@drisp/cli 0.7.12 → 0.7.14

package/dist/cli.js

@@ -9,6 +9,10 @@ import {
   RUN_EXIT_CODE,
   ServiceNotEnabledError,
   approvalAnswer,
+  assignmentPageSchema,
+  assignmentReportSchema,
+  assignmentRevisionSchema,
+  assignmentSchema,
   attachRuntimeEventLoop,
   attemptForecast,
   behindMain,
@@ -20,18 +24,30 @@ import {
   buildPostByToolUseId,
   buildProbeConfigs,
   calibrationSchema,
+  cancelProgress,
   centerAnsi,
   childWorktreePath,
   classifyFailure,
+  commandProgress,
   commandSchema,
   commitBuildFiles,
   compactText,
+  completionPackageSchema,
   computeInputRows,
   connectAlreadyConnectedSchema,
   connectCodeResponseSchema,
   connectPendingResponseSchema,
   connectRedeemResponseSchema,
   connectStartResponseSchema,
+  controlProgress,
+  controlRequestSchema,
+  coordinationActivityPageSchema,
+  coordinationBriefSchema,
+  coordinationCommandResultSchema,
+  coordinationCommandSchema,
+  coordinationInboxEventSchema,
+  coordinationSpendSchema,
+  coordinatorSchema,
   createFeedMapper,
   createLocalFeedSink,
   createRuntime,
@@ -39,10 +55,26 @@ import {
   credentialHelperKey,
   cursorToVisualPosition,
   defaultWorktreesRoot,
+  describeChecks,
   detectClaudeVersion,
   eligibilityReason,
   ensureBuildWorktree,
   ensureChildWorktree,
+  executionActivationSchema,
+  executionCancellationSchema,
+  executionControlState,
+  executionHierarchySchema,
+  executionMessageSchema,
+  executionOutcomeSchema,
+  executionPageSchema,
+  executionQuestionPageSchema,
+  executionQuestionSchema,
+  executionSchema,
+  executionStepsSchema,
+  executionWorkflowPageSchema,
+  executionWorkflowRevisionPageSchema,
+  executionWorkflowRevisionSchema,
+  executionWorkflowSchema,
   expandHome,
   extractFriendlyServerName,
   extractPermissionSnapshot,
@@ -71,10 +103,12 @@ import {
   historyRecordSchema,
   hubHttpUrl,
   identityHubOrigin,
+  inboxCursorSchema,
   isBashToolResponse,
   isCommandPrefix,
   isGitHubRepository,
   isScopedPermissionsRequest,
+  judgeChecks,
   lastCommitTouching,
   listAwaitingAttentionRuns,
   listHarnessAdapters,
@@ -85,9 +119,11 @@ import {
   lookupCredential,
   machineInstallationId,
   makeSkippedProbe,
+  maxClientCancelBoundaryGraceMs,
   mergeFeedItems,
   mergeGuidance,
   messageGlyphs,
+  messageProgress,
   overriddenIdentityPath,
   parseFrontmatter,
   parseToolName,
@@ -97,6 +133,9 @@ import {
   probeSkipReason,
   processRegistry,
   progressGlyphs,
+  qaRoundPageSchema,
+  readCheckList,
+  recoveryEpisodeSchema,
   register,
   registerCleanupOnExit,
   releaseMcpAsset,
@@ -112,8 +151,12 @@ import {
   resolveHookForwarderCommand,
   resolveRuntimeAuthOverlay,
   resolveToolColumn,
+  reviewRoundPageSchema,
   runClaudeAuthStatus,
   runConfiguredRunner,
+  runControlCommandResultSchema,
+  runControlCommandSchema,
+  runControlRecordSchema,
   runExec,
   runMachineRunners,
   runProbe,
@@ -130,21 +173,131 @@ import {
   runnerSoftwareVersion,
   runnerUpdateRequestSchema,
   scopeFingerprint,
+  selectWorkPath,
   serviceInstallationId,
   sessionsDir,
   sliceAnsi,
   spaces,
   startDashboardDecisionDrain,
   startWorkflowExecution,
+  supportedOperations,
   supportsSessionApproval,
   teamDefaultRequestSchema,
   teamDefaultSchema,
   teamIdentityPath,
   todoGlyphSet,
+  trackerImportPreviewSchema,
+  trackerIssueSchema,
+  trackerOperationSchema,
+  trackerSnapshotSchema,
   visualPositionToOffset,
+  workActivityPageSchema,
+  workAttachmentCheckPageSchema,
+  workAttachmentPageSchema,
+  workAttachmentSchema,
+  workAttentionActivityPageSchema,
+  workAttentionCommandResultSchema,
+  workAttentionCommandSchema,
+  workAttentionRequestPageSchema,
+  workAttentionRequestSchema,
+  workAuthoritySchema,
+  workCandidatePageSchema,
+  workCandidateSchema,
+  workCandidateSelectionSchema,
+  workClientContract,
+  workClientContractHeader,
+  workClientUnsupported,
+  workCommandResultSchema,
+  workCommandSchema,
+  workCommentPageSchema,
+  workCommentRevisionPageSchema,
+  workCommentSchema,
+  workDeliveryMigrationPageSchema,
+  workDeliveryWorkflowPageSchema,
+  workDeliveryWorkflowRevisionPageSchema,
+  workDeliveryWorkflowRevisionSchema,
+  workDeliveryWorkflowSchema,
+  workDependencyGateSchema,
+  workDeploymentActivityPageSchema,
+  workDeploymentCommandResultSchema,
+  workDeploymentCommandSchema,
+  workDeploymentPageSchema,
+  workDeploymentSchema,
+  workDiscussionActivityPageSchema,
+  workDiscussionCommandResultSchema,
+  workDiscussionCommandSchema,
+  workEvidenceActivityPageSchema,
+  workEvidenceCommandResultSchema,
+  workEvidenceCommandSchema,
+  workEvidencePageSchema,
+  workEvidenceSchema,
+  workExecutionBindingPageSchema,
+  workExecutionBindingSchema,
+  workExecutionPolicySchema,
+  workExecutionReservationPageSchema,
+  workExecutionReservationSchema,
+  workImportBatchPageSchema,
+  workImportBatchSchema,
+  workImportCommandResultSchema,
+  workImportCommandSchema,
+  workImportComponentPageSchema,
+  workImportItemPageSchema,
+  workImportOutcomePageSchema,
+  workImportSnapshotSchema,
+  workIssueAssigneePageSchema,
+  workIssueLabelPageSchema,
+  workIssueMembershipSchema,
+  workIssuePageSchema,
+  workIssueRelationPageSchema,
+  workIssueRelationSchema,
+  workIssueReservationSchema,
+  workIssueSchema,
+  workIssueTransitionsSchema,
+  workLabelIssuePageSchema,
+  workLabelPageSchema,
+  workLabelSchema,
+  workLegacyAliasSchema,
+  workLifecycleEventPageSchema,
+  workMembershipActivityPageSchema,
+  workMembershipCommandResultSchema,
+  workMembershipCommandSchema,
+  workPageSchema,
+  workPendingRelationActivityPageSchema,
+  workPendingRelationCommandResultSchema,
+  workPendingRelationCommandSchema,
+  workPendingRelationPageSchema,
+  workPendingRelationSchema,
+  workPlanPageSchema,
+  workPlanSchema,
+  workProductionTrailPageSchema,
+  workRelationActivityPageSchema,
+  workRelationCommandResultSchema,
+  workRelationCommandSchema,
+  workReservationActivityPageSchema,
+  workReservationCommandResultSchema,
+  workReservationCommandSchema,
+  workScopeRevisionPageSchema,
+  workSourceActivityPageSchema,
+  workSourceAliasPageSchema,
+  workSourceAssociationPageSchema,
+  workSourceCommandResultSchema,
+  workSourceCommandSchema,
+  workSourceKeyLifecycleSchema,
+  workSourcePrincipalPageSchema,
+  workSourcePrincipalSchema,
+  workSourceReferencePageSchema,
+  workSourceReferenceSchema,
+  workSourceSpacePageSchema,
+  workSourceSpaceSchema,
+  workThreadSchema,
+  workTranscriptHistorySchema,
+  workTranscriptLinkPageSchema,
+  workTranscriptLinkSchema,
+  workVerificationAttemptPageSchema,
+  workVerificationAttemptSchema,
   wrapText,
   writeIdentityOnce
-} from "./chunk-UUUCDIHI.js";
+} from "./chunk-HCTFAAGU.js";
 import {
   generateId as generateId2
 } from "./chunk-PQIB66SG.js";
@@ -162,6 +315,7 @@ import {
   CANNOT_PASS_TEMPLATE,
   DESCRIPTION_TEMPLATE,
   GATES,
+  GATE_NAMES,
   LAYOUT_MARKERS,
   MERGE_SIGN_OFF,
   NO_GATE_TEXT_TEMPLATE,
@@ -172,6 +326,7 @@ import {
   WORKFLOW_MD_TEMPLATE,
   collectMcpServersWithOptions,
   createSteerQueue,
+  describeIgnoredGate,
   deserializeRunMemory,
   external_exports,
   findMarketplaceRepoDir,
@@ -185,6 +340,7 @@ import {
   listMarketplaceWorkflows,
   listMarketplaceWorkflowsFromRepo,
   listWorkflows,
+  parseGateFlags,
   parseWorkflowConfig,
   projectConfigPath,
   pullMarketplaceRepo,
@@ -196,6 +352,7 @@ import {
   resolveWorkflow,
   resolveWorkflowInstall,
   resolveWorkflowMarketplaceSource,
+  tightenGates,
   updateWorkflow,
   updateWorkflows,
   verifyRendered,
@@ -203,7 +360,7 @@ import {
   workflowRegistryDir,
   writeGlobalConfig,
   writeProjectConfig
-} from "./chunk-SACVOS6T.js";
+} from "./chunk-GGAPZULS.js";
 import {
   __toESM
 } from "./chunk-G3PMV62Z.js";
@@ -211,10 +368,10 @@ import {
 // src/app/entry/cli.tsx
 import { render } from "ink";
 import meow from "meow";
-import fs13 from "fs";
+import fs15 from "fs";
 import { createRequire } from "module";
-import os5 from "os";
-import path13 from "path";
+import os6 from "os";
+import path16 from "path";
 import { fileURLToPath } from "url";
 
 // src/app/shell/sessionUiState.ts
@@ -638,7 +795,7 @@ function reduceSessionUiState(state, action, ctx) {
 
 // src/app/shell/sessionUiController.ts
 function createSessionUiController(update, context) {
-  const dispatch = (...actions) => update((state) => {
+  const dispatch2 = (...actions) => update((state) => {
     const ctx = context();
     return resolveSessionUiState(
       actions.reduce(
@@ -649,61 +806,61 @@ function createSessionUiController(update, context) {
     );
   });
   return {
-    focus: (focusMode) => dispatch({ type: "set_focus_mode", focusMode }),
-    cycleFocus: () => dispatch({ type: "cycle_focus" }),
+    focus: (focusMode) => dispatch2({ type: "set_focus_mode", focusMode }),
+    cycleFocus: () => dispatch2({ type: "cycle_focus" }),
     input: (mode) => {
       switch (mode) {
         case "cancel":
-          dispatch({ type: "cancel_input" });
+          dispatch2({ type: "cancel_input" });
           break;
         case "command-open":
-          dispatch({ type: "open_command_input" });
+          dispatch2({ type: "open_command_input" });
           break;
         case "search-open":
-          dispatch({ type: "open_search_input" });
+          dispatch2({ type: "open_search_input" });
           break;
         case "normal-open":
-          dispatch({ type: "open_normal_input" });
+          dispatch2({ type: "open_normal_input" });
           break;
         case "search":
         case "command":
         case "normal":
-          dispatch({ type: "set_input_mode", inputMode: mode });
+          dispatch2({ type: "set_input_mode", inputMode: mode });
       }
     },
-    cycleHints: () => dispatch({ type: "cycle_hints_forced" }),
-    hideOverlay: () => dispatch({ type: "set_show_run_overlay", show: false }),
+    cycleHints: () => dispatch2({ type: "cycle_hints_forced" }),
+    hideOverlay: () => dispatch2({ type: "set_show_run_overlay", show: false }),
     search: {
-      edit: (query) => dispatch({ type: "set_search_query", query }),
-      submit: (query, firstMatchIndex) => dispatch({ type: "submit_search_query", query, firstMatchIndex }),
-      step: (direction, matches) => dispatch({ type: "step_search_match", direction, matches }),
-      clear: () => dispatch({ type: "clear_search_and_jump_tail" })
+      edit: (query) => dispatch2({ type: "set_search_query", query }),
+      submit: (query, firstMatchIndex) => dispatch2({ type: "submit_search_query", query, firstMatchIndex }),
+      step: (direction, matches) => dispatch2({ type: "step_search_match", direction, matches }),
+      clear: () => dispatch2({ type: "clear_search_and_jump_tail" })
     },
     navigate: (panel, destination) => {
       if (typeof destination === "number")
-        dispatch(
+        dispatch2(
           panel === "feed" ? { type: "move_feed_cursor", delta: destination } : { type: "scroll_message_viewport", delta: destination }
         );
       else if (panel === "feed")
-        dispatch({
+        dispatch2({
           type: destination === "top" ? "jump_feed_top" : "jump_feed_tail"
         });
       else
-        dispatch({
+        dispatch2({
           type: destination === "top" ? "jump_message_top" : "jump_message_tail"
         });
     },
     // Wheel navigation selects its panel and moves it in the same update.
-    scrollPanel: (panel, delta) => dispatch(
+    scrollPanel: (panel, delta) => dispatch2(
       { type: "set_focus_mode", focusMode: panel },
       panel === "feed" ? { type: "move_feed_cursor", delta } : { type: "scroll_message_viewport", delta }
     ),
-    reveal: (cursor) => dispatch({ type: "reveal_feed_entry", cursor }),
-    messageTab: (tab) => dispatch({ type: "set_message_tab", tab }),
+    reveal: (cursor) => dispatch2({ type: "reveal_feed_entry", cursor }),
+    messageTab: (tab) => dispatch2({ type: "set_message_tab", tab }),
     todo: {
-      toggle: () => dispatch({ type: "toggle_todo_visible" }),
-      move: (delta) => dispatch({ type: "move_todo_cursor", delta }),
-      show: () => dispatch({ type: "set_todo_visible", visible: true })
+      toggle: () => dispatch2({ type: "toggle_todo_visible" }),
+      move: (delta) => dispatch2({ type: "move_todo_cursor", delta }),
+      show: () => dispatch2({ type: "set_todo_visible", visible: true })
     }
   };
 }
@@ -2807,7 +2964,7 @@ function useWorkflowSessionController(base, input) {
     }
     setIsRunning(false);
   }, [base, cancelCurrentRun]);
-  const spawn = useCallback6(
+  const spawn2 = useCallback6(
     async (prompt, continuation, _configOverride) => {
       await cancelCurrentRun();
       const latest = input.store?.getLatestRun();
@@ -2879,7 +3036,7 @@ function useWorkflowSessionController(base, input) {
   }, []);
   return {
     ...base,
-    startTurn: spawn,
+    startTurn: spawn2,
     isRunning,
     interrupt,
     kill,
@@ -3787,7 +3944,7 @@ function textInputReducer(state, action) {
 }
 function useTextInput(options = {}) {
   const { onChange, onSubmit, isActive = true } = options;
-  const [state, dispatch] = useReducer(textInputReducer, {
+  const [state, dispatch2] = useReducer(textInputReducer, {
     value: "",
     cursorOffset: 0
   });
@@ -3806,7 +3963,7 @@ function useTextInput(options = {}) {
     onChangeRef.current?.(state.value);
   }, [state.value]);
   const setValue = useCallback7((newValue) => {
-    dispatch({ type: "set-value", value: newValue });
+    dispatch2({ type: "set-value", value: newValue });
   }, []);
   const { stdin } = useStdin();
   const isForwardDeleteRef = useRef5(false);
@@ -3846,47 +4003,47 @@ function useTextInput(options = {}) {
         if (key.return) {
           const { value: val, cursorOffset: cur } = stateRef.current;
           if (cur > 0 && val[cur - 1] === "\\") {
-            dispatch({ type: "newline-escape" });
+            dispatch2({ type: "newline-escape" });
           } else {
             onSubmitRef.current?.(val);
           }
           return;
         }
         if (key.leftArrow) {
-          dispatch(key.ctrl ? { type: "move-home" } : { type: "move-left" });
+          dispatch2(key.ctrl ? { type: "move-home" } : { type: "move-left" });
           return;
         }
         if (key.rightArrow) {
-          dispatch(key.ctrl ? { type: "move-end" } : { type: "move-right" });
+          dispatch2(key.ctrl ? { type: "move-end" } : { type: "move-right" });
           return;
         }
         if (key.home) {
-          dispatch({ type: "move-home" });
+          dispatch2({ type: "move-home" });
           return;
         }
         if (key.end) {
-          dispatch({ type: "move-end" });
+          dispatch2({ type: "move-end" });
           return;
         }
         if (key.ctrl) {
-          if (input === "a") dispatch({ type: "move-home" });
-          else if (input === "e") dispatch({ type: "move-end" });
-          else if (input === "w") dispatch({ type: "delete-word-back" });
-          else if (input === "u") dispatch({ type: "clear-line" });
-          else if (input === "d") dispatch({ type: "delete-forward" });
+          if (input === "a") dispatch2({ type: "move-home" });
+          else if (input === "e") dispatch2({ type: "move-end" });
+          else if (input === "w") dispatch2({ type: "delete-word-back" });
+          else if (input === "u") dispatch2({ type: "clear-line" });
+          else if (input === "d") dispatch2({ type: "delete-forward" });
           return;
         }
         if (key.backspace || key.delete) {
           if (isForwardDeleteRef.current) {
             isForwardDeleteRef.current = false;
-            dispatch({ type: "delete-forward" });
+            dispatch2({ type: "delete-forward" });
           } else {
-            dispatch({ type: "backspace" });
+            dispatch2({ type: "backspace" });
           }
           return;
         }
         if (input && !key.meta) {
-          dispatch({ type: "insert", char: input });
+          dispatch2({ type: "insert", char: input });
         }
       } finally {
         done();
@@ -3898,7 +4055,7 @@ function useTextInput(options = {}) {
     value: state.value,
     cursorOffset: state.cursorOffset,
     setValue,
-    dispatch
+    dispatch: dispatch2
   };
 }
 
@@ -4003,7 +4160,7 @@ var ShellInputImpl = forwardRef(function ShellInput({
   commandSuggestionsEnabled,
   wrapSuggestionLine
 }, ref) {
-  const { value, cursorOffset, setValue, dispatch } = useTextInput({
+  const { value, cursorOffset, setValue, dispatch: dispatch2 } = useTextInput({
     onChange,
     onSubmit,
     isActive: isInputActive
@@ -4128,7 +4285,7 @@ var ShellInputImpl = forwardRef(function ShellInput({
           const recalled = historyBackRef.current?.(currentValue);
           if (recalled !== void 0) applyProgrammaticValue(recalled);
         } else {
-          dispatch({ type: "move-up", width: inputContentWidth });
+          dispatch2({ type: "move-up", width: inputContentWidth });
         }
         return;
       }
@@ -4142,11 +4299,11 @@ var ShellInputImpl = forwardRef(function ShellInput({
           const recalled = historyForwardRef.current?.();
           if (recalled !== void 0) applyProgrammaticValue(recalled);
         } else {
-          dispatch({ type: "move-down", width: inputContentWidth });
+          dispatch2({ type: "move-down", width: inputContentWidth });
         }
       }
     },
-    [applyProgrammaticValue, dispatch, inputContentWidth, showSuggestions]
+    [applyProgrammaticValue, dispatch2, inputContentWidth, showSuggestions]
   );
   useInput7(handleArrows, { isActive: isInputActive });
   const lines = renderInputLines(
@@ -5333,14 +5490,14 @@ function extractWebSearch(_input, response) {
   return { type: "text", content: extractTextContent(response), maxLines: 10 };
 }
 function extractNotebookEdit(input, _response) {
-  const path14 = typeof input["notebook_path"] === "string" ? input["notebook_path"] : "";
+  const path17 = typeof input["notebook_path"] === "string" ? input["notebook_path"] : "";
   const mode = typeof input["edit_mode"] === "string" ? input["edit_mode"] : "replace";
   const source = typeof input["new_source"] === "string" ? input["new_source"] : "";
-  if (!source) return { type: "text", content: `${mode} cell in ${path14}` };
+  if (!source) return { type: "text", content: `${mode} cell in ${path17}` };
   return {
     type: "code",
     content: source,
-    language: detectLanguage(path14),
+    language: detectLanguage(path17),
     maxLines: 10
   };
 }
@@ -5866,10 +6023,10 @@ function extractToolSubject(toolName, toolInput) {
       const parts = [];
       const pattern = str(input, "pattern");
       const glob = str(input, "glob");
-      const path14 = str(input, "path");
+      const path17 = str(input, "path");
       if (pattern) parts.push(`"${pattern}"`);
       if (glob) parts.push(glob);
-      if (path14) parts.push(`in ${path14}`);
+      if (path17) parts.push(`in ${path17}`);
       return parts.length > 0 ? parts.join("  ") : void 0;
     }
     case "Skill":
@@ -5902,9 +6059,13 @@ function eventLabel(event) {
       return event.data.scope === "subagent" ? "Subagent" : "Agent";
     case "user.prompt":
       return "User";
+    case "system.wake":
+      return "Wake";
     case "subagent.start":
     case "subagent.stop":
       return `Subagent \xB7 ${event.data.agent_type}`;
+    case "subagent.task":
+      return `Subagent \xB7 ${event.data.subagent_type ?? event.data.task_id}`;
     case "run.start":
       return "Run Start";
     case "run.end":
@@ -6014,11 +6175,17 @@ function renderDetailLines(event, width, pairedPostEvent, theme = darkTheme) {
       const content = renderMarkdownToLines(event.data.message, cw);
       return buildResult(header, content, false);
     }
-    case "user.prompt": {
+    case "user.prompt":
+    case "system.wake": {
       const header = buildCompactHeader(event, width, { theme });
       const content = renderMarkdownToLines(event.data.prompt, cw);
       return buildResult(header, content, false);
     }
+    case "subagent.task": {
+      const header = buildCompactHeader(event, width, { theme });
+      const json2 = JSON.stringify(event.data, null, 2);
+      return buildResult(header, highlightCode(json2, cw, "json"), true);
+    }
     case "tool.post":
     case "tool.delta":
     case "tool.failure":
@@ -8440,8 +8607,8 @@ function formatStatsSnapshot(snapshot) {
 function truncateSessionId(id, maxWidth) {
   if (id.length <= maxWidth) return id;
   if (maxWidth >= 12) {
-    const tail = id.slice(-6);
-    return id.slice(0, maxWidth - 7) + "\u2026" + tail;
+    const tail2 = id.slice(-6);
+    return id.slice(0, maxWidth - 7) + "\u2026" + tail2;
   }
   const alphanumeric = id.replace(/[^a-zA-Z0-9]/g, "").slice(-4);
   return "S" + (alphanumeric || "\u2013");
@@ -9951,10 +10118,11 @@ function deriveStartupTimeoutFailure(args) {
 
 // src/app/shell/resolveAllowedTools.ts
 var BASELINE_ALLOWED_TOOLS = ["mcp__*"];
-function resolveAllowedTools(harness, allowedTools) {
+function resolveAllowedTools(harness, allowedTools, workflowAllowedTools = []) {
   const extras = [
     ...BASELINE_ALLOWED_TOOLS,
-    ...resolveHarnessAdapter(harness).capabilities.extraAllowedTools
+    ...resolveHarnessAdapter(harness).capabilities.extraAllowedTools,
+    ...workflowAllowedTools
   ];
   const merged = [...allowedTools ?? []];
   for (const tool of extras) {
@@ -11776,7 +11944,8 @@ function App({
       workflow: runtimeState.workflow,
       allowedTools: resolveAllowedTools(
         runtimeState.harness,
-        runtimeState.isolation?.allowedTools
+        runtimeState.isolation?.allowedTools,
+        runtimeState.workflow?.allowedTools
       ),
       athenaSessionId,
       children: /* @__PURE__ */ jsx23(
@@ -12206,6 +12375,19 @@ async function runExecCommand(input, deps = {}) {
     );
     return RUN_EXIT_CODE.USAGE;
   }
+  let buildGates;
+  try {
+    buildGates = parseGateFlags(input.flags.gates);
+  } catch (error) {
+    logError(`Error: ${error.message}`);
+    return RUN_EXIT_CODE.USAGE;
+  }
+  const gates = tightenGates(input.runtimeConfig.gates, buildGates);
+  for (const gate of gates.ignored) {
+    logError(
+      `Warning: ${describeIgnoredGate({ gate, source: "--gate", floor: "configured" })}`
+    );
+  }
   let continueResolution;
   try {
     continueResolution = resolveResumeTarget({
@@ -12258,6 +12440,16 @@ async function runExecCommand(input, deps = {}) {
     ephemeral: input.flags.ephemeral,
     timeoutMs: input.flags.timeoutMs,
     permissionGraceMs: graceMs ?? input.runtimeConfig.permissionGraceMs,
+    gates: gates.gates,
+    gateProvenance: {
+      ...input.runtimeConfig.settingsProvenance?.gates,
+      // A gate --gate tightened was set by this Build.
+      ...Object.fromEntries(
+        GATE_NAMES.filter(
+          (name) => gates.gates[name] !== input.runtimeConfig.gates[name]
+        ).map((name) => [name, "build"])
+      )
+    },
     ...answer !== void 0 ? { storedAnswer: localAnswerDecision(answer) } : {},
     // Reporting-only summary: strip to name + source layer so secret-bearing
     // MCP env/command/args and skill paths never reach the startup notice or
@@ -13100,7 +13292,7 @@ var thisMachine = (installationId) => ({
   os: `${platform()} ${release()}`.slice(0, 64),
   softwareVersion: runnerSoftwareVersion
 });
-var post = (origin, path14, body) => fetch(new URL(path14, origin), {
+var post = (origin, path17, body) => fetch(new URL(path17, origin), {
   method: "POST",
   headers: { "Content-Type": "application/json" },
   body: JSON.stringify(body)
@@ -13119,8 +13311,8 @@ async function alreadyConnected(existing, { forTeam, ownIdentity }) {
   const problem = own ? await credentialAccepted(own.config) ? void 0 : "lapsed" : forTeam(existing.orgId).length ? "other_runner" : "missing";
   const runner = { orgId: existing.orgId, runnerId: existing.runnerId, name: existing.name };
   if (own && problem === void 0) return { status: "already_connected", ...runner, path: own.path };
-  const path14 = (own ?? forTeam(existing.orgId)[0])?.path;
-  return { status: "identity_unusable", ...runner, problem, ...path14 ? { path: path14 } : {} };
+  const path17 = (own ?? forTeam(existing.orgId)[0])?.path;
+  return { status: "identity_unusable", ...runner, problem, ...path17 ? { path: path17 } : {} };
 }
 async function connectWithCode({
   code,
@@ -13192,20 +13384,20 @@ async function saveIdentity(origin, credential, { single, forTeam }, directory)
     name: credential.name
   });
   const replaced = [];
-  for (const { path: path15 } of forTeam(credential.orgId)) {
-    const aside = `${path15}.replaced-${Date.now()}`;
-    await rename(path15, aside);
+  for (const { path: path18 } of forTeam(credential.orgId)) {
+    const aside = `${path18}.replaced-${Date.now()}`;
+    await rename(path18, aside);
     replaced.push(aside);
   }
-  const path14 = single ?? teamIdentityPath(origin, credential.orgId, directory);
+  const path17 = single ?? teamIdentityPath(origin, credential.orgId, directory);
   try {
-    await writeIdentityOnce(path14, JSON.stringify(config, null, 2) + "\n");
+    await writeIdentityOnce(path17, JSON.stringify(config, null, 2) + "\n");
   } catch (error) {
     if (error.code === "EEXIST")
-      throw new Error(`Another Connect wrote a Runner identity for this Team at ${path14} meanwhile; it was left unchanged.`);
+      throw new Error(`Another Connect wrote a Runner identity for this Team at ${path17} meanwhile; it was left unchanged.`);
     throw error;
   }
-  return { status: "connected", config, path: path14, replaced };
+  return { status: "connected", config, path: path17, replaced };
 }
 function pathSegment(value) {
   const segment = encodeURIComponent(value);
@@ -13245,7 +13437,7 @@ async function refuseExisting(target) {
   throw new Error(`This machine already has a Runner${name ? ` (${name})` : ""} configured at ${target}.`);
 }
 async function disconnectRunner({
-  identity: { path: path14, config },
+  identity: { path: path17, config },
   serviceManager,
   othersRemain
 }) {
@@ -13278,7 +13470,7 @@ async function disconnectRunner({
     await restore();
     throw new Error(`The Hub refused to disconnect ${name} (${body.error ?? response.status}); it is still connected.`);
   }
-  await forgetRunner(path14);
+  await forgetRunner(path17);
   if (othersRemain) await restore();
   else await serviceManager?.remove();
   return result;
@@ -13431,18 +13623,18 @@ async function runRunnerCommandV2(input, options = {}) {
             `This machine is already connected to this Team as ${outcome.name}, but ${why}. ` + (code ? `The code was not used: connect a new Runner in its place with ${retry}. ` : `Connect a new Runner in its place with a Connect code from Settings \u2192 Runners: ${retry}. `) + `The old ${outcome.name} stays listed in Settings \u2192 Runners, offline.`
           );
         }
-        const { config, path: path14, replaced } = outcome;
+        const { config, path: path17, replaced } = outcome;
         for (const aside of replaced)
           process.stdout.write(
             `The Hub no longer recognised this machine's earlier identity for this Team; it was moved aside to ${aside}.
 `
           );
         process.stdout.write(
-          `Connected as ${config.name ?? config.runnerId}. Identity saved to ${path14}.
+          `Connected as ${config.name ?? config.runnerId}. Identity saved to ${path17}.
 `
         );
         if (services) {
-          const service = await ensureService(services, config, path14);
+          const service = await ensureService(services, config, path17);
           process.stdout.write(`${serviceStarted(service)}
 `);
           return 0;
@@ -13451,7 +13643,7 @@ async function runRunnerCommandV2(input, options = {}) {
           process.stdout.write(
             "No launchd or systemd here to run the Runner as a background service; running it in the foreground instead.\n"
           );
-        await runConfiguredRunner(path14, options.signal);
+        await runConfiguredRunner(path17, options.signal);
         return 0;
       }
       case "disconnect": {
@@ -13522,9 +13714,9 @@ async function runRunnerCommandV2(input, options = {}) {
               configured: true,
               // One entry per Team this machine serves; credentials are never printed.
               teams: identities.map(
-                ({ path: path14, config: { token: _token, ...config } }) => ({
+                ({ path: path17, config: { token: _token, ...config } }) => ({
                   ...config,
-                  path: path14
+                  path: path17
                 })
               ),
               service: service ? {
@@ -13832,7 +14024,368 @@ import { randomUUID as randomUUID2 } from "crypto";
 import fs7 from "fs";
 import path7 from "path";
 
+// ../../packages/client/src/work-flows.ts
+var WorkFlowError = class extends Error {
+  constructor(code, details = {}) {
+    super(code);
+    this.code = code;
+    this.details = details;
+  }
+  code;
+  details;
+};
+var execution = (result) => {
+  const o = result.outcome;
+  if (o.kind === "execution" || o.kind === "assignment" || o.kind === "package" || o.kind === "effect") return o.execution;
+  throw new WorkFlowError("unexpected_outcome", { kind: o.kind });
+};
+var WorkFlows = class {
+  constructor(client2, teamId, commandId = () => crypto.randomUUID(), pageSize = 20) {
+    this.client = client2;
+    this.teamId = teamId;
+    this.commandId = commandId;
+    this.pageSize = pageSize;
+  }
+  client;
+  teamId;
+  commandId;
+  pageSize;
+  /**
+   * The Team's path. A Hub without the authority route (`not_found` with HTTP 404) predates this contract and has no
+   * execution switch, so it is `legacy`; every other failure is thrown.
+   */
+  async path() {
+    try {
+      return selectWorkPath(await this.client.workAuthority());
+    } catch (error) {
+      if (error instanceof ClientError && error.code === "not_found" && error.status === 404) return selectWorkPath(null);
+      throw error;
+    }
+  }
+  async operations() {
+    return supportedOperations(await this.path());
+  }
+  /** Refuses (before any write) an operation the Team's path does not give canonical clients. */
+  async require(operation) {
+    const path17 = await this.path();
+    if (path17.kind === "unsupported") throw new WorkFlowError(path17.code, { minimum: path17.minimum, current: path17.current });
+    if (!supportedOperations(path17).includes(operation))
+      throw new WorkFlowError(path17.execution === "legacy" && path17.work === "core" && !operation.startsWith("work.") && operation !== "history.read" ? "execution_authority_legacy" : "work_authority_legacy", { path: path17.kind, operation });
+  }
+  /** Names an operation the clients deliberately do not offer, with the reason; `undefined` when it is offered. */
+  static unsupported(type) {
+    return workClientUnsupported[type];
+  }
+  async send(body, commandId) {
+    return this.client.coordinationCommand({ version: 1, teamId: this.teamId, commandId: commandId ?? this.commandId(), ...body });
+  }
+  // ── Reads: canonical Work records, one page of each collection ──
+  async readIssue(id) {
+    await this.require("work.read");
+    const page = { limit: this.pageSize };
+    const issue = await this.client.workIssue(id);
+    const [occupancy, executions, attention, evidence, history, transcripts] = await Promise.all([
+      this.client.workIssueReservation(id),
+      this.client.workIssueExecutions(id, page),
+      this.client.workIssueAttention(id, page),
+      this.client.workIssueEvidence(id, page),
+      this.client.workIssueActivity(id, page),
+      this.client.workThreadTranscriptLinks(issue.threadId, page)
+    ]);
+    return { issue, occupancy, executions, attention, evidence, history, transcripts };
+  }
+  async readPlan(id) {
+    await this.require("work.read");
+    const page = { limit: this.pageSize };
+    const [plan, issues, executions, history] = await Promise.all([
+      this.client.workPlan(id),
+      this.client.workIssues({ ...page, planId: id }),
+      this.client.workPlanExecutions(id, page),
+      this.client.workPlanActivity(id, page)
+    ]);
+    return { plan, issues, executions, history };
+  }
+  // ── Start, follow-up, inspect ──
+  /**
+   * Starts a canonical execution of an Issue (through its reservation) or a Plan. Never a legacy Build: under legacy
+   * execution authority this refuses before writing. An occupied Issue answers with its owner.
+   */
+  async start(scope, options = {}) {
+    await this.require("execution.start");
+    try {
+      const result = await this.send({ type: "execution.start", target: scope, payload: {
+        ...options.contract ? { contract: options.contract } : {},
+        ...options.limits ? { limits: options.limits } : {},
+        ...options.activation ? { activation: options.activation } : {},
+        ...options.expectedScopeRevision ? { expectedScopeRevision: options.expectedScopeRevision } : {}
+      } }, options.commandId);
+      return { kind: "started", command: commandProgress(result), replayed: result.replayed, execution: execution(result) };
+    } catch (error) {
+      if (error instanceof ClientError && error.code === "issue_run_live")
+        return { kind: "occupied", owner: error.details.owner ?? {}, reservation: error.details.reservation ?? null };
+      throw error;
+    }
+  }
+  /** The open execution that owns a scope now: the Issue's reservation owner, or the Plan's newest open execution. */
+  async owner(scope) {
+    if (scope.kind === "issue") {
+      const occupancy = await this.client.workIssueReservation(scope.id);
+      const owner = occupancy.reservation?.owner;
+      if (!occupancy.occupied || !owner) throw new WorkFlowError("not_occupied", { issueId: scope.id });
+      if (owner.kind !== "execution") throw new WorkFlowError("legacy_owner", { runId: owner.runId });
+      return this.client.workExecution(owner.executionId);
+    }
+    let after = null;
+    let open;
+    do {
+      const page = await this.client.workPlanExecutions(scope.id, { after, limit: 100 });
+      open = page.items.filter((e) => e.closure === null).at(-1) ?? open;
+      after = page.nextCursor;
+    } while (after);
+    if (!open) throw new WorkFlowError("not_occupied", { planId: scope.id });
+    return open;
+  }
+  /** Durable input for the coordinator of the scope's (or the named) open execution, recorded in its inbox. */
+  async followUp(target, body, commandId) {
+    await this.require("execution.follow_up");
+    const e = target.kind === "execution" ? await this.client.workExecution(target.id) : await this.owner(target);
+    const result = await this.send({
+      type: "execution.message",
+      target: { kind: "execution", id: e.id },
+      expectedGeneration: e.generation,
+      payload: { body }
+    }, commandId);
+    return { command: commandProgress(result), replayed: result.replayed, executionId: e.id, threadId: e.threadId };
+  }
+  /** Progress, outcomes, controls, questions, messages, specialists and their transcripts: the first page of each. */
+  async inspect(executionId) {
+    await this.require("execution.inspect");
+    const page = { limit: this.pageSize };
+    const e = await this.client.workExecution(executionId);
+    const [outcome, controls, questions, messages, assignments, packages, reports, children, history, transcripts, recoveries] = await Promise.all([
+      this.client.workExecutionOutcome(e.id),
+      this.client.workExecutionControls(e.id, page),
+      this.client.workExecutionQuestions(e.id, page),
+      this.client.workExecutionMessages(e.id, page),
+      this.client.workExecutionAssignments(e.id, page),
+      this.client.workExecutionPackages(e.id, page),
+      this.client.workExecutionReports(e.id, page),
+      this.client.workExecutionChildren(e.id, page),
+      this.client.workExecutionActivity(e.id, page),
+      this.client.workThreadTranscriptLinks(e.threadId, page),
+      this.client.workExecutionRecoveries(e.id, page)
+    ]);
+    const cancellation = await this.cancellation(e.id);
+    return {
+      execution: e,
+      outcome,
+      recoveries,
+      cancellation,
+      cancel: cancellation ? cancelProgress(e, cancellation) : null,
+      controls: { items: controls.items.map(controlProgress), nextCursor: controls.nextCursor },
+      questions,
+      messages: { items: messages.items.map((m) => ({ ...m, progress: messageProgress(m) })), nextCursor: messages.nextCursor },
+      assignments,
+      packages,
+      reports,
+      children,
+      history,
+      transcripts
+    };
+  }
+  /** The newest cancellation, or null when the execution was never cancelled (the read's own `not_found`). */
+  async cancellation(executionId) {
+    try {
+      return await this.client.workExecutionCancellation(executionId);
+    } catch (error) {
+      if (error instanceof ClientError && error.code === "not_found") return null;
+      throw error;
+    }
+  }
+  // ── Controls: requested versus effective ──
+  /**
+   * Holds, releases, pauses, resumes or cancels an execution at the generation the caller observed (read now when not
+   * given). The outcome is `requested` until the Hub records the control effective.
+   */
+  async control(executionId, control, options = {}) {
+    await this.require(`execution.${control}`);
+    const generation = options.expectedGeneration ?? (await this.client.workExecution(executionId)).generation;
+    const reason = options.reason ?? null;
+    if (options.boundaryGraceMs !== void 0 && !(Number.isInteger(options.boundaryGraceMs) && options.boundaryGraceMs >= 0 && options.boundaryGraceMs <= maxClientCancelBoundaryGraceMs))
+      throw new WorkFlowError("invalid_request", { field: "boundaryGraceMs", max: maxClientCancelBoundaryGraceMs });
+    const payload = control === "cancel" ? { reason: reason ?? "Cancelled by a member", ...options.boundaryGraceMs !== void 0 ? { boundaryGraceMs: options.boundaryGraceMs } : {} } : { reason };
+    const result = await this.send({
+      type: `execution.${control}`,
+      target: { kind: "execution", id: executionId },
+      expectedGeneration: generation,
+      payload
+    }, options.commandId);
+    const e = execution(result);
+    const kind = control === "unhold" ? "unhold" : control;
+    const requests = await this.client.workExecutionControls(e.id, { limit: this.pageSize });
+    const request = requests.items.filter((r) => r.control === kind && r.commandId === result.commandId).at(-1);
+    const outcome = {
+      control,
+      command: commandProgress(result),
+      replayed: result.replayed,
+      state: executionControlState(e, control),
+      execution: e,
+      request: request ? controlProgress(request) : null
+    };
+    if (control === "cancel") {
+      const cancellation = await this.cancellation(e.id);
+      outcome.cancellation = cancellation;
+      outcome.cancel = cancelProgress(e, cancellation);
+    }
+    return outcome;
+  }
+  /** Publishes the next version of a specialist assignment (`expectedVersion` its current one). */
+  async revise(assignmentId, changes, reason, options = {}) {
+    await this.require("assignment.revise");
+    const a = await this.client.workAssignment(assignmentId);
+    const result = await this.send({
+      type: "assignment.revise",
+      target: { kind: "assignment", id: assignmentId },
+      expectedGeneration: a.generation,
+      expectedVersion: options.expectedVersion ?? a.assignmentVersion,
+      payload: { changes, reason }
+    }, options.commandId);
+    return result;
+  }
+  // ── Recovery of interrupted work (DRI-325) ──
+  /** Settles an effect of uncertain outcome by inspection, naming what was inspected. Never repeats the effect. */
+  async reconcile(effectId, outcome, evidence, options) {
+    await this.require("effect.reconcile");
+    const result = await this.send({
+      type: "effect.reconcile",
+      target: { kind: "effect", id: effectId },
+      expectedGeneration: options.expectedGeneration,
+      payload: { outcome, evidence }
+    }, options.commandId);
+    return { command: commandProgress(result), replayed: result.replayed, execution: execution(result) };
+  }
+  /** Replaces an interrupted specialist Run of an open assignment with `runId`, once the old one is proven stopped. */
+  async recover(assignmentId, input) {
+    await this.require("assignment.recover");
+    const a = await this.client.workAssignment(assignmentId);
+    const { commandId, runId, ...rest } = input;
+    const result = await this.send({
+      type: "assignment.recover",
+      target: { kind: "assignment", id: assignmentId },
+      expectedGeneration: a.generation,
+      payload: { runId: runId ?? crypto.randomUUID(), ...rest }
+    }, commandId);
+    return result;
+  }
+  /**
+   * A member closes a cancelling execution as cancelled (or an escalated one as failed) once every Run is stopped,
+   * acknowledging exactly the effects still outstanding (the cancellation's `blockers.effectIds`); the acknowledgement
+   * waives their reconciliation, never the proof of stop. `effect.reconcile` settles one by inspection instead.
+   */
+  async close(executionId, outcome, options = {}) {
+    await this.require("execution.close");
+    const generation = options.expectedGeneration ?? (await this.client.workExecution(executionId)).generation;
+    const acknowledgement = options.acknowledge?.length ? { reason: options.reason ?? "Acknowledged by a member", effectIds: options.acknowledge } : null;
+    const result = await this.send({
+      type: "execution.close",
+      target: { kind: "execution", id: executionId },
+      expectedGeneration: generation,
+      payload: { outcome, acknowledgement }
+    }, options.commandId);
+    const e = execution(result);
+    const cancellation = outcome === "cancelled" ? await this.cancellation(e.id) : null;
+    return {
+      command: commandProgress(result),
+      replayed: result.replayed,
+      execution: e,
+      ...outcome === "cancelled" ? { cancel: cancelProgress(e, cancellation), cancellation } : {}
+    };
+  }
+  // ── Questions and acceptance ──
+  /** A member answers any question; a coordinator's credential answers a technical one addressed to it (version from its brief). */
+  async answer(questionId, answer, options = {}) {
+    await this.require("question.answer");
+    const version2 = options.expectedVersion ?? (options.asRun ? (await this.client.workBrief()).questions?.find((q) => q.id === questionId)?.version : (await this.client.workQuestion(questionId)).version);
+    if (version2 === void 0) throw new WorkFlowError("question_not_addressed", { questionId });
+    const result = await this.send({
+      type: "question.answer",
+      target: { kind: "question", id: questionId },
+      expectedVersion: version2,
+      payload: { answer }
+    }, options.commandId);
+    if (result.outcome.kind !== "question") throw new WorkFlowError("unexpected_outcome", { kind: result.outcome.kind });
+    return { command: commandProgress(result), replayed: result.replayed, question: result.outcome.question, delivery: result.outcome.question.answer?.delivery ?? null };
+  }
+  /** Forwards a question one level up: the addressed coordinator's own credential only (a member's is `forbidden`). */
+  async forward(questionId, note, options = {}) {
+    await this.require("question.forward");
+    const version2 = options.expectedVersion ?? (await this.client.workBrief()).questions?.find((q) => q.id === questionId)?.version;
+    if (version2 === void 0) throw new WorkFlowError("question_not_addressed", { questionId });
+    return this.send({ type: "question.forward", target: { kind: "question", id: questionId }, expectedVersion: version2, payload: { note } }, options.commandId);
+  }
+  /** A member accepts or rejects a root execution's package (its contract names the authority). */
+  async decide(executionId, packageId, decision, reason, options = {}) {
+    await this.require("execution.decide");
+    const generation = options.expectedGeneration ?? (await this.client.workExecution(executionId)).generation;
+    const result = await this.send({
+      type: "execution.decide",
+      target: { kind: "execution", id: executionId },
+      expectedGeneration: generation,
+      payload: { packageId, decision, reason }
+    }, options.commandId);
+    return { command: commandProgress(result), replayed: result.replayed, execution: execution(result), outcome: await this.client.workExecutionOutcome(executionId) };
+  }
+  // ── A coordinated Run's own credential ──
+  async brief() {
+    await this.require("run.brief");
+    return this.client.workBrief();
+  }
+  /**
+   * The specialist acknowledges a revision once its own in-flight work is reconciled. `toolUseId` is the harness tool
+   * call carrying this command (the Runner's PreToolUse context): the Hub excludes it from the in-flight check.
+   */
+  async incorporate(assignmentId, version2, options) {
+    await this.require("assignment.incorporate");
+    return this.send({
+      type: "assignment.incorporate",
+      target: { kind: "assignment", id: assignmentId },
+      expectedGeneration: options.generation,
+      payload: { version: version2, ...options.toolUseId ? { toolUseId: options.toolUseId } : {} }
+    }, options.commandId);
+  }
+};
+
 // ../../packages/client/src/index.ts
+function discussionQuery(page) {
+  const query = new URLSearchParams(workQuery(page).slice(1));
+  if (page.parentId) query.set("parentId", page.parentId);
+  if (page.commentId) query.set("commentId", page.commentId);
+  const text = query.toString();
+  return text ? `?${text}` : "";
+}
+function relationQuery(page) {
+  const query = new URLSearchParams(workQuery(page).slice(1));
+  if (page.kind) query.set("kind", page.kind);
+  if (page.state) query.set("state", page.state);
+  const text = query.toString();
+  return text ? `?${text}` : "";
+}
+function workQuery(page = {}) {
+  const query = new URLSearchParams();
+  if (page.after) query.set("after", page.after);
+  if (page.limit !== void 0) query.set("limit", String(page.limit));
+  if (page.planId) query.set("planId", page.planId);
+  if (page.lifecycle) query.set("lifecycle", page.lifecycle);
+  const text = query.toString();
+  return text ? `?${text}` : "";
+}
+function sourceQuery(page) {
+  const query = new URLSearchParams();
+  for (const [key, value] of Object.entries(page))
+    if (value !== void 0 && value !== null && value !== "") query.set(key, String(value));
+  const text = query.toString();
+  return text ? `?${text}` : "";
+}
 var runArtifactSchema = external_exports.object({ name: external_exports.string(), seq: external_exports.number().int(), json: external_exports.json() });
 var githubRepositorySchema = external_exports.object({
   installationId: external_exports.number().int().positive(),
@@ -13842,13 +14395,15 @@ var githubRepositorySchema = external_exports.object({
   defaultBranch: external_exports.string()
 });
 var ClientError = class extends Error {
-  constructor(code, status) {
+  constructor(code, status, details = {}) {
     super(code);
     this.code = code;
     this.status = status;
+    this.details = details;
   }
   code;
   status;
+  details;
 };
 var DrispClient = class _DrispClient {
   constructor(baseUrl, orgId, token) {
@@ -13873,26 +14428,710 @@ var DrispClient = class _DrispClient {
     if (!match) throw new Error("invalid_hub_url");
     return new _DrispClient(url.origin, decodeURIComponent(match[1]), async () => token);
   }
-  async request(path14, body) {
+  async request(path17, body) {
     const response = await fetch(
-      `${this.baseUrl}/v2/orgs/${encodeURIComponent(this.orgId)}${path14}`,
+      `${this.baseUrl}/v2/orgs/${encodeURIComponent(this.orgId)}${path17}`,
       {
         method: body === void 0 ? "GET" : "POST",
         headers: {
           Authorization: `Bearer ${await this.token()}`,
-          "Content-Type": "application/json"
+          "Content-Type": "application/json",
+          // DRI-342: the client contract this build speaks; a Hub refuses one below its minimum (`client_upgrade_required`).
+          [workClientContractHeader]: String(workClientContract)
         },
         ...body === void 0 ? {} : { body: JSON.stringify(body) }
       }
     );
     const result = await response.json();
-    if (!response.ok)
-      throw new ClientError(result.error ?? `HTTP ${response.status}`, response.status);
+    if (!response.ok) {
+      const { error, ...details } = result;
+      throw new ClientError(error ?? `HTTP ${response.status}`, response.status, details);
+    }
     return result;
   }
   submit(command) {
     return this.request("/commands", commandSchema.parse(command));
   }
+  async tracker() {
+    return trackerSnapshotSchema.parse(await this.request("/tracker"));
+  }
+  async trackerIssue(id) {
+    return trackerIssueSchema.parse(await this.request(`/tracker/issues/${encodeURIComponent(id)}`));
+  }
+  trackerOperation(operation) {
+    return this.request("/tracker", trackerOperationSchema.parse(operation));
+  }
+  async previewLinearImport(input) {
+    return trackerImportPreviewSchema.parse(await this.trackerOperation({ kind: "import.preview", input }));
+  }
+  async commitLinearImport(previewId) {
+    return trackerSnapshotSchema.parse(await this.trackerOperation({ kind: "import.commit", previewId }));
+  }
+  startIssue(id, command) {
+    return this.request(`/tracker/issues/${encodeURIComponent(id)}/start`, commandSchema.parse(command));
+  }
+  // ── Attention requests and execution policy (DRI-300) ──
+  /**
+   * Sends one attention or execution-policy command (`attention.request`, `attention.resolve`, `attention.sync_run`,
+   * `execution_policy.hold`, `execution_policy.resume`, `execution_policy.set_agent_eligibility`) on the Work
+   * command route, with its receipts and replay. Resolving attention never answers a Run: answer through `submit`.
+   */
+  async workAttentionCommand(command) {
+    return workAttentionCommandResultSchema.parse(await this.request("/work/commands", workAttentionCommandSchema.parse(command)));
+  }
+  /** An Issue's attention requests, oldest first; `state` narrows to open (its Needs Human) or resolved ones. */
+  async workIssueAttention(id, page = {}) {
+    const query = workQuery(page);
+    const state = page.state ? `${query ? "&" : "?"}state=${page.state}` : "";
+    return workAttentionRequestPageSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/attention${query}${state}`));
+  }
+  async workAttentionRequest(id) {
+    return workAttentionRequestSchema.parse(await this.request(`/work/attention-requests/${encodeURIComponent(id)}`));
+  }
+  async workAttentionActivity(id, page = {}) {
+    return workAttentionActivityPageSchema.parse(
+      await this.request(`/work/attention-requests/${encodeURIComponent(id)}/activity${workQuery(page)}`)
+    );
+  }
+  async workExecutionPolicy(issueId) {
+    return workExecutionPolicySchema.parse(await this.request(`/work/issues/${encodeURIComponent(issueId)}/execution-policy`));
+  }
+  async workExecutionPolicyActivity(issueId, page = {}) {
+    return workAttentionActivityPageSchema.parse(
+      await this.request(`/work/issues/${encodeURIComponent(issueId)}/execution-policy/activity${workQuery(page)}`)
+    );
+  }
+  // ── end DRI-300 ──
+  /**
+   * Sends one versioned Team command to the Work core (DRI-294). The caller retains `commandId` for retries: an
+   * identical retry returns the original result with `replayed: true`; a changed payload is `idempotency_conflict`.
+   */
+  async workCommand(command) {
+    return workCommandResultSchema.parse(await this.request("/work/commands", workCommandSchema.parse(command)));
+  }
+  async workIssue(id) {
+    return workIssueSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}`));
+  }
+  /** Issues by number: active only unless `lifecycle` asks for `archived`, `deleted` or `all` (DRI-304). */
+  async workIssues(page = {}) {
+    return workIssuePageSchema.parse(await this.request(`/work/issues${workQuery(page)}`));
+  }
+  async workIssueActivity(id, page = {}) {
+    return workActivityPageSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/activity${workQuery(page)}`));
+  }
+  async workIssueScopeRevisions(id, page = {}) {
+    return workScopeRevisionPageSchema.parse(
+      await this.request(`/work/issues/${encodeURIComponent(id)}/scope-revisions${workQuery(page)}`)
+    );
+  }
+  async workPlan(id) {
+    return workPlanSchema.parse(await this.request(`/work/plans/${encodeURIComponent(id)}`));
+  }
+  /** Plans by number (DRI-296): active only unless `lifecycle` asks for `archived`, `deleted` or `all` (DRI-304). */
+  async workPlans(page = {}) {
+    return workPlanPageSchema.parse(await this.request(`/work/plans${workQuery(page)}`));
+  }
+  async workPlanActivity(id, page = {}) {
+    return workActivityPageSchema.parse(await this.request(`/work/plans/${encodeURIComponent(id)}/activity${workQuery(page)}`));
+  }
+  // ── Sub-Issue trees (DRI-296); `plan.archive`, `plan.unarchive`, `issue.set_plan`, `issue.set_parent` go through `workCommand` ──
+  /** An Issue's direct children, by number. */
+  async workIssueChildren(id, page = {}) {
+    return workIssuePageSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/children${workQuery(page)}`));
+  }
+  /** An Issue's ancestors, nearest first; each page continues from the last ancestor returned. */
+  async workIssueAncestors(id, page = {}) {
+    return workIssuePageSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/ancestors${workQuery(page)}`));
+  }
+  // ── end DRI-296 ──
+  // ── Lifecycle (DRI-304); `issue.archive`, `issue.delete`, `issue.restore`, `plan.delete`, `plan.restore` go through `workCommand` ──
+  /** An Issue's lifecycle events (completion, cancellation, reopening, archival, tombstone, restoration), oldest first. */
+  async workIssueLifecycle(id, page = {}) {
+    return workLifecycleEventPageSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/lifecycle${workQuery(page)}`));
+  }
+  async workPlanLifecycle(id, page = {}) {
+    return workLifecycleEventPageSchema.parse(await this.request(`/work/plans/${encodeURIComponent(id)}/lifecycle${workQuery(page)}`));
+  }
+  /** Who holds a complete source key and whether that holder is tombstoned: the contract imports consume. */
+  async workSourceKeyLifecycle(key) {
+    return workSourceKeyLifecycleSchema.parse(await this.request(`/work/source-references/lifecycle?${new URLSearchParams(key)}`));
+  }
+  // ── end DRI-304 ──
+  /**
+   * Sends one delivery workflow command (`workflow.create`, `workflow.publish`, `workflow.activate`; DRI-297). Team
+   * admin authority; the same envelope, receipts and replay as `workCommand`.
+   */
+  async workflowCommand(command) {
+    return workCommandResultSchema.parse(await this.request("/work/delivery-workflows/commands", workCommandSchema.parse(command)));
+  }
+  async deliveryWorkflows(page = {}) {
+    return workDeliveryWorkflowPageSchema.parse(await this.request(`/work/delivery-workflows${workQuery(page)}`));
+  }
+  /** One delivery workflow; `active` names the Team's active one. */
+  async deliveryWorkflow(id = "active") {
+    return workDeliveryWorkflowSchema.parse(await this.request(`/work/delivery-workflows/${encodeURIComponent(id)}`));
+  }
+  async deliveryWorkflowRevision(id, revision) {
+    return workDeliveryWorkflowRevisionSchema.parse(
+      await this.request(`/work/delivery-workflows/${encodeURIComponent(id)}/revisions/${revision}`)
+    );
+  }
+  async deliveryWorkflowRevisions(id, page = {}) {
+    return workDeliveryWorkflowRevisionPageSchema.parse(
+      await this.request(`/work/delivery-workflows/${encodeURIComponent(id)}/revisions${workQuery(page)}`)
+    );
+  }
+  async deliveryMigrations(page = {}) {
+    return workDeliveryMigrationPageSchema.parse(await this.request(`/work/delivery-migrations${workQuery(page)}`));
+  }
+  /** The moves out of an Issue's current status, each evaluated for the caller by the Hub's gate evaluator. */
+  async workIssueTransitions(id) {
+    return workIssueTransitionsSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/transitions`));
+  }
+  // ── Source identities and attribution (DRI-302) ──
+  /**
+   * Sends one source command (`source_space.register`, `source_principal.record`, `source_principal.map`,
+   * `source_reference.record`, `observe`, `associate`, `alias_key`) on the Work command route, with its receipts.
+   */
+  async workSourceCommand(command) {
+    return workSourceCommandResultSchema.parse(await this.request("/work/commands", workSourceCommandSchema.parse(command)));
+  }
+  async workSourceSpaces(page = {}) {
+    return workSourceSpacePageSchema.parse(await this.request(`/work/source-spaces${workQuery(page)}`));
+  }
+  async workSourceSpace(id) {
+    return workSourceSpaceSchema.parse(await this.request(`/work/source-spaces/${encodeURIComponent(id)}`));
+  }
+  async workSourcePrincipals(page = {}) {
+    return workSourcePrincipalPageSchema.parse(await this.request(`/work/source-principals${sourceQuery(page)}`));
+  }
+  async workSourcePrincipal(id) {
+    return workSourcePrincipalSchema.parse(await this.request(`/work/source-principals/${encodeURIComponent(id)}`));
+  }
+  /** References, optionally of one space or carrying a readable identifier now or formerly (an alias, not identity). */
+  async workSourceReferences(page = {}) {
+    return workSourceReferencePageSchema.parse(await this.request(`/work/source-references${sourceQuery(page)}`));
+  }
+  async workSourceReference(id) {
+    return workSourceReferenceSchema.parse(await this.request(`/work/source-references/${encodeURIComponent(id)}`));
+  }
+  /** The reference holding a complete source key (canonical or alias) in this Team; `not_found` otherwise. */
+  async workResolveSource(key) {
+    return workSourceReferenceSchema.parse(await this.request(`/work/source-references/resolve?${new URLSearchParams(key)}`));
+  }
+  async workSourceAliases(id, page = {}) {
+    return workSourceAliasPageSchema.parse(await this.request(`/work/source-references/${encodeURIComponent(id)}/aliases${workQuery(page)}`));
+  }
+  async workSourceAssociations(id, page = {}) {
+    return workSourceAssociationPageSchema.parse(
+      await this.request(`/work/source-references/${encodeURIComponent(id)}/associations${workQuery(page)}`)
+    );
+  }
+  async workSourceActivity(subject, page = {}) {
+    const collection = { source_space: "source-spaces", source_principal: "source-principals", source_reference: "source-references" }[subject.kind];
+    return workSourceActivityPageSchema.parse(
+      await this.request(`/work/${collection}/${encodeURIComponent(subject.id)}/activity${workQuery(page)}`)
+    );
+  }
+  /** The source references associated with an Issue or Plan now. */
+  async workOwnerSourceReferences(owner, page = {}) {
+    return workSourceReferencePageSchema.parse(
+      await this.request(`/work/${owner.kind}s/${encodeURIComponent(owner.id)}/source-references${workQuery(page)}`)
+    );
+  }
+  /** Every association change to or from an Issue or Plan, including references since moved elsewhere. */
+  async workOwnerSourceHistory(owner, page = {}) {
+    return workSourceAssociationPageSchema.parse(
+      await this.request(`/work/${owner.kind}s/${encodeURIComponent(owner.id)}/source-history${workQuery(page)}`)
+    );
+  }
+  // ── end DRI-302 ──
+  // ── Assignees and Team labels (DRI-295) ──
+  /**
+   * Sends one membership or label command (`issue_membership.assign`, `issue_membership.unassign`,
+   * `issue_membership.add_label`, `issue_membership.remove_label` at the Issue's membership version; `label.create`,
+   * `label.edit`) on the Work command route, with its receipts and replay.
+   */
+  async workMembershipCommand(command) {
+    return workMembershipCommandResultSchema.parse(await this.request("/work/commands", workMembershipCommandSchema.parse(command)));
+  }
+  /** The Issue's membership version (what a membership command names) and its current counts. */
+  async workIssueMembership(id) {
+    return workIssueMembershipSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/membership`));
+  }
+  async workIssueMembershipActivity(id, page = {}) {
+    return workMembershipActivityPageSchema.parse(
+      await this.request(`/work/issues/${encodeURIComponent(id)}/membership/activity${workQuery(page)}`)
+    );
+  }
+  /** An Issue's current assignees, oldest first; `state: 'all'` includes removed periods. */
+  async workIssueAssignees(id, page = {}) {
+    const query = workQuery(page);
+    const state = page.state ? `${query ? "&" : "?"}state=${page.state}` : "";
+    return workIssueAssigneePageSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/assignees${query}${state}`));
+  }
+  /** An Issue's label memberships, each with the label's current record; `state: 'all'` includes removed ones. */
+  async workIssueLabels(id, page = {}) {
+    const query = workQuery(page);
+    const state = page.state ? `${query ? "&" : "?"}state=${page.state}` : "";
+    return workIssueLabelPageSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/labels${query}${state}`));
+  }
+  async workLabels(page = {}) {
+    return workLabelPageSchema.parse(await this.request(`/work/labels${workQuery(page)}`));
+  }
+  async workLabel(id) {
+    return workLabelSchema.parse(await this.request(`/work/labels/${encodeURIComponent(id)}`));
+  }
+  /** Issues currently carrying the label, by number. */
+  async workLabelIssues(id, page = {}) {
+    return workLabelIssuePageSchema.parse(await this.request(`/work/labels/${encodeURIComponent(id)}/issues${workQuery(page)}`));
+  }
+  async workLabelActivity(id, page = {}) {
+    return workMembershipActivityPageSchema.parse(
+      await this.request(`/work/labels/${encodeURIComponent(id)}/activity${workQuery(page)}`)
+    );
+  }
+  // ── end DRI-295 ──
+  // ── Delivery candidates and evidence (DRI-298) ──
+  /**
+   * Sends one candidate or evidence command (`candidate.propose`, `candidate.select` at the selection's version,
+   * `evidence.record`, `evidence.retract` and `evidence.accept` at the evidence's version) on the Work command route,
+   * with its receipts and replay. Recorded evidence may advance the Issue automatically; the result says how.
+   */
+  async workEvidenceCommand(command) {
+    return workEvidenceCommandResultSchema.parse(await this.request("/work/commands", workEvidenceCommandSchema.parse(command)));
+  }
+  async workIssueCandidates(id, page = {}) {
+    return workCandidatePageSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/candidates${workQuery(page)}`));
+  }
+  /** The Issue's current-candidate selection and its version. */
+  async workIssueCandidate(id) {
+    return workCandidateSelectionSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/candidate`));
+  }
+  async workIssueCandidateActivity(id, page = {}) {
+    return workEvidenceActivityPageSchema.parse(
+      await this.request(`/work/issues/${encodeURIComponent(id)}/candidate/activity${workQuery(page)}`)
+    );
+  }
+  /** An Issue's evidence, oldest first, each with its applicability now; narrow by candidate or kind. */
+  async workIssueEvidence(id, page = {}) {
+    const query = new URLSearchParams(workQuery(page).slice(1));
+    if (page.candidateId) query.set("candidateId", page.candidateId);
+    if (page.kind) query.set("kind", page.kind);
+    const text = query.toString();
+    return workEvidencePageSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/evidence${text ? `?${text}` : ""}`));
+  }
+  async workCandidate(id) {
+    return workCandidateSchema.parse(await this.request(`/work/candidates/${encodeURIComponent(id)}`));
+  }
+  async workCandidateEvidence(id, page = {}) {
+    return workEvidencePageSchema.parse(await this.request(`/work/candidates/${encodeURIComponent(id)}/evidence${workQuery(page)}`));
+  }
+  async workEvidence(id) {
+    return workEvidenceSchema.parse(await this.request(`/work/evidence/${encodeURIComponent(id)}`));
+  }
+  /** A candidate's or an evidence record's history, oldest first. */
+  async workEvidenceActivity(subject, page = {}) {
+    const collection = subject.kind === "candidate" ? "candidates" : "evidence";
+    return workEvidenceActivityPageSchema.parse(
+      await this.request(`/work/${collection}/${encodeURIComponent(subject.id)}/activity${workQuery(page)}`)
+    );
+  }
+  // ── end DRI-298 ──
+  // ── Deployments, verification attempts and production confirmation (DRI-299) ──
+  /**
+   * Sends one deployment or verification command (`deployment.record`, `deployment.retire` at the deployment's
+   * version, `verification.start`) on the Work command route. QA results and production confirmation are evidence
+   * commands (`workEvidenceCommand` with `evidence.record` naming the attempt, or `production.confirm`).
+   */
+  async workDeploymentCommand(command) {
+    return workDeploymentCommandResultSchema.parse(await this.request("/work/commands", workDeploymentCommandSchema.parse(command)));
+  }
+  /** An Issue's deployments in recording order; narrow by candidate, environment or lifecycle. */
+  async workIssueDeployments(id, page = {}) {
+    const query = new URLSearchParams(workQuery(page).slice(1));
+    for (const key of ["candidateId", "environment", "lifecycle"]) if (page[key]) query.set(key, page[key]);
+    const text = query.toString();
+    return workDeploymentPageSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/deployments${text ? `?${text}` : ""}`));
+  }
+  /** An Issue's verification attempts in start order, each with its outcome and standing now. */
+  async workIssueVerificationAttempts(id, page = {}) {
+    const query = new URLSearchParams(workQuery(page).slice(1));
+    if (page.deploymentId) query.set("deploymentId", page.deploymentId);
+    const text = query.toString();
+    return workVerificationAttemptPageSchema.parse(
+      await this.request(`/work/issues/${encodeURIComponent(id)}/verification-attempts${text ? `?${text}` : ""}`)
+    );
+  }
+  /** An Issue's staging-to-production trail: its production confirmations with the records they name. */
+  async workIssueProductionTrail(id, page = {}) {
+    return workProductionTrailPageSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/production-trail${workQuery(page)}`));
+  }
+  async workDeployment(id) {
+    return workDeploymentSchema.parse(await this.request(`/work/deployments/${encodeURIComponent(id)}`));
+  }
+  async workDeploymentAttempts(id, page = {}) {
+    return workVerificationAttemptPageSchema.parse(await this.request(`/work/deployments/${encodeURIComponent(id)}/attempts${workQuery(page)}`));
+  }
+  async workVerificationAttempt(id) {
+    return workVerificationAttemptSchema.parse(await this.request(`/work/verification-attempts/${encodeURIComponent(id)}`));
+  }
+  /** A deployment's or a verification attempt's history, oldest first. */
+  async workDeploymentActivity(subject, page = {}) {
+    const collection = subject.kind === "deployment" ? "deployments" : "verification-attempts";
+    return workDeploymentActivityPageSchema.parse(
+      await this.request(`/work/${collection}/${encodeURIComponent(subject.id)}/activity${workQuery(page)}`)
+    );
+  }
+  // ── end DRI-299 ──
+  // ── Dependencies, duplicates and related Issues (DRI-301) ──
+  /** Sends one relation command (`issue_relation.add`, `issue_relation.remove`) on the Work command route. */
+  async workRelationCommand(command) {
+    return workRelationCommandResultSchema.parse(await this.request("/work/commands", workRelationCommandSchema.parse(command)));
+  }
+  /**
+   * An Issue's own relations, oldest first: its prerequisites, its canonical Issue and its related links (either side);
+   * `kind` narrows to one, `state: 'all'` includes removed periods.
+   */
+  async workIssueRelations(id, page = {}) {
+    return workIssueRelationPageSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/relations${relationQuery(page)}`));
+  }
+  /** The Issues blocked by this one (`dependents`) or marked duplicates of it (`duplicates`), oldest first. */
+  async workIssueInverseRelations(id, kind, page = {}) {
+    return workIssueRelationPageSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/${kind}${relationQuery(page)}`));
+  }
+  /** Whether every prerequisite of the Issue is satisfied now, and a page of the unsatisfied ones. */
+  async workDependencyGate(id, page = {}) {
+    return workDependencyGateSchema.parse(await this.request(`/work/issues/${encodeURIComponent(id)}/dependency-gate${workQuery(page)}`));
+  }
+  async workRelation(id) {
+    return workIssueRelationSchema.parse(await this.request(`/work/relations/${encodeURIComponent(id)}`));
+  }
+  async workRelationActivity(id, page = {}) {
+    return workRelationActivityPageSchema.parse(await this.request(`/work/relations/${encodeURIComponent(id)}/activity${workQuery(page)}`));
+  }
+  // ── end DRI-301 ──
+  // ── Pending imported relations (DRI-308) ──
+  /** Sends `pending_relation.dismiss` or `pending_relation.resolve` on the Work command route. */
+  async workPendingRelationCommand(command) {
+    return workPendingRelationCommandResultSchema.parse(await this.request("/work/commands", workPendingRelationCommandSchema.parse(command)));
+  }
+  /** The pending imported relations naming an Issue (`issue`) or recorded by an import batch (`import`), oldest first. */
+  async workPendingRelations(of, page = {}) {
+    const query = new URLSearchParams(workQuery(page).slice(1));
+    if (page.disposition) query.set("disposition", page.disposition);
+    const text = query.toString();
+    return workPendingRelationPageSchema.parse(await this.request(
+      `/work/${of.kind === "issue" ? "issues" : "imports"}/${encodeURIComponent(of.id)}/pending-relations${text ? `?${text}` : ""}`
+    ));
+  }
+  async workPendingRelation(id) {
+    return workPendingRelationSchema.parse(await this.request(`/work/pending-relations/${encodeURIComponent(id)}`));
+  }
+  async workPendingRelationActivity(id, page = {}) {
+    return workPendingRelationActivityPageSchema.parse(await this.request(`/work/pending-relations/${encodeURIComponent(id)}/activity${workQuery(page)}`));
+  }
+  // ── end DRI-308 ──
+  // ── Execution reservations and canonical admission (DRI-310) ──
+  /**
+   * Sends one reservation command (`legacy_alias.record`, Team admin) on the Work command route, with its receipts
+   * and replay. DRI-314 retired the provisional lifecycle commands: Coordination's own (`coordinationCommand`) start,
+   * bind and close executions.
+   */
+  async workReservationCommand(command) {
+    return workReservationCommandResultSchema.parse(await this.request("/work/commands", workReservationCommandSchema.parse(command)));
+  }
+  /** An Issue's occupancy: its ownership generation and held reservation, if any. */
+  async workIssueReservation(issueId) {
+    return workIssueReservationSchema.parse(await this.request(`/work/issues/${encodeURIComponent(issueId)}/reservation`));
+  }
+  /** Every reservation an Issue has had, oldest first. */
+  async workIssueReservations(issueId, page = {}) {
+    return workExecutionReservationPageSchema.parse(
+      await this.request(`/work/issues/${encodeURIComponent(issueId)}/reservations${workQuery(page)}`)
+    );
+  }
+  async workReservation(id) {
+    return workExecutionReservationSchema.parse(await this.request(`/work/reservations/${encodeURIComponent(id)}`));
+  }
+  async workReservationBindings(id, page = {}) {
+    return workExecutionBindingPageSchema.parse(await this.request(`/work/reservations/${encodeURIComponent(id)}/bindings${workQuery(page)}`));
+  }
+  async workReservationActivity(id, page = {}) {
+    return workReservationActivityPageSchema.parse(await this.request(`/work/reservations/${encodeURIComponent(id)}/activity${workQuery(page)}`));
+  }
+  /** A Run's one authoritative binding; `not_found` for a Run admitted outside any canonical Issue. */
+  async workRunBinding(runId) {
+    return workExecutionBindingSchema.parse(await this.request(`/work/runs/${encodeURIComponent(runId)}/binding`));
+  }
+  /** Run control's record of a dispatched coordinated Run: grants, fencing refusal, receipts and physical stop (DRI-340). */
+  async workRunControl(runId) {
+    return runControlRecordSchema.parse(await this.request(`/work/runs/${encodeURIComponent(runId)}/control`));
+  }
+  /** `run_control.acknowledge_lost` (Team admin): a Run whose stop is unproven is accepted as no longer running (DRI-340). */
+  async runControlCommand(command) {
+    return runControlCommandResultSchema.parse(await this.request("/work/commands", runControlCommandSchema.parse(command)));
+  }
+  /** The Issue an exact legacy reference resolves to; anything else is `not_found`. */
+  async workResolveLegacyAlias(alias) {
+    return workLegacyAliasSchema.parse(await this.request(`/work/legacy-aliases/resolve?${new URLSearchParams({ alias })}`));
+  }
+  // ── end DRI-310 ──
+  // ── Coordination (DRI-314) ──
+  /**
+   * Sends one Coordination command on the Work command route, with its receipts and replay: a member's
+   * `execution.start`, `.control`, `.cancel`, `.close`, `.decide`, `.amend`, `.message`, or the provisional synthetic
+   * driver's `coordinator.*` and `run.fact` (Team admin). A stale generation is `stale_generation`.
+   */
+  async coordinationCommand(command) {
+    return coordinationCommandResultSchema.parse(await this.request("/work/commands", coordinationCommandSchema.parse(command)));
+  }
+  async workExecution(id) {
+    return executionSchema.parse(await this.request(`/work/executions/${encodeURIComponent(id)}`));
+  }
+  /** Every execution of an Issue, oldest first: its predecessors and the current one. */
+  async workIssueExecutions(issueId, page = {}) {
+    return executionPageSchema.parse(await this.request(`/work/issues/${encodeURIComponent(issueId)}/executions${workQuery(page)}`));
+  }
+  async workCoordinator(id) {
+    return coordinatorSchema.parse(await this.request(`/work/coordinators/${encodeURIComponent(id)}`));
+  }
+  /** Measured spend across every execution of an Issue. */
+  async workIssueSpend(issueId) {
+    return coordinationSpendSchema.parse(await this.request(`/work/issues/${encodeURIComponent(issueId)}/spend`));
+  }
+  // ── Coordinator activation and specialist assignment (DRI-317) ──
+  /**
+   * With a coordinated Run's scoped credential (its grant's token as the bearer): what that Run may read about its own
+   * work. The coordinator sees its execution's assignments, packages and reports; a specialist its own assignment.
+   * A member's token is `forbidden`. Commands go through `coordinationCommand` with the same credential.
+   */
+  async workBrief() {
+    return coordinationBriefSchema.parse(await this.request("/work/brief"));
+  }
+  /** An execution's coordinator activation: its Run, binding and coordinator Workflow. */
+  async workExecutionActivation(executionId) {
+    return executionActivationSchema.parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/activation`));
+  }
+  /** The specialist reports exposed on an execution's canonical Thread, oldest first. */
+  async workExecutionReports(executionId, page = {}) {
+    return workPageSchema(assignmentReportSchema).parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/reports${workQuery(page)}`));
+  }
+  // ── end DRI-317 ──
+  // ── Coordinator wake-up (DRI-318) ──
+  /** An execution's coordinator inbox, every event oldest first, with each event's acknowledgement. */
+  async workExecutionInbox(executionId, page = {}) {
+    return workPageSchema(coordinationInboxEventSchema).parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/inbox${workQuery(page)}`));
+  }
+  /** An execution's InboxCursor: acknowledged through, newest event, wake-ups, the activation asleep. */
+  async workExecutionCursor(executionId) {
+    return inboxCursorSchema.parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/cursor`));
+  }
+  // ── end DRI-318 ──
+  // ── Recovery of interrupted work (DRI-325) ──
+  /** An execution's recovery episodes, oldest first, each with its append-only steps. */
+  async workExecutionRecoveries(executionId, page = {}) {
+    return workPageSchema(recoveryEpisodeSchema).parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/recoveries${workQuery(page)}`));
+  }
+  // ── end DRI-325 ──
+  // ── Hold, pause and revise (DRI-323) ──
+  /** An execution's control requests, oldest first: requested versus effective, each specialist Run's part, a hold's wait. */
+  async workExecutionControls(executionId, page = {}) {
+    return workPageSchema(controlRequestSchema).parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/controls${workQuery(page)}`));
+  }
+  /** An assignment's published revisions, oldest first, each with its message and incorporation. */
+  async workAssignmentRevisions(assignmentId, page = {}) {
+    return workPageSchema(assignmentRevisionSchema).parse(await this.request(`/work/assignments/${encodeURIComponent(assignmentId)}/revisions${workQuery(page)}`));
+  }
+  // ── end DRI-323 ──
+  // ── DRI-324: an execution's newest cancellation ──
+  /** Each admitted Run's tool-boundary hold and stop, every effect issued (finished, unknown), what remains and what blocks closure. */
+  async workExecutionCancellation(executionId) {
+    return executionCancellationSchema.parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/cancellation`));
+  }
+  // ── Execution workflows (DRI-319): the Team library and a pinned execution's steps ──
+  /** Publishes an execution workflow revision (Team admin) on its own route, with the Work receipts and replay. */
+  async executionWorkflowCommand(command) {
+    return coordinationCommandResultSchema.parse(await this.request("/work/execution-workflows/commands", coordinationCommandSchema.parse(command)));
+  }
+  async executionWorkflows(page = {}) {
+    return executionWorkflowPageSchema.parse(await this.request(`/work/execution-workflows${workQuery(page)}`));
+  }
+  async executionWorkflow(id) {
+    return executionWorkflowSchema.parse(await this.request(`/work/execution-workflows/${encodeURIComponent(id)}`));
+  }
+  async executionWorkflowRevisions(id, page = {}) {
+    return executionWorkflowRevisionPageSchema.parse(await this.request(`/work/execution-workflows/${encodeURIComponent(id)}/revisions${workQuery(page)}`));
+  }
+  async executionWorkflowRevision(id, revision) {
+    return executionWorkflowRevisionSchema.parse(await this.request(`/work/execution-workflows/${encodeURIComponent(id)}/revisions/${revision}`));
+  }
+  /** The pinned workflow revision of an execution and every step's state. */
+  async workExecutionSteps(executionId) {
+    return executionStepsSchema.parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/steps`));
+  }
+  // ── end DRI-319 ──
+  // ── Review and repair loop (DRI-320) ──
+  /** An execution's review rounds, oldest first: each verdict, the candidate it evaluated, the findings. */
+  async workExecutionReviews(executionId, page = {}) {
+    return reviewRoundPageSchema.parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/reviews${workQuery(page)}`));
+  }
+  // ── end DRI-320 ──
+  // ── Messages and receipts (DRI-322) ──
+  /**
+   * An execution's messages, oldest first: a specialist's with its target and every receipt (received, delivered,
+   * incorporated, rejected, unconfirmed), never relabelled. Send with `coordinationCommand` (`message.send`).
+   */
+  async workExecutionMessages(executionId, page = {}) {
+    return workPageSchema(executionMessageSchema).parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/messages${workQuery(page)}`));
+  }
+  // ── end DRI-322 ──
+  // ── DRI-329: an execution's place in the delegation hierarchy ──
+  /** Depth below its root, remaining delegation depth, subtree spend and a page of child executions with state and spend. */
+  async workExecutionHierarchy(executionId, page = {}) {
+    return executionHierarchySchema.parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/hierarchy${workQuery(page)}`));
+  }
+  /** The child executions an execution's assignments control, oldest first. */
+  async workExecutionChildren(executionId, page = {}) {
+    return executionPageSchema.parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/children${workQuery(page)}`));
+  }
+  // ── end DRI-329 ──
+  // ── QA steps and repair (DRI-321) ──
+  /** An execution's QA rounds, oldest first: attempt, deployment, candidate, outcome, reproduction. */
+  async workExecutionQa(executionId, page = {}) {
+    return qaRoundPageSchema.parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/qa${workQuery(page)}`));
+  }
+  // ── end DRI-321 ──
+  // ── Questions routed to their authority (DRI-330) ──
+  /** Every question visible on an execution (raised in it or routed through it), in the order it reached it. Answer with `coordinationCommand`. */
+  async workExecutionQuestions(executionId, page = {}) {
+    return executionQuestionPageSchema.parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/questions${workQuery(page)}`));
+  }
+  /** One question: its authority, addressee, route, answer and its delivery, resolution. */
+  async workQuestion(questionId) {
+    return executionQuestionSchema.parse(await this.request(`/work/questions/${encodeURIComponent(questionId)}`));
+  }
+  // ── end DRI-330 ──
+  // ── Child acceptance and delivery readiness (DRI-335) ──
+  /** An execution's outcomes as distinct facts: finished, awaiting acceptance, accepted, closure, and Work's delivery readiness. */
+  async workExecutionOutcome(executionId) {
+    return executionOutcomeSchema.parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/outcome`));
+  }
+  /** An execution's completion packages, oldest first, each with the versioned assignment contract it answers. */
+  async workExecutionPackages(executionId, page = {}) {
+    return workPageSchema(completionPackageSchema).parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/packages${workQuery(page)}`));
+  }
+  // ── end DRI-335 ──
+  // ── Client integration (DRI-342) ──
+  /** Every execution of a Plan, oldest first. */
+  async workPlanExecutions(planId, page = {}) {
+    return executionPageSchema.parse(await this.request(`/work/plans/${encodeURIComponent(planId)}/executions${workQuery(page)}`));
+  }
+  /** One assignment. */
+  async workAssignment(id) {
+    return assignmentSchema.parse(await this.request(`/work/assignments/${encodeURIComponent(id)}`));
+  }
+  /** A page of an execution's assignments, oldest first. */
+  async workExecutionAssignments(executionId, page = {}) {
+    return assignmentPageSchema.parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/assignments${workQuery(page)}`));
+  }
+  /** A page of an execution's Activity, oldest first: its durable history. */
+  async workExecutionActivity(executionId, page = {}) {
+    return coordinationActivityPageSchema.parse(await this.request(`/work/executions/${encodeURIComponent(executionId)}/activity${workQuery(page)}`));
+  }
+  /**
+   * The Team's authority record: who owns work-domain writes and starts, and the client contract the Hub serves.
+   * Readable whether or not the Work core is on. A Hub that predates it answers `not_found`; see `WorkFlows.path`.
+   */
+  async workAuthority() {
+    return workAuthoritySchema.parse(await this.request("/work/authority"));
+  }
+  // ── end DRI-342 ──
+  // ── end DRI-314 ──
+  // ── Discussion on Work Threads (DRI-303) ──
+  /**
+   * Sends one discussion command (`comment.add`, `comment.edit`, `comment.delete`, `attachment.link`,
+   * `attachment.check`, `attachment.remove`, `transcript.link`) on the Work command route, with its receipts and replay.
+   */
+  async workDiscussionCommand(command) {
+    return workDiscussionCommandResultSchema.parse(await this.request("/work/commands", workDiscussionCommandSchema.parse(command)));
+  }
+  /** The Thread's binding: the one Issue or Plan it belongs to. */
+  async workThread(id) {
+    return workThreadSchema.parse(await this.request(`/work/threads/${encodeURIComponent(id)}`));
+  }
+  /** A Thread's comments, oldest first, deleted ones as tombstones; `parentId` pages the replies of one comment. */
+  async workThreadComments(id, page = {}) {
+    return workCommentPageSchema.parse(await this.request(`/work/threads/${encodeURIComponent(id)}/comments${discussionQuery(page)}`));
+  }
+  /** A Thread's link-only attachments, oldest first; `commentId` narrows to one comment's. */
+  async workThreadAttachments(id, page = {}) {
+    return workAttachmentPageSchema.parse(await this.request(`/work/threads/${encodeURIComponent(id)}/attachments${discussionQuery(page)}`));
+  }
+  /** A Thread's transcript links, each `visible` or `restricted` by the caller's access to its Run. */
+  async workThreadTranscriptLinks(id, page = {}) {
+    return workTranscriptLinkPageSchema.parse(await this.request(`/work/threads/${encodeURIComponent(id)}/transcript-links${workQuery(page)}`));
+  }
+  async workComment(id) {
+    return workCommentSchema.parse(await this.request(`/work/comments/${encodeURIComponent(id)}`));
+  }
+  async workCommentRevisions(id, page = {}) {
+    return workCommentRevisionPageSchema.parse(await this.request(`/work/comments/${encodeURIComponent(id)}/revisions${workQuery(page)}`));
+  }
+  async workAttachment(id) {
+    return workAttachmentSchema.parse(await this.request(`/work/attachments/${encodeURIComponent(id)}`));
+  }
+  async workAttachmentChecks(id, page = {}) {
+    return workAttachmentCheckPageSchema.parse(await this.request(`/work/attachments/${encodeURIComponent(id)}/checks${workQuery(page)}`));
+  }
+  async workTranscriptLink(id) {
+    return workTranscriptLinkSchema.parse(await this.request(`/work/transcript-links/${encodeURIComponent(id)}`));
+  }
+  /** The linked range of the Run's history, under the Run's own visibility; `after` is the last sequence read. */
+  async workTranscriptHistory(id, after) {
+    return workTranscriptHistorySchema.parse(await this.request(
+      `/work/transcript-links/${encodeURIComponent(id)}/history${after === void 0 ? "" : `?after=${after}`}`
+    ));
+  }
+  async workDiscussionActivity(subject, page = {}) {
+    const collection = { comment: "comments", attachment: "attachments", transcript_link: "transcript-links" }[subject.kind];
+    return workDiscussionActivityPageSchema.parse(
+      await this.request(`/work/${collection}/${encodeURIComponent(subject.id)}/activity${workQuery(page)}`)
+    );
+  }
+  // ── end DRI-303 ──
+  // ── Normalized import preview (DRI-305) ──
+  /** Previews one normalized import (`import.preview`, Team admin) on its own route, with the Work receipts. */
+  async workImportCommand(command) {
+    return workImportCommandResultSchema.parse(await this.request("/work/imports/commands", workImportCommandSchema.parse(command)));
+  }
+  async workImports(page = {}) {
+    return workImportBatchPageSchema.parse(await this.request(`/work/imports${workQuery(page)}`));
+  }
+  async workImport(id) {
+    return workImportBatchSchema.parse(await this.request(`/work/imports/${encodeURIComponent(id)}`));
+  }
+  /** A batch's previewed items, optionally of one collection or one disposition. */
+  async workImportItems(id, page = {}) {
+    return workImportItemPageSchema.parse(await this.request(`/work/imports/${encodeURIComponent(id)}/items${sourceQuery(page)}`));
+  }
+  /** The frozen envelope and mapping, exactly as previewed, with their digests. */
+  async workImportSnapshot(id) {
+    return workImportSnapshotSchema.parse(await this.request(`/work/imports/${encodeURIComponent(id)}/snapshot`));
+  }
+  // ── end DRI-305 ──
+  // ── Import commit (DRI-306): `import.commit` goes through `workImportCommand` ──
+  /** What the commit did with a batch, item by item and part by part, optionally filtered. */
+  async workImportOutcomes(id, page = {}) {
+    return workImportOutcomePageSchema.parse(await this.request(`/work/imports/${encodeURIComponent(id)}/outcomes${sourceQuery(page)}`));
+  }
+  // ── end DRI-306 ──
+  // ── Import completion (DRI-307): `import.complete` goes through `workImportCommand` ──
+  /** A committed batch's discussion components and their current states, optionally of one collection or state. */
+  async workImportComponents(id, page = {}) {
+    return workImportComponentPageSchema.parse(await this.request(`/work/imports/${encodeURIComponent(id)}/components${sourceQuery(page)}`));
+  }
+  // ── end DRI-307 ──
   /** The recent Runs; with a filter, every Run carrying that key or every child of that Run, newest first. */
   async runs(filter) {
     const query = !filter ? "" : "key" in filter ? `?key=${encodeURIComponent(filter.key)}` : `?parent=${encodeURIComponent(filter.parent)}`;
@@ -15585,39 +16824,1407 @@ ${USAGE3}
   }
 }
 
-// src/app/entry/doctorCommand.ts
-import process7 from "process";
+// src/app/entry/driveCommand.ts
+import path14 from "path";
 
-// src/harnesses/claude/system/doctorEnvironment.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import * as fs12 from "fs";
-import * as os4 from "os";
-import * as path12 from "path";
-var MANAGED_POLICY_KEYS = [
-  "forceLoginMethod",
-  "forceLoginOrgUUID",
-  "allowManagedHooksOnly",
-  "allowManagedMcpServersOnly",
-  "allowManagedPermissionRulesOnly",
-  "disableAutoMode",
-  "disableBypassPermissionsMode",
-  "forceRemoteSettingsRefresh",
-  "availableModels",
-  "model",
-  "apiKeyHelper",
-  "awsCredentialExport"
+// src/core/drive/merge.ts
+var DEFAULT_TIMEOUT_MS = 9 * 6e4;
+var DEFAULT_POLL_MS = 15e3;
+var DEFAULT_NO_CHECKS_GRACE_MS = 45e3;
+var DEFAULT_SETTLE_MS = 2e4;
+var DEFAULT_LOCK_WAIT_MS = 6e4;
+var MAX_ROUNDS = 2;
+var DEPENDENCY_FILES = [
+  "package.json",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  "bun.lock",
+  "bun.lockb"
 ];
-function inspectSettingsFile(scope, filePath, statFn, readFileFn) {
-  let stat;
+var OUTPUT_TAIL = 4e3;
+var SCRATCH_PREFIX = "drisp-drive-merge-";
+var MERGED_REFS = "refs/drisp/merged";
+var TESTED_REFS = "refs/drisp/tested";
+function tail(text) {
+  const trimmed = text.trim();
+  return trimmed.length > OUTPUT_TAIL ? `\u2026${trimmed.slice(-OUTPUT_TAIL)}` : trimmed;
+}
+function both(result) {
+  return tail([result.stdout, result.stderr].filter(Boolean).join("\n"));
+}
+var Stop = class extends Error {
+  constructor(result) {
+    super(result.detail);
+    this.result = result;
+  }
+  result;
+};
+function stop(outcome, detail, output) {
+  throw new Stop({ outcome, detail, ...output ? { output } : {} });
+}
+function refuse(detail, output) {
+  return stop("refused", detail, output);
+}
+function baseKeptMoving(defaultBranch) {
+  return `base kept moving: ${defaultBranch} moved after each of ${MAX_ROUNDS} rebase-and-check rounds; run the command again`;
+}
+async function driveMerge(input, deps) {
   try {
-    stat = statFn(filePath);
-  } catch {
-    return { scope, path: filePath, present: false };
+    return await new DriveMerge(input, deps).run();
+  } catch (error) {
+    if (error instanceof Stop) return error.result;
+    throw error;
   }
-  const info = {
+}
+function judge(checks, scope) {
+  const { failing, unfinished } = judgeChecks(checks);
+  if (failing.length > 0)
+    return {
+      kind: "failed",
+      detail: `${scope} failed: ${failing.map((check) => check.name).join(", ")}`
+    };
+  const cancelled = unfinished.filter((check) => check.bucket === "cancel");
+  if (cancelled.length > 0)
+    return {
+      kind: "failed",
+      detail: `${scope} cancelled: ${cancelled.map((check) => check.name).join(", ")}`
+    };
+  if (unfinished.length > 0)
+    return {
+      kind: "waiting",
+      detail: `${scope} not finished: ${describeChecks(unfinished)}`
+    };
+  return {
+    kind: "passed",
     scope,
-    path: filePath,
-    present: true,
+    detail: `${scope} passed (${checks.map((check) => check.name).join(", ")})`
+  };
+}
+var DriveMerge = class {
+  constructor(input, deps) {
+    this.input = input;
+    this.deps = deps;
+    this.timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.pollMs = input.pollMs ?? DEFAULT_POLL_MS;
+    this.graceMs = input.noChecksGraceMs ?? DEFAULT_NO_CHECKS_GRACE_MS;
+    this.settleMs = input.settleMs ?? DEFAULT_SETTLE_MS;
+  }
+  input;
+  deps;
+  timeoutMs;
+  /** Set when the command starts; every stage takes what is left of it. */
+  deadline = 0;
+  pollMs;
+  graceMs;
+  settleMs;
+  left() {
+    return this.deadline - this.deps.now();
+  }
+  timedOut(what) {
+    return stop(
+      "checks_timeout",
+      `${what}: the command's ${Math.round(this.timeoutMs / 1e3)} s deadline passed; run the command again`
+    );
+  }
+  git(cwd, ...args) {
+    return this.deps.git(cwd, args);
+  }
+  /** stdout of a git call that must succeed, else `refused` naming it. */
+  must(cwd, what, ...args) {
+    const result = this.git(cwd, ...args);
+    if (result.code !== 0) refuse(`${what} failed`, both(result));
+    return result.stdout.trim();
+  }
+  sha(cwd, ref) {
+    const result = this.git(cwd, "rev-parse", "--verify", "--quiet", ref);
+    return result.code === 0 ? result.stdout.trim() : null;
+  }
+  isAncestor(cwd, commit, of) {
+    return this.git(cwd, "merge-base", "--is-ancestor", commit, of).code === 0;
+  }
+  checkedOut(cwd) {
+    return this.git(
+      cwd,
+      "symbolic-ref",
+      "--quiet",
+      "--short",
+      "HEAD"
+    ).stdout.trim();
+  }
+  rebaseInProgress(worktreeDir) {
+    return ["rebase-merge", "rebase-apply"].some((state) => {
+      const at = this.git(
+        worktreeDir,
+        "rev-parse",
+        "--path-format=absolute",
+        "--git-path",
+        state
+      ).stdout.trim();
+      return at !== "" && this.deps.exists(at);
+    });
+  }
+  async run() {
+    const { worktree, item } = this.input;
+    this.deadline = this.deps.now() + this.timeoutMs;
+    const top = this.git(worktree, "rev-parse", "--show-toplevel");
+    if (top.code !== 0) refuse(`${worktree} is not a git worktree`, both(top));
+    const worktreeDir = top.stdout.trim();
+    if (this.git(worktreeDir, "check-ref-format", `${MERGED_REFS}/${item}`).code !== 0)
+      refuse(`"${item}" cannot name a git ref; use the item's identifier`);
+    const commonDir = this.must(
+      worktreeDir,
+      "reading the git common dir",
+      "rev-parse",
+      "--path-format=absolute",
+      "--git-common-dir"
+    );
+    const release2 = await this.deps.lock(
+      commonDir,
+      Math.min(this.input.lockWaitMs ?? DEFAULT_LOCK_WAIT_MS, this.left())
+    );
+    if (!release2)
+      refuse(
+        "another merge in progress: another drisp drive merge holds the lock in this repository; run the command again once it finishes"
+      );
+    try {
+      this.removeStaleScratch(worktreeDir);
+      return await this.locked(worktreeDir);
+    } finally {
+      release2();
+    }
+  }
+  /** Temporary checkouts a killed run left behind (they live under `drisp-drive-merge-*`). */
+  removeStaleScratch(worktreeDir) {
+    const stale = this.git(worktreeDir, "worktree", "list", "--porcelain").stdout.split("\n").filter(
+      (line) => line.startsWith("worktree ") && line.includes(SCRATCH_PREFIX)
+    ).map((line) => line.slice("worktree ".length));
+    for (const dir of stale)
+      this.git(worktreeDir, "worktree", "remove", "--force", dir);
+    this.git(worktreeDir, "worktree", "prune");
+  }
+  async locked(worktreeDir) {
+    const { item } = this.input;
+    if (this.rebaseInProgress(worktreeDir))
+      refuse(
+        "a rebase is in progress in the worktree; run `git rebase --abort` there (or finish it), then merge again"
+      );
+    const mainCheckout = this.mainCheckout(worktreeDir);
+    const current = this.checkedOut(worktreeDir);
+    const branch = this.input.branch ?? current;
+    if (!branch)
+      refuse("the worktree has a detached HEAD; check out the item branch");
+    if (current !== branch)
+      refuse(
+        `the worktree has ${current || "a detached HEAD"} checked out, not ${branch}`
+      );
+    const originUrl = this.git(
+      mainCheckout,
+      "config",
+      "--get",
+      "remote.origin.url"
+    );
+    const hasOrigin = originUrl.code === 0;
+    const defaultBranch = this.defaultBranch(mainCheckout, hasOrigin);
+    if (branch === defaultBranch)
+      refuse(`${branch} is the default branch; name the item's branch`);
+    const dirty = this.uncommitted(worktreeDir);
+    if (dirty.length > 0)
+      stop(
+        "conflict",
+        "the worktree has uncommitted changes or untracked files; commit them (or remove or ignore them), then merge again",
+        dirty.join("\n")
+      );
+    const github = /github\.com[:/]/i.test(originUrl.stdout);
+    this.deps.log(
+      `drive merge ${item}: ${branch} \u2192 ${defaultBranch} (${github ? "GitHub" : hasOrigin ? "git origin" : "local"})`
+    );
+    const ctx = { worktreeDir, mainCheckout, branch, defaultBranch, hasOrigin };
+    return github ? this.viaGitHub(ctx) : this.viaGit(ctx);
+  }
+  /** The main checkout: the first entry of `git worktree list`. */
+  mainCheckout(worktreeDir) {
+    const list = this.must(
+      worktreeDir,
+      "git worktree list",
+      "worktree",
+      "list",
+      "--porcelain"
+    );
+    const first = list.split("\n").find((line) => line.startsWith("worktree "))?.slice("worktree ".length);
+    if (!first) refuse("could not find the main checkout");
+    return first;
+  }
+  /** origin's HEAD, else the main checkout's `main`/`master`. */
+  defaultBranch(mainCheckout, hasOrigin) {
+    const head = this.git(
+      mainCheckout,
+      "symbolic-ref",
+      "--quiet",
+      "--short",
+      "refs/remotes/origin/HEAD"
+    ).stdout.trim();
+    if (head.startsWith("origin/")) return head.slice("origin/".length);
+    if (hasOrigin) {
+      const remote = this.git(
+        mainCheckout,
+        "ls-remote",
+        "--symref",
+        "origin",
+        "HEAD"
+      ).stdout.match(/^ref: refs\/heads\/(\S+)\s+HEAD/m);
+      if (remote?.[1]) return remote[1];
+    }
+    for (const name of ["main", "master"]) {
+      if (this.sha(mainCheckout, `refs/heads/${name}`)) return name;
+    }
+    return refuse("could not tell the default branch (no main or master)");
+  }
+  status(cwd, untracked) {
+    return this.git(
+      cwd,
+      "status",
+      "--porcelain",
+      `--untracked-files=${untracked}`
+    ).stdout.split("\n").map((line) => line.slice(3).trim()).filter(Boolean);
+  }
+  /** Changes to tracked files and untracked, non-ignored files: neither may ride along unseen. */
+  uncommitted(cwd) {
+    return this.status(cwd, "all");
+  }
+  /** Rebase the worktree onto `onto`; a conflict is aborted and reported. Returns the rebased HEAD. */
+  rebase(worktreeDir, onto) {
+    const rebased = this.git(worktreeDir, "rebase", onto);
+    if (rebased.code !== 0) {
+      const files = this.git(
+        worktreeDir,
+        "diff",
+        "--name-only",
+        "--diff-filter=U"
+      ).stdout.split("\n").filter(Boolean);
+      if (this.rebaseInProgress(worktreeDir))
+        this.git(worktreeDir, "rebase", "--abort");
+      if (files.length === 0)
+        refuse(`git rebase ${onto} failed (not a conflict)`, both(rebased));
+      stop(
+        "conflict",
+        `rebasing onto ${onto} conflicts in ${files.join(", ")}; the rebase was aborted`,
+        files.join("\n")
+      );
+    }
+    return this.must(worktreeDir, "reading HEAD", "rev-parse", "HEAD");
+  }
+  /** The repository's own checks: `.athena/config.json` `checks`, else package.json's `test` script. */
+  repoChecks(mainCheckout, worktreeDir) {
+    const configured = this.deps.configuredChecks(mainCheckout);
+    if (configured && configured.length > 0) return configured;
+    if (this.deps.packageTestScript(worktreeDir) !== void 0)
+      return ["npm test"];
+    return refuse(
+      'no checks to prove the merge: set "checks" in .athena/config.json or a package.json test script'
+    );
+  }
+  /** The manifests and lockfiles whose change means the worktree's installed dependencies may not match. */
+  dependenciesChanged(cwd, base, sha) {
+    const changed = this.git(
+      cwd,
+      "diff",
+      "--name-only",
+      base,
+      sha,
+      "--",
+      ...DEPENDENCY_FILES.map((name) => `:(glob)**/${name}`)
+    ).stdout.trim();
+    return changed !== "";
+  }
+  /** The install the checkout's lockfile calls for, scripts off. */
+  installCommand(dir) {
+    const has = (name) => this.deps.exists(`${dir}/${name}`);
+    if (has("pnpm-lock.yaml"))
+      return "pnpm install --frozen-lockfile --ignore-scripts";
+    if (has("yarn.lock"))
+      return "yarn install --frozen-lockfile --ignore-scripts";
+    if (has("bun.lock") || has("bun.lockb"))
+      return "bun install --frozen-lockfile --ignore-scripts";
+    if (has("package-lock.json") || has("npm-shrinkwrap.json"))
+      return "npm ci --ignore-scripts --no-audit --no-fund";
+    return "npm install --ignore-scripts --no-audit --no-fund";
+  }
+  /**
+   * Run each check in a clean, detached checkout of `sha` (never the worktree, whose files may differ from the
+   * commit); the first non-zero exit fails the merge, and the deadline is `checks_timeout`. The worktree's
+   * `node_modules` is reused only when no manifest or lockfile changed since `base`; otherwise the lockfile's
+   * install runs in the checkout first.
+   */
+  async runRepoChecks(mainCheckout, worktreeDir, base, sha) {
+    const checks = this.repoChecks(mainCheckout, worktreeDir);
+    const scratch = this.deps.scratchDir();
+    const added = this.git(
+      worktreeDir,
+      "worktree",
+      "add",
+      "--quiet",
+      "--detach",
+      scratch.dir,
+      sha
+    );
+    if (added.code !== 0) {
+      scratch.cleanup();
+      refuse("could not check out the tested commit", both(added));
+    }
+    const run = async (command, what) => {
+      if (this.left() <= 0) this.timedOut(`before ${what}`);
+      const result = await this.deps.runCheck(
+        scratch.dir,
+        command,
+        this.left()
+      );
+      if (result.timedOut)
+        stop(
+          "checks_timeout",
+          `${what} was killed at the command's ${Math.round(this.timeoutMs / 1e3)} s deadline; run the command again`,
+          both(result)
+        );
+      if (result.code !== 0)
+        stop("checks_failed", `${what} exited ${result.code}`, both(result));
+    };
+    try {
+      if (this.dependenciesChanged(worktreeDir, base, sha)) {
+        const install = this.installCommand(scratch.dir);
+        this.deps.log(`dependencies changed; installing: ${install}`);
+        await run(install, `the dependency install \`${install}\``);
+      } else {
+        this.deps.linkDependencies(worktreeDir, scratch.dir);
+      }
+      for (const check of checks) {
+        this.deps.log(`check (${sha.slice(0, 7)}): ${check}`);
+        await run(check, `\`${check}\``);
+      }
+      return checks;
+    } finally {
+      this.git(worktreeDir, "worktree", "remove", "--force", scratch.dir);
+      scratch.cleanup();
+      this.git(worktreeDir, "worktree", "prune");
+    }
+  }
+  // ── recorded merges ───────────────────────────────────────────────
+  recordedMerge(cwd) {
+    return this.sha(cwd, `${MERGED_REFS}/${this.input.item}`);
+  }
+  forgetMerge(cwd) {
+    this.git(cwd, "update-ref", "-d", `${MERGED_REFS}/${this.input.item}`);
+    this.git(cwd, "update-ref", "-d", `${TESTED_REFS}/${this.input.item}`);
+  }
+  /**
+   * The default branch's commits origin lacks, along its first parents, are pushed only when each is a merge this
+   * command recorded; anything else on it was not merged here and is refused, so a local `git merge` is never
+   * laundered through a push. Returns a note for the detail.
+   */
+  pushRecordedOnly(mainCheckout, defaultBranch) {
+    const remote = `refs/remotes/origin/${defaultBranch}`;
+    const ahead = this.sha(mainCheckout, remote) ? this.git(
+      mainCheckout,
+      "rev-list",
+      "--first-parent",
+      `${remote}..refs/heads/${defaultBranch}`
+    ).stdout.split("\n").filter(Boolean) : [];
+    if (ahead.length === 0) return "";
+    const recorded = new Set(
+      this.git(
+        mainCheckout,
+        "for-each-ref",
+        "--format=%(objectname)",
+        MERGED_REFS
+      ).stdout.split("\n").filter(Boolean)
+    );
+    const foreign = ahead.filter((commit) => !recorded.has(commit));
+    if (foreign.length > 0)
+      refuse(
+        `${defaultBranch} has commits drisp drive merge did not make, so it pushes nothing; a member must remove them (or push them) first`,
+        this.git(
+          mainCheckout,
+          "log",
+          "--oneline",
+          "--no-walk",
+          ...foreign
+        ).stdout.trim()
+      );
+    const pushed = this.git(
+      mainCheckout,
+      "push",
+      "--quiet",
+      "origin",
+      defaultBranch
+    );
+    if (pushed.code !== 0)
+      refuse(
+        `${defaultBranch} holds a recorded merge that origin lacks, but pushing it failed; run the command again`,
+        both(pushed)
+      );
+    return `; pushed ${defaultBranch} to origin`;
+  }
+  /** Fast-forward the default branch to origin's when origin moved on; refuse when they diverged. */
+  catchUpWithOrigin(mainCheckout, defaultBranch) {
+    this.must(mainCheckout, "git fetch origin", "fetch", "--quiet", "origin");
+    const remote = `refs/remotes/origin/${defaultBranch}`;
+    if (!this.sha(mainCheckout, remote)) return;
+    if (this.isAncestor(mainCheckout, remote, `refs/heads/${defaultBranch}`))
+      return;
+    const ff = this.git(mainCheckout, "merge", "--ff-only", "--quiet", remote);
+    if (ff.code !== 0)
+      refuse(
+        `${defaultBranch} and origin/${defaultBranch} have diverged`,
+        both(ff)
+      );
+  }
+  // ── a git origin, or none ─────────────────────────────────────────
+  async viaGit(ctx) {
+    const { worktreeDir, mainCheckout, branch, defaultBranch, hasOrigin } = ctx;
+    const { item } = this.input;
+    const defaultRef = `refs/heads/${defaultBranch}`;
+    if (hasOrigin)
+      this.must(mainCheckout, "git fetch origin", "fetch", "--quiet", "origin");
+    const tip = this.must(
+      worktreeDir,
+      `reading ${branch}`,
+      "rev-parse",
+      `refs/heads/${branch}`
+    );
+    let recorded = this.recordedMerge(mainCheckout);
+    if (recorded && !(this.isAncestor(mainCheckout, recorded, defaultRef) && (this.isAncestor(mainCheckout, tip, defaultRef) || this.sha(mainCheckout, `${TESTED_REFS}/${item}`) === tip))) {
+      this.forgetMerge(mainCheckout);
+      recorded = null;
+    }
+    if (recorded) {
+      const pushed = hasOrigin ? this.pushRecordedOnly(mainCheckout, defaultBranch) : "";
+      if (hasOrigin) this.deleteRemoteBranch(mainCheckout, branch);
+      return {
+        outcome: "already_merged",
+        detail: `${item} was merged at ${recorded.slice(0, 7)}${pushed}`
+      };
+    }
+    if (this.isAncestor(mainCheckout, tip, defaultRef))
+      refuse(
+        `no commits to merge: ${defaultBranch} already holds every commit of ${branch}, and drisp drive merge did not merge it (a merge it did not record does not count)`
+      );
+    const checkedOut = this.checkedOut(mainCheckout);
+    if (checkedOut !== defaultBranch)
+      refuse(
+        `the main checkout has ${checkedOut || "a detached HEAD"} checked out, not ${defaultBranch}`
+      );
+    const dirty = this.status(mainCheckout, "no");
+    if (dirty.length > 0)
+      refuse(
+        "the main checkout has uncommitted changes to tracked files",
+        dirty.join("\n")
+      );
+    for (let round = 1; round <= MAX_ROUNDS; round++) {
+      if (hasOrigin) {
+        this.pushRecordedOnly(mainCheckout, defaultBranch);
+        this.catchUpWithOrigin(mainCheckout, defaultBranch);
+      }
+      const before = this.must(
+        mainCheckout,
+        "reading the base",
+        "rev-parse",
+        defaultRef
+      );
+      const sha = this.rebase(worktreeDir, defaultRef);
+      const checks = await this.runRepoChecks(
+        mainCheckout,
+        worktreeDir,
+        before,
+        sha
+      );
+      if (hasOrigin) this.catchUpWithOrigin(mainCheckout, defaultBranch);
+      const base = this.must(
+        mainCheckout,
+        "reading the base",
+        "rev-parse",
+        defaultRef
+      );
+      if (!this.isAncestor(mainCheckout, base, sha)) {
+        this.deps.log(
+          `${defaultBranch} moved to ${base.slice(0, 7)} during the checks; rebasing again`
+        );
+        continue;
+      }
+      const merge = this.must(
+        mainCheckout,
+        "creating the merge commit",
+        "commit-tree",
+        `${sha}^{tree}`,
+        "-p",
+        base,
+        "-p",
+        sha,
+        "-m",
+        `Merge ${item} (${branch})`
+      );
+      this.must(
+        mainCheckout,
+        "recording the merge",
+        "update-ref",
+        `${MERGED_REFS}/${item}`,
+        merge
+      );
+      this.must(
+        mainCheckout,
+        "recording the merge",
+        "update-ref",
+        `${TESTED_REFS}/${item}`,
+        sha
+      );
+      const advanced = this.advance(
+        ctx,
+        merge,
+        ` after ${checks.map((check) => `\`${check}\``).join(", ")} passed on ${sha.slice(0, 7)}`
+      );
+      if (advanced) return advanced;
+    }
+    return stop("checks_failed", baseKeptMoving(defaultBranch));
+  }
+  /**
+   * Fast-forward the default branch to the recorded merge and push it. Returns null when origin moved under the
+   * push, after undoing the local merge, so the caller rebases and checks again.
+   */
+  advance(ctx, merge, evidence) {
+    const { mainCheckout, branch, defaultBranch, hasOrigin } = ctx;
+    const before = this.must(
+      mainCheckout,
+      "reading the base",
+      "rev-parse",
+      `refs/heads/${defaultBranch}`
+    );
+    const ff = this.git(mainCheckout, "merge", "--ff-only", "--quiet", merge);
+    if (ff.code !== 0) {
+      this.forgetMerge(mainCheckout);
+      refuse(
+        `fast-forwarding ${defaultBranch} in the main checkout failed`,
+        both(ff)
+      );
+    }
+    let note = "";
+    if (hasOrigin) {
+      const pushed = this.git(
+        mainCheckout,
+        "push",
+        "--quiet",
+        "origin",
+        defaultBranch
+      );
+      if (pushed.code !== 0) {
+        this.git(mainCheckout, "fetch", "--quiet", "origin");
+        const remote = this.sha(
+          mainCheckout,
+          `refs/remotes/origin/${defaultBranch}`
+        );
+        if (remote && !this.isAncestor(mainCheckout, remote, merge)) {
+          this.git(mainCheckout, "reset", "--keep", "--quiet", before);
+          this.forgetMerge(mainCheckout);
+          this.deps.log(
+            `origin/${defaultBranch} moved during the merge; rebasing again`
+          );
+          return null;
+        }
+        refuse(
+          `merged ${branch} into ${defaultBranch} locally (recorded), but pushing ${defaultBranch} failed; run the command again to push`,
+          both(pushed)
+        );
+      }
+      this.deleteRemoteBranch(mainCheckout, branch);
+      note = "; pushed to origin";
+    }
+    return {
+      outcome: "merged",
+      detail: `${branch} merged into ${defaultBranch} at ${merge.slice(0, 7)}${evidence}${note}`
+    };
+  }
+  // ── GitHub ────────────────────────────────────────────────────────
+  async viewPullRequest(worktreeDir, selector) {
+    const view = await this.deps.gh(worktreeDir, [
+      "pr",
+      "view",
+      selector,
+      "--json",
+      "number,state,url,headRefName,headRefOid,baseRefName,mergedAt"
+    ]);
+    if (view.code !== 0)
+      refuse(
+        `no pull request found for ${selector}; the subagent opens one before the merge`,
+        both(view)
+      );
+    try {
+      return JSON.parse(view.stdout);
+    } catch {
+      return refuse("could not read gh pr view", both(view));
+    }
+  }
+  async viaGitHub(ctx) {
+    const { worktreeDir, mainCheckout, branch, defaultBranch } = ctx;
+    let pr = await this.viewPullRequest(worktreeDir, this.input.pr ?? branch);
+    if (pr.headRefName !== branch)
+      refuse(
+        `pull request #${pr.number} is for ${pr.headRefName}, not ${branch}`
+      );
+    if (pr.state === "MERGED") {
+      this.pullMainCheckout(mainCheckout, defaultBranch);
+      this.deleteRemoteBranch(mainCheckout, branch);
+      return {
+        outcome: "already_merged",
+        detail: `pull request #${pr.number} was merged at ${pr.mergedAt ?? "an earlier time"}`
+      };
+    }
+    if (pr.state !== "OPEN")
+      refuse(`pull request #${pr.number} is ${pr.state.toLowerCase()}`);
+    if (pr.baseRefName !== defaultBranch)
+      refuse(
+        `pull request #${pr.number} targets ${pr.baseRefName}, not ${defaultBranch}`
+      );
+    const base = `refs/remotes/origin/${defaultBranch}`;
+    const fetchBase = () => this.must(
+      worktreeDir,
+      "git fetch origin",
+      "fetch",
+      "--quiet",
+      "origin",
+      defaultBranch
+    );
+    fetchBase();
+    if (this.isAncestor(worktreeDir, `refs/heads/${branch}`, base))
+      refuse(
+        `no commits to merge: origin/${defaultBranch} already holds every commit of ${branch}`
+      );
+    for (let round = 1; round <= MAX_ROUNDS; round++) {
+      if (round > 1) {
+        pr = await this.viewPullRequest(worktreeDir, String(pr.number));
+        fetchBase();
+      }
+      const baseSha = this.must(
+        worktreeDir,
+        "reading the base",
+        "rev-parse",
+        base
+      );
+      const sha = this.rebase(worktreeDir, base);
+      this.pushBranch(worktreeDir, branch, pr.headRefOid, sha);
+      const proof = await this.awaitChecks(worktreeDir, pr.number, sha);
+      const ran = proof === "none" ? await this.runRepoChecks(mainCheckout, worktreeDir, baseSha, sha) : null;
+      fetchBase();
+      if (!this.isAncestor(worktreeDir, base, sha)) {
+        this.deps.log(
+          `origin/${defaultBranch} moved during the checks; rebasing again`
+        );
+        continue;
+      }
+      const merged = await this.deps.gh(worktreeDir, [
+        "pr",
+        "merge",
+        String(pr.number),
+        "--squash",
+        "--match-head-commit",
+        sha
+      ]);
+      if (merged.code !== 0) {
+        const after = await this.viewPullRequest(
+          worktreeDir,
+          String(pr.number)
+        );
+        if (after.state !== "MERGED")
+          refuse(`gh pr merge #${pr.number} failed`, both(merged));
+      }
+      this.pullMainCheckout(mainCheckout, defaultBranch);
+      this.deleteRemoteBranch(mainCheckout, branch);
+      return {
+        outcome: "merged",
+        detail: `pull request #${pr.number} squash-merged at ${sha.slice(0, 7)} after ${ran ? `no GitHub checks; ${ran.map((check) => `\`${check}\``).join(", ")} passed` : proof}`
+      };
+    }
+    return stop("checks_failed", baseKeptMoving(defaultBranch));
+  }
+  /**
+   * Push the rebased branch, leased on the head GitHub reported, so a commit pushed meanwhile is never overwritten.
+   * When the lease fails it reads origin again: already at `sha` is fine; anything else is `refused`.
+   */
+  pushBranch(worktreeDir, branch, lease, sha) {
+    const pushed = this.git(
+      worktreeDir,
+      "push",
+      "--quiet",
+      `--force-with-lease=refs/heads/${branch}:${lease}`,
+      "origin",
+      `${sha}:refs/heads/${branch}`
+    );
+    if (pushed.code === 0) return;
+    this.git(worktreeDir, "fetch", "--quiet", "origin", branch);
+    const remote = this.sha(worktreeDir, `refs/remotes/origin/${branch}`);
+    if (remote === sha) return;
+    refuse(
+      `origin's ${branch} is at ${remote?.slice(0, 7) ?? "an unknown commit"}, not the ${lease.slice(0, 7)} the pull request reported, so the push was refused; the subagent pulls those commits into its worktree, then merge again`,
+      both(pushed)
+    );
+  }
+  /**
+   * Wait until GitHub reports the pushed commit's checks done. Required checks decide; with none required, all
+   * checks, which must hold for a settle period after GitHub first reports the commit; with no checks at all
+   * after the grace period (also counted from then), `none`. A failed or cancelled check is `checks_failed`; the
+   * bound is `checks_timeout`.
+   */
+  async awaitChecks(worktreeDir, pr, sha) {
+    let seenAt = null;
+    for (; ; ) {
+      const view = await this.viewPullRequest(worktreeDir, String(pr));
+      let verdict;
+      if (view.headRefOid !== sha) {
+        verdict = {
+          kind: "waiting",
+          detail: `GitHub has not seen ${sha.slice(0, 7)} yet`
+        };
+      } else {
+        seenAt ??= this.deps.now();
+        const since = this.deps.now() - seenAt;
+        verdict = await this.readChecks(worktreeDir, pr);
+        if (verdict.kind === "none" && since >= this.graceMs) return "none";
+        if (verdict.kind === "passed" && verdict.scope === "checks" && since < this.settleMs)
+          verdict = {
+            kind: "waiting",
+            detail: "checks passed; waiting for late checks to register"
+          };
+      }
+      if (verdict.kind === "passed") return verdict.detail;
+      if (verdict.kind === "failed") stop("checks_failed", verdict.detail);
+      if (this.left() < this.pollMs)
+        stop(
+          "checks_timeout",
+          `the command's ${Math.round(this.timeoutMs / 1e3)} s deadline passed waiting for checks (${verdict.detail}); run the command again to keep waiting`
+        );
+      this.deps.log(`waiting for checks: ${verdict.detail}`);
+      await this.deps.sleep(this.pollMs);
+    }
+  }
+  async readChecks(worktreeDir, pr) {
+    const read = async (required) => {
+      const result = await this.deps.gh(worktreeDir, [
+        "pr",
+        "checks",
+        String(pr),
+        ...required ? ["--required"] : [],
+        "--json",
+        "name,bucket"
+      ]);
+      return readCheckList(result.stdout, result.stderr);
+    };
+    const empty = (list2) => list2.kind === "none" || list2.kind === "checks" && list2.checks.length === 0;
+    let list = await read(true);
+    let scope = "required checks";
+    if (empty(list)) {
+      list = await read(false);
+      scope = "checks";
+    }
+    if (empty(list)) return { kind: "none", detail: "no checks reported" };
+    if (list.kind === "unreadable")
+      return { kind: "waiting", detail: list.detail };
+    return list.kind === "checks" ? judge(list.checks, scope) : { kind: "none", detail: "no checks reported" };
+  }
+  /**
+   * Delete the merged item's branch on origin, so clean-up needs no push of its own (in Run D of the sandbox a
+   * clean-up loop's `git push origin --delete $b` parked the Run: its target is a variable). Best effort: a branch
+   * that was never pushed, or one GitHub already deleted, is fine.
+   */
+  deleteRemoteBranch(mainCheckout, branch) {
+    if (this.git(
+      mainCheckout,
+      "ls-remote",
+      "--exit-code",
+      "--heads",
+      "origin",
+      branch
+    ).code !== 0)
+      return;
+    this.git(mainCheckout, "push", "--quiet", "origin", "--delete", branch);
+  }
+  /** Bring the main checkout up to date after a merge on GitHub, so the next worktree starts from it. Best effort. */
+  pullMainCheckout(mainCheckout, defaultBranch) {
+    if (this.checkedOut(mainCheckout) !== defaultBranch) return;
+    this.git(
+      mainCheckout,
+      "pull",
+      "--quiet",
+      "--ff-only",
+      "origin",
+      defaultBranch
+    );
+  }
+};
+
+// src/core/drive/processes.ts
+import { spawn, spawnSync as spawnSync2 } from "child_process";
+import fs13 from "fs";
+import os4 from "os";
+import path13 from "path";
+
+// src/core/drive/lock.ts
+import fs12 from "fs";
+import path12 from "path";
+var LOCK_FILE = "drisp-drive-merge.lock";
+function alive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+var TAKEOVER_STALE_MS = 1e4;
+function ownerOf(file) {
+  try {
+    const owner = Number(fs12.readFileSync(file, "utf8"));
+    return Number.isInteger(owner) && owner > 0 ? owner : null;
+  } catch {
+    return null;
+  }
+}
+function takeOverStale(file, deadOwner) {
+  const marker = `${file}.takeover`;
+  try {
+    fs12.writeFileSync(marker, String(process.pid), { flag: "wx" });
+  } catch {
+    try {
+      if (Date.now() - fs12.statSync(marker).mtimeMs > TAKEOVER_STALE_MS)
+        fs12.unlinkSync(marker);
+    } catch {
+    }
+    return;
+  }
+  try {
+    if (ownerOf(file) === deadOwner) fs12.unlinkSync(file);
+  } catch {
+  } finally {
+    fs12.unlinkSync(marker);
+  }
+}
+async function acquireLock(commonDir, waitMs) {
+  const file = path12.join(commonDir, LOCK_FILE);
+  const deadline = Date.now() + waitMs;
+  for (; ; ) {
+    try {
+      fs12.writeFileSync(file, String(process.pid), { flag: "wx" });
+      return () => {
+        if (ownerOf(file) === process.pid) {
+          try {
+            fs12.unlinkSync(file);
+          } catch {
+          }
+        }
+      };
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+    }
+    const owner = ownerOf(file);
+    if (owner !== null && !alive(owner)) {
+      takeOverStale(file, owner);
+      continue;
+    }
+    if (Date.now() >= deadline) return null;
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+}
+
+// src/core/drive/processes.ts
+var OUTPUT_CAP = 1024 * 1024;
+function runGit(cwd, args) {
+  const result = spawnSync2("git", ["-C", cwd, ...args], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    maxBuffer: 64 * 1024 * 1024
+  });
+  return {
+    code: result.error ? 127 : result.status ?? 1,
+    stdout: result.stdout,
+    stderr: result.error ? result.error.message : result.stderr
+  };
+}
+function runProcess(program, args, cwd, timeoutMs) {
+  return new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    const child = spawn(program, args, {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+      detached: true
+    });
+    const keep = (text, chunk) => (text + chunk.toString()).slice(-OUTPUT_CAP);
+    child.stdout.on("data", (chunk) => {
+      stdout = keep(stdout, chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr = keep(stderr, chunk);
+    });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try {
+        if (child.pid) process.kill(-child.pid, "SIGKILL");
+      } catch {
+        child.kill("SIGKILL");
+      }
+    }, timeoutMs);
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      resolve({ code: 127, stdout, stderr: error.message, timedOut });
+    });
+    child.on("close", (code, signal) => {
+      clearTimeout(timer);
+      resolve({
+        code: code ?? (signal ? 128 : 1),
+        stdout,
+        stderr,
+        timedOut
+      });
+    });
+  });
+}
+var GH_TIMEOUT_MS = 6e4;
+function runCheck(cwd, command, timeoutMs) {
+  return runProcess(
+    "bash",
+    ["-e", "-o", "pipefail", "-c", command],
+    cwd,
+    timeoutMs
+  ).then((result) => ({
+    ...result,
+    // One stream reads better in a Report: the check's own interleaving is lost either way.
+    stdout: [result.stdout, result.stderr].filter(Boolean).join("\n"),
+    stderr: ""
+  }));
+}
+function packageTestScript(dir) {
+  try {
+    const manifest = JSON.parse(
+      fs13.readFileSync(path13.join(dir, "package.json"), "utf8")
+    );
+    const test = manifest.scripts?.["test"];
+    return typeof test === "string" && test.trim() ? test : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function scratchDir() {
+  const parent = fs13.mkdtempSync(path13.join(os4.tmpdir(), SCRATCH_PREFIX));
+  return {
+    dir: path13.join(parent, "checkout"),
+    cleanup: () => fs13.rmSync(parent, { recursive: true, force: true })
+  };
+}
+function linkDependencies(fromDir, toDir) {
+  const modules = path13.join(fromDir, "node_modules");
+  if (fs13.existsSync(modules) && !fs13.existsSync(path13.join(toDir, "node_modules")))
+    fs13.symlinkSync(modules, path13.join(toDir, "node_modules"), "dir");
+}
+function processDeps(configuredChecks, log) {
+  return {
+    git: runGit,
+    gh: (cwd, args) => runProcess("gh", args, cwd, GH_TIMEOUT_MS).then(
+      ({ timedOut, ...result }) => timedOut ? {
+        ...result,
+        code: result.code || 124,
+        stderr: `${result.stderr}
+gh timed out`
+      } : result
+    ),
+    runCheck,
+    configuredChecks,
+    packageTestScript,
+    lock: acquireLock,
+    scratchDir,
+    linkDependencies,
+    exists: (target) => fs13.existsSync(target),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    now: () => Date.now(),
+    log
+  };
+}
+
+// src/app/entry/driveCommand.ts
+var USAGE4 = `Usage: drisp drive merge <item> --worktree <path> [--branch <branch>] [--pr <number|url>] [--timeout-ms <ms>]
+Merges a drive item: already merged \u2192 already_merged; rebase onto the default branch (conflict); on GitHub push with
+--force-with-lease, wait for the required checks (all checks when none is required; the repository's checks when
+there are none) and gh pr merge; otherwise run the repository's checks (.athena/config.json "checks", else the
+package.json test script) and merge --no-ff into the default branch, then push it. Prints {outcome, detail, output?}
+with outcome merged | already_merged | conflict | checks_failed | checks_timeout | refused.`;
+async function runDriveCommand(input) {
+  const stdout = input.stdout ?? process.stdout;
+  const stderr = input.stderr ?? process.stderr;
+  const [item, ...extra] = input.positional;
+  if (input.subcommand !== "merge" || !item || extra.length > 0 || !input.flags.worktree || input.flags.timeoutMs !== void 0 && !(Number.isFinite(input.flags.timeoutMs) && input.flags.timeoutMs > 0)) {
+    stderr.write(`${USAGE4}
+`);
+    return 2;
+  }
+  const deps = input.deps ?? processDeps(
+    (dir) => readConfig(dir).checks,
+    (line) => stderr.write(`${line}
+`)
+  );
+  let result;
+  try {
+    result = await driveMerge(
+      {
+        item,
+        worktree: path14.resolve(input.cwd, input.flags.worktree),
+        ...input.flags.branch ? { branch: input.flags.branch } : {},
+        ...input.flags.pr ? { pr: input.flags.pr } : {},
+        ...input.flags.timeoutMs !== void 0 ? { timeoutMs: input.flags.timeoutMs } : {}
+      },
+      deps
+    );
+  } catch (error) {
+    result = {
+      outcome: "refused",
+      detail: `drive merge failed unexpectedly: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  stdout.write(`${JSON.stringify({ item, ...result })}
+`);
+  return result.outcome === "merged" || result.outcome === "already_merged" ? 0 : 1;
+}
+
+// src/app/entry/trackerCommand.ts
+import { readFile as readFile2 } from "fs/promises";
+async function runTrackerCommand(args, env2 = process.env) {
+  const usage2 = "Usage: drisp tracker get <issue-id> | apply <operation.json>\nOperations: issue.revision, issue.comment, issue.attention, issue.evidence. Read the Issue first for its current version. Evidence includes revision, reference, kind and runId; staging/QA also require deploymentId. Production release confirmation is a human action.";
+  try {
+    if (!env2.DRISP_HUB_URL || !env2.DRISP_RUN_TOKEN)
+      throw new Error(
+        "This command requires a native Issue Run with DRISP_HUB_URL and DRISP_RUN_TOKEN."
+      );
+    const client2 = DrispClient.delegated(
+      env2.DRISP_HUB_URL,
+      env2.DRISP_RUN_TOKEN
+    );
+    const [action, argument, ...extra] = args;
+    if (!argument || extra.length) throw new Error(usage2);
+    if (action === "get")
+      process.stdout.write(
+        JSON.stringify(await client2.trackerIssue(argument)) + "\n"
+      );
+    else if (action === "apply") {
+      const operation = trackerOperationSchema.parse(
+        JSON.parse(await readFile2(argument, "utf8"))
+      );
+      process.stdout.write(
+        JSON.stringify(await client2.trackerOperation(operation)) + "\n"
+      );
+    } else throw new Error(usage2);
+    return 0;
+  } catch (error) {
+    process.stderr.write(
+      (error instanceof Error ? error.message : String(error)) + "\n"
+    );
+    return 2;
+  }
+}
+
+// src/app/entry/workCommand.ts
+import { readFile as readFile3 } from "fs/promises";
+var WORK_USAGE = `Usage: drisp work authority
+       drisp work issue <issue-id> | plan <plan-id>
+       drisp work start issue|plan <id> [--activation <file.json>] [--command-id <id>]
+       drisp work follow-up issue|plan|execution <id> "<text>" [--command-id <id>]
+       drisp work inspect <execution-id>
+       drisp work hold|unhold|pause|resume <execution-id> [--reason <text>] [--generation <n>] [--command-id <id>]
+       drisp work cancel <execution-id> [--reason <text>] [--grace-ms <0-590000>] [--generation <n>] [--command-id <id>]
+       drisp work revise <assignment-id> --changes <file.json> --reason <text> [--command-id <id>]
+       drisp work reconcile <effect-id> succeeded|failed --evidence <file.json> --generation <n>
+       drisp work recover <assignment-id> --reason <text> [--session auto|original|fresh] [--runner-id <id>]
+       drisp work close <execution-id> cancelled|failed [--acknowledge <effect-id,...>] [--reason <text>]
+       drisp work answer <question-id> "<text>" | --decision allow|deny  [--command-id <id>]
+       drisp work accept|reject <execution-id> <package-id> "<reason>" [--generation <n>]
+       drisp work brief
+       drisp work forward <question-id> "<note>"
+       drisp work incorporate <assignment-id> <version> --generation <n> [--tool-use-id <id>]
+DRISP_HUB_URL is the Team's Hub base (https://<hub>/v2/orgs/<team>); DRISP_HUB_TOKEN a member's token, DRISP_RUN_TOKEN a
+coordinated Run's credential (brief, incorporate, forward, and answer as that Run). incorporate reads
+DRISP_TOOL_USE_ID when set; the Runner does not set it yet (DRI-353). A control prints "requested" until the
+Hub records it effective; a cancel reads requested, then the cancellation's state (stopping, waiting_on_children,
+effects_outstanding, runs_lost), and effective only once the execution closed as cancelled, with cleanStop as the Hub
+recorded it. Nothing here starts a legacy Build: under legacy execution authority starts and controls are
+refused (execution_authority_legacy) and the Build commands stay the legacy path.`;
+function workCommandFlags(flags) {
+  const result = {};
+  for (const name of [
+    "reason",
+    "activation",
+    "commandId",
+    "toolUseId",
+    "decision",
+    "changes",
+    "evidence",
+    "session",
+    "runnerId",
+    "acknowledge"
+  ])
+    if (typeof flags[name] === "string") result[name] = flags[name];
+  for (const name of ["generation", "graceMs"])
+    if (typeof flags[name] === "number") result[name] = flags[name];
+  return result;
+}
+var UsageError = class extends Error {
+};
+var UNSUPPORTED = {
+  control: "execution.control",
+  amend: "execution.amend",
+  activate: "execution.activate",
+  message: "message.send",
+  "record-effect": "effect.record",
+  "decide-child": "coordinator.decide",
+  build: "legacy.build_start"
+};
+var RUN_CREDENTIAL = /* @__PURE__ */ new Set(["brief", "incorporate", "forward"]);
+async function runWorkCommand(args, flags = {}, env2 = process.env, io = {
+  out: (line) => process.stdout.write(line + "\n"),
+  err: (line) => process.stderr.write(line + "\n")
+}) {
+  const [sub = "", ...rest] = args;
+  try {
+    if (!sub || sub === "help") throw new UsageError(WORK_USAGE);
+    const asRun = RUN_CREDENTIAL.has(sub);
+    const token = asRun ? env2.DRISP_RUN_TOKEN ?? env2.DRISP_HUB_TOKEN : env2.DRISP_HUB_TOKEN ?? env2.DRISP_RUN_TOKEN;
+    if (!env2.DRISP_HUB_URL || !token)
+      throw new UsageError(
+        `drisp work needs DRISP_HUB_URL and ${asRun ? "DRISP_RUN_TOKEN" : "DRISP_HUB_TOKEN"}.`
+      );
+    if (flags.generation !== void 0 && !(Number.isInteger(flags.generation) && flags.generation > 0))
+      throw new UsageError("--generation must be a positive whole number.");
+    const team = /\/v2\/orgs\/([^/]+)\/?$/.exec(
+      new URL(env2.DRISP_HUB_URL).pathname
+    );
+    if (!team)
+      throw new UsageError(
+        "DRISP_HUB_URL must be the Team base, https://<hub>/v2/orgs/<team>."
+      );
+    const client2 = DrispClient.delegated(env2.DRISP_HUB_URL, token);
+    const teamId = decodeURIComponent(team[1]);
+    const flows = new WorkFlows(client2, teamId);
+    const result = await dispatch(
+      flows,
+      sub,
+      rest,
+      flags,
+      env2,
+      io.readFile ?? ((path17) => readFile3(path17, "utf8"))
+    );
+    io.out(JSON.stringify(result));
+    return 0;
+  } catch (error) {
+    if (error instanceof UsageError) {
+      io.err(error.message);
+      return 2;
+    }
+    if (error instanceof WorkFlowError || error instanceof ClientError) {
+      io.out(
+        JSON.stringify({
+          error: error.code,
+          ...error instanceof ClientError ? { status: error.status } : {},
+          ...error.details
+        })
+      );
+      return 1;
+    }
+    io.out(
+      JSON.stringify({
+        error: "request_failed",
+        message: error instanceof Error ? error.message : String(error)
+      })
+    );
+    return 1;
+  }
+}
+function need(values, count) {
+  if (values.length !== count) throw new UsageError(WORK_USAGE);
+  return values;
+}
+function scopeOf(kind) {
+  if (kind !== "issue" && kind !== "plan") throw new UsageError(WORK_USAGE);
+  return kind;
+}
+async function dispatch(flows, sub, rest, flags, env2, read) {
+  const commandId = flags.commandId;
+  switch (sub) {
+    case "authority": {
+      need(rest, 0);
+      const path17 = await flows.path();
+      return { path: path17, operations: await flows.operations() };
+    }
+    case "issue": {
+      const [id] = need(rest, 1);
+      return flows.readIssue(id);
+    }
+    case "plan": {
+      const [id] = need(rest, 1);
+      return flows.readPlan(id);
+    }
+    case "start": {
+      const [kind, id] = need(rest, 2);
+      const activation = flags.activation ? JSON.parse(await read(flags.activation)) : void 0;
+      if (activation && typeof activation.runId !== "string")
+        activation.runId = crypto.randomUUID();
+      return flows.start(
+        { kind: scopeOf(kind), id },
+        {
+          ...activation ? { activation } : {},
+          ...commandId ? { commandId } : {}
+        }
+      );
+    }
+    case "follow-up": {
+      const [kind, id, text] = need(rest, 3);
+      const target = kind === "execution" ? { kind: "execution", id } : { kind: scopeOf(kind), id };
+      return flows.followUp(target, text, commandId);
+    }
+    case "inspect": {
+      const [id] = need(rest, 1);
+      return flows.inspect(id);
+    }
+    case "hold":
+    case "unhold":
+    case "pause":
+    case "resume":
+    case "cancel": {
+      const [id] = need(rest, 1);
+      if (sub === "cancel" && flags.graceMs !== void 0 && !(Number.isInteger(flags.graceMs) && flags.graceMs >= 0 && flags.graceMs <= maxClientCancelBoundaryGraceMs))
+        throw new UsageError(
+          `--grace-ms must be a whole number of milliseconds from 0 to ${maxClientCancelBoundaryGraceMs}.`
+        );
+      return flows.control(id, sub, {
+        ...flags.reason ? { reason: flags.reason } : {},
+        ...flags.generation !== void 0 ? { expectedGeneration: flags.generation } : {},
+        ...sub === "cancel" && flags.graceMs !== void 0 ? { boundaryGraceMs: flags.graceMs } : {},
+        ...commandId ? { commandId } : {}
+      });
+    }
+    case "revise": {
+      const [id] = need(rest, 1);
+      if (!flags.changes || !flags.reason) throw new UsageError(WORK_USAGE);
+      const changes = JSON.parse(await read(flags.changes));
+      return flows.revise(id, changes, flags.reason, {
+        ...commandId ? { commandId } : {}
+      });
+    }
+    case "reconcile": {
+      const [id, outcome] = need(rest, 2);
+      if (outcome !== "succeeded" && outcome !== "failed" || !flags.evidence || flags.generation === void 0)
+        throw new UsageError(WORK_USAGE);
+      const evidence = JSON.parse(await read(flags.evidence));
+      return flows.reconcile(id, outcome, evidence, {
+        expectedGeneration: flags.generation,
+        ...commandId ? { commandId } : {}
+      });
+    }
+    case "recover": {
+      const [id] = need(rest, 1);
+      const session = flags.session ?? "auto";
+      if (!flags.reason || session !== "auto" && session !== "original" && session !== "fresh")
+        throw new UsageError(WORK_USAGE);
+      return flows.recover(id, {
+        reason: flags.reason,
+        session,
+        ...flags.runnerId ? { runnerId: flags.runnerId } : {},
+        ...commandId ? { commandId } : {}
+      });
+    }
+    case "close": {
+      const [id, outcome] = need(rest, 2);
+      if (outcome !== "cancelled" && outcome !== "failed")
+        throw new UsageError(WORK_USAGE);
+      return flows.close(id, outcome, {
+        ...flags.reason ? { reason: flags.reason } : {},
+        ...flags.acknowledge ? { acknowledge: flags.acknowledge.split(",").filter(Boolean) } : {},
+        ...flags.generation !== void 0 ? { expectedGeneration: flags.generation } : {},
+        ...commandId ? { commandId } : {}
+      });
+    }
+    case "answer": {
+      const [id, text] = rest;
+      if (!id || rest.length > 2) throw new UsageError(WORK_USAGE);
+      const decision = flags.decision;
+      const answer = decision === "allow" || decision === "deny" ? { kind: "permission", decision } : text ? { kind: "text", text } : void 0;
+      if (!answer || text && flags.decision) throw new UsageError(WORK_USAGE);
+      return flows.answer(id, answer, {
+        ...commandId ? { commandId } : {},
+        ...env2.DRISP_HUB_TOKEN ? {} : { asRun: true }
+      });
+    }
+    case "accept":
+    case "reject": {
+      const [id, packageId, reason] = need(rest, 3);
+      return flows.decide(id, packageId, sub, reason, {
+        ...flags.generation !== void 0 ? { expectedGeneration: flags.generation } : {},
+        ...commandId ? { commandId } : {}
+      });
+    }
+    case "brief":
+      need(rest, 0);
+      return flows.brief();
+    case "forward": {
+      const [id, note] = need(rest, 2);
+      return flows.forward(id, note, commandId ? { commandId } : {});
+    }
+    case "incorporate": {
+      const [id, version2] = need(rest, 2);
+      if (flags.generation === void 0 || !/^[1-9][0-9]*$/.test(version2))
+        throw new UsageError(WORK_USAGE);
+      const toolUseId = flags.toolUseId ?? env2.DRISP_TOOL_USE_ID;
+      return flows.incorporate(id, Number(version2), {
+        generation: flags.generation,
+        ...toolUseId ? { toolUseId } : {},
+        ...commandId ? { commandId } : {}
+      });
+    }
+    default: {
+      const operation = UNSUPPORTED[sub];
+      const reason = operation ? WorkFlows.unsupported(operation) : void 0;
+      if (operation && reason)
+        throw new WorkFlowError("unsupported_operation", { operation, reason });
+      throw new UsageError(WORK_USAGE);
+    }
+  }
+}
+
+// src/app/entry/doctorCommand.ts
+import process7 from "process";
+
+// src/harnesses/claude/system/doctorEnvironment.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import * as fs14 from "fs";
+import * as os5 from "os";
+import * as path15 from "path";
+var MANAGED_POLICY_KEYS = [
+  "forceLoginMethod",
+  "forceLoginOrgUUID",
+  "allowManagedHooksOnly",
+  "allowManagedMcpServersOnly",
+  "allowManagedPermissionRulesOnly",
+  "disableAutoMode",
+  "disableBypassPermissionsMode",
+  "forceRemoteSettingsRefresh",
+  "availableModels",
+  "model",
+  "apiKeyHelper",
+  "awsCredentialExport"
+];
+function inspectSettingsFile(scope, filePath, statFn, readFileFn) {
+  let stat;
+  try {
+    stat = statFn(filePath);
+  } catch {
+    return { scope, path: filePath, present: false };
+  }
+  const info = {
+    scope,
+    path: filePath,
+    present: true,
     sizeBytes: stat.size,
     mtime: stat.mtime.toISOString()
   };
@@ -15690,14 +18297,14 @@ function tryRichAuth(claudeBinary) {
 function collectEnvironment(options = {}) {
   const platform2 = options.platform ?? process.platform;
   const env2 = options.env ?? process.env;
-  const homeDir = options.homeDir ?? os4.homedir();
+  const homeDir = options.homeDir ?? os5.homedir();
   const cwd = options.cwd ?? process.cwd();
   const resolveBinary = options.resolveClaudeBinaryFn ?? resolveClaudeBinary;
   const detectVersion = options.detectClaudeVersionFn ?? detectClaudeVersion;
   const runAuthStatus = options.runClaudeAuthStatusFn ?? runClaudeAuthStatus;
   const resolveForwarder = options.resolveHookForwarderCommandFn ?? resolveHookForwarderCommand;
-  const statFn = options.statFn ?? ((p) => fs12.statSync(p));
-  const readFileFn = options.readFileFn ?? ((p) => fs12.readFileSync(p, "utf8"));
+  const statFn = options.statFn ?? ((p) => fs14.statSync(p));
+  const readFileFn = options.readFileFn ?? ((p) => fs14.readFileSync(p, "utf8"));
   const settingsPaths = resolveClaudeSettingsSurfacePaths(
     homeDir,
     cwd,
@@ -15742,7 +18349,7 @@ function collectEnvironment(options = {}) {
   });
   let globalConfigPresent = false;
   try {
-    statFn(path12.join(homeDir, ".claude.json"));
+    statFn(path15.join(homeDir, ".claude.json"));
     globalConfigPresent = true;
   } catch {
     globalConfigPresent = false;
@@ -16222,13 +18829,13 @@ function runRunsCommand(input) {
 // src/app/entry/cli.tsx
 import { jsx as jsx24 } from "react/jsx-runtime";
 function resolvePackageJsonPath(entryUrl) {
-  let currentDir = path13.dirname(fileURLToPath(entryUrl));
+  let currentDir = path16.dirname(fileURLToPath(entryUrl));
   for (; ; ) {
-    const candidatePath = path13.join(currentDir, "package.json");
-    if (fs13.existsSync(candidatePath)) {
+    const candidatePath = path16.join(currentDir, "package.json");
+    if (fs15.existsSync(candidatePath)) {
       return candidatePath;
     }
-    const parentDir = path13.dirname(currentDir);
+    const parentDir = path16.dirname(currentDir);
     if (parentDir === currentDir) {
       throw new Error("Could not locate package.json for CLI metadata.");
     }
@@ -16238,6 +18845,8 @@ function resolvePackageJsonPath(entryUrl) {
 var require2 = createRequire(import.meta.url);
 var { version } = require2(resolvePackageJsonPath(import.meta.url));
 var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
+  "tracker",
+  "work",
   "setup",
   "sessions",
   "resume",
@@ -16251,6 +18860,7 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "marketplace",
   "runner",
   "build",
+  "drive",
   // Deprecated alias of `runner` (#188); removed in 0.7.0.
   "dashboard",
   "telemetry",
@@ -16277,7 +18887,7 @@ async function flushTelemetryOptOut(config) {
     deviceId: deviceId2,
     telemetryEnabled: config.telemetry,
     appVersion: version,
-    os: `${os5.platform()}-${os5.arch()}`
+    os: `${os6.platform()}-${os6.arch()}`
   });
   trackTelemetryOptedOut();
   await shutdownTelemetry();
@@ -16308,6 +18918,11 @@ function printExecDryRunSummary(runtimeConfig, context) {
   lines.push(
     `  model:             ${runtimeConfig.modelName ?? "(default)"} [${runtimeConfig.settingsProvenance?.model ?? "resolved"}]`
   );
+  lines.push(
+    `  gates:             ${Object.entries(runtimeConfig.gates).map(
+      ([gate, mode]) => `${gate}=${mode} [${runtimeConfig.settingsProvenance?.gates[gate] ?? "resolved"}]`
+    ).join(", ")}`
+  );
   lines.push(
     `  permission grace:  ${runtimeConfig.permissionGraceMs}ms [${runtimeConfig.settingsProvenance?.permissionGraceMs ?? "resolved"}]`
   );
@@ -16398,6 +19013,11 @@ var cli = meow(
 			runner [sub]          Run the runner that connects this machine to a Team and executes its Runs
 			                      (no subcommand: foreground; connect [code] --hub <url> [--replace], disconnect [team], status, restart, recover, help)
 			build plan --input <path>  Plan a Build inside an Orchestrator Run (prints one JSON object)
+			tracker get <issue>        Read the current native Drisp Issue
+			tracker apply <json>       Apply a scoped native Issue operation from a JSON file
+			work <sub>                 Canonical Work and coordinated executions (authority, issue, plan, start,
+			                           follow-up, inspect, hold, unhold, pause, resume, cancel, close, revise, reconcile, recover, answer, accept, reject,
+			                           brief, forward, incorporate); drisp work help for usage
 			build children             List this Build's children and their interruptions
 			build inspect <run> [cursor] Read a child's state and paged history
 			build guide <run> "<text>"  Guide a child or answer its delegated technical question
@@ -16407,6 +19027,8 @@ var cli = meow(
 			build step <n>             Report the Run's current step: writes the step run artifact ([--qa none|web|macos|both], --profile, --merge you, --sign-off <sha>, --complete --evidence, --verify)
 			build check <name> -- <cmd> Run a command and record its outcome: writes the checks run artifact
 			build merged               Record the merged pull request: writes the pull_request run artifact
+			drive merge <item> --worktree <path> [--branch <b>] [--pr <n>] [--timeout-ms <ms>]
+			                           Merge a drive item: rebase, prove the checks, merge (prints one JSON outcome)
 			telemetry [action]    Manage anonymous telemetry (enable/disable/status)
 			doctor                Diagnose Claude headless setup (use with --harness=claude)
 
@@ -16427,6 +19049,9 @@ var cli = meow(
 			--steer         Queue a human steer for the head of the next Turn's prompt (repeatable; run mode)
 			--answer        allow | deny: answer the permission a parked run is waiting on; replayed
 			                into the re-issued call on --continue (run mode)
+			--gate          <gate>=ask|auto for this run only (repeatable; run mode). Gates:
+			                planApproval, merge, budget, irreversible. Only tightens: =auto has an
+			                effect only where the configured floor is already auto (docs/human-gates.md)
 			--permission-grace-ms  How long a permission no rule answers is held for an attached
 			                hub before it is deferred and the run parks (default 60000; run mode)
 			--json          Emit JSONL events to stdout (run mode)
@@ -16514,6 +19139,10 @@ var cli = meow(
       answer: {
         type: "string"
       },
+      gate: {
+        type: "string",
+        isMultiple: true
+      },
       permissionGraceMs: {
         type: "number"
       },
@@ -16545,6 +19174,22 @@ var cli = meow(
         isMultiple: true
       },
       profile: { type: "string" },
+      // drisp drive merge (DRI-368)
+      worktree: { type: "string" },
+      branch: { type: "string" },
+      pr: { type: "string" },
+      // drisp work (DRI-342)
+      reason: { type: "string" },
+      generation: { type: "number" },
+      activation: { type: "string" },
+      commandId: { type: "string" },
+      graceMs: { type: "number" },
+      toolUseId: { type: "string" },
+      decision: { type: "string" },
+      changes: { type: "string" },
+      session: { type: "string" },
+      runnerId: { type: "string" },
+      acknowledge: { type: "string" },
       testFirst: { type: "string" },
       review: { type: "string" },
       merge: { type: "string" },
@@ -16594,7 +19239,7 @@ var cli = meow(
   }
 );
 async function main() {
-  const projectDir = path13.resolve(cli.flags.projectDir);
+  const projectDir = path16.resolve(cli.flags.projectDir);
   const [command, ...commandArgs] = cli.input;
   const isRunCommand = command === "run" || command === "exec";
   if (command && !KNOWN_COMMANDS.has(command)) {
@@ -16648,7 +19293,7 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
         await exitWith(1);
         return;
       }
-      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-VPBOZJY5.js");
+      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-MVTO43MW.js");
       const { waitUntilExit } = render(
         /* @__PURE__ */ jsx24(
           WorkflowInstallWizard,
@@ -16726,6 +19371,36 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
     );
     return;
   }
+  if (command === "tracker") {
+    await exitWith(await runTrackerCommand(commandArgs));
+    return;
+  }
+  if (command === "work") {
+    await exitWith(
+      await runWorkCommand(
+        commandArgs,
+        workCommandFlags(cli.flags)
+      )
+    );
+    return;
+  }
+  if (command === "drive") {
+    const [subcommand = "", ...positional] = commandArgs;
+    await exitWith(
+      await runDriveCommand({
+        subcommand,
+        positional,
+        flags: {
+          ...typeof cli.flags.worktree === "string" ? { worktree: cli.flags.worktree } : {},
+          ...typeof cli.flags.branch === "string" ? { branch: cli.flags.branch } : {},
+          ...typeof cli.flags.pr === "string" ? { pr: cli.flags.pr } : {},
+          ...typeof cli.flags.timeoutMs === "number" ? { timeoutMs: cli.flags.timeoutMs } : {}
+        },
+        cwd: process.cwd()
+      })
+    );
+    return;
+  }
   if (command === "build") {
     const rawArgs = process.argv.slice(2);
     const dashIdx = rawArgs.indexOf("--");
@@ -16828,8 +19503,8 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
   const showSetup = isRunCommand ? false : shouldShowSetup({
     cliInput: cli.input,
     setupComplete: globalConfig.setupComplete,
-    globalConfigExists: fs13.existsSync(
-      path13.join(os5.homedir(), ".config", "athena", "config.json")
+    globalConfigExists: fs15.existsSync(
+      path16.join(os6.homedir(), ".config", "athena", "config.json")
     )
   });
   let runtimeConfig;
@@ -16861,6 +19536,11 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
     await exitWith(RUN_EXIT_CODE.USAGE);
     return;
   }
+  if ((cli.flags.gate ?? []).length > 0 && !isRunCommand) {
+    console.error("Error: --gate is only supported in run mode.");
+    await exitWith(RUN_EXIT_CODE.USAGE);
+    return;
+  }
   if (cli.flags.dryRun) {
     if (!isRunCommand) {
       console.error("Error: --dry-run is only supported in exec mode.");
@@ -16886,7 +19566,7 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
     deviceId: resolvedDeviceId,
     telemetryEnabled: globalConfig.telemetry,
     appVersion: version,
-    os: `${os5.platform()}-${os5.arch()}`
+    os: `${os6.platform()}-${os6.arch()}`
   });
   trackAppLaunched({ version, harness: runtimeConfig.harness });
   if (!isRunCommand && isFirstRun && globalConfig.telemetry !== false) {
@@ -16907,7 +19587,8 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
         timeoutMs: cli.flags.timeoutMs,
         verbose: cli.flags.verbose,
         permissionGraceMs: cli.flags.permissionGraceMs,
-        answer: cli.flags.answer
+        answer: cli.flags.answer,
+        gates: cli.flags.gate
       },
       runtimeConfig
     });