@edgehero/pi-dispatch-admin 1.4.0 → 1.6.0

package/dist/index.mjs

@@ -7687,6 +7687,33 @@ var init_secret_profiles = __esm({
   }
 });
 
+// ../worker/src/wait-for.mjs
+function parseAfterInstant(text) {
+  if (typeof text !== "string" || !AFTER_INSTANT.test(text)) return { error: "shape" };
+  const ms = Date.parse(text);
+  if (!Number.isFinite(ms)) return { error: "calendar" };
+  const [year, month, day] = text.slice(0, 10).split("-").map(Number);
+  const probe = new Date(Date.UTC(year, month - 1, day));
+  if (year < 100) probe.setUTCFullYear(year);
+  if (probe.getUTCFullYear() !== year || probe.getUTCMonth() !== month - 1 || probe.getUTCDate() !== day) {
+    return { error: "calendar" };
+  }
+  return { ms };
+}
+function afterInstantMs(text) {
+  const parsed = parseAfterInstant(text);
+  return parsed.error ? null : parsed.ms;
+}
+var WAIT_CONDITION_KEYS, WAIT_CONDITION_MAX, WAIT_AFTER_MAX_DEFAULT_MS, AFTER_INSTANT;
+var init_wait_for = __esm({
+  "../worker/src/wait-for.mjs"() {
+    WAIT_CONDITION_KEYS = ["after", "profile"];
+    WAIT_CONDITION_MAX = 4;
+    WAIT_AFTER_MAX_DEFAULT_MS = 30 * 24 * 3600 * 1e3;
+    AFTER_INSTANT = /^\d{4}-\d{2}-\d{2}[Tt]([01]\d|2[0-3]):[0-5]\d(:[0-5]\d(\.\d+)?)?([Zz]|[+-]\d{2}:\d{2})$/;
+  }
+});
+
 // ../worker/src/config.mjs
 function configError(message) {
   const error = new Error(message);
@@ -7714,6 +7741,7 @@ var init_config2 = __esm({
     init_egress();
     init_forges();
     init_secret_profiles();
+    init_wait_for();
     CHAIN_DEPTH_MAX_DEFAULT = 1;
     CHAIN_MAX_PER_JOB_DEFAULT = 2;
     WORKER_ONLY_SECRET_VARS = /* @__PURE__ */ new Set(["GITHUB_APP_PRIVATE_KEY"]);
@@ -8024,10 +8052,112 @@ var init_pause_windows = __esm({
   }
 });
 
-// ../worker/src/subscriptions.mjs
+// ../worker/src/scoped-limits.mjs
+import { createHash } from "node:crypto";
+import { isAbsolute, resolve } from "node:path";
 function isNonEmptyString3(value) {
   return typeof value === "string" && value.trim() !== "";
 }
+function parseScopedLimits(text, path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    throw configError(`scoped-limits file is not valid JSON: ${path} (${error.message})`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw configError(`scoped-limits file must be an object with "version" and "limits": ${path}`);
+  }
+  const version = parsed.version;
+  if (!Number.isInteger(version) || version < 1) {
+    throw configError(`scoped-limits file must have "version": 1 (an integer >= 1): ${path}`);
+  }
+  if (version > SCOPED_LIMITS_VERSION) {
+    throw configError(`scoped-limits file written by a newer pi-dispatch (version ${version}; this build understands ${SCOPED_LIMITS_VERSION}): ${path}`);
+  }
+  if (!Array.isArray(parsed.limits)) {
+    throw configError(`scoped-limits file must have a "limits" array: ${path}`);
+  }
+  const rows = parsed.limits.map((row, index) => normalizeLimit(row, index, path));
+  const seen = /* @__PURE__ */ new Map();
+  rows.forEach((row, index) => {
+    if (seen.has(row.scope)) {
+      throw configError(`scoped limit at index ${index}: duplicate scope ${JSON.stringify(row.scope)} (first at index ${seen.get(row.scope)}): ${path}`);
+    }
+    seen.set(row.scope, index);
+  });
+  return rows;
+}
+function normalizeLimit(row, index, path) {
+  const at = `scoped limit at index ${index}`;
+  if (row === null || typeof row !== "object" || Array.isArray(row)) {
+    throw configError(`${at}: must be an object: ${path}`);
+  }
+  if (!isNonEmptyString3(row.scope)) throw configError(`${at}: scope must be a non-empty string: ${path}`);
+  const trimmed = row.scope.trim().normalize("NFC");
+  if (trimmed === "*") {
+    throw configError(`${at}: "*" is not supported -- add one row per scope (a per-scope default may adopt "*" later): ${path}`);
+  }
+  if (trimmed.includes("*")) {
+    throw configError(`${at}: scopes match exactly; a scope containing "*" is refused (no globs): ${path}`);
+  }
+  const norm = {
+    // An absolute path is stored resolved so a `/srv/site/` row governs `/srv/site` jobs -- the same
+    // collapse canonicalScope applies on the job side. isAbsolute is PLATFORM-NATIVE on purpose, so a
+    // foreign-platform row (a windows drive path on a POSIX worker) stays verbatim and is inert here;
+    // the doctor's unreferenced-scope advisory names it. Resolving it instead would "work" only by
+    // both sides mangling into the same cwd-prefixed string -- a match by accident, not by contract.
+    scope: isAbsolute(trimmed) ? resolve(trimmed) : trimmed,
+    day: null,
+    week: null,
+    month: null,
+    concurrent: null
+  };
+  let any = false;
+  for (const field of LIMIT_FIELDS) {
+    const value = row[field];
+    if (value === void 0 || value === null) continue;
+    if (!Number.isSafeInteger(value) || value < 1) {
+      throw configError(`${at}: ${field} must be an integer >= 1: ${path}`);
+    }
+    norm[field] = value;
+    any = true;
+  }
+  if (!any) {
+    throw configError(`${at}: at least one of day, week, month, concurrent is required (a row that limits nothing is a row an operator sets and then trusts): ${path}`);
+  }
+  return norm;
+}
+function scopeKeyPrefix(scope) {
+  const h = createHash("sha256").update(String(scope)).digest("hex").slice(0, 16);
+  return `budget:s:${h}`;
+}
+var SCOPED_LIMITS_VERSION, LIMIT_FIELDS;
+var init_scoped_limits = __esm({
+  "../worker/src/scoped-limits.mjs"() {
+    init_config2();
+    init_pause_windows();
+    SCOPED_LIMITS_VERSION = 1;
+    LIMIT_FIELDS = ["day", "week", "month", "concurrent"];
+  }
+});
+
+// ../worker/src/wait-state.mjs
+var LEASE_SLACK_MS, LEASE_MIN_MS, HELD_SET, jobKey, SATISFIED_MS;
+var init_wait_state = __esm({
+  "../worker/src/wait-state.mjs"() {
+    LEASE_SLACK_MS = 60 * 60 * 1e3;
+    LEASE_MIN_MS = 5 * 60 * 1e3;
+    HELD_SET = "wait:held";
+    jobKey = (jobId) => `wait:job:${jobId}`;
+    SATISFIED_MS = 15 * 60 * 1e3;
+  }
+});
+
+// ../worker/src/subscriptions.mjs
+function isNonEmptyString4(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
 function normalizeGlobs(value, label, at, path) {
   if (!Array.isArray(value) || value.length === 0) {
     throw configError(`${at}: ${label} must be a non-empty array of model globs: ${path}`);
@@ -8073,14 +8203,14 @@ function normalizeSubscription(entry, index, path, seenIds) {
   if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
     throw configError(`${at}: must be an object: ${path}`);
   }
-  if (!isNonEmptyString3(entry.id)) throw configError(`${at}: id must be a non-empty string: ${path}`);
+  if (!isNonEmptyString4(entry.id)) throw configError(`${at}: id must be a non-empty string: ${path}`);
   const id = entry.id.trim();
   if (seenIds.has(id)) {
     throw configError(`${at}: id ${JSON.stringify(id)} is already used by the subscription at index ${seenIds.get(id)}: ${path}`);
   }
   seenIds.set(id, index);
-  if (!isNonEmptyString3(entry.vendor)) throw configError(`${at}: vendor must be a non-empty string: ${path}`);
-  if (!isNonEmptyString3(entry.provider)) throw configError(`${at}: provider must be a non-empty string (the pi-ai provider id this plan covers): ${path}`);
+  if (!isNonEmptyString4(entry.vendor)) throw configError(`${at}: vendor must be a non-empty string: ${path}`);
+  if (!isNonEmptyString4(entry.provider)) throw configError(`${at}: provider must be a non-empty string (the pi-ai provider id this plan covers): ${path}`);
   const models = entry.models === void 0 ? ["*"] : normalizeGlobs(entry.models, "models", at, path);
   const price = entry.price;
   if (price === null || typeof price !== "object" || Array.isArray(price)) {
@@ -8100,7 +8230,7 @@ function normalizeSubscription(entry, index, path, seenIds) {
   let counterfactualModel = null;
   if (entry.counterfactualModel !== void 0 && entry.counterfactualModel !== null) {
     const cm = entry.counterfactualModel;
-    if (typeof cm !== "object" || Array.isArray(cm) || !isNonEmptyString3(cm.provider) || !isNonEmptyString3(cm.id)) {
+    if (typeof cm !== "object" || Array.isArray(cm) || !isNonEmptyString4(cm.provider) || !isNonEmptyString4(cm.id)) {
       throw configError(`${at}: counterfactualModel must be { provider, id } with non-empty strings (a PRICED pi-ai model to re-price covered runs at API rates): ${path}`);
     }
     counterfactualModel = { provider: cm.provider.trim(), id: cm.id.trim() };
@@ -8197,9 +8327,9 @@ var init_connection = __esm({
 });
 
 // ../worker/src/job-id.mjs
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 function localJobId({ folder, flow, task, minute }) {
-  const digest = createHash("sha256").update([folder, flow ?? "", task ?? "", minute].join("\0")).digest("hex");
+  const digest = createHash2("sha256").update([folder, flow ?? "", task ?? "", minute].join("\0")).digest("hex");
   return `local-${digest.slice(0, 16)}`;
 }
 var init_job_id = __esm({
@@ -8276,7 +8406,7 @@ var init_reserved_env = __esm({
 });
 
 // ../worker/src/triggers.mjs
-function isNonEmptyString4(value) {
+function isNonEmptyString5(value) {
   return typeof value === "string" && value.trim() !== "";
 }
 function parseTriggers(text, path) {
@@ -8331,7 +8461,7 @@ function normalizeTrigger(entry, index, path, state) {
 function normalizeCron(on, run, index, path, state) {
   const at = `trigger at index ${index}`;
   const id = on.id;
-  if (!isNonEmptyString4(id)) {
+  if (!isNonEmptyString5(id)) {
     throw configError(`${at}: cron on.id must be a non-empty string: ${path}`);
   }
   if (id.includes(":")) {
@@ -8345,7 +8475,7 @@ function normalizeCron(on, run, index, path, state) {
   }
   state.seenCronIds.add(id);
   const pattern = on.pattern;
-  if (!isNonEmptyString4(pattern)) {
+  if (!isNonEmptyString5(pattern)) {
     throw configError(`cron trigger "${id}": on.pattern must be a non-empty string: ${path}`);
   }
   const fieldCount = pattern.trim().split(/\s+/).length;
@@ -8353,13 +8483,13 @@ function normalizeCron(on, run, index, path, state) {
     throw configError(`cron trigger "${id}": on.pattern must have 5 or 6 space-separated fields, got ${fieldCount}: ${path}`);
   }
   const command = validateCommand(run, `cron trigger "${id}"`, path, { onType: "cron" });
-  if (!isNonEmptyString4(run.folder)) {
+  if (!isNonEmptyString5(run.folder)) {
     throw configError(`cron trigger "${id}": run.folder must be a non-empty string: ${path}`);
   }
-  if (command === void 0 && !isNonEmptyString4(run.flow)) {
+  if (command === void 0 && !isNonEmptyString5(run.flow)) {
     throw configError(`cron trigger "${id}": run.flow must be a non-empty string (or use run.command): ${path}`);
   }
-  if (command === void 0 && !isNonEmptyString4(run.task)) {
+  if (command === void 0 && !isNonEmptyString5(run.task)) {
     throw configError(`cron trigger "${id}": run.task must be a non-empty string: ${path}`);
   }
   if (run.github !== void 0 && typeof run.github !== "boolean") {
@@ -8376,6 +8506,7 @@ function normalizeCron(on, run, index, path, state) {
   validateDisarmed(on, `cron trigger "${id}"`, path, { onType: "cron" });
   const secrets = validateSecrets(run, `cron trigger "${id}"`, path);
   const secretsProfile = validateSecretsProfile(run, `cron trigger "${id}"`, path);
+  validateWaitFor(on, run, `cron trigger "${id}"`, path, { onType: "cron" });
   return {
     on: { type: "cron", id, pattern },
     run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: run.provider, model: run.model, maxTurns: run.maxTurns, github: run.github, packages, image, resume, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile } }
@@ -8443,7 +8574,7 @@ function validateCommand(run, at, path, { onType }) {
     throw configError(`${at}: exactly one of run.flow or run.command must be set -- a trigger dispatches either a flow or a registered command, and with both present the file does not say which one runs: ${path}`);
   }
   if (raw === void 0) return void 0;
-  if (!isNonEmptyString4(raw)) {
+  if (!isNonEmptyString5(raw)) {
     throw configError(`${at}: run.command must be a non-empty string -- the registered command name, optionally followed by its arguments: ${path}`);
   }
   if (raw !== raw.trim()) {
@@ -8529,10 +8660,10 @@ function validateDisarmed(on, at, path, { capable = false, onType } = {}) {
       throw configError(`${at}: on.disarmed has an unsupported key ${JSON.stringify(key)} (expected at|jobId): ${path}`);
     }
   }
-  if (!isNonEmptyString4(disarmed.at)) {
+  if (!isNonEmptyString5(disarmed.at)) {
     throw configError(`${at}: on.disarmed.at must be a non-empty string (the time the one-shot fired): ${path}`);
   }
-  if (disarmed.jobId !== void 0 && !isNonEmptyString4(disarmed.jobId)) {
+  if (disarmed.jobId !== void 0 && !isNonEmptyString5(disarmed.jobId)) {
     throw configError(`${at}: on.disarmed.jobId must be a non-empty string when present (the run record it joins to): ${path}`);
   }
   if (on.once !== true) {
@@ -8556,7 +8687,7 @@ function validateRepository(run, onType, at, path) {
   if (!needed) {
     throw configError(`${at}: run.repository is only meaningful on an azure label or comment trigger (a pull request names its own repository): ${path}`);
   }
-  if (!isNonEmptyString4(raw) || raw !== raw.trim() || raw.includes("/")) {
+  if (!isNonEmptyString5(raw) || raw !== raw.trim() || raw.includes("/")) {
     throw configError(`${at}: run.repository must be a non-empty repository NAME within the project, with no slashes and no surrounding whitespace (got ${JSON.stringify(raw)}): ${path}`);
   }
   return raw;
@@ -8596,7 +8727,7 @@ function validateSecrets(run, at, path) {
       throw configError(`${at}: run.secrets key ${JSON.stringify(name)} is a variable the worker sets itself -- the job container would receive the worker's value, not this trigger's, and the trigger would look like it worked: ${path}`);
     }
     const reference = secrets[name];
-    if (!isNonEmptyString4(reference)) {
+    if (!isNonEmptyString5(reference)) {
       throw configError(`${at}: run.secrets.${name} must be a non-empty string reference for your resolver to read (got ${JSON.stringify(reference)}): ${path}`);
     }
     if (reference !== reference.trim()) {
@@ -8614,7 +8745,7 @@ function validateSecrets(run, at, path) {
 function validateSecretsProfile(run, at, path) {
   const profile = run.secretsProfile;
   if (profile === void 0) return void 0;
-  if (!isNonEmptyString4(profile)) {
+  if (!isNonEmptyString5(profile)) {
     throw configError(`${at}: run.secretsProfile must be a non-empty string naming one of the resolver profiles this deployment declares (got ${JSON.stringify(profile)}): ${path}`);
   }
   if (!ID_CHARSET.test(profile)) {
@@ -8625,6 +8756,81 @@ function validateSecretsProfile(run, at, path) {
   }
   return profile;
 }
+function validateWaitFor(on, run, at, path, { onType }) {
+  for (const [label, source, exactIsLegal] of [
+    ["run", run, true],
+    ["on", on, false]
+  ]) {
+    for (const key of Object.keys(source ?? {})) {
+      if (exactIsLegal && key === "waitFor") continue;
+      if (key.replace(/[^a-z0-9]/gi, "").toLowerCase() !== "waitfor") continue;
+      throw configError(`${at}: ${label}.${key} is not a field -- did you mean run.waitFor? A wait condition the loader drops holds nothing while the file reads as though it does, so a near miss is refused rather than dropped: ${path}`);
+    }
+  }
+  const waitFor = run.waitFor;
+  if (waitFor === void 0) return void 0;
+  if (onType === "cron") {
+    throw configError(`${at}: run.waitFor is not yet covered on a cron trigger -- the scheduler advances at pickup, so a held occurrence outlives the teardown that would delete it and still pays, and its surviving job hash can fail worker boot with a scheduler id collision; bounding that needs delayed-set-aware teardown, which is a gap to close, not a limit: ${path}`);
+  }
+  if (on?.once === true) {
+    throw configError(`${at}: run.waitFor and on.once cannot be combined -- the one-shot disarms on every run record, so a wait that never cleared would spend the one-shot with no container ever started and no way to re-arm it but editing this file: ${path}`);
+  }
+  if (run.replicas !== void 0) {
+    throw configError(`${at}: run.waitFor and run.replicas cannot be combined -- replicas fan out at enqueue, so each one would hold and poll the same external condition independently, multiplying the checks by ${run.replicas} for one answer: ${path}`);
+  }
+  if (!Array.isArray(waitFor) || waitFor.length === 0) {
+    throw configError(`${at}: run.waitFor must be a non-empty array of conditions when present (got ${JSON.stringify(waitFor)}): ${path}`);
+  }
+  if (waitFor.length > WAIT_CONDITION_MAX) {
+    throw configError(`${at}: run.waitFor names ${waitFor.length} conditions, over the ${WAIT_CONDITION_MAX} cap -- each profile condition is a subprocess run before the container, holding a concurrency slot while it runs: ${path}`);
+  }
+  const expected = WAIT_CONDITION_KEYS.join("|");
+  const normalized = [];
+  const profiles = /* @__PURE__ */ new Set();
+  let seenAfter = false;
+  for (let i = 0; i < waitFor.length; i += 1) {
+    const condition = waitFor[i];
+    const where = `${at}: run.waitFor[${i}]`;
+    if (condition === null || typeof condition !== "object" || Array.isArray(condition)) {
+      throw configError(`${where} must be an object naming exactly one condition (got ${JSON.stringify(condition)}): ${path}`);
+    }
+    const keys = Object.keys(condition);
+    if (keys.length !== 1) {
+      throw configError(`${where} must name exactly one condition (expected ${expected}), got ${keys.length === 0 ? "an empty object" : JSON.stringify(keys)}: ${path}`);
+    }
+    const key = keys[0];
+    if (key === "exclusive") {
+      throw configError(`${where}: exclusive is no longer a condition you write -- the worker already holds at most one local job per folder, always on, with no configuration and no off switch, and scoped-limits.json bounds any scope further: ${path}`);
+    }
+    if (!WAIT_CONDITION_KEYS.includes(key)) {
+      throw configError(`${where} has an unsupported condition ${JSON.stringify(key)} (expected ${expected}) -- an unknown condition here is a term of the gate that would silently do nothing, so it is refused rather than dropped: ${path}`);
+    }
+    if (key === "after") {
+      if (seenAfter) {
+        throw configError(`${where}: run.waitFor names a second "after" -- the conditions are a conjunction, so two instants mean the later one and the file would read as though both mattered: ${path}`);
+      }
+      if (afterInstantMs(condition.after) === null) {
+        throw configError(`${where}: after must be an ISO-8601 instant carrying its own zone, like "2026-09-01T09:00:00Z" or "2026-09-01T11:00:00+02:00" (got ${JSON.stringify(condition.after)}) -- without a zone the same file would hold for a different instant on a worker in a different timezone: ${path}`);
+      }
+      seenAfter = true;
+      normalized.push({ after: condition.after });
+      continue;
+    }
+    const profile = condition.profile;
+    if (!isNonEmptyString5(profile)) {
+      throw configError(`${where}: profile must be a non-empty string naming one of the wait profiles this deployment declares (got ${JSON.stringify(profile)}): ${path}`);
+    }
+    if (!ID_CHARSET.test(profile)) {
+      throw configError(`${where}: profile ${JSON.stringify(profile)} may use letters, digits, dot, dash and underscore only -- PI_WAIT_PROFILES is a comma-separated list of name:path pairs, so a name carrying either separator cannot be declared: ${path}`);
+    }
+    if (profiles.has(profile)) {
+      throw configError(`${where}: run.waitFor names the profile ${JSON.stringify(profile)} twice -- the conditions are a conjunction, so the second one can never change the answer while it doubles the subprocesses: ${path}`);
+    }
+    profiles.add(profile);
+    normalized.push({ profile });
+  }
+  return normalized;
+}
 function normalizeLabel(on, run, index, path) {
   const at = `trigger at index ${index}`;
   const predicate = validatePredicate(on, index, path, true);
@@ -8632,7 +8838,7 @@ function normalizeLabel(on, run, index, path) {
   validateOnce(on, run, at, path, { onType: "label" });
   validateDisarmed(on, at, path, { onType: "label" });
   const command = validateCommand(run, at, path, { onType: "label" });
-  if (command === void 0 && !isNonEmptyString4(run.flow)) {
+  if (command === void 0 && !isNonEmptyString5(run.flow)) {
     throw configError(`${at}: label trigger run.flow must be a non-empty string (or use run.command): ${path}`);
   }
   validateFlowName(run, at, path);
@@ -8645,21 +8851,22 @@ function normalizeLabel(on, run, index, path) {
   const replicas = validateReplicas(run, at, path);
   const secrets = validateSecrets(run, at, path);
   const secretsProfile = validateSecretsProfile(run, at, path);
+  const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
   return {
     on: { type: "label", any: predicate.any, all: predicate.all, none: predicate.none },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile } }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor } }
   };
 }
 function normalizeComment(on, run, index, path, state) {
   const at = `trigger at index ${index}`;
-  if (!isNonEmptyString4(on.phrase)) {
+  if (!isNonEmptyString5(on.phrase)) {
     throw configError(`${at}: comment trigger on.phrase must be a non-empty string: ${path}`);
   }
   validateNumber(on, at, path, { onType: "comment" });
   validateOnce(on, run, at, path, { onType: "comment" });
   validateDisarmed(on, at, path, { onType: "comment" });
   const command = validateCommand(run, at, path, { onType: "comment" });
-  if (command === void 0 && !isNonEmptyString4(run.flow)) {
+  if (command === void 0 && !isNonEmptyString5(run.flow)) {
     throw configError(`${at}: comment trigger run.flow (the default flow) must be a non-empty string (or use run.command): ${path}`);
   }
   validateFlowName(run, at, path);
@@ -8676,9 +8883,10 @@ function normalizeComment(on, run, index, path, state) {
   const replicas = validateReplicas(run, at, path);
   const secrets = validateSecrets(run, at, path);
   const secretsProfile = validateSecretsProfile(run, at, path);
+  const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
   return {
     on: { type: "comment", phrase: on.phrase },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile } }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor } }
   };
 }
 function normalizeIssue(on, run, index, path) {
@@ -8704,7 +8912,7 @@ function normalizeIssue(on, run, index, path) {
   const once = validateOnce(on, run, at, path, { capable: true, onType: "issue" });
   validateDisarmed(on, at, path, { capable: true, onType: "issue" });
   const command = validateCommand(run, at, path, { onType: "issue" });
-  if (command === void 0 && !isNonEmptyString4(run.flow)) {
+  if (command === void 0 && !isNonEmptyString5(run.flow)) {
     throw configError(`${at}: issue trigger run.flow must be a non-empty string (or use run.command): ${path}`);
   }
   validateFlowName(run, at, path);
@@ -8717,6 +8925,7 @@ function normalizeIssue(on, run, index, path) {
   const replicas = validateReplicas(run, at, path);
   const secrets = validateSecrets(run, at, path);
   const secretsProfile = validateSecretsProfile(run, at, path);
+  const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
   return {
     on: {
       type: "issue",
@@ -8726,7 +8935,7 @@ function normalizeIssue(on, run, index, path) {
       ...number !== void 0 && { number },
       ...once !== void 0 && { once }
     },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile } }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor } }
   };
 }
 function normalizePullRequest(on, run, index, path) {
@@ -8761,7 +8970,7 @@ function normalizePullRequest(on, run, index, path) {
   const once = validateOnce(on, run, at, path, { capable: isClose, onType: "pull_request" });
   validateDisarmed(on, at, path, { capable: isClose, onType: "pull_request" });
   const command = validateCommand(run, at, path, { onType: "pull_request" });
-  if (command === void 0 && !isNonEmptyString4(run.flow)) {
+  if (command === void 0 && !isNonEmptyString5(run.flow)) {
     throw configError(`${at}: pull_request trigger run.flow must be a non-empty string (or use run.command): ${path}`);
   }
   validateFlowName(run, at, path);
@@ -8774,6 +8983,7 @@ function normalizePullRequest(on, run, index, path) {
   const replicas = validateReplicas(run, at, path);
   const secrets = validateSecrets(run, at, path);
   const secretsProfile = validateSecretsProfile(run, at, path);
+  const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
   return {
     on: {
       type: "pull_request",
@@ -8788,7 +8998,7 @@ function normalizePullRequest(on, run, index, path) {
       ...number !== void 0 && { number },
       ...once !== void 0 && { once }
     },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile } }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor } }
   };
 }
 function validateReviewState(on, actions, run, at, path) {
@@ -8817,6 +9027,7 @@ var init_triggers = __esm({
     init_flow_gate();
     init_forges();
     init_reserved_env();
+    init_wait_for();
     ON_TYPES = /* @__PURE__ */ new Set(["cron", "label", "comment", "pull_request", "issue"]);
     DISARMED_TYPE = "disarmed";
     PR_ACTIONS = {
@@ -9031,8 +9242,8 @@ var init_docker_run = __esm({
 
 // ../worker/src/packages.mjs
 import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { basename, dirname as dirname2, join, resolve } from "node:path";
-function isNonEmptyString5(value) {
+import { basename, dirname as dirname2, join, resolve as resolve2 } from "node:path";
+function isNonEmptyString6(value) {
   return typeof value === "string" && value.trim() !== "";
 }
 function readStageManifest({ globalPiDir, readFile = readFileSync, fileExists = existsSync } = {}) {
@@ -9046,7 +9257,7 @@ function readStageManifest({ globalPiDir, readFile = readFileSync, fileExists =
     for (const entry of parsed.packages) {
       if (entry === null || typeof entry !== "object") return null;
       const { name, version, dir } = entry;
-      if (!isNonEmptyString5(name) || !isNonEmptyString5(version) || !isNonEmptyString5(dir)) return null;
+      if (!isNonEmptyString6(name) || !isNonEmptyString6(version) || !isNonEmptyString6(dir)) return null;
       if (!ENTRY_NAME_RE.test(dir) || dir.length > MAX_DIR_LENGTH) return null;
       packages.push({ name, version, dir, from: entry.from === FROM_HOST ? FROM_HOST : FROM_DECLARED });
     }
@@ -9071,7 +9282,7 @@ function readStagedSkills({ globalPiDir, readFile = readFileSync, fileExists = e
           out.unenumerable.push(pkg.name);
           continue;
         }
-        sources = entries.filter((e) => !e.split(/[\\/]/).includes("..")).map((e) => resolve(root, e));
+        sources = entries.filter((e) => !e.split(/[\\/]/).includes("..")).map((e) => resolve2(root, e));
       } else {
         sources = [join(root, "skills")];
       }
@@ -10368,6 +10579,7 @@ function resolvePaths(env = process.env) {
     // root, and silently wrong (demo triggers) everywhere else.
     triggersPath: env.PI_TRIGGERS_FILE ?? "./triggers.json",
     pauseWindowsPath: env.PI_PAUSE_WINDOWS_FILE ?? "./pause-windows.json",
+    scopedLimitsPath: env.PI_SCOPED_LIMITS_FILE ?? "./scoped-limits.json",
     subscriptionsPath: env.PI_SUBSCRIPTIONS_FILE ?? "./subscriptions.json",
     // The operator's global pi overlay dir (REQ-GLOBAL-PI-OVERLAY), where the staged third-party pi
     // packages live under `packages/`. `|| null` so unset AND empty both read as "no overlay" -- the
@@ -10586,6 +10798,172 @@ function writePauseWindows({ pauseWindowsPath, mutate, fs = nodeFs3 }) {
   fs.renameSync(tmp, pauseWindowsPath);
   return { ok: true };
 }
+function readScopedLimits({ scopedLimitsPath, fs = nodeFs3 }) {
+  let text;
+  try {
+    text = fs.readFileSync(scopedLimitsPath, "utf8");
+  } catch {
+    return { missing: true };
+  }
+  try {
+    return { limits: parseScopedLimits(text, scopedLimitsPath) };
+  } catch (e) {
+    return { invalid: e?.message ?? String(e) };
+  }
+}
+function writeScopedLimits({ scopedLimitsPath, mutate, fs = nodeFs3 }) {
+  let current = [];
+  let existing = null;
+  try {
+    existing = fs.readFileSync(scopedLimitsPath, "utf8");
+  } catch {
+  }
+  if (existing !== null) {
+    try {
+      current = parseScopedLimits(existing, scopedLimitsPath);
+    } catch (e) {
+      return { invalid: e?.message ?? String(e) };
+    }
+  }
+  const next = mutate(current.map((l) => ({ ...l })));
+  const rows = next.map((l) => Object.fromEntries(Object.entries(l).filter(([, v]) => v !== null && v !== void 0)));
+  const text = `${JSON.stringify({ version: SCOPED_LIMITS_VERSION, limits: rows }, null, 2)}
+`;
+  try {
+    parseScopedLimits(text, scopedLimitsPath);
+  } catch (e) {
+    return { invalid: e?.message ?? String(e) };
+  }
+  const tmp = `${scopedLimitsPath}.tmp`;
+  fs.writeFileSync(tmp, text, { mode: 420 });
+  fs.renameSync(tmp, scopedLimitsPath);
+  return { ok: true };
+}
+async function readScopedBudget({ url, limits, redisFn = makeRedisClient, timeoutMs = 2500 } = {}) {
+  if (!Array.isArray(limits) || limits.length === 0) return { rows: [] };
+  let redis;
+  try {
+    parseConnection(url, { failFast: true });
+    redis = redisFn(url);
+    const now = /* @__PURE__ */ new Date();
+    const settled = Promise.all(
+      limits.map(async (l) => {
+        const prefix = scopeKeyPrefix(l.scope);
+        const cell2 = async (key) => Number(await redis.get(key) ?? 0);
+        const row = {};
+        if (l.day !== null && l.day !== void 0) row.day = await cell2(dayKey(now, prefix));
+        if (l.week !== null && l.week !== void 0) row.week = await cell2(weekKey(now, prefix));
+        if (l.month !== null && l.month !== void 0) row.month = await cell2(monthKey(now, prefix));
+        return row;
+      })
+    ).then(
+      (rows) => ({ rows }),
+      (err) => ({ unreachable: err?.message ?? String(err) })
+    );
+    return await withTimeout(settled, timeoutMs, { unreachable: "timed out reaching the queue" });
+  } catch (err) {
+    return { unreachable: err?.message ?? String(err) };
+  } finally {
+    if (redis) {
+      try {
+        redis.disconnect();
+      } catch {
+      }
+    }
+  }
+}
+async function readHeldJobs({ url, limit = 20, redisFn = makeRedisClient, timeoutMs = 2500, now = () => Date.now() } = {}) {
+  let redis;
+  try {
+    parseConnection(url, { failFast: true });
+    redis = redisFn(url);
+    const settled = (async () => {
+      const ids = await redis.smembers(HELD_SET);
+      const hydrated = await Promise.all(
+        ids.slice(0, HELD_HYDRATE_MAX).map(async (jobId) => {
+          try {
+            const h = await redis.hgetall(jobKey(jobId));
+            if (!h || !h.since) {
+              await redis.srem(HELD_SET, jobId).catch(() => {
+              });
+              return null;
+            }
+            const since = Number(h.since);
+            return {
+              jobId,
+              target: h.target || null,
+              label: h.label || null,
+              waitedMs: Number.isFinite(since) && since > 0 ? Math.max(0, now() - since) : null,
+              checks: Number(h.checks) || 0
+            };
+          } catch {
+            return null;
+          }
+        })
+      );
+      const rows = hydrated.filter(Boolean);
+      rows.sort((a, b) => (b.waitedMs ?? -1) - (a.waitedMs ?? -1));
+      return {
+        rows: rows.slice(0, limit),
+        more: Math.max(0, rows.length - limit),
+        // True when the index itself was longer than this reader will hydrate: `more` is then a floor, and
+        // a caller that renders a total must say so rather than state a number it cannot know.
+        truncated: ids.length > HELD_HYDRATE_MAX
+      };
+    })();
+    return await withTimeout(settled, timeoutMs, { unreachable: "timed out reaching the queue" });
+  } catch (err) {
+    return { unreachable: err?.message ?? String(err) };
+  } finally {
+    if (redis) {
+      try {
+        redis.disconnect();
+      } catch {
+      }
+    }
+  }
+}
+async function cancelHeldJob({ url, jobId, redisFn = makeRedisClient, queueFn = makeQueue, timeoutMs = 2500 } = {}) {
+  if (typeof jobId !== "string" || jobId === "") return { invalid: "a job id is required" };
+  let redis;
+  let queue;
+  try {
+    parseConnection(url, { failFast: true });
+    redis = redisFn(url);
+    queue = queueFn(parseConnection(url, { failFast: true }));
+    const settled = (async () => {
+      const hash = await redis.hgetall(jobKey(jobId));
+      if (!hash || !hash.since) return { invalid: `job ${jobId} is not waiting on a condition` };
+      const job = await queue.getJob(jobId);
+      if (!job) return { invalid: `job ${jobId} is no longer in the queue` };
+      const state = await job.getState().catch(() => null);
+      if (state !== "delayed" && state !== "waiting" && state !== "prioritized") {
+        return { invalid: `job ${jobId} is ${state ?? "in an unknown state"}, not waiting -- it has already left the hold` };
+      }
+      await redis.del(jobKey(jobId));
+      await redis.srem(HELD_SET, jobId).catch(() => {
+      });
+      if (hash.dedupId) {
+        const holder = await redis.get(`wait:key:${hash.dedupId}`);
+        if (holder === jobId) await redis.del(`wait:key:${hash.dedupId}`);
+      }
+      await job.remove();
+      return { ok: true, jobId };
+    })();
+    return await withTimeout(settled, timeoutMs, { invalid: "timed out reaching the queue" });
+  } catch (err) {
+    return { invalid: err?.message ?? String(err) };
+  } finally {
+    try {
+      redis?.disconnect?.();
+    } catch {
+    }
+    try {
+      await queue?.close?.();
+    } catch {
+    }
+  }
+}
 function readSubscriptions({ subscriptionsPath, fs = nodeFs3 }) {
   if (subscriptionsPath === null || subscriptionsPath === void 0) return { missing: true };
   let text;
@@ -10662,8 +11040,8 @@ async function readBudget({ url, redisFn = makeRedisClient, timeoutMs = 2500 } =
 }
 function withTimeout(promise, ms, fallback) {
   let timer;
-  const timeout = new Promise((resolve2) => {
-    timer = setTimeout(() => resolve2(fallback), ms);
+  const timeout = new Promise((resolve3) => {
+    timer = setTimeout(() => resolve3(fallback), ms);
     if (typeof timer?.unref === "function") timer.unref();
   });
   return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
@@ -11217,7 +11595,7 @@ function clampLines(lines) {
   const n = Number.isFinite(lines) ? Math.floor(lines) : 200;
   return Math.min(2e3, Math.max(1, n));
 }
-var DISPATCH_RUN_TTL_SECONDS, SCAN_WINDOW_MAX_DAYS, GRAPH_LIMITS, GRAPH_LS_TREE_MAX_BYTES;
+var DISPATCH_RUN_TTL_SECONDS, HELD_HYDRATE_MAX, SCAN_WINDOW_MAX_DAYS, GRAPH_LIMITS, GRAPH_LS_TREE_MAX_BYTES;
 var init_read_model = __esm({
   "src/read-model.mjs"() {
     init_config2();
@@ -11225,6 +11603,8 @@ var init_read_model = __esm({
     init_run_history();
     init_budget();
     init_pause_windows();
+    init_scoped_limits();
+    init_wait_state();
     init_subscriptions();
     init_connection();
     init_queue();
@@ -11237,6 +11617,7 @@ var init_read_model = __esm({
     init_costs();
     init_triggers_file();
     DISPATCH_RUN_TTL_SECONDS = 2 * 60 * 60;
+    HELD_HYDRATE_MAX = 200;
     SCAN_WINDOW_MAX_DAYS = 92;
     GRAPH_LIMITS = Object.freeze({
       maxFoldersScanned: 16,
@@ -12751,7 +13132,28 @@ function normBudget(v) {
       cap: Number.isInteger(t.cap) && t.cap > 0 ? t.cap : null,
       state: BUDGET_STATES.includes(t.state) ? t.state : "ok",
       maxTokens: Number.isInteger(t.maxTokens) && t.maxTokens > 0 ? t.maxTokens : null
-    }
+    },
+    // The scoped rows (issue #242): a pre-1.5 payload simply lacks the key and renders nothing.
+    scoped: Array.isArray(v.scoped) ? v.scoped.map(normScopedRow).filter((r) => r !== null) : [],
+    scopedInvalid: typeof v.scopedInvalid === "string" && v.scopedInvalid !== "" ? clip3(v.scopedInvalid, 160) : null
+  };
+}
+function normScopedRow(v) {
+  if (v === null || typeof v !== "object" || typeof v.scope !== "string" || v.scope === "") return null;
+  const win = (w) => {
+    if (w === null || w === void 0 || typeof w !== "object") return null;
+    return {
+      used: Number.isInteger(w.used) && w.used >= 0 ? w.used : null,
+      cap: Number.isInteger(w.cap) && w.cap > 0 ? w.cap : null,
+      state: BUDGET_STATES.includes(w.state) ? w.state : "ok"
+    };
+  };
+  return {
+    scope: clip3(v.scope, 60),
+    day: win(v.day),
+    week: win(v.week),
+    month: win(v.month),
+    concurrent: Number.isInteger(v.concurrent) && v.concurrent > 0 ? v.concurrent : null
   };
 }
 function normSpendMap(v) {
@@ -13123,6 +13525,24 @@ function budgetSectionHtml(nb) {
   if (nb.softHoldPct !== null) {
     rows.push(`<div class="dim small">soft-hold band: ${fmt(nb.softHoldPct)}% of each cap (the amber tick)</div>`);
   }
+  if (nb.scopedInvalid !== null) {
+    rows.push(`<div class="dim small">scoped limits: file invalid (${escapeHtml(nb.scopedInvalid)})</div>`);
+  } else if (nb.scoped.length > 0) {
+    rows.push('<div class="dim small">scoped limits (scoped-limits.json)</div>');
+    for (const s of nb.scoped) {
+      const bits = [];
+      let worst = "ok";
+      for (const key of ["day", "week", "month"]) {
+        const w = s[key];
+        if (w === null || w.cap === null) continue;
+        bits.push(`${key} used ${w.used !== null ? fmt(w.used) : "?"} / cap ${fmt(w.cap)}`);
+        if (w.state !== "ok") worst = w.state;
+      }
+      if (s.concurrent !== null) bits.push(`concurrent \u2264${fmt(s.concurrent)} (config; in-flight not shown)`);
+      rows.push(`<div class="row"><span class="wl">${escapeHtml(s.scope)}</span><span>${escapeHtml(bits.join(" \xB7 "))}</span>${worst !== "ok" ? stateWord(worst) : ""}</div>`);
+    }
+    rows.push('<div class="lever">scoped: dispatch_limit_add/edit/delete \xB7 or press m in the /dispatch panel</div>');
+  }
   rows.push('<div class="lever">adjust: /dispatch set dailyCap|weeklyCap|monthlyCap|dailyTokenCap|softHoldPct &lt;n&gt; \xB7 or press s in the /dispatch panel</div>');
   return `<div id="budget">${rows.join("")}</div>`;
 }
@@ -13528,7 +13948,7 @@ var init_open_browser = __esm({
 // src/deployment-pointer.mjs
 import * as nodeFs4 from "node:fs";
 import { homedir } from "node:os";
-import { join as join3, isAbsolute } from "node:path";
+import { join as join3, isAbsolute as isAbsolute2 } from "node:path";
 function pointerPath(env = process.env) {
   return env.PI_DISPATCH_DEPLOYMENT_FILE || join3(env.PI_CODING_AGENT_DIR || join3(homedir(), ".pi", "agent"), POINTER_BASENAME);
 }
@@ -13542,7 +13962,7 @@ function normalizePointer(raw) {
   if (raw.version > POINTER_VERSION) {
     return { ignored: `version ${raw.version} is newer than the supported version ${POINTER_VERSION}` };
   }
-  if (typeof raw.deploymentDir !== "string" || !isAbsolute(raw.deploymentDir)) {
+  if (typeof raw.deploymentDir !== "string" || !isAbsolute2(raw.deploymentDir)) {
     return { ignored: "deploymentDir must be an absolute path" };
   }
   const rawEnv = raw.env === void 0 ? {} : raw.env;
@@ -13553,7 +13973,7 @@ function normalizePointer(raw) {
   for (const key of POINTER_ENV_ALLOWLIST) {
     const value = rawEnv[key];
     if (typeof value !== "string" || value === "") continue;
-    if (key !== "VALKEY_URL" && !isAbsolute(value)) continue;
+    if (key !== "VALKEY_URL" && !isAbsolute2(value)) continue;
     env[key] = value;
   }
   return { pointer: { version: raw.version, deploymentDir: raw.deploymentDir, env } };
@@ -13624,6 +14044,7 @@ var init_deployment_pointer = __esm({
       "PI_SETTINGS_FILE",
       "PI_TRIGGERS_FILE",
       "PI_PAUSE_WINDOWS_FILE",
+      "PI_SCOPED_LIMITS_FILE",
       "PI_SUBSCRIPTIONS_FILE"
     ]);
     POINTER_BASENAME = "pi-dispatch-deployment.json";
@@ -39168,7 +39589,7 @@ var init_pricing = __esm({
 
 // ../worker/src/sandbox-store.mjs
 import { lstatSync, mkdirSync, readFileSync as readFileSync3, readdirSync as readdirSync2, renameSync, rmSync, writeFileSync } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join5, relative } from "node:path";
+import { isAbsolute as isAbsolute3, join as join5, relative } from "node:path";
 function readManifest({ sandboxDir, jobId, fs = defaultFs }) {
   if (!sandboxDir || jobId === void 0 || jobId === null) return null;
   const dir = join5(sandboxDir, sanitizeJobId(jobId));
@@ -39241,10 +39662,10 @@ function resolveSandbox({ jobId, sandboxDir, retentionHours, publish = [], fs, f
   return { manifest, name: sandboxContainerName(jobId), publish };
 }
 function launchSandbox({ args, spawnFn = spawn }) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const child = spawnFn("docker", args, { stdio: "inherit" });
-    child.on("error", (err) => resolve2({ code: null, error: err }));
-    child.on("close", (code) => resolve2({ code }));
+    child.on("error", (err) => resolve3({ code: null, error: err }));
+    child.on("close", (code) => resolve3({ code }));
   });
 }
 var exec3, SANDBOX_NAME_PREFIX;
@@ -39299,6 +39720,43 @@ function renderBudget({ budget, settings: settings2 } = {}) {
   if (pct !== null) lines.push(`  soft-hold band: ${pct}%`);
   return lines.join("\n");
 }
+function renderHeldJobs({ held } = {}) {
+  if (!held) return null;
+  if (held.unreachable) return `unreadable (${held.unreachable})`;
+  const rows = Array.isArray(held.rows) ? held.rows : [];
+  if (rows.length === 0) return null;
+  const more = Number(held.more) || 0;
+  const lines = rows.map((r) => `${r.target ?? r.jobId ?? "-"}  ${r.label ?? "-"}  waited ${plainDuration(r.waitedMs)}`);
+  if (more > 0) lines.push(`... and ${more} more`);
+  return lines.join("\n");
+}
+function plainDuration(ms) {
+  if (!Number.isFinite(ms) || ms < 0) return "?";
+  const s = Math.floor(ms / 1e3);
+  if (s < 60) return `${s}s`;
+  const m = Math.floor(s / 60);
+  if (m < 60) return `${m}m`;
+  const h = Math.floor(m / 60);
+  return h < 24 ? `${h}h${m % 60}m` : `${Math.floor(h / 24)}d${h % 24}h`;
+}
+function renderScopedLimits({ limits, scopedBudget } = {}) {
+  if (limits?.invalid) return `Scoped limits: file invalid (${limits.invalid})`;
+  const list = Array.isArray(limits?.limits) ? limits.limits : [];
+  if (list.length === 0) return null;
+  const lines = ["Scoped limits:"];
+  list.forEach((l, i) => {
+    const used = scopedBudget?.rows?.[i] ?? null;
+    const bits = [];
+    for (const key of ["day", "week", "month"]) {
+      if (!Number.isInteger(l[key])) continue;
+      const u = used && Number.isFinite(used[key]) ? used[key] : "-";
+      bits.push(`${key} ${u}/${l[key]}`);
+    }
+    if (Number.isInteger(l.concurrent)) bits.push(`<=${l.concurrent} at once`);
+    lines.push(`  ${l.scope}: ${bits.join(" \xB7 ")}`);
+  });
+  return lines.join("\n");
+}
 function capLabel(cap, reserved, pct) {
   if (!Number.isInteger(cap)) return "unknown (worker env/default)";
   const state = windowState(reserved, cap, pct);
@@ -39645,6 +40103,34 @@ function centerBlock(lines, overlayWidth, blockWidth) {
   const prefix = " ".repeat(pad2);
   return lines.map((l) => prefix + l);
 }
+async function heldJobs(redis) {
+  const ids = await redis.smembers("wait:held");
+  const at = Date.now();
+  const hydrated = await Promise.all(
+    ids.slice(0, HELD_HYDRATE_MAX2).map(async (jobId) => {
+      try {
+        const h = await redis.hgetall(`wait:job:${jobId}`);
+        if (!h || !h.since) {
+          await redis.srem("wait:held", jobId).catch(() => {
+          });
+          return null;
+        }
+        const since = Number(h.since);
+        return {
+          jobId,
+          target: h.target || null,
+          label: h.label || null,
+          waitedMs: Number.isFinite(since) && since > 0 ? Math.max(0, at - since) : null
+        };
+      } catch {
+        return null;
+      }
+    })
+  );
+  const rows = hydrated.filter(Boolean);
+  rows.sort((a, b) => (b.waitedMs ?? -1) - (a.waitedMs ?? -1));
+  return { rows: rows.slice(0, HELD_LIMIT), more: Math.max(0, rows.length - HELD_LIMIT), truncated: ids.length > HELD_HYDRATE_MAX2 };
+}
 function createDashboardDeps(paths) {
   const queue = makeQueue(parseConnection(paths.valkeyUrl, { failFast: true }));
   const redis = makeRedisClient(paths.valkeyUrl);
@@ -39666,7 +40152,27 @@ function createDashboardDeps(paths) {
         redis.hgetall(STALL_KEY).catch(() => ({}))
       ]);
       const workers = Array.isArray(workerList) && workerList.length > 0 ? workerList.length : "unknown";
+      const scopedLimits = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+      const limitRows = Array.isArray(scopedLimits?.limits) ? scopedLimits.limits : [];
+      const scopedNow = /* @__PURE__ */ new Date();
+      const scopedBudget = {
+        rows: await Promise.all(
+          limitRows.map(async (l) => {
+            const prefix = scopeKeyPrefix(l.scope);
+            const cell2 = (key) => redis.get(key).then((v) => Number(v ?? 0), () => null);
+            const row = {};
+            if (Number.isInteger(l.day)) row.day = await cell2(dayKey(scopedNow, prefix));
+            if (Number.isInteger(l.week)) row.week = await cell2(weekKey(scopedNow, prefix));
+            if (Number.isInteger(l.month)) row.month = await cell2(monthKey(scopedNow, prefix));
+            return row;
+          })
+        )
+      };
+      const held = await heldJobs(redis).catch((err) => ({ unreachable: err?.message ?? String(err) }));
       return {
+        held,
+        scopedLimits,
+        scopedBudget,
         queue: { pausedState, counts, workers },
         budget: { day: Number(dayRaw ?? 0), week: Number(weekRaw ?? 0), month: Number(monthRaw ?? 0), tokensToday: Number(tokenRaw ?? 0) },
         schedulers: mapSchedulers(schedulerList, Date.now()),
@@ -40027,6 +40533,10 @@ function makeDashboard({
         void dispose().finally(() => done({ action: "managePauses" }));
         return;
       }
+      if (data === "m" || data === "M") {
+        void dispose().finally(() => done({ action: "manageLimits" }));
+        return;
+      }
       if (matchesKey(data, "up")) {
         selected = Math.max(0, selected - 1);
         tui?.requestRender?.();
@@ -40130,6 +40640,10 @@ function renderPanel(snapshot, width, state, styler) {
     { title: "RUNS", lines: renderRunList(buildRows(snapshot, runSort), selected, 24) },
     { title: "SETTINGS", lines: toLines(renderSettingsView(snapshot.settings)) }
   ];
+  const scopedText = renderScopedLimits({ limits: snapshot.scopedLimits, scopedBudget: snapshot.scopedBudget });
+  if (scopedText) sections.splice(2, 0, { title: "SCOPED LIMITS", lines: toLines(scopedText) });
+  const heldText = renderHeldJobs({ held: snapshot.held });
+  if (heldText) sections.push({ title: "HELD", lines: toLines(heldText) });
   const plain = [title];
   for (const section of sections) plain.push(section.title, ...section.lines);
   plain.push(KEY_HINTS);
@@ -40157,6 +40671,7 @@ function collapseKeys(sections, availableRows, focus, baseRows) {
 function buildListLines(snapshot, selected, inner, styler, runSort = "time", availableRows = null) {
   const trg = triggerLines(snapshot, selected, inner, styler);
   const pw = pauseLines(snapshot.pauseWindows, inner, styler);
+  const sl = limitLines(snapshot.scopedLimits, snapshot.scopedBudget, inner, styler);
   const runRows = buildRows(snapshot, runSort).slice(trg.count);
   const runCount = Array.isArray(snapshot.runs) ? snapshot.runs.length : 0;
   const sections = [
@@ -40164,6 +40679,11 @@ function buildListLines(snapshot, selected, inner, styler, runSort = "time", ava
     { key: "spend", head: ["spend & limits", "jobs & tokens/day \xB7 s set"], body: spendLines(snapshot.budget, snapshot.settings, inner, styler), priority: 4, viewKey: "s" },
     { key: "triggers", head: ["triggers", `${trg.count} standing \xB7 a add \xB7 \u21B5 open`], body: trg.lines, priority: 3, viewKey: "tab" },
     { key: "pauses", head: ["pause windows", `${pw.count} \xB7 w manage`], body: pw.lines, priority: 1, viewKey: "w" },
+    // Priority 0: the section an operator acts on least often from the panel folds FIRST under the
+    // collapse budget. The key hint lives in this divider, not the footer -- the footer's width
+    // arithmetic has no headroom for another hint (its own comment), the s/o/Tab precedent.
+    { key: "limits", head: ["scoped limits", `${sl.count} \xB7 m manage`], body: sl.lines, priority: 0, viewKey: "m" },
+    ...heldSection(snapshot.held, inner, styler),
     { key: "runs", head: ["runs", `last ${runCount} \xB7 o ${runSort}`], body: runLines(runRows, selected - trg.count, inner, styler) },
     { key: "settings", head: ["settings", "s edit"], body: settingsLines(snapshot.settings, inner, styler), priority: 2, viewKey: "s" }
   ];
@@ -40179,7 +40699,7 @@ function buildListLines(snapshot, selected, inner, styler, runSort = "time", ava
   sections.forEach((s, i) => {
     if (i > 0) lines.push(RULE);
     if (collapsed.has(s.key)) {
-      lines.push(styler.divider(s.head[0], `(${s.body.length} hidden \u2014 ${s.viewKey} to view)`, inner));
+      lines.push(styler.divider(s.head[0], s.viewKey ? `(${s.body.length} hidden \u2014 ${s.viewKey} to view)` : `(${s.body.length} hidden)`, inner));
       return;
     }
     if (s.head) lines.push(styler.divider(s.head[0], s.head[1], inner));
@@ -40187,6 +40707,37 @@ function buildListLines(snapshot, selected, inner, styler, runSort = "time", ava
   });
   return lines;
 }
+function heldSection(held, inner, styler) {
+  if (!held) return [];
+  if (held.unreachable) {
+    return [{ key: "held", priority: 5, head: ["held", "waiting on conditions"], body: [styler.cell(`unreadable (${held.unreachable})`, inner, { color: "error" })] }];
+  }
+  const rows = Array.isArray(held.rows) ? held.rows : [];
+  if (rows.length === 0) return [];
+  const shown = rows.slice(0, HELD_ON_DASHBOARD);
+  const hidden = rows.length - shown.length + (Number(held.more) || 0);
+  const body = shown.map((r) => heldRow(r, inner, styler));
+  if (hidden > 0) body.push(styler.cell(styler.fg("dim", `\u2193 ${hidden} more`), inner));
+  const total = rows.length + (Number(held.more) || 0);
+  return [{ key: "held", priority: 5, head: ["held", `${total}${held.truncated ? "+" : ""} waiting on conditions`], body }];
+}
+function heldRow(r, inner, styler) {
+  const bits = [
+    `${styler.fg("dim", "\u25CB")} ${styler.fg("accent", r.target ?? r.jobId ?? "-")}`,
+    styler.fg("text", r.label ?? "-"),
+    styler.fg("dim", `waited ${fmtDuration(r.waitedMs)}`)
+  ];
+  return fitLine(bits.join(styler.fg("dim", " \xB7 ")), inner, styler);
+}
+function fmtDuration(ms) {
+  if (!Number.isFinite(ms) || ms < 0) return "?";
+  const s = Math.floor(ms / 1e3);
+  if (s < 60) return `${s}s`;
+  const m = Math.floor(s / 60);
+  if (m < 60) return `${m}m`;
+  const h = Math.floor(m / 60);
+  return h < 24 ? `${h}h${m % 60}m` : `${Math.floor(h / 24)}d${h % 24}h`;
+}
 function statusHeader(queue, inner, styler) {
   if (!queue || queue.unreachable) {
     return styler.cell(`queue unreachable (${queue?.unreachable ?? "?"})`, inner, { color: "error" });
@@ -40198,7 +40749,8 @@ function statusHeader(queue, inner, styler) {
   const dot = styler.fg(stateColor, "\u25CF");
   const word = styler.bold(styler.fg(stateColor, running ? "RUNNING" : "PAUSED"));
   const sep2 = styler.fg("dim", " \xB7 ");
-  const vitals = `${c.waiting ?? 0} waiting` + sep2 + `${c.active ?? 0} active` + sep2 + (failed > 0 ? styler.fg("error", `${failed} failed`) : `${failed} failed`) + sep2 + `${queue.workers ?? "?"} workers`;
+  const delayed = Number(c.delayed ?? 0);
+  const vitals = `${c.waiting ?? 0} waiting` + sep2 + `${c.active ?? 0} active` + sep2 + (delayed > 0 ? `${delayed} delayed` + sep2 : "") + (failed > 0 ? styler.fg("error", `${failed} failed`) : `${failed} failed`) + sep2 + `${queue.workers ?? "?"} workers`;
   const clock = (/* @__PURE__ */ new Date()).toISOString().slice(11, 19);
   const left = `${dot} ${word}  ${vitals}`;
   const gap = inner - styler.visibleLen(left) - clock.length;
@@ -40353,6 +40905,39 @@ function pauseRow(w, now, inner, styler) {
   if (until) bits.push(styler.fg("warning", `resumes in ${humanizeMs(until - now) || "<1m"}`));
   return fitLine(bits.join(styler.fg("dim", "  ")), inner, styler);
 }
+function limitLines(scopedLimits, scopedBudget, inner, styler) {
+  const lines = [];
+  if (scopedLimits && scopedLimits.missing) {
+    lines.push(styler.cell("(no scoped limits \xB7 m to manage)", inner, { color: "dim" }));
+    return { count: 0, lines };
+  }
+  if (scopedLimits && scopedLimits.invalid) {
+    lines.push(styler.cell(`(scoped-limits file invalid: ${scopedLimits.invalid})`, inner, { color: "error" }));
+    return { count: 0, lines };
+  }
+  const list = (scopedLimits && scopedLimits.limits) ?? [];
+  if (list.length === 0) {
+    lines.push(styler.cell("(no scoped limits \xB7 m to manage)", inner, { color: "dim" }));
+    return { count: 0, lines };
+  }
+  list.forEach((l, i) => lines.push(limitRow(l, scopedBudget?.rows?.[i] ?? null, inner, styler)));
+  return { count: list.length, lines };
+}
+function limitRow(l, used, inner, styler) {
+  let atCap = false;
+  const windows = [];
+  for (const key of ["day", "week", "month"]) {
+    if (!Number.isInteger(l[key])) continue;
+    const u = used && Number.isFinite(used[key]) ? used[key] : null;
+    const over = u !== null && u >= l[key];
+    if (over) atCap = true;
+    windows.push(styler.fg(over ? "warning" : "text", `${key} ${u ?? "-"}/${l[key]}`));
+  }
+  const dot = atCap ? styler.fg("warning", "\u25CF") : styler.fg("dim", "\u25CB");
+  const bits = [`${dot} ${styler.fg("accent", l.scope ?? "-")}`, ...windows];
+  if (Number.isInteger(l.concurrent)) bits.push(styler.fg("muted", `\u2264${l.concurrent} at once`));
+  return fitLine(bits.join(styler.fg("dim", "  ")), inner, styler);
+}
 function runLines(rows, selected, inner, styler) {
   if (!Array.isArray(rows) || rows.length === 0) return [styler.cell("(no runs)", inner, { color: "dim" })];
   const { top, count } = runsWindow(rows.length, selected);
@@ -40761,7 +41346,7 @@ function runDetailHints(inner, styler, canOpen = false, canCopy = false, copiedN
   if (copiedNote) return fitLine(styler.fg("success", copiedNote) + styler.fg("dim", "  \xB7  ") + line, inner, styler);
   return fitLine(line, inner, styler);
 }
-var KEY_HINTS, RUNS_ON_DASHBOARD, RUNS_VIEWPORT, RUN_SORTS, REFRESH_MS, TAIL_LINES, TAIL_VIEWPORT, MIN_WIDTH2, DRILL_WIDTH, KIND_COLOR, KIND_WIDTH, FRAME_CHROME_ROWS;
+var KEY_HINTS, RUNS_ON_DASHBOARD, RUNS_VIEWPORT, RUN_SORTS, REFRESH_MS, TAIL_LINES, TAIL_VIEWPORT, MIN_WIDTH2, DRILL_WIDTH, HELD_LIMIT, HELD_HYDRATE_MAX2, KIND_COLOR, KIND_WIDTH, FRAME_CHROME_ROWS, HELD_ON_DASHBOARD;
 var init_dashboard = __esm({
   "src/dashboard.ts"() {
     init_budget();
@@ -40770,6 +41355,7 @@ var init_dashboard = __esm({
     init_scheduler_stall_guard();
     init_pause_windows();
     init_read_model();
+    init_scoped_limits();
     init_render();
     init_keys2();
     init_panel();
@@ -40783,9 +41369,12 @@ var init_dashboard = __esm({
     TAIL_VIEWPORT = 20;
     MIN_WIDTH2 = 8;
     DRILL_WIDTH = 70;
+    HELD_LIMIT = 20;
+    HELD_HYDRATE_MAX2 = 200;
     KIND_COLOR = { cron: "accent", label: "syntaxType", comment: "syntaxKeyword", pull_request: "syntaxFunction", issue: "syntaxString" };
     KIND_WIDTH = 13;
     FRAME_CHROME_ROWS = 4;
+    HELD_ON_DASHBOARD = 3;
   }
 });
 
@@ -40858,16 +41447,16 @@ async function runAttached(ctx, { title, argv0, args, cwd, env, shell, spawnFn =
 ${title}
 
 `);
-        outcome = await new Promise((resolve2) => {
+        outcome = await new Promise((resolve3) => {
           let child;
           try {
             child = spawnFn(argv0, args, { stdio: "inherit", cwd, env, ...shell ? { shell: true } : {} });
           } catch (err) {
-            resolve2({ code: null, error: err });
+            resolve3({ code: null, error: err });
             return;
           }
-          child.on("error", (err) => resolve2({ code: null, error: err }));
-          child.on("close", (code) => resolve2({ code }));
+          child.on("error", (err) => resolve3({ code: null, error: err }));
+          child.on("close", (code) => resolve3({ code }));
         });
       } catch (err) {
         outcome = { code: null, error: err };
@@ -41086,6 +41675,7 @@ up shows each docker action and asks y/N before it \u2014 nothing is auto-accept
     env: {
       PI_TRIGGERS_FILE: join6(dir, "triggers.json"),
       PI_PAUSE_WINDOWS_FILE: join6(dir, "pause-windows.json"),
+      PI_SCOPED_LIMITS_FILE: join6(dir, "scoped-limits.json"),
       PI_SUBSCRIPTIONS_FILE: join6(dir, "subscriptions.json")
     }
   };
@@ -41318,8 +41908,8 @@ var init_setup_wizard = __esm({
     init_deployment_pointer();
     init_read_model();
     init_index();
-    RUNTIME_VERSION = "1.4.0";
-    RECEIVER_VERSION = "1.3.0";
+    RUNTIME_VERSION = "1.6.0";
+    RECEIVER_VERSION = "1.4.0";
     RUNTIME_PKG = "@edgehero/pi-dispatch";
     RECEIVER_PKG = "@edgehero/pi-dispatch-receiver";
     NUDGE_MARKER_BASENAME = "pi-dispatch-setup.nudged";
@@ -41513,15 +42103,15 @@ function registerTools(pi) {
   pi.registerTool({
     name: "dispatch_costs",
     label: "pi-dispatch costs",
-    description: "Read-only. Folds the PII-free run history against the operator's declared subscriptions and pi-ai's rate tables into the costs read-model: window totals, daily buckets, per-flow and per-model rollups, per-plan verdicts, and provenance. window = 7d | 30d | mtd (default mtd); flow filters to one flow's runs.",
-    parameters: typebox_exports.Object({ window: typebox_exports.Optional(typebox_exports.String()), flow: typebox_exports.Optional(typebox_exports.String()) }),
+    description: `Read-only. Folds the PII-free run history against the operator's declared subscriptions and pi-ai's rate tables into the costs read-model: window totals, daily buckets, per-flow and per-model rollups, per-plan verdicts, and provenance. window = 7d | 30d | mtd (default mtd); flow filters to one flow's runs; repo filters to one repo's runs by the by-repo rollup's key (e.g. "acme/web" or "local:site").`,
+    parameters: typebox_exports.Object({ window: typebox_exports.Optional(typebox_exports.String()), flow: typebox_exports.Optional(typebox_exports.String()), repo: typebox_exports.Optional(typebox_exports.String()) }),
     async execute(_toolCallId, params) {
       const window = params.window ?? "mtd";
       if (!COSTS_WINDOWS.includes(window)) {
         throw new Error(`unknown window '${window}' (7d|30d|mtd)`);
       }
       const paths = resolvePaths(process.env);
-      const res = assembleCosts(paths, window, params.flow);
+      const res = assembleCosts(paths, window, params.flow, params.repo);
       if (res.unreachable) throw new Error(`could not read the run history: ${res.unreachable}`);
       return toolText(JSON.stringify({ window, fold: res.fold }));
     }
@@ -41803,6 +42393,148 @@ ${JSON.stringify(before)}
       return toolText(JSON.stringify(result));
     }
   });
+  pi.registerTool({
+    name: "dispatch_limits",
+    label: "pi-dispatch scoped limits",
+    description: "Read-only. Lists the scoped limits (per repo/folder budget caps and concurrency, scoped-limits.json) with their array index and, when the queue is reachable, each scope's used day/week/month run counts. Use the index for dispatch_limit_edit / dispatch_limit_delete. The always-on one-job-per-folder mutex for local jobs is separate: it has no entry here and no switch anywhere.",
+    parameters: typebox_exports.Object({}),
+    async execute() {
+      const paths = resolvePaths(process.env);
+      const p = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+      if (!Array.isArray(p?.limits)) return toolText(JSON.stringify(p));
+      const counters = await readScopedBudget({ url: paths.valkeyUrl, limits: p.limits });
+      const rows = p.limits.map((l, index) => ({ index, ...l, used: counters.rows?.[index] ?? null }));
+      return toolText(JSON.stringify(rows));
+    }
+  });
+  pi.registerTool({
+    name: "dispatch_waits",
+    label: "pi-dispatch held jobs",
+    description: "Read-only. Lists the jobs the worker is currently HOLDING on a trigger's run.waitFor condition: the job id, an id-only target, the operator's own words for what it is waiting on, and how long it has waited. A held job has reserved no budget slot and started no container. This is a different set from the queue's `delayed` count, which also mixes cron next-occurrences, retry backoff and quiet hours; only waits appear here. Use the job id for dispatch_wait_cancel.",
+    parameters: typebox_exports.Object({}),
+    async execute() {
+      const paths = resolvePaths(process.env);
+      const held = await readHeldJobs({ url: paths.valkeyUrl });
+      return toolText(JSON.stringify(held));
+    }
+  });
+  pi.registerTool({
+    name: "dispatch_wait_cancel",
+    label: "pi-dispatch cancel a held job",
+    description: "Removes a job that is waiting on a run.waitFor condition, so it never runs. The operator MUST approve a confirm dialog naming the job and what it was waiting on; refused with no interactive operator. Use dispatch_waits for the job id. This is the ONLY way to stop a held job short of editing redis: a held job has spent nothing, so no budget cap will ever stop it, and deleting the trigger does not reach a job already enqueued. Cancelling writes no run record, because the job never ran.",
+    executionMode: "sequential",
+    parameters: typebox_exports.Object({ jobId: typebox_exports.String({ minLength: 1 }) }),
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+      const paths = resolvePaths(process.env);
+      const held = await readHeldJobs({ url: paths.valkeyUrl });
+      if (held.unreachable) throw new Error(`queue unreachable: ${held.unreachable}`);
+      const row = (held.rows ?? []).find((r) => r.jobId === params.jobId);
+      if (!row) throw new Error(`no held job ${params.jobId} (dispatch_waits lists the ids that are waiting)`);
+      const result = await confirmedWrite(
+        ctx,
+        { title: `Cancel held job ${row.jobId}`, message: `Cancel ${row.target ?? row.jobId}, waiting on ${row.label ?? "a condition"}. It will never run.` },
+        async () => {
+          const res = await cancelHeldJob({ url: paths.valkeyUrl, jobId: params.jobId });
+          if (res.invalid) throw new Error(`rejected: ${res.invalid}`);
+          return { applied: true, jobId: params.jobId };
+        }
+      );
+      return toolText(JSON.stringify(result));
+    }
+  });
+  pi.registerTool({
+    name: "dispatch_limit_add",
+    label: "pi-dispatch add scoped limit",
+    description: 'Adds a scoped limit and applies it live: jobs whose scope (a repo "owner/name" or a local folder path, ABSOLUTE, matched exactly like pause windows \u2014 no globs) exceed the `day`/`week`/`month` job-count caps are REFUSED before any spend (reason scope-cap, never retried); jobs over `concurrent` are DEFERRED, never dropped, and run when a slot frees. At least one of day/week/month/concurrent is required, each an integer >= 1. The operator MUST approve a confirm dialog showing the entry; refused with no interactive operator.',
+    executionMode: "sequential",
+    parameters: typebox_exports.Object({
+      scope: typebox_exports.String(),
+      day: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 })),
+      week: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 })),
+      month: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 })),
+      concurrent: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 }))
+    }),
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+      const paths = resolvePaths(process.env);
+      const l = buildScopedLimit(params);
+      const result = await confirmedWrite(
+        ctx,
+        { title: "Add scoped limit", message: `Add to scoped-limits.json:
+${JSON.stringify(l)}` },
+        () => {
+          const res = writeScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath, mutate: (list) => [...list, l] });
+          if (res.invalid) throw new Error(`rejected: ${res.invalid}`);
+          return { applied: true, added: l };
+        }
+      );
+      return toolText(JSON.stringify(result));
+    }
+  });
+  pi.registerTool({
+    name: "dispatch_limit_delete",
+    label: "pi-dispatch delete scoped limit",
+    description: "Removes a scoped limit (by array index from dispatch_limits) and applies it live. The operator MUST approve a confirm dialog showing the limit; refused with no interactive operator.",
+    executionMode: "sequential",
+    parameters: typebox_exports.Object({ index: typebox_exports.Integer({ minimum: 0 }) }),
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+      const paths = resolvePaths(process.env);
+      const p = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+      const list = Array.isArray(p?.limits) ? p.limits : [];
+      const cur = list[params.index];
+      if (!cur) throw new Error(`no scoped limit at index ${params.index} (have ${list.length})`);
+      const result = await confirmedWrite(
+        ctx,
+        { title: `Delete scoped limit #${params.index + 1}`, message: `Remove scoped limit #${params.index + 1}: ${cur.scope} ${limitSummary(cur)}` },
+        () => {
+          const res = writeScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath, mutate: (l) => l.filter((_, i) => i !== params.index) });
+          if (res.invalid) throw new Error(`rejected: ${res.invalid}`);
+          return { applied: true, deletedIndex: params.index };
+        }
+      );
+      return toolText(JSON.stringify(result));
+    }
+  });
+  pi.registerTool({
+    name: "dispatch_limit_edit",
+    label: "pi-dispatch edit scoped limit",
+    description: "Changes fields of an existing scoped limit (by array index from dispatch_limits) and applies it live. Provide only the fields to change (scope/day/week/month/concurrent); the rest keep their current value (to drop one cap from an entry, delete it and re-add without that field). The operator MUST approve a confirm dialog showing the before->after; refused with no interactive operator.",
+    executionMode: "sequential",
+    parameters: typebox_exports.Object({
+      index: typebox_exports.Integer({ minimum: 0 }),
+      scope: typebox_exports.Optional(typebox_exports.String()),
+      day: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 })),
+      week: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 })),
+      month: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 })),
+      concurrent: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 }))
+    }),
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+      const paths = resolvePaths(process.env);
+      const p = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+      const list = Array.isArray(p?.limits) ? p.limits : [];
+      const cur = list[params.index];
+      if (!cur) throw new Error(`no scoped limit at index ${params.index} (have ${list.length})`);
+      const before = buildScopedLimit(cur);
+      const merged = buildScopedLimit({
+        scope: params.scope ?? cur.scope,
+        day: params.day ?? cur.day,
+        week: params.week ?? cur.week,
+        month: params.month ?? cur.month,
+        concurrent: params.concurrent ?? cur.concurrent
+      });
+      const result = await confirmedWrite(
+        ctx,
+        { title: `Edit scoped limit #${params.index + 1}`, message: `scoped limit #${params.index + 1}:
+${JSON.stringify(before)}
+\u2192 ${JSON.stringify(merged)}` },
+        () => {
+          const res = writeScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath, mutate: (l) => l.map((w, i) => i === params.index ? merged : w) });
+          if (res.invalid) throw new Error(`rejected: ${res.invalid}`);
+          return { applied: true, index: params.index, limit: merged };
+        }
+      );
+      return toolText(JSON.stringify(result));
+    }
+  });
   pi.registerTool({
     name: "dispatch_trigger_delete",
     label: "pi-dispatch delete trigger",
@@ -41888,6 +42620,22 @@ function buildPauseWindow(f) {
   if (dateTo) w.dateTo = dateTo;
   return w;
 }
+function buildScopedLimit(f) {
+  const l = { scope: String(f.scope ?? "").trim() };
+  for (const k of ["day", "week", "month", "concurrent"]) {
+    const v = optInt(f[k]);
+    if (v !== void 0) l[k] = v;
+  }
+  return l;
+}
+function limitSummary(l) {
+  const bits = [];
+  if (Number.isInteger(l?.day)) bits.push(`day ${l.day}`);
+  if (Number.isInteger(l?.week)) bits.push(`week ${l.week}`);
+  if (Number.isInteger(l?.month)) bits.push(`month ${l.month}`);
+  if (Number.isInteger(l?.concurrent)) bits.push(`\u2264${l.concurrent} at once`);
+  return bits.join(" \xB7 ");
+}
 function asWords(x) {
   if (Array.isArray(x)) return x.map((s) => String(s).trim()).filter(Boolean);
   return splitWords(x);
@@ -41957,7 +42705,11 @@ ${renderBudget({ budget, settings: settings2 })}`);
     case "budget": {
       const budget = await readBudget({ url: paths.valkeyUrl });
       const settings2 = readSettingsView({ settingsFile: paths.settingsFile });
-      send(pi, renderBudget({ budget, settings: settings2 }));
+      const limits = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+      const scopedBudget = Array.isArray(limits?.limits) && limits.limits.length > 0 ? await readScopedBudget({ url: paths.valkeyUrl, limits: limits.limits }) : { rows: [] };
+      const scopedText = renderScopedLimits({ limits, scopedBudget });
+      send(pi, `${renderBudget({ budget, settings: settings2 })}${scopedText ? `
+${scopedText}` : ""}`);
       return;
     }
     case "triggers": {
@@ -42038,13 +42790,14 @@ ${renderBudget({ budget, settings: settings2 })}`);
       return;
   }
 }
-function assembleCosts(paths, window, flow) {
+function assembleCosts(paths, window, flow, repo) {
   const nowMs = Date.now();
   const sinceMs = costsSinceMs(window, nowMs);
   const records = scanRunRecords({ logsDir: paths.logsDir, sinceMs, nowMs });
   if (!Array.isArray(records)) return records;
   const subs = readSubscriptions({ subscriptionsPath: paths.subscriptionsPath });
-  const scoped = typeof flow === "string" && flow !== "" ? records.filter((r) => (r?.flow ?? null) === flow) : records;
+  const flowScoped = typeof flow === "string" && flow !== "" ? records.filter((r) => (r?.flow ?? null) === flow) : records;
+  const scoped = typeof repo === "string" && repo !== "" ? flowScoped.filter((r) => repoOfTarget(r?.target) === repo) : flowScoped;
   const triggersView = readTriggers({ triggersPath: paths.triggersPath });
   const triggerJoin = attributeRunsToTriggers({ records: scoped, triggers: Array.isArray(triggersView?.triggers) ? triggersView.triggers : [] });
   const fold = foldCosts({
@@ -42107,13 +42860,27 @@ async function assembleBudgetView(paths) {
   const tokensSpent = unreachable === null ? Number(raw.tokensToday ?? 0) : null;
   const tokenCap = posIntOrNull(overlay.dailyTokenCap);
   const tokenState = tokenCap !== null && tokensSpent !== null ? tokensSpent >= tokenCap ? "over" : pct !== null && tokensSpent > Math.floor(tokenCap * pct / 100) ? "soft-hold" : "ok" : "ok";
+  const limitsView = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+  const limits = Array.isArray(limitsView?.limits) ? limitsView.limits : [];
+  const scopedCounters = limits.length > 0 ? await readScopedBudget({ url: paths.valkeyUrl, limits }) : { rows: [] };
+  const scoped = limits.map((l, i) => {
+    const used = scopedCounters?.rows?.[i] ?? null;
+    const win = (cap, key) => {
+      if (cap === null) return null;
+      const u = used && Number.isFinite(used[key]) ? used[key] : null;
+      return { used: u, cap, state: u !== null ? windowState(u, cap, null) : "ok" };
+    };
+    return { scope: l.scope, day: win(l.day, "day"), week: win(l.week, "week"), month: win(l.month, "month"), concurrent: l.concurrent };
+  });
   return {
     unreachable,
     softHoldPct: pct,
     day: slotWindow("day", "dailyCap"),
     week: slotWindow("week", "weeklyCap"),
     month: slotWindow("month", "monthlyCap"),
-    tokens: { spent: tokensSpent, cap: tokenCap, state: tokenState, maxTokens: posIntOrNull(overlay.maxTokens) }
+    tokens: { spent: tokensSpent, cap: tokenCap, state: tokenState, maxTokens: posIntOrNull(overlay.maxTokens) },
+    scoped,
+    scopedInvalid: limitsView?.invalid ? String(limitsView.invalid) : null
   };
 }
 async function assembleInsights(paths, window) {
@@ -42280,7 +43047,7 @@ could not start docker: ${error.message}
   }
 }
 function pauseForMessage() {
-  return new Promise((resolve2) => setTimeout(resolve2, 2500));
+  return new Promise((resolve3) => setTimeout(resolve3, 2500));
 }
 function splitWords(s) {
   return String(s ?? "").split(/\s+/).map((w) => w.trim()).filter(Boolean);
@@ -42306,8 +43073,84 @@ async function handleDashboardAction(result, paths, ctx) {
       return editSettingsViaDialogs(paths, ui, notify);
     case "managePauses":
       return managePausesViaDialogs(paths, ui, notify);
+    case "manageLimits":
+      return manageLimitsViaDialogs(paths, ui, notify);
   }
 }
+async function manageLimitsViaDialogs(paths, ui, notify) {
+  const action = await ui.select("Scoped limits", ["Add a scoped limit", "Edit a scoped limit", "Delete a scoped limit"]);
+  if (!action) return;
+  if (action.startsWith("Add")) return addScopedLimitViaDialogs(paths, ui, notify);
+  if (action.startsWith("Edit")) return editScopedLimitViaDialogs(paths, ui, notify);
+  return deleteScopedLimitViaDialogs(paths, ui, notify);
+}
+async function addScopedLimitViaDialogs(paths, ui, notify) {
+  const scope = await ui.input('scope \u2014 a repo "owner/name" or an ABSOLUTE local folder path (exact match, no globs)', "");
+  if (scope === void 0 || scope.trim() === "") return;
+  const day = await ui.input("day \u2014 max jobs per UTC day for this scope (blank = no day cap)", "");
+  if (day === void 0) return;
+  const week = await ui.input("week \u2014 max jobs per Mon-Sun UTC week (blank = no week cap)", "");
+  if (week === void 0) return;
+  const month = await ui.input("month \u2014 max jobs per calendar month (blank = no month cap)", "");
+  if (month === void 0) return;
+  const concurrent = await ui.input("concurrent \u2014 max jobs in flight for this scope, extras deferred (blank = no limit)", "");
+  if (concurrent === void 0) return;
+  const l = buildScopedLimit({ scope, day, week, month, concurrent });
+  const res = writeScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath, mutate: (list) => [...list, l] });
+  notify?.(res.ok ? `scoped limit added (live) \u2014 ${l.scope} ${limitSummary(l)}` : `add rejected: ${res.invalid}`, res.ok ? "info" : "error");
+}
+async function editScopedLimitViaDialogs(paths, ui, notify) {
+  const p = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+  const list = Array.isArray(p?.limits) ? p.limits : [];
+  if (list.length === 0) {
+    notify?.("no scoped limits to edit", "info");
+    return;
+  }
+  const labels = list.map((l, i) => `#${i + 1}  ${l.scope}  ${limitSummary(l)}`);
+  const picked = await ui.select("Edit which scoped limit", labels);
+  if (!picked) return;
+  const index = labels.indexOf(picked);
+  if (index < 0) return;
+  const cur = list[index];
+  const ask = async (label, current) => ui.input(`${label} \u2014 blank keeps "${current}"`, current);
+  const keep = (v, current) => v === void 0 || v.trim() === "" ? current : v;
+  const scope = await ask("scope", cur.scope ?? "");
+  if (scope === void 0) return;
+  const day = await ask("day cap", String(cur.day ?? ""));
+  if (day === void 0) return;
+  const week = await ask("week cap", String(cur.week ?? ""));
+  if (week === void 0) return;
+  const month = await ask("month cap", String(cur.month ?? ""));
+  if (month === void 0) return;
+  const concurrent = await ask("concurrent (max in flight)", String(cur.concurrent ?? ""));
+  if (concurrent === void 0) return;
+  const merged = buildScopedLimit({
+    scope: keep(scope, cur.scope),
+    day: keep(day, cur.day),
+    week: keep(week, cur.week),
+    month: keep(month, cur.month),
+    concurrent: keep(concurrent, cur.concurrent)
+  });
+  const res = writeScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath, mutate: (l) => l.map((w, i) => i === index ? merged : w) });
+  notify?.(res.ok ? `scoped limit #${index + 1} updated (live) \u2014 ${merged.scope} ${limitSummary(merged)}` : `edit rejected: ${res.invalid}`, res.ok ? "info" : "error");
+}
+async function deleteScopedLimitViaDialogs(paths, ui, notify) {
+  const p = readScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath });
+  const list = Array.isArray(p?.limits) ? p.limits : [];
+  if (list.length === 0) {
+    notify?.("no scoped limits to delete", "info");
+    return;
+  }
+  const labels = list.map((l, i) => `#${i + 1}  ${l.scope}  ${limitSummary(l)}`);
+  const picked = await ui.select("Delete which scoped limit", labels);
+  if (!picked) return;
+  const index = labels.indexOf(picked);
+  if (index < 0) return;
+  const ok = await ui.confirm("Delete scoped limit", `Remove ${labels[index]}?`);
+  if (!ok) return;
+  const res = writeScopedLimits({ scopedLimitsPath: paths.scopedLimitsPath, mutate: (l) => l.filter((_, i) => i !== index) });
+  notify?.(res.ok ? `scoped limit #${index + 1} deleted (live)` : `delete rejected: ${res.invalid}`, res.ok ? "info" : "error");
+}
 async function managePausesViaDialogs(paths, ui, notify) {
   const action = await ui.select("Pause windows", ["Add a pause window", "Edit a pause window", "Delete a pause window"]);
   if (!action) return;