@gethmy/agent 1.35.0 → 1.36.0

package/dist/cli.js

@@ -821,16 +821,121 @@ function buildGaveUpComment(maxAttempts, failures, pauseEnabled) {
 `);
 }
 
+// src/config-merge.ts
+function mergeAgentConfig(defaults, overrides) {
+  return mergeObjects(defaults, overrides);
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function mergeObjects(base, override) {
+  const result = {};
+  for (const key of Object.keys(base)) {
+    if (FORBIDDEN_KEYS.has(key))
+      continue;
+    result[key] = mergeValue(base[key], override[key]);
+  }
+  for (const key of Object.keys(override)) {
+    if (FORBIDDEN_KEYS.has(key))
+      continue;
+    if (Object.hasOwn(base, key))
+      continue;
+    if (override[key] === undefined)
+      continue;
+    result[key] = copy(override[key]);
+  }
+  return result;
+}
+function mergeValue(base, override) {
+  if (override === undefined)
+    return copy(base);
+  if (isPlainObject(base)) {
+    return isPlainObject(override) ? mergeObjects(base, override) : copy(base);
+  }
+  if (Array.isArray(base)) {
+    return Array.isArray(override) ? override.map(copy) : copy(base);
+  }
+  if (base !== undefined && (isPlainObject(override) || Array.isArray(override))) {
+    return copy(base);
+  }
+  if (Array.isArray(override))
+    return override.map(copy);
+  return override;
+}
+function findConfigTypeMismatches(defaults, overrides) {
+  const found = [];
+  walk(defaults, overrides, "agent", found);
+  return found;
+}
+function walk(base, override, path, found) {
+  for (const key of Object.keys(base)) {
+    if (FORBIDDEN_KEYS.has(key))
+      continue;
+    const baseValue = base[key];
+    const overrideValue = override[key];
+    if (overrideValue === undefined)
+      continue;
+    const here = `${path}.${key}`;
+    if (isPlainObject(baseValue)) {
+      if (isPlainObject(overrideValue)) {
+        walk(baseValue, overrideValue, here, found);
+      } else {
+        found.push(mismatch(here, overrideValue, "a block of settings"));
+      }
+    } else if (Array.isArray(baseValue) && !Array.isArray(overrideValue)) {
+      found.push(mismatch(here, overrideValue, "a list"));
+    } else if (baseValue !== undefined && !isPlainObject(baseValue) && !Array.isArray(baseValue) && (isPlainObject(overrideValue) || Array.isArray(overrideValue))) {
+      found.push(mismatch(here, overrideValue, "a single value"));
+    }
+  }
+}
+function mismatch(path, value, expected) {
+  return `${path} is ${describe(value)} in your config but ${expected}, so it was IGNORED and the default used. Fix the type or remove the key.`;
+}
+function describe(value) {
+  if (value === null)
+    return "null";
+  if (Array.isArray(value))
+    return "a list";
+  if (isPlainObject(value))
+    return "a block of settings";
+  return `a ${typeof value}`;
+}
+function copy(value) {
+  if (Array.isArray(value))
+    return value.map(copy);
+  if (isPlainObject(value)) {
+    const out = {};
+    for (const key of Object.keys(value)) {
+      if (FORBIDDEN_KEYS.has(key))
+        continue;
+      out[key] = copy(value[key]);
+    }
+    return out;
+  }
+  return value;
+}
+var FORBIDDEN_KEYS;
+var init_config_merge = __esm(() => {
+  FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+});
+
 // src/config-validation.ts
 var exports_config_validation = {};
 __export(exports_config_validation, {
   validateVerificationConfig: () => validateVerificationConfig,
   validateSweepConfig: () => validateSweepConfig,
   validateRankingConfig: () => validateRankingConfig,
+  validateHttpConfig: () => validateHttpConfig,
   validateColumnReferences: () => validateColumnReferences,
   validateBudgetConfig: () => validateBudgetConfig,
   validateAutoMergeConfig: () => validateAutoMergeConfig,
   validateAndListColumns: () => validateAndListColumns,
+  isLoopbackBindAddr: () => isLoopbackBindAddr,
   findRemovedConfigKeys: () => findRemovedConfigKeys,
   REMOVED_CONFIG_KEYS: () => REMOVED_CONFIG_KEYS,
   ConfigValidationError: () => ConfigValidationError
@@ -946,6 +1051,31 @@ function validateAutoMergeConfig(config) {
     throw new ConfigValidationError(`Invalid agent config — ${issues.join("; ")}`, issues);
   }
 }
+function isLoopbackBindAddr(addr) {
+  const value = addr.toLowerCase();
+  if (value === "localhost" || value === "::1")
+    return true;
+  const v4 = value.startsWith("::ffff:") ? value.slice("::ffff:".length) : value;
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(v4);
+  if (!match)
+    return false;
+  const octets = match.slice(1).map(Number);
+  if (octets.some((octet) => octet > 255))
+    return false;
+  return octets[0] === 127;
+}
+function validateHttpConfig(config) {
+  const bindAddr = config.http.bindAddr;
+  const issues = [];
+  if (typeof bindAddr !== "string" || !isLoopbackBindAddr(bindAddr)) {
+    issues.push(`http.bindAddr: ${JSON.stringify(bindAddr)} is not a loopback address — the control server is UNAUTHENTICATED (no token, no Origin or Host check), so binding it anywhere else publishes the daemon's kill switch (\`POST /sweep/stop\`), its per-card commands (\`POST /stop/:cardId\`) and a \`GET /status\` carrying card ids, branch names and spend to every host that can reach that interface. Use 127.0.0.1 — any 127.0.0.0/8 address, ::1 or localhost also work. To reach the daemon from another machine, tunnel to loopback (\`ssh -L ${config.http.port}:127.0.0.1:${config.http.port} <host>\`); there is no shared-secret mode, by design (#1061).`);
+  }
+  if (issues.length > 0) {
+    throw new ConfigValidationError(`Invalid agent config — HTTP control server:
+  - ${issues.join(`
+  - `)}`, issues);
+  }
+}
 function validateSweepConfig(config) {
   const sweep = config.sweep;
   const issues = [];
@@ -959,7 +1089,7 @@ function validateSweepConfig(config) {
     issues.push("sweep.enabled: true with no ceiling at all — sweep.maxCardsPerSweep and budget.dailyBudgetCents are both opted out (-1). A self-claiming daemon needs at least one: set a card cap (e.g. 10) or a daily spend cap (e.g. 40000 for $400.00/day).");
   }
   if (sweep.enabled && !config.http.enabled) {
-    issues.push("sweep.enabled: true but http.enabled is false — the sweep kill switch IS the local HTTP server (`POST /sweep/stop`, `harmony-agent sweep stop`), so this configuration ships a self-claiming daemon with no way to stop it, and no way to clear a latched card cap either. Set http.enabled: true.");
+    issues.push("sweep.enabled: true but http.enabled is false — the local sweep kill switch IS the local HTTP server (`POST /sweep/stop`, `harmony-agent sweep stop`), so this configuration ships a self-claiming daemon without it. The board can stop and resume the sweep too (#1060), but only while this daemon still reaches the API and realtime — and that is exactly what is broken when you most need a stop. Set http.enabled: true.");
   }
   if (sweep.enabled && config.pickupColumns.length === 0) {
     issues.push("sweep.enabled: true but pickupColumns is empty — the sweep has no column to claim from");
@@ -1462,9 +1592,9 @@ function isGateOperator(value) {
   return typeof value === "string" && GATE_OPERATORS.includes(value);
 }
 function gateEvaluate(gateSpec, evidence) {
-  const structured = isPlainObject(evidence) ? evidence.structured ?? {} : {};
-  const safeStructured = isPlainObject(structured) ? structured : {};
-  if (!isPlainObject(gateSpec)) {
+  const structured = isPlainObject2(evidence) ? evidence.structured ?? {} : {};
+  const safeStructured = isPlainObject2(structured) ? structured : {};
+  if (!isPlainObject2(gateSpec)) {
     return {
       passed: false,
       findings: [{ level: "error", message: "Malformed gate: not an object." }],
@@ -1496,7 +1626,7 @@ function gateEvaluate(gateSpec, evidence) {
       structured: safeStructured
     };
   }
-  if (!isPlainObject(evidence)) {
+  if (!isPlainObject2(evidence)) {
     return {
       passed: false,
       findings: [
@@ -1569,7 +1699,7 @@ function gateEvaluate(gateSpec, evidence) {
   return { passed: predicatePassed, findings, structured: safeStructured };
 }
 function evaluateCondition(raw, structured) {
-  if (!isPlainObject(raw)) {
+  if (!isPlainObject2(raw)) {
     return {
       ok: false,
       finding: {
@@ -1647,7 +1777,7 @@ function evaluateCondition(raw, structured) {
     }
   };
 }
-function isPlainObject(value) {
+function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function blockedDetail(structured) {
@@ -3019,97 +3149,8 @@ function loadDaemonConfig() {
     if (typeof parsed.agentColor === "string" && parsed.agentColor.trim())
       agentColor = parsed.agentColor.trim();
   } catch {}
-  const agent = {
-    ...DEFAULT_AGENT_CONFIG,
-    ...agentOverrides,
-    completion: {
-      ...DEFAULT_AGENT_CONFIG.completion,
-      ...agentOverrides.completion ?? {}
-    },
-    ranking: {
-      ...DEFAULT_AGENT_CONFIG.ranking,
-      ...agentOverrides.ranking ?? {}
-    },
-    claude: {
-      ...DEFAULT_AGENT_CONFIG.claude,
-      ...agentOverrides.claude ?? {}
-    },
-    worktree: {
-      ...DEFAULT_AGENT_CONFIG.worktree,
-      ...agentOverrides.worktree ?? {}
-    },
-    verification: {
-      ...DEFAULT_AGENT_CONFIG.verification,
-      ...agentOverrides.verification ?? {}
-    },
-    review: {
-      ...DEFAULT_AGENT_CONFIG.review,
-      ...agentOverrides.review ?? {},
-      autoMerge: {
-        ...DEFAULT_AGENT_CONFIG.review.autoMerge,
-        ...agentOverrides.review?.autoMerge ?? {},
-        ciRepair: {
-          ...DEFAULT_AGENT_CONFIG.review.autoMerge.ciRepair,
-          ...agentOverrides.review?.autoMerge?.ciRepair ?? {},
-          patch: {
-            ...DEFAULT_AGENT_CONFIG.review.autoMerge.ciRepair.patch,
-            ...agentOverrides.review?.autoMerge?.ciRepair?.patch ?? {}
-          }
-        },
-        independentReview: {
-          ...DEFAULT_AGENT_CONFIG.review.autoMerge.independentReview,
-          ...agentOverrides.review?.autoMerge?.independentReview ?? {},
-          verdict: {
-            ...DEFAULT_AGENT_CONFIG.review.autoMerge.independentReview.verdict,
-            ...agentOverrides.review?.autoMerge?.independentReview?.verdict ?? {}
-          }
-        }
-      }
-    },
-    budget: {
-      ...DEFAULT_AGENT_CONFIG.budget,
-      ...agentOverrides.budget ?? {},
-      pause: {
-        ...DEFAULT_AGENT_CONFIG.budget.pause,
-        ...agentOverrides.budget?.pause ?? {}
-      }
-    },
-    sdk: {
-      ...DEFAULT_AGENT_CONFIG.sdk,
-      ...agentOverrides.sdk ?? {}
-    },
-    http: {
-      ...DEFAULT_AGENT_CONFIG.http,
-      ...agentOverrides.http ?? {}
-    },
-    timing: {
-      ...DEFAULT_AGENT_CONFIG.timing,
-      ...agentOverrides.timing ?? {}
-    },
-    planning: {
-      ...DEFAULT_AGENT_CONFIG.planning,
-      ...agentOverrides.planning ?? {}
-    },
-    playbooks: {
-      ...DEFAULT_AGENT_CONFIG.playbooks,
-      ...agentOverrides.playbooks ?? {}
-    },
-    contractFirst: {
-      ...DEFAULT_AGENT_CONFIG.contractFirst,
-      ...agentOverrides.contractFirst ?? {}
-    },
-    boardReview: {
-      ...DEFAULT_AGENT_CONFIG.boardReview,
-      ...agentOverrides.boardReview ?? {}
-    },
-    sweep: {
-      ...DEFAULT_AGENT_CONFIG.sweep,
-      ...agentOverrides.sweep ?? {},
-      trustedAuthors: [
-        ...agentOverrides.sweep?.trustedAuthors ?? DEFAULT_AGENT_CONFIG.sweep.trustedAuthors
-      ]
-    }
-  };
+  const agent = mergeAgentConfig(DEFAULT_AGENT_CONFIG, agentOverrides);
+  configWarnings.push(...findConfigTypeMismatches(DEFAULT_AGENT_CONFIG, agentOverrides));
   if (agent.runner !== "cli" && agent.runner !== "sdk") {
     agent.runner = DEFAULT_AGENT_CONFIG.runner;
   }
@@ -3181,6 +3222,7 @@ function createApiClient(config) {
 }
 var NOT_A_REPOSITORY_EXIT = 128;
 var init_config = __esm(() => {
+  init_config_merge();
   init_config_validation();
   init_types2();
 });
@@ -3211,6 +3253,9 @@ class HttpServer {
     return this.boundPort;
   }
   async start() {
+    if (!isLoopbackBindAddr(this.opts.bindAddr)) {
+      throw new Error(`refusing to bind the unauthenticated control server to ${JSON.stringify(this.opts.bindAddr)} — loopback only (127.0.0.0/8, ::1, localhost), see validateHttpConfig (#1061)`);
+    }
     this.server = createServer((req, res) => {
       this.route(req, res).catch((err) => {
         log5.error(TAG5, `unhandled: ${err instanceof Error ? err.message : err}`);
@@ -3423,7 +3468,9 @@ function busy(w) {
   return w.cardId !== null;
 }
 var TAG5 = "http";
-var init_http_server = () => {};
+var init_http_server = __esm(() => {
+  init_config_validation();
+});
 
 // src/identity.ts
 function resolveDaemonUserId(userEmail, members, apiKeyUserId) {
@@ -3487,13 +3534,13 @@ function extractScratchTrees(cleanWorktree, commitish) {
 function changedPaths(changes) {
   return [...changes.modified, ...changes.added, ...changes.deleted];
 }
-function walk(root, dir = root, out = []) {
+function walk2(root, dir = root, out = []) {
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
     const full = join2(dir, entry.name);
     if (entry.isSymbolicLink())
       continue;
     if (entry.isDirectory()) {
-      walk(root, full, out);
+      walk2(root, full, out);
     } else if (entry.isFile()) {
       out.push(relative(root, full).split(sep).join("/"));
     }
@@ -3501,8 +3548,8 @@ function walk(root, dir = root, out = []) {
   return out;
 }
 function diffTrees(pristine, scratch) {
-  const before = new Set(walk(pristine));
-  const after = walk(scratch);
+  const before = new Set(walk2(pristine));
+  const after = walk2(scratch);
   const afterSet = new Set(after);
   const modified = [];
   const added = [];
@@ -4916,7 +4963,7 @@ async function settlePlanCriteria(client, tag, card) {
     if (divergent.length > 0) {
       log13.warn(tag, describeDivergence(card.short_id, card.plan_id, divergent));
     }
-    const settleGroup = async (criteria, planIdOf, describe) => {
+    const settleGroup = async (criteria, planIdOf, describe2) => {
       if (criteria.length === 0)
         return;
       try {
@@ -4925,7 +4972,7 @@ async function settlePlanCriteria(client, tag, card) {
             status: CRITERION_COMPLETED
           });
         }
-        log13.info(tag, describe());
+        log13.info(tag, describe2());
       } catch (err) {
         log13.warn(tag, `plan criteria write-back failed for #${card.short_id}: ${err instanceof Error ? err.message : err}`);
       }
@@ -13115,6 +13162,7 @@ __export(exports_port_registry, {
   recordDaemonPort: () => recordDaemonPort,
   lookupDaemonPort: () => lookupDaemonPort,
   defaultRegistryPath: () => defaultRegistryPath,
+  daemonBaseUrl: () => daemonBaseUrl,
   clearDaemonPort: () => clearDaemonPort
 });
 import {
@@ -13161,6 +13209,10 @@ function recordDaemonPort(projectId, entry, path = defaultRegistryPath()) {
     log33.warn(TAG30, `failed to record port for ${projectId}: ${err instanceof Error ? err.message : err}`);
   }
 }
+function daemonBaseUrl(bindAddr, port) {
+  const host = bindAddr.includes(":") ? `[${bindAddr}]` : bindAddr;
+  return `http://${host}:${port}`;
+}
 function lookupDaemonPort(projectId, path = defaultRegistryPath()) {
   const registry = load(path);
   return registry[projectId] ?? null;
@@ -13845,8 +13897,63 @@ var init_sweep = __esm(() => {
   init_unblock();
 });
 
-// src/sweep-guard.ts
+// src/sweep-commands.ts
 import { log as log38 } from "@gethmy/harness";
+function parseSweepCommands(payload) {
+  if (!payload || typeof payload !== "object")
+    return [];
+  const rows = payload.commands;
+  if (!Array.isArray(rows))
+    return [];
+  const parsed = [];
+  for (const row of rows) {
+    if (!row || typeof row !== "object")
+      continue;
+    const { id, verb, createdAt } = row;
+    if (typeof id !== "string" || !id)
+      continue;
+    if (verb !== "stop" && verb !== "resume")
+      continue;
+    parsed.push({
+      id,
+      verb,
+      createdAt: typeof createdAt === "string" ? createdAt : ""
+    });
+  }
+  return parsed.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+}
+async function claimSweepCommands(client, agentId, projectId, daemonId) {
+  const request = client.request?.bind(client);
+  if (typeof request !== "function") {
+    log38.warn(TAG35, "installed @gethmy/mcp has no generic request method — board sweep commands cannot be claimed; use `harmony-agent sweep stop|resume` until it is upgraded");
+    return [];
+  }
+  try {
+    const res = await request("POST", `/agents/${encodeURIComponent(agentId)}/sweep-commands/claim`, { projectId, daemonId });
+    return parseSweepCommands(res);
+  } catch (err) {
+    log38.warn(TAG35, `could not claim sweep commands: ${err instanceof Error ? err.message : err}`);
+    return [];
+  }
+}
+async function applySweepCommands(commands, actions) {
+  let applied = null;
+  for (const command of commands) {
+    if (command.verb === "stop") {
+      await actions.halt();
+    } else {
+      await actions.resume();
+    }
+    applied = command.verb;
+    log38.info(TAG35, `applied "${command.verb}" from the board (${command.id})`);
+  }
+  return applied;
+}
+var TAG35 = "sweep-cmd";
+var init_sweep_commands = () => {};
+
+// src/sweep-guard.ts
+import { log as log39 } from "@gethmy/harness";
 
 class SweepGuard {
   config;
@@ -13902,7 +14009,7 @@ class SweepGuard {
     await this.store.haltSweep(reason);
     if (!already) {
       const claimed = this.store.getSweep().claimed;
-      log38.info(TAG35, `claiming stopped (${reason}) after ${claimed} claimed`);
+      log39.info(TAG36, `claiming stopped (${reason}) after ${claimed} claimed`);
     }
     return this.snapshot();
   }
@@ -13911,7 +14018,7 @@ class SweepGuard {
     const was = before.haltReason ? this.describeStop(before.haltReason) : null;
     await this.store.resumeSweep();
     if (was)
-      log38.info(TAG35, `claiming resumed by the operator — was stopped: ${was}`);
+      log39.info(TAG36, `claiming resumed by the operator — was stopped: ${was}`);
     return this.snapshot();
   }
   snapshot() {
@@ -13973,11 +14080,11 @@ function sweepBannerLine(config) {
   const authors = extra ? `you + ${extra} trusted author${extra === 1 ? "" : "s"}` : "you only";
   return `Sweep ON — claims ${scope} in ${config.pickupColumns.join(", ")}, ` + `authored by ${authors}; caps: ${describeCaps(sweep, config.budget.dailyBudgetCents)}; ` + `${sweep.maxProbesPerTick} probes/tick`;
 }
-var TAG35 = "sweep";
+var TAG36 = "sweep";
 var init_sweep_guard = () => {};
 
 // src/reconcile.ts
-import { detectGitProvider as detectGitProvider5, log as log39 } from "@gethmy/harness";
+import { detectGitProvider as detectGitProvider5, log as log40 } from "@gethmy/harness";
 function daemonProcessLabels(approvedLabel) {
   const names = ["agent", "agent-recovered", NEED_REVIEW_LABEL, approvedLabel];
   return new Set(names.filter(Boolean).map((n) => n.toLowerCase()));
@@ -14008,6 +14115,8 @@ class Reconciler {
   repoDirectories = null;
   lastSweepStopReported = null;
   publishSweep = () => {};
+  drainingSweepCommands = false;
+  lastSweepNudgeAt = 0;
   get lastTick() {
     return this.lastTickAt;
   }
@@ -14037,7 +14146,7 @@ class Reconciler {
       clearInterval(this.timer);
       this.timer = null;
     }
-    log39.info(TAG36, "Heartbeat stopped");
+    log40.info(TAG37, "Heartbeat stopped");
   }
   async recoverStaleRuns() {
     if (!this.stateStore || !this.agentConfig)
@@ -14048,7 +14157,7 @@ class Reconciler {
     const pool = this.pool;
     for (const run of active) {
       if (isBudgetHeldRun(run)) {
-        log39.info(TAG36, `run ${run.runId} (#${run.cardShortId}) is held for a human budget decision — leaving it`);
+        log40.info(TAG37, `run ${run.runId} (#${run.cardShortId}) is held for a human budget decision — leaving it`);
         continue;
       }
       const foreignDaemon = run.daemonPid !== process.pid;
@@ -14058,7 +14167,7 @@ class Reconciler {
       if (!daemonDead && !(heartbeatStale && ourZombie))
         continue;
       const reason = daemonDead ? `foreign daemon ${run.daemonPid} is dead` : `our worker lost card ${run.cardId} with ${Math.round((now - run.lastHeartbeatAt) / 1000)}s stale heartbeat`;
-      log39.warn(TAG36, `zombie run ${run.runId} (#${run.cardShortId}): ${reason} — recovering`);
+      log40.warn(TAG37, `zombie run ${run.runId} (#${run.cardShortId}): ${reason} — recovering`);
       await recoverRun(run, this.stateStore, this.client, this.agentConfig, {
         runId: run.runId,
         cardId: run.cardId,
@@ -14085,11 +14194,11 @@ class Reconciler {
       const stalledAt = Date.parse(card.updated_at ?? "");
       if (!Number.isFinite(stalledAt) || now - stalledAt < graceMs)
         continue;
-      log39.warn(TAG36, `#${card.short_id} stranded in "${inProgressCol.name}" (no live run) — requeueing to "${pickupCol.name}"`);
+      log40.warn(TAG37, `#${card.short_id} stranded in "${inProgressCol.name}" (no live run) — requeueing to "${pickupCol.name}"`);
       try {
         await this.client.moveCard(card.id, pickupCol.id);
       } catch (err) {
-        log39.error(TAG36, `stranded requeue failed for #${card.short_id}: ${err instanceof Error ? err.message : err}`);
+        log40.error(TAG37, `stranded requeue failed for #${card.short_id}: ${err instanceof Error ? err.message : err}`);
       }
     }
   }
@@ -14121,7 +14230,7 @@ class Reconciler {
           return;
         const cardLabels = resolveCardLabels(card, labelMap);
         const subtasks = card.subtasks ?? [];
-        log39.info(TAG36, `Enqueuing claimed review card #${card.short_id} (agent-agnostic pickup)`);
+        log40.info(TAG37, `Enqueuing claimed review card #${card.short_id} (agent-agnostic pickup)`);
         await this.pool.enqueue(card, column, cardLabels, subtasks, "review");
       }
     });
@@ -14145,11 +14254,11 @@ class Reconciler {
       const parkedAt = Date.parse(card.updated_at ?? "");
       if (!Number.isFinite(parkedAt) || now - parkedAt < ttlMs)
         continue;
-      log39.warn(TAG36, `#${card.short_id} parked for approval > ${planning.approvalTtlHours}h — auto-releasing to "${pickupCol.name}"`);
+      log40.warn(TAG37, `#${card.short_id} parked for approval > ${planning.approvalTtlHours}h — auto-releasing to "${pickupCol.name}"`);
       try {
         await this.client.moveCard(card.id, pickupCol.id);
       } catch (err) {
-        log39.error(TAG36, `auto-release failed for #${card.short_id}: ${err instanceof Error ? err.message : err}`);
+        log40.error(TAG37, `auto-release failed for #${card.short_id}: ${err instanceof Error ? err.message : err}`);
       }
     }
   }
@@ -14184,7 +14293,7 @@ class Reconciler {
     }
     this.lastSweepStopReported = null;
     if (!this.pool.hasFreeImplementSlot()) {
-      log39.debug(TAG36, "sweep skipped — no free implement slot");
+      log40.debug(TAG37, "sweep skipped — no free implement slot");
       return;
     }
     const { claimed } = await sweepForCard({
@@ -14203,9 +14312,9 @@ class Reconciler {
   reportSweepStopped(reason, detail) {
     const line = `sweep stopped claiming — ${detail}`;
     if (this.lastSweepStopReported === reason)
-      log39.debug(TAG36, line);
+      log40.debug(TAG37, line);
     else
-      log39.warn(TAG36, line);
+      log40.warn(TAG37, line);
     this.lastSweepStopReported = reason;
   }
   setSweepPresenceSink(sink) {
@@ -14214,15 +14323,47 @@ class Reconciler {
   publishSweepState() {
     this.publishSweep(toSweepPresence(this.sweepGuard?.snapshot()));
   }
+  async drainSweepCommands() {
+    const guard = this.sweepGuard;
+    if (!guard || !this.agentConfig?.sweep.enabled)
+      return;
+    if (this.drainingSweepCommands)
+      return;
+    this.drainingSweepCommands = true;
+    try {
+      const commands = await claimSweepCommands(this.client, this.agentId, this.projectId, this.stateStore?.getDaemon().daemonId ?? "");
+      if (commands.length === 0)
+        return;
+      const applied = await applySweepCommands(commands, {
+        halt: () => guard.halt("operator"),
+        resume: () => guard.resume()
+      });
+      if (!applied)
+        return;
+      this.lastSweepStopReported = null;
+      this.publishSweepState();
+    } finally {
+      this.drainingSweepCommands = false;
+    }
+  }
+  onSweepCommandNudge() {
+    const now = Date.now();
+    if (now - this.lastSweepNudgeAt < SWEEP_NUDGE_COOLDOWN_MS)
+      return;
+    this.lastSweepNudgeAt = now;
+    this.drainSweepCommands().catch((err) => {
+      log40.error(TAG37, `sweep command nudge failed: ${err instanceof Error ? err.message : err}`);
+    });
+  }
   resolveRepoDirectories() {
     if (this.repoDirectories)
       return this.repoDirectories;
     const dirs = readRepoDirectories(process.cwd());
     this.repoDirectories = dirs;
     if (dirs.size === 0) {
-      log39.warn(TAG36, `Could not read top-level directories of ${process.cwd()} — sweep cohesion runs without its path signal`);
+      log40.warn(TAG37, `Could not read top-level directories of ${process.cwd()} — sweep cohesion runs without its path signal`);
     } else {
-      log39.debug(TAG36, `Path signal allows ${dirs.size} top-level directories`);
+      log40.debug(TAG37, `Path signal allows ${dirs.size} top-level directories`);
     }
     return dirs;
   }
@@ -14266,21 +14407,21 @@ class Reconciler {
           const subtasks = card.subtasks ?? [];
           const mode = route.mode;
           if (route.stage) {
-            log39.info(TAG36, `Stage card #${card.short_id} (stage "${card.current_stage}") in "${column.name}" — routing to the stage executor (implement) regardless of column`);
+            log40.info(TAG37, `Stage card #${card.short_id} (stage "${card.current_stage}") in "${column.name}" — routing to the stage executor (implement) regardless of column`);
           }
           if (mode === "review" && this.approvedLabel && hasLabel(cardLabels, this.approvedLabel)) {
-            log39.debug(TAG36, `Skipping #${card.short_id} — already has "${this.approvedLabel}" label`);
+            log40.debug(TAG37, `Skipping #${card.short_id} — already has "${this.approvedLabel}" label`);
             continue;
           }
           if (mode === "review" && hasLabel(cardLabels, NEED_REVIEW_LABEL)) {
-            log39.debug(TAG36, `Skipping #${card.short_id} — has "${NEED_REVIEW_LABEL}" label (needs human)`);
+            log40.debug(TAG37, `Skipping #${card.short_id} — has "${NEED_REVIEW_LABEL}" label (needs human)`);
             continue;
           }
           if (mode === "review" && !qualifiesForAutoReview(card.description)) {
-            log39.debug(TAG36, `Skipping #${card.short_id} — no branch or PR reference (not qualified for auto-review)`);
+            log40.debug(TAG37, `Skipping #${card.short_id} — no branch or PR reference (not qualified for auto-review)`);
             continue;
           }
-          log39.info(TAG36, `Missed assignment: #${card.short_id} "${card.title}" (${mode}) — enqueueing`);
+          log40.info(TAG37, `Missed assignment: #${card.short_id} "${card.title}" (${mode}) — enqueueing`);
           await this.pool.enqueue(card, column, cardLabels, subtasks, mode);
         }
       }
@@ -14290,29 +14431,34 @@ class Reconciler {
       try {
         await this.pool.drainBudgetDecisions();
       } catch (err) {
-        log39.error(TAG36, `budget decisions were not drained this tick: ${err instanceof Error ? err.message : err}`);
+        log40.error(TAG37, `budget decisions were not drained this tick: ${err instanceof Error ? err.message : err}`);
       }
       await this.recoverStrandedInProgress(cards, columns, knownCardIds);
       await this.recoverStrandedReview(cards, columns, labelMap, knownCardIds);
       for (const knownId of knownCardIds) {
         if (!allAgentCardIds.has(knownId)) {
-          log39.info(TAG36, `Missed unassign: ${knownId} — removing`);
+          log40.info(TAG37, `Missed unassign: ${knownId} — removing`);
           await this.pool.removeCard(knownId);
         }
       }
       await this.releaseStalledApprovals(cards, columns, knownCardIds);
+      try {
+        await this.drainSweepCommands();
+      } catch (err) {
+        log40.error(TAG37, `sweep commands were not drained this tick: ${err instanceof Error ? err.message : err}`);
+      }
       try {
         await this.sweepForWork(cards, columns, labelMap, pickupConfig);
       } catch (err) {
-        log39.error(TAG36, `sweep failed this tick: ${err instanceof Error ? err.message : err}`);
+        log40.error(TAG37, `sweep failed this tick: ${err instanceof Error ? err.message : err}`);
       }
-      log39.debug(TAG36, `Reconciled: ${assignedCards.length} assigned, ${knownCardIds.size} known`);
+      log40.debug(TAG37, `Reconciled: ${assignedCards.length} assigned, ${knownCardIds.size} known`);
     } catch (err) {
-      log39.error(TAG36, `Heartbeat failed: ${err instanceof Error ? err.message : err}`);
+      log40.error(TAG37, `Heartbeat failed: ${err instanceof Error ? err.message : err}`);
     }
   }
 }
-var TAG36 = "reconcile";
+var TAG37 = "reconcile", SWEEP_NUDGE_COOLDOWN_MS = 15000;
 var init_reconcile = __esm(() => {
   init_board_helpers();
   init_recovery();
@@ -14321,6 +14467,7 @@ var init_reconcile = __esm(() => {
   init_state_store();
   init_strand_recovery();
   init_sweep();
+  init_sweep_commands();
   init_sweep_guard();
   init_types2();
 });
@@ -14331,7 +14478,7 @@ __export(exports_startup_banner, {
   createStartupBanner: () => createStartupBanner,
   contextSourceLine: () => contextSourceLine
 });
-import { isPretty, log as log40 } from "@gethmy/harness";
+import { isPretty, log as log41 } from "@gethmy/harness";
 function createStartupBanner(config, version) {
   return isPretty() ? prettyBanner(config, version) : jsonBanner(config, version);
 }
@@ -14356,7 +14503,7 @@ function prettyBanner(config, version) {
       checks.push({ kind: "ok", message });
     },
     warn(message) {
-      log40.warn(TAG37, message);
+      log41.warn(TAG38, message);
       checks.push({ kind: "warn", message: message.split(`
 `, 1)[0] });
     },
@@ -14381,26 +14528,26 @@ function prettyBanner(config, version) {
   };
 }
 function jsonBanner(config, version) {
-  log40.info(TAG37, `Harmony Agent Daemon v${version} starting...`);
-  log40.info(TAG37, `Project: ${config.projectId} | Pool: ${config.agent.poolSize} | Model: ${config.agent.claude.model} | Runner: ${config.agent.runner} | Pickup: ${config.agent.pickupColumns.join(", ")}`);
-  log40.info(TAG37, `Config: ${contextSourceLine(config)}`);
+  log41.info(TAG38, `Harmony Agent Daemon v${version} starting...`);
+  log41.info(TAG38, `Project: ${config.projectId} | Pool: ${config.agent.poolSize} | Model: ${config.agent.claude.model} | Runner: ${config.agent.runner} | Pickup: ${config.agent.pickupColumns.join(", ")}`);
+  log41.info(TAG38, `Config: ${contextSourceLine(config)}`);
   if (config.agent.review.enabled) {
-    log40.info(TAG37, `Review: enabled | Columns: ${config.agent.review.pickupColumns.join(", ")} | → ${config.agent.review.moveToColumn} / ${config.agent.review.failColumn}`);
+    log41.info(TAG38, `Review: enabled | Columns: ${config.agent.review.pickupColumns.join(", ")} | → ${config.agent.review.moveToColumn} / ${config.agent.review.failColumn}`);
   }
   let failed = false;
   return {
     setProjectName(_name) {},
     setGitProvider(provider) {
-      log40.info(TAG37, `Git provider: ${provider}`);
+      log41.info(TAG38, `Git provider: ${provider}`);
     },
     setHttpPort(port) {
-      log40.info(TAG37, `HTTP server on port ${port}`);
+      log41.info(TAG38, `HTTP server on port ${port}`);
     },
     check(message) {
-      log40.info(TAG37, message);
+      log41.info(TAG38, message);
     },
     warn(message) {
-      log40.warn(TAG37, message);
+      log41.warn(TAG38, message);
     },
     fail() {
       failed = true;
@@ -14408,7 +14555,7 @@ function jsonBanner(config, version) {
     async ready(message) {
       if (failed)
         return;
-      log40.info(TAG37, message);
+      log41.info(TAG38, message);
     }
   };
 }
@@ -14460,7 +14607,7 @@ function configRows(config, projectName, gitProvider, httpPort) {
   if (gitProvider)
     tail.push(gitProvider);
   if (config.agent.http.enabled) {
-    tail.push(`HTTP http://${config.agent.http.bindAddr}:${httpPort ?? config.agent.http.port}`);
+    tail.push(`HTTP ${daemonBaseUrl(config.agent.http.bindAddr, httpPort ?? config.agent.http.port)}`);
   }
   if (tail.length > 0) {
     rows.push({ label: "Git", value: tail.join("  ·  ") });
@@ -14497,8 +14644,9 @@ function cyan(s) {
 function yellow(s) {
   return `${ANSI.yellow}${s}${ANSI.reset}`;
 }
-var TAG37 = "daemon", RULE_WIDTH = 70, ANSI;
+var TAG38 = "daemon", RULE_WIDTH = 70, ANSI;
 var init_startup_banner = __esm(() => {
+  init_port_registry();
   ANSI = {
     reset: "\x1B[0m",
     dim: "\x1B[2m",
@@ -14517,7 +14665,7 @@ import {
   writeFileSync as writeFileSync5
 } from "node:fs";
 import { dirname as dirname6, resolve as resolve2, sep as sep2 } from "node:path";
-import { log as log41 } from "@gethmy/harness";
+import { log as log42 } from "@gethmy/harness";
 function migrationMarkerPath(targetPath) {
   return `${targetPath}.migrated`;
 }
@@ -14592,7 +14740,7 @@ function migrateLegacyStateFile(opts) {
       throw new Error("not an object");
     legacy = parsed;
   } catch (err) {
-    log41.warn(TAG38, `legacy state file unreadable — skipping the split this start; it retries on the next (${err instanceof Error ? err.message : err})`);
+    log42.warn(TAG39, `legacy state file unreadable — skipping the split this start; it retries on the next (${err instanceof Error ? err.message : err})`);
     return NO_MIGRATION;
   }
   const runs = Array.isArray(legacy.runs) ? legacy.runs : [];
@@ -14614,13 +14762,13 @@ function migrateLegacyStateFile(opts) {
   const legacyVersion = typeof legacy.version === "number" ? legacy.version : SCHEMA_VERSION;
   const existing = existsSync4(targetPath) ? readTargetFile(targetPath) : null;
   if (existsSync4(targetPath) && !existing) {
-    log41.warn(TAG38, "existing project state file unreadable — the split overwrites it");
+    log42.warn(TAG39, "existing project state file unreadable — the split overwrites it");
   }
   let target;
   if (existing) {
     const existingVersion = typeof existing.version === "number" ? existing.version : SCHEMA_VERSION;
     if (existingVersion !== legacyVersion) {
-      log41.warn(TAG38, `legacy state is schema v${legacyVersion} but the project store is v${existingVersion} — skipping the split`);
+      log42.warn(TAG39, `legacy state is schema v${legacyVersion} but the project store is v${existingVersion} — skipping the split`);
       return NO_MIGRATION;
     }
     const existingRuns = Array.isArray(existing.runs) ? existing.runs : [];
@@ -14666,7 +14814,7 @@ function migrateLegacyStateFile(opts) {
     if (!existsSync4(backupPath))
       copyFileSync(legacyPath, backupPath);
   } catch (err) {
-    log41.warn(TAG38, `could not back up the legacy state file (continuing): ${err instanceof Error ? err.message : err}`);
+    log42.warn(TAG39, `could not back up the legacy state file (continuing): ${err instanceof Error ? err.message : err}`);
   }
   const remainingRuns = runs.filter((r) => !ownRunIds.has(r.runId));
   const remainingCards = cards.filter((c) => !ownCardIds.has(c.cardId));
@@ -14690,10 +14838,10 @@ function migrateLegacyStateFile(opts) {
     copiedIndeterminateCards: indeterminateCards.length,
     foreignUnendedRuns: remainingRuns.filter((r) => r.endedAt === null).length
   };
-  log41.info(TAG38, `split legacy state into ${targetPath}: moved ${result.movedRuns} run(s) ` + `(${result.movedUnendedRuns} unended) and ${result.movedCards} card record(s), ` + `copied ${result.copiedIndeterminateCards} unattributable card record(s); ` + `left ${remainingRuns.length} run(s) (${result.foreignUnendedRuns} unended) for other projects`);
+  log42.info(TAG39, `split legacy state into ${targetPath}: moved ${result.movedRuns} run(s) ` + `(${result.movedUnendedRuns} unended) and ${result.movedCards} card record(s), ` + `copied ${result.copiedIndeterminateCards} unattributable card record(s); ` + `left ${remainingRuns.length} run(s) (${result.foreignUnendedRuns} unended) for other projects`);
   return result;
 }
-var TAG38 = "state-migration", NO_MIGRATION;
+var TAG39 = "state-migration", NO_MIGRATION;
 var init_state_migration = __esm(() => {
   init_state_store();
   NO_MIGRATION = {
@@ -14799,7 +14947,7 @@ var init_stream_parser_selftest = __esm(() => {
 
 // src/watcher.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { isPretty as isPretty2, log as log42 } from "@gethmy/harness";
+import { isPretty as isPretty2, log as log43 } from "@gethmy/harness";
 import { createClient } from "@supabase/supabase-js";
 function toPresenceColumns(names) {
   return names.map((n) => n.trim()).filter((n) => n.length > 0).slice(0, MAX_PRESENCE_COLUMNS).map((n) => n.slice(0, MAX_PRESENCE_COLUMN_LENGTH));
@@ -14812,6 +14960,7 @@ class Watcher {
   routing;
   onCardBroadcast;
   onAgentCommand;
+  onSweepCommandNudge;
   channel = null;
   presenceChannel = null;
   supabase = null;
@@ -14859,20 +15008,21 @@ class Watcher {
     const stillHeld = this.supabase?.getChannels().some((c) => c.topic === old.topic) ?? false;
     if (!stillHeld)
       return true;
-    log42.warn(TAG39, `removeChannel(${old.topic}) returned "${status}" and the client still holds that topic — retrying the removal`);
+    log43.warn(TAG40, `removeChannel(${old.topic}) returned "${status}" and the client still holds that topic — retrying the removal`);
     return false;
   }
-  constructor(credentials, projectId, identity, routing, onCardBroadcast, onAgentCommand) {
+  constructor(credentials, projectId, identity, routing, onCardBroadcast, onAgentCommand, onSweepCommandNudge) {
     this.credentials = credentials;
     this.projectId = projectId;
     this.identity = identity;
     this.routing = routing;
     this.onCardBroadcast = onCardBroadcast;
     this.onAgentCommand = onAgentCommand;
+    this.onSweepCommandNudge = onSweepCommandNudge;
   }
   async start() {
     if (!isPretty2()) {
-      log42.info(TAG39, "Connecting to Supabase realtime (broadcast)...");
+      log43.info(TAG40, "Connecting to Supabase realtime (broadcast)...");
     }
     this.supabase = createClient(this.credentials.supabaseUrl, this.credentials.supabaseAnonKey);
     this.subscribeBroadcast();
@@ -14910,7 +15060,7 @@ class Watcher {
         status = `threw (${String(err)})`;
       }
       if (status !== "ok") {
-        log42.debug(TAG39, `Presence sweep update returned "${status}"`);
+        log43.debug(TAG40, `Presence sweep update returned "${status}"`);
       }
     })();
   }
@@ -14921,7 +15071,7 @@ class Watcher {
     const presenceChannel = this.supabase.channel(`board-presence-${this.projectId}`);
     this.presenceChannel = presenceChannel;
     presenceChannel.on("presence", { event: "sync" }, () => {
-      log42.debug(TAG39, "Presence sync");
+      log43.debug(TAG40, "Presence sync");
     }).subscribe(async (status) => {
       if (gen !== this.presenceGen)
         return;
@@ -14937,13 +15087,13 @@ class Watcher {
         if (trackStatus !== "ok") {
           this.presenceTracked = false;
           if (!this.stopping) {
-            log42.warn(TAG39, `Presence track returned "${trackStatus}" — scheduling reconnect`);
+            log43.warn(TAG40, `Presence track returned "${trackStatus}" — scheduling reconnect`);
             this.schedulePresenceReconnect();
           }
           return;
         }
         if (!isPretty2() || !this.suppressStartupLogs) {
-          log42.info(TAG39, "Presence tracked on board-presence channel");
+          log43.info(TAG40, "Presence tracked on board-presence channel");
         }
         this.presenceTracked = true;
         this.presenceReconnectAttempts = 0;
@@ -14951,7 +15101,7 @@ class Watcher {
       } else if (status === "CHANNEL_ERROR" || status === "TIMED_OUT" || status === "CLOSED") {
         this.presenceTracked = false;
         if (!this.stopping) {
-          log42.warn(TAG39, `Presence subscription ${status} — scheduling reconnect`);
+          log43.warn(TAG40, `Presence subscription ${status} — scheduling reconnect`);
           this.schedulePresenceReconnect();
         }
       }
@@ -14970,7 +15120,7 @@ class Watcher {
   async reconnectPresence() {
     if (this.stopping || !this.supabase)
       return;
-    log42.warn(TAG39, `Reconnecting presence subscription (attempt ${this.presenceReconnectAttempts})`);
+    log43.warn(TAG40, `Reconnecting presence subscription (attempt ${this.presenceReconnectAttempts})`);
     if (this.presenceChannel) {
       const old = this.presenceChannel;
       this.presenceChannel = null;
@@ -14993,13 +15143,13 @@ class Watcher {
       return;
     const gen = ++this.broadcastGen;
     this.channel = this.supabase.channel(`board-${this.projectId}`).on("broadcast", { event: "card_update" }, (msg) => {
-      log42.debug(TAG39, `Broadcast: card_update ${JSON.stringify(msg.payload)}`);
+      log43.debug(TAG40, `Broadcast: card_update ${JSON.stringify(msg.payload)}`);
       this.onCardBroadcast({
         event: "card_update",
         payload: msg.payload ?? {}
       });
     }).on("broadcast", { event: "card_created" }, (msg) => {
-      log42.debug(TAG39, `Broadcast: card_created ${JSON.stringify(msg.payload)}`);
+      log43.debug(TAG40, `Broadcast: card_created ${JSON.stringify(msg.payload)}`);
       this.onCardBroadcast({
         event: "card_created",
         payload: msg.payload ?? {}
@@ -15009,9 +15159,12 @@ class Watcher {
       const cardId = payload.card_id;
       const command = payload.command;
       if (cardId && command) {
-        log42.info(TAG39, `Broadcast: agent_command ${command} for ${cardId}`);
+        log43.info(TAG40, `Broadcast: agent_command ${command} for ${cardId}`);
         this.onAgentCommand?.({ cardId, command });
       }
+    }).on("broadcast", { event: "sweep_command" }, () => {
+      log43.debug(TAG40, "Broadcast: sweep_command — draining");
+      this.onSweepCommandNudge?.();
     }).subscribe((status) => {
       if (gen !== this.broadcastGen)
         return;
@@ -15019,13 +15172,13 @@ class Watcher {
         this.connected = true;
         this.reconnectAttempts = 0;
         if (!isPretty2() || !this.suppressStartupLogs) {
-          log42.info(TAG39, "Broadcast subscription active");
+          log43.info(TAG40, "Broadcast subscription active");
         }
         this.maybeResolveReady();
       } else if (status === "CHANNEL_ERROR" || status === "TIMED_OUT" || status === "CLOSED") {
         this.connected = false;
         if (!this.stopping) {
-          log42.warn(TAG39, `Broadcast subscription ${status} — scheduling reconnect`);
+          log43.warn(TAG40, `Broadcast subscription ${status} — scheduling reconnect`);
           this.scheduleReconnect();
         }
       }
@@ -15044,7 +15197,7 @@ class Watcher {
   async reconnectBroadcast() {
     if (this.stopping || !this.supabase)
       return;
-    log42.warn(TAG39, `Reconnecting broadcast subscription (attempt ${this.reconnectAttempts})`);
+    log43.warn(TAG40, `Reconnecting broadcast subscription (attempt ${this.reconnectAttempts})`);
     if (this.channel) {
       const old = this.channel;
       this.channel = null;
@@ -15086,10 +15239,10 @@ class Watcher {
     }
     this.connected = false;
     this.presenceTracked = false;
-    log42.info(TAG39, "Broadcast subscription stopped");
+    log43.info(TAG40, "Broadcast subscription stopped");
   }
 }
-var TAG39 = "watcher", MAX_PRESENCE_COLUMNS = 24, MAX_PRESENCE_COLUMN_LENGTH = 120;
+var TAG40 = "watcher", MAX_PRESENCE_COLUMNS = 24, MAX_PRESENCE_COLUMN_LENGTH = 120;
 var init_watcher = __esm(() => {
   init_sweep_guard();
 });
@@ -15105,7 +15258,7 @@ __export(exports_worktree_gc, {
 import { execFileSync as execFileSync8 } from "node:child_process";
 import { existsSync as existsSync5, readdirSync as readdirSync3, statSync as statSync3 } from "node:fs";
 import { resolve as resolve3 } from "node:path";
-import { cleanupWorktree as cleanupWorktree5, GIT_NO_HOOKS as GIT_NO_HOOKS9, log as log43 } from "@gethmy/harness";
+import { cleanupWorktree as cleanupWorktree5, GIT_NO_HOOKS as GIT_NO_HOOKS9, log as log44 } from "@gethmy/harness";
 function isTransientGitNetworkError(message) {
   return TRANSIENT_GIT_NETWORK_ERROR.test(message);
 }
@@ -15218,10 +15371,10 @@ function runWorktreeGc(basePath, store, opts = {}) {
     });
   } catch {}
   if (result.removed.length > 0) {
-    log43.info(TAG40, `GC removed ${result.removed.length} orphan worktree(s): ${result.removed.map((p) => p.split("/").pop()).join(", ")}`);
+    log44.info(TAG41, `GC removed ${result.removed.length} orphan worktree(s): ${result.removed.map((p) => p.split("/").pop()).join(", ")}`);
   }
   if (result.errors.length > 0) {
-    log43.warn(TAG40, `GC had ${result.errors.length} error(s): ${result.errors.map((e) => `${e.path}: ${e.error}`).join("; ")}`);
+    log44.warn(TAG41, `GC had ${result.errors.length} error(s): ${result.errors.map((e) => `${e.path}: ${e.error}`).join("; ")}`);
   }
   return result;
 }
@@ -15251,7 +15404,7 @@ function pruneFailedRemoteBranches(opts) {
   } catch (err) {
     const detail = gitErrorDetail2(err);
     if (isTransientGitNetworkError(detail)) {
-      log43.debug(TAG40, `Remote branch GC skipped — remote unreachable: ${detail}`);
+      log44.debug(TAG41, `Remote branch GC skipped — remote unreachable: ${detail}`);
       return result;
     }
     result.errors.push({ ref: "fetch", error: detail });
@@ -15291,7 +15444,7 @@ function pruneFailedRemoteBranches(opts) {
       continue;
     }
     if (clock() > sweepDeadline) {
-      log43.debug(TAG40, `Remote branch GC budget spent — removed ${result.removed.length}, remaining deferred to next tick`);
+      log44.debug(TAG41, `Remote branch GC budget spent — removed ${result.removed.length}, remaining deferred to next tick`);
       break;
     }
     try {
@@ -15304,17 +15457,17 @@ function pruneFailedRemoteBranches(opts) {
     } catch (err) {
       const detail = gitErrorDetail2(err);
       if (isTransientGitNetworkError(detail)) {
-        log43.debug(TAG40, `Remote branch GC interrupted — remote unreachable: ${detail}`);
+        log44.debug(TAG41, `Remote branch GC interrupted — remote unreachable: ${detail}`);
         break;
       }
       result.errors.push({ ref, error: detail });
     }
   }
   if (result.removed.length > 0) {
-    log43.info(TAG40, `Pruned ${result.removed.length} stale remote branch(es) under ${opts.prefix}: ${result.removed.join(", ")}`);
+    log44.info(TAG41, `Pruned ${result.removed.length} stale remote branch(es) under ${opts.prefix}: ${result.removed.join(", ")}`);
   }
   if (result.errors.length > 0) {
-    log43.warn(TAG40, `Remote branch GC had ${result.errors.length} error(s): ${result.errors.map((e) => `${e.ref}: ${e.error}`).join("; ")}`);
+    log44.warn(TAG41, `Remote branch GC had ${result.errors.length} error(s): ${result.errors.map((e) => `${e.ref}: ${e.error}`).join("; ")}`);
   }
   return result;
 }
@@ -15345,13 +15498,13 @@ class WorktreeGc {
     try {
       runWorktreeGc(this.basePath, this.store);
     } catch (err) {
-      log43.warn(TAG40, `GC tick failed: ${err instanceof Error ? err.message : err}`);
+      log44.warn(TAG41, `GC tick failed: ${err instanceof Error ? err.message : err}`);
     }
     if (this.remoteOpts) {
       try {
         pruneFailedRemoteBranches(this.remoteOpts);
       } catch (err) {
-        log43.warn(TAG40, `Remote GC tick failed: ${err instanceof Error ? err.message : err}`);
+        log44.warn(TAG41, `Remote GC tick failed: ${err instanceof Error ? err.message : err}`);
       }
     }
   }
@@ -15365,7 +15518,7 @@ function getRepoRoot2() {
     return null;
   }
 }
-var TAG40 = "worktree-gc", GIT_NETWORK_TIMEOUT_MS = 30000, GIT_SSH_CONNECT_TIMEOUT_SECS = 10, GIT_PRUNE_SWEEP_BUDGET_MS = 60000, GIT_NETWORK_EXEC, TRANSIENT_GIT_NETWORK_ERROR;
+var TAG41 = "worktree-gc", GIT_NETWORK_TIMEOUT_MS = 30000, GIT_SSH_CONNECT_TIMEOUT_SECS = 10, GIT_PRUNE_SWEEP_BUDGET_MS = 60000, GIT_NETWORK_EXEC, TRANSIENT_GIT_NETWORK_ERROR;
 var init_worktree_gc = __esm(() => {
   GIT_NETWORK_EXEC = {
     timeout: GIT_NETWORK_TIMEOUT_MS,
@@ -15404,7 +15557,7 @@ import { resolve as resolve4 } from "node:path";
 import {
   detectGitProvider as detectGitProvider6,
   GIT_NO_HOOKS as GIT_NO_HOOKS10,
-  log as log44,
+  log as log45,
   validateGitProviderCli
 } from "@gethmy/harness";
 async function validatePrerequisites(config, banner) {
@@ -15481,7 +15634,7 @@ async function main() {
   } catch (err) {
     if (err instanceof ConfigValidationError) {
       banner.fail();
-      log44.error(TAG41, err.message);
+      log45.error(TAG42, err.message);
       process.exit(1);
     }
     throw err;
@@ -15492,10 +15645,11 @@ async function main() {
     validateSweepConfig(config.agent);
     validateRankingConfig(config.agent);
     validateVerificationConfig(config.agent);
+    validateHttpConfig(config.agent);
   } catch (err) {
     if (err instanceof ConfigValidationError) {
       banner.fail();
-      log44.error(TAG41, err.message);
+      log45.error(TAG42, err.message);
       process.exit(1);
     }
     throw err;
@@ -15523,7 +15677,7 @@ async function main() {
       worktreePrefix: resolve4(config.repoRoot, config.agent.worktree.basePath)
     });
   } catch (err) {
-    log44.error(TAG41, `legacy state split failed — starting with the project store as-is: ${err instanceof Error ? err.message : err}`);
+    log45.error(TAG42, `legacy state split failed — starting with the project store as-is: ${err instanceof Error ? err.message : err}`);
   }
   const stateStore = StateStore.open({ projectId: config.projectId });
   const daemonId = randomUUID4();
@@ -15667,14 +15821,14 @@ async function main() {
     await handleBroadcast(event, client, pool, config, agentId);
   }, async (command) => {
     await pool.handleAgentCommand(command.cardId, command.command);
-  });
+  }, () => reconciler.onSweepCommandNudge());
   let shuttingDown = false;
   let exitCode = 0;
   const shutdown = async (signal) => {
     if (shuttingDown)
       return;
     shuttingDown = true;
-    log44.info(TAG41, `Received ${signal}, shutting down gracefully...`);
+    log45.info(TAG42, `Received ${signal}, shutting down gracefully...`);
     reconciler.stop();
     mergeMonitor?.stop();
     worktreeGc.stop();
@@ -15685,19 +15839,19 @@ async function main() {
     }
     await watcher.stop();
     await pool.shutdown();
-    log44.info(TAG41, "Daemon stopped.");
+    log45.info(TAG42, "Daemon stopped.");
     process.exit(exitCode);
   };
   process.on("SIGINT", () => shutdown("SIGINT"));
   process.on("SIGTERM", () => shutdown("SIGTERM"));
   process.on("SIGHUP", () => shutdown("SIGHUP"));
   process.on("uncaughtException", (err) => {
-    log44.error(TAG41, `Uncaught exception: ${err.message}`);
+    log45.error(TAG42, `Uncaught exception: ${err.message}`);
     exitCode = 1;
     shutdown("uncaughtException");
   });
   process.on("unhandledRejection", (reason) => {
-    log44.error(TAG41, `Unhandled rejection: ${reason instanceof Error ? reason.message : String(reason)}`);
+    log45.error(TAG42, `Unhandled rejection: ${reason instanceof Error ? reason.message : String(reason)}`);
     exitCode = 1;
     shutdown("unhandledRejection");
   });
@@ -15757,29 +15911,29 @@ async function handleBroadcast(event, client, pool, config, agentId) {
   if (assignedAgentId === undefined)
     return;
   if (assignedAgentId === agentId) {
-    log44.info(TAG41, `Broadcast: card ${cardId} assigned to agent`);
+    log45.info(TAG42, `Broadcast: card ${cardId} assigned to agent`);
     try {
       await pool.resetAttemptsForReassign(cardId);
       await tryEnqueueCard(cardId, client, pool, config, agentId);
     } catch (err) {
-      log44.error(TAG41, `Failed to process assignment: ${err instanceof Error ? err.message : err}`);
+      log45.error(TAG42, `Failed to process assignment: ${err instanceof Error ? err.message : err}`);
     }
   } else if (pool.isCardKnown(cardId)) {
-    log44.info(TAG41, `Broadcast: card ${cardId} unassigned from agent`);
+    log45.info(TAG42, `Broadcast: card ${cardId} unassigned from agent`);
     await pool.removeCard(cardId);
   }
 }
 async function tryEnqueueCard(cardId, client, pool, config, agentId) {
   const { card } = await client.getCard(cardId);
   if (card.assigned_agent_id !== agentId) {
-    log44.debug(TAG41, `Card ${cardId} no longer assigned to agent — skipping`);
+    log45.debug(TAG42, `Card ${cardId} no longer assigned to agent — skipping`);
     return;
   }
   const board = await client.getBoard(config.projectId, { summary: true });
   const columns = board.columns;
   const column = columns.find((c) => c.id === card.column_id);
   if (!column) {
-    log44.warn(TAG41, `Column not found for card ${cardId}`);
+    log45.warn(TAG42, `Column not found for card ${cardId}`);
     return;
   }
   const route = classifyPickup(card, column.name, {
@@ -15788,31 +15942,31 @@ async function tryEnqueueCard(cardId, client, pool, config, agentId) {
     playbooks: config.agent.playbooks
   });
   if (!route) {
-    log44.info(TAG41, `Card #${card.short_id} is in "${column.name}", not a pickup/review/stage column — skipping`);
+    log45.info(TAG42, `Card #${card.short_id} is in "${column.name}", not a pickup/review/stage column — skipping`);
     return;
   }
   if (route.stage) {
-    log44.info(TAG41, `Card #${card.short_id} is a playbook stage card (stage "${card.current_stage}") in "${column.name}" — routing to the stage executor (implement pool) regardless of column`);
+    log45.info(TAG42, `Card #${card.short_id} is a playbook stage card (stage "${card.current_stage}") in "${column.name}" — routing to the stage executor (implement pool) regardless of column`);
   }
   const mode = route.mode;
   const labelMap = buildLabelMap(board.labels ?? []);
   const cardLabels = resolveCardLabels(card, labelMap);
   const subtasks = card.subtasks ?? [];
   if (mode === "review" && config.agent.review.approvedLabel && hasLabel(cardLabels, config.agent.review.approvedLabel)) {
-    log44.debug(TAG41, `Card #${card.short_id} already has "${config.agent.review.approvedLabel}" — skipping review`);
+    log45.debug(TAG42, `Card #${card.short_id} already has "${config.agent.review.approvedLabel}" — skipping review`);
     return;
   }
   if (mode === "review" && hasLabel(cardLabels, NEED_REVIEW_LABEL)) {
-    log44.debug(TAG41, `Card #${card.short_id} has "${NEED_REVIEW_LABEL}" label (needs human) — skipping review`);
+    log45.debug(TAG42, `Card #${card.short_id} has "${NEED_REVIEW_LABEL}" label (needs human) — skipping review`);
     return;
   }
   if (mode === "review" && !qualifiesForAutoReview(card.description)) {
-    log44.info(TAG41, `Card #${card.short_id} has no branch or PR reference — skipping auto-review`);
+    log45.info(TAG42, `Card #${card.short_id} has no branch or PR reference — skipping auto-review`);
     return;
   }
   await pool.enqueue(card, column, cardLabels, subtasks, mode);
 }
-var TAG41 = "daemon", BASE_REMOTE = "origin", PKG_VERSION;
+var TAG42 = "daemon", BASE_REMOTE = "origin", PKG_VERSION;
 var init_src = __esm(() => {
   init_account_guard();
   init_account_probe();
@@ -16106,7 +16260,7 @@ var init_run_stats = () => {};
 // src/cli.ts
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { log as log45 } from "@gethmy/harness";
+import { log as log46 } from "@gethmy/harness";
 var USAGE = `
 Harmony Agent — push-based daemon + ops toolkit.
 
@@ -16150,12 +16304,12 @@ async function runDaemon() {
 }
 async function httpCall(path, init) {
   const { loadDaemonConfig: loadDaemonConfig2 } = await Promise.resolve().then(() => (init_config(), exports_config));
-  const { lookupDaemonPort: lookupDaemonPort2 } = await Promise.resolve().then(() => (init_port_registry(), exports_port_registry));
+  const { daemonBaseUrl: daemonBaseUrl2, lookupDaemonPort: lookupDaemonPort2 } = await Promise.resolve().then(() => (init_port_registry(), exports_port_registry));
   const cfg = loadDaemonConfig2();
   const recorded = lookupDaemonPort2(cfg.projectId);
   const bindAddr = recorded?.bindAddr ?? cfg.agent.http.bindAddr;
   const port = recorded?.port ?? cfg.agent.http.port;
-  const url = `http://${bindAddr}:${port}${path}`;
+  const url = `${daemonBaseUrl2(bindAddr, port)}${path}`;
   return fetch(url, init);
 }
 function formatAccount(account) {
@@ -16319,6 +16473,7 @@ async function doctorCommand() {
   const {
     validateAutoMergeConfig: validateAutoMergeConfig2,
     validateBudgetConfig: validateBudgetConfig2,
+    validateHttpConfig: validateHttpConfig2,
     validateRankingConfig: validateRankingConfig2,
     validateSweepConfig: validateSweepConfig2,
     validateVerificationConfig: validateVerificationConfig2
@@ -16333,6 +16488,7 @@ async function doctorCommand() {
     validateSweepConfig2(config.agent);
     validateRankingConfig2(config.agent);
     validateVerificationConfig2(config.agent);
+    validateHttpConfig2(config.agent);
     const banner = createStartupBanner2(config, version);
     const userId = await validatePrerequisites2(config, banner);
     await banner.ready(`preflight ok — agent user ${userId}`);
@@ -16755,7 +16911,7 @@ if (isMainModule()) {
     if (code !== 0)
       process.exit(code);
   }).catch((err) => {
-    log45.error("cli", err instanceof Error ? err.message : String(err));
+    log46.error("cli", err instanceof Error ? err.message : String(err));
     process.exit(1);
   });
 }