@hivefloor/cli 0.1.1 → 0.1.3

package/dist/{chunk-ZYRPQPGL.js → chunk-TH4ANHSG.js}

@@ -19786,14 +19786,21 @@ var hookEventSchema = external_exports.object({
   model: external_exports.string().min(1).max(200).optional(),
   repo: repoInfoSchema.optional(),
   /** ISO time on the client; display only (the server clock decides). */
-  client_at: external_exports.iso.datetime({ offset: true })
+  client_at: external_exports.iso.datetime({ offset: true }),
+  /** The CLI sets it on the event it posts for a hook whose output the tool reads as context (Claude's UserPromptSubmit and the like): only then does the answer carry the session's pending nudges. */
+  deliver: external_exports.boolean().optional()
 });
 var hookBatchSchema = external_exports.object({ events: external_exports.array(hookEventSchema).min(1).max(HOOK_BATCH_MAX) });
 var hookBatchResponseSchema = external_exports.object({
   accepted: external_exports.number().int().nonnegative(),
-  dropped: external_exports.number().int().nonnegative()
+  dropped: external_exports.number().int().nonnegative(),
+  /** F2: nudges a person sent to the sessions of a `deliver` event, by the tool's own session id. The runner prints the text as the hook's `additionalContext`. */
+  nudges: external_exports.array(external_exports.object({ session_id: external_exports.string(), text: external_exports.string() })).optional()
 });
 
+// ../shared/src/machine-health.ts
+var MACHINE_HEALTH_RULES = ["offline_with_claims", "disk_full", "disk_high", "memory_high", "cli_behind"];
+
 // ../shared/src/api/projects.ts
 var idSchema = external_exports.string().regex(/^[0-9]{1,15}$/, "must be a numeric id");
 var projectNameSchema = external_exports.string().trim().min(1).max(100);
@@ -19964,6 +19971,10 @@ var machineAgentSchema = external_exports.object({
   live_sessions: external_exports.number().int().nonnegative(),
   last_seen_at: external_exports.string().nullable()
 });
+var machineHealthViewSchema = external_exports.object({
+  level: external_exports.enum(["warn", "critical"]),
+  findings: external_exports.array(external_exports.object({ rule: external_exports.enum(MACHINE_HEALTH_RULES), level: external_exports.enum(["warn", "critical"]), text: external_exports.string() }))
+});
 var machineSchema = external_exports.object({
   id: external_exports.string(),
   name: external_exports.string(),
@@ -19975,7 +19986,9 @@ var machineSchema = external_exports.object({
   default_project_id: external_exports.string().nullable(),
   projects: external_exports.array(external_exports.object({ id: external_exports.string(), key: external_exports.string(), name: external_exports.string(), default: external_exports.boolean() })),
   stats: machineStatsSchema.nullable(),
-  agents: external_exports.array(machineAgentSchema)
+  agents: external_exports.array(machineAgentSchema),
+  /** The rules that fire for this machine; null or absent when healthy (older servers omit it). */
+  health: machineHealthViewSchema.nullable().optional()
 });
 var patchMachineBody = external_exports.object({
   name: external_exports.string().trim().min(1).max(100).optional(),
@@ -19995,121 +20008,44 @@ function cliNpxCommand(args = "", opts = {}) {
 }
 var CLI_CONNECT_COMMAND = cliNpxCommand("connect");
 
-// ../shared/src/task-status.ts
-var TASK_STATUSES = ["backlog", "ready", "claimed", "in_review", "done", "blocked", "parked"];
-var taskStatusSchema = external_exports.enum(TASK_STATUSES);
-
-// ../shared/src/remote.ts
-var SCHEME = /^([a-z][a-z0-9+.-]*):\/\//i;
-function normalizeRemote(remote) {
-  let s = remote.trim();
-  if (!s || s.length > 2048 || /[\s\0]/.test(s)) return null;
-  let host2;
-  let path;
-  if (SCHEME.test(s)) {
-    s = s.replace(SCHEME, "");
-    const slash = s.indexOf("/");
-    if (slash < 0) return null;
-    host2 = s.slice(0, slash);
-    path = s.slice(slash + 1);
-  } else {
-    const colon = s.indexOf(":");
-    const slash = s.indexOf("/");
-    if (colon >= 0 && (slash < 0 || colon < slash)) {
-      host2 = s.slice(0, colon);
-      path = s.slice(colon + 1);
-    } else if (slash >= 0) {
-      host2 = s.slice(0, slash);
-      path = s.slice(slash + 1);
-    } else {
-      return null;
-    }
-  }
-  const at = host2.lastIndexOf("@");
-  if (at >= 0) host2 = host2.slice(at + 1);
-  host2 = host2.replace(/:\d*$/, "").toLowerCase();
-  if (!/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/.test(host2)) return null;
-  path = path.replace(/[?#].*$/, "");
-  const parts = path.split("/").filter((p) => p.length > 0);
-  if (parts.length < 2) return null;
-  let name = parts[parts.length - 1];
-  if (name.toLowerCase().endsWith(".git")) name = name.slice(0, -4);
-  const ownerParts = parts.slice(0, -1);
-  if (!name || [...ownerParts, name].some((p) => p === "." || p === ".." || !/^[A-Za-z0-9_.@+-]+$/.test(p))) return null;
-  return { host: host2, owner: ownerParts.join("/"), name };
-}
-function formatRemote(r) {
-  return `${r.host}/${r.owner}/${r.name}`;
-}
-
-// ../shared/src/redact.ts
-var tag = (kind) => `[redacted:${kind}]`;
-function isPlaceholder(value) {
-  const v = value.replace(/^["']|["']$/g, "");
-  return v === "" || /^(\$|<|\{|%|\*+$|x+$|\.\.\.|\[redacted)/i.test(v) || /^(process\.env|os\.environ|env\.|ENV\[|config\.|settings\.)/i.test(v) || /^(null|none|undefined|true|false|changeme|example|your[_-])/i.test(v);
-}
-var KEY_PREFIX = String.raw`(?<![A-Za-z0-9])`;
-var VALUE = String.raw`("[^"\r\n]*"|'[^'\r\n]*'|[^\s,;"'&)}\]]+)`;
-var RULES = [
-  { kind: "pem", re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/g },
-  { kind: "github", re: /\bgithub_pat_[A-Za-z0-9_]{20,}/g },
-  { kind: "github", re: /\bgh[pousr]_[A-Za-z0-9]{20,}/g },
-  { kind: "anthropic", re: /\bsk-ant-[A-Za-z0-9_-]{10,}/g },
-  // sk- keys are random base62; the digit lookahead keeps hyphenated words ("sk-learn-compatible-...") out.
-  { kind: "openai", re: /\bsk-(?=[A-Za-z0-9_-]*\d)[A-Za-z0-9_-]{20,}/g },
-  { kind: "aws", re: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g },
-  { kind: "slack", re: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g },
-  // hf_ tokens are 32 random bytes in base64url: long, with a digit or capital. Snake_case identifiers have neither.
-  { kind: "hivefloor", re: /\bhf_(?=[A-Za-z0-9_-]*[A-Z0-9])[A-Za-z0-9_-]{32,}/g },
-  // A fleet push token (hff_ + 32 random bytes) or machine token (hfm_ + 32 random bytes): must never end up in a status line or a title.
-  { kind: "hivefloor", re: /\bhf[fm]_[A-Za-z0-9_-]{20,}/g },
-  { kind: "webhook", re: /\bwhsec_[A-Za-z0-9_-]{16,}/g },
-  { kind: "vqb", re: /\bvqb_[A-Za-z0-9_-]{16,}/g },
-  { kind: "jwt", re: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g },
-  {
-    kind: "bearer",
-    re: /\b(Bearer)\s+(?=[A-Za-z0-9._~+/=-]*\d)[A-Za-z0-9._~+/=-]{20,}/g,
-    replace: (_m, word) => `${word} ${tag("bearer")}`
-  },
-  // password=hunter2, "passwd": "x", DB_PASSWORD='x'. Any non-placeholder value counts.
-  {
-    kind: "password",
-    re: new RegExp(String.raw`${KEY_PREFIX}(password|passwd|pwd)(["']?\s*[:=]\s*)${VALUE}`, "gi"),
-    replace: (m, _key, sep = "", value = "") => isAssignedSecret(sep, value, 1) ? `${m.slice(0, m.length - value.length)}${tag("password")}` : null
-  },
-  // token=..., client_secret: ..., api_key=...: the value has to be long enough to be a credential.
-  {
-    kind: "secret",
-    re: new RegExp(String.raw`${KEY_PREFIX}(secret|token|api[_-]?key|apikey)(["']?\s*[:=]\s*)${VALUE}`, "gi"),
-    replace: (m, _key, sep = "", value = "") => isAssignedSecret(sep, value, 8) ? `${m.slice(0, m.length - value.length)}${tag("secret")}` : null
-  }
-];
-function isAssignedSecret(sep, value, minLen) {
-  if (isPlaceholder(value)) return false;
-  const quoted = /^["']/.test(value);
-  const v = value.replace(/^["']|["']$/g, "");
-  if (v.length < minLen) return false;
-  if (sep.includes("=") || quoted) return true;
-  return v.length >= 6 && /[^A-Za-z]/.test(v);
+// ../shared/src/usage.ts
+var MIN_SPAN_MS = 5 * 6e4;
+var MAX_ETA_MS = 31 * 24 * 36e5;
+var USAGE_COUNTERS = ["tokens_in", "tokens_out", "cost_usd"];
+function isUsageCounter(value) {
+  return USAGE_COUNTERS.includes(value);
 }
-function redact(input2) {
-  let text2 = input2;
-  let count = 0;
-  for (const rule of RULES) {
-    text2 = text2.replace(rule.re, (...args) => {
-      const match = args[0];
-      const groups = args.slice(1, -2).filter((g) => typeof g === "string");
-      const out = rule.replace ? rule.replace(match, ...groups) : tag(rule.kind);
-      if (out === null) return match;
-      count += 1;
-      return out;
-    });
+function parseUsageKey(key2) {
+  const parts = key2.split(":");
+  if (parts.length < 3) return null;
+  const tool = parts[0];
+  const profile = parts[1];
+  if (!TOOLS.includes(tool)) return null;
+  if (!PROFILE_KEY_RE.test(profile)) return null;
+  if (parts.length === 3) {
+    const counter2 = parts[2];
+    return isUsageCounter(counter2) ? { tool, profile, session: null, counter: counter2 } : null;
   }
-  return { text: text2, count };
+  if (parts[2] !== "s" || parts.length < 5) return null;
+  const session = parts.slice(3, -1).join(":");
+  const counter = parts[parts.length - 1];
+  if (!session || !isUsageCounter(counter)) return null;
+  return { tool, profile, session, counter };
 }
 
+// ../shared/src/usage-alerts.ts
+var WASTE_WITHIN_MS = 3 * 36e5;
+
+// ../shared/src/task-status.ts
+var TASK_STATUSES = ["backlog", "ready", "claimed", "in_review", "done", "blocked", "parked"];
+var taskStatusSchema = external_exports.enum(TASK_STATUSES);
+
 // ../shared/src/health.ts
-var SESSION_HEALTH = ["ok", "stalled", "lost", "looping"];
+var PARKED_AFTER_SEC = 20 * 60;
+var WAITING_LONG_AFTER_SEC = 15 * 60;
+var MIN_STALL_THRESHOLD_SEC = 60;
+var MAX_STALL_THRESHOLD_SEC = 7 * 24 * 3600;
+var SESSION_HEALTH = ["ok", "stalled", "lost", "looping", "parked", "waiting_long"];
 
 // ../shared/src/api/rules.ts
 var entityId = external_exports.string().regex(/^\d{1,20}$/, "an id is a decimal string");
@@ -20134,6 +20070,10 @@ var rulesConfigSchema = external_exports.object({
   wip_per_agent: cap,
   wip_per_machine: cap,
   stall_release_seconds: external_exports.number().int().min(MIN_STALL_RELEASE_SECONDS).max(MAX_STALL_RELEASE_SECONDS).nullable(),
+  /** Seconds an idle session holds a claim before it shows as parked (default 20 min); null or omitted = default. An omitted field keeps what is stored. */
+  parked_after_seconds: external_exports.number().int().min(MIN_STALL_THRESHOLD_SEC).max(MAX_STALL_THRESHOLD_SEC).nullable().optional(),
+  /** Seconds a wait on a person lasts before it shows as waiting_long and the owner is pushed again (default 15 min); the admins hear at 4 times this. */
+  waiting_long_after_seconds: external_exports.number().int().min(MIN_STALL_THRESHOLD_SEC).max(MAX_STALL_THRESHOLD_SEC).nullable().optional(),
   rules: external_exports.array(ruleSchema).max(MAX_RULES).refine((rs) => new Set(rs.map((r) => r.id)).size === rs.length, "rule ids must be unique")
 }).strict();
 var steerBody = external_exports.object({
@@ -20204,9 +20144,11 @@ var taskCardSchema = external_exports.object({
   done_at: isoTimeSchema.nullable(),
   archived_at: isoTimeSchema.nullable(),
   /** Tasks this one waits on (stage 2). It is claimable only when every one of them is done. */
-  blocked_by: external_exports.array(blockerRefSchema).default([])
+  blocked_by: external_exports.array(blockerRefSchema).default([]),
+  /** A claimed task whose holder's machine is offline: the work may be stuck there. Absent or false otherwise. */
+  at_risk: external_exports.boolean().optional()
 });
-var TASK_TIMELINE_KINDS = ["created", "claimed", "note", "blocked", "released", "lease_expired", "pr", "in_review", "done", "answered", "archived", "unarchived", "unblocked", "steered"];
+var TASK_TIMELINE_KINDS = ["created", "claimed", "note", "blocked", "released", "lease_expired", "pr", "in_review", "done", "answered", "archived", "unarchived", "unblocked", "steered", "nudged"];
 var taskTimelineKindSchema = external_exports.enum(TASK_TIMELINE_KINDS);
 var taskTimelineEventSchema = external_exports.object({
   id: entityIdSchema,
@@ -20264,7 +20206,7 @@ var taskStatusLineQuerySchema = external_exports.object({
 }).strict();
 var taskResultSchema = external_exports.object({ task: taskCardSchema });
 var answerBodySchema = external_exports.object({ text: external_exports.string().trim().min(1).max(500) });
-var NOTIFICATION_KINDS = ["task_done", "task_blocked", "agent_waiting", "invite_received", "member_added", "repo_link_requested", "agent_question", "feedback"];
+var NOTIFICATION_KINDS = ["task_done", "task_blocked", "agent_waiting", "invite_received", "member_added", "repo_link_requested", "agent_question", "feedback", "usage_waste", "usage_high", "wait_escalated", "machine_unhealthy"];
 var notificationKindSchema = external_exports.enum(NOTIFICATION_KINDS);
 var notificationViewSchema = external_exports.object({
   id: entityIdSchema,
@@ -20357,50 +20299,6 @@ var releaseBody = external_exports.object({
 }).strict();
 var completeBody = external_exports.object({ claim_token: claimToken.optional(), summary: external_exports.string().min(1).max(5e3), pr_url: external_exports.string().max(1e3).optional(), session: sessionRef.optional() }).strict();
 
-// ../shared/src/api/memory.ts
-var CONTEXT_DECISIONS = 10;
-var MEMORY_KINDS = ["handoff", "decision"];
-var memoryKindSchema = external_exports.enum(MEMORY_KINDS);
-var memoryEntrySchema = external_exports.object({
-  id: entityIdSchema,
-  kind: memoryKindSchema,
-  /** The task the entry is about; always set for a handoff. */
-  task_id: entityIdSchema.nullable(),
-  /** The task as people write it (`HF-12`). */
-  task_key: external_exports.string().nullable(),
-  text: external_exports.string(),
-  author: external_exports.object({ type: external_exports.enum(["agent", "user", "system"]), name: external_exports.string() }),
-  created_at: isoTimeSchema
-});
-var memoryContextSchema = external_exports.object({
-  handoff: memoryEntrySchema.nullable(),
-  decisions: external_exports.array(memoryEntrySchema).max(CONTEXT_DECISIONS)
-});
-var memoryListSchema = external_exports.object({
-  items: external_exports.array(memoryEntrySchema),
-  next_cursor: external_exports.string().nullable()
-});
-var taskIdSchema2 = external_exports.union([external_exports.string().regex(/^[0-9]{1,15}$/), external_exports.number().int().positive()]).transform((v) => String(v));
-var sessionRef2 = external_exports.string().trim().min(1).max(200);
-var addDecisionBody = external_exports.object({
-  project: projectRefSchema.optional(),
-  /** The task the decision is about (optional). */
-  task_id: taskIdSchema2.optional(),
-  text: external_exports.string().min(1).max(2e3),
-  session: sessionRef2.optional()
-}).strict();
-var getContextBody = external_exports.object({
-  project: projectRefSchema.optional(),
-  /** The task whose last handoff to include. */
-  task_id: taskIdSchema2.optional()
-}).strict();
-var humanDecisionBody = external_exports.object({
-  text: external_exports.string().trim().min(1).max(2e3),
-  /** The task number (not the id) the decision is about. */
-  task_num: external_exports.number().int().positive().max(2e9).optional()
-}).strict();
-var decisionResultSchema = external_exports.object({ entry: memoryEntrySchema });
-
 // ../shared/src/api/usage.ts
 var isoTime = external_exports.iso.datetime({ offset: true });
 var USAGE_PROVIDERS = [
@@ -20522,6 +20420,210 @@ var taskUsageSchema = external_exports.object({
   agents: external_exports.array(taskUsageAgentSchema).max(50)
 }).strict();
 
+// ../shared/src/usage-route.ts
+var ROUTE_HORIZON_MS = 2 * 36e5;
+function usageProviderForTool(tool) {
+  switch (tool) {
+    case "claude":
+    case "codex":
+    case "cursor":
+    case "gemini":
+    case "grok":
+      return tool;
+    default:
+      return null;
+  }
+}
+function routeProviderFromParam(param) {
+  const v = param.trim().toLowerCase();
+  const fromTool = usageProviderForTool(v);
+  if (fromTool) return fromTool;
+  const p = usageProviderSchema.safeParse(v);
+  return p.success ? p.data : null;
+}
+var isoTime2 = external_exports.iso.datetime({ offset: true });
+var routeAccountSchema = external_exports.object({
+  id: external_exports.string().max(120),
+  label: external_exports.string().max(60),
+  plan: external_exports.string().max(40).optional(),
+  usable: external_exports.boolean(),
+  score: external_exports.number().nullable(),
+  window: external_exports.string().max(40).optional(),
+  percent_left: external_exports.number().min(0).max(100).optional(),
+  resets_at: isoTime2.optional(),
+  live_sessions: external_exports.number().int().nonnegative(),
+  waste: external_exports.boolean(),
+  reason: external_exports.string().max(200)
+}).strict();
+var routeProviderSchema = external_exports.object({
+  provider: usageProviderSchema,
+  name: external_exports.string().max(40),
+  /** The account to use next: the first of `accounts` when it is usable, else null. */
+  best: external_exports.string().max(120).nullable(),
+  accounts: external_exports.array(routeAccountSchema).max(100)
+}).strict();
+var usageRouteSchema = external_exports.object({
+  generated_at: isoTime2,
+  /** The provider asked for, or null for all of them. */
+  provider: usageProviderSchema.nullable(),
+  providers: external_exports.array(routeProviderSchema).max(USAGE_PROVIDERS.length),
+  /** Live sessions that could not be counted against an account (no label, unknown label, a tool with no usage). */
+  unlinked_sessions: external_exports.number().int().nonnegative()
+}).strict();
+
+// ../shared/src/remote.ts
+var SCHEME = /^([a-z][a-z0-9+.-]*):\/\//i;
+function normalizeRemote(remote) {
+  let s = remote.trim();
+  if (!s || s.length > 2048 || /[\s\0]/.test(s)) return null;
+  let host2;
+  let path;
+  if (SCHEME.test(s)) {
+    s = s.replace(SCHEME, "");
+    const slash = s.indexOf("/");
+    if (slash < 0) return null;
+    host2 = s.slice(0, slash);
+    path = s.slice(slash + 1);
+  } else {
+    const colon = s.indexOf(":");
+    const slash = s.indexOf("/");
+    if (colon >= 0 && (slash < 0 || colon < slash)) {
+      host2 = s.slice(0, colon);
+      path = s.slice(colon + 1);
+    } else if (slash >= 0) {
+      host2 = s.slice(0, slash);
+      path = s.slice(slash + 1);
+    } else {
+      return null;
+    }
+  }
+  const at = host2.lastIndexOf("@");
+  if (at >= 0) host2 = host2.slice(at + 1);
+  host2 = host2.replace(/:\d*$/, "").toLowerCase();
+  if (!/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/.test(host2)) return null;
+  path = path.replace(/[?#].*$/, "");
+  const parts = path.split("/").filter((p) => p.length > 0);
+  if (parts.length < 2) return null;
+  let name = parts[parts.length - 1];
+  if (name.toLowerCase().endsWith(".git")) name = name.slice(0, -4);
+  const ownerParts = parts.slice(0, -1);
+  if (!name || [...ownerParts, name].some((p) => p === "." || p === ".." || !/^[A-Za-z0-9_.@+-]+$/.test(p))) return null;
+  return { host: host2, owner: ownerParts.join("/"), name };
+}
+function formatRemote(r) {
+  return `${r.host}/${r.owner}/${r.name}`;
+}
+
+// ../shared/src/redact.ts
+var tag = (kind) => `[redacted:${kind}]`;
+function isPlaceholder(value) {
+  const v = value.replace(/^["']|["']$/g, "");
+  return v === "" || /^(\$|<|\{|%|\*+$|x+$|\.\.\.|\[redacted)/i.test(v) || /^(process\.env|os\.environ|env\.|ENV\[|config\.|settings\.)/i.test(v) || /^(null|none|undefined|true|false|changeme|example|your[_-])/i.test(v);
+}
+var KEY_PREFIX = String.raw`(?<![A-Za-z0-9])`;
+var VALUE = String.raw`("[^"\r\n]*"|'[^'\r\n]*'|[^\s,;"'&)}\]]+)`;
+var RULES = [
+  { kind: "pem", re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/g },
+  { kind: "github", re: /\bgithub_pat_[A-Za-z0-9_]{20,}/g },
+  { kind: "github", re: /\bgh[pousr]_[A-Za-z0-9]{20,}/g },
+  { kind: "anthropic", re: /\bsk-ant-[A-Za-z0-9_-]{10,}/g },
+  // sk- keys are random base62; the digit lookahead keeps hyphenated words ("sk-learn-compatible-...") out.
+  { kind: "openai", re: /\bsk-(?=[A-Za-z0-9_-]*\d)[A-Za-z0-9_-]{20,}/g },
+  { kind: "aws", re: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g },
+  { kind: "slack", re: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g },
+  // hf_ tokens are 32 random bytes in base64url: long, with a digit or capital. Snake_case identifiers have neither.
+  { kind: "hivefloor", re: /\bhf_(?=[A-Za-z0-9_-]*[A-Z0-9])[A-Za-z0-9_-]{32,}/g },
+  // A fleet push token (hff_ + 32 random bytes) or machine token (hfm_ + 32 random bytes): must never end up in a status line or a title.
+  { kind: "hivefloor", re: /\bhf[fm]_[A-Za-z0-9_-]{20,}/g },
+  { kind: "webhook", re: /\bwhsec_[A-Za-z0-9_-]{16,}/g },
+  { kind: "vqb", re: /\bvqb_[A-Za-z0-9_-]{16,}/g },
+  { kind: "jwt", re: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g },
+  {
+    kind: "bearer",
+    re: /\b(Bearer)\s+(?=[A-Za-z0-9._~+/=-]*\d)[A-Za-z0-9._~+/=-]{20,}/g,
+    replace: (_m, word) => `${word} ${tag("bearer")}`
+  },
+  // password=hunter2, "passwd": "x", DB_PASSWORD='x'. Any non-placeholder value counts.
+  {
+    kind: "password",
+    re: new RegExp(String.raw`${KEY_PREFIX}(password|passwd|pwd)(["']?\s*[:=]\s*)${VALUE}`, "gi"),
+    replace: (m, _key, sep = "", value = "") => isAssignedSecret(sep, value, 1) ? `${m.slice(0, m.length - value.length)}${tag("password")}` : null
+  },
+  // token=..., client_secret: ..., api_key=...: the value has to be long enough to be a credential.
+  {
+    kind: "secret",
+    re: new RegExp(String.raw`${KEY_PREFIX}(secret|token|api[_-]?key|apikey)(["']?\s*[:=]\s*)${VALUE}`, "gi"),
+    replace: (m, _key, sep = "", value = "") => isAssignedSecret(sep, value, 8) ? `${m.slice(0, m.length - value.length)}${tag("secret")}` : null
+  }
+];
+function isAssignedSecret(sep, value, minLen) {
+  if (isPlaceholder(value)) return false;
+  const quoted = /^["']/.test(value);
+  const v = value.replace(/^["']|["']$/g, "");
+  if (v.length < minLen) return false;
+  if (sep.includes("=") || quoted) return true;
+  return v.length >= 6 && /[^A-Za-z]/.test(v);
+}
+function redact(input2) {
+  let text2 = input2;
+  let count = 0;
+  for (const rule of RULES) {
+    text2 = text2.replace(rule.re, (...args) => {
+      const match = args[0];
+      const groups = args.slice(1, -2).filter((g) => typeof g === "string");
+      const out = rule.replace ? rule.replace(match, ...groups) : tag(rule.kind);
+      if (out === null) return match;
+      count += 1;
+      return out;
+    });
+  }
+  return { text: text2, count };
+}
+
+// ../shared/src/api/memory.ts
+var CONTEXT_DECISIONS = 10;
+var MEMORY_KINDS = ["handoff", "decision"];
+var memoryKindSchema = external_exports.enum(MEMORY_KINDS);
+var memoryEntrySchema = external_exports.object({
+  id: entityIdSchema,
+  kind: memoryKindSchema,
+  /** The task the entry is about; always set for a handoff. */
+  task_id: entityIdSchema.nullable(),
+  /** The task as people write it (`HF-12`). */
+  task_key: external_exports.string().nullable(),
+  text: external_exports.string(),
+  author: external_exports.object({ type: external_exports.enum(["agent", "user", "system"]), name: external_exports.string() }),
+  created_at: isoTimeSchema
+});
+var memoryContextSchema = external_exports.object({
+  handoff: memoryEntrySchema.nullable(),
+  decisions: external_exports.array(memoryEntrySchema).max(CONTEXT_DECISIONS)
+});
+var memoryListSchema = external_exports.object({
+  items: external_exports.array(memoryEntrySchema),
+  next_cursor: external_exports.string().nullable()
+});
+var taskIdSchema2 = external_exports.union([external_exports.string().regex(/^[0-9]{1,15}$/), external_exports.number().int().positive()]).transform((v) => String(v));
+var sessionRef2 = external_exports.string().trim().min(1).max(200);
+var addDecisionBody = external_exports.object({
+  project: projectRefSchema.optional(),
+  /** The task the decision is about (optional). */
+  task_id: taskIdSchema2.optional(),
+  text: external_exports.string().min(1).max(2e3),
+  session: sessionRef2.optional()
+}).strict();
+var getContextBody = external_exports.object({
+  project: projectRefSchema.optional(),
+  /** The task whose last handoff to include. */
+  task_id: taskIdSchema2.optional()
+}).strict();
+var humanDecisionBody = external_exports.object({
+  text: external_exports.string().trim().min(1).max(2e3),
+  /** The task number (not the id) the decision is about. */
+  task_num: external_exports.number().int().positive().max(2e9).optional()
+}).strict();
+var decisionResultSchema = external_exports.object({ entry: memoryEntrySchema });
+
 // ../shared/src/api/floor.ts
 var FLOOR_TOOLS = ["claude", "codex", "cursor", "gemini", "grok", "other"];
 var floorToolSchema = external_exports.enum(FLOOR_TOOLS);
@@ -20549,8 +20651,12 @@ var floorSessionSchema = external_exports.object({
   agent_id: entityIdSchema,
   parent_id: entityIdSchema.nullable(),
   state: floorSessionStateSchema,
-  /** Derived from the clock (`stalled`: a working session gone quiet; `lost`: a subagent that never reported done; `looping`: the same error repeating, or no status change while the claim keeps being extended). See `sessionHealth`. */
+  /** Derived from the clock (`stalled`: a working session gone quiet; `lost`: a subagent that never reported done; `looping`: the same error repeating, or no status change while the claim keeps being extended; `parked`: idle for a while holding a claim; `waiting_long`: waiting on a person past the threshold). See `sessionHealth`. */
   health: external_exports.enum(SESSION_HEALTH),
+  /** When the state or status line last changed: the start of the current wait or park (age labels count from it). Older servers omit it; use `last_event_at`. */
+  state_since: isoTimeSchema.optional(),
+  /** For a `waiting` session: false once somebody answered this very wait. Older servers omit it (read as true). */
+  wait_open: external_exports.boolean().optional(),
   /** The tool's own session id (what `claude --resume` takes), main sessions only. */
   tool_session_id: external_exports.string().nullable(),
   model: external_exports.string().nullable(),
@@ -20578,7 +20684,15 @@ var floorPodSchema = external_exports.object({
   agents: external_exports.array(external_exports.object({ agent: floorAgentSchema, sessions: external_exports.array(floorSessionSchema) }))
 });
 var floorSnapshotSchema = external_exports.object({
-  project: external_exports.object({ id: entityIdSchema, key: external_exports.string(), name: external_exports.string() }),
+  project: external_exports.object({
+    id: entityIdSchema,
+    key: external_exports.string(),
+    name: external_exports.string(),
+    /** The project's thresholds for parked and waiting_long, seconds (the defaults when it sets none). The browser judges health with them. */
+    stall: external_exports.object({ parked_after_sec: external_exports.number(), waiting_long_after_sec: external_exports.number() }).optional(),
+    /** Health of the machines this project's agents run on, by machine name; only machines with something to report. Older servers omit it. */
+    machine_health: external_exports.record(external_exports.string(), machineHealthViewSchema).optional()
+  }),
   pods: external_exports.array(floorPodSchema),
   shelves: external_exports.object({
     /** Every ready task, most urgent first (at most 200). */
@@ -20715,6 +20829,8 @@ var projectAgentSchema = external_exports.object({
   ...agentBaseShape,
   /** True when the signed-in person owns the agent (they may revoke it even as a viewer). */
   mine: external_exports.boolean(),
+  /** The tool profile (the AI account) the agent runs under, when known; older servers omit it. */
+  profile: external_exports.string().nullable().optional(),
   sessions: external_exports.array(floorSessionSchema)
 });
 var projectAgentList = listOf(projectAgentSchema);
@@ -20737,7 +20853,7 @@ var LOOP_NO_CHANGE_SEC = 30 * 60;
 var LOOP_LEASE_FRESH_SEC = 5 * 60;
 
 // ../shared/src/api/webhooks.ts
-var WEBHOOK_EVENTS = ["needs_you", "task_done", "agent_lost"];
+var WEBHOOK_EVENTS = ["needs_you", "task_done", "agent_lost", "usage_waste", "usage_high", "machine_unhealthy"];
 var webhookEventSchema = external_exports.enum(WEBHOOK_EVENTS);
 var putWebhookBody = external_exports.object({
   url: external_exports.string().trim().min(1).max(2048),
@@ -20762,31 +20878,6 @@ var webhookGetResponse = external_exports.object({ webhook: webhookViewSchema.nu
 var webhookPutResponse = external_exports.object({ webhook: webhookViewSchema, secret: external_exports.string().optional() }).strict();
 var webhookTestResponse = external_exports.object({ ok: external_exports.literal(true), queued: external_exports.literal(true) }).strict();
 
-// ../shared/src/usage.ts
-var MIN_SPAN_MS = 5 * 6e4;
-var MAX_ETA_MS = 31 * 24 * 36e5;
-var USAGE_COUNTERS = ["tokens_in", "tokens_out", "cost_usd"];
-function isUsageCounter(value) {
-  return USAGE_COUNTERS.includes(value);
-}
-function parseUsageKey(key2) {
-  const parts = key2.split(":");
-  if (parts.length < 3) return null;
-  const tool = parts[0];
-  const profile = parts[1];
-  if (!TOOLS.includes(tool)) return null;
-  if (!PROFILE_KEY_RE.test(profile)) return null;
-  if (parts.length === 3) {
-    const counter2 = parts[2];
-    return isUsageCounter(counter2) ? { tool, profile, session: null, counter: counter2 } : null;
-  }
-  if (parts[2] !== "s" || parts.length < 5) return null;
-  const session = parts.slice(3, -1).join(":");
-  const counter = parts[parts.length - 1];
-  if (!session || !isUsageCounter(counter)) return null;
-  return { tool, profile, session, counter };
-}
-
 // ../shared/src/api/inbox.ts
 var INBOX_KINDS = ["blocked_task", "waiting", "question"];
 var inboxKindSchema = external_exports.enum(INBOX_KINDS);
@@ -20801,7 +20892,9 @@ var inboxItemSchema = external_exports.object({
   text: external_exports.string(),
   waiting_since: isoTimeSchema,
   /** Whether the caller may answer it (role, the project's answer setting, and for a member: owning the agent). */
-  can_answer: external_exports.boolean()
+  can_answer: external_exports.boolean(),
+  /** Whether the caller may nudge the item's session now (F2): owner or admin, and the session is stalled, parked, waiting too long or looping. */
+  can_nudge: external_exports.boolean().optional()
 });
 var inboxListSchema = external_exports.object({
   items: external_exports.array(inboxItemSchema),
@@ -21089,6 +21182,31 @@ var digestAgentItemSchema = external_exports.object({
   /** A short-lived run agent (a mirrored fleet/vq lane, or named `*-run-*` / `vq-*`). */
   is_run: external_exports.boolean()
 }).strict();
+var digestWaitItemSchema = external_exports.object({
+  session_id: idSchema,
+  project_id: idSchema,
+  project_key: external_exports.string(),
+  agent_name: external_exports.string(),
+  machine: external_exports.string().nullable(),
+  /** `waiting` = a wait on a person (or blocked); `parked` = idle while holding a claimed task. */
+  kind: external_exports.enum(["waiting", "parked"]),
+  /** How long the wait has lasted so far (whole seconds). */
+  seconds: external_exports.number().int().nonnegative(),
+  /** Always true today: only waits still open are known (no state history is kept). */
+  open: external_exports.boolean()
+}).strict();
+var digestLostTimeSchema = external_exports.object({
+  waiting_hours: external_exports.number().nonnegative(),
+  parked_hours: external_exports.number().nonnegative(),
+  longest_waits: external_exports.array(digestWaitItemSchema).max(3)
+}).strict();
+var digestWastedAccountSchema = external_exports.object({ account: external_exports.string(), unused_points: external_exports.number().nonnegative(), resets: external_exports.number().int().positive() }).strict();
+var digestQuotaSchema = external_exports.object({
+  wasted_points: external_exports.number().nonnegative(),
+  accounts: external_exports.array(digestWastedAccountSchema).max(DIGEST_ITEMS_LIMIT),
+  alerts_waste: external_exports.number().int().nonnegative(),
+  alerts_high: external_exports.number().int().nonnegative()
+}).strict();
 var digestBucketSchema = (item) => external_exports.object({
   count: external_exports.number().int().nonnegative(),
   items: external_exports.array(item).max(DIGEST_ITEMS_LIMIT)
@@ -21112,7 +21230,11 @@ var meDigestResponseSchema = external_exports.object({
   prs_merged: digestBucketSchema(digestTaskItemSchema),
   tasks_blocked: digestBucketSchema(digestTaskItemSchema),
   needs_you: digestBucketSchema(digestNeedsYouItemSchema),
-  new_agents: digestBucketSchema(digestAgentItemSchema)
+  new_agents: digestBucketSchema(digestAgentItemSchema),
+  /** F7. `total` also counts one for each of `lost_time` and `quota` that has something to show. */
+  lost_time: digestLostTimeSchema,
+  /** Null on a project-scoped digest (accounts are not a project's). */
+  quota: digestQuotaSchema.nullable()
 }).strict();
 var meDigestSeenBodySchema = external_exports.object({
   before: isoTimeSchema.optional()
@@ -21157,6 +21279,24 @@ var feedbackListSchema = external_exports.object({
   total: external_exports.number().int().min(0)
 });
 
+// ../shared/src/api/nudge.ts
+var NUDGE_TTL_SEC = 24 * 3600;
+var NUDGE_NOTE_MAX = 300;
+var nudgeBody = external_exports.object({ note: external_exports.string().trim().max(NUDGE_NOTE_MAX).optional() }).strict();
+var nudgeResponse = external_exports.object({
+  nudge: external_exports.object({
+    id: external_exports.string(),
+    session_id: external_exports.string(),
+    created_at: isoTimeSchema,
+    /** When the next nudge of this session is allowed. */
+    next_allowed_at: isoTimeSchema,
+    /** The owner got a push (with the resume command when the tool has one). */
+    pushed: external_exports.boolean(),
+    resume_command: external_exports.string().nullable()
+  })
+});
+var agentNudgeSchema = external_exports.object({ id: external_exports.string(), text: external_exports.string(), sent_at: isoTimeSchema });
+
 // ../shared/src/index.ts
 var ROLES = ["owner", "admin", "member", "viewer"];
 var roleSchema2 = external_exports.enum(ROLES);
@@ -21268,7 +21408,10 @@ export {
   CLI_INSTALL_COMMAND,
   cliNpxCommand,
   redact,
+  usageReadingSchema,
   parseUsageKey,
+  routeProviderFromParam,
+  usageRouteSchema,
   DEFAULT_HOST,
   defaultCtx,
   hostFromEnv,