@huynle/hub 0.10.0 → 0.11.0

package/packages/cli/dist/hub-cli.js

@@ -7,7 +7,7 @@ import { createInterface } from "readline";
 // packages/cli/package.json
 var package_default = {
   name: "@huynle/hub-cli",
-  version: "0.10.0",
+  version: "0.11.0",
   private: true,
   description: "The hub CLI (`hub` / `hubctl`) for agents and scripts (internal; bundled into @huynle/hub, not published on its own).",
   license: "MIT",
@@ -1162,6 +1162,15 @@ class HubClient {
   grants(options = {}) {
     return this.call("GET", `${AGENT2}/grants`, signalOf(options));
   }
+  heldGrants(options = {}) {
+    return this.call("GET", `${AGENT2}/grants/mine`, signalOf(options));
+  }
+  heldGrant(id, options = {}) {
+    return this.call("GET", `${AGENT2}/grants/mine/${segment(id)}`, signalOf(options));
+  }
+  revokeHeldGrant(id, options = {}) {
+    return this.call("DELETE", `${AGENT2}/grants/mine/${segment(id)}`, signalOf(options));
+  }
   grant(id, options = {}) {
     return this.call("GET", `${AGENT2}/grants/${segment(id)}`, signalOf(options));
   }
@@ -4325,6 +4334,19 @@ var RECORDING_LIMITS = {
   hubFlushMs: 2000,
   hubFlushEvents: 100
 };
+var DEV_LIMITS = {
+  clipsPerRecording: 200,
+  clipPreMs: 3000,
+  clipPostMs: 2000,
+  clipBytes: 192 * 1024,
+  clipGapMs: 2000,
+  repliesPerRecording: 2000,
+  replyBytes: 1024 * 1024,
+  userHeadroomBytes: 50 * 1024 * 1024,
+  recordingHeadroomBytes: 15 * 1024 * 1024,
+  tracesPerMinute: 30,
+  logsPerMinute: 20
+};
 // packages/protocol/src/app-front.ts
 var ACCESS_TOKEN_TTL_MS = 60 * 60000;
 var REFRESH_TOKEN_IDLE_MS = 30 * 24 * 60 * 60000;
@@ -4421,7 +4443,7 @@ var IMPLIED_OPENCODE_FEATURES = [
   "expose",
   "create"
 ];
-var OPTIONAL_SPOKE_FEATURES = [...IMPLIED_OPENCODE_FEATURES, "autoName", "sessionTokens", "deliver", "hubPrompt", "permissionMessage", "actTokens", "launch", "fork", "revert", "dismissError", "timelineMedia", PREVIEW_BUNDLE_FEATURE, "voiceFront", "conciergeFront", "inboxCarried"];
+var OPTIONAL_SPOKE_FEATURES = [...IMPLIED_OPENCODE_FEATURES, "autoName", "sessionTokens", "deliver", "hubPrompt", "permissionMessage", "actTokens", "launch", "fork", "revert", "dismissError", "timelineMedia", PREVIEW_BUNDLE_FEATURE, "voiceFront", "conciergeFront", "inboxCarried", "setModel"];
 var CORE_OPS = ["turn", "steer", "interrupt", "stop", "permission", "form"];
 var KNOWN_SPOKE_FEATURES = [...CORE_OPS, ...OPTIONAL_SPOKE_FEATURES, "turnEvents", PROFILE_APPLY_FEATURE, SESSION_CONTEXT_FEATURE];
 var SPOKE_FEATURES = [...OPTIONAL_SPOKE_FEATURES, PROFILE_APPLY_FEATURE, SESSION_CONTEXT_FEATURE];
@@ -4620,6 +4642,8 @@ function isServerRequest(v) {
       return nonEmpty(v.sessionID);
     case "setModelPrefs":
       return nonEmpty(v.sessionID) && (v.voice === undefined || v.voice === null || isModelSelection(v.voice)) && (v.worker === undefined || v.worker === null || isModelSelection(v.worker)) && (v.voice !== undefined || v.worker !== undefined);
+    case "setModel":
+      return nonEmpty(v.sessionID) && isModelSelection(v.model);
     case "timeline":
       return nonEmpty(v.sessionID) && (v.limit === undefined || Number.isInteger(v.limit) && Number(v.limit) >= 1 && Number(v.limit) <= 200) && (v.cursor === undefined || str2(v.cursor) && v.cursor.length <= 4096) && (v.order === undefined || v.order === "asc" || v.order === "desc") && (v.before === undefined || nonEmpty(v.before) && v.before.length <= 4096) && (v.cursor === undefined || v.before === undefined && v.order !== "desc");
     case "timelinePart":
@@ -6982,35 +7006,213 @@ ${intakeText(intake)}`;
   }
 ];
 
-// packages/cli/src/teams-mcp.ts
+// packages/cli/src/subscriptions.ts
+var SUBSCRIBE_FLAGS = { type: "multi", delivery: "string", batch: "string", expires: "string", "max-per-hour": "string", subscriber: "string", note: "string" };
+var DELIVERIES2 = ["queue", "steer", "silent"];
+var safe = (v, max = 120) => sanitizeLabel(String(v), max);
+function subscribeInput(addrs, flags) {
+  if (!addrs.length)
+    throw new UsageError("needs at least one address (a session, @@role, #team or children)");
+  const delivery = str(flags, "delivery");
+  if (delivery !== undefined && !DELIVERIES2.includes(delivery))
+    throw new UsageError(`--delivery is one of ${DELIVERIES2.join(", ")}`);
+  const batch = str(flags, "batch");
+  const expires = str(flags, "expires");
+  const max = str(flags, "max-per-hour");
+  if (max !== undefined && !/^\d+$/.test(max))
+    throw new UsageError("--max-per-hour takes a whole number (1–120)");
+  const types = flags.type;
+  const subscriber = str(flags, "subscriber");
+  const note = str(flags, "note");
+  return {
+    to: addrs.length === 1 ? addrs[0] : [...addrs],
+    ...types?.length ? { types: types.flatMap((t) => t.split(",")).map((t) => t.trim()).filter(Boolean) } : {},
+    ...delivery !== undefined ? { delivery } : {},
+    ...batch !== undefined ? { batch: durationArg(batch, "--batch") } : {},
+    ...expires !== undefined ? { expires: durationArg(expires, "--expires") } : {},
+    ...max !== undefined ? { maxPerHour: Number(max) } : {},
+    ...subscriber !== undefined ? { subscriber } : {},
+    ...note !== undefined ? { note } : {}
+  };
+}
+var targets = (s) => s.targets.map((t) => t.kind === "children" ? "its subagents" : safe(t.addr, 80)).join(", ");
+var iso3 = (ms) => new Date(ms).toISOString().slice(0, 16) + "Z";
+function subscriptionLine(s) {
+  const extra = [safe(s.delivery, 10), `batch ${Math.round(s.batchMs / 1000)}s`, `≤${s.maxPerHour}/h`, `expires ${iso3(s.expiresAt)}`, `${s.stats.delivered} delivered`, ...s.pending ? [`${s.pending} pending`] : [], ...s.stats.dropped ? [`${s.stats.dropped} dropped`] : [], ...s.stats.suppressed ? [`${s.stats.suppressed} loop-suppressed`] : []];
+  return `${safe(s.id, 40)}  ${safe(s.subscriber, 80)} ← ${targets(s)}  [${s.types.map((t) => safe(t, 40)).join(",")}]  ${extra.join(" · ")}${s.note ? `  "${safe(s.note, 200)}"` : ""}`;
+}
+var subscribedText = (b) => `subscribed ${subscriptionLine(b.subscription)}
+the subscriber gets one hub message per batch window; stop with \`hub unsubscribe ${safe(b.subscription.id, 40)}\``;
+var subscriptionsText = (b) => b.subscriptions.length ? b.subscriptions.map(subscriptionLine).join(`
+`) : "no subscriptions";
+
+// packages/cli/src/subscriptions-mcp.ts
 var STRING4 = { type: "string" };
-var STRINGS = { type: "array", items: STRING4 };
+var need4 = (args, key) => {
+  const value = args[key];
+  if (typeof value !== "string" || !value.trim())
+    throw new ToolArgError(`"${key}" is required (a non-empty string)`);
+  return value;
+};
+var optional5 = (args, key) => {
+  const value = args[key];
+  if (value === undefined || value === null)
+    return;
+  if (typeof value !== "string")
+    throw new ToolArgError(`"${key}" must be a string`);
+  return value.trim() || undefined;
+};
+var array = (args, key) => {
+  const value = args[key];
+  if (value === undefined || value === null)
+    return;
+  if (!Array.isArray(value) || !value.every((v) => typeof v === "string"))
+    throw new ToolArgError(`"${key}" must be a list of strings`);
+  return value;
+};
+var number = (args, key, min, max) => {
+  const value = args[key];
+  if (value === undefined || value === null)
+    return;
+  if (typeof value !== "number" || !Number.isInteger(value) || value < min || value > max)
+    throw new ToolArgError(`"${key}" must be a whole number from ${min} to ${max}`);
+  return value;
+};
+var subscriptionTools = [
+  {
+    name: "subscribe",
+    description: "Follow journal events for a subscriber session. A session subscribes itself; users and apps name subscriber. Apps need events:subscribe, sessions:read, relevant type scopes and messages:send unless silent. Hub checks visibility, rates and loops.",
+    properties: {
+      to: { type: ["string", "array"], items: STRING4, description: "One or more session/role/team addresses, or children." },
+      subscriber: STRING4,
+      types: { type: "array", items: STRING4 },
+      delivery: { type: "string", enum: ["queue", "steer", "silent"] },
+      batch: { type: "number", description: "Seconds per batch (1–3600)." },
+      expires: { type: "number", description: "Seconds until expiry." },
+      maxPerHour: { type: "integer", minimum: 1, maximum: 120 },
+      note: STRING4
+    },
+    required: ["to"],
+    readOnly: false,
+    run: async (hub, args, signal) => {
+      const to = typeof args.to === "string" && args.to.trim() ? args.to : array(args, "to");
+      if (!to || Array.isArray(to) && !to.length)
+        throw new ToolArgError('"to" needs at least one address');
+      const delivery = optional5(args, "delivery");
+      if (delivery && !["queue", "steer", "silent"].includes(delivery))
+        throw new ToolArgError('"delivery" is queue, steer or silent');
+      const subscriber = optional5(args, "subscriber");
+      const types = array(args, "types");
+      const batch = number(args, "batch", 1, 3600);
+      const expires = number(args, "expires", 1, 30 * 86400);
+      const maxPerHour = number(args, "maxPerHour", 1, 120);
+      const note = optional5(args, "note");
+      const input = { to, ...subscriber ? { subscriber } : {}, ...types ? { types } : {}, ...delivery ? { delivery } : {}, ...batch ? { batch } : {}, ...expires ? { expires } : {}, ...maxPerHour ? { maxPerHour } : {}, ...note ? { note } : {} };
+      return subscribedText(await hub.subscribe(input, { signal }));
+    }
+  },
+  {
+    name: "subscriptions",
+    description: "List subscriptions visible to this credential (session: its own; app: created by it; user: all). Optional session filter; route enforces scopes and tenancy.",
+    properties: { session: STRING4 },
+    readOnly: true,
+    run: async (hub, args, signal) => subscriptionsText(await hub.subscriptions({ ...optional5(args, "session") ? { session: optional5(args, "session") } : {}, signal }))
+  },
+  {
+    name: "unsubscribe",
+    description: "Remove a subscription this credential owns. An unknown or another caller's ID answers not_found.",
+    properties: { id: STRING4 },
+    required: ["id"],
+    readOnly: false,
+    organizes: true,
+    run: async (hub, args, signal) => {
+      const id = need4(args, "id");
+      await hub.unsubscribe(id, { signal });
+      return `unsubscribed ${id}`;
+    }
+  }
+];
+
+// packages/cli/src/mcp-operations.ts
+var STRING5 = { type: "string" };
+var need5 = (args, key) => {
+  const v = args[key];
+  if (typeof v !== "string" || !v.trim())
+    throw new ToolArgError(`"${key}" is required (a non-empty string)`);
+  return v;
+};
+var userOnly = async (hub, signal) => {
+  if ((await hub.whoami({ signal })).actor.kind !== "user")
+    throw new CliError(EXIT.forbidden, "only the user can use this tool", "Use the user's device credential");
+};
+var operationTools = [
+  {
+    name: "session_model_set",
+    description: "Set one existing session's model (providerID, modelID and optional variant), exactly as the console Model chip does. User device credential only; the console route checks ownership, catalog, availability and audit. An app or session cannot set it.",
+    properties: { session: STRING5, model: { type: "object", properties: { providerID: STRING5, modelID: STRING5, variant: STRING5 }, required: ["providerID", "modelID"] } },
+    required: ["session", "model"],
+    readOnly: false,
+    run: async (hub, args, signal) => {
+      await userOnly(hub, signal);
+      const model = args.model;
+      if (typeof model !== "object" || model === null || Array.isArray(model))
+        throw new ToolArgError('"model" is required (providerID, modelID, variant?)');
+      const result = await hub.call("PUT", `/api/sessions/${encodeURIComponent(need5(args, "session"))}/model`, { body: { model }, signal });
+      return JSON.stringify(result);
+    }
+  },
+  {
+    name: "machines",
+    description: "The user's own enrolled machines, online status and processes. User device credential only; wraps GET /api/machines. No machine tokens or secrets.",
+    properties: {},
+    readOnly: true,
+    run: async (hub, _args, signal) => {
+      await userOnly(hub, signal);
+      return JSON.stringify(await hub.call("GET", "/api/machines", { signal }));
+    }
+  },
+  {
+    name: "launch_nodes",
+    description: "The user's connected launch nodes: machine, workspace roots, capacity/used/free slots, runtimes (harnesses) and labels. User device credential only; no tokens, connection IDs or mutation.",
+    properties: {},
+    readOnly: true,
+    run: async (hub, _args, signal) => {
+      await userOnly(hub, signal);
+      return JSON.stringify(await hub.call("GET", "/api/agent/launch-nodes", { signal }));
+    }
+  }
+];
+
+// packages/cli/src/teams-mcp.ts
+var STRING6 = { type: "string" };
+var STRINGS = { type: "array", items: STRING6 };
 var TEAM2 = { type: "string", description: "The team: its ID (team_…) or its name." };
 var REVISION2 = { type: "integer", minimum: 0, description: "The team's revision you read (team_show); a stale one answers conflict with the current revision." };
 var IDEMPOTENCY = { type: "string", description: "Idempotency-Key: the same key and arguments within 24 h answer the first result again." };
 var KINDS3 = { type: "array", items: { type: "string", enum: ["msg", "ask"] }, description: "What the path permits: msg and/or ask (replies to a permitted ask never need a path)." };
 var DIRECTION = { type: "string", enum: ["one-way", "two-way"], description: "two-way: `to` may also contact `from` with the same kinds." };
 var ROLE_FIELDS = {
-  label: { ...STRING4, description: "A display label (confers no authority)." },
-  description: STRING4,
+  label: { ...STRING6, description: "A display label (confers no authority)." },
+  description: STRING6,
   externalContact: { type: "boolean", description: "Holders may contact sessions outside all their teams (default false)." },
   responsibilities: { ...STRINGS, description: "Short lines (at most 16)." },
-  profile: { type: "object", properties: { profileID: STRING4, version: { type: "integer", minimum: 1 } }, required: ["profileID"], description: "The agent profile members should run (reported, never pinned by staffing)." },
-  prefs: { type: "object", properties: { harness: STRING4, model: STRING4, machineID: STRING4 }, description: "Placement preferences for launched members (advisory)." },
+  profile: { type: "object", properties: { profileID: STRING6, version: { type: "integer", minimum: 1 } }, required: ["profileID"], description: "The agent profile members should run (reported, never pinned by staffing)." },
+  prefs: { type: "object", properties: { harness: STRING6, model: STRING6, machineID: STRING6 }, description: "Placement preferences for launched members (advisory)." },
   minMembers: { type: "integer", minimum: 0, maximum: 16 },
   maxMembers: { type: "integer", minimum: 1, maximum: 16 }
 };
-var ROLE = { type: "object", properties: { name: { ...STRING4, description: "A slug: lowercase letters, digits, dashes." }, ...ROLE_FIELDS }, required: ["name"] };
-var EDGE = { type: "object", properties: { from: STRING4, to: STRING4, kinds: KINDS3, direction: DIRECTION }, required: ["from", "to", "kinds", "direction"] };
+var ROLE = { type: "object", properties: { name: { ...STRING6, description: "A slug: lowercase letters, digits, dashes." }, ...ROLE_FIELDS }, required: ["name"] };
+var EDGE = { type: "object", properties: { from: STRING6, to: STRING6, kinds: KINDS3, direction: DIRECTION }, required: ["from", "to", "kinds", "direction"] };
 var SPEC_FIELDS = {
-  title: { ...STRING4, description: "1–120 characters." },
-  description: STRING4,
+  title: { ...STRING6, description: "1–120 characters." },
+  description: STRING6,
   mode: { type: "string", enum: ["open", "restricted"], description: "open: every member may msg/ask every other member. restricted: only the drawn paths (edges)." },
+  hopLimit: { type: "integer", minimum: 1, maximum: 100, description: "Agent-only wake hop limit between this team's seats; may not exceed the hub-wide agents.hopLimit. Unset uses the global limit." },
   roles: { type: "array", items: ROLE, description: "1–32 roles." },
-  entryRole: { ...STRING4, description: "The role that receives submitted work (e.g. pm) and supervises members." },
+  entryRole: { ...STRING6, description: "The role that receives submitted work (e.g. pm) and supervises members." },
   edges: { type: "array", items: EDGE, description: "Communication paths between roles (restricted mode)." },
   tags: { ...STRINGS, description: "Slugs." },
-  metadata: { type: "object", additionalProperties: STRING4, description: "String key/value pairs (keys are slugs)." },
+  metadata: { type: "object", additionalProperties: STRING6, description: "String key/value pairs (keys are slugs)." },
   projects: { ...STRINGS, description: "Project names the team works on." }
 };
 var LAUNCH = {
@@ -7021,11 +7223,11 @@ var LAUNCH = {
       type: "object",
       description: "Where the member works on its machine.",
       properties: {
-        repo: { ...STRING4, description: "The repository's absolute path on the machine." },
+        repo: { ...STRING6, description: "The repository's absolute path on the machine." },
         mode: { type: "string", enum: ["worktree", "checkout", "clone"], description: "worktree (default; needs branch), checkout, or clone (needs remote)." },
-        branch: { ...STRING4, description: "The branch to create or check out (a safe git branch name; required for worktree)." },
-        base: { ...STRING4, description: "What a new branch starts from." },
-        remote: { ...STRING4, description: "An https or ssh git remote, without credentials (required for clone)." }
+        branch: { ...STRING6, description: "The branch to create or check out (a safe git branch name; required for worktree)." },
+        base: { ...STRING6, description: "What a new branch starts from." },
+        remote: { ...STRING6, description: "An https or ssh git remote, without credentials (required for clone)." }
       },
       required: ["repo"]
     },
@@ -7033,8 +7235,8 @@ var LAUNCH = {
       type: "object",
       description: "Which machine runs it.",
       properties: {
-        machine: { ...STRING4, description: "A machine ID or name." },
-        labels: { type: "object", additionalProperties: STRING4, description: "Node labels to match." },
+        machine: { ...STRING6, description: "A machine ID or name." },
+        labels: { type: "object", additionalProperties: STRING6, description: "Node labels to match." },
         mode: { type: "string", enum: ["require", "prefer"], description: "require (default) or prefer the machine/labels." }
       }
     },
@@ -7042,7 +7244,7 @@ var LAUNCH = {
       type: "object",
       properties: {
         kind: { type: "string", enum: ["host", "openshell"], description: "host (default) or openshell (clone workspaces only)." },
-        profile: { ...STRING4, description: "An openshell sandbox profile (openshell only)." }
+        profile: { ...STRING6, description: "An openshell sandbox profile (openshell only)." }
       }
     },
     end: {
@@ -7054,27 +7256,27 @@ var LAUNCH = {
         cleanup: { type: "string", enum: ["keep", "remove"], description: "keep (default) or remove the workspace at the end." }
       }
     },
-    name: { ...STRING4, description: "The session's @name, without the @." },
+    name: { ...STRING6, description: "The session's @name, without the @." },
     roles: { ...STRINGS, description: "Roles the session claims (up to 10)." },
-    harness: { ...STRING4, description: "The harness (default opencode)." },
-    agent: { ...STRING4, description: "The harness agent." },
-    model: { ...STRING4, description: "provider/model." },
-    prompt: { ...STRING4, description: "The first prompt (up to 10000 characters)." },
-    intent: { ...STRING4, description: "What the session is for (one line)." },
-    labels: { type: "object", additionalProperties: STRING4, description: "Free-form app labels." },
-    agentProfile: { type: "object", properties: { profileID: STRING4, version: { type: "integer", minimum: 1 } }, required: ["profileID", "version"], description: "The profile version to pin (needs profiles:assign for an app)." }
+    harness: { ...STRING6, description: "The harness (default opencode)." },
+    agent: { ...STRING6, description: "The harness agent." },
+    model: { ...STRING6, description: "provider/model." },
+    prompt: { ...STRING6, description: "The first prompt (up to 10000 characters)." },
+    intent: { ...STRING6, description: "What the session is for (one line)." },
+    labels: { type: "object", additionalProperties: STRING6, description: "Free-form app labels." },
+    agentProfile: { type: "object", properties: { profileID: STRING6, version: { type: "integer", minimum: 1 } }, required: ["profileID", "version"], description: "The profile version to pin (needs profiles:assign for an app)." }
   },
   required: ["workspace"]
 };
 var SCOPES = "App tokens need scope teams:read (reads) or teams:manage (changes); seats, status and staffing also need sessions:read. Session tokens read only teams they are seated in and never change definitions. Team roles confer no authority.";
 var ArgError = ToolArgError;
-var need4 = (args, key) => {
+var need6 = (args, key) => {
   const value = args[key];
   if (typeof value !== "string" || !value.trim())
     throw new ArgError(`"${key}" is required (a non-empty string)`);
   return value;
 };
-var optional5 = (args, key) => {
+var optional6 = (args, key) => {
   const value = args[key];
   if (value === undefined || value === null)
     return;
@@ -7129,6 +7331,7 @@ function specLines(spec) {
   const role = (r) => `  ${r.name}${r.name === spec.entryRole ? " (entry)" : ""}${r.label ? `  "${one(r.label)}"` : ""}${r.externalContact ? "  external contact" : ""}${r.minMembers !== undefined || r.maxMembers !== undefined ? `  members ${r.minMembers ?? 0}–${r.maxMembers ?? 16}` : ""}${r.profile ? `  profile ${r.profile.profileID}${r.profile.version ? `@${r.profile.version}` : ""}` : ""}`;
   return [
     `mode: ${spec.mode}${spec.mode === "open" ? " (every member may msg/ask every other)" : " (only the paths below)"}`,
+    ...spec.hopLimit !== undefined ? [`hop limit: ${spec.hopLimit}`] : [],
     `entry role: ${spec.entryRole}`,
     "roles:",
     ...spec.roles.map(role),
@@ -7147,7 +7350,7 @@ function rosterLines(roster) {
     const flags = [r.vacant ? "vacant" : "", r.understaffed ? `understaffed (min ${r.minMembers})` : "", r.launching ? `${r.launching} launching` : ""].filter(Boolean);
     lines.push(`  ${r.role}${r.entry ? " (entry)" : ""}  ${r.seats.length}/${r.maxMembers}  ${r.online} online${flags.length ? `  ${flags.join(", ")}` : ""}`);
     for (const s of r.seats)
-      lines.push(`    ${s.staffing.id}  ${s.staffing.sessionID}  ${s.presence}  gen ${s.staffing.generation} r${s.staffing.revision}${s.profile ? `  profile ${s.profile.status}${s.profile.matches ? "" : " (mismatch)"}` : ""}`);
+      lines.push(`    ${s.staffing.id}  ${s.staffing.sessionID}  ${s.presence}${s.stalled ? `  stalled: ${s.stalled}` : ""}  gen ${s.staffing.generation} r${s.staffing.revision}${s.profile ? `  profile ${s.profile.status}${s.profile.matches ? "" : " (mismatch)"}` : ""}`);
   }
   const failed = roster.requests.filter((q) => q.state !== "staffed").slice(-5);
   for (const q of failed)
@@ -7164,7 +7367,7 @@ var statusTool = (verb, description, organizes) => ({
   idempotent: true,
   run: async (hub, args, signal) => {
     const expectedRevision = revision(args);
-    const { team } = await hub.teams[verb](need4(args, "team"), expectedRevision, { signal });
+    const { team } = await hub.teams[verb](need6(args, "team"), expectedRevision, { signal });
     return `${team.revision === expectedRevision ? "unchanged" : { pause: "paused", resume: "resumed", archive: "archived", restore: "restored" }[verb]}: ${teamLine(team)}`;
   }
 });
@@ -7178,7 +7381,7 @@ var draftTool = (name, description, properties, required, edit) => ({
   idempotent: true,
   run: async (hub, args, signal) => {
     const expectedRevision = revision(args);
-    const { team, draft } = await edit(hub.teams, need4(args, "team"), args, expectedRevision, signal);
+    const { team, draft } = await edit(hub.teams, need6(args, "team"), args, expectedRevision, signal);
     return draftText("draft saved", team, draft);
   }
 });
@@ -7189,22 +7392,22 @@ var teamTools = [
     properties: {
       state: { type: "string", enum: ["active", "archived", "all"] },
       tags: STRINGS,
-      project: STRING4,
-      metadata: { type: "object", additionalProperties: STRING4 },
+      project: STRING6,
+      metadata: { type: "object", additionalProperties: STRING6 },
       paused: { type: "boolean" },
       limit: { type: "integer", minimum: 1, maximum: 200 },
-      cursor: STRING4
+      cursor: STRING6
     },
     readOnly: true,
     run: async (hub, args, signal) => {
-      const state = optional5(args, "state");
+      const state = optional6(args, "state");
       if (state !== undefined && !["active", "archived", "all"].includes(state))
         throw new ArgError(`"state" is one of active, archived, all`);
       const tags = strings3(args, "tags");
-      const project = optional5(args, "project");
+      const project = optional6(args, "project");
       const metadata = record(args, "metadata");
       const limit = int3(args, "limit", 1, 200);
-      const cursor = optional5(args, "cursor");
+      const cursor = optional6(args, "cursor");
       if (args.paused !== undefined && typeof args.paused !== "boolean")
         throw new ArgError(`"paused" must be true or false`);
       const page = await hub.teams.list({
@@ -7230,7 +7433,7 @@ var teamTools = [
     required: ["team"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const { team, draft } = await hub.teams.get(need4(args, "team"), { signal });
+      const { team, draft } = await hub.teams.get(need6(args, "team"), { signal });
       return [teamLine(team), ...specLines(team), ...draft ? [`draft pending (on v${draft.baseVersion}, saved ${when(draft.savedAt)}): see team_diff`] : []].join(`
 `);
     }
@@ -7242,7 +7445,7 @@ var teamTools = [
     required: ["team"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const { team, roster, intake } = await hub.teams.status(need4(args, "team"), { signal });
+      const { team, roster, intake } = await hub.teams.status(need6(args, "team"), { signal });
       const lines = [teamLine(team), ...rosterLines(roster)];
       if (intake)
         lines.push(`intake: ${intake.queued} queued, ${intake.routed} routed (${intake.open} open, ${intake.inProgress} in progress, ${intake.blocked} blocked), ${intake.done} done, ${intake.failed} failed, ${intake.cancelled} cancelled${intake.oldestQueuedAt !== undefined ? `; oldest queued ${when(intake.oldestQueuedAt)}` : ""}`);
@@ -7253,12 +7456,12 @@ var teamTools = [
   {
     name: "team_history",
     description: `A team's retained published versions, newest first (version, digest, when). ${SCOPES}`,
-    properties: { team: TEAM2, cursor: STRING4 },
+    properties: { team: TEAM2, cursor: STRING6 },
     required: ["team"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const cursor = optional5(args, "cursor");
-      const page = await hub.teams.versions(need4(args, "team"), { signal, ...cursor ? { cursor } : {} });
+      const cursor = optional6(args, "cursor");
+      const page = await hub.teams.versions(need6(args, "team"), { signal, ...cursor ? { cursor } : {} });
       return [...page.items.map((v) => `v${v.version}  ${v.digest.slice(0, 12)}  ${when(v.publishedAt)}`), ...page.cursor ? [`more: cursor ${page.cursor}`] : []].join(`
 `);
     }
@@ -7272,7 +7475,7 @@ var teamTools = [
     run: async (hub, args, signal) => {
       const from = int3(args, "from", 1, 1e9);
       const to = args.to === undefined || args.to === null || args.to === "draft" ? "draft" : int3(args, "to", 1, 1e9);
-      const { from: a, to: b, diff } = await hub.teams.diff(need4(args, "team"), { signal, ...from !== undefined ? { from } : {}, to });
+      const { from: a, to: b, diff } = await hub.teams.diff(need6(args, "team"), { signal, ...from !== undefined ? { from } : {}, to });
       const part = (label, d) => ["added", "removed", "changed"].flatMap((k) => d[k]?.length ? [`${label} ${k}: ${d[k].join(", ")}`] : []);
       const lines = [
         ...diff.fields.length ? [`fields changed: ${diff.fields.join(", ")}`] : [],
@@ -7289,16 +7492,16 @@ var teamTools = [
   {
     name: "team_create",
     description: `Assemble a persistent team: roles (one is the entry role that receives submitted work, e.g. a project manager), open or restricted communication with one-way/two-way paths, tags, projects and metadata. Published as version 1 at once; the name is the team's address (@@role#name) and never changes. ${SCOPES}`,
-    properties: { name: { ...STRING4, description: "A slug (2–40 lowercase letters, digits, dashes), unique per user." }, ...SPEC_FIELDS, idempotencyKey: IDEMPOTENCY },
+    properties: { name: { ...STRING6, description: "A slug (2–40 lowercase letters, digits, dashes), unique per user." }, ...SPEC_FIELDS, idempotencyKey: IDEMPOTENCY },
     required: ["name", "title", "mode", "roles", "entryRole"],
     readOnly: false,
     organizes: true,
     idempotent: true,
     run: async (hub, args, signal) => {
-      need4(args, "name");
-      need4(args, "title");
-      const key = optional5(args, "idempotencyKey");
-      const spec = picked(args, ["name", "title", "description", "mode", "roles", "entryRole", "edges", "tags", "metadata", "projects"]);
+      need6(args, "name");
+      need6(args, "title");
+      const key = optional6(args, "idempotencyKey");
+      const spec = picked(args, ["name", "title", "description", "mode", "hopLimit", "roles", "entryRole", "edges", "tags", "metadata", "projects"]);
       const { team, created } = await hub.teams.create({ ...spec, edges: spec.edges ?? [] }, { signal, ...key ? { idempotencyKey: key } : {} });
       return [`${created ? "created" : "already created (same key)"}: ${teamLine(team)}`, ...specLines(team)].join(`
 `);
@@ -7314,24 +7517,24 @@ var teamTools = [
     idempotent: true,
     run: async (hub, args, signal) => {
       const expectedRevision = revision(args);
-      const patch = picked(args, ["title", "description", "mode", "roles", "entryRole", "edges", "tags", "metadata", "projects"]);
+      const patch = picked(args, ["title", "description", "mode", "hopLimit", "roles", "entryRole", "edges", "tags", "metadata", "projects"]);
       if (Object.keys(patch).length === 0)
         throw new ArgError("give at least one field to change");
-      const id = need4(args, "team");
+      const id = need6(args, "team");
       const { team } = await hub.teams.update(id, patch, expectedRevision, { signal });
       return draftText("draft saved", team, (await hub.teams.draft(team.id, { signal })).draft);
     }
   },
-  draftTool("team_role_set", "Add a role to a team's draft, or replace the role of that name (all its fields).", { role: { ...STRING4, description: "The role's name (a slug)." }, ...ROLE_FIELDS }, ["role"], (teams, team, args, rev, signal) => teams.setRole(team, { name: need4(args, "role"), ...picked(args, Object.keys(ROLE_FIELDS)) }, rev, { signal })),
-  draftTool("team_role_remove", "Remove a role (not the entry role) and every path touching it from a team's draft.", { role: STRING4 }, ["role"], (teams, team, args, rev, signal) => teams.removeRole(team, need4(args, "role"), rev, { signal })),
-  draftTool("team_edge_set", "Draw a communication path from one role to another in a team's draft (replaces the path drawn between them).", { from: STRING4, to: STRING4, kinds: KINDS3, direction: DIRECTION }, ["from", "to", "kinds", "direction"], (teams, team, args, rev, signal) => {
+  draftTool("team_role_set", "Add a role to a team's draft, or replace the role of that name (all its fields).", { role: { ...STRING6, description: "The role's name (a slug)." }, ...ROLE_FIELDS }, ["role"], (teams, team, args, rev, signal) => teams.setRole(team, { name: need6(args, "role"), ...picked(args, Object.keys(ROLE_FIELDS)) }, rev, { signal })),
+  draftTool("team_role_remove", "Remove a role (not the entry role) and every path touching it from a team's draft.", { role: STRING6 }, ["role"], (teams, team, args, rev, signal) => teams.removeRole(team, need6(args, "role"), rev, { signal })),
+  draftTool("team_edge_set", "Draw a communication path from one role to another in a team's draft (replaces the path drawn between them).", { from: STRING6, to: STRING6, kinds: KINDS3, direction: DIRECTION }, ["from", "to", "kinds", "direction"], (teams, team, args, rev, signal) => {
     const kinds = strings3(args, "kinds");
     if (!kinds?.length)
       throw new ArgError(`"kinds" is a list of msg and/or ask`);
-    const direction = need4(args, "direction");
-    return teams.setEdge(team, { from: need4(args, "from"), to: need4(args, "to"), kinds, direction }, rev, { signal });
+    const direction = need6(args, "direction");
+    return teams.setEdge(team, { from: need6(args, "from"), to: need6(args, "to"), kinds, direction }, rev, { signal });
   }),
-  draftTool("team_edge_remove", "Remove the path drawn from one role to another (or a two-way path between them) from a team's draft.", { from: STRING4, to: STRING4 }, ["from", "to"], (teams, team, args, rev, signal) => teams.removeEdge(team, need4(args, "from"), need4(args, "to"), rev, { signal })),
+  draftTool("team_edge_remove", "Remove the path drawn from one role to another (or a two-way path between them) from a team's draft.", { from: STRING6, to: STRING6 }, ["from", "to"], (teams, team, args, rev, signal) => teams.removeEdge(team, need6(args, "from"), need6(args, "to"), rev, { signal })),
   {
     name: "team_discard_draft",
     description: `Drop a team's pending draft (unpublished edits are lost; the published version stays). ${SCOPES}`,
@@ -7339,7 +7542,7 @@ var teamTools = [
     required: ["team", "expectedRevision"],
     readOnly: false,
     idempotent: true,
-    run: async (hub, args, signal) => `draft discarded: ${teamLine((await hub.teams.discardDraft(need4(args, "team"), revision(args), { signal })).team)}`
+    run: async (hub, args, signal) => `draft discarded: ${teamLine((await hub.teams.discardDraft(need6(args, "team"), revision(args), { signal })).team)}`
   },
   {
     name: "team_publish",
@@ -7349,7 +7552,7 @@ var teamTools = [
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const { team, published } = await hub.teams.publish(need4(args, "team"), revision(args), { signal });
+      const { team, published } = await hub.teams.publish(need6(args, "team"), revision(args), { signal });
       return `${published ? `published version ${team.version}` : "the draft equalled the published version; dropped"}: ${teamLine(team)}`;
     }
   },
@@ -7360,17 +7563,17 @@ var teamTools = [
   {
     name: "team_staff",
     description: `Staff a role: attach an existing session (sessionID, any machine) or launch a new member (launch: a launch spec as the launch tool takes). An agent needs the user's grants (roles for the session's project; launch for a repo) or the hub answers needs_user; staffing never issues grants. ${SCOPES}`,
-    properties: { team: TEAM2, role: STRING4, sessionID: { ...STRING4, description: "An existing session (ses_…)." }, launch: LAUNCH, idempotencyKey: IDEMPOTENCY },
+    properties: { team: TEAM2, role: STRING6, sessionID: { ...STRING6, description: "An existing session (ses_…)." }, launch: LAUNCH, idempotencyKey: IDEMPOTENCY },
     required: ["team", "role"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const team = need4(args, "team");
-      const role = need4(args, "role");
-      const sessionID = optional5(args, "sessionID");
+      const team = need6(args, "team");
+      const role = need6(args, "role");
+      const sessionID = optional6(args, "sessionID");
       const launch = launchOf(args);
       if (sessionID === undefined === (launch === undefined))
         throw new ArgError(`give exactly one of sessionID or launch`);
-      const key = optional5(args, "idempotencyKey");
+      const key = optional6(args, "idempotencyKey");
       const options = { signal, ...key ? { idempotencyKey: key } : {} };
       if (sessionID !== undefined) {
         const r = await hub.teams.staff(team, { role, sessionID }, options);
@@ -7383,29 +7586,29 @@ var teamTools = [
   {
     name: "team_unstaff",
     description: `End a seat (the session leaves the role and loses the team's policy rights). Send the seat's revision (team_status). ${SCOPES}`,
-    properties: { team: TEAM2, staffingID: { ...STRING4, description: "The seat (stf_…)." }, expectedRevision: { ...REVISION2, description: "The seat's revision you read (team_status)." } },
+    properties: { team: TEAM2, staffingID: { ...STRING6, description: "The seat (stf_…)." }, expectedRevision: { ...REVISION2, description: "The seat's revision you read (team_status)." } },
     required: ["team", "staffingID", "expectedRevision"],
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const { staffing } = await hub.teams.unstaff(need4(args, "team"), need4(args, "staffingID"), revision(args), { signal });
+      const { staffing } = await hub.teams.unstaff(need6(args, "team"), need6(args, "staffingID"), revision(args), { signal });
       return `unstaffed ${staffing.id} (${staffing.sessionID} as ${staffing.role})`;
     }
   },
   {
     name: "team_replace",
     description: `Replace a seat by an existing session (sessionID) or a new launch (launch): the old seat ends at once and the new member gets the slot's next generation. Send the seat's revision (team_status). ${SCOPES}`,
-    properties: { team: TEAM2, staffingID: STRING4, sessionID: STRING4, launch: LAUNCH, expectedRevision: { ...REVISION2, description: "The seat's revision you read (team_status)." } },
+    properties: { team: TEAM2, staffingID: STRING6, sessionID: STRING6, launch: LAUNCH, expectedRevision: { ...REVISION2, description: "The seat's revision you read (team_status)." } },
     required: ["team", "staffingID", "expectedRevision"],
     readOnly: false,
     run: async (hub, args, signal) => {
       const expectedRevision = revision(args);
-      const sessionID = optional5(args, "sessionID");
+      const sessionID = optional6(args, "sessionID");
       const launch = launchOf(args);
       if (sessionID === undefined === (launch === undefined))
         throw new ArgError(`give exactly one of sessionID or launch`);
       const input = sessionID !== undefined ? { expectedRevision, sessionID } : { expectedRevision, launch };
-      const r = await hub.teams.replace(need4(args, "team"), need4(args, "staffingID"), input, { signal });
+      const r = await hub.teams.replace(need6(args, "team"), need6(args, "staffingID"), input, { signal });
       const next = r.staffing ? `${r.staffing.sessionID} (${r.staffing.id}, generation ${r.staffing.generation})` : `launch ${r.launch?.id ?? "?"} (request ${r.request?.id ?? "?"})`;
       return `replaced ${r.ended.sessionID} in ${r.ended.role} by ${next}`;
     }
@@ -7413,13 +7616,13 @@ var teamTools = [
 ];
 
 // packages/cli/src/profiles-mcp.ts
-var STRING5 = { type: "string" };
-var STRINGS2 = { type: "array", items: STRING5 };
+var STRING7 = { type: "string" };
+var STRINGS2 = { type: "array", items: STRING7 };
 var ID4 = { type: "string", description: "The profile's ID (prof_…; see profiles)." };
 var REVISION3 = { type: "integer", minimum: 0, description: "The profile's revision you read (profile_show); a stale one answers conflict with the current revision." };
 var IDEMPOTENCY2 = { type: "string", description: "Idempotency-Key: the same key and arguments within 24 h answer the first result again." };
-var SKILL = { type: "object", properties: { name: { ...STRING5, description: "A slug." }, description: STRING5, body: { ...STRING5, description: "The skill's full text (loaded on demand)." } }, required: ["name", "description", "body"] };
-var COMMAND3 = { type: "object", properties: { name: { ...STRING5, description: "A slug." }, description: STRING5, template: { ...STRING5, description: "Text with {{name}} parameters and {{secret:NAME}} references (never resolved by the hub)." } }, required: ["name", "description", "template"] };
+var SKILL = { type: "object", properties: { name: { ...STRING7, description: "A slug." }, description: STRING7, body: { ...STRING7, description: "The skill's full text (loaded on demand)." } }, required: ["name", "description", "body"] };
+var COMMAND3 = { type: "object", properties: { name: { ...STRING7, description: "A slug." }, description: STRING7, template: { ...STRING7, description: "Text with {{name}} parameters and {{secret:NAME}} references (never resolved by the hub)." } }, required: ["name", "description", "template"] };
 var CONTENT_FIELDS = {
   instructions: { type: ["string", "null"], description: "The profile's instructions (AGENTS.md-like text)." },
   model: { type: ["string", "null"], description: "provider/model the profile suggests." },
@@ -7427,21 +7630,21 @@ var CONTENT_FIELDS = {
   commands: { type: "array", items: COMMAND3, description: "Commands, wholesale." }
 };
 var META_FIELDS = {
-  title: { ...STRING5, description: "1–120 characters." },
-  description: STRING5,
+  title: { ...STRING7, description: "1–120 characters." },
+  description: STRING7,
   tags: { ...STRINGS2, description: "Slugs." },
-  metadata: { type: "object", additionalProperties: STRING5, description: "String key/value pairs (≤ 32 slug keys)." },
+  metadata: { type: "object", additionalProperties: STRING7, description: "String key/value pairs (≤ 32 slug keys)." },
   projects: { ...STRINGS2, description: "Project names the profile is meant for (≤ 16)." }
 };
 var SCOPES2 = "App tokens need scope profiles:read (reads) or profiles:manage (changes; profile_version_create with content fields and the skill/command set/remove tools read the latest version first, so they also need profiles:read); pins need profiles:assign and sessions:read (an app also needs a prompt grant on the session). Session tokens never change profiles. A profile confers no authority.";
 var ArgError2 = ToolArgError;
-var need5 = (args, key) => {
+var need7 = (args, key) => {
   const value = args[key];
   if (typeof value !== "string" || !value.trim())
     throw new ArgError2(`"${key}" is required (a non-empty string)`);
   return value;
 };
-var optional6 = (args, key) => {
+var optional7 = (args, key) => {
   const value = args[key];
   if (value === undefined || value === null)
     return;
@@ -7457,7 +7660,7 @@ var whole2 = (args, key, min, what) => {
 };
 var revision2 = (args) => whole2(args, "expectedRevision", 0, "the revision you read (profile_show; 0 for a session with no pin)");
 var idempotency = (args) => {
-  const key = optional6(args, "idempotencyKey");
+  const key = optional7(args, "idempotencyKey");
   return key ? { idempotencyKey: key } : {};
 };
 var picked2 = (args, keys) => Object.fromEntries(keys.filter((k) => args[k] !== undefined).map((k) => [k, args[k]]));
@@ -7490,7 +7693,7 @@ var contentTool = (name, description, properties, required, change) => ({
   idempotent: true,
   run: async (hub, args, signal) => {
     const expectedRevision = revision2(args);
-    const id = need5(args, "id");
+    const id = need7(args, "id");
     const { latest, content } = await latestContent(hub.profiles, id, signal);
     return versionText(await hub.profiles.createVersion(id, { expectedRevision, content: change(content, args, latest) }, { signal }));
   }
@@ -7510,7 +7713,7 @@ var stateTool = (verb, description) => ({
   idempotent: true,
   run: async (hub, args, signal) => {
     const expectedRevision = revision2(args);
-    const { profile } = await hub.profiles.update(need5(args, "id"), { expectedRevision, state: verb === "archive" ? "archived" : "active" }, { signal });
+    const { profile } = await hub.profiles.update(need7(args, "id"), { expectedRevision, state: verb === "archive" ? "archived" : "active" }, { signal });
     return `${verb === "archive" ? "archived" : "restored"}: ${profileLine(profile)}`;
   }
 });
@@ -7522,7 +7725,7 @@ var profileLifecycleTools = [
     required: ["id"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const { profile, latest } = await hub.profiles.get(need5(args, "id"), { signal });
+      const { profile, latest } = await hub.profiles.get(need7(args, "id"), { signal });
       return [
         profileLine(profile),
         ...profile.description ? [`description: ${one2(profile.description)}`] : [],
@@ -7537,13 +7740,13 @@ var profileLifecycleTools = [
   {
     name: "profile_versions",
     description: `A profile's retained versions, newest first (version, digest, bytes, when, skill and command counts). ${SCOPES2}`,
-    properties: { id: ID4, limit: { type: "integer", minimum: 1, maximum: 200 }, cursor: STRING5 },
+    properties: { id: ID4, limit: { type: "integer", minimum: 1, maximum: 200 }, cursor: STRING7 },
     required: ["id"],
     readOnly: true,
     run: async (hub, args, signal) => {
       const limit = args.limit === undefined ? undefined : whole2(args, "limit", 1, "a whole number from 1 to 200");
-      const cursor = optional6(args, "cursor");
-      const page = await hub.profiles.versions(need5(args, "id"), { signal, ...limit !== undefined ? { limit } : {}, ...cursor ? { cursor } : {} });
+      const cursor = optional7(args, "cursor");
+      const page = await hub.profiles.versions(need7(args, "id"), { signal, ...limit !== undefined ? { limit } : {}, ...cursor ? { cursor } : {} });
       const counts = (v) => v.skills !== undefined ? `  ${v.skills} skills, ${v.commands ?? 0} commands${v.instructions ? ", instructions" : ""}` : "";
       return [...page.items.map((v) => `v${v.version}  ${v.digest.slice(0, 12)}  ${v.bytes} bytes  ${new Date(v.createdAt).toISOString()}${counts(v)}`), ...page.cursor ? [`more: cursor ${page.cursor}`] : []].join(`
 `) || "no versions";
@@ -7552,14 +7755,14 @@ var profileLifecycleTools = [
   {
     name: "profile_create",
     description: `Create a profile: a versioned bundle of instructions, skills and commands, published as version 1 at once. The name is unique per user. Attach it to a team role with team_role_set (profile), pin it with profile_assign. ${SCOPES2}`,
-    properties: { name: { ...STRING5, description: "A slug, unique per user." }, ...META_FIELDS, ...CONTENT_FIELDS, idempotencyKey: IDEMPOTENCY2 },
+    properties: { name: { ...STRING7, description: "A slug, unique per user." }, ...META_FIELDS, ...CONTENT_FIELDS, idempotencyKey: IDEMPOTENCY2 },
     required: ["name", "title"],
     readOnly: false,
     organizes: true,
     idempotent: true,
     run: async (hub, args, signal) => {
-      need5(args, "name");
-      need5(args, "title");
+      need7(args, "name");
+      need7(args, "title");
       const meta = picked2(args, ["name", "title", "description", "tags", "metadata", "projects"]);
       const text = Object.entries(picked2(args, ["instructions", "model"])).filter(([, v]) => v !== null);
       const content = { ...Object.fromEntries(text), skills: args.skills ?? [], commands: args.commands ?? [] };
@@ -7581,7 +7784,7 @@ var profileLifecycleTools = [
       const patch = picked2(args, ["title", "description", "tags", "metadata", "projects"]);
       if (Object.keys(patch).length === 0)
         throw new ArgError2("give at least one field to change");
-      const { profile } = await hub.profiles.update(need5(args, "id"), { expectedRevision, ...patch }, { signal });
+      const { profile } = await hub.profiles.update(need7(args, "id"), { expectedRevision, ...patch }, { signal });
       return `updated: ${profileLine(profile)}`;
     }
   },
@@ -7595,7 +7798,7 @@ var profileLifecycleTools = [
     idempotent: true,
     run: async (hub, args, signal) => {
       const expectedRevision = revision2(args);
-      const id = need5(args, "id");
+      const id = need7(args, "id");
       const given = Object.keys(picked2(args, Object.keys(CONTENT_FIELDS)));
       const options = { signal, ...idempotency(args) };
       if (args.fromVersion !== undefined) {
@@ -7616,77 +7819,225 @@ var profileLifecycleTools = [
       return versionText(await hub.profiles.createVersion(id, { expectedRevision, content: next }, options));
     }
   },
-  contentTool("profile_skill_set", "Attach a skill to a profile, or replace the skill of that name.", { name: { ...STRING5, description: "The skill's name (a slug)." }, description: STRING5, body: { ...STRING5, description: "The skill's full text." } }, ["name", "description", "body"], (content, args) => ({
+  contentTool("profile_skill_set", "Attach a skill to a profile, or replace the skill of that name.", { name: { ...STRING7, description: "The skill's name (a slug)." }, description: STRING7, body: { ...STRING7, description: "The skill's full text." } }, ["name", "description", "body"], (content, args) => ({
     ...content,
-    skills: setNamed(content.skills, { name: need5(args, "name"), description: need5(args, "description"), body: need5(args, "body") })
+    skills: setNamed(content.skills, { name: need7(args, "name"), description: need7(args, "description"), body: need7(args, "body") })
   })),
-  contentTool("profile_skill_remove", "Detach a skill from a profile.", { name: { ...STRING5, description: "The skill's name." } }, ["name"], (content, args, latest) => ({
+  contentTool("profile_skill_remove", "Detach a skill from a profile.", { name: { ...STRING7, description: "The skill's name." } }, ["name"], (content, args, latest) => ({
     ...content,
-    skills: removeNamed(content.skills, need5(args, "name"), "skill", latest)
+    skills: removeNamed(content.skills, need7(args, "name"), "skill", latest)
   })),
-  contentTool("profile_command_set", "Attach a command to a profile, or replace the command of that name.", { name: { ...STRING5, description: "The command's name (a slug)." }, description: STRING5, template: COMMAND3.properties.template }, ["name", "description", "template"], (content, args) => ({ ...content, commands: setNamed(content.commands, { name: need5(args, "name"), description: need5(args, "description"), template: need5(args, "template") }) })),
-  contentTool("profile_command_remove", "Detach a command from a profile.", { name: { ...STRING5, description: "The command's name." } }, ["name"], (content, args, latest) => ({
+  contentTool("profile_command_set", "Attach a command to a profile, or replace the command of that name.", { name: { ...STRING7, description: "The command's name (a slug)." }, description: STRING7, template: COMMAND3.properties.template }, ["name", "description", "template"], (content, args) => ({ ...content, commands: setNamed(content.commands, { name: need7(args, "name"), description: need7(args, "description"), template: need7(args, "template") }) })),
+  contentTool("profile_command_remove", "Detach a command from a profile.", { name: { ...STRING7, description: "The command's name." } }, ["name"], (content, args, latest) => ({
     ...content,
-    commands: removeNamed(content.commands, need5(args, "name"), "command", latest)
+    commands: removeNamed(content.commands, need7(args, "name"), "command", latest)
   })),
   stateTool("archive", "Archive a profile: it takes no new versions or pins; pinned sessions keep theirs; reversible with profile_restore."),
   stateTool("restore", "Restore an archived profile (it takes versions and pins again)."),
   {
     name: "profile_assign",
     description: `Pin a profile version to a session (applied through its machine; the ack tells whether it took). Send the session's pin revision (0 when it has none; see profile). Pinning confers no authority. ${SCOPES2}`,
-    properties: { addr: { ...STRING5, description: "The session: @name, ses_… ID or other address." }, profileID: ID4, version: { type: "integer", minimum: 1 }, expectedRevision: { ...REVISION3, description: "The session's pin revision (0 when it has none)." } },
+    properties: { addr: { ...STRING7, description: "The session: @name, ses_… ID or other address." }, profileID: ID4, version: { type: "integer", minimum: 1 }, expectedRevision: { ...REVISION3, description: "The session's pin revision (0 when it has none)." } },
     required: ["addr", "profileID", "version", "expectedRevision"],
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
       const expectedRevision = revision2(args);
-      const { assignment: a } = await hub.profiles.assign(need5(args, "addr"), { profileID: need5(args, "profileID"), version: whole2(args, "version", 1, "a version number"), expectedRevision }, { signal });
+      const { assignment: a } = await hub.profiles.assign(need7(args, "addr"), { profileID: need7(args, "profileID"), version: whole2(args, "version", 1, "a version number"), expectedRevision }, { signal });
       return `${a.sessionID} pins ${a.profileID} v${a.version} r${a.revision}${a.ack ? `, ack ${a.ack.status}${a.ack.offline ? " (offline)" : ""}` : ""}`;
     }
   },
   {
     name: "profile_unassign",
     description: `Remove a session's pin (what it already applied stays until it restarts). Send the pin's revision (profile_assign's answer). ${SCOPES2}`,
-    properties: { addr: { ...STRING5, description: "The session." }, expectedRevision: { ...REVISION3, description: "The session's pin revision." } },
+    properties: { addr: { ...STRING7, description: "The session." }, expectedRevision: { ...REVISION3, description: "The session's pin revision." } },
     required: ["addr", "expectedRevision"],
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const addr = need5(args, "addr");
+      const addr = need7(args, "addr");
       await hub.profiles.unassign(addr, revision2(args), { signal });
       return `unpinned ${addr}`;
     }
   }
 ];
 
+// packages/cli/src/grants.ts
+var GRANT_FLAGS = {
+  json: "json",
+  holder: "string",
+  project: "multi",
+  allow: "multi",
+  permit: "multi",
+  never: "multi",
+  expires: "string",
+  "max-per-hour": "string",
+  "allow-always": "bool"
+};
+var GRANT_REQUEST_FLAGS = { ...GRANT_FLAGS, "permission-allow": "multi", why: "string" };
+var GRANT_USER_HINT = "only the user manages grants: use the console, or `hub login` with the user's device token";
+function userOnly2(source, what) {
+  if (source === "env")
+    throw new CliError(EXIT.forbidden, `only the user can ${what} a grant, not a session`, GRANT_USER_HINT);
+}
+function grantError(error) {
+  if (error instanceof CliError && error.exit === EXIT.forbidden)
+    return new CliError(error.exit, error.message, [error.hint, GRANT_USER_HINT].filter(Boolean).join("; "), error.envelope);
+  return error;
+}
+var listOf = (flags, name) => (flags[name] ?? []).flatMap((v) => v.split(",")).map((v) => v.trim()).filter(Boolean);
+async function grantSpecArg(flags, stdin) {
+  return await grantArg(flags, stdin, true);
+}
+function grantRequestArg(flags, stdin) {
+  return grantArg(flags, stdin, false);
+}
+async function grantArg(flags, stdin, holderRequired) {
+  const json = typeof flags.json === "string" ? flags.json : undefined;
+  const flagged = Object.keys(GRANT_REQUEST_FLAGS).filter((name) => name !== "json" && name !== "why" && flags[name] !== undefined);
+  if (json !== undefined) {
+    if (flagged.length)
+      throw new UsageError(`give either --json '{…}' or ${flagged.map((f) => `--${f}`).join(", ")}`);
+    return await jsonObjectArg(json, stdin, "grant");
+  }
+  const holder = str(flags, "holder");
+  if (holder === undefined && holderRequired)
+    throw new UsageError("needs --holder (ses_…, @name, @@orchestrator…, or app:<token id>)");
+  const projects = listOf(flags, "project");
+  if (!projects.length)
+    throw new UsageError("needs --project <path> (repeatable)");
+  const allow = listOf(flags, "allow");
+  if (!allow.length)
+    throw new UsageError("needs --allow <verbs> (approve, deny, answer, prompt, stop, roles, launch)");
+  const permit = [...listOf(flags, "permit"), ...listOf(flags, "permission-allow")];
+  const never = listOf(flags, "never");
+  const expires = str(flags, "expires");
+  const cap = str(flags, "max-per-hour");
+  if (cap !== undefined && !/^\d+$/.test(cap))
+    throw new UsageError("--max-per-hour is a whole number");
+  return {
+    ...holder !== undefined ? { holder } : {},
+    scope: { projects },
+    allow,
+    ...permit.length || never.length ? { permissions: { ...permit.length ? { allow: permit } : {}, ...never.length ? { never } : {} } } : {},
+    ...expires !== undefined ? { expires } : {},
+    ...cap !== undefined ? { maxActionsPerHour: Number(cap) } : {},
+    ...flags["allow-always"] === true ? { allowAlways: true } : {}
+  };
+}
+var iso4 = (ms) => new Date(ms).toISOString().replace(/\.\d{3}Z$/, "Z");
+var grantLine = (g) => [g.id, g.state, g.holder, g.allow.join(","), g.scope.projects.join(","), `until ${iso4(g.expiresAt)}`].join("  ");
+var grantsText = (grants) => grants.length ? grants.map(grantLine).join(`
+`) : "no grants";
+function grantText2(g) {
+  const list = (values) => values.length ? values.join(", ") : "none";
+  return [
+    `${g.id}  ${g.state}`,
+    `holder: ${g.holder}${g.holderSessionID && g.holderSessionID !== g.holder ? ` (${g.holderSessionID})` : ""}`,
+    `projects: ${list(g.scope.projects)}`,
+    `verbs: ${list(g.allow)}`,
+    `permissions allow: ${list(g.permissions.allow)}`,
+    `permissions never: ${list(g.permissions.never)}`,
+    `always: ${g.allowAlways ? "yes" : "no"}`,
+    `max actions per hour: ${g.maxActionsPerHour}`,
+    g.revokedAt !== undefined ? `revoked: ${iso4(g.revokedAt)}` : `expires: ${iso4(g.expiresAt)}`
+  ].join(`
+`);
+}
+var requestedText = (body) => `requested; waiting for the user (Decision ${body.decision.id})`;
+
+// packages/cli/src/grants-mcp.ts
+var STRING8 = { type: "string" };
+var GRANT = { type: "object", description: "The grant spec accepted by POST /api/agent/grants: holder (optional for a request), scope.projects, allow, permissions, allowAlways, maxActionsPerHour and expires. The server validates all fields.", additionalProperties: true };
+var need8 = (args, key) => {
+  if (typeof args[key] !== "string" || !args[key].trim())
+    throw new ToolArgError(`"${key}" is required (a non-empty string)`);
+  return args[key];
+};
+var spec = (args) => {
+  if (typeof args.grant !== "object" || args.grant === null || Array.isArray(args.grant))
+    throw new ToolArgError('"grant" is required (an object)');
+  return args.grant;
+};
+var grantTools = [
+  {
+    name: "grant_request",
+    description: "Ask the user for a grant: opens one tap Decision for @me (approve or deny). Sessions and apps with messages:send only; one open request and at most five per hour. Only the user's answer creates authority.",
+    properties: { grant: GRANT, why: STRING8 },
+    required: ["grant", "why"],
+    readOnly: false,
+    run: async (hub, args, signal) => requestedText(await hub.requestGrant(spec(args), need8(args, "why"), { signal }))
+  },
+  {
+    name: "grant_list",
+    description: "List grants (active, expired or revoked) whose holder is this session or app, including grants for roles it holds now. Apps need messages:read. A user credential has no holder: use the console or hub grant list for administration.",
+    properties: {},
+    readOnly: true,
+    run: async (hub, _args, signal) => grantsText((await hub.heldGrants({ signal })).grants)
+  },
+  {
+    name: "grant_show",
+    description: "Show one grant only if this credential currently holds it. Apps need messages:read; another holder's ID answers not_found.",
+    properties: { id: STRING8 },
+    required: ["id"],
+    readOnly: true,
+    run: async (hub, args, signal) => grantText2((await hub.heldGrant(need8(args, "id"), { signal })).grant)
+  },
+  {
+    name: "grant_revoke",
+    description: "Irreversibly revoke a grant held by this session or app (including a held role shared with other holders). Apps need messages:send; another holder's ID answers not_found.",
+    properties: { id: STRING8 },
+    required: ["id"],
+    readOnly: false,
+    run: async (hub, args, signal) => grantText2((await hub.revokeHeldGrant(need8(args, "id"), { signal })).grant)
+  },
+  {
+    name: "grant_create",
+    description: `Create a grant directly ONLY with the user's device credential. Sessions and apps must use grant_request and wait for the user's tap. ${GRANT_USER_HINT}.`,
+    properties: { grant: GRANT },
+    required: ["grant"],
+    readOnly: false,
+    run: async (hub, args, signal) => {
+      const actor = (await hub.whoami({ signal })).actor;
+      if (actor.kind !== "user")
+        throw new CliError(EXIT.forbidden, "only the user can create a grant, not a session or app", GRANT_USER_HINT);
+      try {
+        return grantText2((await hub.createGrant(spec(args), { signal })).grant);
+      } catch (cause) {
+        throw grantError(cause);
+      }
+    }
+  }
+];
+
 // packages/cli/src/watchlist.ts
-var safe = (value) => sanitizeLabel(String(value), 1024);
-var list2 = (items) => items.length ? items.map(safe).join(", ") : "none";
+var safe2 = (value) => sanitizeLabel(String(value), 1024);
+var list2 = (items) => items.length ? items.map(safe2).join(", ") : "none";
 function watchlistConfigText(c) {
   return [
-    `revision ${safe(c.revision)}`,
-    `auto-active: ${c.autoActive ? `on (within ${safe(c.activeWithinHours)} h)` : "off"}  pins: ${c.usePins ? "on" : "off"}`,
+    `revision ${safe2(c.revision)}`,
+    `auto-active: ${c.autoActive ? `on (within ${safe2(c.activeWithinHours)} h)` : "off"}  pins: ${c.usePins ? "on" : "off"}`,
     `sessions: ${list2(c.sessions)}`,
     `projects: ${list2(c.projects)}`,
-    `labels: ${c.labels.length ? c.labels.map((l) => Object.entries(l).map(([k, v]) => `${safe(k)}=${safe(v)}`).join(",")).join("; ") : "none"}`,
+    `labels: ${c.labels.length ? c.labels.map((l) => Object.entries(l).map(([k, v]) => `${safe2(k)}=${safe2(v)}`).join(",")).join("; ") : "none"}`,
     `muted: ${list2(c.muted)}`,
     `muted projects: ${list2(c.mutedProjects)}`
   ].join(`
 `);
 }
 function watchlistText(view) {
-  const rows = view.entries.map((e) => `${safe(e.sessionID)}  ${e.reasons.map(safe).join(",")}${e.lastActiveAt !== undefined ? `  active ${new Date(e.lastActiveAt).toISOString()}` : ""}`);
+  const rows = view.entries.map((e) => `${safe2(e.sessionID)}  ${e.reasons.map(safe2).join(",")}${e.lastActiveAt !== undefined ? `  active ${new Date(e.lastActiveAt).toISOString()}` : ""}`);
   return [watchlistConfigText(view.config), "", view.entries.length ? `watching ${view.entries.length}${view.truncated ? " (truncated)" : ""}:` : "watching nothing", ...rows].join(`
 `);
 }
 function watchlistChangedText(verb, r) {
-  return `${r.changed ? `${verb}` : `already ${verb}`}: ${safe(r.sessionID)} (revision ${safe(r.config.revision)})`;
+  return `${r.changed ? `${verb}` : `already ${verb}`}: ${safe2(r.sessionID)} (revision ${safe2(r.config.revision)})`;
 }
 var PAST = { watch: "watching", unwatch: "not watching", mute: "muted", unmute: "unmuted" };
 var watchlistVerbText = (verb, r) => watchlistChangedText(PAST[verb], r);
 var ADDR = { type: "string", description: "Session address: ses_… (or a unique prefix), @name, @@role, @name.project." };
 var STRINGS3 = { type: "array", items: { type: "string" } };
-var need6 = (args, key) => {
+var need9 = (args, key) => {
   const value = args[key];
   if (typeof value !== "string" || !value.trim())
     throw new ToolArgError(`"${key}" is required (a non-empty string)`);
@@ -7732,13 +8083,13 @@ var watchlistTools = [
         throw new ToolArgError(`"expectedRevision" is required (the revision you read)`);
       const unknown = Object.keys(args).filter((k) => k !== "expectedRevision" && !UPDATE_FIELDS.includes(k));
       if (unknown.length)
-        throw new ToolArgError(`Unknown argument${unknown.length > 1 ? "s" : ""} ${unknown.map((k) => `"${safe(k).slice(0, 40)}"`).join(", ")}: use ${UPDATE_FIELDS.join(", ")} and expectedRevision`);
+        throw new ToolArgError(`Unknown argument${unknown.length > 1 ? "s" : ""} ${unknown.map((k) => `"${safe2(k).slice(0, 40)}"`).join(", ")}: use ${UPDATE_FIELDS.join(", ")} and expectedRevision`);
       const patch = {};
       for (const field of UPDATE_FIELDS)
         if (args[field] !== undefined && args[field] !== null)
           patch[field] = args[field];
       const r = await hub.concierge.watchlist.update(patch, expected, { signal });
-      const head = r.config.revision === expected ? `No change (revision ${safe(expected)})` : `Updated the watchlist (revision ${safe(expected)} → ${safe(r.config.revision)})`;
+      const head = r.config.revision === expected ? `No change (revision ${safe2(expected)})` : `Updated the watchlist (revision ${safe2(expected)} → ${safe2(r.config.revision)})`;
       return `${head}
 ${watchlistConfigText(r.config)}`;
     }
@@ -7753,7 +8104,7 @@ ${watchlistConfigText(r.config)}`;
     idempotent: true,
     run: async (hub, args, signal) => {
       const on = flag(args, "watch", true);
-      const addr = need6(args, "addr");
+      const addr = need9(args, "addr");
       const r = on ? await hub.concierge.watchlist.watch(addr, { signal }) : await hub.concierge.watchlist.unwatch(addr, { signal });
       return watchlistVerbText(on ? "watch" : "unwatch", r);
     }
@@ -7768,7 +8119,7 @@ ${watchlistConfigText(r.config)}`;
     idempotent: true,
     run: async (hub, args, signal) => {
       const on = flag(args, "mute", true);
-      const addr = need6(args, "addr");
+      const addr = need9(args, "addr");
       const r = on ? await hub.concierge.watchlist.mute(addr, { signal }) : await hub.concierge.watchlist.unmute(addr, { signal });
       return watchlistVerbText(on ? "mute" : "unmute", r);
     }
@@ -7779,13 +8130,13 @@ ${watchlistConfigText(r.config)}`;
 var MCP_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
 var RPC = { parse: -32700, invalidRequest: -32600, methodNotFound: -32601, invalidParams: -32602, internal: -32603 };
 var ArgError3 = ToolArgError;
-var need7 = (args, key) => {
+var need10 = (args, key) => {
   const value = args[key];
   if (typeof value !== "string" || !value.trim())
     throw new ArgError3(`"${key}" is required (a non-empty string)`);
   return value;
 };
-var optional7 = (args, key) => {
+var optional8 = (args, key) => {
   const value = args[key];
   if (value === undefined || value === null)
     return;
@@ -7866,7 +8217,7 @@ var sendOptions = (args) => {
   return { ...wake !== undefined ? { wake } : {}, ...urgent !== undefined ? { urgent } : {}, ...notAfter !== undefined ? { notAfter } : {} };
 };
 var whyOption = (args) => {
-  const why = optional7(args, "why");
+  const why = optional8(args, "why");
   return why !== undefined ? { why } : {};
 };
 var optionalDelivery = (args) => {
@@ -7909,35 +8260,35 @@ var definedFields = (fields) => {
   return Object.keys(out).length ? out : undefined;
 };
 function launchSpec(args) {
-  const repo = need7(args, "repo");
+  const repo = need10(args, "repo");
   if (!repo.startsWith("/"))
     throw new ArgError3(`"repo" must be an absolute path on the node`);
   const kind = optionalEnum(args, "runtime", RUNTIME_KINDS);
-  const profile = optional7(args, "profile");
+  const profile = optional8(args, "profile");
   if (profile !== undefined && kind === undefined)
     throw new ArgError3(`"profile" needs "runtime" (e.g. openshell)`);
   const nodeLabels = optionalLabels(args, "nodeLabels");
-  const machine = optional7(args, "machine");
+  const machine = optional8(args, "machine");
   const prefer = optionalBool(args, "prefer") === true;
   if (prefer && machine === undefined && nodeLabels === undefined)
     throw new ArgError3(`"prefer" needs "machine" or "nodeLabels"`);
-  const workspace = { repo, ...definedFields({ mode: optionalEnum(args, "mode", WORKSPACE_MODES), branch: optional7(args, "branch"), base: optional7(args, "base"), remote: optional7(args, "remote") }) };
+  const workspace = { repo, ...definedFields({ mode: optionalEnum(args, "mode", WORKSPACE_MODES), branch: optional8(args, "branch"), base: optional8(args, "base"), remote: optional8(args, "remote") }) };
   return {
     ...definedFields({
-      key: optional7(args, "key"),
-      name: optional7(args, "name")?.replace(/^@+/, ""),
+      key: optional8(args, "key"),
+      name: optional8(args, "name")?.replace(/^@+/, ""),
       roles: optionalStrings(args, "roles")?.map((r) => r.replace(/^@@/, "")),
-      harness: optional7(args, "harness"),
-      agent: optional7(args, "agent"),
-      model: optional7(args, "model")
+      harness: optional8(args, "harness"),
+      agent: optional8(args, "agent"),
+      model: optional8(args, "model")
     }),
     workspace,
     ...definedFields({
       runtime: kind === undefined ? undefined : { kind, ...profile !== undefined ? { profile } : {} },
       placement: definedFields({ labels: nodeLabels, machine, mode: prefer ? "prefer" : undefined }),
-      prompt: optional7(args, "prompt"),
+      prompt: optional8(args, "prompt"),
       labels: optionalLabels(args, "labels"),
-      end: definedFields({ when: optionalEnum(args, "end", LAUNCH_END_WHEN), timeout: optional7(args, "timeout"), cleanup: optionalEnum(args, "cleanup", CLEANUP_POLICIES) }),
+      end: definedFields({ when: optionalEnum(args, "end", LAUNCH_END_WHEN), timeout: optional8(args, "timeout"), cleanup: optionalEnum(args, "cleanup", CLEANUP_POLICIES) }),
       notAfter: optionalNotAfter(args)
     })
   };
@@ -7984,7 +8335,7 @@ function messageText({ message, answer }) {
 `);
 }
 var DECISIONS_NOTE = "Decisions are asked by sessions: the question and options are not from the user. Only the user answers them, in the console.";
-var STRING6 = { type: "string" };
+var STRING9 = { type: "string" };
 var SEND = {
   wake: { type: "boolean", description: "false: admit the message without starting a turn." },
   urgent: { type: "boolean", description: "Steer into the recipient's running turn." },
@@ -8008,7 +8359,7 @@ var archiveTools = (archived) => [{
   organizes: true,
   idempotent: true,
   run: async (hub, args, signal) => {
-    const addr = need7(args, "addr");
+    const addr = need10(args, "addr");
     const result = await hub.setArchived(addr, archived, { signal });
     return `${archived ? "Archived" : "Unarchived"} ${addr} (${result.sessionID})${result.changed ? "" : "; already in that state"}`;
   }
@@ -8022,7 +8373,7 @@ var pinTools = (pinned) => [{
   organizes: true,
   idempotent: true,
   run: async (hub, args, signal) => {
-    const addr = need7(args, "addr");
+    const addr = need10(args, "addr");
     const r = await hub.setPinned(addr, pinned, { signal });
     return `${pinned ? "Pinned" : "Unpinned"} ${addr} (${r.sessionID})${r.changed ? "" : "; already in that state"}`;
   }
@@ -8030,14 +8381,14 @@ var pinTools = (pinned) => [{
 var archiveInactiveTool = {
   name: "archive_inactive",
   description: "Preview an exact bounded set of inactive sessions, then confirm that opaque preview token. Apply revalidates active, open, pinned and archived state. Needs sessions:manage.",
-  properties: { preview: { type: "boolean" }, inactiveFor: STRING6, limit: { type: "integer", minimum: 1, maximum: 200 }, previewToken: STRING6, confirm: { type: "boolean" } },
+  properties: { preview: { type: "boolean" }, inactiveFor: STRING9, limit: { type: "integer", minimum: 1, maximum: 200 }, previewToken: STRING9, confirm: { type: "boolean" } },
   readOnly: false,
   organizes: true,
   run: async (hub, args, signal) => {
     if (args.preview === true)
-      return JSON.stringify(await hub.previewArchiveInactive(need7(args, "inactiveFor"), optionalInt(args, "limit", 1, 200) ?? 50, { signal }));
+      return JSON.stringify(await hub.previewArchiveInactive(need10(args, "inactiveFor"), optionalInt(args, "limit", 1, 200) ?? 50, { signal }));
     if (args.confirm === true)
-      return JSON.stringify(await hub.archiveInactive(need7(args, "previewToken"), { signal }));
+      return JSON.stringify(await hub.archiveInactive(need10(args, "previewToken"), { signal }));
     throw new ArgError3("Use preview:true with inactiveFor, then confirm:true with previewToken");
   }
 };
@@ -8048,19 +8399,19 @@ var intentTools = [
     properties: { addr: ADDR2 },
     required: ["addr"],
     readOnly: true,
-    run: async (hub, args, signal) => intentLine(need7(args, "addr"), (await hub.intent(need7(args, "addr"), { signal })).intent)
+    run: async (hub, args, signal) => intentLine(need10(args, "addr"), (await hub.intent(need10(args, "addr"), { signal })).intent)
   },
   {
     name: "session_intent_set",
     description: "Set (text, one line, at most 280 characters) or clear (clear: true) a session's intent. Users and apps (sessions:manage) set the user's intent; a session token only its own session's. expectedRevision: the revision read (read first when absent); a stale one is a conflict.",
-    properties: { addr: ADDR2, text: STRING6, clear: { type: "boolean" }, expectedRevision: { type: "integer", minimum: 0 } },
+    properties: { addr: ADDR2, text: STRING9, clear: { type: "boolean" }, expectedRevision: { type: "integer", minimum: 0 } },
     required: ["addr"],
     readOnly: false,
     organizes: true,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const addr = need7(args, "addr");
-      const text = optional7(args, "text");
+      const addr = need10(args, "addr");
+      const text = optional8(args, "text");
       const clear = args.clear === true;
       if (clear === (text !== undefined))
         throw new ArgError3('Give "text" or "clear": true');
@@ -8070,22 +8421,22 @@ var intentTools = [
   }
 ];
 var TARGET = { ...ADDR2, description: `${ADDR2.description} Required for an app token; a session token defaults to itself.` };
-var ROLE2 = { ...STRING6, description: "A role (reviewer, @@reviewer or reviewer.project)." };
-var ROLE_PROJECT = { ...STRING6, description: "Scope the role to this project (as role.project)." };
+var ROLE2 = { ...STRING9, description: "A role (reviewer, @@reviewer or reviewer.project)." };
+var ROLE_PROJECT = { ...STRING9, description: "Scope the role to this project (as role.project)." };
 var MANAGE_NOTE = "Needs scope sessions:manage for an app token";
 var roleText2 = (r) => `@@${r.role}${r.project !== undefined ? `.${r.project}` : ""}`;
 var nameTools = [
   {
     name: "name",
     description: `Name a session (@name); as a session, leave addr out to name yourself (a session token names only its own session). Its previous name stays an alias for 24 h. A taken name fails (name_taken); @me is reserved. ${MANAGE_NOTE}.`,
-    properties: { addr: TARGET, name: { ...STRING6, description: "The name: 2–40 characters a-z, 0-9 and - (a leading @ is fine)." } },
+    properties: { addr: TARGET, name: { ...STRING9, description: "The name: 2–40 characters a-z, 0-9 and - (a leading @ is fine)." } },
     required: ["name"],
     readOnly: false,
     organizes: true,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const session = optional7(args, "addr");
-      const r = await hub.name(need7(args, "name"), { ...session ? { session } : {}, signal });
+      const session = optional8(args, "addr");
+      const r = await hub.name(need10(args, "name"), { ...session ? { session } : {}, signal });
       return `Named ${r.sessionID} @${r.name}${r.alias ? ` (@${r.alias} stays an alias for 24 h)` : ""}`;
     }
   },
@@ -8098,9 +8449,9 @@ var nameTools = [
     organizes: true,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const session = optional7(args, "addr");
-      const project = optional7(args, "project");
-      const r = await hub.claimRole(need7(args, "role"), { ...session ? { session } : {}, ...project !== undefined ? { project } : {}, ...optionalBool(args, "exclusive") ? { exclusive: true } : {}, signal });
+      const session = optional8(args, "addr");
+      const project = optional8(args, "project");
+      const r = await hub.claimRole(need10(args, "role"), { ...session ? { session } : {}, ...project !== undefined ? { project } : {}, ...optionalBool(args, "exclusive") ? { exclusive: true } : {}, signal });
       return `${r.sessionID} holds ${roleText2(r)} (generation ${r.generation}${r.exclusive ? ", exclusive" : ""})`;
     }
   },
@@ -8112,9 +8463,9 @@ var nameTools = [
     readOnly: false,
     organizes: true,
     run: async (hub, args, signal) => {
-      const session = optional7(args, "addr");
-      const project = optional7(args, "project");
-      const r = await hub.releaseRole(need7(args, "role"), { ...session ? { session } : {}, ...project !== undefined ? { project } : {}, signal });
+      const session = optional8(args, "addr");
+      const project = optional8(args, "project");
+      const r = await hub.releaseRole(need10(args, "role"), { ...session ? { session } : {}, ...project !== undefined ? { project } : {}, signal });
       return `${r.sessionID} released ${roleText2(r)}`;
     }
   }
@@ -8123,16 +8474,16 @@ var eventsTool = {
   name: "events",
   description: "Compact Hub events (session.*, blocker.*, machine.changed, message.changed, launch.changed, session.archived) after a cursor, as JSON {events, cursor, more, reset, refresh?}. Call without cursor to start at the latest, then pass back the returned cursor. reset:true means the cursor expired: re-read the listed snapshots (status, sessions, inbox, …) and continue with the new cursor. Unknown event types are valid; ignore them. Needs scope events:subscribe (plus each family's scope) for an app token.",
   properties: {
-    cursor: { ...STRING6, description: "The cursor from the previous events answer (hev1_…); omit to start at the latest." },
+    cursor: { ...STRING9, description: "The cursor from the previous events answer (hev1_…); omit to start at the latest." },
     wait: { type: "integer", minimum: 0, maximum: WAIT_POLL_MAX_S, description: `Seconds to wait while nothing matches (0–${WAIT_POLL_MAX_S}).` },
     limit: { type: "integer", minimum: 1, maximum: 200, description: "At most this many events (default 50)." },
-    types: { type: "array", items: STRING6, description: "Only these event types (exact, or a family like launch.*)." },
-    sessions: { type: "array", items: STRING6, description: "Only events of these sessions (ses_…, @name, @@role)." }
+    types: { type: "array", items: STRING9, description: "Only these event types (exact, or a family like launch.*)." },
+    sessions: { type: "array", items: STRING9, description: "Only events of these sessions (ses_…, @name, @@role)." }
   },
   readOnly: true,
   run: async (hub, args, signal) => {
     const page = await hub.events({
-      cursor: optional7(args, "cursor"),
+      cursor: optional8(args, "cursor"),
       wait: optionalInt(args, "wait", 0, WAIT_POLL_MAX_S),
       limit: optionalInt(args, "limit", 1, 200),
       types: optionalStrings(args, "types"),
@@ -8147,13 +8498,13 @@ var webhookTools = [
   {
     name: "webhook_create",
     description: `Create a durable signed webhook for canonical compact events (e.g. launch.*, session.*, message.changed, team.intake). The signing secret is returned only here. Needs events:subscribe plus every selected family's scope; events ["team.intake"] alone needs only teams:submit (an app gets only its own submissions).`,
-    properties: { url: STRING6, events: { type: "array", items: STRING6 }, label: STRING6 },
+    properties: { url: STRING9, events: { type: "array", items: STRING9 }, label: STRING9 },
     required: ["url"],
     readOnly: false,
     run: async (hub, args, signal) => {
       const events = optionalStrings(args, "events");
-      const label = optional7(args, "label");
-      const r = await hub.webhookCreate({ url: need7(args, "url"), ...events ? { events } : {}, ...label ? { label } : {} }, { signal });
+      const label = optional8(args, "label");
+      const r = await hub.webhookCreate({ url: need10(args, "url"), ...events ? { events } : {}, ...label ? { label } : {} }, { signal });
       return `${webhookText(r.webhook)}
 signing secret (shown once): ${r.secret}`;
     }
@@ -8172,11 +8523,11 @@ signing secret (shown once): ${r.secret}`;
   {
     name: "webhook_show",
     description: "Show one webhook and its retained delivery attempts; never its secret.",
-    properties: { id: STRING6 },
+    properties: { id: STRING9 },
     required: ["id"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const r = await hub.webhook(need7(args, "id"), { signal });
+      const r = await hub.webhook(need10(args, "id"), { signal });
       return `${webhookText(r.webhook)}
 ${JSON.stringify(r.deliveries)}`;
     }
@@ -8184,20 +8535,20 @@ ${JSON.stringify(r.deliveries)}`;
   {
     name: "webhook_delete",
     description: "Delete one webhook and its pending deliveries.",
-    properties: { id: STRING6 },
+    properties: { id: STRING9 },
     required: ["id"],
     readOnly: false,
     organizes: true,
     idempotent: false,
     run: async (hub, args, signal) => {
-      const id = need7(args, "id");
+      const id = need10(args, "id");
       await hub.webhookDelete(id, { signal });
       return `Deleted webhook ${id}`;
     }
   }
 ];
 async function profileTarget(hub, args, signal) {
-  const addr = optional7(args, "addr");
+  const addr = optional8(args, "addr");
   if (addr)
     return addr;
   const { actor } = await hub.whoami({ signal });
@@ -8236,11 +8587,11 @@ var profileTools = [
   {
     name: "profile_skill",
     description: "Load one skill's full text from the profile pinned to a session (your own by default), on demand.",
-    properties: { name: STRING6, addr: ADDR2 },
+    properties: { name: STRING9, addr: ADDR2 },
     required: ["name"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const r = await hub.profiles.sessionSkill(await profileTarget(hub, args, signal), need7(args, "name"), { signal });
+      const r = await hub.profiles.sessionSkill(await profileTarget(hub, args, signal), need10(args, "name"), { signal });
       return `skill ${r.skill.name} (${r.profileID} v${r.version}):
 ${sanitizeText(r.skill.body)}`;
     }
@@ -8248,11 +8599,11 @@ ${sanitizeText(r.skill.body)}`;
   {
     name: "profile_command",
     description: "Render one command of the profile pinned to a session (your own by default) with its {{name}} parameters. Returns the text only: nothing is sent. {{secret:NAME}} references stay unresolved.",
-    properties: { name: STRING6, params: { type: "object", additionalProperties: STRING6, description: "Parameter name → text value." }, addr: ADDR2 },
+    properties: { name: STRING9, params: { type: "object", additionalProperties: STRING9, description: "Parameter name → text value." }, addr: ADDR2 },
     required: ["name"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const r = await hub.profiles.sessionRender(await profileTarget(hub, args, signal), need7(args, "name"), optionalParams(args), { signal });
+      const r = await hub.profiles.sessionRender(await profileTarget(hub, args, signal), need10(args, "name"), optionalParams(args), { signal });
       return r.prompt;
     }
   },
@@ -8271,13 +8622,13 @@ ${sanitizeText(r.skill.body)}`;
   {
     name: "profile_usage",
     description: "Where one profile is used: pinned sessions (requested vs running version, ack, presence, harness), team roles naming it, launches that named it and the sessions' workspaces, with counts. An app token needs profiles:read, plus sessions:read / teams:read / sessions:launch (its own launches) / workspaces:read for each part; parts it may not read are listed as hidden.",
-    properties: { id: STRING6, limit: { type: "integer", minimum: 1, maximum: 200, description: "Sessions per page (default 50)." }, cursor: STRING6 },
+    properties: { id: STRING9, limit: { type: "integer", minimum: 1, maximum: 200, description: "Sessions per page (default 50)." }, cursor: STRING9 },
     required: ["id"],
     readOnly: true,
     run: async (hub, args, signal) => {
       const limit = optionalInt(args, "limit", 1, 200);
-      const cursor = optional7(args, "cursor");
-      const u = await hub.profiles.usage(need7(args, "id"), { ...limit !== undefined ? { limit } : {}, ...cursor ? { cursor } : {}, signal });
+      const cursor = optional8(args, "cursor");
+      const u = await hub.profiles.usage(need10(args, "id"), { ...limit !== undefined ? { limit } : {}, ...cursor ? { cursor } : {}, signal });
       const c = u.counts;
       const plural = (n, word, many = `${word}s`) => `${n} ${n === 1 ? word : many}`;
       const lines = [`${u.profileID} (latest v${u.latestVersion})`];
@@ -8320,7 +8671,7 @@ var needRevision = (args, key = "expectedRevision") => {
   return value;
 };
 var idemOption = (args) => {
-  const key = optional7(args, "idempotencyKey");
+  const key = optional8(args, "idempotencyKey");
   return key !== undefined ? { idempotencyKey: key } : {};
 };
 var WORKSPACE = { type: "string", description: "The workspace's ID (ws_…)." };
@@ -8350,7 +8701,7 @@ var workspaceTools = [
     required: ["workspace"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const id = need7(args, "workspace");
+      const id = need10(args, "workspace");
       const [{ workspace, bindings }, { members }, graph] = await Promise.all([hub.workspaces.get(id, { signal }), hub.workspaces.members(id, { signal }), hub.workspaces.supervision(id, { signal })]);
       const lines = [wsLine(workspace)];
       if (workspace.masterMemberID)
@@ -8366,27 +8717,27 @@ var workspaceTools = [
   {
     name: "workspace_create",
     description: `Create a coordination workspace. ${WS_SCOPES}`,
-    properties: { title: STRING6, description: STRING6, tags: { type: "array", items: STRING6 }, idempotencyKey: IDEMPOTENCY3 },
+    properties: { title: STRING9, description: STRING9, tags: { type: "array", items: STRING9 }, idempotencyKey: IDEMPOTENCY3 },
     required: ["title"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const description = optional7(args, "description");
+      const description = optional8(args, "description");
       const tags = optionalStrings(args, "tags");
-      const { workspace } = await hub.workspaces.create({ title: need7(args, "title"), ...description ? { description } : {}, ...tags ? { tags } : {} }, { ...idemOption(args), signal });
+      const { workspace } = await hub.workspaces.create({ title: need10(args, "title"), ...description ? { description } : {}, ...tags ? { tags } : {} }, { ...idemOption(args), signal });
       return `created ${wsLine(workspace)}`;
     }
   },
   {
     name: "workspace_update",
     description: `Change a workspace's title, description or tags under its revision. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, expectedRevision: REVISION4, title: STRING6, description: STRING6, tags: { type: "array", items: STRING6 } },
+    properties: { workspace: WORKSPACE, expectedRevision: REVISION4, title: STRING9, description: STRING9, tags: { type: "array", items: STRING9 } },
     required: ["workspace", "expectedRevision"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const patch = definedFields({ title: optional7(args, "title"), description: optional7(args, "description"), tags: optionalStrings(args, "tags") });
+      const patch = definedFields({ title: optional8(args, "title"), description: optional8(args, "description"), tags: optionalStrings(args, "tags") });
       if (!patch)
         throw new ArgError3(`give "title", "description" or "tags"`);
-      const { workspace } = await hub.workspaces.update(need7(args, "workspace"), { expectedRevision: needRevision(args), ...patch }, { signal });
+      const { workspace } = await hub.workspaces.update(need10(args, "workspace"), { expectedRevision: needRevision(args), ...patch }, { signal });
       return `updated ${wsLine(workspace)}`;
     }
   },
@@ -8398,7 +8749,7 @@ var workspaceTools = [
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const id = need7(args, "workspace");
+      const id = need10(args, "workspace");
       if (verb === "archive") {
         const r = await hub.workspaces.archive(id, needRevision(args), { signal });
         return `archived ${wsLine(r.workspace)}; ${r.departed} member(s) departed, ${r.supervision.detached} supervision link(s) detached`;
@@ -8409,31 +8760,31 @@ var workspaceTools = [
   {
     name: "workspace_bind",
     description: `Bind a workspace to a repository (absolute path) on one of the user's machines. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, machineID: STRING6, repo: STRING6, label: STRING6, idempotencyKey: IDEMPOTENCY3 },
+    properties: { workspace: WORKSPACE, machineID: STRING9, repo: STRING9, label: STRING9, idempotencyKey: IDEMPOTENCY3 },
     required: ["workspace", "machineID", "repo"],
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const label = optional7(args, "label");
-      const r = await hub.workspaces.bind(need7(args, "workspace"), { machineID: need7(args, "machineID"), repo: need7(args, "repo"), ...label ? { label } : {} }, { ...idemOption(args), signal });
+      const label = optional8(args, "label");
+      const r = await hub.workspaces.bind(need10(args, "workspace"), { machineID: need10(args, "machineID"), repo: need10(args, "repo"), ...label ? { label } : {} }, { ...idemOption(args), signal });
       return `${r.created ? "bound" : "already bound"} ${r.binding.id}  ${r.binding.machineID}:${r.binding.repo}  r${r.binding.revision}`;
     }
   },
   {
     name: "workspace_unbind",
     description: `Remove a repository binding under the binding's revision. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, bindingID: STRING6, expectedRevision: REVISION4 },
+    properties: { workspace: WORKSPACE, bindingID: STRING9, expectedRevision: REVISION4 },
     required: ["workspace", "bindingID", "expectedRevision"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      await hub.workspaces.unbind(need7(args, "workspace"), need7(args, "bindingID"), needRevision(args), { signal });
-      return `unbound ${need7(args, "bindingID")}`;
+      await hub.workspaces.unbind(need10(args, "workspace"), need10(args, "bindingID"), needRevision(args), { signal });
+      return `unbound ${need10(args, "bindingID")}`;
     }
   },
   {
     name: "workspace_join",
     description: `Add a session (ses_…) to a workspace as worker or observer (the master is set by explicit replacement). ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, sessionID: STRING6, role: { type: "string", enum: [...MEMBER_ROLES] }, idempotencyKey: IDEMPOTENCY3 },
+    properties: { workspace: WORKSPACE, sessionID: STRING9, role: { type: "string", enum: [...MEMBER_ROLES] }, idempotencyKey: IDEMPOTENCY3 },
     required: ["workspace", "sessionID", "role"],
     readOnly: false,
     idempotent: true,
@@ -8441,45 +8792,45 @@ var workspaceTools = [
       const role = optionalEnum(args, "role", MEMBER_ROLES);
       if (!role)
         throw new ArgError3(`"role" is one of ${MEMBER_ROLES.join(", ")}`);
-      const { member, created } = await hub.workspaces.join(need7(args, "workspace"), { sessionID: need7(args, "sessionID"), role }, { ...idemOption(args), signal });
+      const { member, created } = await hub.workspaces.join(need10(args, "workspace"), { sessionID: need10(args, "sessionID"), role }, { ...idemOption(args), signal });
       return `member ${member.id} (${member.sessionID}, ${member.role}, generation ${member.generation}, r${member.revision}) ${created ? "joined" : "was already a member"}`;
     }
   },
   {
     name: "workspace_leave",
     description: `Remove a member under its revision; its supervision links are detached. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, memberID: STRING6, expectedRevision: REVISION4 },
+    properties: { workspace: WORKSPACE, memberID: STRING9, expectedRevision: REVISION4 },
     required: ["workspace", "memberID", "expectedRevision"],
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const r = await hub.workspaces.leave(need7(args, "workspace"), need7(args, "memberID"), needRevision(args), { signal });
+      const r = await hub.workspaces.leave(need10(args, "workspace"), need10(args, "memberID"), needRevision(args), { signal });
       return `member ${r.member.id} left (${r.member.leftReason ?? "removed"}); ${r.supervision.detached} supervision link(s) detached`;
     }
   },
   {
     name: "workspace_assign",
     description: `Give a current member an assignment (title and optional outcome criteria; instructions travel as messages). ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, memberID: STRING6, title: STRING6, criteria: { type: "array", items: STRING6 }, ref: STRING6, idempotencyKey: IDEMPOTENCY3 },
+    properties: { workspace: WORKSPACE, memberID: STRING9, title: STRING9, criteria: { type: "array", items: STRING9 }, ref: STRING9, idempotencyKey: IDEMPOTENCY3 },
     required: ["workspace", "memberID", "title"],
     readOnly: false,
     run: async (hub, args, signal) => {
       const criteria = optionalStrings(args, "criteria");
-      const ref = optional7(args, "ref");
-      const { assignment } = await hub.workspaces.assign(need7(args, "workspace"), { memberID: need7(args, "memberID"), title: need7(args, "title"), ...criteria ? { criteria } : {}, ...ref ? { ref } : {} }, { ...idemOption(args), signal });
+      const ref = optional8(args, "ref");
+      const { assignment } = await hub.workspaces.assign(need10(args, "workspace"), { memberID: need10(args, "memberID"), title: need10(args, "title"), ...criteria ? { criteria } : {}, ...ref ? { ref } : {} }, { ...idemOption(args), signal });
       return `assignment ${assignment.id} → ${assignment.memberID}: ${assignment.status}, r${assignment.revision}`;
     }
   },
   {
     name: "workspace_assignments",
     description: `A workspace's assignments (id, member, status, revision, title), optionally one member's or one status. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, memberID: STRING6, status: { type: "string", enum: [...ASSIGNMENT_STATUSES] } },
+    properties: { workspace: WORKSPACE, memberID: STRING9, status: { type: "string", enum: [...ASSIGNMENT_STATUSES] } },
     required: ["workspace"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const memberID = optional7(args, "memberID");
+      const memberID = optional8(args, "memberID");
       const status = optionalEnum(args, "status", ASSIGNMENT_STATUSES);
-      const r = await hub.workspaces.assignments(need7(args, "workspace"), { ...memberID ? { memberID } : {}, ...status ? { status } : {}, limit: 200, signal });
+      const r = await hub.workspaces.assignments(need10(args, "workspace"), { ...memberID ? { memberID } : {}, ...status ? { status } : {}, limit: 200, signal });
       return r.items.length ? r.items.map((v) => `${v.assignment.id}  ${v.assignment.memberID} (${v.member}, ${v.presence})  ${v.assignment.status}  r${v.assignment.revision}  ${oneLine(sanitizeText(v.assignment.title))}`).join(`
 `) : "no assignments";
     }
@@ -8487,16 +8838,16 @@ var workspaceTools = [
   {
     name: "workspace_assignment_update",
     description: `Set an assignment's status (done and cancelled are final) or move it to another current member, under its revision. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, assignmentID: STRING6, expectedRevision: REVISION4, status: { type: "string", enum: [...ASSIGNMENT_STATUSES] }, memberID: STRING6 },
+    properties: { workspace: WORKSPACE, assignmentID: STRING9, expectedRevision: REVISION4, status: { type: "string", enum: [...ASSIGNMENT_STATUSES] }, memberID: STRING9 },
     required: ["workspace", "assignmentID", "expectedRevision"],
     readOnly: false,
     run: async (hub, args, signal) => {
       const status = optionalEnum(args, "status", ASSIGNMENT_STATUSES);
-      const memberID = optional7(args, "memberID");
+      const memberID = optional8(args, "memberID");
       if (status === undefined === (memberID === undefined))
         throw new ArgError3(`give exactly one of "status" or "memberID"`);
-      const id = need7(args, "workspace");
-      const assignmentID = need7(args, "assignmentID");
+      const id = need10(args, "workspace");
+      const assignmentID = need10(args, "assignmentID");
       const { assignment } = status !== undefined ? await hub.workspaces.setAssignmentStatus(id, assignmentID, status, needRevision(args), { signal }) : await hub.workspaces.reassign(id, assignmentID, memberID, needRevision(args), { signal });
       return `assignment ${assignment.id} → ${assignment.memberID}: ${assignment.status}, r${assignment.revision}`;
     }
@@ -8504,16 +8855,16 @@ var workspaceTools = [
   {
     name: "workspace_supervise",
     description: `Set who supervises a member (supervisor null detaches), under the supervision graph's revision (workspace_show). Acyclic, at most 6 levels. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, memberID: STRING6, supervisor: { type: ["string", "null"], description: "The supervising member's ID, or null to detach." }, order: { type: "number" }, expectedRevision: REVISION4 },
+    properties: { workspace: WORKSPACE, memberID: STRING9, supervisor: { type: ["string", "null"], description: "The supervising member's ID, or null to detach." }, order: { type: "number" }, expectedRevision: REVISION4 },
     required: ["workspace", "memberID", "supervisor", "expectedRevision"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const supervisor = args.supervisor === null ? null : need7(args, "supervisor");
+      const supervisor = args.supervisor === null ? null : need10(args, "supervisor");
       const order = args.order;
       if (order !== undefined && (typeof order !== "number" || !Number.isFinite(order)))
         throw new ArgError3(`"order" must be a number`);
-      const r = await hub.workspaces.supervise(need7(args, "workspace"), { memberID: need7(args, "memberID"), supervisorMemberID: supervisor, ...order !== undefined ? { order } : {}, expectedRevision: needRevision(args) }, { signal });
-      return `${r.change}: ${need7(args, "memberID")}${r.link ? ` ← ${r.link.supervisorMemberID} (order ${r.link.order})` : ""}; supervision revision ${r.revision}${r.pruned ? `, ${r.pruned} stale link(s) dropped` : ""}`;
+      const r = await hub.workspaces.supervise(need10(args, "workspace"), { memberID: need10(args, "memberID"), supervisorMemberID: supervisor, ...order !== undefined ? { order } : {}, expectedRevision: needRevision(args) }, { signal });
+      return `${r.change}: ${need10(args, "memberID")}${r.link ? ` ← ${r.link.supervisorMemberID} (order ${r.link.order})` : ""}; supervision revision ${r.revision}${r.pruned ? `, ${r.pruned} stale link(s) dropped` : ""}`;
     }
   },
   {
@@ -8523,7 +8874,7 @@ var workspaceTools = [
     required: ["workspace"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const v = await hub.workspaces.master(need7(args, "workspace"), { signal });
+      const v = await hub.workspaces.master(need10(args, "workspace"), { signal });
       const line = (m) => `${m.member.id}  ${m.member.sessionID}  generation ${m.member.generation}  ${m.presence}${m.member.leftReason ? `  (${m.member.leftReason})` : ""}`;
       return [
         `workspace ${v.workspaceID} r${v.revision}`,
@@ -8537,17 +8888,17 @@ var workspaceTools = [
   {
     name: "workspace_master_replace",
     description: `Replace (or first set) a workspace's master under the workspace revision: a session (ses_…) or a running launch's session (launchID). The old master departs as replaced; its supervised members move to the new one. No grants move: the new master's session needs its own grants. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, sessionID: STRING6, launchID: STRING6, expectedRevision: REVISION4, idempotencyKey: IDEMPOTENCY3 },
+    properties: { workspace: WORKSPACE, sessionID: STRING9, launchID: STRING9, expectedRevision: REVISION4, idempotencyKey: IDEMPOTENCY3 },
     required: ["workspace", "expectedRevision"],
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const sessionID = optional7(args, "sessionID");
-      const launchID = optional7(args, "launchID");
+      const sessionID = optional8(args, "sessionID");
+      const launchID = optional8(args, "launchID");
       if (sessionID === undefined === (launchID === undefined))
         throw new ArgError3(`give exactly one of "sessionID" or "launchID"`);
       const target = sessionID !== undefined ? { sessionID } : { launchID };
-      const r = await hub.workspaces.replaceMaster(need7(args, "workspace"), { ...target, expectedRevision: needRevision(args) }, { ...idemOption(args), signal });
+      const r = await hub.workspaces.replaceMaster(need10(args, "workspace"), { ...target, expectedRevision: needRevision(args) }, { ...idemOption(args), signal });
       if (!r.changed)
         return `${r.master.sessionID} already is the master (${r.master.id}); nothing changed`;
       return [
@@ -8565,7 +8916,7 @@ var workspaceTools = [
     required: ["workspace"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const b = await hub.workspaces.board(need7(args, "workspace"), { signal });
+      const b = await hub.workspaces.board(need10(args, "workspace"), { signal });
       const more = (truncated) => truncated ? "  (more not shown)" : "";
       const section = (name, s, line) => s.status === "ok" ? [`${name}:${more(s.truncated)}`, ...s.items.map((i) => `  ${line(i)}`)] : [`${name}: ${s.status}${s.status === "omitted" ? ` (needs ${s.scope})` : ""}`];
       const lines = [wsLine(b.workspace), ...b.workspace.masterMemberID ? [`master: ${b.workspace.masterMemberID}`] : []];
@@ -8591,10 +8942,13 @@ var TOOLS = [
   ...webhookTools,
   ...profileTools,
   ...profileLifecycleTools,
+  ...grantTools,
   ...workspaceTools,
   ...artifactTools,
   ...artifactJobTools,
   ...teamIntakeTools,
+  ...subscriptionTools,
+  ...operationTools,
   ...teamTools,
   ...watchlistTools,
   {
@@ -8615,14 +8969,14 @@ var TOOLS = [
     name: "sessions",
     description: "The sessions as a flat list, optionally filtered.",
     properties: {
-      project: { ...STRING6, description: "Only this project." },
-      state: { ...STRING6, description: "Only these states (comma-separated, e.g. busy,blocked)." },
-      machine: { ...STRING6, description: "Only this machine." },
-      label: { type: "array", items: STRING6, description: "key=value labels that must all match." }
+      project: { ...STRING9, description: "Only this project." },
+      state: { ...STRING9, description: "Only these states (comma-separated, e.g. busy,blocked)." },
+      machine: { ...STRING9, description: "Only this machine." },
+      label: { type: "array", items: STRING9, description: "key=value labels that must all match." }
     },
     readOnly: true,
     run: async (hub, args, signal) => {
-      const body = await hub.sessions({ project: optional7(args, "project"), state: optional7(args, "state"), machine: optional7(args, "machine"), label: optionalStrings(args, "label"), signal });
+      const body = await hub.sessions({ project: optional8(args, "project"), state: optional8(args, "state"), machine: optional8(args, "machine"), label: optionalStrings(args, "label"), signal });
       return sessionsText(body.sessions ?? []);
     }
   },
@@ -8632,7 +8986,7 @@ var TOOLS = [
     properties: { addr: ADDR2 },
     required: ["addr"],
     readOnly: true,
-    run: async (hub, args, signal) => showText(await hub.show(need7(args, "addr"), { signal }))
+    run: async (hub, args, signal) => showText(await hub.show(need10(args, "addr"), { signal }))
   },
   {
     name: "log",
@@ -8641,7 +8995,7 @@ var TOOLS = [
     required: ["addr"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const addr = need7(args, "addr");
+      const addr = need10(args, "addr");
       const n = optionalInt(args, "n", 1, 200);
       return logText((await hub.log(addr, { ...n !== undefined ? { n } : {}, signal })).rows ?? []);
     }
@@ -8650,25 +9004,25 @@ var TOOLS = [
     name: "who",
     description: "Named and role-holding sessions; a team member sees its teams, grouped by team with its reach to each.",
     properties: {
-      project: { ...STRING6, description: "Only this project." },
-      role: { ...STRING6, description: "Only holders of this role (reviewer, @@reviewer or reviewer#team)." },
-      team: { ...STRING6, description: "Only this team (name or ID)." }
+      project: { ...STRING9, description: "Only this project." },
+      role: { ...STRING9, description: "Only holders of this role (reviewer, @@reviewer or reviewer#team)." },
+      team: { ...STRING9, description: "Only this team (name or ID)." }
     },
     readOnly: true,
     run: async (hub, args, signal) => {
-      const body = await hub.who({ project: optional7(args, "project"), role: optional7(args, "role"), team: optional7(args, "team"), signal });
+      const body = await hub.who({ project: optional8(args, "project"), role: optional8(args, "role"), team: optional8(args, "team"), signal });
       return whoText(body.sessions ?? [], body);
     }
   },
   {
     name: "msg",
     description: "Tell a session something (fire and forget). Sent as this server's credential, not as an OpenCode session.",
-    properties: { to: TO, text: { ...STRING6, description: "The message." }, ...SEND, idempotencyKey: IDEMPOTENCY3 },
+    properties: { to: TO, text: { ...STRING9, description: "The message." }, ...SEND, idempotencyKey: IDEMPOTENCY3 },
     required: ["to", "text"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const to = need7(args, "to");
-      const text = need7(args, "text");
+      const to = need10(args, "to");
+      const text = need10(args, "text");
       const options = { ...sendOptions(args), ...idemOption(args), signal };
       if (optionalBool(args, "all"))
         return sentAllText(await hub.msg(to, text, { ...options, all: true }));
@@ -8680,7 +9034,7 @@ var TOOLS = [
     description: `Ask a session a question, tracked until answered, declined or expired. wait (at most ${WAIT_POLL_MAX_S} s) blocks for the answer; otherwise it shows up in the inbox tool.`,
     properties: {
       to: TO,
-      text: { ...STRING6, description: "The question." },
+      text: { ...STRING9, description: "The question." },
       wait: { type: "number", minimum: 0, maximum: WAIT_POLL_MAX_S, description: `Seconds to wait for the answer (0–${WAIT_POLL_MAX_S}).` },
       expires: { type: ["number", "string"], description: "When the ask expires: seconds, or 30s, 5m, 2h, 1d (1 minute to 7 days; default 24 h)." },
       ...SEND,
@@ -8689,8 +9043,8 @@ var TOOLS = [
     required: ["to", "text"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const to = need7(args, "to");
-      const text = need7(args, "text");
+      const to = need10(args, "to");
+      const text = need10(args, "text");
       const wait = optionalWait(args);
       const expires = optionalExpires(args);
       const options = { ...sendOptions(args), ...expires !== undefined ? { expires } : {}, ...idemOption(args), signal };
@@ -8708,12 +9062,12 @@ ${openedText(asked.decision)}` : outcome;
   {
     name: "reply",
     description: "Reply to a message you received; it goes to the message's real sender.",
-    properties: { id: MSG_ID, text: { ...STRING6, description: "The reply." }, wake: SEND.wake },
+    properties: { id: MSG_ID, text: { ...STRING9, description: "The reply." }, wake: SEND.wake },
     required: ["id", "text"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const id = need7(args, "id");
-      const text = need7(args, "text");
+      const id = need10(args, "id");
+      const text = need10(args, "text");
       const wake = optionalBool(args, "wake");
       return repliedText(await hub.reply(id, text, { ...wake !== undefined ? { wake } : {}, signal }));
     }
@@ -8721,12 +9075,12 @@ ${openedText(asked.decision)}` : outcome;
   {
     name: "decline",
     description: "Decline an ask you received, with a reason.",
-    properties: { id: MSG_ID, why: { ...STRING6, description: "The reason." } },
+    properties: { id: MSG_ID, why: { ...STRING9, description: "The reason." } },
     required: ["id", "why"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const id = need7(args, "id");
-      return declinedText(await hub.decline(id, need7(args, "why"), { signal }));
+      const id = need10(args, "id");
+      return declinedText(await hub.decline(id, need10(args, "why"), { signal }));
     }
   },
   {
@@ -8746,7 +9100,7 @@ ${openedText(asked.decision)}` : outcome;
     required: ["id"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const id = need7(args, "id");
+      const id = need10(args, "id");
       const wait = optionalWait(args);
       return messageText(await hub.message(id, { ...wait !== undefined ? { wait } : {}, signal }));
     }
@@ -8759,7 +9113,7 @@ ${openedText(asked.decision)}` : outcome;
     readOnly: false,
     organizes: true,
     idempotent: true,
-    run: async (hub, args, signal) => mutedText((await hub[verb](need7(args, "addr"), { signal })).muted)
+    run: async (hub, args, signal) => mutedText((await hub[verb](need10(args, "addr"), { signal })).muted)
   })),
   {
     name: "decisions",
@@ -8767,7 +9121,7 @@ ${openedText(asked.decision)}` : outcome;
     properties: { state: { type: "string", enum: [...DECISION_STATES], description: "Only Decisions in this state." } },
     readOnly: true,
     run: async (hub, args, signal) => {
-      const state = optional7(args, "state");
+      const state = optional8(args, "state");
       if (state !== undefined && !DECISION_STATES.includes(state))
         throw new ArgError3(`"state" is one of ${DECISION_STATES.join(", ")}`);
       const { decisions } = await hub.decisions({ ...state ? { state } : {}, signal });
@@ -8782,7 +9136,7 @@ ${decisionsText(decisions)}` : decisionsText(decisions);
     required: ["id"],
     readOnly: true,
     run: async (hub, args, signal) => `${DECISIONS_NOTE}
-${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
+${decisionText((await hub.decision(need10(args, "id"), { signal })).decision)}`
   },
   {
     name: "approve",
@@ -8791,8 +9145,8 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     required: ["addr", "requestID"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const addr = need7(args, "addr");
-      const requestID = need7(args, "requestID");
+      const addr = need10(args, "addr");
+      const requestID = need10(args, "requestID");
       const always = optionalBool(args, "always");
       return approvedText(await hub.approve(addr, requestID, { ...always ? { always } : {}, ...whyOption(args), signal }));
     }
@@ -8804,8 +9158,8 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     required: ["addr", "requestID"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const addr = need7(args, "addr");
-      const requestID = need7(args, "requestID");
+      const addr = need10(args, "addr");
+      const requestID = need10(args, "requestID");
       return deniedText(await hub.deny(addr, requestID, { ...whyOption(args), signal }));
     }
   },
@@ -8822,8 +9176,8 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     required: ["addr", "formID"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const addr = need7(args, "addr");
-      const formID = need7(args, "formID");
+      const addr = need10(args, "addr");
+      const formID = need10(args, "formID");
       const given = formAnswer(args);
       const options = { ...whyOption(args), signal };
       return answeredText(given === "cancel" ? await hub.cancelForm(addr, formID, options) : await hub.answer(addr, formID, given, options), given === "cancel");
@@ -8834,15 +9188,15 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     description: `Prompt a session (an agent's prompt carries the hub's provenance). ${NEEDS_USER}`,
     properties: {
       addr: ADDR2,
-      text: { ...STRING6, description: "The prompt." },
+      text: { ...STRING9, description: "The prompt." },
       delivery: { type: "string", enum: [...DELIVERIES], description: "How it enters a busy session (the spoke picks when unset)." },
       why: WHY
     },
     required: ["addr", "text"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const addr = need7(args, "addr");
-      const text = need7(args, "text");
+      const addr = need10(args, "addr");
+      const text = need10(args, "text");
       const delivery = optionalDelivery(args);
       return promptedText(await hub.prompt(addr, text, { ...delivery ? { delivery } : {}, ...whyOption(args), signal }));
     }
@@ -8853,32 +9207,32 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     properties: { addr: ADDR2, why: WHY },
     required: ["addr"],
     readOnly: false,
-    run: async (hub, args, signal) => stoppedText(await hub.stop(need7(args, "addr"), { ...whyOption(args), signal }))
+    run: async (hub, args, signal) => stoppedText(await hub.stop(need10(args, "addr"), { ...whyOption(args), signal }))
   },
   {
     name: "launch",
     description: "Start a new session on a node (a hub node with the repo under its workspace roots). The same key again answers the same launch. With notAfter, a launch still waiting for a machine at that time is never started (it ends expired). Needs an app token with scope sessions:launch and a grant with verb launch covering the repo.",
     properties: {
-      repo: { ...STRING6, description: "Absolute path of the repository on the node (or where a clone goes)." },
+      repo: { ...STRING9, description: "Absolute path of the repository on the node (or where a clone goes)." },
       mode: { type: "string", enum: [...WORKSPACE_MODES], description: "worktree (default: <repo>/.worktrees/<branch>, needs branch), checkout, or clone (needs remote)." },
-      branch: { ...STRING6, description: "The branch to create or check out." },
-      base: { ...STRING6, description: "What a new branch starts from." },
-      remote: { ...STRING6, description: "An https or ssh git remote (for clone)." },
-      key: { ...STRING6, description: "Idempotency key: retrying with the same key and arguments answers the same launch." },
-      name: { ...STRING6, description: "The session's @name." },
-      roles: { type: "array", items: STRING6, description: "Roles the session claims (e.g. reviewer.hub)." },
-      harness: { ...STRING6, description: "The harness (default opencode)." },
-      agent: { ...STRING6, description: "The harness agent (e.g. build)." },
-      model: { ...STRING6, description: "provider/model." },
+      branch: { ...STRING9, description: "The branch to create or check out." },
+      base: { ...STRING9, description: "What a new branch starts from." },
+      remote: { ...STRING9, description: "An https or ssh git remote (for clone)." },
+      key: { ...STRING9, description: "Idempotency key: retrying with the same key and arguments answers the same launch." },
+      name: { ...STRING9, description: "The session's @name." },
+      roles: { type: "array", items: STRING9, description: "Roles the session claims (e.g. reviewer.hub)." },
+      harness: { ...STRING9, description: "The harness (default opencode)." },
+      agent: { ...STRING9, description: "The harness agent (e.g. build)." },
+      model: { ...STRING9, description: "provider/model." },
       runtime: { type: "string", enum: [...RUNTIME_KINDS], description: "host (default) or openshell (a sandbox)." },
-      profile: { ...STRING6, description: "The runtime's sandbox profile (needs runtime)." },
-      machine: { ...STRING6, description: "The machine (name or ID) to run on." },
+      profile: { ...STRING9, description: "The runtime's sandbox profile (needs runtime)." },
+      machine: { ...STRING9, description: "The machine (name or ID) to run on." },
       nodeLabels: { ...LABELS, description: 'Node labels to place on (e.g. {"os": "darwin"}).' },
       prefer: { type: "boolean", description: "machine and nodeLabels are preferences, not requirements." },
       labels: { ...LABELS, description: "Free-form labels for finding the launch and its session later (never interpreted by the hub)." },
-      prompt: { ...STRING6, description: "The session's first prompt." },
+      prompt: { ...STRING9, description: "The session's first prompt." },
       end: { type: "string", enum: [...LAUNCH_END_WHEN], description: "When it ends: idle (default; idle with nothing open for 30 s), asked (with a question open: needs_user), never." },
-      timeout: { ...STRING6, description: "Longest run, e.g. 4h or 90m." },
+      timeout: { ...STRING9, description: "Longest run, e.g. 4h or 90m." },
       cleanup: { type: "string", enum: [...CLEANUP_POLICIES], description: "keep (default) or remove the workspace when it ends." },
       notAfter: { type: ["number", "string"], description: "Do not start after this time: epoch milliseconds or an ISO 8601 date-time (at most 30 days ahead). Still waiting for a machine then, the launch ends expired; once placed it runs (timeout bounds it). Already passed: nothing is launched (expired)." }
     },
@@ -8894,12 +9248,12 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     name: "launches",
     description: "Your launches, oldest first (an app or session sees the ones it started).",
     properties: {
-      state: { ...STRING6, description: "Only these states (comma-separated: queued, placing, provisioning, running, ended)." },
-      label: { type: "array", items: STRING6, description: "key=value launch labels that must all match." }
+      state: { ...STRING9, description: "Only these states (comma-separated: queued, placing, provisioning, running, ended)." },
+      label: { type: "array", items: STRING9, description: "key=value launch labels that must all match." }
     },
     readOnly: true,
     run: async (hub, args, signal) => {
-      const state = optional7(args, "state")?.split(",").filter(Boolean);
+      const state = optional8(args, "state")?.split(",").filter(Boolean);
       const label = optionalStrings(args, "label");
       return launchesText((await hub.launches.list({ ...state?.length ? { state } : {}, ...label ? { label } : {}, signal })).launches ?? []);
     }
@@ -8910,7 +9264,7 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     properties: { id: LAUNCH_ID },
     required: ["id"],
     readOnly: true,
-    run: async (hub, args, signal) => launchText((await hub.launches.get(need7(args, "id"), { signal })).launch)
+    run: async (hub, args, signal) => launchText((await hub.launches.get(need10(args, "id"), { signal })).launch)
   },
   {
     name: "launch_stop",
@@ -8918,7 +9272,7 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     properties: { id: LAUNCH_ID },
     required: ["id"],
     readOnly: false,
-    run: async (hub, args, signal) => stoppedLaunchText((await hub.launches.stop(need7(args, "id"), { signal })).launch)
+    run: async (hub, args, signal) => stoppedLaunchText((await hub.launches.stop(need10(args, "id"), { signal })).launch)
   }
 ];
 var toolList = () => TOOLS.map((t) => ({
@@ -9113,90 +9467,6 @@ async function watch(credentials, options, write, signal) {
   throw new CliError(EXIT.other, "the watch stream ended (the hub closed it)", AGAIN);
 }
 
-// packages/cli/src/grants.ts
-var GRANT_FLAGS = {
-  json: "json",
-  holder: "string",
-  project: "multi",
-  allow: "multi",
-  permit: "multi",
-  never: "multi",
-  expires: "string",
-  "max-per-hour": "string",
-  "allow-always": "bool"
-};
-var GRANT_REQUEST_FLAGS = { ...GRANT_FLAGS, "permission-allow": "multi", why: "string" };
-var GRANT_USER_HINT = "only the user manages grants: use the console, or `hub login` with the user's device token";
-function userOnly(source, what) {
-  if (source === "env")
-    throw new CliError(EXIT.forbidden, `only the user can ${what} a grant, not a session`, GRANT_USER_HINT);
-}
-function grantError(error) {
-  if (error instanceof CliError && error.exit === EXIT.forbidden)
-    return new CliError(error.exit, error.message, [error.hint, GRANT_USER_HINT].filter(Boolean).join("; "), error.envelope);
-  return error;
-}
-var listOf = (flags, name) => (flags[name] ?? []).flatMap((v) => v.split(",")).map((v) => v.trim()).filter(Boolean);
-async function grantSpecArg(flags, stdin) {
-  return await grantArg(flags, stdin, true);
-}
-function grantRequestArg(flags, stdin) {
-  return grantArg(flags, stdin, false);
-}
-async function grantArg(flags, stdin, holderRequired) {
-  const json = typeof flags.json === "string" ? flags.json : undefined;
-  const flagged = Object.keys(GRANT_REQUEST_FLAGS).filter((name) => name !== "json" && name !== "why" && flags[name] !== undefined);
-  if (json !== undefined) {
-    if (flagged.length)
-      throw new UsageError(`give either --json '{…}' or ${flagged.map((f) => `--${f}`).join(", ")}`);
-    return await jsonObjectArg(json, stdin, "grant");
-  }
-  const holder = str(flags, "holder");
-  if (holder === undefined && holderRequired)
-    throw new UsageError("needs --holder (ses_…, @name, @@orchestrator…, or app:<token id>)");
-  const projects = listOf(flags, "project");
-  if (!projects.length)
-    throw new UsageError("needs --project <path> (repeatable)");
-  const allow = listOf(flags, "allow");
-  if (!allow.length)
-    throw new UsageError("needs --allow <verbs> (approve, deny, answer, prompt, stop, roles, launch)");
-  const permit = [...listOf(flags, "permit"), ...listOf(flags, "permission-allow")];
-  const never = listOf(flags, "never");
-  const expires = str(flags, "expires");
-  const cap = str(flags, "max-per-hour");
-  if (cap !== undefined && !/^\d+$/.test(cap))
-    throw new UsageError("--max-per-hour is a whole number");
-  return {
-    ...holder !== undefined ? { holder } : {},
-    scope: { projects },
-    allow,
-    ...permit.length || never.length ? { permissions: { ...permit.length ? { allow: permit } : {}, ...never.length ? { never } : {} } } : {},
-    ...expires !== undefined ? { expires } : {},
-    ...cap !== undefined ? { maxActionsPerHour: Number(cap) } : {},
-    ...flags["allow-always"] === true ? { allowAlways: true } : {}
-  };
-}
-var iso3 = (ms) => new Date(ms).toISOString().replace(/\.\d{3}Z$/, "Z");
-var grantLine = (g) => [g.id, g.state, g.holder, g.allow.join(","), g.scope.projects.join(","), `until ${iso3(g.expiresAt)}`].join("  ");
-var grantsText = (grants) => grants.length ? grants.map(grantLine).join(`
-`) : "no grants";
-function grantText2(g) {
-  const list = (values) => values.length ? values.join(", ") : "none";
-  return [
-    `${g.id}  ${g.state}`,
-    `holder: ${g.holder}${g.holderSessionID && g.holderSessionID !== g.holder ? ` (${g.holderSessionID})` : ""}`,
-    `projects: ${list(g.scope.projects)}`,
-    `verbs: ${list(g.allow)}`,
-    `permissions allow: ${list(g.permissions.allow)}`,
-    `permissions never: ${list(g.permissions.never)}`,
-    `always: ${g.allowAlways ? "yes" : "no"}`,
-    `max actions per hour: ${g.maxActionsPerHour}`,
-    g.revokedAt !== undefined ? `revoked: ${iso3(g.revokedAt)}` : `expires: ${iso3(g.expiresAt)}`
-  ].join(`
-`);
-}
-var requestedText = (body) => `requested; waiting for the user (Decision ${body.decision.id})`;
-
 // packages/cli/src/node.ts
 import { appendFileSync, existsSync as existsSync5, mkdirSync as mkdirSync7, readFileSync as readFileSync8, realpathSync as realpathSync3, renameSync as renameSync5, rmSync as rmSync8, statSync as statSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import path16 from "node:path";
@@ -9422,7 +9692,7 @@ import { arch as osArch, platform as osPlatform } from "node:os";
 // packages/node/package.json
 var package_default2 = {
   name: "@huynle/hub-node",
-  version: "0.10.0",
+  version: "0.11.0",
   private: true,
   description: "`hub node`: the per-machine daemon that prepares, collects and cleans up launch workspaces (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -10877,7 +11147,7 @@ import path14 from "node:path";
 // packages/runtime-openshell/package.json
 var package_default3 = {
   name: "@huynle/hub-runtime-openshell",
-  version: "0.10.0",
+  version: "0.11.0",
   private: true,
   description: "The `openshell` runtime of `hub node`: launches in NVIDIA OpenShell sandboxes, driven through the openshell CLI (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -12532,46 +12802,6 @@ function openShellCheckText(report) {
 `);
 }
 
-// packages/cli/src/subscriptions.ts
-var SUBSCRIBE_FLAGS = { type: "multi", delivery: "string", batch: "string", expires: "string", "max-per-hour": "string", subscriber: "string", note: "string" };
-var DELIVERIES2 = ["queue", "steer", "silent"];
-var safe2 = (v, max = 120) => sanitizeLabel(String(v), max);
-function subscribeInput(addrs, flags) {
-  if (!addrs.length)
-    throw new UsageError("needs at least one address (a session, @@role, #team or children)");
-  const delivery = str(flags, "delivery");
-  if (delivery !== undefined && !DELIVERIES2.includes(delivery))
-    throw new UsageError(`--delivery is one of ${DELIVERIES2.join(", ")}`);
-  const batch = str(flags, "batch");
-  const expires = str(flags, "expires");
-  const max = str(flags, "max-per-hour");
-  if (max !== undefined && !/^\d+$/.test(max))
-    throw new UsageError("--max-per-hour takes a whole number (1–120)");
-  const types = flags.type;
-  const subscriber = str(flags, "subscriber");
-  const note = str(flags, "note");
-  return {
-    to: addrs.length === 1 ? addrs[0] : [...addrs],
-    ...types?.length ? { types: types.flatMap((t) => t.split(",")).map((t) => t.trim()).filter(Boolean) } : {},
-    ...delivery !== undefined ? { delivery } : {},
-    ...batch !== undefined ? { batch: durationArg(batch, "--batch") } : {},
-    ...expires !== undefined ? { expires: durationArg(expires, "--expires") } : {},
-    ...max !== undefined ? { maxPerHour: Number(max) } : {},
-    ...subscriber !== undefined ? { subscriber } : {},
-    ...note !== undefined ? { note } : {}
-  };
-}
-var targets = (s) => s.targets.map((t) => t.kind === "children" ? "its subagents" : safe2(t.addr, 80)).join(", ");
-var iso4 = (ms) => new Date(ms).toISOString().slice(0, 16) + "Z";
-function subscriptionLine(s) {
-  const extra = [safe2(s.delivery, 10), `batch ${Math.round(s.batchMs / 1000)}s`, `≤${s.maxPerHour}/h`, `expires ${iso4(s.expiresAt)}`, `${s.stats.delivered} delivered`, ...s.pending ? [`${s.pending} pending`] : [], ...s.stats.dropped ? [`${s.stats.dropped} dropped`] : [], ...s.stats.suppressed ? [`${s.stats.suppressed} loop-suppressed`] : []];
-  return `${safe2(s.id, 40)}  ${safe2(s.subscriber, 80)} ← ${targets(s)}  [${s.types.map((t) => safe2(t, 40)).join(",")}]  ${extra.join(" · ")}${s.note ? `  "${safe2(s.note, 200)}"` : ""}`;
-}
-var subscribedText = (b) => `subscribed ${subscriptionLine(b.subscription)}
-the subscriber gets one hub message per batch window; stop with \`hub unsubscribe ${safe2(b.subscription.id, 40)}\``;
-var subscriptionsText = (b) => b.subscriptions.length ? b.subscriptions.map(subscriptionLine).join(`
-`) : "no subscriptions";
-
 // packages/claude-code/src/main.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { realpathSync as realpathSync5 } from "node:fs";
@@ -14875,7 +15105,7 @@ import path23 from "node:path";
 // packages/claude-code/package.json
 var package_default4 = {
   name: "@huynle/hub-claude-code",
-  version: "0.10.0",
+  version: "0.11.0",
   private: true,
   description: "The Claude Code hooks spoke: per-user daemon, hook bridge, plugin dir, `hub claude` wrapper and daemon-backed MCP server (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -15164,7 +15394,7 @@ import path26 from "node:path";
 // packages/preset/package.json
 var package_default5 = {
   name: "@huynle/hub-preset",
-  version: "0.10.0",
+  version: "0.11.0",
   private: true,
   description: "The preset spoke: drives a harness without a spoke of its own through a terminal pane (tmux), described by a data-only preset; official presets in presets/ (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -15689,7 +15919,7 @@ import { openSync as openSync6, closeSync as closeSync6, readFileSync as readFil
 // packages/codex/package.json
 var package_default6 = {
   name: "@huynle/hub-codex",
-  version: "0.10.0",
+  version: "0.11.0",
   private: true,
   description: "The Codex app-server spoke: attaches to Codex's app-server (its own over stdio, and the shared daemon's socket when present), and the `hub codex` wrapper (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -26713,7 +26943,7 @@ ${openedText(body.decision)}` : outcome.text);
   "grant create": {
     flags: GRANT_FLAGS,
     async handle(context) {
-      userOnly(context.credentials().source, "create");
+      userOnly2(context.credentials().source, "create");
       const spec = await grantSpecArg(context.parsed.flags, context.io.stdin);
       const body = await grantHub(context, (hub) => hub.createGrant(spec));
       answer(context, body, (b) => `created ${grantText2(b.grant)}`);
@@ -26733,7 +26963,7 @@ ${openedText(body.decision)}` : outcome.text);
   "grant revoke": {
     args: ["<grantID>"],
     async handle(context) {
-      userOnly(context.credentials().source, "revoke");
+      userOnly2(context.credentials().source, "revoke");
       const body = await grantHub(context, (hub) => hub.revokeGrant(context.parsed.args[0]));
       answer(context, body, (b) => `revoked ${b.grant.id} (${b.grant.holder})`);
     }