@huynle/hub 0.10.1 → 0.11.1

package/packages/cli/dist/hub-cli.js

@@ -7,7 +7,7 @@ import { createInterface } from "readline";
 // packages/cli/package.json
 var package_default = {
   name: "@huynle/hub-cli",
-  version: "0.10.1",
+  version: "0.11.1",
   private: true,
   description: "The hub CLI (`hub` / `hubctl`) for agents and scripts (internal; bundled into @huynle/hub, not published on its own).",
   license: "MIT",
@@ -306,6 +306,12 @@ function showText(s) {
   if (s.roles?.length)
     field("roles", s.roles.map((r) => `@${at(r)}`).join(" "));
   field("now", s.now);
+  if (s.health && s.health.kind !== "ok") {
+    const h = s.health;
+    const reset = typeof h.resetAt === "number" && Number.isFinite(h.resetAt) && Math.abs(h.resetAt) <= 8640000000000000 ? new Date(h.resetAt).toISOString() : undefined;
+    const facts = [h.kind, reset ? `resets ${reset}` : undefined, h.attempt !== undefined ? `attempt ${h.attempt}` : undefined].filter(Boolean).join(", ");
+    field("health", h.detail ? `${facts} — ${oneLine(h.detail, 200)}` : facts);
+  }
   if (s.children)
     field("subagents", s.children);
   if (s.online === false && s.lastSeen !== undefined)
@@ -419,6 +425,74 @@ function parseAddress(addr) {
   const scope = project ? { project } : {};
   return role ? { kind: "role", role: match[1], ...scope } : { kind: "name", name: match[1], ...scope };
 }
+// packages/sdk/src/ask-fields.ts
+var URGENCIES = ["low", "normal", "high"];
+var TIERS = ["confirm", "tap"];
+var KINDS = ["question", "plan", "merge", "release"];
+var DECISION_ASK_PROPERTIES = {
+  options: {
+    type: "array",
+    items: { type: "object", properties: { id: { type: "string" }, label: { type: "string" }, safe: { type: "boolean" } }, required: ["id", "label"] },
+    description: "ask @me: buttons the user taps, [{id, label, safe?}] (at most 8; id: lowercase letters, digits, - or _)."
+  },
+  recommendation: {
+    type: "object",
+    properties: { option: { type: "string" }, why: { type: "string" } },
+    required: ["option"],
+    description: "ask @me: the option you recommend ({option: an option id, why})."
+  },
+  urgency: { type: "string", enum: [...URGENCIES], description: "ask @me: low, normal (default) or high." },
+  tier: { type: "string", enum: [...TIERS], description: "ask @me: confirm (default: any of the user's devices) or tap (only the signed-in console)." },
+  kind: { type: "string", enum: [...KINDS], description: "ask @me: what it is about: question (default), plan, merge or release." },
+  choices: {
+    type: "array",
+    items: {
+      type: "object",
+      properties: {
+        id: { type: "string" },
+        label: { type: "string" },
+        options: { type: "array", items: { type: "object", properties: { id: { type: "string" }, label: { type: "string" }, recommended: { type: "boolean" } }, required: ["id", "label"] } }
+      },
+      required: ["id", "label", "options"]
+    },
+    description: 'ask @me: several points in one ask, instead of options: [{id: "D1", label, options: [{id, label, recommended?}]}], 1–12 groups of 2–6 options, at most one recommended each; the user picks one option per group and you get one "D1: label [a]" line per group.'
+  }
+};
+var DECISION_ASK_FIELDS = Object.keys(DECISION_ASK_PROPERTIES);
+var isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function decisionAskFields(args) {
+  const out = {};
+  const { options, recommendation, urgency, tier, kind, choices } = args;
+  const objects = (value, field, shape) => {
+    if (!Array.isArray(value) || !value.every(isObject))
+      throw new Error(`"${field}" must be a list of ${shape}`);
+    return value;
+  };
+  if (options !== undefined)
+    out.options = objects(options, "options", "{id, label, safe?}");
+  if (recommendation !== undefined) {
+    if (!isObject(recommendation) || typeof recommendation.option !== "string")
+      throw new Error(`"recommendation" must be {option, why?}`);
+    out.recommendation = recommendation;
+  }
+  const oneOf = (value, field, allowed) => {
+    if (value === undefined)
+      return;
+    if (typeof value !== "string" || !allowed.includes(value))
+      throw new Error(`"${field}" is one of ${allowed.join(", ")}`);
+    out[field] = value;
+  };
+  oneOf(urgency, "urgency", URGENCIES);
+  oneOf(tier, "tier", TIERS);
+  oneOf(kind, "kind", KINDS);
+  if (choices !== undefined) {
+    const shape = "{id, label, options: [{id, label, recommended?}]}";
+    for (const group of objects(choices, "choices", shape))
+      objects(group.options, "choices", shape);
+    out.choices = choices;
+  }
+  return out;
+}
 // packages/sdk/src/errors.ts
 class HubError extends Error {
   status;
@@ -843,7 +917,7 @@ var segment = (value) => encodeURIComponent(value).replace(/%40/g, "@");
 var bareRole = (role) => role.replace(/^@@/, "");
 var decisionFields = (options) => {
   const out = {};
-  for (const key of ["options", "recommendation", "urgency", "tier", "deadline", "onTimeout", "about"])
+  for (const key of ["options", "recommendation", "choices", "kind", "urgency", "tier", "deadline", "onTimeout", "about"])
     if (options[key] !== undefined)
       out[key] = options[key];
   return out;
@@ -852,6 +926,7 @@ var whyField = (options) => options.why !== undefined ? { why: options.why } : {
 var signalOf = (options) => options.signal ? { signal: options.signal } : {};
 var idempotent = (options) => ({ ...signalOf(options), ...options.idempotencyKey ? { headers: { "idempotency-key": options.idempotencyKey } } : {} });
 var sendFields = (options) => ({
+  ...options.item !== undefined ? { item: options.item } : {},
   ...options.wake !== undefined ? { wake: options.wake } : {},
   ...options.urgent !== undefined ? { urgent: options.urgent } : {},
   ...options.notAfter !== undefined ? { notAfter: options.notAfter } : {}
@@ -1162,6 +1237,15 @@ class HubClient {
   grants(options = {}) {
     return this.call("GET", `${AGENT2}/grants`, signalOf(options));
   }
+  heldGrants(options = {}) {
+    return this.call("GET", `${AGENT2}/grants/mine`, signalOf(options));
+  }
+  heldGrant(id, options = {}) {
+    return this.call("GET", `${AGENT2}/grants/mine/${segment(id)}`, signalOf(options));
+  }
+  revokeHeldGrant(id, options = {}) {
+    return this.call("DELETE", `${AGENT2}/grants/mine/${segment(id)}`, signalOf(options));
+  }
   grant(id, options = {}) {
     return this.call("GET", `${AGENT2}/grants/${segment(id)}`, signalOf(options));
   }
@@ -1191,7 +1275,7 @@ class HubClient {
 // packages/sdk/src/envelope.ts
 var LABEL_MAX = 120;
 var ANSI = /\u001b\[[0-?]*[ -/]*[@-~]|\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)?|\u001b[P^_][^\u001b]*(?:\u001b\\)?|\u001b[ -/]*[0-~]?|\u009b[0-?]*[ -/]*[@-~]/g;
-var CONTROL = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f\u061c\u200b-\u200f\u2028-\u202e\u2060-\u206f\ufeff]/g;
+var CONTROL = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f\u061c\u200b-\u200f\u2028-\u202e\u2060-\u206f\ufeff\p{Cf}]/gu;
 function sanitizeText(text) {
   return text.replace(/\r\n?/g, `
 `).replace(ANSI, "").replace(CONTROL, "");
@@ -1238,13 +1322,16 @@ function renderEnvelope(input) {
 var WAKE_SKIP_TEXT = {
   wake_false: "sent without a wake",
   subagent: "subagents are never woken",
-  hop_cap: "hop limit reached (8 agent messages without a human turn)",
-  budget: "wake budget spent (30 per 10 minutes)"
+  hop_cap: "hop limit reached (too many agent messages without a human turn)",
+  budget: "wake budget spent",
+  item_budget: "item wake budget spent",
+  item_loop: "this pair is looping on the item without progress; the user decides"
 };
-function wakeSkipNote({ delivery, woke, wakeSkipped }) {
+function wakeSkipNote({ delivery, woke, wakeSkipped, wakeLimit }) {
   if (woke !== false || !wakeSkipped || delivery === "steer" || delivery === "turn")
     return "";
-  return ` — wake skipped: ${WAKE_SKIP_TEXT[wakeSkipped] ?? wakeSkipped}`;
+  const detail = wakeLimit !== undefined && Number.isFinite(wakeLimit) && wakeLimit >= 1 ? wakeSkipped === "hop_cap" ? `hop limit reached (${wakeLimit} agent messages without a human turn)` : wakeSkipped === "budget" ? `wake budget spent (${wakeLimit} per 10 minutes)` : wakeSkipped === "item_budget" ? `item wake budget spent (${wakeLimit} wakes)` : undefined : undefined;
+  return ` — wake skipped: ${detail ?? WAKE_SKIP_TEXT[wakeSkipped] ?? wakeSkipped}`;
 }
 // packages/cli/src/http.ts
 var EXIT = {
@@ -4325,6 +4412,19 @@ var RECORDING_LIMITS = {
   hubFlushMs: 2000,
   hubFlushEvents: 100
 };
+var DEV_LIMITS = {
+  clipsPerRecording: 200,
+  clipPreMs: 3000,
+  clipPostMs: 2000,
+  clipBytes: 192 * 1024,
+  clipGapMs: 2000,
+  repliesPerRecording: 2000,
+  replyBytes: 1024 * 1024,
+  userHeadroomBytes: 50 * 1024 * 1024,
+  recordingHeadroomBytes: 15 * 1024 * 1024,
+  tracesPerMinute: 30,
+  logsPerMinute: 20
+};
 // packages/protocol/src/app-front.ts
 var ACCESS_TOKEN_TTL_MS = 60 * 60000;
 var REFRESH_TOKEN_IDLE_MS = 30 * 24 * 60 * 60000;
@@ -4846,7 +4946,7 @@ function readConfig(file, machineName) {
     return defaults(machineName);
   }
 }
-var isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isObject2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function readRawConfig(file) {
   let text;
   try {
@@ -4862,7 +4962,7 @@ function readRawConfig(file) {
   } catch {
     parsed = undefined;
   }
-  if (!isObject(parsed))
+  if (!isObject2(parsed))
     throw new Error(`${file} is not a JSON object; fix or remove it first`);
   return parsed;
 }
@@ -5296,7 +5396,7 @@ class ProfileError extends RuntimeError {
     this.code = code;
   }
 }
-var isObject2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isObject3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var show = (v) => JSON.stringify(v)?.slice(0, 80) ?? String(v);
 var builtinDefault = () => ({ name: DEFAULT_PROFILE, providers: [], endpoints: [], allowGitRemote: false });
 function egressHost(v) {
@@ -5320,7 +5420,7 @@ function egressEndpoint(v) {
       return;
     host = v.slice(0, colon);
     port = Number(v.slice(colon + 1));
-  } else if (isObject2(v)) {
+  } else if (isObject3(v)) {
     host = v.host;
     port = v.port;
   }
@@ -5377,9 +5477,9 @@ function normalizeOpenShellProfiles(raw) {
   const problems = [];
   const profiles = { [DEFAULT_PROFILE]: builtinDefault() };
   const unsupported = {};
-  if (raw !== undefined && !isObject2(raw))
+  if (raw !== undefined && !isObject3(raw))
     problems.push("openshell.profiles must be an object of profile name to profile");
-  let entries = Object.entries(isObject2(raw) ? raw : {});
+  let entries = Object.entries(isObject3(raw) ? raw : {});
   if (entries.length > PROFILES_MAX) {
     problems.push(`openshell.profiles: at most ${PROFILES_MAX} profiles; the rest are ignored`);
     entries = entries.slice(0, PROFILES_MAX);
@@ -5389,7 +5489,7 @@ function normalizeOpenShellProfiles(raw) {
       problems.push(`openshell.profiles: ${show(name)} is not a profile name (lowercase letters, digits, . _ -; at most ${NAME_MAX})`);
       continue;
     }
-    if (!isObject2(value)) {
+    if (!isObject3(value)) {
       problems.push(`openshell.profiles.${name} must be an object`);
       continue;
     }
@@ -5823,7 +5923,7 @@ var HARNESS = /^[a-z0-9][a-z0-9._-]{0,63}$/;
 function nodeConfigPath(env = process.env, home = homedir2()) {
   return path9.join(path9.dirname(configPath(env, home)), NODE_CONFIG_FILE);
 }
-var isObject3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isObject4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var whole = (v, min, max) => typeof v === "number" && Number.isInteger(v) && v >= min && v <= max;
 var show2 = (v) => JSON.stringify(v)?.slice(0, 80) ?? String(v);
 function configPathOf(raw, options) {
@@ -5845,7 +5945,7 @@ var isRoot = (p) => p === "/" || /^[A-Z]:\/$/.test(p);
 function normalizeNodeConfig(raw, options = {}) {
   const problems = [];
   let r = {};
-  if (isObject3(raw))
+  if (isObject4(raw))
     r = raw;
   else if (raw !== undefined)
     problems.push("node.json must hold a JSON object");
@@ -5937,7 +6037,7 @@ function loopbackOrigin(raw) {
   return url.origin;
 }
 function normalizeOpenCode(raw, problems, options) {
-  if (!isObject3(raw)) {
+  if (!isObject4(raw)) {
     problems.push("opencode must be an object");
     return;
   }
@@ -5948,7 +6048,7 @@ function normalizeOpenCode(raw, problems, options) {
   const list = Array.isArray(raw.servers) ? raw.servers : [];
   list.forEach((entry, i) => {
     const field = `opencode.servers[${i}]`;
-    if (!isObject3(entry))
+    if (!isObject4(entry))
       return void problems.push(`${field} must be an object {url, passwordFile, directories?}`);
     const url = loopbackOrigin(entry.url);
     if (!url)
@@ -5976,7 +6076,7 @@ function normalizeOpenCode(raw, problems, options) {
   return { ...directories ? { directories } : {}, servers, ...timeoutSeconds !== undefined ? { timeoutSeconds } : {} };
 }
 function normalizeHarnesses(raw, problems) {
-  if (!isObject3(raw)) {
+  if (!isObject4(raw)) {
     problems.push("harnesses must be an object of harness names to true or false");
     return;
   }
@@ -5992,7 +6092,7 @@ function normalizeHarnesses(raw, problems) {
   return out;
 }
 function normalizeOpenShell(raw, problems) {
-  if (!isObject3(raw)) {
+  if (!isObject4(raw)) {
     problems.push("openshell must be an object");
     return;
   }
@@ -6234,10 +6334,13 @@ var DECISION_FLAGS = {
   deadline: "string",
   "on-timeout": "string",
   tier: "string",
-  about: "multi"
+  about: "multi",
+  choice: "multi",
+  kind: "string"
 };
-var URGENCIES = ["low", "normal", "high"];
-var TIERS = ["confirm", "tap"];
+var URGENCIES2 = ["low", "normal", "high"];
+var KINDS2 = ["question", "plan", "merge", "release"];
+var TIERS2 = ["confirm", "tap"];
 var STATES = ["open", "answered", "expired", "closed"];
 var DECISION_STATES = STATES;
 function optionArg(value) {
@@ -6253,6 +6356,37 @@ function optionArg(value) {
     throw new UsageError(`--option ${id}: the label is empty`);
   return { id, label, ...safe ? { safe: true } : {} };
 }
+function choiceArg(value) {
+  const usage = `--choice takes GROUP=Label:a=Option*,b=Option (got "${value}")`;
+  const eq = value.indexOf("=");
+  if (eq <= 0)
+    throw new UsageError(usage);
+  const id = value.slice(0, eq);
+  const rest = value.slice(eq + 1);
+  let split = -1;
+  for (let i = rest.lastIndexOf(":");i >= 0; i = rest.lastIndexOf(":", i - 1)) {
+    if (/^[^=,:\s][^=,:]*=/.test(rest.slice(i + 1))) {
+      split = i;
+      break;
+    }
+  }
+  if (split < 0)
+    throw new UsageError(usage);
+  const label = rest.slice(0, split);
+  if (!label.trim())
+    throw new UsageError(`--choice ${id}: the label is empty`);
+  const options = rest.slice(split + 1).split(",").map((option) => {
+    const at = option.indexOf("=");
+    if (at <= 0)
+      throw new UsageError(usage);
+    const recommended = option.endsWith("*");
+    const text = option.slice(at + 1, recommended ? -1 : undefined);
+    if (!text.trim())
+      throw new UsageError(`--choice ${id}: option ${option.slice(0, at)} has an empty label`);
+    return { id: option.slice(0, at), label: text, ...recommended ? { recommended: true } : {} };
+  });
+  return { id, label, options };
+}
 var oneOf2 = (value, allowed, flag) => {
   if (value !== undefined && !allowed.includes(value))
     throw new UsageError(`${flag} is one of ${allowed.join(", ")}`);
@@ -6269,13 +6403,19 @@ function decisionOptions(flags, to) {
   if (why !== undefined && recommend === undefined)
     throw new UsageError("--why explains --recommend");
   const deadline = str(flags, "deadline");
-  const urgency = oneOf2(str(flags, "urgency"), URGENCIES, "--urgency");
-  const tier = oneOf2(str(flags, "tier"), TIERS, "--tier");
+  const urgency = oneOf2(str(flags, "urgency"), URGENCIES2, "--urgency");
+  const tier = oneOf2(str(flags, "tier"), TIERS2, "--tier");
   const onTimeout = str(flags, "on-timeout");
   const options = flags.option;
   const about = flags.about;
+  const choices = flags.choice;
+  if (choices && options)
+    throw new UsageError("--choice and --option don't mix: give one or the other");
+  const kind = oneOf2(str(flags, "kind"), KINDS2, "--kind");
   return {
     ...options ? { options: options.map(optionArg) } : {},
+    ...choices ? { choices: choices.map(choiceArg) } : {},
+    ...kind ? { kind } : {},
     ...recommend !== undefined ? { recommendation: { option: recommend, ...why !== undefined ? { why } : {} } } : {},
     ...urgency ? { urgency } : {},
     ...tier ? { tier } : {},
@@ -6289,6 +6429,10 @@ function stateArg(value) {
 }
 var iso2 = (ms) => new Date(ms).toISOString().replace(/\.\d{3}Z$/, "Z");
 function choicesText(decision) {
+  if (decision.choices?.length) {
+    return decision.choices.map((g) => `${g.id} ${oneLine(g.label, 120)}: ${g.options.map((o) => `${o.id} ${oneLine(o.label, 80)}${o.recommended ? " (recommended)" : ""}`).join(" · ")}`).join(`
+  `);
+  }
   const options = decision.options.map((o) => `${o.id} ${oneLine(o.label, 80)}${o.safe ? " (safe)" : ""}`).join(" · ");
   const r = decision.recommendation;
   const recommended = r ? `recommended: ${r.option}${r.why ? ` (${oneLine(r.why, 200)})` : ""}` : "";
@@ -6297,7 +6441,8 @@ function choicesText(decision) {
 function stateText(decision) {
   if (decision.state === "answered") {
     const a = decision.answer;
-    return `answered${a?.option ? ` ${a.option}` : ""}${a?.answeredBy === "timeout" ? " (timeout)" : ""}`;
+    const picks = a?.picks ? ` ${Object.entries(a.picks).map(([group, option]) => `${group}=${option}`).join(" ")}` : "";
+    return `answered${a?.option ? ` ${a.option}` : ""}${picks}${a?.answeredBy === "timeout" ? " (timeout)" : ""}`;
   }
   if (decision.state === "open" && decision.deadline !== undefined)
     return `open (deadline ${iso2(decision.deadline)})`;
@@ -6474,7 +6619,7 @@ class ToolArgError extends Error {
 
 // packages/cli/src/artifacts-mcp.ts
 var MCP_INLINE_TEXT_BYTES = 256 * 1024;
-var KINDS = ["markdown", "code", "image", "table", "chart", "dashboard", "html", "app", "file"];
+var KINDS3 = ["markdown", "code", "image", "table", "chart", "dashboard", "html", "app", "file"];
 var DEFAULT_MEDIA = { markdown: "text/markdown", html: "text/html", table: "text/csv", chart: "application/json", dashboard: "application/json" };
 var PATH3 = "/api/agent/artifacts";
 var STRING = { type: "string" };
@@ -6570,7 +6715,7 @@ var artifactTools = [
     description: "Create a persistent artifact with its first revision from small inline text or references to staged bytes. Needs scope artifacts:write for an app token.",
     properties: {
       title: STRING,
-      kind: { type: "string", enum: KINDS },
+      kind: { type: "string", enum: KINDS3 },
       description: STRING,
       visibility: { type: "string", enum: ["private", "workspace"] },
       workspaceID: STRING,
@@ -6582,8 +6727,8 @@ var artifactTools = [
     run: async (hub, args, signal) => {
       const title = need(args, "title");
       const kind = need(args, "kind");
-      if (!KINDS.includes(kind))
-        throw new ToolArgError(`"kind" must be one of ${KINDS.join(", ")}`);
+      if (!KINDS3.includes(kind))
+        throw new ToolArgError(`"kind" must be one of ${KINDS3.join(", ")}`);
       const body = files(args, kind);
       const description = optional2(args, "description");
       const visibility = optional2(args, "visibility");
@@ -6618,7 +6763,7 @@ var STRING2 = { type: "string" };
 var ID3 = { type: "string", description: "The artifact's ID (art_…)." };
 var JOB = { type: "string", description: "The job's ID (job_…)." };
 var REVISION = { type: "integer", description: "The job revision you read (from artifact_job)." };
-var KINDS2 = ["ask", "propose-edit", "run-action"];
+var KINDS4 = ["ask", "propose-edit", "run-action"];
 var need2 = (args, key) => {
   const value = args[key];
   if (typeof value !== "string" || !value.trim())
@@ -6695,7 +6840,7 @@ var artifactJobTools = [
       id: ID3,
       baseRevisionID: { type: "string", description: "The revision the job is about (propose-edit: the latest)." },
       instruction: { type: "string", description: "What to do (plain text, at most 8000 characters)." },
-      kind: { type: "string", enum: KINDS2 },
+      kind: { type: "string", enum: KINDS4 },
       action: { type: "string", description: "run-action: one of the artifact's declared actions." },
       machine: { type: "string", description: "Launch a handler session on this machine…" },
       repo: { type: "string", description: "…in this absolute repository path." },
@@ -6710,8 +6855,8 @@ var artifactJobTools = [
     readOnly: false,
     run: async (hub, args, signal) => {
       const kind = optional3(args, "kind");
-      if (kind && !KINDS2.includes(kind))
-        throw new ToolArgError(`"kind" must be one of ${KINDS2.join(", ")}`);
+      if (kind && !KINDS4.includes(kind))
+        throw new ToolArgError(`"kind" must be one of ${KINDS4.join(", ")}`);
       const action = optional3(args, "action");
       const apply = optional3(args, "apply");
       const key = optional3(args, "key");
@@ -6883,7 +7028,7 @@ function notAfterOf(args) {
   }
   throw new ToolArgError(`"notAfter" must be epoch milliseconds or an ISO 8601 date-time like 2027-01-15T12:00:00Z`);
 }
-var line4 = (i) => `${i.id}  ${i.status}${i.progress ? `/${i.progress}` : ""}  ${i.priority}  r${i.revision}  ${sanitizeText(i.title).replace(/\s+/g, " ")}`;
+var line4 = (i) => `${i.id}  ${i.status}${i.progress ? `/${i.progress}` : ""}  ${i.priority}  r${i.revision}  ${sanitizeText(i.title).replace(/\s+/g, " ")}${i.usage ? `  wakes ${i.usage.wakes}/${i.usage.budget.wakes} · ${i.usage.hours.toFixed(1)}/${i.usage.budget.hours}h` : ""}`;
 function intakeText(i) {
   const from = i.source.kind === "user" ? "the user" : i.source.kind === "app" ? `app ${i.source.tokenID}` : `session ${i.source.sessionID}`;
   return [
@@ -6897,7 +7042,8 @@ function intakeText(i) {
     ...i.criteria?.length ? ["done means:", ...i.criteria.map((c) => `- ${sanitizeText(c)}`)] : [],
     ...i.ref ? [`ref: ${sanitizeText(i.ref)}`] : [],
     ...i.reason ? [`reason: ${sanitizeText(i.reason)}`] : [],
-    ...i.lastError ? [`last routing error: ${i.lastError} (retried)`] : []
+    ...i.lastError ? [`last routing error: ${i.lastError} (retried)`] : [],
+    ...i.usage ? [`usage: ${i.usage.wakes}/${i.usage.budget.wakes} wakes · ${i.usage.hours.toFixed(1)}/${i.usage.budget.hours} hours (paused and blocked time counts)${i.usage.chargedTo ? `; last charged to ${i.usage.chargedTo}` : ""}`] : []
   ].join(`
 `);
 }
@@ -6984,35 +7130,215 @@ ${intakeText(intake)}`;
   }
 ];
 
-// packages/cli/src/teams-mcp.ts
+// packages/cli/src/subscriptions.ts
+var SUBSCRIBE_FLAGS = { type: "multi", delivery: "string", batch: "string", expires: "string", "max-per-hour": "string", subscriber: "string", note: "string" };
+var DELIVERIES2 = ["queue", "steer", "silent"];
+var safe = (v, max = 120) => sanitizeLabel(String(v), max);
+function subscribeInput(addrs, flags) {
+  if (!addrs.length)
+    throw new UsageError("needs at least one address (a session, @@role, #team or children)");
+  const delivery = str(flags, "delivery");
+  if (delivery !== undefined && !DELIVERIES2.includes(delivery))
+    throw new UsageError(`--delivery is one of ${DELIVERIES2.join(", ")}`);
+  const batch = str(flags, "batch");
+  const expires = str(flags, "expires");
+  const max = str(flags, "max-per-hour");
+  if (max !== undefined && !/^\d+$/.test(max))
+    throw new UsageError("--max-per-hour takes a whole number (1–120)");
+  const types = flags.type;
+  const subscriber = str(flags, "subscriber");
+  const note = str(flags, "note");
+  return {
+    to: addrs.length === 1 ? addrs[0] : [...addrs],
+    ...types?.length ? { types: types.flatMap((t) => t.split(",")).map((t) => t.trim()).filter(Boolean) } : {},
+    ...delivery !== undefined ? { delivery } : {},
+    ...batch !== undefined ? { batch: durationArg(batch, "--batch") } : {},
+    ...expires !== undefined ? { expires: durationArg(expires, "--expires") } : {},
+    ...max !== undefined ? { maxPerHour: Number(max) } : {},
+    ...subscriber !== undefined ? { subscriber } : {},
+    ...note !== undefined ? { note } : {}
+  };
+}
+var targets = (s) => s.targets.map((t) => t.kind === "children" ? "its subagents" : safe(t.addr, 80)).join(", ");
+var iso3 = (ms) => new Date(ms).toISOString().slice(0, 16) + "Z";
+function subscriptionLine(s) {
+  const extra = [safe(s.delivery, 10), `batch ${Math.round(s.batchMs / 1000)}s`, `≤${s.maxPerHour}/h`, `expires ${iso3(s.expiresAt)}`, `${s.stats.delivered} delivered`, ...s.pending ? [`${s.pending} pending`] : [], ...s.stats.dropped ? [`${s.stats.dropped} dropped`] : [], ...s.stats.suppressed ? [`${s.stats.suppressed} loop-suppressed`] : []];
+  return `${safe(s.id, 40)}  ${safe(s.subscriber, 80)} ← ${targets(s)}  [${s.types.map((t) => safe(t, 40)).join(",")}]  ${extra.join(" · ")}${s.note ? `  "${safe(s.note, 200)}"` : ""}`;
+}
+var subscribedText = (b) => `subscribed ${subscriptionLine(b.subscription)}
+the subscriber gets one hub message per batch window; stop with \`hub unsubscribe ${safe(b.subscription.id, 40)}\``;
+var subscriptionsText = (b) => b.subscriptions.length ? b.subscriptions.map(subscriptionLine).join(`
+`) : "no subscriptions";
+
+// packages/cli/src/subscriptions-mcp.ts
 var STRING4 = { type: "string" };
-var STRINGS = { type: "array", items: STRING4 };
+var need4 = (args, key) => {
+  const value = args[key];
+  if (typeof value !== "string" || !value.trim())
+    throw new ToolArgError(`"${key}" is required (a non-empty string)`);
+  return value;
+};
+var optional5 = (args, key) => {
+  const value = args[key];
+  if (value === undefined || value === null)
+    return;
+  if (typeof value !== "string")
+    throw new ToolArgError(`"${key}" must be a string`);
+  return value.trim() || undefined;
+};
+var array = (args, key) => {
+  const value = args[key];
+  if (value === undefined || value === null)
+    return;
+  if (!Array.isArray(value) || !value.every((v) => typeof v === "string"))
+    throw new ToolArgError(`"${key}" must be a list of strings`);
+  return value;
+};
+var number = (args, key, min, max) => {
+  const value = args[key];
+  if (value === undefined || value === null)
+    return;
+  if (typeof value !== "number" || !Number.isInteger(value) || value < min || value > max)
+    throw new ToolArgError(`"${key}" must be a whole number from ${min} to ${max}`);
+  return value;
+};
+var subscriptionTools = [
+  {
+    name: "subscribe",
+    description: "Follow journal events for a subscriber session. A session subscribes itself; users and apps name subscriber. Apps need events:subscribe, sessions:read, relevant type scopes and messages:send unless silent. Hub checks visibility, rates and loops.",
+    properties: {
+      to: { type: ["string", "array"], items: STRING4, description: "One or more session/role/team addresses, or children." },
+      subscriber: STRING4,
+      types: { type: "array", items: STRING4 },
+      delivery: { type: "string", enum: ["queue", "steer", "silent"] },
+      batch: { type: "number", description: "Seconds per batch (1–3600)." },
+      expires: { type: "number", description: "Seconds until expiry." },
+      maxPerHour: { type: "integer", minimum: 1, maximum: 120 },
+      note: STRING4
+    },
+    required: ["to"],
+    readOnly: false,
+    run: async (hub, args, signal) => {
+      const to = typeof args.to === "string" && args.to.trim() ? args.to : array(args, "to");
+      if (!to || Array.isArray(to) && !to.length)
+        throw new ToolArgError('"to" needs at least one address');
+      const delivery = optional5(args, "delivery");
+      if (delivery && !["queue", "steer", "silent"].includes(delivery))
+        throw new ToolArgError('"delivery" is queue, steer or silent');
+      const subscriber = optional5(args, "subscriber");
+      const types = array(args, "types");
+      const batch = number(args, "batch", 1, 3600);
+      const expires = number(args, "expires", 1, 30 * 86400);
+      const maxPerHour = number(args, "maxPerHour", 1, 120);
+      const note = optional5(args, "note");
+      const input = { to, ...subscriber ? { subscriber } : {}, ...types ? { types } : {}, ...delivery ? { delivery } : {}, ...batch ? { batch } : {}, ...expires ? { expires } : {}, ...maxPerHour ? { maxPerHour } : {}, ...note ? { note } : {} };
+      return subscribedText(await hub.subscribe(input, { signal }));
+    }
+  },
+  {
+    name: "subscriptions",
+    description: "List subscriptions visible to this credential (session: its own; app: created by it; user: all). Optional session filter; route enforces scopes and tenancy.",
+    properties: { session: STRING4 },
+    readOnly: true,
+    run: async (hub, args, signal) => subscriptionsText(await hub.subscriptions({ ...optional5(args, "session") ? { session: optional5(args, "session") } : {}, signal }))
+  },
+  {
+    name: "unsubscribe",
+    description: "Remove a subscription this credential owns. An unknown or another caller's ID answers not_found.",
+    properties: { id: STRING4 },
+    required: ["id"],
+    readOnly: false,
+    organizes: true,
+    run: async (hub, args, signal) => {
+      const id = need4(args, "id");
+      await hub.unsubscribe(id, { signal });
+      return `unsubscribed ${id}`;
+    }
+  }
+];
+
+// packages/cli/src/mcp-operations.ts
+var STRING5 = { type: "string" };
+var need5 = (args, key) => {
+  const v = args[key];
+  if (typeof v !== "string" || !v.trim())
+    throw new ToolArgError(`"${key}" is required (a non-empty string)`);
+  return v;
+};
+var userOnly = async (hub, signal) => {
+  if ((await hub.whoami({ signal })).actor.kind !== "user")
+    throw new CliError(EXIT.forbidden, "only the user can use this tool", "Use the user's device credential");
+};
+var operationTools = [
+  {
+    name: "session_model_set",
+    description: "Set one existing session's model (providerID, modelID and optional variant), exactly as the console Model chip does. User device credential only; the console route checks ownership, catalog, availability and audit. An app or session cannot set it.",
+    properties: { session: STRING5, model: { type: "object", properties: { providerID: STRING5, modelID: STRING5, variant: STRING5 }, required: ["providerID", "modelID"] } },
+    required: ["session", "model"],
+    readOnly: false,
+    run: async (hub, args, signal) => {
+      await userOnly(hub, signal);
+      const model = args.model;
+      if (typeof model !== "object" || model === null || Array.isArray(model))
+        throw new ToolArgError('"model" is required (providerID, modelID, variant?)');
+      const result = await hub.call("PUT", `/api/sessions/${encodeURIComponent(need5(args, "session"))}/model`, { body: { model }, signal });
+      return JSON.stringify(result);
+    }
+  },
+  {
+    name: "machines",
+    description: "The user's own enrolled machines, online status and processes. User device credential only; wraps GET /api/machines. No machine tokens or secrets.",
+    properties: {},
+    readOnly: true,
+    run: async (hub, _args, signal) => {
+      await userOnly(hub, signal);
+      return JSON.stringify(await hub.call("GET", "/api/machines", { signal }));
+    }
+  },
+  {
+    name: "launch_nodes",
+    description: "The user's connected launch nodes: machine, workspace roots, capacity/used/free slots, runtimes (harnesses) and labels. User device credential only; no tokens, connection IDs or mutation.",
+    properties: {},
+    readOnly: true,
+    run: async (hub, _args, signal) => {
+      await userOnly(hub, signal);
+      return JSON.stringify(await hub.call("GET", "/api/agent/launch-nodes", { signal }));
+    }
+  }
+];
+
+// packages/cli/src/teams-mcp.ts
+var STRING6 = { type: "string" };
+var STRINGS = { type: "array", items: STRING6 };
 var TEAM2 = { type: "string", description: "The team: its ID (team_…) or its name." };
 var REVISION2 = { type: "integer", minimum: 0, description: "The team's revision you read (team_show); a stale one answers conflict with the current revision." };
 var IDEMPOTENCY = { type: "string", description: "Idempotency-Key: the same key and arguments within 24 h answer the first result again." };
-var KINDS3 = { type: "array", items: { type: "string", enum: ["msg", "ask"] }, description: "What the path permits: msg and/or ask (replies to a permitted ask never need a path)." };
+var KINDS5 = { type: "array", items: { type: "string", enum: ["msg", "ask"] }, description: "What the path permits: msg and/or ask (replies to a permitted ask never need a path)." };
 var DIRECTION = { type: "string", enum: ["one-way", "two-way"], description: "two-way: `to` may also contact `from` with the same kinds." };
 var ROLE_FIELDS = {
-  label: { ...STRING4, description: "A display label (confers no authority)." },
-  description: STRING4,
+  label: { ...STRING6, description: "A display label (confers no authority)." },
+  description: STRING6,
   externalContact: { type: "boolean", description: "Holders may contact sessions outside all their teams (default false)." },
   responsibilities: { ...STRINGS, description: "Short lines (at most 16)." },
-  profile: { type: "object", properties: { profileID: STRING4, version: { type: "integer", minimum: 1 } }, required: ["profileID"], description: "The agent profile members should run (reported, never pinned by staffing)." },
-  prefs: { type: "object", properties: { harness: STRING4, model: STRING4, machineID: STRING4 }, description: "Placement preferences for launched members (advisory)." },
+  profile: { type: "object", properties: { profileID: STRING6, version: { type: "integer", minimum: 1 } }, required: ["profileID"], description: "The agent profile members should run (reported, never pinned by staffing)." },
+  prefs: { type: "object", properties: { harness: STRING6, model: STRING6, machineID: STRING6 }, description: "Placement preferences for launched members (advisory)." },
   minMembers: { type: "integer", minimum: 0, maximum: 16 },
   maxMembers: { type: "integer", minimum: 1, maximum: 16 }
 };
-var ROLE = { type: "object", properties: { name: { ...STRING4, description: "A slug: lowercase letters, digits, dashes." }, ...ROLE_FIELDS }, required: ["name"] };
-var EDGE = { type: "object", properties: { from: STRING4, to: STRING4, kinds: KINDS3, direction: DIRECTION }, required: ["from", "to", "kinds", "direction"] };
+var ROLE = { type: "object", properties: { name: { ...STRING6, description: "A slug: lowercase letters, digits, dashes." }, ...ROLE_FIELDS }, required: ["name"] };
+var EDGE = { type: "object", properties: { from: STRING6, to: STRING6, kinds: KINDS5, direction: DIRECTION }, required: ["from", "to", "kinds", "direction"] };
 var SPEC_FIELDS = {
-  title: { ...STRING4, description: "1–120 characters." },
-  description: STRING4,
+  title: { ...STRING6, description: "1–120 characters." },
+  description: STRING6,
   mode: { type: "string", enum: ["open", "restricted"], description: "open: every member may msg/ask every other member. restricted: only the drawn paths (edges)." },
+  hopLimit: { type: "integer", minimum: 1, maximum: 1e4, description: "Agent-only wake hop limit between this team's seats; at most the hub's hop ceiling (agent_limits hopCeiling, default 100). The effective limit is the lower of this and the hub-wide hopLimit. Unset uses the hub-wide limit." },
+  itemBudget: { type: "object", properties: { wakes: { type: "integer", minimum: 10, maximum: 5000 }, hours: { type: "integer", minimum: 1, maximum: 720 } }, required: ["wakes", "hours"], description: "User-only per-item budget override: agent wakes and hours in progress." },
+  loop: { type: "object", properties: { messages: { type: "integer", minimum: 4, maximum: 200 }, windowMinutes: { type: "integer", minimum: 5, maximum: 240 } }, required: ["messages", "windowMinutes"], description: "User-only no-progress pair-message threshold and window." },
   roles: { type: "array", items: ROLE, description: "1–32 roles." },
-  entryRole: { ...STRING4, description: "The role that receives submitted work (e.g. pm) and supervises members." },
+  entryRole: { ...STRING6, description: "The role that receives submitted work (e.g. pm) and supervises members." },
   edges: { type: "array", items: EDGE, description: "Communication paths between roles (restricted mode)." },
   tags: { ...STRINGS, description: "Slugs." },
-  metadata: { type: "object", additionalProperties: STRING4, description: "String key/value pairs (keys are slugs)." },
+  metadata: { type: "object", additionalProperties: STRING6, description: "String key/value pairs (keys are slugs)." },
   projects: { ...STRINGS, description: "Project names the team works on." }
 };
 var LAUNCH = {
@@ -7023,11 +7349,11 @@ var LAUNCH = {
       type: "object",
       description: "Where the member works on its machine.",
       properties: {
-        repo: { ...STRING4, description: "The repository's absolute path on the machine." },
+        repo: { ...STRING6, description: "The repository's absolute path on the machine." },
         mode: { type: "string", enum: ["worktree", "checkout", "clone"], description: "worktree (default; needs branch), checkout, or clone (needs remote)." },
-        branch: { ...STRING4, description: "The branch to create or check out (a safe git branch name; required for worktree)." },
-        base: { ...STRING4, description: "What a new branch starts from." },
-        remote: { ...STRING4, description: "An https or ssh git remote, without credentials (required for clone)." }
+        branch: { ...STRING6, description: "The branch to create or check out (a safe git branch name; required for worktree)." },
+        base: { ...STRING6, description: "What a new branch starts from." },
+        remote: { ...STRING6, description: "An https or ssh git remote, without credentials (required for clone)." }
       },
       required: ["repo"]
     },
@@ -7035,8 +7361,8 @@ var LAUNCH = {
       type: "object",
       description: "Which machine runs it.",
       properties: {
-        machine: { ...STRING4, description: "A machine ID or name." },
-        labels: { type: "object", additionalProperties: STRING4, description: "Node labels to match." },
+        machine: { ...STRING6, description: "A machine ID or name." },
+        labels: { type: "object", additionalProperties: STRING6, description: "Node labels to match." },
         mode: { type: "string", enum: ["require", "prefer"], description: "require (default) or prefer the machine/labels." }
       }
     },
@@ -7044,7 +7370,7 @@ var LAUNCH = {
       type: "object",
       properties: {
         kind: { type: "string", enum: ["host", "openshell"], description: "host (default) or openshell (clone workspaces only)." },
-        profile: { ...STRING4, description: "An openshell sandbox profile (openshell only)." }
+        profile: { ...STRING6, description: "An openshell sandbox profile (openshell only)." }
       }
     },
     end: {
@@ -7056,27 +7382,27 @@ var LAUNCH = {
         cleanup: { type: "string", enum: ["keep", "remove"], description: "keep (default) or remove the workspace at the end." }
       }
     },
-    name: { ...STRING4, description: "The session's @name, without the @." },
+    name: { ...STRING6, description: "The session's @name, without the @." },
     roles: { ...STRINGS, description: "Roles the session claims (up to 10)." },
-    harness: { ...STRING4, description: "The harness (default opencode)." },
-    agent: { ...STRING4, description: "The harness agent." },
-    model: { ...STRING4, description: "provider/model." },
-    prompt: { ...STRING4, description: "The first prompt (up to 10000 characters)." },
-    intent: { ...STRING4, description: "What the session is for (one line)." },
-    labels: { type: "object", additionalProperties: STRING4, description: "Free-form app labels." },
-    agentProfile: { type: "object", properties: { profileID: STRING4, version: { type: "integer", minimum: 1 } }, required: ["profileID", "version"], description: "The profile version to pin (needs profiles:assign for an app)." }
+    harness: { ...STRING6, description: "The harness (default opencode)." },
+    agent: { ...STRING6, description: "The harness agent." },
+    model: { ...STRING6, description: "provider/model." },
+    prompt: { ...STRING6, description: "The first prompt (up to 10000 characters)." },
+    intent: { ...STRING6, description: "What the session is for (one line)." },
+    labels: { type: "object", additionalProperties: STRING6, description: "Free-form app labels." },
+    agentProfile: { type: "object", properties: { profileID: STRING6, version: { type: "integer", minimum: 1 } }, required: ["profileID", "version"], description: "The profile version to pin (needs profiles:assign for an app)." }
   },
   required: ["workspace"]
 };
 var SCOPES = "App tokens need scope teams:read (reads) or teams:manage (changes); seats, status and staffing also need sessions:read. Session tokens read only teams they are seated in and never change definitions. Team roles confer no authority.";
 var ArgError = ToolArgError;
-var need4 = (args, key) => {
+var need6 = (args, key) => {
   const value = args[key];
   if (typeof value !== "string" || !value.trim())
     throw new ArgError(`"${key}" is required (a non-empty string)`);
   return value;
 };
-var optional5 = (args, key) => {
+var optional6 = (args, key) => {
   const value = args[key];
   if (value === undefined || value === null)
     return;
@@ -7131,6 +7457,9 @@ function specLines(spec) {
   const role = (r) => `  ${r.name}${r.name === spec.entryRole ? " (entry)" : ""}${r.label ? `  "${one(r.label)}"` : ""}${r.externalContact ? "  external contact" : ""}${r.minMembers !== undefined || r.maxMembers !== undefined ? `  members ${r.minMembers ?? 0}–${r.maxMembers ?? 16}` : ""}${r.profile ? `  profile ${r.profile.profileID}${r.profile.version ? `@${r.profile.version}` : ""}` : ""}`;
   return [
     `mode: ${spec.mode}${spec.mode === "open" ? " (every member may msg/ask every other)" : " (only the paths below)"}`,
+    ...spec.hopLimit !== undefined ? [`hop limit: ${spec.hopLimit}`] : [],
+    ...spec.itemBudget ? [`item budget: ${spec.itemBudget.wakes} wakes, ${spec.itemBudget.hours} hours`] : [],
+    ...spec.loop ? [`loop: ${spec.loop.messages} messages per ${spec.loop.windowMinutes} minutes`] : [],
     `entry role: ${spec.entryRole}`,
     "roles:",
     ...spec.roles.map(role),
@@ -7149,7 +7478,7 @@ function rosterLines(roster) {
     const flags = [r.vacant ? "vacant" : "", r.understaffed ? `understaffed (min ${r.minMembers})` : "", r.launching ? `${r.launching} launching` : ""].filter(Boolean);
     lines.push(`  ${r.role}${r.entry ? " (entry)" : ""}  ${r.seats.length}/${r.maxMembers}  ${r.online} online${flags.length ? `  ${flags.join(", ")}` : ""}`);
     for (const s of r.seats)
-      lines.push(`    ${s.staffing.id}  ${s.staffing.sessionID}  ${s.presence}  gen ${s.staffing.generation} r${s.staffing.revision}${s.profile ? `  profile ${s.profile.status}${s.profile.matches ? "" : " (mismatch)"}` : ""}`);
+      lines.push(`    ${s.staffing.id}  ${s.staffing.sessionID}  ${s.presence}${s.stalled ? `  stalled: ${s.stalled}` : ""}  gen ${s.staffing.generation} r${s.staffing.revision}${s.profile ? `  profile ${s.profile.status}${s.profile.matches ? "" : " (mismatch)"}` : ""}`);
   }
   const failed = roster.requests.filter((q) => q.state !== "staffed").slice(-5);
   for (const q of failed)
@@ -7166,7 +7495,7 @@ var statusTool = (verb, description, organizes) => ({
   idempotent: true,
   run: async (hub, args, signal) => {
     const expectedRevision = revision(args);
-    const { team } = await hub.teams[verb](need4(args, "team"), expectedRevision, { signal });
+    const { team } = await hub.teams[verb](need6(args, "team"), expectedRevision, { signal });
     return `${team.revision === expectedRevision ? "unchanged" : { pause: "paused", resume: "resumed", archive: "archived", restore: "restored" }[verb]}: ${teamLine(team)}`;
   }
 });
@@ -7180,7 +7509,7 @@ var draftTool = (name, description, properties, required, edit) => ({
   idempotent: true,
   run: async (hub, args, signal) => {
     const expectedRevision = revision(args);
-    const { team, draft } = await edit(hub.teams, need4(args, "team"), args, expectedRevision, signal);
+    const { team, draft } = await edit(hub.teams, need6(args, "team"), args, expectedRevision, signal);
     return draftText("draft saved", team, draft);
   }
 });
@@ -7191,22 +7520,22 @@ var teamTools = [
     properties: {
       state: { type: "string", enum: ["active", "archived", "all"] },
       tags: STRINGS,
-      project: STRING4,
-      metadata: { type: "object", additionalProperties: STRING4 },
+      project: STRING6,
+      metadata: { type: "object", additionalProperties: STRING6 },
       paused: { type: "boolean" },
       limit: { type: "integer", minimum: 1, maximum: 200 },
-      cursor: STRING4
+      cursor: STRING6
     },
     readOnly: true,
     run: async (hub, args, signal) => {
-      const state = optional5(args, "state");
+      const state = optional6(args, "state");
       if (state !== undefined && !["active", "archived", "all"].includes(state))
         throw new ArgError(`"state" is one of active, archived, all`);
       const tags = strings3(args, "tags");
-      const project = optional5(args, "project");
+      const project = optional6(args, "project");
       const metadata = record(args, "metadata");
       const limit = int3(args, "limit", 1, 200);
-      const cursor = optional5(args, "cursor");
+      const cursor = optional6(args, "cursor");
       if (args.paused !== undefined && typeof args.paused !== "boolean")
         throw new ArgError(`"paused" must be true or false`);
       const page = await hub.teams.list({
@@ -7232,7 +7561,7 @@ var teamTools = [
     required: ["team"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const { team, draft } = await hub.teams.get(need4(args, "team"), { signal });
+      const { team, draft } = await hub.teams.get(need6(args, "team"), { signal });
       return [teamLine(team), ...specLines(team), ...draft ? [`draft pending (on v${draft.baseVersion}, saved ${when(draft.savedAt)}): see team_diff`] : []].join(`
 `);
     }
@@ -7244,7 +7573,7 @@ var teamTools = [
     required: ["team"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const { team, roster, intake } = await hub.teams.status(need4(args, "team"), { signal });
+      const { team, roster, intake } = await hub.teams.status(need6(args, "team"), { signal });
       const lines = [teamLine(team), ...rosterLines(roster)];
       if (intake)
         lines.push(`intake: ${intake.queued} queued, ${intake.routed} routed (${intake.open} open, ${intake.inProgress} in progress, ${intake.blocked} blocked), ${intake.done} done, ${intake.failed} failed, ${intake.cancelled} cancelled${intake.oldestQueuedAt !== undefined ? `; oldest queued ${when(intake.oldestQueuedAt)}` : ""}`);
@@ -7255,12 +7584,12 @@ var teamTools = [
   {
     name: "team_history",
     description: `A team's retained published versions, newest first (version, digest, when). ${SCOPES}`,
-    properties: { team: TEAM2, cursor: STRING4 },
+    properties: { team: TEAM2, cursor: STRING6 },
     required: ["team"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const cursor = optional5(args, "cursor");
-      const page = await hub.teams.versions(need4(args, "team"), { signal, ...cursor ? { cursor } : {} });
+      const cursor = optional6(args, "cursor");
+      const page = await hub.teams.versions(need6(args, "team"), { signal, ...cursor ? { cursor } : {} });
       return [...page.items.map((v) => `v${v.version}  ${v.digest.slice(0, 12)}  ${when(v.publishedAt)}`), ...page.cursor ? [`more: cursor ${page.cursor}`] : []].join(`
 `);
     }
@@ -7274,7 +7603,7 @@ var teamTools = [
     run: async (hub, args, signal) => {
       const from = int3(args, "from", 1, 1e9);
       const to = args.to === undefined || args.to === null || args.to === "draft" ? "draft" : int3(args, "to", 1, 1e9);
-      const { from: a, to: b, diff } = await hub.teams.diff(need4(args, "team"), { signal, ...from !== undefined ? { from } : {}, to });
+      const { from: a, to: b, diff } = await hub.teams.diff(need6(args, "team"), { signal, ...from !== undefined ? { from } : {}, to });
       const part = (label, d) => ["added", "removed", "changed"].flatMap((k) => d[k]?.length ? [`${label} ${k}: ${d[k].join(", ")}`] : []);
       const lines = [
         ...diff.fields.length ? [`fields changed: ${diff.fields.join(", ")}`] : [],
@@ -7291,16 +7620,16 @@ var teamTools = [
   {
     name: "team_create",
     description: `Assemble a persistent team: roles (one is the entry role that receives submitted work, e.g. a project manager), open or restricted communication with one-way/two-way paths, tags, projects and metadata. Published as version 1 at once; the name is the team's address (@@role#name) and never changes. ${SCOPES}`,
-    properties: { name: { ...STRING4, description: "A slug (2–40 lowercase letters, digits, dashes), unique per user." }, ...SPEC_FIELDS, idempotencyKey: IDEMPOTENCY },
+    properties: { name: { ...STRING6, description: "A slug (2–40 lowercase letters, digits, dashes), unique per user." }, ...SPEC_FIELDS, idempotencyKey: IDEMPOTENCY },
     required: ["name", "title", "mode", "roles", "entryRole"],
     readOnly: false,
     organizes: true,
     idempotent: true,
     run: async (hub, args, signal) => {
-      need4(args, "name");
-      need4(args, "title");
-      const key = optional5(args, "idempotencyKey");
-      const spec = picked(args, ["name", "title", "description", "mode", "roles", "entryRole", "edges", "tags", "metadata", "projects"]);
+      need6(args, "name");
+      need6(args, "title");
+      const key = optional6(args, "idempotencyKey");
+      const spec = picked(args, ["name", "title", "description", "mode", "hopLimit", "itemBudget", "loop", "roles", "entryRole", "edges", "tags", "metadata", "projects"]);
       const { team, created } = await hub.teams.create({ ...spec, edges: spec.edges ?? [] }, { signal, ...key ? { idempotencyKey: key } : {} });
       return [`${created ? "created" : "already created (same key)"}: ${teamLine(team)}`, ...specLines(team)].join(`
 `);
@@ -7316,24 +7645,24 @@ var teamTools = [
     idempotent: true,
     run: async (hub, args, signal) => {
       const expectedRevision = revision(args);
-      const patch = picked(args, ["title", "description", "mode", "roles", "entryRole", "edges", "tags", "metadata", "projects"]);
+      const patch = picked(args, ["title", "description", "mode", "hopLimit", "itemBudget", "loop", "roles", "entryRole", "edges", "tags", "metadata", "projects"]);
       if (Object.keys(patch).length === 0)
         throw new ArgError("give at least one field to change");
-      const id = need4(args, "team");
+      const id = need6(args, "team");
       const { team } = await hub.teams.update(id, patch, expectedRevision, { signal });
       return draftText("draft saved", team, (await hub.teams.draft(team.id, { signal })).draft);
     }
   },
-  draftTool("team_role_set", "Add a role to a team's draft, or replace the role of that name (all its fields).", { role: { ...STRING4, description: "The role's name (a slug)." }, ...ROLE_FIELDS }, ["role"], (teams, team, args, rev, signal) => teams.setRole(team, { name: need4(args, "role"), ...picked(args, Object.keys(ROLE_FIELDS)) }, rev, { signal })),
-  draftTool("team_role_remove", "Remove a role (not the entry role) and every path touching it from a team's draft.", { role: STRING4 }, ["role"], (teams, team, args, rev, signal) => teams.removeRole(team, need4(args, "role"), rev, { signal })),
-  draftTool("team_edge_set", "Draw a communication path from one role to another in a team's draft (replaces the path drawn between them).", { from: STRING4, to: STRING4, kinds: KINDS3, direction: DIRECTION }, ["from", "to", "kinds", "direction"], (teams, team, args, rev, signal) => {
+  draftTool("team_role_set", "Add a role to a team's draft, or replace the role of that name (all its fields).", { role: { ...STRING6, description: "The role's name (a slug)." }, ...ROLE_FIELDS }, ["role"], (teams, team, args, rev, signal) => teams.setRole(team, { name: need6(args, "role"), ...picked(args, Object.keys(ROLE_FIELDS)) }, rev, { signal })),
+  draftTool("team_role_remove", "Remove a role (not the entry role) and every path touching it from a team's draft.", { role: STRING6 }, ["role"], (teams, team, args, rev, signal) => teams.removeRole(team, need6(args, "role"), rev, { signal })),
+  draftTool("team_edge_set", "Draw a communication path from one role to another in a team's draft (replaces the path drawn between them).", { from: STRING6, to: STRING6, kinds: KINDS5, direction: DIRECTION }, ["from", "to", "kinds", "direction"], (teams, team, args, rev, signal) => {
     const kinds = strings3(args, "kinds");
     if (!kinds?.length)
       throw new ArgError(`"kinds" is a list of msg and/or ask`);
-    const direction = need4(args, "direction");
-    return teams.setEdge(team, { from: need4(args, "from"), to: need4(args, "to"), kinds, direction }, rev, { signal });
+    const direction = need6(args, "direction");
+    return teams.setEdge(team, { from: need6(args, "from"), to: need6(args, "to"), kinds, direction }, rev, { signal });
   }),
-  draftTool("team_edge_remove", "Remove the path drawn from one role to another (or a two-way path between them) from a team's draft.", { from: STRING4, to: STRING4 }, ["from", "to"], (teams, team, args, rev, signal) => teams.removeEdge(team, need4(args, "from"), need4(args, "to"), rev, { signal })),
+  draftTool("team_edge_remove", "Remove the path drawn from one role to another (or a two-way path between them) from a team's draft.", { from: STRING6, to: STRING6 }, ["from", "to"], (teams, team, args, rev, signal) => teams.removeEdge(team, need6(args, "from"), need6(args, "to"), rev, { signal })),
   {
     name: "team_discard_draft",
     description: `Drop a team's pending draft (unpublished edits are lost; the published version stays). ${SCOPES}`,
@@ -7341,7 +7670,7 @@ var teamTools = [
     required: ["team", "expectedRevision"],
     readOnly: false,
     idempotent: true,
-    run: async (hub, args, signal) => `draft discarded: ${teamLine((await hub.teams.discardDraft(need4(args, "team"), revision(args), { signal })).team)}`
+    run: async (hub, args, signal) => `draft discarded: ${teamLine((await hub.teams.discardDraft(need6(args, "team"), revision(args), { signal })).team)}`
   },
   {
     name: "team_publish",
@@ -7351,7 +7680,7 @@ var teamTools = [
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const { team, published } = await hub.teams.publish(need4(args, "team"), revision(args), { signal });
+      const { team, published } = await hub.teams.publish(need6(args, "team"), revision(args), { signal });
       return `${published ? `published version ${team.version}` : "the draft equalled the published version; dropped"}: ${teamLine(team)}`;
     }
   },
@@ -7362,17 +7691,17 @@ var teamTools = [
   {
     name: "team_staff",
     description: `Staff a role: attach an existing session (sessionID, any machine) or launch a new member (launch: a launch spec as the launch tool takes). An agent needs the user's grants (roles for the session's project; launch for a repo) or the hub answers needs_user; staffing never issues grants. ${SCOPES}`,
-    properties: { team: TEAM2, role: STRING4, sessionID: { ...STRING4, description: "An existing session (ses_…)." }, launch: LAUNCH, idempotencyKey: IDEMPOTENCY },
+    properties: { team: TEAM2, role: STRING6, sessionID: { ...STRING6, description: "An existing session (ses_…)." }, launch: LAUNCH, idempotencyKey: IDEMPOTENCY },
     required: ["team", "role"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const team = need4(args, "team");
-      const role = need4(args, "role");
-      const sessionID = optional5(args, "sessionID");
+      const team = need6(args, "team");
+      const role = need6(args, "role");
+      const sessionID = optional6(args, "sessionID");
       const launch = launchOf(args);
       if (sessionID === undefined === (launch === undefined))
         throw new ArgError(`give exactly one of sessionID or launch`);
-      const key = optional5(args, "idempotencyKey");
+      const key = optional6(args, "idempotencyKey");
       const options = { signal, ...key ? { idempotencyKey: key } : {} };
       if (sessionID !== undefined) {
         const r = await hub.teams.staff(team, { role, sessionID }, options);
@@ -7385,29 +7714,29 @@ var teamTools = [
   {
     name: "team_unstaff",
     description: `End a seat (the session leaves the role and loses the team's policy rights). Send the seat's revision (team_status). ${SCOPES}`,
-    properties: { team: TEAM2, staffingID: { ...STRING4, description: "The seat (stf_…)." }, expectedRevision: { ...REVISION2, description: "The seat's revision you read (team_status)." } },
+    properties: { team: TEAM2, staffingID: { ...STRING6, description: "The seat (stf_…)." }, expectedRevision: { ...REVISION2, description: "The seat's revision you read (team_status)." } },
     required: ["team", "staffingID", "expectedRevision"],
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const { staffing } = await hub.teams.unstaff(need4(args, "team"), need4(args, "staffingID"), revision(args), { signal });
+      const { staffing } = await hub.teams.unstaff(need6(args, "team"), need6(args, "staffingID"), revision(args), { signal });
       return `unstaffed ${staffing.id} (${staffing.sessionID} as ${staffing.role})`;
     }
   },
   {
     name: "team_replace",
     description: `Replace a seat by an existing session (sessionID) or a new launch (launch): the old seat ends at once and the new member gets the slot's next generation. Send the seat's revision (team_status). ${SCOPES}`,
-    properties: { team: TEAM2, staffingID: STRING4, sessionID: STRING4, launch: LAUNCH, expectedRevision: { ...REVISION2, description: "The seat's revision you read (team_status)." } },
+    properties: { team: TEAM2, staffingID: STRING6, sessionID: STRING6, launch: LAUNCH, expectedRevision: { ...REVISION2, description: "The seat's revision you read (team_status)." } },
     required: ["team", "staffingID", "expectedRevision"],
     readOnly: false,
     run: async (hub, args, signal) => {
       const expectedRevision = revision(args);
-      const sessionID = optional5(args, "sessionID");
+      const sessionID = optional6(args, "sessionID");
       const launch = launchOf(args);
       if (sessionID === undefined === (launch === undefined))
         throw new ArgError(`give exactly one of sessionID or launch`);
       const input = sessionID !== undefined ? { expectedRevision, sessionID } : { expectedRevision, launch };
-      const r = await hub.teams.replace(need4(args, "team"), need4(args, "staffingID"), input, { signal });
+      const r = await hub.teams.replace(need6(args, "team"), need6(args, "staffingID"), input, { signal });
       const next = r.staffing ? `${r.staffing.sessionID} (${r.staffing.id}, generation ${r.staffing.generation})` : `launch ${r.launch?.id ?? "?"} (request ${r.request?.id ?? "?"})`;
       return `replaced ${r.ended.sessionID} in ${r.ended.role} by ${next}`;
     }
@@ -7415,13 +7744,13 @@ var teamTools = [
 ];
 
 // packages/cli/src/profiles-mcp.ts
-var STRING5 = { type: "string" };
-var STRINGS2 = { type: "array", items: STRING5 };
+var STRING7 = { type: "string" };
+var STRINGS2 = { type: "array", items: STRING7 };
 var ID4 = { type: "string", description: "The profile's ID (prof_…; see profiles)." };
 var REVISION3 = { type: "integer", minimum: 0, description: "The profile's revision you read (profile_show); a stale one answers conflict with the current revision." };
 var IDEMPOTENCY2 = { type: "string", description: "Idempotency-Key: the same key and arguments within 24 h answer the first result again." };
-var SKILL = { type: "object", properties: { name: { ...STRING5, description: "A slug." }, description: STRING5, body: { ...STRING5, description: "The skill's full text (loaded on demand)." } }, required: ["name", "description", "body"] };
-var COMMAND3 = { type: "object", properties: { name: { ...STRING5, description: "A slug." }, description: STRING5, template: { ...STRING5, description: "Text with {{name}} parameters and {{secret:NAME}} references (never resolved by the hub)." } }, required: ["name", "description", "template"] };
+var SKILL = { type: "object", properties: { name: { ...STRING7, description: "A slug." }, description: STRING7, body: { ...STRING7, description: "The skill's full text (loaded on demand)." } }, required: ["name", "description", "body"] };
+var COMMAND3 = { type: "object", properties: { name: { ...STRING7, description: "A slug." }, description: STRING7, template: { ...STRING7, description: "Text with {{name}} parameters and {{secret:NAME}} references (never resolved by the hub)." } }, required: ["name", "description", "template"] };
 var CONTENT_FIELDS = {
   instructions: { type: ["string", "null"], description: "The profile's instructions (AGENTS.md-like text)." },
   model: { type: ["string", "null"], description: "provider/model the profile suggests." },
@@ -7429,21 +7758,21 @@ var CONTENT_FIELDS = {
   commands: { type: "array", items: COMMAND3, description: "Commands, wholesale." }
 };
 var META_FIELDS = {
-  title: { ...STRING5, description: "1–120 characters." },
-  description: STRING5,
+  title: { ...STRING7, description: "1–120 characters." },
+  description: STRING7,
   tags: { ...STRINGS2, description: "Slugs." },
-  metadata: { type: "object", additionalProperties: STRING5, description: "String key/value pairs (≤ 32 slug keys)." },
+  metadata: { type: "object", additionalProperties: STRING7, description: "String key/value pairs (≤ 32 slug keys)." },
   projects: { ...STRINGS2, description: "Project names the profile is meant for (≤ 16)." }
 };
 var SCOPES2 = "App tokens need scope profiles:read (reads) or profiles:manage (changes; profile_version_create with content fields and the skill/command set/remove tools read the latest version first, so they also need profiles:read); pins need profiles:assign and sessions:read (an app also needs a prompt grant on the session). Session tokens never change profiles. A profile confers no authority.";
 var ArgError2 = ToolArgError;
-var need5 = (args, key) => {
+var need7 = (args, key) => {
   const value = args[key];
   if (typeof value !== "string" || !value.trim())
     throw new ArgError2(`"${key}" is required (a non-empty string)`);
   return value;
 };
-var optional6 = (args, key) => {
+var optional7 = (args, key) => {
   const value = args[key];
   if (value === undefined || value === null)
     return;
@@ -7459,7 +7788,7 @@ var whole2 = (args, key, min, what) => {
 };
 var revision2 = (args) => whole2(args, "expectedRevision", 0, "the revision you read (profile_show; 0 for a session with no pin)");
 var idempotency = (args) => {
-  const key = optional6(args, "idempotencyKey");
+  const key = optional7(args, "idempotencyKey");
   return key ? { idempotencyKey: key } : {};
 };
 var picked2 = (args, keys) => Object.fromEntries(keys.filter((k) => args[k] !== undefined).map((k) => [k, args[k]]));
@@ -7492,7 +7821,7 @@ var contentTool = (name, description, properties, required, change) => ({
   idempotent: true,
   run: async (hub, args, signal) => {
     const expectedRevision = revision2(args);
-    const id = need5(args, "id");
+    const id = need7(args, "id");
     const { latest, content } = await latestContent(hub.profiles, id, signal);
     return versionText(await hub.profiles.createVersion(id, { expectedRevision, content: change(content, args, latest) }, { signal }));
   }
@@ -7512,7 +7841,7 @@ var stateTool = (verb, description) => ({
   idempotent: true,
   run: async (hub, args, signal) => {
     const expectedRevision = revision2(args);
-    const { profile } = await hub.profiles.update(need5(args, "id"), { expectedRevision, state: verb === "archive" ? "archived" : "active" }, { signal });
+    const { profile } = await hub.profiles.update(need7(args, "id"), { expectedRevision, state: verb === "archive" ? "archived" : "active" }, { signal });
     return `${verb === "archive" ? "archived" : "restored"}: ${profileLine(profile)}`;
   }
 });
@@ -7524,7 +7853,7 @@ var profileLifecycleTools = [
     required: ["id"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const { profile, latest } = await hub.profiles.get(need5(args, "id"), { signal });
+      const { profile, latest } = await hub.profiles.get(need7(args, "id"), { signal });
       return [
         profileLine(profile),
         ...profile.description ? [`description: ${one2(profile.description)}`] : [],
@@ -7539,13 +7868,13 @@ var profileLifecycleTools = [
   {
     name: "profile_versions",
     description: `A profile's retained versions, newest first (version, digest, bytes, when, skill and command counts). ${SCOPES2}`,
-    properties: { id: ID4, limit: { type: "integer", minimum: 1, maximum: 200 }, cursor: STRING5 },
+    properties: { id: ID4, limit: { type: "integer", minimum: 1, maximum: 200 }, cursor: STRING7 },
     required: ["id"],
     readOnly: true,
     run: async (hub, args, signal) => {
       const limit = args.limit === undefined ? undefined : whole2(args, "limit", 1, "a whole number from 1 to 200");
-      const cursor = optional6(args, "cursor");
-      const page = await hub.profiles.versions(need5(args, "id"), { signal, ...limit !== undefined ? { limit } : {}, ...cursor ? { cursor } : {} });
+      const cursor = optional7(args, "cursor");
+      const page = await hub.profiles.versions(need7(args, "id"), { signal, ...limit !== undefined ? { limit } : {}, ...cursor ? { cursor } : {} });
       const counts = (v) => v.skills !== undefined ? `  ${v.skills} skills, ${v.commands ?? 0} commands${v.instructions ? ", instructions" : ""}` : "";
       return [...page.items.map((v) => `v${v.version}  ${v.digest.slice(0, 12)}  ${v.bytes} bytes  ${new Date(v.createdAt).toISOString()}${counts(v)}`), ...page.cursor ? [`more: cursor ${page.cursor}`] : []].join(`
 `) || "no versions";
@@ -7554,14 +7883,14 @@ var profileLifecycleTools = [
   {
     name: "profile_create",
     description: `Create a profile: a versioned bundle of instructions, skills and commands, published as version 1 at once. The name is unique per user. Attach it to a team role with team_role_set (profile), pin it with profile_assign. ${SCOPES2}`,
-    properties: { name: { ...STRING5, description: "A slug, unique per user." }, ...META_FIELDS, ...CONTENT_FIELDS, idempotencyKey: IDEMPOTENCY2 },
+    properties: { name: { ...STRING7, description: "A slug, unique per user." }, ...META_FIELDS, ...CONTENT_FIELDS, idempotencyKey: IDEMPOTENCY2 },
     required: ["name", "title"],
     readOnly: false,
     organizes: true,
     idempotent: true,
     run: async (hub, args, signal) => {
-      need5(args, "name");
-      need5(args, "title");
+      need7(args, "name");
+      need7(args, "title");
       const meta = picked2(args, ["name", "title", "description", "tags", "metadata", "projects"]);
       const text = Object.entries(picked2(args, ["instructions", "model"])).filter(([, v]) => v !== null);
       const content = { ...Object.fromEntries(text), skills: args.skills ?? [], commands: args.commands ?? [] };
@@ -7583,7 +7912,7 @@ var profileLifecycleTools = [
       const patch = picked2(args, ["title", "description", "tags", "metadata", "projects"]);
       if (Object.keys(patch).length === 0)
         throw new ArgError2("give at least one field to change");
-      const { profile } = await hub.profiles.update(need5(args, "id"), { expectedRevision, ...patch }, { signal });
+      const { profile } = await hub.profiles.update(need7(args, "id"), { expectedRevision, ...patch }, { signal });
       return `updated: ${profileLine(profile)}`;
     }
   },
@@ -7597,7 +7926,7 @@ var profileLifecycleTools = [
     idempotent: true,
     run: async (hub, args, signal) => {
       const expectedRevision = revision2(args);
-      const id = need5(args, "id");
+      const id = need7(args, "id");
       const given = Object.keys(picked2(args, Object.keys(CONTENT_FIELDS)));
       const options = { signal, ...idempotency(args) };
       if (args.fromVersion !== undefined) {
@@ -7618,77 +7947,225 @@ var profileLifecycleTools = [
       return versionText(await hub.profiles.createVersion(id, { expectedRevision, content: next }, options));
     }
   },
-  contentTool("profile_skill_set", "Attach a skill to a profile, or replace the skill of that name.", { name: { ...STRING5, description: "The skill's name (a slug)." }, description: STRING5, body: { ...STRING5, description: "The skill's full text." } }, ["name", "description", "body"], (content, args) => ({
+  contentTool("profile_skill_set", "Attach a skill to a profile, or replace the skill of that name.", { name: { ...STRING7, description: "The skill's name (a slug)." }, description: STRING7, body: { ...STRING7, description: "The skill's full text." } }, ["name", "description", "body"], (content, args) => ({
     ...content,
-    skills: setNamed(content.skills, { name: need5(args, "name"), description: need5(args, "description"), body: need5(args, "body") })
+    skills: setNamed(content.skills, { name: need7(args, "name"), description: need7(args, "description"), body: need7(args, "body") })
   })),
-  contentTool("profile_skill_remove", "Detach a skill from a profile.", { name: { ...STRING5, description: "The skill's name." } }, ["name"], (content, args, latest) => ({
+  contentTool("profile_skill_remove", "Detach a skill from a profile.", { name: { ...STRING7, description: "The skill's name." } }, ["name"], (content, args, latest) => ({
     ...content,
-    skills: removeNamed(content.skills, need5(args, "name"), "skill", latest)
+    skills: removeNamed(content.skills, need7(args, "name"), "skill", latest)
   })),
-  contentTool("profile_command_set", "Attach a command to a profile, or replace the command of that name.", { name: { ...STRING5, description: "The command's name (a slug)." }, description: STRING5, template: COMMAND3.properties.template }, ["name", "description", "template"], (content, args) => ({ ...content, commands: setNamed(content.commands, { name: need5(args, "name"), description: need5(args, "description"), template: need5(args, "template") }) })),
-  contentTool("profile_command_remove", "Detach a command from a profile.", { name: { ...STRING5, description: "The command's name." } }, ["name"], (content, args, latest) => ({
+  contentTool("profile_command_set", "Attach a command to a profile, or replace the command of that name.", { name: { ...STRING7, description: "The command's name (a slug)." }, description: STRING7, template: COMMAND3.properties.template }, ["name", "description", "template"], (content, args) => ({ ...content, commands: setNamed(content.commands, { name: need7(args, "name"), description: need7(args, "description"), template: need7(args, "template") }) })),
+  contentTool("profile_command_remove", "Detach a command from a profile.", { name: { ...STRING7, description: "The command's name." } }, ["name"], (content, args, latest) => ({
     ...content,
-    commands: removeNamed(content.commands, need5(args, "name"), "command", latest)
+    commands: removeNamed(content.commands, need7(args, "name"), "command", latest)
   })),
   stateTool("archive", "Archive a profile: it takes no new versions or pins; pinned sessions keep theirs; reversible with profile_restore."),
   stateTool("restore", "Restore an archived profile (it takes versions and pins again)."),
   {
     name: "profile_assign",
     description: `Pin a profile version to a session (applied through its machine; the ack tells whether it took). Send the session's pin revision (0 when it has none; see profile). Pinning confers no authority. ${SCOPES2}`,
-    properties: { addr: { ...STRING5, description: "The session: @name, ses_… ID or other address." }, profileID: ID4, version: { type: "integer", minimum: 1 }, expectedRevision: { ...REVISION3, description: "The session's pin revision (0 when it has none)." } },
+    properties: { addr: { ...STRING7, description: "The session: @name, ses_… ID or other address." }, profileID: ID4, version: { type: "integer", minimum: 1 }, expectedRevision: { ...REVISION3, description: "The session's pin revision (0 when it has none)." } },
     required: ["addr", "profileID", "version", "expectedRevision"],
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
       const expectedRevision = revision2(args);
-      const { assignment: a } = await hub.profiles.assign(need5(args, "addr"), { profileID: need5(args, "profileID"), version: whole2(args, "version", 1, "a version number"), expectedRevision }, { signal });
+      const { assignment: a } = await hub.profiles.assign(need7(args, "addr"), { profileID: need7(args, "profileID"), version: whole2(args, "version", 1, "a version number"), expectedRevision }, { signal });
       return `${a.sessionID} pins ${a.profileID} v${a.version} r${a.revision}${a.ack ? `, ack ${a.ack.status}${a.ack.offline ? " (offline)" : ""}` : ""}`;
     }
   },
   {
     name: "profile_unassign",
     description: `Remove a session's pin (what it already applied stays until it restarts). Send the pin's revision (profile_assign's answer). ${SCOPES2}`,
-    properties: { addr: { ...STRING5, description: "The session." }, expectedRevision: { ...REVISION3, description: "The session's pin revision." } },
+    properties: { addr: { ...STRING7, description: "The session." }, expectedRevision: { ...REVISION3, description: "The session's pin revision." } },
     required: ["addr", "expectedRevision"],
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const addr = need5(args, "addr");
+      const addr = need7(args, "addr");
       await hub.profiles.unassign(addr, revision2(args), { signal });
       return `unpinned ${addr}`;
     }
   }
 ];
 
+// packages/cli/src/grants.ts
+var GRANT_FLAGS = {
+  json: "json",
+  holder: "string",
+  project: "multi",
+  allow: "multi",
+  permit: "multi",
+  never: "multi",
+  expires: "string",
+  "max-per-hour": "string",
+  "allow-always": "bool"
+};
+var GRANT_REQUEST_FLAGS = { ...GRANT_FLAGS, "permission-allow": "multi", why: "string" };
+var GRANT_USER_HINT = "only the user manages grants: use the console, or `hub login` with the user's device token";
+function userOnly2(source, what) {
+  if (source === "env")
+    throw new CliError(EXIT.forbidden, `only the user can ${what} a grant, not a session`, GRANT_USER_HINT);
+}
+function grantError(error) {
+  if (error instanceof CliError && error.exit === EXIT.forbidden)
+    return new CliError(error.exit, error.message, [error.hint, GRANT_USER_HINT].filter(Boolean).join("; "), error.envelope);
+  return error;
+}
+var listOf = (flags, name) => (flags[name] ?? []).flatMap((v) => v.split(",")).map((v) => v.trim()).filter(Boolean);
+async function grantSpecArg(flags, stdin) {
+  return await grantArg(flags, stdin, true);
+}
+function grantRequestArg(flags, stdin) {
+  return grantArg(flags, stdin, false);
+}
+async function grantArg(flags, stdin, holderRequired) {
+  const json = typeof flags.json === "string" ? flags.json : undefined;
+  const flagged = Object.keys(GRANT_REQUEST_FLAGS).filter((name) => name !== "json" && name !== "why" && flags[name] !== undefined);
+  if (json !== undefined) {
+    if (flagged.length)
+      throw new UsageError(`give either --json '{…}' or ${flagged.map((f) => `--${f}`).join(", ")}`);
+    return await jsonObjectArg(json, stdin, "grant");
+  }
+  const holder = str(flags, "holder");
+  if (holder === undefined && holderRequired)
+    throw new UsageError("needs --holder (ses_…, @name, @@orchestrator…, or app:<token id>)");
+  const projects = listOf(flags, "project");
+  if (!projects.length)
+    throw new UsageError("needs --project <path> (repeatable)");
+  const allow = listOf(flags, "allow");
+  if (!allow.length)
+    throw new UsageError("needs --allow <verbs> (approve, deny, answer, prompt, stop, roles, launch)");
+  const permit = [...listOf(flags, "permit"), ...listOf(flags, "permission-allow")];
+  const never = listOf(flags, "never");
+  const expires = str(flags, "expires");
+  const cap = str(flags, "max-per-hour");
+  if (cap !== undefined && !/^\d+$/.test(cap))
+    throw new UsageError("--max-per-hour is a whole number");
+  return {
+    ...holder !== undefined ? { holder } : {},
+    scope: { projects },
+    allow,
+    ...permit.length || never.length ? { permissions: { ...permit.length ? { allow: permit } : {}, ...never.length ? { never } : {} } } : {},
+    ...expires !== undefined ? { expires } : {},
+    ...cap !== undefined ? { maxActionsPerHour: Number(cap) } : {},
+    ...flags["allow-always"] === true ? { allowAlways: true } : {}
+  };
+}
+var iso4 = (ms) => new Date(ms).toISOString().replace(/\.\d{3}Z$/, "Z");
+var grantLine = (g) => [g.id, g.state, g.holder, g.allow.join(","), g.scope.projects.join(","), `until ${iso4(g.expiresAt)}`].join("  ");
+var grantsText = (grants) => grants.length ? grants.map(grantLine).join(`
+`) : "no grants";
+function grantText2(g) {
+  const list = (values) => values.length ? values.join(", ") : "none";
+  return [
+    `${g.id}  ${g.state}`,
+    `holder: ${g.holder}${g.holderSessionID && g.holderSessionID !== g.holder ? ` (${g.holderSessionID})` : ""}`,
+    `projects: ${list(g.scope.projects)}`,
+    `verbs: ${list(g.allow)}`,
+    `permissions allow: ${list(g.permissions.allow)}`,
+    `permissions never: ${list(g.permissions.never)}`,
+    `always: ${g.allowAlways ? "yes" : "no"}`,
+    `max actions per hour: ${g.maxActionsPerHour}`,
+    g.revokedAt !== undefined ? `revoked: ${iso4(g.revokedAt)}` : `expires: ${iso4(g.expiresAt)}`
+  ].join(`
+`);
+}
+var requestedText = (body) => `requested; waiting for the user (Decision ${body.decision.id})`;
+
+// packages/cli/src/grants-mcp.ts
+var STRING8 = { type: "string" };
+var GRANT = { type: "object", description: "The grant spec accepted by POST /api/agent/grants: holder (optional for a request), scope.projects, allow, permissions, allowAlways, maxActionsPerHour and expires. The server validates all fields.", additionalProperties: true };
+var need8 = (args, key) => {
+  if (typeof args[key] !== "string" || !args[key].trim())
+    throw new ToolArgError(`"${key}" is required (a non-empty string)`);
+  return args[key];
+};
+var spec = (args) => {
+  if (typeof args.grant !== "object" || args.grant === null || Array.isArray(args.grant))
+    throw new ToolArgError('"grant" is required (an object)');
+  return args.grant;
+};
+var grantTools = [
+  {
+    name: "grant_request",
+    description: "Ask the user for a grant: opens one tap Decision for @me (approve or deny). Sessions and apps with messages:send only; one open request and at most five per hour. Only the user's answer creates authority.",
+    properties: { grant: GRANT, why: STRING8 },
+    required: ["grant", "why"],
+    readOnly: false,
+    run: async (hub, args, signal) => requestedText(await hub.requestGrant(spec(args), need8(args, "why"), { signal }))
+  },
+  {
+    name: "grant_list",
+    description: "List grants (active, expired or revoked) whose holder is this session or app, including grants for roles it holds now. Apps need messages:read. A user credential has no holder: use the console or hub grant list for administration.",
+    properties: {},
+    readOnly: true,
+    run: async (hub, _args, signal) => grantsText((await hub.heldGrants({ signal })).grants)
+  },
+  {
+    name: "grant_show",
+    description: "Show one grant only if this credential currently holds it. Apps need messages:read; another holder's ID answers not_found.",
+    properties: { id: STRING8 },
+    required: ["id"],
+    readOnly: true,
+    run: async (hub, args, signal) => grantText2((await hub.heldGrant(need8(args, "id"), { signal })).grant)
+  },
+  {
+    name: "grant_revoke",
+    description: "Irreversibly revoke a grant held by this session or app (including a held role shared with other holders). Apps need messages:send; another holder's ID answers not_found.",
+    properties: { id: STRING8 },
+    required: ["id"],
+    readOnly: false,
+    run: async (hub, args, signal) => grantText2((await hub.revokeHeldGrant(need8(args, "id"), { signal })).grant)
+  },
+  {
+    name: "grant_create",
+    description: `Create a grant directly ONLY with the user's device credential. Sessions and apps must use grant_request and wait for the user's tap. ${GRANT_USER_HINT}.`,
+    properties: { grant: GRANT },
+    required: ["grant"],
+    readOnly: false,
+    run: async (hub, args, signal) => {
+      const actor = (await hub.whoami({ signal })).actor;
+      if (actor.kind !== "user")
+        throw new CliError(EXIT.forbidden, "only the user can create a grant, not a session or app", GRANT_USER_HINT);
+      try {
+        return grantText2((await hub.createGrant(spec(args), { signal })).grant);
+      } catch (cause) {
+        throw grantError(cause);
+      }
+    }
+  }
+];
+
 // packages/cli/src/watchlist.ts
-var safe = (value) => sanitizeLabel(String(value), 1024);
-var list2 = (items) => items.length ? items.map(safe).join(", ") : "none";
+var safe2 = (value) => sanitizeLabel(String(value), 1024);
+var list2 = (items) => items.length ? items.map(safe2).join(", ") : "none";
 function watchlistConfigText(c) {
   return [
-    `revision ${safe(c.revision)}`,
-    `auto-active: ${c.autoActive ? `on (within ${safe(c.activeWithinHours)} h)` : "off"}  pins: ${c.usePins ? "on" : "off"}`,
+    `revision ${safe2(c.revision)}`,
+    `auto-active: ${c.autoActive ? `on (within ${safe2(c.activeWithinHours)} h)` : "off"}  pins: ${c.usePins ? "on" : "off"}`,
     `sessions: ${list2(c.sessions)}`,
     `projects: ${list2(c.projects)}`,
-    `labels: ${c.labels.length ? c.labels.map((l) => Object.entries(l).map(([k, v]) => `${safe(k)}=${safe(v)}`).join(",")).join("; ") : "none"}`,
+    `labels: ${c.labels.length ? c.labels.map((l) => Object.entries(l).map(([k, v]) => `${safe2(k)}=${safe2(v)}`).join(",")).join("; ") : "none"}`,
     `muted: ${list2(c.muted)}`,
     `muted projects: ${list2(c.mutedProjects)}`
   ].join(`
 `);
 }
 function watchlistText(view) {
-  const rows = view.entries.map((e) => `${safe(e.sessionID)}  ${e.reasons.map(safe).join(",")}${e.lastActiveAt !== undefined ? `  active ${new Date(e.lastActiveAt).toISOString()}` : ""}`);
+  const rows = view.entries.map((e) => `${safe2(e.sessionID)}  ${e.reasons.map(safe2).join(",")}${e.lastActiveAt !== undefined ? `  active ${new Date(e.lastActiveAt).toISOString()}` : ""}`);
   return [watchlistConfigText(view.config), "", view.entries.length ? `watching ${view.entries.length}${view.truncated ? " (truncated)" : ""}:` : "watching nothing", ...rows].join(`
 `);
 }
 function watchlistChangedText(verb, r) {
-  return `${r.changed ? `${verb}` : `already ${verb}`}: ${safe(r.sessionID)} (revision ${safe(r.config.revision)})`;
+  return `${r.changed ? `${verb}` : `already ${verb}`}: ${safe2(r.sessionID)} (revision ${safe2(r.config.revision)})`;
 }
 var PAST = { watch: "watching", unwatch: "not watching", mute: "muted", unmute: "unmuted" };
 var watchlistVerbText = (verb, r) => watchlistChangedText(PAST[verb], r);
 var ADDR = { type: "string", description: "Session address: ses_… (or a unique prefix), @name, @@role, @name.project." };
 var STRINGS3 = { type: "array", items: { type: "string" } };
-var need6 = (args, key) => {
+var need9 = (args, key) => {
   const value = args[key];
   if (typeof value !== "string" || !value.trim())
     throw new ToolArgError(`"${key}" is required (a non-empty string)`);
@@ -7734,13 +8211,13 @@ var watchlistTools = [
         throw new ToolArgError(`"expectedRevision" is required (the revision you read)`);
       const unknown = Object.keys(args).filter((k) => k !== "expectedRevision" && !UPDATE_FIELDS.includes(k));
       if (unknown.length)
-        throw new ToolArgError(`Unknown argument${unknown.length > 1 ? "s" : ""} ${unknown.map((k) => `"${safe(k).slice(0, 40)}"`).join(", ")}: use ${UPDATE_FIELDS.join(", ")} and expectedRevision`);
+        throw new ToolArgError(`Unknown argument${unknown.length > 1 ? "s" : ""} ${unknown.map((k) => `"${safe2(k).slice(0, 40)}"`).join(", ")}: use ${UPDATE_FIELDS.join(", ")} and expectedRevision`);
       const patch = {};
       for (const field of UPDATE_FIELDS)
         if (args[field] !== undefined && args[field] !== null)
           patch[field] = args[field];
       const r = await hub.concierge.watchlist.update(patch, expected, { signal });
-      const head = r.config.revision === expected ? `No change (revision ${safe(expected)})` : `Updated the watchlist (revision ${safe(expected)} → ${safe(r.config.revision)})`;
+      const head = r.config.revision === expected ? `No change (revision ${safe2(expected)})` : `Updated the watchlist (revision ${safe2(expected)} → ${safe2(r.config.revision)})`;
       return `${head}
 ${watchlistConfigText(r.config)}`;
     }
@@ -7755,7 +8232,7 @@ ${watchlistConfigText(r.config)}`;
     idempotent: true,
     run: async (hub, args, signal) => {
       const on = flag(args, "watch", true);
-      const addr = need6(args, "addr");
+      const addr = need9(args, "addr");
       const r = on ? await hub.concierge.watchlist.watch(addr, { signal }) : await hub.concierge.watchlist.unwatch(addr, { signal });
       return watchlistVerbText(on ? "watch" : "unwatch", r);
     }
@@ -7770,7 +8247,7 @@ ${watchlistConfigText(r.config)}`;
     idempotent: true,
     run: async (hub, args, signal) => {
       const on = flag(args, "mute", true);
-      const addr = need6(args, "addr");
+      const addr = need9(args, "addr");
       const r = on ? await hub.concierge.watchlist.mute(addr, { signal }) : await hub.concierge.watchlist.unmute(addr, { signal });
       return watchlistVerbText(on ? "mute" : "unmute", r);
     }
@@ -7781,13 +8258,13 @@ ${watchlistConfigText(r.config)}`;
 var MCP_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
 var RPC = { parse: -32700, invalidRequest: -32600, methodNotFound: -32601, invalidParams: -32602, internal: -32603 };
 var ArgError3 = ToolArgError;
-var need7 = (args, key) => {
+var need10 = (args, key) => {
   const value = args[key];
   if (typeof value !== "string" || !value.trim())
     throw new ArgError3(`"${key}" is required (a non-empty string)`);
   return value;
 };
-var optional7 = (args, key) => {
+var optional8 = (args, key) => {
   const value = args[key];
   if (value === undefined || value === null)
     return;
@@ -7865,10 +8342,11 @@ var sendOptions = (args) => {
   const wake = optionalBool(args, "wake");
   const urgent = optionalBool(args, "urgent");
   const notAfter = optionalNotAfter(args);
-  return { ...wake !== undefined ? { wake } : {}, ...urgent !== undefined ? { urgent } : {}, ...notAfter !== undefined ? { notAfter } : {} };
+  const item = optional8(args, "item");
+  return { ...wake !== undefined ? { wake } : {}, ...urgent !== undefined ? { urgent } : {}, ...notAfter !== undefined ? { notAfter } : {}, ...item !== undefined ? { item } : {} };
 };
 var whyOption = (args) => {
-  const why = optional7(args, "why");
+  const why = optional8(args, "why");
   return why !== undefined ? { why } : {};
 };
 var optionalDelivery = (args) => {
@@ -7911,35 +8389,35 @@ var definedFields = (fields) => {
   return Object.keys(out).length ? out : undefined;
 };
 function launchSpec(args) {
-  const repo = need7(args, "repo");
+  const repo = need10(args, "repo");
   if (!repo.startsWith("/"))
     throw new ArgError3(`"repo" must be an absolute path on the node`);
   const kind = optionalEnum(args, "runtime", RUNTIME_KINDS);
-  const profile = optional7(args, "profile");
+  const profile = optional8(args, "profile");
   if (profile !== undefined && kind === undefined)
     throw new ArgError3(`"profile" needs "runtime" (e.g. openshell)`);
   const nodeLabels = optionalLabels(args, "nodeLabels");
-  const machine = optional7(args, "machine");
+  const machine = optional8(args, "machine");
   const prefer = optionalBool(args, "prefer") === true;
   if (prefer && machine === undefined && nodeLabels === undefined)
     throw new ArgError3(`"prefer" needs "machine" or "nodeLabels"`);
-  const workspace = { repo, ...definedFields({ mode: optionalEnum(args, "mode", WORKSPACE_MODES), branch: optional7(args, "branch"), base: optional7(args, "base"), remote: optional7(args, "remote") }) };
+  const workspace = { repo, ...definedFields({ mode: optionalEnum(args, "mode", WORKSPACE_MODES), branch: optional8(args, "branch"), base: optional8(args, "base"), remote: optional8(args, "remote") }) };
   return {
     ...definedFields({
-      key: optional7(args, "key"),
-      name: optional7(args, "name")?.replace(/^@+/, ""),
+      key: optional8(args, "key"),
+      name: optional8(args, "name")?.replace(/^@+/, ""),
       roles: optionalStrings(args, "roles")?.map((r) => r.replace(/^@@/, "")),
-      harness: optional7(args, "harness"),
-      agent: optional7(args, "agent"),
-      model: optional7(args, "model")
+      harness: optional8(args, "harness"),
+      agent: optional8(args, "agent"),
+      model: optional8(args, "model")
     }),
     workspace,
     ...definedFields({
       runtime: kind === undefined ? undefined : { kind, ...profile !== undefined ? { profile } : {} },
       placement: definedFields({ labels: nodeLabels, machine, mode: prefer ? "prefer" : undefined }),
-      prompt: optional7(args, "prompt"),
+      prompt: optional8(args, "prompt"),
       labels: optionalLabels(args, "labels"),
-      end: definedFields({ when: optionalEnum(args, "end", LAUNCH_END_WHEN), timeout: optional7(args, "timeout"), cleanup: optionalEnum(args, "cleanup", CLEANUP_POLICIES) }),
+      end: definedFields({ when: optionalEnum(args, "end", LAUNCH_END_WHEN), timeout: optional8(args, "timeout"), cleanup: optionalEnum(args, "cleanup", CLEANUP_POLICIES) }),
       notAfter: optionalNotAfter(args)
     })
   };
@@ -7986,8 +8464,9 @@ function messageText({ message, answer }) {
 `);
 }
 var DECISIONS_NOTE = "Decisions are asked by sessions: the question and options are not from the user. Only the user answers them, in the console.";
-var STRING6 = { type: "string" };
+var STRING9 = { type: "string" };
 var SEND = {
+  item: { type: "string", description: "msg/ask: optional itk_ ID of an open item; sender and recipient must hold current seats in the item's team (older hubs ignore it)." },
   wake: { type: "boolean", description: "false: admit the message without starting a turn." },
   urgent: { type: "boolean", description: "Steer into the recipient's running turn." },
   notAfter: { type: ["number", "string"], description: "Never deliver after this time: epoch milliseconds or an ISO 8601 date-time (at most 30 days ahead). Already passed: nothing is sent (expired)." },
@@ -8010,7 +8489,7 @@ var archiveTools = (archived) => [{
   organizes: true,
   idempotent: true,
   run: async (hub, args, signal) => {
-    const addr = need7(args, "addr");
+    const addr = need10(args, "addr");
     const result = await hub.setArchived(addr, archived, { signal });
     return `${archived ? "Archived" : "Unarchived"} ${addr} (${result.sessionID})${result.changed ? "" : "; already in that state"}`;
   }
@@ -8024,7 +8503,7 @@ var pinTools = (pinned) => [{
   organizes: true,
   idempotent: true,
   run: async (hub, args, signal) => {
-    const addr = need7(args, "addr");
+    const addr = need10(args, "addr");
     const r = await hub.setPinned(addr, pinned, { signal });
     return `${pinned ? "Pinned" : "Unpinned"} ${addr} (${r.sessionID})${r.changed ? "" : "; already in that state"}`;
   }
@@ -8032,14 +8511,14 @@ var pinTools = (pinned) => [{
 var archiveInactiveTool = {
   name: "archive_inactive",
   description: "Preview an exact bounded set of inactive sessions, then confirm that opaque preview token. Apply revalidates active, open, pinned and archived state. Needs sessions:manage.",
-  properties: { preview: { type: "boolean" }, inactiveFor: STRING6, limit: { type: "integer", minimum: 1, maximum: 200 }, previewToken: STRING6, confirm: { type: "boolean" } },
+  properties: { preview: { type: "boolean" }, inactiveFor: STRING9, limit: { type: "integer", minimum: 1, maximum: 200 }, previewToken: STRING9, confirm: { type: "boolean" } },
   readOnly: false,
   organizes: true,
   run: async (hub, args, signal) => {
     if (args.preview === true)
-      return JSON.stringify(await hub.previewArchiveInactive(need7(args, "inactiveFor"), optionalInt(args, "limit", 1, 200) ?? 50, { signal }));
+      return JSON.stringify(await hub.previewArchiveInactive(need10(args, "inactiveFor"), optionalInt(args, "limit", 1, 200) ?? 50, { signal }));
     if (args.confirm === true)
-      return JSON.stringify(await hub.archiveInactive(need7(args, "previewToken"), { signal }));
+      return JSON.stringify(await hub.archiveInactive(need10(args, "previewToken"), { signal }));
     throw new ArgError3("Use preview:true with inactiveFor, then confirm:true with previewToken");
   }
 };
@@ -8050,19 +8529,19 @@ var intentTools = [
     properties: { addr: ADDR2 },
     required: ["addr"],
     readOnly: true,
-    run: async (hub, args, signal) => intentLine(need7(args, "addr"), (await hub.intent(need7(args, "addr"), { signal })).intent)
+    run: async (hub, args, signal) => intentLine(need10(args, "addr"), (await hub.intent(need10(args, "addr"), { signal })).intent)
   },
   {
     name: "session_intent_set",
     description: "Set (text, one line, at most 280 characters) or clear (clear: true) a session's intent. Users and apps (sessions:manage) set the user's intent; a session token only its own session's. expectedRevision: the revision read (read first when absent); a stale one is a conflict.",
-    properties: { addr: ADDR2, text: STRING6, clear: { type: "boolean" }, expectedRevision: { type: "integer", minimum: 0 } },
+    properties: { addr: ADDR2, text: STRING9, clear: { type: "boolean" }, expectedRevision: { type: "integer", minimum: 0 } },
     required: ["addr"],
     readOnly: false,
     organizes: true,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const addr = need7(args, "addr");
-      const text = optional7(args, "text");
+      const addr = need10(args, "addr");
+      const text = optional8(args, "text");
       const clear = args.clear === true;
       if (clear === (text !== undefined))
         throw new ArgError3('Give "text" or "clear": true');
@@ -8072,22 +8551,22 @@ var intentTools = [
   }
 ];
 var TARGET = { ...ADDR2, description: `${ADDR2.description} Required for an app token; a session token defaults to itself.` };
-var ROLE2 = { ...STRING6, description: "A role (reviewer, @@reviewer or reviewer.project)." };
-var ROLE_PROJECT = { ...STRING6, description: "Scope the role to this project (as role.project)." };
+var ROLE2 = { ...STRING9, description: "A role (reviewer, @@reviewer or reviewer.project)." };
+var ROLE_PROJECT = { ...STRING9, description: "Scope the role to this project (as role.project)." };
 var MANAGE_NOTE = "Needs scope sessions:manage for an app token";
 var roleText2 = (r) => `@@${r.role}${r.project !== undefined ? `.${r.project}` : ""}`;
 var nameTools = [
   {
     name: "name",
     description: `Name a session (@name); as a session, leave addr out to name yourself (a session token names only its own session). Its previous name stays an alias for 24 h. A taken name fails (name_taken); @me is reserved. ${MANAGE_NOTE}.`,
-    properties: { addr: TARGET, name: { ...STRING6, description: "The name: 2–40 characters a-z, 0-9 and - (a leading @ is fine)." } },
+    properties: { addr: TARGET, name: { ...STRING9, description: "The name: 2–40 characters a-z, 0-9 and - (a leading @ is fine)." } },
     required: ["name"],
     readOnly: false,
     organizes: true,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const session = optional7(args, "addr");
-      const r = await hub.name(need7(args, "name"), { ...session ? { session } : {}, signal });
+      const session = optional8(args, "addr");
+      const r = await hub.name(need10(args, "name"), { ...session ? { session } : {}, signal });
       return `Named ${r.sessionID} @${r.name}${r.alias ? ` (@${r.alias} stays an alias for 24 h)` : ""}`;
     }
   },
@@ -8100,9 +8579,9 @@ var nameTools = [
     organizes: true,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const session = optional7(args, "addr");
-      const project = optional7(args, "project");
-      const r = await hub.claimRole(need7(args, "role"), { ...session ? { session } : {}, ...project !== undefined ? { project } : {}, ...optionalBool(args, "exclusive") ? { exclusive: true } : {}, signal });
+      const session = optional8(args, "addr");
+      const project = optional8(args, "project");
+      const r = await hub.claimRole(need10(args, "role"), { ...session ? { session } : {}, ...project !== undefined ? { project } : {}, ...optionalBool(args, "exclusive") ? { exclusive: true } : {}, signal });
       return `${r.sessionID} holds ${roleText2(r)} (generation ${r.generation}${r.exclusive ? ", exclusive" : ""})`;
     }
   },
@@ -8114,9 +8593,9 @@ var nameTools = [
     readOnly: false,
     organizes: true,
     run: async (hub, args, signal) => {
-      const session = optional7(args, "addr");
-      const project = optional7(args, "project");
-      const r = await hub.releaseRole(need7(args, "role"), { ...session ? { session } : {}, ...project !== undefined ? { project } : {}, signal });
+      const session = optional8(args, "addr");
+      const project = optional8(args, "project");
+      const r = await hub.releaseRole(need10(args, "role"), { ...session ? { session } : {}, ...project !== undefined ? { project } : {}, signal });
       return `${r.sessionID} released ${roleText2(r)}`;
     }
   }
@@ -8125,16 +8604,16 @@ var eventsTool = {
   name: "events",
   description: "Compact Hub events (session.*, blocker.*, machine.changed, message.changed, launch.changed, session.archived) after a cursor, as JSON {events, cursor, more, reset, refresh?}. Call without cursor to start at the latest, then pass back the returned cursor. reset:true means the cursor expired: re-read the listed snapshots (status, sessions, inbox, …) and continue with the new cursor. Unknown event types are valid; ignore them. Needs scope events:subscribe (plus each family's scope) for an app token.",
   properties: {
-    cursor: { ...STRING6, description: "The cursor from the previous events answer (hev1_…); omit to start at the latest." },
+    cursor: { ...STRING9, description: "The cursor from the previous events answer (hev1_…); omit to start at the latest." },
     wait: { type: "integer", minimum: 0, maximum: WAIT_POLL_MAX_S, description: `Seconds to wait while nothing matches (0–${WAIT_POLL_MAX_S}).` },
     limit: { type: "integer", minimum: 1, maximum: 200, description: "At most this many events (default 50)." },
-    types: { type: "array", items: STRING6, description: "Only these event types (exact, or a family like launch.*)." },
-    sessions: { type: "array", items: STRING6, description: "Only events of these sessions (ses_…, @name, @@role)." }
+    types: { type: "array", items: STRING9, description: "Only these event types (exact, or a family like launch.*)." },
+    sessions: { type: "array", items: STRING9, description: "Only events of these sessions (ses_…, @name, @@role)." }
   },
   readOnly: true,
   run: async (hub, args, signal) => {
     const page = await hub.events({
-      cursor: optional7(args, "cursor"),
+      cursor: optional8(args, "cursor"),
       wait: optionalInt(args, "wait", 0, WAIT_POLL_MAX_S),
       limit: optionalInt(args, "limit", 1, 200),
       types: optionalStrings(args, "types"),
@@ -8149,13 +8628,13 @@ var webhookTools = [
   {
     name: "webhook_create",
     description: `Create a durable signed webhook for canonical compact events (e.g. launch.*, session.*, message.changed, team.intake). The signing secret is returned only here. Needs events:subscribe plus every selected family's scope; events ["team.intake"] alone needs only teams:submit (an app gets only its own submissions).`,
-    properties: { url: STRING6, events: { type: "array", items: STRING6 }, label: STRING6 },
+    properties: { url: STRING9, events: { type: "array", items: STRING9 }, label: STRING9 },
     required: ["url"],
     readOnly: false,
     run: async (hub, args, signal) => {
       const events = optionalStrings(args, "events");
-      const label = optional7(args, "label");
-      const r = await hub.webhookCreate({ url: need7(args, "url"), ...events ? { events } : {}, ...label ? { label } : {} }, { signal });
+      const label = optional8(args, "label");
+      const r = await hub.webhookCreate({ url: need10(args, "url"), ...events ? { events } : {}, ...label ? { label } : {} }, { signal });
       return `${webhookText(r.webhook)}
 signing secret (shown once): ${r.secret}`;
     }
@@ -8174,11 +8653,11 @@ signing secret (shown once): ${r.secret}`;
   {
     name: "webhook_show",
     description: "Show one webhook and its retained delivery attempts; never its secret.",
-    properties: { id: STRING6 },
+    properties: { id: STRING9 },
     required: ["id"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const r = await hub.webhook(need7(args, "id"), { signal });
+      const r = await hub.webhook(need10(args, "id"), { signal });
       return `${webhookText(r.webhook)}
 ${JSON.stringify(r.deliveries)}`;
     }
@@ -8186,20 +8665,20 @@ ${JSON.stringify(r.deliveries)}`;
   {
     name: "webhook_delete",
     description: "Delete one webhook and its pending deliveries.",
-    properties: { id: STRING6 },
+    properties: { id: STRING9 },
     required: ["id"],
     readOnly: false,
     organizes: true,
     idempotent: false,
     run: async (hub, args, signal) => {
-      const id = need7(args, "id");
+      const id = need10(args, "id");
       await hub.webhookDelete(id, { signal });
       return `Deleted webhook ${id}`;
     }
   }
 ];
 async function profileTarget(hub, args, signal) {
-  const addr = optional7(args, "addr");
+  const addr = optional8(args, "addr");
   if (addr)
     return addr;
   const { actor } = await hub.whoami({ signal });
@@ -8238,11 +8717,11 @@ var profileTools = [
   {
     name: "profile_skill",
     description: "Load one skill's full text from the profile pinned to a session (your own by default), on demand.",
-    properties: { name: STRING6, addr: ADDR2 },
+    properties: { name: STRING9, addr: ADDR2 },
     required: ["name"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const r = await hub.profiles.sessionSkill(await profileTarget(hub, args, signal), need7(args, "name"), { signal });
+      const r = await hub.profiles.sessionSkill(await profileTarget(hub, args, signal), need10(args, "name"), { signal });
       return `skill ${r.skill.name} (${r.profileID} v${r.version}):
 ${sanitizeText(r.skill.body)}`;
     }
@@ -8250,11 +8729,11 @@ ${sanitizeText(r.skill.body)}`;
   {
     name: "profile_command",
     description: "Render one command of the profile pinned to a session (your own by default) with its {{name}} parameters. Returns the text only: nothing is sent. {{secret:NAME}} references stay unresolved.",
-    properties: { name: STRING6, params: { type: "object", additionalProperties: STRING6, description: "Parameter name → text value." }, addr: ADDR2 },
+    properties: { name: STRING9, params: { type: "object", additionalProperties: STRING9, description: "Parameter name → text value." }, addr: ADDR2 },
     required: ["name"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const r = await hub.profiles.sessionRender(await profileTarget(hub, args, signal), need7(args, "name"), optionalParams(args), { signal });
+      const r = await hub.profiles.sessionRender(await profileTarget(hub, args, signal), need10(args, "name"), optionalParams(args), { signal });
       return r.prompt;
     }
   },
@@ -8273,13 +8752,13 @@ ${sanitizeText(r.skill.body)}`;
   {
     name: "profile_usage",
     description: "Where one profile is used: pinned sessions (requested vs running version, ack, presence, harness), team roles naming it, launches that named it and the sessions' workspaces, with counts. An app token needs profiles:read, plus sessions:read / teams:read / sessions:launch (its own launches) / workspaces:read for each part; parts it may not read are listed as hidden.",
-    properties: { id: STRING6, limit: { type: "integer", minimum: 1, maximum: 200, description: "Sessions per page (default 50)." }, cursor: STRING6 },
+    properties: { id: STRING9, limit: { type: "integer", minimum: 1, maximum: 200, description: "Sessions per page (default 50)." }, cursor: STRING9 },
     required: ["id"],
     readOnly: true,
     run: async (hub, args, signal) => {
       const limit = optionalInt(args, "limit", 1, 200);
-      const cursor = optional7(args, "cursor");
-      const u = await hub.profiles.usage(need7(args, "id"), { ...limit !== undefined ? { limit } : {}, ...cursor ? { cursor } : {}, signal });
+      const cursor = optional8(args, "cursor");
+      const u = await hub.profiles.usage(need10(args, "id"), { ...limit !== undefined ? { limit } : {}, ...cursor ? { cursor } : {}, signal });
       const c = u.counts;
       const plural = (n, word, many = `${word}s`) => `${n} ${n === 1 ? word : many}`;
       const lines = [`${u.profileID} (latest v${u.latestVersion})`];
@@ -8322,7 +8801,7 @@ var needRevision = (args, key = "expectedRevision") => {
   return value;
 };
 var idemOption = (args) => {
-  const key = optional7(args, "idempotencyKey");
+  const key = optional8(args, "idempotencyKey");
   return key !== undefined ? { idempotencyKey: key } : {};
 };
 var WORKSPACE = { type: "string", description: "The workspace's ID (ws_…)." };
@@ -8352,7 +8831,7 @@ var workspaceTools = [
     required: ["workspace"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const id = need7(args, "workspace");
+      const id = need10(args, "workspace");
       const [{ workspace, bindings }, { members }, graph] = await Promise.all([hub.workspaces.get(id, { signal }), hub.workspaces.members(id, { signal }), hub.workspaces.supervision(id, { signal })]);
       const lines = [wsLine(workspace)];
       if (workspace.masterMemberID)
@@ -8368,27 +8847,27 @@ var workspaceTools = [
   {
     name: "workspace_create",
     description: `Create a coordination workspace. ${WS_SCOPES}`,
-    properties: { title: STRING6, description: STRING6, tags: { type: "array", items: STRING6 }, idempotencyKey: IDEMPOTENCY3 },
+    properties: { title: STRING9, description: STRING9, tags: { type: "array", items: STRING9 }, idempotencyKey: IDEMPOTENCY3 },
     required: ["title"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const description = optional7(args, "description");
+      const description = optional8(args, "description");
       const tags = optionalStrings(args, "tags");
-      const { workspace } = await hub.workspaces.create({ title: need7(args, "title"), ...description ? { description } : {}, ...tags ? { tags } : {} }, { ...idemOption(args), signal });
+      const { workspace } = await hub.workspaces.create({ title: need10(args, "title"), ...description ? { description } : {}, ...tags ? { tags } : {} }, { ...idemOption(args), signal });
       return `created ${wsLine(workspace)}`;
     }
   },
   {
     name: "workspace_update",
     description: `Change a workspace's title, description or tags under its revision. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, expectedRevision: REVISION4, title: STRING6, description: STRING6, tags: { type: "array", items: STRING6 } },
+    properties: { workspace: WORKSPACE, expectedRevision: REVISION4, title: STRING9, description: STRING9, tags: { type: "array", items: STRING9 } },
     required: ["workspace", "expectedRevision"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const patch = definedFields({ title: optional7(args, "title"), description: optional7(args, "description"), tags: optionalStrings(args, "tags") });
+      const patch = definedFields({ title: optional8(args, "title"), description: optional8(args, "description"), tags: optionalStrings(args, "tags") });
       if (!patch)
         throw new ArgError3(`give "title", "description" or "tags"`);
-      const { workspace } = await hub.workspaces.update(need7(args, "workspace"), { expectedRevision: needRevision(args), ...patch }, { signal });
+      const { workspace } = await hub.workspaces.update(need10(args, "workspace"), { expectedRevision: needRevision(args), ...patch }, { signal });
       return `updated ${wsLine(workspace)}`;
     }
   },
@@ -8400,7 +8879,7 @@ var workspaceTools = [
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const id = need7(args, "workspace");
+      const id = need10(args, "workspace");
       if (verb === "archive") {
         const r = await hub.workspaces.archive(id, needRevision(args), { signal });
         return `archived ${wsLine(r.workspace)}; ${r.departed} member(s) departed, ${r.supervision.detached} supervision link(s) detached`;
@@ -8411,31 +8890,31 @@ var workspaceTools = [
   {
     name: "workspace_bind",
     description: `Bind a workspace to a repository (absolute path) on one of the user's machines. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, machineID: STRING6, repo: STRING6, label: STRING6, idempotencyKey: IDEMPOTENCY3 },
+    properties: { workspace: WORKSPACE, machineID: STRING9, repo: STRING9, label: STRING9, idempotencyKey: IDEMPOTENCY3 },
     required: ["workspace", "machineID", "repo"],
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const label = optional7(args, "label");
-      const r = await hub.workspaces.bind(need7(args, "workspace"), { machineID: need7(args, "machineID"), repo: need7(args, "repo"), ...label ? { label } : {} }, { ...idemOption(args), signal });
+      const label = optional8(args, "label");
+      const r = await hub.workspaces.bind(need10(args, "workspace"), { machineID: need10(args, "machineID"), repo: need10(args, "repo"), ...label ? { label } : {} }, { ...idemOption(args), signal });
       return `${r.created ? "bound" : "already bound"} ${r.binding.id}  ${r.binding.machineID}:${r.binding.repo}  r${r.binding.revision}`;
     }
   },
   {
     name: "workspace_unbind",
     description: `Remove a repository binding under the binding's revision. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, bindingID: STRING6, expectedRevision: REVISION4 },
+    properties: { workspace: WORKSPACE, bindingID: STRING9, expectedRevision: REVISION4 },
     required: ["workspace", "bindingID", "expectedRevision"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      await hub.workspaces.unbind(need7(args, "workspace"), need7(args, "bindingID"), needRevision(args), { signal });
-      return `unbound ${need7(args, "bindingID")}`;
+      await hub.workspaces.unbind(need10(args, "workspace"), need10(args, "bindingID"), needRevision(args), { signal });
+      return `unbound ${need10(args, "bindingID")}`;
     }
   },
   {
     name: "workspace_join",
     description: `Add a session (ses_…) to a workspace as worker or observer (the master is set by explicit replacement). ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, sessionID: STRING6, role: { type: "string", enum: [...MEMBER_ROLES] }, idempotencyKey: IDEMPOTENCY3 },
+    properties: { workspace: WORKSPACE, sessionID: STRING9, role: { type: "string", enum: [...MEMBER_ROLES] }, idempotencyKey: IDEMPOTENCY3 },
     required: ["workspace", "sessionID", "role"],
     readOnly: false,
     idempotent: true,
@@ -8443,45 +8922,45 @@ var workspaceTools = [
       const role = optionalEnum(args, "role", MEMBER_ROLES);
       if (!role)
         throw new ArgError3(`"role" is one of ${MEMBER_ROLES.join(", ")}`);
-      const { member, created } = await hub.workspaces.join(need7(args, "workspace"), { sessionID: need7(args, "sessionID"), role }, { ...idemOption(args), signal });
+      const { member, created } = await hub.workspaces.join(need10(args, "workspace"), { sessionID: need10(args, "sessionID"), role }, { ...idemOption(args), signal });
       return `member ${member.id} (${member.sessionID}, ${member.role}, generation ${member.generation}, r${member.revision}) ${created ? "joined" : "was already a member"}`;
     }
   },
   {
     name: "workspace_leave",
     description: `Remove a member under its revision; its supervision links are detached. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, memberID: STRING6, expectedRevision: REVISION4 },
+    properties: { workspace: WORKSPACE, memberID: STRING9, expectedRevision: REVISION4 },
     required: ["workspace", "memberID", "expectedRevision"],
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const r = await hub.workspaces.leave(need7(args, "workspace"), need7(args, "memberID"), needRevision(args), { signal });
+      const r = await hub.workspaces.leave(need10(args, "workspace"), need10(args, "memberID"), needRevision(args), { signal });
       return `member ${r.member.id} left (${r.member.leftReason ?? "removed"}); ${r.supervision.detached} supervision link(s) detached`;
     }
   },
   {
     name: "workspace_assign",
     description: `Give a current member an assignment (title and optional outcome criteria; instructions travel as messages). ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, memberID: STRING6, title: STRING6, criteria: { type: "array", items: STRING6 }, ref: STRING6, idempotencyKey: IDEMPOTENCY3 },
+    properties: { workspace: WORKSPACE, memberID: STRING9, title: STRING9, criteria: { type: "array", items: STRING9 }, ref: STRING9, idempotencyKey: IDEMPOTENCY3 },
     required: ["workspace", "memberID", "title"],
     readOnly: false,
     run: async (hub, args, signal) => {
       const criteria = optionalStrings(args, "criteria");
-      const ref = optional7(args, "ref");
-      const { assignment } = await hub.workspaces.assign(need7(args, "workspace"), { memberID: need7(args, "memberID"), title: need7(args, "title"), ...criteria ? { criteria } : {}, ...ref ? { ref } : {} }, { ...idemOption(args), signal });
+      const ref = optional8(args, "ref");
+      const { assignment } = await hub.workspaces.assign(need10(args, "workspace"), { memberID: need10(args, "memberID"), title: need10(args, "title"), ...criteria ? { criteria } : {}, ...ref ? { ref } : {} }, { ...idemOption(args), signal });
       return `assignment ${assignment.id} → ${assignment.memberID}: ${assignment.status}, r${assignment.revision}`;
     }
   },
   {
     name: "workspace_assignments",
     description: `A workspace's assignments (id, member, status, revision, title), optionally one member's or one status. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, memberID: STRING6, status: { type: "string", enum: [...ASSIGNMENT_STATUSES] } },
+    properties: { workspace: WORKSPACE, memberID: STRING9, status: { type: "string", enum: [...ASSIGNMENT_STATUSES] } },
     required: ["workspace"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const memberID = optional7(args, "memberID");
+      const memberID = optional8(args, "memberID");
       const status = optionalEnum(args, "status", ASSIGNMENT_STATUSES);
-      const r = await hub.workspaces.assignments(need7(args, "workspace"), { ...memberID ? { memberID } : {}, ...status ? { status } : {}, limit: 200, signal });
+      const r = await hub.workspaces.assignments(need10(args, "workspace"), { ...memberID ? { memberID } : {}, ...status ? { status } : {}, limit: 200, signal });
       return r.items.length ? r.items.map((v) => `${v.assignment.id}  ${v.assignment.memberID} (${v.member}, ${v.presence})  ${v.assignment.status}  r${v.assignment.revision}  ${oneLine(sanitizeText(v.assignment.title))}`).join(`
 `) : "no assignments";
     }
@@ -8489,16 +8968,16 @@ var workspaceTools = [
   {
     name: "workspace_assignment_update",
     description: `Set an assignment's status (done and cancelled are final) or move it to another current member, under its revision. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, assignmentID: STRING6, expectedRevision: REVISION4, status: { type: "string", enum: [...ASSIGNMENT_STATUSES] }, memberID: STRING6 },
+    properties: { workspace: WORKSPACE, assignmentID: STRING9, expectedRevision: REVISION4, status: { type: "string", enum: [...ASSIGNMENT_STATUSES] }, memberID: STRING9 },
     required: ["workspace", "assignmentID", "expectedRevision"],
     readOnly: false,
     run: async (hub, args, signal) => {
       const status = optionalEnum(args, "status", ASSIGNMENT_STATUSES);
-      const memberID = optional7(args, "memberID");
+      const memberID = optional8(args, "memberID");
       if (status === undefined === (memberID === undefined))
         throw new ArgError3(`give exactly one of "status" or "memberID"`);
-      const id = need7(args, "workspace");
-      const assignmentID = need7(args, "assignmentID");
+      const id = need10(args, "workspace");
+      const assignmentID = need10(args, "assignmentID");
       const { assignment } = status !== undefined ? await hub.workspaces.setAssignmentStatus(id, assignmentID, status, needRevision(args), { signal }) : await hub.workspaces.reassign(id, assignmentID, memberID, needRevision(args), { signal });
       return `assignment ${assignment.id} → ${assignment.memberID}: ${assignment.status}, r${assignment.revision}`;
     }
@@ -8506,16 +8985,16 @@ var workspaceTools = [
   {
     name: "workspace_supervise",
     description: `Set who supervises a member (supervisor null detaches), under the supervision graph's revision (workspace_show). Acyclic, at most 6 levels. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, memberID: STRING6, supervisor: { type: ["string", "null"], description: "The supervising member's ID, or null to detach." }, order: { type: "number" }, expectedRevision: REVISION4 },
+    properties: { workspace: WORKSPACE, memberID: STRING9, supervisor: { type: ["string", "null"], description: "The supervising member's ID, or null to detach." }, order: { type: "number" }, expectedRevision: REVISION4 },
     required: ["workspace", "memberID", "supervisor", "expectedRevision"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const supervisor = args.supervisor === null ? null : need7(args, "supervisor");
+      const supervisor = args.supervisor === null ? null : need10(args, "supervisor");
       const order = args.order;
       if (order !== undefined && (typeof order !== "number" || !Number.isFinite(order)))
         throw new ArgError3(`"order" must be a number`);
-      const r = await hub.workspaces.supervise(need7(args, "workspace"), { memberID: need7(args, "memberID"), supervisorMemberID: supervisor, ...order !== undefined ? { order } : {}, expectedRevision: needRevision(args) }, { signal });
-      return `${r.change}: ${need7(args, "memberID")}${r.link ? ` ← ${r.link.supervisorMemberID} (order ${r.link.order})` : ""}; supervision revision ${r.revision}${r.pruned ? `, ${r.pruned} stale link(s) dropped` : ""}`;
+      const r = await hub.workspaces.supervise(need10(args, "workspace"), { memberID: need10(args, "memberID"), supervisorMemberID: supervisor, ...order !== undefined ? { order } : {}, expectedRevision: needRevision(args) }, { signal });
+      return `${r.change}: ${need10(args, "memberID")}${r.link ? ` ← ${r.link.supervisorMemberID} (order ${r.link.order})` : ""}; supervision revision ${r.revision}${r.pruned ? `, ${r.pruned} stale link(s) dropped` : ""}`;
     }
   },
   {
@@ -8525,7 +9004,7 @@ var workspaceTools = [
     required: ["workspace"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const v = await hub.workspaces.master(need7(args, "workspace"), { signal });
+      const v = await hub.workspaces.master(need10(args, "workspace"), { signal });
       const line = (m) => `${m.member.id}  ${m.member.sessionID}  generation ${m.member.generation}  ${m.presence}${m.member.leftReason ? `  (${m.member.leftReason})` : ""}`;
       return [
         `workspace ${v.workspaceID} r${v.revision}`,
@@ -8539,17 +9018,17 @@ var workspaceTools = [
   {
     name: "workspace_master_replace",
     description: `Replace (or first set) a workspace's master under the workspace revision: a session (ses_…) or a running launch's session (launchID). The old master departs as replaced; its supervised members move to the new one. No grants move: the new master's session needs its own grants. ${WS_SCOPES}`,
-    properties: { workspace: WORKSPACE, sessionID: STRING6, launchID: STRING6, expectedRevision: REVISION4, idempotencyKey: IDEMPOTENCY3 },
+    properties: { workspace: WORKSPACE, sessionID: STRING9, launchID: STRING9, expectedRevision: REVISION4, idempotencyKey: IDEMPOTENCY3 },
     required: ["workspace", "expectedRevision"],
     readOnly: false,
     idempotent: true,
     run: async (hub, args, signal) => {
-      const sessionID = optional7(args, "sessionID");
-      const launchID = optional7(args, "launchID");
+      const sessionID = optional8(args, "sessionID");
+      const launchID = optional8(args, "launchID");
       if (sessionID === undefined === (launchID === undefined))
         throw new ArgError3(`give exactly one of "sessionID" or "launchID"`);
       const target = sessionID !== undefined ? { sessionID } : { launchID };
-      const r = await hub.workspaces.replaceMaster(need7(args, "workspace"), { ...target, expectedRevision: needRevision(args) }, { ...idemOption(args), signal });
+      const r = await hub.workspaces.replaceMaster(need10(args, "workspace"), { ...target, expectedRevision: needRevision(args) }, { ...idemOption(args), signal });
       if (!r.changed)
         return `${r.master.sessionID} already is the master (${r.master.id}); nothing changed`;
       return [
@@ -8567,7 +9046,7 @@ var workspaceTools = [
     required: ["workspace"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const b = await hub.workspaces.board(need7(args, "workspace"), { signal });
+      const b = await hub.workspaces.board(need10(args, "workspace"), { signal });
       const more = (truncated) => truncated ? "  (more not shown)" : "";
       const section = (name, s, line) => s.status === "ok" ? [`${name}:${more(s.truncated)}`, ...s.items.map((i) => `  ${line(i)}`)] : [`${name}: ${s.status}${s.status === "omitted" ? ` (needs ${s.scope})` : ""}`];
       const lines = [wsLine(b.workspace), ...b.workspace.masterMemberID ? [`master: ${b.workspace.masterMemberID}`] : []];
@@ -8593,12 +9072,22 @@ var TOOLS = [
   ...webhookTools,
   ...profileTools,
   ...profileLifecycleTools,
+  ...grantTools,
   ...workspaceTools,
   ...artifactTools,
   ...artifactJobTools,
   ...teamIntakeTools,
+  ...subscriptionTools,
+  ...operationTools,
   ...teamTools,
   ...watchlistTools,
+  {
+    name: "agent_limits",
+    description: "Read the hub-wide agent hop limit, the hop ceiling (the highest hop limit the hub accepts) and launch caps, their sources and revision. Read-only; only an admin may change them in the console.",
+    properties: {},
+    readOnly: true,
+    run: async (hub, _args, signal) => JSON.stringify(await hub.call("GET", "/api/agent/agent-limits", { signal }), null, 2)
+  },
   {
     name: "whoami",
     description: "Who this hub credential is: the app token of `hub login` (or the session of HUB_SESSION_TOKEN) and its user.",
@@ -8617,14 +9106,14 @@ var TOOLS = [
     name: "sessions",
     description: "The sessions as a flat list, optionally filtered.",
     properties: {
-      project: { ...STRING6, description: "Only this project." },
-      state: { ...STRING6, description: "Only these states (comma-separated, e.g. busy,blocked)." },
-      machine: { ...STRING6, description: "Only this machine." },
-      label: { type: "array", items: STRING6, description: "key=value labels that must all match." }
+      project: { ...STRING9, description: "Only this project." },
+      state: { ...STRING9, description: "Only these states (comma-separated, e.g. busy,blocked)." },
+      machine: { ...STRING9, description: "Only this machine." },
+      label: { type: "array", items: STRING9, description: "key=value labels that must all match." }
     },
     readOnly: true,
     run: async (hub, args, signal) => {
-      const body = await hub.sessions({ project: optional7(args, "project"), state: optional7(args, "state"), machine: optional7(args, "machine"), label: optionalStrings(args, "label"), signal });
+      const body = await hub.sessions({ project: optional8(args, "project"), state: optional8(args, "state"), machine: optional8(args, "machine"), label: optionalStrings(args, "label"), signal });
       return sessionsText(body.sessions ?? []);
     }
   },
@@ -8634,7 +9123,7 @@ var TOOLS = [
     properties: { addr: ADDR2 },
     required: ["addr"],
     readOnly: true,
-    run: async (hub, args, signal) => showText(await hub.show(need7(args, "addr"), { signal }))
+    run: async (hub, args, signal) => showText(await hub.show(need10(args, "addr"), { signal }))
   },
   {
     name: "log",
@@ -8643,7 +9132,7 @@ var TOOLS = [
     required: ["addr"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const addr = need7(args, "addr");
+      const addr = need10(args, "addr");
       const n = optionalInt(args, "n", 1, 200);
       return logText((await hub.log(addr, { ...n !== undefined ? { n } : {}, signal })).rows ?? []);
     }
@@ -8652,25 +9141,25 @@ var TOOLS = [
     name: "who",
     description: "Named and role-holding sessions; a team member sees its teams, grouped by team with its reach to each.",
     properties: {
-      project: { ...STRING6, description: "Only this project." },
-      role: { ...STRING6, description: "Only holders of this role (reviewer, @@reviewer or reviewer#team)." },
-      team: { ...STRING6, description: "Only this team (name or ID)." }
+      project: { ...STRING9, description: "Only this project." },
+      role: { ...STRING9, description: "Only holders of this role (reviewer, @@reviewer or reviewer#team)." },
+      team: { ...STRING9, description: "Only this team (name or ID)." }
     },
     readOnly: true,
     run: async (hub, args, signal) => {
-      const body = await hub.who({ project: optional7(args, "project"), role: optional7(args, "role"), team: optional7(args, "team"), signal });
+      const body = await hub.who({ project: optional8(args, "project"), role: optional8(args, "role"), team: optional8(args, "team"), signal });
       return whoText(body.sessions ?? [], body);
     }
   },
   {
     name: "msg",
     description: "Tell a session something (fire and forget). Sent as this server's credential, not as an OpenCode session.",
-    properties: { to: TO, text: { ...STRING6, description: "The message." }, ...SEND, idempotencyKey: IDEMPOTENCY3 },
+    properties: { to: TO, text: { ...STRING9, description: "The message." }, ...SEND, idempotencyKey: IDEMPOTENCY3 },
     required: ["to", "text"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const to = need7(args, "to");
-      const text = need7(args, "text");
+      const to = need10(args, "to");
+      const text = need10(args, "text");
       const options = { ...sendOptions(args), ...idemOption(args), signal };
       if (optionalBool(args, "all"))
         return sentAllText(await hub.msg(to, text, { ...options, all: true }));
@@ -8679,10 +9168,11 @@ var TOOLS = [
   },
   {
     name: "ask",
-    description: `Ask a session a question, tracked until answered, declined or expired. wait (at most ${WAIT_POLL_MAX_S} s) blocks for the answer; otherwise it shows up in the inbox tool.`,
+    description: `Ask a session a question, tracked until answered, declined or expired. wait (at most ${WAIT_POLL_MAX_S} s) blocks for the answer; otherwise it shows up in the inbox tool. To @me it opens a Decision for the user: give options (buttons) with a recommendation, or choices (several points in one ask), and urgency, tier and kind.`,
     properties: {
       to: TO,
-      text: { ...STRING6, description: "The question." },
+      text: { ...STRING9, description: "The question." },
+      ...DECISION_ASK_PROPERTIES,
       wait: { type: "number", minimum: 0, maximum: WAIT_POLL_MAX_S, description: `Seconds to wait for the answer (0–${WAIT_POLL_MAX_S}).` },
       expires: { type: ["number", "string"], description: "When the ask expires: seconds, or 30s, 5m, 2h, 1d (1 minute to 7 days; default 24 h)." },
       ...SEND,
@@ -8691,11 +9181,17 @@ var TOOLS = [
     required: ["to", "text"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const to = need7(args, "to");
-      const text = need7(args, "text");
+      const to = need10(args, "to");
+      const text = need10(args, "text");
       const wait = optionalWait(args);
       const expires = optionalExpires(args);
-      const options = { ...sendOptions(args), ...expires !== undefined ? { expires } : {}, ...idemOption(args), signal };
+      let decision;
+      try {
+        decision = decisionAskFields(args);
+      } catch (cause) {
+        throw new ArgError3(cause.message);
+      }
+      const options = { ...sendOptions(args), ...expires !== undefined ? { expires } : {}, ...idemOption(args), ...decision, signal };
       if (optionalBool(args, "all")) {
         if (wait !== undefined)
           throw new ArgError3(`"wait" cannot be combined with "all"`);
@@ -8710,12 +9206,12 @@ ${openedText(asked.decision)}` : outcome;
   {
     name: "reply",
     description: "Reply to a message you received; it goes to the message's real sender.",
-    properties: { id: MSG_ID, text: { ...STRING6, description: "The reply." }, wake: SEND.wake },
+    properties: { id: MSG_ID, text: { ...STRING9, description: "The reply." }, wake: SEND.wake },
     required: ["id", "text"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const id = need7(args, "id");
-      const text = need7(args, "text");
+      const id = need10(args, "id");
+      const text = need10(args, "text");
       const wake = optionalBool(args, "wake");
       return repliedText(await hub.reply(id, text, { ...wake !== undefined ? { wake } : {}, signal }));
     }
@@ -8723,12 +9219,12 @@ ${openedText(asked.decision)}` : outcome;
   {
     name: "decline",
     description: "Decline an ask you received, with a reason.",
-    properties: { id: MSG_ID, why: { ...STRING6, description: "The reason." } },
+    properties: { id: MSG_ID, why: { ...STRING9, description: "The reason." } },
     required: ["id", "why"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const id = need7(args, "id");
-      return declinedText(await hub.decline(id, need7(args, "why"), { signal }));
+      const id = need10(args, "id");
+      return declinedText(await hub.decline(id, need10(args, "why"), { signal }));
     }
   },
   {
@@ -8748,7 +9244,7 @@ ${openedText(asked.decision)}` : outcome;
     required: ["id"],
     readOnly: true,
     run: async (hub, args, signal) => {
-      const id = need7(args, "id");
+      const id = need10(args, "id");
       const wait = optionalWait(args);
       return messageText(await hub.message(id, { ...wait !== undefined ? { wait } : {}, signal }));
     }
@@ -8761,7 +9257,7 @@ ${openedText(asked.decision)}` : outcome;
     readOnly: false,
     organizes: true,
     idempotent: true,
-    run: async (hub, args, signal) => mutedText((await hub[verb](need7(args, "addr"), { signal })).muted)
+    run: async (hub, args, signal) => mutedText((await hub[verb](need10(args, "addr"), { signal })).muted)
   })),
   {
     name: "decisions",
@@ -8769,7 +9265,7 @@ ${openedText(asked.decision)}` : outcome;
     properties: { state: { type: "string", enum: [...DECISION_STATES], description: "Only Decisions in this state." } },
     readOnly: true,
     run: async (hub, args, signal) => {
-      const state = optional7(args, "state");
+      const state = optional8(args, "state");
       if (state !== undefined && !DECISION_STATES.includes(state))
         throw new ArgError3(`"state" is one of ${DECISION_STATES.join(", ")}`);
       const { decisions } = await hub.decisions({ ...state ? { state } : {}, signal });
@@ -8784,7 +9280,7 @@ ${decisionsText(decisions)}` : decisionsText(decisions);
     required: ["id"],
     readOnly: true,
     run: async (hub, args, signal) => `${DECISIONS_NOTE}
-${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
+${decisionText((await hub.decision(need10(args, "id"), { signal })).decision)}`
   },
   {
     name: "approve",
@@ -8793,8 +9289,8 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     required: ["addr", "requestID"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const addr = need7(args, "addr");
-      const requestID = need7(args, "requestID");
+      const addr = need10(args, "addr");
+      const requestID = need10(args, "requestID");
       const always = optionalBool(args, "always");
       return approvedText(await hub.approve(addr, requestID, { ...always ? { always } : {}, ...whyOption(args), signal }));
     }
@@ -8806,8 +9302,8 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     required: ["addr", "requestID"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const addr = need7(args, "addr");
-      const requestID = need7(args, "requestID");
+      const addr = need10(args, "addr");
+      const requestID = need10(args, "requestID");
       return deniedText(await hub.deny(addr, requestID, { ...whyOption(args), signal }));
     }
   },
@@ -8824,8 +9320,8 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     required: ["addr", "formID"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const addr = need7(args, "addr");
-      const formID = need7(args, "formID");
+      const addr = need10(args, "addr");
+      const formID = need10(args, "formID");
       const given = formAnswer(args);
       const options = { ...whyOption(args), signal };
       return answeredText(given === "cancel" ? await hub.cancelForm(addr, formID, options) : await hub.answer(addr, formID, given, options), given === "cancel");
@@ -8836,15 +9332,15 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     description: `Prompt a session (an agent's prompt carries the hub's provenance). ${NEEDS_USER}`,
     properties: {
       addr: ADDR2,
-      text: { ...STRING6, description: "The prompt." },
+      text: { ...STRING9, description: "The prompt." },
       delivery: { type: "string", enum: [...DELIVERIES], description: "How it enters a busy session (the spoke picks when unset)." },
       why: WHY
     },
     required: ["addr", "text"],
     readOnly: false,
     run: async (hub, args, signal) => {
-      const addr = need7(args, "addr");
-      const text = need7(args, "text");
+      const addr = need10(args, "addr");
+      const text = need10(args, "text");
       const delivery = optionalDelivery(args);
       return promptedText(await hub.prompt(addr, text, { ...delivery ? { delivery } : {}, ...whyOption(args), signal }));
     }
@@ -8855,32 +9351,32 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     properties: { addr: ADDR2, why: WHY },
     required: ["addr"],
     readOnly: false,
-    run: async (hub, args, signal) => stoppedText(await hub.stop(need7(args, "addr"), { ...whyOption(args), signal }))
+    run: async (hub, args, signal) => stoppedText(await hub.stop(need10(args, "addr"), { ...whyOption(args), signal }))
   },
   {
     name: "launch",
     description: "Start a new session on a node (a hub node with the repo under its workspace roots). The same key again answers the same launch. With notAfter, a launch still waiting for a machine at that time is never started (it ends expired). Needs an app token with scope sessions:launch and a grant with verb launch covering the repo.",
     properties: {
-      repo: { ...STRING6, description: "Absolute path of the repository on the node (or where a clone goes)." },
+      repo: { ...STRING9, description: "Absolute path of the repository on the node (or where a clone goes)." },
       mode: { type: "string", enum: [...WORKSPACE_MODES], description: "worktree (default: <repo>/.worktrees/<branch>, needs branch), checkout, or clone (needs remote)." },
-      branch: { ...STRING6, description: "The branch to create or check out." },
-      base: { ...STRING6, description: "What a new branch starts from." },
-      remote: { ...STRING6, description: "An https or ssh git remote (for clone)." },
-      key: { ...STRING6, description: "Idempotency key: retrying with the same key and arguments answers the same launch." },
-      name: { ...STRING6, description: "The session's @name." },
-      roles: { type: "array", items: STRING6, description: "Roles the session claims (e.g. reviewer.hub)." },
-      harness: { ...STRING6, description: "The harness (default opencode)." },
-      agent: { ...STRING6, description: "The harness agent (e.g. build)." },
-      model: { ...STRING6, description: "provider/model." },
+      branch: { ...STRING9, description: "The branch to create or check out." },
+      base: { ...STRING9, description: "What a new branch starts from." },
+      remote: { ...STRING9, description: "An https or ssh git remote (for clone)." },
+      key: { ...STRING9, description: "Idempotency key: retrying with the same key and arguments answers the same launch." },
+      name: { ...STRING9, description: "The session's @name." },
+      roles: { type: "array", items: STRING9, description: "Roles the session claims (e.g. reviewer.hub)." },
+      harness: { ...STRING9, description: "The harness (default opencode)." },
+      agent: { ...STRING9, description: "The harness agent (e.g. build)." },
+      model: { ...STRING9, description: "provider/model." },
       runtime: { type: "string", enum: [...RUNTIME_KINDS], description: "host (default) or openshell (a sandbox)." },
-      profile: { ...STRING6, description: "The runtime's sandbox profile (needs runtime)." },
-      machine: { ...STRING6, description: "The machine (name or ID) to run on." },
+      profile: { ...STRING9, description: "The runtime's sandbox profile (needs runtime)." },
+      machine: { ...STRING9, description: "The machine (name or ID) to run on." },
       nodeLabels: { ...LABELS, description: 'Node labels to place on (e.g. {"os": "darwin"}).' },
       prefer: { type: "boolean", description: "machine and nodeLabels are preferences, not requirements." },
       labels: { ...LABELS, description: "Free-form labels for finding the launch and its session later (never interpreted by the hub)." },
-      prompt: { ...STRING6, description: "The session's first prompt." },
+      prompt: { ...STRING9, description: "The session's first prompt." },
       end: { type: "string", enum: [...LAUNCH_END_WHEN], description: "When it ends: idle (default; idle with nothing open for 30 s), asked (with a question open: needs_user), never." },
-      timeout: { ...STRING6, description: "Longest run, e.g. 4h or 90m." },
+      timeout: { ...STRING9, description: "Longest run, e.g. 4h or 90m." },
       cleanup: { type: "string", enum: [...CLEANUP_POLICIES], description: "keep (default) or remove the workspace when it ends." },
       notAfter: { type: ["number", "string"], description: "Do not start after this time: epoch milliseconds or an ISO 8601 date-time (at most 30 days ahead). Still waiting for a machine then, the launch ends expired; once placed it runs (timeout bounds it). Already passed: nothing is launched (expired)." }
     },
@@ -8896,12 +9392,12 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     name: "launches",
     description: "Your launches, oldest first (an app or session sees the ones it started).",
     properties: {
-      state: { ...STRING6, description: "Only these states (comma-separated: queued, placing, provisioning, running, ended)." },
-      label: { type: "array", items: STRING6, description: "key=value launch labels that must all match." }
+      state: { ...STRING9, description: "Only these states (comma-separated: queued, placing, provisioning, running, ended)." },
+      label: { type: "array", items: STRING9, description: "key=value launch labels that must all match." }
     },
     readOnly: true,
     run: async (hub, args, signal) => {
-      const state = optional7(args, "state")?.split(",").filter(Boolean);
+      const state = optional8(args, "state")?.split(",").filter(Boolean);
       const label = optionalStrings(args, "label");
       return launchesText((await hub.launches.list({ ...state?.length ? { state } : {}, ...label ? { label } : {}, signal })).launches ?? []);
     }
@@ -8912,7 +9408,7 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     properties: { id: LAUNCH_ID },
     required: ["id"],
     readOnly: true,
-    run: async (hub, args, signal) => launchText((await hub.launches.get(need7(args, "id"), { signal })).launch)
+    run: async (hub, args, signal) => launchText((await hub.launches.get(need10(args, "id"), { signal })).launch)
   },
   {
     name: "launch_stop",
@@ -8920,7 +9416,7 @@ ${decisionText((await hub.decision(need7(args, "id"), { signal })).decision)}`
     properties: { id: LAUNCH_ID },
     required: ["id"],
     readOnly: false,
-    run: async (hub, args, signal) => stoppedLaunchText((await hub.launches.stop(need7(args, "id"), { signal })).launch)
+    run: async (hub, args, signal) => stoppedLaunchText((await hub.launches.stop(need10(args, "id"), { signal })).launch)
   }
 ];
 var toolList = () => TOOLS.map((t) => ({
@@ -8959,7 +9455,7 @@ var clean = (text, token) => {
 var toolResult = (text, isError) => ({ content: [{ type: "text", text }], isError });
 var ok2 = (id, result) => ({ jsonrpc: "2.0", id, result });
 var rpcError = (id, code, message) => ({ jsonrpc: "2.0", id, error: { code, message } });
-var isObject4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isObject5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isId = (value) => typeof value === "string" || typeof value === "number" && Number.isFinite(value);
 function createMcpServer(options) {
   const initialize = (params) => {
@@ -8974,7 +9470,7 @@ function createMcpServer(options) {
     if (!tool)
       return rpcError(id, RPC.invalidParams, typeof params.name === "string" ? `unknown tool: ${params.name}` : "params.name (the tool) is required");
     const args = params.arguments ?? {};
-    if (!isObject4(args))
+    if (!isObject5(args))
       return rpcError(id, RPC.invalidParams, "params.arguments must be an object");
     let token;
     const controller = new AbortController;
@@ -9005,7 +9501,7 @@ function createMcpServer(options) {
       inFlight.clear();
     },
     async handle(message) {
-      if (!isObject4(message))
+      if (!isObject5(message))
         return rpcError(null, RPC.invalidRequest, Array.isArray(message) ? "batches are not supported" : "not a JSON-RPC message");
       const hasId = "id" in message;
       const id = isId(message.id) ? message.id : null;
@@ -9016,12 +9512,12 @@ function createMcpServer(options) {
       if (typeof message.method !== "string")
         return rpcError(id, RPC.invalidRequest, "method must be a string");
       if (!hasId) {
-        notify(message.method, isObject4(message.params) ? message.params : {});
+        notify(message.method, isObject5(message.params) ? message.params : {});
         return;
       }
       if (!isId(message.id))
         return rpcError(null, RPC.invalidRequest, "id must be a string or a number");
-      const params = isObject4(message.params) ? message.params : {};
+      const params = isObject5(message.params) ? message.params : {};
       switch (message.method) {
         case "initialize":
           return ok2(id, initialize(params));
@@ -9115,90 +9611,6 @@ async function watch(credentials, options, write, signal) {
   throw new CliError(EXIT.other, "the watch stream ended (the hub closed it)", AGAIN);
 }
 
-// packages/cli/src/grants.ts
-var GRANT_FLAGS = {
-  json: "json",
-  holder: "string",
-  project: "multi",
-  allow: "multi",
-  permit: "multi",
-  never: "multi",
-  expires: "string",
-  "max-per-hour": "string",
-  "allow-always": "bool"
-};
-var GRANT_REQUEST_FLAGS = { ...GRANT_FLAGS, "permission-allow": "multi", why: "string" };
-var GRANT_USER_HINT = "only the user manages grants: use the console, or `hub login` with the user's device token";
-function userOnly(source, what) {
-  if (source === "env")
-    throw new CliError(EXIT.forbidden, `only the user can ${what} a grant, not a session`, GRANT_USER_HINT);
-}
-function grantError(error) {
-  if (error instanceof CliError && error.exit === EXIT.forbidden)
-    return new CliError(error.exit, error.message, [error.hint, GRANT_USER_HINT].filter(Boolean).join("; "), error.envelope);
-  return error;
-}
-var listOf = (flags, name) => (flags[name] ?? []).flatMap((v) => v.split(",")).map((v) => v.trim()).filter(Boolean);
-async function grantSpecArg(flags, stdin) {
-  return await grantArg(flags, stdin, true);
-}
-function grantRequestArg(flags, stdin) {
-  return grantArg(flags, stdin, false);
-}
-async function grantArg(flags, stdin, holderRequired) {
-  const json = typeof flags.json === "string" ? flags.json : undefined;
-  const flagged = Object.keys(GRANT_REQUEST_FLAGS).filter((name) => name !== "json" && name !== "why" && flags[name] !== undefined);
-  if (json !== undefined) {
-    if (flagged.length)
-      throw new UsageError(`give either --json '{…}' or ${flagged.map((f) => `--${f}`).join(", ")}`);
-    return await jsonObjectArg(json, stdin, "grant");
-  }
-  const holder = str(flags, "holder");
-  if (holder === undefined && holderRequired)
-    throw new UsageError("needs --holder (ses_…, @name, @@orchestrator…, or app:<token id>)");
-  const projects = listOf(flags, "project");
-  if (!projects.length)
-    throw new UsageError("needs --project <path> (repeatable)");
-  const allow = listOf(flags, "allow");
-  if (!allow.length)
-    throw new UsageError("needs --allow <verbs> (approve, deny, answer, prompt, stop, roles, launch)");
-  const permit = [...listOf(flags, "permit"), ...listOf(flags, "permission-allow")];
-  const never = listOf(flags, "never");
-  const expires = str(flags, "expires");
-  const cap = str(flags, "max-per-hour");
-  if (cap !== undefined && !/^\d+$/.test(cap))
-    throw new UsageError("--max-per-hour is a whole number");
-  return {
-    ...holder !== undefined ? { holder } : {},
-    scope: { projects },
-    allow,
-    ...permit.length || never.length ? { permissions: { ...permit.length ? { allow: permit } : {}, ...never.length ? { never } : {} } } : {},
-    ...expires !== undefined ? { expires } : {},
-    ...cap !== undefined ? { maxActionsPerHour: Number(cap) } : {},
-    ...flags["allow-always"] === true ? { allowAlways: true } : {}
-  };
-}
-var iso3 = (ms) => new Date(ms).toISOString().replace(/\.\d{3}Z$/, "Z");
-var grantLine = (g) => [g.id, g.state, g.holder, g.allow.join(","), g.scope.projects.join(","), `until ${iso3(g.expiresAt)}`].join("  ");
-var grantsText = (grants) => grants.length ? grants.map(grantLine).join(`
-`) : "no grants";
-function grantText2(g) {
-  const list = (values) => values.length ? values.join(", ") : "none";
-  return [
-    `${g.id}  ${g.state}`,
-    `holder: ${g.holder}${g.holderSessionID && g.holderSessionID !== g.holder ? ` (${g.holderSessionID})` : ""}`,
-    `projects: ${list(g.scope.projects)}`,
-    `verbs: ${list(g.allow)}`,
-    `permissions allow: ${list(g.permissions.allow)}`,
-    `permissions never: ${list(g.permissions.never)}`,
-    `always: ${g.allowAlways ? "yes" : "no"}`,
-    `max actions per hour: ${g.maxActionsPerHour}`,
-    g.revokedAt !== undefined ? `revoked: ${iso3(g.revokedAt)}` : `expires: ${iso3(g.expiresAt)}`
-  ].join(`
-`);
-}
-var requestedText = (body) => `requested; waiting for the user (Decision ${body.decision.id})`;
-
 // packages/cli/src/node.ts
 import { appendFileSync, existsSync as existsSync5, mkdirSync as mkdirSync7, readFileSync as readFileSync8, realpathSync as realpathSync3, renameSync as renameSync5, rmSync as rmSync8, statSync as statSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import path16 from "node:path";
@@ -9424,7 +9836,7 @@ import { arch as osArch, platform as osPlatform } from "node:os";
 // packages/node/package.json
 var package_default2 = {
   name: "@huynle/hub-node",
-  version: "0.10.1",
+  version: "0.11.1",
   private: true,
   description: "`hub node`: the per-machine daemon that prepares, collects and cleans up launch workspaces (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -10879,7 +11291,7 @@ import path14 from "node:path";
 // packages/runtime-openshell/package.json
 var package_default3 = {
   name: "@huynle/hub-runtime-openshell",
-  version: "0.10.1",
+  version: "0.11.1",
   private: true,
   description: "The `openshell` runtime of `hub node`: launches in NVIDIA OpenShell sandboxes, driven through the openshell CLI (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -12534,46 +12946,6 @@ function openShellCheckText(report) {
 `);
 }
 
-// packages/cli/src/subscriptions.ts
-var SUBSCRIBE_FLAGS = { type: "multi", delivery: "string", batch: "string", expires: "string", "max-per-hour": "string", subscriber: "string", note: "string" };
-var DELIVERIES2 = ["queue", "steer", "silent"];
-var safe2 = (v, max = 120) => sanitizeLabel(String(v), max);
-function subscribeInput(addrs, flags) {
-  if (!addrs.length)
-    throw new UsageError("needs at least one address (a session, @@role, #team or children)");
-  const delivery = str(flags, "delivery");
-  if (delivery !== undefined && !DELIVERIES2.includes(delivery))
-    throw new UsageError(`--delivery is one of ${DELIVERIES2.join(", ")}`);
-  const batch = str(flags, "batch");
-  const expires = str(flags, "expires");
-  const max = str(flags, "max-per-hour");
-  if (max !== undefined && !/^\d+$/.test(max))
-    throw new UsageError("--max-per-hour takes a whole number (1–120)");
-  const types = flags.type;
-  const subscriber = str(flags, "subscriber");
-  const note = str(flags, "note");
-  return {
-    to: addrs.length === 1 ? addrs[0] : [...addrs],
-    ...types?.length ? { types: types.flatMap((t) => t.split(",")).map((t) => t.trim()).filter(Boolean) } : {},
-    ...delivery !== undefined ? { delivery } : {},
-    ...batch !== undefined ? { batch: durationArg(batch, "--batch") } : {},
-    ...expires !== undefined ? { expires: durationArg(expires, "--expires") } : {},
-    ...max !== undefined ? { maxPerHour: Number(max) } : {},
-    ...subscriber !== undefined ? { subscriber } : {},
-    ...note !== undefined ? { note } : {}
-  };
-}
-var targets = (s) => s.targets.map((t) => t.kind === "children" ? "its subagents" : safe2(t.addr, 80)).join(", ");
-var iso4 = (ms) => new Date(ms).toISOString().slice(0, 16) + "Z";
-function subscriptionLine(s) {
-  const extra = [safe2(s.delivery, 10), `batch ${Math.round(s.batchMs / 1000)}s`, `≤${s.maxPerHour}/h`, `expires ${iso4(s.expiresAt)}`, `${s.stats.delivered} delivered`, ...s.pending ? [`${s.pending} pending`] : [], ...s.stats.dropped ? [`${s.stats.dropped} dropped`] : [], ...s.stats.suppressed ? [`${s.stats.suppressed} loop-suppressed`] : []];
-  return `${safe2(s.id, 40)}  ${safe2(s.subscriber, 80)} ← ${targets(s)}  [${s.types.map((t) => safe2(t, 40)).join(",")}]  ${extra.join(" · ")}${s.note ? `  "${safe2(s.note, 200)}"` : ""}`;
-}
-var subscribedText = (b) => `subscribed ${subscriptionLine(b.subscription)}
-the subscriber gets one hub message per batch window; stop with \`hub unsubscribe ${safe2(b.subscription.id, 40)}\``;
-var subscriptionsText = (b) => b.subscriptions.length ? b.subscriptions.map(subscriptionLine).join(`
-`) : "no subscriptions";
-
 // packages/claude-code/src/main.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { realpathSync as realpathSync5 } from "node:fs";
@@ -12659,7 +13031,7 @@ function ask(socketPath, req, options = {}) {
 var ENV_NAME3 = /^[A-Z_][A-Z0-9_]*$/;
 var DROPPED = ["tool_response"];
 var quote = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
-var isObject5 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isObject6 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function flags(argv) {
   const rewake = argv.includes("--rewake");
   const at = argv.indexOf("--wait");
@@ -12697,16 +13069,16 @@ async function runHook(io) {
     const launch = io.env.HUB_CLAUDE_LAUNCH;
     const req = { v: WIRE_VERSION, kind: "hook", input: sent, ...launch ? { launch } : {}, ...rewake ? { rewake: true } : {}, ...waitMs !== undefined ? { waitMs } : {} };
     const reply = await ask(io.socketPath, req, io.timeoutMs !== undefined ? { timeoutMs: io.timeoutMs } : {});
-    if (!isObject5(reply))
+    if (!isObject6(reply))
       return 0;
-    if (isObject5(reply.env))
+    if (isObject6(reply.env))
       writeEnvFile(io.env.CLAUDE_ENV_FILE, reply.env);
     if (rewake && reply.exit === 2) {
       if (typeof reply.stderr === "string")
         io.stderr(reply.stderr);
       return 2;
     }
-    if (isObject5(reply.output))
+    if (isObject6(reply.output))
       io.stdout(`${JSON.stringify(reply.output)}
 `);
     return 0;
@@ -13600,7 +13972,7 @@ function ensurePrivateDir(dir) {
 import { Socket as Socket2 } from "node:net";
 var MCP_END = { hub: "end" };
 var ACT_TOOLS = new Set(["approve", "deny", "answer", "prompt", "stop"]);
-var isObject6 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isObject7 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function createMcpRouter(options) {
   const credentials = (pick, what) => () => {
     const sessionID = options.sessionID();
@@ -13613,9 +13985,9 @@ function createMcpRouter(options) {
   const act = createMcpServer({ version: options.version, credentials: credentials(options.actToken, "hub session act token") });
   return {
     async handle(message) {
-      if (isObject6(message) && message.method === "tools/call" && isObject6(message.params) && ACT_TOOLS.has(message.params.name))
+      if (isObject7(message) && message.method === "tools/call" && isObject7(message.params) && ACT_TOOLS.has(message.params.name))
         return act.handle(message);
-      if (isObject6(message) && !("id" in message))
+      if (isObject7(message) && !("id" in message))
         act.handle(message);
       return shell.handle(message);
     },
@@ -14459,9 +14831,10 @@ class ClaudeSessions {
     this.#settle(s, undefined, true);
     s.stopRequested = false;
     const detail = [input.error_details, input.error].find((v) => typeof v === "string" && v.length > 0) ?? "the turn failed";
+    const token = typeof input.error === "string" && /^[a-z][a-z0-9_]{0,40}$/.test(input.error) ? input.error : undefined;
     const turnID = s.turnID;
     s.busy = false;
-    this.#emit({ type: "session.execution.failed", data: { sessionID: s.hubID, ...turnID ? { turnID } : {}, error: { message: cut4(detail, HARNESS_ERROR_MAX) } } });
+    this.#emit({ type: "session.execution.failed", data: { sessionID: s.hubID, ...turnID ? { turnID } : {}, error: { message: cut4(detail, HARNESS_ERROR_MAX), ...token ? { type: `claude.${token}` } : {} } } });
     return {};
   }
   #child(s, input, start = true) {
@@ -14877,7 +15250,7 @@ import path23 from "node:path";
 // packages/claude-code/package.json
 var package_default4 = {
   name: "@huynle/hub-claude-code",
-  version: "0.10.1",
+  version: "0.11.1",
   private: true,
   description: "The Claude Code hooks spoke: per-user daemon, hook bridge, plugin dir, `hub claude` wrapper and daemon-backed MCP server (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -15166,7 +15539,7 @@ import path26 from "node:path";
 // packages/preset/package.json
 var package_default5 = {
   name: "@huynle/hub-preset",
-  version: "0.10.1",
+  version: "0.11.1",
   private: true,
   description: "The preset spoke: drives a harness without a spoke of its own through a terminal pane (tmux), described by a data-only preset; official presets in presets/ (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -15691,7 +16064,7 @@ import { openSync as openSync6, closeSync as closeSync6, readFileSync as readFil
 // packages/codex/package.json
 var package_default6 = {
   name: "@huynle/hub-codex",
-  version: "0.10.1",
+  version: "0.11.1",
   private: true,
   description: "The Codex app-server spoke: attaches to Codex's app-server (its own over stdio, and the shared daemon's socket when present), and the `hub codex` wrapper (internal; shipped inside @huynle/hub, not published on its own).",
   license: "MIT",
@@ -16041,6 +16414,12 @@ var DEFAULT_TITLE = "Codex session";
 var TOOL_ITEMS = new Set(["commandExecution", "fileChange", "mcpToolCall", "dynamicToolCall", "webSearch"]);
 var APPROVALS = { "item/commandExecution/requestApproval": "shell", "item/fileChange/requestApproval": "edit" };
 var RECENT_TURNS = 50;
+function codexErrorType(info) {
+  const name = typeof info === "string" ? info : isObj3(info) && Object.keys(info).length === 1 ? Object.keys(info)[0] : undefined;
+  if (!name || !/^[a-z][A-Za-z0-9]{0,40}$/.test(name))
+    return;
+  return `codex.${name.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`)}`;
+}
 var isObj3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var str6 = (v) => typeof v === "string" && v !== "" ? v : undefined;
 var cut5 = (text, max) => text.length > max ? `${text.slice(0, max - 1)}…` : text;
@@ -16428,7 +16807,8 @@ class CodexSessions {
       return;
     const status = typeof turn.status === "string" ? turn.status : "completed";
     const error = isObj3(turn.error) && typeof turn.error.message === "string" ? cut5(turn.error.message, HARNESS_ERROR_MAX) : undefined;
-    const end = { status, ...error !== undefined ? { error } : {} };
+    const errorType = isObj3(turn.error) ? codexErrorType(turn.error.codexErrorInfo) : undefined;
+    const end = { status, ...error !== undefined ? { error } : {}, ...errorType !== undefined ? { errorType } : {} };
     if (thread.turnID === turnID)
       thread.turnID = undefined;
     thread.ended.set(turnID, end);
@@ -16441,7 +16821,7 @@ class CodexSessions {
     if (status === "interrupted")
       this.#emit({ type: "session.execution.interrupted", data });
     else if (status === "failed")
-      this.#emit({ type: "session.execution.failed", data: { ...data, ...error !== undefined ? { error: { message: error } } : {} } });
+      this.#emit({ type: "session.execution.failed", data: { ...data, ...error !== undefined ? { error: { message: error, ...end.errorType ? { type: end.errorType } : {} } } : {} } });
     else
       this.#emit({ type: "session.execution.succeeded", data });
     thread.items.clear();
@@ -18444,7 +18824,7 @@ function mergeConfigText(text, format, sets) {
       return txFail("manual_edit_required", `the config cannot be edited losslessly (${error instanceof Error ? error.message : "unreadable"}); make the edit by hand`);
     }
     const tree = toValue(current, cst);
-    if (!isObject7(tree))
+    if (!isObject8(tree))
       return txFail("conflict", "the config is not a JSON object");
     const changed = applySet(tree, set);
     if (!changed.ok)
@@ -18459,7 +18839,7 @@ function mergeConfigText(text, format, sets) {
   }
   return txOk(current);
 }
-var isObject7 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isObject8 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var same = (a, b) => canonicalJSON(a) === canonicalJSON(b);
 var clone = (v) => JSON.parse(JSON.stringify(v));
 function segments(pointer) {
@@ -18483,7 +18863,7 @@ function applySet(root, set) {
       if (index === undefined)
         return txFail("conflict", `${set.pointer}: no array element ${seg}`);
       next = current[index];
-    } else if (isObject7(current)) {
+    } else if (isObject8(current)) {
       next = Object.hasOwn(current, seg) ? current[seg] : undefined;
       if (next === undefined) {
         next = segs[i + 1] === "-" ? [] : {};
@@ -18511,7 +18891,7 @@ function applySet(root, set) {
     current[index] = value;
     return txOk(true);
   }
-  if (!isObject7(current))
+  if (!isObject8(current))
     return txFail("conflict", `${set.pointer}: the parent is not an object or array`);
   if (Object.hasOwn(current, last) && same(current[last], value))
     return txOk(false);
@@ -18680,7 +19060,7 @@ var LEGACY_PLUGIN_PACKAGE = "@huynle/opencode-voice";
 var HUB_MCP_NAME = "hub";
 var MCP_SUBCOMMAND = "mcp";
 var HUB_PROGRAMS = new Set(["hub", "hubctl"]);
-var isObject8 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isObject9 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var basename = (p) => p.slice(p.lastIndexOf("/") + 1);
 var WINDOWS_PATH = /^[A-Za-z]:[\\/]/;
 var programName = (p) => {
@@ -18715,12 +19095,12 @@ function classifyPluginSpec(spec) {
     return { source: "custom" };
   return;
 }
-var specOf = (entry) => typeof entry === "string" ? entry : isObject8(entry) && typeof entry.package === "string" ? entry.package : undefined;
+var specOf = (entry) => typeof entry === "string" ? entry : isObject9(entry) && typeof entry.package === "string" ? entry.package : undefined;
 var parse3 = (text) => {
   const parsed = parseJsonc(text);
   if (!parsed.ok)
     return txFail("manual_edit_required", `the OpenCode config cannot be edited losslessly (${parsed.message}); make the edit by hand`);
-  if (!isObject8(parsed.value))
+  if (!isObject9(parsed.value))
     return txFail("conflict", "the OpenCode config is not a JSON object");
   return txOk(parsed.value);
 };
@@ -18736,7 +19116,7 @@ function inspectPlugin(config, desired, findings) {
       const spec = specOf(entry);
       const kind = spec === undefined ? undefined : classifyPluginSpec(spec);
       if (kind)
-        found.push({ pointer: `/${key}/${i}`, spec, object: isObject8(entry), ...kind });
+        found.push({ pointer: `/${key}/${i}`, spec, object: isObject9(entry), ...kind });
     });
   }
   if (found.length === 0)
@@ -18767,17 +19147,17 @@ function inspectPlugin(config, desired, findings) {
   findings.push({ code: "plugin-drift", message: `the Hub plugin is pinned to ${entry.version}; it becomes ${pluginSpec(desired)}` });
   return txOk({ state: "drift", ...base, object: entry.object });
 }
-var isHubMcp = (server) => isObject8(server) && server.type === "local" && Array.isArray(server.command) && server.command.length === 2 && server.command.every((w) => typeof w === "string") && HUB_PROGRAMS.has(programName(server.command[0])) && server.command[1] === MCP_SUBCOMMAND;
+var isHubMcp = (server) => isObject9(server) && server.type === "local" && Array.isArray(server.command) && server.command.length === 2 && server.command.every((w) => typeof w === "string") && HUB_PROGRAMS.has(programName(server.command[0])) && server.command[1] === MCP_SUBCOMMAND;
 function inspectMcp(config, desired, findings) {
   const mcp = config.mcp;
   if (mcp === undefined)
     return txOk({ state: "absent" });
-  if (!isObject8(mcp))
+  if (!isObject9(mcp))
     return txFail("conflict", '"mcp" in the OpenCode config is not an object; fix it by hand');
   const servers = mcp.servers;
   if (servers === undefined)
     return txOk({ state: "absent" });
-  if (!isObject8(servers))
+  if (!isObject9(servers))
     return txFail("conflict", '"mcp.servers" in the OpenCode config is not an object; fix it by hand');
   const elsewhere = Object.entries(servers).find(([name, server]) => name !== HUB_MCP_NAME && isHubMcp(server));
   if (elsewhere)
@@ -26246,19 +26626,22 @@ Identity
   hub role release <role[.project]> [--session <addr>]
 
 Messaging (text "-" reads it from stdin)
-  hub msg <addr> "text" [--all] [--no-wake] [--urgent] [--not-after <ms|ISO time>] [--key K]
+  hub msg <addr> "text" [--all] [--no-wake] [--urgent] [--item itk_…] [--not-after <ms|ISO time>] [--key K]
                                       tell: fire and forget; --not-after: never delivered after that time
-  hub ask <addr> "text" [--wait [secs]] [--expires 2h] [--not-after <ms|ISO time>] [--all] [--no-wake] [--urgent] [--key K]
+  hub ask <addr> "text" [--wait [secs]] [--expires 2h] [--item itk_…] [--not-after <ms|ISO time>] [--all] [--no-wake] [--urgent] [--key K]
                                       tracked until answered, declined or expired; --wait alone waits until
                                       it expires; exit 0 answered, 1 declined or no answer yet, 8 expired;
                                       --key (Idempotency-Key): a retry with the same key and text answers
-                                      the first send again and sends nothing (24 h, per credential)
+                                      the first send again and sends nothing (24 h, per credential);
+                                      --item: open team intake item, both members seated (older hubs ignore it)
   hub reply <msgID> "text" [--no-wake]   goes to the real sender
   hub decline <msgID> --why "reason"
   hub ask @me "question" [--option id=label[:safe]]... [--recommend id [--why "…"]] [--urgency low|normal|high]
          [--deadline 2h [--on-timeout <safe id>]] [--tier confirm|tap] [--about <addr>]...
+         [--choice "D1=Label:a=Option*,b=Option"]... [--kind question|plan|merge|release]
                                       opens a Decision for the user (answered in the console; the answer
-                                      comes back as a reply); --on-timeout picks a safe option at the deadline
+                                      comes back as a reply); --on-timeout picks a safe option at the deadline;
+                                      --choice (instead of --option) asks several points, * marks the recommendation
   hub decisions list [--state open|answered|expired|closed]   the Decisions you asked
   hub inbox                           asks to answer, your open asks, recent messages, mutes
   hub mute <addr> · hub unmute <addr>    refuse (or accept again) messages from a session
@@ -26431,11 +26814,13 @@ var whyOf = (flags) => {
 var sendFlags = (flags) => {
   const notAfter = str(flags, "not-after");
   const key = str(flags, "key");
+  const item = str(flags, "item");
   return {
     ...flags["no-wake"] === true ? { wake: false } : {},
     ...flags.urgent === true ? { urgent: true } : {},
     ...notAfter === undefined ? {} : { notAfter: notAfterArg(notAfter, "--not-after") },
-    ...key !== undefined ? { idempotencyKey: key } : {}
+    ...key !== undefined ? { idempotencyKey: key } : {},
+    ...item !== undefined ? { item } : {}
   };
 };
 var nodeIo = (io) => ({
@@ -26559,7 +26944,7 @@ var COMMANDS = {
   },
   msg: {
     args: ["<addr>", "<text>"],
-    flags: { all: "bool", "no-wake": "bool", urgent: "bool", "not-after": "string", key: "string" },
+    flags: { all: "bool", "no-wake": "bool", urgent: "bool", "not-after": "string", item: "string", key: "string" },
     async handle(context) {
       const { flags, args } = context.parsed;
       const text = await textArg(args[1], context.io.stdin);
@@ -26571,7 +26956,7 @@ var COMMANDS = {
   },
   ask: {
     args: ["<addr>", "<text>"],
-    flags: { all: "bool", "no-wake": "bool", urgent: "bool", "not-after": "string", key: "string", expires: "string", wait: "optional", ...DECISION_FLAGS },
+    flags: { all: "bool", "no-wake": "bool", urgent: "bool", "not-after": "string", item: "string", key: "string", expires: "string", wait: "optional", ...DECISION_FLAGS },
     async handle(context) {
       const { flags, args } = context.parsed;
       const decision = decisionOptions(flags, args[0]);
@@ -26715,7 +27100,7 @@ ${openedText(body.decision)}` : outcome.text);
   "grant create": {
     flags: GRANT_FLAGS,
     async handle(context) {
-      userOnly(context.credentials().source, "create");
+      userOnly2(context.credentials().source, "create");
       const spec = await grantSpecArg(context.parsed.flags, context.io.stdin);
       const body = await grantHub(context, (hub) => hub.createGrant(spec));
       answer(context, body, (b) => `created ${grantText2(b.grant)}`);
@@ -26735,7 +27120,7 @@ ${openedText(body.decision)}` : outcome.text);
   "grant revoke": {
     args: ["<grantID>"],
     async handle(context) {
-      userOnly(context.credentials().source, "revoke");
+      userOnly2(context.credentials().source, "revoke");
       const body = await grantHub(context, (hub) => hub.revokeGrant(context.parsed.args[0]));
       answer(context, body, (b) => `revoked ${b.grant.id} (${b.grant.holder})`);
     }