@iowarp/clio-coder 0.3.4 → 0.3.7

package/src/cli/run.ts

@@ -28,7 +28,7 @@ import { SafetyDomainModule } from "../domains/safety/index.js";
 import { SchedulingDomainModule } from "../domains/scheduling/index.js";
 import { SessionDomainModule } from "../domains/session/index.js";
 import type { ImageContent } from "../engine/types.js";
-import { assistantTextFromEvent } from "../tools/dispatch-event-text.js";
+import { assistantTextFromEvent, receiptResponseModelIdObservationLabel } from "../tools/dispatch-event-text.js";
 import { isToolProfileName } from "../tools/profiles.js";
 import { parseRunCliArgs, type RunCliArgs } from "./args.js";
 import { runClioCommand } from "./clio.js";
@@ -393,8 +393,27 @@ async function runDispatch(
 	let memorySection = "";
 	try {
 		const records = loadMemoryRecordsSync(clioDataDir());
+		const boundProfileName = parsed.agentProfile ?? effectiveSettings.workers.agentBindings[parsed.agentId];
+		const boundProfile = boundProfileName ? effectiveSettings.workers.profiles[boundProfileName] : undefined;
+		const configuredRuntime = (targetId: string | null | undefined): string | undefined =>
+			effectiveSettings.targets.find((target) => target.id === targetId)?.runtime;
+		const profileRuntimeId = configuredRuntime(boundProfile?.target);
+		// The memory section is compiled before fleet routing settles. Admit a
+		// runtime-scoped record only when every permitted initial and fallback
+		// route is constrained to the same runtime.
+		const memoryRuntimeId =
+			parsed.target !== undefined
+				? configuredRuntime(parsed.target)
+				: boundProfileName !== undefined
+					? parsed.agentRuntime === profileRuntimeId
+						? profileRuntimeId
+						: undefined
+					: parsed.agentRuntime;
 		memorySection = buildMemoryPromptSection(records, {
+			scopes: ["global", "repo", "runtime", "agent"],
 			activeRepository: canonicalMemoryRepositoryIdentity(process.cwd()),
+			activeRuntime: memoryRuntimeId === undefined ? null : { kind: "runtime", key: memoryRuntimeId },
+			activeAgent: { kind: "agent", key: parsed.agentId },
 		}).section;
 	} catch (err) {
 		process.stderr.write(
@@ -488,7 +507,8 @@ function formatReceipt(r: RunReceipt): string {
 	const reasoning =
 		typeof r.reasoningTokenCount === "number" && r.reasoningTokenCount > 0 ? ` reasoning=${r.reasoningTokenCount}` : "";
 	const failure = r.failureMessage ? ` error=${r.failureMessage}` : "";
-	return `receipt: ${r.runId} agent=${r.agentId} exit=${r.exitCode} target=${r.targetId} model=${r.wireModelId} tokens=${r.tokenCount}${reasoning}${failure} start=${r.startedAt} end=${r.endedAt}`;
+	const responseModelIdObservation = receiptResponseModelIdObservationLabel(r);
+	return `receipt: ${r.runId} agent=${r.agentId} exit=${r.exitCode} target=${r.targetId} requested_model_id=${r.wireModelId}${responseModelIdObservation ? ` ${responseModelIdObservation}` : ""} tokens=${r.tokenCount}${reasoning}${failure} start=${r.startedAt} end=${r.endedAt}`;
 }
 
 function mapExitCode(r: RunReceipt): number {

package/src/cli/share.ts

@@ -15,7 +15,7 @@ const HELP = `clio-coder share <command>
 Export and import portable Clio project/resource archives.
 
 Commands:
-  clio-coder share export --out <path> [--project|--user|--both] [--context] [--prompts] [--skills] [--settings] [--extensions]
+  clio-coder share export --out <path> [--project|--user|--both] [--context] [--prompts] [--skills] [--agents] [--fleets] [--settings] [--extensions]
   clio-coder share import <path> [--dry-run] [--force] [--project|--user] [--json]
   clio-coder share inspect <path> [--json]
 
@@ -36,6 +36,8 @@ interface Parsed {
 	includeContext?: boolean;
 	includePrompts?: boolean;
 	includeSkills?: boolean;
+	includeAgents?: boolean;
+	includeFleets?: boolean;
 	includeSettings?: boolean;
 	includeExtensions?: boolean;
 }
@@ -93,6 +95,12 @@ function parse(argv: ReadonlyArray<string>): Parsed | null {
 			case "--skills":
 				out.includeSkills = true;
 				break;
+			case "--agents":
+				out.includeAgents = true;
+				break;
+			case "--fleets":
+				out.includeFleets = true;
+				break;
 			case "--settings":
 				out.includeSettings = true;
 				break;
@@ -103,6 +111,8 @@ function parse(argv: ReadonlyArray<string>): Parsed | null {
 				out.includeContext = true;
 				out.includePrompts = true;
 				out.includeSkills = true;
+				out.includeAgents = true;
+				out.includeFleets = true;
 				out.includeSettings = true;
 				out.includeExtensions = true;
 				break;
@@ -152,6 +162,8 @@ function exportOptions(parsed: Parsed): ShareExportOptions {
 		...(parsed.includeContext !== undefined ? { includeContext: parsed.includeContext } : {}),
 		...(parsed.includePrompts !== undefined ? { includePrompts: parsed.includePrompts } : {}),
 		...(parsed.includeSkills !== undefined ? { includeSkills: parsed.includeSkills } : {}),
+		...(parsed.includeAgents !== undefined ? { includeAgents: parsed.includeAgents } : {}),
+		...(parsed.includeFleets !== undefined ? { includeFleets: parsed.includeFleets } : {}),
 		...(parsed.includeSettings !== undefined ? { includeSettings: parsed.includeSettings } : {}),
 		...(parsed.includeExtensions !== undefined ? { includeExtensions: parsed.includeExtensions } : {}),
 	};

package/src/cli/targets.ts

@@ -1028,10 +1028,19 @@ export function residentModelsSummary(states: TargetStatus["discoveredModelState
  * capability the target reported. Saying so is the difference between a number
  * a user can plan against and one they cannot.
  */
-export function formatContextWindow(status: Pick<TargetStatus, "capabilities" | "contextWindowProvenance">): string {
+export function formatContextWindow(
+	status: Pick<TargetStatus, "capabilities" | "contextWindowProvenance"> &
+		Partial<Pick<TargetStatus, "target" | "discoveredModelStates">>,
+): string {
 	const window = status.capabilities.contextWindow;
-	return status.contextWindowProvenance === "runtime-default"
-		? `ctx ${window} (unverified runtime default)`
+	if (status.contextWindowProvenance === "runtime-default") return `ctx ${window} (unverified runtime default)`;
+	// A llama.cpp window that is one slot's share of `--ctx-size` names the
+	// split, so `ctx 196608` is not mistaken for the whole server (issue #187).
+	const slots = status.target?.defaultModel
+		? status.discoveredModelStates?.[status.target.defaultModel]?.contextSlots
+		: undefined;
+	return slots && Math.floor(slots.totalContextSize / slots.slots) === window
+		? `ctx ${window} (${slots.totalContextSize} / ${slots.slots} slots)`
 		: `ctx ${window}`;
 }
 

package/src/cli/usage.ts

@@ -1,8 +1,15 @@
 import { readdir, readFile, stat } from "node:fs/promises";
 import { join, resolve } from "node:path";
+import {
+	addResponseModelIdObservationCount,
+	emptyResponseModelIdObservationCounts,
+	type ResponseModelIdObservationCounts,
+	responseModelIdObservationCountsLabel,
+} from "../core/response-model-id.js";
 import { clioDataDir, clioStateDir } from "../core/xdg.js";
 import { loadMemoryRecordsSync, type MemoryRecord } from "../domains/memory/index.js";
 import { readEvidenceIndex } from "../domains/observability/evidence-index.js";
+import { type OutOfTurnUsageRow, readOutOfTurnUsageRows } from "../domains/observability/out-of-turn-usage.js";
 import { loadSkills } from "../domains/resources/index.js";
 import {
 	type LedgerUsageCall,
@@ -17,9 +24,10 @@ import { formatColumns, printError } from "./shared.js";
 const HELP = `clio-coder usage report [--repo <path>] [--days <n>] [--json]
 
 Cross-session usage analyzer (experimental, read-only). Reads the local usage
-archive (receipts, session ledgers, audit rows, evidence index, memory store)
-and reports facts plus improvement opportunities, every line citing ids and
-counts. Nothing is written or stored; suggestions are printed only.
+archive (receipts, session ledgers, the out-of-turn usage store, audit rows,
+evidence index, memory store) and reports facts plus improvement opportunities,
+every line citing ids and counts. Nothing is written or stored; suggestions are
+printed only.
 
 Flags:
   --repo <path>   restrict sessions (and runs via the run ledger) to one repo
@@ -88,6 +96,58 @@ function emptyUsageTotals(): UsageTotals {
 	};
 }
 
+function addResponseModelIdObservation(counts: ResponseModelIdObservationCounts, call: LedgerUsageCall): void {
+	addResponseModelIdObservationCount(counts, call.responseModelIdObservation, call.apiCalls ?? 1);
+}
+
+/**
+ * How the folded calls split between the session's own turns and the rounds
+ * that were billed beside it. A `/btw` side question and a `/handoff` round are
+ * real spend and belong in the token and cost totals, but neither is a turn:
+ * they never entered the session. `turns` therefore subtracts them from the
+ * folded row count, which is exactly what the `/cost` overlay does.
+ */
+interface CallOrigins {
+	rows: number;
+	sideQuestions: number;
+	handoffs: number;
+}
+
+function emptyCallOrigins(): CallOrigins {
+	return { rows: 0, sideQuestions: 0, handoffs: 0 };
+}
+
+function turnsOf(origins: CallOrigins): number {
+	return origins.rows - origins.sideQuestions - origins.handoffs;
+}
+
+function hasLabelledCall(origins: CallOrigins): boolean {
+	return origins.sideQuestions > 0 || origins.handoffs > 0;
+}
+
+function addOutOfTurnRow(origins: CallOrigins, row: OutOfTurnUsageRow): void {
+	origins.rows += 1;
+	if (row.label === "side-question") origins.sideQuestions += 1;
+	else origins.handoffs += 1;
+}
+
+/** The out-of-turn store keeps its own usage shape; fold it as one completed call. */
+function outOfTurnUsageCall(row: OutOfTurnUsageRow): LedgerUsageCall {
+	return {
+		providerId: row.target,
+		attributedModelId: row.attributedModelId,
+		requestedModelId: row.attributedModelId,
+		responseModelIdObservation: { state: "not-observed" },
+		input: row.usage.input,
+		output: row.usage.output,
+		cacheRead: row.usage.cacheRead,
+		cacheWrite: row.usage.cacheWrite,
+		reasoningTokens: row.usage.reasoning,
+		totalTokens: row.usage.totalTokens,
+		costUsd: row.usage.costUsd,
+	};
+}
+
 function addUsageCall(totals: UsageTotals, call: LedgerUsageCall): void {
 	totals.apiCalls += call.apiCalls ?? 1;
 	totals.input += call.input;
@@ -240,6 +300,13 @@ export async function runUsageCommand(argv: ReadonlyArray<string>): Promise<numb
 		(receipt) => repoRunIds === null || repoRunIds.has(receipt.runId),
 	);
 	const sessions = await readSessions(stateDir, windowStart, now, repoHash, diagnostics);
+	// Side questions and handoff rounds append nothing to the session ledger by
+	// design, so their spend lives in its own store and is folded in here.
+	const outOfTurn = readOutOfTurnUsageRows(stateDir);
+	for (const error of outOfTurn.errors) diagnostics.notes.push(error);
+	const outOfTurnRows = outOfTurn.rows.filter(
+		(row) => inWindow(row.timestamp, windowStart, now) && (repoHash === undefined || row.repoIdentity === repoHash),
+	);
 	const auditRows = await readAuditRows(stateDir);
 	diagnostics.malformedAuditRows = auditRows.errors.length;
 	const auditInWindow = auditRows.rows.filter((row) => row.ts !== null && inWindow(row.ts, windowStart, now));
@@ -321,21 +388,50 @@ export async function runUsageCommand(argv: ReadonlyArray<string>): Promise<numb
 	// Token and cost facts fold the same per-call usage the `/cost` overlay
 	// reseeds from, through the same session-domain function, so the report and
 	// the overlay cannot disagree about what a session spent.
-	const usageByModel = new Map<string, { providerId: string; modelId: string; totals: UsageTotals }>();
+	// Keyed by the model id accounting attributes the call to. A reported LM
+	// Link peer id gets its own row, while an observed omission becomes unknown.
+	// Requested ids and observation-state counts remain alongside that row.
+	const usageByModel = new Map<
+		string,
+		{
+			providerId: string;
+			attributedModelId: string;
+			requestedModelIds: Set<string>;
+			responseModelIdObservationCounts: ResponseModelIdObservationCounts;
+			totals: UsageTotals;
+		}
+	>();
 	const usageTotals = emptyUsageTotals();
+	const callOrigins = emptyCallOrigins();
+	const foldCall = (call: LedgerUsageCall): void => {
+		addUsageCall(usageTotals, call);
+		const key = `${call.providerId}::${call.attributedModelId}`;
+		const entry = usageByModel.get(key) ?? {
+			providerId: call.providerId,
+			attributedModelId: call.attributedModelId,
+			requestedModelIds: new Set<string>(),
+			responseModelIdObservationCounts: emptyResponseModelIdObservationCounts(),
+			totals: emptyUsageTotals(),
+		};
+		entry.requestedModelIds.add(call.requestedModelId);
+		addResponseModelIdObservation(entry.responseModelIdObservationCounts, call);
+		addUsageCall(entry.totals, call);
+		usageByModel.set(key, entry);
+	};
 	for (const session of sessions) {
 		for (const call of session.usageCalls) {
-			addUsageCall(usageTotals, call);
-			const key = `${call.providerId}::${call.modelId}`;
-			const entry = usageByModel.get(key) ?? {
-				providerId: call.providerId,
-				modelId: call.modelId,
-				totals: emptyUsageTotals(),
-			};
-			addUsageCall(entry.totals, call);
-			usageByModel.set(key, entry);
+			foldCall(call);
+			callOrigins.rows += 1;
 		}
 	}
+	for (const row of outOfTurnRows) {
+		foldCall(outOfTurnUsageCall(row));
+		addOutOfTurnRow(callOrigins, row);
+	}
+	// Token and cost facts need one of their two inputs on disk. A machine whose
+	// session store is gone can still have recorded out-of-turn spend, and
+	// dropping those rows would report money that was spent as nothing at all.
+	const usageMeasurable = presence.sessionsPresent || outOfTurnRows.length > 0;
 	const usageRows = [...usageByModel.values()].sort(
 		(a, b) => b.totals.totalTokens - a.totals.totalTokens || a.providerId.localeCompare(b.providerId),
 	);
@@ -417,10 +513,32 @@ export async function runUsageCommand(argv: ReadonlyArray<string>): Promise<numb
 		if (presence.receiptsPresent) emit({ kind: "fact", fact: "dispatch-runs", value: receipts.length });
 		else emit({ kind: "fact", fact: "receipt-store-missing", path: presence.receiptsPath });
 		emit({ kind: "fact", fact: "audit-tool-calls", value: auditToolCalls.length, blocked: auditBlocked.length });
-		if (presence.sessionsPresent) {
-			emit({ kind: "fact", fact: "tokens", ...usageTotals });
+		if (usageMeasurable) {
+			// The origin split is emitted only when something out of turn was
+			// recorded, so a report over an archive with no `/btw` or `/handoff`
+			// round in it stays byte-identical to what it printed before.
+			emit({
+				kind: "fact",
+				fact: "tokens",
+				...usageTotals,
+				...(hasLabelledCall(callOrigins)
+					? {
+							turns: turnsOf(callOrigins),
+							sideQuestions: callOrigins.sideQuestions,
+							handoffs: callOrigins.handoffs,
+						}
+					: {}),
+			});
 			for (const row of usageRows) {
-				emit({ kind: "fact", fact: "model-usage", providerId: row.providerId, modelId: row.modelId, ...row.totals });
+				emit({
+					kind: "fact",
+					fact: "model-usage",
+					providerId: row.providerId,
+					attributedModelId: row.attributedModelId,
+					requestedModelIds: [...row.requestedModelIds].sort(),
+					responseModelIdObservationCounts: row.responseModelIdObservationCounts,
+					...row.totals,
+				});
 			}
 		}
 		for (const [tool, totals] of topTools) emit({ kind: "fact", fact: "top-tool", tool, ...totals });
@@ -471,22 +589,44 @@ export async function runUsageCommand(argv: ReadonlyArray<string>): Promise<numb
 		out(`  receipt store missing at ${presence.receiptsPath}`);
 	}
 	out(`  audited tool calls in window: ${auditToolCalls.length} (${auditBlocked.length} blocked/denied)`);
-	if (presence.sessionsPresent) {
+	if (usageMeasurable) {
 		out(
 			`  tokens in window: ${usageTotals.totalTokens} over ${usageTotals.apiCalls} model calls (input ${usageTotals.input}, output ${usageTotals.output}, cache read ${usageTotals.cacheRead}, cache write ${usageTotals.cacheWrite}, reasoning ${usageTotals.reasoningTokens})`,
 		);
+		if (hasLabelledCall(callOrigins)) {
+			// Only printed when a labelled call is in the window. Over an archive
+			// with none, these three lines would say nothing the line above does
+			// not already say, and their absence keeps the older output intact.
+			out(`  turns in window: ${turnsOf(callOrigins)}`);
+			if (callOrigins.sideQuestions > 0) out(`  side questions in window: ${callOrigins.sideQuestions}`);
+			if (callOrigins.handoffs > 0) out(`  handoffs in window: ${callOrigins.handoffs}`);
+		}
 		out(`  provider-reported cost in window: $${usageTotals.costUsd.toFixed(4)}`);
 	}
 	if (usageRows.length > 0) {
 		out("");
-		out("  tokens by model (from session ledgers, provider-reported)");
+		out("  tokens by attributed model (from session ledgers and provider-reported usage)");
 		process.stdout.write(
 			indent(
 				formatColumns([
-					["provider", "model", "calls", "input", "output", "cache read", "reasoning", "tokens", "cost"],
+					[
+						"provider",
+						"attributed model",
+						"requested model ids",
+						"response model id observation",
+						"calls",
+						"input",
+						"output",
+						"cache read",
+						"reasoning",
+						"tokens",
+						"cost",
+					],
 					...usageRows.map((row) => [
 						row.providerId,
-						row.modelId,
+						row.attributedModelId,
+						[...row.requestedModelIds].sort().join(","),
+						responseModelIdObservationCountsLabel(row.responseModelIdObservationCounts),
 						String(row.totals.apiCalls),
 						String(row.totals.input),
 						String(row.totals.output),

package/src/core/bus-events.ts

@@ -14,6 +14,7 @@
 
 import type { AgentAudience } from "../domains/agents/spec.js";
 import type { ConfigDiff } from "../domains/config/classify.js";
+import type { RunToolBudgetEnvelope } from "../domains/dispatch/budget-envelope.js";
 import type {
 	DispatchRequestOrigin,
 	RunKind,
@@ -480,10 +481,14 @@ export interface DispatchRunIdentity {
 	wireModelId: string;
 	runtimeId: string;
 	runtimeKind: RunKind;
+	/** Admitted invocation budget provenance for native workers. */
+	budget?: RunToolBudgetEnvelope | undefined;
 	/** Fleet node id the run was placed on; absent renders as the local node. */
 	node?: string | undefined;
 	/** Review/compete gate role and cycle, for fleet board badges. */
 	gate?: { role: string; cycle: number } | undefined;
+	/** Council group presentation data for the Fleet Runs board. */
+	council?: { group: string; label: string; color?: string; round: number } | undefined;
 	/** Dead-node failover hops recorded on this run's chain so far. */
 	rerouteCount?: number | undefined;
 	/** Model context window in tokens, for the per-worker context meter. */
@@ -569,6 +574,8 @@ export interface DispatchTerminalStats {
 	exitCode: number;
 	/** Honest activity record aggregated from the run's tool telemetry; null when the receipt predates it. */
 	toolActivity: ToolActivitySummary | null;
+	/** Host-run declared verification status when the request included checks. */
+	hostVerification?: "verified" | "rejected" | "skipped";
 }
 
 /** Published on {@link BusChannels.DispatchCompleted} when a run finalizes as succeeded. */

package/src/core/commit-attribution.ts

@@ -16,7 +16,7 @@ export const CLIO_COMMIT_TRAILERS = {
 } as const;
 
 export interface CommitReceiptEvidence {
-	version: 15;
+	version: 19;
 	algorithm: "sha256";
 	digest: string;
 	/** The receipt was checked against its run-ledger envelope. */
@@ -58,7 +58,7 @@ const KNOWN_CLIO_TRAILERS = new Set(
 );
 
 function isClioTrailer(key: string): boolean {
-	return KNOWN_CLIO_TRAILERS.has(key) || key.startsWith("clio-evidence:receipt-v15/sha256:");
+	return KNOWN_CLIO_TRAILERS.has(key) || key.startsWith("clio-evidence:receipt-v19/sha256:");
 }
 
 /**
@@ -87,7 +87,7 @@ function trailerBlockStart(lines: ReadonlyArray<string>): number | null {
 
 function receiptTrailer(receipt: CommitReceiptEvidence | undefined): string | null {
 	if (
-		receipt?.version !== 15 ||
+		receipt?.version !== 19 ||
 		receipt.algorithm !== "sha256" ||
 		receipt.integrityValid !== true ||
 		receipt.directlyRelevant !== true ||
@@ -95,7 +95,7 @@ function receiptTrailer(receipt: CommitReceiptEvidence | undefined): string | nu
 	) {
 		return null;
 	}
-	return `Clio-Evidence: receipt-v15/sha256:${receipt.digest}`;
+	return `Clio-Evidence: receipt-v19/sha256:${receipt.digest}`;
 }
 
 /**

package/src/core/config.ts

@@ -19,7 +19,9 @@ import {
 	ACTIVE_AGENT_AUTOMATION_ROLES,
 	ACTIVE_ROUTING_POSTURES,
 	ACTIVE_ROUTING_ROLES,
+	COUNCIL_MEMBER_LABEL_PATTERN,
 	DEFAULT_SETTINGS,
+	THEME_NAMED_COLORS,
 	THINKING_LEVELS,
 	type ThinkingLevel,
 } from "./defaults.js";
@@ -915,6 +917,37 @@ function validateMemorySettings(issues: Issues, value: unknown): ClioSettings["m
 	return out;
 }
 
+/**
+ * The watchdog block. `target` and `cadenceToolCalls` stay absent rather than
+ * taking sentinel values: an absent target means the session's active target,
+ * and an absent cadence means the watchdog fires only at turn end. A written
+ * default for either would turn "not configured" into a configuration.
+ */
+function validateWatchdogSettings(issues: Issues, value: unknown): ClioSettings["watchdog"] {
+	const out = cloneValue(DEFAULT_SETTINGS.watchdog);
+	if (!isPlainObject(value)) {
+		issues.add("watchdog", `expected a map, got ${describe(value)}`);
+		return out;
+	}
+	issues.unknownKeys("watchdog", value, ["enabled", "target", "cadenceToolCalls"]);
+	if ("enabled" in value) {
+		const enabled = expectBoolean(issues, "watchdog.enabled", value.enabled);
+		if (enabled !== undefined) out.enabled = enabled;
+	}
+	if ("target" in value && value.target !== null) {
+		const target = expectString(issues, "watchdog.target", value.target);
+		if (target !== undefined) {
+			if (target.trim().length === 0) issues.add("watchdog.target", "expected a non-empty target id");
+			else out.target = target.trim();
+		}
+	}
+	if ("cadenceToolCalls" in value && value.cadenceToolCalls !== null) {
+		const cadence = expectInteger(issues, "watchdog.cadenceToolCalls", value.cadenceToolCalls, { min: 1 });
+		if (cadence !== undefined) out.cadenceToolCalls = cadence;
+	}
+	return out;
+}
+
 function validateKeybindings(issues: Issues, value: unknown): ClioSettings["keybindings"] {
 	if (!isPlainObject(value)) {
 		issues.add("keybindings", `expected a map, got ${describe(value)}`);
@@ -954,6 +987,7 @@ const TOP_LEVEL_KEYS = [
 	"orchestrator",
 	"background",
 	"memory",
+	"watchdog",
 	"workers",
 	"fleet",
 	"routing",
@@ -964,6 +998,7 @@ const TOP_LEVEL_KEYS = [
 	"theme",
 	"terminal",
 	"skills",
+	"library",
 	"attribution",
 	"delegation",
 	"keybindings",
@@ -1030,6 +1065,25 @@ export function validateSettings(raw: unknown): SettingsValidationResult {
 		const v = expectStringArray(issues, "runtimePlugins", raw.runtimePlugins);
 		if (v !== undefined) settings.runtimePlugins = v;
 	}
+	if ("library" in raw) {
+		if (!isPlainObject(raw.library)) {
+			issues.add("library", `expected a map, got ${describe(raw.library)}`);
+		} else {
+			issues.unknownKeys("library", raw.library, ["catalog", "remote", "confirmedRemote", "sync"]);
+			for (const key of ["catalog", "remote", "confirmedRemote"] as const) {
+				const value = raw.library[key];
+				if (value === undefined) continue;
+				if (value !== null && typeof value !== "string")
+					issues.add(`library.${key}`, `expected a string or null, got ${describe(value)}`);
+				else settings.library[key] = value as string | null;
+			}
+			if (raw.library.sync !== undefined) {
+				if (typeof raw.library.sync !== "boolean")
+					issues.add("library.sync", `expected a boolean, got ${describe(raw.library.sync)}`);
+				else settings.library.sync = raw.library.sync;
+			}
+		}
+	}
 
 	if ("orchestrator" in raw) {
 		settings.orchestrator = validateWorkerTarget(
@@ -1050,6 +1104,7 @@ export function validateSettings(raw: unknown): SettingsValidationResult {
 		);
 	}
 	if ("memory" in raw) settings.memory = validateMemorySettings(issues, raw.memory);
+	if ("watchdog" in raw) settings.watchdog = validateWatchdogSettings(issues, raw.watchdog);
 
 	// Fleet nodes validate before workers so profile node pins can be checked
 	// against the configured node ids.
@@ -1146,6 +1201,7 @@ export function validateSettings(raw: unknown): SettingsValidationResult {
 			issues.unknownKeys("workers", raw.workers, [
 				"default",
 				"profiles",
+				"rosters",
 				"agentBindings",
 				"maxRetries",
 				"onPermission",
@@ -1187,6 +1243,75 @@ export function validateSettings(raw: unknown): SettingsValidationResult {
 					settings.workers.profiles = profiles;
 				}
 			}
+			if ("rosters" in raw.workers) {
+				if (!isPlainObject(raw.workers.rosters)) {
+					issues.add("workers.rosters", `expected a map, got ${describe(raw.workers.rosters)}`);
+				} else {
+					const rosters: ClioSettings["workers"]["rosters"] = {};
+					for (const [rawName, rawRoster] of Object.entries(raw.workers.rosters)) {
+						const name = rawName.trim();
+						const path = `workers.rosters.${name}`;
+						if (!name) {
+							issues.add("workers.rosters", "empty roster name");
+							continue;
+						}
+						if (!isPlainObject(rawRoster)) {
+							issues.add(path, `expected a map, got ${describe(rawRoster)}`);
+							continue;
+						}
+						issues.unknownKeys(path, rawRoster, ["members"]);
+						if (!Array.isArray(rawRoster.members)) {
+							issues.add(`${path}.members`, "expected a list");
+							continue;
+						}
+						if (rawRoster.members.length < 2 || rawRoster.members.length > 5) {
+							issues.add(`${path}.members`, "expected 2 to 5 members");
+						}
+						const members: ClioSettings["workers"]["rosters"][string]["members"] = [];
+						const labels = new Set<string>();
+						for (const [index, rawMember] of rawRoster.members.entries()) {
+							const memberPath = `${path}.members[${index}]`;
+							if (!isPlainObject(rawMember)) {
+								issues.add(memberPath, `expected a map, got ${describe(rawMember)}`);
+								continue;
+							}
+							issues.unknownKeys(memberPath, rawMember, ["label", "target", "model", "thinking", "color"]);
+							const label = expectString(issues, `${memberPath}.label`, rawMember.label);
+							const target = expectString(issues, `${memberPath}.target`, rawMember.target);
+							if (label !== undefined && !COUNCIL_MEMBER_LABEL_PATTERN.test(label)) {
+								issues.add(`${memberPath}.label`, "expected [a-z][a-z0-9_-]{0,31}");
+							}
+							if (label !== undefined && labels.has(label)) issues.add(`${memberPath}.label`, "duplicate label");
+							if (label !== undefined) labels.add(label);
+							if (target !== undefined && !settings.targets.some((entry) => entry.id === target)) {
+								issues.add(`${memberPath}.target`, `unknown target '${target}'`);
+							}
+							const model =
+								rawMember.model === undefined ? undefined : expectString(issues, `${memberPath}.model`, rawMember.model);
+							const thinking =
+								rawMember.thinking === undefined
+									? undefined
+									: expectEnum(issues, `${memberPath}.thinking`, rawMember.thinking, THINKING_LEVELS);
+							const color =
+								rawMember.color === undefined ? undefined : expectString(issues, `${memberPath}.color`, rawMember.color);
+							if (color !== undefined && !THEME_NAMED_COLORS.includes(color as never) && !/^#[0-9a-fA-F]{6}$/u.test(color)) {
+								issues.add(`${memberPath}.color`, "expected a theme named color or 6-digit hex color");
+							}
+							if (label === undefined || target === undefined) continue;
+							members.push({
+								label,
+								target,
+								...(model ? { model } : {}),
+								...(thinking ? { thinking } : {}),
+								...(color ? { color } : {}),
+							});
+						}
+						if (rawRoster.members.length >= 2 && rawRoster.members.length <= 5 && members.length === rawRoster.members.length)
+							rosters[name] = { members };
+					}
+					settings.workers.rosters = rosters;
+				}
+			}
 			if ("agentBindings" in raw.workers) {
 				if (!isPlainObject(raw.workers.agentBindings)) {
 					issues.add("workers.agentBindings", `expected a map, got ${describe(raw.workers.agentBindings)}`);
@@ -1318,6 +1443,7 @@ export function validateSettings(raw: unknown): SettingsValidationResult {
 				"tuiMode",
 				"fullscreenScrollbar",
 				"smoothStreaming",
+				"notify",
 			]);
 			if ("showTerminalProgress" in raw.terminal) {
 				const v = expectBoolean(issues, "terminal.showTerminalProgress", raw.terminal.showTerminalProgress);
@@ -1343,6 +1469,10 @@ export function validateSettings(raw: unknown): SettingsValidationResult {
 				if (v === "off" || v === "auto" || v === "on") settings.terminal.smoothStreaming = v;
 				else if (v !== undefined) issues.add("terminal.smoothStreaming", "expected off, auto, or on");
 			}
+			if ("notify" in raw.terminal) {
+				const v = expectBoolean(issues, "terminal.notify", raw.terminal.notify);
+				if (v !== undefined) settings.terminal.notify = v;
+			}
 		}
 	}