@iowarp/clio-coder 0.3.6 → 0.3.8

package/CHANGELOG.md

@@ -2,6 +2,65 @@
 
 All notable changes to Clio Coder are documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow Semantic Versioning; pre-1.0 minor releases may include incompatible changes.
 
+## 0.3.8 - 2026-08-29
+
+### Added
+- An extension may ship agents, fleets, and namespaced prompts alongside the skills it already provided. `clio-coder-extension.yaml` accepts `resources.agents` and `resources.fleets` beside `resources.skills`, `resources.prompts`, and `resources.themes`, and every declared root is validated when the manifest loads rather than when a resource is first read: a root must be relative, must resolve inside the extension package, must not be the package root itself, must be a directory, and must not reach outside the package through a symbolic link. The whole resource tree is walked for escaping or unresolvable links, and any failure refuses the install with a named diagnostic instead of installing a package whose resources cannot be trusted. Extension agents merge between the builtin recipes and the operator's own, ordered by extension source, so an extension can add an agent but never shadow a shipped one; an attempt is dropped with `ignore override id=<id> by=extension reason=reserved-builtin`. An extension agent's `skills:` bindings resolve only against that same extension's declared skills root with discovery disabled, so a recipe cannot bind a skill from the operator's roots or from another extension, and a binding that escapes the root is refused by name. An extension that binds skills without declaring a skills root is refused rather than silently resolving nothing. Extension fleets take the same position between builtin and user, and a project or user fleet of the same name still wins. Prompts load under the extension's namespace, so `/wtfp:new-paper` addresses the `wtfp` extension's `new-paper` template with no collision against a same-named project prompt, and a `${extensionRoot}` reference in a prompt body resolves to the installed package so a template can cite files it ships. Only an existing path contained by the declaring package resolves; a reference that is missing or escapes is refused with a diagnostic rather than expanding to a path the operator never granted.
+- Nested state resources survive an extension install. The installer excludes `state.json` because that name is the extension manager's own bookkeeping file, but it now excludes only the one at the package root. An extension that ships, say, `core/templates/state.json` as a project-state template keeps it, where every file of that name was previously dropped.
+
+### Changed
+- Receipt integrity moves from v19 to v20, covering the new `pathProvenance` field on dispatch intent (#159). Receipts sealed by 0.3.7 fail verification under 0.3.8 and are never read as evidence; they are not migrated, on the same terms as every prior integrity bump.
+- Legacy path inference is retained with explicit provenance and confidence, and inferred scope is visible before a supervised dispatch runs (#159). #158 made declared intent authoritative and left the inference path unlabelled, so a receipt recorded which project rules applied but never the path set that selected them: the effect was sealed and the cause was discarded. Dispatch intent moves to version 2 and gains `pathProvenance`, one integrity-sealed entry per policy-bearing path carrying its source, whether the value was declared, derived, or inferred, and a confidence with a deterministic ordering. Receipt integrity moves to v20 to cover it. A receipt records that a path was inferred and from which field, never the sentence it was inferred from, so briefing prose stays out of durable evidence. Declared values always outrank inferred ones and inference never widens a scope a declaration closed; an ambiguous or contradictory inference returns a typed refusal rather than passing as though it had been declared. The approval artifact renders inferred policy-bearing scope in full beside the verification argv it already showed, instead of the bare `intent_sha256` hash, and that artifact plus the sealed `pathProvenance` are the two places it appears. A dispatch that declared no intent gets no transcript notice: it is the ordinary case rather than an anomaly, one receipt in ninety-nine carries an intent key today, and warning on it fired on nearly every dispatch, printed twenty entries carrying identical provenance inline, and buried the one scope notice that does mean something.
+- Typed dispatch intent is authoritative for policy-bearing scope, and one path grammar governs every containment check (#158). `readRoots`, `relevantPaths`, and `expectedOutputs` shipped in 0.3.7 with no consumer at all: they were normalized, hashed, and sealed into the receipt, and nothing read them back. Worker rule selection ran on a regular expression over the task and briefing prose, authority admission never saw declared write scope so every writer was admitted against the whole working directory, and five separate containment predicates used three incompatible grammars, under which the entry `src/` meant a subtree to the fleet write boundary and an opaque literal to intent normalization. One owner now defines the grammar, repository-relative POSIX paths where a trailing slash means a subtree and its absence means an exact file, and admission, project-rule selection, worker enforcement, delegation-plan validation, and boundary verification all ask it. The grammar is the fleet write boundary's existing one, so a contract valid before this release means exactly what it meant before. When a request carries `intent`, the declared set replaces prose inference for rule selection and authority rather than joining it, and a path the inference would have contributed that the declaration does not carry is reported to the operator as a transcript notice naming the omitted paths and stating that they selected no project rules and expanded no worker authority. A request without `intent` keeps prose inference unchanged. Batch intent now merges field by field, and a `tasks[]` entry that would widen the top-level declaration is refused rather than silently replacing it.
+- The fleet write boundary stays post-run by design, and the two request constructors say so (#158). Wiring a fleet step's declared `writes` into `spec.writeRoots` would reach the policy engine's blanket refusal of `bash`, `verify`, and `dispatch` under an active write root, which every fleet step running a command depends on. That refusal is honest because the target check can only prove containment when it is handed a concrete write path; narrowing it to admit a fleet-declared command would claim confinement with no mechanism able to enforce it. Pre-emptive fleet confinement needs a command sandbox and is tracked separately.
+
+### Fixed
+- Extension fleets now resolve their own extension-provided agents during `fleet validate` and `fleet graph`. Those read-only commands rebuilt an agent catalog from built-in, user, and project recipes and omitted the extension slot, even though `agents`, `fleet run`, and dispatch used the domain catalog that contained it; a valid installed fleet therefore listed correctly but failed inspection with `unknown agent`. Discovery is now shared with the run and dispatch surface, preserving the existing built-in-before-extension-before-user-before-project precedence, built-in shadow protection, same-extension skill binding, quarantine behavior, and unknown-agent refusal.
+- `$ARGUMENTS` carries the operator's own text byte-for-byte instead of a shell-tokenized reconstruction of it (#240). Every slash prompt template passed its post-command payload through `parseCommandArgs`, whose tokenizer strips both quote characters and splits on spaces and tabs, and then rebuilt the aggregate placeholder with `args.join(" ")`. The round trip silently destroyed every literal quote, every tab, and every run of more than one space, indentation included, from prose the operator had typed. The defect predates this release and reached every slash command, but 0.3.8 is the release that ships namespaced extension prompts and the first real consumer of that surface hit it immediately: a 1,906-character invocation arrived as 1,904, the two missing bytes being the quote characters around a title. `$ARGUMENTS` now carries the exact payload and is substituted after the parsed placeholders, so placeholder-like operator text such as a literal `$1` stays literal rather than expanding a second time. `$1` through `$9`, `$@`, `${@:N}` and `${@:N:L}` keep the shell-tokenized semantics their names describe: quotes still group, and `$@` still joins parsed arguments with single spaces. The first whitespace character after the command name is the delimiter, counting a CRLF pair as one, and every byte after it belongs to the payload.
+- A live fleet is no longer marked failed by an unrelated Clio process starting up (#235). `assignments.json` is machine-wide, so a row still marked `running` does not prove its opener crashed; it usually means another process holds it. Startup reconciliation read `status === "running"` as proof of an orphan and settled every claimed row `failed`, so a second `clio-coder` anywhere on the machine — a CLI command beside an open TUI, a second fleet, an ACP client — declared every fleet in flight a failure while it kept running. The release test caught it on a four-step fleet whose row went terminal 83 seconds early and named a step whose own result was `succeeded: true`; it reproduces in under thirty seconds with two code-only contracts and no model call. This was a regression against #225, which closed the case where the same row lied optimistically. Every live row now persists the orchestrator pid, a process birth token, and an acquisition time, and reconciliation applies the liveness check the checkout writer lease already uses rather than trusting status alone; the owner is cleared only on a true terminal transition. Legacy ownerless rows and genuinely dead owners still reconcile, so `wait` and `collect` can never hang on a real orphan, and an abandoned claimed fleet now settles against its own fleet root instead of filing a successful child attempt as the failed terminal run.
+- The `vote` ballot directive reaches each council member once (#239). `renderCouncilVoteMemberTask` appends the directive to whatever task it is handed, and both plan admission and the runner called it in sequence with the runner receiving admission's output, so every member's integrity-sealed task carried two verbatim copies of the whole block. The vote still tallied correctly, but the directive is specified as bounded and one of its lines is the precedence instruction that stops a small local model answering in its recipe's shape instead of the ballot's — the exact conflict #230 was resolving — and stating a precedence rule twice works against it. The runner now reuses the per-position task admission already pinned into the resolved plan, composing only for a contract with no resolved artifact, so the task the approval artifact binds and the task the receipt seals are byte-identical. Composition is reused rather than made idempotent on purpose: the plan artifact is authoritative, and detecting an already-present suffix could mistake operator-authored text for system composition. The seat, persona, `shadow` audience, read-only autonomy, `council-read-only` profile, ballot contract, and tally are unchanged.
+- A receipt sealed under a retired integrity version is reported as retired, not as corrupt (#238). Receipt integrity moved from v19 to v20 in this release and 0.3.7 receipts are deliberately not migrated, but an intact, correctly sealed 0.3.7 receipt reported `verify fail … integrity invalid` in the TUI and `error: … receipt integrity: integrity invalid` from `evidence build`, which is exactly what a tampered receipt reports; on the release-test machine 99 of 107 receipts were at a retired version, so the release's first impression for anyone with history was an evidence store full of corruption. The verifier's shape check collapsed a wrong version into the same "invalid" as a malformed block, and nothing named either version. There is now a version-mismatch outcome distinct from a digest mismatch, diagnosed ahead of the verifier and carrying both versions: `receipt integrity v19 is retired; this build verifies v20; the receipt is not read as evidence`. The canonical projection distinguishes the two as well, so a retired-format run does not read like a tampered one anywhere: artifact integrity is `unknown` through a compatibility source that names the retired version, the trust line reads `seal v19 retired (this build verifies v20)` where a tampered receipt reads `seal broken`, the receipt-owned axes are absent as `historical_format` rather than `not_observed`, and the verdict is `unknown` rather than `compromised`. `evidence build` records a `receipt-retired` info finding, prints it as a note, and exits 0, since the receipt is set aside unread exactly as a missing one is; `/view verify` and the receipt view report `verify retired` with both versions in the warning color. The receipt is still not migrated and still not read as evidence; the file's digest is unchanged by every one of these reads. Only the reporting changed.
+- The canonical trust projection is the only renderer of a trust axis, on `evidence inspect` and on dispatch (#233). #162 set out to make one trust verdict render the same way everywhere and named this symptom in its own problem statement, and it was still there: `evidence inspect` printed the projection and then unconditionally appended the legacy provenance transcript, which read the receipt directly and never consulted the projection. On a current receipt one axis rendered three times in two vocabularies, `mediated`, `enforced`, and `autonomy enforcement: mediated autonomy=full-auto`; on a receipt whose seal failed, the projection correctly reported `autonomy not recorded` and the block two lines below published `autonomy enforcement: mediated autonomy=read-only` read from that same unverified receipt. Dispatch output carried the same third rendering as an `enforcement=mediated:auto-edit` suffix that `monitor` on the same run did not print. The provenance renderers now take the canonical status and print only what it admits: pipeline, persona-override, and escalation detail behind a verified seal, and the autonomy detail (`autonomy: full-auto mode=… dangerousBypass=…`) only when the projection reports that axis in a recorded state, without the axis word, which the trust summary alone prints. A bundle whose seal was rejected or retired prints no provenance block, `transcript.md` adds no provenance sentence, and `trace.cleaned.jsonl` carries no provenance fields, for the same reason. Without a projection at hand no axis detail is admitted at all, so the dispatch line stops rendering the axis a third time and agrees with `monitor`. A regression test builds a bundle from a receipt at the previous integrity version, and another from a tampered one, and pins that neither rendered output contains an autonomy value.
+- One trust verdict, worded the same way on every surface (#162). #154 defined the algebra and #157 derived receipts and bundles from it, but nothing projected either: two hand-rolled formatters dumped the same six raw axis states with different separators and different completeness, and neither answered who claims this, what was observed, what was independently checked, and what remains unknown without reading receipt internals. A single `evidence inspect` printed the same autonomy fact twice in two vocabularies two lines apart, and it shipped in four spellings across the codebase. Dispatch and monitor collapsed `failed`, `ungrounded` and `absent` validation grounding into one string while the bundle for the same run distinguished them. Evidence findings read two of the six axes, so twelve local runs finished with incomplete completion evidence and nothing said so. The Alt+W board rendered no canonical trust at all, only `host_verification`, which reads as independently verified beside a run whose canonical `independentReview` is `absent`. There are now one compact human projection and one bounded, versioned machine projection carrying references to the detailed artifacts, and dispatch, monitor, the evidence CLI and its reports, findings, the TUI board, the receipt view, and the eval metrics all render the same verdict for the same input. A trust-status glossary is in the docs.
+- The canonical trust status stops reporting valid context provenance as invalid (#162). A `none`-tier run that received the workspace root records real characters, a content hash, and a section, and the adapter refused exactly that shape, so 58 of 91 local receipts and every evidence bundle on this machine read `contextProvenance: invalid`. The axis was invisible on every surface, so nothing surfaced it until the projection above was built. The adapter's rule was written eight days after the producer's behavior shipped and encoded a docblock that was already stale rather than a deliberate stricter model, so the adapter is widened, the docblock is corrected, and the shape a real workspace-root run produces is pinned by a test taken from an actual receipt.
+- The five standing npm audit advisories are cleared, and the release gate now refuses a shipped high (#199). All five reached the published tarball through `@anthropic-ai/claude-agent-sdk` and its MCP dependency chain rather than stopping at the development surface, contrary to the assumption that had let them stand: `package-lock.json` marked every one `"dev": false`. The remaining high was self-inflicted, since this repository's own `overrides` pinned `ip-address` at exactly `10.2.0`, which sat inside an advisory range that had moved past it while the pin held. Dropping that pin and updating four packages within their already-declared semver ranges takes `npm audit` to zero, and the lockfile diff adds and removes nothing: `ip-address` 10.2.0 to 10.5.0, `fast-uri` 3.1.2 to 3.1.6, `hono` 4.12.25 to 4.13.5, `@hono/node-server` 1.19.14 to 1.19.17. Nothing had ever run `npm audit`: CI installs with `--no-audit`, and `scripts/check-release.mjs` audited package contents without asking whether those contents were vulnerable. It now runs `npm audit --omit=dev`, fails the release on a high or critical in a shipped dependency, and prints moderate and low without blocking. There is no environment-variable escape, so shipping a known high takes a reviewable edit.
+- `/council --synthesis vote` asks its members for the verdict it tallies, and produces a real tally (#230). The vote is a strict majority over the final round's structured `verdict` fields, and nothing ever asked a member for one. A council that names no agent seats the builtin `researcher`, whose `research-report` contract accepts `source` and `findings` and nothing else, so a member that emitted a verdict failed its own postcondition and a member that obeyed it emitted no verdict. Every unnamed council's vote resolved to `no_verdict_field` with an empty tally, on every input; the 0.3.7 release test observed exactly this and read it as the specified deterministic behaviour. A vote council now carries a bounded ballot directive on each member's task and seals a new `council-ballot` postcondition, `{"verdict":"...","text":"..."}`, as a per-request override in place of the seated recipe's contract, the same way `reviewer`, the compete `judge`, and the council synthesis already answer the gate that dispatched them rather than their recipe. The seat, the persona, the `shadow` audience, the read-only autonomy, and the `council-read-only` tool profile are all unchanged, and no agent recipe may declare the kind, so a council still runs the agent the operator seated and any recipe can now be voted with. The verdict is bounded to a single line of 64 bytes and lower-cased at the one place a verdict is read, because a tally groups by the exact string and a verdict that is a sentence can only ever tie with itself. A member that seals no conforming ballot spends its ordinary repair rounds and then fails its own run, so a missing verdict is reported as a failed member instead of vanishing from the count. Plan admission composes the same task suffix as the runner, so the approval artifact the plan hash binds shows the ask the member receives. Two things on the override path had to be corrected for it to work at all. A `resultContractOverride` now reaches the worker whether or not the seated recipe declares a contract of its own, matching the resolution the seal has always used; previously the override was sealed but never sent, so the worker spent no repair round on a shape it was never told about. And the worker re-parses its own `WorkerSpec.resultContract` before its first model call through what was the agent-recipe frontmatter parser, which refuses any kind a recipe may not declare, so the first live vote council died with `[worker] fatal: agent recipe: WorkerSpec.resultContract: resultContract.kind is unsupported`; the wire parser is now its own entry point that admits the recipe kinds plus the ones the coordinator authors, and the frontmatter parser stays exactly as strict as it was.
+- A fleet's `assignments.json` row reports the fleet's own verdict instead of whichever step settled last (#225). Every step of a fleet dispatches under the same `lineage.rootRunId`, so all of them share one durable assignment row, and `settleStoredAssignment` had no once-only guard where the in-memory registry has one. Each agent step overwrote the status in turn, so a run that aborted at step 2 of 7 and a run whose final code step exited 1 were both recorded `succeeded`. The receipt was not lying: a write-boundary verdict is applied by the scheduler after the receipt seals, so the assignment path never saw it. A fleet run now claims its row at open, files every settled step as an attempt including code steps, and settles the row once from its own whole-run verdict on both the normal and the throwing path; an attempt-path settle against a claimed row records its attempt and cannot write the status. Orphan reconciliation no longer resolves a claimed record to `succeeded` on the strength of one green attempt, which would have turned a crashed fleet into a successful one on the next startup.
+- The test harness refuses a `.git` at the system temp root and names whoever tried to make one (#205). A stray empty `/tmp/.git` makes `isInsideGitRepo` report every `mkdtemp` scratch as sitting inside a git repository, which drops `--no-require-git` and fails the ignore-policy contracts from whichever lane happens to run them. The creating test was not identified across 28 full suite runs, live `node:fs` and `node:child_process` instrumentation, and a static sweep, so the guard is the fix instead: an in-process write to `<systemTmp>/.git` or `<runRoot>/.git` throws before the entry exists with the test file and line in the stack, a synchronous spawn that creates one throws with its argv and cwd, an asynchronous one is reported at process exit, and `scripts/shard-tests.mjs` backstops the whole run for a creator outside every lane. The guard never deletes, because a `.git` under the system temp root can belong to somebody else. The run root is guarded alongside the system temp root because the same parent walk passes through it.
+- `/council --synthesis judge` runs, seals, and shares as a council (#221). Three defects sat on the default path. Admission refused the whole council before its first member ran, because the persona-override guard counted any non-empty system prompt and the judge carries the coordinator's own `COUNCIL_JUDGE_PROMPT`, while every unnamed council seats the builtin `researcher`, a `shadow` recipe; the ACP delegation path already exempted a bounded gate-role prompt and the two ordinary paths had drifted from it, so all three now share one predicate that stays pinned to one exact prompt text under one gate role and read-only autonomy. The synthesis slot then kept the seated recipe's result contract, so a correct judge answer of `{verdict, text}` sealed a contract failure against `research-report` and burned the configured retries reproducing it; `synthesis` now joins `reviewer` and `judge` as a gate role that answers the coordinator rather than its recipe. And the whole-council-report seal was guarded to vote and none, so `/share <judge synthesis runId>` rendered the bare judge payload with no member answers or roster labels, the exact state the 0.3.7 release test called unusable; judge now seals on the same terms, and the shared block carries every final member's labelled answer plus `[synthesis judge] verdict … · judge run …`.
+- The write boundary no longer rolls back a file the step never wrote, and no longer certifies a window it could not observe (#219). Enforcement derived violations from the working-tree diff over a step's window alone, so a file an operator edited in their own editor while a fleet ran was attributed to the step and restored from the baseline commit. A change is now blamed on a window only when it intersects what that window's runs recorded writing, drawn from the same tool-call fold that grounds a sealed mutation report; anything else is reported as an unattributed concurrent change and left exactly as it is. The record is treated as closed only when it can be: a run that made a successful call to a tool whose arguments cannot name what it writes (`bash`, `verify`, `dispatch`, `steer`, or any unregistered or MCP name, derived from the action classifier rather than a hand-written list) files no usable record, and its window keeps the previous behavior of blaming the whole diff. A blocked or failed call leaves the record closed, because it never reached the filesystem. The verdict gains `unattributed` and `attributionComplete` so it says which of the two it did. Separately, a declared write path that git ignores is now refused at `fleet validate`, at `fleet run` preflight, in the `/fleet run` preview, and when a delegation plan splices a step in, naming the path and the ignoring rule: `git status` cannot report an ignored path, so such a boundary could only ever certify an unobserved window as clean. The existing refusal to touch a path that was already dirty when the window opened is unchanged.
+- `configure` refuses a model the target does not advertise, and health distinguishes reachable from serving (#220). The command already fetched the server's model list to populate `wireModels`, but validated `--model` against the static provider catalog, which is empty for `lmstudio` and every runtime like it, so `src/cli/validate-model.ts` passed any string and the target saved as `ok`. It now checks the live list where there is one, refuses an unadvertised id while naming the ids the server does list, and takes `--force` to save one anyway. A runtime with neither a catalog nor a live list warns that the id could not be verified rather than implying it was. A loaded LM Studio model is accepted under either its instance id or its model key, since the request path resolves both. `targets --probe` gains a `degraded` health state for a target that answers but cannot serve its own `defaultModel`, judged only from a live list on a runtime with no static catalog so a cloud target can never be misread, and the row prints the reason beside the model. `doctor` reports a configured `defaultModel`, `orchestrator.model`, or `workers.default.model` that the target does not advertise. ACP treats `degraded` as reachable, because a client naming its own model can still use the target. The `README.md` quickstart and the two docs copies stop instructing readers to pass `your-model-id`, which produced a target that saved cleanly and failed on its first turn.
+- A version 5 `kind: gate` step that also declares `writes` is refused by name (#217). The gate derives its whole write boundary from `path`, and the refusal now reads `gate step '<id>' must not declare 'writes'; its write boundary is derived from 'path'` instead of `/steps/0: must have required properties scope`, which named a property the author never touched. The check runs before schema validation, alongside the existing version-gate assertions, so `fleet validate`, `fleet run`, and the `/fleet run` approval preview all print it.
+- Settings Center number editors report a refused value instead of dropping it (#218). Every number row now resolves its bound from one shared rule table (`budget.sessionCeilingUsd`, `watchdog.cadenceToolCalls`, and the three `delegation.defaults.*Ms` rows), and the editor and the apply path read the same rule, so a value the editor forwards is never dropped later. A refused submission keeps the editor open and prints the reason under the input in the words the config validator would use for the same key (`Not applied: expected an integer >= 1, got 0.`); Esc still leaves without applying, and a corrected value clears the reason and continues to the scope prompt. Three previously silent drops on that path become named refusals: a blank on the three timeout rows used to parse as zero and be discarded, a blank on `budget.sessionCeilingUsd` used to set the ceiling to zero, and a fractional `watchdog.cadenceToolCalls` used to be floored. A contract test pins the row set, so a sixth number row added without a rule fails it.
+
+## 0.3.7 - 2026-08-24
+
+### Added
+- Typed dispatch intent and host-run verification (#155). The singular request and every `tasks[]` item accept one `intent` object (`read_roots`, `write_roots`, `relevant_paths`, `expected_outputs`, `verification: [{check, timeout_ms?}]`); `gate: "<check>"` is the one shorthand for a single verification entry. Paths are normalized to sorted, duplicate-free repository-relative POSIX paths with entry and byte caps, and absolute, escaping, or malformed entries fail before approval. A `check` is a declared id resolved through the verify tool's `DeclaredCheck` projection (package scripts and `.clio-coder/verifiers.yaml`) at admission, so model text never becomes argv; the resolved argv, cwd, and timeout are frozen into the execution snapshot and the plan hash, and the approval artifact renders them. After a successful worker attempt the orchestrator runs each check through the code-step runner with no shell and the closed environment allowlist, memoizes successful evidence on the workspace fingerprint plus argv, cwd, and allowlisted environment values, and seals `hostVerification` (`verified`, `rejected`, or `skipped` with per-check argv, exit code, duration, bounded output tail, memo provenance, and artifact path) into the receipt. A rejected check turns the run into `host_verification_rejected`, which suppresses automatic retry. Review and compete accept the intent paths but refuse verification entries, as does the Claude Code subprocess runtime, each with a named reason. The receipt seals `intent` on the native worker path and the Claude Code and ACP delegation paths alike. Receipt integrity moves to v16 and covers `intent` and `hostVerification`; the existing `verification` evidence object keeps its name. Dispatch output, `monitor`, and the Fleet Runs card render `host_verification=<status>` beside `evidence_verification`.
+- `/btw <question>` asks one side question beside the session (refs #41). The round sends the compiled message history as read-only input under a short fixed instruction with no tools, streams the answer into an overlay, and appends nothing to the session JSONL, the transcript, the context ledger, or the task board, so a fleet run's workers are never briefed from it. Esc cancels a streaming round; a `/btw` during an in-flight turn is refused rather than queued. The round's usage is counted in `/cost` under a `side questions` row and is excluded from the turn count.
+- Opt-in desktop notifications (#204). `terminal.notify: true` emits one content-free terminal notification when a turn ends, when a detached batch settles, and when a worker permission or `ask_user` request parks. The title is fixed, the body comes from a closed vocabulary, control characters are stripped, and the body is bounded to 128 bytes. OSC 777 is the default and OSC 9 is used on iTerm2, Windows Terminal, and ConEmu, never both for one event. Headless, ACP, and non-TTY runs never emit one.
+- Single-writer token, checkout writer lease, and worktree-per-task (#207). `writers: 1` on a parallel dispatch or an ExecutionPlan admits at most one write-scope step at a time in declared order while read-scope steps stay concurrent; the agent ledger's claims remain advisory. The first checkout writer takes a lease under the state dir keyed by the canonical checkout path and carrying pid, process birth token, and acquisition time; a live sibling process is refused with `checkout_writer_lease_held` naming the holder pid, and a dead owner is reclaimed. `worktree: true` with `apply: "merge"` (default) or `"preserve"` runs a writer task on `clio/task/<runId>` under `.clio-coder/worktrees/<runId>/`, maps the worker cwd, write roots, and protected artifacts into it, and runs declared host verification there before merging; a conflict fails closed as `worktree_merge_conflict` and preserves the branch, and a protected-path change fails closed. The receipt gains `worktree: {path, branch, diffHash, apply, applied, reason?}`, receipt integrity moves to v17, and the approval artifact renders worktree, apply, and the frozen merge destination. Non-git checkouts, read-only agents, compete mode, and a cwd outside the checkout are refused with named reasons.
+- Fleet authoring CLI (#209). `clio-coder fleet new <name> --from <builtin>` copies `build-review`, `build-test`, or `sdlc` into `.clio-coder/fleets/` and refuses an existing destination, an unsafe stem, or an unknown builtin. `fleet validate <name> [--json]` runs the same preflight `fleet run` performs (parse, graph, command bindings, agent resolution, plan compile, write-boundary preflight) with no state-dir write, ledger row, reservation, or worker. `fleet graph <name> [--json]` prints the compiled waves with each step's kind, agent or command, scope, dependencies, and write boundary, and expands loop check and repair nodes. `fleet commands init` discovers package scripts, justfile recipes, Makefile targets, and pyproject script and tool entries through the verifier discovery and writes a fully commented `commands.yaml` draft; uncommenting confirms an entry and an existing registry is never replaced. `fleet run <name> --resume <runId>` replays the successful, integrity-valid prefix recorded in a durable fleet-run record under the state dir, reports replayed steps with their original receipt references, refuses a changed plan hash with a per-step diff, and refuses differing `--var` values. The existing `fleet resume` admission-control subcommand is unchanged.
+- `/fleet run <name> [--var k=v ...]` previews a fleet contract before anything dispatches (#208). The route preflight sends each step's compiled task, so a contract that validates from the CLI previews from the TUI, and a `--var` value may be quoted to carry spaces (`--var task="add a pow function"`). The approval overlay lists the steps by wave with kind, agent and resolved target (or command id and the exact argv from `commands.yaml`), scope, and declared write boundary, then the budget ceiling the run is admitted under; a contract that fails preflight opens the same overlay with its diagnostics and no accept key. Enter dispatches through one shared fleet-run path in the dispatch domain (`executeFleetRun`) so admission, autonomy, receipts, gate decisions, write-boundary enforcement, and the durable ledger are identical to `clio-coder fleet run`; Esc dispatches nothing and writes nothing. `clio-coder fleet run` runs through that same path and both surfaces write the durable fleet-run record, so a run started from the TUI can be resumed with `fleet run --resume`. The Fleet Runs board gains a phase column (`w<n> <stepId>`) on rows a fleet plan dispatched, empty on every other row; the compact island keeps its fixed width and shows the column only when the agent label still fits. `/fleet` alone still opens Settings → Fleet, and `/fleet run` during an in-flight turn is refused rather than queued.
+- `/handoff <goal>` carries a session's working state into a fresh session (#206). The goal is required and gated: under 12 characters, or a non-goal such as "continue" or "resume", is refused with the rule named. One out-of-turn model round with no tools extracts decisions, facts, files, commands, and open questions as JSON against a fixed schema; every list and string is bounded, and over-bound output is truncated with a visible marker rather than refused. Every file path is checked against the session's own read ledger (folded through the active `/tree` path) and never against the filesystem, so a path the session never touched is dropped and listed under `dropped (not in this session's read ledger)`. Extracted decisions merge with the settled decision board, which wins. The document opens for review with `e` for `$EDITOR`; Esc cancels with nothing written. On accept Clio mints a session, seeds it with the reviewed document as data labelled by its origin session, replays the old session's skill activations, and leaves the old session untouched apart from one terminal note naming the target. A handoff never writes a memory promotion candidate and never calls the task-memory bank. Its usage is counted in `/cost` under a `handoffs` row and excluded from the turn count.
+- `/oracle <question>` and the `oracle` shadow advisor (#210). The recipe is read-only, unreachable from `/run`, and never receives a forked transcript: `/oracle` packs a bounded digest as dispatch briefing data (settled decisions from the decision board, open tasks from the task board, the last compaction summary when one exists, and the question), capped at 12 KiB with per-section caps and a truncation marker and filtered to the active `/tree` branch. The run is a singular read-only internal dispatch through the ordinary path, so admission, receipts, and the Fleet Runs island apply; its `oracle-report` contract carries a verdict, the strongest challenge, what would change its mind, and the decisions it cited, and the rendered answer reaches the main agent as an operator note the way `/share` does. `/oracle` during an in-flight turn is refused rather than queued.
+- Opt-in turn-end watchdog (#210). `watchdog: {enabled: false, target?, cadenceToolCalls?}` is hot reloaded. With `enabled: true`, a turn that changed the tree is reviewed by one read-only `verifier` dispatch briefed with the turn's coalesced diff (per-path last-write-wins, bounded to 12 KiB) and the task board's current scope; its failed checks become one transcript notice naming the count and the first three, a passing report emits nothing, and a turn with no file mutations never fires. `watchdog.target` routes the run at a cheap local model; `cadenceToolCalls: N` also fires it every N tool calls inside a turn. At most one watchdog run is in flight at a time and an overlapping trigger is dropped and counted. It never auto-follows, never queues a turn, and never mutates. Headless and ACP runs never fire it.
+- Durable out-of-turn usage and Settings Center rows for notifications and the watchdog (#211, refs #41, #204, #206, #210). A `/btw` side question or a `/handoff` extraction round appends nothing to the session JSONL by contract, so the spend now goes to its own store at `<stateDir>/usage/out-of-turn.jsonl`: one JSON line per priced call carrying the label, session id, the repo identity the session ledger is filed under, timestamp, target, attributed model id, and provider usage, written with one append per row and kept as a bounded ring of 1000 rows rewritten atomically under the state-file lock. `clio-coder usage report` folds that store beside the session ledgers into the window's tokens, cost, and per-model totals, and prints `turns`, `side questions`, and `handoffs` counts on both the text and `--json` surfaces, subtracting labelled calls from the turn count exactly as `/cost` does; an archive with no labelled call renders byte-identical to before. `terminal.notify` gains a boolean row under EXPERIENCE › Terminal, and `watchdog.enabled`, `watchdog.target`, and `watchdog.cadenceToolCalls` gain rows under a new EXPERIENCE › Watchdog section. The two optional keys render their absence as `(session target)` and `(turn end only)` while their editors open on the stored value or empty, never on that prose; submitting an empty value removes the key from `settings.yaml` rather than storing a blank, and a cadence below one is refused with the bound named, matching the config validator. Settings Center wording is pinned word for word to the settings template where it overlaps.
+- `mode: "council"`, the read-only sibling of compete (#212). Two to five members run the same singular task concurrently on local and HTTP targets with no mutation. Members come from a configured `workers.rosters.<name>.members[]` roster (`{label, target, model?, thinking?, color?}`, validated at config load for two to five members, unique labels matching `[a-z][a-z0-9_-]{0,31}`, theme color tokens or six-digit hex, no unknown keys, hot reloaded) or from inline `members`; exactly one of `roster` or `members` is accepted. `synthesis: none | judge | vote` (default `none`), `rounds: 1..3` (default `1`), and `judge` only with judge synthesis. Refusals are typed: `council_roster_unknown`, `council_members_out_of_range`, `council_member_label_duplicate`, `council_member_target_unknown`, `council_member_remote_node` (a route that resolves to an SSH fleet node is refused before approval), `council_synthesis_requires_judge_settings`, and `council_verification_unsupported`. A council request that names no `agent` seats the builtin `researcher` rather than the dispatch default `coder`, whose write requirement the council profile cannot satisfy. Admission pins every member and the judge to `read-only` autonomy and an internal `council-read-only` tool profile holding exactly `read`, `grep`, `find`, `ls`, `code_nav`, and `context`, enforced through ordinary worker admission rather than prompt text. The resolved plan expands every member in every round plus the judge, so the approval artifact lists each member's label, target, model, thinking, node, color, round, and synthesis, and the plan hash binds all of it. Round one gives every member the same task and briefing; each later round gives a member the other members' prior answers as labelled untrusted briefing data (never its own), bounded to 8 KiB with a truncation marker, with a failed peer marked rather than quoted. `vote` computes a deterministic strict majority over the final round's structured `verdict` fields with no model call and reports `no_verdict_field` or `no_majority` when it cannot; `judge` runs one read-only judge under a fixed prompt with every final answer as labelled briefing. The dispatch result carries one section per member and one synthesis section, `details.council` holds the typed `council-report` (`{members: [{label, runId, round, answer, verdict?, failed?}], synthesis: {kind, text?, verdict?, tally?, judgeRunId?}}`), and the result is an error only when a final-round member or the judge failed. Every member run seals its own receipt; `none` and `vote` seal one coordinator-only zero-token synthesis receipt that carries no member provenance and publish its enqueued and completed lifecycle events so the Fleet Runs board and `/share` see it, and the judge receipt is the synthesis receipt in judge mode, each pointing backward at every final member run through gate provenance. `monitor` reports the council role and group, the Fleet Runs board projection carries `council: {group, label, color?, round}` for a later grid, and receipt integrity moves to v18 with the `council` field. The grid and `/council` are a separate change.
+- Council rendering and `/council` (#213). The `Alt+W` Fleet Runs board folds a council group into one card in the position of its first row: a side-by-side grid with one column per member while every column keeps at least 34 cells, otherwise the whole group stacks, because a grid where only some columns are readable is worse than none. Each column shows the member label in its roster color (a theme token paints as that token, `#rrggbb` paints literally through the xterm cube without truecolor, anything else takes the accent), the target and model, the round and status, and up to four rows of the run's bounded answer tail; a council that ran several rounds keeps one column per member at its newest round, and the synthesis run renders full width under the members. The compact island shows one card per council naming the group, member count, and round. `/council [--roster <name>] [--rounds <n>] [--synthesis judge|vote|none] <task>` owns no dispatch path of its own: it builds dispatch-tool arguments spelled exactly as the tool declares them and admits them through the tool registry, so supervised autonomy parks the same approval overlay a model-asked council would. `--roster` falls back to `workers.rosters.default`; with neither the command refuses and names the setting rather than guessing from the only roster present. Rounds and synthesis bounds are enforced where the operator typed them, and a `/council` during an in-flight turn is refused rather than queued. `/share <synthesis runId>` brings every final-round member's labelled answer and the synthesis line (mode, verdict, tally, judge run) into the main context as one bounded prose block, never the raw payload; `/share <member runId>` labels that member's answer with its roster label; a synthesis whose sealed text does not parse is shared verbatim.
+- Fleet contract v5: `kind: plan`, `kind: gate`, per-step target or profile, and top-level `writers` (#214). Version literal `5` joins the contract; readers of 1 to 4 refuse `plan`, `gate`, `target`, `profile`, and `writers` by name, exactly as they refuse `writes` below 4, and ExecutionPlan versioning is unchanged. An agent step, a loop check agent, or a loop repair agent may declare `target: <targetId>` or `profile: <workers.profiles key>` (never both); resolution shares the `/run --target` and `/run --agent-profile` request fields, and an unknown id refuses at preflight naming it, in `fleet validate`, `fleet run`, and the `/fleet run` preview, which now reports a route the process cannot resolve as a named diagnostic instead of rendering `route unresolved`. A `kind: gate` step names a validator agent, one repository-relative `path` that becomes its whole derived write boundary (a separate `writes` is refused), and a `run` command whose argv carries the gate path as the single whole-token `{{path}}` substitution; after the author settles, the coordinator runs the command with no shell against the untouched tree and requires red, a green baseline fails the step as `gate_not_discriminating`, the receipt seals `fleetGate: {path, pathHash}`, and a loop may use `check: {kind: gate, gate: <id>}`, in which case only verbatim `FAIL` lines from the check reach the repair agent. A `kind: plan` step (agent defaults to the builtin `architect`) declares `roster`, `maxTasks: 1..16`, optional `proposals: true`, its own scope and `writes`, and an optional route default; the architect returns a `delegation-plan` result contract (`{tasks: [{id, agent, description, depends_on, writes, mode?}]}`) that a pure validator checks for roster membership, task count, unique ids, resolvable acyclic dependencies, and writes inside the plan step's boundary, each failure a named `delegation_plan_*` reason that fails the step and splices nothing. `delegation-plan` is an admitted worker result contract, so the architect step reaches the model. On success the coordinator records the deterministic plan hash on the durable fleet run record and the scheduler splices the tasks into the live plan after the wave settles: every spliced task passes the same preflight, reservation, admission group, writer-token grouping, post-step write-boundary enforcement, and durable settlement record as a static step, depends on the plan step plus its declared dependencies, inherits the plan step's target or profile, and seals lineage to the plan step's run. `proposals: true` first runs every roster member read-only with the same task and hands the architect their `PROPOSAL <agent>` sections as briefing bounded to 12,000 bytes. `fleet graph` names a gate or plan step by its contract kind with the gate path and run command or the roster and `maxTasks`, and a step whose receipt succeeded but whose gate baseline or delegation plan failed settles as failed with `reason=<name>` in `fleet run` output and the `/fleet run` notice. The approval artifact renders target or profile, gate path, run command, and baseline command, and plan roster, maxTasks, and proposals; `fleet run --resume` replays the static prefix up to the first plan step and reruns it rather than reconstructing prior dynamic tasks. Receipt integrity moves to v19 with the `fleetGate` field.
+- Resource library (#215). The marketplace index machinery that carries skills now carries agent recipes, prompt templates, and fleet contracts. Every index entry accepts `kind: skill | agent | prompt | fleet` (default `skill`, so every existing index parses unchanged) and optional typed `requires: [skill:x, agent:y, prompt:p, fleet:z]`, resolved recursively across the selected catalog and the private catalog; a missing, malformed, or cyclic requirement refuses the entry with `library_requirement_missing`, `library_requirement_malformed`, or `library_requirement_cycle` naming the chain. `clio-coder library list|search [--kind k] [--json]`, `library add <ref> [--from <catalog|path>] [--with-requirements] [--yes]`, `library use <kind> <name>`, `library sync`, `library push`, and `library remote confirm <url>` land as one literal dynamic import. `add` resolves requirements against the pin store and the destination path, lists satisfied ones separately, refuses on unsatisfied ones unless `--with-requirements` installs them first in dependency order, prints every destination and SHA-256 before writing, and writes nothing without `--yes`. An agent installs to `<configDir>/agents/<name>.md` after the recipe schema and policy checks, a prompt to `<configDir>/prompts/<name>.md` after the prompt loader, a fleet to a new user fleet root `<configDir>/fleets/<name>.md` after `parseFleetContract` (precedence is builtin, then user, then project), and a skill through the existing installer; every install is pinned by typed ref and hash in `<configDir>/library-pins.yaml` through the safe resource write. A private catalog at `library.catalog` (default `<configDir>/library.yaml`) overlays same-ref marketplace entries and resolves relative sources beside itself. Git-backed sync is opt-in: `library.sync: false` (the default) refuses `sync` and `push` with `library_sync_disabled` before any process spawns; with it on, the repository's remote must be named `library` and match a confirmed URL (`library remote confirm`, which refuses `library_remote_mismatch` when it differs from `library.remote`), `sync` runs `git fetch library` then `git merge --ff-only FETCH_HEAD`, and `push` runs `git push library`, each an argv vector with no shell. Share archives gain `agent` and `fleet` entry types (`share export --agents --fleets`, included in `--all`), imported into the user roots after the same validation. The Skills Hub keeps rendering skills only; its kind tabs are a separate change.
+- Skills Hub kind tabs and `/library` (#216). The hub carries one tab per resource library kind (Skills, Agents, Prompts, Fleets), switched with `←`/`→`, the key vocabulary the Settings Center already uses to move between sections; the frame title names the active tab and the footer states its row count. The Skills tab is unchanged. The other three list their kind from the same `discoverLibrary()` the CLI's `library list --kind` reads, with origin, version, installed or available, the short pin hash, and the names of any unresolved requirements in the warning token; a catalog entry the library refuses appears as a diagnostic row rather than being omitted. `i` installs through the same classify, plan, and write sequence `library add` runs, behind a framed confirmation that states every destination and SHA-256 and writes nothing on Esc; an entry with unresolved requirements is refused by name on the first `i`, and a second `i` opens the install-with-requirements confirmation naming every entry it would write in dependency order. `Enter` on an installed row inserts `/run <agent> ` for an agent, the `/<id> ` invocation for a prompt, `/skill <name> ` for a skill, and for a fleet closes the hub and opens the `/fleet run` approval preview; a row that is not installed says so and points at `i`. `/library [kind]` opens the hub on that tab and `/library` alone on Skills, where `/skill` still opens. Tab support lives in the shared list overlay, so untabbed overlays are unchanged.
+### Changed
+- `clio-coder fleet run` now executes through the same `executeFleetRun` path as `/fleet run`, so admission, autonomy, receipts, gate decisions, write-boundary enforcement, and the durable fleet-run record under `<stateDir>/fleet-runs/<runId>.json` are identical from both surfaces, and a run started from either can be resumed with `fleet run --resume` (#208, #209). The `fleet resume` admission-control subcommand is unchanged.
+- Fleet contracts resolve from three roots with fixed precedence: builtin, then the new user root `<configDir>/fleets/`, then the project's `.clio-coder/fleets/` (#215). A project contract still shadows a user one of the same name.
+- `share export --all` now includes agent recipes and fleet contracts beside the existing entry types, and `share import` validates them through the recipe schema and `parseFleetContract` before writing (#215). Archives without those entry types import unchanged.
+- The `/fleet run` approval preview reports a step route the process cannot resolve as a named preflight diagnostic instead of rendering `route unresolved` (#214).
+- `clio-coder usage report` prints `turns`, `side questions`, and `handoffs` counts on the text and `--json` surfaces (#211). An archive with no labelled out-of-turn call reports zero side questions and handoffs and the same tokens, cost, and per-model totals as before.
+- Receipt integrity moves from v15 to v19 across this release: v16 adds `intent` and `hostVerification` (#155), v17 adds `worktree` (#207), v18 adds `council` (#212), and v19 adds `fleetGate` (#214). Receipts sealed by 0.3.6 fail verification under 0.3.7 and are never read as evidence; they are not migrated.
+- `clio-coder --help` lists `library` beside `skills`.
+- The `/fleet run` approval, `/handoff` review, and Skills Hub install confirmation overlays match Enter, Esc, and the arrows by key name rather than raw bytes, so they answer under the kitty keyboard protocol, where Esc arrives as `CSI 27 u`, and ignore key-release events.
+
 ## 0.3.6 - 2026-08-23
 
 0.3.5 was published by mistake and withdrawn; its content ships here.

package/README.md

@@ -127,7 +127,7 @@ Scripting the same setup the wizard performs:
 
 ```bash
 clio-coder configure --id local-lmstudio --runtime lmstudio \
-  --url http://localhost:1234 --model your-model-id \
+  --url http://localhost:1234 --model qwen3.8-27b \
   --set-orchestrator --set-fleet-default
 clio-coder targets --probe
 
@@ -135,6 +135,11 @@ clio-coder auth login anthropic-max     # or: openai-codex
 clio-coder configure --id claude-sub --runtime anthropic-max --model claude-sonnet-5 --set-orchestrator
 ```
 
+`--model` must name an id the server advertises; `configure` asks the server
+and refuses one it does not list, naming the ids it does. `qwen3.8-27b` is the
+id LM Studio gives the recommended model above; substitute whatever `lms ls`
+shows for yours.
+
 > [!NOTE]
 > Connecting a Claude Pro/Max subscription over OAuth uses the same path as
 > Claude Code. Using subscription credentials outside a vendor's first-party
@@ -160,6 +165,11 @@ numbered diffs, and `!` runs a shell command in the same transcript.
 | Branch, revisit, or pick up a session | `/tree`, `/fork`, `/resume`, `/new` |
 | Delegate to a fleet agent and watch it work | `/run coder "..."`, `/tasks`, `Alt+W` |
 | Load a skill or bootstrap project context | `/skill <name>`, `/context init` |
+| Ask a side question without touching the session, or get a read-only second opinion | `/btw <question>`, `/oracle <question>` |
+| Put the same question to several models at once and read one synthesis | `/council --synthesis vote "..."` |
+| Preview and run a multi-step fleet contract, resumable from the CLI | `/fleet run <name>` |
+| Install agents, prompts, fleets, and skills from a catalog | `/library`, `/library agents` |
+| Carry the working state into a fresh session | `/handoff <goal>` |
 | Save a self-contained HTML transcript | `/export` (an explicit `.md` path keeps Markdown) |
 | Everything else | `/help` |
 
@@ -215,9 +225,15 @@ fleet:
       maxWorkers: 1
 ```
 
-`clio-coder doctor` preflights every node, `clio-coder fleet list|run|status`
-drives and observes work, and `clio-coder fleet drain|resume` closes or reopens
-admission without interrupting running work. Nodes share the project
+`clio-coder doctor` preflights every node. `clio-coder fleet list` names the
+builtin and discovered contracts, `clio-coder fleet new|validate|graph`
+authors a fleet contract from a builtin and checks it without dispatching
+anything, `clio-coder fleet run|status` drives and observes work (`fleet run
+--resume <runId>` replays a settled prefix), and `clio-coder fleet
+drain|resume` closes or reopens admission without interrupting running work.
+Contracts may declare a single writer, a gate step that must go red before the
+author is trusted, and a plan step whose architect delegates bounded tasks to
+a roster at run time. Nodes share the project
 filesystem at the same absolute path, and a target URL resolves on the node the
 worker runs on, so `localhost` means that node's own inference server. The
 end-to-end walkthrough, including a recorded multi-node demo, is in
@@ -263,7 +279,7 @@ dist-tag instead.
 From source, pinned to this release:
 
 ```bash
-git clone --branch v0.3.6 https://github.com/iowarp/clio-coder.git
+git clone --branch v0.3.8 https://github.com/iowarp/clio-coder.git
 cd clio-coder
 npm run install:local
 export PATH="$HOME/.local/bin:$PATH"
@@ -289,7 +305,7 @@ Full lifecycle details, including `reset` and the upgrade path, are in
 
 ## Status
 
-The current release is **v0.3.6**, installable from npm as
+The current release is **v0.3.7**, installable from npm as
 [`@iowarp/clio-coder`](https://www.npmjs.com/package/@iowarp/clio-coder) or
 from source. Clio Coder is still experimental: we ship quickly, interfaces may
 change between minor versions, and model-specific behavior varies by target, so

package/dist/{acp-2BEHC4DL.js → acp-U67UHUK2.js}

@@ -6,31 +6,31 @@ import {
 } from "./chunk-2VTFPG5O.js";
 import {
   runClioCommand
-} from "./chunk-XYDYPRZI.js";
-import "./chunk-E25LMLRW.js";
+} from "./chunk-VWZOAB7K.js";
+import "./chunk-26LEYJZH.js";
 import "./chunk-HKIYEGME.js";
-import "./chunk-KOHPCX4K.js";
-import "./chunk-24I7BN55.js";
+import "./chunk-IFBNV6H6.js";
+import "./chunk-XWSF374K.js";
 import {
   printError
-} from "./chunk-PPAMZ32Z.js";
+} from "./chunk-XK56QHLX.js";
 import "./chunk-5TSRNF4G.js";
-import "./chunk-AD2SYQYC.js";
-import "./chunk-4OC57DA6.js";
-import "./chunk-LL4KHSZI.js";
-import "./chunk-4VP4KH3K.js";
+import "./chunk-IJ7RPIYJ.js";
 import {
   MAX_TIMER_DELAY_MS
 } from "./chunk-FQ4SKYE4.js";
+import "./chunk-IWHMRKLL.js";
+import "./chunk-4DGYLA73.js";
+import "./chunk-LL4KHSZI.js";
+import "./chunk-4ZG3XFUR.js";
+import "./chunk-EQ63NRB7.js";
+import "./chunk-SST6Z5JA.js";
 import "./chunk-IKCO5N3L.js";
 import "./chunk-3I7MS7N2.js";
-import "./chunk-SST6Z5JA.js";
-import "./chunk-4ZG3XFUR.js";
 import "./chunk-APJ265NV.js";
-import "./chunk-YXLYO42X.js";
 import "./chunk-BNAZZHFG.js";
 import "./chunk-WEPFGWHJ.js";
-import "./chunk-IWHMRKLL.js";
+import "./chunk-YXLYO42X.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
@@ -126,4 +126,4 @@ export {
   resolveAcpCwd,
   runAcpCommand
 };
-//# sourceMappingURL=acp-2BEHC4DL.js.map
+//# sourceMappingURL=acp-U67UHUK2.js.map

package/dist/{agents-LNNFTM53.js → agents-YU6SGALZ.js}

@@ -1,64 +1,71 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
-  AgentsDomainModule,
   SafetyDomainModule
-} from "./chunk-LYF7OHWH.js";
-import "./chunk-6XXKFVSN.js";
+} from "./chunk-EMYUUSFG.js";
+import "./chunk-5Q2VVUKB.js";
 import {
   ensureClioState
-} from "./chunk-KHSFENX2.js";
+} from "./chunk-WWCZ5F23.js";
 import {
   ConfigDomainModule,
   loadDomains
-} from "./chunk-R46L2BIR.js";
-import "./chunk-E25LMLRW.js";
-import "./chunk-QKMUKYO7.js";
-import "./chunk-4BPJXDWC.js";
-import "./chunk-2SFS6XQE.js";
-import "./chunk-ZWLZP4ZT.js";
-import "./chunk-IR4CFBFN.js";
+} from "./chunk-FHJEP5SW.js";
+import {
+  AgentsDomainModule
+} from "./chunk-FBVTI2TJ.js";
+import "./chunk-DR52UMZW.js";
+import "./chunk-TANS5ZJS.js";
+import "./chunk-DGSYXYMX.js";
+import "./chunk-26LEYJZH.js";
+import "./chunk-WXY7KU3G.js";
+import "./chunk-RVG5JXAL.js";
+import "./chunk-E77JEWSD.js";
+import "./chunk-DYIM5TJT.js";
+import "./chunk-VCBR6CU7.js";
 import "./chunk-UOV2BYIW.js";
-import "./chunk-EKY57CSP.js";
+import "./chunk-5H3GB5BO.js";
+import "./chunk-A2NJGIB3.js";
+import "./chunk-HWUFFB6L.js";
+import "./chunk-TTHACPOM.js";
 import {
   isUserVisibleAgent
 } from "./chunk-AOCYTWAV.js";
 import "./chunk-MV3K5QF2.js";
-import "./chunk-FYYLNIL5.js";
 import "./chunk-UL3WSD3F.js";
 import "./chunk-ECH6PKUQ.js";
-import "./chunk-HWUFFB6L.js";
 import "./chunk-5B2AEOW5.js";
 import "./chunk-CGKSTWHD.js";
 import "./chunk-XPLRXC72.js";
-import "./chunk-RD5U66HV.js";
-import "./chunk-KOHPCX4K.js";
-import "./chunk-24I7BN55.js";
+import "./chunk-IFBNV6H6.js";
+import "./chunk-GPIEI3LY.js";
+import "./chunk-XWSF374K.js";
 import {
   printError
-} from "./chunk-PPAMZ32Z.js";
+} from "./chunk-XK56QHLX.js";
 import "./chunk-5TSRNF4G.js";
-import "./chunk-AD2SYQYC.js";
-import "./chunk-4OC57DA6.js";
-import "./chunk-LL4KHSZI.js";
-import "./chunk-4VP4KH3K.js";
-import "./chunk-VEZEGCGW.js";
-import "./chunk-FQ4SKYE4.js";
-import "./chunk-IKCO5N3L.js";
-import "./chunk-3I7MS7N2.js";
+import "./chunk-LU7P4LHA.js";
 import "./chunk-IHXBNWMM.js";
-import "./chunk-SST6Z5JA.js";
-import "./chunk-FO5ZOVUY.js";
+import "./chunk-B5CSFE7B.js";
+import "./chunk-IJ7RPIYJ.js";
+import "./chunk-FQ4SKYE4.js";
+import "./chunk-ZGVHUX3M.js";
+import "./chunk-TT36MB5S.js";
+import "./chunk-3BINW3FP.js";
 import "./chunk-R346GLFC.js";
+import "./chunk-6EJMN2Y3.js";
+import "./chunk-IWHMRKLL.js";
+import "./chunk-4DGYLA73.js";
+import "./chunk-LL4KHSZI.js";
 import "./chunk-4ZG3XFUR.js";
+import "./chunk-EQ63NRB7.js";
+import "./chunk-SST6Z5JA.js";
+import "./chunk-IKCO5N3L.js";
+import "./chunk-3I7MS7N2.js";
 import "./chunk-APJ265NV.js";
-import "./chunk-YXLYO42X.js";
 import "./chunk-BNAZZHFG.js";
-import "./chunk-6EJMN2Y3.js";
 import "./chunk-WEPFGWHJ.js";
-import "./chunk-XE2VEJHX.js";
-import "./chunk-ZGVHUX3M.js";
-import "./chunk-G7MUEIGA.js";
-import "./chunk-IWHMRKLL.js";
+import "./chunk-NUGM5KR6.js";
+import "./chunk-YXLYO42X.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
@@ -118,4 +125,4 @@ function renderLine(spec) {
 export {
   runAgentsCommand
 };
-//# sourceMappingURL=agents-LNNFTM53.js.map
+//# sourceMappingURL=agents-YU6SGALZ.js.map