@kitman-sh/sdk 0.9.0 → 0.10.52

package/dist/{chunk-e1tqypyy.js → chunk-zvzw3zs4.js}

@@ -1,283 +1,406 @@
 // @bun
 import {
-  AgentSandboxNetwork,
   Numeric,
   isWholeNumber,
   guard,
   Id,
   Timestamp,
-  LoopStepOutput,
-  StepBrief,
   LoopManifest,
+  capabilitiesOf2,
   ManifestInvalid2,
   loopManifest2,
+  questionAdvice,
   StepFailed2,
-  agentWorkDeferred2,
   answerDeferred2,
   childDeferred2,
   eventDeferred2,
   verifyDeferred2,
+  ResourceName,
+  claimDeferred2,
+  letGoDeferred2,
+  WorkUnitRepoBinding,
+  ProgramWorkUnit,
+  ApprovedCheck,
+  MeasurePlan2,
+  WorkUnitClaimResult,
+  WorkUnitClaimInput,
+  WorkUnitHeartbeatInput,
+  WorkUnitHeartbeatResult,
+  WorkUnitReleaseInput,
+  WorkUnitCompletion,
+  measureDeferred2,
   loopWorkflow2,
   executeLoop2,
   LoopCheckError2,
   checkLoop2
-} from "./chunk-36jhc745.js";
-// packages/core/src/repo-binding.ts
+} from "./chunk-tcbgb4wm.js";
+// packages/core/src/agent-environment.ts
 import * as Schema from "effect/Schema";
-var ForgeKinds = ["github", "gitlab", "forgejo", "gitea", "gitee", "bitbucket", "azure-devops"];
-var ForgeKind = Schema.Literals(ForgeKinds);
-var RepoBindingProviders = [...ForgeKinds, "generic_git"];
-var RepoBindingPathPrefixPattern = "^(?!/)(?!.*\\\\)(?!.*(?:^|/)\\.\\.?(?:/|$))(?!.*//)\\S+$";
-var RepoBindingProvider = Schema.Literals(RepoBindingProviders);
-var RepoBindingStatus = Schema.Union([Schema.Literal("active"), Schema.Literal("disabled")]);
-var RepoBindingCredentialProviderType = Schema.Union([
-  Schema.Literal("env"),
-  Schema.Literal("file"),
-  Schema.Literal("exec")
+var AgentEnvironmentPolicy = Schema.Union([Schema.Literal("recommended"), Schema.Literal("required")]);
+var AgentHarnessId = Schema.Union([
+  Schema.Literal("opencode"),
+  Schema.Literal("claude-code"),
+  Schema.Literal("codex"),
+  Schema.Literal("pi")
 ]);
-var RepoBindingAccessMode = Schema.Union([
-  Schema.Literal("local_checkout"),
-  Schema.Literal("managed_clone"),
-  Schema.Literal("runner_secret_provider")
+var Sha256 = Schema.String.check(Schema.isPattern(new RegExp("^[a-fA-F0-9]{64}$", "u")));
+var relativePathPattern = "^(?!/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.\\.?($|/)).+$";
+var SourcePath = Schema.String.check(Schema.isMinLength(1), Schema.isPattern(new RegExp(relativePathPattern, "u")));
+var SkillSource = Schema.Union([
+  Schema.Struct({
+    kind: Schema.Literal("skills_sh"),
+    slug: Schema.String.check(Schema.isMinLength(1)),
+    version: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("kitman"),
+    skillId: Schema.optionalKey(Id),
+    name: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
+    contentMarkdown: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
+    files: Schema.optionalKey(Schema.Record(SourcePath, Schema.String))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("git"),
+    url: Schema.String.check(Schema.isMinLength(1)),
+    ref: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
+    path: Schema.optionalKey(SourcePath),
+    sha256: Schema.optionalKey(Sha256)
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("package"),
+    packageName: Schema.String.check(Schema.isMinLength(1)),
+    version: Schema.String.check(Schema.isMinLength(1)),
+    path: Schema.optionalKey(SourcePath),
+    sha256: Schema.optionalKey(Sha256)
+  }),
+  Schema.Struct({ kind: Schema.Literal("url"), url: Schema.String.check(Schema.isMinLength(1)), sha256: Sha256 }),
+  Schema.Struct({ kind: Schema.Literal("local_path"), path: Schema.String.check(Schema.isMinLength(1)) })
+]);
+var PluginSource = Schema.Union([
+  Schema.Struct({
+    kind: Schema.Literal("package"),
+    packageName: Schema.String.check(Schema.isMinLength(1)),
+    version: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("git"),
+    url: Schema.String.check(Schema.isMinLength(1)),
+    ref: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("url"),
+    url: Schema.String.check(Schema.isMinLength(1)),
+    sha256: Schema.String.check(Schema.isPattern(new RegExp("^[a-fA-F0-9]{64}$", "u")))
+  }),
+  Schema.Struct({ kind: Schema.Literal("local_path"), path: Schema.String.check(Schema.isMinLength(1)) })
 ]);
-var RepoBindingCredentialRef = Schema.Union([
-  Schema.Struct({ kind: Schema.Literal("none") }),
-  Schema.Struct({ kind: Schema.Literal("local_env"), envName: Schema.String.check(Schema.isMinLength(1)) }),
+var McpServerTransport = Schema.Union([
+  Schema.Struct({
+    kind: Schema.Literal("stdio"),
+    command: Schema.String.check(Schema.isMinLength(1)),
+    args: Schema.optionalKey(Schema.Array(Schema.String)),
+    env: Schema.optionalKey(Schema.Record(Schema.String, Schema.String))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("streamable_http"),
+    url: Schema.String.check(Schema.isMinLength(1)),
+    headers: Schema.optionalKey(Schema.Record(Schema.String, Schema.String))
+  })
+]);
+var ProviderAuthRef = Schema.Union([
+  Schema.Struct({
+    provider: Schema.String.check(Schema.isMinLength(1)),
+    policy: AgentEnvironmentPolicy,
+    kind: Schema.Literal("existing_harness_login"),
+    accountHint: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
   Schema.Struct({
+    provider: Schema.String.check(Schema.isMinLength(1)),
+    policy: AgentEnvironmentPolicy,
+    kind: Schema.Literal("local_env"),
+    envName: Schema.String.check(Schema.isMinLength(1))
+  }),
+  Schema.Struct({
+    provider: Schema.String.check(Schema.isMinLength(1)),
+    policy: AgentEnvironmentPolicy,
     kind: Schema.Literal("runner_secret"),
-    runnerSecretName: Schema.String.check(Schema.isMinLength(1)),
-    providerType: RepoBindingCredentialProviderType
+    runnerSecretName: Schema.String.check(Schema.isMinLength(1))
   }),
-  Schema.Struct({ kind: Schema.Literal("ssh_agent") })
+  Schema.Struct({
+    provider: Schema.String.check(Schema.isMinLength(1)),
+    policy: AgentEnvironmentPolicy,
+    kind: Schema.Literal("managed_oauth"),
+    grantId: Schema.optionalKey(Id)
+  })
+]);
+var RunnerSecretSource = Schema.Union([
+  Schema.Struct({ kind: Schema.Literal("env"), envName: Schema.String.check(Schema.isMinLength(1)) }),
+  Schema.Struct({ kind: Schema.Literal("file"), pathRef: Schema.String.check(Schema.isMinLength(1)) }),
+  Schema.Struct({ kind: Schema.Literal("exec"), commandRef: Schema.String.check(Schema.isMinLength(1)) })
 ]);
-var RepoBinding = Schema.Struct({
-  id: Id,
-  workspaceId: Id,
-  teamId: Schema.optionalKey(Id),
-  provider: RepoBindingProvider,
-  host: Schema.String.check(Schema.isMinLength(1)),
-  owner: Schema.String.check(Schema.isMinLength(1)),
+var RunnerSecretRef = Schema.Struct({
   name: Schema.String.check(Schema.isMinLength(1)),
-  repositoryUrl: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
-  pathPrefix: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1), Schema.isPattern(new RegExp(RepoBindingPathPrefixPattern, "u")))),
-  defaultTargetBranch: Schema.String.check(Schema.isMinLength(1)),
-  expectedBranch: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
-  expectedCommitSha: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
-  credentialRefs: Schema.Array(RepoBindingCredentialRef),
-  status: RepoBindingStatus,
-  webhook: Schema.optionalKey(Schema.Struct({
-    status: Schema.Literals(["active", "missing", "unavailable"]),
-    message: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(240)))
-  })),
-  createdAt: Timestamp,
-  updatedAt: Timestamp
+  policy: AgentEnvironmentPolicy,
+  source: RunnerSecretSource,
+  capabilities: Schema.optionalKey(Schema.Array(Schema.String.check(Schema.isMinLength(1))))
 });
-var RepoBindingCreate = Schema.Struct({
-  teamId: Schema.optionalKey(Id),
-  provider: RepoBindingProvider,
-  host: Schema.String.check(Schema.isMinLength(1)),
-  owner: Schema.String.check(Schema.isMinLength(1)),
+var Patterns = Schema.Array(Schema.String.check(Schema.isMinLength(1)));
+var AgentSkillRequirement = Schema.Struct({
   name: Schema.String.check(Schema.isMinLength(1)),
-  repositoryUrl: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
-  pathPrefix: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1), Schema.isPattern(new RegExp(RepoBindingPathPrefixPattern, "u")))),
-  defaultTargetBranch: Schema.String.check(Schema.isMinLength(1)),
-  expectedBranch: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
-  expectedCommitSha: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
-  credentialRefs: Schema.optionalKey(Schema.Array(RepoBindingCredentialRef))
+  policy: AgentEnvironmentPolicy,
+  source: SkillSource,
+  appliesTo: Schema.optionalKey(Schema.Struct({ dependencies: Schema.optionalKey(Patterns), files: Schema.optionalKey(Patterns) }))
 });
-var RepoBindingTargetOverride = Schema.Struct({
-  targetBranch: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+var AgentPluginRequirement = Schema.Struct({
+  name: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  sources: Schema.NonEmptyArray(PluginSource)
 });
-var RepoBindingList = Schema.Struct({ items: Schema.Array(RepoBinding) });
-var RunnerRepoBindingCapability = Schema.Struct({
-  repoBindingId: Id,
-  provider: RepoBindingProvider,
-  host: Schema.String.check(Schema.isMinLength(1)),
-  accessModes: Schema.Array(RepoBindingAccessMode),
-  credentialProviderTypes: Schema.Array(RepoBindingCredentialProviderType),
-  authenticated: Schema.Boolean,
-  canPush: Schema.optionalKey(Schema.Boolean)
+var AgentMcpServerRequirement = Schema.Struct({
+  name: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  transport: McpServerTransport
 });
-
-// packages/core/src/work-unit.ts
-import * as Schema2 from "effect/Schema";
-import * as Struct3 from "effect/Struct";
-var WorkUnitLease = Schema2.Struct({
-  leaseOwnerId: Id,
-  runnerReplicaId: Id,
-  leaseId: Id,
-  attempt: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1)),
-  fencingToken: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240), Schema2.isPattern(new RegExp("^[A-Za-z0-9._:-]+$", "u"))),
-  capacitySlot: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  leaseExpiresAt: Timestamp,
-  lastHeartbeatAt: Timestamp
+var AgentHarnessSetting = Schema.Struct({
+  harness: AgentHarnessId,
+  key: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  value: Schema.Unknown
 });
-var WorkUnitLeaseProjection = Schema2.Struct(Struct3.map(WorkUnitLease.fields, Schema2.optionalKey));
-var WorkUnitRepoBinding = Schema2.Struct({
-  id: Id,
-  provider: RepoBindingProvider,
-  host: Schema2.String.check(Schema2.isMinLength(1)),
-  owner: Schema2.String.check(Schema2.isMinLength(1)),
-  name: Schema2.String.check(Schema2.isMinLength(1)),
-  repositoryUrl: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
-  pathPrefix: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
-  defaultTargetBranch: Schema2.String.check(Schema2.isMinLength(1)),
-  expectedBranch: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
-  expectedCommitSha: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1)))
+var AgentRuntimeConstraint = Schema.Struct({
+  key: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  value: Schema.Unknown
 });
-var WorkUnitLeaseInput = Schema2.Struct({
-  leaseOwnerId: Id,
-  runnerReplicaId: Id,
-  leaseId: Id,
-  attempt: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1)),
-  fencingToken: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240), Schema2.isPattern(new RegExp("^[A-Za-z0-9._:-]+$", "u"))),
-  capacitySlot: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240))
+var AgentPermissionRequirement = Schema.Struct({
+  key: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  value: Schema.Unknown
 });
-var WorkUnitStatus = Schema2.Union([
-  Schema2.Literal("pending"),
-  Schema2.Literal("claimed"),
-  Schema2.Literal("running"),
-  Schema2.Literal("waiting"),
-  Schema2.Literal("blocked"),
-  Schema2.Literal("completed"),
-  Schema2.Literal("failed"),
-  Schema2.Literal("canceled"),
-  Schema2.Literal("expired")
-]);
-var LoopCheckout = Schema2.Union([Schema2.Literal("none"), Schema2.Literal("read"), Schema2.Literal("write")]);
-var StorageOrigin = Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(2048)));
-var AgentStepWorkUnit = Schema2.Struct({
-  kind: Schema2.Literal("agent_step"),
-  id: Id,
-  teamId: Schema2.optionalKey(Id),
-  runId: Id,
-  stepKey: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  attempt: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1)),
-  lease: WorkUnitLease,
-  brief: StepBrief,
-  stepCredential: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(512)),
-  checkout: LoopCheckout,
-  repoBinding: Schema2.optionalKey(WorkUnitRepoBinding),
-  branch: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
-  baseRevision: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
-  network: Schema2.optionalKey(AgentSandboxNetwork),
-  sandbox: Schema2.optionalKey(Schema2.Literal("docker")),
-  secrets: Schema2.optionalKey(Schema2.Record(Schema2.String, Schema2.String)),
-  runBaseRevision: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1))),
-  storageOrigin: StorageOrigin
+var AgentHookRequirement = Schema.Struct({
+  name: Schema.String.check(Schema.isMinLength(1)),
+  event: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  command: Schema.String.check(Schema.isMinLength(1)),
+  args: Schema.optionalKey(Schema.Array(Schema.String)),
+  timeoutMs: Schema.optionalKey(Schema.Finite.check(Schema.isGreaterThanOrEqualTo(1)))
 });
-var RunJournal = Schema2.Struct({
-  activities: Schema2.Record(Schema2.String, Schema2.Unknown),
-  deferreds: Schema2.Record(Schema2.String, Schema2.Unknown)
+var AgentSandboxPolicyRequirement = Schema.Struct({
+  key: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  value: Schema.Unknown
 });
-var OrchestrationWorkUnit = Schema2.Struct({
-  kind: Schema2.Literal("orchestration"),
-  id: Id,
-  teamId: Schema2.optionalKey(Id),
-  runId: Id,
-  loopDigest: Schema2.String.check(Schema2.isMinLength(64), Schema2.isMaxLength(64), Schema2.isPattern(new RegExp("^[a-f0-9]{64}$", "u"))),
-  input: Schema2.Unknown,
-  granted: Schema2.Array(Schema2.String),
-  lease: WorkUnitLease,
-  journal: RunJournal,
-  network: Schema2.optionalKey(AgentSandboxNetwork),
-  storageOrigin: StorageOrigin,
-  program: Schema2.Struct({
-    loopId: Schema2.String.check(Schema2.isMinLength(1)),
-    credential: Schema2.String.check(Schema2.isMinLength(1))
-  })
+var AgentEnvironmentFragment = Schema.Struct({
+  skills: Schema.optionalKey(Schema.Array(AgentSkillRequirement)),
+  plugins: Schema.optionalKey(Schema.Array(AgentPluginRequirement)),
+  mcpServers: Schema.optionalKey(Schema.Array(AgentMcpServerRequirement)),
+  harnessSettings: Schema.optionalKey(Schema.Array(AgentHarnessSetting)),
+  providerAuthRefs: Schema.optionalKey(Schema.Array(ProviderAuthRef)),
+  runnerSecretRefs: Schema.optionalKey(Schema.Array(RunnerSecretRef)),
+  permissions: Schema.optionalKey(Schema.Array(AgentPermissionRequirement)),
+  hooks: Schema.optionalKey(Schema.Array(AgentHookRequirement)),
+  runtimeConstraints: Schema.optionalKey(Schema.Array(AgentRuntimeConstraint)),
+  sandboxPolicyRequirements: Schema.optionalKey(Schema.Array(AgentSandboxPolicyRequirement))
 });
-var ProgramWorkUnit = OrchestrationWorkUnit.mapFields(Struct3.omit(["program"]));
-var ApprovedCheck = Schema2.Struct({
-  name: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(120), Schema2.isPattern(new RegExp("^[A-Za-z0-9][A-Za-z0-9._:-]*$", "u"))),
-  command: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(2000)),
-  workingDirectory: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(500)))
+var AgentModelPreference = Schema.Struct({
+  harness: AgentHarnessId,
+  profileRef: Schema.String.check(Schema.isMinLength(1)),
+  provider: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1))),
+  model: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
 });
-var VerificationWorkUnit = Schema2.Struct({
-  kind: Schema2.Literal("verification"),
-  id: Id,
-  teamId: Schema2.optionalKey(Id),
-  runId: Id,
-  stepKey: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  lease: WorkUnitLease,
-  repoBinding: WorkUnitRepoBinding,
-  revision: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  checks: Schema2.Array(ApprovedCheck).check(Schema2.isMinLength(1), Schema2.isMaxLength(50)),
-  storageOrigin: StorageOrigin
+var UserAgentPreferences = Schema.Struct({
+  userId: Schema.optionalKey(Id),
+  defaultHarness: Schema.optionalKey(AgentHarnessId),
+  modelPreferences: Schema.optionalKey(Schema.Array(AgentModelPreference))
+});
+var AgentKitSourceFields = {
+  kitRef: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(240))),
+  kitVersion: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(120))),
+  kitSha256: Schema.optionalKey(Schema.String.check(Schema.isMinLength(64), Schema.isMaxLength(64), Schema.isPattern(new RegExp("^[a-fA-F0-9]{64}$", "u")))),
+  kitActivationId: Schema.optionalKey(Id),
+  kitActivationType: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(80)))
+};
+var AgentEnvironmentSource = Schema.Union([
+  Schema.Struct({
+    kind: Schema.Literal("built_in"),
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("user_preferences"),
+    userId: Id,
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("user_kit"),
+    userId: Id,
+    kitId: Id,
+    ...AgentKitSourceFields,
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("agent_sync_profile"),
+    profileId: Schema.optionalKey(Id),
+    userId: Id,
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("device_local"),
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("workspace_kit"),
+    kitId: Id,
+    ...AgentKitSourceFields,
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("team_default_kit"),
+    teamId: Id,
+    kitId: Id,
+    ...AgentKitSourceFields,
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("team_kit"),
+    kitId: Id,
+    ...AgentKitSourceFields,
+    provenance: Schema.optionalKey(Schema.Union([
+      Schema.Literal("explicit"),
+      Schema.Literal("workspace_default"),
+      Schema.Literal("workspace_mandatory")
+    ])),
+    policyRevision: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThanOrEqualTo(1))),
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("marketplace_kit"),
+    kitSourceId: Id,
+    kitVersionId: Schema.optionalKey(Id),
+    kitInstallationId: Schema.optionalKey(Id),
+    kitActivationId: Schema.optionalKey(Id),
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("step_attempt_override"),
+    stepAttemptId: Id,
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("command_override"),
+    label: Schema.optionalKey(Schema.String.check(Schema.isMinLength(1)))
+  })
+]);
+var ResolvedAgentSkillRequirement = Schema.Struct({
+  item: AgentSkillRequirement,
+  source: AgentEnvironmentSource
 });
-var WorkUnit = Schema2.Union([OrchestrationWorkUnit, AgentStepWorkUnit, VerificationWorkUnit]);
-var WorkUnitClaimResult = Schema2.Struct({ workUnit: Schema2.optionalKey(WorkUnit) });
-var WorkUnitClaimInput = Schema2.Struct({
-  teamId: Schema2.optionalKey(Id),
-  runnerReplicaId: Id,
-  capacitySlot: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  idempotencyKey: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  leaseDurationSeconds: Schema2.optionalKey(Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1), Schema2.isLessThanOrEqualTo(3600)))
+var ResolvedAgentPluginRequirement = Schema.Struct({
+  item: AgentPluginRequirement,
+  source: AgentEnvironmentSource
 });
-var WorkUnitHeartbeatInput = Schema2.Struct({
-  workUnitId: Id,
-  lease: WorkUnitLeaseInput,
-  leaseDurationSeconds: Schema2.optionalKey(Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1), Schema2.isLessThanOrEqualTo(3600)))
+var ResolvedAgentMcpServerRequirement = Schema.Struct({
+  item: AgentMcpServerRequirement,
+  source: AgentEnvironmentSource
 });
-var WorkUnitHeartbeatResult = Schema2.Struct({
-  settled: Schema2.Boolean,
-  outputSubmitted: Schema2.optionalKey(Schema2.Boolean)
+var ResolvedAgentHarnessSetting = Schema.Struct({ item: AgentHarnessSetting, source: AgentEnvironmentSource });
+var ResolvedProviderAuthRef = Schema.Struct({ item: ProviderAuthRef, source: AgentEnvironmentSource });
+var ResolvedRunnerSecretRef = Schema.Struct({ item: RunnerSecretRef, source: AgentEnvironmentSource });
+var ResolvedAgentPermissionRequirement = Schema.Struct({
+  item: AgentPermissionRequirement,
+  source: AgentEnvironmentSource
 });
-var WorkUnitReleaseInput = Schema2.Struct({
-  workUnitId: Id,
-  lease: WorkUnitLeaseInput
+var ResolvedAgentHookRequirement = Schema.Struct({ item: AgentHookRequirement, source: AgentEnvironmentSource });
+var ResolvedAgentRuntimeConstraint = Schema.Struct({
+  item: AgentRuntimeConstraint,
+  source: AgentEnvironmentSource
 });
-var CheckEvidence = Schema2.Struct({
-  name: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(120)),
-  command: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(2000)),
-  status: Schema2.Union([Schema2.Literal("passed"), Schema2.Literal("failed")]),
-  exitCode: Schema2.optionalKey(Schema2.Int),
-  durationMs: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(0)),
-  outputTail: Schema2.String.check(Schema2.isMaxLength(8000)),
-  fileIds: Schema2.optionalKey(Schema2.Array(Schema2.String).check(Schema2.isMaxLength(51)))
+var ResolvedAgentSandboxPolicyRequirement = Schema.Struct({
+  item: AgentSandboxPolicyRequirement,
+  source: AgentEnvironmentSource
 });
-var TreeEvidence = Schema2.Struct({
-  revision: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  tree: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(120)),
-  checks: Schema2.Array(CheckEvidence).check(Schema2.isMaxLength(50))
+var AgentEnvironment = Schema.Struct({
+  harness: AgentHarnessId,
+  skills: Schema.Array(ResolvedAgentSkillRequirement),
+  plugins: Schema.Array(ResolvedAgentPluginRequirement),
+  mcpServers: Schema.Array(ResolvedAgentMcpServerRequirement),
+  harnessSettings: Schema.Array(ResolvedAgentHarnessSetting),
+  providerAuthRefs: Schema.Array(ResolvedProviderAuthRef),
+  runnerSecretRefs: Schema.Array(ResolvedRunnerSecretRef),
+  permissions: Schema.Array(ResolvedAgentPermissionRequirement),
+  hooks: Schema.Array(ResolvedAgentHookRequirement),
+  runtimeConstraints: Schema.Array(ResolvedAgentRuntimeConstraint),
+  sandboxPolicyRequirements: Schema.Array(ResolvedAgentSandboxPolicyRequirement),
+  warnings: Schema.Array(Schema.String)
 });
-var VerificationEvidence = Schema2.Struct({ head: TreeEvidence, baseline: Schema2.optionalKey(TreeEvidence) });
-var BoundaryChange = Schema2.Struct({
-  kind: Schema2.Literal("change"),
-  changedPaths: Schema2.Array(Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(4096))).check(Schema2.isMaxLength(1000)),
-  omittedPaths: Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(0)),
-  files: Schema2.Array(Schema2.Struct({
-    path: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(4096)),
-    excerpt: Schema2.String.check(Schema2.isMaxLength(250000)),
-    redacted: Schema2.Boolean,
-    truncated: Schema2.Boolean
-  })).check(Schema2.isMaxLength(20)),
-  truncated: Schema2.Boolean
+var KitMarketplaceAgentEnvironmentSyncStates = ["ready", "needs_sync", "blocked"];
+var KitMarketplaceAgentEnvironmentEffectKinds = [
+  "skill",
+  "plugin",
+  "mcp_server",
+  "harness_setting",
+  "provider_auth_ref",
+  "runner_secret_ref",
+  "permission",
+  "hook",
+  "runtime_constraint",
+  "sandbox_policy_requirement"
+];
+var KitMarketplaceAgentEnvironmentMaterializerRequirements = [
+  "config_writer",
+  "provider_auth",
+  "runner_secret",
+  "bun",
+  "sandbox_policy"
+];
+var KitMarketplaceAgentEnvironmentEffect = Schema.Struct({
+  kind: Schema.Literals(KitMarketplaceAgentEnvironmentEffectKinds),
+  name: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  source: AgentEnvironmentSource,
+  materializerRequirements: Schema.Array(Schema.Literals(KitMarketplaceAgentEnvironmentMaterializerRequirements))
 });
-var WorkUnitOutcome = Schema2.Struct({
-  status: Schema2.Union([
-    Schema2.Literal("completed"),
-    Schema2.Literal("failed"),
-    Schema2.Literal("blocked"),
-    Schema2.Literal("canceled")
-  ]),
-  result: Schema2.optionalKey(LoopStepOutput),
-  revision: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(120))),
-  evidence: Schema2.optionalKey(VerificationEvidence),
-  boundary: Schema2.optionalKey(BoundaryChange),
-  failureSummary: Schema2.optionalKey(Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(4000)))
+var KitMarketplaceAgentEnvironmentSyncPreview = Schema.Struct({
+  state: Schema.Literals(KitMarketplaceAgentEnvironmentSyncStates),
+  agentEnvironment: AgentEnvironment,
+  effects: Schema.Array(KitMarketplaceAgentEnvironmentEffect),
+  blockers: Schema.Array(Schema.String),
+  drift: Schema.Array(Schema.String)
+});
+var AgentEnvironmentSyncPlanStatuses = ["ready", "needs_apply", "blocked"];
+var AgentEnvironmentSyncPlanItemKinds = [
+  "skill",
+  "plugin",
+  "mcp_server",
+  "harness_setting",
+  "provider_auth_ref",
+  "runner_secret_ref",
+  "permission",
+  "hook",
+  "runtime_constraint",
+  "sandbox_policy_requirement"
+];
+var AgentEnvironmentSyncPlanApplyModes = ["automatic", "manual", "verify_only"];
+var AgentEnvironmentSyncPlanItem = Schema.Struct({
+  kind: Schema.Literals(AgentEnvironmentSyncPlanItemKinds),
+  name: Schema.String.check(Schema.isMinLength(1)),
+  policy: AgentEnvironmentPolicy,
+  source: AgentEnvironmentSource,
+  materializerRequirements: Schema.Array(Schema.Literals(KitMarketplaceAgentEnvironmentMaterializerRequirements)),
+  applyMode: Schema.Literals(AgentEnvironmentSyncPlanApplyModes)
 });
-var WorkUnitCompletion = Schema2.Struct({
-  workUnitId: Id,
-  lease: WorkUnitLeaseInput,
-  idempotencyKey: Schema2.String.check(Schema2.isMinLength(1), Schema2.isMaxLength(240)),
-  outcome: WorkUnitOutcome
+var AgentEnvironmentSyncPlan = Schema.Struct({
+  status: Schema.Literals(AgentEnvironmentSyncPlanStatuses),
+  targetHarness: AgentHarnessId,
+  agentEnvironment: AgentEnvironment,
+  items: Schema.Array(AgentEnvironmentSyncPlanItem),
+  blockers: Schema.Array(Schema.String),
+  drift: Schema.Array(Schema.String)
 });
 // packages/core/src/run-file.ts
-import * as Schema4 from "effect/Schema";
+import * as Schema3 from "effect/Schema";
 
 // packages/core/src/storage.ts
-import * as Schema3 from "effect/Schema";
+import * as Schema2 from "effect/Schema";
 var units = ["B", "KiB", "MiB", "GiB", "TiB"];
 var formatBytes = (bytes) => {
   const exponent = Math.min(units.length - 1, Math.floor(Math.log(Math.max(bytes, 1)) / Math.log(1024)));
@@ -289,16 +412,16 @@ var storageLimitWords = {
   run: (filesPerRun) => `${filesPerRun} files per Run`
 };
 var maxRunFileRetentionDays = 3650;
-var RunFileRetentionDays = Schema3.NullOr(Schema3.Int.check(Schema3.isGreaterThanOrEqualTo(1), Schema3.isLessThanOrEqualTo(maxRunFileRetentionDays)));
-var WorkspaceStorageSettings = Schema3.Struct({
-  usedBytes: Schema3.Int,
-  quotaBytes: Schema3.Int,
-  byPurpose: Schema3.Struct({ runFile: Schema3.Int, taskAsset: Schema3.Int, checkpoint: Schema3.Int }),
-  limits: Schema3.Struct({ fileBytes: Schema3.Int, filesPerRun: Schema3.Int }),
+var RunFileRetentionDays = Schema2.NullOr(Schema2.Int.check(Schema2.isGreaterThanOrEqualTo(1), Schema2.isLessThanOrEqualTo(maxRunFileRetentionDays)));
+var WorkspaceStorageSettings = Schema2.Struct({
+  usedBytes: Schema2.Int,
+  quotaBytes: Schema2.Int,
+  byPurpose: Schema2.Struct({ runFile: Schema2.Int, taskAsset: Schema2.Int, checkpoint: Schema2.Int }),
+  limits: Schema2.Struct({ fileBytes: Schema2.Int, filesPerRun: Schema2.Int }),
   runFileRetentionDays: RunFileRetentionDays
 });
-var WorkspaceStorageUpdate = Schema3.Struct({ runFileRetentionDays: RunFileRetentionDays });
-var WorkspaceStorageSaved = Schema3.Struct({ ...WorkspaceStorageSettings.fields, willExpire: Schema3.Int });
+var WorkspaceStorageUpdate = Schema2.Struct({ runFileRetentionDays: RunFileRetentionDays });
+var WorkspaceStorageSaved = Schema2.Struct({ ...WorkspaceStorageSettings.fields, willExpire: Schema2.Int });
 
 // packages/core/src/run-file.ts
 var RunFileRefusalReasons = ["type", "too_large", "too_many", "quota", "name_taken"];
@@ -317,10 +440,10 @@ var runFileRefusalWords = (refusal) => {
   }
 };
 
-class RunFileRefused extends Schema4.TaggedError()("RunFileRefused", {
-  reason: Schema4.Literals(RunFileRefusalReasons),
-  limit: Schema4.optionalKey(Schema4.Int),
-  actual: Schema4.optionalKey(Schema4.Int)
+class RunFileRefused extends Schema3.TaggedError()("RunFileRefused", {
+  reason: Schema3.Literals(RunFileRefusalReasons),
+  limit: Schema3.optionalKey(Schema3.Int),
+  actual: Schema3.optionalKey(Schema3.Int)
 }) {
   get message() {
     return runFileRefusalWords(this);
@@ -356,72 +479,72 @@ var RunFileStatuses = [
   "removed",
   "expired"
 ];
-var RunFileRecord = Schema4.Struct({
-  id: Schema4.String,
-  runId: Schema4.String,
-  step: Schema4.String,
-  name: Schema4.String,
-  caption: Schema4.optionalKey(Schema4.String),
-  contentType: Schema4.String,
-  kind: Schema4.Literals(RunFileKinds),
-  byteSize: Schema4.Int,
-  sha256: Schema4.String,
-  status: Schema4.Literals(RunFileStatuses)
+var RunFileRecord = Schema3.Struct({
+  id: Schema3.String,
+  runId: Schema3.String,
+  step: Schema3.String,
+  name: Schema3.String,
+  caption: Schema3.optionalKey(Schema3.String),
+  contentType: Schema3.String,
+  kind: Schema3.Literals(RunFileKinds),
+  byteSize: Schema3.Int,
+  sha256: Schema3.String,
+  status: Schema3.Literals(RunFileStatuses)
 });
 var RunFileMakers = ["program", "agent", "check"];
-var RunFileView = Schema4.Struct({
-  id: Schema4.String,
-  runId: Schema4.String,
-  step: Schema4.String,
-  stepAttemptId: Schema4.optionalKey(Schema4.String),
-  verificationId: Schema4.optionalKey(Schema4.String),
-  madeBy: Schema4.Literals(RunFileMakers),
-  name: Schema4.String,
-  caption: Schema4.optionalKey(Schema4.String),
-  kind: Schema4.Literals(RunFileKinds),
-  contentType: Schema4.String,
-  byteSize: Schema4.Int,
-  sha256: Schema4.String,
-  status: Schema4.Literals(RunFileStatuses),
-  reason: Schema4.optionalKey(Schema4.String),
-  limit: Schema4.optionalKey(Schema4.Int),
-  actual: Schema4.optionalKey(Schema4.Int),
-  removedBy: Schema4.optionalKey(Schema4.String),
-  removedAt: Schema4.optionalKey(Timestamp),
+var RunFileView = Schema3.Struct({
+  id: Schema3.String,
+  runId: Schema3.String,
+  step: Schema3.String,
+  stepAttemptId: Schema3.optionalKey(Schema3.String),
+  verificationId: Schema3.optionalKey(Schema3.String),
+  madeBy: Schema3.Literals(RunFileMakers),
+  name: Schema3.String,
+  caption: Schema3.optionalKey(Schema3.String),
+  kind: Schema3.Literals(RunFileKinds),
+  contentType: Schema3.String,
+  byteSize: Schema3.Int,
+  sha256: Schema3.String,
+  status: Schema3.Literals(RunFileStatuses),
+  reason: Schema3.optionalKey(Schema3.String),
+  limit: Schema3.optionalKey(Schema3.Int),
+  actual: Schema3.optionalKey(Schema3.Int),
+  removedBy: Schema3.optionalKey(Schema3.String),
+  removedAt: Schema3.optionalKey(Timestamp),
   createdAt: Timestamp
 });
-var RunFileList = Schema4.Union([
-  Schema4.Struct({ files: Schema4.Array(RunFileView) }),
-  Schema4.Struct({ count: Schema4.Int })
+var RunFileList = Schema3.Union([
+  Schema3.Struct({ files: Schema3.Array(RunFileView) }),
+  Schema3.Struct({ count: Schema3.Int })
 ]);
-var RunFileUrlsRequest = Schema4.Struct({
-  ids: Schema4.Array(Id).check(Schema4.isMinLength(1), Schema4.isMaxLength(200)),
-  use: Schema4.Literals(["view", "download"])
+var RunFileUrlsRequest = Schema3.Struct({
+  ids: Schema3.Array(Id).check(Schema3.isMinLength(1), Schema3.isMaxLength(200)),
+  use: Schema3.Literals(["view", "download"])
 });
-var RunFileRemoveRequest = Schema4.Struct({
-  note: Schema4.optionalKey(Schema4.String.check(Schema4.isMaxLength(500)))
+var RunFileRemoveRequest = Schema3.Struct({
+  note: Schema3.optionalKey(Schema3.String.check(Schema3.isMaxLength(500)))
 });
-var RunFileUrl = Schema4.Struct({ id: Schema4.String, url: Schema4.String, expiresAt: Timestamp });
-var RunFileUrls = Schema4.Struct({ urls: Schema4.Array(RunFileUrl) });
+var RunFileUrl = Schema3.Struct({ id: Schema3.String, url: Schema3.String, expiresAt: Timestamp });
+var RunFileUrls = Schema3.Struct({ urls: Schema3.Array(RunFileUrl) });
 var PresignedRequest = {
-  url: Schema4.String,
-  headers: Schema4.optionalKey(Schema4.Record(Schema4.String, Schema4.String)),
-  expiresAt: Schema4.String
+  url: Schema3.String,
+  headers: Schema3.optionalKey(Schema3.Record(Schema3.String, Schema3.String)),
+  expiresAt: Schema3.String
 };
-var RunFilePartUrl = Schema4.Struct({ partNumber: Schema4.Int, ...PresignedRequest });
-var RunFileUpload = Schema4.Union([
-  Schema4.Struct({ kind: Schema4.Literal("single"), ...PresignedRequest }),
-  Schema4.Struct({ kind: Schema4.Literal("multipart"), partSize: Schema4.Int, parts: Schema4.Array(RunFilePartUrl) })
+var RunFilePartUrl = Schema3.Struct({ partNumber: Schema3.Int, ...PresignedRequest });
+var RunFileUpload = Schema3.Union([
+  Schema3.Struct({ kind: Schema3.Literal("single"), ...PresignedRequest }),
+  Schema3.Struct({ kind: Schema3.Literal("multipart"), partSize: Schema3.Int, parts: Schema3.Array(RunFilePartUrl) })
 ]);
-var UploadedRunFilePart = Schema4.Struct({ partNumber: Schema4.Int, etag: Schema4.String });
-var StepRunFileRequest = Schema4.Struct({
-  name: Schema4.String.check(Schema4.isMinLength(1), Schema4.isMaxLength(255)),
-  caption: Schema4.optionalKey(Schema4.String.check(Schema4.isMaxLength(1000))),
-  contentType: Schema4.String.check(Schema4.isMinLength(1), Schema4.isMaxLength(255)),
-  byteSize: Schema4.Int.check(Schema4.isGreaterThanOrEqualTo(0)),
-  sha256: Schema4.String.check(Schema4.isPattern(/^[0-9a-f]{64}$/))
+var UploadedRunFilePart = Schema3.Struct({ partNumber: Schema3.Int, etag: Schema3.String });
+var StepRunFileRequest = Schema3.Struct({
+  name: Schema3.String.check(Schema3.isMinLength(1), Schema3.isMaxLength(255)),
+  caption: Schema3.optionalKey(Schema3.String.check(Schema3.isMaxLength(1000))),
+  contentType: Schema3.String.check(Schema3.isMinLength(1), Schema3.isMaxLength(255)),
+  byteSize: Schema3.Int.check(Schema3.isGreaterThanOrEqualTo(0)),
+  sha256: Schema3.String.check(Schema3.isPattern(/^[0-9a-f]{64}$/))
 });
-var RunFileSlotted = Schema4.Struct({ file: RunFileRecord, upload: Schema4.optionalKey(RunFileUpload) });
+var RunFileSlotted = Schema3.Struct({ file: RunFileRecord, upload: Schema3.optionalKey(RunFileUpload) });
 // packages/core/src/crypto.ts
 import { createHash, createHmac, createSign, randomBytes, timingSafeEqual } from "crypto";
 function digestSha256(data, encoding) {
@@ -430,6 +553,12 @@ function digestSha256(data, encoding) {
     hash.update(part);
   return hash.digest(encoding);
 }
+function digestSha512(data, encoding) {
+  return createHash("sha512").update(data).digest(encoding);
+}
+function digestWith(algorithm, data, encoding) {
+  return createHash(algorithm).update(data).digest(encoding);
+}
 function sha256Hasher() {
   const hash = createHash("sha256");
   return {
@@ -440,97 +569,115 @@ function sha256Hasher() {
   };
 }
 // packages/core/src/transcript.ts
-import * as Schema5 from "effect/Schema";
-var Text = Schema5.String.check(Schema5.isMaxLength(200000));
-var AgentEvent = Schema5.Union([
-  Schema5.Struct({ kind: Schema5.Literal("message"), role: Schema5.Literals(["assistant", "user"]), text: Text }),
-  Schema5.Struct({
-    kind: Schema5.Literal("tool_call"),
-    callId: Schema5.String,
-    name: Schema5.String.check(Schema5.isMinLength(1), Schema5.isMaxLength(240)),
-    arguments: Schema5.Json
+import * as Schema4 from "effect/Schema";
+var Text = Schema4.String.check(Schema4.isMaxLength(200000));
+var AgentEvent = Schema4.Union([
+  Schema4.Struct({ kind: Schema4.Literal("message"), role: Schema4.Literals(["assistant", "user"]), text: Text }),
+  Schema4.Struct({
+    kind: Schema4.Literal("tool_call"),
+    callId: Schema4.String,
+    name: Schema4.String.check(Schema4.isMinLength(1), Schema4.isMaxLength(240)),
+    arguments: Schema4.Json
   }),
-  Schema5.Struct({
-    kind: Schema5.Literal("tool_result"),
-    callId: Schema5.String,
+  Schema4.Struct({
+    kind: Schema4.Literal("tool_result"),
+    callId: Schema4.String,
     output: Text,
-    isError: Schema5.optionalKey(Schema5.Boolean)
+    isError: Schema4.optionalKey(Schema4.Boolean)
   }),
-  Schema5.Struct({
-    kind: Schema5.Literal("file"),
-    path: Schema5.String.check(Schema5.isMinLength(1), Schema5.isMaxLength(4096)),
-    change: Schema5.Literals(["read", "changed"])
+  Schema4.Struct({
+    kind: Schema4.Literal("file"),
+    path: Schema4.String.check(Schema4.isMinLength(1), Schema4.isMaxLength(4096)),
+    change: Schema4.Literals(["read", "changed"])
   }),
-  Schema5.Struct({ kind: Schema5.Literal("question"), text: Text }),
-  Schema5.Struct({
-    kind: Schema5.Literal("answer"),
-    callId: Schema5.optionalKey(Schema5.String),
-    questionId: Schema5.optionalKey(Schema5.String),
+  Schema4.Struct({ kind: Schema4.Literal("question"), text: Text }),
+  Schema4.Struct({
+    kind: Schema4.Literal("answer"),
+    callId: Schema4.optionalKey(Schema4.String),
+    questionId: Schema4.optionalKey(Schema4.String),
     text: Text
   }),
-  Schema5.Struct({ kind: Schema5.Literal("steer"), messageId: Id, text: Text }),
-  Schema5.Struct({
-    kind: Schema5.Literal("lifecycle"),
-    state: Schema5.Literals(["started", "resumed", "finished", "failed", "canceled"])
+  Schema4.Struct({ kind: Schema4.Literal("steer"), messageId: Id, text: Text }),
+  Schema4.Struct({
+    kind: Schema4.Literal("secret_refused"),
+    reference: Schema4.optionalKey(Schema4.String.check(Schema4.isMinLength(1), Schema4.isMaxLength(300))),
+    host: Schema4.String.check(Schema4.isMaxLength(300)),
+    reason: Schema4.String.check(Schema4.isMaxLength(500))
+  }),
+  Schema4.Struct({
+    kind: Schema4.Literal("lifecycle"),
+    state: Schema4.Literals(["started", "resumed", "parked", "finished", "failed", "canceled"])
   })
 ]);
-var TranscriptAppendEntry = Schema5.Struct({
-  sequence: Schema5.Int.check(Schema5.isGreaterThanOrEqualTo(1)),
+var TranscriptAppendEntry = Schema4.Struct({
+  sequence: Schema4.Int.check(Schema4.isGreaterThanOrEqualTo(1)),
   event: AgentEvent
 });
-var TranscriptEntry = Schema5.Struct({
+var TranscriptEntry = Schema4.Struct({
   stepAttemptId: Id,
-  sequence: Schema5.Int.check(Schema5.isGreaterThanOrEqualTo(1)),
+  sequence: Schema4.Int.check(Schema4.isGreaterThanOrEqualTo(1)),
   event: AgentEvent,
   createdAt: Timestamp
 });
-var TranscriptPage = Schema5.Struct({
-  items: Schema5.Array(TranscriptEntry),
-  next: Schema5.optionalKey(Schema5.Int),
-  previous: Schema5.optionalKey(Schema5.Int)
+var TranscriptPage = Schema4.Struct({
+  items: Schema4.Array(TranscriptEntry),
+  next: Schema4.optionalKey(Schema4.Int),
+  previous: Schema4.optionalKey(Schema4.Int)
 });
-var TranscriptRetention = Schema5.Struct({
-  days: Schema5.NullOr(Schema5.Int.check(Schema5.isGreaterThanOrEqualTo(1)))
+var TranscriptRetention = Schema4.Struct({
+  days: Schema4.NullOr(Schema4.Int.check(Schema4.isGreaterThanOrEqualTo(1)))
 });
 var MaxTranscriptSearchLimit = 50;
-var TranscriptSearchQuery = Schema5.Struct({
-  q: Schema5.String.check(Schema5.isMinLength(1), Schema5.isMaxLength(200)),
-  limit: Schema5.optionalKey(Numeric.check(isWholeNumber, Schema5.isGreaterThanOrEqualTo(1), Schema5.isLessThanOrEqualTo(MaxTranscriptSearchLimit)))
+var TranscriptSearchQuery = Schema4.Struct({
+  q: Schema4.String.check(Schema4.isMinLength(1), Schema4.isMaxLength(200)),
+  limit: Schema4.optionalKey(Numeric.check(isWholeNumber, Schema4.isGreaterThanOrEqualTo(1), Schema4.isLessThanOrEqualTo(MaxTranscriptSearchLimit)))
 });
-var TranscriptSearchHit = Schema5.Struct({
+var TranscriptSearchHit = Schema4.Struct({
   runId: Id,
-  loop: Schema5.String,
-  task: Schema5.optionalKey(Schema5.Struct({ id: Id, key: Schema5.String, title: Schema5.String })),
+  loop: Schema4.String,
+  task: Schema4.optionalKey(Schema4.Struct({ id: Id, key: Schema4.String, title: Schema4.String })),
   stepAttemptId: Id,
-  node: Schema5.optionalKey(Schema5.String),
-  step: Schema5.String,
-  attempt: Schema5.Int,
-  agent: Schema5.optionalKey(Schema5.String),
+  node: Schema4.optionalKey(Schema4.String),
+  step: Schema4.String,
+  attempt: Schema4.Int,
+  agent: Schema4.optionalKey(Schema4.String),
   ranAt: Timestamp,
-  sequence: Schema5.Int,
-  matches: Schema5.Int,
-  excerpt: Schema5.String
+  sequence: Schema4.Int,
+  matches: Schema4.Int,
+  excerpt: Schema4.String
 });
-var TranscriptSearchResult = Schema5.Struct({
-  items: Schema5.Array(TranscriptSearchHit),
-  total: Schema5.Int
+var TranscriptSearchResult = Schema4.Struct({
+  items: Schema4.Array(TranscriptSearchHit),
+  total: Schema4.Int
 });
 // packages/core/src/run-journal.ts
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
-import * as Schema6 from "effect/Schema";
+import * as Schema5 from "effect/Schema";
 var journalEntryMaxBytes = 256 * 1024;
-var JournalExit = Schema6.toCodecJson(Schema6.Exit(Schema6.Json, Schema6.Json, Schema6.Defect()));
-var encodeJournalExit = (exit) => Schema6.encodeUnknownEffect(JournalExit)(Exit.map(exit, (value) => value ?? null));
-var decodeJournalExit = Schema6.decodeUnknownEffect(JournalExit);
-var JournalStepFailed = Schema6.TaggedStruct("StepFailed", { step: Schema6.String, reason: Schema6.String });
-var JournalChildFailed = Schema6.TaggedStruct("ChildFailed", {
-  step: Schema6.String,
-  loop: Schema6.String,
-  reason: Schema6.String
+var JournalExit = Schema5.toCodecJson(Schema5.Exit(Schema5.Json, Schema5.Json, Schema5.Defect()));
+var encodeJournalExit = (exit) => Schema5.encodeUnknownEffect(JournalExit)(Exit.map(exit, (value) => value ?? null));
+var decodeJournalExit = Schema5.decodeUnknownEffect(JournalExit);
+var JournalStepFailed = Schema5.TaggedStruct("StepFailed", { step: Schema5.String, reason: Schema5.String });
+var JournalChildFailed = Schema5.TaggedStruct("ChildFailed", {
+  step: Schema5.String,
+  loop: Schema5.String,
+  reason: Schema5.String
 });
-var JournalWaitTimedOut = Schema6.TaggedStruct("WaitTimedOut", { step: Schema6.String, event: Schema6.String });
+var JournalWaitTimedOut = Schema5.TaggedStruct("WaitTimedOut", { step: Schema5.String, event: Schema5.String });
 var journalEntryBytes = (entry) => new TextEncoder().encode(JSON.stringify(entry)).byteLength;
+// packages/core/src/kit-setup.ts
+import * as Schema6 from "effect/Schema";
+var KitSetup = Schema6.Struct({
+  ...AgentEnvironmentFragment.fields,
+  instructions: Schema6.optionalKey(Schema6.String.check(Schema6.isMinLength(1)))
+});
+var SetupFile = Schema6.Union([
+  Schema6.Struct({ utf8: Schema6.String }),
+  Schema6.Struct({ base64: Schema6.String })
+]);
+var SetupArchive = Schema6.Struct({ setup: KitSetup, files: Schema6.Record(Schema6.String, SetupFile) });
+var kitmanMcpServer = "kitman";
 // packages/sdk/src/program/engine.ts
 import * as Cause from "effect/Cause";
 import * as Clock from "effect/Clock";
@@ -544,6 +691,7 @@ import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import { isPlatformError } from "effect/PlatformError";
 import * as Schema8 from "effect/Schema";
+import * as SchemaIssue from "effect/SchemaIssue";
 import * as Stream from "effect/Stream";
 import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientRequest from "effect/http/HttpClientRequest";
@@ -553,7 +701,7 @@ import * as HttpClientResponse from "effect/http/HttpClientResponse";
 import * as Schema7 from "effect/Schema";
 import { Rpc, RpcGroup, RpcMiddleware } from "effect/rpc";
 var RunnerHeaders = { runnerId: "x-kitman-runner-id", protocolVersion: "x-kitman-rpc-protocol" };
-var RunnerRpcProtocolVersion = 4;
+var RunnerRpcProtocolVersion = 5;
 
 class RunnerRpcError extends Schema7.TaggedError()("RunnerRpcError", {
   code: Schema7.String,
@@ -688,6 +836,10 @@ class RunnerReplicaRpcs extends RpcGroup.make(Rpc.make("Claim", {
   payload: { stepAttemptIds: Schema7.Array(Schema7.String) },
   success: Schema7.Void,
   error: RunnerRpcError
+}), Rpc.make("GitCredential", {
+  payload: { repoBindingId: Schema7.String },
+  success: Schema7.UndefinedOr(Schema7.Struct({ username: Schema7.String, password: Schema7.String })),
+  error: RunnerRpcError
 }), Rpc.make("Bundle", {
   payload: { digest: Schema7.String },
   success: Schema7.Struct({ bundle: Schema7.String }),
@@ -721,7 +873,13 @@ class RunnerCapabilityRpcs extends RpcGroup.make(Rpc.make("PutQuestion", {
     step: Schema7.String,
     prompt: Schema7.String,
     options: Schema7.optional(Schema7.Array(Schema7.String)),
+    optionDescriptions: Schema7.optional(Schema7.Record(Schema7.String, Schema7.String)),
+    recommended: Schema7.optional(Schema7.String),
+    recommendationReason: Schema7.optional(Schema7.String),
+    informationOnly: Schema7.optional(Schema7.Boolean),
     verification: Schema7.optional(SuggestedVerification),
+    default: Schema7.optional(Schema7.String),
+    timeoutMillis: Schema7.optional(Schema7.Finite),
     deferredName: Schema7.String
   },
   success: Schema7.Struct({ questionId: Schema7.String }),
@@ -734,8 +892,11 @@ class RunnerCapabilityRpcs extends RpcGroup.make(Rpc.make("PutQuestion", {
     role: Schema7.String,
     agentId: Schema7.String,
     prompt: Schema7.String,
+    skill: Schema7.optionalKey(Schema7.String.check(Schema7.isMinLength(1))),
     outputSchema: Schema7.Json,
-    secrets: Schema7.optionalKey(Schema7.Array(Schema7.String))
+    secrets: Schema7.optionalKey(Schema7.Array(Schema7.String)),
+    timeoutMillis: Schema7.optionalKey(Schema7.Int),
+    mergeTarget: Schema7.optionalKey(Schema7.String.check(Schema7.isMinLength(1)))
   },
   success: Schema7.Struct({ stepAttemptId: Schema7.String }),
   error: RunnerRpcError
@@ -745,7 +906,14 @@ class RunnerCapabilityRpcs extends RpcGroup.make(Rpc.make("PutQuestion", {
     step: Schema7.String,
     deferredName: Schema7.String,
     revision: Schema7.optionalKey(Schema7.String),
-    checks: Schema7.optional(Schema7.Array(Schema7.String))
+    checks: Schema7.optional(Schema7.Array(Schema7.String)),
+    suggested: Schema7.optionalKey(Schema7.Array(ApprovedCheck)),
+    measure: Schema7.optionalKey(Schema7.Struct({
+      base: Schema7.optionalKey(Schema7.String),
+      plan: MeasurePlan2,
+      samples: Schema7.Int,
+      calibrate: Schema7.Boolean
+    }))
   },
   success: Schema7.Struct({ verificationId: Schema7.String }),
   error: RunnerRpcError
@@ -756,7 +924,22 @@ class RunnerCapabilityRpcs extends RpcGroup.make(Rpc.make("PutQuestion", {
     deferredName: Schema7.String,
     event: Schema7.String,
     filter: Schema7.optional(Schema7.Record(Schema7.String, Schema7.Union([EventFilterValue, Schema7.Array(EventFilterValue)]))),
-    timeoutMillis: Schema7.Int
+    timeoutMillis: Schema7.Int,
+    since: Schema7.optionalKey(Schema7.String),
+    or: Schema7.optionalKey(Schema7.Array(Schema7.Struct({
+      event: Schema7.String,
+      filter: Schema7.optionalKey(Schema7.Record(Schema7.String, Schema7.Union([EventFilterValue, Schema7.Array(EventFilterValue)]))),
+      since: Schema7.optionalKey(Schema7.String)
+    })))
+  },
+  error: RunnerRpcError
+}), Rpc.make("ClaimResource", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema7.String,
+    deferredName: Schema7.String,
+    resource: ResourceName,
+    action: Schema7.Literals(["claim", "take_over", "let_go"])
   },
   error: RunnerRpcError
 }), Rpc.make("AdmitChild", {
@@ -794,7 +977,14 @@ class RunnerCapabilityRpcs extends RpcGroup.make(Rpc.make("PutQuestion", {
     lease: ProgramLease,
     step: Schema7.String,
     effect: Schema7.Union([
-      Schema7.Struct({ kind: Schema7.Literal("post_comment"), changeRequestId: Schema7.String, body: Schema7.String }),
+      Schema7.Struct({
+        kind: Schema7.Literal("post_comment"),
+        changeRequestId: Schema7.String,
+        body: Schema7.String,
+        threadId: Schema7.optionalKey(Schema7.String),
+        summary: Schema7.optionalKey(Schema7.String),
+        anchors: Schema7.optionalKey(Schema7.Array(Schema7.Struct({ file: Schema7.String, line: Schema7.Int, body: Schema7.String })))
+      }),
       Schema7.Struct({
         kind: Schema7.Literal("change_request"),
         title: Schema7.String,
@@ -810,14 +1000,33 @@ class RunnerCapabilityRpcs extends RpcGroup.make(Rpc.make("PutQuestion", {
   },
   success: Schema7.UndefinedOr(Schema7.Struct({ id: Schema7.String, number: Schema7.String, url: Schema7.String })),
   error: RunnerRpcError
+}), Rpc.make("AlertTask", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema7.String,
+    fingerprint: Schema7.String,
+    title: Schema7.String,
+    windowHours: Schema7.Int,
+    resolved: Schema7.optionalKey(Schema7.Boolean),
+    priority: Schema7.optionalKey(Schema7.Literals(["urgent", "high", "medium", "low"]))
+  },
+  success: Schema7.Struct({
+    taskId: Schema7.optionalKey(Schema7.String),
+    created: Schema7.Boolean,
+    resolved: Schema7.optionalKey(Schema7.Boolean),
+    joined: Schema7.optionalKey(Schema7.Struct({ kind: Schema7.Literals(["run", "recent"]), runId: Schema7.String }))
+  }),
+  error: RunnerRpcError
 }), Rpc.make("ReadTranscripts", {
   payload: { lease: ProgramLease, step: Schema7.String, days: Schema7.Int },
   success: Schema7.Struct({
     runs: Schema7.Array(Schema7.Struct({
       runId: Schema7.String,
       loopId: Schema7.String,
+      status: Schema7.optionalKey(Schema7.Literals(["completed", "failed", "canceled", "expired"])),
       teamId: Schema7.optionalKey(Schema7.String),
       failure: Schema7.optionalKey(Schema7.String),
+      retried: Schema7.optionalKey(Schema7.Boolean),
       entries: Schema7.Array(Schema7.Struct({
         stepAttemptId: Schema7.String,
         sequence: Schema7.Int,
@@ -827,6 +1036,65 @@ class RunnerCapabilityRpcs extends RpcGroup.make(Rpc.make("PutQuestion", {
     }))
   }),
   error: RunnerRpcError
+}), Rpc.make("PipelineStatus", {
+  payload: { lease: ProgramLease, step: Schema7.String, changeRequestId: Schema7.String },
+  success: Schema7.Struct({
+    head: Schema7.String,
+    status: Schema7.Literals(["none", "running", "success", "failed", "canceled"]),
+    source: Schema7.Literals(["forge", "reported"]),
+    jobs: Schema7.Array(Schema7.Struct({
+      name: Schema7.String,
+      status: Schema7.Literals(["running", "success", "failed", "skipped"]),
+      url: Schema7.optionalKey(Schema7.String),
+      logTail: Schema7.optionalKey(Schema7.String)
+    })),
+    readAt: Schema7.optionalKey(Schema7.String),
+    runnerChecks: Schema7.optionalKey(Schema7.Array(Schema7.String))
+  }),
+  error: RunnerRpcError
+}), Rpc.make("ReportPipeline", {
+  payload: { lease: ProgramLease, step: Schema7.String, changeRequestId: Schema7.String, verification: Schema7.String },
+  success: Schema7.Struct({ head: Schema7.String, status: Schema7.Literals(["success", "failed"]) }),
+  error: RunnerRpcError
+}), Rpc.make("ReviewThreads", {
+  payload: { lease: ProgramLease, step: Schema7.String, changeRequestId: Schema7.String },
+  success: Schema7.Struct({
+    threads: Schema7.Array(Schema7.Struct({
+      id: Schema7.String,
+      path: Schema7.optionalKey(Schema7.String),
+      line: Schema7.optionalKey(Schema7.Int),
+      outdated: Schema7.optionalKey(Schema7.Boolean),
+      comments: Schema7.Array(Schema7.Struct({ author: Schema7.optionalKey(Schema7.String), body: Schema7.String }))
+    }))
+  }),
+  error: RunnerRpcError
+}), Rpc.make("OpenChangeRequests", {
+  payload: { lease: ProgramLease, step: Schema7.String, authors: Schema7.NonEmptyArray(Schema7.String) },
+  success: Schema7.Struct({
+    changeRequests: Schema7.Array(Schema7.Struct({
+      number: Schema7.String,
+      title: Schema7.String,
+      body: Schema7.String,
+      url: Schema7.String,
+      author: Schema7.String,
+      sourceBranch: Schema7.String,
+      head: Schema7.String
+    }))
+  }),
+  error: RunnerRpcError
+}), Rpc.make("OwnChangeRequests", {
+  payload: { lease: ProgramLease, step: Schema7.String },
+  success: Schema7.Struct({
+    changeRequests: Schema7.Array(Schema7.Struct({
+      id: Schema7.String,
+      number: Schema7.String,
+      url: Schema7.String,
+      title: Schema7.String,
+      sourceBranch: Schema7.String,
+      body: Schema7.String
+    }))
+  }),
+  error: RunnerRpcError
 }), Rpc.make("Propose", {
   payload: {
     lease: ProgramLease,
@@ -843,11 +1111,16 @@ class RunnerCapabilityRpcs extends RpcGroup.make(Rpc.make("PutQuestion", {
         title: Schema7.String,
         description: Schema7.String,
         teamId: Schema7.optionalKey(Schema7.String),
+        key: Schema7.optionalKey(Schema7.String),
         citations: Schema7.NonEmptyArray(Schema7.Struct({ runId: Schema7.String, stepAttemptId: Schema7.String, sequence: Schema7.Int }))
       })
     ])
   },
-  success: Schema7.Struct({ kind: Schema7.Literals(["memory", "task"]), id: Schema7.String }),
+  success: Schema7.Struct({
+    kind: Schema7.Literals(["memory", "task"]),
+    id: Schema7.String,
+    matched: Schema7.optionalKey(Schema7.Boolean)
+  }),
   error: RunnerRpcError
 }), Rpc.make("ReadProject", {
   payload: { lease: ProgramLease, step: Schema7.String, projectId: Schema7.String },
@@ -890,13 +1163,14 @@ class RunnerCapabilityRpcs extends RpcGroup.make(Rpc.make("PutQuestion", {
 }), Rpc.make("CreatePlanTasks", {
   payload: {
     lease: ProgramLease,
+    projectId: Schema7.optionalKey(Schema7.String),
     tickets: Schema7.Array(Schema7.Struct({
       key: Schema7.String,
       title: Schema7.String,
       body: Schema7.String,
       acceptanceCriteria: Schema7.Array(Schema7.String),
       blockedBy: Schema7.Array(Schema7.String),
-      outcome: Schema7.optionalKey(Schema7.Literals(["feature", "bug", "refactor", "investigation", "docs", "migration"]))
+      outcome: Schema7.optionalKey(Schema7.Literals(["feature", "bug", "refactor", "investigation", "docs", "migration", "performance"]))
     }))
   },
   success: Schema7.Array(Schema7.Struct({ key: Schema7.String, taskId: Schema7.String })),
@@ -906,12 +1180,53 @@ class RunnerCapabilityRpcs extends RpcGroup.make(Rpc.make("PutQuestion", {
   success: Schema7.Struct({ repoBindingId: Schema7.String, branch: Schema7.String, revision: Schema7.String }),
   error: RunnerRpcError
 }), Rpc.make("MergeChangeRequest", {
-  payload: { lease: ProgramLease, step: Schema7.String, changeRequestId: Schema7.String },
+  payload: {
+    lease: ProgramLease,
+    step: Schema7.String,
+    changeRequestId: Schema7.String,
+    head: Schema7.optionalKey(Schema7.String)
+  },
   success: Schema7.Union([
     Schema7.Struct({ status: Schema7.Literal("merged"), revision: Schema7.String }),
-    Schema7.Struct({ status: Schema7.Literal("conflict") })
+    Schema7.Struct({ status: Schema7.Literal("conflict") }),
+    Schema7.Struct({ status: Schema7.Literal("moved"), head: Schema7.String })
+  ]),
+  error: RunnerRpcError
+}), Rpc.make("ApproveChangeRequest", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema7.String,
+    changeRequestId: Schema7.String,
+    head: Schema7.String,
+    summary: Schema7.String,
+    review: Schema7.optionalKey(Schema7.String),
+    carries: Schema7.optionalKey(Schema7.String)
+  },
+  success: Schema7.Union([
+    Schema7.Struct({ approved: Schema7.Literal(true), reviewId: Schema7.String }),
+    Schema7.Struct({ approved: Schema7.Literal(false), reason: Schema7.String })
   ]),
   error: RunnerRpcError
+}), Rpc.make("CloseChangeRequest", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema7.String,
+    number: Schema7.String,
+    head: Schema7.String,
+    note: Schema7.String
+  },
+  success: Schema7.Struct({ closed: Schema7.Boolean, head: Schema7.optionalKey(Schema7.String) }),
+  error: RunnerRpcError
+}), Rpc.make("RerunPipeline", {
+  payload: {
+    lease: ProgramLease,
+    step: Schema7.String,
+    changeRequestId: Schema7.optionalKey(Schema7.String),
+    ref: Schema7.optionalKey(Schema7.String),
+    all: Schema7.optionalKey(Schema7.Boolean)
+  },
+  success: Schema7.Struct({ head: Schema7.String, pipelines: Schema7.Int }),
+  error: RunnerRpcError
 }), Rpc.make("PublishRelease", {
   payload: {
     lease: ProgramLease,
@@ -1055,6 +1370,8 @@ var emptyWorkflow = Workflow.make("kitman-loop/none", { payload: {}, idempotency
 var replayStatuses = new Set([401, 403, 409, 429]);
 var isRunnerRpcError = Schema8.is(RunnerRpcError);
 var isRunFileRefused = Schema8.is(RunFileRefused);
+var issues = SchemaIssue.makeFormatterStandardSchemaV1();
+var refusedFields = (issue) => [...new Set(issues(issue).issues.map(({ path }) => (path ?? []).map(String).join(".")))].join(", ");
 var refusedStep2 = (cause) => {
   if (isRunFileRefused(cause))
     return true;
@@ -1062,42 +1379,61 @@ var refusedStep2 = (cause) => {
     return true;
   return isRunnerRpcError(cause) && cause.status >= 400 && cause.status < 500 && !replayStatuses.has(cause.status);
 };
-var requested = (step, request) => request.pipe(Effect2.catch((cause) => refusedStep2(cause) ? Effect2.fail(new StepFailed2({ step, reason: cause.message })) : Effect2.die(new JournalWriteFailed2({ cause }))));
+var requested2 = (step, request) => request.pipe(Effect2.catch((cause) => refusedStep2(cause) ? Effect2.fail(new StepFailed2({ step, reason: cause.message })) : Effect2.die(new JournalWriteFailed2({ cause }))), Effect2.catchDefect((defect) => defect instanceof Error && SchemaIssue.isIssue(defect.cause) ? Effect2.fail(new StepFailed2({
+  step,
+  reason: `Kitman cannot take this Step's request: invalid ${refusedFields(defect.cause)}`
+})) : Effect2.die(defect)));
 var runnerHost = (capabilities) => ({
-  putQuestion: (launch) => requested(launch.step, capabilities.putQuestion({
+  putQuestion: (launch) => requested2(launch.step, capabilities.putQuestion({
     step: launch.step,
     prompt: launch.prompt,
     deferredName: answerDeferred2(launch.step).name,
+    ...questionAdvice(launch),
     ...launch.options === undefined ? undefined : { options: launch.options },
-    ...launch.verification === undefined ? undefined : { verification: launch.verification }
+    ...launch.verification === undefined ? undefined : { verification: launch.verification },
+    ...launch.default === undefined ? undefined : { default: launch.default },
+    ...launch.timeoutMillis === undefined ? undefined : { timeoutMillis: launch.timeoutMillis }
   })).pipe(Effect2.asVoid),
-  startVerification: (launch) => requested(launch.step, capabilities.startVerification({
+  startVerification: (launch) => requested2(launch.step, capabilities.startVerification({
     step: launch.step,
-    deferredName: verifyDeferred2(launch.step).name,
+    deferredName: (launch.measure === undefined ? verifyDeferred2 : measureDeferred2)(launch.step).name,
     ...launch.revision === undefined ? undefined : { revision: launch.revision },
-    ...launch.checks === undefined ? undefined : { checks: launch.checks }
+    ...launch.checks === undefined ? undefined : { checks: launch.checks },
+    ...launch.suggested === undefined ? undefined : { suggested: launch.suggested },
+    ...launch.measure === undefined ? undefined : { measure: launch.measure }
   })).pipe(Effect2.asVoid),
-  startAgentWork: (launch) => requested(launch.step, capabilities.startAgentStep({
+  startAgentWork: (launch) => requested2(launch.step, capabilities.startAgentStep({
     step: launch.step,
-    deferredName: agentWorkDeferred2(launch.step).name,
+    deferredName: launch.deferredName,
     role: launch.role,
     agentId: launch.agent,
     prompt: launch.prompt,
+    ...launch.skill === undefined ? undefined : { skill: launch.skill },
     outputSchema: launch.output,
-    ...launch.secrets === undefined ? undefined : { secrets: launch.secrets }
+    ...launch.secrets === undefined ? undefined : { secrets: launch.secrets },
+    ...launch.timeoutMillis === undefined ? undefined : { timeoutMillis: launch.timeoutMillis },
+    ...launch.mergeTarget === undefined ? undefined : { mergeTarget: launch.mergeTarget }
   })).pipe(Effect2.asVoid),
-  admitChild: (launch) => requested(launch.step, capabilities.admitChild({
+  admitChild: (launch) => requested2(launch.step, capabilities.admitChild({
     step: launch.step,
     loop: launch.loop,
     input: launch.input,
     deferredName: childDeferred2(launch.step).name
   })).pipe(Effect2.asVoid),
-  awaitEvent: (launch) => requested(launch.step, capabilities.awaitEvent({
+  claimResource: (launch) => requested2(launch.step, capabilities.claimResource({
+    step: launch.step,
+    deferredName: (launch.action === "let_go" ? letGoDeferred2 : claimDeferred2)(launch.step).name,
+    resource: launch.resource,
+    action: launch.action
+  })),
+  awaitEvent: (launch) => requested2(launch.step, capabilities.awaitEvent({
     step: launch.step,
     deferredName: eventDeferred2(launch.step).name,
     event: launch.event,
     ...launch.filter === undefined ? undefined : { filter: launch.filter },
-    timeoutMillis: launch.timeoutMillis
+    timeoutMillis: launch.timeoutMillis,
+    ...launch.since === undefined ? undefined : { since: launch.since },
+    ...launch.or === undefined ? undefined : { or: launch.or }
   }))
 });
 var put2 = (target, contentType, body) => Effect2.gen(function* () {
@@ -1134,7 +1470,7 @@ var uploadRunFile2 = (files, file) => Effect2.gen(function* () {
   return yield* upload.kind === "single" ? readRange(file.path, 0, byteSize).pipe(Effect2.flatMap((body) => put2(upload, contentType, body)), Effect2.andThen(files.completeRunFile({ fileId: slotted.id }))) : Effect2.flatMap(uploadParts(files, file.path, contentType, slotted.id, upload), (parts) => files.completeRunFile({ fileId: slotted.id, parts }));
 });
 var keepFile = (files, step, { path, caption }) => Effect2.gen(function* () {
-  const kept = yield* uploadRunFile2(files, { step, name: path.split("/").at(-1) ?? path, path, caption }).pipe(Effect2.catch((cause) => isPlatformError(cause) ? Effect2.fail(new StepFailed2({ step, reason: `Could not read ${path}: ${cause.message}` })) : requested(step, Effect2.fail(cause))));
+  const kept = yield* uploadRunFile2(files, { step, name: path.split("/").at(-1) ?? path, path, caption }).pipe(Effect2.catch((cause) => isPlatformError(cause) ? Effect2.fail(new StepFailed2({ step, reason: `Could not read ${path}: ${cause.message}` })) : requested2(step, Effect2.fail(cause))));
   if (kept.status !== "available")
     return yield* new StepFailed2({
       step,
@@ -1144,7 +1480,7 @@ var keepFile = (files, step, { path, caption }) => Effect2.gen(function* () {
 });
 var runnerActivities = (capabilities, services) => ({
   changeRequest: {
-    run: (request, step) => requested(step, capabilities.performHostEffect({
+    run: (request, step) => requested2(step, capabilities.performHostEffect({
       step,
       effect: {
         kind: "change_request",
@@ -1155,7 +1491,7 @@ var runnerActivities = (capabilities, services) => ({
     })).pipe(Effect2.filterOrFail((opened) => opened !== undefined, () => new StepFailed2({ step, reason: "Kitman opened no ChangeRequest" })))
   },
   writeBack: {
-    run: (request, step) => requested(step, capabilities.performHostEffect({
+    run: (request, step) => requested2(step, capabilities.performHostEffect({
       step,
       effect: {
         kind: "write_back",
@@ -1165,32 +1501,43 @@ var runnerActivities = (capabilities, services) => ({
     })).pipe(Effect2.asVoid)
   },
   artifact: {
-    run: ({ files, ...request }, step) => requested(step, capabilities.storeArtifact({
+    run: ({ files, ...request }, step) => requested2(step, capabilities.storeArtifact({
       step,
       ...request,
       ...files === undefined ? undefined : { fileIds: files.map((shown) => shown.id) }
     }))
   },
   file: { run: (request, step) => keepFile(capabilities, step, request).pipe(Effect2.provideContext(services)) },
-  note: { run: (request, step) => requested(step, capabilities.recordNote({ step, ...request })) },
+  note: { run: (request, step) => requested2(step, capabilities.recordNote({ step, ...request })) },
   createTasks: {
-    run: (request, step) => requested(step, Effect2.map(capabilities.createPlanTasks(request.tickets), (tasks) => ({ tasks })))
+    run: (request, step) => requested2(step, Effect2.map(capabilities.createPlanTasks(request.tickets, request.projectId), (tasks) => ({ tasks })))
   },
+  alertTask: { run: (request, step) => requested2(step, capabilities.alertTask({ step, ...request })) },
   integrationBranch: {
-    run: (request, step) => requested(step, capabilities.integrationBranch(request.repoBindingId))
+    run: (request, step) => requested2(step, capabilities.integrationBranch(request.repoBindingId))
+  },
+  transcripts: { run: (request, step) => requested2(step, capabilities.readTranscripts({ step, ...request })) },
+  changeRequestRead: {
+    pipeline: (request, step) => requested2(step, capabilities.pipelineStatus({ step, ...request })),
+    reviewThreads: (request, step) => requested2(step, capabilities.reviewThreads({ step, ...request })),
+    opened: (request, step) => requested2(step, capabilities.openChangeRequests({ step, ...request })),
+    own: (step) => requested2(step, capabilities.ownChangeRequests({ step }))
   },
-  transcripts: { run: (request, step) => requested(step, capabilities.readTranscripts({ step, ...request })) },
-  propose: { run: (proposal, step) => requested(step, capabilities.propose({ step, proposal })) },
-  projectActivity: { run: (request, step) => requested(step, capabilities.readProject({ step, ...request })) },
-  draftUpdate: { run: (request, step) => requested(step, capabilities.draftUpdate({ step, ...request })) },
+  propose: { run: (proposal, step) => requested2(step, capabilities.propose({ step, proposal })) },
+  projectActivity: { run: (request, step) => requested2(step, capabilities.readProject({ step, ...request })) },
+  draftUpdate: { run: (request, step) => requested2(step, capabilities.draftUpdate({ step, ...request })) },
   mergeChangeRequest: {
-    run: (request, step) => requested(step, capabilities.mergeChangeRequest({ step, ...request }))
+    run: (request, step) => requested2(step, capabilities.mergeChangeRequest({ step, ...request })),
+    close: (request, step) => requested2(step, capabilities.closeChangeRequest({ step, ...request })),
+    rerun: (request, step) => requested2(step, capabilities.rerunPipeline({ step, ...request })),
+    report: (request, step) => requested2(step, capabilities.reportPipeline({ step, ...request })),
+    approve: (request, step) => requested2(step, capabilities.approveChangeRequest({ step, ...request }))
   },
   release: {
-    run: ({ revision, ...request }, step) => requested(step, capabilities.publishRelease({ step, ...request, ...revision === undefined ? undefined : { revision } }))
+    run: ({ revision, ...request }, step) => requested2(step, capabilities.publishRelease({ step, ...request, ...revision === undefined ? undefined : { revision } }))
   },
   comment: {
-    run: (request, step) => requested(step, capabilities.performHostEffect({ step, effect: { kind: "post_comment", ...request } })).pipe(Effect2.asVoid)
+    run: (request, step) => requested2(step, capabilities.performHostEffect({ step, effect: { kind: "post_comment", ...request } })).pipe(Effect2.asVoid)
   }
 });
 var describeFailure = (cause) => {
@@ -1206,7 +1553,7 @@ var runProgram2 = (loop, work, { journal, capabilities }) => Effect2.scoped(Effe
   const execute = executeLoop2(loop, {
     host: runnerHost(capabilities),
     activities: runnerActivities(capabilities, services),
-    granted: new Set(loop.capabilities.filter((capability) => work.granted.includes(capability)))
+    granted: new Set(capabilitiesOf2(loop).filter((capability) => work.granted.includes(capability)))
   });
   yield* Layer.build(workflow.toLayer(execute).pipe(Layer.provide(Layer.succeed(WorkflowEngine.WorkflowEngine)(engine))));
   const result = yield* encoded.execute(workflow, {
@@ -1262,25 +1609,32 @@ var rpcProgramPorts2 = (rpc, work) => {
       step: question.step,
       prompt: question.prompt,
       deferredName: question.deferredName,
+      ...questionAdvice(question),
       ...question.options === undefined ? undefined : { options: [...question.options] },
-      ...question.verification === undefined ? undefined : { verification: question.verification }
+      ...question.verification === undefined ? undefined : { verification: question.verification },
+      ...question.default === undefined ? undefined : { default: question.default },
+      ...question.timeoutMillis === undefined ? undefined : { timeoutMillis: question.timeoutMillis }
     }),
     startVerification: (verification) => rpc.startVerification({
       lease,
       step: verification.step,
       deferredName: verification.deferredName,
       ...verification.revision === undefined ? undefined : { revision: verification.revision },
-      ...verification.checks === undefined ? undefined : { checks: [...verification.checks] }
+      ...verification.checks === undefined ? undefined : { checks: [...verification.checks] },
+      ...verification.suggested === undefined ? undefined : { suggested: [...verification.suggested] },
+      ...verification.measure === undefined ? undefined : { measure: verification.measure }
     }),
     startAgentStep: ({ secrets, ...step }) => rpc.startAgentStep({ lease, ...step, ...secrets === undefined ? undefined : { secrets: [...secrets] } }),
     awaitEvent: (wait) => rpc.awaitEvent({ lease, ...wait }),
+    claimResource: (claim) => rpc.claimResource({ lease, ...claim }),
     admitChild: (child) => rpc.admitChild({ lease, ...child }),
     storeArtifact: ({ fileIds, ...artifact }) => rpc.storeArtifact({ lease, ...artifact, ...fileIds === undefined ? undefined : { fileIds: [...fileIds] } }),
     ...rpcRunFiles2(rpc, lease),
     recordNote: (note) => rpc.recordNote({ lease, ...note }),
     performHostEffect: (request) => rpc.performHostEffect({ lease, ...request }),
-    createPlanTasks: (tickets) => rpc.createPlanTasks({
+    createPlanTasks: (tickets, projectId) => rpc.createPlanTasks({
       lease,
+      ...projectId === undefined ? undefined : { projectId },
       tickets: tickets.map((ticket) => ({
         key: ticket.key,
         title: ticket.title,
@@ -1291,7 +1645,13 @@ var rpcProgramPorts2 = (rpc, work) => {
       }))
     }),
     integrationBranch: (repoBindingId) => rpc.integrationBranch({ lease, ...repoBindingId === undefined ? undefined : { repoBindingId } }),
+    alertTask: (request) => rpc.alertTask({ lease, ...request }),
     readTranscripts: (request) => rpc.readTranscripts({ lease, ...request }),
+    pipelineStatus: (request) => rpc.pipelineStatus({ lease, ...request }),
+    reportPipeline: (request) => rpc.reportPipeline({ lease, ...request }),
+    reviewThreads: (request) => rpc.reviewThreads({ lease, ...request }),
+    openChangeRequests: (request) => rpc.openChangeRequests({ lease, ...request }),
+    ownChangeRequests: (request) => rpc.ownChangeRequests({ lease, ...request }),
     propose: ({ step, proposal }) => rpc.propose({
       lease,
       step,
@@ -1300,6 +1660,7 @@ var rpcProgramPorts2 = (rpc, work) => {
         title: proposal.title,
         description: proposal.description,
         ...proposal.teamId === undefined ? undefined : { teamId: proposal.teamId },
+        ...proposal.key === undefined ? undefined : { key: proposal.key },
         citations: [...proposal.citations]
       }
     }),
@@ -1314,6 +1675,9 @@ var rpcProgramPorts2 = (rpc, work) => {
       }
     }),
     mergeChangeRequest: (request) => rpc.mergeChangeRequest({ lease, ...request }),
+    closeChangeRequest: (request) => rpc.closeChangeRequest({ lease, ...request }),
+    approveChangeRequest: (request) => rpc.approveChangeRequest({ lease, ...request }),
+    rerunPipeline: (request) => rpc.rerunPipeline({ lease, ...request }),
     publishRelease: (request) => rpc.publishRelease({ lease, ...request })
   };
   return { journal, capabilities };
@@ -1356,6 +1720,7 @@ var makeProgramRpcClient = (options) => Effect3.gen(function* () {
     startAgentStep: (input) => authorized(client.StartAgentStep(input)),
     startVerification: (input) => authorized(client.StartVerification(input)),
     awaitEvent: (input) => authorized(client.AwaitEvent(input)),
+    claimResource: (input) => authorized(client.ClaimResource(input)),
     admitChild: (input) => authorized(client.AdmitChild(input)),
     storeArtifact: (input) => authorized(client.StoreArtifact(input)),
     createRunFile: (input) => authorized(client.CreateRunFile(input)),
@@ -1364,12 +1729,21 @@ var makeProgramRpcClient = (options) => Effect3.gen(function* () {
     recordNote: (input) => authorized(client.RecordNote(input)),
     performHostEffect: (input) => authorized(client.PerformHostEffect(input)),
     createPlanTasks: (input) => authorized(client.CreatePlanTasks(input)),
+    alertTask: (input) => authorized(client.AlertTask(input)),
     readTranscripts: (input) => authorized(client.ReadTranscripts(input)),
+    pipelineStatus: (input) => authorized(client.PipelineStatus(input)),
+    reportPipeline: (input) => authorized(client.ReportPipeline(input)),
+    reviewThreads: (input) => authorized(client.ReviewThreads(input)),
+    openChangeRequests: (input) => authorized(client.OpenChangeRequests(input)),
+    ownChangeRequests: (input) => authorized(client.OwnChangeRequests(input)),
     propose: (input) => authorized(client.Propose(input)),
     readProject: (input) => authorized(client.ReadProject(input)),
     draftUpdate: (input) => authorized(client.DraftUpdate(input)),
     integrationBranch: (input) => authorized(client.IntegrationBranch(input)),
     mergeChangeRequest: (input) => authorized(client.MergeChangeRequest(input)),
+    closeChangeRequest: (input) => authorized(client.CloseChangeRequest(input)),
+    approveChangeRequest: (input) => authorized(client.ApproveChangeRequest(input)),
+    rerunPipeline: (input) => authorized(client.RerunPipeline(input)),
     publishRelease: (input) => authorized(client.PublishRelease(input))
   };
 });
@@ -1386,13 +1760,16 @@ import * as Redacted2 from "effect/Redacted";
 import * as Schema9 from "effect/Schema";
 import * as FetchHttpClient from "effect/http/FetchHttpClient";
 var describeFlag2 = "--kitman-describe";
+var DescribedKit = Schema9.Struct({
+  name: Schema9.String,
+  version: Schema9.String,
+  loops: Schema9.Array(LoopManifest),
+  agents: Schema9.Record(Schema9.String, Schema9.Json),
+  schedules: Schema9.optionalKey(Schema9.Record(Schema9.String, Schema9.Json)),
+  setup: Schema9.optionalKey(KitSetup)
+});
 var Described2 = Schema9.Union([
-  Schema9.TaggedStruct("Described", {
-    loops: Schema9.Array(LoopManifest),
-    agents: Schema9.Record(Schema9.String, Schema9.Json),
-    schedules: Schema9.optionalKey(Schema9.Record(Schema9.String, Schema9.Json)),
-    kits: Schema9.optionalKey(Schema9.Record(Schema9.String, Schema9.Json))
-  }),
+  Schema9.TaggedStruct("Described", { kits: Schema9.Array(DescribedKit) }),
   Schema9.TaggedStruct("Refused", { error: Schema9.Union([ManifestInvalid2, LoopCheckError2]) })
 ]);
 var encodeDescribed = Schema9.encodeEffect(Schema9.fromJsonString(Schema9.toCodecJson(Described2)));
@@ -1481,31 +1858,58 @@ var networkGuard2 = (input) => {
   });
   return { fetch, journal };
 };
-var describe = (config) => Effect4.gen(function* () {
-  const loops = yield* Effect4.forEach(config.loops, loopManifest2);
-  for (const loop of config.loops)
-    for (const check of loop.checks ?? [])
-      yield* checkLoop2(loop, check);
-  return {
-    _tag: "Described",
-    loops,
-    agents: config.agents ?? {},
-    ...config.schedules === undefined ? undefined : { schedules: config.schedules },
-    ...config.kits === undefined ? undefined : { kits: config.kits }
+var carriedKits2 = (config, identity, packages) => {
+  const identities = new Map(packages);
+  const carried = [];
+  const visited = new Set;
+  const visit = (kit) => {
+    if (visited.has(kit.config))
+      return;
+    visited.add(kit.config);
+    const index = carried.findIndex((known) => known.identity.name === kit.identity.name);
+    const known = carried[index];
+    if (known === undefined)
+      carried.push(kit);
+    else if (Bun.semver.order(kit.identity.version, known.identity.version) > 0)
+      carried[index] = kit;
+    for (const nested of kit.config.extends ?? []) {
+      const nestedIdentity = identities.get(nested);
+      if (nestedIdentity === undefined)
+        throw new Error(`${kit.identity.name} extends a Kit the build cannot name: import it from a package it depends on, or from a local module with its own package.json`);
+      visit({ identity: nestedIdentity, config: nested });
+    }
   };
+  visit({ identity, config });
+  return carried;
+};
+var describe = (carried) => Effect4.gen(function* () {
+  const kits = [];
+  for (const { identity, config } of carried) {
+    kits.push({
+      ...identity,
+      loops: yield* Effect4.forEach(config.loops, loopManifest2),
+      agents: config.agents ?? {},
+      ...config.schedules === undefined ? undefined : { schedules: config.schedules },
+      ...config.setup === undefined ? undefined : { setup: config.setup }
+    });
+    for (const loop of config.loops)
+      for (const check of loop.checks ?? [])
+        yield* checkLoop2(loop, check);
+  }
+  return { _tag: "Described", kits };
 }).pipe(Effect4.catch((error) => Effect4.succeed({ _tag: "Refused", error })), Effect4.flatMap(encodeDescribed), Effect4.flatMap((described) => Effect4.callback((resume) => void process.stdout.write(described, () => resume(Effect4.void)))), Effect4.as(0));
 var readStdin = Effect4.tryPromise(() => Bun.stdin.text());
 var isWorkUnit = guard(ProgramWorkUnit);
-var host = (config) => Effect4.gen(function* () {
+var host = (carried) => Effect4.gen(function* () {
   const loopId = yield* Config.String("KITMAN_LOOP_ID");
   const apiUrl = yield* Config.String("KITMAN_API_URL");
   const credential = yield* Config.Redacted("KITMAN_PROGRAM_CREDENTIAL");
   const work = yield* Schema9.decodeEffect(Schema9.fromJsonString(Schema9.Unknown))(yield* readStdin);
   if (!isWorkUnit(work))
     return yield* new ProgramRefused({ reason: "stdin holds no orchestration Work Unit" });
-  const loop = config.loops.find((candidate) => candidate.id === loopId);
+  const loop = carried.flatMap((kit) => kit.config.loops).find((candidate) => candidate.id === loopId);
   if (loop === undefined)
-    return yield* new ProgramRefused({ reason: `The Package declares no Loop "${loopId}"` });
+    return yield* new ProgramRefused({ reason: `The Kit carries no Loop "${loopId}"` });
   const hosts = yield* Config.option(Config.String(programHostsEnv2));
   const undeclared = yield* Config.option(Config.Literals(["fail", "warn"], undeclaredHostsEnv2));
   const proxy = yield* Config.option(Config.String("HTTPS_PROXY"));
@@ -1529,9 +1933,10 @@ var host = (config) => Effect4.gen(function* () {
   const ports = rpcProgramPorts2(rpc, work);
   return yield* runProgram2(loop, work, guard === undefined ? ports : { ...ports, journal: guard.journal(ports.journal) }).pipe(Effect4.provide(Layer3.merge(BunServices.layer, FetchHttpClient.layer)), Effect4.provideService(ConfigProvider.ConfigProvider, ConfigProvider.fromUnknown(secrets.value)), Effect4.as(0), Effect4.catchTag("JournalWriteFailed", (error) => Effect4.as(Effect4.logError(error.message), 1)));
 }).pipe(Effect4.scoped, Effect4.catch((error) => Effect4.as(Effect4.logError(error.message), 2)));
-var runPackage2 = (config) => {
-  const program = process.argv.includes(describeFlag2) ? describe(config) : host(config);
+var runKit2 = (config, identity, packages) => {
+  const carried = carriedKits2(config, identity, packages);
+  const program = process.argv.includes(describeFlag2) ? describe(carried) : host(carried);
   BunRuntime.runMain(program.pipe(Effect4.flatMap((code) => Effect4.sync(() => process.exit(code)))));
 };
 
-export { digestSha256, RunnerRpcProtocolVersion, JournalWriteFailed2, refusedStep2, uploadRunFile2, runProgram2, programLease2, rpcRunFiles2, rpcProgramPorts2, describeFlag2, Described2, programSecrets2, programHostsEnv2, undeclaredHostsEnv2, networkGuard2, runPackage2 };
+export { digestSha256, digestSha512, digestWith, kitmanMcpServer, RunnerRpcProtocolVersion, JournalWriteFailed2, refusedStep2, requested2, uploadRunFile2, runProgram2, programLease2, rpcRunFiles2, rpcProgramPorts2, describeFlag2, Described2, programSecrets2, programHostsEnv2, undeclaredHostsEnv2, networkGuard2, carriedKits2, runKit2 };