@kosuke-ai/cli 5.6.5 → 5.8.0

package/openapi.json

@@ -17,6 +17,9 @@
         "summary": "List Activity across every workspace you belong to, newest first: Changes Kosuke observed and what members did. Each event names its workspace. A browser session reads its active workspace only.",
         "tags": ["activity"],
         "x-kosuke-command": ["activity", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -144,6 +147,10 @@
         "summary": "List the repositories the Kosuke GitHub App can reach through your connection, all at once, with installUrl when there is no connection yet. With an API key this is always your own listing, never the staff one. 401 GITHUB_RECONNECT_REQUIRED when GitHub no longer accepts your connection.",
         "tags": ["github"],
         "x-kosuke-command": ["github", "repositories"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -184,6 +191,10 @@
         "summary": "Whether your GitHub connection exists, the account and date behind it, and reconnectRequired when GitHub no longer accepts it.",
         "tags": ["github"],
         "x-kosuke-command": ["github", "status"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -224,6 +235,9 @@
         "summary": "List chat sessions across every workspace you belong to, each with its workspace, project, URL and Needs You reason. q narrows them to titles containing it, ids to the sessions it names. With needsYou, at most 100, most severe first. A browser session reads its active workspace only.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "all"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -381,6 +395,10 @@
         "summary": "List your own Active and Under Review chat sessions in three groups, as the desktop menu bar shows them: needsYou (a Clarification waiting on you, or a Turn that finished or failed since you last read it), running, and recent. Each item names its project, the reason it is listed and the latest chat job. At most 50 per group, newest activity first; counts gives each group in full. With an API key or Connector Token this spans every workspace you belong to; a browser session sees only its active workspace.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "needs-you"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -418,10 +436,11 @@
     "/api/chat-sessions/search": {
       "get": {
         "operationId": "sessionsSearch",
-        "summary": "Search chat sessions by title. With an API key this spans every workspace you belong to; a browser session searches its active workspace; a sandbox or a Cron Run searches its own project.",
+        "summary": "Search chat sessions by title. With an API key this spans every workspace you belong to; a browser session searches its active workspace; an agent token searches its own workspace, or its own project when no member stands behind it.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "search"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
@@ -520,6 +539,9 @@
         "summary": "List the workspaces you belong to.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "responses": {
           "2XX": {
@@ -561,6 +583,10 @@
         "summary": "Read one workspace and your role in it.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -612,6 +638,10 @@
         "summary": "Read which providers you, or the workspace, can run.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "access-status"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -674,6 +704,10 @@
         "summary": "Read the workspace credentials and active auth method per provider. Secrets are masked.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "ai-provider", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -950,6 +984,10 @@
         "summary": "Read the session and weekly utilization of the workspace's Claude login. 400 when the workspace holds no Claude login or it needs reconnecting.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "ai-provider", "usage", "claude"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -1001,6 +1039,10 @@
         "summary": "Read the session and weekly utilization of the workspace's Codex login. 400 when the workspace holds no Codex login or it needs reconnecting.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "ai-provider", "usage", "codex"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -1052,6 +1094,10 @@
         "summary": "Read the session and weekly utilization of the workspace's GLM Coding Plan. 400 when the workspace holds no Coding Plan.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "ai-provider", "usage", "coding-plan"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -1103,6 +1149,9 @@
         "summary": "Search the Artifacts of a workspace by title, across its Chat Sessions and its Cron Runs. Rows only, each naming the session or run it was written in; read one with `sessions artifacts get` or `crons runs artifacts get`.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "artifacts"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -1165,6 +1214,9 @@
         "summary": "Read the credit balance and limit of a workspace.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "credits"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -1217,6 +1269,10 @@
         "summary": "List the workspace's crons, newest first, with each one's projects, creator and last run status. A cron fails as soon as the latest run of any of its projects failed.",
         "tags": ["crons"],
         "x-kosuke-command": ["crons", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -1323,6 +1379,10 @@
         "summary": "Create a cron, enabled, with you as its creator, in one or more of the workspace's projects: each fire runs the Cron Agent in every one of them at once. Every run spends the workspace's Credentials, never a member's Subscription, so a workspace with no usable provider is refused. The model is an encoded id such as anthropic:opus__xhigh; null or left out uses the saved Workspace Default Model when its Provider has usable workspace Credentials, otherwise Kosuke's choice among usable workspace Credentials at run time. The crontab may not fire more often than every 15 minutes.",
         "tags": ["crons"],
         "x-kosuke-command": ["crons", "create"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -1432,6 +1492,10 @@
         "summary": "Read one cron: its prompt, schedule, model, creator, when it runs next, and its projects, each with its last run status and whether five failed runs in a row paused it.",
         "tags": ["crons"],
         "x-kosuke-command": ["crons", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -1491,6 +1555,10 @@
         "summary": "Change a cron; only the fields sent change. projectIds replaces its projects. Any edit starts every project over: no project stays paused and every failure count goes back to zero. enabled=false pauses the cron and enabled=true resumes it; model=null goes back to the workspace default. The creator or a workspace admin only.",
         "tags": ["crons"],
         "x-kosuke-command": ["crons", "update"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -1666,12 +1734,136 @@
         }
       }
     },
+    "/api/organizations/{workspaceId}/crons/{cronId}/artifacts": {
+      "get": {
+        "operationId": "cronsArtifactsList",
+        "summary": "List the Artifacts a cron's runs published, across all of its runs, most recently changed first: each one's title, kind and version, with the run and the project it came from, and the total the filters keep. One row per Artifact: the same slug published by two runs is two rows. Rows only: a body or a file url comes from crons runs artifacts get, with the row's runId. The project and kind filters each take several values and keep an Artifact matching any of them.",
+        "tags": ["crons"],
+        "x-kosuke-command": ["crons", "artifacts", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
+        "parameters": [
+          {
+            "name": "workspaceId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          {
+            "name": "cronId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid",
+              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+            }
+          },
+          {
+            "name": "projectId",
+            "in": "query",
+            "required": false,
+            "description": "Only the Artifacts of runs in these projects.",
+            "schema": {
+              "description": "Only the Artifacts of runs in these projects.",
+              "x-kosuke-flag": "project",
+              "type": "array",
+              "items": {
+                "type": "string",
+                "format": "uuid",
+                "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+              }
+            }
+          },
+          {
+            "name": "kind",
+            "in": "query",
+            "required": false,
+            "description": "Only the Artifacts of these kinds.",
+            "schema": {
+              "description": "Only the Artifacts of these kinds.",
+              "x-kosuke-flag": "kind",
+              "type": "array",
+              "items": {
+                "type": "string",
+                "enum": ["markdown", "html", "image", "video"]
+              }
+            }
+          },
+          {
+            "name": "page",
+            "in": "query",
+            "required": false,
+            "description": "1-based. Default 1.",
+            "schema": {
+              "description": "1-based. Default 1.",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 9007199254740991
+            }
+          },
+          {
+            "name": "pageSize",
+            "in": "query",
+            "required": false,
+            "description": "Default 25. Values above 100 are clamped, not rejected.",
+            "schema": {
+              "description": "Default 25. Values above 100 are clamped, not rejected.",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 9007199254740991
+            }
+          }
+        ],
+        "responses": {
+          "2XX": {
+            "description": "Success envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiSuccess"
+                }
+              }
+            }
+          },
+          "4XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "5XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/organizations/{workspaceId}/crons/{cronId}/projects/{projectId}/resume": {
       "post": {
         "operationId": "cronsProjectsResume",
         "summary": "Resume one project that five failed runs in a row paused inside a cron: it takes part in the next fire and its failure count goes back to zero, while the cron's other projects keep their state. A cron that disabled itself because every project was paused is enabled again; one a member paused stays paused. The creator or a workspace admin only.",
         "tags": ["crons"],
         "x-kosuke-command": ["crons", "projects", "resume"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -1740,9 +1932,13 @@
     "/api/organizations/{workspaceId}/crons/{cronId}/run": {
       "post": {
         "operationId": "cronsRun",
-        "summary": "Fire a cron once now, paused or not, exactly as a scheduled fire: one Cron Run per project, each in that project's main sandbox on the workspace's Credentials, and the sessions they file are Kosuke's, not yours. Every project that five failed runs in a row did not pause, or only the projects named. Answers once the fire is queued; crons runs list shows how it went. The creator or a workspace admin only.",
+        "summary": "Fire a cron once now, paused or not, exactly as a scheduled fire: one Cron Run per project, each in that project's main sandbox on the workspace's Credentials, and the sessions they file are Kosuke's, not yours. Every project that five failed runs in a row did not pause, or only the projects named. Answers with runs, one { projectId, runId, status } per project: status is the run's status when the request answers, after waiting up to about ten seconds for the fire: running once the run was handed to the Cron Agent, failed or skipped when the fire refused it, succeeded, failed or cancelled when the run had already ended, and queued when the fire had not opened the run yet. crons runs get reads any of the run ids. The creator or a workspace admin only.",
         "tags": ["crons"],
         "x-kosuke-command": ["crons", "run"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -1826,6 +2022,10 @@
         "summary": "List a cron's runs, newest first: each one's project, status, the first line of its reply or its error, with the total and failed counts of the runs the filters keep. The project and status filters each take several values and keep a run matching any of them.",
         "tags": ["crons"],
         "x-kosuke-command": ["crons", "runs", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -1942,6 +2142,10 @@
         "summary": "Read one run of a cron: its project, its status, the model it ran on, the Cron Agent's reply, and the sessions it filed with each one's status and whether it waits for an answer.",
         "tags": ["crons"],
         "x-kosuke-command": ["crons", "runs", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -2013,6 +2217,9 @@
         "summary": "List the Artifacts a run of a cron published, most recently changed first. Rows only: a body or a file url comes from reading one.",
         "tags": ["crons"],
         "x-kosuke-command": ["crons", "runs", "artifacts", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -2085,6 +2292,9 @@
         "summary": "Read one Artifact of a run of a cron: a markdown or html one carries its body, an image or a video a presigned url, its media type and its size.",
         "tags": ["crons"],
         "x-kosuke-command": ["crons", "runs", "artifacts", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -2167,6 +2377,10 @@
         "summary": "Stop a run of a cron that is still going, the way Stop on its page does. The run ends cancelled; the Artifacts it stored and the sessions it filed stay, and the cron's runs in its other projects go on. The creator or a workspace admin only.",
         "tags": ["crons"],
         "x-kosuke-command": ["crons", "runs", "cancel"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -2232,12 +2446,12 @@
         }
       }
     },
-    "/api/organizations/{workspaceId}/crons/{cronId}/runs/{runId}/messages": {
+    "/api/organizations/{workspaceId}/crons/{cronId}/runs/{runId}/diagnostics": {
       "get": {
-        "operationId": "cronsRunsMessages",
-        "summary": "Read the Cron Agent's transcript of one run of a cron: the prompt it was given, then everything it did, with the run's status.",
+        "operationId": "cronsRunsDiagnostics",
+        "summary": "Read why a run of a cron ended as it did: its status, error, error code and stop source (member_stop, host_watch, deadline, replaced, sandbox_abort or runtime_error, with who stopped it), the main sandbox it ran in and that sandbox's agent version, when each phase happened (queued, main woken, credentials ready, agent requested, first event, done), the sandbox's own done payload, and the Cron Agent's log lines from the sandbox with secrets redacted. The log is capped at 256 KB and cleared after 30 days. The creator or a workspace admin only.",
         "tags": ["crons"],
-        "x-kosuke-command": ["crons", "runs", "messages"],
+        "x-kosuke-command": ["crons", "runs", "diagnostics"],
         "parameters": [
           {
             "name": "workspaceId",
@@ -2303,12 +2517,16 @@
         }
       }
     },
-    "/api/organizations/{workspaceId}/getting-started": {
+    "/api/organizations/{workspaceId}/crons/{cronId}/runs/{runId}/messages": {
       "get": {
-        "operationId": "workspacesGettingStartedGet",
-        "summary": "Read the getting-started guide and which milestones are done.",
-        "tags": ["workspaces"],
-        "x-kosuke-command": ["workspaces", "getting-started", "get"],
+        "operationId": "cronsRunsMessages",
+        "summary": "Read the Cron Agent's transcript of one run of a cron: the prompt it was given, then everything it did, with the run's status.",
+        "tags": ["crons"],
+        "x-kosuke-command": ["crons", "runs", "messages"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -2318,6 +2536,26 @@
               "type": "string",
               "minLength": 1
             }
+          },
+          {
+            "name": "cronId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid",
+              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+            }
+          },
+          {
+            "name": "runId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid",
+              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+            }
           }
         ],
         "responses": {
@@ -2352,15 +2590,74 @@
             }
           }
         }
-      },
-      "patch": {
-        "operationId": "workspacesGettingStartedUpdate",
-        "summary": "Dismiss the guide (empty body or action=dismiss) or record the preview milestone.",
+      }
+    },
+    "/api/organizations/{workspaceId}/getting-started": {
+      "get": {
+        "operationId": "workspacesGettingStartedGet",
+        "summary": "Read the getting-started guide and which milestones are done.",
         "tags": ["workspaces"],
-        "x-kosuke-command": ["workspaces", "getting-started", "update"],
-        "parameters": [
-          {
-            "name": "workspaceId",
+        "x-kosuke-command": ["workspaces", "getting-started", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
+        "parameters": [
+          {
+            "name": "workspaceId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        ],
+        "responses": {
+          "2XX": {
+            "description": "Success envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiSuccess"
+                }
+              }
+            }
+          },
+          "4XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "5XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      },
+      "patch": {
+        "operationId": "workspacesGettingStartedUpdate",
+        "summary": "Dismiss the guide (empty body or action=dismiss) or record the preview milestone.",
+        "tags": ["workspaces"],
+        "x-kosuke-command": ["workspaces", "getting-started", "update"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
+        "parameters": [
+          {
+            "name": "workspaceId",
             "in": "path",
             "required": true,
             "schema": {
@@ -2425,6 +2722,224 @@
         "summary": "Read the workspace Sentry integration: status, organization, requested scopes, who authorized it and whether remote cleanup is pending. Never a credential or a connected-account identifier.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "integrations", "sentry", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
+        "parameters": [
+          {
+            "name": "workspaceId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        ],
+        "responses": {
+          "2XX": {
+            "description": "Success envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiSuccess"
+                }
+              }
+            }
+          },
+          "4XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "5XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      },
+      "delete": {
+        "operationId": "workspacesIntegrationsSentryRemove",
+        "summary": "Disconnect Sentry: agents lose the workspace's access at once, then Kosuke deletes the stored authorization, retrying in the background if needed. Revoking the authorization inside Sentry is not part of this. Admins only.",
+        "tags": ["workspaces"],
+        "x-kosuke-command": ["workspaces", "integrations", "sentry", "remove"],
+        "parameters": [
+          {
+            "name": "workspaceId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        ],
+        "responses": {
+          "2XX": {
+            "description": "Success envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiSuccess"
+                }
+              }
+            }
+          },
+          "4XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "5XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/organizations/{workspaceId}/integrations/slack": {
+      "get": {
+        "operationId": "workspacesIntegrationsSlackGet",
+        "summary": "Read the workspace Slack integration: the connected Slack workspace, who authorized it and when. Never the bot token.",
+        "tags": ["workspaces"],
+        "x-kosuke-command": ["workspaces", "integrations", "slack", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
+        "parameters": [
+          {
+            "name": "workspaceId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        ],
+        "responses": {
+          "2XX": {
+            "description": "Success envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiSuccess"
+                }
+              }
+            }
+          },
+          "4XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "5XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/organizations/{workspaceId}/lead/cards": {
+      "get": {
+        "operationId": "workspacesLeadCards",
+        "summary": "List your open Lead Cards in a workspace, in the order the triager ranked them.",
+        "tags": ["workspaces"],
+        "x-kosuke-command": ["workspaces", "lead-cards"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
+        "parameters": [
+          {
+            "name": "workspaceId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        ],
+        "responses": {
+          "2XX": {
+            "description": "Success envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiSuccess"
+                }
+              }
+            }
+          },
+          "4XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "5XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/organizations/{workspaceId}/lead/notifications/{notificationId}/open": {
+      "post": {
+        "operationId": "workspacesLeadNotificationsOpen",
+        "summary": "Mark one of your Lead notifications as opened.",
+        "tags": ["workspaces"],
+        "x-kosuke-command": ["workspaces", "lead-notifications", "open"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -2434,6 +2949,16 @@
               "type": "string",
               "minLength": 1
             }
+          },
+          {
+            "name": "notificationId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid",
+              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+            }
           }
         ],
         "responses": {
@@ -2467,24 +2992,232 @@
               }
             }
           }
-        }
-      },
-      "delete": {
-        "operationId": "workspacesIntegrationsSentryRemove",
-        "summary": "Disconnect Sentry: agents lose the workspace's access at once, then Kosuke deletes the stored authorization, retrying in the background if needed. Revoking the authorization inside Sentry is not part of this. Admins only.",
-        "tags": ["workspaces"],
-        "x-kosuke-command": ["workspaces", "integrations", "sentry", "remove"],
-        "parameters": [
-          {
-            "name": "workspaceId",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string",
-              "minLength": 1
-            }
-          }
-        ],
+        }
+      }
+    },
+    "/api/organizations/{workspaceId}/lead/proposals": {
+      "post": {
+        "operationId": "workspacesLeadProposalsCreate",
+        "summary": "Open a Lead Card in your own Needs you that proposes one thing, with one line of why. kind start proposes starting a Backlog session, and is refused unless you are idle. kind delete_ticket (with evidence), merge_tickets (with sessionIds, mergedContent and the promptRevision sessions get gave for each ticket in revisions) and create_cron (with name, prompt, crontab, timezone and projectIds, and no sessionId) change nothing until you accept the card. Pass the body whole with --body.",
+        "tags": ["workspaces"],
+        "x-kosuke-command": ["workspaces", "lead-proposals", "create"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
+        "parameters": [
+          {
+            "name": "workspaceId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "kind": {
+                        "type": "string",
+                        "const": "start"
+                      },
+                      "projectId": {
+                        "type": "string",
+                        "format": "uuid",
+                        "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+                        "description": "The project the card is filed under."
+                      },
+                      "sessionId": {
+                        "type": "string",
+                        "format": "uuid",
+                        "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+                        "description": "A Backlog session of that project."
+                      },
+                      "why": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 300,
+                        "description": "One line: why the member should accept this."
+                      }
+                    },
+                    "required": ["kind", "projectId", "sessionId", "why"]
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "kind": {
+                        "type": "string",
+                        "const": "delete_ticket"
+                      },
+                      "projectId": {
+                        "type": "string",
+                        "format": "uuid",
+                        "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+                        "description": "The project the card is filed under."
+                      },
+                      "sessionId": {
+                        "type": "string",
+                        "format": "uuid",
+                        "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+                        "description": "A Backlog session of that project."
+                      },
+                      "why": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 300,
+                        "description": "One line: why the member should accept this."
+                      },
+                      "evidence": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 300,
+                        "description": "The pull request or session that already did the work."
+                      }
+                    },
+                    "required": ["kind", "projectId", "sessionId", "why", "evidence"]
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "kind": {
+                        "type": "string",
+                        "const": "merge_tickets"
+                      },
+                      "projectId": {
+                        "type": "string",
+                        "format": "uuid",
+                        "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+                        "description": "The project the card is filed under."
+                      },
+                      "sessionId": {
+                        "type": "string",
+                        "format": "uuid",
+                        "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+                        "description": "The Backlog ticket that is kept."
+                      },
+                      "why": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 300,
+                        "description": "One line: why the member should accept this."
+                      },
+                      "sessionIds": {
+                        "minItems": 1,
+                        "maxItems": 20,
+                        "type": "array",
+                        "items": {
+                          "type": "string",
+                          "format": "uuid",
+                          "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+                        },
+                        "description": "The other Backlog tickets of the same project, deleted on Accept."
+                      },
+                      "mergedContent": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 50000,
+                        "description": "The prompt the kept ticket holds after the merge."
+                      },
+                      "revisions": {
+                        "type": "object",
+                        "propertyNames": {
+                          "type": "string",
+                          "format": "uuid",
+                          "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+                        },
+                        "additionalProperties": {
+                          "type": "string",
+                          "pattern": "^[0-9a-f]{64}$"
+                        },
+                        "description": "The promptRevision `kosuke sessions get` gave for each ticket mergedContent was written from, the kept one included, keyed by session id."
+                      }
+                    },
+                    "required": [
+                      "kind",
+                      "projectId",
+                      "sessionId",
+                      "why",
+                      "sessionIds",
+                      "mergedContent",
+                      "revisions"
+                    ]
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "kind": {
+                        "type": "string",
+                        "const": "create_cron"
+                      },
+                      "projectId": {
+                        "type": "string",
+                        "format": "uuid",
+                        "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+                        "description": "The project the card is filed under."
+                      },
+                      "why": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 300,
+                        "description": "One line: why the member should accept this."
+                      },
+                      "name": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 100
+                      },
+                      "prompt": {
+                        "type": "string",
+                        "minLength": 1,
+                        "description": "What each run asks the Cron Agent to do, handed to it word for word."
+                      },
+                      "crontab": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 100,
+                        "description": "Five fields: minute, hour, day of month, month, day of week. At most one fire every 15 minutes."
+                      },
+                      "timezone": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 64,
+                        "description": "The IANA zone the crontab is read in, e.g. Europe/Zurich or UTC."
+                      },
+                      "projectIds": {
+                        "minItems": 1,
+                        "maxItems": 50,
+                        "type": "array",
+                        "items": {
+                          "type": "string",
+                          "format": "uuid",
+                          "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+                        }
+                      }
+                    },
+                    "required": [
+                      "kind",
+                      "projectId",
+                      "why",
+                      "name",
+                      "prompt",
+                      "crontab",
+                      "timezone",
+                      "projectIds"
+                    ]
+                  }
+                ]
+              }
+            }
+          }
+        },
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -2519,12 +3252,16 @@
         }
       }
     },
-    "/api/organizations/{workspaceId}/integrations/slack": {
-      "get": {
-        "operationId": "workspacesIntegrationsSlackGet",
-        "summary": "Read the workspace Slack integration: the connected Slack workspace, who authorized it and when. Never the bot token.",
+    "/api/organizations/{workspaceId}/lead/triage": {
+      "post": {
+        "operationId": "workspacesLeadTriage",
+        "summary": "Write the triage of your own open Lead Cards in a workspace: their order, one line of why per card, who reviews and merges a ready pull request, one notification, and the Welcome back sentence. Answers what was ranked, whether the notification went out, and every part it refused with the reason.",
         "tags": ["workspaces"],
-        "x-kosuke-command": ["workspaces", "integrations", "slack", "get"],
+        "x-kosuke-command": ["workspaces", "lead-triage"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -2536,6 +3273,128 @@
             }
           }
         ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "rank": {
+                    "description": "Open card ids, most urgent first. Cards left out keep their place behind these. A JSON array.",
+                    "maxItems": 200,
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "format": "uuid",
+                      "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+                    }
+                  },
+                  "whys": {
+                    "description": "One line of why per card, kept to 300 characters. A JSON array.",
+                    "maxItems": 200,
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "cardId": {
+                          "type": "string",
+                          "format": "uuid",
+                          "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+                        },
+                        "why": {
+                          "type": "string",
+                          "minLength": 1,
+                          "maxLength": 1000
+                        }
+                      },
+                      "required": ["cardId", "why"]
+                    }
+                  },
+                  "picks": {
+                    "description": "Who reviews and who merges the pull request of a To approve or Merge card. A JSON array.",
+                    "maxItems": 50,
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "cardId": {
+                          "type": "string",
+                          "format": "uuid",
+                          "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+                        },
+                        "reviewers": {
+                          "maxItems": 10,
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "id": {
+                                "type": "string",
+                                "minLength": 1,
+                                "description": "A member id from the candidates list."
+                              },
+                              "why": {
+                                "type": "string",
+                                "minLength": 1,
+                                "maxLength": 300
+                              }
+                            },
+                            "required": ["id", "why"]
+                          }
+                        },
+                        "merger": {
+                          "type": "object",
+                          "properties": {
+                            "id": {
+                              "type": "string",
+                              "minLength": 1,
+                              "description": "A member id from the candidates list."
+                            },
+                            "why": {
+                              "type": "string",
+                              "minLength": 1,
+                              "maxLength": 300
+                            }
+                          },
+                          "required": ["id", "why"]
+                        }
+                      },
+                      "required": ["cardId"]
+                    }
+                  },
+                  "notify": {
+                    "description": "One notification for one card. Refused while the Lead is on screen. A JSON object.",
+                    "type": "object",
+                    "properties": {
+                      "cardId": {
+                        "type": "string",
+                        "format": "uuid",
+                        "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+                      },
+                      "title": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 120
+                      },
+                      "body": {
+                        "type": "string",
+                        "maxLength": 500
+                      }
+                    },
+                    "required": ["cardId", "title", "body"]
+                  },
+                  "welcome": {
+                    "description": "The one sentence under \"Welcome back, N waiting\".",
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 300
+                  }
+                }
+              }
+            }
+          }
+        },
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -2576,6 +3435,10 @@
         "summary": "List the members of a workspace, and its pending invitations unless excluded.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "members"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -2638,7 +3501,9 @@
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "plugins", "list"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -2699,6 +3564,10 @@
         "summary": "Turn a workspace plugin on or off by its plugin@marketplace id, as the list returns it. Running chat sessions install or remove it at their next turn. Admins only. Answers 204.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "plugins", "update"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -3018,6 +3887,9 @@
         "summary": "Read how many sandboxes may run at once and which sessions are running now.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "sandbox-limit"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -3071,7 +3943,9 @@
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "skills", "list"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -3121,6 +3995,10 @@
         "summary": "Add a custom skill from its files. A SKILL.md is required; its frontmatter carries the kebab-case name, the description and an optional argument-hint. Text files only, 100 KiB each, 50 files and 1 MiB in all. Pass factoryId to save these files as the workspace version of that factory skill, which keeps its name and hides the catalog entry until a delete resets it. Admins only. Answers 201 with the id of the new skill.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "skills", "create"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -3211,7 +4089,9 @@
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "skills", "get"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -3270,6 +4150,10 @@
         "summary": "Enable or disable a skill, or replace every file of a custom one; at least one of enabled and files. A factory skill takes files here only when every file Kosuke ships comes back unchanged: the other paths become its added files, replacing the previous set, and it stays a factory skill. To change a shipped file, POST the files with factoryId to save the workspace version instead. A custom skill edited from a factory skill keeps its name. Admins only. Answers 204.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "skills", "update"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -3420,6 +4304,10 @@
         "summary": "Pause the sandboxes of the given chat sessions.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "stop-sandboxes"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -3494,6 +4382,9 @@
         "summary": "Read sandbox usage by day and by project. start must precede end and the range is capped at 366 days.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "usage"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -3566,7 +4457,9 @@
         "summary": "List the projects you can reach. With an API key this spans every workspace you belong to; a browser session sees only its active workspace.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "list"],
+        "x-kosuke-sandbox-token": true,
         "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "responses": {
           "2XX": {
@@ -3606,6 +4499,10 @@
         "summary": "Connect a GitHub repository as a project in a workspace.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "create"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "requestBody": {
           "required": true,
           "content": {
@@ -3672,7 +4569,9 @@
         "summary": "Read one project.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "get"],
+        "x-kosuke-sandbox-token": true,
         "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -3724,6 +4623,10 @@
         "summary": "Rename a project.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "update"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -3844,6 +4747,10 @@
         "summary": "List the repository's branches, 30 per page in alphabetical order; pass nextCursor back as cursor for the next page, and search to filter by name.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "branches"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -4214,10 +5121,11 @@
     "/api/projects/{projectId}/chat-sessions/{sessionId}": {
       "get": {
         "operationId": "sessionsGet",
-        "summary": "Read one chat session with its latest job and pull request.",
+        "summary": "Read one chat session with its latest job and pull request. A Backlog session also carries its promptRevision, which a merge proposal names for each ticket it was written from.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "get"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
@@ -4281,6 +5189,7 @@
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "update"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
@@ -4454,9 +5363,12 @@
     "/api/projects/{projectId}/chat-sessions/{sessionId}/activate": {
       "post": {
         "operationId": "sessionsActivate",
-        "summary": "Start a backlog session: claim a sandbox and run its saved prompt as the first turn.",
+        "summary": "Start a backlog session: claim a sandbox and run its saved prompt as the first turn. With --skill ship the first turn is /ship on that prompt.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "activate"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -4480,6 +5392,23 @@
             }
           }
         ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "skill": {
+                    "description": "Run the saved prompt through this skill: `ship` starts `/ship` on the ticket.",
+                    "type": "string",
+                    "enum": ["ship"]
+                  }
+                }
+              }
+            }
+          }
+        },
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -4520,6 +5449,9 @@
         "summary": "List the session's artifacts, most recently changed first. Rows only: a body or a file url comes from reading one.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "artifacts", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -4581,6 +5513,9 @@
         "summary": "Copy one of your Lead's Prototypes onto a Backlog session as its own artifacts: the variant named, or every variant.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "artifacts", "attach"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -4673,6 +5608,9 @@
         "summary": "Read one artifact of the session: a markdown or html one carries its body, an image or a video a presigned url, its media type and its size.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "artifacts", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -4746,6 +5684,10 @@
         "summary": "List the session's own comments, oldest first. Review comments on the diff are under sessions diff comments.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "comments", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -4806,6 +5748,10 @@
         "summary": "Comment on the session, or reply to one of its comments with replyToId.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "comments", "add"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -4891,6 +5837,10 @@
         "summary": "Edit the text of your own session comment.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "comments", "update"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -5052,7 +6002,9 @@
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "jobs", "list"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -5138,7 +6090,9 @@
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "send"],
         "x-kosuke-attachments": true,
+        "x-kosuke-sandbox-token": true,
         "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -5342,6 +6296,7 @@
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "jobs", "get"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
@@ -5416,6 +6371,10 @@
         "summary": "Stop a running turn. Steers it had not taken go back to the top of Up next, which pauses.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "jobs", "cancel"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -5488,6 +6447,9 @@
         "summary": "Replace the session's Session Labels. New names join the project's labels; a session with a pull request syncs them to it in the background while labelsSyncPending is true.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "labels", "set"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -5570,10 +6532,12 @@
       },
       "patch": {
         "operationId": "sessionsLabelsEdit",
-        "summary": "Add and remove Session Labels, leaving the session's other labels as they are. color sets the initial project color only for newly created labels in add; existing label colors stay unchanged. A sandbox may edit only its own session. A session with a pull request syncs them to it in the background while labelsSyncPending is true; one without gets them when its pull request opens.",
+        "summary": "Add and remove Session Labels, leaving the session's other labels as they are. color sets the initial project color only for newly created labels in add; existing label colors stay unchanged. A session token nobody stands behind may edit only its own session. A session with a pull request syncs them to it in the background while labelsSyncPending is true; one without gets them when its pull request opens.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "labels", "edit"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -5676,6 +6640,7 @@
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "messages"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
@@ -5763,6 +6728,10 @@
         "summary": "List the review comments left on the diff.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "diff", "comments", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -5823,6 +6792,10 @@
         "summary": "Leave a review comment on a range of lines in the diff.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "diff", "comments", "add"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -5933,6 +6906,10 @@
         "summary": "Edit the body of your own comment, or resolve or reopen any comment. One of the two per call.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "diff", "comments", "update"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -6108,6 +7085,10 @@
         "summary": "List the commits the session's branch adds over its pull request's base branch, or over the target branch before a pull request is open. Needs a running sandbox; otherwise commits is empty and unavailable says why.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "diff", "commits"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -6170,6 +7151,9 @@
         "summary": "List the files the session's branch changes against its base, with totals.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "diff", "files"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -6233,6 +7217,9 @@
         "summary": "Read patches: a page (cursor), one file (path, with hunkOffset/hunkEnd), or one file with both sides (path and contents=1). path and cursor are mutually exclusive.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "diff", "patch"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -6393,6 +7380,10 @@
         "summary": "List the files in the session's sandbox. Empty when the sandbox is not running.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "files", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -6455,6 +7446,10 @@
         "summary": "Read one file from the session's sandbox.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "files", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -6526,6 +7521,10 @@
         "summary": "Write one file in the session's sandbox. Refused while a turn is running, and for binary content.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "files", "write"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -6615,6 +7614,10 @@
         "summary": "Read whether the session's sandbox has uncommitted changes, unpushed commits, or commits ahead of its base branch.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "git", "state"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -6677,6 +7680,10 @@
         "summary": "Commit the uncommitted changes in the sandbox. Refused while a turn is running.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "git", "commit"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -6757,6 +7764,10 @@
         "summary": "Draft a commit message for the uncommitted changes. Needs a running sandbox.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "git", "commit-message"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -6819,6 +7830,10 @@
         "summary": "Push the session's branch to GitHub. Refused while a turn is running.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "git", "push"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -6883,6 +7898,7 @@
         "x-kosuke-command": ["sessions", "edit-prompt"],
         "x-kosuke-attachments": true,
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
@@ -6975,12 +7991,81 @@
         }
       }
     },
+    "/api/projects/{projectId}/chat-sessions/{sessionId}/qa-slot": {
+      "post": {
+        "operationId": "sessionsQaSlot",
+        "summary": "Ask for the project's QA slot before a QA run: one session runs QA at a time per project. Answers granted, or the session's 1-based position among those waiting. Safe to repeat; a waiting session is resumed by the platform when its turn comes.",
+        "tags": ["sessions"],
+        "x-kosuke-command": ["sessions", "qa-slot"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
+        "parameters": [
+          {
+            "name": "projectId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid",
+              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+            }
+          },
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid",
+              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+            }
+          }
+        ],
+        "responses": {
+          "2XX": {
+            "description": "Success envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiSuccess"
+                }
+              }
+            }
+          },
+          "4XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "5XX": {
+            "description": "Error envelope",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/projects/{projectId}/chat-sessions/{sessionId}/queue": {
       "get": {
         "operationId": "sessionsQueueList",
         "summary": "List the messages waiting Up next in the session, in the order they will be sent, and whether Up next is paused.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "queue", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
           {
@@ -7045,6 +8130,10 @@
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "queue", "update"],
         "x-kosuke-attachments": true,
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -7228,6 +8317,10 @@
         "summary": "Move your own queued message to another place in Up next.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "queue", "move"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -7319,6 +8412,10 @@
         "summary": "Send your own queued message now as a turn of its own, ahead of the rest of Up next. Only while no turn is running; it resumes a paused Up next.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "queue", "send"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -7391,6 +8488,10 @@
         "summary": "Send your own queued message into your running turn as a steer. Claude and GLM sessions only; the message stays queued when nothing can take it.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "queue", "steer"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -7463,6 +8564,10 @@
         "summary": "Resume a session's paused Up next. Its top message is sent as soon as nothing is running.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "queue", "resume"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -7525,6 +8630,10 @@
         "summary": "Mark a chat session read, clearing its unread marker, as opening it in the app does. The assignee clears their marker; any member clears the shared marker of a session booked to Kosuke.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "mark-read"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -7587,6 +8696,10 @@
         "summary": "Run a runtime command on the agent session: clear starts a fresh conversation, compact summarizes it (Claude and GLM only), with optional focus instructions. Queued Up next while a turn or another command is running. Compact waits for the sandbox and can take a minute.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "runtime-command"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -7669,6 +8782,10 @@
         "summary": "Send a message and steer it into your running turn. Answers delivery steer, queued (the turn could not take it), job (no turn was running) or refused (the turn was stopped).",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "steer"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -7755,6 +8872,10 @@
         "summary": "Generate a title for a backlog session from the prompt text given as content. The title is returned, not saved.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "title-generate"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -7836,7 +8957,9 @@
         "tags": ["deploy"],
         "x-kosuke-command": ["deploy", "messages"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -7890,7 +9013,9 @@
         "tags": ["deploy"],
         "x-kosuke-command": ["deploy", "list"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -7968,6 +9093,7 @@
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "labels"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
@@ -8020,6 +9146,10 @@
         "summary": "Recolor a Session Label. Sessions whose pull request carries it resync, which recolors the repository label on GitHub to match.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "labels", "color"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -8095,6 +9225,10 @@
         "summary": "Read the preview URLs of the project's main sandbox, or of one chat session's.",
         "tags": ["preview"],
         "x-kosuke-command": ["preview", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -8159,6 +9293,10 @@
         "summary": "Read the health of every service behind a preview.",
         "tags": ["preview"],
         "x-kosuke-command": ["preview", "health"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -8223,6 +9361,10 @@
         "summary": "Restart the services of a preview's running sandbox in place. Fails when the sandbox is paused.",
         "tags": ["preview"],
         "x-kosuke-command": ["preview", "reset"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -8290,6 +9432,10 @@
         "summary": "Read the public share link of a preview, if one exists.",
         "tags": ["preview"],
         "x-kosuke-command": ["preview", "share", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -8352,6 +9498,10 @@
         "summary": "Create the public share link of a preview. The body sessionId wins over the query one.",
         "tags": ["preview"],
         "x-kosuke-command": ["preview", "share", "create"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -8502,6 +9652,10 @@
         "summary": "Read the project settings: setup commands, services, environment and sandbox size.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "settings", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -8552,6 +9706,10 @@
         "summary": "Change setup commands, branches, working directory or sandbox tier.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "settings", "update"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -8696,6 +9854,10 @@
         "tags": ["deploy"],
         "x-kosuke-command": ["deploy", "run"],
         "x-kosuke-attachments": true,
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -8795,6 +9957,10 @@
         "summary": "Stop the running deploy. Steers its agent had not taken go back to the top of Up next, which pauses; instructions sent while its sandbox built are discarded and listed.",
         "tags": ["deploy"],
         "x-kosuke-command": ["deploy", "cancel"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -8847,6 +10013,10 @@
         "summary": "Pick the model the deploy agent runs on, as an encoded id such as anthropic:sonnet__medium. Refused while a deploy runs or waits for an answer.",
         "tags": ["deploy"],
         "x-kosuke-command": ["deploy", "set-model"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -8916,6 +10086,10 @@
         "summary": "List the messages waiting Up next in the Deploy Chat, in the order they will be sent, and whether Up next is paused.",
         "tags": ["deploy"],
         "x-kosuke-command": ["deploy", "queue", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -8969,6 +10143,10 @@
         "tags": ["deploy"],
         "x-kosuke-command": ["deploy", "queue", "update"],
         "x-kosuke-attachments": true,
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -9131,6 +10309,10 @@
         "summary": "Move your own queued Deploy Chat message to another place in Up next.",
         "tags": ["deploy"],
         "x-kosuke-command": ["deploy", "queue", "move"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -9212,6 +10394,10 @@
         "summary": "Send your own queued Deploy Chat message now, ahead of the rest of Up next. Only while the deploy agent is idle; it resumes a paused Up next.",
         "tags": ["deploy"],
         "x-kosuke-command": ["deploy", "queue", "send"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -9274,6 +10460,10 @@
         "summary": "Send your own queued Deploy Chat message into the running deploy agent Turn as a steer. Claude deploys only; the message stays queued when nothing can take it.",
         "tags": ["deploy"],
         "x-kosuke-command": ["deploy", "queue", "steer"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -9336,6 +10526,10 @@
         "summary": "Resume the Deploy Chat's paused Up next. Its top message is sent as soon as the deploy is idle.",
         "tags": ["deploy"],
         "x-kosuke-command": ["deploy", "queue", "resume"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -9388,6 +10582,10 @@
         "summary": "Add environment variables. The body is a JSON array of { key, value, isSecret? }.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "env-vars", "add"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -9538,6 +10736,10 @@
         "summary": "Replace the services and environment from a kosuke.config.json document. Cross-service rules (unique ports, after references, one preview endpoint) are checked by the handler, not by the schema.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "settings", "import"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -9804,6 +11006,10 @@
         "summary": "List the project services, in the order they start. Carries no environment variables.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "services", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -9854,6 +11060,10 @@
         "summary": "Add a service. A port already used by another service is rejected by the handler.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "services", "add"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -10011,6 +11221,10 @@
         "summary": "Change one service. Every field is optional; only the ones sent change.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "services", "update"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -10225,6 +11439,7 @@
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "skills"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-lead-token": true,
         "parameters": [
@@ -10589,11 +11804,13 @@
     "/api/user/plugins": {
       "get": {
         "operationId": "userPluginsList",
-        "summary": "List the plugins the Official Marketplaces offer, or one Provider's with provider=anthropic or provider=openai, with whether you have each on as a personal plugin, the last failed install in the chat sessions you are the assignee of, and the workspaces of yours that already have it on. Plugins that carry MCP servers or ChatGPT apps are not offered. Personal plugins follow you into every workspace you belong to, alongside its workspace plugins. From a sandbox, the chat session assignee's, with only this workspace and this project's sessions. From a Cron Run, none: it acts as Kosuke, which holds no personal plugins.",
+        "summary": "List the plugins the Official Marketplaces offer, or one Provider's with provider=anthropic or provider=openai, with whether you have each on as a personal plugin, the last failed install in the chat sessions you are the assignee of, and the workspaces of yours that already have it on. Plugins that carry MCP servers or ChatGPT apps are not offered. Personal plugins follow you into every workspace you belong to, alongside its workspace plugins. From an agent token, those of the member it acts as, with only this workspace and, for a sandbox or a Cron Run, this project's sessions. From a Cron Run with no member behind it, none.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "plugins", "list"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "provider",
@@ -10645,6 +11862,10 @@
         "summary": "Turn one of your personal plugins on or off by its plugin@marketplace id, as the list returns it, in every workspace at once. Chat sessions you are the assignee of install or remove it at their next turn. Answers 204.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "plugins", "update"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "pluginId",
@@ -10713,6 +11934,10 @@
         "summary": "Read your account: id, email, name, onboarding state, default model, auto-commit and plain-language settings.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "profile"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -10750,11 +11975,13 @@
     "/api/user/skills": {
       "get": {
         "operationId": "userSkillsList",
-        "summary": "List your personal skills: what each SKILL.md declares, how many files the skill holds, whether it is enabled, and the workspaces where it replaces an enabled workspace skill of the same name. Personal skills follow you into every workspace you belong to and reach the chat sessions you are the assignee of. From a sandbox, the chat session assignee's, and only this workspace among the replacements. From a Cron Run, none: it acts as Kosuke, which holds no personal skills.",
+        "summary": "List your personal skills: what each SKILL.md declares, how many files the skill holds, whether it is enabled, and the workspaces where it replaces an enabled workspace skill of the same name. Personal skills follow you into every workspace you belong to and reach the chat sessions you are the assignee of. From an agent token, those of the member it acts as, naming only this workspace. From a Cron Run with no member behind it, none.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "skills", "list"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -10793,6 +12020,10 @@
         "summary": "Add a personal skill from its files. A SKILL.md is required; its frontmatter carries the kebab-case name, the description and an optional argument-hint. Text files only, 100 KiB each, 50 files and 1 MiB in all. Names are unique among your own personal skills. Answers 201 with the id of the new skill.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "skills", "create"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "requestBody": {
           "required": true,
           "content": {
@@ -10863,11 +12094,13 @@
     "/api/user/skills/{skillId}": {
       "get": {
         "operationId": "userSkillsGet",
-        "summary": "Get one of your personal skills with every file it holds, SKILL.md included. From a sandbox, one of the chat session assignee's. From a Cron Run, never one: it acts as Kosuke, which holds no personal skills.",
+        "summary": "Get one of your personal skills with every file it holds, SKILL.md included. From an agent token, one of the member it acts as. From a Cron Run with no member behind it, never one: it acts as Kosuke, which holds no personal skills.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "skills", "get"],
         "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
         "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "skillId",
@@ -10918,6 +12151,10 @@
         "summary": "Enable or disable one of your personal skills, or replace every file it holds; at least one of enabled and files. The switch applies in every workspace at once. Answers 204.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "skills", "update"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "skillId",
@@ -11052,6 +12289,10 @@
         "summary": "Read your Claude, Codex and GLM Coding Plan subscriptions (connected, needsReauth, accountEmail) and your default model.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -11461,6 +12702,10 @@
         "summary": "Read the session and weekly utilization of your Claude (claude_code, the default), Codex or GLM Coding Plan (coding_plan) subscription. 400 when it is not connected or needs reconnecting.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "usage"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-orchestrator-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-lead-token": true,
         "parameters": [
           {
             "name": "provider",