@kyleroche/relay 0.1.0 → 0.2.0

package/dist/relay-mcp.js

@@ -133,6 +133,15 @@ function httpClient(opts) {
     async putSummary(slug, summary, tokens, o = {}) {
       await rest("PUT", `/projects/${encodeURIComponent(slug)}/summary`, { summary, tokens, usage: o.usage ?? [] });
     },
+    async githubStatus(slug) {
+      try {
+        const r = await rest("GET", `/projects/${encodeURIComponent(slug)}/github`);
+        return r.body;
+      } catch (e) {
+        if (e instanceof RelayHttpError && e.status === 404) return void 0;
+        throw e;
+      }
+    },
     async recall(q) {
       const text2 = await tool("relay_recall", { query: q.query, ...q.project ? { project: q.project } : {} });
       return { preferences: [], decisions: [], text: /^No matching/.test(text2) ? "" : text2 };
@@ -213,6 +222,22 @@ ${q.issue.body.slice(0, 2e3)}` : ""}` : q.intent, max_tokens: Math.max(200, Math
       const r = await rest("GET", "/tasks", void 0, { project: o.project, state: o.state, limit: o.limit });
       return r.body.tasks;
     },
+    async approveTask(id) {
+      const r = await rest("POST", `/tasks/${taskPath(id)}/approve`, {});
+      return r.body;
+    },
+    async requestChanges(id, note) {
+      const r = await rest("POST", `/tasks/${taskPath(id)}/request-changes`, { note });
+      return r.body;
+    },
+    async requeueTask(id, o = {}) {
+      const r = await rest("POST", `/tasks/${taskPath(id)}/requeue`, { ...o.lane ? { lane: o.lane } : {}, ...o.reason ? { reason: o.reason } : {} });
+      return r.body;
+    },
+    async releaseTask(id, o = {}) {
+      const r = await rest("POST", `/tasks/${taskPath(id)}/release`, { ...o.note ? { note: o.note } : {} });
+      return r.body;
+    },
     async addWebhook(input) {
       const r = await rest("POST", "/webhooks", input);
       return r.body;
@@ -422,9 +447,11 @@ function packageAt(root) {
     sessionStart: join3(hooksDir, "session-start.mjs"),
     userPrompt: join3(hooksDir, "user-prompt.mjs"),
     sessionEnd: join3(hooksDir, "session-end.mjs"),
+    statusLine: join3(hooksDir, "statusline.mjs"),
     mcpEntry: join3(dist, "relay-mcp.js"),
     templatesDir: join3(root, "templates"),
-    migrationsDir: join3(dist, "migrations")
+    migrationsDir: join3(dist, "migrations"),
+    containerDir: join3(dist, "container")
   };
 }
 function checkoutAt(root) {
@@ -437,9 +464,11 @@ function checkoutAt(root) {
     sessionStart: join3(hooksDir, "session-start.mjs"),
     userPrompt: join3(hooksDir, "user-prompt.mjs"),
     sessionEnd: join3(hooksDir, "session-end.mjs"),
+    statusLine: join3(hooksDir, "statusline.mjs"),
     mcpEntry: join3(root, "packages", "mcp", "bin", "relay-mcp.mjs"),
     templatesDir: join3(root, "packages", "cli", "templates"),
-    migrationsDir: join3(root, "packages", "core", "src", "db", "migrations")
+    migrationsDir: join3(root, "packages", "core", "src", "db", "migrations"),
+    containerDir: join3(root, "packages", "cli", "container")
   };
 }
 function detectLayout(root) {
@@ -461,11 +490,45 @@ function runtimePaths(root) {
   return selfRoot();
 }
 
+// ../core/src/meters.ts
+import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
+var METER_WINDOWS = ["5h", "7d"];
+var METER_SOURCE = "claude-statusline";
+var METERS_MAX_AGE_MS = 48 * 36e5;
+var pct = (v) => typeof v === "number" && Number.isFinite(v) ? Math.max(0, Math.min(100, Math.round(v))) : void 0;
+function resetsAtIso(v) {
+  if (typeof v === "number" && Number.isFinite(v) && v > 0) return new Date(v * 1e3).toISOString();
+  if (typeof v === "string" && !Number.isNaN(Date.parse(v))) return new Date(v).toISOString();
+  return null;
+}
+function sanitizeMeters(input) {
+  if (input === void 0) return void 0;
+  if (!Array.isArray(input)) return [];
+  const out = [];
+  for (const r of input.slice(0, 20)) {
+    if (!r || typeof r !== "object") continue;
+    const used = pct(r.used_percentage);
+    const window = r.window;
+    if (used === void 0 || !METER_WINDOWS.includes(window)) continue;
+    if (typeof r.captured_at !== "string" || Number.isNaN(Date.parse(r.captured_at))) continue;
+    out.push({
+      subscription: typeof r.subscription === "string" && r.subscription.trim() ? r.subscription.trim().slice(0, 32) : "max",
+      window,
+      used_percentage: used,
+      resets_at: resetsAtIso(r.resets_at),
+      captured_at: new Date(r.captured_at).toISOString(),
+      source: METER_SOURCE
+    });
+  }
+  return out;
+}
+
 // ../core/src/db/client.ts
 import { mkdirSync as mkdirSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join4 } from "path";
-var DEFAULT_PGLITE_FILE = join4(process.env.RELAY_HOME ?? join4(homedir3(), ".harness"), "relay.pglite");
+import { dirname as dirname2, join as join5 } from "path";
+var DEFAULT_PGLITE_FILE = join5(process.env.RELAY_HOME ?? join5(homedir3(), ".harness"), "relay.pglite");
 var DbError = class extends Error {
   constructor(message2, sql) {
     super(message2);
@@ -563,9 +626,496 @@ var num = (v) => v === null || v === void 0 ? 0 : typeof v === "number" ? v : Nu
 var iso = (v) => v === null || v === void 0 ? null : v instanceof Date ? v.toISOString() : String(v);
 var vec = (v) => `[${v.join(",")}]`;
 
+// ../core/src/db/queue.ts
+async function getQueueVersion(db) {
+  const r = await db.query("SELECT version FROM queue_state WHERE one");
+  return r[0] ? num(r[0].version) : 0;
+}
+async function bumpQueueVersion(db) {
+  const r = await db.query(
+    `INSERT INTO queue_state (one, version, updated_at) VALUES (true, 1, now())
+     ON CONFLICT (one) DO UPDATE SET version = queue_state.version + 1, updated_at = now() RETURNING version`
+  );
+  return num(r[0]?.version);
+}
+
+// ../core/src/db/tasks.ts
+var TASK_STATES = ["queued", "held", "claimed", "running", "review", "done", "failed"];
+var isTaskState = (s) => TASK_STATES.includes(s);
+var taskId = (repo, issue) => `${repo}#${issue}`;
+var issueUrl = (repo, issue) => `https://github.com/${repo}/issues/${issue}`;
+function parseTaskId(id) {
+  const m = /^([\w.-]+\/[\w.-]+)#(\d+)$/.exec(id.trim());
+  return m ? { repo: m[1], issue: Number(m[2]) } : void 0;
+}
+var cols = "id, project, repo, issue, idempotency_key, created_by, created_at, lane, title";
+var toTask = (r) => ({
+  id: r.id,
+  project: r.project,
+  repo: r.repo,
+  issue: num(r.issue),
+  idempotency_key: r.idempotency_key ?? null,
+  created_by: r.created_by,
+  created_at: iso(r.created_at) ?? "",
+  lane: r.lane ?? null,
+  title: r.title ?? null
+});
+var TASK_COLS = cols;
+async function findTaskByKey(db, key) {
+  const r = await db.query(`SELECT ${cols} FROM tasks WHERE idempotency_key = $1`, [key]);
+  return r[0] ? toTask(r[0]) : void 0;
+}
+async function getTask(db, id) {
+  const r = await db.query(`SELECT ${cols} FROM tasks WHERE id = $1`, [id]);
+  return r[0] ? toTask(r[0]) : void 0;
+}
+async function createTask(db, t) {
+  const id = taskId(t.repo, t.issue);
+  const key = t.idempotencyKey?.trim() || null;
+  const title = t.title?.trim() || null;
+  if (key) {
+    const existing2 = await findTaskByKey(db, key);
+    if (existing2) return { task: existing2, created: false };
+  }
+  const r = await db.query(
+    `INSERT INTO tasks (id, project, repo, issue, idempotency_key, created_by, lane, title) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+     ON CONFLICT (id) DO NOTHING RETURNING ${cols}`,
+    [id, t.project, t.repo, t.issue, key, t.createdBy, t.lane ?? null, title]
+  );
+  if (r[0]) {
+    await refreshTaskState(db, id);
+    await bumpQueueVersion(db);
+    return { task: toTask(r[0]), created: true };
+  }
+  const existing = await getTask(db, id);
+  if (!existing) throw new Error(`task ${id} could not be created`);
+  if (t.lane && existing.lane !== t.lane) {
+    await db.query("UPDATE tasks SET lane = $2 WHERE id = $1", [id, t.lane]);
+    existing.lane = t.lane;
+    await bumpQueueVersion(db);
+  }
+  if (title && !existing.title) {
+    await db.query("UPDATE tasks SET title = $2 WHERE id = $1", [id, title]);
+    existing.title = title;
+  }
+  return { task: existing, created: false };
+}
+async function listTasks(db, opts = {}) {
+  const params = [];
+  const where = opts.project ? (params.push(opts.project), `WHERE project = $1`) : "";
+  params.push(opts.limit ?? 50);
+  const r = await db.query(`SELECT ${cols} FROM tasks ${where} ORDER BY created_at DESC, id DESC LIMIT $${params.length}`, params);
+  return r.map(toTask);
+}
+var FAILED_CONCLUSIONS = /* @__PURE__ */ new Set(["failure", "cancelled", "timed_out", "startup_failure", "action_required"]);
+var relayBranchPattern = (issue) => new RegExp(`^relay/(?:[a-z][a-z0-9-]*-${issue}|${issue}-[a-z][a-z0-9-]*)(?:$|[-/])`);
+var payloadStr = (e, key) => typeof e.payload[key] === "string" ? e.payload[key] : null;
+function previewMatches(task, e, prs, branch) {
+  if (!e.kind.startsWith("preview.")) return false;
+  if (e.issue != null) return e.issue === task.issue;
+  if (e.pr != null && prs.has(e.pr)) return true;
+  const ref = payloadStr(e, "ref") ?? payloadStr(e, "branch");
+  if (!ref) return false;
+  if (branch && ref === branch) return true;
+  return relayBranchPattern(task.issue).test(ref);
+}
+function deriveTaskStatus(task, events, claims = [], now = Date.now()) {
+  const sorted = [...events].sort((a, b) => a.ts.localeCompare(b.ts) || a.id - b.id);
+  let state = "queued";
+  let runner = null;
+  let lane = null;
+  let pr = null;
+  let pr_url = null;
+  let branch = null;
+  let lastStart = null;
+  let lastEnd = null;
+  let run_summary = null;
+  let usage = null;
+  let merged_at = null;
+  let review = { decided: null, by: null, at: null, note: null };
+  const prs = /* @__PURE__ */ new Set();
+  for (const e of sorted) if (e.pr != null && !e.kind.startsWith("preview.")) prs.add(e.pr);
+  let preview = null;
+  let lastPush = null;
+  const matched = [];
+  for (const e of sorted) {
+    if (e.kind.startsWith("preview.")) {
+      if (previewMatches(task, e, prs, branch)) {
+        matched.push(e);
+        if (e.kind === "preview.ready") preview = { url: e.url, state: "ready", ts: e.ts };
+        else if (e.kind === "preview.failed") preview = { url: preview?.url ?? null, state: "failed", ts: e.ts };
+      }
+      continue;
+    }
+    const gateRow = e.kind === "step.usage" && e.lane === "gate";
+    if (e.lane && !gateRow) lane = e.lane;
+    if (e.pr != null) pr = e.pr;
+    const b = payloadStr(e, "branch");
+    if (b && (e.kind === "run.started" || e.kind === "pr.opened")) branch = b;
+    switch (e.kind) {
+      case "issue.labeled":
+        state = "queued";
+        break;
+      case "run.started":
+        state = "running";
+        lastStart = e.ts;
+        if (e.actor.startsWith("runner:")) runner = e.actor;
+        break;
+      case "run.dispatched":
+        state = "running";
+        break;
+      case "run.failed":
+        state = "failed";
+        lastEnd = e.ts;
+        break;
+      case "run.finished": {
+        const conclusion = typeof e.payload.conclusion === "string" ? e.payload.conclusion : "";
+        state = FAILED_CONCLUSIONS.has(conclusion) ? "failed" : "review";
+        lastEnd = e.ts;
+        if (e.actor.startsWith("runner:")) runner = e.actor;
+        if (state === "review") {
+          run_summary = e.summary || run_summary;
+          lastPush = e.ts;
+          if (review.decided === "changes_requested") review = { decided: null, by: null, at: null, note: null };
+        }
+        break;
+      }
+      case "step.usage":
+        usage = {
+          runs: (usage?.runs ?? 0) + (gateRow ? 0 : 1),
+          tokens_in: (usage?.tokens_in ?? 0) + e.tokens_in,
+          tokens_out: (usage?.tokens_out ?? 0) + e.tokens_out,
+          cache_read: (usage?.cache_read ?? 0) + e.cache_read,
+          cost_equiv: Math.round(((usage?.cost_equiv ?? 0) + e.cost_equiv) * 1e6) / 1e6,
+          model: gateRow ? usage?.model ?? null : e.model ?? usage?.model ?? null,
+          duration_ms: gateRow ? usage?.duration_ms ?? null : e.duration_ms ?? usage?.duration_ms ?? null
+        };
+        break;
+      case "pr.opened":
+        state = "review";
+        if (e.url) pr_url = e.url;
+        lastPush = e.ts;
+        break;
+      case "pr.merged":
+      case "issue.closed":
+        state = "done";
+        if (e.kind === "pr.merged") {
+          if (e.url) pr_url = e.url;
+          merged_at = merged_at ?? e.ts;
+        }
+        break;
+      case "pr.closed":
+        state = "queued";
+        break;
+      case "task.approved":
+        review = { decided: "approved", by: e.actor, at: e.ts, note: null };
+        if (e.payload.merged === true) {
+          state = "done";
+          merged_at = merged_at ?? e.ts;
+          if (e.url) pr_url = e.url;
+        }
+        break;
+      case "task.changes_requested":
+        review = { decided: "changes_requested", by: e.actor, at: e.ts, note: payloadStr(e, "note") };
+        state = "queued";
+        break;
+      case "task.merge_failed":
+        break;
+      case "task.requeued":
+        state = "queued";
+        lastEnd = e.ts;
+        break;
+      case "task.held":
+        state = "held";
+        lastEnd = e.ts;
+        break;
+      case "task.released":
+        state = "queued";
+        break;
+      default:
+        break;
+    }
+  }
+  let preview_state = preview ? preview.state : "none";
+  if (preview && preview.state === "ready" && lastPush && lastPush > preview.ts) preview_state = "building";
+  if (!branch && lane && lastStart) branch = `relay/${lane}-${task.issue}`;
+  const latest2 = [...claims].sort((a, b) => a.claimed_at.localeCompare(b.claimed_at)).at(-1);
+  if (latest2) {
+    const live = !latest2.released_at && new Date(latest2.lease_until).getTime() > now;
+    if (live) {
+      if (state === "queued") state = "claimed";
+      runner = `runner:${latest2.worker}`;
+    } else if (state === "running" && lastStart && latest2.claimed_at <= lastStart && (!lastEnd || lastEnd < lastStart)) {
+      state = "queued";
+    }
+  }
+  const own = sorted.filter((e) => !e.kind.startsWith("preview.") || matched.includes(e));
+  const last = own.at(-1);
+  if (pr != null && !pr_url) pr_url = `https://github.com/${task.repo}/pull/${pr}`;
+  return {
+    state,
+    runner,
+    lane,
+    pr,
+    pr_url,
+    issue_url: issueUrl(task.repo, task.issue),
+    branch,
+    summary: last?.summary ?? null,
+    run_summary,
+    usage,
+    preview_url: preview?.url ?? null,
+    preview_state,
+    review,
+    merged_at,
+    updated_at: last?.ts ?? null,
+    last_kind: last?.kind ?? null,
+    events: own.length
+  };
+}
+async function taskEvents(db, task) {
+  const r = await db.query(
+    `SELECT ${EVENT_COLS} FROM events
+     WHERE (repo = $1 OR (repo IS NULL AND project = $2))
+       AND (issue = $3
+            OR (kind LIKE 'preview.%' AND issue IS NULL
+                AND ((pr IS NOT NULL AND pr IN (SELECT e2.pr FROM events e2 WHERE e2.repo = $1 AND e2.issue = $3 AND e2.pr IS NOT NULL))
+                     OR coalesce(payload->>'ref', payload->>'branch', '') ~ $4)))
+     ORDER BY ts ASC, id ASC LIMIT 2000`,
+    [task.repo, task.project, task.issue, relayBranchPattern(task.issue).source]
+  );
+  return r.map(toEvent);
+}
+async function taskClaims(db, taskId2) {
+  const r = await db.query(
+    `SELECT w.name AS worker, c.lease_until, c.claimed_at, c.released_at, c.outcome FROM claims c JOIN workers w ON w.id = c.worker_id
+     WHERE c.task_id = $1 ORDER BY c.claimed_at ASC LIMIT 200`,
+    [taskId2]
+  );
+  return r.map((x) => ({ worker: x.worker, lease_until: iso(x.lease_until) ?? "", claimed_at: iso(x.claimed_at) ?? "", released_at: iso(x.released_at), outcome: x.outcome ?? null }));
+}
+async function taskState(db, task) {
+  const [events, claims] = await Promise.all([taskEvents(db, task), taskClaims(db, task.id)]);
+  return deriveTaskStatus(task, events, claims);
+}
+async function taskView(db, task) {
+  return { ...task, ...await taskState(db, task) };
+}
+async function listTaskViews(db, opts = {}) {
+  const limit = opts.limit ?? 50;
+  const params = [];
+  const where = [];
+  if (opts.project) {
+    params.push(opts.project);
+    where.push(`project = $${params.length}`);
+  }
+  if (opts.state) {
+    params.push(opts.state);
+    where.push(`(state = $${params.length} OR state IS NULL)`);
+  }
+  params.push(limit);
+  const rows = await db.query(`SELECT ${cols}, state FROM tasks ${where.length ? "WHERE " + where.join(" AND ") : ""} ORDER BY created_at DESC, id DESC LIMIT $${params.length}`, params);
+  const views = await Promise.all(
+    rows.map(async (r) => {
+      const task = toTask(r);
+      if (r.state == null) await refreshTaskState(db, task.id);
+      return taskView(db, task);
+    })
+  );
+  return opts.state ? views.filter((v) => v.state === opts.state) : views;
+}
+
+// ../core/src/tasks/station.ts
+var FAILED_CONCLUSIONS2 = /* @__PURE__ */ new Set(["failure", "cancelled", "timed_out", "startup_failure", "action_required"]);
+var conclusionOf = (e) => typeof e.payload?.conclusion === "string" ? e.payload.conclusion : "";
+var finishedOk = (e) => e.kind === "run.finished" && !FAILED_CONCLUSIONS2.has(conclusionOf(e));
+var finishedBad = (e) => e.kind === "run.finished" && FAILED_CONCLUSIONS2.has(conclusionOf(e));
+function latest(events, pick) {
+  let best = null;
+  for (const e of events) if (pick(e) && (best === null || e.ts > best)) best = e.ts;
+  return best;
+}
+var QUEUE_KINDS = /* @__PURE__ */ new Set(["issue.labeled", "issue.opened", "task.created", "pr.closed", "task.changes_requested", "task.requeued", "task.held", "task.released"]);
+var PUSH_KINDS = /* @__PURE__ */ new Set(["pr.opened"]);
+function stationOf(task, events = []) {
+  switch (task.state) {
+    case "queued":
+    case "held":
+      return "Queue";
+    case "claimed":
+      return "Claimed";
+    case "running":
+      return "Running";
+    case "done":
+      return "Merged";
+    case "failed":
+      return "Failed";
+    case "review": {
+      const push = latest(events, (e) => PUSH_KINDS.has(e.kind) || finishedOk(e));
+      const engaged = latest(events, (e) => e.kind === "pr.review" || e.kind === "task.merge_failed");
+      if (engaged && (!push || engaged >= push)) return "Review";
+      return task.preview_state === "ready" ? "Preview" : "PR";
+    }
+  }
+}
+function stationSince(task, station, events = [], opts = {}) {
+  let ts = null;
+  switch (station) {
+    case "Queue":
+      ts = latest(events, (e) => QUEUE_KINDS.has(e.kind));
+      break;
+    case "Claimed":
+      ts = opts.claimedAt ?? null;
+      break;
+    case "Running":
+      ts = latest(events, (e) => e.kind === "run.started" || e.kind === "run.dispatched");
+      break;
+    case "PR":
+      ts = latest(events, (e) => PUSH_KINDS.has(e.kind) || finishedOk(e));
+      break;
+    case "Preview":
+      ts = latest(events, (e) => e.kind === "preview.ready" && (!task.preview_url || !e.url || e.url === task.preview_url)) ?? latest(events, (e) => e.kind === "preview.ready");
+      break;
+    case "Review":
+      ts = latest(events, (e) => e.kind === "pr.review" || e.kind === "task.merge_failed");
+      break;
+    case "Merged":
+      ts = task.merged_at ?? latest(events, (e) => e.kind === "pr.merged" || e.kind === "issue.closed" || e.kind === "task.approved" && e.payload?.merged === true);
+      break;
+    case "Failed":
+      ts = latest(events, (e) => e.kind === "run.failed" || finishedBad(e));
+      break;
+  }
+  return ts ?? task.updated_at ?? task.created_at ?? new Date(opts.now ?? Date.now()).toISOString();
+}
+function deriveStation(task, events = [], opts = {}) {
+  const station = stationOf(task, events);
+  return { station, since: stationSince(task, station, events, opts) };
+}
+var FLOW_DONE_MS = 9e4;
+var FLOW_FAILED_MS = 24 * 36e5;
+function failureLine(events) {
+  let best;
+  for (const e of events) if ((e.kind === "run.failed" || finishedBad(e)) && (!best || e.ts > best.ts)) best = e;
+  if (!best) return void 0;
+  const err = typeof best.payload?.error === "string" ? best.payload.error : null;
+  return err ?? best.summary ?? void 0;
+}
+function taskTitle(task, events = []) {
+  if (task.title) return task.title;
+  const opened = events.find((e) => e.kind === "issue.opened" && e.summary);
+  if (opened?.summary) return opened.summary;
+  const created = events.find((e) => e.kind === "task.created" && e.summary?.startsWith(`${task.id}: `));
+  if (created?.summary) return created.summary.slice(task.id.length + 2);
+  const pr = events.find((e) => e.kind === "pr.opened" && e.summary);
+  if (pr?.summary) return pr.summary.replace(/\s*\(#\d+\)\s*$/, "");
+  return `#${task.issue}`;
+}
+
+// ../core/src/db/task-state.ts
+function materializeTask(task, events, claims, now = Date.now()) {
+  const status = deriveTaskStatus(task, events, claims, now);
+  const latest2 = [...claims].sort((a, b) => a.claimed_at.localeCompare(b.claimed_at)).at(-1);
+  const claimedAt = latest2 && !latest2.released_at && new Date(latest2.lease_until).getTime() > now ? latest2.claimed_at : null;
+  const { station, since } = deriveStation({ ...status, created_at: task.created_at }, events, { claimedAt, now });
+  const title = taskTitle(task, events);
+  return {
+    state: status.state,
+    station,
+    since,
+    pr: status.pr,
+    pr_url: status.pr_url,
+    preview_state: status.preview_state,
+    preview_url: status.preview_url,
+    runner: status.runner,
+    last_error: status.state === "failed" ? failureLine(events) ?? null : null,
+    cost: status.usage?.cost_equiv ?? null,
+    title: title === `#${task.issue}` ? null : title
+  };
+}
+async function refreshTaskState(db, id, now = Date.now()) {
+  const r = await db.query(`SELECT ${TASK_COLS} FROM tasks WHERE id = $1`, [id]);
+  if (!r[0]) return void 0;
+  const task = toTask(r[0]);
+  const [events, claims] = await Promise.all([taskEvents(db, task), taskClaims(db, task.id)]);
+  const m = materializeTask(task, events, claims, now);
+  await db.query(
+    `UPDATE tasks SET state = $2, station = $3, since = $4::timestamptz, pr = $5, pr_url = $6, preview_state = $7, preview_url = $8, runner = $9,
+                      last_error = $10, cost = $11, title = coalesce(title, $12), state_updated_at = $13::timestamptz
+     WHERE id = $1`,
+    [id, m.state, m.station, m.since, m.pr, m.pr_url, m.preview_state, m.preview_url, m.runner, m.last_error, m.cost, m.title, new Date(now).toISOString()]
+  );
+  return m;
+}
+var BRANCH_ISSUE = /^relay\/(?:[a-z][a-z0-9-]*-(\d+)|(\d+)-[a-z][a-z0-9-]*)(?:$|[-/])/;
+async function refreshTaskForEvent(db, e, now = Date.now()) {
+  const ids = /* @__PURE__ */ new Set();
+  if (e.issue != null) {
+    if (e.repo) ids.add(taskId(e.repo, e.issue));
+    else if (e.project) {
+      const r = await db.query("SELECT id FROM tasks WHERE project = $1 AND issue = $2", [e.project, e.issue]);
+      for (const x of r) ids.add(x.id);
+    }
+  } else if (e.kind.startsWith("preview.") && e.repo) {
+    const ref = typeof e.payload.ref === "string" ? e.payload.ref : typeof e.payload.branch === "string" ? e.payload.branch : null;
+    const m = ref ? BRANCH_ISSUE.exec(ref) : null;
+    if (m) ids.add(taskId(e.repo, Number(m[1] ?? m[2])));
+    if (e.pr != null || ref) {
+      const r = await db.query(
+        `SELECT DISTINCT issue FROM events WHERE repo = $1 AND issue IS NOT NULL AND kind NOT LIKE 'preview.%'
+           AND (($2::int IS NOT NULL AND pr = $2::int) OR ($3::text IS NOT NULL AND payload->>'branch' = $3::text))`,
+        [e.repo, e.pr ?? null, ref]
+      );
+      for (const x of r) ids.add(taskId(e.repo, num(x.issue)));
+    }
+  }
+  const refreshed = [];
+  for (const id of ids) if (await refreshTaskState(db, id, now)) refreshed.push(id);
+  return refreshed;
+}
+async function backfillTaskState(db, opts = {}) {
+  const r = await db.query(`SELECT id FROM tasks ${opts.all ? "" : "WHERE state IS NULL"} ORDER BY created_at ASC, id ASC`);
+  for (const x of r) await refreshTaskState(db, x.id, opts.now);
+  return r.length;
+}
+var toFlowRow = (r) => ({
+  ...toTask(r),
+  state: r.state,
+  station: r.station,
+  since: iso(r.since) ?? "",
+  pr: r.pr == null ? null : num(r.pr),
+  pr_url: r.pr_url ?? null,
+  preview_state: r.preview_state ?? "none",
+  preview_url: r.preview_url ?? null,
+  runner: r.runner ?? null,
+  last_error: r.last_error ?? null,
+  cost: r.cost == null ? null : num(r.cost),
+  project_repo: r.project_repo ?? null
+});
+async function flowTasks(db, opts = {}) {
+  const now = opts.now ?? Date.now();
+  const limit = opts.limit ?? 200;
+  const select = async () => db.query(
+    `SELECT ${TASK_COLS.split(", ").map((c) => `t.${c}`).join(", ")}, t.state, t.station, t.since, t.pr, t.pr_url, t.preview_state, t.preview_url, t.runner, t.last_error, t.cost, p.repo AS project_repo
+       FROM tasks t LEFT JOIN projects p ON p.slug = t.project
+       WHERE t.state IS NULL
+          OR t.state IN ('queued', 'held', 'claimed', 'running', 'review')
+          OR (t.state = 'done' AND t.since > $1::timestamptz)
+          OR (t.state = 'failed' AND t.since > $2::timestamptz)
+       ORDER BY t.created_at DESC, t.id DESC LIMIT $3`,
+    [new Date(now - FLOW_DONE_MS).toISOString(), new Date(now - FLOW_FAILED_MS).toISOString(), limit]
+  );
+  let rows = await select();
+  const empty = rows.filter((r) => r.state == null);
+  if (empty.length) {
+    for (const r of empty) await refreshTaskState(db, r.id, now);
+    rows = await select();
+  }
+  return rows.filter((r) => r.state != null).map(toFlowRow);
+}
+
 // ../core/src/db/events.ts
 var EVENT_COLS = "id, ts, kind, actor, project, repo, issue, pr, lane, model, subscription, tokens_in, tokens_out, cache_read, cache_write, cost_equiv, duration_ms, summary, url, payload, dedupe_key";
-var cols = EVENT_COLS;
+var cols2 = EVENT_COLS;
 var toEvent = (r) => ({
   id: num(r.id),
   ts: iso(r.ts) ?? "",
@@ -595,7 +1145,7 @@ async function writeEvent(db, e) {
     `INSERT INTO events (ts, kind, actor, project, repo, issue, pr, lane, model, subscription, tokens_in, tokens_out, cache_read, cache_write, cost_equiv, duration_ms, summary, url, payload, dedupe_key)
      VALUES (coalesce($1::timestamptz, now()), $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19::jsonb, $20)
      ON CONFLICT (dedupe_key) DO NOTHING
-     RETURNING ${cols}`,
+     RETURNING ${cols2}`,
     [
       ts,
       e.kind,
@@ -619,7 +1169,10 @@ async function writeEvent(db, e) {
       e.dedupe_key ?? null
     ]
   );
-  return r[0] ? toEvent(r[0]) : void 0;
+  if (!r[0]) return void 0;
+  const row = toEvent(r[0]);
+  await refreshTaskForEvent(db, row);
+  return row;
 }
 async function listEvents(db, opts = {}) {
   const where = [];
@@ -636,9 +1189,13 @@ async function listEvents(db, opts = {}) {
   if (opts.before) add("ts < ?::timestamptz", opts.before);
   if (opts.after) add("ts > ?::timestamptz", opts.after);
   params.push(opts.limit ?? 100);
-  const r = await db.query(`SELECT ${cols} FROM events ${where.length ? "WHERE " + where.join(" AND ") : ""} ORDER BY ts DESC, id DESC LIMIT $${params.length}`, params);
+  const r = await db.query(`SELECT ${cols2} FROM events ${where.length ? "WHERE " + where.join(" AND ") : ""} ORDER BY ts DESC, id DESC LIMIT $${params.length}`, params);
   return r.map(toEvent);
 }
+async function githubDeliveryStats(db, repoName) {
+  const r = await db.query(`SELECT count(*) AS n, max(ts) AS last FROM events WHERE repo = $1 AND dedupe_key LIKE 'github:%'`, [repoName]);
+  return { count: num(r[0]?.n), last_delivery_at: iso(r[0]?.last) ?? null };
+}
 async function usageSummary(db, sinceIso) {
   const r = await db.query(
     `SELECT coalesce(subscription, 'unknown') AS subscription, count(*) AS calls, sum(tokens_in) AS tokens_in, sum(tokens_out) AS tokens_out,
@@ -728,10 +1285,14 @@ function costEquiv(e) {
 // ../core/src/db/repo.ts
 var repo_exports = {};
 __export(repo_exports, {
+  ACCESS_CODE_RETENTION_SECONDS: () => ACCESS_CODE_RETENTION_SECONDS,
   AssetNotFoundError: () => AssetNotFoundError,
   DEFAULT_RETENTION_DAYS: () => DEFAULT_RETENTION_DAYS,
   EVENT_COLS: () => EVENT_COLS,
   LEASE_MS: () => LEASE_MS,
+  MIN_SETTINGS_SECRET_LENGTH: () => MIN_SETTINGS_SECRET_LENGTH,
+  ORPHAN_CLIENT_AGE_SECONDS: () => ORPHAN_CLIENT_AGE_SECONDS,
+  REFRESH_TOKEN_RETENTION_SECONDS: () => REFRESH_TOKEN_RETENTION_SECONDS,
   TASK_COLS: () => TASK_COLS,
   TASK_STATES: () => TASK_STATES,
   TOKEN_PREFIX: () => TOKEN_PREFIX,
@@ -742,6 +1303,8 @@ __export(repo_exports, {
   WORKER_OFFLINE_MS: () => WORKER_OFFLINE_MS,
   WORKER_ONLINE_MS: () => WORKER_ONLINE_MS,
   addDecision: () => addDecision,
+  backfillTaskState: () => backfillTaskState,
+  bumpQueueVersion: () => bumpQueueVersion,
   claimNext: () => claimNext,
   clientSecretMatches: () => clientSecretMatches,
   consumeCode: () => consumeCode,
@@ -753,24 +1316,29 @@ __export(repo_exports, {
   createToken: () => createToken,
   createWebhook: () => createWebhook,
   decideDevice: () => decideDevice,
+  deleteClient: () => deleteClient,
   deleteSettings: () => deleteSettings,
   deleteWebhook: () => deleteWebhook,
   deriveTaskStatus: () => deriveTaskStatus,
+  doorbell: () => doorbell,
   expireAssets: () => expireAssets,
   expireLeases: () => expireLeases,
   findTaskByKey: () => findTaskByKey,
   findToken: () => findToken,
   finishDelivery: () => finishDelivery,
   finishSource: () => finishSource,
+  flowTasks: () => flowTasks,
   generateWebhookSecret: () => generateWebhookSecret,
   getAsset: () => getAsset,
   getClient: () => getClient,
+  getClientSummary: () => getClientSummary,
   getDeviceByCode: () => getDeviceByCode,
   getDeviceByUserCode: () => getDeviceByUserCode,
   getInviteByCode: () => getInviteByCode,
   getModel: () => getModel,
   getProject: () => getProject,
   getProvider: () => getProvider,
+  getQueueVersion: () => getQueueVersion,
   getRefreshToken: () => getRefreshToken,
   getSetting: () => getSetting,
   getSource: () => getSource,
@@ -779,6 +1347,7 @@ __export(repo_exports, {
   getWebhook: () => getWebhook,
   getWorker: () => getWorker,
   getWorkerByName: () => getWorkerByName,
+  githubDeliveryStats: () => githubDeliveryStats,
   hashToken: () => hashToken,
   heartbeatWorker: () => heartbeatWorker,
   insertClient: () => insertClient,
@@ -786,11 +1355,14 @@ __export(repo_exports, {
   insertDeviceCode: () => insertDeviceCode,
   insertInvite: () => insertInvite,
   insertRefreshToken: () => insertRefreshToken,
+  isLoopbackHost: () => isLoopbackHost,
+  isPrivateHost: () => isPrivateHost,
   isTaskState: () => isTaskState,
   isTokenScope: () => isTokenScope,
   issueUrl: () => issueUrl,
   listAssets: () => listAssets,
   listClaims: () => listClaims,
+  listClients: () => listClients,
   listDecisions: () => listDecisions,
   listDeliveries: () => listDeliveries,
   listEvents: () => listEvents,
@@ -801,6 +1373,7 @@ __export(repo_exports, {
   listPendingDevices: () => listPendingDevices,
   listPreferences: () => listPreferences,
   listProjects: () => listProjects,
+  listRecentDevices: () => listRecentDevices,
   listSettingKeys: () => listSettingKeys,
   listSkills: () => listSkills,
   listTaskViews: () => listTaskViews,
@@ -814,16 +1387,23 @@ __export(repo_exports, {
   markOffline: () => markOffline,
   markOnboarded: () => markOnboarded,
   matchingWebhooks: () => matchingWebhooks,
+  materializeTask: () => materializeTask,
   newVersion: () => newVersion,
   openValue: () => openValue,
   parseTaskId: () => parseTaskId,
+  previewMatches: () => previewMatches,
   projectStats: () => projectStats,
   pruneGuidance: () => pruneGuidance,
   publicWebhook: () => publicWebhook,
   publishAsset: () => publishAsset,
+  purgeExpiredAccess: () => purgeExpiredAccess,
   putSetting: () => putSetting,
+  queuedCount: () => queuedCount,
   redeemDevice: () => redeemDevice,
+  refreshTaskForEvent: () => refreshTaskForEvent,
+  refreshTaskState: () => refreshTaskState,
   registerWorker: () => registerWorker,
+  relayBranchPattern: () => relayBranchPattern,
   releaseClaim: () => releaseClaim,
   removeMissingFileDigests: () => removeMissingFileDigests,
   replaceGuidance: () => replaceGuidance,
@@ -1233,7 +1813,7 @@ function retentionDays() {
   const n = Number(process.env.RELAY_ASSET_RETENTION_DAYS);
   return Number.isFinite(n) && n > 0 ? n : DEFAULT_RETENTION_DAYS;
 }
-var cols2 = "id, project, issue, pr, title, description, kind, mime, size, sha256, storage_key, thumb_key, width, height, duration_ms, version, parent_id, status, created_by, created_at, reviewed_by, reviewed_at, review_note, public_url, expires_at, tags";
+var cols3 = "id, project, issue, pr, title, description, kind, mime, size, sha256, storage_key, thumb_key, width, height, duration_ms, version, parent_id, status, created_by, created_at, reviewed_by, reviewed_at, review_note, public_url, expires_at, tags";
 var str = (v) => v === null || v === void 0 ? null : String(v);
 var int = (v) => v === null || v === void 0 ? null : num(v);
 var toAsset = (r) => ({
@@ -1282,7 +1862,7 @@ async function insertAsset(db, a, version, parentId) {
   const r = await db.query(
     `INSERT INTO assets (id, project, issue, pr, title, description, kind, mime, size, sha256, storage_key, thumb_key, width, height, duration_ms, version, parent_id, created_by, tags)
      VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19::text[])
-     RETURNING ${cols2}`,
+     RETURNING ${cols3}`,
     [
       id,
       a.project ?? null,
@@ -1321,7 +1901,7 @@ async function createAsset(db, a) {
   return db.transaction((tx) => insertAsset(tx, a, 1, null));
 }
 async function getAsset(db, id) {
-  const r = await db.query(`SELECT ${cols2} FROM assets WHERE id = $1`, [id]);
+  const r = await db.query(`SELECT ${cols3} FROM assets WHERE id = $1`, [id]);
   return r[0] ? toAsset(r[0]) : void 0;
 }
 async function listAssets(db, opts = {}) {
@@ -1338,7 +1918,7 @@ async function listAssets(db, opts = {}) {
   if (opts.pr !== void 0) add("pr = ?", opts.pr);
   params.push(opts.limit ?? 100);
   const r = await db.query(
-    `SELECT ${cols2} FROM assets ${where.length ? "WHERE " + where.join(" AND ") : ""}
+    `SELECT ${cols3} FROM assets ${where.length ? "WHERE " + where.join(" AND ") : ""}
      ORDER BY (status = 'pending') DESC, created_at DESC, id DESC LIMIT $${params.length}`,
     params
   );
@@ -1354,7 +1934,7 @@ async function listVersions(db, id) {
        SELECT a.* FROM assets a WHERE a.id = (SELECT id FROM root)
        UNION ALL SELECT c.* FROM assets c JOIN down ON c.parent_id = down.id
      )
-     SELECT ${cols2} FROM down ORDER BY version, created_at`,
+     SELECT ${cols3} FROM down ORDER BY version, created_at`,
     [id]
   );
   return r.map(toAsset);
@@ -1389,7 +1969,7 @@ async function reviewAsset(db, id, r) {
     const rows = await tx.query(
       `UPDATE assets SET status = $2, reviewed_by = $3, reviewed_at = now(), review_note = $4,
          expires_at = CASE WHEN $2 = 'rejected' THEN now() + ($5 || ' days')::interval ELSE NULL END
-       WHERE id = $1 RETURNING ${cols2}`,
+       WHERE id = $1 RETURNING ${cols3}`,
       [id, r.decision, r.by, r.note ?? null, String(retentionDays())]
     );
     if (!rows[0]) throw new AssetNotFoundError(id);
@@ -1412,7 +1992,7 @@ async function reviewAsset(db, id, r) {
 }
 async function publishAsset(db, id, publicUrl, opts = {}) {
   return db.transaction(async (tx) => {
-    const rows = await tx.query(`UPDATE assets SET status = 'published', public_url = $2, expires_at = NULL WHERE id = $1 RETURNING ${cols2}`, [id, publicUrl]);
+    const rows = await tx.query(`UPDATE assets SET status = 'published', public_url = $2, expires_at = NULL WHERE id = $1 RETURNING ${cols3}`, [id, publicUrl]);
     if (!rows[0]) throw new AssetNotFoundError(id);
     const row = toAsset(rows[0]);
     await writeEvent(tx, {
@@ -1430,7 +2010,7 @@ async function publishAsset(db, id, publicUrl, opts = {}) {
 }
 async function listExpiredAssets(db, now = /* @__PURE__ */ new Date()) {
   const r = await db.query(
-    `SELECT ${cols2} FROM assets WHERE status IN ('rejected', 'superseded') AND expires_at IS NOT NULL AND expires_at <= $1::timestamptz ORDER BY expires_at`,
+    `SELECT ${cols3} FROM assets WHERE status IN ('rejected', 'superseded') AND expires_at IS NOT NULL AND expires_at <= $1::timestamptz ORDER BY expires_at`,
     [now.toISOString()]
   );
   return r.map(toAsset);
@@ -1486,7 +2066,7 @@ var TOKEN_SCOPE_DESCRIPTIONS = {
   "tokens:write": "Mint, list and revoke tokens (relay token in site mode).",
   "work:claim": "Register a worker, heartbeat, claim queued tasks and report runs (relay work); pair with memory:read for the brief."
 };
-var cols3 = "id, name, scopes, created_by, created_at, last_used_at, revoked_at, expires_at, client_id";
+var cols4 = "id, name, scopes, created_by, created_at, last_used_at, revoked_at, expires_at, client_id";
 var toToken = (r) => ({
   id: r.id,
   name: r.name,
@@ -1508,14 +2088,14 @@ async function createToken(db, input) {
   if (!input.name.trim()) throw new Error("a token needs a name");
   const token = TOKEN_PREFIX + randomBytes2(32).toString("base64url");
   const r = await db.query(
-    `INSERT INTO tokens (id, name, token_hash, scopes, created_by, expires_at, client_id) VALUES ($1, $2, $3, $4::text[], $5, $6, $7) RETURNING ${cols3}`,
+    `INSERT INTO tokens (id, name, token_hash, scopes, created_by, expires_at, client_id) VALUES ($1, $2, $3, $4::text[], $5, $6, $7) RETURNING ${cols4}`,
     [ulid(), input.name.trim(), hashToken(token), scopes, input.createdBy, input.expiresAt ? new Date(input.expiresAt) : null, input.clientId ?? null]
   );
   return { token, row: toToken(r[0]) };
 }
 async function findToken(db, token) {
   if (!token) return void 0;
-  const r = await db.query(`SELECT ${cols3} FROM tokens WHERE token_hash = $1 AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > now())`, [hashToken(token)]);
+  const r = await db.query(`SELECT ${cols4} FROM tokens WHERE token_hash = $1 AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > now())`, [hashToken(token)]);
   if (!r[0]) return void 0;
   const row = toToken(r[0]);
   await db.query("UPDATE tokens SET last_used_at = now() WHERE id = $1", [row.id]).catch(() => {
@@ -1523,198 +2103,35 @@ async function findToken(db, token) {
   return row;
 }
 async function listTokens(db, opts = {}) {
-  const r = await db.query(`SELECT ${cols3} FROM tokens ${opts.includeRevoked ? "" : "WHERE revoked_at IS NULL"} ORDER BY created_at DESC`);
+  const r = await db.query(`SELECT ${cols4} FROM tokens ${opts.includeRevoked ? "" : "WHERE revoked_at IS NULL"} ORDER BY created_at DESC`);
   return r.map(toToken);
 }
 async function getTokenById(db, id) {
-  const r = await db.query(`SELECT ${cols3} FROM tokens WHERE id = $1`, [id]);
+  const r = await db.query(`SELECT ${cols4} FROM tokens WHERE id = $1`, [id]);
   return r[0] ? toToken(r[0]) : void 0;
 }
 async function revokeTokenById(db, id) {
-  const r = await db.query(`UPDATE tokens SET revoked_at = now() WHERE revoked_at IS NULL AND id = $1 RETURNING ${cols3}`, [id]);
+  const r = await db.query(`UPDATE tokens SET revoked_at = now() WHERE revoked_at IS NULL AND id = $1 RETURNING ${cols4}`, [id]);
   return r[0] ? toToken(r[0]) : void 0;
 }
 async function revokeTokenByHash(db, tokenHash) {
-  const r = await db.query(`UPDATE tokens SET revoked_at = now() WHERE revoked_at IS NULL AND token_hash = $1 RETURNING ${cols3}`, [tokenHash]);
+  const r = await db.query(`UPDATE tokens SET revoked_at = now() WHERE revoked_at IS NULL AND token_hash = $1 RETURNING ${cols4}`, [tokenHash]);
   return r[0] ? toToken(r[0]) : void 0;
 }
 async function revokeToken(db, idOrName) {
-  const r = await db.query(`UPDATE tokens SET revoked_at = now() WHERE revoked_at IS NULL AND (id = $1 OR name = $1) RETURNING ${cols3}`, [idOrName]);
+  const r = await db.query(`UPDATE tokens SET revoked_at = now() WHERE revoked_at IS NULL AND (id = $1 OR name = $1) RETURNING ${cols4}`, [idOrName]);
   return r[0] ? toToken(r[0]) : void 0;
 }
 
-// ../core/src/db/tasks.ts
-var TASK_STATES = ["queued", "claimed", "running", "review", "done", "failed"];
-var isTaskState = (s) => TASK_STATES.includes(s);
-var taskId = (repo, issue) => `${repo}#${issue}`;
-var issueUrl = (repo, issue) => `https://github.com/${repo}/issues/${issue}`;
-function parseTaskId(id) {
-  const m = /^([\w.-]+\/[\w.-]+)#(\d+)$/.exec(id.trim());
-  return m ? { repo: m[1], issue: Number(m[2]) } : void 0;
-}
-var cols4 = "id, project, repo, issue, idempotency_key, created_by, created_at, lane";
-var toTask = (r) => ({
-  id: r.id,
-  project: r.project,
-  repo: r.repo,
-  issue: num(r.issue),
-  idempotency_key: r.idempotency_key ?? null,
-  created_by: r.created_by,
-  created_at: iso(r.created_at) ?? "",
-  lane: r.lane ?? null
-});
-var TASK_COLS = cols4;
-async function findTaskByKey(db, key) {
-  const r = await db.query(`SELECT ${cols4} FROM tasks WHERE idempotency_key = $1`, [key]);
-  return r[0] ? toTask(r[0]) : void 0;
-}
-async function getTask(db, id) {
-  const r = await db.query(`SELECT ${cols4} FROM tasks WHERE id = $1`, [id]);
-  return r[0] ? toTask(r[0]) : void 0;
-}
-async function createTask(db, t) {
-  const id = taskId(t.repo, t.issue);
-  const key = t.idempotencyKey?.trim() || null;
-  if (key) {
-    const existing2 = await findTaskByKey(db, key);
-    if (existing2) return { task: existing2, created: false };
-  }
-  const r = await db.query(
-    `INSERT INTO tasks (id, project, repo, issue, idempotency_key, created_by, lane) VALUES ($1, $2, $3, $4, $5, $6, $7)
-     ON CONFLICT (id) DO NOTHING RETURNING ${cols4}`,
-    [id, t.project, t.repo, t.issue, key, t.createdBy, t.lane ?? null]
-  );
-  if (r[0]) return { task: toTask(r[0]), created: true };
-  const existing = await getTask(db, id);
-  if (!existing) throw new Error(`task ${id} could not be created`);
-  if (t.lane && existing.lane !== t.lane) {
-    await db.query("UPDATE tasks SET lane = $2 WHERE id = $1", [id, t.lane]);
-    existing.lane = t.lane;
-  }
-  return { task: existing, created: false };
-}
-async function listTasks(db, opts = {}) {
-  const params = [];
-  const where = opts.project ? (params.push(opts.project), `WHERE project = $1`) : "";
-  params.push(opts.limit ?? 50);
-  const r = await db.query(`SELECT ${cols4} FROM tasks ${where} ORDER BY created_at DESC, id DESC LIMIT $${params.length}`, params);
-  return r.map(toTask);
-}
-var FAILED_CONCLUSIONS = /* @__PURE__ */ new Set(["failure", "cancelled", "timed_out", "startup_failure", "action_required"]);
-function deriveTaskStatus(task, events, claims = [], now = Date.now()) {
-  const sorted = [...events].sort((a, b) => a.ts.localeCompare(b.ts) || a.id - b.id);
-  let state = "queued";
-  let runner = null;
-  let lane = null;
-  let pr = null;
-  let pr_url = null;
-  let lastStart = null;
-  let lastEnd = null;
-  for (const e of sorted) {
-    if (e.lane) lane = e.lane;
-    if (e.pr != null) pr = e.pr;
-    switch (e.kind) {
-      case "issue.labeled":
-        state = "queued";
-        break;
-      case "run.started":
-        state = "running";
-        lastStart = e.ts;
-        if (e.actor.startsWith("runner:")) runner = e.actor;
-        break;
-      case "run.dispatched":
-        state = "running";
-        break;
-      case "run.failed":
-        state = "failed";
-        lastEnd = e.ts;
-        break;
-      case "run.finished": {
-        const conclusion = typeof e.payload.conclusion === "string" ? e.payload.conclusion : "";
-        state = FAILED_CONCLUSIONS.has(conclusion) ? "failed" : "review";
-        lastEnd = e.ts;
-        if (e.actor.startsWith("runner:")) runner = e.actor;
-        break;
-      }
-      case "pr.opened":
-        state = "review";
-        if (e.url) pr_url = e.url;
-        break;
-      case "pr.merged":
-      case "issue.closed":
-        state = "done";
-        if (e.kind === "pr.merged" && e.url) pr_url = e.url;
-        break;
-      case "pr.closed":
-        state = "queued";
-        break;
-      default:
-        break;
-    }
-  }
-  const latest = [...claims].sort((a, b) => a.claimed_at.localeCompare(b.claimed_at)).at(-1);
-  if (latest) {
-    const live = !latest.released_at && new Date(latest.lease_until).getTime() > now;
-    if (live) {
-      if (state === "queued") state = "claimed";
-      runner = `runner:${latest.worker}`;
-    } else if (state === "running" && lastStart && latest.claimed_at <= lastStart && (!lastEnd || lastEnd < lastStart)) {
-      state = "queued";
-    }
-  }
-  const last = sorted.at(-1);
-  if (pr != null && !pr_url) pr_url = `https://github.com/${task.repo}/pull/${pr}`;
-  return {
-    state,
-    runner,
-    lane,
-    pr,
-    pr_url,
-    issue_url: issueUrl(task.repo, task.issue),
-    summary: last?.summary ?? null,
-    updated_at: last?.ts ?? null,
-    last_kind: last?.kind ?? null,
-    events: sorted.length
-  };
-}
-async function taskEvents(db, task) {
-  const r = await db.query(
-    `SELECT ${EVENT_COLS} FROM events WHERE issue = $3 AND (repo = $1 OR (repo IS NULL AND project = $2)) ORDER BY ts ASC, id ASC LIMIT 2000`,
-    [task.repo, task.project, task.issue]
-  );
-  return r.map(toEvent);
-}
-async function taskClaims(db, taskId2) {
-  const r = await db.query(
-    `SELECT w.name AS worker, c.lease_until, c.claimed_at, c.released_at, c.outcome FROM claims c JOIN workers w ON w.id = c.worker_id
-     WHERE c.task_id = $1 ORDER BY c.claimed_at ASC LIMIT 200`,
-    [taskId2]
-  );
-  return r.map((x) => ({ worker: x.worker, lease_until: iso(x.lease_until) ?? "", claimed_at: iso(x.claimed_at) ?? "", released_at: iso(x.released_at), outcome: x.outcome ?? null }));
-}
-async function taskState(db, task) {
-  const [events, claims] = await Promise.all([taskEvents(db, task), taskClaims(db, task.id)]);
-  return deriveTaskStatus(task, events, claims);
-}
-async function taskView(db, task) {
-  return { ...task, ...await taskState(db, task) };
-}
-async function listTaskViews(db, opts = {}) {
-  const rows = await listTasks(db, { ...opts.project ? { project: opts.project } : {}, limit: opts.state ? Math.max((opts.limit ?? 50) * 4, 200) : opts.limit ?? 50 });
-  const views = await Promise.all(rows.map((t) => taskView(db, t)));
-  const filtered = opts.state ? views.filter((v) => v.state === opts.state) : views;
-  return filtered.slice(0, opts.limit ?? 50);
-}
-
-// ../core/src/db/webhooks.ts
-import { randomBytes as randomBytes3 } from "crypto";
-var publicWebhook = (w) => {
-  const { secret: _s, bearer, ...rest } = w;
-  return { ...rest, has_bearer: !!bearer };
-};
-var WEBHOOK_EVENT_KINDS = ["run.finished", "run.failed", "pr.review", "pr.merged", "asset.uploaded", "asset.reviewed", "task.created", "issue.opened", "pr.opened", "preview.ready", "preview.failed", "decision.captured"];
-var cols5 = "id, project, url, secret, bearer, events, active, created_by, created_at";
-var toHook = (r) => ({
+// ../core/src/db/webhooks.ts
+import { randomBytes as randomBytes3 } from "crypto";
+var publicWebhook = (w) => {
+  const { secret: _s, bearer, ...rest } = w;
+  return { ...rest, has_bearer: !!bearer };
+};
+var WEBHOOK_EVENT_KINDS = ["run.finished", "run.failed", "pr.review", "pr.merged", "asset.uploaded", "asset.reviewed", "task.created", "issue.opened", "pr.opened", "preview.ready", "preview.failed", "decision.captured"];
+var cols5 = "id, project, url, secret, bearer, events, active, created_by, created_at";
+var toHook = (r) => ({
   id: r.id,
   project: r.project ?? null,
   url: r.url,
@@ -1726,14 +2143,48 @@ var toHook = (r) => ({
   created_at: iso(r.created_at) ?? ""
 });
 var generateWebhookSecret = () => "whsec_" + randomBytes3(32).toString("base64url");
-function validateWebhookUrl(url) {
+var ipv4 = (host) => {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!m) return void 0;
+  const parts = m.slice(1).map(Number);
+  return parts.every((n) => n <= 255) ? parts : void 0;
+};
+var bareHost = (hostname) => {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  const mapped = /^::ffff:(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|([0-9a-f]{1,4}):([0-9a-f]{1,4}))$/.exec(host);
+  if (!mapped) return host;
+  if (mapped[1]) return mapped[1];
+  const hi = parseInt(mapped[2], 16);
+  const lo = parseInt(mapped[3], 16);
+  return `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
+};
+function isLoopbackHost(hostname) {
+  const host = bareHost(hostname);
+  if (host === "localhost" || host.endsWith(".localhost") || host === "::1" || host === "0.0.0.0" || host === "::") return true;
+  const v4 = ipv4(host);
+  return !!v4 && v4[0] === 127;
+}
+function isPrivateHost(hostname) {
+  const host = bareHost(hostname);
+  if (host.endsWith(".internal") || host.endsWith(".local")) return true;
+  if (/^fe[89ab][0-9a-f]:/.test(host) || /^f[cd][0-9a-f]{2}:/.test(host)) return true;
+  const v4 = ipv4(host);
+  if (!v4) return false;
+  const [a, b] = v4;
+  return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254 || a === 100 && b >= 64 && b <= 127;
+}
+function validateWebhookUrl(url, nodeEnv = process.env.NODE_ENV) {
   let u;
   try {
     u = new URL(url);
   } catch {
-    return "url must be an absolute http(s) URL";
+    return "url must be an absolute https URL";
   }
-  if (u.protocol !== "https:" && u.protocol !== "http:") return "url must use http or https";
+  if (u.protocol !== "https:" && u.protocol !== "http:") return "url must use https";
+  const production = nodeEnv === "production";
+  if (isLoopbackHost(u.hostname)) return production ? "url must not point at this machine (loopback)" : void 0;
+  if (isPrivateHost(u.hostname)) return "url must not point at a link-local, private or internal network address";
+  if (u.protocol !== "https:") return "url must use https (http is allowed for localhost outside production only)";
   return void 0;
 }
 async function createWebhook(db, w) {
@@ -1802,10 +2253,28 @@ import { createHash as createHash2, randomBytes as randomBytes4, timingSafeEqual
 var b64url = (buf) => buf.toString("base64url");
 var opaqueSecret = (prefix, bytes = 32) => prefix + b64url(randomBytes4(bytes));
 var sha256hex = (s) => createHash2("sha256").update(s).digest("hex");
+var USER_CODE_PREFIX = "RLAY";
+function normalizeUserCode(input) {
+  if (!input) return void 0;
+  let s = input.toUpperCase().replace(/[\s-]+/g, "");
+  if (s.startsWith(USER_CODE_PREFIX)) s = s.slice(USER_CODE_PREFIX.length);
+  if (!s || !/^[A-Z0-9]{4,8}$/.test(s)) return void 0;
+  return `${USER_CODE_PREFIX}-${s}`;
+}
 function parseScopeParam(raw) {
   const list = Array.isArray(raw) ? raw : (raw ?? "").split(/[\s,]+/);
   return [...new Set(list.map((s) => s.trim()).filter(Boolean))];
 }
+var scopeString = (scopes) => scopes.join(" ");
+var UNITS = { s: 1, m: 60, h: 3600, d: 86400, w: 604800 };
+function parseDuration(raw) {
+  if (raw === null || raw === void 0 || raw === "") return void 0;
+  if (typeof raw === "number") return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : void 0;
+  const m = /^\s*(\d+(?:\.\d+)?)\s*([smhdw])?\s*$/i.exec(raw);
+  if (!m) return void 0;
+  const n = Number(m[1]) * UNITS[(m[2] ?? "s").toLowerCase()];
+  return n > 0 ? Math.floor(n) : void 0;
+}
 
 // ../core/src/db/oauth.ts
 var ccols = "client_id, client_secret_hash, name, redirect_uris, grant_types, token_endpoint_auth_method, scopes, software_id, client_uri, created_by, created_at";
@@ -1834,6 +2303,29 @@ async function getClient(db, clientId) {
   const r = await db.query(`SELECT ${ccols} FROM oauth_clients WHERE client_id = $1`, [clientId]);
   return r[0] ? toClient(r[0]) : void 0;
 }
+var toClientSummary = (r) => ({ ...toClient(r), live_tokens: num(r.live_tokens), pending_codes: num(r.pending_codes), live_refresh_tokens: num(r.live_refresh_tokens) });
+var scols = `${ccols.split(", ").map((c) => `c.${c}`).join(", ")},
+  (SELECT count(*) FROM tokens t WHERE t.client_id = c.client_id AND t.revoked_at IS NULL AND (t.expires_at IS NULL OR t.expires_at > $1)) AS live_tokens,
+  (SELECT count(*) FROM oauth_device_codes d WHERE d.client_id = c.client_id AND d.status IN ('pending', 'approved') AND d.expires_at > $1) AS pending_codes,
+  (SELECT count(*) FROM oauth_refresh_tokens r WHERE r.client_id = c.client_id AND r.used_at IS NULL AND r.revoked_at IS NULL AND r.expires_at > $1) AS live_refresh_tokens`;
+async function listClients(db, now = /* @__PURE__ */ new Date()) {
+  const r = await db.query(`SELECT ${scols} FROM oauth_clients c ORDER BY c.created_at DESC`, [now]);
+  return r.map(toClientSummary);
+}
+async function getClientSummary(db, clientId, now = /* @__PURE__ */ new Date()) {
+  const r = await db.query(`SELECT ${scols} FROM oauth_clients c WHERE c.client_id = $2`, [now, clientId]);
+  return r[0] ? toClientSummary(r[0]) : void 0;
+}
+async function deleteClient(db, clientId, now = /* @__PURE__ */ new Date()) {
+  const c = await getClientSummary(db, clientId, now);
+  if (!c) return void 0;
+  if (c.live_tokens || c.pending_codes || c.live_refresh_tokens) {
+    throw new Error(`client ${c.name} still has ${c.live_tokens} live token(s), ${c.pending_codes} pending code(s) and ${c.live_refresh_tokens} live refresh token(s); revoke them first`);
+  }
+  await db.query("DELETE FROM oauth_refresh_tokens WHERE client_id = $1", [clientId]);
+  await db.query("DELETE FROM oauth_clients WHERE client_id = $1", [clientId]);
+  return c;
+}
 async function clientSecretMatches(db, clientId, secret) {
   if (!secret) return false;
   const r = await db.query("SELECT client_secret_hash FROM oauth_clients WHERE client_id = $1", [clientId]);
@@ -1907,6 +2399,16 @@ async function listPendingDevices(db, now = /* @__PURE__ */ new Date()) {
   const r = await db.query(`SELECT ${dcols2} ${dfrom} WHERE d.status = 'pending' AND d.expires_at > $1 ORDER BY d.created_at DESC`, [now]);
   return r.map(toDevice);
 }
+async function listRecentDevices(db, opts) {
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const r = await db.query(
+    `SELECT ${dcols2}, t.name AS token_name ${dfrom} LEFT JOIN tokens t ON t.id = d.token_id
+     WHERE d.created_at >= $1 OR (d.status IN ('pending', 'approved') AND d.expires_at > $2)
+     ORDER BY d.created_at DESC`,
+    [opts.since, now]
+  );
+  return r.map((row) => ({ ...toDevice(row), token_name: row.token_name ?? null }));
+}
 async function touchDevicePoll(db, deviceCodeHash, now) {
   await db.query("UPDATE oauth_device_codes SET last_polled_at = $2 WHERE device_code_hash = $1", [deviceCodeHash, now]);
 }
@@ -1916,8 +2418,8 @@ async function decideDevice(db, userCode, decision) {
   if (!r[0]) return void 0;
   return getDeviceByUserCode(db, userCode);
 }
-async function redeemDevice(db, deviceCodeHash, tokenId) {
-  const r = await db.query(`UPDATE oauth_device_codes SET status = 'redeemed', token_id = $2 WHERE device_code_hash = $1 AND status = 'approved' RETURNING device_code_hash`, [deviceCodeHash, tokenId]);
+async function redeemDevice(db, deviceCodeHash, tokenId, now = /* @__PURE__ */ new Date()) {
+  const r = await db.query(`UPDATE oauth_device_codes SET status = 'redeemed', token_id = $2 WHERE device_code_hash = $1 AND status = 'approved' AND expires_at > $3 RETURNING device_code_hash`, [deviceCodeHash, tokenId, now]);
   return r.length > 0;
 }
 var rcols = "token_hash, client_id, access_token_id, scopes, actor, expires_at, rotated_from, used_at, revoked_at, created_at";
@@ -2008,12 +2510,38 @@ async function revokeInvite(db, idOrName) {
   const r = await db.query(`UPDATE invites SET revoked_at = now() WHERE revoked_at IS NULL AND (id = $1 OR name = $1) RETURNING ${icols}`, [idOrName]);
   return r[0] ? toInvite(r[0]) : void 0;
 }
+var ACCESS_CODE_RETENTION_SECONDS = 24 * 60 * 60;
+var REFRESH_TOKEN_RETENTION_SECONDS = 30 * 24 * 60 * 60;
+var ORPHAN_CLIENT_AGE_SECONDS = 24 * 60 * 60;
+async function purgeExpiredAccess(db, now = /* @__PURE__ */ new Date(), deviceGrant = "urn:ietf:params:oauth:grant-type:device_code") {
+  const codeCutoff = new Date(now.getTime() - ACCESS_CODE_RETENTION_SECONDS * 1e3);
+  const refreshCutoff = new Date(now.getTime() - REFRESH_TOKEN_RETENTION_SECONDS * 1e3);
+  const clientCutoff = new Date(now.getTime() - ORPHAN_CLIENT_AGE_SECONDS * 1e3);
+  const dev = await db.query("DELETE FROM oauth_device_codes WHERE expires_at < $1 RETURNING device_code_hash", [codeCutoff]);
+  const auth = await db.query("DELETE FROM oauth_codes WHERE expires_at < $1 RETURNING code_hash", [codeCutoff]);
+  const refresh = await db.query("DELETE FROM oauth_refresh_tokens WHERE expires_at < $1 RETURNING token_hash", [refreshCutoff]);
+  const clients = await db.query(
+    `DELETE FROM oauth_clients c
+     WHERE c.client_secret_hash IS NULL
+       AND cardinality(c.redirect_uris) = 0
+       AND $1 = ANY(c.grant_types)
+       AND c.created_at < $2
+       AND NOT EXISTS (SELECT 1 FROM tokens t WHERE t.client_id = c.client_id)
+       AND NOT EXISTS (SELECT 1 FROM oauth_refresh_tokens r WHERE r.client_id = c.client_id)
+       AND NOT EXISTS (SELECT 1 FROM oauth_device_codes d WHERE d.client_id = c.client_id AND d.expires_at > $3)
+       AND NOT EXISTS (SELECT 1 FROM oauth_codes k WHERE k.client_id = c.client_id AND k.expires_at > $3)
+     RETURNING c.name`,
+    [deviceGrant, clientCutoff, now]
+  );
+  return { device_codes: dev.length, auth_codes: auth.length, refresh_tokens: refresh.length, clients: clients.map((c) => c.name) };
+}
 
 // ../core/src/db/settings.ts
 import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes as randomBytes5 } from "crypto";
 var VERSION = "v1";
+var MIN_SETTINGS_SECRET_LENGTH = 32;
 function keyFor(secret) {
-  if (!secret || secret.length < 16) throw new Error("RELAY_SESSION_SECRET must be set to at least 16 characters to seal settings.");
+  if (!secret || secret.length < MIN_SETTINGS_SECRET_LENGTH) throw new Error(`RELAY_SESSION_SECRET must be at least ${MIN_SETTINGS_SECRET_LENGTH} characters to seal settings; generate one with \`openssl rand -hex 32\`.`);
   return createHash3("sha256").update(`relay-settings:${secret}`).digest();
 }
 function sealValue(plaintext, secret) {
@@ -2060,7 +2588,7 @@ async function listSettingKeys(db, prefix) {
 var LEASE_MS = 30 * 6e4;
 var WORKER_OFFLINE_MS = 60 * 6e4;
 var WORKER_ONLINE_MS = 2 * 6e4;
-var W = "id, name, host, lanes, labels, version, last_seen, status, created_at";
+var W = "id, name, host, lanes, labels, version, last_seen, status, poll_ms, meters, created_at";
 var arr = (v) => Array.isArray(v) ? v.map(String) : typeof v === "string" && v.startsWith("{") ? v.slice(1, -1).split(",").filter(Boolean) : [];
 var toWorker = (r) => ({
   id: r.id,
@@ -2071,6 +2599,8 @@ var toWorker = (r) => ({
   version: r.version ?? "",
   last_seen: iso(r.last_seen) ?? "",
   status: r.status === "offline" ? "offline" : "online",
+  poll_ms: r.poll_ms === null || r.poll_ms === void 0 ? null : num(r.poll_ms),
+  meters: sanitizeMeters(typeof r.meters === "string" ? JSON.parse(r.meters) : r.meters) ?? [],
   created_at: iso(r.created_at) ?? ""
 });
 var C = "id, task_id, worker_id, lease_until, claimed_at, released_at, outcome";
@@ -2111,7 +2641,13 @@ async function listWorkers(db) {
 }
 async function heartbeatWorker(db, id, opts = {}) {
   const now = opts.now ?? Date.now();
-  const r = await db.query(`UPDATE workers SET last_seen = $2::timestamptz, status = $3 WHERE id = $1 RETURNING ${W}`, [id, new Date(now).toISOString(), opts.status ?? "online"]);
+  const r = await db.query(`UPDATE workers SET last_seen = $2::timestamptz, status = $3, poll_ms = coalesce($4::integer, poll_ms), meters = coalesce($5::jsonb, meters) WHERE id = $1 RETURNING ${W}`, [
+    id,
+    new Date(now).toISOString(),
+    opts.status ?? "online",
+    opts.pollMs && Number.isFinite(opts.pollMs) ? Math.round(opts.pollMs) : null,
+    opts.meters ? JSON.stringify(sanitizeMeters(opts.meters) ?? []) : null
+  ]);
   if (!r[0]) return void 0;
   const leases = await db.query(`UPDATE claims SET lease_until = $2::timestamptz WHERE worker_id = $1 AND released_at IS NULL RETURNING ${C}`, [id, new Date(now + (opts.leaseMs ?? LEASE_MS)).toISOString()]);
   return { worker: toWorker(r[0]), leases: leases.map(toClaim) };
@@ -2122,8 +2658,34 @@ async function markOffline(db, olderThanMs = WORKER_OFFLINE_MS, now = Date.now()
 }
 async function expireLeases(db, now = Date.now()) {
   const r = await db.query(`UPDATE claims SET released_at = $1::timestamptz, outcome = 'expired' WHERE released_at IS NULL AND lease_until < $1::timestamptz RETURNING ${C}`, [new Date(now).toISOString()]);
+  if (r.length) {
+    for (const c of r) await refreshTaskState(db, c.task_id, now);
+    await bumpQueueVersion(db);
+  }
   return r.map(toClaim);
 }
+var QUEUE_KINDS2 = ["issue.labeled", "run.started", "run.dispatched", "run.failed", "run.finished", "pr.opened", "pr.merged", "pr.closed", "issue.closed", "task.approved", "task.changes_requested", "task.requeued", "task.held", "task.released"];
+async function queuedCount(db, opts = {}) {
+  const now = new Date(opts.now ?? Date.now()).toISOString();
+  const lanes = (opts.lanes ?? []).map((l) => l.trim()).filter(Boolean);
+  const params = [now, QUEUE_KINDS2];
+  const laneFilter = lanes.length ? (params.push(lanes), `AND t.lane = ANY($3::text[])`) : `AND t.lane NOT LIKE '%-cloud'`;
+  const r = await db.query(
+    `SELECT count(*) AS n FROM tasks t
+     LEFT JOIN LATERAL (SELECT e.kind FROM events e WHERE e.repo = t.repo AND e.issue = t.issue AND e.kind = ANY($2::text[]) ORDER BY e.ts DESC, e.id DESC LIMIT 1) le ON true
+     WHERE t.lane IS NOT NULL ${laneFilter}
+       AND NOT EXISTS (SELECT 1 FROM claims c WHERE c.task_id = t.id AND c.released_at IS NULL AND c.lease_until > $1::timestamptz)
+       AND (le.kind IS NULL OR le.kind IN ('issue.labeled', 'pr.closed', 'task.changes_requested', 'task.requeued', 'task.released')
+            OR (le.kind = 'run.started' AND EXISTS (SELECT 1 FROM claims c WHERE c.task_id = t.id)))`,
+    params
+  );
+  return num(r[0]?.n);
+}
+async function doorbell(db, opts = {}) {
+  const now = opts.now ?? Date.now();
+  const [version, queued] = await Promise.all([getQueueVersion(db), queuedCount(db, { ...opts.lanes ? { lanes: opts.lanes } : {}, now })]);
+  return { version, queued, ts: new Date(now).toISOString() };
+}
 function workerState(w, now = Date.now()) {
   if (w.status === "offline") return "offline";
   const age = now - new Date(w.last_seen).getTime();
@@ -2154,6 +2716,10 @@ async function liveClaim(db, taskId2, workerId) {
 }
 async function releaseClaim(db, taskId2, workerId, outcome, now = Date.now()) {
   const r = await db.query(`UPDATE claims SET released_at = $3::timestamptz, outcome = $4 WHERE task_id = $1 AND worker_id = $2 AND released_at IS NULL RETURNING ${C}`, [taskId2, workerId, new Date(now).toISOString(), outcome]);
+  if (r[0]) {
+    await refreshTaskState(db, taskId2, now);
+    await bumpQueueVersion(db);
+  }
   return r[0] ? toClaim(r[0]) : void 0;
 }
 function requiredLabels(prefs, project, lane) {
@@ -2190,7 +2756,10 @@ async function claimNext(db, req) {
     const [events, claims] = await Promise.all([taskEvents(db, task), taskClaims(db, task.id)]);
     if (deriveTaskStatus(task, events, claims, now).state !== "queued") continue;
     const claim = await takeClaim(db, task.id, req.workerId, now + (req.leaseMs ?? LEASE_MS), now);
-    if (claim) return { claim, task: { ...task, lane } };
+    if (claim) {
+      await refreshTaskState(db, task.id, now);
+      return { claim, task: { ...task, lane } };
+    }
   }
   return void 0;
 }
@@ -2258,306 +2827,47 @@ async function embedTexts(texts, cfg, ledger, tag2) {
   return out;
 }
 
-// ../core/src/brief/index.ts
-var DEFAULT_ORDER = ["preferences", "decisions", "summary", "guidance"];
-var RENDER_ORDER = ["summary", "preferences", "decisions", "guidance"];
-var SCOPE_RANK = { global: 0, project: 1, lane: 2, model: 3 };
-async function mergedPreferences(db, scope) {
-  const all = await listPreferences(db);
-  const applies = (p) => {
-    if (p.scope === "global") return true;
-    if (p.scope === "project") return !!scope.project && p.scope_id === scope.project;
-    if (p.scope === "lane") return !!scope.lane && p.scope_id === scope.lane;
-    if (p.scope === "model") return !!scope.model && p.scope_id === scope.model;
-    return false;
-  };
-  const byKey = /* @__PURE__ */ new Map();
-  for (const p of all) {
-    if (!applies(p)) continue;
-    const cur = byKey.get(p.key);
-    if (!cur || SCOPE_RANK[p.scope] > SCOPE_RANK[cur.scope]) byKey.set(p.key, p);
-  }
-  return [...byKey.values()].sort((a, b) => a.key.localeCompare(b.key));
-}
-function renderPreference(p) {
-  const where = p.scope === "global" ? "" : ` (${p.scope}${p.scope_id ? `: ${p.scope_id}` : ""})`;
-  return `- ${p.key} = ${p.value}${where}${p.reason ? ` \u2014 ${p.reason}` : ""}`;
-}
-function renderDecision(d) {
-  const src = d.source ? ` [${d.source}${d.source_ref ? ` ${shortRef(d.source_ref)}` : ""}]` : "";
-  return `- ${d.text}${src}`;
+// ../core/src/github/client.ts
+import { execFile } from "child_process";
+import { delimiter, join as join6 } from "path";
+import { statSync } from "fs";
+
+// ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/buffer_utils.js
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var strictDecoder = new TextDecoder("utf-8", { fatal: true });
+var MAX_INT32 = 2 ** 32;
+function concat(...buffers) {
+  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
+  let i = 0;
+  for (const buffer of buffers)
+    buf.set(buffer, i), i += buffer.length;
+  return buf;
 }
-var shortRef = (ref) => ref.length > 40 ? ref.slice(0, 37) + "\u2026" : ref;
-async function matchingDecisions(db, project, query, opts = {}) {
-  const k = opts.k ?? 12;
-  let hits = [];
-  if (opts.embed) {
-    const v = await opts.embed(query).catch(() => null);
-    if (v) hits = await searchDecisions(db, project, v, k);
+var NON_ASCII = /[^\x00-\x7f]/;
+function encode(string) {
+  if (typeof string == "string" && string.length >= 128) {
+    if (NON_ASCII.test(string))
+      throw new TypeError("non-ASCII string encountered in encode()");
+    return encoder.encode(string);
   }
-  if (!hits.length && query.trim()) hits = await searchDecisions(db, project, query, k);
-  if (hits.length < k) {
-    const seen2 = new Set(hits.map((h) => h.id));
-    const recent = await listDecisions(db, project, { current: true, limit: k });
-    for (const r of recent) if (!seen2.has(r.id) && hits.length < k) hits.push(r);
+  const bytes = new Uint8Array(string.length);
+  for (let i = 0; i < string.length; i++) {
+    const code = string.charCodeAt(i);
+    if (code > 127)
+      throw new TypeError("non-ASCII string encountered in encode()");
+    bytes[i] = code;
   }
-  const globals = await listDecisions(db, null, { current: true, limit: 4 });
-  const seen = new Set(hits.map((h) => h.id));
-  for (const g of globals) if (!seen.has(g.id)) hits.push(g);
-  return hits;
+  return bytes;
 }
-async function matchingGuidance(db, model, query, opts) {
-  const k = opts.k ?? 8;
-  let hits = [];
-  if (opts.embed) {
-    const v = await opts.embed(query).catch(() => null);
-    if (v) hits = await vectorSearchGuidance(db, model, v, k);
-  }
-  if (!hits.length) hits = await textSearchGuidance(db, model, query, k);
-  return hits;
-}
-function fitItems(items, render, budget) {
-  const lines = [];
-  let used = 0;
-  for (const it of items) {
-    const line = render(it);
-    const t = approxTokens(line + "\n");
-    if (used + t > budget) continue;
-    lines.push(line);
-    used += t;
-  }
-  return { lines, tokens: used };
-}
-var heading = (title) => `## ${title}
-
-`;
-async function compileBrief(db, opts) {
-  const order = opts.sections ?? DEFAULT_ORDER;
-  const query = [opts.issue?.title, opts.issue?.body, opts.intent].filter(Boolean).join("\n").slice(0, 4e3);
-  const project = await getProject(db, opts.project);
-  const rendered = /* @__PURE__ */ new Map();
-  const omitted = [];
-  let remaining = Math.max(0, opts.maxTokens);
-  for (const name of order) {
-    let text3 = "";
-    if (name === "summary") {
-      if (project?.summary) text3 = heading(`Project: ${project.slug}`) + project.summary.trim() + "\n";
-      const t = approxTokens(text3);
-      if (!text3 || t > remaining) {
-        omitted.push(name);
-        continue;
-      }
-      rendered.set(name, { text: text3, tokens: t });
-      remaining -= t;
-    } else if (name === "preferences") {
-      const prefs = await mergedPreferences(db, { project: opts.project, ...opts.lane ? { lane: opts.lane } : {}, ...opts.model ? { model: opts.model } : {} });
-      if (prefs.length) text3 = heading("Preferences (hard rules)") + prefs.map(renderPreference).join("\n") + "\n";
-      const t = approxTokens(text3);
-      if (!text3 || t > remaining) {
-        omitted.push(name);
-        continue;
-      }
-      rendered.set(name, { text: text3, tokens: t });
-      remaining -= t;
-    } else if (name === "decisions") {
-      const head = heading("Current decisions");
-      const headT = approxTokens(head);
-      const items = await matchingDecisions(db, opts.project, query, { embed: opts.embed, ...opts.k ? { k: opts.k } : {} });
-      const fit = fitItems(items, renderDecision, remaining - headT);
-      if (!fit.lines.length) {
-        omitted.push(name);
-        continue;
-      }
-      text3 = head + fit.lines.join("\n") + "\n";
-      const t = approxTokens(text3);
-      rendered.set(name, { text: text3, tokens: t });
-      remaining -= t;
-    } else if (name === "guidance") {
-      if (!opts.model) {
-        omitted.push(name);
-        continue;
-      }
-      const head = heading(`Vendor guidance for ${opts.model}`);
-      const headT = approxTokens(head);
-      const hits = await matchingGuidance(db, opts.model, query, { embed: opts.embed, ...opts.k ? { k: opts.k } : {} });
-      const fit = fitItems(hits, (h) => `### ${h.title} (${h.kind})
-${h.text.trim()}
-Source: ${h.source_url}
-`, remaining - headT);
-      if (!fit.lines.length) {
-        omitted.push(name);
-        continue;
-      }
-      text3 = head + fit.lines.join("\n") + "\n";
-      const t = approxTokens(text3);
-      rendered.set(name, { text: text3, tokens: t });
-      remaining -= t;
-    }
-  }
-  const parts = [];
-  const sections = [];
-  for (const name of RENDER_ORDER) {
-    const r = rendered.get(name);
-    if (!r) continue;
-    parts.push(r.text);
-    sections.push({ name, tokens: r.tokens });
-  }
-  const text2 = parts.join("\n").trimEnd() + (parts.length ? "\n" : "");
-  return { text: text2, sections, tokens: approxTokens(text2), omitted };
-}
-function briefEmbedder(h) {
-  if (!h.cfg.gateway.apiKey) return void 0;
-  return async (text2) => {
-    const v = await embedTexts([text2], h.cfg, h.ledger, "brief");
-    return v?.[0] ?? null;
-  };
-}
-
-// ../core/src/client/device.ts
-var OAuthClientError = class extends Error {
-  constructor(code, description, status) {
-    super(description || code);
-    this.code = code;
-    this.description = description;
-    this.status = status;
-    this.name = "OAuthClientError";
-  }
-  code;
-  description;
-  status;
-};
-var defaultFetch = (u, i) => fetch(u, i);
-async function post(fetchImpl, url, body) {
-  const form = new URLSearchParams();
-  for (const [k, v] of Object.entries(body)) if (v !== void 0 && v !== "") form.set(k, v);
-  const res = await fetchImpl(url, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json", "user-agent": "relay-cli" }, body: form.toString() });
-  const text2 = await res.text();
-  let json2 = {};
-  try {
-    json2 = text2 ? JSON.parse(text2) : {};
-  } catch {
-    json2 = { error: "server_error", error_description: text2.slice(0, 200) };
-  }
-  if (!res.ok) throw new OAuthClientError(String(json2.error ?? `http_${res.status}`), String(json2.error_description ?? json2.detail ?? ""), res.status);
-  return json2;
-}
-var asToken = (j) => {
-  if (typeof j.access_token !== "string") throw new OAuthClientError("server_error", "The token response carried no access_token.", 502);
-  return {
-    access_token: j.access_token,
-    token_type: String(j.token_type ?? "Bearer"),
-    expires_in: Number(j.expires_in ?? 0),
-    ...typeof j.refresh_token === "string" ? { refresh_token: j.refresh_token } : {},
-    ...typeof j.scope === "string" ? { scope: j.scope } : {},
-    ...typeof j.token_name === "string" ? { token_name: j.token_name } : {},
-    ...typeof j.expires_at === "string" ? { expires_at: j.expires_at } : {}
-  };
-};
-async function refreshAccessToken(opts) {
-  return asToken(await post(opts.fetch ?? defaultFetch, `${normalizeSite(opts.site)}/oauth/token`, { grant_type: "refresh_token", refresh_token: opts.refreshToken }));
-}
-function credentialsFromToken(r, now = Date.now()) {
-  const expiresAt = r.expires_at ?? (r.expires_in > 0 ? new Date(now + r.expires_in * 1e3).toISOString() : null);
-  return { token: r.access_token, refreshToken: r.refresh_token ?? null, expiresAt };
-}
-function tokenIsStale(expiresAt, now = Date.now(), marginMs = 12e4) {
-  if (!expiresAt) return false;
-  const t = new Date(expiresAt).getTime();
-  return Number.isFinite(t) && t - now < marginMs;
-}
-
-// ../core/src/db/migrate.ts
-import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync3 } from "fs";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname3, join as join5 } from "path";
-var beside = join5(dirname3(fileURLToPath2(import.meta.url)), "migrations");
-var MIGRATIONS_DIR = existsSync4(beside) ? beside : runtimePaths().migrationsDir;
-function loadMigrations(dir = MIGRATIONS_DIR) {
-  const out = [];
-  for (const f of readdirSync(dir).sort()) {
-    const m = /^(\d{3,})_([\w-]+)\.sql$/.exec(f);
-    if (!m) continue;
-    out.push({ version: Number(m[1]), name: m[2], sql: readFileSync3(join5(dir, f), "utf8") });
-  }
-  const seen = /* @__PURE__ */ new Set();
-  for (const m of out) {
-    if (seen.has(m.version)) throw new Error(`duplicate migration version ${m.version}`);
-    seen.add(m.version);
-  }
-  return out;
-}
-var META_DDL = `CREATE TABLE IF NOT EXISTS meta (
-  key text PRIMARY KEY,
-  value jsonb NOT NULL,
-  updated_at timestamptz NOT NULL DEFAULT now()
-)`;
-async function currentVersion(db) {
-  await db.exec(META_DDL);
-  const r = await db.query("SELECT value FROM meta WHERE key = 'schema_version'");
-  const v = r[0]?.value;
-  return typeof v === "number" ? v : typeof v === "string" ? Number(v) || 0 : 0;
-}
-async function migrate(db, opts = {}) {
-  const log = opts.log ?? noopLog;
-  const have = await currentVersion(db);
-  let applied = have;
-  for (const m of loadMigrations(opts.dir)) {
-    if (m.version <= have) continue;
-    log(`schema: applying ${String(m.version).padStart(3, "0")}_${m.name}`);
-    await db.transaction(async (tx) => {
-      await tx.exec(m.sql);
-      await tx.query(
-        `INSERT INTO meta (key, value, updated_at) VALUES ('schema_version', $1::jsonb, now())
-         ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = now()`,
-        [JSON.stringify(m.version)]
-      );
-    });
-    applied = m.version;
-  }
-  return applied;
-}
-
-// ../core/src/github/client.ts
-import { execFile } from "child_process";
-import { delimiter, join as join6 } from "path";
-import { statSync } from "fs";
-
-// ../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/buffer_utils.js
-var encoder = new TextEncoder();
-var decoder = new TextDecoder();
-var strictDecoder = new TextDecoder("utf-8", { fatal: true });
-var MAX_INT32 = 2 ** 32;
-function concat(...buffers) {
-  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
-  let i = 0;
-  for (const buffer of buffers)
-    buf.set(buffer, i), i += buffer.length;
-  return buf;
-}
-var NON_ASCII = /[^\x00-\x7f]/;
-function encode(string) {
-  if (typeof string == "string" && string.length >= 128) {
-    if (NON_ASCII.test(string))
-      throw new TypeError("non-ASCII string encountered in encode()");
-    return encoder.encode(string);
-  }
-  const bytes = new Uint8Array(string.length);
-  for (let i = 0; i < string.length; i++) {
-    const code = string.charCodeAt(i);
-    if (code > 127)
-      throw new TypeError("non-ASCII string encountered in encode()");
-    bytes[i] = code;
-  }
-  return bytes;
-}
-function encodeBase64(input, url = false) {
-  if (Uint8Array.prototype.toBase64)
-    return input.toBase64({ alphabet: url ? "base64url" : "base64", omitPadding: url });
-  const CHUNK_SIZE = 32768, arr2 = [];
-  for (let i = 0; i < input.length; i += CHUNK_SIZE)
-    arr2.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-  const encoded = btoa(arr2.join(""));
-  return url ? encoded.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : encoded;
+function encodeBase64(input, url = false) {
+  if (Uint8Array.prototype.toBase64)
+    return input.toBase64({ alphabet: url ? "base64url" : "base64", omitPadding: url });
+  const CHUNK_SIZE = 32768, arr2 = [];
+  for (let i = 0; i < input.length; i += CHUNK_SIZE)
+    arr2.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+  const encoded = btoa(arr2.join(""));
+  return url ? encoded.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : encoded;
 }
 function decodeBase64(encoded, url = false) {
   if (Uint8Array.fromBase64)
@@ -3364,8 +3674,12 @@ var GitHubApp = class {
       source: "app",
       createIssue: async (repo, input) => (await perRepo(repo)).createIssue(repo, input),
       addLabels: async (repo, issue, labels) => (await perRepo(repo)).addLabels(repo, issue, labels),
+      removeLabel: async (repo, issue, label) => (await perRepo(repo)).removeLabel(repo, issue, label),
       getIssue: async (repo, issue) => (await perRepo(repo)).getIssue(repo, issue),
       createComment: async (repo, issue, body) => (await perRepo(repo)).createComment(repo, issue, body),
+      getPullRequest: async (repo, number) => (await perRepo(repo)).getPullRequest(repo, number),
+      mergePullRequest: async (repo, number, o) => (await perRepo(repo)).mergePullRequest(repo, number, o),
+      deleteBranch: async (repo, ref) => (await perRepo(repo)).deleteBranch(repo, ref),
       request: async (method, path, body) => (await perRepo(repoOfPath(path))).request(method, path, body)
     };
   }
@@ -3373,6 +3687,62 @@ var GitHubApp = class {
 
 // ../core/src/github/client.ts
 var toComment = (j) => ({ id: Number(j.id ?? 0), html_url: String(j.html_url ?? "") });
+function toPull(j) {
+  const head = j.head ?? {};
+  const base = j.base ?? {};
+  const user = j.user ?? {};
+  return {
+    number: Number(j.number),
+    title: String(j.title ?? ""),
+    state: String(j.state ?? ""),
+    merged: Boolean(j.merged),
+    html_url: String(j.html_url ?? ""),
+    head_ref: String(head.ref ?? ""),
+    head_sha: String(head.sha ?? ""),
+    base_ref: String(base.ref ?? ""),
+    user: String(user.login ?? "")
+  };
+}
+var toMerge = (j) => ({ sha: String(j.sha ?? ""), merged: Boolean(j.merged), message: String(j.message ?? "") });
+var mergeBody = (o) => ({
+  merge_method: o.method ?? "squash",
+  ...o.title ? { commit_title: o.title } : {},
+  ...o.message ? { commit_message: o.message } : {},
+  ...o.sha ? { sha: o.sha } : {}
+});
+async function removeLabelWith(call, repo, issue, label) {
+  assertRepo(repo);
+  if (!label.trim()) return;
+  try {
+    await call("DELETE", `/repos/${repo}/issues/${issue}/labels/${encodeURIComponent(label)}`);
+  } catch (e) {
+    if (e instanceof GitHubError && e.status === 404) return;
+    throw e;
+  }
+}
+function pullOps(call) {
+  return {
+    async getPullRequest(repo, number) {
+      assertRepo(repo);
+      return toPull(await call("GET", `/repos/${repo}/pulls/${number}`));
+    },
+    async mergePullRequest(repo, number, opts = {}) {
+      assertRepo(repo);
+      return toMerge(await call("PUT", `/repos/${repo}/pulls/${number}/merge`, mergeBody(opts)));
+    },
+    async deleteBranch(repo, ref) {
+      assertRepo(repo);
+      const name = ref.replace(/^refs\/heads\//, "");
+      if (!name || /[\s~^:?*[\\]/.test(name)) throw new GitHubError(`branch name is not valid: ${ref}`);
+      try {
+        await call("DELETE", `/repos/${repo}/git/refs/heads/${name}`);
+      } catch (e) {
+        if (e instanceof GitHubError && (e.status === 404 || e.status === 422)) return;
+        throw e;
+      }
+    }
+  };
+}
 var GitHubError = class extends Error {
   constructor(message2, status) {
     super(message2);
@@ -3411,6 +3781,7 @@ function githubFromToken(token, fetchImpl = (u, i) => fetch(u, i), apiUrl = API)
       if (!labels.length) return;
       await call("POST", `/repos/${repo}/issues/${issue}/labels`, { labels });
     },
+    removeLabel: (repo, issue, label) => removeLabelWith(call, repo, issue, label),
     async getIssue(repo, issue) {
       assertRepo(repo);
       return toIssue(await call("GET", `/repos/${repo}/issues/${issue}`));
@@ -3419,7 +3790,8 @@ function githubFromToken(token, fetchImpl = (u, i) => fetch(u, i), apiUrl = API)
     async createComment(repo, issue, body) {
       assertRepo(repo);
       return toComment(await call("POST", `/repos/${repo}/issues/${issue}/comments`, { body }));
-    }
+    },
+    ...pullOps(call)
   };
 }
 var envApp;
@@ -3446,7 +3818,11 @@ function githubFromGh(bin = findOnPath("gh") ?? "gh") {
     const args = ["api", "-X", method, "-H", "Accept: application/vnd.github+json", path];
     if (body !== void 0) args.push("--input", "-");
     const child = execFile(bin, args, { encoding: "utf8", timeout: 3e4, maxBuffer: 4 * 1024 * 1024, env: process.env }, (err, stdout, stderr) => {
-      if (err) return rej(new GitHubError(`gh api ${method} ${path} failed: ${(stderr || err.message).toString().split("\n")[0]?.slice(0, 200)}`));
+      if (err) {
+        const first = (stderr || err.message).toString().split("\n")[0] ?? "";
+        const status = /HTTP (\d{3})/.exec(first)?.[1];
+        return rej(new GitHubError(`gh api ${method} ${path} failed: ${first.slice(0, 200)}`, status ? Number(status) : void 0));
+      }
       try {
         res(stdout.trim() ? JSON.parse(stdout) : {});
       } catch (e) {
@@ -3466,6 +3842,7 @@ function githubFromGh(bin = findOnPath("gh") ?? "gh") {
       if (!labels.length) return;
       await api("POST", `/repos/${repo}/issues/${issue}/labels`, { labels });
     },
+    removeLabel: (repo, issue, label) => removeLabelWith(api, repo, issue, label),
     async getIssue(repo, issue) {
       assertRepo(repo);
       return toIssue(await api("GET", `/repos/${repo}/issues/${issue}`));
@@ -3474,7 +3851,8 @@ function githubFromGh(bin = findOnPath("gh") ?? "gh") {
     async createComment(repo, issue, body) {
       assertRepo(repo);
       return toComment(await api("POST", `/repos/${repo}/issues/${issue}/comments`, { body }));
-    }
+    },
+    ...pullOps(api)
   };
 }
 function detectGitHub(env = process.env, opts = {}) {
@@ -3490,57 +3868,838 @@ function detectGitHub(env = process.env, opts = {}) {
   return void 0;
 }
 
-// ../core/src/oauth/server.ts
-import { randomBytes as randomBytes6 } from "crypto";
-var ACCESS_TOKEN_TTL_SECONDS = 24 * 60 * 60;
-var REFRESH_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;
-var AUTH_CODE_TTL_SECONDS = 10 * 60;
-var DEVICE_CODE_TTL_SECONDS = 15 * 60;
-var INVITE_DEFAULT_TTL_SECONDS = 24 * 60 * 60;
-var OAuthError = class extends Error {
-  constructor(code, description, status = 400) {
-    super(`${code}: ${description}`);
-    this.code = code;
-    this.description = description;
+// ../core/src/tasks/review.ts
+var TaskReviewError = class extends Error {
+  constructor(message2, status = 400) {
+    super(message2);
+    this.status = status;
+    this.name = "TaskReviewError";
+  }
+  status;
+};
+var nameOf = (actor) => actor.slice(actor.indexOf(":") + 1).replace(/^oauth:/, "").toLowerCase();
+var REVIEWERS_TEXT = "a signed-in person, or a bot whose token holds tasks:write and that did not produce the PR itself";
+async function assertReviewable(db, task, actor, opts, verb) {
+  const [events, claims] = await Promise.all([taskEvents(db, task), taskClaims(db, task.id)]);
+  const status = deriveTaskStatus(task, events, claims);
+  if (!actor.startsWith("human:")) {
+    if (opts.scopes && !opts.scopes.includes("tasks:write")) throw new TaskReviewError(`${actor} cannot ${verb} ${task.id}: its token lacks tasks:write. Who can: ${REVIEWERS_TEXT}.`, 403);
+    const me = nameOf(actor);
+    const produced = events.some((e) => (e.kind === "run.started" || e.kind === "pr.opened" || e.kind === "run.finished") && nameOf(e.actor) === me);
+    if (produced) throw new TaskReviewError(`${actor} cannot ${verb} ${task.id}: it produced this PR. A bot never approves its own work; who can: ${REVIEWERS_TEXT}.`, 403);
+  }
+  if (status.state !== "review") throw new TaskReviewError(`${task.id} is ${status.state}, not in review; only a task in review with an open PR can be ${verb === "approve" ? "approved" : "sent back"}.`, 409);
+  if (status.pr == null) throw new TaskReviewError(`${task.id} is in review but relay has no pull request for it yet (pr.opened has not arrived).`, 409);
+  return { status, events };
+}
+async function loadTask(db, taskId2) {
+  const task = await getTask(db, taskId2.trim());
+  if (!task) throw new TaskReviewError(`No task ${taskId2}.`, 404);
+  return task;
+}
+async function approveTask(db, github, taskId2, actor, opts = {}) {
+  const task = await loadTask(db, taskId2);
+  const { status } = await assertReviewable(db, task, actor, opts, "approve");
+  if (!github) throw new TaskReviewError("No GitHub credential: set GITHUB_TOKEN (web) or log in with gh (CLI).", 503);
+  const number = status.pr;
+  const events = [];
+  const base = { actor, project: task.project, repo: task.repo, issue: task.issue, lane: status.lane, pr: number };
+  let pull;
+  try {
+    pull = await github.getPullRequest(task.repo, number);
+  } catch (e) {
+    throw new TaskReviewError(`GitHub could not read PR #${number} of ${task.repo}: ${describe(e)}`, 502);
+  }
+  if (pull.merged) throw new TaskReviewError(`PR #${number} is already merged; relay is waiting for GitHub's pr.merged.`, 409);
+  if (pull.state !== "open") throw new TaskReviewError(`PR #${number} is ${pull.state}, not open.`, 409);
+  const method = opts.method ?? "squash";
+  let merge;
+  try {
+    merge = await github.mergePullRequest(task.repo, number, {
+      method,
+      title: `${pull.title} (#${number})`,
+      message: `relay: approved by ${actor}
+
+Closes #${task.issue}`,
+      sha: pull.head_sha
+    });
+  } catch (e) {
+    const reason = describe(e);
+    const failed = await writeEvent(db, {
+      ...base,
+      kind: "task.merge_failed",
+      summary: `Merge of #${number} refused: ${reason}`.slice(0, 500),
+      url: pull.html_url,
+      payload: { error: reason, method, head_sha: pull.head_sha, status: e instanceof GitHubError ? e.status ?? null : null }
+    });
+    if (failed) events.push(failed);
+    throw new TaskReviewError(`GitHub refused to merge #${number}: ${reason}`, 502);
+  }
+  let branchDeleted = false;
+  if (!opts.keepBranch && pull.head_ref) {
+    try {
+      await github.deleteBranch(task.repo, pull.head_ref);
+      branchDeleted = true;
+    } catch {
+      branchDeleted = false;
+    }
+  }
+  const approved = await writeEvent(db, {
+    ...base,
+    kind: "task.approved",
+    summary: `Approved and merged #${number}${merge.sha ? ` (${merge.sha.slice(0, 7)})` : ""}`,
+    url: pull.html_url,
+    payload: { merged: true, merge_sha: merge.sha, method, branch: pull.head_ref, branch_deleted: branchDeleted, pr_title: pull.title },
+    dedupe_key: `task:${task.id}:approved:${merge.sha || number}`
+  });
+  if (approved) events.push(approved);
+  return { task: await taskView(db, task), events };
+}
+async function requestChanges(db, github, taskId2, actor, note, opts = {}) {
+  const text2 = note.trim();
+  if (!text2) throw new TaskReviewError("A note is required: say what should change.", 400);
+  if (text2.length > 1e4) throw new TaskReviewError("The note must be at most 10000 characters.", 400);
+  const task = await loadTask(db, taskId2);
+  const { status } = await assertReviewable(db, task, actor, opts, "request changes on");
+  if (!github) throw new TaskReviewError("No GitHub credential: set GITHUB_TOKEN (web) or log in with gh (CLI).", 503);
+  const number = status.pr;
+  let comment;
+  try {
+    comment = await github.createComment(task.repo, number, `relay: changes requested by ${actor}:
+
+${text2}
+`);
+  } catch (e) {
+    throw new TaskReviewError(`GitHub refused the comment on #${number}: ${describe(e)}`, 502);
+  }
+  const events = [];
+  const row = await writeEvent(db, {
+    actor,
+    project: task.project,
+    repo: task.repo,
+    issue: task.issue,
+    lane: status.lane,
+    pr: number,
+    kind: "task.changes_requested",
+    summary: `Changes requested on #${number}: ${text2.split("\n").find((l) => l.trim()) ?? ""}`.slice(0, 500),
+    url: comment.html_url || status.pr_url,
+    payload: { note: text2, comment_id: comment.id, comment_url: comment.html_url, branch: status.branch }
+  });
+  if (row) events.push(row);
+  await bumpQueueVersion(db);
+  return { task: await taskView(db, task), events };
+}
+async function reviewNotes(db, task, limit = 5) {
+  const r = await db.query(
+    `SELECT actor, ts, pr, payload FROM events WHERE kind = 'task.changes_requested' AND issue = $3 AND (repo = $1 OR (repo IS NULL AND project = $2)) ORDER BY ts DESC, id DESC LIMIT $4`,
+    [task.repo, task.project, task.issue, limit]
+  );
+  return r.map((x) => {
+    const payload = typeof x.payload === "string" ? JSON.parse(x.payload) : x.payload ?? {};
+    return { by: x.actor, at: x.ts instanceof Date ? x.ts.toISOString() : String(x.ts), pr: x.pr == null ? null : Number(x.pr), note: typeof payload.note === "string" ? payload.note : "" };
+  }).filter((n) => n.note).reverse();
+}
+var describe = (e) => (e instanceof Error ? e.message : String(e)).slice(0, 300);
+
+// ../core/src/brief/index.ts
+var DEFAULT_ORDER = ["review", "preferences", "decisions", "summary", "guidance"];
+var RENDER_ORDER = ["review", "summary", "preferences", "decisions", "guidance"];
+var SCOPE_RANK = { global: 0, project: 1, lane: 2, model: 3 };
+async function mergedPreferences(db, scope) {
+  const all = await listPreferences(db);
+  const applies = (p) => {
+    if (p.scope === "global") return true;
+    if (p.scope === "project") return !!scope.project && p.scope_id === scope.project;
+    if (p.scope === "lane") return !!scope.lane && p.scope_id === scope.lane;
+    if (p.scope === "model") return !!scope.model && p.scope_id === scope.model;
+    return false;
+  };
+  const byKey = /* @__PURE__ */ new Map();
+  for (const p of all) {
+    if (!applies(p)) continue;
+    const cur = byKey.get(p.key);
+    if (!cur || SCOPE_RANK[p.scope] > SCOPE_RANK[cur.scope]) byKey.set(p.key, p);
+  }
+  return [...byKey.values()].sort((a, b) => a.key.localeCompare(b.key));
+}
+function renderPreference(p) {
+  const where = p.scope === "global" ? "" : ` (${p.scope}${p.scope_id ? `: ${p.scope_id}` : ""})`;
+  return `- ${p.key} = ${p.value}${where}${p.reason ? ` \u2014 ${p.reason}` : ""}`;
+}
+function renderDecision(d) {
+  const src = d.source ? ` [${d.source}${d.source_ref ? ` ${shortRef(d.source_ref)}` : ""}]` : "";
+  return `- ${d.text}${src}`;
+}
+var shortRef = (ref) => ref.length > 40 ? ref.slice(0, 37) + "\u2026" : ref;
+async function matchingDecisions(db, project, query, opts = {}) {
+  const k = opts.k ?? 12;
+  let hits = [];
+  if (opts.embed) {
+    const v = await opts.embed(query).catch(() => null);
+    if (v) hits = await searchDecisions(db, project, v, k);
+  }
+  if (!hits.length && query.trim()) hits = await searchDecisions(db, project, query, k);
+  if (hits.length < k) {
+    const seen2 = new Set(hits.map((h) => h.id));
+    const recent = await listDecisions(db, project, { current: true, limit: k });
+    for (const r of recent) if (!seen2.has(r.id) && hits.length < k) hits.push(r);
+  }
+  const globals = await listDecisions(db, null, { current: true, limit: 4 });
+  const seen = new Set(hits.map((h) => h.id));
+  for (const g of globals) if (!seen.has(g.id)) hits.push(g);
+  return hits;
+}
+async function matchingGuidance(db, model, query, opts) {
+  const k = opts.k ?? 8;
+  let hits = [];
+  if (opts.embed) {
+    const v = await opts.embed(query).catch(() => null);
+    if (v) hits = await vectorSearchGuidance(db, model, v, k);
+  }
+  if (!hits.length) hits = await textSearchGuidance(db, model, query, k);
+  return hits;
+}
+function fitItems(items, render, budget) {
+  const lines = [];
+  let used = 0;
+  for (const it of items) {
+    const line = render(it);
+    const t = approxTokens(line + "\n");
+    if (used + t > budget) continue;
+    lines.push(line);
+    used += t;
+  }
+  return { lines, tokens: used };
+}
+var heading = (title) => `## ${title}
+
+`;
+async function compileBrief(db, opts) {
+  const order = opts.sections ?? DEFAULT_ORDER;
+  const query = [opts.issue?.title, opts.issue?.body, opts.intent].filter(Boolean).join("\n").slice(0, 4e3);
+  const project = await getProject(db, opts.project);
+  const rendered = /* @__PURE__ */ new Map();
+  const omitted = [];
+  let remaining = Math.max(0, opts.maxTokens);
+  for (const name of order) {
+    let text3 = "";
+    if (name === "review") {
+      if (project && opts.issue?.number != null) {
+        const notes = await reviewNotes(db, { repo: project.repo ?? "", project: project.slug, issue: opts.issue.number });
+        if (notes.length) {
+          text3 = heading("Review feedback") + `A reviewer sent the pull request for #${opts.issue.number} back. Address every point below; the branch and PR already exist and this run replaces the branch.
+
+` + notes.map((n) => `- ${n.at.slice(0, 16)} ${n.by}${n.pr ? ` on PR #${n.pr}` : ""}:
+  ${n.note.trim().replace(/\n/g, "\n  ")}`).join("\n") + "\n";
+        }
+      }
+      const t = approxTokens(text3);
+      if (!text3 || t > remaining) {
+        omitted.push(name);
+        continue;
+      }
+      rendered.set(name, { text: text3, tokens: t });
+      remaining -= t;
+    } else if (name === "summary") {
+      if (project?.summary) text3 = heading(`Project: ${project.slug}`) + project.summary.trim() + "\n";
+      const t = approxTokens(text3);
+      if (!text3 || t > remaining) {
+        omitted.push(name);
+        continue;
+      }
+      rendered.set(name, { text: text3, tokens: t });
+      remaining -= t;
+    } else if (name === "preferences") {
+      const prefs = await mergedPreferences(db, { project: opts.project, ...opts.lane ? { lane: opts.lane } : {}, ...opts.model ? { model: opts.model } : {} });
+      if (prefs.length) text3 = heading("Preferences (hard rules)") + prefs.map(renderPreference).join("\n") + "\n";
+      const t = approxTokens(text3);
+      if (!text3 || t > remaining) {
+        omitted.push(name);
+        continue;
+      }
+      rendered.set(name, { text: text3, tokens: t });
+      remaining -= t;
+    } else if (name === "decisions") {
+      const head = heading("Current decisions");
+      const headT = approxTokens(head);
+      const items = await matchingDecisions(db, opts.project, query, { embed: opts.embed, ...opts.k ? { k: opts.k } : {} });
+      const fit = fitItems(items, renderDecision, remaining - headT);
+      if (!fit.lines.length) {
+        omitted.push(name);
+        continue;
+      }
+      text3 = head + fit.lines.join("\n") + "\n";
+      const t = approxTokens(text3);
+      rendered.set(name, { text: text3, tokens: t });
+      remaining -= t;
+    } else if (name === "guidance") {
+      if (!opts.model) {
+        omitted.push(name);
+        continue;
+      }
+      const head = heading(`Vendor guidance for ${opts.model}`);
+      const headT = approxTokens(head);
+      const hits = await matchingGuidance(db, opts.model, query, { embed: opts.embed, ...opts.k ? { k: opts.k } : {} });
+      const fit = fitItems(hits, (h) => `### ${h.title} (${h.kind})
+${h.text.trim()}
+Source: ${h.source_url}
+`, remaining - headT);
+      if (!fit.lines.length) {
+        omitted.push(name);
+        continue;
+      }
+      text3 = head + fit.lines.join("\n") + "\n";
+      const t = approxTokens(text3);
+      rendered.set(name, { text: text3, tokens: t });
+      remaining -= t;
+    }
+  }
+  const parts = [];
+  const sections = [];
+  for (const name of RENDER_ORDER) {
+    const r = rendered.get(name);
+    if (!r) continue;
+    parts.push(r.text);
+    sections.push({ name, tokens: r.tokens });
+  }
+  const text2 = parts.join("\n").trimEnd() + (parts.length ? "\n" : "");
+  return { text: text2, sections, tokens: approxTokens(text2), omitted };
+}
+function briefEmbedder(h) {
+  if (!h.cfg.gateway.apiKey) return void 0;
+  return async (text2) => {
+    const v = await embedTexts([text2], h.cfg, h.ledger, "brief");
+    return v?.[0] ?? null;
+  };
+}
+
+// ../core/src/client/device.ts
+var OAuthClientError = class extends Error {
+  constructor(code, description, status) {
+    super(description || code);
+    this.code = code;
+    this.description = description;
+    this.status = status;
+    this.name = "OAuthClientError";
+  }
+  code;
+  description;
+  status;
+};
+var defaultFetch = (u, i) => fetch(u, i);
+async function post(fetchImpl, url, body) {
+  const form = new URLSearchParams();
+  for (const [k, v] of Object.entries(body)) if (v !== void 0 && v !== "") form.set(k, v);
+  const res = await fetchImpl(url, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json", "user-agent": "relay-cli" }, body: form.toString() });
+  const text2 = await res.text();
+  let json2 = {};
+  try {
+    json2 = text2 ? JSON.parse(text2) : {};
+  } catch {
+    json2 = { error: "server_error", error_description: text2.slice(0, 200) };
+  }
+  if (!res.ok) throw new OAuthClientError(String(json2.error ?? `http_${res.status}`), String(json2.error_description ?? json2.detail ?? ""), res.status);
+  return json2;
+}
+var asToken = (j) => {
+  if (typeof j.access_token !== "string") throw new OAuthClientError("server_error", "The token response carried no access_token.", 502);
+  return {
+    access_token: j.access_token,
+    token_type: String(j.token_type ?? "Bearer"),
+    expires_in: Number(j.expires_in ?? 0),
+    ...typeof j.refresh_token === "string" ? { refresh_token: j.refresh_token } : {},
+    ...typeof j.scope === "string" ? { scope: j.scope } : {},
+    ...typeof j.token_name === "string" ? { token_name: j.token_name } : {},
+    ...typeof j.expires_at === "string" ? { expires_at: j.expires_at } : {}
+  };
+};
+async function refreshAccessToken(opts) {
+  return asToken(await post(opts.fetch ?? defaultFetch, `${normalizeSite(opts.site)}/oauth/token`, { grant_type: "refresh_token", refresh_token: opts.refreshToken }));
+}
+function credentialsFromToken(r, now = Date.now()) {
+  const expiresAt = r.expires_at ?? (r.expires_in > 0 ? new Date(now + r.expires_in * 1e3).toISOString() : null);
+  return { token: r.access_token, refreshToken: r.refresh_token ?? null, expiresAt };
+}
+function tokenIsStale(expiresAt, now = Date.now(), marginMs = 12e4) {
+  if (!expiresAt) return false;
+  const t = new Date(expiresAt).getTime();
+  return Number.isFinite(t) && t - now < marginMs;
+}
+
+// ../core/src/db/migrate.ts
+import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { dirname as dirname3, join as join7 } from "path";
+var AFTER_APPLY = {
+  10: async (db, log) => {
+    const n = await backfillTaskState(db);
+    if (n) log(`schema: cached the state of ${n} task${n === 1 ? "" : "s"}`);
+  }
+};
+var beside = join7(dirname3(fileURLToPath2(import.meta.url)), "migrations");
+var MIGRATIONS_DIR = existsSync5(beside) ? beside : runtimePaths().migrationsDir;
+function loadMigrations(dir = MIGRATIONS_DIR) {
+  const out = [];
+  for (const f of readdirSync2(dir).sort()) {
+    const m = /^(\d{3,})_([\w-]+)\.sql$/.exec(f);
+    if (!m) continue;
+    out.push({ version: Number(m[1]), name: m[2], sql: readFileSync4(join7(dir, f), "utf8") });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const m of out) {
+    if (seen.has(m.version)) throw new Error(`duplicate migration version ${m.version}`);
+    seen.add(m.version);
+  }
+  return out;
+}
+var META_DDL = `CREATE TABLE IF NOT EXISTS meta (
+  key text PRIMARY KEY,
+  value jsonb NOT NULL,
+  updated_at timestamptz NOT NULL DEFAULT now()
+)`;
+async function currentVersion(db) {
+  await db.exec(META_DDL);
+  const r = await db.query("SELECT value FROM meta WHERE key = 'schema_version'");
+  const v = r[0]?.value;
+  return typeof v === "number" ? v : typeof v === "string" ? Number(v) || 0 : 0;
+}
+async function migrate(db, opts = {}) {
+  const log = opts.log ?? noopLog;
+  const have = await currentVersion(db);
+  let applied = have;
+  for (const m of loadMigrations(opts.dir)) {
+    if (m.version <= have) continue;
+    log(`schema: applying ${String(m.version).padStart(3, "0")}_${m.name}`);
+    await db.transaction(async (tx) => {
+      await tx.exec(m.sql);
+      await tx.query(
+        `INSERT INTO meta (key, value, updated_at) VALUES ('schema_version', $1::jsonb, now())
+         ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = now()`,
+        [JSON.stringify(m.version)]
+      );
+    });
+    await AFTER_APPLY[m.version]?.(db, log);
+    applied = m.version;
+  }
+  return applied;
+}
+
+// ../core/src/oauth/server.ts
+import { randomBytes as randomBytes6 } from "crypto";
+var ACCESS_TOKEN_TTL_SECONDS = 24 * 60 * 60;
+var REFRESH_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;
+var AUTH_CODE_TTL_SECONDS = 10 * 60;
+var DEVICE_CODE_TTL_SECONDS = 15 * 60;
+var INVITE_DEFAULT_TTL_SECONDS = 24 * 60 * 60;
+var GRANT_INVITE = "urn:relay:invite";
+var OAuthError = class extends Error {
+  constructor(code, description, status = 400) {
+    super(`${code}: ${description}`);
+    this.code = code;
+    this.description = description;
+    this.status = status;
+    this.name = "OAuthError";
+  }
+  code;
+  description;
+  status;
+  toJSON() {
+    return { error: this.code, error_description: this.description };
+  }
+};
+var nowMs = (o) => (o.now ?? Date.now)();
+var after = (o, seconds) => new Date(nowMs(o) + seconds * 1e3);
+var isPast = (o, iso2) => new Date(iso2).getTime() <= nowMs(o);
+function resolveScopes(raw, client, fallback) {
+  const requested = parseScopeParam(raw);
+  if (!requested.length && !fallback) throw new OAuthError("invalid_scope", `scope is required: one or more of ${TOKEN_SCOPES.join(", ")}, space-separated.`);
+  const list = requested.length ? requested : [...fallback];
+  const bad = list.filter((s) => !isTokenScope(s));
+  if (bad.length) throw new OAuthError("invalid_scope", `Unknown scope(s): ${bad.join(", ")}. Valid: ${TOKEN_SCOPES.join(", ")}.`);
+  if (client?.scopes.length) {
+    const over = list.filter((s) => !client.scopes.includes(s));
+    if (over.length) throw new OAuthError("invalid_scope", `This client may not request ${over.join(", ")}.`);
+  }
+  return list;
+}
+async function emit(db, o, ev) {
+  const row = await writeEvent(db, { ...ev, project: null }).catch(() => void 0);
+  if (row && o?.onEvent) await Promise.resolve(o.onEvent(row)).catch(() => {
+  });
+}
+var APPROVER_SCOPE = "tokens:write";
+var isHumanActor = (actor) => actor.startsWith("human:");
+function grantCeilingError(actor, requested, held, o, what = "approve") {
+  if (isHumanActor(actor)) return void 0;
+  const have = new Set(held ?? []);
+  const over = requested.filter((s) => s === APPROVER_SCOPE || !have.has(s));
+  if (!over.length) return void 0;
+  const site = o.issuer.replace(/\/+$/, "");
+  const text2 = what === "approve" ? `a bot can approve only scopes it holds itself, and never tokens:write; ask a person to approve this one at ${site}/activate` : what === "invite" ? `a bot can mint invites only for scopes it holds itself, and never tokens:write; ask a person to create this one at ${site}/tokens` : `a bot can mint tokens only for scopes it holds itself, and never tokens:write; ask a person to create this one at ${site}/tokens`;
+  return new OAuthError("invalid_scope", `${text2} (over the ceiling: ${over.join(", ")}).`, 403);
+}
+async function decideDeviceRequest(db, typed, decision, actor, o, approverScopes) {
+  const code = normalizeUserCode(typed);
+  if (!code) throw new OAuthError("invalid_request", "That does not look like a code (RLAY-XXXX).");
+  const current = await getDeviceByUserCode(db, code);
+  if (!current) throw new OAuthError("invalid_grant", "Unknown code.");
+  if (current.status !== "pending") throw new OAuthError("invalid_grant", `That request was already ${current.status}.`);
+  if (isPast(o, current.expires_at)) throw new OAuthError("expired_token", "That request expired; ask the device to start again.");
+  if (decision === "approve") {
+    const ceiling = grantCeilingError(actor, current.scopes, approverScopes, o, "approve");
+    if (ceiling) throw ceiling;
+  }
+  const row = await decideDevice(db, code, { status: decision === "approve" ? "approved" : "denied", actor, now: new Date(nowMs(o)) });
+  if (!row) throw new OAuthError("invalid_grant", "That request was decided by someone else.");
+  await emit(db, o, {
+    kind: decision === "approve" ? "access.granted" : "access.denied",
+    actor,
+    summary: `${actor.replace(/^human:/, "")} ${decision === "approve" ? "approved" : "denied"} ${row.user_code} for ${row.client_name}`,
+    payload: { user_code: row.user_code, client_id: row.client_id, client_name: row.client_name, scopes: row.scopes, decision },
+    dedupe_key: `access:${row.user_code}:${decision}`
+  });
+  return row;
+}
+var RECENT_ACCESS_WINDOW_SECONDS = 24 * 60 * 60;
+async function listRecentAccess(db, o, sinceSeconds = RECENT_ACCESS_WINDOW_SECONDS) {
+  const now = o ? new Date(nowMs(o)) : /* @__PURE__ */ new Date();
+  const rows = await listRecentDevices(db, { since: new Date(now.getTime() - sinceSeconds * 1e3), now });
+  const rank = { pending: 0, approved: 1, redeemed: 2, denied: 2, expired: 2 };
+  return rows.map((d) => ({ ...d, state: (d.status === "pending" || d.status === "approved") && new Date(d.expires_at).getTime() <= now.getTime() ? "expired" : d.status })).sort((a, b) => rank[a.state] - rank[b.state] || b.created_at.localeCompare(a.created_at));
+}
+async function createInvite(db, input, o) {
+  const name = input.name.trim();
+  if (!name) throw new OAuthError("invalid_request", "name is required.");
+  if (name.length > 80) throw new OAuthError("invalid_request", "name must be at most 80 characters.");
+  const scopes = resolveScopes(input.scopes, null, []);
+  if (!scopes.length) throw new OAuthError("invalid_scope", "An invite needs at least one scope.");
+  const ceiling = grantCeilingError(input.createdBy, scopes, input.creatorScopes, o, "invite");
+  if (ceiling) throw ceiling;
+  const uses = input.uses ?? 1;
+  if (!Number.isInteger(uses) || uses < 1 || uses > 1e3) throw new OAuthError("invalid_request", "uses must be between 1 and 1000.");
+  const ttl = input.expiresInSeconds ?? INVITE_DEFAULT_TTL_SECONDS;
+  if (!Number.isFinite(ttl) || ttl <= 0 || ttl > 365 * 86400) throw new OAuthError("invalid_request", "expires must be between 1 second and 365 days.");
+  const code = opaqueSecret("rin_", 24);
+  const invite = await insertInvite(db, { code, name, scopes, uses, expires_at: after(o, ttl), created_by: input.createdBy });
+  await emit(db, o, { kind: "access.invite_created", actor: input.createdBy, summary: `${input.createdBy.replace(/^human:/, "")} created invite ${invite.id} for ${name} (${scopeString(scopes)}; ${uses} use(s))`, payload: { invite_id: invite.id, name, scopes, uses, expires_at: invite.expires_at } });
+  return { code, invite };
+}
+var listInvites2 = (db, opts) => listInvites(db, opts);
+async function revokeInvite2(db, idOrName, actor, o) {
+  const row = await revokeInvite(db, idOrName);
+  if (row) await emit(db, o, { kind: "access.invite_revoked", actor: actor ?? row.created_by, summary: `Invite ${row.id} for ${row.name} revoked (${row.uses_left} use(s) left)`, payload: { invite_id: row.id, name: row.name, uses_left: row.uses_left } });
+  return row;
+}
+
+// ../core/src/lanes/claude.ts
+import { execFile as execFile2 } from "child_process";
+import { mkdtempSync, rmSync } from "fs";
+import { homedir as homedir4, tmpdir } from "os";
+import { join as join8 } from "path";
+
+// ../core/src/lanes/types.ts
+var locks = /* @__PURE__ */ new Map();
+async function withSubscriptionLock(key, fn) {
+  const prev = locks.get(key) ?? Promise.resolve();
+  let release;
+  const mine = new Promise((r) => release = r);
+  locks.set(key, prev.then(() => mine));
+  await prev;
+  try {
+    return await fn();
+  } finally {
+    release();
+    if (locks.get(key) === mine) locks.delete(key);
+  }
+}
+
+// ../core/src/lanes/sandbox.ts
+var SANDBOX_DEFAULT_DOMAINS = ["registry.npmjs.org", "registry.yarnpkg.com", "github.com", "objects.githubusercontent.com", "codeload.github.com", "fonts.googleapis.com", "fonts.gstatic.com", "pypi.org", "files.pythonhosted.org", "crates.io", "static.crates.io", "proxy.golang.org"];
+var SANDBOX_DENIED_DIRS = ["~/.harness/relay.pglite", "~/.claude", "~/.codex", "~/.grok", "~/.fx", "~/.ssh", "~/.aws", "~/.config/gh"];
+var SANDBOX_DENIED_FILES = ["~/.harness/credentials.json", "~/.harness/config.json", "~/.harness/work.log", "~/.claude.json", "~/.netrc", "~/.npmrc", "~/.gitconfig"];
+var SANDBOX_DENIED_PATHS = [...SANDBOX_DENIED_DIRS, ...SANDBOX_DENIED_FILES];
+var SANDBOX_CACHE_DIRS = ["~/Library/pnpm", "~/Library/Caches/pnpm", "~/.local/share/pnpm", "~/.cache/pnpm", "~/.npm"];
+var uniq = (xs) => [...new Set([...xs].map((s) => s.trim()).filter(Boolean))];
+var parseDomainList = (s) => uniq((s ?? "").split(","));
+var denyRule = (tool, path) => `${tool}(${SANDBOX_DENIED_FILES.includes(path) ? path : `${path}/**`})`;
+function claudeSandboxSettings(opts = {}) {
+  const denied = [...SANDBOX_DENIED_PATHS];
+  return {
+    sandbox: {
+      enabled: true,
+      autoAllowBashIfSandboxed: true,
+      failIfUnavailable: true,
+      allowUnsandboxedCommands: false,
+      excludedCommands: [],
+      network: {
+        strictAllowlist: true,
+        allowedDomains: uniq([...SANDBOX_DEFAULT_DOMAINS, ...opts.allowedDomains ?? []]),
+        deniedDomains: [],
+        allowLocalBinding: opts.allowLocalBinding ?? true
+      },
+      filesystem: {
+        allowWrite: uniq([...SANDBOX_CACHE_DIRS, ...opts.allowWrite ?? []]),
+        denyRead: denied
+      },
+      credentials: {
+        files: denied.map((path) => ({ path, mode: "deny" }))
+      }
+    },
+    permissions: {
+      blockReadsOutsideWorkingDirectories: true,
+      deny: [...denied.map((p) => denyRule("Read", p)), ...denied.map((p) => denyRule("Edit", p))]
+    }
+  };
+}
+var claudeSandboxSettingsJson = (opts = {}) => JSON.stringify(claudeSandboxSettings(opts));
+var SANDBOX_UNAVAILABLE = "sandbox unavailable";
+function looksLikeSandboxUnavailable(text2) {
+  const t = text2.toLowerCase();
+  return /sandbox/.test(t) && /(unavailable|not available|not supported|unsupported|could not|cannot|can't|failed to|missing|not found|not installed|bubblewrap|bwrap|socat|seatbelt)/.test(t);
+}
+
+// ../core/src/lanes/claude.ts
+var MODEL_IDS = { fable: "anthropic/claude-fable-5-1", opus: "anthropic/claude-opus-5", sonnet: "anthropic/claude-sonnet-5" };
+var isUtility = (opts) => opts.tools !== void 0 && opts.tools.length === 0;
+function sandboxFor(req, opts) {
+  const on = opts.sandbox ?? req.lane === "code";
+  if (on === false) return void 0;
+  const o = on === true ? {} : { ...on };
+  const extra = parseDomainList((req.env ?? process.env)["RELAY_LANE_ALLOWED_DOMAINS"]);
+  if (extra.length) o.allowedDomains = [...o.allowedDomains ?? [], ...extra];
+  return o;
+}
+function claudeArgs(req, opts) {
+  const utility = isUtility(opts);
+  const args = ["-p", "--output-format", "json", "--model", opts.model];
+  args.push("--permission-mode", req.readOnly ? "plan" : "acceptEdits");
+  if (opts.tools) args.push("--tools", opts.tools.join(","));
+  if (opts.allowedTools?.length) args.push("--allowedTools", opts.allowedTools.join(","));
+  else if (req.readOnly && opts.tools === void 0) args.push("--allowedTools", "Read,Grep,Glob");
+  if (opts.disallowedTools?.length) args.push("--disallowedTools", opts.disallowedTools.join(","));
+  args.push("--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}', "--setting-sources", "");
+  const sandbox = sandboxFor(req, opts);
+  if (sandbox) args.push("--settings", claudeSandboxSettingsJson(sandbox));
+  if (utility) args.push("--disable-slash-commands");
+  for (const d of req.addDirs ?? []) args.push("--add-dir", d);
+  if (req.system) args.push("--append-system-prompt", req.system);
+  if (req.jsonSchema) args.push("--json-schema", JSON.stringify(req.jsonSchema));
+  if (opts.resume) args.push("--resume", opts.resume);
+  if (opts.maxBudgetUsd) args.push("--max-budget-usd", String(opts.maxBudgetUsd));
+  if (opts.maxTurns) args.push("--max-turns", String(opts.maxTurns));
+  args.push("--", req.prompt);
+  return args;
+}
+function fakeClaude(req, opts) {
+  const props = req.jsonSchema?.properties ?? {};
+  let json2;
+  let text2;
+  if ("files" in props) {
+    const paths = [...req.prompt.matchAll(/^=== FILE: (.+) ===$/gm)].map((m) => m[1]);
+    json2 = { files: paths.map((path) => ({ path, summary: `Canned digest of ${path}: a file of the test repository, summarized here for the index with enough words to pass validation.` })) };
+    text2 = JSON.stringify(json2);
+  } else if ("summary" in props) {
+    const para = (n) => Array.from({ length: n }, (_, i) => `Sentence ${i + 1} of this canned section describes the project in enough detail to count as real text.`).join(" ");
+    json2 = { summary: `## Purpose
+
+${para(4)}
+
+## Stack and layout
+
+${para(5)}
+
+## Commands
+
+${para(3)}
+
+## Conventions
+
+${para(4)}
+
+## Gotchas
+
+${para(3)}
+` };
+    text2 = JSON.stringify(json2);
+  } else if ("verdict" in props) {
+    json2 = { verdict: "clear", score: 0, reasons: [] };
+    text2 = JSON.stringify(json2);
+  } else text2 = "pong";
+  const model = MODEL_IDS[opts.model];
+  const tokensIn = approxTokens(req.prompt + (req.system ?? ""));
+  const tokensOut = approxTokens(text2);
+  const res = {
+    ok: true,
+    text: text2,
+    model,
+    subscription: "max",
+    tokensIn,
+    tokensOut,
+    cacheRead: 0,
+    cacheWrite: 0,
+    costEquiv: costEquiv({ lane: req.lane, model, provider: "anthropic", subscription: "max", tokens_in: tokensIn, tokens_out: tokensOut, duration_ms: 0 }),
+    durationMs: 0,
+    raw: { fake: true }
+  };
+  if (json2 !== void 0) res.json = json2;
+  return res;
+}
+async function runClaude(req, opts) {
+  if (process.env.RELAY_FAKE_LANES === "1") return fakeClaude(req, opts);
+  const bin = opts.bin ?? process.env.RELAY_CLAUDE_BIN ?? join8(homedir4(), ".local", "bin", "claude");
+  const model = MODEL_IDS[opts.model];
+  const utility = isUtility(opts);
+  return withSubscriptionLock("claude:max", async () => {
+    const args = claudeArgs(req, opts);
+    const t0 = Date.now();
+    const env = { ...req.env ?? process.env };
+    delete env["CLAUDECODE"];
+    delete env["CLAUDE_CODE_ENTRYPOINT"];
+    delete env["ANTHROPIC_API_KEY"];
+    delete env["ANTHROPIC_AUTH_TOKEN"];
+    let cwd = req.cwd;
+    let scratch;
+    if (utility) {
+      env["CLAUDE_CODE_DISABLE_AUTO_MEMORY"] = "1";
+      env["CLAUDE_CODE_DISABLE_CLAUDE_MDS"] = "1";
+      scratch = mkdtempSync(join8(tmpdir(), "relay-lane-"));
+      cwd = scratch;
+    }
+    const { stdout, stderr, code } = await new Promise((resolve2) => {
+      const child = execFile2(
+        bin,
+        args,
+        { cwd, env, maxBuffer: 64 * 1024 * 1024, timeout: req.timeoutMs ?? 20 * 6e4 },
+        (err, stdout2, stderr2) => resolve2({ stdout: String(stdout2), stderr: String(stderr2), code: err && "code" in err && typeof err.code === "number" ? err.code : err ? 1 : 0 })
+      );
+      child.stdin?.end();
+    });
+    if (scratch) rmSync(scratch, { recursive: true, force: true });
+    const durationMs = Date.now() - t0;
+    let j;
+    try {
+      j = JSON.parse(stdout.trim());
+    } catch {
+    }
+    const u = j?.usage ?? {};
+    const tokensIn = u.input_tokens ?? 0;
+    const tokensOut = u.output_tokens ?? 0;
+    const cacheRead = u.cache_read_input_tokens ?? 0;
+    const cacheWrite = u.cache_creation_input_tokens ?? 0;
+    const ok = !!j && !j.is_error && code === 0;
+    const res = {
+      ok,
+      text: j?.result ?? "",
+      model,
+      subscription: "max",
+      tokensIn,
+      tokensOut,
+      cacheRead,
+      cacheWrite,
+      costEquiv: costEquiv({ lane: req.lane, model, provider: "anthropic", subscription: "max", tokens_in: tokensIn, tokens_out: tokensOut, cache_read: cacheRead, cache_write: cacheWrite, duration_ms: durationMs }),
+      durationMs,
+      raw: j ?? { stdout: stdout.slice(0, 2e3), stderr: stderr.slice(0, 2e3), code }
+    };
+    if (j?.structured_output !== void 0) res.json = j.structured_output;
+    if (j?.session_id) res.sessionId = j.session_id;
+    if (!ok) {
+      const msg = j?.result || stderr || `claude exited ${code}`;
+      const unavailable = sandboxFor(req, opts) !== void 0 && !j && looksLikeSandboxUnavailable(`${stderr}
+${stdout}`);
+      res.error = (unavailable ? `${SANDBOX_UNAVAILABLE}: ${msg}` : msg).slice(0, 500);
+    }
+    return res;
+  });
+}
+
+// ../core/src/tasks/gate.ts
+var GATE_TEXT_CAP = 20 * 1024;
+var GATE_MARKERS = [
+  { name: "ignore previous instructions", re: /\b(?:ignore|disregard|forget|override)\b[^\n.]{0,40}\b(?:previous|prior|above|earlier|all|your)\b[^\n.]{0,24}\b(?:instructions?|rules|guidance|guidelines|prompt|constraints)\b/i },
+  { name: "curl \u2026 | sh", re: /\b(?:curl|wget)\b[^\n|]*\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b/i },
+  { name: ".ssh", re: /(?:^|[\s"'`(=:/~])\.ssh(?:\/|\b)/ },
+  { name: "credentials.json", re: /\bcredentials\.json\b/i },
+  { name: "GITHUB_TOKEN", re: /\b(?:GITHUB_TOKEN|GH_TOKEN)\b/ },
+  { name: "ANTHROPIC_API_KEY", re: /\b(?:ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|OPENAI_API_KEY|XAI_API_KEY)\b/ },
+  { name: "--dangerously-skip-permissions", re: /--dangerously-skip-permissions\b/ },
+  { name: "git push --force to main", re: /git\s+push\b[^\n]*(?:--force(?:-with-lease)?|\s-f\b)[^\n]*\b(?:main|master)\b|git\s+push\b[^\n]*\b(?:main|master)\b[^\n]*(?:--force(?:-with-lease)?|\s-f\b)/i },
+  { name: "~/.harness", re: /~\/\.harness\b|\$\{?RELAY_HOME\b|\.harness\/(?:credentials|relay\.pglite|work)\b/ }
+];
+function precheckTask(text2) {
+  const hits = [];
+  for (const m of GATE_MARKERS) if (m.re.test(text2)) hits.push(m.name);
+  return hits;
+}
+var GATE_TIMEOUT_MS = 3 * 6e4;
+function heldEvent(task, actor, v, extra = {}) {
+  const first = v.reasons.find((r) => r.trim()) ?? "flagged by the gate";
+  return {
+    kind: "task.held",
+    actor,
+    project: task.project,
+    repo: task.repo,
+    issue: task.issue,
+    lane: extra.lane ?? task.lane,
+    url: `https://github.com/${task.repo}/issues/${task.issue}`,
+    summary: `Held #${task.issue} at the gate (${v.grader}, ${v.score.toFixed(2)}): ${first}`.slice(0, 500),
+    payload: { score: v.score, reasons: v.reasons, grader: v.grader, model: v.model ?? null, ...extra.payload ?? {} },
+    ...extra.dedupe_key !== void 0 ? { dedupe_key: extra.dedupe_key } : {}
+  };
+}
+function heldInfo(events) {
+  let best;
+  for (const e of events) if (e.kind === "task.held" && (!best || e.ts > best.ts || e.ts === best.ts && e.id > best.id)) best = e;
+  if (!best) return void 0;
+  const p = best.payload;
+  return {
+    score: typeof p.score === "number" ? p.score : 1,
+    reasons: Array.isArray(p.reasons) ? p.reasons.map((r) => String(r)) : [],
+    grader: typeof p.grader === "string" ? p.grader : "unknown",
+    model: typeof p.model === "string" ? p.model : null,
+    by: best.actor,
+    at: best.ts
+  };
+}
+var TaskGateError = class extends Error {
+  constructor(message2, status = 400) {
+    super(message2);
     this.status = status;
-    this.name = "OAuthError";
+    this.name = "TaskGateError";
   }
-  code;
-  description;
   status;
-  toJSON() {
-    return { error: this.code, error_description: this.description };
-  }
 };
-var nowMs = (o) => (o.now ?? Date.now)();
-var after = (o, seconds) => new Date(nowMs(o) + seconds * 1e3);
-function resolveScopes(raw, client, fallback = TOKEN_SCOPES) {
-  const requested = parseScopeParam(raw);
-  const list = requested.length ? requested : [...fallback];
-  const bad = list.filter((s) => !isTokenScope(s));
-  if (bad.length) throw new OAuthError("invalid_scope", `Unknown scope(s): ${bad.join(", ")}. Valid: ${TOKEN_SCOPES.join(", ")}.`);
-  if (client?.scopes.length) {
-    const over = list.filter((s) => !client.scopes.includes(s));
-    if (over.length) throw new OAuthError("invalid_scope", `This client may not request ${over.join(", ")}.`);
+var RELEASERS_TEXT = "a signed-in person, or a bot whose token holds tokens:write and that did not open the task itself";
+var nameOf2 = (actor) => actor.slice(actor.indexOf(":") + 1).replace(/^oauth:/, "").toLowerCase();
+async function releaseTask(db, taskId2, actor, opts = {}) {
+  const task = await getTask(db, taskId2.trim());
+  if (!task) throw new TaskGateError(`No task ${taskId2}.`, 404);
+  const note = opts.note?.trim() || null;
+  if (note && note.length > 2e3) throw new TaskGateError("The note must be at most 2000 characters.", 400);
+  if (!actor.startsWith("human:")) {
+    if (opts.scopes && !opts.scopes.includes("tokens:write")) throw new TaskGateError(`${actor} cannot release ${task.id}: its token lacks tokens:write. Who can: ${RELEASERS_TEXT}.`, 403);
+    if (nameOf2(task.created_by) === nameOf2(actor)) throw new TaskGateError(`${actor} cannot release ${task.id}: it opened this task. A bot never releases its own hold; who can: ${RELEASERS_TEXT}.`, 403);
   }
-  return list;
-}
-async function createInvite(db, input, o) {
-  const name = input.name.trim();
-  if (!name) throw new OAuthError("invalid_request", "name is required.");
-  if (name.length > 80) throw new OAuthError("invalid_request", "name must be at most 80 characters.");
-  const scopes = resolveScopes(input.scopes, null, []);
-  if (!scopes.length) throw new OAuthError("invalid_scope", "An invite needs at least one scope.");
-  const uses = input.uses ?? 1;
-  if (!Number.isInteger(uses) || uses < 1 || uses > 1e3) throw new OAuthError("invalid_request", "uses must be between 1 and 1000.");
-  const ttl = input.expiresInSeconds ?? INVITE_DEFAULT_TTL_SECONDS;
-  if (!Number.isFinite(ttl) || ttl <= 0 || ttl > 365 * 86400) throw new OAuthError("invalid_request", "expires must be between 1 second and 365 days.");
-  const code = opaqueSecret("rin_", 24);
-  const invite = await insertInvite(db, { code, name, scopes, uses, expires_at: after(o, ttl), created_by: input.createdBy });
-  return { code, invite };
+  const [events, claims] = await Promise.all([taskEvents(db, task), taskClaims(db, task.id)]);
+  const status = deriveTaskStatus(task, events, claims);
+  if (status.state !== "held") throw new TaskGateError(`${task.id} is ${status.state}, not held; only a held task can be released.`, 409);
+  const held = heldInfo(events);
+  const written = [];
+  const row = await writeEvent(db, {
+    kind: "task.released",
+    actor,
+    project: task.project,
+    repo: task.repo,
+    issue: task.issue,
+    lane: task.lane ?? status.lane,
+    pr: status.pr,
+    url: status.issue_url,
+    summary: `Released #${task.issue} from the gate${note ? `: ${note.split("\n").find((l) => l.trim()) ?? ""}` : ""}`.slice(0, 500),
+    payload: { note, held: held ?? null, previous_state: "held" }
+  });
+  if (row) written.push(row);
+  await bumpQueueVersion(db);
+  return { task: await taskView(db, task), events: written };
 }
-var listInvites2 = (db, opts) => listInvites(db, opts);
-var revokeInvite2 = (db, idOrName) => revokeInvite(db, idOrName);
 
 // ../core/src/tasks/create.ts
 var WORKER_LANES = ["claude", "codex", "grok"];
@@ -3592,17 +4751,112 @@ ${marker}
   const missing = labels.filter((l) => !issue.labels.includes(l));
   if (missing.length) await github.addLabels(project.repo, issue.number, missing).catch(() => {
   });
-  const { task, created } = await createTask(db, { project: project.slug, repo: project.repo, issue: issue.number, idempotencyKey: key, createdBy: input.actor, lane: input.lane });
+  const { task, created } = await createTask(db, { project: project.slug, repo: project.repo, issue: issue.number, idempotencyKey: key, createdBy: input.actor, lane: input.lane, title: input.title.trim() });
   const events = [];
   const base = { actor: input.actor, project: project.slug, repo: project.repo, issue: issue.number, lane: input.lane, url: issue.html_url };
   const opened = await writeEvent(db, { ...base, kind: "issue.opened", summary: input.title.trim(), payload: { labels, via: "relay_task_create" }, dedupe_key: `task:${task.id}:opened` });
   if (opened) events.push(opened);
   const createdEv = await writeEvent(db, { ...base, kind: "task.created", summary: `${task.id}: ${input.title.trim()}`, payload: { task_id: task.id, lane: input.lane, priority: input.priority ?? null, idempotency_key: key }, dedupe_key: `task:${task.id}:created` });
   if (createdEv) events.push(createdEv);
+  const hits = precheckTask(`${input.title}
+
+${input.body ?? ""}`);
+  if (hits.length) {
+    const held = await writeEvent(db, heldEvent({ ...task, lane: input.lane }, "bot:relay", { score: 1, reasons: hits.map((h) => `pre-check: ${h}`), grader: "precheck", model: null }, { payload: { opened_by: input.actor }, dedupe_key: `task:${task.id}:held:create` }));
+    if (held) events.push(held);
+  }
   const view = await taskView(db, task);
   return { task: view, task_id: view.id, issue_url: issue.html_url || view.issue_url, created, events };
 }
 
+// ../core/src/tasks/requeue.ts
+var TaskRequeueError = class extends Error {
+  constructor(message2, status = 400) {
+    super(message2);
+    this.status = status;
+    this.name = "TaskRequeueError";
+  }
+  status;
+};
+var REQUEUERS_TEXT = "a signed-in person, or a bot whose token holds tasks:write";
+var laneLabel = (lane) => `agent:${lane}`;
+var describe2 = (e) => (e instanceof Error ? e.message : String(e)).slice(0, 300);
+async function relabel(github, repo, issue, lane) {
+  if (!github) return { relabelled: false, error: "No GitHub credential: set GITHUB_TOKEN (web) or log in with gh (CLI); move the agent:* label by hand." };
+  try {
+    const current = await github.getIssue(repo, issue);
+    const want = laneLabel(lane);
+    const removed = [];
+    for (const l of current.labels) {
+      if (l.startsWith("agent:") && l !== want) {
+        await github.removeLabel(repo, issue, l);
+        removed.push(l);
+      }
+    }
+    let added = null;
+    if (!current.labels.includes(want)) {
+      await github.addLabels(repo, issue, [want]);
+      added = want;
+    }
+    return { relabelled: true, removed, added };
+  } catch (e) {
+    return { relabelled: false, error: describe2(e) };
+  }
+}
+async function assertRequeueable(db, taskId2, actor, opts) {
+  const task = await getTask(db, taskId2.trim());
+  if (!task) throw new TaskRequeueError(`No task ${taskId2}.`, 404);
+  if (opts.lane != null && opts.lane !== "" && !isTaskLane(opts.lane)) throw new TaskRequeueError(`lane must be one of ${TASK_LANES.join(", ")}.`, 400);
+  if (opts.reason && opts.reason.length > 2e3) throw new TaskRequeueError("The reason must be at most 2000 characters.", 400);
+  if (!actor.startsWith("human:") && opts.scopes && !opts.scopes.includes("tasks:write")) {
+    throw new TaskRequeueError(`${actor} cannot requeue ${task.id}: its token lacks tasks:write. Who can: ${REQUEUERS_TEXT}.`, 403);
+  }
+  const [events, claims] = await Promise.all([taskEvents(db, task), taskClaims(db, task.id)]);
+  const status = deriveTaskStatus(task, events, claims);
+  if (status.state === "done") throw new TaskRequeueError(`${task.id} is done (merged or closed); reopen the issue on GitHub to start it again.`, 409);
+  return { task, status };
+}
+async function requeueTask(db, github, taskId2, actor, opts = {}) {
+  const { task, status } = await assertRequeueable(db, taskId2, actor, opts);
+  const previousLane = task.lane ?? status.lane;
+  const lane = opts.lane ? opts.lane : previousLane;
+  const relaned = Boolean(lane && lane !== previousLane);
+  if (relaned) await db.query("UPDATE tasks SET lane = $2 WHERE id = $1", [task.id, lane]);
+  const github_result = lane ? await relabel(github, task.repo, task.issue, lane) : null;
+  let released = null;
+  const claim = await liveClaim(db, task.id);
+  if (claim) {
+    const r = await releaseClaim(db, task.id, claim.worker_id, "released");
+    if (r) released = (await getWorker(db, claim.worker_id))?.name ?? claim.worker_id;
+  }
+  const reason = opts.reason?.trim() || null;
+  const events = [];
+  const detail = [relaned ? `on the ${lane} lane (was ${previousLane ?? "no lane"})` : lane ? `on the ${lane} lane` : "", `was ${status.state}`].filter(Boolean).join(", ");
+  const row = await writeEvent(db, {
+    actor,
+    project: task.project,
+    repo: task.repo,
+    issue: task.issue,
+    lane,
+    pr: status.pr,
+    kind: "task.requeued",
+    summary: `Requeued #${task.issue} ${detail}${reason ? `: ${reason.split("\n").find((l) => l.trim()) ?? ""}` : ""}`.slice(0, 500),
+    url: status.pr_url ?? status.issue_url,
+    payload: {
+      previous_state: status.state,
+      previous_lane: previousLane,
+      lane,
+      reason,
+      github: github_result,
+      claim_released: released,
+      branch: status.branch
+    }
+  });
+  if (row) events.push(row);
+  await bumpQueueVersion(db);
+  return { task: await taskView(db, await getTask(db, task.id) ?? task), events };
+}
+
 // ../core/src/webhooks/dispatch.ts
 import { createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var SIGNATURE_HEADER = "x-relay-signature";
@@ -3684,6 +4938,7 @@ function pingPayload(hook, deliveryId = ulid()) {
 }
 
 // ../core/src/client/local.ts
+var GITHUB_INSTALLATIONS_URL = "https://github.com/settings/installations";
 var EXTERNAL_KIND = /^external\.[a-z0-9_.-]+$/i;
 function localClient(db, opts) {
   const github = () => typeof opts.github === "function" ? opts.github() : opts.github ?? detectGitHub();
@@ -3728,6 +4983,16 @@ function localClient(db, opts) {
       await setProjectSummary(db, slug, summary, tokens);
       await recordUsage(db, slug, o.usage);
     },
+    async githubStatus(slug) {
+      const p = await getProject(db, slug);
+      if (!p) return void 0;
+      const stats = p.repo ? await githubDeliveryStats(db, p.repo) : { count: 0, last_delivery_at: null };
+      return {
+        repo: p.repo ?? null,
+        app: { configured: false, slug: null, installed: false, installation_id: null, install_url: opts.installUrl ?? GITHUB_INSTALLATIONS_URL },
+        webhook: { org_or_repo_hook_seen: stats.count > 0, last_delivery_at: stats.last_delivery_at }
+      };
+    },
     async recall(q) {
       if (q.project) {
         const preferences2 = await mergedPreferences(db, { project: q.project, ...q.lane ? { lane: q.lane } : {} });
@@ -3776,12 +5041,32 @@ function localClient(db, opts) {
       return t ? taskView(db, t) : void 0;
     },
     listTasks: (o = {}) => listTaskViews(db, o),
+    async approveTask(id) {
+      const r = await approveTask(db, github(), id, opts.actor);
+      for (const ev of r.events) await afterWrite(ev);
+      return r.task;
+    },
+    async requestChanges(id, note) {
+      const r = await requestChanges(db, github(), id, opts.actor, note);
+      for (const ev of r.events) await afterWrite(ev);
+      return r.task;
+    },
+    async requeueTask(id, o = {}) {
+      const r = await requeueTask(db, github(), id, opts.actor, { lane: o.lane ?? null, reason: o.reason ?? null });
+      for (const ev of r.events) await afterWrite(ev);
+      return r.task;
+    },
+    async releaseTask(id, o = {}) {
+      const r = await releaseTask(db, id, opts.actor, { note: o.note ?? null });
+      for (const ev of r.events) await afterWrite(ev);
+      return r.task;
+    },
     async createInvite(i) {
       const r = await createInvite(db, { name: i.name, scopes: i.scopes, ...i.expiresInSeconds ? { expiresInSeconds: i.expiresInSeconds } : {}, ...i.uses ? { uses: i.uses } : {}, createdBy: opts.actor }, { issuer: opts.issuer ?? "relay://local" });
       return r;
     },
     listInvites: (o = {}) => listInvites2(db, o),
-    revokeInvite: (idOrName) => revokeInvite2(db, idOrName),
+    revokeInvite: (idOrName) => revokeInvite2(db, idOrName, opts.actor),
     whoami: async () => ({ actor: opts.actor, name: opts.actor, scopes: [...TOKEN_SCOPES], expires_at: null, source: "local" }),
     async addWebhook(input) {
       const row = await createWebhook(db, { project: input.project ?? null, url: input.url, events: input.events, bearer: input.bearer ?? null, ...input.secret ? { secret: input.secret } : {}, createdBy: opts.actor });
@@ -3870,7 +5155,7 @@ async function openHarness(cfg = loadConfig(), opts = {}) {
   const siteMode = !!cfg.site && !!cfg.siteToken;
   const db = siteMode && !opts.local ? siteModeDb(cfg.site) : await openDb(cfg.databaseUrl ? { url: cfg.databaseUrl } : { file: cfg.dbFile });
   const ledger = new Ledger(db);
-  const client = siteMode ? httpClient({ site: cfg.site, token: cfg.siteToken, actor }) : localClient(db, { actor, embed: briefEmbedder({ cfg, ledger }) });
+  const client = siteMode ? httpClient({ site: cfg.site, token: cfg.siteToken, actor }) : localClient(db, { actor, embed: briefEmbedder({ cfg, ledger }), ...cfg.site ? { installUrl: `${cfg.site}/setup/github` } : {} });
   return {
     cfg,
     db,
@@ -3886,35 +5171,319 @@ async function openHarness(cfg = loadConfig(), opts = {}) {
 
 // ../core/src/work/job.ts
 import { execFile as execFile6 } from "child_process";
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync5, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync as rmSync2 } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join9 } from "path";
-
-// ../core/src/lanes/claude.ts
-import { execFile as execFile2 } from "child_process";
-import { mkdtempSync, rmSync } from "fs";
-import { homedir as homedir4, tmpdir } from "os";
-import { join as join7 } from "path";
+import { join as join10 } from "path";
 
 // ../core/src/lanes/codex.ts
 import { execFile as execFile3 } from "child_process";
+function fakeCodex(req, opts) {
+  const text2 = "pong";
+  const model = `openai/${opts.model ?? "codex"}`;
+  const tokensIn = approxTokens(req.prompt + (req.system ?? ""));
+  const tokensOut = approxTokens(text2);
+  return { ok: true, text: text2, model, subscription: "codex", tokensIn, tokensOut, cacheRead: 0, cacheWrite: 0, costEquiv: costEquiv({ lane: req.lane, model, provider: "codex", subscription: "codex", tokens_in: tokensIn, tokens_out: tokensOut, duration_ms: 0 }), durationMs: 0, raw: { fake: true } };
+}
+function parseCodexJsonl(stdout) {
+  let tokensIn = 0;
+  let tokensOut = 0;
+  let cacheRead = 0;
+  let turns = 0;
+  let text2 = "";
+  let error;
+  for (const line of stdout.split("\n")) {
+    const t = line.trim();
+    if (!t.startsWith("{")) continue;
+    let j;
+    try {
+      j = JSON.parse(t);
+    } catch {
+      continue;
+    }
+    if (j.type === "turn.completed") {
+      turns++;
+      tokensIn += j.usage?.input_tokens ?? 0;
+      tokensOut += j.usage?.output_tokens ?? 0;
+      cacheRead += j.usage?.cached_input_tokens ?? 0;
+    } else if (j.type === "item.completed" && j.item?.type === "agent_message" && typeof j.item.text === "string") text2 = j.item.text;
+    else if (j.type === "error" || j.type === "turn.failed") error = j.error?.message ?? j.message ?? "codex reported an error";
+  }
+  return { tokensIn, tokensOut, cacheRead, text: text2, turns, ...error ? { error } : {} };
+}
+async function runCodex(req, opts = {}) {
+  if (process.env.RELAY_FAKE_LANES === "1") return fakeCodex(req, opts);
+  const bin = opts.bin ?? process.env.RELAY_CODEX_BIN ?? findOnPath("codex") ?? "codex";
+  return withSubscriptionLock("codex", async () => {
+    const args = ["exec", "--json", "--sandbox", req.readOnly ? "read-only" : "workspace-write", "-c", "agents.enabled=false"];
+    if (opts.model) args.push("-m", opts.model);
+    args.push(req.prompt);
+    const env = { ...req.env ?? process.env };
+    delete env["OPENAI_API_KEY"];
+    const t0 = Date.now();
+    const { stdout, stderr, code } = await new Promise((resolve2) => {
+      const child = execFile3(
+        bin,
+        args,
+        { cwd: req.cwd, env, maxBuffer: 64 * 1024 * 1024, timeout: req.timeoutMs ?? 20 * 6e4 },
+        (err, stdout2, stderr2) => resolve2({ stdout: String(stdout2), stderr: String(stderr2), code: err && "code" in err && typeof err.code === "number" ? err.code : err ? 1 : 0 })
+      );
+      child.stdin?.end();
+    });
+    const durationMs = Date.now() - t0;
+    const p = parseCodexJsonl(stdout);
+    const model = `openai/${opts.model ?? "codex"}`;
+    const ok = p.turns > 0 && !p.error && code === 0;
+    const res = {
+      ok,
+      text: p.text,
+      model,
+      subscription: "codex",
+      tokensIn: p.tokensIn,
+      tokensOut: p.tokensOut,
+      cacheRead: p.cacheRead,
+      cacheWrite: 0,
+      costEquiv: costEquiv({ lane: req.lane, model, provider: "codex", subscription: "codex", tokens_in: p.tokensIn, tokens_out: p.tokensOut, cache_read: p.cacheRead, duration_ms: durationMs }),
+      durationMs,
+      raw: { turns: p.turns, code, stderr: stderr.slice(0, 2e3) }
+    };
+    if (!ok) res.error = (p.error ?? stderr ?? `codex exited ${code}`).slice(0, 500);
+    return res;
+  });
+}
 
 // ../core/src/lanes/fx.ts
 import { execFile as execFile4 } from "child_process";
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync2, existsSync as existsSync5, mkdirSync as mkdirSync4 } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, existsSync as existsSync6, mkdirSync as mkdirSync4 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join8 } from "path";
-var FX_HOME = process.env.FX_HOME_DIR ?? join8(homedir5(), ".fx");
-var SETTINGS = join8(FX_HOME, "settings.json");
+import { join as join9 } from "path";
+var FX_HOME = process.env.FX_HOME_DIR ?? join9(homedir5(), ".fx");
+var SETTINGS = join9(FX_HOME, "settings.json");
+function readSettings() {
+  try {
+    return existsSync6(SETTINGS) ? JSON.parse(readFileSync5(SETTINGS, "utf8")) : {};
+  } catch {
+    return {};
+  }
+}
+function ledgerModelId(provider, model) {
+  if (model.includes("/")) return model;
+  if (provider === "codex") return `openai/${model}`;
+  if (provider === "grok") return `xai/${model}`;
+  return model;
+}
+async function runFx(req, opts) {
+  const bin = opts.bin ?? process.env.RELAY_FX_BIN ?? join9(homedir5(), ".local", "bin", "fx");
+  const subscription = opts.provider === "gateway" ? "gateway" : opts.provider;
+  const fxProvider = opts.provider === "gateway" ? "vercel" : opts.provider;
+  return withSubscriptionLock(`fx:${opts.provider}`, async () => {
+    mkdirSync4(FX_HOME, { recursive: true });
+    const before = readSettings();
+    const models2 = { ...before["models"] ?? {}, [fxProvider]: opts.model };
+    writeFileSync2(SETTINGS, JSON.stringify({ ...before, models: models2, provider: fxProvider }));
+    const args = ["--context-limit", `skill_catalog_bytes=${opts.skillCatalogBytes ?? 1024}`];
+    for (const d of req.addDirs ?? []) args.push("--add-dir", d);
+    args.push("ask", "--json", "--no-save", "--quiet");
+    if (req.system) args.push("--system", req.system);
+    if (!req.readOnly) args.push("--auto");
+    args.push("--", req.prompt);
+    const t0 = Date.now();
+    try {
+      const { stdout, stderr, code } = await new Promise((resolve2) => {
+        const child = execFile4(
+          bin,
+          args,
+          { cwd: req.cwd, env: { ...req.env ?? process.env, FX_MODEL: opts.model, FX_NO_OPEN_BROWSER: "1", FX_AUTO_UPGRADE: "0" }, maxBuffer: 64 * 1024 * 1024, timeout: req.timeoutMs ?? 20 * 6e4 },
+          (err, stdout2, stderr2) => resolve2({ stdout: String(stdout2), stderr: String(stderr2), code: err && "code" in err && typeof err.code === "number" ? err.code : err ? 1 : 0 })
+        );
+        child.stdin?.end();
+      });
+      const durationMs = Date.now() - t0;
+      let j;
+      try {
+        j = JSON.parse(stdout.trim().split("\n").filter(Boolean).pop() ?? "");
+      } catch {
+      }
+      const model = ledgerModelId(opts.provider, j?.model || opts.model);
+      const tokensIn = j?.usage?.input_tokens ?? 0;
+      const tokensOut = j?.usage?.output_tokens ?? 0;
+      const ok = !!j && j.exit_code === 0 && !j.error && code === 0;
+      const res = {
+        ok,
+        text: j?.final_output || j?.output || "",
+        model,
+        subscription,
+        tokensIn,
+        tokensOut,
+        cacheRead: 0,
+        cacheWrite: 0,
+        costEquiv: costEquiv({ lane: req.lane, model, provider: opts.provider, subscription, tokens_in: tokensIn, tokens_out: tokensOut, duration_ms: durationMs }),
+        durationMs,
+        raw: j ?? { stdout: stdout.slice(0, 2e3), stderr: stderr.slice(0, 2e3), code }
+      };
+      if (j?.session_id) res.sessionId = j.session_id;
+      if (!ok) res.error = j?.error ?? (j?.output || stderr || `fx exited ${code}`).slice(0, 500);
+      return res;
+    } finally {
+      writeFileSync2(SETTINGS, JSON.stringify(before));
+    }
+  });
+}
 
 // ../core/src/lanes/grok.ts
 import { execFile as execFile5 } from "child_process";
+function fakeGrok(req, opts) {
+  const text2 = "pong";
+  const model = `xai/${opts.model ?? "grok"}`;
+  const tokensIn = approxTokens(req.prompt + (req.system ?? ""));
+  const tokensOut = approxTokens(text2);
+  return { ok: true, text: text2, model, subscription: "grok", tokensIn, tokensOut, cacheRead: 0, cacheWrite: 0, costEquiv: costEquiv({ lane: req.lane, model, provider: "grok", subscription: "grok", tokens_in: tokensIn, tokens_out: tokensOut, duration_ms: 0 }), durationMs: 0, raw: { fake: true } };
+}
+async function runGrok(req, opts = {}) {
+  if (process.env.RELAY_FAKE_LANES === "1") return fakeGrok(req, opts);
+  const bin = opts.bin ?? process.env.RELAY_GROK_BIN ?? findOnPath("grok") ?? "grok";
+  return withSubscriptionLock("grok", async () => {
+    const args = ["-p", req.prompt, "--output-format", "json", "--no-subagents", "--no-plan", "--permission-mode", req.readOnly ? "plan" : "acceptEdits"];
+    if (opts.model) args.push("-m", opts.model);
+    const env = { ...req.env ?? process.env };
+    delete env["XAI_API_KEY"];
+    const t0 = Date.now();
+    const { stdout, stderr, code } = await new Promise((resolve2) => {
+      const child = execFile5(
+        bin,
+        args,
+        { cwd: req.cwd, env, maxBuffer: 64 * 1024 * 1024, timeout: req.timeoutMs ?? 20 * 6e4 },
+        (err, stdout2, stderr2) => resolve2({ stdout: String(stdout2), stderr: String(stderr2), code: err && "code" in err && typeof err.code === "number" ? err.code : err ? 1 : 0 })
+      );
+      child.stdin?.end();
+    });
+    let durationMs = Date.now() - t0;
+    let j;
+    try {
+      j = JSON.parse(stdout.trim());
+    } catch {
+    }
+    if (j?.duration_ms && j.duration_ms > 0) durationMs = j.duration_ms;
+    const u = j?.usage ?? {};
+    const tokensIn = u.input_tokens ?? 0;
+    const tokensOut = u.output_tokens ?? 0;
+    const cacheRead = u.cache_read_input_tokens ?? u.cached_input_tokens ?? 0;
+    const cacheWrite = u.cache_creation_input_tokens ?? 0;
+    const model = `xai/${j?.model || opts.model || "grok"}`;
+    const ok = !!j && !j.is_error && code === 0;
+    const res = {
+      ok,
+      text: j?.result ?? j?.text ?? j?.output ?? "",
+      model,
+      subscription: "grok",
+      tokensIn,
+      tokensOut,
+      cacheRead,
+      cacheWrite,
+      costEquiv: costEquiv({ lane: req.lane, model, provider: "grok", subscription: "grok", tokens_in: tokensIn, tokens_out: tokensOut, cache_read: cacheRead, cache_write: cacheWrite, duration_ms: durationMs }),
+      durationMs,
+      raw: j ?? { stdout: stdout.slice(0, 2e3), stderr: stderr.slice(0, 2e3), code }
+    };
+    if (!ok) res.error = (j?.result || stderr || `grok exited ${code}`).slice(0, 500);
+    return res;
+  });
+}
 
 // ../core/src/work/job.ts
 var DEFAULT_JOB_TIMEOUT_MS = 60 * 6e4;
+var DEFAULT_MAX_TURNS = 40;
+var CODE_TOOLS = [
+  "Read",
+  "Edit",
+  "Write",
+  "Glob",
+  "Grep",
+  "Bash(git status*)",
+  "Bash(git diff*)",
+  "Bash(git log*)",
+  "Bash(git add*)",
+  "Bash(git commit*)",
+  "Bash(git checkout*)",
+  "Bash(git restore*)",
+  // the project's own scripts and checks: the OS sandbox (lanes/sandbox.ts) is the boundary, the allowlist only shapes the work
+  "Bash(pnpm install*)",
+  "Bash(pnpm test*)",
+  "Bash(pnpm typecheck*)",
+  "Bash(pnpm build*)",
+  "Bash(pnpm lint*)",
+  "Bash(pnpm run *)",
+  "Bash(pnpm -r *)",
+  "Bash(npm ci*)",
+  "Bash(npm install*)",
+  "Bash(npm test*)",
+  "Bash(npm run *)",
+  "Bash(npx tsc*)",
+  "Bash(npx eslint*)",
+  "Bash(npx vitest*)",
+  "Bash(npx next *)",
+  "Bash(npx prettier*)",
+  "Bash(yarn install*)",
+  "Bash(yarn test*)",
+  "Bash(yarn build*)",
+  "Bash(yarn lint*)",
+  "Bash(yarn run *)"
+];
+var CODE_DISALLOWED_TOOLS = ["Bash(git push*)", "Bash(git -c*)", "Bash(git config*)", "Bash(git remote*)", "Bash(curl*)", "Bash(wget*)"];
+var SANDBOX_UNAVAILABLE_SUMMARY = `${SANDBOX_UNAVAILABLE}: Claude Code could not set up its OS sandbox on this worker, so the job did not run (relay never runs the lane unsandboxed). Linux: sudo apt install bubblewrap socat (or dnf); macOS has it built in. \`relay work --no-sandbox\` is the recorded escape hatch.`;
+var laneRunner = (o = {}) => async (req, lane) => {
+  const env = process.env;
+  if (lane === "claude") {
+    const model = env.RELAY_MODEL_CLAUDE ?? "opus";
+    return { tool: "claude", ...await runClaude(req, { model, allowedTools: CODE_TOOLS, disallowedTools: CODE_DISALLOWED_TOOLS, maxTurns: DEFAULT_MAX_TURNS, sandbox: o.sandbox ?? true }) };
+  }
+  const fake = env.RELAY_FAKE_LANES === "1";
+  if (lane === "codex") {
+    if (fake || findOnPath("codex") || env.RELAY_CODEX_BIN) return { tool: "codex", ...await runCodex(req, { ...env.RELAY_MODEL_CODEX ? { model: env.RELAY_MODEL_CODEX } : {} }) };
+    return { tool: "fx", ...await runFx(req, { provider: "codex", model: env.RELAY_MODEL_CODEX ?? "gpt-5.5" }) };
+  }
+  if (lane === "grok") {
+    if (fake || findOnPath("grok") || env.RELAY_GROK_BIN) return { tool: "grok", ...await runGrok(req, { ...env.RELAY_MODEL_GROK ? { model: env.RELAY_MODEL_GROK } : {} }) };
+    return { tool: "fx", ...await runFx(req, { provider: "grok", model: env.RELAY_MODEL_GROK ?? "grok-4.7" }) };
+  }
+  throw new Error(`no lane adapter for '${lane}'`);
+};
+var defaultLaneRunner = laneRunner();
+
+// ../core/src/hooks/cache.ts
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync7, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join11 } from "path";
+var BRIEF_CACHE_TTL_MS = 10 * 6e4;
+function relayHome() {
+  return process.env.RELAY_HOME ?? join11(homedir7(), ".harness");
+}
+function briefCacheDir(home = relayHome()) {
+  return join11(home, "cache", "brief");
+}
+var safe = (s) => s.replace(/[^A-Za-z0-9_.-]+/g, "_").slice(0, 60);
+function invalidateBriefCache(project, home) {
+  const dir = briefCacheDir(home);
+  if (!existsSync8(dir)) return 0;
+  let n = 0;
+  for (const f of readdirSync3(dir)) {
+    if (!f.endsWith(".json")) continue;
+    if (project && !f.startsWith(`${safe(project)}-`)) continue;
+    rmSync3(join11(dir, f), { force: true });
+    n++;
+  }
+  return n;
+}
+
+// ../core/src/work/worker.ts
+var MAX_IDLE_MS = 5 * 6e4;
+var IDLE_HEARTBEAT_MS = 5 * 6e4;
 
 // ../core/src/work/service.ts
-import { join as join10 } from "path";
+import { join as join12 } from "path";
+
+// ../core/src/work/container.ts
+var CONTAINER_HOME = "/home/relay";
+var CONTAINER_RELAY_HOME = `${CONTAINER_HOME}/.harness`;
+var CONTAINER_CREDENTIALS = `${CONTAINER_RELAY_HOME}/credentials.json`;
 
 // ../core/src/onboard/registry.ts
 var ark = (id) => `https://docs.byteplus.com/en/docs/ModelArk/${id}`;
@@ -3981,22 +5550,22 @@ var models = [
 import * as cheerio from "cheerio";
 
 // ../core/src/onboard/skills.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync6, existsSync as existsSync7, rmSync as rmSync3, writeFileSync as writeFileSync3, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync8, existsSync as existsSync9, rmSync as rmSync4, writeFileSync as writeFileSync4, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
+import { join as join13 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFileSync } from "child_process";
 
 // ../core/src/state/project.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync7, statSync as statSync3 } from "fs";
-import { join as join12, relative, extname } from "path";
+import { readdirSync as readdirSync5, readFileSync as readFileSync9, statSync as statSync3 } from "fs";
+import { join as join14, relative, extname } from "path";
 var MAX_BYTES = 200 * 1024;
 
 // ../core/src/assets/store.ts
 import { createHmac as createHmac2, randomBytes as randomBytes7, timingSafeEqual as timingSafeEqual3 } from "crypto";
-import { createWriteStream, existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
+import { createWriteStream, existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
 import { readFile, rm, stat, writeFile } from "fs/promises";
-import { homedir as homedir7 } from "os";
-import { dirname as dirname4, isAbsolute, join as join13, normalize, relative as relative2, sep } from "path";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname4, isAbsolute, join as join15, normalize, relative as relative2, sep } from "path";
 import { pipeline } from "stream/promises";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "url";
 var PublishUnsupportedError = class extends Error {
@@ -4005,7 +5574,7 @@ var PublishUnsupportedError = class extends Error {
     this.name = "PublishUnsupportedError";
   }
 };
-var ASSETS_HOME = join13(process.env.RELAY_HOME ?? join13(homedir7(), ".harness"), "assets");
+var ASSETS_HOME = join15(process.env.RELAY_HOME ?? join15(homedir8(), ".harness"), "assets");
 function assertSafeKey(key) {
   if (!key || key.includes("\\") || key.startsWith("/") || key.split("/").some((s) => s === "" || s === "." || s === "..")) {
     throw new Error(`unsafe storage key: ${key}`);
@@ -4022,7 +5591,7 @@ var LocalStore = class {
   secret;
   pathFor(key) {
     assertSafeKey(key);
-    const p = normalize(join13(this.root, ...key.split("/")));
+    const p = normalize(join15(this.root, ...key.split("/")));
     const rel = relative2(this.root, p);
     if (rel.startsWith("..") || isAbsolute(rel)) throw new Error(`unsafe storage key: ${key}`);
     return p;
@@ -4040,12 +5609,12 @@ var LocalStore = class {
       this.secret = Buffer.from(env, "utf8");
       return this.secret;
     }
-    const file = join13(this.root, SIGNING_KEY_FILE);
-    if (!existsSync8(file)) {
-      mkdirSync7(this.root, { recursive: true });
-      writeFileSync4(file, randomBytes7(32).toString("hex") + "\n", { mode: 384, flag: "wx" });
+    const file = join15(this.root, SIGNING_KEY_FILE);
+    if (!existsSync10(file)) {
+      mkdirSync8(this.root, { recursive: true });
+      writeFileSync5(file, randomBytes7(32).toString("hex") + "\n", { mode: 384, flag: "wx" });
     }
-    this.secret = Buffer.from(readFileSync8(file, "utf8").trim(), "hex");
+    this.secret = Buffer.from(readFileSync10(file, "utf8").trim(), "hex");
     return this.secret;
   }
   sign(key, exp) {
@@ -4066,7 +5635,7 @@ ${exp}`).digest("base64url");
   }
   async put(key, data, _opts) {
     const p = this.pathFor(key);
-    mkdirSync7(dirname4(p), { recursive: true });
+    mkdirSync8(dirname4(p), { recursive: true });
     if (Buffer.isBuffer(data)) await writeFile(p, data);
     else await pipeline(data, createWriteStream(p));
   }
@@ -4354,10 +5923,10 @@ function htmlBundleIndex(names) {
 // ../core/src/assets/ingest.ts
 import { execFile as execFile7 } from "child_process";
 import { createHash as createHash4 } from "crypto";
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync5, statSync as statSync4, writeFileSync as writeFileSync6 } from "fs";
 import { readFile as readFile2 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { basename, delimiter as delimiter2, join as join14 } from "path";
+import { basename, delimiter as delimiter2, join as join16 } from "path";
 var IngestError = class extends Error {
   constructor(message2) {
     super(message2);
@@ -4368,7 +5937,7 @@ var MAX_THUMB = 512;
 function onPath(bin) {
   for (const dir of (process.env.PATH ?? "").split(delimiter2)) {
     if (!dir) continue;
-    const p = join14(dir, bin);
+    const p = join16(dir, bin);
     try {
       if (statSync4(p).isFile()) return p;
     } catch {
@@ -4387,9 +5956,9 @@ function run(bin, args, timeoutMs = 3e4) {
   });
 }
 function tempFile(bytes, filename) {
-  const dir = mkdtempSync2(join14(tmpdir3(), "relay-asset-"));
-  const file = join14(dir, basename(filename) || "asset");
-  writeFileSync5(file, bytes);
+  const dir = mkdtempSync2(join16(tmpdir3(), "relay-asset-"));
+  const file = join16(dir, basename(filename) || "asset");
+  writeFileSync6(file, bytes);
   return { dir, file };
 }
 async function ffprobe(file) {
@@ -4458,7 +6027,7 @@ async function probeBytes(bytes, filename, opts = {}) {
       const p = await ffprobe(opts.pathForTools ?? tmp.file);
       if (p) Object.assign(probe, p);
     } finally {
-      if (tmp) rmSync4(tmp.dir, { recursive: true, force: true });
+      if (tmp) rmSync5(tmp.dir, { recursive: true, force: true });
     }
   }
   return probe;
@@ -4476,7 +6045,7 @@ async function storeThumbnail(store, prefix, probe, bytes, filename, opts) {
       try {
         thumb = await videoPoster(opts.pathForTools ?? tmp.file, opts.thumbSize ?? MAX_THUMB);
       } finally {
-        if (tmp) rmSync4(tmp.dir, { recursive: true, force: true });
+        if (tmp) rmSync5(tmp.dir, { recursive: true, force: true });
       }
     }
     if (thumb) {
@@ -4550,54 +6119,29 @@ async function finalizeFromKey(db, store, input) {
 }
 
 // ../core/src/rules/owned-section.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname5, join as join15 } from "path";
-var STATE_FILE = join15(".relay", "rules.json");
+import { existsSync as existsSync11, mkdirSync as mkdirSync9, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname5, join as join17 } from "path";
+var STATE_FILE = join17(".relay", "rules.json");
 
 // ../core/src/hooks/types.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync9, readFileSync as readFileSync10, statSync as statSync5, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir8 } from "os";
-import { delimiter as delimiter3, dirname as dirname6, join as join16 } from "path";
-
-// ../core/src/hooks/cache.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync10, readdirSync as readdirSync4, readFileSync as readFileSync11, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync12, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync8 } from "fs";
 import { homedir as homedir9 } from "os";
-import { join as join17 } from "path";
-var BRIEF_CACHE_TTL_MS = 10 * 6e4;
-function relayHome() {
-  return process.env.RELAY_HOME ?? join17(homedir9(), ".harness");
-}
-function briefCacheDir(home = relayHome()) {
-  return join17(home, "cache", "brief");
-}
-var safe = (s) => s.replace(/[^A-Za-z0-9_.-]+/g, "_").slice(0, 60);
-function invalidateBriefCache(project, home) {
-  const dir = briefCacheDir(home);
-  if (!existsSync11(dir)) return 0;
-  let n = 0;
-  for (const f of readdirSync4(dir)) {
-    if (!f.endsWith(".json")) continue;
-    if (project && !f.startsWith(`${safe(project)}-`)) continue;
-    rmSync5(join17(dir, f), { force: true });
-    n++;
-  }
-  return n;
-}
+import { delimiter as delimiter3, dirname as dirname6, join as join18 } from "path";
 
 // ../core/src/hooks/claude.ts
-import { existsSync as existsSync12 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync13 } from "fs";
+import { join as join19 } from "path";
 
 // ../core/src/hooks/codex.ts
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
+import { join as join20 } from "path";
 
 // ../core/src/hooks/grok.ts
-import { existsSync as existsSync14 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync15 } from "fs";
+import { join as join21 } from "path";
 
 // ../core/src/memory/capture.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { spawnSync } from "child_process";
 
 // ../mcp/src/server.ts
@@ -4625,12 +6169,20 @@ var TOOL_SCOPES = [
   { name: "relay_asset_request_upload", scope: "assets:write", description: "Reserve an asset id and get a one-time upload URL; PUT the bytes there, then call relay_asset_finalize." },
   { name: "relay_asset_finalize", scope: "assets:write", description: "Turn an uploaded object into an asset row (probe, thumbnail, record) after relay_asset_request_upload." },
   { name: "relay_task_create", scope: "tasks:write", description: "Open a task: a GitHub issue in the project's repo with the agent:<lane> label (and priority:<p>); returns task_id and issue_url. Idempotent on idempotency_key." },
-  { name: "relay_task_get", scope: "tasks:read", description: "One task by id (owner/repo#n) with its derived state: queued, claimed, running, review, done or failed, plus the worker, PR and last summary." },
-  { name: "relay_task_list", scope: "tasks:read", description: "Tasks with derived state, newest first; filter by project and state." },
+  { name: "relay_task_get", scope: "tasks:read", description: "One task by id (owner/repo#n) with its derived state: queued, held, claimed, running, review, done or failed, plus the worker, PR, preview URL (preview_url, preview_state), the lane's run summary, usage and the review decision. held means the injection gate flagged the issue text; the task.held row in its feed carries the score and reasons." },
+  { name: "relay_task_list", scope: "tasks:read", description: "Tasks with derived state, newest first; filter by project and state. state=review is what waits for a decision; state=held is what the injection gate stopped and a person should look at." },
+  { name: "relay_task_approve", scope: "tasks:write", description: "Approve a task in review: relay squash-merges its PR through GitHub, deletes the branch and writes task.approved (the task is done). A bot may approve only with tasks:write and never a PR its own lane produced; GitHub's refusal comes back as an error with task.merge_failed in the feed." },
+  { name: "relay_task_request_changes", scope: "tasks:write", description: "Send a task in review back with a note: relay comments on the PR (relay: changes requested by <actor>: \u2026), writes task.changes_requested and queues the task; the next run gets the note in its brief and pushes to the same PR." },
+  { name: "relay_task_release", scope: "tokens:write", description: "Release a task the injection gate held (state held): relay writes task.released and the task is queued again; the next worker grades it again before running. Only for text a person has read and judged safe. A bot needs tokens:write and never releases a task it opened itself." },
+  { name: "relay_task_requeue", scope: "tasks:write", description: "Put a task back in the queue from any state but done, optionally on another lane: relay moves the agent:* label on the issue (best effort), releases a live worker claim, writes task.requeued and rings the doorbell; the next worker that serves the lane claims it and starts over. For a task stuck running (a cloud lane nobody wired, a run that never reported) or on the wrong lane." },
   { name: "relay_event_log", scope: "events:write", description: "Log an external.* event in the feed (a bot's own note). The actor is always bot:<token name>; the client cannot choose it." },
   { name: "relay_whoami", scope: null, description: "Who this connection is: token name, granted scopes, expiry and how it authenticated. Public; anonymous callers learn how to get access." },
   { name: "relay_webhook_subscribe", scope: "webhooks:write", description: "Register an outbound webhook for event kinds (exact, a prefix ending in '.', or '*'), optionally one project and a bearer for deliveries. The signing secret is returned once." },
-  { name: "relay_webhook_unsubscribe", scope: "webhooks:write", description: "Remove an outbound webhook by id." }
+  { name: "relay_webhook_unsubscribe", scope: "webhooks:write", description: "Remove an outbound webhook by id." },
+  { name: "relay_access_list", scope: "tokens:write", description: "Device requests waiting for a decision (user_code, client_name, scopes, requested and expiry times) and approvals the device has not polled yet. For the bot that approves other agents." },
+  { name: "relay_access_approve", scope: "tokens:write", description: "Approve (default) or deny a pending device request by its user code: the same decision the Access page makes. The device receives its token on its next poll; the decision is attributed to this token. A bot can approve only scopes it holds itself, and never tokens:write; wider requests are for a person at /activate." },
+  { name: "relay_invite_create", scope: "tokens:write", description: "Mint an invite code for an agent or machine trusted in advance: a name, scopes, optional expiry (24h default) and uses (1 default). The code is returned once; redeeming it needs no approval. A bot can invite only to scopes it holds itself, and never tokens:write." },
+  { name: "relay_invite_revoke", scope: "tokens:write", description: "Revoke a live invite by id or name; an unredeemed code stops working at once." }
 ];
 var toolDescription = (name) => TOOL_SCOPES.find((t) => t.name === name)?.description ?? name;
 function capText(text2, max = RESULT_TOKENS) {
@@ -4693,7 +6245,7 @@ function createRelayServer(db, opts) {
     } catch {
     }
   };
-  const emit = async (row) => {
+  const emit2 = async (row) => {
     if (!row || !opts.afterEvent) return;
     try {
       await opts.afterEvent(row);
@@ -4810,7 +6362,7 @@ function createRelayServer(db, opts) {
       if (!await repo_exports.getProject(db, project)) return fail(`unknown project '${project}'; run relay link in that repo first`);
       const src = source ?? actor.replace(/^(agent|human):/, "");
       const row = supersedes_id ? await repo_exports.supersedeDecision(db, supersedes_id, { text: t, source: src }) : await repo_exports.addDecision(db, { project, text: t, source: src });
-      await emit(await repo_exports.writeEvent(db, { kind: "decision.captured", actor, project, summary: t.slice(0, 200), payload: { decision_id: row.id, source: src, superseded: supersedes_id ?? null } }));
+      await emit2(await repo_exports.writeEvent(db, { kind: "decision.captured", actor, project, summary: t.slice(0, 200), payload: { decision_id: row.id, source: src, superseded: supersedes_id ?? null } }));
       afterWrite(project);
       return text(`recorded decision #${row.id}${supersedes_id ? ` (supersedes #${supersedes_id})` : ""}`);
     }
@@ -4832,7 +6384,7 @@ function createRelayServer(db, opts) {
       if (g) return g;
       if (scope !== "global" && !scope_id) return fail(`scope '${scope}' needs scope_id`);
       await repo_exports.upsertPreference(db, { key, value, scope, scope_id: scope === "global" ? null : scope_id, reason: reason ?? null });
-      await emit(await repo_exports.writeEvent(db, { kind: "preference.set", actor, project: scope === "project" ? scope_id : null, summary: `${key} = ${value} (${scope}${scope_id ? `: ${scope_id}` : ""})`, payload: { key, value, scope, scope_id: scope_id ?? null } }));
+      await emit2(await repo_exports.writeEvent(db, { kind: "preference.set", actor, project: scope === "project" ? scope_id : null, summary: `${key} = ${value} (${scope}${scope_id ? `: ${scope_id}` : ""})`, payload: { key, value, scope, scope_id: scope_id ?? null } }));
       afterWrite(scope === "project" ? scope_id : void 0);
       return text(`set ${key} = ${value} at ${scope}${scope_id ? ` ${scope_id}` : ""}`);
     }
@@ -5007,7 +6559,7 @@ ${p.summary}` : head);
         project: z.string().min(1).describe("project slug (relay link registered it)"),
         title: z.string().min(1).max(256),
         body: z.string().max(6e4).optional().describe("issue body, markdown; the brief the lane reads"),
-        lane: z.enum(TASK_LANES).describe("which subscription implements it"),
+        lane: z.enum(TASK_LANES).optional().describe("claude, codex or grok run on the user's own workers (machines running relay work) and are the normal choice; default claude. claude-cloud and codex-cloud hand the task to the vendor's hosted tier and only work when the operator has wired it; do not pick them unless asked to."),
         priority: z.enum(TASK_PRIORITIES).optional(),
         idempotency_key: z.string().min(1).max(200).optional().describe("repeat calls with the same key return the same task and open nothing")
       }
@@ -5016,9 +6568,10 @@ ${p.summary}` : head);
       const g = gate("tasks:write", "relay_task_create");
       if (g) return g;
       try {
-        const r = await openTask(db, opts.github, { ...args, actor: externalActor(actor) });
-        for (const e of r.events) await emit(e);
-        return json({ task_id: r.task_id, issue_url: r.issue_url, created: r.created, state: r.task.state, lane: args.lane });
+        const lane = args.lane ?? "claude";
+        const r = await openTask(db, opts.github, { ...args, lane, actor: externalActor(actor) });
+        for (const e of r.events) await emit2(e);
+        return json({ task_id: r.task_id, issue_url: r.issue_url, created: r.created, state: r.task.state, lane });
       } catch (e) {
         return fail(`relay: ${e instanceof Error ? e.message : String(e)}${e instanceof TaskCreateError && e.status === 503 ? " (relay_task_create needs GitHub access on the server)" : ""}`);
       }
@@ -5049,6 +6602,95 @@ ${p.summary}` : head);
       return json({ tasks: rows, count: rows.length });
     }
   );
+  const reviewFail = (e, tool) => fail(`relay: ${e instanceof Error ? e.message : String(e)}${e instanceof TaskReviewError && e.status === 503 ? ` (${tool} needs GitHub access on the server)` : ""}`);
+  server.registerTool(
+    "relay_task_approve",
+    { title: "Approve and merge a task", description: toolDescription("relay_task_approve"), inputSchema: { id: z.string().min(3).describe("owner/repo#n") } },
+    async ({ id }) => {
+      const g = gate("tasks:write", "relay_task_approve");
+      if (g) return g;
+      try {
+        const r = await approveTask(db, opts.github, id.trim(), externalActor(actor), { scopes: [...granted] });
+        for (const e of r.events) await emit2(e);
+        afterWrite(r.task.project);
+        return json({ task_id: r.task.id, state: r.task.state, pr_url: r.task.pr_url, merged_at: r.task.merged_at, review: r.task.review });
+      } catch (e) {
+        return reviewFail(e, "relay_task_approve");
+      }
+    }
+  );
+  server.registerTool(
+    "relay_task_request_changes",
+    {
+      title: "Request changes on a task",
+      description: toolDescription("relay_task_request_changes"),
+      inputSchema: { id: z.string().min(3).describe("owner/repo#n"), note: z.string().min(1).max(1e4).describe("what should change; written for the model that will address it") }
+    },
+    async ({ id, note }) => {
+      const g = gate("tasks:write", "relay_task_request_changes");
+      if (g) return g;
+      try {
+        const r = await requestChanges(db, opts.github, id.trim(), externalActor(actor), note, { scopes: [...granted] });
+        for (const e of r.events) await emit2(e);
+        afterWrite(r.task.project);
+        return json({ task_id: r.task.id, state: r.task.state, pr_url: r.task.pr_url, review: r.task.review, next: "the next worker run gets the note under Review feedback in its brief and pushes to the same PR" });
+      } catch (e) {
+        return reviewFail(e, "relay_task_request_changes");
+      }
+    }
+  );
+  server.registerTool(
+    "relay_task_requeue",
+    {
+      title: "Requeue a task",
+      description: toolDescription("relay_task_requeue"),
+      inputSchema: {
+        id: z.string().min(3).describe("owner/repo#n"),
+        lane: z.enum(TASK_LANES).optional().describe("move the task to this lane; claude, codex or grok run on the user's own workers and are the normal choice. Omitted keeps the lane it has."),
+        reason: z.string().max(2e3).optional().describe("why, for the feed")
+      }
+    },
+    async ({ id, lane, reason }) => {
+      const g = gate("tasks:write", "relay_task_requeue");
+      if (g) return g;
+      try {
+        const r = await requeueTask(db, opts.github, id.trim(), externalActor(actor), { lane: lane ?? null, reason: reason ?? null, scopes: [...granted] });
+        for (const e of r.events) await emit2(e);
+        afterWrite(r.task.project);
+        const github = r.events[0]?.payload.github;
+        return json({
+          task_id: r.task.id,
+          state: r.task.state,
+          lane: r.task.lane,
+          runner: r.task.runner,
+          github: github ?? null,
+          next: r.task.lane && r.task.lane.endsWith("-cloud") ? "a cloud lane: nothing dispatches it until the operator wires that lane; requeue on claude, codex or grok for a worker to pick it up" : "the next idle worker that serves the lane claims it and starts over from the base branch"
+        });
+      } catch (e) {
+        return fail(`relay: ${e instanceof TaskRequeueError || e instanceof Error ? e.message : String(e)}`);
+      }
+    }
+  );
+  server.registerTool(
+    "relay_task_release",
+    {
+      title: "Release a held task",
+      description: toolDescription("relay_task_release"),
+      inputSchema: { id: z.string().min(3).describe("owner/repo#n"), note: z.string().max(2e3).optional().describe("why it is safe to run, for the feed") }
+    },
+    async ({ id, note }) => {
+      const g = gate("tokens:write", "relay_task_release");
+      if (g) return g;
+      try {
+        const r = await releaseTask(db, id.trim(), externalActor(actor), { note: note ?? null, scopes: [...granted] });
+        for (const e of r.events) await emit2(e);
+        afterWrite(r.task.project);
+        return json({ task_id: r.task.id, state: r.task.state, lane: r.task.lane, next: "the next idle worker that serves the lane claims it; its gate grades the text again (a pre-check marker holds it again unless the issue is edited or the worker runs with RELAY_GATE=off)" });
+      } catch (e) {
+        return fail(`relay: ${e instanceof TaskGateError || e instanceof Error ? e.message : String(e)}`);
+      }
+    }
+  );
   server.registerTool("relay_whoami", { title: "Who am I", description: toolDescription("relay_whoami"), inputSchema: {} }, async () => {
     const identity = opts.identity ?? (opts.canWrite ? { name: actor, expires_at: null, source: "local" } : { name: "anonymous", expires_at: null, source: "anonymous" });
     return json({
@@ -5093,6 +6735,93 @@ ${p.summary}` : head);
     const removed = await repo_exports.deleteWebhook(db, id);
     return removed ? json({ removed: id }) : fail(`relay: no webhook ${id}`);
   });
+  const oauth = { issuer: opts.oauth?.issuer ?? "relay", ...opts.oauth?.now ? { now: opts.oauth.now } : {}, onEvent: (row) => emit2(row) };
+  const site = opts.oauth?.issuer?.replace(/\/+$/, "");
+  const accessView = (r) => ({ user_code: r.user_code, client_name: r.client_name, scopes: r.scopes, state: r.state, requested_at: r.created_at, expires_at: r.expires_at });
+  const oauthFail = (e, tool) => {
+    if (!(e instanceof OAuthError)) return fail(`relay: ${e instanceof Error ? e.message : String(e)}`);
+    const next = e.status === 403 ? "" : tool === "relay_access_approve" ? e.code === "expired_token" || /already|Unknown code/.test(e.description) ? " Call relay_access_list to see what is waiting; if the code is not there, ask the device to request a fresh one (it starts the device flow again and shows a new RLAY-XXXX) and approve that." : " Codes look like RLAY-XXXX; relay_access_list shows the pending ones." : "";
+    return fail(`relay: ${e.description}${next}`);
+  };
+  server.registerTool("relay_access_list", { title: "Pending access requests", description: toolDescription("relay_access_list"), inputSchema: {} }, async () => {
+    const g = gate("tokens:write", "relay_access_list");
+    if (g) return g;
+    const rows = await listRecentAccess(db, oauth);
+    const pending = rows.filter((r) => r.state === "pending").map(accessView);
+    const approved = rows.filter((r) => r.state === "approved").map(accessView);
+    return json({
+      pending,
+      approved_awaiting_poll: approved,
+      count: pending.length,
+      ...pending.length ? { next: 'relay_access_approve({ user_code }) approves one; { decision: "deny" } refuses it.' } : {}
+    });
+  });
+  server.registerTool(
+    "relay_access_approve",
+    {
+      title: "Approve an access request",
+      description: toolDescription("relay_access_approve"),
+      inputSchema: {
+        user_code: z.string().min(4).max(20).describe("the code the device showed, RLAY-XXXX (case and dashes do not matter)"),
+        decision: z.enum(["approve", "deny"]).optional().describe("approve (default) or deny")
+      }
+    },
+    async ({ user_code, decision }) => {
+      const g = gate("tokens:write", "relay_access_approve");
+      if (g) return g;
+      try {
+        const row = await decideDeviceRequest(db, user_code, decision ?? "approve", externalActor(actor), oauth, [...granted]);
+        return json({
+          user_code: row.user_code,
+          status: row.status,
+          client_name: row.client_name,
+          scopes: row.scopes,
+          decided_by: row.actor,
+          ...row.status === "approved" ? { next: `${row.client_name} receives its token (oauth:${row.client_name}) on its next poll of /oauth/token; nothing else to do.` } : {}
+        });
+      } catch (e) {
+        return oauthFail(e, "relay_access_approve");
+      }
+    }
+  );
+  server.registerTool(
+    "relay_invite_create",
+    {
+      title: "Mint an invite code",
+      description: toolDescription("relay_invite_create"),
+      inputSchema: {
+        name: z.string().min(1).max(80).describe("who it is for; the token it yields is named oauth:<name>"),
+        scopes: z.array(z.enum(TOKEN_SCOPES)).min(1).describe("exactly the scopes the token will carry"),
+        expires_in: z.union([z.string().min(1), z.number().int().positive()]).optional().describe("a duration like 1h, 24h, 7d, or seconds; default 24h"),
+        uses: z.number().int().min(1).max(1e3).optional().describe("how many times the code may be redeemed; default 1")
+      }
+    },
+    async ({ name, scopes, expires_in, uses }) => {
+      const g = gate("tokens:write", "relay_invite_create");
+      if (g) return g;
+      const ttl = expires_in === void 0 ? void 0 : parseDuration(expires_in);
+      if (expires_in !== void 0 && !ttl) return fail("relay: expires_in must be a duration like 24h, 7d, or a number of seconds.");
+      try {
+        const r = await createInvite(db, { name, scopes, ...ttl ? { expiresInSeconds: ttl } : {}, ...uses ? { uses } : {}, createdBy: externalActor(actor), creatorScopes: [...granted] }, oauth);
+        const where = site ?? "<site>";
+        return json({
+          invite: r.invite,
+          code: r.code,
+          setup: `relay setup --site ${where} --invite ${r.code}`,
+          redeem: `POST ${where}/oauth/token with grant_type=${GRANT_INVITE} invite=${r.code} client_name=<who is redeeming>`,
+          note: "The code is shown once. Hand it to the agent or machine it is for; whoever redeems it gets a token named oauth:" + r.invite.name + " with exactly these scopes and no approval step."
+        });
+      } catch (e) {
+        return oauthFail(e, "relay_invite_create");
+      }
+    }
+  );
+  server.registerTool("relay_invite_revoke", { title: "Revoke an invite", description: toolDescription("relay_invite_revoke"), inputSchema: { id_or_name: z.string().min(1).describe("the invite's id or the name it was created for") } }, async ({ id_or_name }) => {
+    const g = gate("tokens:write", "relay_invite_revoke");
+    if (g) return g;
+    const row = await revokeInvite2(db, id_or_name.trim(), externalActor(actor), oauth);
+    return row ? json({ revoked: row }) : fail(`relay: no live invite matches '${id_or_name}'; it may be spent, expired or already revoked.`);
+  });
   server.registerTool(
     "relay_event_log",
     {
@@ -5112,7 +6841,7 @@ ${p.summary}` : head);
       if (g) return g;
       if (project && !await repo_exports.getProject(db, project)) return fail(`relay: unknown project '${project}'`);
       const row = await repo_exports.writeEvent(db, { kind, actor: externalActor(actor), project: project ?? null, summary, url: url ?? null, cost_equiv: cost_equiv ?? 0, payload: source ? { source } : {} });
-      await emit(row);
+      await emit2(row);
       return json(row ? { id: row.id, ts: row.ts, kind: row.kind, actor: row.actor } : { deduped: true });
     }
   );
@@ -5132,6 +6861,8 @@ async function main() {
     assets: { store: openAssetStore() },
     ...embed ? { embed } : {},
     ...github ? { github } : {},
+    // Invites minted here live in this database; the setup line names the site only when this machine has one configured.
+    ...h.cfg.site ? { oauth: { issuer: h.cfg.site } } : {},
     afterEvent: (row) => dispatchEvent(h.db, row).then(() => void 0)
   });
   const transport = new StdioServerTransport();