@lobehub/cli 0.0.60 → 0.0.61

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
 import * as fs$2 from "node:fs";
-import fs, { appendFileSync, closeSync, constants, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync as readFileSync$1, readSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlink, writeFileSync } from "node:fs";
+import fs, { appendFileSync, closeSync, constants, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlink, writeFileSync } from "node:fs";
 import * as os$1 from "node:os";
 import os, { EOL, constants as constants$1, homedir, platform, tmpdir } from "node:os";
 import * as path$1 from "node:path";
@@ -18934,7 +18934,7 @@ var init_heteroSelectorCapabilities = __esmMin((() => {
 					kind: "config"
 				}],
 				resolve: resolveCodexModel,
-				source: "static"
+				source: "catalog"
 			},
 			speed: {
 				encodings: [{
@@ -19394,6 +19394,53 @@ var init_agent = __esmMin((() => {
 //#region ../../packages/types/src/agentAccount.ts
 var init_agentAccount = __esmMin((() => {}));
 
+//#endregion
+//#region ../../packages/types/src/device.ts
+var gitLinkedPullRequestSchema, workingDirConfigSchema;
+var init_device = __esmMin((() => {
+	init_zod$1();
+	gitLinkedPullRequestSchema = object$2({
+		ciStatus: _enum([
+			"failure",
+			"pending",
+			"success",
+			"unknown"
+		]).optional(),
+		isDraft: boolean().optional(),
+		mergeable: string().optional(),
+		mergeStateStatus: string().optional(),
+		mergedAt: string().nullable().optional(),
+		number: number(),
+		reviewDecision: string().optional(),
+		state: string(),
+		title: string(),
+		url: string()
+	});
+	workingDirConfigSchema = object$2({
+		git: object$2({
+			activeWorktree: string().optional(),
+			branch: string().optional(),
+			detached: boolean().optional(),
+			github: object$2({
+				extraPullRequestCount: number().optional(),
+				pullRequest: gitLinkedPullRequestSchema.nullable().optional(),
+				pullRequestStatus: _enum([
+					"error",
+					"gh-missing",
+					"ok"
+				]).optional()
+			}).optional(),
+			isWorktree: boolean().optional(),
+			upstream: object$2({
+				branch: string(),
+				remote: string()
+			}).optional()
+		}).optional(),
+		path: string(),
+		repoType: _enum(["git", "github"]).optional()
+	});
+}));
+
 //#endregion
 //#region ../../packages/types/src/agentExecution/credentialFacts.ts
 var init_credentialFacts = __esmMin((() => {}));
@@ -19404,9 +19451,26 @@ var init_modelFacts = __esmMin((() => {}));
 
 //#endregion
 //#region ../../packages/types/src/agentExecution/index.ts
+var initialTopicMetadataSchema;
 var init_agentExecution = __esmMin((() => {
+	init_zod$1();
+	init_device();
 	init_credentialFacts();
 	init_modelFacts();
+	initialTopicMetadataSchema = object$2({
+		repos: array(string()).optional(),
+		/**
+		* Cloud-sandbox instance the composer chose before any topic existed. The
+		* choice is made on a conversation that has nothing to write to yet, so it
+		* travels with the first send instead — the server cannot read the client's
+		* pending selection, and without this the new topic would be born unbound and
+		* silently run at the workspace root.
+		*/
+		sandboxInstanceId: string().optional(),
+		sandboxMode: _enum(["ephemeral", "persistent"]).optional(),
+		workingDirectory: string().optional(),
+		workingDirectoryConfig: workingDirConfigSchema.optional()
+	});
 }));
 
 //#endregion
@@ -20637,55 +20701,12 @@ var init_conversation = __esmMin((() => {}));
 var init_creds = __esmMin((() => {}));
 
 //#endregion
-//#region ../../packages/types/src/dbMigration.ts
-var init_dbMigration = __esmMin((() => {}));
+//#region ../../packages/types/src/dashboard/index.ts
+var init_dashboard = __esmMin((() => {}));
 
 //#endregion
-//#region ../../packages/types/src/device.ts
-var gitLinkedPullRequestSchema, workingDirConfigSchema;
-var init_device = __esmMin((() => {
-	init_zod$1();
-	gitLinkedPullRequestSchema = object$2({
-		ciStatus: _enum([
-			"failure",
-			"pending",
-			"success",
-			"unknown"
-		]).optional(),
-		isDraft: boolean().optional(),
-		mergeable: string().optional(),
-		mergeStateStatus: string().optional(),
-		mergedAt: string().nullable().optional(),
-		number: number(),
-		reviewDecision: string().optional(),
-		state: string(),
-		title: string(),
-		url: string()
-	});
-	workingDirConfigSchema = object$2({
-		git: object$2({
-			activeWorktree: string().optional(),
-			branch: string().optional(),
-			detached: boolean().optional(),
-			github: object$2({
-				extraPullRequestCount: number().optional(),
-				pullRequest: gitLinkedPullRequestSchema.nullable().optional(),
-				pullRequestStatus: _enum([
-					"error",
-					"gh-missing",
-					"ok"
-				]).optional()
-			}).optional(),
-			isWorktree: boolean().optional(),
-			upstream: object$2({
-				branch: string(),
-				remote: string()
-			}).optional()
-		}).optional(),
-		path: string(),
-		repoType: _enum(["git", "github"]).optional()
-	});
-}));
+//#region ../../packages/types/src/dbMigration.ts
+var init_dbMigration = __esmMin((() => {}));
 
 //#endregion
 //#region ../../packages/types/src/deviceMetric.ts
@@ -21170,22 +21191,43 @@ var init_goal = __esmMin((() => {}));
 
 //#endregion
 //#region ../../packages/types/src/goalReport.ts
-var idList, goalReportDetourKinds, GoalReportDetourSchema, GoalReportChapterSchema, GoalReportNextStepSchema, GoalReportMainlineSchema, GoalReportMetadataSchema;
+var idList, NO_VALUE_TOKENS, optionalId, goalReportDetourKinds, GOAL_REPORT_MAX_DETOUR_TITLE_LENGTH, GOAL_REPORT_MAX_DETOUR_TEXT_LENGTH, GoalReportDetourSchema, GOAL_REPORT_MAX_DETOURS_PER_CHAPTER, GoalReportChapterSchema, GoalReportNextStepSchema, GoalReportMainlineSchema, GoalReportMetadataSchema;
 var init_goalReport = __esmMin((() => {
 	init_zod$1();
 	idList = array(string().trim().min(1)).max(200);
+	NO_VALUE_TOKENS = new Set([
+		"",
+		"-",
+		"—",
+		"n/a",
+		"na",
+		"nil",
+		"none",
+		"null",
+		"undefined"
+	]);
+	optionalId = preprocess((value) => {
+		if (value === null || value === void 0) return void 0;
+		if (typeof value !== "string") return value;
+		const trimmed = value.trim();
+		if (trimmed === "" || NO_VALUE_TOKENS.has(trimmed.toLowerCase())) return void 0;
+		return trimmed;
+	}, string().trim().min(1).optional());
 	goalReportDetourKinds = [
 		"dead_end",
 		"superseded",
 		"retry"
 	];
+	GOAL_REPORT_MAX_DETOUR_TITLE_LENGTH = 200;
+	GOAL_REPORT_MAX_DETOUR_TEXT_LENGTH = 2e3;
 	GoalReportDetourSchema = object$2({
 		kind: _enum(goalReportDetourKinds),
-		lesson: string().trim().min(1).max(2e3),
+		lesson: string().trim().min(1).max(GOAL_REPORT_MAX_DETOUR_TEXT_LENGTH),
 		nodeIds: idList.min(1),
-		reason: string().trim().min(1).max(2e3),
+		reason: string().trim().min(1).max(GOAL_REPORT_MAX_DETOUR_TEXT_LENGTH),
 		title: string().trim().min(1).max(200)
 	}).strict();
+	GOAL_REPORT_MAX_DETOURS_PER_CHAPTER = 20;
 	GoalReportChapterSchema = object$2({
 		detours: array(GoalReportDetourSchema).max(20).default([]),
 		findingIds: idList.default([]),
@@ -21205,7 +21247,12 @@ var init_goalReport = __esmMin((() => {
 	}).strict();
 	GoalReportMetadataSchema = object$2({
 		chapters: array(GoalReportChapterSchema).min(1).max(30),
-		deliverableWorkId: string().trim().min(1).optional(),
+		/**
+		* The Goal's final deliverable, when it produced one. A placeholder such as
+		* `""` or `"none"` is read as "no deliverable" rather than rejected, so a
+		* Goal without one can still report.
+		*/
+		deliverableWorkId: optionalId,
 		/** The newest `goal_events.id` the report was written against. */
 		graphCursor: string().trim().min(1),
 		headline: string().trim().min(1).max(500),
@@ -21968,6 +22015,9 @@ var init_topic$1 = __esmMin((() => {
 			messageId: string(),
 			reservedAt: string()
 		}).nullable().optional(),
+		sandboxCwd: string().optional(),
+		sandboxInstanceId: string().optional(),
+		sandboxMode: _enum(["ephemeral", "persistent"]).optional(),
 		scheduledRun: topicScheduledRunSchema.nullish(),
 		workingDirectory: string().optional(),
 		workingDirectoryConfig: workingDirConfigSchema.optional()
@@ -22163,7 +22213,13 @@ var init_preference = __esmMin((() => {
 		* expose a port on the working device through a tunnel link, so a dev server
 		* running there can be opened from this UI
 		*/
-		enableDeviceTunnel: boolean().optional()
+		enableDeviceTunnel: boolean().optional(),
+		/**
+		* opt this user's cloud-sandbox runs into a persistent workspace: the working
+		* directory survives session recycling and is shared across their topics,
+		* instead of being thrown away with the sandbox
+		*/
+		enablePersistentSandbox: boolean().optional()
 	});
 	GithubIntegrationPreferenceSchema = object$2({
 		acceptOnMerge: boolean().optional(),
@@ -22607,6 +22663,10 @@ var init_userMemory = __esmMin((() => {
 //#region ../../packages/types/src/verify.ts
 var init_verify = __esmMin((() => {}));
 
+//#endregion
+//#region ../../packages/types/src/widget/index.ts
+var init_widget = __esmMin((() => {}));
+
 //#endregion
 //#region ../../packages/types/src/work.ts
 var WORK_PROVIDER_RESOURCE_TYPES, RESOURCE_TYPE_TO_PROVIDER;
@@ -22723,6 +22783,7 @@ var init_src$1 = __esmMin((() => {
 	init_chunk$1();
 	init_conversation();
 	init_creds();
+	init_dashboard();
 	init_dbMigration();
 	init_device();
 	init_deviceMetric();
@@ -22774,6 +22835,7 @@ var init_src$1 = __esmMin((() => {
 	init_user();
 	init_userMemory();
 	init_verify();
+	init_widget();
 	init_work();
 	init_acceptanceComment();
 	init_acceptanceFlow();
@@ -23127,6 +23189,7 @@ const TRPC_NAMESPACE_API_KEY_RULES = {
 	composio: "blocked",
 	config: "open",
 	connector: "blocked",
+	dashboard: rw("agent:read", null),
 	device: "blocked",
 	deviceMetric: "blocked",
 	document: rw("knowledge:read", "knowledge:write"),
@@ -23167,6 +23230,7 @@ const TRPC_NAMESPACE_API_KEY_RULES = {
 	referral: "blocked",
 	resourcePermission: "blocked",
 	resourceTransferRequest: "blocked",
+	sandboxStorage: "blocked",
 	search: rw("chat:read", null),
 	scm: "blocked",
 	session: rw("chat:read", "chat:write"),
@@ -23192,6 +23256,7 @@ const TRPC_NAMESPACE_API_KEY_RULES = {
 	video: { any: "model:invoke" },
 	waitlist: "blocked",
 	webBrowsing: { any: "model:invoke" },
+	widget: rw("agent:read", null),
 	work: rw("agent:read", "agent:write"),
 	workspace: rw("workspace:read", "workspace:write"),
 	workspaceAuditLog: rw("workspace:read", null),
@@ -25371,33 +25436,199 @@ async function getAgentStreamAuthInfo(workspaceId) {
 	};
 }
 
+//#endregion
+//#region src/utils/agentRunOutcome.ts
+/**
+* Exit status contract of `lh agent run`. Scripts can tell a parked run apart
+* from a finished one, and both apart from a run the CLI could not confirm.
+*/
+const AGENT_RUN_EXIT_CODES = {
+	completed: 0,
+	failed: 1,
+	interrupted: 1,
+	unknown: 3,
+	waiting_for_human: 2
+};
+const COMPLETED_STATUSES = new Set([
+	"completed",
+	"done",
+	"success"
+]);
+const FAILED_STATUSES = new Set(["error", "failed"]);
+const INTERRUPTED_STATUSES = new Set([
+	"aborted",
+	"canceled",
+	"cancelled",
+	"interrupted"
+]);
+/** Non-terminal runtime statuses: the run is still going (or about to resume). */
+const ACTIVE_STATUSES = new Set([
+	"idle",
+	"pending",
+	"processing",
+	"running",
+	"waiting_for_async_tool"
+]);
+/**
+* Classify a runtime status or `agent_runtime_end` reason. Returns `active`
+* for a run that is still going and `undefined` for a value the CLI does not
+* recognise.
+*/
+const classifyRunStatus = (status) => {
+	if (!status) return void 0;
+	if (COMPLETED_STATUSES.has(status)) return "completed";
+	if (FAILED_STATUSES.has(status)) return "failed";
+	if (INTERRUPTED_STATUSES.has(status)) return "interrupted";
+	if (status === "waiting_for_human") return "waiting_for_human";
+	if (ACTIVE_STATUSES.has(status)) return "active";
+};
+const errorText = (error) => {
+	if (!error) return void 0;
+	if (typeof error === "string") return error;
+	if (typeof error === "object" && "message" in error) return String(error.message);
+	return JSON.stringify(error);
+};
+/**
+* Read `aiAgent.getOperationStatus`. The server answers with an envelope —
+* `{ currentState: { status, stepCount, usage, cost, error }, isCompleted,
+* hasError, needsHumanInput, isActive, ... }` — so the run's fields live under
+* `currentState`, not at the top level. The flat reads are kept as fallbacks
+* for older servers, and the envelope's summary flags stand in when there is
+* no status string at all.
+*/
+const readOperationStatus = (r) => {
+	const state = r?.currentState ?? {};
+	let status = state.status ?? r?.status ?? r?.state;
+	if (!status) {
+		if (r?.isCompleted) status = r.hasError ? "error" : "done";
+		else if (r?.needsHumanInput) status = "waiting_for_human";
+		else if (r?.isActive) status = "running";
+	}
+	return {
+		cost: state.cost ?? r?.cost,
+		error: errorText(state.error ?? r?.error),
+		status,
+		stepCount: state.stepCount ?? r?.stepCount ?? r?.stats?.totalSteps,
+		usage: state.usage ?? r?.usage
+	};
+};
+const colorStatus$1 = (status) => {
+	switch (classifyRunStatus(status)) {
+		case "completed": return import_picocolors.default.green(status);
+		case "failed": return import_picocolors.default.red(status);
+		case "interrupted":
+		case "waiting_for_human": return import_picocolors.default.yellow(status);
+		case "active": return import_picocolors.default.cyan(status);
+		default: return import_picocolors.default.dim(status);
+	}
+};
+/** One-line human summary of an outcome, used by the stream and poll paths. */
+const describeOutcome = (outcome) => {
+	switch (outcome.kind) {
+		case "completed": return `${import_picocolors.default.green("✓")} Agent finished`;
+		case "failed": return `${import_picocolors.default.red("✗")} Agent failed${outcome.error ? `: ${outcome.error}` : ""}`;
+		case "interrupted": return `${import_picocolors.default.yellow("■")} Agent interrupted`;
+		case "waiting_for_human": return `${import_picocolors.default.yellow("⏸")} Agent paused: waiting for human approval — approve or answer it in LobeHub, the CLI does not wait for it`;
+		case "unknown": return `${import_picocolors.default.yellow("?")} Agent run outcome unknown${outcome.status ? ` (status: ${outcome.status})` : ""}`;
+	}
+};
+
 //#endregion
 //#region src/utils/agentStream.ts
 /**
+* Map an `agent_runtime_end` event to the run outcome. The server ends the
+* stream on `done`, `error`, `interrupted` and `waiting_for_human` alike, so the
+* end event alone does not mean the run succeeded — `data.reason` says how.
+*/
+const outcomeFromEndEvent = (event) => {
+	const reason = event.data?.reason;
+	const kind = classifyRunStatus(reason);
+	const error = event.data?.finalState?.error;
+	return {
+		error: typeof error === "string" ? error : error?.message ?? void 0,
+		kind: !reason ? "completed" : kind && kind !== "active" ? kind : "unknown",
+		status: reason
+	};
+};
+const STALL_TIMEOUT = 6e4;
+const outcomeFromErrorEvent = (event) => ({
+	error: event.data?.message || event.data?.error || "Unknown error",
+	kind: "failed",
+	status: "error"
+});
+/**
 * Connect to the agent SSE stream and render events to the terminal.
-* Resolves when the stream ends (agent_runtime_end or connection close).
+* Resolves with the run outcome once a terminal event arrives, or `undefined`
+* when the stream closed without one (the caller should check the status).
+* Rejects when the stream cannot be opened — the run may still be executing
+* server-side, so the caller falls back to polling rather than exiting here.
 */
 async function streamAgentEvents(url, headers, options = {}) {
-	const res = await fetch(url, { headers });
-	if (!res.ok) {
-		const text = await res.text();
-		log$13.error(`Agent stream failed: ${res.status} ${text}`);
-		process.exit(1);
-	}
-	if (!res.body) {
-		log$13.error("No response body received from agent stream");
-		process.exit(1);
+	const { onStall, stallTimeoutMs = STALL_TIMEOUT } = options;
+	const jsonEvents = [];
+	let jsonPrinted = false;
+	const printJsonOnce = () => {
+		if (!options.json || jsonPrinted) return;
+		jsonPrinted = true;
+		console.log(JSON.stringify(jsonEvents, null, 2));
+	};
+	let res;
+	try {
+		res = await fetch(url, { headers });
+		if (!res.ok) {
+			const text = await res.text();
+			throw new Error(`Agent stream failed: ${res.status} ${text}`);
+		}
+		if (!res.body) throw new Error("No response body received from agent stream");
+	} catch (error) {
+		printJsonOnce();
+		throw error;
 	}
 	const reader = res.body.getReader();
 	const decoder = new TextDecoder();
 	let buffer = "";
-	const jsonEvents = [];
 	const ctx = createRenderContext();
 	let eventType = "";
 	let eventData = "";
+	let finished = false;
+	let stallTimer;
+	let stalled;
+	const armStallTimer = () => {
+		if (!onStall) return;
+		if (stallTimer) clearTimeout(stallTimer);
+		stallTimer = setTimeout(async () => {
+			if (finished) return;
+			const silence = `Agent stream sent no progress for ${Math.round(stallTimeoutMs / 1e3)}s`;
+			log$13.debug(`${silence}; checking the run status`);
+			try {
+				const outcome = await onStall();
+				if (finished) return;
+				if (!outcome) {
+					armStallTimer();
+					return;
+				}
+				stalled = { outcome };
+			} catch (error) {
+				if (finished) return;
+				stalled = { error: /* @__PURE__ */ new Error(`${silence}; status check failed: ${error.message}`) };
+			}
+			reader.cancel();
+		}, stallTimeoutMs);
+	};
+	armStallTimer();
 	try {
 		while (true) {
 			const { done, value } = await reader.read();
+			if (stalled) {
+				finished = true;
+				if ("error" in stalled) {
+					printJsonOnce();
+					throw stalled.error;
+				}
+				if (options.json) printJsonOnce();
+				else renderOutcome(stalled.outcome);
+				return stalled.outcome;
+			}
 			if (done) break;
 			buffer += decoder.decode(value, { stream: true });
 			const lines = buffer.split("\n");
@@ -25415,19 +25646,22 @@ async function streamAgentEvents(url, headers, options = {}) {
 						eventData = "";
 						continue;
 					}
+					armStallTimer();
 					try {
 						const event = JSON.parse(eventData);
 						if (options.json) jsonEvents.push(event);
 						else renderEvent(event, ctx, options);
 						if (event.type === "agent_runtime_end") {
-							if (options.json) console.log(JSON.stringify(jsonEvents, null, 2));
-							else renderEnd(event);
-							return;
+							const outcome = outcomeFromEndEvent(event);
+							if (options.json) printJsonOnce();
+							else renderEnd(event, outcome);
+							return outcome;
 						}
 						if (event.type === "error") {
-							if (options.json) console.log(JSON.stringify(jsonEvents, null, 2));
-							log$13.error(`Agent error: ${event.data?.message || event.data?.error || "Unknown error"}`);
-							process.exit(1);
+							printJsonOnce();
+							const outcome = outcomeFromErrorEvent(event);
+							log$13.error(`Agent error: ${outcome.error}`);
+							return outcome;
 						}
 					} catch {}
 					eventType = "";
@@ -25435,18 +25669,26 @@ async function streamAgentEvents(url, headers, options = {}) {
 				}
 			}
 		}
-		if (options.json && jsonEvents.length > 0) console.log(JSON.stringify(jsonEvents, null, 2));
+		printJsonOnce();
+		return;
 	} finally {
+		finished = true;
+		if (stallTimer) clearTimeout(stallTimer);
 		reader.releaseLock();
 	}
 }
 /**
 * Replay previously saved JSON events (from --json output) to the terminal.
-* No network calls needed.
+* No network calls needed. Returns the outcome carried by the recorded terminal
+* event, or `undefined` when the recording has none (e.g. a truncated capture).
 */
 function replayAgentEvents(events, options = {}) {
 	if (options.json) {
 		console.log(JSON.stringify(events, null, 2));
+		for (const event of events) {
+			if (event.type === "agent_runtime_end") return outcomeFromEndEvent(event);
+			if (event.type === "error") return outcomeFromErrorEvent(event);
+		}
 		return;
 	}
 	const ctx = createRenderContext();
@@ -25454,22 +25696,26 @@ function replayAgentEvents(events, options = {}) {
 		if (!event.type) continue;
 		renderEvent(event, ctx, options);
 		if (event.type === "agent_runtime_end") {
-			renderEnd(event);
-			return;
+			const outcome = outcomeFromEndEvent(event);
+			renderEnd(event, outcome);
+			return outcome;
 		}
 		if (event.type === "error") {
-			log$13.error(`Agent error: ${event.data?.message || event.data?.error || "Unknown error"}`);
-			return;
+			const outcome = outcomeFromErrorEvent(event);
+			log$13.error(`Agent error: ${outcome.error}`);
+			return outcome;
 		}
 	}
 }
 const HEARTBEAT_INTERVAL$1 = 3e4;
 /**
 * Connect to the Agent Gateway via WebSocket and render events to the terminal.
-* Resolves when the session completes or the connection closes.
+* Resolves with the run outcome once a terminal event arrives, `undefined` when
+* the gateway completed the session without one, and rejects when the
+* connection fails so the caller can fall back to polling.
 */
 async function streamAgentEventsViaWebSocket(options) {
-	const { gatewayUrl, operationId, serverUrl, token, tokenType = "jwt", ...streamOpts } = options;
+	const { gatewayUrl, onStall, operationId, serverUrl, stallTimeoutMs = STALL_TIMEOUT, token, tokenType = "jwt", ...streamOpts } = options;
 	const wsUrl = urlJoin(gatewayUrl.replace(/^http/, "ws"), `/ws?operationId=${encodeURIComponent(operationId)}`);
 	log$13.debug(`Connecting to gateway: ${wsUrl} (auth: ${tokenType})`);
 	return new Promise((resolve, reject) => {
@@ -25477,12 +25723,56 @@ async function streamAgentEventsViaWebSocket(options) {
 		const jsonEvents = [];
 		const ctx = createRenderContext();
 		let heartbeatTimer;
+		let stallTimer;
 		let isSettled = false;
 		let jsonPrinted = false;
 		const cleanup = () => {
 			if (heartbeatTimer) clearInterval(heartbeatTimer);
+			if (stallTimer) clearTimeout(stallTimer);
 			if (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING) ws.close();
 		};
+		const printJsonOnce = () => {
+			if (streamOpts.json && !jsonPrinted) {
+				jsonPrinted = true;
+				console.log(JSON.stringify(jsonEvents, null, 2));
+			}
+		};
+		const settle = (outcome) => {
+			if (isSettled) return;
+			isSettled = true;
+			cleanup();
+			resolve(outcome);
+		};
+		const fail = (error) => {
+			if (isSettled) return;
+			isSettled = true;
+			cleanup();
+			printJsonOnce();
+			reject(error);
+		};
+		const armStallTimer = () => {
+			if (stallTimer) clearTimeout(stallTimer);
+			stallTimer = setTimeout(async () => {
+				if (isSettled) return;
+				const silence = `Agent gateway WebSocket sent no progress for ${Math.round(stallTimeoutMs / 1e3)}s`;
+				if (!onStall) {
+					fail(/* @__PURE__ */ new Error(`${silence} and never reported completion`));
+					return;
+				}
+				log$13.debug(`${silence}; checking the run status`);
+				try {
+					const outcome = await onStall();
+					if (isSettled) return;
+					if (outcome) {
+						if (!streamOpts.json) renderOutcome(outcome);
+						printJsonOnce();
+						settle(outcome);
+					} else armStallTimer();
+				} catch (error) {
+					fail(/* @__PURE__ */ new Error(`${silence}; status check failed: ${error.message}`));
+				}
+			}, stallTimeoutMs);
+		};
 		ws.onopen = () => {
 			ws.send(JSON.stringify({
 				serverUrl,
@@ -25490,9 +25780,11 @@ async function streamAgentEventsViaWebSocket(options) {
 				tokenType,
 				type: "auth"
 			}));
+			armStallTimer();
 		};
 		ws.onmessage = (event) => {
 			const msg = JSON.parse(event.data);
+			if (msg.type !== "heartbeat_ack") armStallTimer();
 			if (msg.type === "auth_success") {
 				log$13.debug("Gateway authenticated");
 				ws.send(JSON.stringify({
@@ -25502,11 +25794,11 @@ async function streamAgentEventsViaWebSocket(options) {
 				heartbeatTimer = setInterval(() => {
 					if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: "heartbeat" }));
 				}, HEARTBEAT_INTERVAL$1);
+				heartbeatTimer.unref?.();
 				return;
 			}
 			if (msg.type === "auth_failed") {
-				cleanup();
-				reject(/* @__PURE__ */ new Error(`Gateway auth failed: ${msg.reason}`));
+				fail(/* @__PURE__ */ new Error(`Gateway auth failed: ${msg.reason}`));
 				return;
 			}
 			if (msg.type === "heartbeat_ack") return;
@@ -25516,57 +25808,33 @@ async function streamAgentEventsViaWebSocket(options) {
 				if (streamOpts.json) jsonEvents.push(agentEvent);
 				else renderEvent(agentEvent, ctx, streamOpts);
 				if (agentEvent.type === "agent_runtime_end") {
-					if (streamOpts.json && !jsonPrinted) {
-						jsonPrinted = true;
-						console.log(JSON.stringify(jsonEvents, null, 2));
-					} else if (!streamOpts.json) renderEnd(agentEvent);
 					if (isSettled) return;
-					isSettled = true;
-					cleanup();
-					resolve();
+					const outcome = outcomeFromEndEvent(agentEvent);
+					if (!streamOpts.json) renderEnd(agentEvent, outcome);
+					printJsonOnce();
+					settle(outcome);
 					return;
 				}
 				if (agentEvent.type === "error") {
-					if (streamOpts.json && !jsonPrinted) {
-						jsonPrinted = true;
-						console.log(JSON.stringify(jsonEvents, null, 2));
-					}
-					log$13.error(`Agent error: ${agentEvent.data?.message || agentEvent.data?.error || "Unknown error"}`);
-					cleanup();
-					process.exit(1);
+					if (isSettled) return;
+					const outcome = outcomeFromErrorEvent(agentEvent);
+					printJsonOnce();
+					log$13.error(`Agent error: ${outcome.error}`);
+					settle(outcome);
+					return;
 				}
 			}
 			if (msg.type === "session_complete") {
-				if (streamOpts.json && jsonEvents.length > 0 && !jsonPrinted) {
-					jsonPrinted = true;
-					console.log(JSON.stringify(jsonEvents, null, 2));
-				}
-				if (isSettled) return;
-				isSettled = true;
-				cleanup();
-				resolve();
+				printJsonOnce();
+				settle(void 0);
 			}
 		};
 		ws.onerror = (err) => {
-			cleanup();
-			if (isSettled) return;
-			if (streamOpts.json && jsonEvents.length > 0 && !jsonPrinted) {
-				jsonPrinted = true;
-				console.log(JSON.stringify(jsonEvents, null, 2));
-			}
-			isSettled = true;
-			reject(/* @__PURE__ */ new Error(`Agent gateway WebSocket failed: ${String(err)}`));
+			fail(/* @__PURE__ */ new Error(`Agent gateway WebSocket failed: ${String(err)}`));
 		};
 		ws.onclose = (event) => {
-			if (heartbeatTimer) clearInterval(heartbeatTimer);
-			if (isSettled) return;
-			if (streamOpts.json && jsonEvents.length > 0 && !jsonPrinted) {
-				jsonPrinted = true;
-				console.log(JSON.stringify(jsonEvents, null, 2));
-			}
-			isSettled = true;
 			const reason = event.reason ? `: ${event.reason}` : "";
-			reject(/* @__PURE__ */ new Error(`Agent gateway WebSocket closed before completion (code ${event.code}${reason})`));
+			fail(/* @__PURE__ */ new Error(`Agent gateway WebSocket closed before completion (code ${event.code}${reason})`));
 		};
 	});
 }
@@ -25621,10 +25889,17 @@ function renderEvent(event, ctx, options) {
 		case "step_complete": break;
 	}
 }
-function renderEnd(event) {
+function renderOutcome(outcome) {
+	console.log();
+	console.log(describeOutcome(outcome));
+}
+function renderEnd(event, outcome) {
 	console.log();
-	const data = event.data || {};
-	const parts = [`${import_picocolors.default.green("✓")} Agent finished`];
+	const data = {
+		...event.data?.finalState,
+		...event.data
+	};
+	const parts = [describeOutcome(outcome)];
 	if (data.stepCount !== void 0) parts.push(`${data.stepCount} step${data.stepCount !== 1 ? "s" : ""}`);
 	if (data.usage?.total_tokens) parts.push(`${data.usage.total_tokens} tokens`);
 	if (data.cost?.total !== void 0) parts.push(`$${data.cost.total.toFixed(4)}`);
@@ -25988,6 +26263,133 @@ async function resolveAgentId$1(client, opts) {
 	return "";
 }
 
+//#endregion
+//#region src/commands/agent/runStatus.ts
+const RUN_POLL_INTERVAL_MS = 1e4;
+/** Upper bound for one status request, so a hung request cannot stall the wait. */
+const RUN_STATUS_REQUEST_TIMEOUT_MS = 3e4;
+/** Consecutive failed / unreadable answers tolerated before giving up. */
+const RUN_STATUS_MAX_MISSES = 3;
+const sleep$7 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const info$2 = (json, msg) => {
+	if (json) console.error(msg);
+	else log$13.info(msg);
+};
+const MISSING_RESULT_MESSAGE = "The server returned no status for this operation (unknown id, not visible to this account, or its run state already expired) — the run's outcome cannot be confirmed.";
+/**
+* Query `getOperationStatus` with a hard deadline. The abort signal cancels
+* the request; the race guarantees the deadline even if a transport ignores it.
+*/
+const queryOperationStatus = async (client, operationId, timeoutMs = RUN_STATUS_REQUEST_TIMEOUT_MS) => {
+	const controller = new AbortController();
+	let timer;
+	const deadline = new Promise((_, reject) => {
+		timer = setTimeout(() => {
+			controller.abort();
+			reject(/* @__PURE__ */ new Error(`status request got no answer within ${Math.round(timeoutMs / 1e3)}s`));
+		}, timeoutMs);
+	});
+	try {
+		return await Promise.race([client.aiAgent.getOperationStatus.query({ operationId }, { signal: controller.signal }), deadline]);
+	} finally {
+		clearTimeout(timer);
+	}
+};
+/**
+* One status check while the live stream is still open but quiet. Returns the
+* outcome once the run has ended, `undefined` while it is still active, and
+* throws when the status cannot be fetched (the caller falls back to polling).
+*/
+const probeRunOutcome = async (client, operationId, options = {}) => {
+	const r = await queryOperationStatus(client, operationId, options.requestTimeoutMs);
+	if (!r) {
+		log$13.error(MISSING_RESULT_MESSAGE);
+		return { kind: "unknown" };
+	}
+	const read = readOperationStatus(r);
+	const kind = classifyRunStatus(read.status);
+	if (kind === "active") return void 0;
+	if (!kind) throw new Error(`unreadable run status (${read.status ?? "none"})`);
+	return {
+		error: read.error,
+		kind,
+		status: read.status
+	};
+};
+/**
+* Fallback when the live stream (gateway WebSocket / SSE) is unavailable or
+* ended without a terminal event: the run may still be executing server-side,
+* so poll its status until it reaches a terminal state.
+*
+* Never reports success it cannot see: failure / interruption statuses come
+* back as such, and a missing, unreadable or unreachable status ends as
+* `unknown` instead of being read as "finished".
+*/
+const pollAgentRunStatus = async (client, operationId, options = {}) => {
+	const { intervalMs = RUN_POLL_INTERVAL_MS, json, maxMisses = 3, requestTimeoutMs } = options;
+	const finish = (outcome) => {
+		if (!json) {
+			console.log();
+			console.log(describeOutcome(outcome));
+		}
+		return outcome;
+	};
+	let lastStatus = "";
+	let failures = 0;
+	let unreadable = 0;
+	for (let i = 0;; i++) {
+		if (i > 0) await sleep$7(intervalMs);
+		let r;
+		try {
+			r = await queryOperationStatus(client, operationId, requestTimeoutMs);
+			failures = 0;
+		} catch (error) {
+			failures++;
+			log$13.warn(`Status poll failed (${failures}/${maxMisses}): ${error.message}`);
+			if (failures >= maxMisses) {
+				log$13.error("Giving up on the run status; the run may still be executing server-side.");
+				return finish({
+					error: error.message,
+					kind: "unknown"
+				});
+			}
+			continue;
+		}
+		if (!r) {
+			log$13.error(MISSING_RESULT_MESSAGE);
+			return finish({ kind: "unknown" });
+		}
+		const read = readOperationStatus(r);
+		const kind = classifyRunStatus(read.status);
+		if (!kind) {
+			unreadable++;
+			if (unreadable >= maxMisses) {
+				const keys = typeof r === "object" ? Object.keys(r).join(", ") : typeof r;
+				log$13.error(`Could not read a run status from the server's answer (status: ${read.status ?? "none"}; keys: ${keys}).`);
+				return finish({
+					kind: "unknown",
+					status: read.status
+				});
+			}
+			continue;
+		}
+		unreadable = 0;
+		if (read.status !== lastStatus) {
+			lastStatus = read.status;
+			const steps = read.stepCount !== void 0 ? ` · ${read.stepCount} step(s)` : "";
+			info$2(json, `Run status: ${colorStatus$1(read.status)}${steps}`);
+		}
+		if (kind !== "active") {
+			if (read.error) log$13.error(`Run error: ${read.error}`);
+			return finish({
+				error: read.error,
+				kind,
+				status: read.status
+			});
+		}
+	}
+};
+
 //#endregion
 //#region node_modules/.pnpm/dayjs@1.11.23/node_modules/dayjs/dayjs.min.js
 var require_dayjs_min = /* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -26428,7 +26830,7 @@ function formatFsLongListing(nodes) {
 	return lines;
 }
 async function readFsContentInput(options) {
-	if (options.contentFile) return readFileSync$1(options.contentFile, "utf8");
+	if (options.contentFile) return readFileSync(options.contentFile, "utf8");
 	if (options.content !== void 0) return options.content;
 	if (process.stdin.isTTY === false) return text(process.stdin);
 	return "";
@@ -26989,14 +27391,20 @@ function registerAgentCommand(program) {
 		const r = await client.agent.duplicateAgent.mutate(input);
 		console.log(`${import_picocolors.default.green("✓")} Duplicated agent → ${import_picocolors.default.bold(r.agentId || r.id || "done")}`);
 	});
-	agent.command("run").description("Run an agent with a prompt").option("-a, --agent-id <id>", "Agent ID").option("-s, --slug <slug>", "Agent slug").option("-p, --prompt <text>", "User prompt").option("-t, --topic-id <id>", "Reuse an existing topic").option("--no-auto-start", "Do not auto-start the agent").option("--device <target>", "Target device ID, or use \"local\" for the current connected device").option("--no-headless", "Disable headless mode and wait for human approval on tool calls (default: headless — tools auto-run, matching the CLI's non-interactive nature)").option("--json", "Output full JSON event stream").option("-v, --verbose", "Show detailed tool call info").option("--replay <file>", "Replay events from a saved JSON file (offline)").option("--sse", "Force SSE stream instead of WebSocket gateway").action(async (options) => {
+	agent.command("run").description("Run an agent with a prompt").option("-a, --agent-id <id>", "Agent ID").option("-s, --slug <slug>", "Agent slug").option("-p, --prompt <text>", "User prompt").option("-t, --topic-id <id>", "Reuse an existing topic").option("--no-auto-start", "Do not auto-start the agent").option("--device <target>", "Target device ID, or use \"local\" for the current connected device").option("--no-headless", "Disable headless mode: tool calls that need approval park the run for a human (default: headless — tools auto-run, matching the CLI's non-interactive nature). The CLI does not wait for that approval; it returns with exit code 2 and the run continues once it is answered in LobeHub").option("--json", "Output full JSON event stream").option("-v, --verbose", "Show detailed tool call info").option("--replay <file>", "Replay events from a saved JSON file (offline)").option("--sse", "Force SSE stream instead of WebSocket gateway").option("--timeout <seconds>", "Stop waiting after this many seconds (exit code 3; the run keeps going server-side). Default: wait as long as the server reports the run active", parsePositiveSeconds).addHelpText("after", `
+Exit codes:
+  0  the run finished (done)
+  1  the run failed or was interrupted
+  2  the run is paused waiting for human approval / input
+  3  the outcome could not be confirmed (no or unreadable status, status checks kept failing, or --timeout reached)`).action(async (options) => {
 		if (options.verbose) setVerbose(true);
 		if (options.replay) {
 			const data = readFileSync(options.replay, "utf8");
-			replayAgentEvents(JSON.parse(data), {
+			const replayExitCode = AGENT_RUN_EXIT_CODES[(replayAgentEvents(JSON.parse(data), {
 				json: options.json,
 				verbose: options.verbose
-			});
+			}) ?? { kind: "unknown" }).kind];
+			if (replayExitCode !== 0) process.exitCode = replayExitCode;
 			return;
 		}
 		if (!options.agentId && !options.slug) {
@@ -27051,24 +27459,45 @@ function registerAgentCommand(program) {
 		if (!options.json) log$13.info(`Operation: ${import_picocolors.default.dim(operationId)} · Topic: ${import_picocolors.default.dim(r.topicId || "n/a")}`);
 		const { serverUrl, headers, token, tokenType } = await getAgentStreamAuthInfo();
 		const agentGatewayUrl = options.sse ? void 0 : resolveAgentGatewayUrl();
-		try {
-			if (agentGatewayUrl) await streamAgentEventsViaWebSocket({
-				gatewayUrl: agentGatewayUrl,
-				json: options.json,
-				operationId,
-				serverUrl,
-				token,
-				tokenType,
-				verbose: options.verbose
-			});
-			else await streamAgentEvents(`${serverUrl}/api/agent/stream?operationId=${encodeURIComponent(operationId)}`, headers, {
-				json: options.json,
-				verbose: options.verbose
-			});
-		} catch (error) {
-			if (options.json) throw error;
-			log$13.warn(`Live stream unavailable (${error.message}). Polling run status every 10s…`);
-			await pollAgentRunStatus(client, operationId);
+		const waitForRun = async () => {
+			let streamed;
+			try {
+				if (agentGatewayUrl) streamed = await streamAgentEventsViaWebSocket({
+					gatewayUrl: agentGatewayUrl,
+					json: options.json,
+					onStall: () => probeRunOutcome(client, operationId, { json: options.json }),
+					operationId,
+					serverUrl,
+					token,
+					tokenType,
+					verbose: options.verbose
+				});
+				else streamed = await streamAgentEvents(`${serverUrl}/api/agent/stream?operationId=${encodeURIComponent(operationId)}`, headers, {
+					json: options.json,
+					onStall: () => probeRunOutcome(client, operationId, { json: options.json }),
+					verbose: options.verbose
+				});
+			} catch (error) {
+				log$13.warn(`Live stream unavailable (${error.message}). Polling run status every ${RUN_POLL_INTERVAL_MS / 1e3}s…`);
+				return pollAgentRunStatus(client, operationId, { json: options.json });
+			}
+			return streamed ?? pollAgentRunStatus(client, operationId, { json: options.json });
+		};
+		let timeoutTimer;
+		let didTimeOut = false;
+		const timedOut = options.timeout === void 0 ? void 0 : new Promise((resolve) => {
+			timeoutTimer = setTimeout(() => {
+				didTimeOut = true;
+				log$13.error(`Stopped waiting after ${options.timeout}s (--timeout). The run may still be executing — check it with 'lh agent status ${operationId}'.`);
+				resolve({ kind: "unknown" });
+			}, options.timeout * 1e3);
+		});
+		const outcome = await (timedOut ? Promise.race([waitForRun(), timedOut]) : waitForRun());
+		clearTimeout(timeoutTimer);
+		const exitCode = AGENT_RUN_EXIT_CODES[outcome.kind];
+		if (exitCode !== 0) {
+			if (didTimeOut) process.exit(exitCode);
+			process.exitCode = exitCode;
 		}
 	});
 	agent.command("pin <agentId>").description("Pin an agent").action(async (agentId) => {
@@ -27204,13 +27633,19 @@ function registerAgentCommand(program) {
 			outputJson(r, typeof options.json === "string" ? options.json : void 0);
 			return;
 		}
+		if (!r) {
+			log$13.error(`No status for operation ${operationId} (unknown id, not visible to this account, or its run state already expired).`);
+			process.exit(1);
+			return;
+		}
+		const read = readOperationStatus(r);
 		console.log(import_picocolors.default.bold("Operation Status"));
 		console.log(`  ID:     ${operationId}`);
-		console.log(`  Status: ${colorStatus$1(r.status || r.state || "unknown")}`);
-		if (r.stepCount !== void 0) console.log(`  Steps:  ${r.stepCount}`);
-		if (r.usage?.total_tokens) console.log(`  Tokens: ${r.usage.total_tokens}`);
-		if (r.cost?.total !== void 0) console.log(`  Cost:   $${r.cost.total.toFixed(4)}`);
-		if (r.error) console.log(`  Error:  ${import_picocolors.default.red(r.error)}`);
+		console.log(`  Status: ${colorStatus$1(read.status || "unknown")}`);
+		if (read.stepCount !== void 0) console.log(`  Steps:  ${read.stepCount}`);
+		if (read.usage?.total_tokens) console.log(`  Tokens: ${read.usage.total_tokens}`);
+		if (read.cost?.total !== void 0) console.log(`  Cost:   $${read.cost.total.toFixed(4)}`);
+		if (read.error) console.log(`  Error:  ${import_picocolors.default.red(read.error)}`);
 		if (r.createdAt) console.log(`  Started: ${r.createdAt}`);
 		if (r.completedAt) console.log(`  Ended:   ${r.completedAt}`);
 	});
@@ -27232,60 +27667,10 @@ function registerAgentCommand(program) {
 		else console.log(`${import_picocolors.default.yellow("!")} Interrupt not acknowledged for ${import_picocolors.default.bold(label)} (already finished?)`);
 	});
 }
-function colorStatus$1(status) {
-	switch (status) {
-		case "completed":
-		case "success": return import_picocolors.default.green(status);
-		case "failed":
-		case "error": return import_picocolors.default.red(status);
-		case "processing":
-		case "running": return import_picocolors.default.yellow(status);
-		default: return import_picocolors.default.dim(status);
-	}
-}
-const TERMINAL_RUN_STATUSES = new Set([
-	"completed",
-	"done",
-	"success",
-	"failed",
-	"error",
-	"cancelled",
-	"canceled",
-	"aborted"
-]);
-/**
-* Fallback when the live stream (gateway WebSocket / SSE) drops before the run
-* finishes: the run is still executing server-side, so poll its status every 10s
-* until it reaches a terminal state (or is no longer tracked, which also means it
-* has finished). Avoids hard-exiting on a transient gateway disconnect.
-*/
-async function pollAgentRunStatus(client, operationId) {
-	const POLL_MS = 1e4;
-	let lastStatus = "";
-	for (let i = 0;; i++) {
-		if (i > 0) await new Promise((resolve) => setTimeout(resolve, POLL_MS));
-		let r;
-		try {
-			r = await client.aiAgent.getOperationStatus.query({ operationId });
-		} catch (error) {
-			log$13.error(`Status poll failed: ${error.message}`);
-			process.exit(1);
-		}
-		if (!r) {
-			log$13.info("Run is no longer tracked — finished (or expired).");
-			return;
-		}
-		const status = r.status || r.state || "unknown";
-		if (status !== lastStatus) {
-			lastStatus = status;
-			const steps = r.stepCount !== void 0 ? ` · ${r.stepCount} step(s)` : "";
-			log$13.info(`Run status: ${colorStatus$1(status)}${steps}`);
-		}
-		if (TERMINAL_RUN_STATUSES.has(status)) {
-			if (r.error) log$13.error(`Run error: ${r.error}`);
-			return;
-		}
-	}
+function parsePositiveSeconds(value) {
+	const seconds = Number(value);
+	if (!Number.isFinite(seconds) || seconds <= 0) throw new InvalidArgumentError("Expected a positive number of seconds.");
+	return seconds;
 }
 
 //#endregion
@@ -38457,6 +38842,7 @@ const isObjectLike = (value) => typeof value === "object" && value !== null;
 */
 const isRecord$6 = (value) => isObjectLike(value) && !Array.isArray(value);
 const toRecord = (value) => isRecord$6(value) ? value : void 0;
+const pickString$1 = (value) => typeof value === "string" ? value : void 0;
 
 //#endregion
 //#region node_modules/.pnpm/partial-json@0.1.7/node_modules/partial-json/dist/options.js
@@ -41667,6 +42053,503 @@ var init_cliSpawn = __esmMin((() => {
 	};
 }));
 
+//#endregion
+//#region ../../packages/heterogeneous-agents/src/codex/CodexAppServerClient.ts
+init_cliSpawn();
+const APP_SERVER_RPC_TIMEOUT_MS = 3e4;
+const DEFAULT_RECONNECT_BASE_DELAY_MS = 250;
+const DEFAULT_RECONNECT_MAX_DELAY_MS = 4e3;
+const DEFAULT_RECONNECT_MAX_ATTEMPTS = 5;
+const APPROVAL_REQUEST_METHODS = new Set(["item/commandExecution/requestApproval", "item/fileChange/requestApproval"]);
+var CodexAppServerRpcError = class extends Error {
+	constructor(message, code, data, method) {
+		super(message);
+		this.code = code;
+		this.data = data;
+		this.method = method;
+		this.name = "CodexAppServerRpcError";
+	}
+};
+var CodexAppServerConnectionError = class extends Error {
+	phase;
+	constructor(message, options) {
+		super(message, options);
+		this.name = "CodexAppServerConnectionError";
+		this.phase = options?.phase;
+	}
+};
+/**
+* One long-lived, bidirectional NDJSON client for `codex app-server`.
+*
+* stdout has exactly one reader here. It correlates RPC responses, publishes
+* notifications to the owning thread session, and separately routes
+* server-initiated requests back to that thread.
+*/
+var CodexAppServerClient = class {
+	activeGeneration = 0;
+	closedByHost = false;
+	connectionState;
+	connectionError;
+	connected = false;
+	consumerCount = 0;
+	generationSequence = 0;
+	hasConnected = false;
+	nextRequestId = 0;
+	pendingRequests = /* @__PURE__ */ new Map();
+	notificationHandlers = /* @__PURE__ */ new Map();
+	serverRequestHandlers = /* @__PURE__ */ new Map();
+	disconnectHandlers = /* @__PURE__ */ new Set();
+	rawMessageHandlers = /* @__PURE__ */ new Map();
+	stderrHandlers = /* @__PURE__ */ new Set();
+	threadRegistrations = /* @__PURE__ */ new Map();
+	processGeneration;
+	reconnectAttempt = 0;
+	reconnectEpoch = 0;
+	reconnectExhaustedEpoch;
+	reconnectTimer;
+	constructor(options) {
+		this.options = options;
+	}
+	get isConnected() {
+		return this.connected && !this.connectionError;
+	}
+	get hasConsumers() {
+		return this.consumerCount > 0;
+	}
+	acquireConsumer() {
+		if (this.closedByHost) throw new CodexAppServerConnectionError("Codex app-server client closed by host");
+		this.consumerCount += 1;
+		let released = false;
+		return () => {
+			if (released) return;
+			released = true;
+			this.consumerCount -= 1;
+		};
+	}
+	/** Process-global options must stay identical while this long-lived client is reused. */
+	canReuseFor(options) {
+		const currentArgs = this.options.args ?? [];
+		const nextArgs = options.args ?? [];
+		const commandIsRelativePath = !path.isAbsolute(this.options.commandPath) && (this.options.commandPath.includes("/") || this.options.commandPath.includes("\\"));
+		if (this.options.commandPath !== options.commandPath || commandIsRelativePath && this.options.cwd !== options.cwd || currentArgs.length !== nextArgs.length || currentArgs.some((arg, index) => arg !== nextArgs[index])) return false;
+		const currentEnv = Object.entries(this.options.env).filter(([, value]) => value !== void 0);
+		const nextEnv = Object.entries(options.env).filter(([, value]) => value !== void 0);
+		return currentEnv.length === nextEnv.length && currentEnv.every(([key, value]) => options.env[key] === value);
+	}
+	connect() {
+		if (this.closedByHost) return Promise.reject(new CodexAppServerConnectionError("Codex app-server client closed by host"));
+		if (this.connectionState && !this.connectionError) return this.connectionState.promise;
+		this.startUserRecoveryEpoch();
+		return this.startConnection();
+	}
+	async request(method, params) {
+		if (!this.connected) await this.connect();
+		if (this.connectionError) throw this.connectionError;
+		return this.requestForGeneration(this.activeGeneration, method, params);
+	}
+	notify(notification) {
+		this.writeForGeneration(this.activeGeneration, { ...notification });
+	}
+	subscribe(threadId, handler) {
+		const handlers = this.notificationHandlers.get(threadId) ?? /* @__PURE__ */ new Set();
+		handlers.add(handler);
+		this.notificationHandlers.set(threadId, handlers);
+		return () => this.removeHandler(this.notificationHandlers, threadId, handler);
+	}
+	subscribeServerRequests(threadId, handler) {
+		const handlers = this.serverRequestHandlers.get(threadId) ?? /* @__PURE__ */ new Set();
+		handlers.add(handler);
+		this.serverRequestHandlers.set(threadId, handlers);
+		return () => this.removeHandler(this.serverRequestHandlers, threadId, handler);
+	}
+	registerThread(threadId, params, registration) {
+		if (params.threadId !== threadId) throw new Error(`Codex resume params do not match registered thread: ${threadId}`);
+		const existing = this.threadRegistrations.get(threadId);
+		if (existing && JSON.stringify(existing.params) !== JSON.stringify(params)) throw new Error(`Conflicting Codex resume params for thread: ${threadId}`);
+		const group = existing ?? {
+			params,
+			registrations: /* @__PURE__ */ new Set()
+		};
+		group.registrations.add(registration);
+		this.threadRegistrations.set(threadId, group);
+		if (!this.connected && this.connectionError) this.scheduleReconnect();
+		return () => {
+			group.registrations.delete(registration);
+			if (group.registrations.size === 0) this.threadRegistrations.delete(threadId);
+			if (this.threadRegistrations.size === 0 && this.reconnectTimer) {
+				clearTimeout(this.reconnectTimer);
+				this.reconnectTimer = void 0;
+			}
+		};
+	}
+	onDisconnect(handler) {
+		this.disconnectHandlers.add(handler);
+		return () => this.disconnectHandlers.delete(handler);
+	}
+	onRawMessage(threadId, handler) {
+		const handlers = this.rawMessageHandlers.get(threadId) ?? /* @__PURE__ */ new Set();
+		handlers.add(handler);
+		this.rawMessageHandlers.set(threadId, handlers);
+		return () => this.removeHandler(this.rawMessageHandlers, threadId, handler);
+	}
+	onStderr(handler) {
+		this.stderrHandlers.add(handler);
+		return () => this.stderrHandlers.delete(handler);
+	}
+	close() {
+		if (this.closedByHost) return;
+		this.closedByHost = true;
+		this.reconnectEpoch += 1;
+		if (this.reconnectTimer) {
+			clearTimeout(this.reconnectTimer);
+			this.reconnectTimer = void 0;
+		}
+		const error = new CodexAppServerConnectionError("Codex app-server client closed by host");
+		const generation = this.activeGeneration;
+		this.activeGeneration = ++this.generationSequence;
+		this.connected = false;
+		this.connectionError = error;
+		this.connectionState = void 0;
+		const processGeneration = this.processGeneration;
+		this.processGeneration = void 0;
+		this.rejectPendingRequests(generation, error);
+		this.emitDisconnect(error);
+		this.terminateChild(processGeneration?.child);
+	}
+	startConnection() {
+		if (this.closedByHost) return Promise.reject(new CodexAppServerConnectionError("Codex app-server client closed by host"));
+		const generation = ++this.generationSequence;
+		const isReconnect = this.hasConnected;
+		this.activeGeneration = generation;
+		this.connected = false;
+		this.connectionError = void 0;
+		const promise = this.initialize(generation, isReconnect);
+		this.connectionState = {
+			generation,
+			promise
+		};
+		return promise;
+	}
+	async initialize(generation, isReconnect) {
+		try {
+			await this.startProcess(generation);
+			const params = {
+				capabilities: {
+					experimentalApi: false,
+					requestAttestation: false
+				},
+				clientInfo: {
+					name: "lobehub-desktop",
+					title: "LobeHub Desktop",
+					version: this.options.clientVersion
+				}
+			};
+			const response = await this.requestForGeneration(generation, "initialize", params);
+			this.writeForGeneration(generation, { method: "initialized" });
+			if (!this.isCurrentGeneration(generation)) throw new CodexAppServerConnectionError("Codex app-server connection was replaced");
+			this.connected = true;
+			this.hasConnected = true;
+			if (isReconnect) {
+				await this.resumeRegisteredThreads(generation);
+				if (!this.isCurrentGeneration(generation) || !this.connected || this.connectionError) throw this.connectionError ?? new CodexAppServerConnectionError("Codex app-server disconnected while resuming threads");
+			}
+			this.reconnectAttempt = 0;
+			this.reconnectExhaustedEpoch = void 0;
+			return response;
+		} catch (error) {
+			const failure = this.toConnectionError(error, "Codex app-server handshake failed");
+			if (!this.isCurrentGeneration(generation)) throw failure;
+			const connectionError = !isReconnect && failure instanceof CodexAppServerConnectionError ? new CodexAppServerConnectionError(failure.message, {
+				cause: failure,
+				phase: "initialize"
+			}) : failure;
+			this.fail(connectionError, generation);
+			throw connectionError;
+		}
+	}
+	async startProcess(generation) {
+		const spawnPlan = await resolveCliSpawnPlan(this.options.commandPath, [...this.options.args ?? [], "app-server"]);
+		if (!this.isCurrentGeneration(generation)) throw new CodexAppServerConnectionError(this.closedByHost ? "Codex app-server client closed by host" : "Codex app-server connection was replaced");
+		const child = spawnManaged(spawnPlan.command, spawnPlan.args, {
+			cwd: this.options.cwd,
+			detached: process.platform !== "win32",
+			env: this.options.env,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+		const processGeneration = {
+			child,
+			generation,
+			stdoutBuffer: ""
+		};
+		if (!this.isCurrentGeneration(generation)) {
+			this.terminateChild(child);
+			throw new CodexAppServerConnectionError("Codex app-server connection was replaced");
+		}
+		this.processGeneration = processGeneration;
+		child.stdin?.on("error", () => {});
+		child.stdout?.on("data", (chunk) => {
+			if (!this.ownsProcess(processGeneration)) return;
+			this.consumeStdout(processGeneration, chunk);
+		});
+		child.stderr?.on("data", (chunk) => {
+			if (!this.ownsProcess(processGeneration)) return;
+			this.emitText(this.stderrHandlers, chunk.toString());
+		});
+		child.once("error", (error) => {
+			if (!this.ownsProcess(processGeneration)) return;
+			this.fail(new CodexAppServerConnectionError(`Failed to start Codex app-server: ${error.message}`, { cause: error }), generation);
+		});
+		child.once("exit", (code, signal) => {
+			if (!this.ownsProcess(processGeneration)) return;
+			this.fail(new CodexAppServerConnectionError(`Codex app-server exited (code ${code ?? "null"}, signal ${signal ?? "null"})`), generation);
+		});
+	}
+	requestForGeneration(generation, method, params) {
+		const processGeneration = this.processGeneration;
+		if (!processGeneration || !this.ownsProcess(processGeneration) || generation !== this.activeGeneration) return Promise.reject(new CodexAppServerConnectionError("Codex app-server stdin is unavailable"));
+		const id = ++this.nextRequestId;
+		const key = String(id);
+		return new Promise((resolve, reject) => {
+			const timeout = setTimeout(() => {
+				const current = this.pendingRequests.get(key);
+				if (!current || current.generation !== generation) return;
+				this.pendingRequests.delete(key);
+				const error = new CodexAppServerConnectionError(`Codex app-server request timed out: ${method}`);
+				reject(error);
+				this.fail(error, generation);
+			}, APP_SERVER_RPC_TIMEOUT_MS);
+			timeout.unref?.();
+			const pending = {
+				generation,
+				method,
+				reject,
+				resolve: (result) => resolve(result),
+				threadId: isRecord$6(params) ? pickString$1(params.threadId) : void 0,
+				timeout
+			};
+			this.pendingRequests.set(key, pending);
+			try {
+				this.writeToProcess(processGeneration, {
+					id,
+					method,
+					params
+				});
+			} catch (error) {
+				if (this.pendingRequests.get(key) === pending) this.pendingRequests.delete(key);
+				clearTimeout(timeout);
+				const connectionError = this.toConnectionError(error, `Failed to write Codex app-server request: ${method}`);
+				reject(connectionError);
+				this.fail(connectionError, generation);
+			}
+		});
+	}
+	consumeStdout(processGeneration, chunk) {
+		processGeneration.stdoutBuffer += chunk.toString("utf8");
+		let newlineIndex;
+		while ((newlineIndex = processGeneration.stdoutBuffer.indexOf("\n")) >= 0) {
+			const line = processGeneration.stdoutBuffer.slice(0, newlineIndex).trim();
+			processGeneration.stdoutBuffer = processGeneration.stdoutBuffer.slice(newlineIndex + 1);
+			if (!line) continue;
+			try {
+				const message = JSON.parse(line);
+				const threadId = this.getMessageThreadId(processGeneration.generation, message);
+				const rawHandlers = threadId ? this.rawMessageHandlers.get(threadId) : void 0;
+				if (rawHandlers) this.emitText(rawHandlers, `${line}\n`);
+				this.routeMessage(processGeneration.generation, message);
+			} catch (error) {
+				this.fail(new CodexAppServerConnectionError("Codex app-server emitted invalid NDJSON", { cause: error }), processGeneration.generation);
+				return;
+			}
+		}
+	}
+	getMessageThreadId(generation, message) {
+		if (!isRecord$6(message)) return;
+		if (isRecord$6(message.params)) {
+			const threadId = pickString$1(message.params.threadId);
+			if (threadId) return threadId;
+		}
+		const id = message.id;
+		if (id === void 0) return;
+		const pending = this.pendingRequests.get(String(id));
+		return pending?.generation === generation ? pending.threadId : void 0;
+	}
+	routeMessage(generation, message) {
+		if (!this.isCurrentGeneration(generation)) return;
+		if (!isRecord$6(message)) throw new TypeError("Expected an app-server RPC object");
+		const method = pickString$1(message.method);
+		const id = message.id;
+		if (method) {
+			if (id !== void 0) this.routeServerRequest(generation, id, method, message.params);
+			else this.routeNotification(method, message.params);
+			return;
+		}
+		if (id === void 0) return;
+		const key = String(id);
+		const pending = this.pendingRequests.get(key);
+		if (!pending || pending.generation !== generation) return;
+		this.pendingRequests.delete(key);
+		clearTimeout(pending.timeout);
+		if (isRecord$6(message.error)) pending.reject(new CodexAppServerRpcError(pickString$1(message.error.message) ?? `Codex app-server request failed: ${pending.method}`, typeof message.error.code === "number" ? message.error.code : void 0, message.error.data, pending.method));
+		else pending.resolve(message.result);
+	}
+	routeNotification(method, params) {
+		const threadId = isRecord$6(params) ? pickString$1(params.threadId) : void 0;
+		if (!threadId) return;
+		for (const handler of this.notificationHandlers.get(threadId) ?? []) handler(method, params);
+	}
+	async routeServerRequest(generation, id, method, params) {
+		const threadId = isRecord$6(params) ? pickString$1(params.threadId) : void 0;
+		const handler = (threadId ? this.serverRequestHandlers.get(threadId) : void 0)?.values().next().value;
+		let response;
+		try {
+			if (handler) response = {
+				id,
+				result: await handler(method, params)
+			};
+			else if (APPROVAL_REQUEST_METHODS.has(method)) response = {
+				id,
+				result: { decision: "cancel" }
+			};
+			else response = {
+				error: {
+					code: -32601,
+					message: `Unsupported Codex app-server request: ${method}`
+				},
+				id
+			};
+		} catch (error) {
+			response = {
+				error: {
+					code: -32603,
+					message: error instanceof Error ? error.message : "Codex server request failed"
+				},
+				id
+			};
+		}
+		if (!this.isCurrentGeneration(generation)) return;
+		try {
+			this.writeForGeneration(generation, response);
+		} catch (error) {
+			this.fail(this.toConnectionError(error, "Failed to write Codex app-server response"), generation);
+		}
+	}
+	writeForGeneration(generation, message) {
+		const processGeneration = this.processGeneration;
+		if (!processGeneration || processGeneration.generation !== generation) throw new CodexAppServerConnectionError("Codex app-server stdin is unavailable");
+		this.writeToProcess(processGeneration, message);
+	}
+	writeToProcess(processGeneration, message) {
+		if (!this.ownsProcess(processGeneration) || !processGeneration.child.stdin) throw new CodexAppServerConnectionError("Codex app-server stdin is unavailable");
+		processGeneration.child.stdin.write(`${JSON.stringify(message)}\n`);
+	}
+	emitText(handlers, data) {
+		for (const handler of handlers) handler(data);
+	}
+	removeHandler(map, key, handler) {
+		const handlers = map.get(key);
+		handlers?.delete(handler);
+		if (handlers?.size === 0) map.delete(key);
+	}
+	fail(error, generation, reconnect = true) {
+		if (!this.isCurrentGeneration(generation) || this.connectionError) return;
+		this.connectionError = error;
+		this.connected = false;
+		if (this.connectionState?.generation === generation) this.connectionState = void 0;
+		const processGeneration = this.processGeneration;
+		if (processGeneration?.generation === generation) {
+			this.processGeneration = void 0;
+			this.terminateChild(processGeneration.child);
+		}
+		this.rejectPendingRequests(generation, error);
+		this.emitDisconnect(error);
+		if (reconnect) this.scheduleReconnect();
+	}
+	scheduleReconnect() {
+		if (this.closedByHost || this.reconnectTimer || this.threadRegistrations.size === 0) return;
+		const maxAttempts = Math.max(0, Math.floor(this.options.reconnectMaxAttempts ?? DEFAULT_RECONNECT_MAX_ATTEMPTS));
+		const epoch = this.reconnectEpoch;
+		if (this.reconnectAttempt >= maxAttempts) {
+			if (this.reconnectExhaustedEpoch === epoch) return;
+			this.reconnectExhaustedEpoch = epoch;
+			const error = new CodexAppServerConnectionError(`Codex app-server reconnect exhausted after ${maxAttempts} attempts`);
+			this.notifyResumeErrors(error);
+			return;
+		}
+		const baseDelay = this.options.reconnectBaseDelayMs ?? DEFAULT_RECONNECT_BASE_DELAY_MS;
+		const maxDelay = this.options.reconnectMaxDelayMs ?? DEFAULT_RECONNECT_MAX_DELAY_MS;
+		const delay = Math.min(baseDelay * 2 ** this.reconnectAttempt, maxDelay);
+		this.reconnectAttempt += 1;
+		this.reconnectTimer = setTimeout(() => {
+			this.reconnectTimer = void 0;
+			if (epoch !== this.reconnectEpoch || this.closedByHost) return;
+			this.startConnection().catch(() => {});
+		}, delay);
+		this.reconnectTimer.unref?.();
+	}
+	async resumeRegisteredThreads(generation) {
+		await Promise.all([...this.threadRegistrations.values()].map(async ({ params, registrations }) => {
+			try {
+				const response = await this.requestForGeneration(generation, "thread/resume", params);
+				if (!this.isCurrentGeneration(generation) || !this.connected) return;
+				await Promise.allSettled([...registrations].map(({ onResume }) => onResume(response)));
+			} catch (error) {
+				if (!this.isCurrentGeneration(generation) || !this.connected) return;
+				const resumeError = error instanceof Error ? error : new Error(String(error));
+				await Promise.allSettled([...registrations].map(({ onResumeError }) => onResumeError(resumeError)));
+			}
+		}));
+	}
+	startUserRecoveryEpoch() {
+		if (this.reconnectTimer) {
+			clearTimeout(this.reconnectTimer);
+			this.reconnectTimer = void 0;
+		}
+		this.reconnectAttempt = 0;
+		this.reconnectEpoch += 1;
+		this.reconnectExhaustedEpoch = void 0;
+	}
+	notifyResumeErrors(error) {
+		Promise.allSettled([...this.threadRegistrations.values()].flatMap(({ registrations }) => [...registrations].map(({ onResumeError }) => onResumeError(error))));
+	}
+	rejectPendingRequests(generation, error) {
+		for (const [key, pending] of this.pendingRequests) {
+			if (pending.generation !== generation) continue;
+			this.pendingRequests.delete(key);
+			clearTimeout(pending.timeout);
+			pending.reject(error);
+		}
+	}
+	emitDisconnect(error) {
+		for (const handler of this.disconnectHandlers) try {
+			handler(error);
+		} catch (handlerError) {
+			console.error("Codex app-server disconnect handler failed:", handlerError);
+		}
+	}
+	isCurrentGeneration(generation) {
+		return !this.closedByHost && this.activeGeneration === generation;
+	}
+	ownsProcess(processGeneration) {
+		return this.isCurrentGeneration(processGeneration.generation) && this.processGeneration === processGeneration;
+	}
+	toConnectionError(error, message) {
+		if (error instanceof CodexAppServerRpcError || error instanceof CodexAppServerConnectionError) return error;
+		return new CodexAppServerConnectionError(message, { cause: error });
+	}
+	terminateChild(child) {
+		if (!child?.pid || child.killed) return;
+		if (process.platform !== "win32") try {
+			process.kill(-child.pid, "SIGTERM");
+			return;
+		} catch {}
+		child.kill("SIGTERM");
+	}
+};
+
 //#endregion
 //#region node_modules/.pnpm/diff@8.0.4/node_modules/diff/libesm/diff/base.js
 var Diff = class {
@@ -50954,7 +51837,7 @@ const buildSpawnArgs = (params) => {
 		default: throw new Error(`spawnAgent: unsupported agent type "${params.agentType}"`);
 	}
 };
-const killProcessTree$1 = (proc, signal, detached) => {
+const killProcessTree = (proc, signal, detached) => {
 	if (!proc.pid || proc.killed) return;
 	if (platform() === "win32") {
 		try {
@@ -51357,7 +52240,7 @@ const spawnAgent = async (options) => {
 		exit,
 		kill: (signal = "SIGINT") => {
 			killedByUs = true;
-			killProcessTree$1(proc, signal, detached);
+			killProcessTree(proc, signal, detached);
 		},
 		pid: proc.pid,
 		get sessionId() {
@@ -248553,6 +249436,13 @@ const MAX_MISSED_HEARTBEATS = 3;
 */
 const CONNECT_TIMEOUT = 15e3;
 const METRICS_ACK_TIMEOUT_MS = 15e3;
+/**
+* Close reason the gateway sends when a newer socket with the same
+* `connectionId` takes over. `connectionId` is persisted per install, so this
+* is how a second process of the same install (two `lh connect` sharing one
+* home) shows up.
+*/
+const REPLACED_CLOSE_REASON = "Replaced by new connection";
 const noopLogger = {
 	debug: () => {},
 	error: () => {},
@@ -248570,6 +249460,15 @@ var GatewayClient = class extends EventEmitter {
 	status = "disconnected";
 	pendingMetricAcks = /* @__PURE__ */ new Map();
 	intentionalDisconnect = false;
+	/**
+	* When each socket abandoned mid-handshake was abandoned. Only such a socket
+	* can reach the gateway after its successor and knock it off with the
+	* takeover reason: an opened socket was registered before the successor
+	* existed. Each can do that at most once, and only within `connectTimeoutMs`
+	* (the handshake budget), so a takeover consumes one live entry and anything
+	* beyond them is another client.
+	*/
+	inFlightAbandons = [];
 	deviceId;
 	connectionId;
 	channel;
@@ -248848,6 +249747,13 @@ var GatewayClient = class extends EventEmitter {
 		this.rejectPendingMetricAcks();
 		this.clearConnectWatchdog();
 		this.ws = null;
+		if (!this.intentionalDisconnect && reason.toString() === REPLACED_CLOSE_REASON && !this.consumeInFlightAbandon()) {
+			this.logger.warn("Connection taken over by another client with the same connection id; not reconnecting");
+			this.setStatus("disconnected");
+			this.emit("replaced");
+			this.emit("disconnected");
+			return;
+		}
 		if (!this.intentionalDisconnect && this.autoReconnect) {
 			this.setStatus("reconnecting");
 			this.scheduleReconnect();
@@ -248856,6 +249762,12 @@ var GatewayClient = class extends EventEmitter {
 			this.emit("disconnected");
 		}
 	};
+	/** Attribute a takeover to one of our own late sockets, if one can still land. */
+	consumeInFlightAbandon() {
+		const now = Date.now();
+		this.inFlightAbandons = this.inFlightAbandons.filter((at) => now - at <= this.connectTimeoutMs);
+		return this.inFlightAbandons.shift() !== void 0;
+	}
 	handleError = (error) => {
 		this.logger.error("WebSocket error:", error.message);
 		this.emit("error", error);
@@ -248945,6 +249857,7 @@ var GatewayClient = class extends EventEmitter {
 		this.rejectPendingMetricAcks();
 		if (!this.ws) return;
 		const ws = this.ws;
+		if (ws.readyState === wrapper_default.CONNECTING) this.inFlightAbandons.push(Date.now());
 		const suppressCloseError = (error) => {
 			this.logger.debug(`Ignoring WebSocket error during close: ${error.message}`);
 		};
@@ -248992,6 +249905,95 @@ const getHeterogeneousTypeLabel = (type) => {
 	return Object.hasOwn(HETEROGENEOUS_TYPE_LABELS, type) ? HETEROGENEOUS_TYPE_LABELS[type] : type;
 };
 
+//#endregion
+//#region ../../packages/heterogeneous-agents/src/models/codex.ts
+/** Discovery has no thread: provider overrides must be applied at process startup. */
+const catalogConfig = (source, initialCwd) => {
+	const args = [];
+	let cwd = initialCwd;
+	const valueFlags = [
+		"-c",
+		"--config",
+		"-C",
+		"--cd",
+		"--enable",
+		"--disable"
+	];
+	for (let index = 0; index < source.length; index += 1) {
+		const arg = source[index];
+		if (arg === "--") break;
+		if ([
+			"-p",
+			"--profile",
+			"--oss",
+			"--local-provider",
+			"--ignore-user-config"
+		].some((flag) => arg === flag || arg.startsWith(`${flag}=`) || flag === "-p" && arg.startsWith("-p"))) throw Object.assign(/* @__PURE__ */ new Error("Unsupported Codex catalog configuration"), { code: "unsupported_configuration" });
+		const flag = valueFlags.find((candidate) => arg === candidate || arg.startsWith(`${candidate}=`) || candidate.length === 2 && arg.startsWith(candidate));
+		if (!flag) continue;
+		const value = arg === flag ? source[++index] : arg.slice(flag.length).replace(/^=/, "");
+		if (!value) throw new Error(`Missing value for Codex ${flag}`);
+		if (flag === "-C" || flag === "--cd") cwd = path.resolve(initialCwd, value);
+		else args.push(flag, value);
+	}
+	return {
+		args,
+		cwd
+	};
+};
+/** A short-lived catalog connection, independent of the exec/app-server task transport. */
+const listCodexModels = async ({ args = [], commandPath, cwd, env, timeoutMs }) => {
+	const client = new CodexAppServerClient({
+		...catalogConfig(args, cwd),
+		clientVersion: "1.0.0",
+		commandPath,
+		env,
+		reconnectMaxAttempts: 0
+	});
+	let timer;
+	const readPages = async () => {
+		const models = /* @__PURE__ */ new Map();
+		const cursors = /* @__PURE__ */ new Set();
+		let cursor;
+		do {
+			const page = await client.request("model/list", {
+				...cursor ? { cursor } : {},
+				includeHidden: false,
+				limit: 100
+			});
+			if (!isRecord$6(page) || !Array.isArray(page.data)) throw new Error("Invalid Codex model catalog");
+			for (const item of page.data) {
+				if (!isRecord$6(item) || typeof item.model !== "string" || !item.model.trim()) throw new Error("Invalid Codex model catalog entry");
+				if (item.hidden === true || models.has(item.model)) continue;
+				models.set(item.model, {
+					id: item.model,
+					...typeof item.displayName === "string" && item.displayName.trim() ? { label: item.displayName } : {},
+					modelId: item.model,
+					providerId: "codex"
+				});
+			}
+			if (page.nextCursor == null) break;
+			if (typeof page.nextCursor !== "string" || !page.nextCursor || cursors.has(page.nextCursor)) throw new Error("Invalid Codex model catalog cursor");
+			cursor = page.nextCursor;
+			cursors.add(cursor);
+		} while (cursor);
+		return [...models.values()];
+	};
+	try {
+		return await Promise.race([readPages(), new Promise((_, reject) => {
+			timer = setTimeout(() => {
+				reject(Object.assign(/* @__PURE__ */ new Error("Codex model discovery timed out"), { code: "ETIMEDOUT" }));
+			}, timeoutMs);
+		})]);
+	} catch (error) {
+		if (error instanceof CodexAppServerRpcError && error.code === -32601) throw Object.assign(/* @__PURE__ */ new Error("Codex model discovery is not supported"), { code: "unsupported_client" });
+		throw error;
+	} finally {
+		clearTimeout(timer);
+		client.close();
+	}
+};
+
 //#endregion
 //#region ../../packages/heterogeneous-agents/src/models/listHeterogeneousAgentModels.ts
 init_cliSpawn();
@@ -249181,8 +250183,11 @@ const parseQoderModelCatalog = (stdout) => {
 };
 const getErrorRecord = (error) => error;
 const classifyCatalogError = (error) => {
+	if (error instanceof Error && error.cause) return classifyCatalogError(error.cause);
 	const { code, killed, signal } = getErrorRecord(error);
 	if (code === "ENOENT") return "cli_not_found";
+	if (code === "unsupported_client") return "unsupported_client";
+	if (code === "unsupported_configuration") return "unsupported_configuration";
 	if (code === "ETIMEDOUT" || killed || signal === "SIGTERM") return "timeout";
 	return "command_failed";
 };
@@ -249210,6 +250215,17 @@ const listHeterogeneousAgentModels = async (params) => {
 		...mergedPath ? { PATH: mergedPath } : {}
 	};
 	try {
+		if (params.type === "codex") return {
+			models: await listCodexModels({
+				args: params.args,
+				commandPath: resolved.command,
+				cwd: params.cwd ?? process.cwd(),
+				env,
+				timeoutMs: MODEL_CATALOG_TIMEOUT_MS
+			}),
+			status: "success",
+			updatedAt
+		};
 		if (params.type === "droid") return {
 			models: await listDroidAcpModels({
 				args: params.args,
@@ -252822,7 +253838,7 @@ const getTargetFd = ({ value, optionName, fdNumber, direction }) => {
 	if (tty.isatty(targetFdNumber)) throw new TypeError(`The \`${optionName}: ${serializeOptionValue(value)}\` option is invalid: it cannot be a TTY with synchronous methods.`);
 	return {
 		type: "uint8Array",
-		value: bufferToUint8Array(readFileSync$1(targetFdNumber)),
+		value: bufferToUint8Array(readFileSync(targetFdNumber)),
 		optionName
 	};
 };
@@ -253103,8 +254119,8 @@ const addProperties$1 = {
 const addPropertiesSync = {
 	input: {
 		...addProperties$1,
-		fileUrl: ({ value }) => ({ contents: [bufferToUint8Array(readFileSync$1(value))] }),
-		filePath: ({ value: { file } }) => ({ contents: [bufferToUint8Array(readFileSync$1(file))] }),
+		fileUrl: ({ value }) => ({ contents: [bufferToUint8Array(readFileSync(value))] }),
+		filePath: ({ value: { file } }) => ({ contents: [bufferToUint8Array(readFileSync(file))] }),
 		fileNumber: forbiddenIfSync,
 		iterable: ({ value }) => ({ contents: [...value] }),
 		string: ({ value }) => ({ contents: [value] }),
@@ -256682,65 +257698,6 @@ const createFileSearchModule = (toolDetector) => {
 	}
 };
 
-//#endregion
-//#region ../../packages/local-file-shell/src/shell/clixml.ts
-/**
-* Decode PowerShell CLIXML blocks embedded in redirected stderr.
-*
-* When powershell.exe / pwsh.exe runs with redirected stderr, records from its
-* non-stdout streams (error, warning, verbose, information / Write-Host) are
-* serialized to stderr as CLIXML: `#< CLIXML\n<Objs ...>...</Objs>`. Shown
-* verbatim this is unreadable noise for the model and the user, so we extract
-* the human-readable messages and replace each block in place — the same
-* approach Ansible's `_parse_clixml` takes.
-*/
-const CLIXML_MARKER = "#< CLIXML";
-/** CLIXML escapes characters as `_xHHHH_` (UTF-16 code units). */
-const unescapeClixmlText = (text) => text.replaceAll(/_x([\dA-Fa-f]{4})_/g, (_, hex) => String.fromCharCode(Number.parseInt(hex, 16))).replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&quot;", "\"").replaceAll("&apos;", "'").replaceAll("&amp;", "&");
-/** Stream-typed string records: `<S S="Error">text</S>` (PS 5.1 style). */
-const STREAM_ENTRY = /<S S="(?:Error|Warning|Verbose|Debug|Info)">([\S\s]*?)<\/S>/g;
-/**
-* Rendered text of serialized records (`InformationRecord` / `HostInformationMessage`
-* from Write-Host end up here). Nested objects repeat the same message in their
-* own `<ToString>`, so consecutive duplicates are collapsed by the caller.
-*/
-const TO_STRING_ENTRY = /<ToString>([\S\s]*?)<\/ToString>/g;
-const extractBlockMessages = (block) => {
-	const streamTexts = [...block.matchAll(STREAM_ENTRY)].map((m) => m[1]);
-	const texts = streamTexts.length > 0 ? streamTexts : [...block.matchAll(TO_STRING_ENTRY)].map((m) => m[1]);
-	const messages = [];
-	for (const raw of texts) {
-		const text = unescapeClixmlText(raw);
-		if (messages.at(-1) === text) continue;
-		messages.push(text);
-	}
-	return messages;
-};
-/**
-* Replace every CLIXML block in `text` with its decoded messages. Plain text
-* around the blocks is preserved; input without a marker is returned as-is.
-* Truncated blocks (output preview cuts) decode whatever entries survived.
-*/
-const decodeClixml = (text) => {
-	if (!text.includes(CLIXML_MARKER)) return text;
-	let result = "";
-	let cursor = 0;
-	while (cursor < text.length) {
-		const markerIndex = text.indexOf(CLIXML_MARKER, cursor);
-		if (markerIndex === -1) {
-			result += text.slice(cursor);
-			break;
-		}
-		result += text.slice(cursor, markerIndex);
-		const closeIndex = text.indexOf("</Objs>", markerIndex);
-		const blockEnd = closeIndex === -1 ? text.length : closeIndex + 7;
-		const messages = extractBlockMessages(text.slice(markerIndex, blockEnd));
-		if (messages.length > 0) result += messages.map((m) => m.endsWith("\n") ? m : `${m}\n`).join("");
-		cursor = blockEnd;
-	}
-	return result;
-};
-
 //#endregion
 //#region node_modules/.pnpm/tree-kill@1.2.2/node_modules/tree-kill/index.js
 var require_tree_kill = /* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -256838,6 +257795,118 @@ var require_tree_kill = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	}
 }));
 
+//#endregion
+//#region ../../packages/local-file-shell/src/shell/child-process-backend.ts
+var import_tree_kill = /* @__PURE__ */ __toESM(require_tree_kill());
+const KILL_SIGNAL = "SIGKILL";
+/**
+* Non-interactive backend: a plain `child_process` with stdin left as an
+* unused pipe and stdout/stderr inherited straight into the output files.
+*/
+var ChildProcessBackend = class {
+	capabilities = {
+		interactive: false,
+		persistent: false,
+		streaming: false
+	};
+	name = "child-process";
+	processes = /* @__PURE__ */ new Map();
+	/**
+	* @param spawnProcess - spawn implementation; a caller can pass one that
+	*   registers each process with a tracker. Defaults to `child_process.spawn`.
+	*/
+	constructor(spawnProcess = spawn) {
+		this.spawnProcess = spawnProcess;
+	}
+	spawn({ cmd, args }, { cwd, env, outputFiles, shellId }) {
+		const childProcess = this.spawnProcess(cmd, args, {
+			cwd,
+			detached: process.platform !== "win32",
+			env,
+			shell: false,
+			stdio: [
+				"pipe",
+				outputFiles.stdout.fd,
+				outputFiles.stderr.fd
+			],
+			windowsHide: true
+		});
+		this.processes.set(shellId, childProcess);
+		return childProcess;
+	}
+	kill(shellId) {
+		const childProcess = this.processes.get(shellId);
+		if (!childProcess) throw new Error(`Shell ID ${shellId} not found`);
+		if (childProcess.pid) {
+			(0, import_tree_kill.default)(childProcess.pid, KILL_SIGNAL);
+			return;
+		}
+		childProcess.kill(KILL_SIGNAL);
+	}
+	release(shellId) {
+		this.processes.delete(shellId);
+	}
+};
+
+//#endregion
+//#region ../../packages/local-file-shell/src/shell/clixml.ts
+/**
+* Decode PowerShell CLIXML blocks embedded in redirected stderr.
+*
+* When powershell.exe / pwsh.exe runs with redirected stderr, records from its
+* non-stdout streams (error, warning, verbose, information / Write-Host) are
+* serialized to stderr as CLIXML: `#< CLIXML\n<Objs ...>...</Objs>`. Shown
+* verbatim this is unreadable noise for the model and the user, so we extract
+* the human-readable messages and replace each block in place — the same
+* approach Ansible's `_parse_clixml` takes.
+*/
+const CLIXML_MARKER = "#< CLIXML";
+/** CLIXML escapes characters as `_xHHHH_` (UTF-16 code units). */
+const unescapeClixmlText = (text) => text.replaceAll(/_x([\dA-Fa-f]{4})_/g, (_, hex) => String.fromCharCode(Number.parseInt(hex, 16))).replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&quot;", "\"").replaceAll("&apos;", "'").replaceAll("&amp;", "&");
+/** Stream-typed string records: `<S S="Error">text</S>` (PS 5.1 style). */
+const STREAM_ENTRY = /<S S="(?:Error|Warning|Verbose|Debug|Info)">([\S\s]*?)<\/S>/g;
+/**
+* Rendered text of serialized records (`InformationRecord` / `HostInformationMessage`
+* from Write-Host end up here). Nested objects repeat the same message in their
+* own `<ToString>`, so consecutive duplicates are collapsed by the caller.
+*/
+const TO_STRING_ENTRY = /<ToString>([\S\s]*?)<\/ToString>/g;
+const extractBlockMessages = (block) => {
+	const streamTexts = [...block.matchAll(STREAM_ENTRY)].map((m) => m[1]);
+	const texts = streamTexts.length > 0 ? streamTexts : [...block.matchAll(TO_STRING_ENTRY)].map((m) => m[1]);
+	const messages = [];
+	for (const raw of texts) {
+		const text = unescapeClixmlText(raw);
+		if (messages.at(-1) === text) continue;
+		messages.push(text);
+	}
+	return messages;
+};
+/**
+* Replace every CLIXML block in `text` with its decoded messages. Plain text
+* around the blocks is preserved; input without a marker is returned as-is.
+* Truncated blocks (output preview cuts) decode whatever entries survived.
+*/
+const decodeClixml = (text) => {
+	if (!text.includes(CLIXML_MARKER)) return text;
+	let result = "";
+	let cursor = 0;
+	while (cursor < text.length) {
+		const markerIndex = text.indexOf(CLIXML_MARKER, cursor);
+		if (markerIndex === -1) {
+			result += text.slice(cursor);
+			break;
+		}
+		result += text.slice(cursor, markerIndex);
+		const closeIndex = text.indexOf("</Objs>", markerIndex);
+		const blockEnd = closeIndex === -1 ? text.length : closeIndex + 7;
+		const messages = extractBlockMessages(text.slice(markerIndex, blockEnd));
+		if (messages.length > 0) result += messages.map((m) => m.endsWith("\n") ? m : `${m}\n`).join("");
+		cursor = blockEnd;
+	}
+	return result;
+};
+
 //#endregion
 //#region ../../packages/local-file-shell/src/shell/utils.ts
 /** Maximum preview bytes returned inline to prevent context explosion */
@@ -257287,7 +258356,6 @@ if (-not \$__lobeExecOk) {
 
 //#endregion
 //#region ../../packages/local-file-shell/src/shell/process-manager.ts
-var import_tree_kill = /* @__PURE__ */ __toESM(require_tree_kill());
 const DEFAULT_OBSERVATION_TIMEOUT_MS = 6e4;
 /**
 * Ceiling on a single observation window. Sized for the real unit of work an
@@ -257336,7 +258404,6 @@ const GET_COMMAND_OUTPUT_HEAD_RATIO = 0;
 const OUTPUT_PREVIEW_TOTAL_MAX_BYTES = 22 * 1024;
 const OUTPUT_PREVIEW_STREAM_MAX_BYTES = 18 * 1024;
 const OUTPUT_PREVIEW_SECONDARY_MIN_BYTES = 4 * 1024;
-const KILL_SIGNAL = "SIGKILL";
 /**
 * Not-found text for a shell id this process never issued. Shell ids travel
 * through the model and the device gateway, so a lookup can land on a device
@@ -257346,6 +258413,8 @@ const KILL_SIGNAL = "SIGKILL";
 */
 const shellNotFoundError = (shellId) => `Shell ID ${shellId} not found in this device process. It may have been started by a different or restarted process; its output is not available here.`;
 var ShellProcessManager = class {
+	/** Default backend for commands spawned through this manager. */
+	backend;
 	nextShellId = 1;
 	/**
 	* Per-instance random prefix for shell ids. A bare counter restarts at 1 in
@@ -257356,7 +258425,8 @@ var ShellProcessManager = class {
 	shellIdToken = randomBytes(3).toString("hex");
 	outputRunDir;
 	processes = /* @__PURE__ */ new Map();
-	constructor(outputRoot) {
+	constructor(outputRoot, backend = new ChildProcessBackend()) {
+		this.backend = backend;
 		const date = /* @__PURE__ */ new Date();
 		this.outputRunDir = path.join(path.resolve(outputRoot ?? path.join(os.tmpdir(), "lobehub", "shell")), `${date.getFullYear()}-${date.getMonth() + 1}-${date.getDate()}`, process.pid.toString());
 		fs.mkdirSync(this.outputRunDir, {
@@ -257424,9 +258494,9 @@ var ShellProcessManager = class {
 			stdout: "",
 			success: false
 		};
-		const { process: childProcess } = shellProcess;
-		let exitCode = childProcess.exitCode ?? shellProcess.exitCode;
-		if (exitCode === null && childProcess.signalCode == null) {
+		const { process: handle } = shellProcess;
+		let exitCode = handle.exitCode ?? shellProcess.exitCode;
+		if (exitCode === null && handle.signalCode == null) {
 			const waitTimeout = resolveWaitTimeout(typeof timeout === "number" && Number.isFinite(timeout) ? Math.min(Math.max(Math.trunc(timeout), 0), MAX_OBSERVATION_TIMEOUT_MS) : DEFAULT_OBSERVATION_TIMEOUT_MS);
 			if (waitTimeout > 0) {
 				let timer;
@@ -257436,11 +258506,11 @@ var ShellProcessManager = class {
 					await Promise.race([
 						new Promise((resolve) => {
 							onError = resolve;
-							childProcess.once("error", onError);
+							handle.once("error", onError);
 						}),
 						new Promise((resolve) => {
 							onExit = resolve;
-							childProcess.once("exit", onExit);
+							handle.once("exit", onExit);
 						}),
 						new Promise((resolve) => {
 							timer = setTimeout(resolve, waitTimeout);
@@ -257448,12 +258518,12 @@ var ShellProcessManager = class {
 					]);
 				} finally {
 					if (timer) clearTimeout(timer);
-					if (onError) childProcess.off("error", onError);
-					if (onExit) childProcess.off("exit", onExit);
+					if (onError) handle.off("error", onError);
+					if (onExit) handle.off("exit", onExit);
 				}
 			}
 		}
-		exitCode = childProcess.exitCode ?? shellProcess.exitCode;
+		exitCode = handle.exitCode ?? shellProcess.exitCode;
 		if (exitCode !== null) {
 			shellProcess.endedAt ??= Date.now();
 			await shellProcess.closed;
@@ -257472,7 +258542,7 @@ var ShellProcessManager = class {
 		} catch {}
 		const startedAt = shellProcess.startedAt ?? Date.now();
 		const durationMs = Math.max(0, (shellProcess.endedAt ?? Date.now()) - startedAt);
-		const signal = childProcess.signalCode ?? void 0;
+		const signal = handle.signalCode ?? void 0;
 		const running = exitCode === null && !signal && !shellProcess.spawnError;
 		return {
 			duration_ms: durationMs,
@@ -257505,7 +258575,7 @@ var ShellProcessManager = class {
 			success: false
 		};
 		try {
-			killProcessTree(shellProcess.process);
+			(shellProcess.backend ?? this.backend).kill(shell_id);
 			return { success: true };
 		} catch (error) {
 			return {
@@ -257516,9 +258586,11 @@ var ShellProcessManager = class {
 	}
 	cleanupAll() {
 		for (const [id, sp] of this.processes) {
+			const backend = sp.backend ?? this.backend;
 			try {
-				killProcessTree(sp.process);
+				backend.kill(id);
 			} catch {}
+			backend.release?.(id);
 			this.closeOutputFiles(sp.outputFiles);
 			this.processes.delete(id);
 		}
@@ -257544,14 +258616,6 @@ var ShellProcessManager = class {
 		};
 	}
 };
-const killProcessTree = (childProcess) => {
-	const { pid } = childProcess;
-	if (pid) {
-		(0, import_tree_kill.default)(pid, KILL_SIGNAL);
-		return;
-	}
-	childProcess.kill(KILL_SIGNAL);
-};
 const allocateOutputPreviewBytes = (stdoutSize, stderrSize) => {
 	if (stdoutSize + stderrSize <= OUTPUT_PREVIEW_TOTAL_MAX_BYTES) return {
 		stderr: stderrSize,
@@ -279889,12 +280953,12 @@ function writeTrustBundle(dir, caCertPem, extraCaCertPaths) {
 	const parts = [caCertPem.trim(), ...rootCertificates];
 	const extra = process.env.NODE_EXTRA_CA_CERTS;
 	if (extra) try {
-		parts.push(readFileSync$1(extra, "utf8").trim());
+		parts.push(readFileSync(extra, "utf8").trim());
 	} catch {}
 	for (const extraPath of extraCaCertPaths ?? []) {
 		let raw;
 		try {
-			raw = readFileSync$1(extraPath, "utf8");
+			raw = readFileSync(extraPath, "utf8");
 		} catch (err) {
 			logForDebugging(`[mitm-ca] extraCaCertPaths: cannot read ${extraPath} (${err.code ?? String(err)}); skipping`, { level: "warn" });
 			continue;
@@ -280039,7 +281103,7 @@ function generateEphemeralCA(extraCaCertPaths) {
 function readPem(path, label, field) {
 	let pem;
 	try {
-		pem = readFileSync$1(path, "utf8");
+		pem = readFileSync(path, "utf8");
 	} catch (err) {
 		const code = err.code ?? String(err);
 		throw new Error(`${field}: cannot read ${path} (${code})`);
@@ -290697,11 +291761,12 @@ const checkWorkingDirectory = async (cwd) => {
 		return `Working directory does not exist on ${os.hostname()}: ${cwd}. The shell is fine — run the command from a directory that exists on this device.`;
 	}
 };
-async function runCommand$1({ command, cwd, description, env: extraEnv, run_in_background, timeout = DEFAULT_OBSERVATION_TIMEOUT_MS }, { processManager, logger, onSandboxUnavailable, sandboxPolicy, spawnProcess = spawn }) {
+async function runCommand$1({ command, cwd, description, env: extraEnv, run_in_background, timeout = DEFAULT_OBSERVATION_TIMEOUT_MS }, { backend: backendOverride, processManager, logger, onSandboxUnavailable, sandboxPolicy, spawnProcess }) {
 	if (!command) return {
 		error: "command is required",
 		success: false
 	};
+	const backend = backendOverride ?? (spawnProcess ? new ChildProcessBackend(spawnProcess) : processManager.backend);
 	const logPrefix = `[runCommand: ${description || command.slice(0, 50)}]`;
 	logger?.debug(`${logPrefix} Starting`, {
 		background: run_in_background,
@@ -290748,37 +291813,35 @@ async function runCommand$1({ command, cwd, description, env: extraEnv, run_in_b
 		const shellId = processManager.createShellId();
 		const shellOutputFiles = processManager.createOutputFiles(shellId);
 		outputFiles = shellOutputFiles;
-		const childProcess = spawnProcess(launchCommand.cmd, launchCommand.args, {
+		const handle = backend.spawn({
+			args: launchCommand.args,
+			cmd: launchCommand.cmd
+		}, {
 			cwd,
-			detached: process.platform !== "win32",
 			env: launchEnv,
-			shell: false,
-			stdio: [
-				"pipe",
-				shellOutputFiles.stdout.fd,
-				shellOutputFiles.stderr.fd
-			],
-			windowsHide: true
+			outputFiles: shellOutputFiles,
+			shellId
 		});
 		const shellProcess = {
+			backend,
 			exitCode: null,
 			outputFiles: shellOutputFiles,
-			process: childProcess
+			process: handle
 		};
-		childProcess.on("exit", (code) => {
+		handle.on("exit", (code) => {
 			logger?.debug(`${logPrefix} Process exited`, {
 				code,
 				shellId
 			});
 			shellProcess.exitCode = code ?? 0;
 		});
-		childProcess.on("error", (error) => {
+		handle.on("error", (error) => {
 			logger?.error(`${logPrefix} Command failed:`, error);
 			const cwdContext = cwd ? ` (working directory: ${cwd})` : "";
 			shellProcess.spawnError = new Error(`Failed to start command${cwdContext}: ${error.message}`, { cause: error });
 			shellProcess.exitCode = 1;
 		});
-		childProcess.once("close", () => releaseSandbox?.());
+		handle.once("close", () => releaseSandbox?.());
 		processManager.register(shellId, shellProcess);
 		processManager.closeOutputFiles(shellOutputFiles);
 		logger?.info?.(`${logPrefix} Started session`, {
@@ -504097,6 +505160,10 @@ async function runConnect(options, isDaemonChild) {
 			error(`Could not refresh workspace ${wsId} connect token. Closing share connection.`);
 			closeWorkspaceConnection(wsId);
 		});
+		wsClient.on("replaced", () => {
+			error(`Workspace ${wsId} share connection was taken over by another '${"lh"} connect' on this machine. Closing it here.`);
+			closeWorkspaceConnection(wsId);
+		});
 		wsClient.on("auth_failed", (reason) => {
 			error(`Workspace ${wsId} authentication failed: ${reason}. Closing share connection.`);
 			closeWorkspaceConnection(wsId);
@@ -504202,6 +505269,11 @@ async function runConnect(options, isDaemonChild) {
 		cleanup();
 		process.exit(1);
 	});
+	client.on("replaced", () => {
+		error(`Another '${"lh"} connect' on this machine took over this device's gateway connection. Only one can be connected at a time; stopping this one.`);
+		cleanup();
+		process.exit(1);
+	});
 	client.on("error", (err) => {
 		error(`Connection error: ${err.message}`);
 	});
@@ -509628,7 +510700,20 @@ const hasOperationToken = () => {
 };
 function registerGoalCommand$1(program) {
 	const goal = program.command("goal").description("Run long-horizon Goal Graphs");
-	goal.command("plan <id>").description("Atomically submit the current main Agent plan").requiredOption("--file <path>", "JSON plan: action tasks/verify/retry/escalate, reason and action fields").requiredOption("--token <token>", "Current server-issued planning turn token").option("--operation <id>", "Defaults to LOBEHUB_OPERATION_ID").option("--json", "Output JSON").action(async (id, options) => {
+	goal.command("wake <id>").description("Deliver an external result to a specific Goal wait").requiredOption("--token <token>", "managerState.token from the waiting Goal").requiredOption("--event <id>", "Stable delivery ID").requiredOption("--type <type>", "Event type declared by the wait").requiredOption("--key <key>", "Event correlation key declared by the wait").option("--summary <text>", "Short observation").option("--reference <reference>", "Evidence reference, not an inline dataset").option("--json", "Output JSON").action(async (id, options) => {
+		const result = await (await getTrpcClient()).goal.wake.mutate({
+			id,
+			waitToken: options.token,
+			eventId: options.event,
+			type: options.type,
+			key: options.key,
+			summary: options.summary,
+			reference: options.reference
+		});
+		if (options.json) outputJson(result.data);
+		else console.log(result.data.accepted ? "Event recorded; Goal continuation queued." : `Event not applied: ${result.data.reason}`);
+	});
+	goal.command("plan <id>").description("Atomically submit the current main Agent plan").requiredOption("--file <path>", "JSON plan: action tasks/wait/verify/retry/escalate, reason and action fields").requiredOption("--token <token>", "Current server-issued planning turn token").option("--operation <id>", "Defaults to LOBEHUB_OPERATION_ID").option("--json", "Output JSON").action(async (id, options) => {
 		const operationId = options.operation ?? process.env.LOBEHUB_OPERATION_ID;
 		if (!operationId) throw new Error("Current manager operation ID required");
 		const client = await getTrpcClient();
@@ -509656,31 +510741,31 @@ function registerGoalCommand$1(program) {
 		if (options.json) outputJson(result.data);
 		else console.log("Goal report recorded.");
 	});
-	goal.command("create <title>").option("--max-manager-turns <n>", "Add a main Agent with this turn limit; it takes over problems the system planner cannot route").description("Create a standalone goal and seed its graph").option("-r, --requirement <text>", "Acceptance requirement").option("-i, --instruction <text>", "The ask in the user's own words, shown on the problem node").option("-t, --task <title...>", "Initial task node titles (omit to let the planner decompose)").option("--agent <id>", "Goal agent: supervises and plans the goal (defaults to the current agent)").option("--task-agent <id>", "Dedicated executor for the goal's tasks (defaults to the goal agent)").option("--project <id>", "Project ID").option("--explore <instruction>", "Explore alternatives using completed experiment results").option("--max-experiments <n>", "Maximum experiment nodes (requires --explore, default 10)").option("--supervise", "Enable bounded recovery supervision in an independent topic").option("--max-supervision-incidents <n>", "Maximum supervised interruptions (default 10, maximum 100)").option("--max-rounds <n>", "Maximum goal rounds").option("--max-cost <usd>", "Maximum total cost in USD").option("--max-attempts-per-task <n>", "Attempts per Task before opening a decision gate").option("--max-concurrent-tasks <n>", "How many of this goal's tasks may run at once (default 3)").option("--max-steps-per-run <n>", "Optional agent step cap per Task run (for example 500)").option("--operation-lease-timeout-ms <n>", "Reclaim a Task operation after this idle time (minimum: 60000)").option("--conversation", "Create the goal from the current conversation run (/goal): this agent supervises it from this conversation, and the output carries a turnToken for the first plan").option("--criterion <text...>", "Acceptance criterion (repeatable)").option("--json [fields]", "Output JSON").action(async (title, options) => {
+	goal.command("create <title>").option("--max-manager-turns <n>", "Add a main Agent with this turn limit; it takes over problems the system planner cannot route").description("Create a standalone goal and seed its graph").option("-r, --requirement <text>", "Acceptance requirement").option("-i, --instruction <text>", "The ask in the user's own words, shown on the problem node").option("-t, --task <title...>", "Initial task node titles (omit to let the planner decompose)").option("--agent <id>", "Goal agent: supervises and plans the goal (defaults to the current agent)").option("--task-agent <id>", "Dedicated executor for the goal's tasks (defaults to the goal agent)").option("--project <id>", "Project ID").option("--explore <instruction>", "Explore alternatives using completed experiment results").option("--max-experiments <n>", "Maximum experiment nodes (requires --explore, default 10)").option("--max-supervision-incidents <n>", "Maximum supervised interruptions (supervision is always on; default 10, maximum 100)").option("--max-rounds <n>", "Maximum goal rounds").option("--max-cost <usd>", "Maximum total cost in USD").option("--max-attempts-per-task <n>", "Attempts per Task before opening a decision gate").option("--max-concurrent-tasks <n>", "How many of this goal's tasks may run at once (default 3)").option("--max-steps-per-run <n>", "Optional agent step cap per Task run (for example 500)").option("--operation-lease-timeout-ms <n>", "Reclaim a Task operation after this idle time (minimum: 60000)").option("--conversation", "Link the goal to the current conversation. Use it whenever you create a goal for the user from a chat, not only for /goal: without it the goal is standalone and never shows on this conversation's goal tray. This agent supervises the goal from this conversation; the output carries a turnToken, so submit the first plan with `lh goal plan <id> --token <turnToken> --file <plan.json>`").option("--criterion <text...>", "Acceptance criterion (repeatable)").option("--json [fields]", "Output JSON").action(async (title, options) => {
 		if (options.maxExperiments && !options.explore) throw new Error("--max-experiments requires --explore");
 		const operationId = process.env.LOBEHUB_OPERATION_ID;
 		if (options.conversation && !operationId) throw new Error("--conversation must run inside an agent conversation (LOBEHUB_OPERATION_ID)");
 		const client = await getTrpcClient();
 		const buildUrl = await resolveAppUrlBuilder(client);
 		const goalInput = {
-			config: options.maxManagerTurns || options.explore || options.supervise || options.maxAttemptsPerTask || options.maxStepsPerRun || options.operationLeaseTimeoutMs || options.maxConcurrentTasks || options.taskAgent ? {
-				taskAgentId: options.taskAgent,
-				manager: options.maxManagerTurns ? { maxTurns: Number(options.maxManagerTurns) } : void 0,
+			config: {
 				exploration: options.explore ? {
 					instruction: options.explore,
 					maxExperiments: Number(options.maxExperiments ?? 10)
 				} : void 0,
-				supervision: options.supervise ? {
-					enabled: true,
-					maxIncidents: options.maxSupervisionIncidents ? Number.parseInt(options.maxSupervisionIncidents, 10) : void 0
-				} : void 0,
+				manager: options.maxManagerTurns ? { maxTurns: Number(options.maxManagerTurns) } : void 0,
 				maxConcurrentTasks: options.maxConcurrentTasks ? Number.parseInt(options.maxConcurrentTasks, 10) : void 0,
 				recovery: {
 					maxAttemptsPerTask: options.maxAttemptsPerTask ? Number.parseInt(options.maxAttemptsPerTask, 10) : void 0,
 					maxStepsPerRun: options.maxStepsPerRun ? Number.parseInt(options.maxStepsPerRun, 10) : void 0,
 					operationLeaseTimeoutMs: options.operationLeaseTimeoutMs ? Number.parseInt(options.operationLeaseTimeoutMs, 10) : void 0
-				}
-			} : void 0,
+				},
+				supervision: {
+					enabled: true,
+					...options.maxSupervisionIncidents ? { maxIncidents: Number.parseInt(options.maxSupervisionIncidents, 10) } : {}
+				},
+				taskAgentId: options.taskAgent
+			},
 			criteria: options.criterion?.map((criterion) => ({ title: criterion })),
 			maxRounds: options.maxRounds ? Number.parseInt(options.maxRounds, 10) : void 0,
 			maxTotalCost: options.maxCost ? Number.parseFloat(options.maxCost) : void 0,
@@ -513776,7 +514861,7 @@ function object(shape, params) {
 }
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
 	return !!s._zod;
 }
@@ -513900,7 +514985,7 @@ function getLiteralValue(schema) {
 }
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 const LATEST_PROTOCOL_VERSION = "2025-11-25";
 const DEFAULT_NEGOTIATED_PROTOCOL_VERSION = "2025-03-26";
 const SUPPORTED_PROTOCOL_VERSIONS = [
@@ -515866,7 +516951,7 @@ var UrlElicitationRequiredError = class extends McpError {
 };
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 /**
 * Experimental task interfaces for MCP SDK.
 * WARNING: These APIs are experimental and may change without notice.
@@ -517009,7 +518094,7 @@ const zodToJsonSchema = (schema, options) => {
 };
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function mapMiniTarget(t) {
 	if (!t) return "draft-7";
 	if (t === "jsonSchema7" || t === "draft-7") return "draft-7";
@@ -517040,7 +518125,7 @@ function parseWithCompat(schema, data) {
 }
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 /**
 * The default request timeout, in miliseconds.
 */
@@ -518218,7 +519303,7 @@ var require_dist = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 }));
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 /**
 * AJV-based JSON Schema validator provider
 */
@@ -518297,7 +519382,7 @@ var AjvJsonSchemaValidator = class {
 };
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 /**
 * Experimental server task features for MCP SDK.
 * WARNING: These APIs are experimental and may change without notice.
@@ -518518,7 +519603,7 @@ var ExperimentalServerTasks = class {
 };
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 /**
 * Experimental task capability assertion helpers.
 * WARNING: These APIs are experimental and may change without notice.
@@ -518570,7 +519655,7 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
 }
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 /**
 * An MCP server on top of a pluggable transport.
 *
@@ -518905,7 +519990,7 @@ var Server = class extends Protocol {
 };
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
 const COMPLETABLE_SYMBOL = Symbol.for("mcp.completable");
 /**
 * Checks if a schema is completable (has completion metadata).
@@ -518925,7 +520010,7 @@ var McpZodTypeKind;
 })(McpZodTypeKind || (McpZodTypeKind = {}));
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
 /**
 * Tool name validation utilities according to SEP: Specify Format for Tool Names
 *
@@ -518997,7 +520082,7 @@ function validateAndWarnToolName(name) {
 }
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
 /**
 * Experimental McpServer task features for MCP SDK.
 * WARNING: These APIs are experimental and may change without notice.
@@ -519029,7 +520114,7 @@ var ExperimentalMcpServerTasks = class {
 };
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
 init_zod$1();
 function toolInputElementCount(value, max) {
 	let count = 0;
@@ -519683,11 +520768,11 @@ const EMPTY_COMPLETION_RESULT = { completion: {
 } };
 
 //#endregion
-//#region node_modules/.pnpm/@hono+node-server@2.1.3_hono@4.13.12/node_modules/@hono/node-server/dist/constants-BLSFu_RU.mjs
+//#region node_modules/.pnpm/@hono+node-server@2.1.3_hono@4.13.13/node_modules/@hono/node-server/dist/constants-BLSFu_RU.mjs
 const X_ALREADY_SENT = "x-hono-already-sent";
 
 //#endregion
-//#region node_modules/.pnpm/hono@4.13.12/node_modules/hono/dist/helper/websocket/index.js
+//#region node_modules/.pnpm/hono@4.13.13/node_modules/hono/dist/helper/websocket/index.js
 /**
 * Create a WebSocket adapter/helper
 */
@@ -519712,7 +520797,7 @@ const defineWebSocketHelper = (handler) => {
 };
 
 //#endregion
-//#region node_modules/.pnpm/@hono+node-server@2.1.3_hono@4.13.12/node_modules/@hono/node-server/dist/index.mjs
+//#region node_modules/.pnpm/@hono+node-server@2.1.3_hono@4.13.13/node_modules/@hono/node-server/dist/index.mjs
 var RequestError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -520978,7 +522063,7 @@ var require_content_type = /* @__PURE__ */ __commonJSMin(((exports) => {
 }));
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
 var import_content_type = /* @__PURE__ */ __toESM(require_content_type(), 1);
 /**
 * Extracts the media type (the lowercased `type/subtype` pair, without
@@ -521025,7 +522110,7 @@ function isJsonContentType(header) {
 }
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/requestBody.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/requestBody.js
 /** Default upper bound, in bytes, on a request body read by the HTTP entry points (4 MiB). */
 const DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
 /** The message answered with 413 for a request body over `maxBytes`. */
@@ -521076,7 +522161,7 @@ async function readRequestBody(request, maxBytes = DEFAULT_MAX_REQUEST_BODY_SIZE
 }
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/sseKeepAlive.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/sseKeepAlive.js
 /** Default interval between SSE keep-alive comment frames. */
 const DEFAULT_SSE_KEEP_ALIVE_MS = 15e3;
 const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
@@ -521089,7 +522174,7 @@ function armSseKeepAlive(intervalMs, onTick) {
 }
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
 /**
 * Web Standards Streamable HTTP Server Transport
 *
@@ -521757,7 +522842,7 @@ var WebStandardStreamableHTTPServerTransport = class {
 };
 
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.0_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/streamableHttp.js
+//#region node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.6.5/node_modules/@modelcontextprotocol/sdk/dist/esm/server/streamableHttp.js
 /**
 * Node.js HTTP Streamable HTTP Server Transport
 *
@@ -528305,10 +529390,10 @@ function registerLifecycleCommands(task) {
 			return;
 		}
 		const { serverUrl, headers } = await getAuthInfo();
-		await streamAgentEvents(`${serverUrl}/api/agent/stream?operationId=${encodeURIComponent(result.operationId)}`, headers, {
+		if ((await streamAgentEvents(`${serverUrl}/api/agent/stream?operationId=${encodeURIComponent(result.operationId)}`, headers, {
 			json: options.json,
 			verbose: options.verbose
-		});
+		}))?.kind === "failed") process.exit(1);
 		try {
 			await client.task.heartbeat.mutate({ id });
 		} catch {}
@@ -528353,10 +529438,10 @@ function registerLifecycleCommands(task) {
 				return;
 			}
 			const { serverUrl, headers } = await getAuthInfo();
-			await streamAgentEvents(`${serverUrl}/api/agent/stream?operationId=${encodeURIComponent(operationId)}`, headers, {
+			if ((await streamAgentEvents(`${serverUrl}/api/agent/stream?operationId=${encodeURIComponent(operationId)}`, headers, {
 				json: options.json,
 				verbose: options.verbose
-			});
+			}))?.kind === "failed") process.exit(1);
 			try {
 				await client.task.heartbeat.mutate({ id });
 			} catch {}
@@ -530847,7 +531932,7 @@ function evidenceTypeForFile(file) {
 function inlineTextEvidenceForFile(file, type) {
 	if (!INLINE_TEXT_EVIDENCE_TYPES.has(type)) return void 0;
 	try {
-		const buffer = readFileSync$1(file);
+		const buffer = readFileSync(file);
 		if (buffer.includes(0)) return void 0;
 		const content = buffer.toString("utf8");
 		return content.length > 0 && content.length < 5e3 ? content : void 0;
@@ -531387,7 +532472,7 @@ function interactionCostFromReportDir(dir, result) {
 	if (!existsSync(tracePath)) return void 0;
 	let raw;
 	try {
-		raw = readFileSync$1(tracePath, "utf8");
+		raw = readFileSync(tracePath, "utf8");
 	} catch {
 		log$13.warn(`${GOMS_KLM_TRACE_FILE} could not be read — publishing without interaction cost`);
 		return;
@@ -532018,7 +533103,7 @@ async function ingestReportAction(reportDir, options) {
 	}
 	let result;
 	try {
-		result = JSON.parse(readFileSync$1(resultPath, "utf8"));
+		result = JSON.parse(readFileSync(resultPath, "utf8"));
 	} catch {
 		log$13.error("result.json is not valid JSON");
 		process.exit(1);
@@ -532043,9 +533128,9 @@ async function ingestReportAction(reportDir, options) {
 	});
 	const summary = result.summary ?? {};
 	const reportMdPath = path.join(dir, "report.md");
-	const content = existsSync(reportMdPath) ? readFileSync$1(reportMdPath, "utf8") : void 0;
+	const content = existsSync(reportMdPath) ? readFileSync(reportMdPath, "utf8") : void 0;
 	const proposalMdPath = path.join(dir, "proposal.md");
-	const proposal = (existsSync(proposalMdPath) ? readFileSync$1(proposalMdPath, "utf8") : typeof result.proposal === "string" ? result.proposal : "").trim();
+	const proposal = (existsSync(proposalMdPath) ? readFileSync(proposalMdPath, "utf8") : typeof result.proposal === "string" ? result.proposal : "").trim();
 	const scenario = scenarioFromResult(result);
 	let context;
 	let pullRequest;
@@ -532073,6 +533158,7 @@ async function ingestReportAction(reportDir, options) {
 		process.exit(1);
 	}
 	let subject = subjectFromResult(result);
+	let foldTaskRunTopic = false;
 	if (!requestedAcceptanceId && options.subject) {
 		const ref = parseSubjectRef(options.subject);
 		if (!ref) {
@@ -532089,6 +533175,7 @@ async function ingestReportAction(reportDir, options) {
 	} else if (!requestedAcceptanceId && !subject) {
 		const ref = subjectFromEnv();
 		if (ref) subject = { ref };
+		foldTaskRunTopic = Boolean(ref);
 	}
 	if (!requestedAcceptanceId && !subject) subject = { ref: {
 		subjectId: randomUUID(),
@@ -532122,8 +533209,16 @@ async function ingestReportAction(reportDir, options) {
 			requirement,
 			subjectId: subject.ref.subjectId,
 			subjectType: subject.ref.subjectType,
+			...foldTaskRunTopic ? { foldTaskRunTopic } : {},
 			...subject.ref.subjectType === "standalone" && (title || goal) ? { title: title || goal } : {}
 		});
+		subject = {
+			...subject,
+			ref: {
+				subjectId: acceptance.subjectId,
+				subjectType: acceptance.subjectType
+			}
+		};
 		bundle = await client.acceptance.getBundle.query({ id: acceptance.id });
 	}
 	plan = reuseSourceCriteria(plan, bundle?.checks);
@@ -532949,20 +534044,12 @@ function registerVerifyCommand(program) {
 		console.log(`${import_picocolors.default.green("✓")} Rubric ${import_picocolors.default.bold(rubricId)} now has ${criterionIds.length} criterion(s)`);
 	});
 	const plan = verify.command("plan").description("Per-run check plan lifecycle");
-	plan.command("generate <operationId>").description("Generate a draft check plan for a run").requiredOption("--goal <goal>", "The run's task/instruction the plan must satisfy").option("--rubric <id>", "Mounted rubric id").option("--criteria <ids>", "Ad-hoc criterion ids (comma-separated)").option("--ai", "Let the LLM propose additional criteria").option("--max-ai <n>", "Max AI-proposed criteria").option("--model <model>", "Model (required with --ai)").option("--provider <provider>", "Provider (required with --ai)").option("--context <text>", "Extra context for the AI prompt").option("--json [fields]", "Output JSON").action(async (operationId, options) => {
-		if (options.ai && (!options.model || !options.provider)) {
-			log$13.error("--ai requires --model and --provider");
-			process.exit(1);
-		}
+	plan.command("generate <operationId>").description("Generate a draft check plan for a run").requiredOption("--goal <goal>", "The run's task/instruction the plan must satisfy").option("--rubric <id>", "Mounted rubric id").option("--criteria <ids>", "Ad-hoc criterion ids (comma-separated)").option("--ai", "Let the LLM propose additional criteria").option("--max-ai <n>", "Max AI-proposed criteria").option("--context <text>", "Extra context for the AI prompt").option("--json [fields]", "Output JSON").action(async (operationId, options) => {
 		const items = await (await getTrpcClient()).verify.generateDraftPlan.mutate({
 			context: options.context,
 			enableAiGeneration: options.ai,
 			goal: options.goal,
 			maxAiCriteria: options.maxAi ? Number.parseInt(options.maxAi, 10) : void 0,
-			modelConfig: options.model && options.provider ? {
-				model: options.model,
-				provider: options.provider
-			} : void 0,
 			operationId,
 			verifyCriteriaIds: options.criteria?.split(",").map((s) => s.trim()).filter(Boolean),
 			verifyRubricId: options.rubric ?? null