@lumi.ai/runner 0.1.0

package/dist/cli.js

@@ -0,0 +1,3432 @@
+#!/usr/bin/env node
+
+// src/cli/index.ts
+import { Command } from "commander";
+
+// src/daemon.ts
+import os4 from "node:os";
+import {
+  collection as collection5,
+  deleteField,
+  doc as doc7,
+  getDoc as getDoc5,
+  onSnapshot as onSnapshot2,
+  orderBy as orderBy3,
+  query as query3,
+  runTransaction as runTransaction2,
+  setDoc as setDoc2,
+  updateDoc as updateDoc2,
+  where as where3
+} from "firebase/firestore";
+
+// ../shared/dist/engines/claude.js
+var CLAUDE_ENGINE = {
+  id: "claude",
+  label: "Claude Code",
+  models: [
+    { id: "sonnet", label: "Sonnet", rates: { input: 3, cachedInput: 0.3, output: 15 } },
+    { id: "opus", label: "Opus", rates: { input: 15, cachedInput: 1.5, output: 75 } }
+  ],
+  defaultModelId: "sonnet",
+  capabilities: {
+    mcp: true,
+    bash: true,
+    webSearch: true,
+    reportsCost: true,
+    reportsCache: true
+  },
+  requiredSecrets: [
+    {
+      key: "claudeToken",
+      label: "Claude setup-token",
+      hint: "Run `claude setup-token` on any machine signed in to Claude Code.",
+      // `claude setup-token` emits `sk-ant-oat01-…`, around 100 characters. The floor is set
+      // well below that on purpose: it exists to catch a half-copied token, not to pin a format
+      // Anthropic is free to change.
+      prefix: "sk-ant-oat01-",
+      minLength: 40
+    }
+  ],
+  usageWindows: {
+    label: "5-hour window",
+    // Claude has both a 5-hour rolling window and a weekly cap. The FALLBACK is the short one
+    // on purpose: when the wall message carries no parsable reset time we cannot tell which
+    // wall we hit, and pausing a Ship for a week on a guess is far worse than retrying in five
+    // hours.
+    fallbackMs: 5 * 60 * 60 * 1e3
+  }
+};
+
+// ../shared/dist/engines/index.js
+var ENGINES = {
+  claude: CLAUDE_ENGINE
+};
+var DEFAULT_ENGINE_ID = "claude";
+function isKnownEngine(id) {
+  return !!id && Object.hasOwn(ENGINES, id);
+}
+function getEngine(id) {
+  return isKnownEngine(id) ? ENGINES[id] : ENGINES[DEFAULT_ENGINE_ID];
+}
+function engineUsageWindows(engineId) {
+  return getEngine(engineId).usageWindows;
+}
+function engineModel(engineId, modelId) {
+  return getEngine(engineId).models.find((m) => m.id === modelId);
+}
+function estimateCostUsd(engineId, modelId, tokens) {
+  const model = engineModel(engineId, modelId);
+  if (!model)
+    return 0;
+  const fresh = Math.max(0, tokens.inputTokens - tokens.cachedInputTokens);
+  return (fresh * model.rates.input + tokens.cachedInputTokens * model.rates.cachedInput + tokens.outputTokens * model.rates.output) / 1e6;
+}
+
+// ../shared/dist/agent.js
+var DEFAULT_AGENT_TOOLS = {
+  workspaceMcp: true,
+  github: { enabled: false, repos: [] },
+  bash: false,
+  webSearch: false,
+  extraMcps: []
+};
+function agentEngine(agent) {
+  return agent.engine ?? DEFAULT_ENGINE_ID;
+}
+function effectiveAgentTools(agent) {
+  const { capabilities } = getEngine(agent.engine);
+  const tools = { ...DEFAULT_AGENT_TOOLS, ...agent.tools };
+  const github = { ...DEFAULT_AGENT_TOOLS.github, ...tools.github };
+  return {
+    ...tools,
+    workspaceMcp: tools.workspaceMcp && capabilities.mcp,
+    bash: tools.bash && capabilities.bash,
+    webSearch: tools.webSearch && capabilities.webSearch,
+    // Arrays are COPIED, not spread through: a shallow spread of an agent doc missing `tools`
+    // hands back DEFAULT_AGENT_TOOLS' own arrays, so a caller appending to the result would
+    // edit the module-level defaults for every later agent.
+    extraMcps: [...tools.extraMcps],
+    github: { ...github, repos: [...github.repos], enabled: github.enabled && capabilities.bash }
+  };
+}
+
+// ../shared/dist/chat.js
+var MAX_CHAT_MESSAGES_IN_PROMPT = 40;
+
+// ../shared/dist/collections.js
+var CREW_DATABASE_ID = "crew";
+var COLLECTIONS = {
+  /** A Ship = one organization; the multi-tenant unit. Everything else hangs off it. */
+  ships: "ships",
+  /** `ships/{shipId}/members/{uid}` — the humans of a Ship (captain | member). */
+  members: "members",
+  /** `ships/{shipId}/tasks/{taskId}` — the board's units of work. */
+  tasks: "tasks",
+  /** `ships/{shipId}/tasks/{taskId}/activity/{eventId}` — a task's feed (comments + status). */
+  activity: "activity",
+  /** `ships/{shipId}/chats/{chatId}` — out-of-task conversations (PRD §7.8). */
+  chats: "chats",
+  /**
+   * `ships/{shipId}/chats/{chatId}/messages/{msgId}` — a chat's messages.
+   *
+   * A generic wire name under a specific parent, unlike `activity`: nothing else in Crew has
+   * `messages`, and the path is only ever composed from `chats` above it.
+   */
+  chatMessages: "messages",
+  /** `ships/{shipId}/agents/{agentId}` — the crew: one doc = one configured agent. */
+  agents: "agents",
+  /** `ships/{shipId}/agents/{agentId}/workflows/{workflowId}` — that agent's playbooks. */
+  workflows: "workflows",
+  /** `ships/{shipId}/knowledge/{slug}` — the org brain; doc id IS the slug (see knowledge.ts). */
+  knowledge: "knowledge",
+  /** `ships/{shipId}/knowledge_folders/{folderId}` — one-level grouping for humans. */
+  knowledgeFolders: "knowledge_folders",
+  /**
+   * `ships/{shipId}/indexes/{docId}` — trigger-owned derived documents (see INDEX_DOCS).
+   * Its OWN collection rather than a reserved id inside the source collection: a trigger writing
+   * into the path it watches self-fires, and a reserved doc id is a name a captain can squat.
+   */
+  indexes: "indexes",
+  /** `ships/{shipId}/jobs/{jobId}` — the execution queue; one doc per agent run. */
+  jobs: "jobs",
+  /** `ships/{shipId}/runners/{runnerId}` — ship-scoped live daemon mirror (Daemons page). */
+  runners: "runners",
+  /** `ships/{shipId}/notifications/{id}` — per-member in-app notifications. */
+  notifications: "notifications",
+  /** `ships/{shipId}/usage_daily/{yyyy-mm-dd}` — token-tracking aggregates. */
+  usageDaily: "usage_daily",
+  /** `ships/{shipId}/engine_limits/{engineId}` — an engine's exhausted usage window. */
+  engineLimits: "engine_limits",
+  /** `ships/{shipId}/events/{id}` — append-only Ship-level audit log. */
+  events: "events",
+  /** `ships/{shipId}/secrets/{docId}` — runner creds + MCP token hash (see secrets.ts). */
+  secrets: "secrets",
+  /** `ships/{shipId}/integrations/{docId}` — 3rd-party connectors (GitHub App; see github.ts). */
+  integrations: "integrations",
+  /** Top-level `users/{uid}/...` — per-user docs (runner machine registry). */
+  users: "users",
+  /** Top-level `githubInstallStates/{stateId}` — single-use install-flow nonces (backend only). */
+  githubInstallStates: "githubInstallStates",
+  /** Top-level `githubInstallations/{installationId}` — installation→Ship index (backend only). */
+  githubInstallations: "githubInstallations",
+  /** Top-level `runnerLoginCodes/{userCode}` — CLI device-login handshakes (backend only). */
+  runnerLoginCodes: "runnerLoginCodes"
+};
+
+// ../shared/dist/engineLimit.js
+function isEngineLimited(limit3, now) {
+  return !!limit3 && limit3.resetsAt > now;
+}
+
+// ../shared/dist/github.js
+var INTEGRATION_DOCS = {
+  /** The GitHub App installation for this Ship (this file's shape). */
+  github: "github"
+};
+
+// ../shared/dist/job.js
+function jobTarget(job) {
+  if (job.taskId && job.chatId)
+    return null;
+  if (job.taskId)
+    return { kind: "task", taskId: job.taskId };
+  if (job.chatId)
+    return { kind: "chat", chatId: job.chatId };
+  return null;
+}
+
+// ../shared/dist/knowledge.js
+var KNOWLEDGE_CATALOG_MAX_CHARS = 1500;
+var KNOWLEDGE_CATALOG_SUMMARIES = 8;
+var INDEX_DOCS = {
+  /** The knowledge catalog, rebuilt by the `onKnowledgeWritten` trigger. */
+  knowledge: "knowledge"
+};
+function rankKnowledge(index, labels = []) {
+  const entries = index?.entries;
+  if (!entries)
+    return [];
+  const wanted = new Set(labels.map((l) => l.toLowerCase()));
+  return Object.entries(entries).map(([slug, entry]) => ({
+    slug,
+    entry,
+    score: (entry.g ?? []).reduce((n, tag) => n + (wanted.has(tag.toLowerCase()) ? 1 : 0), 0)
+  })).sort((a, b) => b.score - a.score || (b.entry.u ?? 0) - (a.entry.u ?? 0) || (a.slug < b.slug ? -1 : a.slug > b.slug ? 1 : 0));
+}
+function knowledgeCatalogBlock(index, labels = []) {
+  const ranked = rankKnowledge(index, labels);
+  if (ranked.length === 0) {
+    return "# Ship knowledge\n\nThis Ship has no knowledge documents yet. `knowledge_write` creates one \u2014 use it the moment you learn something a colleague would need.";
+  }
+  const head = `# Ship knowledge
+
+${ranked.length} document${ranked.length === 1 ? "" : "s"}. These are SUMMARIES \u2014 call \`knowledge_get({slug})\` to read one in full. Most relevant to this task first.
+
+`;
+  const OVERFLOW_PREFIX = "\nNot listed (call knowledge_get to search): ";
+  const RESERVE = OVERFLOW_PREFIX.length + 40;
+  const lines = [];
+  const dropped = [];
+  let used = head.length;
+  ranked.forEach((r, i) => {
+    const line = i < KNOWLEDGE_CATALOG_SUMMARIES ? `- \`${r.slug}\` \u2014 ${r.entry.t}: ${r.entry.s}` : `- \`${r.slug}\` \u2014 ${r.entry.t}`;
+    if (dropped.length === 0 && used + line.length + 1 <= KNOWLEDGE_CATALOG_MAX_CHARS - RESERVE) {
+      lines.push(line);
+      used += line.length + 1;
+    } else {
+      dropped.push(r.slug);
+    }
+  });
+  if (dropped.length === 0)
+    return head + lines.join("\n");
+  const named = [];
+  let room = KNOWLEDGE_CATALOG_MAX_CHARS - used - OVERFLOW_PREFIX.length - 20;
+  for (const slug of dropped) {
+    if (room - (slug.length + 2) < 0)
+      break;
+    named.push(slug);
+    room -= slug.length + 2;
+  }
+  const rest = dropped.length - named.length;
+  const tail = OVERFLOW_PREFIX + named.join(", ") + (rest > 0 ? ` \u2026 and ${rest} more.` : ".");
+  return head + lines.join("\n") + tail;
+}
+
+// ../shared/dist/docMedia.js
+var DOC_MEDIA_IMAGE_TYPES = [
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp"
+];
+var DOC_MEDIA_DOC_TYPES = [
+  "application/pdf",
+  "text/csv",
+  "text/plain",
+  "text/markdown",
+  "application/json"
+];
+var DOC_MEDIA_TYPES = [
+  ...DOC_MEDIA_IMAGE_TYPES,
+  ...DOC_MEDIA_DOC_TYPES
+];
+
+// ../shared/dist/memory.js
+var MAX_MEMORY_ENTRIES = 40;
+var MAX_MEMORY_TOTAL_CHARS = 2e3;
+function emptyMemory() {
+  return { entries: [], nextId: 1, updatedAt: 0 };
+}
+function memoryChars(memory) {
+  return (memory?.entries ?? []).reduce((n, e) => n + (e.text?.length ?? 0), 0);
+}
+function readMemory(memory) {
+  if (!memory || typeof memory !== "object" || Array.isArray(memory))
+    return emptyMemory();
+  const m = memory;
+  const entries = Array.isArray(m.entries) ? m.entries.filter((e) => !!e && typeof e === "object" && typeof e.id === "string" && typeof e.text === "string") : [];
+  const nextId = Number.isInteger(m.nextId) && m.nextId > 0 ? m.nextId : entries.length + 1;
+  return { entries, nextId, updatedAt: typeof m.updatedAt === "number" ? m.updatedAt : 0 };
+}
+function memoryBlock(memory) {
+  const m = readMemory(memory);
+  const head = "# Your memory\n\n";
+  if (m.entries.length === 0) {
+    return head + "(nothing recorded yet)\n\nThis is your private notebook \u2014 it is carried into every session on this Ship. Call `memory_write` with `add` to record something worth knowing next time, or `retire` to drop a line that is no longer true. Durable facts about how this Ship works, not what happened on one task.";
+  }
+  const chars = memoryChars(m);
+  const lines = m.entries.map((e) => {
+    const marks = [e.source === "captain" ? "captain" : "you", e.pinned ? "pinned" : null].filter(Boolean).join(", ");
+    return `- \`${e.id}\` (${marks}) \u2014 ${e.text}`;
+  }).join("\n");
+  return head + `${m.entries.length} of ${MAX_MEMORY_ENTRIES} entries \xB7 ${chars} of ${MAX_MEMORY_TOTAL_CHARS} characters. Entries marked (captain) were written by a human and outrank your own. Change this with \`memory_write\` \u2014 it takes \`add\` and \`retire\`, a delta, never the whole notebook. If one proved wrong while you worked, retire it before you finish.
+
+` + lines;
+}
+
+// ../shared/dist/riskyAction.js
+var RISKY_ACTIONS = [
+  {
+    id: "git_push",
+    label: "Push to GitHub",
+    meaning: "Write commits to a connected repository.",
+    enforcedBy: "github-token"
+  },
+  {
+    id: "task_create",
+    label: "Create tasks",
+    meaning: "Delegate by opening new work, including for other agents.",
+    enforcedBy: "mcp"
+  },
+  {
+    id: "task_assign",
+    label: "Assign work to others",
+    meaning: "Hand a task to another agent or a human.",
+    enforcedBy: "mcp"
+  },
+  {
+    id: "status_done",
+    label: "Mark work finished",
+    meaning: "Move a task into a review or done status \u2014 the claim that work is complete.",
+    enforcedBy: "mcp"
+  }
+];
+var RISKY_ACTION_IDS = RISKY_ACTIONS.map((a) => a.id);
+function isRiskyActionId(value) {
+  return typeof value === "string" && RISKY_ACTION_IDS.includes(value);
+}
+function splitRiskyActions(riskyActions) {
+  const enforced = [];
+  const advisory = [];
+  for (const action2 of riskyActions) {
+    if (isRiskyActionId(action2))
+      enforced.push(action2);
+    else if (action2.trim())
+      advisory.push(action2);
+  }
+  return { enforced, advisory };
+}
+function autonomyRule(agent) {
+  const { enforced, advisory } = splitRiskyActions(agent.riskyActions ?? []);
+  const named = [...enforced, ...advisory];
+  if (agent.autonomy >= 3) {
+    return "You have full autonomy (level 3) within your tool list: no action needs approval. Use it carefully \u2014 nothing will stop you.";
+  }
+  if (agent.autonomy <= 1) {
+    return "You are at autonomy level 1 \u2014 DRAFTS ONLY. Produce comments and drafts; do not mark work as done or ready for review, do not create or reassign tasks, and do not push to GitHub. When you need any of that, call approval_request with a short summary and STOP \u2014 a captain decides, and you will be started again with their answer.";
+  }
+  return `You are at autonomy level 2. Work freely, except for these actions, which need a captain: ${named.length ? named.join(", ") : "(none configured)"}. Before any of them, call approval_request with a short summary and STOP \u2014 you will be started again with the captain's answer.`;
+}
+
+// ../shared/dist/runner.js
+var RUNNER_OFFLINE_AFTER_MS = 2 * 60 * 1e3;
+
+// ../shared/dist/secrets.js
+var SECRET_DOCS = {
+  /** Captain-provided runner credentials (this file's shape). */
+  runner: "runner",
+  /** `{ tokenHash }` for the Workspace MCP bearer — backend-only, never client-readable. */
+  mcp: "mcp"
+};
+
+// ../shared/dist/task.js
+var TASK_STATUS_CATEGORIES = [
+  "backlog",
+  "todo",
+  "in_progress",
+  "waiting_approval",
+  "review",
+  "done",
+  "failed"
+];
+var TASK_STATUS_CATEGORY_META = {
+  backlog: { label: "Backlog", meaning: "Parked \u2014 not ready to be worked; agents ignore it." },
+  todo: { label: "To do", meaning: "Ready to start \u2014 assigning an agent here starts a run." },
+  in_progress: { label: "In progress", meaning: "Actively being worked on." },
+  waiting_approval: {
+    label: "Waiting approval",
+    meaning: "Blocked on a captain decision before work can continue."
+  },
+  review: { label: "Review", meaning: "Work finished but a human must check it." },
+  done: { label: "Done", meaning: "Complete \u2014 nothing pending." },
+  failed: { label: "Failed", meaning: "Ended unsuccessfully; needs human attention." }
+};
+var DEFAULT_TASK_STATUSES = TASK_STATUS_CATEGORIES.map((category) => ({ id: category, label: TASK_STATUS_CATEGORY_META[category].label, category }));
+function shipTaskStatuses(ship2) {
+  const list = ship2?.settings?.taskStatuses;
+  return Array.isArray(list) && list.length > 0 ? list : DEFAULT_TASK_STATUSES;
+}
+function statusById(statuses, statusId) {
+  return statuses.find((s) => s.id === statusId);
+}
+function firstStatusIn(statuses, category) {
+  return statuses.find((s) => s.category === category);
+}
+
+// ../shared/dist/ship.js
+var DEFAULT_SHIP_SETTINGS = {
+  maxChainDepth: 3,
+  maxJobsPerChain: 10,
+  maxHookDepth: 5,
+  defaultAutonomy: 2,
+  githubRepos: [],
+  taskStatuses: DEFAULT_TASK_STATUSES,
+  // UTC, not the server's zone: a default that depends on where the code runs is not a default.
+  // The creation wizard offers the captain's own browser zone, which is what most Ships get.
+  timezone: "UTC"
+};
+
+// ../shared/dist/usage.js
+var EMPTY_USAGE_TOTALS = {
+  inputTokens: 0,
+  cachedInputTokens: 0,
+  outputTokens: 0,
+  costUsd: 0,
+  jobs: 0,
+  durationS: 0
+};
+var EMPTY_USAGE_BY_AGENT = {
+  inputTokens: 0,
+  cachedInputTokens: 0,
+  outputTokens: 0,
+  costUsd: 0,
+  jobs: 0
+};
+
+// ../shared/dist/workflow.js
+var WORKFLOW_SENTINELS = ["generic", "assigned", "activity", "chat"];
+function isWorkflowSentinel(id) {
+  return WORKFLOW_SENTINELS.includes(id);
+}
+function usableWorkflow(workflow) {
+  if (!workflow || !workflow.enabled)
+    return null;
+  return workflow.instructions?.trim() ? workflow : null;
+}
+
+// src/config.ts
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+var DEFAULT_PROJECT_ID = "lumi-afb7d";
+var LEGACY_DIR_NAME = ".crew-runner";
+var DIR_NAME = ".lumi-runner";
+function configDir() {
+  const override = process.env.LUMI_RUNNER_HOME || process.env.CREW_RUNNER_HOME;
+  if (override) return override;
+  const home = os.homedir();
+  const current = path.join(home, DIR_NAME);
+  if (fs.existsSync(current)) return current;
+  const legacy = path.join(home, LEGACY_DIR_NAME);
+  if (fs.existsSync(legacy)) return legacy;
+  return current;
+}
+function migrateLegacyDir() {
+  if (process.env.LUMI_RUNNER_HOME || process.env.CREW_RUNNER_HOME) return null;
+  const home = os.homedir();
+  const from = path.join(home, LEGACY_DIR_NAME);
+  const to = path.join(home, DIR_NAME);
+  if (!fs.existsSync(from) || fs.existsSync(to)) return null;
+  try {
+    fs.renameSync(from, to);
+    return { migrated: true, from, to };
+  } catch {
+    return { migrated: false, from, to };
+  }
+}
+function configPath() {
+  return path.join(configDir(), "config.json");
+}
+function loadConfig() {
+  try {
+    return JSON.parse(fs.readFileSync(configPath(), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function requireConfig() {
+  const config2 = loadConfig();
+  if (!config2) {
+    console.error("Not logged in. Run: lumi-runner setup");
+    process.exit(1);
+  }
+  return config2;
+}
+function saveConfig(config2) {
+  fs.mkdirSync(configDir(), { recursive: true, mode: 448 });
+  fs.writeFileSync(configPath(), `${JSON.stringify(config2, null, 2)}
+`, { mode: 384 });
+}
+function mcpUrl(config2) {
+  return process.env.CREW_MCP_URL || config2.mcpUrl || `https://us-central1-${config2.projectId}.cloudfunctions.net/workspaceMcp`;
+}
+
+// src/version.ts
+var RUNNER_VERSION = true ? "0.1.0" : "0.0.0-dev";
+
+// src/auth.ts
+import os2 from "node:os";
+import { signInWithCustomToken } from "firebase/auth";
+
+// src/callables.ts
+function functionsBaseUrl(config2) {
+  return functionsBaseUrlFor(config2.projectId);
+}
+function functionsBaseUrlFor(projectId) {
+  return process.env.CREW_FUNCTIONS_URL?.replace(/\/$/, "") || `https://us-central1-${projectId}.cloudfunctions.net`;
+}
+var CallableError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+  status;
+};
+async function callFunction(baseUrl, idToken, name, data) {
+  return request(baseUrl, name, data, { authorization: `Bearer ${idToken}` });
+}
+async function callPublicFunction(baseUrl, name, data) {
+  return request(baseUrl, name, data, {});
+}
+async function request(baseUrl, name, data, headers) {
+  const res = await fetch(`${baseUrl}/${name}`, {
+    method: "POST",
+    headers: { "content-type": "application/json", ...headers },
+    body: JSON.stringify({ data })
+  });
+  const text = await res.text();
+  let body = {};
+  try {
+    body = text ? JSON.parse(text) : {};
+  } catch {
+    body = {};
+  }
+  if (!res.ok || body.error) {
+    const status = (body.error?.status || `HTTP_${res.status}`).toUpperCase();
+    throw new CallableError(status, body.error?.message || `${name} failed (${res.status}).`);
+  }
+  return body.result;
+}
+
+// src/auth.ts
+var authEmulator = () => process.env.FIREBASE_AUTH_EMULATOR_HOST;
+function securetokenUrl(apiKey) {
+  const emu = authEmulator();
+  return emu ? `http://${emu}/securetoken.googleapis.com/v1/token?key=${apiKey}` : `https://securetoken.googleapis.com/v1/token?key=${apiKey}`;
+}
+async function login(fb, config2, customToken) {
+  const cred = await signInWithCustomToken(fb.auth, customToken);
+  config2.refreshToken = cred.user.refreshToken;
+  saveConfig(config2);
+  return cred.user;
+}
+var AuthError = class extends Error {
+};
+async function signInWithStoredSession(fb) {
+  const config2 = requireConfig();
+  if (!config2.refreshToken) {
+    throw new AuthError("No stored session. Run `lumi-runner setup`.");
+  }
+  const tokenRes = await fetch(securetokenUrl(config2.apiKey), {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: config2.refreshToken
+    })
+  });
+  if (!tokenRes.ok) {
+    throw new AuthError(`Session refresh failed (${tokenRes.status}). Run \`lumi-runner login\` again.`);
+  }
+  const { id_token: idToken } = await tokenRes.json();
+  let mint;
+  try {
+    mint = await callFunction(functionsBaseUrl(config2), idToken, "mintRunnerToken", {
+      runnerId: config2.runnerId,
+      hostname: os2.hostname(),
+      version: RUNNER_VERSION
+    });
+  } catch (e) {
+    throw new AuthError(`mintRunnerToken failed: ${e instanceof Error ? e.message : e}`);
+  }
+  const cred = await signInWithCustomToken(fb.auth, mint.customToken);
+  config2.runnerId = mint.runnerId;
+  config2.refreshToken = cred.user.refreshToken;
+  saveConfig(config2);
+  return cred.user;
+}
+async function ensureSignedIn(fb) {
+  try {
+    return await signInWithStoredSession(fb);
+  } catch (e) {
+    console.error(e instanceof Error ? e.message : String(e));
+    process.exit(1);
+  }
+}
+
+// src/firebase.ts
+import { deleteApp, getApps, initializeApp } from "firebase/app";
+import { getAuth, connectAuthEmulator } from "firebase/auth";
+import {
+  getFirestore,
+  connectFirestoreEmulator,
+  terminate
+} from "firebase/firestore";
+import { getStorage, connectStorageEmulator } from "firebase/storage";
+function initFirebase(config2) {
+  const app = initializeApp({
+    apiKey: config2.apiKey,
+    projectId: config2.projectId,
+    authDomain: `${config2.projectId}.firebaseapp.com`,
+    // The modern default bucket (post-2024 Firebase projects) — matches what the functions
+    // runtime's admin getStorage().bucket() resolves for getTranscript.
+    storageBucket: `${config2.projectId}.firebasestorage.app`
+  });
+  const auth = getAuth(app);
+  const db = getFirestore(app, CREW_DATABASE_ID);
+  const storage = getStorage(app);
+  if (process.env.FIREBASE_AUTH_EMULATOR_HOST) {
+    connectAuthEmulator(auth, `http://${process.env.FIREBASE_AUTH_EMULATOR_HOST}`, {
+      disableWarnings: true
+    });
+  }
+  if (process.env.FIRESTORE_EMULATOR_HOST) {
+    const [host, port] = process.env.FIRESTORE_EMULATOR_HOST.split(":");
+    connectFirestoreEmulator(db, host, Number(port));
+  }
+  if (process.env.FIREBASE_STORAGE_EMULATOR_HOST) {
+    const [host, port] = process.env.FIREBASE_STORAGE_EMULATOR_HOST.split(":");
+    connectStorageEmulator(storage, host, Number(port));
+  }
+  return { app, auth, db, storage };
+}
+async function closeFirebase() {
+  for (const app of getApps()) {
+    try {
+      await terminate(getFirestore(app, CREW_DATABASE_ID));
+    } catch {
+    }
+    try {
+      await deleteApp(app);
+    } catch {
+    }
+  }
+}
+
+// src/logging.ts
+import fs2 from "node:fs";
+import path2 from "node:path";
+var MAX_BYTES = 5 * 1024 * 1024;
+var KEEP = 3;
+function logDir() {
+  return path2.join(configDir(), "logs");
+}
+function logFile() {
+  return path2.join(logDir(), "runner.log");
+}
+var liveBytes = null;
+function rotate() {
+  const base = logFile();
+  try {
+    fs2.rmSync(`${base}.${KEEP}`, { force: true });
+    for (let i = KEEP - 1; i >= 1; i--) {
+      if (fs2.existsSync(`${base}.${i}`)) fs2.renameSync(`${base}.${i}`, `${base}.${i + 1}`);
+    }
+    if (fs2.existsSync(base)) fs2.renameSync(base, `${base}.1`);
+  } catch {
+  }
+  liveBytes = 0;
+}
+function appendLog(line) {
+  const file = logFile();
+  const payload = `${line}
+`;
+  try {
+    if (liveBytes === null) {
+      fs2.mkdirSync(logDir(), { recursive: true, mode: 448 });
+      liveBytes = fs2.existsSync(file) ? fs2.statSync(file).size : 0;
+    }
+    if (liveBytes + payload.length > MAX_BYTES) rotate();
+    fs2.appendFileSync(file, payload);
+    liveBytes += payload.length;
+  } catch {
+  }
+}
+function readTail(count) {
+  const base = logFile();
+  const chunks = [];
+  for (const file of [`${base}.1`, base]) {
+    try {
+      chunks.push(fs2.readFileSync(file, "utf8"));
+    } catch {
+    }
+  }
+  const lines = chunks.join("").split("\n").filter((l) => l.length > 0);
+  return lines.slice(-count);
+}
+function followLog(onLine, intervalMs = 500) {
+  const file = logFile();
+  let position = 0;
+  try {
+    position = fs2.statSync(file).size;
+  } catch {
+    position = 0;
+  }
+  const tick = () => {
+    let size;
+    try {
+      size = fs2.statSync(file).size;
+    } catch {
+      return;
+    }
+    if (size < position) position = 0;
+    if (size === position) return;
+    try {
+      const fd = fs2.openSync(file, "r");
+      const buffer = Buffer.alloc(size - position);
+      fs2.readSync(fd, buffer, 0, buffer.length, position);
+      fs2.closeSync(fd);
+      position = size;
+      for (const line of buffer.toString("utf8").split("\n")) {
+        if (line.length > 0) onLine(line);
+      }
+    } catch {
+    }
+  };
+  const timer = setInterval(tick, intervalMs);
+  return () => clearInterval(timer);
+}
+
+// src/notify.ts
+import { spawn } from "node:child_process";
+var TITLE_VAR = "CREW_NOTIFY_TITLE";
+var BODY_VAR = "CREW_NOTIFY_BODY";
+var MACOS_SCRIPT = `display notification (system attribute "${BODY_VAR}") with title (system attribute "${TITLE_VAR}")`;
+var WINDOWS_SCRIPT = [
+  "Add-Type -AssemblyName System.Windows.Forms;",
+  "$n = New-Object System.Windows.Forms.NotifyIcon;",
+  "$n.Icon = [System.Drawing.SystemIcons]::Information;",
+  "$n.Visible = $true;",
+  `$n.ShowBalloonTip(5000, $env:${TITLE_VAR}, $env:${BODY_VAR}, 'Info');`,
+  "Start-Sleep -Seconds 6;",
+  "$n.Dispose()"
+].join(" ");
+function enabled() {
+  if (process.env.CREW_NO_NOTIFY === "1") return false;
+  return loadConfig()?.notifications !== false;
+}
+function notify(title, body) {
+  if (!enabled()) return;
+  const env = { ...process.env, [TITLE_VAR]: title, [BODY_VAR]: body };
+  let command;
+  let args;
+  if (process.platform === "darwin") {
+    command = "osascript";
+    args = ["-e", MACOS_SCRIPT];
+  } else if (process.platform === "linux") {
+    command = "notify-send";
+    args = ["--app-name=lumi-runner", title, body];
+  } else if (process.platform === "win32") {
+    command = "powershell";
+    args = ["-NoProfile", "-NonInteractive", "-Command", WINDOWS_SCRIPT];
+  } else {
+    return;
+  }
+  try {
+    const child = spawn(command, args, { env, stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+
+// src/power.ts
+import { spawn as spawn2 } from "node:child_process";
+var NOOP = { release: () => {
+} };
+function hold(command, args) {
+  let child;
+  try {
+    child = spawn2(command, args, { stdio: "ignore", detached: false });
+  } catch {
+    return NOOP;
+  }
+  child.on("error", () => {
+  });
+  let released = false;
+  return {
+    release() {
+      if (released) return;
+      released = true;
+      try {
+        child?.kill("SIGTERM");
+      } catch {
+      }
+    }
+  };
+}
+var WINDOWS_SCRIPT2 = [
+  `Add-Type -Name Power -Namespace Win32 -MemberDefinition '[DllImport("kernel32.dll", SetLastError = true)] public static extern uint SetThreadExecutionState(uint esFlags);';`,
+  // ES_CONTINUOUS (0x80000000) | ES_SYSTEM_REQUIRED (0x00000001)
+  "[Win32.Power]::SetThreadExecutionState(0x80000001) | Out-Null;",
+  "Start-Sleep -Seconds 86400"
+].join(" ");
+function inhibitSleep(reason) {
+  if (process.env.CREW_NO_POWER === "1") return NOOP;
+  if (process.platform === "darwin") {
+    return hold("caffeinate", ["-i", "-w", String(process.pid)]);
+  }
+  if (process.platform === "linux") {
+    return hold("systemd-inhibit", [
+      "--what=idle:sleep",
+      `--why=${reason}`,
+      "--mode=block",
+      "--who=lumi-runner",
+      "sleep",
+      "infinity"
+    ]);
+  }
+  if (process.platform === "win32") {
+    return hold("powershell", ["-NoProfile", "-NonInteractive", "-Command", WINDOWS_SCRIPT2]);
+  }
+  return NOOP;
+}
+
+// src/jobs/contextPack.ts
+import {
+  collection,
+  doc,
+  getDoc,
+  getDocs,
+  limit,
+  orderBy,
+  query,
+  where
+} from "firebase/firestore";
+var MAX_ACTIVITY_IN_PROMPT = 40;
+var MAX_PREVIOUS_JOBS_READ = 5;
+async function loadJobContext(db, shipId, job) {
+  const shipRef = doc(db, COLLECTIONS.ships, shipId);
+  const taskRef = doc(shipRef, COLLECTIONS.tasks, job.taskId);
+  const [shipSnap, agentSnap, taskSnap, activitySnap, jobsSnap, indexSnap] = await Promise.all([
+    getDoc(shipRef),
+    getDoc(doc(shipRef, COLLECTIONS.agents, job.agentId)),
+    getDoc(taskRef),
+    // DESC + reverse, not ASC + limit: a limit takes the FIRST rows the order produces, so an
+    // ascending query with a limit would hand the agent the OLDEST 40 events and hide everything
+    // that has happened since — the exact opposite of what continuity needs. The extra row is
+    // how truncation is detected without a second count query.
+    getDocs(
+      query(
+        collection(taskRef, COLLECTIONS.activity),
+        orderBy("createdAt", "desc"),
+        limit(MAX_ACTIVITY_IN_PROMPT + 1)
+      )
+    ),
+    // The extra row here is for a different reason: this job itself is usually the newest match
+    // and is filtered out below, so without it a full window yields one report short.
+    getDocs(
+      query(
+        collection(shipRef, COLLECTIONS.jobs),
+        where("taskId", "==", job.taskId),
+        orderBy("createdAt", "desc"),
+        limit(MAX_PREVIOUS_JOBS_READ + 1)
+      )
+    ),
+    // The knowledge CATALOG — one document, so this is +1 read regardless of how much the Ship
+    // knows, and it rides the existing Promise.all so it costs no extra latency either. The
+    // agent's memory is free: it is a field on the agent doc already being fetched above.
+    //
+    // ENRICHMENT, not identity, exactly like the playbook read below: a Ship whose catalog is
+    // missing, unreadable or not yet deployed still has a perfectly valid session. Caught rather
+    // than thrown, and deliberately NOT placed where a rejection would propagate.
+    getDoc(doc(shipRef, COLLECTIONS.indexes, INDEX_DOCS.knowledge)).catch(() => null)
+  ]);
+  if (!shipSnap.exists() || !agentSnap.exists() || !taskSnap.exists()) {
+    throw new Error("Job context incomplete: ship, agent or task missing.");
+  }
+  const task = { id: taskSnap.id, ...taskSnap.data() };
+  let parentTask = null;
+  if (task.parentTaskId) {
+    const parentSnap = await getDoc(doc(shipRef, COLLECTIONS.tasks, task.parentTaskId));
+    if (parentSnap.exists()) {
+      parentTask = { id: parentSnap.id, ...parentSnap.data() };
+    }
+  }
+  let workflow = null;
+  if (!isWorkflowSentinel(job.workflowId)) {
+    try {
+      const wfSnap = await getDoc(
+        doc(shipRef, COLLECTIONS.agents, job.agentId, COLLECTIONS.workflows, job.workflowId)
+      );
+      workflow = usableWorkflow(
+        wfSnap.exists() ? { id: wfSnap.id, ...wfSnap.data() } : null
+      );
+    } catch {
+      workflow = null;
+    }
+  }
+  const activityDocs = activitySnap.docs.slice(0, MAX_ACTIVITY_IN_PROMPT);
+  const agent = { id: agentSnap.id, ...agentSnap.data() };
+  return {
+    ship: { id: shipSnap.id, ...shipSnap.data() },
+    agent,
+    task,
+    parentTask,
+    workflow,
+    memory: readMemory(agent.memory),
+    knowledgeIndex: indexSnap?.exists() ? indexSnap.data() : null,
+    activity: activityDocs.map((d) => ({ id: d.id, ...d.data() })).reverse(),
+    // read newest-first, rendered chronologically
+    activityTruncated: activitySnap.docs.length > MAX_ACTIVITY_IN_PROMPT,
+    previousReports: jobsSnap.docs.filter((d) => d.id !== job.id).slice(0, MAX_PREVIOUS_JOBS_READ).map((d) => d.data().report).filter((r) => !!r).reverse()
+    // chronological
+  };
+}
+function standingRules(ship2, statuses, task, agent) {
+  const review = firstStatusIn(statuses, "review");
+  const done = firstStatusIn(statuses, "done");
+  const finishRule = "Communicate in the task activity (task_comment). When finished, post a summary comment and set the task status honestly with task_update_status" + (review && done ? `: \`${review.id}\` if a human must check your work, \`${done.id}\` only if nothing is pending.` : done ? ` (\`${done.id}\` only if nothing is pending).` : ".");
+  const depth = task.chainDepth ?? 0;
+  const maxDepth = ship2.settings?.maxChainDepth ?? DEFAULT_SHIP_SETTINGS.maxChainDepth;
+  const delegationRule = depth >= maxDepth ? `Do NOT delegate: this task is at chain depth ${depth}, this Ship's maximum \u2014 task_create would refuse a child. Do the work yourself, or hand the task back to a human with task_assign.` : `You may delegate: create a task with task_create and give it to another agent (or a human) with task_assign. Depth is tracked for you \u2014 this task is at depth ${depth} of a maximum ${maxDepth}, and each chain has a capped number of runs.`;
+  const routingRule = "When you learn something, ask these in order. (1) Would anyone but YOU need this? If yes, knowledge_write \u2014 a slug, a title and a one-line summary; that summary is all any other agent sees until they open it. (2) Will it still be true next month? If not, it belongs in a task_comment, not a store. (3) Is it about how this Ship works, or about this one task? Ship \u2192 knowledge. Task \u2192 a comment. (4) Is it useful only to you \u2014 a preference, a gotcha in your own workflow? Then memory_write. When in doubt, Ship knowledge: a note only you can read helps nobody else.";
+  return [
+    `You are crew on Ship "${ship2.name}". Work only on the task given below.`,
+    "Stay inside your contract. If the task is outside your responsibility range, do not do it: comment why via task_comment and set the task status back with task_update_status.",
+    // A BOUNDARY rule, so it sits with the delegation one rather than near the finishing
+    // instructions — and before them, because a level-1 agent must not read "set the status to
+    // done" as permission it does not have.
+    autonomyRule(agent),
+    delegationRule,
+    routingRule,
+    finishRule,
+    // Amended with the pointer clause, which is the only thing keeping the three tiers from
+    // duplicating each other: without it a diligent agent writes the same fact into its report,
+    // its notebook and the org brain, and the report grows into a transcript of the other two.
+    "End every session by calling run_report: what you did, what remains, what the next run must know. Do not repeat what you already put in your memory or in Ship knowledge \u2014 point at it instead (the entry id, or the slug)."
+  ].join("\n- ");
+}
+function formatTaskDate(millis, now = Date.now()) {
+  const d = new Date(millis);
+  const pad = (n) => String(n).padStart(2, "0");
+  const day = `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
+  const midnight = (t) => new Date(t.getFullYear(), t.getMonth(), t.getDate()).getTime();
+  const days = Math.round((midnight(d) - midnight(new Date(now))) / 864e5);
+  const distance = days === 0 ? "today" : days === 1 ? "tomorrow" : days === -1 ? "yesterday" : days > 0 ? `in ${days} days` : `${-days} days ago`;
+  return `${day} (${distance})`;
+}
+function statusVocabulary(statuses) {
+  const lines = statuses.map(
+    (s) => `- \`${s.id}\` \u2014 ${s.label}: ${TASK_STATUS_CATEGORY_META[s.category].meaning}`
+  );
+  return `# Task statuses on this board
+
+Use these ids with task_update_status:
+
+${lines.join("\n")}`;
+}
+function buildPrompt(ctx, reason) {
+  const parts = [];
+  const statuses = shipTaskStatuses(ctx.ship);
+  const playbook = usableWorkflow(ctx.workflow);
+  if (reason === "activity") {
+    parts.push(
+      "# Why this session started\n\nSomeone posted on your task after your last run. Read the newest activity below" + (playbook ? ", then follow your playbook below." : ", respond via task_comment, do any follow-up work it asks for, and set the task status honestly if it needs to change.")
+    );
+  } else if (reason === "watch") {
+    parts.push(
+      "# Why this session started\n\nOne of your playbooks watches the board, and this task matched it. Nobody assigned it to you and nobody else is working it right now \u2014 you are picking it up.\n\n**Leave it in a status that says what happened.** The board is how the watch decides what still needs attention, so a task you leave in the same status will come back to you on the next scan" + (playbook ? ", which your playbook below is written for." : ".")
+    );
+  } else if (reason === "resume_after_approval") {
+    parts.push(
+      "# Why this session started\n\nYou asked a captain for permission and stopped. They have now answered \u2014 their decision is the newest entry in the task activity below. Read it first.\n\n**If they approved it, do that thing now** \u2014 the permission is granted for this task and may be single-use, so do not ask again for the same thing. **If they refused, do not retry and do not look for a way around it**: say what you will do instead, or hand the task back with task_assign."
+    );
+  } else if (reason === "schedule") {
+    parts.push(
+      "# Why this session started\n\nThis is a scheduled run: one of your own playbooks created this task on its cron and assigned it to you. It is routine work, not a request from a person, so nobody is waiting on a reply" + (playbook ? " \u2014 the playbook below is the work, and the task's description is only a record of why it exists." : ".")
+    );
+  }
+  parts.push(`# Who you are
+
+${ctx.agent.persona || `You are ${ctx.agent.name}.`}`);
+  if (ctx.agent.contract.trim()) {
+    parts.push(`# Your contract
+
+${ctx.agent.contract}`);
+  }
+  parts.push(memoryBlock(ctx.memory));
+  parts.push(knowledgeCatalogBlock(ctx.knowledgeIndex, ctx.task.labels ?? []));
+  parts.push(`# Standing rules
+
+- ${standingRules(ctx.ship, statuses, ctx.task, ctx.agent)}`);
+  parts.push(statusVocabulary(statuses));
+  if (playbook) {
+    parts.push(
+      `# Your playbook: ${playbook.name}
+
+This is the playbook for this kind of work \u2014 follow it. Your contract and the standing rules above still bind you: where they conflict with the playbook, they win.
+
+${playbook.instructions}`
+    );
+  }
+  const t = ctx.task;
+  const now = Date.now();
+  const statusLabel = statusById(statuses, t.status)?.label ?? t.status;
+  const dates = (typeof t.dueDate === "number" && t.dueDate ? `
+
+Deadline: ${formatTaskDate(t.dueDate, now)} \u2014 the work must be FINISHED by this date. It does not affect when you start.` : "") + (typeof t.startAt === "number" && t.startAt > now ? `
+
+Scheduled start: ${formatTaskDate(t.startAt, now)} \u2014 this run was started before that date.` : "");
+  parts.push(
+    `# The task (id: ${t.id})
+
+## ${t.title}
+
+${t.description || "(no description)"}
+
+Labels: ${t.labels.join(", ") || "none"} \xB7 Status: ${statusLabel} (\`${t.status}\`)` + dates
+  );
+  if (ctx.parentTask) {
+    const p = ctx.parentTask;
+    const parentStatus = statusById(statuses, p.status)?.label ?? p.status;
+    parts.push(
+      `# Delegated from (id: ${p.id})
+
+## ${p.title}
+
+Status: ${parentStatus}
+
+${p.description || "(no description)"}`
+    );
+  }
+  if (ctx.activity.length > 0) {
+    const feed = ctx.activity.map((e) => `- [${e.kind}] ${e.author.type}:${e.author.id} \u2014 ${e.content}`).join("\n");
+    const note2 = ctx.activityTruncated ? `Only the newest ${MAX_ACTIVITY_IN_PROMPT} events are shown. Earlier ones \u2014 including how this task started \u2014 are not here: call task_get for the full feed if you need them.
+
+` : "";
+    parts.push(`# Task activity so far
+
+${note2}${feed}`);
+  }
+  if (ctx.previousReports.length > 0) {
+    const reports = ctx.previousReports.map((r, i) => `## Run ${i + 1}
+
+${r}`).join("\n\n");
+    parts.push(`# Reports from previous runs on this task
+
+${reports}`);
+  }
+  if (ctx.agent.tools.github.enabled && ctx.agent.tools.github.repos.length > 0) {
+    parts.push(
+      `# GitHub
+
+gh + git are authenticated for these repositories via a short-lived GitHub App token (expires in ~1 h): ${ctx.agent.tools.github.repos.join(", ")}`
+    );
+  }
+  return parts.join("\n\n");
+}
+
+// src/jobs/chatContext.ts
+import {
+  collection as collection2,
+  doc as doc2,
+  getCountFromServer,
+  getDoc as getDoc2,
+  getDocs as getDocs2,
+  limit as limit2,
+  orderBy as orderBy2,
+  query as query2,
+  where as where2
+} from "firebase/firestore";
+var MAX_CHAT_REPORTS = 5;
+var actorKey = (a) => `${a.type}:${a.id}`;
+async function loadChatContext(db, shipId, job) {
+  const shipRef = doc2(db, COLLECTIONS.ships, shipId);
+  const chatRef = doc2(shipRef, COLLECTIONS.chats, job.chatId);
+  const messagesCol = collection2(chatRef, COLLECTIONS.chatMessages);
+  const [shipSnap, agentSnap, chatSnap, messagesSnap, countSnap, membersSnap, agentsSnap, indexSnap] = await Promise.all([
+    getDoc2(shipRef),
+    getDoc2(doc2(shipRef, COLLECTIONS.agents, job.agentId)),
+    getDoc2(chatRef),
+    getDocs2(query2(messagesCol, orderBy2("createdAt", "desc"), limit2(MAX_CHAT_MESSAGES_IN_PROMPT + 1))),
+    // Aggregates bill per index entries scanned, not per document, so this stays ~1 read at
+    // any thread length. Caught rather than thrown: a session that cannot count is still a
+    // perfectly good session, it just cannot quote a total.
+    getCountFromServer(messagesCol).catch(() => null),
+    getDocs2(collection2(shipRef, COLLECTIONS.members)),
+    getDocs2(collection2(shipRef, COLLECTIONS.agents)),
+    // ENRICHMENT, not identity — same posture as the task pack: a Ship whose catalog is
+    // missing or unreadable still has a valid session.
+    getDoc2(doc2(shipRef, COLLECTIONS.indexes, INDEX_DOCS.knowledge)).catch(() => null)
+  ]);
+  if (!shipSnap.exists() || !agentSnap.exists() || !chatSnap.exists()) {
+    throw new Error("Chat job context incomplete: ship, agent or chat missing.");
+  }
+  const agent = { id: agentSnap.id, ...agentSnap.data() };
+  const chat = { id: chatSnap.id, ...chatSnap.data() };
+  const names = {};
+  for (const d of membersSnap.docs) {
+    const m = d.data();
+    names[`human:${d.id}`] = m.displayName || m.email || d.id;
+  }
+  for (const d of agentsSnap.docs) {
+    names[`agent:${d.id}`] = d.data().name || d.id;
+  }
+  const messageDocs = messagesSnap.docs.slice(0, MAX_CHAT_MESSAGES_IN_PROMPT);
+  const messagesTruncated = messagesSnap.docs.length > MAX_CHAT_MESSAGES_IN_PROMPT;
+  let previousReports = [];
+  if (messagesTruncated) {
+    try {
+      const jobsSnap = await getDocs2(
+        query2(
+          collection2(shipRef, COLLECTIONS.jobs),
+          where2("chatId", "==", job.chatId),
+          orderBy2("createdAt", "desc"),
+          limit2(MAX_CHAT_REPORTS + 1)
+        )
+      );
+      previousReports = jobsSnap.docs.filter((d) => d.id !== job.id).slice(0, MAX_CHAT_REPORTS).map((d) => d.data().report).filter((r) => !!r).reverse();
+    } catch {
+      previousReports = [];
+    }
+  }
+  return {
+    ship: { id: shipSnap.id, ...shipSnap.data() },
+    agent,
+    chat,
+    messages: messageDocs.map((d) => ({ id: d.id, ...d.data() })).reverse(),
+    // read newest-first, rendered chronologically
+    messagesTruncated,
+    totalMessages: countSnap?.data().count ?? messageDocs.length,
+    names,
+    previousReports,
+    memory: readMemory(agent.memory),
+    knowledgeIndex: indexSnap?.exists() ? indexSnap.data() : null
+  };
+}
+function chatStandingRules(ship2, agent) {
+  const approvalRule = "If something needs permission you do not have, do NOT ask for approval here \u2014 a chat has nothing to approve against. Create a task with task_create describing what you want to do, then say so in the chat; a captain can approve it there.";
+  const replyRule = "Answer in the chat with chat_send. That is how the person hears from you \u2014 nothing else you do in this session is visible to them.";
+  const turnRule = "Only a message from a PERSON starts a session like this one. Your own reply does not wake you again, so finish your thought in one reply rather than promising to continue.";
+  const scopeRule = "If this turns into real work, make it a task with task_create and say in the chat that you did, naming it. Do not run multi-step work here: a chat has no status, no tracking and no report anyone will read.";
+  const registerRule = "Match the register of the conversation. A question deserves an answer, not a status report.";
+  const routingRule = "When you learn something, ask these in order. (1) Would anyone but YOU need this? If yes, knowledge_write \u2014 a slug, a title and a one-line summary; that summary is all any other agent sees until they open it. (2) Will it still be true next month? If not, leave it in the conversation. (3) Is it about how this Ship works, or about this one exchange? Ship \u2192 knowledge. Passing \u2192 nothing. (4) Is it useful only to you \u2014 a preference, a gotcha in your own workflow? Then memory_write. When in doubt, Ship knowledge: a note only you can read helps nobody else.";
+  return [
+    `You are crew on Ship "${ship2.name}". You are in a conversation.`,
+    "Stay inside your contract. If you are asked for something outside your responsibility range, say so plainly and point at who or what should handle it.",
+    autonomyRule(agent),
+    approvalRule,
+    replyRule,
+    turnRule,
+    scopeRule,
+    registerRule,
+    routingRule,
+    "End the session by calling run_report: what was discussed and anything the next run must know. Do not repeat what you already put in your memory or in Ship knowledge \u2014 point at it instead."
+  ].join("\n- ");
+}
+function buildChatPrompt(ctx) {
+  const parts = [];
+  const name = (a) => ctx.names[actorKey(a)] ?? actorKey(a);
+  parts.push(
+    "# Why this session started\n\nSomeone wrote to you in a chat. **This is a conversation, not a task**: nobody has assigned you work, there is no board status to move, and nothing here is tracked. Read the thread below and reply with `chat_send`."
+  );
+  parts.push(`# Who you are
+
+${ctx.agent.persona || `You are ${ctx.agent.name}.`}`);
+  if (ctx.agent.contract.trim()) {
+    parts.push(`# Your contract
+
+${ctx.agent.contract}`);
+  }
+  parts.push(memoryBlock(ctx.memory));
+  parts.push(knowledgeCatalogBlock(ctx.knowledgeIndex, []));
+  parts.push(`# Standing rules
+
+- ${chatStandingRules(ctx.ship, ctx.agent)}`);
+  if (ctx.previousReports.length > 0) {
+    const reports = ctx.previousReports.map((r, i) => `## Earlier run ${i + 1}
+
+${r}`).join("\n\n");
+    parts.push(
+      `# Earlier in this chat
+
+The conversation is longer than the window below. These are your own notes from previous runs on this chat, oldest first.
+
+${reports}`
+    );
+  }
+  const title = ctx.chat.title?.trim();
+  const who = ctx.chat.participants.map((p) => `${name(p)} (${p.type})`).join(", ");
+  const thread = ctx.messages.map((m) => `- ${name(m.author)} (${m.author.type}): ${m.content}`).join("\n");
+  const note2 = ctx.messagesTruncated ? `Showing the last ${ctx.messages.length} of ${ctx.totalMessages} messages. For older ones, call \`chat_get\` with this chat id and a \`before\` timestamp \u2014 the oldest message shown below is the cursor to start from.
+
+` : "";
+  parts.push(
+    `# The conversation${title ? `: ${title}` : ""}
+
+Participants: ${who}
+
+${note2}${thread || "(no messages yet)"}`
+  );
+  if (ctx.agent.tools.github.enabled && ctx.agent.tools.github.repos.length > 0) {
+    parts.push(
+      `# GitHub
+
+gh + git are authenticated for these repositories via a short-lived GitHub App token (expires in ~1 h): ${ctx.agent.tools.github.repos.join(", ")}
+
+Note: a chat session has no task, so it is never granted write access \u2014 you can read and inspect, not push.`
+    );
+  }
+  return parts.join("\n\n");
+}
+
+// src/engines/claude.ts
+import { spawn as spawn3 } from "node:child_process";
+import fs3 from "node:fs";
+import os3 from "node:os";
+import path3 from "node:path";
+function normalizeClaudeUsage(resultEvent, model, fallbackDurationS) {
+  const result = resultEvent ?? {};
+  const u = result.usage ?? {};
+  const cacheRead = u.cache_read_input_tokens ?? 0;
+  const inputTokens = (u.input_tokens ?? 0) + cacheRead + (u.cache_creation_input_tokens ?? 0);
+  const outputTokens = u.output_tokens ?? 0;
+  const costReported = typeof result.total_cost_usd === "number";
+  const usage = {
+    engine: CLAUDE_DRIVER_ID,
+    inputTokens,
+    cachedInputTokens: cacheRead,
+    outputTokens,
+    costUsd: costReported ? result.total_cost_usd : estimateCostUsd(CLAUDE_DRIVER_ID, model, {
+      inputTokens,
+      cachedInputTokens: cacheRead,
+      outputTokens
+    }),
+    costReported,
+    durationS: result.duration_ms ? Math.round(result.duration_ms / 1e3) : fallbackDurationS,
+    raw: { ...u }
+  };
+  return { usage, result };
+}
+var LIMIT_RE = /usage limit (?:reached|exceeded|has been reached)/i;
+var LIMIT_RESET_RE = /\|\s*(\d{10})\b/;
+var MAX_LIMIT_MS = 7 * 24 * 60 * 60 * 1e3 + 60 * 60 * 1e3;
+function detectClaudeLimit(text, now, fallbackMs) {
+  if (!text || !LIMIT_RE.test(text)) return void 0;
+  const match = LIMIT_RESET_RE.exec(text);
+  const reported = match ? Number(match[1]) * 1e3 : NaN;
+  const sane = Number.isFinite(reported) && reported > now && reported <= now + MAX_LIMIT_MS;
+  return {
+    resetsAt: sane ? reported : now + fallbackMs,
+    resetsAtReported: sane,
+    detail: text.trim().slice(0, 300)
+  };
+}
+function allowedTools(agent) {
+  const granted = effectiveAgentTools(agent);
+  const tools = [];
+  if (granted.workspaceMcp) tools.push("mcp__workspace");
+  if (granted.bash) tools.push("Bash");
+  if (granted.github.enabled) tools.push("Bash");
+  if (granted.webSearch) tools.push("WebSearch", "WebFetch");
+  const draftsOnly = agent.autonomy <= 1;
+  tools.push("Read");
+  if (!draftsOnly) tools.push("Write", "Edit");
+  tools.push("Glob", "Grep");
+  return [...new Set(tools)];
+}
+function createSessionDirs(jobId) {
+  const workdir = fs3.mkdtempSync(path3.join(os3.tmpdir(), `crew-job-${jobId}-`));
+  const configDir2 = fs3.mkdtempSync(path3.join(os3.tmpdir(), `crew-cfg-${jobId}-`));
+  return { workdir, configDir: configDir2, mcpConfigPath: path3.join(configDir2, "mcp.json") };
+}
+function buildMcpConfig(input) {
+  return {
+    mcpServers: {
+      workspace: {
+        type: "http",
+        url: input.mcpUrl,
+        headers: {
+          Authorization: `Bearer ${input.idToken}`,
+          "X-Crew-Ship-Id": input.shipId,
+          // Agent and task are sent for the audit trail and for external-client parity, but on
+          // the runner path the server no longer TRUSTS them: it reads the acting agent and the
+          // session task from this job's own doc. `X-Crew-Job-Id` is what it keys on, so it is
+          // required there — dropping it now fails auth rather than silently ungating the call.
+          "X-Crew-Agent-Id": input.agent.id,
+          "X-Crew-Job-Id": input.job.id,
+          // Exactly one of these, spread conditionally: a chat job has no task and a task job no
+          // chat. An `undefined` value here would be serialized into the config as a header with
+          // no value, which is a different thing from an absent header.
+          ...input.job.taskId ? { "X-Crew-Task-Id": input.job.taskId } : {},
+          ...input.job.chatId ? { "X-Crew-Chat-Id": input.job.chatId } : {}
+        }
+      }
+    }
+  };
+}
+function writeMcpConfig(dirs, input) {
+  fs3.writeFileSync(dirs.mcpConfigPath, JSON.stringify(buildMcpConfig(input)), { mode: 384 });
+}
+function cleanupSessionDirs(dirs) {
+  fs3.rmSync(dirs.workdir, { recursive: true, force: true });
+  fs3.rmSync(dirs.configDir, { recursive: true, force: true });
+}
+async function runClaudeSession(input) {
+  const bin = process.env.CREW_CLAUDE_BIN || "claude";
+  if (input.signal?.aborted) {
+    return {
+      ok: false,
+      transcript: "",
+      usage: emptyUsage(),
+      resultText: "Session cancelled before it started (runner shutting down)."
+    };
+  }
+  const dirs = createSessionDirs(input.job.id);
+  try {
+    writeMcpConfig(dirs, input);
+    return await runSession(input, bin, dirs);
+  } finally {
+    cleanupSessionDirs(dirs);
+  }
+}
+async function runSession(input, bin, dirs) {
+  const args = [
+    "-p",
+    input.prompt,
+    "--output-format",
+    "stream-json",
+    "--verbose",
+    "--model",
+    input.agent.model,
+    "--mcp-config",
+    dirs.mcpConfigPath,
+    "--strict-mcp-config",
+    "--allowedTools",
+    allowedTools(input.agent).join(",")
+  ];
+  const claudeToken = input.secrets?.claudeToken;
+  const env = {
+    ...process.env,
+    ...claudeToken ? { CLAUDE_CODE_OAUTH_TOKEN: claudeToken } : {},
+    ...input.githubToken ? {
+      GH_TOKEN: input.githubToken,
+      GITHUB_TOKEN: input.githubToken,
+      // Per-process git auth so bare `git clone https://github.com/o/r` works WITHOUT
+      // touching the machine's ~/.gitconfig. A GitHub App installation token authenticates
+      // as `x-access-token:<token>`; a classic PAT works the same way here.
+      GIT_CONFIG_COUNT: "1",
+      GIT_CONFIG_KEY_0: "url.https://x-access-token:" + input.githubToken + "@github.com/.insteadOf",
+      GIT_CONFIG_VALUE_0: "https://github.com/"
+    } : {}
+  };
+  const startedAt = Date.now();
+  const lines = [];
+  const stderrLines = [];
+  let resultEvent = null;
+  const exitCode = await new Promise((resolve) => {
+    const child = spawn3(bin, args, { cwd: dirs.workdir, env, stdio: ["ignore", "pipe", "pipe"] });
+    const killTimer = setTimeout(() => {
+      input.log(`Session timeout after ${Math.round(input.timeoutMs / 6e4)} min \u2014 killing.`);
+      child.kill("SIGTERM");
+      setTimeout(() => child.kill("SIGKILL"), 1e4).unref();
+    }, input.timeoutMs);
+    const onAbort = () => {
+      input.log("Shutdown signalled \u2014 terminating the session.");
+      child.kill("SIGTERM");
+      setTimeout(() => child.kill("SIGKILL"), 3e3).unref();
+    };
+    input.signal?.addEventListener("abort", onAbort, { once: true });
+    const detachAbort = () => input.signal?.removeEventListener("abort", onAbort);
+    let buffer = "";
+    child.stdout.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      for (; ; ) {
+        const nl = buffer.indexOf("\n");
+        if (nl < 0) break;
+        const line = buffer.slice(0, nl).trim();
+        buffer = buffer.slice(nl + 1);
+        if (!line) continue;
+        lines.push(line);
+        try {
+          const event = JSON.parse(line);
+          if (event.type === "result") resultEvent = event;
+          if (event.type === "assistant") input.log("claude: assistant turn");
+        } catch {
+        }
+      }
+    });
+    child.stderr.on("data", (chunk) => {
+      const text = chunk.toString("utf8").trim();
+      if (text) {
+        lines.push(JSON.stringify({ type: "stderr", text }));
+        stderrLines.push(text);
+        input.log(`claude stderr: ${text.slice(0, 200)}`);
+      }
+    });
+    child.on("error", (e) => {
+      lines.push(JSON.stringify({ type: "stderr", text: `spawn error: ${e.message}` }));
+      clearTimeout(killTimer);
+      detachAbort();
+      resolve(127);
+    });
+    child.on("close", (code) => {
+      clearTimeout(killTimer);
+      detachAbort();
+      resolve(code ?? 1);
+    });
+  });
+  const durationS = Math.round((Date.now() - startedAt) / 1e3);
+  const { usage, result } = normalizeClaudeUsage(resultEvent, input.agent.model, durationS);
+  const ok2 = exitCode === 0 && !!resultEvent && !result.is_error;
+  const resultText = result.result ?? (ok2 ? "" : `Session ended with exit code ${exitCode}${resultEvent ? "" : " and no result event"}.`);
+  const limit3 = ok2 ? void 0 : detectClaudeLimit(
+    `${resultText}
+${stderrLines.slice(-20).join("\n")}`,
+    Date.now(),
+    engineUsageWindows(CLAUDE_DRIVER_ID)?.fallbackMs ?? 5 * 60 * 60 * 1e3
+  );
+  return {
+    ok: ok2,
+    transcript: `${lines.join("\n")}
+`,
+    usage,
+    resultText,
+    ...limit3 ? { limit: limit3 } : {}
+  };
+}
+var CLAUDE_DRIVER_ID = "claude";
+function emptyUsage() {
+  return {
+    engine: CLAUDE_DRIVER_ID,
+    inputTokens: 0,
+    cachedInputTokens: 0,
+    outputTokens: 0,
+    costUsd: 0,
+    costReported: false,
+    durationS: 0
+  };
+}
+async function claudeHealthCheck() {
+  const bin = process.env.CREW_CLAUDE_BIN || "claude";
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (health) => {
+      if (settled) return;
+      settled = true;
+      resolve(health);
+    };
+    let stdout = "";
+    const child = spawn3(bin, ["--version"], { stdio: ["ignore", "pipe", "ignore"] });
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      done({ ok: false, detail: `\`${bin} --version\` timed out`, fix: "Check the Claude CLI install." });
+    }, 1e4);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString("utf8");
+    });
+    child.on("error", () => {
+      clearTimeout(timer);
+      done({
+        ok: false,
+        detail: `\`${bin}\` not found on PATH`,
+        fix: "Install the Claude CLI (https://claude.com/claude-code), or set CREW_CLAUDE_BIN to its path."
+      });
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      const version = stdout.trim().split("\n")[0] || "(no version reported)";
+      done(
+        code === 0 ? { ok: true, detail: `${bin} \u2014 ${version}` } : {
+          ok: false,
+          detail: `\`${bin} --version\` exited ${code}`,
+          fix: "Reinstall or repair the Claude CLI."
+        }
+      );
+    });
+  });
+}
+var claudeDriver = {
+  engineId: CLAUDE_DRIVER_ID,
+  run: runClaudeSession,
+  healthCheck: claudeHealthCheck
+};
+
+// src/engines/index.ts
+var DRIVERS = {
+  claude: claudeDriver
+};
+function getDriver(engineId) {
+  return engineId && Object.hasOwn(DRIVERS, engineId) ? DRIVERS[engineId] : DRIVERS[DEFAULT_ENGINE_ID];
+}
+
+// src/jobs/githubToken.ts
+import {
+  doc as doc3,
+  getDoc as getDoc3
+} from "firebase/firestore";
+var TerminalJobError = class extends Error {
+};
+async function readIntegration(db, shipId) {
+  const snap = await getDoc3(
+    doc3(db, COLLECTIONS.ships, shipId, COLLECTIONS.integrations, INTEGRATION_DOCS.github)
+  );
+  return snap.exists() ? snap.data() : null;
+}
+async function resolveGithubToken(input) {
+  if (!input.agent.tools?.github?.enabled) return null;
+  const integration = await readIntegration(input.db, input.shipId);
+  if (integration?.status === "active") {
+    try {
+      const res = await callFunction(
+        functionsBaseUrl(input.config),
+        input.idToken,
+        "mintGithubJobToken",
+        { shipId: input.shipId, jobId: input.jobId }
+      );
+      return { token: res.token, source: "app" };
+    } catch (e) {
+      if (e instanceof CallableError && (e.status === "FAILED_PRECONDITION" || e.status === "PERMISSION_DENIED" || e.status === "NOT_FOUND")) {
+        throw new TerminalJobError(e.message);
+      }
+      throw e;
+    }
+  }
+  if (input.githubPat) return { token: input.githubPat, source: "pat" };
+  return null;
+}
+
+// src/jobs/secrets.ts
+import { doc as doc4, getDoc as getDoc4 } from "firebase/firestore";
+async function loadRunnerSecrets(db, shipId) {
+  const snap = await getDoc4(
+    doc4(db, COLLECTIONS.ships, shipId, COLLECTIONS.secrets, SECRET_DOCS.runner)
+  );
+  return snap.exists() ? snap.data() : null;
+}
+function missingSecretsFor(engineId, secrets) {
+  return getEngine(engineId).requiredSecrets.filter((req) => !secrets?.[req.key]).map((req) => req.label);
+}
+
+// src/jobs/engineLimits.ts
+import {
+  collection as collection3,
+  deleteDoc,
+  doc as doc5,
+  onSnapshot,
+  setDoc
+} from "firebase/firestore";
+var limitKey = (shipId, engineId) => `${shipId}/${engineId}`;
+function isLimited(limits, shipId, engineId, now) {
+  const entry = limits.get(limitKey(shipId, engineId));
+  return !!entry && entry.resetsAt > now;
+}
+function pruneExpired(limits, now) {
+  const cleared = [];
+  for (const [key, entry] of limits) {
+    if (entry.resetsAt <= now) {
+      cleared.push(entry);
+      limits.delete(key);
+    }
+  }
+  return cleared;
+}
+function nextResetAt(limits, now) {
+  let soonest = null;
+  for (const entry of limits.values()) {
+    if (entry.resetsAt > now && (soonest === null || entry.resetsAt < soonest)) {
+      soonest = entry.resetsAt;
+    }
+  }
+  return soonest;
+}
+function limitRef(db, shipId, engineId) {
+  return doc5(db, COLLECTIONS.ships, shipId, COLLECTIONS.engineLimits, engineId);
+}
+async function noteEngineLimit(db, shipId, engineId, limit3, runnerId) {
+  await setDoc(limitRef(db, shipId, engineId), {
+    engineId,
+    resetsAt: limit3.resetsAt,
+    detectedAt: Date.now(),
+    resetsAtReported: limit3.resetsAtReported,
+    detail: limit3.detail.slice(0, 500),
+    runnerId
+  });
+}
+async function clearEngineLimit(db, shipId, engineId) {
+  await deleteDoc(limitRef(db, shipId, engineId));
+}
+function subscribeEngineLimits(db, shipId, cb, onError) {
+  return onSnapshot(
+    collection3(db, COLLECTIONS.ships, shipId, COLLECTIONS.engineLimits),
+    (snap) => cb(snap.docs.map((d) => ({ id: d.id, ...d.data() }))),
+    (e) => onError?.(e)
+  );
+}
+
+// src/jobs/finish.ts
+import {
+  addDoc,
+  collection as collection4,
+  doc as doc6,
+  runTransaction,
+  updateDoc
+} from "firebase/firestore";
+import { ref as storageRef, uploadBytes } from "firebase/storage";
+function redactTranscript(transcript, knownSecrets) {
+  let out = transcript;
+  for (const secret of knownSecrets) {
+    if (secret && secret.length >= 8) out = out.split(secret).join("[REDACTED]");
+  }
+  out = out.replace(/sk-ant-[A-Za-z0-9_-]{8,}/g, "[REDACTED]");
+  out = out.replace(/gh[pousr]_[A-Za-z0-9]{20,}/g, "[REDACTED]");
+  out = out.replace(/github_pat_[A-Za-z0-9_]{20,}/g, "[REDACTED]");
+  out = out.replace(/ya29\.[A-Za-z0-9_-]{20,}/g, "[REDACTED]");
+  out = out.replace(/crewmcp_[A-Za-z0-9]+_[a-f0-9]{64}/g, "[REDACTED]");
+  return out;
+}
+async function uploadTranscript(storage, shipId, jobId, redacted) {
+  const path5 = `crew/${shipId}/transcripts/${jobId}.jsonl`;
+  await uploadBytes(storageRef(storage, path5), new TextEncoder().encode(redacted), {
+    contentType: "application/x-ndjson"
+  });
+  return path5;
+}
+function utcDay(millis) {
+  return new Date(millis).toISOString().slice(0, 10);
+}
+async function finalizeJob(db, shipId, job, input) {
+  const shipRef = doc6(db, COLLECTIONS.ships, shipId);
+  const jobRef = doc6(shipRef, COLLECTIONS.jobs, job.id);
+  const now = Date.now();
+  const usageRef = doc6(shipRef, COLLECTIONS.usageDaily, utcDay(now));
+  await runTransaction(db, async (tx) => {
+    const usageSnap = await tx.get(usageRef);
+    const totals = { ...EMPTY_USAGE_TOTALS, ...usageSnap.data()?.totals ?? {} };
+    const byAgent = usageSnap.data()?.byAgent ?? {};
+    const agentAgg = {
+      ...EMPTY_USAGE_BY_AGENT,
+      ...byAgent[job.agentId] ?? {}
+    };
+    const u = input.usage;
+    tx.update(jobRef, {
+      status: input.status,
+      endedAt: now,
+      usage: u,
+      transcriptPath: input.transcriptPath,
+      ...input.error ? { error: input.error.slice(0, 1500) } : {}
+    });
+    tx.set(usageRef, {
+      totals: {
+        inputTokens: totals.inputTokens + u.inputTokens,
+        cachedInputTokens: totals.cachedInputTokens + u.cachedInputTokens,
+        outputTokens: totals.outputTokens + u.outputTokens,
+        costUsd: totals.costUsd + u.costUsd,
+        jobs: totals.jobs + 1,
+        durationS: totals.durationS + u.durationS
+      },
+      byAgent: {
+        ...byAgent,
+        [job.agentId]: {
+          inputTokens: agentAgg.inputTokens + u.inputTokens,
+          cachedInputTokens: agentAgg.cachedInputTokens + u.cachedInputTokens,
+          outputTokens: agentAgg.outputTokens + u.outputTokens,
+          costUsd: agentAgg.costUsd + u.costUsd,
+          jobs: agentAgg.jobs + 1
+        }
+      }
+    });
+  });
+}
+async function requeueForRetry(db, shipId, job, error) {
+  await runTransaction(db, async (tx) => {
+    tx.update(doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
+      status: "queued",
+      attempt: job.attempt + 1,
+      error: error.slice(0, 1500)
+    });
+  });
+}
+async function releaseJob(db, shipId, job, reason) {
+  await updateDoc(doc6(db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id), {
+    status: "queued",
+    runnerId: "",
+    startedAt: 0,
+    error: reason.slice(0, 1500)
+  });
+}
+async function markTaskFailed(db, shipId, job, error, statuses) {
+  const shipRef = doc6(db, COLLECTIONS.ships, shipId);
+  const taskRef = doc6(shipRef, COLLECTIONS.tasks, job.taskId);
+  const now = Date.now();
+  const failedStatus = firstStatusIn(statuses, "failed")?.id ?? "failed";
+  await runTransaction(db, async (tx) => {
+    tx.update(taskRef, { status: failedStatus, updatedAt: now });
+    tx.set(doc6(collection4(taskRef, COLLECTIONS.activity)), {
+      author: { type: "agent", id: job.agentId },
+      createdAt: now,
+      kind: "comment",
+      content: `Job failed after ${job.attempt} attempts.
+
+Error tail:
+\`\`\`
+${error.slice(0, 800)}
+\`\`\``
+    });
+  });
+}
+async function markChatFailed(db, shipId, job, error) {
+  const shipRef = doc6(db, COLLECTIONS.ships, shipId);
+  const chatRef = doc6(shipRef, COLLECTIONS.chats, job.chatId);
+  const now = Date.now();
+  const content = `I could not finish replying \u2014 the run failed after ${job.attempt} attempt(s).
+
+\`\`\`
+${error.slice(0, 500)}
+\`\`\`
+
+Write again to start a fresh run.`;
+  await addDoc(collection4(chatRef, COLLECTIONS.chatMessages), {
+    author: { type: "agent", id: job.agentId },
+    content,
+    chars: content.length,
+    createdAt: now
+  });
+}
+
+// src/daemon.ts
+var HEARTBEAT_MS = 3e4;
+var JOB_TIMEOUT_MS = 20 * 60 * 1e3;
+var MAX_ATTEMPTS = 2;
+var SHUTDOWN_GRACE_MS = 1e4;
+async function startDaemon() {
+  const moved = migrateLegacyDir();
+  const config2 = requireConfig();
+  if (config2.ships.length === 0) {
+    console.error("No Ships assigned. Run: lumi-runner ship add <shipId>");
+    process.exit(1);
+  }
+  const fb = initFirebase(config2);
+  let user = await ensureSignedIn(fb);
+  console.log(`Signed in as ${user.uid}, runner ${config2.runnerId}, ships: ${config2.ships.join(", ")}`);
+  const logLines = [];
+  const log2 = (line) => {
+    const stamped = `${(/* @__PURE__ */ new Date()).toISOString()} ${line}`;
+    console.log(stamped);
+    appendLog(stamped);
+    logLines.push(stamped);
+    if (logLines.length > 20) logLines.shift();
+  };
+  if (moved?.migrated) log2(`Moved runner config from ${moved.from} to ${moved.to}.`);
+  const startedAt = Date.now();
+  let currentJob = null;
+  const secretsOk = /* @__PURE__ */ new Map();
+  const enrolled = /* @__PURE__ */ new Set();
+  const approved = /* @__PURE__ */ new Map();
+  const warnedUnapproved = /* @__PURE__ */ new Set();
+  const shipRunnerRef = (shipId) => doc7(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, config2.runnerId);
+  async function ensureEnrolled(shipId) {
+    if (enrolled.has(shipId)) return;
+    const snap = await getDoc5(shipRunnerRef(shipId));
+    if (!snap.exists()) {
+      await setDoc2(shipRunnerRef(shipId), {
+        ownerUserId: user.uid,
+        hostname: os4.hostname(),
+        version: RUNNER_VERSION,
+        status: "online",
+        lastSeenAt: Date.now(),
+        startedAt,
+        keyPresent: secretsOk.get(shipId) ?? false,
+        currentJob: null,
+        lastLogLines: [],
+        approved: false
+      });
+    }
+    enrolled.add(shipId);
+  }
+  let becameEligible = false;
+  let tokenStale = false;
+  let beating = false;
+  async function heartbeat() {
+    if (beating) return;
+    beating = true;
+    const now = Date.now();
+    try {
+      await setDoc2(
+        doc7(fb.db, COLLECTIONS.users, user.uid, COLLECTIONS.runners, config2.runnerId),
+        {
+          hostname: os4.hostname(),
+          version: RUNNER_VERSION,
+          status: "online",
+          lastSeenAt: now,
+          ships: config2.ships
+        }
+      );
+      for (const shipId of config2.ships) {
+        await ensureEnrolled(shipId);
+        await setDoc2(
+          shipRunnerRef(shipId),
+          {
+            hostname: os4.hostname(),
+            version: RUNNER_VERSION,
+            status: "online",
+            lastSeenAt: now,
+            startedAt,
+            keyPresent: secretsOk.get(shipId) ?? false,
+            currentJob: currentJob ?? null,
+            lastLogLines: [...logLines]
+          },
+          { merge: true }
+        );
+        const snap = await getDoc5(shipRunnerRef(shipId));
+        const isApproved = snap.data()?.approved === true;
+        const seen = approved.has(shipId);
+        const wasApproved = approved.get(shipId) === true;
+        approved.set(shipId, isApproved);
+        if (!isApproved && !warnedUnapproved.has(shipId)) {
+          warnedUnapproved.add(shipId);
+          log2(
+            `Ship ${shipId}: awaiting captain approval \u2014 this machine is enrolled but idle. Approve it on the Ship's Daemons page.`
+          );
+        }
+        if (isApproved && !wasApproved) {
+          warnedUnapproved.delete(shipId);
+          becameEligible = true;
+          if (seen) tokenStale = true;
+        }
+      }
+    } catch (e) {
+      console.error("heartbeat failed:", e instanceof Error ? e.message : e);
+    } finally {
+      beating = false;
+    }
+    if (tokenStale) {
+      tokenStale = false;
+      try {
+        user = await ensureSignedIn(fb);
+        log2("Approval granted \u2014 session refreshed, picking up queued work.");
+      } catch (e) {
+        console.error("re-mint after approval failed:", e instanceof Error ? e.message : e);
+      }
+    }
+    if (becameEligible) {
+      becameEligible = false;
+      poke();
+    }
+  }
+  const pending = /* @__PURE__ */ new Map();
+  const engineLimits = /* @__PURE__ */ new Map();
+  const agentEngines = /* @__PURE__ */ new Map();
+  const unsubs = [];
+  for (const shipId of config2.ships) {
+    const q = query3(
+      collection5(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs),
+      where3("status", "==", "queued"),
+      orderBy3("createdAt", "asc")
+    );
+    unsubs.push(
+      onSnapshot2(
+        q,
+        (snap) => {
+          for (const key of [...pending.keys()]) {
+            if (pending.get(key)?.shipId === shipId) pending.delete(key);
+          }
+          for (const d of snap.docs) {
+            pending.set(`${shipId}/${d.id}`, {
+              shipId,
+              job: { id: d.id, ...d.data() }
+            });
+          }
+          poke();
+        },
+        (e) => console.error(`jobs listener error (${shipId}):`, e.message)
+      )
+    );
+    unsubs.push(
+      onSnapshot2(
+        collection5(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents),
+        (snap) => {
+          for (const d of snap.docs) {
+            agentEngines.set(`${shipId}/${d.id}`, agentEngine(d.data()));
+          }
+          poke();
+        },
+        (e) => console.error(`agents listener error (${shipId}):`, e.message)
+      )
+    );
+    unsubs.push(
+      subscribeEngineLimits(
+        fb.db,
+        shipId,
+        (docs) => {
+          for (const key of [...engineLimits.keys()]) {
+            if (engineLimits.get(key)?.shipId === shipId) engineLimits.delete(key);
+          }
+          for (const d of docs) {
+            engineLimits.set(limitKey(shipId, d.engineId), {
+              shipId,
+              engineId: d.engineId,
+              resetsAt: d.resetsAt,
+              resetsAtReported: d.resetsAtReported,
+              detail: d.detail
+            });
+          }
+          sweepLimits();
+        },
+        (e) => console.error(`engine limits listener error (${shipId}):`, e.message)
+      )
+    );
+  }
+  const engineForJob = (shipId, job) => agentEngines.get(`${shipId}/${job.agentId}`) ?? DEFAULT_ENGINE_ID;
+  let working = false;
+  let pokeRequested = false;
+  let shuttingDown = false;
+  let sessionAbort = null;
+  let inFlight = null;
+  function poke() {
+    if (working || shuttingDown) {
+      pokeRequested = !shuttingDown;
+      return;
+    }
+    void workLoop();
+  }
+  let limitTimer = null;
+  function armLimitTimer() {
+    if (limitTimer) {
+      clearTimeout(limitTimer);
+      limitTimer = null;
+    }
+    const at = nextResetAt(engineLimits, Date.now());
+    if (at === null) return;
+    limitTimer = setTimeout(sweepLimits, Math.max(0, at - Date.now()) + 1e3);
+    limitTimer.unref();
+  }
+  function sweepLimits() {
+    limitTimer = null;
+    const cleared = pruneExpired(engineLimits, Date.now());
+    for (const entry of cleared) {
+      log2(
+        `${getEngine(entry.engineId).label} usage window on Ship ${entry.shipId} has reset \u2014 resuming.`
+      );
+      void clearEngineLimit(fb.db, entry.shipId, entry.engineId).catch(() => {
+      });
+    }
+    armLimitTimer();
+    if (cleared.length > 0) poke();
+  }
+  async function workLoop() {
+    working = true;
+    try {
+      for (; ; ) {
+        pokeRequested = false;
+        if (shuttingDown) break;
+        const now = Date.now();
+        const next = [...pending.values()].filter((p) => approved.get(p.shipId) === true).filter((p) => !isLimited(engineLimits, p.shipId, engineForJob(p.shipId, p.job), now)).sort((a, b) => a.job.createdAt - b.job.createdAt)[0];
+        if (!next) break;
+        pending.delete(`${next.shipId}/${next.job.id}`);
+        inFlight = processJob(next.shipId, next.job);
+        try {
+          await inFlight;
+        } finally {
+          inFlight = null;
+        }
+        if (!pokeRequested && pending.size === 0) break;
+      }
+    } finally {
+      working = false;
+      if (pokeRequested) poke();
+    }
+  }
+  async function claim(shipId, job) {
+    const jobRef = doc7(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.jobs, job.id);
+    try {
+      let claimed = null;
+      await runTransaction2(fb.db, async (tx) => {
+        const snap = await tx.get(jobRef);
+        if (!snap.exists() || snap.data().status !== "queued") {
+          claimed = null;
+          return;
+        }
+        const startedAt2 = Date.now();
+        tx.update(jobRef, { status: "running", runnerId: config2.runnerId, startedAt: startedAt2 });
+        claimed = { id: snap.id, ...snap.data(), status: "running", runnerId: config2.runnerId, startedAt: startedAt2 };
+      });
+      return claimed;
+    } catch (e) {
+      log2(`claim failed for ${job.id}: ${e instanceof Error ? e.message : e}`);
+      return null;
+    }
+  }
+  async function setAgentStatus(shipId, agentId, status) {
+    try {
+      await updateDoc2(doc7(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents, agentId), { status });
+    } catch (e) {
+      log2(`agent status update failed: ${e instanceof Error ? e.message : e}`);
+    }
+  }
+  async function loadSecrets(shipId) {
+    const secrets = await loadRunnerSecrets(fb.db, shipId);
+    secretsOk.set(shipId, missingSecretsFor(DEFAULT_ENGINE_ID, secrets).length === 0);
+    return secrets;
+  }
+  async function processJob(shipId, queuedJob) {
+    const job = await claim(shipId, queuedJob);
+    if (!job) return;
+    const target = jobTarget(job);
+    if (!target) {
+      log2(`Job ${job.id} names neither a task nor a chat (or both) \u2014 failing it.`);
+      await finalizeJob(fb.db, shipId, job, {
+        status: "failed",
+        usage: {
+          engine: DEFAULT_ENGINE_ID,
+          inputTokens: 0,
+          cachedInputTokens: 0,
+          outputTokens: 0,
+          costUsd: 0,
+          costReported: false,
+          durationS: 0
+        },
+        transcriptPath: "",
+        error: "Job names neither a task nor a chat, so there is nothing to run."
+      });
+      currentJob = null;
+      return;
+    }
+    const targetLabel = target.kind === "task" ? `task ${target.taskId}` : `chat ${target.chatId}`;
+    log2(`Claimed job ${job.id} (ship ${shipId}, ${targetLabel}, attempt ${job.attempt})`);
+    currentJob = {
+      jobId: job.id,
+      // Conditional spread: Firestore rejects an explicit undefined in the mirror write.
+      ...target.kind === "task" ? { taskId: target.taskId } : { chatId: target.chatId },
+      agentId: job.agentId,
+      workflowId: job.workflowId,
+      ...job.workflowName ? { workflowName: job.workflowName } : {},
+      startedAt: Date.now()
+    };
+    await setAgentStatus(shipId, job.agentId, "working");
+    void heartbeat();
+    const wake = config2.keepAwake === false ? null : inhibitSleep(`Crew job ${job.id}`);
+    sessionAbort = new AbortController();
+    notify(
+      "Crew job started",
+      target.kind === "task" ? `Agent is working on task ${target.taskId}.` : "Agent is replying in a chat."
+    );
+    let failure = null;
+    let terminal = false;
+    let sessionLimit = null;
+    let engineId = DEFAULT_ENGINE_ID;
+    let transcript = "";
+    let usage = {
+      engine: DEFAULT_ENGINE_ID,
+      inputTokens: 0,
+      cachedInputTokens: 0,
+      outputTokens: 0,
+      costUsd: 0,
+      costReported: false,
+      durationS: 0
+    };
+    let githubToken;
+    let statuses = DEFAULT_TASK_STATUSES;
+    try {
+      const secrets = await loadSecrets(shipId);
+      const packed = target.kind === "chat" ? { kind: "chat", ctx: await loadChatContext(fb.db, shipId, { ...job, chatId: target.chatId }) } : { kind: "task", ctx: await loadJobContext(fb.db, shipId, { ...job, taskId: target.taskId }) };
+      if (packed.kind === "task" && !isWorkflowSentinel(job.workflowId) && !packed.ctx.workflow) {
+        log2(
+          `Playbook ${job.workflowId} is missing, disabled or empty \u2014 running a generic session.`
+        );
+      }
+      const { ship: ship2, agent } = packed.ctx;
+      engineId = agentEngine(agent);
+      usage = { ...usage, engine: engineId };
+      statuses = shipTaskStatuses(ship2);
+      const missing = missingSecretsFor(engineId, secrets);
+      if (missing.length > 0 && !process.env.CREW_CLAUDE_BIN) {
+        throw new Error(
+          `Runner credentials are not configured for this Ship \u2014 a captain must save the following in Ship Settings: ${missing.join(", ")}.`
+        );
+      }
+      const prompt = packed.kind === "chat" ? buildChatPrompt(packed.ctx) : buildPrompt(packed.ctx, job.reason);
+      const idToken = await user.getIdToken();
+      try {
+        const gh = await resolveGithubToken({
+          db: fb.db,
+          config: config2,
+          idToken,
+          shipId,
+          jobId: job.id,
+          agent,
+          githubPat: secrets?.githubPat
+        });
+        githubToken = gh?.token;
+        if (gh) log2(`GitHub credential resolved for job ${job.id} (${gh.source}).`);
+      } catch (e) {
+        if (e instanceof TerminalJobError) {
+          terminal = true;
+          throw new Error(`GitHub access unavailable: ${e.message}`);
+        }
+        throw e;
+      }
+      if (sessionAbort.signal.aborted) throw new Error("Shutting down before the session started.");
+      const session = await getDriver(engineId).run({
+        prompt,
+        agent,
+        job,
+        shipId,
+        mcpUrl: mcpUrl(config2),
+        idToken,
+        secrets,
+        githubToken,
+        timeoutMs: JOB_TIMEOUT_MS,
+        signal: sessionAbort.signal,
+        log: log2
+      });
+      transcript = redactTranscript(session.transcript, [
+        idToken,
+        secrets?.claudeToken,
+        githubToken,
+        secrets?.githubPat
+      ]);
+      usage = session.usage;
+      if (session.limit && getEngine(engineId).usageWindows) {
+        sessionLimit = session.limit;
+        engineLimits.set(limitKey(shipId, engineId), {
+          shipId,
+          engineId,
+          resetsAt: session.limit.resetsAt,
+          resetsAtReported: session.limit.resetsAtReported,
+          detail: session.limit.detail
+        });
+        armLimitTimer();
+      }
+      if (!session.ok) failure = session.resultText || "Session failed.";
+    } catch (e) {
+      failure = e instanceof Error ? e.message : String(e);
+    }
+    wake?.release();
+    sessionAbort = null;
+    try {
+      if (shuttingDown) {
+        await releaseJob(
+          fb.db,
+          shipId,
+          job,
+          "Runner shut down mid-job \u2014 released back to the queue without consuming a retry."
+        );
+        log2(`Job ${job.id} released back to the queue (attempt ${job.attempt} preserved).`);
+      } else if (sessionLimit) {
+        const engineLabel = getEngine(engineId).label;
+        const resetsAt = new Date(sessionLimit.resetsAt).toISOString();
+        await noteEngineLimit(fb.db, shipId, engineId, sessionLimit, config2.runnerId);
+        await releaseJob(
+          fb.db,
+          shipId,
+          job,
+          `${engineLabel} usage limit reached \u2014 released without consuming a retry; resumes ${resetsAt}.`
+        );
+        log2(
+          `Job ${job.id} released: ${engineId} usage limit on Ship ${shipId} until ${resetsAt}${sessionLimit.resetsAtReported ? "" : " (estimated \u2014 the engine named no reset time)"}. Attempt ${job.attempt} preserved; claims paused for this Ship+engine.`
+        );
+        notify(
+          "Crew paused",
+          `${engineLabel} usage limit reached \u2014 work resumes automatically.`
+        );
+      } else if (!failure) {
+        const transcriptPath = await uploadTranscript(fb.storage, shipId, job.id, transcript);
+        await finalizeJob(fb.db, shipId, job, { status: "done", usage, transcriptPath });
+        log2(`Job ${job.id} done (${usage.inputTokens}in/${usage.outputTokens}out tokens).`);
+        notify(
+          "Crew job finished",
+          target.kind === "task" ? `Task ${target.taskId} is done.` : "Agent replied in a chat."
+        );
+      } else if (!terminal && job.attempt < MAX_ATTEMPTS) {
+        log2(`Job ${job.id} failed (attempt ${job.attempt}) \u2014 re-queueing: ${failure.slice(0, 120)}`);
+        await requeueForRetry(fb.db, shipId, job, failure);
+      } else {
+        const transcriptPath = transcript ? await uploadTranscript(fb.storage, shipId, job.id, transcript) : "";
+        await finalizeJob(fb.db, shipId, job, { status: "failed", usage, transcriptPath, error: failure });
+        if (target.kind === "chat") {
+          await markChatFailed(fb.db, shipId, { ...job, chatId: target.chatId }, failure);
+        } else {
+          await markTaskFailed(fb.db, shipId, { ...job, taskId: target.taskId }, failure, statuses);
+        }
+        log2(`Job ${job.id} FAILED terminally: ${failure.slice(0, 120)}`);
+        notify("Crew job failed", `${targetLabel}: ${failure.slice(0, 120)}`);
+      }
+    } catch (e) {
+      log2(`finalize failed for ${job.id}: ${e instanceof Error ? e.message : e}`);
+    }
+    currentJob = null;
+    await setAgentStatus(shipId, job.agentId, "idle");
+    if (!shuttingDown) void heartbeat();
+  }
+  await Promise.all(config2.ships.map((shipId) => loadSecrets(shipId).catch(() => null)));
+  await heartbeat();
+  const heartbeatTimer = setInterval(() => {
+    void heartbeat();
+    sweepLimits();
+  }, HEARTBEAT_MS);
+  let stopping = false;
+  const shutdown = async (signal) => {
+    if (stopping) return;
+    stopping = true;
+    shuttingDown = true;
+    clearInterval(heartbeatTimer);
+    if (limitTimer) clearTimeout(limitTimer);
+    unsubs.forEach((u) => u());
+    if (sessionAbort) {
+      log2(`${signal} received with a job in flight \u2014 stopping the session and releasing it.`);
+      notify("Crew runner stopping", "A job was in progress; it has been returned to the queue.");
+      sessionAbort.abort();
+    } else {
+      log2(`${signal} received \u2014 shutting down.`);
+    }
+    if (inFlight) {
+      await Promise.race([
+        inFlight,
+        new Promise((resolve) => setTimeout(resolve, SHUTDOWN_GRACE_MS).unref())
+      ]);
+    }
+    const now = Date.now();
+    try {
+      await setDoc2(
+        doc7(fb.db, COLLECTIONS.users, user.uid, COLLECTIONS.runners, config2.runnerId),
+        { status: "offline", lastSeenAt: now },
+        { merge: true }
+      );
+      for (const shipId of config2.ships) {
+        await setDoc2(
+          doc7(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, config2.runnerId),
+          { ownerUserId: user.uid, status: "offline", lastSeenAt: now, currentJob: deleteField() },
+          { merge: true }
+        );
+      }
+    } catch {
+    }
+    process.exit(0);
+  };
+  process.on("SIGINT", () => void shutdown("SIGINT"));
+  process.on("SIGTERM", () => void shutdown("SIGTERM"));
+  log2(`Runner online \u2014 watching ${config2.ships.length} Ship(s), MCP: ${mcpUrl(config2)}`);
+  await new Promise(() => {
+  });
+}
+
+// src/cli/ui.ts
+import * as clack from "@clack/prompts";
+import { createColors } from "picocolors";
+var CliError = class extends Error {
+  constructor(message, exitCode = 1) {
+    super(message);
+    this.exitCode = exitCode;
+    this.name = "CliError";
+  }
+  exitCode;
+};
+var jsonMode = false;
+var assumeYes = false;
+var palette = createColors();
+var delegate = (name) => (input) => palette[name](input);
+var pc = {
+  bold: delegate("bold"),
+  dim: delegate("dim"),
+  black: delegate("black"),
+  red: delegate("red"),
+  green: delegate("green"),
+  yellow: delegate("yellow"),
+  cyan: delegate("cyan"),
+  bgCyan: delegate("bgCyan")
+};
+function configureOutput(options) {
+  jsonMode = options.json === true;
+  assumeYes = options.yes === true;
+  if (options.color === false || jsonMode) palette = createColors(false);
+}
+function isJson() {
+  return jsonMode;
+}
+function emitJson(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+}
+function canPrompt() {
+  return !jsonMode && process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+function requireInteractive(what, flagHint) {
+  if (canPrompt()) return;
+  throw new CliError(
+    `${what} needs an interactive terminal. Run it in a terminal, or pass ${pc.bold(flagHint)}.`
+  );
+}
+var say = {
+  intro(title) {
+    if (!jsonMode) clack.intro(pc.bgCyan(pc.black(` ${title} `)));
+  },
+  outro(message) {
+    if (!jsonMode) clack.outro(message);
+  },
+  info(message) {
+    if (!jsonMode) clack.log.info(message);
+  },
+  success(message) {
+    if (!jsonMode) clack.log.success(message);
+  },
+  warn(message) {
+    if (!jsonMode) clack.log.warn(message);
+  },
+  error(message) {
+    if (!jsonMode) clack.log.error(message);
+  },
+  step(message) {
+    if (!jsonMode) clack.log.step(message);
+  },
+  note(body, title) {
+    if (!jsonMode) clack.note(body, title);
+  },
+  /** Raw line straight to stdout — for `logs`, where the content IS the output. */
+  line(message) {
+    process.stdout.write(`${message}
+`);
+  }
+};
+function spinner2() {
+  if (jsonMode) {
+    return { start: () => {
+    }, update: () => {
+    }, stop: () => {
+    } };
+  }
+  if (!canPrompt()) {
+    return {
+      start: (msg) => process.stderr.write(`${msg}
+`),
+      update: (msg) => process.stderr.write(`${msg}
+`),
+      stop: (msg) => msg && process.stderr.write(`${msg}
+`)
+    };
+  }
+  const s = clack.spinner();
+  return {
+    start: (msg) => s.start(msg),
+    update: (msg) => s.message(msg),
+    stop: (msg) => s.stop(msg)
+  };
+}
+function unwrap(value) {
+  if (clack.isCancel(value)) throw new CliError("Cancelled.", 130);
+  return value;
+}
+async function promptMultiSelect(options) {
+  requireInteractive(options.message, options.flagHint);
+  return unwrap(
+    await clack.multiselect({
+      message: options.message,
+      options: options.choices,
+      initialValues: options.initialValues,
+      required: options.required ?? false
+    })
+  );
+}
+async function promptConfirm(options) {
+  if (assumeYes && options.yesFlagApplies !== false) return true;
+  requireInteractive(options.message, "--yes");
+  return unwrap(await clack.confirm({ message: options.message, initialValue: options.initialValue }));
+}
+function glyph(level) {
+  if (level === "ok") return pc.green("\u2714");
+  if (level === "warn") return pc.yellow("\u25B2");
+  return pc.red("\u2716");
+}
+
+// src/cli/commands/config.ts
+var TOGGLES = {
+  notifications: "Desktop notifications when a job starts, finishes or fails",
+  keepAwake: "Keep this machine awake while a job is running"
+};
+function isToggle(key) {
+  return Object.hasOwn(TOGGLES, key);
+}
+function parseBool(value) {
+  if (["on", "true", "yes", "1"].includes(value.toLowerCase())) return true;
+  if (["off", "false", "no", "0"].includes(value.toLowerCase())) return false;
+  throw new CliError(`Expected on/off, got "${value}".`);
+}
+async function runConfigList() {
+  const config2 = requireConfig();
+  const values = Object.fromEntries(
+    Object.keys(TOGGLES).map((key) => [key, config2[key] !== false])
+  );
+  if (isJson()) {
+    emitJson({ configDir: configDir(), ...values });
+    return 0;
+  }
+  say.line(`  ${configDir()}`);
+  say.line("");
+  for (const key of Object.keys(TOGGLES)) {
+    say.line(`  ${key.padEnd(16)} ${values[key] ? "on" : "off"}   ${TOGGLES[key]}`);
+  }
+  return 0;
+}
+async function runConfigSet(key, value) {
+  if (!isToggle(key)) {
+    throw new CliError(`Unknown setting "${key}". Known: ${Object.keys(TOGGLES).join(", ")}.`);
+  }
+  const config2 = requireConfig();
+  config2[key] = parseBool(value);
+  saveConfig(config2);
+  if (isJson()) {
+    emitJson({ [key]: config2[key] });
+    return 0;
+  }
+  say.success(`${key} = ${config2[key] ? "on" : "off"}`);
+  return 0;
+}
+
+// src/cli/commands/doctor.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { collection as collection6, doc as doc8, getDoc as getDoc6, getDocs as getDocs3 } from "firebase/firestore";
+
+// src/service.ts
+import { spawnSync } from "node:child_process";
+import fs4 from "node:fs";
+import os5 from "node:os";
+import path4 from "node:path";
+import { fileURLToPath } from "node:url";
+var SERVICE_LABEL = "com.lumi.runner";
+var LINUX_UNIT = "lumi-runner.service";
+var WINDOWS_TASK = "LumiRunner";
+var LEGACY_SERVICE_LABEL = "com.lumi.crew-runner";
+var LEGACY_LINUX_UNIT = "crew-runner.service";
+var LEGACY_WINDOWS_TASK = "CrewRunner";
+var ServiceError = class extends Error {
+};
+function run(command, args) {
+  const result = spawnSync(command, args, { encoding: "utf8" });
+  return {
+    ok: result.status === 0,
+    out: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim()
+  };
+}
+function cliPath() {
+  return fileURLToPath(import.meta.url);
+}
+function uid() {
+  return String(process.getuid?.() ?? 0);
+}
+function launchAgentPath() {
+  return path4.join(os5.homedir(), "Library/LaunchAgents", `${SERVICE_LABEL}.plist`);
+}
+function systemdUnitPath() {
+  return path4.join(os5.homedir(), ".config/systemd/user", LINUX_UNIT);
+}
+function legacyLaunchAgentPath() {
+  return path4.join(os5.homedir(), "Library/LaunchAgents", `${LEGACY_SERVICE_LABEL}.plist`);
+}
+function legacySystemdUnitPath() {
+  return path4.join(os5.homedir(), ".config/systemd/user", LEGACY_LINUX_UNIT);
+}
+function serviceEnv() {
+  const env = { PATH: process.env.PATH ?? "" };
+  if (process.env.LUMI_RUNNER_HOME || process.env.CREW_RUNNER_HOME) {
+    env.LUMI_RUNNER_HOME = configDir();
+  }
+  return env;
+}
+function removeLegacyService() {
+  const removed = [];
+  if (process.platform === "darwin") {
+    const unitPath = legacyLaunchAgentPath();
+    if (fs4.existsSync(unitPath)) {
+      run("launchctl", ["bootout", `gui/${uid()}/${LEGACY_SERVICE_LABEL}`]);
+      fs4.rmSync(unitPath, { force: true });
+      removed.push(unitPath);
+    }
+    return removed;
+  }
+  if (process.platform === "linux") {
+    const unitPath = legacySystemdUnitPath();
+    if (fs4.existsSync(unitPath)) {
+      run("systemctl", ["--user", "disable", "--now", LEGACY_LINUX_UNIT]);
+      fs4.rmSync(unitPath, { force: true });
+      run("systemctl", ["--user", "daemon-reload"]);
+      removed.push(unitPath);
+    }
+    return removed;
+  }
+  if (process.platform === "win32") {
+    if (run("schtasks", ["/Query", "/TN", LEGACY_WINDOWS_TASK]).ok) {
+      run("schtasks", ["/Delete", "/TN", LEGACY_WINDOWS_TASK, "/F"]);
+      removed.push(LEGACY_WINDOWS_TASK);
+    }
+    return removed;
+  }
+  return removed;
+}
+var BOOTSTRAP_RETRY_DELAYS_MS = [250, 500, 1e3, 2e3, 2e3];
+function isTransientBootstrapError(out) {
+  const text = out.toLowerCase();
+  return (
+    // The observed one: `Bootstrap failed: 5: Input/output error`.
+    text.includes("input/output error") || // Same cause, different report: the old generation is still registered.
+    text.includes("service already loaded") || text.includes("service is already loaded") || text.includes("eexist") || // launchd is mid-teardown and says so.
+    text.includes("operation already in progress") || text.includes("operation now in progress")
+  );
+}
+function retryWhileTransient(attempt, wait, delays = BOOTSTRAP_RETRY_DELAYS_MS) {
+  let result = attempt();
+  for (const delay of delays) {
+    if (result.ok || !isTransientBootstrapError(result.out)) return result;
+    wait(delay);
+    result = attempt();
+  }
+  return result;
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function plistXml() {
+  const env = serviceEnv();
+  const envEntries = Object.entries(env).map(([k, v]) => `      <key>${k}</key>
+      <string>${escapeXml(v)}</string>`).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${SERVICE_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${escapeXml(process.execPath)}</string>
+    <string>${escapeXml(cliPath())}</string>
+    <string>start</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>ExitTimeOut</key>
+  <integer>20</integer>
+  <key>EnvironmentVariables</key>
+  <dict>
+${envEntries}
+  </dict>
+  <key>StandardOutPath</key>
+  <string>${escapeXml(path4.join(logDir(), "service.out.log"))}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(path4.join(logDir(), "service.err.log"))}</string>
+</dict>
+</plist>
+`;
+}
+function escapeXml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function systemdUnit() {
+  const env = serviceEnv();
+  const envLines = Object.entries(env).map(([k, v]) => `Environment="${k}=${v}"`).join("\n");
+  return `[Unit]
+Description=Lumi Crew runner daemon
+After=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${process.execPath} ${cliPath()} start
+Restart=always
+RestartSec=5
+# Must exceed the daemon's SHUTDOWN_GRACE_MS: a SIGKILL mid-release is exactly the stranded
+# job the graceful shutdown exists to prevent.
+TimeoutStopSec=20
+${envLines}
+
+[Install]
+WantedBy=default.target
+`;
+}
+function serviceStatus() {
+  if (process.platform === "darwin") {
+    const unitPath = launchAgentPath();
+    if (!fs4.existsSync(unitPath)) return { state: "not-installed", detail: "No LaunchAgent installed." };
+    const printed = run("launchctl", ["print", `gui/${uid()}/${SERVICE_LABEL}`]);
+    if (!printed.ok) return { state: "installed", detail: "LaunchAgent present but not loaded.", unitPath };
+    const running = /\bpid = \d+/.test(printed.out);
+    return {
+      state: running ? "running" : "installed",
+      detail: running ? "LaunchAgent loaded and running." : "LaunchAgent loaded but not running.",
+      unitPath
+    };
+  }
+  if (process.platform === "linux") {
+    const unitPath = systemdUnitPath();
+    if (!fs4.existsSync(unitPath)) return { state: "not-installed", detail: "No systemd user unit installed." };
+    const active = run("systemctl", ["--user", "is-active", LINUX_UNIT]);
+    return {
+      state: active.out === "active" ? "running" : "installed",
+      detail: `systemd user unit is ${active.out || "unknown"}.`,
+      unitPath
+    };
+  }
+  if (process.platform === "win32") {
+    const query6 = run("schtasks", ["/Query", "/TN", WINDOWS_TASK]);
+    if (!query6.ok) return { state: "not-installed", detail: "No scheduled task installed." };
+    return {
+      state: /\bRunning\b/i.test(query6.out) ? "running" : "installed",
+      detail: "Scheduled task installed (runs at logon).",
+      unitPath: WINDOWS_TASK
+    };
+  }
+  return { state: "unsupported", detail: `No service integration for ${process.platform}.` };
+}
+function installService() {
+  const notes = [];
+  fs4.mkdirSync(logDir(), { recursive: true, mode: 448 });
+  for (const unit of removeLegacyService()) {
+    notes.push(`Removed the previous crew-runner service (${unit}).`);
+  }
+  if (process.platform === "darwin") {
+    const unitPath = launchAgentPath();
+    fs4.mkdirSync(path4.dirname(unitPath), { recursive: true });
+    fs4.writeFileSync(unitPath, plistXml());
+    run("launchctl", ["bootout", `gui/${uid()}/${SERVICE_LABEL}`]);
+    const boot = retryWhileTransient(
+      () => run("launchctl", ["bootstrap", `gui/${uid()}`, unitPath]),
+      sleepSync
+    );
+    if (!boot.ok) throw new ServiceError(`launchctl bootstrap failed: ${boot.out}`);
+    return { unitPath, notes };
+  }
+  if (process.platform === "linux") {
+    const unitPath = systemdUnitPath();
+    fs4.mkdirSync(path4.dirname(unitPath), { recursive: true });
+    fs4.writeFileSync(unitPath, systemdUnit());
+    const reload = run("systemctl", ["--user", "daemon-reload"]);
+    if (!reload.ok) throw new ServiceError(`systemctl daemon-reload failed: ${reload.out}`);
+    const enable = run("systemctl", ["--user", "enable", "--now", LINUX_UNIT]);
+    if (!enable.ok) throw new ServiceError(`systemctl enable failed: ${enable.out}`);
+    const linger = run("loginctl", ["show-user", os5.userInfo().username, "--property=Linger"]);
+    if (!linger.out.includes("Linger=yes")) {
+      notes.push(
+        `Run \`sudo loginctl enable-linger ${os5.userInfo().username}\` so the daemon survives logout and starts at boot.`
+      );
+    }
+    return { unitPath, notes };
+  }
+  if (process.platform === "win32") {
+    const command = `"${process.execPath}" "${cliPath()}" start`;
+    const create = run("schtasks", [
+      "/Create",
+      "/TN",
+      WINDOWS_TASK,
+      "/TR",
+      command,
+      "/SC",
+      "ONLOGON",
+      "/RL",
+      "LIMITED",
+      "/F"
+    ]);
+    if (!create.ok) throw new ServiceError(`schtasks /Create failed: ${create.out}`);
+    notes.push(
+      "Task Scheduler starts the daemon at logon but does not restart it if it exits. For a true always-on box, run the daemon under pm2 or a Windows service wrapper instead."
+    );
+    return { unitPath: WINDOWS_TASK, notes };
+  }
+  throw new ServiceError(`Service install is not supported on ${process.platform}.`);
+}
+function uninstallService() {
+  removeLegacyService();
+  if (process.platform === "darwin") {
+    run("launchctl", ["bootout", `gui/${uid()}/${SERVICE_LABEL}`]);
+    fs4.rmSync(launchAgentPath(), { force: true });
+    return;
+  }
+  if (process.platform === "linux") {
+    run("systemctl", ["--user", "disable", "--now", LINUX_UNIT]);
+    fs4.rmSync(systemdUnitPath(), { force: true });
+    run("systemctl", ["--user", "daemon-reload"]);
+    return;
+  }
+  if (process.platform === "win32") {
+    run("schtasks", ["/Delete", "/TN", WINDOWS_TASK, "/F"]);
+    return;
+  }
+  throw new ServiceError(`Service uninstall is not supported on ${process.platform}.`);
+}
+function restartService() {
+  if (process.platform === "darwin") {
+    const result = run("launchctl", ["kickstart", "-k", `gui/${uid()}/${SERVICE_LABEL}`]);
+    if (!result.ok) throw new ServiceError(`launchctl kickstart failed: ${result.out}`);
+    return;
+  }
+  if (process.platform === "linux") {
+    const result = run("systemctl", ["--user", "restart", LINUX_UNIT]);
+    if (!result.ok) throw new ServiceError(`systemctl restart failed: ${result.out}`);
+    return;
+  }
+  if (process.platform === "win32") {
+    run("schtasks", ["/End", "/TN", WINDOWS_TASK]);
+    const result = run("schtasks", ["/Run", "/TN", WINDOWS_TASK]);
+    if (!result.ok) throw new ServiceError(`schtasks /Run failed: ${result.out}`);
+    return;
+  }
+  throw new ServiceError(`Service restart is not supported on ${process.platform}.`);
+}
+
+// src/cli/session.ts
+async function openSession() {
+  const config2 = requireConfig();
+  const fb = initFirebase(config2);
+  const user = await signInWithStoredSession(fb);
+  return { config: config2, fb, user };
+}
+
+// src/cli/commands/doctor.ts
+var ok = (id, label, detail) => ({ id, label, level: "ok", detail });
+var warn = (id, label, detail, fix) => ({
+  id,
+  label,
+  level: "warn",
+  detail,
+  fix
+});
+var fail = (id, label, detail, fix) => ({
+  id,
+  label,
+  level: "fail",
+  detail,
+  fix
+});
+function onPath(binary) {
+  const probe = process.platform === "win32" ? "where" : "which";
+  return spawnSync2(probe, [binary], { stdio: "ignore" }).status === 0;
+}
+function checkNode() {
+  const major = Number(process.versions.node.split(".")[0]);
+  return major >= 20 ? ok("node", "Node.js", `v${process.versions.node}`) : fail("node", "Node.js", `v${process.versions.node} is too old`, "Install Node.js 20 or newer.");
+}
+async function checkMcp(url) {
+  try {
+    const response = await fetch(url, { method: "GET", signal: AbortSignal.timeout(5e3) });
+    return ok("mcp", "Workspace MCP", `${url} \u2192 HTTP ${response.status}`);
+  } catch (e) {
+    return fail(
+      "mcp",
+      "Workspace MCP",
+      `${url} unreachable (${e instanceof Error ? e.message : e})`,
+      "Check network access, or override the endpoint with CREW_MCP_URL."
+    );
+  }
+}
+function checkService() {
+  const status = serviceStatus();
+  if (status.state === "running") return ok("service", "Background service", status.detail);
+  if (status.state === "installed") {
+    return warn("service", "Background service", status.detail, "Run `lumi-runner service restart`.");
+  }
+  if (status.state === "unsupported") return warn("service", "Background service", status.detail);
+  return warn(
+    "service",
+    "Background service",
+    "Not installed \u2014 the daemon only runs while a terminal is open.",
+    "Run `lumi-runner service install` to keep this Ship online whenever the machine is."
+  );
+}
+async function checkShips(session) {
+  const { config: config2, fb, user } = session;
+  const checks = [];
+  const engines = /* @__PURE__ */ new Set();
+  let needsGithub = false;
+  if (config2.ships.length === 0) {
+    checks.push(
+      fail("ships", "Ships", "This machine serves no Ships.", "Run `lumi-runner ship add` to pick one.")
+    );
+    return { checks, engines, needsGithub };
+  }
+  for (const shipId of config2.ships) {
+    try {
+      const snap = await getDoc6(
+        doc8(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.runners, config2.runnerId)
+      );
+      if (!snap.exists()) {
+        checks.push(
+          warn(
+            `approval:${shipId}`,
+            `Ship ${shipId} \u2014 approval`,
+            "This machine has not enrolled yet.",
+            "Start the daemon once; it enrols on its first heartbeat, then a captain approves it."
+          )
+        );
+      } else if (snap.data().approved !== true) {
+        checks.push(
+          fail(
+            `approval:${shipId}`,
+            `Ship ${shipId} \u2014 approval`,
+            "Enrolled but awaiting captain approval \u2014 no jobs will be claimed.",
+            `Approve this machine on the Ship's Daemons page.`
+          )
+        );
+      } else if (snap.data().ownerUserId !== user.uid) {
+        checks.push(
+          fail(
+            `approval:${shipId}`,
+            `Ship ${shipId} \u2014 approval`,
+            "The approval record belongs to another user.",
+            "Re-run `lumi-runner login` on this machine."
+          )
+        );
+      } else {
+        checks.push(ok(`approval:${shipId}`, `Ship ${shipId} \u2014 approval`, "Approved by a captain."));
+      }
+    } catch (e) {
+      checks.push(
+        fail(
+          `approval:${shipId}`,
+          `Ship ${shipId} \u2014 approval`,
+          `Could not read the approval record (${e instanceof Error ? e.message : e}).`,
+          "Are you still a member of this Ship?"
+        )
+      );
+    }
+    let agents = [];
+    try {
+      const snap = await getDocs3(collection6(fb.db, COLLECTIONS.ships, shipId, COLLECTIONS.agents));
+      agents = snap.docs.map((d) => ({ id: d.id, ...d.data() }));
+    } catch {
+    }
+    const shipEngines = new Set(agents.map((agent) => agentEngine(agent)));
+    if (shipEngines.size === 0) shipEngines.add(DEFAULT_ENGINE_ID);
+    for (const id of shipEngines) engines.add(id);
+    if (agents.some((agent) => effectiveAgentTools(agent).github.enabled)) needsGithub = true;
+    try {
+      const secrets = await loadRunnerSecrets(fb.db, shipId);
+      const missing = [...new Set([...shipEngines].flatMap((id) => missingSecretsFor(id, secrets)))];
+      checks.push(
+        missing.length === 0 ? ok(`secrets:${shipId}`, `Ship ${shipId} \u2014 credentials`, "All required secrets are saved.") : fail(
+          `secrets:${shipId}`,
+          `Ship ${shipId} \u2014 credentials`,
+          `Missing: ${missing.join(", ")}.`,
+          "A captain saves these in Ship Settings \u2192 Runner credentials."
+        )
+      );
+    } catch (e) {
+      checks.push(
+        fail(
+          `secrets:${shipId}`,
+          `Ship ${shipId} \u2014 credentials`,
+          `Could not read the Ship's runner secrets (${e instanceof Error ? e.message : e}).`,
+          "Only captains and approved runners may read them \u2014 get this machine approved first."
+        )
+      );
+    }
+  }
+  return { checks, engines, needsGithub };
+}
+async function runDoctor() {
+  const checks = [checkNode()];
+  const config2 = loadConfig();
+  if (!config2) {
+    checks.push(
+      fail("config", "Configuration", "This machine is not connected.", "Run `lumi-runner setup`.")
+    );
+    return report(checks);
+  }
+  checks.push(ok("config", "Configuration", `Runner ${config2.runnerId} on project ${config2.projectId}`));
+  const progress = spinner2();
+  progress.start("Running checks\u2026");
+  let session = null;
+  try {
+    session = await openSession();
+    checks.push(ok("session", "Session", `Signed in as ${session.user.uid}`));
+  } catch (e) {
+    checks.push(
+      fail("session", "Session", e instanceof Error ? e.message : String(e), "Run `lumi-runner login`.")
+    );
+  }
+  const engines = /* @__PURE__ */ new Set([DEFAULT_ENGINE_ID]);
+  let needsGithub = false;
+  if (session) {
+    const shipResults = await checkShips(session);
+    checks.push(...shipResults.checks);
+    if (shipResults.engines.size > 0) {
+      engines.clear();
+      for (const id of shipResults.engines) engines.add(id);
+    }
+    needsGithub = shipResults.needsGithub;
+  }
+  for (const engineId of engines) {
+    const health = await getDriver(engineId).healthCheck();
+    checks.push(
+      health.ok ? ok(`engine:${engineId}`, `Engine "${engineId}"`, health.detail) : fail(`engine:${engineId}`, `Engine "${engineId}"`, health.detail, health.fix)
+    );
+  }
+  if (needsGithub) {
+    for (const binary of ["git", "gh"]) {
+      checks.push(
+        onPath(binary) ? ok(`bin:${binary}`, `\`${binary}\``, "On PATH.") : fail(
+          `bin:${binary}`,
+          `\`${binary}\``,
+          "Not on PATH, but an agent has GitHub enabled.",
+          `Install ${binary} and make sure it is on the PATH the daemon runs with.`
+        )
+      );
+    }
+  }
+  checks.push(await checkMcp(mcpUrl(config2)));
+  checks.push(checkService());
+  progress.stop("Checks complete.");
+  return report(checks);
+}
+function report(checks) {
+  const failed = checks.filter((c) => c.level === "fail");
+  const warned = checks.filter((c) => c.level === "warn");
+  if (isJson()) {
+    emitJson({
+      version: RUNNER_VERSION,
+      ok: failed.length === 0,
+      failed: failed.length,
+      warned: warned.length,
+      checks
+    });
+    return failed.length === 0 ? 0 : 1;
+  }
+  for (const check of checks) {
+    say.line(`  ${glyph(check.level)} ${pc.bold(check.label)}  ${pc.dim(check.detail)}`);
+    if (check.fix && check.level !== "ok") say.line(`      ${pc.cyan("\u2192")} ${check.fix}`);
+  }
+  say.line("");
+  if (failed.length === 0 && warned.length === 0) {
+    say.success("All checks passed \u2014 this machine is ready to run jobs.");
+  } else if (failed.length === 0) {
+    say.warn(`${warned.length} warning(s), nothing blocking.`);
+  } else {
+    say.error(`${failed.length} check(s) failed \u2014 jobs will not run until these are fixed.`);
+  }
+  return failed.length === 0 ? 0 : 1;
+}
+
+// src/cli/commands/login.ts
+import { spawn as spawn4 } from "node:child_process";
+import os6 from "node:os";
+import { signInWithCustomToken as signInWithCustomToken2 } from "firebase/auth";
+function openBrowser(url) {
+  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn4(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function runLogin(options) {
+  const moved = migrateLegacyDir();
+  if (moved?.migrated) say.info(`Moved your runner config from ${moved.from} to ${moved.to}.`);
+  return options.token ? loginWithToken(options) : loginWithDeviceFlow(options);
+}
+async function loginWithDeviceFlow(options) {
+  const existingConfig = loadConfig();
+  const projectId = options.project || existingConfig?.projectId || DEFAULT_PROJECT_ID;
+  const baseUrl = functionsBaseUrlFor(projectId);
+  const start = await callPublicFunction(baseUrl, "startRunnerLogin", {
+    hostname: os6.hostname(),
+    // Offer the id this machine already has: re-logging in should keep its identity, and with
+    // it the captain approvals it has already earned.
+    ...existingConfig?.runnerId ? { runnerId: existingConfig.runnerId } : {}
+  });
+  if (!options.noBrowser) openBrowser(start.verificationUrl);
+  say.note(
+    `${pc.bold(start.verificationUrl)}
+
+Code: ${pc.bold(start.displayCode)}`,
+    "Approve this machine in your browser"
+  );
+  const progress = spinner2();
+  progress.start("Waiting for approval\u2026");
+  const deadline = Date.now() + start.expiresIn * 1e3;
+  let interval = start.interval;
+  let approved = null;
+  while (Date.now() < deadline) {
+    await sleep(interval * 1e3);
+    let poll;
+    try {
+      poll = await callPublicFunction(baseUrl, "pollRunnerLogin", {
+        userCode: start.userCode,
+        deviceCode: start.deviceCode
+      });
+    } catch (e) {
+      progress.stop("");
+      if (e instanceof CallableError) throw new CliError(e.message);
+      throw e;
+    }
+    if (poll.status === "approved") {
+      approved = poll;
+      break;
+    }
+    interval = poll.interval;
+  }
+  if (!approved) {
+    progress.stop("");
+    throw new CliError("The approval window expired. Run `lumi-runner login` again.");
+  }
+  progress.stop("Approved.");
+  const config2 = {
+    ...existingConfig,
+    apiKey: approved.apiKey || existingConfig?.apiKey || "",
+    projectId: approved.projectId || projectId,
+    runnerId: approved.runnerId,
+    refreshToken: "",
+    // What the human PICKED on the approval page. Their choice replaces whatever this machine
+    // was serving — that page is where the decision is now made.
+    ships: approved.selectedShips.length > 0 ? approved.selectedShips : existingConfig?.ships ?? [],
+    ...options.mcpUrl ? { mcpUrl: options.mcpUrl } : {}
+  };
+  if (!config2.apiKey) {
+    throw new CliError(
+      "The approval did not include a Firebase apiKey. Update the web app, or pass --api-key with --token."
+    );
+  }
+  const fb = initFirebase(config2);
+  const credential = await signInWithCustomToken2(fb.auth, approved.customToken);
+  config2.refreshToken = credential.user.refreshToken;
+  saveConfig(config2);
+  return report2({
+    runnerId: config2.runnerId,
+    uid: credential.user.uid,
+    ships: config2.ships,
+    approvedShips: approved.approvedShips,
+    pendingShips: approved.pendingShips.filter((id) => config2.ships.includes(id))
+  });
+}
+async function loginWithToken(options) {
+  if (!options.apiKey || !options.project) {
+    throw new CliError("--token also needs --api-key and --project. Omit --token to use the browser flow.");
+  }
+  const existing = loadConfig();
+  const config2 = {
+    ...existing,
+    apiKey: options.apiKey,
+    projectId: options.project,
+    runnerId: options.runnerId || existing?.runnerId || `runner-${os6.hostname().toLowerCase().replace(/[^a-z0-9]/g, "").slice(0, 12)}-${Math.random().toString(36).slice(2, 6)}`,
+    refreshToken: "",
+    ships: existing?.ships ?? [],
+    ...options.mcpUrl ? { mcpUrl: options.mcpUrl } : {}
+  };
+  const fb = initFirebase(config2);
+  const user = await login(fb, config2, options.token);
+  return report2({ runnerId: config2.runnerId, uid: user.uid, ships: config2.ships });
+}
+function report2(result) {
+  if (isJson()) {
+    emitJson({ version: RUNNER_VERSION, ...result });
+    return 0;
+  }
+  say.success(`Connected as ${result.uid} \u2014 runner ${result.runnerId}`);
+  if (result.ships.length > 0) say.info(`Serving: ${result.ships.join(", ")}`);
+  if (result.pendingShips && result.pendingShips.length > 0) {
+    say.warn(
+      `Awaiting captain approval on: ${result.pendingShips.join(", ")} \u2014 a captain approves this machine on the Ship's Daemons page.`
+    );
+  }
+  return 0;
+}
+
+// src/cli/commands/logs.ts
+async function runLogs(options) {
+  const tail = readTail(options.lines);
+  if (tail.length === 0 && !options.follow) {
+    say.warn(`No log output yet at ${logFile()}.`);
+    return 0;
+  }
+  for (const line of tail) say.line(line);
+  if (!options.follow) return 0;
+  await new Promise((resolve) => {
+    const stop = followLog((line) => say.line(line));
+    const finish = () => {
+      stop();
+      resolve();
+    };
+    process.on("SIGINT", finish);
+    process.on("SIGTERM", finish);
+  });
+  return 0;
+}
+
+// src/cli/commands/service.ts
+async function runServiceInstall() {
+  const before = serviceStatus();
+  if (before.state !== "not-installed" && before.state !== "unsupported") {
+    const replace = await promptConfirm({
+      message: "A service is already installed. Reinstall it with the current settings?",
+      initialValue: true
+    });
+    if (!replace) {
+      say.info("Left the existing service alone.");
+      return 0;
+    }
+  }
+  const result = installService();
+  if (isJson()) {
+    emitJson({ installed: true, unitPath: result.unitPath, notes: result.notes, ...serviceStatus() });
+    return 0;
+  }
+  say.success(`Service installed: ${result.unitPath}`);
+  say.info("The daemon now starts automatically whenever this machine is on.");
+  for (const note2 of result.notes) say.warn(note2);
+  return 0;
+}
+async function runServiceUninstall() {
+  uninstallService();
+  if (isJson()) {
+    emitJson({ installed: false });
+    return 0;
+  }
+  say.success("Service removed. The daemon will not start on its own any more.");
+  return 0;
+}
+async function runServiceRestart() {
+  restartService();
+  if (isJson()) {
+    emitJson({ restarted: true, ...serviceStatus() });
+    return 0;
+  }
+  say.success("Service restarted.");
+  return 0;
+}
+async function runServiceStatus() {
+  const status = serviceStatus();
+  if (isJson()) {
+    emitJson(status);
+    return 0;
+  }
+  say.line(`  ${status.detail}`);
+  if (status.unitPath) say.line(`  ${status.unitPath}`);
+  return 0;
+}
+
+// src/cli/commands/ship.ts
+import { collectionGroup, doc as doc9, getDoc as getDoc7, getDocs as getDocs4, query as query4, where as where4 } from "firebase/firestore";
+async function listMyShips() {
+  const { fb, user } = await openSession();
+  const memberships = await getDocs4(
+    query4(collectionGroup(fb.db, COLLECTIONS.members), where4("uid", "==", user.uid))
+  );
+  const shipIds = memberships.docs.map((d) => d.ref.parent.parent?.id).filter((id) => !!id);
+  const ships = await Promise.all(
+    shipIds.map(async (id) => {
+      const snap = await getDoc7(doc9(fb.db, COLLECTIONS.ships, id));
+      return snap.exists() ? { id: snap.id, ...snap.data() } : null;
+    })
+  );
+  return ships.filter((s) => s !== null).sort((a, b) => (b.createdAt ?? 0) - (a.createdAt ?? 0));
+}
+async function pickShips(current) {
+  const ships = await listMyShips();
+  if (ships.length === 0) {
+    throw new CliError("You are not a member of any Ship yet \u2014 create one in the web app first.");
+  }
+  return promptMultiSelect({
+    message: "Which Ships should this machine serve?",
+    choices: ships.map((ship2) => ({ value: ship2.id, label: ship2.name || ship2.id, hint: ship2.id })),
+    initialValues: current.filter((id) => ships.some((s) => s.id === id)),
+    flagHint: "lumi-runner ship add <shipId>"
+  });
+}
+async function runShipList() {
+  const config2 = requireConfig();
+  if (isJson()) {
+    emitJson({ ships: config2.ships });
+    return 0;
+  }
+  if (config2.ships.length === 0) {
+    say.warn("This machine serves no Ships. Run `lumi-runner ship add`.");
+    return 0;
+  }
+  for (const shipId of config2.ships) say.line(`  ${shipId}`);
+  return 0;
+}
+async function runShipAdd(shipIds) {
+  const config2 = requireConfig();
+  if (shipIds.length === 0) {
+    if (!canPrompt()) {
+      throw new CliError("Pass at least one shipId, or run this in a terminal to pick interactively.");
+    }
+    config2.ships = await pickShips(config2.ships);
+  } else {
+    config2.ships = [.../* @__PURE__ */ new Set([...config2.ships, ...shipIds])];
+  }
+  saveConfig(config2);
+  return reportAssignment(config2.ships);
+}
+async function runShipRemove(shipIds) {
+  const config2 = requireConfig();
+  config2.ships = config2.ships.filter((id) => !shipIds.includes(id));
+  saveConfig(config2);
+  return reportAssignment(config2.ships);
+}
+function reportAssignment(ships) {
+  if (isJson()) {
+    emitJson({ ships });
+    return 0;
+  }
+  say.success(ships.length > 0 ? `Serving: ${ships.join(", ")}` : "Serving no Ships.");
+  say.info("Restart the daemon for this to take effect: `lumi-runner service restart`.");
+  return 0;
+}
+
+// src/cli/commands/setup.ts
+async function runSetup(options) {
+  if (!canPrompt()) {
+    throw new CliError(
+      "setup is interactive. On a headless machine run `lumi-runner login`, `lumi-runner ship add <id>` and `lumi-runner service install` instead."
+    );
+  }
+  say.intro("lumi-runner setup");
+  const moved = migrateLegacyDir();
+  if (moved?.migrated) say.info(`Moved your runner config from ${moved.from} to ${moved.to}.`);
+  const existing = loadConfig();
+  const reuse = existing?.refreshToken && await promptConfirm({
+    message: `This machine is already connected as ${existing.runnerId}. Keep that session?`,
+    initialValue: true,
+    yesFlagApplies: false
+  });
+  if (!reuse) {
+    await runLogin(options);
+  }
+  const config2 = loadConfig();
+  if (!config2) throw new CliError("Login did not complete.");
+  if (config2.ships.length === 0) {
+    config2.ships = await pickShips([]);
+    saveConfig(config2);
+    say.success(`Serving: ${config2.ships.join(", ") || "(none)"}`);
+  } else {
+    const change = await promptConfirm({
+      message: `Serving ${config2.ships.join(", ")}. Change that?`,
+      initialValue: false,
+      yesFlagApplies: false
+    });
+    if (change) {
+      config2.ships = await pickShips(config2.ships);
+      saveConfig(config2);
+    }
+  }
+  say.step("Checking this machine\u2026");
+  const doctorExit = await runDoctor();
+  if (serviceStatus().state === "not-installed") {
+    const install = await promptConfirm({
+      message: "Start the daemon automatically whenever this machine is on?",
+      initialValue: true,
+      yesFlagApplies: false
+    });
+    if (install) await runServiceInstall();
+    else say.info("Skipped. Run `lumi-runner start` manually, or `lumi-runner service install` later.");
+  }
+  say.outro(
+    doctorExit === 0 ? "Ready. This machine will claim jobs for its Ships." : "Setup finished, but some checks failed \u2014 fix those and re-run `lumi-runner doctor`."
+  );
+  return doctorExit;
+}
+
+// src/cli/commands/status.ts
+import {
+  collection as collection7,
+  doc as doc10,
+  getCountFromServer as getCountFromServer2,
+  getDoc as getDoc8,
+  getDocs as getDocs5,
+  query as query5,
+  where as where5
+} from "firebase/firestore";
+async function runStatus() {
+  const config2 = loadConfig();
+  if (!config2) {
+    if (isJson()) {
+      emitJson({ version: RUNNER_VERSION, connected: false });
+      return 0;
+    }
+    say.warn("This machine is not connected. Run `lumi-runner setup`.");
+    return 0;
+  }
+  const progress = spinner2();
+  progress.start("Reading Ship state\u2026");
+  const { fb } = await openSession();
+  const ships = [];
+  for (const shipId of config2.ships) {
+    const shipRef = doc10(fb.db, COLLECTIONS.ships, shipId);
+    const mirrorSnap = await getDoc8(doc10(shipRef, COLLECTIONS.runners, config2.runnerId));
+    const mirror = mirrorSnap.data();
+    let queued = 0;
+    try {
+      const counted = await getCountFromServer2(
+        query5(collection7(shipRef, COLLECTIONS.jobs), where5("status", "==", "queued"))
+      );
+      queued = counted.data().count;
+    } catch {
+      queued = 0;
+    }
+    const usageSnap = await getDoc8(doc10(shipRef, COLLECTIONS.usageDaily, utcDay(Date.now())));
+    const today = { ...EMPTY_USAGE_TOTALS, ...usageSnap.data()?.totals ?? {} };
+    const now = Date.now();
+    const limitsSnap = await getDocs5(collection7(shipRef, COLLECTIONS.engineLimits));
+    const engineLimits = limitsSnap.docs.map((d) => ({ id: d.id, ...d.data() })).filter((l) => isEngineLimited(l, now));
+    ships.push({
+      shipId,
+      enrolled: mirrorSnap.exists(),
+      approved: mirror?.approved === true,
+      online: mirror?.status === "online" && Date.now() - (mirror?.lastSeenAt ?? 0) < RUNNER_OFFLINE_AFTER_MS,
+      lastSeenAt: mirror?.lastSeenAt ?? null,
+      currentJob: mirror?.currentJob ?? null,
+      queued,
+      today,
+      engineLimits
+    });
+  }
+  progress.stop("");
+  const service2 = serviceStatus();
+  if (isJson()) {
+    emitJson({
+      version: RUNNER_VERSION,
+      connected: true,
+      runnerId: config2.runnerId,
+      projectId: config2.projectId,
+      service: { state: service2.state, detail: service2.detail },
+      ships
+    });
+    return 0;
+  }
+  say.line("");
+  say.line(`  ${pc.bold("Runner")}   ${config2.runnerId}  ${pc.dim(`v${RUNNER_VERSION}`)}`);
+  say.line(`  ${pc.bold("Project")}  ${config2.projectId}`);
+  say.line(`  ${pc.bold("Service")}  ${service2.detail}`);
+  say.line("");
+  if (ships.length === 0) {
+    say.warn("This machine serves no Ships. Run `lumi-runner ship add`.");
+    return 0;
+  }
+  for (const ship2 of ships) {
+    const state = !ship2.enrolled ? pc.dim("not enrolled") : !ship2.approved ? pc.yellow("awaiting approval") : ship2.online ? pc.green("online") : pc.red("offline");
+    say.line(`  ${pc.bold(ship2.shipId)}  ${state}`);
+    if (ship2.lastSeenAt) say.line(`    last seen   ${new Date(ship2.lastSeenAt).toLocaleString()}`);
+    say.line(
+      ship2.currentJob ? `    running     job ${ship2.currentJob.jobId} on task ${ship2.currentJob.taskId} (agent ${ship2.currentJob.agentId})` : "    running     nothing"
+    );
+    say.line(`    queued      ${ship2.queued}`);
+    for (const limit3 of ship2.engineLimits) {
+      say.line(
+        `    ${pc.yellow("paused")}      ${getEngine(limit3.engineId).label} usage limit \u2014 resumes ${new Date(limit3.resetsAt).toLocaleString()}${limit3.resetsAtReported ? "" : " (estimated)"}`
+      );
+    }
+    say.line(
+      `    today       ${ship2.today.jobs} job(s) \xB7 ${ship2.today.inputTokens.toLocaleString()} in / ${ship2.today.outputTokens.toLocaleString()} out tokens`
+    );
+    say.line("");
+  }
+  return 0;
+}
+
+// src/cli/index.ts
+var program = new Command();
+program.name("lumi-runner").description("Lumi Crew runner daemon \u2014 runs agent jobs for your Ships on this machine.").version(RUNNER_VERSION).option("--json", "machine-readable output on stdout").option("-y, --yes", "assume yes for confirmations").option("--no-color", "disable coloured output").hook("preAction", (command) => {
+  const options = command.opts();
+  configureOutput(options);
+});
+function action(handler) {
+  return async (...args) => {
+    try {
+      process.exitCode = await handler(...args);
+    } catch (error) {
+      if (error instanceof CliError) {
+        say.error(error.message);
+        process.exitCode = error.exitCode;
+      } else {
+        say.error(error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+      }
+    } finally {
+      await closeFirebase();
+    }
+  };
+}
+program.command("setup").description("Connect this machine and set it up to run jobs (interactive)").option("--project <projectId>", "Firebase project to connect to").option("--no-browser", "print the approval URL instead of opening a browser").action(action(
+  async (options) => runSetup({ project: options.project, noBrowser: options.browser === false })
+));
+program.command("login").description("Connect this machine (opens a browser to approve it)").option("--project <projectId>", "Firebase project to connect to").option("--no-browser", "print the approval URL instead of opening a browser").option("--token <customToken>", "skip the browser: use a token from mintRunnerToken (CI)").option("--api-key <key>", "Firebase web API key (only with --token)").option("--runner-id <id>", "reuse an existing runner id (only with --token)").option("--mcp-url <url>", "override the Workspace MCP endpoint").action(
+  action(
+    async (options) => runLogin({
+      project: options.project,
+      noBrowser: options.browser === false,
+      token: options.token,
+      apiKey: options.apiKey,
+      runnerId: options.runnerId,
+      mcpUrl: options.mcpUrl
+    })
+  )
+);
+var ship = program.command("ship").description("Which Ships this machine serves");
+ship.command("add [shipIds...]").description("Serve one or more Ships (omit ids to pick interactively)").action(action(async (shipIds) => runShipAdd(shipIds ?? [])));
+ship.command("remove <shipIds...>").description("Stop serving one or more Ships").action(action(async (shipIds) => runShipRemove(shipIds)));
+ship.command("list").description("List the Ships this machine serves").action(action(runShipList));
+program.command("start").description("Run the daemon in the foreground").action(
+  action(async () => {
+    await startDaemon();
+    return 0;
+  })
+);
+program.command("doctor").description("Check whether this machine can run jobs").action(action(runDoctor));
+program.command("status").description("Show what this machine is doing").action(action(runStatus));
+program.command("logs").description("Show the daemon's log file").option("-n, --lines <count>", "how many lines to show", "50").option("-f, --follow", "keep printing new lines").action(
+  action(
+    async (options) => runLogs({ lines: Number(options.lines) || 50, follow: options.follow === true })
+  )
+);
+var service = program.command("service").description("Run the daemon in the background, starting with the machine");
+service.command("install").description("Install and start the background service").action(action(runServiceInstall));
+service.command("uninstall").description("Stop and remove the background service").action(action(runServiceUninstall));
+service.command("restart").description("Restart the background service").action(action(runServiceRestart));
+service.command("status").description("Is the background service installed and running?").action(action(runServiceStatus));
+var config = program.command("config").description("Local per-machine preferences");
+config.command("list").description("Show current settings").action(action(runConfigList));
+config.command("set <key> <value>").description("Change a setting (notifications | keepAwake \u2192 on/off)").action(action(async (key, value) => runConfigSet(key, value)));
+await program.parseAsync(process.argv);
+//# sourceMappingURL=cli.js.map