@maycombhq/atticus 2.0.0-beta.21 → 2.0.0-beta.22

package/dist/{chunk-LNWEWYCM.js → chunk-THDMSZ3R.js}

@@ -6,11 +6,7 @@ var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   historyEntry,
   listHistory
-} from "./chunk-3WON4G3M.js";
-import "./chunk-JYTIHTIK.js";
-import {
-  uiComponentTypeRoutes
-} from "./chunk-CG6CULP6.js";
+} from "./chunk-7IOWA5D5.js";
 import {
   answerAudit,
   auditLines,
@@ -18,52 +14,20 @@ import {
   precisionOf,
   prepareAudit,
   writeAudit
-} from "./chunk-7FUIVIBG.js";
-import {
-  listRuns,
-  partStates,
-  runTranscript
-} from "./chunk-BA2HUMDN.js";
+} from "./chunk-AJQ72EBM.js";
 import {
   uiCiteRoutes
-} from "./chunk-WCEF7H6L.js";
+} from "./chunk-QFWA2DPH.js";
+import "./chunk-X3WY6MN3.js";
 import {
   isHandoffStep
 } from "./chunk-4Q3NN7VF.js";
 import {
-  estimateOf
-} from "./chunk-WFU77T3A.js";
-import {
-  changeMapBody,
-  changeMapOf,
-  targetFlowsOf
-} from "./chunk-GNWAOVFQ.js";
-import {
-  changeArchive,
-  changeHandoff,
-  changeNew,
-  changeReleasePrs,
-  changeSync
-} from "./chunk-COYN3UAN.js";
-import {
-  isSandbox,
-  learnCheck,
-  learnStart,
-  lessonsFor,
-  readProgress,
-  sandboxCreate
-} from "./chunk-ZQLRCA2V.js";
-import {
-  defencesScan,
-  evalRun
-} from "./chunk-FVMPFCDS.js";
-import {
-  listReports,
-  readQuality
-} from "./chunk-FYBF5MB2.js";
+  uiComponentTypeRoutes
+} from "./chunk-NDCF4R6S.js";
 import {
   conformanceCommand
-} from "./chunk-G5YJBNDZ.js";
+} from "./chunk-J3IOLXWM.js";
 import {
   outcomeList,
   outcomeRecord,
@@ -72,118 +36,172 @@ import {
   releaseNotesCommand,
   releasePlanCommand,
   releaseSecurityCommand
-} from "./chunk-AZDITBCT.js";
+} from "./chunk-OHVTTOPS.js";
 import {
-  readServiceRequests
-} from "./chunk-36RY7ZXM.js";
-import {
-  runDone,
-  taskRun,
-  taskRunNotWaiting
-} from "./chunk-AOCWFA7T.js";
+  listRuns,
+  partStates,
+  runTranscript
+} from "./chunk-GZY6RUZ6.js";
 import {
   executorsCheck,
   todoDone,
   todoRun,
   todoShow
-} from "./chunk-ZFQMMU5Y.js";
+} from "./chunk-JB5LINEM.js";
 import {
   inputsSha256,
   loadExecutors
-} from "./chunk-DDJPM5YX.js";
+} from "./chunk-6OJQOPUN.js";
 import {
-  initiativeStatus,
-  readView
-} from "./chunk-2V2ZPQQU.js";
+  isSandbox,
+  learnCheck,
+  learnStart,
+  lessonsFor,
+  readProgress,
+  sandboxCreate
+} from "./chunk-VW62D6QE.js";
 import {
-  DecideError,
-  correctDecision,
-  decisionsView,
-  undoBatch
-} from "./chunk-UYLBRRFK.js";
+  defencesScan,
+  evalRun
+} from "./chunk-WKUJ3KPV.js";
+import {
+  listReports,
+  readQuality
+} from "./chunk-RXPJMEOW.js";
+import {
+  estimateOf
+} from "./chunk-BDKC6H5P.js";
+import {
+  changeMapBody,
+  changeMapOf,
+  targetFlowsOf
+} from "./chunk-IH2XURVQ.js";
+import {
+  changeArchive,
+  changeHandoff,
+  changeNew,
+  changeReleasePrs,
+  changeSync,
+  syncAfterManualStep
+} from "./chunk-O7XLYEFA.js";
 import {
   boxesOf,
   candidatesOf,
   uiLinkRoutes
-} from "./chunk-6DQYZU2W.js";
+} from "./chunk-LFGTYX5U.js";
 import {
   matchDone,
   quotesOf,
   readMatch,
   runMatch
-} from "./chunk-QJCJOMW3.js";
-import "./chunk-3SSTNB4E.js";
-import "./chunk-JRVNXLZP.js";
+} from "./chunk-E3ISYXO3.js";
+import "./chunk-2LGRMVCA.js";
+import "./chunk-VCTWPLAO.js";
 import {
-  copilotAcpAllowed
-} from "./chunk-LIJJCBQI.js";
-import "./chunk-26Z7OGQW.js";
-import "./chunk-OKUB6RJA.js";
+  readServiceRequests
+} from "./chunk-WF7B67YE.js";
+import {
+  initiativeStatus,
+  readView
+} from "./chunk-6PPOWY5E.js";
+import {
+  runDone,
+  taskRun,
+  taskRunNotWaiting
+} from "./chunk-VTZMAJ3W.js";
 import {
   filesUnder,
   memoByFiles,
   recheckNow,
   uiFactsRoutes
-} from "./chunk-QOOEYDNJ.js";
+} from "./chunk-AJYXNTNZ.js";
 import {
   HttpError,
   badRequest,
   conflict,
   notFound,
+  requireConfirmation,
   startServer,
   strParam
-} from "./chunk-HK3VOHIE.js";
+} from "./chunk-C3RY6KU6.js";
+import {
+  DecideError,
+  correctDecision,
+  decisionsView,
+  undoBatch
+} from "./chunk-DCZWQLYT.js";
+import {
+  copilotAcpAllowed
+} from "./chunk-6ZJ5A7AF.js";
+import "./chunk-X5F3Q5LV.js";
+import "./chunk-VBTP56CE.js";
 import {
   safeMessage,
   withFileLock
-} from "./chunk-THN26IEF.js";
-import "./chunk-LN77DXBM.js";
-import "./chunk-L4CESDPB.js";
-import "./chunk-U3NBK4EU.js";
-import "./chunk-455SYIIE.js";
+} from "./chunk-S7FCV7S5.js";
+import {
+  readRepos
+} from "./chunk-YYY3AZFE.js";
+import "./chunk-RGERPOIV.js";
+import "./chunk-OUBGGKDU.js";
+import "./chunk-XI2LCCYQ.js";
+import "./chunk-BPK5P77O.js";
+import {
+  digestCommand
+} from "./chunk-7DOR27HL.js";
 import {
   reconcileCommand
-} from "./chunk-YZDZOEV4.js";
+} from "./chunk-KDNTAPLX.js";
 import {
   sourcesAdd,
   sourcesSync
-} from "./chunk-HXXP2NTE.js";
+} from "./chunk-KQGURXFU.js";
 import {
   INPUTS_SOURCE_ID
-} from "./chunk-D57MFJPP.js";
-import "./chunk-5QUOPNLN.js";
-import {
-  readRepos
-} from "./chunk-4TKVU2I2.js";
+} from "./chunk-D73UEXYW.js";
+import "./chunk-OHNCWBKF.js";
 import {
   uiOnboardingRoutes
-} from "./chunk-PNQLCRSS.js";
-import "./chunk-3J5I7ZOU.js";
+} from "./chunk-7JITZFJC.js";
+import "./chunk-EHA7RMZ3.js";
 import {
   uiTrustRoutes
-} from "./chunk-4FOAYLI4.js";
+} from "./chunk-OWNCM4ZN.js";
 import {
   contractCheckOf,
   estateJoinOnFile,
   stampOf
-} from "./chunk-GX74YWR7.js";
-import "./chunk-G6IQYM25.js";
-import "./chunk-LPV6T362.js";
+} from "./chunk-T6DQR5TV.js";
+import "./chunk-WXFLMQSR.js";
+import "./chunk-TYQBFTBR.js";
 import {
-  digestCommand
-} from "./chunk-X2CUXTWU.js";
+  checkoutOf
+} from "./chunk-2F4CYZKJ.js";
+import "./chunk-LO6P2VYG.js";
+import {
+  intakeContext
+} from "./chunk-SFUP7TTO.js";
+import "./chunk-7FTTA3HD.js";
+import "./chunk-ZQ3ON2VQ.js";
 import {
   baselineCommand,
   setupSteps
-} from "./chunk-GK4PYVEC.js";
+} from "./chunk-AFWUDXEM.js";
+import {
+  catalogRecords,
+  openChanges,
+  systemGuide
+} from "./chunk-GUX3PTYM.js";
 import {
   doctorChecks
-} from "./chunk-HGHRSF3E.js";
-import "./chunk-4B6BT75O.js";
+} from "./chunk-EGQRREQH.js";
+import "./chunk-3G4YI4ZU.js";
+import "./chunk-P2V7QW4D.js";
+import "./chunk-Z5IA3WDR.js";
 import {
   readMe,
   writeMe
-} from "./chunk-UF4UHCIG.js";
+} from "./chunk-2Q56PQPS.js";
 import {
   cancelTaskRunWait,
   findTaskRunOfRun,
@@ -196,63 +214,38 @@ import {
   settleTaskPr,
   stopAllBuilds,
   taskRunOfRun
-} from "./chunk-Y6K3CJBU.js";
-import "./chunk-GIFMBCTW.js";
-import "./chunk-MD7KUEJ3.js";
-import {
-  checkoutOf
-} from "./chunk-Q46QDDMF.js";
-import "./chunk-TGVVUKTG.js";
-import {
-  intakeContext
-} from "./chunk-TQ4TG57V.js";
+} from "./chunk-6MUGR4LS.js";
 import {
   workspaceOpen,
   workspaceSync
-} from "./chunk-IFHDV6KQ.js";
-import "./chunk-LQH4P45K.js";
-import "./chunk-P2VBXX7N.js";
+} from "./chunk-DOBQKHIF.js";
+import "./chunk-JENSEMXF.js";
+import "./chunk-O7FDLW7L.js";
+import {
+  planStories,
+  snowDraft,
+  snowSubmit
+} from "./chunk-HNM2YQT2.js";
+import "./chunk-PAQ2AS5E.js";
 import {
-  archiveGate,
   ciArchiveGate
-} from "./chunk-ZX7235KR.js";
+} from "./chunk-RUGXBPWI.js";
 import {
   traceMatrix
-} from "./chunk-EZIN5E5B.js";
-import "./chunk-3LZ6P5EP.js";
+} from "./chunk-BTGPE6CR.js";
+import "./chunk-MUWDB4R4.js";
+import {
+  archiveGate
+} from "./chunk-ZQ7SKESZ.js";
 import {
   scanCommand
-} from "./chunk-NCB6656Z.js";
-import "./chunk-TYD6I4CZ.js";
+} from "./chunk-TNR75OXT.js";
+import "./chunk-MFR5OPBD.js";
 import {
   readChangeTasks,
   readStory,
   setTaskDone
-} from "./chunk-YWAKDNMH.js";
-import {
-  catalogRecords,
-  openChanges,
-  systemGuide
-} from "./chunk-FY3QIRTL.js";
-import "./chunk-3G4YI4ZU.js";
-import "./chunk-2HTEMYTB.js";
-import {
-  ASSISTANT_FORMATS,
-  readProbes,
-  whatRunsWhere
-} from "./chunk-3AQ2R5NL.js";
-import {
-  critic,
-  criticStats,
-  findingAction
-} from "./chunk-PTQ3ZALZ.js";
-import "./chunk-A2G72UI4.js";
-import {
-  planStories,
-  snowDraft,
-  snowSubmit
-} from "./chunk-I2A3Z5AK.js";
-import "./chunk-F6H2RJ3N.js";
+} from "./chunk-UGUP3ZM6.js";
 import {
   CORRECTIONS_FILE,
   FEATURE_FILE,
@@ -289,15 +282,26 @@ import {
   stageComments,
   stageGate,
   writeSketch
-} from "./chunk-BEPCKDCP.js";
+} from "./chunk-R7NYHMUU.js";
 import {
   FeaturePlacement,
   STAGES,
   STAGE_PHASE,
   fieldNames,
   rerunOf
-} from "./chunk-HWD4JPU7.js";
-import "./chunk-5WERBKLE.js";
+} from "./chunk-IVBOQAGB.js";
+import "./chunk-ISUAAMGS.js";
+import {
+  ASSISTANT_FORMATS,
+  readProbes,
+  whatRunsWhere
+} from "./chunk-BEVTIBRH.js";
+import {
+  critic,
+  criticStats,
+  findingAction
+} from "./chunk-UF4AZOZB.js";
+import "./chunk-YHCMZC2J.js";
 import "./chunk-VOGCSYOI.js";
 import {
   layerRules,
@@ -311,7 +315,7 @@ import {
   readStoryIndex,
   reviewedGates,
   roundsOf
-} from "./chunk-K332XW7K.js";
+} from "./chunk-S4PMJU6H.js";
 import {
   ChangeOwnersError,
   artifactFiles,
@@ -325,13 +329,13 @@ import {
   loadChangeContext,
   requiredArtifacts,
   setChangeOwners
-} from "./chunk-HSZMPH5T.js";
-import "./chunk-D2WSW4GU.js";
+} from "./chunk-IDKCWSM5.js";
+import "./chunk-UUU4CLJG.js";
 import {
   fileStepStore,
   manualAdapter,
   stepOfProvisional
-} from "./chunk-4KNOJC6J.js";
+} from "./chunk-7IGKHZ4Z.js";
 import {
   componentRenames,
   estateFacts,
@@ -343,7 +347,7 @@ import {
   outsideProfileSystems,
   readCatalog,
   targetPicker
-} from "./chunk-4SLBCEPD.js";
+} from "./chunk-J2JAKCIW.js";
 import {
   OrgPackProposal,
   SNAPSHOT_FILE,
@@ -367,38 +371,40 @@ import {
   snapshotDates,
   snapshotSources,
   writeReview
-} from "./chunk-64AADMTW.js";
+} from "./chunk-745DAZ4L.js";
 import {
   NoSuchNode,
   buildEstate,
   focusView,
   nodeView,
   viewKey
-} from "./chunk-JYMIB5XY.js";
+} from "./chunk-CXJ6FUKN.js";
 import {
   readServiceRequestExports,
   readVendorSpec,
   readWorkItemExports
-} from "./chunk-CPK7QSBG.js";
-import "./chunk-YO2PKTXT.js";
-import "./chunk-TWQRPM76.js";
-import "./chunk-VUVGX5L2.js";
-import "./chunk-API5TOUB.js";
+} from "./chunk-QKUJMING.js";
+import "./chunk-6ZGLAACW.js";
+import "./chunk-CQDGOPGH.js";
+import "./chunk-3NFFJL5D.js";
+import "./chunk-F3P7N7SF.js";
+import "./chunk-UPS2DGFC.js";
 import {
   baseClonePath,
   loadRepos,
   readChangeRepos
-} from "./chunk-XOL3GFW2.js";
+} from "./chunk-PKBHS4AA.js";
 import {
   COMMON_SETTINGS,
   PROVIDER_SETTINGS,
   defaultKeyStore,
+  keyEnvFromEnvironment,
   looksLikeKey
-} from "./chunk-PRW3HXM3.js";
+} from "./chunk-LYBNHMVZ.js";
 import {
   providerFactoryFor
-} from "./chunk-QHJJMZLX.js";
-import "./chunk-7AB6OWTV.js";
+} from "./chunk-P32RUW3B.js";
+import "./chunk-QA4O2GGC.js";
 import {
   ASSISTANTS,
   ChangeArtifact,
@@ -467,7 +473,6 @@ import {
   readQuestion,
   readRepoSpec,
   readSharedMaps,
-  require_dist,
   runsDirOf,
   runsRelOf,
   setManifestField,
@@ -475,13 +480,16 @@ import {
   specRelOf,
   specRepos,
   undeclareLink
-} from "./chunk-PAINMSID.js";
+} from "./chunk-Q2TECDIT.js";
 import {
   FileChangedError,
   createLog,
   writeFileAtomic,
   writeFileIfUnchanged
-} from "./chunk-ODMBPDDV.js";
+} from "./chunk-TUULXQRW.js";
+import {
+  require_dist
+} from "./chunk-BQGDB6ZL.js";
 import {
   __toESM
 } from "./chunk-TV45EUGM.js";
@@ -776,8 +784,9 @@ async function artifactPath(root, id, artifact, o = {}) {
 }
 function uiRoutes(r, ctx, deps = {}) {
   const { root, user, jobs } = ctx;
+  const confirmed2 = (write, target, given) => requireConfirmation(ctx.confirmations, write, target, given);
   const readyView = async (change) => {
-    const { deployOrderOf } = await import("./chunk-JKIGL3XQ.js");
+    const { deployOrderOf } = await import("./chunk-SYV5LHML.js");
     const repoOrder = await deployOrderOf(root, change);
     const prStates = /* @__PURE__ */ new Map();
     for (const t of await taskViews(root, change, {
@@ -814,7 +823,7 @@ function uiRoutes(r, ctx, deps = {}) {
     return { status: 202, body: { jobId: job.id } };
   };
   return r.add("POST", "/api/facts/{repo}/apply", async ({ params }) => {
-    const { verifyCommand } = await import("./chunk-T74WQQGS.js");
+    const { verifyCommand } = await import("./chunk-PSOFBQWB.js");
     const repo = params.repo;
     if (!FACTS_REPO.test(repo))
       throw badRequest(`${JSON.stringify(repo)} isn't a repo name.`);
@@ -822,25 +831,26 @@ function uiRoutes(r, ctx, deps = {}) {
       throw notFound(`There is no repo ${repo} in this workspace.`);
     return asJob(`Applying to ${repo}`, () => run((io) => verifyCommand(root, repo, { write: true, verbose: false, json: false }, io)));
   }).add("GET", "/api/upgrade", async () => {
-    const { upgradeCheck } = await import("./chunk-AM6FP6JW.js");
+    const { newerAtticusOf, upgradeCheck } = await import("./chunk-AVTBS4OW.js");
     const c = await upgradeCheck(root);
+    const stamp2 = c.stamp?.atticus ?? newerAtticusOf(c);
     const body = {
       atticus: c.atticus,
       newer: c.newer,
-      ...c.stamp ? { stamp: c.stamp.atticus } : {},
+      ...stamp2 ? { stamp: stamp2 } : {},
       pending: c.pending
     };
     return { status: 200, body };
   }).add("POST", "/api/upgrade", async () => {
-    const { upgradeCheck, upgradeCommand } = await import("./chunk-AM6FP6JW.js");
+    const { newerThan, newerWords, upgradeCheck, upgradeCommand } = await import("./chunk-AVTBS4OW.js");
     const c = await upgradeCheck(root);
     if (c.newer)
-      throw conflict(`This metarepo was upgraded by Atticus ${c.stamp.atticus}; this is ${c.atticus}. Install ${c.stamp.atticus} or later first.`);
-    if (!c.pending.length)
+      throw conflict(newerWords(c));
+    if (!c.pending.length && c.stamp && !newerThan(c.atticus, c.stamp.atticus))
       throw conflict(`Nothing to upgrade: up to date for Atticus ${c.atticus}.`);
     return asJob("Upgrading the metarepo", () => run((io) => upgradeCommand(root, { by: user }, io)));
   }).add("GET", "/api/propose", async ({ query }) => {
-    const { proposePlan, PROPOSE_SCOPES } = await import("./chunk-UZACEG2C.js");
+    const { proposePlan, PROPOSE_SCOPES } = await import("./chunk-EMRIQUND.js");
     const scope = query.get("scope") ?? "";
     if (!PROPOSE_SCOPES.includes(scope))
       throw refused({
@@ -862,7 +872,8 @@ function uiRoutes(r, ctx, deps = {}) {
     return { status: 200, body: { ...plan, applyFirst: await applyFirstOf(root, plan.files) } };
   }).add("POST", "/api/propose", async ({ body }) => {
     const b = parseBody(api_exports.ProposeRequest, body);
-    const { proposeForReview } = await import("./chunk-UZACEG2C.js");
+    confirmed2("propose", b.scope, b.confirmation);
+    const { proposeForReview } = await import("./chunk-EMRIQUND.js");
     return asJob("Proposing for review", () => run((io) => proposeForReview(root, {
       scope: b.scope,
       by: user,
@@ -871,11 +882,11 @@ function uiRoutes(r, ctx, deps = {}) {
       ...b.branch ? { branch: b.branch } : {}
     }, io)));
   }).add("POST", "/api/propose/bring-in", async () => {
-    const { bringInMerged } = await import("./chunk-UZACEG2C.js");
+    const { bringInMerged } = await import("./chunk-EMRIQUND.js");
     return asJob("Bringing in what merged", () => run((io) => bringInMerged(root, io)));
   }).add("POST", "/api/changes/{changeId}/conformance", async ({ params }) => {
     await readChange(root, params.changeId);
-    const { changeConformCommand } = await import("./chunk-5CMPVC3N.js");
+    const { changeConformCommand } = await import("./chunk-5SJZW52K.js");
     return asJob(`Checking ${params.changeId}'s code against its design`, () => run((io) => changeConformCommand(root, params.changeId, { findingsAnswer: true }, io)));
   }).add("GET", "/api/change-types", async () => {
     const op = await loadOrgPack(orgPackDirOf(root));
@@ -978,7 +989,7 @@ function uiRoutes(r, ctx, deps = {}) {
       throw conflict(`${rel} changed since you opened it. Reload it, then make your edit again.`);
     await mkdir(dirname2(file), { recursive: true });
     await writeFileIfUnchanged(file, was, b.content);
-    const { recordPersonSave: recordPersonSave2 } = await import("./chunk-NTAVOWYD.js");
+    const { recordPersonSave: recordPersonSave2 } = await import("./chunk-NY2XSR5K.js");
     await recordPersonSave2(join2(changesDirOf(root), params.changeId), params.changeId, {
       file: rel,
       who: user,
@@ -1101,12 +1112,14 @@ function uiRoutes(r, ctx, deps = {}) {
       };
     });
     return { status: 202, body: api_exports.RunReadyAccepted.parse({ jobId: job.id, tasks }) };
-  }).add("POST", "/api/changes/{changeId}/tasks/{taskId}/pr", async ({ params }) => {
+  }).add("POST", "/api/changes/{changeId}/tasks/{taskId}/pr", async ({ params, body }) => {
     await readChange(root, params.changeId);
     const change = params.changeId;
     const task = params.taskId;
+    const b = parseBody(api_exports.ConfirmedRequest, body ?? {});
     if (!(await taskViews(root, change)).some((t) => t.id === task))
       throw notFound(`Change ${change} has no task ${task}.`);
+    confirmed2("task-pr", `${change}/${task}`, b.confirmation);
     let raised;
     try {
       raised = await raiseTaskPr(root, change, task, {
@@ -1148,6 +1161,7 @@ function uiRoutes(r, ctx, deps = {}) {
   }).add("POST", "/api/changes/{changeId}/handoff", async ({ params, body }) => {
     await readChange(root, params.changeId);
     const b = parseBody(api_exports.HandoffRequest, body);
+    confirmed2("handoff", params.changeId, b.confirmation);
     const res = await run((io) => changeHandoff(root, params.changeId, { by: user, approve: true, ...b.repo ? { repo: b.repo } : {} }, io, changeDeps));
     if (res.code !== 0)
       throw refused(res);
@@ -1158,7 +1172,8 @@ function uiRoutes(r, ctx, deps = {}) {
   }).add("POST", "/api/changes/{changeId}/release-prs", async ({ params, body }) => {
     const id = params.changeId;
     await readChange(root, id);
-    parseBody(api_exports.ReleasePrsRequest, body);
+    const b = parseBody(api_exports.ReleasePrsRequest, body);
+    confirmed2("release-prs", id, b.confirmation);
     const res = await run((io) => changeReleasePrs(root, id, { by: user, approve: true }, io, changeDeps));
     ctx.events.publish({ type: "file.changed", path: `${id}/repos.yaml` });
     if (res.code !== 0)
@@ -1167,10 +1182,13 @@ function uiRoutes(r, ctx, deps = {}) {
   }).add("POST", "/api/changes/{changeId}/sync", async ({ params, body }) => {
     await readChange(root, params.changeId);
     const b = parseBody(api_exports.SyncRequest, body);
-    const res = await run((io) => changeSync(root, params.changeId, { by: user, approve: true, ...b.repo ? { repo: b.repo } : {} }, io, changeDeps));
+    const approve = b.confirmation !== void 0;
+    if (approve)
+      confirmed2("merge", params.changeId, b.confirmation);
+    const res = await run((io) => changeSync(root, params.changeId, { by: user, approve, ...b.repo ? { repo: b.repo } : {} }, io, changeDeps));
     if (res.code === 2)
       throw refused(res);
-    const { appLines } = await import("./chunk-J2O4LFVI.js");
+    const { appLines } = await import("./chunk-CBGGOQWU.js");
     return {
       status: 200,
       body: {
@@ -1180,14 +1198,14 @@ function uiRoutes(r, ctx, deps = {}) {
     };
   }).add("GET", "/api/changes/{changeId}/inputs", async ({ params }) => {
     const c = await readChange(root, params.changeId);
-    const { readChangeInputs } = await import("./chunk-UDXWIPCB.js");
+    const { readChangeInputs } = await import("./chunk-RLDGWLQ7.js");
     return {
       status: 200,
       body: api_exports.ChangeInputList.parse(await readChangeInputs(join2(changesDirOf(root), c.id)))
     };
   }).add("GET", "/api/changes/{changeId}/prototypes", async ({ params }) => {
     const c = await readChange(root, params.changeId);
-    const { changePrototypes } = await import("./chunk-VYOCPTUB.js");
+    const { changePrototypes } = await import("./chunk-7ASNL4Q4.js");
     return {
       status: 200,
       body: api_exports.ChangePrototypeList.parse(await changePrototypes(root, c.id))
@@ -1195,7 +1213,7 @@ function uiRoutes(r, ctx, deps = {}) {
   }).add("POST", "/api/changes/{changeId}/prototypes", async ({ params, body }) => {
     const c = await readChange(root, params.changeId);
     const b = parseBody(api_exports.ComparePrototypeRequest, body);
-    const { attachPrototype, changePrototypes } = await import("./chunk-VYOCPTUB.js");
+    const { attachPrototype, changePrototypes } = await import("./chunk-7ASNL4Q4.js");
     const res = await run((io) => attachPrototype(root, c.id, b.repo, { by: user, ...deps.now ? { now: new Date(deps.now) } : {} }, io));
     if (res.code !== 0)
       throw refused(res);
@@ -1213,7 +1231,7 @@ function uiRoutes(r, ctx, deps = {}) {
     const bytes = new Uint8Array(Buffer.from(b.content, "base64"));
     if (bytes.length > MAX_ATTACH)
       throw new HttpError(413, "The file is too large", "Attach a file of 15 MB or less.");
-    const { attachFiles } = await import("./chunk-XQ3YZ4QW.js");
+    const { attachFiles } = await import("./chunk-LDLL7LB3.js");
     const r2 = await attachFiles(root, c.id, [{ name: b.name, bytes }], user);
     if (!r2.added.length)
       throw new HttpError(422, "Atticus can't attach that", r2.refused[0]?.why ?? "", {
@@ -1332,11 +1350,11 @@ function uiRoutes(r, ctx, deps = {}) {
     }
     const after = await findRun(root, params.runId);
     ctx.events.publish({ type: "run.changed", runId: after.runId, state: after.state });
-    const { resumeAfterDone, appLines } = await import("./chunk-J2O4LFVI.js");
+    const { resumeAfterDone, appLines } = await import("./chunk-CBGGOQWU.js");
     if (res.code !== 0)
       throw refused({ ...res, out: appLines(res.out), err: appLines(res.err) });
     const stepRunner = deps.runStep ?? (async (args) => {
-      const { main } = await import("./chunk-7FHNFCHK.js");
+      const { main } = await import("./chunk-IUPG3UKI.js");
       const out = [];
       const err = [];
       const code = await main([...args, "--root", root], { out: (l) => out.push(l), err: (l) => err.push(l) }, { quiet: true });
@@ -1481,6 +1499,9 @@ function uiRoutes(r, ctx, deps = {}) {
     return { status: 202, body: { jobId: job.id } };
   }).add("POST", "/api/workspace/sync", ({ body }) => {
     const b = parseBody(api_exports.ScanRequest.pick({ repos: true }), body);
+    const busy = jobs.runningOf("sync");
+    if (busy)
+      throw conflict(`A sync is already running (${busy.id}): wait for it to finish.`);
     const job = jobs.start("sync", async (c) => {
       c.progress(0, 1, "Syncing base clones");
       const res = await run((io) => workspaceSync(root, b.repos, io));
@@ -1490,6 +1511,9 @@ function uiRoutes(r, ctx, deps = {}) {
     return { status: 202, body: { jobId: job.id } };
   }).add("POST", "/api/reconcile", ({ body }) => {
     const b = parseBody(api_exports.ReconcileRequest, body);
+    const busy = jobs.runningOf("reconcile");
+    if (busy)
+      throw conflict(`A reconcile is already running (${busy.id}): wait for it to finish.`);
     const job = jobs.start("reconcile", async (c) => {
       c.progress(0, 1, `Reconciling ${b.diagram}`);
       const res = await run((io) => reconcileCommand(root, [b.diagram], { json: true }, io));
@@ -1729,19 +1753,16 @@ function uiRunRoutes(r, ctx, deps = {}) {
   const pack = () => loadOrgPack(orgPackDirOf(root));
   const rel = deps.now ? { now: () => new Date(deps.now) } : {};
   const syncAfterStep = async (s) => {
-    if (s.system !== "git-host" || !s.change || s.state === "open")
-      return void 0;
-    const c = await changeStore(root).tryRead(s.change).catch(() => void 0);
-    const live = c && c.state !== "returned" ? liveHandoff(c) : void 0;
-    const steps = await fileStepStore(root).list({ change: s.change, system: "git-host" });
-    const open = s.action === "open-pull-request" ? s : steps.find((x) => x.action === "open-pull-request" && s.dependsOn.includes(x.id));
-    if (!live || !open || open.inputs.head !== live.branch)
+    let synced = false;
+    const res = await run2(async (io) => {
+      synced = await syncAfterManualStep(root, s, user, io, {
+        ...deps.gitHost ? { gitHost: deps.gitHost } : {},
+        ...deps.now ? { now: deps.now } : {}
+      });
+      return 0;
+    });
+    if (!synced)
       return void 0;
-    const repo = typeof open.inputs.repo === "string" ? open.inputs.repo : void 0;
-    const res = await run2((io) => changeSync(root, s.change, { by: user, ...repo ? { repo } : {} }, io, {
-      ...deps.gitHost ? { gitHost: deps.gitHost } : {},
-      ...deps.now ? { now: deps.now } : {}
-    }));
     ctx.events.publish({ type: "file.changed", path: `${changesRelOf(root)}/${s.change}` });
     return [...res.out, ...res.err];
   };
@@ -1806,12 +1827,19 @@ function uiRunRoutes(r, ctx, deps = {}) {
   }).add("POST", "/api/todo/{stepId}/done", async ({ params, body }) => {
     const b = parseBody2(api_exports.StepDoneRequest, body);
     const ref = stepRef(params.stepId, b.change);
-    const res = await run2((io) => todoDone(root, ref, {
-      by: user,
-      result: b.values,
-      ...b.skip ? { skip: true } : {},
-      ...b.note ? { note: b.note } : {}
-    }, io, deps.todo ?? {}));
+    const res = await run2((io) => todoDone(
+      root,
+      ref,
+      {
+        by: user,
+        result: b.values,
+        ...b.skip ? { skip: true } : {},
+        ...b.note ? { note: b.note } : {}
+      },
+      io,
+      // the step's sync is said apart, as `synced`, below
+      { ...deps.todo, sync: false }
+    ));
     if (res.code !== 0) {
       if (res.err.some((l) => /^There is no step/.test(l)))
         throw notFound(res.err.join("\n"));
@@ -1843,12 +1871,20 @@ function uiRunRoutes(r, ctx, deps = {}) {
     };
   }).add("POST", "/api/todo/{stepId}/run", async ({ params, body }) => {
     const b = parseBody2(api_exports.StepRunRequest, body);
-    const res = await run2((io) => todoRun(root, stepRef(params.stepId, b.change), {
-      with: b.with,
-      approve: user,
-      inputs: b.inputsSha256,
-      ...b.fillOnly ? { fillOnly: true } : {}
-    }, io, deps.todo ?? {}));
+    requireConfirmation(ctx.confirmations, "step-run", params.stepId, b.confirmation);
+    const res = await run2((io) => todoRun(
+      root,
+      stepRef(params.stepId, b.change),
+      {
+        with: b.with,
+        approve: user,
+        inputs: b.inputsSha256,
+        ...b.fillOnly ? { fillOnly: true } : {}
+      },
+      io,
+      // the step's sync is said apart, as `synced`, below
+      { ...deps.todo, sync: false }
+    ));
     if (res.code !== 0) {
       if (res.err.some((l) => /^There is no step/.test(l)))
         throw notFound(res.err.join("\n"));
@@ -2395,6 +2431,8 @@ function uiMeRoutes(r, ctx, deps = {}) {
     const b = api_exports.SendDigestRequest.safeParse(body ?? {});
     if (!b.success)
       throw badRequest("Send { send: true } to post it, or {} to see it.");
+    if (b.data.send)
+      requireConfirmation(ctx.confirmations, "digest-send", "me", b.data.confirmation);
     const me = await readMe(ctx.root);
     const out = [];
     const err = [];
@@ -2448,7 +2486,7 @@ function uiKnowRoutes(r, ctx, o = {}) {
   if (o.warm)
     void machine().catch(() => void 0);
   const view3 = async (name, arg) => {
-    const build = VIEWS[name];
+    const build = Object.hasOwn(VIEWS, name) ? VIEWS[name] : void 0;
     if (!build)
       throw notFound(`There is no view ${name}.`);
     if (arg !== void 0 && !ID.test(arg))
@@ -2456,7 +2494,7 @@ function uiKnowRoutes(r, ctx, o = {}) {
     const args = build(arg);
     if (!args)
       throw badRequest(`The ${name} view needs an id: /api/view/${name}/<id>.`);
-    const { main } = await import("./chunk-7FHNFCHK.js");
+    const { main } = await import("./chunk-IUPG3UKI.js");
     const out = [];
     const err = [];
     const code = await main([...args, "--json", "--root", ctx.root], { out: (l) => out.push(l), err: (l) => err.push(l) }, { quiet: true });
@@ -2486,7 +2524,7 @@ function uiKnowRoutes(r, ctx, o = {}) {
     return { status: 200, body: { code, data: body, problems: err } };
   };
   const text = async (args) => {
-    const { main } = await import("./chunk-7FHNFCHK.js");
+    const { main } = await import("./chunk-IUPG3UKI.js");
     const out = [];
     const err = [];
     const code = await main([...args, "--root", ctx.root], { out: (l) => out.push(l), err: (l) => err.push(l) }, { quiet: true });
@@ -2504,7 +2542,7 @@ function uiKnowRoutes(r, ctx, o = {}) {
       throw badRequest("Some fields aren't right.", {
         errors: b.error.issues.map((i) => ({ path: i.path.join("."), message: i.message }))
       });
-    const { triageDecide } = await import("./chunk-ZKYRDV7A.js");
+    const { triageDecide } = await import("./chunk-UWMJKX5U.js");
     const out = [];
     const err = [];
     const code = await triageDecide(ctx.root, params.itemId, b.data.option, { by: ctx.user, ...b.data.reason ? { reason: b.data.reason } : {} }, { out: (l) => out.push(l), err: (l) => err.push(l) });
@@ -2620,7 +2658,7 @@ function refused3(r) {
   return r.code === 2 ? badRequest(detail) : new HttpError(422, "Atticus refused", detail);
 }
 function uiInitiativeRoutes(r, ctx) {
-  const commands = () => import("./chunk-AE4P57KK.js");
+  const commands = () => import("./chunk-7UOMVMFG.js");
   const changed = () => ctx.events.publish({ type: "file.changed", path: "catalog/curated" });
   return r.add("POST", "/api/initiatives", async ({ body }) => {
     const b = parseBody3(api_exports.NewInitiativeRequest, body);
@@ -2698,9 +2736,9 @@ function uiQuestionRoutes(r, ctx, deps = {}) {
       throw badRequest("role is product, architecture, analysis or delivery, or left out.");
     const onFile = await listQuestions(ctx.root);
     const every = { ...onFile, questions: onFile.questions.filter((q) => !q.finding) };
-    const { routeQuestions } = await import("./chunk-Z3QFH7YG.js");
+    const { routeQuestions } = await import("./chunk-CADWLE2T.js");
     const routedAll = await routeQuestions(ctx.root, every.questions, mine ? { mine: ctx.user } : {});
-    const { stageQuestions, roleWithStage, isChangeQuestion, countByRole, personsRoles } = await import("./chunk-KYZMRSPS.js");
+    const { stageQuestions, roleWithStage, isChangeQuestion, countByRole, personsRoles } = await import("./chunk-5NMKONLP.js");
     const stages = await stageQuestions(ctx.root);
     const roleOf = (q) => roleWithStage(q, stages);
     for (const q of every.questions) {
@@ -2710,20 +2748,21 @@ function uiQuestionRoutes(r, ctx, deps = {}) {
         a.role = r2;
     }
     const base = change ? routedAll.questions.filter((q) => isChangeQuestion(q, change, { stages, restsOn: routedAll.about[q.id]?.restsOn })) : routedAll.questions;
+    const ofRole = role ? base.filter((q) => roleOf(q) === role) : base;
     const routed = {
       ...routedAll,
-      questions: base.filter((q) => (!state || q.state === state) && (!role || roleOf(q) === role))
+      questions: ofRole.filter((q) => !state || q.state === state)
     };
     const listed = { problems: every.problems };
-    const n = (s) => base.filter((q) => q.state === s).length;
+    const n = (s) => ofRole.filter((q) => q.state === s).length;
     const body = {
       counts: {
         open: n("open"),
         answered: n("answered"),
         retired: n("retired"),
-        total: base.length,
-        byRepo: Object.fromEntries([...new Set(base.map((q) => q.repo))].sort().map((r2) => {
-          const of = base.filter((q) => q.repo === r2);
+        total: ofRole.length,
+        byRepo: Object.fromEntries([...new Set(ofRole.map((q) => q.repo))].sort().map((r2) => {
+          const of = ofRole.filter((q) => q.repo === r2);
           const k = (s) => of.filter((q) => q.state === s).length;
           return [
             r2,
@@ -2745,13 +2784,13 @@ function uiQuestionRoutes(r, ctx, deps = {}) {
     };
     return { status: 200, body };
   }).add("GET", "/api/owner-questions", async () => {
-    const { ownerQuestions } = await import("./chunk-M4H2UG4R.js");
+    const { ownerQuestions } = await import("./chunk-JRBFANFE.js");
     return { status: 200, body: await ownerQuestions(ctx.root, { now: now() }) };
   }).add("POST", "/api/owner-questions/{id}/answer", async ({ params, body }) => {
     const b = api_exports.OwnerAnswerRequest.safeParse(body ?? {});
     if (!b.success || !b.data.answer.trim())
       throw badRequest('Answer with { answer: "what the owner said" }.');
-    const { answerOwnerQuestion, OwnerQuestionError } = await import("./chunk-M4H2UG4R.js");
+    const { answerOwnerQuestion, OwnerQuestionError } = await import("./chunk-JRBFANFE.js");
     try {
       const r2 = await answerOwnerQuestion(ctx.root, params.id, b.data.answer, {
         by: ctx.user,
@@ -2776,13 +2815,13 @@ function uiQuestionRoutes(r, ctx, deps = {}) {
       throw notFound(`There is no question ${params.id}.`);
     if (q.askedBy.step !== TARGETS_STEP_ID && q.askedBy.step !== TOPICS_STEP_ID)
       throw new HttpError(422, "That question doesn't ask where a call goes or who owns a topic", `${q.id} isn't a targets or topics question, so it has no picker.`);
-    const { pickerOf } = await import("./chunk-IFFRGC3N.js");
+    const { pickerOf } = await import("./chunk-KFAVQZSX.js");
     return { status: 200, body: { picks: await pickerOf(ctx.root) } };
   }).add("GET", "/api/questions/{id}/evidence", async ({ params }) => {
     const q = await readQuestion(ctx.root, params.id).catch(() => void 0);
     if (!q)
       throw notFound(`There is no question ${params.id}.`);
-    const { evidenceExcerpts } = await import("./chunk-UFE36WJH.js");
+    const { evidenceExcerpts } = await import("./chunk-BIGDQDHD.js");
     return {
       status: 200,
       body: {
@@ -2805,7 +2844,7 @@ function uiQuestionRoutes(r, ctx, deps = {}) {
         const q0 = await readQuestion(ctx.root, params.id).catch(() => void 0);
         if (!q0)
           throw notFound(`There is no question ${params.id}.`);
-        const { targetAnswerOf, offerLine } = await import("./chunk-IFFRGC3N.js");
+        const { targetAnswerOf, offerLine } = await import("./chunk-KFAVQZSX.js");
         const t = await targetAnswerOf(ctx.root, q0, target, {
           ...addSystem ? { addSystem } : {},
           ...name ? { name } : {}
@@ -3049,8 +3088,9 @@ async function hopsFromTargetFlows(dir, mappings, interfaces) {
         rows: names.map((name, i) => ({
           line: i + 1,
           source: name,
-          target: as[name] ?? name,
-          rule: derived[name] ?? "",
+          // Review round 48: a field named toString or constructor is a field, not the prototype's.
+          target: (Object.hasOwn(as, name) ? as[name] : void 0) ?? name,
+          rule: (Object.hasOwn(derived, name) ? derived[name] : void 0) ?? "",
           whenMissing: ""
         })),
         asIs: asIsFor(mappings, ifIds),
@@ -3388,7 +3428,7 @@ function uiSpecRoutes(r, ctx) {
   });
   r.add("GET", "/api/changes/{changeId}/conformance", async ({ params }) => {
     const change = idOf2(params.changeId, "change");
-    const { conformanceOf } = await import("./chunk-FRHD22WM.js");
+    const { conformanceOf } = await import("./chunk-ZFFYNRIO.js");
     const c = await conformanceOf(root, change);
     if (!c)
       throw notFound(`There is no change ${change}.`);
@@ -3403,7 +3443,7 @@ function uiSpecRoutes(r, ctx) {
   });
   r.add("GET", "/api/changes/{changeId}/impact", async ({ params }) => {
     const change = idOf2(params.changeId, "change");
-    const { changeImpactOf } = await import("./chunk-2D7PWSOK.js");
+    const { changeImpactOf } = await import("./chunk-7MJSQTL5.js");
     const i = await changeImpactOf(root, change);
     if (!i)
       throw notFound(`There is no change ${change}.`);
@@ -4010,7 +4050,7 @@ async function configuredModel(root) {
 function uiModelRunRoutes(r, ctx, deps = {}) {
   const root = ctx.root;
   const runStep = deps.runStep ?? (async (args) => {
-    const { main } = await import("./chunk-7FHNFCHK.js");
+    const { main } = await import("./chunk-IUPG3UKI.js");
     const out = [];
     const err = [];
     const code = await main([...args, "--root", root], { out: (l) => out.push(l), err: (l) => err.push(l) }, { quiet: true });
@@ -4018,7 +4058,7 @@ function uiModelRunRoutes(r, ctx, deps = {}) {
   });
   return r.add("POST", "/api/runs/handoff", async ({ body }) => {
     const words = stepWords(body);
-    const { prepareStep } = await import("./chunk-J2O4LFVI.js");
+    const { prepareStep } = await import("./chunk-CBGGOQWU.js");
     const { code, prepared } = await prepareStep(root, runStep, words);
     ctx.events.publish({ type: "file.changed", path: runsRelOf(root) });
     if (!prepared.runId && code !== 0)
@@ -4213,10 +4253,10 @@ var CopilotRun = class {
 
 // packages/cli/dist/ui-api-copilot-runs.js
 var defaultStarter = (root) => async (o, io, deps) => {
-  const { mapAllCommand } = await import("./chunk-YF5DZCPN.js");
+  const { mapAllCommand } = await import("./chunk-VNU26RCO.js");
   return mapAllCommand(root, o, io, {
     ...deps,
-    makeAcp: async () => (await import("./chunk-ZPDDEVQX.js")).acpStepRunner(root)
+    makeAcp: async () => (await import("./chunk-JAVI7JSP.js")).acpStepRunner(root)
   });
 };
 var TAIL = 200;
@@ -4537,7 +4577,7 @@ function uiDecisionRoutes(r, ctx, deps = {}) {
         ctx.events.publish({ type: "file.changed", path });
     return { status: 200, body: out };
   }).add("GET", "/api/propose-answers", async () => {
-    const { openDecideRun, PROPOSE_CHANGE } = await import("./chunk-EFCQSMXB.js");
+    const { openDecideRun, PROPOSE_CHANGE } = await import("./chunk-EBL2R3YG.js");
     const run4 = await openDecideRun(ctx.root, PROPOSE_CHANGE);
     const body = run4 ? {
       state: "waiting",
@@ -4551,7 +4591,7 @@ function uiDecisionRoutes(r, ctx, deps = {}) {
     const op = await loadOrgPack(orgPackDirOf(ctx.root));
     if (op.runtime.ai === "off")
       throw conflict("runtime.yaml turns AI off here (ai: off): answer the questions yourself.");
-    const { startProposeHandoff } = await import("./chunk-ZPDDEVQX.js");
+    const { startProposeHandoff } = await import("./chunk-JAVI7JSP.js");
     const h = await startProposeHandoff(ctx.root, { now: now() });
     const body = {
       state: "waiting",
@@ -5000,11 +5040,38 @@ function uiHistoryRoutes(r, ctx) {
 
 // packages/cli/dist/ui-api-ai.js
 var import_yaml6 = __toESM(require_dist(), 1);
+import { execFileSync } from "node:child_process";
 import { existsSync as existsSync3 } from "node:fs";
 import { readFile as readFile8 } from "node:fs/promises";
-import { join as join10, relative, sep } from "node:path";
+import { basename, dirname as dirname3, join as join10, relative, sep } from "node:path";
 var unprocessable = (detail) => new HttpError(422, "The settings aren't valid", detail);
 var ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+function whereKeyGoes(m) {
+  const s = m?.settings ?? {};
+  const picked = Object.keys(s).filter((k) => k === "keyEnv" || k === "caFile" || /url|endpoint|host|address/i.test(k)).sort().map((k) => [k, s[k]]);
+  return JSON.stringify([m?.type ?? null, picked]);
+}
+function canonical(v) {
+  if (Array.isArray(v))
+    return `[${v.map(canonical).join(",")}]`;
+  if (v && typeof v === "object")
+    return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`).join(",")}}`;
+  return JSON.stringify(v ?? null);
+}
+function committedModel(file) {
+  try {
+    const text = execFileSync("git", ["show", `HEAD:./${basename(file)}`], {
+      cwd: dirname3(file),
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+    });
+    const raw = (0, import_yaml6.parse)(text) ?? {};
+    return { model: raw.adapters?.model };
+  } catch {
+    return void 0;
+  }
+}
 var FIELDS = ["ai", "modes", "assistants", "models", "budgets", "decide"];
 function uiAiRoutes(r, ctx, deps = {}) {
   const root = ctx.root;
@@ -5055,7 +5122,8 @@ function uiAiRoutes(r, ctx, deps = {}) {
         ],
         model: model ? { type: model.type, settings: model.settings } : null,
         // Whether the key's variable is set here, by name: its value is never read out.
-        keySet: keyEnv ? !!env[keyEnv]?.trim() || !!keys().get(keyEnv) : false,
+        // Review round 48: as the provider reads it, the environment only for a model's key.
+        keySet: keyEnv ? keyEnvFromEnvironment(keyEnv) && !!env[keyEnv]?.trim() || !!keys().get(keyEnv) : false,
         models: rt.models,
         budgets: rt.budgets,
         // Ninth UX walk (ADR 0181): whether the AI decides first, and the bar that pauses it.
@@ -5084,8 +5152,14 @@ function uiAiRoutes(r, ctx, deps = {}) {
               throw unprocessable(`${name} looks like a key. A key never goes in runtime.yaml: keep it in an environment variable (or the OS's credential store) and give that variable's name as keyEnv.`);
         if (settings.keyEnv !== void 0 && !ENV_NAME.test(String(settings.keyEnv)))
           throw unprocessable(`keyEnv is the name of an environment variable, such as ATTICUS_MODEL_KEY.`);
+        const keyEnv = settings.keyEnv === void 0 ? void 0 : String(settings.keyEnv);
+        if (keyEnv && !keyEnvFromEnvironment(keyEnv) && !keys().get(keyEnv))
+          throw unprocessable(`keyEnv ${keyEnv} isn't a model's key: name a variable starting ATTICUS_ (such as ATTICUS_MODEL_KEY) or the provider's own (such as ANTHROPIC_API_KEY or OPENAI_API_KEY), or keep the key in this machine's credential store under that name first ("Set the key on this machine", or atticus secret set ${keyEnv}). Another variable (a Git or pipeline token, cloud credentials) is never sent to a model.`);
         adapters.model = { type: m.type, settings };
       }
+      const was = raw.adapters?.model;
+      if (adapters.model !== void 0 && whereKeyGoes(was) !== whereKeyGoes(adapters.model))
+        requireConfirmation(ctx.confirmations, "ai-model", "model", b.confirmation);
       raw.adapters = adapters;
     }
     const names = (m) => {
@@ -5133,11 +5207,14 @@ function uiAiRoutes(r, ctx, deps = {}) {
       throw unprocessable("No key was given.");
     keys().set(name, value);
     return { status: 200, body: { ok: true, name } };
-  }).add("POST", "/api/settings/ai/test", async () => {
+  }).add("POST", "/api/settings/ai/test", async ({ body }) => {
     const op = await loadOrgPack(orgPackDirOf(root));
     const model = op.runtime.adapters.model;
     if (!model || model.type === "mock")
       throw conflict("No model provider is set in runtime.yaml: choose one first.");
+    const committed = committedModel(file());
+    if (!committed || canonical(committed.model) !== canonical(model))
+      requireConfirmation(ctx.confirmations, "ai-test", "model", body?.confirmation);
     const started = Date.now();
     try {
       const p = await build(op, model.type, model.settings);
@@ -5167,7 +5244,7 @@ function uiDocumentRoutes(r, ctx) {
   const root = ctx.root;
   const changed = (path) => ctx.events.publish({ type: "file.changed", path });
   return r.add("GET", "/api/knowledge/documents", async () => {
-    const { listDocuments } = await import("./chunk-URIKUID7.js");
+    const { listDocuments } = await import("./chunk-O4GXGGBX.js");
     return { status: 200, body: api_exports.DocumentList.parse(await listDocuments(root)) };
   }).add("POST", "/api/knowledge/documents", async ({ body }) => {
     const b = api_exports.AttachFileRequest.safeParse(body ?? {});
@@ -5176,7 +5253,7 @@ function uiDocumentRoutes(r, ctx) {
     const bytes = new Uint8Array(Buffer.from(b.data.content, "base64"));
     if (bytes.length > MAX_FILE)
       throw new HttpError(413, "The file is too large", "Add a file of 15 MB or less.");
-    const { addToInbox } = await import("./chunk-ZKYRDV7A.js");
+    const { addToInbox } = await import("./chunk-UWMJKX5U.js");
     const res = await addToInbox(root, [{ name: b.data.name, bytes }]);
     if (!res.added.length)
       throw new HttpError(422, "Atticus can't add that", res.refused[0]?.why ?? "", {
@@ -5186,7 +5263,7 @@ function uiDocumentRoutes(r, ctx) {
       changed(a.path);
     return { status: 201, body: api_exports.AddDocumentResult.parse(res) };
   }, { maxBody: Math.ceil(MAX_FILE * 4 / 3) + 64 * 1024 }).add("POST", "/api/changes/{changeId}/inputs/{name}/promote", async ({ params }) => {
-    const { AttachError, promoteChangeInput } = await import("./chunk-XQ3YZ4QW.js");
+    const { AttachError, promoteChangeInput } = await import("./chunk-LDLL7LB3.js");
     try {
       const res = await promoteChangeInput(root, params.changeId, params.name);
       changed(res.path);
@@ -5203,13 +5280,13 @@ function uiDocumentRoutes(r, ctx) {
 function uiRepoRoutes(r, ctx) {
   const root = ctx.root;
   return r.add("GET", "/api/repos/branches", async () => {
-    const { repoBranches } = await import("./chunk-YBOVNMHC.js");
+    const { repoBranches } = await import("./chunk-M32BLWDH.js");
     return { status: 200, body: api_exports.RepoBranchesList.parse(await repoBranches(root)) };
   }).add("GET", "/api/repos/compare", async ({ query }) => {
     const branch = query.get("branch")?.trim() ?? "";
     if (!branch)
       throw badRequest("Say which branch: ?branch=<name>.");
-    const { compareBranch } = await import("./chunk-YBOVNMHC.js");
+    const { compareBranch } = await import("./chunk-M32BLWDH.js");
     const c = await compareBranch(root, branch);
     if (!c)
       throw notFound(`${branch} hasn't been scanned beside the baseline yet.`);
@@ -5218,7 +5295,7 @@ function uiRepoRoutes(r, ctx) {
     const b = api_exports.EditRepoBranchesRequest.safeParse(body ?? {});
     if (!b.success)
       throw badRequest("Send defaultBranch and branches as branch names.");
-    const { editRepoBranches, RepoEditError } = await import("./chunk-YBOVNMHC.js");
+    const { editRepoBranches, RepoEditError } = await import("./chunk-M32BLWDH.js");
     try {
       const file = await editRepoBranches(root, params.repoId, b.data);
       ctx.events.publish({ type: "file.changed", path: file });
@@ -5238,7 +5315,7 @@ function uiRepoRoutes(r, ctx) {
     const b = api_exports.EditRepoBuildRequest.safeParse(body ?? {});
     if (!b.success)
       throw badRequest('Send the build command as build ("" clears it), up to 500 characters.');
-    const { editRepoBuild, RepoEditError } = await import("./chunk-YBOVNMHC.js");
+    const { editRepoBuild, RepoEditError } = await import("./chunk-M32BLWDH.js");
     try {
       const r2 = await editRepoBuild(root, params.repoId, b.data);
       ctx.events.publish({ type: "file.changed", path: r2.file });
@@ -5259,7 +5336,7 @@ function uiRepoRoutes(r, ctx) {
     const b = api_exports.SetOrgPackOwnerRequest.safeParse(body ?? {});
     if (!b.success)
       throw badRequest("Send the owner as one handle: { owner }.");
-    const { setOrgPackOwner, OwnerEditError } = await import("./chunk-PQH56YF6.js");
+    const { setOrgPackOwner, OwnerEditError } = await import("./chunk-KXITGYLF.js");
     try {
       const r2 = await setOrgPackOwner(root, b.data.owner, b.data.was);
       ctx.events.publish({ type: "file.changed", path: r2.file });
@@ -5280,7 +5357,7 @@ function uiRepoRoutes(r, ctx) {
     const b = api_exports.EditRepoDescriptionRequest.safeParse(body ?? {});
     if (!b.success)
       throw badRequest("Send what the repo is as text, or accept: true to confirm the draft, or reject: true to drop it.");
-    const { editRepoDescription, RepoEditError } = await import("./chunk-YBOVNMHC.js");
+    const { editRepoDescription, RepoEditError } = await import("./chunk-M32BLWDH.js");
     try {
       const r2 = await editRepoDescription(root, params.repoId, b.data);
       ctx.events.publish({ type: "file.changed", path: r2.file });
@@ -5301,13 +5378,19 @@ function uiRepoRoutes(r, ctx) {
 }
 
 // packages/cli/dist/ui-api-cockpit.js
+function changeIdOf(v) {
+  if (!RecordId.safeParse(v).success)
+    throw badRequest(`${JSON.stringify(v.slice(0, 120))} isn't a change id.`);
+  return v;
+}
 function uiCockpitRoutes(r, ctx) {
   return r.add("GET", "/api/changes/{changeId}/cockpit", async ({ params }) => {
-    const { cockpit } = await import("./chunk-6EXDI5GI.js");
+    const id = changeIdOf(params.changeId);
+    const { cockpit } = await import("./chunk-ZFL7NY4F.js");
     try {
       return {
         status: 200,
-        body: api_exports.ChangeCockpit.parse(await cockpit(ctx.root, params.changeId, { user: ctx.user }))
+        body: api_exports.ChangeCockpit.parse(await cockpit(ctx.root, id, { user: ctx.user }))
       };
     } catch (e) {
       if (e instanceof Error && e.name === "ChangeFileError")
@@ -5315,8 +5398,9 @@ function uiCockpitRoutes(r, ctx) {
       throw e;
     }
   }).add("GET", "/api/past-changes", async ({ query }) => {
-    const { changeAboutText, similarChanges } = await import("./chunk-BC6KKZ67.js");
-    const change = query.get("change");
+    const { changeAboutText, similarChanges } = await import("./chunk-W7VWI2YH.js");
+    const given = query.get("change");
+    const change = given ? changeIdOf(given) : void 0;
     const text = change ? await changeAboutText(ctx.root, change) : query.get("text")?.trim();
     if (change && !text)
       throw notFound(`There is no change ${change}.`);
@@ -5333,11 +5417,11 @@ function uiCockpitRoutes(r, ctx) {
     const b = api_exports.AttachPastChangeRequest.safeParse(body ?? {});
     if (!b.success)
       throw badRequest("Say which archived change: { like: <its folder or id> }.");
-    const { attachPastChange, findPastChange } = await import("./chunk-BC6KKZ67.js");
+    const { attachPastChange, findPastChange } = await import("./chunk-W7VWI2YH.js");
     const folder = await findPastChange(ctx.root, b.data.like);
     if (!folder)
       throw notFound(`There is no archived change ${b.data.like}.`);
-    const { AttachError } = await import("./chunk-XQ3YZ4QW.js");
+    const { AttachError } = await import("./chunk-LDLL7LB3.js");
     try {
       const name = await attachPastChange(ctx.root, params.changeId, folder, ctx.user);
       ctx.events.publish({ type: "file.changed", path: `inputs/${name}` });
@@ -6142,6 +6226,7 @@ async function startUi(root, o = {}, deps = {}) {
     ...o.embed ? { embed: o.embed } : {},
     ...o.full ? { full: true } : {},
     ...o.token ? { token: o.token } : {},
+    ...o.pageKey ? { pageKey: o.pageKey } : {},
     staticDir: o.staticDir ?? uiDistDir(),
     ...o.user ? { user: o.user } : {},
     ...o.version ? { version: o.version } : {},
@@ -6222,16 +6307,23 @@ function untilStopped(embedded, stdin = process.stdin, o = {}) {
 function startedLines(url, token, o) {
   return [
     `Atticus is running at ${url} (Ctrl+C stops it).`,
-    o.embed || o.parent !== void 0 ? "The session token isn't printed: the editor that started the app has it." : o.showToken ? `For assistants and scripts, the session token is ${token}` : "The page has the session token; --show-token prints it for an assistant or a script."
+    o.embed || o.parent !== void 0 ? "The session token isn't printed: the editor that started the app has it." : o.showToken ? `For assistants and scripts, the session token is ${token}` : "The page has the session token; --show-token prints it for an assistant or a script.",
+    // ADR 0186: what the printed token can't do, said where it is printed.
+    ...o.showToken && !o.embed && o.parent === void 0 ? [
+      "It doesn't approve a write to a shared system (a PR, a push, a merge, a message): a person confirms those in the app, or runs the command with --approve."
+    ] : []
   ];
 }
 async function uiCommand(root, o, io) {
   const given = o.embed ? process.env.ATTICUS_UI_TOKEN : void 0;
   delete process.env.ATTICUS_UI_TOKEN;
+  const pageKey = o.embed ? process.env.ATTICUS_UI_PAGE_KEY : void 0;
+  delete process.env.ATTICUS_UI_PAGE_KEY;
   let srv;
   try {
     srv = await startUi(root, {
       ...given ? { token: given } : {},
+      ...pageKey ? { pageKey } : {},
       warm: true,
       ...o.full ? { full: true } : {},
       ...o.port !== void 0 ? { port: o.port } : {},