@mgsoftwarebv/mg-dashboard-mcp 7.4.13 → 7.4.15

package/dist/index.js

@@ -13,6 +13,7 @@ import crypto, { randomUUID, createHash, randomBytes, createCipheriv, createDeci
 import { readFile, mkdtemp, writeFile, rm } from 'fs/promises';
 import { createServer } from 'http';
 import { tmpdir } from 'os';
+import { AsyncLocalStorage } from 'async_hooks';
 import { drizzle } from 'drizzle-orm/postgres-js';
 import postgres from 'postgres';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
@@ -454,6 +455,12 @@ var init_db_ssh_tunnel = __esm({
   "src/db-ssh-tunnel.ts"() {
   }
 });
+new AsyncLocalStorage();
+var reportingContext = new AsyncLocalStorage();
+function maybeReportSlowQuery(durationMs, query) {
+  if (reportingContext.getStore()) return;
+  return;
+}
 function getConnectionConfig() {
   return {
     prepare: false,
@@ -490,7 +497,20 @@ function getPool() {
 }
 function getDb() {
   if (!_db) {
-    _db = drizzle(getPool(), { casing: "snake_case" });
+    const raw = drizzle(getPool(), { casing: "snake_case" });
+    const originalExecute = raw.execute.bind(raw);
+    raw.execute = ((query) => {
+      const start = performance.now();
+      const result = originalExecute(query);
+      if (result && typeof result.then === "function") {
+        return result.finally(() => {
+          maybeReportSlowQuery(performance.now() - start);
+        });
+      }
+      maybeReportSlowQuery(performance.now() - start);
+      return result;
+    });
+    _db = raw;
   }
   return _db;
 }
@@ -703,10 +723,10 @@ var TRIGGER_TOOL_MODULE_MAP = {
   "trigger-env": "settings"
 };
 async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
-  const sql29 = `SELECT re.\\"apiKey\\" || '~~' || p.\\"externalRef\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
+  const sql31 = `SELECT re.\\"apiKey\\" || '~~' || p.\\"externalRef\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
   const cmd = [
     `PORT=$(docker port "${WA_CONTAINER}" 3000/tcp 2>/dev/null | head -1 | sed 's/.*://')`,
-    `ROW=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql29}" 2>/dev/null | tr -d '[:space:]')`,
+    `ROW=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql31}" 2>/dev/null | tr -d '[:space:]')`,
     'echo "$PORT|$ROW"'
   ].join(" && ");
   const result = await sshExec2(conn, cmd, proxy);
@@ -728,8 +748,8 @@ async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
   return { port, apiKey: apiKey2, projectRef: projectRef || "" };
 }
 async function fetchRunLogs(runId, conn, proxy, sshExec2) {
-  const sql29 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
-  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql29}" 2>/dev/null`;
+  const sql31 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
+  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql31}" 2>/dev/null`;
   const result = await sshExec2(conn, cmd, proxy);
   const output = result.stdout.trim();
   if (!output) return "";
@@ -811,8 +831,8 @@ async function handleTriggerTool(name, args2, deps) {
   switch (name) {
     // -----------------------------------------------------------------
     case "trigger-list": {
-      const sql29 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
-      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql29}" 2>/dev/null`;
+      const sql31 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
+      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql31}" 2>/dev/null`;
       const result = await sshExec2(conn, cmd, proxy);
       const output = result.stdout.trim();
       if (!output) {
@@ -990,9 +1010,9 @@ ${raw2.substring(0, 500)}` }] };
           return { content: [{ type: "text", text: `No environment variables for ${project}/${env}.` }] };
         }
         const lines = vars.map((v) => `${v.isSecret ? "[secret]" : "        "}  ${v.name}`).sort();
-        const text19 = `Env vars for ${project}/${env} (${vars.length}) \u2014 values hidden, use action="get" with a key:
+        const text22 = `Env vars for ${project}/${env} (${vars.length}) \u2014 values hidden, use action="get" with a key:
 ` + "-".repeat(50) + "\n" + lines.join("\n");
-        return { content: [{ type: "text", text: text19 }] };
+        return { content: [{ type: "text", text: text22 }] };
       }
       if (action === "get") {
         const key2 = String(args2.key ?? "");
@@ -1079,9 +1099,9 @@ async function fetchAndFormatRun(conn, proxy, sshExec2, instance, runId) {
     return { content: [{ type: "text", text: `Invalid API response:
 ${rawJson.substring(0, 500)}` }] };
   }
-  let text19 = formatRunDetail(run);
-  if (logs) text19 += "\n\n--- Logs ---\n" + logs;
-  return { content: [{ type: "text", text: text19 }] };
+  let text22 = formatRunDetail(run);
+  if (logs) text22 += "\n\n--- Logs ---\n" + logs;
+  return { content: [{ type: "text", text: text22 }] };
 }
 async function waitForCompletion(conn, proxy, sshExec2, instance, runId, waitSeconds) {
   const pollInterval = 3e3;
@@ -1103,10 +1123,10 @@ async function waitForCompletion(conn, proxy, sshExec2, instance, runId, waitSec
       continue;
     }
     if (TERMINAL_STATUSES.has(run.status)) {
-      let text19 = formatRunDetail(run);
+      let text22 = formatRunDetail(run);
       const logs = await fetchRunLogs(runId, conn, proxy, sshExec2);
-      if (logs) text19 += "\n\n--- Logs ---\n" + logs;
-      return { content: [{ type: "text", text: text19 }] };
+      if (logs) text22 += "\n\n--- Logs ---\n" + logs;
+      return { content: [{ type: "text", text: text22 }] };
     }
   }
   return {
@@ -1116,6 +1136,128 @@ async function waitForCompletion(conn, proxy, sshExec2, instance, runId, waitSec
     }]
   };
 }
+
+// src/github-code-access-tools.ts
+var GITHUB_CODE_ACCESS_TOOLS = [
+  {
+    name: "get_mg_dashboard_file",
+    description: "Read ONE source file at a git ref for an allowlisted GitHub org/repo (CODE_BATTLE_GITHUB_ORGS, default MGSoftwareBV). Use after get_mg_dashboard_commits when commit subjects are not enough to judge exists / polish / new. Returns metadata + text content (secrets redacted). Credential paths (.env, keys) are denied. Binary files return { binary: true } with no payload. Full diffs are never attached to get_mg_dashboard_commits \u2014 use get_mg_dashboard_diff for a compact patch.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repository: {
+          type: "string",
+          description: "owner/repo, e.g. MGSoftwareBV/mg-dashboard. Org must be allowlisted."
+        },
+        ref: {
+          type: "string",
+          description: "Commit sha, branch, or tag."
+        },
+        path: {
+          type: "string",
+          description: "File path inside the repo (not a directory)."
+        }
+      },
+      required: ["repository", "ref", "path"]
+    }
+  },
+  {
+    name: "get_mg_dashboard_diff",
+    description: "Fetch a COMPACT unified diff for one commit sha XOR one pull request number, same org allowlist as get_mg_dashboard_file. Returns per-file path/status/+/- and a truncated patch (secrets redacted). Binary files are omitted. Does not change get_mg_dashboard_commits (metadata-only by design).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repository: {
+          type: "string",
+          description: "owner/repo, e.g. MGSoftwareBV/mg-dashboard. Org must be allowlisted."
+        },
+        sha: {
+          type: "string",
+          description: "Commit sha. Provide exactly one of sha or pullNumber."
+        },
+        pullNumber: {
+          type: "number",
+          description: "Pull request number. Provide exactly one of sha or pullNumber."
+        }
+      },
+      required: ["repository"]
+    }
+  }
+];
+async function handleGithubCodeAccessTool(name, args2, ctx) {
+  if (name === "get_mg_dashboard_file") {
+    const repository = typeof args2.repository === "string" ? args2.repository.trim() : "";
+    const ref = typeof args2.ref === "string" ? args2.ref.trim() : "";
+    const path = typeof args2.path === "string" ? args2.path.trim() : "";
+    if (!repository || !ref || !path) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: "Error: repository, ref and path are required"
+          }
+        ]
+      };
+    }
+    return proxyJson(ctx, "/api/activity/file", { repository, ref, path });
+  }
+  if (name === "get_mg_dashboard_diff") {
+    const repository = typeof args2.repository === "string" ? args2.repository.trim() : "";
+    if (!repository) {
+      return {
+        content: [
+          { type: "text", text: "Error: repository is required" }
+        ]
+      };
+    }
+    const sha = typeof args2.sha === "string" ? args2.sha.trim() : void 0;
+    const pullNumber = typeof args2.pullNumber === "number" ? args2.pullNumber : void 0;
+    const hasSha = Boolean(sha);
+    const hasPr = pullNumber != null;
+    if (hasSha === hasPr) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: "Error: provide exactly one of sha or pullNumber"
+          }
+        ]
+      };
+    }
+    return proxyJson(ctx, "/api/activity/diff", {
+      repository,
+      ...hasSha ? { sha } : { pullNumber }
+    });
+  }
+  return {
+    content: [{ type: "text", text: `Error: unknown tool ${name}` }]
+  };
+}
+async function proxyJson(ctx, route, body) {
+  const res = await fetch(`${ctx.dashboardBaseUrl}${route}`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${ctx.apiKey}`
+    },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Error: mg-dashboard ${route} failed (${res.status}). ${detail.slice(0, 300)}`
+        }
+      ]
+    };
+  }
+  const data = await res.json();
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
 var ALGORITHM = "aes-256-gcm";
 var IV_LENGTH = 16;
 var AUTH_TAG_LENGTH = 16;
@@ -3793,10 +3935,10 @@ var ZodObject = class _ZodObject extends ZodType {
   //   }) as any;
   //   return merged;
   // }
-  catchall(index16) {
+  catchall(index19) {
     return new _ZodObject({
       ...this._def,
-      catchall: index16
+      catchall: index19
     });
   }
   pick(mask) {
@@ -4114,9 +4256,9 @@ function mergeValues(a, b) {
       return { valid: false };
     }
     const newArray = [];
-    for (let index16 = 0; index16 < a.length; index16++) {
-      const itemA = a[index16];
-      const itemB = b[index16];
+    for (let index19 = 0; index19 < a.length; index19++) {
+      const itemA = a[index19];
+      const itemB = b[index19];
       const sharedValue = mergeValues(itemA, itemB);
       if (!sharedValue.valid) {
         return { valid: false };
@@ -4322,10 +4464,10 @@ var ZodMap = class extends ZodType {
     }
     const keyType = this._def.keyType;
     const valueType = this._def.valueType;
-    const pairs = [...ctx.data.entries()].map(([key, value], index16) => {
+    const pairs = [...ctx.data.entries()].map(([key, value], index19) => {
       return {
-        key: keyType._parse(new ParseInputLazyPath(ctx, key, ctx.path, [index16, "key"])),
-        value: valueType._parse(new ParseInputLazyPath(ctx, value, ctx.path, [index16, "value"]))
+        key: keyType._parse(new ParseInputLazyPath(ctx, key, ctx.path, [index19, "key"])),
+        value: valueType._parse(new ParseInputLazyPath(ctx, value, ctx.path, [index19, "value"]))
       };
     });
     if (ctx.common.async) {
@@ -5340,13 +5482,19 @@ pgTable(
     verifyNote: text("verify_note"),
     dirty: boolean("dirty").notNull().default(false),
     vaultSyncedAt: timestamp("vault_synced_at", { withTimezone: true }),
+    /** Reviewer / itemized-phase lease holder. */
+    claimedBy: text("claimed_by"),
+    claimedAt: timestamp("claimed_at", { withTimezone: true }),
+    /** Expired leases are reclaimable by any runner. */
+    leaseExpiresAt: timestamp("lease_expires_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     index("idx_wiki_page_status").on(table.status),
     index("idx_wiki_page_last_verified").on(table.lastVerifiedOn),
-    index("idx_wiki_page_dirty").on(table.dirty)
+    index("idx_wiki_page_dirty").on(table.dirty),
+    index("idx_wiki_page_lease_expires").on(table.leaseExpiresAt).where(sql`${table.leaseExpiresAt} IS NOT NULL`)
   ]
 );
 pgTable(
@@ -5391,11 +5539,9 @@ pgTable(
     resolvedAt: timestamp("resolved_at", { withTimezone: true })
   },
   (table) => [
-    uniqueIndex("wiki_page_evidence_page_slug_evidence_type_evidence_ref_key").on(
-      table.pageSlug,
-      table.evidenceType,
-      table.evidenceRef
-    ),
+    uniqueIndex(
+      "wiki_page_evidence_page_slug_evidence_type_evidence_ref_key"
+    ).on(table.pageSlug, table.evidenceType, table.evidenceRef),
     index("idx_wiki_page_evidence_created").on(table.createdAt)
   ]
 );
@@ -5450,6 +5596,65 @@ pgTable(
     )
   ]
 );
+pgTable(
+  "wiki_invariant_violation",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    slug: text("slug").notNull(),
+    code: text("code").notNull(),
+    severity: text("severity").notNull().default("warning"),
+    detail: text("detail").notNull().default(""),
+    suggestedFix: text("suggested_fix"),
+    suggestedSlug: text("suggested_slug"),
+    occurrenceCount: integer("occurrence_count").notNull().default(1),
+    reopenCount: integer("reopen_count").notNull().default(0),
+    firstSeenAt: timestamp("first_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    resolvedAt: timestamp("resolved_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("wiki_invariant_violation_slug_code_key").on(
+      table.slug,
+      table.code
+    ),
+    index("idx_wiki_invariant_violation_severity").on(
+      table.severity,
+      table.resolvedAt
+    )
+  ]
+);
+pgTable(
+  "wiki_pipeline_rule",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    scope: text("scope").notNull(),
+    ruleKey: text("rule_key").notNull(),
+    text: text("text").notNull(),
+    /** A = deterministic auto-applied, B = judgement, gated by insight accept. */
+    tier: text("tier").notNull().default("B"),
+    status: text("status").notNull().default("proposed"),
+    sourceCode: text("source_code"),
+    evidenceRefs: text("evidence_refs").array().notNull().default([]),
+    violationCount: integer("violation_count").notNull().default(0),
+    lastViolationAt: timestamp("last_violation_at", { withTimezone: true }),
+    activatedAt: timestamp("activated_at", { withTimezone: true }),
+    retiredAt: timestamp("retired_at", { withTimezone: true }),
+    retiredReason: text("retired_reason"),
+    rejectedAt: timestamp("rejected_at", { withTimezone: true }),
+    rejectedReason: text("rejected_reason"),
+    approvedBy: text("approved_by"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("wiki_pipeline_rule_scope_key_key").on(
+      table.scope,
+      table.ruleKey
+    )
+  ]
+);
 pgTable(
   "wiki_search_log",
   {
@@ -5477,6 +5682,69 @@ pgTable(
   },
   (table) => [index("idx_team_memory_search_log_created").on(table.createdAt)]
 );
+pgTable(
+  "wiki_agent_run",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    phase: text("phase").notNull(),
+    model: text("model"),
+    claimed: jsonb("claimed").$type(),
+    proven: jsonb("proven").$type(),
+    violationCount: integer("violation_count").notNull().default(0),
+    violations: jsonb("violations").$type(),
+    outcome: text("outcome").notNull().default("ok"),
+    agentId: text("agent_id"),
+    runId: text("run_id"),
+    passId: text("pass_id"),
+    changedPaths: jsonb("changed_paths").$type(),
+    summary: text("summary"),
+    userVerdict: text("user_verdict"),
+    userVerdictNote: text("user_verdict_note"),
+    verdictAt: timestamp("verdict_at", { withTimezone: true }),
+    reviewed: boolean("reviewed").notNull().default(false),
+    reviewNotes: text("review_notes"),
+    reviewedAt: timestamp("reviewed_at", { withTimezone: true }),
+    startedAt: timestamp("started_at", { withTimezone: true }),
+    finishedAt: timestamp("finished_at", { withTimezone: true }).notNull().defaultNow(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("idx_wiki_agent_run_phase_created").on(table.phase, table.createdAt),
+    index("idx_wiki_agent_run_created").on(table.createdAt),
+    index("idx_wiki_agent_run_reviewed").on(table.reviewed),
+    index("idx_wiki_agent_run_user_verdict").on(table.userVerdict),
+    index("idx_wiki_agent_run_pass_id").on(table.passId)
+  ]
+);
+pgTable(
+  "wiki_agent_review_suggestion",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    status: text("status").notNull().default("proposed"),
+    implementationClass: text("implementation_class").notNull(),
+    phase: text("phase"),
+    scope: text("scope"),
+    title: text("title").notNull(),
+    summary: text("summary").notNull(),
+    targetFile: text("target_file"),
+    targetKey: text("target_key"),
+    beforeText: text("before_text"),
+    afterText: text("after_text"),
+    evidenceRunIds: uuid("evidence_run_ids").array().notNull().default([]),
+    evidenceRefs: text("evidence_refs").array().notNull().default([]),
+    dedupeKey: text("dedupe_key").notNull(),
+    source: text("source").notNull().default("auto"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("wiki_agent_review_suggestion_dedupe_key").on(table.dedupeKey),
+    index("idx_wiki_agent_review_suggestion_status_created").on(
+      table.status,
+      table.createdAt
+    )
+  ]
+);
 
 // ../db/src/schema/agent-memory.ts
 pgTable(
@@ -5521,6 +5789,88 @@ pgTable(
     index("idx_agent_memory_category").on(table.category)
   ]
 );
+var agentWorldAgent = pgTable(
+  "agent_world_agent",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    name: text("name").notNull(),
+    color: text("color").notNull(),
+    /** Personality sliders 0–100: curiosity, sociability, diligence, calm. */
+    personality: jsonb("personality").$type().notNull().default({
+      curiosity: 50,
+      sociability: 50,
+      diligence: 50,
+      calm: 50
+    }),
+    /** Needs 0–100: higher = more urgent. */
+    needs: jsonb("needs").$type().notNull().default({ energy: 40, coffee: 30, focus: 35, social: 25 }),
+    position: jsonb("position").$type().notNull().default({ x: 0, y: 0, z: 0 }),
+    target: jsonb("target").$type(),
+    activity: text("activity").notNull().default("idle"),
+    waypoint: text("waypoint"),
+    memories: jsonb("memories").$type().notNull().default([]),
+    diaryCount: integer("diary_count").notNull().default(0),
+    lastSay: text("last_say"),
+    lastSayAt: timestamp("last_say_at", { withTimezone: true }),
+    sortOrder: integer("sort_order").notNull().default(0),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [index("idx_agent_world_agent_sort").on(table.sortOrder)]
+);
+pgTable(
+  "agent_world_event",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    /** say | diary | think | god | activity | memo | system */
+    type: text("type").notNull(),
+    agentId: uuid("agent_id").references(() => agentWorldAgent.id, {
+      onDelete: "set null"
+    }),
+    message: text("message").notNull(),
+    meta: jsonb("meta").$type().notNull().default({}),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("idx_agent_world_event_created").on(table.createdAt),
+    index("idx_agent_world_event_type").on(table.type),
+    index("idx_agent_world_event_agent").on(table.agentId),
+    // Diary / per-agent feed: WHERE agent_id ORDER BY created_at DESC LIMIT N
+    index("idx_agent_world_event_agent_created").on(
+      table.agentId,
+      table.createdAt
+    )
+  ]
+);
+pgTable(
+  "agent_world_memo",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    agentId: uuid("agent_id").references(() => agentWorldAgent.id, {
+      onDelete: "set null"
+    }),
+    title: text("title").notNull(),
+    content: text("content").notNull(),
+    location: text("location").notNull().default("whiteboard"),
+    reads: integer("reads").notNull().default(0),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("idx_agent_world_memo_created").on(table.createdAt),
+    index("idx_agent_world_memo_location").on(table.location)
+  ]
+);
+pgTable("agent_world_state", {
+  id: text("id").primaryKey().default("world"),
+  tick: integer("tick").notNull().default(0),
+  /** Simulated minutes since day start (0–1439 wraps). */
+  simMinutes: integer("sim_minutes").notNull().default(540),
+  paused: boolean("paused").notNull().default(false),
+  lastThinkAt: timestamp("last_think_at", { withTimezone: true }),
+  lastThinkAgentId: uuid("last_think_agent_id"),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
 var contentSourceType = pgEnum("content_source_type", [
   "own_site",
   "client_site",
@@ -6086,7 +6436,11 @@ pgTable(
       table.resourceId,
       table.metric,
       table.sampledAt
-    )
+    ),
+    // Retention cleanup (monitoring-sample-retention-cleanup) filters only on
+    // sampled_at. Without this index Postgres seq-scans the full firehose.
+    // Live DB name uses idx_ prefix (see migration 20260731070000).
+    index("idx_monitoring_sample_sampled_at").on(table.sampledAt)
   ]
 );
 var appLogSource = pgTable(
@@ -6420,7 +6774,8 @@ var directorySubmissionStatus = pgEnum(
     "rejected",
     "failed",
     "manual",
-    "captcha"
+    "captcha",
+    "skipped"
   ]
 );
 var directoryAccountStatus = pgEnum("directory_account_status", [
@@ -6444,6 +6799,13 @@ var linkDirectory = pgTable(
     automationLevel: directoryAutomationLevel("automation_level").notNull().default("auto"),
     enabled: boolean("enabled").notNull().default(false),
     formMapping: jsonb("form_mapping").$type(),
+    /** Set when a submission for this directory reached live/submitted end-to-end. */
+    provenAt: timestamp("proven_at", { withTimezone: true }),
+    successCount: integer("success_count").notNull().default(0),
+    failCount: integer("fail_count").notNull().default(0),
+    /** Hard captcha (even after residential) — disable after CAPTCHA_STRIKE_LIMIT. */
+    captchaStrike: integer("captcha_strike").notNull().default(0),
+    lastOutcome: text("last_outcome"),
     lastCheckedAt: timestamp("last_checked_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -6451,7 +6813,8 @@ var linkDirectory = pgTable(
   (table) => [
     uniqueIndex("link_directory_submit_url_uidx").on(table.submitUrl),
     index("link_directory_enabled_dr_idx").on(table.enabled, table.dr),
-    index("link_directory_region_idx").on(table.region)
+    index("link_directory_region_idx").on(table.region),
+    index("link_directory_proven_at_idx").on(table.provenAt)
   ]
 );
 var linkBuildingClient = pgTable(
@@ -6463,19 +6826,26 @@ var linkBuildingClient = pgTable(
     mailboxAddress: text("mailbox_address"),
     refrontMailAccountId: text("refront_mail_account_id"),
     profile: jsonb("profile").$type().notNull().default({}),
-    weeklyPace: integer("weekly_pace").notNull().default(12),
+    weeklyPace: integer("weekly_pace").notNull().default(35),
     /** Target package size (number of directory backlinks sold). */
     packageSize: integer("package_size").notNull().default(100),
-    autoSubmit: boolean("auto_submit").notNull().default(false),
+    autoSubmit: boolean("auto_submit").notNull().default(true),
     startingDr: doublePrecision("starting_dr"),
     currentDr: doublePrecision("current_dr"),
     isActive: boolean("is_active").notNull().default(true),
+    /** Opaque token for public customer progress reports (backlinking.eu). */
+    reportToken: text("report_token"),
+    /** External shop order id from backlinking.eu checkout. */
+    shopOrderId: text("shop_order_id"),
+    shopCustomerEmail: text("shop_customer_email"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
     uniqueIndex("link_building_client_website_uidx").on(table.websiteUrl),
-    index("link_building_client_active_idx").on(table.isActive)
+    index("link_building_client_active_idx").on(table.isActive),
+    uniqueIndex("link_building_client_report_token_uidx").on(table.reportToken),
+    index("link_building_client_shop_order_idx").on(table.shopOrderId)
   ]
 );
 var directorySubmission = pgTable(
@@ -6583,6 +6953,78 @@ pgTable(
     )
   ]
 );
+var networkListingStatus = pgEnum("network_listing_status", [
+  "pending",
+  "queued",
+  "placing",
+  "live",
+  "failed",
+  "expired",
+  "cancelled"
+]);
+var networkSite = pgTable(
+  "network_site",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    name: text("name").notNull(),
+    domain: text("domain").notNull(),
+    websiteUrl: text("website_url").notNull(),
+    dr: integer("dr").notNull().default(0),
+    theme: text("theme").notNull().default("general"),
+    /** Yearly listing price in euro cents. */
+    priceYearCents: integer("price_year_cents").notNull().default(9900),
+    categories: jsonb("categories").$type().notNull().default([]),
+    /** GitHub repo for placement commits, e.g. MGSoftwareBV/catalogcompany.nl */
+    repoFullName: text("repo_full_name"),
+    /** Path in repo for partner/listing data (relative). */
+    listingDataPath: text("listing_data_path"),
+    dofollow: boolean("dofollow").notNull().default(true),
+    enabled: boolean("enabled").notNull().default(false),
+    maxListings: integer("max_listings").notNull().default(50),
+    notes: text("notes"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("network_site_domain_uidx").on(table.domain),
+    index("network_site_enabled_dr_idx").on(table.enabled, table.dr),
+    index("network_site_theme_idx").on(table.theme)
+  ]
+);
+pgTable(
+  "network_listing",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    siteId: uuid("site_id").notNull().references(() => networkSite.id, { onDelete: "cascade" }),
+    clientId: uuid("client_id").references(() => linkBuildingClient.id, {
+      onDelete: "set null"
+    }),
+    customerName: text("customer_name").notNull(),
+    customerEmail: text("customer_email").notNull(),
+    targetUrl: text("target_url").notNull(),
+    anchorText: text("anchor_text").notNull(),
+    categorySlug: text("category_slug").notNull().default("general"),
+    status: networkListingStatus("status").notNull().default("pending"),
+    listingUrl: text("listing_url"),
+    /** External shop order reference from backlinking.eu */
+    shopOrderId: text("shop_order_id"),
+    shopOrderItemId: text("shop_order_item_id"),
+    priceCents: integer("price_cents").notNull().default(0),
+    startsAt: timestamp("starts_at", { withTimezone: true }),
+    renewsAt: timestamp("renews_at", { withTimezone: true }),
+    placedAt: timestamp("placed_at", { withTimezone: true }),
+    lastError: text("last_error"),
+    log: jsonb("log").$type().notNull().default({}),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("network_listing_site_status_idx").on(table.siteId, table.status),
+    index("network_listing_client_idx").on(table.clientId),
+    index("network_listing_renews_at_idx").on(table.renewsAt),
+    index("network_listing_shop_order_idx").on(table.shopOrderId)
+  ]
+);
 pgTable("github_api_budget", {
   tokenKey: text("token_key").primaryKey(),
   windowStartedAt: timestamp("window_started_at", { withTimezone: true }).notNull().defaultNow(),
@@ -6611,6 +7053,7 @@ pgTable(
     requestCount: integer("request_count").notNull().default(0),
     errorCount: integer("error_count").notNull().default(0),
     cacheHitCount: integer("cache_hit_count").notNull().default(0),
+    breakerHitCount: integer("breaker_hit_count").notNull().default(0),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
@@ -6655,11 +7098,66 @@ pgTable(
     index("github_webhook_secret_owner_idx").on(table.owner)
   ]
 );
+var gscOpportunityPass = pgTable(
+  "gsc_opportunity_pass",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    siteKey: text("site_key").notNull(),
+    gscProperty: text("gsc_property").notNull(),
+    passedAt: timestamp("passed_at", { withTimezone: true }).notNull().defaultNow(),
+    kind: text("kind").notNull(),
+    headline: text("headline"),
+    windowFrom: date("window_from"),
+    windowTo: date("window_to"),
+    canvasPath: text("canvas_path"),
+    createdBy: text("created_by"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("idx_gsc_opportunity_pass_site_passed").on(
+      table.siteKey,
+      table.passedAt
+    ),
+    index("idx_gsc_opportunity_pass_kind").on(table.siteKey, table.kind)
+  ]
+);
+pgTable(
+  "gsc_opportunity_item",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    passId: uuid("pass_id").notNull().references(() => gscOpportunityPass.id, { onDelete: "cascade" }),
+    siteKey: text("site_key").notNull(),
+    url: text("url").notNull(),
+    queryCluster: text("query_cluster"),
+    status: text("status").notNull().default("awaiting"),
+    changeSummary: text("change_summary"),
+    shippedAt: date("shipped_at"),
+    expectEffectAfter: date("expect_effect_after"),
+    sourceUrls: jsonb("source_urls").$type().notNull().default([]),
+    notes: text("notes"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("idx_gsc_opportunity_item_site_status").on(
+      table.siteKey,
+      table.status
+    ),
+    index("idx_gsc_opportunity_item_pass").on(table.passId),
+    index("idx_gsc_opportunity_item_url").on(table.siteKey, table.url)
+  ]
+);
 pgTable(
   "handoff_loop_run",
   {
     id: uuid("id").primaryKey().defaultRandom(),
     runSlug: text("run_slug").notNull(),
+    /**
+     * Skill pack that produced the run. Default is the plan-handoff loop;
+     * quality leaves push mg-strict-truth / mg-seo-strict.
+     */
+    skill: text("skill").notNull().default("mg-plan-handoff-loop"),
     userId: text("user_id"),
     gitRepository: text("git_repository"),
     machine: text("machine"),
@@ -6676,12 +7174,23 @@ pgTable(
     checklistProposed: integer("checklist_proposed").notNull().default(0),
     checklistAccepted: integer("checklist_accepted").notNull().default(0),
     checklistVerified: integer("checklist_verified").notNull().default(0),
+    /** Items resolved with evidence instead of a check (e.g. no browser session). */
+    checklistNa: integer("checklist_na").notNull().default(0),
     inputTokens: bigint("input_tokens", { mode: "number" }).notNull().default(0),
     outputTokens: bigint("output_tokens", { mode: "number" }).notNull().default(0),
     cacheReadTokens: bigint("cache_read_tokens", { mode: "number" }).notNull().default(0),
     totalDurationMs: bigint("total_duration_ms", { mode: "number" }).notNull().default(0),
     retro: text("retro"),
     metrics: jsonb("metrics"),
+    /**
+     * Human end-verdict: good | mixed | bad. The orchestrator asks once at
+     * Phase 4 and the AI Agents table offers a second capture point, so the
+     * review skill can score runs against the user instead of the loop's own
+     * self-report.
+     */
+    userVerdict: text("user_verdict"),
+    userVerdictNote: text("user_verdict_note"),
+    verdictAt: timestamp("verdict_at", { withTimezone: true }),
     reviewed: boolean("reviewed").notNull().default(false),
     reviewNotes: text("review_notes"),
     reviewedAt: timestamp("reviewed_at", { withTimezone: true }),
@@ -6694,8 +7203,10 @@ pgTable(
     uniqueIndex("uq_handoff_loop_run_slug").on(table.runSlug),
     index("idx_handoff_loop_run_user").on(table.userId),
     index("idx_handoff_loop_run_outcome").on(table.outcome),
+    index("idx_handoff_loop_run_skill").on(table.skill),
     index("idx_handoff_loop_run_reviewed").on(table.reviewed),
-    index("idx_handoff_loop_run_created").on(table.createdAt)
+    index("idx_handoff_loop_run_created").on(table.createdAt),
+    index("idx_handoff_loop_run_verdict").on(table.userVerdict)
   ]
 );
 var managedSiteSyncMode = pgEnum("managed_site_sync_mode", [
@@ -7052,6 +7563,8 @@ var TRANSIENT_GITHUB_STATUSES = /* @__PURE__ */ new Set([
   524
 ]);
 var DEFAULT_BUDGET_PER_MINUTE = 75;
+var DEFAULT_INTERACTIVE_CACHE_MAX_AGE_MS = 5 * 6e4;
+var DEFAULT_INTERACTIVE_STALE_MAX_AGE_MS = 30 * 6e4;
 var BUDGET_STATE_KEY = "github_api_budget_per_minute";
 var DEFAULT_BLOCK_MS = 15 * 60 * 1e3;
 var MAX_ATTEMPTS = 4;
@@ -7059,6 +7572,7 @@ var BASE_DELAY_MS = 750;
 var RATE_LIMIT_FLOOR = 50;
 var BUDGET_WAIT_ATTEMPTS = 4;
 var BUDGET_WAIT_CAP_MS = 15e3;
+var INTERACTIVE_BUDGET_WAIT_CAP_MS = 1e3;
 var GitHubGatewayBlockedError = class extends Error {
   blockedUntil;
   constructor(blockedUntil, message) {
@@ -7095,6 +7609,31 @@ function summarizeGitHubErrorBody(body, maxLen = 240) {
 function isTransientGitHubStatus(status) {
   return TRANSIENT_GITHUB_STATUSES.has(status);
 }
+var TRANSIENT_NETWORK_CODES = /* @__PURE__ */ new Set([
+  "ECONNRESET",
+  "ECONNREFUSED",
+  "ETIMEDOUT",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ENETUNREACH",
+  "EHOSTUNREACH",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_BODY_TIMEOUT",
+  "UND_ERR_SOCKET"
+]);
+function isTransientNetworkError(err) {
+  if (!(err instanceof Error)) return false;
+  const message = err.message.toLowerCase();
+  if (message.includes("fetch failed") || message.includes("socket hang up") || message.includes("network") || message.includes("other side closed")) {
+    return true;
+  }
+  const code = err.code;
+  if (code && TRANSIENT_NETWORK_CODES.has(code)) return true;
+  const cause = err.cause;
+  if (cause && cause !== err) return isTransientNetworkError(cause);
+  return false;
+}
 function hourBucket(now = /* @__PURE__ */ new Date()) {
   return new Date(
     Date.UTC(
@@ -7111,6 +7650,55 @@ function hourBucket(now = /* @__PURE__ */ new Date()) {
 function cacheKeyFor(url, tokenKey) {
   return createHash("sha256").update(`${tokenKey}:${url}`).digest("hex");
 }
+function toDate(value) {
+  if (value == null) return null;
+  const date3 = typeof value === "string" ? new Date(value) : value;
+  return Number.isNaN(date3.getTime()) ? null : date3;
+}
+function isSoftCacheFresh(input) {
+  const nowMs = input.nowMs ?? Date.now();
+  const expiresAt = toDate(input.expiresAt ?? null);
+  if (expiresAt && expiresAt.getTime() > nowMs) return true;
+  if (input.maxAgeMs == null || input.maxAgeMs <= 0) return false;
+  const updatedAt = toDate(input.updatedAt ?? null);
+  if (!updatedAt) return false;
+  return nowMs - updatedAt.getTime() <= input.maxAgeMs;
+}
+function canInteractiveSoftServe(input) {
+  if (isSoftCacheFresh({
+    expiresAt: input.expiresAt,
+    updatedAt: input.updatedAt,
+    maxAgeMs: input.maxAgeMs,
+    nowMs: input.nowMs
+  })) {
+    return true;
+  }
+  const staleMaxAgeMs = input.staleMaxAgeMs ?? DEFAULT_INTERACTIVE_STALE_MAX_AGE_MS;
+  if (staleMaxAgeMs <= 0) return false;
+  return isSoftCacheFresh({
+    expiresAt: null,
+    updatedAt: input.updatedAt,
+    maxAgeMs: staleMaxAgeMs,
+    nowMs: input.nowMs
+  });
+}
+function resolveMaxAgeMs(options, priority, useCache) {
+  if (!useCache) return void 0;
+  if (options.maxAgeMs !== void 0) {
+    return options.maxAgeMs > 0 ? options.maxAgeMs : void 0;
+  }
+  if (priority === "interactive") return DEFAULT_INTERACTIVE_CACHE_MAX_AGE_MS;
+  return void 0;
+}
+function cachedJsonResponse(body, status, cacheHeader) {
+  return new Response(body, {
+    status,
+    headers: {
+      "x-github-gateway-cache": cacheHeader,
+      "content-type": "application/json"
+    }
+  });
+}
 async function isGithubSyncPaused() {
   try {
     const rows = await getDb().execute(sql`
@@ -7133,9 +7721,9 @@ async function getBlockedUntil(tokenKey) {
   );
   const raw = rows[0]?.blocked_until;
   if (!raw) return null;
-  const date2 = typeof raw === "string" ? new Date(raw) : raw;
-  if (Number.isNaN(date2.getTime()) || date2.getTime() <= Date.now()) return null;
-  return date2;
+  const date3 = typeof raw === "string" ? new Date(raw) : raw;
+  if (Number.isNaN(date3.getTime()) || date3.getTime() <= Date.now()) return null;
+  return date3;
 }
 async function setGithubCircuitBreaker(tokenKey, blockedUntil) {
   await getDb().execute(sql`
@@ -7215,7 +7803,15 @@ async function consumeBudgetOrWait(input) {
       return;
     }
     if (input.priority === "interactive") {
-      await sleep(BASE_DELAY_MS);
+      if (attempt >= 2) {
+        await forceConsumeBudget(input.tokenKey);
+        return;
+      }
+      const waitMs2 = Math.min(
+        await msUntilBudgetWindowReset(input.tokenKey),
+        INTERACTIVE_BUDGET_WAIT_CAP_MS
+      );
+      await sleep(waitMs2);
       continue;
     }
     if (attempt === BUDGET_WAIT_ATTEMPTS) {
@@ -7229,40 +7825,76 @@ async function consumeBudgetOrWait(input) {
   }
   throw new GitHubGatewayBudgetError(input.tokenKey);
 }
+async function forceConsumeBudget(tokenKey) {
+  const updated = await getDb().execute(sql`
+    UPDATE github_api_budget
+    SET request_count = request_count + 1, updated_at = now()
+    WHERE token_key = ${tokenKey}
+    RETURNING request_count
+  `);
+  if (updated[0]) return;
+  await getDb().execute(sql`
+    INSERT INTO github_api_budget (token_key, window_started_at, request_count, updated_at)
+    VALUES (${tokenKey}, now(), 1, now())
+    ON CONFLICT (token_key) DO UPDATE SET
+      request_count = github_api_budget.request_count + 1,
+      updated_at = now()
+  `);
+}
 async function recordStat(input) {
   const bucket = hourBucket().toISOString();
   await getDb().execute(sql`
     INSERT INTO github_api_stat (
-      token_key, job_id, hour_bucket, request_count, error_count, cache_hit_count, updated_at
+      token_key, job_id, hour_bucket, request_count, error_count,
+      cache_hit_count, breaker_hit_count, updated_at
     )
     VALUES (
       ${input.tokenKey},
       ${input.jobId},
       ${bucket}::timestamptz,
-      1,
+      ${input.breakerHit ? 0 : 1},
       ${input.error ? 1 : 0},
       ${input.cacheHit ? 1 : 0},
+      ${input.breakerHit ? 1 : 0},
       now()
     )
     ON CONFLICT (token_key, job_id, hour_bucket) DO UPDATE SET
-      request_count = github_api_stat.request_count + 1,
+      request_count = github_api_stat.request_count + ${input.breakerHit ? 0 : 1},
       error_count = github_api_stat.error_count + ${input.error ? 1 : 0},
       cache_hit_count = github_api_stat.cache_hit_count + ${input.cacheHit ? 1 : 0},
+      breaker_hit_count = github_api_stat.breaker_hit_count + ${input.breakerHit ? 1 : 0},
       updated_at = now()
   `);
 }
+async function recordBreakerHit(input) {
+  await recordStat({
+    tokenKey: input.tokenKey,
+    jobId: input.jobId,
+    breakerHit: true
+  });
+}
 async function loadEtagCache(key) {
   const rows = await getDb().execute(sql`
-    SELECT etag, body, status FROM github_api_cache
+    SELECT etag, body, status, expires_at, updated_at
+    FROM github_api_cache
     WHERE cache_key = ${key}
     LIMIT 1
   `);
-  return rows[0] ?? null;
+  const row = rows[0];
+  if (!row) return null;
+  return {
+    etag: row.etag,
+    body: row.body,
+    status: row.status,
+    expiresAt: row.expires_at,
+    updatedAt: row.updated_at
+  };
 }
 async function saveEtagCache(input) {
+  const expiresAt = input.maxAgeMs != null && input.maxAgeMs > 0 ? new Date(Date.now() + input.maxAgeMs).toISOString() : null;
   await getDb().execute(sql`
     INSERT INTO github_api_cache (
-      cache_key, etag, body, status, content_type, updated_at
+      cache_key, etag, body, status, content_type, expires_at, updated_at
     )
     VALUES (
       ${input.key},
@@ -7270,6 +7902,7 @@ async function saveEtagCache(input) {
       ${input.body},
       ${input.status},
       ${input.contentType},
+      ${expiresAt}::timestamptz,
       now()
     )
     ON CONFLICT (cache_key) DO UPDATE SET
@@ -7277,6 +7910,7 @@ async function saveEtagCache(input) {
       body = EXCLUDED.body,
       status = EXCLUDED.status,
       content_type = EXCLUDED.content_type,
+      expires_at = EXCLUDED.expires_at,
       updated_at = now()
   `);
 }
@@ -7319,21 +7953,65 @@ function tripBreakerFromResponse(response) {
 }
 async function githubGatewayFetch(url, init, options) {
   const priority = options.priority ?? "background";
-  const budgetPerMinute = await resolveGithubBudgetPerMinute(
-    options.budgetPerMinute
-  );
   const method = (init.method ?? "GET").toUpperCase();
   const useCache = options.useEtagCache !== false && method === "GET";
+  const maxAgeMs = resolveMaxAgeMs(options, priority, useCache);
   if (priority !== "interactive" && await isGithubSyncPaused()) {
     throw new GitHubGatewayPausedError();
   }
+  const key = useCache ? cacheKeyFor(url, options.tokenKey) : null;
+  if (key && !options.bypassSoftCache) {
+    const soft = await loadEtagCache(key);
+    const softOk = soft?.body != null && (priority === "interactive" ? canInteractiveSoftServe({
+      expiresAt: soft.expiresAt,
+      updatedAt: soft.updatedAt,
+      maxAgeMs
+    }) : isSoftCacheFresh({
+      expiresAt: soft.expiresAt,
+      updatedAt: soft.updatedAt,
+      maxAgeMs
+    }));
+    if (softOk && soft?.body != null) {
+      const isFresh = isSoftCacheFresh({
+        expiresAt: soft.expiresAt,
+        updatedAt: soft.updatedAt,
+        maxAgeMs
+      });
+      await recordStat({
+        tokenKey: options.tokenKey,
+        jobId: options.jobId,
+        cacheHit: true
+      });
+      if (priority === "interactive" && !isFresh) {
+        void githubGatewayFetch(url, init, {
+          ...options,
+          bypassSoftCache: true,
+          priority: "background",
+          maxAgeMs: maxAgeMs ?? DEFAULT_INTERACTIVE_CACHE_MAX_AGE_MS
+        }).catch(() => {
+        });
+      }
+      return cachedJsonResponse(soft.body, soft.status ?? 200, "soft");
+    }
+  }
+  const budgetPerMinute = await resolveGithubBudgetPerMinute(
+    options.budgetPerMinute
+  );
   const blocked = await getBlockedUntil(options.tokenKey);
   if (blocked) {
     if (priority === "interactive") {
       if (blocked.getTime() - Date.now() > 6e4) {
+        await recordBreakerHit({
+          tokenKey: options.tokenKey,
+          jobId: options.jobId
+        });
         throw new GitHubGatewayBlockedError(blocked);
       }
     } else {
+      await recordBreakerHit({
+        tokenKey: options.tokenKey,
+        jobId: options.jobId
+      });
       throw new GitHubGatewayBlockedError(blocked);
     }
   }
@@ -7352,14 +8030,32 @@ async function githubGatewayFetch(url, init, options) {
   if (!headers.has("X-GitHub-Api-Version")) {
     headers.set("X-GitHub-Api-Version", "2022-11-28");
   }
-  const key = useCache ? cacheKeyFor(url, options.tokenKey) : null;
   if (key) {
     const cached = await loadEtagCache(key);
     if (cached?.etag) headers.set("If-None-Match", cached.etag);
   }
   let lastError = null;
   for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
-    const response = await fetch(url, { ...init, headers });
+    let response;
+    try {
+      response = await fetch(url, {
+        ...init,
+        headers,
+        signal: init.signal ?? AbortSignal.timeout(2e4)
+      });
+    } catch (err) {
+      lastError = err instanceof Error ? err : new Error(String(err));
+      await recordStat({
+        tokenKey: options.tokenKey,
+        jobId: options.jobId,
+        error: true
+      });
+      if (!isTransientNetworkError(err) || attempt === MAX_ATTEMPTS) {
+        throw lastError;
+      }
+      await sleep(BASE_DELAY_MS * 2 ** (attempt - 1));
+      continue;
+    }
     await updateRateLimitHeaders(options.tokenKey, response);
     if (response.status === 304 && key) {
       const cached = await loadEtagCache(key);
@@ -7368,13 +8064,11 @@ async function githubGatewayFetch(url, init, options) {
         jobId: options.jobId,
         cacheHit: true
       });
-      return new Response(cached?.body ?? "", {
-        status: cached?.status ?? 200,
-        headers: {
-          "x-github-gateway-cache": "hit",
-          "content-type": "application/json"
-        }
-      });
+      return cachedJsonResponse(
+        cached?.body ?? "",
+        cached?.status ?? 200,
+        "hit"
+      );
     }
     if (response.status === 403 || response.status === 429 || isTransientGitHubStatus(response.status)) {
       const bodyText = summarizeGitHubErrorBody(
@@ -7393,6 +8087,10 @@ async function githubGatewayFetch(url, init, options) {
           error: true
         });
         if (attempt === MAX_ATTEMPTS || secondary) {
+          await recordBreakerHit({
+            tokenKey: options.tokenKey,
+            jobId: options.jobId
+          });
           throw new GitHubGatewayBlockedError(until, lastError.message);
         }
         const retryAfter = Number(response.headers.get("retry-after"));
@@ -7409,7 +8107,8 @@ async function githubGatewayFetch(url, init, options) {
         etag,
         body,
         status: response.status,
-        contentType: response.headers.get("content-type")
+        contentType: response.headers.get("content-type"),
+        maxAgeMs
       });
     }
     await recordStat({
@@ -8840,7 +9539,7 @@ function getEncryptionKey() {
     throw new Error("ENCRYPTION_KEY must be a 64-character hex string");
   return buf;
 }
-function encrypt(text19) {
+function encrypt(text22) {
   const key = getEncryptionKey();
   const iv = randomBytes(ENC_IV_LENGTH);
   const cipher = createCipheriv(
@@ -8848,7 +9547,7 @@ function encrypt(text19) {
     new Uint8Array(key),
     new Uint8Array(iv)
   );
-  let encrypted = cipher.update(text19, "utf8", "hex");
+  let encrypted = cipher.update(text22, "utf8", "hex");
   encrypted += cipher.final("hex");
   const authTag = cipher.getAuthTag();
   return Buffer.concat([
@@ -9568,10 +10267,10 @@ async function r2GetObjectRange(bucket, key, range) {
     const body = result.Body;
     if (!body?.transformToString)
       throw new Error("R2 returned no readable body");
-    const text19 = await body.transformToString();
+    const text22 = await body.transformToString();
     const header = `# range: bytes ${range.offset}-${end} of ${size} (${effectiveLen} bytes)`;
     return `${header}
-${text19}`;
+${text22}`;
   } catch (e) {
     throw r2WrapError(bucket, key, e);
   }
@@ -9934,15 +10633,15 @@ async function sftpRead(opts, filePath, proxy, options) {
             clearTimeout(timer);
             cleanup?.();
             cleanup = void 0;
-            const text19 = Buffer.concat(
+            const text22 = Buffer.concat(
               chunks.map((ch) => new Uint8Array(ch))
             ).toString("utf-8");
             if (!isWholeFileRequest) {
               const header = `# range: bytes ${offset}-${offset + effectiveLen - 1} of ${total} (${effectiveLen} bytes)`;
               resolve(`${header}
-${text19}`);
+${text22}`);
             } else {
-              resolve(text19);
+              resolve(text22);
             }
           });
           rs.on("error", (e) => {
@@ -9975,6 +10674,8 @@ var RESPONSE_MAX_BYTES = 8192;
 var NO_FOOTER_TOOLS = /* @__PURE__ */ new Set();
 var RAW_JSON_TOOLS = /* @__PURE__ */ new Set([
   "get_mg_dashboard_commits",
+  "get_mg_dashboard_file",
+  "get_mg_dashboard_diff",
   "extract_article",
   // Content family (2026-DASMG-040/041/042) — compact JSON consumed verbatim.
   // Consolidated action-based tools (the Cursor surface); each proxies to the
@@ -9990,7 +10691,9 @@ var RAW_JSON_TOOLS = /* @__PURE__ */ new Set([
   "managed-site",
   "content-sync",
   // Skill registry metadata only (no file bodies) — must stay valid JSON.
-  "cursor-skill"
+  "cursor-skill",
+  // GSC opportunity store (pass + items)
+  "gsc-opportunity"
 ]);
 var TOOL_CACHE_TTL_MS = {
   "list-servers": 6e4,
@@ -10091,11 +10794,11 @@ function getKnownContainers(serverId, maxAgeMs = 5 * 6e4) {
   if (Date.now() - e.capturedAt > maxAgeMs) return void 0;
   return e.names;
 }
-function truncateForLLM(text19, maxBytes) {
-  const totalBytes = Buffer.byteLength(text19, "utf8");
+function truncateForLLM(text22, maxBytes) {
+  const totalBytes = Buffer.byteLength(text22, "utf8");
   if (totalBytes <= maxBytes)
-    return { text: text19, truncated: false, totalBytes, shownBytes: totalBytes };
-  const buf = Buffer.from(text19, "utf8");
+    return { text: text22, truncated: false, totalBytes, shownBytes: totalBytes };
+  const buf = Buffer.from(text22, "utf8");
   let cut = maxBytes;
   while (cut > 0 && (buf[cut] & 192) === 128) cut--;
   const head = buf.subarray(0, cut).toString("utf8");
@@ -10126,10 +10829,10 @@ function postprocessResult(result, meta) {
   if (!result.content?.length) return result;
   if (RAW_JSON_TOOLS.has(meta.toolName)) return result;
   const block = result.content[0];
-  let text19 = String(block.text ?? "");
-  const trunc = truncateForLLM(text19, RESPONSE_MAX_BYTES);
+  let text22 = String(block.text ?? "");
+  const trunc = truncateForLLM(text22, RESPONSE_MAX_BYTES);
   if (trunc.truncated) {
-    text19 = trunc.text + "\n\n... " + buildTruncationHint(
+    text22 = trunc.text + "\n\n... " + buildTruncationHint(
       meta.toolName,
       meta.args,
       trunc.totalBytes,
@@ -10143,11 +10846,11 @@ function postprocessResult(result, meta) {
     const parts = [`took ${tookStr}`, sizeStr];
     if (meta.serverIdLabel) parts.push(`server: ${meta.serverIdLabel}`);
     if (meta.cached) parts.push("cached");
-    text19 = `${text19}
+    text22 = `${text22}
 
 [${parts.join(", ")}]`;
   }
-  return { ...result, content: [{ ...block, text: text19 }] };
+  return { ...result, content: [{ ...block, text: text22 }] };
 }
 function buildPipelineScript(commands, shell, marker, stopOnError) {
   if (shell === "powershell") {
@@ -10933,11 +11636,11 @@ CREATE TABLE IF NOT EXISTS _mcp_migrations (
   applied_by  TEXT
 );
 `.trim();
-function normaliseMigrationSql(sql29) {
-  return sql29.replace(/\r\n/g, "\n").trim() + "\n";
+function normaliseMigrationSql(sql31) {
+  return sql31.replace(/\r\n/g, "\n").trim() + "\n";
 }
-function migrationSha256(sql29) {
-  return createHash("sha256").update(sql29.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+function migrationSha256(sql31) {
+  return createHash("sha256").update(sql31.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function dollarQuoteTag(value) {
   let tag = "_mcp";
@@ -12143,6 +12846,7 @@ var TOOLS = [
       required: ["actor", "dateFrom", "dateTo"]
     }
   },
+  ...GITHUB_CODE_ACCESS_TOOLS,
   {
     name: "extract_article",
     description: "Extract readable article/content data from ONE PUBLIC URL, with a browser-render fallback for pages that block a normal fetch (403) or only render with JavaScript (ticket 2026-DASMG-039). Returns title, author, publishedAt, source, summary, facts[], optional rawText (capped), canonicalUrl, the `extractionMethod` used (http | browser | jsonld | rss | amp | metadata_only) and an explicit `limitations` array (e.g. blocked_without_browser, paywall_detected, partial_content, rawtext_truncated). PUBLIC URLs only \u2014 SSRF-guarded (private/loopback/metadata addresses rejected), no paywall bypass, no credentials; the source/canonical URL is always preserved. Use it to turn a news/article link into safe factual source material for agents; it never auto-publishes or rewrites. For several sources + cross-checking, use `research` with action=topic.",
@@ -12803,6 +13507,87 @@ var TOOLS = [
     }
   },
   // ----- Shared Cursor skills (metadata only; install via downloads ZIP) -----
+  {
+    name: "gsc-opportunity",
+    description: 'GSC opportunity store (shared SoT across MG-managed sites). Pick `action`:\n- "list": open items/passes for a siteKey (filter by status/statuses/kind). Default excludes closed.\n- "upsert": create/update a pass + optional items (url, queryCluster, status, expectEffectAfter, sourceUrls).\n- "close": mark an item closed by id or siteKey+url(+queryCluster).\nUse before/after gsc-opportunities skill passes instead of growing markdown logs. On CTR/policy polish upserts, include sourceUrls (official claim URLs).',
+    inputSchema: {
+      type: "object",
+      properties: {
+        action: {
+          type: "string",
+          enum: ["list", "upsert", "close"],
+          description: "list | upsert | close"
+        },
+        siteKey: {
+          type: "string",
+          description: "Stable site id, e.g. solarfast (required for all actions)."
+        },
+        status: {
+          type: "string",
+          enum: ["awaiting", "monitor", "pending_reindex", "skipped", "closed"],
+          description: "action=list: single status filter."
+        },
+        statuses: {
+          type: "array",
+          items: {
+            type: "string",
+            enum: ["awaiting", "monitor", "pending_reindex", "skipped", "closed"]
+          },
+          description: "action=list: multi status filter."
+        },
+        kind: {
+          type: "string",
+          enum: ["analysis", "ctr_polish", "reindex", "cls", "other"],
+          description: "action=list/upsert: pass kind."
+        },
+        includeClosed: {
+          type: "boolean",
+          description: "action=list: include closed items (default false)."
+        },
+        limit: { type: "number", description: "action=list: max items (default 50)." },
+        offset: { type: "number", description: "action=list: pagination offset." },
+        gscProperty: {
+          type: "string",
+          description: "action=upsert: e.g. sc-domain:solarfast.nl"
+        },
+        passId: {
+          type: "string",
+          description: "action=upsert: update existing pass uuid."
+        },
+        headline: { type: "string", description: "action=upsert: pass headline." },
+        windowFrom: { type: "string", description: "action=upsert: YYYY-MM-DD." },
+        windowTo: { type: "string", description: "action=upsert: YYYY-MM-DD." },
+        canvasPath: { type: "string", description: "action=upsert: optional canvas path." },
+        createdBy: { type: "string", description: "action=upsert: agent/user label." },
+        passedAt: {
+          type: "string",
+          description: "action=upsert: ISO datetime for the pass."
+        },
+        items: {
+          type: "array",
+          description: "action=upsert: items [{url, queryCluster?, status?, changeSummary?, shippedAt?, expectEffectAfter?, sourceUrls?, notes?, id?}]",
+          items: { type: "object" }
+        },
+        id: {
+          type: "string",
+          description: "action=close: item uuid (preferred)."
+        },
+        url: {
+          type: "string",
+          description: "action=close: item url when id omitted."
+        },
+        queryCluster: {
+          type: "string",
+          description: "action=close: optional cluster disambiguator."
+        },
+        notes: {
+          type: "string",
+          description: "action=close/upsert item notes."
+        }
+      },
+      required: ["action", "siteKey"]
+    }
+  },
   {
     name: "cursor-skill",
     description: 'Shared Cursor skill registry (metadata only \u2014 never returns file bodies; MCP truncates large text). Actions: list (slugs+versions), status (localVersion vs tip), pull (install pointer only). To install bytes: GET https://dashboard.mgsoftware.nl/api/downloads/versions.txt (skills/<slug>.zip=N) then GET \u2026/api/downloads/skills/<slug>.zip and expand into .cursor/skills/<slug>/. Publish from mg-dashboard: bun scripts/skills/pack-and-publish.ts --slug <slug> --message "\u2026". No push via this tool.',
@@ -12833,7 +13618,7 @@ var TOOLS = [
   // ----- Trigger.dev -----
   ...TRIGGER_TOOLS
 ];
-var MCP_VERSION = "7.4.13";
+var MCP_VERSION = "7.4.14";
 async function handleListTools() {
   if (!authContext) return { tools: TOOLS };
   const allowedTools = authContext.allowedTools;
@@ -12974,6 +13759,12 @@ async function executeToolCall(name, a, _serverId) {
           content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
         };
       }
+      case "get_mg_dashboard_file":
+      case "get_mg_dashboard_diff":
+        return handleGithubCodeAccessTool(name, a, {
+          dashboardBaseUrl,
+          apiKey: apiKey ?? ""
+        });
       // ----- Public-web extraction (article tools) -----
       case "extract_article": {
         const url = typeof a.url === "string" ? a.url.trim() : "";
@@ -13050,6 +13841,39 @@ async function executeToolCall(name, a, _serverId) {
           content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
         };
       }
+      case "gsc-opportunity": {
+        const action = typeof a.action === "string" ? a.action.trim() : "";
+        if (!action) {
+          return {
+            content: [{ type: "text", text: "Error: action is required" }]
+          };
+        }
+        const { action: _action, ...params } = a;
+        void _action;
+        const res = await fetch(`${dashboardBaseUrl}/api/tools/gsc-opportunity`, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${apiKey}`
+          },
+          body: JSON.stringify({ action, params })
+        });
+        if (!res.ok) {
+          const detail = await res.text().catch(() => "");
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Error: gsc-opportunity failed (${res.status}). ${detail.slice(0, 400)}`
+              }
+            ]
+          };
+        }
+        const data = await res.json();
+        return {
+          content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+        };
+      }
       // ----- Team memory -----
       case "search-team-memory": {
         const query = typeof a.query === "string" ? a.query.trim() : "";
@@ -13091,7 +13915,7 @@ async function executeToolCall(name, a, _serverId) {
             ]
           };
         }
-        const lines = data.hits.map((hit, index16) => {
+        const lines = data.hits.map((hit, index19) => {
           const when = hit.lastMessageAt ? new Date(hit.lastMessageAt).toISOString().slice(0, 10) : "unknown date";
           const repo = hit.repo ?? "unknown repo";
           const sim = hit.similarity !== null ? ` \xB7 ${(hit.similarity * 100).toFixed(0)}% match` : "";
@@ -13101,7 +13925,7 @@ async function executeToolCall(name, a, _serverId) {
             ...Array.isArray(hit.tech) ? hit.tech.slice(0, 4) : []
           ].filter(Boolean);
           const tags = facets.length > 0 ? ` \xB7 ${facets.join(", ")}` : "";
-          return `${index16 + 1}. [${repo} \xB7 ${when}${sim}${tags}] ${hit.title}
+          return `${index19 + 1}. [${repo} \xB7 ${when}${sim}${tags}] ${hit.title}
    id: ${hit.id}
    ${(hit.summary ?? hit.snippet).replace(/\s+/g, " ").slice(0, 500)}`;
         });
@@ -13308,12 +14132,12 @@ Searchable via search-team-memory once indexing completes (usually immediate).`
             ]
           };
         }
-        const lines = data.hits.map((hit, index16) => {
+        const lines = data.hits.map((hit, index19) => {
           const sim = hit.similarity !== null ? ` \xB7 ${Math.round(hit.similarity * 100)}% match` : "";
           const tags = hit.tags.length ? ` \xB7 ${hit.tags.slice(0, 5).join(", ")}` : "";
           const sources = hit.sources.length ? `
    sources: ${hit.sources.slice(0, 6).map((s) => `${s.type}:${s.ref}`).join(", ")}` : "";
-          return `${index16 + 1}. [${hit.status} \xB7 updated ${hit.pageUpdatedOn ?? "unknown"}${sim}${tags}] ${hit.title}
+          return `${index19 + 1}. [${hit.status} \xB7 updated ${hit.pageUpdatedOn ?? "unknown"}${sim}${tags}] ${hit.title}
    slug: ${hit.slug}${sources}
    ${(hit.summary ?? hit.snippet).replace(/\s+/g, " ").slice(0, 400)}`;
         });
@@ -13370,8 +14194,8 @@ Call get-wiki-page with a slug for the full page; follow its sources (team-memor
         const formatSource = (s) => {
           const base = `${s.type}:${s.ref}`;
           if (s.title) {
-            const date2 = s.date ? ` (${s.date})` : "";
-            return `${base} \u2014 "${s.title}"${date2}`;
+            const date3 = s.date ? ` (${s.date})` : "";
+            return `${base} \u2014 "${s.title}"${date3}`;
           }
           return base;
         };
@@ -14570,8 +15394,8 @@ ${sample.join("\n")}${files.length > 5 ? `
             };
           const filtered = sortRows(applyFilter(only.rows));
           if (format === "json") {
-            const text20 = filtered.map((c) => JSON.stringify(c)).join("\n") || "(no containers)";
-            return { content: [{ type: "text", text: text20 }] };
+            const text23 = filtered.map((c) => JSON.stringify(c)).join("\n") || "(no containers)";
+            return { content: [{ type: "text", text: text23 }] };
           }
           if (groupByProject) {
             const groups = /* @__PURE__ */ new Map();
@@ -14598,8 +15422,8 @@ ${sample.join("\n")}${files.length > 5 ? `
           }
           const header = `${"NAMES".padEnd(36)}  ${"IMAGE".padEnd(40)}  ${"STATUS".padEnd(24)}  ${"HEALTH".padEnd(10)}  ${"PORTS".padEnd(40)}  PROJECT`;
           const body = filtered.map((r) => `${fmtRow(r)}  ${r.Project || ""}`);
-          const text19 = filtered.length === 0 ? "(no containers match)" : [header, ...body].join("\n");
-          return { content: [{ type: "text", text: text19 }] };
+          const text22 = filtered.length === 0 ? "(no containers match)" : [header, ...body].join("\n");
+          return { content: [{ type: "text", text: text22 }] };
         }
         if (format === "json") {
           const lines = [];