@nanocollective/roster 0.1.0-alpha.3 → 0.1.0-alpha.5

package/dist/cli.js

@@ -244,6 +244,11 @@ function opsTemplateDir() {
 // src/lib/render.ts
 var NOTE = "%%TOKENS%%";
 var TOKEN = /%%([A-Z_]+)%%/g;
+function toolsOf(org) {
+  const list = org?.defaults?.allowed_tools;
+  const asked = Array.isArray(list) ? list.join(",") : typeof list === "string" ? list : "";
+  return asked.replace(/\s+/g, "") || "Bash,Read,Write,Edit,Glob,Grep,WebFetch,WebSearch";
+}
 function orgTokens(org) {
   return {
     ORG: org.org,
@@ -251,7 +256,11 @@ function orgTokens(org) {
     OPS_REPO: org.opsRepo,
     OPS_REPO_DIR: org.opsDirName,
     HUMAN: org.human,
-    HUMAN_MARKER: org.humanMarker
+    HUMAN_MARKER: org.humanMarker,
+    /* A JSON array, spelled into a GitHub expression as `fromJSON('%%HUMAN_LOGINS%%')`. One
+       login is still a one-element list, so the generated gate has one shape rather than two. */
+    HUMAN_LOGINS: JSON.stringify((org.humanLogins ?? [org.human]).filter(Boolean)),
+    ALLOWED_TOOLS: org.allowedTools
   };
 }
 function tokensFor(org, s) {
@@ -269,7 +278,6 @@ function tokensFor(org, s) {
     MODEL: s.model,
     TIMEOUT: String(s.timeout),
     MENTION_TIMEOUT: String(s.mentionTimeout),
-    PR_MENTION_TIMEOUT: String(s.prMentionTimeout),
     SECRET_PREFIX: s.secretPrefix,
     PUBLIC_SECRET_PREFIX: s.publicSecretPrefix,
     APP: s.app,
@@ -354,11 +362,11 @@ function specFromManifest(m, dir) {
     worksIn: (m.works_in ?? []).map((w) => String(w?.repo)).filter(Boolean),
     schedule: String(m.schedule ?? ""),
     model: String(m.model ?? ""),
-    timeout: Number(m.timeout_minutes ?? 60),
-    // Absent from the manifests written before these were separate fields. The defaults are
-    // the values those manifests were already producing, so nothing moves on the first upgrade.
-    mentionTimeout: Number(m.mention_timeout_minutes ?? 30),
-    prMentionTimeout: Number(m.pr_mention_timeout_minutes ?? 60),
+    timeout: Number(m.timeout_minutes ?? 90),
+    // Absent from the manifests written before these were separate fields. 90 either way: a
+    // mention that ends in a build needs a session's room, and the 30 these once fell back to
+    // killed four runs mid-gate at a ceiling nobody had chosen.
+    mentionTimeout: Number(m.mention_timeout_minutes ?? 90),
     secretPrefix: String(priv.secret_prefix ?? String(m.handle ?? dir).toUpperCase()),
     publicSecretPrefix: String(pub.secret_prefix ?? "BOT"),
     app: String(priv.app ?? ""),
@@ -622,11 +630,37 @@ ${text.trimEnd()}
 ${bars}`;
 }
 
+// src/lib/humans.ts
+function readHumans(org) {
+  const listed = Array.isArray(org?.humans) ? org.humans : org?.humans ? [org.humans] : [];
+  const raw = [...listed, org?.human].filter(Boolean);
+  const out = [];
+  for (const entry of raw) {
+    const github = String(entry.github ?? entry.login ?? "").trim();
+    const name = String(entry.name ?? github).trim();
+    if (!github && !name) continue;
+    if (github && out.some((h) => h.github.toLowerCase() === github.toLowerCase())) continue;
+    out.push({
+      github,
+      name: name || github,
+      marker: String(entry.marker ?? "").trim() || defaultMarker(name || github),
+      role: entry.role === void 0 || entry.role === null ? void 0 : String(entry.role)
+    });
+  }
+  return out;
+}
+function humanLogins(org) {
+  return readHumans(org).map((h) => h.github).filter(Boolean);
+}
+function defaultMarker(name) {
+  return String(name).trim().split(/[\s-]+/)[0].toLowerCase().replace(/[^a-z0-9]/g, "") || "human";
+}
+
 // src/lib/prompt.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync2, writeFileSync } from "fs";
 import { dirname as dirname3, join as join6, relative as relative2, resolve as resolve2 } from "path";
-var KINDS = ["daily", "mention", "pr-mention"];
+var KINDS = ["daily", "mention"];
 function promptView(ws, compose, staffHandle, brainDir, kind) {
   const had = process.env.ROSTER_CONTEXT;
   if (kind !== "daily" && !had) {
@@ -774,12 +808,15 @@ function validateOrgYaml(text, parseYaml) {
       return `org.yaml needs a "${key}", and every prompt is composed against it`;
     }
   }
-  for (const key of ["staff", "repos"]) {
+  for (const key of ["staff", "repos", "humans"]) {
     if (doc[key] !== void 0 && !Array.isArray(doc[key])) return `"${key}" has to be a list`;
   }
   for (const s of doc.staff ?? []) {
     if (!s?.handle) return "every staff entry needs a handle";
   }
+  for (const h of doc.humans ?? []) {
+    if (!h?.github) return "every entry in humans needs a github login";
+  }
   return null;
 }
 
@@ -814,7 +851,7 @@ roster brief <kind> [handle]
   these briefs by \`roster init\` and \`roster hire\`. There is nothing in them that is
   specific to any agent.
 
-  --kind <k>      for amend: daily | mention | pr-mention  (default: daily)
+  --kind <k>      for amend: daily | mention  (default: daily)
   --want <text>   for amend: what you want changed
   --ops <dir>     ops repo directory (default: found by walking up)
 `;
@@ -876,14 +913,19 @@ function staffTokens(ws, org, handle, parseYaml) {
   return tokensFor(spec(org, ws), specFromManifest(manifest, dir));
 }
 function spec(org, ws) {
-  const human = org.human ?? {};
+  const humans = readHumans(org);
+  const first = humans[0];
   return {
     org: org.org,
     name: org.name,
     opsRepo: `${org.org}/${ws.opsName}`,
     opsDirName: ws.opsName,
-    human: human.name ?? human.github ?? "the human",
-    humanMarker: human.marker ?? human.github ?? "human"
+    /* A brief is prose addressed to one person, so it names the first. The rest are in the
+       manifest and in the gate; a brief that said "Will and Sam" would read as a committee. */
+    human: first?.name ?? first?.github ?? "the human",
+    humanMarker: first?.marker ?? "human",
+    humanLogins: humans.map((h) => h.github).filter(Boolean),
+    allowedTools: toolsOf(org)
   };
 }
 function renderBrief(text, tokens, where) {
@@ -921,7 +963,7 @@ function parseFlags2(argv) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync10, readdirSync as readdirSync4, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync10, readdirSync as readdirSync5, readFileSync as readFileSync9 } from "fs";
 import { join as join11 } from "path";
 
 // src/lib/memory.ts
@@ -1124,7 +1166,15 @@ function looksUnwritten(body) {
 
 // src/commands/upgrade.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync9, mkdirSync, mkdtempSync as mkdtempSync2, readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import {
+  existsSync as existsSync9,
+  mkdirSync,
+  mkdtempSync as mkdtempSync2,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync8,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync3
+} from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { dirname as dirname4, join as join10 } from "path";
 
@@ -1454,8 +1504,10 @@ function planBrains(ws, parseYaml) {
     name: org.name,
     opsRepo: `${org.org}/${ws.opsName}`,
     opsDirName: ws.opsName,
-    human: org.human?.github ?? "",
-    humanMarker: org.human?.marker ?? "human"
+    human: readHumans(org)[0]?.github ?? "",
+    humanMarker: readHumans(org)[0]?.marker ?? "human",
+    humanLogins: humanLogins(org),
+    allowedTools: toolsOf(org)
   };
   const out = [];
   for (const entry of org.staff ?? []) {
@@ -1494,6 +1546,12 @@ function planBrains(ws, parseYaml) {
         have === text ? { rel, kind, verdict: "same" } : { rel, kind, verdict: "regenerate", next: text, diff: unified(have, text) }
       );
     }
+    for (const rel of callerFiles(root)) {
+      if (want.has(rel)) continue;
+      const text = readFileSync8(join10(root, rel), "utf8");
+      if (!text.includes(`${orgSpec2.opsRepo}/.github/workflows/session.yaml`)) continue;
+      base2.files.push({ rel, kind: "generated", verdict: "obsolete" });
+    }
     out.push(base2);
   }
   return out;
@@ -1518,6 +1576,11 @@ function unified(before, after) {
     rmSync2(dir, { recursive: true, force: true });
   }
 }
+function callerFiles(root) {
+  const dir = join10(root, ".github", "workflows");
+  if (!existsSync9(dir)) return [];
+  return readdirSync4(dir).filter((n) => n.endsWith(".yaml") || n.endsWith(".yml")).map((n) => `.github/workflows/${n}`);
+}
 function reportBrains(brains, opts) {
   for (const b of brains) {
     const interesting = b.files.filter((f) => f.verdict !== "same");
@@ -1541,6 +1604,13 @@ function reportBrains(brains, opts) {
 `);
         continue;
       }
+      if (f.verdict === "obsolete") {
+        process.stdout.write(
+          `    - ${f.rel}  the framework no longer generates this; will be removed
+`
+        );
+        continue;
+      }
       process.stdout.write(`    \u2191 ${f.rel}  differs from the template
 `);
       if (f.diff) {
@@ -1555,6 +1625,11 @@ function applyBrains(brains) {
   let wrote = 0;
   for (const b of brains) {
     for (const f of b.files) {
+      if (f.verdict === "obsolete") {
+        rmSync2(join10(b.root, f.rel), { force: true });
+        wrote++;
+        continue;
+      }
       if (f.next === void 0) continue;
       const dest = join10(b.root, f.rel);
       mkdirSync(dirname4(dest), { recursive: true });
@@ -1602,11 +1677,12 @@ async function collect(opts) {
   const composer = await loadComposer(ws.opsDir);
   const org = readOrg(ws.opsDir, composer.parseYaml);
   const staff = (org.staff ?? []).filter((s) => !opts.only || s.handle === opts.only);
-  if (!staff.length) return null;
+  if (opts.only && !staff.length) return null;
   const findings = [];
   const online = !opts.offline && await gate(findings);
   findings.push(...checkWorkspace(ws, org));
   findings.push(...checkBusiness(ws));
+  findings.push(...await checkAgent(ws, org));
   if (online) findings.push(...await checkOrgOnline(ws, org));
   const perStaff = await Promise.all(staff.map((s) => checkStaff(ws, org, s, composer, online)));
   for (const f of perStaff) findings.push(...f);
@@ -1659,13 +1735,22 @@ function checkWorkspace(ws, org) {
     id: "org.yaml",
     title: `org.yaml names ${org.repos?.length ?? 0} repos and ${org.staff?.length ?? 0} staff`
   });
-  if (!org.human?.github) {
+  const humans = readHumans(org);
+  if (!humans.some((h) => h.github)) {
     out.push({
       scope,
       level: "fail",
       id: "human",
-      title: "org.yaml has no human.github",
-      fix: "The mention callers gate on this login. Without it nothing can wake an agent."
+      title: "org.yaml names no human with a github login",
+      fix: "The mention callers gate on these logins. Without one nothing can wake an agent. Write `human: { github: you }`, or a `humans:` list for more than one."
+    });
+  } else if (humans.some((h) => !h.github)) {
+    out.push({
+      scope,
+      level: "warn",
+      id: "human.login",
+      title: `${humans.filter((h) => !h.github).map((h) => h.name).join(", ")} has no github login`,
+      fix: "Give them one, or the mention gate silently ignores everything they write."
     });
   }
   try {
@@ -1714,6 +1799,57 @@ function checkWorkspace(ws, org) {
   }
   return out;
 }
+async function checkAgent(ws, org) {
+  const scope = "workspace";
+  let agent;
+  try {
+    const { resolveAgent } = await import(`file://${join11(ws.opsDir, "agents.mjs")}`);
+    agent = resolveAgent(org, {});
+  } catch (err) {
+    return [
+      {
+        scope,
+        level: "fail",
+        id: "agent",
+        title: `no runner resolves: ${firstLine(err)}`,
+        fix: "Nothing can run until org.yaml names an agent this tenant's agents.mjs knows."
+      }
+    ];
+  }
+  const out = [{ scope, level: "ok", id: "agent", title: `runs on ${agent.id}` }];
+  const orgFile = join11(ws.opsDir, "org.yaml");
+  if (existsSync10(orgFile) && /FILL IN/.test(readFileSync9(orgFile, "utf8"))) {
+    out.push({
+      scope,
+      level: "fail",
+      id: "agent.config",
+      title: "org.yaml still has a blank in it",
+      fix: "Fill in the FILL IN. A run cannot pick a model from a placeholder."
+    });
+  }
+  if (!agent.config) return out;
+  const path = join11(ws.opsDir, agent.config.path);
+  if (!existsSync10(path)) {
+    out.push({
+      scope,
+      level: "fail",
+      id: "agent.config",
+      title: `${agent.id} needs ${agent.config.path} and there is none`,
+      fix: "roster init writes it for a new tenant. See docs/agents.md for what goes in it."
+    });
+    return out;
+  }
+  if (/FILL IN/.test(readFileSync9(path, "utf8"))) {
+    out.push({
+      scope,
+      level: "fail",
+      id: "agent.config",
+      title: `${agent.config.path} still has a blank in it`,
+      fix: `Fill in the FILL IN. ${agent.id} cannot pick a model without it.`
+    });
+  }
+  return out;
+}
 function checkBusiness(ws) {
   const path = join11(ws.opsDir, "org", "business.md");
   if (!existsSync10(path)) {
@@ -1847,11 +1983,10 @@ async function checkStaff(ws, org, entry, composer, online) {
   const CONTEXT = JSON.stringify({
     issue_number: "1",
     comment_id: "1",
-    pr_number: "1",
     repo: `${org.org}/example`
   });
   const before = process.env.ROSTER_CONTEXT;
-  for (const kind of ["daily", "mention", "pr-mention"]) {
+  for (const kind of ["daily", "mention"]) {
     try {
       if (kind === "daily") delete process.env.ROSTER_CONTEXT;
       else process.env.ROSTER_CONTEXT = CONTEXT;
@@ -1879,16 +2014,16 @@ async function checkStaff(ws, org, entry, composer, online) {
       scope,
       level: "ok",
       id: "compose",
-      title: "prompts compose for daily, mention and pr-mention"
+      title: "prompts compose for daily and mention"
     });
   }
-  const callers = readCallers(root);
-  if (callers.length !== 3) {
+  const callers = readCallers(root, entry.handle);
+  if (callers.length !== 2) {
     out.push({
       scope,
       level: callers.length ? "warn" : "fail",
       id: "callers",
-      title: `${callers.length} caller workflow${callers.length === 1 ? "" : "s"}, expected 3 (daily, mention, pr-mention)`,
+      title: `${callers.length} caller workflow${callers.length === 1 ? "" : "s"}, expected 2 (daily, mention)`,
       fix: "A missing caller is a route that silently never fires. Compare against roster's templates/brain."
     });
   }
@@ -1926,8 +2061,13 @@ async function checkStaff(ws, org, entry, composer, online) {
       });
     }
   }
-  if (callers.length === 3 && !out.some((f) => f.id.startsWith("callers"))) {
-    out.push({ scope, level: "ok", id: "callers", title: `3 callers, all pointing at ${opsRepo}` });
+  if (callers.length === 2 && !out.some((f) => f.id.startsWith("callers"))) {
+    out.push({
+      scope,
+      level: "ok",
+      id: "callers",
+      title: `2 callers, both pointing at ${opsRepo}`
+    });
   }
   const missing = (manifest.surfaces ?? []).map((s) => s.path).filter((p) => p && !existsSync10(join11(root, p)));
   if (missing.length) {
@@ -1946,7 +2086,7 @@ async function checkStaff(ws, org, entry, composer, online) {
 }
 function timeoutOf(callerText) {
   const m = /timeout_minutes:\s*(\d+)/.exec(callerText);
-  return m ? Number(m[1]) : 60;
+  return m ? Number(m[1]) : 90;
 }
 function runMinutes(run6) {
   return (new Date(run6.updatedAt).getTime() - new Date(run6.createdAt).getTime()) / 6e4;
@@ -1971,10 +2111,11 @@ function inferredCeiling(cancelled) {
   }
   return most >= 2 ? best : null;
 }
-function readCallers(root) {
+function readCallers(root, handle) {
   const dir = join11(root, ".github", "workflows");
   if (!existsSync10(dir)) return [];
-  return readdirSync4(dir).filter((f) => /\.ya?ml$/.test(f)).sort().map((name) => ({ name, text: readFileSync9(join11(dir, name), "utf8") }));
+  const mine = new RegExp(`^${handle}-(daily|mention)\\.ya?ml$`);
+  return readdirSync5(dir).filter((f) => mine.test(f)).sort().map((name) => ({ name, text: readFileSync9(join11(dir, name), "utf8") }));
 }
 async function checkOrgOnline(ws, org) {
   const out = [];
@@ -2165,6 +2306,9 @@ async function checkStaffOnline(scope, manifest, callers) {
       }
     );
   }
+  const proven = runs.some(
+    ({ res }) => (res.data ?? []).some((r) => r.status === "completed" && r.conclusion === "success")
+  );
   for (const { name, res } of runs) {
     if (!res.ok) {
       out.push({
@@ -2189,13 +2333,20 @@ async function checkStaffOnline(scope, manifest, callers) {
       continue;
     }
     if (!real.length) {
-      out.push({
-        scope,
-        level: "warn",
-        id: "runs",
-        title: `${name}: ${all.length} recent triggers, all gated out before doing anything`,
-        fix: "Nothing here has exercised the app grant. A skipped run proves only the trigger."
-      });
+      out.push(
+        proven ? {
+          scope,
+          level: "ok",
+          id: "runs",
+          title: `${name}: ${all.length} recent triggers, all gated out, which is its normal state`
+        } : {
+          scope,
+          level: "warn",
+          id: "runs",
+          title: `${name}: ${all.length} recent triggers, all gated out before doing anything`,
+          fix: "Nothing in this repo has exercised the app grant. A skipped run proves only the trigger, so trigger one workflow here by hand before trusting any of them."
+        }
+      );
       continue;
     }
     const timeout = timeoutOf(callers.find((c) => c.name === name)?.text ?? "");
@@ -2208,7 +2359,15 @@ async function checkStaffOnline(scope, manifest, callers) {
     const cancelled = real.filter((r) => !killed(r) && r.conclusion === "cancelled");
     const ok = real.filter((r) => r.conclusion === "success");
     const ceiling = timedOut.length ? Math.round(runMinutes(timedOut[0])) : timeout;
-    if (timedOut.length) {
+    const provedSince = ceiling !== timeout && ok.some((r) => r.createdAt > timedOut[0].createdAt);
+    if (timedOut.length && provedSince) {
+      out.push({
+        scope,
+        level: "ok",
+        id: "runs.timeout",
+        title: `${name}: the ${ceiling}m ceiling that killed ${timedOut.length} of the last ${real.length} was raised to ${timeout}m, and a run has finished since`
+      });
+    } else if (timedOut.length) {
       out.push({
         scope,
         level: "fail",
@@ -2301,7 +2460,7 @@ import { writeFileSync as writeFileSync4 } from "fs";
 
 // src/lib/export.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync11, readdirSync as readdirSync5, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
+import { existsSync as existsSync11, readdirSync as readdirSync6, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
 import { join as join12, relative as relative3 } from "path";
 var SKIP = /* @__PURE__ */ new Set([".git", "node_modules", ".next", "dist", "out", ".DS_Store"]);
 function buildExport(ws, org, parseYaml, opts = {}) {
@@ -2344,11 +2503,13 @@ function buildExport(ws, org, parseYaml, opts = {}) {
     s.soloBots = s.bots.filter((b) => times.get(b) === 1);
     s.sharedBots = s.bots.filter((b) => (times.get(b) ?? 0) > 1);
   }
+  const humans = readHumans(org);
   return {
     org: org.org,
     name: org.name,
     opsName: ws.opsName,
-    human: org.human ?? {},
+    human: humans[0] ?? org.human ?? {},
+    humans,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     staff
   };
@@ -2369,7 +2530,7 @@ function readRig(root, manifest, commits) {
   const wfDir = join12(root, ".github", "workflows");
   const declared = manifest.surfaces ?? [];
   return {
-    workflows: existsSync11(wfDir) ? readdirSync5(wfDir).filter((f) => /\.ya?ml$/.test(f)).sort() : [],
+    workflows: existsSync11(wfDir) ? readdirSync6(wfDir).filter((f) => /\.ya?ml$/.test(f)).sort() : [],
     hasCharter: existsSync11(join12(root, "CHARTER.md")),
     hasManifest: existsSync11(join12(root, "staff.yaml")),
     missingSurfaces: declared.filter((s) => s?.path && !existsSync11(join12(root, s.path))).map((s) => s.path),
@@ -2398,7 +2559,7 @@ function readSurfaces(root, declared) {
   }));
 }
 function walk2(dir, root, out = []) {
-  for (const name of readdirSync5(dir)) {
+  for (const name of readdirSync6(dir)) {
     if (SKIP.has(name)) continue;
     const full = join12(dir, name);
     const st = statSync3(full);
@@ -2839,7 +3000,7 @@ import { dirname as dirname5, join as join14 } from "path";
 var hireHelp = `
 roster hire <handle> [--name "Chief Financial Officer"] [--apply]
 
-  Scaffold a new staff member: their brain repo, the three caller workflows, a manifest, a
+  Scaffold a new staff member: their brain repo, the two caller workflows, a manifest, a
   memory index, a charter stub, labels, a pinned status issue, and the peer wiring in both
   directions.
 
@@ -2856,7 +3017,6 @@ roster hire <handle> [--name "Chief Financial Officer"] [--apply]
   --model <id>           defaults to org.yaml's
   --timeout <n>          daily run ceiling, minutes
   --mention-timeout <n>  mention run ceiling, minutes
-  --pr-timeout <n>       PR-amendment run ceiling, minutes
   --secret-prefix <X>    secrets are <X>_APP_ID and <X>_APP_PRIVATE_KEY. Defaults to HANDLE.
   --app <slug>           this staff member's GitHub App. Defaults to the pattern its peers use.
   --public-app <slug>    the shared public identity. Defaults to whatever the peers use.
@@ -2937,9 +3097,11 @@ function buildPlan(ws, org, handle, opts, parseYaml) {
     worksIn: (org.repos ?? []).filter((r) => r.role === "product").map((r) => `${org.org}/${r.name}`),
     schedule,
     model,
-    timeout: opts.timeout ?? org.defaults?.timeout_minutes ?? 60,
-    mentionTimeout: opts.mentionTimeout ?? 30,
-    prMentionTimeout: opts.prMentionTimeout ?? 60,
+    timeout: opts.timeout ?? org.defaults?.timeout_minutes ?? 90,
+    // A mention that ends in a build needs a session's room: the product repo's gate alone
+    // can outlast a short ceiling, and a hire that has to discover that costs a run. An org
+    // that wants them split says so; absent that, one number governs both.
+    mentionTimeout: opts.mentionTimeout ?? org.defaults?.mention_timeout_minutes ?? org.defaults?.timeout_minutes ?? 90,
     secretPrefix: opts.secretPrefix ?? handle.toUpperCase(),
     publicSecretPrefix: publicIdentity?.secret_prefix ?? "BOT",
     app: app ?? `${handle}`,
@@ -2956,16 +3118,24 @@ function buildPlan(ws, org, handle, opts, parseYaml) {
       "status_issue is 0 until --apply opens the pinned issue; prompts will not compose before then"
     );
   }
+  const humans = readHumans(org);
   const orgSpec2 = {
     org: org.org,
     name: org.name,
     opsRepo: `${org.org}/${ws.opsName}`,
     opsDirName: ws.opsName,
-    human: org.human?.github ?? "",
-    humanMarker: org.human?.marker ?? "human"
+    human: humans[0]?.github ?? "",
+    humanMarker: humans[0]?.marker ?? "human",
+    humanLogins: humans.map((h) => h.github).filter(Boolean),
+    allowedTools: toolsOf(org)
   };
   if (!orgSpec2.human)
     warnings.push("org.yaml has no human.github, so the mention gate will never match");
+  if (humans.length > 1) {
+    warnings.push(
+      `the mention gate accepts ${humans.map((h) => h.github).join(", ")} \u2014 everyone in org.yaml`
+    );
+  }
   const tokens = tokensFor(orgSpec2, staff);
   const files = renderTree(brainTemplateDir(), tokens);
   for (const [rel, text] of briefCommands(["charter"], tokens)) files.set(rel, text);
@@ -3301,7 +3471,6 @@ function parseFlags6(argv) {
     else if (flag === "--model") out.model = value;
     else if (flag === "--timeout") out.timeout = Number(value);
     else if (flag === "--mention-timeout") out.mentionTimeout = Number(value);
-    else if (flag === "--pr-timeout") out.prMentionTimeout = Number(value);
     else if (flag === "--secret-prefix") out.secretPrefix = value;
     else if (flag === "--app") out.app = value;
     else if (flag === "--public-app") out.publicApp = value;
@@ -3362,7 +3531,7 @@ async function initCommand(argv) {
 `);
     return 2;
   }
-  const files = initFiles({ org: opts.org, name, human, marker, opsName, agent: opts.agent });
+  const files = await initFiles({ org: opts.org, name, human, marker, opsName, agent: opts.agent });
   process.stdout.write(`
   roster init \u2014 ${name} (${opts.org})
 
@@ -3438,12 +3607,18 @@ async function initCommand(argv) {
 `);
   return 0;
 }
-function initFiles(o) {
+async function initFiles(o) {
   const files = /* @__PURE__ */ new Map();
   for (const rel of templateFiles(opsTemplateDir())) {
     files.set(rel, readFileSync13(join15(opsTemplateDir(), rel), "utf8"));
   }
-  files.set("org.yaml", orgYaml({ ...o, agent: o.agent ?? "claude-code-action" }));
+  const agent = o.agent ?? "claude-code-action";
+  const preset = await agentPreset(agent);
+  const model = preset.model || '"FILL IN: a model the provider below serves"';
+  files.set("org.yaml", orgYaml({ ...o, agent, model }));
+  if (preset.config) {
+    files.set(preset.config.path, JSON.stringify(preset.config.contents, null, 2) + "\n");
+  }
   files.set("org/business.md", businessStub(o.name, o.org));
   for (const [rel, text] of briefCommands(["discover", "voice"], {
     ORG: o.org,
@@ -3458,6 +3633,18 @@ function initFiles(o) {
   files.set(".roster-version", stamp2() + "\n");
   return files;
 }
+async function agentPreset(id) {
+  const path = join15(opsTemplateDir(), "agents.mjs");
+  const { PRESETS } = await import(`file://${path}`);
+  const preset = PRESETS[id];
+  if (!preset) {
+    throw new Error(
+      `unknown agent "${id}". Known: ${Object.keys(PRESETS).join(", ")}.
+  Anything else works by writing install, run and token_env into org.yaml by hand.`
+    );
+  }
+  return preset;
+}
 function orgYaml(o) {
   return `# The org manifest. Read at the top of every composed prompt.
 # Kept deliberately simple: compose.mjs parses a small, strict YAML subset, and a manifest
@@ -3467,6 +3654,11 @@ org: ${o.org}
 name: ${o.name}
 ops_dir: ${o.opsName}
 
+# Who the staff answer to. More than one person? Use a "humans:" list instead \u2014 the mention
+# gate accepts every login in it, and the first is the one the prompts address:
+#   humans:
+#     - { name: ${o.human}, github: ${o.human}, marker: ${o.marker}, role: founder }
+#     - { name: Sam, github: sam, marker: sam, role: operations }
 human:
   name: ${o.human}
   github: ${o.human}
@@ -3481,11 +3673,18 @@ experiment_private: true
 # works by writing the three fields out longhand. See agents.mjs.
 agent:
   id: ${o.agent}
+  # How much it may do without stopping to ask: full, workspace, or read-only. One word here,
+  # translated into each agent's own vocabulary by agents.mjs \u2014 a tool list for Claude, a
+  # sandbox and an approval policy for Codex, a development mode for nanocoder.
+  permissions: full
+  # Anything else, in that agent's own words, passed through untranslated:
+  #   options:
+  #     provider: openrouter
 
 defaults:
-  model: claude-opus-5
-  timeout_minutes: 60
-  allowed_tools: [Bash, Read, Write, Edit, Glob, Grep, WebFetch, WebSearch]
+  model: ${o.model}
+  timeout_minutes: 90
+  mention_timeout_minutes: 90
 
 # Every staff member, and where their brain lands in the runner checkout.
 # Written by \`roster hire\`.
@@ -3659,16 +3858,81 @@ function parseFlags8(argv) {
 }
 
 // src/commands/portal.ts
-import { execFileSync as execFileSync7 } from "child_process";
+import { execFileSync as execFileSync8 } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { existsSync as existsSync21, readFileSync as readFileSync19, statSync as statSync5 } from "fs";
+import { createReadStream, existsSync as existsSync22, readdirSync as readdirSync9, readFileSync as readFileSync19, statSync as statSync5 } from "fs";
 import { createServer as createServer2 } from "http";
-import { extname as extname2, join as join23, resolve as resolve5 } from "path";
+import { extname as extname3, join as join24, resolve as resolve5 } from "path";
 
 // src/lib/act.ts
 import { execFile as execFile3 } from "child_process";
 import { promisify as promisify3 } from "util";
+
+// src/lib/ask.ts
+var MAX_PATCH_LINES = 40;
+function askTitle(req) {
+  const name = req.pr.repo.split("/")[1] ?? req.pr.repo;
+  const head2 = `${name}#${req.pr.number} \u2014 `;
+  const room = 120 - head2.length;
+  const title = req.pr.title.trim() || "a pull request";
+  return head2 + (title.length > room ? `${title.slice(0, room - 1).trimEnd()}\u2026` : title);
+}
+function askBody(req) {
+  const { staff, pr, anchor } = req;
+  const said = req.body.trim();
+  const isPr = pr.kind !== "issue";
+  const it = isPr ? "pull request" : "issue";
+  const out = [];
+  out.push(stripLeadingMention(said, staff.mention) ? `${staff.mention} ${said}` : said);
+  out.push("", "---", "");
+  out.push(`**This is about ${pr.repo}#${pr.number} \u2014 "${pr.title.trim()}".**`);
+  out.push("", pr.url);
+  if (pr.head && pr.base) out.push("", `Branch \`${pr.head}\` \u2192 \`${pr.base}\`.`);
+  if (anchor?.path) {
+    out.push("", `They were looking at \`${anchor.path}\`.`);
+    const hunk = clip(anchor.patch ?? "");
+    if (hunk) out.push("", fence2(hunk, "diff"));
+    else if (anchor.patch) out.push("", "The diff for it is on the pull request.");
+  }
+  out.push(
+    "",
+    `**Answer on the ${it}, not here.** That is where it will be read${isPr ? ", and it is where the diff is" : ""}:`,
+    "",
+    fence2(`gh issue comment ${pr.number} --repo ${pr.repo} --body "\u2026"`, ""),
+    "",
+    ...isPr ? [
+      pr.head ? `Push any change to \`${pr.head}\`. Close this issue once the reply is up.` : "Push any change to the pull request's branch. Close this issue once the reply is up."
+    ] : ["Close this issue once the reply is up."]
+  );
+  return `${out.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}
+`;
+}
+function stripLeadingMention(said, mention) {
+  return !new RegExp(`(^|\\s)${escapeRe(mention)}(\\s|$)`).test(said);
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function clip(patch) {
+  const lines = patch.replace(/\s+$/, "").split("\n");
+  if (!lines[0]) return "";
+  if (lines.length <= MAX_PATCH_LINES) return lines.join("\n");
+  return [
+    ...lines.slice(0, MAX_PATCH_LINES),
+    `\u2026 ${lines.length - MAX_PATCH_LINES} more lines, on the pull request`
+  ].join("\n");
+}
+function fence2(text, lang) {
+  const longest = Math.max(0, ...[...text.matchAll(/`+/g)].map((m) => m[0].length));
+  const ticks = "`".repeat(Math.max(3, longest + 1));
+  return `${ticks}${lang}
+${text}
+${ticks}`;
+}
+
+// src/lib/act.ts
 var run3 = promisify3(execFile3);
+var MERGE_FLAG = { squash: "--squash", merge: "--merge", rebase: "--rebase" };
 async function act(req) {
   const { action, repo } = req;
   if (action === "create") {
@@ -3679,6 +3943,37 @@ async function act(req) {
     const { stdout } = await run3("gh", args, { encoding: "utf8" });
     return { ok: true, action, url: stdout.trim().split("\n").pop() };
   }
+  if (action === "ask") {
+    const ask = req.ask;
+    if (!ask) throw new Error("an ask needs to say who it is for and what it is about");
+    if (!ask.staff?.brain) throw new Error(`${ask.staff?.name ?? "they"} has no brain repo`);
+    if (repo !== ask.staff.brain)
+      throw new Error(`an ask goes to ${ask.staff.brain}, not to ${repo}`);
+    if (!ask.body?.trim()) throw new Error("an empty ask is not an ask");
+    const title = (req.title ?? "").trim() || askTitle(ask);
+    const args = ["issue", "create", "--repo", repo, "--title", title, "--body-file", "-"];
+    for (const l of req.labels ?? []) args.push("--label", l);
+    const { stdout } = await execWithStdin(args, askBody(ask));
+    const url = stdout.trim().split("\n").pop();
+    if (!req.alsoOnPr) return { ok: true, action, url };
+    const note = `${ask.body.trim()}
+
+\u2014 asked ${ask.staff.name} (${ask.staff.mention}): ${url ?? ask.staff.brain}`;
+    try {
+      const posted = await execWithStdin(
+        ["issue", "comment", String(ask.pr.number), "--repo", ask.pr.repo, "--body-file", "-"],
+        note
+      );
+      return { ok: true, action, url, prUrl: posted.stdout.trim().split("\n").pop() };
+    } catch (err) {
+      return {
+        ok: true,
+        action,
+        url,
+        warning: `${ask.staff.name} was asked, but the copy on ${ask.pr.repo}#${ask.pr.number} did not go up: ${String(err?.message ?? err).split("\n")[0]}`
+      };
+    }
+  }
   const number = req.number;
   if (!Number.isInteger(number) || number <= 0)
     throw new Error("a valid issue number is required");
@@ -3703,8 +3998,37 @@ async function act(req) {
     await run3("gh", ["issue", "reopen", n, "--repo", repo], { encoding: "utf8" });
     return { ok: true, action };
   }
+  if (action === "merge") {
+    const how = req.mergeMethod ?? await mergeMethodFor(repo);
+    const flag = MERGE_FLAG[how];
+    if (!flag) throw new Error(`unknown merge method "${req.mergeMethod}"`);
+    const args = ["pr", "merge", n, "--repo", repo, flag];
+    if (req.body?.trim() && how !== "rebase") args.push("--body", req.body.trim());
+    await run3("gh", args, { encoding: "utf8" });
+    return { ok: true, action, mergedBy: how };
+  }
   throw new Error(`unknown action "${action}"`);
 }
+async function mergeMethodFor(repo) {
+  try {
+    const { stdout } = await run3(
+      "gh",
+      [
+        "api",
+        `repos/${repo}`,
+        "--jq",
+        "[.allow_squash_merge,.allow_merge_commit,.allow_rebase_merge]"
+      ],
+      { encoding: "utf8" }
+    );
+    const [squash, commit, rebase] = JSON.parse(stdout);
+    if (squash) return "squash";
+    if (commit) return "merge";
+    if (rebase) return "rebase";
+  } catch {
+  }
+  return "squash";
+}
 function execWithStdin(args, input) {
   return new Promise((resolve6, reject) => {
     const child = execFile3(
@@ -3717,26 +4041,144 @@ function execWithStdin(args, input) {
   });
 }
 
+// src/lib/attach.ts
+import { execFileSync as execFileSync7 } from "child_process";
+import { existsSync as existsSync15, mkdirSync as mkdirSync4, writeFileSync as writeFileSync7 } from "fs";
+import { basename, extname, join as join17 } from "path";
+var MAX_UPLOAD = 25 * 1024 * 1024;
+var ATTACH_DIR = "attachments";
+function attach(opts) {
+  const { repoDir, repo, data, today } = opts;
+  if (!existsSync15(join17(repoDir, ".git"))) {
+    throw new Error(`${repo} is not checked out here, so there is nowhere to put the file`);
+  }
+  if (!data.length) throw new Error("that file is empty");
+  if (data.length > MAX_UPLOAD) {
+    throw new Error(`${basename(opts.name)} is larger than ${MAX_UPLOAD / 1024 / 1024}MB`);
+  }
+  const rel = free(repoDir, `${ATTACH_DIR}/${today}-${safeName(opts.name)}`);
+  const full = join17(repoDir, rel);
+  mkdirSync4(join17(repoDir, ATTACH_DIR), { recursive: true });
+  writeFileSync7(full, data);
+  const git4 = (args) => execFileSync7("git", ["-C", repoDir, ...args], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  try {
+    git4(["add", "--", rel]);
+    git4(["commit", "-m", `portal: attach ${rel}`, "--", rel]);
+  } catch (err) {
+    throw new Error(`commit failed: ${short2(err)}`);
+  }
+  const branch = git4(["rev-parse", "--abbrev-ref", "HEAD"]).trim();
+  const url = `https://github.com/${repo}/blob/${branch}/${rel.split("/").map(encodeURIComponent).join("/")}`;
+  try {
+    git4(["push"]);
+  } catch (err) {
+    return { path: rel, url, bytes: data.length, pushed: false, note: short2(err) };
+  }
+  return { path: rel, url, bytes: data.length, pushed: true };
+}
+function safeName(raw) {
+  const name = basename(String(raw ?? "")).replace(/^\.+/, "");
+  const ext = extname(name).toLowerCase().slice(0, 12);
+  const stem = name.slice(0, name.length - extname(name).length).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "file";
+  return stem + ext.replace(/[^a-z0-9.]/g, "");
+}
+function free(repoDir, rel) {
+  if (!existsSync15(join17(repoDir, rel))) return rel;
+  const ext = extname(rel);
+  const stem = rel.slice(0, rel.length - ext.length);
+  for (let n = 2; n < 500; n++) {
+    const next = `${stem}-${n}${ext}`;
+    if (!existsSync15(join17(repoDir, next))) return next;
+  }
+  throw new Error("too many files by that name today");
+}
+function short2(e) {
+  const msg = e instanceof Error ? e.stderr?.toString() || e.message : String(e);
+  const line = msg.split("\n").find((l) => l.trim()) ?? msg;
+  return line.length > 200 ? `${line.slice(0, 199)}\u2026` : line;
+}
+
 // src/lib/docs.ts
-import { existsSync as existsSync15, readdirSync as readdirSync6, readFileSync as readFileSync14 } from "fs";
-import { dirname as dirname7, join as join17 } from "path";
+import { existsSync as existsSync16, readdirSync as readdirSync7, readFileSync as readFileSync14 } from "fs";
+import { dirname as dirname7, join as join18 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function docsDir() {
   const here = dirname7(fileURLToPath2(import.meta.url));
-  const candidates = [join17(here, "..", "..", "docs"), join17(here, "..", "docs")];
-  for (const path of candidates) if (existsSync15(path)) return path;
+  const candidates = [join18(here, "..", "..", "docs"), join18(here, "..", "docs")];
+  for (const path of candidates) if (existsSync16(path)) return path;
   throw new Error(`docs not found. Looked in:
   ${candidates.join("\n  ")}`);
 }
 function docPages() {
   const dir = docsDir();
-  const all = readdirSync6(dir).filter((f) => f.endsWith(".md"));
-  const index = readFileSync14(join17(dir, "README.md"), "utf8");
+  const all = readdirSync7(dir).filter((f) => f.endsWith(".md"));
+  const index = readFileSync14(join18(dir, "README.md"), "utf8");
   const ordered = [...index.matchAll(/\[([^\]]+)\]\(([\w.-]+\.md)\)/g)].map((m) => ({ title: m[1], file: m[2] })).filter((d, i, xs) => all.includes(d.file) && xs.findIndex((x) => x.file === d.file) === i);
   const listed = new Set(ordered.map((d) => d.file));
-  const rest = all.filter((f) => f !== "README.md" && !listed.has(f)).map((file) => ({ file, title: titleOf(join17(dir, file)) }));
+  const rest = all.filter((f) => f !== "README.md" && !listed.has(f)).map((file) => ({ file, title: titleOf(join18(dir, file)) }));
   return [{ file: "README.md", title: "Overview" }, ...ordered, ...rest];
 }
+var ASSET_TYPES = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".webp": "image/webp"
+};
+function docAsset(name) {
+  const dir = join18(docsDir(), "images");
+  if (!existsSync16(dir)) return null;
+  const wanted = String(name ?? "").replace(/^images\//, "");
+  const found = readdirSync7(dir).find((f) => f === wanted);
+  if (!found) return null;
+  const type = ASSET_TYPES[found.slice(found.lastIndexOf(".")).toLowerCase()];
+  return type ? { path: join18(dir, found), type } : null;
+}
+function searchDocs(query2, snippets = 3) {
+  const terms = String(query2 ?? "").toLowerCase().split(/\s+/).map((t) => t.trim()).filter(Boolean);
+  if (!terms.length) return [];
+  const dir = docsDir();
+  const out = [];
+  for (const page2 of docPages()) {
+    const text = readFileSync14(join18(dir, page2.file), "utf8").replace(/^---\n[\s\S]*?\n---\n/, "");
+    const haystack = (page2.title + "\n" + text).toLowerCase();
+    if (!terms.every((t) => haystack.includes(t))) continue;
+    const title = page2.title.toLowerCase();
+    const matches = [];
+    let body = 0;
+    text.split("\n").forEach((raw, i) => {
+      const line = raw.trim();
+      if (!line) return;
+      const hits = terms.filter((t) => line.toLowerCase().includes(t)).length;
+      if (!hits) return;
+      body += hits === terms.length ? 2 : 1;
+      if (line.startsWith("#")) body += 8;
+      if (matches.length < snippets) {
+        matches.push({ line: i + 1, text: snippet(line, terms) });
+      }
+    });
+    out.push({
+      ...page2,
+      score: terms.filter((t) => title.includes(t)).length * 100 + Math.min(body, 60),
+      matches
+    });
+  }
+  return out.sort((a, b) => b.score - a.score);
+}
+function snippet(line, terms, width = 150) {
+  const clean = line.replace(/^#+\s*/, "").replace(/^[-*|]\s*/, "");
+  if (clean.length <= width) return clean;
+  const at = Math.min(
+    ...terms.map((t) => clean.toLowerCase().indexOf(t)).filter((n) => n >= 0),
+    clean.length
+  );
+  const from = Math.max(0, at - 40);
+  return (from ? "\u2026" : "") + clean.slice(from, from + width).trim() + "\u2026";
+}
 function titleOf(path) {
   const first = readFileSync14(path, "utf8").split("\n").find((l) => l.startsWith("# "));
   return first ? first.slice(2).trim() : path.split("/").pop();
@@ -3746,9 +4188,15 @@ function titleOf(path) {
 import { execFile as execFile4 } from "child_process";
 import { promisify as promisify4 } from "util";
 var run4 = promisify4(execFile4);
+var REACTIONS = `
+  reactionGroups {
+    content
+    reactors(first:6) { totalCount nodes { ... on User { login } ... on Bot { login } } }
+  }
+`;
 var TIMELINE_COMMON = `
   __typename
-  ... on IssueComment { author { login } createdAt body url }
+  ... on IssueComment { author { login } createdAt body url ${REACTIONS} }
   ... on CrossReferencedEvent {
     actor { login } createdAt
     source {
@@ -3804,6 +4252,7 @@ query($owner:String!, $name:String!) {
       nodes {
         number title body url state createdAt updatedAt
         author { login }
+        ${REACTIONS}
         labels(first:12) { nodes { name } }
         assignees(first:8) { nodes { login } }
         timelineItems(last:80, itemTypes:${ISSUE_TYPES}) { nodes { ${TIMELINE_COMMON} } }
@@ -3811,8 +4260,9 @@ query($owner:String!, $name:String!) {
     }
     pullRequests(states:OPEN, first:60, orderBy:{field:UPDATED_AT, direction:DESC}) {
       nodes {
-        number title body url state createdAt updatedAt isDraft
+        number title body url state createdAt updatedAt isDraft mergeable
         author { login }
+        ${REACTIONS}
         labels(first:12) { nodes { name } }
         assignees(first:8) { nodes { login } }
         commits(last:1) { nodes { commit { statusCheckRollup { state } } } }
@@ -3827,6 +4277,7 @@ query($owner:String!, $name:String!) {
       nodes {
         number title body url state createdAt updatedAt
         author { login }
+        ${REACTIONS}
         labels(first:12) { nodes { name } }
         assignees(first:8) { nodes { login } }
         timelineItems(last:${CLOSED_TIMELINE}, itemTypes:${ISSUE_TYPES}) {
@@ -3840,6 +4291,7 @@ query($owner:String!, $name:String!) {
       nodes {
         number title body url state createdAt updatedAt isDraft
         author { login }
+        ${REACTIONS}
         labels(first:12) { nodes { name } }
         assignees(first:8) { nodes { login } }
         timelineItems(last:${CLOSED_TIMELINE}, itemTypes:${PR_TYPES}) {
@@ -3863,6 +4315,7 @@ async function fetchInbox(repos) {
           const item = shape(n, full, r.role, "pr");
           item.draft = n.isDraft;
           item.checks = rollup(n.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state);
+          item.mergeable = n.mergeable;
           items.push(item);
         }
         const cutoff = Date.now() - CLOSED_DAYS * 864e5;
@@ -3876,7 +4329,7 @@ async function fetchInbox(repos) {
           items.push(item);
         }
       } catch (e) {
-        errors.push(`${full}: ${short2(e)}`);
+        errors.push(`${full}: ${short3(e)}`);
       }
     })
   );
@@ -3908,15 +4361,30 @@ function shape(n, repo, role, kind) {
     url: n.url,
     state: n.state ?? "OPEN",
     comments: events.filter((e) => e.type === "comment").map((e) => ({ author: e.actor, createdAt: e.createdAt, body: e.body ?? "" })),
-    events
+    events,
+    reactions: reactions(n)
   };
 }
+function reactions(n) {
+  return (n.reactionGroups ?? []).filter((g) => (g.reactors?.totalCount ?? 0) > 0).map((g) => ({
+    content: g.content,
+    count: g.reactors.totalCount,
+    by: (g.reactors.nodes ?? []).map((u) => u?.login).filter(Boolean)
+  }));
+}
 function event(e) {
   const who = e.actor?.login ?? e.author?.login ?? "";
   const at = e.createdAt;
   switch (e.__typename) {
     case "IssueComment":
-      return { type: "comment", actor: who, createdAt: at, body: e.body ?? "", url: e.url };
+      return {
+        type: "comment",
+        actor: who,
+        createdAt: at,
+        body: e.body ?? "",
+        url: e.url,
+        reactions: reactions(e)
+      };
     case "CrossReferencedEvent": {
       const s = e.source;
       if (!s?.number) return null;
@@ -4021,7 +4489,7 @@ function rollup(state) {
   if (/FAILURE|ERROR/i.test(state)) return "failing";
   return "pending";
 }
-function short2(e) {
+function short3(e) {
   const msg = e instanceof Error ? e.message : String(e);
   const line = msg.split("\n").find((l) => l.trim() && !/^\s*$/.test(l)) ?? msg;
   return line.length > 200 ? line.slice(0, 199) + "\u2026" : line;
@@ -4116,8 +4584,8 @@ function ensureNewline(text) {
 }
 
 // src/lib/pastebrief.ts
-import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
+import { join as join19 } from "path";
 var WRITES = {
   discover: (c) => [`${c.opsName}/org/business.md`],
   voice: (c) => [`${c.opsName}/org/voice.md`],
@@ -4208,13 +4676,13 @@ ${END}`).join("\n\n");
 function fileBlock(ws, rel, note) {
   const body = read2(ws, rel);
   if (!body.trim()) return [`### \`${rel}\``, "", `*Empty or absent (${note}).*`, ""];
-  return [`### \`${rel}\``, "", `*${note}*`, "", fence2(body), ""];
+  return [`### \`${rel}\``, "", `*${note}*`, "", fence3(body), ""];
 }
 function read2(ws, rel) {
-  const full = join18(ws.root, rel);
-  return existsSync16(full) ? readFileSync15(full, "utf8") : "";
+  const full = join19(ws.root, rel);
+  return existsSync17(full) ? readFileSync15(full, "utf8") : "";
 }
-function fence2(text) {
+function fence3(text) {
   const longest = (text.match(/`{3,}/g) ?? []).reduce((n, m) => Math.max(n, m.length), 2);
   const bars = "`".repeat(longest + 1);
   return `${bars}
@@ -4222,15 +4690,15 @@ ${text.trimEnd()}
 ${bars}`;
 }
 function briefTemplate(kind) {
-  const path = join18(briefTemplateDir(), `${kind}.md`);
-  if (!existsSync16(path)) throw new Error(`no brief template for "${kind}"`);
+  const path = join19(briefTemplateDir(), `${kind}.md`);
+  if (!existsSync17(path)) throw new Error(`no brief template for "${kind}"`);
   return readFileSync15(path, "utf8");
 }
 
 // src/lib/setup.ts
 import { execFile as execFile5 } from "child_process";
-import { existsSync as existsSync17, mkdirSync as mkdirSync4, readFileSync as readFileSync16 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync16 } from "fs";
+import { join as join20 } from "path";
 var AGENTS = [
   {
     id: "claude-code-action",
@@ -4294,14 +4762,14 @@ async function setupStatus(startedIn) {
   };
 }
 function readOrgName(opsDir) {
-  const path = join19(opsDir, "org.yaml");
-  if (!existsSync17(path)) return void 0;
+  const path = join20(opsDir, "org.yaml");
+  if (!existsSync18(path)) return void 0;
   const m = /^org:\s*(\S+)\s*$/m.exec(readFileSync16(path, "utf8"));
   return m?.[1];
 }
 function readRepoNames(opsDir) {
-  const path = join19(opsDir, "org.yaml");
-  if (!existsSync17(path)) return [];
+  const path = join20(opsDir, "org.yaml");
+  if (!existsSync18(path)) return [];
   const names = [];
   let inside = false;
   for (const line of readFileSync16(path, "utf8").split("\n")) {
@@ -4317,29 +4785,29 @@ function readRepoNames(opsDir) {
   return names;
 }
 async function loadFrameworkComposer() {
-  const path = join19(templatesRoot(), "ops", "compose.mjs");
+  const path = join20(templatesRoot(), "ops", "compose.mjs");
   return await import(`file://${path}`);
 }
 async function joinTenant(root, org) {
-  mkdirSync4(root, { recursive: true });
+  mkdirSync5(root, { recursive: true });
   const cloned = [];
-  const opsDir = join19(root, "roster-ops");
-  if (!existsSync17(opsDir)) {
+  const opsDir = join20(root, "roster-ops");
+  if (!existsSync18(opsDir)) {
     await clone(`https://github.com/${org}/roster-ops.git`, opsDir);
     cloned.push("roster-ops");
   }
-  if (!existsSync17(join19(opsDir, "org.yaml"))) {
+  if (!existsSync18(join20(opsDir, "org.yaml"))) {
     throw new Error(`${org}/roster-ops has no org.yaml, so it is not a roster tenant`);
   }
-  const { parseYaml } = await import(`file://${join19(opsDir, "compose.mjs")}`).then(
+  const { parseYaml } = await import(`file://${join20(opsDir, "compose.mjs")}`).then(
     (m) => m
   );
-  const orgFile = parseYaml(readFileSync16(join19(opsDir, "org.yaml"), "utf8"), "org.yaml");
+  const orgFile = parseYaml(readFileSync16(join20(opsDir, "org.yaml"), "utf8"), "org.yaml");
   for (const person of orgFile.staff ?? []) {
     const dir = person.dir ?? person.handle;
-    if (existsSync17(join19(root, dir))) continue;
+    if (existsSync18(join20(root, dir))) continue;
     try {
-      await clone(`https://github.com/${org}/${dir}.git`, join19(root, dir));
+      await clone(`https://github.com/${org}/${dir}.git`, join20(root, dir));
       cloned.push(dir);
     } catch {
     }
@@ -4354,16 +4822,16 @@ function clone(url, into) {
 
 // src/lib/sync.ts
 import { execFile as execFile6 } from "child_process";
-import { existsSync as existsSync18 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync19 } from "fs";
+import { join as join21 } from "path";
 import { promisify as promisify5 } from "util";
 var run5 = promisify5(execFile6);
 async function syncRepos(root, dirs) {
-  return Promise.all(dirs.map((dir) => syncOne(join20(root, dir), dir)));
+  return Promise.all(dirs.map((dir) => syncOne(join21(root, dir), dir)));
 }
 async function syncOne(path, dir) {
   const base2 = { dir, behind: 0, ahead: 0, dirty: false, pulled: false };
-  if (!existsSync18(join20(path, ".git"))) return { ...base2, skipped: "no-remote" };
+  if (!existsSync19(join21(path, ".git"))) return { ...base2, skipped: "no-remote" };
   const git4 = async (...args) => (await run5("git", ["-C", path, ...args], { encoding: "utf8" })).stdout.trim();
   try {
     const remotes = await git4("remote");
@@ -4384,35 +4852,37 @@ async function syncOne(path, dir) {
     if (dirty) return { ...base2, ahead, behind, dirty, skipped: "dirty" };
     if (ahead > 0) return { ...base2, ahead, behind, dirty, skipped: "diverged" };
     await git4("pull", "--ff-only", "--quiet");
-    return { ...base2, ahead, behind, dirty, pulled: true };
+    return { ...base2, ahead, behind: 0, dirty, pulled: true };
   } catch (err) {
-    return { ...base2, error: firstLine2(err) };
+    return { ...base2, error: reason(err) };
   }
 }
-function firstLine2(e) {
-  const msg = e instanceof Error ? e.message : String(e);
-  const line = msg.split("\n").find((l) => l.trim()) ?? msg;
+function reason(e) {
+  const err = e;
+  const text = String(err?.stderr ?? "").trim() || String(err?.message ?? e);
+  const lines = text.split("\n").map((l) => l.trim()).filter(Boolean);
+  const line = lines.find((l) => !/^Command failed:/i.test(l)) ?? lines[0] ?? String(e);
   return line.length > 180 ? line.slice(0, 179) + "\u2026" : line;
 }
 
 // src/portal/assets.ts
-import { existsSync as existsSync19, readFileSync as readFileSync17, statSync as statSync4 } from "fs";
-import { dirname as dirname8, extname, join as join21, resolve as resolve4 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync17, statSync as statSync4 } from "fs";
+import { dirname as dirname8, extname as extname2, join as join22, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function portalDir() {
   const here = dirname8(fileURLToPath3(import.meta.url));
   const candidates = [
-    join21(here, "..", "..", "templates", "portal"),
+    join22(here, "..", "..", "templates", "portal"),
     // src/portal → package root
-    join21(here, "..", "templates", "portal")
+    join22(here, "..", "templates", "portal")
     // dist → package root
   ];
-  for (const path of candidates) if (existsSync19(join21(path, "index.html"))) return path;
+  for (const path of candidates) if (existsSync20(join22(path, "index.html"))) return path;
   throw new Error(`portal UI not found. Looked in:
   ${candidates.join("\n  ")}`);
 }
 function portalIndex() {
-  return readFileSync17(join21(portalDir(), "index.html"), "utf8");
+  return readFileSync17(join22(portalDir(), "index.html"), "utf8");
 }
 var ASSET_MIME = {
   ".css": "text/css; charset=utf-8",
@@ -4426,15 +4896,15 @@ function portalAsset(rel) {
   const root = portalDir();
   const full = resolve4(root, rel);
   if (!full.startsWith(resolve4(root) + "/")) return null;
-  const type = ASSET_MIME[extname(full).toLowerCase()];
+  const type = ASSET_MIME[extname2(full).toLowerCase()];
   if (!type) return null;
-  if (!existsSync19(full) || statSync4(full).isDirectory()) return null;
+  if (!existsSync20(full) || statSync4(full).isDirectory()) return null;
   return { body: readFileSync17(full), type };
 }
 
 // src/commands/retire.ts
-import { existsSync as existsSync20, readdirSync as readdirSync7, readFileSync as readFileSync18, writeFileSync as writeFileSync7 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync21, readdirSync as readdirSync8, readFileSync as readFileSync18, writeFileSync as writeFileSync8 } from "fs";
+import { join as join23 } from "path";
 var retireHelp = `
 roster retire <handle>
 
@@ -4485,23 +4955,23 @@ async function retireCommand(argv) {
 function buildRetirePlan(ws, org, handle, parseYaml) {
   const entry = (org.staff ?? []).find((s) => s.handle === handle);
   const dir = entry.dir ?? entry.handle;
-  const root = join22(ws.root, dir);
+  const root = join23(ws.root, dir);
   const warnings = [];
   const manifest = readManifest3(root, parseYaml);
   const brain = manifest?.brain;
-  if (!existsSync20(root)) warnings.push(`${dir}/ is not checked out, so its files cannot be read`);
-  const wfDir = join22(root, ".github", "workflows");
-  const workflows = existsSync20(wfDir) ? readdirSync7(wfDir).filter((f) => /\.ya?ml$/.test(f)).sort() : [];
+  if (!existsSync21(root)) warnings.push(`${dir}/ is not checked out, so its files cannot be read`);
+  const wfDir = join23(root, ".github", "workflows");
+  const workflows = existsSync21(wfDir) ? readdirSync8(wfDir).filter((f) => /\.ya?ml$/.test(f)).sort() : [];
   if (!workflows.length) warnings.push("no workflows found, so nothing to disable");
   const peers = [];
   for (const other of org.staff ?? []) {
     if (other.handle === handle) continue;
     const otherDir = other.dir ?? other.handle;
-    const path = join22(ws.root, otherDir, "staff.yaml");
-    if (!existsSync20(path)) continue;
+    const path = join23(ws.root, otherDir, "staff.yaml");
+    if (!existsSync21(path)) continue;
     const text = readFileSync18(path, "utf8");
     if (!new RegExp(`handle: ${handle}[,\\s}]`).test(text)) continue;
-    const theirs = readManifest3(join22(ws.root, otherDir), parseYaml);
+    const theirs = readManifest3(join23(ws.root, otherDir), parseYaml);
     peers.push({
       handle: other.handle,
       dir: otherDir,
@@ -4509,7 +4979,7 @@ function buildRetirePlan(ws, org, handle, parseYaml) {
       label: `from-${handle}`
     });
   }
-  const facts = countFacts(join22(root, "memory", "INDEX.md"));
+  const facts = countFacts(join23(root, "memory", "INDEX.md"));
   return {
     handle,
     name: entry.name ?? handle,
@@ -4567,9 +5037,9 @@ async function applyRetirePlan(ws, plan2) {
   removeFromOrgYaml(ws, plan2);
   process.stdout.write("  removed from org.yaml\n");
   for (const p of plan2.peers) {
-    const path = join22(ws.root, p.dir, "staff.yaml");
+    const path = join23(ws.root, p.dir, "staff.yaml");
     const text = readFileSync18(path, "utf8");
-    writeFileSync7(path, removePeerLine(text, plan2.handle));
+    writeFileSync8(path, removePeerLine(text, plan2.handle));
     process.stdout.write(`  removed from ${p.dir}/staff.yaml
 `);
     if (!p.brain) continue;
@@ -4595,9 +5065,9 @@ async function applyRetirePlan(ws, plan2) {
   return failed ? 1 : 0;
 }
 function removeFromOrgYaml(ws, plan2) {
-  const path = join22(ws.opsDir, "org.yaml");
+  const path = join23(ws.opsDir, "org.yaml");
   const text = readFileSync18(path, "utf8");
-  writeFileSync7(path, removeOrgLines(text, plan2.handle, plan2.dir));
+  writeFileSync8(path, removeOrgLines(text, plan2.handle, plan2.dir));
 }
 function removeOrgLines(text, handle, dir) {
   return text.split("\n").filter((line) => {
@@ -4615,8 +5085,8 @@ function removePeerLine(text, handle) {
   }).join("\n");
 }
 function readManifest3(root, parseYaml) {
-  const path = join22(root, "staff.yaml");
-  if (!existsSync20(path)) return null;
+  const path = join23(root, "staff.yaml");
+  if (!existsSync21(path)) return null;
   try {
     return parseYaml(readFileSync18(path, "utf8"), "staff.yaml");
   } catch {
@@ -4624,7 +5094,7 @@ function readManifest3(root, parseYaml) {
   }
 }
 function countFacts(indexPath) {
-  if (!existsSync20(indexPath)) return 0;
+  if (!existsSync21(indexPath)) return 0;
   return (readFileSync18(indexPath, "utf8").match(/^- \*\*`/gm) ?? []).length;
 }
 function parseFlags9(argv) {
@@ -4682,8 +5152,20 @@ var MIME = {
   ".svg": "image/svg+xml",
   ".webp": "image/webp",
   ".ico": "image/x-icon",
-  ".pdf": "application/pdf"
+  ".pdf": "application/pdf",
+  // A brain holds recordings as often as it holds screenshots, and a video served as
+  // application/octet-stream is a download prompt rather than something you can watch.
+  ".mp4": "video/mp4",
+  ".m4v": "video/mp4",
+  ".webm": "video/webm",
+  ".mov": "video/quicktime",
+  ".ogv": "video/ogg",
+  ".mp3": "audio/mpeg",
+  ".m4a": "audio/mp4",
+  ".wav": "audio/wav",
+  ".oga": "audio/ogg"
 };
+var SEEKABLE = /^(video|audio)\//;
 var pendingApps = /* @__PURE__ */ new Map();
 var appResults = /* @__PURE__ */ new Map();
 async function portalCommand(argv) {
@@ -4704,6 +5186,8 @@ async function portalCommand(argv) {
   };
   let cache = null;
   const TTL = 45e3;
+  const labelCache = /* @__PURE__ */ new Map();
+  const LABEL_TTL = 3e5;
   const brainDirs = () => (readOrg(ws.opsDir, parseYaml).staff ?? []).map((s) => s.dir ?? s.handle);
   const knownRepos = () => {
     const org = readOrg(ws.opsDir, parseYaml);
@@ -4741,7 +5225,7 @@ async function portalCommand(argv) {
       }
       const dir = entry.dir ?? entry.handle;
       const spec2 = specFromManifest(
-        parseYaml(readFileSync19(join23(ws.root, dir, "staff.yaml"), "utf8"), "staff.yaml"),
+        parseYaml(readFileSync19(join24(ws.root, dir, "staff.yaml"), "utf8"), "staff.yaml"),
         dir
       );
       const isPublic = payload.scope === "public";
@@ -4845,7 +5329,7 @@ async function portalCommand(argv) {
         res.end(JSON.stringify({ error: "a repo name and a known role are needed" }));
         return;
       }
-      const path = join23(ws.opsDir, "org.yaml");
+      const path = join24(ws.opsDir, "org.yaml");
       const text = readFileSync19(path, "utf8");
       if (new RegExp(`name: ${name}[,\\s}]`).test(text)) {
         json(res, { ok: true, note: "already there" });
@@ -4883,16 +5367,16 @@ async function portalCommand(argv) {
       if (route === "plan") {
         json(res, {
           org,
-          dir: join23(startedIn, "roster-ops"),
+          dir: join24(startedIn, "roster-ops"),
           files: [
-            ...initFiles({
+            ...(await initFiles({
               org,
               name: String(params.name ?? org),
               human: String(params.human ?? ""),
               marker: String(params.marker ?? "human"),
               opsName: "roster-ops",
               agent: String(params.agent ?? "claude-code-action")
-            }).keys()
+            })).keys()
           ].sort()
         });
         return;
@@ -4914,11 +5398,11 @@ async function portalCommand(argv) {
     }
     res.writeHead(404).end("not found");
   };
-  const body = (req) => new Promise((resolve6, reject) => {
+  const body = (req, limit = 1e6) => new Promise((resolve6, reject) => {
     let buf = "";
     req.on("data", (c) => {
       buf += c;
-      if (buf.length > 1e6) reject(new Error("body too large"));
+      if (buf.length > limit) reject(new Error("body too large"));
     });
     req.on("end", () => resolve6(buf));
     req.on("error", reject);
@@ -4949,6 +5433,10 @@ async function portalCommand(argv) {
         res.end(JSON.stringify(docPages()));
         return;
       }
+      if (url.pathname === "/api/docsearch") {
+        json(res, { hits: searchDocs(url.searchParams.get("q") ?? "") });
+        return;
+      }
       if (url.pathname === "/api/doc") {
         const page2 = url.searchParams.get("page") ?? "";
         if (!docPages().some((d) => d.file === page2)) {
@@ -4956,7 +5444,20 @@ async function portalCommand(argv) {
           return;
         }
         res.writeHead(200, { "content-type": "text/plain; charset=utf-8" });
-        res.end(readFileSync19(join23(docsDir(), page2), "utf8"));
+        res.end(readFileSync19(join24(docsDir(), page2), "utf8"));
+        return;
+      }
+      if (url.pathname === "/api/docasset") {
+        const asset = docAsset(url.searchParams.get("path") ?? "");
+        if (!asset) {
+          res.writeHead(404).end("not found");
+          return;
+        }
+        res.writeHead(200, {
+          "content-type": asset.type,
+          "cache-control": "public, max-age=86400"
+        });
+        res.end(readFileSync19(asset.path));
         return;
       }
       if (url.pathname === "/setup/app/start") {
@@ -5041,6 +5542,23 @@ async function portalCommand(argv) {
         res.end(JSON.stringify(data));
         return;
       }
+      if (url.pathname === "/api/orglayer") {
+        const listMd = (dir, prefix) => existsSync22(join24(w.opsDir, dir)) ? readdirSync9(join24(w.opsDir, dir)).filter((f) => f.endsWith(".md")).sort().map((f) => prefix + f) : [];
+        const files = ["org.yaml", ...listMd("org", "org/"), ...listMd("prompts", "prompts/")].filter((rel) => isWritable(w, `${w.opsName}/${rel}`, brainDirs())).map((rel) => {
+          const full = join24(w.opsDir, rel);
+          const text = readFileSync19(full, "utf8");
+          return {
+            path: rel,
+            bytes: statSync5(full).size,
+            group: rel.startsWith("prompts/") ? "prompts" : "org",
+            /* The first heading, for anything the page has no description of. Markdown
+               only: `# ` opens a comment in YAML, and the first line of org.yaml is one. */
+            title: rel.endsWith(".md") ? text.split("\n").find((l) => l.startsWith("# "))?.slice(2).trim() ?? "" : ""
+          };
+        });
+        json(res, { files, opsName: w.opsName });
+        return;
+      }
       if (url.pathname === "/api/prompt") {
         const handle = url.searchParams.get("staff") ?? "";
         const kind = url.searchParams.get("kind") ?? "daily";
@@ -5050,7 +5568,7 @@ async function portalCommand(argv) {
           res.writeHead(400).end("bad request");
           return;
         }
-        const brainDir = join23(w.root, entry.dir ?? entry.handle);
+        const brainDir = join24(w.root, entry.dir ?? entry.handle);
         try {
           const view = promptView(w, compose, handle, brainDir, kind);
           view.problems = auditPrompt(w, view, workspaceRoots(org));
@@ -5168,6 +5686,34 @@ async function portalCommand(argv) {
         });
         return;
       }
+      if (url.pathname === "/api/promptaudit") {
+        const handle = url.searchParams.get("staff") ?? "";
+        const org = readOrg(w.opsDir, parseYaml);
+        const entry = (org.staff ?? []).find((s) => s.handle === handle);
+        if (!entry) {
+          res.writeHead(400).end("bad request");
+          return;
+        }
+        const brainDir = join24(w.root, entry.dir ?? entry.handle);
+        const roots = workspaceRoots(org);
+        const found = /* @__PURE__ */ new Map();
+        const errors = [];
+        for (const kind of KINDS) {
+          try {
+            const view = promptView(w, compose, handle, brainDir, kind);
+            for (const p of auditPrompt(w, view, roots)) {
+              const key = `${p.id}|${p.path ?? ""}|${p.title}`;
+              const seen = found.get(key);
+              if (seen) seen.kinds.push(kind);
+              else found.set(key, { ...p, kind, kinds: [kind] });
+            }
+          } catch (err) {
+            errors.push({ kind, error: String(err.message) });
+          }
+        }
+        json(res, { staff: handle, problems: [...found.values()], errors });
+        return;
+      }
       if (url.pathname === "/api/amend") {
         const handle = url.searchParams.get("staff") ?? "";
         const kind = url.searchParams.get("kind") ?? "daily";
@@ -5179,9 +5725,9 @@ async function portalCommand(argv) {
           return;
         }
         const dir = entry.dir ?? entry.handle;
-        const view = promptView(w, compose, handle, join23(w.root, dir), kind);
-        const manifestPath = join23(w.root, dir, "staff.yaml");
-        const tokens = existsSync21(manifestPath) ? tokensFor(
+        const view = promptView(w, compose, handle, join24(w.root, dir), kind);
+        const manifestPath = join24(w.root, dir, "staff.yaml");
+        const tokens = existsSync22(manifestPath) ? tokensFor(
           orgSpec(org, w),
           specFromManifest(
             parseYaml(readFileSync19(manifestPath, "utf8"), "staff.yaml"),
@@ -5242,6 +5788,10 @@ async function portalCommand(argv) {
           const known = (org.repos ?? []).map((r) => `${org.org}/${r.name}`);
           if (!known.includes(payload.repo))
             throw new Error(`${payload.repo} is not a repo in org.yaml`);
+          if (payload.action === "ask") {
+            const prRepo = payload.ask?.pr?.repo ?? "";
+            if (!known.includes(prRepo)) throw new Error(`${prRepo} is not a repo in org.yaml`);
+          }
           const result = await act(payload);
           cache = null;
           res.writeHead(200, {
@@ -5255,11 +5805,38 @@ async function portalCommand(argv) {
         });
         return;
       }
+      if (url.pathname === "/api/upload") {
+        if (!writeAllowed(req)) {
+          refuseWrite(res);
+          return;
+        }
+        body(req, Math.ceil(MAX_UPLOAD * 1.4)).then((raw) => {
+          const payload = JSON.parse(raw || "{}");
+          const repo = payload.repo ?? "";
+          const known = knownRepos().find((r) => `${r.owner}/${r.name}` === repo);
+          if (!known) throw new Error(`${repo} is not a repo in org.yaml`);
+          if (!payload.name) throw new Error("a file needs a name");
+          json(
+            res,
+            attach({
+              repoDir: join24(w.root, known.name),
+              repo,
+              name: payload.name,
+              data: Buffer.from(payload.data ?? "", "base64"),
+              today: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10)
+            })
+          );
+        }).catch((err) => {
+          res.writeHead(400, { "content-type": "application/json" });
+          res.end(JSON.stringify({ error: String(err?.message ?? err) }));
+        });
+        return;
+      }
       if (url.pathname === "/api/sync") {
         const org = readOrg(w.opsDir, parseYaml);
         const dirs = [w.opsName, ...(org.staff ?? []).map((s) => s.dir ?? s.handle)];
         syncRepos(w.root, dirs).then((results) => {
-          cache = null;
+          if (results.some((r) => r.pulled)) cache = null;
           res.writeHead(200, {
             "content-type": "application/json; charset=utf-8",
             "cache-control": "no-store"
@@ -5271,6 +5848,38 @@ async function portalCommand(argv) {
         });
         return;
       }
+      if (url.pathname === "/api/repos") {
+        json(res, { repos: knownRepos() });
+        return;
+      }
+      if (url.pathname === "/api/labels") {
+        const repo = url.searchParams.get("repo") ?? "";
+        if (!knownRepos().some((r) => `${r.owner}/${r.name}` === repo)) {
+          res.writeHead(400).end("bad request");
+          return;
+        }
+        const hit = labelCache.get(repo);
+        if (hit && Date.now() - hit.at < LABEL_TTL) {
+          json(res, { labels: hit.labels });
+          return;
+        }
+        api(
+          `repos/${repo}/labels?per_page=100`
+        ).then((result) => {
+          if (!result.ok) {
+            json(res, { labels: [], error: result.error });
+            return;
+          }
+          const labels = (result.data ?? []).map((l) => ({
+            name: l.name,
+            color: l.color,
+            description: l.description ?? ""
+          }));
+          labelCache.set(repo, { at: Date.now(), labels });
+          json(res, { labels });
+        }).catch((err) => json(res, { labels: [], error: String(err?.message ?? err) }));
+        return;
+      }
       if (url.pathname === "/api/inbox") {
         const fresh = url.searchParams.get("refresh") === "1";
         if (!fresh && cache && Date.now() - cache.at < TTL) {
@@ -5296,6 +5905,55 @@ async function portalCommand(argv) {
         });
         return;
       }
+      if (url.pathname === "/api/pr") {
+        const repo = url.searchParams.get("repo") ?? "";
+        const number = Number(url.searchParams.get("number"));
+        const allowed = knownRepos().some((r) => `${r.owner}/${r.name}` === repo);
+        if (!allowed || !Number.isInteger(number) || number <= 0) {
+          res.writeHead(400).end("bad request");
+          return;
+        }
+        Promise.all([
+          api(`repos/${repo}/pulls/${number}`),
+          api(`repos/${repo}/pulls/${number}/commits?per_page=100`),
+          api(`repos/${repo}/pulls/${number}/files?per_page=100`)
+        ]).then(([pr, commits, files]) => {
+          if (!pr.ok) {
+            json(res, { error: pr.error });
+            return;
+          }
+          json(res, {
+            base: pr.data.base?.ref,
+            head: pr.data.head?.ref,
+            draft: !!pr.data.draft,
+            /* GitHub computes mergeability in the background, so the first read of a fresh
+               PR can honestly answer "I do not know yet". Passed through as null rather
+               than flattened to false, which would read as a conflict. */
+            mergeable: pr.data.mergeable,
+            mergeState: pr.data.mergeable_state,
+            additions: pr.data.additions,
+            deletions: pr.data.deletions,
+            changedFiles: pr.data.changed_files,
+            commits: (commits.data ?? []).map((c) => ({
+              sha: String(c.sha).slice(0, 7),
+              subject: String(c.commit?.message ?? "").split("\n")[0],
+              author: c.author?.login ?? c.commit?.author?.name ?? "",
+              date: c.commit?.author?.date,
+              url: c.html_url
+            })),
+            files: (files.data ?? []).map((f) => ({
+              path: f.filename,
+              status: f.status,
+              additions: f.additions,
+              deletions: f.deletions,
+              // Absent on binaries and on files too large for the API to patch.
+              patch: f.patch ?? ""
+            })),
+            errors: [commits, files].filter((r) => !r.ok).map((r) => r.error)
+          });
+        }).catch((err) => json(res, { error: String(err?.message ?? err) }));
+        return;
+      }
       if (url.pathname === "/api/thread") {
         const repo = url.searchParams.get("repo") ?? "";
         const number = Number(url.searchParams.get("number"));
@@ -5328,9 +5986,9 @@ async function portalCommand(argv) {
           res.writeHead(400).end("bad request");
           return;
         }
-        const out = execFileSync7(
+        const out = execFileSync8(
           "git",
-          ["-C", join23(w.root, dir), "show", "--format=%an%x1f%aI%x1f%s", sha, "--", path],
+          ["-C", join24(w.root, dir), "show", "--format=%an%x1f%aI%x1f%s", sha, "--", path],
           {
             encoding: "utf8",
             maxBuffer: 8 * 1024 * 1024
@@ -5343,15 +6001,42 @@ async function portalCommand(argv) {
       if (url.pathname === "/api/file") {
         const rel = url.searchParams.get("path") ?? "";
         const full = resolve5(w.root, rel);
-        if (!full.startsWith(resolve5(w.root) + "/") || !existsSync21(full) || statSync5(full).isDirectory()) {
+        if (!full.startsWith(resolve5(w.root) + "/") || !existsSync22(full) || statSync5(full).isDirectory()) {
           res.writeHead(404).end("not found");
           return;
         }
-        const ext = extname2(full).toLowerCase();
-        res.writeHead(200, {
-          "content-type": MIME[ext] ?? "application/octet-stream",
-          "cache-control": "no-store"
-        });
+        const ext = extname3(full).toLowerCase();
+        const type = MIME[ext] ?? "application/octet-stream";
+        if (SEEKABLE.test(type)) {
+          const size2 = statSync5(full).size;
+          const range = /^bytes=(\d*)-(\d*)$/.exec(String(req.headers.range ?? ""));
+          if (range) {
+            const start = range[1] ? Number(range[1]) : 0;
+            const end = range[2] ? Math.min(Number(range[2]), size2 - 1) : size2 - 1;
+            if (!(start <= end && start < size2)) {
+              res.writeHead(416, { "content-range": `bytes */${size2}` }).end();
+              return;
+            }
+            res.writeHead(206, {
+              "content-type": type,
+              "content-length": end - start + 1,
+              "content-range": `bytes ${start}-${end}/${size2}`,
+              "accept-ranges": "bytes",
+              "cache-control": "no-store"
+            });
+            createReadStream(full, { start, end }).pipe(res);
+            return;
+          }
+          res.writeHead(200, {
+            "content-type": type,
+            "content-length": size2,
+            "accept-ranges": "bytes",
+            "cache-control": "no-store"
+          });
+          createReadStream(full).pipe(res);
+          return;
+        }
+        res.writeHead(200, { "content-type": type, "cache-control": "no-store" });
         res.end(readFileSync19(full));
         return;
       }
@@ -5403,7 +6088,7 @@ function buildPasteBrief(ws, parseYaml, kind, handle) {
       throw new Error(`unknown staff handle "${handle}". org.yaml knows: ${known}`);
     }
     dir = entry.dir ?? entry.handle;
-    const manifestPath = join23(ws.root, dir, "staff.yaml");
+    const manifestPath = join24(ws.root, dir, "staff.yaml");
     tokens = tokensFor(
       orgSpec(org, ws),
       specFromManifest(parseYaml(readFileSync19(manifestPath, "utf8"), "staff.yaml"), dir)
@@ -5437,7 +6122,6 @@ function hireFlags(params) {
     model: params.get("model") ?? void 0,
     timeout: num("timeout"),
     mentionTimeout: num("mentionTimeout"),
-    prMentionTimeout: num("prMentionTimeout"),
     secretPrefix: params.get("secretPrefix") ?? void 0,
     app: params.get("app") ?? void 0,
     publicApp: params.get("publicApp") ?? void 0,
@@ -5463,14 +6147,17 @@ function capture() {
   };
 }
 function orgSpec(org, w) {
-  const human = org.human ?? {};
+  const humans = readHumans(org);
+  const first = humans[0];
   return {
     org: org.org,
     name: org.name,
     opsRepo: `${org.org}/${w.opsName}`,
     opsDirName: w.opsName,
-    human: human.name ?? human.github ?? "the human",
-    humanMarker: human.marker ?? human.github ?? "human"
+    human: first?.name ?? first?.github ?? "the human",
+    humanMarker: first?.marker ?? "human",
+    humanLogins: humans.map((h) => h.github).filter(Boolean),
+    allowedTools: toolsOf(org)
   };
 }
 function workspaceRoots(org) {
@@ -5495,10 +6182,10 @@ function parseFlags10(argv) {
 }
 
 // src/commands/prompt.ts
-import { execFileSync as execFileSync8 } from "child_process";
-import { mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync8 } from "fs";
+import { execFileSync as execFileSync9 } from "child_process";
+import { mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync9 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 
 // src/lib/livePrompt.ts
 import { readFileSync as readFileSync20 } from "fs";
@@ -5529,7 +6216,7 @@ roster prompt <handle> [options]
   agent is sent \u2014 the CLI imports the tenant's own compose.mjs, so there is no second
   implementation to drift.
 
-  --kind <k>       daily | mention | pr-mention        (default: daily)
+  --kind <k>       daily | mention                     (default: daily)
   --diff <file>    diff the composed prompt against the prompt: block in a workflow file
   --stat           with --diff, print a summary instead of the full diff
   --ops <dir>      ops repo directory (default: found by walking up)
@@ -5559,12 +6246,12 @@ async function promptCommand(argv) {
     process.stdout.write(composed);
     return 0;
   }
-  const live = extractLivePrompt(join24(ws.root, opts.diff));
-  const dir = mkdtempSync3(join24(tmpdir3(), "roster-diff-"));
-  const a = join24(dir, "live.md");
-  const b = join24(dir, "composed.md");
-  writeFileSync8(a, normalise(live));
-  writeFileSync8(b, normalise(composed));
+  const live = extractLivePrompt(join25(ws.root, opts.diff));
+  const dir = mkdtempSync3(join25(tmpdir3(), "roster-diff-"));
+  const a = join25(dir, "live.md");
+  const b = join25(dir, "composed.md");
+  writeFileSync9(a, normalise(live));
+  writeFileSync9(b, normalise(composed));
   const entry = org.staff?.find((s) => s.handle === handle);
   process.stdout.write(`
   ${entry?.name ?? handle} \xB7 ${kind}
@@ -5579,7 +6266,7 @@ async function promptCommand(argv) {
   else args.push("--unified=2");
   args.push(a, b);
   try {
-    execFileSync8("git", args, { stdio: "inherit" });
+    execFileSync9("git", args, { stdio: "inherit" });
     process.stdout.write("  identical\n\n");
     return 0;
   } catch {