@odla-ai/cli 0.42.2 → 0.43.1

package/dist/bin.cjs

@@ -556,10 +556,10 @@ function isManagedDevVar(line2) {
   const match = line2.match(/^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/);
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
-function writePrivateText(path, text3) {
+function writePrivateText(path, text4) {
   (0, import_node_fs7.mkdirSync)((0, import_node_path5.dirname)(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
-  (0, import_node_fs7.writeFileSync)(temporary, text3, { mode: 384 });
+  (0, import_node_fs7.writeFileSync)(temporary, text4, { mode: 384 });
   (0, import_node_fs7.chmodSync)(temporary, 384);
   (0, import_node_fs7.renameSync)(temporary, path);
 }
@@ -1105,12 +1105,12 @@ async function readAdminAiAudit(request3) {
   }
 }
 async function responseBody(response2) {
-  const text3 = await response2.text();
-  if (!text3) return {};
+  const text4 = await response2.text();
+  if (!text4) return {};
   try {
-    return JSON.parse(text3);
+    return JSON.parse(text4);
   } catch {
-    return { message: text3.slice(0, 300) };
+    return { message: text4.slice(0, 300) };
   }
 }
 function apiError(status, body) {
@@ -1226,12 +1226,12 @@ function timestamp2(value2) {
   return Number.isFinite(date.valueOf()) ? date.toISOString() : "";
 }
 async function responseBody2(res) {
-  const text3 = await res.text();
-  if (!text3) return {};
+  const text4 = await res.text();
+  if (!text4) return {};
   try {
-    return JSON.parse(text3);
+    return JSON.parse(text4);
   } catch {
-    return { message: text3.slice(0, 300) };
+    return { message: text4.slice(0, 300) };
   }
 }
 function apiError2(action2, status, body) {
@@ -1414,12 +1414,12 @@ function catalogModels(body) {
   return body.catalog.models.filter((value2) => isRecord3(value2) && typeof value2.id === "string" && typeof value2.provider === "string");
 }
 async function responseBody3(res) {
-  const text3 = await res.text();
-  if (!text3) return {};
+  const text4 = await res.text();
+  if (!text4) return {};
   try {
-    return JSON.parse(text3);
+    return JSON.parse(text4);
   } catch {
-    return { message: text3.slice(0, 300) };
+    return { message: text4.slice(0, 300) };
   }
 }
 function apiError3(action2, status, body) {
@@ -2936,8 +2936,8 @@ async function appImport(options) {
   const out = options.stdout ?? console;
   const say = options.json ? (line2) => out.error(line2) : (line2) => out.log(line2);
   const { tenant } = resolveTenant(cfg, options.env);
-  const text3 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs12.readFileSync)(0, "utf8")))() : (0, import_node_fs12.readFileSync)(options.file, "utf8");
-  const { format, sources } = (0, import_import.parseImport)(text3, options.ns);
+  const text4 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs12.readFileSync)(0, "utf8")))() : (0, import_node_fs12.readFileSync)(options.file, "utf8");
+  const { format, sources } = (0, import_import.parseImport)(text4, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
   }
@@ -3274,7 +3274,7 @@ var init_brand_design_unpack = __esm({
       "text/html": "html",
       "application/json": "json"
     };
-    encode = (text3) => new TextEncoder().encode(text3);
+    encode = (text4) => new TextEncoder().encode(text4);
   }
 });
 
@@ -4130,9 +4130,9 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
   }
   throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
 }
-function errorCode(text3) {
+function errorCode(text4) {
   try {
-    const body = JSON.parse(text3);
+    const body = JSON.parse(text4);
     return typeof body.error?.code === "string" ? body.error.code : null;
   } catch {
     return null;
@@ -4918,15 +4918,15 @@ function readWranglerConfig(path) {
     return null;
   }
 }
-function stripJsonComments(text3) {
+function stripJsonComments(text4) {
   let result = "";
   let inString = false;
-  for (let i = 0; i < text3.length; i++) {
-    const ch = text3[i];
+  for (let i = 0; i < text4.length; i++) {
+    const ch = text4[i];
     if (inString) {
       result += ch;
       if (ch === "\\") {
-        result += text3[i + 1] ?? "";
+        result += text4[i + 1] ?? "";
         i++;
       } else if (ch === '"') {
         inString = false;
@@ -4938,14 +4938,14 @@ function stripJsonComments(text3) {
       result += ch;
       continue;
     }
-    if (ch === "/" && text3[i + 1] === "/") {
-      while (i < text3.length && text3[i] !== "\n") i++;
+    if (ch === "/" && text4[i + 1] === "/") {
+      while (i < text4.length && text4[i] !== "\n") i++;
       result += "\n";
       continue;
     }
-    if (ch === "/" && text3[i + 1] === "*") {
+    if (ch === "/" && text4[i + 1] === "*") {
       i += 2;
-      while (i < text3.length && !(text3[i] === "*" && text3[i + 1] === "/")) i++;
+      while (i < text4.length && !(text4[i] === "*" && text4[i + 1] === "/")) i++;
       i++;
       continue;
     }
@@ -5529,9 +5529,9 @@ function initProject(options) {
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
-function writeIfMissing(path, text3) {
+function writeIfMissing(path, text4) {
   if ((0, import_node_fs16.existsSync)(path)) return;
-  (0, import_node_fs16.writeFileSync)(path, text3);
+  (0, import_node_fs16.writeFileSync)(path, text4);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -5763,13 +5763,13 @@ async function secretsSetClerkKey(options) {
     body: JSON.stringify({ value: value2 })
   });
   if (!res.ok) {
-    const text3 = scrubValue((await res.text().catch(() => "")).slice(0, 300), value2);
-    throw new Error(`store Clerk secret key failed (${res.status}): ${text3 || "request failed"}`);
+    const text4 = scrubValue((await res.text().catch(() => "")).slice(0, 300), value2);
+    throw new Error(`store Clerk secret key failed (${res.status}): ${text4 || "request failed"}`);
   }
   out.log(`Clerk secret key stored for ${tenantId} ($clerk_secret, reserved + write-only; the value was never echoed)`);
 }
-function scrubValue(text3, value2) {
-  return redactSecrets(text3).split(value2).join("[value redacted]");
+function scrubValue(text4, value2) {
+  return redactSecrets(text4).split(value2).join("[value redacted]");
 }
 async function resolveVaultWrite(options) {
   const out = options.stdout ?? console;
@@ -6086,8 +6086,8 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     harnesses: installations
   };
 }
-function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path16.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path16.sep}`) && !(0, import_node_path16.isAbsolute)(path)).sort();
+function pathsUnder(root, paths2) {
+  return [...paths2].map((path) => (0, import_node_path16.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path16.sep}`) && !(0, import_node_path16.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -6557,17 +6557,17 @@ var init_cli_project = __esm({
   }
 });
 
-// ../harness/dist/chunk-LNQNFGQC.js
+// ../harness/dist/chunk-RXNHCGWE.js
 var HARNESS_PROTOCOL_VERSION;
-var init_chunk_LNQNFGQC = __esm({
-  "../harness/dist/chunk-LNQNFGQC.js"() {
+var init_chunk_RXNHCGWE = __esm({
+  "../harness/dist/chunk-RXNHCGWE.js"() {
     "use strict";
     init_cjs_shims();
     HARNESS_PROTOCOL_VERSION = 1;
   }
 });
 
-// ../harness/dist/chunk-K76I2TCQ.js
+// ../harness/dist/chunk-CR6RE3A2.js
 function assertPinnedImage(image) {
   if (!DIGEST_IMAGE.test(image)) throw new TypeError("container image must be pinned by sha256 digest");
 }
@@ -6795,12 +6795,12 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
   });
   if (outputBytes > 8 * 1024 * 1024) throw new Error("git file inventory exceeds 8 MiB");
   if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
-  const paths = Buffer.concat(stdout).toString("utf8").split("\0").filter(Boolean).sort();
-  if (paths.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
+  const paths2 = Buffer.concat(stdout).toString("utf8").split("\0").filter(Boolean).sort();
+  if (paths2.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
   const root = (0, import_path4.resolve)(sourceDir);
   const files = [];
   let bytes = 0;
-  for (const relativePath of paths) {
+  for (const relativePath of paths2) {
     if (!allowedWorkspacePath(relativePath)) continue;
     const source = (0, import_path4.resolve)(root, relativePath);
     if (!source.startsWith(`${root}${import_path4.sep}`)) throw new TypeError("git file path escapes workspace");
@@ -6916,8 +6916,8 @@ async function stageWorkspacePair(baselineSource, workspaceSource, options = {})
   }
 }
 var import_child_process, import_fs, import_promises2, import_path, import_process, import_promises3, import_os, import_path2, import_child_process2, import_path3, import_promises4, import_os2, import_path4, import_child_process3, DIGEST_IMAGE, SKIP_WORKSPACE_DIRS, SECRET_WORKSPACE_FILE;
-var init_chunk_K76I2TCQ = __esm({
-  "../harness/dist/chunk-K76I2TCQ.js"() {
+var init_chunk_CR6RE3A2 = __esm({
+  "../harness/dist/chunk-CR6RE3A2.js"() {
     "use strict";
     init_cjs_shims();
     import_child_process = require("child_process");
@@ -7276,13 +7276,13 @@ function validateSnapshot(snapshot, limits) {
   if (!Number.isSafeInteger(limits.maximumFiles) || limits.maximumFiles < 1 || !Number.isSafeInteger(limits.maximumBytes) || limits.maximumBytes < 1 || snapshot.files.length > limits.maximumFiles) {
     throw new CamelError("limit_exceeded", "Code snapshot exceeds its registered limits.");
   }
-  const paths = /* @__PURE__ */ new Set();
+  const paths2 = /* @__PURE__ */ new Set();
   let bytes = 0;
   for (const file of snapshot.files) {
-    if (!file.path || file.path.startsWith("/") || file.path.includes("\\") || file.path.split("/").some((part) => !part || part === "." || part === "..") || paths.has(file.path) || typeof file.content !== "string") {
+    if (!file.path || file.path.startsWith("/") || file.path.includes("\\") || file.path.split("/").some((part) => !part || part === "." || part === "..") || paths2.has(file.path) || typeof file.content !== "string") {
       throw new CamelError("state_conflict", "Code snapshot contains an invalid or duplicate path.");
     }
-    paths.add(file.path);
+    paths2.add(file.path);
     bytes += utf8Length(file.path) + utf8Length(file.content);
   }
   if (bytes > limits.maximumBytes) {
@@ -7433,8 +7433,8 @@ function boundedInteger(value2, spec) {
 }
 function boundedNumber(value2, spec) {
   if (spec.kind !== "finite_number" || typeof value2 !== "number" || !Number.isFinite(value2) || value2 < spec.minimum || value2 > spec.maximum) throw new CamelError("conversion_rejected", "Finite-number conversion rejected the structured value.");
-  const text3 = String(value2);
-  if (/e/i.test(text3) || (text3.split(".")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError("conversion_rejected", "Finite-number conversion rejected a non-canonical decimal.");
+  const text4 = String(value2);
+  if (/e/i.test(text4) || (text4.split(".")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError("conversion_rejected", "Finite-number conversion rejected a non-canonical decimal.");
   return value2;
 }
 function enumMember(value2, spec) {
@@ -7617,8 +7617,8 @@ function validateUnsafeSelector(path, value2, tool) {
   return void 0;
 }
 function looksLikeDestination(value2) {
-  const text3 = value2.trim();
-  return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text3) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text3);
+  const text4 = value2.trim();
+  return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text4) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text4);
 }
 var init_policy = __esm({
   "../camel/dist/policy.js"() {
@@ -7792,9 +7792,9 @@ async function extractImports(builder, input) {
   const sources = input.paths.filter(isSourcePath);
   const known = new Set(sources);
   for (const path of sources) {
-    let text3;
+    let text4;
     try {
-      text3 = await input.read(path);
+      text4 = await input.read(path);
     } catch {
       continue;
     }
@@ -7802,13 +7802,13 @@ async function extractImports(builder, input) {
     const file = builder.node(FILE, path, pkg ? { pkg } : void 0);
     if (pkg) builder.edge(builder.node(PACKAGE, pkg), CONTAINS, file);
     const specifiers = /* @__PURE__ */ new Set();
-    for (const match of text3.matchAll(IMPORT_FROM)) specifiers.add(match[1]);
-    for (const match of text3.matchAll(BARE_IMPORT)) specifiers.add(match[1]);
+    for (const match of text4.matchAll(IMPORT_FROM)) specifiers.add(match[1]);
+    for (const match of text4.matchAll(BARE_IMPORT)) specifiers.add(match[1]);
     for (const specifier of specifiers) {
       const resolved = resolveImport(path, specifier, known);
       if (resolved) builder.edge(file, IMPORTS, nodeId(FILE, resolved));
     }
-    for (const name of exportedNames(text3)) {
+    for (const name of exportedNames(text4)) {
       builder.edge(file, EXPORTS, builder.node(SYMBOL, name));
     }
   }
@@ -7821,16 +7821,16 @@ async function extractData(builder, input) {
   };
   for (const path of input.paths) {
     if (!SOURCE_FILE.test(path) || input.ignore?.(path)) continue;
-    let text3;
+    let text4;
     try {
-      text3 = await input.read(path);
+      text4 = await input.read(path);
     } catch {
       continue;
     }
-    for (const statement of text3.matchAll(STATEMENT)) {
+    for (const statement of text4.matchAll(STATEMENT)) {
       const verb = statement[1].toUpperCase().replace(/\s+/g, " ");
       const start = statement.index ?? 0;
-      const rest = text3.slice(start + statement[0].length, start + STATEMENT_WINDOW);
+      const rest = text4.slice(start + statement[0].length, start + STATEMENT_WINDOW);
       if (verb === "SELECT") {
         for (const read3 of rest.matchAll(READ_TABLES)) touch(path, read3[1].toLowerCase(), TABLE, READS);
         continue;
@@ -7846,16 +7846,16 @@ async function extractData(builder, input) {
         for (const read3 of rest.matchAll(READ_TABLES)) touch(path, read3[1].toLowerCase(), TABLE, READS);
       }
     }
-    for (const match of text3.matchAll(NS_CONST)) {
-      touch(path, `${match[1]}.${match[2]}`, NAMESPACE, accessFor(text3, match.index ?? 0));
+    for (const match of text4.matchAll(NS_CONST)) {
+      touch(path, `${match[1]}.${match[2]}`, NAMESPACE, accessFor(text4, match.index ?? 0));
     }
-    for (const match of text3.matchAll(NS_LITERAL)) {
-      touch(path, match[1], NAMESPACE, accessFor(text3, match.index ?? 0));
+    for (const match of text4.matchAll(NS_LITERAL)) {
+      touch(path, match[1], NAMESPACE, accessFor(text4, match.index ?? 0));
     }
   }
 }
-function accessFor(text3, index) {
-  const window = text3.slice(Math.max(0, index - 160), index + 40);
+function accessFor(text4, index) {
+  const window = text4.slice(Math.max(0, index - 160), index + 40);
   return /\b(?:transact|update|delete|create|insert|Ops)\b/.test(window) ? WRITES : READS;
 }
 async function buildCodeGraph(input) {
@@ -7915,7 +7915,7 @@ var init_code2 = __esm({
   }
 });
 
-// ../harness/dist/chunk-GYWQM76X.js
+// ../harness/dist/chunk-ISR434K7.js
 async function digestStagedWorkspace(root, limits) {
   const files = [];
   const walk = async (directory) => {
@@ -8195,7 +8195,7 @@ function validateCodePatch(rawPatch, maxBytes) {
   if (FORBIDDEN.test(patch2) || /(?:old|new)(?: file)? mode 120000/.test(patch2)) {
     throw new TypeError("patch uses a forbidden binary, link, mode, rename, or copy operation");
   }
-  const paths = [];
+  const paths2 = [];
   const lines = patch2.split("\n");
   for (let index = 0; index < lines.length; index += 1) {
     const line2 = lines[index];
@@ -8211,10 +8211,10 @@ function validateCodePatch(rawPatch, maxBytes) {
     if (!validHeaderPath(oldPath, path, "a") || !validHeaderPath(newPath, path, "b")) {
       throw new TypeError("patch file headers do not match the declared path");
     }
-    paths.push(path);
+    paths2.push(path);
   }
-  if (!paths.length || new Set(paths).size !== paths.length) throw new TypeError("patch has no diffs or repeats a path");
-  return paths;
+  if (!paths2.length || new Set(paths2).size !== paths2.length) throw new TypeError("patch has no diffs or repeats a path");
+  return paths2;
 }
 function validHeaderPath(value2, path, prefix) {
   return value2 === "/dev/null" || value2 === `${prefix}/${path}`;
@@ -8239,11 +8239,11 @@ function describePatchFailure(patch2, detail) {
   const hint = hunks.length > 0 && contextless ? " A hunk has no context lines; include at least one unchanged line above or below each change." : "";
   return `patch did not apply: ${detail}${hint}`;
 }
-async function applyCodePatch(workspaceDir, rawPatch, paths) {
+async function applyCodePatch(workspaceDir, rawPatch, paths2) {
   const patch2 = stripPatchEnvelope(rawPatch);
   await gitApply(workspaceDir, patch2, true);
   await gitApply(workspaceDir, patch2, false);
-  for (const path of paths) {
+  for (const path of paths2) {
     try {
       const info = await (0, import_promises6.lstat)(resolveCodePath(workspaceDir, path));
       if (info.isSymbolicLink() || !info.isFile() && !info.isDirectory()) {
@@ -8265,8 +8265,8 @@ function gitApply(cwd, patch2, check) {
     });
     let stderr2 = "";
     child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (text3) => {
-      if (stderr2.length < 4e3) stderr2 += text3.slice(0, 4e3);
+    child.stderr.on("data", (text22) => {
+      if (stderr2.length < 4e3) stderr2 += text22.slice(0, 4e3);
     });
     child.once("error", reject);
     child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(describePatchFailure(patch2, stderr2.trim().slice(0, 500)))));
@@ -8290,8 +8290,8 @@ async function restoreCodeWorkspaceCheckpoint(input) {
   const workspace = await stageWorkspace(input.trustedBaseDir, input.stage);
   try {
     if (checkpoint.patch) {
-      const paths = validateCodePatch(checkpoint.patch, 256 * 1024);
-      await applyCodePatch(workspace.workspaceDir, checkpoint.patch, paths);
+      const paths2 = validateCodePatch(checkpoint.patch, 256 * 1024);
+      await applyCodePatch(workspace.workspaceDir, checkpoint.patch, paths2);
     }
     return { workspace, checkpoint };
   } catch (error) {
@@ -8432,8 +8432,8 @@ async function verifyCodeCandidate(input) {
   try {
     const baseDigest = await digestStagedWorkspace(staged.workspaceDir, limits);
     if (baseDigest !== input.trustedBaseDigest) throw new TypeError("trusted base does not match its registered digest");
-    const paths = validateCodePatch(input.candidatePatch, policy.maximumPatchBytes);
-    await applyCodePatch(staged.workspaceDir, input.candidatePatch, paths);
+    const paths2 = validateCodePatch(input.candidatePatch, policy.maximumPatchBytes);
+    await applyCodePatch(staged.workspaceDir, input.candidatePatch, paths2);
     const sourceDigest = await digestStagedWorkspace(staged.workspaceDir, limits);
     const policyDigest = digestPolicy(policy);
     const patchDigest = digestBytes(input.candidatePatch);
@@ -8442,7 +8442,7 @@ async function verifyCodeCandidate(input) {
       trustedBaseDigest: input.trustedBaseDigest,
       patchDigest
     });
-    const changedTests = changedTestPaths(paths, policy);
+    const changedTests = changedTestPaths(paths2, policy);
     if (changedTests.length > policy.maximumChangedTests) throw new TypeError("candidate changes too many test files");
     const recipes = [];
     const logs = [];
@@ -8509,8 +8509,8 @@ function validate2(input) {
   }
   return result;
 }
-function changedTestPaths(paths, policy) {
-  return paths.filter((path) => policy.testPathSuffixes.some((suffix) => path.endsWith(suffix)) || policy.testPathPrefixes.some((prefix) => path.startsWith(prefix) || path.includes(`/${prefix}`))).sort();
+function changedTestPaths(paths2, policy) {
+  return paths2.filter((path) => policy.testPathSuffixes.some((suffix) => path.endsWith(suffix)) || policy.testPathPrefixes.some((prefix) => path.startsWith(prefix) || path.includes(`/${prefix}`))).sort();
 }
 function recipeReceipt(recipe2, result, artifacts) {
   const status = result.timedOut ? "timed_out" : result.outputLimitExceeded ? "output_limited" : result.exitCode === 0 && artifacts.every((item) => item.status === "verified") ? "passed" : "failed";
@@ -9143,7 +9143,7 @@ function createWorkspaceFileRegistry(limit = DEFAULT_MAX_FILES, enumerate = regi
     files(root) {
       const existing = cache2.get(root);
       if (existing) return existing;
-      const pending = enumerate(root, limit).then((paths) => Object.freeze(paths));
+      const pending = enumerate(root, limit).then((paths2) => Object.freeze(paths2));
       cache2.set(root, pending);
       void pending.catch(() => {
         if (cache2.get(root) === pending) cache2.delete(root);
@@ -9156,7 +9156,7 @@ function createWorkspaceFileRegistry(limit = DEFAULT_MAX_FILES, enumerate = regi
   };
 }
 async function registeredFiles(root, limit = DEFAULT_MAX_FILES) {
-  const paths = [];
+  const paths2 = [];
   const walk = async (directory) => {
     for (const entry of await (0, import_promises9.readdir)(directory, { withFileTypes: true })) {
       if (SKIP_WORKSPACE_DIRS.has(entry.name)) continue;
@@ -9170,26 +9170,26 @@ async function registeredFiles(root, limit = DEFAULT_MAX_FILES) {
         } catch {
           continue;
         }
-        paths.push(path);
-        if (paths.length > limit) throw new TypeError("workspace file registry exceeds its bound");
+        paths2.push(path);
+        if (paths2.length > limit) throw new TypeError("workspace file registry exceeds its bound");
       }
     }
   };
   await walk((0, import_path9.resolve)(root));
-  return paths.sort();
+  return paths2.sort();
 }
-function listWorkspace(paths, options = {}) {
+function listWorkspace(paths2, options = {}) {
   const max = options.maxEntries ?? 1e3;
   const prefix = options.prefix?.replace(/\/+$/, "");
-  const scoped = prefix ? paths.filter((path) => path === prefix || path.startsWith(`${prefix}/`)) : [...paths];
+  const scoped = prefix ? paths2.filter((path) => path === prefix || path.startsWith(`${prefix}/`)) : [...paths2];
   return scoped.slice(0, max);
 }
-async function searchWorkspace(root, paths, options) {
+async function searchWorkspace(root, paths2, options) {
   options.signal?.throwIfAborted();
   if (!options.query) throw new TypeError("search query must be a non-empty string");
   const maxResults = options.maxResults ?? DEFAULT_MAX_RESULTS;
   const maxFileBytes = options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES;
-  const scoped = listWorkspace(paths, { ...options.prefix ? { prefix: options.prefix } : {}, maxEntries: paths.length });
+  const scoped = listWorkspace(paths2, { ...options.prefix ? { prefix: options.prefix } : {}, maxEntries: paths2.length });
   if (scoped.length === 0) return [];
   try {
     return await nativeSearch(root, scoped, { ...options, maxResults, maxFileBytes });
@@ -9198,11 +9198,11 @@ async function searchWorkspace(root, paths, options) {
     return fallbackSearch(root, scoped, { ...options, maxResults, maxFileBytes });
   }
 }
-async function nativeSearch(root, paths, options) {
+async function nativeSearch(root, paths2, options) {
   const batches = [];
   let batch = [];
   let bytes = 0;
-  for (const path of paths) {
+  for (const path of paths2) {
     const size = Buffer.byteLength(path) + 1;
     if (batch.length > 0 && bytes + size > MAX_NATIVE_ARG_BYTES) {
       batches.push(batch);
@@ -9221,7 +9221,7 @@ async function nativeSearch(root, paths, options) {
   }
   return matches;
 }
-function nativeSearchBatch(root, paths, options, remaining) {
+function nativeSearchBatch(root, paths2, options, remaining) {
   return new Promise((resolveMatches, reject) => {
     const args = [
       "--fixed-strings",
@@ -9234,7 +9234,7 @@ function nativeSearchBatch(root, paths, options, remaining) {
       options.caseSensitive === false ? "--ignore-case" : "--case-sensitive",
       "--",
       options.query,
-      ...paths
+      ...paths2
     ];
     const child = (0, import_child_process6.spawn)("rg", args, {
       cwd: root,
@@ -9380,16 +9380,16 @@ function createCodePolicyGate(options) {
     }
   };
 }
-function directoryPrefixes(paths) {
+function directoryPrefixes(paths2) {
   const prefixes = /* @__PURE__ */ new Set(["."]);
-  for (const path of paths) {
+  for (const path of paths2) {
     const parts = path.split("/");
     for (let index = 1; index < parts.length; index += 1) prefixes.add(parts.slice(0, index).join("/"));
   }
   return [...prefixes].sort();
 }
-async function safePrefix(base, paths, prefix) {
-  const prefixes = directoryPrefixes(paths);
+async function safePrefix(base, paths2, prefix) {
+  const prefixes = directoryPrefixes(paths2);
   const conversions = await conversionRegistry(
     [await registeredPolicy("code.prefix.v1", "code.prefixes.v1", prefixes)],
     { "code.prefixes.v1": prefixes }
@@ -9500,7 +9500,7 @@ function optionalInteger(value2) {
 function response(request3, ok, content2, details) {
   return { requestId: request3.requestId, ok, content: content2, ...details ? { details } : {} };
 }
-function workspaceGraphs(workspaceDir, paths) {
+function workspaceGraphs(workspaceDir, paths2) {
   const existing = cache.get(workspaceDir);
   if (existing) return existing;
   const read22 = (path) => (0, import_promises11.readFile)((0, import_path10.join)(workspaceDir, path), "utf8");
@@ -9508,7 +9508,7 @@ function workspaceGraphs(workspaceDir, paths) {
     // No knownTables: a staged workspace may not carry migrations, and a filter
     // that silently drops every table is worse than an unfiltered one. Callers
     // with ground truth should build the graph themselves.
-    graph: await buildCodeGraph({ paths, read: read22, data: { ignore: (path) => path.includes(".generated.") } })
+    graph: await buildCodeGraph({ paths: paths2, read: read22, data: { ignore: (path) => path.includes(".generated.") } })
   }))();
   cache.set(workspaceDir, built);
   return built;
@@ -9561,11 +9561,11 @@ async function read(context, request3, options, policy, registry) {
   if (endLine < startLine || endLine - startLine + 1 > (options.maxReadLines ?? 2e3)) {
     throw new TypeError("requested line range exceeds its bound");
   }
-  const paths = await registry.files(context.workspaceDir);
-  if (!paths.includes(path)) {
+  const paths2 = await registry.files(context.workspaceDir);
+  if (!paths2.includes(path)) {
     throw new TypeError(`no such file in the staged workspace: "${path}". Use sandbox.overview, sandbox.where_is or sandbox.search to find the correct path.`);
   }
-  const allowed = await policy.read(policyContext(context, request3, options, { paths, path, startLine, endLine }));
+  const allowed = await policy.read(policyContext(context, request3, options, { paths: paths2, path, startLine, endLine }));
   if (!allowed) return response(request3, false, "tool denied by CaMeL policy");
   const target = resolveCodePath(context.workspaceDir, path);
   const info = await (0, import_promises10.stat)(target);
@@ -9587,16 +9587,16 @@ async function list(context, request3, options, policy, registry) {
   const prefix = typeof raw === "string" && raw.length > 0 ? raw : void 0;
   const maxEntries = optionalInteger(request3.input.maxEntries) ?? 1e3;
   if (maxEntries > 5e3) throw new TypeError("maxEntries exceeds its bound");
-  const paths = await registry.files(context.workspaceDir);
-  const allowed = await policy.list(policyContext(context, request3, options, { paths, ...prefix ? { prefix } : {} }));
+  const paths2 = await registry.files(context.workspaceDir);
+  const allowed = await policy.list(policyContext(context, request3, options, { paths: paths2, ...prefix ? { prefix } : {} }));
   if (!allowed) return response(request3, false, "tool denied by CaMeL policy");
-  const entries = listWorkspace(paths, { ...prefix ? { prefix } : {}, maxEntries });
+  const entries = listWorkspace(paths2, { ...prefix ? { prefix } : {}, maxEntries });
   if (!entries.length) {
     return response(request3, true, prefix ? `No files under "${prefix}".` : "Workspace is empty.", { count: 0 });
   }
-  const truncated = entries.length < paths.length && entries.length === maxEntries;
-  const hint = !prefix && paths.length > 500 ? `
-\u2026 ${paths.length} files total. sandbox.overview is far cheaper for orientation; use a prefix here once you know the area.` : "";
+  const truncated = entries.length < paths2.length && entries.length === maxEntries;
+  const hint = !prefix && paths2.length > 500 ? `
+\u2026 ${paths2.length} files total. sandbox.overview is far cheaper for orientation; use a prefix here once you know the area.` : "";
   return response(
     request3,
     true,
@@ -9614,10 +9614,10 @@ async function search(context, request3, options, policy, registry) {
   const maxResults = optionalInteger(request3.input.maxResults) ?? 100;
   if (maxResults > 500) throw new TypeError("maxResults exceeds its bound");
   const caseSensitive = request3.input.caseSensitive === void 0 ? true : request3.input.caseSensitive === true;
-  const paths = await registry.files(context.workspaceDir);
-  const allowed = await policy.search(policyContext(context, request3, options, { paths, query, ...prefix ? { prefix } : {} }));
+  const paths2 = await registry.files(context.workspaceDir);
+  const allowed = await policy.search(policyContext(context, request3, options, { paths: paths2, query, ...prefix ? { prefix } : {} }));
   if (!allowed) return response(request3, false, "tool denied by CaMeL policy");
-  const matches = await searchWorkspace(context.workspaceDir, paths, {
+  const matches = await searchWorkspace(context.workspaceDir, paths2, {
     query,
     maxResults,
     caseSensitive,
@@ -9639,8 +9639,8 @@ async function graphQuery(context, request3, options, policy, registry) {
     selector: query
   }));
   if (!allowed) return response(request3, false, "tool denied by CaMeL policy");
-  const paths = await registry.files(context.workspaceDir);
-  const graphs = await workspaceGraphs(context.workspaceDir, paths);
+  const paths2 = await registry.files(context.workspaceDir);
+  const graphs = await workspaceGraphs(context.workspaceDir, paths2);
   if (request3.tool === "sandbox.overview") {
     return response(request3, true, renderOverview(graphs, query || void 0));
   }
@@ -9702,16 +9702,16 @@ function toolFailureMessage(reason) {
 async function patch(context, request3, options, policy, registry) {
   exactKeys(request3.input, ["patch"]);
   const value2 = stringField(request3.input, "patch");
-  const paths = validateCodePatch(value2, options.maxPatchBytes ?? 256 * 1024);
-  if (paths.some((path) => options.readOnlyPrefixes?.some((prefix) => path === prefix || path.startsWith(`${prefix}/`)))) {
+  const paths2 = validateCodePatch(value2, options.maxPatchBytes ?? 256 * 1024);
+  if (paths2.some((path) => options.readOnlyPrefixes?.some((prefix) => path === prefix || path.startsWith(`${prefix}/`)))) {
     throw new TypeError("patch targets a read-only reference source");
   }
   const allowed = await policy.patch(policyContext(context, request3, options, { patch: value2 }));
   if (!allowed) return response(request3, false, "tool denied by CaMeL policy");
-  await applyCodePatch(context.workspaceDir, value2, paths);
+  await applyCodePatch(context.workspaceDir, value2, paths2);
   registry.invalidate(context.workspaceDir);
   forgetWorkspaceGraphs(context.workspaceDir);
-  return response(request3, true, `Applied patch to ${paths.length} file(s).`, { paths });
+  return response(request3, true, `Applied patch to ${paths2.length} file(s).`, { paths: paths2 });
 }
 async function recipe(context, request3, options, recipes, policy) {
   exactKeys(request3.input, ["recipeId"]);
@@ -10058,16 +10058,107 @@ async function startGoalPursuit(input) {
 async function appendCodeRuntimeEvent(control, command, event, refs) {
   const eventId = `${command.commandId.slice(0, 45)}:${refs.length + 1}`;
   refs.push(eventId);
-  const bounded = event.type === "message" ? { ...event, body: event.body.trim().slice(0, 2e4) || `${event.actor} event` } : event;
+  const attributed = { ...event, interactionId: command.commandId };
+  const bounded = attributed.type === "message" ? { ...attributed, body: attributed.body.trim().slice(0, 2e4) || `${attributed.actor} event` } : attributed;
   await control.appendSessionEvent(command.sessionId, eventId, bounded);
 }
-var import_crypto, import_promises5, import_path5, import_child_process4, import_promises6, import_path6, import_child_process5, import_process2, import_crypto2, import_crypto3, import_fs2, import_promises7, import_path7, import_promises8, import_os3, import_path8, import_ai4, import_ai5, import_child_process6, import_promises9, import_path9, import_promises10, import_promises11, import_path10, import_crypto4, CODE_RUNTIME_PROTOCOL_VERSION, CodeRuntimeReconciler, CodeRuntimeControlError, record5, invalid, RESERVED, SECRET, PATH, FORBIDDEN, ARTIFACT_PATH, PRIVATE_ARTIFACT_PART, SHA3, DIGEST3, ID3, RULE, DEFAULT_PREFIXES, DEFAULT_SUFFIXES, message, CodeRuntimeCheckpointManager, record22, SOURCE_LIMITS, RESERVED2, SECRET2, SOURCE_MAX_FILES, SOURCE_MAX_BYTES, SOURCE_SET_MAX_BYTES, V1_SYSTEM_PROMPT, V2_SYSTEM_PROMPT, V3_SYSTEM_PROMPT, SYSTEM_PROMPT_FOR, DEFAULT_MAX_FILES, DEFAULT_MAX_RESULTS, DEFAULT_MAX_FILE_BYTES, MAX_NATIVE_ARG_BYTES, DESTINATIONS, READ, LIST, SEARCH, GRAPH, PATCH, RECIPE, cache, shortId, GRAPH_TOOLS, MAX_MEMORY_BODY, POSITIVE, digestRuntimeValue, runtimeErrorMessage, TheseusRuntimeEngine;
-var init_chunk_GYWQM76X = __esm({
-  "../harness/dist/chunk-GYWQM76X.js"() {
+function patchStats(value2) {
+  if (typeof value2 !== "string") return {};
+  let additions = 0;
+  let deletions = 0;
+  for (const line2 of value2.slice(0, 262144).split("\n")) {
+    if (line2.startsWith("+++") || line2.startsWith("---")) continue;
+    if (line2.startsWith("+")) additions += 1;
+    else if (line2.startsWith("-")) deletions += 1;
+  }
+  return { ...additions ? { additions } : {}, ...deletions ? { deletions } : {} };
+}
+function searchResults(value2) {
+  if (typeof value2 !== "string") return void 0;
+  const results = value2.split("\n").flatMap((line2) => {
+    const match = /^([^:\n]{1,1024}):(\d+):\s?(.*)$/.exec(line2);
+    if (!match) return [];
+    const lineNumber = Number(match[2]);
+    const itemText = text3(match[3], 240);
+    if (!Number.isSafeInteger(lineNumber) || lineNumber < 1) return [];
+    return [{ path: match[1], line: lineNumber, ...itemText ? { text: itemText } : {} }];
+  }).slice(0, 5);
+  return results.length ? results : void 0;
+}
+function codeToolRequestPresentation(request3) {
+  const input = request3.input;
+  if (request3.tool === "sandbox.read") {
+    const path = text3(input.path, 1024);
+    if (!path) return void 0;
+    const startLine = integer2(input.startLine);
+    const endLine = integer2(input.endLine);
+    return { kind: "read", path, ...startLine ? { startLine } : {}, ...endLine ? { endLine } : {} };
+  }
+  if (request3.tool === "sandbox.list") {
+    const scope = text3(input.prefix, 1024);
+    return { kind: "list", ...scope ? { scope } : {} };
+  }
+  if (request3.tool === "sandbox.search" || request3.tool === "sandbox.overview" || request3.tool === "sandbox.where_is" || request3.tool === "sandbox.who_imports" || request3.tool === "sandbox.who_touches") {
+    const query = text3(input.query, 512);
+    const scope = request3.tool === "sandbox.search" ? text3(input.prefix, 1024) : void 0;
+    if (request3.tool === "sandbox.search" && !query) return void 0;
+    return { kind: "query", ...query ? { query } : {}, ...scope ? { scope } : {} };
+  }
+  if (request3.tool === "sandbox.apply_patch") {
+    return { kind: "patch", ...patchStats(input.patch) };
+  }
+  const recipeId = text3(input.recipeId, 120);
+  return recipeId ? { kind: "recipe", recipeId } : void 0;
+}
+function codeToolResultPresentation(request3, response2) {
+  const started = codeToolRequestPresentation(request3);
+  if (!started || !response2.ok) return started;
+  const details = record32(response2.details);
+  if (started.kind === "read") {
+    return {
+      ...started,
+      ...integer2(details?.startLine) ? { startLine: integer2(details?.startLine) } : {},
+      ...integer2(details?.endLine) ? { endLine: integer2(details?.endLine) } : {},
+      ...excerpt(response2.content) ? { excerpt: excerpt(response2.content) } : {}
+    };
+  }
+  if (started.kind === "list") {
+    const listed = response2.content.split("\n").filter((line2) => line2 && !line2.startsWith("\u2026") && !line2.startsWith("Workspace ")).map((line2) => text3(line2, 1024)).filter((line2) => Boolean(line2)).slice(0, 8);
+    return {
+      ...started,
+      ...integer2(details?.count) !== void 0 ? { count: integer2(details?.count) } : {},
+      ...listed.length ? { paths: listed } : {}
+    };
+  }
+  if (started.kind === "query") {
+    const results = request3.tool === "sandbox.search" ? searchResults(response2.content) : void 0;
+    const resultExcerpt = request3.tool === "sandbox.search" ? void 0 : excerpt(response2.content);
+    return {
+      ...started,
+      ...integer2(details?.count) !== void 0 ? { count: integer2(details?.count) } : {},
+      ...results ? { results } : {},
+      ...resultExcerpt ? { excerpt: resultExcerpt } : {}
+    };
+  }
+  if (started.kind === "patch") {
+    return { ...started, ...paths(details?.paths) ? { paths: paths(details?.paths) } : {} };
+  }
+  const output = response2.content.replace(/^Recipe [^\n]*\.?\s*/u, "");
+  return {
+    ...started,
+    ...integer2(details?.exitCode) !== void 0 ? { exitCode: integer2(details?.exitCode) } : {},
+    ...typeof details?.timedOut === "boolean" ? { timedOut: details.timedOut } : {},
+    ...typeof details?.outputLimitExceeded === "boolean" ? { outputLimitExceeded: details.outputLimitExceeded } : {},
+    ...excerpt(output, true) ? { excerpt: excerpt(output, true) } : {}
+  };
+}
+var import_crypto, import_promises5, import_path5, import_child_process4, import_promises6, import_path6, import_child_process5, import_process2, import_crypto2, import_crypto3, import_fs2, import_promises7, import_path7, import_promises8, import_os3, import_path8, import_ai4, import_ai5, import_child_process6, import_promises9, import_path9, import_promises10, import_promises11, import_path10, import_crypto4, CODE_RUNTIME_PROTOCOL_VERSION, CodeRuntimeReconciler, CodeRuntimeControlError, record5, invalid, RESERVED, SECRET, PATH, FORBIDDEN, ARTIFACT_PATH, PRIVATE_ARTIFACT_PART, SHA3, DIGEST3, ID3, RULE, DEFAULT_PREFIXES, DEFAULT_SUFFIXES, message, CodeRuntimeCheckpointManager, record22, SOURCE_LIMITS, RESERVED2, SECRET2, SOURCE_MAX_FILES, SOURCE_MAX_BYTES, SOURCE_SET_MAX_BYTES, V1_SYSTEM_PROMPT, V2_SYSTEM_PROMPT, V3_SYSTEM_PROMPT, SYSTEM_PROMPT_FOR, DEFAULT_MAX_FILES, DEFAULT_MAX_RESULTS, DEFAULT_MAX_FILE_BYTES, MAX_NATIVE_ARG_BYTES, DESTINATIONS, READ, LIST, SEARCH, GRAPH, PATCH, RECIPE, cache, shortId, GRAPH_TOOLS, MAX_MEMORY_BODY, POSITIVE, digestRuntimeValue, runtimeErrorMessage, text3, integer2, record32, excerpt, paths, TheseusRuntimeEngine;
+var init_chunk_ISR434K7 = __esm({
+  "../harness/dist/chunk-ISR434K7.js"() {
     "use strict";
     init_cjs_shims();
-    init_chunk_K76I2TCQ();
-    init_chunk_LNQNFGQC();
+    init_chunk_CR6RE3A2();
+    init_chunk_RXNHCGWE();
     import_crypto = require("crypto");
     import_promises5 = require("fs/promises");
     import_path5 = require("path");
@@ -10306,6 +10397,30 @@ Never claim a build or test passed unless odla_run_recipe returned that result.`
     POSITIVE = (value2) => Number.isFinite(value2) && Number(value2) > 0 ? Number(value2) : void 0;
     digestRuntimeValue = (value2) => `sha256:${(0, import_crypto4.createHash)("sha256").update(value2).digest("hex")}`;
     runtimeErrorMessage = (value2) => value2 instanceof Error ? value2.message : String(value2);
+    text3 = (value2, maximum) => {
+      if (typeof value2 !== "string") return void 0;
+      const bounded = value2.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, " ").trim();
+      return bounded ? bounded.slice(0, maximum) : void 0;
+    };
+    integer2 = (value2) => Number.isSafeInteger(value2) && Number(value2) >= 0 ? Number(value2) : void 0;
+    record32 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : void 0;
+    excerpt = (value2, tail = false) => {
+      if (typeof value2 !== "string") return void 0;
+      const safe = value2.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, " ");
+      const source = (tail ? safe.slice(-1e4) : safe.slice(0, 1e4)).trim();
+      if (!source) return void 0;
+      const lines = source.split("\n").filter((line2) => line2.trim()).map((line2) => line2.slice(0, 240));
+      const selected = tail ? lines.slice(-10) : lines.slice(0, 10);
+      return text3(selected.join("\n"), 2400);
+    };
+    paths = (value2) => {
+      if (!Array.isArray(value2)) return void 0;
+      const items = value2.flatMap((item) => {
+        const path = text3(item, 1024);
+        return path ? [path] : [];
+      }).slice(0, 12);
+      return items.length ? items : void 0;
+    };
     TheseusRuntimeEngine = class {
       constructor(options) {
         this.options = options;
@@ -10539,18 +10654,29 @@ Never claim a build or test passed unless odla_run_recipe returned that result.`
         return {
           execute: async (context, request3) => {
             const startedAt = Date.now();
+            const operationId = digestRuntimeValue(`${command.commandId}:${request3.requestId}`);
+            const startedPresentation = codeToolRequestPresentation(request3);
             await this.#event(
               command,
-              { type: "tool", phase: "started", tool: request3.tool },
+              {
+                type: "tool",
+                phase: "started",
+                tool: request3.tool,
+                operationId,
+                ...startedPresentation ? { presentation: startedPresentation } : {}
+              },
               active.conversationRefs
             ).catch(() => void 0);
             const response2 = await broker.execute(context, request3);
+            const completedPresentation = codeToolResultPresentation(request3, response2);
             await this.#event(command, {
               type: "tool",
               phase: "completed",
               tool: request3.tool,
               ok: response2.ok,
-              durationMs: Date.now() - startedAt
+              durationMs: Date.now() - startedAt,
+              operationId,
+              ...completedPresentation ? { presentation: completedPresentation } : {}
             }, active.conversationRefs).catch(() => void 0);
             return response2;
           }
@@ -10591,8 +10717,8 @@ var init_node = __esm({
   "../harness/dist/node.js"() {
     "use strict";
     init_cjs_shims();
-    init_chunk_GYWQM76X();
-    init_chunk_K76I2TCQ();
+    init_chunk_ISR434K7();
+    init_chunk_CR6RE3A2();
     MEASURED_PREMIUM = Object.freeze({
       /** 3 racers vs pure depth at equal budget: 21,044 / 7,936. */
       racePerRacer: 0.55,
@@ -11649,7 +11775,8 @@ Usage:
   odla-ai pm bug list [--app <id>] [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm goal add --app <id> --title <t> [--status <s>] [--proof <text>] [--target <pct>] [--mutation-id <id>] [--json]
   odla-ai pm task add --app <id> --title <t> [--column <backlog|ready|doing|review|done>] [--goal <id>|--alignment-decision <id>] [--assignee <id>] [--description <text>|--body <text>] [--acceptance <text>] [--execution <human|agent|either>] [--due <epoch-ms>] [--mutation-id <id>] [--json]
-  odla-ai pm next --app <id> [--project <id>] [--json]
+  odla-ai pm next --app <id> [--project <id>] [--verbose] [--json]
+  odla-ai pm start --app <id> [<task-id>] [--goal <id>] [--verbose] [--mutation-id <id>] [--json]   [claims the top Ready task in one call]
   odla-ai pm watch --app <id> [--cursor <cursor>] [--entity goal|task|decision|bug] [--action created|updated|deleted|comment.created|comment.updated] [--state <state>] [--by <principalId>] [--self <principalId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
   odla-ai pm task ready <id> --expected-revision <n> [--goal <id>|--alignment-decision <id>] [--description <text>|--body <text>] [--acceptance <text>] [--execution <human|agent|either>] [--mutation-id <id>] [--json]
   odla-ai pm task claim <id> --expected-revision <n> [--mutation-id <id>] [--json]
@@ -11670,7 +11797,7 @@ Usage:
   odla-ai pm <goal|task|decision|bug> comments <id> [--json]
   odla-ai pm <goal|task|decision|bug> history <id> [--limit <n>] [--json]
   odla-ai pm <goal|task|decision|bug> rm <id>
-  odla-ai pm handoff --app <id> [--project <id>] [--json]
+  odla-ai pm handoff --app <id> [--project <id>] [--verbose] [--json]
   odla-ai discuss groups [--json]
   odla-ai discuss list [--app <id>] [--q <text>] [--state open|resolved|all] [--mentions] [--json]
   odla-ai discuss read <topic> [--limit <n> --offset <n>] [--json]
@@ -11837,6 +11964,16 @@ Commands:
                execution contract and a reviewed revision. Any caller with PM
                mutation access to that app/project may do it; claims coordinate
                execution but never own or lock the PM record.
+               To pick up work: "pm next" reads open goals, Ready candidates,
+               and work in progress; "pm start" claims the top Ready task in
+               one call, compare-and-swapped on the revision it just read, and
+               returns the task, its goal, and the acceptance criteria to work
+               against. Finish with "pm task done <id>", or hand it back with
+               "pm task release <id> --expected-revision <n>". "pm start" never
+               marks work Ready: that contract is reviewed separately so an
+               agent cannot authorize its own work.
+               Intake output is projected to the fields an executing caller
+               acts on; --verbose returns whole records with their audit trail.
   bug          Intent-first alias for PM bugs. "bug report" writes to
                odla PM; odla product defects do not belong in GitHub Issues.
   discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
@@ -12648,7 +12785,8 @@ async function pmRequest(ctx, method, path, body) {
       const message2 = error.message;
       if (typeof message2 === "string" && message2.length > 0) detail = message2;
     }
-    throw new Error(
+    throw new PmRequestError(
+      response2.status,
       `pm ${method} ${path} failed: ${detail ?? `registry returned ${response2.status}`} (${response2.status})`
     );
   }
@@ -12663,8 +12801,8 @@ function collectFields(parsed, allowClear) {
       if (allowClear) out[spec.key] = null;
       continue;
     }
-    const text3 = stringOpt(value2);
-    out[spec.key] = spec.num ? Number(text3) : text3;
+    const text4 = stringOpt(value2);
+    out[spec.key] = spec.num ? Number(text4) : text4;
   }
   return out;
 }
@@ -12708,7 +12846,7 @@ function emit2(ctx, value2, human) {
   if (ctx.json) ctx.out.log(JSON.stringify(value2, null, 2));
   else human();
 }
-var DONE, writeMutationId2, FIELD_MAP, STUDIO_SECTION;
+var DONE, writeMutationId2, FIELD_MAP, PmRequestError, isRevisionConflict, STUDIO_SECTION;
 var init_pm_action_core = __esm({
   "src/pm-action-core.ts"() {
     "use strict";
@@ -12741,6 +12879,15 @@ var init_pm_action_core = __esm({
       execution: { key: "executionMode" },
       "expected-revision": { key: "expectedRevision", num: true }
     };
+    PmRequestError = class extends Error {
+      constructor(status, message2) {
+        super(message2);
+        this.status = status;
+        this.name = "PmRequestError";
+      }
+      status;
+    };
+    isRevisionConflict = (error) => error instanceof PmRequestError && error.status === 409;
     STUDIO_SECTION = {
       goal: "goals",
       task: "board",
@@ -12872,110 +13019,231 @@ async function pmTaskLifecycle(ctx, id2, action2, parsed) {
     ctx.out.log(`task: ${label} \u2192 ${state2}`);
   });
 }
-async function allRecords(ctx, entity, appId, projectId) {
+async function pmRemove(ctx, entity, id2) {
+  await pmRequest(ctx, "DELETE", `/${entity}/${encodeURIComponent(id2)}`);
+  ctx.out.log(`deleted ${entity} ${id2}`);
+}
+var init_pm_actions = __esm({
+  "src/pm-actions.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_argv();
+    init_pm_action_core();
+  }
+});
+
+// src/pm-lean.ts
+function leanRecord(entity, record11) {
+  const out = {};
+  for (const key of [...COMMON, ...PER_ENTITY[entity]]) {
+    const value2 = record11[key];
+    if (value2 !== void 0 && value2 !== null) out[key] = value2;
+  }
+  return out;
+}
+function leanRecords(entity, records, verbose) {
+  return verbose ? records : records.map((record11) => leanRecord(entity, record11));
+}
+var COMMON, PER_ENTITY;
+var init_pm_lean = __esm({
+  "src/pm-lean.ts"() {
+    "use strict";
+    init_cjs_shims();
+    COMMON = ["id", "appId", "projectId", "title", "revision"];
+    PER_ENTITY = {
+      goal: ["status", "proof", "targetPct", "currentPct"],
+      task: [
+        "column",
+        "goalId",
+        "alignmentDecisionId",
+        "description",
+        "acceptanceCriteria",
+        "executionMode",
+        "assigneeId",
+        "claimedByPrincipalId",
+        "dueAt"
+      ],
+      decision: ["status", "body", "supersedesId"],
+      bug: ["status", "severity", "description", "goalId", "assigneeId", "decisionId"]
+    };
+  }
+});
+
+// src/pm-intake.ts
+async function listFiltered(ctx, entity, appId, projectId, filters) {
   const records = [];
   for (; ; ) {
-    const q = new URLSearchParams({
-      app: appId,
-      limit: "100",
-      offset: String(records.length)
-    });
+    const q = new URLSearchParams({ app: appId, limit: "100", offset: String(records.length) });
     if (projectId) q.set("project", projectId);
+    for (const [key, value2] of Object.entries(filters)) q.set(key, value2);
     const page2 = await pmRequest(ctx, "GET", `/${entity}?${q}`);
     records.push(...page2.records);
     if (records.length >= page2.total || page2.records.length === 0) return records;
   }
 }
-async function pmNext(ctx, parsed) {
+function requireApp(ctx, parsed, command) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
-  const projectId = stringOpt(parsed.options.project) ?? ctx.projectId;
-  if (!appId) throw new Error("pm next needs --app <appId>");
+  if (!appId) throw new Error(`pm ${command} needs --app <appId>`);
+  return { appId, projectId: stringOpt(parsed.options.project) ?? ctx.projectId };
+}
+async function pmNext(ctx, parsed) {
+  const { appId, projectId } = requireApp(ctx, parsed, "next");
+  const verbose = wantsVerbose(parsed);
   const [goals, tasks] = await Promise.all([
-    allRecords(ctx, "goal", appId, projectId),
-    allRecords(ctx, "task", appId, projectId)
+    listFiltered(ctx, "goal", appId, projectId, { status: UNMET_GOAL_STATUS }),
+    // One request for both live columns; the split below is over open work only.
+    listFiltered(ctx, "task", appId, projectId, { column: `${READY_COLUMN},doing` })
   ]);
+  const ready = tasks.filter((record11) => record11.column === READY_COLUMN);
+  const doing = tasks.filter((record11) => record11.column === "doing");
+  const guidance = !goals.length ? "discuss alignment with the user before creating or claiming project work" : !ready.length ? 'refine a linked Backlog task and mark it Ready with "pm task ready <id>"' : `claim the top Ready task in one call: odla-ai pm start --app ${appId}`;
   const result = {
     appId,
     projectId,
-    openGoals: goals.filter((record11) => record11.status === "open"),
-    doing: tasks.filter((record11) => record11.column === "doing"),
-    ready: tasks.filter((record11) => record11.column === "todo")
+    openGoals: leanRecords("goal", goals, verbose),
+    doing: leanRecords("task", doing, verbose),
+    ready: leanRecords("task", ready, verbose),
+    next: guidance
   };
   emit2(ctx, result, () => {
     ctx.out.log(`${appId}: goal-aligned work intake (read only)`);
-    for (const [label, records] of [
-      ["doing", result.doing],
-      ["ready", result.ready],
-      ["open goals", result.openGoals]
+    for (const [label, entity, records] of [
+      ["doing", "task", doing],
+      ["ready", "task", ready],
+      ["open goals", "goal", goals]
     ]) {
       ctx.out.log(`${label}:`);
       if (!records.length) ctx.out.log("- (none)");
-      else for (const record11 of records) printRecord(
-        ctx,
-        label === "open goals" ? "goal" : "task",
-        record11
-      );
-    }
-    if (!result.openGoals.length) {
-      ctx.out.log("next: discuss alignment with the user before creating or claiming project work");
-    } else if (!result.ready.length) {
-      ctx.out.log("next: refine a linked Backlog task and mark it Ready");
-    } else {
-      ctx.out.log("next: review a Ready task, then claim it with its revision");
+      else for (const record11 of records) printRecord(ctx, entity, record11);
     }
+    ctx.out.log(`next: ${guidance}`);
   });
 }
 async function pmHandoff(ctx, parsed) {
-  const appId = stringOpt(parsed.options.app) ?? ctx.appId;
-  const projectId = stringOpt(parsed.options.project) ?? ctx.projectId;
-  if (!appId) throw new Error("pm handoff needs --app <appId>");
+  const { appId, projectId } = requireApp(ctx, parsed, "handoff");
+  const verbose = wantsVerbose(parsed);
   const [goals, tasks, bugs] = await Promise.all([
-    allRecords(ctx, "goal", appId, projectId),
-    allRecords(ctx, "task", appId, projectId),
-    allRecords(ctx, "bug", appId, projectId)
+    listFiltered(ctx, "goal", appId, projectId, { status: UNMET_GOAL_STATUS }),
+    listFiltered(ctx, "task", appId, projectId, { column: ACTIVE_TASK_COLUMNS }),
+    listFiltered(ctx, "bug", appId, projectId, { status: OPEN_BUG_STATUSES })
   ]);
-  const handoff = {
+  const clean4 = !goals.length && !tasks.length && !bugs.length;
+  const result = {
     appId,
     projectId,
-    unmetGoals: goals.filter((record11) => record11.status !== "met"),
-    activeTasks: tasks.filter((record11) => record11.column !== "done"),
-    openBugs: bugs.filter((record11) => record11.status !== "fixed" && record11.status !== "wontfix")
-  };
-  const result = {
-    ...handoff,
-    clean: !handoff.unmetGoals.length && !handoff.activeTasks.length && !handoff.openBugs.length
+    unmetGoals: leanRecords("goal", goals, verbose),
+    activeTasks: leanRecords("task", tasks, verbose),
+    openBugs: leanRecords("bug", bugs, verbose),
+    clean: clean4
   };
   emit2(ctx, result, () => {
-    if (result.clean) {
+    if (clean4) {
       ctx.out.log(`${appId}: no unresolved PM work`);
       return;
     }
     ctx.out.log(`${appId}: authoritative PM handoff`);
-    for (const [label, records] of [
-      ["unmet goals", result.unmetGoals],
-      ["active tasks", result.activeTasks],
-      ["open bugs", result.openBugs]
+    for (const [label, entity, records] of [
+      ["unmet goals", "goal", goals],
+      ["active tasks", "task", tasks],
+      ["open bugs", "bug", bugs]
     ]) {
       ctx.out.log(`${label}:`);
       if (!records.length) ctx.out.log("- (none)");
-      else for (const record11 of records) printRecord(
-        ctx,
-        label === "unmet goals" ? "goal" : label === "active tasks" ? "task" : "bug",
-        record11
-      );
+      else for (const record11 of records) printRecord(ctx, entity, record11);
     }
   });
 }
-async function pmRemove(ctx, entity, id2) {
-  await pmRequest(ctx, "DELETE", `/${entity}/${encodeURIComponent(id2)}`);
-  ctx.out.log(`deleted ${entity} ${id2}`);
+var READY_COLUMN, UNMET_GOAL_STATUS, ACTIVE_TASK_COLUMNS, OPEN_BUG_STATUSES, wantsVerbose;
+var init_pm_intake = __esm({
+  "src/pm-intake.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_argv();
+    init_pm_action_core();
+    init_pm_lean();
+    READY_COLUMN = "todo";
+    UNMET_GOAL_STATUS = "open";
+    ACTIVE_TASK_COLUMNS = "backlog,todo,doing,review";
+    OPEN_BUG_STATUSES = "open,triaged";
+    wantsVerbose = (parsed) => parsed.options.verbose === true;
+  }
+});
+
+// src/pm-start.ts
+async function claimAt(ctx, task, parsed) {
+  const res = await pmRequest(
+    ctx,
+    "POST",
+    `/task/${encodeURIComponent(task.id)}/claim`,
+    { expectedRevision: task.revision, mutationId: writeMutationId2(parsed) }
+  );
+  return res.record;
+}
+async function selectTask(ctx, parsed, appId, projectId) {
+  const named = parsed.positionals[2];
+  if (named) return getTask(ctx, named);
+  const goalId = stringOpt(parsed.options.goal);
+  const ready = await listFiltered(ctx, "task", appId, projectId, {
+    column: READY_COLUMN,
+    ...goalId ? { goalId } : {}
+  });
+  const candidate = ready[0];
+  if (!candidate) {
+    throw new Error(
+      `no Ready task to claim in ${appId}${goalId ? ` for goal ${goalId}` : ""}. Run "odla-ai pm next --app ${appId}" to see open goals and Backlog work, then "odla-ai pm task ready <id>" once a task has a complete contract.`
+    );
+  }
+  return candidate;
 }
-var init_pm_actions = __esm({
-  "src/pm-actions.ts"() {
+async function pmStart(ctx, parsed) {
+  const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  if (!appId) throw new Error("pm start needs --app <appId>");
+  const projectId = stringOpt(parsed.options.project) ?? ctx.projectId;
+  const verbose = wantsVerbose(parsed);
+  const selected = await selectTask(ctx, parsed, appId, projectId);
+  if (selected.column !== READY_COLUMN) {
+    throw new Error(
+      `task ${selected.id} is ${selected.column === "doing" ? "already claimed" : `in ${selected.column}`}, not Ready. Only Ready work can be started; run "odla-ai pm task ready ${selected.id} --expected-revision ${selected.revision}" once its goal, description, and acceptance criteria are complete.`
+    );
+  }
+  let claimed;
+  try {
+    claimed = await claimAt(ctx, selected, parsed);
+  } catch (error) {
+    if (!isRevisionConflict(error)) throw error;
+    const reloaded = await getTask(ctx, selected.id);
+    if (reloaded.column !== READY_COLUMN) {
+      throw new Error(
+        `task ${selected.id} was taken while starting it (now ${reloaded.column}). Run "odla-ai pm start --app ${appId}" again to take the next Ready task.`
+      );
+    }
+    claimed = await claimAt(ctx, reloaded, parsed);
+  }
+  const task = claimed ?? await getTask(ctx, selected.id);
+  const goalId = typeof task.goalId === "string" ? task.goalId : void 0;
+  const goal = goalId ? await pmRequest(ctx, "GET", `/goal/${encodeURIComponent(goalId)}`).then((res) => res.record).catch(() => null) : null;
+  const result = {
+    claimed: verbose ? task : leanRecord("task", task),
+    goal: goal ? verbose ? goal : leanRecord("goal", goal) : null,
+    next: 'work the acceptance criteria, then "odla-ai pm task done <id>" (or "odla-ai pm task release <id> --expected-revision <n>" to hand it back)'
+  };
+  emit2(ctx, result, () => {
+    ctx.out.log(`claimed: ${studioRecordLink(ctx, "task", task)}`);
+    if (goal) ctx.out.log(`goal: ${studioRecordLink(ctx, "goal", goal)}`);
+    if (typeof task.acceptanceCriteria === "string") ctx.out.log(`acceptance: ${task.acceptanceCriteria}`);
+    ctx.out.log(`next: ${result.next}`);
+  });
+}
+var getTask;
+var init_pm_start = __esm({
+  "src/pm-start.ts"() {
     "use strict";
     init_cjs_shims();
     init_argv();
     init_pm_action_core();
+    init_pm_lean();
+    init_pm_intake();
+    getTask = async (ctx, id2) => (await pmRequest(ctx, "GET", `/task/${encodeURIComponent(id2)}`)).record;
   }
 });
 
@@ -13457,9 +13725,13 @@ async function pmCommand(parsed, deps = {}) {
     throw new Error(`unknown pm project action "${action3}". Try list|add|use.`);
   }
   if (word === "next") {
-    assertArgs(parsed, [...COMMON_OPTIONS, "app", "project"], 2);
+    assertArgs(parsed, [...COMMON_OPTIONS, "app", "project", "verbose"], 2);
     return pmNext(await buildContext2(parsed, deps), parsed);
   }
+  if (word === "start") {
+    assertArgs(parsed, [...COMMON_OPTIONS, "app", "project", "goal", "verbose", "mutation-id"], 3);
+    return pmStart(await buildContext2(parsed, deps), parsed);
+  }
   if (word === "watch") {
     assertArgs(parsed, [
       ...COMMON_OPTIONS,
@@ -13477,11 +13749,11 @@ async function pmCommand(parsed, deps = {}) {
     return pmWatch(await buildContext2(parsed, deps), parsed).then(() => void 0);
   }
   if (word === "handoff") {
-    assertArgs(parsed, [...COMMON_OPTIONS, "app", "project"], 2);
+    assertArgs(parsed, [...COMMON_OPTIONS, "app", "project", "verbose"], 2);
     return pmHandoff(await buildContext2(parsed, deps), parsed);
   }
   const entity = ALIASES[word];
-  if (!entity) throw new Error(`unknown pm entity "${word}". Try "odla-ai pm bug list" (goal|task|decision|bug).`);
+  if (!entity) throw new Error(`unknown pm entity "${word}". Try "odla-ai pm start" to claim Ready work, or "odla-ai pm bug list" (goal|task|decision|bug).`);
   const requestedAction = parsed.positionals[2] ?? "list";
   const action2 = canonicalAction(requestedAction);
   if (!action2) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|link|ref|comment|comments|history|rm.`);
@@ -13528,6 +13800,8 @@ var init_pm_command = __esm({
     init_argv();
     init_operator_context();
     init_pm_actions();
+    init_pm_intake();
+    init_pm_start();
     init_pm_links();
     init_pm_comments();
     init_pm_history();
@@ -14125,14 +14399,14 @@ function statusMinutes(value2) {
 }
 async function read2(url, headers, doFetch) {
   const response2 = await doFetch(url, { headers });
-  const text3 = await response2.text();
+  const text4 = await response2.text();
   let body = {};
-  if (text3) {
+  if (text4) {
     try {
-      const value2 = JSON.parse(text3);
+      const value2 = JSON.parse(text4);
       body = value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : { value: value2 };
     } catch {
-      body = { message: text3.slice(0, 300) };
+      body = { message: text4.slice(0, 300) };
     }
   }
   return { httpStatus: response2.status, body };
@@ -14365,13 +14639,13 @@ async function monitorCommand(parsed, deps = {}) {
 }
 async function request2(url, init, doFetch) {
   const response2 = await doFetch(url, init);
-  const text3 = await response2.text();
+  const text4 = await response2.text();
   let body = {};
   try {
-    const parsed = text3 ? JSON.parse(text3) : {};
+    const parsed = text4 ? JSON.parse(text4) : {};
     body = record10(parsed) ? parsed : { value: parsed };
   } catch {
-    body = { message: text3.slice(0, 500) };
+    body = { message: text4.slice(0, 500) };
   }
   if (!response2.ok) {
     const error = record10(body.error) ? body.error : body;
@@ -14611,8 +14885,8 @@ function runtimeUrl(cfg, suffix = "") {
   return `${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/runtime-credentials${suffix}`;
 }
 async function safeError(response2) {
-  const text3 = await response2.text();
-  return redactSecrets(text3.slice(0, 1e3));
+  const text4 = await response2.text();
+  return redactSecrets(text4.slice(0, 1e3));
 }
 async function finish(doFetch, cfg, token, sessionId, method) {
   return doFetch(runtimeUrl(cfg, `/${encodeURIComponent(sessionId)}`), {
@@ -15107,6 +15381,7 @@ var init_surface = __esm({
         project: { list: {}, add: {}, create: {}, use: {} },
         handoff: {},
         next: {},
+        start: {},
         watch: {}
       },
       provision: {},
@@ -15213,10 +15488,10 @@ var init_advisory_output = __esm({
 // src/device-ttl.ts
 function parseDeviceTtl(raw) {
   if (raw === void 0 || raw === true) return void 0;
-  const text3 = String(raw).trim().toLowerCase();
-  if (!text3) return void 0;
-  if (text3 === "forever" || text3 === "never") return 100 * 365 * DAY_MS;
-  const match = /^(\d+)\s*([dwy])$/.exec(text3);
+  const text4 = String(raw).trim().toLowerCase();
+  if (!text4) return void 0;
+  if (text4 === "forever" || text4 === "never") return 100 * 365 * DAY_MS;
+  const match = /^(\d+)\s*([dwy])$/.exec(text4);
   if (!match) {
     throw new Error(
       `--device-ttl expects a duration like 30d, 6w, 2y, or "forever" (got "${raw}")`
@@ -15583,12 +15858,12 @@ var init_runbook_actions = __esm({
 });
 
 // src/runbook-import.ts
-function parseRunbook(text3, slug) {
-  let rest = text3;
+function parseRunbook(text4, slug) {
+  let rest = text4;
   const meta = {};
-  const fm = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text3);
+  const fm = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text4);
   if (fm) {
-    rest = text3.slice(fm[0].length);
+    rest = text4.slice(fm[0].length);
     for (const line2 of fm[1].split(/\r?\n/)) {
       const pair = /^(\w+)\s*:\s*(.+)$/.exec(line2.trim());
       if (!pair) continue;