@open-mercato/cezar 0.9.2 → 0.10.0-pr892.1298

package/dist/server/server.js

@@ -16,9 +16,16 @@ import { streamSSE } from 'hono/streaming';
 import { jsonZodValidator, paramZodValidator, queryZodValidator } from './validators.js';
 import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
 import { z } from 'zod';
+import { setWorkspaceUiStateInputSchema, } from '../contract/index.js';
+// A contract VALUE, like `workspaceUiStateSchema` in workspace/migrations.ts — the request
+// schema this route validates with is the same one the client compiles against.
+import { modelDiscoveryRunnerSchema, openProjectInSchema, updateProjectInputSchema, } from '../contract/index.js';
 import { detectEnvironment } from '../core/backend-detect.js';
+import { RUNNER_IDS } from '../core/agent-runner.js';
+import { AGENT_MODELS_LOCKED_ERROR, agentModelsLocked } from '../core/agent-model-policy.js';
 import { discoverCodexModels } from '../core/codex-model-catalog.js';
-import { PROVIDER_IDS, ProviderAuthService, } from '../core/provider-auth.js';
+import { discoverOpencodeModels } from '../core/opencode-model-catalog.js';
+import { PROVIDER_IDS, ProviderAuthService, providerAuthChecksDisabled, } from '../core/provider-auth.js';
 import { applyProviderEnablement } from '../core/provider-availability.js';
 import { RunnerModelCatalog } from '../core/runner-model-catalog.js';
 import { currentUsage, onUsage } from '../core/process-usage.js';
@@ -30,28 +37,38 @@ import { SkillsUpdateConflictError, SkillsUpdateCoordinator, SkillsUpdateService
 import { getTeamSkillsCached, refreshTeamSkills, waitForTeamSkills } from '../skills-remote.js';
 import { appendHandoffHeartbeat, handoffProgressExcerpt, readHandoff } from '../handoff.js';
 import { markStarted, onTodosChanged, readTodos, removeTodo, todoTaskText } from '../todos.js';
+import { HistoryCursorError, deriveRunContextEvents, readEventsAfterLiveCursor, readRunHistoryPage, validateLiveCursor, } from '../runs/event-history.js';
+import { readRunIndexFromDisk } from '../runs/run-index.js';
 import { isV2WireEventType } from '../runs/ui-event-sink.js';
+import { runEventsQuerySchema, runHistoryQuerySchema, runIdParamSchema, } from '../contract/index.js';
 import { removeWorktree, worktreeDiff, worktreeDiffStat, worktreeSizeBytes } from '../git-worktree.js';
 import { isReclaimable, reclaimWorktrees } from '../runs/retention.js';
 import { getBranches, getCommit, getDiff, getLog, getRepoInfo, getStatus } from './git.js';
 import { collectChanges, collectCommitChanges, collectRunCommits, commitAll, createOrSwitchBranch, imageMimeType, isOsOpenableImage, pushCurrentBranch, readWorktreePath, } from './git-changes.js';
 import { gatedSkillsRepos, loadConfig, resolveWorktreeRetention } from '../config.js';
 import { findConfigFile } from '../agent-config/catalog.js';
-import { readConfigFile, writeConfigFile } from '../agent-config/files.js';
+import { readConfigFile, statConfigPath, writeConfigFile } from '../agent-config/files.js';
+import { readAgentModelDefaults } from '../agent-config/models.js';
 import { listAgentConfig } from '../agent-config/service.js';
+import { listConfigFiles } from '../agent-config/catalog.js';
+import { readAccountIdentity } from '../agent-config/account-identity.js';
 import { PROJECT_ID_RE, defaultWorkspaceConfig, effectiveSkillsAutoUpdate, loadWorkspaceConfig, mergeWriteWorkspaceConfig, effectiveComposerDefault, } from '../workspace/config.js';
-import { allocateProjectSlug, listProjects, probeProjectStatus, registerProject, removeProject, shouldRegisterProject, } from '../workspace/projects.js';
+import { CONTROL_CHARS_RE, DEFAULT_AGENT_ACCOUNT_ID, defaultAgentAccountStore, isAbsoluteConfigDir, loadAgentAccounts, mergeWriteAgentAccounts, } from '../workspace/agent-accounts.js';
+import { defaultAgentProfile, listAgentProfiles, profileDirState, resolveProfileEnvForRoot, resolveStoredProfile, sameProfileDir, } from '../workspace/agent-profiles.js';
+import { PROFILE_CAPABLE_PROVIDERS, profileEnv, supportsProfiles } from '../core/agent-profiles.js';
+import { withEnvPrefix } from '../core/shell-env.js';
+import { allocateProjectSlug, listProjects, normalizeProjectTags, probeProjectStatus, registerProject, removeProject, shouldRegisterProject, } from '../workspace/projects.js';
 import { mergeWriteWorkspaceUiState, readWorkspaceUiState } from '../workspace/ui-state.js';
 import { checkoutRepo } from './checkout.js';
 import { ProjectContextError, ProjectContexts } from './project-context.js';
 import { reviewGateEnabled } from '../runs/review-gate.js';
 import { readUiState, uiStatePath } from '../ui-state.js';
-import { expandTilde } from '../paths.js';
+import { agentHomePaths, expandTilde } from '../paths.js';
 import { isLoopbackHostHeader, normalizeHostname, resolveCapabilities } from './capabilities.js';
 import { createSocketHub } from './ws.js';
 import { browseDirectory, isInsideBrowseRoot, isLexicallyInsideBrowseRoot, resolveBrowseRoot } from './fs-browse.js';
 import { parseRemote, resolveForge } from './forge/index.js';
-import { fetchGithub, fetchGithubChecks, fetchGithubComments, fetchGithubPrDiff, GithubPrNotFoundError, GH_CHECKS_MAX } from './github.js';
+import { fetchGithub, fetchGithubChecks, fetchGithubComments, fetchGithubPrDiff, fetchGithubRefStatus, forgetRefStatus, readCachedRefStatuses, refNumberFromUrl, GithubPrNotFoundError, GH_CHECKS_MAX, GH_REF_STATUS_MAX } from './github.js';
 import { ensureLaunchKey } from './launch-key.js';
 import { openInTerminal } from './open-in-terminal.js';
 import { agentCliRunner, detectOpenTargets, openFileInDefaultApp, openInApp } from './open-in-app.js';
@@ -66,7 +83,52 @@ import { ASSET_CACHE_CONTROL, BUILD_HINT_HTML, assetContentType, isSafeAssetFile
 const projectIdSchema = z.union([z.literal('default'), z.string().regex(PROJECT_ID_RE)]);
 const providerConnectSchema = z.object({
     provider: z.enum(PROVIDER_IDS),
+    /** Which agent account to sign in (spec 2026-07-29-agent-profiles). Absent = the discovered
+     *  default, which is what every pre-profiles client sends. Without this, "Connect" on a second
+     *  Claude account would open a login for the FIRST one and report success. */
+    profileId: z.string().max(64).optional(),
 }).strict();
+/** Agent-account bodies (spec 2026-07-29-agent-profiles). Bounds mirror `agentProfileSchema` in
+ *  src/workspace/config.ts exactly, so a value these accept can never be degraded away by the
+ *  next load's `.catch`. The id is allocated server-side and is never a request field. */
+const createAgentProfileSchema = z.object({
+    provider: z.enum(PROVIDER_IDS),
+    label: z.string().trim().max(200).optional(),
+    configDir: z.string().trim().min(1).max(4096),
+}).strict();
+/** `POST …/agent-profiles/:id/open` — a catalog id (or `folder`) plus an optional open target. */
+const openAgentAccountFileSchema = z.object({
+    file: z.string().min(1).max(200),
+    target: z.string().min(1).max(64).optional(),
+}).strict();
+const updateAgentProfileSchema = z.object({
+    label: z.string().trim().max(200).optional(),
+    configDir: z.string().trim().min(1).max(4096).optional(),
+}).strict().refine((value) => value.label !== undefined || value.configDir !== undefined, 'send label or configDir');
+/** `PUT …/agent-profiles/selection` — which account a project uses for one provider. `null`
+ *  clears it back to the discovered account. */
+const selectAgentProfileSchema = z.object({
+    /** `null` targets the machine-wide default rather than one repo. */
+    projectId: z.string().min(1).max(64).nullable(),
+    provider: z.enum(PROVIDER_IDS),
+    profileId: z.string().max(64).nullable(),
+}).strict();
+/** The hosted-mode refusal, worded like the agent-config one it mirrors. */
+const hostedProfileRefusal = {
+    error: 'agent accounts are managed from the machine that owns the checkout (this cockpit runs in hosted mode)',
+};
+/**
+ * Allocate a profile id from the label (or, with no label, the folder name).
+ *
+ * Reuses the project allocator's shape, and deliberately its reserved set too: `default` is the
+ * discovered profile here exactly as it is the boot alias there, so a folder called `default/`
+ * becomes `default-2` and can never shadow it.
+ */
+function allocateAgentProfileId(source, taken) {
+    // `allocateProjectSlug` already basenames its argument and enforces the shared
+    // `^[a-z0-9][a-z0-9-]{0,63}$` shape, so `~/.claude-klaudiusz` slugs to `claude-klaudiusz`.
+    return allocateProjectSlug(source, taken);
+}
 const providerParamSchema = z.enum(PROVIDER_IDS);
 const providerEnabledSchema = z.object({ enabled: z.boolean() }).strict();
 const providerRetrySchema = z.object({
@@ -146,6 +208,8 @@ export function projectRouteManifest(app) {
 }
 /** 409 body for the inbox mutators while the follow-up inbox is off (#471). */
 const FOLLOWUPS_OFF = 'the follow-up inbox is disabled — set CEZ_FOLLOWUPS=1 to enable it';
+/** 409 body for every automations route while GitHub automations are off (#801). */
+const AUTOMATIONS_OFF = 'GitHub automations are disabled — set CEZ_AUTOMATIONS=1 to enable them';
 /**
  * The in-process bus for workspace-level SSE events. The registry-mutating
  * routes (`POST /api/projects` — step 4.2, emits `project-added` for a
@@ -193,7 +257,11 @@ const startRunSchema = z
     task: z.string().min(1).max(100_000, 'must be at most 100000 characters'),
     model: z.string().optional(),
     // Agent backend for this task (falls back to config `defaultRunner`).
-    runner: z.enum(['claude', 'codex', 'opencode']).optional(),
+    runner: z.enum(RUNNER_IDS).optional(),
+    // Agent account for this task (spec 2026-07-29-agent-profiles). Falls back to the project's
+    // own selection, then the discovered default. Bounded like a profile id in the workspace
+    // schema, so a value this route accepts can never be degraded away by the next load.
+    agentProfile: z.string().max(64).optional(),
     // Parallel variants (spec 010): ×2/×3 runs the task as 2–3 competing
     // agents in separate worktrees; the user compares diffs and picks one.
     variants: z.number().int().min(1).max(3).optional(),
@@ -295,60 +363,6 @@ const appearanceSchema = z.object({
     density: z.enum(['comfortable', 'compact', 'ultra']).optional(),
     width: z.enum(['narrow', 'wide']).optional(),
 });
-const providerAuthDismissalsSchema = z
-    .object({
-    claude: z.string().min(1).max(128).optional(),
-    codex: z.string().min(1).max(128).optional(),
-    opencode: z.string().min(1).max(128).optional(),
-})
-    .strict();
-/** Global GUI state (`~/.cezar/ui-state.json`, step 2.7) — the workspace twin
- *  of `uiStateSchema` below, sharing its `.passthrough()` + key-cap + shallow
- *  merge-on-write semantics via `parseUiStateBody`. Known keys are the
- *  cross-project prefs from the spec's Data Model; everything project-scoped
- *  (githubView, prompt templates, dismissed banners…) stays per-repo. */
-const workspaceUiStateSchema = z
-    .object({
-    appearance: appearanceSchema.optional(),
-    notifications: z.object({ enabled: z.boolean().optional() }).passthrough().optional(),
-    dismissedProviderAuthFailures: providerAuthDismissalsSchema.optional(),
-    lastLocation: z
-        .object({
-        projectId: z.string().min(1).max(64),
-        pathname: z.string().min(1).max(2048).startsWith('/p/'),
-        search: z.string().max(4096).startsWith('?').optional(),
-        hash: z.string().max(2048).startsWith('#').optional(),
-    })
-        .strict()
-        .optional(),
-    // Sidebar per-project collapse map, keyed by project id (slug ≤ 64 chars).
-    // Entry-capped like `skillUsage`: the map is written straight to a file the
-    // cockpit GETs on every load, so it must stay bounded on every axis.
-    sidebar: z
-        .object({
-        collapsed: z
-            .record(z.string().min(1).max(64), z.boolean())
-            .refine((map) => Object.keys(map).length <= UI_STATE_MAX_KEYS, {
-            message: `sidebar.collapsed must have at most ${UI_STATE_MAX_KEYS} entries`,
-        })
-            .optional(),
-    })
-        .passthrough()
-        .optional(),
-    // The user's curated selection of default (vendor) skills — `open-mercato/skills` — so the
-    // catalog is no longer forced in full. GLOBAL (here, not per-repo) because "which skills I
-    // want" describes the person, not a checkout, and must not depend on where cezar was launched
-    // (multi-project workspace). Tri-state, enforced in `discoverSkills`: an ABSENT key means "not
-    // curated" and every default skill still shows (opt-out default — no silent break on upgrade);
-    // a PRESENT array (even `[]`) shows only those names. Bounded like the `skillUsage` map: the
-    // file is GET/PUT wholesale, so an unbounded array is an unbounded write. Names match
-    // `lastTask.ref` (`.min(1).max(200)`). The client PUTs the whole array (shallow top-level merge).
-    importedSkills: z
-        .array(z.string().min(1).max(200))
-        .max(SKILL_USAGE_MAX_ENTRIES)
-        .optional(),
-})
-    .passthrough();
 const uiStateSchema = z
     .object({
     lastTask: z
@@ -487,7 +501,7 @@ function foldedLength(task, stack) {
 const continueSchema = z.object({
     text: z.string().max(100_000, 'must be at most 100000 characters').optional(),
     images: z.array(imageInputSchema).max(4).optional(),
-    runner: z.enum(['claude', 'codex', 'opencode']).optional(),
+    runner: z.enum(RUNNER_IDS).optional(),
     model: z.string().max(200).optional(),
 });
 // Inbox "▶ Run" body (spec 007 / #401 / #413): every field optional, and the whole body is
@@ -499,7 +513,7 @@ const continueSchema = z.object({
 // absent so it never touches `task`.
 const startTodoSchema = z
     .object({
-    runner: z.enum(['claude', 'codex', 'opencode']).optional(),
+    runner: z.enum(RUNNER_IDS).optional(),
     model: z.string().max(200).optional(),
     prompt: z
         .string()
@@ -547,7 +561,6 @@ function capUiStateKeys(data, ctx) {
 // generic wrapper leaves the schema type unresolved where `jsonBody` needs it, and Hono answers
 // that by dropping the whole PUT from the route schema rather than erroring — both ui-state PUTs
 // silently vanished from `AppType`. Concrete consts keep them visible to `hc`.
-const workspaceUiStateBody = workspaceUiStateSchema.superRefine(capUiStateKeys);
 const uiStateBody = uiStateSchema.superRefine(capUiStateKeys);
 /**
  * Query schemas for the READ routes — deliberately permissive.
@@ -660,7 +673,10 @@ export function createApp(deps) {
     const bootRoot = deps.repoRoot;
     const bootDataDir = join(bootRoot, '.ai/cezar');
     const modelCatalog = deps.modelCatalog ?? new RunnerModelCatalog({
-        adapters: { codex: { discover: () => discoverCodexModels({ cwd: bootRoot }) } },
+        adapters: {
+            codex: { discover: () => discoverCodexModels({ cwd: bootRoot }) },
+            opencode: { discover: () => discoverOpencodeModels({ cwd: bootRoot }) },
+        },
     });
     const providerAuth = deps.providerAuth ?? new ProviderAuthService();
     const workspaceConfig = deps.workspaceConfig ?? {
@@ -668,14 +684,48 @@ export function createApp(deps) {
         mergeWrite: mergeWriteWorkspaceConfig,
     };
     const providerStatus = async (options) => {
+        if (providerAuthChecksDisabled()) {
+            return applyProviderEnablement(await providerAuth.status(options?.refresh ? { refresh: true } : undefined), []);
+        }
         const [discovered, workspace] = await Promise.all([
             providerAuth.status(options?.refresh ? { refresh: true } : undefined),
             workspaceConfig.load(),
         ]);
         return applyProviderEnablement(discovered, workspace.disabledProviders);
     };
-    const providerActionError = async (required) => unavailableProviderMessage(required, await providerStatus());
+    /**
+     * The gate: why a run cannot start against `required`, or null when it can.
+     *
+     * VERIFY BEFORE YOU REFUSE. Auth state is served stale-while-revalidate (see
+     * `ProviderAuthService.status`), so a cached "disconnected" may predate a login cezar could not
+     * observe — someone running `claude auth login` in a terminal. Refusing on that would lock a user
+     * out of their own cockpit with no way back but waiting. So a believed-unavailable provider is
+     * re-probed, and only a refusal that survives the fresh answer is returned.
+     *
+     * The cost lands where it belongs: the common path (connected, warm) pays nothing at all, and the
+     * probe is only spawned when cezar is about to say no — a rare, interactive moment. This is also
+     * what lets the cache hold a negative for a minute instead of five seconds, which is what made
+     * every reader of `GET /providers/status` periodically pay for a CLI spawn.
+     *
+     * A runtime auth latch is deliberately NOT escaped by this: `withRuntimeFailures` keeps forcing
+     * the row disconnected until the user acknowledges that exact incident, so the re-probe cannot
+     * talk cezar out of a rejection it actually observed.
+     */
+    const providerActionError = async (required) => {
+        const known = await providerStatus();
+        const message = unavailableProviderMessage(required, known);
+        if (message === null)
+            return null;
+        // A DISABLED provider is a settings fact, not a probe result — re-probing it learns nothing and
+        // would spawn a CLI to re-read something the user typed.
+        const disabled = required.some((provider) => known.providers.find((row) => row.provider === provider)?.enabled === false);
+        if (disabled)
+            return message;
+        return unavailableProviderMessage(required, await providerStatus({ refresh: true }));
+    };
     const openTerminal = deps.openTerminal ?? openInTerminal;
+    const openFile = deps.openFile ?? openFileInDefaultApp;
+    const openApp = deps.openApp ?? openInApp;
     const skillsUpdate = deps.skillsUpdate ?? new SkillsUpdateService();
     // ---- workspace boot-project identity (multi-project spec) ----------------
     // The boot flow (`initWorkspace` in src/index.ts) registers the boot repo
@@ -1150,12 +1200,106 @@ export function createApp(deps) {
     // `GET /api/health` reads a warm value instead of the cold ~1 s compute.
     if (deps.socketHub)
         void refreshHealth();
+    /**
+     * Warm the whole of cezar's agent knowledge — the three discovered defaults AND every extra
+     * account — so no reader ever pays the first shell-out.
+     *
+     * Which login each agent is signed into is operating knowledge, not a settings-page detail: the
+     * composer, the action gate, the accounts pane and every run resolution ask for it. So the server
+     * learns it once, at boot, and keeps it (see the asymmetric cache lifetime in
+     * `core/provider-auth.ts`); on-demand refresh rides on `?refresh=1` and on the explicit
+     * invalidations — connect, repoint, remove, runtime rejection.
+     *
+     * Extra accounts are warmed ONE AT A TIME, after the defaults. Each is a CLI spawn, and a machine
+     * with several accounts would otherwise fan out a spawn storm at exactly the moment the browser is
+     * fetching the bundle; nothing is waiting on this, so sequential costs nothing that matters.
+     *
+     * Hosted mode warms only the defaults: the agent-profiles family is refused there, so there are
+     * no accounts to learn about.
+     */
+    const warmAgentKnowledge = async () => {
+        await providerAuth.status().catch(() => { });
+        if (!capabilities().localHandoff)
+            return;
+        const store = await loadAgentAccounts().catch(() => defaultAgentAccountStore());
+        for (const account of listAgentProfiles(store, PROVIDER_IDS)) {
+            if (account.isDefault)
+                continue; // covered by `status()` above
+            await providerAuth
+                .profileStatus(account.provider, { id: account.id, configDir: account.path })
+                .catch(() => { });
+        }
+    };
+    // Same gate as `refreshHealth`, same reason (startServer injects the hub; a bare app in tests does
+    // not, so tests never spawn probes here). Fire-and-forget: a probe that fails leaves that row
+    // cold, which is exactly the state every reader already handles.
+    if (deps.socketHub)
+        void warmAgentKnowledge();
     // ---- chained family: host model catalog (workspace-level) ----
     const modelsRoutes = new Hono()
-        .get('/models', queryZodValidator(z.object({ runner: z.union([z.string(), z.array(z.string()).transform((v) => v[0])]).pipe(z.literal('codex')) }), { message: 'runner must be codex' }), async (c) => {
+        // `modelDiscoveryRunnerSchema` is the contract's own list of the runners with an
+        // authoritative host-local catalog (#794), so the client compiles against exactly what this
+        // validates. Claude has no such source: its picker stays on static presets and this 400s.
+        .get('/models', queryZodValidator(z.object({ runner: z.union([z.string(), z.array(z.string()).transform((v) => v[0])]).pipe(modelDiscoveryRunnerSchema) }), { message: 'runner must be codex or opencode' }), async (c) => {
         const query = { data: c.req.valid('query') };
         return c.json(await modelCatalog.get(query.data.runner));
     });
+    /**
+     * Resolve `profileId` (absent = the discovered default) into a concrete account for `provider`.
+     *
+     * A dangling id is an ERROR here rather than the silent fall-back to the default that run
+     * resolution performs. The difference is who is asking: a run is replaying a stored reference
+     * and the default is the only safe answer it can act on, whereas a route is answering a user
+     * who just named an account — telling them "unknown account" is honest, and quietly connecting
+     * or reporting on a different one is not.
+     */
+    const resolveWorkspaceProfile = async (provider, profileId) => {
+        if (profileId === undefined || profileId === DEFAULT_AGENT_ACCOUNT_ID) {
+            return { profile: defaultAgentProfile(provider) };
+        }
+        let accounts;
+        try {
+            accounts = (await loadAgentAccounts()).accounts;
+        }
+        catch {
+            return { error: `unknown ${provider} account: ${profileId}` };
+        }
+        const stored = accounts.find((a) => a.id === profileId && a.provider === provider);
+        if (!stored)
+            return { error: `unknown ${provider} account: ${profileId}` };
+        return { profile: resolveStoredProfile(stored) };
+    };
+    /**
+     * The environment a terminal handoff must carry so the CLI lands on the right account.
+     *
+     * `profileId` is the one RECORDED on the step that owns the session, never the project's
+     * current selection: `claude --resume <id>` reads `<configDir>/sessions`, so a handoff for a
+     * run started on the work account and resumed after the project was switched back would find
+     * nothing and silently open a fresh conversation.
+     */
+    const handoffEnv = async (provider, profileId) => {
+        const resolved = await resolveWorkspaceProfile(provider, profileId);
+        if ('error' in resolved) {
+            return { error: `this session belongs to an account that no longer exists (${profileId})` };
+        }
+        const { profile } = resolved;
+        return { env: profile.isDefault ? {} : profileEnv(provider, profile.path) };
+    };
+    /** The copy-paste fallback shown when no terminal could be opened — same account, spelled for
+     *  this platform's shell. `null` when the dir cannot be embedded safely, which is a refusal. */
+    const handoffFallbackCommand = (cwd, command, env) => {
+        const prefixed = withEnvPrefix(command, env, process.platform);
+        return prefixed === null ? null : `cd '${cwd}' && ${prefixed}`;
+    };
+    /** A registered project's realpath'd root, or null when the id is unknown. */
+    const projectRootFor = async (projectId) => {
+        try {
+            return (await loadWorkspaceConfig()).projects.find((p) => p.id === projectId)?.root ?? null;
+        }
+        catch {
+            return null;
+        }
+    };
     // ---- chained family: agent providers (workspace-level) ----
     const providersRoutes = new Hono()
         .get('/providers/status', queryZodValidator(z.object({ refresh: queryValue.refine((v) => v === undefined || v === '1') }), { message: 'refresh must be 1 when provided' }), async (c) => {
@@ -1197,11 +1341,46 @@ export function createApp(deps) {
             workspaceEvents.emit('provider-status', row);
         return c.json(result);
     })
-        .post('/providers/connect', jsonZodValidator(providerConnectSchema, { message: 'provider must be claude, codex, or opencode' }), async (c) => {
+        .post('/providers/connect', jsonZodValidator(providerConnectSchema, { message: 'provider must be claude, codex, opencode, or pi' }), async (c) => {
         const body = { data: c.req.valid('json') };
         const provider = body.data.provider;
-        const command = providerAuth.loginCommand(provider);
-        const row = (await providerAuth.status({ refresh: true })).providers.find((candidate) => candidate.provider === provider);
+        // A NAMED account is refused in hosted mode before anything is resolved, exactly like every
+        // sibling route in the agent-profiles family. Checking later would already have read
+        // `~/.cezar/agent-accounts.json`, built a command carrying the account's absolute path (which
+        // both the success body and the hosted 409 echo), and — for a stored account — spawned a
+        // probe. It would also answer `unknown account: <id>` for a wrong id, which is an enumeration
+        // oracle for the very ids the hosted listing withholds. The bare-provider spelling keeps its
+        // existing behaviour: it names no host path and is how the Providers card has always worked.
+        if (body.data.profileId !== undefined
+            && body.data.profileId !== DEFAULT_AGENT_ACCOUNT_ID
+            && !capabilities().localHandoff) {
+            return c.json(hostedProfileRefusal, 409);
+        }
+        // Resolve the account BEFORE anything else: both the command and the status probe below
+        // must describe the same one, or the pane reports on the personal login while the terminal
+        // signs into the work login.
+        const resolved = await resolveWorkspaceProfile(provider, body.data.profileId);
+        if ('error' in resolved)
+            return c.json({ error: resolved.error }, 400);
+        const { profile } = resolved;
+        const command = providerAuth.loginCommand(provider, profile.isDefault ? null : profile.path);
+        // Fail closed: a config dir that cannot be embedded safely in this platform's shell has no
+        // safe degradation. Running the bare command would sign the user into a DIFFERENT account
+        // than the one they clicked, and nothing in the terminal would say so.
+        if (command === null) {
+            return c.json({ error: `This account's folder cannot be used in a terminal command: ${profile.configDir}` }, 409);
+        }
+        // BOTH branches must mean "is this account signed in NOW". The default branch refreshes; the
+        // account branch has to evict first, because `profileStatus` serves the per-account cache and
+        // a connected answer there stands for CONNECTED_TTL_MS. Without this, Connect after a
+        // `claude /logout` answers "already connected", opens nothing, and the user is stuck — and it
+        // would contradict this module's own invariant that opening a login is one of the things
+        // cezar CAN observe and therefore invalidates explicitly rather than waiting out a window.
+        if (!profile.isDefault)
+            providerAuth.forgetProfileStatus(provider, profile.id);
+        const row = profile.isDefault
+            ? (await providerAuth.status({ refresh: true })).providers.find((candidate) => candidate.provider === provider)
+            : await providerAuth.profileStatus(provider, { id: profile.id, configDir: profile.path });
         if (!row) {
             return c.json({ error: 'Authentication could not be verified. Try again.' }, 500);
         }
@@ -1219,6 +1398,9 @@ export function createApp(deps) {
         }
         let opened = false;
         try {
+            // No `env` argument: `loginCommand` already rendered the account's config dir INTO the
+            // command, because this string is also the copy-paste fallback the pane shows. Passing
+            // it again here would set the variable twice.
             opened = await openTerminal(bootRoot, command);
         }
         catch {
@@ -1229,6 +1411,468 @@ export function createApp(deps) {
         }
         return c.json({ opened: true, command });
     });
+    // ---- chained family: agent profiles / accounts (workspace-level) ----------
+    // Extra config dirs for a SECOND login of the same agent CLI (spec
+    // 2026-07-29-agent-profiles). Workspace-level and therefore SINGLE-MOUNT: an account belongs to
+    // the person and the machine, never to a repo, and a project-scoped spelling would be a second
+    // surface to protect with no consumer. Which account a project uses is a field on
+    // `PATCH /api/v1/projects/:projectId` instead.
+    //
+    // Writing is a LOCAL-MACHINE capability, exactly like `PUT /api/v1/agent-config/:id`: a profile
+    // points an agent at a directory on the host, and the listing echoes absolute paths carrying
+    // the username — the same disclosure `/api/v1/health` trims in hosted mode (#431).
+    /**
+     * This agent's own USER-scope config files, resolved inside ONE account's folder.
+     *
+     * Straight from the catalog — the single home of config-file vendor knowledge — with an
+     * `AgentHomePaths` whose slot for this provider is the account's dir. That is what makes a second
+     * login's `settings.json` the file you open rather than the default account's, and it keeps the
+     * ids opaque and stable so the open route below never takes a path from the client.
+     */
+    const accountFiles = async (profile) => {
+        const home = {
+            ...agentHomePaths(),
+            ...(profile.provider === 'claude' ? { claude: profile.path } : {}),
+            ...(profile.provider === 'codex' ? { codex: profile.path } : {}),
+            ...(profile.provider === 'opencode' ? { opencodeConfig: profile.path } : {}),
+        };
+        const defs = listConfigFiles().filter((def) => def.scope === 'user' && def.runners.includes(profile.provider));
+        return Promise.all(defs.map(async (def) => {
+            const path = def.resolve(bootRoot, home);
+            return { id: def.id, label: basename(path), path, exists: (await statConfigPath(path)).exists };
+        }));
+    };
+    /** Build the wire row for one resolved profile: its dir state plus whatever auth is cached. */
+    const agentProfileBody = async (profile) => ({
+        id: profile.id,
+        provider: profile.provider,
+        label: profile.label,
+        configDir: profile.configDir,
+        path: profile.path,
+        ...(await profileDirState(profile.provider, profile.path)),
+        isDefault: profile.isDefault,
+        // CACHED auth only — this listing must never pay a CLI spawn.
+        //
+        // Probing here cost a shell-out per provider PLUS one per extra account: ~0.7s with no extra
+        // accounts and over 2s with a few, on every cold load, for a route whose real job (what
+        // accounts exist) is a JSON read and a handful of stats. `GET /api/v1/health` already
+        // established the rule — it serves whatever the cache holds and never pays a `gh` shell-out.
+        // An absent `status` means "not determined yet", which the cockpit renders as Checking… and
+        // then fills in from the per-account status route below.
+        //
+        // SPREAD, not `status: maybeUndefined`: hono would type the key as always-present while
+        // `JSON.stringify` drops it, which is exactly the drift `contract-parity` catches (AGENTS.md
+        // names this as one of the two recurring mismatches).
+        ...(() => {
+            const cached = profile.isDefault
+                ? providerAuth.peekStatus()?.providers.find((row) => row.provider === profile.provider)
+                : providerAuth.peekProfileStatus(profile.provider, profile.id);
+            return cached ? { status: cached } : {};
+        })(),
+        files: await accountFiles(profile),
+    });
+    /**
+     * Resolve `:id` to an account for the per-account reads below. Unlike `resolveWorkspaceProfile`
+     * this accepts the reserved `default` for a NAMED provider, which these routes cannot infer — so
+     * the id may be `default:<provider>` as well as a stored account id.
+     */
+    const accountById = async (id) => {
+        const [head, tail] = id.split(':');
+        if (head === DEFAULT_AGENT_ACCOUNT_ID) {
+            const provider = PROVIDER_IDS.find((p) => p === tail);
+            return provider ? defaultAgentProfile(provider) : null;
+        }
+        try {
+            const stored = (await loadAgentAccounts()).accounts.find((a) => a.id === id);
+            return stored ? resolveStoredProfile(stored) : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    /** Validate a client-supplied config dir. Returns the error text, or null when it is usable. */
+    const checkProfileDir = (configDir) => {
+        if (CONTROL_CHARS_RE.test(configDir))
+            return 'folder must not contain control characters';
+        const expanded = expandTilde(configDir);
+        // Absolute after expansion: a relative dir would resolve against whatever cwd the agent
+        // happens to be spawned in, which for a task is a throwaway worktree. Through
+        // `isAbsoluteConfigDir`, never a leading-`/` test — see its note: a string test refuses every
+        // real Windows path, and this is the only gate the Add-account dialog has.
+        if (!isAbsoluteConfigDir(expanded))
+            return `folder must be an absolute path: ${configDir}`;
+        return null;
+    };
+    /** Refuse a dir that is already some other account's (or the default's), compared through
+     *  `realpath` — two spellings of one directory would be two accounts silently sharing one
+     *  session store, and "which one am I logged into?" would stop having an answer. */
+    const conflictingProfile = async (profiles, provider, path, exceptId) => {
+        if (await sameProfileDir(path, defaultAgentProfile(provider).path)) {
+            return 'that is already this agent\'s default folder';
+        }
+        for (const candidate of profiles) {
+            if (candidate.provider !== provider || candidate.id === exceptId)
+                continue;
+            if (await sameProfileDir(path, expandTilde(candidate.configDir))) {
+                return `that folder is already used by "${candidate.label || candidate.id}"`;
+            }
+        }
+        return null;
+    };
+    const agentProfilesRoutes = new Hono()
+        .get('/workspace/agent-profiles', async (c) => {
+        const editable = capabilities().localHandoff;
+        // Hosted mode withholds the listing entirely rather than serving it read-only: the paths
+        // are the host disclosure, so an empty list is the only honest hosted answer.
+        //
+        // ONE body object, never a hosted `return` and a local `return`: two returns let hono
+        // narrow `editable` to the literal `false`/`true` of each branch, and the contract's
+        // honest `z.boolean()` then reads as wider than the route. Same shape as
+        // `listAgentConfig`, which carries the same flag for the same reason.
+        let store = defaultAgentAccountStore();
+        if (editable) {
+            try {
+                store = await loadAgentAccounts();
+            }
+            catch {
+                // an unreadable home degrades to "no extra accounts", never a failed request
+            }
+        }
+        const profiles = editable
+            ? await Promise.all(listAgentProfiles(store, PROVIDER_IDS).map(agentProfileBody))
+            : [];
+        return c.json({
+            editable,
+            profiles,
+            profileCapableProviders: [...PROFILE_CAPABLE_PROVIDERS],
+            // Which account each project uses, keyed by repo root. Served here rather than on the
+            // project registry because it lives in the same file as the accounts it names.
+            selections: editable ? store.selections : {},
+            /** The machine-wide fallback, for repos that have chosen nothing. Withheld in hosted mode
+             *  on the same terms as the rest of this family. */
+            defaults: editable ? store.defaults : {},
+        });
+    })
+        .post('/workspace/agent-profiles', jsonZodValidator(() => createAgentProfileSchema), async (c) => {
+        if (!capabilities().localHandoff)
+            return c.json(hostedProfileRefusal, 409);
+        const { provider, configDir, label } = c.req.valid('json');
+        if (!supportsProfiles(provider)) {
+            return c.json({ error: `${provider} cannot carry more than one account` }, 400);
+        }
+        const dirError = checkProfileDir(configDir);
+        if (dirError)
+            return c.json({ error: dirError }, 400);
+        // Read-first, exactly like `POST /projects`: the duplicate check needs `realpath`, and the
+        // merge-write mutator is deliberately SYNCHRONOUS so the read→rename window stays as small
+        // as it is for every other writer of this file. Two processes adding the same folder in
+        // that window would both win — a cosmetic duplicate, not a correctness problem, since the
+        // schema's id dedupe is what keeps resolution deterministic.
+        let existing = [];
+        try {
+            existing = (await loadAgentAccounts()).accounts;
+        }
+        catch {
+            // unreadable store — the merge-write below reports the real failure
+        }
+        const conflict = await conflictingProfile(existing, provider, expandTilde(configDir));
+        if (conflict !== null)
+            return c.json({ error: conflict }, 409);
+        let created;
+        try {
+            await mergeWriteAgentAccounts((store) => {
+                const id = allocateAgentProfileId(label ?? configDir, store.accounts.map((a) => a.id));
+                created = {
+                    id,
+                    provider,
+                    configDir,
+                    label: label?.trim() || id,
+                    addedAt: new Date().toISOString(),
+                };
+                store.accounts.push(created);
+            });
+        }
+        catch (err) {
+            return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
+        }
+        if (!created)
+            return c.json({ error: 'account could not be saved' }, 500);
+        // A brand-new account is the one thing the boot warm could not have known about, so learn it
+        // now rather than only when something asks. Still off the response: the row is returned with
+        // `status` absent (the listing's rule), the pane shows Checking…, and its follow-up request
+        // joins this same in-flight probe.
+        const account = resolveStoredProfile(created);
+        const created201 = await agentProfileBody(account);
+        void providerAuth
+            .profileStatus(account.provider, { id: account.id, configDir: account.path })
+            .catch(() => { });
+        return c.json({ profile: created201 }, 201);
+    })
+        .patch('/workspace/agent-profiles/:id', paramZodValidator(z.object({ id: z.string() })), jsonZodValidator(() => updateAgentProfileSchema), async (c) => {
+        if (!capabilities().localHandoff)
+            return c.json(hostedProfileRefusal, 409);
+        const id = c.req.param('id');
+        const { label, configDir } = c.req.valid('json');
+        if (configDir !== undefined) {
+            const dirError = checkProfileDir(configDir);
+            if (dirError)
+                return c.json({ error: dirError }, 400);
+        }
+        // Read-first (see POST above, and `PATCH /projects`): a well-formed but unknown id must
+        // 404 WITHOUT rewriting the config, and the duplicate check needs async `realpath`.
+        let existing = [];
+        try {
+            existing = (await loadAgentAccounts()).accounts;
+        }
+        catch {
+            // unreadable store — treated as unknown, like DELETE and PATCH /projects
+        }
+        const current = existing.find((a) => a.id === id);
+        if (!current)
+            return c.json({ error: `unknown account: ${id}` }, 404);
+        if (configDir !== undefined) {
+            const conflict = await conflictingProfile(existing, current.provider, expandTilde(configDir), id);
+            if (conflict !== null)
+                return c.json({ error: conflict }, 409);
+        }
+        let updated;
+        try {
+            await mergeWriteAgentAccounts((store) => {
+                const entry = store.accounts.find((a) => a.id === id);
+                if (!entry)
+                    return; // lost a race with a concurrent delete — answered below
+                // Mutated in place so `.passthrough()` keys on the row survive.
+                if (label !== undefined)
+                    entry.label = label.trim() || entry.id;
+                if (configDir !== undefined)
+                    entry.configDir = configDir;
+                updated = entry;
+            });
+        }
+        catch (err) {
+            return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
+        }
+        if (!updated)
+            return c.json({ error: `unknown account: ${id}` }, 404);
+        // The dir may have moved under a cached probe — drop THIS account's answer so the response
+        // reports the new folder's state rather than the old one's, and leave every other account's
+        // warm answer alone (it is still true). Then re-learn it in the background, so the server's
+        // knowledge is complete again whether or not a cockpit is open to ask; the pane's own
+        // request for this row joins the same in-flight probe rather than spawning a second.
+        const repointed = resolveStoredProfile(updated);
+        providerAuth.forgetProfileStatus(repointed.provider, repointed.id);
+        const body = await agentProfileBody(repointed);
+        void providerAuth
+            .profileStatus(repointed.provider, { id: repointed.id, configDir: repointed.path })
+            .catch(() => { });
+        return c.json({ profile: body });
+    })
+        /**
+         * One account's authentication state, probed for real.
+         *
+         * Separate from the listing because a probe shells out to an agent CLI: keeping it here lets
+         * the pane paint immediately and fill each row in as its answer lands, instead of every cold
+         * load blocking on N spawns. `refresh=1` drops this account's cached answer and re-probes, for
+         * the "Check again" affordance — the cache itself holds a connected answer for minutes and an
+         * unsettled one for a minute (`cacheTtlFor` in `core/provider-auth.ts`).
+         */
+        .get('/workspace/agent-profiles/:id/status', paramZodValidator(z.object({ id: z.string() })), queryZodValidator(z.object({ refresh: queryValue.refine((v) => v === undefined || v === '1') }), { message: 'refresh must be 1 when provided' }), async (c) => {
+        if (!capabilities().localHandoff)
+            return c.json(hostedProfileRefusal, 409);
+        const account = await accountById(c.req.param('id'));
+        if (!account)
+            return c.json({ error: `unknown account: ${c.req.param('id')}` }, 404);
+        const refresh = c.req.valid('query').refresh === '1';
+        // The discovered account's row is the one `GET /api/v1/providers/status` owns, so it comes
+        // from there — enablement included, which a bare probe does not know about.
+        if (account.isDefault) {
+            const all = await providerStatus(refresh ? { refresh: true } : undefined);
+            const row = all.providers.find((candidate) => candidate.provider === account.provider);
+            return c.json({ status: row ?? { provider: account.provider, status: 'unknown' } });
+        }
+        // "Check again" re-probes THIS account only — the other accounts' warm answers are not
+        // invalidated by asking about this one.
+        if (refresh)
+            providerAuth.forgetProfileStatus(account.provider, account.id);
+        return c.json({
+            status: await providerAuth.profileStatus(account.provider, {
+                id: account.id,
+                configDir: account.path,
+            }),
+        });
+    })
+        /**
+         * Who this account is signed in AS — the pane's "Show details".
+         *
+         * A separate, on-demand route rather than a field on the listing, and that is what makes
+         * "hidden by default" real: an email carried by the listing would already be in the response,
+         * the query cache and devtools, whatever the UI chose to render. `provider-auth.ts` keeps
+         * identity out of ITS boundary on purpose; this is the deliberate, local-only, opt-in
+         * exception — not a widening of that rule. Never logged, never persisted.
+         */
+        .get('/workspace/agent-profiles/:id/details', paramZodValidator(z.object({ id: z.string() })), async (c) => {
+        if (!capabilities().localHandoff)
+            return c.json(hostedProfileRefusal, 409);
+        const account = await accountById(c.req.param('id'));
+        if (!account)
+            return c.json({ error: `unknown account: ${c.req.param('id')}` }, 404);
+        return c.json(await readAccountIdentity(account.provider, account.path));
+    })
+        /**
+         * Open one of this account's own config files — or its folder — in a local app.
+         *
+         * `file` is a catalog ID from the account's own `files`, never a path: the client cannot name a
+         * location, so there is no traversal surface here at all (the same rule
+         * `/api/v1/agent-config/:id` follows). `folder` is the one extra keyword, and it resolves to
+         * the account's dir rather than anything the caller spelled.
+         */
+        .post('/workspace/agent-profiles/:id/open', paramZodValidator(z.object({ id: z.string() })), jsonZodValidator(() => openAgentAccountFileSchema), async (c) => {
+        if (!capabilities().localHandoff)
+            return c.json(hostedProfileRefusal, 409);
+        const account = await accountById(c.req.param('id'));
+        if (!account)
+            return c.json({ error: `unknown account: ${c.req.param('id')}` }, 404);
+        const { file, target } = c.req.valid('json');
+        let path;
+        if (file === 'folder') {
+            path = account.path;
+        }
+        else {
+            const match = (await accountFiles(account)).find((f) => f.id === file);
+            if (!match)
+                return c.json({ error: `unknown file: ${file}` }, 404);
+            path = match.path;
+        }
+        // A file the agent has not written yet has nothing to open; say so rather than hand the OS
+        // a missing path and report success.
+        if (!(await statConfigPath(path)).exists && file !== 'folder') {
+            return c.json({ error: `this account has no ${basename(path)} yet` }, 409);
+        }
+        // `target` names a detected app; absent means the OS default handler. Either way the PATH
+        // came from the catalog, so an editor is only ever pointed inside this account's folder.
+        //
+        // Which targets APPLY is checked here rather than left to the UI, because two of them are
+        // actively wrong rather than merely useless: `terminal` runs `cd <path>`, which fails on a
+        // file, and a `cli:<runner>` handoff would start an agent session inside the config folder.
+        // A route is a surface of its own; it refuses what it cannot do correctly.
+        if (target !== undefined) {
+            if (agentCliRunner(target) !== null) {
+                return c.json({ error: 'agent CLIs open a task worktree, not a config folder' }, 400);
+            }
+            if (target === 'terminal' && file !== 'folder') {
+                return c.json({ error: 'a terminal opens a folder, not a file' }, 400);
+            }
+            if (!detectOpenTargets().some((candidate) => candidate.id === target)) {
+                return c.json({ error: `no such app on this machine: ${target}` }, 400);
+            }
+        }
+        const opened = target === undefined
+            ? await openFile(path)
+            : await openApp(target, path);
+        if (!opened)
+            return c.json({ error: `could not open ${basename(path)}`, path }, 409);
+        return c.json({ opened: true, path });
+    })
+        // Which account a PROJECT uses. On the accounts family rather than `PATCH /api/v1/projects`
+        // because the selection is stored beside the accounts it names — one file, one atomic write,
+        // and nothing about it can be dropped by a cezar version that never heard of accounts.
+        .put('/workspace/agent-profiles/selection', jsonZodValidator(() => selectAgentProfileSchema), async (c) => {
+        if (!capabilities().localHandoff)
+            return c.json(hostedProfileRefusal, 409);
+        const { projectId, provider, profileId } = c.req.valid('json');
+        // `null` writes the MACHINE-WIDE default instead of one repo's selection: the account any
+        // repo that has chosen nothing uses, so a second login is set up once rather than per
+        // checkout. No project to resolve, and therefore no 404 path.
+        let root = null;
+        if (projectId !== null) {
+            const resolvedId = projectId === 'default' ? await resolveBootProject() : projectId;
+            // Keyed by repo ROOT, so the selection survives the registry being rebuilt and needs no
+            // cross-reference into config.json. An unknown project is a 404 rather than an orphan
+            // entry nobody will ever read.
+            root = await projectRootFor(resolvedId);
+            if (root === null)
+                return c.json({ error: `unknown project: ${projectId}` }, 404);
+        }
+        // A user naming an account that does not exist gets told so — the opposite of how RUN
+        // resolution treats a dangling stored id, and deliberately: a run has no better answer
+        // than the default, a person does.
+        if (profileId !== null && profileId !== DEFAULT_AGENT_ACCOUNT_ID) {
+            const account = await resolveWorkspaceProfile(provider, profileId);
+            if ('error' in account)
+                return c.json({ error: account.error }, 400);
+        }
+        let store;
+        try {
+            store = await mergeWriteAgentAccounts((current) => {
+                // One rule, two targets: the machine default is the same per-provider shape as a repo's
+                // selection, so it clears the same way rather than growing its own spelling.
+                const selection = root === null ? current.defaults : current.selections[root] ?? {};
+                // `null` and the reserved `default` both mean "back to the discovered account", which
+                // is stored as ABSENCE — the default id is never written to the file.
+                if (profileId === null || profileId === DEFAULT_AGENT_ACCOUNT_ID)
+                    delete selection[provider];
+                else
+                    selection[provider] = profileId;
+                // The machine default keeps an emptied object where a repo selection is deleted, and
+                // that asymmetry is the schema's, not an oversight: `defaults` is one FIXED field with
+                // `.default(() => ({}))`, so `mergeWriteAgentAccounts` re-materializes it on the next
+                // write no matter what this one omits (verified). `selections` is a growing MAP, where
+                // an emptied entry is a row per repo ever touched that says nothing. The rule stated
+                // for `agentDefaults.models` — "absence is the same answer" — applies there because
+                // that key is `.optional()`, so deleting it actually sticks.
+                if (root === null)
+                    current.defaults = selection;
+                else if (Object.keys(selection).length === 0)
+                    delete current.selections[root];
+                else
+                    current.selections[root] = selection;
+            });
+        }
+        catch (err) {
+            return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
+        }
+        return c.json({ selections: store.selections, defaults: store.defaults });
+    })
+        .delete('/workspace/agent-profiles/:id', paramZodValidator(z.object({ id: z.string() })), async (c) => {
+        if (!capabilities().localHandoff)
+            return c.json(hostedProfileRefusal, 409);
+        const id = c.req.param('id');
+        let removed = false;
+        // Captured inside the mutator, because after the write there is nothing left to ask which
+        // provider this account belonged to — and the eviction below is keyed by it.
+        let removedProvider;
+        try {
+            await mergeWriteAgentAccounts((store) => {
+                const before = store.accounts.length;
+                removedProvider = store.accounts.find((a) => a.id === id)?.provider;
+                store.accounts = store.accounts.filter((a) => a.id !== id);
+                removed = store.accounts.length < before;
+                if (!removed)
+                    return;
+                // Scrub every reference IN THE SAME MUTATOR — the reason selections share this file.
+                // A two-call delete-then-scrub can be observed mid-way by another cezar process on
+                // this machine, which would then resolve a dangling id; harmless today (it degrades
+                // to the default) but only by luck.
+                for (const [root, selection] of Object.entries(store.selections)) {
+                    for (const key of Object.keys(selection)) {
+                        if (selection[key] === id)
+                            delete selection[key];
+                    }
+                    if (Object.keys(selection).length === 0)
+                        delete store.selections[root];
+                }
+            });
+        }
+        catch (err) {
+            return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
+        }
+        if (!removed)
+            return c.json({ error: `unknown account: ${id}` }, 404);
+        // Only this account's answer: it is about to stop existing, and holding it would let a
+        // re-added account with the same id read the deleted one's state.
+        providerAuth.forgetProfileStatus(removedProvider, id);
+        return c.json({ removed: true, id });
+    });
     // ---- workspace projects (multi-project spec) -----------------------------
     // The registered-project list for the cockpit sidebar. Same-origin (unlike
     // health), so absolute `root`s are fine here. `listProjects()` TTL-caches
@@ -1342,7 +1986,21 @@ export function createApp(deps) {
         const body = { removed: true, id };
         return c.json(body);
     })
-        .patch('/projects/:projectId', jsonZodValidator(() => updateProjectSchema), async (c) => {
+        // Edit the per-project registry fields the cockpit owns: the concurrency ceiling (spec
+        // 2026-07-22-per-project-concurrency) and the grouping tags (spec
+        // 2026-08-10-global-tasks-and-project-tags). A PATCH (not PUT) because it touches named
+        // fields and leaves the rest of the entry alone, and a distinct route from POST
+        // (register-a-folder) to keep register vs. edit semantics clear.
+        //
+        // The body schema is the CONTRACT's, passed directly rather than restated behind a thunk:
+        // it is already in scope, and a second copy is a second thing to keep in step. Its bounds
+        // mirror `workspaceProjectSchema` (config.ts) exactly, so a value this route accepts can
+        // never be degraded away by the next load's `.catch`.
+        //
+        // Deliberately NOT the home of the agent-account selection: that lives in
+        // `~/.cezar/agent-accounts.json` beside the accounts it names, so a cezar version that has
+        // never heard of accounts cannot drop it (see workspace/agent-accounts.ts).
+        .patch('/projects/:projectId', jsonZodValidator(updateProjectInputSchema), async (c) => {
         if (capabilities().singleProject) {
             return c.json(singleProjectRefusal('editing projects'), 409);
         }
@@ -1354,7 +2012,7 @@ export function createApp(deps) {
         const parsed = { data: c.req.valid('json') };
         // `default` is the boot alias the cockpit is allowed to use everywhere else.
         const id = raw === 'default' ? await resolveBootProject() : raw;
-        const { maxParallel } = parsed.data;
+        const { maxParallel, tags } = parsed.data;
         // Read-first (mirroring DELETE, server.ts:1252-1258): a well-formed but
         // unknown id must 404 WITHOUT rewriting the config — otherwise it would both
         // do a needless full-config tmp+rename and, on a read-only home, surface the
@@ -1375,12 +2033,27 @@ export function createApp(deps) {
                 const entry = config.projects.find((p) => p.id === id);
                 if (!entry)
                     return; // lost a race with a concurrent remove — answered below
-                // null clears the override; a number sets it. Mutated in place so
-                // `.passthrough()` keys on the entry survive.
-                if (maxParallel === null)
-                    delete entry.maxParallel;
-                else
-                    entry.maxParallel = maxParallel;
+                // Each key is applied only when the body NAMED it: a PATCH that says
+                // nothing about a field must leave it exactly as it was, which is what
+                // keeps the tags editor from clearing a concurrency ceiling (and the
+                // pre-tags `{ maxParallel }` body from clearing tags). null clears;
+                // a value sets. Mutated in place so `.passthrough()` keys survive.
+                if (maxParallel !== undefined) {
+                    if (maxParallel === null)
+                        delete entry.maxParallel;
+                    else
+                        entry.maxParallel = maxParallel;
+                }
+                if (tags !== undefined) {
+                    // Normalized on the way IN, so every reader — this API, the CLI, the
+                    // global Tasks page — sees one spelling per tag and never has to
+                    // fold case itself.
+                    const normalized = normalizeProjectTags(tags);
+                    if (normalized === undefined)
+                        delete entry.tags;
+                    else
+                        entry.tags = normalized;
+                }
                 updated = entry;
             });
         }
@@ -1642,17 +2315,6 @@ export function createApp(deps) {
             throw error;
         }
     });
-    // Edit one field of an existing registry entry (spec
-    // 2026-07-22-per-project-concurrency): the per-project concurrency ceiling.
-    // A PATCH (not PUT) because it touches a single field, and a distinct route
-    // from POST (register-a-folder) to keep register vs. edit semantics clear.
-    // `maxParallel: null` clears the override back to "inherit the workspace
-    // cap". Bounds mirror `workspaceProjectSchema` (config.ts) exactly, so a
-    // value this route accepts can never be degraded away by the next load's
-    // `.catch`.
-    const updateProjectSchema = z.object({
-        maxParallel: z.number().int().min(1).max(16).nullable(),
-    });
     // ---- GUI clone (multi-project spec, step 4.3) ----------------------------
     // "Add project → Clone from GitHub": clone into the checkout root, then
     // register the result through `registerFolder` above (same guards, same
@@ -1694,16 +2356,24 @@ export function createApp(deps) {
             maxParallel: config.resources.maxParallel,
             maxMonitoringSessions: config.resources.maxMonitoringSessions,
             monitoringWakeIntervalMinutes: config.resources.monitoringWakeIntervalMinutes,
+            autoResumeOnUsageLimit: config.resources.autoResumeOnUsageLimit,
             memoryLimitMb: config.resources.memoryLimitMb,
             worktreeRetentionDefault: config.resources.worktreeRetentionDefault,
         },
+        // SPREAD, never `runner: maybeUndefined`: hono would type the key as always-present while
+        // `JSON.stringify` drops it, which is the exact drift `contract-parity` catches. And absent has
+        // to keep meaning "no opinion" here, or the fallback collapses into "always claude".
+        agentDefaults: {
+            ...(config.agentDefaults.runner !== undefined ? { runner: config.agentDefaults.runner } : {}),
+            ...(config.agentDefaults.models !== undefined ? { models: config.agentDefaults.models } : {}),
+        },
     });
     // ---- chained family: workspace settings + GUI prefs (workspace-level) ----
     const workspaceConfigRoutes = new Hono()
         .get('/workspace/config', async (c) => c.json(workspaceConfigBody(await loadWorkspaceConfig())))
         .put('/workspace/config', jsonZodValidator(() => workspaceConfigUpdateSchema), async (c) => {
         const parsed = { data: c.req.valid('json') };
-        const { browseRoot, projectsDir, skillsAutoUpdate, composerDefaults, resources } = parsed.data;
+        const { browseRoot, projectsDir, skillsAutoUpdate, composerDefaults, resources, agentDefaults } = parsed.data;
         for (const [configuredRoot, create] of [
             [browseRoot, false],
             [projectsDir, true],
@@ -1764,11 +2434,35 @@ export function createApp(deps) {
                 if (resources?.monitoringWakeIntervalMinutes !== undefined) {
                     config.resources.monitoringWakeIntervalMinutes = resources.monitoringWakeIntervalMinutes;
                 }
+                if (resources?.autoResumeOnUsageLimit !== undefined) {
+                    config.resources.autoResumeOnUsageLimit = resources.autoResumeOnUsageLimit;
+                }
                 if (resources?.memoryLimitMb !== undefined)
                     config.resources.memoryLimitMb = resources.memoryLimitMb;
                 if (resources?.worktreeRetentionDefault !== undefined) {
                     config.resources.worktreeRetentionDefault = resources.worktreeRetentionDefault;
                 }
+                // `null` CLEARS back to "no opinion" — a partial patch cannot say that by omission,
+                // and leaving a stale runner behind would keep overriding repos that never chose.
+                if (agentDefaults?.runner === null)
+                    delete config.agentDefaults.runner;
+                else if (agentDefaults?.runner !== undefined)
+                    config.agentDefaults.runner = agentDefaults.runner;
+                for (const runner of PROVIDER_IDS) {
+                    const model = agentDefaults?.models?.[runner];
+                    if (model === undefined)
+                        continue;
+                    const models = config.agentDefaults.models ?? {};
+                    if (model === null)
+                        delete models[runner];
+                    else
+                        models[runner] = model;
+                    // An empty object would persist a key that says nothing; absence is the same answer.
+                    if (Object.keys(models).length === 0)
+                        delete config.agentDefaults.models;
+                    else
+                        config.agentDefaults.models = models;
+                }
             });
         }
         catch (err) {
@@ -1791,7 +2485,7 @@ export function createApp(deps) {
         // the same point (before the handler, so the cap still precedes any read) and leaves the
         // chain's type accumulation alone. Method-agnostic here, which the GET does not mind.
         .use('/workspace/ui-state', bodyLimit({ maxSize: UI_STATE_BODY_LIMIT }))
-        .put('/workspace/ui-state', jsonZodValidator(workspaceUiStateBody), async (c) => {
+        .put('/workspace/ui-state', jsonZodValidator(setWorkspaceUiStateInputSchema), async (c) => {
         const parsed = { data: c.req.valid('json') };
         try {
             return c.json(await mergeWriteWorkspaceUiState((state) => ({
@@ -1822,10 +2516,26 @@ export function createApp(deps) {
             maxParallel: z.number().int().min(1).max(16).optional(),
             maxMonitoringSessions: z.number().int().min(0).max(16).optional(),
             monitoringWakeIntervalMinutes: z.number().int().min(1).max(60).nullable().optional(),
+            autoResumeOnUsageLimit: z.boolean().optional(),
             memoryLimitMb: z.number().int().min(0).max(1_048_576).nullable().optional(),
             worktreeRetentionDefault: z.number().int().min(0).max(1000).optional(),
         })
             .optional(),
+        // Bounds mirror `src/workspace/config.ts`, so a value this accepts is never degraded away by
+        // the next load's `.catch`. `null` clears a key back to "no opinion".
+        agentDefaults: z
+            .object({
+            runner: z.enum(PROVIDER_IDS).nullable().optional(),
+            models: z
+                .object({
+                claude: z.string().trim().min(1).max(200).nullable().optional(),
+                codex: z.string().trim().min(1).max(200).nullable().optional(),
+                opencode: z.string().trim().min(1).max(200).nullable().optional(),
+                pi: z.string().trim().min(1).max(200).nullable().optional(),
+            })
+                .optional(),
+        })
+            .optional(),
     });
     // ---- chained family: filesystem browse (workspace-level) ----
     const fsBrowseRoutes = new Hono()
@@ -2014,12 +2724,35 @@ export function createApp(deps) {
         return c.json(await planChain(repoRoot, parsed.data.task));
     });
     const manualChecks = new Map();
+    /**
+     * The automations gate (#801): with `CEZ_AUTOMATIONS` unset, every route of the feature
+     * answers 409 before touching a store, a lease or GitHub.
+     *
+     * Written as MIDDLEWARE rather than a line in each handler so the family cannot drift: a route
+     * added to either chain below inherits the gate from its path, where a per-handler check is one
+     * omission away from an ungated endpoint.
+     *
+     * Registered against EXPLICIT paths, never `use('*')`. Both chains are mounted with
+     * `.route('/', …)` alongside a dozen unrelated sub-apps, and `route()` re-registers a sub-app's
+     * middleware under the mount prefix — so a `'*'` here would gate the entire `/api/v1` surface,
+     * including `/health`. The two-line pairing (`/automations` and `/automations/*`) is what makes
+     * a path match both the collection and everything under it.
+     */
+    const requireAutomations = async (c, next) => {
+        if (!capabilities().automations)
+            return c.json({ error: AUTOMATIONS_OFF }, 409);
+        await next();
+    };
     // ---- chained family: GitHub automations (project-scoped) ----
     // Every handler below reads `c.get('project')` — the definitions, their runtime state and the
     // execution log are per-project files — so the family is project-scoped and mounted with the
     // rest of the mirrored table. The one exception is the manual-check read, which touches no
     // project at all; it is its own workspace-level family below.
     const automationsRoutes = new Hono()
+        .use('/automations', requireAutomations)
+        .use('/automations/*', requireAutomations)
+        .use('/automation-log', requireAutomations)
+        .use('/automation-log/*', requireAutomations)
         .get('/automations', async (c) => {
         const { root, automationStore } = c.get('project');
         const forge = resolveForge(await getRepoInfo(root));
@@ -2243,6 +2976,7 @@ export function createApp(deps) {
     // above, keyed by an unguessable id that the project-scoped POST hands back. Mounting it under
     // `/api/v1/p/:projectId` too would be a second spelling of a lookup that consults no project.
     const automationChecksRoutes = new Hono()
+        .use('/automation-checks/*', requireAutomations)
         .get('/automation-checks/:checkId', (c) => {
         const check = manualChecks.get(c.req.param('checkId'));
         return check ? c.json(check) : c.json({ error: 'not found' }, 404);
@@ -2289,19 +3023,43 @@ export function createApp(deps) {
         const id = c.req.param('id');
         // An empty/absent body archives (the common case); a malformed body degrades
         // to `{}` just as before, but a wrong-typed `archived` is now a 400 (#429).
+        // Archiving also retires any pending usage-limit resume, but that rule belongs to
+        // `setArchived` itself — the bulk sweep must obey it too (spec
+        // 2026-08-03-auto-resume-after-usage-limit).
         const parsed = { data: c.req.valid('json') };
         const run = store.setArchived(id, parsed.data.archived !== false);
         return run ? c.json(run) : c.json({ error: 'not found' }, 404);
+    })
+        // The per-task off switch for that resume (the workspace setting is Settings → Resources).
+        // Idempotent: a run with nothing pending answers 200 too, because "this task will not
+        // resume itself" is equally true either way.
+        .delete('/runs/:id/auto-resume', (c) => {
+        const { store, manager } = c.get('project');
+        const id = c.req.param('id');
+        if (!store.getRun(id))
+            return c.json({ error: 'not found' }, 404);
+        manager.cancelAutoResume(id);
+        return c.json({ cancelled: true });
     })
         .post('/runs/:id/read', (c) => {
         // No body: opening a thread marks it read, full stop. Stamps `seenAt = now` and
         // returns the updated record (which also rides the `run` SSE via `touch`).
         const run = c.get('project').store.setRead(c.req.param('id'));
         return run ? c.json(run) : c.json({ error: 'not found' }, 404);
+    })
+        .post('/runs/:id/unread', (c) => {
+        // The mark-unread twin (#775) — bodyless like its read counterpart: clearing the
+        // receipt is the whole action, so there is nothing to say about it. Sits under
+        // `/runs/:id/`, so the `read-all` registration-order caveat above does not apply.
+        const run = c.get('project').store.setUnread(c.req.param('id'));
+        return run ? c.json(run) : c.json({ error: 'not found' }, 404);
     })
         .post('/runs', jsonZodValidator(startRunSchema), async (c) => {
         const { root: repoRoot, dataDir, manager } = c.get('project');
         const parsed = { data: c.req.valid('json') };
+        if (agentModelsLocked(repoRoot) && parsed.data.model?.trim()) {
+            return c.json({ error: AGENT_MODELS_LOCKED_ERROR }, 409);
+        }
         let workflow;
         if (parsed.data.steps) {
             // Inline chain (spec 008): an approved plan runs as an ad-hoc workflow.
@@ -2324,6 +3082,15 @@ export function createApp(deps) {
         const blocked = await providerActionError(providersRequiredByWorkflow(workflow, fallback));
         if (blocked)
             return c.json({ error: blocked }, 409);
+        // A composer override names an account the user just picked, so a stale id (deleted since
+        // the page loaded) is answered honestly instead of quietly running on the default — the
+        // opposite of how RESOLUTION treats a dangling reference, and deliberately so: a run
+        // replaying a stored id has no better answer than the default, a user does.
+        if (parsed.data.agentProfile !== undefined) {
+            const account = await resolveWorkspaceProfile(fallback, parsed.data.agentProfile);
+            if ('error' in account)
+                return c.json({ error: account.error }, 400);
+        }
         const images = parsed.data.images?.map((img) => ({
             type: 'image',
             source: { type: 'base64', media_type: img.mediaType, data: img.data },
@@ -2332,6 +3099,7 @@ export function createApp(deps) {
             task: parsed.data.task,
             model: parsed.data.model,
             runner: parsed.data.runner,
+            agentProfile: parsed.data.agentProfile,
             images,
             systemPrompt: parsed.data.systemPrompt,
             worktree: parsed.data.worktree,
@@ -2370,6 +3138,27 @@ export function createApp(deps) {
         const { store } = c.get('project');
         const run = store.getRun(c.req.param('id'));
         return run ? c.json(withUsage(run)) : c.json({ error: 'not found' }, 404);
+    })
+        .get('/runs/:id/history', paramZodValidator(runIdParamSchema), queryZodValidator(runHistoryQuerySchema), async (c) => {
+        const { store, dataDir } = c.get('project');
+        const { id } = c.req.valid('param');
+        if (!store.getRun(id))
+            return c.json({ error: 'not found' }, 404);
+        try {
+            return c.json(await readRunHistoryPage(join(dataDir, 'runs', `${id}.ndjson`), c.req.valid('query').cursor));
+        }
+        catch (error) {
+            if (error instanceof HistoryCursorError)
+                return c.json({ error: error.message }, error.status);
+            throw error;
+        }
+    })
+        .get('/runs/:id/history-context', paramZodValidator(runIdParamSchema), async (c) => {
+        const { store, dataDir } = c.get('project');
+        const { id } = c.req.valid('param');
+        if (!store.getRun(id))
+            return c.json({ error: 'not found' }, 404);
+        return c.json(await deriveRunContextEvents(join(dataDir, 'runs', `${id}.ndjson`)));
     })
         // Editable titles (#389). The UI displays `titleSummary ?? title`, so a
         // user edit sets BOTH: `title` (the record's own name — the raw task stops
@@ -2547,7 +3336,7 @@ export function createApp(deps) {
     })
         // "Continue" (spec 003): reopen a finished run's session in-process.
         .post('/runs/:id/continue', jsonZodValidator(continueSchema, { absent: ({}) }), async (c) => {
-        const { store, manager } = c.get('project');
+        const { root: repoRoot, store, manager } = c.get('project');
         const id = c.req.param('id');
         const run = store.getRun(id);
         if (!run)
@@ -2555,6 +3344,9 @@ export function createApp(deps) {
         // Bounded resume text (#429); an empty/absent body still just re-runs on the
         // run's current backend, and a runner/model override reopens on that engine (#401).
         const parsed = { data: c.req.valid('json') };
+        if (agentModelsLocked(repoRoot) && parsed.data.model?.trim()) {
+            return c.json({ error: AGENT_MODELS_LOCKED_ERROR }, 409);
+        }
         const blocked = await providerActionError([providerForExistingRun(run, parsed.data.runner)]);
         if (blocked)
             return c.json({ error: blocked }, 409);
@@ -2586,7 +3378,8 @@ export function createApp(deps) {
                 error: 'local handoff is disabled — this cockpit runs in hosted mode (CEZ_REMOTE); resume the session from a machine that has the checkout',
             }, 409);
         }
-        const sessionId = [...run.steps].reverse().find((s) => s.sessionId)?.sessionId;
+        const sessionStep = [...run.steps].reverse().find((s) => s.sessionId);
+        const sessionId = sessionStep?.sessionId;
         if (!sessionId)
             return c.json({ error: 'no agent session to resume' }, 409);
         const blocked = await providerActionError([providerForExistingRun(run)]);
@@ -2597,12 +3390,19 @@ export function createApp(deps) {
         // Fails closed on an id we do not recognise — see resumeCommand (#431).
         if (!command)
             return c.json({ error: 'the recorded session id has an unexpected shape' }, 409);
-        const opened = await openInTerminal(cwd, command);
+        // The account that OWNS this session, not the project's current one (spec 2026-07-29).
+        const account = await handoffEnv(run.runner ?? 'claude', sessionStep?.profileId);
+        if ('error' in account)
+            return c.json({ error: account.error }, 409);
+        const fallback = handoffFallbackCommand(cwd, command, account.env);
+        // Fail closed for the same reason as the session id: a terminal opened without the
+        // account's config dir resumes nothing and says nothing about why.
+        if (fallback === null) {
+            return c.json({ error: 'this account\'s folder cannot be used in a terminal command' }, 409);
+        }
+        const opened = await openTerminal(cwd, command, account.env);
         if (!opened) {
-            return c.json({
-                error: 'no terminal emulator found',
-                command: `cd '${cwd}' && ${command}`,
-            }, 409);
+            return c.json({ error: 'no terminal emulator found', command: fallback }, 409);
         }
         return c.json({ opened: true, command });
     })
@@ -2659,7 +3459,7 @@ export function createApp(deps) {
                 }, 409);
             }
             const filePath = join(run.worktreePath, result.path);
-            const opened = await openFileInDefaultApp(filePath);
+            const opened = await openFile(filePath);
             if (!opened)
                 return c.json({ error: `could not open ${result.path}`, path: filePath }, 409);
             return c.json({ opened: true, path: filePath });
@@ -2682,21 +3482,32 @@ export function createApp(deps) {
             if (blocked)
                 return c.json({ error: blocked }, 409);
             const engineOwnsSession = run.status === 'running' || run.status === 'queued' || run.status === 'waiting';
-            const sessionId = engineOwnsSession ? undefined : [...run.steps].reverse().find((s) => s.sessionId)?.sessionId;
+            const sessionStep = engineOwnsSession ? undefined : [...run.steps].reverse().find((s) => s.sessionId);
+            const sessionId = sessionStep?.sessionId;
             // An id resumeCommand refuses (#431) degrades to a fresh CLI in the worktree,
             // exactly like a run that never recorded a session.
             const resume = sessionId && cliRunner === (run.runner ?? 'claude') ? resumeCommand(cliRunner, sessionId) : null;
             const command = resume ?? cliRunner;
-            const opened = await openInTerminal(dir, command);
+            // BOTH branches carry the account (spec 2026-07-29-agent-profiles): a resume needs the
+            // config dir that holds its session, and a FRESH CLI in this worktree should still open
+            // on the account the project works under — otherwise "Open in → Claude CLI" quietly
+            // hands the user a different subscription than every task in the same project uses.
+            const account = resume
+                ? await handoffEnv(cliRunner, sessionStep?.profileId)
+                : { env: (await resolveProfileEnvForRoot(repoRoot, cliRunner)).env };
+            if ('error' in account)
+                return c.json({ error: account.error }, 409);
+            const fallback = handoffFallbackCommand(dir, command, account.env);
+            if (fallback === null) {
+                return c.json({ error: 'this account\'s folder cannot be used in a terminal command' }, 409);
+            }
+            const opened = await openTerminal(dir, command, account.env);
             if (!opened) {
-                return c.json({
-                    error: 'no terminal emulator found',
-                    command: `cd '${dir}' && ${command}`,
-                }, 409);
+                return c.json({ error: 'no terminal emulator found', command: fallback }, 409);
             }
             return c.json({ opened: true, path: dir, command });
         }
-        const opened = await openInApp(target, dir);
+        const opened = await openApp(target, dir);
         if (!opened)
             return c.json({ error: `could not open ${target}`, path: dir }, 409);
         return c.json({ opened: true, path: dir });
@@ -2750,6 +3561,8 @@ export function createApp(deps) {
             return c.json({ error: NO_WORKTREE }, 409);
         const result = await collectChanges(workingDirectory, run.baseBranch ?? 'HEAD', {
             taskBranch: run.branch,
+            // Anchors a repointed worktree at the branch as this run found it (#751).
+            runStartedAt: run.startedAt,
             // A read-only GET against the user's real checkout must never modify its index.
             intentToAdd: run.worktreePath ? undefined : false,
         });
@@ -2911,6 +3724,12 @@ export function createApp(deps) {
         if (!outcome.ok) {
             return c.json({ error: outcome.error, manual: `git merge ${run.branch}` }, 409);
         }
+        // A number the cockpit asked about BEFORE the pull request existed is cached as "this
+        // repository has no such number" — which is exactly what a `CEZ:PR=901` marker declared
+        // ahead of the push looks like. It exists now.
+        const createdNumber = refNumberFromUrl(outcome.url);
+        if (createdNumber !== null)
+            forgetRefStatus(repoRoot, createdNumber);
         store.updateRun(id, {
             pullRequestUrl: outcome.url,
             status: 'done',
@@ -3038,7 +3857,31 @@ export function createApp(deps) {
     });
     // ---- chained family: open-targets (project-scoped) ----
     const openTargetsRoutes = new Hono()
-        .get('/open-targets', (c) => c.json({ targets: capabilities().localHandoff ? detectOpenTargets() : [] }));
+        .get('/open-targets', (c) => c.json({ targets: capabilities().localHandoff ? detectOpenTargets() : [] }))
+        // Open the PROJECT ROOT itself (Settings → "Project folder" → Open with). The run route
+        // above opens a task worktree and needs a run to name one; this is the repo the cockpit is
+        // scoped to, which the scope middleware has already resolved — so no path is accepted from
+        // the client and there is nothing to contain.
+        .post('/open-in', jsonZodValidator(openProjectInSchema), async (c) => {
+        const { root } = c.get('project');
+        if (!capabilities().localHandoff) {
+            return c.json({ error: 'local handoff is disabled — this cockpit runs in hosted mode (CEZ_REMOTE)' }, 409);
+        }
+        const { target } = c.req.valid('json');
+        // Refused here rather than left to the menu, on the same principle as the accounts route:
+        // a `cli:<runner>` handoff would START AN AGENT in the checkout everything else runs in a
+        // worktree to protect. Which app APPLIES is a property of the route, not of one client.
+        if (agentCliRunner(target) !== null) {
+            return c.json({ error: 'agent CLIs open a task worktree, not the project folder' }, 400);
+        }
+        if (!detectOpenTargets().some((candidate) => candidate.id === target)) {
+            return c.json({ error: `no such app on this machine: ${target}` }, 400);
+        }
+        const opened = await openApp(target, root);
+        if (!opened)
+            return c.json({ error: `could not open ${target}`, path: root }, 409);
+        return c.json({ opened: true, path: root });
+    });
     // Agent screenshots — image blocks the run manager persisted out of tool
     // results (persistImage). `basename` pins reads inside the run's own dir.
     const IMAGE_TYPES = {
@@ -3140,6 +3983,9 @@ export function createApp(deps) {
         const id = c.req.param('id');
         const todo = c.get('todo');
         const parsed = { data: c.req.valid('json') };
+        if (agentModelsLocked(repoRoot) && parsed.data?.model?.trim()) {
+            return c.json({ error: AGENT_MODELS_LOCKED_ERROR }, 409);
+        }
         if (todo.startedTaskId)
             return c.json({ error: 'already started' }, 409);
         let task = todoTaskText(todo);
@@ -3182,14 +4028,28 @@ export function createApp(deps) {
     });
     // ---- chained family: SSE streams (project-scoped) ----
     const sseRoutes = new Hono()
-        .get('/runs/:id/events', (c) => {
-        const { store } = c.get('project');
-        const id = c.req.param('id');
+        .get('/runs/:id/events', paramZodValidator(runIdParamSchema), queryZodValidator(runEventsQuerySchema), async (c) => {
+        const { store, dataDir } = c.get('project');
+        const { id } = c.req.valid('param');
         if (!store.getRun(id))
             return c.json({ error: 'not found' }, 404);
+        const query = c.req.valid('query');
+        const eventsPath = join(dataDir, 'runs', `${id}.ndjson`);
+        if (query.cursor) {
+            try {
+                await validateLiveCursor(eventsPath, query.cursor);
+            }
+            catch (error) {
+                if (error instanceof HistoryCursorError)
+                    return c.json({ error: error.message }, error.status);
+                throw error;
+            }
+        }
+        const lastEventId = Number.parseInt(c.req.header('Last-Event-ID') ?? '', 10);
+        const requestedAfter = Math.max(query.afterSeq ?? 0, Number.isSafeInteger(lastEventId) && lastEventId >= 0 ? lastEventId : 0);
         return streamSSENoBuffer(c, async (stream) => {
             let replaying = true;
-            let maxSeq = 0;
+            let maxSeq = requestedAfter;
             const buffered = [];
             // One endpoint, two SSE event names: v1 lines stay `run-event` (the name
             // the legacy UI listened to — its default branch JSON-dumped unknown
@@ -3199,6 +4059,7 @@ export function createApp(deps) {
             // ride `ui-event`, which only v2-aware clients subscribe to.
             // EventSource ignores names it has no listener for.
             const writeEvent = (event) => stream.writeSSE({
+                id: String(event.seq),
                 event: isV2WireEventType(event.type) ? 'ui-event' : 'run-event',
                 data: JSON.stringify(event),
             });
@@ -3221,9 +4082,15 @@ export function createApp(deps) {
                 store.off('event', onEvent);
                 store.off('run', onRun);
             });
-            for (const event of store.readEvents(id)) {
-                maxSeq = Math.max(maxSeq, event.seq);
+            const replay = query.cursor
+                ? await readEventsAfterLiveCursor(eventsPath, query.cursor)
+                : { events: store.readEvents(id), boundarySeq: 0 };
+            maxSeq = Math.max(maxSeq, replay.boundarySeq);
+            for (const event of replay.events) {
+                if (event.seq <= maxSeq)
+                    continue;
                 await writeEvent(event);
+                maxSeq = event.seq;
             }
             replaying = false;
             for (const event of buffered) {
@@ -3400,6 +4267,21 @@ export function createApp(deps) {
     // would be in its temporal dead zone. (The schemas below are all read inside a handler, or
     // passed as a thunk, which defers them past that point.)
     const mergeNumberParams = z.object({ number: z.coerce.number().int().positive() });
+    /** A ref-status list: `null` means malformed (the caller answers 400), `[]` means "not asked
+     *  for". Absent and empty are the same request — neither names a number. */
+    const parseRefNumbers = (raw) => {
+        const parts = (raw ?? '').split(',').map((p) => p.trim()).filter(Boolean);
+        if (parts.length > GH_REF_STATUS_MAX)
+            return null;
+        const numbers = [];
+        for (const part of parts) {
+            const n = Number(part);
+            if (!Number.isInteger(n) || n <= 0 || String(n) !== part)
+                return null;
+            numbers.push(n);
+        }
+        return numbers;
+    };
     const prChangesParams = z.object({ number: z.coerce.number().int().positive().safe() });
     const prChangesQuery = z.object({ refresh: queryValue.refine((v) => v === undefined || v === '1') });
     const githubRoutes = new Hono()
@@ -3443,6 +4325,23 @@ export function createApp(deps) {
             numbers.push(n);
         }
         return c.json(await fetchGithubChecks(repoRoot, numbers));
+    })
+        // Batched status for the PR/issue chips a task table paints. Additive sibling of
+        // /github/checks and shaped like it: comma-separated positive integers, capped at
+        // GH_REF_STATUS_MAX per kind, malformed input is a 400, and an unreachable forge degrades in
+        // the payload. Unlike /github/checks BOTH keys are optional — a table may hold only issues —
+        // but at least one must name something, or the request asks for nothing.
+        .get('/github/ref-status', queryZodValidator(z.object({ prs: z.string().optional(), issues: z.string().optional() })), async (c) => {
+        const { root: repoRoot } = c.get('project');
+        const { prs, issues } = c.req.valid('query');
+        const parsedPrs = parseRefNumbers(prs);
+        const parsedIssues = parseRefNumbers(issues);
+        if (parsedPrs === null || parsedIssues === null)
+            return c.json({ error: 'invalid ref-status query' }, 400);
+        if (parsedPrs.length === 0 && parsedIssues.length === 0) {
+            return c.json({ error: 'missing prs or issues query' }, 400);
+        }
+        return c.json(await fetchGithubRefStatus(repoRoot, { prs: parsedPrs, issues: parsedIssues }));
     })
         .get('/github/prs/:number/merge-state', paramZodValidator(mergeNumberParams, { message: 'invalid pull request number' }), queryZodValidator(refreshQuery), async (c) => {
         const { root: repoRoot } = c.get('project');
@@ -3460,8 +4359,14 @@ export function createApp(deps) {
         if (!forge?.mergePR)
             return c.json({ error: 'GitHub merge is unavailable' }, 409);
         const result = await forge.mergePR(parsedNumber.data.number, body.data);
-        if (result.merged)
+        if (result.merged) {
+            // We just changed this pull request, so what the ref-status cache holds about it is now
+            // known-stale — and its TTL would keep every chip showing the PRE-merge status for up to
+            // a minute after the user watched this server merge it. Forget it; the next reader asks
+            // the forge, gets `merged`, and then stops polling it at all.
+            forgetRefStatus(repoRoot, parsedNumber.data.number);
             return c.json(result);
+        }
         return c.json({
             error: result.error,
             ...(result.code ? { code: result.code } : {}),
@@ -3595,29 +4500,44 @@ export function createApp(deps) {
     });
     // The Settings → Agents knobs in one read (R6 Step 1.5) — an ADDITIVE
     // sibling of PUT /api/config below; /api/health keeps its protected shape.
-    const configAnswer = (config) => ({
-        baseBranch: config.baseBranch ?? null,
-        defaultRunner: config.defaultRunner,
-        systemPrompt: config.systemPrompt ?? null,
-        defaultModels: config.defaultModels ?? {},
-        maxParallel: config.maxParallel,
-        memoryLimitMb: config.memoryLimitMb ?? null,
-        // Count-based worktree retention (#483): keep the last N finished worktrees
-        // on disk. 0 = unlimited. Always materialized (schema default 10).
-        worktreeRetention: config.worktreeRetention,
-        // Live title updates (task auto-naming spec): tri-state — null means "no
-        // config key, the CEZ_TITLE_UPDATES env default (ON) decides".
-        liveTitleUpdates: config.liveTitleUpdates ?? null,
-        // Optional review gate (#489): tri-state — null means "no config key, the
-        // CEZ_REVIEW_GATE env default (OFF) decides".
-        reviewGate: config.reviewGate ?? null,
-    });
+    const configAnswer = async (repoRoot, config) => {
+        const nativeModels = await readAgentModelDefaults(repoRoot);
+        const modelsLocked = agentModelsLocked(repoRoot);
+        return {
+            baseBranch: config.baseBranch ?? null,
+            defaultRunner: config.defaultRunner,
+            systemPrompt: config.systemPrompt ?? null,
+            // Native defaults seed each runner independently. A Cezar preset remains
+            // selectable unless the operator opts into the fixed-model policy.
+            defaultModels: modelsLocked
+                ? nativeModels
+                : { ...nativeModels, ...(config.defaultModels ?? {}) },
+            modelsLocked,
+            maxParallel: config.maxParallel,
+            memoryLimitMb: config.memoryLimitMb ?? null,
+            // Count-based worktree retention (#483): keep the last N finished worktrees
+            // on disk. 0 = unlimited. Always materialized (schema default 10).
+            worktreeRetention: config.worktreeRetention,
+            // Live title updates (task auto-naming spec): tri-state — null means "no
+            // config key, the CEZ_TITLE_UPDATES env default (ON) decides".
+            liveTitleUpdates: config.liveTitleUpdates ?? null,
+            // Optional review gate (#489): tri-state — null means "no config key, the
+            // CEZ_REVIEW_GATE env default (OFF) decides".
+            reviewGate: config.reviewGate ?? null,
+        };
+    };
     // ---- chained family: per-repo config (project-scoped) ----
     const configRoutes = new Hono()
-        .get('/config', async (c) => c.json(configAnswer(await loadConfig(c.get('project').root))))
+        .get('/config', async (c) => {
+        const repoRoot = c.get('project').root;
+        return c.json(await configAnswer(repoRoot, await loadConfig(repoRoot)));
+    })
         .put('/config', jsonZodValidator(() => setConfigSchema), async (c) => {
         const { root: repoRoot, dataDir } = c.get('project');
         const parsed = { data: c.req.valid('json') };
+        if (agentModelsLocked(repoRoot) && parsed.data.defaultModels !== undefined) {
+            return c.json({ error: AGENT_MODELS_LOCKED_ERROR }, 409);
+        }
         const configPath = join(dataDir, 'config.json');
         let raw = {};
         try {
@@ -3702,7 +4622,7 @@ export function createApp(deps) {
             return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
         }
         // Pre-R6 answer shape ({baseBranch, defaultRunner}) + additive R6 fields.
-        return c.json(configAnswer(await loadConfig(repoRoot)));
+        return c.json(await configAnswer(repoRoot, await loadConfig(repoRoot)));
     });
     // Set/clear the agents' config knobs (Settings → Agents; the Repo tab's
     // base-branch picker). Merges into the RAW config.json so user keys
@@ -3712,13 +4632,14 @@ export function createApp(deps) {
     const modelPresetSchema = z.string().trim().max(200).nullable().optional();
     const setConfigSchema = z.object({
         baseBranch: z.string().trim().min(1).max(200).nullable().optional(),
-        defaultRunner: z.enum(['claude', 'codex', 'opencode']).optional(),
+        defaultRunner: z.enum(RUNNER_IDS).optional(),
         systemPrompt: z.string().trim().max(20_000, 'must be at most 20000 characters').nullable().optional(),
         defaultModels: z
             .object({
             claude: modelPresetSchema,
             codex: modelPresetSchema,
             opencode: modelPresetSchema,
+            pi: modelPresetSchema,
         })
             .optional(),
         // Concurrency + memory guard (Settings → Resources). maxParallel clamps to
@@ -3819,6 +4740,147 @@ export function createApp(deps) {
         .route('/', repoRoutes)
         .route('/', configRoutes)
         .route('/', agentConfigRoutes);
+    // ---- chained family: the cross-project run index (workspace-level) -------
+    /**
+     * How many runs each project may contribute, newest first. The index is a FINDER, not a
+     * listing: past the newest couple of hundred per project you are looking for something the
+     * project's own Tasks table answers better, and every extra row is a DOM node the palette's
+     * filter walks on each keystroke. `truncated` names the projects this bit, so a consumer never
+     * has to pretend the list is complete.
+     */
+    const RUNS_INDEX_PER_PROJECT = 200;
+    /** `RunRecord` → the wire row. Optional keys are spread CONDITIONALLY: writing
+     *  `titleSummary: run.titleSummary` types a key as always-present that `JSON.stringify` then
+     *  drops when it is undefined, which is exactly the drift the parity guard fails on. */
+    /**
+     * Every number a run MENTIONS — a superset of what its chip will show.
+     *
+     * Deliberately not `taskReference()`'s rule: which of a run's references is displayed is the
+     * cockpit's decision (#407, #526), and re-deriving it here would be a second rule that drifts
+     * from the first. This feeds a CACHE READ, which costs nothing per number, so asking about one
+     * the client will not paint is free and asking about one it will is the whole point.
+     */
+    const mentionedReferenceNumbers = (run) => {
+        const numbers = [];
+        for (const url of [run.pullRequestUrl, run.referencedPullRequestUrl, run.referencedIssueUrl]) {
+            const number = url ? refNumberFromUrl(url) : null;
+            if (number !== null)
+                numbers.push(number);
+        }
+        for (const number of [run.prNumber, run.issueNumber, run.markerRefs?.pr, run.markerRefs?.issue]) {
+            if (typeof number === 'number' && Number.isInteger(number) && number > 0)
+                numbers.push(number);
+        }
+        return numbers;
+    };
+    const runIndexEntry = (projectId, run) => {
+        const usage = currentUsage(run.id);
+        return {
+            projectId,
+            id: run.id,
+            title: run.title,
+            ...(run.titleSummary !== undefined ? { titleSummary: run.titleSummary } : {}),
+            ...(run.titleOrigin !== undefined ? { titleOrigin: run.titleOrigin } : {}),
+            status: run.status,
+            ...(run.activity !== undefined ? { activity: run.activity } : {}),
+            createdAt: run.createdAt,
+            ...(run.finishedAt !== undefined ? { finishedAt: run.finishedAt } : {}),
+            ...(run.seenAt !== undefined ? { seenAt: run.seenAt } : {}),
+            archived: run.archived,
+            ...(run.autoResumeAt !== undefined ? { autoResumeAt: run.autoResumeAt } : {}),
+            workflow: run.workflow,
+            ...(run.branch !== undefined ? { branch: run.branch } : {}),
+            ...(run.startedAt !== undefined ? { startedAt: run.startedAt } : {}),
+            // The tracker-reference inputs, verbatim — the cockpit's `taskReference()` owns the rule
+            // that picks between them (see the schema's note).
+            ...(run.pullRequestUrl !== undefined ? { pullRequestUrl: run.pullRequestUrl } : {}),
+            ...(run.referencedPullRequestUrl !== undefined
+                ? { referencedPullRequestUrl: run.referencedPullRequestUrl }
+                : {}),
+            ...(run.prNumber !== undefined ? { prNumber: run.prNumber } : {}),
+            ...(run.issueNumber !== undefined ? { issueNumber: run.issueNumber } : {}),
+            ...(run.referencedIssueUrl !== undefined ? { referencedIssueUrl: run.referencedIssueUrl } : {}),
+            ...(run.markerRefs !== undefined ? { markerRefs: run.markerRefs } : {}),
+            ...(run.costUsd !== undefined ? { costUsd: run.costUsd } : {}),
+            ...(run.peakRssBytes !== undefined ? { peakRssBytes: run.peakRssBytes } : {}),
+            ...(run.peakProcCount !== undefined ? { peakProcCount: run.peakProcCount } : {}),
+            // The live sample, on the same terms as `GET /runs`: process-wide sampler, so a
+            // workspace-level answer can carry it for every project's runs at once.
+            ...(usage ? { usage } : {}),
+        };
+    };
+    /**
+     * `GET /workspace/runs-index` — every registered project's recent tasks in one slim answer, so
+     * ⌘K can find a task without knowing which project it lives in.
+     *
+     * Workspace-level and single-mount for the obvious reason: a project-scoped spelling of "all
+     * projects" is a contradiction. The per-project source is chosen the same way the automation
+     * coordinator's boot fan-out chooses it (`bootContext` for the boot project, `contexts.peek`
+     * for anything this process already owns, disk otherwise) — and never `contexts.context()`,
+     * which would build a context, prune worktrees and `recover()` running agents. Typing in a
+     * search box must not resume work; see `runs/run-index.ts`.
+     */
+    const runsIndexRoutes = new Hono()
+        .get('/workspace/runs-index', async (c) => {
+        let projects = [];
+        try {
+            const selector = capabilities().singleProject
+                ? { projectId: await resolveBootProject() }
+                : undefined;
+            projects = await listProjects(selector);
+        }
+        catch {
+            // unreadable workspace — an empty index, never a 500. The palette degrades to the
+            // active project's own run list, which it holds either way.
+        }
+        const bootId = await resolveBootProject(projects);
+        const runs = [];
+        const truncated = [];
+        // Statuses the server already holds, shipped WITH the rows that carry the references. The
+        // cockpit would otherwise ask for them a beat after the table paints — one round trip per
+        // project, and a visible flash of un-coloured chips before it lands. Cache-only, so this
+        // never touches `gh` and never slows the index down; anything cold stays absent and the
+        // lazy `/github/ref-status` route fills it in.
+        const referenceStatuses = {};
+        for (const project of projects) {
+            // No folder, no runs to read. `not-git` still has an `.ai/cezar` worth indexing.
+            if (project.status === 'missing')
+                continue;
+            const owned = project.id === bootId ? bootContext : contexts.peek(project.id);
+            // `listRuns()` already sorts newest-first; the disk reader returns file order, so both
+            // paths get sorted below rather than trusting either.
+            //
+            // Archived runs are INCLUDED. The active project's rows reach the palette through
+            // `GET /runs`, which has always carried them, and excluding them here would mean a task
+            // is findable while you stand in its project and vanishes the moment you leave — the
+            // exact asymmetry a cross-project finder exists to remove.
+            const recent = (owned ? owned.store.listRuns() : readRunIndexFromDisk(join(project.root, '.ai/cezar'))).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+            if (recent.length > RUNS_INDEX_PER_PROJECT)
+                truncated.push(project.id);
+            const mentioned = [];
+            for (const run of recent.slice(0, RUNS_INDEX_PER_PROJECT)) {
+                runs.push(runIndexEntry(project.id, run));
+                mentioned.push(...mentionedReferenceNumbers(run));
+            }
+            if (mentioned.length > 0) {
+                const cached = readCachedRefStatuses(project.root, mentioned);
+                // Only when something was actually warm. A project key holding two empty maps is noise
+                // that every consumer would have to look past, and it would blur the one rule this
+                // payload has: absent means nothing is known.
+                if (Object.keys(cached.prs).length > 0 || Object.keys(cached.issues).length > 0) {
+                    referenceStatuses[project.id] = cached;
+                }
+            }
+        }
+        runs.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+        const body = {
+            runs,
+            perProjectLimit: RUNS_INDEX_PER_PROJECT,
+            truncated,
+            referenceStatuses,
+        };
+        return c.json(body);
+    });
     // Workspace-level families answer for the whole workspace, so they are single-mount: never a
     // project-scoped spelling, which would be a second surface to protect with no consumer.
     const workspaceV1 = new Hono()
@@ -3826,10 +4888,12 @@ export function createApp(deps) {
         .route('/', modelsRoutes)
         .route('/', providersRoutes)
         .route('/', projectsRoutes)
+        .route('/', agentProfilesRoutes)
         .route('/', skillsUpdateRoutes)
         .route('/', workspaceConfigRoutes)
         .route('/', fsBrowseRoutes)
         .route('/', automationChecksRoutes)
+        .route('/', runsIndexRoutes)
         .route('/', workspaceEventsRoutes);
     // ---- mount ---------------------------------------------------------------
     // Scoped first, then the unscoped alias bound to the boot project. The paths are disjoint (no
@@ -3870,6 +4934,11 @@ export function startServer(deps, port) {
         semaphore: deps.semaphore,
         automationStore: (projectId, root) => automationCoordinator.store(projectId, root),
     });
+    // #801: GitHub automations are opt-in. Off, the flag must remove the BEHAVIOR and not merely
+    // the UI — no scheduler, no GitHub polling, no launched runs — so every entry point into the
+    // workspace scheduler below is gated on it. Read per call rather than captured, for the same
+    // reason `capabilities()` is inside `createApp`: tests flip the variable between apps.
+    const automationsEnabled = () => resolveCapabilities(process.env, deps.bindHost).automations;
     let rescheduleAutomations = () => { };
     const app = createApp({
         ...deps,
@@ -3922,7 +4991,14 @@ export function startServer(deps, port) {
             };
         },
     });
-    rescheduleAutomations = () => { void automationScheduler.reschedule(); };
+    // The scheduler is inert until `start()` anyway (it constructs `stopped`), but the gate is
+    // stated here rather than inherited from that detail: a definition saved while the flag is off
+    // must not even ask the coordinator to refresh.
+    rescheduleAutomations = () => {
+        if (!automationsEnabled())
+            return;
+        void automationScheduler.reschedule();
+    };
     const unsubscribe = workspaceEvents.on((event, data) => {
         if (event === 'project-added') {
             const project = data.project;
@@ -3932,7 +5008,7 @@ export function startServer(deps, port) {
                     const parsed = parseRemote(info?.remote ?? '');
                     if (parsed?.host === 'github.com')
                         automationProjects.set(project.id, { root: project.root, owner: parsed.owner, repo: parsed.repo });
-                    return automationScheduler.reschedule();
+                    return rescheduleAutomations();
                 });
             }
         }
@@ -3943,7 +5019,7 @@ export function startServer(deps, port) {
             if (typeof id === 'string') {
                 automationCoordinator.remove(id);
                 automationProjects.delete(id);
-                void automationScheduler.reschedule();
+                rescheduleAutomations();
             }
         }
     });
@@ -3952,6 +5028,11 @@ export function startServer(deps, port) {
             const all = projects.some((project) => project.root === deps.repoRoot)
                 ? projects : [{ id: deps.bootProjectId ?? 'default', root: deps.repoRoot, status: 'ok' }, ...projects];
             coordinator.start(all);
+            // #801: with automations off there is nothing to warm — no remote to resolve, no receipts
+            // to reconcile, and above all no scheduler to start. The skills-update coordinator above is
+            // a separate feature and starts either way.
+            if (!automationsEnabled())
+                return;
             void Promise.all(all.map(async (project) => {
                 const parsed = parseRemote((await getRepoInfo(project.root))?.remote ?? '');
                 if (parsed?.host === 'github.com')
@@ -4121,6 +5202,8 @@ export function resumeCommand(runner, sessionId) {
             return `codex resume ${sessionId}`;
         case 'opencode':
             return `opencode --session ${sessionId}`;
+        case 'pi':
+            return `pi --session ${sessionId}`;
         default:
             return `claude --resume ${sessionId}`;
     }