npm - @osfactory/har - Versions diffs - 0.20.0 → 0.22.0 - Mend

@osfactory/har 0.20.0 → 0.22.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/README.md +14 -0
package/dist/index.js +1140 -529
package/dist/templates/agent-skills/har-wt.md +11 -0
package/dist/templates/har-boilerplate/agent-slot.sh +3 -1
package/dist/templates/har-boilerplate/gitignore.template +3 -0
package/dist/templates/har-boilerplate/launch.sh +10 -0
package/dist/templates/har-boilerplate-cli/agent-slot.sh +3 -1
package/dist/templates/har-boilerplate-cli/gitignore.template +3 -0
package/dist/templates/har-boilerplate-cli/launch.sh +10 -0
package/dist/templates/har-boilerplate-ios/agent-slot.sh +3 -1
package/dist/templates/har-boilerplate-ios/gitignore.template +3 -0
package/dist/templates/har-boilerplate-ios/launch.sh +10 -0
package/package.json +1 -1

package/dist/index.js CHANGED Viewed

@@ -765,14 +765,14 @@ var require_url_state_machine = __commonJS({
       return url.replace(/\u0009|\u000A|\u000D/g, "");
     }
     function shortenPath(url) {
-      const path52 = url.path;
-      if (path52.length === 0) {
+      const path54 = url.path;
+      if (path54.length === 0) {
         return;
       }
-      if (url.scheme === "file" && path52.length === 1 && isNormalizedWindowsDriveLetter(path52[0])) {
+      if (url.scheme === "file" && path54.length === 1 && isNormalizedWindowsDriveLetter(path54[0])) {
         return;
       }
-      path52.pop();
+      path54.pop();
     }
     function includesCredentials(url) {
       return url.username !== "" || url.password !== "";
@@ -1811,7 +1811,7 @@ var require_lib2 = __commonJS({
       return ex && typeof ex === "object" && "default" in ex ? ex["default"] : ex;
     }
     var Stream2 = _interopDefault(require("stream"));
-    var http = _interopDefault(require("http"));
+    var http2 = _interopDefault(require("http"));
     var Url = _interopDefault(require("url"));
     var whatwgUrl = _interopDefault(require_public_api());
     var https = _interopDefault(require("https"));
@@ -2092,7 +2092,7 @@ var require_lib2 = __commonJS({
       let accum = [];
       let accumBytes = 0;
       let abort = false;
-      return new Body.Promise(function(resolve37, reject) {
+      return new Body.Promise(function(resolve38, reject) {
         let resTimeout;
         if (_this4.timeout) {
           resTimeout = setTimeout(function() {
@@ -2126,7 +2126,7 @@ var require_lib2 = __commonJS({
           }
           clearTimeout(resTimeout);
           try {
-            resolve37(Buffer.concat(accum, accumBytes));
+            resolve38(Buffer.concat(accum, accumBytes));
           } catch (err) {
             reject(new FetchError(`Could not create Buffer from response body for ${_this4.url}: ${err.message}`, "system", err));
           }
@@ -2551,7 +2551,7 @@ var require_lib2 = __commonJS({
       return headers;
     }
     var INTERNALS$1 = Symbol("Response internals");
-    var STATUS_CODES = http.STATUS_CODES;
+    var STATUS_CODES = http2.STATUS_CODES;
     var Response3 = class _Response {
       constructor() {
         let body = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : null;
@@ -2801,10 +2801,10 @@ var require_lib2 = __commonJS({
         throw new Error("native promise missing, set fetch.Promise to your favorite alternative");
       }
       Body.Promise = fetch3.Promise;
-      return new fetch3.Promise(function(resolve37, reject) {
+      return new fetch3.Promise(function(resolve38, reject) {
         const request = new Request3(url, opts);
         const options = getNodeRequestOptions(request);
-        const send = (options.protocol === "https:" ? https : http).request;
+        const send = (options.protocol === "https:" ? https : http2).request;
         const signal = request.signal;
         let response = null;
         const abort = function abort2() {
@@ -2934,7 +2934,7 @@ var require_lib2 = __commonJS({
                   requestOpts.body = void 0;
                   requestOpts.headers.delete("content-length");
                 }
-                resolve37(fetch3(new Request3(locationURL, requestOpts)));
+                resolve38(fetch3(new Request3(locationURL, requestOpts)));
                 finalize();
                 return;
             }
@@ -2955,7 +2955,7 @@ var require_lib2 = __commonJS({
           const codings = headers.get("Content-Encoding");
           if (!request.compress || request.method === "HEAD" || codings === null || res.statusCode === 204 || res.statusCode === 304) {
             response = new Response3(body, response_options);
-            resolve37(response);
+            resolve38(response);
             return;
           }
           const zlibOptions = {
@@ -2965,7 +2965,7 @@ var require_lib2 = __commonJS({
           if (codings == "gzip" || codings == "x-gzip") {
             body = body.pipe(zlib.createGunzip(zlibOptions));
             response = new Response3(body, response_options);
-            resolve37(response);
+            resolve38(response);
             return;
           }
           if (codings == "deflate" || codings == "x-deflate") {
@@ -2977,12 +2977,12 @@ var require_lib2 = __commonJS({
                 body = body.pipe(zlib.createInflateRaw());
               }
               response = new Response3(body, response_options);
-              resolve37(response);
+              resolve38(response);
             });
             raw.on("end", function() {
               if (!response) {
                 response = new Response3(body, response_options);
-                resolve37(response);
+                resolve38(response);
               }
             });
             return;
@@ -2990,11 +2990,11 @@ var require_lib2 = __commonJS({
           if (codings == "br" && typeof zlib.createBrotliDecompress === "function") {
             body = body.pipe(zlib.createBrotliDecompress());
             response = new Response3(body, response_options);
-            resolve37(response);
+            resolve38(response);
             return;
           }
           response = new Response3(body, response_options);
-          resolve37(response);
+          resolve38(response);
         });
         writeToStream(req, request);
       });
@@ -6351,14 +6351,14 @@ __export(fileFromPath_exports, {
   fileFromPathSync: () => fileFromPathSync,
   isFile: () => isFile
 });
-function createFileFromPath(path52, { mtimeMs, size }, filenameOrOptions, options = {}) {
+function createFileFromPath(path54, { mtimeMs, size }, filenameOrOptions, options = {}) {
   let filename;
   if (isPlainObject_default2(filenameOrOptions)) {
     [options, filename] = [filenameOrOptions, void 0];
   } else {
     filename = filenameOrOptions;
   }
-  const file = new FileFromPath({ path: path52, size, lastModified: mtimeMs });
+  const file = new FileFromPath({ path: path54, size, lastModified: mtimeMs });
   if (!filename) {
     filename = file.name;
   }
@@ -6367,13 +6367,13 @@ function createFileFromPath(path52, { mtimeMs, size }, filenameOrOptions, option
     lastModified: file.lastModified
   });
 }
-function fileFromPathSync(path52, filenameOrOptions, options = {}) {
-  const stats = (0, import_fs5.statSync)(path52);
-  return createFileFromPath(path52, stats, filenameOrOptions, options);
+function fileFromPathSync(path54, filenameOrOptions, options = {}) {
+  const stats = (0, import_fs5.statSync)(path54);
+  return createFileFromPath(path54, stats, filenameOrOptions, options);
 }
-async function fileFromPath2(path52, filenameOrOptions, options) {
-  const stats = await import_fs5.promises.stat(path52);
-  return createFileFromPath(path52, stats, filenameOrOptions, options);
+async function fileFromPath2(path54, filenameOrOptions, options) {
+  const stats = await import_fs5.promises.stat(path54);
+  return createFileFromPath(path54, stats, filenameOrOptions, options);
 }
 var import_fs5, import_path5, import_node_domexception, __classPrivateFieldSet5, __classPrivateFieldGet6, _FileFromPath_path, _FileFromPath_start, MESSAGE, FileFromPath;
 var init_fileFromPath = __esm({
@@ -6433,6 +6433,44 @@ var init_fileFromPath = __esm({
   }
 });
+// src/core/portal-credentials.ts
+function portalCredentialsPath() {
+  if (process.env.HAR_CREDENTIALS_PATH) {
+    return path25.resolve(process.env.HAR_CREDENTIALS_PATH);
+  }
+  return path25.join(os4.homedir(), ".har", "credentials.json");
+}
+function readPortalCredentials() {
+  try {
+    const raw = fs26.readFileSync(portalCredentialsPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed.portalUrl || !parsed.token) return null;
+    return {
+      portalUrl: parsed.portalUrl,
+      token: parsed.token,
+      workspace: parsed.workspace,
+      createdAt: parsed.createdAt ?? ""
+    };
+  } catch {
+    return null;
+  }
+}
+function writePortalCredentials(creds) {
+  const file = portalCredentialsPath();
+  fs26.mkdirSync(path25.dirname(file), { recursive: true });
+  fs26.writeFileSync(file, JSON.stringify(creds, null, 2), { mode: 384 });
+  fs26.chmodSync(file, 384);
+}
+var fs26, os4, path25;
+var init_portal_credentials = __esm({
+  "src/core/portal-credentials.ts"() {
+    "use strict";
+    fs26 = __toESM(require("fs"));
+    os4 = __toESM(require("os"));
+    path25 = __toESM(require("path"));
+  }
+});
 // src/core/control-config.ts
 function getControlApiUrl() {
   return process.env.HAR_CONTROL_API_URL ?? DEFAULT_CONTROL_API_URL;
@@ -6440,10 +6478,33 @@ function getControlApiUrl() {
 function isControlEnabled() {
   return process.env.HAR_CONTROL_DISABLED !== "true";
 }
+function normalizeUrl(url) {
+  return url.replace(/\/+$/, "");
+}
+function getPortalTarget() {
+  if (process.env.HAR_PORTAL_URL && process.env.HAR_PORTAL_TOKEN) {
+    return {
+      url: normalizeUrl(process.env.HAR_PORTAL_URL),
+      token: process.env.HAR_PORTAL_TOKEN
+    };
+  }
+  const stored = readPortalCredentials();
+  if (stored) {
+    return { url: normalizeUrl(stored.portalUrl), token: stored.token };
+  }
+  if (process.env.HAR_CLOUD_API_URL && process.env.HAR_CLOUD_API_KEY) {
+    return {
+      url: normalizeUrl(process.env.HAR_CLOUD_API_URL),
+      token: process.env.HAR_CLOUD_API_KEY
+    };
+  }
+  return null;
+}
 var DEFAULT_CONTROL_API_URL;
 var init_control_config = __esm({
   "src/core/control-config.ts"() {
     "use strict";
+    init_portal_credentials();
     DEFAULT_CONTROL_API_URL = "http://localhost:3847";
   }
 });
@@ -6451,9 +6512,9 @@ var init_control_config = __esm({
 // src/core/telemetry-config.ts
 function getPreferencePath() {
   if (process.env.HAR_TELEMETRY_CONFIG_PATH) {
-    return path35.resolve(process.env.HAR_TELEMETRY_CONFIG_PATH);
+    return path37.resolve(process.env.HAR_TELEMETRY_CONFIG_PATH);
   }
-  return path35.join(os9.homedir(), ".har", "telemetry.json");
+  return path37.join(os10.homedir(), ".har", "telemetry.json");
 }
 function parseEnvOverride(raw) {
   if (raw === void 0 || raw === "") return void 0;
@@ -6474,10 +6535,10 @@ function normalizeSignals(enabled, raw) {
 function readTelemetryPreference() {
   const preferencePath = getPreferencePath();
   try {
-    if (!fs35.existsSync(preferencePath)) {
+    if (!fs37.existsSync(preferencePath)) {
       return { enabled: true, signals: { ...DEFAULT_SIGNALS_ON } };
     }
-    const parsed = JSON.parse(fs35.readFileSync(preferencePath, "utf8"));
+    const parsed = JSON.parse(fs37.readFileSync(preferencePath, "utf8"));
     const enabled = parsed.enabled !== false;
     return {
       enabled,
@@ -6500,8 +6561,8 @@ function writeTelemetryPreference(enabled, signals2) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   const preferencePath = getPreferencePath();
-  fs35.mkdirSync(path35.dirname(preferencePath), { recursive: true });
-  fs35.writeFileSync(preferencePath, JSON.stringify(preference, null, 2) + "\n");
+  fs37.mkdirSync(path37.dirname(preferencePath), { recursive: true });
+  fs37.writeFileSync(preferencePath, JSON.stringify(preference, null, 2) + "\n");
   return preference;
 }
 function isTelemetryEnabled() {
@@ -6516,13 +6577,13 @@ function getTelemetrySignals() {
 function getTelemetryPreferencePath() {
   return getPreferencePath();
 }
-var fs35, os9, path35, DEFAULT_SIGNALS_ON, DEFAULT_SIGNALS_OFF, TELEMETRY_SIGNALS;
+var fs37, os10, path37, DEFAULT_SIGNALS_ON, DEFAULT_SIGNALS_OFF, TELEMETRY_SIGNALS;
 var init_telemetry_config = __esm({
   "src/core/telemetry-config.ts"() {
     "use strict";
-    fs35 = __toESM(require("fs"));
-    os9 = __toESM(require("os"));
-    path35 = __toESM(require("path"));
+    fs37 = __toESM(require("fs"));
+    os10 = __toESM(require("os"));
+    path37 = __toESM(require("path"));
     DEFAULT_SIGNALS_ON = {
       metrics: true,
       logs: true,
@@ -6563,15 +6624,15 @@ __export(otel_hooks_exports, {
 });
 function getOtelHooksHome() {
   if (process.env.HAR_OTEL_HOOKS_HOME) {
-    return path41.resolve(process.env.HAR_OTEL_HOOKS_HOME);
+    return path43.resolve(process.env.HAR_OTEL_HOOKS_HOME);
   }
-  return path41.join(os12.homedir(), ".har", "otel-hooks");
+  return path43.join(os13.homedir(), ".har", "otel-hooks");
 }
 function getOtelHooksConfigPath(hooksHome = getOtelHooksHome()) {
-  return path41.join(hooksHome, "otel_config.json");
+  return path43.join(hooksHome, "otel_config.json");
 }
 function getOtelHooksWrapperPath(hooksHome = getOtelHooksHome()) {
-  return path41.join(hooksHome, "run-otel-hook.sh");
+  return path43.join(hooksHome, "run-otel-hook.sh");
 }
 function buildOtelHooksConfig(options) {
   const enabled = options?.enabled ?? isTelemetryEnabled();
@@ -6590,18 +6651,18 @@ function buildOtelHooksConfig(options) {
   };
 }
 function writeOtelHooksConfig(config2, hooksHome = getOtelHooksHome()) {
-  fs39.mkdirSync(hooksHome, { recursive: true });
+  fs41.mkdirSync(hooksHome, { recursive: true });
   const configPath = getOtelHooksConfigPath(hooksHome);
   const payload = {
     _comment: "Managed by har telemetry \u2014 do not edit by hand; use: har telemetry on|off",
     ...config2
   };
-  fs39.writeFileSync(configPath, `${JSON.stringify(payload, null, 2)}
+  fs41.writeFileSync(configPath, `${JSON.stringify(payload, null, 2)}
 `);
   return configPath;
 }
 function writeOtelHooksWrapper(otelHookCommand, hooksHome = getOtelHooksHome()) {
-  fs39.mkdirSync(hooksHome, { recursive: true });
+  fs41.mkdirSync(hooksHome, { recursive: true });
   const wrapperPath = getOtelHooksWrapperPath(hooksHome);
   const script = `#!/usr/bin/env bash
 # Managed by har telemetry \u2014 invokes opentelemetry-hooks with HAR config home.
@@ -6609,9 +6670,9 @@ set -euo pipefail
 export IDE_OTEL_HOOK_HOME="${hooksHome}"
 exec "${otelHookCommand}" "$@"
 `;
-  fs39.writeFileSync(wrapperPath, script, { mode: 493 });
+  fs41.writeFileSync(wrapperPath, script, { mode: 493 });
   try {
-    fs39.chmodSync(wrapperPath, 493);
+    fs41.chmodSync(wrapperPath, 493);
   } catch {
   }
   return wrapperPath;
@@ -6691,10 +6752,10 @@ function runSetupAgent(agent, otelHookCommand, hooksHome) {
   };
 }
 function rewriteHookCommandsToWrapper(filePath, wrapperPath) {
-  if (!fs39.existsSync(filePath)) return false;
+  if (!fs41.existsSync(filePath)) return false;
   let raw;
   try {
-    raw = fs39.readFileSync(filePath, "utf8");
+    raw = fs41.readFileSync(filePath, "utf8");
   } catch {
     return false;
   }
@@ -6733,16 +6794,16 @@ function rewriteHookCommandsToWrapper(filePath, wrapperPath) {
     return changed;
   };
   if (!walk(parsed)) return false;
-  fs39.writeFileSync(filePath, `${JSON.stringify(parsed, null, 2)}
+  fs41.writeFileSync(filePath, `${JSON.stringify(parsed, null, 2)}
 `);
   return true;
 }
 function rewriteKnownHookRegistrations(wrapperPath) {
-  const home = os12.homedir();
+  const home = os13.homedir();
   const candidates = [
-    path41.join(home, ".cursor", "hooks.json"),
-    path41.join(home, ".claude", "settings.json"),
-    path41.join(home, ".codex", "hooks.json")
+    path43.join(home, ".cursor", "hooks.json"),
+    path43.join(home, ".claude", "settings.json"),
+    path43.join(home, ".codex", "hooks.json")
   ];
   for (const filePath of candidates) {
     try {
@@ -6755,7 +6816,7 @@ function ensureOtelHooks(options) {
   const hooksHome = getOtelHooksHome();
   const errors = [];
   const agentsSetup = [];
-  fs39.mkdirSync(hooksHome, { recursive: true });
+  fs41.mkdirSync(hooksHome, { recursive: true });
   let otelHookCommand = resolveOtelHookCommand();
   if (!otelHookCommand) {
     const installed = tryInstallPackage();
@@ -6824,14 +6885,14 @@ function ensureOtelHooks(options) {
 function disableOtelHooksExport() {
   return writeOtelHooksConfig(buildOtelHooksConfig({ enabled: false }));
 }
-var import_child_process9, fs39, os12, path41, OTEL_HOOKS_PACKAGE, OTEL_HOOKS_AGENTS;
+var import_child_process9, fs41, os13, path43, OTEL_HOOKS_PACKAGE, OTEL_HOOKS_AGENTS;
 var init_otel_hooks = __esm({
   "src/core/otel-hooks.ts"() {
     "use strict";
     import_child_process9 = require("child_process");
-    fs39 = __toESM(require("fs"));
-    os12 = __toESM(require("os"));
-    path41 = __toESM(require("path"));
+    fs41 = __toESM(require("fs"));
+    os13 = __toESM(require("os"));
+    path43 = __toESM(require("path"));
     init_control_config();
     init_telemetry_config();
     OTEL_HOOKS_PACKAGE = "opentelemetry-hooks==0.14.0";
@@ -9790,7 +9851,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve37.call(this, root, ref);
+      let _sch = resolve38.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -9817,7 +9878,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve37(root, ref) {
+    function resolve38(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -10035,8 +10096,8 @@ var require_utils2 = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path52) {
-      let input = path52;
+    function removeDotSegments(path54) {
+      let input = path54;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -10288,8 +10349,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path52, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path52 && path52 !== "/" ? path52 : void 0;
+        const [path54, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path54 && path54 !== "/" ? path54 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -10348,7 +10409,7 @@ var require_schemes = __commonJS({
       urnComponent.nss = (uuidComponent.uuid || "").toLowerCase();
       return urnComponent;
     }
-    var http = (
+    var http2 = (
       /** @type {SchemeHandler} */
       {
         scheme: "http",
@@ -10361,7 +10422,7 @@ var require_schemes = __commonJS({
       /** @type {SchemeHandler} */
       {
         scheme: "https",
-        domainHost: http.domainHost,
+        domainHost: http2.domainHost,
         parse: httpParse,
         serialize: httpSerialize
       }
@@ -10405,7 +10466,7 @@ var require_schemes = __commonJS({
     var SCHEMES = (
       /** @type {Record<SchemeName, SchemeHandler>} */
       {
-        http,
+        http: http2,
         https,
         ws,
         wss,
@@ -10448,7 +10509,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve37(baseURI, relativeURI, options) {
+    function resolve38(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -10706,7 +10767,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize: normalize3,
-      resolve: resolve37,
+      resolve: resolve38,
       resolveComponent,
       equal,
       serialize,
@@ -13682,12 +13743,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f2;
     };
-    function addFormats(ajv, list, fs44, exportName) {
+    function addFormats(ajv, list, fs46, exportName) {
       var _a3;
       var _b2;
       (_a3 = (_b2 = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b2.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f2 of list)
-        ajv.addFormat(f2, fs44[f2]);
+        ajv.addFormat(f2, fs46[f2]);
     }
     module2.exports = exports2 = formatsPlugin;
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -14787,15 +14848,15 @@ var require_route = __commonJS({
       };
     }
     function wrapConversion(toModel, graph) {
-      const path52 = [graph[toModel].parent, toModel];
+      const path54 = [graph[toModel].parent, toModel];
       let fn = conversions[graph[toModel].parent][toModel];
       let cur = graph[toModel].parent;
       while (graph[cur].parent) {
-        path52.unshift(graph[cur].parent);
+        path54.unshift(graph[cur].parent);
         fn = link(conversions[graph[cur].parent][cur], fn);
         cur = graph[cur].parent;
       }
-      fn.conversion = path52;
+      fn.conversion = path54;
       return fn;
     }
     module2.exports = function(fromModel) {
@@ -20725,7 +20786,7 @@ var require_iso2022 = __commonJS({
 // node_modules/chardet/index.js
 var require_chardet = __commonJS({
   "node_modules/chardet/index.js"(exports2, module2) {
-    var fs44 = require("fs");
+    var fs46 = require("fs");
     var utf8 = require_utf8();
     var unicode = require_unicode();
     var mbcs = require_mbcs();
@@ -20799,28 +20860,28 @@ var require_chardet = __commonJS({
       var fd;
       var handler = function(err, buffer) {
         if (fd) {
-          fs44.closeSync(fd);
+          fs46.closeSync(fd);
         }
         if (err) return cb(err, null);
         cb(null, self.detect(buffer, opts));
       };
       if (opts && opts.sampleSize) {
-        fd = fs44.openSync(filepath, "r"), sample = Buffer.allocUnsafe(opts.sampleSize);
-        fs44.read(fd, sample, 0, opts.sampleSize, null, function(err) {
+        fd = fs46.openSync(filepath, "r"), sample = Buffer.allocUnsafe(opts.sampleSize);
+        fs46.read(fd, sample, 0, opts.sampleSize, null, function(err) {
           handler(err, sample);
         });
         return;
       }
-      fs44.readFile(filepath, handler);
+      fs46.readFile(filepath, handler);
     };
     module2.exports.detectFileSync = function(filepath, opts) {
       if (opts && opts.sampleSize) {
-        var fd = fs44.openSync(filepath, "r"), sample2 = Buffer.allocUnsafe(opts.sampleSize);
-        fs44.readSync(fd, sample2, 0, opts.sampleSize);
-        fs44.closeSync(fd);
+        var fd = fs46.openSync(filepath, "r"), sample2 = Buffer.allocUnsafe(opts.sampleSize);
+        fs46.readSync(fd, sample2, 0, opts.sampleSize);
+        fs46.closeSync(fd);
         return self.detect(sample2, opts);
       }
-      return self.detect(fs44.readFileSync(filepath), opts);
+      return self.detect(fs46.readFileSync(filepath), opts);
     };
     module2.exports.detectAll = function(buffer, opts) {
       if (typeof opts !== "object") {
@@ -24285,16 +24346,16 @@ var require_os_tmpdir = __commonJS({
     var isWindows = process.platform === "win32";
     var trailingSlashRe = isWindows ? /[^:]\\$/ : /.\/$/;
     module2.exports = function() {
-      var path52;
+      var path54;
       if (isWindows) {
-        path52 = process.env.TEMP || process.env.TMP || (process.env.SystemRoot || process.env.windir) + "\\temp";
+        path54 = process.env.TEMP || process.env.TMP || (process.env.SystemRoot || process.env.windir) + "\\temp";
       } else {
-        path52 = process.env.TMPDIR || process.env.TMP || process.env.TEMP || "/tmp";
+        path54 = process.env.TMPDIR || process.env.TMP || process.env.TEMP || "/tmp";
       }
-      if (trailingSlashRe.test(path52)) {
-        path52 = path52.slice(0, -1);
+      if (trailingSlashRe.test(path54)) {
+        path54 = path54.slice(0, -1);
       }
-      return path52;
+      return path54;
     };
   }
 });
@@ -24302,9 +24363,9 @@ var require_os_tmpdir = __commonJS({
 // node_modules/tmp/lib/tmp.js
 var require_tmp = __commonJS({
   "node_modules/tmp/lib/tmp.js"(exports2, module2) {
-    var fs44 = require("fs");
-    var path52 = require("path");
-    var crypto4 = require("crypto");
+    var fs46 = require("fs");
+    var path54 = require("path");
+    var crypto6 = require("crypto");
     var osTmpDir = require_os_tmpdir();
     var _c2 = process.binding("constants");
     var tmpDir = osTmpDir();
@@ -24322,9 +24383,9 @@ var require_tmp = __commonJS({
     function _randomChars(howMany) {
       var value = [], rnd = null;
       try {
-        rnd = crypto4.randomBytes(howMany);
+        rnd = crypto6.randomBytes(howMany);
       } catch (e2) {
-        rnd = crypto4.pseudoRandomBytes(howMany);
+        rnd = crypto6.pseudoRandomBytes(howMany);
       }
       for (var i2 = 0; i2 < howMany; i2++) {
         value.push(RANDOM_CHARS[rnd[i2] % RANDOM_CHARS.length]);
@@ -24345,7 +24406,7 @@ var require_tmp = __commonJS({
     }
     function _generateTmpName(opts) {
       if (opts.name) {
-        return path52.join(opts.dir || tmpDir, opts.name);
+        return path54.join(opts.dir || tmpDir, opts.name);
       }
       if (opts.template) {
         return opts.template.replace(TEMPLATE_PATTERN, _randomChars(6));
@@ -24356,7 +24417,7 @@ var require_tmp = __commonJS({
         _randomChars(12),
         opts.postfix || ""
       ].join("");
-      return path52.join(opts.dir || tmpDir, name);
+      return path54.join(opts.dir || tmpDir, name);
     }
     function tmpName(options, callback) {
       var args = _parseArguments(options, callback), opts = args[0], cb = args[1], tries = opts.name ? 1 : opts.tries || DEFAULT_TRIES;
@@ -24366,7 +24427,7 @@ var require_tmp = __commonJS({
         return cb(new Error("Invalid template provided"));
       (function _getUniqueName() {
         const name = _generateTmpName(opts);
-        fs44.stat(name, function(err) {
+        fs46.stat(name, function(err) {
           if (!err) {
             if (tries-- > 0) return _getUniqueName();
             return cb(new Error("Could not get a unique tmp filename, max tries reached " + name));
@@ -24384,7 +24445,7 @@ var require_tmp = __commonJS({
       do {
         const name = _generateTmpName(opts);
         try {
-          fs44.statSync(name);
+          fs46.statSync(name);
         } catch (e2) {
           return name;
         }
@@ -24396,13 +24457,13 @@ var require_tmp = __commonJS({
       opts.postfix = _isUndefined(opts.postfix) ? ".tmp" : opts.postfix;
       tmpName(opts, function _tmpNameCreated(err, name) {
         if (err) return cb(err);
-        fs44.open(name, CREATE_FLAGS, opts.mode || FILE_MODE, function _fileCreated(err2, fd) {
+        fs46.open(name, CREATE_FLAGS, opts.mode || FILE_MODE, function _fileCreated(err2, fd) {
           if (err2) return cb(err2);
           if (opts.discardDescriptor) {
-            return fs44.close(fd, function _discardCallback(err3) {
+            return fs46.close(fd, function _discardCallback(err3) {
               if (err3) {
                 try {
-                  fs44.unlinkSync(name);
+                  fs46.unlinkSync(name);
                 } catch (e2) {
                   if (!isENOENT(e2)) {
                     err3 = e2;
@@ -24425,9 +24486,9 @@ var require_tmp = __commonJS({
       opts.postfix = opts.postfix || ".tmp";
       const discardOrDetachDescriptor = opts.discardDescriptor || opts.detachDescriptor;
       const name = tmpNameSync(opts);
-      var fd = fs44.openSync(name, CREATE_FLAGS, opts.mode || FILE_MODE);
+      var fd = fs46.openSync(name, CREATE_FLAGS, opts.mode || FILE_MODE);
       if (opts.discardDescriptor) {
-        fs44.closeSync(fd);
+        fs46.closeSync(fd);
         fd = void 0;
       }
       return {
@@ -24439,9 +24500,9 @@ var require_tmp = __commonJS({
     function _rmdirRecursiveSync(root) {
       const dirs = [root];
       do {
-        var dir2 = dirs.pop(), deferred = false, files = fs44.readdirSync(dir2);
+        var dir2 = dirs.pop(), deferred = false, files = fs46.readdirSync(dir2);
         for (var i2 = 0, length = files.length; i2 < length; i2++) {
-          var file2 = path52.join(dir2, files[i2]), stat = fs44.lstatSync(file2);
+          var file2 = path54.join(dir2, files[i2]), stat = fs46.lstatSync(file2);
           if (stat.isDirectory()) {
             if (!deferred) {
               deferred = true;
@@ -24449,11 +24510,11 @@ var require_tmp = __commonJS({
             }
             dirs.push(file2);
           } else {
-            fs44.unlinkSync(file2);
+            fs46.unlinkSync(file2);
           }
         }
         if (!deferred) {
-          fs44.rmdirSync(dir2);
+          fs46.rmdirSync(dir2);
         }
       } while (dirs.length !== 0);
     }
@@ -24461,7 +24522,7 @@ var require_tmp = __commonJS({
       var args = _parseArguments(options, callback), opts = args[0], cb = args[1];
       tmpName(opts, function _tmpNameCreated(err, name) {
         if (err) return cb(err);
-        fs44.mkdir(name, opts.mode || DIR_MODE, function _dirCreated(err2) {
+        fs46.mkdir(name, opts.mode || DIR_MODE, function _dirCreated(err2) {
           if (err2) return cb(err2);
           cb(null, name, _prepareTmpDirRemoveCallback(name, opts));
         });
@@ -24470,7 +24531,7 @@ var require_tmp = __commonJS({
     function dirSync(options) {
       var args = _parseArguments(options), opts = args[0];
       const name = tmpNameSync(opts);
-      fs44.mkdirSync(name, opts.mode || DIR_MODE);
+      fs46.mkdirSync(name, opts.mode || DIR_MODE);
       return {
         name,
         removeCallback: _prepareTmpDirRemoveCallback(name, opts)
@@ -24480,7 +24541,7 @@ var require_tmp = __commonJS({
       const removeCallback = _prepareRemoveCallback(function _removeCallback(fdPath) {
         try {
           if (0 <= fdPath[0]) {
-            fs44.closeSync(fdPath[0]);
+            fs46.closeSync(fdPath[0]);
           }
         } catch (e2) {
           if (!isEBADF(e2) && !isENOENT(e2)) {
@@ -24488,7 +24549,7 @@ var require_tmp = __commonJS({
           }
         }
         try {
-          fs44.unlinkSync(fdPath[1]);
+          fs46.unlinkSync(fdPath[1]);
         } catch (e2) {
           if (!isENOENT(e2)) {
             throw e2;
@@ -24501,7 +24562,7 @@ var require_tmp = __commonJS({
       return removeCallback;
     }
     function _prepareTmpDirRemoveCallback(name, opts) {
-      const removeFunction = opts.unsafeCleanup ? _rmdirRecursiveSync : fs44.rmdirSync.bind(fs44);
+      const removeFunction = opts.unsafeCleanup ? _rmdirRecursiveSync : fs46.rmdirSync.bind(fs46);
       const removeCallback = _prepareRemoveCallback(removeFunction, name);
       if (!opts.keep) {
         _removeObjects.unshift(removeCallback);
@@ -25652,7 +25713,7 @@ var require_Observable = __commonJS({
       Observable2.prototype.forEach = function(next, promiseCtor) {
         var _this = this;
         promiseCtor = getPromiseCtor(promiseCtor);
-        return new promiseCtor(function(resolve37, reject) {
+        return new promiseCtor(function(resolve38, reject) {
           var subscriber = new Subscriber_1.SafeSubscriber({
             next: function(value) {
               try {
@@ -25663,7 +25724,7 @@ var require_Observable = __commonJS({
               }
             },
             error: reject,
-            complete: resolve37
+            complete: resolve38
           });
           _this.subscribe(subscriber);
         });
@@ -25685,14 +25746,14 @@ var require_Observable = __commonJS({
       Observable2.prototype.toPromise = function(promiseCtor) {
         var _this = this;
         promiseCtor = getPromiseCtor(promiseCtor);
-        return new promiseCtor(function(resolve37, reject) {
+        return new promiseCtor(function(resolve38, reject) {
           var value;
           _this.subscribe(function(x2) {
             return value = x2;
           }, function(err) {
             return reject(err);
           }, function() {
-            return resolve37(value);
+            return resolve38(value);
           });
         });
       };
@@ -27788,11 +27849,11 @@ var require_innerFrom = __commonJS({
     "use strict";
     var __awaiter = exports2 && exports2.__awaiter || function(thisArg, _arguments, P2, generator) {
       function adopt(value) {
-        return value instanceof P2 ? value : new P2(function(resolve37) {
-          resolve37(value);
+        return value instanceof P2 ? value : new P2(function(resolve38) {
+          resolve38(value);
         });
       }
-      return new (P2 || (P2 = Promise))(function(resolve37, reject) {
+      return new (P2 || (P2 = Promise))(function(resolve38, reject) {
         function fulfilled(value) {
           try {
             step(generator.next(value));
@@ -27808,7 +27869,7 @@ var require_innerFrom = __commonJS({
           }
         }
         function step(result) {
-          result.done ? resolve37(result.value) : adopt(result.value).then(fulfilled, rejected);
+          result.done ? resolve38(result.value) : adopt(result.value).then(fulfilled, rejected);
         }
         step((generator = generator.apply(thisArg, _arguments || [])).next());
       });
@@ -27890,14 +27951,14 @@ var require_innerFrom = __commonJS({
       }, i2);
       function verb(n2) {
         i2[n2] = o2[n2] && function(v2) {
-          return new Promise(function(resolve37, reject) {
-            v2 = o2[n2](v2), settle(resolve37, reject, v2.done, v2.value);
+          return new Promise(function(resolve38, reject) {
+            v2 = o2[n2](v2), settle(resolve38, reject, v2.done, v2.value);
           });
         };
       }
-      function settle(resolve37, reject, d2, v2) {
+      function settle(resolve38, reject, d2, v2) {
         Promise.resolve(v2).then(function(v3) {
-          resolve37({ value: v3, done: d2 });
+          resolve38({ value: v3, done: d2 });
         }, reject);
       }
     };
@@ -28516,7 +28577,7 @@ var require_lastValueFrom = __commonJS({
     var EmptyError_1 = require_EmptyError();
     function lastValueFrom2(source, config2) {
       var hasConfig = typeof config2 === "object";
-      return new Promise(function(resolve37, reject) {
+      return new Promise(function(resolve38, reject) {
         var _hasValue = false;
         var _value;
         source.subscribe({
@@ -28527,9 +28588,9 @@ var require_lastValueFrom = __commonJS({
           error: reject,
           complete: function() {
             if (_hasValue) {
-              resolve37(_value);
+              resolve38(_value);
             } else if (hasConfig) {
-              resolve37(config2.defaultValue);
+              resolve38(config2.defaultValue);
             } else {
               reject(new EmptyError_1.EmptyError());
             }
@@ -28551,16 +28612,16 @@ var require_firstValueFrom = __commonJS({
     var Subscriber_1 = require_Subscriber();
     function firstValueFrom(source, config2) {
       var hasConfig = typeof config2 === "object";
-      return new Promise(function(resolve37, reject) {
+      return new Promise(function(resolve38, reject) {
         var subscriber = new Subscriber_1.SafeSubscriber({
           next: function(value) {
-            resolve37(value);
+            resolve38(value);
             subscriber.unsubscribe();
           },
           error: reject,
           complete: function() {
             if (hasConfig) {
-              resolve37(config2.defaultValue);
+              resolve38(config2.defaultValue);
             } else {
               reject(new EmptyError_1.EmptyError());
             }
@@ -34353,14 +34414,14 @@ var require_run_async = __commonJS({
       return function() {
         var args = arguments;
         var originalThis = this;
-        var promise = new Promise(function(resolve37, reject) {
+        var promise = new Promise(function(resolve38, reject) {
           var resolved = false;
           const wrappedResolve = function(value) {
             if (resolved) {
               console.warn("Run-async promise already resolved.");
             }
             resolved = true;
-            resolve37(value);
+            resolve38(value);
           };
           var rejected = false;
           const wrappedReject = function(value) {
@@ -35714,11 +35775,11 @@ var parser = new YargsParser({
   resolve: import_path2.resolve,
   // TODO: figure  out a  way to combine ESM and CJS coverage, such  that
   // we can exercise all the lines below:
-  require: (path52) => {
+  require: (path54) => {
     if (typeof require !== "undefined") {
-      return require(path52);
-    } else if (path52.match(/\.json$/)) {
-      return JSON.parse((0, import_fs2.readFileSync)(path52, "utf8"));
+      return require(path54);
+    } else if (path54.match(/\.json$/)) {
+      return JSON.parse((0, import_fs2.readFileSync)(path54, "utf8"));
     } else {
       throw Error("only .json config files are supported in ESM");
     }
@@ -38244,12 +38305,12 @@ var YargsInstance = class {
   async getCompletion(args, done) {
     argsert("<array> [function]", [args, done], arguments.length);
     if (!done) {
-      return new Promise((resolve37, reject) => {
+      return new Promise((resolve38, reject) => {
         __classPrivateFieldGet(this, _YargsInstance_completion, "f").getCompletion(args, (err, completions) => {
           if (err)
             reject(err);
           else
-            resolve37(completions);
+            resolve38(completions);
         });
       });
     } else {
@@ -40399,8 +40460,8 @@ function getErrorMap() {
 // node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path52, errorMaps, issueData } = params;
-  const fullPath = [...path52, ...issueData.path || []];
+  const { data, path: path54, errorMaps, issueData } = params;
+  const fullPath = [...path54, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -40516,11 +40577,11 @@ var errorUtil;
 // node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path52, key) {
+  constructor(parent, value, path54, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path52;
+    this._path = path54;
     this._key = key;
   }
   get path() {
@@ -44117,6 +44178,51 @@ var StageKindSchema = HarnessStageKindSchema;
 var VerificationResultSchema = HarnessVerificationResultSchema;
 var StageResultSchema = HarnessStageRunResultSchema;
 var RunRecordTriggerSchema = external_exports.enum(["cli", "mcp", "script"]);
+var WorkUnitIdSchema = external_exports.string().min(1).max(128).regex(
+  /^[A-Za-z0-9][A-Za-z0-9._:/#@-]*$/,
+  "work unit id must start with an alphanumeric character and contain only stable identifier characters"
+);
+var WorkAttemptIdSchema = external_exports.string().uuid();
+var WorkUnitMetadataSchema = external_exports.object({
+  workUnitId: WorkUnitIdSchema,
+  source: external_exports.string().min(1).max(64).optional(),
+  sourceUrl: external_exports.string().url().optional(),
+  title: external_exports.string().min(1).max(256).optional(),
+  parentWorkUnitId: WorkUnitIdSchema.optional()
+});
+var WorkUnitOutcomeSchema = external_exports.object({
+  decision: external_exports.enum(["completed", "abandoned"]),
+  decidedAt: external_exports.string(),
+  attemptId: WorkAttemptIdSchema.optional(),
+  validationId: external_exports.string().uuid().optional(),
+  treeHash: external_exports.string().regex(/^[0-9a-f]{40,64}$/).optional(),
+  reason: external_exports.string().max(2e3).optional()
+}).superRefine((outcome, ctx) => {
+  if (outcome.decision === "completed" && (!outcome.attemptId || !outcome.validationId || !outcome.treeHash)) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "completed work must reference an attempt and exact-tree validation"
+    });
+  }
+});
+var WorkUnitRecordSchema = WorkUnitMetadataSchema.extend({
+  version: external_exports.number().int().default(1),
+  createdAt: external_exports.string(),
+  updatedAt: external_exports.string(),
+  outcome: WorkUnitOutcomeSchema.optional()
+}).passthrough();
+var WorkAttemptRecordSchema = external_exports.object({
+  version: external_exports.number().int().default(1),
+  attemptId: WorkAttemptIdSchema,
+  workUnitId: WorkUnitIdSchema,
+  agentId: external_exports.number().int().min(HAR_AGENT_SLOT_MIN),
+  sessionKey: external_exports.string().min(1).optional(),
+  workDir: external_exports.string().optional(),
+  worktreePath: external_exports.string().optional(),
+  branch: external_exports.string().optional(),
+  baseCommit: external_exports.string().optional(),
+  createdAt: external_exports.string()
+}).passthrough();
 var RunRecordSchema = external_exports.object({
   runId: external_exports.string().uuid(),
   repoPath: external_exports.string(),
@@ -44132,7 +44238,9 @@ var RunRecordSchema = external_exports.object({
   relativePath: external_exports.string().optional(),
   command: external_exports.string().optional(),
   workDir: external_exports.string().optional(),
-  harnessRoot: external_exports.string().optional()
+  harnessRoot: external_exports.string().optional(),
+  workUnitId: WorkUnitIdSchema.optional(),
+  attemptId: WorkAttemptIdSchema.optional()
 }).passthrough();
 var SlotRegistryEntrySchema = external_exports.object({
   version: external_exports.number().int().default(1),
@@ -44154,6 +44262,8 @@ var SlotRegistryEntrySchema = external_exports.object({
   createdAt: external_exports.string(),
   ports: external_exports.record(external_exports.number()).optional(),
   previewUrls: external_exports.record(external_exports.string()).optional(),
+  workUnitId: WorkUnitIdSchema.optional(),
+  attemptId: WorkAttemptIdSchema.optional(),
   status: external_exports.enum(["starting", "active", "failed", "completed"]).default("active"),
   lastError: external_exports.string().optional()
 }).passthrough();
@@ -44199,6 +44309,8 @@ var AgentSlotStatusSchema = external_exports.object({
   sessionCreatedAt: external_exports.string().optional(),
   /** Derived from first captured user prompt (OTEL hooks); not set at launch. */
   purpose: external_exports.string().optional(),
+  workUnitId: WorkUnitIdSchema.optional(),
+  attemptId: WorkAttemptIdSchema.optional(),
   sessionStatus: external_exports.enum(["starting", "active", "failed", "completed"]).optional(),
   lastError: external_exports.string().optional(),
   /** Set when a failed/starting session can be resumed without --replace. */
@@ -44259,6 +44371,10 @@ var SyncSlotsInputSchema = external_exports.object({
   slots: external_exports.array(AgentSlotStatusSchema),
   generatedAt: external_exports.string()
 });
+var SyncWorkUnitsInputSchema = external_exports.object({
+  workUnits: external_exports.array(WorkUnitRecordSchema),
+  attempts: external_exports.array(WorkAttemptRecordSchema)
+});
 var ChangedFileStatusSchema = external_exports.enum(["A", "M", "D", "R", "C", "T", "U"]);
 var ChangedFileSchema = external_exports.object({
   path: external_exports.string(),
@@ -44285,6 +44401,17 @@ var ValidationRecordSchema = external_exports.object({
 var SyncValidationsInputSchema = external_exports.object({
   validations: external_exports.array(ValidationRecordSchema)
 });
+var ValidationBindingRecordSchema = external_exports.object({
+  bindingId: external_exports.string().uuid(),
+  workUnitId: WorkUnitIdSchema,
+  attemptId: WorkAttemptIdSchema,
+  validationId: external_exports.string().uuid(),
+  treeHash: external_exports.string().regex(/^[0-9a-f]{40,64}$/),
+  createdAt: external_exports.string()
+});
+var SyncValidationBindingsInputSchema = external_exports.object({
+  bindings: external_exports.array(ValidationBindingRecordSchema)
+});
 var AgentToolSchema = external_exports.enum(["claude_code", "codex", "cursor"]);
 var UsageSourceSchema = external_exports.enum(["otel", "harvest"]);
 var AgentSessionUsageSchema = external_exports.object({
@@ -44294,6 +44421,8 @@ var AgentSessionUsageSchema = external_exports.object({
   workDir: external_exports.string().optional(),
   branch: external_exports.string().optional(),
   suffix: external_exports.string().optional(),
+  workUnitId: WorkUnitIdSchema.optional(),
+  attemptId: WorkAttemptIdSchema.optional(),
   tokensInput: external_exports.number().nonnegative().default(0),
   tokensOutput: external_exports.number().nonnegative().default(0),
   tokensCacheRead: external_exports.number().nonnegative().default(0),
@@ -44315,6 +44444,8 @@ var AgentSessionEventSchema = external_exports.object({
   eventName: external_exports.string().min(1),
   sequence: external_exports.number().int().nonnegative().default(0),
   timestamp: external_exports.string(),
+  workUnitId: WorkUnitIdSchema.optional(),
+  attemptId: WorkAttemptIdSchema.optional(),
   attributes: external_exports.record(external_exports.unknown()).optional(),
   promptText: external_exports.string().nullable().optional(),
   responseText: external_exports.string().nullable().optional(),
@@ -44589,16 +44720,16 @@ async function handleAgentSkills(options) {
 }
 async function askYesNo(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     process.stderr.write(`${question} `);
     rl.once("line", (answer) => {
       rl.close();
       const trimmed = answer.trim();
       if (trimmed === "") {
-        resolve37(true);
+        resolve38(true);
         return;
       }
-      resolve37(/^y(es)?$/i.test(trimmed));
+      resolve38(/^y(es)?$/i.test(trimmed));
     });
   });
 }
@@ -44677,7 +44808,7 @@ function handleRemove(argv) {
 }
 // src/cli/commands/env.ts
-var path45 = __toESM(require("path"));
+var path47 = __toESM(require("path"));
 // src/core/harness.ts
 var fs20 = __toESM(require("fs"));
@@ -45456,13 +45587,13 @@ var MultipartBody = class {
 // node_modules/@anthropic-ai/sdk/_shims/node-runtime.mjs
 var import_web = require("node:stream/web");
 var fileFromPathWarned = false;
-async function fileFromPath3(path52, ...args) {
+async function fileFromPath3(path54, ...args) {
   const { fileFromPath: _fileFromPath } = await Promise.resolve().then(() => (init_fileFromPath(), fileFromPath_exports));
   if (!fileFromPathWarned) {
-    console.warn(`fileFromPath is deprecated; use fs.createReadStream(${JSON.stringify(path52)}) instead`);
+    console.warn(`fileFromPath is deprecated; use fs.createReadStream(${JSON.stringify(path54)}) instead`);
     fileFromPathWarned = true;
   }
-  return await _fileFromPath(path52, ...args);
+  return await _fileFromPath(path54, ...args);
 }
 var defaultHttpAgent = new import_agentkeepalive.default({ keepAlive: true, timeout: 5 * 60 * 1e3 });
 var defaultHttpsAgent = new import_agentkeepalive.default.HttpsAgent({ keepAlive: true, timeout: 5 * 60 * 1e3 });
@@ -45958,8 +46089,8 @@ async function defaultParseResponse(props) {
 }
 var APIPromise = class _APIPromise extends Promise {
   constructor(responsePromise, parseResponse = defaultParseResponse) {
-    super((resolve37) => {
-      resolve37(null);
+    super((resolve38) => {
+      resolve38(null);
     });
     this.responsePromise = responsePromise;
     this.parseResponse = parseResponse;
@@ -46059,29 +46190,29 @@ var APIClient = class {
   defaultIdempotencyKey() {
     return `stainless-node-retry-${uuid4()}`;
   }
-  get(path52, opts) {
-    return this.methodRequest("get", path52, opts);
+  get(path54, opts) {
+    return this.methodRequest("get", path54, opts);
   }
-  post(path52, opts) {
-    return this.methodRequest("post", path52, opts);
+  post(path54, opts) {
+    return this.methodRequest("post", path54, opts);
   }
-  patch(path52, opts) {
-    return this.methodRequest("patch", path52, opts);
+  patch(path54, opts) {
+    return this.methodRequest("patch", path54, opts);
   }
-  put(path52, opts) {
-    return this.methodRequest("put", path52, opts);
+  put(path54, opts) {
+    return this.methodRequest("put", path54, opts);
   }
-  delete(path52, opts) {
-    return this.methodRequest("delete", path52, opts);
+  delete(path54, opts) {
+    return this.methodRequest("delete", path54, opts);
   }
-  methodRequest(method, path52, opts) {
+  methodRequest(method, path54, opts) {
     return this.request(Promise.resolve(opts).then(async (opts2) => {
       const body = opts2 && isBlobLike(opts2?.body) ? new DataView(await opts2.body.arrayBuffer()) : opts2?.body instanceof DataView ? opts2.body : opts2?.body instanceof ArrayBuffer ? new DataView(opts2.body) : opts2 && ArrayBuffer.isView(opts2?.body) ? new DataView(opts2.body.buffer) : opts2?.body;
-      return { method, path: path52, ...opts2, body };
+      return { method, path: path54, ...opts2, body };
     }));
   }
-  getAPIList(path52, Page, opts) {
-    return this.requestAPIList(Page, { method: "get", path: path52, ...opts });
+  getAPIList(path54, Page, opts) {
+    return this.requestAPIList(Page, { method: "get", path: path54, ...opts });
   }
   calculateContentLength(body) {
     if (typeof body === "string") {
@@ -46099,10 +46230,10 @@ var APIClient = class {
     return null;
   }
   buildRequest(options) {
-    const { method, path: path52, query, headers = {} } = options;
+    const { method, path: path54, query, headers = {} } = options;
     const body = ArrayBuffer.isView(options.body) || options.__binaryRequest && typeof options.body === "string" ? options.body : isMultipartBody(options.body) ? options.body.body : options.body ? JSON.stringify(options.body, null, 2) : null;
     const contentLength = this.calculateContentLength(body);
-    const url = this.buildURL(path52, query);
+    const url = this.buildURL(path54, query);
     if ("timeout" in options)
       validatePositiveInteger("timeout", options.timeout);
     const timeout = options.timeout ?? this.timeout;
@@ -46211,8 +46342,8 @@ var APIClient = class {
     const request = this.makeRequest(options, null);
     return new PagePromise(this, request, Page);
   }
-  buildURL(path52, query) {
-    const url = isAbsoluteURL(path52) ? new URL(path52) : new URL(this.baseURL + (this.baseURL.endsWith("/") && path52.startsWith("/") ? path52.slice(1) : path52));
+  buildURL(path54, query) {
+    const url = isAbsoluteURL(path54) ? new URL(path54) : new URL(this.baseURL + (this.baseURL.endsWith("/") && path54.startsWith("/") ? path54.slice(1) : path54));
     const defaultQuery = this.defaultQuery();
     if (!isEmptyObj(defaultQuery)) {
       query = { ...defaultQuery, ...query };
@@ -46497,7 +46628,7 @@ var startsWithSchemeRegexp = new RegExp("^(?:[a-z]+:)?//", "i");
 var isAbsoluteURL = (url) => {
   return startsWithSchemeRegexp.test(url);
 };
-var sleep = (ms) => new Promise((resolve37) => setTimeout(resolve37, ms));
+var sleep = (ms) => new Promise((resolve38) => setTimeout(resolve38, ms));
 var validatePositiveInteger = (name, n2) => {
   if (typeof n2 !== "number" || !Number.isInteger(n2)) {
     throw new AnthropicError(`${name} must be an integer`);
@@ -46988,12 +47119,12 @@ var PromptCachingBetaMessageStream = class _PromptCachingBetaMessageStream {
       }
       return this._emit("error", new AnthropicError(String(error3)));
     });
-    __classPrivateFieldSet7(this, _PromptCachingBetaMessageStream_connectedPromise, new Promise((resolve37, reject) => {
-      __classPrivateFieldSet7(this, _PromptCachingBetaMessageStream_resolveConnectedPromise, resolve37, "f");
+    __classPrivateFieldSet7(this, _PromptCachingBetaMessageStream_connectedPromise, new Promise((resolve38, reject) => {
+      __classPrivateFieldSet7(this, _PromptCachingBetaMessageStream_resolveConnectedPromise, resolve38, "f");
       __classPrivateFieldSet7(this, _PromptCachingBetaMessageStream_rejectConnectedPromise, reject, "f");
     }), "f");
-    __classPrivateFieldSet7(this, _PromptCachingBetaMessageStream_endPromise, new Promise((resolve37, reject) => {
-      __classPrivateFieldSet7(this, _PromptCachingBetaMessageStream_resolveEndPromise, resolve37, "f");
+    __classPrivateFieldSet7(this, _PromptCachingBetaMessageStream_endPromise, new Promise((resolve38, reject) => {
+      __classPrivateFieldSet7(this, _PromptCachingBetaMessageStream_resolveEndPromise, resolve38, "f");
       __classPrivateFieldSet7(this, _PromptCachingBetaMessageStream_rejectEndPromise, reject, "f");
     }), "f");
     __classPrivateFieldGet8(this, _PromptCachingBetaMessageStream_connectedPromise, "f").catch(() => {
@@ -47122,11 +47253,11 @@ var PromptCachingBetaMessageStream = class _PromptCachingBetaMessageStream {
    *   const message = await stream.emitted('message') // rejects if the stream errors
    */
   emitted(event) {
-    return new Promise((resolve37, reject) => {
+    return new Promise((resolve38, reject) => {
       __classPrivateFieldSet7(this, _PromptCachingBetaMessageStream_catchingPromiseCreated, true, "f");
       if (event !== "error")
         this.once("error", reject);
-      this.once(event, resolve37);
+      this.once(event, resolve38);
     });
   }
   async done() {
@@ -47353,7 +47484,7 @@ var PromptCachingBetaMessageStream = class _PromptCachingBetaMessageStream {
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve37, reject) => readQueue.push({ resolve: resolve37, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve38, reject) => readQueue.push({ resolve: resolve38, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
         }
         const chunk = pushQueue.shift();
         return { value: chunk, done: false };
@@ -47501,12 +47632,12 @@ var MessageStream = class _MessageStream {
       }
       return this._emit("error", new AnthropicError(String(error3)));
     });
-    __classPrivateFieldSet8(this, _MessageStream_connectedPromise, new Promise((resolve37, reject) => {
-      __classPrivateFieldSet8(this, _MessageStream_resolveConnectedPromise, resolve37, "f");
+    __classPrivateFieldSet8(this, _MessageStream_connectedPromise, new Promise((resolve38, reject) => {
+      __classPrivateFieldSet8(this, _MessageStream_resolveConnectedPromise, resolve38, "f");
       __classPrivateFieldSet8(this, _MessageStream_rejectConnectedPromise, reject, "f");
     }), "f");
-    __classPrivateFieldSet8(this, _MessageStream_endPromise, new Promise((resolve37, reject) => {
-      __classPrivateFieldSet8(this, _MessageStream_resolveEndPromise, resolve37, "f");
+    __classPrivateFieldSet8(this, _MessageStream_endPromise, new Promise((resolve38, reject) => {
+      __classPrivateFieldSet8(this, _MessageStream_resolveEndPromise, resolve38, "f");
       __classPrivateFieldSet8(this, _MessageStream_rejectEndPromise, reject, "f");
     }), "f");
     __classPrivateFieldGet9(this, _MessageStream_connectedPromise, "f").catch(() => {
@@ -47635,11 +47766,11 @@ var MessageStream = class _MessageStream {
    *   const message = await stream.emitted('message') // rejects if the stream errors
    */
   emitted(event) {
-    return new Promise((resolve37, reject) => {
+    return new Promise((resolve38, reject) => {
       __classPrivateFieldSet8(this, _MessageStream_catchingPromiseCreated, true, "f");
       if (event !== "error")
         this.once("error", reject);
-      this.once(event, resolve37);
+      this.once(event, resolve38);
     });
   }
   async done() {
@@ -47866,7 +47997,7 @@ var MessageStream = class _MessageStream {
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve37, reject) => readQueue.push({ resolve: resolve37, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve38, reject) => readQueue.push({ resolve: resolve38, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
         }
         const chunk = pushQueue.shift();
         return { value: chunk, done: false };
@@ -48126,11 +48257,11 @@ async function promptApplyAgentMdProposal(repoPath) {
 }
 async function askYesNo2(question) {
   const rl = readline2.createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     process.stderr.write(`${question} `);
     rl.once("line", (answer) => {
       rl.close();
-      resolve37(/^y(es)?$/i.test(answer.trim()));
+      resolve38(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -48360,7 +48491,7 @@ async function executeAuthoringToolCall(toolName, input, repoPath, harnessDir, c
 }
 async function askUser(question, options) {
   const rl = readline3.createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     process.stderr.write("\n");
     process.stderr.write(`\u2753 ${question}
 `);
@@ -48371,7 +48502,7 @@ async function askUser(question, options) {
     process.stderr.write("> ");
     rl.once("line", (answer) => {
       rl.close();
-      resolve37(answer.trim());
+      resolve38(answer.trim());
     });
   });
 }
@@ -48515,7 +48646,7 @@ function runScript(scriptPath, args = [], options = {}) {
 function runScriptCapture(scriptPath, args = [], options = {}) {
   const stream = options.stream ?? false;
   const { stream: _stream, ...spawnOptions } = options;
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     const proc = (0, import_child_process.spawn)("bash", [scriptPath, ...args], {
       ...spawnOptions,
       stdio: ["inherit", "pipe", "pipe"]
@@ -48530,13 +48661,13 @@ function runScriptCapture(scriptPath, args = [], options = {}) {
       stderr += d2;
       if (stream) process.stderr.write(d2);
     });
-    proc.on("close", (code) => resolve37({ stdout, stderr, code: code ?? 0 }));
+    proc.on("close", (code) => resolve38({ stdout, stderr, code: code ?? 0 }));
   });
 }
 function runShellCommand(command2, options = {}) {
   const stream = options.stream ?? false;
   const { stream: _stream, ...spawnOptions } = options;
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     const proc = (0, import_child_process.spawn)("bash", ["-lc", command2], {
       ...spawnOptions,
       stdio: ["inherit", "pipe", "pipe"]
@@ -48551,7 +48682,7 @@ function runShellCommand(command2, options = {}) {
       stderr += d2;
       if (stream) process.stderr.write(d2);
     });
-    proc.on("close", (code) => resolve37({ stdout, stderr, code: code ?? 0 }));
+    proc.on("close", (code) => resolve38({ stdout, stderr, code: code ?? 0 }));
   });
 }
@@ -49715,16 +49846,16 @@ async function promptScaffoldCursorRule(exists) {
 }
 async function askYesNo3(question) {
   const rl = readline4.createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     process.stderr.write(`${question} `);
     rl.once("line", (answer) => {
       rl.close();
       const trimmed = answer.trim();
       if (trimmed === "") {
-        resolve37(true);
+        resolve38(true);
         return;
       }
-      resolve37(/^y(es)?$/i.test(trimmed));
+      resolve38(/^y(es)?$/i.test(trimmed));
     });
   });
 }
@@ -49802,6 +49933,9 @@ function buildStageResult(input) {
   });
 }
+// src/core/run-service.ts
+var crypto5 = __toESM(require("crypto"));
 // src/core/local-executor.ts
 var fs25 = __toESM(require("fs"));
 var path24 = __toESM(require("path"));
@@ -49854,6 +49988,8 @@ function buildLaunchFlagArgs(flags) {
   if (flags.confirmReplace) args.push("--replace");
   if (flags.force) args.push("--force");
   if (flags.resume) args.push("--resume");
+  if (flags.workUnitId) args.push(`--work-id=${flags.workUnitId}`);
+  if (flags.attemptId) args.push(`--attempt-id=${flags.attemptId}`);
   return args;
 }
 function resolveRepoPath(repoPath) {
@@ -50029,19 +50165,19 @@ var LocalScriptExecutor = class {
 var localScriptExecutor = new LocalScriptExecutor();
 // src/core/control-sync.ts
-var path39 = __toESM(require("path"));
+var path41 = __toESM(require("path"));
 init_control_config();
 // src/core/control-registry.ts
-var fs27 = __toESM(require("fs"));
-var os4 = __toESM(require("os"));
-var path26 = __toESM(require("path"));
+var fs28 = __toESM(require("fs"));
+var os5 = __toESM(require("os"));
+var path27 = __toESM(require("path"));
 // src/core/control-repo-path.ts
-var fs26 = __toESM(require("fs"));
-var path25 = __toESM(require("path"));
+var fs27 = __toESM(require("fs"));
+var path26 = __toESM(require("path"));
 function tryGit(cwd, args) {
-  if (!fs26.existsSync(cwd)) return void 0;
+  if (!fs27.existsSync(cwd)) return void 0;
   const result = run(`git ${args}`, { cwd });
   return result.code === 0 ? result.stdout.trim() : void 0;
 }
@@ -50049,58 +50185,58 @@ function resolveMainWorkingTree(cwd) {
   const toplevel = tryGit(cwd, "rev-parse --show-toplevel");
   if (!toplevel) return void 0;
   const commonDirRaw = tryGit(cwd, "rev-parse --git-common-dir");
-  const commonDir = commonDirRaw ? path25.resolve(cwd, commonDirRaw) : void 0;
-  if (!commonDir) return path25.resolve(toplevel);
-  if (path25.basename(commonDir) === ".git") {
-    return path25.dirname(commonDir);
+  const commonDir = commonDirRaw ? path26.resolve(cwd, commonDirRaw) : void 0;
+  if (!commonDir) return path26.resolve(toplevel);
+  if (path26.basename(commonDir) === ".git") {
+    return path26.dirname(commonDir);
   }
   const porcelain = tryGit(cwd, "worktree list --porcelain");
   if (porcelain) {
     for (const line of porcelain.split("\n")) {
       if (line.startsWith("worktree ")) {
-        return path25.resolve(line.slice("worktree ".length));
+        return path26.resolve(line.slice("worktree ".length));
       }
     }
   }
-  return path25.resolve(toplevel);
+  return path26.resolve(toplevel);
 }
 function canonicalizeControlRepoPath(repoPath) {
-  const resolved = path25.resolve(repoPath);
+  const resolved = path26.resolve(repoPath);
   const toplevel = tryGit(resolved, "rev-parse --show-toplevel");
   if (!toplevel) return resolved;
   const mainRoot = resolveMainWorkingTree(resolved);
   if (!mainRoot) return resolved;
-  const top2 = path25.resolve(toplevel);
-  const main = path25.resolve(mainRoot);
+  const top2 = path26.resolve(toplevel);
+  const main = path26.resolve(mainRoot);
   if (top2 === main) return resolved;
-  const rel = path25.relative(top2, resolved);
+  const rel = path26.relative(top2, resolved);
   if (!rel || rel === ".") return main;
-  if (rel.startsWith(`..${path25.sep}`) || rel === ".." || path25.isAbsolute(rel)) {
+  if (rel.startsWith(`..${path26.sep}`) || rel === ".." || path26.isAbsolute(rel)) {
     return resolved;
   }
-  return path25.resolve(main, rel);
+  return path26.resolve(main, rel);
 }
 // src/core/control-registry.ts
 function getRegistryPath() {
   if (process.env.HAR_CONTROL_REGISTRY_PATH) {
-    return path26.resolve(process.env.HAR_CONTROL_REGISTRY_PATH);
+    return path27.resolve(process.env.HAR_CONTROL_REGISTRY_PATH);
   }
-  return path26.join(os4.homedir(), ".har", "repos.json");
+  return path27.join(os5.homedir(), ".har", "repos.json");
 }
 function readRegistry() {
   const registryPath = getRegistryPath();
   try {
-    if (!fs27.existsSync(registryPath)) return { repos: [] };
-    return JSON.parse(fs27.readFileSync(registryPath, "utf8"));
+    if (!fs28.existsSync(registryPath)) return { repos: [] };
+    return JSON.parse(fs28.readFileSync(registryPath, "utf8"));
   } catch {
     return { repos: [] };
   }
 }
 function writeRegistry(registry2) {
   const registryPath = getRegistryPath();
-  fs27.mkdirSync(path26.dirname(registryPath), { recursive: true });
-  fs27.writeFileSync(registryPath, JSON.stringify(registry2, null, 2) + "\n");
+  fs28.mkdirSync(path27.dirname(registryPath), { recursive: true });
+  fs28.writeFileSync(registryPath, JSON.stringify(registry2, null, 2) + "\n");
 }
 function registryChanged(before, after) {
   if (before.length !== after.length) return true;
@@ -50122,7 +50258,7 @@ function removeRegisteredRepo(repoPath) {
     try {
       return canonicalizeControlRepoPath(entry) !== resolved;
     } catch {
-      return path26.resolve(entry) !== resolved;
+      return path27.resolve(entry) !== resolved;
     }
   });
   if (next.length === registry2.repos.length) return false;
@@ -50134,9 +50270,9 @@ function listRegisteredRepos() {
   const kept = [];
   const seen = /* @__PURE__ */ new Set();
   for (const repoPath of registry2.repos) {
-    if (!fs27.existsSync(repoPath)) continue;
+    if (!fs28.existsSync(repoPath)) continue;
     const canonical = canonicalizeControlRepoPath(repoPath);
-    if (!fs27.existsSync(canonical) || !readManifest(canonical)) continue;
+    if (!fs28.existsSync(canonical) || !readManifest(canonical)) continue;
     if (seen.has(canonical)) continue;
     seen.add(canonical);
     kept.push(canonical);
@@ -50148,17 +50284,17 @@ function listRegisteredRepos() {
 }
 // src/core/slot-status.ts
-var fs32 = __toESM(require("fs"));
-var os7 = __toESM(require("os"));
-var path32 = __toESM(require("path"));
+var fs33 = __toESM(require("fs"));
+var os8 = __toESM(require("os"));
+var path33 = __toESM(require("path"));
 var import_child_process7 = require("child_process");
 // src/core/runs.ts
 var crypto2 = __toESM(require("crypto"));
 var import_child_process2 = require("child_process");
-var fs28 = __toESM(require("fs"));
-var os5 = __toESM(require("os"));
-var path27 = __toESM(require("path"));
+var fs29 = __toESM(require("fs"));
+var os6 = __toESM(require("os"));
+var path28 = __toESM(require("path"));
 var RUNS_DIR = "runs";
 function gitCommonDir(cwd) {
   try {
@@ -50167,7 +50303,7 @@ function gitCommonDir(cwd) {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "ignore"]
     }).trim();
-    return out ? path27.resolve(cwd, out) : void 0;
+    return out ? path28.resolve(cwd, out) : void 0;
   } catch {
     return void 0;
   }
@@ -50189,7 +50325,7 @@ function gitPrefix(cwd) {
   }
 }
 function getRunsDir(harnessRoot) {
-  return path27.join(getHarnessDir(harnessRoot), RUNS_DIR);
+  return path28.join(getHarnessDir(harnessRoot), RUNS_DIR);
 }
 function formatLocalDate(d2) {
   const y2 = d2.getFullYear();
@@ -50209,24 +50345,24 @@ function buildRunRelativePath(stageId, agentId, startedAt, runId, runsDir) {
   const timePart = formatLocalTime(started);
   const agentPart = agentId !== void 0 ? `_agent-${agentId}` : "";
   let filename = `${timePart}_${stageId}${agentPart}.json`;
-  const fullPath = path27.join(runsDir, dateFolder, filename);
-  if (fs28.existsSync(fullPath)) {
+  const fullPath = path28.join(runsDir, dateFolder, filename);
+  if (fs29.existsSync(fullPath)) {
     filename = `${timePart}_${stageId}${agentPart}-${runId.slice(0, 8)}.json`;
   }
-  return path27.join(dateFolder, filename);
+  return path28.join(dateFolder, filename);
 }
 function resolveRunFilePath(harnessRoot, run2) {
   if (run2.relativePath) {
-    return path27.join(getRunsDir(harnessRoot), run2.relativePath);
+    return path28.join(getRunsDir(harnessRoot), run2.relativePath);
   }
-  return path27.join(getRunsDir(harnessRoot), `${run2.runId}.json`);
+  return path28.join(getRunsDir(harnessRoot), `${run2.runId}.json`);
 }
 function collectRunFiles(runsDir) {
-  if (!fs28.existsSync(runsDir)) return [];
+  if (!fs29.existsSync(runsDir)) return [];
   const files = [];
   const walk = (dir) => {
-    for (const entry of fs28.readdirSync(dir, { withFileTypes: true })) {
-      const full = path27.join(dir, entry.name);
+    for (const entry of fs29.readdirSync(dir, { withFileTypes: true })) {
+      const full = path28.join(dir, entry.name);
       if (entry.isDirectory()) {
         walk(full);
       } else if (entry.name.endsWith(".json")) {
@@ -50240,30 +50376,30 @@ function collectRunFiles(runsDir) {
 function resolveAgentWorkDir(harnessRoot, agentId) {
   if (agentId === void 0) return void 0;
   const entry = readSlotRegistry(harnessRoot, agentId);
-  if (entry?.workDir && fs28.existsSync(entry.workDir)) return entry.workDir;
+  if (entry?.workDir && fs29.existsSync(entry.workDir)) return entry.workDir;
   const env3 = readHarnessEnv(harnessRoot);
-  const projectName = env3.HARNESS_PROJECT_NAME ?? path27.basename(harnessRoot);
-  const worktreeDir = path27.join(os5.homedir(), "worktrees", `${projectName}-agent-${agentId}`);
+  const projectName = env3.HARNESS_PROJECT_NAME ?? path28.basename(harnessRoot);
+  const worktreeDir = path28.join(os6.homedir(), "worktrees", `${projectName}-agent-${agentId}`);
   const relPrefix = gitPrefix(harnessRoot);
   const sessionEnvFiles = [];
-  const worktreesRoot = path27.join(os5.homedir(), "worktrees");
-  if (fs28.existsSync(worktreesRoot)) {
+  const worktreesRoot = path28.join(os6.homedir(), "worktrees");
+  if (fs29.existsSync(worktreesRoot)) {
     const suffix = `-har-agent-${agentId}-`;
-    for (const entry2 of fs28.readdirSync(worktreesRoot, { withFileTypes: true })) {
+    for (const entry2 of fs29.readdirSync(worktreesRoot, { withFileTypes: true })) {
       if (!entry2.isDirectory() || !entry2.name.includes(suffix)) continue;
-      const sessionDir = path27.join(worktreesRoot, entry2.name);
+      const sessionDir = path28.join(worktreesRoot, entry2.name);
       if (!sameGitCheckout(harnessRoot, sessionDir)) continue;
-      sessionEnvFiles.push(path27.join(sessionDir, relPrefix, `.env.agent.${agentId}`));
+      sessionEnvFiles.push(path28.join(sessionDir, relPrefix, `.env.agent.${agentId}`));
     }
   }
   const candidates = [
-    path27.join(worktreeDir, `.env.agent.${agentId}`),
-    path27.join(harnessRoot, `.env.agent.${agentId}`),
+    path28.join(worktreeDir, `.env.agent.${agentId}`),
+    path28.join(harnessRoot, `.env.agent.${agentId}`),
     ...sessionEnvFiles.sort()
   ];
   for (const envFile of candidates) {
-    if (!fs28.existsSync(envFile)) continue;
-    const content = fs28.readFileSync(envFile, "utf8");
+    if (!fs29.existsSync(envFile)) continue;
+    const content = fs29.readFileSync(envFile, "utf8");
     const match = content.match(/^REPO_ROOT=(.+)$/m);
     if (match) return match[1].trim();
   }
@@ -50275,11 +50411,11 @@ function createRun(ctx, meta) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const runId = crypto2.randomUUID();
   const relativePath = buildRunRelativePath(meta.stageId, meta.agentId, startedAt, runId, runsDir);
-  const runFilePath = path27.join(runsDir, relativePath);
-  fs28.mkdirSync(path27.dirname(runFilePath), { recursive: true });
+  const runFilePath = path28.join(runsDir, relativePath);
+  fs29.mkdirSync(path28.dirname(runFilePath), { recursive: true });
   const run2 = RunRecordSchema.parse({
     runId,
-    repoPath: path27.resolve(ctx.repoPath),
+    repoPath: path28.resolve(ctx.repoPath),
     harnessRoot,
     stageId: meta.stageId,
     kind: meta.kind,
@@ -50288,9 +50424,11 @@ function createRun(ctx, meta) {
     status: "unknown",
     startedAt,
     relativePath,
-    trigger: ctx.trigger ?? "cli"
+    trigger: ctx.trigger ?? "cli",
+    workUnitId: ctx.workUnitId,
+    attemptId: ctx.attemptId
   });
-  fs28.writeFileSync(runFilePath, JSON.stringify(run2, null, 2) + "\n");
+  fs29.writeFileSync(runFilePath, JSON.stringify(run2, null, 2) + "\n");
   return run2;
 }
 function finishRun(repoPath, runId, update) {
@@ -50309,13 +50447,13 @@ function finishRun(repoPath, runId, update) {
     finishedAt: (/* @__PURE__ */ new Date()).toISOString()
   });
   const runPath = resolveRunFilePath(harnessRoot, finished);
-  fs28.writeFileSync(runPath, JSON.stringify(finished, null, 2) + "\n");
+  fs29.writeFileSync(runPath, JSON.stringify(finished, null, 2) + "\n");
   return finished;
 }
 function findRunRecord(harnessRoot, runId) {
   const runsDir = getRunsDir(harnessRoot);
   for (const filePath of collectRunFiles(runsDir)) {
-    const parsed = RunRecordSchema.safeParse(JSON.parse(fs28.readFileSync(filePath, "utf8")));
+    const parsed = RunRecordSchema.safeParse(JSON.parse(fs29.readFileSync(filePath, "utf8")));
     if (parsed.success && parsed.data.runId === runId) {
       return parsed.data;
     }
@@ -50327,10 +50465,10 @@ function getRun(repoPath, runId) {
 }
 function listRuns(repoPath, filter2 = {}) {
   const runsDir = getRunsDir(resolveHarnessRoot(repoPath));
-  if (!fs28.existsSync(runsDir)) return [];
+  if (!fs29.existsSync(runsDir)) return [];
   const runs = [];
   for (const filePath of collectRunFiles(runsDir)) {
-    const parsed = RunRecordSchema.safeParse(JSON.parse(fs28.readFileSync(filePath, "utf8")));
+    const parsed = RunRecordSchema.safeParse(JSON.parse(fs29.readFileSync(filePath, "utf8")));
     if (!parsed.success) continue;
     if (filter2.stageId && parsed.data.stageId !== filter2.stageId) continue;
     runs.push(parsed.data);
@@ -50343,18 +50481,18 @@ function listRuns(repoPath, filter2 = {}) {
 }
 // src/core/slot-preflight.ts
-var path31 = __toESM(require("path"));
+var path32 = __toESM(require("path"));
 // src/core/control-port.ts
 var import_child_process4 = require("child_process");
-var fs30 = __toESM(require("fs"));
-var path29 = __toESM(require("path"));
+var fs31 = __toESM(require("fs"));
+var path30 = __toESM(require("path"));
 init_control_config();
 // src/core/slot-ports.ts
 var import_child_process3 = require("child_process");
-var fs29 = __toESM(require("fs"));
-var path28 = __toESM(require("path"));
+var fs30 = __toESM(require("fs"));
+var path29 = __toESM(require("path"));
 function portStep(env3) {
   return Number(env3.HARNESS_PORT_STEP ?? 10);
 }
@@ -50410,7 +50548,7 @@ function allocateAppPorts(repoPath, agentId) {
 }
 function harnessUsesPm2(repoPath) {
   const harnessRoot = resolveHarnessRoot(repoPath);
-  return fs29.existsSync(path28.join(harnessRoot, ".har", "ecosystem.agent.template.cjs"));
+  return fs30.existsSync(path29.join(harnessRoot, ".har", "ecosystem.agent.template.cjs"));
 }
 // src/core/control-port.ts
@@ -50465,13 +50603,13 @@ function controlDefaultPortWarnings(containers, defaultFrontendPort, allocatedFr
   return [formatControlDefaultPortWarning(control.name, defaultFrontendPort, allocatedFrontend)];
 }
 function inspectControlUpReadiness(repoPath) {
-  const resolved = path29.resolve(repoPath);
+  const resolved = path30.resolve(repoPath);
   const port = parseControlHostPort();
   const containers = listDockerContainers();
   const control = controlContainerOnPort(containers, port);
   const warnings = [];
-  const controlHarnessDir = path29.join(resolved, "control", ".har");
-  const harnessSlot1Active = fs30.existsSync(controlHarnessDir) && readSlotRegistry(path29.join(resolved, "control"), 1)?.status === "active";
+  const controlHarnessDir = path30.join(resolved, "control", ".har");
+  const harnessSlot1Active = fs31.existsSync(controlHarnessDir) && readSlotRegistry(path30.join(resolved, "control"), 1)?.status === "active";
   if (control) {
     return {
       warnings,
@@ -50502,9 +50640,9 @@ function inspectControlUpReadiness(repoPath) {
 }
 // src/core/slot-launch-guard-occupied.ts
-var fs31 = __toESM(require("fs"));
-var os6 = __toESM(require("os"));
-var path30 = __toESM(require("path"));
+var fs32 = __toESM(require("fs"));
+var os7 = __toESM(require("os"));
+var path31 = __toESM(require("path"));
 var import_child_process5 = require("child_process");
 function runGit(cwd, args) {
   try {
@@ -50523,7 +50661,7 @@ function worktreeDirty(worktreePath) {
 }
 function gitCommonDir2(cwd) {
   const out = runGit(cwd, "rev-parse --git-common-dir");
-  return out ? path30.resolve(cwd, out) : void 0;
+  return out ? path31.resolve(cwd, out) : void 0;
 }
 function sameGitCheckout2(a2, b2) {
   const left2 = gitCommonDir2(a2);
@@ -50532,20 +50670,20 @@ function sameGitCheckout2(a2, b2) {
 }
 function discoverWorktree(harnessRoot, agentId, projectName) {
   const session = readSlotRegistry(harnessRoot, agentId);
-  if (session?.worktreePath && fs31.existsSync(session.worktreePath)) {
+  if (session?.worktreePath && fs32.existsSync(session.worktreePath)) {
     return session.worktreePath;
   }
-  const legacy = path30.join(os6.homedir(), "worktrees", `${projectName}-agent-${agentId}`);
-  if (fs31.existsSync(legacy) && sameGitCheckout2(harnessRoot, legacy)) return legacy;
-  const worktreesRoot = path30.join(os6.homedir(), "worktrees");
-  if (!fs31.existsSync(worktreesRoot)) return void 0;
+  const legacy = path31.join(os7.homedir(), "worktrees", `${projectName}-agent-${agentId}`);
+  if (fs32.existsSync(legacy) && sameGitCheckout2(harnessRoot, legacy)) return legacy;
+  const worktreesRoot = path31.join(os7.homedir(), "worktrees");
+  if (!fs32.existsSync(worktreesRoot)) return void 0;
   const suffix = `-har-agent-${agentId}-`;
   const relPrefix = runGit(harnessRoot, "rev-parse --show-prefix") ?? "";
-  for (const name of fs31.readdirSync(worktreesRoot)) {
+  for (const name of fs32.readdirSync(worktreesRoot)) {
     if (!name.includes(suffix)) continue;
-    const candidate = path30.join(worktreesRoot, name);
+    const candidate = path31.join(worktreesRoot, name);
     if (!sameGitCheckout2(harnessRoot, candidate)) continue;
-    if (!fs31.existsSync(path30.join(candidate, relPrefix, `.env.agent.${agentId}`))) continue;
+    if (!fs32.existsSync(path31.join(candidate, relPrefix, `.env.agent.${agentId}`))) continue;
     return candidate;
   }
   return void 0;
@@ -50553,13 +50691,13 @@ function discoverWorktree(harnessRoot, agentId, projectName) {
 function collectOccupiedSlot(repoPath, agentId) {
   const harnessRoot = resolveHarnessRoot(repoPath);
   const env3 = readHarnessEnv(harnessRoot);
-  const projectName = env3.HARNESS_PROJECT_NAME ?? path30.basename(harnessRoot);
+  const projectName = env3.HARNESS_PROJECT_NAME ?? path31.basename(harnessRoot);
   const session = readSlotRegistry(harnessRoot, agentId);
   const worktreePath = discoverWorktree(harnessRoot, agentId, projectName);
   const workDir = session?.workDir;
-  const envInWorkDir = workDir ? fs31.existsSync(path30.join(workDir, `.env.agent.${agentId}`)) : false;
-  const envInRoot = fs31.existsSync(path30.join(harnessRoot, `.env.agent.${agentId}`));
-  const envInWorktree = worktreePath ? fs31.existsSync(path30.join(worktreePath, `.env.agent.${agentId}`)) : false;
+  const envInWorkDir = workDir ? fs32.existsSync(path31.join(workDir, `.env.agent.${agentId}`)) : false;
+  const envInRoot = fs32.existsSync(path31.join(harnessRoot, `.env.agent.${agentId}`));
+  const envInWorktree = worktreePath ? fs32.existsSync(path31.join(worktreePath, `.env.agent.${agentId}`)) : false;
   const active = session !== void 0 && session.status !== "completed" || envInWorkDir || envInRoot || envInWorktree;
   if (!active) return void 0;
   const dirty = worktreePath ? worktreeDirty(worktreePath) : void 0;
@@ -50725,7 +50863,7 @@ function checkInfraPort(env3, varName, defaultPort, scanStart, scanEnd) {
 function inspectSlotReadiness(repoPath, agentId, options = {}) {
   const harnessRoot = resolveHarnessRoot(repoPath);
   const env3 = readHarnessEnv(harnessRoot);
-  const projectName = env3.HARNESS_PROJECT_NAME ?? path31.basename(harnessRoot);
+  const projectName = env3.HARNESS_PROJECT_NAME ?? path32.basename(harnessRoot);
   const usesPm2 = harnessUsesPm2(repoPath);
   const blockers = [];
   const remediations = [];
@@ -50927,7 +51065,7 @@ function readWorktreeBranch(worktreePath) {
 }
 function gitCommonDir3(cwd) {
   const out = runGit2(cwd, "rev-parse --git-common-dir");
-  return out ? path32.resolve(cwd, out) : void 0;
+  return out ? path33.resolve(cwd, out) : void 0;
 }
 function sameGitCheckout3(a2, b2) {
   const left2 = gitCommonDir3(a2);
@@ -50939,12 +51077,12 @@ function gitPrefix2(cwd) {
   return out ?? "";
 }
 function discoverSessionWorktreePath(harnessRoot, agentId) {
-  const worktreesRoot = path32.join(os7.homedir(), "worktrees");
-  if (!fs32.existsSync(worktreesRoot)) return void 0;
+  const worktreesRoot = path33.join(os8.homedir(), "worktrees");
+  if (!fs33.existsSync(worktreesRoot)) return void 0;
   const suffix = `-har-agent-${agentId}-`;
   const relPrefix = gitPrefix2(harnessRoot);
-  const matches = fs32.readdirSync(worktreesRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name.includes(suffix)).map((entry) => path32.join(worktreesRoot, entry.name)).filter(
-    (candidate) => sameGitCheckout3(harnessRoot, candidate) && fs32.existsSync(path32.join(candidate, relPrefix, `.env.agent.${agentId}`))
+  const matches = fs33.readdirSync(worktreesRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name.includes(suffix)).map((entry) => path33.join(worktreesRoot, entry.name)).filter(
+    (candidate) => sameGitCheckout3(harnessRoot, candidate) && fs33.existsSync(path33.join(candidate, relPrefix, `.env.agent.${agentId}`))
   );
   return matches.sort()[0];
 }
@@ -51019,18 +51157,18 @@ function detectPm2Issue(projectName, agentId, session, procs) {
 }
 function collectSlotStatus(harnessRoot, agentId, runs, pm2Procs) {
   const env3 = readHarnessEnv(harnessRoot);
-  const projectName = env3.HARNESS_PROJECT_NAME ?? path32.basename(harnessRoot);
+  const projectName = env3.HARNESS_PROJECT_NAME ?? path33.basename(harnessRoot);
   const session = readSlotRegistry(harnessRoot, agentId);
-  const legacyWorktreePath = path32.join(
-    os7.homedir(),
+  const legacyWorktreePath = path33.join(
+    os8.homedir(),
     "worktrees",
     `${projectName}-agent-${agentId}`
   );
-  const worktreePath = session?.worktreePath && fs32.existsSync(session.worktreePath) ? session.worktreePath : fs32.existsSync(legacyWorktreePath) ? legacyWorktreePath : discoverSessionWorktreePath(harnessRoot, agentId);
+  const worktreePath = session?.worktreePath && fs33.existsSync(session.worktreePath) ? session.worktreePath : fs33.existsSync(legacyWorktreePath) ? legacyWorktreePath : discoverSessionWorktreePath(harnessRoot, agentId);
   const workDir = resolveAgentWorkDir(harnessRoot, agentId);
-  const envInWorkDir = workDir ? fs32.existsSync(path32.join(workDir, `.env.agent.${agentId}`)) : false;
-  const envInRoot = fs32.existsSync(path32.join(harnessRoot, `.env.agent.${agentId}`));
-  const envInWorktree = worktreePath ? fs32.existsSync(path32.join(worktreePath, `.env.agent.${agentId}`)) : false;
+  const envInWorkDir = workDir ? fs33.existsSync(path33.join(workDir, `.env.agent.${agentId}`)) : false;
+  const envInRoot = fs33.existsSync(path33.join(harnessRoot, `.env.agent.${agentId}`));
+  const envInWorktree = worktreePath ? fs33.existsSync(path33.join(worktreePath, `.env.agent.${agentId}`)) : false;
   const active = session !== void 0 && session.status !== "completed" || envInWorkDir || envInRoot || envInWorktree;
   const latest = latestRunForAgent(runs, agentId);
   const verifyRun = runs.find((r2) => r2.agentId === agentId && r2.stageId === "verify");
@@ -51069,6 +51207,8 @@ function collectSlotStatus(harnessRoot, agentId, runs, pm2Procs) {
     baseBranch: session?.baseBranch,
     baseCommit: session?.baseCommit,
     sessionCreatedAt: session?.createdAt,
+    workUnitId: session?.workUnitId,
+    attemptId: session?.attemptId,
     sessionStatus: session?.status,
     lastError: session?.lastError,
     resumeHint,
@@ -51082,7 +51222,7 @@ function collectEnvironmentStatus(repoPath) {
   const slotIds = getAgentSlotIds(harnessRoot);
   const pm2Procs = listPm2Processes2();
   return {
-    repoPath: path32.resolve(repoPath),
+    repoPath: path33.resolve(repoPath),
     harnessRoot,
     gitRemote: readGitRemote(harnessRoot),
     profile: manifest?.profile,
@@ -51093,13 +51233,13 @@ function collectEnvironmentStatus(repoPath) {
 // src/core/validations.ts
 var crypto3 = __toESM(require("crypto"));
-var fs34 = __toESM(require("fs"));
-var path34 = __toESM(require("path"));
+var fs35 = __toESM(require("fs"));
+var path35 = __toESM(require("path"));
 // src/core/change-batch.ts
-var fs33 = __toESM(require("fs"));
-var os8 = __toESM(require("os"));
-var path33 = __toESM(require("path"));
+var fs34 = __toESM(require("fs"));
+var os9 = __toESM(require("os"));
+var path34 = __toESM(require("path"));
 function git(checkoutDir, args, env3) {
   const result = run(`git ${args}`, { cwd: checkoutDir, env: env3 });
   if (result.code !== 0) {
@@ -51115,7 +51255,7 @@ function isCheckoutRoot(checkoutDir) {
   const toplevel = tryGit2(checkoutDir, "rev-parse --show-toplevel");
   if (!toplevel) return false;
   try {
-    return fs33.realpathSync(toplevel) === fs33.realpathSync(checkoutDir);
+    return fs34.realpathSync(toplevel) === fs34.realpathSync(checkoutDir);
   } catch {
     return false;
   }
@@ -51137,7 +51277,7 @@ function isMergeOrRebaseInProgress(checkoutDir) {
   if (tryGit2(checkoutDir, "rev-parse -q --verify MERGE_HEAD") !== void 0) return true;
   for (const dir of ["rebase-merge", "rebase-apply"]) {
     const gitPath = tryGit2(checkoutDir, `rev-parse --git-path ${dir}`);
-    if (gitPath && fs33.existsSync(path33.resolve(checkoutDir, gitPath))) return true;
+    if (gitPath && fs34.existsSync(path34.resolve(checkoutDir, gitPath))) return true;
   }
   return false;
 }
@@ -51160,8 +51300,8 @@ function parseNameStatus(output) {
   return files;
 }
 function computeWorktreeSnapshot(checkoutDir) {
-  const tmpDir = fs33.mkdtempSync(path33.join(os8.tmpdir(), "har-idx-"));
-  const tmpIndex = path33.join(tmpDir, "index");
+  const tmpDir = fs34.mkdtempSync(path34.join(os9.tmpdir(), "har-idx-"));
+  const tmpIndex = path34.join(tmpDir, "index");
   const env3 = { GIT_INDEX_FILE: tmpIndex };
   try {
     const headTree = getHeadTree(checkoutDir);
@@ -51184,35 +51324,35 @@ function computeWorktreeSnapshot(checkoutDir) {
       changedFiles: parseNameStatus(diffOutput)
     };
   } finally {
-    fs33.rmSync(tmpDir, { recursive: true, force: true });
+    fs34.rmSync(tmpDir, { recursive: true, force: true });
   }
 }
 // src/core/validations.ts
 var VALIDATIONS_DIR = "validations";
 function getValidationsDir(checkoutDir) {
-  return path34.join(checkoutDir, ".har", VALIDATIONS_DIR);
+  return path35.join(checkoutDir, ".har", VALIDATIONS_DIR);
 }
 function validationPath(checkoutDir, treeHash) {
-  return path34.join(getValidationsDir(checkoutDir), `${treeHash}.json`);
+  return path35.join(getValidationsDir(checkoutDir), `${treeHash}.json`);
 }
 function writeRecord(checkoutDir, record2) {
   const dir = getValidationsDir(checkoutDir);
-  fs34.mkdirSync(dir, { recursive: true });
-  fs34.writeFileSync(
+  fs35.mkdirSync(dir, { recursive: true });
+  fs35.writeFileSync(
     validationPath(checkoutDir, record2.treeHash),
     `${JSON.stringify(record2, null, 2)}
 `
   );
 }
 function ensureValidationsIgnored(checkoutDir) {
-  const harDir = path34.join(checkoutDir, ".har");
-  if (!fs34.existsSync(harDir)) return;
-  const gitignorePath = path34.join(harDir, ".gitignore");
-  const content = fs34.existsSync(gitignorePath) ? fs34.readFileSync(gitignorePath, "utf8") : "";
+  const harDir = path35.join(checkoutDir, ".har");
+  if (!fs35.existsSync(harDir)) return;
+  const gitignorePath = path35.join(harDir, ".gitignore");
+  const content = fs35.existsSync(gitignorePath) ? fs35.readFileSync(gitignorePath, "utf8") : "";
   if (content.split("\n").some((line) => line.trim() === `${VALIDATIONS_DIR}/`)) return;
   const suffix = content.length === 0 || content.endsWith("\n") ? "" : "\n";
-  fs34.writeFileSync(gitignorePath, `${content}${suffix}${VALIDATIONS_DIR}/
+  fs35.writeFileSync(gitignorePath, `${content}${suffix}${VALIDATIONS_DIR}/
 `);
 }
 function recordValidation(input) {
@@ -51229,8 +51369,8 @@ function recordValidation(input) {
     treeHash: snapshot.treeHash,
     headSha: snapshot.headSha,
     branch: snapshot.branch,
-    workDir: path34.resolve(input.checkoutDir),
-    harnessRoot: path34.resolve(input.harnessRoot),
+    workDir: path35.resolve(input.checkoutDir),
+    harnessRoot: path35.resolve(input.harnessRoot),
     agentId: input.agentId,
     status: input.status,
     full: input.full,
@@ -51242,16 +51382,16 @@ function recordValidation(input) {
     committedAt: existing?.committedAt
   });
   writeRecord(input.checkoutDir, record2);
-  if (path34.resolve(input.harnessRoot) !== path34.resolve(input.checkoutDir)) {
+  if (path35.resolve(input.harnessRoot) !== path35.resolve(input.checkoutDir)) {
     writeRecord(input.harnessRoot, record2);
   }
   return record2;
 }
 function findValidation(checkoutDir, treeHash) {
   const file = validationPath(checkoutDir, treeHash);
-  if (!fs34.existsSync(file)) return void 0;
+  if (!fs35.existsSync(file)) return void 0;
   try {
-    return ValidationRecordSchema.parse(JSON.parse(fs34.readFileSync(file, "utf8")));
+    return ValidationRecordSchema.parse(JSON.parse(fs35.readFileSync(file, "utf8")));
   } catch {
     return void 0;
   }
@@ -51266,25 +51406,192 @@ function attachCommit(checkoutDir, treeHash, commitSha) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   writeRecord(checkoutDir, updated);
-  if (record2.harnessRoot && path34.resolve(record2.harnessRoot) !== path34.resolve(checkoutDir) && fs34.existsSync(path34.join(record2.harnessRoot, ".har"))) {
+  if (record2.harnessRoot && path35.resolve(record2.harnessRoot) !== path35.resolve(checkoutDir) && fs35.existsSync(path35.join(record2.harnessRoot, ".har"))) {
     writeRecord(record2.harnessRoot, updated);
   }
   return updated;
 }
 function listValidations(harnessRoot) {
   const dir = getValidationsDir(harnessRoot);
-  if (!fs34.existsSync(dir)) return [];
+  if (!fs35.existsSync(dir)) return [];
   const records = [];
-  for (const entry of fs34.readdirSync(dir)) {
+  for (const entry of fs35.readdirSync(dir)) {
     if (!entry.endsWith(".json")) continue;
     try {
-      records.push(ValidationRecordSchema.parse(JSON.parse(fs34.readFileSync(path34.join(dir, entry), "utf8"))));
+      records.push(ValidationRecordSchema.parse(JSON.parse(fs35.readFileSync(path35.join(dir, entry), "utf8"))));
     } catch {
     }
   }
   return records.sort((a2, b2) => b2.updatedAt.localeCompare(a2.updatedAt));
 }
+// src/core/work-units.ts
+var crypto4 = __toESM(require("crypto"));
+var fs36 = __toESM(require("fs"));
+var path36 = __toESM(require("path"));
+var WORK_UNITS_DIR = "work-units";
+var WORK_ATTEMPTS_DIR = "work-attempts";
+var VALIDATION_BINDINGS_DIR = "validation-bindings";
+var EVIDENCE_DIRS = [WORK_UNITS_DIR, WORK_ATTEMPTS_DIR, VALIDATION_BINDINGS_DIR];
+function harEvidenceDir(harnessRoot, name) {
+  return path36.join(harnessRoot, ".har", name);
+}
+function hashedRecordPath(harnessRoot, dir, id) {
+  const digest = crypto4.createHash("sha256").update(id).digest("hex");
+  return path36.join(harEvidenceDir(harnessRoot, dir), `${digest}.json`);
+}
+function writeRecord2(file, value) {
+  fs36.mkdirSync(path36.dirname(file), { recursive: true });
+  const temp = `${file}.${process.pid}.tmp`;
+  fs36.writeFileSync(temp, `${JSON.stringify(value, null, 2)}
+`);
+  fs36.renameSync(temp, file);
+}
+function ensureWorkEvidenceIgnored(harnessRoot) {
+  const harDir = path36.join(harnessRoot, ".har");
+  if (!fs36.existsSync(harDir)) return;
+  const gitignorePath = path36.join(harDir, ".gitignore");
+  const content = fs36.existsSync(gitignorePath) ? fs36.readFileSync(gitignorePath, "utf8") : "";
+  const lines2 = new Set(content.split("\n").map((line) => line.trim()));
+  const missing = EVIDENCE_DIRS.map((dir) => `${dir}/`).filter((dir) => !lines2.has(dir));
+  if (missing.length === 0) return;
+  const separator = content.length === 0 || content.endsWith("\n") ? "" : "\n";
+  fs36.writeFileSync(gitignorePath, `${content}${separator}${missing.join("\n")}
+`);
+}
+function listRecords(harnessRoot, dir, parse4) {
+  const recordDir = harEvidenceDir(harnessRoot, dir);
+  if (!fs36.existsSync(recordDir)) return [];
+  const records = [];
+  for (const name of fs36.readdirSync(recordDir)) {
+    if (!name.endsWith(".json")) continue;
+    try {
+      records.push(parse4(JSON.parse(fs36.readFileSync(path36.join(recordDir, name), "utf8"))));
+    } catch {
+    }
+  }
+  return records;
+}
+function findWorkUnit(harnessRoot, workUnitId) {
+  const metadata = WorkUnitMetadataSchema.parse({ workUnitId });
+  const file = hashedRecordPath(harnessRoot, WORK_UNITS_DIR, metadata.workUnitId);
+  if (!fs36.existsSync(file)) return void 0;
+  try {
+    return WorkUnitRecordSchema.parse(JSON.parse(fs36.readFileSync(file, "utf8")));
+  } catch {
+    return void 0;
+  }
+}
+function upsertWorkUnit(harnessRoot, input) {
+  const metadata = WorkUnitMetadataSchema.parse(input);
+  ensureWorkEvidenceIgnored(harnessRoot);
+  const existing = findWorkUnit(harnessRoot, metadata.workUnitId);
+  if (existing) {
+    if (existing.outcome) {
+      throw new Error(
+        `Work unit ${metadata.workUnitId} is already ${existing.outcome.decision}; reopening is not supported`
+      );
+    }
+    for (const field of ["source", "sourceUrl", "title", "parentWorkUnitId"]) {
+      if (metadata[field] !== void 0 && existing[field] !== void 0 && metadata[field] !== existing[field]) {
+        throw new Error(
+          `Work unit ${metadata.workUnitId} has immutable ${field}=${existing[field]}`
+        );
+      }
+    }
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const record2 = WorkUnitRecordSchema.parse({
+    ...existing,
+    workUnitId: metadata.workUnitId,
+    source: existing?.source ?? metadata.source,
+    sourceUrl: existing?.sourceUrl ?? metadata.sourceUrl,
+    title: existing?.title ?? metadata.title,
+    parentWorkUnitId: existing?.parentWorkUnitId ?? metadata.parentWorkUnitId,
+    version: 1,
+    createdAt: existing?.createdAt ?? now,
+    updatedAt: now,
+    outcome: existing?.outcome
+  });
+  writeRecord2(
+    hashedRecordPath(harnessRoot, WORK_UNITS_DIR, metadata.workUnitId),
+    record2
+  );
+  return record2;
+}
+function listWorkUnits(harnessRoot) {
+  return listRecords(
+    harnessRoot,
+    WORK_UNITS_DIR,
+    (value) => WorkUnitRecordSchema.parse(value)
+  ).sort((a2, b2) => b2.updatedAt.localeCompare(a2.updatedAt));
+}
+function createWorkAttempt(harnessRoot, input) {
+  const attempt = WorkAttemptRecordSchema.parse({
+    ...input,
+    version: 1,
+    createdAt: input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+  });
+  ensureWorkEvidenceIgnored(harnessRoot);
+  writeRecord2(
+    hashedRecordPath(harnessRoot, WORK_ATTEMPTS_DIR, attempt.attemptId),
+    attempt
+  );
+  return attempt;
+}
+function listWorkAttempts(harnessRoot) {
+  return listRecords(
+    harnessRoot,
+    WORK_ATTEMPTS_DIR,
+    (value) => WorkAttemptRecordSchema.parse(value)
+  ).sort((a2, b2) => b2.createdAt.localeCompare(a2.createdAt));
+}
+function bindValidationToAttempt(harnessRoot, input) {
+  const stableKey = `${input.attemptId}:${input.validation.validationId}`;
+  ensureWorkEvidenceIgnored(harnessRoot);
+  const existingFile = hashedRecordPath(
+    harnessRoot,
+    VALIDATION_BINDINGS_DIR,
+    stableKey
+  );
+  if (fs36.existsSync(existingFile)) {
+    try {
+      return ValidationBindingRecordSchema.parse(
+        JSON.parse(fs36.readFileSync(existingFile, "utf8"))
+      );
+    } catch {
+    }
+  }
+  const binding = ValidationBindingRecordSchema.parse({
+    bindingId: crypto4.randomUUID(),
+    workUnitId: input.workUnitId,
+    attemptId: input.attemptId,
+    validationId: input.validation.validationId,
+    treeHash: input.validation.treeHash,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  writeRecord2(existingFile, binding);
+  return binding;
+}
+function listValidationBindings(harnessRoot) {
+  return listRecords(
+    harnessRoot,
+    VALIDATION_BINDINGS_DIR,
+    (value) => ValidationBindingRecordSchema.parse(value)
+  ).sort((a2, b2) => b2.createdAt.localeCompare(a2.createdAt));
+}
+function decideWorkUnitOutcome(harnessRoot, workUnitId, outcome) {
+  const existing = findWorkUnit(harnessRoot, workUnitId);
+  if (!existing) throw new Error(`Unknown work unit: ${workUnitId}`);
+  const record2 = WorkUnitRecordSchema.parse({
+    ...existing,
+    outcome,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  writeRecord2(hashedRecordPath(harnessRoot, WORK_UNITS_DIR, workUnitId), record2);
+  return record2;
+}
 // src/core/cloud-executor.ts
 var RemoteExecutor = class {
   constructor(apiUrl, apiKey) {
@@ -51311,14 +51618,14 @@ function createRemoteExecutor(apiUrl, apiKey) {
 init_telemetry_config();
 // src/core/usage-harvest/claude.ts
-var fs37 = __toESM(require("fs"));
-var os10 = __toESM(require("os"));
-var path37 = __toESM(require("path"));
+var fs39 = __toESM(require("fs"));
+var os11 = __toESM(require("os"));
+var path39 = __toESM(require("path"));
 init_telemetry_config();
 // src/core/telemetry-env.ts
-var fs36 = __toESM(require("fs"));
-var path36 = __toESM(require("path"));
+var fs38 = __toESM(require("fs"));
+var path38 = __toESM(require("path"));
 init_control_config();
 function escapeAttrValue(value) {
   return value.replace(/[,=]/g, "_");
@@ -51332,6 +51639,10 @@ function buildOtelResourceAttributes(attrs) {
   ];
   if (attrs.branch) parts.push(`har.branch=${escapeAttrValue(attrs.branch)}`);
   if (attrs.suffix) parts.push(`har.suffix=${escapeAttrValue(attrs.suffix)}`);
+  if (attrs.workUnitId) {
+    parts.push(`har.work_unit_id=${escapeAttrValue(attrs.workUnitId)}`);
+  }
+  if (attrs.attemptId) parts.push(`har.attempt_id=${attrs.attemptId}`);
   return parts.join(",");
 }
 function buildSessionKey(input) {
@@ -51345,6 +51656,8 @@ function buildTelemetryEnvBlock(attrs) {
     "",
     "# HAR session attribution (generated)",
     `HAR_SESSION_KEY=${attrs.sessionKey}`,
+    ...attrs.workUnitId ? [`HAR_WORK_UNIT_ID=${attrs.workUnitId}`] : [],
+    ...attrs.attemptId ? [`HAR_ATTEMPT_ID=${attrs.attemptId}`] : [],
     `HAR_CONTROL_API_URL=${apiUrl}`,
     `OTEL_RESOURCE_ATTRIBUTES=${buildOtelResourceAttributes(attrs)}`,
     "# Agent telemetry: opentelemetry-hooks \u2192 Mission Control (har telemetry on|off)"
@@ -51358,8 +51671,8 @@ function appendTelemetryEnvToFile(envFilePath, attrs) {
 ${TELEMETRY_MARKER_END}
 `;
   let existing = "";
-  if (fs36.existsSync(envFilePath)) {
-    existing = fs36.readFileSync(envFilePath, "utf8");
+  if (fs38.existsSync(envFilePath)) {
+    existing = fs38.readFileSync(envFilePath, "utf8");
     const start = existing.indexOf(TELEMETRY_MARKER_START);
     if (start >= 0) {
       const end = existing.indexOf(TELEMETRY_MARKER_END, start);
@@ -51370,28 +51683,28 @@ ${TELEMETRY_MARKER_END}
       }
     }
   }
-  fs36.mkdirSync(path36.dirname(envFilePath), { recursive: true });
+  fs38.mkdirSync(path38.dirname(envFilePath), { recursive: true });
   const combined = (existing.replace(/\n+$/, "\n") + block).replace(/^\n+/, "");
-  fs36.writeFileSync(envFilePath, combined.endsWith("\n") ? combined : combined + "\n");
+  fs38.writeFileSync(envFilePath, combined.endsWith("\n") ? combined : combined + "\n");
 }
 // src/core/usage-harvest/claude.ts
 function pathsMatch(candidate, targets) {
-  const norm = path37.resolve(candidate);
+  const norm = path39.resolve(candidate);
   return targets.some((t2) => {
-    const target = path37.resolve(t2);
-    return norm === target || norm.startsWith(target + path37.sep) || target.startsWith(norm + path37.sep);
+    const target = path39.resolve(t2);
+    return norm === target || norm.startsWith(target + path39.sep) || target.startsWith(norm + path39.sep);
   });
 }
 function claudeProjectsRoot() {
-  return process.env.HAR_CLAUDE_PROJECTS_DIR ? path37.resolve(process.env.HAR_CLAUDE_PROJECTS_DIR) : path37.join(os10.homedir(), ".claude", "projects");
+  return process.env.HAR_CLAUDE_PROJECTS_DIR ? path39.resolve(process.env.HAR_CLAUDE_PROJECTS_DIR) : path39.join(os11.homedir(), ".claude", "projects");
 }
 function encodeClaudeProjectDir(cwd) {
   return cwd.replace(/[^a-zA-Z0-9]/g, "-");
 }
 function readJsonlRecords(filePath) {
-  if (!fs37.existsSync(filePath)) return [];
-  const lines2 = fs37.readFileSync(filePath, "utf8").split(/\r?\n/);
+  if (!fs39.existsSync(filePath)) return [];
+  const lines2 = fs39.readFileSync(filePath, "utf8").split(/\r?\n/);
   const out = [];
   for (const line of lines2) {
     const trimmed = line.trim();
@@ -51434,16 +51747,16 @@ function findMatchingClaudeTranscripts(slot) {
   const targets = [slot.workDir, slot.worktreePath].filter(Boolean);
   if (targets.length === 0) return [];
   const root = claudeProjectsRoot();
-  if (!fs37.existsSync(root)) return [];
+  if (!fs39.existsSync(root)) return [];
   const matches = [];
-  for (const entry of fs37.readdirSync(root, { withFileTypes: true })) {
+  for (const entry of fs39.readdirSync(root, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const projectDir = path37.join(root, entry.name);
+    const projectDir = path39.join(root, entry.name);
     const encodedHit = targets.some((t2) => entry.name.includes(encodeClaudeProjectDir(t2).slice(0, 40)));
-    for (const file of fs37.readdirSync(projectDir)) {
+    for (const file of fs39.readdirSync(projectDir)) {
       if (!file.endsWith(".jsonl")) continue;
-      const filePath = path37.join(projectDir, file);
-      const stat = fs37.statSync(filePath);
+      const filePath = path39.join(projectDir, file);
+      const stat = fs39.statSync(filePath);
       const records = readJsonlRecords(filePath);
       let cwdHit = encodedHit;
       for (const record2 of records) {
@@ -51554,30 +51867,30 @@ function harvestClaudeEvents(slot) {
 }
 // src/core/usage-harvest/codex.ts
-var fs38 = __toESM(require("fs"));
-var os11 = __toESM(require("os"));
-var path38 = __toESM(require("path"));
+var fs40 = __toESM(require("fs"));
+var os12 = __toESM(require("os"));
+var path40 = __toESM(require("path"));
 function pathsMatch2(candidate, targets) {
-  const norm = path38.resolve(candidate);
+  const norm = path40.resolve(candidate);
   return targets.some((t2) => {
-    const target = path38.resolve(t2);
-    return norm === target || norm.startsWith(target + path38.sep) || target.startsWith(norm + path38.sep);
+    const target = path40.resolve(t2);
+    return norm === target || norm.startsWith(target + path40.sep) || target.startsWith(norm + path40.sep);
   });
 }
 function codexSessionsRoot() {
-  return process.env.HAR_CODEX_SESSIONS_DIR ? path38.resolve(process.env.HAR_CODEX_SESSIONS_DIR) : path38.join(os11.homedir(), ".codex", "sessions");
+  return process.env.HAR_CODEX_SESSIONS_DIR ? path40.resolve(process.env.HAR_CODEX_SESSIONS_DIR) : path40.join(os12.homedir(), ".codex", "sessions");
 }
 function walkJsonlFiles(dir, out = []) {
-  if (!fs38.existsSync(dir)) return out;
-  for (const entry of fs38.readdirSync(dir, { withFileTypes: true })) {
-    const full = path38.join(dir, entry.name);
+  if (!fs40.existsSync(dir)) return out;
+  for (const entry of fs40.readdirSync(dir, { withFileTypes: true })) {
+    const full = path40.join(dir, entry.name);
     if (entry.isDirectory()) walkJsonlFiles(full, out);
     else if (entry.isFile() && entry.name.endsWith(".jsonl")) out.push(full);
   }
   return out;
 }
 function readJsonl(filePath) {
-  const lines2 = fs38.readFileSync(filePath, "utf8").split(/\r?\n/);
+  const lines2 = fs40.readFileSync(filePath, "utf8").split(/\r?\n/);
   const out = [];
   for (const line of lines2) {
     const trimmed = line.trim();
@@ -51641,7 +51954,7 @@ function harvestCodexUsage(slot) {
     const extracted = extractCodexTokens(records);
     if (!extracted.cwd || !pathsMatch2(extracted.cwd, targets)) continue;
     if (extracted.tokensInput + extracted.tokensOutput + extracted.tokensCacheRead === 0) continue;
-    const mtime = fs38.statSync(file).mtimeMs;
+    const mtime = fs40.statSync(file).mtimeMs;
     if (mtime >= bestMtime) {
       bestMtime = mtime;
       best = extracted;
@@ -51696,6 +52009,42 @@ async function postJson(url, body, dryRun) {
   }
   return await response.json();
 }
+async function postPortalSync(target, body, dryRun) {
+  if (dryRun) return;
+  const response = await fetch(`${target.url}/api/sync`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${target.token}`
+    },
+    body: JSON.stringify(body)
+  });
+  if (!response.ok) {
+    if (response.status === 401 || response.status === 403) {
+      throw new Error(
+        `har-portal rejected the ingest token (HTTP ${response.status}) \u2014 check HAR_PORTAL_TOKEN.`
+      );
+    }
+    const text = await response.text().catch(() => "");
+    throw new Error(`har-portal sync failed: HTTP ${response.status}${text ? ` \u2014 ${text}` : ""}`);
+  }
+}
+function buildPortalSyncBody(repoPath) {
+  const runs = listRuns(repoPath);
+  const status = collectEnvironmentStatus(repoPath);
+  const manifest = readManifest(repoPath);
+  const stagesRegistry = readStageRegistry(repoPath);
+  const validations = listValidations(resolveHarnessRoot(repoPath));
+  return {
+    path: repoPath,
+    ...manifest ? { manifest } : {},
+    ...stagesRegistry ? { stagesRegistry } : {},
+    runs,
+    slots: status.slots,
+    generatedAt: status.generatedAt,
+    ...validations.length > 0 ? { validations } : {}
+  };
+}
 async function isControlApiReachable(apiUrl = getControlApiUrl()) {
   try {
     const response = await fetch(`${apiUrl}/api/health`, {
@@ -51711,14 +52060,15 @@ async function waitForControlApi(apiUrl = getControlApiUrl(), timeoutMs = 6e4, i
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     if (await isControlApiReachable(apiUrl)) return true;
-    await new Promise((resolve37) => setTimeout(resolve37, intervalMs));
+    await new Promise((resolve38) => setTimeout(resolve38, intervalMs));
   }
   return false;
 }
 async function syncAllKnownReposWithControl(options) {
   if (!isControlEnabled()) return { synced: 0, failed: 0 };
   const apiUrl = options?.apiUrl ?? getControlApiUrl();
-  if (!await isControlApiReachable(apiUrl)) {
+  const portal = getPortalTarget();
+  if (!await isControlApiReachable(portal ? portal.url : apiUrl)) {
     return { synced: 0, failed: 0 };
   }
   const repoPaths = new Set(listRegisteredRepos());
@@ -51787,26 +52137,40 @@ async function syncRepoWithControl(options) {
     }
     const runs = listRuns(repoPath);
     const status = collectEnvironmentStatus(repoPath);
+    const harnessRoot = resolveHarnessRoot(repoPath);
     const response = await fetch(`${process.env.HAR_CLOUD_API_URL}/api/sync`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
         Authorization: `Bearer ${process.env.HAR_CLOUD_API_KEY}`
       },
-      body: JSON.stringify({ path: repoPath, runs, slots: status.slots })
+      body: JSON.stringify({
+        path: repoPath,
+        runs,
+        slots: status.slots,
+        workUnits: listWorkUnits(harnessRoot),
+        attempts: listWorkAttempts(harnessRoot),
+        validations: listValidations(harnessRoot),
+        validationBindings: listValidationBindings(harnessRoot)
+      })
     });
     if (!response.ok) {
       throw new Error(`Cloud sync failed: ${response.status}`);
     }
     return;
   }
+  const portal = getPortalTarget();
+  if (portal) {
+    await postPortalSync(portal, buildPortalSyncBody(repoPath), options.dryRun);
+    return;
+  }
   const registerResult = await registerRepoWithControl({ ...options, repoPath });
   const repoId = registerResult?.id;
   if (!repoId && !options.dryRun) {
     const listResponse = await fetch(`${apiUrl}/api/repos`);
     if (!listResponse.ok) throw new Error("Failed to list repos from Control API");
     const repos = await listResponse.json();
-    const existing = repos.find((r2) => path39.resolve(r2.path) === repoPath);
+    const existing = repos.find((r2) => path41.resolve(r2.path) === repoPath);
     if (!existing) {
       return;
     }
@@ -51827,6 +52191,13 @@ async function syncRepoRunsAndSlots(apiUrl, repoId, repoPath, dryRun) {
     generatedAt: status.generatedAt
   });
   await postJson(`${apiUrl}/api/repos/${repoId}/slots`, slotsBody, dryRun);
+  const workUnitsBody = SyncWorkUnitsInputSchema.parse({
+    workUnits: listWorkUnits(resolveHarnessRoot(repoPath)),
+    attempts: listWorkAttempts(resolveHarnessRoot(repoPath))
+  });
+  if (workUnitsBody.workUnits.length > 0 || workUnitsBody.attempts.length > 0) {
+    await postJson(`${apiUrl}/api/repos/${repoId}/work-units`, workUnitsBody, dryRun);
+  }
   if (isTelemetryEnabled() && process.env.NODE_ENV !== "test") {
     try {
       const usage2 = status.slots.flatMap(
@@ -51840,6 +52211,8 @@ async function syncRepoRunsAndSlots(apiUrl, repoId, repoPath, dryRun) {
           repoPath
         }).map((row) => ({
           ...row,
+          workUnitId: slot.workUnitId,
+          attemptId: slot.attemptId,
           sessionKey: row.sessionKey || buildSessionKey({
             branch: slot.branch,
             agentId: slot.agentId,
@@ -51861,7 +52234,11 @@ async function syncRepoRunsAndSlots(apiUrl, repoId, repoPath, dryRun) {
           suffix: slot.suffix,
           sessionCreatedAt: slot.sessionCreatedAt,
           repoPath
-        })
+        }).map((event) => ({
+          ...event,
+          workUnitId: slot.workUnitId,
+          attemptId: slot.attemptId
+        }))
       );
       if (events.length > 0) {
         const eventsBody = SyncSessionEventsInputSchema.parse({ events });
@@ -51878,6 +52255,16 @@ async function syncRepoRunsAndSlots(apiUrl, repoId, repoPath, dryRun) {
     const validationsBody = SyncValidationsInputSchema.parse({ validations });
     await postJson(`${apiUrl}/api/repos/${repoId}/validations`, validationsBody, dryRun);
   }
+  const bindingsBody = SyncValidationBindingsInputSchema.parse({
+    bindings: listValidationBindings(resolveHarnessRoot(repoPath))
+  });
+  if (bindingsBody.bindings.length > 0) {
+    await postJson(
+      `${apiUrl}/api/repos/${repoId}/validation-bindings`,
+      bindingsBody,
+      dryRun
+    );
+  }
 }
 var SYNC_TIMEOUT_MS = 15e3;
 function withTimeout(promise, ms, label) {
@@ -51891,17 +52278,18 @@ async function syncRepoWithControlAsync(repoPath) {
   if (process.env.HAR_CONTROL_DISABLED === "true" || process.env.NODE_ENV === "test") return;
   const verbose = process.env.HAR_CONTROL_VERBOSE === "true";
   try {
-    const apiUrl = getControlApiUrl();
-    if (!await isControlApiReachable(apiUrl)) {
+    const portal = getPortalTarget();
+    const healthUrl = portal ? portal.url : getControlApiUrl();
+    if (!await isControlApiReachable(healthUrl)) {
       if (verbose) {
-        process.stderr.write(`[har control] sync skipped: control API not reachable at ${apiUrl}
+        process.stderr.write(`[har control] sync skipped: not reachable at ${healthUrl}
 `);
       }
       return;
     }
     const canonical = canonicalizeControlRepoPath(repoPath);
     await withTimeout(
-      syncRepoWithControl({ repoPath: canonical, apiUrl }),
+      syncRepoWithControl({ repoPath: canonical }),
       SYNC_TIMEOUT_MS,
       "control sync"
     );
@@ -51935,7 +52323,7 @@ init_control_config();
 // src/core/control-lifecycle.ts
 var import_child_process8 = require("child_process");
-var path40 = __toESM(require("path"));
+var path42 = __toESM(require("path"));
 // src/core/control-image.ts
 var DEFAULT_CONTROL_IMAGE = "theosfactory/har-control";
@@ -51959,10 +52347,10 @@ var CONTROL_DATA_VOLUME = "har_control_data";
 var CONTROL_CONTAINER_PORT = 3847;
 var CONTROL_DATA_DB_URL = "file:/data/har_control.db";
 function resolveControlDir() {
-  return path40.resolve(__dirname, "..", "control");
+  return path42.resolve(__dirname, "..", "control");
 }
 function resolveControlBuildContext() {
-  return path40.resolve(resolveControlDir(), "..");
+  return path42.resolve(resolveControlDir(), "..");
 }
 function buildDockerRunArgs(options) {
   const name = options.containerName ?? CONTROL_CONTAINER_NAME;
@@ -52018,7 +52406,7 @@ async function startMissionControl(options) {
       "-t",
       imageRef,
       "-f",
-      path40.join(resolveControlDir(), "Dockerfile"),
+      path42.join(resolveControlDir(), "Dockerfile"),
       resolveControlBuildContext()
     ]);
     if (buildCode !== 0) {
@@ -52162,7 +52550,7 @@ async function ensureTelemetryInfrastructure(options) {
 // src/core/run-service.ts
 init_telemetry_config();
-var path42 = __toESM(require("path"));
+var path44 = __toESM(require("path"));
 function extractShellOutput(result) {
   const stdout = result.logs?.find((log) => log.stream === "stdout")?.content ?? result.logs?.find((log) => !log.stream)?.content ?? "";
   const stderr = result.logs?.find((log) => log.stream === "stderr")?.content ?? "";
@@ -52200,11 +52588,14 @@ var RunService = class {
     this.executor = executor;
   }
   async runStage(options) {
+    const activeSession = options.agentId !== void 0 && options.kind !== "launch" ? readSlotRegistry(resolveHarnessRoot(options.repoPath), options.agentId) : void 0;
     const ctx = {
       repoPath: options.repoPath,
       capture: options.capture,
       agentId: options.agentId,
-      trigger: options.trigger
+      trigger: options.trigger,
+      workUnitId: options.workUnitId ?? activeSession?.workUnitId,
+      attemptId: options.attemptId ?? activeSession?.attemptId
     };
     const stageLookup = options.stageId ? { id: options.stageId } : options.kind ? { kind: options.kind } : null;
     if (!stageLookup) {
@@ -52306,47 +52697,96 @@ Usage from Cursor / Claude / Codex (opentelemetry-hooks) will appear under Workt
 `;
       }
     }
+    const harnessRoot = resolveHarnessRoot(options.repoPath);
+    const resumableSession = options.resume ? readSlotRegistry(harnessRoot, options.agentId) : void 0;
+    const workUnitId = options.workUnitId ?? resumableSession?.workUnitId;
+    const attemptId = workUnitId ? resumableSession?.attemptId ?? crypto5.randomUUID() : void 0;
+    if (workUnitId && attemptId) {
+      const conflictingSession = listSlotRegistryEntries(harnessRoot).find(
+        (entry) => entry.workUnitId === workUnitId && !(entry.agentId === options.agentId && (options.resume || options.confirmReplace))
+      );
+      if (conflictingSession) {
+        return {
+          code: 2,
+          stdout: "",
+          stderr: `Work unit ${workUnitId} is already bound to slot ${conflictingSession.agentId} (attempt ${conflictingSession.attemptId ?? "unknown"}).`,
+          blocked: true
+        };
+      }
+      upsertWorkUnit(harnessRoot, {
+        workUnitId,
+        source: options.source,
+        sourceUrl: options.sourceUrl,
+        title: options.title,
+        parentWorkUnitId: options.parentWorkUnitId
+      });
+      createWorkAttempt(harnessRoot, {
+        attemptId,
+        workUnitId,
+        agentId: options.agentId
+      });
+    }
     const result = await this.runStage({
       repoPath: options.repoPath,
       kind: "launch",
       agentId: options.agentId,
+      workUnitId,
+      attemptId,
       capture: options.capture ?? false,
       launchFlags: {
         worktree: options.worktree,
         claude: options.claude,
         confirmReplace: options.confirmReplace,
         force: options.force,
-        resume: options.resume
+        resume: options.resume,
+        workUnitId,
+        attemptId
       },
       trigger: "cli"
     });
     const envResult = toEnvironmentRunResult(result);
     if (envResult.code === 0) {
-      const harnessRoot = resolveHarnessRoot(options.repoPath);
       const session = readSlotRegistry(harnessRoot, options.agentId);
       if (session) {
         envResult.workDir = session.workDir;
         envResult.worktreePath = session.worktreePath;
         envResult.branch = session.branch;
         envResult.previewUrls = envResult.previewUrls ?? session.previewUrls;
+        envResult.workUnitId = session.workUnitId;
+        envResult.attemptId = session.attemptId;
         const sessionKey = buildSessionKey({
           branch: session.branch,
           agentId: options.agentId,
           suffix: session.suffix,
           createdAt: session.createdAt
         });
-        const envFile = path42.join(session.workDir, `.env.agent.${options.agentId}`);
+        const envFile = path44.join(session.workDir, `.env.agent.${options.agentId}`);
         try {
           appendTelemetryEnvToFile(envFile, {
             sessionKey,
             agentId: options.agentId,
-            repoPath: path42.resolve(options.repoPath),
+            repoPath: path44.resolve(options.repoPath),
             workDir: session.workDir,
             branch: session.branch,
-            suffix: session.suffix
+            suffix: session.suffix,
+            workUnitId: session.workUnitId,
+            attemptId: session.attemptId
           });
         } catch {
         }
+        if (session.workUnitId && session.attemptId) {
+          createWorkAttempt(harnessRoot, {
+            attemptId: session.attemptId,
+            workUnitId: session.workUnitId,
+            agentId: options.agentId,
+            sessionKey,
+            workDir: session.workDir,
+            worktreePath: session.worktreePath,
+            branch: session.branch,
+            baseCommit: session.baseCommit,
+            createdAt: session.createdAt
+          });
+        }
       }
       if (telemetryBanner) {
         envResult.stderr = `${telemetryBanner}${envResult.stderr ?? ""}`;
@@ -52377,7 +52817,7 @@ Usage from Cursor / Claude / Codex (opentelemetry-hooks) will appear under Workt
         const harnessRoot = resolveHarnessRoot(options.repoPath);
         const checkoutDir = resolveAgentWorkDir(harnessRoot, options.agentId) ?? harnessRoot;
         const runId = typeof result.data === "object" && result.data !== null && !Array.isArray(result.data) ? result.data.runId : void 0;
-        recordValidation({
+        const validation2 = recordValidation({
           checkoutDir,
           harnessRoot,
           status: verification.status,
@@ -52385,7 +52825,22 @@ Usage from Cursor / Claude / Codex (opentelemetry-hooks) will appear under Workt
           runId,
           agentId: options.agentId
         });
+        const session = readSlotRegistry(harnessRoot, options.agentId);
+        if (session?.workUnitId && session.attemptId) {
+          bindValidationToAttempt(harnessRoot, {
+            workUnitId: session.workUnitId,
+            attemptId: session.attemptId,
+            validation: validation2
+          });
+        }
         await syncRepoWithControlAsync(options.repoPath);
+        return {
+          code: shell.code,
+          stdout: shell.stdout,
+          stderr: shell.stderr,
+          verification,
+          validation: validation2
+        };
       } catch {
       }
     }
@@ -52423,6 +52878,7 @@ Usage from Cursor / Claude / Codex (opentelemetry-hooks) will appear under Workt
       };
     }
     let verification;
+    let validation2;
     if (!options.skipVerify) {
       const verify = await this.runVerification({
         repoPath: options.repoPath,
@@ -52432,6 +52888,7 @@ Usage from Cursor / Claude / Codex (opentelemetry-hooks) will appear under Workt
         trigger: options.trigger
       });
       verification = verify.verification;
+      validation2 = verify.validation;
       if (verify.code !== 0 || verification?.status !== "pass") {
         return {
           ...verify,
@@ -52439,6 +52896,24 @@ Usage from Cursor / Claude / Codex (opentelemetry-hooks) will appear under Workt
         };
       }
     }
+    if (session.workUnitId && session.attemptId && !options.skipVerify && !validation2) {
+      return {
+        code: 1,
+        stdout: "",
+        stderr: "Full verification passed, but HAR could not record exact-tree validation proof. Session NOT completed.",
+        verification
+      };
+    }
+    if (session.workUnitId && session.attemptId && validation2) {
+      decideWorkUnitOutcome(harnessRoot, session.workUnitId, {
+        decision: "completed",
+        decidedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        attemptId: session.attemptId,
+        validationId: validation2.validationId,
+        treeHash: validation2.treeHash
+      });
+      await syncRepoWithControlAsync(options.repoPath);
+    }
     const teardown = await this.teardownEnvironment({
       repoPath: options.repoPath,
       agentId: options.agentId,
@@ -52522,9 +52997,9 @@ var getEnvironmentLogs = defaultRunService.getEnvironmentLogs.bind(defaultRunSer
 var readline5 = __toESM(require("readline"));
 // src/core/hooks.ts
-var fs40 = __toESM(require("fs"));
-var os13 = __toESM(require("os"));
-var path43 = __toESM(require("path"));
+var fs42 = __toESM(require("fs"));
+var os14 = __toESM(require("os"));
+var path45 = __toESM(require("path"));
 var MARKER_START = "# >>> har commit gate (managed by `har hooks`) >>>";
 var MARKER_END = "# <<< har commit gate <<<";
 var PRE_COMMIT_BLOCK = [
@@ -52549,7 +53024,7 @@ function resolveCheckoutRoot(cwd) {
 function resolveHooksDir(checkoutDir) {
   const hooksPath = tryGit3(checkoutDir, "rev-parse --git-path hooks");
   if (!hooksPath) throw new Error(`Not a git checkout: ${checkoutDir}`);
-  return path43.resolve(checkoutDir, hooksPath);
+  return path45.resolve(checkoutDir, hooksPath);
 }
 function getConfiguredHooksPath(checkoutDir) {
   return tryGit3(checkoutDir, "config core.hooksPath") || void 0;
@@ -52557,9 +53032,9 @@ function getConfiguredHooksPath(checkoutDir) {
 function defaultHarInvocation() {
   const entry = process.argv[1];
   if (entry && entry.endsWith(".js")) {
-    return `"${process.execPath}" "${path43.resolve(entry)}"`;
+    return `"${process.execPath}" "${path45.resolve(entry)}"`;
   }
-  if (entry) return `"${path43.resolve(entry)}"`;
+  if (entry) return `"${path45.resolve(entry)}"`;
   return "har";
 }
 function buildHookScript(harInvocation, subcommand, failOpenNotice) {
@@ -52580,40 +53055,40 @@ exit 0
 `;
 }
 function upsertMarkedBlock(filePath, block) {
-  if (!fs40.existsSync(filePath)) {
-    fs40.writeFileSync(filePath, `#!/bin/sh
+  if (!fs42.existsSync(filePath)) {
+    fs42.writeFileSync(filePath, `#!/bin/sh
 ${block}
 `, { mode: 493 });
     return "created";
   }
-  const content = fs40.readFileSync(filePath, "utf8");
+  const content = fs42.readFileSync(filePath, "utf8");
   if (content.includes(MARKER_START)) {
     const pattern = new RegExp(
       `${escapeRegExp(MARKER_START)}[\\s\\S]*?${escapeRegExp(MARKER_END)}`
     );
-    fs40.writeFileSync(filePath, content.replace(pattern, block));
-    fs40.chmodSync(filePath, 493);
+    fs42.writeFileSync(filePath, content.replace(pattern, block));
+    fs42.chmodSync(filePath, 493);
     return "updated";
   }
   const suffix = content.endsWith("\n") ? "" : "\n";
-  fs40.writeFileSync(filePath, `${content}${suffix}
+  fs42.writeFileSync(filePath, `${content}${suffix}
 ${block}
 `);
-  fs40.chmodSync(filePath, 493);
+  fs42.chmodSync(filePath, 493);
   return "appended";
 }
 function removeMarkedBlock(filePath) {
-  if (!fs40.existsSync(filePath)) return false;
-  const content = fs40.readFileSync(filePath, "utf8");
+  if (!fs42.existsSync(filePath)) return false;
+  const content = fs42.readFileSync(filePath, "utf8");
   if (!content.includes(MARKER_START)) return false;
   const pattern = new RegExp(
     `\\n?${escapeRegExp(MARKER_START)}[\\s\\S]*?${escapeRegExp(MARKER_END)}\\n?`
   );
   const stripped = content.replace(pattern, "\n");
   if (stripped.replace(/^#!\/bin\/sh\n?/, "").trim() === "") {
-    fs40.rmSync(filePath);
+    fs42.rmSync(filePath);
   } else {
-    fs40.writeFileSync(filePath, stripped);
+    fs42.writeFileSync(filePath, stripped);
   }
   return true;
 }
@@ -52635,20 +53110,20 @@ Or re-run with --force to write into that directory anyway.`
     );
   }
   const hooksDir = resolveHooksDir(checkout);
-  fs40.mkdirSync(hooksDir, { recursive: true });
+  fs42.mkdirSync(hooksDir, { recursive: true });
   const invocation = options.harInvocation ?? defaultHarInvocation();
-  fs40.writeFileSync(
-    path43.join(hooksDir, "har-pre-commit"),
+  fs42.writeFileSync(
+    path45.join(hooksDir, "har-pre-commit"),
     buildHookScript(invocation, "check", "har: binary not found; skipping commit gate (reinstall with har hooks install)"),
     { mode: 493 }
   );
-  fs40.writeFileSync(
-    path43.join(hooksDir, "har-post-commit"),
+  fs42.writeFileSync(
+    path45.join(hooksDir, "har-post-commit"),
     buildHookScript(invocation, "record-commit", "har: binary not found; skipping commit association"),
     { mode: 493 }
   );
-  const preCommit = upsertMarkedBlock(path43.join(hooksDir, "pre-commit"), PRE_COMMIT_BLOCK);
-  const postCommit = upsertMarkedBlock(path43.join(hooksDir, "post-commit"), POST_COMMIT_BLOCK);
+  const preCommit = upsertMarkedBlock(path45.join(hooksDir, "pre-commit"), PRE_COMMIT_BLOCK);
+  const postCommit = upsertMarkedBlock(path45.join(hooksDir, "post-commit"), POST_COMMIT_BLOCK);
   ensureValidationsIgnored(checkout);
   return { hooksDir, preCommit, postCommit };
 }
@@ -52657,12 +53132,12 @@ function uninstallHooks(repoPath) {
   if (!checkout) throw new Error(`Not a git repository: ${repoPath}`);
   const hooksDir = resolveHooksDir(checkout);
   let removed = false;
-  removed = removeMarkedBlock(path43.join(hooksDir, "pre-commit")) || removed;
-  removed = removeMarkedBlock(path43.join(hooksDir, "post-commit")) || removed;
+  removed = removeMarkedBlock(path45.join(hooksDir, "pre-commit")) || removed;
+  removed = removeMarkedBlock(path45.join(hooksDir, "post-commit")) || removed;
   for (const file of ["har-pre-commit", "har-post-commit"]) {
-    const full = path43.join(hooksDir, file);
-    if (fs40.existsSync(full)) {
-      fs40.rmSync(full);
+    const full = path45.join(hooksDir, file);
+    if (fs42.existsSync(full)) {
+      fs42.rmSync(full);
       removed = true;
     }
   }
@@ -52681,10 +53156,10 @@ function isAgentWorktree(checkoutDir) {
   if (branch && (/^har-agent-\d+$/.test(branch) || /-har-agent-\d+-[a-z0-9]+$/.test(branch))) {
     return true;
   }
-  const worktreesRoot = path43.join(os13.homedir(), "worktrees");
-  const resolved = path43.resolve(checkoutDir);
-  const name = path43.basename(resolved);
-  return resolved.startsWith(`${worktreesRoot}${path43.sep}`) && (/-agent-\d+$/.test(name) || /-har-agent-\d+-[a-z0-9]+$/.test(name));
+  const worktreesRoot = path45.join(os14.homedir(), "worktrees");
+  const resolved = path45.resolve(checkoutDir);
+  const name = path45.basename(resolved);
+  return resolved.startsWith(`${worktreesRoot}${path45.sep}`) && (/-agent-\d+$/.test(name) || /-har-agent-\d+-[a-z0-9]+$/.test(name));
 }
 function resolveEffectiveMode(checkoutDir, gate) {
   if (!gate.enabled) return "off";
@@ -52697,15 +53172,15 @@ function getHooksStatus(repoPath) {
   const hooksDir = resolveHooksDir(checkout);
   const gate = getCommitGateConfig(checkout);
   const hasBlock = (name) => {
-    const file = path43.join(hooksDir, name);
-    return fs40.existsSync(file) && fs40.readFileSync(file, "utf8").includes(MARKER_START);
+    const file = path45.join(hooksDir, name);
+    return fs42.existsSync(file) && fs42.readFileSync(file, "utf8").includes(MARKER_START);
   };
   return {
     checkout,
     hooksDir,
     configuredHooksPath: getConfiguredHooksPath(checkout),
-    preCommitInstalled: hasBlock("pre-commit") && fs40.existsSync(path43.join(hooksDir, "har-pre-commit")),
-    postCommitInstalled: hasBlock("post-commit") && fs40.existsSync(path43.join(hooksDir, "har-post-commit")),
+    preCommitInstalled: hasBlock("pre-commit") && fs42.existsSync(path45.join(hooksDir, "har-pre-commit")),
+    postCommitInstalled: hasBlock("post-commit") && fs42.existsSync(path45.join(hooksDir, "har-post-commit")),
     gate,
     effectiveMode: resolveEffectiveMode(checkout, gate)
   };
@@ -52716,7 +53191,7 @@ function checkCommitGate(cwd) {
   }
   const checkout = resolveCheckoutRoot(cwd);
   if (!checkout) return { exitCode: 0, messages: [] };
-  if (!fs40.existsSync(path43.join(checkout, ".har", "stages.json"))) {
+  if (!fs42.existsSync(path45.join(checkout, ".har", "stages.json"))) {
     return { exitCode: 0, messages: [] };
   }
   const gate = getCommitGateConfig(checkout);
@@ -52789,12 +53264,12 @@ async function recordCommitAssociation(cwd) {
 // src/core/commit-gate-onboarding.ts
 function askYesNo4(question) {
   const rl = readline5.createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     process.stderr.write(`${question} `);
     rl.once("line", (answer) => {
       rl.close();
       const trimmed = answer.trim();
-      resolve37(trimmed === "" || /^y(es)?$/i.test(trimmed));
+      resolve38(trimmed === "" || /^y(es)?$/i.test(trimmed));
     });
   });
 }
@@ -52836,20 +53311,20 @@ async function handleCommitGateOnboarding(options) {
 }
 // src/core/onboarding-preferences.ts
-var fs41 = __toESM(require("fs"));
-var os14 = __toESM(require("os"));
-var path44 = __toESM(require("path"));
+var fs43 = __toESM(require("fs"));
+var os15 = __toESM(require("os"));
+var path46 = __toESM(require("path"));
 function getOnboardingPreferencesPath() {
   if (process.env.HAR_PREFERENCES_PATH) {
-    return path44.resolve(process.env.HAR_PREFERENCES_PATH);
+    return path46.resolve(process.env.HAR_PREFERENCES_PATH);
   }
-  return path44.join(os14.homedir(), ".har", "preferences.json");
+  return path46.join(os15.homedir(), ".har", "preferences.json");
 }
 function readOnboardingPreferences() {
   const preferencePath = getOnboardingPreferencesPath();
   try {
-    if (!fs41.existsSync(preferencePath)) return OnboardingPreferencesSchema.parse({});
-    return OnboardingPreferencesSchema.parse(JSON.parse(fs41.readFileSync(preferencePath, "utf8")));
+    if (!fs43.existsSync(preferencePath)) return OnboardingPreferencesSchema.parse({});
+    return OnboardingPreferencesSchema.parse(JSON.parse(fs43.readFileSync(preferencePath, "utf8")));
   } catch {
     return OnboardingPreferencesSchema.parse({});
   }
@@ -52874,8 +53349,8 @@ function writeOnboardingPreferences(overrides) {
   };
   const parsed = OnboardingPreferencesSchema.parse(preference);
   const preferencePath = getOnboardingPreferencesPath();
-  fs41.mkdirSync(path44.dirname(preferencePath), { recursive: true });
-  fs41.writeFileSync(preferencePath, `${JSON.stringify(parsed, null, 2)}
+  fs43.mkdirSync(path46.dirname(preferencePath), { recursive: true });
+  fs43.writeFileSync(preferencePath, `${JSON.stringify(parsed, null, 2)}
 `);
   return parsed;
 }
@@ -53070,6 +53545,15 @@ var envCommand = {
       type: "boolean",
       default: false,
       describe: LAUNCH_RESUME_DESCRIBE
+    }).option("work-id", {
+      type: "string",
+      describe: "Bind this session to a durable external work identifier"
+    }).option("work-source", {
+      type: "string",
+      describe: "Optional provider/source name (for example github or linear)"
+    }).option("work-url", { type: "string", describe: "Optional source URL for the work" }).option("work-title", { type: "string", describe: "Optional human-readable title" }).option("parent-work-id", {
+      type: "string",
+      describe: "Optional parent work unit identifier"
     }).epilog(LAUNCH_EPILOG),
     handleLaunch
   ).command(
@@ -53146,7 +53630,7 @@ var envCommand = {
   }
 };
 async function handleInit(argv) {
-  const repoPath = path45.resolve(argv.repo);
+  const repoPath = path47.resolve(argv.repo);
   const onboarding = resolveOnboardingOptions(argv);
   header("har env init");
   info(`Repository: ${repoPath}`);
@@ -53210,7 +53694,7 @@ async function handleInit(argv) {
   }
 }
 async function handleMaintain(argv) {
-  const repoPath = path45.resolve(argv.repo);
+  const repoPath = path47.resolve(argv.repo);
   const onboarding = resolveOnboardingOptions(argv);
   header("har env maintain");
   info(`Repository: ${repoPath}`);
@@ -53325,7 +53809,7 @@ async function handleAgentMdProposal(repoPath, autoYes) {
   if (autoYes) {
     const proposal = readAgentMdProposal(repoPath);
     if (proposal) {
-      writeFileSafe(path45.join(repoPath, "AGENT.md"), proposal.content);
+      writeFileSafe(path47.join(repoPath, "AGENT.md"), proposal.content);
       clearAgentMdProposal(repoPath);
       info("Applied AGENT.md proposal (--yes)");
     }
@@ -53334,7 +53818,7 @@ async function handleAgentMdProposal(repoPath, autoYes) {
   await promptApplyAgentMdProposal(repoPath);
 }
 async function handleAddStage(argv) {
-  const repoPath = path45.resolve(argv.repo);
+  const repoPath = path47.resolve(argv.repo);
   const available = listStageTemplateIds();
   if (argv.list) {
     for (const id of available) {
@@ -53411,7 +53895,7 @@ async function handleAddStage(argv) {
   }
 }
 async function handlePreflight(argv) {
-  const repo = path45.resolve(argv.repo);
+  const repo = path47.resolve(argv.repo);
   const agentId = validateAgentId(argv.id, repo);
   const result = await preflightEnvironment({
     repoPath: repo,
@@ -53429,7 +53913,7 @@ async function handlePreflight(argv) {
   process.exit(result.code);
 }
 async function handleLaunch(argv) {
-  const repo = path45.resolve(argv.repo);
+  const repo = path47.resolve(argv.repo);
   const agentId = validateAgentId(argv.id, repo);
   let confirmReplace = argv.replace;
   let force = argv.force;
@@ -53441,8 +53925,8 @@ async function handleLaunch(argv) {
         console.error(guard.reason ?? "");
         const readline9 = await import("readline");
         const rl = readline9.createInterface({ input: process.stdin, output: process.stderr });
-        const answer = await new Promise((resolve37) => {
-          rl.question("Replace this slot? [y/N] ", resolve37);
+        const answer = await new Promise((resolve38) => {
+          rl.question("Replace this slot? [y/N] ", resolve38);
         });
         rl.close();
         if (!/^[Yy]$/.test(answer.trim())) {
@@ -53458,8 +53942,8 @@ async function handleLaunch(argv) {
         warn("Worktree has uncommitted changes.");
         const readline9 = await import("readline");
         const rl = readline9.createInterface({ input: process.stdin, output: process.stderr });
-        const answer = await new Promise((resolve37) => {
-          rl.question("Discard uncommitted changes? [y/N] ", resolve37);
+        const answer = await new Promise((resolve38) => {
+          rl.question("Discard uncommitted changes? [y/N] ", resolve38);
         });
         rl.close();
         if (!/^[Yy]$/.test(answer.trim())) {
@@ -53481,6 +53965,11 @@ async function handleLaunch(argv) {
     confirmReplace,
     force,
     resume: argv.resume,
+    workUnitId: argv.workId,
+    source: argv.workSource,
+    sourceUrl: argv.workUrl,
+    title: argv.workTitle,
+    parentWorkUnitId: argv.parentWorkId,
     capture: false
   });
   if (result.blocked) {
@@ -53509,11 +53998,16 @@ async function handleRecover(argv) {
     claude: false,
     replace: false,
     force: false,
-    resume: true
+    resume: true,
+    workId: void 0,
+    workSource: void 0,
+    workUrl: void 0,
+    workTitle: void 0,
+    parentWorkId: void 0
   });
 }
 async function handleVerify(argv) {
-  const repo = path45.resolve(argv.repo);
+  const repo = path47.resolve(argv.repo);
   const agentId = validateAgentId(argv.id, repo);
   const result = await runVerification({
     repoPath: repo,
@@ -53525,7 +54019,7 @@ async function handleVerify(argv) {
   process.exit(result.code);
 }
 async function handleTeardown(argv) {
-  const repo = path45.resolve(argv.repo);
+  const repo = path47.resolve(argv.repo);
   const agentId = validateAgentId(argv.id, repo);
   const result = await teardownEnvironment({
     repoPath: repo,
@@ -53536,7 +54030,7 @@ async function handleTeardown(argv) {
   process.exit(result.code);
 }
 async function handleComplete(argv) {
-  const repo = path45.resolve(argv.repo);
+  const repo = path47.resolve(argv.repo);
   const agentId = validateAgentId(argv.id, repo);
   const result = await completeEnvironment({
     repoPath: repo,
@@ -53557,7 +54051,7 @@ async function handleComplete(argv) {
   process.exit(result.code);
 }
 async function handleStatus(argv) {
-  const repoPath = path45.resolve(argv.repo);
+  const repoPath = path47.resolve(argv.repo);
   if (argv.json) {
     const status = collectEnvironmentStatus(repoPath);
     const output = EnvironmentStatusSchema.parse(status);
@@ -53570,7 +54064,7 @@ async function handleStatus(argv) {
   });
 }
 async function handleRunsList(argv) {
-  const repoPath = path45.resolve(argv.repo);
+  const repoPath = path47.resolve(argv.repo);
   const runs = listRuns(repoPath, { stageId: argv.stage, limit: argv.limit });
   if (argv.json) {
     process.stdout.write(JSON.stringify({ runs }, null, 2) + "\n");
@@ -53587,7 +54081,7 @@ async function handleRunsList(argv) {
   }
 }
 async function handleRunsGet(argv) {
-  const run2 = getRun(path45.resolve(argv.repo), argv.runId);
+  const run2 = getRun(path47.resolve(argv.repo), argv.runId);
   if (!run2) {
     error(`Run not found: ${argv.runId}`);
     process.exit(1);
@@ -53666,20 +54160,87 @@ function printNextSteps(auto2) {
 }
 // src/cli/commands/control.ts
-var path47 = __toESM(require("path"));
+var path49 = __toESM(require("path"));
 init_control_config();
+init_portal_credentials();
+// src/core/portal-login.ts
+var http = __toESM(require("http"));
+var import_crypto = require("crypto");
+var import_child_process10 = require("child_process");
+var CALLBACK_PATH = "/callback";
+var LOGIN_TIMEOUT_MS = 3 * 6e4;
+function openBrowser(url) {
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = (0, import_child_process10.spawn)(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function loginViaBrowser(portalUrl, openUrl = openBrowser) {
+  const state = (0, import_crypto.randomUUID)();
+  return new Promise((resolve38, reject) => {
+    let timer;
+    const server = http.createServer((req, res) => {
+      const requestUrl = new URL(req.url ?? "", "http://127.0.0.1");
+      if (requestUrl.pathname !== CALLBACK_PATH) {
+        res.writeHead(404);
+        res.end("Not found");
+        return;
+      }
+      const token = requestUrl.searchParams.get("token");
+      const returnedState = requestUrl.searchParams.get("state");
+      const workspace = requestUrl.searchParams.get("workspace") ?? void 0;
+      if (returnedState !== state || !token) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end("<h1>Login failed</h1><p>You can close this tab and try again.</p>");
+        cleanup();
+        reject(new Error("state mismatch or missing token"));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html" });
+      res.end("<h1>Logged in</h1><p>You can close this tab and return to the terminal.</p>");
+      cleanup();
+      resolve38({ portalUrl, token, workspace, createdAt: (/* @__PURE__ */ new Date()).toISOString() });
+    });
+    const cleanup = () => {
+      clearTimeout(timer);
+      server.close();
+    };
+    server.on("error", (err) => {
+      cleanup();
+      reject(err);
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const { port } = server.address();
+      const callback = `http://127.0.0.1:${port}${CALLBACK_PATH}`;
+      const loginUrl = `${portalUrl}/cli/login?callback=${encodeURIComponent(callback)}&state=${state}`;
+      openUrl(loginUrl);
+      process.stderr.write(`Opening ${loginUrl}
+If your browser did not open, paste that URL.
+`);
+      timer = setTimeout(() => {
+        cleanup();
+        reject(new Error("timed out"));
+      }, LOGIN_TIMEOUT_MS);
+    });
+  });
+}
 // src/core/control-unregister.ts
-var fs42 = __toESM(require("fs"));
-var path46 = __toESM(require("path"));
+var fs44 = __toESM(require("fs"));
+var path48 = __toESM(require("path"));
 init_control_config();
 function listUnregisterWorktreeCandidates(repoPath) {
   const harnessRoot = canonicalizeControlRepoPath(repoPath);
   const byPath = /* @__PURE__ */ new Map();
   const add = (partial2) => {
-    const resolved = path46.resolve(partial2.worktreePath);
+    const resolved = path48.resolve(partial2.worktreePath);
     if (!resolved || resolved === harnessRoot) return;
-    const exists = partial2.exists ?? fs42.existsSync(resolved);
+    const exists = partial2.exists ?? fs44.existsSync(resolved);
     const prev = byPath.get(resolved);
     if (prev) {
       byPath.set(resolved, {
@@ -53730,8 +54291,8 @@ async function askYesNo5(question) {
   if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
   const readline9 = await import("readline");
   const rl = readline9.createInterface({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve37) => {
-    rl.question(question, resolve37);
+  const answer = await new Promise((resolve38) => {
+    rl.question(question, resolve38);
   });
   rl.close();
   return /^[Yy]$/.test(answer.trim());
@@ -53793,28 +54354,28 @@ async function teardownWorktrees(repoPath, candidates, dryRun) {
         trigger: "cli"
       });
       if (result.code !== 0) {
-        if (fs42.existsSync(candidate.worktreePath)) {
-          fs42.rmSync(candidate.worktreePath, { recursive: true, force: true });
+        if (fs44.existsSync(candidate.worktreePath)) {
+          fs44.rmSync(candidate.worktreePath, { recursive: true, force: true });
         }
       }
       outcomes.push({
         path: candidate.worktreePath,
         agentId: candidate.agentId,
-        deleted: !fs42.existsSync(candidate.worktreePath),
-        error: result.code !== 0 && fs42.existsSync(candidate.worktreePath) ? result.stderr : void 0
+        deleted: !fs44.existsSync(candidate.worktreePath),
+        error: result.code !== 0 && fs44.existsSync(candidate.worktreePath) ? result.stderr : void 0
       });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       try {
-        if (fs42.existsSync(candidate.worktreePath)) {
-          fs42.rmSync(candidate.worktreePath, { recursive: true, force: true });
+        if (fs44.existsSync(candidate.worktreePath)) {
+          fs44.rmSync(candidate.worktreePath, { recursive: true, force: true });
         }
       } catch {
       }
       outcomes.push({
         path: candidate.worktreePath,
         agentId: candidate.agentId,
-        deleted: !fs42.existsSync(candidate.worktreePath),
+        deleted: !fs44.existsSync(candidate.worktreePath),
         error: message
       });
     }
@@ -53930,8 +54491,11 @@ var controlCommand = {
     handleWatch
   ).command(
     "login",
-    "Configure HAR Cloud API credentials (hosted sync)",
-    (y2) => y2.option("api-key", { type: "string", describe: "HAR Cloud API key" }),
+    "Log in to a har-portal (browser SSO) and store an ingest token",
+    (y2) => y2.option("portal", { type: "string", describe: "Portal base URL (or set HAR_PORTAL_URL)" }).option("api-key", {
+      type: "string",
+      describe: "Store this ingest token directly instead of browser login"
+    }),
     handleLogin
   ).demandCommand(
     1,
@@ -53996,7 +54560,7 @@ async function handleDown() {
   process.exit(code);
 }
 async function handleRegister(argv) {
-  const repoPath = path47.resolve(argv.repo);
+  const repoPath = path49.resolve(argv.repo);
   header("har control register");
   info(`Repository: ${repoPath}`);
   try {
@@ -54020,7 +54584,7 @@ async function handleRegister(argv) {
   }
 }
 async function handleUnregister(argv) {
-  const repoPath = path47.resolve(argv.repo);
+  const repoPath = path49.resolve(argv.repo);
   const worktrees = listUnregisterWorktreeCandidates(repoPath);
   try {
     let deleteWorktrees = argv.deleteWorktrees;
@@ -54089,7 +54653,7 @@ async function handleUnregister(argv) {
   }
 }
 async function handleSync(argv) {
-  const repoPath = path47.resolve(argv.repo);
+  const repoPath = path49.resolve(argv.repo);
   try {
     await syncRepoWithControl({
       repoPath,
@@ -54128,7 +54692,7 @@ async function handleWatch(argv) {
   };
   const tick = async () => {
     if (argv.repo) {
-      await syncOne(path47.resolve(argv.repo));
+      await syncOne(path49.resolve(argv.repo));
       return;
     }
     try {
@@ -54149,21 +54713,40 @@ async function handleWatch(argv) {
 }
 async function handleLogin(argv) {
   header("har control login");
-  if (!argv.apiKey) {
-    error("Provide --api-key (HAR Cloud API key)");
+  const portalUrl = (argv.portal ?? process.env.HAR_PORTAL_URL ?? "").replace(/\/+$/, "");
+  if (!portalUrl) {
+    error("Provide --portal <url> (or set HAR_PORTAL_URL)");
+    process.exit(1);
+  }
+  if (argv.apiKey) {
+    writePortalCredentials({
+      portalUrl,
+      token: argv.apiKey,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    success(`Saved ingest token for ${portalUrl}`);
+    info("Sync: har control sync");
+    return;
+  }
+  try {
+    const creds = await loginViaBrowser(portalUrl);
+    writePortalCredentials(creds);
+    success(
+      `Logged in to ${portalUrl}${creds.workspace ? ` (workspace: ${creds.workspace})` : ""}`
+    );
+    info("Sync: har control sync");
+  } catch (err) {
+    error(`Login failed: ${err.message}`);
     process.exit(1);
   }
-  process.env.HAR_CLOUD_API_KEY = argv.apiKey;
-  success("HAR_CLOUD_API_KEY set for this process. Export it in your shell for persistence.");
-  info("Sync to cloud: har control sync --cloud");
 }
 // src/cli/commands/hooks.ts
-var path49 = __toESM(require("path"));
+var path51 = __toESM(require("path"));
 // src/core/claude-hooks.ts
-var fs43 = __toESM(require("fs"));
-var path48 = __toESM(require("path"));
+var fs45 = __toESM(require("fs"));
+var path50 = __toESM(require("path"));
 var CLAUDE_GUARD_RELATIVE_PATH = ".har/hooks/claude-worktree-guard.sh";
 var CLAUDE_SETTINGS_RELATIVE_PATH = ".claude/settings.json";
 var GUARD_MATCHER = "Edit|Write|MultiEdit|NotebookEdit";
@@ -54174,8 +54757,8 @@ function isHarGuardEntry(entry) {
   );
 }
 function readSettings(settingsPath) {
-  if (!fs43.existsSync(settingsPath)) return {};
-  const raw = fs43.readFileSync(settingsPath, "utf8").trim();
+  if (!fs45.existsSync(settingsPath)) return {};
+  const raw = fs45.readFileSync(settingsPath, "utf8").trim();
   if (raw === "") return {};
   const parsed = JSON.parse(raw);
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
@@ -54184,19 +54767,19 @@ function readSettings(settingsPath) {
   return parsed;
 }
 function writeSettings(settingsPath, settings) {
-  fs43.mkdirSync(path48.dirname(settingsPath), { recursive: true });
-  fs43.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+  fs45.mkdirSync(path50.dirname(settingsPath), { recursive: true });
+  fs45.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
 }
 function installClaudeGuard(repoPath) {
   const templatePath = resolveTemplateFile("claude-worktree-guard.sh.template");
   if (!templatePath) {
     throw new Error("Guard template not found (claude-worktree-guard.sh.template). Run npm run build.");
   }
-  const guardScript = path48.join(repoPath, CLAUDE_GUARD_RELATIVE_PATH);
-  fs43.mkdirSync(path48.dirname(guardScript), { recursive: true });
-  fs43.copyFileSync(templatePath, guardScript);
-  fs43.chmodSync(guardScript, 493);
-  const settingsPath = path48.join(repoPath, CLAUDE_SETTINGS_RELATIVE_PATH);
+  const guardScript = path50.join(repoPath, CLAUDE_GUARD_RELATIVE_PATH);
+  fs45.mkdirSync(path50.dirname(guardScript), { recursive: true });
+  fs45.copyFileSync(templatePath, guardScript);
+  fs45.chmodSync(guardScript, 493);
+  const settingsPath = path50.join(repoPath, CLAUDE_SETTINGS_RELATIVE_PATH);
   const settings = readSettings(settingsPath);
   const hooks = settings.hooks ?? {};
   const preToolUse = (hooks.PreToolUse ?? []).filter((entry) => !isHarGuardEntry(entry));
@@ -54210,15 +54793,15 @@ function installClaudeGuard(repoPath) {
 }
 function uninstallClaudeGuard(repoPath) {
   let removed = false;
-  const guardScript = path48.join(repoPath, CLAUDE_GUARD_RELATIVE_PATH);
-  if (fs43.existsSync(guardScript)) {
-    fs43.rmSync(guardScript);
+  const guardScript = path50.join(repoPath, CLAUDE_GUARD_RELATIVE_PATH);
+  if (fs45.existsSync(guardScript)) {
+    fs45.rmSync(guardScript);
     removed = true;
-    const parent = path48.dirname(guardScript);
-    if (fs43.existsSync(parent) && fs43.readdirSync(parent).length === 0) fs43.rmdirSync(parent);
+    const parent = path50.dirname(guardScript);
+    if (fs45.existsSync(parent) && fs45.readdirSync(parent).length === 0) fs45.rmdirSync(parent);
   }
-  const settingsPath = path48.join(repoPath, CLAUDE_SETTINGS_RELATIVE_PATH);
-  if (fs43.existsSync(settingsPath)) {
+  const settingsPath = path50.join(repoPath, CLAUDE_SETTINGS_RELATIVE_PATH);
+  if (fs45.existsSync(settingsPath)) {
     const settings = readSettings(settingsPath);
     const preToolUse = settings.hooks?.PreToolUse;
     if (preToolUse) {
@@ -54243,8 +54826,8 @@ function uninstallClaudeGuard(repoPath) {
   return { removed };
 }
 function claudeGuardInstalled(repoPath) {
-  const settingsPath = path48.join(repoPath, CLAUDE_SETTINGS_RELATIVE_PATH);
-  if (!fs43.existsSync(settingsPath)) return false;
+  const settingsPath = path50.join(repoPath, CLAUDE_SETTINGS_RELATIVE_PATH);
+  if (!fs45.existsSync(settingsPath)) return false;
   try {
     const settings = readSettings(settingsPath);
     return (settings.hooks?.PreToolUse ?? []).some(isHarGuardEntry);
@@ -54260,7 +54843,7 @@ function repoOption(y2) {
 function handleInstall2(argv) {
   try {
     if (argv.claude) {
-      const result2 = installClaudeGuard(path49.resolve(argv.repo));
+      const result2 = installClaudeGuard(path51.resolve(argv.repo));
       success("Claude Code worktree guard installed.");
       info(`Guard script:  ${result2.guardScript}`);
       info(`Settings:      ${result2.settingsPath} (PreToolUse: Edit|Write|MultiEdit|NotebookEdit)`);
@@ -54268,7 +54851,7 @@ function handleInstall2(argv) {
       info("Commit both files so the guard travels with the repo.");
       return;
     }
-    const result = installHooks({ repoPath: path49.resolve(argv.repo), force: argv.force });
+    const result = installHooks({ repoPath: path51.resolve(argv.repo), force: argv.force });
     success(`Commit gate installed in ${result.hooksDir}`);
     info(`pre-commit: ${result.preCommit}, post-commit: ${result.postCommit}`);
     info("Commits of unverified change batches will be blocked in agent worktrees.");
@@ -54281,7 +54864,7 @@ function handleInstall2(argv) {
 function handleUninstall(argv) {
   try {
     if (argv.claude) {
-      const result2 = uninstallClaudeGuard(path49.resolve(argv.repo));
+      const result2 = uninstallClaudeGuard(path51.resolve(argv.repo));
       if (result2.removed) {
         success("Claude Code worktree guard removed.");
       } else {
@@ -54289,7 +54872,7 @@ function handleUninstall(argv) {
       }
       return;
     }
-    const result = uninstallHooks(path49.resolve(argv.repo));
+    const result = uninstallHooks(path51.resolve(argv.repo));
     if (result.removed) {
       success(`Commit gate removed from ${result.hooksDir}`);
     } else {
@@ -54302,7 +54885,7 @@ function handleUninstall(argv) {
 }
 function handleStatus2(argv) {
   try {
-    const status = getHooksStatus(path49.resolve(argv.repo));
+    const status = getHooksStatus(path51.resolve(argv.repo));
     if (argv.json) {
       process.stdout.write(`${JSON.stringify(status, null, 2)}
 `);
@@ -54320,7 +54903,7 @@ function handleStatus2(argv) {
     );
     info(`Effective:     ${status.effectiveMode} (in this checkout)`);
     info(
-      `Claude guard:  ${claudeGuardInstalled(path49.resolve(argv.repo)) ? `installed (${CLAUDE_GUARD_RELATIVE_PATH})` : "not installed"}`
+      `Claude guard:  ${claudeGuardInstalled(path51.resolve(argv.repo)) ? `installed (${CLAUDE_GUARD_RELATIVE_PATH})` : "not installed"}`
     );
   } catch (err) {
     error(err instanceof Error ? err.message : String(err));
@@ -54581,10 +55164,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path52) {
-  if (!path52)
+function getElementAtPath(obj, path54) {
+  if (!path54)
     return obj;
-  return path52.reduce((acc, key) => acc?.[key], obj);
+  return path54.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -54904,11 +55487,11 @@ function aborted(x2, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path52, issues) {
+function prefixIssues(path54, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path52);
+    iss.path.unshift(path54);
     return iss;
   });
 }
@@ -60231,7 +60814,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve37) => setTimeout(resolve37, pollInterval));
+        await new Promise((resolve38) => setTimeout(resolve38, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error3) {
@@ -60248,7 +60831,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve37, reject) => {
+    return new Promise((resolve38, reject) => {
       const earlyReject = (error3) => {
         reject(error3);
       };
@@ -60326,7 +60909,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve37(parseResult.data);
+            resolve38(parseResult.data);
           }
         } catch (error3) {
           reject(error3);
@@ -60587,12 +61170,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve37, reject) => {
+    return new Promise((resolve38, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve37, interval);
+      const timeoutId = setTimeout(resolve38, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -61382,7 +61965,7 @@ var Server = class extends Protocol {
 };
 // src/mcp/server.ts
-var path50 = __toESM(require("path"));
+var path52 = __toESM(require("path"));
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var import_node_process2 = __toESM(require("node:process"), 1);
@@ -61465,12 +62048,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve37) => {
+    return new Promise((resolve38) => {
       const json = serializeMessage(message);
       if (this._stdout.write(json)) {
-        resolve37();
+        resolve38();
       } else {
-        this._stdout.once("drain", resolve37);
+        this._stdout.once("drain", resolve38);
       }
     });
   }
@@ -61553,13 +62136,20 @@ var LaunchEnvironmentInputSchema = external_exports.object({
   force: external_exports.boolean().default(false).describe(
     "Discard uncommitted changes in a dirty occupied worktree. Requires confirmReplace=true and explicit user approval \u2014 never set autonomously."
   ),
-  resume: external_exports.boolean().default(false).describe("Resume a failed or partial launch without creating a new worktree.")
+  resume: external_exports.boolean().default(false).describe("Resume a failed or partial launch without creating a new worktree."),
+  workUnitId: external_exports.string().min(1).max(128).optional(),
+  source: external_exports.string().min(1).max(64).optional(),
+  sourceUrl: external_exports.string().url().optional(),
+  title: external_exports.string().min(1).max(256).optional(),
+  parentWorkUnitId: external_exports.string().min(1).max(128).optional()
 });
 var LaunchEnvironmentOutputSchema = ShellRunOutputSchema.extend({
   previewUrls: external_exports.record(external_exports.string()).optional(),
   workDir: external_exports.string().optional().describe("Where the session code lives \u2014 ALL file edits must go under this path"),
   worktreePath: external_exports.string().optional(),
   branch: external_exports.string().optional(),
+  workUnitId: external_exports.string().optional(),
+  attemptId: external_exports.string().uuid().optional(),
   blocked: external_exports.boolean().optional(),
   occupiedSlot: external_exports.object({
     agentId: external_exports.number().int(),
@@ -61692,6 +62282,17 @@ var HAR_MCP_TOOLS = [
         resume: {
           type: "boolean",
           description: "Resume a failed or partial launch (status failed/starting) without confirmReplace. Preserves worktree and env."
+        },
+        workUnitId: {
+          type: "string",
+          description: "Durable external work identifier to bind to this session."
+        },
+        source: { type: "string", description: "Optional provider/source name." },
+        sourceUrl: { type: "string", description: "Optional source URL." },
+        title: { type: "string", description: "Optional human-readable work title." },
+        parentWorkUnitId: {
+          type: "string",
+          description: "Optional parent work unit identifier."
         }
       },
       ["agentId"]
@@ -61875,6 +62476,11 @@ async function handleMcpToolCall(toolName, args, defaultRepo = ".") {
         confirmReplace: input.confirmReplace,
         force: input.force,
         resume: input.resume,
+        workUnitId: input.workUnitId,
+        source: input.source,
+        sourceUrl: input.sourceUrl,
+        title: input.title,
+        parentWorkUnitId: input.parentWorkUnitId,
         capture: true
       });
       const parsed = LaunchEnvironmentOutputSchema.parse(result);
@@ -61894,6 +62500,11 @@ async function handleMcpToolCall(toolName, args, defaultRepo = ".") {
         confirmReplace: false,
         force: false,
         resume: true,
+        workUnitId: input.workUnitId,
+        source: input.source,
+        sourceUrl: input.sourceUrl,
+        title: input.title,
+        parentWorkUnitId: input.parentWorkUnitId,
         capture: true
       });
       const parsed = LaunchEnvironmentOutputSchema.parse(result);
@@ -62014,7 +62625,7 @@ async function handleMcpToolCall(toolName, args, defaultRepo = ".") {
       const input = ControlUpInputSchema.parse({ ...args, repo });
       const result = await startControlAndSync({
         detach: input.detach,
-        cwd: path50.resolve(input.repo)
+        cwd: path52.resolve(input.repo)
       });
       if (result.code !== 0) {
         return {
@@ -63094,13 +63705,13 @@ var PromisePolyfill = class extends Promise {
   // Available starting from Node 22
   // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise/withResolvers
   static withResolver() {
-    let resolve37;
+    let resolve38;
     let reject;
     const promise = new Promise((res, rej) => {
-      resolve37 = res;
+      resolve38 = res;
       reject = rej;
     });
-    return { promise, resolve: resolve37, reject };
+    return { promise, resolve: resolve38, reject };
   }
 };
@@ -63117,7 +63728,7 @@ function createPrompt(view) {
       output
     });
     const screen = new ScreenManager(rl);
-    const { promise, resolve: resolve37, reject } = PromisePolyfill.withResolver();
+    const { promise, resolve: resolve38, reject } = PromisePolyfill.withResolver();
     const cancel = () => reject(new CancelPromptError());
     if (signal) {
       const abort = () => reject(new AbortPromptError({ cause: signal.reason }));
@@ -63141,7 +63752,7 @@ function createPrompt(view) {
       cycle(() => {
         try {
           const nextView = view(config2, (value) => {
-            setImmediate(() => resolve37(value));
+            setImmediate(() => resolve38(value));
           });
           const [content, bottomContent] = typeof nextView === "string" ? [nextView] : nextView;
           screen.render(content, bottomContent);
@@ -64128,9 +64739,9 @@ var import_run_async = __toESM(require_run_async(), 1);
 var import_mute_stream2 = __toESM(require_lib3(), 1);
 var import_ansi_escapes5 = __toESM(require_ansi_escapes(), 1);
 var _2 = {
-  set: (obj, path52 = "", value) => {
+  set: (obj, path54 = "", value) => {
     let pointer = obj;
-    path52.split(".").forEach((key, index, arr) => {
+    path54.split(".").forEach((key, index, arr) => {
       if (key === "__proto__" || key === "constructor")
         return;
       if (index === arr.length - 1) {
@@ -64141,8 +64752,8 @@ var _2 = {
       pointer = pointer[key];
     });
   },
-  get: (obj, path52 = "", defaultValue) => {
-    const travel = (regexp) => String.prototype.split.call(path52, regexp).filter(Boolean).reduce(
+  get: (obj, path54 = "", defaultValue) => {
+    const travel = (regexp) => String.prototype.split.call(path54, regexp).filter(Boolean).reduce(
       // @ts-expect-error implicit any on res[key]
       (res, key) => res !== null && res !== void 0 ? res[key] : res,
       obj
@@ -64256,7 +64867,7 @@ var PromptsRunner = class {
       throw new Error(`Prompt for type ${question.type} not found`);
     }
     let cleanupSignal;
-    const promptFn = isPromptConstructor(prompt2) ? (q2, { signal: signal2 } = {}) => new Promise((resolve37, reject) => {
+    const promptFn = isPromptConstructor(prompt2) ? (q2, { signal: signal2 } = {}) => new Promise((resolve38, reject) => {
       const rl = import_node_readline.default.createInterface(setupReadlineOptions(this.opt));
       rl.resume();
       const onClose = () => {
@@ -64292,7 +64903,7 @@ var PromptsRunner = class {
           cleanupSignal = void 0;
         };
       }
-      activePrompt.run().then(resolve37, reject).finally(cleanup);
+      activePrompt.run().then(resolve38, reject).finally(cleanup);
     }) : prompt2;
     const { signal: moduleSignal } = this.opt;
     if (moduleSignal?.aborted) {
@@ -64506,7 +65117,7 @@ var preferencesCommand = {
 };
 // src/cli/commands/telemetry.ts
-var path51 = __toESM(require("path"));
+var path53 = __toESM(require("path"));
 init_control_config();
 init_otel_hooks();
 init_telemetry_config();
@@ -64591,7 +65202,7 @@ async function handleOff() {
   info("Mission Control will not auto-start. Existing usage rows are kept.");
 }
 async function handleWriteEnv(argv) {
-  const repoPath = path51.resolve(argv.repo);
+  const repoPath = path53.resolve(argv.repo);
   const harnessRoot = resolveHarnessRoot(repoPath);
   const session = readSlotRegistry(harnessRoot, argv.agentId);
   const workDir = argv.workDir ?? session?.workDir ?? repoPath;
@@ -64603,7 +65214,7 @@ async function handleWriteEnv(argv) {
     suffix,
     createdAt: session?.createdAt
   });
-  const envFile = argv.envFile ?? path51.join(workDir, `.env.agent.${argv.agentId}`);
+  const envFile = argv.envFile ?? path53.join(workDir, `.env.agent.${argv.agentId}`);
   const attrs = {
     sessionKey,
     agentId: argv.agentId,
@@ -64622,7 +65233,7 @@ async function handleWriteEnv(argv) {
   success(`Wrote session attribution to ${envFile}`);
 }
 function handlePrintEnv(argv) {
-  const repoPath = path51.resolve(argv.repo);
+  const repoPath = path53.resolve(argv.repo);
   const workDir = argv.workDir ?? repoPath;
   const sessionKey = buildSessionKey({
     branch: argv.branch,