@overdeck/contracts 0.72.0 → 0.73.0

package/dist/index.cjs

@@ -564,6 +564,7 @@ const AgentSnapshot = effect.Schema.Struct({
 		askedAt: effect.Schema.String,
 		questions: effect.Schema.Array(effect.Schema.Struct({
 			question: effect.Schema.String,
+			context: effect.Schema.optional(effect.Schema.String),
 			header: effect.Schema.optional(effect.Schema.String),
 			multiSelect: effect.Schema.optional(effect.Schema.Boolean),
 			options: effect.Schema.Array(effect.Schema.Struct({
@@ -1824,6 +1825,7 @@ const AgentEnrichmentChangedEvent = effect.Schema.Struct({
 			askedAt: effect.Schema.String,
 			questions: effect.Schema.Array(effect.Schema.Struct({
 				question: effect.Schema.String,
+				context: effect.Schema.optional(effect.Schema.String),
 				header: effect.Schema.optional(effect.Schema.String),
 				multiSelect: effect.Schema.optional(effect.Schema.Boolean),
 				options: effect.Schema.Array(effect.Schema.Struct({
@@ -2831,6 +2833,14 @@ const ConversationPullRequestsChangedEvent = effect.Schema.Struct({
 		effective: effect.Schema.NullOr(PullRequestLink)
 	})
 });
+/** Emitted (in-memory only) when a conversation's schedules change (PAN-4657), so the
+* list and the schedule dialog refresh the next-run badge. */
+const ConversationSchedulesChangedEvent = effect.Schema.Struct({
+	type: effect.Schema.Literal("conversation.schedules_changed"),
+	sequence: SequenceNumber,
+	timestamp: effect.Schema.String,
+	payload: effect.Schema.Struct({ conversationName: effect.Schema.String })
+});
 /** Emitted (in-memory only) when a PermissionRequest hook fires or resolves for a conversation. */
 const ConversationPermissionChangedEvent = effect.Schema.Struct({
 	type: effect.Schema.Literal("conversation.permission_changed"),
@@ -3058,6 +3068,7 @@ const DomainEvent = effect.Schema.Union([
 	ConversationMovedEvent,
 	ConversationTitleChangedEvent,
 	ConversationPullRequestsChangedEvent,
+	ConversationSchedulesChangedEvent,
 	ConversationPermissionChangedEvent,
 	ScanStartedEvent,
 	ScanProgressEvent,
@@ -3234,6 +3245,63 @@ const OpenInEditorInput = effect.Schema.Struct({
 	editor: EditorIdSchema,
 	reveal: effect.Schema.optional(effect.Schema.Boolean)
 });
+const BROWSERS = [
+	{
+		id: "default-browser",
+		label: "browser",
+		linuxCommands: [],
+		macApp: null
+	},
+	{
+		id: "chrome",
+		label: "Google Chrome",
+		linuxCommands: ["google-chrome"],
+		macApp: "Google Chrome"
+	},
+	{
+		id: "chromium",
+		label: "Chromium",
+		linuxCommands: ["chromium", "chromium-browser"],
+		macApp: "Chromium"
+	},
+	{
+		id: "firefox",
+		label: "Firefox",
+		linuxCommands: ["firefox"],
+		macApp: "Firefox"
+	},
+	{
+		id: "brave",
+		label: "Brave",
+		linuxCommands: ["brave-browser"],
+		macApp: "Brave Browser"
+	},
+	{
+		id: "edge",
+		label: "Microsoft Edge",
+		linuxCommands: ["microsoft-edge"],
+		macApp: "Microsoft Edge"
+	},
+	{
+		id: "vivaldi",
+		label: "Vivaldi",
+		linuxCommands: ["vivaldi"],
+		macApp: "Vivaldi"
+	}
+];
+const BrowserIdSchema = effect.Schema.Literals([
+	"default-browser",
+	"chrome",
+	"chromium",
+	"firefox",
+	"brave",
+	"edge",
+	"vivaldi"
+]);
+const OpenInBrowserInput = effect.Schema.Struct({
+	path: effect.Schema.String,
+	browser: BrowserIdSchema
+});
 //#endregion
 //#region src/effort.ts
 /**
@@ -3294,7 +3362,9 @@ const WS_METHODS = {
 	sendTerminalInput: "pan.sendTerminalInput",
 	resizeTerminal: "pan.resizeTerminal",
 	shellOpenInEditor: "pan.shellOpenInEditor",
-	getAvailableEditors: "pan.getAvailableEditors"
+	getAvailableEditors: "pan.getAvailableEditors",
+	shellOpenInBrowser: "pan.shellOpenInBrowser",
+	getAvailableBrowsers: "pan.getAvailableBrowsers"
 };
 var PanRpcError = class extends effect.Schema.TaggedErrorClass()("PanRpcError", {
 	message: effect.Schema.String,
@@ -3740,6 +3810,16 @@ const GetAvailableEditorsRpc = effect_unstable_rpc_Rpc.make(WS_METHODS.getAvaila
 	}),
 	error: PanRpcError
 });
+/** Open a local file in a browser (PAN-4762) */
+const ShellOpenInBrowserRpc = effect_unstable_rpc_Rpc.make(WS_METHODS.shellOpenInBrowser, {
+	payload: OpenInBrowserInput,
+	error: PanRpcError
+});
+/** Get available (installed) browsers (PAN-4762) */
+const GetAvailableBrowsersRpc = effect_unstable_rpc_Rpc.make(WS_METHODS.getAvailableBrowsers, {
+	success: effect.Schema.Struct({ browsers: effect.Schema.Array(BrowserIdSchema) }),
+	error: PanRpcError
+});
 const DiscoveredSessionListResult = effect.Schema.Struct({
 	sessions: effect.Schema.Array(DiscoveredSessionSnapshot),
 	count: effect.Schema.Number,
@@ -3900,7 +3980,7 @@ const GetConversationStatsRpc = effect_unstable_rpc_Rpc.make(WS_METHODS.getConve
 	error: PanRpcError
 });
 /** All Overdeck WebSocket RPC methods */
-const PanRpcGroup = effect_unstable_rpc_RpcGroup.make(SubscribeDomainEventsRpc, SubscribeIssueEventsRpc, SubscribeTerminalRpc, SubscribeAgentOutputRpc, GetSnapshotRpc, ReplayEventsRpc, ReadWorkspaceFileRpc, ReadFileAtPathRpc, WriteFileAtPathRpc, ResolveFilePathExistsRpc, TerminalOpenRpc, TerminalWriteRpc, TerminalResizeRpc, TerminalCloseRpc, StartPlanningRpc, StartAgentRpc, DeepWipeRpc, SendTerminalInputRpc, ResizeTerminalRpc, SubscribeConversationMessagesRpc, SubscribeProjectSessionTreeRpc, ShellOpenInEditorRpc, GetAvailableEditorsRpc, ScanConversationsRpc, SearchConversationsRpc, ListDiscoveredSessionsRpc, ListSessionsFeedRpc, GetSessionsFeedFacetsRpc, GetDiscoveredSessionRpc, EnrichSessionsRpc, EmbedSessionsRpc, GetConversationCostRpc, GetConversationCostByWorkspaceRpc, GetConversationStatsRpc);
+const PanRpcGroup = effect_unstable_rpc_RpcGroup.make(SubscribeDomainEventsRpc, SubscribeIssueEventsRpc, SubscribeTerminalRpc, SubscribeAgentOutputRpc, GetSnapshotRpc, ReplayEventsRpc, ReadWorkspaceFileRpc, ReadFileAtPathRpc, WriteFileAtPathRpc, ResolveFilePathExistsRpc, TerminalOpenRpc, TerminalWriteRpc, TerminalResizeRpc, TerminalCloseRpc, StartPlanningRpc, StartAgentRpc, DeepWipeRpc, SendTerminalInputRpc, ResizeTerminalRpc, SubscribeConversationMessagesRpc, SubscribeProjectSessionTreeRpc, ShellOpenInEditorRpc, GetAvailableEditorsRpc, ShellOpenInBrowserRpc, GetAvailableBrowsersRpc, ScanConversationsRpc, SearchConversationsRpc, ListDiscoveredSessionsRpc, ListSessionsFeedRpc, GetSessionsFeedFacetsRpc, GetDiscoveredSessionRpc, EnrichSessionsRpc, EmbedSessionsRpc, GetConversationCostRpc, GetConversationCostByWorkspaceRpc, GetConversationStatsRpc);
 //#endregion
 //#region src/agent-runtime-merge.ts
 function defaultRuntimeSnapshot(agentId, timestamp, sequence) {
@@ -5231,6 +5311,10 @@ function applyEvent(state, event) {
 			...state,
 			conversationsListRevision: state.conversationsListRevision + 1
 		};
+		case "conversation.schedules_changed": return {
+			...state,
+			conversationsListRevision: state.conversationsListRevision + 1
+		};
 		case "conversation.permission_changed": {
 			const { conversationName, waiting } = event.payload;
 			if (!waiting) {
@@ -5681,7 +5765,9 @@ const FlywheelLastTick = effect.Schema.Struct({
 	inFlight: effect.Schema.Array(effect.Schema.String),
 	needsYou: effect.Schema.NullOr(effect.Schema.String),
 	/** The assistant message's `createdAt`. */
-	at: effect.Schema.String
+	at: effect.Schema.String,
+	/** The assistant message's id, when the harness records one. */
+	messageId: effect.Schema.optional(effect.Schema.String)
 });
 const FlywheelPolicies = effect.Schema.Struct({
 	auto_pickup_backlog: effect.Schema.Boolean,
@@ -5711,6 +5797,8 @@ const FlywheelInFlightRow = effect.Schema.Struct({
 	pr: effect.Schema.optional(DerivedPrState),
 	/** Set when no configured tracker answered: the state is a guess, not a fact. */
 	trackerUnknown: effect.Schema.optional(effect.Schema.Literal(true)),
+	/** The row folds a feature-<id>-strike workspace onto its base issue (PAN-4752). */
+	strike: effect.Schema.optional(effect.Schema.Literal(true)),
 	/** Live agent panes on this issue. `working` with 0 means nobody is driving it. */
 	liveAgents: effect.Schema.Number,
 	/** The loop named this id in its newest tick marker's in-flight list. */
@@ -6111,10 +6199,15 @@ const HARNESS_CAPABILITY_KEYS = [
 	"hostEffortFlag",
 	"binaryLabel",
 	"installHint",
+	"updateArgs",
+	"npmPackage",
 	"binaryConfigKey",
 	"launchPreflight",
 	"workspaceResolution",
-	"correlatesBySessionId"
+	"correlatesBySessionId",
+	"answersQuestionByMessage",
+	"askAnswerDelivery",
+	"runsOnFlyMachine"
 ];
 const CLAUDE_CODE_CAPABILITIES = {
 	contextChannel: "append-system-prompt-file",
@@ -6129,10 +6222,15 @@ const CLAUDE_CODE_CAPABILITIES = {
 	hostEffortFlag: false,
 	binaryLabel: "Claude Code",
 	installHint: "curl -fsSL https://claude.ai/install.sh | bash",
+	updateArgs: ["update"],
+	npmPackage: "@anthropic-ai/claude-code",
 	binaryConfigKey: null,
 	launchPreflight: "claude-code-model-minimum",
 	workspaceResolution: "claude-project-hash",
-	correlatesBySessionId: false
+	correlatesBySessionId: false,
+	answersQuestionByMessage: true,
+	askAnswerDelivery: "message",
+	runsOnFlyMachine: true
 };
 const OHMYPI_CAPABILITIES = {
 	contextChannel: "append-system-prompt",
@@ -6147,10 +6245,15 @@ const OHMYPI_CAPABILITIES = {
 	hostEffortFlag: false,
 	binaryLabel: "OhMyPi",
 	installHint: null,
+	updateArgs: null,
+	npmPackage: null,
 	binaryConfigKey: null,
 	launchPreflight: null,
 	workspaceResolution: "first-message-only",
-	correlatesBySessionId: true
+	correlatesBySessionId: true,
+	answersQuestionByMessage: false,
+	askAnswerDelivery: "pi-ask-modal",
+	runsOnFlyMachine: false
 };
 const CODEX_CAPABILITIES = {
 	contextChannel: "developer_instructions",
@@ -6165,10 +6268,15 @@ const CODEX_CAPABILITIES = {
 	hostEffortFlag: false,
 	binaryLabel: "Codex CLI",
 	installHint: null,
+	updateArgs: ["update"],
+	npmPackage: "@openai/codex",
 	binaryConfigKey: null,
 	launchPreflight: null,
 	workspaceResolution: "agent-dir",
-	correlatesBySessionId: true
+	correlatesBySessionId: true,
+	answersQuestionByMessage: false,
+	askAnswerDelivery: "message",
+	runsOnFlyMachine: true
 };
 const ACP_CAPABILITIES = {
 	contextChannel: "acp-initial-context",
@@ -6183,10 +6291,15 @@ const ACP_CAPABILITIES = {
 	hostEffortFlag: false,
 	binaryLabel: "Kimi Code CLI",
 	installHint: null,
+	updateArgs: ["upgrade", "--yes"],
+	npmPackage: null,
 	binaryConfigKey: "acp.kimi.binaryPath",
 	launchPreflight: null,
 	workspaceResolution: "agent-dir",
-	correlatesBySessionId: true
+	correlatesBySessionId: true,
+	answersQuestionByMessage: false,
+	askAnswerDelivery: "message",
+	runsOnFlyMachine: false
 };
 const KIMI_CODE_CAPABILITIES = {
 	contextChannel: "initial-message-envelope",
@@ -6201,10 +6314,15 @@ const KIMI_CODE_CAPABILITIES = {
 	hostEffortFlag: false,
 	binaryLabel: "Kimi Code CLI",
 	installHint: null,
+	updateArgs: ["upgrade", "--yes"],
+	npmPackage: null,
 	binaryConfigKey: "kimiCode.binaryPath",
 	launchPreflight: null,
 	workspaceResolution: "first-message-only",
-	correlatesBySessionId: true
+	correlatesBySessionId: true,
+	answersQuestionByMessage: false,
+	askAnswerDelivery: "message",
+	runsOnFlyMachine: false
 };
 const OPENCODE_CAPABILITIES = {
 	contextChannel: "acp-initial-context",
@@ -6219,10 +6337,15 @@ const OPENCODE_CAPABILITIES = {
 	hostEffortFlag: true,
 	binaryLabel: "OpenCode",
 	installHint: null,
+	updateArgs: ["upgrade"],
+	npmPackage: "opencode-ai",
 	binaryConfigKey: null,
 	launchPreflight: null,
 	workspaceResolution: "agent-dir",
-	correlatesBySessionId: true
+	correlatesBySessionId: true,
+	answersQuestionByMessage: false,
+	askAnswerDelivery: "message",
+	runsOnFlyMachine: false
 };
 const MUSE_CAPABILITIES = {
 	contextChannel: "append-system-prompt-file",
@@ -6237,10 +6360,15 @@ const MUSE_CAPABILITIES = {
 	hostEffortFlag: false,
 	binaryLabel: "Muse Code",
 	installHint: null,
+	updateArgs: null,
+	npmPackage: null,
 	binaryConfigKey: null,
 	launchPreflight: null,
 	workspaceResolution: "first-message-only",
-	correlatesBySessionId: true
+	correlatesBySessionId: true,
+	answersQuestionByMessage: false,
+	askAnswerDelivery: "message",
+	runsOnFlyMachine: false
 };
 const PRIME_AGENT_CAPABILITIES = {
 	contextChannel: "prime-agent-append-system-prompt",
@@ -6255,10 +6383,15 @@ const PRIME_AGENT_CAPABILITIES = {
 	hostEffortFlag: false,
 	binaryLabel: "Prime Agent",
 	installHint: null,
+	updateArgs: null,
+	npmPackage: null,
 	binaryConfigKey: null,
 	launchPreflight: null,
 	workspaceResolution: "first-message-only",
-	correlatesBySessionId: true
+	correlatesBySessionId: true,
+	answersQuestionByMessage: false,
+	askAnswerDelivery: "message",
+	runsOnFlyMachine: false
 };
 //#endregion
 //#region src/harness-behavior.ts
@@ -6686,7 +6819,12 @@ const TELEMETRY_CLI_VERBS = [
 ];
 const TELEMETRY_PROPERTY_DOMAINS = {
 	agent_spawn_mode: ["spawn-and-send", "spawn-work-and-send"],
-	answer_type: ["custom", "selection"],
+	answer_type: [
+		"custom",
+		"selection",
+		"note",
+		"selection+note"
+	],
 	auto_merge_variant: ["segmented", "badge"],
 	boolean: [false, true],
 	cli_verb: TELEMETRY_CLI_VERBS,
@@ -7219,29 +7357,35 @@ const COMPOSER_COMMAND_MANIFEST = [
 			"add"
 		],
 		"display": "/pan skills pack add",
-		"description": "Register a git skill pack at the commit a ref resolves to (enables nothing)",
+		"description": "Register a git skill pack at the commit a ref resolves to (enables nothing); known packs default the url and ref",
 		"args": [{
 			"name": "id",
 			"required": true,
 			"variadic": false
 		}, {
 			"name": "url",
-			"required": true,
+			"required": false,
 			"variadic": false
 		}],
 		"options": [
 			{
 				"flags": "--ref <ref>",
-				"description": "Tag or branch to pin",
+				"description": "Tag, branch or commit to pin (default: the known pack ref)",
 				"required": true,
 				"valueHint": "ref"
 			},
 			{
 				"flags": "--adapter <adapter>",
-				"description": "plain, claude-plugin, or deft-readonly",
+				"description": "plain, claude-plugin, deft-readonly, or gstack-runtime",
 				"required": true,
 				"valueHint": "adapter"
 			},
+			{
+				"flags": "--browser",
+				"description": "Also build the browser runtime (gstack; asks separately)",
+				"required": false,
+				"valueHint": null
+			},
 			{
 				"flags": "--yes",
 				"description": "Trust the resolved commit without asking",
@@ -7280,6 +7424,33 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"aliases": [],
 		"category": "Core"
 	},
+	{
+		"id": "pan-skills-pack-browser",
+		"path": [
+			"skills",
+			"pack",
+			"browser"
+		],
+		"display": "/pan skills pack browser",
+		"description": "Turn a runtime pack's browser runtime on or off (gstack)",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}, {
+			"name": "state",
+			"required": false,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--yes",
+			"description": "Trust without asking",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Core"
+	},
 	{
 		"id": "pan-skills-pack-list",
 		"path": [
@@ -7348,7 +7519,7 @@ const COMPOSER_COMMAND_MANIFEST = [
 			"gc"
 		],
 		"display": "/pan skills pack gc",
-		"description": "Remove unused skill pack mounts and dangling launch links",
+		"description": "Remove unused skill pack mounts, dangling launch links, stale renders and orphaned pack state",
 		"args": [],
 		"options": [{
 			"flags": "--max-age-days <n>",
@@ -7426,7 +7597,7 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"id": "pan-skills-deft",
 		"path": ["skills", "deft"],
 		"display": "/pan skills deft",
-		"description": "Deft Directive detection, ownership report, and managed mode",
+		"description": "Deft Directive detection, managed mode, and running an issue on Deft",
 		"args": [],
 		"options": [],
 		"aliases": [],
@@ -7499,6 +7670,98 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"aliases": [],
 		"category": "Core"
 	},
+	{
+		"id": "pan-skills-deft-use",
+		"path": [
+			"skills",
+			"deft",
+			"use"
+		],
+		"display": "/pan skills deft use",
+		"description": "Run an issue on Deft Directive's pipeline: install Directive into its workspace, hidden from git",
+		"args": [{
+			"name": "issue",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--start",
+			"description": "Start the work agent afterwards (pan start)",
+			"required": false,
+			"valueHint": null
+		}, {
+			"flags": "--json",
+			"description": "Output as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Core"
+	},
+	{
+		"id": "pan-skills-deft-back",
+		"path": [
+			"skills",
+			"deft",
+			"back"
+		],
+		"display": "/pan skills deft back",
+		"description": "Switch an issue back to Overdeck's pipeline: save the Deft state, then remove the install",
+		"args": [{
+			"name": "issue",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--json",
+			"description": "Output as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Core"
+	},
+	{
+		"id": "pan-skills-deft-save",
+		"path": [
+			"skills",
+			"deft",
+			"save"
+		],
+		"display": "/pan skills deft save",
+		"description": "Commit the issue's Deft state archive under .pan/deft/<ISSUE>/",
+		"args": [{
+			"name": "issue",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "Core"
+	},
+	{
+		"id": "pan-skills-deft-show",
+		"path": [
+			"skills",
+			"deft",
+			"show"
+		],
+		"display": "/pan skills deft show",
+		"description": "Show an issue's pipeline, Deft install, drift, and merge-guard verdict",
+		"args": [{
+			"name": "issue",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--json",
+			"description": "Output as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Core"
+	},
 	{
 		"id": "pan-pair",
 		"path": ["pair"],
@@ -7568,48 +7831,63 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"category": "CLI"
 	},
 	{
-		"id": "pan-token",
-		"path": ["token"],
-		"display": "/pan token",
-		"description": "Create, list or revoke scoped access tokens (see configuration/remote-access.mdx)",
+		"id": "pan-machines",
+		"path": ["machines"],
+		"display": "/pan machines",
+		"description": "Link this dashboard to other machines and manage the links (see configuration/linked-machines.mdx)",
 		"args": [],
 		"options": [],
 		"aliases": [],
 		"category": "CLI"
 	},
 	{
-		"id": "pan-token-create",
-		"path": ["token", "create"],
-		"display": "/pan token create",
-		"description": "Create a scoped access token and print it once",
+		"id": "pan-machines-link",
+		"path": ["machines", "link"],
+		"display": "/pan machines link",
+		"description": "Link to the machine whose `pan pair` link this is (links both ways unless --one-way)",
 		"args": [{
-			"name": "name",
+			"name": "pairing-url",
 			"required": true,
 			"variadic": false
 		}],
-		"options": [{
-			"flags": "--scopes <list>",
-			"description": "Comma-separated scopes: read:events, read:state, read:conversations, tell, operate, admin",
-			"required": true,
-			"valueHint": "list"
-		}, {
-			"flags": "--json",
-			"description": "Print { id, name, scopes, token } as JSON",
-			"required": false,
-			"valueHint": null
-		}],
+		"options": [
+			{
+				"flags": "--one-way",
+				"description": "Only this machine reaches the other; do not give it a link back",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--agent-fenced",
+				"description": "Agent-fenced access: forwarded requests are never operator-level",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--allow-loopback",
+				"description": "Accept a localhost pairing link (both servers on this host)",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--json",
+				"description": "Print the new link as JSON",
+				"required": false,
+				"valueHint": null
+			}
+		],
 		"aliases": [],
 		"category": "CLI"
 	},
 	{
-		"id": "pan-token-list",
-		"path": ["token", "list"],
-		"display": "/pan token list",
-		"description": "List access tokens with scopes and created, last-used and revoked times",
+		"id": "pan-machines-list",
+		"path": ["machines", "list"],
+		"display": "/pan machines list",
+		"description": "List linked machines with state and route, then the machines that link here",
 		"args": [],
 		"options": [{
 			"flags": "--json",
-			"description": "Print the tokens as JSON",
+			"description": "Print { self, links, inbound } as JSON",
 			"required": false,
 			"valueHint": null
 		}],
@@ -7617,84 +7895,758 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"category": "CLI"
 	},
 	{
-		"id": "pan-token-revoke",
-		"path": ["token", "revoke"],
-		"display": "/pan token revoke",
-		"description": "Revoke an access token and close its live connections",
+		"id": "pan-machines-unlink",
+		"path": ["machines", "unlink"],
+		"display": "/pan machines unlink",
+		"description": "Remove a link by label, environment id or link id, revoking the token the other machine holds",
 		"args": [{
-			"name": "id",
+			"name": "target",
 			"required": true,
 			"variadic": false
 		}],
-		"options": [],
+		"options": [{
+			"flags": "--keep-server",
+			"description": "For an SSH machine this dashboard started: leave its Overdeck server running; for a Fly machine: do not destroy it",
+			"required": false,
+			"valueHint": null
+		}, {
+			"flags": "--json",
+			"description": "Print { ok, peerNotified, ssh, fly } as JSON",
+			"required": false,
+			"valueHint": null
+		}],
 		"aliases": [],
 		"category": "CLI"
 	},
 	{
-		"id": "pan-issues",
-		"path": ["issues"],
-		"display": "/pan issues",
-		"description": "List and triage work across configured trackers",
-		"args": [],
+		"id": "pan-machines-forward",
+		"path": ["machines", "forward"],
+		"display": "/pan machines forward",
+		"description": "Forward a TCP port of a linked machine to 127.0.0.1 here and print the URL (for a dev-server preview)",
+		"args": [{
+			"name": "machine",
+			"required": false,
+			"variadic": false
+		}, {
+			"name": "port",
+			"required": false,
+			"variadic": false
+		}],
 		"options": [
 			{
-				"flags": "--all",
-				"description": "Include closed issues",
-				"required": false,
-				"valueHint": null
-			},
-			{
-				"flags": "--mine",
-				"description": "Show only my assigned issues",
-				"required": false,
-				"valueHint": null
-			},
-			{
-				"flags": "--json",
-				"description": "Output as JSON",
+				"flags": "--list",
+				"description": "List the open forwards",
 				"required": false,
 				"valueHint": null
 			},
 			{
-				"flags": "--tracker <type>",
-				"description": "Query specific tracker (linear/github/gitlab)",
+				"flags": "--stop <id>",
+				"description": "Close a forward",
 				"required": true,
-				"valueHint": "type"
-			},
-			{
-				"flags": "--all-trackers",
-				"description": "Query all configured trackers",
-				"required": false,
-				"valueHint": null
+				"valueHint": "id"
 			},
 			{
-				"flags": "--triage",
-				"description": "Show triage queue",
+				"flags": "--json",
+				"description": "Print JSON",
 				"required": false,
 				"valueHint": null
 			}
 		],
 		"aliases": [],
-		"category": "Lifecycle"
+		"category": "CLI"
 	},
 	{
-		"id": "pan-show",
-		"path": ["show"],
-		"display": "/pan show",
-		"description": "Unified lens: derived issue state, CV, context, health for one issue",
-		"args": [{
-			"name": "id",
-			"required": true,
-			"variadic": false
+		"id": "pan-machines-directory",
+		"path": ["machines", "directory"],
+		"display": "/pan machines directory",
+		"description": "List this account's machines in the overdeck.ai directory, with pending approvals and joins",
+		"args": [],
+		"options": [{
+			"flags": "--json",
+			"description": "Print the GET /api/directory response as JSON",
+			"required": false,
+			"valueHint": null
 		}],
-		"options": [
-			{
-				"flags": "--cv",
-				"description": "Agent work history only",
-				"required": false,
-				"valueHint": null
-			},
-			{
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-machines-join",
+		"path": ["machines", "join"],
+		"display": "/pan machines join",
+		"description": "Ask your other machines (or one) to link with this one; confirm the code on both screens",
+		"args": [],
+		"options": [{
+			"flags": "--to <machine>",
+			"description": "Ask only this machine (label or environment id)",
+			"required": true,
+			"valueHint": "machine"
+		}, {
+			"flags": "--json",
+			"description": "Print { requestId, sas, fingerprint, approver } as JSON once a machine opens the request",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-machines-accept",
+		"path": ["machines", "accept"],
+		"display": "/pan machines accept",
+		"description": "Accept a join request after checking that both screens show the same code",
+		"args": [{
+			"name": "request-id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-machines-reject",
+		"path": ["machines", "reject"],
+		"display": "/pan machines reject",
+		"description": "Reject an approval or join request",
+		"args": [{
+			"name": "request-id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-machines-approve",
+		"path": ["machines", "approve"],
+		"display": "/pan machines approve",
+		"description": "Open an approval request, show its code and approve it",
+		"args": [{
+			"name": "request-id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--yes",
+			"description": "Approve without asking",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-machines-forget",
+		"path": ["machines", "forget"],
+		"display": "/pan machines forget",
+		"description": "Remove a machine from the overdeck.ai directory (label or environment id)",
+		"args": [{
+			"name": "machine",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-machines-versions",
+		"path": ["machines", "versions"],
+		"display": "/pan machines versions",
+		"description": "Show Overdeck and harness CLI versions on every machine",
+		"args": [],
+		"options": [{
+			"flags": "--json",
+			"description": "Print { rows } as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-machines-update",
+		"path": ["machines", "update"],
+		"display": "/pan machines update",
+		"description": "Update Overdeck and the harness CLIs on every online machine, after running turns end",
+		"args": [],
+		"options": [
+			{
+				"flags": "--now",
+				"description": "Do not wait for running turns to end",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--machine <label>",
+				"description": "Only this machine; repeat for more",
+				"required": true,
+				"valueHint": "label"
+			},
+			{
+				"flags": "--cancel",
+				"description": "Cancel waiting updates",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--json",
+				"description": "Print { started, skipped } as JSON",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-machines-add-ssh",
+		"path": ["machines", "add-ssh"],
+		"display": "/pan machines add-ssh",
+		"description": "Link a machine reached over SSH: this dashboard starts or adopts Overdeck there and forwards a port to it",
+		"args": [{
+			"name": "host",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [
+			{
+				"flags": "--pan-path <path>",
+				"description": "Absolute path to pan on the host (default: pan from its login PATH)",
+				"required": true,
+				"valueHint": "path"
+			},
+			{
+				"flags": "--one-way",
+				"description": "Only this machine reaches the other; do not give it a link back",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--agent-fenced",
+				"description": "Agent-fenced access: forwarded requests are never operator-level",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--json",
+				"description": "Print the new link as JSON",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-machines-test-ssh",
+		"path": ["machines", "test-ssh"],
+		"display": "/pan machines test-ssh",
+		"description": "Check that this dashboard reaches <host> over SSH and that it has the same pan version",
+		"args": [{
+			"name": "host",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--pan-path <path>",
+			"description": "Absolute path to pan on the host (default: pan from its login PATH)",
+			"required": true,
+			"valueHint": "path"
+		}, {
+			"flags": "--json",
+			"description": "Print { reachable, panVersion, localVersion, versionMatches, error, message } as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-machines-add-project",
+		"path": ["machines", "add-project"],
+		"display": "/pan machines add-project",
+		"description": "Clone a linked machine's project here (or, with --to, this machine's project there) and copy its .env-style files (0600, never overwriting)",
+		"args": [{
+			"name": "machine",
+			"required": true,
+			"variadic": false
+		}, {
+			"name": "project-key",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [
+			{
+				"flags": "--to <machine>",
+				"description": "Add this machine's project <project-key> to <machine> instead",
+				"required": true,
+				"valueHint": "machine"
+			},
+			{
+				"flags": "--file <path>",
+				"description": "Also copy this git-ignored file; repeat for more",
+				"required": true,
+				"valueHint": "path"
+			},
+			{
+				"flags": "--no-env",
+				"description": "Do not copy .env, .envrc and .dev.vars",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--parent-dir <dir>",
+				"description": "Clone under this directory (default: the projects folder)",
+				"required": true,
+				"valueHint": "dir"
+			},
+			{
+				"flags": "--json",
+				"description": "Print the finished add job as JSON",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-machines-who",
+		"path": ["machines", "who"],
+		"display": "/pan machines who",
+		"description": "Show which machines run agents or conversations for an issue",
+		"args": [{
+			"name": "issue",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--json",
+			"description": "Print the fleet answer as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-machines-add-fly",
+		"path": ["machines", "add-fly"],
+		"display": "/pan machines add-fly",
+		"description": "Start a Fly.io VM that runs Overdeck, link it from here, and optionally start a Claude Code or Codex conversation on it",
+		"args": [],
+		"options": [
+			{
+				"flags": "--project <key>",
+				"description": "Clone this project onto the VM (GitHub projects only)",
+				"required": true,
+				"valueHint": "key"
+			},
+			{
+				"flags": "--message <text>",
+				"description": "Start a conversation with this first message (needs --project)",
+				"required": true,
+				"valueHint": "text"
+			},
+			{
+				"flags": "--harness <name>",
+				"description": "Harness for the conversation: claude-code (default) or codex",
+				"required": true,
+				"valueHint": "name"
+			},
+			{
+				"flags": "--model <id>",
+				"description": "Model for the conversation (required with --harness codex)",
+				"required": true,
+				"valueHint": "id"
+			},
+			{
+				"flags": "--effort <level>",
+				"description": "Reasoning effort for the conversation",
+				"required": true,
+				"valueHint": "level"
+			},
+			{
+				"flags": "--region <code>",
+				"description": "Fly region (default: remote.fly.region, else iad)",
+				"required": true,
+				"valueHint": "code"
+			},
+			{
+				"flags": "--image <ref>",
+				"description": "Image (default: remote.fly.image, else registry.fly.io/<app>:latest)",
+				"required": true,
+				"valueHint": "ref"
+			},
+			{
+				"flags": "--json",
+				"description": "Print { link, record, conversation? } as JSON",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-connect",
+		"path": ["connect"],
+		"display": "/pan connect",
+		"description": "Install this machine's server as a lasting service and print one link that links it from another machine (see cli/machines.mdx)",
+		"args": [],
+		"options": [
+			{
+				"flags": "--url <base>",
+				"description": "Address another machine reaches this one at (default: picked automatically)",
+				"required": true,
+				"valueHint": "base"
+			},
+			{
+				"flags": "--label <name>",
+				"description": "Name recorded for the pairing in the activity log",
+				"required": true,
+				"valueHint": "name"
+			},
+			{
+				"flags": "--json",
+				"description": "Print the result as JSON",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-tailscale",
+		"path": ["tailscale"],
+		"display": "/pan tailscale",
+		"description": "Reach this machine over Tailscale: state, setup and tailnet peers (see configuration/tailscale.mdx)",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-tailscale-status",
+		"path": ["tailscale", "status"],
+		"display": "/pan tailscale status",
+		"description": "Show Tailscale state, the next setup step and Overdeck machines on the tailnet",
+		"args": [],
+		"options": [{
+			"flags": "--json",
+			"description": "Print { state, peers } as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-tailscale-setup",
+		"path": ["tailscale", "setup"],
+		"display": "/pan tailscale setup",
+		"description": "Install Tailscale, sign in and turn on protected HTTPS access to this dashboard",
+		"args": [],
+		"options": [{
+			"flags": "--userspace",
+			"description": "On Linux, install for this user without an administrator password",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-token",
+		"path": ["token"],
+		"display": "/pan token",
+		"description": "Create, list or revoke scoped access tokens (see configuration/remote-access.mdx)",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-token-create",
+		"path": ["token", "create"],
+		"display": "/pan token create",
+		"description": "Create a scoped access token and print it once",
+		"args": [{
+			"name": "name",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--scopes <list>",
+			"description": "Comma-separated scopes: read:events, read:state, read:conversations, read:costs, read:settings, tell, operate, approve, forward, admin",
+			"required": true,
+			"valueHint": "list"
+		}, {
+			"flags": "--json",
+			"description": "Print { id, name, scopes, token } as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-token-list",
+		"path": ["token", "list"],
+		"display": "/pan token list",
+		"description": "List access tokens with scopes and created, last-used and revoked times",
+		"args": [],
+		"options": [{
+			"flags": "--json",
+			"description": "Print the tokens as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-token-revoke",
+		"path": ["token", "revoke"],
+		"display": "/pan token revoke",
+		"description": "Revoke an access token and close its live connections",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-mcp",
+		"path": ["mcp"],
+		"display": "/pan mcp",
+		"description": "Serve Overdeck to MCP clients (see configuration/mcp.mdx)",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-mcp-serve",
+		"path": ["mcp", "serve"],
+		"display": "/pan mcp serve",
+		"description": "Serve Overdeck as an MCP server over stdio (token from OVERDECK_MCP_TOKEN; see configuration/mcp.mdx)",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-triggers",
+		"path": ["triggers"],
+		"display": "/pan triggers",
+		"description": "Manage webhook triggers that message or start conversations (see configuration/triggers.mdx)",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-triggers-add",
+		"path": ["triggers", "add"],
+		"display": "/pan triggers add",
+		"description": "Create a trigger and print its secret URL once",
+		"args": [{
+			"name": "name",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [
+			{
+				"flags": "--conversation <name-or-id>",
+				"description": "Send each event as a message to this conversation",
+				"required": true,
+				"valueHint": "name-or-id"
+			},
+			{
+				"flags": "--project <key>",
+				"description": "Start a new conversation in this project for each event",
+				"required": true,
+				"valueHint": "key"
+			},
+			{
+				"flags": "--prompt <text>",
+				"description": "Prompt template placed before the event (required for --project)",
+				"required": true,
+				"valueHint": "text"
+			},
+			{
+				"flags": "--prompt-file <path>",
+				"description": "Read the prompt template from a file",
+				"required": true,
+				"valueHint": "path"
+			},
+			{
+				"flags": "--verify <kind>",
+				"description": "Signature check: none, github or stripe",
+				"required": true,
+				"valueHint": "kind"
+			},
+			{
+				"flags": "--signing-secret <value>",
+				"description": "HMAC signing secret (github generates one when omitted)",
+				"required": true,
+				"valueHint": "value"
+			},
+			{
+				"flags": "--model <id>",
+				"description": "Model for conversations a project trigger starts",
+				"required": true,
+				"valueHint": "id"
+			},
+			{
+				"flags": "--harness <name>",
+				"description": "Harness for conversations a project trigger starts",
+				"required": true,
+				"valueHint": "name"
+			},
+			{
+				"flags": "--effort <level>",
+				"description": "Reasoning effort for conversations a project trigger starts",
+				"required": true,
+				"valueHint": "level"
+			},
+			{
+				"flags": "--inbox",
+				"description": "Hold events while this machine is offline in an overdeck.ai inbox (Anywhere plan; needs the dashboard)",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--json",
+				"description": "Print { trigger, hookPath, url, localUrl, funnelCommand, generatedSigningSecret } as JSON",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-triggers-list",
+		"path": ["triggers", "list"],
+		"display": "/pan triggers list",
+		"description": "List triggers with their targets and verification; never prints secrets",
+		"args": [],
+		"options": [{
+			"flags": "--json",
+			"description": "Print the triggers as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-triggers-remove",
+		"path": ["triggers", "remove"],
+		"display": "/pan triggers remove",
+		"description": "Remove a trigger; its URL answers 404 at once",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-triggers-set-secret",
+		"path": ["triggers", "set-secret"],
+		"display": "/pan triggers set-secret",
+		"description": "Set the signing secret of a github or stripe trigger (reads one line from stdin without --secret)",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--secret <value>",
+			"description": "The signing secret",
+			"required": true,
+			"valueHint": "value"
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-issues",
+		"path": ["issues"],
+		"display": "/pan issues",
+		"description": "List and triage work across configured trackers",
+		"args": [],
+		"options": [
+			{
+				"flags": "--all",
+				"description": "Include closed issues",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--mine",
+				"description": "Show only my assigned issues",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--json",
+				"description": "Output as JSON",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--tracker <type>",
+				"description": "Query specific tracker (linear/github/gitlab)",
+				"required": true,
+				"valueHint": "type"
+			},
+			{
+				"flags": "--all-trackers",
+				"description": "Query all configured trackers",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--triage",
+				"description": "Show triage queue",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "Lifecycle"
+	},
+	{
+		"id": "pan-show",
+		"path": ["show"],
+		"display": "/pan show",
+		"description": "Unified lens: derived issue state, CV, context, health for one issue",
+		"args": [{
+			"name": "id",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [
+			{
+				"flags": "--cv",
+				"description": "Agent work history only",
+				"required": false,
+				"valueHint": null
+			},
+			{
 				"flags": "--context",
 				"description": "Context engineering state only",
 				"required": false,
@@ -7997,7 +8949,7 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"id": "pan-tell",
 		"path": ["tell"],
 		"display": "/pan tell",
-		"description": "Send message to running agent",
+		"description": "Send message to running agent, or to a linked machine's conversation as @<machine>/<conv>",
 		"args": [{
 			"name": "id",
 			"required": true,
@@ -8007,17 +8959,32 @@ const COMPOSER_COMMAND_MANIFEST = [
 			"required": true,
 			"variadic": false
 		}],
-		"options": [{
-			"flags": "--force",
-			"description": "Deliver even to a critic or verifier lane that already filed its verdict",
-			"required": false,
-			"valueHint": null
-		}, {
-			"flags": "--steer",
-			"description": "Interrupt the running turn and send now (Claude Code send-now; Ctrl+X Ctrl+S)",
-			"required": false,
-			"valueHint": null
-		}],
+		"options": [
+			{
+				"flags": "--force",
+				"description": "Deliver even to a critic or verifier lane that already filed its verdict",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--steer",
+				"description": "Interrupt the running turn and send now (Claude Code send-now; Ctrl+X Ctrl+S)",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--when-limit-resets",
+				"description": "Queue the message on the server; it sends when the conversation's usage limit resets (conversations only)",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--message-id <id>",
+				"description": "Idempotency key: a repeat with the same id is delivered once",
+				"required": true,
+				"valueHint": "id"
+			}
+		],
 		"aliases": [],
 		"category": "Lifecycle"
 	},
@@ -8746,20 +9713,44 @@ const COMPOSER_COMMAND_MANIFEST = [
 				"valueHint": null
 			},
 			{
-				"flags": "--host",
-				"description": "Bypass workspace docker stack-health gate and spawn on the host",
-				"required": false,
-				"valueHint": null
+				"flags": "--host",
+				"description": "Bypass workspace docker stack-health gate and spawn on the host",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--yes",
+				"description": "Confirm --host in non-interactive contexts",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--skip-freshness",
+				"description": "Bypass the plan-freshness preflight and spawn even if the plan names files deleted since it was written",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--machine <label|auto>",
+				"description": "Start the issue agent on a linked machine (label or environment id), or auto to place it by load",
+				"required": true,
+				"valueHint": "label|auto"
 			},
 			{
-				"flags": "--yes",
-				"description": "Confirm --host in non-interactive contexts",
+				"flags": "--needs <tags>",
+				"description": "Comma-separated capability tags the machine must have (docker, gpu, ios-sim, …)",
+				"required": true,
+				"valueHint": "tags"
+			},
+			{
+				"flags": "--push-first",
+				"description": "With --machine: push unpushed workspace commits before starting on the other machine",
 				"required": false,
 				"valueHint": null
 			},
 			{
-				"flags": "--skip-freshness",
-				"description": "Bypass the plan-freshness preflight and spawn even if the plan names files deleted since it was written",
+				"flags": "--ignore-unpushed",
+				"description": "With --machine: start even though local workspace commits are not pushed",
 				"required": false,
 				"valueHint": null
 			}
@@ -10236,6 +11227,56 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"aliases": [],
 		"category": "CLI"
 	},
+	{
+		"id": "pan-account",
+		"path": ["account"],
+		"display": "/pan account",
+		"description": "Optional overdeck.ai sign-in for this machine (directory and hosted features)",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-account-login",
+		"path": ["account", "login"],
+		"display": "/pan account login",
+		"description": "Sign in to overdeck.ai with the device flow and store this machine's device token",
+		"args": [],
+		"options": [{
+			"flags": "--base-url <url>",
+			"description": "Account service URL (default https://account.overdeck.ai, or OVERDECK_ACCOUNT_URL)",
+			"required": true,
+			"valueHint": "url"
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-account-status",
+		"path": ["account", "status"],
+		"display": "/pan account status",
+		"description": "Show the signed-in GitHub account and this device",
+		"args": [],
+		"options": [{
+			"flags": "--json",
+			"description": "Output in JSON format",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "CLI"
+	},
+	{
+		"id": "pan-account-logout",
+		"path": ["account", "logout"],
+		"display": "/pan account logout",
+		"description": "Revoke this machine's device token and delete it locally",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "CLI"
+	},
 	{
 		"id": "pan-test",
 		"path": ["test"],
@@ -12777,6 +13818,28 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"aliases": [],
 		"category": "Admin"
 	},
+	{
+		"id": "pan-admin-config-set",
+		"path": [
+			"admin",
+			"config",
+			"set"
+		],
+		"display": "/pan admin config set",
+		"description": "Set one config.yaml value (dotted snake_case key; the value is parsed as YAML), keeping comments",
+		"args": [{
+			"name": "key",
+			"required": true,
+			"variadic": false
+		}, {
+			"name": "value",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "Admin"
+	},
 	{
 		"id": "pan-admin-hooks",
 		"path": ["admin", "hooks"],
@@ -13261,6 +14324,68 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"aliases": ["transcript"],
 		"category": "Conversation"
 	},
+	{
+		"id": "pan-conversations-pending",
+		"path": ["conversations", "pending"],
+		"display": "/pan conversations pending",
+		"description": "List messages queued to send when the conversation's usage limit resets",
+		"args": [{
+			"name": "conv",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--json",
+			"description": "Print JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Conversation"
+	},
+	{
+		"id": "pan-conversations-pull",
+		"path": ["conversations", "pull"],
+		"display": "/pan conversations pull",
+		"description": "Make this machine own a conversation that runs on a linked machine (@<machine>/<conv>)",
+		"args": [{
+			"name": "conv",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--stop-turn",
+			"description": "Stop a running turn instead of waiting for it",
+			"required": false,
+			"valueHint": null
+		}, {
+			"flags": "--json",
+			"description": "Print the final job state as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Conversation"
+	},
+	{
+		"id": "pan-conversations-reclaim",
+		"path": ["conversations", "reclaim"],
+		"display": "/pan conversations reclaim",
+		"description": "Take back a conversation this machine released when the other machine does not run it",
+		"args": [{
+			"name": "conv",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--force",
+			"description": "Reclaim even when the other machine cannot be asked",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Conversation"
+	},
 	{
 		"id": "pan-conversations-move",
 		"path": ["conversations", "move"],
@@ -13308,11 +14433,206 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"display": "/pan conversations unlink-pr",
 		"description": "Unlink a pull request from a conversation (the sweep will not re-add it)",
 		"args": [{
-			"name": "query",
-			"required": true,
-			"variadic": false
-		}, {
-			"name": "ref",
+			"name": "query",
+			"required": true,
+			"variadic": false
+		}, {
+			"name": "ref",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "Conversation"
+	},
+	{
+		"id": "pan-conversations-prs",
+		"path": ["conversations", "prs"],
+		"display": "/pan conversations prs",
+		"description": "List the pull requests linked to a conversation (* = the one shown)",
+		"args": [{
+			"name": "query",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--json",
+			"description": "Output { links, effective } as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Conversation"
+	},
+	{
+		"id": "pan-conversations-auto-settle-on-merge",
+		"path": ["conversations", "auto-settle-on-merge"],
+		"display": "/pan conversations auto-settle-on-merge",
+		"description": "Show or set (on|off) settling conversations once all their linked PRs are merged or closed (default on)",
+		"args": [{
+			"name": "value",
+			"required": false,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "Conversation"
+	},
+	{
+		"id": "pan-conversations-auto-settle",
+		"path": ["conversations", "auto-settle"],
+		"display": "/pan conversations auto-settle",
+		"description": "Show or set (on|off|inherit) one conversation's auto-settle-on-merge override",
+		"args": [{
+			"name": "query",
+			"required": true,
+			"variadic": false
+		}, {
+			"name": "value",
+			"required": false,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "Conversation"
+	},
+	{
+		"id": "pan-conversations-auto-settle-idle-days",
+		"path": ["conversations", "auto-settle-idle-days"],
+		"display": "/pan conversations auto-settle-idle-days",
+		"description": "Show or set how many days without activity before an operator conversation is settled (0 = off, default 3)",
+		"args": [{
+			"name": "days",
+			"required": false,
+			"variadic": false
+		}],
+		"options": [],
+		"aliases": [],
+		"category": "Conversation"
+	},
+	{
+		"id": "pan-conversations-schedule",
+		"path": ["conversations", "schedule"],
+		"display": "/pan conversations schedule",
+		"description": "Run a prompt in a conversation on a recurring schedule (Overdeck fires it, even after restarts)",
+		"args": [],
+		"options": [],
+		"aliases": [],
+		"category": "Conversation"
+	},
+	{
+		"id": "pan-conversations-schedule-add",
+		"path": [
+			"conversations",
+			"schedule",
+			"add"
+		],
+		"display": "/pan conversations schedule add",
+		"description": "Add a schedule; <conv> is self, a conversation number, a name, or a title match",
+		"args": [{
+			"name": "conv",
+			"required": true,
+			"variadic": false
+		}],
+		"options": [
+			{
+				"flags": "--cron <expr>",
+				"description": "5-field cron expression, evaluated in --tz",
+				"required": true,
+				"valueHint": "expr"
+			},
+			{
+				"flags": "--hourly",
+				"description": "Every hour on the hour",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--daily <HH:MM>",
+				"description": "Every day at HH:MM",
+				"required": true,
+				"valueHint": "HH:MM"
+			},
+			{
+				"flags": "--weekdays <HH:MM>",
+				"description": "Monday to Friday at HH:MM",
+				"required": true,
+				"valueHint": "HH:MM"
+			},
+			{
+				"flags": "--weekly <spec>",
+				"description": "Once a week: \"<day> HH:MM\", e.g. \"mon 09:00\"",
+				"required": true,
+				"valueHint": "spec"
+			},
+			{
+				"flags": "--prompt <text>",
+				"description": "The prompt to send",
+				"required": true,
+				"valueHint": "text"
+			},
+			{
+				"flags": "--prompt-file <path>",
+				"description": "Read the prompt from a file",
+				"required": true,
+				"valueHint": "path"
+			},
+			{
+				"flags": "--tz <zone>",
+				"description": "IANA time zone (default: this machine's zone)",
+				"required": true,
+				"valueHint": "zone"
+			},
+			{
+				"flags": "--paused",
+				"description": "Create the schedule paused",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--json",
+				"description": "Output the created schedule as JSON",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "Conversation"
+	},
+	{
+		"id": "pan-conversations-schedule-list",
+		"path": [
+			"conversations",
+			"schedule",
+			"list"
+		],
+		"display": "/pan conversations schedule list",
+		"description": "List schedules (all, or one conversation's)",
+		"args": [{
+			"name": "conv",
+			"required": false,
+			"variadic": false
+		}],
+		"options": [{
+			"flags": "--json",
+			"description": "Output as JSON",
+			"required": false,
+			"valueHint": null
+		}],
+		"aliases": [],
+		"category": "Conversation"
+	},
+	{
+		"id": "pan-conversations-schedule-pause",
+		"path": [
+			"conversations",
+			"schedule",
+			"pause"
+		],
+		"display": "/pan conversations schedule pause",
+		"description": "Pause a schedule",
+		"args": [{
+			"name": "id",
 			"required": true,
 			"variadic": false
 		}],
@@ -13321,32 +14641,35 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"category": "Conversation"
 	},
 	{
-		"id": "pan-conversations-prs",
-		"path": ["conversations", "prs"],
-		"display": "/pan conversations prs",
-		"description": "List the pull requests linked to a conversation (* = the one shown)",
+		"id": "pan-conversations-schedule-resume",
+		"path": [
+			"conversations",
+			"schedule",
+			"resume"
+		],
+		"display": "/pan conversations schedule resume",
+		"description": "Resume a paused schedule; the next run is computed from now",
 		"args": [{
-			"name": "query",
+			"name": "id",
 			"required": true,
 			"variadic": false
 		}],
-		"options": [{
-			"flags": "--json",
-			"description": "Output { links, effective } as JSON",
-			"required": false,
-			"valueHint": null
-		}],
+		"options": [],
 		"aliases": [],
 		"category": "Conversation"
 	},
 	{
-		"id": "pan-conversations-auto-archive-on-merge",
-		"path": ["conversations", "auto-archive-on-merge"],
-		"display": "/pan conversations auto-archive-on-merge",
-		"description": "Show or set (on|off) archiving operator conversations once all their linked PRs are merged or closed (default off)",
+		"id": "pan-conversations-schedule-rm",
+		"path": [
+			"conversations",
+			"schedule",
+			"rm"
+		],
+		"display": "/pan conversations schedule rm",
+		"description": "Delete a schedule",
 		"args": [{
-			"name": "value",
-			"required": false,
+			"name": "id",
+			"required": true,
 			"variadic": false
 		}],
 		"options": [],
@@ -13932,6 +15255,30 @@ const COMPOSER_COMMAND_MANIFEST = [
 				"description": "Stop the worker after its first report",
 				"required": false,
 				"valueHint": null
+			},
+			{
+				"flags": "--machine <label|auto>",
+				"description": "Run on a linked machine (label or environment id), or auto to place it by load",
+				"required": true,
+				"valueHint": "label|auto"
+			},
+			{
+				"flags": "--needs <tags>",
+				"description": "Comma-separated capability tags the machine must have (docker, gpu, ios-sim, …)",
+				"required": true,
+				"valueHint": "tags"
+			},
+			{
+				"flags": "--push-first",
+				"description": "With --machine: push unpushed commits before starting on the other machine",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--ignore-unpushed",
+				"description": "With --machine: start even though local commits are not pushed",
+				"required": false,
+				"valueHint": null
 			}
 		],
 		"aliases": [],
@@ -14231,6 +15578,18 @@ const COMPOSER_COMMAND_MANIFEST = [
 				"required": false,
 				"valueHint": null
 			},
+			{
+				"flags": "--machine <label|auto>",
+				"description": "Where to run: a linked machine's label or environment id, or auto",
+				"required": true,
+				"valueHint": "label|auto"
+			},
+			{
+				"flags": "--needs <tags>",
+				"description": "With --machine auto: comma-separated capability tags the machine must have",
+				"required": true,
+				"valueHint": "tags"
+			},
 			{
 				"flags": "--no-wait",
 				"description": "Return without waiting for the lane to start",
@@ -14405,7 +15764,7 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"id": "pan-lane-stop",
 		"path": ["lane", "stop"],
 		"display": "/pan lane stop",
-		"description": "Stop a lane through the conversation stop door",
+		"description": "Stop a lane through the conversation stop door (on its own machine for a remote lane)",
 		"args": [{
 			"name": "lane",
 			"required": true,
@@ -15562,6 +16921,11 @@ const COMPOSER_COMMAND_MANIFEST = [
 			"description": "Exit non-zero if any optional dependency is missing (e.g. Pi binary)",
 			"required": false,
 			"valueHint": null
+		}, {
+			"flags": "--json",
+			"description": "Print every check as JSON (name, status, message, fix); same exit code as text mode",
+			"required": false,
+			"valueHint": null
 		}],
 		"aliases": [],
 		"category": "Core"
@@ -15581,6 +16945,47 @@ const COMPOSER_COMMAND_MANIFEST = [
 		"aliases": [],
 		"category": "Core"
 	},
+	{
+		"id": "pan-diagnose",
+		"path": ["diagnose"],
+		"display": "/pan diagnose",
+		"description": "Collect a redacted diagnostic bundle and start Claude Code or Codex to fix the problem",
+		"args": [],
+		"options": [
+			{
+				"flags": "--harness <harness>",
+				"description": "Harness to start",
+				"required": true,
+				"valueHint": "harness"
+			},
+			{
+				"flags": "--describe <text>",
+				"description": "What went wrong, in your words (saved in the bundle)",
+				"required": true,
+				"valueHint": "text"
+			},
+			{
+				"flags": "--bundle-only",
+				"description": "Write the bundle and print its path; do not start a harness",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--no-issue",
+				"description": "Do not let the session draft or create an upstream issue",
+				"required": false,
+				"valueHint": null
+			},
+			{
+				"flags": "--yes",
+				"description": "Start the harness without asking to confirm the bundle",
+				"required": false,
+				"valueHint": null
+			}
+		],
+		"aliases": [],
+		"category": "CLI"
+	},
 	{
 		"id": "pan-resources",
 		"path": ["resources"],
@@ -15900,6 +17305,11 @@ const COMPOSER_COMMAND_MANIFEST = [
 			"description": "Port to listen on",
 			"required": true,
 			"valueHint": "port"
+		}, {
+			"flags": "--no-open",
+			"description": "Do not open a browser",
+			"required": false,
+			"valueHint": null
 		}],
 		"aliases": [],
 		"category": "CLI"
@@ -16302,6 +17712,39 @@ function isConfiguredPullRequestRepo(ref, repos) {
 	return repos.some((repo) => repo.host === ref.host && repo.repository === ref.repository);
 }
 //#endregion
+//#region src/tracker-issue-ref.ts
+const GITHUB_ISSUE = /^(?:https?:\/\/)?github\.com\/([\w.-]+\/[\w.-]+)\/issues\/(\d+)\/?(?:[?#].*)?$/i;
+const LINEAR_ISSUE = /^(?:https?:\/\/)?linear\.app\/[\w.-]+\/issue\/([A-Za-z]+-\d+)(?:\/[^?#]*)?(?:[?#].*)?$/i;
+function parseTrackerIssueUrl(input) {
+	const text = input.trim();
+	const github = GITHUB_ISSUE.exec(text);
+	if (github) {
+		const number = Number(github[2]);
+		if (!Number.isSafeInteger(number) || number <= 0) return null;
+		return {
+			tracker: "github",
+			repository: github[1].toLowerCase().replace(/\.git$/, ""),
+			number
+		};
+	}
+	const linear = LINEAR_ISSUE.exec(text);
+	if (linear) return {
+		tracker: "linear",
+		identifier: linear[1].toUpperCase()
+	};
+	return null;
+}
+function resolveTrackerIssueId(ref, projects) {
+	for (const project of projects) {
+		const prefix = typeof project?.linearTeam === "string" ? project.linearTeam.trim().toUpperCase() : "";
+		if (!prefix || project.tracker !== ref.tracker) continue;
+		if (ref.tracker === "github") {
+			if (project.githubRepo?.toLowerCase() === ref.repository) return `${prefix}-${ref.number}`;
+		} else if (ref.identifier.slice(0, ref.identifier.lastIndexOf("-")) === prefix) return ref.identifier;
+	}
+	return null;
+}
+//#endregion
 //#region src/conversation-rows.ts
 /**
 * Conversation-row classifiers shared by the dashboard server (`src/lib`) and
@@ -16405,6 +17848,241 @@ function hasToolResult(e) {
 	return !!e.result || (e.resultBytes ?? 0) > 0;
 }
 //#endregion
+//#region src/machines.ts
+/**
+* Secure-channel link protocol version (D-4645-11). Independent of
+* `ENVIRONMENT_PROTOCOL_VERSION`: a peer whose descriptor reports another value,
+* or no `capabilities.machineLinks`, is `unsupported`.
+*/
+const LINK_PROTOCOL_VERSION = 1;
+/** The exact command that installs one Overdeck version (PAN-4654 FR-1, D-2). */
+function overdeckInstallCommand(version) {
+	return `npm install -g @overdeck/core@${version}`;
+}
+/** Route kinds, ranked best to worst (D-10 of the Anywhere PRD). */
+const ROUTE_KINDS = [
+	"lan",
+	"tailnet",
+	"ssh",
+	"public",
+	"direct",
+	"relay"
+];
+const RouteKind = effect.Schema.Literals(ROUTE_KINDS);
+/**
+* Where a route on a link came from. `directory` routes (PAN-2356) are dynamic: offered while the
+* overdeck.ai directory lists the peer, never stored in machine-links.json.
+*/
+const RouteSource = effect.Schema.Literals([
+	"pairing",
+	"manual",
+	"advertised",
+	"directory"
+]);
+/** An endpoint a machine advertises in its descriptor (`lan` and `tailnet` only in this issue). */
+const AdvertisedEndpoint = effect.Schema.Struct({
+	kind: effect.Schema.Literals(["lan", "tailnet"]),
+	/** `tcp://host:port` or `wss://host[:port]/ws/link`. */
+	url: effect.Schema.String
+});
+/** Link supervisor state (FR-3). */
+const LinkState = effect.Schema.Literals([
+	"online",
+	"connecting",
+	"offline",
+	"unsupported",
+	"revoked"
+]);
+/** Access level of a link (FR-4). */
+const LinkAccess = effect.Schema.Literals(["operator", "agent-fenced"]);
+/** Last known result of probing one route. */
+const LinkRouteStatus = effect.Schema.Literals([
+	"untried",
+	"current",
+	"reachable",
+	"unreachable"
+]);
+const LinkRouteView = effect.Schema.Struct({
+	url: effect.Schema.String,
+	kind: RouteKind,
+	source: RouteSource,
+	status: LinkRouteStatus
+});
+/** A heartbeat gap, diagnosed as a peer freeze or a network failure (FR-9). */
+const LinkIncident = effect.Schema.Struct({
+	kind: effect.Schema.Literals(["froze", "network"]),
+	durationMs: effect.Schema.Number,
+	/** ISO-8601 UTC time the gap ended, in the linking machine's clock. */
+	at: effect.Schema.String
+});
+/** Whether the linking server started the SSH host's Overdeck or adopted one already running (PAN-4404). */
+const SshLaunch = effect.Schema.Literals(["managed", "external"]);
+/** State of the local SSH port forward that carries an SSH machine's link (PAN-4404 D-4404-10). */
+const SshForwardState = effect.Schema.Literals([
+	"starting",
+	"up",
+	"down",
+	"attention"
+]);
+/** The SSH side of a link that this server set up over SSH. */
+const SshLinkInfo = effect.Schema.Struct({
+	destination: effect.Schema.String,
+	launch: SshLaunch,
+	forward: SshForwardState,
+	forwardDetail: effect.Schema.NullOr(effect.Schema.String),
+	localPort: effect.Schema.Number,
+	remotePort: effect.Schema.Number
+});
+/** PAN-4651 D-4651-8: a machine's load, sampled every 15 s and carried in the link heartbeat. */
+const LoadSample = effect.Schema.Struct({
+	/** CPU PSI `some avg10` (percent); null off Linux. */
+	cpuPsiSomeAvg10: effect.Schema.NullOr(effect.Schema.Number),
+	cpuSaturated: effect.Schema.Boolean,
+	memAvailableBytes: effect.Schema.NullOr(effect.Schema.Number),
+	workingAgents: effect.Schema.Number,
+	sampledAt: effect.Schema.String
+});
+/** PAN-4651 FR-7: `on-request` reserves a machine — Auto skips it unless only it has a needed tag. */
+const MachinePlacementMode = effect.Schema.Literals(["auto", "on-request"]);
+/** PAN-4651 FR-6: `CPU 3% · 41 GB · 2 agents` (unknown parts `n/a`); null without a sample. */
+function formatMachineLoad(load) {
+	if (!load) return null;
+	return `CPU ${load.cpuPsiSomeAvg10 === null ? "n/a" : `${Math.round(load.cpuPsiSomeAvg10)}%`} · ${load.memAvailableBytes === null ? "n/a" : `${Math.floor(load.memAvailableBytes / 2 ** 30)}`} GB · ${load.workingAgents} agents`;
+}
+/** PAN-4651 FR-7: `tags: docker, linux · reserved`; null when there is neither. */
+function formatMachineProfile(tags, placement) {
+	const parts = [...tags && tags.length > 0 ? [`tags: ${tags.join(", ")}`] : [], ...placement === "on-request" ? ["reserved"] : []];
+	return parts.length > 0 ? parts.join(" · ") : null;
+}
+/** PAN-4651 D-4651-9: why Auto placement skipped one machine. */
+const PlacementRejection = effect.Schema.Struct({
+	environmentId: effect.Schema.String,
+	label: effect.Schema.String,
+	/** `offline`, `unsupported`, `no project`, `no <tag>`, `CPU saturated` or `reserved`. */
+	reason: effect.Schema.String
+});
+/** PAN-4651 D-4651-9: the machine Auto chose (with the one-line reason), or why none fits. */
+const PlacementAnswer = effect.Schema.Union([effect.Schema.Struct({
+	ok: effect.Schema.Literal(true),
+	environmentId: effect.Schema.String,
+	label: effect.Schema.String,
+	self: effect.Schema.Boolean,
+	reason: effect.Schema.String,
+	rejections: effect.Schema.Array(PlacementRejection)
+}), effect.Schema.Struct({
+	ok: effect.Schema.Literal(false),
+	rejections: effect.Schema.Array(PlacementRejection)
+})]);
+/** PAN-4651 D-4651-11: one project a machine has registered, as linked machines see it (never a path). */
+const MachineProject = effect.Schema.Struct({
+	key: effect.Schema.String,
+	name: effect.Schema.String,
+	/** `github.com/<owner>/<repo>` or `gitlab.com/<path>`; null when the project has no remote repo. */
+	gitOrigin: effect.Schema.NullOr(effect.Schema.String)
+});
+/** PAN-4651 D-4651-13: one repository across machines, as `GET /api/fleet/projects` lists it. */
+const FleetProjectRow = effect.Schema.Struct({
+	/** The git origin slug; null for a local project without one (its own row). */
+	gitOrigin: effect.Schema.NullOr(effect.Schema.String),
+	name: effect.Schema.String,
+	/** This machine's project for the slug, or null when only other machines have it. */
+	local: effect.Schema.NullOr(effect.Schema.Struct({ key: effect.Schema.String })),
+	machines: effect.Schema.Array(effect.Schema.Struct({
+		environmentId: effect.Schema.String,
+		label: effect.Schema.String,
+		key: effect.Schema.String,
+		state: LinkState
+	}))
+});
+const FleetProjectsResponse = effect.Schema.Struct({
+	combine: effect.Schema.Boolean,
+	projects: effect.Schema.Array(FleetProjectRow)
+});
+/** One outbound link as shown by `GET /api/machines` and `pan machines list`. */
+const MachineLinkView = effect.Schema.Struct({
+	id: effect.Schema.String,
+	environmentId: effect.Schema.String,
+	label: effect.Schema.String,
+	/** Fingerprint of the pinned machine key: five dash-separated groups of four hex. */
+	fingerprint: effect.Schema.String,
+	access: LinkAccess,
+	state: LinkState,
+	stateDetail: effect.Schema.NullOr(effect.Schema.String),
+	currentRoute: effect.Schema.NullOr(effect.Schema.String),
+	routes: effect.Schema.Array(LinkRouteView),
+	lastHeartbeatAt: effect.Schema.NullOr(effect.Schema.String),
+	incident: effect.Schema.NullOr(LinkIncident),
+	peerVersion: effect.Schema.NullOr(effect.Schema.String),
+	createdAt: effect.Schema.String,
+	/** PAN-4650: Hide this machine — its conversations are left out of the conversation list. */
+	hidden: effect.Schema.optional(effect.Schema.Boolean),
+	/** Present only on links this server set up over SSH. */
+	ssh: effect.Schema.optional(SshLinkInfo),
+	/** PAN-4651: the peer's last heartbeat load sample; null before one arrives or from a peer that predates it. */
+	load: effect.Schema.optional(effect.Schema.NullOr(LoadSample)),
+	/** PAN-4651: the peer's capability tags (detected plus `anywhere.machine.tags`). */
+	tags: effect.Schema.optional(effect.Schema.Array(effect.Schema.String)),
+	placement: effect.Schema.optional(MachinePlacementMode)
+});
+/** One `machine` token this machine issued to another machine (inbound access). */
+const InboundMachineView = effect.Schema.Struct({
+	tokenId: effect.Schema.String,
+	environmentId: effect.Schema.String,
+	label: effect.Schema.String,
+	fingerprint: effect.Schema.String,
+	access: LinkAccess,
+	createdAt: effect.Schema.String,
+	lastUsedAt: effect.Schema.NullOr(effect.Schema.String)
+});
+const MachinesResponse = effect.Schema.Struct({
+	self: effect.Schema.Struct({
+		environmentId: effect.Schema.String,
+		label: effect.Schema.String,
+		fingerprint: effect.Schema.String,
+		/** PAN-4650 D-4: linked machines list this machine's conversations (anywhere.json, default on). */
+		shareConversations: effect.Schema.Boolean,
+		/** PAN-4651 D-4651-13: one project per git origin across machines (anywhere.json, default on). */
+		combineRepositories: effect.Schema.optional(effect.Schema.Boolean),
+		/** PAN-4651: this machine's own load sample, tags and placement mode. */
+		load: effect.Schema.optional(effect.Schema.NullOr(LoadSample)),
+		tags: effect.Schema.optional(effect.Schema.Array(effect.Schema.String)),
+		placement: effect.Schema.optional(MachinePlacementMode)
+	}),
+	links: effect.Schema.Array(MachineLinkView),
+	inbound: effect.Schema.Array(InboundMachineView)
+});
+/**
+* Version of the `OVERDECK_SSH_HELPER` result line that `pan machines ssh-helper`
+* prints on the SSH host (PAN-4404).
+*/
+const SSH_HELPER_PROTOCOL = 1;
+/** Error codes of the SSH machine flow (PAN-4404 D-4404-9). */
+const SSH_MACHINE_ERROR_CODES = [
+	"bad-destination",
+	"busy",
+	"unresolvable",
+	"unreachable",
+	"host-key",
+	"auth-failed",
+	"pan-missing",
+	"version-mismatch",
+	"helper-failed",
+	"start-failed",
+	"forward-failed",
+	"self-link",
+	"not-found"
+];
+const SshMachineErrorCode = effect.Schema.Literals(SSH_MACHINE_ERROR_CODES);
+/** Answer of `POST /api/machines/ssh/test` and `pan machines test-ssh`. */
+const SshTestResult = effect.Schema.Struct({
+	reachable: effect.Schema.Boolean,
+	panVersion: effect.Schema.NullOr(effect.Schema.String),
+	localVersion: effect.Schema.String,
+	versionMatches: effect.Schema.Boolean,
+	error: effect.Schema.NullOr(SshMachineErrorCode),
+	message: effect.Schema.NullOr(effect.Schema.String)
+});
+//#endregion
 //#region src/environment.ts
 /** Wire protocol version a client and server must agree on. */
 const ENVIRONMENT_PROTOCOL_VERSION = 1;
@@ -16415,7 +18093,9 @@ const EnvironmentCapabilities = effect.Schema.Struct({
 	/** `GET/DELETE /api/devices` is available. */
 	deviceSessions: effect.Schema.Boolean,
 	/** `/ws/*` upgrades require a credential (PAN-1166). */
-	terminalAuth: effect.Schema.Boolean
+	terminalAuth: effect.Schema.Boolean,
+	/** Secure machine links are accepted (PAN-4645). Absent on older servers ⇒ `unsupported`. */
+	machineLinks: effect.Schema.optional(effect.Schema.Boolean)
 });
 const EnvironmentDescriptor = effect.Schema.Struct({
 	descriptorVersion: effect.Schema.Literal(1),
@@ -16429,7 +18109,13 @@ const EnvironmentDescriptor = effect.Schema.Struct({
 	serverVersion: effect.Schema.String,
 	/** The server's `ENVIRONMENT_PROTOCOL_VERSION`. */
 	protocolVersion: effect.Schema.Number,
-	capabilities: EnvironmentCapabilities
+	capabilities: EnvironmentCapabilities,
+	/** Long-term X25519 machine public key, 64 lowercase hex (PAN-4645). */
+	machineKey: effect.Schema.optional(effect.Schema.String),
+	/** The server's `LINK_PROTOCOL_VERSION`; optional so older descriptors still decode (D-4645-11). */
+	linkProtocol: effect.Schema.optional(effect.Schema.Number),
+	/** Endpoints this machine advertises for secure channels. */
+	endpoints: effect.Schema.optional(effect.Schema.Array(AdvertisedEndpoint))
 });
 /** A server-local id qualified by the environment that owns it. */
 const ScopedRef = (localId) => effect.Schema.Struct({
@@ -16446,15 +18132,548 @@ function isProtocolCompatible(descriptor, clientProtocolVersion) {
 	return descriptor.protocolVersion === clientProtocolVersion;
 }
 //#endregion
+//#region src/linked-conversations.ts
+/** The viewing machine's name for a linked conversation: `@<environmentId>/<name>`. */
+function linkedConversationName(environmentId, name) {
+	return `@${environmentId}/${name}`;
+}
+const LINKED_NAME = /^@([^/]+)\/([^/]+)$/;
+/**
+* Parse `@<target>/<name>`, where target is an environment id or a machine
+* label. Returns null for a local name or a malformed value.
+*/
+function parseLinkedConversationName(value) {
+	const match = LINKED_NAME.exec(value);
+	if (!match) return null;
+	return {
+		target: match[1],
+		name: match[2]
+	};
+}
+//#endregion
+//#region src/connect.ts
+const CONNECT_PROTOCOL_VERSION = 1;
+/** Relay allowance per account per UTC calendar month (OD-3): 50 GB. */
+const RELAY_MONTHLY_CAP_BYTES = 5e10;
+/** Largest webhook body the directory inbox accepts (D-2356-14). */
+const INBOX_BODY_MAX_BYTES = 262144;
+/** How long the inbox holds a sealed event before it expires (D-2356-18). */
+const INBOX_HOLD_MS = 864e5;
+/** How long an approval request stays live (D-2356-9). */
+const APPROVAL_TTL_MS = 6e5;
+const FREE_MACHINE_LIMIT_MESSAGE = "The free account includes 3 machines";
+const NO_DIRECT_PATH_MESSAGE = "No direct path; install Tailscale or use the relay plan";
+const RELAY_CAP_MESSAGE = "Relay allowance used; install Tailscale or add 50 GB";
+/** WebSocket close codes the directory uses. */
+const CONNECT_CLOSE_CODES = {
+	unauthorized: 4001,
+	grantExpired: 4003,
+	machineLimit: 4009,
+	unsupportedProtocol: 4010,
+	/** Replaced by a newer socket for the same machine. */
+	replaced: 4011,
+	forgotten: 4012
+};
+//#endregion
+//#region src/connect-view.ts
+const DirectoryClientState = effect.Schema.Literals([
+	"off",
+	"connecting",
+	"online",
+	"refused"
+]);
+const DirectoryPlan = effect.Schema.Literals(["free", "tester"]);
+/** One machine of the account, as the directory lists it. */
+const DirectoryMachineView = effect.Schema.Struct({
+	environmentId: effect.Schema.String,
+	label: effect.Schema.String,
+	publicKeyHex: effect.Schema.String,
+	fingerprint: effect.Schema.String,
+	online: effect.Schema.Boolean,
+	/** ISO-8601 UTC. */
+	lastSeenAt: effect.Schema.String,
+	serverVersion: effect.Schema.String,
+	endpoints: effect.Schema.Array(AdvertisedEndpoint),
+	/** This machine holds a link to it. */
+	linked: effect.Schema.Boolean
+});
+/**
+* Approver side: `pending` (request arrived), `open` (approval channel open, SAS known),
+* `approving` (this operator approved; waiting for the other machine to accept), `failed`.
+*/
+const DirectoryApprovalState = effect.Schema.Literals([
+	"pending",
+	"open",
+	"approving",
+	"failed"
+]);
+/** Requester side: `waiting` (no approver yet), `open` (SAS known), `accepted`, `rejected`. */
+const DirectoryJoinState = effect.Schema.Literals([
+	"waiting",
+	"open",
+	"accepted",
+	"rejected"
+]);
+/** An incoming approval request: another machine asks to link with this one. */
+const DirectoryApprovalView = effect.Schema.Struct({
+	requestId: effect.Schema.String,
+	/** Environment id of the requesting machine. */
+	from: effect.Schema.String,
+	label: effect.Schema.String,
+	fingerprint: effect.Schema.String,
+	/** Unix milliseconds. */
+	expiresAt: effect.Schema.Number,
+	/** Six-digit code, set once the approval channel is open. */
+	sas: effect.Schema.NullOr(effect.Schema.String),
+	state: DirectoryApprovalState,
+	/** Why the approval failed, when `state` is `failed`. */
+	error: effect.Schema.NullOr(effect.Schema.String)
+});
+/** An outgoing join request this machine made. */
+const DirectoryJoinView = effect.Schema.Struct({
+	requestId: effect.Schema.String,
+	/** Target environment id, or null for every machine of the account. */
+	to: effect.Schema.NullOr(effect.Schema.String),
+	/** Unix milliseconds. */
+	expiresAt: effect.Schema.Number,
+	/** Six-digit code, set once an approver opened the approval channel. */
+	sas: effect.Schema.NullOr(effect.Schema.String),
+	/** The approver's fingerprint, from the handshake key (never from the directory). */
+	fingerprint: effect.Schema.NullOr(effect.Schema.String),
+	state: DirectoryJoinState
+});
+const RelayStatusView = effect.Schema.Struct({
+	/** UTC calendar month, `YYYY-MM`. */
+	month: effect.Schema.String,
+	bytesUsed: effect.Schema.Number,
+	capBytes: effect.Schema.Number,
+	stopped: effect.Schema.Boolean
+});
+const DirectoryResponse = effect.Schema.Struct({
+	signedIn: effect.Schema.Boolean,
+	state: DirectoryClientState,
+	/** The configured directory URL, or null when it is invalid. */
+	url: effect.Schema.NullOr(effect.Schema.String),
+	plan: effect.Schema.NullOr(DirectoryPlan),
+	refusal: effect.Schema.NullOr(effect.Schema.String),
+	machines: effect.Schema.Array(DirectoryMachineView),
+	approvals: effect.Schema.Array(DirectoryApprovalView),
+	joins: effect.Schema.Array(DirectoryJoinView),
+	relay: effect.Schema.NullOr(RelayStatusView)
+});
+//#endregion
+//#region src/fleet-versions.ts
+const FleetInstallMode = effect.Schema.Literals([
+	"npm-global",
+	"development",
+	"desktop"
+]);
+const FleetComponentStatus = effect.Schema.Literals([
+	"pending",
+	"running",
+	"updated",
+	"current",
+	"skipped",
+	"failed"
+]);
+const FleetJobPhase = effect.Schema.Literals([
+	"waiting",
+	"updating",
+	"restarting",
+	"done",
+	"failed",
+	"cancelled"
+]);
+const FleetUpdateMode = effect.Schema.Literals(["when-idle", "now"]);
+/** Fleet-table column order (D-16): these binaries first, then any other binary alphabetically. */
+const FLEET_BINARY_ORDER = [
+	"claude",
+	"codex",
+	"kimi",
+	"opencode",
+	"muse",
+	"prime-agent",
+	"omp"
+];
+/** Sort comparator for harness binary names in D-16 order. */
+function compareFleetBinaries(a, b) {
+	const rank = (binary) => {
+		const index = FLEET_BINARY_ORDER.indexOf(binary);
+		return index === -1 ? FLEET_BINARY_ORDER.length : index;
+	};
+	return rank(a) - rank(b) || a.localeCompare(b);
+}
+/** After this long waiting for turns, the row says it is still waiting and points at Update now (FR-8). */
+const FLEET_UPDATE_STILL_WAITING_MS = 30 * 6e4;
+const FleetComponentSchema = effect.Schema.Struct({
+	name: effect.Schema.String,
+	label: effect.Schema.String,
+	before: effect.Schema.NullOr(effect.Schema.String),
+	after: effect.Schema.NullOr(effect.Schema.String),
+	status: FleetComponentStatus,
+	detail: effect.Schema.NullOr(effect.Schema.String)
+});
+/** Decodes a persisted job file. */
+const FleetUpdateJobSchema = effect.Schema.Struct({
+	id: effect.Schema.String,
+	mode: FleetUpdateMode,
+	phase: FleetJobPhase,
+	requestedBy: effect.Schema.String,
+	startedAt: effect.Schema.String,
+	waitingTurns: effect.Schema.Number,
+	waitingSince: effect.Schema.NullOr(effect.Schema.String),
+	finishedAt: effect.Schema.NullOr(effect.Schema.String),
+	components: effect.Schema.Array(FleetComponentSchema)
+});
+/** Decodes a peer's `GET /api/versions/self` body. */
+const MachineVersionsReportSchema = effect.Schema.Struct({
+	environmentId: effect.Schema.String,
+	label: effect.Schema.String,
+	overdeck: effect.Schema.Struct({
+		version: effect.Schema.String,
+		installMode: FleetInstallMode,
+		linkProtocol: effect.Schema.Number
+	}),
+	harnesses: effect.Schema.Array(effect.Schema.Struct({
+		binary: effect.Schema.String,
+		label: effect.Schema.String,
+		harnesses: effect.Schema.Array(effect.Schema.String),
+		version: effect.Schema.NullOr(effect.Schema.String),
+		updatable: effect.Schema.Boolean,
+		command: effect.Schema.String,
+		reason: effect.Schema.NullOr(effect.Schema.String)
+	})),
+	job: effect.Schema.NullOr(FleetUpdateJobSchema)
+});
+//#endregion
+//#region src/color-theme.ts
+const TERMINAL_PALETTE_KEYS = [
+	"background",
+	"foreground",
+	"cursor",
+	"cursorAccent",
+	"selectionBackground",
+	"black",
+	"red",
+	"green",
+	"yellow",
+	"blue",
+	"magenta",
+	"cyan",
+	"white",
+	"brightBlack",
+	"brightRed",
+	"brightGreen",
+	"brightYellow",
+	"brightBlue",
+	"brightMagenta",
+	"brightCyan",
+	"brightWhite"
+];
+const UI_KEYS = [
+	"background",
+	"surface",
+	"overlay",
+	"border",
+	"foreground",
+	"muted",
+	"accent"
+];
+const COLOR_THEME_ID_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const RESERVED_COLOR_THEME_IDS = ["overdeck-dark", "overdeck-light"];
+const HEX_COLOR_RE = /^#(?:[0-9a-f]{3}|[0-9a-f]{4}|[0-9a-f]{6}|[0-9a-f]{8})$/i;
+const FONT_STYLE_RE = /^[a-z ]*$/i;
+const BUILTIN_COLOR_THEMES = {
+	"overdeck-dark": {
+		id: "overdeck-dark",
+		name: "Overdeck Dark",
+		type: "dark",
+		builtin: true,
+		terminal: {
+			background: "#1a1a2e",
+			foreground: "#eaeaea",
+			cursor: "#eaeaea",
+			cursorAccent: "#1a1a2e",
+			selectionBackground: "#3a3a5e",
+			black: "#1a1a2e",
+			red: "#ff5555",
+			green: "#50fa7b",
+			yellow: "#f1fa8c",
+			blue: "#6272a4",
+			magenta: "#ff79c6",
+			cyan: "#8be9fd",
+			white: "#f8f8f2",
+			brightBlack: "#6272a4",
+			brightRed: "#ff6e6e",
+			brightGreen: "#69ff94",
+			brightYellow: "#ffffa5",
+			brightBlue: "#d6acff",
+			brightMagenta: "#ff92df",
+			brightCyan: "#a4ffff",
+			brightWhite: "#ffffff"
+		}
+	},
+	"overdeck-light": {
+		id: "overdeck-light",
+		name: "Overdeck Light",
+		type: "light",
+		builtin: true,
+		terminal: {
+			background: "#ffffff",
+			foreground: "#24292e",
+			cursor: "#24292e",
+			cursorAccent: "#ffffff",
+			selectionBackground: "#bcd3f5",
+			black: "#24292e",
+			red: "#d73a49",
+			green: "#22863a",
+			yellow: "#b08800",
+			blue: "#0366d6",
+			magenta: "#6f42c1",
+			cyan: "#1b7c83",
+			white: "#6a737d",
+			brightBlack: "#959da5",
+			brightRed: "#cb2431",
+			brightGreen: "#28a745",
+			brightYellow: "#dbab09",
+			brightBlue: "#2188ff",
+			brightMagenta: "#8a63d2",
+			brightCyan: "#3192aa",
+			brightWhite: "#24292e"
+		}
+	}
+};
+function builtinFor(type) {
+	return type === "dark" ? BUILTIN_COLOR_THEMES["overdeck-dark"] : BUILTIN_COLOR_THEMES["overdeck-light"];
+}
+/** Expands "#rgb" to "#rrggbb" and drops an alpha channel, lowercased, so xterm and tmux render the same opaque color. */
+function toOpaqueHex(hex) {
+	const lower = hex.toLowerCase();
+	const digits = lower.slice(1);
+	if (digits.length === 3) return `#${digits[0]}${digits[0]}${digits[1]}${digits[1]}${digits[2]}${digits[2]}`;
+	if (digits.length === 4) return `#${digits[0]}${digits[0]}${digits[1]}${digits[1]}${digits[2]}${digits[2]}`;
+	if (digits.length === 8) return `#${digits.slice(0, 6)}`;
+	return lower;
+}
+/** WCAG-contrast-based readable text color for a background hex: whichever of black/white has the higher contrast ratio. */
+function readableForeground(hex) {
+	const opaque = toOpaqueHex(hex);
+	const r = parseInt(opaque.slice(1, 3), 16) / 255;
+	const g = parseInt(opaque.slice(3, 5), 16) / 255;
+	const b = parseInt(opaque.slice(5, 7), 16) / 255;
+	const channel = (c) => c <= .03928 ? c / 12.92 : Math.pow((c + .055) / 1.055, 2.4);
+	const luminance = .2126 * channel(r) + .7152 * channel(g) + .0722 * channel(b);
+	const contrastWithWhite = 1.05 / (luminance + .05);
+	return (luminance + .05) / .05 >= contrastWithWhite ? "#000000" : "#ffffff";
+}
+/** Lowercase slug: runs of non-[a-z0-9] become "-", trimmed, capped at 64 chars, "theme" if empty. */
+function slugifyThemeId(name) {
+	const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
+	return slug.length > 0 ? slug : "theme";
+}
+/** The built-in palette for the theme's type, overlaid with the theme's own terminal colors. */
+function effectiveTerminalPalette(theme) {
+	const palette = {
+		...builtinFor(theme.type).terminal,
+		...theme.terminal
+	};
+	return {
+		...palette,
+		background: toOpaqueHex(palette.background)
+	};
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeSource(raw) {
+	if (!isPlainObject(raw)) return void 0;
+	if (raw.kind !== "vscode-import") return void 0;
+	if (typeof raw.fileName !== "string" || typeof raw.importedAt !== "string") return void 0;
+	return {
+		kind: "vscode-import",
+		fileName: raw.fileName,
+		importedAt: raw.importedAt
+	};
+}
+function normalizeTerminal(raw, warnings) {
+	if (raw === void 0) return void 0;
+	if (!isPlainObject(raw)) {
+		warnings.push("terminal must be an object; ignoring");
+		return;
+	}
+	const result = {};
+	for (const [key, value] of Object.entries(raw)) {
+		if (!TERMINAL_PALETTE_KEYS.includes(key)) {
+			warnings.push(`unknown terminal key terminal.${key}; dropping`);
+			continue;
+		}
+		if (typeof value !== "string" || !HEX_COLOR_RE.test(value)) {
+			warnings.push(`invalid color for terminal.${key}; dropping`);
+			continue;
+		}
+		result[key] = value;
+	}
+	return Object.keys(result).length > 0 ? result : void 0;
+}
+function normalizeUi(raw, warnings) {
+	if (raw === void 0) return void 0;
+	if (!isPlainObject(raw)) {
+		warnings.push("ui must be an object; ignoring");
+		return;
+	}
+	const result = {};
+	for (const [key, value] of Object.entries(raw)) {
+		if (!UI_KEYS.includes(key)) {
+			warnings.push(`unknown ui key ui.${key}; dropping`);
+			continue;
+		}
+		if (typeof value !== "string" || !HEX_COLOR_RE.test(value)) {
+			warnings.push(`invalid color for ui.${key}; dropping`);
+			continue;
+		}
+		result[key] = value;
+	}
+	return Object.keys(result).length > 0 ? result : void 0;
+}
+function normalizeTokenColors(raw, warnings) {
+	if (raw === void 0) return [];
+	if (!Array.isArray(raw)) {
+		warnings.push("syntax.tokenColors must be an array; ignoring");
+		return [];
+	}
+	const entries = [];
+	for (const entry of raw.slice(0, 2e3)) {
+		if (!isPlainObject(entry) || !isPlainObject(entry.settings)) continue;
+		const settings = {};
+		const rawSettings = entry.settings;
+		if (typeof rawSettings.foreground === "string" && HEX_COLOR_RE.test(rawSettings.foreground)) settings.foreground = rawSettings.foreground;
+		if (typeof rawSettings.background === "string" && HEX_COLOR_RE.test(rawSettings.background)) settings.background = rawSettings.background;
+		if (typeof rawSettings.fontStyle === "string" && FONT_STYLE_RE.test(rawSettings.fontStyle)) settings.fontStyle = rawSettings.fontStyle;
+		const result = { settings };
+		if (typeof entry.scope === "string") result.scope = entry.scope;
+		else if (Array.isArray(entry.scope) && entry.scope.every((s) => typeof s === "string")) result.scope = entry.scope;
+		entries.push(result);
+	}
+	return entries;
+}
+function normalizeSyntax(raw, warnings) {
+	if (raw === void 0) return void 0;
+	if (!isPlainObject(raw)) {
+		warnings.push("syntax must be an object; ignoring");
+		return;
+	}
+	const tokenColors = normalizeTokenColors(raw.tokenColors, warnings);
+	let colors;
+	if (isPlainObject(raw.colors)) {
+		const filtered = {};
+		const background = raw.colors["editor.background"];
+		const foreground = raw.colors["editor.foreground"];
+		if (typeof background === "string" && HEX_COLOR_RE.test(background)) filtered["editor.background"] = background;
+		if (typeof foreground === "string" && HEX_COLOR_RE.test(foreground)) filtered["editor.foreground"] = foreground;
+		if (Object.keys(filtered).length > 0) colors = filtered;
+	}
+	if (tokenColors.length === 0 && colors === void 0) return void 0;
+	return {
+		tokenColors,
+		...colors !== void 0 ? { colors } : {}
+	};
+}
+/**
+* Validates and sanitizes a raw theme. An invalid color or unknown key is
+* dropped with a warning naming it — never an error. A missing/invalid
+* `name` or `type` is an error: there is no sensible default for either.
+*/
+function normalizeColorTheme(raw, id) {
+	const errors = [];
+	if (!isPlainObject(raw)) return { errors: ["theme must be an object"] };
+	const rawName = raw.name;
+	let name;
+	if (typeof rawName === "string" && rawName.trim().length > 0) name = rawName.trim().slice(0, 80);
+	else errors.push("name is required");
+	const rawType = raw.type;
+	let type;
+	if (rawType === "light" || rawType === "dark") type = rawType;
+	else errors.push("type must be \"light\" or \"dark\"");
+	if (errors.length > 0 || name === void 0 || type === void 0) return { errors };
+	const warnings = [];
+	const terminal = normalizeTerminal(raw.terminal, warnings);
+	const ui = normalizeUi(raw.ui, warnings);
+	const syntax = normalizeSyntax(raw.syntax, warnings);
+	const source = normalizeSource(raw.source);
+	return {
+		theme: {
+			id,
+			builtin: false,
+			name,
+			type,
+			...terminal !== void 0 ? { terminal } : {},
+			...syntax !== void 0 ? { syntax } : {},
+			...ui !== void 0 ? { ui } : {},
+			...source !== void 0 ? { source } : {}
+		},
+		warnings
+	};
+}
+//#endregion
+//#region src/conversation-schedule-presets.ts
+const SCHEDULE_PRESET_DAYS = [
+	"mon",
+	"tue",
+	"wed",
+	"thu",
+	"fri",
+	"sat",
+	"sun"
+];
+const TIME_PATTERN = /^([01]\d|2[0-3]):([0-5]\d)$/;
+const DAY_NUMBERS = {
+	sun: 0,
+	mon: 1,
+	tue: 2,
+	wed: 3,
+	thu: 4,
+	fri: 5,
+	sat: 6
+};
+function parseTime(time) {
+	const match = TIME_PATTERN.exec(time);
+	if (!match) throw new Error(`Invalid time "${time}": expected HH:MM (24-hour)`);
+	return {
+		hour: Number(match[1]),
+		minute: Number(match[2])
+	};
+}
+function presetToCron(preset) {
+	switch (preset.kind) {
+		case "hourly": return "0 * * * *";
+		case "daily": {
+			const { hour, minute } = parseTime(preset.time);
+			return `${minute} ${hour} * * *`;
+		}
+		case "weekdays": {
+			const { hour, minute } = parseTime(preset.time);
+			return `${minute} ${hour} * * 1-5`;
+		}
+		case "weekly": {
+			const day = DAY_NUMBERS[preset.day.toLowerCase()];
+			if (day === void 0) throw new Error(`Invalid day "${preset.day}": expected sun, mon, tue, wed, thu, fri or sat`);
+			const { hour, minute } = parseTime(preset.time);
+			return `${minute} ${hour} * * ${day}`;
+		}
+	}
+}
+//#endregion
 exports.ACP_BEHAVIOR = ACP_BEHAVIOR;
 exports.ACP_CAPABILITIES = ACP_CAPABILITIES;
 exports.AGENT_ROLES = AGENT_ROLES;
+exports.APPROVAL_TTL_MS = APPROVAL_TTL_MS;
 exports.Activity = Activity;
 exports.ActivityDetailedEvent = ActivityDetailedEvent;
 exports.ActivityEntryEvent = ActivityEntryEvent;
 exports.ActivityTtsEvent = ActivityTtsEvent;
 exports.ActivityUpdatedEvent = ActivityUpdatedEvent;
 exports.AdmissionState = AdmissionState;
+exports.AdvertisedEndpoint = AdvertisedEndpoint;
 exports.AgentActivityChangedEvent = AgentActivityChangedEvent;
 exports.AgentChannelReply = AgentChannelReply;
 exports.AgentChannelReplyEvent = AgentChannelReplyEvent;
@@ -16508,20 +18727,26 @@ exports.ArtifactUrls = ArtifactUrls;
 exports.ArtifactValidationCode = ArtifactValidationCode;
 exports.ArtifactValidationFinding = ArtifactValidationFinding;
 exports.ArtifactValidationResult = ArtifactValidationResult;
+exports.BROWSERS = BROWSERS;
+exports.BUILTIN_COLOR_THEMES = BUILTIN_COLOR_THEMES;
 exports.BackendPane = BackendPane;
 exports.BackendPaneChangedEvent = BackendPaneChangedEvent;
 exports.BackendPaneRemovedEvent = BackendPaneRemovedEvent;
 exports.BeadsFreshnessChangedEvent = BeadsFreshnessChangedEvent;
+exports.BrowserIdSchema = BrowserIdSchema;
 exports.CHANNEL_REPLY_KIND_VALUES = CHANNEL_REPLY_KIND_VALUES;
 exports.CLAUDE_CODE_BEHAVIOR = CLAUDE_CODE_BEHAVIOR;
 exports.CLAUDE_CODE_CAPABILITIES = CLAUDE_CODE_CAPABILITIES;
 exports.CODEX_BEHAVIOR = CODEX_BEHAVIOR;
 exports.CODEX_CAPABILITIES = CODEX_CAPABILITIES;
+exports.COLOR_THEME_ID_RE = COLOR_THEME_ID_RE;
 exports.COMPANION_TERMINAL_CLOSE_BODY_KEYS = COMPANION_TERMINAL_CLOSE_BODY_KEYS;
 exports.COMPANION_TERMINAL_OPEN_BODY_KEYS = COMPANION_TERMINAL_OPEN_BODY_KEYS;
 exports.COMPOSER_COMMAND_INSERT_OVERRIDES = COMPOSER_COMMAND_INSERT_OVERRIDES;
 exports.COMPOSER_COMMAND_MANIFEST = COMPOSER_COMMAND_MANIFEST;
 exports.COMPOSER_COMMAND_VARIANTS = COMPOSER_COMMAND_VARIANTS;
+exports.CONNECT_CLOSE_CODES = CONNECT_CLOSE_CODES;
+exports.CONNECT_PROTOCOL_VERSION = CONNECT_PROTOCOL_VERSION;
 exports.CONTEXT_LAYER_KINDS = CONTEXT_LAYER_KINDS;
 exports.CONTEXT_PREVIEW_HARNESSES = CONTEXT_PREVIEW_HARNESSES;
 exports.CONVERSATION_PAGE_DEFAULT_LIMIT = CONVERSATION_PAGE_DEFAULT_LIMIT;
@@ -16564,6 +18789,7 @@ exports.ConversationPullRequests = ConversationPullRequests;
 exports.ConversationPullRequestsChangedEvent = ConversationPullRequestsChangedEvent;
 exports.ConversationResponse = ConversationResponse;
 exports.ConversationResume = ConversationResume;
+exports.ConversationSchedulesChangedEvent = ConversationSchedulesChangedEvent;
 exports.ConversationTitleChangedEvent = ConversationTitleChangedEvent;
 exports.ConversationWindow = ConversationWindow;
 exports.CostEventRecordedEvent = CostEventRecordedEvent;
@@ -16581,14 +18807,22 @@ exports.DerivedIssueState = DerivedIssueState;
 exports.DerivedPrOutsidePipeline = DerivedPrOutsidePipeline;
 exports.DerivedPrState = DerivedPrState;
 exports.DerivedWorkStart = DerivedWorkStart;
+exports.DirectoryApprovalState = DirectoryApprovalState;
+exports.DirectoryApprovalView = DirectoryApprovalView;
+exports.DirectoryClientState = DirectoryClientState;
 exports.DirectoryEntry = DirectoryEntry;
 exports.DirectoryEntryKind = DirectoryEntryKind;
 exports.DirectoryEntryLocation = DirectoryEntryLocation;
 exports.DirectoryEntrySource = DirectoryEntrySource;
 exports.DirectoryEntryState = DirectoryEntryState;
+exports.DirectoryJoinState = DirectoryJoinState;
+exports.DirectoryJoinView = DirectoryJoinView;
+exports.DirectoryMachineView = DirectoryMachineView;
 exports.DirectoryPause = DirectoryPause;
 exports.DirectoryPauseBy = DirectoryPauseBy;
+exports.DirectoryPlan = DirectoryPlan;
 exports.DirectoryProviderError = DirectoryProviderError;
+exports.DirectoryResponse = DirectoryResponse;
 exports.DirectoryScope = DirectoryScope;
 exports.DirectoryTranscriptRef = DirectoryTranscriptRef;
 exports.DiscoveredSessionSnapshot = DiscoveredSessionSnapshot;
@@ -16611,9 +18845,19 @@ exports.EnvironmentDescriptor = EnvironmentDescriptor;
 exports.EnvironmentId = EnvironmentId;
 exports.ExtractionProviderConfig = ExtractionProviderConfig;
 exports.ExtractionProviderTarget = ExtractionProviderTarget;
+exports.FLEET_BINARY_ORDER = FLEET_BINARY_ORDER;
+exports.FLEET_UPDATE_STILL_WAITING_MS = FLEET_UPDATE_STILL_WAITING_MS;
+exports.FREE_MACHINE_LIMIT_MESSAGE = FREE_MACHINE_LIMIT_MESSAGE;
 exports.FeatureNode = FeatureNode;
 exports.FeatureRegistryEntry = FeatureRegistryEntry;
 exports.FeatureRegistryStatus = FeatureRegistryStatus;
+exports.FleetComponentStatus = FleetComponentStatus;
+exports.FleetInstallMode = FleetInstallMode;
+exports.FleetJobPhase = FleetJobPhase;
+exports.FleetProjectRow = FleetProjectRow;
+exports.FleetProjectsResponse = FleetProjectsResponse;
+exports.FleetUpdateJobSchema = FleetUpdateJobSchema;
+exports.FleetUpdateMode = FleetUpdateMode;
 exports.FlywheelAgent = FlywheelAgent;
 exports.FlywheelAgentStatus = FlywheelAgentStatus;
 exports.FlywheelAgentSummary = FlywheelAgentSummary;
@@ -16656,6 +18900,7 @@ exports.FlywheelSystemStatus = FlywheelSystemStatus;
 exports.GITHUB_QUOTA_BUCKETS = GITHUB_QUOTA_BUCKETS;
 exports.GITHUB_QUOTA_CALLERS = GITHUB_QUOTA_CALLERS;
 exports.GITHUB_QUOTA_POOLS = GITHUB_QUOTA_POOLS;
+exports.GetAvailableBrowsersRpc = GetAvailableBrowsersRpc;
 exports.GetAvailableEditorsRpc = GetAvailableEditorsRpc;
 exports.GetConversationCostByWorkspaceRpc = GetConversationCostByWorkspaceRpc;
 exports.GetConversationCostRpc = GetConversationCostRpc;
@@ -16684,10 +18929,13 @@ exports.HostPlatform = HostPlatform;
 exports.HygieneFinding = HygieneFinding;
 exports.HygienePullRequest = HygienePullRequest;
 exports.HygieneReport = HygieneReport;
+exports.INBOX_BODY_MAX_BYTES = INBOX_BODY_MAX_BYTES;
+exports.INBOX_HOLD_MS = INBOX_HOLD_MS;
 exports.INITIAL_READ_MODEL_STATE = INITIAL_READ_MODEL_STATE;
 exports.ISSUE_ATTENTIONS = ISSUE_ATTENTIONS;
 exports.ISSUE_STATES = ISSUE_STATES;
 exports.ISSUE_STATE_PRECEDENCE = ISSUE_STATE_PRECEDENCE;
+exports.InboundMachineView = InboundMachineView;
 exports.IssueAttention = IssueAttention;
 exports.IssueId = IssueId;
 exports.IssueState = IssueState;
@@ -16701,14 +18949,21 @@ exports.KIMI_CODE_BEHAVIOR = KIMI_CODE_BEHAVIOR;
 exports.KIMI_CODE_CAPABILITIES = KIMI_CODE_CAPABILITIES;
 exports.KNOWN_HARNESSES = KNOWN_HARNESSES;
 exports.LANE_STARTING_GRACE_MS = LANE_STARTING_GRACE_MS;
+exports.LINK_PROTOCOL_VERSION = LINK_PROTOCOL_VERSION;
 exports.LegacySystemHealthSummary = LegacySystemHealthSummary;
 exports.LegacyWebhookRelaySummary = LegacyWebhookRelaySummary;
 exports.LinearMcpAuthCallbackRelayedEvent = LinearMcpAuthCallbackRelayedEvent;
 exports.LinearMcpAuthHealthyEvent = LinearMcpAuthHealthyEvent;
 exports.LinearMcpAuthNotifiedEvent = LinearMcpAuthNotifiedEvent;
 exports.LinearMcpAuthRequiredEvent = LinearMcpAuthRequiredEvent;
+exports.LinkAccess = LinkAccess;
+exports.LinkIncident = LinkIncident;
+exports.LinkRouteStatus = LinkRouteStatus;
+exports.LinkRouteView = LinkRouteView;
+exports.LinkState = LinkState;
 exports.ListDiscoveredSessionsRpc = ListDiscoveredSessionsRpc;
 exports.ListSessionsFeedRpc = ListSessionsFeedRpc;
+exports.LoadSample = LoadSample;
 exports.MAX_CHANNEL_REPLY_ARTIFACT_LABEL_LENGTH = MAX_CHANNEL_REPLY_ARTIFACT_LABEL_LENGTH;
 exports.MAX_CHANNEL_REPLY_ARTIFACT_REFS = MAX_CHANNEL_REPLY_ARTIFACT_REFS;
 exports.MAX_CHANNEL_REPLY_ARTIFACT_URI_LENGTH = MAX_CHANNEL_REPLY_ARTIFACT_URI_LENGTH;
@@ -16716,6 +18971,11 @@ exports.MAX_CHANNEL_REPLY_SUMMARY_LENGTH = MAX_CHANNEL_REPLY_SUMMARY_LENGTH;
 exports.MEMBERSHIP_UNAVAILABLE_REASONS = MEMBERSHIP_UNAVAILABLE_REASONS;
 exports.MUSE_BEHAVIOR = MUSE_BEHAVIOR;
 exports.MUSE_CAPABILITIES = MUSE_CAPABILITIES;
+exports.MachineLinkView = MachineLinkView;
+exports.MachinePlacementMode = MachinePlacementMode;
+exports.MachineProject = MachineProject;
+exports.MachineVersionsReportSchema = MachineVersionsReportSchema;
+exports.MachinesResponse = MachinesResponse;
 exports.MemoryAgentRole = MemoryAgentRole;
 exports.MemoryHealthChangedEvent = MemoryHealthChangedEvent;
 exports.MemoryIdentity = MemoryIdentity;
@@ -16731,12 +18991,14 @@ exports.MergeReadyEvent = MergeReadyEvent;
 exports.ModelOrigin = ModelOrigin;
 exports.ModelOriginEntry = ModelOriginEntry;
 exports.NON_ESSENTIAL_GITHUB_CALLERS = NON_ESSENTIAL_GITHUB_CALLERS;
+exports.NO_DIRECT_PATH_MESSAGE = NO_DIRECT_PATH_MESSAGE;
 exports.OHMYPI_BEHAVIOR = OHMYPI_BEHAVIOR;
 exports.OHMYPI_CAPABILITIES = OHMYPI_CAPABILITIES;
 exports.OPENCODE_BEHAVIOR = OPENCODE_BEHAVIOR;
 exports.OPENCODE_CAPABILITIES = OPENCODE_CAPABILITIES;
 exports.OVERDECK_AGENT_PROTOCOL_VERSION = OVERDECK_AGENT_PROTOCOL_VERSION;
 exports.OVERDECK_DASHBOARD_PROTOCOL_VERSION = OVERDECK_DASHBOARD_PROTOCOL_VERSION;
+exports.OpenInBrowserInput = OpenInBrowserInput;
 exports.OpenInEditorInput = OpenInEditorInput;
 exports.OperatorInterventionEvent = OperatorInterventionEvent;
 exports.OrderBook = OrderBook;
@@ -16758,6 +19020,8 @@ exports.PipelineTestCompletedEvent = PipelineTestCompletedEvent;
 exports.PipelineTestStartedEvent = PipelineTestStartedEvent;
 exports.PipelineVerificationFailedEvent = PipelineVerificationFailedEvent;
 exports.PipelineVerificationStartedEvent = PipelineVerificationStartedEvent;
+exports.PlacementAnswer = PlacementAnswer;
+exports.PlacementRejection = PlacementRejection;
 exports.PlanItemStatusChangedEvent = PlanItemStatusChangedEvent;
 exports.PlanItemsUnblockedEvent = PlanItemsUnblockedEvent;
 exports.PlanSubitemStatusChangedEvent = PlanSubitemStatusChangedEvent;
@@ -16784,7 +19048,11 @@ exports.PullRequestLinkSource = PullRequestLinkSource;
 exports.PullRequestLinkedConversation = PullRequestLinkedConversation;
 exports.PullRequestSnapshot = PullRequestSnapshot;
 exports.PullRequestState = PullRequestState;
+exports.RELAY_CAP_MESSAGE = RELAY_CAP_MESSAGE;
+exports.RELAY_MONTHLY_CAP_BYTES = RELAY_MONTHLY_CAP_BYTES;
+exports.RESERVED_COLOR_THEME_IDS = RESERVED_COLOR_THEME_IDS;
 exports.RESUME_OPEN_IDS_MAX = RESUME_OPEN_IDS_MAX;
+exports.ROUTE_KINDS = ROUTE_KINDS;
 exports.RagDecision = RagDecision;
 exports.RagDecisionSource = RagDecisionSource;
 exports.ReadFileAtPathInput = ReadFileAtPathInput;
@@ -16793,6 +19061,7 @@ exports.ReadFileAtPathRpc = ReadFileAtPathRpc;
 exports.ReadWorkspaceFileInput = ReadWorkspaceFileInput;
 exports.ReadWorkspaceFileResult = ReadWorkspaceFileResult;
 exports.ReadWorkspaceFileRpc = ReadWorkspaceFileRpc;
+exports.RelayStatusView = RelayStatusView;
 exports.ReplayEventsResult = ReplayEventsResult;
 exports.ReplayEventsRpc = ReplayEventsRpc;
 exports.ReplayTooFarBehind = ReplayTooFarBehind;
@@ -16821,7 +19090,12 @@ exports.ReviewVerdictRestoreBlockedEvent = ReviewVerdictRestoreBlockedEvent;
 exports.ReviewerRoundMetadata = ReviewerRoundMetadata;
 exports.ReviewerRoundSummary = ReviewerRoundSummary;
 exports.Role = Role;
+exports.RouteKind = RouteKind;
+exports.RouteSource = RouteSource;
+exports.SCHEDULE_PRESET_DAYS = SCHEDULE_PRESET_DAYS;
 exports.SINGLETON_AGENT_IDS = SINGLETON_AGENT_IDS;
+exports.SSH_HELPER_PROTOCOL = SSH_HELPER_PROTOCOL;
+exports.SSH_MACHINE_ERROR_CODES = SSH_MACHINE_ERROR_CODES;
 exports.ScanCompleteEvent = ScanCompleteEvent;
 exports.ScanConversationsRpc = ScanConversationsRpc;
 exports.ScanProgressEvent = ScanProgressEvent;
@@ -16847,11 +19121,17 @@ exports.SessionsFeedFacetsSnapshot = SessionsFeedFacetsSnapshot;
 exports.SessionsFeedRowSnapshot = SessionsFeedRowSnapshot;
 exports.SessionsFeedSource = SessionsFeedSource;
 exports.ShadowInferenceUpdateEvent = ShadowInferenceUpdateEvent;
+exports.ShellOpenInBrowserRpc = ShellOpenInBrowserRpc;
 exports.ShellOpenInEditorRpc = ShellOpenInEditorRpc;
 exports.SpecialistCompletedEvent = SpecialistCompletedEvent;
 exports.SpecialistFailedEvent = SpecialistFailedEvent;
 exports.SpecialistLifecycle = SpecialistLifecycle;
 exports.SpecialistStartedEvent = SpecialistStartedEvent;
+exports.SshForwardState = SshForwardState;
+exports.SshLaunch = SshLaunch;
+exports.SshLinkInfo = SshLinkInfo;
+exports.SshMachineErrorCode = SshMachineErrorCode;
+exports.SshTestResult = SshTestResult;
 exports.StartAgentRpc = StartAgentRpc;
 exports.StartPlanningRpc = StartPlanningRpc;
 exports.SubagentHumanInput = SubagentHumanInput;
@@ -16913,9 +19193,11 @@ exports.applyEvents = applyEvents;
 exports.applyIssueDelta = applyIssueDelta;
 exports.bucketQuotaPoints = bucketQuotaPoints;
 exports.bucketQuotaRemaining = bucketQuotaRemaining;
+exports.builtinFor = builtinFor;
 exports.canonicalPullRequestUrl = canonicalPullRequestUrl;
 exports.companionTerminalKindFor = companionTerminalKindFor;
 exports.compareEffort = compareEffort;
+exports.compareFleetBinaries = compareFleetBinaries;
 exports.compareIssueIds = compareIssueIds;
 exports.compareTimelineKeys = compareTimelineKeys;
 exports.createIssueDelta = createIssueDelta;
@@ -16923,8 +19205,11 @@ exports.decodeFlywheelDerivedStatus = decodeFlywheelDerivedStatus;
 exports.decodeFlywheelStats = decodeFlywheelStats;
 exports.decodeTimelineCursor = decodeTimelineCursor;
 exports.deriveProjectCi = deriveProjectCi;
+exports.effectiveTerminalPalette = effectiveTerminalPalette;
 exports.encodeFlywheelStats = encodeFlywheelStats;
 exports.encodeTimelineCursor = encodeTimelineCursor;
+exports.formatMachineLoad = formatMachineLoad;
+exports.formatMachineProfile = formatMachineProfile;
 exports.getHarness = getHarness;
 exports.getHarnessBehavior = getHarnessBehavior;
 exports.getMaxMemoryObservationsPerIssue = getMaxMemoryObservationsPerIssue;
@@ -16945,17 +19230,27 @@ exports.isSingletonConversation = isSingletonConversation;
 exports.isTerminalBackendName = isTerminalBackendName;
 exports.isTerminalTurnDiffSummaryStatus = isTerminalTurnDiffSummaryStatus;
 exports.laneActivityOf = laneActivityOf;
+exports.linkedConversationName = linkedConversationName;
 exports.normalizeChannelReplyPayload = normalizeChannelReplyPayload;
+exports.normalizeColorTheme = normalizeColorTheme;
 exports.normalizeHarnessName = normalizeHarnessName;
 exports.omitTurnDiffSummariesForAgent = omitTurnDiffSummariesForAgent;
+exports.overdeckInstallCommand = overdeckInstallCommand;
 exports.paneAgentKey = paneAgentKey;
+exports.parseLinkedConversationName = parseLinkedConversationName;
 exports.parsePullRequestRef = parsePullRequestRef;
+exports.parseTrackerIssueUrl = parseTrackerIssueUrl;
+exports.presetToCron = presetToCron;
 exports.projectLegacySystemHealthSummary = projectLegacySystemHealthSummary;
+exports.readableForeground = readableForeground;
 exports.repoFromRemoteUrl = repoFromRemoteUrl;
 exports.resolveEffectivePullRequest = resolveEffectivePullRequest;
+exports.resolveTrackerIssueId = resolveTrackerIssueId;
+exports.slugifyThemeId = slugifyThemeId;
 exports.syncSnapshot = syncSnapshot;
 exports.timelineKeyOfMessage = timelineKeyOfMessage;
 exports.timelineKeyOfWork = timelineKeyOfWork;
+exports.toOpaqueHex = toOpaqueHex;
 exports.trimMemoryObservations = trimMemoryObservations;
 exports.trimTurnDiffSummaries = trimTurnDiffSummaries;
 exports.withPaneLivenessAlias = withPaneLivenessAlias;