@overdeck/desktop 0.45.15 → 0.45.18

package/server/{agents-CsOzAmRg.js → queries-C0LCGG21.js}

@@ -1,40 +1,41 @@
 import { n as __esmMin, o as __toESM } from "./rolldown-runtime-DNCzzKnI.js";
-import { Ar as OVERDECK_HOME, C as init_tier_table, Dn as getProjectSwarmHotspots, F as getBuiltInDefaultHarness, H as setupCredentialFileAuthSync, It as resolveProjectForIssue, Kn as resolveProjectFromIssueSync, Kr as getOverdeckHome, L as getProviderEnvSync, Nt as readIssueRecordForWorkspaceSync, On as getProjectSync, P as clearCredentialFileAuthSync, Pn as init_projects, Pt as readIssueRecordSync, R as getProviderForModelSync, Rt as writeAgentHarnessModelSync, T as resolveTieredExecutionEnabledForIssue, Tn as getIssuePrefix, U as ensureOpenAICompatibleProxyRunning, W as init_openai_compatible_proxy, X as init_roles, Xr as resolveOhmypiExtensionPath, Yr as packageRoot, Z as resolveModel, Zr as sessionFilePath, at as resolveModelIdSync, b as DEFAULT_TIERED_EXECUTION_CONFIG, br as init_errors, cr as ClaudeCredentialParseError, ct as init_percent, et as getModelCapabilitySync, f as loadConfigSync, hn as shouldCommitLegacyWorkspaceArtifacts, ir as resolveBareNumericIdSync, kt as init_record, l as isClaudeCodeChannelsMcpEnabled, lr as ConfigError, nt as hasModelCapabilitySync, or as require_dist, ot as fmix32, pn as init_state_read_home, qr as init_paths, rt as init_model_capabilities, st as fnv1a32, t as init_config_yaml, tr as init_issue_id, u as isTldrEnabledSync, ur as FsError, w as resolveTieredExecutionEnabled, x as TIERED_EXECUTION_DIFFICULTIES, xn as findProjectByPathSync, xr as AGENTS_DIR, z as init_providers, zr as encodeClaudeProjectDir } from "./config-yaml-Dcz-8uit.js";
+import { $r as sessionFilePath, C as init_tier_table, Cr as AGENTS_DIR, En as getIssuePrefix, F as getBuiltInDefaultHarness, Fn as init_projects, H as setupCredentialFileAuthSync, It as resolveProjectForIssue, Jr as getOverdeckHome, L as getProviderEnvSync, Mr as OVERDECK_HOME, Nt as readIssueRecordForWorkspaceSync, On as getProjectSwarmHotspots, P as clearCredentialFileAuthSync, Pt as readIssueRecordSync, Qr as resolveOhmypiExtensionPath, R as getProviderForModelSync, Rt as writeAgentHarnessModelSync, Sn as findProjectByPathSync, Sr as init_errors, T as resolveTieredExecutionEnabledForIssue, U as ensureOpenAICompatibleProxyRunning, Vr as encodeClaudeProjectDir, W as init_openai_compatible_proxy, X as init_roles, Yr as init_paths, Z as resolveModel, Zr as packageRoot, at as resolveModelIdSync, b as DEFAULT_TIERED_EXECUTION_CONFIG, cr as require_dist, ct as init_percent, dr as ConfigError, et as getModelCapabilitySync, f as loadConfigSync, fr as FsError, hn as shouldCommitLegacyWorkspaceArtifacts, kn as getProjectSync, kt as init_record, l as isClaudeCodeChannelsMcpEnabled, nt as hasModelCapabilitySync, or as resolveBareNumericIdSync, ot as fmix32, pn as init_state_read_home, qn as resolveProjectFromIssueSync, rr as init_issue_id, rt as init_model_capabilities, st as fnv1a32, t as init_config_yaml, u as isTldrEnabledSync, ur as ClaudeCredentialParseError, w as resolveTieredExecutionEnabled, x as TIERED_EXECUTION_DIFFICULTIES, z as init_providers } from "./config-yaml-CqaAyn8y.js";
 import { t as require_toml } from "./toml-CeLDATih.js";
 import { a as init_activity_logger, n as emitActivityEntrySync, r as emitActivityTtsSync } from "./activity-logger-pcbf-e30.js";
-import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-bpq1MHKU.js";
-import { A as listSessionsSync, C as isPaneDead, E as listPaneValues, I as sendRawKeystroke, L as sessionExists, N as sendEscapeKeyAsync, P as sendKeys, R as sessionExistsSync, T as killSessionSync, W as BLANKED_PROVIDER_ENV, a as capturePaneSync, d as exactPaneTarget, i as capturePane, k as listSessions, o as createSession, q as init_child_env, s as createSessionSync, w as killSession, x as init_tmux, z as setOption } from "./tmux-C_d-lSIq.js";
-import { a as init_event_store, i as initEventStore } from "./event-store-DRte2Rwt.js";
-import { a as getHarnessBehavior, i as OHMYPI_BEHAVIOR } from "./src-DHn4Rd2F.js";
-import { A as listOverdeckAgentStatesSync, E as readReviewStatusMap, O as getOverdeckAgentStateSync, T as init_review_status_source, c as init_review_status, j as saveOverdeckAgentStateSync, k as init_agent_state_sync, m as resetPipelineVerdictsForWorkStartSync } from "./review-status-4qqLkRMu.js";
-import { d as init_agents$1, l as countAgentsByStatus, n as ensureSessionContextBriefingFile, r as init_briefing_freshness } from "./briefing-freshness-Kh5V8RTh.js";
-import { o as getPricingSync, s as init_cost } from "./cost-DQ2ajr_m.js";
-import { t as init_behavior } from "./behavior-Cpj03N4v.js";
-import { _ as init_tier_metrics, g as estimateFeedDeliveryTokens, v as recordTierFeedDelivery } from "./cost-sync-gTayEuWP.js";
-import { n as init_agent_runtime_mirror, r as isAgentStateServiceInProcess, t as getRuntimeSnapshot } from "./agent-runtime-mirror-DrWxopNA.js";
-import { i as ensureInternalTokenSync, s as init_internal_token, t as INTERNAL_TOKEN_HEADER } from "./internal-token-CjlhdufS.js";
-import { m as readWorkspacePlanSync, o as init_io } from "./io-BiQ2Cs3k.js";
-import { c as bridgeGeminiAuthToCliproxy, p as getCliproxyClientEnv, s as bridgeCodexAuthToCliproxySync, v as init_cliproxy } from "./cliproxy-BsoNNDAj.js";
-import { f as init_config$1, m as loadConfigSync$1 } from "./config-ZNnMpIlh.js";
-import { L as normalizeHarness, R as reactivateConversationForSpawn, S as getConversationByName, k as init_conversations, y as createConversation } from "./conversations-DG2M8WnT.js";
-import { n as recordFeatureRegistryLifecycle, t as init_feature_registry_population } from "./feature-registry-population-ie-yBcQC.js";
-import { a as readCavemanVariant, n as init_workspace } from "./workspace-CNuW2j41.js";
-import { a as init_launcher_generator, c as requireModelOverrideSync, i as generateLauncherScriptSync, l as shellQuoteModelIdSync, n as init_state_home, o as init_model_validation, r as isStateMigrated, s as normalizeModelOverrideSync } from "./state-home-CRowbXqU.js";
-import { a as init_claude_permissions, r as getClaudePermissionFlagsStringSync } from "./claude-permissions-CaWqysff.js";
-import { h as workspaceContextFile, o as init_layers } from "./layers-CD6FysRU.js";
-import { a as extractThreadIdFromRollout, c as initCodexHome, l as init_codex, o as findLatestRollout } from "./codex-DW60_5j2.js";
-import { a as getFlywheelActiveRunIdSync, s as init_control_settings } from "./control-settings-DwkAeooY.js";
-import { n as createTrackerFromConfig, r as init_factory, t as createTracker } from "./factory-FN727tWr.js";
-import { a as init_stack_health, i as getWorkspaceStackHealth } from "./stack-health-DxsTx7II.js";
-import { a as createActiveSlice, c as groupItemsByWave, s as getDispatchableItems, u as init_dag } from "./dag-CqTehWpY.js";
-import { n as init_bd_process_lock, t as BdTransientFailure } from "./bd-process-lock-D3S4T4o-.js";
-import { n as assertIssueHasBeads, r as init_beads_query, t as BeadsMissingError } from "./beads-query-B1DlJVp9.js";
-import { c as generateFixedPointPromptSync, f as initHookSync, n as checkHookSync, p as init_hooks } from "./hooks-C9b7Vqpw.js";
-import { n as resolveHarness, t as init_harness_resolve } from "./harness-resolve-iMjyNUJ2.js";
-import { r as isRoleTerminal, t as init_reap_terminal_sessions } from "./reap-terminal-sessions-D6JDJsqF.js";
-import { a as init_lifecycle_io, t as appendContinueSessionEntryForIssue } from "./lifecycle-io-CeYxP3cE.js";
-import { r as init_swarm_readiness, t as analyzeSwarmReadiness } from "./swarm-readiness-CL5sM9B1.js";
-import { delimiter, dirname, join, relative } from "node:path";
+import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-_Kx1m9pm.js";
+import { A as listSessions, B as setOption, D as listPaneValues, E as killSessionSync, F as sendKeys, G as BLANKED_PROVIDER_ENV, J as init_child_env, L as sendRawKeystroke, P as sendEscapeKeyAsync, R as sessionExists, S as init_tmux, T as killSession, a as capturePaneSync, f as exactPaneTarget, i as capturePane, j as listSessionsSync, o as createSession, s as createSessionSync, w as isPaneDead, z as sessionExistsSync } from "./tmux-U55cNGFG.js";
+import { a as init_event_store, i as initEventStore } from "./event-store-KZnWUKWh.js";
+import { a as getHarnessBehavior, i as OHMYPI_BEHAVIOR } from "./src-By3D85Ry.js";
+import { C as init_review_status_source, D as init_agent_state_sync, E as getOverdeckAgentStateSync, O as listOverdeckAgentStatesSync, c as init_review_status, k as saveOverdeckAgentStateSync, m as resetPipelineVerdictsForWorkStartSync, w as readReviewStatusMap } from "./review-status-DANr0t-v.js";
+import { i as countAgentsByStatus, o as init_agents$1 } from "./agents-BHBxr8c9.js";
+import { n as ensureSessionContextBriefingFile, r as init_briefing_freshness } from "./briefing-freshness-DuxIE1yr.js";
+import { o as getPricingSync, s as init_cost } from "./cost-BoqD1Pxz.js";
+import { _ as init_tier_metrics, g as estimateFeedDeliveryTokens, v as recordTierFeedDelivery } from "./cost-sync-BYnmnMkY.js";
+import { a as persistCurrentSessionId, d as isAgentStateServiceInProcess, i as logLauncherSessionPinned, l as getRuntimeSnapshot, n as createFreshSessionIdentity, o as init_persistent_logger, r as init_session_history, s as logAgentLifecycleSync, u as init_agent_runtime_mirror } from "./session-history-bnOFKMwf.js";
+import { t as init_behavior } from "./behavior-CWqNMqE5.js";
+import { i as ensureInternalTokenSync, s as init_internal_token, t as INTERNAL_TOKEN_HEADER } from "./internal-token-Cl-1IxaE.js";
+import { m as readWorkspacePlanSync, o as init_io } from "./io-DkC4sFSy.js";
+import { c as bridgeGeminiAuthToCliproxy, d as getCliproxyAuthDir, g as getCliproxyLogPath, l as decodeJwtPayload$1, p as getCliproxyClientEnv, s as bridgeCodexAuthToCliproxySync, v as init_cliproxy } from "./cliproxy-CGBA1GzA.js";
+import { L as normalizeHarness, R as reactivateConversationForSpawn, S as getConversationByName, k as init_conversations, y as createConversation } from "./conversations-BX5aD-6F.js";
+import { n as recordFeatureRegistryLifecycle, t as init_feature_registry_population } from "./feature-registry-population-Ca2UaV0U.js";
+import { a as readCavemanVariant, n as init_workspace } from "./workspace-CuN0ev4Z.js";
+import { a as requireModelOverrideSync, i as normalizeModelOverrideSync, n as init_launcher_generator, o as shellQuoteModelIdSync, r as init_model_validation, t as generateLauncherScriptSync } from "./launcher-generator-BXLM9f4b.js";
+import { a as init_claude_permissions, r as getClaudePermissionFlagsStringSync } from "./claude-permissions-BB6agcOZ.js";
+import { h as workspaceContextFile, o as init_layers } from "./layers-gCJlK62m.js";
+import { a as extractThreadIdFromRollout, c as initCodexHome, l as init_codex, o as findLatestRollout } from "./codex-sgWVCGUd.js";
+import { f as init_config$1, m as loadConfigSync$1 } from "./config-DfaUXr6r.js";
+import { a as getFlywheelActiveRunIdSync, s as init_control_settings } from "./control-settings-BguNQ1F_.js";
+import { n as createTrackerFromConfig, r as init_factory, t as createTracker } from "./factory-BtaRsHFC.js";
+import { a as init_stack_health, i as getWorkspaceStackHealth } from "./stack-health-C-SnpRHh.js";
+import { i as createActiveSlice, l as init_dag, o as getDispatchableItems, s as groupItemsByWave } from "./dag-C6kYyF17.js";
+import { c as generateFixedPointPromptSync, f as initHookSync, n as checkHookSync, p as init_hooks } from "./hooks-BS_JrvYP.js";
+import { n as resolveHarness, t as init_harness_resolve } from "./harness-resolve-Dx8hUsvC.js";
+import { r as isRoleTerminal, t as init_reap_terminal_sessions } from "./reap-terminal-sessions-CFkuquQj.js";
+import { c as isStateMigrated, o as init_state_home } from "./state-home-Bur1y4oH.js";
+import { n as provisionClaudeHooks, t as init_claude_hooks_provision } from "./claude-hooks-provision-Du_PkMsp.js";
+import { a as init_lifecycle_io, t as appendContinueSessionEntryForIssue } from "./lifecycle-io-FfPUtz-y.js";
+import { r as init_swarm_readiness, t as analyzeSwarmReadiness } from "./swarm-readiness-sXB1vhzo.js";
+import { dirname, join, relative } from "node:path";
 import { Data, Duration, Effect, FileSystem } from "effect";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync, statfsSync, unlinkSync, writeFileSync } from "fs";
 import { basename as basename$1, dirname as dirname$1, join as join$1, resolve as resolve$1 } from "path";
@@ -44,11 +45,11 @@ import { chmodSync as chmodSync$1, closeSync as closeSync$1, constants, cpSync,
 import { chmod, mkdir, readFile, stat as stat$1, writeFile } from "node:fs/promises";
 import { randomUUID } from "crypto";
 import { ChildProcess } from "effect/unstable/process";
-import { mkdir as mkdir$1, readFile as readFile$1, readdir as readdir$1, rename as rename$1, rm as rm$1, stat as stat$2, writeFile as writeFile$1 } from "fs/promises";
+import { mkdir as mkdir$1, open as open$1, readFile as readFile$1, readdir as readdir$1, rename as rename$1, rm as rm$1, stat as stat$2, writeFile as writeFile$1 } from "fs/promises";
 import { platform as platform$2 } from "process";
 import { exec, execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { exec as exec$1, execSync as execSync$1 } from "child_process";
+import { exec as exec$1, execSync } from "child_process";
 import { promisify as promisify$1 } from "util";
 import { createHash as createHash$1, randomBytes, randomUUID as randomUUID$1 } from "node:crypto";
 import { fileURLToPath } from "node:url";
@@ -356,6 +357,402 @@ var init_ohmypi_parser = __esmMin((() => {
 	]);
 }));
 //#endregion
+//#region ../../lib/codex-auth.ts
+/** Absolute path to the codex CLI's own global credential file. */
+function getNativeCodexAuthPath() {
+	return join$1(homedir(), ".codex", "auth.json");
+}
+/**
+* Pure classifier for the native store's raw JSON (PAN-2285). Decodes the
+* access_token JWT `exp` to decide valid/expired; reports missing when the file
+* is absent (raw === null) and unknown when it is malformed. API-key mode
+* (OPENAI_API_KEY set, no OAuth tokens) is a valid auth state. Exported for
+* testing with fabricated JWTs.
+*/
+function classifyNativeCodexAuth(raw, now = Date.now()) {
+	if (raw === null) return { status: "missing" };
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return { status: "unknown" };
+	}
+	const lastRefresh = typeof parsed.last_refresh === "string" ? parsed.last_refresh : void 0;
+	const accessToken = typeof parsed.tokens?.access_token === "string" ? parsed.tokens.access_token : null;
+	if (!accessToken) {
+		if (typeof parsed.OPENAI_API_KEY === "string" && parsed.OPENAI_API_KEY) return {
+			status: "valid",
+			lastRefresh
+		};
+		return {
+			status: "unknown",
+			lastRefresh
+		};
+	}
+	const idToken = typeof parsed.tokens?.id_token === "string" ? parsed.tokens.id_token : null;
+	const idClaims = idToken ? decodeJwtPayload$1(idToken) : null;
+	const email = idClaims && typeof idClaims.email === "string" ? idClaims.email : void 0;
+	const accessClaims = decodeJwtPayload$1(accessToken);
+	const expSec = accessClaims && typeof accessClaims.exp === "number" ? accessClaims.exp : null;
+	if (expSec === null) return {
+		status: "unknown",
+		email,
+		lastRefresh
+	};
+	const expiresAt = (/* @__PURE__ */ new Date(expSec * 1e3)).toISOString();
+	if (expSec * 1e3 <= now) return {
+		status: "expired",
+		email,
+		expiresAt,
+		lastRefresh
+	};
+	return {
+		status: "valid",
+		email,
+		expiresAt,
+		lastRefresh
+	};
+}
+/** Async native-store probe used by the dashboard status endpoint. */
+async function probeNativeCodexAuth(now = Date.now()) {
+	const path = getNativeCodexAuthPath();
+	let raw;
+	let mtimeMs = 0;
+	try {
+		raw = await readFile$1(path, "utf8");
+		mtimeMs = (await stat$2(path)).mtimeMs;
+	} catch {
+		raw = null;
+	}
+	return {
+		...classifyNativeCodexAuth(raw, now),
+		mtimeMs
+	};
+}
+/** Sync native-store probe used by the spawn gate. */
+function probeNativeCodexAuthSync(now = Date.now()) {
+	let raw;
+	try {
+		raw = readFileSync(getNativeCodexAuthPath(), "utf8");
+	} catch {
+		raw = null;
+	}
+	return classifyNativeCodexAuth(raw, now);
+}
+function nativeCodexAuthMtimeSync() {
+	try {
+		return statSync(getNativeCodexAuthPath()).mtimeMs;
+	} catch {
+		return 0;
+	}
+}
+/**
+* Pure classifier over a codex agent's pane tail (PAN-2285). True when the pane
+* shows the revoked/invalidated refresh-token error. Exported so it is testable
+* without tmux.
+*/
+function paneShowsCodexAuthBurn(paneText) {
+	return CODEX_AUTH_BURN_MARKERS.some((marker) => paneText.includes(marker));
+}
+/**
+* Mark an agent state as codex-auth-burned (PAN-2285). Pure mutation — the
+* caller persists via the agent-state write door (saveAgentStateSync), which
+* mirrors into the shared agents table so the flag crosses the deacon/server
+* process boundary. Returns true only when the state was newly flagged
+* (idempotent: an already-flagged state is left untouched), so callers can emit
+* a single operator notice instead of one per patrol tick. The flag time is
+* embedded in the reason (`codex-auth-burned[<ISO>]`) because the agents table
+* has no dedicated column for it and `troubledAt` may predate the burn when the
+* agent was already troubled for another reason.
+*/
+function applyCodexAuthBurnFlag(state, nowMs = Date.now()) {
+	if (state.troubled && state.lastFailureReason?.startsWith("codex-auth-burned")) return false;
+	const nowIso = new Date(nowMs).toISOString();
+	state.troubled = true;
+	if (!state.troubledAt) state.troubledAt = nowIso;
+	state.lastFailureReason = `${CODEX_AUTH_BURNED_REASON_PREFIX}[${nowIso}]: Codex refresh token was revoked — re-authenticate (dashboard Codex-auth banner has a Re-authenticate button, or run \`codex login\`)`;
+	state.lastFailureAt = nowIso;
+	return true;
+}
+/**
+* When (epoch ms) a state was flagged codex-auth-burned, or null if it is not
+* currently flagged. Requires the troubled gate to still be set — `pan
+* untroubled` / resume clears troubled and the failure fields, which retires the
+* flag. Parses the ISO stamp embedded in the reason; falls back to `troubledAt`
+* for flags written by builds that predate the embedded stamp.
+*/
+function codexAuthBurnFlaggedAtMs(state) {
+	if (!state.troubled) return null;
+	const reason = state.lastFailureReason;
+	if (!reason?.startsWith("codex-auth-burned")) return null;
+	const embedded = reason.match(/^codex-auth-burned\[([^\]]+)\]/)?.[1];
+	const fromReason = embedded ? Date.parse(embedded) : NaN;
+	if (Number.isFinite(fromReason)) return fromReason;
+	const fromTroubledAt = state.troubledAt ? Date.parse(state.troubledAt) : NaN;
+	return Number.isFinite(fromTroubledAt) ? fromTroubledAt : 0;
+}
+/**
+* Pure filter: which of these agent states are burned AND still current? Flags
+* recorded strictly before the native store's last write are stale: a global
+* `codex login` rewrites ~/.codex/auth.json (bumping its mtime) and heals every
+* agent through the shared symlink, so those burns no longer apply (the flag
+* itself is retired when the agent is untroubled/resumed).
+*/
+function filterCodexAuthBurnedAgentIds(states, nativeMtimeMs) {
+	const active = [];
+	for (const state of states) {
+		const flaggedAt = codexAuthBurnFlaggedAtMs(state);
+		if (flaggedAt !== null && flaggedAt >= nativeMtimeMs) active.push(state.id);
+	}
+	return active;
+}
+/**
+* Agents currently flagged codex-auth-burned. Callers supply states read through
+* the agent resolver so this pure auth module does not create a spawn-time cycle.
+*/
+function listCodexAuthBurnedAgentsSync(nativeMtimeMs, states) {
+	return filterCodexAuthBurnedAgentIds(states, nativeMtimeMs);
+}
+/** Sync convenience for the spawn gate: are any agents still burned right now? */
+function hasActiveBurnedCodexAgentsSync(states) {
+	return listCodexAuthBurnedAgentsSync(nativeCodexAuthMtimeSync(), states).length > 0;
+}
+function nativeToStatus(native) {
+	switch (native.status) {
+		case "valid": return {
+			status: "valid",
+			email: native.email ?? "",
+			expiresAt: native.expiresAt ?? "",
+			source: "native"
+		};
+		case "expired": return {
+			status: "expired",
+			email: native.email ?? "",
+			expiresAt: native.expiresAt ?? "",
+			source: "native"
+		};
+		case "missing": return {
+			status: "missing",
+			source: "native"
+		};
+		case "unknown": return {
+			status: "unknown",
+			source: "native"
+		};
+	}
+}
+function withSource(status, source) {
+	return {
+		...status,
+		source
+	};
+}
+/**
+* Merge the native and cliproxy statuses into the single worst state the banner
+* should react to (burned > expired > valid > missing > unknown). Both stores
+* are healed by the same `codex login`, so surfacing the more severe one is
+* correct and its remedy is identical. Exported for testing.
+*/
+function combineCodexAuthStatuses(native, cliproxy) {
+	const nativeSev = CODEX_AUTH_SEVERITY[native.status];
+	return CODEX_AUTH_SEVERITY[cliproxy.status] > nativeSev ? withSource(cliproxy, "cliproxy") : native;
+}
+async function checkCodexAuthStatusPromise(options = {}) {
+	const native = await probeNativeCodexAuth(Date.now());
+	const cliproxy = await checkCliproxyCodexAuthStatusPromise(options);
+	const activeBurned = listCodexAuthBurnedAgentsSync(native.mtimeMs, options.agentStates ?? []);
+	if (activeBurned.length > 0) return {
+		status: "burned",
+		email: native.email ?? "",
+		expiresAt: native.expiresAt ?? "",
+		source: "native",
+		affectedAgents: activeBurned
+	};
+	return combineCodexAuthStatuses(nativeToStatus(native), cliproxy);
+}
+/**
+* Spawn gate (PAN-2285): refuse to launch a NEW codex-harness agent while the
+* native codex auth is unusable — missing/expired file or any agent currently
+* burned (revoked refresh token shared across the family). Resumes are exempt:
+* the symlink migration in initCodexHome heals a stale home on relaunch. Throws
+* a clear, remedy-naming error, mirroring the harness-policy ToS gate.
+*/
+function assertCodexNativeAuthForSpawn(harness, agentStates) {
+	if (harness !== "codex") return;
+	const native = probeNativeCodexAuthSync();
+	const reason = native.status === "missing" ? "not signed in (~/.codex/auth.json is missing)" : native.status === "expired" ? "expired (~/.codex/auth.json access token has lapsed)" : hasActiveBurnedCodexAgentsSync(agentStates) ? "revoked (a running codex agent hit a revoked refresh token — the shared token family is dead)" : null;
+	if (reason === null) return;
+	throw new Error(`Cannot spawn a Codex agent: native Codex authentication is ${reason}. Run \`codex login\` on the host (or click Re-authenticate in the dashboard Codex-auth banner), then retry.`);
+}
+async function checkCliproxyCodexAuthStatusPromise(options = {}) {
+	const credPath = join$1(getCliproxyAuthDir(), "codex-primary.json");
+	let raw;
+	let credMtimeMs = null;
+	try {
+		raw = await readFile$1(credPath, "utf8");
+		credMtimeMs = (await stat$2(credPath)).mtimeMs;
+	} catch {
+		return { status: "missing" };
+	}
+	let creds;
+	try {
+		creds = JSON.parse(raw);
+	} catch {
+		return {
+			status: "unknown",
+			message: "Malformed credential file"
+		};
+	}
+	const accessToken = typeof creds.access_token === "string" ? creds.access_token : null;
+	if (!accessToken) return {
+		status: "unknown",
+		message: "Missing access_token in credential file"
+	};
+	const claims = decodeJwtPayload$1(accessToken);
+	if (!claims) return {
+		status: "unknown",
+		message: "Unable to decode access_token"
+	};
+	const expSec = typeof claims.exp === "number" ? claims.exp : null;
+	if (expSec === null) return {
+		status: "unknown",
+		message: "Missing exp claim in access_token"
+	};
+	const email = typeof creds.email === "string" ? creds.email : "";
+	const expiresAt = (/* @__PURE__ */ new Date(expSec * 1e3)).toISOString();
+	if (expSec * 1e3 <= Date.now()) return {
+		status: "expired",
+		email,
+		expiresAt
+	};
+	return await applyBurnedTokenOverride({
+		status: "valid",
+		email,
+		expiresAt
+	}, email, expiresAt, { ignoreBurnBefore: options.ignoreBurnBefore ?? credMtimeMs ?? void 0 });
+}
+/** Read the trailing window of the cliproxy log for burn/failure analysis. */
+async function readLogTail(path) {
+	const TAIL_BYTES = 128 * 1024;
+	const file = await open$1(path, "r");
+	try {
+		const stat = await file.stat();
+		const length = Math.min(stat.size, TAIL_BYTES);
+		const buffer = Buffer.alloc(length);
+		await file.read(buffer, 0, length, stat.size - length);
+		return buffer.toString("utf8");
+	} finally {
+		await file.close();
+	}
+}
+async function applyBurnedTokenOverride(baseStatus, email, expiresAt, options) {
+	let logRaw;
+	try {
+		logRaw = await readLogTail(getCliproxyLogPath());
+	} catch {
+		return baseStatus;
+	}
+	return evaluateBurnedFromLog(logRaw, baseStatus, email, expiresAt, options);
+}
+/**
+* Pure decision: given the cliproxy log tail, decide whether a JWT-valid token
+* is actually burned. Exported for regression testing (PAN-1584).
+*
+* "Auth failure" evidence = either a refresh-token burn line
+* (`refresh token has already been used`) OR a `503` on `/v1/messages` /
+* `/v1/chat/completions` (the live symptom the agent hits once cliproxy disables
+* the provider — and which keeps appearing after the burn line stops, since a
+* disabled provider no longer attempts refreshes). "Success" = a `200` on those
+* same paths (proves the auth path works right now).
+*
+* Decision:
+*   - No failure evidence              → trust base status.
+*   - Success AFTER the last failure   → trust base status (recovered).
+*   - Failure AFTER the credential's last write (ignoreBurnBefore) → BURNED,
+*     regardless of age. The credential write time is when you last logged in;
+*     a failure after it means the current token is dead. This is authoritative
+*     and is the fix for the bug where a >1h-stale burn line was dismissed as
+*     "valid" during a quiet period even though the token was dead (PAN-1584).
+*   - Failure BEFORE that cutoff       → trust base status (re-authed since).
+*   - No cutoff available              → fall back to the staleness backstop:
+*     burned only if the last failure is within BURN_STALENESS_MS.
+*
+* We intentionally don't probe cliproxy with HTTP — `GET /v1/models` always
+* 401s (it needs real OAuth, not the local key) and would generate spurious log
+* lines on every dashboard load.
+*/
+function evaluateBurnedFromLog(logRaw, baseStatus, email, expiresAt, options = {}) {
+	const now = options.now ?? Date.now();
+	const lines = logRaw.split("\n").slice(-500);
+	const isBurnLine = (l) => l.includes("refresh token has already been used") || l.includes("refresh_token_reused");
+	const isAuthFailure503 = (l) => /\b503 \|/.test(l) && /POST\s+"\/v1\/(messages|chat\/completions)/.test(l);
+	const isSuccess = (l) => /\b200 \|/.test(l) && /POST\s+"\/v1\/(messages|chat\/completions)/.test(l);
+	const timestampAt = (idx) => {
+		for (let j = idx; j >= Math.max(0, idx - 10); j--) {
+			const m = lines[j]?.match(/^\[(\d{4}-\d{2}-\d{2}) (\d{2}:\d{2}:\d{2})\]/);
+			if (m) {
+				const t = Date.parse(`${m[1]}T${m[2]}Z`);
+				if (Number.isFinite(t)) return t;
+			}
+		}
+		return null;
+	};
+	let lastFailureIdx = -1;
+	let lastFailureTimestamp = null;
+	let lastSuccessIdx = -1;
+	for (let i = lines.length - 1; i >= 0; i--) {
+		const line = lines[i] ?? "";
+		if (lastFailureIdx < 0 && (isBurnLine(line) || isAuthFailure503(line))) {
+			lastFailureIdx = i;
+			lastFailureTimestamp = timestampAt(i);
+		}
+		if (lastSuccessIdx < 0 && isSuccess(line)) lastSuccessIdx = i;
+		if (lastFailureIdx >= 0 && lastSuccessIdx >= 0) break;
+	}
+	if (lastFailureIdx < 0) return baseStatus;
+	if (lastSuccessIdx > lastFailureIdx) return baseStatus;
+	if (options.ignoreBurnBefore !== void 0) {
+		if (lastFailureTimestamp !== null && lastFailureTimestamp + 1e3 <= options.ignoreBurnBefore) return baseStatus;
+		return {
+			status: "burned",
+			email,
+			expiresAt
+		};
+	}
+	if (lastFailureTimestamp !== null && now - lastFailureTimestamp > BURN_STALENESS_MS) return baseStatus;
+	return {
+		status: "burned",
+		email,
+		expiresAt
+	};
+}
+var CodexAuthCheckError, CODEX_AUTH_BURN_MARKERS, CODEX_AUTH_BURNED_REASON_PREFIX, CODEX_AUTH_SEVERITY, BURN_STALENESS_MS, checkCodexAuthStatus;
+var init_codex_auth = __esmMin((() => {
+	init_cliproxy();
+	CodexAuthCheckError = class extends Data.TaggedError("CodexAuthCheckError") {};
+	CODEX_AUTH_BURN_MARKERS = [
+		"could not be refreshed because your refresh token was revoked",
+		"token_invalidated",
+		"token_revoked"
+	];
+	CODEX_AUTH_BURNED_REASON_PREFIX = "codex-auth-burned";
+	CODEX_AUTH_SEVERITY = {
+		burned: 4,
+		expired: 3,
+		valid: 2,
+		missing: 1,
+		unknown: 0
+	};
+	BURN_STALENESS_MS = 3600 * 1e3;
+	checkCodexAuthStatus = (options = {}) => Effect.tryPromise({
+		try: () => checkCodexAuthStatusPromise(options),
+		catch: (cause) => new CodexAuthCheckError({
+			message: cause instanceof Error ? cause.message : String(cause),
+			cause
+		})
+	});
+}));
+//#endregion
 //#region ../../lib/overdeck/agent-rollback-state.ts
 function getRollbackAgentStatePath(agentId) {
 	return join(getOverdeckHome(), "agents", agentId, AGENT_STATE_ROLLBACK_FILE);
@@ -889,54 +1286,6 @@ var init_agent_record_sync = __esmMin((() => {
 	init_record();
 }));
 //#endregion
-//#region ../../lib/persistent-logger.ts
-/**
-* Append-only persistent logger for forensic audit trails.
-*
-* Complements the SQLite event store (activity-logger.ts) with flat-file logs
-* that survive event-store resets and are greppable from the shell.
-*
-* Files:
-*   ~/.overdeck/logs/deacon.log        — deacon startup recovery actions
-*   ~/.overdeck/agents/<id>/lifecycle.log — per-agent state transitions
-*/
-function logsDir() {
-	return join$1(getOverdeckHome(), "logs");
-}
-function agentDir(agentId) {
-	return join$1(getOverdeckHome(), "agents", agentId);
-}
-function ensureLogsDir() {
-	try {
-		mkdirSync(logsDir(), { recursive: true });
-	} catch {}
-}
-function ensureAgentDir(agentId) {
-	try {
-		mkdirSync(agentDir(agentId), { recursive: true });
-	} catch {}
-}
-function timestamp() {
-	return (/* @__PURE__ */ new Date()).toISOString();
-}
-/** Append a line to ~/.overdeck/logs/deacon.log */
-function logDeaconEventSync(message) {
-	ensureLogsDir();
-	try {
-		appendFileSync(join$1(logsDir(), "deacon.log"), `[${timestamp()}] ${message}\n`);
-	} catch {}
-}
-/** Append a line to ~/.overdeck/agents/<agentId>/lifecycle.log */
-function logAgentLifecycleSync(agentId, message) {
-	ensureAgentDir(agentId);
-	try {
-		appendFileSync(join$1(agentDir(agentId), "lifecycle.log"), `[${timestamp()}] ${message}\n`);
-	} catch {}
-}
-var init_persistent_logger = __esmMin((() => {
-	init_paths();
-}));
-//#endregion
 //#region ../../lib/agents/agent-state.ts
 function getAgentDir(agentId) {
 	return join$1(getOverdeckHome(), "agents", agentId);
@@ -1308,10 +1657,16 @@ function getAgentResumeGateBlockReason(state) {
 /** Intent-aware policy over a classified gate. This function never mutates agent state. */
 function decideResumeGate(block, intent, context = {}) {
 	if (!block) return { decision: "proceed" };
-	if (intent === "message-delivery") return {
-		decision: "queue-message",
-		reason: block.reason
-	};
+	if (intent === "message-delivery") {
+		if (block.gate === "stopped-by-user" && context.hasCompletedHandoff === true && context.owesRework === true) return {
+			decision: "proceed",
+			clearStoppedByUser: true
+		};
+		return {
+			decision: "queue-message",
+			reason: block.reason
+		};
+	}
 	if (intent === "operator-start") {
 		if (block.gate === "paused") return {
 			decision: "block",
@@ -2324,7 +2679,7 @@ async function createOhmypiFifoPromise(agentId, home) {
 		mode: 448
 	});
 	if (existsSync$1(paths.fifoPath)) unlinkSync$1(paths.fifoPath);
-	await execAsync$7(`mkfifo -m 600 ${shellQuote$2(paths.fifoPath)}`);
+	await execAsync$6(`mkfifo -m 600 ${shellQuote$1(paths.fifoPath)}`);
 	return paths.fifoPath;
 }
 /**
@@ -2362,14 +2717,14 @@ function writeOhmypiCommandSync(agentId, command, home) {
 		closeSync$1(fd);
 	}
 }
-function shellQuote$2(s) {
+function shellQuote$1(s) {
 	if (/^[A-Za-z0-9._/-]+$/.test(s)) return s;
 	return `'${s.replace(/'/g, `'\\''`)}'`;
 }
-var execAsync$7, OhmypiNotReady, OhmypiFifoError, createOhmypiFifo;
+var execAsync$6, OhmypiNotReady, OhmypiFifoError, createOhmypiFifo;
 var init_ohmypi_fifo = __esmMin((() => {
 	init_paths();
-	execAsync$7 = promisify(exec);
+	execAsync$6 = promisify(exec);
 	OhmypiNotReady = class extends Error {
 		code = "OHMYPI_NOT_READY";
 		constructor(message) {
@@ -2429,12 +2784,12 @@ async function claudeSystemPromptFiles(workspace, harness) {
 	files.push(await ensureSessionContextBriefingFile());
 	const behavior = getHarnessBehavior(harness);
 	if (behavior.contextLayerKind === "pi") {
-		const { piGlobalContextFile } = await import("./context-layers-ByOWUjUg.js");
+		const { piGlobalContextFile } = await import("./context-layers-DWL_8HhY.js");
 		const globalFile = piGlobalContextFile();
 		if (existsSync(globalFile)) files.unshift(globalFile);
 	}
 	if (behavior.contextLayerKind === "codex") {
-		const { codexGlobalContextFile } = await import("./context-layers-ByOWUjUg.js");
+		const { codexGlobalContextFile } = await import("./context-layers-DWL_8HhY.js");
 		const globalFile = codexGlobalContextFile();
 		if (existsSync(globalFile)) files.unshift(globalFile);
 	}
@@ -2461,14 +2816,14 @@ async function hasAgentRuntimeInSubtree(rootPid, harness = "claude-code") {
 		if (seen.has(pid) || !/^\d+$/.test(pid)) continue;
 		seen.add(pid);
 		try {
-			const { stdout: comm } = await execAsync$5(`ps -p ${pid} -o comm=`);
+			const { stdout: comm } = await execAsync$4(`ps -p ${pid} -o comm=`);
 			const name = comm.trim();
 			if (expectedProcessNames.has(name)) return true;
 		} catch {
 			continue;
 		}
 		try {
-			const { stdout: kids } = await execAsync$5(`pgrep -P ${pid}`);
+			const { stdout: kids } = await execAsync$4(`pgrep -P ${pid}`);
 			for (const kid of kids.trim().split("\n").filter(Boolean)) queue.push(kid);
 		} catch {}
 	}
@@ -2587,7 +2942,7 @@ async function injectPiPromptTimeMemory(agentId, prompt) {
 			agentRole: agentState.role ?? "work",
 			agentHarness: agentState.harness ?? "claude-code"
 		};
-		const { injectPromptTimeMemory } = await import("./injection-BLWfwTVZ.js");
+		const { injectPromptTimeMemory } = await import("./injection-Bvhyg_MV.js");
 		const result = await injectPromptTimeMemory({
 			prompt,
 			identity,
@@ -2621,7 +2976,7 @@ async function injectPiConversationMemory(opts, prompt) {
 			agentRole: "work",
 			agentHarness: "ohmypi"
 		};
-		const { injectPromptTimeMemory } = await import("./injection-BLWfwTVZ.js");
+		const { injectPromptTimeMemory } = await import("./injection-Bvhyg_MV.js");
 		const result = await injectPromptTimeMemory({
 			prompt,
 			identity,
@@ -2797,7 +3152,7 @@ async function getRoleRuntimeBaseCommand(model, agentName, role, harness = "clau
 	if (provider.name === "openai" && await getProviderAuthMode(validatedModel) === "subscription") return `claude${printFlag}${roleInject}${permissionFlags} --model ${shellQuoteModelIdSync(CLI_PROXY_MODEL_ALIASES[validatedModel] ?? validatedModel)}${effortFlag}${nameFlag}`;
 	return `claude${printFlag}${roleInject}${permissionFlags} --model ${quotedModel}${effortFlag}${nameFlag}`;
 }
-var import_dist, execAsync$5, missingRoleDefinitionWarnings, OHMYPI_AGENT_READY_TIMEOUT_SECONDS;
+var import_dist, execAsync$4, missingRoleDefinitionWarnings, OHMYPI_AGENT_READY_TIMEOUT_SECONDS;
 var init_runtime_command = __esmMin((() => {
 	import_dist = /* @__PURE__ */ __toESM(require_dist(), 1);
 	init_claude_permissions();
@@ -2817,7 +3172,7 @@ var init_runtime_command = __esmMin((() => {
 	init_agent_state();
 	init_identity();
 	init_provider_env();
-	execAsync$5 = promisify$1(exec$1);
+	execAsync$4 = promisify$1(exec$1);
 	missingRoleDefinitionWarnings = /* @__PURE__ */ new Set();
 	OHMYPI_AGENT_READY_TIMEOUT_SECONDS = 120;
 }));
@@ -2876,6 +3231,14 @@ var init_resolve_tier = __esmMin((() => {
 }));
 //#endregion
 //#region ../../lib/agents/staffing.ts
+/** Per-issue work-model override from the issue record, or undefined. */
+function resolveIssueWorkModel(issueId) {
+	const resolved = resolveProjectFromIssueSync(issueId);
+	if (!resolved) return void 0;
+	const project = getProjectSync(resolved.projectKey);
+	if (!project) return void 0;
+	return readIssueRecordSync(project, issueId)?.workModel || void 0;
+}
 /** Provider-default harness for a model (PAN-1984: harness is derived from the
 * model's provider — per-provider setting else built-in default). */
 function providerDefaultHarnessSync(model, config) {
@@ -2900,6 +3263,16 @@ function resolveImplicitStaffing(config, spawnKey) {
 */
 function resolveStaffing(item, options = {}) {
 	const config = options.config ?? loadConfigSync().config;
+	const issueModel = options.issueId ? resolveIssueWorkModel(options.issueId) : void 0;
+	if (issueModel) {
+		const model = requireModelOverrideSync(issueModel);
+		return {
+			tierName: "issue-override",
+			model,
+			harness: providerDefaultHarnessSync(model, config),
+			implicit: false
+		};
+	}
 	const tiered = config.tieredExecution;
 	if (tiered && resolveTieredExecutionEnabled(tiered, options.planMetadata)) try {
 		const tier = resolveTier(item, tiered);
@@ -2939,7 +3312,9 @@ var init_staffing = __esmMin((() => {
 	init_config_yaml();
 	init_roles();
 	init_model_validation();
+	init_record();
 	init_providers();
+	init_projects();
 	init_percent();
 	init_resolve_tier();
 	init_tier_table();
@@ -3011,7 +3386,8 @@ function resolveSlotTierSpawnParams(baseWorkspace, slotItemId, explicitModel, sp
 	const staffing = resolveStaffing(item, {
 		planMetadata,
 		spawnKey,
-		config
+		config,
+		issueId: issueId ?? void 0
 	});
 	return {
 		model: staffing.model,
@@ -3043,6 +3419,7 @@ function resolveSingleWorkTierSpawnParams(workspace, explicitModel, spawnKey) {
 	const staffing = resolveStaffing(item, {
 		planMetadata,
 		spawnKey,
+		issueId: issueId ?? void 0,
 		config: {
 			...config,
 			tieredExecution: {
@@ -3125,7 +3502,7 @@ async function transitionIssueToInReview(issueId, workspacePath) {
 async function buildAgentLaunchConfig(opts) {
 	const model = requireModelOverrideSync(opts.model);
 	try {
-		const { injectOverdeckInfraDeny } = await import("./claude-settings-overlay-BbA4FbVI.js");
+		const { injectOverdeckInfraDeny } = await import("./claude-settings-overlay-DUWWLd6M.js");
 		await Effect.runPromise(injectOverdeckInfraDeny(opts.workspace));
 	} catch (err) {
 		console.warn(`[agents] injectOverdeckInfraDeny failed for ${opts.agentId} (non-fatal): ${err instanceof Error ? err.message : err}`);
@@ -3206,7 +3583,7 @@ async function retrieveSpawnTimeMemoryContext(input) {
 			agentRole: input.role,
 			agentHarness: input.harness
 		};
-		const { injectPromptTimeMemory } = await import("./injection-BLWfwTVZ.js");
+		const { injectPromptTimeMemory } = await import("./injection-Bvhyg_MV.js");
 		return (await injectPromptTimeMemory({
 			prompt: input.prompt,
 			identity,
@@ -3297,7 +3674,7 @@ async function assertWorkspaceStackHealthyForSpawn(issueId, role, allowHost = fa
 	record.attempts += 1;
 	spawnStackRebuildState.set(normalizedIssue, record);
 	console.log(`[agents] Workspace stack for ${normalizedIssue} unhealthy (${details}) — rebuilding before spawn (attempt ${record.attempts}/${SPAWN_STACK_REBUILD_MAX_ATTEMPTS})`);
-	const { rebuildWorkspaceStack } = await import("./rebuild-stack-GOsWqXi3.js");
+	const { rebuildWorkspaceStack } = await import("./rebuild-stack-C7JPUom6.js");
 	const result = await Effect.runPromise(rebuildWorkspaceStack(issueId, { onProgress: (m) => console.log(`[agents]   ${normalizedIssue} stack rebuild: ${m}`) })).catch((err) => ({
 		success: false,
 		error: err instanceof Error ? err.message : String(err)
@@ -4196,12 +4573,6 @@ var init_config = __esmMin((() => {
 				120
 			]
 		},
-		cost_limits: {
-			per_agent_usd: 10,
-			per_issue_usd: 25,
-			daily_total_usd: 100,
-			alert_threshold: .8
-		},
 		retention: {
 			agent_state_days: 7,
 			reviewer_state_days: 1,
@@ -4523,151 +4894,6 @@ var init_concurrency = __esmMin((() => {
 	swarmReservedThisPatrol = 0;
 }));
 //#endregion
-//#region ../../lib/agents/queries.ts
-function listRunningAgentsSync() {
-	const tmuxSessions = listSessionsSync();
-	const tmuxNames = new Set(tmuxSessions.map((s) => s.name));
-	return listOverdeckAgentStatesSync().map((state) => {
-		const normalizedId = normalizeAgentId(state.id);
-		return {
-			...state,
-			id: normalizedId,
-			tmuxActive: tmuxNames.has(normalizedId)
-		};
-	});
-}
-/**
-* PAN-1908: list all agents in the SQLite registry with optional filtering.
-* This is the replacement for enumerating ~/.overdeck/agents/ directories.
-*/
-function listAgentStates(options) {
-	return listOverdeckAgentStatesSync().filter((state) => {
-		if (options?.status && state.status !== options.status) return false;
-		if (options?.role && state.role !== options.role) return false;
-		return true;
-	});
-}
-/**
-* PAN-1048 P2: async startup migration.
-*
-* The previous synchronous version used readdirSync, readFileSync,
-* killSession (sync tmux subprocess), and rmSync — all on the Node
-* event loop. Called from warnOnBareNumericIssueIds() during dashboard
-* read-model bootstrap, this blocked all HTTP/WebSocket/PTY traffic on
-* server startup while it scanned every agent dir, killed stale tmux
-* sessions, and recursively deleted directories.
-*
-* This async variant does the same work using fs/promises and the
-* already-async killSessionAsync() so the bootstrap path no longer
-* stalls the event loop.
-*/
-async function dropLegacyAgentStatesMissingRoleAsync() {
-	if (!existsSync(AGENTS_DIR)) return 0;
-	const fsp = await import("fs/promises");
-	let entries;
-	try {
-		entries = await fsp.readdir(AGENTS_DIR);
-	} catch {
-		return 0;
-	}
-	let dropped = 0;
-	await Promise.all(entries.map(async (entry) => {
-		const dirPath = join$1(AGENTS_DIR, entry);
-		let stat;
-		try {
-			stat = await fsp.stat(dirPath);
-		} catch {
-			return;
-		}
-		if (!stat.isDirectory()) return;
-		const agentId = normalizeAgentId(entry);
-		const stateFile = getRollbackAgentStatePath(agentId);
-		let raw;
-		try {
-			const contents = await fsp.readFile(stateFile, "utf8");
-			raw = JSON.parse(contents);
-		} catch {
-			return;
-		}
-		if (isRole(raw.role)) return;
-		try {
-			await Effect.runPromise(killSession(agentId));
-		} catch {}
-		try {
-			await fsp.rm(dirPath, {
-				recursive: true,
-				force: true
-			});
-			dropped++;
-		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			console.warn(`[agents] Failed to drop legacy agent state ${agentId}: ${msg}`);
-		}
-	}));
-	return dropped;
-}
-/**
-* Scan ~/.overdeck/agents/ for state files with bare numeric issueIds
-* (e.g. "484" instead of "PAN-484") and log warnings to stderr.
-*
-* These workspaces were created before the pan- prefix convention and may
-* cause cross-tracker pollution if their in_review transition is triggered.
-* Called once at server startup to surface legacy state files.
-*/
-/**
-* PAN-1048 P2: bootstrap-path migration is async.
-*
-* Sweeps legacy state files missing a `role` field and warns on bare
-* numeric issueIds. Both passes used to be synchronous (readdirSync,
-* readFileSync, killSession, rmSync), which blocked the dashboard
-* server's event loop on startup. The async version scans the same
-* directory once per concern and uses fs/promises throughout.
-*/
-async function warnOnBareNumericIssueIds() {
-	const droppedLegacyAgents = await dropLegacyAgentStatesMissingRoleAsync();
-	if (droppedLegacyAgents > 0) console.warn(`[agents] Dropped ${droppedLegacyAgents} legacy agent state file(s) missing role`);
-	if (!existsSync(AGENTS_DIR)) return;
-	const fsp = await import("fs/promises");
-	let entries;
-	try {
-		entries = await fsp.readdir(AGENTS_DIR);
-	} catch {
-		return;
-	}
-	const legacy = [];
-	await Promise.all(entries.map(async (entry) => {
-		const dirPath = join$1(AGENTS_DIR, entry);
-		try {
-			if (!(await fsp.stat(dirPath)).isDirectory()) return;
-		} catch {
-			return;
-		}
-		const state = await Effect.runPromise(getAgentState(entry));
-		if (state?.issueId && /^\d+$/.test(state.issueId)) legacy.push(`${entry} (issueId: "${state.issueId}")`);
-	}));
-	if (legacy.length > 0) console.warn(`[agents] WARNING: ${legacy.length} agent state file(s) have bare numeric issueIds (created before the pan- prefix convention). These agents will not be able to transition tracker state. Consider removing or updating them:\n` + legacy.map((l) => `  ~/.overdeck/agents/${l}`).join("\n"));
-}
-var listRunningAgents;
-var init_queries = __esmMin((() => {
-	init_agents();
-	init_tmux();
-	init_paths();
-	init_agent_rollback_state();
-	init_agent_state_sync();
-	listRunningAgents = () => Effect.gen(function* () {
-		const tmuxSessions = yield* listSessions();
-		const tmuxNames = new Set(tmuxSessions.map((s) => s.name));
-		return listOverdeckAgentStatesSync().map((state) => {
-			const normalizedId = normalizeAgentId(state.id);
-			return {
-				...state,
-				id: normalizedId,
-				tmuxActive: tmuxNames.has(normalizedId)
-			};
-		});
-	});
-}));
-//#endregion
 //#region ../../lib/agents/termination.ts
 /**
 * True when the PID is a tmux process (client or server). Used to keep the
@@ -4701,7 +4927,7 @@ function killLauncherProcessSync(agentId) {
 	const launcherPath = join$1(AGENTS_DIR, agentId, "launcher.sh");
 	let pidsOut;
 	try {
-		pidsOut = execSync$1(`pgrep -f ${JSON.stringify(launcherPath)}`, {
+		pidsOut = execSync(`pgrep -f ${JSON.stringify(launcherPath)}`, {
 			encoding: "utf-8",
 			stdio: [
 				"ignore",
@@ -4718,7 +4944,7 @@ function killLauncherProcessSync(agentId) {
 		process.kill(pid, "SIGTERM");
 	} catch {}
 	try {
-		execSync$1("sleep 0.5", { stdio: "ignore" });
+		execSync("sleep 0.5", { stdio: "ignore" });
 	} catch {}
 	const survivors = [];
 	for (const pid of pids) try {
@@ -4733,7 +4959,7 @@ async function killLauncherProcessAsync(agentId) {
 	const launcherPath = join$1(AGENTS_DIR, agentId, "launcher.sh");
 	let pidsOut;
 	try {
-		const { stdout } = await execAsync$4(`pgrep -f ${JSON.stringify(launcherPath)}`);
+		const { stdout } = await execAsync$3(`pgrep -f ${JSON.stringify(launcherPath)}`);
 		pidsOut = stdout.trim();
 	} catch {
 		return;
@@ -4777,14 +5003,14 @@ function stopAgentSync(agentId) {
 		lastActivity: (/* @__PURE__ */ new Date()).toISOString()
 	});
 }
-var execAsync$4, stopAgent;
+var execAsync$3, stopAgent;
 var init_termination = __esmMin((() => {
 	init_agents();
 	init_agent_runtime();
 	init_paths();
 	init_tmux();
 	init_errors();
-	execAsync$4 = promisify$1(exec$1);
+	execAsync$3 = promisify$1(exec$1);
 	stopAgent = (agentId) => {
 		const normalizedId = normalizeAgentId(agentId);
 		return Effect.gen(function* () {
@@ -4835,44 +5061,25 @@ var init_termination = __esmMin((() => {
 	};
 }));
 //#endregion
-//#region ../../lib/beads/bd-shim.ts
-function shellQuote$1(value) {
-	return `'${value.replace(/'/g, `'"'"'`)}'`;
-}
-function installBdAgentShim(agentDir, realBdPath) {
-	const binDir = join(agentDir, "bin");
-	mkdirSync$1(binDir, { recursive: true });
-	const path = join(binDir, "bd");
-	writeFileSync$1(path, `#!/usr/bin/env bash
-set -euo pipefail
-verb="\${1:-}"
-subverb="\${2:-}"
-case "$verb:$subverb" in
-  create:*|update:*|close:*|delete:*|import:*|init:*|migrate:*|batch:*|dep:add|dep:remove|dolt:push|dolt:commit|dolt:reset|config:set|config:unset|comments:add|comments:delete|admin:compact)
-    echo "Raw mutating bd commands are blocked in agent sessions. Use pan beads claim|update|close|create|dep|delete so the canonical writer pulls, validates, exports, and pushes durably." >&2
-    exit 64
-    ;;
-esac
-exec ${shellQuote$1(realBdPath)} "$@"
-`, { mode: 493 });
-	chmodSync$1(path, 493);
-	return {
-		binDir,
-		pathPrefix: `${binDir}${delimiter}${process.env.PATH ?? ""}`
-	};
-}
-async function resolveBdAgentShimPath(agentDir) {
-	try {
-		const { stdout } = await execAsync$3("command -v bd", { encoding: "utf8" });
-		const realBd = stdout.trim();
-		return realBd ? installBdAgentShim(agentDir, realBd).pathPrefix : void 0;
-	} catch {
-		return;
-	}
-}
-var execAsync$3;
-var init_bd_shim = __esmMin((() => {
-	execAsync$3 = promisify(exec);
+//#region ../../lib/agents/hook-readiness.ts
+/**
+* Ensure Claude's global lifecycle hooks are registered before the process can
+* emit SessionStart. This must be awaited: provisioning after launch races the
+* one event that writes ready.json and acknowledges kickoff delivery.
+*/
+async function ensureLifecycleHooksBeforeLaunch(agentId, harness) {
+	if (harness !== "claude-code") return;
+	const result = await provisionClaudeHooks();
+	if (!result.ok) {
+		const reason = result.reason ?? "unknown provisioning failure";
+		logAgentLifecycleSync(agentId, `hook provisioning: failed harness=${harness} reason=${reason}`);
+		throw new Error(`Claude Code lifecycle hooks are unavailable: ${reason}. Run \`pan up\` to install host prerequisites, then \`pan sync\` and retry.`);
+	}
+	logAgentLifecycleSync(agentId, `hook provisioning: ready harness=${harness} changed=${result.changed} binariesSynced=${result.binariesSynced} registered=${result.registered.length} pruned=${result.pruned.length}`);
+}
+var init_hook_readiness = __esmMin((() => {
+	init_claude_hooks_provision();
+	init_persistent_logger();
 }));
 //#endregion
 //#region ../../lib/agents/spawn.ts
@@ -4923,18 +5130,18 @@ async function spawnRun(issueId, role, options = {}) {
 		let reapWarmIdle = false;
 		const advancing = role === "review" || role === "test" || role === "ship";
 		try {
-			const { isPaneDead } = await import("./tmux-x291Gjjb.js");
+			const { isPaneDead } = await import("./tmux-C-rgxRDA.js");
 			if (await Effect.runPromise(isPaneDead(agentId))) reapWarmIdle = true;
 			else if (advancing) {
-				const { getReviewStatusSync } = await import("./review-status-Br6lAFGO.js");
-				const { isRoleTerminal } = await import("./reap-terminal-sessions-D_xvy-Mk.js");
+				const { getReviewStatusSync } = await import("./review-status-77N3PoZr.js");
+				const { isRoleTerminal } = await import("./reap-terminal-sessions-BR39qflC.js");
 				const status = getReviewStatusSync(issueId);
 				reapWarmIdle = !!status && isRoleTerminal(role, status);
 			}
 		} catch {}
 		if (!reapWarmIdle) throw new Error(`Role run ${agentId} already running. Use 'pan tell' to message it.`);
 		console.log(`[spawn] ${agentId} is warm-idle from the previous cycle — reaping it for the new ${role} dispatch (PAN-2579)`);
-		const { killSession } = await import("./tmux-x291Gjjb.js");
+		const { killSession } = await import("./tmux-C-rgxRDA.js");
 		await Effect.runPromise(killSession(agentId)).catch(() => {});
 	}
 	await assertWorkspaceStackHealthyForSpawn(issueId, role, options.allowHost, workspace);
@@ -4944,8 +5151,10 @@ async function spawnRun(issueId, role, options = {}) {
 		role,
 		model: selectedModel
 	});
+	assertCodexNativeAuthForSpawn(resolvedHarness, listAgentStates());
+	await ensureLifecycleHooksBeforeLaunch(agentId, resolvedHarness);
 	if (getProviderForModelSync(selectedModel).name === "openai" && await getProviderAuthMode(selectedModel) === "subscription") {
-		const { isCliproxyRunning } = await import("./cliproxy-C2xC-3vH.js");
+		const { isCliproxyRunning } = await import("./cliproxy-BQX1TL6N.js");
 		if (!await Effect.runPromise(isCliproxyRunning())) throw new Error("CLIProxyAPI sidecar is not running. GPT subscription role runs route through a local cliproxy process managed by `pan up`. Run `pan up` (or restart the dashboard) before spawning a GPT role run.");
 	}
 	const state = {
@@ -4986,7 +5195,6 @@ async function spawnRun(issueId, role, options = {}) {
 			await Effect.runPromise(saveAgentState(state));
 		}
 	}
-	checkAndSetupHooks();
 	const provider = getProviderForModelSync(selectedModel);
 	if (provider.authType === "credential-file") setupCredentialFileAuthSync(provider, workspace);
 	else clearCredentialFileAuthSync(workspace);
@@ -5054,7 +5262,7 @@ async function spawnRun(issueId, role, options = {}) {
 	const claudeCmd = `bash ${launcherScript}`;
 	console.log(`[claude-invoke] purpose=role-run | role=${role} | model=${state.model} | source=agents.ts:spawnRun | session=${agentId} | command="${claudeCmd}"`);
 	try {
-		const { preTrustDirectory } = await import("./workspace-manager-DjUAJCSs.js");
+		const { preTrustDirectory } = await import("./workspace-manager-B1mYn0lN.js");
 		preTrustDirectory(workspace);
 	} catch {}
 	clearReadySignal(agentId);
@@ -5124,15 +5332,7 @@ async function spawnAgent(options) {
 	if (await Effect.runPromise(sessionExists(agentId))) throw new Error(`Agent ${agentId} already running. Use 'pan tell' to message it.`);
 	await assertWorkspaceStackHealthyForSpawn(options.issueId, role, options.allowHost, options.workspace);
 	initHookSync(agentId);
-	if (role !== "strike" && role !== "knowledge" && options.slotItemId === void 0) try {
-		await Effect.runPromise(assertIssueHasBeads(options.workspace, options.issueId, { acquisitionTimeoutMs: 500 }));
-	} catch (error) {
-		if (error instanceof BeadsMissingError && error.transientFailure !== void 0) {
-			const attempts = error.transientFailure instanceof BdTransientFailure ? ` after ${error.transientFailure.attempts} attempts` : "";
-			throw new Error(`Beads database was temporarily locked while checking ${options.issueId}${attempts}; re-run shortly.`);
-		}
-		throw error;
-	}
+	if (role !== "strike" && role !== "knowledge" && options.slotItemId === void 0 && !readWorkspacePlanSync(options.workspace)) throw new Error(`The required vBRIEF checklist for ${options.issueId} is missing or unreadable. Run planning before spawning a work agent.`);
 	const modelSpawnKey = `${role}:${options.issueId}`;
 	const singleTierParams = role === "work" && options.slotItemId === void 0 && options.slotIndex === void 0 ? resolveSingleWorkTierSpawnParams(options.workspace, options.model, modelSpawnKey) : {};
 	const selectedModel = determineModel({
@@ -5142,7 +5342,7 @@ async function spawnAgent(options) {
 	});
 	console.log(`[DEBUG] Selected model: ${selectedModel}`);
 	if (getProviderForModelSync(selectedModel).name === "openai" && await getProviderAuthMode(selectedModel) === "subscription") {
-		const { isCliproxyRunning } = await import("./cliproxy-C2xC-3vH.js");
+		const { isCliproxyRunning } = await import("./cliproxy-BQX1TL6N.js");
 		if (!await Effect.runPromise(isCliproxyRunning())) throw new Error("CLIProxyAPI sidecar is not running. GPT subscription agents route through a local cliproxy process managed by `pan up`. Run `pan up` (or restart the dashboard) before spawning a GPT agent.");
 	}
 	const resolvedHarness = await resolveHarness({
@@ -5150,6 +5350,8 @@ async function spawnAgent(options) {
 		role,
 		model: selectedModel
 	});
+	assertCodexNativeAuthForSpawn(resolvedHarness, listAgentStates());
+	await ensureLifecycleHooksBeforeLaunch(agentId, resolvedHarness);
 	const state = {
 		id: agentId,
 		issueId: options.issueId,
@@ -5161,14 +5363,15 @@ async function spawnAgent(options) {
 		status: "starting",
 		startedAt: (/* @__PURE__ */ new Date()).toISOString(),
 		costSoFar: 0,
-		hostOverride: options.allowHost || void 0
+		hostOverride: options.allowHost || void 0,
+		sessionId: createFreshSessionIdentity(agentId, resolvedHarness)
 	};
 	const supervisorLaunch = await prepareSupervisorForFreshLaunch(agentId, options, state);
 	saveAgentStateSync(state);
 	if (role === "work") {
 		try {
 			if (resetPipelineVerdictsForWorkStartSync(options.issueId)) {
-				const { resetPostMergeState } = await import("./merge-agent-36wfYm2u.js");
+				const { resetPostMergeState } = await import("./merge-agent-DMQTJMP0.js");
 				resetPostMergeState(options.issueId);
 			}
 		} catch (err) {
@@ -5179,7 +5382,7 @@ async function spawnAgent(options) {
 		});
 	}
 	if (role === "work") try {
-		const { writeStoryFeatureContext } = await import("./work-agent-prompt-fZljjA1_.js");
+		const { writeStoryFeatureContext } = await import("./work-agent-prompt-BiJ43Der.js");
 		await writeStoryFeatureContext(options.workspace, options.issueId);
 	} catch (ctxErr) {
 		console.warn(`[agents] Could not write story feature context for ${options.issueId}: ${ctxErr.message}`);
@@ -5225,11 +5428,10 @@ async function spawnAgent(options) {
 			saveAgentStateSync(state);
 		}
 	}
-	checkAndSetupHooks();
 	try {
 		const venvPath = join$1(options.workspace, ".venv");
 		if (isTldrEnabledSync() && existsSync(venvPath)) {
-			const { getTldrDaemonServiceSync } = await import("./tldr-daemon-DD9rI5gA.js");
+			const { getTldrDaemonServiceSync } = await import("./tldr-daemon-DhGwd88s.js");
 			const tldrService = getTldrDaemonServiceSync(options.workspace, venvPath);
 			if (!(await tldrService.getStatus()).running) {
 				await tldrService.start(true);
@@ -5259,21 +5461,23 @@ async function spawnAgent(options) {
 		useSupervisor: supervisorLaunch.useSupervisor,
 		supervisorScriptPath: supervisorLaunch.supervisorScriptPath,
 		harness: state.harness ?? "claude-code",
+		sessionId: state.sessionId,
 		extraEnvExports: flywheelEnvExports(flywheelEnv),
 		effort: options.effort
 	});
 	const launcherScript = join$1(getAgentDir(agentId), "launcher.sh");
 	await writeLauncherScriptAtomic(launcherScript, launcherContent);
+	if (state.sessionId) logLauncherSessionPinned(agentId, state.sessionId, launcherScript);
 	const claudeCmd = `bash ${launcherScript}`;
 	console.log(`[claude-invoke] purpose=work-agent | model=${state.model} | source=agents.ts:spawnAgent | session=${agentId} | command="${claudeCmd}"`);
 	try {
-		const { preTrustDirectory } = await import("./workspace-manager-DjUAJCSs.js");
+		const { preTrustDirectory } = await import("./workspace-manager-B1mYn0lN.js");
 		preTrustDirectory(options.workspace);
 	} catch {}
 	try {
-		const { isGitHubAppConfigured, generateInstallationToken, configureWorkspaceForBot } = await import("./github-app-DRD2woO0.js");
+		const { isGitHubAppConfigured, generateInstallationToken, configureWorkspaceForBot } = await import("./github-app-BrYwK_Gb.js");
 		if (isGitHubAppConfigured()) {
-			const { findProjectByPathSync } = await import("./projects-KJ94e50I.js");
+			const { findProjectByPathSync } = await import("./projects-Dc9aoVoG.js");
 			const ghRepo = findProjectByPathSync(resolve$1(options.workspace, "..", ".."))?.github_repo;
 			if (ghRepo) {
 				const [owner, repo] = ghRepo.split("/");
@@ -5286,7 +5490,6 @@ async function spawnAgent(options) {
 		console.warn(`[${agentId}] GitHub App config failed (falling back to SSH): ${err.message}`);
 	}
 	clearReadySignal(agentId);
-	const bdShimPath = role === "work" ? await resolveBdAgentShimPath(getAgentDir(agentId)) : void 0;
 	await Effect.runPromise(createSession(agentId, options.workspace, claudeCmd, { env: {
 		...BLANKED_PROVIDER_ENV,
 		TERM: "xterm-256color",
@@ -5295,11 +5498,11 @@ async function spawnAgent(options) {
 		OVERDECK_SESSION_TYPE: role,
 		CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION: "false",
 		GIT_SEQUENCE_EDITOR: "false",
-		...bdShimPath ? { PATH: bdShimPath } : {},
 		...flywheelEnv,
 		...providerEnv
 	} }));
 	await saveAgentRuntimeState(agentId, {
+		claudeSessionId: state.sessionId,
 		sessionModel: selectedModel,
 		sessionHarness: resolvedHarness
 	});
@@ -5343,7 +5546,7 @@ async function spawnAgent(options) {
 		const codexHomeForAgent = join$1(homedir(), ".overdeck", "agents", agentId, "codex-home");
 		(async () => {
 			try {
-				const { waitForCodexRollout, extractThreadIdFromRollout, writeThreadId } = await import("./codex-B7DTpwEw.js");
+				const { waitForCodexRollout, extractThreadIdFromRollout, writeThreadId } = await import("./codex-DxLivxri.js");
 				const rollout = await waitForCodexRollout(codexHomeForAgent, 12e4);
 				if (rollout) {
 					const threadId = extractThreadIdFromRollout(rollout);
@@ -5423,26 +5626,6 @@ function escapeRegExp$1(value) {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 /**
-* Check if Overdeck hooks are configured, and auto-setup if not
-*/
-function checkAndSetupHooks() {
-	const settingsPath = join$1(homedir(), ".claude", "settings.json");
-	const hookPath = join$1(homedir(), ".overdeck", "bin", "heartbeat-hook");
-	if (existsSync(settingsPath)) try {
-		const settingsContent = readFileSync(settingsPath, "utf-8");
-		if ((JSON.parse(settingsContent)?.hooks?.PostToolUse || []).some((hookConfig) => hookConfig.hooks?.some((hook) => hook.command === hookPath || hook.command?.includes("overdeck") || hook.command?.includes("heartbeat-hook")))) return;
-	} catch {}
-	try {
-		console.log("Configuring Overdeck heartbeat hooks...");
-		exec$1("pan admin hooks install", (error) => {
-			if (error) console.warn("⚠ Failed to auto-configure hooks. Run `pan admin hooks install` manually.");
-			else console.log("✓ Heartbeat hooks configured");
-		});
-	} catch (error) {
-		console.warn("⚠ Failed to auto-configure hooks. Run `pan admin hooks install` manually.");
-	}
-}
-/**
 * Write task cache for heartbeat hook to use
 */
 function writeTaskCache(agentId, issueId) {
@@ -5457,8 +5640,6 @@ function writeTaskCache(agentId, issueId) {
 var execAsync$2;
 var init_spawn = __esmMin((() => {
 	init_activity_logger();
-	init_beads_query();
-	init_bd_process_lock();
 	init_child_env();
 	init_config_yaml();
 	init_conversations();
@@ -5468,6 +5649,7 @@ var init_spawn = __esmMin((() => {
 	init_providers();
 	init_review_status();
 	init_harness_resolve();
+	init_codex_auth();
 	init_bridge_token();
 	init_tmux();
 	init_dag();
@@ -5486,7 +5668,8 @@ var init_spawn = __esmMin((() => {
 	init_state_read_home();
 	init_supervisor_channels();
 	init_termination();
-	init_bd_shim();
+	init_session_history();
+	init_hook_readiness();
 	execAsync$2 = promisify$1(exec$1);
 }));
 //#endregion
@@ -5917,9 +6100,7 @@ function getActivity(agentId, limit = 100) {
 * Save Claude session ID for later resume
 */
 function saveSessionId(agentId, sessionId) {
-	const dir = getAgentDir(agentId);
-	mkdirSync(dir, { recursive: true });
-	writeFileSync(join$1(dir, "session.id"), sessionId);
+	persistCurrentSessionId(agentId, sessionId);
 }
 /**
 * Get saved Claude session ID
@@ -6024,6 +6205,7 @@ var init_activity = __esmMin((() => {
 	init_ohmypi();
 	init_behavior();
 	init_errors();
+	init_session_history();
 	getLatestSessionId = (agentId) => {
 		const agentDir = getAgentDir(agentId);
 		const sessionFile = join$1(agentDir, "session.id");
@@ -6102,9 +6284,24 @@ async function appendTellInterventionForUserSource(normalizedId, caller) {
 		source: caller
 	});
 }
-async function messageAgent(agentId, message, caller = "internal") {
+async function messageAgent(agentId, message, caller = "internal", opts = {}) {
 	const normalizedId = normalizeAgentId(agentId);
 	const agentState = getAgentStateSync(normalizedId);
+	const decideMessageGate = () => {
+		const block = agentState ? getAgentResumeGateBlockReason(agentState) : void 0;
+		const agentDir = getAgentDir(normalizedId);
+		const decision = decideResumeGate(block, "message-delivery", {
+			hasCompletedHandoff: existsSync(join$1(agentDir, "completed")) || existsSync(join$1(agentDir, "completed.processed")),
+			owesRework: opts.owesRework === true
+		});
+		if (decision.decision === "proceed" && decision.clearStoppedByUser && agentState) {
+			console.log(`[agents] ${normalizedId} was operator-stopped but owes rework after a completed handoff — clearing stop gate to deliver feedback (PAN-2668)`);
+			logAgentLifecycleSync(normalizedId, "stoppedByUser cleared: completed handoff owes rework; delivering pipeline feedback (PAN-2668)");
+			delete agentState.stoppedByUser;
+			saveAgentStateSync(agentState);
+		}
+		return decision;
+	};
 	if (agentState?.paused === true) {
 		const gateBlockReason = getAgentResumeGateBlockReason(agentState)?.reason ?? "agent is paused";
 		queueAgentMail(normalizedId, message);
@@ -6113,15 +6310,16 @@ async function messageAgent(agentId, message, caller = "internal") {
 		return;
 	}
 	if (getAgentRuntimeStateSync(normalizedId)?.state === "suspended") {
-		const gateBlockReason = agentState ? getAgentResumeGateBlockReason(agentState)?.reason : void 0;
-		if (gateBlockReason) {
+		const suspendedGate = decideMessageGate();
+		if (suspendedGate.decision !== "proceed") {
+			const gateBlockReason = suspendedGate.reason ?? "agent is gated";
 			queueAgentMail(normalizedId, message);
 			logAgentLifecycleSync(normalizedId, `messageAgent queued mail without resume: ${gateBlockReason}`);
 			console.log(`[agents] Queued message for ${normalizedId}; ${gateBlockReason}`);
 			return;
 		}
 		console.log(`[agents] Auto-resuming suspended agent ${normalizedId} to deliver message`);
-		const { resumeAgent } = await import("./agents-DCvyTXNU.js");
+		const { resumeAgent } = await import("./agents-BA15AQqo.js");
 		const result = await resumeAgent(normalizedId, message);
 		if (!result.success) throw new Error(`Failed to auto-resume agent: ${result.error}`);
 		if (result.messageDelivered === false) throw new Error(`Agent resumed but ready signal did not fire — message not delivered. Feedback is in the mail queue.`);
@@ -6129,15 +6327,16 @@ async function messageAgent(agentId, message, caller = "internal") {
 		return;
 	}
 	if (agentState && agentState.status === "stopped") {
-		const gateBlockReason = getAgentResumeGateBlockReason(agentState)?.reason;
-		if (gateBlockReason) {
+		const stoppedGate = decideMessageGate();
+		if (stoppedGate.decision !== "proceed") {
+			const gateBlockReason = stoppedGate.reason ?? "agent is gated";
 			queueAgentMail(normalizedId, message);
 			logAgentLifecycleSync(normalizedId, `messageAgent queued mail without resume: ${gateBlockReason}`);
 			console.log(`[agents] Queued message for ${normalizedId}; ${gateBlockReason}`);
 			return;
 		}
 		console.log(`[agents] Auto-resuming stopped agent ${normalizedId} to deliver feedback (session exists: ${await Effect.runPromise(sessionExists(normalizedId))})`);
-		const { resumeAgent } = await import("./agents-DCvyTXNU.js");
+		const { resumeAgent } = await import("./agents-BA15AQqo.js");
 		const resumeResult = await resumeAgent(normalizedId, message);
 		queueAgentMail(normalizedId, message);
 		if (resumeResult.success && resumeResult.messageDelivered !== false) {
@@ -6173,7 +6372,7 @@ async function messageAgent(agentId, message, caller = "internal") {
 		const resumeRole = agentState.role ?? "work";
 		const resumeModel = agentState.model || "claude-sonnet-4-6";
 		const fallbackHarness = agentState.harness ?? "claude-code";
-		const { assertWorkspaceStackHealthyForSpawn } = await import("./agents-DCvyTXNU.js");
+		const { assertWorkspaceStackHealthyForSpawn } = await import("./agents-BA15AQqo.js");
 		await assertWorkspaceStackHealthyForSpawn(agentState.issueId || normalizedId.replace(/^agent-/, "").toUpperCase(), resumeRole, agentState.hostOverride === true, agentState.workspace);
 		const fallbackPiFields = fallbackHarness === "ohmypi" ? await getOhmypiLauncherFields(normalizedId, resumeModel) : {};
 		const fallbackCodexFields = fallbackHarness === "codex" ? getCodexLauncherFields(normalizedId, resumeModel, agentState.workspace) : {};
@@ -6236,7 +6435,7 @@ async function messageAgent(agentId, message, caller = "internal") {
 		} else console.warn(`[agents] Fallback-restarted ${normalizedId} but ready signal not detected — feedback in mail queue`);
 		return;
 	}
-	const { loadRemoteAgentState, sendToRemoteAgent } = await import("./remote-agents-DlvbzO7m.js");
+	const { loadRemoteAgentState, sendToRemoteAgent } = await import("./remote-agents-DYY5fFpd.js");
 	const remoteState = loadRemoteAgentState(normalizedId);
 	if (remoteState && remoteState.vmName) {
 		console.log(`[agents] Sending message to remote agent ${normalizedId} on ${remoteState.vmName}`);
@@ -6250,7 +6449,7 @@ async function messageAgent(agentId, message, caller = "internal") {
 	const expectedHarness = agentState?.harness ?? "claude-code";
 	if (panePids.length > 0 && !await hasAgentRuntimeInSubtree(panePids[0], expectedHarness)) {
 		console.warn(`[agents] ${normalizedId} tmux session is a zombie (no ${expectedHarness} runtime) — attempting resume`);
-		const { resumeAgent } = await import("./agents-DCvyTXNU.js");
+		const { resumeAgent } = await import("./agents-BA15AQqo.js");
 		const resumeResult = await resumeAgent(normalizedId, message);
 		if (resumeResult.success) {
 			if (resumeResult.messageDelivered !== false) await appendTellInterventionForUserSource(normalizedId, caller);
@@ -6318,7 +6517,7 @@ function buildCompactRecoverySeedMessage(issueId, summary) {
 	const lines = [`Your previous session for ${issueId} hit the model's context-window limit, so you are starting a fresh session. This freed tokens; it did not reset your filesystem work.`, "Do NOT start over and do NOT expect the prior conversation to be available."];
 	if (summary) lines.push("", "Summary of the archived session:", "", summary, "");
 	else lines.push("");
-	lines.push("Reconstruct your exact work-in-progress from durable artifacts:", "1. Read .pan/continue.json for resumePoint, decisions, hazards, feedback, and sessionHistory.", "2. Run `bd ready` for your open beads and `bd show <id>` for the bead you are working on.", "3. Inspect `git status` and `git diff` for uncommitted work already on disk.", "Then continue from that reconstructed state and complete the next required bead — do not wait for further instructions.");
+	lines.push("Reconstruct your exact work-in-progress from durable artifacts:", "1. Read .pan/continue.json for resumePoint, decisions, hazards, feedback, and sessionHistory.", "2. Run `pan task next` for the next open item and `pan task show <issue> <item>` for its current state.", "3. Inspect `git status` and `git diff` for uncommitted work already on disk.", "Then continue from that reconstructed state and complete the next required bead — do not wait for further instructions.");
 	return lines.join("\n");
 }
 var CONTEXT_OVERFLOW_PATTERNS;
@@ -6362,7 +6561,7 @@ async function buildCompactRecoverySeed(agentId) {
 	if (agentState?.workspace && sessionId) {
 		const sessionFile = sessionFilePath(agentState.workspace, sessionId);
 		try {
-			const [{ getConversationCompactionSettings }, { generateSmartSummary }] = await Promise.all([import("./conversation-compaction-WYQZUVDm.js"), import("./smart-compaction-h4_ca6Uk.js")]);
+			const [{ getConversationCompactionSettings }, { generateSmartSummary }] = await Promise.all([import("./conversation-compaction-CRKAf2qP.js"), import("./smart-compaction-DldUel4B.js")]);
 			const settings = getConversationCompactionSettings();
 			summary = (await Effect.runPromise(generateSmartSummary({
 				jsonlPath: sessionFile,
@@ -6373,7 +6572,7 @@ async function buildCompactRecoverySeed(agentId) {
 		} catch (err) {
 			logAgentLifecycleSync(normalizedId, `compact-recovery smart summary failed (${err instanceof Error ? err.message : String(err)}); trying heuristic fallback`);
 			try {
-				const { generateFallbackSummary } = await import("./summary-fork-CKc01Our.js");
+				const { generateFallbackSummary } = await import("./summary-fork-BxnF8Xh0.js");
 				summary = await Effect.runPromise(generateFallbackSummary(sessionFile));
 			} catch (fallbackErr) {
 				logAgentLifecycleSync(normalizedId, `compact-recovery fallback summary failed (${fallbackErr instanceof Error ? fallbackErr.message : String(fallbackErr)}); seeding with reseed instructions only`);
@@ -6990,7 +7189,7 @@ function generateRecoveryPrompt(state) {
 		`- Started: ${state.startedAt}`,
 		"",
 		"## Recovery Steps",
-		"1. Check beads for context: `bd show " + state.issueId + "`",
+		"1. Check the vBRIEF task state: `pan task show " + state.issueId + " <item-id>`",
 		"2. Review recent git commits: `git log --oneline -10`",
 		"3. Check hook for pending work: `pan admin fpp check`",
 		"4. Resume from last known state",
@@ -7192,10 +7391,10 @@ function computeTierRunSchedule(doc, config) {
 		if (!item) continue;
 		const tier = resolveTier(item, config);
 		const currentRun = runs[runs.length - 1];
-		if (currentRun && currentRun.tierName === tier.tierName) currentRun.beadIds.push(item.id);
+		if (currentRun && currentRun.tierName === tier.tierName) currentRun.itemIds.push(item.id);
 		else runs.push({
 			tierName: tier.tierName,
-			beadIds: [item.id]
+			itemIds: [item.id]
 		});
 	}
 	return runs;
@@ -7229,20 +7428,20 @@ function applyEffectiveDifficulty(item, overrides) {
 * retry event persistence, tier promotion writes, dispatch, and notifications.
 */
 function decideEscalation(trigger, bead, config, overrides) {
-	const beadId = trigger.beadId || bead.id;
+	const itemId = trigger.itemId || bead.id;
 	const override = overrides[bead.id];
 	const currentDifficulty = override?.effectiveDifficulty ?? bead.metadata?.difficulty;
 	if (!currentDifficulty) return {
 		action: "block",
-		reason: `bead ${beadId} has no effective difficulty`
+		reason: `task ${itemId} has no effective difficulty`
 	};
 	if ((override?.promotions ?? 0) >= config.max_promotions) return {
 		action: "block",
-		reason: `max promotions reached for ${beadId} at ${currentDifficulty}`
+		reason: `max promotions reached for ${itemId} at ${currentDifficulty}`
 	};
 	if (currentDifficulty === "expert") return {
 		action: "block",
-		reason: `expert bead ${beadId} cannot promote beyond expert`
+		reason: `expert task ${itemId} cannot promote beyond expert`
 	};
 	const attemptsAtCurrentTier = trigger.attemptsAtCurrentTier ?? 0;
 	if (attemptsAtCurrentTier < config.retries_at_tier) return {
@@ -7252,7 +7451,7 @@ function decideEscalation(trigger, bead, config, overrides) {
 	const to = TIERED_EXECUTION_DIFFICULTIES[TIERED_EXECUTION_DIFFICULTIES.indexOf(currentDifficulty) + 1];
 	if (!to) return {
 		action: "block",
-		reason: `bead ${beadId} cannot promote beyond ${currentDifficulty}`
+		reason: `task ${itemId} cannot promote beyond ${currentDifficulty}`
 	};
 	return {
 		action: "promote",
@@ -7324,20 +7523,20 @@ function resolveFeedApiUrl(env = process.env) {
 }
 /**
 * Compose the ingestion-only feed message for one commit. Deterministic over
-* (sha, beadTitle, diff) so replay reconstructs byte-identical messages.
+* (sha, itemTitle, diff) so replay reconstructs byte-identical messages.
 */
-function composeCommitFeedMessage(sha, beadTitle, diff, callout) {
+function composeCommitFeedMessage(sha, itemTitle, diff, callout) {
 	const lines = [
 		`# Commit feed (ingestion-only): ${sha}`,
 		"",
-		`Bead: ${beadTitle}`,
+		`Bead: ${itemTitle}`,
 		""
 	];
 	if (callout) {
 		const body = JSON.stringify({
 			issueId: callout.issueId,
 			sha,
-			beadId: callout.beadId,
+			itemId: callout.itemId,
 			tierName: callout.tierName,
 			agentId: callout.agentId,
 			claim: "<one sentence: what is wrong and where>"
@@ -7354,22 +7553,22 @@ function composeCommitFeedMessage(sha, beadTitle, diff, callout) {
 */
 async function broadcastCommit(options) {
 	const feedConfig = options.feedConfig ?? DEFAULT_FEED_CONFIG;
-	if (shouldSkipFeedSubject(options.commitSubject ?? options.beadTitle, feedConfig)) return [];
+	if (shouldSkipFeedSubject(options.commitSubject ?? options.itemTitle, feedConfig)) return [];
 	const renderDiff = options.renderDiff ?? (options.gitShow ? (workspace, sha) => options.gitShow(workspace, sha) : renderCommitFeedDiff);
 	const deliver = options.deliver ?? deliverAgentMessage;
 	const recordDelivery = options.recordDelivery ?? recordTierFeedDelivery;
 	const now = options.now ?? (() => /* @__PURE__ */ new Date());
 	const diff = await renderDiff(options.workspace, options.sha, feedConfig);
-	const baseMessage = composeCommitFeedMessage(options.sha, options.beadTitle, diff);
+	const baseMessage = composeCommitFeedMessage(options.sha, options.itemTitle, diff);
 	const baseTokenCount = estimateFeedDeliveryTokens(baseMessage);
-	const includeCallout = feedConfig.callouts !== "off" && options.issueId !== void 0 && options.beadId !== void 0;
+	const includeCallout = feedConfig.callouts !== "off" && options.issueId !== void 0 && options.itemId !== void 0;
 	const apiUrl = options.apiUrl ?? resolveFeedApiUrl();
 	const deliveries = [];
 	for (const tier of options.tiers) {
-		const message = includeCallout ? composeCommitFeedMessage(options.sha, options.beadTitle, diff, {
+		const message = includeCallout ? composeCommitFeedMessage(options.sha, options.itemTitle, diff, {
 			apiUrl,
 			issueId: options.issueId,
-			beadId: options.beadId,
+			itemId: options.itemId,
 			tierName: tier.tierName,
 			agentId: tier.agentId
 		}) : baseMessage;
@@ -7388,7 +7587,7 @@ async function broadcastCommit(options) {
 			ts: now().toISOString(),
 			issueId: options.issueId,
 			sha: options.sha,
-			beadTitle: options.beadTitle,
+			itemTitle: options.itemTitle,
 			tierName: tier.tierName,
 			agentId: tier.agentId,
 			tokenCount,
@@ -7467,10 +7666,10 @@ function shouldSupervise(bead, policy, options = {}) {
 * is stable across the live commit feed, replay re-delivery (tier-replay),
 * and tests.
 */
-function sampleFraction(beadId) {
+function sampleFraction(itemId) {
 	let hash = 2166136261;
-	for (let i = 0; i < beadId.length; i++) {
-		hash ^= beadId.charCodeAt(i);
+	for (let i = 0; i < itemId.length; i++) {
+		hash ^= itemId.charCodeAt(i);
 		hash = Math.imul(hash, 16777619);
 	}
 	return (hash >>> 0) / 4294967296;
@@ -7587,7 +7786,7 @@ You are the standing supervisor for ${event.issueId}. Review this commit against
 ## Bead under review
 
 - Issue: ${event.issueId}
-- Bead: ${event.beadId} — ${event.beadTitle}
+- Bead: ${event.itemId} — ${event.itemTitle}
 - Commit: ${event.sha}
 
 ## Acceptance criteria
@@ -7602,14 +7801,14 @@ ${event.diff}
 
 ## Verdict (REQUIRED — post exactly one)
 
-Land your verdict on the existing inspect-status surface. Your notes MUST begin with "Bead ${event.beadId}" — the server extracts the bead id from that prefix.
+Land your verdict on the existing inspect-status surface. Your notes MUST begin with "Item ${event.itemId}" — the server extracts the bead id from that prefix.
 
 If the diff satisfies the acceptance criteria, post an ack (this persists inspectStatus and saves the bead checkpoint):
 
 \`\`\`bash
 curl -X POST ${event.apiUrl}/api/specialists/done \\
   -H "Content-Type: application/json" \\
-  -d '{"specialist":"inspect","issueId":"${event.issueId}","status":"passed","notes":"Bead ${event.beadId} ack: <one-line summary>"}'
+  -d '{"specialist":"inspect","issueId":"${event.issueId}","status":"passed","notes":"Item ${event.itemId} ack: <one-line summary>"}'
 \`\`\`
 
 If any acceptance criterion is not met, post a blocking finding with specific, actionable violations ([file:line] + what is wrong):
@@ -7617,7 +7816,7 @@ If any acceptance criterion is not met, post a blocking finding with specific, a
 \`\`\`bash
 curl -X POST ${event.apiUrl}/api/specialists/done \\
   -H "Content-Type: application/json" \\
-  -d '{"specialist":"inspect","issueId":"${event.issueId}","status":"failed","notes":"Bead ${event.beadId} BLOCKED: <specific violations and required fixes>"}'
+  -d '{"specialist":"inspect","issueId":"${event.issueId}","status":"failed","notes":"Item ${event.itemId} BLOCKED: <specific violations and required fixes>"}'
 \`\`\`
 
 Rules:
@@ -7646,8 +7845,8 @@ async function deliverCommitForReview(options) {
 	const frText = options.prdMarkdown && traces.length > 0 ? extractTracedFrText(options.prdMarkdown, traces) : void 0;
 	const message = buildSupervisorReviewMessage({
 		issueId: options.issueId,
-		beadId: options.beadId ?? options.item.id,
-		beadTitle: options.item.title,
+		itemId: options.itemId ?? options.item.id,
+		itemTitle: options.item.title,
 		sha: options.sha,
 		diff,
 		acceptanceCriteria: extractAcceptanceCriteria(options.item),
@@ -7784,11 +7983,11 @@ async function replayTierFeed(agentId, target, commits, deps) {
 	const includeCallout = (target.feedConfig ?? DEFAULT_TIERED_EXECUTION_CONFIG.feed).callouts !== "off";
 	const apiUrl = target.apiUrl ?? resolveFeedApiUrl();
 	for (const commit of commits) {
-		const beadId = commit.beadId;
-		const message = composeCommitFeedMessage(commit.sha, commit.subject, commit.diff, includeCallout && beadId ? {
+		const itemId = commit.itemId;
+		const message = composeCommitFeedMessage(commit.sha, commit.subject, commit.diff, includeCallout && itemId ? {
 			apiUrl,
 			issueId: target.issueId,
-			beadId,
+			itemId,
 			tierName: target.tierName,
 			agentId
 		} : void 0);
@@ -7808,8 +8007,8 @@ async function replaySupervisorFeed(agentId, target, commits, deps) {
 		const frText = target.prdMarkdown && traces.length > 0 ? extractTracedFrText(target.prdMarkdown, traces) : void 0;
 		const message = buildSupervisorReviewMessage({
 			issueId: target.issueId,
-			beadId: item.id,
-			beadTitle: item.title,
+			itemId: item.id,
+			itemTitle: item.title,
 			sha: commit.sha,
 			diff: commit.diff,
 			acceptanceCriteria: extractAcceptanceCriteria(item),
@@ -7915,6 +8114,151 @@ var init_agents = __esmMin((() => {
 	init_tier_replay();
 }));
 //#endregion
-export { warnOnBareNumericIssueIds as $, writeAgentStateJsonSync as $n, waitForPromptReady as $t, init_messaging as A, getAgentDir as An, init_bridge_token as At, createOhmypiRuntimeSync as B, markAgentRunningState as Bn, resolveStaffing as Bt, restartAgent as C, __testInternals as Cn, deliverAgentPermissionDecision as Ct, init_context_overflow as D, clearAgentTroubledSync as Dn, captureTranscriptUserRecordSnapshot as Dt, resumeAgent as E, clearAgentTroubled as En, setAgentDeliveryMethod as Et, getActivity as F, init_agent_state as Fn, init_spawn_prep as Ft, init_termination as G, recordStartupSessionExit as Gn, getAgentRuntimeBaseCommand as Gt, init_spawn as H, markAgentTroubled as Hn, resolveTier as Ht, getLatestSessionId as I, isAgentPaused as In, retrieveSpawnTimeMemoryContext as It, dropLegacyAgentStatesMissingRoleAsync as J, saveAgentStateSync as Jn, getProviderAuthMode as Jt, stopAgent as K, resetAgentFailureCount as Kn, getCodexLauncherFields as Kt, getLatestSessionIdSync as L, isAgentTroubled as Ln, transitionIssueToInProgress as Lt, init_operator_interventions as M, getAgentState as Mn, assertWorkspaceStackHealthyForSpawn as Mt, operatorInterventionEvent as N, getAgentStateFilePath as Nn, buildAgentLaunchConfig as Nt, isContextOverflowError as O, clearYieldForResumeSync as On, init_transcript_landing as Ot, appendActivity as P, getAgentStateSync as Pn, defaultRunWorkspace as Pt, listRunningAgentsSync as Q, wipeAgentStateDirs as Qn, roleAgentDefinitionPath as Qt, getSessionId as R, isRole as Rn, transitionIssueToInReview as Rt, recoverAgent as S, SESSION_EXITED_BEFORE_KICKOFF as Sn, parseOhmypiSessionCostResultSync as Sr, deliverAgentMessage as St, init_resume as T, clearAgentPausedSync as Tn, deliverResumeMessageWithTranscriptConfirmation as Tt, spawnAgent as U, recordAgentFailure as Un, OHMYPI_AGENT_READY_TIMEOUT_SECONDS as Ut, init_ohmypi as V, markAgentStoppedState as Vn, init_resolve_tier as Vt, spawnRun as W, recordAgentFailureSync as Wn, describeOhmypiSpawnFailure as Wt, listAgentStates as X, setAgentPausedSync as Xn, init_runtime_command as Xt, init_queries as Y, setAgentPaused as Yn, getRoleRuntimeBaseCommand as Yt, listRunningAgents as Z, setAgentYieldedSync as Zn, injectPiConversationMemory as Zt, init_slot_reconcile as _, decideChannelsForWorkAgent as _n, init_runtime_state as _r, init_config as _t, replayStandingAgent as a, init_claude_auth as an, init_pty_token as ar, init_concurrency as at, autoRecoverAgents as b, writeChannelsBridgeMcpConfig as bn, init_agent_runtime as br, saveCloisterConfigSync as bt, init_tier_supervisor as c, determineModel as cn, resolvePtySupervisorScriptPath as cr, resetPatrolDispatchBudget as ct, spawnTierSupervisor as d, getProviderTmuxFlags as dn, normalizeAgentId as dr, workResumeSlotsAvailable as dt, init_pi_fifo as en, init_persistent_logger as er, countRunningAgents as et, supervisorAgentId as f, init_provider_health as fn, resolveAgentTargetSync as fr, getCachedMemoryVerdict as ft, init_tier_escalation as g, buildDefaultResumeContinueMessage as gn, getAgentRuntimeStateSync as gr, getHealthThresholdsMs as gt, decideEscalation as h, init_openai_auth as hn, getAgentRuntimeState as hr, DEFAULT_CLOISTER_CONFIG as ht, replayCrashedStandingAgent as i, getClaudeAuthStatus as in, readAgentHarnessModelRecordSync as ir, getConcurrencyLimits as it, messageAgent as j, getAgentResumeGateBlockReason as jn, writeBridgeTokenSync as jt, isContextOverflowTail as k, decideResumeGate as kn, probeTranscriptSince as kt, loadPrdDraft as l, getProviderEnvForModel as ln, clearReadySignal as lr, tryReserveAdvancingSlot as lt, init_tier_feed as m, getOpenAIAuthStatus as mn, waitForReadySignal as mr, setCachedMemoryVerdict as mt, compactAtTierRunBoundary as n, init_ohmypi_fifo as nn, logDeaconEventSync as nr, describeRunningAgents as nt, shouldReplayCompactAtTierRunBoundary as o, buildCavemanExports as on, writePtyToken as or, releaseAdvancingSlot as ot, broadcastCommit as p, validateProviderHealth as pn, waitForAgentIdle as pr, init_memory_verdict_cache as pt, stopAgentSync as q, saveAgentState as qn, getOhmypiLauncherFields as qt, contextWindowForModel as r, ohmypiFifoPaths as rn, init_agent_record_sync as rr, emergencyBrake as rt, deliverCommitForReview as s, buildSpawnEnvForModel as sn, init_pty_supervisor_locate as sr, releaseSwarmSlot as st, init_agents as t, piFifoPaths as tn, logAgentLifecycleSync as tr, countRunningSwarmSlotsForIssue as tt, shouldSupervise as u, getProviderExportsForModel as un, isQualifiedAgentId as ur, tryReserveSwarmSlot as ut, listSlotAssignments as v, decideSupervisorForWorkAgent as vn, saveAgentRuntimeState as vr, loadCloisterConfig as vt, buildCompactRecoverySeed as w, clearAgentPaused as wn, deliverInitialPromptWithRetry as wt, detectCrashedAgents as x, GOVERNOR_SLOT_PAUSE_REASON_PREFIX as xn, init_ohmypi_parser as xr, shouldAutoStart as xt, reconcileSlotState as y, dismissDevChannelsDialog as yn, getAgentRuntimeSnapshot as yr, loadCloisterConfigSync as yt, saveSessionId as z, markAgentRunning as zn, init_staffing as zt };
+//#region ../../lib/agents/queries.ts
+function listRunningAgentsSync() {
+	const tmuxSessions = listSessionsSync();
+	const tmuxNames = new Set(tmuxSessions.map((s) => s.name));
+	return listOverdeckAgentStatesSync().map((state) => {
+		const normalizedId = normalizeAgentId(state.id);
+		return {
+			...state,
+			id: normalizedId,
+			tmuxActive: tmuxNames.has(normalizedId)
+		};
+	});
+}
+/**
+* PAN-1908: list all agents in the SQLite registry with optional filtering.
+* This is the replacement for enumerating ~/.overdeck/agents/ directories.
+*/
+function listAgentStates(options) {
+	return listOverdeckAgentStatesSync().filter((state) => {
+		if (options?.status && state.status !== options.status) return false;
+		if (options?.role && state.role !== options.role) return false;
+		return true;
+	});
+}
+/**
+* PAN-1048 P2: async startup migration.
+*
+* The previous synchronous version used readdirSync, readFileSync,
+* killSession (sync tmux subprocess), and rmSync — all on the Node
+* event loop. Called from warnOnBareNumericIssueIds() during dashboard
+* read-model bootstrap, this blocked all HTTP/WebSocket/PTY traffic on
+* server startup while it scanned every agent dir, killed stale tmux
+* sessions, and recursively deleted directories.
+*
+* This async variant does the same work using fs/promises and the
+* already-async killSessionAsync() so the bootstrap path no longer
+* stalls the event loop.
+*/
+async function dropLegacyAgentStatesMissingRoleAsync() {
+	if (!existsSync(AGENTS_DIR)) return 0;
+	const fsp = await import("fs/promises");
+	let entries;
+	try {
+		entries = await fsp.readdir(AGENTS_DIR);
+	} catch {
+		return 0;
+	}
+	let dropped = 0;
+	await Promise.all(entries.map(async (entry) => {
+		const dirPath = join$1(AGENTS_DIR, entry);
+		let stat;
+		try {
+			stat = await fsp.stat(dirPath);
+		} catch {
+			return;
+		}
+		if (!stat.isDirectory()) return;
+		const agentId = normalizeAgentId(entry);
+		const stateFile = getRollbackAgentStatePath(agentId);
+		let raw;
+		try {
+			const contents = await fsp.readFile(stateFile, "utf8");
+			raw = JSON.parse(contents);
+		} catch {
+			return;
+		}
+		if (isRole(raw.role)) return;
+		try {
+			await Effect.runPromise(killSession(agentId));
+		} catch {}
+		try {
+			await fsp.rm(dirPath, {
+				recursive: true,
+				force: true
+			});
+			dropped++;
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			console.warn(`[agents] Failed to drop legacy agent state ${agentId}: ${msg}`);
+		}
+	}));
+	return dropped;
+}
+/**
+* Scan ~/.overdeck/agents/ for state files with bare numeric issueIds
+* (e.g. "484" instead of "PAN-484") and log warnings to stderr.
+*
+* These workspaces were created before the pan- prefix convention and may
+* cause cross-tracker pollution if their in_review transition is triggered.
+* Called once at server startup to surface legacy state files.
+*/
+/**
+* PAN-1048 P2: bootstrap-path migration is async.
+*
+* Sweeps legacy state files missing a `role` field and warns on bare
+* numeric issueIds. Both passes used to be synchronous (readdirSync,
+* readFileSync, killSession, rmSync), which blocked the dashboard
+* server's event loop on startup. The async version scans the same
+* directory once per concern and uses fs/promises throughout.
+*/
+async function warnOnBareNumericIssueIds() {
+	const droppedLegacyAgents = await dropLegacyAgentStatesMissingRoleAsync();
+	if (droppedLegacyAgents > 0) console.warn(`[agents] Dropped ${droppedLegacyAgents} legacy agent state file(s) missing role`);
+	if (!existsSync(AGENTS_DIR)) return;
+	const fsp = await import("fs/promises");
+	let entries;
+	try {
+		entries = await fsp.readdir(AGENTS_DIR);
+	} catch {
+		return;
+	}
+	const legacy = [];
+	await Promise.all(entries.map(async (entry) => {
+		const dirPath = join$1(AGENTS_DIR, entry);
+		try {
+			if (!(await fsp.stat(dirPath)).isDirectory()) return;
+		} catch {
+			return;
+		}
+		const state = await Effect.runPromise(getAgentState(entry));
+		if (state?.issueId && /^\d+$/.test(state.issueId)) legacy.push(`${entry} (issueId: "${state.issueId}")`);
+	}));
+	if (legacy.length > 0) console.warn(`[agents] WARNING: ${legacy.length} agent state file(s) have bare numeric issueIds (created before the pan- prefix convention). These agents will not be able to transition tracker state. Consider removing or updating them:\n` + legacy.map((l) => `  ~/.overdeck/agents/${l}`).join("\n"));
+}
+var listRunningAgents;
+var init_queries = __esmMin((() => {
+	init_agents();
+	init_tmux();
+	init_paths();
+	init_agent_rollback_state();
+	init_agent_state_sync();
+	listRunningAgents = () => Effect.gen(function* () {
+		const tmuxSessions = yield* listSessions();
+		const tmuxNames = new Set(tmuxSessions.map((s) => s.name));
+		return listOverdeckAgentStatesSync().map((state) => {
+			const normalizedId = normalizeAgentId(state.id);
+			return {
+				...state,
+				id: normalizedId,
+				tmuxActive: tmuxNames.has(normalizedId)
+			};
+		});
+	});
+}));
+//#endregion
+export { stopAgentSync as $, wipeAgentStateDirs as $n, roleAgentDefinitionPath as $t, buildCompactRecoverySeed as A, decideResumeGate as An, init_bridge_token as At, appendActivity as B, markAgentRunning as Bn, resolveImplicitStaffing as Bt, init_slot_reconcile as C, SESSION_EXITED_BEFORE_KICKOFF as Cn, init_ohmypi_parser as Cr, deliverAgentPermissionDecision as Ct, detectCrashedAgents as D, clearAgentTroubled as Dn, captureTranscriptUserRecordSnapshot as Dt, autoRecoverAgents as E, clearAgentPausedSync as En, setAgentDeliveryMethod as Et, isContextOverflowTail as F, getAgentStateSync as Fn, init_spawn_prep as Ft, saveSessionId as G, recordAgentFailureSync as Gn, describeOhmypiSpawnFailure as Gt, getLatestSessionId as H, markAgentStoppedState as Hn, init_resolve_tier as Ht, init_messaging as I, init_agent_state as In, retrieveSpawnTimeMemoryContext as It, init_spawn as J, saveAgentState as Jn, getOhmypiLauncherFields as Jt, createOhmypiRuntimeSync as K, recordStartupSessionExit as Kn, getAgentRuntimeBaseCommand as Kt, messageAgent as L, isAgentPaused as Ln, transitionIssueToInProgress as Lt, resumeAgent as M, getAgentResumeGateBlockReason as Mn, assertWorkspaceStackHealthyForSpawn as Mt, init_context_overflow as N, getAgentState as Nn, buildAgentLaunchConfig as Nt, recoverAgent as O, clearAgentTroubledSync as On, init_transcript_landing as Ot, isContextOverflowError as P, getAgentStateFilePath as Pn, defaultRunWorkspace as Pt, stopAgent as Q, setAgentYieldedSync as Qn, injectPiConversationMemory as Qt, init_operator_interventions as R, isAgentTroubled as Rn, transitionIssueToInReview as Rt, init_tier_escalation as S, GOVERNOR_SLOT_PAUSE_REASON_PREFIX as Sn, paneShowsCodexAuthBurn as Sr, deliverAgentMessage as St, reconcileSlotState as T, clearAgentPaused as Tn, deliverResumeMessageWithTranscriptConfirmation as Tt, getLatestSessionIdSync as U, markAgentTroubled as Un, resolveTier as Ut, getActivity as V, markAgentRunningState as Vn, resolveStaffing as Vt, getSessionId as W, recordAgentFailure as Wn, OHMYPI_AGENT_READY_TIMEOUT_SECONDS as Wt, spawnRun as X, setAgentPaused as Xn, getRoleRuntimeBaseCommand as Xt, spawnAgent as Y, saveAgentStateSync as Yn, getProviderAuthMode as Yt, init_termination as Z, setAgentPausedSync as Zn, init_runtime_command as Zt, spawnTierSupervisor as _, buildDefaultResumeContinueMessage as _n, getAgentRuntimeSnapshot as _r, init_config as _t, listRunningAgentsSync as a, getClaudeAuthStatus as an, init_pty_supervisor_locate as ar, init_concurrency as at, init_tier_feed as b, dismissDevChannelsDialog as bn, checkCodexAuthStatus as br, saveCloisterConfigSync as bt, compactAtTierRunBoundary as c, buildSpawnEnvForModel as cn, isQualifiedAgentId as cr, resetPatrolDispatchBudget as ct, replayStandingAgent as d, getProviderExportsForModel as dn, waitForAgentIdle as dr, workResumeSlotsAvailable as dt, waitForPromptReady as en, writeAgentStateJsonSync as er, countRunningAgents as et, shouldReplayCompactAtTierRunBoundary as f, getProviderTmuxFlags as fn, waitForReadySignal as fr, getCachedMemoryVerdict as ft, shouldSupervise as g, init_openai_auth as gn, saveAgentRuntimeState as gr, getHealthThresholdsMs as gt, loadPrdDraft as h, getOpenAIAuthStatus as hn, init_runtime_state as hr, DEFAULT_CLOISTER_CONFIG as ht, listRunningAgents as i, ohmypiFifoPaths as in, writePtyToken as ir, getConcurrencyLimits as it, init_resume as j, getAgentDir as jn, writeBridgeTokenSync as jt, restartAgent as k, clearYieldForResumeSync as kn, probeTranscriptSince as kt, contextWindowForModel as l, determineModel as ln, normalizeAgentId as lr, tryReserveAdvancingSlot as lt, init_tier_supervisor as m, validateProviderHealth as mn, getAgentRuntimeStateSync as mr, setCachedMemoryVerdict as mt, init_queries as n, piFifoPaths as nn, readAgentHarnessModelRecordSync as nr, describeRunningAgents as nt, warnOnBareNumericIssueIds as o, init_claude_auth as on, resolvePtySupervisorScriptPath as or, releaseAdvancingSlot as ot, deliverCommitForReview as p, init_provider_health as pn, getAgentRuntimeState as pr, init_memory_verdict_cache as pt, init_ohmypi as q, resetAgentFailureCount as qn, getCodexLauncherFields as qt, listAgentStates as r, init_ohmypi_fifo as rn, init_pty_token as rr, emergencyBrake as rt, init_agents as s, buildCavemanExports as sn, clearReadySignal as sr, releaseSwarmSlot as st, dropLegacyAgentStatesMissingRoleAsync as t, init_pi_fifo as tn, init_agent_record_sync as tr, countRunningSwarmSlotsForIssue as tt, replayCrashedStandingAgent as u, getProviderEnvForModel as un, resolveAgentTargetSync as ur, tryReserveSwarmSlot as ut, supervisorAgentId as v, decideChannelsForWorkAgent as vn, init_agent_runtime as vr, loadCloisterConfig as vt, listSlotAssignments as w, __testInternals as wn, parseOhmypiSessionCostResultSync as wr, deliverInitialPromptWithRetry as wt, decideEscalation as x, writeChannelsBridgeMcpConfig as xn, init_codex_auth as xr, shouldAutoStart as xt, broadcastCommit as y, decideSupervisorForWorkAgent as yn, applyCodexAuthBurnFlag as yr, loadCloisterConfigSync as yt, operatorInterventionEvent as z, isRole as zn, init_staffing as zt };
 
-//# sourceMappingURL=agents-CsOzAmRg.js.map
+//# sourceMappingURL=queries-C0LCGG21.js.map