@p4code/cli 0.1.17 → 0.1.19

package/dist/bin.mjs

@@ -121,7 +121,7 @@ const closeServer = (server) => {
 * NetService - Service tag for startup networking helpers.
 */
 var NetService = class extends Context.Service()("@p4code/shared/Net/NetService") {};
-const make$75 = () => {
+const make$76 = () => {
 	/**
 	* Returns true when a TCP server can bind to {host, port}.
 	* `EADDRNOTAVAIL` is treated as available so IPv6-absent hosts don't fail
@@ -230,10 +230,10 @@ const make$75 = () => {
 		})
 	};
 };
-const layer$71 = Layer.sync(NetService, make$75);
+const layer$72 = Layer.sync(NetService, make$76);
 //#endregion
 //#region package.json
-var version = "0.1.17";
+var version = "0.1.19";
 //#endregion
 //#region src/config.ts
 /**
@@ -254,8 +254,8 @@ var ServerConfig$1 = class extends Context.Service()("@p4code/cli/config/ServerC
 	/** @deprecated Import and use `layerTest` from this module. */
 	static layerTest = (cwd, baseDirOrPrefix) => layerTest$2(cwd, baseDirOrPrefix);
 };
-const make$74 = (config) => ServerConfig$1.of(config);
-const layer$70 = (config) => Layer.succeed(ServerConfig$1, make$74(config));
+const make$75 = (config) => ServerConfig$1.of(config);
+const layer$71 = (config) => Layer.succeed(ServerConfig$1, make$75(config));
 const deriveServerPaths = Effect.fn(function* (baseDir, devUrl, options = {}) {
 	const { join } = yield* Path.Path;
 	const stateDir = join(baseDir, devUrl !== void 0 && !options.baseDirIsExplicit ? "dev" : "userdata");
@@ -3430,6 +3430,36 @@ const PreviewAutomationNetworkEntry = Schema.Struct({
 	errorText: Schema.optional(Schema.String),
 	timestamp: Schema.String
 });
+/** Value of an accessibility state such as `expanded`, `checked` or `level`. */
+const PreviewAccessibilityState = Schema.Union([
+	Schema.String,
+	Schema.Number,
+	Schema.Boolean
+]);
+/**
+* A node of the compacted accessibility tree. `parentId` points at the nearest
+* emitted ancestor, so the hierarchy is reconstructible without child lists.
+*/
+const PreviewAccessibilityNode = Schema.Struct({
+	id: Schema.String,
+	parentId: Schema.optional(Schema.String),
+	role: Schema.String,
+	name: Schema.optional(Schema.String),
+	description: Schema.optional(Schema.String),
+	value: Schema.optional(Schema.String),
+	states: Schema.optional(Schema.Record(Schema.String, PreviewAccessibilityState))
+});
+/**
+* Semantic nodes only: ignored nodes, raw text nodes and unnamed layout
+* wrappers are dropped, and the node list is capped. `totalNodes` counts the
+* nodes that survived filtering, so `truncated` distinguishes a clipped tree
+* from a small page.
+*/
+const PreviewAccessibilitySnapshot = Schema.Struct({
+	nodes: Schema.Array(PreviewAccessibilityNode),
+	totalNodes: Schema.Int,
+	truncated: Schema.Boolean
+});
 const PreviewAutomationActionEvent = Schema.Struct({
 	id: Schema.String,
 	action: Schema.String,
@@ -3449,7 +3479,7 @@ const PreviewAutomationSnapshot = Schema.Struct({
 	loading: Schema.Boolean,
 	visibleText: Schema.String,
 	interactiveElements: Schema.Array(PreviewAutomationElement),
-	accessibilityTree: Schema.Unknown,
+	accessibilityTree: PreviewAccessibilitySnapshot,
 	consoleEntries: Schema.Array(PreviewAutomationConsoleEntry),
 	networkEntries: Schema.Array(PreviewAutomationNetworkEntry),
 	actionTimeline: Schema.Array(PreviewAutomationActionEvent),
@@ -4773,6 +4803,7 @@ Schema$1.Literals([
 	"config.warning",
 	"deprecation.notice",
 	"files.persisted",
+	"code.published",
 	"runtime.warning",
 	"runtime.error"
 ]);
@@ -4821,6 +4852,7 @@ const ModelReroutedType = Schema$1.Literal("model.rerouted");
 const ConfigWarningType = Schema$1.Literal("config.warning");
 const DeprecationNoticeType = Schema$1.Literal("deprecation.notice");
 const FilesPersistedType = Schema$1.Literal("files.persisted");
+const CodePublishedType = Schema$1.Literal("code.published");
 const ToolDeniedType = Schema$1.Literal("tool.denied");
 const RuntimeWarningType = Schema$1.Literal("runtime.warning");
 const RuntimeErrorType = Schema$1.Literal("runtime.error");
@@ -5123,6 +5155,12 @@ const FilesPersistedPayload = Schema$1.Struct({
 		error: TrimmedNonEmptyStringSchema$1
 	})))
 });
+const CodePublishedPayload = Schema$1.Struct({
+	hostingProvider: TrimmedNonEmptyStringSchema$1,
+	url: TrimmedNonEmptyStringSchema$1,
+	repo: Schema$1.optional(TrimmedNonEmptyStringSchema$1),
+	identifier: Schema$1.optional(TrimmedNonEmptyStringSchema$1)
+});
 const ToolDeniedPayload = Schema$1.Struct({
 	toolName: TrimmedNonEmptyStringSchema$1,
 	toolUseId: Schema$1.optional(TrimmedNonEmptyStringSchema$1),
@@ -5363,6 +5401,11 @@ const ProviderRuntimeFilesPersistedEvent = Schema$1.Struct({
 	type: FilesPersistedType,
 	payload: FilesPersistedPayload
 });
+const ProviderRuntimeCodePublishedEvent = Schema$1.Struct({
+	...ProviderRuntimeEventBase.fields,
+	type: CodePublishedType,
+	payload: CodePublishedPayload
+});
 const ProviderRuntimeToolDeniedEvent = Schema$1.Struct({
 	...ProviderRuntimeEventBase.fields,
 	type: ToolDeniedType,
@@ -5424,6 +5467,7 @@ Schema$1.Union([
 	ProviderRuntimeConfigWarningEvent,
 	ProviderRuntimeDeprecationNoticeEvent,
 	ProviderRuntimeFilesPersistedEvent,
+	ProviderRuntimeCodePublishedEvent,
 	ProviderRuntimeToolDeniedEvent,
 	ProviderRuntimeWarningEvent,
 	ProviderRuntimeErrorEvent
@@ -5795,6 +5839,20 @@ const ServerSettings = Schema$1.Struct({
 	* back for sessions started by the Claude provider.
 	*/
 	enableToolCallNarration: Schema$1.Boolean.pipe(Schema$1.withDecodingDefault(Effect.succeed(true))),
+	/**
+	* Whether the model may spawn subagents without being asked to.
+	*
+	* On by default: a bounded search or review whose result is far smaller than
+	* the reading it takes to produce is exactly the work a subagent is for, and
+	* an agent that has to ask first will simply do it inline instead.
+	*
+	* Stated in the appended prompt whichever way it is set, rather than only
+	* when off. The provider's own preset prompt carries an instruction not to
+	* spawn subagents unless asked, and p4code requests that preset wholesale —
+	* so there is nothing to withhold, and only a later, more specific
+	* instruction can override an earlier general one.
+	*/
+	enableUnpromptedSubagents: Schema$1.Boolean.pipe(Schema$1.withDecodingDefault(Effect.succeed(true))),
 	automaticGitFetchInterval: Schema$1.DurationFromMillis.pipe(Schema$1.withDecodingDefault(Effect.succeed(Duration.toMillis(DEFAULT_AUTOMATIC_GIT_FETCH_INTERVAL)))),
 	defaultThreadEnvMode: ThreadEnvMode.pipe(Schema$1.withDecodingDefault(Effect.succeed("local"))),
 	newWorktreesStartFromOrigin: Schema$1.Boolean.pipe(Schema$1.withDecodingDefault(Effect.succeed(true))),
@@ -5929,6 +5987,7 @@ const ServerSettingsPatch = Schema$1.Struct({
 	enableAssistantStreaming: Schema$1.optionalKey(Schema$1.Boolean),
 	enableProviderUpdateChecks: Schema$1.optionalKey(Schema$1.Boolean),
 	enableToolCallNarration: Schema$1.optionalKey(Schema$1.Boolean),
+	enableUnpromptedSubagents: Schema$1.optionalKey(Schema$1.Boolean),
 	automaticGitFetchInterval: Schema$1.optionalKey(Schema$1.DurationFromMillis),
 	defaultThreadEnvMode: Schema$1.optionalKey(ThreadEnvMode),
 	newWorktreesStartFromOrigin: Schema$1.optionalKey(Schema$1.Boolean),
@@ -7189,6 +7248,21 @@ const RepositoryKeyField = TrimmedNonEmptyString.pipe(Schema$1.annotateEncoded({
 * placed by hand and falls back to the priority/recency order.
 */
 const OrderKeyField = TrimmedNonEmptyString.pipe(Schema$1.annotateEncoded({ description: "Manual board position key. Lexicographic: smaller sorts higher in the column. Null means no manual position." }));
+/**
+* Where a task came from when it did not originate on this board.
+*
+* The identifier is the tracker's own, not ours: `MOBILE-12262` reads the same
+* in p4code as it does in Linear, in a commit message, and in conversation,
+* which is the whole point of carrying it. `url` is what the tracker itself
+* reported, never a guess assembled from the identifier - a Linear URL embeds
+* the workspace slug, so a constructed one would 404.
+*/
+const TaskExternalRef = Schema$1.Struct({
+	source: Schema$1.Literals(["linear"]),
+	identifier: TrimmedNonEmptyString,
+	url: TrimmedNonEmptyString
+});
+const ExternalRefField = TaskExternalRef.pipe(Schema$1.annotateEncoded({ description: "The tracker issue this task mirrors, e.g. a Linear ticket. Null for a task that originated on this board." }));
 const LabelsField = Schema$1.Array(TaskLabel).check(Schema$1.isMaxLength(TASK_LABELS_MAX_COUNT)).pipe(Schema$1.annotateEncoded({ description: "Free-form tags used to group and filter tasks." }));
 const TaskIdField = TaskId.pipe(Schema$1.annotateEncoded({ description: "Id of the task to act on - the UUID or the readable id (e.g. P4-12)." }));
 const Task = Schema$1.Struct({
@@ -7230,6 +7304,13 @@ const Task = Schema$1.Struct({
 	* to a history.
 	*/
 	threadId: Schema$1.NullOr(ThreadId),
+	/**
+	* The tracker issue this task mirrors, or `null` for a task that was filed
+	* here. Nullable-with-default for the same version-skew reason as
+	* `readableId` above: a row from a store without the migration decodes to
+	* `null` rather than failing the whole board.
+	*/
+	externalRef: Schema$1.NullOr(TaskExternalRef).pipe(Schema$1.withDecodingDefault(Effect.succeed(null))),
 	title: TrimmedNonEmptyString.check(Schema$1.isMaxLength(TASK_TITLE_MAX_LENGTH)),
 	body: Schema$1.String,
 	status: StoredStatusField,
@@ -7243,6 +7324,7 @@ const TaskCreateInput = Schema$1.Struct({
 	projectId: Schema$1.optional(ProjectIdField),
 	repositoryKey: Schema$1.optional(RepositoryKeyField),
 	threadId: Schema$1.optional(ThreadIdField),
+	externalRef: Schema$1.optional(ExternalRefField),
 	title: TitleField,
 	body: Schema$1.optional(BodyField),
 	status: Schema$1.optional(StatusField),
@@ -7281,6 +7363,7 @@ const TaskUpdateInput = Schema$1.Struct({
 	projectId: Schema$1.optional(Schema$1.NullOr(ProjectIdField)),
 	repositoryKey: Schema$1.optional(Schema$1.NullOr(RepositoryKeyField)),
 	threadId: Schema$1.optional(Schema$1.NullOr(ThreadIdField)),
+	externalRef: Schema$1.optional(Schema$1.NullOr(ExternalRefField)),
 	title: Schema$1.optional(TitleField),
 	body: Schema$1.optional(BodyField),
 	status: Schema$1.optional(StatusField),
@@ -7646,6 +7729,58 @@ var ProjectWriteFileError = class extends Schema$1.TaggedErrorClass()("ProjectWr
 	}
 };
 //#endregion
+//#region ../../packages/contracts/src/ticket.ts
+/**
+* Reading an issue out of an external tracker.
+*
+* One call, deliberately: p4code does not sync trackers, it recognizes a ticket
+* somebody pasted and asks the tracker what it is called. Everything durable
+* that comes back is stored on a task as its {@link TaskExternalRef}.
+*
+* The tracker is reached through the MCP server the user already registered for
+* it, so there is no second place to configure credentials and no p4code-owned
+* API key. That also bounds what this can ever answer: a tracker with no MCP
+* server registered, or one never signed in to on this machine, is reported as
+* unconfigured rather than silently returning nothing.
+*
+* @module contracts/ticket
+*/
+/**
+* A tracker reference as it was typed, before anything has confirmed it exists.
+*
+* Deliberately not the parsed `{ source, identifier }` pair: what a user pastes
+* is a URL as often as an id, and which tracker a bare `MOBILE-12262` belongs
+* to is a question only the resolver can answer.
+*/
+const TicketResolveInput = Schema$1.Struct({ reference: TrimmedNonEmptyString });
+const TicketResolveResult = Schema$1.Struct({
+	externalRef: TaskExternalRef,
+	/** The issue title as the tracker reports it, for the task that mirrors it. */
+	title: TrimmedNonEmptyString
+});
+/**
+* Why a reference could not be turned into a ticket.
+*
+* The reason is separate from the detail because the client acts on it: an
+* unconfigured tracker is a thing the user can fix in Settings and is worth
+* saying so about, while `unavailable` is a retry and `not_found` usually means
+* a typo. `detail` is the sentence to show; the reason decides the shape.
+*/
+const TicketResolveFailureReason = Schema$1.Literals([
+	"not_configured",
+	"not_authorized",
+	"not_found",
+	"unavailable"
+]);
+var TicketResolveError = class extends Schema$1.TaggedErrorClass()("TicketResolveError", {
+	reason: TicketResolveFailureReason,
+	detail: Schema$1.String
+}) {
+	get message() {
+		return this.detail;
+	}
+};
+//#endregion
 //#region ../../packages/contracts/src/threadControl.ts
 /**
 * Thread control over MCP - the self-scoped toolkit an agent uses to act on
@@ -7820,11 +7955,17 @@ const AGENT_ASSET_TOTAL_MAX_BYTES = 4 * 1024 * 1024;
 *   directory rather than the provider's. The definition travels; the bearer
 *   tokens and API keys it references do not, and stay in each machine's own
 *   secret store.
+* - `agent` — a subagent definition, a single markdown file in
+*   `<configDir>/agents`. The name is the filename, as for `memory`. This is the
+*   only artifact that bounds what a subagent is handed and what it hands back,
+*   because p4code observes subagent runs rather than constructing their
+*   prompts — so the I/O contract can only ship as a file the provider reads.
 */
 const AgentAssetKind = Schema$1.Literals([
 	"skill",
 	"memory",
-	"mcp"
+	"mcp",
+	"agent"
 ]);
 /**
 * An asset's name, which for a skill is also its directory name.
@@ -8691,6 +8832,7 @@ const WS_METHODS = {
 	tasksUpdate: "tasks.update",
 	tasksDelete: "tasks.delete",
 	tasksStartThread: "tasks.startThread",
+	ticketsResolve: "tickets.resolve",
 	hubGetSyncStatus: "hub.getSyncStatus",
 	hubConnect: "hub.connect",
 	hubDisconnect: "hub.disconnect",
@@ -8998,6 +9140,17 @@ const WsMcpOAuthDisconnectRpc = Rpc.make(WS_METHODS.mcpOAuthDisconnect, {
 	error: Schema$1.Union([McpRegistryError, EnvironmentAuthorizationError])
 });
 /**
+* Asks the tracker what a pasted reference is, without writing anything.
+*
+* Read-only on purpose: the caller decides whether the answer becomes a task.
+* A resolve that filed a row would make an accidental paste a board entry.
+*/
+const WsTicketsResolveRpc = Rpc.make(WS_METHODS.ticketsResolve, {
+	payload: TicketResolveInput,
+	success: TicketResolveResult,
+	error: Schema$1.Union([TicketResolveError, EnvironmentAuthorizationError])
+});
+/**
 * The board, then every change to it, for as long as the client stays
 * subscribed. The leading snapshot is what makes this sufficient on its own —
 * a client does not list first, so there is no window between the two in which
@@ -9375,7 +9528,7 @@ const WsSubscribeAuthAccessRpc = Rpc.make(WS_METHODS.subscribeAuthAccess, {
 	error: Schema$1.Union([AuthAccessStreamError, EnvironmentAuthorizationError]),
 	stream: true
 });
-const WsRpcGroup = RpcGroup.make(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetProviderUsageRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerSignalProcessRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsPreviewOpenRpc, WsPreviewNavigateRpc, WsPreviewResizeRpc, WsPreviewRefreshRpc, WsPreviewCloseRpc, WsPreviewListRpc, WsPreviewReportStatusRpc, WsPreviewAutomationConnectRpc, WsPreviewAutomationRespondRpc, WsPreviewAutomationFocusHostRpc, WsSubscribePreviewEventsRpc, WsSubscribeDiscoveredLocalServersRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsTasksListRpc, WsTasksGetRpc, WsTasksCreateRpc, WsTasksUpdateRpc, WsTasksDeleteRpc, WsTasksStartThreadRpc, WsSubscribeTasksRpc, WsHubGetSyncStatusRpc, WsHubConnectRpc, WsHubDisconnectRpc, WsHubSetSyncModeRpc, WsHubSetShareModeRpc, WsHubMintTokenRpc, WsSkillsSyncRpc, WsSkillsPublishRpc, WsSkillsPublishAllRpc, WsSkillsUnpublishRpc, WsAssetsReadRpc, WsAssetsSaveRpc, WsAssetsDeleteRpc, WsAssetsCreateLocalRpc, WsAssetsRemoveLocalRpc, WsSkillRegistrySearchRpc, WsSkillRegistryFetchRpc, WsMcpListRpc, WsMcpSaveRpc, WsMcpRemoveRpc, WsMcpSetSecretRpc, WsMcpOAuthBeginRpc, WsMcpOAuthDisconnectRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
+const WsRpcGroup = RpcGroup.make(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetProviderUsageRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerSignalProcessRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsPreviewOpenRpc, WsPreviewNavigateRpc, WsPreviewResizeRpc, WsPreviewRefreshRpc, WsPreviewCloseRpc, WsPreviewListRpc, WsPreviewReportStatusRpc, WsPreviewAutomationConnectRpc, WsPreviewAutomationRespondRpc, WsPreviewAutomationFocusHostRpc, WsSubscribePreviewEventsRpc, WsSubscribeDiscoveredLocalServersRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsTasksListRpc, WsTasksGetRpc, WsTasksCreateRpc, WsTasksUpdateRpc, WsTasksDeleteRpc, WsTasksStartThreadRpc, WsSubscribeTasksRpc, WsHubGetSyncStatusRpc, WsHubConnectRpc, WsHubDisconnectRpc, WsHubSetSyncModeRpc, WsHubSetShareModeRpc, WsHubMintTokenRpc, WsSkillsSyncRpc, WsSkillsPublishRpc, WsSkillsPublishAllRpc, WsSkillsUnpublishRpc, WsAssetsReadRpc, WsAssetsSaveRpc, WsAssetsDeleteRpc, WsAssetsCreateLocalRpc, WsAssetsRemoveLocalRpc, WsSkillRegistrySearchRpc, WsSkillRegistryFetchRpc, WsMcpListRpc, WsMcpSaveRpc, WsMcpRemoveRpc, WsMcpSetSecretRpc, WsMcpOAuthBeginRpc, WsMcpOAuthDisconnectRpc, WsTicketsResolveRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
 //#endregion
 //#region ../../packages/shared/src/oauthScope.ts
 const OAUTH_SCOPE_TOKEN = /^[\u0021\u0023-\u005b\u005d-\u007e]+$/u;
@@ -9521,7 +9674,7 @@ function deriveAuthClientMetadata(input) {
 //#endregion
 //#region src/auth/EnvironmentAuthPolicy.ts
 var EnvironmentAuthPolicy = class extends Context.Service()("@p4code/cli/auth/EnvironmentAuthPolicy") {};
-const make$73 = Effect.gen(function* () {
+const make$74 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const isRemoteReachable = isRemoteReachableHost(config.host);
 	const policy = config.mode === "desktop" ? isRemoteReachable ? "remote-reachable" : "desktop-managed-local" : isRemoteReachable ? "remote-reachable" : "loopback-browser";
@@ -9539,7 +9692,7 @@ const make$73 = Effect.gen(function* () {
 	};
 	return EnvironmentAuthPolicy.of({ getDescriptor: () => Effect.succeed(descriptor).pipe(Effect.withSpan("EnvironmentAuthPolicy.getDescriptor")) });
 });
-const layer$69 = Layer.effect(EnvironmentAuthPolicy, make$73);
+const layer$70 = Layer.effect(EnvironmentAuthPolicy, make$74);
 //#endregion
 //#region src/persistence/Errors.ts
 function summarizeSchemaIssue(issue) {
@@ -9720,7 +9873,7 @@ function toPersistenceSqlOrDecodeError$6(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$72 = Effect.gen(function* () {
+const make$73 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createSessionRow = SqlSchema.void({
 		Request: CreateAuthSessionInput,
@@ -9854,7 +10007,7 @@ const make$72 = Effect.gen(function* () {
 		setLastConnectedAt
 	};
 });
-const layer$68 = Layer.effect(AuthSessionRepository, make$72);
+const layer$69 = Layer.effect(AuthSessionRepository, make$73);
 //#endregion
 //#region src/auth/ServerSecretStore.ts
 const secretStoreErrorContext = {
@@ -9921,7 +10074,7 @@ const isSecretStoreError = Schema$1.is(SecretStoreError);
 const isPlatformError = (value) => Predicate.isTagged(value, "PlatformError");
 const isSecretAlreadyExistsError = (error) => "cause" in error && isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists";
 var ServerSecretStore = class extends Context.Service()("@p4code/cli/auth/ServerSecretStore") {};
-const make$71 = Effect.gen(function* () {
+const make$72 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -9991,7 +10144,7 @@ const make$71 = Effect.gen(function* () {
 		remove
 	});
 });
-const layer$67 = Layer.effect(ServerSecretStore, make$71);
+const layer$68 = Layer.effect(ServerSecretStore, make$72);
 //#endregion
 //#region src/auth/SessionStore.ts
 var MalformedSessionTokenError = class extends Schema$1.TaggedErrorClass()("MalformedSessionTokenError", {}) {
@@ -10229,7 +10382,7 @@ function toAuthClientSession(input) {
 		current: false
 	};
 }
-const make$70 = Effect.gen(function* () {
+const make$71 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const serverConfig = yield* ServerConfig$1;
 	const secretStore = yield* ServerSecretStore;
@@ -10543,7 +10696,7 @@ const make$70 = Effect.gen(function* () {
 		markDisconnected
 	});
 });
-const layer$66 = Layer.effect(SessionStore, make$70).pipe(Layer.provideMerge(layer$68));
+const layer$67 = Layer.effect(SessionStore, make$71).pipe(Layer.provideMerge(layer$69));
 //#endregion
 //#region src/persistence/AuthPairingLinks.ts
 const AuthPairingLinkRecord = Schema$1.Struct({
@@ -10604,7 +10757,7 @@ function toPersistenceSqlOrDecodeError$5(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$69 = Effect.gen(function* () {
+const make$70 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createPairingLinkRow = SqlSchema.void({
 		Request: CreateAuthPairingLinkInput,
@@ -10739,7 +10892,7 @@ const make$69 = Effect.gen(function* () {
 		getByCredential
 	};
 });
-const layer$65 = Layer.effect(AuthPairingLinkRepository, make$69);
+const layer$66 = Layer.effect(AuthPairingLinkRepository, make$70);
 //#endregion
 //#region src/auth/PairingGrantStore.ts
 var UnknownBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("UnknownBootstrapCredentialError", {}) {
@@ -10834,7 +10987,7 @@ const DEV_STARTUP_TTL_HOURS = Duration.hours(24);
 const PAIRING_TOKEN_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
 const PAIRING_TOKEN_LENGTH = 12;
 const PAIRING_TOKEN_REJECTION_LIMIT = Math.floor(256 / 32) * 32;
-const make$68 = Effect.gen(function* () {
+const make$69 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const config = yield* ServerConfig$1;
 	const pairingLinks = yield* AuthPairingLinkRepository;
@@ -11032,7 +11185,7 @@ const make$68 = Effect.gen(function* () {
 		consume
 	});
 });
-const layer$64 = Layer.effect(PairingGrantStore, make$68).pipe(Layer.provideMerge(layer$65));
+const layer$65 = Layer.effect(PairingGrantStore, make$69).pipe(Layer.provideMerge(layer$66));
 //#endregion
 //#region src/persistence/Migrations/001_OrchestrationEvents.ts
 var _001_OrchestrationEvents_default = Effect.gen(function* () {
@@ -12485,6 +12638,28 @@ var _039_ProjectionThreadsCompressMode_default = Effect.gen(function* () {
   `;
 });
 //#endregion
+//#region src/persistence/Migrations/040_TaskExternalRef.ts
+/**
+* The tracker issue a task mirrors, for tasks that did not start on this board.
+*
+* Stored as one JSON blob rather than three columns because nothing queries
+* inside it except the uniqueness check below, and a tracker's shape is not
+* ours to normalize - a second source will bring fields Linear does not have.
+*
+* The unique index is over the identifier alone, extracted from the JSON: it is
+* what stops a second paste of the same ticket from filing a duplicate task.
+* Partial, so the many rows with no external ref do not collide on NULL.
+*/
+var _040_TaskExternalRef_default = Effect.gen(function* () {
+	const sql = yield* SqlClient.SqlClient;
+	yield* sql`ALTER TABLE tasks ADD COLUMN external_ref_json TEXT`;
+	yield* sql`
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_tasks_external_ref_identifier
+    ON tasks(json_extract(external_ref_json, '$.identifier'))
+    WHERE external_ref_json IS NOT NULL
+  `;
+});
+//#endregion
 //#region src/persistence/Migrations.ts
 /**
 * MigrationsLive - Migration runner with inline loader
@@ -12700,6 +12875,11 @@ const migrationEntries = [
 		39,
 		"ProjectionThreadsCompressMode",
 		_039_ProjectionThreadsCompressMode_default
+	],
+	[
+		40,
+		"TaskExternalRef",
+		_040_TaskExternalRef_default
 	]
 ];
 const makeMigrationLoader = (throughId) => Migrator.fromRecord(Object.fromEntries(migrationEntries.filter(([id]) => throughId === void 0 || id <= throughId).map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -12887,7 +13067,7 @@ function parseBearerToken(request) {
 	const token = header.slice(7).trim();
 	return token.length > 0 ? token : null;
 }
-const make$67 = Effect.gen(function* () {
+const make$68 = Effect.gen(function* () {
 	const policy = yield* EnvironmentAuthPolicy;
 	const bootstrapCredentials = yield* PairingGrantStore;
 	const sessions = yield* SessionStore;
@@ -13082,9 +13262,9 @@ const make$67 = Effect.gen(function* () {
 		issueStartupPairingUrl
 	});
 });
-const layer$63 = Layer.effect(EnvironmentAuth, make$67).pipe(Layer.provideMerge(layer$64), Layer.provideMerge(layer$66), Layer.provideMerge(layer$69));
-const storageLayer = Layer.mergeAll(layer$67, layerConfig);
-const runtimeLayer = layer$63.pipe(Layer.provideMerge(storageLayer));
+const layer$64 = Layer.effect(EnvironmentAuth, make$68).pipe(Layer.provideMerge(layer$65), Layer.provideMerge(layer$67), Layer.provideMerge(layer$70));
+const storageLayer = Layer.mergeAll(layer$68, layerConfig);
+const runtimeLayer = layer$64.pipe(Layer.provideMerge(storageLayer));
 //#endregion
 //#region src/cliAuthFormat.ts
 const newline = "\n";
@@ -13839,7 +14019,7 @@ const runWithEnvironmentAuth = (flags, run, options) => Effect.gen(function* ()
 	}
 	return yield* Effect.gen(function* () {
 		return yield* run(yield* EnvironmentAuth);
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$70(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$71(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const ttlFlag = Flag.string("ttl").pipe(Flag.withSchema(DurationFromString), Flag.withDescription("TTL, for example `5m`, `1h`, `30d`, or `15 minutes`."), Flag.optional);
 const jsonFlag = Flag.boolean("json").pipe(Flag.withDescription("Emit JSON instead of human-readable output."), Flag.withDefault(false));
@@ -13979,7 +14159,7 @@ const DEFAULT_LIMITS = {
 	windowMillis: FAILURE_WINDOW_MS,
 	blockMillis: BLOCK_DURATION_MS
 };
-const make$66 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LIMITS) {
+const make$67 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LIMITS) {
 	const state = yield* Ref.make(initialThrottleState);
 	return HubAuthThrottle.of({
 		shouldRefuse: Effect.gen(function* () {
@@ -13993,7 +14173,7 @@ const make$66 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LI
 		})
 	});
 });
-const layer$62 = Layer.effect(HubAuthThrottle, make$66());
+const layer$63 = Layer.effect(HubAuthThrottle, make$67());
 //#endregion
 //#region src/hub/HubAuth.ts
 /**
@@ -14307,7 +14487,10 @@ const DeleteTaskInput = Schema$1.Struct({ taskId: TaskId });
 var TaskRepository = class extends Context.Service()("@p4code/cli/persistence/Services/Tasks/TaskRepository") {};
 //#endregion
 //#region src/persistence/Layers/Tasks.ts
-const TaskDbRow = Task.mapFields(Struct.assign({ labels: Schema$1.fromJsonString(Schema$1.Array(TaskLabel)) }));
+const TaskDbRow = Task.mapFields(Struct.assign({
+	labels: Schema$1.fromJsonString(Schema$1.Array(TaskLabel)),
+	externalRef: Schema$1.NullOr(Schema$1.fromJsonString(TaskExternalRef))
+}));
 /**
 * The `list` filter with every field normalized to a bound `null` rather than
 * an absent key. Each predicate is then `(:param IS NULL OR column = :param)`,
@@ -14327,6 +14510,7 @@ const TASK_COLUMNS = `
   project_id AS "projectId",
   repository_key AS "repositoryKey",
   thread_id AS "threadId",
+  external_ref_json AS "externalRef",
   title,
   body,
   status,
@@ -14350,6 +14534,7 @@ const makeTaskRepository = Effect.gen(function* () {
           project_id,
           repository_key,
           thread_id,
+          external_ref_json,
           title,
           body,
           status,
@@ -14366,6 +14551,7 @@ const makeTaskRepository = Effect.gen(function* () {
           ${row.projectId},
           ${row.repositoryKey},
           ${row.threadId},
+          ${row.externalRef === null ? null : JSON.stringify(row.externalRef)},
           ${row.title},
           ${row.body},
           ${row.status},
@@ -14382,6 +14568,7 @@ const makeTaskRepository = Effect.gen(function* () {
           project_id = excluded.project_id,
           repository_key = excluded.repository_key,
           thread_id = excluded.thread_id,
+          external_ref_json = excluded.external_ref_json,
           title = excluded.title,
           body = excluded.body,
           status = excluded.status,
@@ -14480,6 +14667,7 @@ const makeTaskRepository = Effect.gen(function* () {
 			...input.projectId !== void 0 ? { projectId: input.projectId } : {},
 			...input.repositoryKey !== void 0 ? { repositoryKey: input.repositoryKey } : {},
 			...input.threadId !== void 0 ? { threadId: input.threadId } : {},
+			...input.externalRef !== void 0 ? { externalRef: input.externalRef } : {},
 			...input.title !== void 0 ? { title: input.title } : {},
 			...input.body !== void 0 ? { body: input.body } : {},
 			...input.status !== void 0 ? { status: input.status } : {},
@@ -14651,6 +14839,7 @@ const createTaskRoute = HttpRouter.add("POST", "/tasks", respondToHubFailures(Ef
 		projectId: input.projectId ?? null,
 		repositoryKey: input.repositoryKey ?? null,
 		threadId: input.threadId ?? null,
+		externalRef: input.externalRef ?? null,
 		title: input.title,
 		body: input.body ?? "",
 		status: input.status ?? "backlog",
@@ -14792,7 +14981,7 @@ const deleteAssetRoute = HttpRouter.add("DELETE", "/assets/:kind/:name", respond
 	const outcome = yield* (yield* AgentAssetRepository).deleteByName(requested);
 	return outcome._tag === "conflict" ? assetConflict(Option.getOrNull(outcome.current)) : HttpServerResponse.empty({ status: 204 });
 })));
-const layer$61 = Layer.mergeAll(healthRoute, listTasksRoute, getTaskRoute, createTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute);
+const layer$62 = Layer.mergeAll(healthRoute, listTasksRoute, getTaskRoute, createTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute);
 //#endregion
 //#region src/hub/Migrations/001_Tasks.ts
 /**
@@ -14954,6 +15143,22 @@ var _005_TaskOrderKeys_default = Effect.gen(function* () {
 	yield* (yield* SqlClient.SqlClient)`ALTER TABLE tasks ADD COLUMN order_key TEXT`;
 });
 //#endregion
+//#region src/hub/Migrations/006_TaskExternalRef.ts
+/**
+* The tracker issue a task mirrors, mirroring the environment server's
+* migration 040. The hub carries the column so a task filed against a Linear
+* ticket on one machine still reads as that ticket on another.
+*/
+var _006_TaskExternalRef_default = Effect.gen(function* () {
+	const sql = yield* SqlClient.SqlClient;
+	yield* sql`ALTER TABLE tasks ADD COLUMN external_ref_json TEXT`;
+	yield* sql`
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_tasks_external_ref_identifier
+    ON tasks(json_extract(external_ref_json, '$.identifier'))
+    WHERE external_ref_json IS NOT NULL
+  `;
+});
+//#endregion
 //#region src/hub/Migrations.ts
 /**
 * Hub migrations.
@@ -14989,6 +15194,11 @@ const hubMigrationEntries = [
 		5,
 		"TaskOrderKeys",
 		_005_TaskOrderKeys_default
+	],
+	[
+		6,
+		"TaskExternalRef",
+		_006_TaskExternalRef_default
 	]
 ];
 const hubMigrationLoader = Migrator.fromRecord(Object.fromEntries(hubMigrationEntries.map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -15071,7 +15281,7 @@ const announce = Layer.effectDiscard(Effect.gen(function* () {
 	});
 	if (isRemoteReachableHost(config.host)) yield* Effect.logWarning("Hub is reachable beyond loopback. The bearer token is the only control — repeated auth failures are not rate limited.", { host: config.host });
 }));
-const makeHubLayer = HttpRouter.serve(layer$61).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$62), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
+const makeHubLayer = HttpRouter.serve(layer$62).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$63), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
 const runHub = Layer.launch(makeHubLayer);
 //#endregion
 //#region src/atomicWrite.ts
@@ -15195,7 +15405,7 @@ function stripDefaultServerSettings(current, defaults) {
 	}
 	return Object.is(current, defaults) ? void 0 : current;
 }
-const make$65 = Effect.gen(function* () {
+const make$66 = Effect.gen(function* () {
 	const { settingsPath } = yield* ServerConfig$1;
 	const fs = yield* FileSystem.FileSystem;
 	const pathService = yield* Path.Path;
@@ -15416,7 +15626,7 @@ const make$65 = Effect.gen(function* () {
 		}
 	};
 });
-const layer$60 = Layer.effect(ServerSettingsService, make$65);
+const layer$61 = Layer.effect(ServerSettingsService, make$66);
 //#endregion
 //#region src/pathExpansion.ts
 /**
@@ -15532,7 +15742,15 @@ function buildSkillOverrides(disabled, discovered) {
 * @module provider/Drivers/ClaudeSkills
 */
 const FRONTMATTER_PATTERN = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/;
-function parseSkillFrontmatter(contents) {
+/**
+* The `name`/`description` header a skill and a subagent definition both carry.
+*
+* Exported because agent definitions are the same header in a different file,
+* and the sync validates them before publishing one. A second copy of this
+* would be a second answer to "does this load in the provider", which is the
+* one question both callers are asking.
+*/
+function parseMarkdownFrontmatter(contents) {
 	const match = FRONTMATTER_PATTERN.exec(contents);
 	if (!match) return { kind: "missing" };
 	let parsed;
@@ -15583,6 +15801,19 @@ const resolveClaudeUserSkillsDir = Effect.fn("resolveClaudeUserSkillsDir")(funct
 	return path.join(configDirPath, "skills");
 });
 /**
+* The user-scope subagent directory the CLI would read.
+*
+* Same resolution as the skills directory beside it, for the same reason: the
+* sync materializes into exactly the directory the provider loads from, and
+* deriving it a second time is how the two come to disagree about where an
+* agent definition lives.
+*/
+const resolveClaudeUserAgentsDir = Effect.fn("resolveClaudeUserAgentsDir")(function* (config, environment, cwd) {
+	const path = yield* Path.Path;
+	const configDirPath = yield* resolveClaudeConfigDirPath(config, environment ?? process.env, cwd);
+	return path.join(configDirPath, "agents");
+});
+/**
 * Enumerate Claude Code skills from the user config dir and the workspace.
 * Discovery is best-effort: unreadable roots and malformed skill entries are
 * skipped so a broken skill never degrades the provider snapshot. On name
@@ -15607,7 +15838,7 @@ const discoverClaudeSkills = Effect.fn("discoverClaudeSkills")(function* (config
 			const skillPath = path.join(root.directory, entry, "SKILL.md");
 			const contents = yield* fileSystem.readFileString(skillPath).pipe(Effect.orElseSucceed(() => void 0));
 			if (contents === void 0) continue;
-			const frontmatter = parseSkillFrontmatter(contents);
+			const frontmatter = parseMarkdownFrontmatter(contents);
 			if (frontmatter.kind === "malformed") continue;
 			const name = (frontmatter.kind === "parsed" ? frontmatter.name : void 0) ?? entry.trim();
 			if (!name) continue;
@@ -15737,7 +15968,7 @@ function claudeEntryFromRegistration(registration) {
 	};
 }
 var ClaudeMcpFiles = class extends Context.Service()("@p4code/cli/mcp/ClaudeMcpFiles") {};
-const make$64 = Effect.gen(function* () {
+const make$65 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const services = yield* Effect.context();
@@ -15802,7 +16033,7 @@ const make$64 = Effect.gen(function* () {
 		removeProject: (projectDir, name) => removeAt(Effect.succeed(projectFile(projectDir)))(name)
 	};
 });
-const layer$59 = Layer.effect(ClaudeMcpFiles, make$64);
+const layer$60 = Layer.effect(ClaudeMcpFiles, make$65);
 Layer.succeed(ClaudeMcpFiles, {
 	readUser: Effect.succeed([]),
 	upsertUser: () => Effect.fail(new McpRegistryError({ detail: "No Claude config in tests." })),
@@ -15938,7 +16169,7 @@ const decodeClientRegistration = Schema$1.decodeUnknownExit(ClientRegistrationRe
 const decodeTokenResponse = Schema$1.decodeUnknownExit(TokenResponse);
 var McpOAuth = class extends Context.Service()("@p4code/cli/mcp/McpOAuth") {};
 const registryError = (detail) => new McpRegistryError({ detail });
-const make$63 = Effect.gen(function* () {
+const make$64 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const secrets = yield* ServerSecretStore;
 	const http = yield* HttpClient.HttpClient;
@@ -16258,7 +16489,7 @@ const make$63 = Effect.gen(function* () {
 		accessTokenFor
 	};
 });
-const layer$58 = Layer.effect(McpOAuth, make$63);
+const layer$59 = Layer.effect(McpOAuth, make$64);
 Layer.succeed(McpOAuth, {
 	statusFor: () => Effect.succeed(Option.none()),
 	begin: () => Effect.fail(new McpRegistryError({ detail: "OAuth sign-in is not available." })),
@@ -16276,7 +16507,7 @@ const decodeRegistration$1 = Schema$1.decodeUnknownExit(RegistrationFromJson$1);
 const encodeRegistration = Schema$1.encodeSync(RegistrationFromJson$1);
 var McpRegistry = class extends Context.Service()("@p4code/cli/mcp/McpRegistry") {};
 const slotsOf = (registration) => registration.secrets ?? [];
-const make$62 = Effect.gen(function* () {
+const make$63 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const secrets = yield* ServerSecretStore;
 	const oauth = yield* McpOAuth;
@@ -16427,7 +16658,289 @@ const make$62 = Effect.gen(function* () {
 		}).pipe(Effect.provide(services), Effect.catchCause((cause) => Effect.logWarning("mcp registry resolve failed", { cause }).pipe(Effect.as({}))))
 	};
 });
-const layer$57 = Layer.effect(McpRegistry, make$62);
+const layer$58 = Layer.effect(McpRegistry, make$63);
+//#endregion
+//#region src/sync/skillDirectory.ts
+/**
+* Reading and writing skill directories on disk.
+*
+* Kept apart from the sync itself so the filesystem shape has its own tests,
+* and so the rules about what is refusable — binaries, oversized files, deep
+* trees — live in one place rather than being rediscovered at each call site.
+*
+* @module sync/skillDirectory
+*/
+/** Bounded so a stray symlink or a vendored `node_modules` cannot walk forever. */
+const MAX_SKILL_DEPTH = 4;
+/**
+* Entries that are never part of a skill, skipped rather than refused.
+*
+* The distinction matters. Refusing an asset because it cannot be represented
+* faithfully is right — a half-materialized skill loads and misbehaves. But a
+* `.DS_Store` is not part of the skill at all, and macOS drops one into any
+* directory that has been opened in Finder, so refusing on its account rejects
+* a perfectly good skill for a reason its author cannot see.
+*
+* These could not sync in any case: `AgentAssetFilePath` rejects a leading dot,
+* so a dotfile has no representable path even if it were text.
+*/
+const IGNORED_ENTRIES = /* @__PURE__ */ new Set([
+	".DS_Store",
+	"Thumbs.db",
+	".git",
+	".svn",
+	".hg",
+	"node_modules",
+	"__pycache__",
+	".venv",
+	".pytest_cache",
+	".ruff_cache",
+	".mypy_cache"
+]);
+/**
+* Anything else with a leading dot is skipped too — an editor's `.idea`, a
+* `.gitignore` that belongs to the checkout rather than the skill. The rule is
+* the same one the path schema already enforces, applied earlier so it reads as
+* "not part of the skill" instead of "this skill is broken".
+*/
+const isIgnoredEntry = (entry) => IGNORED_ENTRIES.has(entry) || entry.startsWith(".");
+/**
+* A file is binary if decoding it yields a NUL.
+*
+* Cheap, and right for what is being asked: the question is not "is this valid
+* UTF-8" but "can this round-trip through a JSON text column", and a NUL is
+* what actually breaks that on the way back out of SQLite.
+*
+* Exported so the single-file kinds ask it the same way this one does, rather
+* than each keeping a copy that could drift into a different answer.
+*/
+const looksBinary$1 = (content) => content.includes("\0");
+/**
+* Read one directory as an asset's files, or say why it cannot be one.
+*
+* Exported because memory's `global-memory/` is the same shape by a different
+* name: a directory whose whole contents are the asset. Sharing this keeps the
+* refusal rules — depth, file count, binaries, size — identical for both,
+* rather than letting a second copy drift into accepting what the first
+* rejects.
+*/
+const readSkillFiles = Effect.fn("skillDirectory.readSkillFiles")(function* (root) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const files = [];
+	const walk = Effect.fn("skillDirectory.walk")(function* (directory, prefix, depth) {
+		if (depth > MAX_SKILL_DEPTH) return "too-deep";
+		const entries = yield* fileSystem.readDirectory(directory).pipe(Effect.orElseSucceed(() => []));
+		for (const entry of [...entries].sort()) {
+			if (isIgnoredEntry(entry)) continue;
+			const absolute = path.join(directory, entry);
+			const relative = prefix === "" ? entry : `${prefix}/${entry}`;
+			const info = yield* fileSystem.stat(absolute).pipe(Effect.orElseSucceed(() => void 0));
+			if (info === void 0) return "unreadable";
+			if (info.type === "Directory") {
+				const nested = yield* walk(absolute, relative, depth + 1);
+				if (nested !== null) return nested;
+				continue;
+			}
+			if (info.type !== "File") continue;
+			if (files.length >= 512) return "too-many-files";
+			const content = yield* fileSystem.readFileString(absolute).pipe(Effect.orElseSucceed(() => void 0));
+			if (content === void 0) return "unreadable";
+			if (looksBinary$1(content)) return "binary-file";
+			if (content.length > 524288) return "file-too-large";
+			files.push({
+				path: relative,
+				content
+			});
+		}
+		return null;
+	});
+	const refusal = yield* walk(root, "", 1);
+	if (refusal !== null) return { refusal };
+	if (agentAssetTotalBytes(files) > 4194304) return { refusal: "asset-too-large" };
+	return { files };
+});
+/**
+* Read every skill directory under a user-scope `skills/` root.
+*
+* A directory with no `SKILL.md` is not a skill and is skipped silently —
+* Claude Code would ignore it too, so reporting it would be noise about
+* something that was never a skill in the first place.
+*/
+const readSkillDirectory = Effect.fn("skillDirectory.readSkillDirectory")(function* (skillsRoot) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const entries = yield* fileSystem.readDirectory(skillsRoot).pipe(Effect.orElseSucceed(() => []));
+	const skills = [];
+	const refused = [];
+	for (const entry of [...entries].sort()) {
+		if (isIgnoredEntry(entry)) continue;
+		const directory = path.join(skillsRoot, entry);
+		if ((yield* fileSystem.stat(directory).pipe(Effect.orElseSucceed(() => void 0)))?.type !== "Directory") continue;
+		if (!(yield* fileSystem.exists(path.join(directory, "SKILL.md")).pipe(Effect.orElseSucceed(() => false)))) continue;
+		const read = yield* readSkillFiles(directory);
+		if ("refusal" in read) {
+			refused.push({
+				name: entry,
+				reason: read.refusal
+			});
+			continue;
+		}
+		skills.push({
+			name: entry,
+			files: read.files
+		});
+	}
+	return {
+		skills,
+		refused
+	};
+});
+/**
+* Replace a skill directory with exactly the asset's files.
+*
+* Written to a sibling and then swapped, so a crash mid-write leaves the old
+* skill intact rather than half of the new one. A skill is loaded as a unit and
+* a partially written one is instructions with the middle missing, which an
+* agent will happily follow.
+*/
+const writeSkillDirectory = Effect.fn("skillDirectory.writeSkillDirectory")(function* (input) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const target = path.join(input.skillsRoot, input.name);
+	const staging = path.join(input.skillsRoot, `.${input.name}.p4code-staging`);
+	yield* fileSystem.makeDirectory(input.skillsRoot, { recursive: true });
+	yield* fileSystem.remove(staging, {
+		recursive: true,
+		force: true
+	});
+	yield* fileSystem.makeDirectory(staging, { recursive: true });
+	for (const file of input.files) {
+		const destination = path.join(staging, file.path);
+		yield* fileSystem.makeDirectory(path.dirname(destination), { recursive: true });
+		yield* fileSystem.writeFileString(destination, file.content);
+	}
+	yield* fileSystem.remove(target, {
+		recursive: true,
+		force: true
+	});
+	yield* fileSystem.rename(staging, target);
+});
+const removeSkillDirectory = Effect.fn("skillDirectory.removeSkillDirectory")(function* (input) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	yield* fileSystem.remove(path.join(input.skillsRoot, input.name), {
+		recursive: true,
+		force: true
+	});
+});
+/**
+* Whether this text is a definition the provider would actually load.
+*
+* Both fields, not just the header. `name` is how a subagent is addressed and
+* `description` is how the orchestrator decides to address it, so a definition
+* missing either is present on disk and unreachable in practice.
+*/
+const isLoadableAgentDefinition = (content) => {
+	const frontmatter = parseMarkdownFrontmatter(content);
+	return frontmatter.kind === "parsed" && frontmatter.name !== void 0 && frontmatter.description !== void 0;
+};
+/**
+* Every definition in the directory, as syncable assets.
+*
+* A file that will not load is refused rather than skipped, unlike a stray
+* `.DS_Store`: a `.md` in this directory is meant to be an agent, so a broken
+* header is a fault worth reporting instead of noise to ignore.
+*/
+const readAgentDefinitions = Effect.fn("agentDefinitionFiles.read")(function* (agentsRoot) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const entries = yield* fileSystem.readDirectory(agentsRoot).pipe(Effect.orElseSucceed(() => []));
+	const skills = [];
+	const refused = [];
+	for (const entry of [...entries].sort()) {
+		if (!entry.endsWith(".md") || entry.startsWith(".")) continue;
+		const absolute = path.join(agentsRoot, entry);
+		if ((yield* fileSystem.stat(absolute).pipe(Effect.orElseSucceed(() => void 0)))?.type !== "File") continue;
+		const content = yield* fileSystem.readFileString(absolute).pipe(Effect.orElseSucceed(() => void 0));
+		if (content === void 0) {
+			refused.push({
+				name: entry,
+				reason: "unreadable"
+			});
+			continue;
+		}
+		if (looksBinary$1(content)) {
+			refused.push({
+				name: entry,
+				reason: "binary-file"
+			});
+			continue;
+		}
+		if (content.length > 524288) {
+			refused.push({
+				name: entry,
+				reason: "file-too-large"
+			});
+			continue;
+		}
+		if (!isLoadableAgentDefinition(content)) {
+			refused.push({
+				name: entry,
+				reason: "unreadable"
+			});
+			continue;
+		}
+		const files = [{
+			path: entry,
+			content
+		}];
+		if (agentAssetTotalBytes(files) > 4194304) {
+			refused.push({
+				name: entry,
+				reason: "asset-too-large"
+			});
+			continue;
+		}
+		skills.push({
+			name: entry,
+			files
+		});
+	}
+	return {
+		skills,
+		refused
+	};
+});
+/**
+* Write a definition that arrived from the hub.
+*
+* Refused unless it is exactly one markdown file whose path is the asset's own
+* name and whose frontmatter would load. The last check is the one that matters
+* across machines: it is what stops a hub row edited by hand from installing a
+* file the provider quietly ignores on every machine that syncs it.
+*
+* Written atomically because a definition is read whole when a subagent starts,
+* and half of one is instructions with the contract missing.
+*/
+const writeAgentDefinition = Effect.fn("agentDefinitionFiles.write")(function* (input) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const file = input.files[0];
+	if (!input.name.endsWith(".md") || input.files.length !== 1 || file === void 0 || file.path !== input.name) return "refused";
+	if (!isLoadableAgentDefinition(file.content)) return "refused";
+	yield* fileSystem.makeDirectory(input.agentsRoot, { recursive: true }).pipe(Effect.ignore);
+	return yield* writeFileStringAtomically({
+		filePath: path.join(input.agentsRoot, input.name),
+		contents: file.content
+	}).pipe(Effect.as("written"), Effect.orElseSucceed(() => "failed"));
+});
+const removeAgentDefinition = Effect.fn("agentDefinitionFiles.remove")(function* (input) {
+	if (!input.name.endsWith(".md")) return;
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	yield* fileSystem.remove(path.join(input.agentsRoot, input.name), { force: true });
+});
 //#endregion
 //#region src/sync/HubLink.ts
 /**
@@ -16524,7 +17037,7 @@ const formatHubLink = (input) => encodeStoredHubLink({
 	shareMode: input.shareMode
 });
 const fromEnvironment = (environment) => validateHubLink(environment.P4CODE_HUB_URL ?? "", environment.P4CODE_HUB_TOKEN ?? "");
-const make$61 = Effect.fn("HubLink.make")(function* (environment) {
+const make$62 = Effect.fn("HubLink.make")(function* (environment) {
 	const secrets = yield* ServerSecretStore;
 	const env = environment ?? process.env;
 	const fromEnv = fromEnvironment(env);
@@ -16590,7 +17103,7 @@ const make$61 = Effect.fn("HubLink.make")(function* (environment) {
 		})
 	};
 });
-const layer$56 = Layer.effect(HubLink, make$61());
+const layer$57 = Layer.effect(HubLink, make$62());
 //#endregion
 //#region src/sync/HubAssetClient.ts
 /**
@@ -16623,7 +17136,7 @@ const decodeAssetListPage = Schema$1.decodeUnknownEffect(AssetListPage);
 const decodeConflictBody$1 = Schema$1.decodeUnknownEffect(ConflictBody$1);
 const decodeAsset = Schema$1.decodeUnknownEffect(AgentAsset);
 var HubAssetClient = class extends Context.Service()("@p4code/cli/sync/HubAssetClient") {};
-const make$60 = Effect.gen(function* () {
+const make$61 = Effect.gen(function* () {
 	const http = yield* HttpClient.HttpClient;
 	const link = yield* HubLink;
 	const requireSettings = Effect.gen(function* () {
@@ -16705,7 +17218,7 @@ const make$60 = Effect.gen(function* () {
 		remove
 	};
 });
-const layer$55 = Layer.effect(HubAssetClient, make$60);
+const layer$56 = Layer.effect(HubAssetClient, make$61);
 //#endregion
 //#region src/sync/mcpRegistrationFiles.ts
 /**
@@ -16802,178 +17315,6 @@ const removeMcpRegistration = Effect.fn("mcpRegistrationFiles.remove")(function*
 	yield* fileSystem.remove(path.join(input.registrationsRoot, input.name), { force: true });
 });
 //#endregion
-//#region src/sync/skillDirectory.ts
-/**
-* Reading and writing skill directories on disk.
-*
-* Kept apart from the sync itself so the filesystem shape has its own tests,
-* and so the rules about what is refusable — binaries, oversized files, deep
-* trees — live in one place rather than being rediscovered at each call site.
-*
-* @module sync/skillDirectory
-*/
-/** Bounded so a stray symlink or a vendored `node_modules` cannot walk forever. */
-const MAX_SKILL_DEPTH = 4;
-/**
-* Entries that are never part of a skill, skipped rather than refused.
-*
-* The distinction matters. Refusing an asset because it cannot be represented
-* faithfully is right — a half-materialized skill loads and misbehaves. But a
-* `.DS_Store` is not part of the skill at all, and macOS drops one into any
-* directory that has been opened in Finder, so refusing on its account rejects
-* a perfectly good skill for a reason its author cannot see.
-*
-* These could not sync in any case: `AgentAssetFilePath` rejects a leading dot,
-* so a dotfile has no representable path even if it were text.
-*/
-const IGNORED_ENTRIES = /* @__PURE__ */ new Set([
-	".DS_Store",
-	"Thumbs.db",
-	".git",
-	".svn",
-	".hg",
-	"node_modules",
-	"__pycache__",
-	".venv",
-	".pytest_cache",
-	".ruff_cache",
-	".mypy_cache"
-]);
-/**
-* Anything else with a leading dot is skipped too — an editor's `.idea`, a
-* `.gitignore` that belongs to the checkout rather than the skill. The rule is
-* the same one the path schema already enforces, applied earlier so it reads as
-* "not part of the skill" instead of "this skill is broken".
-*/
-const isIgnoredEntry = (entry) => IGNORED_ENTRIES.has(entry) || entry.startsWith(".");
-/**
-* A file is binary if decoding it yields a NUL.
-*
-* Cheap, and right for what is being asked: the question is not "is this valid
-* UTF-8" but "can this round-trip through a JSON text column", and a NUL is
-* what actually breaks that on the way back out of SQLite.
-*/
-const looksBinary$1 = (content) => content.includes("\0");
-/**
-* Read one directory as an asset's files, or say why it cannot be one.
-*
-* Exported because memory's `global-memory/` is the same shape by a different
-* name: a directory whose whole contents are the asset. Sharing this keeps the
-* refusal rules — depth, file count, binaries, size — identical for both,
-* rather than letting a second copy drift into accepting what the first
-* rejects.
-*/
-const readSkillFiles = Effect.fn("skillDirectory.readSkillFiles")(function* (root) {
-	const fileSystem = yield* FileSystem.FileSystem;
-	const path = yield* Path.Path;
-	const files = [];
-	const walk = Effect.fn("skillDirectory.walk")(function* (directory, prefix, depth) {
-		if (depth > MAX_SKILL_DEPTH) return "too-deep";
-		const entries = yield* fileSystem.readDirectory(directory).pipe(Effect.orElseSucceed(() => []));
-		for (const entry of [...entries].sort()) {
-			if (isIgnoredEntry(entry)) continue;
-			const absolute = path.join(directory, entry);
-			const relative = prefix === "" ? entry : `${prefix}/${entry}`;
-			const info = yield* fileSystem.stat(absolute).pipe(Effect.orElseSucceed(() => void 0));
-			if (info === void 0) return "unreadable";
-			if (info.type === "Directory") {
-				const nested = yield* walk(absolute, relative, depth + 1);
-				if (nested !== null) return nested;
-				continue;
-			}
-			if (info.type !== "File") continue;
-			if (files.length >= 512) return "too-many-files";
-			const content = yield* fileSystem.readFileString(absolute).pipe(Effect.orElseSucceed(() => void 0));
-			if (content === void 0) return "unreadable";
-			if (looksBinary$1(content)) return "binary-file";
-			if (content.length > 524288) return "file-too-large";
-			files.push({
-				path: relative,
-				content
-			});
-		}
-		return null;
-	});
-	const refusal = yield* walk(root, "", 1);
-	if (refusal !== null) return { refusal };
-	if (agentAssetTotalBytes(files) > 4194304) return { refusal: "asset-too-large" };
-	return { files };
-});
-/**
-* Read every skill directory under a user-scope `skills/` root.
-*
-* A directory with no `SKILL.md` is not a skill and is skipped silently —
-* Claude Code would ignore it too, so reporting it would be noise about
-* something that was never a skill in the first place.
-*/
-const readSkillDirectory = Effect.fn("skillDirectory.readSkillDirectory")(function* (skillsRoot) {
-	const fileSystem = yield* FileSystem.FileSystem;
-	const path = yield* Path.Path;
-	const entries = yield* fileSystem.readDirectory(skillsRoot).pipe(Effect.orElseSucceed(() => []));
-	const skills = [];
-	const refused = [];
-	for (const entry of [...entries].sort()) {
-		if (isIgnoredEntry(entry)) continue;
-		const directory = path.join(skillsRoot, entry);
-		if ((yield* fileSystem.stat(directory).pipe(Effect.orElseSucceed(() => void 0)))?.type !== "Directory") continue;
-		if (!(yield* fileSystem.exists(path.join(directory, "SKILL.md")).pipe(Effect.orElseSucceed(() => false)))) continue;
-		const read = yield* readSkillFiles(directory);
-		if ("refusal" in read) {
-			refused.push({
-				name: entry,
-				reason: read.refusal
-			});
-			continue;
-		}
-		skills.push({
-			name: entry,
-			files: read.files
-		});
-	}
-	return {
-		skills,
-		refused
-	};
-});
-/**
-* Replace a skill directory with exactly the asset's files.
-*
-* Written to a sibling and then swapped, so a crash mid-write leaves the old
-* skill intact rather than half of the new one. A skill is loaded as a unit and
-* a partially written one is instructions with the middle missing, which an
-* agent will happily follow.
-*/
-const writeSkillDirectory = Effect.fn("skillDirectory.writeSkillDirectory")(function* (input) {
-	const fileSystem = yield* FileSystem.FileSystem;
-	const path = yield* Path.Path;
-	const target = path.join(input.skillsRoot, input.name);
-	const staging = path.join(input.skillsRoot, `.${input.name}.p4code-staging`);
-	yield* fileSystem.makeDirectory(input.skillsRoot, { recursive: true });
-	yield* fileSystem.remove(staging, {
-		recursive: true,
-		force: true
-	});
-	yield* fileSystem.makeDirectory(staging, { recursive: true });
-	for (const file of input.files) {
-		const destination = path.join(staging, file.path);
-		yield* fileSystem.makeDirectory(path.dirname(destination), { recursive: true });
-		yield* fileSystem.writeFileString(destination, file.content);
-	}
-	yield* fileSystem.remove(target, {
-		recursive: true,
-		force: true
-	});
-	yield* fileSystem.rename(staging, target);
-});
-const removeSkillDirectory = Effect.fn("skillDirectory.removeSkillDirectory")(function* (input) {
-	const fileSystem = yield* FileSystem.FileSystem;
-	const path = yield* Path.Path;
-	yield* fileSystem.remove(path.join(input.skillsRoot, input.name), {
-		recursive: true,
-		force: true
-	});
-});
-//#endregion
 //#region src/sync/memoryFile.ts
 /**
 * Reading and writing user-scope memory files.
@@ -17254,12 +17595,20 @@ const PROCEED = { _tag: "proceed" };
 * - A skill without `SKILL.md` would be invisible to discovery: the picker
 *   skips directories without one, so the create would look like it silently
 *   failed. Refused with the reason instead.
+* - An agent definition is one markdown file whose name is the asset's own, and
+*   anything else is invisible in the same way — the provider reads `.md` in
+*   that directory and nothing else. The frontmatter check is the writer's,
+*   because it needs a YAML parse this module deliberately does without.
 * - An existing local name is never overwritten. Create means create; editing
 *   is a different operation with a different surface.
 */
 function decideCreateLocal(input) {
 	if (input.asset.kind === "mcp") return refuse("refused", "MCP registrations are created through mcp.save, not as files.");
 	if (input.asset.kind === "skill" && !input.asset.files.some((file) => file.path === "SKILL.md")) return refuse("refused", "A skill needs a SKILL.md at its root; without one, discovery skips the directory.");
+	if (input.asset.kind === "agent") {
+		const [file, ...rest] = input.asset.files;
+		if (!input.asset.name.endsWith(".md") || rest.length > 0 || file?.path !== input.asset.name) return refuse("refused", "An agent definition is a single markdown file named after the asset, for example 'reviewer.md' holding 'reviewer.md'.");
+	}
 	if (input.localNames.has(input.asset.name)) return refuse("exists", `An asset named '${input.asset.name}' already exists locally.`);
 	return PROCEED;
 }
@@ -17444,7 +17793,7 @@ const EMPTY_REPORT = {
 	unavailable: null
 };
 var AssetSync = class extends Context.Service()("@p4code/cli/sync/AssetSync") {};
-const make$59 = Effect.gen(function* () {
+const make$60 = Effect.gen(function* () {
 	const client = yield* HubAssetClient;
 	const link = yield* HubLink;
 	const settingsStore = yield* ServerSettingsService;
@@ -17502,6 +17851,22 @@ const make$59 = Effect.gen(function* () {
 				name
 			}).pipe(Effect.ignore)
 		},
+		{
+			kind: "agent",
+			resolveRoot: Effect.gen(function* () {
+				return yield* resolveClaudeUserAgentsDir(yield* claudeHome());
+			}),
+			read: (root) => readAgentDefinitions(root),
+			write: ({ root, name, files }) => writeAgentDefinition({
+				agentsRoot: root,
+				name,
+				files
+			}),
+			remove: ({ root, name }) => removeAgentDefinition({
+				agentsRoot: root,
+				name
+			}).pipe(Effect.ignore)
+		},
 		{
 			kind: "mcp",
 			resolveRoot: Effect.succeed(path.join(config.stateDir, "mcp")),
@@ -18141,10 +18506,266 @@ const make$59 = Effect.gen(function* () {
 		removeLocal
 	};
 });
-const layer$54 = Layer.effect(AssetSync, make$59);
+const layer$55 = Layer.effect(AssetSync, make$60);
+//#endregion
+//#region src/provider/CompressPrompts.ts
+/**
+* Caveman-style response compression rulesets, adapted from the caveman
+* plugin's SKILL.md. Pre-baked per level so injection is a lookup, not a
+* runtime template. Applies to assistant prose only: code blocks, commits,
+* PRs, error strings, and safety-critical text stay uncompressed.
+*/
+const COMPRESS_SHARED_RULES = `Respond terse. All technical substance stays. Only fluff dies.
+
+## Persistence
+
+Active every response. No revert after many turns. No filler drift. Still active if unsure.
+
+## Rules
+
+Drop filler (just/really/basically/actually/simply), pleasantries (sure/certainly/of course/happy to), hedging. Short synonyms (big not extensive, fix not "implement a solution for"). No decorative tables/emoji, no dumping long raw error logs unless asked - quote shortest decisive line. Standard well-known tech acronyms OK (DB/API/HTTP); never invent new abbreviations (cfg/impl/req/res/fn) - tokenizers split them same as the full word: zero tokens saved, reader still decodes. No causal arrows (->) in prose. Technical terms exact. Code blocks unchanged. Errors quoted exact.
+
+Never drop not/never/no/only/except: flipping the meaning costs more than any token saved. Numbers and units exact.
+
+Tool calls: fire direct. No plan, no progress note between calls, never announce the next call. If the harness asks for a short lead-in before tool calls, write that one line and nothing more. Otherwise text before a call only to clarify, warn about a security or irreversible action, or resolve ambiguity.
+
+Preserve the user's dominant language: reply in the language the user writes, whatever language the examples or the surrounding context use. Compress the style, not the language. Every emitted line in that language, lead-in lines included, not just the final reply. Always keep technical terms, code, API names, CLI commands, commit-type keywords (feat/fix/...), and exact error strings verbatim unless the user explicitly asks for translation.
+
+Dropping articles applies to article languages only. Where small markers carry case or role (particles, postpositions), keep them: grammar, not filler. Compress politeness and filler instead.
+
+No self-reference. Never name or announce the style. No compressed answer plus normal recap - compressed output only. Exception: user explicitly asks what the mode is.
+
+## Auto-Clarity
+
+Drop compression and write normally when:
+- Security warnings
+- Irreversible action confirmations
+- Multi-step sequences where fragment order or omitted conjunctions risk misread
+- Compression itself creates technical ambiguity (e.g. "migrate table drop column backup first" - order unclear without articles and conjunctions)
+- User asks to clarify or repeats a question
+
+Resume compression after the clear part is done. The example below shows the format only: write the warning in the session's language, not the example's.
+
+Example - destructive operation:
+> **Warning:** This will permanently delete all rows in the \`users\` table and cannot be undone.
+> \`\`\`sql
+> DROP TABLE users;
+> \`\`\`
+> Compression resumes. Verify a backup exists first.
+
+## Boundaries
+
+Anything persisted outside the chat: write normal, uncompressed prose. Covers code, code comments, commit messages, PR and issue text, docs, memory files, and messages to third parties.`;
+const COMPRESS_RULESETS = {
+	lite: `## Response compression: lite
+
+${COMPRESS_SHARED_RULES}
+
+## Intensity: lite
+
+No filler or hedging. Keep articles and full sentences. Professional but tight.
+
+Example - "Why does my React component re-render?"
+"Your component re-renders because you create a new object reference each render. Wrap it in \`useMemo\`."
+
+Example - "Explain database connection pooling."
+"Connection pooling reuses open connections instead of creating a new one per request. Avoids repeated handshake overhead."`,
+	full: `## Response compression: full
+
+${COMPRESS_SHARED_RULES}
+
+## Intensity: full
+
+Drop articles (a/an/the), fragments OK, short synonyms. Pattern: [thing] [action] [reason]. [next step].
+
+Not: "Sure! I'd be happy to help you with that. The issue you're experiencing is likely caused by..."
+Yes: "Bug in auth middleware. Token expiry check use \`<\` not \`<=\`. Fix:"
+
+Example - "Why does my React component re-render?"
+"New object ref each render. Inline object prop = new ref = re-render. Wrap in \`useMemo\`."
+
+Example - "Explain database connection pooling."
+"Pool reuses open DB connections. No new connection per request. Skips handshake overhead."`,
+	ultra: `## Response compression: ultra
+
+${COMPRESS_SHARED_RULES}
+
+## Intensity: ultra
+
+Drop articles, fragments OK, short synonyms. Also strip conjunctions when cause-then-effect stays unambiguous. One word when one word is enough. State each fact once. Still no invented abbreviations (cfg/impl/req/res/fn/auth) and still no arrows (X -> Y): both measure as zero token saving and cost decode clarity. Code symbols, function names, API names, error strings: never touch.
+
+Example - "Why does my React component re-render?"
+"Inline object prop, new ref, re-render. \`useMemo\`."
+
+Example - "Explain database connection pooling."
+"Pool reuses open DB connections. No per-request handshake."`
+};
+const COMPRESS_TURN_REMINDERS = {
+	lite: "[response style: compressed lite - no filler/hedging, full sentences; keep negations and numbers exact; code/commits/security text normal]",
+	full: "[response style: compressed full - terse fragments, drop articles/filler; keep negations and numbers exact; code/commits/security text normal]",
+	ultra: "[response style: compressed ultra - maximum terseness, one word when enough; keep negations and numbers exact; code/commits/security text normal]"
+};
+function compressRulesetFor(mode) {
+	return mode === "off" ? void 0 : COMPRESS_RULESETS[mode];
+}
+function compressTurnReminderFor(mode) {
+	return mode === "off" ? void 0 : COMPRESS_TURN_REMINDERS[mode];
+}
+//#endregion
+//#region src/sync/agentPresets.ts
+/**
+* The row ceiling both presets impose.
+*
+* A cap rather than "be brief": an uncapped list is how a subagent turns a
+* bounded answer back into a page, and a number is the only form of that
+* instruction a model cannot negotiate with.
+*/
+const PRESET_MAX_RESULT_ROWS = 20;
+/**
+* Named `p4-*` on purpose.
+*
+* The directory is shared with whatever the user has written by hand, and
+* installing a preset must never quietly replace their own `reviewer`. The
+* prefix also makes provenance obvious in the settings list, where every kind
+* of agent definition appears in one column.
+*/
+const PRESET_NAME_PREFIX = "p4-";
+/**
+* What every preset says about what it is handed.
+*
+* Shared because it is the same contract whatever the subagent does: no
+* inherited history, exact paths, and a refusal instead of a guess. The last
+* clause is the one that earns its place — a subagent that invents the missing
+* half of an under-specified prompt returns something confident and wrong,
+* which costs more than the turn that asked for it.
+*/
+const INPUT_CONTRACT = `## What you are given
+
+You inherit no session history. The prompt is the whole of what you know: one
+request, plus whatever exact paths the orchestrator has already established.
+Treat those paths as authoritative and start from them rather than searching for
+them again.
+
+What the prompt does not say, you do not assume. If it names no request, or
+names a path that is not there, answer with the BLOCKED line below. Guessing at
+the missing half of a request produces an answer that reads as confident and is
+not checkable, which is worse than no answer.`;
+/**
+* What every preset says about the answer.
+*
+* The two sentinels matter as much as the table. Without `NONE` a clean run
+* comes back as a paragraph explaining that everything looked fine; without
+* `BLOCKED` an under-specified request comes back as an apology. Both are the
+* narrative this contract exists to remove, and both are cheap to name.
+*/
+const outputContract = (row, extra) => [
+	"## What you return",
+	"",
+	"Your final message is the result. It is the table and nothing else: no",
+	"preamble, no restatement of the request, no summary underneath it.",
+	"",
+	`One row per finding, at most ${PRESET_MAX_RESULT_ROWS}, most important first:`,
+	"",
+	`    ${row}`,
+	"",
+	"Nothing to report: the single word NONE.",
+	"Request insufficient: BLOCKED - <what is missing>, on one line.",
+	"",
+	"Paths are repository-relative and carry a line number. A row without one is",
+	"a row you have not verified: open the file and get it.",
+	...extra
+].join("\n");
+/**
+* Assemble one definition.
+*
+* The compression ruleset goes last so the contract above it is read first.
+* Both are instructions to the same model and neither overrides the other:
+* the contract fixes the shape, the ruleset fixes the prose inside it.
+*/
+const buildPreset = (input) => {
+	const name = `${PRESET_NAME_PREFIX}${input.name}`;
+	const content = [
+		"---",
+		`name: ${name}`,
+		`description: ${JSON.stringify(input.description)}`,
+		`tools: ${input.tools}`,
+		"---",
+		"",
+		input.body.trim(),
+		"",
+		compressRulesetFor("full") ?? "",
+		""
+	].join("\n");
+	const fileName = `${name}.md`;
+	return {
+		name: fileName,
+		summary: input.summary,
+		files: [{
+			path: fileName,
+			content
+		}]
+	};
+};
+/** Every preset, in the order `p4c agents presets` lists them. */
+const AGENT_PRESETS = [buildPreset({
+	name: "investigator",
+	description: "Find where something lives in the codebase. Use when the answer is a set of locations rather than a change. Returns a fixed table of path:line rows and nothing else.",
+	tools: "Read, Grep, Glob, Bash",
+	summary: "Locates code and answers with a path:line table.",
+	body: `You locate code. You do not change it, and you say no more about any location
+than the one clause that explains why it is in the list.
+
+${INPUT_CONTRACT}
+
+${outputContract("path:line - symbol - one clause on why it matters", [
+		"",
+		"Symbol is the function, type or constant the line belongs to, not a paraphrase",
+		"of the line. Where there is genuinely no symbol, name the block: a route table,",
+		"a config literal."
+	])}`
+}), buildPreset({
+	name: "reviewer",
+	description: "Review named files or a diff for defects. Use when the answer is a list of findings rather than a change. Returns a fixed table of path:line findings and nothing else.",
+	tools: "Read, Grep, Glob, Bash",
+	summary: "Reviews named files and answers with a severity-tagged finding table.",
+	body: `You review code you did not write. You do not change it, and you do not report
+what it does well - the orchestrator asked what is wrong, and a list padded with
+approval is a list that has to be re-read to find the three rows that matter.
+
+${INPUT_CONTRACT}
+
+${outputContract("path:line - severity - what is wrong, and what it breaks", [
+		"",
+		"Severity is one of three words:",
+		"",
+		"    bug   - wrong behaviour reachable in ordinary use. Name the input that reaches it.",
+		"    risk  - correct today, and depends on something the code does not state.",
+		"    nit   - style or clarity. Include only when the file is otherwise clean.",
+		"",
+		"A finding you cannot reach with a concrete input is a risk, not a bug. Saying",
+		"so is what keeps the bug rows worth reading."
+	])}`
+})];
+/**
+* Look one up by the name someone typed.
+*
+* Both spellings are accepted - `investigator` and `p4-investigator.md` - because
+* the listing shows the filename and the sentence people write is the bare word,
+* and refusing one of the two would be refusing whichever the person happened to
+* read most recently.
+*/
+const findAgentPreset = (requested) => {
+	const wanted = requested.trim().toLowerCase();
+	if (wanted.length === 0) return void 0;
+	return AGENT_PRESETS.find((preset) => {
+		const fileName = preset.name.toLowerCase();
+		const bare = fileName.slice(3, -3);
+		return wanted === fileName || wanted === bare || wanted === `${PRESET_NAME_PREFIX}${bare}`;
+	});
+};
 //#endregion
 //#region src/cli/assets.ts
-const SyncServicesLive = layer$54.pipe(Layer.provideMerge(layer$55), Layer.provideMerge(layer$56), Layer.provideMerge(layer$60.pipe(Layer.provide(layer$67))), Layer.provideMerge(layer$67), Layer.provideMerge(FetchHttpClient.layer));
+const SyncServicesLive = layer$55.pipe(Layer.provideMerge(layer$56), Layer.provideMerge(layer$57), Layer.provideMerge(layer$61.pipe(Layer.provide(layer$68))), Layer.provideMerge(layer$68), Layer.provideMerge(FetchHttpClient.layer));
 const runWithSync = (flags, run) => Effect.gen(function* () {
 	const config = yield* resolveCliAuthConfig(flags, yield* GlobalFlag.LogLevel);
 	return yield* Effect.gen(function* () {
@@ -18152,7 +18773,7 @@ const runWithSync = (flags, run) => Effect.gen(function* () {
 			sync: yield* AssetSync,
 			link: yield* HubLink
 		});
-	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$70(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
+	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$71(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
 });
 const STATE_LABEL = {
 	synced: "synced",
@@ -18186,6 +18807,14 @@ const MCP_WORDS = {
 	rootLabel: "MCP",
 	nameDescription: "Registration filename, for example linear.json."
 };
+const AGENT_WORDS = {
+	kind: "agent",
+	command: "agents",
+	singular: "agent definition",
+	plural: "agent definitions",
+	rootLabel: "Agents",
+	nameDescription: "Definition filename, for example p4-reviewer.md."
+};
 const rootFor = (status, kind) => status.roots.find((root) => root.kind === kind)?.path ?? null;
 /**
 * Exported for tests. These two are the only place a wrong report becomes a
@@ -18248,7 +18877,8 @@ const formatReport = (report) => {
 const ALL_WORDS = [
 	SKILL_WORDS,
 	MEMORY_WORDS,
-	MCP_WORDS
+	MCP_WORDS,
+	AGENT_WORDS
 ];
 /**
 * The whole picture, in one page.
@@ -18380,6 +19010,67 @@ const makeAssetCommands = (words) => {
 const skillCommands = makeAssetCommands(SKILL_WORDS);
 const memoryCommands = makeAssetCommands(MEMORY_WORDS);
 const mcpCommands = makeAssetCommands(MCP_WORDS);
+const agentCommands = makeAssetCommands(AGENT_WORDS);
+/**
+* What one install attempt did, in a sentence.
+*
+* Exported for tests: `exists` in particular must never read as success. The
+* whole point of refusing to overwrite is that someone who has edited a preset
+* keeps their edits, and a line saying "installed" would tell them the opposite.
+*/
+const formatPresetInstall = (input) => {
+	if (input.outcome === "created") return `Installed ${input.name}${input.path === null ? "" : ` at ${input.path}`}`;
+	if (input.outcome === "exists") return `Skipped ${input.name}: it already exists here, and installing would overwrite your copy.`;
+	return `Could not install ${input.name}: ${input.detail ?? input.outcome}`;
+};
+/**
+* `p4c agents presets` — what is on offer, before anything is written.
+*
+* Its own command rather than a flag on `install`, because reading the list is
+* what people do first and a listing that requires naming an install target is
+* not a listing.
+*/
+const presetsCommand = Command.make("presets", { ...authLocationFlags }).pipe(Command.withDescription("List the agent definitions p4code ships, without installing any."), Command.withHandler(() => Console.log([
+	...AGENT_PRESETS.map((preset) => `  ${preset.name.padEnd(28)} ${preset.summary}`),
+	"",
+	"Install one with:  p4c agents install <name>"
+].join("\n"))));
+/**
+* Install a shipped definition onto this machine, and only this machine.
+*
+* `createLocal` rather than a hub write, so an installed preset starts out
+* exactly like one written by hand: local, unmanaged, and shared only when
+* something explicitly publishes it. It also means this works with no hub
+* configured, which is when a fresh machine most wants it.
+*/
+const presetInstallCommand = Command.make("install", {
+	...authLocationFlags,
+	name: Argument.string("name").pipe(Argument.withDescription("Preset to install, for example investigator."), Argument.optional),
+	all: Flag.boolean("all").pipe(Flag.withDescription("Install every preset p4code ships."))
+}).pipe(Command.withDescription("Install a p4code agent definition into this machine's agents directory."), Command.withHandler((flags) => runWithSync(flags, ({ sync }) => Effect.gen(function* () {
+	const requested = Option.getOrUndefined(flags.name);
+	if (!flags.all && requested === void 0) return yield* Console.error("Name a preset, or pass --all to install every one.\nSee them with:  p4c agents presets");
+	const chosen = flags.all ? AGENT_PRESETS : (() => {
+		const found = findAgentPreset(requested ?? "");
+		return found === void 0 ? [] : [found];
+	})();
+	if (chosen.length === 0) return yield* Console.error(`No preset named ${requested ?? ""}. See them with:  p4c agents presets`);
+	const lines = [];
+	for (const preset of chosen) {
+		const result = yield* sync.createLocal({
+			kind: AGENT_WORDS.kind,
+			name: preset.name,
+			files: preset.files
+		});
+		lines.push(formatPresetInstall({
+			name: preset.name,
+			outcome: result.outcome,
+			path: result.path,
+			detail: result.detail
+		}));
+	}
+	return yield* Console.log(lines.join("\n"));
+}))));
 const shareAllCommand = Command.make("share-all", { ...authLocationFlags }).pipe(Command.withDescription("Share everything, including new items, automatically. The default."), Command.withHandler((flags) => runWithSync(flags, ({ sync, link }) => Effect.gen(function* () {
 	yield* link.setShareMode("all");
 	yield* Console.log(formatStatus(yield* sync.status));
@@ -18432,6 +19123,23 @@ const mcpCommand = Command.make("mcp", {}).pipe(Command.withDescription("Share M
 	mcpCommands.showCommand,
 	mcpCommands.removeCommand
 ]));
+/**
+* `p4c agents` — the subagent definitions this machine runs.
+*
+* The same six subcommands every kind gets, plus the two that are particular to
+* this one: p4code ships definitions, and a definition is the only place a
+* subagent's input and output contract can be stated.
+*/
+const agentsCommand = Command.make("agents", {}).pipe(Command.withDescription("Share subagent definitions across your machines, and install p4code's."), Command.withSubcommands([
+	agentCommands.statusCommand,
+	agentCommands.syncCommand,
+	agentCommands.publishCommand,
+	agentCommands.unpublishCommand,
+	agentCommands.showCommand,
+	agentCommands.removeCommand,
+	presetsCommand,
+	presetInstallCommand
+]));
 /** Exported for the hub command, which owns `connect`/`disconnect`. */
 const hubLinkCommands = [hubConnectCommand, hubDisconnectCommand];
 //#endregion
@@ -23417,12 +24125,12 @@ const runProcessCore = Effect.fn("processRunner.runProcessCore")(function* (spaw
 		stderrTruncated: stderr.truncated
 	};
 });
-const make$58 = Effect.fn("ProcessRunner.make")(function* () {
+const make$59 = Effect.fn("ProcessRunner.make")(function* () {
 	const spawner = yield* ChildProcessSpawner$1.ChildProcessSpawner;
 	const run = (input) => finalizeRunProcess(runProcessCore(spawner, input), input);
 	return ProcessRunner.of({ run });
 });
-const layer$53 = Layer.effect(ProcessRunner, make$58());
+const layer$54 = Layer.effect(ProcessRunner, make$59());
 //#endregion
 //#region src/project/RepositoryIdentityResolver.ts
 const DEFAULT_REPOSITORY_IDENTITY_CACHE_CAPACITY = 512;
@@ -23513,7 +24221,7 @@ const resolveRepositoryIdentityFromCacheKey = Effect.fn("RepositoryIdentityResol
 		rootPath: cacheKey
 	}) : null;
 });
-const make$57 = Effect.fn("RepositoryIdentityResolver.make")(function* (options = {}) {
+const make$58 = Effect.fn("RepositoryIdentityResolver.make")(function* (options = {}) {
 	const processRunner = yield* ProcessRunner;
 	const repositoryIdentityCache = yield* Cache.makeWith((cacheKey) => resolveRepositoryIdentityFromCacheKey(cacheKey).pipe(Effect.provideService(ProcessRunner, processRunner)), {
 		capacity: options.cacheCapacity ?? DEFAULT_REPOSITORY_IDENTITY_CACHE_CAPACITY,
@@ -23528,7 +24236,7 @@ const make$57 = Effect.fn("RepositoryIdentityResolver.make")(function* (options
 	});
 	return RepositoryIdentityResolver.of({ resolve });
 });
-const layer$52 = Layer.effect(RepositoryIdentityResolver, make$57()).pipe(Layer.provide(layer$53));
+const layer$53 = Layer.effect(RepositoryIdentityResolver, make$58()).pipe(Layer.provide(layer$54));
 //#endregion
 //#region src/orchestration/Layers/ProjectionSnapshotQuery.ts
 const decodeReadModel = Schema$1.decodeUnknownEffect(OrchestrationReadModel);
@@ -25348,7 +26056,7 @@ function mergeWithDefaultKeybindings(custom) {
 * Keybindings - Service tag for keybinding configuration operations.
 */
 var Keybindings = class extends Context.Service()("@p4code/cli/keybindings") {};
-const make$56 = Effect.gen(function* () {
+const make$57 = Effect.gen(function* () {
 	const { keybindingsConfigPath } = yield* ServerConfig$1;
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -25609,7 +26317,7 @@ const make$56 = Effect.gen(function* () {
 		}))
 	};
 });
-const layer$51 = Layer.effect(Keybindings, make$56);
+const layer$52 = Layer.effect(Keybindings, make$57);
 //#endregion
 //#region src/process/externalLauncher.ts
 /**
@@ -25836,7 +26544,7 @@ const launchEditorProcess = Effect.fn("externalLauncher.launchEditorProcess")(fu
 		cause
 	}));
 });
-const make$55 = Effect.gen(function* () {
+const make$56 = Effect.gen(function* () {
 	const spawner = yield* ChildProcessSpawner$1.ChildProcessSpawner;
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -25847,7 +26555,7 @@ const make$55 = Effect.gen(function* () {
 		launchEditor: (input) => provideCommandResolutionServices(Effect.flatMap(resolveEditorLaunch(input), (launch) => launchEditorProcess(launch).pipe(Effect.provideService(ChildProcessSpawner$1.ChildProcessSpawner, spawner))))
 	});
 });
-const layer$50 = Layer.effect(ExternalLauncher, make$55);
+const layer$51 = Layer.effect(ExternalLauncher, make$56);
 //#endregion
 //#region src/orchestration/Services/OrchestrationReactor.ts
 /**
@@ -25865,7 +26573,7 @@ var OrchestrationReactor = class extends Context.Service()("@p4code/cli/orchestr
 //#endregion
 //#region src/serverLifecycleEvents.ts
 var ServerLifecycleEvents = class extends Context.Service()("@p4code/cli/serverLifecycleEvents") {};
-const make$54 = Effect.gen(function* () {
+const make$55 = Effect.gen(function* () {
 	const pubsub = yield* PubSub.unbounded();
 	const state = yield* Ref.make({
 		sequence: 0,
@@ -25889,7 +26597,7 @@ const make$54 = Effect.gen(function* () {
 		}
 	};
 });
-const layer$49 = Layer.effect(ServerLifecycleEvents, make$54);
+const layer$50 = Layer.effect(ServerLifecycleEvents, make$55);
 //#endregion
 //#region src/telemetry/Identify.ts
 const CodexAuthJsonSchema = Schema$1.Struct({ tokens: Schema$1.Struct({ account_id: Schema$1.String }) });
@@ -26062,7 +26770,7 @@ var AnalyticsService = class AnalyticsService extends Context.Service()("@p4code
 	/** No-op layer for callers that intentionally disable telemetry. */
 	static layerTest = Layer.succeed(AnalyticsService, inert);
 };
-const make$53 = Effect.gen(function* () {
+const make$54 = Effect.gen(function* () {
 	const telemetryConfig = yield* TelemetryEnvConfig;
 	const posthogKey = telemetryConfig.posthogKey.trim();
 	if (!telemetryConfig.enabled || posthogKey === "") return inert;
@@ -26132,7 +26840,7 @@ const make$53 = Effect.gen(function* () {
 		flush
 	});
 });
-const layer$48 = Layer.effect(AnalyticsService, make$53);
+const layer$49 = Layer.effect(AnalyticsService, make$54);
 AnalyticsService.layerTest;
 //#endregion
 //#region src/service/pinnedRuntime.ts
@@ -26479,7 +27187,7 @@ var BootServiceInstallError = class extends Schema$1.TaggedErrorClass()("BootSer
 	}
 };
 var BootService = class extends Context.Service()("@p4code/cli/service/bootService") {};
-const make$52 = Effect.fn("cloud.boot_service.make")(function* (input) {
+const make$53 = Effect.fn("cloud.boot_service.make")(function* (input) {
 	const hostExecPath = yield* HostProcessExecutablePath;
 	const hostArguments = yield* HostProcessArguments;
 	const host = input.host ?? {
@@ -26698,7 +27406,7 @@ const make$52 = Effect.fn("cloud.boot_service.make")(function* (input) {
 		logPath
 	});
 });
-const layer$47 = (input) => Layer.effect(BootService, make$52(input));
+const layer$48 = (input) => Layer.effect(BootService, make$53(input));
 //#endregion
 //#region src/service/selfUpdate.ts
 /**
@@ -26773,7 +27481,7 @@ const resolveServerSelfUpdateCapability = Effect.fn("cloud.server_self_update.re
 	return null;
 });
 var ServerSelfUpdate = class extends Context.Service()("@p4code/cli/service/selfUpdate/ServerSelfUpdate") {};
-const make$51 = Effect.fn("cloud.server_self_update.make")(function* (options) {
+const make$52 = Effect.fn("cloud.server_self_update.make")(function* (options) {
 	const serverConfig = yield* ServerConfig$1;
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -26923,7 +27631,7 @@ const make$51 = Effect.fn("cloud.server_self_update.make")(function* (options) {
 	});
 	return ServerSelfUpdate.of({ update });
 });
-const layer$46 = Layer.effect(ServerSelfUpdate, make$51()).pipe(Layer.provide(layer$53));
+const layer$47 = Layer.effect(ServerSelfUpdate, make$52()).pipe(Layer.provide(layer$54));
 //#endregion
 //#region src/environment/ServerEnvironmentLabel.ts
 const ServerEnvironmentLabelCommandProbe = Schema$1.Literals(["macos-computer-name", "linux-pretty-hostname"]);
@@ -27055,7 +27763,7 @@ function platformArch(architecture) {
 		default: return "other";
 	}
 }
-const make$50 = Effect.gen(function* () {
+const make$51 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const serverConfig = yield* ServerConfig$1;
@@ -27118,7 +27826,7 @@ const make$50 = Effect.gen(function* () {
 * state. It intentionally has no fallback Layer.succeed value: callers must
 * provide the external platform services and a ServerConfig.
 */
-const layer$45 = Layer.effect(ServerEnvironment, make$50).pipe(Layer.provide(layer$53));
+const layer$46 = Layer.effect(ServerEnvironment, make$51).pipe(Layer.provide(layer$54));
 //#endregion
 //#region src/provider/Services/ProviderSessionReaper.ts
 var ProviderSessionReaper = class extends Context.Service()("@p4code/cli/provider/Services/ProviderSessionReaper") {};
@@ -28195,7 +28903,7 @@ const maybeOpenBrowser = (target) => Effect.gen(function* () {
 	yield* (yield* ExternalLauncher).launchBrowser(target).pipe(Effect.catch(() => Effect.logInfo("browser auto-open unavailable", { hint: `Open ${target} in your browser.` })));
 });
 const runStartupPhase = (phase, effect) => effect.pipe(Effect.annotateSpans({ "startup.phase": phase }), Effect.withSpan(`server.startup.${phase}`));
-const make$49 = Effect.gen(function* () {
+const make$50 = Effect.gen(function* () {
 	const serverConfig = yield* ServerConfig$1;
 	const keybindings = yield* Keybindings;
 	const orchestrationReactor = yield* OrchestrationReactor;
@@ -28336,7 +29044,7 @@ const make$49 = Effect.gen(function* () {
 		enqueueCommand: commandGate.enqueueCommand
 	};
 });
-const layer$44 = Layer.effect(ServerRuntimeStartup, make$49);
+const layer$45 = Layer.effect(ServerRuntimeStartup, make$50);
 //#endregion
 //#region src/serverRuntimeState.ts
 const PersistedServerRuntimeState = Schema$1.Struct({
@@ -28484,7 +29192,7 @@ function expandHomePath$2(input, path) {
 	if (input.startsWith("~/") || input.startsWith("~\\")) return path.join(NodeOS.homedir(), input.slice(2));
 	return input;
 }
-const make$48 = Effect.gen(function* () {
+const make$49 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const statWorkspaceRoot = Effect.fn("WorkspacePaths.statWorkspaceRoot")(function* (workspaceRoot, normalizedWorkspaceRoot, phase) {
@@ -28541,7 +29249,7 @@ const make$48 = Effect.gen(function* () {
 		resolveRelativePathWithinRoot
 	});
 });
-const layer$43 = Layer.effect(WorkspacePaths, make$48);
+const layer$44 = Layer.effect(WorkspacePaths, make$49);
 //#endregion
 //#region src/cli/project.ts
 const isEnvironmentHttpCommonError = Schema$1.is(EnvironmentHttpCommonError);
@@ -28647,7 +29355,7 @@ const projectCommandUuid = Crypto.Crypto.pipe(Effect.flatMap((crypto) => crypto.
 	operation: "generateProjectCommandId",
 	cause
 })));
-const ProjectCliRuntimeLive = Layer.mergeAll(layer$43, OrchestrationLayerLive.pipe(Layer.provideMerge(layer$52), Layer.provideMerge(layerConfig)));
+const ProjectCliRuntimeLive = Layer.mergeAll(layer$44, OrchestrationLayerLive.pipe(Layer.provideMerge(layer$53), Layer.provideMerge(layerConfig)));
 const PROJECT_CLI_LIVE_SERVER_TIMEOUT = Duration.seconds(1);
 const withProjectCliSessionToken = (environmentAuth, run) => Effect.acquireUseRelease(environmentAuth.issueSession({
 	scopes: AuthAdministrativeScopes,
@@ -28738,7 +29446,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}));
-		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$70(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
+		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$71(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
 		return yield* Effect.gen(function* () {
 			const snapshot = yield* getOfflineSnapshot();
 			const orchestrationEngine = yield* OrchestrationEngineService;
@@ -28749,7 +29457,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}).pipe(Effect.provide(offlineRuntimeLayer));
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$43).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$70(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$44).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$71(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const projectAddCommand = Command.make("add", {
 	...projectLocationFlags,
@@ -29356,7 +30064,7 @@ const logP4ProjectFileLoadError = (error) => Effect.logWarning(error).pipe(Effec
 	filePath: error.filePath,
 	errorTag: error._tag
 }));
-const make$47 = Effect.gen(function* () {
+const make$48 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const load = Effect.fn("P4ProjectFileLoader.load")(function* (workspaceRoot) {
@@ -29377,7 +30085,7 @@ const make$47 = Effect.gen(function* () {
 	});
 	return P4ProjectFileLoader.of({ load });
 });
-const layer$42 = Layer.effect(P4ProjectFileLoader, make$47);
+const layer$43 = Layer.effect(P4ProjectFileLoader, make$48);
 //#endregion
 //#region src/project/ProjectFaviconResolver.ts
 /**
@@ -29448,7 +30156,7 @@ function extractIconHref(source) {
 	return null;
 }
 const optionOnNotFound$1 = (effect) => effect.pipe(Effect.map(Option.some), Effect.catchTags({ PlatformError: (error) => error.reason._tag === "NotFound" ? Effect.succeed(Option.none()) : Effect.fail(error) }));
-const make$46 = Effect.gen(function* () {
+const make$47 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const workspacePaths = yield* WorkspacePaths;
@@ -29517,7 +30225,7 @@ const make$46 = Effect.gen(function* () {
 	});
 	return ProjectFaviconResolver.of({ resolvePath });
 });
-const layer$41 = Layer.effect(ProjectFaviconResolver, make$46);
+const layer$42 = Layer.effect(ProjectFaviconResolver, make$47);
 //#endregion
 //#region src/assets/AssetAccess.ts
 const ASSET_ROUTE_PREFIX = "/api/assets";
@@ -29770,10 +30478,10 @@ const resolveAsset = Effect.fn("AssetAccess.resolveAsset")(function* (token, rel
 //#endregion
 //#region src/observability/BrowserTraceCollector.ts
 var BrowserTraceCollector = class extends Context.Service()("@p4code/cli/observability/BrowserTraceCollector") {};
-const make$45 = (sink) => BrowserTraceCollector.of({ record: (records) => Effect.sync(() => {
+const make$46 = (sink) => BrowserTraceCollector.of({ record: (records) => Effect.sync(() => {
 	for (const record of records) sink.push(record);
 }) });
-const layer$40 = (sink) => Layer.succeed(BrowserTraceCollector, make$45(sink));
+const layer$41 = (sink) => Layer.succeed(BrowserTraceCollector, make$46(sink));
 //#endregion
 //#region src/auth/http.ts
 const CREDENTIAL_RESPONSE_HEADERS = {
@@ -30736,7 +31444,7 @@ const NESTED_PAYLOAD_KEYS = [
 	"operations"
 ];
 const MAX_COLLECT_DEPTH = 4;
-function asRecord$3(value) {
+function asRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 function pushChangedFilePath(target, value) {
@@ -30751,7 +31459,7 @@ function collectChangedFilePaths(value, target, depth) {
 		for (const entry of value) collectChangedFilePaths(entry, target, depth + 1);
 		return;
 	}
-	const record = asRecord$3(value);
+	const record = asRecord$4(value);
 	if (!record) return;
 	for (const field of CHANGED_FILE_FIELDS) pushChangedFilePath(target, record[field]);
 	for (const nestedKey of NESTED_PAYLOAD_KEYS) if (nestedKey in record) collectChangedFilePaths(record[nestedKey], target, depth + 1);
@@ -30762,7 +31470,7 @@ function collectChangedFilePaths(value, target, depth) {
 */
 function collectActivityChangedFilePaths(payload) {
 	const target = /* @__PURE__ */ new Set();
-	collectChangedFilePaths(asRecord$3(asRecord$3(payload)?.data), target, 0);
+	collectChangedFilePaths(asRecord$4(asRecord$4(payload)?.data), target, 0);
 	return target;
 }
 /**
@@ -32667,7 +33375,7 @@ const classifyNonZeroExit = (command, stderr) => {
 	if (command === "gh" && (normalized.includes("could not resolve to a pullrequest") || normalized.includes("repository.pullrequest") || normalized.includes("no pull requests found for branch") || normalized.includes("pull request not found")) || command === "glab" && (normalized.includes("merge request not found") || normalized.includes("not found") || normalized.includes("404")) || command === "az" && normalized.includes("pull request") && (normalized.includes("not found") || normalized.includes("does not exist"))) return "not-found";
 	return "command-failed";
 };
-const make$44 = Effect.gen(function* () {
+const make$45 = Effect.gen(function* () {
 	const processRunner = yield* ProcessRunner;
 	const run = Effect.fn("VcsProcess.run")(function* (input) {
 		const baseError = {
@@ -32724,7 +33432,7 @@ const make$44 = Effect.gen(function* () {
 	});
 	return VcsProcess.of({ run });
 });
-const layer$39 = Layer.effect(VcsProcess, make$44).pipe(Layer.provide(layer$53));
+const layer$40 = Layer.effect(VcsProcess, make$45).pipe(Layer.provide(layer$54));
 //#endregion
 //#region src/vcs/VcsDriver.ts
 var VcsDriver = class extends Context.Service()("@p4code/cli/vcs/VcsDriver") {};
@@ -33175,12 +33883,12 @@ const makeVcsDriver = Effect.gen(function* () {
 	const driver = yield* makeVcsDriverShape();
 	return VcsDriver.of(driver);
 });
-const make$43 = Effect.gen(function* () {
+const make$44 = Effect.gen(function* () {
 	const git = yield* makeGitVcsDriverCore();
 	return GitVcsDriver.of(git);
 });
 Layer.effect(VcsDriver, makeVcsDriver);
-const layer$38 = Layer.effect(GitVcsDriver, make$43);
+const layer$39 = Layer.effect(GitVcsDriver, make$44);
 //#endregion
 //#region src/vcs/VcsProjectConfig.ts
 const ProjectVcsConfigJson = fromLenientJson(Schema$1.Struct({
@@ -33212,7 +33920,7 @@ const logVcsProjectConfigError = (error) => Effect.logWarning(error).pipe(Effect
 	configPath: error.configPath,
 	errorTag: error._tag
 }));
-const make$42 = Effect.gen(function* () {
+const make$43 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const findConfigPath = Effect.fn("VcsProjectConfig.findConfigPath")(function* (cwd) {
@@ -33253,7 +33961,7 @@ const make$42 = Effect.gen(function* () {
 	});
 	return VcsProjectConfig.of({ resolveKind });
 });
-const layer$37 = Layer.effect(VcsProjectConfig, make$42);
+const layer$38 = Layer.effect(VcsProjectConfig, make$43);
 //#endregion
 //#region src/vcs/VcsDriverRegistry.ts
 const DETECTION_CACHE_CAPACITY = 2048;
@@ -33273,7 +33981,7 @@ function parseDetectionCacheKey(key) {
 		cwd: key.slice(separatorIndex + 1)
 	};
 }
-const make$41 = Effect.gen(function* () {
+const make$42 = Effect.gen(function* () {
 	const projectConfig = yield* VcsProjectConfig;
 	const git = yield* makeVcsDriver;
 	const drivers = { git };
@@ -33330,7 +34038,7 @@ const make$41 = Effect.gen(function* () {
 		resolve
 	});
 });
-const layer$36 = Layer.effect(VcsDriverRegistry, make$41).pipe(Layer.provide(layer$37));
+const layer$37 = Layer.effect(VcsDriverRegistry, make$42).pipe(Layer.provide(layer$38));
 //#endregion
 //#region src/checkpointing/CheckpointStore.ts
 /**
@@ -33350,7 +34058,7 @@ const layer$36 = Layer.effect(VcsDriverRegistry, make$41).pipe(Layer.provide(lay
 */
 /** Service tag for checkpoint persistence and restore operations. */
 var CheckpointStore = class extends Context.Service()("@p4code/cli/checkpointing/CheckpointStore") {};
-const make$40 = Effect.gen(function* () {
+const make$41 = Effect.gen(function* () {
 	const vcsRegistry = yield* VcsDriverRegistry;
 	const resolveCheckpoints = Effect.fn("CheckpointStore.resolveCheckpoints")(function* (operation, cwd) {
 		const handle = yield* vcsRegistry.resolve({ cwd });
@@ -33389,7 +34097,7 @@ const make$40 = Effect.gen(function* () {
 		deleteCheckpointRefs
 	});
 });
-const layer$35 = Layer.effect(CheckpointStore, make$40);
+const layer$36 = Layer.effect(CheckpointStore, make$41);
 //#endregion
 //#region src/checkpointing/CheckpointDiffQuery.ts
 /**
@@ -33411,7 +34119,7 @@ function buildTurnDiffResult(input, diff) {
 		diff
 	};
 }
-const make$39 = Effect.gen(function* () {
+const make$40 = Effect.gen(function* () {
 	const projectionSnapshotQuery = yield* ProjectionSnapshotQuery;
 	const checkpointStore = yield* CheckpointStore;
 	const threadActivities = yield* ProjectionThreadActivityRepository;
@@ -33577,7 +34285,7 @@ const make$39 = Effect.gen(function* () {
 		getFullThreadDiff
 	});
 });
-const layer$34 = Layer.effect(CheckpointDiffQuery, make$39);
+const layer$35 = Layer.effect(CheckpointDiffQuery, make$40);
 //#endregion
 //#region ../../packages/shared/src/toolCategory.ts
 const TOOL_CATEGORY_TITLES = {
@@ -33846,22 +34554,22 @@ function classifyToolCategory(input) {
 	if (normalized.includes("image")) return "image_view";
 	return "tool";
 }
-function asRecord$2(value) {
+function asRecord$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 /** Classify from a runtime item payload's `data` (`{ toolName, input }`). */
 function classifyToolCategoryFromToolData(data) {
-	const record = asRecord$2(data);
+	const record = asRecord$3(data);
 	const toolName = record?.toolName;
 	if (typeof toolName !== "string" || toolName.trim().length === 0) return;
 	return classifyToolCategory({
 		toolName,
-		toolInput: asRecord$2(record?.input)
+		toolInput: asRecord$3(record?.input)
 	});
 }
 //#endregion
 //#region src/orchestration/ActivityPayloadProjection.ts
-function asRecord$1(value) {
+function asRecord$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asTrimmedString$1(value) {
@@ -33884,7 +34592,7 @@ function collectChangedFiles(value, target, seen, depth) {
 		}
 		return;
 	}
-	const record = asRecord$1(value);
+	const record = asRecord$2(value);
 	if (!record) return;
 	pushChangedFile(target, seen, record.path);
 	pushChangedFile(target, seen, record.filePath);
@@ -33910,13 +34618,13 @@ function collectChangedFiles(value, target, seen, depth) {
 	}
 }
 function projectCommandData(data) {
-	const item = asRecord$1(data.item);
+	const item = asRecord$2(data.item);
 	if (!item) return;
 	const projectedItem = {};
 	if ("command" in item) projectedItem.command = item.command;
-	const input = asRecord$1(item.input);
+	const input = asRecord$2(item.input);
 	if (input && "command" in input) projectedItem.input = { command: input.command };
-	const result = asRecord$1(item.result);
+	const result = asRecord$2(item.result);
 	if (result && "command" in result) projectedItem.result = { command: result.command };
 	return Object.keys(projectedItem).length > 0 ? projectedItem : void 0;
 }
@@ -33932,7 +34640,7 @@ function summarizeToolTextOutput(value) {
 	return null;
 }
 function projectRawOutput(value) {
-	const rawOutput = asRecord$1(value);
+	const rawOutput = asRecord$2(value);
 	if (!rawOutput) return;
 	if (typeof rawOutput.totalFiles === "number" && Number.isFinite(rawOutput.totalFiles)) return {
 		totalFiles: rawOutput.totalFiles,
@@ -33954,14 +34662,14 @@ function projectRawOutput(value) {
 * the full payload in persistence and the event store.
 */
 function projectActivityPayload(activity) {
-	const payload = asRecord$1(activity.payload);
-	const data = asRecord$1(payload?.data);
+	const payload = asRecord$2(activity.payload);
+	const data = asRecord$2(payload?.data);
 	if (!payload || !data || payload.itemType === "mcp_tool_call") return activity;
 	const projectedData = {};
 	const item = projectCommandData(data);
 	if (item) projectedData.item = item;
 	if ("command" in data) projectedData.command = data.command;
-	const input = asRecord$1(data.input);
+	const input = asRecord$2(data.input);
 	if (input && "command" in input) projectedData.input = { command: input.command };
 	const changedFiles = [];
 	collectChangedFiles(data, changedFiles, /* @__PURE__ */ new Set(), 0);
@@ -33988,7 +34696,7 @@ function projectActivityPayload(activity) {
 */
 function isResolvableContextWindowActivity(activity) {
 	if (activity.kind !== "context-window.updated") return false;
-	const usedTokens = asRecord$1(activity.payload)?.usedTokens;
+	const usedTokens = asRecord$2(activity.payload)?.usedTokens;
 	return typeof usedTokens === "number" && Number.isFinite(usedTokens) && usedTokens >= 0;
 }
 /**
@@ -34004,7 +34712,7 @@ function isResolvableContextWindowActivity(activity) {
 * client.
 */
 function withoutContextWindowBreakdown$1(activity) {
-	const payload = asRecord$1(activity.payload);
+	const payload = asRecord$2(activity.payload);
 	if (!payload || payload.breakdown === void 0) return activity;
 	const { breakdown: _breakdown, ...rest } = payload;
 	return {
@@ -34019,7 +34727,7 @@ function dropStaleContextWindowActivities(activities) {
 	const retainedIndexes = new Set(latestIndexByTurn.values());
 	let breakdownIndex = null;
 	for (const index of retainedIndexes) {
-		if (asRecord$1(activities[index].payload)?.breakdown === void 0) continue;
+		if (asRecord$2(activities[index].payload)?.breakdown === void 0) continue;
 		if (breakdownIndex === null || index > breakdownIndex) breakdownIndex = index;
 	}
 	return activities.flatMap((activity, index) => {
@@ -34147,6 +34855,7 @@ const buildTaskRow = (input, taskId, timestamp, repositoryKey = null) => ({
 	projectId: input.projectId ?? null,
 	repositoryKey: repositoryKey ?? input.repositoryKey ?? null,
 	threadId: input.threadId ?? null,
+	externalRef: input.externalRef ?? null,
 	title: input.title,
 	body: input.body ?? "",
 	status: input.status ?? "backlog",
@@ -34739,7 +35448,7 @@ function makeUpdateState(input) {
 		output: input.output ?? null
 	};
 }
-const make$38 = Effect.fn("ProviderMaintenanceRunner.make")(function* () {
+const make$39 = Effect.fn("ProviderMaintenanceRunner.make")(function* () {
 	const providerRegistry = yield* ProviderRegistry;
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
 	const httpClient = yield* HttpClient.HttpClient;
@@ -34854,7 +35563,7 @@ const make$38 = Effect.fn("ProviderMaintenanceRunner.make")(function* () {
 	});
 	return ProviderMaintenanceRunner.of({ updateProvider });
 });
-const layer$33 = Layer.effect(ProviderMaintenanceRunner, make$38());
+const layer$34 = Layer.effect(ProviderMaintenanceRunner, make$39());
 //#endregion
 //#region src/provider/Services/ProviderInstanceRegistry.ts
 var ProviderInstanceRegistry = class extends Context.Service()("@p4code/cli/provider/Services/ProviderInstanceRegistry") {};
@@ -34878,11 +35587,11 @@ const makeTextGenerationFromRegistry = (registry) => TextGeneration.of({
 		detail: "This provider does not report account usage."
 	}))))
 });
-const make$37 = Effect.gen(function* () {
+const make$38 = Effect.gen(function* () {
 	const registry = yield* ProviderInstanceRegistry;
 	return makeTextGenerationFromRegistry(registry);
 });
-const layer$32 = Layer.effect(TextGeneration, make$37);
+const layer$33 = Layer.effect(TextGeneration, make$38);
 const SKILL_MANIFEST_FILENAME = "SKILL.md";
 /**
 * Split a catalogue id (`owner/repo/skill-name`) into its parts.
@@ -34991,7 +35700,7 @@ function toAssetFilePath(repositoryPath, root) {
 const REGISTRY_SEARCH_URL = "https://www.skills.sh/api/search";
 const GITHUB_API_URL = "https://api.github.com";
 const GITHUB_RAW_URL = "https://raw.githubusercontent.com";
-const REQUEST_TIMEOUT_MS = 15e3;
+const REQUEST_TIMEOUT_MS$1 = 15e3;
 /** More than a person reads, few enough that the panel is a list and not a feed. */
 const MAX_SEARCH_RESULTS = 25;
 /**
@@ -35028,10 +35737,10 @@ const emptyFetch = (id, unavailable) => ({
 	skipped: [],
 	unavailable
 });
-const make$36 = Effect.gen(function* () {
+const make$37 = Effect.gen(function* () {
 	const http = yield* HttpClient.HttpClient;
 	const request = Effect.fn("SkillRegistry.request")(function* (url) {
-		return yield* http.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.setHeader("accept", "application/json"), HttpClientRequest.setHeader("user-agent", "p4code"))).pipe(Effect.timeout(REQUEST_TIMEOUT_MS));
+		return yield* http.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.setHeader("accept", "application/json"), HttpClientRequest.setHeader("user-agent", "p4code"))).pipe(Effect.timeout(REQUEST_TIMEOUT_MS$1));
 	});
 	const search = (query) => Effect.gen(function* () {
 		const response = yield* request(`${REGISTRY_SEARCH_URL}?q=${encodeURIComponent(query)}`).pipe(Effect.orElseSucceed(() => null));
@@ -35099,7 +35808,309 @@ const make$36 = Effect.gen(function* () {
 		fetch
 	};
 });
-const layer$31 = Layer.effect(SkillRegistry, make$36);
+const layer$32 = Layer.effect(SkillRegistry, make$37);
+//#endregion
+//#region ../../packages/shared/src/ticketReference.ts
+/**
+* Recognizing a tracker reference in text somebody pasted.
+*
+* Shared because both ends need the same answer: the composer decides whether a
+* paste is worth a round trip, and the server decides what to ask the tracker.
+* Two copies of this rule would differ, and the difference would read as "it
+* works on my machine but the paste does nothing".
+*
+* @module ticketReference
+*/
+/**
+* A Linear issue URL, e.g.
+* `https://linear.app/omnicasa/issue/MOBILE-12262/haptic-feedback`.
+*
+* The workspace slug is what makes the URL unguessable from the identifier
+* alone, which is why a resolved ticket keeps the tracker's own URL rather than
+* rebuilding one.
+*/
+const LINEAR_ISSUE_URL_PATTERN = /https?:\/\/(?:www\.)?linear\.app\/[^/\s]+\/issue\/([A-Za-z][A-Za-z0-9]*-\d+)/;
+/**
+* A bare identifier, e.g. `MOBILE-12262`.
+*
+* Anchored: only a paste that is *nothing but* an identifier counts. Scanning
+* prose for this shape would claim things that are not tickets - a date range,
+* a version, a p4code readable id like `P4-40` - and each false positive costs
+* a request and, worse, a wrong link.
+*/
+const BARE_IDENTIFIER_PATTERN = /^([A-Za-z][A-Za-z0-9]*-\d+)$/;
+/**
+* The issue identifier a paste refers to, or `null` when it refers to none.
+*
+* Case is normalized up, the way every tracker prints it, so the same ticket
+* pasted two ways compares equal.
+*/
+function parseTicketReference(text) {
+	const trimmed = text.trim();
+	if (trimmed.length === 0) return null;
+	const url = LINEAR_ISSUE_URL_PATTERN.exec(trimmed);
+	if (url?.[1] !== void 0) return url[1].toUpperCase();
+	const bare = BARE_IDENTIFIER_PATTERN.exec(trimmed);
+	if (bare?.[1] !== void 0) return bare[1].toUpperCase();
+	return null;
+}
+//#endregion
+//#region src/mcp/McpToolClient.ts
+/**
+* Calling a tool on somebody else's MCP server.
+*
+* The rest of `apps/server/src/mcp` points the other way: it *exposes* p4code's
+* toolkit to an agent. This is the only place p4code is the client, and it
+* exists because one feature - recognizing a pasted ticket - needs an answer
+* before any agent turn runs, from a server the user has already registered.
+*
+* Deliberately not a general MCP client. There is no session reuse, no tool
+* listing, no notifications, no SSE stream held open: one request/response pair
+* per call, which is all streamable HTTP requires for a plain `tools/call`. A
+* real client belongs here only once something needs one.
+*
+* @module mcp/McpToolClient
+*/
+/**
+* The version p4code speaks. Sent on `initialize` and echoed back as a header
+* on the follow-up calls, which is what the spec asks of a client that has
+* already negotiated.
+*/
+const MCP_PROTOCOL_VERSION = "2025-06-18";
+const REQUEST_TIMEOUT_MS = 15e3;
+var McpToolCallError = class extends Schema$1.TaggedErrorClass()("McpToolCallError", {
+	detail: Schema$1.String,
+	status: Schema$1.NullOr(Schema$1.Number)
+}) {
+	get message() {
+		return this.detail;
+	}
+};
+const unauthorized$1 = (status) => status === 401 || status === 403;
+/**
+* Read a JSON-RPC envelope out of a response that may be either JSON or SSE.
+*
+* A streamable-http server picks the encoding, and both are legal answers to a
+* single call. The SSE branch keeps the last `data:` payload that parses: a
+* server is free to emit progress notifications ahead of the result, and the
+* result is what a caller of this asked for.
+*/
+const readEnvelope = (body) => {
+	const direct = parseJsonObject(body);
+	if (direct !== void 0) return direct;
+	let latest;
+	for (const line of body.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed.startsWith("data:")) continue;
+		const parsed = parseJsonObject(trimmed.slice(5).trim());
+		if (parsed !== void 0) latest = parsed;
+	}
+	return latest;
+};
+const parseJsonObject = (text) => {
+	if (text.length === 0) return void 0;
+	try {
+		const parsed = JSON.parse(text);
+		return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+	} catch {
+		return;
+	}
+};
+const textOf = (content) => {
+	if (!Array.isArray(content)) return "";
+	const parts = [];
+	for (const block of content) {
+		if (typeof block !== "object" || block === null) continue;
+		const record = block;
+		if (record["type"] === "text" && typeof record["text"] === "string") parts.push(record["text"]);
+	}
+	return parts.join("\n");
+};
+/**
+* One `tools/call`, preceded by the `initialize` handshake the transport
+* requires.
+*
+* The handshake is not optional and not cacheable here: a server may hand out a
+* session id, and this holds no session state between calls. Two round trips
+* for one answer is the price of not keeping a connection open for a feature
+* that fires when somebody pastes something.
+*/
+const callMcpTool = Effect.fn("McpToolClient.callMcpTool")(function* (input) {
+	const http = yield* HttpClient$1.HttpClient;
+	const post = (body, extraHeaders) => http.execute(HttpClientRequest$1.bodyJsonUnsafe(HttpClientRequest$1.setHeaders(HttpClientRequest$1.post(input.url), {
+		...input.headers,
+		...extraHeaders,
+		accept: "application/json, text/event-stream"
+	}), body)).pipe(Effect.timeout(REQUEST_TIMEOUT_MS), Effect.catchCause((cause) => Effect.fail(new McpToolCallError({
+		detail: `Could not reach ${input.url}: ${String(cause)}`,
+		status: null
+	}))));
+	const initialize = yield* post({
+		jsonrpc: "2.0",
+		id: 1,
+		method: "initialize",
+		params: {
+			protocolVersion: MCP_PROTOCOL_VERSION,
+			capabilities: {},
+			clientInfo: {
+				name: "p4code",
+				version: "0.0.0"
+			}
+		}
+	}, {});
+	if (initialize.status >= 400) return yield* new McpToolCallError({
+		detail: unauthorized$1(initialize.status) ? "The server rejected p4code's credentials." : `The server answered ${initialize.status} to initialize.`,
+		status: initialize.status
+	});
+	const sessionId = initialize.headers["mcp-session-id"];
+	const sessionHeaders = {
+		"mcp-protocol-version": MCP_PROTOCOL_VERSION,
+		...sessionId === void 0 ? {} : { "mcp-session-id": sessionId }
+	};
+	yield* post({
+		jsonrpc: "2.0",
+		method: "notifications/initialized"
+	}, sessionHeaders).pipe(Effect.ignore);
+	const response = yield* post({
+		jsonrpc: "2.0",
+		id: 2,
+		method: "tools/call",
+		params: {
+			name: input.toolName,
+			arguments: input.arguments
+		}
+	}, sessionHeaders);
+	const body = yield* response.text.pipe(Effect.catchCause(() => Effect.succeed("")));
+	if (response.status >= 400) return yield* new McpToolCallError({
+		detail: unauthorized$1(response.status) ? "The server rejected p4code's credentials." : `The server answered ${response.status} to ${input.toolName}.`,
+		status: response.status
+	});
+	const envelope = readEnvelope(body);
+	if (envelope === void 0) return yield* new McpToolCallError({
+		detail: `The server's answer to ${input.toolName} was not JSON-RPC.`,
+		status: response.status
+	});
+	const error = envelope["error"];
+	if (typeof error === "object" && error !== null) {
+		const detail = error["message"];
+		return yield* new McpToolCallError({
+			detail: typeof detail === "string" ? detail : `${input.toolName} failed.`,
+			status: response.status
+		});
+	}
+	const result = envelope["result"];
+	if (typeof result !== "object" || result === null) return yield* new McpToolCallError({
+		detail: `${input.toolName} returned no result.`,
+		status: response.status
+	});
+	const resultRecord = result;
+	const text = textOf(resultRecord["content"]);
+	if (resultRecord["isError"] === true) return yield* new McpToolCallError({
+		detail: text.length > 0 ? text : `${input.toolName} reported an error.`,
+		status: response.status
+	});
+	return {
+		structuredContent: resultRecord["structuredContent"],
+		text
+	};
+});
+//#endregion
+//#region src/mcp/TicketResolver.ts
+/**
+* The registered server name a Linear ticket is resolved through.
+*
+* Matched by name rather than by URL: the name is what the user typed in
+* Settings and what every other surface calls it, and a workspace may reach
+* Linear through a proxy URL that no pattern here would recognize.
+*/
+const LINEAR_SERVER_NAME = "linear";
+/** Linear's own tool for reading one issue. */
+const LINEAR_GET_ISSUE_TOOL = "get_issue";
+var TicketResolver = class extends Context.Service()("@p4code/cli/mcp/TicketResolver") {};
+const stringField$1 = (record, key) => {
+	const value = record[key];
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+};
+const asRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+/**
+* Find the issue inside whatever the tool returned.
+*
+* MCP leaves the shape of a tool result to the tool, so this accepts the three
+* arrangements in the wild - the structured payload itself, that payload with
+* the issue nested one level down, or a text block that happens to be JSON -
+* rather than assuming the one Linear happens to send today.
+*/
+const readIssue = (result) => {
+	const structured = asRecord$1(result.structuredContent);
+	if (structured !== void 0) {
+		const nested = asRecord$1(structured["issue"]);
+		if (nested !== void 0) return nested;
+		if (stringField$1(structured, "url") !== void 0) return structured;
+	}
+	try {
+		const parsed = JSON.parse(result.text);
+		const record = asRecord$1(parsed);
+		if (record === void 0) return structured;
+		return asRecord$1(record["issue"]) ?? record;
+	} catch {
+		return structured;
+	}
+};
+const make$36 = Effect.gen(function* () {
+	const registry = yield* McpRegistry;
+	const oauth = yield* McpOAuth;
+	const http = yield* HttpClient$1.HttpClient;
+	return { resolve: Effect.fn("TicketResolver.resolve")(function* (reference) {
+		const identifier = parseTicketReference(reference);
+		if (identifier === null) return yield* new TicketResolveError({
+			reason: "not_found",
+			detail: `"${reference}" does not look like a ticket reference.`
+		});
+		const server = (yield* registry.list).find((candidate) => candidate.registration.name.toLowerCase() === LINEAR_SERVER_NAME && candidate.registration.enabled);
+		if (server === void 0 || server.registration.transport === "stdio") return yield* new TicketResolveError({
+			reason: "not_configured",
+			detail: "No Linear MCP server is registered on this machine. Add it in Settings to link tickets."
+		});
+		const registration = server.registration;
+		const token = yield* oauth.accessTokenFor(registration);
+		const headers = {
+			...registration.headers,
+			...Option.isSome(token) ? { authorization: `Bearer ${token.value}` } : {}
+		};
+		if (Option.isNone(token) && Object.keys(registration.headers ?? {}).length === 0) return yield* new TicketResolveError({
+			reason: "not_authorized",
+			detail: "Linear is registered but not signed in on this machine. Sign in from Settings."
+		});
+		const result = yield* callMcpTool({
+			url: registration.url,
+			headers,
+			toolName: LINEAR_GET_ISSUE_TOOL,
+			arguments: { id: identifier }
+		}).pipe(Effect.provideService(HttpClient$1.HttpClient, http), Effect.mapError((error) => error.status === 401 || error.status === 403 ? new TicketResolveError({
+			reason: "not_authorized",
+			detail: "Linear rejected p4code's sign-in. Sign in again from Settings."
+		}) : new TicketResolveError({
+			reason: "unavailable",
+			detail: error.detail
+		})));
+		const issue = readIssue(result);
+		const url = issue === void 0 ? void 0 : stringField$1(issue, "url");
+		const title = issue === void 0 ? void 0 : stringField$1(issue, "title");
+		if (issue === void 0 || url === void 0 || title === void 0) return yield* new TicketResolveError({
+			reason: "not_found",
+			detail: `Linear returned nothing usable for ${identifier}.`
+		});
+		return {
+			externalRef: {
+				source: "linear",
+				identifier: stringField$1(issue, "identifier") ?? identifier,
+				url
+			},
+			title
+		};
+	}) };
+});
+const layer$31 = Layer.effect(TicketResolver, make$36);
 //#endregion
 //#region ../../packages/shared/src/KeyedCoalescingWorker.ts
 const makeKeyedCoalescingWorker = (options) => Effect.gen(function* () {
@@ -37189,7 +38200,7 @@ const makeWithOptions$1 = Effect.fn("TerminalManager.makeWithOptions")(function*
 		subscribeMetadata
 	});
 });
-const layer$29 = Layer.effect(TerminalManager, make$34()).pipe(Layer.provide(layer$53));
+const layer$29 = Layer.effect(TerminalManager, make$34()).pipe(Layer.provide(layer$54));
 //#endregion
 //#region src/mcp/McpInvocationContext.ts
 var McpInvocationContext = class extends Context.Service()("@p4code/cli/mcp/McpInvocationContext") {};
@@ -44269,6 +45280,7 @@ const RPC_REQUIRED_SCOPE = /* @__PURE__ */ new Map([
 	[WS_METHODS.tasksUpdate, AuthOrchestrationOperateScope],
 	[WS_METHODS.tasksDelete, AuthOrchestrationOperateScope],
 	[WS_METHODS.tasksStartThread, AuthOrchestrationOperateScope],
+	[WS_METHODS.ticketsResolve, AuthOrchestrationReadScope],
 	[WS_METHODS.subscribeTasks, AuthOrchestrationReadScope],
 	[WS_METHODS.hubGetSyncStatus, AuthOrchestrationReadScope],
 	[WS_METHODS.hubConnect, AuthOrchestrationOperateScope],
@@ -44423,6 +45435,7 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker) => WsRpcGroup.t
 	const mcpOAuth = yield* McpOAuth;
 	const claudeMcpFiles = yield* ClaudeMcpFiles;
 	const skillRegistry = yield* SkillRegistry;
+	const ticketResolver = yield* TicketResolver;
 	const listMcpServersEverywhere = Effect.gen(function* () {
 		const servers = [...yield* mcpRegistry.list];
 		const projectRows = yield* projectionProjects.listAll().pipe(Effect.map((rows) => rows.filter((row) => row.deletedAt === null)), Effect.orElseSucceed(() => []));
@@ -44969,6 +45982,13 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker) => WsRpcGroup.t
 				threadId
 			};
 		}), { "rpc.aggregate": "tasks" }),
+		/**
+		* What a pasted reference is, straight from the tracker.
+		*
+		* Nothing is written here: the client decides whether the answer
+		* becomes a task, so an accidental paste costs one request and no row.
+		*/
+		[WS_METHODS.ticketsResolve]: ({ reference }) => observeRpcEffect$1(WS_METHODS.ticketsResolve, ticketResolver.resolve(reference), { "rpc.aggregate": "tickets" }),
 		[WS_METHODS.subscribeTasks]: (_input) => observeRpcStreamEffect$1(WS_METHODS.subscribeTasks, Effect.succeed(taskRepository.streamWithSnapshot.pipe(Stream.catch((cause) => Stream.fromEffect(toTaskStoreError("tasks.subscribe")(cause))))), { "rpc.aggregate": "tasks" }),
 		[WS_METHODS.hubGetSyncStatus]: (_input) => observeRpcEffect$1(WS_METHODS.hubGetSyncStatus, assetSync.status, { "rpc.aggregate": "hub" }),
 		[WS_METHODS.hubConnect]: (input) => observeRpcEffect$1(WS_METHODS.hubConnect, hubLink.connect(input).pipe(Effect.mapError((cause) => new HubLinkError({ detail: cause.message })), Effect.andThen(assetSync.status)), { "rpc.aggregate": "hub" }),
@@ -45236,7 +46256,7 @@ const websocketRpcRouteLayer = Layer.unwrap(Effect.gen(function* () {
 		const serverAuth = yield* EnvironmentAuth;
 		const sessions = yield* SessionStore;
 		const session = yield* serverAuth.authenticateWebSocketUpgrade(request).pipe(Effect.catchIf(isServerAuthCredentialError, (error) => failEnvironmentAuthInvalid(serverAuthCredentialReason(error))), Effect.catchIf(isServerAuthInternalError, (error) => failEnvironmentInternal("internal_error", error)));
-		const rpcWebSocketHttpEffect = yield* RpcServer.toHttpEffectWebsocket(WsRpcGroup, { disableTracing: true }).pipe(Effect.provide(makeWsRpcLayer(session, previewAutomationBroker).pipe(Layer.provideMerge(RpcSerialization.layerJson), Layer.provide(layer$33), Layer.provide(Layer.succeed(ServerSelfUpdate, serverSelfUpdate)), Layer.provide(Layer.succeed(TaskRepository, taskRepository)), Layer.provide(Layer.succeed(ProjectionProjectRepository, projectionProjects)), Layer.provide(Layer.succeed(P4ProjectFileLoader, p4ProjectFileLoader)), Layer.provide(layer$5.pipe(Layer.provide(layer$14.pipe(Layer.provide(Layer.mergeAll(layer$22, layer$20, layer$18, layer$16)), Layer.provideMerge(layer$38), Layer.provide(layer$36.pipe(Layer.provide(layer$37))))), Layer.provide(layer$39))))));
+		const rpcWebSocketHttpEffect = yield* RpcServer.toHttpEffectWebsocket(WsRpcGroup, { disableTracing: true }).pipe(Effect.provide(makeWsRpcLayer(session, previewAutomationBroker).pipe(Layer.provideMerge(RpcSerialization.layerJson), Layer.provide(layer$34), Layer.provide(Layer.succeed(ServerSelfUpdate, serverSelfUpdate)), Layer.provide(Layer.succeed(TaskRepository, taskRepository)), Layer.provide(Layer.succeed(ProjectionProjectRepository, projectionProjects)), Layer.provide(Layer.succeed(P4ProjectFileLoader, p4ProjectFileLoader)), Layer.provide(layer$5.pipe(Layer.provide(layer$14.pipe(Layer.provide(Layer.mergeAll(layer$22, layer$20, layer$18, layer$16)), Layer.provideMerge(layer$39), Layer.provide(layer$37.pipe(Layer.provide(layer$38))))), Layer.provide(layer$40))))));
 		return yield* Effect.acquireUseRelease(sessions.markConnected(session.sessionId), () => rpcWebSocketHttpEffect, () => sessions.markDisconnected(session.sessionId));
 	}).pipe(Effect.catchTags({
 		EnvironmentAuthInvalidError: HttpServerRespondable.toResponse,
@@ -47560,7 +48580,7 @@ const makeOpenCodeRuntime = Effect.gen(function* () {
 	};
 });
 var OpenCodeRuntime = class extends Context.Service()("@p4code/cli/provider/opencodeRuntime") {};
-const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$71));
+const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$72));
 //#endregion
 //#region src/textGeneration/TextGenerationUtils.ts
 const isTextGenerationError$3 = Schema$1.is(TextGenerationError);
@@ -49044,88 +50064,6 @@ function formatAskUserQuestionAnswers(answers) {
 	return formatted;
 }
 //#endregion
-//#region src/provider/CompressPrompts.ts
-/**
-* Caveman-style response compression rulesets, adapted from the caveman
-* plugin's SKILL.md. Pre-baked per level so injection is a lookup, not a
-* runtime template. Applies to assistant prose only: code blocks, commits,
-* PRs, error strings, and safety-critical text stay uncompressed.
-*/
-const COMPRESS_SHARED_RULES = `Respond terse. All technical substance stays. Only fluff dies.
-
-## Persistence
-
-Active every response. No revert after many turns. No filler drift. Still active if unsure.
-
-## Rules
-
-Drop filler (just/really/basically/actually/simply), pleasantries (sure/certainly/of course/happy to), hedging. Short synonyms (big not extensive, fix not "implement a solution for"). No tool-call narration, no decorative tables/emoji, no dumping long raw error logs unless asked - quote shortest decisive line. Standard well-known tech acronyms OK (DB/API/HTTP); never invent new abbreviations (cfg/impl/req/res/fn) - tokenizers split them same as the full word: zero tokens saved, reader still decodes. No causal arrows (->) in prose. Technical terms exact. Code blocks unchanged. Errors quoted exact.
-
-Preserve the user's dominant language: compress the style, not the language. Always keep technical terms, code, API names, CLI commands, commit-type keywords (feat/fix/...), and exact error strings verbatim unless the user explicitly asks for translation.
-
-No self-reference. Never name or announce the style. No compressed answer plus normal recap - compressed output only. Exception: user explicitly asks what the mode is.
-
-## Auto-Clarity
-
-Drop compression and write normally when:
-- Security warnings
-- Irreversible action confirmations
-- Multi-step sequences where fragment order or omitted conjunctions risk misread
-- Compression itself creates technical ambiguity
-- User asks to clarify or repeats a question
-
-Resume compression after the clear part is done.
-
-## Boundaries
-
-Code, commit messages, and PR descriptions: write normal, uncompressed.`;
-const COMPRESS_RULESETS = {
-	lite: `## Response compression: lite
-
-${COMPRESS_SHARED_RULES}
-
-## Intensity: lite
-
-No filler or hedging. Keep articles and full sentences. Professional but tight.
-
-Example - "Why does my React component re-render?"
-"Your component re-renders because you create a new object reference each render. Wrap it in \`useMemo\`."`,
-	full: `## Response compression: full
-
-${COMPRESS_SHARED_RULES}
-
-## Intensity: full
-
-Drop articles (a/an/the), fragments OK, short synonyms. Pattern: [thing] [action] [reason]. [next step].
-
-Not: "Sure! I'd be happy to help you with that. The issue you're experiencing is likely caused by..."
-Yes: "Bug in auth middleware. Token expiry check use \`<\` not \`<=\`. Fix:"
-
-Example - "Why does my React component re-render?"
-"New object ref each render. Inline object prop = new ref = re-render. Wrap in \`useMemo\`."`,
-	ultra: `## Response compression: ultra
-
-${COMPRESS_SHARED_RULES}
-
-## Intensity: ultra
-
-Drop articles, fragments OK, short synonyms. Also strip conjunctions when cause-then-effect stays unambiguous. One word when one word is enough. State each fact once. Code symbols, function names, API names, error strings: never touch.
-
-Example - "Why does my React component re-render?"
-"Inline object prop, new ref, re-render. \`useMemo\`."`
-};
-const COMPRESS_TURN_REMINDERS = {
-	lite: "[response style: compressed lite - no filler/hedging, full sentences; code/commits/security text normal]",
-	full: "[response style: compressed full - terse fragments, drop articles/filler; code/commits/security text normal]",
-	ultra: "[response style: compressed ultra - maximum terseness, one word when enough; code/commits/security text normal]"
-};
-function compressRulesetFor(mode) {
-	return mode === "off" ? void 0 : COMPRESS_RULESETS[mode];
-}
-function compressTurnReminderFor(mode) {
-	return mode === "off" ? void 0 : COMPRESS_TURN_REMINDERS[mode];
-}
-//#endregion
 //#region src/provider/Layers/ClaudeAdapter.ts
 /**
 * ClaudeAdapterLive - Scoped live implementation for the Claude Agent provider adapter.
@@ -49687,6 +50625,20 @@ const SUPPORTED_CLAUDE_IMAGE_MIME_TYPES = /* @__PURE__ */ new Set([
 /** Emitted by the CLI but absent from the SDK's `SDKMessage` union. */
 const UNTYPED_COMMAND_LIFECYCLE_MESSAGE = "command_lifecycle";
 const NARRATE_BEFORE_TOOLS_PROMPT = "Before your first tool call in a turn, write one short sentence saying what you are about to do. Keep it to a single line and skip it when you are answering without tools.";
+/**
+* Said whichever way the setting is set, and said as an override.
+*
+* The preset system prompt this adapter requests already carries an
+* instruction not to spawn subagents unless the user asked — and a preset is
+* taken wholesale, so there is no version of it with that line removed. An
+* append that merely stayed silent when subagents are allowed would therefore
+* leave the restriction standing, which is the one outcome the setting exists
+* to change. Both texts name the earlier instruction they replace, because a
+* later instruction that does not acknowledge the conflict reads as an
+* accident rather than a decision.
+*/
+const SUBAGENTS_ALLOWED_PROMPT = "You may spawn subagents with the Task tool whenever it helps, without asking the user first. This overrides any earlier instruction to use subagents only when they are requested. Prefer one for bounded search or review work whose result is much smaller than the reading it takes to produce; do the work inline when the answer is a single file or a single edit.";
+const SUBAGENTS_ON_REQUEST_PROMPT = "Do not spawn subagents with the Task tool unless the user asks for one. This overrides any earlier instruction permitting them on your own initiative. Do the work inline instead, and say so if it would have been better delegated.";
 const CLAUDE_SETTING_SOURCES = [
 	"user",
 	"project",
@@ -49915,6 +50867,25 @@ function sdkNativeMethod(message) {
 *   would only duplicate a refresh that has already happened.
 */
 const CONSUMED_UNDECLARED_SYSTEM_SUBTYPES = /* @__PURE__ */ new Set(["background_tasks_changed", "vcs_state_changed"]);
+/**
+* Another undeclared-but-real subtype, emitted once the CLI has pushed the
+* turn's changes to a hosting provider:
+* `{provider: "github", url: "https://github.com/org/repo/pull/96",
+*   repo: "org/repo", identifier: "96"}`. Mapped to `code.published` so the
+* work log links the pull request instead of logging an unknown-subtype
+* warning.
+*/
+const CODE_CHANGE_PUBLISHED_SUBTYPE = "code_change_published";
+function codePublishedPayloadFromSdkMessage(message) {
+	const record = message;
+	if (typeof record.url !== "string" || record.url.length === 0) return;
+	return {
+		hostingProvider: typeof record.provider === "string" && record.provider.length > 0 ? record.provider : "unknown",
+		url: record.url,
+		...typeof record.repo === "string" && record.repo.length > 0 ? { repo: record.repo } : {},
+		...typeof record.identifier === "string" && record.identifier.length > 0 ? { identifier: record.identifier } : {}
+	};
+}
 const SDK_MESSAGE_NOISE_KEYS = /* @__PURE__ */ new Set([
 	"type",
 	"subtype",
@@ -50886,6 +51857,17 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 			}
 		};
 		if (CONSUMED_UNDECLARED_SYSTEM_SUBTYPES.has(message.subtype)) return;
+		if (message.subtype === CODE_CHANGE_PUBLISHED_SUBTYPE) {
+			const published = codePublishedPayloadFromSdkMessage(message);
+			if (published) {
+				yield* offerRuntimeEvent({
+					...base,
+					type: "code.published",
+					payload: published
+				});
+				return;
+			}
+		}
 		switch (message.subtype) {
 			case "init":
 				yield* offerRuntimeEvent({
@@ -51520,8 +52502,13 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 		const mcpSession = readMcpProviderSession(input.threadId);
 		const externalMcpServers = options?.resolveMcpServers === void 0 ? {} : yield* options.resolveMcpServers;
 		const narrateBeforeTools = options?.resolveToolCallNarration === void 0 ? DEFAULT_SERVER_SETTINGS.enableToolCallNarration : yield* options.resolveToolCallNarration;
+		const unpromptedSubagents = options?.resolveUnpromptedSubagents === void 0 ? DEFAULT_SERVER_SETTINGS.enableUnpromptedSubagents : yield* options.resolveUnpromptedSubagents;
 		const compressRuleset = compressRulesetFor(input.compressMode ?? "off");
-		const systemPromptAppend = [...narrateBeforeTools ? [NARRATE_BEFORE_TOOLS_PROMPT] : [], ...compressRuleset !== void 0 ? [compressRuleset] : []].join("\n\n");
+		const systemPromptAppend = [
+			...narrateBeforeTools ? [NARRATE_BEFORE_TOOLS_PROMPT] : [],
+			unpromptedSubagents ? SUBAGENTS_ALLOWED_PROMPT : SUBAGENTS_ON_REQUEST_PROMPT,
+			...compressRuleset !== void 0 ? [compressRuleset] : []
+		].join("\n\n");
 		const queryOptions = {
 			...input.cwd ? { cwd: input.cwd } : {},
 			...apiModelId ? { model: apiModelId } : {},
@@ -51983,12 +52970,14 @@ const ClaudeDriver = {
 		const mcpRegistry = yield* McpRegistry;
 		const resolveDisabledSkills = serverSettings.getSettings.pipe(Effect.map((settings) => settings.disabledSkills), Effect.orElseSucceed(() => []));
 		const resolveToolCallNarration = serverSettings.getSettings.pipe(Effect.map((settings) => settings.enableToolCallNarration), Effect.orElseSucceed(() => DEFAULT_SERVER_SETTINGS.enableToolCallNarration));
+		const resolveUnpromptedSubagents = serverSettings.getSettings.pipe(Effect.map((settings) => settings.enableUnpromptedSubagents), Effect.orElseSucceed(() => DEFAULT_SERVER_SETTINGS.enableUnpromptedSubagents));
 		const adapter = yield* makeClaudeAdapter(effectiveConfig, {
 			instanceId,
 			environment: processEnv,
 			resolveMcpServers: mcpRegistry.resolveForSession,
 			resolveDisabledSkills,
 			resolveToolCallNarration,
+			resolveUnpromptedSubagents,
 			...eventLoggers.native ? { nativeEventLogger: eventLoggers.native } : {}
 		});
 		const textGeneration = yield* makeClaudeTextGeneration(effectiveConfig, processEnv);
@@ -85633,6 +86622,24 @@ function runtimeEventToActivities(event, taskTitle) {
 			turnId: toTurnId$1(event.turnId) ?? null,
 			...maybeSequence
 		}];
+		case "code.published": {
+			const label = event.payload.repo ? event.payload.identifier ? `${event.payload.repo}#${event.payload.identifier}` : event.payload.repo : event.payload.url;
+			return [{
+				id: event.eventId,
+				createdAt: event.createdAt,
+				tone: "info",
+				kind: "code.published",
+				summary: `Published ${label}`,
+				payload: {
+					hostingProvider: event.payload.hostingProvider,
+					url: event.payload.url,
+					...event.payload.repo ? { repo: event.payload.repo } : {},
+					...event.payload.identifier ? { identifier: event.payload.identifier } : {}
+				},
+				turnId: toTurnId$1(event.turnId) ?? null,
+				...maybeSequence
+			}];
+		}
 		case "turn.plan.updated": return [{
 			id: event.eventId,
 			createdAt: event.createdAt,
@@ -88017,7 +89024,7 @@ const ObservabilityLive = Layer.unwrap(Effect.gen(function* () {
 			sink,
 			...delegate ? { delegate } : {}
 		});
-		return Layer.mergeAll(Layer.succeed(Tracer.Tracer, tracer), layer$40(sink));
+		return Layer.mergeAll(Layer.succeed(Tracer.Tracer, tracer), layer$41(sink));
 	})).pipe(Layer.provide(OtlpExporter.layerFlusher), Layer.provideMerge(otlpSerializationLayer));
 	const metricsLayer = config.otlpMetricsUrl === void 0 ? Layer.empty : OtlpMetrics.layer({
 		url: config.otlpMetricsUrl,
@@ -88296,25 +89303,25 @@ const ReactorLayerLive = Layer.empty.pipe(Layer.provideMerge(OrchestrationReacto
 const ProviderSessionDirectoryLayerLive = ProviderSessionDirectoryLive.pipe(Layer.provide(layer$3));
 const ProviderLayerLive = ProviderServiceLive.pipe(Layer.provide(ProviderAdapterRegistryLive), Layer.provideMerge(ProviderSessionDirectoryLayerLive));
 const PersistenceLayerLive = Layer.empty.pipe(Layer.provideMerge(layerConfig));
-const VcsDriverRegistryLayerLive = layer$36.pipe(Layer.provide(layer$37));
-const SourceControlProviderRegistryLayerLive = layer$14.pipe(Layer.provide(Layer.mergeAll(layer$22, layer$20, layer$18, layer$16)), Layer.provideMerge(layer$38), Layer.provideMerge(VcsDriverRegistryLayerLive));
-const GitManagerLayerLive = layer$13.pipe(Layer.provideMerge(layer$23), Layer.provideMerge(layer$38), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(layer$32));
-const GitLayerLive = Layer.empty.pipe(Layer.provideMerge(GitManagerLayerLive), Layer.provideMerge(layer$38));
+const VcsDriverRegistryLayerLive = layer$37.pipe(Layer.provide(layer$38));
+const SourceControlProviderRegistryLayerLive = layer$14.pipe(Layer.provide(Layer.mergeAll(layer$22, layer$20, layer$18, layer$16)), Layer.provideMerge(layer$39), Layer.provideMerge(VcsDriverRegistryLayerLive));
+const GitManagerLayerLive = layer$13.pipe(Layer.provideMerge(layer$23), Layer.provideMerge(layer$39), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(layer$33));
+const GitLayerLive = Layer.empty.pipe(Layer.provideMerge(GitManagerLayerLive), Layer.provideMerge(layer$39));
 const GitWorkflowLayerLive = layer$12.pipe(Layer.provideMerge(VcsDriverRegistryLayerLive), Layer.provideMerge(GitLayerLive));
-const SourceControlRepositoryServiceLayerLive = layer$4.pipe(Layer.provideMerge(layer$38), Layer.provideMerge(SourceControlProviderRegistryLayerLive));
-const ReviewLayerLive = layer$9.pipe(Layer.provideMerge(layer$38), Layer.provideMerge(VcsDriverRegistryLayerLive));
-const VcsLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$37), Layer.provideMerge(VcsDriverRegistryLayerLive), Layer.provideMerge(layer$10.pipe(Layer.provide(VcsDriverRegistryLayerLive))), Layer.provideMerge(GitWorkflowLayerLive), Layer.provideMerge(ReviewLayerLive), Layer.provideMerge(SourceControlRepositoryServiceLayerLive), Layer.provideMerge(layer$11.pipe(Layer.provide(GitWorkflowLayerLive))));
-const CheckpointingLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$34), Layer.provideMerge(layer$35.pipe(Layer.provide(VcsDriverRegistryLayerLive))));
-const PortScannerLayerLive = layer$30.pipe(Layer.provide(layer$53));
+const SourceControlRepositoryServiceLayerLive = layer$4.pipe(Layer.provideMerge(layer$39), Layer.provideMerge(SourceControlProviderRegistryLayerLive));
+const ReviewLayerLive = layer$9.pipe(Layer.provideMerge(layer$39), Layer.provideMerge(VcsDriverRegistryLayerLive));
+const VcsLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$38), Layer.provideMerge(VcsDriverRegistryLayerLive), Layer.provideMerge(layer$10.pipe(Layer.provide(VcsDriverRegistryLayerLive))), Layer.provideMerge(GitWorkflowLayerLive), Layer.provideMerge(ReviewLayerLive), Layer.provideMerge(SourceControlRepositoryServiceLayerLive), Layer.provideMerge(layer$11.pipe(Layer.provide(GitWorkflowLayerLive))));
+const CheckpointingLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$35), Layer.provideMerge(layer$36.pipe(Layer.provide(VcsDriverRegistryLayerLive))));
+const PortScannerLayerLive = layer$30.pipe(Layer.provide(layer$54));
 const TerminalLayerLive = layer$29.pipe(Layer.provide(PtyAdapterLive), Layer.provide(PortScannerLayerLive));
 const PreviewLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$27), Layer.provideMerge(PortScannerLayerLive));
-const WorkspaceEntriesLayerLive = layer$25.pipe(Layer.provide(layer$43));
-const WorkspaceFileSystemLayerLive = layer$24.pipe(Layer.provide(layer$43), Layer.provide(WorkspaceEntriesLayerLive));
-const WorkspaceLayerLive = Layer.mergeAll(layer$43, WorkspaceEntriesLayerLive, WorkspaceFileSystemLayerLive);
-const ProjectFaviconResolverLayerLive = layer$41.pipe(Layer.provide(layer$43), Layer.provide(layer$42));
-const AuthLayerLive = layer$63.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$67));
+const WorkspaceEntriesLayerLive = layer$25.pipe(Layer.provide(layer$44));
+const WorkspaceFileSystemLayerLive = layer$24.pipe(Layer.provide(layer$44), Layer.provide(WorkspaceEntriesLayerLive));
+const WorkspaceLayerLive = Layer.mergeAll(layer$44, WorkspaceEntriesLayerLive, WorkspaceFileSystemLayerLive);
+const ProjectFaviconResolverLayerLive = layer$42.pipe(Layer.provide(layer$44), Layer.provide(layer$43));
+const AuthLayerLive = layer$64.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$68));
 const ProviderRuntimeLayerLive = ProviderSessionReaperLive.pipe(Layer.provideMerge(ProviderLayerLive), Layer.provideMerge(OrchestrationLayerLive));
-const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$51), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$60.pipe(Layer.provide(layer$67))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$52), Layer.provideMerge(layer$45), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(Layer.mergeAll(layer$57, layer$31).pipe(Layer.provideMerge(layer$58), Layer.provideMerge(layer$59))), Layer.provideMerge(layer$67)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$48), Layer.provideMerge(layer$50), Layer.provideMerge(layer$49), Layer.provide(layer$71));
+const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$52), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$61.pipe(Layer.provide(layer$68))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$53), Layer.provideMerge(layer$46), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$31.pipe(Layer.provideMerge(Layer.mergeAll(layer$58, layer$32).pipe(Layer.provideMerge(layer$59), Layer.provideMerge(layer$60))))), Layer.provideMerge(layer$68)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$49), Layer.provideMerge(layer$51), Layer.provideMerge(layer$50), Layer.provide(layer$72));
 /**
 * Hub asset sync.
 *
@@ -88322,9 +89329,9 @@ const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(Checkpo
 * not-configured shape, and every call reports that rather than failing — so
 * this costs a server with no hub nothing but a layer.
 */
-const AssetSyncLive = layer$54.pipe(Layer.provideMerge(layer$55), Layer.provideMerge(layer$56));
-const RuntimeServicesLive = layer$44.pipe(Layer.provideMerge(AssetSyncLive), Layer.provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = Layer.mergeAll(Layer.mergeAll(HttpApiBuilder.layer(EnvironmentHttpApi).pipe(Layer.provide(authHttpApiLayer), Layer.provide(orchestrationHttpApiLayer), Layer.provide(serverEnvironmentHttpApiLayer), Layer.provide(environmentAuthenticatedAuthLayer)), otlpTracesProxyRouteLayer, assetRouteLayer, mcpOAuthCallbackRouteLayer, staticAndDevRouteLayer, websocketRpcRouteLayer), layer.pipe(Layer.provide(layer$2))).pipe(Layer.provide(RoutedTaskRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(ProjectionProjectRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(layer$42), Layer.provide(layer$28), Layer.provide(layer$46), Layer.provide(browserApiCorsLayer), Layer.provide(httpCompressionLayer));
+const AssetSyncLive = layer$55.pipe(Layer.provideMerge(layer$56), Layer.provideMerge(layer$57));
+const RuntimeServicesLive = layer$45.pipe(Layer.provideMerge(AssetSyncLive), Layer.provideMerge(RuntimeDependenciesLive));
+const makeRoutesLayer = Layer.mergeAll(Layer.mergeAll(HttpApiBuilder.layer(EnvironmentHttpApi).pipe(Layer.provide(authHttpApiLayer), Layer.provide(orchestrationHttpApiLayer), Layer.provide(serverEnvironmentHttpApiLayer), Layer.provide(environmentAuthenticatedAuthLayer)), otlpTracesProxyRouteLayer, assetRouteLayer, mcpOAuthCallbackRouteLayer, staticAndDevRouteLayer, websocketRpcRouteLayer), layer.pipe(Layer.provide(layer$2))).pipe(Layer.provide(RoutedTaskRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(ProjectionProjectRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(layer$43), Layer.provide(layer$28), Layer.provide(layer$47), Layer.provide(browserApiCorsLayer), Layer.provide(httpCompressionLayer));
 const makeServerLayer = Layer.unwrap(Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	yield* fixPath();
@@ -88367,7 +89374,7 @@ const makeServerLayer = Layer.unwrap(Effect.gen(function* () {
 		cause,
 		servePort: configured.servePort
 	}))) : Effect.void)) : Layer.empty;
-	return Layer.mergeAll(HttpRouter.serve(makeRoutesLayer, { disableLogger: !config.logWebSocketEvents }), httpListeningLayer, runtimeStateLayer, tailscaleServeLayer).pipe(Layer.provideMerge(RuntimeServicesLive), Layer.provideMerge(HttpResponseCompressionLive), Layer.provideMerge(HttpServerLive), Layer.provide(ObservabilityLive), Layer.provideMerge(FetchHttpClient.layer), Layer.provideMerge(layer$39), Layer.provideMerge(PlatformServicesLive));
+	return Layer.mergeAll(HttpRouter.serve(makeRoutesLayer, { disableLogger: !config.logWebSocketEvents }), httpListeningLayer, runtimeStateLayer, tailscaleServeLayer).pipe(Layer.provideMerge(RuntimeServicesLive), Layer.provideMerge(HttpResponseCompressionLive), Layer.provideMerge(HttpServerLive), Layer.provide(ObservabilityLive), Layer.provideMerge(FetchHttpClient.layer), Layer.provideMerge(layer$40), Layer.provideMerge(PlatformServicesLive));
 }));
 const runServer = Layer.launch(makeServerLayer);
 //#endregion
@@ -88529,11 +89536,11 @@ const reconcileWithNewBinary = Effect.fn("cli.selfUpdate.reconcileWithNewBinary"
 //#endregion
 //#region src/cli/service.ts
 const isBootServiceCommandError = Schema$1.is(BootServiceCommandError);
-const bootServiceLayer = (config) => layer$47({
+const bootServiceLayer = (config) => layer$48({
 	baseDir: config.baseDir,
 	logsDir: config.logsDir,
 	cliVersion: version
-}).pipe(Layer.provide(layer$53));
+}).pipe(Layer.provide(layer$54));
 /** Install, update, or repair the service using the CLI version running this command. */
 const reconcileService = Effect.fn("cli.service.reconcile")(function* () {
 	const service = yield* BootService;
@@ -88580,7 +89587,7 @@ const runServiceCommand = Effect.fn("cli.service.run")(function* (flags, run, pr
 	const baseDirNotice = yield* describeNonDefaultBaseDir(config.baseDir);
 	if (baseDirNotice !== null) yield* Console.error(baseDirNotice);
 	if (prepare !== void 0) yield* prepare(config);
-	return yield* run.pipe(Effect.tapError((error) => isBootServiceCommandError(error) ? BootService.pipe(Effect.flatMap((service) => Console.error(`Details: ${service.logPath}`))) : Effect.void), Effect.provide(Layer.mergeAll(bootServiceLayer(config), layer$53)));
+	return yield* run.pipe(Effect.tapError((error) => isBootServiceCommandError(error) ? BootService.pipe(Effect.flatMap((service) => Console.error(`Details: ${service.logPath}`))) : Effect.void), Effect.provide(Layer.mergeAll(bootServiceLayer(config), layer$54)));
 });
 /**
 * Options the installed unit carries, rather than ones this command consumes.
@@ -88734,7 +89741,7 @@ const serviceCommand = Command.make("service").pipe(Command.withDescription("Man
 ]));
 //#endregion
 //#region src/bin.ts
-const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$71, FetchHttpClient.layer);
+const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$72, FetchHttpClient.layer);
 /**
 * Prints an update reminder before dispatching, at most once a day.
 *
@@ -88764,6 +89771,7 @@ const reportUpdateAvailable = Effect.gen(function* () {
 const makeCli = () => Command.make("p4c", { ...sharedServerCommandFlags }).pipe(Command.withDescription("Run the P4Code server."), Command.withHandler((flags) => runServerCommand(flags)), Command.withSubcommands([
 	startCommand,
 	serveCommand,
+	agentsCommand,
 	authCommand,
 	hubCommand,
 	mcpCommand,