@rallycry/conveyor-agent 11.0.27 → 11.0.29

package/dist/{chunk-PBSFLQA7.js → chunk-KLM6ZOUX.js}

@@ -244,6 +244,7 @@ function syncBundleGithubToken(token) {
 var logger = createServiceLogger("agent-connection");
 var EVENT_BATCH_MS = 500;
 var MAX_EVENT_BUFFER = 5e3;
+var PTY_INPUT_REPORT_INTERVAL_MS = 3e4;
 var TOKEN_REFRESH_INTERVAL_MS = 45 * 60 * 1e3;
 var AgentConnection = class _AgentConnection {
   socket = null;
@@ -291,6 +292,9 @@ var AgentConnection = class _AgentConnection {
    *  question-grace expiry reads it to defer un-parking while a human is
    *  actively typing into the Connected-TUI (they may be mid-answer). */
   _lastPtyInputAt = null;
+  /** Runner-side subscribers to keystrokes from EITHER transport. */
+  ptyInputActivityListeners = /* @__PURE__ */ new Set();
+  lastReportedDirectInputAt = Number.NEGATIVE_INFINITY;
   constructor(config) {
     this.config = config;
   }
@@ -479,7 +483,7 @@ var AgentConnection = class _AgentConnection {
       });
       this.socket.on("pty:input", (data) => {
         if (data.sessionId && data.sessionId !== this.config.sessionId) return;
-        this._lastPtyInputAt = Date.now();
+        this.notePtyInput("relay");
         this.ptyInputCallback?.(data.data);
       });
       this.socket.on("pty:resize", (data) => {
@@ -946,7 +950,32 @@ var AgentConnection = class _AgentConnection {
     }).catch(() => {
     });
   }
-  /** Epoch ms of the last relayed TUI keystroke, or null before any. */
+  /**
+   * A human typed into the TUI. Stamps `lastPtyInputAt` and notifies the
+   * runner's input-activity listeners for both transports. Direct-stream
+   * keystrokes never cross the API, so for those this also tells the server
+   * (`reportPtyInput`, throttled, fire-and-forget) — the relay path's server
+   * already bumps in `relayPtyInput`. An old API that doesn't know the method
+   * rejects harmlessly.
+   */
+  notePtyInput(origin = "direct") {
+    const now = Date.now();
+    this._lastPtyInputAt = now;
+    for (const listener of this.ptyInputActivityListeners) listener();
+    if (origin !== "direct" || !this.socket) return;
+    if (now - this.lastReportedDirectInputAt < PTY_INPUT_REPORT_INTERVAL_MS) return;
+    this.lastReportedDirectInputAt = now;
+    void this.call("reportPtyInput", { sessionId: this.config.sessionId }).catch(() => {
+    });
+  }
+  /** Subscribe to keystroke activity from either transport. Returns an unsubscribe fn. */
+  onPtyInputActivity(listener) {
+    this.ptyInputActivityListeners.add(listener);
+    return () => {
+      this.ptyInputActivityListeners.delete(listener);
+    };
+  }
+  /** Epoch ms of the last TUI keystroke (relay or direct), or null before any. */
   get lastPtyInputAt() {
     return this._lastPtyInputAt;
   }
@@ -1446,14 +1475,24 @@ ${q.question}${q.options.length ? "\n" + q.options.map((o) => `- ${o.label}: ${o
   }
 };
 
-// ../shared/dist/chunk-U3HGG5NX.js
+// ../shared/dist/chunk-3D2OVVIS.js
 import { z } from "zod";
+import { z as z2 } from "zod";
 var DEFAULT_SONNET_MODEL = "claude-sonnet-5";
 var DEFAULT_OPUS_MODEL = "claude-opus-5-5";
 var DEFAULT_HAIKU_MODEL = "claude-haiku-4-5-20251001";
 var FABLE_MODEL = "claude-fable-5-1";
 var PREVIOUS_SONNET_MODEL = "claude-sonnet-4-6";
 var PREVIOUS_OPUS_MODEL = "claude-opus-5";
+function formatModelId(provider, model) {
+  return `${provider}/${model}`;
+}
+var JEV_MODEL = "jev-1.13.0";
+var JEV_MODEL_ID = formatModelId("typesafe", JEV_MODEL);
+var JEV_ZEN_MODEL = "jev-1.13";
+var JEV_ZEN_MODEL_ID = formatModelId("zen", JEV_ZEN_MODEL);
+var JEV_INPUT_PRICE_PER_TOKEN = 0.042 / 1e6;
+var JEV_STATE_MAX_CHARS = 1e5;
 var PTY_STREAM_PORT_BASE = 7420;
 var PTY_STREAM_PORT_ATTEMPTS = 8;
 function encodePtyStreamFrame(frame) {
@@ -1507,6 +1546,11 @@ var PREVIEW_PORT_DENY_LIST = [
   9200,
   ...Array.from({ length: PTY_STREAM_PORT_ATTEMPTS }, (_, i) => PTY_STREAM_PORT_BASE + i)
 ];
+function isAllowablePreviewPort(port) {
+  if (typeof port !== "number" || !Number.isInteger(port)) return false;
+  if (port < 1 || port > 65535) return false;
+  return !PREVIEW_PORT_DENY_LIST.includes(port);
+}
 function normalizeCheckpointPath(value) {
   let normalized = value.trim().replace(/\/{2,}/g, "/");
   normalized = normalized.split("/").filter((segment) => segment !== ".").join("/");
@@ -1565,6 +1609,12 @@ var projectCheckpointSettingsSchema = z.object({
 var CARD_DESCRIPTION_MAX = 255;
 var CARD_DESCRIPTION_LIMIT_MESSAGE = `Card descriptions are capped at ${CARD_DESCRIPTION_MAX} characters \u2014 write 1-2 plain sentences a non-engineer can read; put technical detail in the plan or card chat.`;
 var CARD_DESCRIPTION_FIELD_HINT = `max ${CARD_DESCRIPTION_MAX} chars, 1-2 plain sentences a non-engineer can read \u2014 put technical detail in the plan`;
+var MAX_MANUAL_TESTS_PER_TASK = 5;
+var MAX_MANUAL_TEST_TITLE_LENGTH = 200;
+var ManualTestItemsSchema = z2.array(z2.object({ title: z2.string().min(1).max(MAX_MANUAL_TEST_TITLE_LENGTH) })).min(1).max(MAX_MANUAL_TESTS_PER_TASK);
+function describeManualTestRejection(item) {
+  return item.reason === "cap" ? `Rejected "${item.title}": the card already holds ${MAX_MANUAL_TESTS_PER_TASK} manual tests. Use remove_manual_test or edit_manual_test to consolidate.` : `Rejected "${item.title}": names an automated step (lint, tests, CI, shell); manual tests describe what a person does in the app.`;
+}
 var DEFAULT_CI_WAIT_TIMEOUT_MINUTES = 45;
 var MAX_CI_WAIT_TIMEOUT_MINUTES = 180;
 var SEVERITY_ENUM = [
@@ -1699,9 +1749,9 @@ async function runQueryGrafanaLogs(port, params, now = Date.now) {
 }
 
 // ../shared/dist/index.js
-import { z as z2 } from "zod";
-import { z as z22 } from "zod";
 import { z as z3 } from "zod";
+import { z as z22 } from "zod";
+import { z as z32 } from "zod";
 import { z as z4 } from "zod";
 import { z as z5 } from "zod";
 import { z as z6 } from "zod";
@@ -1736,7 +1786,7 @@ var ACHIEVEMENT_RARITIES = [
   { key: "pack", name: "Pack", color: "#9c27b0", iconPath: "/storypoints/pack.svg" }
 ];
 var RISK_LEVELS = ["critical", "high", "medium", "low"];
-var riskLevelSchema = z2.enum(RISK_LEVELS);
+var riskLevelSchema = z3.enum(RISK_LEVELS);
 var DEFAULT_RISK_LEVELS = [
   {
     level: "critical",
@@ -1966,7 +2016,9 @@ var KnownAgentEventSchema = z22.discriminatedUnion("type", [
     startCommandRunning: z22.boolean().optional(),
     startCommandConfigured: z22.boolean().optional(),
     // Sanitized server-side by sanitizeSessionPreviewPorts — stays unknown.
-    previewPorts: z22.unknown().optional()
+    previewPorts: z22.unknown().optional(),
+    // Sanitized server-side by sanitizeSessionPreviewLinks — stays unknown.
+    previewLinks: z22.unknown().optional()
   }).passthrough(),
   z22.object({ type: z22.literal("setup_error"), message: z22.string() }).passthrough(),
   z22.object({ type: z22.literal("start_command_started") }).passthrough(),
@@ -1983,29 +2035,29 @@ var AgentEventSchema = z22.union([
   KnownAgentEventSchema,
   z22.object({ type: z22.string().min(1) }).catchall(z22.unknown())
 ]);
-var cardDescription = z3.string().max(CARD_DESCRIPTION_MAX, CARD_DESCRIPTION_LIMIT_MESSAGE).optional();
-var AgentHeartbeatSchema = z3.object({
-  sessionId: z3.string().optional(),
-  timestamp: z3.string(),
-  status: z3.enum(["active", "idle", "building"]),
-  currentAction: z3.string().optional(),
+var cardDescription = z32.string().max(CARD_DESCRIPTION_MAX, CARD_DESCRIPTION_LIMIT_MESSAGE).optional();
+var AgentHeartbeatSchema = z32.object({
+  sessionId: z32.string().optional(),
+  timestamp: z32.string(),
+  status: z32.enum(["active", "idle", "building"]),
+  currentAction: z32.string().optional(),
   /** Sender-observed main event-loop lag (ms) — see AgentHeartbeat.loopLagMs. */
-  loopLagMs: z3.number().nonnegative().optional()
-});
-var CreatePRInputSchema = z3.object({
-  title: z3.string().min(1),
-  body: z3.string(),
-  head: z3.string().optional(),
-  base: z3.string().optional()
-});
-var PostToChatInputSchema = z3.object({
-  message: z3.string().min(1),
-  type: z3.enum(["message", "question", "update"]).optional().default("message"),
-  milestone: z3.enum(["plan_ready", "implementation_complete", "blocked"]).optional()
-});
-var GetTaskContextRequestSchema = z3.object({
-  sessionId: z3.string(),
-  includeHistory: z3.boolean().optional().default(false),
+  loopLagMs: z32.number().nonnegative().optional()
+});
+var CreatePRInputSchema = z32.object({
+  title: z32.string().min(1),
+  body: z32.string(),
+  head: z32.string().optional(),
+  base: z32.string().optional()
+});
+var PostToChatInputSchema = z32.object({
+  message: z32.string().min(1),
+  type: z32.enum(["message", "question", "update"]).optional().default("message"),
+  milestone: z32.enum(["plan_ready", "implementation_complete", "blocked"]).optional()
+});
+var GetTaskContextRequestSchema = z32.object({
+  sessionId: z32.string(),
+  includeHistory: z32.boolean().optional().default(false),
   /**
    * Read the plan-revised marker WITHOUT consuming it. Bookkeeping fetches
    * (the session-identity check, the branch refresh) pass true so they cannot
@@ -2013,283 +2065,283 @@ var GetTaskContextRequestSchema = z3.object({
    * Defaults to false — consuming — so a pod running an older agent build still
    * clears the marker instead of showing the notice on every boot forever.
    */
-  peekPlanRevision: z3.boolean().optional().default(false)
+  peekPlanRevision: z32.boolean().optional().default(false)
 });
-var GetChatMessagesRequestSchema = z3.object({
-  sessionId: z3.string(),
-  limit: z3.number().int().positive().optional().default(50),
-  offset: z3.number().int().nonnegative().optional().default(0),
+var GetChatMessagesRequestSchema = z32.object({
+  sessionId: z32.string(),
+  limit: z32.number().int().positive().optional().default(50),
+  offset: z32.number().int().nonnegative().optional().default(0),
   /** Task id or slug to read chat from. Omit for the session's own task. Only
    * the session's own task or one of its children resolves — anything else is
    * an error, never a silent fallback to the caller's own chat. */
-  taskId: z3.string().optional()
+  taskId: z32.string().optional()
 });
-var GetTaskFilesRequestSchema = z3.object({
-  sessionId: z3.string(),
-  taskId: z3.string().optional()
+var GetTaskFilesRequestSchema = z32.object({
+  sessionId: z32.string(),
+  taskId: z32.string().optional()
 });
-var GetTaskFileRequestSchema = z3.object({
-  sessionId: z3.string(),
-  fileId: z3.string(),
-  taskId: z3.string().optional()
+var GetTaskFileRequestSchema = z32.object({
+  sessionId: z32.string(),
+  fileId: z32.string(),
+  taskId: z32.string().optional()
 });
-var DeleteTaskFileRequestSchema = z3.object({
-  sessionId: z3.string(),
-  fileId: z3.string()
+var DeleteTaskFileRequestSchema = z32.object({
+  sessionId: z32.string(),
+  fileId: z32.string()
 });
-var GetTaskRequestSchema = z3.object({
-  sessionId: z3.string(),
-  taskSlugOrId: z3.string()
+var GetTaskRequestSchema = z32.object({
+  sessionId: z32.string(),
+  taskSlugOrId: z32.string()
 });
-var GetCliHistoryRequestSchema = z3.object({
-  sessionId: z3.string(),
-  limit: z3.number().int().positive().optional().default(100),
-  source: z3.enum(["agent", "application"]).optional(),
+var GetCliHistoryRequestSchema = z32.object({
+  sessionId: z32.string(),
+  limit: z32.number().int().positive().optional().default(100),
+  source: z32.enum(["agent", "application"]).optional(),
   /** Task id or slug to read logs from. Omit for the session's own task. Only
    * the session's own task or one of its children resolves — anything else is
    * an error, never a silent fallback to the caller's own logs. */
-  taskId: z3.string().optional()
+  taskId: z32.string().optional()
 });
-var ListSubtasksRequestSchema = z3.object({
-  sessionId: z3.string(),
+var ListSubtasksRequestSchema = z32.object({
+  sessionId: z32.string(),
   /** "compact" returns the slim orchestration view (ListSubtasksCompactResponse:
    * per-child status, agent, story points, PR state, dependencies); "full" (default — wire-compat with older
    * agents) returns the verbose SubtaskSummaryDTO[] including description/plan. */
-  view: z3.enum(["compact", "full"]).optional()
-});
-var GetDependenciesRequestSchema = z3.object({
-  sessionId: z3.string()
-});
-var GetSuggestionsRequestSchema = z3.object({
-  sessionId: z3.string(),
-  status: z3.string().optional(),
-  limit: z3.number().int().min(1).max(100).optional()
-});
-var ListManualTestsRequestSchema = z3.object({
-  sessionId: z3.string()
-});
-var QueryManualTestsRequestSchema = z3.object({
-  sessionId: z3.string(),
-  cardStatuses: z3.array(z3.string()).optional(),
-  testStatuses: z3.array(z3.enum(["open", "approved", "rejected"])).optional()
-});
-var CreatePullRequestRequestSchema = CreatePRInputSchema.extend({ sessionId: z3.string() });
-var RequestFileUploadRequestSchema = z3.object({
-  sessionId: z3.string(),
-  fileName: z3.string().min(1).max(255),
-  mimeType: z3.string().min(1).max(128),
-  fileSize: z3.number().int().positive().max(MAX_FILE_SIZE_BYTES)
-});
-var ConfirmFileUploadRequestSchema = z3.object({
-  sessionId: z3.string(),
-  fileId: z3.string(),
-  title: z3.string().max(500).optional(),
+  view: z32.enum(["compact", "full"]).optional()
+});
+var GetDependenciesRequestSchema = z32.object({
+  sessionId: z32.string()
+});
+var GetSuggestionsRequestSchema = z32.object({
+  sessionId: z32.string(),
+  status: z32.string().optional(),
+  limit: z32.number().int().min(1).max(100).optional()
+});
+var ListManualTestsRequestSchema = z32.object({
+  sessionId: z32.string()
+});
+var QueryManualTestsRequestSchema = z32.object({
+  sessionId: z32.string(),
+  cardStatuses: z32.array(z32.string()).optional(),
+  testStatuses: z32.array(z32.enum(["open", "approved", "rejected"])).optional()
+});
+var CreatePullRequestRequestSchema = CreatePRInputSchema.extend({ sessionId: z32.string() });
+var RequestFileUploadRequestSchema = z32.object({
+  sessionId: z32.string(),
+  fileName: z32.string().min(1).max(255),
+  mimeType: z32.string().min(1).max(128),
+  fileSize: z32.number().int().positive().max(MAX_FILE_SIZE_BYTES)
+});
+var ConfirmFileUploadRequestSchema = z32.object({
+  sessionId: z32.string(),
+  fileId: z32.string(),
+  title: z32.string().max(500).optional(),
   /** Glossary tag names (or ids) this file is an example of. */
-  tags: z3.array(z3.string().min(1).max(MAX_FILE_TAG_LENGTH)).max(MAX_FILE_TAGS).optional()
-});
-var UpdateTaskStatusRequestSchema = z3.object({
-  sessionId: z3.string(),
-  status: z3.string(),
-  force: z3.boolean().optional().default(false)
-});
-var StoreSessionIdRequestSchema = z3.object({
-  sessionId: z3.string(),
-  sdkSessionId: z3.string()
-});
-var SetManualTestsRequestSchema = z3.object({
-  sessionId: z3.string(),
-  items: z3.array(z3.object({ title: z3.string().min(1) })).min(1)
-});
-var EditManualTestRequestSchema = z3.object({
-  sessionId: z3.string(),
-  title: z3.string().min(1),
-  newTitle: z3.string().min(1)
-});
-var RemoveManualTestRequestSchema = z3.object({
-  sessionId: z3.string(),
-  title: z3.string().min(1)
-});
-var ApproveManualTestRequestSchema = z3.object({
-  sessionId: z3.string(),
-  title: z3.string().min(1)
-});
-var RejectManualTestRequestSchema = z3.object({
-  sessionId: z3.string(),
-  title: z3.string().min(1),
-  reason: z3.string().min(1).max(2e3)
-});
-var SessionStartRequestSchema = z3.object({
-  sessionId: z3.string(),
-  agentVersion: z3.string(),
-  capabilities: z3.array(z3.string())
-});
-var SessionStopRequestSchema = z3.object({
-  sessionId: z3.string(),
-  reason: z3.string().optional()
-});
-var EndReviewSessionRequestSchema = z3.object({
-  sessionId: z3.string(),
-  reason: z3.enum(["approved", "changes_requested", "finished"]).optional()
-});
-var ConnectAgentRequestSchema = z3.object({
-  sessionId: z3.string()
-});
-var ReportAgentStatusRequestSchema = z3.object({
-  sessionId: z3.string(),
-  status: z3.string(),
+  tags: z32.array(z32.string().min(1).max(MAX_FILE_TAG_LENGTH)).max(MAX_FILE_TAGS).optional()
+});
+var UpdateTaskStatusRequestSchema = z32.object({
+  sessionId: z32.string(),
+  status: z32.string(),
+  force: z32.boolean().optional().default(false)
+});
+var StoreSessionIdRequestSchema = z32.object({
+  sessionId: z32.string(),
+  sdkSessionId: z32.string()
+});
+var SetManualTestsRequestSchema = z32.object({
+  sessionId: z32.string(),
+  items: ManualTestItemsSchema
+});
+var EditManualTestRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().min(1),
+  newTitle: z32.string().min(1)
+});
+var RemoveManualTestRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().min(1)
+});
+var ApproveManualTestRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().min(1)
+});
+var RejectManualTestRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().min(1),
+  reason: z32.string().min(1).max(2e3)
+});
+var SessionStartRequestSchema = z32.object({
+  sessionId: z32.string(),
+  agentVersion: z32.string(),
+  capabilities: z32.array(z32.string())
+});
+var SessionStopRequestSchema = z32.object({
+  sessionId: z32.string(),
+  reason: z32.string().optional()
+});
+var EndReviewSessionRequestSchema = z32.object({
+  sessionId: z32.string(),
+  reason: z32.enum(["approved", "changes_requested", "finished"]).optional()
+});
+var ConnectAgentRequestSchema = z32.object({
+  sessionId: z32.string()
+});
+var ReportAgentStatusRequestSchema = z32.object({
+  sessionId: z32.string(),
+  status: z32.string(),
   /** Why the agent reports this status (e.g. "user_question" while an AskUserQuestion questionnaire is pending in the TUI). */
-  reason: z3.string().optional(),
+  reason: z32.string().optional(),
   /**
    * The pending question text, sent only alongside `reason: "user_question"`
    * so the server can surface it in the user-question notification body (and
    * thus the Attention feed) instead of a generic string. Optional: older
    * agents omit it and the server falls back to the generic wording.
    */
-  questionText: z3.string().optional()
+  questionText: z32.string().optional()
 });
-var NotifyAgentVersionRequestSchema = z3.object({
-  sessionId: z3.string(),
-  agentVersion: z3.string()
+var NotifyAgentVersionRequestSchema = z32.object({
+  sessionId: z32.string(),
+  agentVersion: z32.string()
 });
-var DiscoveredPortSchema = z3.object({
-  port: z3.number().int().min(1).max(65535),
-  label: z3.string().min(1).max(64).optional(),
-  protocol: z3.enum(["http", "tcp"]).optional(),
-  detectedAt: z3.string()
+var DiscoveredPortSchema = z32.object({
+  port: z32.number().int().min(1).max(65535),
+  label: z32.string().min(1).max(64).optional(),
+  protocol: z32.enum(["http", "tcp"]).optional(),
+  detectedAt: z32.string()
 });
-var ReportDiscoveredPortsRequestSchema = z3.object({
-  sessionId: z3.string(),
-  ports: z3.array(DiscoveredPortSchema).max(64)
+var ReportDiscoveredPortsRequestSchema = z32.object({
+  sessionId: z32.string(),
+  ports: z32.array(DiscoveredPortSchema).max(64)
 });
-var ReportBootMilestoneRequestSchema = z3.object({
-  sessionId: z3.string(),
-  key: z3.string().max(64)
+var ReportBootMilestoneRequestSchema = z32.object({
+  sessionId: z32.string(),
+  key: z32.string().max(64)
 });
-var CreateSubtaskRequestSchema = z3.object({
-  sessionId: z3.string(),
-  title: z3.string().min(1),
+var CreateSubtaskRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().min(1),
   description: cardDescription,
-  plan: z3.string().optional(),
-  storyPointValue: z3.number().int().positive().optional(),
-  ordinal: z3.number().int().nonnegative().optional(),
-  followParentStatus: z3.boolean().optional(),
+  plan: z32.string().optional(),
+  storyPointValue: z32.number().int().positive().optional(),
+  ordinal: z32.number().int().nonnegative().optional(),
+  followParentStatus: z32.boolean().optional(),
   /** Sibling subtask ids or slugs this subtask blocks on (explicit dependency
    * metadata — preferred over encoding order in plan text / ordinal). */
-  dependsOn: z3.array(z3.string().min(1)).max(32).optional(),
+  dependsOn: z32.array(z32.string().min(1)).max(32).optional(),
   /** Glossary tag names to assign to the child. Unmatched names come back in
    * the response rather than failing the create. */
-  tags: z3.array(z3.string().min(1)).max(10).optional()
+  tags: z32.array(z32.string().min(1)).max(10).optional()
 });
-var UpdateSubtaskRequestSchema = z3.object({
-  sessionId: z3.string(),
-  subtaskId: z3.string(),
-  title: z3.string().min(1).optional(),
+var UpdateSubtaskRequestSchema = z32.object({
+  sessionId: z32.string(),
+  subtaskId: z32.string(),
+  title: z32.string().min(1).optional(),
   description: cardDescription,
-  plan: z3.string().optional(),
+  plan: z32.string().optional(),
   /** Orchestration statuses only ("Planning" | "Open") — the pack parent's
    * sanctioned promotion path. Execution statuses stay with the build
    * pipeline / force_update_task_status. Enforced server-side. */
-  status: z3.string().optional(),
+  status: z32.string().optional(),
   /** Assign a project agent to the child — accepts the agent's id or exact
    * name; resolved against the parent task's project server-side. */
-  agentIdOrName: z3.string().min(1).optional(),
-  storyPointValue: z3.number().int().positive().optional(),
-  followParentStatus: z3.boolean().optional(),
+  agentIdOrName: z32.string().min(1).optional(),
+  storyPointValue: z32.number().int().positive().optional(),
+  followParentStatus: z32.boolean().optional(),
   /** Replace this subtask's dependency edges with these sibling ids/slugs.
    * Empty array clears all. Omit to leave dependencies unchanged. */
-  dependsOn: z3.array(z3.string().min(1)).max(32).optional()
+  dependsOn: z32.array(z32.string().min(1)).max(32).optional()
 });
-var DeleteSubtaskRequestSchema = z3.object({
-  sessionId: z3.string(),
-  subtaskId: z3.string()
+var DeleteSubtaskRequestSchema = z32.object({
+  sessionId: z32.string(),
+  subtaskId: z32.string()
 });
-var SetSubtaskParentRequestSchema = z3.object({
-  sessionId: z3.string(),
-  taskId: z3.string().min(1),
-  detach: z3.boolean().optional(),
-  ordinal: z3.number().int().nonnegative().optional(),
-  followParentStatus: z3.boolean().optional()
+var SetSubtaskParentRequestSchema = z32.object({
+  sessionId: z32.string(),
+  taskId: z32.string().min(1),
+  detach: z32.boolean().optional(),
+  ordinal: z32.number().int().nonnegative().optional(),
+  followParentStatus: z32.boolean().optional()
 });
-var GetTaskPropertiesRequestSchema = z3.object({
-  sessionId: z3.string()
+var GetTaskPropertiesRequestSchema = z32.object({
+  sessionId: z32.string()
 });
-var UpdateTaskFieldsRequestSchema = z3.object({
-  sessionId: z3.string(),
-  plan: z3.string().optional(),
+var UpdateTaskFieldsRequestSchema = z32.object({
+  sessionId: z32.string(),
+  plan: z32.string().optional(),
   description: cardDescription
 });
-var UpdateTaskPropertiesRequestSchema = z3.object({
-  sessionId: z3.string(),
-  title: z3.string().optional(),
-  storyPointValue: z3.number().int().positive().optional(),
-  tagIds: z3.array(z3.string()).optional(),
-  tagNames: z3.array(z3.string()).optional(),
-  githubPRUrl: z3.string().url().optional(),
-  githubBranch: z3.string().optional(),
+var UpdateTaskPropertiesRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().optional(),
+  storyPointValue: z32.number().int().positive().optional(),
+  tagIds: z32.array(z32.string()).optional(),
+  tagNames: z32.array(z32.string()).optional(),
+  githubPRUrl: z32.string().url().optional(),
+  githubBranch: z32.string().optional(),
   // Canonical risk level, or null to clear — same semantics as the headless
   // update_task boundary (resolved to the project's Risk row in the handler).
   risk: riskLevelSchema.nullable().optional()
 });
-var ListIconsRequestSchema = z3.object({
-  sessionId: z3.string()
+var ListIconsRequestSchema = z32.object({
+  sessionId: z32.string()
 });
-var GenerateTaskIconRequestSchema = z3.object({
-  sessionId: z3.string(),
-  prompt: z3.string().min(1),
-  aspectRatio: z3.string().optional()
+var GenerateTaskIconRequestSchema = z32.object({
+  sessionId: z32.string(),
+  prompt: z32.string().min(1),
+  aspectRatio: z32.string().optional()
 });
-var SearchFaIconsRequestSchema = z3.object({
-  sessionId: z3.string(),
-  query: z3.string().min(1),
-  first: z3.number().int().positive().optional()
+var SearchFaIconsRequestSchema = z32.object({
+  sessionId: z32.string(),
+  query: z32.string().min(1),
+  first: z32.number().int().positive().optional()
 });
-var PickFaIconRequestSchema = z3.object({
-  sessionId: z3.string(),
-  fontAwesomeId: z3.string().min(1),
-  fontAwesomeStyle: z3.string().optional()
+var PickFaIconRequestSchema = z32.object({
+  sessionId: z32.string(),
+  fontAwesomeId: z32.string().min(1),
+  fontAwesomeStyle: z32.string().optional()
 });
-var CreateFollowUpTaskRequestSchema = z3.object({
-  sessionId: z3.string(),
-  title: z3.string().min(1),
+var CreateFollowUpTaskRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().min(1),
   description: cardDescription,
-  plan: z3.string().optional(),
-  storyPointValue: z3.number().int().positive().optional()
+  plan: z32.string().optional(),
+  storyPointValue: z32.number().int().positive().optional()
 });
-var AddDependencyRequestSchema = z3.object({
-  sessionId: z3.string(),
-  dependsOnSlugOrId: z3.string()
+var AddDependencyRequestSchema = z32.object({
+  sessionId: z32.string(),
+  dependsOnSlugOrId: z32.string()
 });
-var RemoveDependencyRequestSchema = z3.object({
-  sessionId: z3.string(),
-  dependsOnSlugOrId: z3.string()
+var RemoveDependencyRequestSchema = z32.object({
+  sessionId: z32.string(),
+  dependsOnSlugOrId: z32.string()
 });
-var CreateSuggestionRequestSchema = z3.object({
-  sessionId: z3.string(),
-  title: z3.string().min(1),
+var CreateSuggestionRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().min(1),
   description: cardDescription,
-  tagNames: z3.array(z3.string()).optional()
+  tagNames: z32.array(z32.string()).optional()
 });
-var VoteSuggestionRequestSchema = z3.object({
-  sessionId: z3.string(),
-  suggestionId: z3.string(),
-  value: z3.union([z3.literal(1), z3.literal(-1)])
+var VoteSuggestionRequestSchema = z32.object({
+  sessionId: z32.string(),
+  suggestionId: z32.string(),
+  value: z32.union([z32.literal(1), z32.literal(-1)])
 });
-var TriggerIdentificationRequestSchema = z3.object({
-  sessionId: z3.string()
+var TriggerIdentificationRequestSchema = z32.object({
+  sessionId: z32.string()
 });
-var HandoffToImplementerRequestSchema = z3.object({
-  sessionId: z3.string(),
+var HandoffToImplementerRequestSchema = z32.object({
+  sessionId: z32.string(),
   // Optional difficulty sizing — sets the task's story points before resolving
   // the matched implementer agent. Omit to hand off using the task's current
   // story points (or the project's default task agent when unsized).
-  storyPoints: z3.number().int().positive().optional(),
+  storyPoints: z32.number().int().positive().optional(),
   // Optional kickoff note posted to the task chat alongside the handoff notice.
-  message: z3.string().optional()
+  message: z32.string().optional()
 });
-var SubmitCodeReviewResultRequestSchema = z3.object({
-  sessionId: z3.string(),
-  approved: z3.boolean(),
-  content: z3.string(),
+var SubmitCodeReviewResultRequestSchema = z32.object({
+  sessionId: z32.string(),
+  approved: z32.boolean(),
+  content: z32.string(),
   // Canonical risk level the reviewer assigned to this change. Required on every
   // verdict — the reviewer must judge it. Applied authoritatively server-side
   // (may raise OR lower an already-set value; the reviewer has that authority).
@@ -2297,165 +2349,168 @@ var SubmitCodeReviewResultRequestSchema = z3.object({
   // The commit SHA the reviewer actually reviewed. When present, the verdict is
   // rejected unless the task is still at this SHA (guards against a late
   // old-SHA verdict overwriting a newer review cycle).
-  reviewedSha: z3.string().optional()
-});
-var CycleCodingAgentKeyRequestSchema = z3.object({
-  sessionId: z3.string(),
-  rateLimitType: z3.string(),
-  resetsAt: z3.string().optional()
-});
-var PostChildChatMessageRequestSchema = z3.object({
-  sessionId: z3.string(),
-  childTaskId: z3.string(),
-  message: z3.string().min(1)
-});
-var UpdateChildStatusRequestSchema = z3.object({
-  sessionId: z3.string(),
-  childTaskId: z3.string(),
-  status: z3.string()
-});
-var GetAgentStatusRequestSchema = z3.object({
-  taskId: z3.string()
-});
-var GetUiCliHistoryRequestSchema = z3.object({
-  taskId: z3.string()
-});
-var GetActivePtySessionRequestSchema = z3.object({
-  taskId: z3.string()
-});
-var ListActivePtySessionsRequestSchema = z3.object({
-  taskId: z3.string()
-});
-var SendSoftStopRequestSchema = z3.object({
-  taskId: z3.string()
-});
-var StopTaskSessionRequestSchema = z3.object({
-  taskId: z3.string(),
-  sessionId: z3.string()
-});
-var FlushTaskQueueRequestSchema = z3.object({
-  taskId: z3.string(),
-  softStop: z3.boolean().optional()
-});
-var CancelTaskQueuedMessageRequestSchema = z3.object({
-  taskId: z3.string(),
-  messageId: z3.string()
-});
-var FlushSingleQueuedMessageRequestSchema = z3.object({
-  taskId: z3.string(),
-  messageId: z3.string(),
-  softStop: z3.boolean().optional()
-});
-var AnswerAgentQuestionRequestSchema = z3.object({
-  taskId: z3.string(),
-  requestId: z3.string(),
-  answers: z3.record(z3.string(), z3.string())
-});
-var ClearAgentTodosRequestSchema = z3.object({
-  taskId: z3.string()
-});
-var AgentQuestionOptionSchema = z3.object({
-  label: z3.string(),
-  description: z3.string(),
-  preview: z3.string().optional()
-});
-var AgentQuestionSchema = z3.object({
-  question: z3.string(),
-  header: z3.string(),
-  options: z3.array(AgentQuestionOptionSchema),
-  multiSelect: z3.boolean().optional()
-});
-var AskUserQuestionRequestSchema = z3.object({
-  sessionId: z3.string(),
-  question: z3.string().min(1),
-  requestId: z3.string().min(1),
-  questions: z3.array(AgentQuestionSchema).min(1)
-});
-var PostAgentMessageRequestSchema = z3.object({
-  sessionId: z3.string().min(1),
-  content: z3.string(),
-  milestone: z3.enum(["plan_ready", "implementation_complete", "blocked"]).optional()
-});
-var EmitAgentEventRequestSchema = z3.object({
-  sessionId: z3.string(),
-  events: z3.array(AgentEventSchema).max(500)
-});
-var RefreshGithubTokenRequestSchema = z3.object({
-  sessionId: z3.string(),
-  forceFresh: z3.boolean().optional()
-});
-var ReportCredentialFailureRequestSchema = z3.object({
-  sessionId: z3.string(),
-  error: z3.string().max(2e3).optional(),
-  tokenShape: z3.string().max(500).optional(),
-  healed: z3.boolean().optional()
-});
-var ReportReviewSpawnFailureRequestSchema = z3.object({
-  sessionId: z3.string(),
-  reviewSessionId: z3.string(),
-  error: z3.string().max(2e3).optional()
+  reviewedSha: z32.string().optional()
+});
+var CycleCodingAgentKeyRequestSchema = z32.object({
+  sessionId: z32.string(),
+  rateLimitType: z32.string(),
+  resetsAt: z32.string().optional()
+});
+var PostChildChatMessageRequestSchema = z32.object({
+  sessionId: z32.string(),
+  childTaskId: z32.string(),
+  message: z32.string().min(1)
+});
+var UpdateChildStatusRequestSchema = z32.object({
+  sessionId: z32.string(),
+  childTaskId: z32.string(),
+  status: z32.string()
+});
+var GetAgentStatusRequestSchema = z32.object({
+  taskId: z32.string()
+});
+var GetUiCliHistoryRequestSchema = z32.object({
+  taskId: z32.string()
+});
+var GetActivePtySessionRequestSchema = z32.object({
+  taskId: z32.string()
+});
+var ListActivePtySessionsRequestSchema = z32.object({
+  taskId: z32.string()
+});
+var SendSoftStopRequestSchema = z32.object({
+  taskId: z32.string()
+});
+var StopTaskSessionRequestSchema = z32.object({
+  taskId: z32.string(),
+  sessionId: z32.string()
+});
+var FlushTaskQueueRequestSchema = z32.object({
+  taskId: z32.string(),
+  softStop: z32.boolean().optional()
+});
+var CancelTaskQueuedMessageRequestSchema = z32.object({
+  taskId: z32.string(),
+  messageId: z32.string()
+});
+var FlushSingleQueuedMessageRequestSchema = z32.object({
+  taskId: z32.string(),
+  messageId: z32.string(),
+  softStop: z32.boolean().optional()
+});
+var AnswerAgentQuestionRequestSchema = z32.object({
+  taskId: z32.string(),
+  requestId: z32.string(),
+  answers: z32.record(z32.string(), z32.string())
+});
+var ClearAgentTodosRequestSchema = z32.object({
+  taskId: z32.string()
+});
+var AgentQuestionOptionSchema = z32.object({
+  label: z32.string(),
+  description: z32.string(),
+  preview: z32.string().optional()
+});
+var AgentQuestionSchema = z32.object({
+  question: z32.string(),
+  header: z32.string(),
+  options: z32.array(AgentQuestionOptionSchema),
+  multiSelect: z32.boolean().optional()
+});
+var AskUserQuestionRequestSchema = z32.object({
+  sessionId: z32.string(),
+  question: z32.string().min(1),
+  requestId: z32.string().min(1),
+  questions: z32.array(AgentQuestionSchema).min(1)
+});
+var PostAgentMessageRequestSchema = z32.object({
+  sessionId: z32.string().min(1),
+  content: z32.string(),
+  milestone: z32.enum(["plan_ready", "implementation_complete", "blocked"]).optional()
+});
+var EmitAgentEventRequestSchema = z32.object({
+  sessionId: z32.string(),
+  events: z32.array(AgentEventSchema).max(500)
+});
+var RefreshGithubTokenRequestSchema = z32.object({
+  sessionId: z32.string(),
+  forceFresh: z32.boolean().optional()
+});
+var ReportCredentialFailureRequestSchema = z32.object({
+  sessionId: z32.string(),
+  error: z32.string().max(2e3).optional(),
+  tokenShape: z32.string().max(500).optional(),
+  healed: z32.boolean().optional()
+});
+var ReportReviewSpawnFailureRequestSchema = z32.object({
+  sessionId: z32.string(),
+  reviewSessionId: z32.string(),
+  error: z32.string().max(2e3).optional()
 });
 var ReportBuilderSpawnFailureRequestSchema = ReportReviewSpawnFailureRequestSchema.omit({
   reviewSessionId: true
-}).extend({ buildSessionId: z3.string() });
-var SpawnTaskSessionRequestSchema = z3.object({
-  taskId: z3.string(),
-  kind: z3.enum(["tui", "shell"])
+}).extend({ buildSessionId: z32.string() });
+var SpawnTaskSessionRequestSchema = z32.object({
+  taskId: z32.string(),
+  kind: z32.enum(["tui", "shell"])
 });
-var StartCodeReviewRequestSchema = z3.object({
-  taskId: z3.string(),
-  force: z3.boolean().optional()
+var StartCodeReviewRequestSchema = z32.object({
+  taskId: z32.string(),
+  force: z32.boolean().optional()
 });
-var StopCodeReviewRequestSchema = z3.object({
-  taskId: z3.string()
+var StopCodeReviewRequestSchema = z32.object({
+  taskId: z32.string()
 });
-var ReportSessionSpawnFailureRequestSchema = z3.object({
-  sessionId: z3.string(),
-  spawnedSessionId: z3.string(),
-  error: z3.string().max(2e3).optional()
+var ReportSessionSpawnFailureRequestSchema = z32.object({
+  sessionId: z32.string(),
+  spawnedSessionId: z32.string(),
+  error: z32.string().max(2e3).optional()
 });
-var RefreshGithubTokenResponseSchema = z3.object({
-  token: z3.string()
+var RefreshGithubTokenResponseSchema = z32.object({
+  token: z32.string()
 });
 var PTY_FRAME_MAX_CHARS = 256 * 1024;
 var PTY_MAX_DIMENSION = 1e3;
-var PtyOutputRequestSchema = z3.object({
-  sessionId: z3.string(),
-  data: z3.string().max(PTY_FRAME_MAX_CHARS),
-  cols: z3.number().int().positive().max(PTY_MAX_DIMENSION).optional(),
-  rows: z3.number().int().positive().max(PTY_MAX_DIMENSION).optional()
-});
-var PtyEndedRequestSchema = z3.object({
-  sessionId: z3.string()
-});
-var PtyInputRequestSchema = z3.object({
-  sessionId: z3.string(),
-  data: z3.string().max(PTY_FRAME_MAX_CHARS)
-});
-var PtyResizeRequestSchema = z3.object({
-  sessionId: z3.string(),
-  cols: z3.number().int().positive().max(PTY_MAX_DIMENSION),
-  rows: z3.number().int().positive().max(PTY_MAX_DIMENSION)
-});
-var PtyAttachRequestSchema = z3.object({
-  sessionId: z3.string()
-});
-var ReportPtyStreamRequestSchema = z3.object({
-  sessionId: z3.string(),
-  port: z3.number().int().positive().max(65535).nullable()
-});
-var GetPtyStreamEndpointRequestSchema = z3.object({
-  sessionId: z3.string()
-});
-var PtyChatEventPayloadSchema = z3.discriminatedUnion("kind", [
-  z3.object({
-    kind: z3.literal("init"),
-    model: z3.string().max(200),
-    claudeSessionId: z3.string().max(100).optional()
+var PtyOutputRequestSchema = z32.object({
+  sessionId: z32.string(),
+  data: z32.string().max(PTY_FRAME_MAX_CHARS),
+  cols: z32.number().int().positive().max(PTY_MAX_DIMENSION).optional(),
+  rows: z32.number().int().positive().max(PTY_MAX_DIMENSION).optional()
+});
+var PtyEndedRequestSchema = z32.object({
+  sessionId: z32.string()
+});
+var PtyInputRequestSchema = z32.object({
+  sessionId: z32.string(),
+  data: z32.string().max(PTY_FRAME_MAX_CHARS)
+});
+var PtyResizeRequestSchema = z32.object({
+  sessionId: z32.string(),
+  cols: z32.number().int().positive().max(PTY_MAX_DIMENSION),
+  rows: z32.number().int().positive().max(PTY_MAX_DIMENSION)
+});
+var PtyAttachRequestSchema = z32.object({
+  sessionId: z32.string()
+});
+var ReportPtyStreamRequestSchema = z32.object({
+  sessionId: z32.string(),
+  port: z32.number().int().positive().max(65535).nullable()
+});
+var ReportPtyInputRequestSchema = z32.object({
+  sessionId: z32.string()
+});
+var GetPtyStreamEndpointRequestSchema = z32.object({
+  sessionId: z32.string()
+});
+var PtyChatEventPayloadSchema = z32.discriminatedUnion("kind", [
+  z32.object({
+    kind: z32.literal("init"),
+    model: z32.string().max(200),
+    claudeSessionId: z32.string().max(100).optional()
   }),
-  z3.object({
-    kind: z3.literal("user_text"),
-    text: z3.string().max(16384),
+  z32.object({
+    kind: z32.literal("user_text"),
+    text: z32.string().max(16384),
     // Set by the SERVER (never the agent) when this prompt was injected by
     // Conveyor rather than typed by a human — the routed message's `source`
     // (`ci_success`, `review_trigger`, `automated_feedback`, …). The agent
@@ -2463,69 +2518,69 @@ var PtyChatEventPayloadSchema = z3.discriminatedUnion("kind", [
     // CLI records both as plain transcript `user` records; without this the
     // builder chat renders "All CI checks passed on your PR." as the human's
     // own bubble. Absent ⇒ a genuine human prompt.
-    source: z3.string().max(60).optional()
+    source: z32.string().max(60).optional()
   }),
-  z3.object({ kind: z3.literal("assistant_text"), text: z3.string().max(16384) }),
-  z3.object({
-    kind: z3.literal("tool_use"),
-    name: z3.string().max(200),
+  z32.object({ kind: z32.literal("assistant_text"), text: z32.string().max(16384) }),
+  z32.object({
+    kind: z32.literal("tool_use"),
+    name: z32.string().max(200),
     // Compact preview: JSON.stringify(input) truncated agent-side. The cap
     // matches the text events because AskUserQuestion payloads ride this field
     // and the web lifts them into an interactive card — a tight cap forced
     // option descriptions down to 80 chars, making them unreadable. Every
     // other tool keeps a far smaller agent-side budget (`TOOL_INPUT_MAX` in
     // `chat-record-mapper.ts`), so the ring does not grow for normal calls.
-    input: z3.string().max(16384),
+    input: z32.string().max(16384),
     // Transcript tool_use block id — lets the client pair the tool_result.
-    id: z3.string().max(100).optional()
+    id: z32.string().max(100).optional()
   }),
-  z3.object({
-    kind: z3.literal("tool_result"),
+  z32.object({
+    kind: z32.literal("tool_result"),
     // tool_use block id this result answers (absent on malformed records).
-    toolUseId: z3.string().max(100).optional(),
+    toolUseId: z32.string().max(100).optional(),
     // Compact output preview, truncated agent-side.
-    output: z3.string().max(2e3),
-    isError: z3.boolean().optional()
+    output: z32.string().max(2e3),
+    isError: z32.boolean().optional()
   }),
-  z3.object({ kind: z3.literal("turn_end") })
+  z32.object({ kind: z32.literal("turn_end") })
 ]);
-var PtyChatEventRequestSchema = z3.object({
-  sessionId: z3.string(),
+var PtyChatEventRequestSchema = z32.object({
+  sessionId: z32.string(),
   event: PtyChatEventPayloadSchema
 });
-var PtyChatAttachRequestSchema = z3.object({
-  sessionId: z3.string()
+var PtyChatAttachRequestSchema = z32.object({
+  sessionId: z32.string()
 });
-var CreatePRResponseSchema = z3.object({
-  prNumber: z3.number().int().positive(),
-  prUrl: z3.string().url(),
+var CreatePRResponseSchema = z32.object({
+  prNumber: z32.number().int().positive(),
+  prUrl: z32.string().url(),
   /** Advisory glossary-upkeep note derived from the PR's changed files matched
    *  against tag contextPaths — rendered into the tool result, never stored. */
-  glossaryNote: z3.string().optional()
+  glossaryNote: z32.string().optional()
 });
-var PostToChatResponseSchema = z3.object({
-  messageId: z3.string()
+var PostToChatResponseSchema = z32.object({
+  messageId: z32.string()
 });
-var UpdateTaskStatusResponseSchema = z3.object({
-  taskId: z3.string(),
-  status: z3.string()
+var UpdateTaskStatusResponseSchema = z32.object({
+  taskId: z32.string(),
+  status: z32.string()
 });
-var StoreSessionIdResponseSchema = z3.object({
-  success: z3.boolean()
+var StoreSessionIdResponseSchema = z32.object({
+  success: z32.boolean()
 });
-var HeartbeatResponseSchema = z3.object({
-  acknowledged: z3.boolean()
+var HeartbeatResponseSchema = z32.object({
+  acknowledged: z32.boolean()
 });
-var SessionStartResponseSchema = z3.object({
-  sessionId: z3.string(),
-  startedAt: z3.string()
+var SessionStartResponseSchema = z32.object({
+  sessionId: z32.string(),
+  startedAt: z32.string()
 });
-var SessionStopResponseSchema = z3.object({
-  sessionId: z3.string(),
-  stoppedAt: z3.string()
+var SessionStopResponseSchema = z32.object({
+  sessionId: z32.string(),
+  stoppedAt: z32.string()
 });
-var DeleteSubtaskResponseSchema = z3.object({
-  deleted: z3.boolean()
+var DeleteSubtaskResponseSchema = z32.object({
+  deleted: z32.boolean()
 });
 var ParkOnCheckResultRequestSchema = z4.object({
   sessionId: z4.string(),
@@ -2561,6 +2616,11 @@ var ListProjectTasksRequestSchema = z5.object({
   // Scope to a sub-project board when provided. Unlike the board layer's `?? null`
   // semantics, agents default to seeing the whole project when omitted.
   subProjectId: z5.string().nullable().optional(),
+  // Plain equality on the on-hold flag: true = only parked cards, false =
+  // exclude them, omitted = both. Deliberately NOT the board's
+  // includeOnHold/surfaceActiveWork bucketing — an agent sweeping a backlog
+  // needs the raw column, not a column projection.
+  onHold: z5.boolean().optional(),
   limit: z5.number().int().positive().optional().default(50)
 }).refine((p) => !(p.unassigned && p.assigneeId), {
   message: "Pass either assigneeId or unassigned, not both"
@@ -2595,7 +2655,9 @@ var SearchProjectTasksRequestSchema = z5.object({
   message: "Pass either assigneeId or unassigned, not both"
 });
 var ListProjectTagsRequestSchema = z5.object({
-  projectId: z5.string()
+  projectId: z5.string(),
+  /** "summary" (default) omits inline context links; "full" includes them. */
+  detail: z5.enum(["summary", "full"]).optional()
 });
 var GetProjectTagRequestSchema = z5.object({
   projectId: z5.string(),
@@ -2698,11 +2760,15 @@ var UpdateProjectTaskRequestSchema = z5.object({
   // handler: the ref must exist on origin and no live workspace may be bound
   // to a different branch.
   githubBranch: z5.string().min(1).max(GIT_BRANCH_NAME_MAX).refine(isValidGitBranchName, { message: GIT_BRANCH_NAME_MESSAGE }).nullable().optional(),
+  // Park the card on hold (true) or return it to the active board (false).
+  // The handler mirrors the web path's two side effects: a board re-bucket
+  // event, and demotion to Open when an active-work card is parked.
+  onHold: z5.boolean().optional(),
   requestingUserId: z5.string().optional()
 }).strict().refine(
-  (v) => v.title !== void 0 || v.description !== void 0 || v.plan !== void 0 || v.status !== void 0 || v.risk !== void 0 || v.storyPointValue !== void 0 || v.assignedUserId !== void 0 || v.subProjectId !== void 0 || v.githubBranch !== void 0,
+  (v) => v.title !== void 0 || v.description !== void 0 || v.plan !== void 0 || v.status !== void 0 || v.risk !== void 0 || v.storyPointValue !== void 0 || v.assignedUserId !== void 0 || v.subProjectId !== void 0 || v.githubBranch !== void 0 || v.onHold !== void 0,
   {
-    message: "update_task requires at least one field to change (title, description, plan, status, risk, storyPointValue, assignedUserId, subProjectId, or githubBranch)"
+    message: "update_task requires at least one field to change (title, description, plan, status, risk, storyPointValue, assignedUserId, subProjectId, githubBranch, or onHold)"
   }
 );
 var TransitionProjectTaskStatusRequestSchema = z5.object({
@@ -3023,7 +3089,7 @@ var QueryProjectManualTestsRequestSchema = z5.object({
 var SetProjectManualTestsRequestSchema = z5.object({
   projectId: z5.string(),
   taskId: z5.string(),
-  items: z5.array(z5.object({ title: z5.string().min(1) })).min(1),
+  items: ManualTestItemsSchema,
   requestingUserId: z5.string().optional()
 });
 var EditProjectManualTestRequestSchema = z5.object({
@@ -3102,42 +3168,6 @@ var ReportApiOutageRequestSchema = z7.object({
   detail: z7.string().max(2e3),
   attempts: z7.number().int().min(0).max(100)
 });
-var SHA_PATTERN = /^[0-9a-f]{40}$/i;
-var ReviewGuideFileReferenceSchema = z8.object({
-  path: z8.string().min(1).max(500),
-  startLine: z8.number().int().positive().max(1e6).optional(),
-  endLine: z8.number().int().positive().max(1e6).optional(),
-  hunkHeader: z8.string().min(1).max(300).optional()
-}).strict().superRefine((value, ctx) => {
-  if (value.endLine !== void 0 && value.startLine === void 0) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["startLine"],
-      message: "startLine is required when endLine is set"
-    });
-  }
-  if (value.startLine !== void 0 && value.endLine !== void 0 && value.endLine < value.startLine) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["endLine"],
-      message: "endLine must be greater than or equal to startLine"
-    });
-  }
-});
-var ReviewGuideSectionSchema = z8.object({
-  title: z8.string().min(1).max(160),
-  explanation: z8.string().min(1).max(2e3),
-  classification: z8.enum(["core", "supporting"]).optional(),
-  files: z8.array(ReviewGuideFileReferenceSchema).min(1).max(20)
-}).strict();
-var ReviewGuideContentSchema = z8.object({
-  overview: z8.string().min(1).max(3e3),
-  sections: z8.array(ReviewGuideSectionSchema).min(1).max(12)
-}).strict();
-var PublishReviewGuideRequestSchema = ReviewGuideContentSchema.extend({
-  sessionId: z8.string().min(1),
-  reviewedSha: z8.string().regex(SHA_PATTERN, "reviewedSha must be a 40-character commit SHA")
-}).strict();
 var CONTEXT_LINK_LOCATOR_MAX = 300;
 var TEST_TITLE = /\b(?:it|test|describe)(?:\.\w+)?\s*\(\s*(['"`])((?:(?!\1)[\s\S])*)\1/g;
 function extractTestTitles(content) {
@@ -3153,130 +3183,130 @@ function locatorMatchesContent(content, locatorType, locator) {
 var TAG_DESCRIPTION_MAX = CARD_DESCRIPTION_MAX;
 var TAG_OVERVIEW_MAX = 32e3;
 var TAG_REASON_MAX = 500;
-var ProjectTagContextPathSchema = z9.object({
-  type: z9.enum(["rule", "doc", "file", "folder"]),
-  path: z9.string().min(1).max(500),
-  label: z9.string().max(100).optional(),
+var ProjectTagContextPathSchema = z8.object({
+  type: z8.enum(["rule", "doc", "file", "folder"]),
+  path: z8.string().min(1).max(500),
+  label: z8.string().max(100).optional(),
   /** Verified-link tether — text that must keep existing in the file. */
-  locator: z9.string().min(1).max(CONTEXT_LINK_LOCATOR_MAX).regex(/^[^\r\n]*$/, "Locator cannot contain line breaks").optional(),
+  locator: z8.string().min(1).max(CONTEXT_LINK_LOCATOR_MAX).regex(/^[^\r\n]*$/, "Locator cannot contain line breaks").optional(),
   /** test = must appear in a real test/describe title; code = any substring. */
-  locatorType: z9.enum(["test", "code"]).optional()
+  locatorType: z8.enum(["test", "code"]).optional()
 }).refine((link) => link.locator === void 0 === (link.locatorType === void 0), {
   message: "locator and locatorType must be provided together"
 }).refine((link) => link.locator === void 0 || link.type !== "folder", {
   message: "folder links cannot carry a locator"
 });
-var hexColor = z9.string().regex(/^#[0-9a-fA-F]{6}$/, "Expected #RRGGBB hex color");
-var overviewPathSchema = z9.string().min(1).max(500).regex(/^[^\r\n]*$/, "Overview path cannot contain line breaks");
-var CreateProjectTagRequestSchema = z9.object({
-  projectId: z9.string(),
-  name: z9.string().min(1).max(50),
+var hexColor = z8.string().regex(/^#[0-9a-fA-F]{6}$/, "Expected #RRGGBB hex color");
+var overviewPathSchema = z8.string().min(1).max(500).regex(/^[^\r\n]*$/, "Overview path cannot contain line breaks");
+var CreateProjectTagRequestSchema = z8.object({
+  projectId: z8.string(),
+  name: z8.string().min(1).max(50),
   color: hexColor.optional(),
-  description: z9.string().max(TAG_DESCRIPTION_MAX).optional(),
-  overview: z9.string().max(TAG_OVERVIEW_MAX).optional(),
+  description: z8.string().max(TAG_DESCRIPTION_MAX).optional(),
+  overview: z8.string().max(TAG_OVERVIEW_MAX).optional(),
   /** Source the overview from this repo file (stored overview stays as the pending fallback). */
   overviewPath: overviewPathSchema.optional(),
-  contextPaths: z9.array(ProjectTagContextPathSchema).max(20).optional(),
+  contextPaths: z8.array(ProjectTagContextPathSchema).max(20).optional(),
   /** Parents to link at create time (multi-parent DAG). */
-  parentTagIds: z9.array(z9.string()).max(25).optional(),
-  requestingUserId: z9.string().optional()
+  parentTagIds: z8.array(z8.string()).max(25).optional(),
+  requestingUserId: z8.string().optional()
 });
-var UpdateProjectTagRequestSchema = z9.object({
-  projectId: z9.string(),
-  tagId: z9.string(),
-  name: z9.string().min(1).max(50).optional(),
+var UpdateProjectTagRequestSchema = z8.object({
+  projectId: z8.string(),
+  tagId: z8.string(),
+  name: z8.string().min(1).max(50).optional(),
   color: hexColor.optional(),
-  description: z9.string().max(TAG_DESCRIPTION_MAX).optional(),
+  description: z8.string().max(TAG_DESCRIPTION_MAX).optional(),
   /** Full markdown glossary body; null clears it. Rejected while overviewPath is set. */
-  overview: z9.string().max(TAG_OVERVIEW_MAX).nullable().optional(),
+  overview: z8.string().max(TAG_OVERVIEW_MAX).nullable().optional(),
   /** Repo file to source the overview from; null clears back to the stored overview. */
   overviewPath: overviewPathSchema.nullable().optional(),
   /** Full replacement of the tag's context links when provided. */
-  contextPaths: z9.array(ProjectTagContextPathSchema).max(20).optional(),
+  contextPaths: z8.array(ProjectTagContextPathSchema).max(20).optional(),
   /** Full-set replacement of the tag's parent tags (multi-parent DAG). */
-  parentTagIds: z9.array(z9.string()).max(25).optional(),
+  parentTagIds: z8.array(z8.string()).max(25).optional(),
   /** One-line revision provenance, recorded in the tag's history. */
-  reason: z9.string().max(TAG_REASON_MAX).optional(),
+  reason: z8.string().max(TAG_REASON_MAX).optional(),
   /** Card the caller was working in — stamped into the revision history. */
-  taskId: z9.string().optional(),
-  requestingUserId: z9.string().optional()
+  taskId: z8.string().optional(),
+  requestingUserId: z8.string().optional()
 });
-var PostToProjectChatRequestSchema = z9.object({
-  projectId: z9.string(),
-  content: z9.string().min(1).max(2e4),
-  requestingUserId: z9.string().optional(),
+var PostToProjectChatRequestSchema = z8.object({
+  projectId: z8.string(),
+  content: z8.string().min(1).max(2e4),
+  requestingUserId: z8.string().optional(),
   /** Marks the post so the server can persist it beyond chat (tag-audit summaries land in tag history). */
-  kind: z9.enum(["tag_audit_summary"]).optional()
-});
-var StartTagAuditRequestSchema = z9.object({
-  projectId: z9.string(),
-  requestingUserId: z9.string().optional()
-});
-var StartTaskAuditRequestSchema = z9.object({
-  projectId: z9.string(),
-  taskIds: z9.array(z9.string()).min(1).max(20),
-  requestingUserId: z9.string().optional()
-});
-var GetActiveAuditSessionsRequestSchema = z9.object({
-  projectId: z9.string()
-});
-var ReportTaskAuditResultRequestSchema = z9.object({
-  projectId: z9.string(),
-  taskId: z9.string(),
-  summary: z9.string(),
-  turnGrades: z9.array(
-    z9.object({
-      turnIndex: z9.number(),
-      phase: z9.enum(["planning", "building", "human"]),
-      grade: z9.enum(["correct", "neutral", "blunder"]),
-      reasoning: z9.string(),
-      eventType: z9.string(),
-      eventSummary: z9.string()
+  kind: z8.enum(["tag_audit_summary"]).optional()
+});
+var StartTagAuditRequestSchema = z8.object({
+  projectId: z8.string(),
+  requestingUserId: z8.string().optional()
+});
+var StartTaskAuditRequestSchema = z8.object({
+  projectId: z8.string(),
+  taskIds: z8.array(z8.string()).min(1).max(20),
+  requestingUserId: z8.string().optional()
+});
+var GetActiveAuditSessionsRequestSchema = z8.object({
+  projectId: z8.string()
+});
+var ReportTaskAuditResultRequestSchema = z8.object({
+  projectId: z8.string(),
+  taskId: z8.string(),
+  summary: z8.string(),
+  turnGrades: z8.array(
+    z8.object({
+      turnIndex: z8.number(),
+      phase: z8.enum(["planning", "building", "human"]),
+      grade: z8.enum(["correct", "neutral", "blunder"]),
+      reasoning: z8.string(),
+      eventType: z8.string(),
+      eventSummary: z8.string()
     })
   ),
-  planningAccuracy: z9.number().nullable(),
-  buildingAccuracy: z9.number().nullable(),
-  humanAccuracy: z9.number().nullable(),
-  planningCorrect: z9.number(),
-  planningNeutral: z9.number(),
-  planningBlunder: z9.number(),
-  buildingCorrect: z9.number(),
-  buildingNeutral: z9.number(),
-  buildingBlunder: z9.number(),
-  humanCorrect: z9.number(),
-  humanNeutral: z9.number(),
-  humanBlunder: z9.number(),
-  humanEvaluations: z9.array(
-    z9.object({
-      messageIndex: z9.number(),
-      rating: z9.union([z9.literal(-1), z9.literal(0), z9.literal(1)]),
-      reasoning: z9.string()
+  planningAccuracy: z8.number().nullable(),
+  buildingAccuracy: z8.number().nullable(),
+  humanAccuracy: z8.number().nullable(),
+  planningCorrect: z8.number(),
+  planningNeutral: z8.number(),
+  planningBlunder: z8.number(),
+  buildingCorrect: z8.number(),
+  buildingNeutral: z8.number(),
+  buildingBlunder: z8.number(),
+  humanCorrect: z8.number(),
+  humanNeutral: z8.number(),
+  humanBlunder: z8.number(),
+  humanEvaluations: z8.array(
+    z8.object({
+      messageIndex: z8.number(),
+      rating: z8.union([z8.literal(-1), z8.literal(0), z8.literal(1)]),
+      reasoning: z8.string()
     })
   ).optional(),
-  suggestionIds: z9.array(z9.string()),
-  auditCostUsd: z9.number().nullable(),
-  model: z9.string().nullable(),
+  suggestionIds: z8.array(z8.string()),
+  auditCostUsd: z8.number().nullable(),
+  model: z8.string().nullable(),
   /** When set, the audit is marked failed with this message instead. */
-  error: z9.string().optional()
+  error: z8.string().optional()
 });
-var GetTaskAuditsRequestSchema = z9.object({
-  projectId: z9.string(),
-  limit: z9.number().int().positive().max(200).optional().default(50)
+var GetTaskAuditsRequestSchema = z8.object({
+  projectId: z8.string(),
+  limit: z8.number().int().positive().max(200).optional().default(50)
 });
-var GetTaskAuditRequestSchema = z9.object({
-  projectId: z9.string(),
-  auditId: z9.string()
+var GetTaskAuditRequestSchema = z8.object({
+  projectId: z8.string(),
+  auditId: z8.string()
 });
-var GetTaskAuditAggregatesRequestSchema = z9.object({
-  projectId: z9.string()
+var GetTaskAuditAggregatesRequestSchema = z8.object({
+  projectId: z8.string()
 });
-var DeleteTaskAuditRequestSchema = z9.object({
-  projectId: z9.string(),
-  auditId: z9.string(),
-  requestingUserId: z9.string().optional()
+var DeleteTaskAuditRequestSchema = z8.object({
+  projectId: z8.string(),
+  auditId: z8.string(),
+  requestingUserId: z8.string().optional()
 });
-var MarkInitialPromptSubmittedRequestSchema = z9.object({
-  sessionId: z9.string()
+var MarkInitialPromptSubmittedRequestSchema = z8.object({
+  sessionId: z8.string()
 });
 var CRITICAL_AUTOMATED_SOURCES = /* @__PURE__ */ new Set([
   "ci_failure",
@@ -3293,6 +3323,30 @@ var CRITICAL_AUTOMATED_SOURCES = /* @__PURE__ */ new Set([
   // clear the completion guard.
   "ci_result"
 ]);
+var MAX_PREVIEW_LINKS = 8;
+var MAX_PREVIEW_LINK_LABEL = 64;
+var MAX_PREVIEW_LINK_PATH = 512;
+function isSafePreviewPath(path) {
+  if (!path.startsWith("/") || path.startsWith("//")) return false;
+  if (path.length > MAX_PREVIEW_LINK_PATH) return false;
+  return !/[\s\\\u0000-\u001f\u007f]/.test(path);
+}
+function sanitizeSessionPreviewLinks(raw) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const entry of raw) {
+    if (out.length >= MAX_PREVIEW_LINKS) break;
+    if (!entry || typeof entry !== "object") continue;
+    const { label, port, path } = entry;
+    if (typeof label !== "string") continue;
+    const trimmed = label.trim().slice(0, MAX_PREVIEW_LINK_LABEL);
+    if (trimmed.length === 0 || !isAllowablePreviewPort(port)) continue;
+    const resolvedPath = path === void 0 ? "/" : path;
+    if (typeof resolvedPath !== "string" || !isSafePreviewPath(resolvedPath)) continue;
+    out.push({ label: trimmed, port, path: resolvedPath });
+  }
+  return out;
+}
 var DECISION_STATUS_LABELS = ["Open", "Decided", "Cancelled"];
 var DECISION_OPTION_KINDS = ["current", "planned", "proposed"];
 var DECISION_VOTE_SOURCES = ["web", "slack", "discord", "agent"];
@@ -3306,166 +3360,265 @@ var DECISION_DEADLINE_MIN_HOURS = 1;
 var DECISION_DEADLINE_MAX_DAYS = 30;
 var DECISION_DEADLINE_MAX_HOURS = DECISION_DEADLINE_MAX_DAYS * 24;
 var DECISION_LIST_MAX_LIMIT = 200;
-var decisionIdSchema = z10.string().cuid("Invalid decision ID");
-var optionInputSchema = z10.object({
-  label: z10.string().min(1, "Option label is required").max(DECISION_OPTION_LABEL_MAX),
-  description: z10.string().min(1, "Describe the option as GIVEN / WHEN / THEN"),
-  kind: z10.enum(DECISION_OPTION_KINDS).optional()
+var decisionIdSchema = z9.string().cuid("Invalid decision ID");
+var optionInputSchema = z9.object({
+  label: z9.string().min(1, "Option label is required").max(DECISION_OPTION_LABEL_MAX),
+  description: z9.string().min(1, "Describe the option as GIVEN / WHEN / THEN"),
+  kind: z9.enum(DECISION_OPTION_KINDS).optional()
 });
-var optionsArraySchema = z10.array(optionInputSchema).min(DECISION_OPTIONS_MIN, `A decision needs at least ${DECISION_OPTIONS_MIN} options`).max(
+var optionsArraySchema = z9.array(optionInputSchema).min(DECISION_OPTIONS_MIN, `A decision needs at least ${DECISION_OPTIONS_MIN} options`).max(
   DECISION_OPTIONS_MAX,
   `A decision takes at most ${DECISION_OPTIONS_MAX} options \u2014 more than that means the question is not framed yet`
 );
-var CreateDecisionRequestSchema = z10.object({
-  projectId: z10.string().cuid("Invalid project ID"),
+var CreateDecisionRequestSchema = z9.object({
+  projectId: z9.string().cuid("Invalid project ID"),
   /** The question, as one plain sentence. */
-  title: z10.string().min(1, "A decision needs a question").max(DECISION_QUESTION_MAX),
-  description: z10.string().max(CARD_DESCRIPTION_MAX).optional(),
-  context: z10.string().min(1, "Context is required \u2014 say why this is being asked now"),
+  title: z9.string().min(1, "A decision needs a question").max(DECISION_QUESTION_MAX),
+  description: z9.string().max(CARD_DESCRIPTION_MAX).optional(),
+  context: z9.string().min(1, "Context is required \u2014 say why this is being asked now"),
   options: optionsArraySchema,
   /** 1-based position of the option that wins on silence. */
-  defaultOptionOrdinal: z10.number().int().min(1).max(DECISION_OPTIONS_MAX),
-  deadlineHours: z10.number().min(DECISION_DEADLINE_MIN_HOURS).max(DECISION_DEADLINE_MAX_HOURS).optional(),
+  defaultOptionOrdinal: z9.number().int().min(1).max(DECISION_OPTIONS_MAX),
+  deadlineHours: z9.number().min(DECISION_DEADLINE_MIN_HOURS).max(DECISION_DEADLINE_MAX_HOURS).optional(),
   /** Cards this decision blocks, by cuid or slug. */
-  impactedCardRefs: z10.array(z10.string().min(1)).max(50).optional(),
-  tagNames: z10.array(z10.string().min(1)).max(10).optional(),
-  raisedByTaskId: z10.string().min(1).optional(),
-  raisedByPrNumber: z10.number().int().positive().optional()
+  impactedCardRefs: z9.array(z9.string().min(1)).max(50).optional(),
+  tagNames: z9.array(z9.string().min(1)).max(10).optional(),
+  raisedByTaskId: z9.string().min(1).optional(),
+  raisedByPrNumber: z9.number().int().positive().optional()
 });
-var VoteDecisionRequestSchema = z10.object({
+var VoteDecisionRequestSchema = z9.object({
   decisionId: decisionIdSchema,
-  optionId: z10.string().cuid("Invalid option ID"),
-  reason: z10.string().max(DECISION_VOTE_REASON_MAX).optional(),
-  source: z10.enum(DECISION_VOTE_SOURCES).optional()
+  optionId: z9.string().cuid("Invalid option ID"),
+  reason: z9.string().max(DECISION_VOTE_REASON_MAX).optional(),
+  source: z9.enum(DECISION_VOTE_SOURCES).optional()
 });
-var RemoveDecisionVoteRequestSchema = z10.object({
+var RemoveDecisionVoteRequestSchema = z9.object({
   decisionId: decisionIdSchema
 });
-var ResolveDecisionRequestSchema = z10.object({
+var ResolveDecisionRequestSchema = z9.object({
   decisionId: decisionIdSchema,
-  chosenOptionId: z10.string().cuid("Invalid option ID"),
-  resolution: z10.string().min(1, "A resolution is required \u2014 say what was decided").max(DECISION_RESOLUTION_MAX),
-  resolutionNotes: z10.string().optional()
+  chosenOptionId: z9.string().cuid("Invalid option ID"),
+  resolution: z9.string().min(1, "A resolution is required \u2014 say what was decided").max(DECISION_RESOLUTION_MAX),
+  resolutionNotes: z9.string().optional()
 });
-var CancelDecisionRequestSchema = z10.object({
+var CancelDecisionRequestSchema = z9.object({
   decisionId: decisionIdSchema,
   /** Why it is being dropped. Posted to the decision thread. */
-  reason: z10.string().max(DECISION_RESOLUTION_MAX).optional()
+  reason: z9.string().max(DECISION_RESOLUTION_MAX).optional()
 });
-var BulkDecisionIdsRequestSchema = z10.object({
-  projectId: z10.string().cuid("Invalid project ID"),
-  decisionIds: z10.array(z10.string().cuid()).min(1).max(200)
+var BulkDecisionIdsRequestSchema = z9.object({
+  projectId: z9.string().cuid("Invalid project ID"),
+  decisionIds: z9.array(z9.string().cuid()).min(1).max(200)
 });
-var ReopenDecisionRequestSchema = z10.object({
+var ReopenDecisionRequestSchema = z9.object({
   decisionId: decisionIdSchema,
-  deadlineHours: z10.number().min(DECISION_DEADLINE_MIN_HOURS).max(DECISION_DEADLINE_MAX_HOURS).optional()
+  deadlineHours: z9.number().min(DECISION_DEADLINE_MIN_HOURS).max(DECISION_DEADLINE_MAX_HOURS).optional()
 });
-var UpdateDecisionRequestSchema = z10.object({
+var UpdateDecisionRequestSchema = z9.object({
   decisionId: decisionIdSchema,
-  title: z10.string().min(1).max(200).optional(),
-  description: z10.string().max(CARD_DESCRIPTION_MAX).optional(),
-  context: z10.string().min(1).optional(),
-  deadlineAt: z10.string().datetime().optional(),
+  title: z9.string().min(1).max(200).optional(),
+  description: z9.string().max(CARD_DESCRIPTION_MAX).optional(),
+  context: z9.string().min(1).optional(),
+  deadlineAt: z9.string().datetime().optional(),
   /** Only accepted while the decision has zero votes. */
   options: optionsArraySchema.optional(),
-  defaultOptionOrdinal: z10.number().int().min(1).max(DECISION_OPTIONS_MAX).optional(),
-  addImpactedCardRefs: z10.array(z10.string().min(1)).max(50).optional(),
-  removeImpactedCardIds: z10.array(z10.string().min(1)).max(50).optional()
+  defaultOptionOrdinal: z9.number().int().min(1).max(DECISION_OPTIONS_MAX).optional(),
+  addImpactedCardRefs: z9.array(z9.string().min(1)).max(50).optional(),
+  removeImpactedCardIds: z9.array(z9.string().min(1)).max(50).optional()
 });
-var GetDecisionRequestSchema = z10.object({
+var GetDecisionRequestSchema = z9.object({
   /** cuid or slug. A slug needs `projectId` to resolve unambiguously. */
-  decisionId: z10.string().min(1),
-  projectId: z10.string().cuid().optional()
+  decisionId: z9.string().min(1),
+  projectId: z9.string().cuid().optional()
 });
-var ListDecisionsRequestSchema = z10.object({
-  projectId: z10.string().cuid("Invalid project ID"),
-  status: z10.enum(DECISION_STATUS_LABELS).optional(),
+var ListDecisionsRequestSchema = z9.object({
+  projectId: z9.string().cuid("Invalid project ID"),
+  status: z9.enum(DECISION_STATUS_LABELS).optional(),
   /** Tag name, not id — an agent knows the tag it is working under. */
-  tag: z10.string().min(1).optional(),
+  tag: z9.string().min(1).optional(),
   /** Decisions that this card is blocked by (cuid or slug). */
-  cardId: z10.string().min(1).optional(),
-  query: z10.string().min(1).optional(),
-  limit: z10.number().int().min(1).max(DECISION_LIST_MAX_LIMIT).optional()
+  cardId: z9.string().min(1).optional(),
+  query: z9.string().min(1).optional(),
+  limit: z9.number().int().min(1).max(DECISION_LIST_MAX_LIMIT).optional()
 });
-var optionInput = z11.object({
-  label: z11.string().min(1).max(DECISION_OPTION_LABEL_MAX),
-  description: z11.string().min(1),
-  kind: z11.enum(DECISION_OPTION_KINDS).optional()
+var optionInput = z10.object({
+  label: z10.string().min(1).max(DECISION_OPTION_LABEL_MAX),
+  description: z10.string().min(1),
+  kind: z10.enum(DECISION_OPTION_KINDS).optional()
 });
-var optionsInput = z11.array(optionInput).min(DECISION_OPTIONS_MIN).max(DECISION_OPTIONS_MAX);
-var deadlineHours = z11.number().min(DECISION_DEADLINE_MIN_HOURS).max(DECISION_DEADLINE_MAX_HOURS).optional();
-var CreateProjectDecisionRequestSchema = z11.object({
-  projectId: z11.string(),
-  question: z11.string().min(1).max(200),
-  summary: z11.string().max(CARD_DESCRIPTION_MAX).optional(),
-  context: z11.string().min(1),
+var optionsInput = z10.array(optionInput).min(DECISION_OPTIONS_MIN).max(DECISION_OPTIONS_MAX);
+var deadlineHours = z10.number().min(DECISION_DEADLINE_MIN_HOURS).max(DECISION_DEADLINE_MAX_HOURS).optional();
+var CreateProjectDecisionRequestSchema = z10.object({
+  projectId: z10.string(),
+  question: z10.string().min(1).max(200),
+  summary: z10.string().max(CARD_DESCRIPTION_MAX).optional(),
+  context: z10.string().min(1),
   options: optionsInput,
-  defaultOption: z11.number().int().min(1).max(DECISION_OPTIONS_MAX),
+  defaultOption: z10.number().int().min(1).max(DECISION_OPTIONS_MAX),
   deadlineHours,
-  impactedCards: z11.array(z11.string().min(1)).max(50).optional(),
+  impactedCards: z10.array(z10.string().min(1)).max(50).optional(),
   /**
    * Pod surface only: also block the card this session is working on. The
    * session's task id is resolved SERVER-side from `sessionId` — a
    * client-supplied card id would let a pod block any card in the project.
    */
-  includeCurrentCard: z11.boolean().optional(),
-  sessionId: z11.string().optional(),
-  tagNames: z11.array(z11.string().min(1)).max(10).optional(),
-  raisedByPr: z11.number().int().positive().optional(),
+  includeCurrentCard: z10.boolean().optional(),
+  sessionId: z10.string().optional(),
+  tagNames: z10.array(z10.string().min(1)).max(10).optional(),
+  raisedByPr: z10.number().int().positive().optional(),
   /** Slug or id of the card that raised the question. A link back, not a block. */
-  raisedByCard: z11.string().min(1).optional(),
+  raisedByCard: z10.string().min(1).optional(),
   /** Absolute deadline (ISO 8601). Wins over `deadlineHours` when both are sent. */
-  deadlineAt: z11.string().datetime({ offset: true }).optional(),
-  requestingUserId: z11.string().optional()
-});
-var ListProjectDecisionsRequestSchema = z11.object({
-  projectId: z11.string(),
-  status: z11.enum(DECISION_STATUS_LABELS).optional(),
-  tag: z11.string().min(1).optional(),
-  card: z11.string().min(1).optional(),
-  query: z11.string().min(1).optional(),
-  limit: z11.number().int().min(1).max(DECISION_LIST_MAX_LIMIT).optional(),
-  requestingUserId: z11.string().optional()
-});
-var GetProjectDecisionRequestSchema = z11.object({
-  projectId: z11.string(),
-  decision: z11.string().min(1),
-  requestingUserId: z11.string().optional()
+  deadlineAt: z10.string().datetime({ offset: true }).optional(),
+  requestingUserId: z10.string().optional()
 });
-var VoteProjectDecisionRequestSchema = z11.object({
-  projectId: z11.string(),
-  decision: z11.string().min(1),
-  /** An option id, or its 1-based position. */
-  option: z11.string().min(1),
-  reason: z11.string().max(CARD_DESCRIPTION_MAX).optional(),
-  requestingUserId: z11.string().optional()
+var ListProjectDecisionsRequestSchema = z10.object({
+  projectId: z10.string(),
+  status: z10.enum(DECISION_STATUS_LABELS).optional(),
+  tag: z10.string().min(1).optional(),
+  card: z10.string().min(1).optional(),
+  query: z10.string().min(1).optional(),
+  limit: z10.number().int().min(1).max(DECISION_LIST_MAX_LIMIT).optional(),
+  requestingUserId: z10.string().optional()
 });
-var ResolveProjectDecisionRequestSchema = z11.object({
-  projectId: z11.string(),
-  decision: z11.string().min(1),
-  option: z11.string().min(1),
-  resolution: z11.string().min(1).max(DECISION_RESOLUTION_MAX),
-  notes: z11.string().optional(),
-  requestingUserId: z11.string().optional()
+var GetProjectDecisionRequestSchema = z10.object({
+  projectId: z10.string(),
+  decision: z10.string().min(1),
+  requestingUserId: z10.string().optional()
 });
-var UpdateProjectDecisionRequestSchema = z11.object({
-  projectId: z11.string(),
-  decision: z11.string().min(1),
-  question: z11.string().min(1).max(200).optional(),
-  summary: z11.string().max(CARD_DESCRIPTION_MAX).optional(),
-  context: z11.string().min(1).optional(),
+var VoteProjectDecisionRequestSchema = z10.object({
+  projectId: z10.string(),
+  decision: z10.string().min(1),
+  /** An option id, or its 1-based position. */
+  option: z10.string().min(1),
+  reason: z10.string().max(CARD_DESCRIPTION_MAX).optional(),
+  requestingUserId: z10.string().optional()
+});
+var ResolveProjectDecisionRequestSchema = z10.object({
+  projectId: z10.string(),
+  decision: z10.string().min(1),
+  option: z10.string().min(1),
+  resolution: z10.string().min(1).max(DECISION_RESOLUTION_MAX),
+  notes: z10.string().optional(),
+  requestingUserId: z10.string().optional()
+});
+var UpdateProjectDecisionRequestSchema = z10.object({
+  projectId: z10.string(),
+  decision: z10.string().min(1),
+  question: z10.string().min(1).max(200).optional(),
+  summary: z10.string().max(CARD_DESCRIPTION_MAX).optional(),
+  context: z10.string().min(1).optional(),
   /** Accepted only while nobody has voted. */
   options: optionsInput.optional(),
-  defaultOption: z11.number().int().min(1).max(DECISION_OPTIONS_MAX).optional(),
-  tagNames: z11.array(z11.string().min(1)).max(10).optional(),
+  defaultOption: z10.number().int().min(1).max(DECISION_OPTIONS_MAX).optional(),
+  tagNames: z10.array(z10.string().min(1)).max(10).optional(),
   deadlineHours,
   /** Absolute deadline (ISO 8601). Wins over `deadlineHours` when both are sent. */
-  deadlineAt: z11.string().datetime({ offset: true }).optional(),
-  addImpactedCards: z11.array(z11.string().min(1)).max(50).optional(),
-  removeImpactedCards: z11.array(z11.string().min(1)).max(50).optional(),
-  status: z11.enum(["Cancelled", "Open"]).optional(),
-  requestingUserId: z11.string().optional()
+  deadlineAt: z10.string().datetime({ offset: true }).optional(),
+  addImpactedCards: z10.array(z10.string().min(1)).max(50).optional(),
+  removeImpactedCards: z10.array(z10.string().min(1)).max(50).optional(),
+  status: z10.enum(["Cancelled", "Open"]).optional(),
+  requestingUserId: z10.string().optional()
+});
+var EVALUATE_MAX_QUESTIONS = 32;
+var EVALUATE_MAX_ITEMS = 100;
+var EVALUATE_ITEM_MAX_CHARS = 8e3;
+var EVALUATE_REQUEST_MAX_CHARS = 4e5;
+var TEXT_MAX = 1e3;
+var QUESTION_KEY = /^[A-Za-z0-9_-]{1,64}$/;
+var EvaluateQuestionSchema = z11.object({
+  key: z11.string().regex(QUESTION_KEY, "key must be 1-64 letters, digits, _ or -"),
+  type: z11.enum(["noul", "choice", "score"]),
+  instructions: z11.string().min(1).max(4e3),
+  options: z11.array(
+    z11.object({
+      key: z11.string().min(1).max(200),
+      description: z11.string().min(1).max(TEXT_MAX)
+    })
+  ).optional(),
+  levels: z11.array(z11.string().min(1).max(TEXT_MAX)).optional()
+}).superRefine((q, ctx) => {
+  if (q.type === "choice") {
+    const n = q.options?.length ?? 0;
+    if (n < 2 || n > 255) {
+      ctx.addIssue({
+        code: z11.ZodIssueCode.custom,
+        path: ["options"],
+        message: "a choice question needs 2-255 options"
+      });
+    } else if (new Set(q.options?.map((o) => o.key)).size !== n) {
+      ctx.addIssue({
+        code: z11.ZodIssueCode.custom,
+        path: ["options"],
+        message: "option keys must be unique"
+      });
+    }
+  }
+  if (q.type === "score") {
+    const n = q.levels?.length ?? 0;
+    if (n < 2 || n > 10) {
+      ctx.addIssue({
+        code: z11.ZodIssueCode.custom,
+        path: ["levels"],
+        message: "a score question needs 2-10 levels"
+      });
+    }
+  }
+});
+var EvaluateQuestionsRequestSchema = z11.object({
+  projectId: z11.string(),
+  state: z11.string().max(JEV_STATE_MAX_CHARS).optional(),
+  items: z11.array(z11.string().max(EVALUATE_ITEM_MAX_CHARS)).max(EVALUATE_MAX_ITEMS).optional(),
+  questions: z11.array(EvaluateQuestionSchema).min(1).max(EVALUATE_MAX_QUESTIONS)
+}).superRefine((req, ctx) => {
+  if (req.state === void 0 && (!req.items || req.items.length === 0)) {
+    ctx.addIssue({
+      code: z11.ZodIssueCode.custom,
+      path: ["state"],
+      message: "pass state, or a non-empty items array"
+    });
+  }
+  if (JSON.stringify(req).length > EVALUATE_REQUEST_MAX_CHARS) {
+    ctx.addIssue({
+      code: z11.ZodIssueCode.custom,
+      path: [],
+      message: `the request is over ${EVALUATE_REQUEST_MAX_CHARS} characters; split the items across calls`
+    });
+  }
+  if (new Set(req.questions.map((q) => q.key)).size !== req.questions.length) {
+    ctx.addIssue({
+      code: z11.ZodIssueCode.custom,
+      path: ["questions"],
+      message: "question keys must be unique"
+    });
+  }
 });
+var round3 = (n) => Math.round(n * 1e3) / 1e3;
+function compactAnswer(answer) {
+  switch (answer.type) {
+    case "noul":
+      return round3(answer.noul);
+    case "choice":
+      return {
+        choice: answer.choice,
+        p: round3(answer.probabilities[answer.choice] ?? 0),
+        confidence: round3(answer.confidence)
+      };
+    case "score":
+      return { score: answer.score, confidence: round3(answer.confidence) };
+  }
+}
+function formatEvaluateQuestionsResult(res) {
+  const results = res.results.map(
+    (r) => "error" in r ? { index: r.index, error: r.error } : {
+      index: r.index,
+      answers: Object.fromEntries(
+        Object.entries(r.answers).map(([key, a]) => [key, compactAnswer(a)])
+      )
+    }
+  );
+  return JSON.stringify({ model: res.model, results });
+}
 var MEETING_CHECKLIST_TITLE_MAX = 300;
 var MEETING_TRANSCRIPT_MAX_CHARS = 2e6;
 var MEETING_TITLE_MAX = 200;
@@ -3603,9 +3756,6 @@ var AGENT_STATUS_REASON_USER_QUESTION = "user_question";
 var TASK_CHAT_HISTORY_LIMIT = 20;
 var PM_CHAT_HISTORY_LIMIT = 40;
 var AGENT_CHAT_HISTORY_FETCH_LIMIT = Math.max(TASK_CHAT_HISTORY_LIMIT, PM_CHAT_HISTORY_LIMIT) + 10;
-function formatModelId(provider, model) {
-  return `${provider}/${model}`;
-}
 function anthropicEntry(model, label, inputPerMillion, outputPerMillion, opts = {}) {
   return {
     provider: "anthropic",
@@ -3635,7 +3785,7 @@ function isCodexReasoningEffort(value) {
   return typeof value === "string" && CODEX_REASONING_EFFORTS.includes(value);
 }
 var HUMAN_PROSE_WRITING_STYLE = `## Writing style for humans
-When you write prose a person will read \u2014 chat messages, plan updates, PR titles and bodies, PR review guides (the \`publish_review_guide\` overview and section explanations), review comments \u2014 follow these rules (based on ASD-STE100 Simplified Technical English):
+When you write prose a person will read \u2014 chat messages, plan updates, PR titles and bodies, review comments \u2014 follow these rules (based on ASD-STE100 Simplified Technical English):
 - Use active voice. Say who does what ("The API rejects the request", not "the request is rejected").
 - Use simple tenses ("we received", not "we have received").
 - One instruction or fact per sentence. Keep sentences under ~20 words.
@@ -4539,21 +4689,30 @@ async function loadForwardPorts(workspaceDir) {
       if (value.visibility === "public" || value.visibility === "private") {
         entry.visibility = value.visibility;
       }
+      if (value.onAutoForward === "ignore") entry.hidden = true;
       attributes[key] = entry;
     }
-    return { ports, attributes };
+    const links = sanitizeSessionPreviewLinks(parsed.customizations?.conveyor?.previewLinks);
+    return { ports, attributes, links };
   } catch {
-    return { ports: [], attributes: {} };
+    return { ports: [], attributes: {}, links: [] };
   }
 }
 function buildSessionPreviewPorts(result) {
-  return result.ports.filter((port) => !DEVCONTAINER_PORT_DENY_LIST.has(port)).map((port) => {
+  const toEntry = (port) => {
     const attr = result.attributes[String(port)];
     const entry = { port };
     if (attr?.label) entry.label = attr.label;
     if (attr?.visibility) entry.visibility = attr.visibility;
+    if (attr?.hidden) entry.hidden = true;
     return entry;
-  });
+  };
+  const forwarded = result.ports.filter((port) => !DEVCONTAINER_PORT_DENY_LIST.has(port));
+  const listed = new Set(forwarded);
+  const hiddenOnly = Object.entries(result.attributes).filter(([, attr]) => attr.hidden).map(([key]) => Number(key)).filter(
+    (port) => Number.isInteger(port) && port >= 1 && port <= 65535 && !listed.has(port) && !DEVCONTAINER_PORT_DENY_LIST.has(port)
+  );
+  return [...forwarded, ...hiddenOnly].map(toEntry);
 }
 function loadConveyorConfig() {
   const envStart = process.env.CONVEYOR_START_COMMAND;
@@ -4656,12 +4815,19 @@ var Lifecycle = class {
     this.clearIdleTimers();
     const delay2 = Math.max(0, overrideMs ?? this.config.idleTimeoutMs);
     this.idleTimer = setTimeout(() => {
+      this.idleTimer = null;
       this.callbacks.onIdleTimeout();
     }, delay2);
   }
   cancelIdleTimer() {
     this.clearIdleTimers();
   }
+  /** Restart an ARMED idle timer with the full window; a no-op when none is
+   *  armed. Human activity uses this, so a keystroke during a running turn
+   *  (timer cancelled) can never arm one. */
+  touchIdleTimer() {
+    if (this.idleTimer) this.startIdleTimer();
+  }
   // ── Dormant timer ──────────────────────────────────────────────────
   /** Start (or restart) the dormant timer.
    *  @param overrideMs Optional custom delay in ms. When provided, the timer
@@ -5098,6 +5264,9 @@ export {
   encodePtyStreamFrame,
   PtyStreamFrameReader,
   CARD_DESCRIPTION_FIELD_HINT,
+  MAX_MANUAL_TESTS_PER_TASK,
+  MAX_MANUAL_TEST_TITLE_LENGTH,
+  describeManualTestRejection,
   DEFAULT_CI_WAIT_TIMEOUT_MINUTES,
   MAX_CI_WAIT_TIMEOUT_MINUTES,
   SEVERITY_ENUM,
@@ -5108,7 +5277,6 @@ export {
   MAX_FILE_SIZE_BYTES,
   isCapabilityServableMime,
   RUNNER_MODES,
-  ReviewGuideContentSchema,
   CONTEXT_LINK_LOCATOR_MAX,
   isPlaceholderLocator,
   locatorMatchesContent,
@@ -5116,6 +5284,7 @@ export {
   TAG_OVERVIEW_MAX,
   TAG_REASON_MAX,
   CRITICAL_AUTOMATED_SOURCES,
+  formatEvaluateQuestionsResult,
   AGENT_STATUS_REASON_USER_QUESTION,
   TASK_CHAT_HISTORY_LIMIT,
   PM_CHAT_HISTORY_LIMIT,