@rallycry/conveyor-mcp 5.0.7 → 5.0.9

package/dist/cli.js

@@ -4,7 +4,7 @@ import {
 } from "./chunk-5KU3QS6A.js";
 import {
   ConveyorConnection
-} from "./chunk-77XLXIFP.js";
+} from "./chunk-UPLS63HM.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -72,8 +72,9 @@ function registerProjectTools(server2, conn2) {
 // src/tools/connection.ts
 import { z as z4 } from "zod";
 
-// ../shared/dist/chunk-U3HGG5NX.js
+// ../shared/dist/chunk-ZSXAYKD4.js
 import { z as z2 } from "zod";
+import { z as z22 } from "zod";
 var DEFAULT_SONNET_MODEL = "claude-sonnet-5";
 var DEFAULT_OPUS_MODEL = "claude-opus-5-5";
 var DEFAULT_HAIKU_MODEL = "claude-haiku-4-5-20251001";
@@ -146,6 +147,12 @@ var projectCheckpointSettingsSchema = z2.object({
 var CARD_DESCRIPTION_MAX = 255;
 var CARD_DESCRIPTION_LIMIT_MESSAGE = `Card descriptions are capped at ${CARD_DESCRIPTION_MAX} characters \u2014 write 1-2 plain sentences a non-engineer can read; put technical detail in the plan or card chat.`;
 var CARD_DESCRIPTION_FIELD_HINT = `max ${CARD_DESCRIPTION_MAX} chars, 1-2 plain sentences a non-engineer can read \u2014 put technical detail in the plan`;
+var MAX_MANUAL_TESTS_PER_TASK = 5;
+var MAX_MANUAL_TEST_TITLE_LENGTH = 200;
+var ManualTestItemsSchema = z22.array(z22.object({ title: z22.string().min(1).max(MAX_MANUAL_TEST_TITLE_LENGTH) })).min(1).max(MAX_MANUAL_TESTS_PER_TASK);
+function describeManualTestRejection(item) {
+  return item.reason === "cap" ? `Rejected "${item.title}": the card already holds ${MAX_MANUAL_TESTS_PER_TASK} manual tests. Use remove_manual_test or edit_manual_test to consolidate.` : `Rejected "${item.title}": names an automated step (lint, tests, CI, shell); manual tests describe what a person does in the app.`;
+}
 var DEFAULT_CI_WAIT_TIMEOUT_MINUTES = 45;
 var MAX_CI_WAIT_TIMEOUT_MINUTES = 180;
 var SEVERITY_ENUM = [
@@ -306,14 +313,14 @@ var f = {
     return { kind: "nullable", inner };
   }
 };
-function compileString(z13, spec) {
-  let schema = z13.string();
+function compileString(z14, spec) {
+  let schema = z14.string();
   if (spec.min !== void 0) schema = schema.min(spec.min);
   if (spec.max !== void 0) schema = schema.max(spec.max);
   return schema;
 }
-function compileNumber(z13, spec) {
-  let schema = z13.number();
+function compileNumber(z14, spec) {
+  let schema = z14.number();
   if (spec.int) schema = schema.int();
   if (spec.positive) schema = schema.positive();
   if (spec.nonnegative) schema = schema.nonnegative();
@@ -321,49 +328,50 @@ function compileNumber(z13, spec) {
   if (spec.max !== void 0) schema = schema.max(spec.max);
   return schema;
 }
-function compileArray(z13, spec) {
-  let schema = z13.array(compileField(z13, spec.item));
+function compileArray(z14, spec) {
+  let schema = z14.array(compileField(z14, spec.item));
   if (spec.min !== void 0) schema = schema.min(spec.min);
+  if (spec.max !== void 0) schema = schema.max(spec.max);
   return schema;
 }
-function compileBase(z13, spec) {
+function compileBase(z14, spec) {
   switch (spec.kind) {
     case "string":
-      return compileString(z13, spec);
+      return compileString(z14, spec);
     case "number":
-      return compileNumber(z13, spec);
+      return compileNumber(z14, spec);
     case "boolean":
-      return z13.boolean();
+      return z14.boolean();
     case "enum":
-      return z13.enum([...spec.values]);
+      return z14.enum([...spec.values]);
     case "array":
-      return compileArray(z13, spec);
+      return compileArray(z14, spec);
     case "object":
-      return z13.object(compileShape(z13, spec.fields));
+      return z14.object(compileShape(z14, spec.fields));
   }
 }
 function descriptionOf(spec) {
   if (spec.kind === "optional" || spec.kind === "nullable") return descriptionOf(spec.inner);
   return spec.desc;
 }
-function compileUndescribed(z13, spec) {
+function compileUndescribed(z14, spec) {
   if (spec.kind === "optional") {
-    return compileUndescribed(z13, spec.inner).optional();
+    return compileUndescribed(z14, spec.inner).optional();
   }
   if (spec.kind === "nullable") {
-    return compileUndescribed(z13, spec.inner).nullable();
+    return compileUndescribed(z14, spec.inner).nullable();
   }
-  return compileBase(z13, spec);
+  return compileBase(z14, spec);
 }
-function compileField(z13, spec) {
-  const schema = compileUndescribed(z13, spec);
+function compileField(z14, spec) {
+  const schema = compileUndescribed(z14, spec);
   const desc = descriptionOf(spec);
   return desc === void 0 ? schema : schema.describe(desc);
 }
-function compileShape(z13, fields) {
+function compileShape(z14, fields) {
   const shape = {};
   for (const [key, spec] of Object.entries(fields)) {
-    shape[key] = compileField(z13, spec);
+    shape[key] = compileField(z14, spec);
   }
   return shape;
 }
@@ -453,16 +461,24 @@ var readTaskChatContract = defineToolContract({
     }
   }
 });
+var listTagsDetail = f.optional(
+  f.enum(["summary", "full"], {
+    desc: `"summary" (default) returns one compact row per tag with a contextPathCount. "full" also ships each tag's contextPaths inline (each link with its verification status). Full mode can exceed a client's tool-output budget on a large glossary; use get_tag for one term instead.`
+  })
+);
 var listTagsContract = defineToolContract({
   name: "list_tags",
   agent: {
-    description: "List the project glossary: every tag's id, name, color, description, parent/child tag ids, its contextPaths (the rule/doc/file/folder links it wires into agent context \u2014 `[]` means none), whether it carries a full overview (fetch that with get_tag), and its attachmentCount (files labelled as examples of the term). The context links ship inline, so you only need get_tag for a term's full overview. Use the ids with get_tag / update_tag.",
-    fields: {}
+    description: "List the whole project glossary in one call. The default summary gives every tag's id, name, color, description, parent/child tag ids, whether it carries a full overview (hasOverview), its attachmentCount (files labelled as examples of the term), and its contextPathCount (the rule/doc/file/folder links it wires into agent context \u2014 `0` means none). Pass detail: \"full\" to ship the contextPaths themselves inline. Use get_tag for one term's full overview and full link verification. Use the ids with get_tag / update_tag.",
+    fields: {
+      detail: listTagsDetail
+    }
   },
   mcp: {
-    description: "List all project tags with names, IDs, colors, descriptions, hierarchy (parent/child ids), contextPaths (the rule/doc/file/folder links each tag wires into agent context \u2014 `[]` means none), a hasOverview flag, and an attachmentCount (files labelled as examples of the term \u2014 read the tiles with list_tag_attachments). Context links ship inline; call get_tag only for a term's full overview. Pass projectId to target a specific project; otherwise the configured default project is used.",
+    description: 'List all project tags in one call. The default summary gives names, IDs, colors, descriptions, hierarchy (parent/child ids), a hasOverview flag, an attachmentCount (files labelled as examples of the term \u2014 read the tiles with list_tag_attachments), and a contextPathCount (the rule/doc/file/folder links each tag wires into agent context \u2014 `0` means none). Pass detail: "full" to ship the contextPaths themselves inline. Call get_tag for one term\'s full overview and full link verification. Pass projectId to target a specific project; otherwise the configured default project is used.',
     fields: {
-      projectId: mcpProjectId
+      projectId: mcpProjectId,
+      detail: listTagsDetail
     }
   }
 });
@@ -598,7 +614,7 @@ var updateTaskContract = defineToolContract({
     }
   },
   mcp: {
-    description: "Update task fields: title, description, plan, status, risk, story points, assignment, githubBranch, or tags. Set status to claim a card (InProgress), triage it (Open), or cancel it (Cancelled); for review approvals prefer approve_task / request_changes, which guard against stale-state races. Tags are additive/subtractive \u2014 pass addTags/removeTags with tag names (not a replace-set). Pass projectId to target a specific project; otherwise the configured default project is used. Moving a task beyond Planning auto-fills any missing icon, story points, and agent assignment \u2014 don't spend turns on them; pass storyPointValue only to correct the sizing yourself. For subtasks use update_subtask.",
+    description: "Update task fields: title, description, plan, status, risk, story points, assignment, githubBranch, onHold, or tags. Set status to claim a card (InProgress), triage it (Open), or cancel it (Cancelled); for review approvals prefer approve_task / request_changes, which guard against stale-state races. Set onHold to park a card (true) or bring it back to the active board (false) without cancelling it. Tags are additive/subtractive \u2014 pass addTags/removeTags with tag names (not a replace-set). Pass projectId to target a specific project; otherwise the configured default project is used. Moving a task beyond Planning auto-fills any missing icon, story points, and agent assignment \u2014 don't spend turns on them; pass storyPointValue only to correct the sizing yourself. For subtasks use update_subtask.",
     fields: {
       projectId: mcpProjectId,
       taskId: f.string({ desc: "The task ID" }),
@@ -629,6 +645,11 @@ var updateTaskContract = defineToolContract({
         )
       ),
       githubBranch: f.optional(f.nullable(f.string({ desc: GITHUB_BRANCH_DESC }))),
+      onHold: f.optional(
+        f.boolean({
+          desc: "Park the card on hold (true) or return it to the active board (false). On hold hides the card from the active columns without cancelling it; a card already at an active work status is demoted to Open when parked."
+        })
+      ),
       addTags: f.optional(
         f.array(f.string(), {
           desc: 'Tag names to add to the card (e.g. ["refactor"]). Additive \u2014 existing tags are kept. Unknown names are rejected; use list_tags to see available tags or manage_tags to create one.'
@@ -672,9 +693,20 @@ var testStatuses = f.optional(
   })
 );
 var setManualTestItems = f.array(
-  f.object({ title: f.string({ min: 1, desc: "A concise, actionable test step" }) }),
-  { min: 1, desc: "List of manual test steps to add" }
+  f.object({
+    title: f.string({
+      min: 1,
+      max: MAX_MANUAL_TEST_TITLE_LENGTH,
+      desc: "One sentence a non-engineer can follow: where to go, what to do, what they should see. No commands, no code."
+    })
+  }),
+  {
+    min: 1,
+    max: MAX_MANUAL_TESTS_PER_TASK,
+    desc: `Manual tests to add. A card holds at most ${MAX_MANUAL_TESTS_PER_TASK}; most changes need 1, and a change with no user-visible behavior needs none.`
+  }
 );
+var setManualTestsBar = 'A manual test is a real user path in plain language ("Open a card with a PR: the Pull Request slat sits directly under Description"), not an engineering check. Never record lint, typecheck, unit tests, CI, curl, database, log, or deploy steps; those run automatically. Record at most 5 per card, usually 1, and none when the change has no user-visible behavior. Existing items with the same title are skipped; items that name an automated step or exceed the cap are rejected and reported back.';
 var titleToEdit = f.string({ min: 1, desc: "The current title of the manual test to edit" });
 var newTitle = f.string({ min: 1, desc: "The new title for the manual test" });
 var titleToRemove = f.string({ min: 1, desc: "The title of the manual test to remove" });
@@ -728,13 +760,13 @@ var queryManualTestsContract = defineToolContract({
 var setManualTestsContract = defineToolContract({
   name: "set_manual_tests",
   agent: {
-    description: "Add manual test steps to the task checklist. Existing items with the same title are automatically skipped (deduplication). Use to record specific manual verification steps that reviewers should follow when testing this PR.",
+    description: `Record the manual tests a person should run in the app to sign off on this card. ${setManualTestsBar}`,
     fields: {
       items: setManualTestItems
     }
   },
   mcp: {
-    description: "Add manual test steps to a task's checklist. Pass projectId to target a specific project; otherwise the configured default project is used. Existing items with the same title are automatically skipped (deduplication). Use to record specific manual verification steps that reviewers should follow when testing the task's PR.",
+    description: `Record the manual tests a person should run in the app to sign off on a card. Pass projectId to target a specific project; otherwise the configured default project is used. ${setManualTestsBar}`,
     fields: {
       projectId: mcpProjectId,
       taskId: mcpChecklistTaskId,
@@ -1057,11 +1089,18 @@ var subtasksContracts = [
   setTaskParentContract
 ];
 var mcpTaskIdOrSlug = f.string({ desc: "The task ID or slug" });
+var agentTaskIdOrSlug = f.optional(
+  f.string({
+    desc: "Omit for the current card; pass a parent, sibling, or any other card in this project (id or slug) to read its files instead."
+  })
+);
 var listTaskFilesContract = defineToolContract({
   name: "list_task_files",
   agent: {
-    description: "List all files attached to this task with metadata. Use before fetching a specific file to see what is available and how large each is. For file contents use get_attachment.",
-    fields: {}
+    description: "List all files attached to this task with metadata. Use before fetching a specific file to see what is available and how large each is. For file contents use get_attachment. Pass task_id to list another card's files in this project, for example the pack parent's source documents.",
+    fields: {
+      task_id: agentTaskIdOrSlug
+    }
   },
   mcp: {
     description: "List all files attached to a task with metadata (no contents \u2014 fast and small). Pass projectId to target a specific project; otherwise the configured default project is used. Use before fetching a specific file to see what is available and how large each is. For file contents use get_attachment.",
@@ -1074,13 +1113,14 @@ var listTaskFilesContract = defineToolContract({
 var getAttachmentContract = defineToolContract({
   name: "get_attachment",
   agent: {
-    description: "Fetch one task file's content plus metadata by file ID. Call list_task_files first to discover IDs and check sizes \u2014 large binaries may be truncated by the service's size limit.",
+    description: "Fetch one task file's content plus metadata by file ID. This is the way to read attachment bytes: a document `downloadUrl` (anything that is not an image or video) answers 404 without a signed-in project member's session, so do not curl or WebFetch it from the pod. Call list_task_files first to discover IDs and check sizes \u2014 large binaries may be truncated by the service's size limit. Pass task_id when the file is attached to another card in this project, such as the pack parent.",
     fields: {
-      fileId: f.string({ desc: "The file ID to retrieve" })
+      fileId: f.string({ desc: "The file ID to retrieve" }),
+      task_id: agentTaskIdOrSlug
     }
   },
   mcp: {
-    description: "Fetch one task file's content plus metadata by file ID (accepts task id or slug). Pass projectId to target a specific project; otherwise the configured default project is used. Images are returned as viewable image blocks. Large text files (logs, JSON) are returned in pages \u2014 use `offset`/`maxBytes` to read more, or fetch `downloadUrl` for the whole file. Call list_task_files first to discover IDs and sizes.",
+    description: "Fetch one task file's content plus metadata by file ID (accepts task id or slug). Pass projectId to target a specific project; otherwise the configured default project is used. Images are returned as viewable image blocks. Large text files (logs, JSON) are returned in pages \u2014 use `offset`/`maxBytes` to read more. This tool is the way to read bytes: a document `downloadUrl` (anything that is not an image or video) answers 404 unless the request carries a signed-in project member's session, so do not curl or fetch it. Call list_task_files first to discover IDs and sizes.",
     fields: {
       projectId: mcpProjectId,
       taskId: mcpTaskIdOrSlug,
@@ -1147,10 +1187,29 @@ var uploadAttachmentContract = defineToolContract({
     }
   }
 });
+var DELETE_ATTACHMENT_WARNING = "Permanent, with no trash and no undo (unlike drive_delete_file): the file and its bytes are gone, and the chat message that announced it keeps its text but loses the attachment. Use it to remove a superseded upload once its replacement is attached. `fileId` comes from list_task_files.";
+var deleteAttachmentContract = defineToolContract({
+  name: "delete_attachment",
+  agent: {
+    description: `Delete one attachment from this task. ${DELETE_ATTACHMENT_WARNING} A pod can only delete files on its own card.`,
+    fields: {
+      fileId: f.string({ desc: "The file ID to delete" })
+    }
+  },
+  mcp: {
+    description: `Delete one attachment from a task (accepts task id or slug). ${DELETE_ATTACHMENT_WARNING} Requires Moderate on the project, the same bar as the web Files delete button. Pass projectId to target a specific project; otherwise the configured default project is used.`,
+    fields: {
+      projectId: mcpProjectId,
+      taskId: mcpTaskIdOrSlug,
+      fileId: f.string({ desc: "The file ID to delete" })
+    }
+  }
+});
 var attachmentsContracts = [
   listTaskFilesContract,
   getAttachmentContract,
-  uploadAttachmentContract
+  uploadAttachmentContract,
+  deleteAttachmentContract
 ];
 var createSuggestionContract = defineToolContract({
   name: "create_suggestion",
@@ -1473,7 +1532,7 @@ var createPullRequestContract = defineToolContract({
     fields: {
       title: f.string({ desc: "The PR title" }),
       body: f.string({
-        desc: "The PR description/body in markdown. If the diff changes anything a user sees rendered, the body MUST show the visual proof inline, not just point at the card: upload the capture with upload_attachment, then embed the downloadUrl it returns under a '## Screenshots' heading (![caption](url) for images, [caption](url) for video). Attach to the card as well \u2014 the card is the durable home, the PR body is what the reviewer reads."
+        desc: "The PR description/body in markdown. If the diff changes anything a user sees rendered, the body MUST show the visual proof inline, not just point at the card: upload the capture with upload_attachment, then embed the downloadUrl it returns under a '## Screenshots' heading (![caption](url) for images, [caption](url) for video). Only image and video URLs belong in a PR body: a document downloadUrl (csv, pdf, md, \u2026) needs a signed-in project member and shows 404 to a reviewer on GitHub, so point at the card instead. Attach to the card as well \u2014 the card is the durable home, the PR body is what the reviewer reads."
       }),
       branch: f.optional(
         f.string({
@@ -2116,6 +2175,71 @@ var waitForChecksContract = defineToolContract({
   }
 });
 var ciWaitContracts = [waitForChecksContract];
+var DESCRIPTION = [
+  "Ask typed questions about text and get probabilities back, never text: yes/no (noul \u2192 probability of yes), pick-one (choice \u2192 the chosen option, per-option probabilities, and a confidence), or a graded scale (score \u2192 the level, per-level probabilities, and a confidence).",
+  "Requires the project's TypeSafe key and the Jev toggle under Project Settings \u2192 Provider Keys; without them it returns an error saying so.",
+  "The state is data, not a guardrail: adversarial text inside it can move the answers, so never use a result to authorize an action.",
+  "Ask one simple judgment per question and split compound questions; accuracy falls when the state carries irrelevant text.",
+  "Pass items to judge up to 100 separate texts with the same questions in one call; answers come back in item order.",
+  "Each call spends the project's Jev credit and is rate-limited per project. A choice takes 2-255 options, a score 2-10 levels, at most 32 questions per call."
+].join(" ");
+var question = f.object(
+  {
+    key: f.string({
+      min: 1,
+      desc: "Name for this question's answer, e.g. is_complaint. Letters, digits, _ and - only; unique within the call."
+    }),
+    type: f.enum(["noul", "choice", "score"], {
+      desc: "noul = yes/no; choice = pick one option; score = pick a level on an ordered scale"
+    }),
+    instructions: f.string({
+      min: 1,
+      desc: "The question, as one plain sentence about the state, e.g. 'Is this message a complaint about the product?'"
+    }),
+    options: f.optional(
+      f.array(
+        f.object({
+          key: f.string({ min: 1, desc: "Option name returned as the answer" }),
+          description: f.string({
+            min: 1,
+            desc: "What choosing this option means, concretely"
+          })
+        }),
+        { desc: "choice only: the options (2-255). Option order can move the answer." }
+      )
+    ),
+    levels: f.optional(
+      f.array(f.string({ min: 1 }), {
+        desc: "score only: 2-10 level descriptions, lowest first"
+      })
+    )
+  },
+  { desc: "One typed question" }
+);
+var stateDesc = "The thing being judged, as plain text or JSON. Required unless items is given; with items it is ignored.";
+var itemsDesc = "Up to 100 separate texts (each up to 8,000 characters), each judged on its own with the same questions. Use this for bulk classification instead of one call per item.";
+var questionsDesc = "1-32 questions, all answered independently against the same state.";
+var evaluateQuestionsContract = defineToolContract({
+  name: "evaluate_questions",
+  agent: {
+    description: DESCRIPTION,
+    fields: {
+      state: f.optional(f.string({ desc: stateDesc })),
+      questions: f.array(question, { min: 1, desc: questionsDesc }),
+      items: f.optional(f.array(f.string(), { desc: itemsDesc }))
+    }
+  },
+  mcp: {
+    description: `${DESCRIPTION} Pass projectId to target a specific project; otherwise the configured default project is used.`,
+    fields: {
+      projectId: mcpProjectId,
+      state: f.optional(f.string({ desc: stateDesc })),
+      questions: f.array(question, { min: 1, desc: questionsDesc }),
+      items: f.optional(f.array(f.string(), { desc: itemsDesc }))
+    }
+  }
+});
+var evaluateContracts = [evaluateQuestionsContract];
 var TOOL_CONTRACTS = Object.fromEntries(
   [
     ...tasksContracts,
@@ -2132,7 +2256,8 @@ var TOOL_CONTRACTS = Object.fromEntries(
     ...driveContracts,
     ...meetingsContracts,
     ...logsContracts,
-    ...ciWaitContracts
+    ...ciWaitContracts,
+    ...evaluateContracts
   ].map((contract) => [contract.name, contract])
 );
 
@@ -2570,6 +2695,7 @@ function registerListTasks(server2, conn2) {
       assigneeId: z6.string().optional().describe("Filter by assigned user ID"),
       unassigned: z6.boolean().optional().describe("Only return tasks with no assignee (mutually exclusive with assigneeId)"),
       subProjectId: BOARD_FILTER,
+      onHold: z6.boolean().optional().describe("true = only cards on hold, false = exclude them, omit = both"),
       limit: z6.number().optional().describe("Max tasks to return (default 50)")
     },
     async (params) => {
@@ -2776,7 +2902,7 @@ function registerSearchTasks(server2, conn2) {
 }
 function registerListTags(server2, conn2) {
   registerContractTool(server2, listTagsContract, async (params) => {
-    const tags = await conn2.listTags(params.projectId);
+    const tags = await conn2.listTags(params.projectId, params.detail);
     return { content: [{ type: "text", text: JSON.stringify(tags, null, 2) }] };
   });
 }
@@ -3010,6 +3136,9 @@ var MIME_BY_EXT = {
   ".yaml": "application/yaml",
   ".yml": "application/yaml",
   ".pdf": "application/pdf",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
   ".zip": "application/zip",
   ".gz": "application/gzip",
   ".mp4": "video/mp4",
@@ -3031,9 +3160,9 @@ function buildTextContent(file, content) {
   const start = file.contentByteOffset ?? 0;
   const shown = Buffer.byteLength(content, "utf-8");
   const total = file.contentTotalBytes ?? shown;
-  const more = file.contentTruncated ? ` \u2014 showing bytes ${start}\u2013${start + shown} of ${total}; pass offset=${start + shown} for the next page, or fetch the full file at downloadUrl` : "";
+  const more = file.contentTruncated ? ` \u2014 showing bytes ${start}\u2013${start + shown} of ${total}; pass offset=${start + shown} for the next page` : "";
   const header = `${file.fileName ?? "file"} (${file.mimeType ?? "?"}, ${total} bytes)${more}
-${file.downloadUrl ? `downloadUrl: ${file.downloadUrl}
+${file.downloadUrl ? `downloadUrl (signed-in project members only; read bytes with this tool): ${file.downloadUrl}
 ` : ""}---
 `;
   return [{ type: "text", text: header + content }];
@@ -3159,10 +3288,24 @@ function registerSetFileTags(server2, conn2) {
     }
   );
 }
+function registerDeleteAttachment(server2, conn2) {
+  registerContractTool(server2, deleteAttachmentContract, async (params) => {
+    const result = await conn2.deleteAttachment(params.taskId, params.fileId, params.projectId);
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Deleted ${result.fileName} (${result.id}) permanently. Any chat message that announced it keeps its text without the attachment.`
+        }
+      ]
+    };
+  });
+}
 function registerAttachmentTools(server2, conn2) {
   registerListTaskFiles(server2, conn2);
   registerGetAttachment(server2, conn2);
   registerUploadAttachment(server2, conn2);
+  registerDeleteAttachment(server2, conn2);
   registerSetFileTags(server2, conn2);
 }
 
@@ -3270,353 +3413,9 @@ function registerSuggestionTools(server2, conn2) {
   });
 }
 
-// src/tools/checklists.ts
-function renderManualTestGroups(groups) {
-  const lines = [];
-  for (const g of groups) {
-    lines.push(`## ${g.title} [${g.status}] (${g.slug})`);
-    for (const t of g.tests) {
-      const mark = t.status === "approved" ? "\u2713" : t.status === "rejected" ? "\u2717" : "\u25CB";
-      lines.push(`  ${mark} ${t.title} \u2014 ${t.status}`);
-      if (t.status === "rejected") {
-        for (const f2 of t.failures ?? []) {
-          lines.push(`      \u26A0 ${f2.userName ?? "Someone"}: ${f2.reason ?? "(no message)"}`);
-        }
-      }
-    }
-    lines.push("");
-  }
-  return lines.join("\n").trimEnd();
-}
-function registerListManualTests(server2, conn2) {
-  registerContractTool(server2, listManualTestsContract, async (params) => {
-    const items = await conn2.listManualTests(params.taskId, params.projectId);
-    if (items.length === 0) {
-      return { content: [{ type: "text", text: "No manual tests recorded for this task." }] };
-    }
-    const lines = items.flatMap((item, i) => {
-      const checked = item.checked ? "[x]" : "[ ]";
-      const row = [`${i + 1}. ${checked} ${item.title}`];
-      for (const f2 of item.failures ?? []) {
-        const who = f2.userName ?? "Someone";
-        const reason = f2.reason ?? "(no message)";
-        row.push(`   \u26A0 Failed (${who}): ${reason}`);
-      }
-      return row;
-    });
-    return { content: [{ type: "text", text: lines.join("\n") }] };
-  });
-}
-function registerSetManualTests(server2, conn2) {
-  registerContractTool(server2, setManualTestsContract, async (params) => {
-    const result = await conn2.setManualTests(params.taskId, params.items, params.projectId);
-    const parts = [`Created ${result.created} manual test item(s).`];
-    if (result.skipped > 0) parts.push(`Skipped ${result.skipped} duplicate(s).`);
-    return { content: [{ type: "text", text: parts.join(" ") }] };
-  });
-}
-function registerEditManualTest(server2, conn2) {
-  registerContractTool(server2, editManualTestContract, async (params) => {
-    await conn2.editManualTest(params.taskId, params.title, params.newTitle, params.projectId);
-    return { content: [{ type: "text", text: `Updated manual test to "${params.newTitle}".` }] };
-  });
-}
-function registerRemoveManualTest(server2, conn2) {
-  registerContractTool(server2, removeManualTestContract, async (params) => {
-    await conn2.removeManualTest(params.taskId, params.title, params.projectId);
-    return { content: [{ type: "text", text: `Removed manual test "${params.title}".` }] };
-  });
-}
-function registerApproveManualTest(server2, conn2) {
-  registerContractTool(server2, approveManualTestContract, async (params) => {
-    await conn2.approveManualTest(params.taskId, params.title, params.projectId);
-    return { content: [{ type: "text", text: `Approved manual test "${params.title}".` }] };
-  });
-}
-function registerRejectManualTest(server2, conn2) {
-  registerContractTool(server2, rejectManualTestContract, async (params) => {
-    await conn2.rejectManualTest(params.taskId, params.title, params.reason, params.projectId);
-    return {
-      content: [
-        {
-          type: "text",
-          text: `Flagged an issue with manual test "${params.title}": ${params.reason}`
-        }
-      ]
-    };
-  });
-}
-function registerQueryManualTests(server2, conn2) {
-  registerContractTool(server2, queryManualTestsContract, async (params) => {
-    const groups = await conn2.queryManualTests({
-      projectId: params.projectId,
-      cardStatuses: params.cardStatuses,
-      testStatuses: params.testStatuses
-    });
-    if (groups.length === 0) {
-      return { content: [{ type: "text", text: "No manual tests match those filters." }] };
-    }
-    return { content: [{ type: "text", text: renderManualTestGroups(groups) }] };
-  });
-}
-function registerChecklistTools(server2, conn2) {
-  registerListManualTests(server2, conn2);
-  registerQueryManualTests(server2, conn2);
-  registerSetManualTests(server2, conn2);
-  registerEditManualTest(server2, conn2);
-  registerRemoveManualTest(server2, conn2);
-  registerApproveManualTest(server2, conn2);
-  registerRejectManualTest(server2, conn2);
-}
-
-// src/tools/workspace.ts
+// ../shared/dist/index.js
 import { z as z9 } from "zod";
-
-// src/workspace-ssh-tunnel.ts
-import net from "net";
-import { once } from "events";
-import { WebSocket } from "ws";
-var WORKSPACE_TUNNEL_HEARTBEAT_MS = 3e4;
-function withPort(url, port) {
-  const parsed = new URL(url);
-  parsed.searchParams.set("port", String(port));
-  return parsed.toString();
-}
-function toBuffer(data) {
-  if (Buffer.isBuffer(data)) return data;
-  if (data instanceof ArrayBuffer) return Buffer.from(data);
-  return Buffer.concat(data);
-}
-function startHeartbeat(ws) {
-  const timer = setInterval(() => {
-    if (ws.readyState === WebSocket.OPEN) ws.ping();
-  }, WORKSPACE_TUNNEL_HEARTBEAT_MS);
-  timer.unref?.();
-  return () => clearInterval(timer);
-}
-function bridgeClient(client, options) {
-  let ws = null;
-  let ready = false;
-  const pending = [];
-  client.on("data", (data) => {
-    const chunk = Buffer.isBuffer(data) ? data : Buffer.from(data);
-    if (ready && ws && ws.readyState === WebSocket.OPEN) ws.send(chunk);
-    else pending.push(chunk);
-  });
-  client.on("close", () => ws?.close());
-  client.on("error", () => ws?.close());
-  options.resolveTarget().then(({ tunnelUrl, attachToken }) => {
-    const socket = new WebSocket(withPort(tunnelUrl, options.remotePort), {
-      headers: { "x-workspace-attach-token": attachToken }
-    });
-    ws = socket;
-    const stopHeartbeat = startHeartbeat(socket);
-    socket.on("message", (data) => {
-      const chunk = toBuffer(data);
-      if (!ready) {
-        const text = chunk.toString("utf8");
-        if (text === JSON.stringify({ ok: true })) {
-          ready = true;
-          for (const buffered of pending.splice(0)) socket.send(buffered);
-          return;
-        }
-        client.destroy(new Error(`Workspace tunnel rejected connection: ${text}`));
-        socket.close();
-        return;
-      }
-      client.write(chunk);
-    });
-    socket.on("close", () => {
-      stopHeartbeat();
-      client.destroy();
-    });
-    socket.on("error", (err) => {
-      stopHeartbeat();
-      client.destroy(err);
-    });
-  }).catch((err) => {
-    client.destroy(err instanceof Error ? err : new Error(String(err)));
-  });
-}
-async function startWorkspaceSshTunnel(options) {
-  const host = options.host ?? "127.0.0.1";
-  const server2 = net.createServer((client) => bridgeClient(client, options));
-  const ac = new AbortController();
-  server2.listen(options.preferredLocalPort ?? 0, host);
-  try {
-    await Promise.race([
-      once(server2, "listening", { signal: ac.signal }),
-      once(server2, "error", { signal: ac.signal }).then(([err]) => {
-        throw err instanceof Error ? err : new Error(String(err));
-      })
-    ]);
-  } catch (err) {
-    server2.close();
-    throw new Error(
-      `Failed to bind workspace SSH tunnel: ${err instanceof Error ? err.message : String(err)}`,
-      { cause: err }
-    );
-  } finally {
-    ac.abort();
-  }
-  const address = server2.address();
-  if (!address || typeof address === "string") {
-    server2.close();
-    throw new Error("Failed to bind workspace SSH tunnel");
-  }
-  return {
-    host,
-    port: address.port,
-    close: () => new Promise((resolve, reject) => {
-      server2.close((err) => {
-        if (err) reject(err);
-        else resolve();
-      });
-    })
-  };
-}
-
-// src/tools/workspace.ts
-var activeTunnels = /* @__PURE__ */ new Map();
-function createTunnelId(taskId, port) {
-  return `${taskId}:${port}:${Date.now().toString(36)}:${Math.random().toString(36).slice(2, 8)}`;
-}
-function localUrlFor(port, host, localPort) {
-  if (port === 2222) return void 0;
-  return `http://${host}:${localPort}`;
-}
-function registerAttachInfoTool(server2, conn2) {
-  server2.tool(
-    "workspace_attach_info",
-    "Return SSH/SFTP attach metadata for a running task Claudespace, plus hosted preview URLs and configured preview ports. Optionally installs an OpenSSH public key for this attach session.",
-    {
-      taskId: z9.string().describe("The task ID"),
-      sshPublicKey: z9.string().optional().describe("Optional OpenSSH public key to install into the workspace")
-    },
-    async ({ taskId, sshPublicKey }) => {
-      const info = await conn2.getWorkspaceAttachInfo(taskId, sshPublicKey);
-      return { content: [{ type: "text", text: JSON.stringify(info, null, 2) }] };
-    }
-  );
-}
-function registerPreviewUrlsTool(server2, conn2) {
-  server2.tool(
-    "workspace_preview_urls",
-    "Return the hosted preview URLs and preview ports for a running task Claudespace. This mirrors the web UI preview link metadata.",
-    {
-      taskId: z9.string().describe("The task ID")
-    },
-    async ({ taskId }) => {
-      const info = await conn2.getWorkspaceAttachInfo(taskId);
-      return {
-        content: [
-          {
-            type: "text",
-            text: JSON.stringify(
-              {
-                taskId: info.taskId,
-                sessionId: info.sessionId,
-                previewPorts: info.previewPorts,
-                previewUrls: info.previewUrls
-              },
-              null,
-              2
-            )
-          }
-        ]
-      };
-    }
-  );
-}
-function registerStartTunnelTool(server2, conn2, startTunnel) {
-  server2.tool(
-    "workspace_start_tunnel",
-    "Start a local loopback tunnel through the MCP server to a running task Claudespace port. Use port 2222 for SSH/SFTP, or one of previewPorts for app access.",
-    {
-      taskId: z9.string().describe("The task ID"),
-      port: z9.number().optional().describe("Remote Claudespace port. Defaults to SSH port 2222."),
-      preferredLocalPort: z9.number().optional().describe("Preferred local loopback port. If omitted, the OS chooses one."),
-      sshPublicKey: z9.string().optional().describe("Optional OpenSSH public key to install before opening the tunnel")
-    },
-    async ({ taskId, port, preferredLocalPort, sshPublicKey }) => {
-      const info = await conn2.getWorkspaceAttachInfo(taskId, sshPublicKey);
-      if (!info.tunnelUrl || !info.attachToken) {
-        throw new Error(
-          "Workspace tunnels are unavailable for this task (GitHub Codespace-backed environments expose previews only \u2014 use workspace_preview_urls)."
-        );
-      }
-      const remotePort = port ?? info.ssh?.remotePort ?? 2222;
-      const handle = await startTunnel({
-        remotePort,
-        preferredLocalPort,
-        // Re-mint per connection so the tunnel outlives the attach-token TTL.
-        // The key (if any) is already installed by the call above; the refetch
-        // only needs a fresh token, so it omits sshPublicKey.
-        resolveTarget: async () => {
-          const fresh = await conn2.getWorkspaceAttachInfo(taskId);
-          if (!fresh.tunnelUrl || !fresh.attachToken)
-            throw new Error("Workspace tunnel target is no longer available");
-          return { tunnelUrl: fresh.tunnelUrl, attachToken: fresh.attachToken };
-        }
-      });
-      const tunnelId = createTunnelId(taskId, remotePort);
-      activeTunnels.set(tunnelId, handle);
-      return {
-        content: [
-          {
-            type: "text",
-            text: JSON.stringify(
-              {
-                tunnelId,
-                taskId,
-                remotePort,
-                localHost: handle.host,
-                localPort: handle.port,
-                localUrl: localUrlFor(remotePort, handle.host, handle.port),
-                // `-o ServerAliveInterval=30` drives client-side keepalives so an
-                // idle session keeps the tunnel warm (the tunnel layer pings too,
-                // but the client must keep its own TCP path alive across every hop).
-                sshCommand: remotePort === 2222 ? `ssh -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -p ${handle.port} ${info.ssh?.username ?? "conveyor"}@${handle.host}` : void 0,
-                sftpCommand: remotePort === 2222 ? `sftp -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -P ${handle.port} ${info.ssh?.username ?? "conveyor"}@${handle.host}` : void 0,
-                previewPorts: info.previewPorts,
-                previewUrls: info.previewUrls,
-                expiresAt: info.expiresAt
-              },
-              null,
-              2
-            )
-          }
-        ]
-      };
-    }
-  );
-}
-function registerStopTunnelTool(server2) {
-  server2.tool(
-    "workspace_stop_tunnel",
-    "Stop a local workspace tunnel previously opened by workspace_start_tunnel.",
-    {
-      tunnelId: z9.string().describe("Tunnel id returned by workspace_start_tunnel")
-    },
-    async ({ tunnelId }) => {
-      const tunnel = activeTunnels.get(tunnelId);
-      if (!tunnel) throw new Error("Workspace tunnel not found");
-      await tunnel.close();
-      activeTunnels.delete(tunnelId);
-      return { content: [{ type: "text", text: "Workspace tunnel stopped" }] };
-    }
-  );
-}
-function registerWorkspaceTools(server2, conn2, deps = {}) {
-  registerAttachInfoTool(server2, conn2);
-  registerPreviewUrlsTool(server2, conn2);
-  registerStartTunnelTool(server2, conn2, deps.startTunnel ?? startWorkspaceSshTunnel);
-  registerStopTunnelTool(server2);
-}
-
-// ../shared/dist/index.js
-import { z as z10 } from "zod";
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 import { z as z32 } from "zod";
 import { z as z42 } from "zod";
 import { z as z52 } from "zod";
@@ -3624,7 +3423,7 @@ import { z as z62 } from "zod";
 import { z as z72 } from "zod";
 import { z as z82 } from "zod";
 import { z as z92 } from "zod";
-import { z as z102 } from "zod";
+import { z as z10 } from "zod";
 import { z as z11 } from "zod";
 import { z as z12 } from "zod";
 var ACHIEVEMENT_RARITIES = [
@@ -3650,7 +3449,7 @@ var ACHIEVEMENT_RARITIES = [
   { key: "pack", name: "Pack", color: "#9c27b0", iconPath: "/storypoints/pack.svg" }
 ];
 var RISK_LEVELS = ["critical", "high", "medium", "low"];
-var riskLevelSchema = z10.enum(RISK_LEVELS);
+var riskLevelSchema = z9.enum(RISK_LEVELS);
 var DEFAULT_RISK_LEVELS = [
   {
     level: "critical",
@@ -3701,158 +3500,187 @@ var DEFAULT_TASK_STATUS_COLOR_INT = Number.parseInt(DEFAULT_TASK_STATUS_COLOR.sl
 var MAX_FILE_SIZE_BYTES2 = 25 * 1024 * 1024;
 var MAX_FILE_TAGS2 = 5;
 var MAX_FILE_TAG_LENGTH = 100;
+var ALLOWED_FILE_MIME_TYPES = [
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "application/json",
+  "text/csv",
+  "text/plain",
+  "text/markdown",
+  "text/vnd.mermaid",
+  "application/pdf",
+  // Reports (conveyor-consensus and friends) are single-file, no-JS HTML. Safe
+  // to store because the DOWNLOAD route serves these under a sandbox CSP with
+  // an opaque origin — see SANDBOXED_MIME in services/file/routes.ts.
+  "text/html",
+  // Office documents: the OOXML trio only (legacy .doc/.xls/.ppt stay out).
+  // Served inline like PDFs; browsers download them and nothing renders
+  // in-origin, so they need no SANDBOXED_MIME entry.
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation"
+];
+var ALLOWED_FILE_ACCEPT = [
+  ...ALLOWED_FILE_MIME_TYPES,
+  // Extensions too: a mime-only `accept` filters the OS picker by its own mime
+  // registry, which greys out .md/.mmd (and Office files on a machine without
+  // Office) even though the upload would succeed.
+  ".png,.jpg,.jpeg,.gif,.webp,.json,.csv,.txt,.md,.mmd,.pdf,.html,.docx,.xlsx,.pptx"
+].join(",");
 var EMBED_THRESHOLD_IMAGES = 5 * 1024 * 1024;
 var EMBED_THRESHOLD_TEXT = 2 * 1024 * 1024;
 var IDLE_HEARTBEAT_MS = 90 * 1e3;
-var TurnEndToolCallSchema = z22.object({
-  tool: z22.string(),
-  input: z22.string().optional(),
-  output: z22.string().optional(),
-  timestamp: z22.string().optional()
+var TurnEndToolCallSchema = z23.object({
+  tool: z23.string(),
+  input: z23.string().optional(),
+  output: z23.string().optional(),
+  timestamp: z23.string().optional()
 }).passthrough();
-var AgentTurnUsageSchema = z22.object({
-  inputTokens: z22.number(),
-  outputTokens: z22.number(),
-  cacheReadInputTokens: z22.number(),
-  cacheCreationInputTokens: z22.number(),
-  totalTokens: z22.number()
-});
-var KnownAgentEventSchema = z22.discriminatedUnion("type", [
+var AgentTurnUsageSchema = z23.object({
+  inputTokens: z23.number(),
+  outputTokens: z23.number(),
+  cacheReadInputTokens: z23.number(),
+  cacheCreationInputTokens: z23.number(),
+  totalTokens: z23.number()
+});
+var KnownAgentEventSchema = z23.discriminatedUnion("type", [
   // ── Lifecycle / connection ────────────────────────────────────────────
-  z22.object({
-    type: z22.literal("connected"),
-    sessionId: z22.string(),
-    projectId: z22.string().optional()
+  z23.object({
+    type: z23.literal("connected"),
+    sessionId: z23.string(),
+    projectId: z23.string().optional()
   }).passthrough(),
   // Open-ended context snapshot spread from buildInitializationContext().
-  z22.object({ type: z22.literal("session_manifest") }).passthrough(),
-  z22.object({
-    type: z22.literal("agent_runner_status"),
-    reason: z22.string(),
-    attempt: z22.number().optional(),
-    attempts: z22.number().optional()
+  z23.object({ type: z23.literal("session_manifest") }).passthrough(),
+  z23.object({
+    type: z23.literal("agent_runner_status"),
+    reason: z23.string(),
+    attempt: z23.number().optional(),
+    attempts: z23.number().optional()
   }).passthrough(),
-  z22.object({ type: z22.literal("shutdown"), reason: z22.string().optional() }).passthrough(),
-  z22.object({ type: z22.literal("mode_changed"), agentMode: z22.string() }).passthrough(),
-  z22.object({ type: z22.literal("mode_transition"), from: z22.string(), to: z22.string() }).passthrough(),
+  z23.object({ type: z23.literal("shutdown"), reason: z23.string().optional() }).passthrough(),
+  z23.object({ type: z23.literal("mode_changed"), agentMode: z23.string() }).passthrough(),
+  z23.object({ type: z23.literal("mode_transition"), from: z23.string(), to: z23.string() }).passthrough(),
   // ── Turn stream ───────────────────────────────────────────────────────
-  z22.object({ type: z22.literal("message"), content: z22.string() }).passthrough(),
-  z22.object({ type: z22.literal("thinking"), message: z22.string() }).passthrough(),
-  z22.object({
-    type: z22.literal("tool_use"),
-    tool: z22.string(),
+  z23.object({ type: z23.literal("message"), content: z23.string() }).passthrough(),
+  z23.object({ type: z23.literal("thinking"), message: z23.string() }).passthrough(),
+  z23.object({
+    type: z23.literal("tool_use"),
+    tool: z23.string(),
     // Producers send JSON.stringify(input); consumers defend against
     // object inputs from older agents, so the wire stays permissive here.
-    input: z22.unknown().optional()
+    input: z23.unknown().optional()
   }).passthrough(),
-  z22.object({
-    type: z22.literal("tool_result"),
-    tool: z22.string(),
-    output: z22.unknown().optional(),
-    isError: z22.boolean().optional(),
-    redactedCount: z22.number().optional()
+  z23.object({
+    type: z23.literal("tool_result"),
+    tool: z23.string(),
+    output: z23.unknown().optional(),
+    isError: z23.boolean().optional(),
+    redactedCount: z23.number().optional()
   }).passthrough(),
-  z22.object({ type: z22.literal("turn_end"), toolCalls: z22.array(TurnEndToolCallSchema) }).passthrough(),
-  z22.object({
-    type: z22.literal("completed"),
-    summary: z22.string().optional(),
-    durationMs: z22.number().optional(),
+  z23.object({ type: z23.literal("turn_end"), toolCalls: z23.array(TurnEndToolCallSchema) }).passthrough(),
+  z23.object({
+    type: z23.literal("completed"),
+    summary: z23.string().optional(),
+    durationMs: z23.number().optional(),
     /** Tokens this turn consumed, summed from the transcript's assistant
      *  records. Optional: an older agent build sends none, and the server
      *  then records nothing rather than zeroing the session's totals. */
     usage: AgentTurnUsageSchema.optional()
   }).passthrough(),
-  z22.object({ type: z22.literal("error"), message: z22.string() }).passthrough(),
-  z22.object({ type: z22.literal("agent_typing_start") }).passthrough(),
-  z22.object({ type: z22.literal("agent_typing_stop") }).passthrough(),
+  z23.object({ type: z23.literal("error"), message: z23.string() }).passthrough(),
+  z23.object({ type: z23.literal("agent_typing_start") }).passthrough(),
+  z23.object({ type: z23.literal("agent_typing_stop") }).passthrough(),
   // ── Telemetry ─────────────────────────────────────────────────────────
   // heartbeat/typing: legacy telemetry the server still classifies as
   // transient (TRANSIENT_EVENT_TYPES) — kept in the vocabulary.
-  z22.object({ type: z22.literal("heartbeat") }).passthrough(),
-  z22.object({ type: z22.literal("typing") }).passthrough(),
-  z22.object({
-    type: z22.literal("context_update"),
-    contextTokens: z22.number(),
-    contextWindow: z22.number(),
-    inputTokens: z22.number().optional(),
-    cacheReadInputTokens: z22.number().optional(),
-    cacheCreationInputTokens: z22.number().optional(),
-    totalTokensUsed: z22.number().optional()
+  z23.object({ type: z23.literal("heartbeat") }).passthrough(),
+  z23.object({ type: z23.literal("typing") }).passthrough(),
+  z23.object({
+    type: z23.literal("context_update"),
+    contextTokens: z23.number(),
+    contextWindow: z23.number(),
+    inputTokens: z23.number().optional(),
+    cacheReadInputTokens: z23.number().optional(),
+    cacheCreationInputTokens: z23.number().optional(),
+    totalTokensUsed: z23.number().optional()
   }).passthrough(),
   // Four producer shapes share this type: {rateLimitType, utilization, status}
   // (SDK rate_limit_event), {resetsAt} (agent-connection resume notice), the
   // usage-sampler ({rateLimitType, utilization, status, resetsAt, gauges}
   // — resetsAt matches rateLimitType; gauges survives via .passthrough()), and
   // {unmeasurable, reason} (the sampler reporting it cannot read this key).
-  z22.object({
-    type: z22.literal("rate_limit_update"),
-    rateLimitType: z22.string().optional(),
-    utilization: z22.number().optional(),
-    status: z22.string().optional(),
-    resetsAt: z22.string().optional(),
-    unmeasurable: z22.boolean().optional(),
-    reason: z22.string().optional()
+  z23.object({
+    type: z23.literal("rate_limit_update"),
+    rateLimitType: z23.string().optional(),
+    utilization: z23.number().optional(),
+    status: z23.string().optional(),
+    resetsAt: z23.string().optional(),
+    unmeasurable: z23.boolean().optional(),
+    reason: z23.string().optional()
   }).passthrough(),
-  z22.object({
-    type: z22.literal("context_compacted"),
-    trigger: z22.string().optional(),
-    preTokens: z22.number().optional()
+  z23.object({
+    type: z23.literal("context_compacted"),
+    trigger: z23.string().optional(),
+    preTokens: z23.number().optional()
   }).passthrough(),
-  z22.object({
-    type: z22.literal("tool_progress"),
-    toolName: z22.string().optional(),
-    elapsedSeconds: z22.number().optional()
+  z23.object({
+    type: z23.literal("tool_progress"),
+    toolName: z23.string().optional(),
+    elapsedSeconds: z23.number().optional()
   }).passthrough(),
-  z22.object({
-    type: z22.literal("subagent_started"),
-    sdkTaskId: z22.string().optional(),
-    description: z22.string().optional()
+  z23.object({
+    type: z23.literal("subagent_started"),
+    sdkTaskId: z23.string().optional(),
+    description: z23.string().optional()
   }).passthrough(),
-  z22.object({
-    type: z22.literal("subagent_progress"),
-    sdkTaskId: z22.string().optional(),
-    description: z22.string().optional(),
-    toolUses: z22.number().optional(),
-    durationMs: z22.number().optional()
+  z23.object({
+    type: z23.literal("subagent_progress"),
+    sdkTaskId: z23.string().optional(),
+    description: z23.string().optional(),
+    toolUses: z23.number().optional(),
+    durationMs: z23.number().optional()
   }).passthrough(),
   // ── Work products ─────────────────────────────────────────────────────
-  z22.object({ type: z22.literal("pr_created"), url: z22.string(), number: z22.number() }).passthrough(),
-  z22.object({
-    type: z22.literal("code_review_complete"),
-    result: z22.enum(["approved", "changes_requested"]),
-    summary: z22.string().optional(),
-    issues: z22.array(
-      z22.object({
-        file: z22.string(),
-        line: z22.number().optional(),
-        severity: z22.string().optional(),
-        description: z22.string().optional()
+  z23.object({ type: z23.literal("pr_created"), url: z23.string(), number: z23.number() }).passthrough(),
+  z23.object({
+    type: z23.literal("code_review_complete"),
+    result: z23.enum(["approved", "changes_requested"]),
+    summary: z23.string().optional(),
+    issues: z23.array(
+      z23.object({
+        file: z23.string(),
+        line: z23.number().optional(),
+        severity: z23.string().optional(),
+        description: z23.string().optional()
       }).passthrough()
     ).optional()
   }).passthrough(),
   // ── Environment setup / start command ─────────────────────────────────
-  z22.object({ type: z22.literal("setup_output"), stream: z22.string(), data: z22.string() }).passthrough(),
-  z22.object({
-    type: z22.literal("setup_complete"),
-    startCommandRunning: z22.boolean().optional(),
-    startCommandConfigured: z22.boolean().optional(),
+  z23.object({ type: z23.literal("setup_output"), stream: z23.string(), data: z23.string() }).passthrough(),
+  z23.object({
+    type: z23.literal("setup_complete"),
+    startCommandRunning: z23.boolean().optional(),
+    startCommandConfigured: z23.boolean().optional(),
     // Sanitized server-side by sanitizeSessionPreviewPorts — stays unknown.
-    previewPorts: z22.unknown().optional()
+    previewPorts: z23.unknown().optional()
   }).passthrough(),
-  z22.object({ type: z22.literal("setup_error"), message: z22.string() }).passthrough(),
-  z22.object({ type: z22.literal("start_command_started") }).passthrough(),
-  z22.object({ type: z22.literal("start_command_output"), stream: z22.string(), data: z22.string() }).passthrough(),
-  z22.object({
-    type: z22.literal("start_command_exited"),
-    code: z22.number().nullable().optional(),
-    signal: z22.string().nullable().optional(),
-    message: z22.string().optional()
+  z23.object({ type: z23.literal("setup_error"), message: z23.string() }).passthrough(),
+  z23.object({ type: z23.literal("start_command_started") }).passthrough(),
+  z23.object({ type: z23.literal("start_command_output"), stream: z23.string(), data: z23.string() }).passthrough(),
+  z23.object({
+    type: z23.literal("start_command_exited"),
+    code: z23.number().nullable().optional(),
+    signal: z23.string().nullable().optional(),
+    message: z23.string().optional()
   }).passthrough(),
-  z22.object({ type: z22.literal("start_command_error"), message: z22.string() }).passthrough()
+  z23.object({ type: z23.literal("start_command_error"), message: z23.string() }).passthrough()
 ]);
-var AgentEventSchema = z22.union([
+var AgentEventSchema = z23.union([
   KnownAgentEventSchema,
-  z22.object({ type: z22.string().min(1) }).catchall(z22.unknown())
+  z23.object({ type: z23.string().min(1) }).catchall(z23.unknown())
 ]);
 var cardDescription = z32.string().max(CARD_DESCRIPTION_MAX, CARD_DESCRIPTION_LIMIT_MESSAGE).optional();
 var AgentHeartbeatSchema = z32.object({
@@ -3896,9 +3724,15 @@ var GetChatMessagesRequestSchema = z32.object({
   taskId: z32.string().optional()
 });
 var GetTaskFilesRequestSchema = z32.object({
-  sessionId: z32.string()
+  sessionId: z32.string(),
+  taskId: z32.string().optional()
 });
 var GetTaskFileRequestSchema = z32.object({
+  sessionId: z32.string(),
+  fileId: z32.string(),
+  taskId: z32.string().optional()
+});
+var DeleteTaskFileRequestSchema = z32.object({
   sessionId: z32.string(),
   fileId: z32.string()
 });
@@ -3963,7 +3797,7 @@ var StoreSessionIdRequestSchema = z32.object({
 });
 var SetManualTestsRequestSchema = z32.object({
   sessionId: z32.string(),
-  items: z32.array(z32.object({ title: z32.string().min(1) })).min(1)
+  items: ManualTestItemsSchema
 });
 var EditManualTestRequestSchema = z32.object({
   sessionId: z32.string(),
@@ -4426,6 +4260,11 @@ var ListProjectTasksRequestSchema = z52.object({
   // Scope to a sub-project board when provided. Unlike the board layer's `?? null`
   // semantics, agents default to seeing the whole project when omitted.
   subProjectId: z52.string().nullable().optional(),
+  // Plain equality on the on-hold flag: true = only parked cards, false =
+  // exclude them, omitted = both. Deliberately NOT the board's
+  // includeOnHold/surfaceActiveWork bucketing — an agent sweeping a backlog
+  // needs the raw column, not a column projection.
+  onHold: z52.boolean().optional(),
   limit: z52.number().int().positive().optional().default(50)
 }).refine((p) => !(p.unassigned && p.assigneeId), {
   message: "Pass either assigneeId or unassigned, not both"
@@ -4460,7 +4299,9 @@ var SearchProjectTasksRequestSchema = z52.object({
   message: "Pass either assigneeId or unassigned, not both"
 });
 var ListProjectTagsRequestSchema = z52.object({
-  projectId: z52.string()
+  projectId: z52.string(),
+  /** "summary" (default) omits inline context links; "full" includes them. */
+  detail: z52.enum(["summary", "full"]).optional()
 });
 var GetProjectTagRequestSchema = z52.object({
   projectId: z52.string(),
@@ -4563,11 +4404,15 @@ var UpdateProjectTaskRequestSchema = z52.object({
   // handler: the ref must exist on origin and no live workspace may be bound
   // to a different branch.
   githubBranch: z52.string().min(1).max(GIT_BRANCH_NAME_MAX).refine(isValidGitBranchName, { message: GIT_BRANCH_NAME_MESSAGE }).nullable().optional(),
+  // Park the card on hold (true) or return it to the active board (false).
+  // The handler mirrors the web path's two side effects: a board re-bucket
+  // event, and demotion to Open when an active-work card is parked.
+  onHold: z52.boolean().optional(),
   requestingUserId: z52.string().optional()
 }).strict().refine(
-  (v) => v.title !== void 0 || v.description !== void 0 || v.plan !== void 0 || v.status !== void 0 || v.risk !== void 0 || v.storyPointValue !== void 0 || v.assignedUserId !== void 0 || v.subProjectId !== void 0 || v.githubBranch !== void 0,
+  (v) => v.title !== void 0 || v.description !== void 0 || v.plan !== void 0 || v.status !== void 0 || v.risk !== void 0 || v.storyPointValue !== void 0 || v.assignedUserId !== void 0 || v.subProjectId !== void 0 || v.githubBranch !== void 0 || v.onHold !== void 0,
   {
-    message: "update_task requires at least one field to change (title, description, plan, status, risk, storyPointValue, assignedUserId, subProjectId, or githubBranch)"
+    message: "update_task requires at least one field to change (title, description, plan, status, risk, storyPointValue, assignedUserId, subProjectId, githubBranch, or onHold)"
   }
 );
 var TransitionProjectTaskStatusRequestSchema = z52.object({
@@ -4828,6 +4673,12 @@ var GetProjectAttachmentRequestSchema = z52.object({
   /** Max bytes of text content to return from `offset`. Server default applies. */
   maxBytes: z52.number().int().positive().optional()
 });
+var DeleteProjectTaskFileRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  fileId: z52.string(),
+  requestingUserId: z52.string().optional()
+});
 var RequestProjectFileUploadRequestSchema = z52.object({
   projectId: z52.string(),
   taskId: z52.string(),
@@ -4882,7 +4733,7 @@ var QueryProjectManualTestsRequestSchema = z52.object({
 var SetProjectManualTestsRequestSchema = z52.object({
   projectId: z52.string(),
   taskId: z52.string(),
-  items: z52.array(z52.object({ title: z52.string().min(1) })).min(1),
+  items: ManualTestItemsSchema,
   requestingUserId: z52.string().optional()
 });
 var EditProjectManualTestRequestSchema = z52.object({
@@ -4961,170 +4812,134 @@ var ReportApiOutageRequestSchema = z72.object({
   detail: z72.string().max(2e3),
   attempts: z72.number().int().min(0).max(100)
 });
-var SHA_PATTERN = /^[0-9a-f]{40}$/i;
-var ReviewGuideFileReferenceSchema = z82.object({
-  path: z82.string().min(1).max(500),
-  startLine: z82.number().int().positive().max(1e6).optional(),
-  endLine: z82.number().int().positive().max(1e6).optional(),
-  hunkHeader: z82.string().min(1).max(300).optional()
-}).strict().superRefine((value, ctx) => {
-  if (value.endLine !== void 0 && value.startLine === void 0) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["startLine"],
-      message: "startLine is required when endLine is set"
-    });
-  }
-  if (value.startLine !== void 0 && value.endLine !== void 0 && value.endLine < value.startLine) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["endLine"],
-      message: "endLine must be greater than or equal to startLine"
-    });
-  }
-});
-var ReviewGuideSectionSchema = z82.object({
-  title: z82.string().min(1).max(160),
-  explanation: z82.string().min(1).max(2e3),
-  classification: z82.enum(["core", "supporting"]).optional(),
-  files: z82.array(ReviewGuideFileReferenceSchema).min(1).max(20)
-}).strict();
-var ReviewGuideContentSchema = z82.object({
-  overview: z82.string().min(1).max(3e3),
-  sections: z82.array(ReviewGuideSectionSchema).min(1).max(12)
-}).strict();
-var PublishReviewGuideRequestSchema = ReviewGuideContentSchema.extend({
-  sessionId: z82.string().min(1),
-  reviewedSha: z82.string().regex(SHA_PATTERN, "reviewedSha must be a 40-character commit SHA")
-}).strict();
 var CONTEXT_LINK_LOCATOR_MAX2 = 300;
 var TAG_DESCRIPTION_MAX = CARD_DESCRIPTION_MAX;
 var TAG_OVERVIEW_MAX = 32e3;
 var TAG_REASON_MAX = 500;
-var ProjectTagContextPathSchema = z92.object({
-  type: z92.enum(["rule", "doc", "file", "folder"]),
-  path: z92.string().min(1).max(500),
-  label: z92.string().max(100).optional(),
+var ProjectTagContextPathSchema = z82.object({
+  type: z82.enum(["rule", "doc", "file", "folder"]),
+  path: z82.string().min(1).max(500),
+  label: z82.string().max(100).optional(),
   /** Verified-link tether — text that must keep existing in the file. */
-  locator: z92.string().min(1).max(CONTEXT_LINK_LOCATOR_MAX2).regex(/^[^\r\n]*$/, "Locator cannot contain line breaks").optional(),
+  locator: z82.string().min(1).max(CONTEXT_LINK_LOCATOR_MAX2).regex(/^[^\r\n]*$/, "Locator cannot contain line breaks").optional(),
   /** test = must appear in a real test/describe title; code = any substring. */
-  locatorType: z92.enum(["test", "code"]).optional()
+  locatorType: z82.enum(["test", "code"]).optional()
 }).refine((link) => link.locator === void 0 === (link.locatorType === void 0), {
   message: "locator and locatorType must be provided together"
 }).refine((link) => link.locator === void 0 || link.type !== "folder", {
   message: "folder links cannot carry a locator"
 });
-var hexColor = z92.string().regex(/^#[0-9a-fA-F]{6}$/, "Expected #RRGGBB hex color");
-var overviewPathSchema = z92.string().min(1).max(500).regex(/^[^\r\n]*$/, "Overview path cannot contain line breaks");
-var CreateProjectTagRequestSchema = z92.object({
-  projectId: z92.string(),
-  name: z92.string().min(1).max(50),
+var hexColor = z82.string().regex(/^#[0-9a-fA-F]{6}$/, "Expected #RRGGBB hex color");
+var overviewPathSchema = z82.string().min(1).max(500).regex(/^[^\r\n]*$/, "Overview path cannot contain line breaks");
+var CreateProjectTagRequestSchema = z82.object({
+  projectId: z82.string(),
+  name: z82.string().min(1).max(50),
   color: hexColor.optional(),
-  description: z92.string().max(TAG_DESCRIPTION_MAX).optional(),
-  overview: z92.string().max(TAG_OVERVIEW_MAX).optional(),
+  description: z82.string().max(TAG_DESCRIPTION_MAX).optional(),
+  overview: z82.string().max(TAG_OVERVIEW_MAX).optional(),
   /** Source the overview from this repo file (stored overview stays as the pending fallback). */
   overviewPath: overviewPathSchema.optional(),
-  contextPaths: z92.array(ProjectTagContextPathSchema).max(20).optional(),
+  contextPaths: z82.array(ProjectTagContextPathSchema).max(20).optional(),
   /** Parents to link at create time (multi-parent DAG). */
-  parentTagIds: z92.array(z92.string()).max(25).optional(),
-  requestingUserId: z92.string().optional()
+  parentTagIds: z82.array(z82.string()).max(25).optional(),
+  requestingUserId: z82.string().optional()
 });
-var UpdateProjectTagRequestSchema = z92.object({
-  projectId: z92.string(),
-  tagId: z92.string(),
-  name: z92.string().min(1).max(50).optional(),
+var UpdateProjectTagRequestSchema = z82.object({
+  projectId: z82.string(),
+  tagId: z82.string(),
+  name: z82.string().min(1).max(50).optional(),
   color: hexColor.optional(),
-  description: z92.string().max(TAG_DESCRIPTION_MAX).optional(),
+  description: z82.string().max(TAG_DESCRIPTION_MAX).optional(),
   /** Full markdown glossary body; null clears it. Rejected while overviewPath is set. */
-  overview: z92.string().max(TAG_OVERVIEW_MAX).nullable().optional(),
+  overview: z82.string().max(TAG_OVERVIEW_MAX).nullable().optional(),
   /** Repo file to source the overview from; null clears back to the stored overview. */
   overviewPath: overviewPathSchema.nullable().optional(),
   /** Full replacement of the tag's context links when provided. */
-  contextPaths: z92.array(ProjectTagContextPathSchema).max(20).optional(),
+  contextPaths: z82.array(ProjectTagContextPathSchema).max(20).optional(),
   /** Full-set replacement of the tag's parent tags (multi-parent DAG). */
-  parentTagIds: z92.array(z92.string()).max(25).optional(),
+  parentTagIds: z82.array(z82.string()).max(25).optional(),
   /** One-line revision provenance, recorded in the tag's history. */
-  reason: z92.string().max(TAG_REASON_MAX).optional(),
+  reason: z82.string().max(TAG_REASON_MAX).optional(),
   /** Card the caller was working in — stamped into the revision history. */
-  taskId: z92.string().optional(),
-  requestingUserId: z92.string().optional()
+  taskId: z82.string().optional(),
+  requestingUserId: z82.string().optional()
 });
-var PostToProjectChatRequestSchema = z92.object({
-  projectId: z92.string(),
-  content: z92.string().min(1).max(2e4),
-  requestingUserId: z92.string().optional(),
+var PostToProjectChatRequestSchema = z82.object({
+  projectId: z82.string(),
+  content: z82.string().min(1).max(2e4),
+  requestingUserId: z82.string().optional(),
   /** Marks the post so the server can persist it beyond chat (tag-audit summaries land in tag history). */
-  kind: z92.enum(["tag_audit_summary"]).optional()
-});
-var StartTagAuditRequestSchema = z92.object({
-  projectId: z92.string(),
-  requestingUserId: z92.string().optional()
-});
-var StartTaskAuditRequestSchema = z92.object({
-  projectId: z92.string(),
-  taskIds: z92.array(z92.string()).min(1).max(20),
-  requestingUserId: z92.string().optional()
-});
-var GetActiveAuditSessionsRequestSchema = z92.object({
-  projectId: z92.string()
-});
-var ReportTaskAuditResultRequestSchema = z92.object({
-  projectId: z92.string(),
-  taskId: z92.string(),
-  summary: z92.string(),
-  turnGrades: z92.array(
-    z92.object({
-      turnIndex: z92.number(),
-      phase: z92.enum(["planning", "building", "human"]),
-      grade: z92.enum(["correct", "neutral", "blunder"]),
-      reasoning: z92.string(),
-      eventType: z92.string(),
-      eventSummary: z92.string()
+  kind: z82.enum(["tag_audit_summary"]).optional()
+});
+var StartTagAuditRequestSchema = z82.object({
+  projectId: z82.string(),
+  requestingUserId: z82.string().optional()
+});
+var StartTaskAuditRequestSchema = z82.object({
+  projectId: z82.string(),
+  taskIds: z82.array(z82.string()).min(1).max(20),
+  requestingUserId: z82.string().optional()
+});
+var GetActiveAuditSessionsRequestSchema = z82.object({
+  projectId: z82.string()
+});
+var ReportTaskAuditResultRequestSchema = z82.object({
+  projectId: z82.string(),
+  taskId: z82.string(),
+  summary: z82.string(),
+  turnGrades: z82.array(
+    z82.object({
+      turnIndex: z82.number(),
+      phase: z82.enum(["planning", "building", "human"]),
+      grade: z82.enum(["correct", "neutral", "blunder"]),
+      reasoning: z82.string(),
+      eventType: z82.string(),
+      eventSummary: z82.string()
     })
   ),
-  planningAccuracy: z92.number().nullable(),
-  buildingAccuracy: z92.number().nullable(),
-  humanAccuracy: z92.number().nullable(),
-  planningCorrect: z92.number(),
-  planningNeutral: z92.number(),
-  planningBlunder: z92.number(),
-  buildingCorrect: z92.number(),
-  buildingNeutral: z92.number(),
-  buildingBlunder: z92.number(),
-  humanCorrect: z92.number(),
-  humanNeutral: z92.number(),
-  humanBlunder: z92.number(),
-  humanEvaluations: z92.array(
-    z92.object({
-      messageIndex: z92.number(),
-      rating: z92.union([z92.literal(-1), z92.literal(0), z92.literal(1)]),
-      reasoning: z92.string()
+  planningAccuracy: z82.number().nullable(),
+  buildingAccuracy: z82.number().nullable(),
+  humanAccuracy: z82.number().nullable(),
+  planningCorrect: z82.number(),
+  planningNeutral: z82.number(),
+  planningBlunder: z82.number(),
+  buildingCorrect: z82.number(),
+  buildingNeutral: z82.number(),
+  buildingBlunder: z82.number(),
+  humanCorrect: z82.number(),
+  humanNeutral: z82.number(),
+  humanBlunder: z82.number(),
+  humanEvaluations: z82.array(
+    z82.object({
+      messageIndex: z82.number(),
+      rating: z82.union([z82.literal(-1), z82.literal(0), z82.literal(1)]),
+      reasoning: z82.string()
     })
   ).optional(),
-  suggestionIds: z92.array(z92.string()),
-  auditCostUsd: z92.number().nullable(),
-  model: z92.string().nullable(),
+  suggestionIds: z82.array(z82.string()),
+  auditCostUsd: z82.number().nullable(),
+  model: z82.string().nullable(),
   /** When set, the audit is marked failed with this message instead. */
-  error: z92.string().optional()
+  error: z82.string().optional()
 });
-var GetTaskAuditsRequestSchema = z92.object({
-  projectId: z92.string(),
-  limit: z92.number().int().positive().max(200).optional().default(50)
+var GetTaskAuditsRequestSchema = z82.object({
+  projectId: z82.string(),
+  limit: z82.number().int().positive().max(200).optional().default(50)
 });
-var GetTaskAuditRequestSchema = z92.object({
-  projectId: z92.string(),
-  auditId: z92.string()
+var GetTaskAuditRequestSchema = z82.object({
+  projectId: z82.string(),
+  auditId: z82.string()
 });
-var GetTaskAuditAggregatesRequestSchema = z92.object({
-  projectId: z92.string()
+var GetTaskAuditAggregatesRequestSchema = z82.object({
+  projectId: z82.string()
 });
-var DeleteTaskAuditRequestSchema = z92.object({
-  projectId: z92.string(),
-  auditId: z92.string(),
-  requestingUserId: z92.string().optional()
+var DeleteTaskAuditRequestSchema = z82.object({
+  projectId: z82.string(),
+  auditId: z82.string(),
+  requestingUserId: z82.string().optional()
 });
-var MarkInitialPromptSubmittedRequestSchema = z92.object({
-  sessionId: z92.string()
+var MarkInitialPromptSubmittedRequestSchema = z82.object({
+  sessionId: z82.string()
 });
 var DECISION_STATUS_LABELS = ["Open", "Decided", "Cancelled"];
 var DECISION_OPTION_KINDS = ["current", "planned", "proposed"];
@@ -5139,166 +4954,272 @@ var DECISION_DEADLINE_MIN_HOURS = 1;
 var DECISION_DEADLINE_MAX_DAYS = 30;
 var DECISION_DEADLINE_MAX_HOURS = DECISION_DEADLINE_MAX_DAYS * 24;
 var DECISION_LIST_MAX_LIMIT = 200;
-var decisionIdSchema = z102.string().cuid("Invalid decision ID");
-var optionInputSchema = z102.object({
-  label: z102.string().min(1, "Option label is required").max(DECISION_OPTION_LABEL_MAX),
-  description: z102.string().min(1, "Describe the option as GIVEN / WHEN / THEN"),
-  kind: z102.enum(DECISION_OPTION_KINDS).optional()
+var decisionIdSchema = z92.string().cuid("Invalid decision ID");
+var optionInputSchema = z92.object({
+  label: z92.string().min(1, "Option label is required").max(DECISION_OPTION_LABEL_MAX),
+  description: z92.string().min(1, "Describe the option as GIVEN / WHEN / THEN"),
+  kind: z92.enum(DECISION_OPTION_KINDS).optional()
 });
-var optionsArraySchema = z102.array(optionInputSchema).min(DECISION_OPTIONS_MIN, `A decision needs at least ${DECISION_OPTIONS_MIN} options`).max(
+var optionsArraySchema = z92.array(optionInputSchema).min(DECISION_OPTIONS_MIN, `A decision needs at least ${DECISION_OPTIONS_MIN} options`).max(
   DECISION_OPTIONS_MAX,
   `A decision takes at most ${DECISION_OPTIONS_MAX} options \u2014 more than that means the question is not framed yet`
 );
-var CreateDecisionRequestSchema = z102.object({
-  projectId: z102.string().cuid("Invalid project ID"),
+var CreateDecisionRequestSchema = z92.object({
+  projectId: z92.string().cuid("Invalid project ID"),
   /** The question, as one plain sentence. */
-  title: z102.string().min(1, "A decision needs a question").max(DECISION_QUESTION_MAX),
-  description: z102.string().max(CARD_DESCRIPTION_MAX).optional(),
-  context: z102.string().min(1, "Context is required \u2014 say why this is being asked now"),
+  title: z92.string().min(1, "A decision needs a question").max(DECISION_QUESTION_MAX),
+  description: z92.string().max(CARD_DESCRIPTION_MAX).optional(),
+  context: z92.string().min(1, "Context is required \u2014 say why this is being asked now"),
   options: optionsArraySchema,
   /** 1-based position of the option that wins on silence. */
-  defaultOptionOrdinal: z102.number().int().min(1).max(DECISION_OPTIONS_MAX),
-  deadlineHours: z102.number().min(DECISION_DEADLINE_MIN_HOURS).max(DECISION_DEADLINE_MAX_HOURS).optional(),
+  defaultOptionOrdinal: z92.number().int().min(1).max(DECISION_OPTIONS_MAX),
+  deadlineHours: z92.number().min(DECISION_DEADLINE_MIN_HOURS).max(DECISION_DEADLINE_MAX_HOURS).optional(),
   /** Cards this decision blocks, by cuid or slug. */
-  impactedCardRefs: z102.array(z102.string().min(1)).max(50).optional(),
-  tagNames: z102.array(z102.string().min(1)).max(10).optional(),
-  raisedByTaskId: z102.string().min(1).optional(),
-  raisedByPrNumber: z102.number().int().positive().optional()
+  impactedCardRefs: z92.array(z92.string().min(1)).max(50).optional(),
+  tagNames: z92.array(z92.string().min(1)).max(10).optional(),
+  raisedByTaskId: z92.string().min(1).optional(),
+  raisedByPrNumber: z92.number().int().positive().optional()
 });
-var VoteDecisionRequestSchema = z102.object({
+var VoteDecisionRequestSchema = z92.object({
   decisionId: decisionIdSchema,
-  optionId: z102.string().cuid("Invalid option ID"),
-  reason: z102.string().max(DECISION_VOTE_REASON_MAX).optional(),
-  source: z102.enum(DECISION_VOTE_SOURCES).optional()
+  optionId: z92.string().cuid("Invalid option ID"),
+  reason: z92.string().max(DECISION_VOTE_REASON_MAX).optional(),
+  source: z92.enum(DECISION_VOTE_SOURCES).optional()
 });
-var RemoveDecisionVoteRequestSchema = z102.object({
+var RemoveDecisionVoteRequestSchema = z92.object({
   decisionId: decisionIdSchema
 });
-var ResolveDecisionRequestSchema = z102.object({
+var ResolveDecisionRequestSchema = z92.object({
   decisionId: decisionIdSchema,
-  chosenOptionId: z102.string().cuid("Invalid option ID"),
-  resolution: z102.string().min(1, "A resolution is required \u2014 say what was decided").max(DECISION_RESOLUTION_MAX),
-  resolutionNotes: z102.string().optional()
+  chosenOptionId: z92.string().cuid("Invalid option ID"),
+  resolution: z92.string().min(1, "A resolution is required \u2014 say what was decided").max(DECISION_RESOLUTION_MAX),
+  resolutionNotes: z92.string().optional()
 });
-var CancelDecisionRequestSchema = z102.object({
+var CancelDecisionRequestSchema = z92.object({
   decisionId: decisionIdSchema,
   /** Why it is being dropped. Posted to the decision thread. */
-  reason: z102.string().max(DECISION_RESOLUTION_MAX).optional()
+  reason: z92.string().max(DECISION_RESOLUTION_MAX).optional()
 });
-var BulkDecisionIdsRequestSchema = z102.object({
-  projectId: z102.string().cuid("Invalid project ID"),
-  decisionIds: z102.array(z102.string().cuid()).min(1).max(200)
+var BulkDecisionIdsRequestSchema = z92.object({
+  projectId: z92.string().cuid("Invalid project ID"),
+  decisionIds: z92.array(z92.string().cuid()).min(1).max(200)
 });
-var ReopenDecisionRequestSchema = z102.object({
+var ReopenDecisionRequestSchema = z92.object({
   decisionId: decisionIdSchema,
-  deadlineHours: z102.number().min(DECISION_DEADLINE_MIN_HOURS).max(DECISION_DEADLINE_MAX_HOURS).optional()
+  deadlineHours: z92.number().min(DECISION_DEADLINE_MIN_HOURS).max(DECISION_DEADLINE_MAX_HOURS).optional()
 });
-var UpdateDecisionRequestSchema = z102.object({
+var UpdateDecisionRequestSchema = z92.object({
   decisionId: decisionIdSchema,
-  title: z102.string().min(1).max(200).optional(),
-  description: z102.string().max(CARD_DESCRIPTION_MAX).optional(),
-  context: z102.string().min(1).optional(),
-  deadlineAt: z102.string().datetime().optional(),
+  title: z92.string().min(1).max(200).optional(),
+  description: z92.string().max(CARD_DESCRIPTION_MAX).optional(),
+  context: z92.string().min(1).optional(),
+  deadlineAt: z92.string().datetime().optional(),
   /** Only accepted while the decision has zero votes. */
   options: optionsArraySchema.optional(),
-  defaultOptionOrdinal: z102.number().int().min(1).max(DECISION_OPTIONS_MAX).optional(),
-  addImpactedCardRefs: z102.array(z102.string().min(1)).max(50).optional(),
-  removeImpactedCardIds: z102.array(z102.string().min(1)).max(50).optional()
+  defaultOptionOrdinal: z92.number().int().min(1).max(DECISION_OPTIONS_MAX).optional(),
+  addImpactedCardRefs: z92.array(z92.string().min(1)).max(50).optional(),
+  removeImpactedCardIds: z92.array(z92.string().min(1)).max(50).optional()
 });
-var GetDecisionRequestSchema = z102.object({
+var GetDecisionRequestSchema = z92.object({
   /** cuid or slug. A slug needs `projectId` to resolve unambiguously. */
-  decisionId: z102.string().min(1),
-  projectId: z102.string().cuid().optional()
+  decisionId: z92.string().min(1),
+  projectId: z92.string().cuid().optional()
 });
-var ListDecisionsRequestSchema = z102.object({
-  projectId: z102.string().cuid("Invalid project ID"),
-  status: z102.enum(DECISION_STATUS_LABELS).optional(),
+var ListDecisionsRequestSchema = z92.object({
+  projectId: z92.string().cuid("Invalid project ID"),
+  status: z92.enum(DECISION_STATUS_LABELS).optional(),
   /** Tag name, not id — an agent knows the tag it is working under. */
-  tag: z102.string().min(1).optional(),
+  tag: z92.string().min(1).optional(),
   /** Decisions that this card is blocked by (cuid or slug). */
-  cardId: z102.string().min(1).optional(),
-  query: z102.string().min(1).optional(),
-  limit: z102.number().int().min(1).max(DECISION_LIST_MAX_LIMIT).optional()
-});
-var optionInput = z11.object({
-  label: z11.string().min(1).max(DECISION_OPTION_LABEL_MAX),
-  description: z11.string().min(1),
-  kind: z11.enum(DECISION_OPTION_KINDS).optional()
-});
-var optionsInput = z11.array(optionInput).min(DECISION_OPTIONS_MIN).max(DECISION_OPTIONS_MAX);
-var deadlineHours = z11.number().min(DECISION_DEADLINE_MIN_HOURS).max(DECISION_DEADLINE_MAX_HOURS).optional();
-var CreateProjectDecisionRequestSchema = z11.object({
-  projectId: z11.string(),
-  question: z11.string().min(1).max(200),
-  summary: z11.string().max(CARD_DESCRIPTION_MAX).optional(),
-  context: z11.string().min(1),
+  cardId: z92.string().min(1).optional(),
+  query: z92.string().min(1).optional(),
+  limit: z92.number().int().min(1).max(DECISION_LIST_MAX_LIMIT).optional()
+});
+var optionInput = z10.object({
+  label: z10.string().min(1).max(DECISION_OPTION_LABEL_MAX),
+  description: z10.string().min(1),
+  kind: z10.enum(DECISION_OPTION_KINDS).optional()
+});
+var optionsInput = z10.array(optionInput).min(DECISION_OPTIONS_MIN).max(DECISION_OPTIONS_MAX);
+var deadlineHours = z10.number().min(DECISION_DEADLINE_MIN_HOURS).max(DECISION_DEADLINE_MAX_HOURS).optional();
+var CreateProjectDecisionRequestSchema = z10.object({
+  projectId: z10.string(),
+  question: z10.string().min(1).max(200),
+  summary: z10.string().max(CARD_DESCRIPTION_MAX).optional(),
+  context: z10.string().min(1),
   options: optionsInput,
-  defaultOption: z11.number().int().min(1).max(DECISION_OPTIONS_MAX),
+  defaultOption: z10.number().int().min(1).max(DECISION_OPTIONS_MAX),
   deadlineHours,
-  impactedCards: z11.array(z11.string().min(1)).max(50).optional(),
+  impactedCards: z10.array(z10.string().min(1)).max(50).optional(),
   /**
    * Pod surface only: also block the card this session is working on. The
    * session's task id is resolved SERVER-side from `sessionId` — a
    * client-supplied card id would let a pod block any card in the project.
    */
-  includeCurrentCard: z11.boolean().optional(),
-  sessionId: z11.string().optional(),
-  tagNames: z11.array(z11.string().min(1)).max(10).optional(),
-  raisedByPr: z11.number().int().positive().optional(),
+  includeCurrentCard: z10.boolean().optional(),
+  sessionId: z10.string().optional(),
+  tagNames: z10.array(z10.string().min(1)).max(10).optional(),
+  raisedByPr: z10.number().int().positive().optional(),
   /** Slug or id of the card that raised the question. A link back, not a block. */
-  raisedByCard: z11.string().min(1).optional(),
+  raisedByCard: z10.string().min(1).optional(),
   /** Absolute deadline (ISO 8601). Wins over `deadlineHours` when both are sent. */
-  deadlineAt: z11.string().datetime({ offset: true }).optional(),
-  requestingUserId: z11.string().optional()
-});
-var ListProjectDecisionsRequestSchema = z11.object({
-  projectId: z11.string(),
-  status: z11.enum(DECISION_STATUS_LABELS).optional(),
-  tag: z11.string().min(1).optional(),
-  card: z11.string().min(1).optional(),
-  query: z11.string().min(1).optional(),
-  limit: z11.number().int().min(1).max(DECISION_LIST_MAX_LIMIT).optional(),
-  requestingUserId: z11.string().optional()
-});
-var GetProjectDecisionRequestSchema = z11.object({
-  projectId: z11.string(),
-  decision: z11.string().min(1),
-  requestingUserId: z11.string().optional()
-});
-var VoteProjectDecisionRequestSchema = z11.object({
-  projectId: z11.string(),
-  decision: z11.string().min(1),
+  deadlineAt: z10.string().datetime({ offset: true }).optional(),
+  requestingUserId: z10.string().optional()
+});
+var ListProjectDecisionsRequestSchema = z10.object({
+  projectId: z10.string(),
+  status: z10.enum(DECISION_STATUS_LABELS).optional(),
+  tag: z10.string().min(1).optional(),
+  card: z10.string().min(1).optional(),
+  query: z10.string().min(1).optional(),
+  limit: z10.number().int().min(1).max(DECISION_LIST_MAX_LIMIT).optional(),
+  requestingUserId: z10.string().optional()
+});
+var GetProjectDecisionRequestSchema = z10.object({
+  projectId: z10.string(),
+  decision: z10.string().min(1),
+  requestingUserId: z10.string().optional()
+});
+var VoteProjectDecisionRequestSchema = z10.object({
+  projectId: z10.string(),
+  decision: z10.string().min(1),
   /** An option id, or its 1-based position. */
-  option: z11.string().min(1),
-  reason: z11.string().max(CARD_DESCRIPTION_MAX).optional(),
-  requestingUserId: z11.string().optional()
-});
-var ResolveProjectDecisionRequestSchema = z11.object({
-  projectId: z11.string(),
-  decision: z11.string().min(1),
-  option: z11.string().min(1),
-  resolution: z11.string().min(1).max(DECISION_RESOLUTION_MAX),
-  notes: z11.string().optional(),
-  requestingUserId: z11.string().optional()
-});
-var UpdateProjectDecisionRequestSchema = z11.object({
-  projectId: z11.string(),
-  decision: z11.string().min(1),
-  question: z11.string().min(1).max(200).optional(),
-  summary: z11.string().max(CARD_DESCRIPTION_MAX).optional(),
-  context: z11.string().min(1).optional(),
+  option: z10.string().min(1),
+  reason: z10.string().max(CARD_DESCRIPTION_MAX).optional(),
+  requestingUserId: z10.string().optional()
+});
+var ResolveProjectDecisionRequestSchema = z10.object({
+  projectId: z10.string(),
+  decision: z10.string().min(1),
+  option: z10.string().min(1),
+  resolution: z10.string().min(1).max(DECISION_RESOLUTION_MAX),
+  notes: z10.string().optional(),
+  requestingUserId: z10.string().optional()
+});
+var UpdateProjectDecisionRequestSchema = z10.object({
+  projectId: z10.string(),
+  decision: z10.string().min(1),
+  question: z10.string().min(1).max(200).optional(),
+  summary: z10.string().max(CARD_DESCRIPTION_MAX).optional(),
+  context: z10.string().min(1).optional(),
   /** Accepted only while nobody has voted. */
   options: optionsInput.optional(),
-  defaultOption: z11.number().int().min(1).max(DECISION_OPTIONS_MAX).optional(),
-  tagNames: z11.array(z11.string().min(1)).max(10).optional(),
+  defaultOption: z10.number().int().min(1).max(DECISION_OPTIONS_MAX).optional(),
+  tagNames: z10.array(z10.string().min(1)).max(10).optional(),
   deadlineHours,
   /** Absolute deadline (ISO 8601). Wins over `deadlineHours` when both are sent. */
-  deadlineAt: z11.string().datetime({ offset: true }).optional(),
-  addImpactedCards: z11.array(z11.string().min(1)).max(50).optional(),
-  removeImpactedCards: z11.array(z11.string().min(1)).max(50).optional(),
-  status: z11.enum(["Cancelled", "Open"]).optional(),
-  requestingUserId: z11.string().optional()
+  deadlineAt: z10.string().datetime({ offset: true }).optional(),
+  addImpactedCards: z10.array(z10.string().min(1)).max(50).optional(),
+  removeImpactedCards: z10.array(z10.string().min(1)).max(50).optional(),
+  status: z10.enum(["Cancelled", "Open"]).optional(),
+  requestingUserId: z10.string().optional()
+});
+function formatModelId(provider, model) {
+  return `${provider}/${model}`;
+}
+var JEV_MODEL = "jev-1.13.0";
+var JEV_MODEL_ID = formatModelId("typesafe", JEV_MODEL);
+var JEV_INPUT_PRICE_PER_TOKEN = 0.042 / 1e6;
+var JEV_STATE_MAX_CHARS = 1e5;
+var EVALUATE_MAX_QUESTIONS = 32;
+var EVALUATE_MAX_ITEMS = 100;
+var EVALUATE_ITEM_MAX_CHARS = 8e3;
+var EVALUATE_REQUEST_MAX_CHARS = 4e5;
+var TEXT_MAX = 1e3;
+var QUESTION_KEY = /^[A-Za-z0-9_-]{1,64}$/;
+var EvaluateQuestionSchema = z11.object({
+  key: z11.string().regex(QUESTION_KEY, "key must be 1-64 letters, digits, _ or -"),
+  type: z11.enum(["noul", "choice", "score"]),
+  instructions: z11.string().min(1).max(4e3),
+  options: z11.array(
+    z11.object({
+      key: z11.string().min(1).max(200),
+      description: z11.string().min(1).max(TEXT_MAX)
+    })
+  ).optional(),
+  levels: z11.array(z11.string().min(1).max(TEXT_MAX)).optional()
+}).superRefine((q, ctx) => {
+  if (q.type === "choice") {
+    const n = q.options?.length ?? 0;
+    if (n < 2 || n > 255) {
+      ctx.addIssue({
+        code: z11.ZodIssueCode.custom,
+        path: ["options"],
+        message: "a choice question needs 2-255 options"
+      });
+    } else if (new Set(q.options?.map((o) => o.key)).size !== n) {
+      ctx.addIssue({
+        code: z11.ZodIssueCode.custom,
+        path: ["options"],
+        message: "option keys must be unique"
+      });
+    }
+  }
+  if (q.type === "score") {
+    const n = q.levels?.length ?? 0;
+    if (n < 2 || n > 10) {
+      ctx.addIssue({
+        code: z11.ZodIssueCode.custom,
+        path: ["levels"],
+        message: "a score question needs 2-10 levels"
+      });
+    }
+  }
+});
+var EvaluateQuestionsRequestSchema = z11.object({
+  projectId: z11.string(),
+  state: z11.string().max(JEV_STATE_MAX_CHARS).optional(),
+  items: z11.array(z11.string().max(EVALUATE_ITEM_MAX_CHARS)).max(EVALUATE_MAX_ITEMS).optional(),
+  questions: z11.array(EvaluateQuestionSchema).min(1).max(EVALUATE_MAX_QUESTIONS)
+}).superRefine((req, ctx) => {
+  if (req.state === void 0 && (!req.items || req.items.length === 0)) {
+    ctx.addIssue({
+      code: z11.ZodIssueCode.custom,
+      path: ["state"],
+      message: "pass state, or a non-empty items array"
+    });
+  }
+  if (JSON.stringify(req).length > EVALUATE_REQUEST_MAX_CHARS) {
+    ctx.addIssue({
+      code: z11.ZodIssueCode.custom,
+      path: [],
+      message: `the request is over ${EVALUATE_REQUEST_MAX_CHARS} characters; split the items across calls`
+    });
+  }
+  if (new Set(req.questions.map((q) => q.key)).size !== req.questions.length) {
+    ctx.addIssue({
+      code: z11.ZodIssueCode.custom,
+      path: ["questions"],
+      message: "question keys must be unique"
+    });
+  }
 });
+var round3 = (n) => Math.round(n * 1e3) / 1e3;
+function compactAnswer(answer) {
+  switch (answer.type) {
+    case "noul":
+      return round3(answer.noul);
+    case "choice":
+      return {
+        choice: answer.choice,
+        p: round3(answer.probabilities[answer.choice] ?? 0),
+        confidence: round3(answer.confidence)
+      };
+    case "score":
+      return { score: answer.score, confidence: round3(answer.confidence) };
+  }
+}
+function formatEvaluateQuestionsResult(res) {
+  const results = res.results.map(
+    (r) => "error" in r ? { index: r.index, error: r.error } : {
+      index: r.index,
+      answers: Object.fromEntries(
+        Object.entries(r.answers).map(([key, a]) => [key, compactAnswer(a)])
+      )
+    }
+  );
+  return JSON.stringify({ model: res.model, results });
+}
 var MEETING_CHECKLIST_TITLE_MAX = 300;
 var MEETING_TRANSCRIPT_MAX_CHARS = 2e6;
 var MEETING_TITLE_MAX = 200;
@@ -5435,9 +5356,6 @@ var UpdateProjectMeetingRequestSchema = z12.object({
 var TASK_CHAT_HISTORY_LIMIT = 20;
 var PM_CHAT_HISTORY_LIMIT = 40;
 var AGENT_CHAT_HISTORY_FETCH_LIMIT = Math.max(TASK_CHAT_HISTORY_LIMIT, PM_CHAT_HISTORY_LIMIT) + 10;
-function formatModelId(provider, model) {
-  return `${provider}/${model}`;
-}
 function anthropicEntry(model, label, inputPerMillion, outputPerMillion, opts = {}) {
   return {
     provider: "anthropic",
@@ -5776,26 +5694,371 @@ var BOARD_CARD_TYPES = surfaceTypes("board");
 var REPORT_CARD_TYPES = surfaceTypes("report");
 var DECISION_CARD_TYPES = surfaceTypes("decision");
 
-// src/tools/logs.ts
-function registerLogTools(server2, conn2) {
-  registerContractTool(server2, queryGcpLogsContract, async (params) => {
-    const text = await runQueryGcpLogs(conn2, params);
-    return { content: [{ type: "text", text }] };
-  });
-  registerContractTool(server2, queryGrafanaLogsContract, async (params) => {
-    const text = await runQueryGrafanaLogs(conn2, params);
-    return { content: [{ type: "text", text }] };
-  });
+// src/tools/checklists.ts
+function renderManualTestGroups(groups) {
+  const lines = [];
+  for (const g of groups) {
+    lines.push(`## ${g.title} [${g.status}] (${g.slug})`);
+    for (const t of g.tests) {
+      const mark = t.status === "approved" ? "\u2713" : t.status === "rejected" ? "\u2717" : "\u25CB";
+      lines.push(`  ${mark} ${t.title} \u2014 ${t.status}`);
+      if (t.status === "rejected") {
+        for (const f2 of t.failures ?? []) {
+          lines.push(`      \u26A0 ${f2.userName ?? "Someone"}: ${f2.reason ?? "(no message)"}`);
+        }
+      }
+    }
+    lines.push("");
+  }
+  return lines.join("\n").trimEnd();
 }
-
-// src/tools/integrations.ts
-function registerIntegrationTools(server2, conn2) {
-  registerContractTool(server2, listProjectIntegrationsContract, async (params) => {
-    const result = await conn2.listProjectIntegrations(params.projectId);
-    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-  });
-  registerContractTool(server2, listProjectChannelsContract, async (params) => {
-    const channels = await conn2.listProjectChannels(params.projectId);
+function registerListManualTests(server2, conn2) {
+  registerContractTool(server2, listManualTestsContract, async (params) => {
+    const items = await conn2.listManualTests(params.taskId, params.projectId);
+    if (items.length === 0) {
+      return { content: [{ type: "text", text: "No manual tests recorded for this task." }] };
+    }
+    const lines = items.flatMap((item, i) => {
+      const checked = item.checked ? "[x]" : "[ ]";
+      const row = [`${i + 1}. ${checked} ${item.title}`];
+      for (const f2 of item.failures ?? []) {
+        const who = f2.userName ?? "Someone";
+        const reason = f2.reason ?? "(no message)";
+        row.push(`   \u26A0 Failed (${who}): ${reason}`);
+      }
+      return row;
+    });
+    return { content: [{ type: "text", text: lines.join("\n") }] };
+  });
+}
+function registerSetManualTests(server2, conn2) {
+  registerContractTool(server2, setManualTestsContract, async (params) => {
+    const result = await conn2.setManualTests(params.taskId, params.items, params.projectId);
+    const parts = [`Created ${result.created} manual test item(s).`];
+    if (result.skipped > 0) parts.push(`Skipped ${result.skipped} duplicate(s).`);
+    for (const item of result.rejected ?? []) parts.push(describeManualTestRejection(item));
+    return { content: [{ type: "text", text: parts.join(" ") }] };
+  });
+}
+function registerEditManualTest(server2, conn2) {
+  registerContractTool(server2, editManualTestContract, async (params) => {
+    await conn2.editManualTest(params.taskId, params.title, params.newTitle, params.projectId);
+    return { content: [{ type: "text", text: `Updated manual test to "${params.newTitle}".` }] };
+  });
+}
+function registerRemoveManualTest(server2, conn2) {
+  registerContractTool(server2, removeManualTestContract, async (params) => {
+    await conn2.removeManualTest(params.taskId, params.title, params.projectId);
+    return { content: [{ type: "text", text: `Removed manual test "${params.title}".` }] };
+  });
+}
+function registerApproveManualTest(server2, conn2) {
+  registerContractTool(server2, approveManualTestContract, async (params) => {
+    await conn2.approveManualTest(params.taskId, params.title, params.projectId);
+    return { content: [{ type: "text", text: `Approved manual test "${params.title}".` }] };
+  });
+}
+function registerRejectManualTest(server2, conn2) {
+  registerContractTool(server2, rejectManualTestContract, async (params) => {
+    await conn2.rejectManualTest(params.taskId, params.title, params.reason, params.projectId);
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Flagged an issue with manual test "${params.title}": ${params.reason}`
+        }
+      ]
+    };
+  });
+}
+function registerQueryManualTests(server2, conn2) {
+  registerContractTool(server2, queryManualTestsContract, async (params) => {
+    const groups = await conn2.queryManualTests({
+      projectId: params.projectId,
+      cardStatuses: params.cardStatuses,
+      testStatuses: params.testStatuses
+    });
+    if (groups.length === 0) {
+      return { content: [{ type: "text", text: "No manual tests match those filters." }] };
+    }
+    return { content: [{ type: "text", text: renderManualTestGroups(groups) }] };
+  });
+}
+function registerChecklistTools(server2, conn2) {
+  registerListManualTests(server2, conn2);
+  registerQueryManualTests(server2, conn2);
+  registerSetManualTests(server2, conn2);
+  registerEditManualTest(server2, conn2);
+  registerRemoveManualTest(server2, conn2);
+  registerApproveManualTest(server2, conn2);
+  registerRejectManualTest(server2, conn2);
+}
+
+// src/tools/workspace.ts
+import { z as z13 } from "zod";
+
+// src/workspace-ssh-tunnel.ts
+import net from "net";
+import { once } from "events";
+import { WebSocket } from "ws";
+var WORKSPACE_TUNNEL_HEARTBEAT_MS = 3e4;
+function withPort(url, port) {
+  const parsed = new URL(url);
+  parsed.searchParams.set("port", String(port));
+  return parsed.toString();
+}
+function toBuffer(data) {
+  if (Buffer.isBuffer(data)) return data;
+  if (data instanceof ArrayBuffer) return Buffer.from(data);
+  return Buffer.concat(data);
+}
+function startHeartbeat(ws) {
+  const timer = setInterval(() => {
+    if (ws.readyState === WebSocket.OPEN) ws.ping();
+  }, WORKSPACE_TUNNEL_HEARTBEAT_MS);
+  timer.unref?.();
+  return () => clearInterval(timer);
+}
+function bridgeClient(client, options) {
+  let ws = null;
+  let ready = false;
+  const pending = [];
+  client.on("data", (data) => {
+    const chunk = Buffer.isBuffer(data) ? data : Buffer.from(data);
+    if (ready && ws && ws.readyState === WebSocket.OPEN) ws.send(chunk);
+    else pending.push(chunk);
+  });
+  client.on("close", () => ws?.close());
+  client.on("error", () => ws?.close());
+  options.resolveTarget().then(({ tunnelUrl, attachToken }) => {
+    const socket = new WebSocket(withPort(tunnelUrl, options.remotePort), {
+      headers: { "x-workspace-attach-token": attachToken }
+    });
+    ws = socket;
+    const stopHeartbeat = startHeartbeat(socket);
+    socket.on("message", (data) => {
+      const chunk = toBuffer(data);
+      if (!ready) {
+        const text = chunk.toString("utf8");
+        if (text === JSON.stringify({ ok: true })) {
+          ready = true;
+          for (const buffered of pending.splice(0)) socket.send(buffered);
+          return;
+        }
+        client.destroy(new Error(`Workspace tunnel rejected connection: ${text}`));
+        socket.close();
+        return;
+      }
+      client.write(chunk);
+    });
+    socket.on("close", () => {
+      stopHeartbeat();
+      client.destroy();
+    });
+    socket.on("error", (err) => {
+      stopHeartbeat();
+      client.destroy(err);
+    });
+  }).catch((err) => {
+    client.destroy(err instanceof Error ? err : new Error(String(err)));
+  });
+}
+async function startWorkspaceSshTunnel(options) {
+  const host = options.host ?? "127.0.0.1";
+  const server2 = net.createServer((client) => bridgeClient(client, options));
+  const ac = new AbortController();
+  server2.listen(options.preferredLocalPort ?? 0, host);
+  try {
+    await Promise.race([
+      once(server2, "listening", { signal: ac.signal }),
+      once(server2, "error", { signal: ac.signal }).then(([err]) => {
+        throw err instanceof Error ? err : new Error(String(err));
+      })
+    ]);
+  } catch (err) {
+    server2.close();
+    throw new Error(
+      `Failed to bind workspace SSH tunnel: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
+  } finally {
+    ac.abort();
+  }
+  const address = server2.address();
+  if (!address || typeof address === "string") {
+    server2.close();
+    throw new Error("Failed to bind workspace SSH tunnel");
+  }
+  return {
+    host,
+    port: address.port,
+    close: () => new Promise((resolve, reject) => {
+      server2.close((err) => {
+        if (err) reject(err);
+        else resolve();
+      });
+    })
+  };
+}
+
+// src/tools/workspace.ts
+var activeTunnels = /* @__PURE__ */ new Map();
+function createTunnelId(taskId, port) {
+  return `${taskId}:${port}:${Date.now().toString(36)}:${Math.random().toString(36).slice(2, 8)}`;
+}
+function localUrlFor(port, host, localPort) {
+  if (port === 2222) return void 0;
+  return `http://${host}:${localPort}`;
+}
+function registerAttachInfoTool(server2, conn2) {
+  server2.tool(
+    "workspace_attach_info",
+    "Return SSH/SFTP attach metadata for a running task Claudespace, plus hosted preview URLs and configured preview ports. Optionally installs an OpenSSH public key for this attach session.",
+    {
+      taskId: z13.string().describe("The task ID"),
+      sshPublicKey: z13.string().optional().describe("Optional OpenSSH public key to install into the workspace")
+    },
+    async ({ taskId, sshPublicKey }) => {
+      const info = await conn2.getWorkspaceAttachInfo(taskId, sshPublicKey);
+      return { content: [{ type: "text", text: JSON.stringify(info, null, 2) }] };
+    }
+  );
+}
+function registerPreviewUrlsTool(server2, conn2) {
+  server2.tool(
+    "workspace_preview_urls",
+    "Return the hosted preview URLs and preview ports for a running task Claudespace. This mirrors the web UI preview link metadata.",
+    {
+      taskId: z13.string().describe("The task ID")
+    },
+    async ({ taskId }) => {
+      const info = await conn2.getWorkspaceAttachInfo(taskId);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(
+              {
+                taskId: info.taskId,
+                sessionId: info.sessionId,
+                previewPorts: info.previewPorts,
+                previewUrls: info.previewUrls
+              },
+              null,
+              2
+            )
+          }
+        ]
+      };
+    }
+  );
+}
+function registerStartTunnelTool(server2, conn2, startTunnel) {
+  server2.tool(
+    "workspace_start_tunnel",
+    "Start a local loopback tunnel through the MCP server to a running task Claudespace port. Use port 2222 for SSH/SFTP, or one of previewPorts for app access.",
+    {
+      taskId: z13.string().describe("The task ID"),
+      port: z13.number().optional().describe("Remote Claudespace port. Defaults to SSH port 2222."),
+      preferredLocalPort: z13.number().optional().describe("Preferred local loopback port. If omitted, the OS chooses one."),
+      sshPublicKey: z13.string().optional().describe("Optional OpenSSH public key to install before opening the tunnel")
+    },
+    async ({ taskId, port, preferredLocalPort, sshPublicKey }) => {
+      const info = await conn2.getWorkspaceAttachInfo(taskId, sshPublicKey);
+      if (!info.tunnelUrl || !info.attachToken) {
+        throw new Error(
+          "Workspace tunnels are unavailable for this task (GitHub Codespace-backed environments expose previews only \u2014 use workspace_preview_urls)."
+        );
+      }
+      const remotePort = port ?? info.ssh?.remotePort ?? 2222;
+      const handle = await startTunnel({
+        remotePort,
+        preferredLocalPort,
+        // Re-mint per connection so the tunnel outlives the attach-token TTL.
+        // The key (if any) is already installed by the call above; the refetch
+        // only needs a fresh token, so it omits sshPublicKey.
+        resolveTarget: async () => {
+          const fresh = await conn2.getWorkspaceAttachInfo(taskId);
+          if (!fresh.tunnelUrl || !fresh.attachToken)
+            throw new Error("Workspace tunnel target is no longer available");
+          return { tunnelUrl: fresh.tunnelUrl, attachToken: fresh.attachToken };
+        }
+      });
+      const tunnelId = createTunnelId(taskId, remotePort);
+      activeTunnels.set(tunnelId, handle);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(
+              {
+                tunnelId,
+                taskId,
+                remotePort,
+                localHost: handle.host,
+                localPort: handle.port,
+                localUrl: localUrlFor(remotePort, handle.host, handle.port),
+                // `-o ServerAliveInterval=30` drives client-side keepalives so an
+                // idle session keeps the tunnel warm (the tunnel layer pings too,
+                // but the client must keep its own TCP path alive across every hop).
+                sshCommand: remotePort === 2222 ? `ssh -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -p ${handle.port} ${info.ssh?.username ?? "conveyor"}@${handle.host}` : void 0,
+                sftpCommand: remotePort === 2222 ? `sftp -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -P ${handle.port} ${info.ssh?.username ?? "conveyor"}@${handle.host}` : void 0,
+                previewPorts: info.previewPorts,
+                previewUrls: info.previewUrls,
+                expiresAt: info.expiresAt
+              },
+              null,
+              2
+            )
+          }
+        ]
+      };
+    }
+  );
+}
+function registerStopTunnelTool(server2) {
+  server2.tool(
+    "workspace_stop_tunnel",
+    "Stop a local workspace tunnel previously opened by workspace_start_tunnel.",
+    {
+      tunnelId: z13.string().describe("Tunnel id returned by workspace_start_tunnel")
+    },
+    async ({ tunnelId }) => {
+      const tunnel = activeTunnels.get(tunnelId);
+      if (!tunnel) throw new Error("Workspace tunnel not found");
+      await tunnel.close();
+      activeTunnels.delete(tunnelId);
+      return { content: [{ type: "text", text: "Workspace tunnel stopped" }] };
+    }
+  );
+}
+function registerWorkspaceTools(server2, conn2, deps = {}) {
+  registerAttachInfoTool(server2, conn2);
+  registerPreviewUrlsTool(server2, conn2);
+  registerStartTunnelTool(server2, conn2, deps.startTunnel ?? startWorkspaceSshTunnel);
+  registerStopTunnelTool(server2);
+}
+
+// src/tools/logs.ts
+function registerLogTools(server2, conn2) {
+  registerContractTool(server2, queryGcpLogsContract, async (params) => {
+    const text = await runQueryGcpLogs(conn2, params);
+    return { content: [{ type: "text", text }] };
+  });
+  registerContractTool(server2, queryGrafanaLogsContract, async (params) => {
+    const text = await runQueryGrafanaLogs(conn2, params);
+    return { content: [{ type: "text", text }] };
+  });
+}
+
+// src/tools/integrations.ts
+function registerIntegrationTools(server2, conn2) {
+  registerContractTool(server2, listProjectIntegrationsContract, async (params) => {
+    const result = await conn2.listProjectIntegrations(params.projectId);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+  registerContractTool(server2, listProjectChannelsContract, async (params) => {
+    const channels = await conn2.listProjectChannels(params.projectId);
     if (channels.length === 0) {
       return {
         content: [
@@ -6027,6 +6290,14 @@ function registerDecisionTools(server2, conn2) {
   registerDecisionWrites(server2, conn2);
 }
 
+// src/tools/evaluate.ts
+function registerEvaluateTools(server2, conn2) {
+  registerContractTool(server2, evaluateQuestionsContract, async (params) => {
+    const res = await conn2.evaluateQuestions(params);
+    return { content: [{ type: "text", text: formatEvaluateQuestionsResult(res) }] };
+  });
+}
+
 // src/tools/index.ts
 function registerAllTools(server2, conn2) {
   registerProjectTools(server2, conn2);
@@ -6046,6 +6317,7 @@ function registerAllTools(server2, conn2) {
   registerDriveTools(server2, conn2);
   registerMeetingTools(server2, conn2);
   registerDecisionTools(server2, conn2);
+  registerEvaluateTools(server2, conn2);
 }
 
 // src/cli.ts