@rosthq/cli 0.5.27 → 0.5.28

package/dist/index.js

@@ -472,13 +472,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path3, preserveJsx) {
-  if (typeof path3 === "string" && /^\.\.?\//.test(path3)) {
-    return path3.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
+function __rewriteRelativeImportExtension(path4, preserveJsx) {
+  if (typeof path4 === "string" && /^\.\.?\//.test(path4)) {
+    return path4.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : d + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path3;
+  return path4;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -5471,7 +5471,7 @@ var require_helpers = __commonJS({
     exports.generateCallbackId = generateCallbackId;
     exports.parseParametersFromURL = parseParametersFromURL;
     exports.decodeJWT = decodeJWT;
-    exports.sleep = sleep2;
+    exports.sleep = sleep3;
     exports.retryable = retryable;
     exports.generatePKCEVerifier = generatePKCEVerifier;
     exports.generatePKCEChallenge = generatePKCEChallenge;
@@ -5609,7 +5609,7 @@ var require_helpers = __commonJS({
       };
       return data;
     }
-    async function sleep2(time3) {
+    async function sleep3(time3) {
       return await new Promise((accept) => {
         setTimeout(() => accept(null), time3);
       });
@@ -7718,10 +7718,10 @@ var require_webauthn = __commonJS({
         authenticatorAttachment: (_a3 = credentialWithAttachment.authenticatorAttachment) !== null && _a3 !== void 0 ? _a3 : void 0
       };
     }
-    function isValidDomain(hostname3) {
+    function isValidDomain(hostname4) {
       return (
         // Consider localhost valid as well since it's okay wrt Secure Contexts
-        hostname3 === "localhost" || /^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(hostname3)
+        hostname4 === "localhost" || /^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/i.test(hostname4)
       );
     }
     function browserSupportsWebAuthn() {
@@ -14026,10 +14026,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path3) {
-  if (!path3)
+function getElementAtPath(obj, path4) {
+  if (!path4)
     return obj;
-  return path3.reduce((acc, key) => acc?.[key], obj);
+  return path4.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -14438,11 +14438,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path3, issues) {
+function prefixIssues(path4, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path3);
+    iss.path.unshift(path4);
     return iss;
   });
 }
@@ -14589,16 +14589,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path3 = []) => {
+  const processError = (error52, path4 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path3, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path4, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
       } else {
-        const fullpath = [...path3, ...issue2.path];
+        const fullpath = [...path4, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -14625,17 +14625,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path3 = []) => {
+  const processError = (error52, path4 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path3, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path4, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
       } else {
-        const fullpath = [...path3, ...issue2.path];
+        const fullpath = [...path4, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -14667,8 +14667,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path3 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path3) {
+  const path4 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path4) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -14874,8 +14874,8 @@ function emoji() {
 }
 var ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-var mac = (delimiter) => {
-  const escapedDelim = escapeRegex(delimiter ?? ":");
+var mac = (delimiter2) => {
+  const escapedDelim = escapeRegex(delimiter2 ?? ":");
   return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
 };
 var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -27360,13 +27360,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path3 = ref.slice(1).split("/").filter(Boolean);
-  if (path3.length === 0) {
+  const path4 = ref.slice(1).split("/").filter(Boolean);
+  if (path4.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path3[0] === defsKey) {
-    const key = path3[1];
+  if (path4[0] === defsKey) {
+    const key = path4[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -27828,7 +27828,7 @@ var CommandClient = class {
     this.fetchImpl = options.fetchImpl ?? fetch;
   }
   async execute(commandId, body = {}, options = {}) {
-    const path3 = `/api/commands/${encodeURIComponent(commandId)}`;
+    const path4 = `/api/commands/${encodeURIComponent(commandId)}`;
     const headers = {
       authorization: `Bearer ${this.token}`,
       "content-type": "application/json"
@@ -27836,7 +27836,7 @@ var CommandClient = class {
     if (options.targetSeatId !== void 0 && options.targetSeatId.length > 0) {
       headers["x-rost-seat"] = options.targetSeatId;
     }
-    const response = await this.fetchImpl(`${this.appUrl}${path3}`, {
+    const response = await this.fetchImpl(`${this.appUrl}${path4}`, {
       method: "POST",
       headers,
       body: JSON.stringify(body)
@@ -27849,7 +27849,7 @@ var CommandClient = class {
       const snippet = redactSecrets(text.replace(/\s+/g, " ").trim()).slice(0, 200);
       throw new CommandClientError(
         response.status,
-        `server returned HTTP ${response.status} (non-JSON) from ${path3}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
+        `server returned HTTP ${response.status} (non-JSON) from ${path4}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
       );
     }
     const parsed = commandResponseSchema.parse(raw);
@@ -33056,8 +33056,8 @@ var IcebergError = class extends Error {
     return this.status === 419;
   }
 };
-function buildUrl(baseUrl, path3, query) {
-  const url2 = new URL(path3, baseUrl);
+function buildUrl(baseUrl, path4, query) {
+  const url2 = new URL(path4, baseUrl);
   if (query) {
     for (const [key, value] of Object.entries(query)) {
       if (value !== void 0) {
@@ -33087,12 +33087,12 @@ function createFetchClient(options) {
   return {
     async request({
       method,
-      path: path3,
+      path: path4,
       query,
       body,
       headers
     }) {
-      const url2 = buildUrl(options.baseUrl, path3, query);
+      const url2 = buildUrl(options.baseUrl, path4, query);
       const authHeaders = await buildAuthHeaders(options.auth);
       const res = await fetchFn(url2, {
         method,
@@ -33954,7 +33954,7 @@ var StorageFileApi = class extends BaseApiClient {
   * @param path The relative file path. Should be of the format `folder/subfolder/filename.png`. The bucket must already exist before attempting to upload.
   * @param fileBody The body of the file to be stored in the bucket.
   */
-  async uploadOrUpdate(method, path3, fileBody, fileOptions) {
+  async uploadOrUpdate(method, path4, fileBody, fileOptions) {
     var _this = this;
     return _this.handleOperation(async () => {
       let body;
@@ -33978,7 +33978,7 @@ var StorageFileApi = class extends BaseApiClient {
         if ((typeof ReadableStream !== "undefined" && body instanceof ReadableStream || body && typeof body === "object" && "pipe" in body && typeof body.pipe === "function") && !options.duplex) options.duplex = "half";
       }
       if (fileOptions === null || fileOptions === void 0 ? void 0 : fileOptions.headers) for (const [key, value] of Object.entries(fileOptions.headers)) headers = setHeader(headers, key, value);
-      const cleanPath = _this._removeEmptyFolders(path3);
+      const cleanPath = _this._removeEmptyFolders(path4);
       const _path = _this._getFinalPath(cleanPath);
       const data = await (method == "PUT" ? put : post)(_this.fetch, `${_this.url}/object/${_path}`, body, _objectSpread22({ headers }, (options === null || options === void 0 ? void 0 : options.duplex) ? { duplex: options.duplex } : {}));
       return {
@@ -34055,8 +34055,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Upload file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async upload(path3, fileBody, fileOptions) {
-    return this.uploadOrUpdate("POST", path3, fileBody, fileOptions);
+  async upload(path4, fileBody, fileOptions) {
+    return this.uploadOrUpdate("POST", path4, fileBody, fileOptions);
   }
   /**
   * Upload a file with a token generated from `createSignedUploadUrl`.
@@ -34096,9 +34096,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async uploadToSignedUrl(path3, token, fileBody, fileOptions) {
+  async uploadToSignedUrl(path4, token, fileBody, fileOptions) {
     var _this3 = this;
-    const cleanPath = _this3._removeEmptyFolders(path3);
+    const cleanPath = _this3._removeEmptyFolders(path4);
     const _path = _this3._getFinalPath(cleanPath);
     const url2 = new URL(_this3.url + `/object/upload/sign/${_path}`);
     url2.searchParams.set("token", token);
@@ -34167,10 +34167,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `insert`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUploadUrl(path3, options) {
+  async createSignedUploadUrl(path4, options) {
     var _this4 = this;
     return _this4.handleOperation(async () => {
-      let _path = _this4._getFinalPath(path3);
+      let _path = _this4._getFinalPath(path4);
       const headers = _objectSpread22({}, _this4.headers);
       if (options === null || options === void 0 ? void 0 : options.upsert) headers["x-upsert"] = "true";
       const data = await post(_this4.fetch, `${_this4.url}/object/upload/sign/${_path}`, {}, { headers });
@@ -34179,7 +34179,7 @@ var StorageFileApi = class extends BaseApiClient {
       if (!token) throw new StorageError("No token returned by API");
       return {
         signedUrl: url2.toString(),
-        path: path3,
+        path: path4,
         token
       };
     });
@@ -34239,8 +34239,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Update file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async update(path3, fileBody, fileOptions) {
-    return this.uploadOrUpdate("PUT", path3, fileBody, fileOptions);
+  async update(path4, fileBody, fileOptions) {
+    return this.uploadOrUpdate("PUT", path4, fileBody, fileOptions);
   }
   /**
   * Moves an existing file to a new path in the same bucket.
@@ -34391,10 +34391,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUrl(path3, expiresIn, options) {
+  async createSignedUrl(path4, expiresIn, options) {
     var _this8 = this;
     return _this8.handleOperation(async () => {
-      let _path = _this8._getFinalPath(path3);
+      let _path = _this8._getFinalPath(path4);
       const hasTransform = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0;
       let data = await post(_this8.fetch, `${_this8.url}/object/sign/${_path}`, _objectSpread22({ expiresIn }, hasTransform ? { transform: options.transform } : {}), { headers: _this8.headers });
       const query = new URLSearchParams();
@@ -34530,13 +34530,13 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  download(path3, options, parameters) {
+  download(path4, options, parameters) {
     const renderPath = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0 ? "render/image/authenticated" : "object";
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
     if ((options === null || options === void 0 ? void 0 : options.cacheNonce) != null) query.set("cacheNonce", String(options.cacheNonce));
     const queryString = query.toString();
-    const _path = this._getFinalPath(path3);
+    const _path = this._getFinalPath(path4);
     const downloadFn = () => get(this.fetch, `${this.url}/${renderPath}/${_path}${queryString ? `?${queryString}` : ""}`, {
       headers: this.headers,
       noResolveJson: true
@@ -34567,9 +34567,9 @@ var StorageFileApi = class extends BaseApiClient {
   * }
   * ```
   */
-  async info(path3) {
+  async info(path4) {
     var _this10 = this;
-    const _path = _this10._getFinalPath(path3);
+    const _path = _this10._getFinalPath(path4);
     return _this10.handleOperation(async () => {
       return recursiveToCamel(await get(_this10.fetch, `${_this10.url}/object/info/${_path}`, { headers: _this10.headers }));
     });
@@ -34590,9 +34590,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   .exists('folder/avatar1.png')
   * ```
   */
-  async exists(path3) {
+  async exists(path4) {
     var _this11 = this;
-    const _path = _this11._getFinalPath(path3);
+    const _path = _this11._getFinalPath(path4);
     try {
       await head(_this11.fetch, `${_this11.url}/object/${_path}`, { headers: _this11.headers });
       return {
@@ -34671,8 +34671,8 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  getPublicUrl(path3, options) {
-    const _path = this._getFinalPath(path3);
+  getPublicUrl(path4, options) {
+    const _path = this._getFinalPath(path4);
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.download) query.set("download", options.download === true ? "" : options.download);
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
@@ -34811,10 +34811,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async list(path3, options, parameters) {
+  async list(path4, options, parameters) {
     var _this13 = this;
     return _this13.handleOperation(async () => {
-      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path3 || "" });
+      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path4 || "" });
       return await post(_this13.fetch, `${_this13.url}/object/list/${_this13.bucketId}`, body, { headers: _this13.headers }, parameters);
     });
   }
@@ -34879,11 +34879,11 @@ var StorageFileApi = class extends BaseApiClient {
     if (typeof Buffer !== "undefined") return Buffer.from(data).toString("base64");
     return btoa(data);
   }
-  _getFinalPath(path3) {
-    return `${this.bucketId}/${path3.replace(/^\/+/, "")}`;
+  _getFinalPath(path4) {
+    return `${this.bucketId}/${path4.replace(/^\/+/, "")}`;
   }
-  _removeEmptyFolders(path3) {
-    return path3.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
+  _removeEmptyFolders(path4) {
+    return path4.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
   }
   /** Modifies the `query`, appending values the from `transform` */
   applyTransformOptsToQuery(query, transform2) {
@@ -36381,12 +36381,12 @@ function shouldPropagateToTarget(targetUrl, targets) {
   }
   return false;
 }
-function matchStringTarget(hostname3, target) {
-  if (target === hostname3) return true;
+function matchStringTarget(hostname4, target) {
+  if (target === hostname4) return true;
   if (target.startsWith("*.")) {
     const domain2 = target.slice(2);
-    if (hostname3.endsWith(domain2)) {
-      if (hostname3 === domain2 || hostname3.endsWith("." + domain2)) return true;
+    if (hostname4.endsWith(domain2)) {
+      if (hostname4 === domain2 || hostname4.endsWith("." + domain2)) return true;
     }
   }
   return false;
@@ -37172,7 +37172,7 @@ async function defaultVerifyOtp(config2, input) {
 }
 async function loginWithDeviceCode(config2, io, deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
-  const sleep2 = deps.sleep ?? defaultSleep;
+  const sleep3 = deps.sleep ?? defaultSleep;
   const openBrowser2 = deps.openBrowser ?? tryOpenBrowser;
   const verifyOtp = deps.verifyOtp ?? defaultVerifyOtp;
   const now = deps.now ?? Date.now;
@@ -37206,7 +37206,7 @@ async function loginWithDeviceCode(config2, io, deps = {}) {
         `The code expired before it was approved. Run '${cliBrand.binName} login --device' again.`
       );
     }
-    await sleep2(intervalMs);
+    await sleep3(intervalMs);
     const poll = await postJson(fetchImpl, `${baseUrl}/api/auth/device/token`, {
       device_code: session.device_code
     });
@@ -37359,8 +37359,8 @@ var FileTokenStore = class {
     return `plain file fallback at ${this.filePath}`;
   }
   async chmodOwnerOnly() {
-    const { chmod } = await import("node:fs/promises");
-    await chmod(this.filePath, 384);
+    const { chmod: chmod2 } = await import("node:fs/promises");
+    await chmod2(this.filePath, 384);
   }
 };
 function createTokenStore(options = {}) {
@@ -37920,8 +37920,8 @@ function getErrorMap2() {
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path3, errorMaps, issueData } = params;
-  const fullPath = [...path3, ...issueData.path || []];
+  const { data, path: path4, errorMaps, issueData } = params;
+  const fullPath = [...path4, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -38037,11 +38037,11 @@ var errorUtil;
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path3, key) {
+  constructor(parent, value, path4, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path3;
+    this._path = path4;
     this._key = key;
   }
   get path() {
@@ -42085,6 +42085,7 @@ The dry run is a real sandbox rehearsal, not a stamp. It executes a mock-provide
       "sync.run.start",
       "sync.run.complete",
       "sync.item.assign",
+      "coach.draft_guide",
       "confirmation.approve"
     ],
     legal: {
@@ -42156,6 +42157,7 @@ Decisions should be recorded as human decisions. Handoffs should attach to seats
       "agent.list_fleet",
       "agent.fleet_digest",
       "system.health",
+      "team.health_score",
       "agent_setup.get",
       "agent_setup.update",
       "agent.decommission",
@@ -42255,7 +42257,7 @@ Use the lower-level commands after health names a finding: \`agent.get_run\` for
     order: 46,
     title: "Tool access and vault",
     summary: "How to give agents access to tools without exposing raw credentials or expanding authority by accident.",
-    version: "2026-06-20.5",
+    version: "2026-06-27.6",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -42303,9 +42305,13 @@ For an API with no dedicated connector, the generic REST tool lets a seat call a
 
 \`slack.post_message\` reuses the connected Slack workspace credential and the seat's Slack channel binding. A live call posts only to that bound channel, through the server-side guard and vault-bound bot token. If the bound channel is marked sensitive, the handler escalates for human approval instead of posting. A sandbox dry run makes no Slack request and does not open the vault.
 
+## Gmail connector
+
+The native Gmail handlers run inside the same broker boundary as the REST and Slack connectors: every call passes the server guard and writes an audit row, and the vaulted Google OAuth token is bound only inside a credential closure \u2014 the agent never sees it, and both the access and refresh tokens are redacted from anything a handler returns. \`gmail.read\` (read scoped inbox) and \`gmail.draft\` (compose a draft, never send) are autonomous-eligible. \`gmail.send\` is approval-gated: it never sends autonomously \u2014 it holds the action for steward approval. A sandbox dry run previews the intended read/draft/held-send with no Gmail request and without opening the vault. Live external Gmail send stays gated on Google verification and domain cutover (DER-880 / DER-881); the draft and send-with-approval paths are live now.
+
 ## Google connector status
 
-Google can be connected from Settings once the workspace OAuth app is configured. The connection flow requests offline access for Gmail read/compose and Sheets, stores the returned credential in the vault, and records only account and scope metadata in the integration row. The test action refreshes the vaulted credential and performs a minimal Gmail profile read. Gmail and Sheets agent tools remain configuration-only until their guarded handlers ship; connecting Google does not by itself let an agent read mail or edit a sheet.
+Google can be connected from Settings once the workspace OAuth app is configured. The connection flow requests offline access for Gmail read/compose and Sheets, stores the returned credential in the vault, and records only account and scope metadata in the integration row. The test action refreshes the vaulted credential and performs a minimal Gmail profile read. Sheets agent tools remain configuration-only until their guarded handlers ship; connecting Google does not by itself let an agent edit a sheet.
 
 CLI and MCP can inspect connector readiness without seeing secrets: \`integration.list\` / \`rost_list_integrations\` lists connected providers and health metadata, \`integration.status\` / \`rost_get_integration_status\` reads one provider by id or name, and \`integration.test\` / \`rost_test_integration_connection\` runs the installed provider-specific health check. For Google, the test refreshes the vaulted OAuth credential and reads the Gmail profile, then records only account, scope, and health metadata.
 
@@ -42340,7 +42346,7 @@ There is exactly one way to give a connected tool its credential, and it is the
     order: 47,
     title: "Available tools guide",
     summary: "How to think about tool categories available to seats and what each category should be used for.",
-    version: "2026-06-21.1",
+    version: "2026-06-27.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -42386,14 +42392,14 @@ Agents should explain the job, the required tool category, the minimum permissio
 
 Every tool call passes the server-side guard first: the guard checks the call against the seat's signed permission manifest and records a tool-call audit row for **every** call \u2014 allowed, denied, or escalated. Tool selection is never authorization. Only an allowed call reaches its handler. A connected credential is bound into the handler for the duration of the call only; the secret never appears in the result, the audit summary, logs, or the model's context.
 
-External connectors are being rolled out provider by provider, conservatively (read and draft before send; write behind approval). A selected tool is only a permission until a live handler exists and the seat has the required credential or binding. Today the built-in execution path supports internal status reporting, the generic REST connector when a signed host/method/path allowlist and credential exist, and \`slack.post_message\` for a bound Slack channel. Other provider entries remain configuration-only until their connector ships, so nothing runs silently.`
+External connectors are being rolled out provider by provider, conservatively (read and draft before send; write behind approval). A selected tool is only a permission until a live handler exists and the seat has the required credential or binding. Today the built-in execution path supports internal status reporting, the generic REST connector when a signed host/method/path allowlist and credential exist, \`slack.post_message\` for a bound Slack channel, and the Gmail handlers (\`gmail.read\`/\`gmail.draft\` autonomous-eligible, \`gmail.send\` held for approval) when Google is connected. Other provider entries remain configuration-only until their connector ships, so nothing runs silently.`
   },
   {
     slug: "mcp-and-cli-guide",
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-06-27.1",
+    version: "2026-06-28.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -42459,6 +42465,9 @@ External connectors are being rolled out provider by provider, conservatively (r
       "deliverable.get",
       "deliverable.create",
       "deliverable.attach",
+      "deliverable.accept",
+      "usage.report",
+      "usage.snapshot",
       "error_log.list",
       "error_log.resolve",
       "error_log.supersede",
@@ -42789,6 +42798,7 @@ These are the security posture rules for operating after install \u2014 a checkl
 | Command | Purpose | Scope | Safe example |
 |---|---|---|---|
 | \`{{cli}} docs\` | Print the agent-facing how-to summary. | Public reference | \`{{cli}} docs\` |
+| \`{{cli}} doctor\` | Diagnose local CLI configuration: app URL, Supabase URL, installed version, PATH, session store, local Claude/Codex availability, and update status without printing tokens. | Local environment | \`{{cli}} doctor\` |
 | \`{{cli}} help [group]\` | Print top-level usage, or one operation group's usage; \`{{cli}} <group> --help\` works too. | Public reference | \`{{cli}} help agent\` |
 | \`{{cli}} reference <list|search|get> [options]\` | Help syntax for public reference commands. \`--audience <human|cli|mcp|in_app_agent>\` filters to one audience (omit for all). | Public reference | \`{{cli}} reference search "onboarding" --audience cli\` |
 | \`{{cli}} reference list\` | List public reference guides. | Public reference | \`{{cli}} reference list --audience cli\` |
@@ -42838,11 +42848,12 @@ The signed-in app exposes the same Skill command surface under **Skills** in the
 | \`{{cli}} escalation list|get|resolve|reject\` | \`escalation.list\`, \`escalation.get\`, \`escalation.resolve\`, \`escalation.reject\` | Work the steward escalation queue. | Steward | \`{{cli}} escalation list --json\` |
 | \`{{cli}} error list|resolve|supersede\` | \`error_log.list\`, \`error_log.resolve\`, \`error_log.supersede\` | List active, acknowledged, resolved, or superseded product error logs and let a human acknowledge, resolve, or supersede stale errors with evidence links. | Tenant | \`{{cli}} error list --resolved active --json\`; \`{{cli}} error resolve --error-log-id <id> --reason "Fixed in PR #123"\` |
 | \`{{cli}} sync brief|compile|complete\` | \`sync.brief.get\`, \`sync.brief.compile\`, \`sync.run.complete\` | Compile, read, and complete a weekly Sync. | Tenant | \`{{cli}} sync brief --json\` |
-| \`{{cli}} runner list|status|diagnose|repair|work-orders|revoke\` | \`runner.list\`, \`runner.status\`, \`runner.diagnose\`, \`runner.repair\`, \`work_order.list\`, \`runner.revoke\` | Inspect runners and work orders, diagnose offline runners, get repair guidance, and revoke a runner. | Tenant | \`{{cli}} runner diagnose --runner-id <id> --json\` |
+| \`{{cli}} runner list|status|diagnose|repair|work-orders|revoke|serve\` | \`runner.list\`, \`runner.status\`, \`runner.diagnose\`, \`runner.repair\`, \`work_order.list\`, \`runner.revoke\`, runner endpoint APIs | Inspect runners and work orders, diagnose offline runners, get repair guidance, revoke a runner, or run the headless local runner loop. | Tenant | \`{{cli}} runner diagnose --runner-id <id> --json\`; \`{{cli}} runner serve --once\` |
 | \`{{cli}} notification settings|test|errors\` | \`notification.settings.get\`, \`notification.test\`, \`notification.list_errors\` | Read notification settings, send a test, and list failed deliveries with linked product error source, seat id, and run id when available. | Tenant | \`{{cli}} notification errors --limit 10 --json\` |
 | \`{{cli}} integration list|readiness|status|test\` | \`integration.list\`, \`integration.readiness\`, \`integration.status\`, \`integration.test\` | List connector metadata, read the setup-readiness checklist, read one connector's health, and run the provider-specific connection test without exposing credentials. | Tenant | \`{{cli}} integration readiness --provider google --json\` |
 | \`{{cli}} system health\` | \`system.health\` | Read the scoped system-health snapshot across agent runs, unresolved errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness. | Tenant, member, or seat token | \`{{cli}} system health --json\`; \`{{cli}} system health --seat <id> --json\` |
-| \`{{cli}} settings get|update|product-learning|rename\` | \`settings.get\`, \`settings.update\`, \`settings.product_learning.get\`, \`settings.product_learning.update\`, \`tenant.rename\` | Read tenant settings, update budget caps, read or update product-learning participation, and rename the company. Budget and product-learning updates stop at human confirmation in non-interactive CLI/MCP sessions; company rename is owner-only and human-gated. | Tenant / Tenant-admin for updates | \`{{cli}} settings product-learning get --json\`; \`{{cli}} settings product-learning update --mode disabled --json\`; \`{{cli}} settings rename --company "Acme Operations"\` |
+| \`{{cli}} command usage.report|usage.snapshot\` | \`usage.report\`, \`usage.snapshot\` | Read the AI-workforce ROI report (per-period agent turns, token/run cost, human-accepted value, exceptions, approvals) from immutable usage snapshots, and freeze a period's totals into a new snapshot (insert-only, idempotent). | Tenant | \`{{cli}} command usage.report --json\`; \`{{cli}} command usage.snapshot --json\` |
+| \`{{cli}} settings get|update|product-learning|agent-policy|rename\` | \`settings.get\`, \`settings.update\`, \`settings.product_learning.get\`, \`settings.product_learning.update\`, \`settings.agent_policy.get\`, \`settings.agent_policy.update\`, \`tenant.rename\` | Read tenant settings, update budget caps, read or update product-learning participation, read or set the company autonomy ceiling, and rename the company. Budget, product-learning, and policy updates stop at human confirmation in non-interactive CLI/MCP sessions; company rename is owner-only and human-gated. | Tenant / Tenant-admin for updates | \`{{cli}} settings product-learning get --json\`; \`{{cli}} settings agent-policy get --json\`; \`{{cli}} settings rename --company "Acme Operations"\` |
 | \`{{cli}} member invite|update|remove\` | \`member.invite\`, \`member.update\`, \`member.remove\` | Manage tenant members. | Tenant | \`{{cli}} member invite --email ops@example.com --role member\` |
 | \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.fleet_digest\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, capture the fleet-health digest, read one run's transcript/error diagnostics, and show a markdown readout. Human CLI dry-runs print the rehearsal transcript and, when present, the per-tool preview labels (\`Would run\`, \`Blocked\`, \`Escalated\`) before go-live. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent fleet-digest --json\` |
 | \`{{cli}} tools list\` | \`tool.catalog\` | List the discoverable tool catalog the builder reads (id, scope tiers, credential requirement, access policy, and execution-boundary guidance). | Tenant | \`{{cli}} tools list --json\` |
@@ -42853,6 +42864,8 @@ The signed-in app exposes the same Skill command surface under **Skills** in the
 | \`{{cli}} compass show\` | \`compass.show_markdown\` | Render the current Compass as a clean markdown card for review. | Tenant | \`{{cli}} compass show --markdown\` |
 | \`{{cli}} charter show\` | \`charter.show_markdown\` | Render a seat's Charter as a clean markdown card for review. | Tenant | \`{{cli}} charter show --seat-id <id> --markdown\` |
 | \`{{cli}} deliverable list|get|create|attach\` | \`deliverable.list\`, \`deliverable.get\`, \`deliverable.create\`, \`deliverable.attach\` | List, get, create, or attach agent deliverables for a seat. Deliverables are durable work outputs visible across UI, CLI, and MCP. | Tenant (list/get), Seat (create/attach) | \`{{cli}} deliverable list --seat-id <id> --json\`; \`{{cli}} deliverable create --title "Brief" --kind brief\` |
+| \`{{cli}} graph show\` | \`graph.get\` | Print a table view of the Responsibility Graph with explicit \`seat_id\` and \`parent_seat_id\` columns. | Tenant | \`{{cli}} graph show\` |
+| \`{{cli}} seat list|get|create|rename|reparent|decommission\` | \`graph.get\`, \`seat.get\`, \`seat.create\`, \`seat.rename\`, \`seat.reparent\`, \`seat.decommission\`, \`seat.decommission_preview\` | Work with seats as first-class CLI primitives. \`seat decommission --dry-run\` previews affected occupancies, agents, Charters, tokens, credentials, work orders, and schedules before the human-gated teardown. | Tenant / Seat for targeted mutations | \`{{cli}} seat list\`; \`{{cli}} seat decommission --seat-id <id> --dry-run\` |
 
 Skills wrapper help:
 
@@ -42935,6 +42948,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_rename_seat\` | \`seat.rename\` | Rename a seat. | Seat or tenant-admin | Call with \`seat_id\` and \`name\`. |
 | \`rost_reparent_seat\` | \`seat.reparent\` | Move a seat under a new parent. | Seat or tenant-admin | Call with \`seat_id\` and \`parent_seat_id\`. |
 | \`rost_set_seat_type\` | \`seat.set_type\` | Set a seat type. | Seat or tenant-admin | Call with \`seat_id\` and \`seat_type\`. |
+| \`rost_preview_seat_decommission\` | \`seat.decommission_preview\` | Preview retiring a seat: affected occupancies, agents, Charters, MCP tokens, credentials, work orders, and schedules. No mutation. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; no confirmation. |
 | \`rost_decommission_seat\` | \`seat.decommission\` | Retire a seat: end occupancies, archive the Charter, revoke tokens/credentials, cancel schedules, tombstone event. No-orphan guarded. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`; expect confirmation. |
 | \`rost_draft_charter\` | \`charter.draft\` | Create or fetch a draft Charter. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_draft_all_charters\` | \`charter.draft_all\` | Draft Charters for every eligible seat. | Tenant | Call after initial graph creation. |
@@ -42977,6 +42991,9 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_get_agent_deliverable\` | \`deliverable.get\` | Read one durable agent deliverable by id for a seat. | Seat or tenant-admin | Call with \`{"seat_id":"<seat-id>","deliverable_id":"<id>"}\`. |
 | \`rost_create_agent_deliverable\` | \`deliverable.create\` | Create a scrubbed durable work output for the acting seat. | Seat | Call with title, kind, summary/content, and optional safe links. |
 | \`rost_attach_agent_deliverable\` | \`deliverable.attach\` | Attach a scrubbed deliverable to a source run, task, or work order after server-side seat validation. | Seat | Call with title, kind, and the source ids that belong to the acting seat. |
+| \`rost_accept_deliverable_value\` | \`deliverable.accept\` | Record a human-confirmed accepted value (USD) on a deliverable; owner-only and human-gated. Humans decide \u2014 agents cannot self-accept. Re-accepting records a correction as a new event. | Tenant-admin | Call with \`{"deliverable_id":"<id>","impact_value_usd":<number>}\`; expect human confirmation. |
+| \`rost_ai_workforce_roi_report\` | \`usage.report\` | Read the AI-workforce ROI report \u2014 per-period agent turns, token/run cost, human-accepted value, exceptions, and approvals \u2014 from immutable usage snapshots. | Tenant | Call with \`{}\` or \`{"limit":<n>}\`. |
+| \`rost_capture_usage_period_snapshot\` | \`usage.snapshot\` | Freeze the current (or a given) period's usage and accepted-value totals into an immutable snapshot; insert-only and idempotent. | Tenant | Call with \`{}\` or \`{"period":"YYYY-MM-DD"}\`. |
 | \`rost_list_agent_templates\` | \`agent_template.list\` | List stock agent templates and metadata. | Tenant | Call with \`{}\`. |
 | \`rost_create_agent_from_template\` | \`agent.create_from_template\` | Create a draft stock agent and draft Charter from a template (draft-only; occupancy needs a human steward). | Tenant | Call with \`seat_id\` and \`template_slug\`; expect human confirmation. |
 | \`rost_start_agent_setup\` | \`agent_setup.start\` | Start an agent setup draft for template, custom, or existing mode. | Tenant | Call with \`mode\` and seat placement. |
@@ -43031,9 +43048,12 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_create_cascade_goal\` | \`goal.create\` | Create a cycle goal under an objective. | Tenant | Call with cycle, seat, parent, title, definition of done. |
 | \`rost_update_cascade_goal\` | \`goal.update\` | Update a goal's title or definition of done. | Tenant | Call with \`goal_id\` and the changed fields. |
 | \`rost_set_cascade_goal_status\` | \`goal.set_status\` | Set a goal's status (on/off/done). | Seat or tenant-admin | Seats may set only their own goals. |
+| \`rost_set_cascade_goal_progress\` | \`goal.set_progress\` | Report a goal's quantified progress (0-100). An agent's progress is a proposal a human approves before the goal moves. | Seat or tenant-admin | Seats set only their own goals; expect confirmation. |
+| \`rost_list_at_risk_cascade_goals\` | \`goal.list_at_risk\` | List goals projected off pace (at-risk or projected-miss) with days behind pace. Read-only; status-only goals excluded. | Tenant | Call with \`{}\`. |
 | \`rost_reparent_cascade_goal\` | \`goal.reparent\` | Move a goal under a new parent. | Tenant | Authority change; expect confirmation. |
 | \`rost_drop_cascade_goal\` | \`goal.drop\` | Drop (retire) a goal, retained for audit. | Tenant | Expect confirmation. |
 | \`rost_list_friction_issues\` | \`friction.list\` | List Friction issues ranked by impact and severity. | Seat or tenant-admin | Call with \`{}\` or \`{"status":"active"}\`. |
+| \`rost_assist_friction_issue\` | \`friction.assist\` | Advisory IDS assist: the most-similar prior resolved issues with their root causes and decisions, a recurring-pattern flag, and recommended options. Read-only \u2014 it never resolves the issue. | Tenant | Call with \`{"issue_id":"<id>"}\`. |
 | \`rost_update_friction_issue_status\` | \`friction.update_status\` | Move a non-terminal issue between open and diagnosing. | Seat or tenant-admin | Call with \`issue_id\` and \`status\`. |
 | \`rost_resolve_friction_issue\` | \`friction.resolve\` | Resolve an issue with a root cause and remediation task. | Tenant | Human decision; expect confirmation. |
 | \`rost_link_task_to_friction_issue\` | \`friction.link_task\` | Attach an existing task as an issue's action task. | Seat or tenant-admin | Call with \`issue_id\` and \`task_id\`. |
@@ -43045,6 +43065,8 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_assign_sync_follow_up\` | \`sync.item.assign\` | Create a follow-up task from a Sync agenda item. | Tenant | Call with brief, owner seat, title, description. |
 | \`rost_list_escalations\` | \`escalation.list\` | List Steward queue escalations (own steward chain for humans, own seat for agents). | Seat or tenant-admin | Call with \`{}\` or \`{"include_decided":true}\`. |
 | \`rost_get_escalation\` | \`escalation.get\` | Read one escalation's evidence, recommendation, and decision state. | Seat or tenant-admin | Call with \`{"id":"<escalation-id>"}\`. Resolve/reject are human-only and not exposed over MCP. |
+| \`rost_check_compass_alignment\` | \`compass.alignment\` | Advisory drift check: scores whether cycle goals still ladder to the active vision and flags orphan/contradictory goals. Read-only \u2014 it never edits the Compass or any goal. | Tenant | Call with \`{}\`. |
+| \`rost_team_health_score\` | \`team.health_score\` | Read the single rolled-up 0-100 team-health score (latest month) with its band and label. | Tenant | Call with \`{}\`. |
 | \`rost_show_compass_as_markdown\` | \`compass.show_markdown\` | Render the current Compass and its open gaps as a clean markdown card for review. | Tenant | Call with \`{}\`. |
 | \`rost_show_charter_as_markdown\` | \`charter.show_markdown\` | Render a seat's active or latest Charter as a clean markdown card for review. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
 | \`rost_show_agent_setup_as_markdown\` | \`agent.show_markdown\` | Render a seat's agent setup, model, steward, tools, and Charter as a clean markdown card for review. | Tenant | Call with \`{"seat_id":"<seat-id>"}\`. |
@@ -43532,7 +43554,7 @@ Retrieve the narrowest relevant guide before making a setup recommendation. Pref
     order: 60,
     title: "Cascade guide",
     summary: "How to connect company goals to seat-level work without turning {{brand}} into a project-management tool.",
-    version: "2026-06-20.2",
+    version: "2026-06-28.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -43544,8 +43566,11 @@ Retrieve the narrowest relevant guide before making a setup recommendation. Pref
       "goal.create",
       "goal.update",
       "goal.set_status",
+      "goal.set_progress",
+      "goal.list_at_risk",
       "goal.reparent",
       "goal.drop",
+      "compass.alignment",
       "confirmation.approve"
     ],
     legal: {
@@ -43587,6 +43612,10 @@ Cascade warnings are advisory, not blockers. They point to setup that should be
 
 On \`/cascade\`, the screen renders the full goal depth, not just one or two levels. Off-track descendant branches stay open so the operator can see why a parent rolled up to risk.
 
+## Goal progress and at-risk goals
+
+A goal can carry a quantified progress (0-100) distinct from its on/off/done status. Report it with \`goal.set_progress\`; when an agent reports progress it lands as a proposal a human approves before the goal moves. \`goal.list_at_risk\` projects which goals are off pace by comparing progress against the elapsed fraction of the cycle window (deterministic date math, no forecast model). Off-pace goals surface on \`/cascade\`, on the owner home, in the weekly Sync Brief, and as a weekly owner alert. Status-only goals (no progress recorded) are simply excluded from the projection.
+
 On human and function seat pages, goal visibility includes both direct goals and descendant seat goals from the Responsibility Graph subtree, so a manager can review team progress without double-owning the agent's work.
 
 ## What does not belong
@@ -43689,6 +43718,7 @@ Agents may record readings when the Charter allows it. Agent-reported readings s
       "compass.answer_gap",
       "friction.file_issue",
       "friction.list",
+      "friction.assist",
       "friction.update_status",
       "friction.resolve",
       "friction.link_task",
@@ -43752,7 +43782,7 @@ Resolving Friction should produce one of four outcomes: a decision, a task, a Ch
     order: 70,
     title: "Steward queue guide",
     summary: "How Stewards review escalations, approve agent boundaries, and keep agents accountable.",
-    version: "2026-06-27.1",
+    version: "2026-06-27.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -43795,6 +43825,10 @@ When nothing is waiting, the Steward page still proves the governance loop. It s
 
 An escalation reaches you the same way no matter how the agent raised it \u2014 in a chat or CLI session, or on its own scheduled cloud run. When the agent stops at a boundary it opens the queue item and sends a notification to the accountable human along the steward chain, preferring a connected Slack channel and falling back to email. If no human occupies the agent's seat, the chain walks up to the next Steward. Delivery is idempotent: a retried run never notifies you twice for the same escalation, and the notification carries only summarized, redacted evidence \u2014 never secret material.
 
+## Where notifications land
+
+Every notification sent to you \u2014 escalations, approval requests, sync briefs, and your daily digest \u2014 also appears in your in-app Inbox, with unread state you can clear. A Slack or email delivery that fails is retried automatically on a bounded schedule; once it can no longer be delivered it stays visible in the Inbox rather than being lost. A once-a-day digest rolls up the day's deliverables, open approvals, and exceptions into a single message, so a quiet day stays quiet and a busy one is summarized in one place.
+
 ## Work the queue from CLI or MCP
 
 The Steward reads the queue from any surface but decides as a human.
@@ -45947,12 +45981,12 @@ function resolveModelConfig(model, effort) {
     ...resolvedEffort ? { effort: resolvedEffort } : {}
   };
 }
-function usageWithSchemaFooter(usage, bin) {
-  return `${usage}
+function usageWithSchemaFooter(usage2, bin) {
+  return `${usage2}
 discover a command's exact input with: ${bin} command schema <id>`;
 }
-async function dispatch(context, group, args, actions, usage) {
-  const usageText = usageWithSchemaFooter(usage, context.binName);
+async function dispatch(context, group, args, actions, usage2) {
+  const usageText = usageWithSchemaFooter(usage2, context.binName);
   const action = args[0];
   if (action === "--help" || action === "-h" || action === "help") {
     context.io.stdout.write(`${usageText}
@@ -45978,12 +46012,137 @@ ${usageText}
   }
 }
 function execute(context, parsed, commandId, body, format) {
-  const options = parsed.seat === void 0 ? void 0 : { targetSeatId: parsed.seat };
+  const autoConfirm = parsed.flags.has("yes") || parsed.flags.has("y");
+  const options = {
+    ...parsed.seat === void 0 ? {} : { targetSeatId: parsed.seat },
+    ...autoConfirm ? { autoConfirm: true } : {}
+  };
   if (parsed.json) {
     return context.run(context.client, commandId, body, void 0, options);
   }
   return context.run(context.client, commandId, body, format, options);
 }
+var graphWrapper = (context, args) => dispatch(context, "graph", args, {
+  show: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    return execute(ctx, parsed, "graph.get", {}, formatGraph);
+  },
+  get: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    return execute(ctx, parsed, "graph.get", {}, formatGraph);
+  }
+}, graphUsage(context.binName));
+function formatGraph(output) {
+  const record2 = asRecord(output);
+  const nodes = asArray(record2.nodes);
+  if (nodes.length === 0) {
+    return "No seats in the Responsibility Graph.";
+  }
+  const lines = [
+    `root_seat_id=${field(record2, "root_seat_id")}`,
+    "seat_id  parent_seat_id  type  status  name"
+  ];
+  for (const node of nodes) {
+    const row = asRecord(node);
+    lines.push(`${field(row, "seat_id")}  ${field(row, "parent_seat_id")}  ${field(row, "seat_type")}  ${field(row, "status")}  ${field(row, "name")}`);
+  }
+  return lines.join("\n");
+}
+function graphUsage(bin) {
+  return `Usage: ${bin} graph show|get [--json]
+  ${bin} graph show`;
+}
+var seatWrapper = (context, args) => dispatch(context, "seat", args, {
+  list: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    return execute(ctx, parsed, "graph.get", {}, formatSeatList);
+  },
+  get: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    const seatId = requireValue2(parsed, "seat-id");
+    return execute(ctx, parsed, "seat.get", { seat_id: seatId }, formatSeatDetail);
+  },
+  create: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    const body = withOptional({
+      name: requireValue2(parsed, "name"),
+      seat_type: requireValue2(parsed, "type")
+    }, {
+      parent_seat_id: optionalValue(parsed, "parent-seat-id")
+    });
+    return execute(ctx, parsed, "seat.create", body, formatSeatMutation);
+  },
+  rename: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    return execute(ctx, parsed, "seat.rename", {
+      seat_id: requireValue2(parsed, "seat-id"),
+      name: requireValue2(parsed, "name")
+    }, formatSeatMutation);
+  },
+  reparent: (ctx, rest) => {
+    const parsed = parseFlags(rest);
+    return execute(ctx, parsed, "seat.reparent", {
+      seat_id: requireValue2(parsed, "seat-id"),
+      new_parent_seat_id: requireValue2(parsed, "parent-seat-id")
+    }, formatSeatMutation);
+  },
+  decommission: (ctx, rest) => {
+    const parsed = parseFlags(rest, /* @__PURE__ */ new Set(["dry-run", "preview"]));
+    if (parsed.flags.has("dry-run") || parsed.flags.has("preview")) {
+      return execute(ctx, parsed, "seat.decommission_preview", {
+        seat_id: requireValue2(parsed, "seat-id")
+      }, formatSeatDecommissionPreview);
+    }
+    return execute(ctx, parsed, "seat.decommission", {
+      seat_id: requireValue2(parsed, "seat-id")
+    }, formatSeatMutation);
+  }
+}, seatUsage(context.binName));
+function formatSeatList(output) {
+  const nodes = asArray(asRecord(output).nodes);
+  if (nodes.length === 0) {
+    return "No seats.";
+  }
+  return nodes.map((node) => {
+    const row = asRecord(node);
+    return `seat_id=${field(row, "seat_id")} parent_seat_id=${field(row, "parent_seat_id")} type=${field(row, "seat_type")} status=${field(row, "status")} name=${field(row, "name")}`;
+  }).join("\n");
+}
+function formatSeatDetail(output) {
+  const record2 = asRecord(output);
+  const counts = asRecord(record2.counts);
+  return [
+    `seat_id=${field(record2, "seat_id")} name=${field(record2, "name")} type=${field(record2, "seat_type")} status=${field(record2, "status")}`,
+    `parent_seat_id=${field(record2, "parent_seat_id")} active_charter_version_id=${field(record2, "active_charter_version_id")} draft_charter_version_id=${field(record2, "draft_charter_version_id")}`,
+    `agent_status=${field(record2, "agent_status")} agent_lane=${field(record2, "agent_lane")}`,
+    `counts: open_tasks=${field(counts, "open_tasks")} owned_goals=${field(counts, "owned_goals")} active_measurables=${field(counts, "active_measurables")} open_issues=${field(counts, "open_issues")}`
+  ].join("\n");
+}
+function formatSeatMutation(output) {
+  const record2 = asRecord(output);
+  return `seat_id=${field(record2, "seat_id")}`;
+}
+function formatSeatDecommissionPreview(output) {
+  const record2 = asRecord(output);
+  const effects = asArray(record2.effects).map((effect) => `- ${String(effect)}`);
+  return [
+    `seat_id=${field(record2, "seat_id")} name=${field(record2, "seat_name")} status=${field(record2, "previous_status")}`,
+    `active_occupancies=${field(record2, "active_occupancy_count")} active_agents=${field(record2, "active_agent_ids")}`,
+    `active_charters=${field(record2, "active_charter_count")} mcp_tokens=${field(record2, "active_mcp_token_count")} credentials=${field(record2, "active_credential_count")}`,
+    `open_work_orders=${field(record2, "open_work_order_count")} schedules=${field(record2, "schedule_count")} no_orphan_steward_guard=${field(record2, "no_orphan_steward_guard")}`,
+    "effects:",
+    ...effects
+  ].join("\n");
+}
+function seatUsage(bin) {
+  return `Usage: ${bin} seat list|get|create|rename|reparent|decommission [--json] [--yes]
+  ${bin} seat list
+  ${bin} seat get --seat-id <id>
+  ${bin} seat create --name <text> --type human|agent|hybrid [--parent-seat-id <id>]
+  ${bin} seat rename --seat-id <id> --name <text>
+  ${bin} seat reparent --seat-id <id> --parent-seat-id <id> [--yes]
+  ${bin} seat decommission --seat-id <id> [--dry-run] [--yes]`;
+}
 var taskWrapper = (context, args) => dispatch(context, "task", args, {
   list: (ctx, rest) => {
     const parsed = parseFlags(rest);
@@ -46496,13 +46655,14 @@ var runnerWrapper = (context, args) => dispatch(context, "runner", args, {
   }
 }, runnerUsage(context.binName));
 function runnerUsage(bin) {
-  return `Usage: ${bin} runner list|status|diagnose|repair|work-orders|revoke [--json]
+  return `Usage: ${bin} runner list|status|diagnose|repair|work-orders|revoke|serve [--json]
   ${bin} runner list [--include-revoked]
   ${bin} runner status --runner-id <id>
   ${bin} runner diagnose --runner-id <id>
   ${bin} runner repair --runner-id <id> [--issue restart|re_pair|revoke_stale|missing_cli_runtime]
   ${bin} runner work-orders [--status <s>] [--agent-id <id>] [--runner-id <id>] [--limit <n>]
-  ${bin} runner revoke --runner-id <id>`;
+  ${bin} runner revoke --runner-id <id>
+  ${bin} runner serve [--name <text>] [--state-file <path>] [--heartbeat-ms <n>] [--once] [--execute]`;
 }
 var notificationWrapper = (context, args) => dispatch(context, "notification", args, {
   settings: (ctx, rest) => {
@@ -47487,7 +47647,9 @@ var OPERATION_GROUPS = [
   "compass",
   "charter",
   "deliverable",
-  "system"
+  "system",
+  "graph",
+  "seat"
 ];
 var wrappers = {
   task: taskWrapper,
@@ -47510,7 +47672,9 @@ var wrappers = {
   compass: compassWrapper,
   charter: charterWrapper,
   deliverable: deliverableWrapper,
-  system: systemWrapper
+  system: systemWrapper,
+  graph: graphWrapper,
+  seat: seatWrapper
 };
 function isOperationGroup(value) {
   return value !== void 0 && OPERATION_GROUPS.includes(value);
@@ -47536,7 +47700,9 @@ var groupUsageBuilders = {
   compass: compassUsage,
   charter: charterUsage,
   deliverable: deliverableUsage,
-  system: systemUsage
+  system: systemUsage,
+  graph: graphUsage,
+  seat: seatUsage
 };
 function operationGroupUsage(group, bin) {
   return usageWithSchemaFooter(groupUsageBuilders[group](bin), bin);
@@ -47559,9 +47725,9 @@ function operationUsageLines(bin) {
     `${bin} escalation list|get|resolve|reject`,
     `${bin} error list|resolve|supersede`,
     `${bin} sync brief|compile|complete`,
-    `${bin} runner list|status|diagnose|repair|work-orders|revoke`,
+    `${bin} runner list|status|diagnose|repair|work-orders|revoke|serve`,
     `${bin} notification settings|test|errors`,
-    `${bin} settings get|update|product-learning|rename`,
+    `${bin} settings get|update|product-learning|agent-policy|rename`,
     `${bin} member invite|update|remove`,
     `${bin} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show`,
     `${bin} tools list`,
@@ -47569,7 +47735,9 @@ function operationUsageLines(bin) {
     `${bin} model list`,
     `${bin} compass show`,
     `${bin} charter show`,
-    `${bin} deliverable list|get|create|attach`
+    `${bin} deliverable list|get|create|attach`,
+    `${bin} graph show`,
+    `${bin} seat list|get|create|rename|reparent|decommission`
   ];
 }
 
@@ -48064,6 +48232,424 @@ function pendingConfirmationFromError(error51) {
   return { confirmationId, commandId };
 }
 
+// src/doctor.ts
+import { execFile as execFileCallback2 } from "node:child_process";
+import { access, readFile as readFile3 } from "node:fs/promises";
+import { delimiter } from "node:path";
+import { promisify as promisify3 } from "node:util";
+var execFile3 = promisify3(execFileCallback2);
+async function runDoctor(options) {
+  const env = options.env ?? process.env;
+  const store = options.store ?? createTokenStore();
+  const lines = [`${cliBrand.name} CLI doctor`];
+  const config2 = loadConfig(env);
+  lines.push(`app_url: ${config2.appUrl}`);
+  lines.push(`supabase_url: ${config2.supabaseUrl}`);
+  const currentVersion = await readCurrentVersion2();
+  lines.push(`version: ${currentVersion ?? "unknown"}`);
+  const pathStatus = await checkPath(env);
+  lines.push(pathStatus);
+  try {
+    const session = await store.read();
+    lines.push(`session: ${session ? `present (${store.describe()})` : `missing - run ${cliBrand.binName} login --device`}`);
+  } catch (error51) {
+    lines.push(`session: unreadable - ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}`);
+  }
+  const [claude, codex] = await Promise.all([probeCli("claude"), probeCli("codex")]);
+  lines.push(`claude: ${claude}`);
+  lines.push(`codex: ${codex}`);
+  const latest = await fetchLatestVersion2(cliBrand.packageName, env);
+  if (currentVersion && latest && isSemverBehind2(currentVersion, latest)) {
+    lines.push(`update: ${currentVersion} -> ${latest}; run npm i -g ${cliBrand.packageName}@latest`);
+  } else if (latest) {
+    lines.push(`update: current (${latest})`);
+  } else {
+    lines.push("update: skipped or unavailable");
+  }
+  options.io.stdout.write(`${lines.join("\n")}
+`);
+  return 0;
+}
+async function checkPath(env) {
+  const pathValue = env.PATH ?? "";
+  const candidates = pathValue.split(delimiter).filter(Boolean).map((entry) => `${entry}/${cliBrand.binName}`);
+  for (const candidate of candidates) {
+    try {
+      await access(candidate);
+      return `path: found ${candidate}`;
+    } catch {
+      continue;
+    }
+  }
+  return `path: ${cliBrand.binName} not found on PATH - use npx ${cliBrand.packageName}@latest or add your npm global bin directory`;
+}
+async function probeCli(command) {
+  try {
+    const { stdout, stderr } = await execFile3(command, ["--version"], { timeout: 1500 });
+    const version4 = (stdout || stderr).trim().split("\n")[0]?.trim();
+    return version4 ? `installed (${version4})` : "installed";
+  } catch {
+    return "not found";
+  }
+}
+async function readCurrentVersion2() {
+  try {
+    const url2 = new URL("../package.json", import.meta.url);
+    const parsed = JSON.parse(await readFile3(url2, "utf8"));
+    return typeof parsed.version === "string" ? parsed.version : null;
+  } catch {
+    return null;
+  }
+}
+async function fetchLatestVersion2(packageName, env) {
+  if (env.CI || env.VITEST || env.CLI_SKIP_UPDATE_CHECK === "1" || env[`${cliBrand.envPrefix}_CLI_NO_UPDATE_CHECK`] === "1") {
+    return null;
+  }
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 750);
+  try {
+    const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest`, {
+      headers: { accept: "application/json" },
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const body = await response.json();
+    return typeof body.version === "string" ? body.version : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function isSemverBehind2(currentVersion, latestVersion) {
+  const current = parseSemver2(currentVersion);
+  const latest = parseSemver2(latestVersion);
+  if (!current || !latest) {
+    return currentVersion !== latestVersion;
+  }
+  if (current.major !== latest.major) {
+    return current.major < latest.major;
+  }
+  if (current.minor !== latest.minor) {
+    return current.minor < latest.minor;
+  }
+  return current.patch < latest.patch;
+}
+function parseSemver2(value) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(value);
+  if (!match) {
+    return null;
+  }
+  const [, major, minor, patch] = match;
+  if (major === void 0 || minor === void 0 || patch === void 0) {
+    return null;
+  }
+  return {
+    major: Number.parseInt(major, 10),
+    minor: Number.parseInt(minor, 10),
+    patch: Number.parseInt(patch, 10)
+  };
+}
+
+// src/runner-serve.ts
+import { execFile as execFileCallback3, spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmod, mkdir as mkdir2, readFile as readFile4, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { hostname as hostname3, tmpdir } from "node:os";
+import path3 from "node:path";
+import { setTimeout as sleep2 } from "node:timers/promises";
+import { promisify as promisify4 } from "node:util";
+var execFile4 = promisify4(execFileCallback3);
+async function runRunnerServe(options) {
+  const env = options.env ?? process.env;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  let config2;
+  try {
+    config2 = parseServeArgs(options.args, options.appUrl, env);
+  } catch (error51) {
+    options.io.stderr.write(`${error51 instanceof Error ? error51.message : String(error51)}
+${usage()}
+`);
+    return 1;
+  }
+  options.io.stdout.write(`runner serve: ${options.appUrl} name=${config2.name} execute=${config2.execute}
+`);
+  let state;
+  try {
+    state = await pairIfNeeded(options.client ?? null, fetchImpl, options.appUrl, config2, options.io);
+  } catch (error51) {
+    options.io.stderr.write(`${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+`);
+    return 1;
+  }
+  let beat = 0;
+  let heartbeatSucceeded = false;
+  let failed = false;
+  do {
+    const capabilities = await detectCapabilities();
+    try {
+      const heartbeat = await post2(fetchImpl, options.appUrl, "/api/runner/heartbeat", { capabilities }, state.runner_secret);
+      if (heartbeat.status !== 200) {
+        options.io.stderr.write(`heartbeat ${heartbeat.status}: ${redactForLog(JSON.stringify(heartbeat.json))}
+`);
+        failed = true;
+      } else {
+        heartbeatSucceeded = true;
+        options.io.stdout.write(`heartbeat ok #${beat} runner_id=${state.runner_id} claude=${capabilities.claude.installed} codex=${capabilities.codex.installed}
+`);
+      }
+      if (config2.execute && capabilities.claude.installed) {
+        await claimAndExecute(fetchImpl, options.appUrl, state, options.io);
+      }
+    } catch (error51) {
+      failed = true;
+      options.io.stderr.write(`transient runner error (continuing): ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+`);
+    }
+    beat += 1;
+    if (!config2.once) {
+      await sleep2(config2.heartbeatMs);
+    }
+  } while (!config2.once);
+  return heartbeatSucceeded && !failed ? 0 : 1;
+}
+function parseServeArgs(args, appUrl2, env) {
+  let name = env.RUNNER_NAME ?? `headless-${hostname3()}`;
+  let stateFile = env.RUNNER_STATE_FILE ?? path3.join(tmpdir(), `rost-runner-${createHash("sha1").update(appUrl2).digest("hex").slice(0, 8)}.json`);
+  let heartbeatMs = Number(env.RUNNER_HEARTBEAT_MS ?? 3e4);
+  let execute2 = env.RUNNER_EXECUTE === "1";
+  let once = false;
+  let userCode = env.RUNNER_USER_CODE;
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (token === "--name") {
+      name = requiredValue(args, index);
+      index += 1;
+    } else if (token === "--state-file") {
+      stateFile = requiredValue(args, index);
+      index += 1;
+    } else if (token === "--heartbeat-ms") {
+      heartbeatMs = Number(requiredValue(args, index));
+      index += 1;
+    } else if (token === "--user-code") {
+      userCode = requiredValue(args, index);
+      index += 1;
+    } else if (token === "--execute") {
+      execute2 = true;
+    } else if (token === "--once") {
+      once = true;
+    } else {
+      throw new Error(`Unexpected runner serve argument: ${token ?? ""}`);
+    }
+  }
+  if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 1e3) {
+    throw new Error("--heartbeat-ms must be an integer >= 1000.");
+  }
+  return { name, stateFile, heartbeatMs, execute: execute2, once, ...userCode ? { userCode } : {} };
+}
+function requiredValue(args, index) {
+  const value = args[index + 1];
+  if (value === void 0 || value.startsWith("--")) {
+    throw new Error(`${args[index] ?? "flag"} requires a value.`);
+  }
+  return value;
+}
+async function resolveRunnerServeTenant(client) {
+  try {
+    const response = await client.execute("user.whoami", {});
+    const output = response.output && typeof response.output === "object" && !Array.isArray(response.output) ? response.output : {};
+    const activeTenantId = output.active_tenant_id ?? output.current_tenant_id ?? output.tenant_id;
+    return typeof activeTenantId === "string" && activeTenantId.length > 0 ? activeTenantId : null;
+  } catch {
+    return null;
+  }
+}
+async function pairIfNeeded(client, fetchImpl, appUrl2, config2, io) {
+  if (client) {
+    const expectedTenantId = await resolveRunnerServeTenant(client);
+    if (expectedTenantId) {
+      config2.expectedTenantId = expectedTenantId;
+    }
+  }
+  const existing = await loadState(config2.stateFile, config2.expectedTenantId);
+  if (existing) {
+    io.stdout.write(`reusing paired runner ${existing.runner_id}
+`);
+    return existing;
+  }
+  if (!client) {
+    throw new Error(`No paired runner state at ${config2.stateFile}. Run with a CLI login once to pair this runner before starting without a CLI session.`);
+  }
+  const userCode = config2.userCode ?? await startPairing(client, config2);
+  const claim = await post2(fetchImpl, appUrl2, "/api/runner/pairing/claim", { user_code: userCode });
+  const runnerSecret = claim.json.runner_secret;
+  const runnerId = claim.json.runner_id;
+  const tenantId = claim.json.tenant_id;
+  if (claim.status !== 200 || typeof runnerSecret !== "string" || typeof runnerId !== "string") {
+    throw new Error(`pairing claim failed ${claim.status}: ${redactForLog(JSON.stringify(claim.json))}`);
+  }
+  const state = {
+    runner_id: runnerId,
+    runner_secret: runnerSecret,
+    ...typeof tenantId === "string" ? { tenant_id: tenantId } : config2.expectedTenantId ? { tenant_id: config2.expectedTenantId } : {},
+    name: typeof claim.json.name === "string" ? claim.json.name : config2.name
+  };
+  await mkdir2(path3.dirname(config2.stateFile), { recursive: true, mode: 448 });
+  await writeFile2(config2.stateFile, `${JSON.stringify(state)}
+`, { mode: 384 });
+  await chmod(config2.stateFile, 384);
+  io.stdout.write(`paired runner_id=${runnerId} state_file=${config2.stateFile}
+`);
+  return state;
+}
+async function loadState(filePath, expectedTenantId) {
+  try {
+    const parsed = JSON.parse(await readFile4(filePath, "utf8"));
+    if (typeof parsed.runner_id === "string" && typeof parsed.runner_secret === "string") {
+      if (expectedTenantId && parsed.tenant_id !== expectedTenantId) {
+        return null;
+      }
+      return {
+        runner_id: parsed.runner_id,
+        runner_secret: parsed.runner_secret,
+        ...typeof parsed.tenant_id === "string" ? { tenant_id: parsed.tenant_id } : {},
+        ...typeof parsed.name === "string" ? { name: parsed.name } : {}
+      };
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+async function startPairing(client, config2) {
+  const response = await client.execute("runner.pairing.start", { name: config2.name, platform: process.platform });
+  const userCode = response.output && typeof response.output === "object" ? response.output.user_code : void 0;
+  if (typeof userCode !== "string" || userCode.length === 0) {
+    throw new Error("runner.pairing.start did not return a user_code.");
+  }
+  return userCode;
+}
+async function detectCapabilities() {
+  const [claude, codex] = await Promise.all([probe("claude"), probe("codex")]);
+  return { claude, codex };
+}
+async function probe(command) {
+  try {
+    const { stdout, stderr } = await execFile4(command, ["--version"], { timeout: 1500 });
+    return { installed: true, version: (stdout || stderr).trim() || null, auth_state: "ready" };
+  } catch {
+    return { installed: false, version: null, auth_state: "unknown" };
+  }
+}
+async function post2(fetchImpl, appUrl2, pathName, body, token) {
+  const headers = { "content-type": "application/json" };
+  if (token) {
+    headers.authorization = `Bearer ${token}`;
+  }
+  const response = await fetchImpl(`${appUrl2.replace(/\/+$/, "")}${pathName}`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body)
+  });
+  const text = await response.text();
+  let json2;
+  try {
+    json2 = JSON.parse(text);
+  } catch {
+    json2 = { raw: text.slice(0, 300) };
+  }
+  return { status: response.status, json: json2 };
+}
+async function claimAndExecute(fetchImpl, appUrl2, state, io) {
+  const claimed = await post2(fetchImpl, appUrl2, "/api/runner/work-orders/claim", {}, state.runner_secret);
+  const workOrder = claimed.json.work_order;
+  if (claimed.status !== 200 || !workOrder || typeof workOrder !== "object") {
+    return;
+  }
+  const workOrderId = workOrder.id;
+  if (typeof workOrderId !== "string") {
+    return;
+  }
+  const started = await post2(fetchImpl, appUrl2, `/api/runner/work-orders/${encodeURIComponent(workOrderId)}/start`, {}, state.runner_secret);
+  if (started.status !== 200) {
+    throw new Error(`work order start failed ${started.status}: ${redactForLog(JSON.stringify(started.json))}`);
+  }
+  const result = await runClaudeTurn(appUrl2, workOrder);
+  const reported = await post2(fetchImpl, appUrl2, `/api/runner/work-orders/${encodeURIComponent(workOrderId)}/result`, {
+    status: result.ok ? "succeeded" : "failed",
+    summary: result.summary,
+    log_ref: `runner-local:${workOrderId}`,
+    model: "claude-cli"
+  }, state.runner_secret);
+  if (reported.status !== 200) {
+    throw new Error(`work order result failed ${reported.status}: ${redactForLog(JSON.stringify(reported.json))}`);
+  }
+  io.stdout.write(`work_order_id=${workOrderId} status=${result.ok ? "succeeded" : "failed"}
+`);
+}
+async function runClaudeTurn(appUrl2, workOrder) {
+  const mcp = typeof workOrder.mcp === "object" && workOrder.mcp !== null ? workOrder.mcp : {};
+  const token = typeof mcp.token === "string" ? mcp.token : "";
+  const url2 = typeof mcp.url === "string" ? `${appUrl2.replace(/\/+$/, "")}${mcp.url}` : `${appUrl2.replace(/\/+$/, "")}/mcp`;
+  const mcpConfig = JSON.stringify({ mcpServers: { rost: { type: "http", url: url2, headers: { Authorization: `Bearer ${token}` } } } });
+  const configPath = path3.join(tmpdir(), `rost-runner-mcp-${createHash("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
+  const context = {
+    work_order_id: workOrder.id,
+    task_id: workOrder.task_id ?? null,
+    seat: workOrder.seat ?? null,
+    charter: workOrder.charter ?? null,
+    permission_manifest: workOrder.permission_manifest ?? null
+  };
+  const prompt = [
+    `Load your ${cliBrand.name} context, report one read-only status, and stop.`,
+    "Do not call external systems or mutating tools.",
+    `Claimed work order context: ${JSON.stringify(context).slice(0, 8e3)}`
+  ].join("\n");
+  await writeFile2(configPath, `${mcpConfig}
+`, { mode: 384 });
+  await chmod(configPath, 384);
+  return new Promise((resolve2) => {
+    let settled = false;
+    const finish = (result) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      void rm2(configPath, { force: true });
+      resolve2(result);
+    };
+    const child = spawn("claude", ["-p", prompt, "--mcp-config", configPath, "--strict-mcp-config", "--output-format", "text"], {
+      cwd: tmpdir(),
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let out = "";
+    let err = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish({ ok: false, summary: "turn timed out after 180s" });
+    }, 18e4);
+    child.stdout.on("data", (data) => {
+      out += data.toString("utf8");
+    });
+    child.stderr.on("data", (data) => {
+      err += data.toString("utf8");
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      finish({ ok: code === 0, summary: redactForLog((out || err || "completed").trim()).slice(0, 600) });
+    });
+    child.on("error", (error51) => {
+      clearTimeout(timer);
+      finish({ ok: false, summary: `spawn error: ${redactForLog(error51.message)}` });
+    });
+  });
+}
+function usage() {
+  return "Usage: rost runner serve [--name <text>] [--state-file <path>] [--heartbeat-ms <n>] [--user-code <code>] [--once] [--execute]";
+}
+
 // src/index.ts
 async function main(argv = process.argv.slice(2), options = {}) {
   const io = options.io ?? {
@@ -48117,6 +48703,13 @@ async function main(argv = process.argv.slice(2), options = {}) {
     }
     return result.exitCode;
   }
+  if (command === "doctor") {
+    return runDoctor({
+      io,
+      env: process.env,
+      ...options.store ? { store: options.store } : {}
+    });
+  }
   if (command === "onboard" && args[0] === "run") {
     io.stdout.write(`${renderOnboardRunPrompt()}
 `);
@@ -48172,12 +48765,35 @@ async function main(argv = process.argv.slice(2), options = {}) {
 `);
     justLoggedIn = true;
   }
+  const config2 = loadConfig();
+  if (command === "runner" && args[0] === "serve") {
+    let runnerClient = null;
+    if (session) {
+      try {
+        const refreshed2 = await refreshSession(config2, session);
+        if (refreshed2 !== session) {
+          session = refreshed2;
+          await store.write(session);
+        }
+        runnerClient = new CommandClient({ appUrl: config2.appUrl, token: session.accessToken });
+      } catch (error51) {
+        io.stderr.write(`CLI session unavailable; trying paired runner state only: ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+`);
+      }
+    }
+    return runRunnerServe({
+      io,
+      client: runnerClient,
+      appUrl: config2.appUrl,
+      args: args.slice(1),
+      env: process.env
+    });
+  }
   if (!session) {
     io.stderr.write(`Not logged in. Run ${cliBrand.binName} login first.
 `);
     return 1;
   }
-  const config2 = loadConfig();
   let refreshed;
   try {
     refreshed = await refreshSession(config2, session);
@@ -48294,9 +48910,10 @@ async function executeDirectCommand(io, client, args) {
   }
   const commandId = first;
   let seat;
+  let autoConfirm = false;
   let rest;
   try {
-    ({ seat, rest } = extractSeatFlag(args.slice(1)));
+    ({ seat, autoConfirm, rest } = extractCommandMetaFlags(args.slice(1)));
   } catch (error51) {
     io.stderr.write(`${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
 `);
@@ -48317,11 +48934,15 @@ async function executeDirectCommand(io, client, args) {
 `);
     return 1;
   }
-  return printCommandOutput(io, client, commandId, body, void 0, seat === void 0 ? {} : { targetSeatId: seat });
+  return printCommandOutput(io, client, commandId, body, void 0, {
+    ...seat === void 0 ? {} : { targetSeatId: seat },
+    autoConfirm
+  });
 }
-function extractSeatFlag(args) {
+function extractCommandMetaFlags(args) {
   const rest = [];
   let seat;
+  let autoConfirm = false;
   for (let index = 0; index < args.length; index += 1) {
     const token = args[index];
     if (token === "--seat") {
@@ -48333,11 +48954,15 @@ function extractSeatFlag(args) {
       index += 1;
       continue;
     }
+    if (token === "--yes" || token === "-y") {
+      autoConfirm = true;
+      continue;
+    }
     if (token !== void 0) {
       rest.push(token);
     }
   }
-  return { ...seat === void 0 ? {} : { seat }, rest };
+  return { ...seat === void 0 ? {} : { seat }, autoConfirm, rest };
 }
 var SeatFlagError = class extends Error {
 };
@@ -48352,7 +48977,9 @@ function formatCommandSchema(output) {
   if (typeof help === "string" && help.length > 0) {
     lines.push(`help: ${help}`);
   }
-  lines.push("", "input_schema:", JSON.stringify(record2.input_schema, null, 2));
+  const schemaSummary = formatInputSchemaSummary(record2.input_schema);
+  lines.push("", "input:");
+  lines.push(schemaSummary || "  no input fields");
   if (record2.example !== void 0) {
     lines.push("", "example input:", JSON.stringify(record2.example, null, 2));
   }
@@ -48366,6 +48993,23 @@ function formatCommandSchema(output) {
   }
   return lines.join("\n");
 }
+function formatInputSchemaSummary(schema) {
+  const root = asRecord3(schema);
+  const properties = asRecord3(root.properties);
+  const required2 = new Set(asStringArray(root.required));
+  const entries = Object.entries(properties);
+  if (entries.length === 0) {
+    return "";
+  }
+  return entries.map(([key, value]) => {
+    const prop = asRecord3(value);
+    const type = Array.isArray(prop.type) ? prop.type.join("|") : field2(prop, "type");
+    const enumValues = asStringArray(prop.enum);
+    const description = typeof prop.description === "string" ? ` \u2014 ${prop.description}` : "";
+    const enumText = enumValues.length > 0 ? ` enum=${enumValues.join("|")}` : "";
+    return `  ${key}${required2.has(key) ? " (required)" : " (optional)"}: ${type}${enumText}${description}`;
+  }).join("\n");
+}
 function formatCommandList(output) {
   const commands = Array.isArray(asRecord3(output).commands) ? asRecord3(output).commands : [];
   if (commands.length === 0) {
@@ -48492,10 +49136,12 @@ async function printCommandOutput(io, client, commandId, body = {}, format, opti
 `);
     return 0;
   } catch (error51) {
-    if (io.interactive === true) {
+    const envAutoConfirm = process.env[`${cliBrand.envPrefix}_CLI_AUTO_CONFIRM`] === "1";
+    if (io.interactive === true || options.autoConfirm === true || envAutoConfirm) {
       const pending = pendingConfirmationFromError2(error51);
       if (pending && pending.commandId === commandId) {
-        io.stderr.write(`Approving ${pending.commandId} confirmation ${pending.confirmationId} as the interactive CLI user.
+        const reason = io.interactive === true ? "interactive CLI user" : options.autoConfirm === true ? "explicit CLI auto-confirm" : `${cliBrand.envPrefix}_CLI_AUTO_CONFIRM environment auto-confirm`;
+        io.stderr.write(`Approving ${pending.commandId} confirmation ${pending.confirmationId} as the ${reason}.
 `);
         try {
           const approved = await client.execute("confirmation.approve", { confirmation_id: pending.confirmationId });
@@ -48540,6 +49186,14 @@ function printCommandError2(io, error51) {
       io.stderr.write(`\u2192 try: ${redactForLog(help)}
 `);
     }
+    if (error51.response.error.code === "COMMAND_CONFIRMATION_REQUIRED") {
+      const details = asRecord3(error51.response.error.details);
+      const expiresAt = details.expiresAt;
+      if (typeof expiresAt === "string" && expiresAt.length > 0) {
+        io.stderr.write(`confirmation expires at: ${redactForLog(expiresAt)}
+`);
+      }
+    }
     if (error51.status === 409) {
       return 3;
     }
@@ -48561,7 +49215,7 @@ function parseJsonBody(args) {
   return JSON.parse(body);
 }
 function isCommand(value) {
-  return value === "login" || value === "logout" || value === "signup" || value === "whoami" || value === "tenants" || value === "use" || value === "command" || value === "onboard" || value === "mcp" || value === "skills" || value === "init" || value === "docs" || value === "reference" || value === "help";
+  return value === "login" || value === "logout" || value === "signup" || value === "whoami" || value === "tenants" || value === "use" || value === "command" || value === "onboard" || value === "mcp" || value === "skills" || value === "init" || value === "docs" || value === "reference" || value === "doctor" || value === "help";
 }
 function printUsage(io) {
   io.stdout.write([
@@ -48575,6 +49229,7 @@ function printUsage(io) {
     `${cliBrand.binName} command <id> [--seat <seat-id>] --json [json-body]`,
     `${cliBrand.binName} command schema <id> [--json]`,
     `${cliBrand.binName} command list [--json]`,
+    `${cliBrand.binName} doctor`,
     ...operationUsageLines(cliBrand.binName),
     `${cliBrand.binName} onboard status`,
     `${cliBrand.binName} onboard run`,