@rosthq/cli 0.7.28 → 0.7.30

package/dist/index.js

@@ -472,13 +472,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path5, preserveJsx) {
-  if (typeof path5 === "string" && /^\.\.?\//.test(path5)) {
-    return path5.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
+function __rewriteRelativeImportExtension(path6, preserveJsx) {
+  if (typeof path6 === "string" && /^\.\.?\//.test(path6)) {
+    return path6.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : d + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path5;
+  return path6;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -13257,7 +13257,7 @@ var require_main3 = __commonJS({
 });
 
 // src/index.ts
-import { realpathSync as realpathSync2 } from "node:fs";
+import { realpathSync as realpathSync3 } from "node:fs";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "node:url";
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
@@ -14026,10 +14026,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path5) {
-  if (!path5)
+function getElementAtPath(obj, path6) {
+  if (!path6)
     return obj;
-  return path5.reduce((acc, key) => acc?.[key], obj);
+  return path6.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -14438,11 +14438,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path5, issues) {
+function prefixIssues(path6, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path5);
+    iss.path.unshift(path6);
     return iss;
   });
 }
@@ -14589,16 +14589,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path5 = []) => {
+  const processError = (error52, path6 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path6, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else {
-        const fullpath = [...path5, ...issue2.path];
+        const fullpath = [...path6, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -14625,17 +14625,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path5 = []) => {
+  const processError = (error52, path6 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path6, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else {
-        const fullpath = [...path5, ...issue2.path];
+        const fullpath = [...path6, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -14667,8 +14667,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path5 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path5) {
+  const path6 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path6) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -27360,13 +27360,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path5 = ref.slice(1).split("/").filter(Boolean);
-  if (path5.length === 0) {
+  const path6 = ref.slice(1).split("/").filter(Boolean);
+  if (path6.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path5[0] === defsKey) {
-    const key = path5[1];
+  if (path6[0] === defsKey) {
+    const key = path6[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -27828,7 +27828,7 @@ var CommandClient = class {
     this.fetchImpl = options.fetchImpl ?? fetch;
   }
   async execute(commandId, body = {}, options = {}) {
-    const path5 = `/api/commands/${encodeURIComponent(commandId)}`;
+    const path6 = `/api/commands/${encodeURIComponent(commandId)}`;
     const headers = {
       authorization: `Bearer ${this.token}`,
       "content-type": "application/json"
@@ -27836,7 +27836,7 @@ var CommandClient = class {
     if (options.targetSeatId !== void 0 && options.targetSeatId.length > 0) {
       headers["x-rost-seat"] = options.targetSeatId;
     }
-    const response = await this.fetchImpl(`${this.appUrl}${path5}`, {
+    const response = await this.fetchImpl(`${this.appUrl}${path6}`, {
       method: "POST",
       headers,
       body: JSON.stringify(body)
@@ -27849,7 +27849,7 @@ var CommandClient = class {
       const snippet = redactSecrets(text.replace(/\s+/g, " ").trim()).slice(0, 200);
       throw new CommandClientError(
         response.status,
-        `server returned HTTP ${response.status} (non-JSON) from ${path5}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
+        `server returned HTTP ${response.status} (non-JSON) from ${path6}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
       );
     }
     const parsed = commandResponseSchema.parse(raw);
@@ -33064,8 +33064,8 @@ var IcebergError = class extends Error {
     return this.status === 419;
   }
 };
-function buildUrl(baseUrl, path5, query) {
-  const url2 = new URL(path5, baseUrl);
+function buildUrl(baseUrl, path6, query) {
+  const url2 = new URL(path6, baseUrl);
   if (query) {
     for (const [key, value] of Object.entries(query)) {
       if (value !== void 0) {
@@ -33095,12 +33095,12 @@ function createFetchClient(options) {
   return {
     async request({
       method,
-      path: path5,
+      path: path6,
       query,
       body,
       headers
     }) {
-      const url2 = buildUrl(options.baseUrl, path5, query);
+      const url2 = buildUrl(options.baseUrl, path6, query);
       const authHeaders = await buildAuthHeaders(options.auth);
       const res = await fetchFn(url2, {
         method,
@@ -33962,7 +33962,7 @@ var StorageFileApi = class extends BaseApiClient {
   * @param path The relative file path. Should be of the format `folder/subfolder/filename.png`. The bucket must already exist before attempting to upload.
   * @param fileBody The body of the file to be stored in the bucket.
   */
-  async uploadOrUpdate(method, path5, fileBody, fileOptions) {
+  async uploadOrUpdate(method, path6, fileBody, fileOptions) {
     var _this = this;
     return _this.handleOperation(async () => {
       let body;
@@ -33986,7 +33986,7 @@ var StorageFileApi = class extends BaseApiClient {
         if ((typeof ReadableStream !== "undefined" && body instanceof ReadableStream || body && typeof body === "object" && "pipe" in body && typeof body.pipe === "function") && !options.duplex) options.duplex = "half";
       }
       if (fileOptions === null || fileOptions === void 0 ? void 0 : fileOptions.headers) for (const [key, value] of Object.entries(fileOptions.headers)) headers = setHeader(headers, key, value);
-      const cleanPath = _this._removeEmptyFolders(path5);
+      const cleanPath = _this._removeEmptyFolders(path6);
       const _path = _this._getFinalPath(cleanPath);
       const data = await (method == "PUT" ? put : post)(_this.fetch, `${_this.url}/object/${_path}`, body, _objectSpread22({ headers }, (options === null || options === void 0 ? void 0 : options.duplex) ? { duplex: options.duplex } : {}));
       return {
@@ -34063,8 +34063,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Upload file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async upload(path5, fileBody, fileOptions) {
-    return this.uploadOrUpdate("POST", path5, fileBody, fileOptions);
+  async upload(path6, fileBody, fileOptions) {
+    return this.uploadOrUpdate("POST", path6, fileBody, fileOptions);
   }
   /**
   * Upload a file with a token generated from `createSignedUploadUrl`.
@@ -34104,9 +34104,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async uploadToSignedUrl(path5, token, fileBody, fileOptions) {
+  async uploadToSignedUrl(path6, token, fileBody, fileOptions) {
     var _this3 = this;
-    const cleanPath = _this3._removeEmptyFolders(path5);
+    const cleanPath = _this3._removeEmptyFolders(path6);
     const _path = _this3._getFinalPath(cleanPath);
     const url2 = new URL(_this3.url + `/object/upload/sign/${_path}`);
     url2.searchParams.set("token", token);
@@ -34175,10 +34175,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `insert`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUploadUrl(path5, options) {
+  async createSignedUploadUrl(path6, options) {
     var _this4 = this;
     return _this4.handleOperation(async () => {
-      let _path = _this4._getFinalPath(path5);
+      let _path = _this4._getFinalPath(path6);
       const headers = _objectSpread22({}, _this4.headers);
       if (options === null || options === void 0 ? void 0 : options.upsert) headers["x-upsert"] = "true";
       const data = await post(_this4.fetch, `${_this4.url}/object/upload/sign/${_path}`, {}, { headers });
@@ -34187,7 +34187,7 @@ var StorageFileApi = class extends BaseApiClient {
       if (!token) throw new StorageError("No token returned by API");
       return {
         signedUrl: url2.toString(),
-        path: path5,
+        path: path6,
         token
       };
     });
@@ -34247,8 +34247,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Update file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async update(path5, fileBody, fileOptions) {
-    return this.uploadOrUpdate("PUT", path5, fileBody, fileOptions);
+  async update(path6, fileBody, fileOptions) {
+    return this.uploadOrUpdate("PUT", path6, fileBody, fileOptions);
   }
   /**
   * Moves an existing file to a new path in the same bucket.
@@ -34399,10 +34399,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUrl(path5, expiresIn, options) {
+  async createSignedUrl(path6, expiresIn, options) {
     var _this8 = this;
     return _this8.handleOperation(async () => {
-      let _path = _this8._getFinalPath(path5);
+      let _path = _this8._getFinalPath(path6);
       const hasTransform = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0;
       let data = await post(_this8.fetch, `${_this8.url}/object/sign/${_path}`, _objectSpread22({ expiresIn }, hasTransform ? { transform: options.transform } : {}), { headers: _this8.headers });
       const query = new URLSearchParams();
@@ -34538,13 +34538,13 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  download(path5, options, parameters) {
+  download(path6, options, parameters) {
     const renderPath = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0 ? "render/image/authenticated" : "object";
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
     if ((options === null || options === void 0 ? void 0 : options.cacheNonce) != null) query.set("cacheNonce", String(options.cacheNonce));
     const queryString = query.toString();
-    const _path = this._getFinalPath(path5);
+    const _path = this._getFinalPath(path6);
     const downloadFn = () => get(this.fetch, `${this.url}/${renderPath}/${_path}${queryString ? `?${queryString}` : ""}`, {
       headers: this.headers,
       noResolveJson: true
@@ -34575,9 +34575,9 @@ var StorageFileApi = class extends BaseApiClient {
   * }
   * ```
   */
-  async info(path5) {
+  async info(path6) {
     var _this10 = this;
-    const _path = _this10._getFinalPath(path5);
+    const _path = _this10._getFinalPath(path6);
     return _this10.handleOperation(async () => {
       return recursiveToCamel(await get(_this10.fetch, `${_this10.url}/object/info/${_path}`, { headers: _this10.headers }));
     });
@@ -34598,9 +34598,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   .exists('folder/avatar1.png')
   * ```
   */
-  async exists(path5) {
+  async exists(path6) {
     var _this11 = this;
-    const _path = _this11._getFinalPath(path5);
+    const _path = _this11._getFinalPath(path6);
     try {
       await head(_this11.fetch, `${_this11.url}/object/${_path}`, { headers: _this11.headers });
       return {
@@ -34679,8 +34679,8 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  getPublicUrl(path5, options) {
-    const _path = this._getFinalPath(path5);
+  getPublicUrl(path6, options) {
+    const _path = this._getFinalPath(path6);
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.download) query.set("download", options.download === true ? "" : options.download);
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
@@ -34819,10 +34819,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async list(path5, options, parameters) {
+  async list(path6, options, parameters) {
     var _this13 = this;
     return _this13.handleOperation(async () => {
-      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path5 || "" });
+      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path6 || "" });
       return await post(_this13.fetch, `${_this13.url}/object/list/${_this13.bucketId}`, body, { headers: _this13.headers }, parameters);
     });
   }
@@ -34887,11 +34887,11 @@ var StorageFileApi = class extends BaseApiClient {
     if (typeof Buffer !== "undefined") return Buffer.from(data).toString("base64");
     return btoa(data);
   }
-  _getFinalPath(path5) {
-    return `${this.bucketId}/${path5.replace(/^\/+/, "")}`;
+  _getFinalPath(path6) {
+    return `${this.bucketId}/${path6.replace(/^\/+/, "")}`;
   }
-  _removeEmptyFolders(path5) {
-    return path5.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
+  _removeEmptyFolders(path6) {
+    return path6.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
   }
   /** Modifies the `query`, appending values the from `transform` */
   applyTransformOptsToQuery(query, transform2) {
@@ -42664,7 +42664,14 @@ var softwareCapacityObservationSummarySchema = external_exports.object({
   account_alias: external_exports.string().nullable()
 });
 var softwareRequestCreateInputSchema = external_exports.object({
-  software_project_id: uuid10,
+  // DER-1310: the project the request opens against. Either identifier works —
+  // the raw id (still fully supported) or `project`, the project's slug or name,
+  // resolved server-side to the tenant's active project. The command layer (not
+  // this schema) enforces that exactly one resolves, with an actionable error
+  // when neither is given or neither matches — keeping this shape a plain
+  // `z.object` so JSON-schema/CLI-flag projection stays simple (no `.refine`).
+  software_project_id: uuid10.optional(),
+  project: external_exports.string().trim().min(1).max(200).optional(),
   // Untrusted display text (ADR-0018 §5) — bounded, never treated as an instruction.
   title: external_exports.string().trim().min(1).max(500),
   source_channel: softwareSourceChannelSchema.optional(),
@@ -43312,6 +43319,82 @@ var softwareGithubIssueIntakeMetadataSchema = external_exports.object({
   labels: external_exports.array(external_exports.string().trim().min(1).max(80)).max(50).default([]),
   requested_automation_mode: softwareAutomationModeSchema.optional()
 }).strict();
+var softwareVercelDeploymentStatusSchema = external_exports.enum(["queued", "initializing", "building", "ready", "error", "canceled", "unknown"]);
+var softwareVercelConnectionConnectInputSchema = external_exports.object({
+  account_id: external_exports.string().trim().min(1).max(200),
+  account_name: external_exports.string().trim().min(1).max(255).nullable().optional(),
+  team_id: external_exports.string().trim().min(1).max(200).nullable().optional(),
+  team_slug: external_exports.string().trim().min(1).max(255).nullable().optional(),
+  user_id: external_exports.string().trim().min(1).max(200).nullable().optional(),
+  configuration_id: external_exports.string().trim().min(1).max(200).nullable().optional(),
+  access_token_vault_ref: external_exports.string().trim().min(12).max(700),
+  scopes: external_exports.array(external_exports.string().trim().min(1).max(120)).max(40).default([])
+}).strict();
+var softwareVercelConnectionConnectOutputSchema = external_exports.object({
+  vercel_connection_id: uuid10,
+  account_id: external_exports.string(),
+  team_id: external_exports.string().nullable()
+});
+var softwareVercelProjectLinkInputSchema = external_exports.object({
+  software_project_id: uuid10,
+  vercel_connection_id: uuid10,
+  vercel_project_id: external_exports.string().trim().min(1).max(200),
+  vercel_project_name: external_exports.string().trim().min(1).max(255),
+  framework: external_exports.string().trim().min(1).max(120).nullable().optional(),
+  root_directory: external_exports.string().trim().min(1).max(500).nullable().optional(),
+  production_branch: external_exports.string().trim().min(1).max(255).nullable().optional(),
+  git_repository: external_exports.record(external_exports.string().min(1), external_exports.unknown()).default({})
+}).strict();
+var softwareVercelProjectLinkOutputSchema = external_exports.object({
+  vercel_project_link_id: uuid10,
+  software_project_id: uuid10,
+  vercel_project_id: external_exports.string()
+});
+var softwareVercelConnectionViewSchema = external_exports.object({
+  id: uuid10,
+  account_id: external_exports.string(),
+  account_name: external_exports.string().nullable(),
+  team_id: external_exports.string().nullable(),
+  team_slug: external_exports.string().nullable(),
+  user_id: external_exports.string().nullable(),
+  configuration_id: external_exports.string().nullable(),
+  status: external_exports.enum(["active", "revoked"]),
+  connected_at: external_exports.string()
+});
+var softwareVercelProjectLinkViewSchema = external_exports.object({
+  id: uuid10,
+  software_project_id: uuid10,
+  software_project_name: external_exports.string(),
+  software_project_slug: external_exports.string(),
+  vercel_connection_id: uuid10,
+  vercel_project_id: external_exports.string(),
+  vercel_project_name: external_exports.string(),
+  framework: external_exports.string().nullable(),
+  root_directory: external_exports.string().nullable(),
+  production_branch: external_exports.string().nullable(),
+  status: external_exports.enum(["active", "revoked"])
+});
+var softwareVercelProjectListInputSchema = external_exports.object({}).strict();
+var softwareVercelProjectListOutputSchema = external_exports.object({
+  connections: external_exports.array(softwareVercelConnectionViewSchema),
+  project_links: external_exports.array(softwareVercelProjectLinkViewSchema)
+});
+var softwareVercelDeployPreviewInputSchema = external_exports.object({
+  software_project_id: uuid10,
+  commit_sha: external_exports.string().trim().regex(/^[A-Fa-f0-9]{7,64}$/),
+  git_ref: external_exports.string().trim().min(1).max(255),
+  build_request_id: uuid10.optional(),
+  phase_run_id: uuid10.optional(),
+  seat_id: uuid10.optional(),
+  required_secret_keys: external_exports.array(external_exports.string().trim().min(1).max(200)).max(25).default([])
+}).strict();
+var softwareVercelDeployPreviewOutputSchema = external_exports.object({
+  vercel_deployment_record_id: uuid10,
+  deployment_id: external_exports.string(),
+  deployment_url: external_exports.string().nullable(),
+  commit_sha: external_exports.string(),
+  status: softwareVercelDeploymentStatusSchema
+});
 
 // ../../packages/protocol/src/sync-brief.ts
 var uuidSchema14 = external_exports.string().uuid();
@@ -44556,7 +44639,7 @@ No orphan agents. No raw secrets in prompts, logs, or tool arguments. No durable
     order: 41,
     title: "Add agents to your Responsibility Graph",
     summary: "The visual journey for adding an agent seat: where to start, choosing a mode, placing the seat, naming a Steward, setup, the safety gates, and go-live.",
-    version: "2026-07-04.1",
+    version: "2026-07-04.2",
     public: true,
     audiences: ["human", "in_app_agent"],
     stages: ["staffing"],
@@ -44578,7 +44661,7 @@ A seat is a function, not a person. Adding an agent means staffing a seat with a
 You can open agent creation from three places:
 
 - **Responsibility Graph.** Hover or focus a seat node and use its **Add agent** action to add an agent seat under that seat. The graph toolbar's **Add agent** action adds an agent and then asks where it should report. On an empty or small graph, **Add first agent** starts the same flow with the founder or owner seat as the default Steward.
-- **Left sidebar.** The **Agents** item in the Define section opens the agents surface. **Add agent** at the top of that surface is the primary action.
+- **Left sidebar.** The **Agents** item opens the agents surface. **Add agent** at the top of that surface is the primary action.
 - **Agents surface.** The unified agents page has **Templates**, **Custom**, and **Existing** modes. A template's **Use template** action enters the same wizard with that template selected.
 
 Starting from a selected graph seat carries the parent seat and a default Steward candidate into the wizard so you do not re-pick them.
@@ -45049,7 +45132,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-04.19",
+    version: "2026-07-05.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -45497,7 +45580,7 @@ These ergonomic wrappers (including the \`{{cli}} agent\` group) require **{{cli
 
 **Generated verbs (0.6.0+).** Every registry command now has a first-class \`{{cli}} <namespace> <action>\` verb, projected directly from the command's input schema \u2014 so namespaces that previously had no ergonomic wrapper (for example \`{{cli}} measurable create\`, \`{{cli}} work_order enqueue\`, \`{{cli}} mcp_token create\`) are usable without dropping to the raw \`command <id>\` path. Flags follow the schema field names (\`--seat-id\`, \`--name\`, \u2026); read a command's exact input offline with \`{{cli}} <namespace> <action> --schema\` before calling it, and pass a nested payload with \`--input '<json>'\` when a field is a complex object. \`--json\` still selects machine output, \`--seat <id>\` still sets seat scope, and \`{{cli}} command <id> --json '<body>'\` remains the universal fallback.
 
-The signed-in app exposes the same Skill command surface under **Skills** in the left sidebar. Use \`/skills\` to filter the tenant library, \`/skills/new\` to build canonical \`SKILL.md\` frontmatter with \`tool.catalog\` dependencies, \`/skills/import\` for bounded GitHub or upload imports, and each Skill detail page to review validation, publish, check Seat dependencies, and assign a published version. During \`/agents/new\`, \`agent_setup.get\` can return \`next_action: "choose_skills"\`; selected Skills are proposed immutable-version assignments and required Skill tools block sign-off/go-live until tool configuration is ready.
+The signed-in app exposes the same Skill command surface at **Skills**, linked from the Agents page (the nav collapse moved it out of the primary sidebar). Use \`/skills\` to filter the tenant library, \`/skills/new\` to build canonical \`SKILL.md\` frontmatter with \`tool.catalog\` dependencies, \`/skills/import\` for bounded GitHub or upload imports, and each Skill detail page to review validation, publish, check Seat dependencies, and assign a published version. During \`/agents/new\`, \`agent_setup.get\` can return \`next_action: "choose_skills"\`; selected Skills are proposed immutable-version assignments and required Skill tools block sign-off/go-live until tool configuration is ready.
 
 | Command | Command ids | Purpose | Scope | Safe example |
 |---|---|---|---|---|
@@ -45528,7 +45611,7 @@ The signed-in app exposes the same Skill command surface under **Skills** in the
 | \`{{cli}} deliverable list|get|create|attach\` | \`deliverable.list\`, \`deliverable.get\`, \`deliverable.create\`, \`deliverable.attach\` | List, get, create, or attach agent deliverables for a seat. Deliverables are durable work outputs visible across UI, CLI, and MCP. | Tenant (list/get), Seat (create/attach) | \`{{cli}} deliverable list --seat-id <id> --json\`; \`{{cli}} deliverable create --title "Brief" --kind brief\` |
 | \`{{cli}} graph show\` | \`graph.get\` | Print a table view of the Responsibility Graph with explicit \`seat_id\` and \`parent_seat_id\` columns. | Tenant | \`{{cli}} graph show\` |
 | \`{{cli}} seat list|get|create|rename|reparent|decommission\` | \`graph.get\`, \`seat.get\`, \`seat.create\`, \`seat.rename\`, \`seat.reparent\`, \`seat.decommission\`, \`seat.decommission_preview\` | Work with seats as first-class CLI primitives. \`seat decommission --dry-run\` previews affected occupancies, agents, Charters, tokens, credentials, work orders, and schedules before the human-gated teardown. | Tenant / Seat for targeted mutations | \`{{cli}} seat list\`; \`{{cli}} seat decommission --seat-id <id> --dry-run\` |
-| \`{{cli}} forge project-create|project-list|request-create|request-list|request-show|request-pause|request-cancel|request-resume\` | \`software_factory.project.create\`, \`software_factory.project.list\`, \`software_factory.request.create\`, \`software_factory.request.list\`, \`software_factory.request.show\`, \`software_factory.request.pause\`, \`software_factory.request.cancel\`, \`software_factory.request.resume\` | Create/list Forge projects, open/read governed Forge build requests, and control request lifecycle. Project creation plus pause/cancel/resume are tenant-admin, entitlement-gated, and human-gated; reads and request creation require the Forge add-on. Pause halts new runner claims at the next task checkpoint, cancel drives terminal canceled, and resume requeues from the last completed task checkpoint. | Tenant / Tenant-admin for create and lifecycle controls | \`{{cli}} forge project-create --name "Leiluna app" --base-branch main\`; \`{{cli}} forge request-create --software-project-id <id> --title "Add invoice export"\`; \`{{cli}} forge request-pause --build-request-id <id> --reason "Operator hold"\` |
+| \`{{cli}} forge project-create|project-list|request-create|request-list|request-show|request-pause|request-cancel|request-resume\` | \`software_factory.project.create\`, \`software_factory.project.list\`, \`software_factory.request.create\`, \`software_factory.request.list\`, \`software_factory.request.show\`, \`software_factory.request.pause\`, \`software_factory.request.cancel\`, \`software_factory.request.resume\` | Create/list Forge projects, open/read governed Forge build requests, and control request lifecycle. Project creation plus pause/cancel/resume are tenant-admin, entitlement-gated, and human-gated; reads and request creation require the Forge add-on. Pause halts new runner claims at the next task checkpoint, cancel drives terminal canceled, and resume requeues from the last completed task checkpoint. | Tenant / Tenant-admin for create and lifecycle controls | \`{{cli}} forge project-create --name "Leiluna app" --base-branch main\`; \`{{cli}} forge request-create --project <slug-or-name> --title "Add invoice export"\` (accepts \`--software-project-id <id>\` instead of \`--project\` too); \`{{cli}} forge request-pause --build-request-id <id> --reason "Operator hold"\` |
 
 Skills wrapper help:
 
@@ -45769,7 +45852,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_revoke_skill_from_seat\` | \`skill.revoke_from_seat\` | Human-gated revocation that stops future Skill use without deleting historical activations. | Tenant-admin | Call with \`{"assignment_id":"<assignment-id>"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_list_model_catalog\` | \`model.catalog\` | List guided model tiers \u2014 recommendations, token prices, cost bands, best-fit work, and model ids for \`--model\`. | Tenant | Call with \`{}\`. |
 | \`rost_create_a_forge_project\` | \`software_factory.project.create\` | Create an active Forge software project before binding repositories or opening build requests. Tenant-admin, human-gated, and entitlement-gated. | Tenant-admin | Call with \`{"name":"Leiluna app","slug":"leiluna-app","base_branch":"main"}\`; non-interactive callers receive a confirmation handoff. |
-| \`rost_create_a_forge_build_request\` | \`software_factory.request.create\` | Open a governed Forge build request against a connected software project; records the request plus its initial intake phase run. Requires the Forge add-on; the title is untrusted display text. | Tenant | Call with \`{"software_project_id":"<project-id>","title":"Add invoice export"}\`. |
+| \`rost_create_a_forge_build_request\` | \`software_factory.request.create\` | Open a governed Forge build request against a connected software project; records the request plus its initial intake phase run. Requires the Forge add-on; the title is untrusted display text. | Tenant | Call with \`{"project":"<slug-or-name>","title":"Add invoice export"}\` (or \`{"software_project_id":"<project-id>", ...}\`). |
 | \`rost_pause_a_forge_build_request\` | \`software_factory.request.pause\` | Pause an in-flight Forge build request. New runner claims stop immediately; running work halts at the next task checkpoint. Human-gated. | Tenant-admin | Call with \`{"build_request_id":"<request-id>","reason":"Operator hold"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_cancel_a_forge_build_request\` | \`software_factory.request.cancel\` | Cancel a Forge build request and expire active runner work orders. This is terminal; use pause for reversible holds. Human-gated. | Tenant-admin | Call with \`{"build_request_id":"<request-id>","reason":"Out of scope"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_resume_a_forge_build_request\` | \`software_factory.request.resume\` | Resume a paused or human-blocked Forge build request from the last completed task checkpoint and requeue the current phase. Human-gated. | Tenant-admin | Call with \`{"build_request_id":"<request-id>","reason":"Budget raised"}\`; non-interactive callers receive a confirmation handoff. |
@@ -45795,6 +45878,8 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_set_a_forge_github_automation_policy\` | \`software_factory.github.policy.upsert\` | Set the server-side GitHub automation policy: allowed actions, automation-mode ceiling, and operations requiring humans. The allowed-actions and human-gated-actions lists are stored server-side as structured JSON arrays. Owner-only and human-gated. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","automation_mode_ceiling":"pr_only","allowed_actions":["webhook_intake","installation_token"],"requires_human_for":["deploy_production"]}\`. |
 | \`rost_create_a_forge_github_installation_token\` | \`software_factory.github.installation_token.create\` | Mint a short-lived GitHub App installation token for one bound repository after policy evaluation. The token is returned once and never stored. | Tenant | Call with \`{"software_project_id":"<project-id>","repository_id":789,"requested_actions":["read"],"requested_automation_mode":"plan_only"}\`. |
 | \`rost_list_forge_github_installations\` | \`software_factory.github.installation.list\` | List connected GitHub App installations and each repository's bind state (connected or active) with the Forge project it maps to. Read-only. | Tenant | Call with \`{}\`; a \`connected\` repository is verified but not yet bound to a project. |
+| \`rost_list_forge_vercel_links\` | \`software_factory.vercel.project.list\` | List connected Vercel accounts/teams and linked existing Vercel projects. Read-only; no OAuth tokens or vault refs are returned. | Tenant | Call with \`{}\`; tenant admins connect/link from \`/forge/settings/vercel\`. |
+| \`rost_create_a_forge_vercel_preview_deployment\` | \`software_factory.vercel.deploy_preview\` | Create a Vercel preview deployment for a linked project after Forge deploy-preview authority, the Vercel OAuth vault-ref connection, and required preview secret/config grants are verified. | Tenant | Call with \`{"software_project_id":"<project-id>","commit_sha":"<sha>","git_ref":"feature/example","seat_id":"<seat-id>"}\`; returns deployment metadata, not tokens. |
 | \`rost_list_forge_runner_capacity\` | \`software_factory.capacity.list\` | List Forge runner capacity observations (advisory scheduling input only, never an authority input). Read-only; requires the Forge add-on. | Tenant | Call with \`{}\` or \`{"runner_id":"<runner-id>"}\`. |
 
 The web Forge control room at \`/forge\` uses the same command path for project selection, build request creation/list/detail reads, request pause/cancel/resume controls, runner capacity, configuration status, and Developer Team install. A request detail page shows phase history, open gates, plan progress, loop/time/cost ceilings, and latest plan-review questions from \`software_factory.request.show\`; answering a clarification, approving a plan, rejecting it, pausing, canceling, or resuming calls the same Forge commands exposed over CLI/MCP. Lifecycle controls deliberately stage pending confirmations before changing runner state. The install button also stages a pending confirmation before durable seats, Skills, authority grants, or live agent activation are applied; the install page states plainly that approving activates the 6 agents at a pull-request-only, observe-first posture and surfaces the company autonomy ceiling.
@@ -45809,6 +45894,12 @@ Tenant GitHub App connect and bind are intentionally not CLI or MCP mutation too
 
 The Forge GitHub App itself is org-owned. App private key, webhook secret, and client secret values are platform-owned ROST operator credentials stored through the vault's reserved ROST system namespace, not through a customer tenant namespace or a tenant UUID deployment variable. Manifest conversion and manual secret storage also require the app-level \`GITHUB_APP_OPERATOR_EMAILS\` allowlist, which should contain only approved ROST platform operator emails. Deployment config carries only refs (\`GITHUB_APP_PRIVATE_KEY_REF\`, \`GITHUB_APP_WEBHOOK_SECRET_REF\`, \`GITHUB_APP_CLIENT_SECRET_REF\`); raw secret env vars are local/legacy compatibility only. The dogfood app is \`ROST Forge\` under \`agenticoperatingsystem\` with App ID \`4208495\` and Client ID \`Iv23liImH7qlBvXYQ0Wx\`. The base app omits \`administration\` and \`workflows\`; elevated repo creation or workflow mutation needs a separate human-approved power path.
 
+#### Forge Vercel access
+
+Forge Vercel access is through a tenant-bound OAuth connection, never a browser-visible token. Tenant admins start at \`/forge/settings/vercel\`; the callback exchanges the short-lived Vercel code server-side, stores the access token in the vault, and records only account/team metadata plus the vault-ref pointer via \`software_factory.vercel.connection.connect\`. Existing Vercel projects are linked through \`software_factory.vercel.project.link\`; greenfield project creation is intentionally absent from this slice and requires a future explicit authority flag.
+
+Preview deployment creation is a governed command. \`software_factory.vercel.deploy_preview\` requires an active Vercel project link, a Vercel OAuth vault-ref connection, active \`deploy_preview\` Forge authority for the requesting seat when a seat is supplied, and any requested preview secret/config grants. It writes the deployment id, URL, commit SHA, checks, status, and error metadata into \`software_vercel_deployments\`; build-request deployments also write a Forge artifact and event. Raw OAuth tokens and vault refs are never returned.
+
 ### Seat-scoped operating tools
 
 Seat-scoped MCP tokens expose the operating protocol below. The server still checks the seat's permission manifest, Charter, task ownership, and tenant boundary. These are the **seat-token equivalents** of the CLI \`{{cli}} task\` / \`{{cli}} signal\` / \`{{cli}} friction\` wrappers and the tenant-admin task tools above: \`rost_get_tasks\`, \`{{cli}} task list\`, and \`task.list\` are the same operation reached three different ways. The command-id column makes the mapping explicit.
@@ -46813,7 +46904,7 @@ Do not claim that a live charge happened unless Stripe test/live evidence proves
     order: 72,
     title: "Settings guide",
     summary: "How to use Settings as the control plane for company access, channels, providers, tokens, and operating defaults.",
-    version: "2026-07-04.2",
+    version: "2026-07-04.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -46836,9 +46927,9 @@ Start with members and invites, then provider and channel connections, then MCP
 
 ## Navigating Settings
 
-Settings is a left-rail master\u2013detail layout: a grouped rail (General, Team & Access, Billing, AI & Agents, Connections) selects one section at a time, shown in the detail pane. The active section is a URL search param, so \`/settings?section=<id>\` is linkable and survives a refresh. The Connections section is the workspace-level provider surface: Google, Slack, QuickBooks, local runners, seat-scoped agent tokens, and stored secrets appear as provider cards with status, used-for chips, actions, and the shared Access language (**Off / Read / Draft / Act with approval**). Detailed management forms for tokens, channels, runners, provider links, and stored vault entries remain reachable from those cards.
+Settings is reached from the footer gear in the left sidebar (the nav collapse moved it out of the primary item list). It is a left-rail master\u2013detail layout: a grouped rail (General, Team & Access, Billing, AI & Agents, Connections, Advanced) selects one section at a time, shown in the detail pane. The active section is a URL search param, so \`/settings?section=<id>\` is linkable and survives a refresh. The Connections section is the workspace-level provider surface: Google, Slack, QuickBooks, local runners, seat-scoped agent tokens, and stored secrets appear as provider cards with status, used-for chips, actions, and the shared Access language (**Off / Read / Draft / Act with approval**). Detailed management forms for tokens, channels, runners, provider links, and stored vault entries remain reachable from those cards.
 
-Legacy hash deep-links still resolve \u2014 \`/settings#integrations\`, \`#channels\`, and \`#vault\` redirect to \`?section=connections\`; other hashes such as \`#members\` and \`#guardrails\` redirect to their matching section. \`#runners\` is the one exception: it keeps resolving to the dedicated Connected machines management table (not the Connections overview), since System Health and seat pages deep-link there expecting the per-runner revoke actions. Documented shortcut links resolve to the right section instead of a dead end: \`/settings/integrations\` and \`/readiness\` open the Connections section (connector readiness lives inside it, not on a standalone page), and \`/settings/policy\` opens the Product learning section. After you save a change, the app keeps you on the section you edited rather than returning to the top.
+Legacy hash deep-links still resolve \u2014 \`/settings#integrations\`, \`#channels\`, and \`#vault\` redirect to \`?section=connections\`; other hashes such as \`#members\` and \`#guardrails\` redirect to their matching section. \`#runners\` is the one exception: it keeps resolving to the dedicated Connected machines management table (not the Connections overview), since System Health and seat pages deep-link there expecting the per-runner revoke actions. Documented shortcut links resolve to the right section instead of a dead end: \`/settings/integrations\` and \`/readiness\` open the Connections section (connector readiness lives inside it, not on a standalone page), \`/settings/policy\` opens the Product learning section, and MCP/CLI access tokens live in the Agent access tokens section (not a separate \`/mcp\` page \u2014 \`/mcp\` is the MCP protocol endpoint itself, not a browsable settings screen). The Advanced group links out to \`/migration/ninety\`, the one settings-adjacent page with no home in the grouped rail. After you save a change, the app keeps you on the section you edited rather than returning to the top.
 
 ## What belongs in Settings
 
@@ -47092,7 +47183,7 @@ The runner should not store raw credentials in local notes, prompts, or logs. It
     order: 76,
     title: "Stock agents guide",
     summary: "How to use stock agent templates as starting points while preserving seat-specific Charters and human approval.",
-    version: "2026-07-01.1",
+    version: "2026-07-04.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -47111,7 +47202,7 @@ Stock agents are templates, not finished employees. Use them to accelerate setup
 
 ## Where to create agents
 
-Add agents from the unified agents surface. In the app, open it from the **Agents** item in the left sidebar's Define section, or from an **Add agent** action on the Responsibility Graph. The first screen asks for a creation mode \u2014 use a template, design a custom agent, or connect an existing agent \u2014 then walks the same conservative path for every mode: seat placement, Steward, draft Charter, manifest sign-off, sandbox dry run, and human go-live. Each step is command-backed, so the same workflow runs from the app, the CLI, and MCP.
+Add agents from the unified agents surface. In the app, open it from the **Agents** item in the left sidebar, or from an **Add agent** action on the Responsibility Graph. The first screen asks for a creation mode \u2014 use a template, design a custom agent, or connect an existing agent \u2014 then walks the same conservative path for every mode: seat placement, Steward, draft Charter, manifest sign-off, sandbox dry run, and human go-live. Each step is command-backed, so the same workflow runs from the app, the CLI, and MCP.
 
 ## Template review
 
@@ -49005,7 +49096,7 @@ var COMMAND_MANIFEST = [
   { "id": "software_factory.project.list", "namespace": "software_factory", "action": "project.list", "title": "List Forge projects", "description": "List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. Read-only and entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. Read-only; requires the Forge add-on." },
   { "id": "software_factory.request.answer_clarification", "namespace": "software_factory", "action": "request.answer_clarification", "title": "Answer Forge plan clarifications", "description": "Write structured human answers to a draft plan's clarifying questions and optionally mark it ready for plan review. Answers append to the versioned planning artifact; this never widens authority or automation mode.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "mark_ready_for_plan_review", "flag": "mark-ready-for-plan-review", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Write structured human answers to a draft plan's clarifying questions and optionally mark it ready for plan review. Never widens authority or automation mode." },
   { "id": "software_factory.request.cancel", "namespace": "software_factory", "action": "request.cancel", "title": "Cancel a Forge build request", "description": "Cancel a Forge build request and expire active runner work orders. This is terminal; use pause for reversible holds. Human-gated and entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Cancel a Forge build request, expire unstarted runner work, and terminalize active runner work. Terminal, tenant-admin, and human-gated." },
-  { "id": "software_factory.request.create", "namespace": "software_factory", "action": "request.create", "title": "Create a Forge build request", "description": "Open a governed Forge build request against a connected software project. Records the request plus its initial intake phase run. Entitlement-gated (Forge add-on); the title is untrusted display text, never an instruction.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "source_channel", "flag": "source-channel", "type": "enum", "required": false, "enumValues": ["ui", "cli", "github_issue", "linear", "api"] }, { "name": "source_ref", "flag": "source-ref", "type": "string", "required": false }], "hasComplexInput": true, "help": "Open a governed Forge build request against a connected software project; the title is untrusted display text. Requires the Forge add-on." },
+  { "id": "software_factory.request.create", "namespace": "software_factory", "action": "request.create", "title": "Create a Forge build request", "description": "Open a governed Forge build request against a connected software project. Records the request plus its initial intake phase run. Entitlement-gated (Forge add-on); the title is untrusted display text, never an instruction.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "project", "flag": "project", "type": "string", "required": false }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "source_channel", "flag": "source-channel", "type": "enum", "required": false, "enumValues": ["ui", "cli", "github_issue", "linear", "api"] }, { "name": "source_ref", "flag": "source-ref", "type": "string", "required": false }], "hasComplexInput": true, "help": "Open a governed Forge build request against a connected software project; the title is untrusted display text. Requires the Forge add-on." },
   { "id": "software_factory.request.list", "namespace": "software_factory", "action": "request.list", "title": "List Forge build requests", "description": "The Forge control-room board: the tenant's build requests with status, current phase, and risk/automation mode. Read-only, entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List Forge build requests (the control-room board) with status, current phase, and risk. Read-only; requires the Forge add-on." },
   { "id": "software_factory.request.pause", "namespace": "software_factory", "action": "request.pause", "title": "Pause a Forge build request", "description": "Pause an in-flight Forge build request. New runner claims stop immediately; any running task halts at the next task checkpoint before resume. Human-gated and entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Pause an in-flight Forge build request so no new runner work starts; running work stops at the next task checkpoint. Tenant-admin and human-gated." },
   { "id": "software_factory.request.resume", "namespace": "software_factory", "action": "request.resume", "title": "Resume a Forge build request", "description": "Resume a paused or human-blocked Forge build request from the last completed task checkpoint and requeue the current phase. Human-gated and entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": true, "help": "Resume a paused or blocked Forge build request from its last completed task checkpoint after human review. Tenant-admin and human-gated." },
@@ -49015,6 +49106,10 @@ var COMMAND_MANIFEST = [
   { "id": "software_factory.secret.request", "namespace": "software_factory", "action": "secret.request", "title": "Request a Forge secret grant", "description": "An agent or user REQUESTS access to a project secret by key (draft-and-confirm \u2014 no value, no grant). Records the ask as a durable event for a human to grant. Never accepts a secret value (invariant #5). Entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "environment", "flag": "environment", "type": "enum", "required": true, "enumValues": ["development", "preview", "production"] }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "action", "flag": "action", "type": "string", "required": true }, { "name": "key_name", "flag": "key-name", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Request access to a project secret by key; persists the request and creates a human approval task. Never accepts a secret value." },
   { "id": "software_factory.secret.revoke", "namespace": "software_factory", "action": "secret.revoke", "title": "Revoke a Forge secret grant", "description": "Revoke a Forge secret grant (teardown \u2014 a compromised seat's access can be cut immediately, ADR-0018 \xA76). Owner-only, human-gated. Entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "grant_id", "flag": "grant-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Revoke a Forge secret grant (teardown \u2014 cut a compromised seat's access immediately). Owner-only and human-gated." },
   { "id": "software_factory.secret.use", "namespace": "software_factory", "action": "secret.use", "title": "Verify Forge secret broker access", "description": "Verify a scoped secret broker grant without returning or opening the raw value. Runtime vault access happens only in the runner-side broker helper; this command writes a redacted authorization log and creates a request task for missing grants.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "environment", "flag": "environment", "type": "enum", "required": true, "enumValues": ["development", "preview", "production"] }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "action", "flag": "action", "type": "string", "required": true }, { "name": "key_name", "flag": "key-name", "type": "string", "required": true }, { "name": "operation", "flag": "operation", "type": "enum", "required": false, "enumValues": ["use", "vercel_env_sync", "test_execution"] }], "hasComplexInput": false, "help": "Verify scoped broker access without returning or opening the raw value; missing grants create or reuse a request task and all attempts write redacted access logs." },
+  { "id": "software_factory.vercel.connection.connect", "namespace": "software_factory", "action": "vercel.connection.connect", "title": "Connect a Forge Vercel account", "description": "Record a Vercel OAuth account/team connection. The access token is stored only as a vault ref; this command persists bounded account metadata. Owner-only and human-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "account_id", "flag": "account-id", "type": "string", "required": true }, { "name": "account_name", "flag": "account-name", "type": "string", "required": false }, { "name": "team_id", "flag": "team-id", "type": "string", "required": false }, { "name": "team_slug", "flag": "team-slug", "type": "string", "required": false }, { "name": "user_id", "flag": "user-id", "type": "string", "required": false }, { "name": "configuration_id", "flag": "configuration-id", "type": "string", "required": false }, { "name": "access_token_vault_ref", "flag": "access-token-vault-ref", "type": "string", "required": true }, { "name": "scopes", "flag": "scopes", "type": "array", "required": false, "itemType": "string" }], "hasComplexInput": false, "help": "Record a Vercel OAuth account/team connection from the Forge Vercel settings flow. Stores only a vault-ref pointer to the token. Owner-only and human-gated." },
+  { "id": "software_factory.vercel.deploy_preview", "namespace": "software_factory", "action": "vercel.deploy_preview", "title": "Create a Forge Vercel preview deployment", "description": "Create a Vercel preview deployment for a linked existing project after Forge authority, Vercel connection, and required secret/config grants are verified. Records deployment metadata as artifacts and audit rows.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "commit_sha", "flag": "commit-sha", "type": "string", "required": true }, { "name": "git_ref", "flag": "git-ref", "type": "string", "required": true }, { "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": false }, { "name": "phase_run_id", "flag": "phase-run-id", "type": "string", "required": false }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "required_secret_keys", "flag": "required-secret-keys", "type": "array", "required": false, "itemType": "string" }], "hasComplexInput": false, "help": "Create a Vercel preview deployment for a linked project after Forge authority, Vercel connection, and required secret/config grants are verified." },
+  { "id": "software_factory.vercel.project.link", "namespace": "software_factory", "action": "vercel.project.link", "title": "Link a Forge project to Vercel", "description": "Link a Forge project to an existing Vercel project. Greenfield Vercel project creation is intentionally out of scope and remains behind a future authority flag.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "vercel_connection_id", "flag": "vercel-connection-id", "type": "string", "required": true }, { "name": "vercel_project_id", "flag": "vercel-project-id", "type": "string", "required": true }, { "name": "vercel_project_name", "flag": "vercel-project-name", "type": "string", "required": true }, { "name": "framework", "flag": "framework", "type": "string", "required": false }, { "name": "root_directory", "flag": "root-directory", "type": "string", "required": false }, { "name": "production_branch", "flag": "production-branch", "type": "string", "required": false }], "hasComplexInput": true, "help": "Link an existing Vercel project to a Forge software project. Owner-only and human-gated; greenfield project creation remains a future explicit authority." },
+  { "id": "software_factory.vercel.project.list", "namespace": "software_factory", "action": "vercel.project.list", "title": "List Forge Vercel links", "description": "List Vercel account/team connections and existing Vercel project links for this tenant. Read-only; token vault refs are never returned.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List Vercel account/team connections and linked Vercel projects. Read-only; no OAuth tokens or vault refs are returned." },
   { "id": "staffing.assign", "namespace": "staffing", "action": "assign", "title": "Staff seat", "description": "Compatibility command for the DER-626 MCP staffing tool.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": true, "help": "Staff a seat only after the function, Charter, and human accountability are clear." },
   { "id": "staffing.assign_agent_dry_run", "namespace": "staffing", "action": "assign_agent_dry_run", "title": "Assign dry-run agent to seat", "description": "Assign an agent occupancy while the agent remains in dry-run.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "agent_id", "flag": "agent-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Start agent staffing with dry runs and a named human Steward." },
   { "id": "staffing.assign_user", "namespace": "staffing", "action": "assign_user", "title": "Assign user to seat", "description": "Assign a human user occupancy to a seat.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "user_id", "flag": "user-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Assign humans to seats after the seat accountability is clear." },
@@ -49231,9 +49326,9 @@ function coerceScalar(field3, raw) {
   }
 }
 function rawValueForField(entry, field3, parsed, aliasFlags) {
-  const canonical = parsed.values.get(field3.flag);
-  if (canonical !== void 0) {
-    return canonical;
+  const canonical2 = parsed.values.get(field3.flag);
+  if (canonical2 !== void 0) {
+    return canonical2;
   }
   for (const [aliasFlag, targetField] of aliasFlags) {
     if (targetField === field3.name) {
@@ -51567,11 +51662,247 @@ function parseSemver2(value) {
 // src/runner-serve.ts
 import { execFile as execFileCallback3, spawn } from "node:child_process";
 import { createHash } from "node:crypto";
-import { chmod, mkdir as mkdir2, readFile as readFile4, rename, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
-import { cpus, hostname as hostname3, platform, totalmem, tmpdir } from "node:os";
-import path3 from "node:path";
+import { chmod, mkdir as mkdir2, readFile as readFile4, rename, rm as rm3, writeFile as writeFile2 } from "node:fs/promises";
+import { cpus, homedir as homedir2, hostname as hostname3, platform, totalmem, tmpdir } from "node:os";
+import path4 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 import { promisify as promisify3 } from "node:util";
+
+// src/runner-sandbox.ts
+import { existsSync as existsSync2, realpathSync } from "node:fs";
+import { readdir, rm as rm2, stat as stat2 } from "node:fs/promises";
+import path3 from "node:path";
+var SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
+var RUNNER_TEMP_PREFIXES = [
+  "rost-runner-mcp-",
+  "rost-runner-sandbox-",
+  "rost-runner-askpass-"
+];
+var SENSITIVE_READ_SUBPATHS = [
+  ".ssh",
+  ".aws",
+  ".gnupg",
+  ".config/gcloud",
+  ".config/gh",
+  ".kube",
+  ".docker",
+  ".npmrc"
+];
+var SENSITIVE_READ_LITERALS = [".netrc"];
+var SENSITIVE_WRITE_SUBPATHS = [
+  ".ssh",
+  ".aws",
+  ".gnupg",
+  ".config/git",
+  "bin",
+  "Library/LaunchAgents"
+];
+var SENSITIVE_WRITE_LITERALS = [
+  ".gitconfig",
+  ".zshrc",
+  ".zprofile",
+  ".zshenv",
+  ".zlogin",
+  ".bashrc",
+  ".bash_profile",
+  ".bash_login",
+  ".profile"
+];
+function parseSandboxMode(value) {
+  const normalized = (value ?? "auto").trim().toLowerCase();
+  if (normalized === "off" || normalized === "strict" || normalized === "auto" || normalized === "") {
+    return normalized === "" ? "auto" : normalized;
+  }
+  return "auto";
+}
+function parseSandboxNetwork(value) {
+  const normalized = (value ?? "").trim().toLowerCase();
+  if (normalized === "" || normalized === "allow") {
+    return { allowNetwork: true, unrecognized: null };
+  }
+  if (normalized === "deny") {
+    return { allowNetwork: false, unrecognized: null };
+  }
+  return { allowNetwork: true, unrecognized: value ?? "" };
+}
+function sbplString(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function subpath(value) {
+  return `(subpath ${sbplString(value)})`;
+}
+function literal2(value) {
+  return `(literal ${sbplString(value)})`;
+}
+var STRICT_SYSTEM_READ_SUBPATHS = [
+  "/usr",
+  "/bin",
+  "/sbin",
+  "/System",
+  "/Library",
+  "/private/etc",
+  "/private/var/db",
+  "/dev",
+  "/opt",
+  "/nix"
+];
+function buildSeatbeltProfile(input) {
+  const home = input.homeDir.replace(/\/+$/, "");
+  const lines = ["(version 1)"];
+  const denyReadBaseSubpaths = input.denyReadPaths.filter((p) => p.endsWith("/")).map((p) => subpath(p.replace(/\/+$/, "")));
+  const denyReadLiterals = input.denyReadPaths.filter((p) => !p.endsWith("/")).map(literal2);
+  const credentialReadDenies = [
+    ...SENSITIVE_READ_SUBPATHS.map((rel) => subpath(`${home}/${rel}`)),
+    ...SENSITIVE_READ_LITERALS.map((rel) => literal2(`${home}/${rel}`))
+  ];
+  if (input.strict) {
+    lines.push("(deny default)");
+    lines.push("(allow process*)");
+    lines.push("(allow sysctl-read)");
+    lines.push("(allow mach-lookup)");
+    lines.push("(allow iokit-open)");
+    lines.push("(allow system-socket)");
+    lines.push("(allow signal (target self))");
+    lines.push("(allow file-read-metadata)");
+    const strictReads = [
+      ...STRICT_SYSTEM_READ_SUBPATHS.map(subpath),
+      subpath(`${home}/.claude`),
+      subpath(`${home}/.codex`),
+      subpath(input.tmpDir)
+    ];
+    lines.push(`(allow file-read* ${strictReads.join(" ")})`);
+  } else {
+    lines.push("(allow default)");
+  }
+  lines.push("(deny appleevent-send)");
+  if (denyReadBaseSubpaths.length > 0) {
+    lines.push(`(deny file-read* ${denyReadBaseSubpaths.join(" ")})`);
+  }
+  const workspaceReads = [subpath(input.workspaceDir), ...input.allowWritePaths.map(subpath)];
+  lines.push(`(allow file-read* ${workspaceReads.join(" ")})`);
+  lines.push("(deny file-write*)");
+  const allowWrites = [
+    subpath(input.workspaceDir),
+    subpath(input.tmpDir),
+    subpath(`${home}/.claude`),
+    subpath(`${home}/.codex`),
+    ...input.allowWritePaths.map(subpath),
+    subpath("/dev/fd"),
+    literal2("/dev/null"),
+    literal2("/dev/stdout"),
+    literal2("/dev/stderr"),
+    literal2("/dev/tty"),
+    literal2("/dev/dtracehelper")
+  ];
+  lines.push(`(allow file-write* ${allowWrites.join(" ")})`);
+  lines.push(`(deny file-read* ${[...credentialReadDenies, ...denyReadLiterals].join(" ")})`);
+  const denyWrites = [
+    ...SENSITIVE_WRITE_SUBPATHS.map((rel) => subpath(`${home}/${rel}`)),
+    ...SENSITIVE_WRITE_LITERALS.map((rel) => literal2(`${home}/${rel}`))
+  ];
+  lines.push(`(deny file-write* ${denyWrites.join(" ")})`);
+  lines.push('(deny mach-lookup (global-name "com.apple.coreservices.appleevents"))');
+  if (!input.allowNetwork) {
+    lines.push("(deny network*)");
+  } else if (input.strict) {
+    lines.push("(allow network*)");
+  }
+  return `${lines.join("\n")}
+`;
+}
+function canonical(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+}
+function canonicalFile(p) {
+  return path3.join(canonical(path3.dirname(p)), path3.basename(p));
+}
+function isSandboxExecAvailable() {
+  try {
+    return existsSync2(SANDBOX_EXEC_PATH);
+  } catch {
+    return false;
+  }
+}
+function resolveSandboxSpec(options) {
+  if (options.mode === "off") {
+    return { kind: "none", reason: "RUNNER_SANDBOX=off (loosened fallback - OS confinement disabled)" };
+  }
+  if (options.platform !== "darwin") {
+    return { kind: "none", reason: `no OS sandbox on ${options.platform} (seatbelt is macOS-only; Linux confinement is a follow-up)` };
+  }
+  const available = options.sandboxExecAvailable ?? isSandboxExecAvailable();
+  if (!available) {
+    return { kind: "none", reason: `sandbox-exec not found at ${SANDBOX_EXEC_PATH}` };
+  }
+  const workspaceDir = canonical(options.workspaceDir);
+  const tmpDir = canonical(options.tmpDir);
+  const homeDir = canonical(options.homeDir);
+  const allowNetwork = options.allowNetwork ?? true;
+  const denyReadPaths = [canonicalFile(options.stateFile)];
+  if (options.runnerBaseDir) {
+    denyReadPaths.push(`${canonical(options.runnerBaseDir).replace(/\/+$/, "")}/`);
+  }
+  const profile = buildSeatbeltProfile({
+    workspaceDir,
+    tmpDir,
+    homeDir,
+    denyReadPaths,
+    allowWritePaths: (options.allowWritePaths ?? []).map(canonical),
+    allowNetwork,
+    strict: options.mode === "strict"
+  });
+  return {
+    kind: "seatbelt",
+    reason: options.mode === "strict" ? "seatbelt (strict: deny-default reads + write confinement)" : "seatbelt (guard: deny sensitive reads/writes)",
+    profile,
+    allowNetwork
+  };
+}
+function wrapCommandWithSandbox(spec, command, args, profilePath) {
+  if (spec.kind === "none" || profilePath === null) {
+    return { command, args, profilePath: null };
+  }
+  return {
+    command: SANDBOX_EXEC_PATH,
+    args: ["-f", profilePath, command, ...args],
+    profilePath
+  };
+}
+async function sweepStaleRunnerTempFiles(dir, options = {}) {
+  const maxAgeMs = options.maxAgeMs ?? 60 * 60 * 1e3;
+  const now = options.now ?? Date.now();
+  let entries;
+  try {
+    entries = await readdir(dir);
+  } catch {
+    return [];
+  }
+  const removed = [];
+  await Promise.all(
+    entries.map(async (name) => {
+      if (!RUNNER_TEMP_PREFIXES.some((prefix) => name.startsWith(prefix))) {
+        return;
+      }
+      const full = path3.join(dir, name);
+      try {
+        const info = await stat2(full);
+        if (now - info.mtimeMs < maxAgeMs) {
+          return;
+        }
+        await rm2(full, { force: true });
+        removed.push(name);
+      } catch {
+      }
+    })
+  );
+  return removed;
+}
+
+// src/runner-serve.ts
 var execFile3 = promisify3(execFileCallback3);
 var RUNNER_WORK_ORDER_TOOLS = [
   "mcp__rost__rost_get_context",
@@ -51597,6 +51928,20 @@ ${usage()}
   }
   options.io.stdout.write(`runner serve: ${options.appUrl} name=${config2.name} execute=${config2.execute}
 `);
+  options.io.stdout.write(`runner sandbox: ${config2.sandbox.kind} - ${config2.sandbox.reason}
+`);
+  if (config2.sandboxNetworkWarning) {
+    options.io.stderr.write(`warning: ${config2.sandboxNetworkWarning}
+`);
+  }
+  try {
+    const swept = await sweepStaleRunnerTempFiles(tmpdir());
+    if (swept.length > 0) {
+      options.io.stdout.write(`swept ${swept.length} stale runner temp file(s)
+`);
+    }
+  } catch {
+  }
   let state;
   try {
     state = await pairIfNeeded(options.client ?? null, fetchImpl, options.appUrl, config2, options.io);
@@ -51682,7 +52027,7 @@ function detectTelemetry(capabilities, env, activeSessions) {
 }
 function parseServeArgs(args, appUrl2, env) {
   let name = env.RUNNER_NAME ?? `headless-${hostname3()}`;
-  let stateFile = env.RUNNER_STATE_FILE ?? path3.join(tmpdir(), `rost-runner-${createHash("sha1").update(appUrl2).digest("hex").slice(0, 8)}.json`);
+  let stateFile = env.RUNNER_STATE_FILE ?? path4.join(tmpdir(), `rost-runner-${createHash("sha1").update(appUrl2).digest("hex").slice(0, 8)}.json`);
   let heartbeatMs = Number(env.RUNNER_HEARTBEAT_MS ?? 3e4);
   let interactiveClaimMs = Number(env.RUNNER_INTERACTIVE_CLAIM_MS ?? 1e3);
   let execute2 = env.RUNNER_EXECUTE === "1";
@@ -51724,7 +52069,29 @@ function parseServeArgs(args, appUrl2, env) {
     throw new Error("--interactive-claim-ms must be an integer >= 250.");
   }
   interactiveClaimMs = Math.min(interactiveClaimMs, heartbeatMs);
-  return { name, stateFile, heartbeatMs, interactiveClaimMs, execute: execute2, once, runtime, ...userCode ? { userCode } : {} };
+  const network = parseSandboxNetwork(env.RUNNER_SANDBOX_NETWORK);
+  const sandbox = resolveSandboxSpec({
+    mode: parseSandboxMode(env.RUNNER_SANDBOX),
+    platform: process.platform,
+    workspaceDir: tmpdir(),
+    tmpDir: tmpdir(),
+    homeDir: homedir2(),
+    stateFile,
+    runnerBaseDir: path4.join(homedir2(), ".rost"),
+    allowNetwork: network.allowNetwork
+  });
+  return {
+    name,
+    stateFile,
+    heartbeatMs,
+    interactiveClaimMs,
+    execute: execute2,
+    once,
+    runtime,
+    sandbox,
+    ...network.unrecognized !== null ? { sandboxNetworkWarning: `RUNNER_SANDBOX_NETWORK='${network.unrecognized}' not recognized (use allow|deny); defaulting to allow egress.` } : {},
+    ...userCode ? { userCode } : {}
+  };
 }
 function parseRuntime(value) {
   if (value === "auto" || value === "claude" || value === "codex") {
@@ -51844,7 +52211,7 @@ function isRuntimeSessionMap(value) {
   });
 }
 async function saveState(filePath, state) {
-  await mkdir2(path3.dirname(filePath), { recursive: true, mode: 448 });
+  await mkdir2(path4.dirname(filePath), { recursive: true, mode: 448 });
   const tempPath = `${filePath}.${process.pid}.${createHash("sha1").update(`${Date.now()}:${Math.random()}`).digest("hex").slice(0, 8)}.tmp`;
   try {
     await writeFile2(tempPath, `${JSON.stringify(state)}
@@ -51852,7 +52219,7 @@ async function saveState(filePath, state) {
     await chmod(tempPath, 384);
     await rename(tempPath, filePath);
   } catch (error51) {
-    await rm2(tempPath, { force: true });
+    await rm3(tempPath, { force: true });
     throw error51;
   }
 }
@@ -51938,7 +52305,7 @@ async function executeClaimedUnit(fetchImpl, appUrl2, state, config2, io, runtim
     throw new Error(`${claimedUnitLabel(input.kind)} start failed ${started.status}: ${redactForLog(JSON.stringify(started.json))}`);
   }
   const turnRuntime = runtimeForClaimedUnit(input.item, runtime, input.kind);
-  const result = turnRuntime ? await runLocalTurn(appUrl2, input.item, turnRuntime, input.kind, state) : {
+  const result = turnRuntime ? await runLocalTurn(appUrl2, input.item, turnRuntime, input.kind, state, config2.sandbox) : {
     ok: false,
     summary: `Runner runtime ${runtime} cannot execute requested ${String(input.item.brain ?? "unknown")} turn.`
   };
@@ -51978,14 +52345,14 @@ function runtimeForClaimedUnit(item, fallback, kind) {
   }
   return fallback === "claude" ? "claude" : null;
 }
-function runLocalTurn(appUrl2, workOrder, runtime, kind, state) {
-  return runtime === "codex" ? runCodexTurn(appUrl2, workOrder, kind) : runClaudeTurn(appUrl2, workOrder, kind, state);
+function runLocalTurn(appUrl2, workOrder, runtime, kind, state, sandbox) {
+  return runtime === "codex" ? runCodexTurn(appUrl2, workOrder, kind, sandbox) : runClaudeTurn(appUrl2, workOrder, kind, state, sandbox);
 }
-function runClaudeTurn(appUrl2, workOrder, kind, state) {
-  return spawnRunnerTurn(appUrl2, workOrder, "claude", kind, state);
+function runClaudeTurn(appUrl2, workOrder, kind, state, sandbox) {
+  return spawnRunnerTurn(appUrl2, workOrder, "claude", kind, sandbox, state);
 }
-function runCodexTurn(appUrl2, workOrder, kind) {
-  return spawnRunnerTurn(appUrl2, workOrder, "codex", kind);
+function runCodexTurn(appUrl2, workOrder, kind, sandbox) {
+  return spawnRunnerTurn(appUrl2, workOrder, "codex", kind, sandbox);
 }
 function buildTurnCommand(runtime, prompt, configPath, kind, resumeSessionId) {
   if (runtime === "codex") {
@@ -52010,12 +52377,12 @@ function buildTurnCommand(runtime, prompt, configPath, kind, resumeSessionId) {
     ]
   };
 }
-async function spawnRunnerTurn(appUrl2, workOrder, runtime, kind, state) {
+async function spawnRunnerTurn(appUrl2, workOrder, runtime, kind, sandbox, state) {
   const mcp = typeof workOrder.mcp === "object" && workOrder.mcp !== null ? workOrder.mcp : {};
   const token = typeof mcp.token === "string" ? mcp.token : "";
   const url2 = typeof mcp.url === "string" ? `${appUrl2.replace(/\/+$/, "")}${mcp.url}` : `${appUrl2.replace(/\/+$/, "")}/mcp`;
   const mcpConfig = JSON.stringify({ mcpServers: { rost: { type: "http", url: url2, headers: { Authorization: `Bearer ${token}` } } } });
-  const configPath = path3.join(tmpdir(), `rost-runner-mcp-${createHash("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
+  const configPath = path4.join(tmpdir(), `rost-runner-mcp-${createHash("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
   const context = {
     work_order_id: kind === "work_order" ? workOrder.id : null,
     turn_execution_id: kind === "turn_execution" ? workOrder.id : null,
@@ -52045,7 +52412,17 @@ async function spawnRunnerTurn(appUrl2, workOrder, runtime, kind, state) {
 `, { mode: 384 });
   await chmod(configPath, 384);
   const resumeSessionId = runtime === "claude" ? getClaudeResumeSessionId(state, workOrder) : void 0;
-  const { command, args } = buildTurnCommand(runtime, prompt, configPath, kind, resumeSessionId);
+  const built = buildTurnCommand(runtime, prompt, configPath, kind, resumeSessionId);
+  let sandboxProfilePath = null;
+  if (sandbox.kind === "seatbelt") {
+    sandboxProfilePath = path4.join(
+      tmpdir(),
+      `rost-runner-sandbox-${createHash("sha256").update(`${configPath}:${Math.random()}`).digest("hex").slice(0, 16)}.sb`
+    );
+    await writeFile2(sandboxProfilePath, sandbox.profile, { mode: 384 });
+    await chmod(sandboxProfilePath, 384);
+  }
+  const { command, args } = wrapCommandWithSandbox(sandbox, built.command, built.args, sandboxProfilePath);
   const expectSessionEnvelope = runtime === "claude" && kind === "turn_execution";
   return new Promise((resolve2) => {
     let settled = false;
@@ -52054,7 +52431,10 @@ async function spawnRunnerTurn(appUrl2, workOrder, runtime, kind, state) {
         return;
       }
       settled = true;
-      void rm2(configPath, { force: true });
+      void rm3(configPath, { force: true });
+      if (sandboxProfilePath) {
+        void rm3(sandboxProfilePath, { force: true });
+      }
       resolve2(resumeSessionId ? { ...result, resumedFromSessionId: resumeSessionId } : result);
     };
     const child = spawn(command, args, {
@@ -52187,10 +52567,10 @@ function usage() {
 
 // src/runner-service.ts
 import { execFile as execFileCallback4 } from "node:child_process";
-import { realpathSync } from "node:fs";
-import { access as access2, mkdir as mkdir3, readFile as readFile5, rm as rm3, writeFile as writeFile3 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import path4 from "node:path";
+import { realpathSync as realpathSync2 } from "node:fs";
+import { access as access2, mkdir as mkdir3, readFile as readFile5, rm as rm4, writeFile as writeFile3 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import path5 from "node:path";
 import { promisify as promisify4 } from "node:util";
 var execFile4 = promisify4(execFileCallback4);
 var SERVICE_VERBS = ["install-service", "start", "stop", "restart", "status", "logs", "uninstall"];
@@ -52207,9 +52587,9 @@ function isRunnerServiceInvocation(args) {
 function runnerServicePaths(homeDir, runnerName) {
   const safeName = safeRunnerName(runnerName);
   return {
-    launchAgentPath: path4.join(homeDir, "Library", "LaunchAgents", `${serviceLabel(safeName)}.plist`),
-    stateFile: path4.join(homeDir, "Library", "Application Support", cliBrand.name, `runner-${safeName}.json`),
-    logDir: path4.join(homeDir, "Library", "Logs", cliBrand.name, "runner", safeName)
+    launchAgentPath: path5.join(homeDir, "Library", "LaunchAgents", `${serviceLabel(safeName)}.plist`),
+    stateFile: path5.join(homeDir, "Library", "Application Support", cliBrand.name, `runner-${safeName}.json`),
+    logDir: path5.join(homeDir, "Library", "Logs", cliBrand.name, "runner", safeName)
   };
 }
 function renderLaunchdPlist(config2) {
@@ -52249,9 +52629,9 @@ ${programArgsXml}
   <key>RunAtLoad</key>
   <true/>
   <key>StandardOutPath</key>
-  <string>${escapePlist(path4.join(config2.logDir, "stdout.log"))}</string>
+  <string>${escapePlist(path5.join(config2.logDir, "stdout.log"))}</string>
   <key>StandardErrorPath</key>
-  <string>${escapePlist(path4.join(config2.logDir, "stderr.log"))}</string>
+  <string>${escapePlist(path5.join(config2.logDir, "stderr.log"))}</string>
 </dict>
 </plist>
 `;
@@ -52286,7 +52666,7 @@ ${serviceUsage()}
     userCode: parsed.userCode,
     nodePath: options.nodePath ?? resolveNodePath(),
     binPath: options.binPath ?? resolveBinPath(),
-    homeDir: options.homeDir ?? homedir2(),
+    homeDir: options.homeDir ?? homedir3(),
     platform: options.platform ?? process.platform,
     exec: options.exec ?? defaultExec,
     uid: options.uid ?? (process.getuid ? process.getuid() : 0)
@@ -52318,8 +52698,8 @@ async function installService(options) {
   const paths = runnerServicePaths(options.homeDir, safeName);
   const label = serviceLabel(safeName);
   await mkdir3(paths.logDir, { recursive: true });
-  await mkdir3(path4.dirname(paths.stateFile), { recursive: true });
-  await mkdir3(path4.dirname(paths.launchAgentPath), { recursive: true });
+  await mkdir3(path5.dirname(paths.stateFile), { recursive: true });
+  await mkdir3(path5.dirname(paths.launchAgentPath), { recursive: true });
   if (options.userCode !== void 0) {
     const paired = await pairRunnerOnce(options, safeName, paths.stateFile, options.userCode);
     if (!paired) {
@@ -52497,8 +52877,8 @@ async function logsService(options) {
   const safeName = safeRunnerName(options.runnerName);
   const paths = runnerServicePaths(options.homeDir, safeName);
   const label = serviceLabel(safeName);
-  const stdoutLog = path4.join(paths.logDir, "stdout.log");
-  const stderrLog = path4.join(paths.logDir, "stderr.log");
+  const stdoutLog = path5.join(paths.logDir, "stdout.log");
+  const stderrLog = path5.join(paths.logDir, "stderr.log");
   options.io.stdout.write(
     `${[
       `runner service logs for ${label}:`,
@@ -52529,7 +52909,7 @@ async function uninstallService(options) {
   await bootoutQuietly(options.exec, options.uid, paths.launchAgentPath);
   let removed = false;
   try {
-    await rm3(paths.launchAgentPath, { force: true });
+    await rm4(paths.launchAgentPath, { force: true });
     removed = true;
   } catch (error51) {
     options.io.stderr.write(
@@ -52673,11 +53053,11 @@ function resolveNodePath() {
 }
 function buildServicePath(nodePath, homeDir) {
   const entries = [
-    path4.dirname(nodePath),
+    path5.dirname(nodePath),
     "/opt/homebrew/bin",
     "/usr/local/bin",
-    path4.join(homeDir, ".local", "bin"),
-    path4.join(homeDir, "bin"),
+    path5.join(homeDir, ".local", "bin"),
+    path5.join(homeDir, "bin"),
     "/usr/bin",
     "/bin",
     "/usr/sbin",
@@ -52722,7 +53102,7 @@ function resolveBinPath() {
     return cliBrand.binName;
   }
   try {
-    return realpathSync(entry);
+    return realpathSync2(entry);
   } catch {
     return entry;
   }
@@ -53385,7 +53765,7 @@ function isCliEntrypoint(moduleUrl, argvPath) {
     return false;
   }
   try {
-    return realpathSync2(fileURLToPath3(moduleUrl)) === realpathSync2(argvPath);
+    return realpathSync3(fileURLToPath3(moduleUrl)) === realpathSync3(argvPath);
   } catch {
     return moduleUrl === pathToFileURL(argvPath).href;
   }