@rosthq/cli 0.7.30 → 0.7.32

package/dist/cli-version.d.ts

@@ -0,0 +1,2 @@
+export declare function readCliVersion(): Promise<string | null>;
+//# sourceMappingURL=cli-version.d.ts.map

package/dist/cli-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-version.d.ts","sourceRoot":"","sources":["../src/cli-version.ts"],"names":[],"mappings":"AAgBA,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ7D"}

package/dist/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAOA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKrE,KAAK,QAAQ,GAAG;IACd,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,KAAK,aAAa,GAAG;IACnB,EAAE,EAAE,QAAQ,CAAC;IACb,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,CAAC;AAEF,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAoCvE"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAQA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKrE,KAAK,QAAQ,GAAG;IACd,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,KAAK,aAAa,GAAG;IACnB,EAAE,EAAE,QAAQ,CAAC;IACb,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,CAAC;AAEF,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAoCvE"}

package/dist/index.js

@@ -42464,6 +42464,16 @@ var softwareDeveloperTeamRoleSchema = external_exports.enum([
   "qa_release",
   "fold_memory"
 ]);
+var softwareDeveloperTeamLaneSchema = external_exports.enum(["runner", "cloud"]);
+var softwareDeveloperTeamLaneOverridesSchema = external_exports.object({
+  forge_lead: softwareDeveloperTeamLaneSchema.optional(),
+  planner: softwareDeveloperTeamLaneSchema.optional(),
+  builder: softwareDeveloperTeamLaneSchema.optional(),
+  plan_conformance_reviewer: softwareDeveloperTeamLaneSchema.optional(),
+  security_reviewer: softwareDeveloperTeamLaneSchema.optional(),
+  qa_release: softwareDeveloperTeamLaneSchema.optional(),
+  fold_memory: softwareDeveloperTeamLaneSchema.optional()
+}).strict();
 var softwareEnvironmentSchema = external_exports.enum(["development", "preview", "production"]);
 var softwareGrantStatusSchema = external_exports.enum(["active", "revoked"]);
 var softwareConfigValueKindSchema = external_exports.enum(["plain", "secret_ref"]);
@@ -43045,7 +43055,14 @@ var softwareDeveloperTeamInstallInputSchema = external_exports.object({
   // auto-activate unless the owner explicitly acknowledges that posture. Never
   // silently inherit a more-permissive-than-designed ceiling (invariant #10). A
   // tenant within the envelope (locked_down/balanced) never needs this.
-  acknowledge_autonomy_ceiling: external_exports.boolean().default(false)
+  acknowledge_autonomy_ceiling: external_exports.boolean().default(false),
+  // DER-1317 (T0.2a): optionally pin an individual role to a specific execution
+  // lane. Omitted roles staff their declared default lane (phase-owning agents =
+  // `runner`; the human `forge_lead` seat is never staffed with an agent, so its
+  // override is inert). `.nullable()` for the same confirm-replay round-trip
+  // reason as `software_project_id` above (JSONB re-parse of a human-confirmed
+  // command tolerates a JSON `null` for an omitted object).
+  lane_overrides: softwareDeveloperTeamLaneOverridesSchema.nullable().optional()
 }).strict();
 var softwareDeveloperTeamSeatSummarySchema = external_exports.object({
   role: softwareDeveloperTeamRoleSchema,
@@ -45132,7 +45149,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-05.1",
+    version: "2026-07-05.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -45869,7 +45886,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_create_a_forge_authority_profile\` | \`software_factory.authority_profile.create\` | Define a Forge authority profile (a named seat capability preset). Owner-only; defaults to the read_only preset. | Tenant-admin | Call with \`{"name":"Builder","preset":"contributor"}\`. |
 | \`rost_grant_forge_seat_authority\` | \`software_factory.authority.grant\` | Grant a seat a Forge authority profile on a project (seat \u2192 project \u2192 profile). Owner-only and human-gated; emits a durable authority-change event. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","seat_id":"<seat-id>","authority_profile_id":"<profile-id>"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_revoke_forge_seat_authority\` | \`software_factory.authority.revoke\` | Revoke a Forge authority grant (teardown). Owner-only and human-gated. | Tenant-admin | Call with \`{"grant_id":"<grant-id>"}\`; non-interactive callers receive a confirmation handoff. |
-| \`rost_install_forge_developer_team\` | \`software_factory.developer_team.install\` | Install AND activate the governed Forge Developer Team: Forge Lead (human) plus Planner, Builder, plan reviewer, security reviewer, QA/release, and Fold/Memory seats with draft Charters, first-party Forge Skills, and authority presets. Approving ALSO auto-staffs the 6 agent seats as live occupancies at a pull-request-only, observe-first posture (open pull requests, never merge/deploy without a human), steward-chained to the human lead, each with a signed manifest + passed sandbox dry-run; it sets a conservative default token budget (only if none) and, for a supplied project, a default pr_only GitHub automation policy (only if none \u2014 never widening a stricter one). Entitlement-gated and human-gated. | Tenant-admin | Call with \`{"steward_seat_id":"<human-steward-seat-id>"}\` \u2014 \`software_project_id\` is optional (when supplied it scopes authority grants to that project; the team installs tenant-wide either way). If the company autonomy ceiling is more permissive than the observe-first envelope, add \`{"acknowledge_autonomy_ceiling":true}\` to activate. Non-interactive callers receive a confirmation handoff. |
+| \`rost_install_forge_developer_team\` | \`software_factory.developer_team.install\` | Install AND activate the governed Forge Developer Team: Forge Lead (human) plus Planner, Builder, plan reviewer, security reviewer, QA/release, and Fold/Memory seats with draft Charters, first-party Forge Skills, and authority presets. Approving ALSO auto-staffs the 6 agent seats as live occupancies at a pull-request-only, observe-first posture (open pull requests, never merge/deploy without a human), steward-chained to the human lead, each with a signed manifest + passed sandbox dry-run; the 6 agent seats staff the runner lane and go live in a PARKED state \u2014 they become claimable once a runner pairs and cannot claim work before then; it sets a conservative default token budget (only if none) and, for a supplied project, a default pr_only GitHub automation policy (only if none \u2014 never widening a stricter one). Entitlement-gated and human-gated. | Tenant-admin | Call with \`{"steward_seat_id":"<human-steward-seat-id>"}\` \u2014 \`software_project_id\` is optional (when supplied it scopes authority grants to that project; the team installs tenant-wide either way). If the company autonomy ceiling is more permissive than the observe-first envelope, add \`{"acknowledge_autonomy_ceiling":true}\` to activate. Add \`{"lane_overrides":{"qa_release":"cloud"}}\` to pin a role to the cloud lane instead of the default runner lane. Non-interactive callers receive a confirmation handoff. |
 | \`rost_list_forge_config\` | \`software_factory.config.list\` | List active Forge configuration entries. Plain values may be returned only when they passed the non-secret guard; secret refs appear as metadata and never include the ref value. | Tenant | Call with \`{}\` or \`{"software_project_id":"<project-id>","environment":"preview"}\`. |
 | \`rost_set_forge_config\` | \`software_factory.config.set\` | Human-gated config create/rotation for plain values or secret refs. Secret refs store only a vault pointer and raw secret-shaped plain values are rejected. | Tenant-admin | Call with \`{"software_project_id":"<project-id>","environment":"preview","key_name":"PUBLIC_BASE_URL","value_kind":"plain","plain_value":"https://preview.example.com"}\`. |
 | \`rost_list_forge_secret_requests\` | \`software_factory.secret_request.list\` | List missing-secret requests and their approval Task ids/statuses. It returns request metadata only \u2014 no secret values and no vault refs. | Tenant | Call with \`{}\` or \`{"status":"pending"}\`. |
@@ -48826,21 +48843,32 @@ function helpText() {
   ].join("\n");
 }
 
-// src/update-check.ts
+// src/cli-version.ts
 import { readFile as readFile2 } from "node:fs/promises";
 import { dirname as dirname2, resolve } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-var latestPackageSchema = external_exports.object({
+var packageMetadataSchema = external_exports.object({
   version: external_exports.string()
 });
-var packageMetadataSchema = external_exports.object({
+async function readCliVersion() {
+  const packageJsonPath = resolve(dirname2(fileURLToPath2(import.meta.url)), "../package.json");
+  try {
+    const metadata = packageMetadataSchema.parse(JSON.parse(await readFile2(packageJsonPath, "utf8")));
+    return metadata.version;
+  } catch {
+    return null;
+  }
+}
+
+// src/update-check.ts
+var latestPackageSchema = external_exports.object({
   version: external_exports.string()
 });
 async function maybePrintUpgradeNudge(io) {
   if (process.env.CI || process.env.VITEST || process.env.CLI_SKIP_UPDATE_CHECK === "1") {
     return;
   }
-  const currentVersion = await readCurrentVersion();
+  const currentVersion = await readCliVersion();
   if (!currentVersion || currentVersion === "0.0.0") {
     return;
   }
@@ -48853,15 +48881,6 @@ async function maybePrintUpgradeNudge(io) {
 `
   );
 }
-async function readCurrentVersion() {
-  const packageJsonPath = resolve(dirname2(fileURLToPath2(import.meta.url)), "../package.json");
-  try {
-    const metadata = packageMetadataSchema.parse(JSON.parse(await readFile2(packageJsonPath, "utf8")));
-    return metadata.version;
-  } catch {
-    return null;
-  }
-}
 async function fetchLatestVersion(packageName) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 750);
@@ -49081,7 +49100,7 @@ var COMMAND_MANIFEST = [
   { "id": "software_factory.config.list", "namespace": "software_factory", "action": "config.list", "title": "List Forge config", "description": "List active Forge config metadata for project environments. Plain config values may be returned; secret refs are represented only as has_secret_ref.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "environment", "flag": "environment", "type": "enum", "required": false, "enumValues": ["development", "preview", "production"] }], "hasComplexInput": false, "help": "List active Forge config entries. Plain config may be shown; secret refs are represented only as metadata." },
   { "id": "software_factory.config.set", "namespace": "software_factory", "action": "config.set", "title": "Set Forge config", "description": "Create or rotate a Forge project config entry. Secret config stores only a vault ref pointer; raw values are never accepted for secret_ref entries.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "environment", "flag": "environment", "type": "enum", "required": true, "enumValues": ["development", "preview", "production"] }, { "name": "key_name", "flag": "key-name", "type": "string", "required": true }, { "name": "value_kind", "flag": "value-kind", "type": "enum", "required": true, "enumValues": ["plain", "secret_ref"] }, { "name": "plain_value", "flag": "plain-value", "type": "string", "required": false }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": false }], "hasComplexInput": false, "help": "Set or rotate a Forge project config key. Secret entries store only vault refs and are human-gated." },
   { "id": "software_factory.conformance.record_findings", "namespace": "software_factory", "action": "conformance.record_findings", "title": "Record Forge conformance findings", "description": "The plan-conformance reviewer records one or more findings against a build request; open findings route the request back to implementation. Recording is evidence, not a decision \u2014 accepting a gap is a separate human gate. Requires the Forge add-on.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "phase_run_id", "flag": "phase-run-id", "type": "string", "required": false }], "hasComplexInput": true, "help": "Record structured Forge plan-conformance findings as reviewer evidence. Open findings route the request back to implementation; accepting a gap remains a separate human gate." },
-  { "id": "software_factory.developer_team.install", "namespace": "software_factory", "action": "developer_team.install", "title": "Install Forge Developer Team", "description": "Install AND activate the governed Forge Developer Team: 7 seats (1 human lead + 6 agents), first-party skills, authority presets, and a conservative token budget. Approving this ACTIVATES the 6 agents as live occupancies at a pr_only, observe-first posture: they open pull requests but never merge or deploy without a human. Entitlement-gated and human-confirmed.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": true }, { "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "assign_skills", "flag": "assign-skills", "type": "boolean", "required": false }, { "name": "acknowledge_autonomy_ceiling", "flag": "acknowledge-autonomy-ceiling", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Install the governed Forge Developer Team template with seats, draft Charters, skills, project authority grants, and audit records. Tenant-admin and human-gated; creates no live agent occupancy." },
+  { "id": "software_factory.developer_team.install", "namespace": "software_factory", "action": "developer_team.install", "title": "Install Forge Developer Team", "description": "Install AND activate the governed Forge Developer Team: 7 seats (1 human lead + 6 agents), first-party skills, authority presets, and a conservative token budget. Approving this ACTIVATES the 6 agents as live occupancies at a pr_only, observe-first posture: they open pull requests but never merge or deploy without a human. Entitlement-gated and human-confirmed.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": true }, { "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "assign_skills", "flag": "assign-skills", "type": "boolean", "required": false }, { "name": "acknowledge_autonomy_ceiling", "flag": "acknowledge-autonomy-ceiling", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Install the governed Forge Developer Team template with seats, draft Charters, skills, project authority grants, and audit records. Tenant-admin and human-gated; creates no live agent occupancy." },
   { "id": "software_factory.gate.decide", "namespace": "software_factory", "action": "gate.decide", "title": "Decide a Forge gate", "description": "A human approves or rejects a Forge gate. The resolver is recorded (never an agent \u2014 invariant #7); sensitive gates (security sign-off, merge/deploy, authority change, production deploy) also write a linked human decision. Requires confirmation.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "gate_id", "flag": "gate-id", "type": "string", "required": true }, { "name": "decision", "flag": "decision", "type": "enum", "required": true, "enumValues": ["approve", "reject"] }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human approves or rejects a Forge gate; an agent caller routes to /approvals and can never self-approve. Sensitive gates record a human decision." },
   { "id": "software_factory.github.installation_token.create", "namespace": "software_factory", "action": "github.installation_token.create", "title": "Create a Forge GitHub installation token", "description": "Mint a short-lived GitHub App installation token for one bound repository after server-side policy evaluation. The token is returned once and never persisted.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "repository_id", "flag": "repository-id", "type": "integer", "required": true }, { "name": "requested_actions", "flag": "requested-actions", "type": "array", "required": true, "itemType": "string" }, { "name": "requested_automation_mode", "flag": "requested-automation-mode", "type": "enum", "required": false, "enumValues": ["plan_only", "pr_only", "merge_after_checks", "deploy_preview", "deploy_production"] }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Mint a short-lived GitHub App installation token for one bound repository after policy evaluation; token material is returned once and never stored." },
   { "id": "software_factory.github.installation.bind", "namespace": "software_factory", "action": "github.installation.bind", "title": "Bind Forge GitHub repositories to projects", "description": "Bind already-connected GitHub repositories to Forge projects. Owner-only and human-gated; operates on repositories already verified and connected in this tenant, so no GitHub re-authorization is required. Available any time, add or re-map bindings.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "app_slug", "flag": "app-slug", "type": "string", "required": false }, { "name": "installation_id", "flag": "installation-id", "type": "integer", "required": true }], "hasComplexInput": true, "help": "Bind already-connected GitHub repositories to Forge projects from the Forge GitHub settings flow. Owner-only and human-gated; no GitHub re-authorization required." },
@@ -51540,7 +51559,7 @@ function pendingConfirmationFromError(error51) {
 
 // src/doctor.ts
 import { execFile as execFileCallback2 } from "node:child_process";
-import { access, readFile as readFile3 } from "node:fs/promises";
+import { access } from "node:fs/promises";
 import { delimiter } from "node:path";
 import { promisify as promisify2 } from "node:util";
 var execFile2 = promisify2(execFileCallback2);
@@ -51551,7 +51570,7 @@ async function runDoctor(options) {
   const config2 = loadConfig(env);
   lines.push(`app_url: ${config2.appUrl}`);
   lines.push(`supabase_url: ${config2.supabaseUrl}`);
-  const currentVersion = await readCurrentVersion2();
+  const currentVersion = await readCliVersion();
   lines.push(`version: ${currentVersion ?? "unknown"}`);
   const pathStatus = await checkPath(env);
   lines.push(pathStatus);
@@ -51598,15 +51617,6 @@ async function probeCli(command) {
     return "not found";
   }
 }
-async function readCurrentVersion2() {
-  try {
-    const url2 = new URL("../package.json", import.meta.url);
-    const parsed = JSON.parse(await readFile3(url2, "utf8"));
-    return typeof parsed.version === "string" ? parsed.version : null;
-  } catch {
-    return null;
-  }
-}
 async function fetchLatestVersion2(packageName, env) {
   if (env.CI || env.VITEST || env.CLI_SKIP_UPDATE_CHECK === "1" || env[`${cliBrand.envPrefix}_CLI_NO_UPDATE_CHECK`] === "1") {
     return null;
@@ -51662,7 +51672,7 @@ function parseSemver2(value) {
 // src/runner-serve.ts
 import { execFile as execFileCallback3, spawn } from "node:child_process";
 import { createHash } from "node:crypto";
-import { chmod, mkdir as mkdir2, readFile as readFile4, rename, rm as rm3, writeFile as writeFile2 } from "node:fs/promises";
+import { chmod, mkdir as mkdir2, readFile as readFile3, rename, rm as rm3, statfs, writeFile as writeFile2 } from "node:fs/promises";
 import { cpus, homedir as homedir2, hostname as hostname3, platform, totalmem, tmpdir } from "node:os";
 import path4 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
@@ -51917,6 +51927,8 @@ var RUNNER_AICOS_TURN_TOOLS = [
 async function runRunnerServe(options) {
   const env = options.env ?? process.env;
   const fetchImpl = options.fetchImpl ?? fetch;
+  const cliVersion = await readCliVersion();
+  const homeDir = options.homeDir ?? homedir2();
   let config2;
   try {
     config2 = parseServeArgs(options.args, options.appUrl, env);
@@ -51955,13 +51967,13 @@ ${usage()}
   let failed = false;
   let activeSessions = 0;
   do {
-    const detectedCapabilities = await detectCapabilities();
+    const detectedCapabilities = await detectCapabilities(cliVersion, env, homeDir);
     const capabilities = capabilitiesForConfiguredRuntime(detectedCapabilities, config2.runtime);
     const localRuntime = config2.execute ? effectiveExecutionRuntime(config2.runtime, capabilities) : null;
     try {
       const heartbeat = await post2(fetchImpl, options.appUrl, "/api/runner/heartbeat", {
         capabilities,
-        telemetry: detectTelemetry(capabilities, env, activeSessions)
+        telemetry: detectTelemetry(capabilities, env, activeSessions, cliVersion)
       }, state.runner_secret);
       if (heartbeat.status !== 200) {
         options.io.stderr.write(`heartbeat ${heartbeat.status}: ${redactForLog(JSON.stringify(heartbeat.json))}
@@ -52008,17 +52020,28 @@ async function waitForNextHeartbeat(fetchImpl, appUrl2, state, config2, io, runt
     }
   }
 }
-function detectTelemetry(capabilities, env, activeSessions) {
-  const accountAlias = (env.RUNNER_MODEL_ACCOUNT_ALIAS ?? env.ROST_RUNNER_MODEL_ACCOUNT_ALIAS ?? "").trim() || "default";
+function resolveAccountAlias(env) {
+  return (env.RUNNER_MODEL_ACCOUNT_ALIAS ?? env.ROST_RUNNER_MODEL_ACCOUNT_ALIAS ?? "").trim() || "default";
+}
+function capabilitiesForAnalytics(capabilities) {
+  return {
+    ...capabilities,
+    claude: { ...capabilities.claude, account_alias: null },
+    codex: { ...capabilities.codex, account_alias: null }
+  };
+}
+function detectTelemetry(capabilities, env, activeSessions, cliVersion) {
   const usageState = env.RUNNER_MODEL_ACCOUNT_STATE ?? env.ROST_RUNNER_MODEL_ACCOUNT_STATE ?? "unknown";
   return {
     os: platform(),
     cpu_count: cpus().length,
     memory_mb: Math.round(totalmem() / (1024 * 1024)),
-    runner_version: env.npm_package_version ?? null,
+    // DER-1319: sourced from the bundled package.json, not env.npm_package_version (undefined
+    // under launchd — prod runners were silently reporting a null version).
+    runner_version: cliVersion,
     active_sessions: activeSessions,
-    installed_runtimes: capabilities,
-    account_alias: accountAlias,
+    installed_runtimes: capabilitiesForAnalytics(capabilities),
+    account_alias: resolveAccountAlias(env),
     usage_limit_observation: {
       state: usageState,
       source: "runner_env_or_unknown"
@@ -52180,7 +52203,7 @@ async function pairIfNeeded(client, fetchImpl, appUrl2, config2, io) {
 }
 async function loadState(filePath, expectedTenantId) {
   try {
-    const parsed = JSON.parse(await readFile4(filePath, "utf8"));
+    const parsed = JSON.parse(await readFile3(filePath, "utf8"));
     if (typeof parsed.runner_id === "string" && typeof parsed.runner_secret === "string") {
       if (expectedTenantId && parsed.tenant_id !== expectedTenantId) {
         return null;
@@ -52231,9 +52254,25 @@ async function startPairing(client, config2) {
   }
   return userCode;
 }
-async function detectCapabilities() {
-  const [claude, codex] = await Promise.all([probe("claude"), probe("codex")]);
-  return { claude, codex, turn_executions: { report_supported: true } };
+async function detectCapabilities(cliVersion, env, homeDir) {
+  const [claude, codex, git, gh, forgeDiskFreeMb] = await Promise.all([
+    probe("claude"),
+    probe("codex"),
+    probeGit(),
+    probeGh(),
+    probeForgeDiskFreeMb(homeDir)
+  ]);
+  const accountAlias = resolveAccountAlias(env);
+  return {
+    claude: { ...claude, account_alias: accountAlias, rate_limited_until: null },
+    codex: { ...codex, account_alias: accountAlias, rate_limited_until: null },
+    turn_executions: { report_supported: true },
+    ...cliVersion ? { forge_build: cliVersion } : {},
+    git,
+    gh,
+    scheduler: { max_parallel_sessions_estimate: null },
+    host: { forge_disk_free_mb: forgeDiskFreeMb }
+  };
 }
 async function probe(command) {
   try {
@@ -52243,6 +52282,43 @@ async function probe(command) {
     return { installed: false, version: null, auth_state: "unknown" };
   }
 }
+async function probeGit() {
+  try {
+    const { stdout, stderr } = await execFile3("git", ["--version"], { timeout: 1500 });
+    const raw = (stdout || stderr).trim();
+    return { installed: true, version: /(\d+\.\d+(?:\.\d+)?)/.exec(raw)?.[1] ?? (raw || null) };
+  } catch {
+    return { installed: false, version: null };
+  }
+}
+async function probeGh() {
+  try {
+    const { stdout, stderr } = await execFile3("gh", ["--version"], { timeout: 1500 });
+    const raw = (stdout || stderr).trim().split("\n")[0]?.trim() ?? "";
+    const authenticated = await probeGhAuth();
+    return { installed: true, version: /(\d+\.\d+\.\d+)/.exec(raw)?.[1] ?? (raw || null), authenticated };
+  } catch {
+    return { installed: false, version: null, authenticated: false };
+  }
+}
+async function probeGhAuth() {
+  try {
+    await execFile3("gh", ["auth", "status"], { timeout: 1500 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function probeForgeDiskFreeMb(homeDir) {
+  const dir = path4.join(homeDir, ".rost", "forge");
+  try {
+    await mkdir2(dir, { recursive: true, mode: 448 });
+    const stats = await statfs(dir);
+    return Math.floor(stats.bavail * stats.bsize / (1024 * 1024));
+  } catch {
+    return null;
+  }
+}
 async function post2(fetchImpl, appUrl2, pathName, body, token) {
   const headers = { "content-type": "application/json" };
   if (token) {
@@ -52568,7 +52644,7 @@ function usage() {
 // src/runner-service.ts
 import { execFile as execFileCallback4 } from "node:child_process";
 import { realpathSync as realpathSync2 } from "node:fs";
-import { access as access2, mkdir as mkdir3, readFile as readFile5, rm as rm4, writeFile as writeFile3 } from "node:fs/promises";
+import { access as access2, mkdir as mkdir3, readFile as readFile4, rm as rm4, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
 import path5 from "node:path";
 import { promisify as promisify4 } from "node:util";
@@ -53121,7 +53197,7 @@ async function fileExists(file2) {
 }
 async function readTail(file2, maxBytes) {
   try {
-    const content = await readFile5(file2, "utf8");
+    const content = await readFile4(file2, "utf8");
     return content.length > maxBytes ? content.slice(content.length - maxBytes) : content;
   } catch {
     return null;