@rosthq/cli 0.7.52 → 0.7.53

package/dist/config.d.ts

@@ -1,4 +1,7 @@
 import { z } from "zod";
+export declare const canonicalAppUrl = "https://rost.elevatez.ai";
+export declare const legacyAppUrlAliases: readonly ["https://rost-pink.vercel.app"];
+export declare const allowInsecureAppUrlEnv: string;
 declare const configSchema: z.ZodObject<{
     appUrl: z.ZodString;
     supabaseUrl: z.ZodString;
@@ -6,5 +9,13 @@ declare const configSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type CliConfig = z.infer<typeof configSchema>;
 export declare function loadConfig(env?: NodeJS.ProcessEnv): CliConfig;
+export declare function loadConfigWithDiagnostics(env?: NodeJS.ProcessEnv): {
+    config: CliConfig;
+    appUrlWarning: string | null;
+};
+export declare function resolveAppUrl(value: string, env?: NodeJS.ProcessEnv): {
+    value: string;
+    warning: string | null;
+};
 export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,QAAA,MAAM,YAAY;;;;kBAIP,CAAC;AAEZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAErD,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAM1E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,2CAA4C,CAAC;AAC7E,eAAO,MAAM,sBAAsB,QAAiD,CAAC;AAYrF,QAAA,MAAM,YAAY;;;;kBAIP,CAAC;AAEZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAErD,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAE1E;AAED,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAC/E,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAcA;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CA2CA"}

package/dist/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAQA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKrE,KAAK,QAAQ,GAAG;IACd,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,KAAK,aAAa,GAAG;IACnB,EAAE,EAAE,QAAQ,CAAC;IACb,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,CAAC;AAEF,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAoCvE"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAQA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKrE,KAAK,QAAQ,GAAG;IACd,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,KAAK,aAAa,GAAG;IACnB,EAAE,EAAE,QAAQ,CAAC;IACb,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,CAAC;AAEF,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAuCvE"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAMA,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAwBrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAK1C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;CACnD,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8QnG;AAsdD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAMA,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAwBrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAK1C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;CACnD,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqRnG;AAsdD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}

package/dist/index.js

@@ -27862,7 +27862,7 @@ var CommandClient = class {
 };
 
 // ../../packages/design/src/brand.ts
-var appUrl = process.env.NEXT_PUBLIC_APP_URL ?? "";
+var appUrl = process.env.NEXT_PUBLIC_APP_URL ?? "https://rost.elevatez.ai";
 var marketingUrl = process.env.NEXT_PUBLIC_MARKETING_URL ?? "";
 var BRAND = {
   name: "ROST",
@@ -27925,8 +27925,11 @@ var cliBrand = {
 };
 
 // src/config.ts
+var canonicalAppUrl = "https://rost.elevatez.ai";
+var legacyAppUrlAliases = ["https://rost-pink.vercel.app"];
+var allowInsecureAppUrlEnv = `${cliBrand.envPrefix}_ALLOW_INSECURE_APP_URL`;
 var publicProductionDefaults = {
-  appUrl: "https://rost-pink.vercel.app",
+  appUrl: canonicalAppUrl,
   supabaseUrl: "https://jysblwhxtagcibpxdtnc.supabase.co",
   supabaseAnonKey: [
     "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9",
@@ -27940,11 +27943,58 @@ var configSchema = external_exports.object({
   supabaseAnonKey: external_exports.string().min(1)
 }).strict();
 function loadConfig(env = process.env) {
-  return configSchema.parse({
+  return loadConfigWithDiagnostics(env).config;
+}
+function loadConfigWithDiagnostics(env = process.env) {
+  const parsed = configSchema.parse({
     appUrl: firstValue(env[brandEnvKey("APP_URL")], env.NEXT_PUBLIC_APP_URL, cliBrand.appUrl, publicProductionDefaults.appUrl),
     supabaseUrl: firstValue(env[brandEnvKey("SUPABASE_URL")], env.NEXT_PUBLIC_SUPABASE_URL, publicProductionDefaults.supabaseUrl),
     supabaseAnonKey: firstValue(env[brandEnvKey("SUPABASE_ANON_KEY")], env.NEXT_PUBLIC_SUPABASE_ANON_KEY, publicProductionDefaults.supabaseAnonKey)
   });
+  const appUrl2 = resolveAppUrl(parsed.appUrl, env);
+  return {
+    config: {
+      ...parsed,
+      appUrl: appUrl2.value
+    },
+    appUrlWarning: appUrl2.warning
+  };
+}
+function resolveAppUrl(value, env = process.env) {
+  const normalized = value.trim().replace(/\/+$/, "");
+  const parsed = new URL(normalized);
+  const displayUrl = `${parsed.protocol}//${parsed.host}`;
+  const allowDevelopmentAppUrl = env[allowInsecureAppUrlEnv] === "1";
+  const isLocalHttpHost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new Error(
+      `Configured app_url must use https://. Use ${canonicalAppUrl} for production, http://localhost or http://127.0.0.1 for local development, or set ${allowInsecureAppUrlEnv}=1 only for explicit development.`
+    );
+  }
+  if (parsed.protocol === "http:" && !allowDevelopmentAppUrl && !isLocalHttpHost) {
+    throw new Error(
+      `Refusing insecure app_url ${displayUrl}. Use ${canonicalAppUrl} for production. Only http://localhost and http://127.0.0.1 are allowed without ${allowInsecureAppUrlEnv}=1.`
+    );
+  }
+  if (legacyAppUrlAliases.includes(normalized)) {
+    return {
+      value: canonicalAppUrl,
+      warning: `app_url ${displayUrl} is a legacy alias; using ${canonicalAppUrl}. Update ${brandEnvKey("APP_URL")} or NEXT_PUBLIC_APP_URL.`
+    };
+  }
+  if (normalized !== canonicalAppUrl) {
+    if (!allowDevelopmentAppUrl && !isLocalHttpHost) {
+      throw new Error(
+        `Refusing non-canonical app_url ${displayUrl}. Use ${canonicalAppUrl} for production. Set ${allowInsecureAppUrlEnv}=1 only for explicit development or preview testing.`
+      );
+    }
+    const insecureNote = parsed.protocol === "http:" ? " and is allowed only for development" : " and requires explicit development opt-in";
+    return {
+      value: normalized,
+      warning: `app_url ${displayUrl} is not the canonical production host ${canonicalAppUrl}${insecureNote}.`
+    };
+  }
+  return { value: normalized, warning: null };
 }
 function brandEnvKey(suffix) {
   return `${cliBrand.envPrefix}_${suffix}`;
@@ -38996,6 +39046,16 @@ var agentTurnExecutionSchema = external_exports.object({
   claimedByRunnerId: uuidSchema4.nullable(),
   linkedRunId: uuidSchema4.nullable(),
   interactiveDeadline: external_exports.string().datetime({ offset: true }),
+  claimedAt: external_exports.string().datetime({ offset: true }).nullable().optional(),
+  startedAt: external_exports.string().datetime({ offset: true }).nullable().optional(),
+  finishedAt: external_exports.string().datetime({ offset: true }).nullable().optional(),
+  terminalReason: external_exports.string().min(1).max(120).nullable().optional(),
+  claimLatencyMs: external_exports.number().int().nonnegative().nullable().optional(),
+  runtimeDurationMs: external_exports.number().int().nonnegative().nullable().optional(),
+  totalDurationMs: external_exports.number().int().nonnegative().nullable().optional(),
+  inputTokens: external_exports.number().int().nonnegative().nullable().optional(),
+  outputTokens: external_exports.number().int().nonnegative().nullable().optional(),
+  model: external_exports.string().min(1).max(120).nullable().optional(),
   createdAt: external_exports.string().datetime({ offset: true }),
   updatedAt: external_exports.string().datetime({ offset: true })
 }).strict();
@@ -39008,6 +39068,8 @@ var aicosPendingTurnSchema = external_exports.object({
   status: agentTurnExecutionStatusSchema,
   linkedRunId: uuidSchema4.nullable(),
   interactiveDeadline: external_exports.string().datetime({ offset: true }),
+  terminalReason: external_exports.string().min(1).max(120).nullable().default(null),
+  totalDurationMs: external_exports.number().int().nonnegative().nullable().default(null),
   updatedAt: external_exports.string().datetime({ offset: true })
 }).strict();
 var aicosMessageRoleSchema = external_exports.enum(["user", "assistant", "tool", "system"]);
@@ -44401,7 +44463,7 @@ The Compass is drafted, then activated by a human through supersession.
     order: 15,
     title: "AICOS chat guide",
     summary: "How the AI Chief of Staff chat works in the authenticated app shell and what it can safely do today.",
-    version: "2026-07-04.11",
+    version: "2026-07-07.1",
     public: true,
     audiences: ["human", "in_app_agent"],
     stages: ["company_setup", "operating_rhythm"],
@@ -44457,9 +44519,9 @@ The current chat harness shows the effective lane and model. Cloud is the defaul
 
 AICOS also has an explicit brain selection. Cloud can use the included managed allowance or a tenant Anthropic key (BYOK). Runner can target the paired machine's Claude subscription or Codex subscription. MCP is labeled as the MCP client. Read this selection with \`aicos.brain_settings.get\`; owners can update it with \`aicos.brain_settings.update\` (CLI flags: \`--lane\`, \`--cloud-brain managed|byok\`, \`--runner-brain claude-cli|codex-cli\`). BYOK requires an active tenant Anthropic key. Runner and MCP answers are labeled in the transcript and do not consume the managed cloud allowance.
 
-Runner mode uses the same AICOS sessions and transcript. Interactive chat turns are tracked separately from scheduled work orders: each user message has one user-owned turn execution with a short deadline, so two users' chat messages cannot collapse into the same scheduled-work slot. Scheduled and Forge runner work still use work orders. Runner claim packets carry ids and execution metadata, not the user's free-text request. After claim, the local runner calls the governed AICOS context-load tool, which re-checks seat scope and returns the bounded transcript, session summary, route context, tenant clock, grounding text, and source counts authorized for that turn. The runner treats that loaded tenant clock and context as authoritative instead of substituting its own runtime clock or local files. A runner must be paired, execute-ready, and backed by the live AICOS agent before it can be selected.
+Runner mode uses the same AICOS sessions and transcript. Interactive chat turns are tracked separately from scheduled work orders: each user message has one user-owned turn execution with a short deadline, so two users' chat messages cannot collapse into the same scheduled-work slot. Scheduled and Forge runner work still use work orders. Runner claim packets carry ids and execution metadata, not the user's free-text request. After claim, the local runner calls the governed AICOS context-load tool, which re-checks seat scope and returns the bounded transcript, session summary, route context, tenant clock, grounding text, and source counts authorized for that turn. For execute-ready runners, the claim also carries a server-built Seat work contract that names the governed runtime profile, the AICOS context-loader tool, and the Seat's permission manifest; action attempts still route through command guards, tool-call audit, and pending confirmations. The runner treats loaded tenant clock, context, and contract as authoritative instead of substituting its own runtime clock, local files, or self-invented authority. A runner must be paired, execute-ready, and backed by the live AICOS agent before it can be selected.
 
-When a runner claims an interactive AICOS turn, the runner reports start and final result back to {{brand}}. The server appends exactly one assistant transcript message for the result, links that message to run evidence, and treats duplicate or late result reports as idempotent. If the runner answer includes a validated in-app link, the web panel can surface the same consent-required navigation suggestion once polling sees that the pending turn is terminal. If a queued, claimed, or running interactive turn passes its short deadline before a runner writes back, the turn is marked offline and the transcript receives a terminal assistant message instead of leaving a permanent "queued" placeholder.
+When a runner claims an interactive AICOS turn, the runner reports start and final result back to {{brand}}. The turn row records claim/start/finish timing, terminal reason, model label, and token counts when the runner or cloud path provides them. The server appends exactly one assistant transcript message for the result, links that message to run evidence, and treats duplicate or late result reports as idempotent. If the runner answer includes a validated in-app link, the web panel can surface the same consent-required navigation suggestion once polling sees that the pending turn is terminal. If a queued, claimed, or running interactive turn passes its short deadline before a runner writes back, the turn is marked offline and the transcript receives a terminal assistant message instead of leaving a permanent "queued" placeholder.
 
 While a runner turn is queued, claimed, or running, the chat panel keeps showing the pending state and polls the session until the answer or terminal status arrives. The composer, model picker, and lane picker are disabled during that active turn so a second browser tab or direct API call cannot overlap another runner turn in the same thread. Terminal runner statuses such as failed, offline, or canceled stay visible only while they are still the latest user turn; if the user continues the conversation in another lane, the stale terminal marker is no longer projected at the bottom of the thread.
 
@@ -44473,7 +44535,7 @@ You can attach images to a message from the composer. {{brand}} accepts PNG, JPE
 
 AICOS can also retrieve bounded summaries from prior sessions owned by the same tenant user and surface them as session-memory read models. Setup-limited users do not retrieve sensitive historical run or company-memory summaries through this path. This is a practical memory seam for AICOS continuity; it is not yet the future Company Brain, and it does not make unaccepted knowledge authoritative.
 
-Platform allowance and BYOK state are checked before routing; an exhausted included allowance keeps AICOS in guided mode and points the user toward BYOK/manual continuation. Because the DER-1068 implementation still uses the deterministic harness, it does not create fake llm_calls rows or settle fake allowance usage; reservation/settlement belongs to the real provider call path.
+Platform allowance and BYOK state are checked before routing; an exhausted included allowance keeps AICOS in guided mode and points the user toward BYOK, billing, or manual continuation. The chat transcript and Settings surface the exhaustion reason and provide direct paths to add a tenant Anthropic key or review the plan. Because the DER-1068 implementation still uses the deterministic harness, it does not create fake llm_calls rows or settle fake allowance usage; reservation/settlement belongs to the real provider call path.
 
 During onboarding, the deterministic harness may execute only explicit low-risk draft actions. In the Responsibility Graph step, a user with setup/action authority can ask AICOS to create one named draft seat per turn; the seat stays vacant, is traceable to the AICOS message through artifact sources, and still needs human review before staffing, Charters, manifests, or go-live. Compass and Charter help remains draft guidance and clarifying questions until the live drafting planner lands. AICOS never silently finishes onboarding, approves Compass or Charter content, signs manifests, goes live, stores credentials, changes autonomy policy, or invites external people; those actions remain human-confirmed.
 
@@ -47281,7 +47343,7 @@ Every notification should include the seat, cause, evidence, and requested decis
     order: 75,
     title: "Local runner guide",
     summary: "How local agent sessions and runner surfaces should operate through {{brand}} without bypassing Charters or audit.",
-    version: "2026-07-05.1",
+    version: "2026-07-07.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -47323,6 +47385,8 @@ Two ways to authenticate and pair \u2014 both first-class, an agent can drive ei
 
 Headless and service accounts are supported first-class: when no usable OS keychain exists (for example a service or SSH account), the CLI stores the session in an owner-only file (directory 0700, file 0600) automatically \u2014 no development flag. That file holds only the CLI session token, never tenant secrets, API keys, or vault refs.
 
+Runner transport defaults to the canonical production host \`https://rost.elevatez.ai\`. The CLI rewrites the old \`https://rost-pink.vercel.app\` alias to the canonical host with a visible warning. External \`http://\` app URLs and non-canonical hosts are refused before pairing, heartbeat, claim, MCP, or result traffic starts; only \`http://localhost\`, \`http://127.0.0.1\`, or the explicit development/preview escape \`ROST_ALLOW_INSECURE_APP_URL=1\` are allowed.
+
 Choose the local runtime with \`--runtime auto|claude|codex\` (default \`auto\`). The same short-lived seat-scoped MCP token and server-side guard apply regardless of runtime; results are tagged \`claude-cli\` or \`codex-cli\`.
 
 For always-on execution, \`runner serve --execute\` heartbeats on its normal interval and also checks for claimable work between heartbeats. The default interactive claim cadence is about one second; set \`RUNNER_INTERACTIVE_CLAIM_MS\` or \`--interactive-claim-ms\` to tune it for a host. Claude-backed turns reuse a per-seat Claude Code resume session when Claude reports a session id, so later turns can run with \`claude --resume <session-id>\` under the local subscription account. The runner stores only the opaque resume id in its owner-only state file; it does not use API-billed managed sessions to make subscription runner turns faster. A resident long-lived Claude/Codex process is still prototype-gated, so do not assume a fixed latency SLA from this guide alone.
@@ -47331,7 +47395,7 @@ The runner bearer secret is stored locally and is never displayed. Each claimed
 
 ## Interactive AICOS runner turns
 
-AICOS runner chat uses the same runner process but not the scheduled work-order queue. The runner claims an \`agent_turn_executions\` item for one user message, starts it, executes the local Claude or Codex runtime with bounded AICOS context, then reports the final assistant answer back to {{brand}}. The transcript write-back is server-owned: one terminal result creates one assistant message, links it to run evidence, and records the final turn status. Retrying the same final report does not append a second answer. If an interactive turn expires while queued, claimed, or running, {{brand}} marks it offline and appends a visible terminal assistant message so the user is not left waiting on a stale queued state.
+AICOS runner chat uses the same runner process but not the scheduled work-order queue. The runner claims an \`agent_turn_executions\` item for one user message, starts it, executes the local Claude or Codex runtime with bounded AICOS context, then reports the final assistant answer back to {{brand}}. Execute-ready AICOS claims include a server-built Seat work contract: the governed runtime profile, the AICOS context-loader tool, and the Seat permission manifest. Actions invoked from that local runtime still pass through command guards, \`tool_calls\` audit, pending confirmations, human gates, and tenant isolation before anything durable changes. The transcript write-back is server-owned: one terminal result creates one assistant message, links it to run evidence, and records the final turn status, terminal reason, timings, model, and token telemetry when present. Retrying the same final report does not append a second answer. If an interactive turn expires while queued, claimed, or running, {{brand}} marks it offline and appends a visible terminal assistant message so the user is not left waiting on a stale queued state.
 
 ## Forge scheduler work
 
@@ -51773,8 +51837,11 @@ async function runDoctor(options) {
   const env = options.env ?? process.env;
   const store = options.store ?? createTokenStore();
   const lines = [`${cliBrand.name} CLI doctor`];
-  const config2 = loadConfig(env);
+  const { config: config2, appUrlWarning } = loadConfigWithDiagnostics(env);
   lines.push(`app_url: ${config2.appUrl}`);
+  if (appUrlWarning) {
+    lines.push(`app_url_warning: ${appUrlWarning}`);
+  }
   lines.push(`supabase_url: ${config2.supabaseUrl}`);
   const currentVersion = await readCliVersion();
   lines.push(`version: ${currentVersion ?? "unknown"}`);
@@ -52902,6 +52969,10 @@ ${usage()}
   }
   options.io.stdout.write(`runner serve: ${options.appUrl} name=${config2.name} execute=${config2.execute}
 `);
+  if (options.appUrlWarning) {
+    options.io.stderr.write(`warning: ${options.appUrlWarning}
+`);
+  }
   options.io.stdout.write(`runner sandbox: ${config2.sandbox.kind} - ${config2.sandbox.reason}
 `);
   if (config2.sandboxNetworkWarning) {
@@ -54399,7 +54470,9 @@ ${programArgsXml}
   <dict>
     <key>${cliBrand.envPrefix}_APP_URL</key>
     <string>${escapePlist(config2.appUrl)}</string>
-    <key>PATH</key>
+${config2.allowDevelopmentAppUrl === true ? `    <key>${allowInsecureAppUrlEnv}</key>
+    <string>1</string>
+` : ""}    <key>PATH</key>
     <string>${escapePlist(config2.servicePath)}</string>
   </dict>
   <key>KeepAlive</key>
@@ -54442,6 +54515,7 @@ ${serviceUsage()}
     io: options.io,
     runnerName: parsed.runnerName,
     appUrl: options.appUrl,
+    allowDevelopmentAppUrl: options.allowDevelopmentAppUrl === true,
     execute: parsed.execute,
     userCode: parsed.userCode,
     nodePath: options.nodePath ?? resolveNodePath(),
@@ -54493,6 +54567,7 @@ async function installService(options) {
     stateFile: paths.stateFile,
     logDir: paths.logDir,
     appUrl: options.appUrl,
+    ...options.allowDevelopmentAppUrl ? { allowDevelopmentAppUrl: true } : {},
     servicePath: buildServicePath(options.nodePath, options.homeDir),
     execute: options.execute
   });
@@ -54860,7 +54935,11 @@ async function pairRunnerOnce(options, safeName, stateFile, userCode) {
   ];
   try {
     await options.exec(options.nodePath, serveArgs, {
-      env: { ...process.env, [`${cliBrand.envPrefix}_APP_URL`]: options.appUrl }
+      env: {
+        ...process.env,
+        [`${cliBrand.envPrefix}_APP_URL`]: options.appUrl,
+        ...options.allowDevelopmentAppUrl === true ? { [allowInsecureAppUrlEnv]: "1" } : {}
+      }
     });
     options.io.stdout.write(`Paired runner ${safeName}.
 `);
@@ -55041,7 +55120,8 @@ async function main(argv = process.argv.slice(2), options = {}) {
 `);
     justLoggedIn = true;
   }
-  const config2 = loadConfig();
+  const configResult = loadConfigWithDiagnostics();
+  const config2 = configResult.config;
   if (command === "runner" && args[0] === "serve") {
     let runnerClient = null;
     if (session) {
@@ -55061,12 +55141,18 @@ async function main(argv = process.argv.slice(2), options = {}) {
       io,
       client: runnerClient,
       appUrl: config2.appUrl,
+      appUrlWarning: configResult.appUrlWarning,
       args: args.slice(1),
       env: process.env
     });
   }
   if (command === "runner" && isRunnerServiceInvocation(args)) {
-    return runRunnerService({ io, args, appUrl: config2.appUrl });
+    return runRunnerService({
+      io,
+      args,
+      appUrl: config2.appUrl,
+      allowDevelopmentAppUrl: process.env[allowInsecureAppUrlEnv] === "1"
+    });
   }
   if (!session) {
     io.stderr.write(`Not logged in. Run ${cliBrand.binName} login first.