@rosthq/cli 0.7.68 → 0.7.69

package/dist/index.js

@@ -472,13 +472,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path7, preserveJsx) {
-  if (typeof path7 === "string" && /^\.\.?\//.test(path7)) {
-    return path7.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
+function __rewriteRelativeImportExtension(path8, preserveJsx) {
+  if (typeof path8 === "string" && /^\.\.?\//.test(path8)) {
+    return path8.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : d + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path7;
+  return path8;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -14027,10 +14027,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path7) {
-  if (!path7)
+function getElementAtPath(obj, path8) {
+  if (!path8)
     return obj;
-  return path7.reduce((acc, key) => acc?.[key], obj);
+  return path8.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -14439,11 +14439,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path7, issues) {
+function prefixIssues(path8, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path7);
+    iss.path.unshift(path8);
     return iss;
   });
 }
@@ -14590,16 +14590,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path7 = []) => {
+  const processError = (error52, path8 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path7, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path8, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path7, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path7, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
       } else {
-        const fullpath = [...path7, ...issue2.path];
+        const fullpath = [...path8, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -14626,17 +14626,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path7 = []) => {
+  const processError = (error52, path8 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path7, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path8, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path7, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path7, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
       } else {
-        const fullpath = [...path7, ...issue2.path];
+        const fullpath = [...path8, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -14668,8 +14668,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path7 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path7) {
+  const path8 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path8) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -27361,13 +27361,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path7 = ref.slice(1).split("/").filter(Boolean);
-  if (path7.length === 0) {
+  const path8 = ref.slice(1).split("/").filter(Boolean);
+  if (path8.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path7[0] === defsKey) {
-    const key = path7[1];
+  if (path8[0] === defsKey) {
+    const key = path8[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -27829,7 +27829,7 @@ var CommandClient = class {
     this.fetchImpl = options.fetchImpl ?? fetch;
   }
   async execute(commandId, body = {}, options = {}) {
-    const path7 = `/api/commands/${encodeURIComponent(commandId)}`;
+    const path8 = `/api/commands/${encodeURIComponent(commandId)}`;
     const headers = {
       authorization: `Bearer ${this.token}`,
       "content-type": "application/json"
@@ -27837,7 +27837,7 @@ var CommandClient = class {
     if (options.targetSeatId !== void 0 && options.targetSeatId.length > 0) {
       headers["x-rost-seat"] = options.targetSeatId;
     }
-    const response = await this.fetchImpl(`${this.appUrl}${path7}`, {
+    const response = await this.fetchImpl(`${this.appUrl}${path8}`, {
       method: "POST",
       headers,
       body: JSON.stringify(body)
@@ -27850,7 +27850,7 @@ var CommandClient = class {
       const snippet = redactSecrets(text.replace(/\s+/g, " ").trim()).slice(0, 200);
       throw new CommandClientError(
         response.status,
-        `server returned HTTP ${response.status} (non-JSON) from ${path7}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
+        `server returned HTTP ${response.status} (non-JSON) from ${path8}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
       );
     }
     const parsed = commandResponseSchema.parse(raw);
@@ -33181,8 +33181,8 @@ var IcebergError = class extends Error {
     return this.status === 419;
   }
 };
-function buildUrl(baseUrl, path7, query) {
-  const url2 = new URL(path7, baseUrl);
+function buildUrl(baseUrl, path8, query) {
+  const url2 = new URL(path8, baseUrl);
   if (query) {
     for (const [key, value] of Object.entries(query)) {
       if (value !== void 0) {
@@ -33212,12 +33212,12 @@ function createFetchClient(options) {
   return {
     async request({
       method,
-      path: path7,
+      path: path8,
       query,
       body,
       headers
     }) {
-      const url2 = buildUrl(options.baseUrl, path7, query);
+      const url2 = buildUrl(options.baseUrl, path8, query);
       const authHeaders = await buildAuthHeaders(options.auth);
       const res = await fetchFn(url2, {
         method,
@@ -34079,7 +34079,7 @@ var StorageFileApi = class extends BaseApiClient {
   * @param path The relative file path. Should be of the format `folder/subfolder/filename.png`. The bucket must already exist before attempting to upload.
   * @param fileBody The body of the file to be stored in the bucket.
   */
-  async uploadOrUpdate(method, path7, fileBody, fileOptions) {
+  async uploadOrUpdate(method, path8, fileBody, fileOptions) {
     var _this = this;
     return _this.handleOperation(async () => {
       let body;
@@ -34103,7 +34103,7 @@ var StorageFileApi = class extends BaseApiClient {
         if ((typeof ReadableStream !== "undefined" && body instanceof ReadableStream || body && typeof body === "object" && "pipe" in body && typeof body.pipe === "function") && !options.duplex) options.duplex = "half";
       }
       if (fileOptions === null || fileOptions === void 0 ? void 0 : fileOptions.headers) for (const [key, value] of Object.entries(fileOptions.headers)) headers = setHeader(headers, key, value);
-      const cleanPath = _this._removeEmptyFolders(path7);
+      const cleanPath = _this._removeEmptyFolders(path8);
       const _path = _this._getFinalPath(cleanPath);
       const data = await (method == "PUT" ? put : post)(_this.fetch, `${_this.url}/object/${_path}`, body, _objectSpread22({ headers }, (options === null || options === void 0 ? void 0 : options.duplex) ? { duplex: options.duplex } : {}));
       return {
@@ -34180,8 +34180,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Upload file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async upload(path7, fileBody, fileOptions) {
-    return this.uploadOrUpdate("POST", path7, fileBody, fileOptions);
+  async upload(path8, fileBody, fileOptions) {
+    return this.uploadOrUpdate("POST", path8, fileBody, fileOptions);
   }
   /**
   * Upload a file with a token generated from `createSignedUploadUrl`.
@@ -34221,9 +34221,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async uploadToSignedUrl(path7, token, fileBody, fileOptions) {
+  async uploadToSignedUrl(path8, token, fileBody, fileOptions) {
     var _this3 = this;
-    const cleanPath = _this3._removeEmptyFolders(path7);
+    const cleanPath = _this3._removeEmptyFolders(path8);
     const _path = _this3._getFinalPath(cleanPath);
     const url2 = new URL(_this3.url + `/object/upload/sign/${_path}`);
     url2.searchParams.set("token", token);
@@ -34292,10 +34292,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `insert`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUploadUrl(path7, options) {
+  async createSignedUploadUrl(path8, options) {
     var _this4 = this;
     return _this4.handleOperation(async () => {
-      let _path = _this4._getFinalPath(path7);
+      let _path = _this4._getFinalPath(path8);
       const headers = _objectSpread22({}, _this4.headers);
       if (options === null || options === void 0 ? void 0 : options.upsert) headers["x-upsert"] = "true";
       const data = await post(_this4.fetch, `${_this4.url}/object/upload/sign/${_path}`, {}, { headers });
@@ -34304,7 +34304,7 @@ var StorageFileApi = class extends BaseApiClient {
       if (!token) throw new StorageError("No token returned by API");
       return {
         signedUrl: url2.toString(),
-        path: path7,
+        path: path8,
         token
       };
     });
@@ -34364,8 +34364,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Update file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async update(path7, fileBody, fileOptions) {
-    return this.uploadOrUpdate("PUT", path7, fileBody, fileOptions);
+  async update(path8, fileBody, fileOptions) {
+    return this.uploadOrUpdate("PUT", path8, fileBody, fileOptions);
   }
   /**
   * Moves an existing file to a new path in the same bucket.
@@ -34516,10 +34516,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUrl(path7, expiresIn, options) {
+  async createSignedUrl(path8, expiresIn, options) {
     var _this8 = this;
     return _this8.handleOperation(async () => {
-      let _path = _this8._getFinalPath(path7);
+      let _path = _this8._getFinalPath(path8);
       const hasTransform = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0;
       let data = await post(_this8.fetch, `${_this8.url}/object/sign/${_path}`, _objectSpread22({ expiresIn }, hasTransform ? { transform: options.transform } : {}), { headers: _this8.headers });
       const query = new URLSearchParams();
@@ -34655,13 +34655,13 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  download(path7, options, parameters) {
+  download(path8, options, parameters) {
     const renderPath = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0 ? "render/image/authenticated" : "object";
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
     if ((options === null || options === void 0 ? void 0 : options.cacheNonce) != null) query.set("cacheNonce", String(options.cacheNonce));
     const queryString = query.toString();
-    const _path = this._getFinalPath(path7);
+    const _path = this._getFinalPath(path8);
     const downloadFn = () => get(this.fetch, `${this.url}/${renderPath}/${_path}${queryString ? `?${queryString}` : ""}`, {
       headers: this.headers,
       noResolveJson: true
@@ -34692,9 +34692,9 @@ var StorageFileApi = class extends BaseApiClient {
   * }
   * ```
   */
-  async info(path7) {
+  async info(path8) {
     var _this10 = this;
-    const _path = _this10._getFinalPath(path7);
+    const _path = _this10._getFinalPath(path8);
     return _this10.handleOperation(async () => {
       return recursiveToCamel(await get(_this10.fetch, `${_this10.url}/object/info/${_path}`, { headers: _this10.headers }));
     });
@@ -34715,9 +34715,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   .exists('folder/avatar1.png')
   * ```
   */
-  async exists(path7) {
+  async exists(path8) {
     var _this11 = this;
-    const _path = _this11._getFinalPath(path7);
+    const _path = _this11._getFinalPath(path8);
     try {
       await head(_this11.fetch, `${_this11.url}/object/${_path}`, { headers: _this11.headers });
       return {
@@ -34796,8 +34796,8 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  getPublicUrl(path7, options) {
-    const _path = this._getFinalPath(path7);
+  getPublicUrl(path8, options) {
+    const _path = this._getFinalPath(path8);
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.download) query.set("download", options.download === true ? "" : options.download);
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
@@ -34936,10 +34936,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async list(path7, options, parameters) {
+  async list(path8, options, parameters) {
     var _this13 = this;
     return _this13.handleOperation(async () => {
-      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path7 || "" });
+      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path8 || "" });
       return await post(_this13.fetch, `${_this13.url}/object/list/${_this13.bucketId}`, body, { headers: _this13.headers }, parameters);
     });
   }
@@ -35004,11 +35004,11 @@ var StorageFileApi = class extends BaseApiClient {
     if (typeof Buffer !== "undefined") return Buffer.from(data).toString("base64");
     return btoa(data);
   }
-  _getFinalPath(path7) {
-    return `${this.bucketId}/${path7.replace(/^\/+/, "")}`;
+  _getFinalPath(path8) {
+    return `${this.bucketId}/${path8.replace(/^\/+/, "")}`;
   }
-  _removeEmptyFolders(path7) {
-    return path7.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
+  _removeEmptyFolders(path8) {
+    return path8.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
   }
   /** Modifies the `query`, appending values the from `transform` */
   applyTransformOptsToQuery(query, transform2) {
@@ -40919,6 +40919,23 @@ var goalListMeasurablesOutputSchema = external_exports.object({
   goal_id: uuidSchema8,
   bindings: external_exports.array(goalMeasurableBindingSchema)
 }).strict();
+var goalCoreSchema = external_exports.object({
+  id: uuidSchema8,
+  title: external_exports.string(),
+  kind: external_exports.enum(["objective", "cycle_goal", "company_objective", "seat_goal", "milestone"]),
+  status: goalStatusSchema,
+  status_source: goalStatusSourceSchema,
+  progress_pct: external_exports.number().int().min(0).max(100).nullable(),
+  seat_id: uuidSchema8.nullable(),
+  parent_goal_id: uuidSchema8.nullable(),
+  definition_of_done: external_exports.string()
+}).strict();
+var goalGetInputSchema = external_exports.object({
+  goal_id: uuidSchema8
+}).strict();
+var goalGetOutputSchema = external_exports.object({
+  goal: goalCoreSchema
+}).strict();
 var issueStatusSchema = external_exports.enum(["open", "diagnosing", "resolved", "dropped"]);
 var frictionListInputSchema = external_exports.object({
   status: external_exports.enum(["open", "diagnosing", "resolved", "dropped", "active", "all"]).optional()
@@ -40941,6 +40958,28 @@ var frictionIssueSummarySchema = external_exports.object({
 var frictionListOutputSchema = external_exports.object({
   issues: external_exports.array(frictionIssueSummarySchema)
 }).strict();
+var frictionIssueDetailSchema = frictionIssueSummarySchema.extend({
+  raised_by_seat_type: external_exports.enum(["human", "agent", "hybrid"]),
+  raised_by_seat_steward_name: external_exports.string().nullable(),
+  origin_actor_kind: external_exports.enum(["user", "agent", "system"]).nullable(),
+  origin_actor_id: uuidSchema8.nullable(),
+  evidence: external_exports.unknown(),
+  action_task_title: external_exports.string().nullable(),
+  action_task_owner_seat_id: uuidSchema8.nullable(),
+  action_task_owner_seat_name: external_exports.string().nullable(),
+  action_task_due_on: external_exports.string().nullable(),
+  decision_id: uuidSchema8.nullable(),
+  decision_title: external_exports.string().nullable(),
+  decision_summary: external_exports.string().nullable(),
+  decided_by_name: external_exports.string().nullable(),
+  updated_at: external_exports.string()
+}).strict();
+var frictionGetInputSchema = external_exports.object({
+  issue_id: uuidSchema8
+}).strict();
+var frictionGetOutputSchema = external_exports.object({
+  issue: frictionIssueDetailSchema
+}).strict();
 var frictionUpdateStatusInputSchema = external_exports.object({
   issue_id: uuidSchema8,
   status: external_exports.enum(["open", "diagnosing"])
@@ -40952,17 +40991,34 @@ var frictionUpdateStatusOutputSchema = external_exports.object({
 }).strict();
 var frictionResolveInputSchema = external_exports.object({
   issue_id: uuidSchema8,
+  resolution_mode: external_exports.enum(["ids", "already_fixed"]).default("ids"),
   root_cause: external_exports.string().trim().min(1),
-  owner_seat_id: uuidSchema8,
-  task_title: external_exports.string().trim().min(1),
-  task_description: external_exports.string().trim().min(1),
-  done_by: dateOnlySchema,
+  owner_seat_id: uuidSchema8.optional(),
+  task_title: external_exports.string().trim().min(1).optional(),
+  task_description: external_exports.string().trim().min(1).optional(),
+  done_by: dateOnlySchema.optional(),
   resolving_seat_id: uuidSchema8.optional()
-}).strict();
+}).strict().superRefine((value, ctx) => {
+  if (value.resolution_mode !== "ids") {
+    return;
+  }
+  if (value.owner_seat_id === void 0) {
+    ctx.addIssue({ code: "custom", path: ["owner_seat_id"], message: 'Required for resolution_mode "ids".' });
+  }
+  if (value.task_title === void 0) {
+    ctx.addIssue({ code: "custom", path: ["task_title"], message: 'Required for resolution_mode "ids".' });
+  }
+  if (value.task_description === void 0) {
+    ctx.addIssue({ code: "custom", path: ["task_description"], message: 'Required for resolution_mode "ids".' });
+  }
+  if (value.done_by === void 0) {
+    ctx.addIssue({ code: "custom", path: ["done_by"], message: 'Required for resolution_mode "ids".' });
+  }
+});
 var frictionResolveOutputSchema = external_exports.object({
   issue_id: uuidSchema8,
   status: external_exports.literal("resolved"),
-  action_task_id: uuidSchema8,
+  action_task_id: uuidSchema8.nullable(),
   decision_id: uuidSchema8
 }).strict();
 var frictionLinkTaskInputSchema = external_exports.object({
@@ -41565,6 +41621,18 @@ var compassShowMarkdownInputSchema = external_exports.object({}).strict();
 var charterShowMarkdownInputSchema = external_exports.object({
   seat_id: uuidSchema9
 }).strict();
+var charterShowMarkdownOutputSchema = external_exports.object({
+  markdown: external_exports.string().min(1),
+  charter_version_id: uuidSchema9.nullable(),
+  seat_id: uuidSchema9,
+  version: external_exports.number().int().nonnegative().nullable(),
+  status: external_exports.string().nullable(),
+  doc: external_exports.unknown().nullable(),
+  dry_run: external_exports.object({
+    status: external_exports.enum(["passed", "failed"]),
+    summary: external_exports.string()
+  }).strict().nullable()
+}).strict();
 var agentShowMarkdownInputSchema = external_exports.object({
   seat_id: uuidSchema9
 }).strict();
@@ -41799,6 +41867,27 @@ var confirmationRejectOutputSchema = external_exports.object({
   command_id: external_exports.string().min(1),
   rejected: external_exports.literal(true)
 }).strict();
+var confirmationListInputSchema = external_exports.object({
+  limit: external_exports.number().int().min(1).max(200).optional()
+}).strict();
+var confirmationSummarySchema = external_exports.object({
+  id: uuidSchema10,
+  command_id: external_exports.string(),
+  redacted_args: external_exports.unknown(),
+  actor_kind: external_exports.enum(["user", "agent", "system"]),
+  source: external_exports.string(),
+  scope_kind: external_exports.enum(["tenant_admin", "tenant", "seat"]),
+  seat_id: uuidSchema10.nullable(),
+  seat_name: external_exports.string().nullable(),
+  seat_type: external_exports.enum(["human", "agent", "hybrid"]).nullable(),
+  risk_level: external_exports.enum(["normal", "sensitive", "dangerous"]),
+  summary: external_exports.string(),
+  expires_at: external_exports.string(),
+  created_at: external_exports.string()
+}).strict();
+var confirmationListOutputSchema = external_exports.object({
+  confirmations: external_exports.array(confirmationSummarySchema)
+}).strict();
 var credentialIngressInputSchema = external_exports.object({
   seat_id: uuidSchema10.optional(),
   provider: external_exports.string().trim().min(1),
@@ -46261,7 +46350,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-12.2",
+    version: "2026-07-12.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -46834,6 +46923,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_skip_charter_draft\` | \`charter.skip\` | Mark a Charter draft as skipped. | Seat or tenant-admin | Call only when a human defers the seat. |
 | \`rost_apply_charter_seat_type_recommendation\` | \`charter.apply_seat_type_recommendation\` | Apply a Charter's seat-type recommendation. | Seat or tenant-admin | Call after reviewing the draft. |
 | \`rost_sign_charter_manifest\` | \`charter.sign_manifest\` | Request human confirmation for a permission manifest. | Seat or tenant-admin | Use after tool permissions are reviewed. |
+| \`rost_list_pending_confirmations\` | \`confirmation.list\` | List in-flight confirmations awaiting a human decision, scoped to the caller's authority (owner sees all; a member sees seats they occupy; an agent sees its own seat). | Seat or tenant-admin | Call with \`{}\`. |
 | \`rost_draft_compass\` | \`compass.draft\` | Create a Compass draft. | Tenant | Call with a concise Compass document. |
 | \`rost_update_compass_draft\` | \`compass.update_draft\` | Replace a Compass draft document. | Tenant | Call with the \`compass_version_id\` from \`compass.draft\` as \`draft_id\` and the updated document. |
 | \`rost_approve_compass_version\` | \`compass.approve_version\` | Activate a Compass version by supersession. | Tenant | Call after human review. |
@@ -46934,6 +47024,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_import_rocks_from_a_ninety_rocks_export\` | \`cascade.import\` | Bulk-import Rocks as Cascade cycle goals under a company objective in the active cycle (from a ninety Rocks export). Owners resolve to seats; idempotent re-import skips a cycle goal already imported for the same objective + seat + title. | Tenant | Call with the parsed \`rocks\` array. |
 | \`rost_import_a_ninety_v_to_into_a_compass_draft\` | \`compass.import\` | AI-draft a Compass from a ninety V/TO (Core Values \u2192 principles, 10/3/1-Year \u2192 horizon goals, Rocks \u2192 cycle objectives), landed as a draft a human confirms by supersession \u2014 never an accepted Compass. Idempotent by document content (a re-upload of the same V/TO short-circuits without re-drafting). | Tenant | Call with the extracted V/TO \`text\` (and optional \`source_name\`). |
 | \`rost_list_cascade_goals\` | \`goal.list\` | List Cascade goals, optionally by cycle or seat. | Seat or tenant-admin | Call with \`{}\` or \`{"cycle_id":"<id>"}\`. |
+| \`rost_get_cascade_goal\` | \`goal.get\` | Get one goal's core detail and status by id. Seat-scoped callers may only read their own seat's goals. | Seat or tenant-admin | Call with \`{"goal_id":"<id>"}\`. |
 | \`rost_list_a_cascade_goals_signals\` | \`goal.list_measurables\` | List the goal's status-driving Signal binding (role drives_status; 0-or-1 per goal) with its current indicator and latest confirmed reading. Driver-only \u2014 informs bindings (direct indicators) are not returned. Read-only. | Seat or tenant-admin | Call with \`{"goal_id":"<id>"}\`. |
 | \`rost_create_cascade_goal\` | \`goal.create\` | Create a cycle goal under an objective. | Tenant | Call with cycle, seat, parent, title, definition of done. |
 | \`rost_update_cascade_goal\` | \`goal.update\` | Update a goal's title or definition of done. | Tenant | Call with \`goal_id\` and the changed fields. |
@@ -46946,6 +47037,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_reparent_cascade_goal\` | \`goal.reparent\` | Move a goal under a new parent. | Tenant | Authority change; expect confirmation. |
 | \`rost_drop_cascade_goal\` | \`goal.drop\` | Drop (retire) a goal, retained for audit. | Tenant | Expect confirmation. |
 | \`rost_list_friction_issues\` | \`friction.list\` | List Friction issues ranked by impact and severity. | Seat or tenant-admin | Call with \`{}\` or \`{"status":"active"}\`. |
+| \`rost_get_friction_issue\` | \`friction.get\` | Get full detail for one Friction issue by id. | Seat or tenant-admin | Call with \`{"issue_id":"<id>"}\`. |
 | \`rost_assist_friction_issue\` | \`friction.assist\` | Advisory IDS assist: the most-similar prior resolved issues with their root causes and decisions, a recurring-pattern flag, and recommended options. Read-only \u2014 it never resolves the issue. | Tenant | Call with \`{"issue_id":"<id>"}\`. |
 | \`rost_update_friction_issue_status\` | \`friction.update_status\` | Move a non-terminal issue between open and diagnosing. | Seat or tenant-admin | Call with \`issue_id\` and \`status\`. |
 | \`rost_resolve_friction_issue\` | \`friction.resolve\` | Resolve an issue with a root cause and remediation task. | Tenant | Human decision; expect confirmation. |
@@ -47516,6 +47608,7 @@ Retrieve the narrowest relevant guide before making a setup recommendation. Pref
       "compass.approve_version",
       "onboarding.finish",
       "goal.list",
+      "goal.get",
       "goal.create",
       "goal.update",
       "goal.set_status",
@@ -47735,6 +47828,7 @@ Agents may record readings when the Charter allows it. Agent-reported readings s
       "compass.answer_gap",
       "friction.file_issue",
       "friction.list",
+      "friction.get",
       "friction.assist",
       "friction.update_status",
       "friction.resolve",
@@ -47881,7 +47975,7 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "charter_design", "staffing", "operating_rhythm"],
-    relatedCommandIds: ["confirmation.approve", "confirmation.reject", "charter.approve", "agent.go_live", "credential.ingress", "mcp_token.create", "staffing.assign_user", "goal.reparent", "friction.resolve"],
+    relatedCommandIds: ["confirmation.approve", "confirmation.list", "confirmation.reject", "charter.approve", "agent.go_live", "credential.ingress", "mcp_token.create", "staffing.assign_user", "goal.reparent", "friction.resolve"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native human-gate guidance."] },
     sources: [
       {
@@ -50026,6 +50120,11 @@ function helpText() {
   ].join("\n");
 }
 
+// src/update-check.ts
+import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import path2 from "node:path";
+
 // src/cli-version.ts
 import { readFile as readFile2 } from "node:fs/promises";
 import { dirname as dirname2, resolve } from "node:path";
@@ -50047,15 +50146,23 @@ async function readCliVersion() {
 var latestPackageSchema = external_exports.object({
   version: external_exports.string()
 });
-async function maybePrintUpgradeNudge(io) {
-  if (process.env.CI || process.env.VITEST || process.env.CLI_SKIP_UPDATE_CHECK === "1") {
+var updateCheckStateSchema = external_exports.object({ lastNaggedOn: external_exports.string() }).strict();
+async function maybePrintUpgradeNudge(io, options = {}) {
+  if (!options.skipEnvGuard && (process.env.CI || process.env.VITEST || process.env.CLI_SKIP_UPDATE_CHECK === "1")) {
+    return;
+  }
+  const statePath = options.statePath ?? defaultUpdateCheckStatePath();
+  const today = toUtcDateOnly(options.now ?? /* @__PURE__ */ new Date());
+  const state = await readUpdateCheckState(statePath);
+  if (state?.lastNaggedOn === today) {
     return;
   }
   const currentVersion = await readCliVersion();
   if (!currentVersion || currentVersion === "0.0.0") {
     return;
   }
-  const latestVersion = await fetchLatestVersion(cliBrand.packageName);
+  const fetchLatest = options.fetchLatest ?? fetchLatestVersion;
+  const latestVersion = await fetchLatest(cliBrand.packageName);
   if (!latestVersion || !isSemverBehind(currentVersion, latestVersion)) {
     return;
   }
@@ -50063,6 +50170,28 @@ async function maybePrintUpgradeNudge(io) {
     `A newer ${cliBrand.binName} CLI is available: ${currentVersion} -> ${latestVersion}. Upgrade with npm i -g ${cliBrand.packageName}@latest.
 `
   );
+  await writeUpdateCheckStateBestEffort(statePath, { lastNaggedOn: today });
+}
+function defaultUpdateCheckStatePath() {
+  return path2.join(homedir2(), ".config", cliBrand.binName, "update-check.json");
+}
+function toUtcDateOnly(date5) {
+  return date5.toISOString().slice(0, 10);
+}
+async function readUpdateCheckState(statePath) {
+  try {
+    return updateCheckStateSchema.parse(JSON.parse(await readFile3(statePath, "utf8")));
+  } catch {
+    return null;
+  }
+}
+async function writeUpdateCheckStateBestEffort(statePath, state) {
+  try {
+    await mkdir2(path2.dirname(statePath), { recursive: true, mode: 448 });
+    await writeFile2(statePath, `${JSON.stringify(state)}
+`, { mode: 384 });
+  } catch {
+  }
 }
 async function fetchLatestVersion(packageName) {
   const controller = new AbortController();
@@ -50168,6 +50297,7 @@ var COMMAND_MANIFEST = [
   { "id": "compass.show_markdown", "namespace": "compass", "action": "show_markdown", "title": "Show Compass as markdown", "description": "Compose the current Compass and its open gaps into a clean, human-skimmable markdown card for review.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Render the current Compass and its open gaps as a clean markdown card to show your human a quick review." },
   { "id": "compass.update_draft", "namespace": "compass", "action": "update_draft", "title": "Update Compass draft", "description": "Replace a draft Compass document.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "draft_id", "flag": "draft-id", "type": "string", "required": true }], "hasComplexInput": true, "help": "Pass the compass_version_id returned by compass.draft as draft_id; update_draft replaces only an unpublished draft in this tenant." },
   { "id": "confirmation.approve", "namespace": "confirmation", "action": "approve", "title": "Approve pending confirmation", "description": "Approve an in-flight confirmation and execute the original command as the approving human.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }, { "name": "reviewed", "flag": "reviewed", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Approve pending confirmations only when the requested durable change is clear to the human owner." },
+  { "id": "confirmation.list", "namespace": "confirmation", "action": "list", "title": "List pending confirmations", "description": "List in-flight confirmations awaiting a human decision, scoped to the caller's authority (owner sees all; a member sees seats they occupy; an agent sees its own seat).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List pending confirmations awaiting a human decision before approving or rejecting them." },
   { "id": "confirmation.reject", "namespace": "confirmation", "action": "reject", "title": "Reject pending confirmation", "description": "Reject an in-flight confirmation without executing the original command.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Reject pending confirmations when authority, evidence, or human intent is unclear." },
   { "id": "credential.ingress", "namespace": "credential", "action": "ingress", "title": "Store credential", "description": "Store a secret through the vault and persist only the credential vault reference.", "requiredScope": "seat", "confirmation": "credential_flow", "exposeOverMcp": false, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "scope_description", "flag": "scope-description", "type": "string", "required": true }, { "name": "secret_name", "flag": "secret-name", "type": "string", "required": true }], "hasComplexInput": false, "secretBlocked": true, "help": "Ingress credentials only through vault-backed flows; never place raw secrets in prompts, logs, or docs." },
   { "id": "deliverable.accept", "namespace": "deliverable", "action": "accept", "title": "Accept deliverable value", "description": "Record a human-confirmed accepted value (USD) on a deliverable. Humans decide; agents cannot self-accept. Re-accepting records a correction as a new event; prior events are never mutated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "deliverable_id", "flag": "deliverable-id", "type": "string", "required": true }, { "name": "impact_value_usd", "flag": "impact-value-usd", "type": "number", "required": true }], "hasComplexInput": false, "help": "Record a human-confirmed accepted value (USD) on a deliverable; owner-only and human-gated. Humans decide \u2014 agents cannot self-accept. Re-accepting records a correction as a new event." },
@@ -50185,14 +50315,16 @@ var COMMAND_MANIFEST = [
   { "id": "escalation.resolve", "namespace": "escalation", "action": "resolve", "title": "Resolve escalation", "description": "Approve an open escalation (or convert it to Friction). Writes a human decision; agents cannot resolve.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": false, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }, { "name": "action", "flag": "action", "type": "enum", "required": false, "enumValues": ["approve", "convert_to_issue"] }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": false, "help": "Resolve an escalation as a human Steward; the decision records decided_by as the approving human. Agents cannot resolve." },
   { "id": "friction.assist", "namespace": "friction", "action": "assist", "title": "Assist Friction issue", "description": "Advisory IDS assist for an issue: the most-similar prior resolved issues with their root causes and decisions, a recurring-pattern flag, and recommended options. Read-only \u2014 it never resolves the issue.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "issue_id", "flag": "issue-id", "type": "string", "required": true }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "Advisory IDS assist: the most-similar prior resolved issues with their root causes and decisions, plus a recurring-pattern flag. Read-only \u2014 it never resolves the issue." },
   { "id": "friction.file_issue", "namespace": "friction", "action": "file_issue", "title": "File Friction issue", "description": "Emit an issue event and open a Friction issue raised by the acting seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "summary", "flag": "summary", "type": "string", "required": true }, { "name": "blocking_goal_id", "flag": "blocking-goal-id", "type": "string", "required": false }, { "name": "broken_measurable_id", "flag": "broken-measurable-id", "type": "string", "required": false }, { "name": "severity", "flag": "severity", "type": "enum", "required": true, "enumValues": ["low", "med", "high", "critical"] }], "hasComplexInput": true, "help": "File a Friction issue with evidence when a goal or measurable is blocked or broken." },
+  { "id": "friction.get", "namespace": "friction", "action": "get", "title": "Get Friction issue", "description": "Get full detail for one Friction issue by id.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "issue_id", "flag": "issue-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Get full detail for one Friction issue by id, including its root cause, action task, and resolution decision when present." },
   { "id": "friction.import", "namespace": "friction", "action": "import", "title": "Import Friction issues from a ninety Issues List", "description": "Bulk-import a ninety Issues List export into Friction. Owners are seat names resolved to seats; each issue is raised by the resolved seat and attributed to the importing human. Idempotent \u2014 re-importing the same export is a no-op, and an existing open issue with the same seat + summary is skipped.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "dry_run", "flag": "dry-run", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Import a ninety Issues List export into Friction; owners resolve to seats, idempotent by file + seat/summary." },
   { "id": "friction.link_task", "namespace": "friction", "action": "link_task", "title": "Link task to Friction issue", "description": "Attach an existing tenant task as the action task for a non-terminal issue. Both ids must belong to the tenant.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "issue_id", "flag": "issue-id", "type": "string", "required": true }, { "name": "task_id", "flag": "task-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Attach an existing task as the action task for a non-terminal issue." },
   { "id": "friction.list", "namespace": "friction", "action": "list", "title": "List Friction issues", "description": "List Friction issues ranked by status, impact, and severity. Defaults to active (open + diagnosing).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "status", "flag": "status", "type": "enum", "required": false, "enumValues": ["open", "diagnosing", "resolved", "dropped", "active", "all"] }], "hasComplexInput": false, "help": "List Friction issues ranked by impact and severity to find the issue id before updating or resolving it." },
-  { "id": "friction.resolve", "namespace": "friction", "action": "resolve", "title": "Resolve Friction issue", "description": "Resolve an issue with a root cause and remediation task. This records a human decision (decided_by) and creates the follow-up task in one transaction.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "issue_id", "flag": "issue-id", "type": "string", "required": true }, { "name": "root_cause", "flag": "root-cause", "type": "string", "required": true }, { "name": "owner_seat_id", "flag": "owner-seat-id", "type": "string", "required": true }, { "name": "task_title", "flag": "task-title", "type": "string", "required": true }, { "name": "task_description", "flag": "task-description", "type": "string", "required": true }, { "name": "done_by", "flag": "done-by", "type": "string", "required": true }, { "name": "resolving_seat_id", "flag": "resolving-seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Resolve an issue with a root cause and remediation task; resolution is a human decision." },
+  { "id": "friction.resolve", "namespace": "friction", "action": "resolve", "title": "Resolve Friction issue", "description": 'Resolve an issue with a root cause. In the default "ids" resolution_mode this also creates a remediation follow-up task; "already_fixed" records only the root cause (no follow-up task). Always records a human decision (decided_by) in the same transaction.', "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "issue_id", "flag": "issue-id", "type": "string", "required": true }, { "name": "resolution_mode", "flag": "resolution-mode", "type": "enum", "required": false, "enumValues": ["ids", "already_fixed"] }, { "name": "root_cause", "flag": "root-cause", "type": "string", "required": true }, { "name": "owner_seat_id", "flag": "owner-seat-id", "type": "string", "required": false }, { "name": "task_title", "flag": "task-title", "type": "string", "required": false }, { "name": "task_description", "flag": "task-description", "type": "string", "required": false }, { "name": "done_by", "flag": "done-by", "type": "string", "required": false }, { "name": "resolving_seat_id", "flag": "resolving-seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Resolve an issue with a root cause and remediation task; resolution is a human decision." },
   { "id": "friction.update_status", "namespace": "friction", "action": "update_status", "title": "Update Friction issue status", "description": "Move a non-terminal issue between open and diagnosing. Terminal issues (resolved/dropped) cannot be reopened here.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "issue_id", "flag": "issue-id", "type": "string", "required": true }, { "name": "status", "flag": "status", "type": "enum", "required": true, "enumValues": ["open", "diagnosing"] }], "hasComplexInput": false, "help": "Move a non-terminal issue between open and diagnosing while it is being worked." },
   { "id": "goal.bind_measurable", "namespace": "goal", "action": "bind_measurable", "title": "Bind a Signal to a Cascade goal", "description": "Bind a measurable to a goal. Role defaults to 'informs' \u2014 a conservative informative indicator allowed at any goal level (many per goal) that never changes goal status. Role 'drives_status' makes it the goal's status driver: allowed only on a childless seat goal or milestone, at most one per goal, and auto-status starts OFF until a steward opts in with goal.set_auto_status. Binding is human-gated.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }, { "name": "measurable_id", "flag": "measurable-id", "type": "string", "required": true }, { "name": "role", "flag": "role", "type": "enum", "required": false, "enumValues": ["drives_status", "informs"] }], "hasComplexInput": false, "help": "Bind a Signal to a goal. Defaults to role informs (a conservative indicator at any level that never changes status); pass role drives_status to make it a childless leaf goal's status driver (auto-status starts OFF until a steward opts in)." },
   { "id": "goal.create", "namespace": "goal", "action": "create", "title": "Create Cascade goal", "description": "Create a cycle goal under an existing objective. The parent chain must terminate at a Compass objective in the same cycle (enforced server-side).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "cycle_id", "flag": "cycle-id", "type": "string", "required": true }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "parent_goal_id", "flag": "parent-goal-id", "type": "string", "required": true }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "definition_of_done", "flag": "definition-of-done", "type": "string", "required": true }, { "name": "status", "flag": "status", "type": "enum", "required": false, "enumValues": ["on", "off"] }], "hasComplexInput": false, "help": "Create cycle goals under an existing objective; the parent chain must terminate at a Compass objective." },
   { "id": "goal.drop", "namespace": "goal", "action": "drop", "title": "Drop Cascade goal", "description": "Drop (retire) a goal by setting status to dropped. Dropping retires the commitment, so it is human-gated. The row is retained for audit (never deleted).", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Drop a goal to retire a commitment; the goal is retained for audit and dropping is human-gated." },
+  { "id": "goal.get", "namespace": "goal", "action": "get", "title": "Get Cascade goal", "description": "Get one goal's core detail and status by id. Seat-scoped callers may only read their own seat's goals.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Get one goal's core detail and status by id; seat tokens may only read their own goals." },
   { "id": "goal.list", "namespace": "goal", "action": "list", "title": "List Cascade goals", "description": "List goals in the tenant, optionally filtered by cycle or seat. Seat-scoped callers see only their own seat's goals.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "cycle_id", "flag": "cycle-id", "type": "string", "required": false }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "List Cascade goals to find goal ids, parentage, and seat ownership before mutating the tree." },
   { "id": "goal.list_at_risk", "namespace": "goal", "action": "list_at_risk", "title": "List at-risk Cascade goals", "description": "List goals projected to miss their cycle pace (at-risk or projected-miss), with how many days behind pace. Read-only; status-only goals (no progress) are excluded.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List goals projected off pace (at-risk or projected-miss), with how many days behind pace. Read-only; status-only goals are excluded." },
   { "id": "goal.list_measurables", "namespace": "goal", "action": "list_measurables", "title": "List a Cascade goal's Signals", "description": "List the status-driver Signal bound to a Cascade goal (role drives_status), with its current signal indicator and latest confirmed reading. Read-only. Informative (informs) bindings appear in the goal-detail panel's Direct indicators, not here.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "List the Signals bound to a goal (role drives_status) with each one's current indicator and latest confirmed reading." },
@@ -50497,6 +50629,19 @@ function execute(context, parsed, commandId, body, format) {
 }
 
 // src/generator/flags.ts
+var SEAT_FLAG_FILLS_REQUIRED_SEAT_ID = /* @__PURE__ */ new Set([
+  "agent.status",
+  "agent.show_markdown",
+  "agent.get_run",
+  "agent.list_runs",
+  "agent.list_tool_calls",
+  "charter.show_markdown",
+  "seat.get",
+  "seat.decommission_preview",
+  "deliverable.get",
+  "deliverable.list",
+  "skill.check_dependencies"
+]);
 function booleanFlagsFor(entry, overrides = {}) {
   const booleanFields = new Set(entry.fields.filter((field3) => field3.type === "boolean").map((field3) => field3.name));
   const flags = /* @__PURE__ */ new Set(["yes", "y"]);
@@ -50586,6 +50731,9 @@ function buildBodyFromFlags(entry, parsed, positional, overrides = {}) {
     if (raw === void 0 && positional !== void 0 && overrides.primaryPositional === field3.name) {
       raw = positional;
     }
+    if (raw === void 0 && field3.name === "seat_id" && (!field3.required || SEAT_FLAG_FILLS_REQUIRED_SEAT_ID.has(entry.id))) {
+      raw = parsed.seat;
+    }
     if (raw === void 0 || raw.length === 0) {
       continue;
     }
@@ -50990,6 +51138,15 @@ function renderGoalStatus(output) {
   const record2 = asRecord(output);
   return `Goal ${field(record2, "goal_id")} status set to ${field(record2, "status")}.`;
 }
+function renderGoalGet(output) {
+  const record2 = asRecord(asRecord(output).goal);
+  return [
+    `${field(record2, "id")}  ${field(record2, "status")}  ${field(record2, "title")}`,
+    `kind: ${field(record2, "kind")}  status source: ${field(record2, "status_source")}`,
+    `progress: ${field(record2, "progress_pct")}`,
+    `definition of done: ${field(record2, "definition_of_done")}`
+  ].join("\n");
+}
 function renderGoalReparent(output) {
   const record2 = asRecord(output);
   return `Goal ${field(record2, "goal_id")} reparented under ${field(record2, "parent_goal_id")}.`;
@@ -51020,6 +51177,27 @@ function renderFrictionLink(output) {
   const record2 = asRecord(output);
   return `Linked task ${field(record2, "action_task_id")} to issue ${field(record2, "issue_id")}.`;
 }
+function renderFrictionGet(output) {
+  const record2 = asRecord(asRecord(output).issue);
+  return [
+    `${field(record2, "issue_id")}  ${field(record2, "status")}  ${field(record2, "severity")}`,
+    `summary: ${field(record2, "summary")}`,
+    `raised by: ${field(record2, "raised_by_seat_name")}`,
+    `impact score: ${field(record2, "impact_score")}`,
+    `root cause: ${field(record2, "root_cause")}`,
+    `action task: ${field(record2, "action_task_id")}`
+  ].join("\n");
+}
+function renderConfirmationList(output) {
+  const confirmations = asArray(asRecord(output).confirmations);
+  if (confirmations.length === 0) {
+    return "No pending confirmations.";
+  }
+  return confirmations.map((entry) => {
+    const record2 = asRecord(entry);
+    return `${field(record2, "id")}  ${field(record2, "risk_level")}  ${field(record2, "command_id")}  ${field(record2, "summary")}`;
+  }).join("\n");
+}
 function renderEscalationList(output) {
   const escalations = asArray(asRecord(output).escalations);
   if (escalations.length === 0) {
@@ -51922,7 +52100,8 @@ var GROUP_SPECS = {
       list: { commandId: "goal.list", render: renderGoalList },
       create: { commandId: "goal.create", render: renderGoalCreate },
       update: { commandId: "goal.update", handler: goalUpdateHandler, render: renderGoalUpdate },
-      status: { commandId: "goal.set_status", render: renderGoalStatus },
+      status: { commandId: "goal.get", render: renderGoalGet, primaryPositional: "goal_id" },
+      "set-status": { commandId: "goal.set_status", render: renderGoalStatus },
       reparent: { commandId: "goal.reparent", render: renderGoalReparent },
       drop: { commandId: "goal.drop", render: renderGoalDrop }
     }
@@ -51946,6 +52125,7 @@ var GROUP_SPECS = {
   friction: {
     verbs: {
       list: { commandId: "friction.list", render: renderFrictionList },
+      get: { commandId: "friction.get", render: renderFrictionGet, primaryPositional: "issue_id" },
       file: { commandId: "friction.file_issue", handler: frictionFileHandler, render: renderFrictionFile },
       resolve: { commandId: "friction.resolve", render: renderFrictionResolve },
       link: { commandId: "friction.link_task", render: renderFrictionLink },
@@ -51967,7 +52147,7 @@ var GROUP_SPECS = {
     verbs: {
       list: { commandId: "escalation.list", render: renderEscalationList },
       get: { commandId: "escalation.get", render: renderEscalationGet, primaryPositional: "id" },
-      resolve: { commandId: "escalation.resolve", render: renderEscalationResolve },
+      resolve: { commandId: "escalation.resolve", render: renderEscalationResolve, primaryPositional: "id" },
       reject: { commandId: "escalation.reject", render: renderEscalationReject }
     }
   },
@@ -52089,6 +52269,11 @@ var GROUP_SPECS = {
     verbs: {
       health: { commandId: "system.health", handler: systemHealthHandler, render: formatSystemHealth }
     }
+  },
+  confirmation: {
+    verbs: {
+      list: { commandId: "confirmation.list", render: renderConfirmationList }
+    }
   }
 };
 
@@ -52378,7 +52563,7 @@ function ensureTrailingSlash2(value) {
 // src/skills.ts
 import { existsSync, mkdirSync, readFileSync as readFileSync3, rmSync, writeFileSync } from "node:fs";
 import os from "node:os";
-import path2 from "node:path";
+import path3 from "node:path";
 var UsageError2 = class extends Error {
 };
 var CLIENTS = /* @__PURE__ */ new Set(["claude-code", "codex", "cursor"]);
@@ -52573,8 +52758,8 @@ function writeInstalls(output, root) {
     const slug2 = safeLocalSlug(String(install.slug ?? ""));
     const metadata = asRecord2(install.metadata);
     const files = asArray2(install.files).map(asRecord2);
-    const dir = path2.join(root, slug2);
-    const metadataPath = path2.join(dir, ".rost-skill.json");
+    const dir = path3.join(root, slug2);
+    const metadataPath = path3.join(dir, ".rost-skill.json");
     const expectedHash = String(metadata.content_sha256 ?? "");
     if (existingHash(metadataPath) === expectedHash) {
       return { slug: slug2, dir, status: "unchanged", files: files.length };
@@ -52584,8 +52769,8 @@ function writeInstalls(output, root) {
     for (const file2 of files) {
       const relativePath = safeRelativePath(String(file2.path ?? ""));
       const content = String(file2.content ?? "");
-      const target = path2.join(dir, relativePath);
-      mkdirSync(path2.dirname(target), { recursive: true });
+      const target = path3.join(dir, relativePath);
+      mkdirSync(path3.dirname(target), { recursive: true });
       writeFileSync(target, content, "utf8");
     }
     writeFileSync(metadataPath, `${JSON.stringify(metadata, null, 2)}
@@ -52605,7 +52790,7 @@ function removeRevokedInstalls(output, root) {
     if (installs.has(slug2)) {
       continue;
     }
-    const dir = path2.join(root, slug2);
+    const dir = path3.join(root, slug2);
     if (!existsSync(dir)) {
       continue;
     }
@@ -52617,15 +52802,15 @@ function removeRevokedInstalls(output, root) {
 function installRoot(client, env) {
   const override = env.ROST_SKILL_INSTALL_ROOT;
   if (override && override.length > 0) {
-    return path2.resolve(override, client);
+    return path3.resolve(override, client);
   }
   if (client === "codex") {
-    return path2.join(env.CODEX_HOME ?? path2.join(os.homedir(), ".codex"), "skills", "rost");
+    return path3.join(env.CODEX_HOME ?? path3.join(os.homedir(), ".codex"), "skills", "rost");
   }
   if (client === "claude-code") {
-    return path2.join(env.CLAUDE_HOME ?? path2.join(os.homedir(), ".claude"), "skills", "rost");
+    return path3.join(env.CLAUDE_HOME ?? path3.join(os.homedir(), ".claude"), "skills", "rost");
   }
-  return path2.join(os.homedir(), ".cursor", "skills", "rost");
+  return path3.join(os.homedir(), ".cursor", "skills", "rost");
 }
 function safeRelativePath(value) {
   const normalized = value.trim().replaceAll("\\", "/").replace(/^\.\/+/, "");
@@ -52834,9 +53019,9 @@ import { promisify as promisify3 } from "node:util";
 import { existsSync as existsSync2, realpathSync } from "node:fs";
 import { readdir, rm as rm2, stat as stat2 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import path3 from "node:path";
+import path4 from "node:path";
 var SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
-var RUNNER_ASKPASS_DIR = path3.join(tmpdir(), "rost-runner-askpass");
+var RUNNER_ASKPASS_DIR = path4.join(tmpdir(), "rost-runner-askpass");
 var RUNNER_TEMP_PREFIXES = [
   "rost-runner-mcp-",
   "rost-runner-sandbox-",
@@ -53006,7 +53191,7 @@ function canonical(p) {
   }
 }
 function canonicalFile(p) {
-  return path3.join(canonical(path3.dirname(p)), path3.basename(p));
+  return path4.join(canonical(path4.dirname(p)), path4.basename(p));
 }
 function isSandboxExecAvailable() {
   try {
@@ -53089,7 +53274,7 @@ async function sweepStaleRunnerTempFiles(dir, options = {}) {
       if (!RUNNER_TEMP_PREFIXES.some((prefix) => name.startsWith(prefix))) {
         return;
       }
-      const full = path3.join(dir, name);
+      const full = path4.join(dir, name);
       try {
         const info = await stat2(full);
         if (now - info.mtimeMs < maxAgeMs) {
@@ -53107,9 +53292,9 @@ async function sweepStaleRunnerTempFiles(dir, options = {}) {
 // src/runner-service.ts
 import { execFile as execFileCallback2 } from "node:child_process";
 import { realpathSync as realpathSync2 } from "node:fs";
-import { access, mkdir as mkdir2, readFile as readFile3, readdir as readdir2, rm as rm3, writeFile as writeFile2 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import path4 from "node:path";
+import { access, mkdir as mkdir3, readFile as readFile4, readdir as readdir2, rm as rm3, writeFile as writeFile3 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import path5 from "node:path";
 import { promisify as promisify2 } from "node:util";
 var execFile2 = promisify2(execFileCallback2);
 var SERVICE_VERBS = ["install-service", "start", "stop", "restart", "status", "logs", "uninstall"];
@@ -53126,9 +53311,9 @@ function isRunnerServiceInvocation(args) {
 function runnerServicePaths(homeDir, runnerName) {
   const safeName = safeRunnerName(runnerName);
   return {
-    launchAgentPath: path4.join(homeDir, "Library", "LaunchAgents", `${serviceLabel(safeName)}.plist`),
-    stateFile: path4.join(homeDir, "Library", "Application Support", cliBrand.name, `runner-${safeName}.json`),
-    logDir: path4.join(homeDir, "Library", "Logs", cliBrand.name, "runner", safeName)
+    launchAgentPath: path5.join(homeDir, "Library", "LaunchAgents", `${serviceLabel(safeName)}.plist`),
+    stateFile: path5.join(homeDir, "Library", "Application Support", cliBrand.name, `runner-${safeName}.json`),
+    logDir: path5.join(homeDir, "Library", "Logs", cliBrand.name, "runner", safeName)
   };
 }
 function renderLaunchdPlist(config2) {
@@ -53170,9 +53355,9 @@ ${config2.allowDevelopmentAppUrl === true ? `    <key>${allowInsecureAppUrlEnv}<
   <key>RunAtLoad</key>
   <true/>
   <key>StandardOutPath</key>
-  <string>${escapePlist(path4.join(config2.logDir, "stdout.log"))}</string>
+  <string>${escapePlist(path5.join(config2.logDir, "stdout.log"))}</string>
   <key>StandardErrorPath</key>
-  <string>${escapePlist(path4.join(config2.logDir, "stderr.log"))}</string>
+  <string>${escapePlist(path5.join(config2.logDir, "stderr.log"))}</string>
 </dict>
 </plist>
 `;
@@ -53208,7 +53393,7 @@ ${serviceUsage()}
     userCode: parsed.userCode,
     nodePath: options.nodePath ?? resolveNodePath(),
     binPath: options.binPath ?? resolveBinPath(),
-    homeDir: options.homeDir ?? homedir2(),
+    homeDir: options.homeDir ?? homedir3(),
     platform: options.platform ?? process.platform,
     exec: options.exec ?? defaultExec,
     uid: options.uid ?? (process.getuid ? process.getuid() : 0)
@@ -53239,9 +53424,9 @@ async function installService(options) {
   const safeName = safeRunnerName(options.runnerName);
   const paths = runnerServicePaths(options.homeDir, safeName);
   const label = serviceLabel(safeName);
-  await mkdir2(paths.logDir, { recursive: true });
-  await mkdir2(path4.dirname(paths.stateFile), { recursive: true });
-  await mkdir2(path4.dirname(paths.launchAgentPath), { recursive: true });
+  await mkdir3(paths.logDir, { recursive: true });
+  await mkdir3(path5.dirname(paths.stateFile), { recursive: true });
+  await mkdir3(path5.dirname(paths.launchAgentPath), { recursive: true });
   if (options.userCode !== void 0) {
     const paired = await pairRunnerOnce(options, safeName, paths.stateFile, options.userCode);
     if (!paired) {
@@ -53259,7 +53444,7 @@ async function installService(options) {
     servicePath: buildServicePath(options.nodePath, options.homeDir),
     execute: options.execute
   });
-  await writeFile2(paths.launchAgentPath, plist, { mode: 420 });
+  await writeFile3(paths.launchAgentPath, plist, { mode: 420 });
   await bootoutQuietly(options.exec, options.uid, paths.launchAgentPath);
   try {
     const bootstrapped = await bootstrapService(options.exec, options.uid, paths.launchAgentPath);
@@ -53396,8 +53581,8 @@ async function logsService(options) {
   const safeName = safeRunnerName(options.runnerName);
   const paths = runnerServicePaths(options.homeDir, safeName);
   const label = serviceLabel(safeName);
-  const stdoutLog = path4.join(paths.logDir, "stdout.log");
-  const stderrLog = path4.join(paths.logDir, "stderr.log");
+  const stdoutLog = path5.join(paths.logDir, "stdout.log");
+  const stderrLog = path5.join(paths.logDir, "stderr.log");
   options.io.stdout.write(
     `${[
       `runner service logs for ${label}:`,
@@ -53500,8 +53685,8 @@ function serviceTargets(uid, label) {
   return launchdDomains(uid).map((domain2) => `${domain2}/${label}`);
 }
 async function inspectRunnerServiceInstallations(options = {}) {
-  const homeDir = options.homeDir ?? homedir2();
-  const launchAgentsDir = path4.join(homeDir, "Library", "LaunchAgents");
+  const homeDir = options.homeDir ?? homedir3();
+  const launchAgentsDir = path5.join(homeDir, "Library", "LaunchAgents");
   let names = [];
   try {
     const entries = await readdir2(launchAgentsDir);
@@ -53521,7 +53706,7 @@ async function inspectRunnerService(options) {
   const paths = runnerServicePaths(options.homeDir, safeName);
   const label = serviceLabel(safeName);
   const installed = await fileExists(paths.launchAgentPath);
-  const plist = installed ? await readFile3(paths.launchAgentPath, "utf8").catch(() => null) : null;
+  const plist = installed ? await readFile4(paths.launchAgentPath, "utf8").catch(() => null) : null;
   const programArgs = plist ? extractProgramArguments(plist) : [];
   const appUrl2 = plist ? extractPlistEnvironmentValue(plist, `${cliBrand.envPrefix}_APP_URL`) : null;
   const urlPolicyEnv = extractPlistEnvironmentValue(plist ?? "", allowInsecureAppUrlEnv) === "1" ? "set" : "unset";
@@ -53630,11 +53815,11 @@ function resolveNodePath() {
 }
 function buildServicePath(nodePath, homeDir) {
   const entries = [
-    path4.dirname(nodePath),
+    path5.dirname(nodePath),
     "/opt/homebrew/bin",
     "/usr/local/bin",
-    path4.join(homeDir, ".local", "bin"),
-    path4.join(homeDir, "bin"),
+    path5.join(homeDir, ".local", "bin"),
+    path5.join(homeDir, "bin"),
     "/usr/bin",
     "/bin",
     "/usr/sbin",
@@ -53789,7 +53974,7 @@ async function fileExists(file2) {
 }
 async function readTail(file2, maxBytes) {
   try {
-    const content = await readFile3(file2, "utf8");
+    const content = await readFile4(file2, "utf8");
     return content.length > maxBytes ? content.slice(content.length - maxBytes) : content;
   } catch {
     return null;
@@ -53936,17 +54121,17 @@ function parseSemver2(value) {
 // src/runner-serve.ts
 import { execFile as execFileCallback5, spawn } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { chmod as chmod2, mkdir as mkdir4, readFile as readFile4, rename, rm as rm5, statfs, writeFile as writeFile4 } from "node:fs/promises";
-import { cpus, homedir as homedir3, hostname as hostname3, platform, totalmem, tmpdir as tmpdir2 } from "node:os";
-import path6 from "node:path";
+import { chmod as chmod2, mkdir as mkdir5, readFile as readFile5, rename, rm as rm5, statfs, writeFile as writeFile5 } from "node:fs/promises";
+import { cpus, homedir as homedir4, hostname as hostname3, platform, totalmem, tmpdir as tmpdir2 } from "node:os";
+import path7 from "node:path";
 import { setTimeout as sleep3 } from "node:timers/promises";
 import { promisify as promisify5 } from "node:util";
 
 // src/forge-workspace.ts
 import { execFile as execFileCallback4 } from "node:child_process";
 import { createHash } from "node:crypto";
-import { chmod, lstat, mkdir as mkdir3, mkdtemp, realpath, rm as rm4, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
-import path5 from "node:path";
+import { chmod, lstat, mkdir as mkdir4, mkdtemp, realpath, rm as rm4, stat as stat3, writeFile as writeFile4 } from "node:fs/promises";
+import path6 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 import { promisify as promisify4 } from "node:util";
 
@@ -54083,20 +54268,20 @@ function shortRequestId(buildRequestId) {
   return slice.length > 0 ? slice : createHash("sha1").update(buildRequestId).digest("hex").slice(0, 8);
 }
 function requestRoot(baseDir, buildRequestId) {
-  return path5.join(baseDir, "work", shortRequestId(buildRequestId));
+  return path6.join(baseDir, "work", shortRequestId(buildRequestId));
 }
 function baseRepoDir(baseDir, buildRequestId) {
-  return path5.join(requestRoot(baseDir, buildRequestId), "base");
+  return path6.join(requestRoot(baseDir, buildRequestId), "base");
 }
 function branchName(buildRequestId, changeset) {
   const short = shortRequestId(buildRequestId);
   return changeset.total > 1 ? `forge/${short}-cs${changeset.ordinal}` : `forge/${short}`;
 }
 function buildWorktreeDir(baseDir, buildRequestId, ordinal) {
-  return path5.join(requestRoot(baseDir, buildRequestId), `cs${ordinal}`);
+  return path6.join(requestRoot(baseDir, buildRequestId), `cs${ordinal}`);
 }
 function reviewWorktreeDir(baseDir, buildRequestId, ordinal) {
-  return path5.join(requestRoot(baseDir, buildRequestId), `review-cs${ordinal}`);
+  return path6.join(requestRoot(baseDir, buildRequestId), `review-cs${ordinal}`);
 }
 function remoteUrlFor(options) {
   if (options.remoteUrl) {
@@ -54113,7 +54298,7 @@ async function pathExists(target) {
   }
 }
 async function isGitRepo(dir) {
-  return await pathExists(path5.join(dir, ".git")) || await pathExists(path5.join(dir, "HEAD"));
+  return await pathExists(path6.join(dir, ".git")) || await pathExists(path6.join(dir, "HEAD"));
 }
 async function runGit(args, cwd, timeoutMs = LOCAL_GIT_TIMEOUT_MS) {
   try {
@@ -54166,10 +54351,10 @@ async function withNetworkRetries(op, fn, retryCounter) {
   throw new Error(`${op} exhausted retries: ${lastError instanceof Error ? redactSecrets(lastError.message) : redactSecrets(String(lastError))}`);
 }
 async function canonicalAskpassBase(baseDir) {
-  return path5.join(await realpath(path5.dirname(baseDir)), path5.basename(baseDir));
+  return path6.join(await realpath(path6.dirname(baseDir)), path6.basename(baseDir));
 }
 async function prepareAskpassTurnDir(baseDir) {
-  await mkdir3(baseDir, { recursive: true, mode: 448 });
+  await mkdir4(baseDir, { recursive: true, mode: 448 });
   const baseInfo = await lstat(baseDir);
   if (baseInfo.isSymbolicLink() || !baseInfo.isDirectory()) {
     throw new Error(`refusing to use askpass dir ${baseDir}: not a real directory (possible symlink attack)`);
@@ -54178,10 +54363,10 @@ async function prepareAskpassTurnDir(baseDir) {
     throw new Error(`refusing to use askpass dir ${baseDir}: not owned by this user (possible pre-planted dir)`);
   }
   await chmod(baseDir, 448);
-  const turnDir = await mkdtemp(path5.join(baseDir, "rost-runner-askpass-"));
+  const turnDir = await mkdtemp(path6.join(baseDir, "rost-runner-askpass-"));
   const canonicalBase = await canonicalAskpassBase(baseDir);
   const realTurn = await realpath(turnDir);
-  if (path5.dirname(realTurn) !== canonicalBase) {
+  if (path6.dirname(realTurn) !== canonicalBase) {
     await rm4(turnDir, { recursive: true, force: true });
     throw new Error(`refusing to use askpass dir ${turnDir}: resolved outside ${canonicalBase} (possible symlink attack)`);
   }
@@ -54189,7 +54374,7 @@ async function prepareAskpassTurnDir(baseDir) {
 }
 async function openAskpassSession(credential, baseDir = RUNNER_ASKPASS_DIR) {
   const turnDir = await prepareAskpassTurnDir(baseDir);
-  const helperPath = path5.join(turnDir, "askpass.sh");
+  const helperPath = path6.join(turnDir, "askpass.sh");
   const helper = [
     "#!/bin/sh",
     "# One-shot Forge GIT_ASKPASS helper. Contains no secret; reads the token from env.",
@@ -54199,7 +54384,7 @@ async function openAskpassSession(credential, baseDir = RUNNER_ASKPASS_DIR) {
     "esac",
     ""
   ].join("\n");
-  await writeFile3(helperPath, helper, { mode: 448 });
+  await writeFile4(helperPath, helper, { mode: 448 });
   await chmod(helperPath, 448);
   const env = {
     ...process.env,
@@ -54250,8 +54435,8 @@ async function localBranchExists(baseRepo, branch) {
 async function worktreeRegistered(baseRepo, worktreeDir) {
   try {
     const listing = await runGit(["worktree", "list", "--porcelain"], baseRepo);
-    const target = path5.resolve(worktreeDir);
-    return listing.split("\n").some((line) => line.startsWith("worktree ") && path5.resolve(line.slice("worktree ".length).trim()) === target);
+    const target = path6.resolve(worktreeDir);
+    return listing.split("\n").some((line) => line.startsWith("worktree ") && path6.resolve(line.slice("worktree ".length).trim()) === target);
   } catch {
     return false;
   }
@@ -54262,7 +54447,7 @@ async function configureForgeIdentity(baseRepo) {
 }
 async function ensureBaseClone(input) {
   const baseRepo = baseRepoDir(input.baseDir, input.buildRequestId);
-  await mkdir3(path5.dirname(baseRepo), { recursive: true, mode: 448 });
+  await mkdir4(path6.dirname(baseRepo), { recursive: true, mode: 448 });
   await withLedgerStep(input.ledger, "clone", (retryCounter) => withAskpass(input.credential, async (netEnv) => {
     if (await isGitRepo(baseRepo)) {
       await runGitNetwork("git fetch", ["fetch", "--prune", "--quiet", input.url, "+refs/heads/*:refs/remotes/origin/*"], netEnv, baseRepo, FETCH_TIMEOUT_MS, retryCounter);
@@ -54311,7 +54496,7 @@ async function prepareMergeWorkspace(options) {
     ledger: options.ledger
   });
   const branch = options.headBranch;
-  const worktreeDir = path5.join(requestRoot(options.baseDir, options.buildRequestId), "merge");
+  const worktreeDir = path6.join(requestRoot(options.baseDir, options.buildRequestId), "merge");
   const originDefault = `origin/${options.repo.default_branch}`;
   const originHead = `origin/${branch}`;
   await withLedgerStep(options.ledger, "branch", async () => {
@@ -54789,7 +54974,7 @@ async function runRunnerServe(options) {
   const env = options.env ?? process.env;
   const fetchImpl = options.fetchImpl ?? fetch;
   const cliVersion = await readCliVersion();
-  const homeDir = options.homeDir ?? homedir3();
+  const homeDir = options.homeDir ?? homedir4();
   let config2;
   try {
     config2 = parseServeArgs(options.args, options.appUrl, env, homeDir);
@@ -54975,7 +55160,7 @@ function detectTelemetry(capabilities, env, activeSessions, cliVersion) {
 }
 function parseServeArgs(args, appUrl2, env, homeDir) {
   let name = env.RUNNER_NAME ?? `headless-${hostname3()}`;
-  let stateFile = env.RUNNER_STATE_FILE ?? path6.join(tmpdir2(), `rost-runner-${createHash2("sha1").update(appUrl2).digest("hex").slice(0, 8)}.json`);
+  let stateFile = env.RUNNER_STATE_FILE ?? path7.join(tmpdir2(), `rost-runner-${createHash2("sha1").update(appUrl2).digest("hex").slice(0, 8)}.json`);
   let heartbeatMs = Number(env.RUNNER_HEARTBEAT_MS ?? 3e4);
   let interactiveClaimMs = Number(env.RUNNER_INTERACTIVE_CLAIM_MS ?? 1e3);
   let execute2 = env.RUNNER_EXECUTE === "1";
@@ -55026,7 +55211,7 @@ function parseServeArgs(args, appUrl2, env, homeDir) {
     tmpDir: tmpdir2(),
     homeDir,
     stateFile,
-    runnerBaseDir: path6.join(homeDir, ".rost"),
+    runnerBaseDir: path7.join(homeDir, ".rost"),
     allowNetwork: network.allowNetwork
   });
   return {
@@ -55132,7 +55317,7 @@ async function pairIfNeeded(client, fetchImpl, appUrl2, config2, io) {
 }
 async function loadState(filePath, expectedTenantId) {
   try {
-    const parsed = JSON.parse(await readFile4(filePath, "utf8"));
+    const parsed = JSON.parse(await readFile5(filePath, "utf8"));
     if (typeof parsed.runner_id === "string" && typeof parsed.runner_secret === "string") {
       if (expectedTenantId && parsed.tenant_id !== expectedTenantId) {
         return null;
@@ -55163,10 +55348,10 @@ function isRuntimeSessionMap(value) {
   });
 }
 async function saveState(filePath, state) {
-  await mkdir4(path6.dirname(filePath), { recursive: true, mode: 448 });
+  await mkdir5(path7.dirname(filePath), { recursive: true, mode: 448 });
   const tempPath = `${filePath}.${process.pid}.${createHash2("sha1").update(`${Date.now()}:${Math.random()}`).digest("hex").slice(0, 8)}.tmp`;
   try {
-    await writeFile4(tempPath, `${JSON.stringify(state)}
+    await writeFile5(tempPath, `${JSON.stringify(state)}
 `, { mode: 384 });
     await chmod2(tempPath, 384);
     await rename(tempPath, filePath);
@@ -55216,8 +55401,8 @@ function resolveSandboxKind(env, homeDir) {
     workspaceDir: tmpdir2(),
     tmpDir: tmpdir2(),
     homeDir,
-    stateFile: path6.join(tmpdir2(), "runner-sandbox-probe.json"),
-    runnerBaseDir: path6.join(homeDir, ".rost"),
+    stateFile: path7.join(tmpdir2(), "runner-sandbox-probe.json"),
+    runnerBaseDir: path7.join(homeDir, ".rost"),
     allowNetwork: resolveSandboxNetworkFlag(env) === "allow"
   }).kind;
 }
@@ -55316,9 +55501,9 @@ async function probeGhAuth() {
   }
 }
 async function probeForgeDiskFreeMb(homeDir) {
-  const dir = path6.join(homeDir, ".rost", "forge");
+  const dir = path7.join(homeDir, ".rost", "forge");
   try {
-    await mkdir4(dir, { recursive: true, mode: 448 });
+    await mkdir5(dir, { recursive: true, mode: 448 });
     const stats = await statfs(dir);
     return Math.floor(stats.bavail * stats.bsize / (1024 * 1024));
   } catch {
@@ -55650,7 +55835,7 @@ async function prepareForgeTurn(ctx, workOrder, execution) {
   let workspace;
   try {
     workspace = await prepareForgeWorkspace({
-      baseDir: path6.join(ctx.config.homeDir, ".rost", "forge", ctx.state.runner_id),
+      baseDir: path7.join(ctx.config.homeDir, ".rost", "forge", ctx.state.runner_id),
       tenantId,
       buildRequestId,
       changeset: { id: buildRequestId, ordinal: 1, total: 1 },
@@ -55670,7 +55855,7 @@ async function prepareForgeTurn(ctx, workOrder, execution) {
     tmpDir: tmpdir2(),
     homeDir: ctx.config.homeDir,
     stateFile: ctx.config.stateFile,
-    runnerBaseDir: path6.join(ctx.config.homeDir, ".rost"),
+    runnerBaseDir: path7.join(ctx.config.homeDir, ".rost"),
     allowWritePaths: [workspace.baseRepo],
     // Re-allow the shared object store for local commits, but DENY the model writing the
     // repo's hook + config (and the worktree's gitdir pointer). The harness runs git
@@ -55678,9 +55863,9 @@ async function prepareForgeTurn(ctx, workOrder, execution) {
     // hook or `ext::`/`insteadOf` config would otherwise exfiltrate it (DER-1327 review).
     // `.git/{objects,refs,worktrees,logs,index,HEAD}` stay writable so the model can commit.
     denyWritePaths: [
-      `${path6.join(workspace.baseRepo, ".git", "hooks")}/`,
-      path6.join(workspace.baseRepo, ".git", "config"),
-      path6.join(workspace.worktreeDir, ".git")
+      `${path7.join(workspace.baseRepo, ".git", "hooks")}/`,
+      path7.join(workspace.baseRepo, ".git", "config"),
+      path7.join(workspace.worktreeDir, ".git")
     ],
     allowNetwork: ctx.config.sandboxAllowNetwork
   });
@@ -55699,7 +55884,7 @@ async function prepareForgeTurn(ctx, workOrder, execution) {
 var FORGE_MAX_CHANGED_PATHS = 2e3;
 var FORGE_MAX_CHANGED_PATH_LENGTH = 500;
 function forgeChangedPathsField(changedPaths) {
-  const withinCaps = changedPaths.length > 0 && changedPaths.length <= FORGE_MAX_CHANGED_PATHS && changedPaths.every((path7) => path7.length >= 1 && path7.length <= FORGE_MAX_CHANGED_PATH_LENGTH);
+  const withinCaps = changedPaths.length > 0 && changedPaths.length <= FORGE_MAX_CHANGED_PATHS && changedPaths.every((path8) => path8.length >= 1 && path8.length <= FORGE_MAX_CHANGED_PATH_LENGTH);
   return withinCaps ? { changedPaths: [...changedPaths] } : {};
 }
 async function finalizeForgeBuildPush(ctx, prep, result) {
@@ -55840,9 +56025,9 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   const token = typeof mcp.token === "string" ? mcp.token : "";
   const url2 = typeof mcp.url === "string" ? `${ctx.appUrl.replace(/\/+$/, "")}${mcp.url}` : `${ctx.appUrl.replace(/\/+$/, "")}/mcp`;
   const mcpConfig = JSON.stringify({ mcpServers: { rost: { type: "http", url: url2, headers: { Authorization: `Bearer ${token}` } } } });
-  const configPath = path6.join(tmpdir2(), `rost-runner-mcp-${createHash2("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
+  const configPath = path7.join(tmpdir2(), `rost-runner-mcp-${createHash2("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
   const prompt = buildTurnPrompt({ kind, workOrder, execution, hasWorkspace: forgePrep !== null });
-  await writeFile4(configPath, `${mcpConfig}
+  await writeFile5(configPath, `${mcpConfig}
 `, { mode: 384 });
   await chmod2(configPath, 384);
   const resumeSessionId = runtime === "claude" ? getClaudeResumeSessionId(ctx.state, workOrder) : void 0;
@@ -55857,11 +56042,11 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   });
   let sandboxProfilePath = null;
   if (sandbox.kind === "seatbelt") {
-    sandboxProfilePath = path6.join(
+    sandboxProfilePath = path7.join(
       tmpdir2(),
       `rost-runner-sandbox-${createHash2("sha256").update(`${configPath}:${Math.random()}`).digest("hex").slice(0, 16)}.sb`
     );
-    await writeFile4(sandboxProfilePath, sandbox.profile, { mode: 384 });
+    await writeFile5(sandboxProfilePath, sandbox.profile, { mode: 384 });
     await chmod2(sandboxProfilePath, 384);
   }
   const { command, args } = wrapCommandWithSandbox(sandbox, built.command, built.args, sandboxProfilePath);
@@ -55992,7 +56177,7 @@ async function resolveMergeConflictTurn(ctx, input) {
   let workspace;
   try {
     workspace = await prepareMergeWorkspace({
-      baseDir: path6.join(ctx.config.homeDir, ".rost", "forge", ctx.state.runner_id),
+      baseDir: path7.join(ctx.config.homeDir, ".rost", "forge", ctx.state.runner_id),
       tenantId,
       buildRequestId: input.buildRequestId,
       repo: input.repo,
@@ -56010,12 +56195,12 @@ async function resolveMergeConflictTurn(ctx, input) {
     tmpDir: tmpdir2(),
     homeDir: ctx.config.homeDir,
     stateFile: ctx.config.stateFile,
-    runnerBaseDir: path6.join(ctx.config.homeDir, ".rost"),
+    runnerBaseDir: path7.join(ctx.config.homeDir, ".rost"),
     allowWritePaths: [workspace.baseRepo],
     denyWritePaths: [
-      `${path6.join(workspace.baseRepo, ".git", "hooks")}/`,
-      path6.join(workspace.baseRepo, ".git", "config"),
-      path6.join(workspace.worktreeDir, ".git")
+      `${path7.join(workspace.baseRepo, ".git", "hooks")}/`,
+      path7.join(workspace.baseRepo, ".git", "config"),
+      path7.join(workspace.worktreeDir, ".git")
     ],
     allowNetwork: ctx.config.sandboxAllowNetwork
   });
@@ -56045,8 +56230,8 @@ async function spawnMergeConflictModel(ctx, input) {
   const token = typeof mcp.token === "string" ? mcp.token : "";
   const url2 = typeof mcp.url === "string" ? `${ctx.appUrl.replace(/\/+$/, "")}${mcp.url}` : `${ctx.appUrl.replace(/\/+$/, "")}/mcp`;
   const mcpConfig = JSON.stringify({ mcpServers: { rost: { type: "http", url: url2, headers: { Authorization: `Bearer ${token}` } } } });
-  const configPath = path6.join(tmpdir2(), `rost-runner-mcp-${createHash2("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
-  await writeFile4(configPath, `${mcpConfig}
+  const configPath = path7.join(tmpdir2(), `rost-runner-mcp-${createHash2("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
+  await writeFile5(configPath, `${mcpConfig}
 `, { mode: 384 });
   await chmod2(configPath, 384);
   const plan = resolveTurnPlan({ kind: "work_order", execution: input.execution, repoDir: input.workspace.worktreeDir });
@@ -56058,8 +56243,8 @@ async function spawnMergeConflictModel(ctx, input) {
   ].join("\n");
   let sandboxProfilePath = null;
   if (input.sandbox.kind === "seatbelt") {
-    sandboxProfilePath = path6.join(tmpdir2(), `rost-runner-sandbox-${createHash2("sha256").update(`${configPath}:${Math.random()}`).digest("hex").slice(0, 16)}.sb`);
-    await writeFile4(sandboxProfilePath, input.sandbox.profile, { mode: 384 });
+    sandboxProfilePath = path7.join(tmpdir2(), `rost-runner-sandbox-${createHash2("sha256").update(`${configPath}:${Math.random()}`).digest("hex").slice(0, 16)}.sb`);
+    await writeFile5(sandboxProfilePath, input.sandbox.profile, { mode: 384 });
     await chmod2(sandboxProfilePath, 384);
   }
   const built = buildTurnCommand({