@rudderhq/cli 0.7.3 → 0.7.4

package/dist/index.js

@@ -65,6 +65,7 @@ var init_computer_use = __esm({
     COMPUTER_USE_MCP_TOOL_PREFIX = "rudder_computer_";
     COMPUTER_USE_ACTIONS = [
       "list_apps",
+      "launch_app",
       "list_windows",
       "get_app_state",
       "click",
@@ -103,6 +104,14 @@ var init_computer_use = __esm({
     });
     COMPUTER_USE_MCP_TOOLS = [
       tool("list_apps", "List running macOS applications. Use this to identify the exact target before observing it.", objectSchema({})),
+      tool("launch_app", "Launch an installed application without taking focus. Use the returned pid and window ID to observe it directly.", {
+        ...objectSchema({
+          name: { type: "string", description: "Exact installed application name." },
+          bundleId: { type: "string", description: "Exact application bundle identifier." },
+          newInstance: { type: "boolean", description: "Request a separate application instance when the platform supports it." }
+        }),
+        anyOf: [{ required: ["name"] }, { required: ["bundleId"] }]
+      }),
       tool("list_windows", "List windows for a running application.", objectSchema({
         ...targetProperties,
         onScreenOnly: { type: "boolean" }
@@ -182,6 +191,11 @@ var init_computer_use = __esm({
     }).strict();
     computerUseActionSchemas = {
       list_apps: z.object({}).strict(),
+      launch_app: z.object({
+        name: z.string().trim().min(1).max(300).optional(),
+        bundleId: z.string().trim().min(1).max(300).optional(),
+        newInstance: z.boolean().optional()
+      }).strict().refine((value) => value.name !== void 0 || value.bundleId !== void 0, { message: "Launch app requires a name or bundle ID." }),
       list_windows: appTargetSchema.extend({ onScreenOnly: z.boolean().optional() }).strict(),
       get_app_state: appTargetSchema.extend({
         includeScreenshot: z.boolean().optional(),
@@ -242,7 +256,7 @@ var init_computer_use = __esm({
 });
 
 // ../packages/shared/dist/constants.js
-var ORGANIZATION_STATUSES, ORGANIZATION_INTELLIGENCE_PROFILE_PURPOSES, ORGANIZATION_INTELLIGENCE_PROFILE_STATUSES, DEPLOYMENT_MODES, DEPLOYMENT_EXPOSURES, AUTH_BASE_URL_MODES, AGENT_STATUSES, AGENT_RUNTIME_TYPES, AGENT_ROLES, AGENT_ICON_NAMES, AGENT_OREO_ICON_PREFIX, AGENT_OREO_SHAPE_IDS, AGENT_OREO_PALETTE_IDS, AGENT_DICEBEAR_NOTIONISTS_ICON_PREFIX, AGENT_AVATAR_BACKGROUND_PRESET_IDS, ISSUE_STATUSES, ISSUE_PRIORITIES, AGENT_INTEGRATION_PROVIDERS, AGENT_INTEGRATION_STATUSES, AGENT_INTEGRATION_TRANSPORTS, AGENT_INTEGRATION_PROVIDER_REGIONS, AGENT_INTEGRATION_CHAT_TYPES, AGENT_INTEGRATION_DROP_REASONS, AGENT_INTEGRATION_OUTBOUND_STATUSES, RUDDER_AGENT_V1_MCP_TOOL_NAMES, RUDDER_BROWSER_MCP_TOOL_NAMES2, RUDDER_CORE_MCP_TOOL_NAMES2, CUSTOM_INTEGRATION_KINDS, CUSTOM_INTEGRATION_SCOPES, CUSTOM_INTEGRATION_STATUSES, CUSTOM_INTEGRATION_TOOL_STATUSES, CUSTOM_INTEGRATION_BINDING_STATUSES, CUSTOM_INTEGRATION_TOOL_CALL_STATUSES, MCP_CONNECTION_PROVIDERS, MCP_CONNECTION_TRANSPORTS, MCP_CONNECTION_SCOPES, MCP_CONNECTION_ACCESS_MODES, MCP_AGENT_ACCESS_MODES, MCP_CONNECTION_CANONICAL_STATES, MCP_PROVIDER_SCOPE_MODES, MCP_PROVIDER_CREDENTIAL_MODES, MCP_PROVIDER_ORGANIZATION_STATES, MCP_TOOL_CAPABILITY_CLASSES, MCP_CONNECTION_STATUSES, MCP_OAUTH_GRANT_STATUSES, MCP_AGENT_BINDING_STATUSES, MCP_OAUTH_SESSION_TTL_MS, MCP_PROVIDER_CATALOG, CALENDAR_SOURCE_TYPES, CALENDAR_OWNER_TYPES, CALENDAR_VISIBILITIES, CALENDAR_SOURCE_STATUSES, CALENDAR_EVENT_KINDS, CALENDAR_EVENT_STATUSES, CALENDAR_SOURCE_MODES, CHAT_CONVERSATION_STATUSES, CHAT_ISSUE_CREATION_MODES, CHAT_MESSAGE_ROLES, CHAT_MESSAGE_KINDS, CHAT_MESSAGE_STATUSES, CHAT_CONTEXT_ENTITY_TYPES, GOAL_OBJECTIVE_MODES, GOAL_EVALUATOR_KINDS, GOAL_CONTINUATION_KINDS, GOAL_ACTIVITY_KINDS, GOAL_FEEDBACK_KINDS, PROJECT_STATUSES, ORGANIZATION_RESOURCE_KINDS, ORGANIZATION_RESOURCE_SOURCE_TYPES, PROJECT_RESOURCE_ATTACHMENT_ROLES, AUTOMATION_STATUSES, AUTOMATION_CONCURRENCY_POLICIES, AUTOMATION_CATCH_UP_POLICIES, AUTOMATION_OUTPUT_MODES, AUTOMATION_TRIGGER_SIGNING_MODES, PROJECT_COLORS, PROJECT_ICONS, APPROVAL_TYPES, SECRET_PROVIDERS, STORAGE_PROVIDERS, BILLING_TYPES, FINANCE_EVENT_KINDS, FINANCE_DIRECTIONS, FINANCE_UNITS, BUDGET_SCOPE_TYPES, BUDGET_METRICS, BUDGET_WINDOW_KINDS, BUDGET_INCIDENT_RESOLUTION_ACTIONS, AGENT_ISSUE_CREATION_REQUEST_STATUSES, INVITE_JOIN_TYPES, JOIN_REQUEST_TYPES, JOIN_REQUEST_STATUSES, PERMISSION_KEYS;
+var ORGANIZATION_STATUSES, ORGANIZATION_INTELLIGENCE_PROFILE_PURPOSES, ORGANIZATION_INTELLIGENCE_PROFILE_STATUSES, DEPLOYMENT_MODES, DEPLOYMENT_EXPOSURES, AUTH_BASE_URL_MODES, AGENT_STATUSES, AGENT_RUNTIME_TYPES, AGENT_ROLES, AGENT_ICON_NAMES, AGENT_OREO_ICON_PREFIX, AGENT_OREO_SHAPE_IDS, AGENT_OREO_PALETTE_IDS, AGENT_DICEBEAR_NOTIONISTS_ICON_PREFIX, AGENT_AVATAR_BACKGROUND_PRESET_IDS, ISSUE_STATUSES, ISSUE_PRIORITIES, AGENT_INTEGRATION_PROVIDERS, AGENT_INTEGRATION_STATUSES, AGENT_INTEGRATION_TRANSPORTS, AGENT_INTEGRATION_PROVIDER_REGIONS, AGENT_INTEGRATION_CHAT_TYPES, AGENT_INTEGRATION_DROP_REASONS, AGENT_INTEGRATION_OUTBOUND_STATUSES, RUDDER_AGENT_V1_MCP_TOOL_NAMES, RUDDER_BROWSER_MCP_TOOL_NAMES2, RUDDER_CORE_MCP_TOOL_NAMES2, CUSTOM_INTEGRATION_KINDS, CUSTOM_INTEGRATION_SCOPES, CUSTOM_INTEGRATION_STATUSES, CUSTOM_INTEGRATION_TOOL_STATUSES, CUSTOM_INTEGRATION_BINDING_STATUSES, CUSTOM_INTEGRATION_TOOL_CALL_STATUSES, MCP_CONNECTION_PROVIDERS, MCP_CONNECTION_TRANSPORTS, MCP_CONNECTION_SCOPES, MCP_CONNECTION_ACCESS_MODES, MCP_AGENT_ACCESS_MODES, MCP_CONNECTION_CANONICAL_STATES, MCP_PROVIDER_SCOPE_MODES, MCP_PROVIDER_CREDENTIAL_MODES, MCP_PROVIDER_ORGANIZATION_STATES, MCP_TOOL_CAPABILITY_CLASSES, MCP_CONNECTION_STATUSES, MCP_OAUTH_GRANT_STATUSES, MCP_AGENT_BINDING_STATUSES, MCP_OAUTH_SESSION_TTL_MS, MCP_PROVIDER_CATALOG, CALENDAR_SOURCE_TYPES, CALENDAR_OWNER_TYPES, CALENDAR_VISIBILITIES, CALENDAR_SOURCE_STATUSES, CALENDAR_EVENT_KINDS, CALENDAR_EVENT_STATUSES, CALENDAR_SOURCE_MODES, CHAT_CONVERSATION_STATUSES, CHAT_ISSUE_CREATION_MODES, CHAT_MESSAGE_ROLES, CHAT_MESSAGE_KINDS, CHAT_MESSAGE_STATUSES, CHAT_CONTEXT_ENTITY_TYPES, GOAL_OBJECTIVE_MODES, GOAL_EVALUATOR_KINDS, GOAL_CONTINUATION_KINDS, GOAL_ACTIVITY_KINDS, GOAL_FEEDBACK_KINDS, PROJECT_STATUSES, ORGANIZATION_RESOURCE_KINDS, ORGANIZATION_RESOURCE_SOURCE_TYPES, PROJECT_RESOURCE_ATTACHMENT_ROLES, AUTOMATION_STATUSES, AUTOMATION_CONCURRENCY_POLICIES, AUTOMATION_CATCH_UP_POLICIES, AUTOMATION_OUTPUT_MODES, AUTOMATION_TRIGGER_SIGNING_MODES, PROJECT_COLORS, PROJECT_ICONS, APPROVAL_TYPES, REQUEST_STATUSES, ASSISTANCE_REQUEST_RESOLUTIONS, SECRET_PROVIDERS, STORAGE_PROVIDERS, BILLING_TYPES, FINANCE_EVENT_KINDS, FINANCE_DIRECTIONS, FINANCE_UNITS, BUDGET_SCOPE_TYPES, BUDGET_METRICS, BUDGET_WINDOW_KINDS, BUDGET_INCIDENT_RESOLUTION_ACTIONS, AGENT_ISSUE_CREATION_REQUEST_STATUSES, INVITE_JOIN_TYPES, JOIN_REQUEST_TYPES, JOIN_REQUEST_STATUSES, PERMISSION_KEYS;
 var init_constants = __esm({
   "../packages/shared/dist/constants.js"() {
     "use strict";
@@ -424,6 +438,11 @@ var init_constants = __esm({
       "rudder_agent_skills_create",
       "rudder_agent_skills_enable",
       "rudder_agent_skills_sync",
+      "rudder_goal_list",
+      "rudder_goal_context",
+      "rudder_goal_progress",
+      "rudder_goal_change_propose",
+      "rudder_goal_result_propose",
       "rudder_issue_get",
       "rudder_issue_list",
       "rudder_issue_search",
@@ -642,7 +661,7 @@ var init_constants = __esm({
       "system_event"
     ];
     CHAT_MESSAGE_STATUSES = ["streaming", "completed", "stopped", "failed", "interrupted"];
-    CHAT_CONTEXT_ENTITY_TYPES = ["issue", "project", "agent"];
+    CHAT_CONTEXT_ENTITY_TYPES = ["issue", "project", "agent", "goal"];
     GOAL_OBJECTIVE_MODES = ["target", "maximize", "maintain", "decide"];
     GOAL_EVALUATOR_KINDS = ["artifact", "metric", "policy", "human"];
     GOAL_CONTINUATION_KINDS = ["commitment", "wait", "decision", "verification"];
@@ -755,6 +774,8 @@ var init_constants = __esm({
       "agent_runtime",
       "goal_change"
     ];
+    REQUEST_STATUSES = ["open", "resolved", "cancelled", "superseded"];
+    ASSISTANCE_REQUEST_RESOLUTIONS = ["answered", "action_completed", "cannot_help"];
     SECRET_PROVIDERS = [
       "local_encrypted",
       "aws_secrets_manager",
@@ -2036,7 +2057,9 @@ var init_chat = __esm({
       body: z5.string().trim().max(2e4).default(""),
       inlineAnnotations: chatInlineAnnotationsInputSchema.optional(),
       editUserMessageId: z5.string().uuid().optional().nullable(),
-      queuedMessageId: z5.string().uuid().optional().nullable()
+      queuedMessageId: z5.string().uuid().optional().nullable(),
+      modelOverride: chatModelOverrideSchema.optional().nullable(),
+      effortOverride: chatEffortOverrideSchema.optional().nullable()
     }).superRefine((value, ctx) => {
       if (value.body.length === 0 && (value.inlineAnnotations?.length ?? 0) === 0) {
         ctx.addIssue({
@@ -3206,7 +3229,7 @@ var init_organization_portability = __esm({
 
 // ../packages/shared/dist/validators/organization-skill.js
 import { z as z18 } from "zod";
-var organizationSkillSourceTypeSchema, organizationSkillTrustLevelSchema, organizationSkillCompatibilitySchema, organizationSkillSourceBadgeSchema, organizationSkillFileInventoryEntrySchema, organizationSkillSchema, organizationSkillListItemSchema, organizationSkillUsageAgentSchema, organizationSkillDetailSchema, organizationSkillUpdateStatusSchema, organizationSkillImportSchema, organizationSkillProjectScanRequestSchema, organizationSkillProjectScanSkippedSchema, organizationSkillProjectScanConflictSchema, organizationSkillProjectScanResultSchema, organizationSkillLocalScanRequestSchema, organizationSkillLocalScanSkippedSchema, organizationSkillLocalScanConflictSchema, organizationSkillLocalScanResultSchema, organizationSkillCreateSchema, organizationSkillFileDetailSchema, organizationSkillFileUpdateSchema;
+var organizationSkillSourceTypeSchema, organizationSkillTrustLevelSchema, organizationSkillCompatibilitySchema, organizationSkillSourceBadgeSchema, organizationSkillFileInventoryEntrySchema, organizationSkillSchema, organizationSkillListItemSchema, organizationSkillUsageAgentSchema, organizationSkillDetailSchema, organizationSkillUpdateStatusSchema, organizationSkillImportSchema, organizationSkillUploadSchema, organizationSkillProjectScanRequestSchema, organizationSkillProjectScanSkippedSchema, organizationSkillProjectScanConflictSchema, organizationSkillProjectScanResultSchema, organizationSkillLocalScanRequestSchema, organizationSkillLocalScanSkippedSchema, organizationSkillLocalScanConflictSchema, organizationSkillLocalScanResultSchema, organizationSkillCreateSchema, organizationSkillFileDetailSchema, organizationSkillFileUpdateSchema;
 var init_organization_skill = __esm({
   "../packages/shared/dist/validators/organization-skill.js"() {
     "use strict";
@@ -3282,6 +3305,12 @@ var init_organization_skill = __esm({
     organizationSkillImportSchema = z18.object({
       source: z18.string().min(1)
     });
+    organizationSkillUploadSchema = z18.object({
+      files: z18.array(z18.object({
+        path: z18.string().min(1).max(512),
+        content: z18.string().max(1048576)
+      })).min(1).max(128)
+    });
     organizationSkillProjectScanRequestSchema = z18.object({
       projectIds: z18.array(z18.string().uuid()).optional(),
       workspaceIds: z18.array(z18.string().uuid()).optional()
@@ -3998,6 +4027,7 @@ var init_goal = __esm({
   "../packages/shared/dist/validators/goal.js"() {
     "use strict";
     init_constants();
+    init_issue();
     jsonRecord = z27.record(z27.string(), z27.unknown());
     evidenceRefSchema = z27.string().trim().min(1).regex(/^[a-z][a-z0-9+.-]*:[^\s]+$/i, "Evidence references must use a URI-like scheme");
     sha256HexSchema = z27.string().regex(/^[a-f0-9]{64}$/, "Expected a SHA-256 hex digest");
@@ -4025,16 +4055,20 @@ var init_goal = __esm({
       title: z27.string().trim().min(1),
       description: z27.string().optional().nullable(),
       alignmentQuestion: z27.string().trim().min(1).optional().nullable(),
-      /** Accepted for legacy clients but intentionally ignored by the canonical create command. */
+      targetTime: z27.coerce.date().optional().nullable(),
       level: z27.string().optional(),
       status: z27.string().optional(),
       parentId: z27.string().uuid().optional().nullable(),
-      ownerAgentId: z27.string().uuid().optional().nullable()
+      ownerAgentId: z27.string().uuid().optional().nullable(),
+      ownerAgentRuntimeOverrides: issueAssigneeAdapterOverridesSchema.optional().nullable()
     });
     updateGoalSchema = z27.object({
       title: z27.string().trim().min(1).optional(),
       description: z27.string().optional().nullable(),
-      alignmentQuestion: z27.string().trim().min(1).optional().nullable()
+      alignmentQuestion: z27.string().trim().min(1).optional().nullable(),
+      ownerAgentId: z27.string().uuid().optional().nullable(),
+      ownerAgentRuntimeOverrides: issueAssigneeAdapterOverridesSchema.optional().nullable(),
+      targetTime: z27.coerce.date().optional().nullable()
     }).strict();
     activateGoalSchema = z27.object({
       confirmed: z27.literal(true),
@@ -4086,6 +4120,7 @@ var init_goal = __esm({
       requestKey: z27.string().trim().min(1),
       packetHash: sha256HexSchema,
       packet: goalStartPacketSchema,
+      allowCapabilityMismatch: z27.boolean().optional(),
       draftGoalId: z27.string().uuid().optional()
     }).strict();
     createGoalActivitySchema = z27.object({
@@ -4217,8 +4252,29 @@ var init_approval = __esm({
   }
 });
 
-// ../packages/shared/dist/validators/automation.js
+// ../packages/shared/dist/validators/request.js
 import { z as z29 } from "zod";
+var listRequestsQuerySchema, resolveAssistanceRequestSchema, cancelAssistanceRequestSchema;
+var init_request = __esm({
+  "../packages/shared/dist/validators/request.js"() {
+    "use strict";
+    init_constants();
+    listRequestsQuerySchema = z29.object({
+      status: z29.enum(REQUEST_STATUSES).optional(),
+      kind: z29.enum(["approval", "assistance"]).optional()
+    });
+    resolveAssistanceRequestSchema = z29.object({
+      resolution: z29.enum(ASSISTANCE_REQUEST_RESOLUTIONS),
+      response: z29.string().trim().min(1).max(2e4)
+    });
+    cancelAssistanceRequestSchema = z29.object({
+      reason: z29.string().trim().min(1).max(2e3).optional()
+    });
+  }
+});
+
+// ../packages/shared/dist/validators/automation.js
+import { z as z30 } from "zod";
 function normalizeAutomationInstructions(value) {
   const { instructions, ...rest } = value;
   return {
@@ -4237,28 +4293,28 @@ var init_automation = __esm({
     "use strict";
     init_constants();
     init_issue();
-    automationTextFieldSchema = z29.string().optional().nullable();
-    automationBodyFieldsSchema = z29.object({
-      projectId: z29.string().uuid().optional().nullable().default(null),
-      goalId: z29.string().uuid().optional().nullable(),
-      parentIssueId: z29.string().uuid().optional().nullable(),
-      title: z29.string().trim().min(1).max(200),
+    automationTextFieldSchema = z30.string().optional().nullable();
+    automationBodyFieldsSchema = z30.object({
+      projectId: z30.string().uuid().optional().nullable().default(null),
+      goalId: z30.string().uuid().optional().nullable(),
+      parentIssueId: z30.string().uuid().optional().nullable(),
+      title: z30.string().trim().min(1).max(200),
       instructions: automationTextFieldSchema,
       description: automationTextFieldSchema,
-      assigneeAgentId: z29.string().uuid(),
+      assigneeAgentId: z30.string().uuid(),
       assigneeAgentRuntimeOverrides: issueAssigneeAdapterOverridesSchema.optional().nullable(),
-      priority: z29.enum(ISSUE_PRIORITIES).optional().default("medium"),
-      status: z29.enum(AUTOMATION_STATUSES).optional().default("active"),
-      concurrencyPolicy: z29.enum(AUTOMATION_CONCURRENCY_POLICIES).optional().default("coalesce_if_active"),
-      catchUpPolicy: z29.enum(AUTOMATION_CATCH_UP_POLICIES).optional().default("skip_missed"),
-      outputMode: z29.enum(AUTOMATION_OUTPUT_MODES).optional().default("track_issue"),
-      chatConversationId: z29.string().uuid().optional().nullable().default(null),
-      notifyOnIssueCreated: z29.boolean().optional().default(false)
+      priority: z30.enum(ISSUE_PRIORITIES).optional().default("medium"),
+      status: z30.enum(AUTOMATION_STATUSES).optional().default("active"),
+      concurrencyPolicy: z30.enum(AUTOMATION_CONCURRENCY_POLICIES).optional().default("coalesce_if_active"),
+      catchUpPolicy: z30.enum(AUTOMATION_CATCH_UP_POLICIES).optional().default("skip_missed"),
+      outputMode: z30.enum(AUTOMATION_OUTPUT_MODES).optional().default("track_issue"),
+      chatConversationId: z30.string().uuid().optional().nullable().default(null),
+      notifyOnIssueCreated: z30.boolean().optional().default(false)
     });
     createAutomationSchema = automationBodyFieldsSchema.superRefine((value, ctx) => {
       if (value.chatConversationId) {
         ctx.addIssue({
-          code: z29.ZodIssueCode.custom,
+          code: z30.ZodIssueCode.custom,
           path: ["chatConversationId"],
           message: "Chat output creates an automation-owned conversation; existing chats cannot be selected"
         });
@@ -4267,185 +4323,185 @@ var init_automation = __esm({
     updateAutomationSchema = automationBodyFieldsSchema.partial().superRefine((value, ctx) => {
       if (value.chatConversationId) {
         ctx.addIssue({
-          code: z29.ZodIssueCode.custom,
+          code: z30.ZodIssueCode.custom,
           path: ["chatConversationId"],
           message: "Chat output creates an automation-owned conversation; existing chats cannot be selected"
         });
       }
     }).transform(normalizeAutomationInstructions).transform(normalizeAutomationNotifications);
-    baseTriggerSchema = z29.object({
-      label: z29.string().trim().max(120).optional().nullable(),
-      enabled: z29.boolean().optional().default(true)
+    baseTriggerSchema = z30.object({
+      label: z30.string().trim().max(120).optional().nullable(),
+      enabled: z30.boolean().optional().default(true)
     });
-    createAutomationTriggerSchema = z29.discriminatedUnion("kind", [
+    createAutomationTriggerSchema = z30.discriminatedUnion("kind", [
       baseTriggerSchema.extend({
-        kind: z29.literal("schedule"),
-        cronExpression: z29.string().trim().min(1),
-        timezone: z29.string().trim().min(1).default("UTC")
+        kind: z30.literal("schedule"),
+        cronExpression: z30.string().trim().min(1),
+        timezone: z30.string().trim().min(1).default("UTC")
       }),
       baseTriggerSchema.extend({
-        kind: z29.literal("webhook"),
-        signingMode: z29.enum(AUTOMATION_TRIGGER_SIGNING_MODES).optional().default("bearer"),
-        replayWindowSec: z29.number().int().min(30).max(86400).optional().default(300)
+        kind: z30.literal("webhook"),
+        signingMode: z30.enum(AUTOMATION_TRIGGER_SIGNING_MODES).optional().default("bearer"),
+        replayWindowSec: z30.number().int().min(30).max(86400).optional().default(300)
       }),
       baseTriggerSchema.extend({
-        kind: z29.literal("api")
+        kind: z30.literal("api")
       })
     ]);
-    updateAutomationTriggerSchema = z29.object({
-      label: z29.string().trim().max(120).optional().nullable(),
-      enabled: z29.boolean().optional(),
-      cronExpression: z29.string().trim().min(1).optional().nullable(),
-      timezone: z29.string().trim().min(1).optional().nullable(),
-      signingMode: z29.enum(AUTOMATION_TRIGGER_SIGNING_MODES).optional().nullable(),
-      replayWindowSec: z29.number().int().min(30).max(86400).optional().nullable()
+    updateAutomationTriggerSchema = z30.object({
+      label: z30.string().trim().max(120).optional().nullable(),
+      enabled: z30.boolean().optional(),
+      cronExpression: z30.string().trim().min(1).optional().nullable(),
+      timezone: z30.string().trim().min(1).optional().nullable(),
+      signingMode: z30.enum(AUTOMATION_TRIGGER_SIGNING_MODES).optional().nullable(),
+      replayWindowSec: z30.number().int().min(30).max(86400).optional().nullable()
     });
-    runAutomationSchema = z29.object({
-      triggerId: z29.string().uuid().optional().nullable(),
-      payload: z29.record(z29.unknown()).optional().nullable(),
-      idempotencyKey: z29.string().trim().max(255).optional().nullable(),
-      source: z29.enum(["manual", "api"]).optional().default("manual")
+    runAutomationSchema = z30.object({
+      triggerId: z30.string().uuid().optional().nullable(),
+      payload: z30.record(z30.unknown()).optional().nullable(),
+      idempotencyKey: z30.string().trim().max(255).optional().nullable(),
+      source: z30.enum(["manual", "api"]).optional().default("manual")
     });
-    rotateAutomationTriggerSecretSchema = z29.object({});
+    rotateAutomationTriggerSecretSchema = z30.object({});
   }
 });
 
 // ../packages/shared/dist/validators/calendar.js
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 var nullableUuid, createCalendarSourceSchema, updateCalendarSourceSchema, calendarEventBaseSchema, createCalendarEventSchema, updateCalendarEventSchema, calendarEventListQuerySchema, googleCalendarSyncSchema, updateGoogleCalendarOAuthConfigSchema;
 var init_calendar = __esm({
   "../packages/shared/dist/validators/calendar.js"() {
     "use strict";
     init_constants();
-    nullableUuid = z30.string().uuid().optional().nullable();
-    createCalendarSourceSchema = z30.object({
-      type: z30.enum(CALENDAR_SOURCE_TYPES).optional().default("rudder_local"),
-      name: z30.string().trim().min(1).max(160),
-      ownerType: z30.enum(CALENDAR_OWNER_TYPES).optional().default("user"),
-      ownerUserId: z30.string().trim().min(1).optional().nullable(),
+    nullableUuid = z31.string().uuid().optional().nullable();
+    createCalendarSourceSchema = z31.object({
+      type: z31.enum(CALENDAR_SOURCE_TYPES).optional().default("rudder_local"),
+      name: z31.string().trim().min(1).max(160),
+      ownerType: z31.enum(CALENDAR_OWNER_TYPES).optional().default("user"),
+      ownerUserId: z31.string().trim().min(1).optional().nullable(),
       ownerAgentId: nullableUuid,
-      externalProvider: z30.string().trim().min(1).max(80).optional().nullable(),
-      externalCalendarId: z30.string().trim().min(1).max(512).optional().nullable(),
-      visibilityDefault: z30.enum(CALENDAR_VISIBILITIES).optional().default("full"),
-      status: z30.enum(CALENDAR_SOURCE_STATUSES).optional().default("active"),
-      syncCursorJson: z30.record(z30.unknown()).optional().nullable()
+      externalProvider: z31.string().trim().min(1).max(80).optional().nullable(),
+      externalCalendarId: z31.string().trim().min(1).max(512).optional().nullable(),
+      visibilityDefault: z31.enum(CALENDAR_VISIBILITIES).optional().default("full"),
+      status: z31.enum(CALENDAR_SOURCE_STATUSES).optional().default("active"),
+      syncCursorJson: z31.record(z31.unknown()).optional().nullable()
     });
     updateCalendarSourceSchema = createCalendarSourceSchema.partial().extend({
-      lastSyncedAt: z30.coerce.date().optional().nullable()
+      lastSyncedAt: z31.coerce.date().optional().nullable()
     });
-    calendarEventBaseSchema = z30.object({
+    calendarEventBaseSchema = z31.object({
       sourceId: nullableUuid,
-      eventKind: z30.enum(CALENDAR_EVENT_KINDS),
-      eventStatus: z30.enum(CALENDAR_EVENT_STATUSES).optional().default("planned"),
-      ownerType: z30.enum(CALENDAR_OWNER_TYPES),
-      ownerUserId: z30.string().trim().min(1).optional().nullable(),
+      eventKind: z31.enum(CALENDAR_EVENT_KINDS),
+      eventStatus: z31.enum(CALENDAR_EVENT_STATUSES).optional().default("planned"),
+      ownerType: z31.enum(CALENDAR_OWNER_TYPES),
+      ownerUserId: z31.string().trim().min(1).optional().nullable(),
       ownerAgentId: nullableUuid,
-      title: z30.string().trim().min(1).max(240),
-      description: z30.string().optional().nullable(),
-      startAt: z30.coerce.date(),
-      endAt: z30.coerce.date(),
-      timezone: z30.string().trim().min(1).max(80).optional().default("UTC"),
-      allDay: z30.boolean().optional().default(false),
-      visibility: z30.enum(CALENDAR_VISIBILITIES).optional().default("full"),
+      title: z31.string().trim().min(1).max(240),
+      description: z31.string().optional().nullable(),
+      startAt: z31.coerce.date(),
+      endAt: z31.coerce.date(),
+      timezone: z31.string().trim().min(1).max(80).optional().default("UTC"),
+      allDay: z31.boolean().optional().default(false),
+      visibility: z31.enum(CALENDAR_VISIBILITIES).optional().default("full"),
       issueId: nullableUuid,
       projectId: nullableUuid,
       goalId: nullableUuid,
       approvalId: nullableUuid,
       heartbeatRunId: nullableUuid,
       activityId: nullableUuid,
-      sourceMode: z30.enum(CALENDAR_SOURCE_MODES).optional().default("manual"),
-      externalProvider: z30.string().trim().min(1).max(80).optional().nullable(),
-      externalCalendarId: z30.string().trim().min(1).max(512).optional().nullable(),
-      externalEventId: z30.string().trim().min(1).max(512).optional().nullable(),
-      externalEtag: z30.string().trim().min(1).max(512).optional().nullable(),
-      externalUpdatedAt: z30.coerce.date().optional().nullable()
+      sourceMode: z31.enum(CALENDAR_SOURCE_MODES).optional().default("manual"),
+      externalProvider: z31.string().trim().min(1).max(80).optional().nullable(),
+      externalCalendarId: z31.string().trim().min(1).max(512).optional().nullable(),
+      externalEventId: z31.string().trim().min(1).max(512).optional().nullable(),
+      externalEtag: z31.string().trim().min(1).max(512).optional().nullable(),
+      externalUpdatedAt: z31.coerce.date().optional().nullable()
     });
     createCalendarEventSchema = calendarEventBaseSchema.refine((value) => value.endAt.getTime() > value.startAt.getTime(), { path: ["endAt"], message: "End time must be after start time" });
     updateCalendarEventSchema = calendarEventBaseSchema.partial().refine((value) => value.startAt === void 0 || value.endAt === void 0 || value.endAt.getTime() > value.startAt.getTime(), { path: ["endAt"], message: "End time must be after start time" });
-    calendarEventListQuerySchema = z30.object({
-      start: z30.coerce.date(),
-      end: z30.coerce.date(),
-      agentIds: z30.string().optional(),
-      sourceIds: z30.string().optional(),
-      eventKinds: z30.string().optional(),
-      statuses: z30.string().optional()
+    calendarEventListQuerySchema = z31.object({
+      start: z31.coerce.date(),
+      end: z31.coerce.date(),
+      agentIds: z31.string().optional(),
+      sourceIds: z31.string().optional(),
+      eventKinds: z31.string().optional(),
+      statuses: z31.string().optional()
     }).refine((value) => value.end.getTime() > value.start.getTime(), { path: ["end"], message: "End time must be after start time" });
-    googleCalendarSyncSchema = z30.object({
-      sourceId: z30.string().uuid().optional().nullable()
+    googleCalendarSyncSchema = z31.object({
+      sourceId: z31.string().uuid().optional().nullable()
     });
-    updateGoogleCalendarOAuthConfigSchema = z30.object({
-      clientId: z30.string().trim().min(1).max(512).optional(),
-      clientSecret: z30.string().trim().min(1).max(2048).optional(),
-      clear: z30.boolean().optional().default(false)
+    updateGoogleCalendarOAuthConfigSchema = z31.object({
+      clientId: z31.string().trim().min(1).max(512).optional(),
+      clientSecret: z31.string().trim().min(1).max(2048).optional(),
+      clear: z31.boolean().optional().default(false)
     }).refine((value) => value.clear || value.clientId !== void 0 || value.clientSecret !== void 0, { message: "Provide credentials or clear the stored Google Calendar OAuth configuration" });
   }
 });
 
 // ../packages/shared/dist/validators/cost.js
-import { z as z31 } from "zod";
+import { z as z32 } from "zod";
 var createCostEventSchema, updateBudgetSchema;
 var init_cost = __esm({
   "../packages/shared/dist/validators/cost.js"() {
     "use strict";
     init_constants();
-    createCostEventSchema = z31.object({
-      agentId: z31.string().uuid(),
-      issueId: z31.string().uuid().optional().nullable(),
-      projectId: z31.string().uuid().optional().nullable(),
-      goalId: z31.string().uuid().optional().nullable(),
-      heartbeatRunId: z31.string().uuid().optional().nullable(),
-      billingCode: z31.string().optional().nullable(),
-      provider: z31.string().min(1),
-      biller: z31.string().min(1).optional(),
-      billingType: z31.enum(BILLING_TYPES).optional().default("unknown"),
-      model: z31.string().min(1),
-      inputTokens: z31.number().int().nonnegative().optional().default(0),
-      cachedInputTokens: z31.number().int().nonnegative().optional().default(0),
-      outputTokens: z31.number().int().nonnegative().optional().default(0),
-      costCents: z31.number().int().nonnegative(),
-      occurredAt: z31.string().datetime()
+    createCostEventSchema = z32.object({
+      agentId: z32.string().uuid(),
+      issueId: z32.string().uuid().optional().nullable(),
+      projectId: z32.string().uuid().optional().nullable(),
+      goalId: z32.string().uuid().optional().nullable(),
+      heartbeatRunId: z32.string().uuid().optional().nullable(),
+      billingCode: z32.string().optional().nullable(),
+      provider: z32.string().min(1),
+      biller: z32.string().min(1).optional(),
+      billingType: z32.enum(BILLING_TYPES).optional().default("unknown"),
+      model: z32.string().min(1),
+      inputTokens: z32.number().int().nonnegative().optional().default(0),
+      cachedInputTokens: z32.number().int().nonnegative().optional().default(0),
+      outputTokens: z32.number().int().nonnegative().optional().default(0),
+      costCents: z32.number().int().nonnegative(),
+      occurredAt: z32.string().datetime()
     }).transform((value) => ({
       ...value,
       biller: value.biller ?? value.provider
     }));
-    updateBudgetSchema = z31.object({
-      budgetMonthlyCents: z31.number().int().nonnegative()
+    updateBudgetSchema = z32.object({
+      budgetMonthlyCents: z32.number().int().nonnegative()
     });
   }
 });
 
 // ../packages/shared/dist/validators/finance.js
-import { z as z32 } from "zod";
+import { z as z33 } from "zod";
 var createFinanceEventSchema;
 var init_finance = __esm({
   "../packages/shared/dist/validators/finance.js"() {
     "use strict";
     init_constants();
-    createFinanceEventSchema = z32.object({
-      agentId: z32.string().uuid().optional().nullable(),
-      issueId: z32.string().uuid().optional().nullable(),
-      projectId: z32.string().uuid().optional().nullable(),
-      goalId: z32.string().uuid().optional().nullable(),
-      heartbeatRunId: z32.string().uuid().optional().nullable(),
-      costEventId: z32.string().uuid().optional().nullable(),
-      billingCode: z32.string().optional().nullable(),
-      description: z32.string().max(500).optional().nullable(),
-      eventKind: z32.enum(FINANCE_EVENT_KINDS),
-      direction: z32.enum(FINANCE_DIRECTIONS).optional().default("debit"),
-      biller: z32.string().min(1),
-      provider: z32.string().min(1).optional().nullable(),
-      executionAgentRuntimeType: z32.enum(AGENT_RUNTIME_TYPES).optional().nullable(),
-      pricingTier: z32.string().min(1).optional().nullable(),
-      region: z32.string().min(1).optional().nullable(),
-      model: z32.string().min(1).optional().nullable(),
-      quantity: z32.number().int().nonnegative().optional().nullable(),
-      unit: z32.enum(FINANCE_UNITS).optional().nullable(),
-      amountCents: z32.number().int().nonnegative(),
-      currency: z32.string().length(3).optional().default("USD"),
-      estimated: z32.boolean().optional().default(false),
-      externalInvoiceId: z32.string().optional().nullable(),
-      metadataJson: z32.record(z32.string(), z32.unknown()).optional().nullable(),
-      occurredAt: z32.string().datetime()
+    createFinanceEventSchema = z33.object({
+      agentId: z33.string().uuid().optional().nullable(),
+      issueId: z33.string().uuid().optional().nullable(),
+      projectId: z33.string().uuid().optional().nullable(),
+      goalId: z33.string().uuid().optional().nullable(),
+      heartbeatRunId: z33.string().uuid().optional().nullable(),
+      costEventId: z33.string().uuid().optional().nullable(),
+      billingCode: z33.string().optional().nullable(),
+      description: z33.string().max(500).optional().nullable(),
+      eventKind: z33.enum(FINANCE_EVENT_KINDS),
+      direction: z33.enum(FINANCE_DIRECTIONS).optional().default("debit"),
+      biller: z33.string().min(1),
+      provider: z33.string().min(1).optional().nullable(),
+      executionAgentRuntimeType: z33.enum(AGENT_RUNTIME_TYPES).optional().nullable(),
+      pricingTier: z33.string().min(1).optional().nullable(),
+      region: z33.string().min(1).optional().nullable(),
+      model: z33.string().min(1).optional().nullable(),
+      quantity: z33.number().int().nonnegative().optional().nullable(),
+      unit: z33.enum(FINANCE_UNITS).optional().nullable(),
+      amountCents: z33.number().int().nonnegative(),
+      currency: z33.string().length(3).optional().default("USD"),
+      estimated: z33.boolean().optional().default(false),
+      externalInvoiceId: z33.string().optional().nullable(),
+      metadataJson: z33.record(z33.string(), z33.unknown()).optional().nullable(),
+      occurredAt: z33.string().datetime()
     }).transform((value) => ({
       ...value,
       currency: value.currency.toUpperCase()
@@ -4454,127 +4510,127 @@ var init_finance = __esm({
 });
 
 // ../packages/shared/dist/validators/asset.js
-import { z as z33 } from "zod";
+import { z as z34 } from "zod";
 var createAssetImageMetadataSchema;
 var init_asset = __esm({
   "../packages/shared/dist/validators/asset.js"() {
     "use strict";
-    createAssetImageMetadataSchema = z33.object({
-      namespace: z33.string().trim().min(1).max(120).regex(/^[a-zA-Z0-9/_-]+$/).optional()
+    createAssetImageMetadataSchema = z34.object({
+      namespace: z34.string().trim().min(1).max(120).regex(/^[a-zA-Z0-9/_-]+$/).optional()
     });
   }
 });
 
 // ../packages/shared/dist/validators/access.js
-import { z as z34 } from "zod";
+import { z as z35 } from "zod";
 var createCompanyInviteSchema, createOpenClawInvitePromptSchema, acceptInviteSchema, listJoinRequestsQuerySchema, claimJoinRequestApiKeySchema, boardCliAuthAccessLevelSchema, createCliAuthChallengeSchema, resolveCliAuthChallengeSchema, updateMemberPermissionsSchema, updateUserCompanyAccessSchema;
 var init_access = __esm({
   "../packages/shared/dist/validators/access.js"() {
     "use strict";
     init_constants();
-    createCompanyInviteSchema = z34.object({
-      allowedJoinTypes: z34.enum(INVITE_JOIN_TYPES).default("both"),
-      defaultsPayload: z34.record(z34.string(), z34.unknown()).optional().nullable(),
-      agentMessage: z34.string().max(4e3).optional().nullable()
+    createCompanyInviteSchema = z35.object({
+      allowedJoinTypes: z35.enum(INVITE_JOIN_TYPES).default("both"),
+      defaultsPayload: z35.record(z35.string(), z35.unknown()).optional().nullable(),
+      agentMessage: z35.string().max(4e3).optional().nullable()
     });
-    createOpenClawInvitePromptSchema = z34.object({
-      agentMessage: z34.string().max(4e3).optional().nullable()
+    createOpenClawInvitePromptSchema = z35.object({
+      agentMessage: z35.string().max(4e3).optional().nullable()
     });
-    acceptInviteSchema = z34.object({
-      requestType: z34.enum(JOIN_REQUEST_TYPES),
-      agentName: z34.string().min(1).max(120).optional(),
-      agentRuntimeType: z34.enum(AGENT_RUNTIME_TYPES).optional(),
-      capabilities: z34.string().max(4e3).optional().nullable(),
-      agentDefaultsPayload: z34.record(z34.string(), z34.unknown()).optional().nullable(),
+    acceptInviteSchema = z35.object({
+      requestType: z35.enum(JOIN_REQUEST_TYPES),
+      agentName: z35.string().min(1).max(120).optional(),
+      agentRuntimeType: z35.enum(AGENT_RUNTIME_TYPES).optional(),
+      capabilities: z35.string().max(4e3).optional().nullable(),
+      agentDefaultsPayload: z35.record(z35.string(), z35.unknown()).optional().nullable(),
       // OpenClaw join compatibility fields accepted at top level.
-      responsesWebhookUrl: z34.string().max(4e3).optional().nullable(),
-      responsesWebhookMethod: z34.string().max(32).optional().nullable(),
-      responsesWebhookHeaders: z34.record(z34.string(), z34.unknown()).optional().nullable(),
-      rudderApiUrl: z34.string().max(4e3).optional().nullable(),
-      webhookAuthHeader: z34.string().max(4e3).optional().nullable()
+      responsesWebhookUrl: z35.string().max(4e3).optional().nullable(),
+      responsesWebhookMethod: z35.string().max(32).optional().nullable(),
+      responsesWebhookHeaders: z35.record(z35.string(), z35.unknown()).optional().nullable(),
+      rudderApiUrl: z35.string().max(4e3).optional().nullable(),
+      webhookAuthHeader: z35.string().max(4e3).optional().nullable()
     });
-    listJoinRequestsQuerySchema = z34.object({
-      status: z34.enum(JOIN_REQUEST_STATUSES).optional(),
-      requestType: z34.enum(JOIN_REQUEST_TYPES).optional()
+    listJoinRequestsQuerySchema = z35.object({
+      status: z35.enum(JOIN_REQUEST_STATUSES).optional(),
+      requestType: z35.enum(JOIN_REQUEST_TYPES).optional()
     });
-    claimJoinRequestApiKeySchema = z34.object({
-      claimSecret: z34.string().min(16).max(256)
+    claimJoinRequestApiKeySchema = z35.object({
+      claimSecret: z35.string().min(16).max(256)
     });
-    boardCliAuthAccessLevelSchema = z34.enum([
+    boardCliAuthAccessLevelSchema = z35.enum([
       "board",
       "instance_admin_required"
     ]);
-    createCliAuthChallengeSchema = z34.object({
-      command: z34.string().min(1).max(240),
-      clientName: z34.string().max(120).optional().nullable(),
+    createCliAuthChallengeSchema = z35.object({
+      command: z35.string().min(1).max(240),
+      clientName: z35.string().max(120).optional().nullable(),
       requestedAccess: boardCliAuthAccessLevelSchema.default("board"),
-      requestedCompanyId: z34.string().uuid().optional().nullable()
+      requestedCompanyId: z35.string().uuid().optional().nullable()
     });
-    resolveCliAuthChallengeSchema = z34.object({
-      token: z34.string().min(16).max(256)
+    resolveCliAuthChallengeSchema = z35.object({
+      token: z35.string().min(16).max(256)
     });
-    updateMemberPermissionsSchema = z34.object({
-      grants: z34.array(z34.object({
-        permissionKey: z34.enum(PERMISSION_KEYS),
-        scope: z34.record(z34.string(), z34.unknown()).optional().nullable()
+    updateMemberPermissionsSchema = z35.object({
+      grants: z35.array(z35.object({
+        permissionKey: z35.enum(PERMISSION_KEYS),
+        scope: z35.record(z35.string(), z35.unknown()).optional().nullable()
       }))
     });
-    updateUserCompanyAccessSchema = z34.object({
-      orgIds: z34.array(z34.string().uuid()).default([])
+    updateUserCompanyAccessSchema = z35.object({
+      orgIds: z35.array(z35.string().uuid()).default([])
     });
   }
 });
 
 // ../packages/shared/dist/validators/plugin-v1.js
-import { z as z35 } from "zod";
+import { z as z36 } from "zod";
 var rudderPluginPackageFileSchema, inspectRudderPluginSchema, inspectRudderPluginArchiveSchema, configureRudderPluginMarketplaceSchema, installRudderPluginSchema, updateRudderPluginEnablementSchema, configureRudderPluginSkillsSchema, configureRudderPluginMcpSchema, customizeRudderPluginSkillSchema;
 var init_plugin_v1 = __esm({
   "../packages/shared/dist/validators/plugin-v1.js"() {
     "use strict";
-    rudderPluginPackageFileSchema = z35.object({
-      path: z35.string().min(1).max(1024),
-      content: z35.string().max(14e6),
-      encoding: z35.enum(["utf8", "base64"]).optional().default("utf8")
+    rudderPluginPackageFileSchema = z36.object({
+      path: z36.string().min(1).max(1024),
+      content: z36.string().max(14e6),
+      encoding: z36.enum(["utf8", "base64"]).optional().default("utf8")
     }).strict();
-    inspectRudderPluginSchema = z35.object({
-      sourceLabel: z35.string().trim().min(1).max(240),
-      sourceType: z35.literal("local_upload").optional().default("local_upload"),
-      files: z35.array(rudderPluginPackageFileSchema).min(1).max(500)
+    inspectRudderPluginSchema = z36.object({
+      sourceLabel: z36.string().trim().min(1).max(240),
+      sourceType: z36.literal("local_upload").optional().default("local_upload"),
+      files: z36.array(rudderPluginPackageFileSchema).min(1).max(500)
     }).strict();
-    inspectRudderPluginArchiveSchema = z35.object({
-      sourceLabel: z35.string().trim().min(1).max(240),
-      filename: z35.string().trim().min(1).max(240).refine((value) => /\.zip$/i.test(value), "Only ZIP Plugin archives are supported"),
-      content: z35.string().min(1).max(14e6),
-      encoding: z35.literal("base64")
+    inspectRudderPluginArchiveSchema = z36.object({
+      sourceLabel: z36.string().trim().min(1).max(240),
+      filename: z36.string().trim().min(1).max(240).refine((value) => /\.zip$/i.test(value), "Only ZIP Plugin archives are supported"),
+      content: z36.string().min(1).max(14e6),
+      encoding: z36.literal("base64")
     }).strict();
-    configureRudderPluginMarketplaceSchema = z35.object({
-      sourceLabel: z35.string().trim().min(1).max(240),
-      files: z35.array(rudderPluginPackageFileSchema).min(1).max(500).optional(),
-      github: z35.object({
-        repository: z35.string().url().max(500),
-        commit: z35.string().regex(/^[0-9a-f]{40}$/i, "A full 40-character Git commit SHA is required")
+    configureRudderPluginMarketplaceSchema = z36.object({
+      sourceLabel: z36.string().trim().min(1).max(240),
+      files: z36.array(rudderPluginPackageFileSchema).min(1).max(500).optional(),
+      github: z36.object({
+        repository: z36.string().url().max(500),
+        commit: z36.string().regex(/^[0-9a-f]{40}$/i, "A full 40-character Git commit SHA is required")
       }).strict().optional()
     }).strict().superRefine((value, ctx) => {
       if (Boolean(value.files) === Boolean(value.github)) {
-        ctx.addIssue({ code: z35.ZodIssueCode.custom, message: "Provide exactly one local marketplace folder or pinned GitHub marketplace" });
+        ctx.addIssue({ code: z36.ZodIssueCode.custom, message: "Provide exactly one local marketplace folder or pinned GitHub marketplace" });
       }
     });
-    installRudderPluginSchema = z35.object({
-      enabled: z35.boolean().optional().default(true),
-      confirmAccessExpansion: z35.boolean().optional().default(false),
-      skillConflictStrategy: z35.enum(["keep", "replace", "rename"]).optional()
+    installRudderPluginSchema = z36.object({
+      enabled: z36.boolean().optional().default(true),
+      confirmAccessExpansion: z36.boolean().optional().default(false),
+      skillConflictStrategy: z36.enum(["keep", "replace", "rename"]).optional()
     }).strict();
-    updateRudderPluginEnablementSchema = z35.object({
-      enabled: z35.boolean()
+    updateRudderPluginEnablementSchema = z36.object({
+      enabled: z36.boolean()
     }).strict();
-    configureRudderPluginSkillsSchema = z35.object({
-      agentIds: z35.array(z35.string().uuid()).max(100)
+    configureRudderPluginSkillsSchema = z36.object({
+      agentIds: z36.array(z36.string().uuid()).max(100)
     }).strict();
-    configureRudderPluginMcpSchema = z35.object({
-      componentId: z35.string().uuid()
+    configureRudderPluginMcpSchema = z36.object({
+      componentId: z36.string().uuid()
     }).strict();
-    customizeRudderPluginSkillSchema = z35.object({
-      componentId: z35.string().uuid()
+    customizeRudderPluginSkillSchema = z36.object({
+      componentId: z36.string().uuid()
     }).strict();
   }
 });
@@ -4607,6 +4663,7 @@ var init_validators = __esm({
     init_workspace_backup2();
     init_goal();
     init_approval();
+    init_request();
     init_secret();
     init_automation();
     init_calendar();
@@ -4650,6 +4707,7 @@ var init_api = __esm({
       calendar: `${API_PREFIX}/calendar`,
       goals: `${API_PREFIX}/goals`,
       approvals: `${API_PREFIX}/approvals`,
+      requests: `${API_PREFIX}/requests`,
       secrets: `${API_PREFIX}/secrets`,
       costs: `${API_PREFIX}/costs`,
       activity: `${API_PREFIX}/activity`,
@@ -4780,34 +4838,34 @@ var init_issue_activity = __esm({
 });
 
 // ../packages/shared/dist/config-schema.js
-import { z as z36 } from "zod";
+import { z as z37 } from "zod";
 var DEFAULT_DATABASE_BACKUP_MAX_ESTIMATED_BYTES, configMetaSchema, llmConfigSchema, databaseBackupConfigSchema, databaseConfigSchema, loggingConfigSchema, serverConfigSchema, authConfigSchema, storageLocalDiskConfigSchema, storageS3ConfigSchema, storageConfigSchema, secretsLocalEncryptedConfigSchema, secretsConfigSchema, rudderConfigSchema;
 var init_config_schema = __esm({
   "../packages/shared/dist/config-schema.js"() {
     "use strict";
     init_constants();
     DEFAULT_DATABASE_BACKUP_MAX_ESTIMATED_BYTES = 256 * 1024 * 1024;
-    configMetaSchema = z36.object({
-      version: z36.literal(1),
-      updatedAt: z36.string(),
-      source: z36.enum(["onboard", "configure", "doctor"])
+    configMetaSchema = z37.object({
+      version: z37.literal(1),
+      updatedAt: z37.string(),
+      source: z37.enum(["onboard", "configure", "doctor"])
     });
-    llmConfigSchema = z36.object({
-      provider: z36.enum(["claude", "openai"]),
-      apiKey: z36.string().optional()
+    llmConfigSchema = z37.object({
+      provider: z37.enum(["claude", "openai"]),
+      apiKey: z37.string().optional()
     });
-    databaseBackupConfigSchema = z36.object({
-      enabled: z36.boolean().default(true),
-      intervalMinutes: z36.number().int().min(1).max(7 * 24 * 60).default(60),
-      retentionDays: z36.number().int().min(1).max(3650).default(30),
-      maxEstimatedBytes: z36.number().int().min(1).default(DEFAULT_DATABASE_BACKUP_MAX_ESTIMATED_BYTES),
-      dir: z36.string().default("~/.rudder/instances/default/data/backups")
+    databaseBackupConfigSchema = z37.object({
+      enabled: z37.boolean().default(true),
+      intervalMinutes: z37.number().int().min(1).max(7 * 24 * 60).default(60),
+      retentionDays: z37.number().int().min(1).max(3650).default(30),
+      maxEstimatedBytes: z37.number().int().min(1).default(DEFAULT_DATABASE_BACKUP_MAX_ESTIMATED_BYTES),
+      dir: z37.string().default("~/.rudder/instances/default/data/backups")
     });
-    databaseConfigSchema = z36.object({
-      mode: z36.enum(["embedded-postgres", "postgres"]).default("embedded-postgres"),
-      connectionString: z36.string().optional(),
-      embeddedPostgresDataDir: z36.string().default("~/.rudder/instances/default/db"),
-      embeddedPostgresPort: z36.number().int().min(1).max(65535).default(54329),
+    databaseConfigSchema = z37.object({
+      mode: z37.enum(["embedded-postgres", "postgres"]).default("embedded-postgres"),
+      connectionString: z37.string().optional(),
+      embeddedPostgresDataDir: z37.string().default("~/.rudder/instances/default/db"),
+      embeddedPostgresPort: z37.number().int().min(1).max(65535).default(54329),
       backup: databaseBackupConfigSchema.default({
         enabled: true,
         intervalMinutes: 60,
@@ -4816,35 +4874,35 @@ var init_config_schema = __esm({
         dir: "~/.rudder/instances/default/data/backups"
       })
     });
-    loggingConfigSchema = z36.object({
-      mode: z36.enum(["file", "cloud"]),
-      logDir: z36.string().default("~/.rudder/instances/default/logs")
+    loggingConfigSchema = z37.object({
+      mode: z37.enum(["file", "cloud"]),
+      logDir: z37.string().default("~/.rudder/instances/default/logs")
     });
-    serverConfigSchema = z36.object({
-      deploymentMode: z36.enum(DEPLOYMENT_MODES).default("local_trusted"),
-      exposure: z36.enum(DEPLOYMENT_EXPOSURES).default("private"),
-      host: z36.string().default("127.0.0.1"),
-      port: z36.number().int().min(1).max(65535).default(3100),
-      allowedHostnames: z36.array(z36.string().min(1)).default([]),
-      serveUi: z36.boolean().default(true)
+    serverConfigSchema = z37.object({
+      deploymentMode: z37.enum(DEPLOYMENT_MODES).default("local_trusted"),
+      exposure: z37.enum(DEPLOYMENT_EXPOSURES).default("private"),
+      host: z37.string().default("127.0.0.1"),
+      port: z37.number().int().min(1).max(65535).default(3100),
+      allowedHostnames: z37.array(z37.string().min(1)).default([]),
+      serveUi: z37.boolean().default(true)
     });
-    authConfigSchema = z36.object({
-      baseUrlMode: z36.enum(AUTH_BASE_URL_MODES).default("auto"),
-      publicBaseUrl: z36.string().url().optional(),
-      disableSignUp: z36.boolean().default(false)
+    authConfigSchema = z37.object({
+      baseUrlMode: z37.enum(AUTH_BASE_URL_MODES).default("auto"),
+      publicBaseUrl: z37.string().url().optional(),
+      disableSignUp: z37.boolean().default(false)
     });
-    storageLocalDiskConfigSchema = z36.object({
-      baseDir: z36.string().default("~/.rudder/instances/default/data/storage")
+    storageLocalDiskConfigSchema = z37.object({
+      baseDir: z37.string().default("~/.rudder/instances/default/data/storage")
     });
-    storageS3ConfigSchema = z36.object({
-      bucket: z36.string().min(1).default("rudder"),
-      region: z36.string().min(1).default("us-east-1"),
-      endpoint: z36.string().optional(),
-      prefix: z36.string().default(""),
-      forcePathStyle: z36.boolean().default(false)
+    storageS3ConfigSchema = z37.object({
+      bucket: z37.string().min(1).default("rudder"),
+      region: z37.string().min(1).default("us-east-1"),
+      endpoint: z37.string().optional(),
+      prefix: z37.string().default(""),
+      forcePathStyle: z37.boolean().default(false)
     });
-    storageConfigSchema = z36.object({
-      provider: z36.enum(STORAGE_PROVIDERS).default("local_disk"),
+    storageConfigSchema = z37.object({
+      provider: z37.enum(STORAGE_PROVIDERS).default("local_disk"),
       localDisk: storageLocalDiskConfigSchema.default({
         baseDir: "~/.rudder/instances/default/data/storage"
       }),
@@ -4855,17 +4913,17 @@ var init_config_schema = __esm({
         forcePathStyle: false
       })
     });
-    secretsLocalEncryptedConfigSchema = z36.object({
-      keyFilePath: z36.string().default("~/.rudder/instances/default/secrets/master.key")
+    secretsLocalEncryptedConfigSchema = z37.object({
+      keyFilePath: z37.string().default("~/.rudder/instances/default/secrets/master.key")
     });
-    secretsConfigSchema = z36.object({
-      provider: z36.enum(SECRET_PROVIDERS).default("local_encrypted"),
-      strictMode: z36.boolean().default(false),
+    secretsConfigSchema = z37.object({
+      provider: z37.enum(SECRET_PROVIDERS).default("local_encrypted"),
+      strictMode: z37.boolean().default(false),
       localEncrypted: secretsLocalEncryptedConfigSchema.default({
         keyFilePath: "~/.rudder/instances/default/secrets/master.key"
       })
     });
-    rudderConfigSchema = z36.object({
+    rudderConfigSchema = z37.object({
       $meta: configMetaSchema,
       llm: llmConfigSchema.optional(),
       database: databaseConfigSchema,
@@ -4898,7 +4956,7 @@ var init_config_schema = __esm({
       if (value.server.deploymentMode === "local_trusted") {
         if (value.server.exposure !== "private") {
           ctx.addIssue({
-            code: z36.ZodIssueCode.custom,
+            code: z37.ZodIssueCode.custom,
             message: "server.exposure must be private when deploymentMode is local_trusted",
             path: ["server", "exposure"]
           });
@@ -4907,21 +4965,21 @@ var init_config_schema = __esm({
       }
       if (value.auth.baseUrlMode === "explicit" && !value.auth.publicBaseUrl) {
         ctx.addIssue({
-          code: z36.ZodIssueCode.custom,
+          code: z37.ZodIssueCode.custom,
           message: "auth.publicBaseUrl is required when auth.baseUrlMode is explicit",
           path: ["auth", "publicBaseUrl"]
         });
       }
       if (value.server.exposure === "public" && value.auth.baseUrlMode !== "explicit") {
         ctx.addIssue({
-          code: z36.ZodIssueCode.custom,
+          code: z37.ZodIssueCode.custom,
           message: "auth.baseUrlMode must be explicit when deploymentMode=authenticated and exposure=public",
           path: ["auth", "baseUrlMode"]
         });
       }
       if (value.server.exposure === "public" && !value.auth.publicBaseUrl) {
         ctx.addIssue({
-          code: z36.ZodIssueCode.custom,
+          code: z37.ZodIssueCode.custom,
           message: "auth.publicBaseUrl is required when deploymentMode=authenticated and exposure=public",
           path: ["auth", "publicBaseUrl"]
         });
@@ -4965,6 +5023,7 @@ var init_dist = __esm({
     init_project_url_key();
     init_short_refs();
     init_token_usage();
+    init_request();
     init_chat_transcript_visibility();
     init_issue_activity();
     init_config_schema();
@@ -9197,6 +9256,51 @@ var RUDDER_MCP_TOOL_DESCRIPTORS = [
     "requiresAgentId": false,
     "attachesRunIdWhenAvailable": true
   },
+  {
+    "capabilityId": "goal.list",
+    "name": "rudder_goal_list",
+    "description": "Discover Goals owned by the authenticated Agent; defaults to active Goals and returns current progress, next step, and attention state.",
+    "mutating": false,
+    "requiresOrgId": true,
+    "requiresAgentId": true,
+    "attachesRunIdWhenAvailable": false
+  },
+  {
+    "capabilityId": "goal.context",
+    "name": "rudder_goal_context",
+    "description": "Read the owned Goal agreement and current operating context before acting: contract revision, criteria, boundaries, progress, next step, attention, proposals, and recent feedback.",
+    "mutating": false,
+    "requiresOrgId": false,
+    "requiresAgentId": true,
+    "attachesRunIdWhenAvailable": false
+  },
+  {
+    "capabilityId": "goal.progress",
+    "name": "rudder_goal_progress",
+    "description": "Record evidence-backed progress for a Goal owned by the authenticated Agent and attribute it to the current Run.",
+    "mutating": true,
+    "requiresOrgId": false,
+    "requiresAgentId": true,
+    "attachesRunIdWhenAvailable": true
+  },
+  {
+    "capabilityId": "goal.change.propose",
+    "name": "rudder_goal_change_propose",
+    "description": "Propose a reviewable change to the current Goal contract when evidence shows its outcome, criteria, boundaries, or deadlines should change.",
+    "mutating": true,
+    "requiresOrgId": false,
+    "requiresAgentId": true,
+    "attachesRunIdWhenAvailable": true
+  },
+  {
+    "capabilityId": "goal.result.propose",
+    "name": "rudder_goal_result_propose",
+    "description": "Submit an evidence-backed Goal result for mandatory human acceptance without closing the Goal.",
+    "mutating": true,
+    "requiresOrgId": false,
+    "requiresAgentId": true,
+    "attachesRunIdWhenAvailable": true
+  },
   {
     "capabilityId": "issue.get",
     "name": "rudder_issue_get",
@@ -9308,7 +9412,7 @@ var RUDDER_MCP_TOOL_DESCRIPTORS = [
   {
     "capabilityId": "issue.block",
     "name": "rudder_issue_block",
-    "description": "Mark an issue blocked with a required blocker comment, optionally uploading images.",
+    "description": "Request human assistance after bounded recovery attempts; repeated matching claims are audited before the Issue becomes blocked.",
     "mutating": true,
     "requiresOrgId": false,
     "requiresAgentId": false,
@@ -10225,6 +10329,7 @@ function coreMcpInputSchema(id) {
     ...required.length > 0 ? { required } : {}
   });
   const issue = string("Issue UUID, identifier, or short reference.", { maxLength: 200 });
+  const goal = string("Goal UUID from the current Goal Runtime Context.", { maxLength: 200 });
   const project = string("Project UUID or shortname.", { maxLength: 200 });
   const approval = string("Approval UUID or short reference.", { maxLength: 200 });
   const automation = string("Automation UUID or short reference.", { maxLength: 200 });
@@ -10265,6 +10370,120 @@ function coreMcpInputSchema(id) {
       return schema({ selectionRefs: strings("Skill selection references.", 100) }, ["selectionRefs"]);
     case "agent.skills.sync":
       return schema({ desiredSkills: string("Comma-separated desired skill references.", { maxLength: 2e4 }) }, ["desiredSkills"]);
+    case "goal.list":
+      return schema({
+        lifecycle: string("Goal lifecycle filter; active is the safe default.", {
+          enum: ["draft", "active", "closed", "all"],
+          maxLength: 20
+        }),
+        focus: boolean("Filter by whether the Goal is the organization Focus Goal."),
+        facet: string("Current Goal workspace facet.", {
+          enum: ["agent_advancing", "needs_attention", "waiting_focus", "waiting_external", "ready_for_acceptance", "closed"],
+          maxLength: 40
+        }),
+        limit: number("Maximum owned Goals to return.", 1, 100)
+      });
+    case "goal.context":
+      return schema({ goal: string("Goal UUID returned by rudder_goal_list.", { maxLength: 200 }) }, ["goal"]);
+    case "goal.progress":
+      return schema({
+        goal,
+        summary: string("Plain-language progress, observed change, or named blocker."),
+        activityKind: string("Progress classification.", { enum: ["progress", "evidence", "bottleneck"], maxLength: 30 }),
+        evidenceRefs: {
+          type: "array",
+          description: "URI-like references to artifacts, measurements, or other supporting evidence.",
+          minItems: 1,
+          maxItems: 100,
+          items: string("URI-like evidence reference.", { maxLength: 8192 })
+        },
+        idempotencyKey: string("Stable key for safe retry.", { maxLength: 500 })
+      }, ["goal", "summary", "evidenceRefs", "idempotencyKey"]);
+    case "goal.change.propose":
+      return schema({
+        goal,
+        contractRevision: number("Current Goal contract revision.", 1, 1e9),
+        afterContract: {
+          type: "object",
+          description: "Only the Goal contract fields that should change.",
+          additionalProperties: false,
+          minProperties: 1,
+          properties: {
+            outcomeStatement: string("Proposed result-oriented outcome."),
+            objectiveMode: string("Proposed objective mode.", {
+              enum: ["target", "maximize", "maintain", "decide"],
+              maxLength: 20
+            }),
+            criteria: {
+              type: "array",
+              minItems: 1,
+              maxItems: 100,
+              items: schema({
+                id: string("Stable criterion id.", { maxLength: 500 }),
+                label: string("Plain-language success criterion."),
+                evaluator: string("Criterion evaluator.", {
+                  enum: ["artifact", "metric", "policy", "human"],
+                  maxLength: 20
+                }),
+                evidenceRequirements: {
+                  type: "array",
+                  maxItems: 100,
+                  items: string("URI-like required evidence reference.", { maxLength: 8192 })
+                }
+              }, ["id", "label", "evaluator"])
+            },
+            autonomyEnvelope: { type: "object", additionalProperties: true },
+            humanAuthorities: { type: "object", additionalProperties: true },
+            evaluationPolicy: { type: "object", additionalProperties: true },
+            actionDeadline: {
+              description: "Proposed ISO-8601 action deadline, or null to clear it.",
+              oneOf: [{ type: "string", format: "date-time" }, { type: "null" }]
+            },
+            evaluationDeadline: {
+              description: "Proposed ISO-8601 evaluation deadline, or null to clear it.",
+              oneOf: [{ type: "string", format: "date-time" }, { type: "null" }]
+            }
+          }
+        },
+        rationale: string("Why the current contract should change and what evidence invalidated it."),
+        evidenceRefs: {
+          type: "array",
+          description: "URI-like references supporting the proposed change.",
+          maxItems: 100,
+          items: string("URI-like evidence reference.", { maxLength: 8192 })
+        },
+        idempotencyKey: string("Stable key for safe retry.", { maxLength: 500 })
+      }, ["goal", "contractRevision", "afterContract", "rationale", "idempotencyKey"]);
+    case "goal.result.propose":
+      return schema({
+        goal,
+        contractRevision: number("Current Goal contract revision.", 1, 1e9),
+        criteria: {
+          type: "array",
+          description: "Criterion outcomes for the current contract revision.",
+          minItems: 1,
+          maxItems: 100,
+          items: schema({
+            id: string("Criterion id from the Goal Runtime Context.", { maxLength: 500 }),
+            status: string("Observed criterion status.", { enum: ["met", "unmet", "breached", "unknown"], maxLength: 20 })
+          }, ["id", "status"])
+        },
+        evidenceRefs: {
+          type: "array",
+          description: "URI-like references supporting the proposed result.",
+          minItems: 1,
+          maxItems: 100,
+          items: string("URI-like evidence reference.", { maxLength: 8192 })
+        },
+        resultValue: {
+          description: "Optional measured result value.",
+          oneOf: [{ type: "string", maxLength: 1e5 }, { type: "number" }, { type: "boolean" }]
+        },
+        decision: string("Optional decision reached for decide-mode Goals."),
+        resultPayload: { type: "object", description: "Optional structured result details.", additionalProperties: true },
+        riskSummary: string("Known risks, limitations, or remaining gaps."),
+        idempotencyKey: string("Stable key for safe retry.", { maxLength: 500 })
+      }, ["goal", "contractRevision", "criteria", "evidenceRefs", "riskSummary", "idempotencyKey"]);
     case "issue.list":
       return schema({
         status: string("Comma-separated issue statuses.", { maxLength: 500 }),
@@ -10806,6 +11025,66 @@ var AGENT_CLI_CAPABILITIES = [
     requiresRunId: false,
     attachesRunIdWhenAvailable: true
   },
+  {
+    id: "goal.list",
+    command: "rudder goal list [--lifecycle <draft|active|closed|all>] [--focus <true|false>] [--facet <facet>] [--limit <n>]",
+    category: "goal",
+    description: "Discover Goals owned by the authenticated Agent; defaults to active Goals and returns current progress, next step, and attention state.",
+    mutating: false,
+    contract: "agent-v1",
+    requiresOrgId: true,
+    requiresAgentId: true,
+    requiresRunId: false,
+    attachesRunIdWhenAvailable: false
+  },
+  {
+    id: "goal.context",
+    command: "rudder goal context <goal-id>",
+    category: "goal",
+    description: "Read the owned Goal agreement and current operating context before acting: contract revision, criteria, boundaries, progress, next step, attention, proposals, and recent feedback.",
+    mutating: false,
+    contract: "agent-v1",
+    requiresOrgId: false,
+    requiresAgentId: true,
+    requiresRunId: false,
+    attachesRunIdWhenAvailable: false
+  },
+  {
+    id: "goal.progress",
+    command: "rudder goal progress <goal-id> --summary <text> --evidence-refs <json> --idempotency-key <key>",
+    category: "goal",
+    description: "Record evidence-backed progress for a Goal owned by the authenticated Agent and attribute it to the current Run.",
+    mutating: true,
+    contract: "agent-v1",
+    requiresOrgId: false,
+    requiresAgentId: true,
+    requiresRunId: true,
+    attachesRunIdWhenAvailable: true
+  },
+  {
+    id: "goal.change.propose",
+    command: "rudder goal change propose <goal-id> --contract-revision <n> --after-contract <json> --rationale <text> --idempotency-key <key>",
+    category: "goal",
+    description: "Propose a reviewable change to the current Goal contract when evidence shows its outcome, criteria, boundaries, or deadlines should change.",
+    mutating: true,
+    contract: "agent-v1",
+    requiresOrgId: false,
+    requiresAgentId: true,
+    requiresRunId: true,
+    attachesRunIdWhenAvailable: true
+  },
+  {
+    id: "goal.result.propose",
+    command: "rudder goal result propose <goal-id> --contract-revision <n> --criteria <json> --evidence-refs <json> --risk-summary <text> --idempotency-key <key>",
+    category: "goal",
+    description: "Submit an evidence-backed Goal result for mandatory human acceptance without closing the Goal.",
+    mutating: true,
+    contract: "agent-v1",
+    requiresOrgId: false,
+    requiresAgentId: true,
+    requiresRunId: true,
+    attachesRunIdWhenAvailable: true
+  },
   {
     id: "agent.hire",
     command: "rudder agent hire --org-id <id> --payload <json>",
@@ -11026,7 +11305,7 @@ var AGENT_CLI_CAPABILITIES = [
     id: "issue.block",
     command: "rudder issue block <issue> --comment-file <path> [--image <path>]",
     category: "issue",
-    description: "Mark an issue blocked with a required blocker comment, optionally uploading images.",
+    description: "Request human assistance after bounded recovery attempts; repeated matching claims are audited before the Issue becomes blocked.",
     mutating: true,
     contract: "agent-v1",
     requiresOrgId: false,
@@ -11987,6 +12266,7 @@ var AGENT_CLI_CAPABILITIES = [
 // src/agent-v1-registry.ts
 var CATEGORY_TITLES = {
   agent: "Agent",
+  goal: "Goal",
   issue: "Issue",
   project: "Project",
   automation: "Automation",
@@ -12277,6 +12557,10 @@ var LEGACY_ARGUMENT_ALIASES = {
     selections: "selectionRefs",
     skills: "selectionRefs"
   },
+  "goal.context": { goalId: "goal" },
+  "goal.progress": { goalId: "goal" },
+  "goal.change.propose": { goalId: "goal" },
+  "goal.result.propose": { goalId: "goal" },
   "issue.get": { issueId: "issue" },
   "issue.context": { issueId: "issue" },
   "issue.checkout": { issueId: "issue" },
@@ -12705,6 +12989,64 @@ async function callToolDirectlyIfSupported(toolName, rawArgs, env, signal) {
       return success(await api.get("/api/agents/me"));
     case "agent.inbox":
       return success(await api.get("/api/agents/me/inbox-lite"));
+    case "goal.list": {
+      const orgId = requiredRuntimeString(env, "RUDDER_ORG_ID");
+      requiredRuntimeString(env, "RUDDER_AGENT_ID");
+      const params = new URLSearchParams({
+        lifecycle: optionalString(input.lifecycle) ?? "active",
+        limit: String(parsePositiveInteger(input.limit, 20))
+      });
+      if (typeof input.focus === "boolean") params.set("focus", String(input.focus));
+      appendOptionalQuery(params, "facet", input.facet);
+      return success(await api.get(`/api/orgs/${encodeURIComponent(orgId)}/goals/assigned?${params}`));
+    }
+    case "goal.context":
+      requiredRuntimeString(env, "RUDDER_AGENT_ID");
+      return success(await api.get(
+        `/api/goals/${encodeURIComponent(requiredAnyString(input, ["goal", "goalId"]))}/agent-context`
+      ));
+    case "goal.progress": {
+      const payload = createGoalActivitySchema.parse({
+        summary: requiredString(input, "summary"),
+        activityKind: optionalString(input.activityKind) ?? "progress",
+        evidenceRefs: input.evidenceRefs,
+        idempotencyKey: requiredString(input, "idempotencyKey")
+      });
+      return success(await api.post(
+        `/api/goals/${encodeURIComponent(requiredAnyString(input, ["goal", "goalId"]))}/activities`,
+        payload
+      ));
+    }
+    case "goal.change.propose": {
+      const payload = createGoalChangeProposalSchema.parse({
+        expectedContractRevision: input.contractRevision,
+        afterContract: input.afterContract,
+        rationale: requiredString(input, "rationale"),
+        evidenceRefs: input.evidenceRefs,
+        idempotencyKey: requiredString(input, "idempotencyKey")
+      });
+      return success(await api.post(
+        `/api/goals/${encodeURIComponent(requiredAnyString(input, ["goal", "goalId"]))}/change-proposals`,
+        payload
+      ));
+    }
+    case "goal.result.propose": {
+      const decision = optionalString(input.decision);
+      const payload = createGoalResultProposalSchema.parse({
+        contractRevision: input.contractRevision,
+        criteria: input.criteria,
+        evidenceRefs: input.evidenceRefs,
+        resultValue: input.resultValue,
+        ...decision ? { decision } : {},
+        resultPayload: input.resultPayload,
+        riskSummary: requiredString(input, "riskSummary"),
+        idempotencyKey: requiredString(input, "idempotencyKey")
+      });
+      return success(await api.post(
+        `/api/goals/${encodeURIComponent(requiredAnyString(input, ["goal", "goalId"]))}/result-proposals`,
+        payload
+      ));
+    }
     case "issue.get":
       return success(await api.get(`/api/issues/${encodeURIComponent(requiredAnyString(input, ["issue", "issueId"]))}`));
     case "issue.context": {
@@ -13049,6 +13391,73 @@ function cliArgsForCapability(capabilityId, input, tempFiles, env) {
       pushOptional(args, "--desired-skills", input.desiredSkills);
       return args;
     }
+    case "goal.list": {
+      const args = ["goal", "list"];
+      pushOptional(args, "--lifecycle", input.lifecycle ?? "active");
+      if (typeof input.focus === "boolean") args.push("--focus", String(input.focus));
+      pushOptional(args, "--facet", input.facet);
+      if (input.limit !== void 0) args.push("--limit", String(input.limit));
+      return args;
+    }
+    case "goal.context":
+      return ["goal", "context", requiredAnyString(input, ["goal", "goalId"])];
+    case "goal.progress": {
+      const args = [
+        "goal",
+        "progress",
+        requiredAnyString(input, ["goal", "goalId"]),
+        "--summary",
+        requiredString(input, "summary"),
+        "--evidence-refs",
+        JSON.stringify(input.evidenceRefs),
+        "--idempotency-key",
+        requiredString(input, "idempotencyKey")
+      ];
+      pushOptional(args, "--activity-kind", input.activityKind);
+      return args;
+    }
+    case "goal.change.propose": {
+      const args = [
+        "goal",
+        "change",
+        "propose",
+        requiredAnyString(input, ["goal", "goalId"]),
+        "--contract-revision",
+        String(input.contractRevision),
+        "--after-contract",
+        JSON.stringify(input.afterContract),
+        "--rationale",
+        requiredString(input, "rationale"),
+        "--idempotency-key",
+        requiredString(input, "idempotencyKey")
+      ];
+      if (input.evidenceRefs !== void 0) {
+        args.push("--evidence-refs", JSON.stringify(input.evidenceRefs));
+      }
+      return args;
+    }
+    case "goal.result.propose": {
+      const args = [
+        "goal",
+        "result",
+        "propose",
+        requiredAnyString(input, ["goal", "goalId"]),
+        "--contract-revision",
+        String(input.contractRevision),
+        "--criteria",
+        JSON.stringify(input.criteria),
+        "--evidence-refs",
+        JSON.stringify(input.evidenceRefs),
+        "--risk-summary",
+        requiredString(input, "riskSummary"),
+        "--idempotency-key",
+        requiredString(input, "idempotencyKey")
+      ];
+      if (input.resultValue !== void 0) args.push("--result-value", JSON.stringify(input.resultValue));
+      pushOptional(args, "--decision", input.decision);
+      if (input.resultPayload !== void 0) args.push("--result-payload", JSON.stringify(input.resultPayload));
+      return args;
+    }
     case "issue.get":
       return ["issue", "get", requiredAnyString(input, ["issue", "issueId"])];
     case "issue.list": {
@@ -14588,6 +14997,89 @@ function asString(value, fallback) {
 }
 
 // ../packages/agent-runtime-utils/dist/server-utils.prompts.js
+var RUDDER_GOAL_RUNTIME_BOUNDARY = `This is a Rudder product Goal, not a Codex internal goal. Do not call Codex \`create_goal\`, \`update_goal\`, or \`get_goal\` for it; those tools do not manage Rudder Goals. If the Goal packet names an exact managed Rudder tool, call that typed tool directly. Do not load \`rudder-docs\`, inspect skill files, or run discovery commands merely to confirm a tool that the packet already names. If the Rudder Goal context is missing or stale, report the named blocker and request refreshed context instead of using shell, Bash, curl, or the \`rudder\` CLI to retrieve it.
+
+Record meaningful evidence-backed advancement with \`rudder_goal_progress\`; the tool automatically attributes progress to this Run. If evidence shows the Goal contract itself must change, use \`rudder_goal_change_propose\` so a human can review the exact delta; never silently redefine the outcome or boundaries. When the outcome is ready for review, use \`rudder_goal_result_propose\` with the current contract revision and supporting evidence. Do not use shell, Bash, curl, or the \`rudder\` CLI for these actions.
+
+A human must accept every terminal Goal result. A Result Proposal requests acceptance; it does not let the runtime mark, close, or claim the Goal complete.`;
+var GOAL_STARTED_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{agent.name}}). A Goal has started and you are responsible for advancing it.
+
+{{context.rudderWorkspace.orgResourcesPrompt}}
+
+${RUDDER_GOAL_RUNTIME_BOUNDARY}
+
+## Goal Runtime Context
+
+**Goal:** {{context.goalRuntime.goalTitle}}
+**Goal ID:** {{context.goalRuntime.goalId}}
+
+**Goal outcome:**
+{{context.goalRuntime.goalOutcome}}
+
+**Current contract:**
+{{context.goalRuntime.currentContract}}
+
+**Continuation:**
+{{context.goalRuntime.continuation}}
+
+Advance this Goal from the current contract and continuation. Preserve the stated outcome and contract boundaries; do not silently redefine them.`;
+var GOAL_FEEDBACK_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{agent.name}}). New feedback requires your review on a Goal you own.
+
+{{context.rudderWorkspace.orgResourcesPrompt}}
+
+${RUDDER_GOAL_RUNTIME_BOUNDARY}
+
+## Goal Runtime Context
+
+**Goal:** {{context.goalRuntime.goalTitle}}
+**Goal ID:** {{context.goalRuntime.goalId}}
+
+**Goal outcome:**
+{{context.goalRuntime.goalOutcome}}
+
+**Current contract:**
+{{context.goalRuntime.currentContract}}
+
+**Continuation:**
+{{context.goalRuntime.continuation}}
+
+## Goal Feedback
+
+**Feedback ID:** {{context.goalRuntime.feedbackId}}
+
+**Feedback body:**
+{{context.goalRuntime.feedbackBody}}
+
+Review the feedback against the current Goal contract, then continue from the recorded continuation. Treat any outcome or contract change as an explicit proposal instead of silently changing the Goal.`;
+var GOAL_CHANGE_DECIDED_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{agent.name}}). A human decided a proposed change to a Goal you own.
+
+{{context.rudderWorkspace.orgResourcesPrompt}}
+
+${RUDDER_GOAL_RUNTIME_BOUNDARY}
+
+## Goal Runtime Context
+
+**Goal:** {{context.goalRuntime.goalTitle}}
+**Goal ID:** {{context.goalRuntime.goalId}}
+
+**Goal outcome:**
+{{context.goalRuntime.goalOutcome}}
+
+**Current contract:**
+{{context.goalRuntime.currentContract}}
+
+**Continuation:**
+{{context.goalRuntime.continuation}}
+
+## Goal Change Decision
+
+**Decision:** {{context.goalRuntime.decision}}
+**Decision status:** {{context.goalRuntime.decisionStatus}}
+
+**Decision note:**
+{{context.goalRuntime.decisionNote}}
+
+Continue from the current Goal contract and this human decision. Do not apply a rejected change or silently reinterpret the decision.`;
 var ISSUE_ASSIGNEE_EXECUTION_RAIL = "Before doing issue-scoped execution as the assignee, check out the assigned issue. If checkout returns `409`, do not retry; stop and report the ownership conflict.";
 var ISSUE_ASSIGN_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{agent.name}}). You have been assigned to work on an issue.
 
@@ -14800,7 +15292,7 @@ var RUDDER_AGENT_HEARTBEAT_INSTRUCTION = [
   "4. Inspect your Rudder inbox. Prioritize reviewer rows in `in_review` or `blocked`, then assignee `in_progress`, then assignee `todo`. Do not look for unassigned work.",
   "5. For mention wakes, read the wake comment before acting. Mentions request attention; they do not transfer ownership unless the comment explicitly says so. If the issue is not assigned to you, including user-owned or unassigned issues, and the comment does not explicitly ask you to implement, modify files, close the issue, or take ownership, respond to the comment itself instead of executing the whole issue.",
   "6. Load compact issue context, do one bounded useful chunk, and preserve evidence.",
-  "7. Before exiting active work, leave exactly one durable signal: progress, done, blocked, explicit handoff, or structured review decision.",
+  "7. Complete the real task. When an action fails, investigate and try a bounded materially different recovery path before requesting human help. Before exiting active work, leave exactly one durable signal: progress, done, a blocker claim with the exact human input/action required, explicit handoff, or structured review decision. Rudder audits repeated blocker claims; the first claim does not directly establish a blocked Issue.",
   "8. Treat passive follow-up as issue follow-up, not a fresh assignment.",
   "9. Treat review close-out follow-up as review follow-up; free-form accept/reject text is not a durable decision.",
   "",
@@ -17801,6 +18293,124 @@ function registerDashboardCommands(program) {
   );
 }
 
+// src/commands/client/goal.ts
+init_dist();
+function registerGoalCommands(program) {
+  const goal = program.command("goal").description("Goal Owner runtime operations");
+  addCommonClientOptions(
+    goal.command("list").description(getAgentCliCapabilityById("goal.list").description).option("--lifecycle <state>", "draft, active, closed, or all", "active").option("--focus <true|false>", "Filter by organization Focus state").option("--facet <facet>", "Filter by current workspace attention facet").option("--limit <n>", "Maximum Goals to return (1-100)", "20").action(async (opts) => {
+      try {
+        const ctx = resolveCommandContext(opts, { requireCompany: true });
+        if (!ctx.agentId) throw new Error("Agent ID is required. Set RUDDER_AGENT_ID.");
+        const params = new URLSearchParams({
+          lifecycle: opts.lifecycle,
+          limit: opts.limit
+        });
+        if (opts.focus !== void 0) params.set("focus", opts.focus);
+        if (opts.facet) params.set("facet", opts.facet);
+        const response = await ctx.api.get(`/api/orgs/${ctx.orgId}/goals/assigned?${params}`);
+        printOutput(response, { json: ctx.json });
+      } catch (err) {
+        handleCommandError(err);
+      }
+    }),
+    { includeCompany: true }
+  );
+  addCommonClientOptions(
+    goal.command("context").description(getAgentCliCapabilityById("goal.context").description).argument("<goalId>", "Goal ID returned by goal list").action(async (goalId, opts) => {
+      try {
+        const ctx = resolveCommandContext(opts);
+        if (!ctx.agentId) throw new Error("Agent ID is required. Set RUDDER_AGENT_ID.");
+        const response = await ctx.api.get(`/api/goals/${goalId}/agent-context`);
+        printOutput(response, { json: ctx.json });
+      } catch (err) {
+        handleCommandError(err);
+      }
+    })
+  );
+  addCommonClientOptions(
+    goal.command("progress").description(getAgentCliCapabilityById("goal.progress").description).argument("<goalId>", "Goal ID from the current Goal Runtime Context").requiredOption("--summary <text>", "Plain-language progress summary").option("--activity-kind <kind>", "progress, evidence, or bottleneck", "progress").requiredOption("--evidence-refs <json>", "JSON array of URI-like evidence references").requiredOption("--idempotency-key <key>", "Stable key for safe retry").action(async (goalId, opts) => {
+      try {
+        const ctx = resolveCommandContext(opts);
+        const payload = createGoalActivitySchema.parse({
+          summary: opts.summary,
+          activityKind: opts.activityKind,
+          evidenceRefs: parseJsonArray(opts.evidenceRefs, "evidence refs"),
+          idempotencyKey: opts.idempotencyKey
+        });
+        const activity = await ctx.api.post(`/api/goals/${goalId}/activities`, payload);
+        printOutput(activity, { json: ctx.json });
+      } catch (err) {
+        handleCommandError(err);
+      }
+    })
+  );
+  const change = goal.command("change").description("Goal contract change operations");
+  addCommonClientOptions(
+    change.command("propose").description(getAgentCliCapabilityById("goal.change.propose").description).argument("<goalId>", "Goal ID from the current Goal Runtime Context").requiredOption("--contract-revision <n>", "Current Goal contract revision").requiredOption("--after-contract <json>", "JSON object containing only proposed contract field changes").requiredOption("--rationale <text>", "Why the current Goal contract should change").option("--evidence-refs <json>", "JSON array of URI-like evidence references", "[]").requiredOption("--idempotency-key <key>", "Stable key for safe retry").action(async (goalId, opts) => {
+      try {
+        const ctx = resolveCommandContext(opts);
+        const payload = createGoalChangeProposalSchema.parse({
+          expectedContractRevision: Number(opts.contractRevision),
+          afterContract: parseJsonObject3(opts.afterContract, "after contract"),
+          rationale: opts.rationale,
+          evidenceRefs: parseJsonArray(opts.evidenceRefs ?? "[]", "evidence refs"),
+          idempotencyKey: opts.idempotencyKey
+        });
+        const proposal = await ctx.api.post(`/api/goals/${goalId}/change-proposals`, payload);
+        printOutput(proposal, { json: ctx.json });
+      } catch (err) {
+        handleCommandError(err);
+      }
+    })
+  );
+  const result = goal.command("result").description("Goal result operations");
+  addCommonClientOptions(
+    result.command("propose").description(getAgentCliCapabilityById("goal.result.propose").description).argument("<goalId>", "Goal ID from the current Goal Runtime Context").requiredOption("--contract-revision <n>", "Current Goal contract revision").requiredOption("--criteria <json>", "JSON array of criterion id/status objects").requiredOption("--evidence-refs <json>", "JSON array of URI-like evidence references").option("--result-value <json-or-text>", "Optional measured result value").option("--decision <text>", "Optional decision for decide-mode Goals").option("--result-payload <json>", "Optional structured result details").requiredOption("--risk-summary <text>", "Known risks, limitations, or remaining gaps").requiredOption("--idempotency-key <key>", "Stable key for safe retry").action(async (goalId, opts) => {
+      try {
+        const ctx = resolveCommandContext(opts);
+        const payload = createGoalResultProposalSchema.parse({
+          contractRevision: Number(opts.contractRevision),
+          criteria: parseJsonArray(opts.criteria, "criteria"),
+          evidenceRefs: parseJsonArray(opts.evidenceRefs, "evidence refs"),
+          ...opts.resultValue !== void 0 ? { resultValue: parseResultValue(opts.resultValue) } : {},
+          ...opts.decision !== void 0 ? { decision: opts.decision } : {},
+          ...opts.resultPayload !== void 0 ? { resultPayload: parseJsonObject3(opts.resultPayload, "result payload") } : {},
+          riskSummary: opts.riskSummary,
+          idempotencyKey: opts.idempotencyKey
+        });
+        const proposal = await ctx.api.post(`/api/goals/${goalId}/result-proposals`, payload);
+        printOutput(proposal, { json: ctx.json });
+      } catch (err) {
+        handleCommandError(err);
+      }
+    })
+  );
+}
+function parseJsonArray(value, label) {
+  const parsed = JSON.parse(value);
+  if (!Array.isArray(parsed)) throw new Error(`${label} must be a JSON array`);
+  return parsed;
+}
+function parseJsonObject3(value, label) {
+  const parsed = JSON.parse(value);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`${label} must be a JSON object`);
+  }
+  return parsed;
+}
+function parseResultValue(value) {
+  try {
+    const parsed = JSON.parse(value);
+    if (typeof parsed === "string" || typeof parsed === "number" || typeof parsed === "boolean") {
+      return parsed;
+    }
+  } catch {
+    return value;
+  }
+  throw new Error("result value must be a string, number, or boolean");
+}
+
 // src/commands/client/issue.ts
 init_dist();
 import { readFile as readFile4, stat as stat4 } from "node:fs/promises";
@@ -20079,7 +20689,7 @@ import * as p15 from "@clack/prompts";
 import { spawn as spawn3, spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash2, randomUUID } from "node:crypto";
 import { createWriteStream, constants as fsConstants, mkdirSync, readFileSync as readFileSync2 } from "node:fs";
-import { access, chmod, copyFile as copyFile2, cp as cp2, mkdir as mkdir4, mkdtemp as mkdtemp2, readdir as readdir3, readFile as readFile6, rm as rm2, stat as stat5, utimes, writeFile as writeFile3 } from "node:fs/promises";
+import { access, chmod, copyFile as copyFile2, cp as cp2, lstat, mkdir as mkdir4, mkdtemp as mkdtemp2, readdir as readdir3, readFile as readFile6, rm as rm2, stat as stat5, utimes, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import path22 from "node:path";
 import { Readable, Transform } from "node:stream";
@@ -21427,6 +22037,21 @@ async function startCommand(opts) {
   const version = opts.targetVersion?.trim() || opts.version?.trim() || resolveCurrentCliVersion();
   const dryRun = opts.dryRun === true;
   const desktopProgressJson = opts.desktopProgressJson === true;
+  const exactDesktopAssetPath = opts.desktopAssetPath?.trim() || null;
+  const exactDesktopAssetChecksum = opts.desktopAssetChecksum?.trim() || null;
+  const exactDesktopAssetName = opts.desktopAssetName?.trim() || null;
+  const exactDesktopReleaseDigest = opts.desktopReleaseDigest?.trim() || null;
+  if (exactDesktopAssetPath || exactDesktopAssetChecksum || exactDesktopAssetName || exactDesktopReleaseDigest) {
+    if (!exactDesktopAssetPath || !exactDesktopAssetChecksum || !exactDesktopAssetName || !exactDesktopReleaseDigest) {
+      throw new Error("Exact Desktop asset mode requires path, checksum, asset name, and release digest.");
+    }
+    if (!path22.isAbsolute(exactDesktopAssetPath) || exactDesktopAssetName.includes("/") || !/^[a-f0-9]{64}$/iu.test(exactDesktopAssetChecksum) || !/^[a-f0-9]{64}$/iu.test(exactDesktopReleaseDigest)) {
+      throw new Error("Exact Desktop asset mode received invalid candidate identity.");
+    }
+    if (opts.desktopAssetKind && opts.desktopAssetKind !== "full" && opts.desktopAssetKind !== "shell") {
+      throw new Error("Exact Desktop asset mode received an invalid asset kind.");
+    }
+  }
   let runtimeSupportsShellAssets = false;
   if (desktopProgressJson) {
     process.stdout.on("error", (error) => {
@@ -21513,49 +22138,86 @@ async function startCommand(opts) {
       return;
     }
     await withDesktopInstallLock(installPaths, async () => {
-      const directReleaseVersion = resolveDesktopReleaseVersion(tag);
       const progressFactory = desktopProgressJson ? createDesktopProgressFactory() : createByteProgress;
-      let release = null;
-      try {
-        release = await runStartPhase(
-          "Resolving Desktop release...",
-          "Desktop release resolved.",
-          () => fetchGithubRelease(repo, tag),
-          desktopProgressJson ? "resolving_release" : null
-        );
-      } catch (error) {
-        if (!directReleaseVersion) throw error;
-        p15.log.warn(
-          `Desktop release metadata could not be resolved; falling back to deterministic download URLs. ${formatFetchError(error)}`
+      let releaseTag;
+      let selectedAsset;
+      let selectedAssetKind;
+      let expectedChecksum;
+      let cachedAsset = null;
+      let assetCandidates = [];
+      let checksums = /* @__PURE__ */ new Map();
+      if (exactDesktopAssetPath) {
+        releaseTag = tag;
+        selectedAsset = {
+          name: exactDesktopAssetName,
+          browser_download_url: ""
+        };
+        selectedAssetKind = opts.desktopAssetKind ?? "full";
+        expectedChecksum = normalizeDesktopAssetChecksum(exactDesktopAssetChecksum);
+        const computedReleaseDigest = createHash2("sha256").update(JSON.stringify({
+          releaseTag,
+          assetName: selectedAsset.name,
+          assetChecksum: expectedChecksum,
+          assetKind: selectedAssetKind,
+          platform: target.platform,
+          arch: target.arch
+        })).digest("hex");
+        if (computedReleaseDigest !== exactDesktopReleaseDigest.toLowerCase()) {
+          throw new Error("Exact Desktop asset release digest does not match the candidate identity.");
+        }
+        const descriptor = await stat5(exactDesktopAssetPath);
+        if (!descriptor.isFile()) throw new Error("Exact Desktop asset must be a regular file.");
+        const linkDescriptor = await lstat(exactDesktopAssetPath);
+        if (linkDescriptor.isSymbolicLink()) throw new Error("Exact Desktop asset must not be a symbolic link.");
+        const checksum = await runStartPhase(
+          "Verifying staged Desktop checksum...",
+          `Verified ${pc14.cyan(path22.basename(exactDesktopAssetPath))}.`,
+          () => assertChecksumMatch(exactDesktopAssetPath, expectedChecksum),
+          desktopProgressJson ? "verifying_checksum" : null
         );
+        cachedAsset = { path: exactDesktopAssetPath, checksum, cacheStatus: "hit" };
+      } else {
+        const directReleaseVersion = resolveDesktopReleaseVersion(tag);
+        let release = null;
+        try {
+          release = await runStartPhase(
+            "Resolving Desktop release...",
+            "Desktop release resolved.",
+            () => fetchGithubRelease(repo, tag),
+            desktopProgressJson ? "resolving_release" : null
+          );
+        } catch (error) {
+          if (!directReleaseVersion) throw error;
+          p15.log.warn(
+            `Desktop release metadata could not be resolved; falling back to deterministic download URLs. ${formatFetchError(error)}`
+          );
+        }
+        releaseTag = release?.tag_name ?? (directReleaseVersion ? tag : "");
+        if (!releaseTag) throw new Error(`Unable to resolve Rudder Desktop release tag for ${repo}@${tag}.`);
+        assetCandidates = resolveDesktopAssetCandidates({
+          releaseAssets: release?.assets ?? [],
+          target,
+          repo,
+          tag,
+          directReleaseVersion,
+          allowShellAssets: runtimeSupportsShellAssets
+        });
+        if (assetCandidates.length === 0) {
+          throw new Error(`No Rudder Desktop portable asset found for ${target.platform}/${target.arch} in ${repo}@${releaseTag}.`);
+        }
+        const checksumAsset = selectChecksumAsset(release?.assets ?? []) ?? (directReleaseVersion ? buildGithubReleaseAsset(repo, tag, DESKTOP_CHECKSUM_ASSET_NAME) : null);
+        checksums = await downloadChecksums(checksumAsset, outputDir, progressFactory);
+        let selectedCandidate;
+        try {
+          selectedCandidate = selectChecksummedDesktopAssetCandidate(assetCandidates, checksums);
+        } catch {
+          throw new Error(`No checksummed Rudder Desktop asset found for ${target.platform}/${target.arch} in ${repo}@${releaseTag}.`);
+        }
+        for (const warning of selectedCandidate.warnings) p15.log.warn(warning);
+        selectedAsset = selectedCandidate.asset;
+        selectedAssetKind = selectedCandidate.kind;
+        expectedChecksum = selectedCandidate.expectedChecksum;
       }
-      const releaseTag = release?.tag_name ?? (directReleaseVersion ? tag : null);
-      if (!releaseTag) {
-        throw new Error(`Unable to resolve Rudder Desktop release tag for ${repo}@${tag}.`);
-      }
-      const assetCandidates = resolveDesktopAssetCandidates({
-        releaseAssets: release?.assets ?? [],
-        target,
-        repo,
-        tag,
-        directReleaseVersion,
-        allowShellAssets: runtimeSupportsShellAssets
-      });
-      if (assetCandidates.length === 0) {
-        throw new Error(`No Rudder Desktop portable asset found for ${target.platform}/${target.arch} in ${repo}@${releaseTag}.`);
-      }
-      const checksumAsset = selectChecksumAsset(release?.assets ?? []) ?? (directReleaseVersion ? buildGithubReleaseAsset(repo, tag, DESKTOP_CHECKSUM_ASSET_NAME) : null);
-      const checksums = await downloadChecksums(checksumAsset, outputDir, progressFactory);
-      let selectedCandidate;
-      try {
-        selectedCandidate = selectChecksummedDesktopAssetCandidate(assetCandidates, checksums);
-      } catch (error) {
-        throw new Error(`No checksummed Rudder Desktop asset found for ${target.platform}/${target.arch} in ${repo}@${releaseTag}.`);
-      }
-      for (const warning of selectedCandidate.warnings) p15.log.warn(warning);
-      let selectedAsset = selectedCandidate.asset;
-      let selectedAssetKind = selectedCandidate.kind;
-      let expectedChecksum = selectedCandidate.expectedChecksum;
       const metadata = await readInstallMetadata(installPaths.metadataPath);
       if (isInstalledDesktopCurrent(metadata, releaseTag, selectedAsset.name, expectedChecksum) && await pathExists2(installPaths.executablePath)) {
         p15.log.success(`Rudder Desktop is already installed at ${pc14.cyan(installPaths.appPath)}.`);
@@ -21569,8 +22231,7 @@ async function startCommand(opts) {
           desktopProgressJson ? "preparing_restart" : null
         );
       } else {
-        let cachedAsset;
-        try {
+        if (!exactDesktopAssetPath) try {
           cachedAsset = await downloadDesktopAssetWithCache(selectedAsset, expectedChecksum, {
             outputDir,
             progressFactory
@@ -21589,8 +22250,10 @@ async function startCommand(opts) {
             progressFactory
           });
         }
-        if (cachedAsset.cacheStatus === "hit") {
-          p15.log.success(`Desktop asset cache hit at ${pc14.cyan(cachedAsset.path)}.`);
+        if (!cachedAsset) throw new Error("Desktop update did not produce a verified asset.");
+        const verifiedAsset = cachedAsset;
+        if (verifiedAsset.cacheStatus === "hit") {
+          p15.log.success(`Desktop asset cache hit at ${pc14.cyan(verifiedAsset.path)}.`);
           if (desktopProgressJson) {
             writeDesktopProgress({
               phase: "downloading_asset",
@@ -21601,10 +22264,30 @@ async function startCommand(opts) {
         }
         const checksum = await runStartPhase(
           "Verifying Desktop checksum...",
-          `Verified ${pc14.cyan(path22.basename(cachedAsset.path))}.`,
-          () => assertChecksumMatch(cachedAsset.path, expectedChecksum),
+          `Verified ${pc14.cyan(path22.basename(verifiedAsset.path))}.`,
+          () => assertChecksumMatch(verifiedAsset.path, expectedChecksum),
           desktopProgressJson ? "verifying_checksum" : null
         );
+        if (opts.desktopPrepareOnly === true) {
+          writeDesktopProgress({
+            phase: "prepared",
+            message: "Desktop update is downloaded and verified.",
+            percent: 100,
+            assetName: selectedAsset.name,
+            assetChecksum: checksum,
+            stagedArtifactPath: path22.resolve(verifiedAsset.path),
+            stagedArtifactDigest: checksum,
+            releaseDigest: createHash2("sha256").update(JSON.stringify({
+              releaseTag,
+              assetName: selectedAsset.name,
+              assetChecksum: checksum,
+              assetKind: selectedAssetKind,
+              platform: target.platform,
+              arch: target.arch
+            })).digest("hex")
+          });
+          return;
+        }
         let applySignal = null;
         let applySignalController = null;
         if (desktopProgressJson && opts.desktopWaitForApply === true) {
@@ -21642,7 +22325,7 @@ async function startCommand(opts) {
         await runStartPhase(
           "Installing portable Desktop app...",
           `Installed Rudder Desktop to ${pc14.cyan(installPaths.appPath)}.`,
-          () => installPortableDesktop(cachedAsset.path, installPaths, target),
+          () => installPortableDesktop(verifiedAsset.path, installPaths, target),
           desktopProgressJson ? "preparing_restart" : null
         );
         await runStartPhase(
@@ -21749,7 +22432,7 @@ function createProgram() {
     });
     loadRudderEnvFile(options.config);
   });
-  program.command("start").description("Start Rudder Desktop and prepare the matching persistent CLI").option("--server-only", "Prepare the Rudder server runtime and persistent CLI without installing Desktop").option("--no-cli", "Skip persistent CLI installation").option("--no-runtime", "Skip Rudder runtime installation").option("--no-desktop", "Skip desktop app installation").option("--version <version>", "Rudder version to start (default: current CLI version)").option("--target-version <version>", "Rudder version to start; avoids the root CLI version flag").option("--repo <owner/repo>", "GitHub repository that hosts desktop releases").option("--output-dir <path>", "Directory for downloaded desktop release assets").option("--desktop-install-dir <path>", "Directory for the portable Desktop install").option("--no-open", "Install Desktop without launching it").option("--wait-for-active-runs", "Wait for active Rudder runs to finish before replacing Desktop", false).option("--desktop-progress-json", "Emit newline-delimited Desktop update progress events").option("--desktop-wait-for-apply", "Wait for an apply signal after downloading and verifying the Desktop update", false).option("--no-version-check", "Skip checking npm for a newer Rudder CLI version").option("--dry-run", "Print the start actions without changing the machine", false).action(startCommand);
+  program.command("start").description("Start Rudder Desktop and prepare the matching persistent CLI").option("--server-only", "Prepare the Rudder server runtime and persistent CLI without installing Desktop").option("--no-cli", "Skip persistent CLI installation").option("--no-runtime", "Skip Rudder runtime installation").option("--no-desktop", "Skip desktop app installation").option("--version <version>", "Rudder version to start (default: current CLI version)").option("--target-version <version>", "Rudder version to start; avoids the root CLI version flag").option("--repo <owner/repo>", "GitHub repository that hosts desktop releases").option("--output-dir <path>", "Directory for downloaded desktop release assets").option("--desktop-install-dir <path>", "Directory for the portable Desktop install").option("--no-open", "Install Desktop without launching it").option("--wait-for-active-runs", "Wait for active Rudder runs to finish before replacing Desktop", false).option("--desktop-progress-json", "Emit newline-delimited Desktop update progress events").option("--desktop-wait-for-apply", "Wait for an apply signal after downloading and verifying the Desktop update", false).option("--desktop-prepare-only", "Download and verify the Desktop update without installing or launching it", false).option("--desktop-asset-path <path>", "Use one previously staged, exact Desktop asset path").option("--desktop-asset-checksum <sha256>", "SHA-256 for the exact staged Desktop asset").option("--desktop-asset-name <name>", "Asset name bound to the exact staged Desktop candidate").option("--desktop-asset-kind <kind>", "Asset kind bound to the exact staged Desktop candidate (full or shell)").option("--desktop-release-digest <sha256>", "Release digest bound to the exact staged Desktop candidate").option("--no-version-check", "Skip checking npm for a newer Rudder CLI version").option("--dry-run", "Print the start actions without changing the machine", false).action(startCommand);
   program.command("onboard").description("Interactive first-run setup wizard").option("-c, --config <path>", "Path to config file").option("-d, --data-dir <path>", DATA_DIR_OPTION_HELP).option("-y, --yes", "Accept defaults (quickstart + start immediately)", false).option("--run", "Start Rudder immediately after saving config", false).action(onboard);
   program.command("doctor").description("Run diagnostic checks on your Rudder setup").option("-c, --config <path>", "Path to config file").option("-d, --data-dir <path>", DATA_DIR_OPTION_HELP).option("--repair", "Attempt to repair issues automatically").alias("--fix").option("-y, --yes", "Skip repair confirmation prompts").action(async (opts) => {
     await doctor(opts);
@@ -21779,6 +22462,7 @@ function createProgram() {
   ).option("--trigger <trigger>", "Trigger detail (manual | ping | callback | system)", "manual").option("--timeout-ms <ms>", "Max time to wait before giving up", "0").option("--json", "Output raw JSON where applicable").option("--debug", "Show raw adapter stdout/stderr JSON chunks").action(heartbeatRun);
   registerContextCommands(program);
   registerCompanyCommands(program);
+  registerGoalCommands(program);
   registerIssueCommands(program);
   registerProjectCommands(program);
   registerAgentCommands(program);