npm - @runtypelabs/cli - Versions diffs - 2.35.4 → 2.35.6 - Mend

@runtypelabs/cli 2.35.4 → 2.35.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/CHANGELOG.md DELETED Viewed

@@ -1,2436 +0,0 @@
-# @runtypelabs/cli
-## 2.35.4
-### Patch Changes
-- 8ab7d4a: Apply flow and agent version snapshots to the live execution rows atomically when publishing from any API surface.
-- Updated dependencies [ccd07e2]
-- Updated dependencies [8ab7d4a]
-  - @runtypelabs/sdk@9.3.2
-## 2.35.3
-### Patch Changes
-- Updated dependencies [95e48e6]
-  - @runtypelabs/sdk@9.3.1
-## 2.35.2
-### Patch Changes
-- 6bfcfa0: `runtype agents execute --stream` now follows a durable turn's watch-lease detach: the command routes through the SDK's `agents.executeStream()`, which reopens the run on `awaitReason: 'detached'` and keeps printing events until a real terminal arrives.
-- Updated dependencies [20f2a28]
-- Updated dependencies [6bfcfa0]
-- Updated dependencies [9ac677d]
-- Updated dependencies [9ac677d]
-- Updated dependencies [e1111dc]
-- Updated dependencies [6bfcfa0]
-  - @runtypelabs/sdk@9.3.0
-## 2.35.1
-### Patch Changes
-- Updated dependencies [a370a11]
-  - @runtypelabs/sdk@9.2.1
-## 2.35.0
-### Minor Changes
-- dae3030: Add `runtype api-keys request` and `runtype api-keys claim` for agent-initiated
-  API key requests: the CLI generates a PKCE verifier/challenge, files the
-  request, opens the approval page for a human, polls until they decide, and
-  redeems the approval into a canonical `runtype.api-key/v1` key file
-  (`~/.runtype/keys/<name>.json`, mode 0600), a Runtype secret reference
-  (`--secret`), or stdout (`--inline`). `runtype api-keys create --out` writes the
-  same key-file format, so there is one on-disk artifact across the CLI,
-  dashboard, and MCP guidance.
-- 235751c: Report exact raw Runtype-funded provider and hosted-tool cost separately from blended execution cost.
-### Patch Changes
-- Updated dependencies [d129b45]
-- Updated dependencies [005b795]
-- Updated dependencies [b216c6a]
-- Updated dependencies [235751c]
-- Updated dependencies [edefa3c]
-- Updated dependencies [dd54ba0]
-- Updated dependencies [b2ac8a0]
-- Updated dependencies [dae3030]
-- Updated dependencies [f95b02e]
-- Updated dependencies [f5250b6]
-- Updated dependencies [c5a5baf]
-- Updated dependencies [e305a29]
-- Updated dependencies [2783291]
-  - @runtypelabs/sdk@9.2.0
-## 2.34.1
-### Patch Changes
-- Updated dependencies [7aea953]
-- Updated dependencies [9c9eb47]
-  - @runtypelabs/sdk@9.1.1
-## 2.34.0
-### Minor Changes
-- ccdc5f6: Expose the first-class record/conversation `ownerId` on every client surface (#3395)
-  - **CLI**: `records list`, `records create`, and `records export` take `--owner-id`; `records update` takes `--owner-id` plus `--clear-owner` (an explicit `null`, which clears the stored owner — omitting both leaves it untouched). `conversations list` takes `--owner-id`. `records get`/`update` render the owner, and the CSV export gains an `ownerId` column.
-  - **SDK**: `CreateRecordRequest.ownerId` and `CreateConversationRequest.ownerId` / `UpdateConversationRequest.ownerId` accept `string | null`, so `records.update()` and `conversations.update()` can clear an owner.
-  - **MCP**: `create_record` / `create_conversation` accept `owner_id`; `update_record` / `update_conversation` accept a nullable `owner_id` where `null` clears the owner.
-  - **Code Mode MCP**: the `listRecords` / `createRecord` / `updateRecord` / `listConversations` / `createConversation` / `updateConversation` method docs describe `ownerId` and its null-clears semantics.
-### Patch Changes
-- Updated dependencies [b4c1858]
-- Updated dependencies [cf8dd74]
-- Updated dependencies [ccdc5f6]
-- Updated dependencies [ccdc5f6]
-- Updated dependencies [901ee20]
-- Updated dependencies [86212a3]
-- Updated dependencies [840934b]
-  - @runtypelabs/sdk@9.1.0
-## 2.33.16
-### Patch Changes
-- 4406dc3: Serve large static reference data from a new `runtype-catalog` worker instead of
-  bundling it into every consumer.
-  The rich model catalog (~848 KB) and the rich tier of the built-in tool registry
-  (~430 KB: `parametersSchema`, `managedExecution`, `description`,
-  `documentationUrl`, `configSchema`) move into `apps/catalog`, reached over the
-  new `CATALOG` service binding. The api keeps a lean tool index and merges rich
-  fields per lookup, batching through `prefetchBuiltInToolRichData` once per
-  execution.
-  Measured: api Worker upload 13,662.65 KiB → 12,889.70 KiB (−772.95 KiB), gzip
-  3,387.60 → 3,314.10 KiB, eager-evaluated bytes 6.05 MiB → 5.73 MiB. The
-  dashboard's initial client JavaScript drops 75.8 KiB gzip (−14.1%).
-  `@runtypelabs/shared` is a minor because the barrel surface changed:
-  `getBuiltInToolById` now returns a `LeanBuiltInToolDefinition`, and
-  `ORTHOGONAL_PLATFORM_TOOLS`, `validateToolConfig`, `validateConfigAgainstSchema`,
-  `getBuiltInToolsByProvider`, and `getBuiltInToolsByCategory` are no longer
-  exported from it. The full definitions live behind the
-  `@runtypelabs/shared/builtin-tools-full` subpath.
-- Updated dependencies [b01026e]
-- Updated dependencies [7a5cf94]
-  - @runtypelabs/sdk@9.0.0
-## 2.33.15
-### Patch Changes
-- Updated dependencies [e154387]
-  - @runtypelabs/sdk@8.0.3
-## 2.33.14
-### Patch Changes
-- 3b4f69c: Normalize package authorship and copyright metadata.
-  The `author` field reads `Runtype` rather than `Runtype Labs` across every
-  workspace package that set it, and the copyright holder in each license file is
-  now `Runtype, Inc` — replacing `Travrse Labs, Inc` in the CLI and the four Fern
-  SDKs, and the `Runtype Labs` that the new `flue-otel` license was written with.
-  Metadata only: no source, dependency, or behavior change.
-- Updated dependencies [3b4f69c]
-  - @runtypelabs/terminal-animations@0.2.4
-  - @runtypelabs/ink-components@0.3.7
-  - @runtypelabs/sdk@8.0.2
-## 2.33.13
-### Patch Changes
-- Updated dependencies [047a57b]
-  - @runtypelabs/sdk@8.0.1
-## 2.33.12
-### Patch Changes
-- 3c7309f: Bump `@runtypelabs/persona` from 4.17.0 to 4.17.1 across the consuming
-  workspaces (dashboard-spa, dotapp, marketing, end-user-usage-lab, assistant,
-  cli, shared); assistant's peer range `>=4.9.0` is unchanged. 4.17.1 regenerates
-  the Runtype OpenAPI contract types to match the current public API spec (adds
-  visitor/identity fields to client init, `conversationId`/`conversationRevision`/
-  `visitor`/`app`/`targetId` on the init response, a `requests[]` array and
-  `externalAgent` on await events, `stepErrorCount` on execution completion, and
-  `displayContent` on chat request messages) and bumps `@mcp-b/webmcp-polyfill`
-  to 4.0.0. Also widened the `minimumReleaseAgeExclude` entry so pnpm accepts the
-  just-published 4.17.1.
-## 2.33.11
-### Patch Changes
-- Updated dependencies [7d284c9]
-- Updated dependencies [93387f9]
-- Updated dependencies [af59a67]
-- Updated dependencies [c29f1ce]
-- Updated dependencies [8847973]
-- Updated dependencies [4776fa0]
-- Updated dependencies [3ea4dd2]
-- Updated dependencies [59e5efa]
-- Updated dependencies [60e39b1]
-- Updated dependencies [553da9d]
-- Updated dependencies [a2c4ec7]
-- Updated dependencies [6671abd]
-- Updated dependencies [f3aef36]
-  - @runtypelabs/sdk@8.0.0
-## 2.33.10
-### Patch Changes
-- Updated dependencies [5df5995]
-- Updated dependencies [1419c72]
-- Updated dependencies [948ceed]
-- Updated dependencies [c56a67e]
-- Updated dependencies [212bd10]
-- Updated dependencies [5ae8a9c]
-  - @runtypelabs/sdk@7.3.1
-## 2.33.9
-### Patch Changes
-- 790e4a6: Remove copy-only tests so user-facing text can change without breaking behavior-focused coverage.
-- Updated dependencies [d1ba834]
-  - @runtypelabs/sdk@7.3.0
-## 2.33.8
-### Patch Changes
-- Updated dependencies [083846c]
-  - @runtypelabs/sdk@7.2.1
-## 2.33.7
-### Patch Changes
-- Updated dependencies [6ae01b5]
-  - @runtypelabs/sdk@7.2.0
-## 2.33.6
-### Patch Changes
-- Updated dependencies [8d85ce9]
-- Updated dependencies [cdff95a]
-- Updated dependencies [27d0b95]
-  - @runtypelabs/sdk@7.1.0
-## 2.33.5
-### Patch Changes
-- Updated dependencies [a634b53]
-- Updated dependencies [836fc82]
-- Updated dependencies [dda50f3]
-  - @runtypelabs/sdk@7.0.0
-## 2.33.4
-### Patch Changes
-- 308c44c: Stop every consumer surface from claiming execution-count caps that no longer exist (remove-execution-caps Slice 3).
-  Slice 2 removed execution-count caps from enforcement. This makes the dashboard, the REST responses, and the docs agree with that: a card-on-file account is never bounded by execution count, and the only remaining bound is the code-owned protective daily ceiling for accounts with no payment method, framed as "add a payment method to remove", never "upgrade your plan".
-  - `ExecutionStats` gains `executionCapReason` (`'no_card_ceiling' | null`), the single signal a surface may branch on. The neutral fallbacks (rate-limit block, spend-cap block, DO fail-open, failed display read) no longer report a ceiling-shaped limit.
-  - `GET /usage-limits` and `/usage-limits/daily` expose `executionCapReason` and always key the payload under `daily`; `inSlowMode` / `isOverage` / `overageCount` / `periodType` stay on the wire but are documented as inert.
-  - `GET /v1/billing/status` gains `usage.executionsToday` (`executionsThisMonth` is a deprecated alias carrying the same daily count); `isApproachingLimits` / `isOverLimits` are documented as always `false`.
-  - Dashboard: usage banners render only for a no-card account, the slow-mode modal is deleted (it had no producer), and the dev billing tester models the carded/no-card matrix instead of retired plan pools.
-  - CLI: `runtype billing status` and `runtype auth whoami` read `executionsToday` instead of `executionsUsed` / `executionsLimit`, which the API has never returned, so both printed "Executions: 0" against a live API. They now show a plain count (no invented denominator) and say "unavailable" when the usage read failed.
-- Updated dependencies [f59e62b]
-- Updated dependencies [308c44c]
-  - @runtypelabs/sdk@6.6.3
-## 2.33.3
-### Patch Changes
-- 8721b57: Bump `@runtypelabs/persona` from 4.15.0 to 4.17.0 across the consuming workspaces.
-  4.17.0 bundles `dompurify@3.4.13`, fixing GHSA-55q2-fjhq-7xh7 (IN_PLACE
-  hook-removal XSS) and GHSA-c2j3-45gr-mqc4 (`CUSTOM_ELEMENT_HANDLING` bypass).
-## 2.33.2
-### Patch Changes
-- Updated dependencies [941f500]
-  - @runtypelabs/sdk@6.6.2
-## 2.33.1
-### Patch Changes
-- 1238c60: Distinguish an unreachable API from an invalid key during auth. Key validation now
-  returns "invalid" only when the API answers 401; any other HTTP status (an egress
-  proxy's 403, a 407, an API 5xx) reports the real problem and names the host that
-  needs to be reachable, instead of telling users their API key is bad.
-- Updated dependencies [5ad8bac]
-- Updated dependencies [58f5a8a]
-- Updated dependencies [e12b556]
-- Updated dependencies [e23af15]
-  - @runtypelabs/sdk@6.6.1
-## 2.33.0
-### Minor Changes
-- bcf78f5: Add typed record collections end to end (Records→Collections plan §5.1/§5.2). The SDK gains an augmentable `RecordCollections` map, a `CollectionMeta<S>` helper, and `client.records.from(slug)` — a typed scope whose `.list/.get/.create/.update` pin the record `type` to the slug and type `metadata` for that collection (`.get`/`.update` guard against cross-collection ids). A new authed `GET /v1/collections/types.d.ts` endpoint hand-emits a `.d.ts` (one interface per schematized collection plus a `declare module '@runtypelabs/sdk'` augmentation, with `// skipped:` markers for rows whose stored schema no longer parses) from the constrained schema dialect. `runtype records typegen [-o <file>]` fetches it (commit and diff-check the output in CI to catch collection-schema drift). The typegen endpoint is fanned out across surfaces: the `get_collection_types` MCP tool (standard + code-mode `getCollectionTypegen`) and the CLI.
-### Patch Changes
-- 5a8e7db: Bump react to 19.2.8, react-dom to 19.2.8, and @types/react to 19.2.17 (devDependencies).
-- db37a92: Bump `@runtypelabs/persona` from 4.14.0 to 4.15.0 across the consuming workspaces.
-- b83dfd2: Group dependency bumps: add-mcp 1.14.0 → 2.0.0, ws ^8.21.0 → ^8.21.1, @radix-ui/react-separator 1.1.8 → 1.1.15, eslint-config-next 16.2.9 → 16.2.12, and @cloudflare/workers-types ^5.20260703.1 → ^5.20260804.1 (workspace override + minimum-release-age exclude lifted).
-- Updated dependencies [5a8e7db]
-- Updated dependencies [bcf78f5]
-  - @runtypelabs/ink-components@0.3.6
-  - @runtypelabs/terminal-animations@0.2.3
-  - @runtypelabs/sdk@6.6.0
-## 2.32.5
-### Patch Changes
-- Updated dependencies [22ab25a]
-  - @runtypelabs/sdk@6.5.1
-## 2.32.4
-### Patch Changes
-- eab2128: Pin first-party dispatch helpers to the response mode selected by their JSON or streaming transport.
-- Updated dependencies [9dca3bc]
-- Updated dependencies [e76a310]
-- Updated dependencies [eab2128]
-- Updated dependencies [25412dc]
-- Updated dependencies [7ab031f]
-- Updated dependencies [eab2128]
-  - @runtypelabs/sdk@6.5.0
-## 2.32.3
-### Patch Changes
-- ad943b9: Align public dispatch request types and clients with the canonical API schema.
-- 7fe10a4: Align portable runtime provider configuration with ModelRouter: honor Together
-  dedicated endpoints, the operator Mixlayer Cloudflare Gateway overlay, native
-  OpenAI/Anthropic gateway policy, and Bedrock/Vertex region defaults. Provider
-  endpoint parsing and defaults now have one shared implementation, and CLI
-  deploys no longer require region/location values that execution defaults.
-- 938ec68: Bump `@runtypelabs/persona` from 4.13.0 to 4.14.0 and adopt the new `preferences` config key in the dashboard chat. `PersonaChat` accepts an optional `preferences` prop (a `WidgetPreferenceSlice` of per-instance display overrides applied over `features` through Persona's allowlist, with live updates and explicit-undefined clearing), and the dashboard's artifact features now set a default display ruleset: documents and components render as reference cards, file-backed code artifacts render inline, and previewable HTML/SVG files get the sandboxed iframe preview in inline mode. The playground's chat panel consolidates its two header rows into one bar: Chat / Payload / Events tabs (Events opens the widget's event stream full-pane), a Display menu with artifact, tool call, and reasoning preference groups wired through the new prop (applying live and clearing back to dashboard defaults), and Logs / Clear on the right. PersonaChat gains `header="none"` plus an `onControlsChange` callback so a parent can own the chrome; all other call sites keep the built-in header. The Display menu is a shared component (`chat-display-menu.tsx`) now present across every test chat: PersonaChat's default header (agent test sheet, flow run sheet), the surface test chat, and the Claude Managed capability chat, with the latter two also picking up the dashboard's default artifact display rules.
-- a62d543: Preserve request-scoped local model routing inside nested flow tools and keep
-  defaulted Bedrock and Vertex region overrides visible as optional deployment
-  settings without requiring them as credentials.
-- Updated dependencies [c576866]
-- Updated dependencies [ad943b9]
-- Updated dependencies [15f3980]
-- Updated dependencies [41a2650]
-- Updated dependencies [050c834]
-- Updated dependencies [17382d8]
-- Updated dependencies [17382d8]
-- Updated dependencies [9e19bc0]
-  - @runtypelabs/sdk@6.4.0
-## 2.32.2
-### Patch Changes
-- Updated dependencies [19e0d21]
-  - @runtypelabs/sdk@6.3.6
-## 2.32.1
-### Patch Changes
-- a548a79: Bump `@runtypelabs/persona` from 4.12.0 to 4.13.0 across the consuming workspaces.
-- d3bb1ed: Apply security overrides for dev/build tooling (batch 1), resolving 29 Dependabot
-  alerts. Adds bounded `overrides` entries for `@tootallnate/once`, `ajv`,
-  `minimatch`, `path-to-regexp`, `smol-toml`, `rollup`, `@babel/core`, `js-yaml`,
-  `brace-expansion`, `undici` (<6 only) and `sharp`, and bumps the
-  `vercel-functions-hello` example's `vercel` devDependency 44 -> 58 so
-  `@vercel/fun` stops pinning `tar@6.2.1` (which no `tar` override could clear).
-  No runtime source changed; this is a lockfile/root-config change. Notable
-  resolution shifts: `sharp` 0.34.5 -> 0.35.2 (prebuilt binary set swap, verified
-  against the marketing Next.js build), `rollup` 4.57.0 -> 4.62.0, and `tar@6.2.1`
-  removed from the tree entirely. `undici@7.28.0` is deliberately untouched for
-  miniflare / wrangler / `@cloudflare/vitest-pool-workers`.
-- 13b718f: Apply security overrides for runtime-reachable dependencies (batch 2). Adds bounded
-  `overrides` entries for `fast-uri`, `form-data` (3.x and 4.x), `lodash`, `uuid` (13.x),
-  `basic-ftp`, `defu`, `flatted`, `body-parser` (2.x), `js-yaml` (4.x),
-  `brace-expansion` (5.x), `ip-address` (10.x) and `dompurify`.
-  Unlike batch 1 these are reachable from shipped code, not just dev/build tooling:
-  `fast-uri` sits under `ajv` in the API worker's MCP/schema path, `form-data` and
-  `uuid` are pulled in by the API, runtime and sandbox dependency trees, `js-yaml` 4.x
-  reaches `@runtypelabs/cli`, and `brace-expansion` 5.x reaches
-  `@runtypelabs/model-execution`. The `dompurify` entry drops the vulnerable 3.3.3 copy
-  that `posthog-js` pulled in and consolidates on 3.4.12, the version
-  `@runtypelabs/persona` already ships in the same tree.
-  No runtime source changed; this is a lockfile/root-config change. Every override
-  carries a deliberate upper bound, since a bare `>=X` override resolves to the newest
-  match across all majors. Verified: no downgrades anywhere in the lockfile.
-- Updated dependencies [6784100]
-- Updated dependencies [d3bb1ed]
-- Updated dependencies [13b718f]
-  - @runtypelabs/sdk@6.3.5
-## 2.32.0
-### Minor Changes
-- 17b9d49: Migrate from the v1 MCP SDK monolith (`@modelcontextprotocol/sdk` 1.29.0) to the v2 scoped packages (`@modelcontextprotocol/{server,client,core}` 2.0.0-beta.5, pinned exact until the stable release lands with the 2026-07-28 spec). The hosted API transport now serves both protocol eras: legacy `initialize` clients (2025-11-25 and earlier) take the unchanged production path, and 2026-07-28 envelope-carrying requests (including `server/discover`) are served through the SDK's modern handler. `@hono/mcp` is replaced by driving the SDK's web-standard transport directly.
-### Patch Changes
-- 739cd8c: Bump `@runtypelabs/persona` from 4.10.0 to 4.12.0 across the consuming workspaces.
-- Updated dependencies [400c1f1]
-- Updated dependencies [400c1f1]
-- Updated dependencies [93a3c5b]
-  - @runtypelabs/sdk@6.3.4
-## 2.31.6
-### Patch Changes
-- Updated dependencies [844b742]
-  - @runtypelabs/sdk@6.3.3
-## 2.31.5
-### Patch Changes
-- Updated dependencies [f0ec44b]
-  - @runtypelabs/sdk@6.3.2
-## 2.31.4
-### Patch Changes
-- e9fef9f: Bump `@runtypelabs/persona` from 4.9.0 to 4.10.0 across the consuming workspaces.
-- Updated dependencies [d547ab3]
-- Updated dependencies [c065bb9]
-  - @runtypelabs/sdk@6.3.1
-## 2.31.3
-### Patch Changes
-- Updated dependencies [401acbd]
-- Updated dependencies [cb8cb9e]
-- Updated dependencies [7f77e9f]
-- Updated dependencies [20737ee]
-  - @runtypelabs/sdk@6.3.0
-## 2.31.2
-### Patch Changes
-- Updated dependencies [68a503e]
-  - @runtypelabs/sdk@6.2.1
-## 2.31.1
-### Patch Changes
-- 064d62e: Bump `@runtypelabs/persona` from 4.6.1 to 4.8.0: refreshed WebMCP clientTools snapshot on client-token resume (4.7.0) and the artifact system overhaul (4.8.0) with sandboxed file previews, display modes, inline artifact blocks, syntax-highlighted source views, and detached/flush panel appearances.
-- Updated dependencies [b967727]
-- Updated dependencies [2c8cf42]
-- Updated dependencies [2c8cf42]
-  - @runtypelabs/sdk@6.2.0
-## 2.31.0
-### Minor Changes
-- 47cd4cb: Browserless agent signup: `runtype auth register --email` / `claim` / `verify` wrap the agent-auth claim ceremony so coding agents can create and verify a Runtype account from a non-TTY shell with no browser. Non-TTY `auth login`/`signup` now print actionable guidance instead of a dead-end TTY error, `auth status` reports pending-signup state with the exact next command, and `whoami` falls back to `/users/profile` for key classes that `/auth/me` rejects. The runtype.ai agent onboarding instructions now lead with this flow (the user is only ever asked for their email and the emailed 6-digit code), and auth.md documents the CLI as the preferred protocol client.
-## 2.30.1
-### Patch Changes
-- Updated dependencies [843b702]
-  - @runtypelabs/sdk@6.1.4
-## 2.30.0
-### Minor Changes
-- 180154f: Add `runtype onboard`, a single npx-able command that collapses the agent golden path: it signs in, installs Runtype agent skills and the hosted OAuth MCP server for the current coding agent, and prints an explicit next-step payload (with `--print-instructions` to emit the canonical agent onboarding markdown verbatim).
-## 2.29.0
-### Minor Changes
-- 88cc64f: Add `runtype devices` commands that securely install and control the native macOS device provider, pair local Macs, manage policy and lifecycle, inspect relay status, and discover each device's managed MCP endpoint.
-## 2.28.1
-### Patch Changes
-- Updated dependencies [1acada7]
-- Updated dependencies [db2cf06]
-  - @runtypelabs/sdk@6.1.3
-## 2.28.0
-### Minor Changes
-- 5a95da5: Add generic `runtype mcp tools`, `inspect`, and `call` commands for dynamically discovering and invoking the primary or Code Mode MCP server, with typed fields, JSON file/stdin input, and machine-readable results.
-## 2.27.1
-### Patch Changes
-- Updated dependencies [158223e]
-- Updated dependencies [3abba4d]
-  - @runtypelabs/sdk@6.1.2
-## 2.27.0
-### Minor Changes
-- 43f040b: Automatically install verified stable CLI releases into a user-owned version cache, activate them
-  on the next invocation, and add manual check, update, and rollback controls.
-- 9cb48c2: Add a native-first `runtype install-mcp` command that detects the active coding harness, installs its Runtype skills, configures the hosted user-level MCP server, starts client-owned OAuth when supported, and gives explicit restart instructions. Replace runtype.ai's branching OAuth/API-key/CLI setup tree with one CLI-first-session to OAuth-MCP golden path, keeping API keys as a linked headless exception and moving task-specific detail into installed skills.
-## 2.26.1
-### Patch Changes
-- Updated dependencies [40cb003]
-  - @runtypelabs/sdk@6.1.1
-## 2.26.0
-### Minor Changes
-- cfacf11: feat: record collections on every non-REST surface
-  Fans the `/v1/collections` REST API (Records→Collections Phase 1) out to the
-  remaining surfaces, closing the Phase 1 acceptance loop — create → infer →
-  warn → validate-existing → enforce → 422 works identically via REST, SDK, MCP,
-  and CLI:
-  - **MCP** (`@runtypelabs/mcp` + the api-internal client): seven tools —
-    `list_collections`, `get_collection`, `create_collection`,
-    `update_collection`, `delete_collection`, `infer_collection_schema`,
-    `validate_collection_records` — with
-    read-only/destructive annotations, next-step hints, and collections-domain
-    error recovery hints.
-  - **Code Mode MCP**: matching `runtype.listCollections(...)` /
-    `getCollection` / `createCollection` / `updateCollection` /
-    `deleteCollection` / `inferCollectionSchema` / `validateExistingRecords`
-    executor methods with overlay docs and examples.
-  - **SDK**: `client.collections` endpoint class
-    (list/get/create/update/delete/inferSchema/validateExisting) with response
-    types derived from the generated OpenAPI spec.
-  - **CLI**: `runtype collections list|get|create|update|delete|infer|validate`,
-    including `--schema-file` round-tripping and the infer → update adoption
-    flow.
-  - **Docs**: new user-guide page "Defining a schema" plus a collections section
-    in the MCP server integration guide.
-  The dashboard assistant deliberately excludes the new tools
-  (`phase2:collections`) until the Collections UI ships.
-### Patch Changes
-- 0da0e61: Close three friction points the onboarding E2E tester hit: document `allow_draft: true` for deploying draft examples via `create_product_from_example`, add an `execute_agent` request example (the `messages` array shape) to the runtype.ai agent prose, and make `runtype auth whoami` honor `RUNTYPE_API_KEY` (it previously read only the credential store and reported "unauthenticated" for env-key-only sessions, contradicting the documented contract that CLI commands work with the env key alone). Also carves `agent-onboarding-content` out of the shared barrel into a subpath export so the API Worker's eager graph no longer carries it.
-- Updated dependencies [c26556c]
-- Updated dependencies [cfacf11]
-- Updated dependencies [2c315c5]
-- Updated dependencies [644e057]
-- Updated dependencies [cd1133f]
-  - @runtypelabs/sdk@6.1.0
-## 2.25.15
-### Patch Changes
-- Updated dependencies [a948051]
-  - @runtypelabs/sdk@6.0.2
-## 2.25.14
-### Patch Changes
-- Updated dependencies [4b4bbe9]
-- Updated dependencies [9a3dd1a]
-- Updated dependencies [aab02e1]
-- Updated dependencies [ebb401b]
-  - @runtypelabs/sdk@6.0.1
-## 2.25.13
-### Patch Changes
-- 5cff576: Enforce full-workspace ESLint coverage for published TypeScript packages.
-- Updated dependencies [5cff576]
-- Updated dependencies [51ab2d1]
-- Updated dependencies [a27eea9]
-- Updated dependencies [5f08625]
-- Updated dependencies [9ab9197]
-  - @runtypelabs/sdk@6.0.0
-  - @runtypelabs/ink-components@0.3.5
-  - @runtypelabs/terminal-animations@0.2.2
-## 2.25.12
-### Patch Changes
-- 4849a3a: Upgrade the dashboard SPA build toolchain to Vite 8.1 (Rolldown/Oxc), @vitejs/plugin-react 6, and @cloudflare/vite-plugin 1.43. Removes the obsolete esbuild `supported: { destructuring }` workaround (no esbuild in the Vite 8 pipeline) and renames `build.rollupOptions` to `build.rolldownOptions`. Bumps @runtypelabs/persona to 4.6.1 monorepo-wide: 4.6.1 rewrites its `"message" in e` guards to `Reflect.has`, so its minified dist no longer contains the for-init arrow `in`-expression shape that Oxc rejects at parse time and Rolldown otherwise silently emits as an empty chunk — no build-side workaround needed. No user-facing behavior change.
-- Updated dependencies [6aac451]
-  - @runtypelabs/sdk@5.15.0
-## 2.25.11
-### Patch Changes
-- 29ce53f: Finish hiding pre-GA Runtype Apps from public SDK/docs/CLI surfaces and keep app-only client sessions fail-closed behind the feature flag.
-- Updated dependencies [29ce53f]
-- Updated dependencies [5d828d9]
-  - @runtypelabs/sdk@5.14.3
-## 2.25.10
-### Patch Changes
-- b00dea7: Hide pre-GA Runtype Apps surfaces from public tool catalogs, docs, schemas, skills indexes, SDK generation, and unauthenticated CLI help; keep runtime/tool access fail-closed behind the feature flag.
-- Updated dependencies [b00dea7]
-  - @runtypelabs/sdk@5.14.2
-## 2.25.9
-### Patch Changes
-- Updated dependencies [0d4b1b8]
-  - @runtypelabs/sdk@5.14.1
-## 2.25.8
-### Patch Changes
-- Updated dependencies [facb5d9]
-  - @runtypelabs/sdk@5.14.0
-## 2.25.7
-### Patch Changes
-- Updated dependencies [89dbb72]
-  - @runtypelabs/sdk@5.13.0
-## 2.25.6
-### Patch Changes
-- Updated dependencies [b2badd2]
-  - @runtypelabs/sdk@5.12.1
-## 2.25.5
-### Patch Changes
-- Updated dependencies [2821ddb]
-- Updated dependencies [9a527cd]
-- Updated dependencies [ec895c9]
-  - @runtypelabs/sdk@5.12.0
-## 2.25.4
-### Patch Changes
-- Updated dependencies [8f998e7]
-- Updated dependencies [e6b97e1]
-- Updated dependencies [e88000e]
-- Updated dependencies [3ac490c]
-- Updated dependencies [9a47ef1]
-- Updated dependencies [d7780b7]
-  - @runtypelabs/sdk@5.11.0
-## 2.25.3
-### Patch Changes
-- 3458218: Remove dead code identified by an audit: the unused prompt-library table/dialog components, the unregistered CLI `talk` command (and its orphaned test), seven orphaned root scripts, the never-exposed eval-suite CRUD surface on the MCP `RuntypeClient` interface (and its API-side mirror), a one-line re-export shim in the flow-execution code-tool resolver, and duplicated local tail-event types in the CLI `tail` command in favor of the canonical `@runtypelabs/shared` exports. No behavior changes.
-- Updated dependencies [36d84c1]
-- Updated dependencies [e769fbf]
-- Updated dependencies [5d07273]
-  - @runtypelabs/sdk@5.10.0
-## 2.25.2
-### Patch Changes
-- ae6f98e: Degrade gracefully when R2 SQL fails on the logs read path. When the historical (R2 SQL) leg of a merged GET /v1/logs or /v1/logs/stats query fails (e.g. the Iceberg manifest scan limit, error 40020), the request now serves hot-tier (recent) entries and counts with a new optional `degraded: true` field on the response data instead of failing the whole request with a 500. Degraded stats responses are never cached. The dashboard logs page shows a "historical logs temporarily unavailable" banner when the flag is set.
-- 48d0dd5: Upgrade `@cloudflare/workers-types` from v4 to v5 (`5.20260703.1`) across the monorepo.
-  v5 ships only the latest runtime types and removes the dated entrypoints (`@cloudflare/workers-types/2023-07-01`, etc.); the bare and `/experimental` entrypoints are retained. The repo-wide pin (`pnpm.overrides`) and all workspace `devDependencies` ranges are moved to v5, and `apps/tail-worker` switches off its now-removed `/2023-07-01` dated entrypoint onto the bare entrypoint.
-  The newer compat-date globals in v5 required a few type-only adjustments in the API and Code Mode MCP workers: the Cloudflare `ExecutionContext` now carries required `exports`/`tracing` members (so Hono's narrower `c.executionCtx` is cast where passed to Workers APIs), and `navigator` is no longer a member of `typeof globalThis`. No runtime behavior changes. The CLI deploy scaffold now emits `@cloudflare/workers-types@^5.0.0` for generated projects.
-- Updated dependencies [e85c67e]
-- Updated dependencies [ae6f98e]
-- Updated dependencies [f5ad9c0]
-  - @runtypelabs/sdk@5.9.0
-## 2.25.1
-### Patch Changes
-- Updated dependencies [9087295]
-- Updated dependencies [7007359]
-- Updated dependencies [ee51039]
-- Updated dependencies [db60b0c]
-- Updated dependencies [40874d8]
-- Updated dependencies [41b296a]
-  - @runtypelabs/sdk@5.8.1
-## 2.25.0
-### Minor Changes
-- 1b707f9: Add tenancy-scope parameters to the hand-written `create_secret` surfaces so they
-  reach parity with the REST route + generated SDKs (multi-tenancy V1, inc 5). The
-  MCP `create_secret` tool gains optional `product_tenant_id` / `end_user_id` inputs
-  (mapped to `productTenantId` / `endUserId` on `POST /v1/secrets`), and the CLI
-  `secrets create` command gains `--product-tenant-id` / `--end-user-id` flags. Omit
-  both for an org-level secret (unchanged default); a scoped secret requires a value.
-### Patch Changes
-- 451f923: Bump commander from ^12.0.0 to ^15.0.0. No runtime code changes needed: the CLI is already ESM-only with the modern .opts()/action signature, single parse() with exitOverride, and no reliance on silently-ignored excess arguments. Tightens engines.node to >=22.12.0 to match commander 15's floor. Fixes the tail command unit-test harness, which passed a bogus ['node','test'] prefix with { from: 'user' } that commander 14+ now correctly rejects as excess arguments.
-- 96aba76: Harden the synchronous `/eval/run` CI gate. The run now enforces a 4-minute total wall-clock deadline for case execution (cases the deadline prevents from running are returned as failed with an actionable message instead of letting the CLI's HTTP stack sever the buffered response client-side), releases the reserved daily-eval quota slot when a run throws after reservation (new `releaseEvalCount` on UsageTrackerDO + `DailyEvalLimitService.release`), and fixes `step_order` / `ran_step` trace grading for interleaved flows: the grading trace is now built in true execution order from `step_start` events (the eval dispatch runs in debug mode so `streamOutput: false` steps are captured too), and step labels match by name, type, or step id. Adds command-level tests for `runtype eval run` (exit codes, `--strict`, `--virtual`, `--junit`, ensure→run sequencing, abort-on-first-API-error) plus ensure update-path and run-service happy-path/402/deadline/release coverage.
-- 4c17349: Eval score persistence (Beginner-First Evals Phase 1, PR-A): grader scores now have a durable home.
-  - **Saved-suite runs of `POST /v1/eval/run` persist by default**: the run gets a `batchExecutions` anchor row (`executionType='eval'`, `evalSuiteId` set) and one `eval_case_scores` row per (case, grader) — the data source for run history, baselines, and score-over-time. Pass `virtual: true` to keep a run ephemeral; inline `definition` runs stay ephemeral always. The response (and SDK `RunEvalResult`) gains `runId`.
-  - **Suite-linked batch runs are scored at completion**: `completeBatch()` now grades a run with `batchExecutions.evalSuiteId` set from its persisted step results — including trace-grader coverage rebuilt from `flowStepResults` + `tool_executions` (closing the deferred batch-trace gap). Idempotent and non-fatal; dormant until a producer links batches to suites.
-  - **New read endpoint `GET /v1/eval/runs/{batchId}/scores`** returning per-case grader outcomes in the same shape as the sync run response.
-  - **Four new AI grader presets**: Stays on task, Same language, Refuses when it should, No personal data (mirrored in the SDK `judges.*` builders).
-  - CLI `runtype eval run` prints the persisted run id.
-- ad19f94: Make the global `--json` and `--api-url` flags actually work. Commander stores an option on the command that declared it, so both flags landed on the root program's opts and were silently ignored: leaf actions reading `options.json` got an empty object (even when the subcommand declared its own `--json`), and nothing ever read the parsed `--api-url` (`getApiUrl()` only consulted the env var). A new preAction forwarding hook copies `--api-url` into `RUNTYPE_API_URL` (the single seam every client/auth path reads, flag overrides env) and injects `--json` into the action command's options. Long-standing behavior present on every published version.
-- 2238a2e: Fix "An unexpected error occurred: CommanderError: (outputHelp)" noise printed after `--help` output. The top-level error handler recognized `commander.help` (thrown by `.help()`) but not `commander.helpDisplayed`, which is what commander's exitOverride throws when `--help`/`-h` displays help. Long-standing bug present on every published version; surfaced by a smoke test of the commander 15 bump.
-- 5371c45: Fix "An unexpected error occurred" dump after `error: unknown command '...'`. The top-level error handler did not recognize commander's `commander.unknownCommand` code, so a typo'd subcommand printed the proper one-line error followed by a raw CommanderError stack. Commander already writes the message to stderr; the handler now just exits 1. Pre-existing on every published version; found in the same smoke test as the --help fix.
-- Updated dependencies [1422e92]
-- Updated dependencies [d0df6a8]
-- Updated dependencies [de60a30]
-- Updated dependencies [4c17349]
-- Updated dependencies [f89cb41]
-- Updated dependencies [9736850]
-- Updated dependencies [8f13a37]
-- Updated dependencies [fa6d18a]
-- Updated dependencies [9002f51]
-- Updated dependencies [4520c60]
-- Updated dependencies [49d599f]
-- Updated dependencies [9cbdba8]
-- Updated dependencies [b82d8f1]
-- Updated dependencies [edae98b]
-  - @runtypelabs/sdk@5.8.0
-## 2.24.1
-### Patch Changes
-- Updated dependencies [fd2e18e]
-  - @runtypelabs/sdk@5.7.0
-## 2.24.0
-### Minor Changes
-- 78e6f0e: feat(evals): grader severity (`gate`/`soft`) + functional `--strict`, and inline `evals:` on `flows.ensure` (code-colocated evals increment 5)
-  - **Severity.** Every grader now carries an optional `severity: 'gate' | 'soft'` (absent ⇒ `gate`, the historical hard-gate behavior). A `soft` grader miss is tracked-but-not-failing — reported per-outcome but it does not fail the case unless the run is strict. `casePassed(outcomes, { strict })` in `@runtypelabs/shared` owns the aggregation; `EvalScoringService.scoreRun` threads a `strict` flag and stamps each outcome's severity.
-  - **`runtype eval --strict` is now functional** (previously a stub): it sends `strict: true` to `POST /v1/eval/run`, and the server-computed severity-aware `passed` drives the exit code (a soft miss alone exits `0` without `--strict`, `1` with it; a gate miss always exits `1`). The CLI also surfaces soft misses on passing cases as warnings.
-  - **SDK chainable severity handles.** Grader builders (`contains(...)`, `judge(...)`, `calledTool(...)`, …) return a `Gradeable` with `.gate()` / `.soft()` handles (and `.atLeast(n)` on AI graders to set the 1-5 judge cutoff). The handles are non-enumerable, so a grader still serializes byte-identically to its plain wire shape and the content hash of an un-annotated grader is unchanged.
-  - **Inline `evals:` on `flows.ensure`.** `defineFlow({ ..., evals: [...] })` attaches eval suites that converge with the flow; an inline eval that omits `target` defaults to the enclosing flow. This is SDK-orchestrated and honors the eval-endpoints-only rule — the flow converges through `/flows/ensure` (its `{ name, steps }` wire shape and content hash are unchanged; `evals` is never sent there) and each inline suite converges through the existing `/eval/ensure`. `Runtype.flows.ensure(...)` returns the per-suite converge outcomes under `evals`.
-### Patch Changes
-- Updated dependencies [78e6f0e]
-  - @runtypelabs/sdk@5.6.0
-## 2.23.1
-### Patch Changes
-- Updated dependencies [edf1724]
-  - @runtypelabs/sdk@5.5.0
-## 2.23.0
-### Minor Changes
-- a7b06ce: Code-colocated evals increment 3: the `runtype eval run` CI gate plus the
-  synchronous run+score endpoint behind it.
-  New `POST /v1/eval/run` runs every case of an eval suite (a saved suite by id, or
-  an inline `--virtual` definition) against its target flow/saved-agent, grades the
-  outputs with the suite graders via `EvalScoringService`, and returns the suite
-  score + per-case grader outcomes in one response. Synchronous and ephemeral — no
-  batch is created and no `eval_case_scores` are persisted (AI-grader spend is
-  still metered); bounded by a per-run case ceiling, with a per-case timeout.
-  `claude_managed` agents and inline/virtual agent targets are rejected with an
-  actionable error.
-  The SDK gains `client.evals.runSuite({ suiteId } | { definition })` (and the
-  `runEvalSuite` helper) returning the typed `RunEvalResult`.
-  The CLI gains `runtype eval run [idOrDirPrefix]`: it discovers `**/*.eval.ts`,
-  loads each `defineEval(...)` default export via jiti, `ensure`s the suite (or runs
-  it inline with `--virtual`), runs it, and maps the result to eve-style exit codes
-  (`0` pass / `1` gate failure / `2` config error). Supports `--junit <path>`,
-  `--url <api>`, `--cwd <dir>`, and a `--strict` stub (grader severity lands in a
-  later increment).
-### Patch Changes
-- Updated dependencies [0cd1d82]
-- Updated dependencies [a7b06ce]
-- Updated dependencies [17f7b6b]
-  - @runtypelabs/sdk@5.4.0
-## 2.22.17
-### Patch Changes
-- Updated dependencies [2260366]
-  - @runtypelabs/sdk@5.3.1
-## 2.22.16
-### Patch Changes
-- Updated dependencies [83d57ad]
-- Updated dependencies [9ed5154]
-  - @runtypelabs/sdk@5.3.0
-## 2.22.15
-### Patch Changes
-- 346f947: Run workspace type-checking on the TypeScript 7 native compiler (`tsgo`, from `@typescript/native-preview`). The per-package `typecheck` / `type-check` scripts now invoke `tsgo --noEmit` instead of `tsc --noEmit` (~5x faster across the workspace). This is a type-check-only change: `typescript` stays pinned at `^6.0.3` for builds, lint, and codegen — whose compiler-API consumers (tsup `.d.ts` emit, typescript-eslint, ts-morph) are not stable on the 7.x API until ~7.1 — so no package's runtime behavior or emitted types change. The `typecheck:native` benchmark harness is updated to stay version-agnostic (it derives the `tsc` baseline for `--compare`), `@typescript/native-preview` is bumped to the latest tracked build, and the orphaned `@runtypelabs/system-product-generator` package's stray `typescript@^5.9.3` pin is aligned to `^6.0.3`.
-- Updated dependencies [346f947]
-  - @runtypelabs/sdk@5.2.3
-  - @runtypelabs/ink-components@0.3.4
-## 2.22.14
-### Patch Changes
-- ba0a50b: Upgrade the workspace TypeScript toolchain from 5.9 to 6.0 (`^6.0.3`, the transitional release before the Go-native 7.0). This is a build and type-check toolchain change only: `typescript` is a devDependency and the edits are tsconfig-level, so no package's runtime behavior changes.
-  Config migrations required by 6.0: removed the deprecated `baseUrl` option (paths now resolve relative to the tsconfig), added `ignoreDeprecations: "6.0"` where tsup's DTS build injects a `baseUrl`, and set explicit `rootDir` / `types` where 6.0's new defaults (`types: []`, `noUncheckedSideEffectImports: true`) required it. typescript-eslint 8.61 already supports 6.0; build, typecheck, and lint are green. See `docs/typescript-6-upgrade.md`.
-- Updated dependencies [ba0a50b]
-  - @runtypelabs/ink-components@0.3.3
-## 2.22.13
-### Patch Changes
-- 01e44aa: Add a local Persona Playground demo option to `runtype persona init` with WebMCP-ready provisioning and generated HTML.
-## 2.22.12
-### Patch Changes
-- 23a75ec: chore: bump @runtypelabs/persona to 4.3.1
-## 2.22.11
-### Patch Changes
-- 1a25b10: Bump `@runtypelabs/persona` to 4.1.0
-- 012eb68: Bump `@runtypelabs/persona` to 4.2.0
-## 2.22.10
-### Patch Changes
-- a3c41f5: Bump `@runtypelabs/persona` from 3.37.0 to 4.0.0. The embedded 4.x widget consumes the unified SSE vocabulary natively, so the dashboard no longer forces the `?events=legacy` override on its dispatch/execute/test/approve fetches. Removed the transitional `persona-legacy-sse` adapter; the two still-needed canonical helpers (`getPersonaSseErrorMessage`, `parsePersonaCanonicalSseEvent`) now live in `persona-sse.ts`.
-- Updated dependencies [c09b0af]
-  - @runtypelabs/sdk@5.2.2
-## 2.22.9
-### Patch Changes
-- Updated dependencies [9a77df1]
-  - @runtypelabs/sdk@5.2.1
-## 2.22.8
-### Patch Changes
-- Updated dependencies [049bcf9]
-  - @runtypelabs/sdk@5.2.0
-## 2.22.7
-### Patch Changes
-- Updated dependencies [97a3431]
-- Updated dependencies [82d897c]
-  - @runtypelabs/sdk@5.1.0
-## 2.22.6
-### Patch Changes
-- Updated dependencies [44779c1]
-  - @runtypelabs/sdk@5.0.0
-## 2.22.5
-### Patch Changes
-- Updated dependencies [4bef8db]
-- Updated dependencies [2b788c7]
-- Updated dependencies [b43088f]
-  - @runtypelabs/sdk@4.21.0
-## 2.22.4
-### Patch Changes
-- Updated dependencies [3fdf801]
-  - @runtypelabs/sdk@4.20.0
-## 2.22.3
-### Patch Changes
-- f3ef273: Bump `@runtypelabs/persona` to 3.37.0 across the application.
-  The 3.35.0 release split `createThemePreview` (and `ThemePreviewHandle` /
-  `PreviewDevice`) out of `@runtypelabs/persona/theme-editor` into a new
-  `@runtypelabs/persona/theme-editor/preview` subpath, so the dashboard's
-  `WidgetStyleDrawer` and `now/preview-content` imports are updated to the new path.
-## 2.22.2
-### Patch Changes
-- Updated dependencies [d5b9f87]
-- Updated dependencies [6d5ba51]
-  - @runtypelabs/sdk@4.19.2
-## 2.22.1
-### Patch Changes
-- Updated dependencies [cd7b402]
-  - @runtypelabs/sdk@4.19.1
-## 2.22.0
-### Minor Changes
-- 9efb803: Marathon playbooks: opt-in `fallbackOnEmpty` to recover from empty (text-less)
-  model output.
-  Set `fallbackOnEmpty: true` on a milestone (or at the playbook top level as a
-  default) to make that milestone's `fallbackModels` chain also fire when the model
-  finishes successfully but returns no visible text — the "thinking model spends its
-  whole budget reasoning and answers nothing" failure — instead of only on errors.
-  It attaches the execution engine's existing `empty-output` fallback trigger to the
-  agent `errorHandling` the marathon writes. Off by default (never automatic) and
-  only effective when `fallbackModels` is configured; the playbook loader warns when
-  it is enabled without a fallback chain. No API change.
-- 9efb803: Marathon: support per-session `maxTokens` and `temperature` overrides for the
-  **primary** model, settable from the CLI (`--max-tokens` / `--temperature`) and
-  in playbooks (per-milestone fields plus top-level defaults).
-  - API: `POST /v1/agents/:id/execute` now accepts request-level `temperature` and
-    `maxTokens`, merged into the agent config before `buildVirtualFlow` (mirrors the
-    existing `model` / `systemPrompt` overrides). Out-of-range values are ignored.
-  - SDK: `RunTaskOptions`, `AgentExecuteRequest`, and `WorkflowMilestoneConfig` gain
-    optional `temperature` / `maxTokens`; the marathon runner threads them into each
-    session's execute request.
-  - CLI: resolves both per phase with precedence per-milestone playbook value >
-    global CLI flag > playbook top-level default.
-  Previously only a fallback model could carry a `maxTokens`, so a "thinking"
-  primary model that spent its budget reasoning could return no tool call and stall
-  the run with nothing to show.
-### Patch Changes
-- 009a396: Extract the marathon TUI steering/follow-up message queues into a standalone,
-  unit-tested `createSteeringQueue` module. Behavior-preserving refactor: it
-  removes the push/drain/count bookkeeping duplicated across the composer submit
-  handler, the Esc-Esc abort path, and the `streamRef` drain actions, and creates
-  a single injection point so a message can be enqueued from any producer (the
-  local keyboard today, a remote control channel later) without knowing how
-  draining or the count display works. Groundwork for marathon tethered mode
-  (local execution, remote control).
-- Updated dependencies [e96edad]
-- Updated dependencies [9efb803]
-- Updated dependencies [9efb803]
-  - @runtypelabs/sdk@4.19.0
-## 2.21.6
-### Patch Changes
-- Updated dependencies [266280e]
-  - @runtypelabs/sdk@4.18.0
-## 2.21.5
-### Patch Changes
-- Updated dependencies [408e8f4]
-- Updated dependencies [fee4239]
-  - @runtypelabs/sdk@4.17.1
-## 2.21.4
-### Patch Changes
-- Updated dependencies [83e5921]
-  - @runtypelabs/sdk@4.17.0
-## 2.21.3
-### Patch Changes
-- Updated dependencies [46624dc]
-- Updated dependencies [845d81b]
-- Updated dependencies [45aaaa7]
-- Updated dependencies [3396ef1]
-- Updated dependencies [f9b537d]
-  - @runtypelabs/sdk@4.16.0
-## 2.21.2
-### Patch Changes
-- Updated dependencies [0dcd669]
-  - @runtypelabs/sdk@4.15.0
-## 2.21.1
-### Patch Changes
-- Updated dependencies [fec3688]
-- Updated dependencies [26c393c]
-  - @runtypelabs/sdk@4.14.0
-## 2.21.0
-### Minor Changes
-- dc36176: `runtype records get` now renders a record's `messages` (previously only id/name/
-  type/metadata were shown). Multi-modal message content renders as text plus
-  compact `[image …]` / `[file …]` / `[attachment …]` markers, and on terminals with
-  an inline-image graphics protocol (iTerm2, WezTerm, Kitty, Ghostty) image parts
-  render inline — mirroring `conversations get`. Inline images are TTY-gated and can
-  be disabled with `--no-images`. Records carry rehydrated inline image data URIs on
-  the read path as of the asset-offload records GET seam, so a record created with
-  inline media now displays that media instead of hiding it. The shared content-walk
-  helper (`renderMessageContent`) was lifted into `lib/message-content.ts` and is now
-  shared by both commands.
-## 2.20.0
-### Minor Changes
-- 5e4f47c: Render conversation image attachments inline in `runtype conversations get` on terminals that support a graphics protocol. When stdout is an interactive terminal that implements the iTerm2 inline-images protocol (iTerm2, WezTerm) or the Kitty graphics protocol (Kitty, Ghostty), image parts are displayed inline instead of as a `[image …]` marker. The rehydrated `data:` URI bytes are passed straight to the protocol with no image-decoding dependency (iTerm2 handles any format; Kitty renders PNG dependency-free and falls back to the marker for other formats). Non-interactive output (pipes, CI), unknown terminals, and `--no-images` keep the text marker.
-## 2.19.4
-### Patch Changes
-- e444f67: Fix `runtype conversations get` rendering multi-modal / offloaded message content as `[object Object]`. A conversation message's `content` can be an array of typed parts (text + `image`/`file`, and rehydrated or raw `asset_ref` attachments), not just a string. The CLI now renders text parts inline and collapses each media/attachment part to a compact `[image …]` / `[file …]` / `[attachment …]` marker in both the non-TTY and TTY output paths.
-## 2.19.3
-### Patch Changes
-- Updated dependencies [8bffeb2]
-  - @runtypelabs/sdk@4.13.1
-## 2.19.2
-### Patch Changes
-- c9959e9: Bump `@runtypelabs/persona` to 3.34.1 across the repo.
-- 78f5be1: Marathon: route fresh build-and-deploy / game goals to the deploy and game
-  workflows when a deploy-capable sandbox (`--sandbox daytona` or
-  `runtype-sandbox`) is explicitly enabled, instead of falling through to the
-  default create workflow (which confines writes to `public/` and never calls
-  `deploy_sandbox`). When the goal looks deploy/game-shaped but no deploy-capable
-  sandbox is enabled, the CLI now prints an actionable hint to re-run with
-  `--sandbox daytona`. Auto-enabling a sandbox from keywords alone is still
-  intentionally avoided.
-- ac35549: Marathon ledger unification (increment 2): instrument session-search indexing cost.
-  The default-on session-search revisit trigger was unevaluable because the `/session-context/index` POST was a silent `.catch(() => {})`. Now the marathon command:
-  - Counts indexed chunks and serialized payload bytes across all sessions and checkpoint restarts, and prints a cumulative `Indexed: N chunks (M KB)` line in the final task summary.
-  - Surfaces a context notice (`session_indexed`) when a single session's indexing payload exceeds 512 KB — the signal the revisit trigger watches for.
-  - Logs indexing failures once per task (`indexing_failed` notice) instead of swallowing them silently, so "search finds nothing because indexing has been failing" is diagnosable. The POST stays non-blocking.
-  CLI-side observability only; no API changes.
-- Updated dependencies [04db6c7]
-- Updated dependencies [7ea7ece]
-- Updated dependencies [3a162cc]
-- Updated dependencies [ee6f248]
-  - @runtypelabs/sdk@4.13.0
-## 2.19.1
-### Patch Changes
-- b7c3ab8: Bump `@runtypelabs/persona` 3.31.0 → 3.34.0. This picks up the push-dock fix (persona#287/#285): the docked push reveal now offsets its track with `margin-left` instead of a CSS `transform`, so it no longer establishes a containing block that pushed viewport-`fixed`/`sticky` host chrome (e.g. the dashboard editor toolbar) off-screen. Unblocks the docked dashboard-assistant rollout.
-- 4cfef88: Marathon ledger unification (increment 1): route SDK hot-tail tool-output offloads through one artifact store.
-  - SDK: new `offloadRecorder` option on `RunTaskOptions` (and exported `RunTaskOffloadRecorder` type). When supplied, `offloadToolResult` delegates persistence to the recorder and splices its reference into the send view instead of writing to the unledgered `.runtype/marathons/<slug>/tool-outputs/` fallback. The SDK still owns the offload decision (its inline threshold); the recorder owns storage. Declining (returning `undefined`/throwing) falls back to the built-in store, so non-marathon and browser consumers are unchanged.
-  - CLI: supplies a recorder backed by the existing content-addressed ledger store (`offloadToolOutput`), so the 500–100k char band becomes a first-class ledger citizen (content-addressed `art_<sha256>`, hashed, `read_offloaded_output`-resolvable, deduped, on-timeline) instead of a separate unledgered store.
-  - CLI: fix the per-offload `loadTreeLog` reload — `recordOffloadedArtifact` now appends through a shared head accessor (`getOrLoadTreeLogSync`) so artifact entries land on-chain at the live head instead of as sibling stubs off a stale, disk-reloaded head, and offload cost is O(1) rather than O(tree-log size).
-- 062e5bd: Neutralize CSV formula injection on record export. Cells whose first character is `=`, `+`, `-`, `@`, or a leading tab/carriage return/newline are now prefixed with a single quote so spreadsheet applications (Excel, Sheets, LibreOffice) treat them as text instead of executing them as formulas. Record metadata is frequently written from external/agent input, so exported values were attacker-controllable. The trigger set lives in a single shared helper (`neutralizeCsvFormula` in `@runtypelabs/shared`) consumed by both the API export (`escapeCsvValue`) and the CLI's local CSV export (`csvEscape`), so the two surfaces cannot drift.
-- 6c475fe: Close record-tool surface-parity gaps (P0.7): expose already-existing `/v1/records` API capabilities on the client surfaces that lacked them.
-  - MCP: add the `delete_record` tool (input schema, schema-map registration, destructive tool definition, execution handler, and `deleteRecord` on the `RuntypeClient` interface + both implementers).
-  - Code-Mode MCP: add `deleteRecord(id)` → `DELETE /v1/records/:id` to the executor and code-spec overlay.
-  - SDK: add `records.getStepResults(id, params?)` → `GET /v1/records/:id/step-results` and `records.getCosts(id)` → `GET /v1/records/:id/costs` to `RecordsEndpoint`.
-  - CLI: add `records results <id>` and `records costs <id>` subcommands routed through the SDK.
-- Updated dependencies [cf9eae0]
-- Updated dependencies [d895f91]
-- Updated dependencies [2392c5e]
-- Updated dependencies [4cfef88]
-- Updated dependencies [04dc52c]
-- Updated dependencies [6c475fe]
-- Updated dependencies [6f6dd80]
-  - @runtypelabs/sdk@4.12.0
-## 2.19.0
-### Minor Changes
-- e7a7c22: Add workflow stall policy and richer marathon playbooks. WorkflowDefinition gains an optional `stallPolicy` (`nudgeAfter` / `escalateModelAfter` / `stopAfter`) keyed on the consecutive-empty-sessions counter, so narration-only sessions trigger a recovery nudge, a model-escalation signal (`state.stallEscalationRequested`), or a configurable stall threshold instead of silently dying after 3 empty sessions. Playbooks can now declare per-milestone `recovery` messages (triggered on the same stall counter), `transitionSummary` strings, and a top-level `stallPolicy`; policy blocks also compile into model-facing tool guidance so enforced constraints (write globs, outputRoot, plan-first) are stated to the model instead of silently blocking it. The CLI consumes the escalation signal by restarting the marathon on the milestone's next `fallbackModels` entry, and surfaces playbook authoring warnings (e.g. no milestone sets `canAcceptCompletion: true`) at load time. Default (non-playbook) marathon behavior is unchanged.
-- e7a7c22: TypeScript playbooks. Marathon playbooks can now be `.ts`/`.mts` modules, loaded at runtime via jiti (no Node version or transpile-step requirements) from the same search paths as YAML/JSON. Every workflow config behavior slot (instructions, tool guidance, completion criteria, recovery, transition summaries, intercepts, force-end-turn, accept-completion, classify/bootstrap/candidate-block) now accepts a plain function in addition to inline data and hook references, so TypeScript playbooks express custom logic directly without registry ceremony; `definePlaybook(...)` is exported from the SDK as optional type-inference sugar. A module playbook's default export is either a config object or a factory receiving the injected `{ registerWorkflowHook }` API for named-hook registration. Load failures, missing default exports, and non-config exports fail with actionable errors naming the playbook path.
-- e7a7c22: Workflow hook registry and the default marathon workflow as data (Phase 3). The SDK gains a named hook registry (`registerWorkflowHook` with a reserved `builtin:` namespace, slot-kind validation, and actionable load-time errors) and an environment-free `compileWorkflowConfig` that turns declarative workflow configs into `WorkflowDefinition`s, with glob matching injected via deps. The default workflow's behaviors (classification, bootstrap discovery, per-phase instructions/guards/recovery/completion heuristics) are now registered as `builtin:*` hooks and composed by an exported `defaultWorkflowConfig` compiled through the same function — so playbooks and the default share one compile path and a user playbook can reuse or override any slice of the default by hook name. The CLI playbook loader delegates compilation to the SDK and adds: hook references in every behavior slot (`instructions: builtin:research-instructions`, `completionCriteria: { type: acme:my-completion }`), per-milestone `intercept`/`forceEndTurn` slots, and a `plugins:` field that loads JS modules (confined to the playbook's directory) which register custom hooks via an injected `registerWorkflowHook` API. `loadPlaybook` is now async. Compiled output for the default workflow is behavior-identical (pinned by the existing workflow test suite).
-### Patch Changes
-- Updated dependencies [713e743]
-- Updated dependencies [e7a7c22]
-- Updated dependencies [e7a7c22]
-- Updated dependencies [e7a7c22]
-- Updated dependencies [e7a7c22]
-  - @runtypelabs/sdk@4.11.0
-## 2.18.0
-### Minor Changes
-- f07ceb8: Add marathon context-ledger artifact plumbing, derive tool-result context views without mutating saved history, and enable session context recall by default.
-- 7d398a2: Mid-session hard abort for marathon (Esc Esc). The SDK's `runTask` and `executeWithLocalTools` accept an `abortSignal` that cancels the in-flight SSE stream and ends the run gracefully (cost and tokens preserved, state persisted, status `paused`/resumable). In the marathon TUI, pressing Esc twice while the agent works interrupts the turn, restores any queued steering messages and composer draft into the checkpoint input, and lands at a "stopped" checkpoint where Enter exits or new instructions continue the task.
-- 6ecce93: Runtype Apps increment 1, PR 3: agent + developer deploy surfaces. Adds six MCP tools (`create_app`, `deploy_app_version`, `activate_app_version`, `list_apps`, `get_app`, `delete_app`) on both MCP servers (standard + Code Mode `runtype.*` methods), an SDK `client.apps` endpoint (incl. raw-zip `uploadVersion` and JSON `uploadVersionFiles`), a `runtype apps` CLI command family (`create`, `deploy <dir>`, `list`, `versions`, `activate`, `delete`), a JSON `{ files, filesBase64 }` upload variant on `POST /v1/apps/:id/versions` (the API zips server-side for surfaces that cannot stream binary bodies), and the `build-runtype-app` agent skill.
-### Patch Changes
-- 92c6ae3: Marathon context ledger: window-base compaction and persistence fixes.
-  SDK: compaction now records a send-window base (`RunTaskState.contextWindowBaseIndex`). After a compaction, sessions send `[stored summary, messages since base, continuation]` and only re-compact when that window itself re-crosses the threshold — previously every post-threshold session re-summarized the whole task and dropped all recent raw turns from the send. The persist path appends exactly the new continuation message per session, fixing duplicated (and fidelity-degraded) history once replay trimming made the send view shorter than the source. Send-view derivation no longer deep-clones the full history per send, and hot-tail offload skips rewriting files that already exist. Offload reference markers now live in a shared `offload-markers` module with locale-pinned size formatting.
-  CLI: tree-log delta checkpoints no longer re-embed compaction summary text on every save (summary ledger entries are the durable copy; materialization and `/tree` navigation rebuild them from the chain). Repeated offloads of identical output record one artifact entry. `read_offloaded_output` verifies content against the recorded sha256 and warns on mismatch. Tools rebuilt after a `/tools` or sandbox checkpoint change keep their offload wrapping. The unused artifact GC stub (which would have deleted still-readable legacy offload files) was removed.
-- Updated dependencies [ad2dd30]
-- Updated dependencies [90a4707]
-- Updated dependencies [7027149]
-- Updated dependencies [df3a66d]
-- Updated dependencies [f07ceb8]
-- Updated dependencies [7d398a2]
-- Updated dependencies [92c6ae3]
-- Updated dependencies [518018a]
-- Updated dependencies [6ecce93]
-- Updated dependencies [2bb37c4]
-- Updated dependencies [c7bad37]
-- Updated dependencies [4e3999f]
-- Updated dependencies [6e53e7f]
-  - @runtypelabs/sdk@4.10.0
-## 2.17.0
-### Minor Changes
-- e60f98e: Marathon gains `/tree` and `/fork` at checkpoints: browse the session tree (branches recorded in the `<task>.tree.jsonl` log), switch the conversation head to any prior entry, or fork from an earlier user message and steer the new branch. The original timeline is never lost.
-- 96ec88a: Mid-run steering queue for marathon (Pi-style): press Enter while the agent is working to open a composer and queue a steering message. Queued steers end the in-flight session at the next local-tool pause and are delivered at the start of the next session; Tab toggles delivery to "after all work" (follow-up). `runTask` gains additive `getQueuedUserMessages` / `hasQueuedUserMessages` options.
-### Patch Changes
-- 727ce76: Fix headless API-key authentication: the CLI validated `RUNTYPE_API_KEY` (and `auth login --api-key` / `auth status`) against `/auth/me`, which only accepted Clerk sessions, so valid keys always fell through to interactive login. Key validation now probes `/users/profile`, `/auth/me` accepts API keys, and the CLI parses the endpoint's actual camelCase response shape.
-- d14293a: Marathon help panel documents the steering composer shortcuts and the `/tree` and `/fork` checkpoint commands.
-- aebb6c5: Marathon now mirrors every persisted state save into a tree-capable JSONL session log (`<task>.tree.jsonl`) recording the conversation as a parent-linked entry tree. Groundwork for `/fork` and `/tree`; no behavior change yet (the `.json` state file remains the source of truth for resume).
-- Updated dependencies [96ec88a]
-  - @runtypelabs/sdk@4.9.0
-## 2.16.20
-### Patch Changes
-- 849b346: Bump safe dependencies: radix-ui patch updates (react-avatar 1.1.12, react-slot 1.2.5), conf major (15.1.0, CLI tests green), cloud-run example Node 22→26
-## 2.16.19
-### Patch Changes
-- Updated dependencies [15b4a2f]
-- Updated dependencies [698edda]
-  - @runtypelabs/sdk@4.8.1
-## 2.16.18
-### Patch Changes
-- 4756305: Bump @runtypelabs/persona from 3.29.1 to 3.31.0
-## 2.16.17
-### Patch Changes
-- Updated dependencies [982da6c]
-- Updated dependencies [8aeda2c]
-  - @runtypelabs/sdk@4.8.0
-## 2.16.16
-### Patch Changes
-- f3ec545: Bump @runtypelabs/persona to 3.29.1 across consuming workspaces.
-## 2.16.15
-### Patch Changes
-- 9e775c7: Route `persona init` snippet generation through the single source of truth — `generateCodeSnippet` from the pure `@runtypelabs/persona/codegen` subpath — instead of the hand-rolled copy in `persona-snippets.ts`. This retires the last divergent snippet generator: the CLI now emits the same install code the dashboard and MCP `generate_persona_embed_code` tool produce.
-  Behavior changes for `runtype persona init`:
-  - `script-installer` carries the client token (and `--target` selector) in `data-config` and pins the CDN URL to the persona version (matching the dashboard), instead of the old `data-runtype-token` attribute with `@latest`.
-  - `script-manual` now maps to Persona's real CDN global-script setup (previously mis-mapped to the heavier DOM-collecting `script-advanced`), and `esm` maps to the non-React ESM init.
-  - `--target` is threaded through as the generator's mount-target option (added in `@runtypelabs/persona@3.29.0`), so it works across all formats without the CLI's own templating.
-  The pure `/codegen` subpath is bundled into the CLI (tsup `noExternal`), so no browser-SDK runtime (idiomorph/marked) is pulled into a user's install.
-- Updated dependencies [2c12987]
-  - @runtypelabs/sdk@4.7.1
-## 2.16.14
-### Patch Changes
-- Updated dependencies [5d3eada]
-- Updated dependencies [6efd928]
-- Updated dependencies [6730e12]
-  - @runtypelabs/sdk@4.7.0
-## 2.16.13
-### Patch Changes
-- Updated dependencies [cf15960]
-  - @runtypelabs/sdk@4.6.1
-## 2.16.12
-### Patch Changes
-- Updated dependencies [e7eefe0]
-  - @runtypelabs/sdk@4.6.0
-## 2.16.11
-### Patch Changes
-- Updated dependencies [55eb091]
-- Updated dependencies [3f65083]
-  - @runtypelabs/sdk@4.5.0
-## 2.16.10
-### Patch Changes
-- Updated dependencies [59fd1b6]
-  - @runtypelabs/sdk@4.4.0
-## 2.16.9
-### Patch Changes
-- Updated dependencies [e133753]
-- Updated dependencies [26401de]
-  - @runtypelabs/sdk@4.3.0
-## 2.16.8
-### Patch Changes
-- Updated dependencies [52091ac]
-- Updated dependencies [0aa81ed]
-  - @runtypelabs/sdk@4.2.0
-## 2.16.7
-### Patch Changes
-- Updated dependencies [88d04d6]
-- Updated dependencies [2711b97]
-- Updated dependencies [ac87cbe]
-- Updated dependencies [84ab7da]
-  - @runtypelabs/sdk@4.1.0
-## 2.16.6
-### Patch Changes
-- e6efe4f: Bump several low-risk dependencies (combines the safe open Dependabot PRs) and drop one unused dependency:
-  - `yaml` 2.8.3 → 2.9.0 (minor) in `@runtypelabs/api`, `@runtypelabs/cli`, and the workspace root
-  - `@ai-sdk/xai` 3.0.91 → 3.0.93 (patch) in `@runtypelabs/api` and `@runtypelabs/model-execution`
-  - Remove `react-day-picker` from `@runtypelabs/dashboard` entirely — it had no imports anywhere in the codebase, so rather than take the Dependabot v10 major bump we drop the dead dependency
-  Also bumps four GitHub Actions to their latest SHA-pinned releases (CI-only, no package impact): `actions/checkout` 6.0.2 → 6.0.3, `github/codeql-action` 4.36.0 → 4.36.1, `astral-sh/setup-uv` 8.1.0 → 8.2.0, and `changesets/action` 1.8.0 → 1.9.0.
-- Updated dependencies [2e3a776]
-  - @runtypelabs/sdk@4.0.4
-## 2.16.5
-### Patch Changes
-- 31ef33f: FPO validation no longer short-circuits on a Zod schema failure. `validateProductObject` and the four `validate*Only` helpers now run the shared semantic validators on the parsed-where-possible object and merge their findings with the schema errors, so a single `validate_product` call surfaces schema AND semantic issues together. Zod `issue.code` discriminators are preserved (`SCHEMA_<CODE>`) instead of flattening everything to `SCHEMA_ERROR`.
-  The CLI's `runtype validate-product` is brought into parity with the API: its local `runValidation` applies the same schema/semantic merge and the same preserved `SCHEMA_<CODE>` mapping, so the CLI and `POST /v1/public/products/validate` return identical codes and finding sets for the same invalid FPO. Template schema failures (`validateFPOTemplate`) likewise preserve `SCHEMA_<CODE>`.
-  Duplicate-ID detection is collapsed to a single source of truth: it now lives only in the imperative `validateFPO` (so it still runs when the schema parse fails) and was removed from the `fullProductObjectSchema` `.superRefine`.
-- da0df2b: Centralize FPO Zod schema issue mapping and schema-plus-semantic validation merging in the shared product-generation validators so the API, CLI, and template validator preserve `SCHEMA_<CODE>` validation codes consistently.
-- Updated dependencies [8f11ab5]
-- Updated dependencies [edf2b2a]
-  - @runtypelabs/sdk@4.0.3
-## 2.16.4
-### Patch Changes
-- Updated dependencies [d4ca2dd]
-  - @runtypelabs/sdk@4.0.2
-## 2.16.3
-### Patch Changes
-- Updated dependencies [a7cb0d9]
-  - @runtypelabs/sdk@4.0.1
-## 2.16.2
-### Patch Changes
-- 89b107f: feat(sdk): alias Flow/FlowStep/Tool from the OpenAPI spec; fix flow + tool response-schema drift
-  Continues the OpenAPI codegen swap (after #3645/#3665). Three coupled changes that all touch `entities.ts` + the regenerated spec + SDK `types.ts`:
-  - **Flow phantom fix (API spec accuracy):** the flow `GET`/`LIST`/`POST` response schemas advertised a `status` field the handlers stopped returning (removed in #3404), and the shared detail schema carried a `draftVersionId` that only the `PUT` handler returns. Removed `status` everywhere and split a dedicated `UpdatedFlowResponseSchema` (`FlowDetailSchema.extend({ draftVersionId })`) for the update route so `GET`/`POST` no longer promise it.
-  - **Tool schema split:** `GET /v1/tools/{id}` never attaches `validation` (only create/update/convert do, when custom-tool code produces warnings). Split `ToolDetailSchema` (base, GET) from `ToolWithValidationSchema` (create/update/convert).
-  - **SDK aliases:** `Flow`, `FlowStep`, and `Tool` are now `paths[...]`-derived from the generated spec instead of hand-written interfaces. Added a `FlowListItem` alias for the lighter `GET /v1/flows` list item and retyped `flows.list()` to `PaginationResponse<FlowListItem>` (it was incorrectly typed as the detail shape). `FlowListItem` is named to avoid colliding with the flow-execution `FlowSummary` already exported by `flow-builder.ts`.
-  This is a **major** bump for `@runtypelabs/sdk` because the generated shapes are looser/more accurate than the old interfaces: the GET flow detail no longer carries `status`/`description`, flow steps have optional `name`/`order`/`enabled`/`config`, the tool GET shape drops `validation`, and tool `config`/`parametersSchema` are typed as the JSONB records the API actually returns. Dashboard and CLI consumers are updated in lockstep.
-- Updated dependencies [c3536a2]
-- Updated dependencies [8fefe6f]
-- Updated dependencies [a0b30f3]
-- Updated dependencies [aa97266]
-- Updated dependencies [42979fc]
-- Updated dependencies [55d5817]
-- Updated dependencies [89b107f]
-- Updated dependencies [e1a4368]
-- Updated dependencies [af80a8a]
-  - @runtypelabs/sdk@4.0.0
-## 2.16.1
-### Patch Changes
-- 53bfe49: Let dispatch stream callbacks infer their event types from the SDK's `StreamCallbacks` instead of hard-coding narrower param shapes, so they stay compatible with the spec-derived streaming event union.
-- Updated dependencies [53bfe49]
-  - @runtypelabs/sdk@3.0.0
-## 2.16.0
-### Minor Changes
-- 1a29b74: Expand the CLI to cover more of the API: add secrets, tools, logs, conversations, integrations, and surfaces commands; add update (and create/delete) verbs to flows, agents, records, prompts, and schedules; add batch summary/cost inspection and products list/get.
-- 75c7cbd: CLI consistency polish: standardize output and pagination flags, bump Node engine
-  - Unify the `--json` flag description to `Output as JSON` across commands and the
-    root program (semantically distinct variants on `tail`, `agents task`, and
-    `persona init` are intentionally preserved).
-  - Standardize pagination flags on list commands whose API supports cursor
-    pagination: `--limit <n>` + `--cursor <cursor>`, with an actionable
-    "fetch the next page with `--cursor …`" hint when more results exist.
-    - Added to: `flows`, `prompts`, `records`, `agents`, `schedules`,
-      `conversations`, `tools`, `products`.
-    - `--limit` has no forced default — when omitted, the API's own page size
-      applies (avoids silently shrinking existing default result counts).
-    - `conversations`/`tools` previously printed a dead-end "pass ?limit and
-      ?cursor" hint without exposing the flags; they now work.
-  - Add shared `buildListParams` / `printNextCursorHint` helpers in `lib/output.ts`
-    (normalizing the `nextCursor`/`cursor` and `hasMore`/`hasNextPage` response
-    variants) and adopt them in `surfaces` and `logs`, replacing hand-rolled query
-    builders and inline hints (also fixes a `surfaces` hint that rendered a trailing
-    space when no cursor was present).
-  - Bump `engines.node` from `>=18.0.0` to `>=22.0.0` for `@runtypelabs/cli`,
-    `@runtypelabs/sdk`, `@runtypelabs/ink-components`, and
-    `@runtypelabs/terminal-animations`. Node 18 is EOL; 22 is the current LTS. (The
-    repo root requires `>=24`, but these are published/consumer-installed packages,
-    so the floor is held at the current LTS rather than the dev-toolchain version.)
-- 4c5d416: Add `runtype skills` command and a one-time prompt to install Runtype agent skills into detected AI coding agents (Claude Code, Cursor, Codex, OpenCode, Copilot, Gemini CLI, …). Detection and installation are delegated to `rosie-skills`, pulling skills from the public `runtypelabs/skills` mirror. `runtype skills list` shows detected agents; `runtype skills install` installs (with `--agent`, `--yes`, `--json` for non-interactive use). The passive offer fires once per machine on the first interactive, non-CI command run.
-### Patch Changes
-- 64f7081: Fix `flows create` so `--name` and `--description` override values loaded from `--from-file` instead of being silently dropped (consistent with the update commands).
-- 3b357cc: Route all CLI API access through the SDK client instead of a hand-rolled raw HTTP client. Every command now constructs a configured `@runtypelabs/sdk` client via `createCliClient`, using typed endpoint methods (e.g. `client.flows.list()`) where available and the SDK's generic methods elsewhere. This makes the SDK the CLI's single source of truth for the API surface, so the CLI stops drifting behind the API, and a new `runtype/cli-use-sdk` lint rule prevents reintroducing a parallel raw client. The CLI client disables request timeouts by default for long-running executions via the SDK's new `timeout: null` support. Also fixes two latent bugs surfaced during the migration: `flows run --no-stream` now correctly requests a non-streamed response (`options.streamResponse`), and `flows get` displays the step count from the actual `flowSteps`/`stepCount` response fields.
-- 91df87d: Fix marathon stream session/cost/token totals for single-turn agents now that agent_iteration_complete is no longer emitted — derive sessionCount and final totals from agent_complete.
-- 422b660: Route CLI delete-by-id resource commands through the SDK's typed endpoint methods (`client.<resource>.delete(id)`) instead of generic string-path calls, gaining compile-time API-contract checking. Covers agents, api-keys, client-tokens, conversations, prompts, records, schedules, secrets, and tools. List, get, create, update, and streaming calls intentionally remain on the SDK's sanctioned generic methods, since their call sites consume CLI-local summary interfaces that diverge structurally from the SDK entity types (migrating them would require disallowed casts).
-- Updated dependencies [75c7cbd]
-- Updated dependencies [3b357cc]
-- Updated dependencies [f676234]
-  - @runtypelabs/sdk@2.2.0
-  - @runtypelabs/ink-components@0.3.2
-  - @runtypelabs/terminal-animations@0.2.1
-## 2.15.6
-### Patch Changes
-- Updated dependencies [3b6779b]
-  - @runtypelabs/sdk@2.1.1
-## 2.15.5
-### Patch Changes
-- Updated dependencies [7d37b2f]
-  - @runtypelabs/sdk@2.1.0
-## 2.15.4
-### Patch Changes
-- Updated dependencies [89dc476]
-  - @runtypelabs/sdk@2.0.1
-## 2.15.3
-### Patch Changes
-- 1da2af7: Fix MCP OAuth2 dynamic client registration for servers that return non-standard field types (e.g. PlanetScale returning `client_secret_expires_at` as a non-number)
-- dc704fb: Remove the unused `status` lifecycle field from Flows and Agents (Option A from the status-field planning doc). The field gated nothing at runtime — dispatch always ran the live config row — and conflated lifecycle and draft/publish concerns. Dropped the `flows.status` and `agents.status` columns (and their now-redundant indexes), removed `status` from the REST list/create/update routes, the SDK `Flow` type, the MCP create/update agent + flow tools and list filters, the FPO agent schema, and the dashboard status pill/selectors.
-  Breaking: API responses for flows/agents no longer include `status`; the create/update endpoints and MCP tools no longer accept it; `Flow.status` is removed from `@runtypelabs/sdk`. Surface status, product status, and execution/run status are unaffected. Draft vs. published is now owned entirely by the versioning system.
-- Updated dependencies [fed76a8]
-- Updated dependencies [102e70b]
-- Updated dependencies [cd6d918]
-- Updated dependencies [dc704fb]
-- Updated dependencies [95df762]
-  - @runtypelabs/sdk@2.0.0
-## 2.15.2
-### Patch Changes
-- Updated dependencies [bade11f]
-- Updated dependencies [6fbe4ed]
-  - @runtypelabs/sdk@1.24.2
-## 2.15.1
-### Patch Changes
-- Updated dependencies [d659976]
-- Updated dependencies [0442e36]
-  - @runtypelabs/sdk@1.24.1
-## 2.15.0
-### Minor Changes
-- d4bffd9: Add `--target cloudflare` and `--target vercel` to `runtype deploy`, and fix `applyParameterMapping` target-key collision in the api
-  **CLI (`@runtypelabs/cli`)**
-  `runtype deploy` now accepts `--target <cloud-run|cloudflare|vercel>` (default: `cloud-run`).
-  - `--target cloudflare` scaffolds a Cloudflare Workers project: raw `fetch` handler with `CloudflareAdapter`, one static JSON import per agent slug (required because Workers has no `fs` access — Wrangler bundles them at deploy time), `wrangler.toml`, `setup.sh` (pnpm pack + `file:` rewrite pattern), and a `README.md` with `wrangler secret put` instructions.
-  - `--target vercel` scaffolds a Vercel Functions project: Hono + `hono/vercel` catch-all route with `VercelAdapter`, static JSON imports, `vercel.json` (60 s maxDuration), `setup.sh`, and a `README.md` with `vercel env add` instructions.
-  - `--target cloud-run` (default) is unchanged.
-  - Unknown `--target` values exit with an actionable error.
-  **API (`@runtypelabs/api`)**
-  Fixed a target-key collision bug in both copies of `applyParameterMapping`:
-  - `apps/api/src/services/tool-executor.ts` (private method)
-  - `apps/api/src/lib/flow-execution/engine.ts` (public method)
-  With `parameterMapping = { foo: 'bar' }` and the model supplying `{ foo: 'A', bar: 'B' }`, the passthrough loop's `!(key in parameterMapping)` check only tested source keys, so the raw `bar: 'B'` overwrote the renamed `bar: 'A'`. Fix: pre-compute a `Set` of cleaned target key names and skip passthrough for keys in that set so the rename always wins. Regression test added to `apps/api/tests/parameter-mapping.test.ts`.
-### Patch Changes
-- Updated dependencies [761dd74]
-  - @runtypelabs/sdk@1.24.0
-## 2.14.0
-### Minor Changes
-- ed8ad80: Add versioning to agents (mirrors flow versioning). New `agent_versions` table, `published_version_id` / `draft_version_id` pointers on agents, audit pointer on `agent_executions`. New `/v1/agent-versions` API, `list_agent_versions` / `get_agent_version` / `get_published_agent_version` / `publish_agent_version` MCP tools, `runtype agent-versions` CLI subcommands, and an Agent Versions dashboard sheet for browsing/restoring history. Flow and agent versioning now share a generic `version-service-factory` with retry-on-conflict, and version snapshot creation is best-effort so a snapshot failure cannot fail the underlying agent save.
-## 2.13.0
-### Minor Changes
-- a97d521: Add `runtype deploy` CLI command: exports an agent or flow via the `/export-runtime` API and scaffolds a ready-to-deploy Cloud Run project directory with `server.ts`, `Dockerfile`, `tsconfig.json`, `package.json`, `setup.sh`, and `README.md`. The runtime package is wired as a `file:` tarball (private distribution model preserved).
-### Patch Changes
-- Updated dependencies [96b2f28]
-- Updated dependencies [5b7e3fe]
-  - @runtypelabs/sdk@1.23.0
-## 2.12.8
-### Patch Changes
-- Updated dependencies [de7f600]
-  - @runtypelabs/sdk@1.22.0
-## 2.12.7
-### Patch Changes
-- 7542451: Address `/review` findings on the schedules pagination work:
-  - Internal MCP client (`apps/api/src/lib/mcp-internal-client.ts`) now forwards `search` and `status` to `GET /v1/schedules`. Previously the public `RuntypeApiClient` and the Code-Mode executor forwarded these new filter params, but the internal client (used by the API's own `/api/mcp` endpoint) silently dropped them — so `list_schedules({ search, status })` returned unfiltered results.
-  - CLI `runtype schedules list` (non-TTY / `--json` path) now prints a yellow warning when `pagination.hasMore` is true, telling the user they're seeing only the first N results. Matches the existing API `Warning: 199` header signal so users with >50 schedules know to paginate instead of silently losing rows.
-  - Code-Mode MCP spec example for `listSchedules` now destructures `const { data: schedules } = ...` (was `const { schedules }`, which was always `undefined` — the API returns `{ data, pagination }`). The `returns:` description was also updated to match. Other `list*` examples in `spec.ts` have the same pre-existing key mismatch and are out of scope here.
-## 2.12.6
-### Patch Changes
-- Updated dependencies [569e7d5]
-  - @runtypelabs/sdk@1.21.3
-## 2.12.5
-### Patch Changes
-- 2a11be5: Enforce strict TypeScript checking across all projects in CI
-- Updated dependencies [b3a580e]
-  - @runtypelabs/sdk@1.21.2
-## 2.12.4
-### Patch Changes
-- d05fa77: Add a `name` column to schedules, snapshotted server-side from the target flow or agent at create time and re-snapshotted whenever the target changes. The dashboard table and detail sheet now read `s.name` directly instead of looking up the target name on every render. Existing rows are backfilled in the migration. The column is server-managed — clients cannot override it via REST or MCP. The snapshot helper (`snapshotScheduleTargetName`) is ownership-scoped via `ownershipFilter`, so a target flow/agent the caller does not own resolves to a generic 404 — closing both a cross-org name-disclosure leak and a flow-existence enumeration oracle on `PUT /v1/schedules/:id`. All three insert sites for `flow_schedules` (the public schedules route, the product-surfaces schedules route, and the FPO product assembly path) now share the helper and persist a populated `name`. The `create_schedule` and `update_schedule` MCP tool descriptions document the snapshot behavior. The CLI `schedules create` subcommand was already broken (wrong payload shape and a `--name` flag the API never honored); fixed to emit the correct `target` / `trigger` envelope and dropped the dead `--name` flag in favor of a now-required `--timezone`.
-- Updated dependencies [c5e0c1d]
-  - @runtypelabs/sdk@1.21.1
-## 2.12.3
-### Patch Changes
-- a8f5949: Remove dotenv dependency from CLI (inline minimal .env loader) and move to devDependencies in api
-## 2.12.2
-### Patch Changes
-- Updated dependencies [5190fd0]
-  - @runtypelabs/sdk@1.21.0
-## 2.12.1
-### Patch Changes
-- Updated dependencies [f777029]
-  - @runtypelabs/sdk@1.20.0
-## 2.12.0
-### Minor Changes
-- f519af1: Rename 'cloudflare-sandbox' to 'runtype-sandbox' across all customer-facing and internal interfaces. Old value accepted for backwards compatibility.
-## 2.11.8
-### Patch Changes
-- 54dee3e: Build `@runtypelabs/shared` with tsup as dual ESM+CJS and declare `"sideEffects": false`. The React-importing `use-flow-execution-streaming` hook is moved out of the main barrel into its own subpath export (`@runtypelabs/shared/hooks/use-flow-execution-streaming`), so Next.js Server Component bundles no longer transitively load React. The CLI switches from deep `dist/*` imports to barrel imports; the runtype-ai worker switches from `src/*` deep import to barrel import.
-## 2.11.7
-### Patch Changes
-- db40ddb: Support OAuth 2.1 client ID metadata document flow for MCP server connections
-  When an MCP server's OAuth authorization server advertises `client_id_metadata_document_supported: true`, the API now uses a hosted client metadata document URL as the `client_id` instead of attempting Dynamic Client Registration (DCR). This fixes 403 errors when connecting to servers like Airtable that block server-to-server DCR from Cloudflare Worker IPs. The mock API also gains MCP OAuth2 test endpoints for validating both flows.
-- Updated dependencies [7712f0d]
-  - @runtypelabs/sdk@1.19.1
-## 2.11.6
-### Patch Changes
-- Updated dependencies [e6d59df]
-  - @runtypelabs/sdk@1.19.0
-## 2.11.5
-### Patch Changes
-- 0bed197: Expose GPT Image 2 as a built-in image generation tool and route legacy DALL-E tool usage through GPT Image 2 with token-based pricing.
-## 2.11.4
-### Patch Changes
-- Updated dependencies [778a8be]
-  - @runtypelabs/sdk@1.18.1
-## 2.11.3
-### Patch Changes
-- Updated dependencies [e886078]
-- Updated dependencies [e6fcbe6]
-- Updated dependencies [94261ac]
-- Updated dependencies [91db7b9]
-- Updated dependencies [7070cfb]
-  - @runtypelabs/sdk@1.18.0
-## 2.11.2
-### Patch Changes
-- 92cd427: Bump @vercel/analytics to v2.0.1; remove unused uuid dependency from CLI
-## 2.11.1
-### Patch Changes
-- Updated dependencies [28f126c]
-  - @runtypelabs/sdk@1.17.1
-## 2.11.0
-### Minor Changes
-- ed60fc9: Add GCP-style `?account=<clerk_id>` deep-link support to the dashboard. The parameter auto-switches the active Clerk organization (`org_...`) or personal account (`user_...`) on page load, with membership validation and a signed-in-as-wrong-user recovery screen. MCP tools, CLI output, API OAuth callbacks, and billing notification emails now include `account=` in dashboard URLs when the authenticated context is known, so recipients land in the right account regardless of which one is currently active in their browser.
-### Patch Changes
-- Updated dependencies [060278a]
-  - @runtypelabs/sdk@1.17.0
-## 2.10.9
-### Patch Changes
-- Updated dependencies [23b42c8]
-  - @runtypelabs/sdk@1.16.0
-## 2.10.8
-### Patch Changes
-- ce93ba6: Fix CLI vitest failing on cold checkout by aliasing `@runtypelabs/shared/dist` to the shared package source. Tests no longer require shared to be pre-built.
-- 60dbf93: Improve `deploy_sandbox` on the Cloudflare Sandbox provider: auto-create parent directories when writing nested `files` entries, reject reserved port 3000 up front with a clear message, default to port 8080, and return a `stage` field plus captured stdout/stderr in `output` on failure for easier debugging.
-- Updated dependencies [60dbf93]
-  - @runtypelabs/sdk@1.15.3
-## 2.10.7
-### Patch Changes
-- 5e438d2: Bump Marathon TUI tool preview truncation from 48 to 96 chars so preview URLs (e.g. sandbox `runtype.run` links) render more usefully in tool output.
-## 2.10.6
-### Patch Changes
-- Updated dependencies [64dfdb5]
-  - @runtypelabs/sdk@1.15.2
-## 2.10.5
-### Patch Changes
-- 4271b9a: Replace stale `meta/llama3.1-8b-instruct-free` defaults across dashboard onboarding, magic buttons, schedule/cron assistants, marketing demo flow + allowlist, usage-stats mock data, smoke-test templates, and integration tests.
-  Runtime code (dashboard, marketing, usage-stats, CLI README) imports `DEFAULT_MODEL_ID` from `@runtypelabs/shared` (currently `qwen/qwen3.5-9b`) so it tracks whatever model is marked as the new-account default. Tests, smoke-test JSON templates, bruno fixtures, and eval configs pin to `google/gemma-4-26b-a4b-it` so test behavior doesn't silently shift when the default rotates.
-  The deprecated model stays in the catalog so existing saved configs still resolve — this is pure noise cleanup so newly-created surfaces no longer suggest a deprecated model.
-- 4dd8b2d: Fix `Dynamic require of "react" is not supported` at CLI startup by importing `DEFAULT_MODEL_ID` from the `@runtypelabs/shared/dist/default-models` subpath instead of the barrel. The shared barrel re-exports a React hook; bundling it into the CLI's ESM output left `require('react')` in the dist and broke every command (including `marathon`) since the import runs at startup. Adds an ESLint `no-restricted-imports` rule and a `node dist/index.js --version` CI smoke test to prevent regressions.
-## 2.10.4
-### Patch Changes
-- 43806a4: Migrate FALLBACK_MODEL and all default-model literals from `meta/llama3.1-8b-instruct-free` to `DEFAULT_MODEL_ID` (currently `qwen/qwen3.5-9b`). Updates DB schema defaults (new prompts get the modern default; drizzle migration `0019_parched_cyclops.sql` updates the `ALTER COLUMN ... SET DEFAULT`). The old model remains in `DEPRECATED_MODELS` so existing references continue to resolve.
-## 2.10.3
-### Patch Changes
-- Updated dependencies [ca82595]
-  - @runtypelabs/sdk@1.15.1
-## 2.10.2
-### Patch Changes
-- 16f49e2: Re-publish `@runtypelabs/cli` to npm. Previous Version Packages merges (#2217 / #2219 / #2223 / #2236 / #2247) skipped the publish step due to a stuck ignored-only changeset in `.changeset/`, so versions 2.9.0 / 2.9.1 / 2.10.0 were tagged in the repo but never pushed to npm. This changeset forces a new Version Packages PR that, when merged, drains the queue.
-## 2.10.1
-### Patch Changes
-- 2e144ac: Include `cloudflare-sandbox` in the `runtype marathon --sandbox` invalid-value error message so the hint matches the providers actually accepted by `parseSandboxProvider`.
-## 2.10.0
-### Minor Changes
-- 2820927: Replace the `cloudflare-shell` sandbox provider with `cloudflare-sandbox`, backed by `@cloudflare/sandbox`.
-  - `sandboxProvider` on transform-data steps and custom runtime tools accepts `'cloudflare-sandbox'` instead of `'cloudflare-shell'`.
-  - New `CloudflareSandboxDO` container-backed Durable Object replaces `ShellSandboxDO`. Each sandbox is a full Linux computer (Node 22, Python 3.12, pnpm, tsx, uv, git) with snapshot-backed persistence, preview URLs, and Active-CPU pricing.
-  - New routes: `POST /tools/sandbox/cf-sandbox/deploy` and `DELETE /tools/sandbox/cf-sandbox/:sandboxId`. The old `cf-shell` routes are removed.
-  - SDK: `deployCfShell` / `cleanupCfShell` renamed to `deployCfSandbox` / `cleanupCfSandbox`. `DeployCfShellRequest` / `DeployCfShellResponse` renamed to `DeployCfSandboxRequest` / `DeployCfSandboxResponse`.
-  - CLI: `createDeployCfShellLocalTool` / `cleanupCfShellWorkers` renamed to `createDeployCfSandboxLocalTool` / `cleanupCfSandboxes`. Python is now a supported language for Cloudflare Sandbox.
-  - Infrastructure: wrangler migration `v7` drops `ShellSandboxDO` and adds `CloudflareSandboxDO`. `SHELL_STORAGE` R2 binding renamed to `SANDBOX_STORAGE`. Requires Workers Paid + Containers add-on on the Cloudflare account.
-  Breaking change: any caller passing `sandboxProvider: 'cloudflare-shell'` must switch to `'cloudflare-sandbox'`. There was no production usage of the old provider, so the impact is limited to internal testing.
-### Patch Changes
-- Updated dependencies [2820927]
-  - @runtypelabs/sdk@1.15.0
-## 2.9.1
-### Patch Changes
-- 3ab8900: Auto-validate every FPO and FPO template under `docs/templates/` as part of the CLI test suite. The new `packages/cli/test/integration/published-templates.test.ts` discovers all `*.json` files recursively, skips `flows/**` (flow exports are a different artifact type) and `_`-prefixed files (drafts), and asserts each one validates cleanly via the same `detectKind` + `runValidation` functions `runtype validate-product` uses. Moved `autonomous-research-content-pipeline.json` into `docs/templates/flows/` so the FPO glob is unambiguous. See `docs/templates/README.md` for the directory conventions.
-## 2.9.0
-### Minor Changes
-- 50eb108: Add `runtype validate-product` command that validates FPOs (Full Product Objects) and FPO templates locally using the shared validators. Accepts a file path, raw JSON, or stdin; auto-detects FPO vs template; supports `--json`, `--quiet`, `--fpo`, and `--template` flags. Surfaces template default-resolution errors (e.g. required variables without defaults). Exits 0 when valid, 1 on errors or IO failure.
-## 2.8.5
-### Patch Changes
-- Updated dependencies [799f8db]
-  - @runtypelabs/sdk@1.14.1
-## 2.8.4
-### Patch Changes
-- Updated dependencies [040c7e8]
-  - @runtypelabs/sdk@1.14.0
-## 2.8.3
-### Patch Changes
-- ca1921e: fix: show error state for failed marathon sessions in TUI
-  - Display error message in Overview tab when viewing a session that ended with an error (e.g., context_length_exceeded)
-  - Show error indicator on session tabs: "Run N ✗" for errors, "Run N $" for budget exceeded
-  - Thread error messages through session snapshots so they persist and display on resume
-  - Fix live session snapshot to recognize error phase instead of showing blank screen
-## 2.8.2
-### Patch Changes
-- 24626bc: fix: show error state for failed marathon sessions in TUI
-  - Display error message in Overview tab when viewing a session that ended with an error (e.g., context_length_exceeded)
-  - Show error indicator on session tabs: "Run N ✗" for errors, "Run N $" for budget exceeded
-  - Thread error messages through session snapshots so they persist and display on resume
-  - Fix live session snapshot to recognize error phase instead of showing blank screen
-## 2.8.1
-### Patch Changes
-- e10c4d4: Add marathon `/copy-trimmed` and session menu option to copy the same session JSON with large code and tool payloads trimmed for LLM context limits.
-  Publish a marketing changelog entry for the feature.
-- Updated dependencies [e10c4d4]
-  - @runtypelabs/sdk@1.13.3
-## 2.8.0
-### Minor Changes
-- 99e67a2: Add `runtype auth export-key` command that prints the stored API key to stdout
-  Enables scripts and setup tools to programmatically retrieve the authenticated API key without creating new keys. Follows the same pattern as `gh auth token` and `gcloud auth print-access-token`.
-### Patch Changes
-- 36483b1: Fix flaky tail command tests that timed out due to real retry back-off delays
-- Updated dependencies [7f727ab]
-- Updated dependencies [19b9c08]
-  - @runtypelabs/sdk@1.13.2
-## 2.7.1
-### Patch Changes
-- d73361a: Disable source maps in published packages to reduce npm package size
-- Updated dependencies [d73361a]
-  - @runtypelabs/sdk@1.13.1
-  - @runtypelabs/ink-components@0.3.1
-## 2.7.0
-### Minor Changes
-- 9936443: feat: add live tail log streaming with type-safe event emission
-  Adds real-time log streaming across API, CLI, and dashboard using Cloudflare's Tail Worker infrastructure with per-org tenant isolation via TailFanoutDO.
-  - Type-safe `LogData` discriminated union: `{ tail: true }` requires `audience` and `category` at compile time
-  - Logger `child()` immutable pattern for safe async context propagation
-  - TailFanoutDO with hibernatable WebSockets, connection limits, and `tail_gap` backpressure
-  - Thin tail worker relay with dual-heuristic loop suppression
-  - CLI `runtype tail` command with SSE streaming, reconnect, and formatted output
-  - Dashboard `TailLogPanel` integrated into surface, capability, and conversations panels
-## 2.6.2
-### Patch Changes
-- e88481e: chore: prefer Gemini 3.1 Flash-Lite and Flash Image in defaults and examples
-  Use routed `gemini-3-1-flash-lite` and `gemini-3-1-flash-image` instead of `gemini-3-flash` and `gemini-3-pro-image` for new-account defaults, lightweight picks, provider routing metadata, product templates, marketing MDX examples, and the CLI talk model picker.
-## 2.6.1
-### Patch Changes
-- 2de3530: Fix two hangs in `persona init`: clipboard copy now uses execFileSync (promisified execFile silently ignores `input`), and quitting via 'q'/Escape now pauses stdin so the process exits cleanly
-- 2de3530: Fix persona init: default agent name to "Persona Test", fix interactive key menu exiting immediately, and create agents with model (qwen3.5-35b-a3b), system prompt, and description
-- Updated dependencies [2de3530]
-  - @runtypelabs/sdk@1.13.0
-## 2.6.0
-### Minor Changes
-- ee55324: Add `runtype persona init` to create an agent, a scoped client token, and a Persona embed snippet in one command (`--json` and non-interactive flags supported).
-## 2.5.0
-### Minor Changes
-- 62c2f83: Add Cloudflare Shell as a new sandbox provider for Marathon CLI
-  Introduces `cloudflare-shell` as an alternative to Daytona for agent code execution in Marathon. Uses `@cloudflare/worker-bundler` for runtime TypeScript compilation and npm dependency resolution, and `@cloudflare/shell` for virtual filesystem persistence backed by SQLite + R2.
-  Key features:
-  - JavaScript and TypeScript execution with npm dependencies
-  - Virtual filesystem persistence via `@cloudflare/shell` Workspace
-  - Deploy-with-preview via persistent Dynamic Workers
-  - No API key required (uses existing Cloudflare Workers infrastructure)
-  - ~1-5ms startup vs ~100-500ms for Daytona
-  Usage: `runtype task "your task" --sandbox cloudflare-shell`
-### Patch Changes
-- Updated dependencies [62c2f83]
-  - @runtypelabs/sdk@1.12.0
-## 2.4.0
-### Minor Changes
-- 4b0a612: Add client token management and Persona embed code generation across CLI and MCP server. CLI gets `client-tokens` command group (list, get, create, delete, regenerate). MCP server gets matching tools plus `generate_persona_embed_code` which uses Persona's `generateCodeSnippet` directly to produce script-installer and React component embed code. Both CLI and MCP default `allowedOrigins` to `["*"]` when not provided, matching the dashboard onboarding behavior.
-## 2.3.0
-### Minor Changes
-- cc9ff7a: Add Orthogonal-backed platform tools with hierarchical `platform:orthogonal:company:tool` ID format, catalog generation, managed execution, and spend tracking via DO + Analytics Engine.
-### Patch Changes
-- Updated dependencies [cc9ff7a]
-  - @runtypelabs/sdk@1.11.0
-## 2.2.1
-### Patch Changes
-- a6cf1cd: Fix environment variable exfiltration via npm script injection in run_check tool
-  - Sanitize subprocess environment to whitelist-only safe variables (PATH, HOME, etc.)
-  - Add output secret redaction as defense-in-depth against leaked values
-  - Block npm/pnpm script commands when package.json has uncommitted modifications
-- 9e3fee1: Fix marathon session reliability: resolve completion deadlocks (verification auto-waive, premature TASK_COMPLETE), fix write loops and stall detection, retain accumulated cost across checkpoint restarts, retry server-side network errors in session loop, and add 'o' key to open files from Files tab or open agent in dashboard
-- Updated dependencies [9e3fee1]
-  - @runtypelabs/sdk@1.10.2
-## 2.2.0
-### Minor Changes
-- 0327529: Add session context search for marathon CLI (RLM-inspired)
-  Introduces semantic search over marathon session history using a platform-owned Cloudflare Vectorize index. When marathon sessions complete, content is automatically chunked and indexed. Agents can use the new `search_session_history` tool to recall information from earlier sessions that may have been compacted away.
-  - API: New `/v1/session-context/index`, `/v1/session-context/search`, and `DELETE /v1/session-context` endpoints
-  - API: New `SessionContextService` using platform Vectorize credentials with tenant namespace isolation
-  - CLI: New `search_session_history` local tool registered by default in marathon tasks
-  - CLI: Session content auto-indexed after each session via `onSession` callback
-  - CLI: New `--no-session-search` flag to disable the feature
-  - Cost tracking via `session-context:embedding` in service cost registry
-### Patch Changes
-- ce76184: Add user-friendly error messages when marathon fails due to network issues, distinguishing between local network being offline, server being unreachable, and request timeouts
-- Updated dependencies [ce76184]
-  - @runtypelabs/sdk@1.10.1
-## 2.1.0
-### Minor Changes
-- 190adf8: Add agent fallback-model and playbook policy support across the API, CLI, and SDK.
-  Improve marathon task execution with safer verification handling, creation-task output constraints, and better recovery when verification is repeatedly blocked.
-### Patch Changes
-- Updated dependencies [190adf8]
-  - @runtypelabs/sdk@1.10.0
-## 2.0.2
-### Patch Changes
-- bd08d42: Wire streamed tool input through the API, SDK, and Marathon CLI, keep local tools active through client-side execution, and enable Anthropic eager input streaming behind a feature flag.
-- 73d6d60: Fix marathon session complete banner to show accumulated totals from all sessions instead of only the last session's tool calls
-- bd08d42: Improve marathon CLI scrolling performance by caching rendered detail content between scroll updates.
-- Updated dependencies [bd08d42]
-  - @runtypelabs/sdk@1.9.2
-## 2.0.1
-### Patch Changes
-- 8494865: Wire streamed tool input through the API, SDK, and Marathon CLI, keep local tools active through client-side execution, and enable Anthropic eager input streaming behind a feature flag.
-- f49d2d6: Improve Marathon build-and-serve workflow routing for prompts that ask the agent to create a runnable web app, serve it, and verify routes.
-- 8494865: Improve marathon CLI scrolling performance by caching rendered detail content between scroll updates.
-- Updated dependencies [8494865]
-- Updated dependencies [f49d2d6]
-  - @runtypelabs/sdk@1.9.1
-## 2.0.0
-### Major Changes
-- b6d2ceb: feat(cli): custom playbooks, visual milestone progress, and steering→checkpoint rename
-  - Rename "steering" to "checkpoint" throughout marathon TUI and CLI flags (`--no-steer` → `--no-checkpoint`, `--steer-timeout` → `--checkpoint-timeout`)
-  - Add milestone progress bar in SessionHeader showing `✓ research ── ● planning ── ○ execution` with live updates as the agent progresses through workflow phases
-  - Add `--playbook <name>` flag to load custom YAML playbook files from `.runtype/marathons/playbooks/` (repo-level or user-level), defining milestones, per-milestone model overrides, verification settings, and rules in a single file
-  - Remove recipe system (`--recipe` flag and `.marathon/recipes/`) — playbooks replace it entirely
-  - Add `yaml` dependency for playbook parsing
-  - Update CLI README with playbook documentation, YAML schema example, and marathon anatomy diagram
-### Patch Changes
-- b6d2ceb: feat(marathon): add ghost vector startup backgrounds
-  - add viewport-aware `vector3d-ghost-wave` and `vector3d-ghost-box-drift` variants to `@runtypelabs/terminal-animations`
-  - extend `AnimatedVariant` with optional `width` and `height` props so background variants can fill the active terminal viewport without wrapping
-  - render a randomly selected ghost vector scene behind the marathon startup splash, resume prompt, model picker, and playbook model confirmation screen
-- Updated dependencies [152019b]
-- Updated dependencies [b6d2ceb]
-- Updated dependencies [b6d2ceb]
-  - @runtypelabs/sdk@1.9.0
-  - @runtypelabs/terminal-animations@0.2.0
-## 1.9.4
-### Patch Changes
-- b65465e: Replace `uuid` package with native `crypto.randomUUID()` for session ID generation
-## 1.9.3
-### Patch Changes
-- c7229a9: Standardize marathon sidecar event logs on one-based session numbering so resumed runs load Events correctly from `session-1.jsonl`, `session-2.jsonl`, and so on.
-- c7229a9: Tighten marathon local tool filesystem access so agents cannot read or write outside the workspace root or inside restricted internal state directories, and switch hot-tail offload retrieval to opaque ids via `read_offloaded_output`.
-- Updated dependencies [c7229a9]
-- Updated dependencies [c7229a9]
-  - @runtypelabs/sdk@1.8.2
-## 1.9.2
-### Patch Changes
-- b31908e: Fix typo in CLI README: "store in wthin" → "store it within"
-## 1.9.1
-### Patch Changes
-- 4ec90b5: Fix `--compact-threshold` parsing to remove ambiguous bare-ratio format. The flag now accepts only two formats: percent (e.g. `--compact-threshold 80%`) and absolute token count (e.g. `--compact-threshold 120000`). Bare decimal values like `0.8` are no longer interpreted as ratios. Also ensure provider-native compaction lifecycle cleanup fires even when session execution throws, preventing a stuck compaction indicator in the TUI.
-- 4ec90b5: Add provider-aware marathon context management with model-budget-aware compaction thresholds, compaction lifecycle telemetry, structured compact summaries, CLI controls for compaction strategy and instructions, and tool-output guardrails that surface or offload oversized local tool results.
-- Updated dependencies [4ec90b5]
-- Updated dependencies [4ec90b5]
-  - @runtypelabs/sdk@1.8.1
-## 1.9.0
-### Minor Changes
-- cb1b95d: Files tab: render markdown for .md files and show copy hint
-  Markdown files (.md/.mdx) in the marathon Files tab detail view now render with terminal-styled formatting (headings, code blocks, bold, links, etc.) instead of raw text. The detail header also now displays a "c: copy" hint matching the Events and Tools panels. Added ANSI-aware line wrapping to keep scroll math correct with styled content.
-### Patch Changes
-- 5d64851: Add automatic retry with exponential backoff for transient network errors during marathon execution. When a network connection drops mid-marathon, the CLI now retries up to 3 times (5s, 10s, 20s backoff) before falling back to saving state and exiting. Previously, any network interruption would immediately terminate the marathon.
-- 097e1fd: Add Marathon execution attribution end-to-end. Marathon CLI requests now send standard CLI headers plus `X-Runtype-Client-Origin`, the API propagates `clientOrigin` through flow and agent execution context into usage analytics and execution telemetry, and usage-stats can filter and visualize Marathon-origin traffic separately from existing execution `source` values.
-- Updated dependencies [cb1b95d]
-  - @runtypelabs/ink-components@0.3.0
-## 1.8.5
-### Patch Changes
-- 45e99f3: perf: defer telemetry redaction to async flush path; fix secret-detection test values and CLI update-check test
-- 105c8f6: Fix update-check test failing in CI by clearing the CI environment variable in test setup
-## 1.8.4
-### Patch Changes
-- 16c0ef0: Add CLI upgrade notifications and API minimum CLI version enforcement.
-- 16c0ef0: Add a cinematic fullscreen startup splash for marathon mode with centered resume prompts and a fade handoff into the Ink UI.
-- 16c0ef0: Fix Daytona sandbox deployments to reuse existing sandboxes and persist beyond CLI exit
-  - Uses `daytona.get(sandboxId)` to reconnect to existing sandboxes when the in-memory cache misses (stateless Cloudflare Workers)
-  - Sets auto-stop interval to 120 minutes so deploy sandboxes stay alive after CLI exits
-  - Stops deleting sandboxes on marathon exit — users can revisit preview URLs or reconnect via --resume
-  - Kills existing server process on port before redeployment to avoid conflicts
-  - Fixes cleanup method to reconnect to sandboxes for proper deletion
-- 16c0ef0: Fix Marathon tools-screen crashes when opening a tool detail view.
-- 16c0ef0: Restore the steering prompt when resuming a paused marathon without new instructions, warn clearly when a resumed state has no saved `messages` history, derive resume recap token totals from saved session summaries when aggregate totals are missing, label steering recap token usage explicitly as input/output, stage steering command changes until explicit submit, keep steer-time review navigation available for scrolling and tab/event browsing, pause the steering countdown when the user starts reviewing prior output, align marathon text-area delete shortcuts with terminal editor expectations, simplify marathon progress chrome so tabs and the runner track do not duplicate run numbering, and remove decorative runner animation fields from persisted marathon state.
-## 1.8.3
-### Patch Changes
-- b6f8291: docs: add documentation for --tools flag in CLI README
-- 6db3feb: Fix marathon runner emoji orientation to face right on the top row and left on the bottom row
-- 951e5fc: Fix marathon track growing 1 row taller when runner emoji reaches the border
-## 1.8.2
-### Patch Changes
-- 3f9eb94: Import from specific @runtypelabs/shared subpaths instead of barrel export to avoid bundling React hooks, fixing "Dynamic require of react is not supported" error at runtime.
-## 1.8.1
-### Patch Changes
-- cbe7dbd: Bundle @runtypelabs/shared into CLI dist instead of treating it as an external npm dependency. Fixes installation failure caused by npm trying to resolve the private shared package from the registry.
-## 1.8.0
-### Minor Changes
-- 564d33c: Add --tools flag to marathon command for enabling built-in tools (exa, firecrawl, dalle, web search, etc.) during agent runs
-### Patch Changes
-- 5f683ed: Disable talk command from available CLI commands
-- Updated dependencies [564d33c]
-  - @runtypelabs/sdk@1.8.0
-## 1.7.0
-### Minor Changes
-- 7f95a76: Improved model selector UI with searchable model list, arrow key navigation, and all available platform models
-## 1.6.0
-### Minor Changes
-- 6ecb8a5: Improved model selector UI with searchable model list, arrow key navigation, and all available platform models
-## 1.5.4
-### Patch Changes
-- 6292d58: Ring the terminal bell when marathon steering prompt appears, notifying users that the marathon is waiting for input after each iteration
-## 1.5.3
-### Patch Changes
-- f9b1333: Switch SDK build from tsc (CommonJS) to tsup (dual ESM + CJS) to fix named export errors when consumed by ESM packages like the CLI on Node.js v24+
-- Updated dependencies [f9b1333]
-  - @runtypelabs/sdk@1.7.3
-## 1.5.2
-### Patch Changes
-- 1b18b6d: Publish @runtypelabs/terminal-animations to npm (previously private, causing install failures for CLI users)
-- Updated dependencies [1b18b6d]
-  - @runtypelabs/terminal-animations@0.1.1
-## 1.5.1
-### Patch Changes
-- a9c25a3: Fix SessionHeader test truncation by widening trackWidth
-## 1.5.0
-### Minor Changes
-- c746431: Decompose marathon command into focused modules and add new features
-  - **Decomposition**: Extract monolithic agents-task.ts (2400 lines) into 10 focused modules under `packages/cli/src/marathon/`:
-    - `verification.ts` - Command safety validation
-    - `checkpoint.ts` - File checkpoint management
-    - `errors.ts` - API error formatting
-    - `repo-discovery.ts` - File search and tree utilities
-    - `sandbox.ts` - Sandboxed code execution
-    - `local-tools.ts` - Agent tool definitions
-    - `state.ts` - State persistence and session management
-    - `index.ts` - Barrel export
-  - **Loop Detection** (`loop-detector.ts`): Detects repeating action subsequences (length 2-5, threshold 3 repeats) and injects steering messages to break agent loops
-  - **Context Offloading** (`context-offload.ts`): Saves large tool outputs (>threshold chars) to files, returning compact references to reduce context window pressure
-  - **Workflow Recipes** (`recipes.ts`): Declarative JSON configuration for phases, rules, model cascading, and verification settings via `.marathon/recipes/` directory
-  - **Scoped Rules**: Load markdown rule files from `.marathon/rules/` with optional YAML frontmatter for glob-based and phase-based scoping
-  - **Model Cascading**: New `--planning-model` and `--execution-model` CLI flags for using different models during research/planning vs execution phases
-  - **Enhanced Steering**: New `/plan`, `/status`, and `/revert` steering commands
-  - **Context Offloading Flag**: New `--offload-threshold` flag to enable automatic tool output offloading
-### Patch Changes
-- c746431: Polish the Ink terminal UI with a warmer low-contrast palette, calmer chrome, themed select menus, and more cohesive markdown rendering for marathon and talk flows.
-- c746431: Preserve Marathon `agent_await` payloads in the Event Stream panel so local tool wait events show their real metadata instead of `{}`.
-- Updated dependencies [c746431]
-  - @runtypelabs/ink-components@0.2.2
-## 1.4.0
-### Minor Changes
-- cb689ac: Add animated loading indicator before tokens stream in marathon UI
-  - New `@runtypelabs/terminal-animations` package (internal) with AnimatedVariant and LoadingAnimation
-  - Marathon shows a randomly-selected terminal animation (neon-pulse, matrix-drip, tron variants, marathon POV, etc.) centered in the content area while waiting for first tokens
-  - Loading displays during idle and thinking phases when no content/reasoning/tools are shown yet
-### Patch Changes
-- cb689ac: Improve marathon safety and verification by checkpointing original files before writes, adding rollback and guarded verification tools, and requiring successful verification before completion.
-- cb689ac: Add marathon session history tabs with persisted replay snapshots.
-- cb689ac: Improve interactive CLI selection prompts with arrow-key navigation in TTY mode while preserving numeric shortcuts and non-interactive fallbacks.
-- cb689ac: Render marathon upgrade prompts as a dismissible modal overlay with direct billing-page shortcuts.
-- cb689ac: Fix marathon resume and execution-state handling so resumed or restarted runs keep their workflow phase, advance cleanly from planning into execution, avoid reusing the wrong local-tool results across resume cycles, and stop reporting errored runs as completed.
-- cb689ac: Improve marathon state handling by prompting before reusing or overwriting saved local state and adding a `--fresh` flag for explicit fresh starts.
-- cb689ac: Tighten marathon execution target tracking by trimming candidate paths, ignoring scratch-file writes as targets, blocking planning/execution writes to undeclared files, sanitizing poisoned saved marathon state on resume, and surfacing clearer rate-limit details when marathon hits a 429.
-- cb689ac: Improve marathon transcript readability and reasoning panel contrast.
-- Updated dependencies [cb689ac]
-- Updated dependencies [cb689ac]
-- Updated dependencies [cb689ac]
-- Updated dependencies [cb689ac]
-- Updated dependencies [cb689ac]
-  - @runtypelabs/sdk@1.7.2
-## 1.3.1
-### Patch Changes
-- Updated dependencies [458711d]
-  - @runtypelabs/sdk@1.7.1
-## 1.3.0
-### Minor Changes
-- 1ef582e: feat: add OAuth2 authentication for external MCP server connections
-  Adds full OAuth2 support (RFC 9728) for connecting to external MCP servers that require OAuth2 authentication. Includes:
-  - OAuth2 auto-discovery via .well-known/oauth-authorization-server
-  - PKCE authorization code flow with dynamic client registration
-  - Token refresh with automatic retry-on-401
-  - Dashboard UI with popup-based OAuth2 login flow
-  - CLI OAuth2 auth flow using local callback server
-  - Test OAuth2 MCP Worker for smoke testing
-### Patch Changes
-- d8d5e28: fix: implement RFC 9728 three-phase OAuth2 Protected Resource Metadata discovery
-  The OAuth2 discovery endpoint now follows the MCP spec's two-step protocol for servers where the Authorization Server is at a different origin than the MCP server (e.g., `mcp.linear.app` with AS at `linear.app`).
-  Phase 1a: Probe MCP URL → parse `resource_metadata` from `WWW-Authenticate` on 401 → extract `authorization_servers[0]` → discover AS metadata.
-  Phase 1b: Try `/.well-known/oauth-protected-resource` at the MCP URL → extract `authorization_servers[0]` → discover AS metadata.
-  Phase 2: Origin fallback — try `/.well-known/oauth-authorization-server` at MCP server's origin (backward compat).
-  Also fixes BugBot finding where the discover endpoint used `id: 'discovery_temp'` causing `refreshOAuth2Token` to persist tokens under a non-existent DB name.
-## 1.2.1
-### Patch Changes
-- 6d08460: chore: bump dependencies (42 minor/patch updates, 15 unused deps removed)
-- Updated dependencies [6d08460]
-  - @runtypelabs/ink-components@0.2.1
-## 1.2.0
-### Minor Changes
-- 3531abb: Make Cloudflare Worker the default sandbox provider for transform-data steps, soft-deprecating QuickJS as legacy
-### Patch Changes
-- Updated dependencies [3531abb]
-  - @runtypelabs/sdk@1.7.0
-## 1.1.5
-### Patch Changes
-- Updated dependencies [57ca1e0]
-  - @runtypelabs/sdk@1.6.0
-## 1.1.4
-### Patch Changes
-- 8976cd0: Ensure agents-task restores the primary terminal screen when Ink render fails.
-  The marathon command now creates the Ink UI inside the existing try/catch block, matching talk's safety pattern. This guarantees `exitAltScreen()` is called before error output when `render()` throws, preventing errors from being written to the alternate screen buffer and disappearing when the process exits.
-- 8976cd0: Fix marathon and talk scrollback in tmux by using the alternate screen buffer
-  Fullscreen Ink TUI apps (marathon, talk) now enter the terminal's alternate screen buffer before rendering. This prevents render cycles from polluting the scrollback history, which was making scrollback unusable in terminal multiplexers like tmux. When the app exits, the original terminal content is restored — matching the behavior of vim, less, and htop.
-## 1.1.3
-### Patch Changes
-- 077b0ff: Internal maintenance: update comments and rename imports for clarity
-- Updated dependencies [077b0ff]
-  - @runtypelabs/sdk@1.5.1
-## 1.1.2
-### Patch Changes
-- 28da130: Rename @runtypelabs/ink dependency to @runtypelabs/ink-components
-  The ink shared component library has been renamed from @runtypelabs/ink to
-  @runtypelabs/ink-components so it can be published to npm without conflicting
-  with the existing "ink" package name.
-- Updated dependencies [8505d96]
-- Updated dependencies [a52e64d]
-- Updated dependencies [a96ce5d]
-  - @runtypelabs/sdk@1.5.0
-  - @runtypelabs/ink-components@0.2.0
-## 1.1.1
-### Patch Changes
-- ed4d85a: Unify SSE event naming across the platform
-  - Rename `step_chunk` to `step_delta` (aligns with Anthropic/OpenAI/Vercel convention)
-  - Rename `flow_paused` to `flow_await`, `step_waiting_local` to `step_await`, `agent_paused` to `agent_await`
-  - Consolidate fallback events: merge `fallbacks_initiated` into `fallback_start`, unify `fallback_success`/`fallback_fail` into `fallback_complete`, rename `fallbacks_exhausted` to `fallback_exhausted`
-  - Add structured TypeScript interfaces for tool events (`ToolStartEventData`, `ToolCompleteEventData`, `ToolErrorEventData`)
-  - Formalize `tool_error` as a first-class event type with `emitToolError()` method
-  All renames use dual-emit for backwards compatibility: the API sends both the new and legacy event names during the transition period. SDK consumers accept both names.
-- Updated dependencies [ed4d85a]
-  - @runtypelabs/sdk@1.4.0
-## 1.1.0
-### Minor Changes
-- e4040c8: Add 'o' keyboard shortcut in marathon mode to open the agent page in the Runtype dashboard. The status bar shows the hint and the dashboard URL is printed in the post-completion summary.
-## 1.0.0
-### Major Changes
-- ffab49e: BREAKING: Complete Ink TUI migration — replaced readline/inquirer with Ink for talk, init, Marathon, and all CRUD commands. Output format and interactive behavior changed. Marathon continuity: terminal steering, resume, model/tools switching.
-### Patch Changes
-- e6846a4: Fix integration test failures in non-TTY/CI environments. Add section headers to non-TTY list output, add non-TTY path for dispatch --no-stream to prevent timeout, and improve billing portal non-TTY messages.
-- Updated dependencies [ffab49e]
-  - @runtypelabs/sdk@1.3.0
-## 0.2.6
-### Patch Changes
-- b7f10cd: Fix `runtype talk` 404 and improve fetch error handling: use versioned dispatch URL (/v1/dispatch) and surface underlying cause plus local-API tip on "fetch failed".
-## 0.2.5
-### Patch Changes
-- d59a2d0: Remove backward-compatibility tests for auth callback; callback now expects token only.
-## 0.2.4
-### Patch Changes
-- 5ca7894: Fix CLI auth login in production: exchange Clerk JWT directly with the Runtype API instead of using an in-memory temp code on the dashboard (which broke on Vercel's serverless functions). The CLI callback server now accepts `token` parameter alongside legacy `code` for backward compatibility.
-## 0.2.3
-### Patch Changes
-- Updated dependencies [0e5a64a]
-  - @runtypelabs/sdk@1.2.1
-## 0.2.2
-### Patch Changes
-- 76c322c: Fix CLI auth login in production: use dashboard URL from config (getDashboardUrl) for token exchange instead of hardcoding localhost:3001, so `runtype auth login` works against https://use.runtype.com without setting RUNTYPE_DASHBOARD_URL.
-## 0.2.1
-### Patch Changes
-- b0bada9: Add `end_turn` stop reason to distinguish "turn ended" from "task completed." Non-loop agents now return `end_turn` instead of `complete`, enabling multi-session marathon execution to continue across sessions. SDK includes client-side stop-phrase detection as a fallback for non-loop agents.
-- Updated dependencies [b0bada9]
-  - @runtypelabs/sdk@1.2.0
-## 0.2.0
-### Minor Changes
-- ebe3c6b: Add `agents task` command and top-level `marathon` alias for multi-session long-task agent execution with streaming output, local state persistence, and `--track` flag for dashboard sync. Rename `agents run-task` to `agents task` and `--track-progress` to `--track`.
-### Patch Changes
-- Updated dependencies [ebe3c6b]
-  - @runtypelabs/sdk@1.1.0
-## 0.1.10
-### Patch Changes
-- Updated dependencies [aa97d84]
-  - @runtypelabs/sdk@1.0.2
-## 0.1.9
-### Patch Changes
-- Updated dependencies [de81f99]
-  - @runtypelabs/sdk@1.0.1
-## 0.1.8
-### Patch Changes
-- Updated dependencies [065de96]
-  - @runtypelabs/sdk@1.0.0
-## 0.1.7
-### Patch Changes
-- Updated dependencies [0140d17]
-  - @runtypelabs/sdk@0.5.0
-## 0.1.6
-### Patch Changes
-- Updated dependencies [cf6fcdc]
-  - @runtypelabs/sdk@0.4.0
-## 0.1.5
-### Patch Changes
-- Updated dependencies [9ec83bd]
-- Updated dependencies [a63f268]
-  - @runtypelabs/sdk@0.3.0
-## 0.1.4
-### Patch Changes
-- 8506aa1: Remove private @runtypelabs/shared dependency from all public packages by inlining types and constants. This fixes npm installation errors where users couldn't install packages due to the unpublished internal shared package dependency.
-- Updated dependencies [8506aa1]
-  - @runtypelabs/sdk@0.2.1
-## 0.1.3
-### Patch Changes
-- Updated dependencies
-- Updated dependencies [06ac26d]
-  - @runtypelabs/sdk@0.2.0
-## 0.1.2
-### Patch Changes
-- 2eb58c6: Add official CLI tool badge to README
-- Updated dependencies [2eb58c6]
-  - @runtypelabs/sdk@0.1.3