@task-boards/mcp-server 0.15.0 → 0.16.0

package/build/cli.js

@@ -25,6 +25,25 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// ../api/build/agent-runs/agent-runs.api.js
+var require_agent_runs_api = __commonJS({
+  "../api/build/agent-runs/agent-runs.api.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.AGENT_RUNS_ROUTES = exports.AGENT_RUNS_PREFIX = void 0;
+    exports.AGENT_RUNS_PREFIX = "/agent-runs";
+    exports.AGENT_RUNS_ROUTES = {
+      listAgentRuns: () => exports.AGENT_RUNS_PREFIX,
+      claimAgentRuns: () => `${exports.AGENT_RUNS_PREFIX}/claim`,
+      listAgentRunsByWorkItem: (workItemId) => `/work-items/${workItemId}/agent-runs`,
+      retryAgentRun: (id) => `${exports.AGENT_RUNS_PREFIX}/${id}/retry`,
+      acknowledgeAgentRun: (id) => `${exports.AGENT_RUNS_PREFIX}/${id}/acknowledge`,
+      setAgentRunAttention: (id) => `${exports.AGENT_RUNS_PREFIX}/${id}/attention`,
+      completeAgentRun: (id) => `${exports.AGENT_RUNS_PREFIX}/${id}/complete`
+    };
+  }
+});
+
 // ../api/build/api-prefix.js
 var require_api_prefix = __commonJS({
   "../api/build/api-prefix.js"(exports) {
@@ -102,6 +121,7 @@ var require_agent_run_outcome_enum = __commonJS({
     exports.AGENT_RUN_OUTCOME = {
       DEFAULT: "DEFAULT",
       SKIP_DESIGN: "SKIP_DESIGN",
+      SKIP_DEV: "SKIP_DEV",
       HAS_BUGS: "HAS_BUGS",
       NEEDS_CLARIFICATION: "NEEDS_CLARIFICATION",
       FAILED: "FAILED"
@@ -915,25 +935,6 @@ var require_notifications = __commonJS({
   }
 });
 
-// ../api/build/agent-runs/agent-runs.api.js
-var require_agent_runs_api = __commonJS({
-  "../api/build/agent-runs/agent-runs.api.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.AGENT_RUNS_ROUTES = exports.AGENT_RUNS_PREFIX = void 0;
-    exports.AGENT_RUNS_PREFIX = "/agent-runs";
-    exports.AGENT_RUNS_ROUTES = {
-      listAgentRuns: () => exports.AGENT_RUNS_PREFIX,
-      claimAgentRuns: () => `${exports.AGENT_RUNS_PREFIX}/claim`,
-      listAgentRunsByWorkItem: (workItemId) => `/work-items/${workItemId}/agent-runs`,
-      retryAgentRun: (id) => `${exports.AGENT_RUNS_PREFIX}/${id}/retry`,
-      acknowledgeAgentRun: (id) => `${exports.AGENT_RUNS_PREFIX}/${id}/acknowledge`,
-      setAgentRunAttention: (id) => `${exports.AGENT_RUNS_PREFIX}/${id}/attention`,
-      completeAgentRun: (id) => `${exports.AGENT_RUNS_PREFIX}/${id}/complete`
-    };
-  }
-});
-
 // ../api/build/agent-runs/agent-runs.types.js
 var require_agent_runs_types = __commonJS({
   "../api/build/agent-runs/agent-runs.types.js"(exports) {
@@ -1682,7 +1683,10 @@ var require_exception_codes = __commonJS({
       ADMIN_NOTIFICATION_SETTINGS_NOT_FOUND: "ADMIN_NOTIFICATION_SETTINGS_NOT_FOUND",
       ADMIN_NOTIFICATION_CHANNEL_INVALID: "ADMIN_NOTIFICATION_CHANNEL_INVALID",
       ADMIN_NOTIFICATION_EMAIL_RECIPIENT_REQUIRED: "ADMIN_NOTIFICATION_EMAIL_RECIPIENT_REQUIRED",
-      ADMIN_NOTIFICATION_TELEGRAM_CONFIG_INCOMPLETE: "ADMIN_NOTIFICATION_TELEGRAM_CONFIG_INCOMPLETE"
+      ADMIN_NOTIFICATION_TELEGRAM_CONFIG_INCOMPLETE: "ADMIN_NOTIFICATION_TELEGRAM_CONFIG_INCOMPLETE",
+      PAYMENTS_DISABLED: "PAYMENTS_DISABLED",
+      PAYMENTS_NOT_CONFIGURED: "PAYMENTS_NOT_CONFIGURED",
+      PAYMENTS_PROBE_FAILED: "PAYMENTS_PROBE_FAILED"
     };
   }
 });
@@ -1695,7 +1699,8 @@ var require_health_api = __commonJS({
     exports.HEALTH_ROUTES = exports.HEALTH_PREFIX = void 0;
     exports.HEALTH_PREFIX = "/health";
     exports.HEALTH_ROUTES = {
-      getHealth: () => exports.HEALTH_PREFIX
+      getHealth: () => exports.HEALTH_PREFIX,
+      getReadiness: () => `${exports.HEALTH_PREFIX}/ready`
     };
   }
 });
@@ -1705,10 +1710,18 @@ var require_health_types = __commonJS({
   "../shared/build/internal/health/health.types.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.HEALTH_STATUS = void 0;
+    exports.READINESS_CHECK_STATUS = exports.READINESS_STATUS = exports.HEALTH_STATUS = void 0;
     exports.HEALTH_STATUS = {
       OK: "ok"
     };
+    exports.READINESS_STATUS = {
+      OK: "ok",
+      ERROR: "error"
+    };
+    exports.READINESS_CHECK_STATUS = {
+      UP: "up",
+      DOWN: "down"
+    };
   }
 });
 
@@ -1873,6 +1886,36 @@ var require_admin = __commonJS({
   }
 });
 
+// ../shared/build/internal/payments/admin-payments.api.js
+var require_admin_payments_api = __commonJS({
+  "../shared/build/internal/payments/admin-payments.api.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ADMIN_PAYMENTS_ROUTES = exports.ADMIN_PAYMENTS_PREFIX = void 0;
+    var admin_api_1 = require_admin_api();
+    exports.ADMIN_PAYMENTS_PREFIX = `${admin_api_1.ADMIN_PREFIX}/payments`;
+    exports.ADMIN_PAYMENTS_ROUTES = {
+      probePaymentsConnectivity: () => `${exports.ADMIN_PAYMENTS_PREFIX}/probe`
+    };
+  }
+});
+
+// ../shared/build/internal/payments/index.js
+var require_payments = __commonJS({
+  "../shared/build/internal/payments/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ADMIN_PAYMENTS_ROUTES = exports.ADMIN_PAYMENTS_PREFIX = void 0;
+    var admin_payments_api_1 = require_admin_payments_api();
+    Object.defineProperty(exports, "ADMIN_PAYMENTS_PREFIX", { enumerable: true, get: function() {
+      return admin_payments_api_1.ADMIN_PAYMENTS_PREFIX;
+    } });
+    Object.defineProperty(exports, "ADMIN_PAYMENTS_ROUTES", { enumerable: true, get: function() {
+      return admin_payments_api_1.ADMIN_PAYMENTS_ROUTES;
+    } });
+  }
+});
+
 // ../shared/build/internal/subscriptions/subscription-source.enum.js
 var require_subscription_source_enum = __commonJS({
   "../shared/build/internal/subscriptions/subscription-source.enum.js"(exports) {
@@ -2090,6 +2133,7 @@ var require_internal = __commonJS({
     __exportStar(require_exception_codes(), exports);
     __exportStar(require_health(), exports);
     __exportStar(require_admin(), exports);
+    __exportStar(require_payments(), exports);
     __exportStar(require_subscriptions2(), exports);
   }
 });
@@ -2428,7 +2472,8 @@ var require_agentic_sdlc_workflow = __commonJS({
       "in-analysis": {
         defaultNextSlug: "in-development",
         outcomes: {
-          [agent_run_outcome_enum_1.AGENT_RUN_OUTCOME.SKIP_DESIGN]: "in-development"
+          [agent_run_outcome_enum_1.AGENT_RUN_OUTCOME.SKIP_DESIGN]: "in-development",
+          [agent_run_outcome_enum_1.AGENT_RUN_OUTCOME.SKIP_DEV]: "released"
         }
       },
       "in-development": {
@@ -2470,7 +2515,7 @@ var require_agentic_sdlc_workflow = __commonJS({
         nextAgentRole
       };
     }
-    function resolveInAnalysisTransition(outcome, workflowPhase) {
+    function resolveInAnalysisTransition(outcome, workflowPhase, context) {
       if (outcome === agent_run_outcome_enum_1.AGENT_RUN_OUTCOME.NEEDS_CLARIFICATION) {
         return moveTransition(exports.IN_AWAITING_COLUMN_SLUG, workflowPhase, null);
       }
@@ -2491,6 +2536,12 @@ var require_agentic_sdlc_workflow = __commonJS({
         if (outcome === agent_run_outcome_enum_1.AGENT_RUN_OUTCOME.SKIP_DESIGN) {
           return moveTransition("in-development", workflow_phase_enum_1.WORKFLOW_PHASE.DEVELOPMENT, null);
         }
+        if (outcome === agent_run_outcome_enum_1.AGENT_RUN_OUTCOME.SKIP_DEV) {
+          if (context.codeChangesRequired !== false) {
+            return null;
+          }
+          return moveTransition("released", null, null);
+        }
         return null;
       }
       if (workflowPhase === workflow_phase_enum_1.WORKFLOW_PHASE.ARCHITECT) {
@@ -2566,7 +2617,7 @@ var require_agentic_sdlc_workflow = __commonJS({
       }
       if (currentColumnSlug === "in-analysis") {
         const phase = context.workflowPhase ?? (0, workflow_phase_subagent_role_map_1.subagentRoleToWorkflowPhase)(context.agentRole);
-        return resolveInAnalysisTransition(outcome, phase);
+        return resolveInAnalysisTransition(outcome, phase, context);
       }
       if (currentColumnSlug === "in-development") {
         return resolveInDevelopmentTransition(outcome, context);
@@ -3326,7 +3377,8 @@ var require_mcp_sensitive_data_util = __commonJS({
     exports.MCP_REDACTED_HOST = "[REDACTED_HOST]";
     exports.MCP_REDACTED_PORT = "[REDACTED_PORT]";
     exports.MCP_WORKSPACE_PLACEHOLDER = "[workspace]";
-    var SENSITIVE_OBJECT_KEY_PATTERN = /^(password|passwd|secret|clientsecret|client_secret|apikey|api_key|token|authorization|smtp_password|tokenpepper|token_pepper|privatekey|private_key)$/i;
+    var SENSITIVE_OBJECT_KEY_PATTERN = /^(password|passwd|secret|clientsecret|client_secret|apikey|api_key|apisecret|api_secret|token|authorization|smtp_password|tokenpepper|token_pepper|privatekey|private_key|pan|cardnumber|card_number)$/i;
+    var PAN_PATTERN = /\b(?:\d[ -]*?){13,19}\b/g;
     var BLOCKED_ATTACHMENT_FILE_NAME_PATTERN = /^(?:\.env(?:\..*)?|secrets\.ya?ml|config\.ya?ml|.*\.pem|.*\.p12|.*\.key|id_rsa(?:\..*)?|credentials\.json|\.npmrc|docker-compose\.ya?ml|compose\.ya?ml)$/i;
     var JWT_PATTERN = /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
     var BEARER_PATTERN = /Bearer\s+[A-Za-z0-9._~+/=-]+/gi;
@@ -3373,6 +3425,7 @@ var require_mcp_sensitive_data_util = __commonJS({
       result = result.replace(HTTPS_REMOTE_URL_PATTERN, `${exports.MCP_REDACTED_HOST}/...`);
       result = result.replace(ENV_ASSIGNMENT_PATTERN, `${exports.MCP_REDACTED}_ENV`);
       result = result.replace(NPM_TOKEN_PATTERN, `NpmToken.${exports.MCP_REDACTED}`);
+      result = result.replace(PAN_PATTERN, exports.MCP_REDACTED);
       return result;
     }
     function redactSensitiveValueDeep(value, workspaceRoot) {
@@ -3551,43 +3604,44 @@ var require_build2 = __commonJS({
   }
 });
 
-// src/index.ts
-import { createRequire } from "node:module";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+// src/orchestrator/orchestrator-transport.ts
+var import_agent_runs2 = __toESM(require_agent_runs_api(), 1);
+var import_shared5 = __toESM(require_build2(), 1);
 
-// src/config.ts
-var import_api = __toESM(require_build(), 1);
-function resolveSanitizeResponses() {
-  const raw = process.env.TASK_BOARDS_MCP_SANITIZE;
-  if (raw === void 0 || raw.trim() === "") {
-    return true;
-  }
-  const normalized = raw.trim().toLowerCase();
-  return normalized !== "false" && normalized !== "0" && normalized !== "no";
+// src/tools/attachments.ts
+var import_attachments = __toESM(require_attachments_api(), 1);
+var import_shared3 = __toESM(require_build2(), 1);
+import { existsSync as existsSync3 } from "node:fs";
+import { z } from "zod";
+
+// src/attachments/detect-mime-type.ts
+import { basename } from "node:path";
+import { lookup as lookupMimeType } from "mime-types";
+function detectMimeType(filePath) {
+  const mimeType = lookupMimeType(basename(filePath));
+  return typeof mimeType === "string" ? mimeType : "application/octet-stream";
 }
-function resolveBlockSensitiveAttachments() {
-  const raw = process.env.TASK_BOARDS_MCP_BLOCK_SENSITIVE_ATTACHMENTS;
-  if (raw === void 0 || raw.trim() === "") {
-    return true;
-  }
-  const normalized = raw.trim().toLowerCase();
-  return normalized !== "false" && normalized !== "0" && normalized !== "no";
+
+// src/attachments/staging.util.ts
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+var MAX_FILE_NAME_LENGTH = 200;
+function sanitizeFileName(name) {
+  const baseName = name.split(/[/\\]/).pop() ?? name;
+  const sanitized = baseName.replace(/[^a-zA-Z0-9._-]/g, "_");
+  return sanitized.length > MAX_FILE_NAME_LENGTH ? sanitized.slice(0, MAX_FILE_NAME_LENGTH) : sanitized;
 }
-function loadConfig() {
-  const apiUrl = process.env.TASK_BOARDS_API_URL ?? "http://localhost:3000";
-  const apiToken = process.env.TASK_BOARDS_API_TOKEN;
-  const workspaceRoot = process.env.WORKSPACE_ROOT;
-  if (process.env.NODE_ENV === "production" && (apiToken === void 0 || apiToken.trim() === "")) {
-    console.error("WARNING: TASK_BOARDS_API_TOKEN is not set. MCP server cannot authenticate to the Task Boards API.");
-  }
-  return {
-    apiUrl: `${apiUrl.replace(/\/$/, "")}${import_api.API_V1_PREFIX}`,
-    apiToken,
-    workspaceRoot: workspaceRoot !== void 0 && workspaceRoot.trim() !== "" ? workspaceRoot : void 0,
-    sanitizeResponses: resolveSanitizeResponses(),
-    blockSensitiveAttachments: resolveBlockSensitiveAttachments()
-  };
+function buildStagingPath(workspaceRoot, workItemId, attachmentId, fileName) {
+  const sanitizedFileName = sanitizeFileName(fileName);
+  return resolve(workspaceRoot, ".task-boards", "attachments", workItemId, `${attachmentId}_${sanitizedFileName}`);
+}
+function buildStagingDir(workspaceRoot, workItemId) {
+  return resolve(workspaceRoot, ".task-boards", "attachments", workItemId);
+}
+async function writeStagingFile(path, data) {
+  const absolutePath = resolve(path);
+  await mkdir(dirname(absolutePath), { recursive: true });
+  await writeFile(absolutePath, data);
 }
 
 // src/rest-client.ts
@@ -3694,6 +3748,121 @@ var RestClient = class {
   }
 };
 
+// src/workspace/confine-file-path.ts
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { basename as basename2, isAbsolute, relative, resolve as resolve2 } from "node:path";
+
+// src/workspace/workspace-error.ts
+var WorkspaceError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "WorkspaceError";
+  }
+};
+
+// src/workspace/confine-file-path.ts
+function confineFilePath(workspaceRoot, filePath) {
+  const resolvedRoot = resolve2(workspaceRoot);
+  const resolvedPath = isAbsolute(filePath) ? resolve2(filePath) : resolve2(resolvedRoot, filePath);
+  const relativePath = relative(resolvedRoot, resolvedPath);
+  if (relativePath.startsWith("..") || isAbsolute(relativePath)) {
+    throw new WorkspaceError(
+      "FILE_OUT_OF_BOUNDS",
+      `filePath is outside workspaceRoot: ${basename2(filePath) || filePath}`
+    );
+  }
+  if (!existsSync(resolvedPath)) {
+    throw new WorkspaceError("FILE_NOT_FOUND", `filePath does not exist: ${basename2(filePath) || filePath}`);
+  }
+  const stats = statSync(resolvedPath);
+  if (!stats.isFile()) {
+    throw new WorkspaceError("FILE_NOT_FOUND", `filePath is not a file: ${basename2(filePath) || filePath}`);
+  }
+  return resolvedPath;
+}
+function readConfinedWorkspaceFile(workspaceRoot, filePath) {
+  const absolutePath = confineFilePath(workspaceRoot, filePath);
+  const stats = statSync(absolutePath);
+  const buffer = readFileSync(absolutePath);
+  return {
+    absolutePath,
+    fileName: basename2(absolutePath),
+    sizeBytes: stats.size,
+    buffer
+  };
+}
+
+// src/workspace/resolve-workspace-root.ts
+import { existsSync as existsSync2, statSync as statSync2 } from "node:fs";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join, relative as relative2, resolve as resolve3 } from "node:path";
+var TASK_BOARDS_FILE = ".task-boards.yaml";
+var MAX_UPWARD_LEVELS = 20;
+function assertDirectory(path, source) {
+  const absolutePath = resolve3(path);
+  if (!existsSync2(absolutePath)) {
+    throw new WorkspaceError("WORKSPACE_NOT_FOUND", `${source} does not exist: ${absolutePath}`);
+  }
+  const stats = statSync2(absolutePath);
+  if (!stats.isDirectory()) {
+    throw new WorkspaceError("WORKSPACE_NOT_FOUND", `${source} is not a directory: ${absolutePath}`);
+  }
+  return absolutePath;
+}
+function assertWithinAllowedRoot(target, allowedRoot) {
+  const relativePath = relative2(allowedRoot, target);
+  const isNested = relativePath !== "" && !relativePath.startsWith("..") && !isAbsolute2(relativePath);
+  if (target !== allowedRoot && !isNested) {
+    throw new WorkspaceError(
+      "WORKSPACE_OUT_OF_BOUNDS",
+      `workspaceRoot is outside the allowed WORKSPACE_ROOT: ${target}`
+    );
+  }
+}
+function assertGitRepository(absolutePath) {
+  if (!existsSync2(join(absolutePath, ".git"))) {
+    throw new WorkspaceError("WORKSPACE_NOT_GIT_REPO", `workspaceRoot is not a git repository: ${absolutePath}`);
+  }
+}
+function findWorkspaceRootUpward(startDir) {
+  let current = resolve3(startDir);
+  for (let level = 0; level <= MAX_UPWARD_LEVELS; level += 1) {
+    const markerPath = join(current, TASK_BOARDS_FILE);
+    if (existsSync2(markerPath)) {
+      return current;
+    }
+    const parent = dirname2(current);
+    if (parent === current) {
+      break;
+    }
+    current = parent;
+  }
+  return null;
+}
+function resolveWorkspaceRoot(explicitOverride, envWorkspaceRoot) {
+  const allowedRoot = envWorkspaceRoot !== void 0 && envWorkspaceRoot.trim() !== "" ? assertDirectory(envWorkspaceRoot, "WORKSPACE_ROOT") : void 0;
+  if (explicitOverride !== void 0 && explicitOverride.trim() !== "") {
+    const resolved = assertDirectory(explicitOverride, "workspaceRoot");
+    if (allowedRoot !== void 0) {
+      assertWithinAllowedRoot(resolved, allowedRoot);
+    } else {
+      assertGitRepository(resolved);
+    }
+    return resolved;
+  }
+  if (allowedRoot !== void 0) {
+    return allowedRoot;
+  }
+  const fromMarker = findWorkspaceRootUpward(process.cwd());
+  if (fromMarker !== null) {
+    return fromMarker;
+  }
+  return resolve3(process.cwd());
+}
+
+// src/tools/tool-utils.ts
+var import_shared2 = __toESM(require_build2(), 1);
+
 // src/tool-runtime.ts
 var serverConfig = null;
 function initToolRuntime(config) {
@@ -3706,24 +3875,577 @@ function shouldSanitizeResponses() {
   return serverConfig.sanitizeResponses !== false;
 }
 
-// src/tools/agent-runs.ts
-var import_agent_runs2 = __toESM(require_agent_runs_api(), 1);
-var import_agent_run_outcome = __toESM(require_agent_run_outcome_enum(), 1);
-var import_agent_run_status4 = __toESM(require_agent_run_status_enum(), 1);
-import { z } from "zod";
-
-// src/tools/orchestrator-hints.ts
-var import_agent_run_status2 = __toESM(require_agent_run_status_enum(), 1);
-var import_subagent_role = __toESM(require_subagent_role_enum(), 1);
+// src/tools/tool-utils.ts
+function jsonResult(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
+function toolError(code, message) {
+  const sanitizedMessage = shouldSanitizeResponses() ? (0, import_shared2.sanitizeMcpErrorMessage)(message) : message;
+  return {
+    isError: true,
+    content: [{ type: "text", text: JSON.stringify({ code, message: sanitizedMessage }) }]
+  };
+}
+function toToolError(error) {
+  if (error instanceof RestClientError || error instanceof WorkspaceError) {
+    return toolError(error.code, error.message);
+  }
+  const message = error instanceof Error ? error.message : "Unknown error";
+  return toolError("INTERNAL_ERROR", message);
+}
+async function runTool(handler, options) {
+  try {
+    let data = await handler();
+    if (shouldSanitizeResponses()) {
+      data = (0, import_shared2.sanitizeMcpToolResult)(data, { workspaceRoot: options?.workspaceRoot });
+    }
+    return jsonResult(data);
+  } catch (error) {
+    return toToolError(error);
+  }
+}
 
-// src/tools/orchestrator-attention.util.ts
-var import_agent_run_status = __toESM(require_agent_run_status_enum(), 1);
-var ATTENTION_MESSAGE_CATEGORY = {
-  SHELL: "shell",
-  GIT: "git",
-  NETWORK: "network",
-  SMART_MODE: "smart-mode",
-  MCP: "mcp",
+// src/tools/attachments.ts
+var MAX_ATTACHMENT_COUNT = 20;
+var MAX_TOTAL_BYTES = 200 * 1024 * 1024;
+async function fetchAttachments(client, workItemId) {
+  return client.get(import_attachments.ATTACHMENTS_ROUTES.listAttachments(workItemId));
+}
+function filterAttachments(items, attachmentIds) {
+  if (attachmentIds === void 0 || attachmentIds.length === 0) {
+    return items;
+  }
+  const idSet = new Set(attachmentIds);
+  return items.filter((item) => idSet.has(item.id));
+}
+function assertDownloadLimits(attachments) {
+  if (attachments.length > MAX_ATTACHMENT_COUNT) {
+    throw new RestClientError(
+      "ATTACHMENT_LIMIT_EXCEEDED",
+      `Cannot download more than ${MAX_ATTACHMENT_COUNT} attachments at once (requested ${attachments.length})`
+    );
+  }
+  const totalBytes = attachments.reduce((sum, attachment) => sum + attachment.sizeBytes, 0);
+  if (totalBytes > MAX_TOTAL_BYTES) {
+    throw new RestClientError(
+      "ATTACHMENT_SIZE_LIMIT_EXCEEDED",
+      `Total attachment size ${totalBytes} bytes exceeds limit of ${MAX_TOTAL_BYTES} bytes`
+    );
+  }
+}
+async function downloadWorkItemAttachments(client, params) {
+  const { workItemId, workspaceRoot, attachmentIds, overwrite = false, blockSensitiveAttachments = true } = params;
+  const listResponse = await fetchAttachments(client, workItemId);
+  const selected = filterAttachments(listResponse.items, attachmentIds);
+  assertDownloadLimits(selected);
+  const stagingDir = buildStagingDir(workspaceRoot, workItemId);
+  const downloaded = [];
+  const skipped = [];
+  if (attachmentIds !== void 0 && attachmentIds.length > 0) {
+    const selectedIds = new Set(selected.map((item) => item.id));
+    for (const attachmentId of attachmentIds) {
+      if (!selectedIds.has(attachmentId)) {
+        skipped.push({ attachmentId, reason: "not found on work item" });
+      }
+    }
+  }
+  for (const attachment of selected) {
+    if (blockSensitiveAttachments && (0, import_shared3.isBlockedMcpAttachmentFileName)(attachment.fileName)) {
+      skipped.push({ attachmentId: attachment.id, reason: "blocked_sensitive_filename" });
+      continue;
+    }
+    const stagingPath = buildStagingPath(workspaceRoot, workItemId, attachment.id, attachment.fileName);
+    if (!overwrite && existsSync3(stagingPath)) {
+      skipped.push({ attachmentId: attachment.id, reason: "file already exists (set overwrite=true to replace)" });
+      continue;
+    }
+    const { data } = await client.downloadBinary(import_attachments.ATTACHMENTS_ROUTES.downloadAttachment(workItemId, attachment.id));
+    await writeStagingFile(stagingPath, data);
+    downloaded.push({
+      attachmentId: attachment.id,
+      fileName: attachment.fileName,
+      path: stagingPath,
+      sizeBytes: data.length
+    });
+  }
+  return {
+    workItemId,
+    downloaded,
+    skipped,
+    stagingDir
+  };
+}
+async function uploadWorkItemAttachment(client, params) {
+  const { workItemId, workspaceRoot, filePath, blockSensitiveAttachments = true } = params;
+  const confinedFile = readConfinedWorkspaceFile(workspaceRoot, filePath);
+  if (blockSensitiveAttachments && (0, import_shared3.isBlockedMcpAttachmentFileName)(confinedFile.fileName)) {
+    throw new RestClientError(
+      "BLOCKED_SENSITIVE_FILENAME",
+      `Attachment filename is blocked for MCP upload: ${confinedFile.fileName}`
+    );
+  }
+  const mimeType = detectMimeType(confinedFile.absolutePath);
+  const attachment = await client.uploadMultipart(
+    import_attachments.ATTACHMENTS_ROUTES.uploadAttachment(workItemId),
+    "file",
+    {
+      buffer: confinedFile.buffer,
+      fileName: confinedFile.fileName,
+      mimeType
+    }
+  );
+  return {
+    workItemId,
+    attachment,
+    sourcePath: confinedFile.absolutePath
+  };
+}
+function registerAttachmentTools(server, client, config) {
+  server.registerTool(
+    "list_work_item_attachments",
+    {
+      description: "List file attachments for a work item.",
+      inputSchema: {
+        workItemId: z.string().uuid().describe("Work item UUID")
+      }
+    },
+    async ({ workItemId }) => runTool(async () => fetchAttachments(client, workItemId))
+  );
+  server.registerTool(
+    "download_work_item_attachments",
+    {
+      description: "Download work item attachments into the local workspace staging directory (.task-boards/attachments).",
+      inputSchema: {
+        workItemId: z.string().uuid().describe("Work item UUID"),
+        attachmentIds: z.array(z.string().uuid()).optional().describe("Optional subset of attachment UUIDs; downloads all when omitted"),
+        overwrite: z.boolean().optional().default(false).describe("Replace existing staged files when true"),
+        workspaceRoot: z.string().optional().describe("Optional absolute path to git repo root; defaults to WORKSPACE_ROOT or upward search from cwd")
+      }
+    },
+    async ({ workItemId, attachmentIds, overwrite, workspaceRoot }) => {
+      const resolvedWorkspaceRoot = resolveWorkspaceRoot(workspaceRoot, config.workspaceRoot);
+      return runTool(
+        async () => downloadWorkItemAttachments(client, {
+          workItemId,
+          workspaceRoot: resolvedWorkspaceRoot,
+          attachmentIds,
+          overwrite,
+          blockSensitiveAttachments: config.blockSensitiveAttachments
+        }),
+        { workspaceRoot: resolvedWorkspaceRoot }
+      );
+    }
+  );
+  server.registerTool(
+    "upload_work_item_attachment",
+    {
+      description: "Upload a local workspace file as a work item attachment (multipart field file).",
+      inputSchema: {
+        workItemId: z.string().uuid().describe("Work item UUID"),
+        filePath: z.string().describe("Absolute or workspace-relative path to the file; must stay within workspaceRoot"),
+        workspaceRoot: z.string().optional().describe("Optional absolute path to git repo root; defaults to WORKSPACE_ROOT or upward search from cwd")
+      }
+    },
+    async ({ workItemId, filePath, workspaceRoot }) => {
+      const resolvedWorkspaceRoot = resolveWorkspaceRoot(workspaceRoot, config.workspaceRoot);
+      return runTool(
+        async () => uploadWorkItemAttachment(client, {
+          workItemId,
+          workspaceRoot: resolvedWorkspaceRoot,
+          filePath,
+          blockSensitiveAttachments: config.blockSensitiveAttachments
+        }),
+        { workspaceRoot: resolvedWorkspaceRoot }
+      );
+    }
+  );
+}
+
+// src/tools/comments.ts
+var import_comments = __toESM(require_comments_api(), 1);
+import { z as z2 } from "zod";
+async function fetchComments(client, workItemId) {
+  return client.get(import_comments.COMMENTS_ROUTES.listComments(workItemId));
+}
+async function postComment(client, workItemId, body) {
+  const request = { body };
+  return client.post(import_comments.COMMENTS_ROUTES.createComment(workItemId), request);
+}
+function registerCommentTools(server, client) {
+  server.registerTool(
+    "list_comments",
+    {
+      description: "List comments for a work item (newest last).",
+      inputSchema: {
+        workItemId: z2.string().uuid().describe("Work item UUID")
+      }
+    },
+    async ({ workItemId }) => runTool(async () => fetchComments(client, workItemId))
+  );
+  server.registerTool(
+    "create_comment",
+    {
+      description: "Create a comment on a work item. Use for orchestrator NEEDS_CLARIFICATION questions before complete_agent_run.",
+      inputSchema: {
+        workItemId: z2.string().uuid().describe("Work item UUID"),
+        body: z2.string().min(1).describe("Comment body (markdown supported)")
+      }
+    },
+    async ({ workItemId, body }) => runTool(async () => postComment(client, workItemId, body))
+  );
+}
+
+// src/subagents/sync-project-subagents.ts
+var import_shared4 = __toESM(require_build2(), 1);
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join as join2 } from "node:path";
+var SAFE_SUBAGENT_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var MAX_SUBAGENT_SLUG_LENGTH = 64;
+function isSyncableSlug(slug) {
+  const trimmed = slug.trim();
+  return trimmed.length > 0 && trimmed.length <= MAX_SUBAGENT_SLUG_LENGTH && SAFE_SUBAGENT_SLUG_PATTERN.test(trimmed);
+}
+function buildFileContent(subagent) {
+  return (0, import_shared4.buildSubagentFileContentFromBody)({
+    slug: subagent.slug,
+    description: subagent.description,
+    bodyMarkdown: subagent.bodyMarkdown
+  });
+}
+async function syncProjectSubagents(client, params) {
+  const { projectId, workspaceRoot } = params;
+  const listResponse = await client.get(import_shared4.PROJECT_SUBAGENTS_ROUTES.listSubagents(projectId));
+  const directory = join2(workspaceRoot, ".cursor", "agents");
+  mkdirSync(directory, { recursive: true });
+  const synced = [];
+  const skipped = [];
+  for (const subagent of listResponse.items) {
+    if (!isSyncableSlug(subagent.slug)) {
+      skipped.push(subagent.slug);
+      continue;
+    }
+    const filePath = join2(directory, `${subagent.slug}.md`);
+    writeFileSync(filePath, buildFileContent(subagent), "utf8");
+    synced.push(subagent.slug);
+  }
+  return { synced, skipped, directory };
+}
+
+// src/tools/wait-for-agent-runs.ts
+var import_agent_runs = __toESM(require_agent_runs_api(), 1);
+var import_agent_run_status = __toESM(require_agent_run_status_enum(), 1);
+var DEFAULT_RETRY_BASE_MS = 500;
+var DEFAULT_RETRY_MAX_MS = 3e4;
+var DEFAULT_INFLIGHT_LIMIT = 10;
+function sleep(ms) {
+  return new Promise((resolve4) => {
+    setTimeout(resolve4, ms);
+  });
+}
+function isTransientClaimError(error) {
+  if (!(error instanceof RestClientError)) {
+    return false;
+  }
+  if (error.status === void 0) {
+    return error.code === "HTTP_ERROR";
+  }
+  return error.status >= 500;
+}
+function computeBackoffMs(consecutiveFailures, baseMs, maxMs) {
+  const exponential = baseMs * 2 ** (consecutiveFailures - 1);
+  return Math.min(exponential, maxMs);
+}
+function compareInflightRuns(a, b) {
+  if (a.requiresAttention !== b.requiresAttention) {
+    return a.requiresAttention ? -1 : 1;
+  }
+  const aDispatched = a.dispatchedAt ?? "";
+  const bDispatched = b.dispatchedAt ?? "";
+  return aDispatched.localeCompare(bDispatched);
+}
+async function fetchInflightAgentRuns(client, options) {
+  const limit = options.limit ?? DEFAULT_INFLIGHT_LIMIT;
+  const page = await client.get(import_agent_runs.AGENT_RUNS_ROUTES.listAgentRuns(), {
+    projectId: options.projectId,
+    activeOnly: "true",
+    limit: String(limit)
+  });
+  const filtered = page.items.filter(
+    (run) => run.status === import_agent_run_status.AGENT_RUN_STATUS.DISPATCHED || run.status === import_agent_run_status.AGENT_RUN_STATUS.ACKNOWLEDGED
+  );
+  filtered.sort(compareInflightRuns);
+  return filtered.slice(0, limit);
+}
+async function pollAgentRuns(client, options, deps) {
+  const { projectId, timeoutMs, pollIntervalMs, limit } = options;
+  if (pollIntervalMs > timeoutMs) {
+    throw new WorkspaceError("VALIDATION_ERROR", "pollInterval must not exceed timeout");
+  }
+  const sleepFn = deps?.sleep ?? sleep;
+  const deadline = Date.now() + timeoutMs;
+  const claimLimit = limit ?? 1;
+  const retryBaseMs = options.retryBaseMs ?? DEFAULT_RETRY_BASE_MS;
+  const retryMaxMs = options.retryMaxMs ?? DEFAULT_RETRY_MAX_MS;
+  let consecutiveFailures = 0;
+  while (true) {
+    let response;
+    try {
+      response = await client.post(import_agent_runs.AGENT_RUNS_ROUTES.claimAgentRuns(), {
+        projectId,
+        limit: claimLimit
+      });
+      consecutiveFailures = 0;
+    } catch (error) {
+      if (!isTransientClaimError(error)) {
+        throw error;
+      }
+      if (Date.now() >= deadline) {
+        return { items: [], inflightRuns: [], timedOut: true };
+      }
+      consecutiveFailures += 1;
+      const backoffMs = computeBackoffMs(consecutiveFailures, retryBaseMs, retryMaxMs);
+      const remainingMs2 = deadline - Date.now();
+      await sleepFn(Math.min(backoffMs, remainingMs2));
+      continue;
+    }
+    if (response.items.length > 0) {
+      return { items: response.items, inflightRuns: [], timedOut: false };
+    }
+    const inflightRuns = await fetchInflightAgentRuns(client, { projectId, limit: claimLimit });
+    if (inflightRuns.length > 0) {
+      return { items: [], inflightRuns, timedOut: false };
+    }
+    if (Date.now() >= deadline) {
+      return { items: [], inflightRuns: [], timedOut: true };
+    }
+    const remainingMs = deadline - Date.now();
+    const waitMs = Math.min(pollIntervalMs, remainingMs);
+    await sleepFn(waitMs);
+  }
+}
+
+// src/orchestrator/orchestrator-transport.ts
+var OrchestratorTransport = class {
+  constructor(client, options = {}) {
+    this.client = client;
+    this.options = options;
+  }
+  async claimAndPoll(options, deps) {
+    return pollAgentRuns(this.client, options, deps);
+  }
+  async fetchInflightRuns(projectId, limit) {
+    return fetchInflightAgentRuns(this.client, { projectId, limit });
+  }
+  async ackRun(agentRunId, note) {
+    const body = note !== void 0 ? { note } : void 0;
+    return this.client.patch(import_agent_runs2.AGENT_RUNS_ROUTES.acknowledgeAgentRun(agentRunId), body);
+  }
+  async setAttention(agentRunId, requiresAttention, message) {
+    const body = requiresAttention ? { requiresAttention: true, attentionMessage: message ?? "" } : { requiresAttention: false };
+    return this.client.patch(import_agent_runs2.AGENT_RUNS_ROUTES.setAgentRunAttention(agentRunId), body);
+  }
+  async completeRun(agentRunId, body) {
+    return this.client.post(import_agent_runs2.AGENT_RUNS_ROUTES.completeAgentRun(agentRunId), body);
+  }
+  async listAttachments(workItemId) {
+    return fetchAttachments(this.client, workItemId);
+  }
+  async downloadAttachments(workItemId, workspaceRoot, attachmentIds) {
+    return downloadWorkItemAttachments(this.client, {
+      workItemId,
+      workspaceRoot,
+      attachmentIds,
+      blockSensitiveAttachments: this.options.blockSensitiveAttachments ?? true
+    });
+  }
+  async syncSubagents(projectId, workspaceRoot) {
+    return syncProjectSubagents(this.client, { projectId, workspaceRoot });
+  }
+  async createComment(workItemId, body) {
+    return postComment(this.client, workItemId, body);
+  }
+};
+function createOrchestratorTransport(client, config) {
+  return new OrchestratorTransport(client, {
+    workspaceRoot: config?.workspaceRoot,
+    blockSensitiveAttachments: config?.blockSensitiveAttachments
+  });
+}
+
+// src/orchestrator/active-run-state.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join3 } from "node:path";
+var ACTIVE_RUN_STATE_RELATIVE_PATH = ".cursor/orchestrator-active-run.json";
+var ATTENTION_PENDING_RELATIVE_PATH = ".cursor/orchestrator-attention-pending.json";
+var ACTIVE_RUN_LEASE_MINUTES = 30;
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isUuid(value) {
+  return UUID_PATTERN.test(value);
+}
+function isIsoDateTimeString(value) {
+  return !Number.isNaN(Date.parse(value));
+}
+function getActiveRunStatePath(workspaceRoot) {
+  return join3(workspaceRoot, ACTIVE_RUN_STATE_RELATIVE_PATH);
+}
+function getAttentionPendingPath(workspaceRoot) {
+  return join3(workspaceRoot, ATTENTION_PENDING_RELATIVE_PATH);
+}
+function computeExpiresAt(acknowledgedAt, leaseMinutes = ACTIVE_RUN_LEASE_MINUTES) {
+  const expiresMs = Date.parse(acknowledgedAt) + leaseMinutes * 60 * 1e3;
+  return new Date(expiresMs).toISOString();
+}
+function ensureCursorDir(workspaceRoot) {
+  const cursorDir = join3(workspaceRoot, ".cursor");
+  if (!existsSync4(cursorDir)) {
+    mkdirSync2(cursorDir, { recursive: true });
+  }
+}
+function parseActiveRunState(raw) {
+  if (!isRecord(raw)) {
+    return null;
+  }
+  const version = raw.version;
+  const agentRunId = raw.agentRunId;
+  const workItemId = raw.workItemId;
+  const projectId = raw.projectId;
+  const acknowledgedAt = raw.acknowledgedAt;
+  const expiresAt = raw.expiresAt;
+  if (version !== 1 || typeof agentRunId !== "string" || typeof workItemId !== "string" || typeof projectId !== "string" || typeof acknowledgedAt !== "string" || typeof expiresAt !== "string" || !isUuid(agentRunId) || !isUuid(workItemId) || !isUuid(projectId) || !isIsoDateTimeString(acknowledgedAt) || !isIsoDateTimeString(expiresAt)) {
+    return null;
+  }
+  return {
+    version: 1,
+    agentRunId,
+    workItemId,
+    projectId,
+    acknowledgedAt,
+    expiresAt
+  };
+}
+function parseAttentionPendingState(raw) {
+  if (!isRecord(raw)) {
+    return null;
+  }
+  const agentRunId = raw.agentRunId;
+  const reportedAt = raw.reportedAt;
+  if (typeof agentRunId !== "string" || typeof reportedAt !== "string" || !isUuid(agentRunId) || !isIsoDateTimeString(reportedAt)) {
+    return null;
+  }
+  return { agentRunId, reportedAt };
+}
+function isActiveRunStateUsable(state, nowMs = Date.now()) {
+  if (state === null) {
+    return false;
+  }
+  const expiresMs = Date.parse(state.expiresAt);
+  if (Number.isNaN(expiresMs)) {
+    return false;
+  }
+  return nowMs < expiresMs;
+}
+function readActiveRunState(workspaceRoot) {
+  const filePath = getActiveRunStatePath(workspaceRoot);
+  if (!existsSync4(filePath)) {
+    return null;
+  }
+  try {
+    const content = readFileSync2(filePath, "utf8");
+    const parsed = JSON.parse(content);
+    return parseActiveRunState(parsed);
+  } catch {
+    return null;
+  }
+}
+function writeActiveRunState(workspaceRoot, input) {
+  ensureCursorDir(workspaceRoot);
+  const state = {
+    version: 1,
+    agentRunId: input.agentRunId,
+    workItemId: input.workItemId,
+    projectId: input.projectId,
+    acknowledgedAt: input.acknowledgedAt,
+    expiresAt: computeExpiresAt(input.acknowledgedAt)
+  };
+  writeFileSync2(getActiveRunStatePath(workspaceRoot), `${JSON.stringify(state, null, 2)}
+`, "utf8");
+  return state;
+}
+function clearActiveRunState(workspaceRoot) {
+  const filePath = getActiveRunStatePath(workspaceRoot);
+  if (existsSync4(filePath)) {
+    rmSync(filePath, { force: true });
+  }
+}
+function readAttentionPendingState(workspaceRoot) {
+  const filePath = getAttentionPendingPath(workspaceRoot);
+  if (!existsSync4(filePath)) {
+    return null;
+  }
+  try {
+    const content = readFileSync2(filePath, "utf8");
+    const parsed = JSON.parse(content);
+    return parseAttentionPendingState(parsed);
+  } catch {
+    return null;
+  }
+}
+function writeAttentionPendingState(workspaceRoot, agentRunId) {
+  ensureCursorDir(workspaceRoot);
+  const pending = {
+    agentRunId,
+    reportedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeFileSync2(getAttentionPendingPath(workspaceRoot), `${JSON.stringify(pending, null, 2)}
+`, "utf8");
+  return pending;
+}
+function clearAttentionPendingState(workspaceRoot) {
+  const filePath = getAttentionPendingPath(workspaceRoot);
+  if (existsSync4(filePath)) {
+    rmSync(filePath, { force: true });
+  }
+}
+function clearOrchestratorBridgeState(workspaceRoot) {
+  clearActiveRunState(workspaceRoot);
+  clearAttentionPendingState(workspaceRoot);
+}
+
+// src/workspace/parse-task-boards-yaml.ts
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "node:fs";
+import { join as join4 } from "node:path";
+var TASK_BOARDS_FILE2 = ".task-boards.yaml";
+var VERSION_PATTERN = /^\s*version\s*:\s*1\s*$/m;
+var PROJECT_ID_PATTERN = /^\s*projectId\s*:\s*["']?([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})["']?\s*$/im;
+function parseTaskBoardsYaml(workspaceRoot) {
+  const filePath = join4(workspaceRoot, TASK_BOARDS_FILE2);
+  if (!existsSync5(filePath)) {
+    return null;
+  }
+  const content = readFileSync3(filePath, "utf8");
+  if (!VERSION_PATTERN.test(content)) {
+    return null;
+  }
+  const match = PROJECT_ID_PATTERN.exec(content);
+  if (match === null) {
+    return null;
+  }
+  return match[1] ?? null;
+}
+
+// src/tools/orchestrator-attention.util.ts
+var import_agent_run_status2 = __toESM(require_agent_run_status_enum(), 1);
+var ATTENTION_MESSAGE_CATEGORY = {
+  SHELL: "shell",
+  GIT: "git",
+  NETWORK: "network",
+  SMART_MODE: "smart-mode",
+  MCP: "mcp",
   FILE: "file",
   OTHER: "other"
 };
@@ -3780,10 +4502,10 @@ function deriveOrchestratorRunPhase(run) {
   if (run.requiresAttention) {
     return "awaiting_ide_approval";
   }
-  if (run.status === import_agent_run_status.AGENT_RUN_STATUS.DISPATCHED) {
+  if (run.status === import_agent_run_status2.AGENT_RUN_STATUS.DISPATCHED) {
     return "dispatched";
   }
-  if (run.status === import_agent_run_status.AGENT_RUN_STATUS.ACKNOWLEDGED) {
+  if (run.status === import_agent_run_status2.AGENT_RUN_STATUS.ACKNOWLEDGED) {
     return "acknowledged";
   }
   if (run.acknowledgedAt !== null) {
@@ -3802,1114 +4524,1067 @@ function parseAttentionMessageCategory(message) {
   }
   return ATTENTION_MESSAGE_CATEGORY.OTHER;
 }
+function formatAttentionMessage(category, detail) {
+  return `[${category}] ${detail.trim()}`;
+}
 function buildAttentionGuidance(run) {
   const phase = deriveOrchestratorRunPhase(run);
   const detectedCategory = run.attentionMessage !== null ? parseAttentionMessageCategory(run.attentionMessage) : null;
-  const reportStep = phase === "awaiting_ide_approval" ? null : `report_agent_attention(${run.id}, message) \u2014 use formatAttentionMessage(category, detail); replaces prior message on same ACK run`;
-  const clearStep = run.requiresAttention ? `clear_agent_attention(${run.id}) after resolving: ${run.attentionMessage ?? "attention flag"}` : null;
-  return {
-    phase,
-    reportStep,
-    clearStep,
-    detectedCategory,
-    templateExamples: ALL_TEMPLATE_CATEGORIES
-  };
-}
-
-// src/tools/orchestrator-hints.ts
-var SLEEPER_POLICY = {
-  singleBlockingPoll: true,
-  noParallelPoll: true,
-  noDuplicateWake: true,
-  guidance: "Run exactly one blocking poll (run_orchestrator_once or wait_for_agent_runs) per workspace at a time; do not overlap polls or stack duplicate automation wakes."
-};
-var IDLE_INFLIGHT_CHECK_STEP = "Checked inflight runs (DISPATCHED/ACKNOWLEDGED); none found \u2014 true idle.";
-var IDLE_NO_DUPLICATE_WAKE_STEP = "Schedule at most one follow-up automation wake; do not stack duplicate sleepers while a poll is in flight.";
-var PROCESSING_NO_PARALLEL_POLL_STEP = "Do not start another poll until this batch finishes.";
-var INFLIGHT_DISPATCHED_RECOVERY_STEP = "Orphan DISPATCHED \u2014 resume Task+ack; avoid duplicate Task if subagent already running in this session";
-var IDLE_TIMEOUT_DO_NOT_CLEAR_ATTENTION = "Do not clear_agent_attention on timeout; badge remains until human resolves in IDE";
-var IDLE_TIMEOUT_NEXT_STEPS = [
-  "Call sync_git_releases(projectId) to sync work-item commits",
-  IDLE_TIMEOUT_DO_NOT_CLEAR_ATTENTION,
-  "Call wait_for_agent_runs again (or run_orchestrator_once) to continue monitoring"
-];
-var IDE_ATTENTION_NOT_IN_AWAITING = "IDE attention is not in-awaiting; do not move column; replace attention message on re-report";
-var PROCESSING_NEXT_STEPS = [
-  "Call sync_project_subagents(projectId) before Task dispatch when the project uses custom subagent slugs",
-  "Agent runs only for STORY items assigned to \u0410\u0433\u0435\u043D\u0442 \u0418\u0418 (SERVICE user); assign via update_work_item before moving to agent columns",
-  "When a subagent is blocked, call report_agent_attention(agentRunId, message); clear with clear_agent_attention after resolution",
-  "After processing all runs: local git commit with work-item:{uuid} tag (always; no push on master/main)",
-  "On feature branch (not master/main): git push origin HEAD then sync_git_releases(projectId)",
-  "Parallel Task runs OK for same workItemId when agentRole differs (e.g. FRONTEND_DEVELOPER + DEVELOPER)",
-  "Claim priority: in-development > in-qa > in-analysis; in-analysis blocked while SERVICE-assigned stories exist in dev/qa",
-  "Call run_orchestrator_once or wait_for_agent_runs to continue monitoring"
-];
-var ATTENTION_PROCESSING_NEXT_STEPS = [
-  "Resolve requiresAttention runs before dispatching new Task subagents",
-  IDE_ATTENTION_NOT_IN_AWAITING,
-  "Call clear_agent_attention(agentRunId) after each blocker is resolved"
-];
-var RUN_LIFECYCLE_DOC = {
-  phases: ["dispatched", "acknowledged", "awaiting_ide_approval", "ready_to_complete"],
-  terminalPhase: "complete",
-  ideAttentionVsWorkflowAwaiting: "IDE attention (report_agent_attention on ACKNOWLEDGED runs) is not in-awaiting \u2014 do not move the story column for shell/git/network/MCP/Smart Mode approvals. Use complete_agent_run(NEEDS_CLARIFICATION) and in-awaiting only for workflow clarifications."
-};
-function buildTaskStep(run) {
-  const subagent = run.payload.suggestedSubagentType ?? "subagent";
-  return `Task(subagent_type=${subagent}, prompt=payload.contextSummary)`;
-}
-function buildCompleteStep(run) {
-  if (run.agentRole === import_subagent_role.SUBAGENT_ROLE.ARCHITECT) {
-    return "complete_agent_run after work; architect may set workItemPatch.designerRequired (boolean, default false)";
-  }
-  return "complete_agent_run after work";
-}
-function buildReportAttentionStep(run) {
-  return `report_agent_attention(${run.id}, message) if blocked awaiting human input \u2014 ${ATTENTION_MESSAGE_TEMPLATES.shell.messagePattern.replace("{detail}", "<detail>")}; replaces prior message on re-report`;
-}
-function buildProcessRunAttentionHint(run) {
-  const guidance = buildAttentionGuidance(run);
-  return {
-    phase: guidance.phase,
-    requiresAttention: run.requiresAttention,
-    message: run.attentionMessage,
-    detectedCategory: guidance.detectedCategory,
-    reportGuidance: `report_agent_attention(${run.id}, message) using formatAttentionMessage(category, detail); replaces prior message on same ACK run`,
-    clearGuidance: guidance.clearStep,
-    templateCategories: guidance.templateExamples
-  };
-}
-function buildDispatchedProcessRunSteps(run) {
-  return [
-    "sync_project_subagents(projectId) when payload.suggestedSubagentType is a project custom slug",
-    `list_work_item_attachments(${run.workItemId})`,
-    "download_work_item_attachments if needed",
-    buildTaskStep(run),
-    `ack_agent_run(${run.id})`,
-    buildReportAttentionStep(run),
-    `clear_agent_attention(${run.id}) after human resolves in IDE`,
-    buildCompleteStep(run),
-    "git commit with work-item tag (local; push only on feature branch)"
-  ];
-}
-function buildAwaitingIdeApprovalProcessRunSteps(run) {
-  return [
-    `clear_agent_attention(${run.id}) after resolving: ${run.attentionMessage ?? "attention flag"}`,
-    buildCompleteStep(run),
-    "git commit with work-item tag (local; push only on feature branch)"
-  ];
-}
-function buildAcknowledgedProcessRunSteps(run) {
-  return [
-    "Resume subagent work (Task may already be running in this session)",
-    buildReportAttentionStep(run),
-    `clear_agent_attention(${run.id}) after human resolves in IDE`,
-    buildCompleteStep(run),
-    "git commit with work-item tag (local; push only on feature branch)"
-  ];
-}
-function buildProcessRunHint(run, source) {
-  const phase = deriveOrchestratorRunPhase(run);
-  if (phase === "awaiting_ide_approval") {
-    return {
-      agentRunId: run.id,
-      workItemId: run.workItemId,
-      phase,
-      source,
-      steps: buildAwaitingIdeApprovalProcessRunSteps(run),
-      attention: buildProcessRunAttentionHint(run)
-    };
-  }
-  if (phase === "acknowledged") {
-    return {
-      agentRunId: run.id,
-      workItemId: run.workItemId,
-      phase,
-      source,
-      steps: buildAcknowledgedProcessRunSteps(run)
-    };
-  }
-  const steps = buildDispatchedProcessRunSteps(run);
-  if (source === "inflight") {
-    return {
-      agentRunId: run.id,
-      workItemId: run.workItemId,
-      phase,
-      source,
-      steps: [INFLIGHT_DISPATCHED_RECOVERY_STEP, ...steps]
-    };
-  }
-  return {
-    agentRunId: run.id,
-    workItemId: run.workItemId,
-    phase,
-    source,
-    steps
-  };
-}
-function buildProcessRuns(items, inflightRuns) {
-  const hints = [];
-  for (const run of items) {
-    if (run.requiresAttention) {
-      hints.push(buildProcessRunHint(run, "claimed"));
-    }
-  }
-  for (const run of inflightRuns) {
-    if (run.requiresAttention) {
-      hints.push(buildProcessRunHint(run, "inflight"));
-    }
-  }
-  for (const run of inflightRuns) {
-    if (!run.requiresAttention) {
-      hints.push(buildProcessRunHint(run, "inflight"));
-    }
-  }
-  for (const run of items) {
-    if (!run.requiresAttention) {
-      hints.push(buildProcessRunHint(run, "claimed"));
-    }
-  }
-  return hints;
-}
-function buildAttentionSummary(runs) {
-  const blockedRuns = runs.filter((run) => run.requiresAttention);
-  return {
-    blockedRunCount: blockedRuns.length,
-    blockedAgentRunIds: blockedRuns.map((run) => run.id),
-    resolveBeforeNewDispatch: blockedRuns.length > 0
-  };
-}
-function buildInflightSummary(inflightRuns) {
-  if (inflightRuns.length === 0) {
-    return void 0;
-  }
-  return {
-    dispatchedCount: inflightRuns.filter((run) => run.status === import_agent_run_status2.AGENT_RUN_STATUS.DISPATCHED).length,
-    acknowledgedCount: inflightRuns.filter((run) => run.status === import_agent_run_status2.AGENT_RUN_STATUS.ACKNOWLEDGED).length,
-    requiresAttentionCount: inflightRuns.filter((run) => run.requiresAttention).length,
-    agentRunIds: inflightRuns.map((run) => run.id)
-  };
-}
-function derivePollResultSource(items, inflightRuns) {
-  if (items.length > 0) {
-    return "claimed";
-  }
-  if (inflightRuns.length > 0) {
-    return "inflight";
-  }
-  return "idle";
-}
-function buildOrchestratorHints(items, inflightRuns, timedOut) {
-  const pollResultSource = derivePollResultSource(items, inflightRuns);
-  const allRuns = [...items, ...inflightRuns];
-  if (timedOut) {
-    return {
-      phase: "idle",
-      pollResultSource,
-      sleeperPolicy: SLEEPER_POLICY,
-      nextSteps: [IDLE_INFLIGHT_CHECK_STEP, ...IDLE_TIMEOUT_NEXT_STEPS, IDLE_NO_DUPLICATE_WAKE_STEP]
-    };
-  }
-  if (allRuns.length === 0) {
-    return {
-      phase: "idle",
-      pollResultSource,
-      sleeperPolicy: SLEEPER_POLICY,
-      nextSteps: [IDLE_INFLIGHT_CHECK_STEP, ...IDLE_TIMEOUT_NEXT_STEPS, IDLE_NO_DUPLICATE_WAKE_STEP]
-    };
-  }
-  const hasAttentionRuns = allRuns.some((run) => run.requiresAttention);
-  return {
-    phase: "processing",
-    pollResultSource,
-    sleeperPolicy: SLEEPER_POLICY,
-    inflightSummary: buildInflightSummary(inflightRuns),
-    processRuns: buildProcessRuns(items, inflightRuns),
-    attentionSummary: buildAttentionSummary(allRuns),
-    runLifecycle: RUN_LIFECYCLE_DOC,
-    nextSteps: hasAttentionRuns ? [PROCESSING_NO_PARALLEL_POLL_STEP, ...ATTENTION_PROCESSING_NEXT_STEPS, ...PROCESSING_NEXT_STEPS] : [PROCESSING_NO_PARALLEL_POLL_STEP, ...PROCESSING_NEXT_STEPS]
-  };
-}
-function enrichPollResult(items, inflightRuns, timedOut) {
+  const reportStep = phase === "awaiting_ide_approval" ? null : `report_agent_attention(${run.id}, message) \u2014 use formatAttentionMessage(category, detail); replaces prior message on same ACK run`;
+  const clearStep = run.requiresAttention ? `clear_agent_attention(${run.id}) after resolving: ${run.attentionMessage ?? "attention flag"}` : null;
   return {
-    items,
-    inflightRuns,
-    timedOut,
-    orchestrator: buildOrchestratorHints(items, inflightRuns, timedOut)
+    phase,
+    reportStep,
+    clearStep,
+    detectedCategory,
+    templateExamples: ALL_TEMPLATE_CATEGORIES
   };
 }
 
-// src/tools/tool-utils.ts
-var import_shared2 = __toESM(require_build2(), 1);
-
-// src/workspace/workspace-error.ts
-var WorkspaceError = class extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.name = "WorkspaceError";
+// src/attention/shell-category.util.ts
+var READONLY_SHELL_PATTERN = /^\s*(?:ls(?:\s|$)|cat\s|pwd(?:\s|$)|echo\s|git\s+status(?:\s|$)|git\s+diff(?:\s|$)|git\s+log(?:\s|$))/i;
+var GIT_DESTRUCTIVE_PATTERN = /\bgit\b.*\b(?:push|commit|checkout|reset|rebase|merge|tag|stash\s+pop|clean|fetch|pull|clone|remote|submodule)\b|\b(?:push|commit|checkout|reset|rebase|merge|tag|stash\s+pop|clean|fetch|pull|clone|remote|submodule)\b.*\bgit\b/i;
+var NETWORK_PATTERN = /\b(?:curl|wget|npm\s+(?:install|ci|publish|login)|pnpm\s+(?:install|add|i)|yarn\s+(?:install|add)|pip3?\s+install|docker\s+(?:pull|push|run|build|compose)|gh\s+api|npx\s+-y|nc\s|telnet\s|ssh\s)\b/i;
+function truncateCommand(command, maxLength) {
+  const trimmed = command.trim();
+  if (trimmed.length <= maxLength) {
+    return trimmed;
   }
-};
+  return `${trimmed.slice(0, maxLength - 1)}\u2026`;
+}
+function classifyShellCommand(command) {
+  const trimmed = command.trim();
+  if (trimmed === "") {
+    return null;
+  }
+  if (READONLY_SHELL_PATTERN.test(trimmed)) {
+    return null;
+  }
+  if (GIT_DESTRUCTIVE_PATTERN.test(trimmed)) {
+    return "git";
+  }
+  if (NETWORK_PATTERN.test(trimmed)) {
+    return "network";
+  }
+  return "shell";
+}
 
-// src/tools/tool-utils.ts
-function jsonResult(data) {
-  return {
-    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
-  };
+// src/attention/attention-message.util.ts
+function buildShellAttentionMessage(category, command) {
+  const truncated = truncateCommand(command, 200);
+  switch (category) {
+    case "git":
+      return formatAttentionMessage(ATTENTION_MESSAGE_CATEGORY.GIT, `Approve git operation: ${truncated}`);
+    case "network":
+      return formatAttentionMessage(ATTENTION_MESSAGE_CATEGORY.NETWORK, `Approve network access: ${truncated}`);
+    case "shell":
+      return formatAttentionMessage(ATTENTION_MESSAGE_CATEGORY.SHELL, `Approve shell command: ${truncated}`);
+  }
 }
-function toolError(code, message) {
-  const sanitizedMessage = shouldSanitizeResponses() ? (0, import_shared2.sanitizeMcpErrorMessage)(message) : message;
-  return {
-    isError: true,
-    content: [{ type: "text", text: JSON.stringify({ code, message: sanitizedMessage }) }]
-  };
+function buildMcpAttentionMessage(server, toolName) {
+  const detail = `${server}/${toolName}`.trim();
+  return formatAttentionMessage(ATTENTION_MESSAGE_CATEGORY.MCP, `Approve MCP / API action: ${detail}`);
 }
-function toToolError(error) {
-  if (error instanceof RestClientError || error instanceof WorkspaceError) {
-    return toolError(error.code, error.message);
+function buildSmartModeAttentionMessage(toolName, reason) {
+  const detailReason = reason !== void 0 && reason !== null && reason.trim() !== "" ? reason.trim() : "elevated permissions required";
+  return formatAttentionMessage(
+    ATTENTION_MESSAGE_CATEGORY.SMART_MODE,
+    `Approve Smart Mode: ${toolName} \u2014 ${detailReason}`
+  );
+}
+
+// src/attention/hook-payload.util.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readString(record, key) {
+  const value = record[key];
+  if (typeof value !== "string" || value.trim() === "") {
+    return null;
   }
-  const message = error instanceof Error ? error.message : "Unknown error";
-  return toolError("INTERNAL_ERROR", message);
+  return value;
 }
-async function runTool(handler, options) {
+function parseHookPayloadJson(raw) {
+  const trimmed = raw.trim();
+  if (trimmed === "") {
+    return null;
+  }
   try {
-    let data = await handler();
-    if (shouldSanitizeResponses()) {
-      data = (0, import_shared2.sanitizeMcpToolResult)(data, { workspaceRoot: options?.workspaceRoot });
+    const parsed = JSON.parse(trimmed);
+    if (!isRecord2(parsed)) {
+      return null;
     }
-    return jsonResult(data);
-  } catch (error) {
-    return toToolError(error);
+    return parsed;
+  } catch {
+    return null;
   }
 }
-
-// src/tools/wait-for-agent-runs.ts
-var import_agent_runs = __toESM(require_agent_runs_api(), 1);
-var import_agent_run_status3 = __toESM(require_agent_run_status_enum(), 1);
-var DEFAULT_RETRY_BASE_MS = 500;
-var DEFAULT_RETRY_MAX_MS = 3e4;
-var DEFAULT_INFLIGHT_LIMIT = 10;
-function sleep(ms) {
-  return new Promise((resolve4) => {
-    setTimeout(resolve4, ms);
-  });
+function extractShellCommand(payload) {
+  return readString(payload, "command");
 }
-function isTransientClaimError(error) {
-  if (!(error instanceof RestClientError)) {
-    return false;
+function extractMcpExecution(payload) {
+  const server = readString(payload, "server") ?? readString(payload, "serverName") ?? readString(payload, "mcpServer");
+  const toolName = readString(payload, "toolName") ?? readString(payload, "tool") ?? readString(payload, "mcpToolName");
+  if (server === null || toolName === null) {
+    return null;
   }
-  if (error.status === void 0) {
-    return error.code === "HTTP_ERROR";
+  return { server, toolName };
+}
+function extractPreToolUse(payload) {
+  const toolName = readString(payload, "tool_name") ?? readString(payload, "toolName") ?? readString(payload, "tool") ?? readString(payload, "name");
+  if (toolName === null) {
+    return null;
   }
-  return error.status >= 500;
+  const smartModeReason = readString(payload, "block_reason") ?? readString(payload, "smartModeBlockReason") ?? readString(payload, "smart_mode_block_reason") ?? readString(payload, "reason");
+  const permission = readString(payload, "permission");
+  const smartMode = payload.smart_mode ?? payload.smartMode;
+  const hasSmartModeSignal = smartModeReason !== null || permission === "ask" || smartMode === true || smartMode === "blocked";
+  if (!hasSmartModeSignal) {
+    return null;
+  }
+  return { toolName, smartModeReason };
 }
-function computeBackoffMs(consecutiveFailures, baseMs, maxMs) {
-  const exponential = baseMs * 2 ** (consecutiveFailures - 1);
-  return Math.min(exponential, maxMs);
+function isAfterHookEvent(event) {
+  return event === "afterShellExecution" || event === "afterMCPExecution" || event === "postToolUse";
 }
-function compareInflightRuns(a, b) {
-  if (a.requiresAttention !== b.requiresAttention) {
-    return a.requiresAttention ? -1 : 1;
+
+// src/attention/attention-cli.ts
+function defaultReadStdin() {
+  return new Promise((resolve4, reject) => {
+    const chunks = [];
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      chunks.push(Buffer.from(chunk));
+    });
+    process.stdin.on("end", () => {
+      resolve4(Buffer.concat(chunks).toString("utf8"));
+    });
+    process.stdin.on("error", reject);
+  });
+}
+function resolveBridgeWorkspaceRoot(config) {
+  try {
+    return resolveWorkspaceRoot(void 0, config.workspaceRoot);
+  } catch {
+    return null;
   }
-  const aDispatched = a.dispatchedAt ?? "";
-  const bDispatched = b.dispatchedAt ?? "";
-  return aDispatched.localeCompare(bDispatched);
 }
-async function fetchInflightAgentRuns(client, options) {
-  const limit = options.limit ?? DEFAULT_INFLIGHT_LIMIT;
-  const page = await client.get(import_agent_runs.AGENT_RUNS_ROUTES.listAgentRuns(), {
-    projectId: options.projectId,
-    activeOnly: "true",
-    limit: String(limit)
-  });
-  const filtered = page.items.filter(
-    (run) => run.status === import_agent_run_status3.AGENT_RUN_STATUS.DISPATCHED || run.status === import_agent_run_status3.AGENT_RUN_STATUS.ACKNOWLEDGED
-  );
-  filtered.sort(compareInflightRuns);
-  return filtered.slice(0, limit);
+function resolveProjectId(workspaceRoot) {
+  return parseTaskBoardsYaml(workspaceRoot);
 }
-async function pollAgentRuns(client, options, deps) {
-  const { projectId, timeoutMs, pollIntervalMs, limit } = options;
-  if (pollIntervalMs > timeoutMs) {
-    throw new WorkspaceError("VALIDATION_ERROR", "pollInterval must not exceed timeout");
+function writeActiveRunFromAck(config, run) {
+  if (config.workspaceRoot === void 0) {
+    return;
   }
-  const sleepFn = deps?.sleep ?? sleep;
-  const deadline = Date.now() + timeoutMs;
-  const claimLimit = limit ?? 1;
-  const retryBaseMs = options.retryBaseMs ?? DEFAULT_RETRY_BASE_MS;
-  const retryMaxMs = options.retryMaxMs ?? DEFAULT_RETRY_MAX_MS;
-  let consecutiveFailures = 0;
-  while (true) {
-    let response;
-    try {
-      response = await client.post(import_agent_runs.AGENT_RUNS_ROUTES.claimAgentRuns(), {
-        projectId,
-        limit: claimLimit
-      });
-      consecutiveFailures = 0;
-    } catch (error) {
-      if (!isTransientClaimError(error)) {
-        throw error;
-      }
-      if (Date.now() >= deadline) {
-        return { items: [], inflightRuns: [], timedOut: true };
-      }
-      consecutiveFailures += 1;
-      const backoffMs = computeBackoffMs(consecutiveFailures, retryBaseMs, retryMaxMs);
-      const remainingMs2 = deadline - Date.now();
-      await sleepFn(Math.min(backoffMs, remainingMs2));
-      continue;
-    }
-    if (response.items.length > 0) {
-      return { items: response.items, inflightRuns: [], timedOut: false };
-    }
-    const inflightRuns = await fetchInflightAgentRuns(client, { projectId, limit: claimLimit });
-    if (inflightRuns.length > 0) {
-      return { items: [], inflightRuns, timedOut: false };
-    }
-    if (Date.now() >= deadline) {
-      return { items: [], inflightRuns: [], timedOut: true };
-    }
-    const remainingMs = deadline - Date.now();
-    const waitMs = Math.min(pollIntervalMs, remainingMs);
-    await sleepFn(waitMs);
+  const workspaceRoot = resolveBridgeWorkspaceRoot(config);
+  if (workspaceRoot === null) {
+    return;
   }
+  const projectId = resolveProjectId(workspaceRoot);
+  if (projectId === null) {
+    return;
+  }
+  const acknowledgedAt = run.acknowledgedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  writeActiveRunState(workspaceRoot, {
+    agentRunId: run.id,
+    workItemId: run.workItemId,
+    projectId,
+    acknowledgedAt
+  });
 }
-
-// src/tools/agent-runs.ts
-var agentRunStatusValues = Object.values(import_agent_run_status4.AGENT_RUN_STATUS);
-var agentRunOutcomeValues = Object.values(import_agent_run_outcome.AGENT_RUN_OUTCOME);
-var AGENTIC_SDLC_COLUMNS_SUMMARY = "AGENTIC_SDLC has 7 columns: backlog, in-analysis (PRODUCT\u2192ANALYST\u2192ARCHITECT handoffs), in-development (DESIGNER optional, then parallel FRONTEND_DEVELOPER+DEVELOPER), in-qa, in-awaiting, done, released.";
-var COMPLETE_AGENT_RUN_OUTCOME_SUMMARY = "Prerequisite: STORY assignee must be \u0410\u0433\u0435\u043D\u0442 \u0418\u0418 (SERVICE user) \u2014 otherwise no agent_run is enqueued or claimed. in-analysis: PRODUCT/ANALYST DEFAULT \u2192 HANDOFF next phase (skip unbound roles); ANALYST SKIP_DESIGN \u2192 in-development; ARCHITECT DEFAULT \u2192 in-development (set workItemPatch.designerRequired). in-development: DESIGNER DEFAULT \u2192 DEVELOPMENT; dev role DEFAULT removes role from pendingDevRoles, moves to in-qa when empty; SKIP_DESIGN skips DESIGNER. in-qa: DEFAULT \u2192 done; HAS_BUGS \u2192 in-development (re-init pendingDevRoles). NEEDS_CLARIFICATION \u2192 in-awaiting. FAILED \u2192 no move. Claim priority: in-development > in-qa > in-analysis (SERVICE-assigned stories only block analysis).";
-function registerAgentRunTools(server, client) {
-  server.registerTool(
-    "list_agent_runs",
-    {
-      description: "List agent runs for a project (default status PENDING). Prefer wait_for_agent_runs for orchestrator long-polling.",
-      inputSchema: {
-        projectId: z.string().uuid().describe("Project UUID (required)"),
-        status: z.enum(agentRunStatusValues).optional().describe("Filter by agent run status")
-      }
-    },
-    async ({ status, projectId }) => runTool(async () => {
-      const effectiveStatus = status ?? import_agent_run_status4.AGENT_RUN_STATUS.PENDING;
-      return client.get(import_agent_runs2.AGENT_RUNS_ROUTES.listAgentRuns(), {
-        status: effectiveStatus,
-        projectId
-      });
-    })
-  );
-  server.registerTool(
-    "wait_for_agent_runs",
-    {
-      description: "Long-poll agent runs for a project: atomically claims PENDING runs (POST /agent-runs/claim). On empty claim, immediately lists inflight DISPATCHED/ACKNOWLEDGED runs (GET activeOnly) for orphan recovery before sleeping. Returns items (newly claimed), inflightRuns (resume candidates), and orchestrator hints. First claim is immediate; subsequent polls sleep pollInterval seconds only when both claim and inflight are empty.",
-      inputSchema: {
-        projectId: z.string().uuid().describe("Project UUID"),
-        timeout: z.number().int().min(1).max(300).default(120).describe("Maximum wait in seconds (1\u2013300, default 120)"),
-        pollInterval: z.number().int().min(1).max(60).default(2).describe("Seconds between polls (1\u201360, default 2); must not exceed timeout"),
-        limit: z.number().int().min(1).max(10).default(1).describe("Max runs to claim per poll (1\u201310, default 1)")
-      }
-    },
-    async ({ projectId, timeout, pollInterval, limit }) => runTool(async () => {
-      const pollResult = await pollAgentRuns(client, {
-        projectId,
-        timeoutMs: timeout * 1e3,
-        pollIntervalMs: pollInterval * 1e3,
-        limit
-      });
-      return enrichPollResult(pollResult.items, pollResult.inflightRuns, pollResult.timedOut);
-    })
-  );
-  server.registerTool(
-    "ack_agent_run",
-    {
-      description: "Acknowledge agent run delivery after Task subagent has been dispatched. Requires status DISPATCHED (DISPATCHED \u2192 ACKNOWLEDGED).",
-      inputSchema: {
-        agentRunId: z.string().uuid().describe("Agent run UUID"),
-        note: z.string().nullable().optional().describe("Optional acknowledgment note")
-      }
-    },
-    async ({ agentRunId, note }) => runTool(async () => {
-      const body = note !== void 0 ? { note } : void 0;
-      return client.patch(import_agent_runs2.AGENT_RUNS_ROUTES.acknowledgeAgentRun(agentRunId), body);
-    })
-  );
-  server.registerTool(
-    "report_agent_attention",
-    {
-      description: "Signal that the in-flight subagent needs human attention while the run is ACKNOWLEDGED. Sets requiresAttention on the agent run for orchestrator/UI visibility.",
-      inputSchema: {
-        agentRunId: z.string().uuid().describe("Agent run UUID"),
-        message: z.string().min(1).describe("Why human attention is needed")
-      }
-    },
-    async ({ agentRunId, message }) => runTool(async () => {
-      const body = {
-        requiresAttention: true,
-        attentionMessage: message
-      };
-      return client.patch(import_agent_runs2.AGENT_RUNS_ROUTES.setAgentRunAttention(agentRunId), body);
-    })
-  );
-  server.registerTool(
-    "clear_agent_attention",
-    {
-      description: "Clear the human-attention flag after the blocker is resolved. Requires the run to still be ACKNOWLEDGED.",
-      inputSchema: {
-        agentRunId: z.string().uuid().describe("Agent run UUID")
-      }
-    },
-    async ({ agentRunId }) => runTool(async () => {
-      const body = {
-        requiresAttention: false
-      };
-      return client.patch(import_agent_runs2.AGENT_RUNS_ROUTES.setAgentRunAttention(agentRunId), body);
-    })
-  );
-  server.registerTool(
-    "complete_agent_run",
-    {
-      description: `Complete agent run: apply AGENTIC_SDLC workflow transition and optional work item patch. ${AGENTIC_SDLC_COLUMNS_SUMMARY} Outcomes: ${COMPLETE_AGENT_RUN_OUTCOME_SUMMARY}`,
-      inputSchema: {
-        agentRunId: z.string().uuid().describe("Agent run UUID"),
-        outcome: z.enum(agentRunOutcomeValues).optional().describe(
-          `Completion outcome (DEFAULT, SKIP_DESIGN, HAS_BUGS, NEEDS_CLARIFICATION, FAILED). ${COMPLETE_AGENT_RUN_OUTCOME_SUMMARY}`
-        ),
-        note: z.string().nullable().optional().describe("Optional completion note"),
-        workItemPatch: z.object({
-          description: z.string().nullable().optional().describe("Updated work item description"),
-          acceptanceCriteria: z.string().nullable().optional().describe("Updated acceptance criteria"),
-          designerRequired: z.boolean().optional().describe("Architect only: whether DESIGNER phase runs before development")
-        }).nullable().optional().describe("Optional work item field updates")
-      }
-    },
-    async ({ agentRunId, outcome, note, workItemPatch }) => runTool(async () => {
-      const body = {};
-      if (outcome !== void 0) {
-        body.outcome = outcome;
-      }
-      if (note !== void 0) {
-        body.note = note;
-      }
-      if (workItemPatch !== void 0 && workItemPatch !== null) {
-        body.workItemPatch = workItemPatch;
-      }
-      const hasBody = outcome !== void 0 || note !== void 0 || workItemPatch !== void 0 && workItemPatch !== null;
-      return client.post(
-        import_agent_runs2.AGENT_RUNS_ROUTES.completeAgentRun(agentRunId),
-        hasBody ? body : void 0
-      );
-    })
-  );
-}
-
-// src/tools/orchestrator.ts
-import { z as z2 } from "zod";
-
-// src/workspace/resolve-project.ts
-var import_projects = __toESM(require_projects_api(), 1);
-import { basename } from "node:path";
-
-// src/workspace/normalize-token.ts
-function normalizeToken(value) {
-  return value.toLowerCase().normalize("NFKD").replace(/[\u0300-\u036f]/g, "").replace(/[^a-z0-9]/g, "");
+function clearActiveRunAfterComplete(config) {
+  if (config.workspaceRoot === void 0) {
+    return;
+  }
+  const workspaceRoot = resolveBridgeWorkspaceRoot(config);
+  if (workspaceRoot === null) {
+    return;
+  }
+  clearActiveRunState(workspaceRoot);
+  clearAttentionPendingState(workspaceRoot);
 }
-
-// src/workspace/auto-match-project.ts
-function toCandidate(project, matchedBy) {
-  return {
-    projectId: project.id,
-    name: project.name,
-    key: project.key,
-    presetCode: project.presetCode,
-    matchedBy
-  };
+function logCliError(deps, message) {
+  if (deps.logError !== void 0) {
+    deps.logError(message);
+    return;
+  }
+  console.error(message);
 }
-function autoMatchProject(folderToken, projects) {
-  const normalizedFolder = normalizeToken(folderToken);
-  if (normalizedFolder.length === 0) {
-    return { kind: "none" };
+function readFlagValue(args, flag) {
+  const index = args.indexOf(flag);
+  if (index === -1 || index + 1 >= args.length) {
+    return null;
   }
-  const keyMatches = [];
-  const nameMatches = [];
-  for (const project of projects) {
-    const input = {
-      id: project.id,
-      name: project.name,
-      key: project.key,
-      presetCode: project.presetCode
-    };
-    if (normalizeToken(project.key) === normalizedFolder) {
-      keyMatches.push(input);
-    }
-    if (normalizeToken(project.name) === normalizedFolder) {
-      nameMatches.push(input);
+  return args[index + 1] ?? null;
+}
+function removeConsumedFlags(args) {
+  const flagsWithValues = /* @__PURE__ */ new Set([
+    "--category",
+    "--detail",
+    "--event",
+    "--agent-run-id",
+    "--work-item-id",
+    "--project-id",
+    "--acknowledged-at"
+  ]);
+  const result = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (flagsWithValues.has(arg)) {
+      index += 1;
+      continue;
     }
+    result.push(arg);
   }
-  const uniqueById = /* @__PURE__ */ new Map();
-  for (const project of keyMatches) {
-    uniqueById.set(project.id, { project, matchedBy: "key" });
+  return result;
+}
+async function reportAttention(deps, agentRunId, message, workspaceRoot) {
+  const transport = createOrchestratorTransport(deps.client);
+  await transport.setAttention(agentRunId, true, message);
+  writeAttentionPendingState(workspaceRoot, agentRunId);
+}
+async function clearAttention(deps, workspaceRoot) {
+  const pending = readAttentionPendingState(workspaceRoot);
+  if (pending === null) {
+    return;
   }
-  for (const project of nameMatches) {
-    if (!uniqueById.has(project.id)) {
-      uniqueById.set(project.id, { project, matchedBy: "name" });
-    }
+  const active = readActiveRunState(workspaceRoot);
+  if (!isActiveRunStateUsable(active) || active.agentRunId !== pending.agentRunId) {
+    return;
   }
-  const matches = [...uniqueById.values()];
-  if (matches.length === 1) {
-    const match = matches[0];
-    if (match === void 0) {
-      return { kind: "none" };
-    }
-    return { kind: "single", project: match.project, matchedBy: match.matchedBy };
+  const transport = createOrchestratorTransport(deps.client);
+  try {
+    await transport.setAttention(active.agentRunId, false);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Failed to clear agent attention";
+    logCliError(deps, message);
+  } finally {
+    clearAttentionPendingState(workspaceRoot);
   }
-  if (matches.length > 1) {
-    return {
-      kind: "candidates",
-      candidates: matches.map((match) => toCandidate(match.project, match.matchedBy))
-    };
+}
+async function handleAttentionReport(deps, args) {
+  const category = readFlagValue(args, "--category");
+  const detail = readFlagValue(args, "--detail");
+  if (category === null || detail === null) {
+    logCliError(deps, "attention report requires --category and --detail");
+    return 0;
+  }
+  const workspaceRoot = resolveBridgeWorkspaceRoot(deps.config);
+  if (workspaceRoot === null) {
+    return 0;
+  }
+  const active = readActiveRunState(workspaceRoot);
+  if (!isActiveRunStateUsable(active)) {
+    return 0;
+  }
+  const message = `[${category}] ${detail.trim()}`;
+  try {
+    await reportAttention(deps, active.agentRunId, message, workspaceRoot);
+  } catch (error) {
+    const messageText = error instanceof Error ? error.message : "Failed to report agent attention";
+    logCliError(deps, messageText);
   }
-  return { kind: "none" };
+  return 0;
 }
-
-// src/workspace/parse-ide-rules.ts
-import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-var PROJECT_ID_LINE_PATTERN = /projectId\s*[:=]\s*["']?([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/gi;
-var TASK_BOARDS_UUID_PATTERN = /task-boards[^\n\r]*?([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/gi;
-function extractUuids(content) {
-  const ids = /* @__PURE__ */ new Set();
-  for (const pattern of [PROJECT_ID_LINE_PATTERN, TASK_BOARDS_UUID_PATTERN]) {
-    pattern.lastIndex = 0;
-    let match = pattern.exec(content);
-    while (match !== null) {
-      const id = match[1];
-      if (id !== void 0) {
-        ids.add(id.toLowerCase());
-      }
-      match = pattern.exec(content);
+async function handleAttentionReportFromHook(deps, args) {
+  const eventRaw = readFlagValue(args, "--event");
+  if (eventRaw === null) {
+    logCliError(deps, "attention report-from-hook requires --event");
+    return 0;
+  }
+  const event = eventRaw;
+  if (isAfterHookEvent(event)) {
+    return 0;
+  }
+  const readStdin = deps.readStdin ?? defaultReadStdin;
+  const stdin = await readStdin();
+  const payload = parseHookPayloadJson(stdin);
+  if (payload === null) {
+    return 0;
+  }
+  const workspaceRoot = resolveBridgeWorkspaceRoot(deps.config);
+  if (workspaceRoot === null) {
+    return 0;
+  }
+  const active = readActiveRunState(workspaceRoot);
+  if (!isActiveRunStateUsable(active)) {
+    return 0;
+  }
+  let message = null;
+  if (event === "beforeShellExecution") {
+    const command = extractShellCommand(payload);
+    if (command === null) {
+      return 0;
     }
+    const category = classifyShellCommand(command);
+    if (category === null) {
+      return 0;
+    }
+    message = buildShellAttentionMessage(category, command);
+  } else if (event === "beforeMCPExecution") {
+    const mcp = extractMcpExecution(payload);
+    if (mcp === null) {
+      return 0;
+    }
+    message = buildMcpAttentionMessage(mcp.server, mcp.toolName);
+  } else if (event === "preToolUse") {
+    const preTool = extractPreToolUse(payload);
+    if (preTool === null) {
+      return 0;
+    }
+    message = buildSmartModeAttentionMessage(preTool.toolName, preTool.smartModeReason);
   }
-  return ids;
+  if (message === null) {
+    return 0;
+  }
+  try {
+    await reportAttention(deps, active.agentRunId, message, workspaceRoot);
+  } catch (error) {
+    const messageText = error instanceof Error ? error.message : "Failed to report agent attention from hook";
+    logCliError(deps, messageText);
+  }
+  return 0;
 }
-function parseIdeRules(workspaceRoot) {
-  const rulesDir = join(workspaceRoot, ".cursor", "rules");
-  if (!existsSync(rulesDir)) {
-    return { status: "missing" };
+async function handleAttentionClear(deps) {
+  const workspaceRoot = resolveBridgeWorkspaceRoot(deps.config);
+  if (workspaceRoot === null) {
+    return 0;
   }
-  const entries = readdirSync(rulesDir, { withFileTypes: true });
-  const allIds = /* @__PURE__ */ new Set();
-  for (const entry of entries) {
-    if (!entry.isFile()) {
-      continue;
+  await clearAttention(deps, workspaceRoot);
+  return 0;
+}
+function handleOrchestratorWriteActiveRun(deps, args) {
+  const agentRunId = readFlagValue(args, "--agent-run-id");
+  const workItemId = readFlagValue(args, "--work-item-id");
+  const projectId = readFlagValue(args, "--project-id");
+  const acknowledgedAt = readFlagValue(args, "--acknowledged-at") ?? (/* @__PURE__ */ new Date()).toISOString();
+  if (agentRunId === null || workItemId === null || projectId === null) {
+    logCliError(deps, "orchestrator write-active-run requires --agent-run-id, --work-item-id, --project-id");
+    return 0;
+  }
+  const workspaceRoot = resolveBridgeWorkspaceRoot(deps.config);
+  if (workspaceRoot === null) {
+    return 0;
+  }
+  writeActiveRunState(workspaceRoot, {
+    agentRunId,
+    workItemId,
+    projectId,
+    acknowledgedAt
+  });
+  return 0;
+}
+function handleOrchestratorClearActiveRun(deps) {
+  const workspaceRoot = resolveBridgeWorkspaceRoot(deps.config);
+  if (workspaceRoot === null) {
+    return 0;
+  }
+  clearOrchestratorBridgeState(workspaceRoot);
+  return 0;
+}
+async function runAttentionCli(argv, deps) {
+  const args = removeConsumedFlags(argv);
+  const topLevel = args[0];
+  if (topLevel === "attention") {
+    const subcommand = args[1];
+    if (subcommand === "report") {
+      return handleAttentionReport(deps, argv);
     }
-    if (!entry.name.endsWith(".mdc") && !entry.name.endsWith(".md")) {
-      continue;
+    if (subcommand === "report-from-hook") {
+      return handleAttentionReportFromHook(deps, argv);
     }
-    const content = readFileSync(join(rulesDir, entry.name), "utf8");
-    for (const id of extractUuids(content)) {
-      allIds.add(id);
+    if (subcommand === "clear") {
+      return handleAttentionClear(deps);
     }
+    logCliError(deps, `Unknown attention subcommand: ${subcommand ?? "(missing)"}`);
+    return 0;
   }
-  if (allIds.size === 0) {
-    return { status: "missing" };
-  }
-  if (allIds.size === 1) {
-    const projectId = [...allIds][0];
-    if (projectId === void 0) {
-      return { status: "missing" };
+  if (topLevel === "orchestrator") {
+    const subcommand = args[1];
+    if (subcommand === "write-active-run") {
+      return handleOrchestratorWriteActiveRun(deps, argv);
     }
-    return { status: "found", projectId };
+    if (subcommand === "clear-active-run") {
+      return handleOrchestratorClearActiveRun(deps);
+    }
+    logCliError(deps, `Unknown orchestrator subcommand: ${subcommand ?? "(missing)"}`);
+    return 0;
   }
-  return { status: "ambiguous" };
+  return 1;
+}
+function isAttentionCliInvocation(argv) {
+  const topLevel = argv[0];
+  return topLevel === "attention" || topLevel === "orchestrator";
 }
 
-// src/workspace/parse-task-boards-yaml.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import { join as join2 } from "node:path";
-var TASK_BOARDS_FILE = ".task-boards.yaml";
-var VERSION_PATTERN = /^\s*version\s*:\s*1\s*$/m;
-var PROJECT_ID_PATTERN = /^\s*projectId\s*:\s*["']?([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})["']?\s*$/im;
-function parseTaskBoardsYaml(workspaceRoot) {
-  const filePath = join2(workspaceRoot, TASK_BOARDS_FILE);
-  if (!existsSync2(filePath)) {
-    return null;
+// src/config.ts
+var import_api = __toESM(require_build(), 1);
+function resolveSanitizeResponses() {
+  const raw = process.env.TASK_BOARDS_MCP_SANITIZE;
+  if (raw === void 0 || raw.trim() === "") {
+    return true;
   }
-  const content = readFileSync2(filePath, "utf8");
-  if (!VERSION_PATTERN.test(content)) {
-    return null;
+  const normalized = raw.trim().toLowerCase();
+  return normalized !== "false" && normalized !== "0" && normalized !== "no";
+}
+function resolveBlockSensitiveAttachments() {
+  const raw = process.env.TASK_BOARDS_MCP_BLOCK_SENSITIVE_ATTACHMENTS;
+  if (raw === void 0 || raw.trim() === "") {
+    return true;
   }
-  const match = PROJECT_ID_PATTERN.exec(content);
-  if (match === null) {
-    return null;
+  const normalized = raw.trim().toLowerCase();
+  return normalized !== "false" && normalized !== "0" && normalized !== "no";
+}
+function loadConfig() {
+  const apiUrl = process.env.TASK_BOARDS_API_URL ?? "http://localhost:3000";
+  const apiToken = process.env.TASK_BOARDS_API_TOKEN;
+  const workspaceRoot = process.env.WORKSPACE_ROOT;
+  if (process.env.NODE_ENV === "production" && (apiToken === void 0 || apiToken.trim() === "")) {
+    console.error("WARNING: TASK_BOARDS_API_TOKEN is not set. MCP server cannot authenticate to the Task Boards API.");
   }
-  return match[1] ?? null;
+  return {
+    apiUrl: `${apiUrl.replace(/\/$/, "")}${import_api.API_V1_PREFIX}`,
+    apiToken,
+    workspaceRoot: workspaceRoot !== void 0 && workspaceRoot.trim() !== "" ? workspaceRoot : void 0,
+    sanitizeResponses: resolveSanitizeResponses(),
+    blockSensitiveAttachments: resolveBlockSensitiveAttachments()
+  };
+}
+
+// src/index.ts
+import { createRequire } from "node:module";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// src/tools/agent-runs.ts
+var import_agent_runs3 = __toESM(require_agent_runs_api(), 1);
+var import_agent_run_outcome = __toESM(require_agent_run_outcome_enum(), 1);
+var import_agent_run_status4 = __toESM(require_agent_run_status_enum(), 1);
+import { z as z3 } from "zod";
+
+// src/tools/orchestrator-hints.ts
+var import_agent_run_status3 = __toESM(require_agent_run_status_enum(), 1);
+var import_subagent_role = __toESM(require_subagent_role_enum(), 1);
+var SLEEPER_POLICY = {
+  singleBlockingPoll: true,
+  noParallelPoll: true,
+  noDuplicateWake: true,
+  guidance: "Run exactly one blocking poll (run_orchestrator_once or wait_for_agent_runs) per workspace at a time; do not overlap polls or stack duplicate automation wakes."
+};
+var IDLE_INFLIGHT_CHECK_STEP = "Checked inflight runs (DISPATCHED/ACKNOWLEDGED); none found \u2014 true idle.";
+var IDLE_NO_DUPLICATE_WAKE_STEP = "Schedule at most one follow-up automation wake; do not stack duplicate sleepers while a poll is in flight.";
+var PROCESSING_NO_PARALLEL_POLL_STEP = "Do not start another poll until this batch finishes.";
+var INFLIGHT_DISPATCHED_RECOVERY_STEP = "Orphan DISPATCHED \u2014 resume Task+ack; avoid duplicate Task if subagent already running in this session";
+var IDLE_TIMEOUT_DO_NOT_CLEAR_ATTENTION = "Do not clear_agent_attention on timeout; badge remains until human resolves in IDE";
+var IDLE_TIMEOUT_NEXT_STEPS = [
+  "Call sync_git_releases(projectId) to sync work-item commits",
+  IDLE_TIMEOUT_DO_NOT_CLEAR_ATTENTION,
+  "Call wait_for_agent_runs again (or run_orchestrator_once) to continue monitoring"
+];
+var IDE_ATTENTION_NOT_IN_AWAITING = "IDE attention is not in-awaiting; do not move column; replace attention message on re-report";
+var PROCESSING_NEXT_STEPS = [
+  "Call sync_project_subagents(projectId) before Task dispatch when the project uses custom subagent slugs",
+  "Agent runs only for STORY items assigned to \u0410\u0433\u0435\u043D\u0442 \u0418\u0418 (SERVICE user); assign via update_work_item before moving to agent columns",
+  "When a subagent is blocked, call report_agent_attention(agentRunId, message); clear with clear_agent_attention after resolution",
+  "After processing all runs: local git commit with work-item:{uuid} tag (skip commit and sync_git_releases when any run completed with SKIP_DEV)",
+  "On feature branch (not master/main): git push origin HEAD then sync_git_releases(projectId)",
+  "Parallel Task runs OK for same workItemId when agentRole differs (e.g. FRONTEND_DEVELOPER + DEVELOPER)",
+  "Claim priority: in-development > in-qa > in-analysis; in-analysis blocked while SERVICE-assigned stories exist in dev/qa",
+  "Call run_orchestrator_once or wait_for_agent_runs to continue monitoring"
+];
+var ATTENTION_PROCESSING_NEXT_STEPS = [
+  "Resolve requiresAttention runs before dispatching new Task subagents",
+  IDE_ATTENTION_NOT_IN_AWAITING,
+  "Call clear_agent_attention(agentRunId) after each blocker is resolved"
+];
+var RUN_LIFECYCLE_DOC = {
+  phases: ["dispatched", "acknowledged", "awaiting_ide_approval", "ready_to_complete"],
+  terminalPhase: "complete",
+  ideAttentionVsWorkflowAwaiting: "IDE attention (report_agent_attention on ACKNOWLEDGED runs) is not in-awaiting \u2014 do not move the story column for shell/git/network/MCP/Smart Mode approvals. Use complete_agent_run(NEEDS_CLARIFICATION) and in-awaiting only for workflow clarifications."
+};
+function buildTaskStep(run) {
+  const subagent = run.payload.suggestedSubagentType ?? "subagent";
+  return `Task(subagent_type=${subagent}, prompt=payload.contextSummary)`;
+}
+function buildCompleteStep(run) {
+  if (run.agentRole === import_subagent_role.SUBAGENT_ROLE.ARCHITECT) {
+    return "complete_agent_run after work; architect may set workItemPatch.designerRequired (boolean, default false)";
+  }
+  if (run.agentRole === import_subagent_role.SUBAGENT_ROLE.ANALYST) {
+    return "complete_agent_run after work; use outcome SKIP_DEV when codeChangesRequired=false (released without git commit)";
+  }
+  return "complete_agent_run after work";
+}
+function buildGitCommitStep(run) {
+  if (run.agentRole === import_subagent_role.SUBAGENT_ROLE.ANALYST) {
+    return "skip git commit and sync_git_releases when outcome SKIP_DEV; otherwise git commit with work-item tag (local; push only on feature branch)";
+  }
+  return "git commit with work-item tag (local; push only on feature branch)";
+}
+function buildReportAttentionStep(run) {
+  return `report_agent_attention(${run.id}, message) if blocked awaiting human input \u2014 ${ATTENTION_MESSAGE_TEMPLATES.shell.messagePattern.replace("{detail}", "<detail>")}; replaces prior message on re-report`;
+}
+function buildProcessRunAttentionHint(run) {
+  const guidance = buildAttentionGuidance(run);
+  return {
+    phase: guidance.phase,
+    requiresAttention: run.requiresAttention,
+    message: run.attentionMessage,
+    detectedCategory: guidance.detectedCategory,
+    reportGuidance: `report_agent_attention(${run.id}, message) using formatAttentionMessage(category, detail); replaces prior message on same ACK run`,
+    clearGuidance: guidance.clearStep,
+    templateCategories: guidance.templateExamples
+  };
+}
+function buildDispatchedProcessRunSteps(run) {
+  return [
+    "sync_project_subagents(projectId) when payload.suggestedSubagentType is a project custom slug",
+    `list_work_item_attachments(${run.workItemId})`,
+    "download_work_item_attachments if needed",
+    buildTaskStep(run),
+    `ack_agent_run(${run.id})`,
+    buildReportAttentionStep(run),
+    `clear_agent_attention(${run.id}) after human resolves in IDE`,
+    buildCompleteStep(run),
+    buildGitCommitStep(run)
+  ];
 }
-
-// src/workspace/resolve-workspace-root.ts
-import { existsSync as existsSync3, statSync } from "node:fs";
-import { dirname, isAbsolute, join as join3, relative, resolve } from "node:path";
-var TASK_BOARDS_FILE2 = ".task-boards.yaml";
-var MAX_UPWARD_LEVELS = 20;
-function assertDirectory(path, source) {
-  const absolutePath = resolve(path);
-  if (!existsSync3(absolutePath)) {
-    throw new WorkspaceError("WORKSPACE_NOT_FOUND", `${source} does not exist: ${absolutePath}`);
-  }
-  const stats = statSync(absolutePath);
-  if (!stats.isDirectory()) {
-    throw new WorkspaceError("WORKSPACE_NOT_FOUND", `${source} is not a directory: ${absolutePath}`);
-  }
-  return absolutePath;
+function buildAwaitingIdeApprovalProcessRunSteps(run) {
+  return [
+    `clear_agent_attention(${run.id}) after resolving: ${run.attentionMessage ?? "attention flag"}`,
+    buildCompleteStep(run),
+    buildGitCommitStep(run)
+  ];
 }
-function assertWithinAllowedRoot(target, allowedRoot) {
-  const relativePath = relative(allowedRoot, target);
-  const isNested = relativePath !== "" && !relativePath.startsWith("..") && !isAbsolute(relativePath);
-  if (target !== allowedRoot && !isNested) {
-    throw new WorkspaceError(
-      "WORKSPACE_OUT_OF_BOUNDS",
-      `workspaceRoot is outside the allowed WORKSPACE_ROOT: ${target}`
-    );
-  }
+function buildAcknowledgedProcessRunSteps(run) {
+  return [
+    "Resume subagent work (Task may already be running in this session)",
+    buildReportAttentionStep(run),
+    `clear_agent_attention(${run.id}) after human resolves in IDE`,
+    buildCompleteStep(run),
+    buildGitCommitStep(run)
+  ];
 }
-function assertGitRepository(absolutePath) {
-  if (!existsSync3(join3(absolutePath, ".git"))) {
-    throw new WorkspaceError("WORKSPACE_NOT_GIT_REPO", `workspaceRoot is not a git repository: ${absolutePath}`);
+function buildProcessRunHint(run, source) {
+  const phase = deriveOrchestratorRunPhase(run);
+  if (phase === "awaiting_ide_approval") {
+    return {
+      agentRunId: run.id,
+      workItemId: run.workItemId,
+      phase,
+      source,
+      steps: buildAwaitingIdeApprovalProcessRunSteps(run),
+      attention: buildProcessRunAttentionHint(run)
+    };
+  }
+  if (phase === "acknowledged") {
+    return {
+      agentRunId: run.id,
+      workItemId: run.workItemId,
+      phase,
+      source,
+      steps: buildAcknowledgedProcessRunSteps(run)
+    };
+  }
+  const steps = buildDispatchedProcessRunSteps(run);
+  if (source === "inflight") {
+    return {
+      agentRunId: run.id,
+      workItemId: run.workItemId,
+      phase,
+      source,
+      steps: [INFLIGHT_DISPATCHED_RECOVERY_STEP, ...steps]
+    };
   }
+  return {
+    agentRunId: run.id,
+    workItemId: run.workItemId,
+    phase,
+    source,
+    steps
+  };
 }
-function findWorkspaceRootUpward(startDir) {
-  let current = resolve(startDir);
-  for (let level = 0; level <= MAX_UPWARD_LEVELS; level += 1) {
-    const markerPath = join3(current, TASK_BOARDS_FILE2);
-    if (existsSync3(markerPath)) {
-      return current;
-    }
-    const parent = dirname(current);
-    if (parent === current) {
-      break;
+function buildProcessRuns(items, inflightRuns) {
+  const hints = [];
+  for (const run of items) {
+    if (run.requiresAttention) {
+      hints.push(buildProcessRunHint(run, "claimed"));
     }
-    current = parent;
   }
-  return null;
-}
-function resolveWorkspaceRoot(explicitOverride, envWorkspaceRoot) {
-  const allowedRoot = envWorkspaceRoot !== void 0 && envWorkspaceRoot.trim() !== "" ? assertDirectory(envWorkspaceRoot, "WORKSPACE_ROOT") : void 0;
-  if (explicitOverride !== void 0 && explicitOverride.trim() !== "") {
-    const resolved = assertDirectory(explicitOverride, "workspaceRoot");
-    if (allowedRoot !== void 0) {
-      assertWithinAllowedRoot(resolved, allowedRoot);
-    } else {
-      assertGitRepository(resolved);
+  for (const run of inflightRuns) {
+    if (run.requiresAttention) {
+      hints.push(buildProcessRunHint(run, "inflight"));
     }
-    return resolved;
   }
-  if (allowedRoot !== void 0) {
-    return allowedRoot;
+  for (const run of inflightRuns) {
+    if (!run.requiresAttention) {
+      hints.push(buildProcessRunHint(run, "inflight"));
+    }
   }
-  const fromMarker = findWorkspaceRootUpward(process.cwd());
-  if (fromMarker !== null) {
-    return fromMarker;
+  for (const run of items) {
+    if (!run.requiresAttention) {
+      hints.push(buildProcessRunHint(run, "claimed"));
+    }
   }
-  return resolve(process.cwd());
+  return hints;
 }
-
-// src/workspace/resolve-project.ts
-function emptyResponse(workspaceRoot) {
+function buildAttentionSummary(runs) {
+  const blockedRuns = runs.filter((run) => run.requiresAttention);
   return {
-    resolutionSource: "ambiguous",
-    workspaceRoot,
-    projectId: null,
-    name: null,
-    key: null,
-    presetCode: null,
-    hint: "No project binding found. Add .task-boards.yaml, an IDE rule (.cursor/rules) with projectId, or rename the folder to match a project key/name."
+    blockedRunCount: blockedRuns.length,
+    blockedAgentRunIds: blockedRuns.map((run) => run.id),
+    resolveBeforeNewDispatch: blockedRuns.length > 0
   };
 }
-function fromProject(workspaceRoot, resolutionSource, project) {
+function buildInflightSummary(inflightRuns) {
+  if (inflightRuns.length === 0) {
+    return void 0;
+  }
   return {
-    resolutionSource,
-    workspaceRoot,
-    projectId: project.id,
-    name: project.name,
-    key: project.key,
-    presetCode: project.presetCode
+    dispatchedCount: inflightRuns.filter((run) => run.status === import_agent_run_status3.AGENT_RUN_STATUS.DISPATCHED).length,
+    acknowledgedCount: inflightRuns.filter((run) => run.status === import_agent_run_status3.AGENT_RUN_STATUS.ACKNOWLEDGED).length,
+    requiresAttentionCount: inflightRuns.filter((run) => run.requiresAttention).length,
+    agentRunIds: inflightRuns.map((run) => run.id)
   };
 }
-async function enrichProject(client, workspaceRoot, resolutionSource, projectId) {
-  const project = await client.get(import_projects.PROJECTS_ROUTES.getProject(projectId));
-  return fromProject(workspaceRoot, resolutionSource, project);
-}
-async function resolveProject(client, options = {}) {
-  const workspaceRoot = resolveWorkspaceRoot(options.workspaceRootOverride, options.envWorkspaceRoot);
-  const yamlProjectId = parseTaskBoardsYaml(workspaceRoot);
-  if (yamlProjectId !== null) {
-    return enrichProject(client, workspaceRoot, "yaml", yamlProjectId);
+function derivePollResultSource(items, inflightRuns) {
+  if (items.length > 0) {
+    return "claimed";
   }
-  const rulesResult = parseIdeRules(workspaceRoot);
-  if (rulesResult.status === "ambiguous") {
+  if (inflightRuns.length > 0) {
+    return "inflight";
+  }
+  return "idle";
+}
+function buildOrchestratorHints(items, inflightRuns, timedOut) {
+  const pollResultSource = derivePollResultSource(items, inflightRuns);
+  const allRuns = [...items, ...inflightRuns];
+  if (timedOut) {
     return {
-      ...emptyResponse(workspaceRoot),
-      hint: "Multiple distinct projectId values found in .cursor/rules. Use .task-boards.yaml or set WORKSPACE_ROOT to a single-project workspace."
+      phase: "idle",
+      pollResultSource,
+      sleeperPolicy: SLEEPER_POLICY,
+      nextSteps: [IDLE_INFLIGHT_CHECK_STEP, ...IDLE_TIMEOUT_NEXT_STEPS, IDLE_NO_DUPLICATE_WAKE_STEP]
     };
   }
-  if (rulesResult.status === "found") {
-    return enrichProject(client, workspaceRoot, "rule", rulesResult.projectId);
-  }
-  const folderToken = basename(workspaceRoot);
-  const listResponse = await client.get(import_projects.PROJECTS_ROUTES.listProjects());
-  const autoMatch = autoMatchProject(folderToken, listResponse.items);
-  if (autoMatch.kind === "single") {
-    return enrichProject(client, workspaceRoot, "auto_match", autoMatch.project.id);
-  }
-  if (autoMatch.kind === "candidates") {
+  if (allRuns.length === 0) {
     return {
-      resolutionSource: "ambiguous",
-      workspaceRoot,
-      projectId: null,
-      name: null,
-      key: null,
-      presetCode: null,
-      candidates: autoMatch.candidates,
-      hint: `Multiple projects match folder name "${folderToken}". Pick one candidate or add .task-boards.yaml.`
+      phase: "idle",
+      pollResultSource,
+      sleeperPolicy: SLEEPER_POLICY,
+      nextSteps: [IDLE_INFLIGHT_CHECK_STEP, ...IDLE_TIMEOUT_NEXT_STEPS, IDLE_NO_DUPLICATE_WAKE_STEP]
     };
   }
-  return emptyResponse(workspaceRoot);
+  const hasAttentionRuns = allRuns.some((run) => run.requiresAttention);
+  return {
+    phase: "processing",
+    pollResultSource,
+    sleeperPolicy: SLEEPER_POLICY,
+    inflightSummary: buildInflightSummary(inflightRuns),
+    processRuns: buildProcessRuns(items, inflightRuns),
+    attentionSummary: buildAttentionSummary(allRuns),
+    runLifecycle: RUN_LIFECYCLE_DOC,
+    nextSteps: hasAttentionRuns ? [PROCESSING_NO_PARALLEL_POLL_STEP, ...ATTENTION_PROCESSING_NEXT_STEPS, ...PROCESSING_NEXT_STEPS] : [PROCESSING_NO_PARALLEL_POLL_STEP, ...PROCESSING_NEXT_STEPS]
+  };
 }
-
-// src/tools/orchestrator.ts
-async function runOrchestratorOnce(client, options) {
-  let projectId = options.projectId;
-  let resolutionSource = "explicit";
-  if (projectId === void 0) {
-    const resolved = await resolveProject(client, {
-      workspaceRootOverride: options.workspaceRootOverride,
-      envWorkspaceRoot: options.envWorkspaceRoot
-    });
-    if (resolved.projectId === null) {
-      const hint = resolved.hint ?? "Could not resolve project for workspace.";
-      throw new WorkspaceError("PROJECT_NOT_FOUND", hint);
-    }
-    projectId = resolved.projectId;
-    resolutionSource = resolved.resolutionSource;
-  }
-  const pollResult = await pollAgentRuns(client, {
-    projectId,
-    timeoutMs: options.timeoutMs,
-    pollIntervalMs: options.pollIntervalMs,
-    limit: options.limit
-  });
-  const enriched = enrichPollResult(pollResult.items, pollResult.inflightRuns, pollResult.timedOut);
+function enrichPollResult(items, inflightRuns, timedOut) {
   return {
-    projectId,
-    resolutionSource,
-    items: enriched.items,
-    inflightRuns: enriched.inflightRuns,
-    timedOut: enriched.timedOut,
-    orchestrator: enriched.orchestrator
+    items,
+    inflightRuns,
+    timedOut,
+    orchestrator: buildOrchestratorHints(items, inflightRuns, timedOut)
   };
 }
-function registerOrchestratorTools(server, client, config) {
+
+// src/tools/agent-runs.ts
+var agentRunStatusValues = Object.values(import_agent_run_status4.AGENT_RUN_STATUS);
+var agentRunOutcomeValues = Object.values(import_agent_run_outcome.AGENT_RUN_OUTCOME);
+var AGENTIC_SDLC_COLUMNS_SUMMARY = "AGENTIC_SDLC has 7 columns: backlog, in-analysis (PRODUCT\u2192ANALYST\u2192ARCHITECT handoffs), in-development (DESIGNER optional, then parallel FRONTEND_DEVELOPER+DEVELOPER), in-qa, in-awaiting, done, released.";
+var COMPLETE_AGENT_RUN_OUTCOME_SUMMARY = "Prerequisite: STORY assignee must be \u0410\u0433\u0435\u043D\u0442 \u0418\u0418 (SERVICE user) \u2014 otherwise no agent_run is enqueued or claimed. in-analysis: PRODUCT/ANALYST DEFAULT \u2192 HANDOFF next phase (skip unbound roles); ANALYST SKIP_DESIGN \u2192 in-development; ANALYST SKIP_DEV \u2192 released when codeChangesRequired=false (no git commit); ARCHITECT DEFAULT \u2192 in-development (set workItemPatch.designerRequired). in-development: DESIGNER DEFAULT \u2192 DEVELOPMENT; dev role DEFAULT removes role from pendingDevRoles, moves to in-qa when empty; SKIP_DESIGN skips DESIGNER. in-qa: DEFAULT \u2192 done; HAS_BUGS \u2192 in-development (re-init pendingDevRoles). NEEDS_CLARIFICATION \u2192 in-awaiting. FAILED \u2192 no move. Claim priority: in-development > in-qa > in-analysis (SERVICE-assigned stories only block analysis).";
+function registerAgentRunTools(server, client, config) {
+  server.registerTool(
+    "list_agent_runs",
+    {
+      description: "List agent runs for a project (default status PENDING). Prefer wait_for_agent_runs for orchestrator long-polling.",
+      inputSchema: {
+        projectId: z3.string().uuid().describe("Project UUID (required)"),
+        status: z3.enum(agentRunStatusValues).optional().describe("Filter by agent run status")
+      }
+    },
+    async ({ status, projectId }) => runTool(async () => {
+      const effectiveStatus = status ?? import_agent_run_status4.AGENT_RUN_STATUS.PENDING;
+      return client.get(import_agent_runs3.AGENT_RUNS_ROUTES.listAgentRuns(), {
+        status: effectiveStatus,
+        projectId
+      });
+    })
+  );
   server.registerTool(
-    "run_orchestrator_once",
+    "wait_for_agent_runs",
     {
-      description: "Resolve project (if needed), long-poll agent runs with atomic claim, and return orchestrator hints. Claims only STORY items assigned to \u0410\u0433\u0435\u043D\u0442 \u0418\u0418 (SERVICE user). Does not call sync_git_releases \u2014 the orchestrator agent decides when to sync.",
+      description: "Long-poll agent runs for a project: atomically claims PENDING runs (POST /agent-runs/claim). On empty claim, immediately lists inflight DISPATCHED/ACKNOWLEDGED runs (GET activeOnly) for orphan recovery before sleeping. Returns items (newly claimed), inflightRuns (resume candidates), and orchestrator hints. First claim is immediate; subsequent polls sleep pollInterval seconds only when both claim and inflight are empty.",
       inputSchema: {
-        projectId: z2.string().uuid().optional().describe("Project UUID; when omitted, resolves via .task-boards.yaml / .cursor/rules / folder name"),
-        timeout: z2.number().int().min(1).max(300).default(120).describe("Maximum wait in seconds (1\u2013300, default 120)"),
-        pollInterval: z2.number().int().min(1).max(60).default(2).describe("Seconds between polls (1\u201360, default 2); must not exceed timeout"),
-        limit: z2.number().int().min(1).max(10).default(1).describe("Max runs to claim per poll (1\u201310, default 1)"),
-        workspaceRoot: z2.string().optional().describe("Optional absolute workspace root; defaults to WORKSPACE_ROOT or upward search from cwd")
+        projectId: z3.string().uuid().describe("Project UUID"),
+        timeout: z3.number().int().min(1).max(300).default(120).describe("Maximum wait in seconds (1\u2013300, default 120)"),
+        pollInterval: z3.number().int().min(1).max(60).default(2).describe("Seconds between polls (1\u201360, default 2); must not exceed timeout"),
+        limit: z3.number().int().min(1).max(10).default(1).describe("Max runs to claim per poll (1\u201310, default 1)")
       }
     },
-    async ({ projectId, timeout, pollInterval, limit, workspaceRoot }) => runTool(
-      async () => runOrchestratorOnce(client, {
+    async ({ projectId, timeout, pollInterval, limit }) => runTool(async () => {
+      const pollResult = await pollAgentRuns(client, {
         projectId,
         timeoutMs: timeout * 1e3,
         pollIntervalMs: pollInterval * 1e3,
-        limit,
-        workspaceRootOverride: workspaceRoot,
-        envWorkspaceRoot: config.workspaceRoot
-      })
-    )
+        limit
+      });
+      return enrichPollResult(pollResult.items, pollResult.inflightRuns, pollResult.timedOut);
+    })
+  );
+  server.registerTool(
+    "ack_agent_run",
+    {
+      description: "Acknowledge agent run delivery after Task subagent has been dispatched. Requires status DISPATCHED (DISPATCHED \u2192 ACKNOWLEDGED).",
+      inputSchema: {
+        agentRunId: z3.string().uuid().describe("Agent run UUID"),
+        note: z3.string().nullable().optional().describe("Optional acknowledgment note")
+      }
+    },
+    async ({ agentRunId, note }) => runTool(async () => {
+      const body = note !== void 0 ? { note } : void 0;
+      const response = await client.patch(import_agent_runs3.AGENT_RUNS_ROUTES.acknowledgeAgentRun(agentRunId), body);
+      writeActiveRunFromAck(config, response);
+      return response;
+    })
+  );
+  server.registerTool(
+    "report_agent_attention",
+    {
+      description: "Signal that the in-flight subagent needs human attention while the run is ACKNOWLEDGED. Sets requiresAttention on the agent run for orchestrator/UI visibility.",
+      inputSchema: {
+        agentRunId: z3.string().uuid().describe("Agent run UUID"),
+        message: z3.string().min(1).describe("Why human attention is needed")
+      }
+    },
+    async ({ agentRunId, message }) => runTool(async () => {
+      const body = {
+        requiresAttention: true,
+        attentionMessage: message
+      };
+      return client.patch(import_agent_runs3.AGENT_RUNS_ROUTES.setAgentRunAttention(agentRunId), body);
+    })
+  );
+  server.registerTool(
+    "clear_agent_attention",
+    {
+      description: "Clear the human-attention flag after the blocker is resolved. Requires the run to still be ACKNOWLEDGED.",
+      inputSchema: {
+        agentRunId: z3.string().uuid().describe("Agent run UUID")
+      }
+    },
+    async ({ agentRunId }) => runTool(async () => {
+      const body = {
+        requiresAttention: false
+      };
+      return client.patch(import_agent_runs3.AGENT_RUNS_ROUTES.setAgentRunAttention(agentRunId), body);
+    })
+  );
+  server.registerTool(
+    "complete_agent_run",
+    {
+      description: `Complete agent run: apply AGENTIC_SDLC workflow transition and optional work item patch. ${AGENTIC_SDLC_COLUMNS_SUMMARY} Outcomes: ${COMPLETE_AGENT_RUN_OUTCOME_SUMMARY}`,
+      inputSchema: {
+        agentRunId: z3.string().uuid().describe("Agent run UUID"),
+        outcome: z3.enum(agentRunOutcomeValues).optional().describe(
+          `Completion outcome (DEFAULT, SKIP_DESIGN, SKIP_DEV, HAS_BUGS, NEEDS_CLARIFICATION, FAILED). ${COMPLETE_AGENT_RUN_OUTCOME_SUMMARY}`
+        ),
+        note: z3.string().nullable().optional().describe("Optional completion note"),
+        workItemPatch: z3.object({
+          description: z3.string().nullable().optional().describe("Updated work item description"),
+          acceptanceCriteria: z3.string().nullable().optional().describe("Updated acceptance criteria"),
+          designerRequired: z3.boolean().optional().describe("Architect only: whether DESIGNER phase runs before development")
+        }).nullable().optional().describe("Optional work item field updates")
+      }
+    },
+    async ({ agentRunId, outcome, note, workItemPatch }) => runTool(async () => {
+      const body = {};
+      if (outcome !== void 0) {
+        body.outcome = outcome;
+      }
+      if (note !== void 0) {
+        body.note = note;
+      }
+      if (workItemPatch !== void 0 && workItemPatch !== null) {
+        body.workItemPatch = workItemPatch;
+      }
+      const hasBody = outcome !== void 0 || note !== void 0 || workItemPatch !== void 0 && workItemPatch !== null;
+      const response = await client.post(
+        import_agent_runs3.AGENT_RUNS_ROUTES.completeAgentRun(agentRunId),
+        hasBody ? body : void 0
+      );
+      clearActiveRunAfterComplete(config);
+      return response;
+    })
   );
 }
 
-// src/tools/attachments.ts
-var import_attachments = __toESM(require_attachments_api(), 1);
-var import_shared3 = __toESM(require_build2(), 1);
-import { existsSync as existsSync5 } from "node:fs";
-import { z as z3 } from "zod";
+// src/tools/orchestrator.ts
+import { z as z4 } from "zod";
 
-// src/attachments/detect-mime-type.ts
-import { basename as basename2 } from "node:path";
-import { lookup as lookupMimeType } from "mime-types";
-function detectMimeType(filePath) {
-  const mimeType = lookupMimeType(basename2(filePath));
-  return typeof mimeType === "string" ? mimeType : "application/octet-stream";
-}
+// src/workspace/resolve-project.ts
+var import_projects = __toESM(require_projects_api(), 1);
+import { basename as basename3 } from "node:path";
 
-// src/attachments/staging.util.ts
-import { mkdir, writeFile } from "node:fs/promises";
-import { dirname as dirname2, resolve as resolve2 } from "node:path";
-var MAX_FILE_NAME_LENGTH = 200;
-function sanitizeFileName(name) {
-  const baseName = name.split(/[/\\]/).pop() ?? name;
-  const sanitized = baseName.replace(/[^a-zA-Z0-9._-]/g, "_");
-  return sanitized.length > MAX_FILE_NAME_LENGTH ? sanitized.slice(0, MAX_FILE_NAME_LENGTH) : sanitized;
-}
-function buildStagingPath(workspaceRoot, workItemId, attachmentId, fileName) {
-  const sanitizedFileName = sanitizeFileName(fileName);
-  return resolve2(workspaceRoot, ".task-boards", "attachments", workItemId, `${attachmentId}_${sanitizedFileName}`);
-}
-function buildStagingDir(workspaceRoot, workItemId) {
-  return resolve2(workspaceRoot, ".task-boards", "attachments", workItemId);
-}
-async function writeStagingFile(path, data) {
-  const absolutePath = resolve2(path);
-  await mkdir(dirname2(absolutePath), { recursive: true });
-  await writeFile(absolutePath, data);
+// src/workspace/normalize-token.ts
+function normalizeToken(value) {
+  return value.toLowerCase().normalize("NFKD").replace(/[\u0300-\u036f]/g, "").replace(/[^a-z0-9]/g, "");
 }
 
-// src/workspace/confine-file-path.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
-import { basename as basename3, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve3 } from "node:path";
-function confineFilePath(workspaceRoot, filePath) {
-  const resolvedRoot = resolve3(workspaceRoot);
-  const resolvedPath = isAbsolute2(filePath) ? resolve3(filePath) : resolve3(resolvedRoot, filePath);
-  const relativePath = relative2(resolvedRoot, resolvedPath);
-  if (relativePath.startsWith("..") || isAbsolute2(relativePath)) {
-    throw new WorkspaceError(
-      "FILE_OUT_OF_BOUNDS",
-      `filePath is outside workspaceRoot: ${basename3(filePath) || filePath}`
-    );
-  }
-  if (!existsSync4(resolvedPath)) {
-    throw new WorkspaceError("FILE_NOT_FOUND", `filePath does not exist: ${basename3(filePath) || filePath}`);
-  }
-  const stats = statSync2(resolvedPath);
-  if (!stats.isFile()) {
-    throw new WorkspaceError("FILE_NOT_FOUND", `filePath is not a file: ${basename3(filePath) || filePath}`);
-  }
-  return resolvedPath;
-}
-function readConfinedWorkspaceFile(workspaceRoot, filePath) {
-  const absolutePath = confineFilePath(workspaceRoot, filePath);
-  const stats = statSync2(absolutePath);
-  const buffer = readFileSync3(absolutePath);
+// src/workspace/auto-match-project.ts
+function toCandidate(project, matchedBy) {
   return {
-    absolutePath,
-    fileName: basename3(absolutePath),
-    sizeBytes: stats.size,
-    buffer
+    projectId: project.id,
+    name: project.name,
+    key: project.key,
+    presetCode: project.presetCode,
+    matchedBy
   };
 }
-
-// src/tools/attachments.ts
-var MAX_ATTACHMENT_COUNT = 20;
-var MAX_TOTAL_BYTES = 200 * 1024 * 1024;
-async function fetchAttachments(client, workItemId) {
-  return client.get(import_attachments.ATTACHMENTS_ROUTES.listAttachments(workItemId));
-}
-function filterAttachments(items, attachmentIds) {
-  if (attachmentIds === void 0 || attachmentIds.length === 0) {
-    return items;
+function autoMatchProject(folderToken, projects) {
+  const normalizedFolder = normalizeToken(folderToken);
+  if (normalizedFolder.length === 0) {
+    return { kind: "none" };
   }
-  const idSet = new Set(attachmentIds);
-  return items.filter((item) => idSet.has(item.id));
-}
-function assertDownloadLimits(attachments) {
-  if (attachments.length > MAX_ATTACHMENT_COUNT) {
-    throw new RestClientError(
-      "ATTACHMENT_LIMIT_EXCEEDED",
-      `Cannot download more than ${MAX_ATTACHMENT_COUNT} attachments at once (requested ${attachments.length})`
-    );
+  const keyMatches = [];
+  const nameMatches = [];
+  for (const project of projects) {
+    const input = {
+      id: project.id,
+      name: project.name,
+      key: project.key,
+      presetCode: project.presetCode
+    };
+    if (normalizeToken(project.key) === normalizedFolder) {
+      keyMatches.push(input);
+    }
+    if (normalizeToken(project.name) === normalizedFolder) {
+      nameMatches.push(input);
+    }
   }
-  const totalBytes = attachments.reduce((sum, attachment) => sum + attachment.sizeBytes, 0);
-  if (totalBytes > MAX_TOTAL_BYTES) {
-    throw new RestClientError(
-      "ATTACHMENT_SIZE_LIMIT_EXCEEDED",
-      `Total attachment size ${totalBytes} bytes exceeds limit of ${MAX_TOTAL_BYTES} bytes`
-    );
+  const uniqueById = /* @__PURE__ */ new Map();
+  for (const project of keyMatches) {
+    uniqueById.set(project.id, { project, matchedBy: "key" });
+  }
+  for (const project of nameMatches) {
+    if (!uniqueById.has(project.id)) {
+      uniqueById.set(project.id, { project, matchedBy: "name" });
+    }
+  }
+  const matches = [...uniqueById.values()];
+  if (matches.length === 1) {
+    const match = matches[0];
+    if (match === void 0) {
+      return { kind: "none" };
+    }
+    return { kind: "single", project: match.project, matchedBy: match.matchedBy };
+  }
+  if (matches.length > 1) {
+    return {
+      kind: "candidates",
+      candidates: matches.map((match) => toCandidate(match.project, match.matchedBy))
+    };
   }
+  return { kind: "none" };
 }
-async function downloadWorkItemAttachments(client, params) {
-  const { workItemId, workspaceRoot, attachmentIds, overwrite = false, blockSensitiveAttachments = true } = params;
-  const listResponse = await fetchAttachments(client, workItemId);
-  const selected = filterAttachments(listResponse.items, attachmentIds);
-  assertDownloadLimits(selected);
-  const stagingDir = buildStagingDir(workspaceRoot, workItemId);
-  const downloaded = [];
-  const skipped = [];
-  if (attachmentIds !== void 0 && attachmentIds.length > 0) {
-    const selectedIds = new Set(selected.map((item) => item.id));
-    for (const attachmentId of attachmentIds) {
-      if (!selectedIds.has(attachmentId)) {
-        skipped.push({ attachmentId, reason: "not found on work item" });
+
+// src/workspace/parse-ide-rules.ts
+import { existsSync as existsSync6, readdirSync, readFileSync as readFileSync4 } from "node:fs";
+import { join as join5 } from "node:path";
+var PROJECT_ID_LINE_PATTERN = /projectId\s*[:=]\s*["']?([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/gi;
+var TASK_BOARDS_UUID_PATTERN = /task-boards[^\n\r]*?([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})/gi;
+function extractUuids(content) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const pattern of [PROJECT_ID_LINE_PATTERN, TASK_BOARDS_UUID_PATTERN]) {
+    pattern.lastIndex = 0;
+    let match = pattern.exec(content);
+    while (match !== null) {
+      const id = match[1];
+      if (id !== void 0) {
+        ids.add(id.toLowerCase());
       }
+      match = pattern.exec(content);
     }
   }
-  for (const attachment of selected) {
-    if (blockSensitiveAttachments && (0, import_shared3.isBlockedMcpAttachmentFileName)(attachment.fileName)) {
-      skipped.push({ attachmentId: attachment.id, reason: "blocked_sensitive_filename" });
+  return ids;
+}
+function parseIdeRules(workspaceRoot) {
+  const rulesDir = join5(workspaceRoot, ".cursor", "rules");
+  if (!existsSync6(rulesDir)) {
+    return { status: "missing" };
+  }
+  const entries = readdirSync(rulesDir, { withFileTypes: true });
+  const allIds = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (!entry.isFile()) {
       continue;
     }
-    const stagingPath = buildStagingPath(workspaceRoot, workItemId, attachment.id, attachment.fileName);
-    if (!overwrite && existsSync5(stagingPath)) {
-      skipped.push({ attachmentId: attachment.id, reason: "file already exists (set overwrite=true to replace)" });
+    if (!entry.name.endsWith(".mdc") && !entry.name.endsWith(".md")) {
       continue;
     }
-    const { data } = await client.downloadBinary(import_attachments.ATTACHMENTS_ROUTES.downloadAttachment(workItemId, attachment.id));
-    await writeStagingFile(stagingPath, data);
-    downloaded.push({
-      attachmentId: attachment.id,
-      fileName: attachment.fileName,
-      path: stagingPath,
-      sizeBytes: data.length
-    });
+    const content = readFileSync4(join5(rulesDir, entry.name), "utf8");
+    for (const id of extractUuids(content)) {
+      allIds.add(id);
+    }
+  }
+  if (allIds.size === 0) {
+    return { status: "missing" };
+  }
+  if (allIds.size === 1) {
+    const projectId = [...allIds][0];
+    if (projectId === void 0) {
+      return { status: "missing" };
+    }
+    return { status: "found", projectId };
   }
+  return { status: "ambiguous" };
+}
+
+// src/workspace/resolve-project.ts
+function emptyResponse(workspaceRoot) {
   return {
-    workItemId,
-    downloaded,
-    skipped,
-    stagingDir
+    resolutionSource: "ambiguous",
+    workspaceRoot,
+    projectId: null,
+    name: null,
+    key: null,
+    presetCode: null,
+    hint: "No project binding found. Add .task-boards.yaml, an IDE rule (.cursor/rules) with projectId, or rename the folder to match a project key/name."
   };
 }
-async function uploadWorkItemAttachment(client, params) {
-  const { workItemId, workspaceRoot, filePath, blockSensitiveAttachments = true } = params;
-  const confinedFile = readConfinedWorkspaceFile(workspaceRoot, filePath);
-  if (blockSensitiveAttachments && (0, import_shared3.isBlockedMcpAttachmentFileName)(confinedFile.fileName)) {
-    throw new RestClientError(
-      "BLOCKED_SENSITIVE_FILENAME",
-      `Attachment filename is blocked for MCP upload: ${confinedFile.fileName}`
-    );
+function fromProject(workspaceRoot, resolutionSource, project) {
+  return {
+    resolutionSource,
+    workspaceRoot,
+    projectId: project.id,
+    name: project.name,
+    key: project.key,
+    presetCode: project.presetCode
+  };
+}
+async function enrichProject(client, workspaceRoot, resolutionSource, projectId) {
+  const project = await client.get(import_projects.PROJECTS_ROUTES.getProject(projectId));
+  return fromProject(workspaceRoot, resolutionSource, project);
+}
+async function resolveProject(client, options = {}) {
+  const workspaceRoot = resolveWorkspaceRoot(options.workspaceRootOverride, options.envWorkspaceRoot);
+  const yamlProjectId = parseTaskBoardsYaml(workspaceRoot);
+  if (yamlProjectId !== null) {
+    return enrichProject(client, workspaceRoot, "yaml", yamlProjectId);
   }
-  const mimeType = detectMimeType(confinedFile.absolutePath);
-  const attachment = await client.uploadMultipart(
-    import_attachments.ATTACHMENTS_ROUTES.uploadAttachment(workItemId),
-    "file",
-    {
-      buffer: confinedFile.buffer,
-      fileName: confinedFile.fileName,
-      mimeType
+  const rulesResult = parseIdeRules(workspaceRoot);
+  if (rulesResult.status === "ambiguous") {
+    return {
+      ...emptyResponse(workspaceRoot),
+      hint: "Multiple distinct projectId values found in .cursor/rules. Use .task-boards.yaml or set WORKSPACE_ROOT to a single-project workspace."
+    };
+  }
+  if (rulesResult.status === "found") {
+    return enrichProject(client, workspaceRoot, "rule", rulesResult.projectId);
+  }
+  const folderToken = basename3(workspaceRoot);
+  const listResponse = await client.get(import_projects.PROJECTS_ROUTES.listProjects());
+  const autoMatch = autoMatchProject(folderToken, listResponse.items);
+  if (autoMatch.kind === "single") {
+    return enrichProject(client, workspaceRoot, "auto_match", autoMatch.project.id);
+  }
+  if (autoMatch.kind === "candidates") {
+    return {
+      resolutionSource: "ambiguous",
+      workspaceRoot,
+      projectId: null,
+      name: null,
+      key: null,
+      presetCode: null,
+      candidates: autoMatch.candidates,
+      hint: `Multiple projects match folder name "${folderToken}". Pick one candidate or add .task-boards.yaml.`
+    };
+  }
+  return emptyResponse(workspaceRoot);
+}
+
+// src/tools/orchestrator.ts
+async function runOrchestratorOnce(client, options) {
+  let projectId = options.projectId;
+  let resolutionSource = "explicit";
+  if (projectId === void 0) {
+    const resolved = await resolveProject(client, {
+      workspaceRootOverride: options.workspaceRootOverride,
+      envWorkspaceRoot: options.envWorkspaceRoot
+    });
+    if (resolved.projectId === null) {
+      const hint = resolved.hint ?? "Could not resolve project for workspace.";
+      throw new WorkspaceError("PROJECT_NOT_FOUND", hint);
     }
-  );
+    projectId = resolved.projectId;
+    resolutionSource = resolved.resolutionSource;
+  }
+  const pollResult = await pollAgentRuns(client, {
+    projectId,
+    timeoutMs: options.timeoutMs,
+    pollIntervalMs: options.pollIntervalMs,
+    limit: options.limit
+  });
+  const enriched = enrichPollResult(pollResult.items, pollResult.inflightRuns, pollResult.timedOut);
   return {
-    workItemId,
-    attachment,
-    sourcePath: confinedFile.absolutePath
+    projectId,
+    resolutionSource,
+    items: enriched.items,
+    inflightRuns: enriched.inflightRuns,
+    timedOut: enriched.timedOut,
+    orchestrator: enriched.orchestrator
   };
 }
-function registerAttachmentTools(server, client, config) {
-  server.registerTool(
-    "list_work_item_attachments",
-    {
-      description: "List file attachments for a work item.",
-      inputSchema: {
-        workItemId: z3.string().uuid().describe("Work item UUID")
-      }
-    },
-    async ({ workItemId }) => runTool(async () => fetchAttachments(client, workItemId))
-  );
-  server.registerTool(
-    "download_work_item_attachments",
-    {
-      description: "Download work item attachments into the local workspace staging directory (.task-boards/attachments).",
-      inputSchema: {
-        workItemId: z3.string().uuid().describe("Work item UUID"),
-        attachmentIds: z3.array(z3.string().uuid()).optional().describe("Optional subset of attachment UUIDs; downloads all when omitted"),
-        overwrite: z3.boolean().optional().default(false).describe("Replace existing staged files when true"),
-        workspaceRoot: z3.string().optional().describe("Optional absolute path to git repo root; defaults to WORKSPACE_ROOT or upward search from cwd")
-      }
-    },
-    async ({ workItemId, attachmentIds, overwrite, workspaceRoot }) => {
-      const resolvedWorkspaceRoot = resolveWorkspaceRoot(workspaceRoot, config.workspaceRoot);
-      return runTool(
-        async () => downloadWorkItemAttachments(client, {
-          workItemId,
-          workspaceRoot: resolvedWorkspaceRoot,
-          attachmentIds,
-          overwrite,
-          blockSensitiveAttachments: config.blockSensitiveAttachments
-        }),
-        { workspaceRoot: resolvedWorkspaceRoot }
-      );
-    }
-  );
+function registerOrchestratorTools(server, client, config) {
   server.registerTool(
-    "upload_work_item_attachment",
+    "run_orchestrator_once",
     {
-      description: "Upload a local workspace file as a work item attachment (multipart field file).",
+      description: "Resolve project (if needed), long-poll agent runs with atomic claim, and return orchestrator hints. Claims only STORY items assigned to \u0410\u0433\u0435\u043D\u0442 \u0418\u0418 (SERVICE user). Does not call sync_git_releases \u2014 the orchestrator agent decides when to sync.",
       inputSchema: {
-        workItemId: z3.string().uuid().describe("Work item UUID"),
-        filePath: z3.string().describe("Absolute or workspace-relative path to the file; must stay within workspaceRoot"),
-        workspaceRoot: z3.string().optional().describe("Optional absolute path to git repo root; defaults to WORKSPACE_ROOT or upward search from cwd")
+        projectId: z4.string().uuid().optional().describe("Project UUID; when omitted, resolves via .task-boards.yaml / .cursor/rules / folder name"),
+        timeout: z4.number().int().min(1).max(300).default(120).describe("Maximum wait in seconds (1\u2013300, default 120)"),
+        pollInterval: z4.number().int().min(1).max(60).default(2).describe("Seconds between polls (1\u201360, default 2); must not exceed timeout"),
+        limit: z4.number().int().min(1).max(10).default(1).describe("Max runs to claim per poll (1\u201310, default 1)"),
+        workspaceRoot: z4.string().optional().describe("Optional absolute workspace root; defaults to WORKSPACE_ROOT or upward search from cwd")
       }
     },
-    async ({ workItemId, filePath, workspaceRoot }) => {
-      const resolvedWorkspaceRoot = resolveWorkspaceRoot(workspaceRoot, config.workspaceRoot);
-      return runTool(
-        async () => uploadWorkItemAttachment(client, {
-          workItemId,
-          workspaceRoot: resolvedWorkspaceRoot,
-          filePath,
-          blockSensitiveAttachments: config.blockSensitiveAttachments
-        }),
-        { workspaceRoot: resolvedWorkspaceRoot }
-      );
-    }
+    async ({ projectId, timeout, pollInterval, limit, workspaceRoot }) => runTool(
+      async () => runOrchestratorOnce(client, {
+        projectId,
+        timeoutMs: timeout * 1e3,
+        pollIntervalMs: pollInterval * 1e3,
+        limit,
+        workspaceRootOverride: workspaceRoot,
+        envWorkspaceRoot: config.workspaceRoot
+      })
+    )
   );
 }
 
 // src/tools/board.ts
 var import_boards = __toESM(require_boards_api(), 1);
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 function registerBoardTools(server, client) {
   server.registerTool(
     "get_board",
     {
       description: "Get board projection for a project (columns and on-board work items).",
       inputSchema: {
-        projectId: z4.string().uuid().describe("Project UUID")
+        projectId: z5.string().uuid().describe("Project UUID")
       }
     },
     async ({ projectId }) => runTool(async () => client.get(import_boards.BOARDS_ROUTES.getBoard(projectId)))
   );
 }
 
-// src/tools/comments.ts
-var import_comments = __toESM(require_comments_api(), 1);
-import { z as z5 } from "zod";
-async function fetchComments(client, workItemId) {
-  return client.get(import_comments.COMMENTS_ROUTES.listComments(workItemId));
-}
-async function postComment(client, workItemId, body) {
-  const request = { body };
-  return client.post(import_comments.COMMENTS_ROUTES.createComment(workItemId), request);
-}
-function registerCommentTools(server, client) {
-  server.registerTool(
-    "list_comments",
-    {
-      description: "List comments for a work item (newest last).",
-      inputSchema: {
-        workItemId: z5.string().uuid().describe("Work item UUID")
-      }
-    },
-    async ({ workItemId }) => runTool(async () => fetchComments(client, workItemId))
-  );
-  server.registerTool(
-    "create_comment",
-    {
-      description: "Create a comment on a work item. Use for orchestrator NEEDS_CLARIFICATION questions before complete_agent_run.",
-      inputSchema: {
-        workItemId: z5.string().uuid().describe("Work item UUID"),
-        body: z5.string().min(1).describe("Comment body (markdown supported)")
-      }
-    },
-    async ({ workItemId, body }) => runTool(async () => postComment(client, workItemId, body))
-  );
-}
-
 // src/tools/labels.ts
 var import_label_color = __toESM(require_label_color_enum(), 1);
 var import_labels = __toESM(require_labels_api(), 1);
@@ -5306,44 +5981,6 @@ function registerSyncGitReleasesTools(server, client, config) {
 
 // src/tools/sync-project-subagents.ts
 import { z as z10 } from "zod";
-
-// src/subagents/sync-project-subagents.ts
-var import_shared4 = __toESM(require_build2(), 1);
-import { mkdirSync, writeFileSync } from "node:fs";
-import { join as join4 } from "node:path";
-var SAFE_SUBAGENT_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-var MAX_SUBAGENT_SLUG_LENGTH = 64;
-function isSyncableSlug(slug) {
-  const trimmed = slug.trim();
-  return trimmed.length > 0 && trimmed.length <= MAX_SUBAGENT_SLUG_LENGTH && SAFE_SUBAGENT_SLUG_PATTERN.test(trimmed);
-}
-function buildFileContent(subagent) {
-  return (0, import_shared4.buildSubagentFileContentFromBody)({
-    slug: subagent.slug,
-    description: subagent.description,
-    bodyMarkdown: subagent.bodyMarkdown
-  });
-}
-async function syncProjectSubagents(client, params) {
-  const { projectId, workspaceRoot } = params;
-  const listResponse = await client.get(import_shared4.PROJECT_SUBAGENTS_ROUTES.listSubagents(projectId));
-  const directory = join4(workspaceRoot, ".cursor", "agents");
-  mkdirSync(directory, { recursive: true });
-  const synced = [];
-  const skipped = [];
-  for (const subagent of listResponse.items) {
-    if (!isSyncableSlug(subagent.slug)) {
-      skipped.push(subagent.slug);
-      continue;
-    }
-    const filePath = join4(directory, `${subagent.slug}.md`);
-    writeFileSync(filePath, buildFileContent(subagent), "utf8");
-    synced.push(subagent.slug);
-  }
-  return { synced, skipped, directory };
-}
-
-// src/tools/sync-project-subagents.ts
 function registerSyncProjectSubagentsTools(server, client, config) {
   server.registerTool(
     "sync_project_subagents",
@@ -5499,6 +6136,7 @@ function registerWorkItemTools(server, client) {
         assigneeUserId: z11.string().uuid().nullable().optional().describe(
           "Project member user id assignee; set to \xAB\u0410\u0433\u0435\u043D\u0442 \u0418\u0418\xBB (SERVICE user) for AI orchestrator to process the STORY. Changing assignee from SERVICE to a human cancels pending agent runs for that work item."
         ),
+        codeChangesRequired: z11.boolean().optional().describe("STORY only: when false, ANALYST may complete with SKIP_DEV to release without code/git"),
         labelIds: z11.array(z11.string().uuid()).max(10).optional().describe("Replace work item labels (up to 10)")
       }
     },
@@ -5513,6 +6151,7 @@ function registerWorkItemTools(server, client) {
       storyPoints,
       estimate,
       assigneeUserId,
+      codeChangesRequired,
       labelIds
     }) => runTool(async () => {
       const current = await client.get(import_work_items.WORK_ITEMS_ROUTES.getWorkItem(workItemId));
@@ -5526,6 +6165,7 @@ function registerWorkItemTools(server, client) {
         storyPoints,
         estimate,
         assigneeUserId,
+        codeChangesRequired,
         labelIds,
         version: current.version
       };
@@ -5584,7 +6224,7 @@ function registerTools(server, client, config) {
   registerLabelTools(server, client);
   registerAttachmentTools(server, client, config);
   registerBoardTools(server, client);
-  registerAgentRunTools(server, client);
+  registerAgentRunTools(server, client, config);
   registerOrchestratorTools(server, client, config);
   registerSyncGitReleasesTools(server, client, config);
   registerSyncProjectSubagentsTools(server, client, config);
@@ -5607,7 +6247,17 @@ async function main() {
 }
 
 // src/cli.ts
-main().catch((error) => {
+async function main2() {
+  const argv = process.argv.slice(2);
+  if (isAttentionCliInvocation(argv)) {
+    const config = loadConfig();
+    const client = new RestClient(config.apiUrl, config.apiToken);
+    const exitCode = await runAttentionCli(argv, { config, client });
+    process.exit(exitCode);
+  }
+  await main();
+}
+main2().catch((error) => {
   const message = error instanceof Error ? error.message : "Failed to start MCP server";
   console.error(message);
   process.exit(1);