@task0/cli 0.2.1 → 0.4.1

package/dist/main.js

@@ -58,14 +58,14 @@ function generateObjectId(type) {
 function isTaskObjectId(id) {
   return TASK_ID_RE.test(id);
 }
-var RESOURCE_PREFIXES, PREFIX_TO_TYPE, BASE62, ID_LEN, BASE, MOD, TASK_ID_RE, PREFIXES_PATTERN, OBJECT_ID_RE;
+var RESOURCE_PREFIXES, LEGACY_PREFIX_TO_TYPE, PREFIX_TO_TYPE, BASE62, ID_LEN, BASE, MOD, TASK_ID_RE, PREFIXES_PATTERN, OBJECT_ID_RE;
 var init_object_id = __esm({
   "../../packages/shared/dist/object-id.js"() {
     "use strict";
     RESOURCE_PREFIXES = {
       task: "tsk",
       project: "prj",
-      runtime: "rt",
+      agent_run: "run",
       issue: "iss",
       inbox: "ibx",
       inbox_note: "note",
@@ -81,7 +81,15 @@ var init_object_id = __esm({
       task_kr_link: "krl",
       task_comment: "cmt",
       agent: "agt",
-      daemon: "dmn"
+      daemon: "dmn",
+      user: "usr",
+      runtime_profile: "rtp",
+      api_token: "apit",
+      automation: "aut",
+      automation_run: "autr"
+    };
+    LEGACY_PREFIX_TO_TYPE = {
+      rt: "agent_run"
     };
     PREFIX_TO_TYPE = Object.fromEntries(Object.entries(RESOURCE_PREFIXES).map(([k, v]) => [v, k]));
     BASE62 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
@@ -89,7 +97,10 @@ var init_object_id = __esm({
     BASE = 62n;
     MOD = BASE ** BigInt(ID_LEN);
     TASK_ID_RE = /^tsk_[A-Za-z0-9]{5,12}$/;
-    PREFIXES_PATTERN = Object.values(RESOURCE_PREFIXES).join("|");
+    PREFIXES_PATTERN = [
+      ...Object.values(RESOURCE_PREFIXES),
+      ...Object.keys(LEGACY_PREFIX_TO_TYPE)
+    ].join("|");
     OBJECT_ID_RE = new RegExp(`\\b(?:${PREFIXES_PATTERN})_[A-Za-z0-9]{5,12}\\b`, "g");
   }
 });
@@ -444,8 +455,14 @@ async function updateTaskWorkflow(taskYml, patch) {
     const raw = readTaskYaml(taskYml);
     const current = raw.workflow || {};
     const merged = { ...current, ...patch, updated_at: (/* @__PURE__ */ new Date()).toISOString() };
-    if (patch.runtimes) {
-      merged.runtimes = { ...current.runtimes || {}, ...patch.runtimes };
+    if (patch.runtimes || patch.agent_runs || current.runtimes || current.agent_runs) {
+      merged.agent_runs = {
+        ...current.runtimes || {},
+        ...current.agent_runs || {},
+        ...patch.runtimes || {},
+        ...patch.agent_runs || {}
+      };
+      delete merged.runtimes;
     }
     if (patch.decisions) {
       const next = { ...current.decisions || {} };
@@ -903,8 +920,8 @@ var init_task_state2 = __esm({
 // src/main.ts
 import { readFileSync } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import path24 from "path";
-import { Command as Command22 } from "commander";
+import path25 from "path";
+import { Command as Command23 } from "commander";
 
 // src/commands/source.ts
 import { Command } from "commander";
@@ -1122,7 +1139,7 @@ async function request(method, pathname, body) {
     });
   } catch (error2) {
     const err = new Error(
-      `Cannot reach task0 API at ${apiBaseUrl()}. Start it with \`task0 serve\` (or \`task0 ui\` for dev).`
+      `Cannot reach task0 API at ${apiBaseUrl()}. Start the task0-server binary (download from GitHub Releases) or repoint TASK0_API_URL.`
     );
     err.cause = error2;
     throw err;
@@ -1144,11 +1161,11 @@ async function request(method, pathname, body) {
   return parsed;
 }
 var api = {
-  get: (path25) => request("GET", path25),
-  post: (path25, body) => request("POST", path25, body ?? {}),
-  put: (path25, body) => request("PUT", path25, body ?? {}),
-  patch: (path25, body) => request("PATCH", path25, body ?? {}),
-  del: (path25) => request("DELETE", path25)
+  get: (path26) => request("GET", path26),
+  post: (path26, body) => request("POST", path26, body ?? {}),
+  put: (path26, body) => request("PUT", path26, body ?? {}),
+  patch: (path26, body) => request("PATCH", path26, body ?? {}),
+  del: (path26) => request("DELETE", path26)
 };
 
 // src/commands/task/triage.ts
@@ -1157,23 +1174,23 @@ import chalk3 from "chalk";
 import fs10 from "fs";
 import path10 from "path";
 
-// src/core/runtime-wait.ts
-async function getRuntime(id) {
-  return api.get(`/api/runtimes/${encodeURIComponent(id)}`);
+// src/core/agent-run-wait.ts
+async function getAgentRun(id) {
+  return api.get(`/api/agent-runs/${encodeURIComponent(id)}`);
 }
-async function waitForRuntime(id, opts = {}) {
+async function waitForAgentRun(id, opts = {}) {
   const interval = opts.intervalMs ?? 2e3;
   const deadline = opts.timeoutMs ? Date.now() + opts.timeoutMs : null;
   let lastStatus = "";
   while (true) {
-    const snap = await getRuntime(id);
+    const snap = await getAgentRun(id);
     if (snap.status !== lastStatus) {
       lastStatus = snap.status;
       opts.onTick?.(snap);
     }
     if (snap.status === "done" || snap.status === "error") return snap;
     if (deadline && Date.now() > deadline) {
-      throw new Error(`Timeout waiting for runtime ${id} (last status: ${snap.status})`);
+      throw new Error(`Timeout waiting for agent-run ${id} (last status: ${snap.status})`);
     }
     await new Promise((r) => setTimeout(r, interval));
   }
@@ -1251,11 +1268,11 @@ var triage = new Command3("triage").description("Decompose IDEA into ISSUE.md +
       `/api/agents/${encodeURIComponent(opts.agent)}/run`,
       body
     );
-    const runtimeId = resp.runtime.id;
-    if (!opts.json) console.log(chalk3.green(`triage runtime ${runtimeId}`));
-    await updateWorkflow(loc.taskYml, { runtimes: { triage: runtimeId } });
+    const agentRunId = resp.runtime.id;
+    if (!opts.json) console.log(chalk3.green(`triage runtime ${agentRunId}`));
+    await updateWorkflow(loc.taskYml, { agent_runs: { triage: agentRunId } });
     if (opts.wait) {
-      const final = await waitForRuntime(runtimeId, {
+      const final = await waitForAgentRun(agentRunId, {
         onTick: (s) => {
           if (!opts.json) console.log(chalk3.dim(`[triage] ${s.status}${s.phase ? " " + s.phase : ""}`));
         }
@@ -1288,7 +1305,7 @@ var triage = new Command3("triage").description("Decompose IDEA into ISSUE.md +
         console.log(chalk3.dim(`blockingQuestionCount: ${blockingQuestionCount}`));
       } else {
         console.log(JSON.stringify({
-          runtimeId,
+          agentRunId,
           issueOverview: "ISSUE.md",
           issueFiles,
           blockingQuestionCount
@@ -1296,7 +1313,7 @@ var triage = new Command3("triage").description("Decompose IDEA into ISSUE.md +
       }
       process.exit(blockingQuestionCount > 0 ? 2 : 0);
     }
-    if (opts.json) console.log(JSON.stringify({ runtimeId }, null, 2));
+    if (opts.json) console.log(JSON.stringify({ agentRunId }, null, 2));
   } catch (err) {
     console.error(chalk3.red(err.message));
     process.exit(1);
@@ -1361,24 +1378,24 @@ var exec = new Command4("exec").description("Execute a plan against the task (cw
       `/api/agents/${encodeURIComponent(opts.agent)}/run`,
       body
     );
-    const runtimeId = resp.runtime.id;
-    if (!opts.json) console.log(chalk4.green(`exec runtime ${runtimeId} (plan: ${planFile})`));
-    await updateWorkflow(loc.taskYml, { phase: "executing", runtimes: { exec: runtimeId } });
+    const agentRunId = resp.runtime.id;
+    if (!opts.json) console.log(chalk4.green(`exec runtime ${agentRunId} (plan: ${planFile})`));
+    await updateWorkflow(loc.taskYml, { phase: "executing", agent_runs: { exec: agentRunId } });
     if (opts.wait) {
-      const final = await waitForRuntime(runtimeId, {
+      const final = await waitForAgentRun(agentRunId, {
         onTick: (s) => {
           if (!opts.json) console.log(chalk4.dim(`[exec] ${s.status}${s.phase ? " " + s.phase : ""}`));
         }
       });
       if (final.status === "done") {
         if (!opts.json) console.log(chalk4.green("exec completed"));
-        if (opts.json) console.log(JSON.stringify({ runtimeId, planFile, result: final.result }, null, 2));
+        if (opts.json) console.log(JSON.stringify({ agentRunId, planFile, result: final.result }, null, 2));
         return;
       }
       console.error(chalk4.red(`exec failed: ${final.error || "unknown"}`));
       process.exit(1);
     }
-    if (opts.json) console.log(JSON.stringify({ runtimeId, planFile }, null, 2));
+    if (opts.json) console.log(JSON.stringify({ agentRunId, planFile }, null, 2));
   } catch (err) {
     console.error(chalk4.red(err.message));
     process.exit(1);
@@ -1435,13 +1452,16 @@ function preview(body, width = 60) {
   const single = body.replace(/\s+/g, " ").trim();
   return single.length > width ? single.slice(0, width - 1) + "\u2026" : single;
 }
-function printRow(c) {
+function printRow(c, indent = "") {
   const id = chalk6.cyan(c.id.padEnd(14));
   const author = chalk6.magenta(c.author.padEnd(12));
-  console.log(`${id} ${author} ${preview(c.body)}  ${chalk6.dim(c.updated_at)}`);
+  console.log(`${indent}${id} ${author} ${preview(c.body)}  ${chalk6.dim(c.updated_at)}`);
 }
 function printDetail(c) {
   console.log(`${chalk6.bold("id:")}         ${c.id}`);
+  if ("parent_comment_id" in c) {
+    console.log(`${chalk6.bold("parent:")}     ${c.parent_comment_id}`);
+  }
   console.log(`${chalk6.bold("author:")}     ${c.author}`);
   console.log(`${chalk6.bold("created:")}    ${c.created_at}`);
   console.log(`${chalk6.bold("updated:")}    ${c.updated_at}`);
@@ -1469,17 +1489,22 @@ comment.command("list <taskId>").description("List comments on a task (taskId is
       console.log(chalk6.dim("No comments."));
       return;
     }
-    for (const c of comments) printRow(c);
+    for (const c of comments) {
+      printRow(c);
+      for (const reply of c.replies ?? []) {
+        printRow(reply, chalk6.dim("  \u21B3 "));
+      }
+    }
   } catch (err) {
     fail(err);
   }
 });
-comment.command("add <taskId>").description("Add a comment to a task").option("--body <text>", "Comment body (markdown)").option("--file <path>", "Read body from file (- for stdin)").option("--author <name>", "Author label (default: user)", "user").option("--json", "Output JSON").action(async (taskId, opts) => {
+comment.command("add <taskId>").description("Add a comment to a task").option("--body <text>", "Comment body (markdown)").option("--file <path>", "Read body from file (- for stdin)").option("--author <name>", "Author label (default: user)", "user").option("--reply-to <cmtId>", "Create a second-level reply under a top-level comment").option("--json", "Output JSON").action(async (taskId, opts) => {
   try {
     const body = readBodyFromOpts(opts);
     const { comment: created } = await api.post(
       `/api/tasks/${encodeURIComponent(taskId)}/comments`,
-      { body, author: opts.author }
+      { body, author: opts.author, parent_comment_id: opts.replyTo }
     );
     if (opts.json) {
       console.log(JSON.stringify({ comment: created }, null, 2));
@@ -1814,61 +1839,9 @@ var ui = new Command9("ui").description("Launch the dashboard").option("-p, --po
   process.on("SIGTERM", () => child.kill("SIGTERM"));
 });
 
-// src/commands/serve.ts
+// src/commands/models.ts
 import { Command as Command10 } from "commander";
-import { spawn as spawn2 } from "child_process";
-import fs15 from "fs";
-import path14 from "path";
 import chalk10 from "chalk";
-var SERVER_DIR = path14.resolve(
-  import.meta.dirname,
-  "..",
-  "..",
-  "..",
-  "server"
-);
-var HTTP_ENTRY = path14.join(SERVER_DIR, "src", "main.ts");
-var CLI_TSX = path14.resolve(
-  import.meta.dirname,
-  "..",
-  "..",
-  "node_modules",
-  ".bin",
-  "tsx"
-);
-var serve = new Command10("serve").description("Run the headless task0 API server").option("-p, --port <port>", "Port number", "4318").option("-H, --host <address>", "Bind address", "127.0.0.1").action((opts) => {
-  if (!fs15.existsSync(HTTP_ENTRY)) {
-    console.error(chalk10.red(`Server entry not found: ${HTTP_ENTRY}`));
-    process.exit(1);
-  }
-  if (!fs15.existsSync(CLI_TSX)) {
-    console.error(chalk10.red(`tsx not found at ${CLI_TSX}. Run \`pnpm install\` in the CLI package.`));
-    process.exit(1);
-  }
-  console.log(chalk10.green(`Starting task0 API on http://${opts.host}:${opts.port}`));
-  const child = spawn2(CLI_TSX, [HTTP_ENTRY], {
-    cwd: SERVER_DIR,
-    stdio: "inherit",
-    env: {
-      ...process.env,
-      TASK0_API_PORT: opts.port,
-      TASK0_API_HOST: opts.host
-    }
-  });
-  child.on("error", (err) => {
-    console.error(chalk10.red(`Failed to start server: ${err.message}`));
-    process.exit(1);
-  });
-  child.on("exit", (code) => {
-    process.exit(code ?? 0);
-  });
-  process.on("SIGINT", () => child.kill("SIGINT"));
-  process.on("SIGTERM", () => child.kill("SIGTERM"));
-});
-
-// src/commands/models.ts
-import { Command as Command11 } from "commander";
-import chalk11 from "chalk";
 
 // ../../packages/shared/dist/types/agent.js
 var AGENT_KINDS = ["coding", "llm_api", "workflow"];
@@ -1880,8 +1853,8 @@ function isCodingRuntimeAgent(value) {
 }
 
 // ../../packages/shared/dist/types/runtime.js
-var RUNTIME_STATUS_VALUES = ["starting", "running", "done", "error"];
-var RUNTIME_STATUS_SET = new Set(RUNTIME_STATUS_VALUES);
+var AGENT_RUN_STATUS_VALUES = ["starting", "running", "done", "error"];
+var AGENT_RUN_STATUS_SET = new Set(AGENT_RUN_STATUS_VALUES);
 var RUNTIME_AGENTS = CODING_RUNTIME_AGENTS;
 var isRuntimeAgent = isCodingRuntimeAgent;
 var AGENT_MODEL_DEFAULTS = {
@@ -2066,31 +2039,31 @@ function refreshAgentModels(agent2) {
 function parseAgent(raw) {
   const trimmed = raw.trim();
   if (!isRuntimeAgent(trimmed)) {
-    console.error(chalk11.red(`Invalid agent "${raw}" (expected one of ${RUNTIME_AGENTS.join(", ")})`));
+    console.error(chalk10.red(`Invalid agent "${raw}" (expected one of ${RUNTIME_AGENTS.join(", ")})`));
     process.exit(1);
   }
   return trimmed;
 }
-var models = new Command11("models").description("Manage cached agent model lists");
+var models = new Command10("models").description("Manage cached agent model lists");
 models.command("refresh").description("Refresh cached agent model lists into local config").option("-a, --agent <agent>", "Refresh a single agent only (claude-code, codex, cursor)").action((opts) => {
   const agent2 = opts.agent ? parseAgent(opts.agent) : void 0;
   try {
     const summary = refreshAgentModels(agent2);
     for (const result of summary.results) {
-      const source2 = result.source === "command" ? chalk11.cyan("command") : chalk11.dim("builtin");
-      console.log(chalk11.green(`Refreshed ${result.agent}`) + `  ${source2}  ${result.modelCount} models`);
+      const source2 = result.source === "command" ? chalk10.cyan("command") : chalk10.dim("builtin");
+      console.log(chalk10.green(`Refreshed ${result.agent}`) + `  ${source2}  ${result.modelCount} models`);
       if (result.fetchCommand) {
-        console.log(chalk11.dim(`  ${result.fetchCommand}`));
+        console.log(chalk10.dim(`  ${result.fetchCommand}`));
       }
     }
     for (const failure of summary.failures) {
-      console.error(chalk11.red(`Failed ${failure.agent}: ${failure.error}`));
+      console.error(chalk10.red(`Failed ${failure.agent}: ${failure.error}`));
     }
     if (summary.failures.length > 0) {
       process.exit(1);
     }
   } catch (error2) {
-    console.error(chalk11.red(error2 instanceof Error ? error2.message : String(error2)));
+    console.error(chalk10.red(error2 instanceof Error ? error2.message : String(error2)));
     process.exit(1);
   }
 });
@@ -2114,70 +2087,73 @@ models.command("default <agent>").description("Get or set default model / effort
   if (wroteModel || wroteEffort) {
     saveConfig(config);
   }
-  console.log(chalk11.green(agent2));
-  console.log(`  model:  ${entry.defaultModel ?? chalk11.dim("(unset)")}`);
-  console.log(`  effort: ${entry.defaultEffort ?? chalk11.dim("(unset)")}`);
+  console.log(chalk10.green(agent2));
+  console.log(`  model:  ${entry.defaultModel ?? chalk10.dim("(unset)")}`);
+  console.log(`  effort: ${entry.defaultEffort ?? chalk10.dim("(unset)")}`);
 });
 
-// src/commands/runtime.ts
-import { Command as Command12 } from "commander";
-import chalk12 from "chalk";
-import { spawn as spawn3 } from "child_process";
-var runtime = new Command12("runtime").description("Inspect and control runtimes");
-runtime.command("list").description("List active runtimes").option("--json", "Output JSON").option("--task <id>", "Filter by task id").action(async (opts) => {
+// src/commands/agent-run.ts
+import fs15 from "fs";
+import path14 from "path";
+import { Command as Command11 } from "commander";
+import chalk11 from "chalk";
+import { spawn as spawn2, spawnSync as spawnSync3 } from "child_process";
+import yaml6 from "js-yaml";
+var agentRun = new Command11("agent-run").description("Inspect and control agent runs");
+agentRun.command("list").description("List active agent runs").option("--json", "Output JSON").option("--task <id>", "Filter by task id").action(async (opts) => {
   try {
-    const { runtimes } = await api.get("/api/runtimes");
+    const { agent_runs: runtimes } = await api.get("/api/agent-runs");
     const filtered = opts.task ? runtimes.filter((r) => r.taskId === opts.task) : runtimes;
     if (opts.json) {
       console.log(JSON.stringify(filtered, null, 2));
       return;
     }
     if (filtered.length === 0) {
-      console.log(chalk12.dim("No runtimes."));
+      console.log(chalk11.dim("No agent runs."));
       return;
     }
     const objectIdWidth = Math.max(...filtered.map((r) => (r.objectId || "").length), 8);
     for (const r of filtered) {
-      const statusColor2 = r.status === "done" ? chalk12.green : r.status === "error" ? chalk12.red : r.status === "running" ? chalk12.cyan : chalk12.dim;
-      const objectId = chalk12.cyan((r.objectId || "-").padEnd(objectIdWidth));
-      console.log(`${statusColor2(r.status.padEnd(8))} ${objectId} ${chalk12.dim(r.type.padEnd(12))} ${r.taskId.padEnd(30)} ${chalk12.dim(r.id)}`);
+      const statusColor2 = r.status === "done" ? chalk11.green : r.status === "error" ? chalk11.red : r.status === "running" ? chalk11.cyan : chalk11.dim;
+      const objectId = chalk11.cyan((r.objectId || "-").padEnd(objectIdWidth));
+      console.log(`${statusColor2(r.status.padEnd(8))} ${objectId} ${chalk11.dim(r.type.padEnd(12))} ${r.taskId.padEnd(30)} ${chalk11.dim(r.id)}`);
     }
   } catch (err) {
-    console.error(chalk12.red(err.message));
+    console.error(chalk11.red(err.message));
     process.exit(1);
   }
 });
-runtime.command("show <id>").description("Show runtime details").option("--json", "Output JSON").action(async (id, opts) => {
+agentRun.command("show <id>").description("Show agent run details").option("--json", "Output JSON").action(async (id, opts) => {
   try {
-    const r = await getRuntime(id);
+    const r = await getAgentRun(id);
     if (opts.json) {
       console.log(JSON.stringify(r, null, 2));
       return;
     }
-    console.log(`${chalk12.bold("id:")}       ${r.id}`);
-    if (r.objectId) console.log(`${chalk12.bold("object_id:")} ${r.objectId}`);
-    console.log(`${chalk12.bold("type:")}     ${r.type}`);
-    console.log(`${chalk12.bold("agent:")}    ${r.agent}`);
-    console.log(`${chalk12.bold("task:")}     ${r.taskId}`);
-    console.log(`${chalk12.bold("status:")}   ${r.status}`);
-    if (r.phase) console.log(`${chalk12.bold("phase:")}    ${r.phase}`);
-    if (r.error) console.log(`${chalk12.red("error:")}    ${r.error}`);
-    console.log(`${chalk12.bold("tmux:")}     ${r.tmuxSession} (alive: ${r.sessionAlive ?? "unknown"})`);
+    console.log(`${chalk11.bold("id:")}       ${r.id}`);
+    if (r.objectId) console.log(`${chalk11.bold("object_id:")} ${r.objectId}`);
+    console.log(`${chalk11.bold("type:")}     ${r.type}`);
+    console.log(`${chalk11.bold("agent:")}    ${r.agent}`);
+    console.log(`${chalk11.bold("task:")}     ${r.taskId}`);
+    console.log(`${chalk11.bold("status:")}   ${r.status}`);
+    if (r.phase) console.log(`${chalk11.bold("phase:")}    ${r.phase}`);
+    if (r.error) console.log(`${chalk11.red("error:")}    ${r.error}`);
+    console.log(`${chalk11.bold("tmux:")}     ${r.tmuxSession} (alive: ${r.sessionAlive ?? "unknown"})`);
     if (r.result) {
-      console.log(chalk12.bold("result:"));
+      console.log(chalk11.bold("result:"));
       console.log("  " + JSON.stringify(r.result, null, 2).split("\n").join("\n  "));
     }
   } catch (err) {
-    console.error(chalk12.red(err.message));
+    console.error(chalk11.red(err.message));
     process.exit(1);
   }
 });
-runtime.command("wait <id>").description("Block until runtime reaches done or error").option("--timeout <seconds>", "Max seconds to wait", "1800").option("--json", "Output final JSON").action(async (id, opts) => {
+agentRun.command("wait <id>").description("Block until agent run reaches done or error").option("--timeout <seconds>", "Max seconds to wait", "1800").option("--json", "Output final JSON").action(async (id, opts) => {
   try {
-    const final = await waitForRuntime(id, {
+    const final = await waitForAgentRun(id, {
       timeoutMs: Number(opts.timeout) * 1e3,
       onTick: (s) => {
-        if (!opts.json) console.log(chalk12.dim(`[${s.status}] ${s.phase ?? ""}`));
+        if (!opts.json) console.log(chalk11.dim(`[${s.status}] ${s.phase ?? ""}`));
       }
     });
     if (opts.json) {
@@ -2185,41 +2161,120 @@ runtime.command("wait <id>").description("Block until runtime reaches done or er
     }
     process.exit(final.status === "done" ? 0 : 1);
   } catch (err) {
-    console.error(chalk12.red(err.message));
+    console.error(chalk11.red(err.message));
     process.exit(1);
   }
 });
-runtime.command("cancel <id>").description("Cancel a runtime").action(async (id) => {
+agentRun.command("cancel <id>").description("Cancel an agent run").action(async (id) => {
   try {
-    await api.post(`/api/runtimes/${encodeURIComponent(id)}/cancel`);
-    console.log(chalk12.green(`Canceled ${id}`));
+    await api.post(`/api/agent-runs/${encodeURIComponent(id)}/cancel`);
+    console.log(chalk11.green(`Canceled ${id}`));
   } catch (err) {
-    console.error(chalk12.red(err.message));
+    console.error(chalk11.red(err.message));
     process.exit(1);
   }
 });
-runtime.command("attach <id>").description("Attach to the tmux session backing a runtime").action(async (id) => {
+agentRun.command("attach <id>").description("Attach to the tmux session backing an agent run").action(async (id) => {
   try {
-    const r = await getRuntime(id);
+    const r = await getAgentRun(id);
     if (!r.tmuxSession) {
-      console.error(chalk12.red("No tmux session recorded for this runtime."));
+      console.error(chalk11.red("No tmux session recorded for this agent run."));
       process.exit(1);
     }
-    const child = spawn3("tmux", ["attach", "-t", r.tmuxSession], { stdio: "inherit" });
+    const child = spawn2("tmux", ["attach", "-t", r.tmuxSession], { stdio: "inherit" });
     child.on("exit", (code) => process.exit(code ?? 0));
     child.on("error", (err) => {
-      console.error(chalk12.red(`Failed to attach: ${err.message}`));
+      console.error(chalk11.red(`Failed to attach: ${err.message}`));
       process.exit(1);
     });
   } catch (err) {
-    console.error(chalk12.red(err.message));
+    console.error(chalk11.red(err.message));
     process.exit(1);
   }
 });
+function failProfile(message) {
+  console.error(chalk11.red(message));
+  process.exit(1);
+}
+function formatProfile(r) {
+  const tag = r.system ? chalk11.dim("(system)") : r.scope ? chalk11.dim(`(${r.scope})`) : "";
+  return `${chalk11.bold(r.slug.padEnd(20))} ${chalk11.dim(r.object_id.padEnd(14))} ${r.kind.padEnd(5)} ${chalk11.dim(r.exec.command.padEnd(20))} ${tag}`;
+}
+var profile = new Command11("profile").description("Manage RuntimeProfile templates (the executables / endpoints agents bind to)");
+profile.command("list").description("List visible runtime profiles (project + user + built-in cascade)").option("--include-system", "Include built-in system profiles (default true)").option("--json", "Output JSON").action(async (opts) => {
+  try {
+    const qs = opts.includeSystem === false ? "?include_system=false" : "";
+    const result = await api.get(`/api/runtime-profiles${qs}`);
+    if (opts.json) return console.log(JSON.stringify(result.runtimes, null, 2));
+    if (!result.runtimes.length) {
+      console.log(chalk11.dim("(no runtime profiles)"));
+      return;
+    }
+    for (const r of result.runtimes) console.log(formatProfile(r));
+  } catch (err) {
+    failProfile(err.message);
+  }
+});
+profile.command("get <ref>").description("Show one runtime profile by slug or object_id").option("--json", "Output JSON").action(async (ref, opts) => {
+  try {
+    const result = await api.get(`/api/runtime-profiles/${encodeURIComponent(ref)}`);
+    if (opts.json) return console.log(JSON.stringify(result.runtime, null, 2));
+    console.log(formatProfile(result.runtime));
+    console.log();
+    console.log(chalk11.dim("--- exec ---"));
+    console.log(yaml6.dump(result.runtime.exec, { lineWidth: 100 }));
+  } catch (err) {
+    const apiErr = err;
+    if (apiErr.status === 404) failProfile(`not found: ${ref}`);
+    failProfile(err.message);
+  }
+});
+profile.command("create").description("Create a runtime profile from a YAML spec file").requiredOption("--from-file <file>", "YAML spec file with kind, slug, exec").option("--scope <scope>", "Storage scope: user (default) or project", "user").option("--project-root <path>", "Project root (required for --scope project)").action(async (opts) => {
+  let parsed;
+  try {
+    parsed = yaml6.load(fs15.readFileSync(path14.resolve(opts.fromFile), "utf-8"));
+  } catch (err) {
+    failProfile(`cannot read ${opts.fromFile}: ${err.message}`);
+  }
+  try {
+    const body = { ...parsed, scope: opts.scope, project_root: opts.projectRoot };
+    const result = await api.post("/api/runtime-profiles", body);
+    console.log(chalk11.green(`created ${result.runtime.slug} (${result.runtime.object_id})`));
+  } catch (err) {
+    failProfile(err.message);
+  }
+});
+profile.command("edit <ref>").description("Open the runtime profile YAML in $EDITOR and save changes").action(async (ref) => {
+  try {
+    const result = await api.get(`/api/runtime-profiles/${encodeURIComponent(ref)}`);
+    if (result.runtime.system) failProfile("cannot edit a system runtime profile");
+    const tmp = path14.join(process.env.TMPDIR || "/tmp", `task0-runtime-${result.runtime.slug}-${Date.now()}.yml`);
+    fs15.writeFileSync(tmp, yaml6.dump(result.runtime, { lineWidth: 100 }), "utf-8");
+    const editor = process.env.EDITOR || "vi";
+    const r = spawnSync3(editor, [tmp], { stdio: "inherit" });
+    if (r.status !== 0) failProfile(`editor exited with status ${r.status}`);
+    const updated = yaml6.load(fs15.readFileSync(tmp, "utf-8"));
+    await api.put(`/api/runtime-profiles/${encodeURIComponent(ref)}`, updated);
+    fs15.unlinkSync(tmp);
+    console.log(chalk11.green(`updated ${ref}`));
+  } catch (err) {
+    failProfile(err.message);
+  }
+});
+profile.command("delete <ref>").description("Delete a runtime profile").action(async (ref) => {
+  try {
+    const result = await api.del(`/api/runtime-profiles/${encodeURIComponent(ref)}`);
+    if (!result.deleted) failProfile(`not deleted: ${ref}`);
+    console.log(chalk11.green(`deleted ${ref}`));
+  } catch (err) {
+    failProfile(err.message);
+  }
+});
+agentRun.addCommand(profile);
 
 // src/commands/plan.ts
-import { Command as Command13 } from "commander";
-import chalk13 from "chalk";
+import { Command as Command12 } from "commander";
+import chalk12 from "chalk";
 import fs16 from "fs";
 import path15 from "path";
 init_task_state2();
@@ -2228,27 +2283,27 @@ function resolveSkillFilePath3(projectRoot, skillName) {
   const p = path15.join(projectRoot, ".claude", "skills", skillName, "SKILL.md");
   return fs16.existsSync(p) ? p : null;
 }
-var plan = new Command13("plan").description("Generate and refine plans");
+var plan = new Command12("plan").description("Generate and refine plans");
 plan.command("generate <objectId>").description("Generate plan(s) from an IDEA file \u2014 supports agent fan-out").option("-a, --agents <list>", "Comma-separated agents (claude-code,codex,cursor)", "codex,claude-code").option("--model <id>", "Model id or alias \u2014 only with a single agent; use `task0 models default` for fan-out").option("--effort <level>", "Reasoning effort \u2014 only with a single agent; use `task0 models default` for fan-out").option("--idea <file>", "IDEA file name (default: latest IDEA-NN.md)").option("--additional-prompt <text>", "Extra prompt content").option("--wait", "Wait for completion").option("--force", "Overwrite existing plan files").option("--json", "Output JSON").action(async (objectId, opts) => {
   try {
     const loc = resolveTaskByObjectId(objectId);
     const ideaFile = opts.idea || latestArtifact(loc.taskDir, /^IDEA-\d+\.md$/);
     if (!ideaFile) {
-      console.error(chalk13.red(`No IDEA-NN.md found in ${loc.taskDir}. Pass --idea.`));
+      console.error(chalk12.red(`No IDEA-NN.md found in ${loc.taskDir}. Pass --idea.`));
       process.exit(1);
     }
     const agents = opts.agents.split(",").map((a) => a.trim()).filter(Boolean);
     if (agents.length === 0) {
-      console.error(chalk13.red("No agents specified."));
+      console.error(chalk12.red("No agents specified."));
       process.exit(1);
     }
     if ((opts.model || opts.effort) && agents.length > 1) {
-      console.error(chalk13.red(
+      console.error(chalk12.red(
         `--model/--effort only works with a single agent; got ${agents.length} (${agents.join(", ")}). Use \`task0 models default <agent>\` to set per-agent defaults for fan-out.`
       ));
       process.exit(1);
     }
-    const warn = opts.json ? void 0 : (m) => console.error(chalk13.dim(m));
+    const warn = opts.json ? void 0 : (m) => console.error(chalk12.dim(m));
     const skillFilePath = resolveSkillFilePath3(loc.projectRoot, PLAN_GENERATE_SKILL_NAME);
     if (opts.model || opts.effort) {
       resolveModelOptions(agents[0], { model: opts.model, effort: opts.effort }, warn);
@@ -2271,43 +2326,56 @@ plan.command("generate <objectId>").description("Generate plan(s) from an IDEA f
         prompt: promptForAgent(agent2),
         ...skillFilePath ? { skill_file_path: skillFilePath } : {}
       };
-      try {
-        const resp = await api.post(
-          `/api/agents/${encodeURIComponent(agent2)}/run`,
-          body
-        );
-        return {
-          agent: agent2,
-          runtimeId: resp.runtime.id,
-          sessionName: "",
-          error: null
-        };
-      } catch (err) {
-        return { agent: agent2, runtimeId: "", sessionName: "", error: err.message };
+      const maxAttempts = 6;
+      const backoffMs = 2e3;
+      for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        try {
+          const resp = await api.post(
+            `/api/agents/${encodeURIComponent(agent2)}/run`,
+            body
+          );
+          return {
+            agent: agent2,
+            agentRunId: resp.runtime.id,
+            sessionName: "",
+            error: null
+          };
+        } catch (err) {
+          const e = err;
+          const busy = e.status === 409 && e.body?.error === "agent_busy";
+          if (busy && attempt < maxAttempts) {
+            if (!opts.json) console.error(chalk12.dim(`[${agent2}] busy, retry ${attempt}/${maxAttempts - 1}`));
+            await new Promise((r) => setTimeout(r, backoffMs));
+            continue;
+          }
+          const msg = e.body?.message || err.message;
+          return { agent: agent2, agentRunId: "", sessionName: "", error: msg };
+        }
       }
+      return { agent: agent2, agentRunId: "", sessionName: "", error: "agent_busy: exhausted retries" };
     }));
     const launched = kicks.filter((k) => !k.error);
     const failed = kicks.filter((k) => k.error);
     if (!opts.json) {
       for (const k of launched) {
-        console.log(chalk13.green(`[${k.agent}]`) + ` runtime ${k.runtimeId}`);
+        console.log(chalk12.green(`[${k.agent}]`) + ` runtime ${k.agentRunId}`);
       }
       for (const k of failed) {
-        console.error(chalk13.red(`[${k.agent}] ${k.error}`));
+        console.error(chalk12.red(`[${k.agent}] ${k.error}`));
       }
     }
-    const runtimeIds = {};
-    for (const k of launched) runtimeIds[k.agent] = k.runtimeId;
+    const agentRunIds = {};
+    for (const k of launched) agentRunIds[k.agent] = k.agentRunId;
     await updateWorkflow(loc.taskYml, {
-      runtimes: { plan: runtimeIds }
+      agent_runs: { plan: agentRunIds }
     });
     const planFiles = [];
     if (opts.wait) {
       const results = await Promise.all(launched.map(async (k) => {
         try {
-          const final = await waitForRuntime(k.runtimeId, {
+          const final = await waitForAgentRun(k.agentRunId, {
             onTick: (s) => {
-              if (!opts.json) console.log(chalk13.dim(`[${k.agent}] ${s.status}${s.phase ? " " + s.phase : ""}`));
+              if (!opts.json) console.log(chalk12.dim(`[${k.agent}] ${s.status}${s.phase ? " " + s.phase : ""}`));
             }
           });
           return { agent: k.agent, final, error: null };
@@ -2320,10 +2388,10 @@ plan.command("generate <objectId>").description("Generate plan(s) from an IDEA f
           const planFile = r.final.result?.planFile;
           if (planFile) {
             planFiles.push(planFile);
-            if (!opts.json) console.log(chalk13.green(`[${r.agent}] ${planFile}`));
+            if (!opts.json) console.log(chalk12.green(`[${r.agent}] ${planFile}`));
           }
         } else {
-          if (!opts.json) console.error(chalk13.red(`[${r.agent}] failed: ${r.error || r.final?.error || "unknown"}`));
+          if (!opts.json) console.error(chalk12.red(`[${r.agent}] failed: ${r.error || r.final?.error || "unknown"}`));
         }
       }
       const existingPlanFiles = readWorkflow(loc.taskYml).plan_files || [];
@@ -2337,7 +2405,7 @@ plan.command("generate <objectId>").description("Generate plan(s) from an IDEA f
     }
     if (failed.length > 0) process.exit(1);
   } catch (err) {
-    console.error(chalk13.red(err.message));
+    console.error(chalk12.red(err.message));
     process.exit(1);
   }
 });
@@ -2348,7 +2416,7 @@ plan.command("refine <objectId>").description("Synthesize plan files + ISSUE fil
     const files = fs16.readdirSync(loc.taskDir);
     const planFiles = files.filter((f) => /^PLAN-\d+-(codex|claude-code|cursor)\.md$/.test(f));
     if (planFiles.length === 0) {
-      console.error(chalk13.red("No PLAN-NN-<agent>.md files found. Run `task0 plan generate` first."));
+      console.error(chalk12.red("No PLAN-NN-<agent>.md files found. Run `task0 plan generate` first."));
       process.exit(1);
     }
     const idx = planFiles[0].match(/^PLAN-(\d+)/)?.[1] || nextArtifactIndex(loc.taskDir, "PLAN");
@@ -2357,7 +2425,7 @@ plan.command("refine <objectId>").description("Synthesize plan files + ISSUE fil
       resolveModelOptions(
         opts.agent,
         { model: opts.model, effort: opts.effort },
-        opts.json ? void 0 : (m) => console.error(chalk13.dim(m))
+        opts.json ? void 0 : (m) => console.error(chalk12.dim(m))
       );
     }
     const skillFilePath = resolveSkillFilePath3(loc.projectRoot, PLAN_REFINE_SKILL_NAME);
@@ -2376,15 +2444,15 @@ plan.command("refine <objectId>").description("Synthesize plan files + ISSUE fil
       `/api/agents/${encodeURIComponent(opts.agent)}/run`,
       body
     );
-    const runtimeId = resp.runtime.id;
-    if (!opts.json) console.log(chalk13.green(`refine runtime ${runtimeId}`));
+    const agentRunId = resp.runtime.id;
+    if (!opts.json) console.log(chalk12.green(`refine runtime ${agentRunId}`));
     await updateWorkflow(loc.taskYml, {
-      runtimes: { refine: runtimeId }
+      agent_runs: { refine: agentRunId }
     });
     if (opts.wait) {
-      const final = await waitForRuntime(runtimeId, {
+      const final = await waitForAgentRun(agentRunId, {
         onTick: (s) => {
-          if (!opts.json) console.log(chalk13.dim(`[refine] ${s.status}${s.phase ? " " + s.phase : ""}`));
+          if (!opts.json) console.log(chalk12.dim(`[refine] ${s.status}${s.phase ? " " + s.phase : ""}`));
         }
       });
       const refinedPath = path15.join(loc.taskDir, refinedFile);
@@ -2394,29 +2462,29 @@ plan.command("refine <objectId>").description("Synthesize plan files + ISSUE fil
           phase: "refined",
           refined_plan_file: refinedFile
         });
-        if (!opts.json) console.log(chalk13.green(refinedFile));
-        if (opts.json) console.log(JSON.stringify({ runtimeId, refinedFile }, null, 2));
+        if (!opts.json) console.log(chalk12.green(refinedFile));
+        if (opts.json) console.log(JSON.stringify({ agentRunId, refinedFile }, null, 2));
         return;
       }
       if (final.status !== "done") {
-        console.error(chalk13.red(`refine failed: ${final.error || "unknown"}`));
+        console.error(chalk12.red(`refine failed: ${final.error || "unknown"}`));
       } else if (!wrote) {
-        console.error(chalk13.red(`refine completed but ${refinedFile} was not written`));
+        console.error(chalk12.red(`refine completed but ${refinedFile} was not written`));
       }
       process.exit(1);
     }
-    if (opts.json) console.log(JSON.stringify({ runtimeId, refinedFile }, null, 2));
+    if (opts.json) console.log(JSON.stringify({ agentRunId, refinedFile }, null, 2));
   } catch (err) {
-    console.error(chalk13.red(err.message));
+    console.error(chalk12.red(err.message));
     process.exit(1);
   }
 });
 
 // src/commands/run.ts
 init_task_state2();
-import { Command as Command14 } from "commander";
-import chalk14 from "chalk";
-import { spawnSync as spawnSync3 } from "child_process";
+import { Command as Command13 } from "commander";
+import chalk13 from "chalk";
+import { spawnSync as spawnSync4 } from "child_process";
 var PHASES = ["triage", "plan", "refine", "exec"];
 var PAUSE_AFTER = /* @__PURE__ */ new Set(["refine"]);
 var CHECKPOINT_EXIT = 78;
@@ -2435,13 +2503,13 @@ function nextPhaseFromWorkflow(wf) {
       return null;
   }
 }
-var run = new Command14("run").description("Run the full task orchestration (triage \u2192 plan \u2192 refine \u2192 exec)").argument("<objectId>", "Task object_id (tsk_XXXXX)").option("--from <phase>", "Start from phase (triage|plan|refine|exec)").option("--to <phase>", "Stop after phase").option("--auto", "Skip pauses (no exit 78 at checkpoints)").option("--planners <list>", "Comma-separated plan agents", "codex,claude-code").option("--executor <agent>", "Executor agent", "claude-code").option("--triage-agent <agent>", "Triage agent", "claude-code").option("--refine-agent <agent>", "Refine agent", "claude-code").option("--json", "Output JSON summary at end").action(async (objectId, opts) => {
+var run = new Command13("run").description("Run the full task orchestration (triage \u2192 plan \u2192 refine \u2192 exec)").argument("<objectId>", "Task object_id (tsk_XXXXX)").option("--from <phase>", "Start from phase (triage|plan|refine|exec)").option("--to <phase>", "Stop after phase").option("--auto", "Skip pauses (no exit 78 at checkpoints)").option("--planners <list>", "Comma-separated plan agents", "codex,claude-code").option("--executor <agent>", "Executor agent", "claude-code").option("--triage-agent <agent>", "Triage agent", "claude-code").option("--refine-agent <agent>", "Refine agent", "claude-code").option("--json", "Output JSON summary at end").action(async (objectId, opts) => {
   try {
     const loc = resolveTaskByObjectId(objectId);
     const wf = readWorkflow(loc.taskYml);
     const fromCandidate = opts.from ?? nextPhaseFromWorkflow(wf);
     if (!fromCandidate) {
-      if (!opts.json) console.log(chalk14.dim(`Nothing to do \u2014 workflow phase is "${wf.phase}".`));
+      if (!opts.json) console.log(chalk13.dim(`Nothing to do \u2014 workflow phase is "${wf.phase}".`));
       return;
     }
     const from = fromCandidate;
@@ -2452,23 +2520,23 @@ var run = new Command14("run").description("Run the full task orchestration (tri
     const toIdx = PHASES.indexOf(to);
     if (fromIdx > toIdx) throw new Error(`--from (${from}) is past --to (${to})`);
     if (!opts.json) {
-      console.log(chalk14.bold(`task0 run ${objectId}`) + chalk14.dim(` \u2014 ${from} \u2192 ${to}`));
+      console.log(chalk13.bold(`task0 run ${objectId}`) + chalk13.dim(` \u2014 ${from} \u2192 ${to}`));
     }
     for (let i = fromIdx; i <= toIdx; i++) {
       const phase = PHASES[i];
-      if (!opts.json) console.log(chalk14.bold.cyan(`
+      if (!opts.json) console.log(chalk13.bold.cyan(`
 \u25B6 ${phase}`));
       const code = runPhase(phase, objectId, opts);
       if (code !== 0) {
-        console.error(chalk14.red(`Phase "${phase}" failed (exit ${code}). Resume with: task0 run ${objectId} --from ${phase}`));
+        console.error(chalk13.red(`Phase "${phase}" failed (exit ${code}). Resume with: task0 run ${objectId} --from ${phase}`));
         process.exit(code);
       }
       if (!opts.auto && PAUSE_AFTER.has(phase) && i < toIdx) {
         const next = PHASES[i + 1];
         if (!opts.json) {
-          console.log(chalk14.yellow(`
+          console.log(chalk13.yellow(`
 \u23F8  checkpoint after ${phase}. Review and resume with:`));
-          console.log(chalk14.yellow(`   task0 run ${objectId} --from ${next}`));
+          console.log(chalk13.yellow(`   task0 run ${objectId} --from ${next}`));
         }
         process.exit(CHECKPOINT_EXIT);
       }
@@ -2477,11 +2545,11 @@ var run = new Command14("run").description("Run the full task orchestration (tri
     if (opts.json) {
       console.log(JSON.stringify({ objectId, from, to, workflow: finalWf }, null, 2));
     } else {
-      console.log(chalk14.green(`
+      console.log(chalk13.green(`
 \u2713 done (phase: ${finalWf.phase})`));
     }
   } catch (err) {
-    console.error(chalk14.red(err.message));
+    console.error(chalk13.red(err.message));
     process.exit(1);
   }
 });
@@ -2503,7 +2571,7 @@ function runPhase(phase, objectId, opts) {
       args = ["task", "exec", objectId, "--wait", "--agent", opts.executor];
       break;
   }
-  const r = spawnSync3(node, [cli, ...args], { stdio: "inherit" });
+  const r = spawnSync4(node, [cli, ...args], { stdio: "inherit" });
   return r.status ?? 1;
 }
 run.command("status <objectId>").description("Show current workflow state").option("--json", "Output JSON").action((objectId, opts) => {
@@ -2514,29 +2582,30 @@ run.command("status <objectId>").description("Show current workflow state").opti
       console.log(JSON.stringify(wf, null, 2));
       return;
     }
-    console.log(`${chalk14.bold("phase:")}           ${wf.phase ?? chalk14.dim("(not started)")}`);
+    console.log(`${chalk13.bold("phase:")}           ${wf.phase ?? chalk13.dim("(not started)")}`);
     if (wf.issue_overview) {
       const extra = wf.issue_files?.length ? ` (+${wf.issue_files.length} details)` : "";
-      console.log(`${chalk14.bold("issues:")}          ${wf.issue_overview}${extra}`);
-    }
-    if (wf.plan_files?.length) console.log(`${chalk14.bold("plans:")}           ${wf.plan_files.join(", ")}`);
-    if (wf.refined_plan_file) console.log(`${chalk14.bold("refined:")}         ${wf.refined_plan_file}`);
-    if (wf.runtimes) {
-      console.log(chalk14.bold("runtimes:"));
-      for (const [k, v] of Object.entries(wf.runtimes)) {
+      console.log(`${chalk13.bold("issues:")}          ${wf.issue_overview}${extra}`);
+    }
+    if (wf.plan_files?.length) console.log(`${chalk13.bold("plans:")}           ${wf.plan_files.join(", ")}`);
+    if (wf.refined_plan_file) console.log(`${chalk13.bold("refined:")}         ${wf.refined_plan_file}`);
+    const phaseRuns = wf.agent_runs ?? wf.runtimes;
+    if (phaseRuns) {
+      console.log(chalk13.bold("agent_runs:"));
+      for (const [k, v] of Object.entries(phaseRuns)) {
         console.log(`  ${k.padEnd(8)} ${typeof v === "string" ? v : JSON.stringify(v)}`);
       }
     }
-    if (wf.updated_at) console.log(chalk14.dim(`updated_at: ${wf.updated_at}`));
+    if (wf.updated_at) console.log(chalk13.dim(`updated_at: ${wf.updated_at}`));
   } catch (err) {
-    console.error(chalk14.red(err.message));
+    console.error(chalk13.red(err.message));
     process.exit(1);
   }
 });
 
 // src/commands/okr.ts
-import { Command as Command15 } from "commander";
-import chalk15 from "chalk";
+import { Command as Command14 } from "commander";
+import chalk14 from "chalk";
 
 // src/lib/project.ts
 import path16 from "path";
@@ -2569,7 +2638,7 @@ function resolveProjectName(opts) {
 
 // src/commands/okr.ts
 function fail3(message) {
-  console.error(chalk15.red(message));
+  console.error(chalk14.red(message));
   process.exit(1);
 }
 function parseNumber(value) {
@@ -2606,11 +2675,11 @@ function countKRs(plan3) {
   return plan3.objectives.reduce((sum, o) => sum + o.key_results.length, 0);
 }
 function printPlanSummary(plan3) {
-  const oid = chalk15.cyan((plan3.object_id || "-").padEnd(10));
+  const oid = chalk14.cyan((plan3.object_id || "-").padEnd(10));
   const id = plan3.id.padEnd(16);
-  const status = chalk15.yellow(plan3.status.padEnd(8));
+  const status = chalk14.yellow(plan3.status.padEnd(8));
   const range = `${dateShort(plan3.start_at)} \u2192 ${dateShort(plan3.end_at)}`;
-  const counts = chalk15.dim(
+  const counts = chalk14.dim(
     `${plan3.objectives.length} obj \xB7 ${countKRs(plan3)} kr \xB7 ${plan3.milestones.length} ms`
   );
   console.log(`${oid}  ${id}  ${status}  ${range}  ${counts}  ${plan3.title}`);
@@ -2629,37 +2698,37 @@ function krProgress(kr2) {
 }
 function printPlanDetail(plan3) {
   console.log(
-    `${chalk15.bold(plan3.id)}  ${chalk15.dim(plan3.object_id || "")}  ${chalk15.yellow(plan3.status)}   ${dateShort(plan3.start_at)} \u2192 ${dateShort(plan3.end_at)}`
+    `${chalk14.bold(plan3.id)}  ${chalk14.dim(plan3.object_id || "")}  ${chalk14.yellow(plan3.status)}   ${dateShort(plan3.start_at)} \u2192 ${dateShort(plan3.end_at)}`
   );
   if (plan3.title) console.log(`  ${plan3.title}`);
   for (const obj of plan3.objectives) {
     console.log(
-      `  ${chalk15.bold(obj.id)}  ${obj.title}  ${chalk15.dim(`(${obj.status})`)}  ${chalk15.dim(obj.object_id || "")}`
+      `  ${chalk14.bold(obj.id)}  ${obj.title}  ${chalk14.dim(`(${obj.status})`)}  ${chalk14.dim(obj.object_id || "")}`
     );
     for (const kr2 of obj.key_results) {
       const unit = kr2.unit ? kr2.unit : "";
       const vals = kr2.target_value !== null ? `${kr2.start_value ?? 0}${unit}\u2192${kr2.target_value}${unit} now ${kr2.current_value ?? 0}${unit}` : "\u2014";
       console.log(
-        `    ${kr2.id.padEnd(20)} ${vals}  ${krProgress(kr2)}  ${chalk15.dim(`(${kr2.status}/${kr2.confidence})`)}  ${chalk15.dim(kr2.object_id || "")}`
+        `    ${kr2.id.padEnd(20)} ${vals}  ${krProgress(kr2)}  ${chalk14.dim(`(${kr2.status}/${kr2.confidence})`)}  ${chalk14.dim(kr2.object_id || "")}`
       );
     }
   }
   for (const ms of plan3.milestones) {
-    const links = ms.linked_kr_ids.length ? chalk15.dim(`\u2192 ${ms.linked_kr_ids.join(",")}`) : "";
+    const links = ms.linked_kr_ids.length ? chalk14.dim(`\u2192 ${ms.linked_kr_ids.join(",")}`) : "";
     console.log(
-      `  ${chalk15.bold(ms.id)}  ${dateShort(ms.due_at)}  ${ms.title}  ${chalk15.dim(`(${ms.status})`)}  ${links}  ${chalk15.dim(ms.object_id || "")}`
+      `  ${chalk14.bold(ms.id)}  ${dateShort(ms.due_at)}  ${ms.title}  ${chalk14.dim(`(${ms.status})`)}  ${links}  ${chalk14.dim(ms.object_id || "")}`
     );
   }
   if (plan3.task_kr_links.length) {
-    console.log(chalk15.dim("links:"));
+    console.log(chalk14.dim("links:"));
     for (const link of plan3.task_kr_links) {
       console.log(
-        `  ${link.task_id} \u2192 ${link.kr_id}  ${chalk15.dim(`${link.contribution} w=${link.weight}`)}`
+        `  ${link.task_id} \u2192 ${link.kr_id}  ${chalk14.dim(`${link.contribution} w=${link.weight}`)}`
       );
     }
   }
 }
-var okr = new Command15("okr").description(
+var okr = new Command14("okr").description(
   "Manage OKR plans, objectives, key results, milestones"
 );
 var plan2 = okr.command("plan").description("OKR plans");
@@ -2693,7 +2762,7 @@ plan2.command("create <plan-id>").description("Create a new OKR plan").requiredO
       };
       const { plan: view } = await api.post(planBasePath(name), body);
       if (maybeJson(view, opts)) return;
-      console.log(chalk15.green("ok"), view.id, chalk15.dim(view.object_id || ""));
+      console.log(chalk14.green("ok"), view.id, chalk14.dim(view.object_id || ""));
       printPlanSummary(view);
     });
   }
@@ -2712,7 +2781,7 @@ plan2.command("update <plan-id>").description("Update plan fields").option("-t,
         body
       );
       if (maybeJson(view, opts)) return;
-      console.log(chalk15.green("updated"), view.id, chalk15.dim(view.object_id || ""));
+      console.log(chalk14.green("updated"), view.id, chalk14.dim(view.object_id || ""));
       printPlanSummary(view);
     });
   }
@@ -2735,10 +2804,10 @@ objective.command("create <plan-id> <objective-id>").description("Create an obje
       );
       if (maybeJson(view, opts)) return;
       console.log(
-        chalk15.green("ok"),
+        chalk14.green("ok"),
         view.id,
-        chalk15.dim(view.object_id || ""),
-        chalk15.dim(`(${view.status})`),
+        chalk14.dim(view.object_id || ""),
+        chalk14.dim(`(${view.status})`),
         view.title
       );
     });
@@ -2759,7 +2828,7 @@ objective.command("update <plan-id> <objective-id>").description("Update objecti
         body
       );
       if (maybeJson(view, opts)) return;
-      console.log(chalk15.green("updated"), view.id, chalk15.dim(`(${view.status})`), view.title);
+      console.log(chalk14.green("updated"), view.id, chalk14.dim(`(${view.status})`), view.title);
     });
   }
 );
@@ -2787,10 +2856,10 @@ kr.command("create <plan-id> <objective-id> <kr-id>").description("Create a key
       );
       if (maybeJson(view, opts)) return;
       console.log(
-        chalk15.green("ok"),
+        chalk14.green("ok"),
         view.id,
-        chalk15.dim(view.object_id || ""),
-        chalk15.dim(`(${view.status}/${view.confidence})`),
+        chalk14.dim(view.object_id || ""),
+        chalk14.dim(`(${view.status}/${view.confidence})`),
         view.title
       );
     });
@@ -2818,9 +2887,9 @@ kr.command("update <plan-id> <kr-id>").description("Update a key result").option
       );
       if (maybeJson(view, opts)) return;
       console.log(
-        chalk15.green("updated"),
+        chalk14.green("updated"),
         view.id,
-        chalk15.dim(`(${view.status}/${view.confidence})`),
+        chalk14.dim(`(${view.status}/${view.confidence})`),
         view.title
       );
     });
@@ -2840,10 +2909,10 @@ kr.command("progress <plan-id> <kr-id>").description("Update key result progress
       );
       if (maybeJson(view, opts)) return;
       console.log(
-        chalk15.green("progress"),
+        chalk14.green("progress"),
         view.id,
         krProgress(view),
-        chalk15.dim(`(${view.status}/${view.confidence})`)
+        chalk14.dim(`(${view.status}/${view.confidence})`)
       );
     });
   }
@@ -2867,11 +2936,11 @@ milestone.command("create <plan-id> <milestone-id>").description("Create a miles
       );
       if (maybeJson(view, opts)) return;
       console.log(
-        chalk15.green("ok"),
+        chalk14.green("ok"),
         view.id,
-        chalk15.dim(view.object_id || ""),
+        chalk14.dim(view.object_id || ""),
         dateShort(view.due_at),
-        chalk15.dim(`(${view.status})`),
+        chalk14.dim(`(${view.status})`),
         view.title
       );
     });
@@ -2894,10 +2963,10 @@ milestone.command("update <plan-id> <milestone-id>").description("Update a miles
       );
       if (maybeJson(view, opts)) return;
       console.log(
-        chalk15.green("updated"),
+        chalk14.green("updated"),
         view.id,
         dateShort(view.due_at),
-        chalk15.dim(`(${view.status})`),
+        chalk14.dim(`(${view.status})`),
         view.title
       );
     });
@@ -2919,9 +2988,9 @@ okr.command("link <plan-id>").description("Link a task to a key result").require
       );
       if (maybeJson(link, opts)) return;
       console.log(
-        chalk15.green("linked"),
+        chalk14.green("linked"),
         `${link.task_id} \u2192 ${link.kr_id}`,
-        chalk15.dim(`${link.contribution} w=${link.weight}`)
+        chalk14.dim(`${link.contribution} w=${link.weight}`)
       );
     });
   }
@@ -2933,15 +3002,15 @@ okr.command("unlink <plan-id>").description("Unlink a task from a key result").r
         `${planEncodedPath(name, planId)}/task-kr-links/${encodeURIComponent(opts.task)}/${encodeURIComponent(opts.kr)}`
       );
       if (maybeJson(result, opts)) return;
-      console.log(chalk15.green("unlinked"), `${opts.task} \u2715 ${opts.kr}`);
+      console.log(chalk14.green("unlinked"), `${opts.task} \u2715 ${opts.kr}`);
     });
   }
 );
 
 // src/commands/note.ts
-import { Command as Command16 } from "commander";
-import chalk16 from "chalk";
-var note = new Command16("note").description("Manage inbox notes");
+import { Command as Command15 } from "commander";
+import chalk15 from "chalk";
+var note = new Command15("note").description("Manage inbox notes");
 async function fetchAllInboxNotes() {
   const { inboxes } = await api.get("/api/inboxes");
   const results = [];
@@ -2983,33 +3052,33 @@ function preview2(body, width = 60) {
   return single.length > width ? single.slice(0, width - 1) + "\u2026" : single;
 }
 function printNoteRow(n, inboxName) {
-  const oid = chalk16.cyan((n.object_id || "-").padEnd(14));
-  const id = chalk16.dim(n.id.padEnd(10));
-  const tags = n.tags.length ? chalk16.yellow(n.tags.join(",")) : chalk16.dim("-");
-  const linked = n.linked_task_id ? chalk16.magenta(n.linked_task_id) : chalk16.dim("-");
-  const inboxPart = inboxName ? chalk16.dim(`[${inboxName}] `) : "";
-  console.log(`${oid} ${id} ${inboxPart}${preview2(n.body)}  ${tags}  ${linked}  ${chalk16.dim(n.updated_at)}`);
+  const oid = chalk15.cyan((n.object_id || "-").padEnd(14));
+  const id = chalk15.dim(n.id.padEnd(10));
+  const tags = n.tags.length ? chalk15.yellow(n.tags.join(",")) : chalk15.dim("-");
+  const linked = n.linked_task_id ? chalk15.magenta(n.linked_task_id) : chalk15.dim("-");
+  const inboxPart = inboxName ? chalk15.dim(`[${inboxName}] `) : "";
+  console.log(`${oid} ${id} ${inboxPart}${preview2(n.body)}  ${tags}  ${linked}  ${chalk15.dim(n.updated_at)}`);
 }
 function printNoteDetail(n, inboxId) {
-  if (n.object_id) console.log(`${chalk16.bold("object_id:")}    ${n.object_id}`);
-  console.log(`${chalk16.bold("id:")}           ${n.id}`);
-  if (inboxId) console.log(`${chalk16.bold("inbox:")}        ${inboxId}`);
-  console.log(`${chalk16.bold("tags:")}         ${n.tags.length ? n.tags.join(", ") : "-"}`);
-  if (n.linked_task_id) console.log(`${chalk16.bold("linked_task:")} ${n.linked_task_id}`);
-  if (n.linked_project) console.log(`${chalk16.bold("linked_project:")} ${n.linked_project}`);
-  console.log(`${chalk16.bold("created_at:")}   ${n.created_at}`);
-  console.log(`${chalk16.bold("updated_at:")}   ${n.updated_at}`);
+  if (n.object_id) console.log(`${chalk15.bold("object_id:")}    ${n.object_id}`);
+  console.log(`${chalk15.bold("id:")}           ${n.id}`);
+  if (inboxId) console.log(`${chalk15.bold("inbox:")}        ${inboxId}`);
+  console.log(`${chalk15.bold("tags:")}         ${n.tags.length ? n.tags.join(", ") : "-"}`);
+  if (n.linked_task_id) console.log(`${chalk15.bold("linked_task:")} ${n.linked_task_id}`);
+  if (n.linked_project) console.log(`${chalk15.bold("linked_project:")} ${n.linked_project}`);
+  console.log(`${chalk15.bold("created_at:")}   ${n.created_at}`);
+  console.log(`${chalk15.bold("updated_at:")}   ${n.updated_at}`);
   if (n.published_to?.length) {
-    console.log(chalk16.bold("published_to:"));
+    console.log(chalk15.bold("published_to:"));
     for (const p of n.published_to) {
-      console.log(`  - ${p.source_type}:${p.source_name} ${p.identifier} ${chalk16.dim(p.url)}`);
+      console.log(`  - ${p.source_type}:${p.source_name} ${p.identifier} ${chalk15.dim(p.url)}`);
     }
   }
-  console.log(chalk16.bold("body:"));
+  console.log(chalk15.bold("body:"));
   console.log(n.body.split("\n").map((l) => "  " + l).join("\n"));
 }
 function fail4(err) {
-  console.error(chalk16.red(err.message));
+  console.error(chalk15.red(err.message));
   process.exit(1);
 }
 note.command("list").description("List inbox notes").option("--inbox <id>", "Restrict to a specific inbox").option("--json", "Output JSON").action(async (opts) => {
@@ -3023,7 +3092,7 @@ note.command("list").description("List inbox notes").option("--inbox <id>", "Res
         return;
       }
       if (!notes.length) {
-        console.log(chalk16.dim("No notes."));
+        console.log(chalk15.dim("No notes."));
         return;
       }
       for (const n of notes) printNoteRow(n);
@@ -3036,7 +3105,7 @@ note.command("list").description("List inbox notes").option("--inbox <id>", "Res
     }
     const flat = all.flatMap(({ inbox, notes }) => notes.map((n) => ({ n, inboxName: inbox.name })));
     if (!flat.length) {
-      console.log(chalk16.dim("No notes."));
+      console.log(chalk15.dim("No notes."));
       return;
     }
     for (const { n, inboxName } of flat) printNoteRow(n, inboxName);
@@ -3069,7 +3138,7 @@ note.command("create").description("Create a note in an inbox").requiredOption("
       console.log(JSON.stringify({ note: created }, null, 2));
       return;
     }
-    console.log(chalk16.green(`Created ${created.object_id || created.id}`));
+    console.log(chalk15.green(`Created ${created.object_id || created.id}`));
     printNoteDetail(created, opts.inbox);
   } catch (err) {
     fail4(err);
@@ -3085,7 +3154,7 @@ note.command("update <id>").description("Update a note (accepts short id or note
     if (opts.linkedTask !== void 0) payload.linked_task_id = opts.linkedTask;
     if (opts.linkedProject !== void 0) payload.linked_project = opts.linkedProject;
     if (!Object.keys(payload).length) {
-      console.error(chalk16.yellow("Nothing to update. Pass --body, --tag, --clear-tags, --linked-task, or --linked-project."));
+      console.error(chalk15.yellow("Nothing to update. Pass --body, --tag, --clear-tags, --linked-task, or --linked-project."));
       process.exit(1);
     }
     const { note: updated } = await api.patch(
@@ -3096,7 +3165,7 @@ note.command("update <id>").description("Update a note (accepts short id or note
       console.log(JSON.stringify({ note: updated }, null, 2));
       return;
     }
-    console.log(chalk16.green(`Updated ${updated.object_id || updated.id}`));
+    console.log(chalk15.green(`Updated ${updated.object_id || updated.id}`));
     printNoteDetail(updated, inboxId);
   } catch (err) {
     fail4(err);
@@ -3108,7 +3177,7 @@ note.command("delete <id>").description("Delete a note (accepts short id or note
     await api.del(
       `/api/inboxes/${encodeURIComponent(inboxId)}/notes/${encodeURIComponent(existing.id)}`
     );
-    console.log(chalk16.green(`Deleted ${existing.object_id || existing.id}`));
+    console.log(chalk15.green(`Deleted ${existing.object_id || existing.id}`));
   } catch (err) {
     fail4(err);
   }
@@ -3126,8 +3195,8 @@ note.command("publish <id>").description("Publish a note to a github/linear sour
       console.log(JSON.stringify({ published }, null, 2));
       return;
     }
-    console.log(chalk16.green(`Published to ${published.source_type}:${published.source_name} ${published.identifier}`));
-    console.log(`  ${chalk16.dim(published.url)}`);
+    console.log(chalk15.green(`Published to ${published.source_type}:${published.source_name} ${published.identifier}`));
+    console.log(`  ${chalk15.dim(published.url)}`);
   } catch (err) {
     fail4(err);
   }
@@ -3143,16 +3212,16 @@ note.command("convert <id>").description("Convert a note into a task under a pro
       console.log(JSON.stringify({ task: task2 }, null, 2));
       return;
     }
-    console.log(chalk16.green(`Converted to task ${task2.object_id} (${task2.id}) in ${task2.project}`));
+    console.log(chalk15.green(`Converted to task ${task2.object_id} (${task2.id}) in ${task2.project}`));
   } catch (err) {
     fail4(err);
   }
 });
 
 // src/commands/object.ts
-import { Command as Command17 } from "commander";
-import chalk17 from "chalk";
-var object = new Command17("object").description("Resolve any object by its object_id");
+import { Command as Command16 } from "commander";
+import chalk16 from "chalk";
+var object = new Command16("object").description("Resolve any object by its object_id");
 function pickFirst(resource, keys) {
   for (const k of keys) {
     const value = resource[k];
@@ -3162,16 +3231,16 @@ function pickFirst(resource, keys) {
 }
 function printSummary(result) {
   const { type, resource } = result;
-  console.log(`${chalk17.bold("type:")}      ${type}`);
+  console.log(`${chalk16.bold("type:")}      ${type}`);
   const title = pickFirst(resource, ["title", "name"]);
   const id = pickFirst(resource, ["object_id", "objectId", "id"]);
   const status = pickFirst(resource, ["status"]);
-  if (id) console.log(`${chalk17.bold("object_id:")} ${id}`);
-  if (title) console.log(`${chalk17.bold("title:")}     ${title}`);
-  if (status) console.log(`${chalk17.bold("status:")}    ${status}`);
+  if (id) console.log(`${chalk16.bold("object_id:")} ${id}`);
+  if (title) console.log(`${chalk16.bold("title:")}     ${title}`);
+  if (status) console.log(`${chalk16.bold("status:")}    ${status}`);
   const updatedAt = pickFirst(resource, ["updated_at", "updatedAt"]);
-  if (updatedAt) console.log(`${chalk17.bold("updated_at:")} ${updatedAt}`);
-  console.log(chalk17.dim("(pass --json for full payload)"));
+  if (updatedAt) console.log(`${chalk16.bold("updated_at:")} ${updatedAt}`);
+  console.log(chalk16.dim("(pass --json for full payload)"));
 }
 object.command("get <object-id>").description("Resolve an object by object_id (tsk_\u2026, note_\u2026, obj_\u2026, rt_\u2026, \u2026)").option("--json", "Output full JSON envelope").action(async (objectId, opts) => {
   try {
@@ -3184,17 +3253,17 @@ object.command("get <object-id>").description("Resolve an object by object_id (t
   } catch (err) {
     const apiErr = err;
     if (apiErr.status === 404) {
-      console.error(chalk17.red(`not found: ${objectId}`));
+      console.error(chalk16.red(`not found: ${objectId}`));
       process.exit(1);
     }
-    console.error(chalk17.red(err.message));
+    console.error(chalk16.red(err.message));
     process.exit(1);
   }
 });
 
 // src/commands/issue.ts
-import { Command as Command18 } from "commander";
-import chalk18 from "chalk";
+import { Command as Command17 } from "commander";
+import chalk17 from "chalk";
 
 // src/core/issue/decision.ts
 init_node();
@@ -3368,7 +3437,7 @@ async function propose(opts) {
           kicks.push({
             issue: issue2.file,
             agent: agent2,
-            runtimeId: "",
+            agentRunId: "",
             sessionName: "",
             decisionFile,
             error: null,
@@ -3378,7 +3447,7 @@ async function propose(opts) {
           kicks.push({
             issue: issue2.file,
             agent: agent2,
-            runtimeId: "",
+            agentRunId: "",
             sessionName: "",
             decisionFile,
             error: `${decisionFile} already exists (pass --force to overwrite)`
@@ -3402,7 +3471,7 @@ async function propose(opts) {
         kicks.push({
           issue: issue2.file,
           agent: agent2,
-          runtimeId: resp.runtime.id,
+          agentRunId: resp.runtime.id,
           sessionName: "",
           decisionFile,
           error: null
@@ -3411,7 +3480,7 @@ async function propose(opts) {
         kicks.push({
           issue: issue2.file,
           agent: agent2,
-          runtimeId: "",
+          agentRunId: "",
           sessionName: "",
           decisionFile,
           error: err.message
@@ -3419,25 +3488,25 @@ async function propose(opts) {
       }
     }
     const runtimesByAgent = {};
-    for (const k of kicks) if (!k.error && k.runtimeId) runtimesByAgent[k.agent] = k.runtimeId;
+    for (const k of kicks) if (!k.error && k.agentRunId) runtimesByAgent[k.agent] = k.agentRunId;
     const proposalFiles = kicks.filter((k) => !k.error).map((k) => k.decisionFile);
     if (Object.keys(runtimesByAgent).length > 0 || proposalFiles.length > 0) {
       await updateWorkflow(loc.taskYml, {
         decisions: {
           [issue2.file]: {
             proposal_files: proposalFiles.length > 0 ? proposalFiles : void 0,
-            proposal_runtimes: Object.keys(runtimesByAgent).length > 0 ? runtimesByAgent : void 0
+            proposal_agent_runs: Object.keys(runtimesByAgent).length > 0 ? runtimesByAgent : void 0
           }
         }
       });
     }
     if (opts.wait) {
       for (const k of kicks) {
-        if (k.error || !k.runtimeId) continue;
+        if (k.error || !k.agentRunId) continue;
         try {
-          const final = await waitForRuntime(k.runtimeId);
+          const final = await waitForAgentRun(k.agentRunId);
           if (final.status !== "done") {
-            k.error = final.error || `runtime ${k.runtimeId} ended with ${final.status}`;
+            k.error = final.error || `runtime ${k.agentRunId} ended with ${final.status}`;
           } else if (!fs18.existsSync(path17.join(loc.taskDir, k.decisionFile))) {
             k.error = `runtime completed but ${k.decisionFile} was not written`;
           }
@@ -3467,7 +3536,7 @@ async function consolidate(opts) {
     if (proposalFiles.length === 0) {
       kicks.push({
         issue: issue2.file,
-        runtimeId: "",
+        agentRunId: "",
         sessionName: "",
         consolidatedFile: consolidatedFileName(issue2),
         error: `no DECISION-${issue2.index}-<agent>.md proposals found. Run \`task0 issue propose\` first.`
@@ -3486,28 +3555,28 @@ async function consolidate(opts) {
           prompt
         }
       );
-      const runtimeId = resp.runtime.id;
+      const agentRunId = resp.runtime.id;
       await updateWorkflow(loc.taskYml, {
         decisions: {
           [issue2.file]: {
             consolidated_file: consolidatedFile,
-            consolidate_runtime: runtimeId
+            consolidate_agent_run: agentRunId
           }
         }
       });
       const kick = {
         issue: issue2.file,
-        runtimeId,
+        agentRunId,
         sessionName: "",
         consolidatedFile,
         error: null
       };
       if (opts.wait) {
         try {
-          const final = await waitForRuntime(runtimeId);
+          const final = await waitForAgentRun(agentRunId);
           const wrote = fs18.existsSync(path17.join(loc.taskDir, consolidatedFile));
           if (final.status !== "done") {
-            kick.error = final.error || `runtime ${runtimeId} ended with ${final.status}`;
+            kick.error = final.error || `runtime ${agentRunId} ended with ${final.status}`;
           } else if (!wrote) {
             kick.error = `runtime completed but ${consolidatedFile} was not written`;
           }
@@ -3520,7 +3589,7 @@ async function consolidate(opts) {
     } catch (err) {
       kicks.push({
         issue: issue2.file,
-        runtimeId: "",
+        agentRunId: "",
         sessionName: "",
         consolidatedFile,
         error: err.message
@@ -3580,7 +3649,7 @@ function buildReferenceFiles(taskDir, issue2) {
 }
 
 // src/commands/issue.ts
-var issue = new Command18("issue").description(
+var issue = new Command17("issue").description(
   "Resolve blocking ISSUE Open Questions via multi-agent decision proposals"
 );
 issue.command("propose <taskId>").description(`Fan out agents to propose decisions for the task's blocking "## Open Questions"`).option("--issue <file>", "Specific ISSUE file (ISSUE-NN, NN, or ISSUE-NN.md); defaults to all blocking ISSUEs").option("-a, --agents <list>", "Comma-separated agents", "codex,claude-code").option("--additional-prompt <text>", "Extra prompt content appended to the default propose prompt").option("--model <id>", "Model id or alias (only valid with a single agent)").option("--effort <level>", "Reasoning effort (only valid with a single agent)").option("--wait", "Wait for each runtime to finish").option("--force", "Overwrite existing DECISION files").option("--if-needed", "Idempotent: skip issues with no Open Questions and agents whose DECISION file already exists (exit 0)").option("--json", "Output JSON").action(async (taskId, opts) => {
@@ -3596,7 +3665,7 @@ issue.command("propose <taskId>").description(`Fan out agents to propose decisio
       wait: opts.wait,
       force: opts.force,
       ifNeeded: opts.ifNeeded,
-      warn: opts.json ? void 0 : (m) => console.error(chalk18.dim(m))
+      warn: opts.json ? void 0 : (m) => console.error(chalk17.dim(m))
     });
     if (opts.json) {
       console.log(JSON.stringify(result, null, 2));
@@ -3605,26 +3674,26 @@ issue.command("propose <taskId>").description(`Fan out agents to propose decisio
       return;
     }
     if (opts.ifNeeded && result.issues.length === 0) {
-      console.log(chalk18.dim("no blocking Open Questions; nothing to propose"));
+      console.log(chalk17.dim("no blocking Open Questions; nothing to propose"));
       return;
     }
     let anyFailed = false;
     for (const item of result.issues) {
-      console.log(chalk18.bold(item.issue));
+      console.log(chalk17.bold(item.issue));
       for (const k of item.kicks) {
         if (k.error) {
           anyFailed = true;
-          console.error(chalk18.red(`  [${k.agent}] ${k.error}`));
+          console.error(chalk17.red(`  [${k.agent}] ${k.error}`));
         } else if (k.skipped === "already-exists") {
-          console.log(chalk18.dim(`  [${k.agent}] skipped (${k.decisionFile} exists)`));
+          console.log(chalk17.dim(`  [${k.agent}] skipped (${k.decisionFile} exists)`));
         } else {
-          console.log(chalk18.green(`  [${k.agent}]`) + ` runtime ${k.runtimeId} \u2192 ${k.decisionFile}`);
+          console.log(chalk17.green(`  [${k.agent}]`) + ` runtime ${k.agentRunId} \u2192 ${k.decisionFile}`);
         }
       }
     }
     if (anyFailed) process.exit(1);
   } catch (err) {
-    console.error(chalk18.red(err.message));
+    console.error(chalk17.red(err.message));
     process.exit(1);
   }
 });
@@ -3637,7 +3706,7 @@ issue.command("consolidate-propose <taskId>").description("Synthesize DECISION-N
       model: opts.model,
       effort: opts.effort,
       wait: opts.wait,
-      warn: opts.json ? void 0 : (m) => console.error(chalk18.dim(m))
+      warn: opts.json ? void 0 : (m) => console.error(chalk17.dim(m))
     });
     if (opts.json) {
       console.log(JSON.stringify(result, null, 2));
@@ -3649,16 +3718,16 @@ issue.command("consolidate-propose <taskId>").description("Synthesize DECISION-N
     for (const k of result.kicks) {
       if (k.error) {
         anyFailed = true;
-        console.error(chalk18.red(`[${k.issue}] ${k.error}`));
+        console.error(chalk17.red(`[${k.issue}] ${k.error}`));
       } else {
         console.log(
-          chalk18.green(`[${k.issue}]`) + ` runtime ${k.runtimeId} \u2192 ${k.consolidatedFile}` + (k.wrote === false ? chalk18.yellow(" (pending write)") : "")
+          chalk17.green(`[${k.issue}]`) + ` runtime ${k.agentRunId} \u2192 ${k.consolidatedFile}` + (k.wrote === false ? chalk17.yellow(" (pending write)") : "")
         );
       }
     }
     if (anyFailed) process.exit(1);
   } catch (err) {
-    console.error(chalk18.red(err.message));
+    console.error(chalk17.red(err.message));
     process.exit(1);
   }
 });
@@ -3670,10 +3739,10 @@ issue.command("approve <taskId>").description("Apply the consolidated decisions
       return;
     }
     for (const u of result.updated) {
-      console.log(chalk18.green(`approved ${u.issueFile}`) + ` (${u.questionsReplaced} decisions \u2190 ${u.consolidatedFile})`);
+      console.log(chalk17.green(`approved ${u.issueFile}`) + ` (${u.questionsReplaced} decisions \u2190 ${u.consolidatedFile})`);
     }
   } catch (err) {
-    console.error(chalk18.red(err.message));
+    console.error(chalk17.red(err.message));
     process.exit(1);
   }
 });
@@ -3681,23 +3750,37 @@ issue.command("approve <taskId>").description("Apply the consolidated decisions
 // src/commands/agent.ts
 import fs19 from "fs";
 import path18 from "path";
-import { spawnSync as spawnSync4 } from "child_process";
-import { Command as Command19 } from "commander";
-import chalk19 from "chalk";
-import yaml6 from "js-yaml";
+import { spawnSync as spawnSync5 } from "child_process";
+import { Command as Command18 } from "commander";
+import chalk18 from "chalk";
+import yaml7 from "js-yaml";
+function statusBadge(s) {
+  if (s === "working") return chalk18.cyan("\u25CF");
+  if (s === "error") return chalk18.red("\u25CF");
+  if (s === "idle") return chalk18.green("\u25CF");
+  return chalk18.dim("\u25CB");
+}
+function formatDuration(ms) {
+  if (ms === null || !Number.isFinite(ms)) return "\u2014";
+  if (ms < 1e3) return `${ms}ms`;
+  if (ms < 6e4) return `${(ms / 1e3).toFixed(1)}s`;
+  if (ms < 36e5) return `${(ms / 6e4).toFixed(1)}m`;
+  return `${(ms / 36e5).toFixed(1)}h`;
+}
 function fail5(message, code = 1) {
-  console.error(chalk19.red(message));
+  console.error(chalk18.red(message));
   process.exit(code);
 }
 function formatAgent(a, withDetails = false) {
-  const tag = a.system ? chalk19.dim("(system)") : a.scope ? chalk19.dim(`(${a.scope})`) : "";
-  const head = `${chalk19.bold(a.slug.padEnd(24))} ${chalk19.dim(a.object_id.padEnd(16))} ${a.kind.padEnd(10)} ${tag}`;
+  const tag = a.system ? chalk18.dim("(system)") : a.scope ? chalk18.dim(`(${a.scope})`) : "";
+  const dot = statusBadge(a.status);
+  const head = `${dot} ${chalk18.bold(a.slug.padEnd(24))} ${chalk18.dim(a.object_id.padEnd(16))} ${a.kind.padEnd(10)} ${tag}`;
   if (!withDetails) return head;
   const lines = [head];
-  if (a.description) lines.push(chalk19.dim("  " + a.description));
+  if (a.description) lines.push(chalk18.dim("  " + a.description));
   return lines.join("\n");
 }
-var agent = new Command19("agent").description("Manage agents and run them against tasks");
+var agent = new Command18("agent").description("Manage agents and run them against tasks");
 agent.command("list").description("List visible agents (project + user + built-in cascade)").option("--kind <kind>", "Filter by kind: coding | llm-api | workflow").option("--include-system", "Include built-in system agents (default true)").option("--json", "Output JSON").action(async (opts) => {
   try {
     const params = new URLSearchParams();
@@ -3707,7 +3790,7 @@ agent.command("list").description("List visible agents (project + user + built-i
     const result = await api.get(`/api/agents${qs}`);
     if (opts.json) return console.log(JSON.stringify(result.agents, null, 2));
     if (!result.agents.length) {
-      console.log(chalk19.dim("(no agents)"));
+      console.log(chalk18.dim("(no agents)"));
       return;
     }
     for (const a of result.agents) console.log(formatAgent(a, true));
@@ -3718,11 +3801,23 @@ agent.command("list").description("List visible agents (project + user + built-i
 agent.command("get <ref>").description("Show one agent by object_id or slug").option("--json", "Output JSON").action(async (ref, opts) => {
   try {
     const result = await api.get(`/api/agents/${encodeURIComponent(ref)}`);
-    if (opts.json) return console.log(JSON.stringify(result.agent, null, 2));
+    if (opts.json) return console.log(JSON.stringify(result, null, 2));
     console.log(formatAgent(result.agent, true));
+    const limit = result.agent.max_concurrent_tasks;
+    const inFlight = result.in_flight ?? 0;
+    if (limit !== void 0) {
+      const at = inFlight >= limit ? chalk18.yellow : chalk18.dim;
+      console.log(at(`  concurrency: ${inFlight}/${limit}`));
+    } else if (inFlight > 0) {
+      console.log(chalk18.dim(`  concurrency: ${inFlight}/\u221E`));
+    }
     console.log();
-    console.log(chalk19.dim("--- spec ---"));
-    console.log(yaml6.dump(result.agent.spec, { lineWidth: 100 }));
+    console.log(chalk18.dim("--- spec ---"));
+    console.log(yaml7.dump(result.agent.spec, { lineWidth: 100 }));
+    if (result.agent.mcp_config) {
+      console.log(chalk18.dim("--- mcp_config ---"));
+      console.log(yaml7.dump(result.agent.mcp_config, { lineWidth: 100 }));
+    }
   } catch (err) {
     const apiErr = err;
     if (apiErr.status === 404) fail5(`not found: ${ref}`);
@@ -3733,14 +3828,14 @@ agent.command("create").description("Create an agent from a YAML spec file").req
   let parsed;
   try {
     const raw = fs19.readFileSync(path18.resolve(opts.fromFile), "utf-8");
-    parsed = yaml6.load(raw);
+    parsed = yaml7.load(raw);
   } catch (err) {
     fail5(`cannot read ${opts.fromFile}: ${err.message}`);
   }
   try {
     const body = { ...parsed, scope: opts.scope, project_root: opts.projectRoot };
     const result = await api.post("/api/agents", body);
-    console.log(chalk19.green(`created ${result.agent.slug} (${result.agent.object_id})`));
+    console.log(chalk18.green(`created ${result.agent.slug} (${result.agent.object_id})`));
   } catch (err) {
     fail5(err.message);
   }
@@ -3753,14 +3848,14 @@ agent.command("edit <ref>").description("Open the agent YAML in $EDITOR and save
       process.env.TMPDIR || "/tmp",
       `task0-agent-${result.agent.slug}-${Date.now()}.yml`
     );
-    fs19.writeFileSync(tmp, yaml6.dump(result.agent, { lineWidth: 100 }), "utf-8");
+    fs19.writeFileSync(tmp, yaml7.dump(result.agent, { lineWidth: 100 }), "utf-8");
     const editor = process.env.EDITOR || "vi";
-    const r = spawnSync4(editor, [tmp], { stdio: "inherit" });
+    const r = spawnSync5(editor, [tmp], { stdio: "inherit" });
     if (r.status !== 0) fail5(`editor exited with status ${r.status}`);
-    const updated = yaml6.load(fs19.readFileSync(tmp, "utf-8"));
+    const updated = yaml7.load(fs19.readFileSync(tmp, "utf-8"));
     await api.put(`/api/agents/${encodeURIComponent(ref)}`, updated);
     fs19.unlinkSync(tmp);
-    console.log(chalk19.green(`updated ${ref}`));
+    console.log(chalk18.green(`updated ${ref}`));
   } catch (err) {
     fail5(err.message);
   }
@@ -3769,8 +3864,42 @@ agent.command("delete <ref>").description("Delete an agent").action(async (ref)
   try {
     const result = await api.del(`/api/agents/${encodeURIComponent(ref)}`);
     if (!result.deleted) fail5(`not deleted: ${ref}`);
-    console.log(chalk19.green(`deleted ${ref}`));
+    console.log(chalk18.green(`deleted ${ref}`));
+  } catch (err) {
+    fail5(err.message);
+  }
+});
+agent.command("activity <ref>").description("Show recent activity (runs, status, duration) for an agent").option("--days <n>", "Time window in days (default 30)", "30").option("--limit <n>", "Limit recent rows shown (default 10)", "10").option("--json", "Output JSON").action(async (ref, opts) => {
+  try {
+    const days = encodeURIComponent(opts.days);
+    const result = await api.get(`/api/agents/${encodeURIComponent(ref)}/activity?days=${days}`);
+    if (opts.json) return console.log(JSON.stringify(result, null, 2));
+    const a = result.agent;
+    const limitStr = a.max_concurrent_tasks === null ? "\u221E" : String(a.max_concurrent_tasks);
+    console.log(`${statusBadge(result.status)} ${chalk18.bold(a.slug)} ${chalk18.dim(a.object_id)} ${a.kind}`);
+    console.log(chalk18.dim(`  concurrency: ${result.in_flight}/${limitStr}    status: ${result.status}`));
+    console.log();
+    console.log(chalk18.dim(`--- last ${result.range_days}d ---`));
+    console.log(
+      `  total: ${result.runs_total}    ${chalk18.green("ok")}: ${result.runs_success}    ${chalk18.red("err")}: ${result.runs_failed}    ${chalk18.cyan("running")}: ${result.runs_running}    avg: ${formatDuration(result.avg_duration_ms)}    last: ${result.last_run_at ?? "\u2014"}`
+    );
+    const limit = Math.max(1, Number(opts.limit) || 10);
+    const recent = result.recent.slice(0, limit);
+    if (recent.length === 0) {
+      console.log(chalk18.dim("  (no recent runs)"));
+      return;
+    }
+    console.log();
+    console.log(chalk18.dim("--- recent ---"));
+    for (const r of recent) {
+      const dotStatus = r.status === "done" ? "idle" : r.status === "error" ? "error" : "working";
+      console.log(
+        `  ${statusBadge(dotStatus)} ${r.started_at}    ${r.status.padEnd(8)} ${formatDuration(r.duration_ms).padStart(7)}    ${chalk18.dim(r.type)} ${chalk18.dim(r.task_id)}`
+      );
+    }
   } catch (err) {
+    const apiErr = err;
+    if (apiErr.status === 404) fail5(`not found: ${ref}`);
     fail5(err.message);
   }
 });
@@ -3780,27 +3909,54 @@ agent.command("run <ref>").description("Run an agent against a task with a user
       `/api/agents/${encodeURIComponent(ref)}/run`,
       { task_id: opts.task, prompt: opts.prompt }
     );
-    console.log(chalk19.green(`runtime ${result.runtime.id} started`));
-    if (result.runtime.objectId) console.log(chalk19.dim(`object_id: ${result.runtime.objectId}`));
+    console.log(chalk18.green(`runtime ${result.runtime.id} started`));
+    if (result.runtime.objectId) console.log(chalk18.dim(`object_id: ${result.runtime.objectId}`));
     if (opts.stream) {
       await streamOutput(ref, result.runtime.id);
     }
     if (opts.attach) {
-      console.log(chalk19.dim("--attach not yet wired; runtime is visible in dashboard"));
+      console.log(chalk18.dim("--attach not yet wired; runtime is visible in dashboard"));
     }
   } catch (err) {
     fail5(err.message);
   }
 });
-async function streamOutput(ref, runtimeId) {
+var mcp = new Command18("mcp").description("Manage per-agent MCP config (mcp_config field)");
+mcp.command("set <ref>").description("Set mcp_config from a JSON file (replaces existing config)").requiredOption("--from-file <file>", "JSON file containing the mcp_config object").action(async (ref, opts) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(fs19.readFileSync(path18.resolve(opts.fromFile), "utf-8"));
+  } catch (err) {
+    fail5(`cannot parse ${opts.fromFile}: ${err.message}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    fail5("mcp_config must be a JSON object");
+  }
+  try {
+    await api.put(`/api/agents/${encodeURIComponent(ref)}`, { mcp_config: parsed });
+    console.log(chalk18.green(`mcp_config set on ${ref}`));
+  } catch (err) {
+    fail5(err.message);
+  }
+});
+mcp.command("clear <ref>").description("Remove mcp_config from an agent").action(async (ref) => {
+  try {
+    await api.put(`/api/agents/${encodeURIComponent(ref)}`, { mcp_config: null });
+    console.log(chalk18.green(`mcp_config cleared on ${ref}`));
+  } catch (err) {
+    fail5(err.message);
+  }
+});
+agent.addCommand(mcp);
+async function streamOutput(ref, agentRunId) {
   let lastCount = 0;
   for (let i = 0; i < 600; i++) {
     const result = await api.get(
-      `/api/agents/${encodeURIComponent(ref)}/runs/${encodeURIComponent(runtimeId)}/output`
+      `/api/agents/${encodeURIComponent(ref)}/runs/${encodeURIComponent(agentRunId)}/output`
     );
     for (const line of result.lines.slice(lastCount)) {
       if (line.error?.message) {
-        console.error(chalk19.red(`[error] ${line.error.message}`));
+        console.error(chalk18.red(`[error] ${line.error.message}`));
         return;
       }
       const text = line.message?.content?.map((c) => c.text ?? "").join("") ?? "";
@@ -3812,47 +3968,115 @@ async function streamOutput(ref, runtimeId) {
 }
 
 // src/commands/daemon.ts
-import os6 from "os";
-import { Command as Command20 } from "commander";
-import chalk20 from "chalk";
+import os7 from "os";
+import { Command as Command19 } from "commander";
+import chalk19 from "chalk";
 import WebSocket from "ws";
 
-// src/core/daemon-config.ts
+// src/core/admin-token.ts
 import fs20 from "fs";
 import os4 from "os";
 import path19 from "path";
 var CONFIG_DIR2 = path19.join(os4.homedir(), ".config", "task0");
-var CONFIG_FILE2 = path19.join(CONFIG_DIR2, "daemon.json");
+var TOKEN_FILE = path19.join(CONFIG_DIR2, "admin.token");
+var cached = null;
+var AdminTokenUnavailableError = class extends Error {
+  constructor() {
+    super(
+      `Admin token not found.
+  \u2022 If the task0 server runs on this host, run the task0-server binary once \u2014 the token will be generated at ${TOKEN_FILE}.
+  \u2022 Otherwise, copy the token from the server host and set TASK0_ADMIN_TOKEN.`
+    );
+    this.name = "AdminTokenUnavailableError";
+  }
+};
+function readAdminToken() {
+  if (cached) return cached;
+  const fromEnv = process.env.TASK0_ADMIN_TOKEN?.trim();
+  if (fromEnv) {
+    cached = fromEnv;
+    return cached;
+  }
+  if (fs20.existsSync(TOKEN_FILE)) {
+    const v = fs20.readFileSync(TOKEN_FILE, "utf-8").trim();
+    if (v) {
+      cached = v;
+      return cached;
+    }
+  }
+  throw new AdminTokenUnavailableError();
+}
+function adminAuthHeader() {
+  return { authorization: `Bearer ${readAdminToken()}` };
+}
+
+// src/core/daemon-config.ts
+import fs21 from "fs";
+import os5 from "os";
+import path20 from "path";
+var CONFIG_DIR3 = path20.join(os5.homedir(), ".config", "task0");
+var CONFIG_FILE2 = path20.join(CONFIG_DIR3, "daemon.json");
 function daemonConfigPath() {
   return CONFIG_FILE2;
 }
 function readDaemonIdentity() {
-  if (!fs20.existsSync(CONFIG_FILE2)) return null;
+  if (!fs21.existsSync(CONFIG_FILE2)) return null;
   try {
-    const raw = fs20.readFileSync(CONFIG_FILE2, "utf-8");
+    const raw = fs21.readFileSync(CONFIG_FILE2, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
   }
 }
 function writeDaemonIdentity(identity) {
-  fs20.mkdirSync(CONFIG_DIR2, { recursive: true });
-  fs20.writeFileSync(CONFIG_FILE2, JSON.stringify(identity, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
+  fs21.mkdirSync(CONFIG_DIR3, { recursive: true });
+  fs21.writeFileSync(CONFIG_FILE2, JSON.stringify(identity, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
   try {
-    fs20.chmodSync(CONFIG_FILE2, 384);
+    fs21.chmodSync(CONFIG_FILE2, 384);
   } catch {
   }
 }
 function clearDaemonIdentity() {
-  if (!fs20.existsSync(CONFIG_FILE2)) return false;
-  fs20.unlinkSync(CONFIG_FILE2);
+  if (!fs21.existsSync(CONFIG_FILE2)) return false;
+  fs21.unlinkSync(CONFIG_FILE2);
   return true;
 }
 
+// src/core/register-auth.ts
+var RegisterAuthUnavailableError = class extends Error {
+  constructor() {
+    super(
+      `No registration credential available.
+  \u2022 Pass --token <apit_...> with an API token created in the dashboard, or
+  \u2022 Set TASK0_API_TOKEN in the environment, or
+  \u2022 Fall back to the server's admin token (TASK0_ADMIN_TOKEN or ~/.config/task0/admin.token).`
+    );
+    this.name = "RegisterAuthUnavailableError";
+  }
+};
+function pickRegisterAuth(flagToken) {
+  const fromFlag = flagToken?.trim();
+  if (fromFlag) {
+    return { header: { authorization: `Bearer ${fromFlag}` }, source: "flag" };
+  }
+  const fromEnv = process.env.TASK0_API_TOKEN?.trim();
+  if (fromEnv) {
+    return { header: { authorization: `Bearer ${fromEnv}` }, source: "env" };
+  }
+  try {
+    return { header: { authorization: `Bearer ${readAdminToken()}` }, source: "admin" };
+  } catch (error2) {
+    if (error2 instanceof AdminTokenUnavailableError) {
+      throw new RegisterAuthUnavailableError();
+    }
+    throw error2;
+  }
+}
+
 // src/core/daemon-rpc-handlers.ts
 init_node();
-import fs21 from "fs";
-import path20 from "path";
+import fs22 from "fs";
+import path21 from "path";
 var MAX_FILE_BYTES = 1 * 1024 * 1024;
 function ensureString(value, name) {
   if (typeof value !== "string" || value.length === 0) {
@@ -3865,7 +4089,7 @@ var rpcHandlers = {
   // in-process server's /api/tasks scanProject() returns.
   async scan_project(params) {
     const rootPath = ensureString(params.rootPath, "rootPath");
-    const name = typeof params.name === "string" && params.name ? params.name : path20.basename(rootPath);
+    const name = typeof params.name === "string" && params.name ? params.name : path21.basename(rootPath);
     return scanProject(rootPath, name);
   },
   // Read a file from disk on the daemon's host. The dashboard uses this to
@@ -3875,7 +4099,7 @@ var rpcHandlers = {
     const filePath = ensureString(params.path, "path");
     let stat;
     try {
-      stat = fs21.statSync(filePath);
+      stat = fs22.statSync(filePath);
     } catch {
       throw Object.assign(new Error("file not found"), { code: "not_found" });
     }
@@ -3885,23 +4109,23 @@ var rpcHandlers = {
     if (stat.size > MAX_FILE_BYTES) {
       throw Object.assign(new Error(`file too large (${stat.size} bytes > ${MAX_FILE_BYTES})`), { code: "too_large" });
     }
-    const content = fs21.readFileSync(filePath, "utf-8");
+    const content = fs22.readFileSync(filePath, "utf-8");
     return { content, size: stat.size, modifiedAt: stat.mtime.toISOString() };
   }
 };
 
 // src/core/daemon-service/launchd.ts
-import { spawnSync as spawnSync5 } from "child_process";
-import fs23 from "fs";
-import path22 from "path";
+import { spawnSync as spawnSync6 } from "child_process";
+import fs24 from "fs";
+import path23 from "path";
 
 // src/core/daemon-service/binary.ts
-import fs22 from "fs";
+import fs23 from "fs";
 import { fileURLToPath } from "url";
 function resolveTask0Invocation() {
   const node = process.execPath;
   const argv1 = process.argv[1] ?? fileURLToPath(import.meta.url);
-  const main2 = fs22.realpathSync(argv1);
+  const main2 = fs23.realpathSync(argv1);
   if (!isInstalledBuild(main2) && process.env.TASK0_ALLOW_DEV_SERVICE !== "1") {
     throw new Error(
       `Refusing to install autostart service pointing at ${main2}.
@@ -3917,8 +4141,8 @@ function isInstalledBuild(p) {
 }
 
 // src/core/daemon-service/paths.ts
-import os5 from "os";
-import path21 from "path";
+import os6 from "os";
+import path22 from "path";
 
 // src/core/daemon-service/types.ts
 var SERVICE_LABEL = "cc.cy0.task0";
@@ -3927,21 +4151,21 @@ var SERVICE_LABEL = "cc.cy0.task0";
 function unitPath(scope) {
   const platform = process.platform;
   if (platform === "darwin") {
-    return scope === "user" ? path21.join(os5.homedir(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`) : path21.join("/", "Library", "LaunchDaemons", `${SERVICE_LABEL}.plist`);
+    return scope === "user" ? path22.join(os6.homedir(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`) : path22.join("/", "Library", "LaunchDaemons", `${SERVICE_LABEL}.plist`);
   }
   if (platform === "linux") {
-    return scope === "user" ? path21.join(os5.homedir(), ".config", "systemd", "user", `${SERVICE_LABEL}.service`) : path21.join("/", "etc", "systemd", "system", `${SERVICE_LABEL}.service`);
+    return scope === "user" ? path22.join(os6.homedir(), ".config", "systemd", "user", `${SERVICE_LABEL}.service`) : path22.join("/", "etc", "systemd", "system", `${SERVICE_LABEL}.service`);
   }
   throw new Error(`Unsupported platform for service install: ${platform}`);
 }
 function logDir() {
-  return path21.join(os5.homedir(), ".task0", "logs");
+  return path22.join(os6.homedir(), ".task0", "logs");
 }
 function logPaths() {
   const dir = logDir();
   return {
-    out: path21.join(dir, "daemon.out.log"),
-    err: path21.join(dir, "daemon.err.log")
+    out: path22.join(dir, "daemon.out.log"),
+    err: path22.join(dir, "daemon.err.log")
   };
 }
 
@@ -3994,7 +4218,7 @@ function serviceTarget(scope) {
   return `${domainTarget(scope)}/${SERVICE_LABEL}`;
 }
 function run2(cmd, args) {
-  const res = spawnSync5(cmd, args, { encoding: "utf-8" });
+  const res = spawnSync6(cmd, args, { encoding: "utf-8" });
   return { code: res.status ?? -1, stdout: res.stdout ?? "", stderr: res.stderr ?? "" };
 }
 function createLaunchdManager(scope) {
@@ -4002,8 +4226,8 @@ function createLaunchdManager(scope) {
   const logs = logPaths();
   async function install() {
     const inv = resolveTask0Invocation();
-    fs23.mkdirSync(logDir(), { recursive: true });
-    fs23.mkdirSync(path22.dirname(file), { recursive: true });
+    fs24.mkdirSync(logDir(), { recursive: true });
+    fs24.mkdirSync(path23.dirname(file), { recursive: true });
     const body = renderPlist({
       node: inv.node,
       main: inv.main,
@@ -4012,7 +4236,7 @@ function createLaunchdManager(scope) {
       out: logs.out,
       err: logs.err
     });
-    fs23.writeFileSync(file, body, { mode: 420 });
+    fs24.writeFileSync(file, body, { mode: 420 });
     const bootstrap = run2("launchctl", ["bootstrap", domainTarget(scope), file]);
     if (bootstrap.code !== 0) {
       const already = /already loaded|service already bootstrapped/i.test(bootstrap.stderr);
@@ -4038,9 +4262,9 @@ function createLaunchdManager(scope) {
   }
   async function uninstall() {
     run2("launchctl", ["bootout", serviceTarget(scope)]);
-    if (fs23.existsSync(file)) {
+    if (fs24.existsSync(file)) {
       run2("launchctl", ["unload", file]);
-      fs23.unlinkSync(file);
+      fs24.unlinkSync(file);
     }
   }
   async function start() {
@@ -4059,7 +4283,7 @@ function createLaunchdManager(scope) {
     }
   }
   async function status() {
-    if (!fs23.existsSync(file)) return "absent";
+    if (!fs24.existsSync(file)) return "absent";
     const printed = run2("launchctl", ["print", serviceTarget(scope)]);
     if (printed.code !== 0) return "installed";
     const out = printed.stdout;
@@ -4081,9 +4305,9 @@ function createLaunchdManager(scope) {
 }
 
 // src/core/daemon-service/systemd.ts
-import { spawnSync as spawnSync6 } from "child_process";
-import fs24 from "fs";
-import path23 from "path";
+import { spawnSync as spawnSync7 } from "child_process";
+import fs25 from "fs";
+import path24 from "path";
 function shellEscape(s) {
   if (!/[\s"\\$]/.test(s)) return s;
   return `"${s.replace(/[\\"]/g, (m) => `\\${m}`)}"`;
@@ -4113,7 +4337,7 @@ function scopeFlag(scope) {
   return scope === "user" ? ["--user"] : [];
 }
 function run3(cmd, args) {
-  const res = spawnSync6(cmd, args, { encoding: "utf-8" });
+  const res = spawnSync7(cmd, args, { encoding: "utf-8" });
   return { code: res.status ?? -1, stdout: res.stdout ?? "", stderr: res.stderr ?? "" };
 }
 function createSystemdManager(scope) {
@@ -4122,8 +4346,8 @@ function createSystemdManager(scope) {
   const unitName = `${SERVICE_LABEL}.service`;
   async function install() {
     const inv = resolveTask0Invocation();
-    fs24.mkdirSync(logDir(), { recursive: true });
-    fs24.mkdirSync(path23.dirname(file), { recursive: true });
+    fs25.mkdirSync(logDir(), { recursive: true });
+    fs25.mkdirSync(path24.dirname(file), { recursive: true });
     const body = renderUnit({
       node: inv.node,
       main: inv.main,
@@ -4132,7 +4356,7 @@ function createSystemdManager(scope) {
       err: logs.err,
       scope
     });
-    fs24.writeFileSync(file, body, { mode: 420 });
+    fs25.writeFileSync(file, body, { mode: 420 });
     const reload = run3("systemctl", [...scopeFlag(scope), "daemon-reload"]);
     if (reload.code !== 0) {
       throw new Error(`systemctl daemon-reload failed: ${reload.stderr}`);
@@ -4141,8 +4365,8 @@ function createSystemdManager(scope) {
   }
   async function uninstall() {
     run3("systemctl", [...scopeFlag(scope), "disable", "--now", unitName]);
-    if (fs24.existsSync(file)) {
-      fs24.unlinkSync(file);
+    if (fs25.existsSync(file)) {
+      fs25.unlinkSync(file);
     }
     run3("systemctl", [...scopeFlag(scope), "daemon-reload"]);
   }
@@ -4159,7 +4383,7 @@ function createSystemdManager(scope) {
     }
   }
   async function status() {
-    if (!fs24.existsSync(file)) return "absent";
+    if (!fs25.existsSync(file)) return "absent";
     const res = run3("systemctl", [...scopeFlag(scope), "is-active", unitName]);
     const out = res.stdout.trim();
     if (out === "active") return "running";
@@ -4215,7 +4439,7 @@ function sendRpc(ws, payload) {
   }
 }
 function fail6(message, code = 1) {
-  console.error(chalk20.red(message));
+  console.error(chalk19.red(message));
   process.exit(code);
 }
 function loadRequiredIdentity() {
@@ -4229,10 +4453,18 @@ function serverBase(identity) {
   if (identity) return identity.server_url.replace(/\/$/, "");
   return (process.env.TASK0_API_URL || "http://127.0.0.1:4318").replace(/\/$/, "");
 }
+function adminHeaders() {
+  try {
+    return adminAuthHeader();
+  } catch (error2) {
+    if (error2 instanceof AdminTokenUnavailableError) fail6(error2.message);
+    throw error2;
+  }
+}
 async function jsonGet(url) {
   let res;
   try {
-    res = await fetch(url);
+    res = await fetch(url, { headers: adminHeaders() });
   } catch (error2) {
     fail6(`Cannot reach ${url}: ${error2 instanceof Error ? error2.message : String(error2)}`);
   }
@@ -4245,16 +4477,16 @@ function requireRootIfSystem(scope, rerunHint) {
   if (scope !== "system") return;
   const uid = process.getuid?.();
   if (uid === 0) return;
-  console.error(chalk20.red("--system requires root."));
+  console.error(chalk19.red("--system requires root."));
   console.error("Re-run with sudo, preserving env:");
-  console.error(chalk20.cyan(`  sudo -E ${rerunHint}`));
+  console.error(chalk19.cyan(`  sudo -E ${rerunHint}`));
   process.exit(1);
 }
 function rerunArgv() {
   return ["task0", ...process.argv.slice(2)].join(" ");
 }
-var daemonCmd = new Command20("daemon").description("Manage this host as a task0 daemon registered with a central server");
-daemonCmd.command("register").description("Register this host with a central server, install the autostart service, and start it").requiredOption("-s, --server <url>", "Central server URL (e.g. https://central.example.com:4318)").option("-n, --name <name>", "Display name for this daemon (defaults to hostname)").option("--force", "Overwrite existing identity if present").option("--system", "Install at the system layer (LaunchDaemons / /etc/systemd/system, requires sudo)").option("--no-install", "Skip installing the autostart service unit").option("--no-start", "Install the service unit but do not start it now").action(async (opts) => {
+var daemonCmd = new Command19("daemon").description("Manage this host as a task0 daemon registered with a central server");
+daemonCmd.command("register").description("Register this host with a central server, install the autostart service, and start it").requiredOption("-s, --server <url>", "Central server URL (e.g. https://central.example.com:4318)").option("-n, --name <name>", "Display name for this daemon (defaults to hostname)").option("-t, --token <token>", "API token (apit_...) for registration. Falls back to TASK0_API_TOKEN, then admin token.").option("--force", "Overwrite existing identity if present").option("--system", "Install at the system layer (LaunchDaemons / /etc/systemd/system, requires sudo)").option("--no-install", "Skip installing the autostart service unit").option("--no-start", "Install the service unit but do not start it now").action(async (opts) => {
   const scope = opts.system ? "system" : "user";
   if (opts.install) {
     requireRootIfSystem(scope, rerunArgv());
@@ -4264,8 +4496,19 @@ daemonCmd.command("register").description("Register this host with a central ser
     fail6(`Already registered as ${existing.daemon_id}. Pass --force to re-register.`);
   }
   const base = opts.server.replace(/\/$/, "");
+  let authHeader;
+  try {
+    const choice = pickRegisterAuth(opts.token);
+    authHeader = choice.header;
+    if (choice.source === "admin") {
+      console.log(chalk19.dim("Registering with admin token (legacy). Prefer an API token from the dashboard."));
+    }
+  } catch (error2) {
+    if (error2 instanceof RegisterAuthUnavailableError) fail6(error2.message);
+    throw error2;
+  }
   const body = {
-    hostname: os6.hostname(),
+    hostname: os7.hostname(),
     platform: process.platform,
     name: opts.name
   };
@@ -4273,7 +4516,7 @@ daemonCmd.command("register").description("Register this host with a central ser
   try {
     res = await fetch(`${base}/api/daemons/register`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", ...authHeader },
       body: JSON.stringify(body)
     });
   } catch (error2) {
@@ -4293,16 +4536,16 @@ daemonCmd.command("register").description("Register this host with a central ser
     registered_at: data.daemon.registered_at
   };
   writeDaemonIdentity(identity);
-  console.log(chalk20.green(`Registered as ${data.daemon.object_id} (${data.daemon.name})`));
+  console.log(chalk19.green(`Registered as ${data.daemon.object_id} (${data.daemon.name})`));
   console.log(`Identity saved to ${daemonConfigPath()}`);
   if (!opts.install) {
-    console.log(chalk20.dim("Skipping service install (--no-install)."));
-    console.log(chalk20.dim(`Run \`task0 daemon run\` to start the WebSocket loop in foreground.`));
+    console.log(chalk19.dim("Skipping service install (--no-install)."));
+    console.log(chalk19.dim(`Run \`task0 daemon run\` to start the WebSocket loop in foreground.`));
     return;
   }
   if (!isPlatformSupported()) {
     console.log(
-      chalk20.yellow(
+      chalk19.yellow(
         `Autostart service is not supported on ${process.platform}. Run \`task0 daemon run\` under a supervisor of your choice.`
       )
     );
@@ -4312,18 +4555,18 @@ daemonCmd.command("register").description("Register this host with a central ser
   try {
     const { unitPath: unitPath2 } = await svc.install({ identity });
     const logs = svc.logPaths();
-    console.log(chalk20.green(`Installed service unit at ${unitPath2}`));
-    console.log(chalk20.dim(`Logs: ${logs.out}`));
-    console.log(chalk20.dim(`      ${logs.err}`));
+    console.log(chalk19.green(`Installed service unit at ${unitPath2}`));
+    console.log(chalk19.dim(`Logs: ${logs.out}`));
+    console.log(chalk19.dim(`      ${logs.err}`));
     if (opts.start) {
       await svc.start();
-      console.log(chalk20.green("Service started."));
+      console.log(chalk19.green("Service started."));
     } else {
-      console.log(chalk20.dim("Skipping start (--no-start). Run `task0 daemon start` when ready."));
+      console.log(chalk19.dim("Skipping start (--no-start). Run `task0 daemon start` when ready."));
     }
   } catch (error2) {
-    console.error(chalk20.red(`Service install failed: ${error2 instanceof Error ? error2.message : String(error2)}`));
-    console.error(chalk20.dim("Identity is saved; rerun `task0 daemon register --force` once the issue is resolved."));
+    console.error(chalk19.red(`Service install failed: ${error2 instanceof Error ? error2.message : String(error2)}`));
+    console.error(chalk19.dim("Identity is saved; rerun `task0 daemon register --force` once the issue is resolved."));
     process.exit(1);
   }
 });
@@ -4336,7 +4579,7 @@ daemonCmd.command("start").description("Start the installed autostart service vi
   const svc = getServiceManager(scope);
   try {
     await svc.start();
-    console.log(chalk20.green("Service started."));
+    console.log(chalk19.green("Service started."));
   } catch (error2) {
     fail6(error2 instanceof Error ? error2.message : String(error2));
   }
@@ -4350,7 +4593,7 @@ daemonCmd.command("stop").description("Stop the autostart service via launchctl
   const svc = getServiceManager(scope);
   try {
     await svc.stop();
-    console.log(chalk20.green("Service stopped."));
+    console.log(chalk19.green("Service stopped."));
   } catch (error2) {
     fail6(error2 instanceof Error ? error2.message : String(error2));
   }
@@ -4358,7 +4601,7 @@ daemonCmd.command("stop").description("Stop the autostart service via launchctl
 daemonCmd.command("run").description("Run the daemon WebSocket loop in foreground (invoked by the service unit; useful for debugging)").action(async () => {
   const identity = loadRequiredIdentity();
   const wsUrl = identity.server_url.replace(/^http/, "ws").replace(/\/$/, "") + "/ws/daemon";
-  console.log(chalk20.green(`Starting daemon ${identity.daemon_id} \u2192 ${wsUrl}`));
+  console.log(chalk19.green(`Starting daemon ${identity.daemon_id} \u2192 ${wsUrl}`));
   let reconnectDelay = 1e3;
   let shouldRun = true;
   let activeWs = null;
@@ -4369,7 +4612,7 @@ daemonCmd.command("run").description("Run the daemon WebSocket loop in foregroun
     activeWs = ws;
     ws.on("open", () => {
       reconnectDelay = 1e3;
-      console.log(chalk20.green(`[${(/* @__PURE__ */ new Date()).toISOString()}] connected`));
+      console.log(chalk19.green(`[${(/* @__PURE__ */ new Date()).toISOString()}] connected`));
       const hello = {
         type: "hello",
         daemon_id: identity.daemon_id,
@@ -4381,7 +4624,7 @@ daemonCmd.command("run").description("Run the daemon WebSocket loop in foregroun
       const projects = loadConfig().sources.filter((source2) => source2.type === "project").map((source2) => ({ name: source2.name, path: source2.path, enabled: source2.enabled }));
       const manifest = { type: "manifest", projects };
       ws.send(JSON.stringify(manifest));
-      console.log(chalk20.dim(`pushed manifest: ${projects.length} project(s)`));
+      console.log(chalk19.dim(`pushed manifest: ${projects.length} project(s)`));
     });
     ws.on("message", (raw) => {
       let msg;
@@ -4391,12 +4634,12 @@ daemonCmd.command("run").description("Run the daemon WebSocket loop in foregroun
         return;
       }
       if (msg.type === "welcome") {
-        console.log(chalk20.green(`welcomed ${msg.server_time}`));
+        console.log(chalk19.green(`welcomed ${msg.server_time}`));
       } else if (msg.type === "ping") {
         const beat = { type: "heartbeat", ts: (/* @__PURE__ */ new Date()).toISOString() };
         if (ws.readyState === ws.OPEN) ws.send(JSON.stringify(beat));
       } else if (msg.type === "error") {
-        console.error(chalk20.yellow(`server error: ${msg.message}`));
+        console.error(chalk19.yellow(`server error: ${msg.message}`));
       } else if (msg.type === "rpc_request") {
         void dispatchRpc(ws, msg.id, msg.method, msg.params);
       }
@@ -4404,9 +4647,9 @@ daemonCmd.command("run").description("Run the daemon WebSocket loop in foregroun
     ws.on("close", (code, reason) => {
       activeWs = null;
       const reasonText = reason.toString("utf-8") || "no reason";
-      console.log(chalk20.yellow(`[${(/* @__PURE__ */ new Date()).toISOString()}] disconnected (code=${code}, ${reasonText})`));
+      console.log(chalk19.yellow(`[${(/* @__PURE__ */ new Date()).toISOString()}] disconnected (code=${code}, ${reasonText})`));
       if (code === 4001) {
-        console.error(chalk20.red("superseded by another daemon connection; exiting"));
+        console.error(chalk19.red("superseded by another daemon connection; exiting"));
         process.exit(0);
       }
       if (shouldRun) {
@@ -4415,7 +4658,7 @@ daemonCmd.command("run").description("Run the daemon WebSocket loop in foregroun
       }
     });
     ws.on("error", (err) => {
-      console.error(chalk20.red(`ws error: ${err.message}`));
+      console.error(chalk19.red(`ws error: ${err.message}`));
     });
   }
   const shutdown = () => {
@@ -4440,9 +4683,9 @@ daemonCmd.command("list").description("List daemons registered on the configured
     return;
   }
   for (const d of data.daemons) {
-    const status = d.status === "online" ? chalk20.green(d.status) : chalk20.dim(d.status);
+    const status = d.status === "online" ? chalk19.green(d.status) : chalk19.dim(d.status);
     console.log(
-      `${chalk20.bold(d.object_id)}  ${d.name.padEnd(20)}  ${d.hostname.padEnd(24)}  ${d.platform.padEnd(8)}  ${status}`
+      `${chalk19.bold(d.object_id)}  ${d.name.padEnd(20)}  ${d.hostname.padEnd(24)}  ${d.platform.padEnd(8)}  ${status}`
     );
   }
 });
@@ -4455,9 +4698,9 @@ daemonCmd.command("show [daemonId]").description("Show local daemon identity (no
       try {
         const svc = getServiceManager(scope);
         const state2 = await svc.status();
-        console.log(chalk20.dim(`service (${scope}): ${state2}  \u2192  ${svc.unitPath()}`));
+        console.log(chalk19.dim(`service (${scope}): ${state2}  \u2192  ${svc.unitPath()}`));
       } catch (error2) {
-        console.log(chalk20.dim(`service status unavailable: ${error2 instanceof Error ? error2.message : String(error2)}`));
+        console.log(chalk19.dim(`service status unavailable: ${error2 instanceof Error ? error2.message : String(error2)}`));
       }
     }
     return;
@@ -4474,21 +4717,169 @@ daemonCmd.command("logout").description("Stop and uninstall the autostart servic
       const svc = getServiceManager(scope);
       try {
         await svc.uninstall();
-        console.log(chalk20.dim(`Service unit removed (${scope}).`));
+        console.log(chalk19.dim(`Service unit removed (${scope}).`));
       } catch (error2) {
         console.error(
-          chalk20.yellow(`Service uninstall warning: ${error2 instanceof Error ? error2.message : String(error2)}`)
+          chalk19.yellow(`Service uninstall warning: ${error2 instanceof Error ? error2.message : String(error2)}`)
         );
       }
     }
   }
   if (clearDaemonIdentity()) {
-    console.log(chalk20.green("Daemon identity cleared."));
+    console.log(chalk19.green("Daemon identity cleared."));
   } else {
     console.log("No daemon identity to clear.");
   }
 });
 
+// src/commands/user.ts
+import { Command as Command20 } from "commander";
+import chalk20 from "chalk";
+var DEFAULT_BASE2 = (process.env.TASK0_API_URL || "http://127.0.0.1:4318").replace(/\/$/, "");
+function serverBase2() {
+  return DEFAULT_BASE2;
+}
+function fail7(message, code = 1) {
+  console.error(chalk20.red(message));
+  process.exit(code);
+}
+async function callServer(path26, init = {}) {
+  const url = `${serverBase2()}${path26}`;
+  let auth;
+  try {
+    auth = adminAuthHeader();
+  } catch (error2) {
+    if (error2 instanceof AdminTokenUnavailableError) fail7(error2.message);
+    throw error2;
+  }
+  const headers = { ...auth, ...init.headers };
+  let res;
+  try {
+    res = await fetch(url, { ...init, headers });
+  } catch (error2) {
+    fail7(`Cannot reach ${url}: ${error2 instanceof Error ? error2.message : String(error2)}`);
+  }
+  if (res.status === 204) return { status: 204, body: null };
+  const text = await res.text();
+  let body = null;
+  if (text.length > 0) {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = null;
+    }
+  }
+  return { status: res.status, body };
+}
+function promptHidden(prompt) {
+  return new Promise((resolve, reject) => {
+    const stdin = process.stdin;
+    const stdout = process.stdout;
+    if (!stdin.isTTY) {
+      reject(new Error("stdin is not a TTY; password input requires an interactive terminal"));
+      return;
+    }
+    stdout.write(prompt);
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    let buf = "";
+    const onData = (raw) => {
+      for (const ch of raw) {
+        const code = ch.charCodeAt(0);
+        if (ch === "\n" || ch === "\r" || code === 4) {
+          stdin.removeListener("data", onData);
+          stdin.setRawMode(false);
+          stdin.pause();
+          stdout.write("\n");
+          resolve(buf);
+          return;
+        }
+        if (code === 3) {
+          stdin.removeListener("data", onData);
+          stdin.setRawMode(false);
+          stdin.pause();
+          stdout.write("\n");
+          process.exit(130);
+        }
+        if (code === 127 || code === 8) {
+          buf = buf.slice(0, -1);
+          continue;
+        }
+        if (code < 32) continue;
+        buf += ch;
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+async function readPasswordWithConfirm() {
+  const a = await promptHidden("Password: ");
+  if (!a) fail7("Password must not be empty.");
+  const b = await promptHidden("Confirm password: ");
+  if (a !== b) fail7("Passwords do not match.");
+  return a;
+}
+var userCmd = new Command20("user").description("Manage dashboard login accounts");
+userCmd.command("create <username>").description("Create a new dashboard login account (prompts for password)").action(async (username) => {
+  const password = await readPasswordWithConfirm();
+  const { status, body } = await callServer(
+    "/api/auth/users",
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ username, password })
+    }
+  );
+  if (status === 201 && body?.user) {
+    console.log(chalk20.green(`Created user ${body.user.username} (${body.user.object_id})`));
+    return;
+  }
+  if (status === 409) fail7(body?.error || "username already exists");
+  fail7(`Server returned ${status}: ${body?.error ?? "unknown error"}`);
+});
+userCmd.command("list").description("List dashboard login accounts").action(async () => {
+  const { status, body } = await callServer("/api/auth/users");
+  if (status !== 200 || !body) fail7(`Server returned ${status}: ${body?.error ?? "unknown error"}`);
+  if (body.users.length === 0) {
+    console.log("No users. Use `task0 user create <username>` to create one.");
+    return;
+  }
+  const nameWidth = Math.max(...body.users.map((u) => u.username.length), 4);
+  for (const u of body.users) {
+    console.log(`${chalk20.cyan(u.object_id)}  ${u.username.padEnd(nameWidth)}  ${chalk20.dim(u.created_at)}`);
+  }
+});
+userCmd.command("delete <username>").description("Delete a dashboard login account").action(async (username) => {
+  const { status, body } = await callServer(
+    `/api/auth/users/${encodeURIComponent(username)}`,
+    { method: "DELETE" }
+  );
+  if (status === 204) {
+    console.log(chalk20.green(`Deleted user ${username}`));
+    return;
+  }
+  if (status === 404) fail7(body?.error || "user not found");
+  fail7(`Server returned ${status}: ${body?.error ?? "unknown error"}`);
+});
+userCmd.command("passwd <username>").description("Reset a user's password (prompts for new password)").action(async (username) => {
+  const password = await readPasswordWithConfirm();
+  const { status, body } = await callServer(
+    `/api/auth/users/${encodeURIComponent(username)}/password`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ password })
+    }
+  );
+  if (status === 204) {
+    console.log(chalk20.green(`Updated password for ${username}`));
+    return;
+  }
+  if (status === 404) fail7(body?.error || "user not found");
+  fail7(`Server returned ${status}: ${body?.error ?? "unknown error"}`);
+});
+
 // src/commands/error.ts
 init_node();
 import { Command as Command21 } from "commander";
@@ -4653,6 +5044,209 @@ error.command("prune").description("Remove captured error reports by age, count,
   console.log(`Removed ${res.removed.length} report(s); ${res.kept} remaining.`);
 });
 
+// src/commands/automation.ts
+import { Command as Command22 } from "commander";
+import chalk22 from "chalk";
+function fail8(message) {
+  console.error(chalk22.red(message));
+  process.exit(1);
+}
+function shortIso(value) {
+  if (!value) return "\u2014";
+  return value.replace("T", " ").replace(/\.\d{3}Z$/, "Z").replace(/Z$/, " UTC");
+}
+function buildPresetRrule(preset, opts) {
+  switch (preset) {
+    case "hourly": {
+      const minute = clampInt(opts.minute ?? "0", 0, 59);
+      return `RRULE:FREQ=HOURLY;BYMINUTE=${minute};BYSECOND=0`;
+    }
+    case "daily": {
+      const { hour, minute } = parseHHMM(opts.time ?? "09:00");
+      return `RRULE:FREQ=DAILY;BYHOUR=${hour};BYMINUTE=${minute};BYSECOND=0`;
+    }
+    case "weekdays": {
+      const { hour, minute } = parseHHMM(opts.time ?? "09:00");
+      return `RRULE:FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR;BYHOUR=${hour};BYMINUTE=${minute};BYSECOND=0`;
+    }
+    case "weekly": {
+      const { hour, minute } = parseHHMM(opts.time ?? "09:00");
+      const codes = ["SU", "MO", "TU", "WE", "TH", "FR", "SA"];
+      const idx = clampInt(opts.weekday ?? "1", 0, 6);
+      return `RRULE:FREQ=WEEKLY;BYDAY=${codes[idx]};BYHOUR=${hour};BYMINUTE=${minute};BYSECOND=0`;
+    }
+    case "custom": {
+      if (!opts.custom) throw new Error("custom preset requires --rrule");
+      const trimmed = opts.custom.trim();
+      if (!trimmed.startsWith("RRULE:")) throw new Error('custom rrule must start with "RRULE:"');
+      return trimmed;
+    }
+  }
+}
+function parseHHMM(value) {
+  const m = value.match(/^(\d{1,2}):(\d{2})$/);
+  if (!m) throw new Error(`invalid --time, expected HH:MM, got: ${value}`);
+  return {
+    hour: clampInt(m[1], 0, 23),
+    minute: clampInt(m[2], 0, 59)
+  };
+}
+function clampInt(value, lo, hi) {
+  const n = Number(value);
+  if (!Number.isFinite(n)) return lo;
+  return Math.max(lo, Math.min(hi, Math.floor(n)));
+}
+function printAutomation(a) {
+  const status = a.status === "active" ? chalk22.green("active") : chalk22.yellow("paused");
+  console.log(
+    `${chalk22.cyan(a.object_id.padEnd(10))}  ${status.padEnd(15)}  ${a.schedule_preset.padEnd(8)}  next=${shortIso(a.next_run_at)}`
+  );
+  console.log(`  ${chalk22.bold(a.title)}`);
+  console.log(
+    `  project=${a.project_name}  agent=${a.agent_object_id}  skill=${a.skill_file_path}`
+  );
+  console.log(`  rrule=${chalk22.dim(a.rrule)}  tz=${a.timezone}`);
+}
+function printRun(r) {
+  const status = (() => {
+    switch (r.status) {
+      case "succeeded":
+        return chalk22.green(r.status);
+      case "failed":
+        return chalk22.red(r.status);
+      case "running":
+        return chalk22.yellow(r.status);
+      case "pending":
+        return chalk22.dim(r.status);
+    }
+  })();
+  console.log(
+    `${chalk22.cyan(r.object_id.padEnd(10))}  ${status.padEnd(18)}  ${r.trigger.padEnd(10)}  started=${shortIso(r.started_at)}  finished=${shortIso(r.finished_at)}`
+  );
+  console.log(`  ${chalk22.dim(r.title_snapshot)}`);
+  if (r.agent_run_object_id) console.log(`  agent_run=${chalk22.dim(r.agent_run_object_id)}`);
+  if (r.error_message) console.log(`  ${chalk22.red("error: " + r.error_message)}`);
+}
+function maybeJson2(view, opts) {
+  if (opts.json) {
+    console.log(JSON.stringify(view, null, 2));
+    return true;
+  }
+  return false;
+}
+var automation = new Command22("automation").description(
+  "Manage automations \u2014 scheduled or manual AgentRuns"
+);
+automation.command("list").description("List automations").option("-p, --project <name>", "Filter by project (defaults to cwd if no other filter)").option("--status <status>", "active|paused").option("--json", "Output JSON").option("--all", "Do not filter by project").action(async (opts) => {
+  const query = new URLSearchParams();
+  if (!opts.all) {
+    const projectName = opts.project ?? safeResolveProject();
+    if (projectName) query.set("project", projectName);
+  }
+  if (opts.status) query.set("status", opts.status);
+  const qs = query.toString();
+  const url = qs ? `/api/automations?${qs}` : "/api/automations";
+  const { automations } = await api.get(url);
+  if (maybeJson2(automations, opts)) return;
+  if (automations.length === 0) {
+    console.log(chalk22.dim("No automations"));
+    return;
+  }
+  for (const a of automations) printAutomation(a);
+});
+function safeResolveProject() {
+  try {
+    return resolveProjectName({});
+  } catch {
+    return void 0;
+  }
+}
+automation.command("create").description("Create a new automation").requiredOption("--title <title>", "Display name").option("-p, --project <name>", "Project name (defaults to cwd)").requiredOption("--agent <object_id>", "Agent object id (agt_*)").requiredOption("--skill <path>", "Absolute path to the skill markdown file").requiredOption("--prompt <text>", "Additional prompt sent to the agent").requiredOption("--schedule <preset>", "hourly|daily|weekdays|weekly|custom").option("--time <HH:MM>", "Local time for daily/weekdays/weekly presets", "09:00").option("--weekday <0-6>", "Day of week for weekly preset (Sun=0)", "1").option("--minute <0-59>", "Minute for hourly preset", "0").option("--rrule <rrule>", "Custom RRULE string (required when --schedule=custom)").option("--timezone <tz>", "IANA timezone", "UTC").option("--dtstart <iso>", "Schedule anchor (ISO 8601)").option("--model <name>", "Override agent model").option("--paused", "Create in paused status").option("--json", "Output JSON").action(async (opts) => {
+  const presets = ["hourly", "daily", "weekdays", "weekly", "custom"];
+  if (!presets.includes(opts.schedule)) {
+    fail8(`--schedule must be one of ${presets.join("|")}`);
+  }
+  const preset = opts.schedule;
+  let rrule;
+  try {
+    rrule = buildPresetRrule(preset, {
+      time: opts.time,
+      weekday: opts.weekday,
+      minute: opts.minute,
+      custom: opts.rrule
+    });
+  } catch (err) {
+    fail8(err instanceof Error ? err.message : "failed to build rrule");
+  }
+  const projectName = opts.project ?? safeResolveProject();
+  if (!projectName) fail8("Cannot determine project \u2014 pass --project or run inside a registered project");
+  const { automation: automation2 } = await api.post("/api/automations", {
+    title: opts.title,
+    project_name: projectName,
+    agent_object_id: opts.agent,
+    skill_file_path: opts.skill,
+    prompt: opts.prompt,
+    schedule_preset: preset,
+    rrule,
+    timezone: opts.timezone,
+    dtstart: opts.dtstart,
+    model: opts.model ?? null,
+    status: opts.paused ? "paused" : "active"
+  });
+  if (maybeJson2(automation2, opts)) return;
+  console.log(chalk22.green("created:"));
+  printAutomation(automation2);
+});
+automation.command("get <id>").description("Show automation detail including recent runs").option("--json", "Output JSON").action(async (id, opts) => {
+  const { automation: automation2 } = await api.get(`/api/automations/${encodeURIComponent(id)}`);
+  if (maybeJson2(automation2, opts)) return;
+  printAutomation(automation2);
+  console.log("");
+  console.log(chalk22.dim(`recent_runs (${automation2.recent_runs.length}):`));
+  for (const run4 of automation2.recent_runs) printRun(run4);
+});
+automation.command("update <id>").description("Patch an automation").option("--title <title>").option("--prompt <text>").option("--status <status>", "active|paused").option("--rrule <rrule>").option("--timezone <tz>").option("--dtstart <iso>").option("--model <name>").option("--json", "Output JSON").action(async (id, opts) => {
+  const patch = {};
+  if (opts.title) patch.title = opts.title;
+  if (opts.prompt) patch.prompt = opts.prompt;
+  if (opts.status) patch.status = opts.status;
+  if (opts.rrule) patch.rrule = opts.rrule;
+  if (opts.timezone) patch.timezone = opts.timezone;
+  if (opts.dtstart) patch.dtstart = opts.dtstart;
+  if (opts.model !== void 0) patch.model = opts.model || null;
+  const { automation: automation2 } = await api.patch(
+    `/api/automations/${encodeURIComponent(id)}`,
+    patch
+  );
+  if (maybeJson2(automation2, opts)) return;
+  console.log(chalk22.green("updated:"));
+  printAutomation(automation2);
+});
+automation.command("delete <id>").description("Delete an automation and its run history").action(async (id) => {
+  await api.del(`/api/automations/${encodeURIComponent(id)}`);
+  console.log(chalk22.green(`deleted ${id}`));
+});
+automation.command("run <id>").description("Trigger an automation immediately (manual)").option("--json", "Output JSON").action(async (id, opts) => {
+  const { automation_run } = await api.post(
+    `/api/automations/${encodeURIComponent(id)}/run`
+  );
+  if (maybeJson2(automation_run, opts)) return;
+  console.log(chalk22.green("started:"));
+  printRun(automation_run);
+});
+automation.command("runs <id>").description("List recent runs for an automation").option("--limit <n>", "Max rows to return", "20").option("--json", "Output JSON").action(async (id, opts) => {
+  const limit = Number(opts.limit ?? "20");
+  const { automation_runs } = await api.get(
+    `/api/automations/${encodeURIComponent(id)}/runs?limit=${limit}`
+  );
+  if (maybeJson2(automation_runs, opts)) return;
+  if (automation_runs.length === 0) {
+    console.log(chalk22.dim("No runs"));
+    return;
+  }
+  for (const run4 of automation_runs) printRun(run4);
+});
+
 // src/core/error-capture.ts
 init_node();
 var DEFAULT_KEEP = 50;
@@ -4753,30 +5347,31 @@ function captureTopLevel(err, options) {
 var TASK0_VERSION = readVersion();
 function readVersion() {
   try {
-    const here = path24.dirname(fileURLToPath2(import.meta.url));
-    const pkg = JSON.parse(readFileSync(path24.resolve(here, "..", "package.json"), "utf-8"));
+    const here = path25.dirname(fileURLToPath2(import.meta.url));
+    const pkg = JSON.parse(readFileSync(path25.resolve(here, "..", "package.json"), "utf-8"));
     return pkg.version ?? "unknown";
   } catch {
     return "unknown";
   }
 }
-var program = new Command22().name("task0").description("Task-centric control layer for agent workflow").version(TASK0_VERSION);
+var program = new Command23().name("task0").description("Task-centric control layer for agent workflow").version(TASK0_VERSION);
 program.addCommand(source);
 program.addCommand(project);
 program.addCommand(task);
-program.addCommand(runtime);
+program.addCommand(agentRun);
 program.addCommand(plan);
 program.addCommand(okr);
 program.addCommand(note);
 program.addCommand(run);
 program.addCommand(ui);
-program.addCommand(serve);
 program.addCommand(models);
 program.addCommand(object);
 program.addCommand(issue);
 program.addCommand(agent);
 program.addCommand(daemonCmd);
+program.addCommand(userCmd);
 program.addCommand(error);
+program.addCommand(automation);
 async function main() {
   installErrorCapture({ version: TASK0_VERSION });
   try {