@todoforai/cli 0.1.68 → 0.1.70

package/dist/todoforai-cli.js

@@ -43132,6 +43132,18 @@ class ApiClient {
       throw new Error(`API POST /resources/open failed: ${res.status} ${await res.text()}`);
     return res.json();
   }
+  async showConnect(todoId, keys, opts = {}) {
+    const endpoint = `${this.apiUrl}${restBasePath(this.apiKey)}/resources/connect`;
+    const res = await fetch(endpoint, {
+      method: "POST",
+      headers: { "x-api-key": this.apiKey, "Content-Type": "application/json" },
+      body: JSON.stringify({ todoId, keys, ...opts }),
+      signal: AbortSignal.timeout(30000)
+    });
+    if (!res.ok)
+      throw new Error(`API POST /resources/connect failed: ${res.status} ${await res.text()}`);
+    return res.json();
+  }
   async listShows(opts = {}) {
     const qs = new URLSearchParams;
     if (opts.todoId)
@@ -43976,8 +43988,7 @@ var ToolType;
   ToolType2["Question"] = "question";
   ToolType2["Login"] = "login_prompt";
   ToolType2["BusinessOnboarding"] = "business_onboarding";
-  ToolType2["RequestMcpAccess"] = "request_mcp_access";
-  ToolType2["EdgeNotRunning"] = "edge_not_running";
+  ToolType2["ConnectDevice"] = "connect_device";
   ToolType2["WebFetch"] = "webfetch";
   ToolType2["GoogleSearch"] = "google_search";
   ToolType2["WebSearch"] = "web_search";
@@ -43998,7 +44009,8 @@ var USER_INPUT_BLOCK_TYPES = new Set([
   "question" /* Question */,
   "login_prompt" /* Login */,
   "business_onboarding" /* BusinessOnboarding */,
-  "open_browser" /* OpenBrowser */
+  "open_browser" /* OpenBrowser */,
+  "connect_device" /* ConnectDevice */
 ]);
 var EDGE_TOOL_TYPES = new Set([
   "read" /* Read */,
@@ -44711,6 +44723,7 @@ var tool_catalog_default = {
     voiceChannel: "Gmail",
     summary: "Read and send Gmail from your own account.",
     statusCmd: "zele whoami 2>/dev/null | grep -o 'email: *[^ ]*' | tr -d ' ' | paste -sd ' ' - | grep -m1 .",
+    logoutCmd: "zele logout {{ACCOUNT}}",
     loginNeedsPty: true,
     loginCmd: "zele login --method google",
     oauthUrlPattern: "(https://accounts\\.google\\.com\\S+)",
@@ -44722,6 +44735,7 @@ var tool_catalog_default = {
     description: "Gmail (multi-account, OAuth login): inbox, search, send, reply, contacts. Google Calendar via `zele cal`: list/create/update/delete events (Meet links, recurrence), respond to invites, free/busy."
   },
   "zele-calendar": {
+    subcommands: ["cal"],
     preinstallCloud: true,
     category: "productivity",
     pkg: "zele",
@@ -44730,6 +44744,7 @@ var tool_catalog_default = {
     label: "Google Calendar",
     summary: "See your Google Calendar and book, move or cancel events.",
     statusCmd: "zele whoami 2>/dev/null | grep -o 'email: *[^ ]*' | tr -d ' ' | paste -sd ' ' - | grep -m1 .",
+    logoutCmd: "zele logout {{ACCOUNT}}",
     loginNeedsPty: true,
     loginCmd: "zele login --method google",
     oauthUrlPattern: "(https://accounts\\.google\\.com\\S+)",
@@ -44940,6 +44955,24 @@ var tool_catalog_default = {
     versionCmd: "ntn --version 2>/dev/null | sed -n 1p",
     description: "Official Notion CLI: raw API calls (`ntn api <path>`), page/data-source management, file uploads, Workers deploy."
   },
+  treg: {
+    preinstallCloud: true,
+    packages: ["tools-registry==0.27.0"],
+    category: "research",
+    pkg: "tools-registry",
+    pipModules: ["treg"],
+    installer: "pip",
+    label: "treg",
+    summary: "Call 4000+ paid data/SEO/enrichment APIs through one prepaid key, no vendor accounts.",
+    statusCmd: `python3 -c "import json,os;d=json.load(open(os.path.expanduser('~/.treg/config.json')));print(d.get('email') or '' if d.get('token') else '')" 2>/dev/null | grep -m1 .`,
+    loginCmd: "treg login",
+    oauthUrlPattern: "(https://treg\\.to/login\\?\\S+)",
+    sessionIdPattern: "#code=([A-Z0-9]{4,8})",
+    logoutCmd: "treg logout",
+    credentialPaths: ["~/.treg/config.json"],
+    versionCmd: "treg --version 2>/dev/null | sed -n 1p",
+    description: 'treg.to ("OpenRouter for agent tools"): one prepaid balance, 100+ providers (SE Ranking, DataForSEO, Perplexity, CompanyEnrich, ScrapeCreators, TikHub, cloro AI-search scrapes…) metered per call, credentials injected server-side. Find by intent: `treg catalog search "backlinks for a domain" --json` (each result shows price + a `call_template`); run: `treg call <endpoint.id> --query k=v --json` or `treg call <endpoint.id> --method POST --data \'<json>\' --json` (prints one `{result,_treg}` line); money: `treg balance`, `treg topup`; `treg review` rates a call. Own keys/CLIs: `treg secret|tool|skill`, `treg cli run <vendor> …` and `treg <cmd>` inject the team\'s stored credentials. Team: `treg org ls|use|invite|members`, `treg audit`. `--org <slug>` targets another team. Every catalog call spends real money — check the `cost` field and prefer a connected first-party connector when one exists. Docs: https://treg.to/llms.txt'
+  },
   "perplexity-api": {
     preinstallCloud: true,
     category: "research",
@@ -45201,7 +45234,7 @@ var tool_catalog_default = {
     installer: "npm",
     label: "TODOforAI",
     summary: "Create and follow up on your TODOs, and show results in the chat.",
-    description: 'Manage the user\'s OWN TODOforAI tasks (not code `// TODO` comments). Delegate/spin off work: `tfa-cli "prompt"` creates a real TODO with its own agent and chat (`-n` wait for completion, `--no-watch` fire-and-forget, `--project/--agent/--model`, `--resume <id>`, `addmessage <id> "text"`). Inspect: `list [--status open]`, `--inspect <id>`. Edit any todo without opening it: `status <id> DONE|READY|ARCHIVED|POSTPONED|CANCELLED|DELETED` (close, reopen, shelve, trash — `todo restore <id>` undoes a delete) and `todo set <id|-> title=… group=… star=true schedule=<unix-ms> agent=… brand=…` (own todo fields). Both take ONE id, so a loop over `list --json | jq -r \'.items[].id\'` is how you close, retitle, refile or archive MANY todos at once; `project set|settings|groups …` (name, settings, todo groups), `agent create|update <agent> model=… sysmsg=…` (permissions/MCP/device wiring and delete are refused from an agent shell). Surface results into chat: `show <file|-> [todo-id]` (renders by mimetype, private to the todo\'s readers; `--card <name>` via project renderer; `--alias <name>` updates in place, `--alias <todoId>:<name>` updates another todo\'s artifact; `show share <ref>` makes it public and prints the link, `show unshare <ref>` makes it private again), `open <url>` embeds a live preview. Show viewer chrome: `--title` appears in the header; a kebab menu holds file actions, versions and sharing when available. Desktop floating previews add minimize (park in a tab), maximize/restore and close (X); inline blocks have no window controls. For authored HTML, do not duplicate the header/controls or add a rounded, bordered root card: the floating viewer owns the rounded frame. Keep content edge-to-edge; internal layout padding is fine. Pick by where the output lives: read once → plain reply; interactive, this chat only → `html_snippet`; kept/revised later → `show --alias`, then `show share` only if someone outside needs a link; format the user asked for (pptx, docx…) → `show` the file. Notifications: `inbox [needs-you|messages|activity] [--unread]` reads the user\'s bell feed (what finished/failed/needs them while away), `inbox seen [tab]` marks it read; `notify "Title" "message" [--href /t/<id>]` leaves a note in the user\'s Messages tab + phone push (shown as from you); `--to <email>` reaches a member of the current project instead (`project members` lists them, 20/day) — nobody else; same text is delivered once, max 10/day to the user, use for things they must see later (not chat replies). This is the ONLY way to display a local file (image, pdf, html) in the chat: markdown `![](path.png)` with a local/relative path does NOT resolve to workspace files or attachments and 404s in the browser. `--template` for registry workflows. Project files: `memory sync|path [--project <id>]` requires a project and checks out only projects/<id>/{memory,context} and projects/<id>/me/{memory,context}; legacy global files are read-only recovery. Voice commands use `--scope mine|project` (default mine, private within this project; project is shared).',
+    description: 'Manage the user\'s OWN TODOforAI tasks (not code `// TODO` comments). Delegate/spin off work: `tfa-cli "prompt"` creates a real TODO with its own agent and chat (`-n` wait for completion, `--no-watch` fire-and-forget, `--project/--agent/--model`, `--resume <id>`, `addmessage <id> "text"`). Inspect: `list [--status open]`, `--inspect <id>`. Edit any todo without opening it: `status <id> DONE|READY|ARCHIVED|POSTPONED|CANCELLED|DELETED` (close, reopen, shelve, trash — `todo restore <id>` undoes a delete) and `todo set <id|-> title=… group=… star=true schedule=<unix-ms> agent=… brand=…` (own todo fields). Both take ONE id, so a loop over `list --json | jq -r \'.items[].id\'` is how you close, retitle, refile or archive MANY todos at once; `project set|settings|groups …` (name, settings, todo groups), `agent create|update <agent> model=… sysmsg=…` (permissions/MCP/device wiring and delete are refused from an agent shell). Surface results into chat: `show <file|-> [todo-id]` (renders by mimetype, private to the todo\'s readers; `--card <name>` via project renderer; `--alias <name>` updates in place, `--alias <todoId>:<name>` updates another todo\'s artifact; `show share <ref>` makes it public and prints the link, `show unshare <ref>` makes it private again), `open <url>` embeds a live preview. Show viewer chrome: `--title` appears in the header; a kebab menu holds file actions, versions and sharing when available. Desktop floating previews add minimize (park in a tab), maximize/restore and close (X); inline blocks have no window controls. For authored HTML, do not duplicate the header/controls or add a rounded, bordered root card: the floating viewer owns the rounded frame. Keep content edge-to-edge; internal layout padding is fine. Pick by where the output lives: read once → plain reply; interactive, this chat only → `html_snippet`; kept/revised later → `show --alias`, then `show share` only if someone outside needs a link; format the user asked for (pptx, docx…) → `show` the file. Notifications: `inbox [needs-you|messages|activity] [--unread]` reads the user\'s bell feed (what finished/failed/needs them while away), `inbox seen [tab]` marks it read; `notify "Title" "message" [--href /t/<id>] [--url <link>: tap opens it on the phone, e.g. a Google Maps navigation link]` leaves a note in the user\'s Messages tab + phone push (shown as from you); `--to <email>` reaches a member of the current project instead (`project members` lists them, 20/day) — nobody else; same text is delivered once, max 10/day to the user, use for things they must see later (not chat replies). This is the ONLY way to display a local file (image, pdf, html) in the chat: markdown `![](path.png)` with a local/relative path does NOT resolve to workspace files or attachments and 404s in the browser. `--template` for registry workflows. Project files: `memory sync|path [--project <id>]` requires a project and checks out only projects/<id>/{memory,context} and projects/<id>/me/{memory,context}; legacy global files are read-only recovery. Voice commands use `--scope mine|project` (default mine, private within this project; project is shared).',
     installCmd: "npm install -g @todoforai/cli",
     versionCmd: "tfa-cli --version 2>/dev/null | sed -n 1p",
     preinstallCloud: true,
@@ -45253,57 +45286,111 @@ var tool_catalog_default = {
     installer: "binary",
     preinstallCloud: true,
     binary: {
-      "linux-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.7/rclone-linux-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
-      "linux-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.7/rclone-linux-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
-      "darwin-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.7/rclone-darwin-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
-      "darwin-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.7/rclone-darwin-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
-      "windows-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.7/rclone-windows-amd64.zip", archive: "zip", extract: "rclone.exe" }
+      "linux-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-linux-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "linux-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-linux-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "darwin-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-darwin-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "darwin-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-darwin-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "windows-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-windows-amd64.zip", archive: "zip", extract: "rclone.exe" }
     },
+    internal: true,
     label: "Cloud Storage",
-    summary: "Move files between Google Drive, Dropbox, OneDrive, S3 and more.",
-    statusCmd: "rclone listremotes --long 2>/dev/null | tr -s ' ' | grep -v ' todoforai *$' | grep -m20 .",
-    loginCmd: "rclone config",
-    loginTerminalHint: "Connect a storage from its own tile (Google Drive, OneDrive, Dropbox…). For other backends run `rclone config` in a terminal on this host.",
-    oauthUrlPattern: "(https?://127\\.0\\.0\\.1:\\d+/auth\\?\\S+)",
-    oauthCallbackPort: 53682,
+    summary: "The rclone program behind the Google Drive, OneDrive, Dropbox and S3 connectors.",
     credentialPaths: ["~/.config/rclone/rclone.conf"],
-    subProviders: {
-      gdrive: {
-        label: "Google Drive",
-        authType: "oauth",
-        connectCmd: "rclone config create {{REMOTE}} drive",
-        remoteName: "gdrive",
-        rcloneType: "drive",
-        userInfoCmd: `TOKEN=$(rclone config dump 2>/dev/null | python3 -c "import json,sys; print(json.loads(json.load(sys.stdin)['{{REMOTE}}']['token'])['access_token'])") && curl -sf 'https://www.googleapis.com/drive/v3/about?fields=user' -H "Authorization: Bearer $TOKEN" | python3 -c "import json,sys; print(json.load(sys.stdin)['user']['emailAddress'])" 2>/dev/null`
-      },
-      onedrive: {
-        label: "OneDrive",
-        authType: "oauth",
-        connectCmd: "rclone config create {{REMOTE}} onedrive",
-        remoteName: "onedrive",
-        rcloneType: "onedrive",
-        userInfoCmd: `TOKEN=$(rclone config dump 2>/dev/null | python3 -c "import json,sys; print(json.loads(json.load(sys.stdin)['{{REMOTE}}']['token'])['access_token'])") && curl -sf 'https://graph.microsoft.com/v1.0/me' -H "Authorization: Bearer $TOKEN" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('mail') or d.get('userPrincipalName',''))" 2>/dev/null`
-      },
-      dropbox: {
-        label: "Dropbox",
-        authType: "oauth",
-        connectCmd: "rclone config create {{REMOTE}} dropbox",
-        remoteName: "dropbox",
-        rcloneType: "dropbox",
-        userInfoCmd: `TOKEN=$(rclone config dump 2>/dev/null | python3 -c "import json,sys; print(json.loads(json.load(sys.stdin)['{{REMOTE}}']['token'])['access_token'])") && curl -sf -X POST 'https://api.dropboxapi.com/2/users/get_current_account' -H "Authorization: Bearer $TOKEN" | python3 -c "import json,sys; print(json.load(sys.stdin)['email'])" 2>/dev/null`
-      },
-      s3: {
-        label: "Amazon S3",
-        authType: "credentials",
-        connectCmd: "rclone config create {{REMOTE}} s3",
-        remoteName: "s3",
-        rcloneType: "s3"
-      }
-    },
     versionCmd: "rclone version 2>/dev/null | sed -n 1p",
     preinstallJarvis: true,
     description: "Access Google Drive, OneDrive, Dropbox, S3, and 40+ cloud providers. List, copy, sync, move, and mount files; use `rclone config create <name> <provider>` to connect."
   },
+  gdrive: {
+    category: "cloud",
+    pkg: "rclone",
+    installer: "binary",
+    binName: "rclone",
+    binary: {
+      "linux-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-linux-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "linux-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-linux-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "darwin-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-darwin-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "darwin-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-darwin-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "windows-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-windows-amd64.zip", archive: "zip", extract: "rclone.exe" }
+    },
+    label: "Google Drive",
+    summary: "Browse, read and write files in your Google Drive.",
+    rcloneType: "drive",
+    statusCmd: `rclone listremotes --long 2>/dev/null | while read -r n t d; do [ "$t" = drive ] && { case "$d" in ""|*[[:space:]]*) a=\${n%:};; *) a=$d;; esac; echo "$a"; }; done | paste -sd ' ' - | grep -m1 .`,
+    loginCmd: "rclone config",
+    oauthBroker: true,
+    logoutCmd: 'x={{ACCOUNT}}; rclone listremotes --long 2>/dev/null | while read -r n t d; do [ "$t" = drive ] || continue; case "$d" in ""|*[[:space:]]*) a=${n%:};; *) a=$d;; esac; [ -z "$x" ] || [ "$a" = "$x" ] && rclone config delete "${n%:}"; done; true',
+    credentialPaths: ["~/.config/rclone/rclone.conf"],
+    versionCmd: "rclone version 2>/dev/null | sed -n 1p",
+    description: "Google Drive connector. Uses the rclone CLI: `rclone listremotes --long` lists every connected storage as `name: type account`; `rclone lsf <remote>:<path>`, `rclone copy|sync|move <src> <dst>`, `rclone cat`, `rclone mkdir`, `rclone deletefile` work on any of them (Google Drive = type drive, OneDrive = onedrive, Dropbox = dropbox, S3 = s3). Never run `rclone config` interactively; connect new accounts with `todo.connect('<key>')`."
+  },
+  onedrive: {
+    category: "cloud",
+    pkg: "rclone",
+    installer: "binary",
+    binName: "rclone",
+    binary: {
+      "linux-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-linux-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "linux-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-linux-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "darwin-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-darwin-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "darwin-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-darwin-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "windows-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-windows-amd64.zip", archive: "zip", extract: "rclone.exe" }
+    },
+    label: "OneDrive",
+    summary: "Browse, read and write files in your OneDrive.",
+    rcloneType: "onedrive",
+    statusCmd: `rclone listremotes --long 2>/dev/null | while read -r n t d; do [ "$t" = onedrive ] && { case "$d" in ""|*[[:space:]]*) a=\${n%:};; *) a=$d;; esac; echo "$a"; }; done | paste -sd ' ' - | grep -m1 .`,
+    loginCmd: "rclone config",
+    oauthBroker: true,
+    logoutCmd: 'x={{ACCOUNT}}; rclone listremotes --long 2>/dev/null | while read -r n t d; do [ "$t" = onedrive ] || continue; case "$d" in ""|*[[:space:]]*) a=${n%:};; *) a=$d;; esac; [ -z "$x" ] || [ "$a" = "$x" ] && rclone config delete "${n%:}"; done; true',
+    credentialPaths: ["~/.config/rclone/rclone.conf"],
+    versionCmd: "rclone version 2>/dev/null | sed -n 1p",
+    description: "OneDrive connector. Uses the rclone CLI: `rclone listremotes --long` lists every connected storage as `name: type account`; `rclone lsf <remote>:<path>`, `rclone copy|sync|move <src> <dst>`, `rclone cat`, `rclone mkdir`, `rclone deletefile` work on any of them (Google Drive = type drive, OneDrive = onedrive, Dropbox = dropbox, S3 = s3). Never run `rclone config` interactively; connect new accounts with `todo.connect('<key>')`."
+  },
+  dropbox: {
+    category: "cloud",
+    pkg: "rclone",
+    installer: "binary",
+    binName: "rclone",
+    binary: {
+      "linux-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-linux-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "linux-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-linux-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "darwin-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-darwin-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "darwin-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-darwin-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "windows-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-windows-amd64.zip", archive: "zip", extract: "rclone.exe" }
+    },
+    label: "Dropbox",
+    summary: "Browse, read and write files in your Dropbox.",
+    rcloneType: "dropbox",
+    statusCmd: `rclone listremotes --long 2>/dev/null | while read -r n t d; do [ "$t" = dropbox ] && { case "$d" in ""|*[[:space:]]*) a=\${n%:};; *) a=$d;; esac; echo "$a"; }; done | paste -sd ' ' - | grep -m1 .`,
+    loginCmd: "rclone config",
+    oauthBroker: true,
+    logoutCmd: 'x={{ACCOUNT}}; rclone listremotes --long 2>/dev/null | while read -r n t d; do [ "$t" = dropbox ] || continue; case "$d" in ""|*[[:space:]]*) a=${n%:};; *) a=$d;; esac; [ -z "$x" ] || [ "$a" = "$x" ] && rclone config delete "${n%:}"; done; true',
+    credentialPaths: ["~/.config/rclone/rclone.conf"],
+    versionCmd: "rclone version 2>/dev/null | sed -n 1p",
+    description: "Dropbox connector. Uses the rclone CLI: `rclone listremotes --long` lists every connected storage as `name: type account`; `rclone lsf <remote>:<path>`, `rclone copy|sync|move <src> <dst>`, `rclone cat`, `rclone mkdir`, `rclone deletefile` work on any of them (Google Drive = type drive, OneDrive = onedrive, Dropbox = dropbox, S3 = s3). Never run `rclone config` interactively; connect new accounts with `todo.connect('<key>')`."
+  },
+  s3: {
+    category: "cloud",
+    pkg: "rclone",
+    installer: "binary",
+    binName: "rclone",
+    binary: {
+      "linux-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-linux-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "linux-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-linux-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "darwin-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-darwin-amd64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "darwin-aarch64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-darwin-arm64.tar.gz", archive: "tar.gz", extract: "rclone" },
+      "windows-x86_64": { url: "https://github.com/todoforai/rclone-backend/releases/download/v0.1.8/rclone-windows-amd64.zip", archive: "zip", extract: "rclone.exe" }
+    },
+    label: "Amazon S3",
+    summary: "Browse, read and write files in your Amazon S3 buckets.",
+    rcloneType: "s3",
+    statusCmd: `rclone listremotes --long 2>/dev/null | while read -r n t d; do [ "$t" = s3 ] && { case "$d" in ""|*[[:space:]]*) a=\${n%:};; *) a=$d;; esac; echo "$a"; }; done | paste -sd ' ' - | grep -m1 .`,
+    loginCmd: `k=<access_key_id> s=<secret_access_key> r=<region>; RCLONE_S3_PROVIDER=AWS RCLONE_S3_ENV_AUTH=false RCLONE_S3_ACCESS_KEY_ID="$k" RCLONE_S3_SECRET_ACCESS_KEY="$s" RCLONE_S3_REGION="$r" rclone lsd :s3: --config /dev/null --ask-password=false --contimeout 10s --timeout 15s --retries 1 --low-level-retries 1 >/dev/null 2>&1 || { echo 'S3 access check failed: check the keys, the region and the s3:ListAllMyBuckets permission.'; exit 2; }; rclone config create --non-interactive --ask-password=false "s3_$(date +%s)" s3 provider AWS env_auth false access_key_id "$k" secret_access_key "$s" region "$r" >/dev/null && echo 'S3 connected.'`,
+    logoutCmd: 'x={{ACCOUNT}}; rclone listremotes --long 2>/dev/null | while read -r n t d; do [ "$t" = s3 ] || continue; case "$d" in ""|*[[:space:]]*) a=${n%:};; *) a=$d;; esac; [ -z "$x" ] || [ "$a" = "$x" ] && rclone config delete "${n%:}"; done; true',
+    credentialPaths: ["~/.config/rclone/rclone.conf"],
+    versionCmd: "rclone version 2>/dev/null | sed -n 1p",
+    description: "Amazon S3 connector. Uses the rclone CLI: `rclone listremotes --long` lists every connected storage as `name: type account`; `rclone lsf <remote>:<path>`, `rclone copy|sync|move <src> <dst>`, `rclone cat`, `rclone mkdir`, `rclone deletefile` work on any of them (Google Drive = type drive, OneDrive = onedrive, Dropbox = dropbox, S3 = s3). Never run `rclone config` interactively; connect new accounts with `todo.connect('<key>')`."
+  },
   aws: {
     preinstallCloud: true,
     cloudInstallCmd: "curl -fsSL https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o /tmp/awscli.zip && unzip -qo /tmp/awscli.zip -d /tmp && /tmp/aws/install --update && rm -rf /tmp/aws /tmp/awscli.zip",
@@ -45330,6 +45417,7 @@ var tool_catalog_default = {
     needsPython: true,
     installCmd: `case "$(uname -s)-$(uname -m)" in Darwin-arm64) p=darwin-arm;; Darwin-*) p=darwin-x86_64;; Linux-aarch64|Linux-arm64) p=linux-arm;; *) p=linux-x86_64;; esac && tmp="$HOME/.gcloud-new.$$" && rm -rf "$tmp" && mkdir -p "$tmp" && curl -fsSL "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-$p.tar.gz" | tar -xzC "$tmp" && rm -rf "$HOME/google-cloud-sdk" && mv "$tmp/google-cloud-sdk" "$HOME/google-cloud-sdk" && rm -rf "$tmp" && mkdir -p "$HOME/.todoforai/tools/bin" && rm -f "$HOME/.todoforai/tools/bin/gcloud" && printf '#!/bin/sh\\nCLOUDSDK_PYTHON="\${CLOUDSDK_PYTHON:-%s}" exec "$HOME/google-cloud-sdk/bin/gcloud" "$@"\\n' "$py" > "$HOME/.todoforai/tools/bin/gcloud" && chmod +x "$HOME/.todoforai/tools/bin/gcloud"`,
     statusCmd: `gcloud auth list --filter=status:ACTIVE --format="value(account)" 2>/dev/null | tr -d '\\r' | grep -m1 .`,
+    logoutCmd: "gcloud auth revoke --all --quiet",
     loginCmd: "gcloud auth login --no-launch-browser",
     loginNeedsPty: true,
     stdinPaste: true,
@@ -45435,7 +45523,7 @@ var tool_catalog_default = {
     preinstallCloud: true,
     label: "Browser",
     summary: "Browse websites automatically: click, type, read and screenshot.",
-    description: "Browser automation over CDP (`open`/`snapshot`/`click`/`type`/`fill`/`read`/`screenshot`/`eval`). `connect '<url>'` to a listed live browser (prefer the user's real Chrome), verify with `snapshot`; if empty, `close` (own session only) and reconnect once. NEVER `close --all`. Shared browser: `tab new` for your own tab, `tab <id>` before each command. No URL listed: cloud → browser-manager-cli; PC with display → Chrome `--remote-debugging-port=9222`, attach `--cdp 9222`. Never `sleep`: `open` returns after load, but `click`/`fill` fail at once if the element isn't there yet — `wait '<sel>'`, `wait --text 'Done'`, `wait --url '**/dash'`, `wait --load networkidle` or `wait '#spinner' --state hidden` first. Extension browsers (WEB_EXTENSION) only: try sign-in with credentials from `tfa-vault`; request human help only for a step you cannot complete yourself (MFA/CAPTCHA/consent). Use Node/Bun WebSocket on the listed CDP URL; `Target.getTargets` or `device_list` gives `tab-N`, whose N is the numeric tabId. On the SAME socket send `{id: 1, method: 'TodoforAI.requestHumanHelp', params: {tabId: N, message: 'what to do'}}` (message 1–500 chars). This focuses and pauses the tab, sets its yellow `?` badge, and shows needs-you in the extension popup. Tell the user to click Resume control and reply here, then end your turn; Resume does not wake the agent. Afterwards reconnect and snapshot fresh. `TodoforAI.humanHelpStatus` with `{tabId}` remains available while paused. If bootstrap fails on a restricted target, direct CDP `Target.createTarget` with an ordinary URL opens your tab on the SAME socket; pass numeric N from returned `tab-N` as `tabId`.",
+    description: "Browser automation over CDP (`open`/`snapshot`/`click`/`type`/`fill`/`read`/`screenshot`/`eval`). `connect '<url>'` to a listed live browser (prefer the user's real Chrome); connect prints `whoami` (browser=extension|embedded|local, headless, ua) — run `agent-browser whoami` again after any error or odd output, and stop on `ERROR`/`DISCONNECTED`/`headless=yes` where the user's browser was expected: re-run the connect command, never continue in another browser. If a page is empty, `close` (own session only) and reconnect once. NEVER `close --all`. Shared browser: `tab new` for your own tab, `tab <id>` before each command. No URL listed: cloud → browser-manager-cli; PC with display → Chrome `--remote-debugging-port=9222`, attach `--cdp 9222`. Never `sleep`: `open` returns after load, but `click`/`fill` fail at once if the element isn't there yet — `wait '<sel>'`, `wait --text 'Done'`, `wait --url '**/dash'`, `wait --load networkidle` or `wait '#spinner' --state hidden` first. Extension browsers (WEB_EXTENSION) only: try sign-in with credentials from `tfa-vault`; request human help only for a step you cannot complete yourself (MFA/CAPTCHA/consent). Use Node/Bun WebSocket on the listed CDP URL; `Target.getTargets` or `device_list` gives `tab-N`, whose N is the numeric tabId. On the SAME socket send `{id: 1, method: 'TodoforAI.requestHumanHelp', params: {tabId: N, message: 'what to do'}}` (message 1–500 chars). This only marks the tab (yellow count badge on the extension icon, needs-you row with Show in the popup); it never pauses you or takes the tab away. Tell the user what to do and to reply here, then end your turn. When resumed, snapshot to verify, then clear the marker with `TodoforAI.clearHumanHelp` `{tabId: N}`. If bootstrap fails on a restricted target, direct CDP `Target.createTarget` with an ordinary URL opens your tab on the SAME socket; pass numeric N from returned `tab-N` as `tabId`.",
     versionCmd: "agent-browser --version 2>/dev/null | sed -n 1p",
     preinstallJarvis: true
   },
@@ -46036,7 +46124,7 @@ var tool_catalog_default = {
     summary: "Read and write your Outlook mail.",
     statusCmd: `outlook-api whoami 2>/dev/null | sed -n 's/.*"userPrincipalName"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m10 .`,
     logoutCmd: "outlook-api logout",
-    loginCmd: "outlook-api auth",
+    loginCmd: "outlook-api auth --tenant common",
     credentialPaths: ["~/.config/outlook-api/config.json"],
     description: "Outlook/Hotmail/M365 mail over Microsoft Graph (on-prem Exchange → ews-api). `auth` = device-code flow; `--tenant consumers` (default, personal) | `organizations`. list/search/read/attachments are read-only; `draft`/`reply` stay in Drafts unless --send; `send <draftId>`. `get <path>` = raw Graph GET. JSON out.",
     versionCmd: "outlook-api --version 2>/dev/null | sed -n 1p",
@@ -46083,6 +46171,7 @@ var tool_catalog_default = {
     label: "Google Workspace",
     summary: "Work with Google Sheets, Docs, Slides, Drive, Forms, Tasks, Contacts and Chat.",
     statusCmd: `gws auth status 2>/dev/null | sed -n 's/.*"user"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' | grep -m1 .`,
+    logoutCmd: "gws auth logout",
     loginCmd: "gws auth login --scopes https://www.googleapis.com/auth/spreadsheets,https://www.googleapis.com/auth/documents,https://www.googleapis.com/auth/presentations,https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/forms.body,https://www.googleapis.com/auth/forms.responses.readonly,https://www.googleapis.com/auth/tasks,https://www.googleapis.com/auth/contacts,https://www.googleapis.com/auth/chat.spaces,https://www.googleapis.com/auth/chat.messages,https://www.googleapis.com/auth/chat.memberships,https://www.googleapis.com/auth/chat.delete",
     loginTerminalHint: "gws needs your own Google OAuth client first: in console.cloud.google.com create a Desktop-app OAuth client (consent screen External/testing, add yourself as test user), enable the APIs you need (Sheets/Docs/Slides/Drive/Forms/Tasks/People/Chat), save the JSON as ~/.config/gws/client_secret.json (or run `gws auth setup` if gcloud is logged in), then `gws auth login -s sheets,drive`.",
     oauthUrlPattern: "(https://accounts\\.google\\.com/o/oauth2/auth\\S+)",
@@ -46177,6 +46266,7 @@ var tool_catalog_default = {
     summary: "Read your Granola meeting notes and transcripts.",
     statusCmd: `granola auth status -o json 2>/dev/null | sed -n 's/.*"authenticated": *true.*/authenticated/p' | grep -m1 .`,
     loginCmd: "granola auth login",
+    logoutCmd: "granola auth logout",
     loginTerminalHint: "Imports the Granola desktop app's session: install Granola on this host, sign in there, then run `granola auth login`.",
     credentialPaths: ["~/.config/keyring", "~/.config/granola"],
     versionCmd: "granola --version 2>/dev/null | sed -n 1p",
@@ -48744,6 +48834,7 @@ var tool_catalog_default = {
     label: "Heroku",
     summary: "Deploy and manage apps, add-ons and databases on Heroku.",
     statusCmd: "heroku auth:whoami 2>/dev/null | tr -d '\\r' | grep -m1 .",
+    logoutCmd: "heroku logout",
     loginCmd: `k=<api_key>; f="$HOME/.netrc"; (umask 077; touch "$f"; chmod 600 "$f") && K="$k" python3 -c 'import os,re,sys; f=sys.argv[1]; k=os.environ["K"]; s=re.sub(r"machine\\s+(api|git)\\.heroku\\.com\\s+login\\s+\\S+\\s+password\\s+\\S+\\s*", "", open(f).read()); open(f, "w").write(s + "".join("machine %s.heroku.com\\n  login token\\n  password %s\\n" % (h, k) for h in ("api", "git")))' "$f" && heroku auth:whoami`,
     credentialPaths: ["~/.netrc"],
     versionCmd: "heroku --version 2>/dev/null | sed -n 1p",
@@ -49216,6 +49307,7 @@ var tool_catalog_default = {
     description: "Official Pinecone CLI (`pc`). Connect with a project API key (app.pinecone.io → API keys). `pc index list`, `pc index create --name <n> --dimension 1536 --metric cosine --cloud aws --region us-east-1`, `pc index describe --name <n>`.",
     loginCmd: "pc auth configure --api-key <api_key>",
     statusCmd: "pc index list --json >/dev/null 2>&1 && echo authenticated",
+    logoutCmd: "pc auth logout",
     versionCmd: "pc version 2>/dev/null | sed -n 1p",
     credentialPaths: [
       "~/.config/pinecone/secrets.yaml",
@@ -49593,6 +49685,7 @@ var tool_catalog_default = {
   cloudinary: {
     category: "creative",
     pkg: "cloudinary-cli",
+    pipSdist: ["cloudinary-cli"],
     installer: "pip",
     label: "Cloudinary",
     binName: "cld",
@@ -50045,6 +50138,24 @@ var tool_catalog_default = {
 
 // ../packages/shared-fbe/src/toolCatalog.ts
 var TOOL_CATALOG = tool_catalog_default;
+// ../packages/shared-fbe/src/emailDomains.ts
+var PUBLIC_EMAIL_DOMAINS = new Set([
+  "gmail.com",
+  "googlemail.com",
+  "outlook.com",
+  "hotmail.com",
+  "live.com",
+  "icloud.com",
+  "me.com",
+  "yahoo.com",
+  "proton.me",
+  "protonmail.com",
+  "fastmail.com",
+  "gmx.com",
+  "gmx.net",
+  "mail.com",
+  "zoho.com"
+]);
 // ../packages/shared-fbe/src/toolInstallCommand.ts
 var NPM_HOME = '"${TFA_NPM_HOME:-$HOME}"';
 var NPM_TOOLS = NPM_HOME.replace('}"', '}/.todoforai/tools"');
@@ -50284,13 +50395,14 @@ import { parseArgs } from "util";
 // package.json
 var package_default = {
   name: "@todoforai/cli",
+  license: "MIT",
   description: "TODOforAI CLI — create and manage tasks with tfa-cli.",
   homepage: "https://todofor.ai",
   repository: {
     type: "git",
     url: "git+https://github.com/todoforai/cli.git"
   },
-  version: "0.1.68",
+  version: "0.1.70",
   type: "module",
   bin: {
     "todoforai-cli": "bin/todoforai-cli.js",
@@ -50358,10 +50470,11 @@ Examples:
   tfa-cli show <file|-> [todo-id]     # Render a local file (image/pdf/html…) in the chat; - = stdin
   tfa-cli show list|rm …              # List / take down shown files
   tfa-cli open <url> [todo-id]        # Live url preview in the chat
+  tfa-cli connect <key>… [--reason "why"]  # Sign-in card for connectors on this machine (several keys = one choice)
   tfa-cli recommend --template <id>    # Add a template as a recommendation card
   tfa-cli inbox [needs-you|messages|activity] [--unread]  # Read the notification feed (the bell)
   tfa-cli inbox seen [tab]              # Mark notifications read
-  tfa-cli notify [--to <email>] "Title" "message" [--href /t/<id>]  # Note to your own user, or --to a project member (Messages tab + phone push)
+  tfa-cli notify [--to <email>] "Title" "message" [--href /t/<id>] [--url <link>]  # Note to your own user, or --to a project member (Messages tab + phone push)
   tfa-cli claim mint --seed <projectId> [--emails a@x,b@y] [--ttl <sec>]  # Mint /claim/<token> links for a project you own
   tfa-cli next [--direction "<text>"]  # Analyzer growth recommendation cards
   tfa-cli import [claude|codex|<file>...] [--dry-run]  # Import Claude Code / Codex sessions as todos
@@ -50492,6 +50605,7 @@ function parseCliArgs() {
       link: { type: "boolean", default: false },
       force: { type: "boolean", default: false },
       direction: { type: "string" },
+      reason: { type: "string" },
       url: { type: "string" },
       account: { type: "string" },
       "from-company": { type: "boolean", default: false },
@@ -53297,6 +53411,8 @@ Fields map directly to agent settings; values are parsed as JSON when possible
   temperature     number, e.g. 0.7
   thinkingLevel   low | medium | high | xhigh | max
   refusalFallbackModel   model to switch to if 'model' refuses (empty = off)
+  autoCompaction  true | false — automatic context compaction (default true)
+  contextLimit    tokens compaction is measured against (0 = auto from model, max 200K)
   name            agent display name
 
 Examples:
@@ -53305,7 +53421,9 @@ Examples:
   tfa-cli agent update <agent> sysmsg="You are a terse video editor."
   tfa-cli agent create name=Reviewer model=claude sysmsg="Review diffs only."
 
-From an agent shell (dst_ token) permissions, edgesMcpConfigs, devicesConfig and delete are refused by the backend.
+  tfa-cli agent update <agent> judgeSysmsg="Ask before destructive actions. Everything else can run."   (auto-approve policy)
+
+From an agent shell (dst_ token) permissions, judgeSysmsg, edgesMcpConfigs, devicesConfig and delete are refused by the backend.
 `);
 }
 var FIELD_ALIASES = {
@@ -54897,15 +55015,17 @@ function printNotifyHelp() {
 tfa-cli notify — leave a note in someone's Messages inbox (+ phone push)
 
 Usage:
-  tfa-cli notify "Title" "message" [--href /t/<todo-id>] [--subject <key>] [--json]
+  tfa-cli notify "Title" "message" [--href /t/<todo-id>] [--url <link>] [--subject <key>] [--json]
   tfa-cli notify --to <email> "Title" "message" [--project <id>]
   echo "message" | tfa-cli notify "Title"
 
 Recipient: your own user by default. --to <email> reaches a TEAMMATE: someone who is a member
 of the current project (--project, $TODOFORAI_PROJECT_ID or your default), shown as from you.
 Anyone else is refused. List them with: tfa-cli project members
---subject dedupes: the same subject is delivered once (default: hash of title+message,
+--subject dedupes: the same subject is delivered once (default: hash of title+message+url,
 so a retry never double-notifies). --href must be an in-app path.
+--url is what tapping the phone notification opens (https/tel/sms/mailto), e.g. navigation:
+  --url "https://www.google.com/maps/dir/?api=1&destination=Deák+tér&dir_action=navigate"
 Limits: 10 notes/day to yourself, 20/day to teammates.
 `);
 }
@@ -54984,8 +55104,9 @@ async function notifyCommand(api, positionals, args, projectId) {
     process.exit(2);
   }
   const subject = args.subject || createHash("sha256").update(`${title}
-${message}`).digest("hex").slice(0, 16);
-  const msg = { subject, title, message, ...args.href ? { href: String(args.href) } : {} };
+${message}${args.url ? `
+${args.url}` : ""}`).digest("hex").slice(0, 16);
+  const msg = { subject, title, message, ...args.href ? { href: String(args.href) } : {}, ...args.url ? { url: String(args.url) } : {} };
   const row = await (to ? api.sendMemberMessage({ ...msg, projectId, to }) : api.sendFeedMessage(msg));
   if (args.json) {
     console.log(JSON.stringify(row));
@@ -55797,17 +55918,7 @@ var AGENT_METHODS = {
   session_fork: "session/fork",
   session_resume: "session/resume",
   session_close: "session/close",
-  logout: "logout",
-  nes_start: "nes/start",
-  nes_suggest: "nes/suggest",
-  nes_accept: "nes/accept",
-  nes_reject: "nes/reject",
-  nes_close: "nes/close",
-  document_did_open: "document/didOpen",
-  document_did_change: "document/didChange",
-  document_did_close: "document/didClose",
-  document_did_save: "document/didSave",
-  document_did_focus: "document/didFocus"
+  logout: "logout"
 };
 var CLIENT_METHODS = {
   session_request_permission: "session/request_permission",
@@ -75884,204 +75995,86 @@ var zSessionAdditionalDirectoriesCapabilities = object({
     return;
   })
 });
-var zSessionForkCapabilities = object({
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zSessionResumeCapabilities = object({
+var zSessionSystemPromptOverrideCapabilities = object({
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
 });
-var zSessionCloseCapabilities = object({
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zSessionCapabilities = object({
-  list: defaultOnError(zSessionListCapabilities.nullish(), () => {
-    return;
-  }),
-  delete: defaultOnError(zSessionDeleteCapabilities.nullish(), () => {
-    return;
-  }),
-  additionalDirectories: defaultOnError(zSessionAdditionalDirectoriesCapabilities.nullish(), () => {
-    return;
-  }),
-  fork: defaultOnError(zSessionForkCapabilities.nullish(), () => {
-    return;
-  }),
-  resume: defaultOnError(zSessionResumeCapabilities.nullish(), () => {
-    return;
-  }),
-  close: defaultOnError(zSessionCloseCapabilities.nullish(), () => {
+var zSessionSystemPromptModeCapabilities = object({
+  override: defaultOnError(zSessionSystemPromptOverrideCapabilities.nullish(), () => {
     return;
   }),
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
 });
-var zLogoutCapabilities = object({
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zAgentAuthCapabilities = object({
-  logout: defaultOnError(zLogoutCapabilities.nullish(), () => {
+var zSessionSystemPromptCapabilities = object({
+  mode: defaultOnError(zSessionSystemPromptModeCapabilities.nullish(), () => {
     return;
   }),
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
 });
-var zProvidersCapabilities = object({
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesDocumentDidOpenCapabilities = object({
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zTextDocumentSyncKind = union([
-  literal("full"),
-  literal("incremental")
-]);
-var zNesDocumentDidChangeCapabilities = object({
-  syncKind: zTextDocumentSyncKind,
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesDocumentDidCloseCapabilities = object({
+var zSessionForkCapabilities = object({
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
 });
-var zNesDocumentDidSaveCapabilities = object({
+var zSessionResumeCapabilities = object({
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
 });
-var zNesDocumentDidFocusCapabilities = object({
+var zSessionCloseCapabilities = object({
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
 });
-var zNesDocumentEventCapabilities = object({
-  didOpen: defaultOnError(zNesDocumentDidOpenCapabilities.nullish(), () => {
-    return;
-  }),
-  didChange: defaultOnError(zNesDocumentDidChangeCapabilities.nullish(), () => {
+var zSessionCapabilities = object({
+  list: defaultOnError(zSessionListCapabilities.nullish(), () => {
     return;
   }),
-  didClose: defaultOnError(zNesDocumentDidCloseCapabilities.nullish(), () => {
+  delete: defaultOnError(zSessionDeleteCapabilities.nullish(), () => {
     return;
   }),
-  didSave: defaultOnError(zNesDocumentDidSaveCapabilities.nullish(), () => {
+  additionalDirectories: defaultOnError(zSessionAdditionalDirectoriesCapabilities.nullish(), () => {
     return;
   }),
-  didFocus: defaultOnError(zNesDocumentDidFocusCapabilities.nullish(), () => {
+  systemPrompt: defaultOnError(zSessionSystemPromptCapabilities.nullish(), () => {
     return;
   }),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesEventCapabilities = object({
-  document: defaultOnError(zNesDocumentEventCapabilities.nullish(), () => {
-    return;
-  }),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesRecentFilesCapabilities = object({
-  maxCount: defaultOnError(int().gte(0).max(4294967295, {
-    error: "Invalid value: Expected uint32 to be <= 4294967295"
-  }).nullish(), () => {
+  fork: defaultOnError(zSessionForkCapabilities.nullish(), () => {
     return;
   }),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesRelatedSnippetsCapabilities = object({
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesEditHistoryCapabilities = object({
-  maxCount: defaultOnError(int().gte(0).max(4294967295, {
-    error: "Invalid value: Expected uint32 to be <= 4294967295"
-  }).nullish(), () => {
+  resume: defaultOnError(zSessionResumeCapabilities.nullish(), () => {
     return;
   }),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesUserActionsCapabilities = object({
-  maxCount: defaultOnError(int().gte(0).max(4294967295, {
-    error: "Invalid value: Expected uint32 to be <= 4294967295"
-  }).nullish(), () => {
+  close: defaultOnError(zSessionCloseCapabilities.nullish(), () => {
     return;
   }),
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
 });
-var zNesOpenFilesCapabilities = object({
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesDiagnosticsCapabilities = object({
+var zLogoutCapabilities = object({
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
 });
-var zNesContextCapabilities = object({
-  recentFiles: defaultOnError(zNesRecentFilesCapabilities.nullish(), () => {
-    return;
-  }),
-  relatedSnippets: defaultOnError(zNesRelatedSnippetsCapabilities.nullish(), () => {
-    return;
-  }),
-  editHistory: defaultOnError(zNesEditHistoryCapabilities.nullish(), () => {
-    return;
-  }),
-  userActions: defaultOnError(zNesUserActionsCapabilities.nullish(), () => {
-    return;
-  }),
-  openFiles: defaultOnError(zNesOpenFilesCapabilities.nullish(), () => {
-    return;
-  }),
-  diagnostics: defaultOnError(zNesDiagnosticsCapabilities.nullish(), () => {
+var zAgentAuthCapabilities = object({
+  logout: defaultOnError(zLogoutCapabilities.nullish(), () => {
     return;
   }),
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
 });
-var zNesCapabilities = object({
-  events: defaultOnError(zNesEventCapabilities.nullish(), () => {
-    return;
-  }),
-  context: defaultOnError(zNesContextCapabilities.nullish(), () => {
-    return;
-  }),
+var zProvidersCapabilities = object({
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
 });
-var zPositionEncodingKind = union([
-  literal("utf-16"),
-  literal("utf-32"),
-  literal("utf-8")
-]);
 var zAgentCapabilities = object({
   loadSession: defaultOnError(boolean2().optional().default(false), () => false),
   promptCapabilities: defaultOnError(zPromptCapabilities.optional().default({
@@ -76107,12 +76100,6 @@ var zAgentCapabilities = object({
   providers: defaultOnError(zProvidersCapabilities.nullish(), () => {
     return;
   }),
-  nes: defaultOnError(zNesCapabilities.nullish(), () => {
-    return;
-  }),
-  positionEncoding: defaultOnError(zPositionEncodingKind.nullish(), () => {
-    return;
-  }),
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
@@ -76446,101 +76433,6 @@ var zPromptResponse = object({
     return;
   })
 });
-var zStartNesResponse = object({
-  sessionId: zSessionId,
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesSuggestionId = string2();
-var zPosition = object({
-  line: int().gte(0).max(4294967295, {
-    error: "Invalid value: Expected uint32 to be <= 4294967295"
-  }),
-  character: int().gte(0).max(4294967295, {
-    error: "Invalid value: Expected uint32 to be <= 4294967295"
-  }),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zRange = object({
-  start: zPosition,
-  end: zPosition,
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesTextEdit = object({
-  range: zRange,
-  newText: string2(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesEditSuggestion = object({
-  id: zNesSuggestionId,
-  uri: string2(),
-  edits: array(zNesTextEdit),
-  cursorPosition: defaultOnError(zPosition.nullish(), () => {
-    return;
-  }),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesJumpSuggestion = object({
-  id: zNesSuggestionId,
-  uri: string2(),
-  position: zPosition,
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesRenameSuggestion = object({
-  id: zNesSuggestionId,
-  uri: string2(),
-  position: zPosition,
-  newName: string2(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesSearchAndReplaceSuggestion = object({
-  id: zNesSuggestionId,
-  uri: string2(),
-  search: string2(),
-  replace: string2(),
-  isRegex: boolean2().nullish(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesSuggestion = union([
-  zNesEditSuggestion.and(object({
-    kind: literal("edit")
-  })),
-  zNesJumpSuggestion.and(object({
-    kind: literal("jump")
-  })),
-  zNesRenameSuggestion.and(object({
-    kind: literal("rename")
-  })),
-  zNesSearchAndReplaceSuggestion.and(object({
-    kind: literal("searchAndReplace")
-  }))
-]);
-var zSuggestNesResponse = object({
-  suggestions: array(zNesSuggestion),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zCloseNesResponse = object({
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
 var zExtResponse = unknown();
 var zErrorCode = union([
   literal(-32700),
@@ -76584,9 +76476,6 @@ var zAgentResponse = union([
       zSetSessionModeResponse,
       zSetSessionConfigOptionResponse,
       zPromptResponse,
-      zStartNesResponse,
-      zSuggestNesResponse,
-      zCloseNesResponse,
       zExtResponse
     ])
   }),
@@ -77105,35 +76994,6 @@ var zElicitationCapabilities = object({
     return;
   })
 });
-var zNesJumpCapabilities = object({
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesRenameCapabilities = object({
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesSearchAndReplaceCapabilities = object({
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zClientNesCapabilities = object({
-  jump: defaultOnError(zNesJumpCapabilities.nullish(), () => {
-    return;
-  }),
-  rename: defaultOnError(zNesRenameCapabilities.nullish(), () => {
-    return;
-  }),
-  searchAndReplace: defaultOnError(zNesSearchAndReplaceCapabilities.nullish(), () => {
-    return;
-  }),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
 var zClientCapabilities = object({
   fs: defaultOnError(zFileSystemCapabilities.optional().default({ readTextFile: false, writeTextFile: false }), () => ({ readTextFile: false, writeTextFile: false })),
   terminal: defaultOnError(boolean2().optional().default(false), () => false),
@@ -77150,10 +77010,6 @@ var zClientCapabilities = object({
   elicitation: defaultOnError(zElicitationCapabilities.nullish(), () => {
     return;
   }),
-  nes: defaultOnError(zClientNesCapabilities.nullish(), () => {
-    return;
-  }),
-  positionEncodings: defaultOnError(vecSkipError(zPositionEncodingKind).optional(), () => []),
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
@@ -77258,10 +77114,23 @@ var zMcpServer = union([
   })),
   zMcpServerStdio
 ]);
+var zSystemPromptMode = union([
+  literal("append"),
+  literal("override"),
+  string2()
+]);
+var zSystemPrompt = object({
+  mode: zSystemPromptMode,
+  content: array(zContentBlock),
+  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
+    return;
+  })
+});
 var zNewSessionRequest = object({
   cwd: string2(),
   additionalDirectories: array(string2()).optional(),
   mcpServers: array(zMcpServer),
+  systemPrompt: zSystemPrompt.nullish(),
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
@@ -77271,6 +77140,7 @@ var zLoadSessionRequest = object({
   cwd: string2(),
   additionalDirectories: array(string2()).optional(),
   sessionId: zSessionId,
+  systemPrompt: zSystemPrompt.nullish(),
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
@@ -77293,6 +77163,7 @@ var zForkSessionRequest = object({
   cwd: string2(),
   additionalDirectories: array(string2()).optional(),
   mcpServers: array(zMcpServer).optional(),
+  systemPrompt: zSystemPrompt.nullish(),
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
@@ -77302,6 +77173,7 @@ var zResumeSessionRequest = object({
   cwd: string2(),
   additionalDirectories: array(string2()).optional(),
   mcpServers: array(zMcpServer).optional(),
+  systemPrompt: zSystemPrompt.nullish(),
   _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
     return;
   })
@@ -77341,138 +77213,6 @@ var zPromptRequest = object({
     return;
   })
 });
-var zWorkspaceFolder = object({
-  uri: string2(),
-  name: string2(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesRepository = object({
-  name: string2(),
-  owner: string2(),
-  remoteUrl: string2(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zStartNesRequest = object({
-  workspaceUri: defaultOnError(string2().nullish(), () => {
-    return;
-  }),
-  workspaceFolders: array(zWorkspaceFolder).nullish(),
-  repository: defaultOnError(zNesRepository.nullish(), () => {
-    return;
-  }),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesTriggerKind = union([
-  literal("automatic"),
-  literal("diagnostic"),
-  literal("manual")
-]);
-var zNesRecentFile = object({
-  uri: string2(),
-  languageId: string2(),
-  text: string2(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesExcerpt = object({
-  startLine: int().gte(0).max(4294967295, {
-    error: "Invalid value: Expected uint32 to be <= 4294967295"
-  }),
-  endLine: int().gte(0).max(4294967295, {
-    error: "Invalid value: Expected uint32 to be <= 4294967295"
-  }),
-  text: string2(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesRelatedSnippet = object({
-  uri: string2(),
-  excerpts: array(zNesExcerpt),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesEditHistoryEntry = object({
-  uri: string2(),
-  diff: string2(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesUserAction = object({
-  action: string2(),
-  uri: string2(),
-  position: zPosition,
-  timestampMs: number2(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesOpenFile = object({
-  uri: string2(),
-  languageId: string2(),
-  visibleRange: defaultOnError(zRange.nullish(), () => {
-    return;
-  }),
-  lastFocusedMs: defaultOnError(number2().nullish(), () => {
-    return;
-  }),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesDiagnosticSeverity = union([
-  literal("error"),
-  literal("warning"),
-  literal("information"),
-  literal("hint")
-]);
-var zNesDiagnostic = object({
-  uri: string2(),
-  range: zRange,
-  severity: zNesDiagnosticSeverity,
-  message: string2(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesSuggestContext = object({
-  recentFiles: array(zNesRecentFile).nullish(),
-  relatedSnippets: array(zNesRelatedSnippet).nullish(),
-  editHistory: array(zNesEditHistoryEntry).nullish(),
-  userActions: array(zNesUserAction).nullish(),
-  openFiles: array(zNesOpenFile).nullish(),
-  diagnostics: array(zNesDiagnostic).nullish(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zSuggestNesRequest = object({
-  sessionId: zSessionId,
-  uri: string2(),
-  version: number2(),
-  position: zPosition,
-  selection: zRange.nullish(),
-  triggerKind: zNesTriggerKind,
-  context: zNesSuggestContext.nullish(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zCloseNesRequest = object({
-  sessionId: zSessionId,
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
 var zClientRequest = object({
   id: zRequestId,
   method: string2(),
@@ -77493,9 +77233,6 @@ var zClientRequest = object({
     zSetSessionModeRequest,
     zSetSessionConfigOptionRequest,
     zPromptRequest,
-    zStartNesRequest,
-    zSuggestNesRequest,
-    zCloseNesRequest,
     zExtRequest
   ]).nullish()
 });
@@ -77661,79 +77398,6 @@ var zCancelNotification = object({
     return;
   })
 });
-var zDidOpenDocumentNotification = object({
-  sessionId: zSessionId,
-  uri: string2(),
-  languageId: string2(),
-  version: number2(),
-  text: string2(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zTextDocumentContentChangeEvent = object({
-  range: zRange.nullish(),
-  text: string2(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zDidChangeDocumentNotification = object({
-  sessionId: zSessionId,
-  uri: string2(),
-  version: number2(),
-  contentChanges: array(zTextDocumentContentChangeEvent),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zDidCloseDocumentNotification = object({
-  sessionId: zSessionId,
-  uri: string2(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zDidSaveDocumentNotification = object({
-  sessionId: zSessionId,
-  uri: string2(),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zDidFocusDocumentNotification = object({
-  sessionId: zSessionId,
-  uri: string2(),
-  version: number2(),
-  position: zPosition,
-  visibleRange: zRange,
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zAcceptNesNotification = object({
-  sessionId: zSessionId,
-  id: zNesSuggestionId,
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
-var zNesRejectReason = union([
-  literal("rejected"),
-  literal("ignored"),
-  literal("replaced"),
-  literal("cancelled")
-]);
-var zRejectNesNotification = object({
-  sessionId: zSessionId,
-  id: zNesSuggestionId,
-  reason: defaultOnError(zNesRejectReason.nullish(), () => {
-    return;
-  }),
-  _meta: defaultOnError(record(string2(), unknown()).nullish(), () => {
-    return;
-  })
-});
 var zMessageMcpNotification = object({
   serverId: zMcpServerAcpId,
   requestId: zMcpRequestId,
@@ -77745,18 +77409,7 @@ var zMessageMcpNotification = object({
 });
 var zClientNotification = object({
   method: string2(),
-  params: union([
-    zCancelNotification,
-    zDidOpenDocumentNotification,
-    zDidChangeDocumentNotification,
-    zDidCloseDocumentNotification,
-    zDidSaveDocumentNotification,
-    zDidFocusDocumentNotification,
-    zAcceptNesNotification,
-    zRejectNesNotification,
-    zMessageMcpNotification,
-    zExtNotification
-  ]).nullish()
+  params: union([zCancelNotification, zMessageMcpNotification, zExtNotification]).nullish()
 });
 var zCancelRequestNotification = object({
   requestId: zRequestId,
@@ -78507,6 +78160,12 @@ class RequestError extends Error {
   static resourceNotFound(uri) {
     return new RequestError(-32002, `Resource not found${uri ? `: ${uri}` : ""}`, uri && { uri });
   }
+  static unsupportedProtocolVersion(requested, supported) {
+    return new RequestError(-32022, "Unsupported protocol version", {
+      requested,
+      supported: [...supported]
+    });
+  }
   toResult() {
     return {
       error: {
@@ -78834,20 +78493,6 @@ var methods = {
       setConfigOption: AGENT_METHODS.session_set_config_option,
       prompt: AGENT_METHODS.session_prompt,
       cancel: AGENT_METHODS.session_cancel
-    },
-    nes: {
-      start: AGENT_METHODS.nes_start,
-      suggest: AGENT_METHODS.nes_suggest,
-      accept: AGENT_METHODS.nes_accept,
-      reject: AGENT_METHODS.nes_reject,
-      close: AGENT_METHODS.nes_close
-    },
-    document: {
-      didOpen: AGENT_METHODS.document_did_open,
-      didChange: AGENT_METHODS.document_did_change,
-      didClose: AGENT_METHODS.document_did_close,
-      didSave: AGENT_METHODS.document_did_save,
-      didFocus: AGENT_METHODS.document_did_focus
     }
   },
   client: {
@@ -79216,7 +78861,11 @@ function parseParams(parser, params) {
   return parser.parse(params);
 }
 function requestSpec(method, params, mapResponse) {
-  return { method, params, mapResponse };
+  return {
+    method,
+    params: (value) => parseParams(params, value ?? {}),
+    mapResponse
+  };
 }
 function notificationSpec(method, params) {
   return { method, params };
@@ -79253,20 +78902,10 @@ var agentRequestSpecs = {
   unstable_setProvider: requestSpec(AGENT_METHODS.providers_set, zSetProviderRequest, emptyObjectResponse),
   unstable_disableProvider: requestSpec(AGENT_METHODS.providers_disable, zDisableProviderRequest, emptyObjectResponse),
   logout: requestSpec(AGENT_METHODS.logout, zLogoutRequest, emptyObjectResponse),
-  prompt: requestSpec(AGENT_METHODS.session_prompt, zPromptRequest),
-  unstable_startNes: requestSpec(AGENT_METHODS.nes_start, zStartNesRequest),
-  unstable_suggestNes: requestSpec(AGENT_METHODS.nes_suggest, zSuggestNesRequest),
-  unstable_closeNes: requestSpec(AGENT_METHODS.nes_close, zCloseNesRequest, emptyObjectResponse)
+  prompt: requestSpec(AGENT_METHODS.session_prompt, zPromptRequest)
 };
 var agentNotificationSpecs = {
-  cancel: notificationSpec(AGENT_METHODS.session_cancel, zCancelNotification),
-  unstable_didOpenDocument: notificationSpec(AGENT_METHODS.document_did_open, zDidOpenDocumentNotification),
-  unstable_didChangeDocument: notificationSpec(AGENT_METHODS.document_did_change, zDidChangeDocumentNotification),
-  unstable_didCloseDocument: notificationSpec(AGENT_METHODS.document_did_close, zDidCloseDocumentNotification),
-  unstable_didSaveDocument: notificationSpec(AGENT_METHODS.document_did_save, zDidSaveDocumentNotification),
-  unstable_didFocusDocument: notificationSpec(AGENT_METHODS.document_did_focus, zDidFocusDocumentNotification),
-  unstable_acceptNes: notificationSpec(AGENT_METHODS.nes_accept, zAcceptNesNotification),
-  unstable_rejectNes: notificationSpec(AGENT_METHODS.nes_reject, zRejectNesNotification)
+  cancel: notificationSpec(AGENT_METHODS.session_cancel, zCancelNotification)
 };
 var clientRequestSpecs = {
   requestPermission: requestSpec(CLIENT_METHODS.session_request_permission, zRequestPermissionRequest),
@@ -79569,20 +79208,10 @@ var legacyAgentRequestMethods = new Set([
   AGENT_METHODS.session_fork,
   AGENT_METHODS.session_resume,
   AGENT_METHODS.session_close,
-  AGENT_METHODS.logout,
-  AGENT_METHODS.nes_start,
-  AGENT_METHODS.nes_suggest,
-  AGENT_METHODS.nes_close
+  AGENT_METHODS.logout
 ]);
 var legacyAgentNotificationMethods = new Set([
-  AGENT_METHODS.session_cancel,
-  AGENT_METHODS.nes_accept,
-  AGENT_METHODS.nes_reject,
-  AGENT_METHODS.document_did_open,
-  AGENT_METHODS.document_did_change,
-  AGENT_METHODS.document_did_close,
-  AGENT_METHODS.document_did_save,
-  AGENT_METHODS.document_did_focus
+  AGENT_METHODS.session_cancel
 ]);
 var legacyClientRequestMethods = new Set([
   CLIENT_METHODS.session_request_permission,
@@ -79637,36 +79266,6 @@ function legacyAgentApp(implementation) {
   if (implementation.logout) {
     app.onRequest(AGENT_METHODS.logout, async (ctx) => await implementation.logout(ctx.params) ?? {});
   }
-  if (implementation.unstable_startNes) {
-    app.onRequest(AGENT_METHODS.nes_start, (ctx) => implementation.unstable_startNes(ctx.params));
-  }
-  if (implementation.unstable_suggestNes) {
-    app.onRequest(AGENT_METHODS.nes_suggest, (ctx) => implementation.unstable_suggestNes(ctx.params));
-  }
-  if (implementation.unstable_closeNes) {
-    app.onRequest(AGENT_METHODS.nes_close, async (ctx) => await implementation.unstable_closeNes(ctx.params) ?? {});
-  }
-  if (implementation.unstable_didOpenDocument) {
-    app.onNotification(AGENT_METHODS.document_did_open, (ctx) => implementation.unstable_didOpenDocument(ctx.params));
-  }
-  if (implementation.unstable_didChangeDocument) {
-    app.onNotification(AGENT_METHODS.document_did_change, (ctx) => implementation.unstable_didChangeDocument(ctx.params));
-  }
-  if (implementation.unstable_didCloseDocument) {
-    app.onNotification(AGENT_METHODS.document_did_close, (ctx) => implementation.unstable_didCloseDocument(ctx.params));
-  }
-  if (implementation.unstable_didSaveDocument) {
-    app.onNotification(AGENT_METHODS.document_did_save, (ctx) => implementation.unstable_didSaveDocument(ctx.params));
-  }
-  if (implementation.unstable_didFocusDocument) {
-    app.onNotification(AGENT_METHODS.document_did_focus, (ctx) => implementation.unstable_didFocusDocument(ctx.params));
-  }
-  if (implementation.unstable_acceptNes) {
-    app.onNotification(AGENT_METHODS.nes_accept, (ctx) => implementation.unstable_acceptNes(ctx.params));
-  }
-  if (implementation.unstable_rejectNes) {
-    app.onNotification(AGENT_METHODS.nes_reject, (ctx) => implementation.unstable_rejectNes(ctx.params));
-  }
   if (implementation.extMethod) {
     app[appBuilder]().withHandler({
       handleMessage: async (message) => {
@@ -80718,6 +80317,21 @@ async function main() {
       console.log(res.ref);
     return;
   }
+  if (positionals[0] === "connect") {
+    const keys = positionals.slice(1);
+    const todoId = aliasTodoId(args.alias) || getEnv("TODO_ID") || cfgScope.data.last_todo_id;
+    if (!keys.length || !todoId) {
+      process.stderr.write(`${RED3}Usage: tfa-cli connect <key> [<key>\u2026] [--reason "why"]${RESET2}
+`);
+      process.exit(2);
+    }
+    const res = await api2.showConnect(todoId, keys, { reason: args.reason, alias: args.alias });
+    if (args.json)
+      console.log(JSON.stringify(res, null, 2));
+    else
+      console.log(res.ref);
+    return;
+  }
   if (positionals[0] === "recommend") {
     const templateId = args.template || positionals[1];
     if (!templateId) {