@vm0/runner 3.3.2 → 3.5.0

package/index.js

@@ -15,7 +15,8 @@ var SANDBOX_DEFAULTS = {
   max_concurrent: 1,
   vcpu: 2,
   memory_mb: 2048,
-  poll_interval_ms: 5e3
+  poll_interval_ms: 3e4
+  // 30s fallback polling (push is primary)
 };
 var PROXY_DEFAULTS = {
   port: 8080
@@ -186,6 +187,89 @@ async function completeJob(apiUrl, context, exitCode, error) {
   }
   return response.json();
 }
+async function getRealtimeToken(server, group) {
+  const headers = getAuthHeaders(server.token);
+  const response = await fetch(`${server.url}/api/runners/realtime/token`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ group })
+  });
+  if (!response.ok) {
+    const errorData = await response.json();
+    throw new Error(
+      `Failed to get realtime token: ${errorData.error?.message || response.statusText}`
+    );
+  }
+  return response.json();
+}
+
+// src/lib/realtime/subscription.ts
+import { z as z2 } from "zod";
+
+// src/lib/realtime/client.ts
+import Ably from "ably";
+function createRealtimeClient(getToken) {
+  return new Ably.Realtime({
+    authCallback: (_tokenParams, callback) => {
+      getToken().then((tokenRequest) => {
+        callback(null, tokenRequest);
+      }).catch((error) => {
+        const errorInfo = {
+          name: "AuthError",
+          message: error instanceof Error ? error.message : "Token fetch failed",
+          code: 40100,
+          statusCode: 401
+        };
+        callback(errorInfo, null);
+      });
+    }
+  });
+}
+function getRunnerGroupChannelName(group) {
+  return `runner-group:${group}`;
+}
+
+// src/lib/realtime/subscription.ts
+var JobNotificationSchema = z2.object({
+  runId: z2.string()
+});
+async function subscribeToJobs(server, group, onJob, onConnectionChange) {
+  const ablyClient = createRealtimeClient(async () => {
+    return getRealtimeToken(server, group);
+  });
+  const channelName = getRunnerGroupChannelName(group);
+  const channel = ablyClient.channels.get(channelName);
+  if (onConnectionChange) {
+    ablyClient.connection.on((stateChange) => {
+      onConnectionChange(stateChange.current, stateChange.reason?.message);
+    });
+  }
+  ablyClient.connection.on("failed", (stateChange) => {
+    console.error(
+      `Ably connection failed: ${stateChange.reason?.message || "Unknown error"}`
+    );
+  });
+  function handleMessage(message) {
+    if (message.name === "job") {
+      const result = JobNotificationSchema.safeParse(message.data);
+      if (result.success) {
+        onJob(result.data);
+      } else {
+        console.error(`Invalid job notification:`, result.error.issues);
+      }
+    }
+  }
+  await channel.subscribe(handleMessage);
+  console.log(`Subscribed to job notifications on ${channelName}`);
+  return {
+    cleanup: () => {
+      channel.unsubscribe();
+      ablyClient.close();
+      console.log(`Unsubscribed from ${channelName}`);
+    },
+    client: ablyClient
+  };
+}
 
 // src/lib/executor.ts
 import path4 from "path";
@@ -1622,7 +1706,7 @@ var VsockClient = class {
 };
 
 // ../../packages/core/src/contracts/base.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 
 // ../../node_modules/.pnpm/@ts-rest+core@3.53.0-rc.1_@types+node@24.3.0/node_modules/@ts-rest/core/index.esm.mjs
 var util;
@@ -5225,7 +5309,7 @@ var coerce = {
   date: ((arg) => ZodDate.create({ ...arg, coerce: true }))
 };
 var NEVER = INVALID;
-var z2 = /* @__PURE__ */ Object.freeze({
+var z3 = /* @__PURE__ */ Object.freeze({
   __proto__: null,
   defaultErrorMap: errorMap,
   setErrorMap,
@@ -5355,29 +5439,29 @@ var zodMerge = (objectA, objectB) => {
   }
   return Object.assign({}, objectA, objectB);
 };
-var ZodErrorSchema = z2.object({
-  name: z2.literal("ZodError"),
-  issues: z2.array(z2.object({
-    path: z2.array(z2.union([z2.string(), z2.number()])),
-    message: z2.string().optional(),
-    code: z2.nativeEnum(z2.ZodIssueCode)
-  }).catchall(z2.any()))
-});
-var RequestValidationErrorSchema = z2.object({
-  message: z2.literal("Request validation failed"),
+var ZodErrorSchema = z3.object({
+  name: z3.literal("ZodError"),
+  issues: z3.array(z3.object({
+    path: z3.array(z3.union([z3.string(), z3.number()])),
+    message: z3.string().optional(),
+    code: z3.nativeEnum(z3.ZodIssueCode)
+  }).catchall(z3.any()))
+});
+var RequestValidationErrorSchema = z3.object({
+  message: z3.literal("Request validation failed"),
   pathParameterErrors: ZodErrorSchema.nullable(),
   headerErrors: ZodErrorSchema.nullable(),
   queryParameterErrors: ZodErrorSchema.nullable(),
   bodyErrors: ZodErrorSchema.nullable()
 });
-var RequestValidationErrorSchemaWithoutMessage = z2.object({
+var RequestValidationErrorSchemaWithoutMessage = z3.object({
   // No message, express never had this implemented
   pathParameterErrors: ZodErrorSchema.nullable(),
   headerErrors: ZodErrorSchema.nullable(),
   queryParameterErrors: ZodErrorSchema.nullable(),
   bodyErrors: ZodErrorSchema.nullable()
 });
-var RequestValidationErrorSchemaForNest = z2.object({
+var RequestValidationErrorSchemaForNest = z3.object({
   paramsResult: ZodErrorSchema.nullable(),
   headersResult: ZodErrorSchema.nullable(),
   queryResult: ZodErrorSchema.nullable(),
@@ -5451,61 +5535,61 @@ var initContract = () => {
 };
 
 // ../../packages/core/src/contracts/base.ts
-var authHeadersSchema = z3.object({
-  authorization: z3.string().optional()
+var authHeadersSchema = z4.object({
+  authorization: z4.string().optional()
 });
 
 // ../../packages/core/src/contracts/errors.ts
-import { z as z4 } from "zod";
-var apiErrorSchema = z4.object({
-  error: z4.object({
-    message: z4.string(),
-    code: z4.string()
+import { z as z5 } from "zod";
+var apiErrorSchema = z5.object({
+  error: z5.object({
+    message: z5.string(),
+    code: z5.string()
   })
 });
 
 // ../../packages/core/src/contracts/composes.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 
 // ../../packages/core/src/contracts/runners.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 var c = initContract();
-var firewallRuleSchema = z5.object({
-  domain: z5.string().optional(),
-  ip: z5.string().optional(),
+var firewallRuleSchema = z6.object({
+  domain: z6.string().optional(),
+  ip: z6.string().optional(),
   /** Terminal rule - value is the action (ALLOW or DENY) */
-  final: z5.enum(["ALLOW", "DENY"]).optional(),
+  final: z6.enum(["ALLOW", "DENY"]).optional(),
   /** Action for domain/ip rules */
-  action: z5.enum(["ALLOW", "DENY"]).optional()
+  action: z6.enum(["ALLOW", "DENY"]).optional()
 });
-var experimentalFirewallSchema = z5.object({
-  enabled: z5.boolean(),
-  rules: z5.array(firewallRuleSchema).optional(),
-  experimental_mitm: z5.boolean().optional(),
-  experimental_seal_secrets: z5.boolean().optional()
+var experimentalFirewallSchema = z6.object({
+  enabled: z6.boolean(),
+  rules: z6.array(firewallRuleSchema).optional(),
+  experimental_mitm: z6.boolean().optional(),
+  experimental_seal_secrets: z6.boolean().optional()
 });
-var runnerGroupSchema = z5.string().regex(
+var runnerGroupSchema = z6.string().regex(
   /^[a-z0-9-]+\/[a-z0-9-]+$/,
   "Runner group must be in scope/name format (e.g., acme/production)"
 );
-var jobSchema = z5.object({
-  runId: z5.string().uuid(),
-  prompt: z5.string(),
-  agentComposeVersionId: z5.string(),
-  vars: z5.record(z5.string(), z5.string()).nullable(),
-  secretNames: z5.array(z5.string()).nullable(),
-  checkpointId: z5.string().uuid().nullable()
+var jobSchema = z6.object({
+  runId: z6.string().uuid(),
+  prompt: z6.string(),
+  agentComposeVersionId: z6.string(),
+  vars: z6.record(z6.string(), z6.string()).nullable(),
+  secretNames: z6.array(z6.string()).nullable(),
+  checkpointId: z6.string().uuid().nullable()
 });
 var runnersPollContract = c.router({
   poll: {
     method: "POST",
     path: "/api/runners/poll",
     headers: authHeadersSchema,
-    body: z5.object({
+    body: z6.object({
       group: runnerGroupSchema
     }),
     responses: {
-      200: z5.object({
+      200: z6.object({
         job: jobSchema.nullable()
       }),
       400: apiErrorSchema,
@@ -5515,65 +5599,69 @@ var runnersPollContract = c.router({
     summary: "Poll for pending jobs (long-polling with 30s timeout)"
   }
 });
-var storageEntrySchema = z5.object({
-  mountPath: z5.string(),
-  archiveUrl: z5.string().nullable()
+var storageEntrySchema = z6.object({
+  mountPath: z6.string(),
+  archiveUrl: z6.string().nullable()
 });
-var artifactEntrySchema = z5.object({
-  mountPath: z5.string(),
-  archiveUrl: z5.string().nullable(),
-  vasStorageName: z5.string(),
-  vasVersionId: z5.string()
+var artifactEntrySchema = z6.object({
+  mountPath: z6.string(),
+  archiveUrl: z6.string().nullable(),
+  vasStorageName: z6.string(),
+  vasVersionId: z6.string()
 });
-var storageManifestSchema = z5.object({
-  storages: z5.array(storageEntrySchema),
+var storageManifestSchema = z6.object({
+  storages: z6.array(storageEntrySchema),
   artifact: artifactEntrySchema.nullable()
 });
-var resumeSessionSchema = z5.object({
-  sessionId: z5.string(),
-  sessionHistory: z5.string()
+var resumeSessionSchema = z6.object({
+  sessionId: z6.string(),
+  sessionHistory: z6.string()
 });
-var storedExecutionContextSchema = z5.object({
-  workingDir: z5.string(),
+var storedExecutionContextSchema = z6.object({
+  workingDir: z6.string(),
   storageManifest: storageManifestSchema.nullable(),
-  environment: z5.record(z5.string(), z5.string()).nullable(),
+  environment: z6.record(z6.string(), z6.string()).nullable(),
   resumeSession: resumeSessionSchema.nullable(),
-  encryptedSecrets: z5.string().nullable(),
+  encryptedSecrets: z6.string().nullable(),
   // AES-256-GCM encrypted secrets
-  cliAgentType: z5.string(),
+  cliAgentType: z6.string(),
   experimentalFirewall: experimentalFirewallSchema.optional(),
   // Debug flag to force real Claude in mock environments (internal use only)
-  debugNoMockClaude: z5.boolean().optional()
-});
-var executionContextSchema = z5.object({
-  runId: z5.string().uuid(),
-  prompt: z5.string(),
-  agentComposeVersionId: z5.string(),
-  vars: z5.record(z5.string(), z5.string()).nullable(),
-  secretNames: z5.array(z5.string()).nullable(),
-  checkpointId: z5.string().uuid().nullable(),
-  sandboxToken: z5.string(),
+  debugNoMockClaude: z6.boolean().optional(),
+  // Dispatch timestamp for E2E timing metrics
+  apiStartTime: z6.number().optional()
+});
+var executionContextSchema = z6.object({
+  runId: z6.string().uuid(),
+  prompt: z6.string(),
+  agentComposeVersionId: z6.string(),
+  vars: z6.record(z6.string(), z6.string()).nullable(),
+  secretNames: z6.array(z6.string()).nullable(),
+  checkpointId: z6.string().uuid().nullable(),
+  sandboxToken: z6.string(),
   // New fields for E2B parity:
-  workingDir: z5.string(),
+  workingDir: z6.string(),
   storageManifest: storageManifestSchema.nullable(),
-  environment: z5.record(z5.string(), z5.string()).nullable(),
+  environment: z6.record(z6.string(), z6.string()).nullable(),
   resumeSession: resumeSessionSchema.nullable(),
-  secretValues: z5.array(z5.string()).nullable(),
-  cliAgentType: z5.string(),
+  secretValues: z6.array(z6.string()).nullable(),
+  cliAgentType: z6.string(),
   // Experimental firewall configuration
   experimentalFirewall: experimentalFirewallSchema.optional(),
   // Debug flag to force real Claude in mock environments (internal use only)
-  debugNoMockClaude: z5.boolean().optional()
+  debugNoMockClaude: z6.boolean().optional(),
+  // Dispatch timestamp for E2E timing metrics
+  apiStartTime: z6.number().optional()
 });
 var runnersJobClaimContract = c.router({
   claim: {
     method: "POST",
     path: "/api/runners/jobs/:id/claim",
     headers: authHeadersSchema,
-    pathParams: z5.object({
-      id: z5.string().uuid()
+    pathParams: z6.object({
+      id: z6.string().uuid()
     }),
-    body: z5.object({}),
+    body: z6.object({}),
     responses: {
       200: executionContextSchema,
       400: apiErrorSchema,
@@ -5591,75 +5679,75 @@ var runnersJobClaimContract = c.router({
 
 // ../../packages/core/src/contracts/composes.ts
 var c2 = initContract();
-var composeVersionQuerySchema = z6.preprocess(
+var composeVersionQuerySchema = z7.preprocess(
   (val) => val === void 0 || val === null ? void 0 : String(val),
-  z6.string().min(1, "Missing version query parameter").regex(
+  z7.string().min(1, "Missing version query parameter").regex(
     /^[a-f0-9]{8,64}$|^latest$/i,
     "Version must be 8-64 hex characters or 'latest'"
   )
 );
-var agentNameSchema = z6.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
+var agentNameSchema = z7.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
   /^[a-zA-Z0-9][a-zA-Z0-9-]{1,62}[a-zA-Z0-9]$/,
   "Agent name must start and end with letter or number, and contain only letters, numbers, and hyphens"
 );
-var volumeConfigSchema = z6.object({
-  name: z6.string().min(1, "Volume name is required"),
-  version: z6.string().min(1, "Volume version is required")
+var volumeConfigSchema = z7.object({
+  name: z7.string().min(1, "Volume name is required"),
+  version: z7.string().min(1, "Volume version is required")
 });
 var SUPPORTED_APPS = ["github"];
 var SUPPORTED_APP_TAGS = ["latest", "dev"];
 var APP_NAME_REGEX = /^[a-z0-9-]+$/;
-var appStringSchema = z6.string().superRefine((val, ctx) => {
+var appStringSchema = z7.string().superRefine((val, ctx) => {
   const [appName, tag] = val.split(":");
   if (!appName || !APP_NAME_REGEX.test(appName)) {
     ctx.addIssue({
-      code: z6.ZodIssueCode.custom,
+      code: z7.ZodIssueCode.custom,
       message: "App name must contain only lowercase letters, numbers, and hyphens"
     });
     return;
   }
   if (!SUPPORTED_APPS.includes(appName)) {
     ctx.addIssue({
-      code: z6.ZodIssueCode.custom,
+      code: z7.ZodIssueCode.custom,
       message: `Invalid app: "${appName}". Supported apps: ${SUPPORTED_APPS.join(", ")}`
     });
     return;
   }
   if (tag !== void 0 && !SUPPORTED_APP_TAGS.includes(tag)) {
     ctx.addIssue({
-      code: z6.ZodIssueCode.custom,
+      code: z7.ZodIssueCode.custom,
       message: `Invalid app tag: "${tag}". Supported tags: ${SUPPORTED_APP_TAGS.join(", ")}`
     });
   }
 });
-var agentDefinitionSchema = z6.object({
-  description: z6.string().optional(),
-  framework: z6.string().min(1, "Framework is required"),
+var agentDefinitionSchema = z7.object({
+  description: z7.string().optional(),
+  framework: z7.string().min(1, "Framework is required"),
   /**
    * Array of pre-installed apps/tools for the agent environment.
    * Format: "app" or "app:tag" (e.g., "github", "github:dev", "github:latest")
    * Default tag is "latest" if not specified.
    * Currently supported apps: "github" (includes GitHub CLI)
    */
-  apps: z6.array(appStringSchema).optional(),
-  volumes: z6.array(z6.string()).optional(),
-  environment: z6.record(z6.string(), z6.string()).optional(),
+  apps: z7.array(appStringSchema).optional(),
+  volumes: z7.array(z7.string()).optional(),
+  environment: z7.record(z7.string(), z7.string()).optional(),
   /**
    * Path to instructions file (e.g., AGENTS.md).
    * Auto-uploaded as volume and mounted at /home/user/.claude/CLAUDE.md
    */
-  instructions: z6.string().min(1, "Instructions path cannot be empty").optional(),
+  instructions: z7.string().min(1, "Instructions path cannot be empty").optional(),
   /**
    * Array of GitHub tree URLs for agent skills.
    * Each skill is auto-downloaded and mounted at /home/user/.claude/skills/{skillName}/
    */
-  skills: z6.array(z6.string()).optional(),
+  skills: z7.array(z7.string()).optional(),
   /**
    * Route this agent to a self-hosted runner instead of E2B.
    * When specified, runs will be queued for the specified runner group.
    */
-  experimental_runner: z6.object({
-    group: z6.string().regex(
+  experimental_runner: z7.object({
+    group: z7.string().regex(
       /^[a-z0-9-]+\/[a-z0-9-]+$/,
       "Runner group must be in scope/name format (e.g., acme/production)"
     )
@@ -5674,32 +5762,32 @@ var agentDefinitionSchema = z6.object({
    * @deprecated Server-resolved field. User input is ignored.
    * @internal
    */
-  image: z6.string().optional(),
+  image: z7.string().optional(),
   /**
    * @deprecated Server-resolved field. User input is ignored.
    * @internal
    */
-  working_dir: z6.string().optional()
+  working_dir: z7.string().optional()
 });
-var agentComposeContentSchema = z6.object({
-  version: z6.string().min(1, "Version is required"),
-  agents: z6.record(z6.string(), agentDefinitionSchema),
-  volumes: z6.record(z6.string(), volumeConfigSchema).optional()
+var agentComposeContentSchema = z7.object({
+  version: z7.string().min(1, "Version is required"),
+  agents: z7.record(z7.string(), agentDefinitionSchema),
+  volumes: z7.record(z7.string(), volumeConfigSchema).optional()
 });
-var composeResponseSchema = z6.object({
-  id: z6.string(),
-  name: z6.string(),
-  headVersionId: z6.string().nullable(),
+var composeResponseSchema = z7.object({
+  id: z7.string(),
+  name: z7.string(),
+  headVersionId: z7.string().nullable(),
   content: agentComposeContentSchema.nullable(),
-  createdAt: z6.string(),
-  updatedAt: z6.string()
+  createdAt: z7.string(),
+  updatedAt: z7.string()
 });
-var createComposeResponseSchema = z6.object({
-  composeId: z6.string(),
-  name: z6.string(),
-  versionId: z6.string(),
-  action: z6.enum(["created", "existing"]),
-  updatedAt: z6.string()
+var createComposeResponseSchema = z7.object({
+  composeId: z7.string(),
+  name: z7.string(),
+  versionId: z7.string(),
+  action: z7.enum(["created", "existing"]),
+  updatedAt: z7.string()
 });
 var composesMainContract = c2.router({
   /**
@@ -5711,9 +5799,9 @@ var composesMainContract = c2.router({
     method: "GET",
     path: "/api/agent/composes",
     headers: authHeadersSchema,
-    query: z6.object({
-      name: z6.string().min(1, "Missing name query parameter"),
-      scope: z6.string().optional()
+    query: z7.object({
+      name: z7.string().min(1, "Missing name query parameter"),
+      scope: z7.string().optional()
     }),
     responses: {
       200: composeResponseSchema,
@@ -5733,7 +5821,7 @@ var composesMainContract = c2.router({
     method: "POST",
     path: "/api/agent/composes",
     headers: authHeadersSchema,
-    body: z6.object({
+    body: z7.object({
       content: agentComposeContentSchema
     }),
     responses: {
@@ -5754,8 +5842,8 @@ var composesByIdContract = c2.router({
     method: "GET",
     path: "/api/agent/composes/:id",
     headers: authHeadersSchema,
-    pathParams: z6.object({
-      id: z6.string().min(1, "Compose ID is required")
+    pathParams: z7.object({
+      id: z7.string().min(1, "Compose ID is required")
     }),
     responses: {
       200: composeResponseSchema,
@@ -5774,14 +5862,14 @@ var composesVersionsContract = c2.router({
     method: "GET",
     path: "/api/agent/composes/versions",
     headers: authHeadersSchema,
-    query: z6.object({
-      composeId: z6.string().min(1, "Missing composeId query parameter"),
+    query: z7.object({
+      composeId: z7.string().min(1, "Missing composeId query parameter"),
       version: composeVersionQuerySchema
     }),
     responses: {
-      200: z6.object({
-        versionId: z6.string(),
-        tag: z6.string().optional()
+      200: z7.object({
+        versionId: z7.string(),
+        tag: z7.string().optional()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -5790,10 +5878,10 @@ var composesVersionsContract = c2.router({
     summary: "Resolve version specifier to full version ID"
   }
 });
-var composeListItemSchema = z6.object({
-  name: z6.string(),
-  headVersionId: z6.string().nullable(),
-  updatedAt: z6.string()
+var composeListItemSchema = z7.object({
+  name: z7.string(),
+  headVersionId: z7.string().nullable(),
+  updatedAt: z7.string()
 });
 var composesListContract = c2.router({
   /**
@@ -5805,12 +5893,12 @@ var composesListContract = c2.router({
     method: "GET",
     path: "/api/agent/composes/list",
     headers: authHeadersSchema,
-    query: z6.object({
-      scope: z6.string().optional()
+    query: z7.object({
+      scope: z7.string().optional()
     }),
     responses: {
-      200: z6.object({
-        composes: z6.array(composeListItemSchema)
+      200: z7.object({
+        composes: z7.array(composeListItemSchema)
       }),
       400: apiErrorSchema,
       401: apiErrorSchema
@@ -5820,87 +5908,116 @@ var composesListContract = c2.router({
 });
 
 // ../../packages/core/src/contracts/runs.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var c3 = initContract();
-var runStatusSchema = z7.enum([
+var runStatusSchema = z8.enum([
   "pending",
   "running",
   "completed",
   "failed",
   "timeout"
 ]);
-var unifiedRunRequestSchema = z7.object({
+var unifiedRunRequestSchema = z8.object({
   // High-level shortcuts (mutually exclusive with each other)
-  checkpointId: z7.string().optional(),
-  sessionId: z7.string().optional(),
+  checkpointId: z8.string().optional(),
+  sessionId: z8.string().optional(),
   // Base parameters (can be used directly or overridden after shortcut expansion)
-  agentComposeId: z7.string().optional(),
-  agentComposeVersionId: z7.string().optional(),
-  conversationId: z7.string().optional(),
-  artifactName: z7.string().optional(),
-  artifactVersion: z7.string().optional(),
-  vars: z7.record(z7.string(), z7.string()).optional(),
-  secrets: z7.record(z7.string(), z7.string()).optional(),
-  volumeVersions: z7.record(z7.string(), z7.string()).optional(),
+  agentComposeId: z8.string().optional(),
+  agentComposeVersionId: z8.string().optional(),
+  conversationId: z8.string().optional(),
+  artifactName: z8.string().optional(),
+  artifactVersion: z8.string().optional(),
+  vars: z8.record(z8.string(), z8.string()).optional(),
+  secrets: z8.record(z8.string(), z8.string()).optional(),
+  volumeVersions: z8.record(z8.string(), z8.string()).optional(),
   // Debug flag to force real Claude in mock environments (internal use only)
-  debugNoMockClaude: z7.boolean().optional(),
+  debugNoMockClaude: z8.boolean().optional(),
   // Model provider for automatic credential injection
-  modelProvider: z7.string().optional(),
+  modelProvider: z8.string().optional(),
   // Required
-  prompt: z7.string().min(1, "Missing prompt")
+  prompt: z8.string().min(1, "Missing prompt")
 });
-var createRunResponseSchema = z7.object({
-  runId: z7.string(),
+var createRunResponseSchema = z8.object({
+  runId: z8.string(),
   status: runStatusSchema,
-  sandboxId: z7.string().optional(),
-  output: z7.string().optional(),
-  error: z7.string().optional(),
-  executionTimeMs: z7.number().optional(),
-  createdAt: z7.string()
-});
-var getRunResponseSchema = z7.object({
-  runId: z7.string(),
-  agentComposeVersionId: z7.string(),
+  sandboxId: z8.string().optional(),
+  output: z8.string().optional(),
+  error: z8.string().optional(),
+  executionTimeMs: z8.number().optional(),
+  createdAt: z8.string()
+});
+var getRunResponseSchema = z8.object({
+  runId: z8.string(),
+  agentComposeVersionId: z8.string(),
   status: runStatusSchema,
-  prompt: z7.string(),
-  vars: z7.record(z7.string(), z7.string()).optional(),
-  sandboxId: z7.string().optional(),
-  result: z7.object({
-    output: z7.string(),
-    executionTimeMs: z7.number()
+  prompt: z8.string(),
+  vars: z8.record(z8.string(), z8.string()).optional(),
+  sandboxId: z8.string().optional(),
+  result: z8.object({
+    output: z8.string(),
+    executionTimeMs: z8.number()
   }).optional(),
-  error: z7.string().optional(),
-  createdAt: z7.string(),
-  startedAt: z7.string().optional(),
-  completedAt: z7.string().optional()
-});
-var runEventSchema = z7.object({
-  sequenceNumber: z7.number(),
-  eventType: z7.string(),
-  eventData: z7.unknown(),
-  createdAt: z7.string()
-});
-var runResultSchema = z7.object({
-  checkpointId: z7.string(),
-  agentSessionId: z7.string(),
-  conversationId: z7.string(),
-  artifact: z7.record(z7.string(), z7.string()).optional(),
+  error: z8.string().optional(),
+  createdAt: z8.string(),
+  startedAt: z8.string().optional(),
+  completedAt: z8.string().optional()
+});
+var runEventSchema = z8.object({
+  sequenceNumber: z8.number(),
+  eventType: z8.string(),
+  eventData: z8.unknown(),
+  createdAt: z8.string()
+});
+var runResultSchema = z8.object({
+  checkpointId: z8.string(),
+  agentSessionId: z8.string(),
+  conversationId: z8.string(),
+  artifact: z8.record(z8.string(), z8.string()).optional(),
   // optional when run has no artifact
-  volumes: z7.record(z7.string(), z7.string()).optional()
+  volumes: z8.record(z8.string(), z8.string()).optional()
 });
-var runStateSchema = z7.object({
+var runStateSchema = z8.object({
   status: runStatusSchema,
   result: runResultSchema.optional(),
-  error: z7.string().optional()
+  error: z8.string().optional()
 });
-var eventsResponseSchema = z7.object({
-  events: z7.array(runEventSchema),
-  hasMore: z7.boolean(),
-  nextSequence: z7.number(),
+var eventsResponseSchema = z8.object({
+  events: z8.array(runEventSchema),
+  hasMore: z8.boolean(),
+  nextSequence: z8.number(),
   run: runStateSchema,
-  framework: z7.string()
+  framework: z8.string()
+});
+var runListItemSchema = z8.object({
+  id: z8.string(),
+  agentName: z8.string(),
+  status: runStatusSchema,
+  prompt: z8.string(),
+  createdAt: z8.string(),
+  startedAt: z8.string().nullable()
+});
+var runsListResponseSchema = z8.object({
+  runs: z8.array(runListItemSchema)
 });
 var runsMainContract = c3.router({
+  /**
+   * GET /api/agent/runs
+   * List agent runs (pending and running by default)
+   */
+  list: {
+    method: "GET",
+    path: "/api/agent/runs",
+    headers: authHeadersSchema,
+    query: z8.object({
+      status: runStatusSchema.optional(),
+      limit: z8.coerce.number().min(1).max(100).default(50)
+    }),
+    responses: {
+      200: runsListResponseSchema,
+      401: apiErrorSchema
+    },
+    summary: "List agent runs"
+  },
   /**
    * POST /api/agent/runs
    * Create and execute a new agent run
@@ -5929,8 +6046,8 @@ var runsByIdContract = c3.router({
     method: "GET",
     path: "/api/agent/runs/:id",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
     responses: {
       200: getRunResponseSchema,
@@ -5941,6 +6058,33 @@ var runsByIdContract = c3.router({
     summary: "Get agent run by ID"
   }
 });
+var cancelRunResponseSchema = z8.object({
+  id: z8.string(),
+  status: z8.literal("cancelled"),
+  message: z8.string()
+});
+var runsCancelContract = c3.router({
+  /**
+   * POST /api/agent/runs/:id/cancel
+   * Cancel a pending or running run
+   */
+  cancel: {
+    method: "POST",
+    path: "/api/agent/runs/:id/cancel",
+    headers: authHeadersSchema,
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
+    }),
+    body: z8.undefined(),
+    responses: {
+      200: cancelRunResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Cancel a pending or running run"
+  }
+});
 var runEventsContract = c3.router({
   /**
    * GET /api/agent/runs/:id/events
@@ -5950,12 +6094,12 @@ var runEventsContract = c3.router({
     method: "GET",
     path: "/api/agent/runs/:id/events",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
-    query: z7.object({
-      since: z7.coerce.number().default(-1),
-      limit: z7.coerce.number().default(100)
+    query: z8.object({
+      since: z8.coerce.number().default(-1),
+      limit: z8.coerce.number().default(100)
     }),
     responses: {
       200: eventsResponseSchema,
@@ -5965,50 +6109,50 @@ var runEventsContract = c3.router({
     summary: "Get agent run events"
   }
 });
-var telemetryMetricSchema = z7.object({
-  ts: z7.string(),
-  cpu: z7.number(),
-  mem_used: z7.number(),
-  mem_total: z7.number(),
-  disk_used: z7.number(),
-  disk_total: z7.number()
+var telemetryMetricSchema = z8.object({
+  ts: z8.string(),
+  cpu: z8.number(),
+  mem_used: z8.number(),
+  mem_total: z8.number(),
+  disk_used: z8.number(),
+  disk_total: z8.number()
 });
-var systemLogResponseSchema = z7.object({
-  systemLog: z7.string(),
-  hasMore: z7.boolean()
+var systemLogResponseSchema = z8.object({
+  systemLog: z8.string(),
+  hasMore: z8.boolean()
 });
-var metricsResponseSchema = z7.object({
-  metrics: z7.array(telemetryMetricSchema),
-  hasMore: z7.boolean()
+var metricsResponseSchema = z8.object({
+  metrics: z8.array(telemetryMetricSchema),
+  hasMore: z8.boolean()
 });
-var agentEventsResponseSchema = z7.object({
-  events: z7.array(runEventSchema),
-  hasMore: z7.boolean(),
-  framework: z7.string()
+var agentEventsResponseSchema = z8.object({
+  events: z8.array(runEventSchema),
+  hasMore: z8.boolean(),
+  framework: z8.string()
 });
-var networkLogEntrySchema = z7.object({
-  timestamp: z7.string(),
+var networkLogEntrySchema = z8.object({
+  timestamp: z8.string(),
   // Common fields (all modes)
-  mode: z7.enum(["mitm", "sni"]).optional(),
-  action: z7.enum(["ALLOW", "DENY"]).optional(),
-  host: z7.string().optional(),
-  port: z7.number().optional(),
-  rule_matched: z7.string().nullable().optional(),
+  mode: z8.enum(["mitm", "sni"]).optional(),
+  action: z8.enum(["ALLOW", "DENY"]).optional(),
+  host: z8.string().optional(),
+  port: z8.number().optional(),
+  rule_matched: z8.string().nullable().optional(),
   // MITM-only fields (optional)
-  method: z7.string().optional(),
-  url: z7.string().optional(),
-  status: z7.number().optional(),
-  latency_ms: z7.number().optional(),
-  request_size: z7.number().optional(),
-  response_size: z7.number().optional()
+  method: z8.string().optional(),
+  url: z8.string().optional(),
+  status: z8.number().optional(),
+  latency_ms: z8.number().optional(),
+  request_size: z8.number().optional(),
+  response_size: z8.number().optional()
 });
-var networkLogsResponseSchema = z7.object({
-  networkLogs: z7.array(networkLogEntrySchema),
-  hasMore: z7.boolean()
+var networkLogsResponseSchema = z8.object({
+  networkLogs: z8.array(networkLogEntrySchema),
+  hasMore: z8.boolean()
 });
-var telemetryResponseSchema = z7.object({
-  systemLog: z7.string(),
-  metrics: z7.array(telemetryMetricSchema)
+var telemetryResponseSchema = z8.object({
+  systemLog: z8.string(),
+  metrics: z8.array(telemetryMetricSchema)
 });
 var runTelemetryContract = c3.router({
   /**
@@ -6019,8 +6163,8 @@ var runTelemetryContract = c3.router({
     method: "GET",
     path: "/api/agent/runs/:id/telemetry",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
     responses: {
       200: telemetryResponseSchema,
@@ -6039,13 +6183,13 @@ var runSystemLogContract = c3.router({
     method: "GET",
     path: "/api/agent/runs/:id/telemetry/system-log",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
-    query: z7.object({
-      since: z7.coerce.number().optional(),
-      limit: z7.coerce.number().min(1).max(100).default(5),
-      order: z7.enum(["asc", "desc"]).default("desc")
+    query: z8.object({
+      since: z8.coerce.number().optional(),
+      limit: z8.coerce.number().min(1).max(100).default(5),
+      order: z8.enum(["asc", "desc"]).default("desc")
     }),
     responses: {
       200: systemLogResponseSchema,
@@ -6064,13 +6208,13 @@ var runMetricsContract = c3.router({
     method: "GET",
     path: "/api/agent/runs/:id/telemetry/metrics",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
-    query: z7.object({
-      since: z7.coerce.number().optional(),
-      limit: z7.coerce.number().min(1).max(100).default(5),
-      order: z7.enum(["asc", "desc"]).default("desc")
+    query: z8.object({
+      since: z8.coerce.number().optional(),
+      limit: z8.coerce.number().min(1).max(100).default(5),
+      order: z8.enum(["asc", "desc"]).default("desc")
     }),
     responses: {
       200: metricsResponseSchema,
@@ -6089,13 +6233,13 @@ var runAgentEventsContract = c3.router({
     method: "GET",
     path: "/api/agent/runs/:id/telemetry/agent",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
-    query: z7.object({
-      since: z7.coerce.number().optional(),
-      limit: z7.coerce.number().min(1).max(100).default(5),
-      order: z7.enum(["asc", "desc"]).default("desc")
+    query: z8.object({
+      since: z8.coerce.number().optional(),
+      limit: z8.coerce.number().min(1).max(100).default(5),
+      order: z8.enum(["asc", "desc"]).default("desc")
     }),
     responses: {
       200: agentEventsResponseSchema,
@@ -6114,13 +6258,13 @@ var runNetworkLogsContract = c3.router({
     method: "GET",
     path: "/api/agent/runs/:id/telemetry/network",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
-    query: z7.object({
-      since: z7.coerce.number().optional(),
-      limit: z7.coerce.number().min(1).max(100).default(5),
-      order: z7.enum(["asc", "desc"]).default("desc")
+    query: z8.object({
+      since: z8.coerce.number().optional(),
+      limit: z8.coerce.number().min(1).max(100).default(5),
+      order: z8.enum(["asc", "desc"]).default("desc")
     }),
     responses: {
       200: networkLogsResponseSchema,
@@ -6132,20 +6276,20 @@ var runNetworkLogsContract = c3.router({
 });
 
 // ../../packages/core/src/contracts/storages.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var c4 = initContract();
-var storageTypeSchema = z8.enum(["volume", "artifact"]);
-var versionQuerySchema = z8.preprocess(
+var storageTypeSchema = z9.enum(["volume", "artifact"]);
+var versionQuerySchema = z9.preprocess(
   (val) => val === void 0 || val === null ? void 0 : String(val),
-  z8.string().regex(/^[a-f0-9]{8,64}$/i, "Version must be 8-64 hex characters").optional()
+  z9.string().regex(/^[a-f0-9]{8,64}$/i, "Version must be 8-64 hex characters").optional()
 );
-var uploadStorageResponseSchema = z8.object({
-  name: z8.string(),
-  versionId: z8.string(),
-  size: z8.number(),
-  fileCount: z8.number(),
+var uploadStorageResponseSchema = z9.object({
+  name: z9.string(),
+  versionId: z9.string(),
+  size: z9.number(),
+  fileCount: z9.number(),
   type: storageTypeSchema,
-  deduplicated: z8.boolean()
+  deduplicated: z9.boolean()
 });
 var storagesContract = c4.router({
   /**
@@ -6187,8 +6331,8 @@ var storagesContract = c4.router({
     method: "GET",
     path: "/api/storages",
     headers: authHeadersSchema,
-    query: z8.object({
-      name: z8.string().min(1, "Storage name is required"),
+    query: z9.object({
+      name: z9.string().min(1, "Storage name is required"),
       version: versionQuerySchema
     }),
     responses: {
@@ -6205,41 +6349,41 @@ var storagesContract = c4.router({
     summary: "Download storage archive"
   }
 });
-var fileEntryWithHashSchema = z8.object({
-  path: z8.string().min(1, "File path is required"),
-  hash: z8.string().length(64, "Hash must be SHA-256 (64 hex chars)"),
-  size: z8.number().int().min(0, "Size must be non-negative")
+var fileEntryWithHashSchema = z9.object({
+  path: z9.string().min(1, "File path is required"),
+  hash: z9.string().length(64, "Hash must be SHA-256 (64 hex chars)"),
+  size: z9.number().int().min(0, "Size must be non-negative")
 });
-var storageChangesSchema = z8.object({
-  added: z8.array(z8.string()),
-  modified: z8.array(z8.string()),
-  deleted: z8.array(z8.string())
+var storageChangesSchema = z9.object({
+  added: z9.array(z9.string()),
+  modified: z9.array(z9.string()),
+  deleted: z9.array(z9.string())
 });
-var presignedUploadSchema = z8.object({
-  key: z8.string(),
-  presignedUrl: z8.string().url()
+var presignedUploadSchema = z9.object({
+  key: z9.string(),
+  presignedUrl: z9.string().url()
 });
 var storagesPrepareContract = c4.router({
   prepare: {
     method: "POST",
     path: "/api/storages/prepare",
     headers: authHeadersSchema,
-    body: z8.object({
-      storageName: z8.string().min(1, "Storage name is required"),
+    body: z9.object({
+      storageName: z9.string().min(1, "Storage name is required"),
       storageType: storageTypeSchema,
-      files: z8.array(fileEntryWithHashSchema),
-      force: z8.boolean().optional(),
-      runId: z8.string().optional(),
+      files: z9.array(fileEntryWithHashSchema),
+      force: z9.boolean().optional(),
+      runId: z9.string().optional(),
       // For sandbox auth
-      baseVersion: z8.string().optional(),
+      baseVersion: z9.string().optional(),
       // For incremental uploads
       changes: storageChangesSchema.optional()
     }),
     responses: {
-      200: z8.object({
-        versionId: z8.string(),
-        existing: z8.boolean(),
-        uploads: z8.object({
+      200: z9.object({
+        versionId: z9.string(),
+        existing: z9.boolean(),
+        uploads: z9.object({
           archive: presignedUploadSchema,
           manifest: presignedUploadSchema
         }).optional()
@@ -6257,22 +6401,22 @@ var storagesCommitContract = c4.router({
     method: "POST",
     path: "/api/storages/commit",
     headers: authHeadersSchema,
-    body: z8.object({
-      storageName: z8.string().min(1, "Storage name is required"),
+    body: z9.object({
+      storageName: z9.string().min(1, "Storage name is required"),
       storageType: storageTypeSchema,
-      versionId: z8.string().min(1, "Version ID is required"),
-      files: z8.array(fileEntryWithHashSchema),
-      runId: z8.string().optional(),
-      message: z8.string().optional()
+      versionId: z9.string().min(1, "Version ID is required"),
+      files: z9.array(fileEntryWithHashSchema),
+      runId: z9.string().optional(),
+      message: z9.string().optional()
     }),
     responses: {
-      200: z8.object({
-        success: z8.literal(true),
-        versionId: z8.string(),
-        storageName: z8.string(),
-        size: z8.number(),
-        fileCount: z8.number(),
-        deduplicated: z8.boolean().optional()
+      200: z9.object({
+        success: z9.literal(true),
+        versionId: z9.string(),
+        storageName: z9.string(),
+        size: z9.number(),
+        fileCount: z9.number(),
+        deduplicated: z9.boolean().optional()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -6289,26 +6433,26 @@ var storagesDownloadContract = c4.router({
     method: "GET",
     path: "/api/storages/download",
     headers: authHeadersSchema,
-    query: z8.object({
-      name: z8.string().min(1, "Storage name is required"),
+    query: z9.object({
+      name: z9.string().min(1, "Storage name is required"),
       type: storageTypeSchema,
       version: versionQuerySchema
     }),
     responses: {
       // Normal response with presigned URL
-      200: z8.union([
-        z8.object({
-          url: z8.string().url(),
-          versionId: z8.string(),
-          fileCount: z8.number(),
-          size: z8.number()
+      200: z9.union([
+        z9.object({
+          url: z9.string().url(),
+          versionId: z9.string(),
+          fileCount: z9.number(),
+          size: z9.number()
         }),
         // Empty artifact response
-        z8.object({
-          empty: z8.literal(true),
-          versionId: z8.string(),
-          fileCount: z8.literal(0),
-          size: z8.literal(0)
+        z9.object({
+          empty: z9.literal(true),
+          versionId: z9.string(),
+          fileCount: z9.literal(0),
+          size: z9.literal(0)
         })
       ]),
       400: apiErrorSchema,
@@ -6324,16 +6468,16 @@ var storagesListContract = c4.router({
     method: "GET",
     path: "/api/storages/list",
     headers: authHeadersSchema,
-    query: z8.object({
+    query: z9.object({
       type: storageTypeSchema
     }),
     responses: {
-      200: z8.array(
-        z8.object({
-          name: z8.string(),
-          size: z8.number(),
-          fileCount: z8.number(),
-          updatedAt: z8.string()
+      200: z9.array(
+        z9.object({
+          name: z9.string(),
+          size: z9.number(),
+          fileCount: z9.number(),
+          updatedAt: z9.string()
         })
       ),
       401: apiErrorSchema,
@@ -6344,18 +6488,18 @@ var storagesListContract = c4.router({
 });
 
 // ../../packages/core/src/contracts/webhooks.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var c5 = initContract();
-var agentEventSchema = z9.object({
-  type: z9.string(),
-  sequenceNumber: z9.number().int().nonnegative()
+var agentEventSchema = z10.object({
+  type: z10.string(),
+  sequenceNumber: z10.number().int().nonnegative()
 }).passthrough();
-var artifactSnapshotSchema = z9.object({
-  artifactName: z9.string(),
-  artifactVersion: z9.string()
+var artifactSnapshotSchema = z10.object({
+  artifactName: z10.string(),
+  artifactVersion: z10.string()
 });
-var volumeVersionsSnapshotSchema = z9.object({
-  versions: z9.record(z9.string(), z9.string())
+var volumeVersionsSnapshotSchema = z10.object({
+  versions: z10.record(z10.string(), z10.string())
 });
 var webhookEventsContract = c5.router({
   /**
@@ -6366,15 +6510,15 @@ var webhookEventsContract = c5.router({
     method: "POST",
     path: "/api/webhooks/agent/events",
     headers: authHeadersSchema,
-    body: z9.object({
-      runId: z9.string().min(1, "runId is required"),
-      events: z9.array(agentEventSchema).min(1, "events array cannot be empty")
+    body: z10.object({
+      runId: z10.string().min(1, "runId is required"),
+      events: z10.array(agentEventSchema).min(1, "events array cannot be empty")
     }),
     responses: {
-      200: z9.object({
-        received: z9.number(),
-        firstSequence: z9.number(),
-        lastSequence: z9.number()
+      200: z10.object({
+        received: z10.number(),
+        firstSequence: z10.number(),
+        lastSequence: z10.number()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -6393,15 +6537,15 @@ var webhookCompleteContract = c5.router({
     method: "POST",
     path: "/api/webhooks/agent/complete",
     headers: authHeadersSchema,
-    body: z9.object({
-      runId: z9.string().min(1, "runId is required"),
-      exitCode: z9.number(),
-      error: z9.string().optional()
+    body: z10.object({
+      runId: z10.string().min(1, "runId is required"),
+      exitCode: z10.number(),
+      error: z10.string().optional()
     }),
     responses: {
-      200: z9.object({
-        success: z9.boolean(),
-        status: z9.enum(["completed", "failed"])
+      200: z10.object({
+        success: z10.boolean(),
+        status: z10.enum(["completed", "failed"])
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -6420,21 +6564,21 @@ var webhookCheckpointsContract = c5.router({
     method: "POST",
     path: "/api/webhooks/agent/checkpoints",
     headers: authHeadersSchema,
-    body: z9.object({
-      runId: z9.string().min(1, "runId is required"),
-      cliAgentType: z9.string().min(1, "cliAgentType is required"),
-      cliAgentSessionId: z9.string().min(1, "cliAgentSessionId is required"),
-      cliAgentSessionHistory: z9.string().min(1, "cliAgentSessionHistory is required"),
+    body: z10.object({
+      runId: z10.string().min(1, "runId is required"),
+      cliAgentType: z10.string().min(1, "cliAgentType is required"),
+      cliAgentSessionId: z10.string().min(1, "cliAgentSessionId is required"),
+      cliAgentSessionHistory: z10.string().min(1, "cliAgentSessionHistory is required"),
       artifactSnapshot: artifactSnapshotSchema.optional(),
       volumeVersionsSnapshot: volumeVersionsSnapshotSchema.optional()
     }),
     responses: {
-      200: z9.object({
-        checkpointId: z9.string(),
-        agentSessionId: z9.string(),
-        conversationId: z9.string(),
+      200: z10.object({
+        checkpointId: z10.string(),
+        agentSessionId: z10.string(),
+        conversationId: z10.string(),
         artifact: artifactSnapshotSchema.optional(),
-        volumes: z9.record(z9.string(), z9.string()).optional()
+        volumes: z10.record(z10.string(), z10.string()).optional()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -6453,12 +6597,12 @@ var webhookHeartbeatContract = c5.router({
     method: "POST",
     path: "/api/webhooks/agent/heartbeat",
     headers: authHeadersSchema,
-    body: z9.object({
-      runId: z9.string().min(1, "runId is required")
+    body: z10.object({
+      runId: z10.string().min(1, "runId is required")
     }),
     responses: {
-      200: z9.object({
-        ok: z9.boolean()
+      200: z10.object({
+        ok: z10.boolean()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -6486,11 +6630,11 @@ var webhookStoragesContract = c5.router({
     contentType: "multipart/form-data",
     body: c5.type(),
     responses: {
-      200: z9.object({
-        versionId: z9.string(),
-        storageName: z9.string(),
-        size: z9.number(),
-        fileCount: z9.number()
+      200: z10.object({
+        versionId: z10.string(),
+        storageName: z10.string(),
+        size: z10.number(),
+        fileCount: z10.number()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -6520,17 +6664,17 @@ var webhookStoragesIncrementalContract = c5.router({
     contentType: "multipart/form-data",
     body: c5.type(),
     responses: {
-      200: z9.object({
-        versionId: z9.string(),
-        storageName: z9.string(),
-        size: z9.number(),
-        fileCount: z9.number(),
-        incrementalStats: z9.object({
-          addedFiles: z9.number(),
-          modifiedFiles: z9.number(),
-          deletedFiles: z9.number(),
-          unchangedFiles: z9.number(),
-          bytesUploaded: z9.number()
+      200: z10.object({
+        versionId: z10.string(),
+        storageName: z10.string(),
+        size: z10.number(),
+        fileCount: z10.number(),
+        incrementalStats: z10.object({
+          addedFiles: z10.number(),
+          modifiedFiles: z10.number(),
+          deletedFiles: z10.number(),
+          unchangedFiles: z10.number(),
+          bytesUploaded: z10.number()
         }).optional()
       }),
       400: apiErrorSchema,
@@ -6541,36 +6685,36 @@ var webhookStoragesIncrementalContract = c5.router({
     summary: "Upload storage version incrementally from sandbox"
   }
 });
-var metricDataSchema = z9.object({
-  ts: z9.string(),
-  cpu: z9.number(),
-  mem_used: z9.number(),
-  mem_total: z9.number(),
-  disk_used: z9.number(),
-  disk_total: z9.number()
+var metricDataSchema = z10.object({
+  ts: z10.string(),
+  cpu: z10.number(),
+  mem_used: z10.number(),
+  mem_total: z10.number(),
+  disk_used: z10.number(),
+  disk_total: z10.number()
 });
-var sandboxOperationSchema = z9.object({
-  ts: z9.string(),
-  action_type: z9.string(),
-  duration_ms: z9.number(),
-  success: z9.boolean(),
-  error: z9.string().optional()
+var sandboxOperationSchema = z10.object({
+  ts: z10.string(),
+  action_type: z10.string(),
+  duration_ms: z10.number(),
+  success: z10.boolean(),
+  error: z10.string().optional()
 });
-var networkLogSchema = z9.object({
-  timestamp: z9.string(),
+var networkLogSchema = z10.object({
+  timestamp: z10.string(),
   // Common fields (all modes)
-  mode: z9.enum(["mitm", "sni"]).optional(),
-  action: z9.enum(["ALLOW", "DENY"]).optional(),
-  host: z9.string().optional(),
-  port: z9.number().optional(),
-  rule_matched: z9.string().nullable().optional(),
+  mode: z10.enum(["mitm", "sni"]).optional(),
+  action: z10.enum(["ALLOW", "DENY"]).optional(),
+  host: z10.string().optional(),
+  port: z10.number().optional(),
+  rule_matched: z10.string().nullable().optional(),
   // MITM-only fields (optional)
-  method: z9.string().optional(),
-  url: z9.string().optional(),
-  status: z9.number().optional(),
-  latency_ms: z9.number().optional(),
-  request_size: z9.number().optional(),
-  response_size: z9.number().optional()
+  method: z10.string().optional(),
+  url: z10.string().optional(),
+  status: z10.number().optional(),
+  latency_ms: z10.number().optional(),
+  request_size: z10.number().optional(),
+  response_size: z10.number().optional()
 });
 var webhookTelemetryContract = c5.router({
   /**
@@ -6581,17 +6725,17 @@ var webhookTelemetryContract = c5.router({
     method: "POST",
     path: "/api/webhooks/agent/telemetry",
     headers: authHeadersSchema,
-    body: z9.object({
-      runId: z9.string().min(1, "runId is required"),
-      systemLog: z9.string().optional(),
-      metrics: z9.array(metricDataSchema).optional(),
-      networkLogs: z9.array(networkLogSchema).optional(),
-      sandboxOperations: z9.array(sandboxOperationSchema).optional()
+    body: z10.object({
+      runId: z10.string().min(1, "runId is required"),
+      systemLog: z10.string().optional(),
+      metrics: z10.array(metricDataSchema).optional(),
+      networkLogs: z10.array(networkLogSchema).optional(),
+      sandboxOperations: z10.array(sandboxOperationSchema).optional()
     }),
     responses: {
-      200: z9.object({
-        success: z9.boolean(),
-        id: z9.string()
+      200: z10.object({
+        success: z10.boolean(),
+        id: z10.string()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -6606,21 +6750,21 @@ var webhookStoragesPrepareContract = c5.router({
     method: "POST",
     path: "/api/webhooks/agent/storages/prepare",
     headers: authHeadersSchema,
-    body: z9.object({
-      runId: z9.string().min(1, "runId is required"),
+    body: z10.object({
+      runId: z10.string().min(1, "runId is required"),
       // Required for webhook auth
-      storageName: z9.string().min(1, "Storage name is required"),
+      storageName: z10.string().min(1, "Storage name is required"),
       storageType: storageTypeSchema,
-      files: z9.array(fileEntryWithHashSchema),
-      force: z9.boolean().optional(),
-      baseVersion: z9.string().optional(),
+      files: z10.array(fileEntryWithHashSchema),
+      force: z10.boolean().optional(),
+      baseVersion: z10.string().optional(),
       changes: storageChangesSchema.optional()
     }),
     responses: {
-      200: z9.object({
-        versionId: z9.string(),
-        existing: z9.boolean(),
-        uploads: z9.object({
+      200: z10.object({
+        versionId: z10.string(),
+        existing: z10.boolean(),
+        uploads: z10.object({
           archive: presignedUploadSchema,
           manifest: presignedUploadSchema
         }).optional()
@@ -6638,23 +6782,23 @@ var webhookStoragesCommitContract = c5.router({
     method: "POST",
     path: "/api/webhooks/agent/storages/commit",
     headers: authHeadersSchema,
-    body: z9.object({
-      runId: z9.string().min(1, "runId is required"),
+    body: z10.object({
+      runId: z10.string().min(1, "runId is required"),
       // Required for webhook auth
-      storageName: z9.string().min(1, "Storage name is required"),
+      storageName: z10.string().min(1, "Storage name is required"),
       storageType: storageTypeSchema,
-      versionId: z9.string().min(1, "Version ID is required"),
-      files: z9.array(fileEntryWithHashSchema),
-      message: z9.string().optional()
+      versionId: z10.string().min(1, "Version ID is required"),
+      files: z10.array(fileEntryWithHashSchema),
+      message: z10.string().optional()
     }),
     responses: {
-      200: z9.object({
-        success: z9.literal(true),
-        versionId: z9.string(),
-        storageName: z9.string(),
-        size: z9.number(),
-        fileCount: z9.number(),
-        deduplicated: z9.boolean().optional()
+      200: z10.object({
+        success: z10.literal(true),
+        versionId: z10.string(),
+        storageName: z10.string(),
+        size: z10.number(),
+        fileCount: z10.number(),
+        deduplicated: z10.boolean().optional()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -6668,11 +6812,11 @@ var webhookStoragesCommitContract = c5.router({
 });
 
 // ../../packages/core/src/contracts/cli-auth.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var c6 = initContract();
-var oauthErrorSchema = z10.object({
-  error: z10.string(),
-  error_description: z10.string()
+var oauthErrorSchema = z11.object({
+  error: z11.string(),
+  error_description: z11.string()
 });
 var cliAuthDeviceContract = c6.router({
   /**
@@ -6682,14 +6826,14 @@ var cliAuthDeviceContract = c6.router({
   create: {
     method: "POST",
     path: "/api/cli/auth/device",
-    body: z10.object({}).optional(),
+    body: z11.object({}).optional(),
     responses: {
-      200: z10.object({
-        device_code: z10.string(),
-        user_code: z10.string(),
-        verification_path: z10.string(),
-        expires_in: z10.number(),
-        interval: z10.number()
+      200: z11.object({
+        device_code: z11.string(),
+        user_code: z11.string(),
+        verification_path: z11.string(),
+        expires_in: z11.number(),
+        interval: z11.number()
       }),
       500: oauthErrorSchema
     },
@@ -6704,16 +6848,16 @@ var cliAuthTokenContract = c6.router({
   exchange: {
     method: "POST",
     path: "/api/cli/auth/token",
-    body: z10.object({
-      device_code: z10.string().min(1, "device_code is required")
+    body: z11.object({
+      device_code: z11.string().min(1, "device_code is required")
     }),
     responses: {
       // Success - token issued
-      200: z10.object({
-        access_token: z10.string(),
-        refresh_token: z10.string(),
-        token_type: z10.literal("Bearer"),
-        expires_in: z10.number()
+      200: z11.object({
+        access_token: z11.string(),
+        refresh_token: z11.string(),
+        token_type: z11.literal("Bearer"),
+        expires_in: z11.number()
       }),
       // Authorization pending
       202: oauthErrorSchema,
@@ -6726,7 +6870,7 @@ var cliAuthTokenContract = c6.router({
 });
 
 // ../../packages/core/src/contracts/auth.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var c7 = initContract();
 var authContract = c7.router({
   /**
@@ -6738,9 +6882,9 @@ var authContract = c7.router({
     path: "/api/auth/me",
     headers: authHeadersSchema,
     responses: {
-      200: z11.object({
-        userId: z11.string(),
-        email: z11.string()
+      200: z12.object({
+        userId: z12.string(),
+        email: z12.string()
       }),
       401: apiErrorSchema,
       404: apiErrorSchema,
@@ -6751,18 +6895,18 @@ var authContract = c7.router({
 });
 
 // ../../packages/core/src/contracts/cron.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var c8 = initContract();
-var cleanupResultSchema = z12.object({
-  runId: z12.string(),
-  sandboxId: z12.string().nullable(),
-  status: z12.enum(["cleaned", "error"]),
-  error: z12.string().optional()
+var cleanupResultSchema = z13.object({
+  runId: z13.string(),
+  sandboxId: z13.string().nullable(),
+  status: z13.enum(["cleaned", "error"]),
+  error: z13.string().optional()
 });
-var cleanupResponseSchema = z12.object({
-  cleaned: z12.number(),
-  errors: z12.number(),
-  results: z12.array(cleanupResultSchema)
+var cleanupResponseSchema = z13.object({
+  cleaned: z13.number(),
+  errors: z13.number(),
+  results: z13.array(cleanupResultSchema)
 });
 var cronCleanupSandboxesContract = c8.router({
   /**
@@ -6783,44 +6927,44 @@ var cronCleanupSandboxesContract = c8.router({
 });
 
 // ../../packages/core/src/contracts/proxy.ts
-import { z as z13 } from "zod";
-var proxyErrorSchema = z13.object({
-  error: z13.object({
-    message: z13.string(),
-    code: z13.enum([
+import { z as z14 } from "zod";
+var proxyErrorSchema = z14.object({
+  error: z14.object({
+    message: z14.string(),
+    code: z14.enum([
       "UNAUTHORIZED",
       "BAD_REQUEST",
       "BAD_GATEWAY",
       "INTERNAL_ERROR"
     ]),
-    targetUrl: z13.string().optional()
+    targetUrl: z14.string().optional()
   })
 });
 
 // ../../packages/core/src/contracts/scopes.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 var c9 = initContract();
-var scopeTypeSchema = z14.enum(["personal", "organization", "system"]);
-var scopeSlugSchema = z14.string().min(3, "Scope slug must be at least 3 characters").max(64, "Scope slug must be at most 64 characters").regex(
+var scopeTypeSchema = z15.enum(["personal", "organization", "system"]);
+var scopeSlugSchema = z15.string().min(3, "Scope slug must be at least 3 characters").max(64, "Scope slug must be at most 64 characters").regex(
   /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]{1,2}$/,
   "Scope slug must contain only lowercase letters, numbers, and hyphens, and must start and end with an alphanumeric character"
 ).refine(
   (slug) => !slug.startsWith("vm0"),
   "Scope slug cannot start with 'vm0' (reserved)"
 ).transform((s) => s.toLowerCase());
-var scopeResponseSchema = z14.object({
-  id: z14.string().uuid(),
-  slug: z14.string(),
+var scopeResponseSchema = z15.object({
+  id: z15.string().uuid(),
+  slug: z15.string(),
   type: scopeTypeSchema,
-  createdAt: z14.string(),
-  updatedAt: z14.string()
+  createdAt: z15.string(),
+  updatedAt: z15.string()
 });
-var createScopeRequestSchema = z14.object({
+var createScopeRequestSchema = z15.object({
   slug: scopeSlugSchema
 });
-var updateScopeRequestSchema = z14.object({
+var updateScopeRequestSchema = z15.object({
   slug: scopeSlugSchema,
-  force: z14.boolean().optional().default(false)
+  force: z15.boolean().optional().default(false)
 });
 var scopeContract = c9.router({
   /**
@@ -6880,28 +7024,28 @@ var scopeContract = c9.router({
 });
 
 // ../../packages/core/src/contracts/credentials.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var c10 = initContract();
-var credentialNameSchema = z15.string().min(1, "Credential name is required").max(255, "Credential name must be at most 255 characters").regex(
+var credentialNameSchema = z16.string().min(1, "Credential name is required").max(255, "Credential name must be at most 255 characters").regex(
   /^[A-Z][A-Z0-9_]*$/,
   "Credential name must contain only uppercase letters, numbers, and underscores, and must start with a letter (e.g., MY_API_KEY)"
 );
-var credentialTypeSchema = z15.enum(["user", "model-provider"]);
-var credentialResponseSchema = z15.object({
-  id: z15.string().uuid(),
-  name: z15.string(),
-  description: z15.string().nullable(),
+var credentialTypeSchema = z16.enum(["user", "model-provider"]);
+var credentialResponseSchema = z16.object({
+  id: z16.string().uuid(),
+  name: z16.string(),
+  description: z16.string().nullable(),
   type: credentialTypeSchema,
-  createdAt: z15.string(),
-  updatedAt: z15.string()
+  createdAt: z16.string(),
+  updatedAt: z16.string()
 });
-var credentialListResponseSchema = z15.object({
-  credentials: z15.array(credentialResponseSchema)
+var credentialListResponseSchema = z16.object({
+  credentials: z16.array(credentialResponseSchema)
 });
-var setCredentialRequestSchema = z15.object({
+var setCredentialRequestSchema = z16.object({
   name: credentialNameSchema,
-  value: z15.string().min(1, "Credential value is required"),
-  description: z15.string().max(1e3).optional()
+  value: z16.string().min(1, "Credential value is required"),
+  description: z16.string().max(1e3).optional()
 });
 var credentialsMainContract = c10.router({
   /**
@@ -6947,7 +7091,7 @@ var credentialsByNameContract = c10.router({
     method: "GET",
     path: "/api/credentials/:name",
     headers: authHeadersSchema,
-    pathParams: z15.object({
+    pathParams: z16.object({
       name: credentialNameSchema
     }),
     responses: {
@@ -6966,11 +7110,11 @@ var credentialsByNameContract = c10.router({
     method: "DELETE",
     path: "/api/credentials/:name",
     headers: authHeadersSchema,
-    pathParams: z15.object({
+    pathParams: z16.object({
       name: credentialNameSchema
     }),
     responses: {
-      204: z15.undefined(),
+      204: z16.undefined(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -6980,39 +7124,38 @@ var credentialsByNameContract = c10.router({
 });
 
 // ../../packages/core/src/contracts/model-providers.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var c11 = initContract();
-var modelProviderTypeSchema = z16.enum([
+var modelProviderTypeSchema = z17.enum([
   "claude-code-oauth-token",
-  "anthropic-api-key",
-  "openai-api-key"
+  "anthropic-api-key"
 ]);
-var modelProviderFrameworkSchema = z16.enum(["claude-code", "codex"]);
-var modelProviderResponseSchema = z16.object({
-  id: z16.string().uuid(),
+var modelProviderFrameworkSchema = z17.enum(["claude-code", "codex"]);
+var modelProviderResponseSchema = z17.object({
+  id: z17.string().uuid(),
   type: modelProviderTypeSchema,
   framework: modelProviderFrameworkSchema,
-  credentialName: z16.string(),
-  isDefault: z16.boolean(),
-  createdAt: z16.string(),
-  updatedAt: z16.string()
+  credentialName: z17.string(),
+  isDefault: z17.boolean(),
+  createdAt: z17.string(),
+  updatedAt: z17.string()
 });
-var modelProviderListResponseSchema = z16.object({
-  modelProviders: z16.array(modelProviderResponseSchema)
+var modelProviderListResponseSchema = z17.object({
+  modelProviders: z17.array(modelProviderResponseSchema)
 });
-var upsertModelProviderRequestSchema = z16.object({
+var upsertModelProviderRequestSchema = z17.object({
   type: modelProviderTypeSchema,
-  credential: z16.string().min(1, "Credential is required"),
-  convert: z16.boolean().optional()
+  credential: z17.string().min(1, "Credential is required"),
+  convert: z17.boolean().optional()
 });
-var upsertModelProviderResponseSchema = z16.object({
+var upsertModelProviderResponseSchema = z17.object({
   provider: modelProviderResponseSchema,
-  created: z16.boolean()
+  created: z17.boolean()
 });
-var checkCredentialResponseSchema = z16.object({
-  exists: z16.boolean(),
-  credentialName: z16.string(),
-  currentType: z16.enum(["user", "model-provider"]).optional()
+var checkCredentialResponseSchema = z17.object({
+  exists: z17.boolean(),
+  credentialName: z17.string(),
+  currentType: z17.enum(["user", "model-provider"]).optional()
 });
 var modelProvidersMainContract = c11.router({
   list: {
@@ -7047,7 +7190,7 @@ var modelProvidersCheckContract = c11.router({
     method: "GET",
     path: "/api/model-providers/check/:type",
     headers: authHeadersSchema,
-    pathParams: z16.object({
+    pathParams: z17.object({
       type: modelProviderTypeSchema
     }),
     responses: {
@@ -7063,11 +7206,11 @@ var modelProvidersByTypeContract = c11.router({
     method: "DELETE",
     path: "/api/model-providers/:type",
     headers: authHeadersSchema,
-    pathParams: z16.object({
+    pathParams: z17.object({
       type: modelProviderTypeSchema
     }),
     responses: {
-      204: z16.undefined(),
+      204: z17.undefined(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -7080,10 +7223,10 @@ var modelProvidersConvertContract = c11.router({
     method: "POST",
     path: "/api/model-providers/:type/convert",
     headers: authHeadersSchema,
-    pathParams: z16.object({
+    pathParams: z17.object({
       type: modelProviderTypeSchema
     }),
-    body: z16.undefined(),
+    body: z17.undefined(),
     responses: {
       200: modelProviderResponseSchema,
       400: apiErrorSchema,
@@ -7099,10 +7242,10 @@ var modelProvidersSetDefaultContract = c11.router({
     method: "POST",
     path: "/api/model-providers/:type/set-default",
     headers: authHeadersSchema,
-    pathParams: z16.object({
+    pathParams: z17.object({
       type: modelProviderTypeSchema
     }),
-    body: z16.undefined(),
+    body: z17.undefined(),
     responses: {
       200: modelProviderResponseSchema,
       401: apiErrorSchema,
@@ -7114,40 +7257,40 @@ var modelProvidersSetDefaultContract = c11.router({
 });
 
 // ../../packages/core/src/contracts/sessions.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 var c12 = initContract();
-var sessionResponseSchema = z17.object({
-  id: z17.string(),
-  agentComposeId: z17.string(),
-  agentComposeVersionId: z17.string().nullable(),
-  conversationId: z17.string().nullable(),
-  artifactName: z17.string().nullable(),
-  vars: z17.record(z17.string(), z17.string()).nullable(),
-  secretNames: z17.array(z17.string()).nullable(),
-  volumeVersions: z17.record(z17.string(), z17.string()).nullable(),
-  createdAt: z17.string(),
-  updatedAt: z17.string()
+var sessionResponseSchema = z18.object({
+  id: z18.string(),
+  agentComposeId: z18.string(),
+  agentComposeVersionId: z18.string().nullable(),
+  conversationId: z18.string().nullable(),
+  artifactName: z18.string().nullable(),
+  vars: z18.record(z18.string(), z18.string()).nullable(),
+  secretNames: z18.array(z18.string()).nullable(),
+  volumeVersions: z18.record(z18.string(), z18.string()).nullable(),
+  createdAt: z18.string(),
+  updatedAt: z18.string()
 });
-var agentComposeSnapshotSchema = z17.object({
-  agentComposeVersionId: z17.string(),
-  vars: z17.record(z17.string(), z17.string()).optional(),
-  secretNames: z17.array(z17.string()).optional()
+var agentComposeSnapshotSchema = z18.object({
+  agentComposeVersionId: z18.string(),
+  vars: z18.record(z18.string(), z18.string()).optional(),
+  secretNames: z18.array(z18.string()).optional()
 });
-var artifactSnapshotSchema2 = z17.object({
-  artifactName: z17.string(),
-  artifactVersion: z17.string()
+var artifactSnapshotSchema2 = z18.object({
+  artifactName: z18.string(),
+  artifactVersion: z18.string()
 });
-var volumeVersionsSnapshotSchema2 = z17.object({
-  versions: z17.record(z17.string(), z17.string())
+var volumeVersionsSnapshotSchema2 = z18.object({
+  versions: z18.record(z18.string(), z18.string())
 });
-var checkpointResponseSchema = z17.object({
-  id: z17.string(),
-  runId: z17.string(),
-  conversationId: z17.string(),
+var checkpointResponseSchema = z18.object({
+  id: z18.string(),
+  runId: z18.string(),
+  conversationId: z18.string(),
   agentComposeSnapshot: agentComposeSnapshotSchema,
   artifactSnapshot: artifactSnapshotSchema2.nullable(),
   volumeVersionsSnapshot: volumeVersionsSnapshotSchema2.nullable(),
-  createdAt: z17.string()
+  createdAt: z18.string()
 });
 var sessionsByIdContract = c12.router({
   /**
@@ -7158,8 +7301,8 @@ var sessionsByIdContract = c12.router({
     method: "GET",
     path: "/api/agent/sessions/:id",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      id: z17.string().min(1, "Session ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Session ID is required")
     }),
     responses: {
       200: sessionResponseSchema,
@@ -7179,8 +7322,8 @@ var checkpointsByIdContract = c12.router({
     method: "GET",
     path: "/api/agent/checkpoints/:id",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      id: z17.string().min(1, "Checkpoint ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Checkpoint ID is required")
     }),
     responses: {
       200: checkpointResponseSchema,
@@ -7193,88 +7336,88 @@ var checkpointsByIdContract = c12.router({
 });
 
 // ../../packages/core/src/contracts/schedules.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 var c13 = initContract();
-var scheduleTriggerSchema = z18.object({
-  cron: z18.string().optional(),
-  at: z18.string().optional(),
-  timezone: z18.string().default("UTC")
+var scheduleTriggerSchema = z19.object({
+  cron: z19.string().optional(),
+  at: z19.string().optional(),
+  timezone: z19.string().default("UTC")
 }).refine((data) => data.cron && !data.at || !data.cron && data.at, {
   message: "Exactly one of 'cron' or 'at' must be specified"
 });
-var scheduleRunConfigSchema = z18.object({
-  agent: z18.string().min(1, "Agent reference required"),
-  prompt: z18.string().min(1, "Prompt required"),
-  vars: z18.record(z18.string(), z18.string()).optional(),
-  secrets: z18.record(z18.string(), z18.string()).optional(),
-  artifactName: z18.string().optional(),
-  artifactVersion: z18.string().optional(),
-  volumeVersions: z18.record(z18.string(), z18.string()).optional()
+var scheduleRunConfigSchema = z19.object({
+  agent: z19.string().min(1, "Agent reference required"),
+  prompt: z19.string().min(1, "Prompt required"),
+  vars: z19.record(z19.string(), z19.string()).optional(),
+  secrets: z19.record(z19.string(), z19.string()).optional(),
+  artifactName: z19.string().optional(),
+  artifactVersion: z19.string().optional(),
+  volumeVersions: z19.record(z19.string(), z19.string()).optional()
 });
-var scheduleDefinitionSchema = z18.object({
+var scheduleDefinitionSchema = z19.object({
   on: scheduleTriggerSchema,
   run: scheduleRunConfigSchema
 });
-var scheduleYamlSchema = z18.object({
-  version: z18.literal("1.0"),
-  schedules: z18.record(z18.string(), scheduleDefinitionSchema)
-});
-var deployScheduleRequestSchema = z18.object({
-  name: z18.string().min(1).max(64, "Schedule name max 64 chars"),
-  cronExpression: z18.string().optional(),
-  atTime: z18.string().optional(),
-  timezone: z18.string().default("UTC"),
-  prompt: z18.string().min(1, "Prompt required"),
-  vars: z18.record(z18.string(), z18.string()).optional(),
-  secrets: z18.record(z18.string(), z18.string()).optional(),
-  artifactName: z18.string().optional(),
-  artifactVersion: z18.string().optional(),
-  volumeVersions: z18.record(z18.string(), z18.string()).optional(),
+var scheduleYamlSchema = z19.object({
+  version: z19.literal("1.0"),
+  schedules: z19.record(z19.string(), scheduleDefinitionSchema)
+});
+var deployScheduleRequestSchema = z19.object({
+  name: z19.string().min(1).max(64, "Schedule name max 64 chars"),
+  cronExpression: z19.string().optional(),
+  atTime: z19.string().optional(),
+  timezone: z19.string().default("UTC"),
+  prompt: z19.string().min(1, "Prompt required"),
+  vars: z19.record(z19.string(), z19.string()).optional(),
+  secrets: z19.record(z19.string(), z19.string()).optional(),
+  artifactName: z19.string().optional(),
+  artifactVersion: z19.string().optional(),
+  volumeVersions: z19.record(z19.string(), z19.string()).optional(),
   // Resolved agent compose ID (CLI resolves scope/name:version → composeId)
-  composeId: z18.string().uuid("Invalid compose ID")
+  composeId: z19.string().uuid("Invalid compose ID")
 }).refine(
   (data) => data.cronExpression && !data.atTime || !data.cronExpression && data.atTime,
   {
     message: "Exactly one of 'cronExpression' or 'atTime' must be specified"
   }
 );
-var scheduleResponseSchema = z18.object({
-  id: z18.string().uuid(),
-  composeId: z18.string().uuid(),
-  composeName: z18.string(),
-  scopeSlug: z18.string(),
-  name: z18.string(),
-  cronExpression: z18.string().nullable(),
-  atTime: z18.string().nullable(),
-  timezone: z18.string(),
-  prompt: z18.string(),
-  vars: z18.record(z18.string(), z18.string()).nullable(),
+var scheduleResponseSchema = z19.object({
+  id: z19.string().uuid(),
+  composeId: z19.string().uuid(),
+  composeName: z19.string(),
+  scopeSlug: z19.string(),
+  name: z19.string(),
+  cronExpression: z19.string().nullable(),
+  atTime: z19.string().nullable(),
+  timezone: z19.string(),
+  prompt: z19.string(),
+  vars: z19.record(z19.string(), z19.string()).nullable(),
   // Secret names only (values are never returned)
-  secretNames: z18.array(z18.string()).nullable(),
-  artifactName: z18.string().nullable(),
-  artifactVersion: z18.string().nullable(),
-  volumeVersions: z18.record(z18.string(), z18.string()).nullable(),
-  enabled: z18.boolean(),
-  nextRunAt: z18.string().nullable(),
-  createdAt: z18.string(),
-  updatedAt: z18.string()
-});
-var runSummarySchema = z18.object({
-  id: z18.string().uuid(),
-  status: z18.enum(["pending", "running", "completed", "failed", "timeout"]),
-  createdAt: z18.string(),
-  completedAt: z18.string().nullable(),
-  error: z18.string().nullable()
-});
-var scheduleRunsResponseSchema = z18.object({
-  runs: z18.array(runSummarySchema)
-});
-var scheduleListResponseSchema = z18.object({
-  schedules: z18.array(scheduleResponseSchema)
-});
-var deployScheduleResponseSchema = z18.object({
+  secretNames: z19.array(z19.string()).nullable(),
+  artifactName: z19.string().nullable(),
+  artifactVersion: z19.string().nullable(),
+  volumeVersions: z19.record(z19.string(), z19.string()).nullable(),
+  enabled: z19.boolean(),
+  nextRunAt: z19.string().nullable(),
+  createdAt: z19.string(),
+  updatedAt: z19.string()
+});
+var runSummarySchema = z19.object({
+  id: z19.string().uuid(),
+  status: z19.enum(["pending", "running", "completed", "failed", "timeout"]),
+  createdAt: z19.string(),
+  completedAt: z19.string().nullable(),
+  error: z19.string().nullable()
+});
+var scheduleRunsResponseSchema = z19.object({
+  runs: z19.array(runSummarySchema)
+});
+var scheduleListResponseSchema = z19.object({
+  schedules: z19.array(scheduleResponseSchema)
+});
+var deployScheduleResponseSchema = z19.object({
   schedule: scheduleResponseSchema,
-  created: z18.boolean()
+  created: z19.boolean()
   // true if created, false if updated
 });
 var schedulesMainContract = c13.router({
@@ -7324,11 +7467,11 @@ var schedulesByNameContract = c13.router({
     method: "GET",
     path: "/api/agent/schedules/:name",
     headers: authHeadersSchema,
-    pathParams: z18.object({
-      name: z18.string().min(1, "Schedule name required")
+    pathParams: z19.object({
+      name: z19.string().min(1, "Schedule name required")
     }),
-    query: z18.object({
-      composeId: z18.string().uuid("Compose ID required")
+    query: z19.object({
+      composeId: z19.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -7345,14 +7488,14 @@ var schedulesByNameContract = c13.router({
     method: "DELETE",
     path: "/api/agent/schedules/:name",
     headers: authHeadersSchema,
-    pathParams: z18.object({
-      name: z18.string().min(1, "Schedule name required")
+    pathParams: z19.object({
+      name: z19.string().min(1, "Schedule name required")
     }),
-    query: z18.object({
-      composeId: z18.string().uuid("Compose ID required")
+    query: z19.object({
+      composeId: z19.string().uuid("Compose ID required")
     }),
     responses: {
-      204: z18.undefined(),
+      204: z19.undefined(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
@@ -7368,11 +7511,11 @@ var schedulesEnableContract = c13.router({
     method: "POST",
     path: "/api/agent/schedules/:name/enable",
     headers: authHeadersSchema,
-    pathParams: z18.object({
-      name: z18.string().min(1, "Schedule name required")
+    pathParams: z19.object({
+      name: z19.string().min(1, "Schedule name required")
     }),
-    body: z18.object({
-      composeId: z18.string().uuid("Compose ID required")
+    body: z19.object({
+      composeId: z19.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -7389,11 +7532,11 @@ var schedulesEnableContract = c13.router({
     method: "POST",
     path: "/api/agent/schedules/:name/disable",
     headers: authHeadersSchema,
-    pathParams: z18.object({
-      name: z18.string().min(1, "Schedule name required")
+    pathParams: z19.object({
+      name: z19.string().min(1, "Schedule name required")
     }),
-    body: z18.object({
-      composeId: z18.string().uuid("Compose ID required")
+    body: z19.object({
+      composeId: z19.string().uuid("Compose ID required")
     }),
     responses: {
       200: scheduleResponseSchema,
@@ -7412,12 +7555,12 @@ var scheduleRunsContract = c13.router({
     method: "GET",
     path: "/api/agent/schedules/:name/runs",
     headers: authHeadersSchema,
-    pathParams: z18.object({
-      name: z18.string().min(1, "Schedule name required")
+    pathParams: z19.object({
+      name: z19.string().min(1, "Schedule name required")
     }),
-    query: z18.object({
-      composeId: z18.string().uuid("Compose ID required"),
-      limit: z18.coerce.number().min(0).max(100).default(5)
+    query: z19.object({
+      composeId: z19.string().uuid("Compose ID required"),
+      limit: z19.coerce.number().min(0).max(100).default(5)
     }),
     responses: {
       200: scheduleRunsResponseSchema,
@@ -7429,16 +7572,16 @@ var scheduleRunsContract = c13.router({
 });
 
 // ../../packages/core/src/contracts/realtime.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 var c14 = initContract();
-var ablyTokenRequestSchema = z19.object({
-  keyName: z19.string(),
-  ttl: z19.number().optional(),
-  timestamp: z19.number(),
-  capability: z19.string(),
-  clientId: z19.string().optional(),
-  nonce: z19.string(),
-  mac: z19.string()
+var ablyTokenRequestSchema = z20.object({
+  keyName: z20.string(),
+  ttl: z20.number().optional(),
+  timestamp: z20.number(),
+  capability: z20.string(),
+  clientId: z20.string().optional(),
+  nonce: z20.string(),
+  mac: z20.string()
 });
 var realtimeTokenContract = c14.router({
   /**
@@ -7449,8 +7592,8 @@ var realtimeTokenContract = c14.router({
     method: "POST",
     path: "/api/realtime/token",
     headers: authHeadersSchema,
-    body: z19.object({
-      runId: z19.string().uuid("runId must be a valid UUID")
+    body: z20.object({
+      runId: z20.string().uuid("runId must be a valid UUID")
     }),
     responses: {
       200: ablyTokenRequestSchema,
@@ -7462,13 +7605,34 @@ var realtimeTokenContract = c14.router({
     summary: "Get Ably token for run event subscription"
   }
 });
+var runnerRealtimeTokenContract = c14.router({
+  /**
+   * POST /api/runners/realtime/token
+   * Get an Ably token to subscribe to a runner group's job notification channel
+   */
+  create: {
+    method: "POST",
+    path: "/api/runners/realtime/token",
+    headers: authHeadersSchema,
+    body: z20.object({
+      group: runnerGroupSchema
+    }),
+    responses: {
+      200: ablyTokenRequestSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Get Ably token for runner group job notifications"
+  }
+});
 
 // ../../packages/core/src/contracts/platform.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 
 // ../../packages/core/src/contracts/public/common.ts
-import { z as z20 } from "zod";
-var publicApiErrorTypeSchema = z20.enum([
+import { z as z21 } from "zod";
+var publicApiErrorTypeSchema = z21.enum([
   "api_error",
   // Internal server error (5xx)
   "invalid_request_error",
@@ -7482,40 +7646,40 @@ var publicApiErrorTypeSchema = z20.enum([
   "rate_limit_error"
   // Rate limit exceeded (429)
 ]);
-var publicApiErrorSchema = z20.object({
-  error: z20.object({
+var publicApiErrorSchema = z21.object({
+  error: z21.object({
     type: publicApiErrorTypeSchema,
-    code: z20.string(),
-    message: z20.string(),
-    param: z20.string().optional(),
-    docUrl: z20.string().url().optional()
+    code: z21.string(),
+    message: z21.string(),
+    param: z21.string().optional(),
+    docUrl: z21.string().url().optional()
   })
 });
-var paginationSchema = z20.object({
-  hasMore: z20.boolean(),
-  nextCursor: z20.string().nullable()
+var paginationSchema = z21.object({
+  hasMore: z21.boolean(),
+  nextCursor: z21.string().nullable()
 });
 function createPaginatedResponseSchema(dataSchema) {
-  return z20.object({
-    data: z20.array(dataSchema),
+  return z21.object({
+    data: z21.array(dataSchema),
     pagination: paginationSchema
   });
 }
-var listQuerySchema = z20.object({
-  cursor: z20.string().optional(),
-  limit: z20.coerce.number().min(1).max(100).default(20)
+var listQuerySchema = z21.object({
+  cursor: z21.string().optional(),
+  limit: z21.coerce.number().min(1).max(100).default(20)
 });
-var requestIdSchema = z20.string().uuid();
-var timestampSchema = z20.string().datetime();
+var requestIdSchema = z21.string().uuid();
+var timestampSchema = z21.string().datetime();
 
 // ../../packages/core/src/contracts/platform.ts
 var c15 = initContract();
-var platformPaginationSchema = z21.object({
-  hasMore: z21.boolean(),
-  nextCursor: z21.string().nullable(),
-  totalPages: z21.number()
+var platformPaginationSchema = z22.object({
+  hasMore: z22.boolean(),
+  nextCursor: z22.string().nullable(),
+  totalPages: z22.number()
 });
-var platformLogStatusSchema = z21.enum([
+var platformLogStatusSchema = z22.enum([
   "pending",
   "running",
   "completed",
@@ -7523,28 +7687,28 @@ var platformLogStatusSchema = z21.enum([
   "timeout",
   "cancelled"
 ]);
-var platformLogEntrySchema = z21.object({
-  id: z21.string().uuid()
+var platformLogEntrySchema = z22.object({
+  id: z22.string().uuid()
 });
-var platformLogsListResponseSchema = z21.object({
-  data: z21.array(platformLogEntrySchema),
+var platformLogsListResponseSchema = z22.object({
+  data: z22.array(platformLogEntrySchema),
   pagination: platformPaginationSchema
 });
-var artifactSchema = z21.object({
-  name: z21.string().nullable(),
-  version: z21.string().nullable()
+var artifactSchema = z22.object({
+  name: z22.string().nullable(),
+  version: z22.string().nullable()
 });
-var platformLogDetailSchema = z21.object({
-  id: z21.string().uuid(),
-  sessionId: z21.string().nullable(),
-  agentName: z21.string(),
-  framework: z21.string().nullable(),
+var platformLogDetailSchema = z22.object({
+  id: z22.string().uuid(),
+  sessionId: z22.string().nullable(),
+  agentName: z22.string(),
+  framework: z22.string().nullable(),
   status: platformLogStatusSchema,
-  prompt: z21.string(),
-  error: z21.string().nullable(),
-  createdAt: z21.string(),
-  startedAt: z21.string().nullable(),
-  completedAt: z21.string().nullable(),
+  prompt: z22.string(),
+  error: z22.string().nullable(),
+  createdAt: z22.string(),
+  startedAt: z22.string().nullable(),
+  completedAt: z22.string().nullable(),
   artifact: artifactSchema
 });
 var platformLogsListContract = c15.router({
@@ -7552,7 +7716,7 @@ var platformLogsListContract = c15.router({
     method: "GET",
     path: "/api/platform/logs",
     query: listQuerySchema.extend({
-      search: z21.string().optional()
+      search: z22.string().optional()
     }),
     responses: {
       200: platformLogsListResponseSchema,
@@ -7565,8 +7729,8 @@ var platformLogsByIdContract = c15.router({
   getById: {
     method: "GET",
     path: "/api/platform/logs/:id",
-    pathParams: z21.object({
-      id: z21.string().uuid("Invalid log ID")
+    pathParams: z22.object({
+      id: z22.string().uuid("Invalid log ID")
     }),
     responses: {
       200: platformLogDetailSchema,
@@ -7576,17 +7740,17 @@ var platformLogsByIdContract = c15.router({
     summary: "Get agent run log details by ID"
   }
 });
-var artifactDownloadResponseSchema = z21.object({
-  url: z21.string().url(),
-  expiresAt: z21.string()
+var artifactDownloadResponseSchema = z22.object({
+  url: z22.string().url(),
+  expiresAt: z22.string()
 });
 var platformArtifactDownloadContract = c15.router({
   getDownloadUrl: {
     method: "GET",
     path: "/api/platform/artifacts/download",
-    query: z21.object({
-      name: z21.string().min(1, "Artifact name is required"),
-      version: z21.string().optional()
+    query: z22.object({
+      name: z22.string().min(1, "Artifact name is required"),
+      version: z22.string().optional()
     }),
     responses: {
       200: artifactDownloadResponseSchema,
@@ -7598,26 +7762,26 @@ var platformArtifactDownloadContract = c15.router({
 });
 
 // ../../packages/core/src/contracts/public/agents.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 var c16 = initContract();
-var publicAgentSchema = z22.object({
-  id: z22.string(),
-  name: z22.string(),
-  currentVersionId: z22.string().nullable(),
+var publicAgentSchema = z23.object({
+  id: z23.string(),
+  name: z23.string(),
+  currentVersionId: z23.string().nullable(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var agentVersionSchema = z22.object({
-  id: z22.string(),
-  agentId: z22.string(),
-  versionNumber: z22.number(),
+var agentVersionSchema = z23.object({
+  id: z23.string(),
+  agentId: z23.string(),
+  versionNumber: z23.number(),
   createdAt: timestampSchema
 });
 var publicAgentDetailSchema = publicAgentSchema;
 var paginatedAgentsSchema = createPaginatedResponseSchema(publicAgentSchema);
 var paginatedAgentVersionsSchema = createPaginatedResponseSchema(agentVersionSchema);
 var agentListQuerySchema = listQuerySchema.extend({
-  name: z22.string().optional()
+  name: z23.string().optional()
 });
 var publicAgentsListContract = c16.router({
   list: {
@@ -7639,8 +7803,8 @@ var publicAgentByIdContract = c16.router({
     method: "GET",
     path: "/v1/agents/:id",
     headers: authHeadersSchema,
-    pathParams: z22.object({
-      id: z22.string().min(1, "Agent ID is required")
+    pathParams: z23.object({
+      id: z23.string().min(1, "Agent ID is required")
     }),
     responses: {
       200: publicAgentDetailSchema,
@@ -7657,8 +7821,8 @@ var publicAgentVersionsContract = c16.router({
     method: "GET",
     path: "/v1/agents/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z22.object({
-      id: z22.string().min(1, "Agent ID is required")
+    pathParams: z23.object({
+      id: z23.string().min(1, "Agent ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -7673,9 +7837,9 @@ var publicAgentVersionsContract = c16.router({
 });
 
 // ../../packages/core/src/contracts/public/runs.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 var c17 = initContract();
-var publicRunStatusSchema = z23.enum([
+var publicRunStatusSchema = z24.enum([
   "pending",
   "running",
   "completed",
@@ -7683,48 +7847,48 @@ var publicRunStatusSchema = z23.enum([
   "timeout",
   "cancelled"
 ]);
-var publicRunSchema = z23.object({
-  id: z23.string(),
-  agentId: z23.string(),
-  agentName: z23.string(),
+var publicRunSchema = z24.object({
+  id: z24.string(),
+  agentId: z24.string(),
+  agentName: z24.string(),
   status: publicRunStatusSchema,
-  prompt: z23.string(),
+  prompt: z24.string(),
   createdAt: timestampSchema,
   startedAt: timestampSchema.nullable(),
   completedAt: timestampSchema.nullable()
 });
 var publicRunDetailSchema = publicRunSchema.extend({
-  error: z23.string().nullable(),
-  executionTimeMs: z23.number().nullable(),
-  checkpointId: z23.string().nullable(),
-  sessionId: z23.string().nullable(),
-  artifactName: z23.string().nullable(),
-  artifactVersion: z23.string().nullable(),
-  volumes: z23.record(z23.string(), z23.string()).optional()
+  error: z24.string().nullable(),
+  executionTimeMs: z24.number().nullable(),
+  checkpointId: z24.string().nullable(),
+  sessionId: z24.string().nullable(),
+  artifactName: z24.string().nullable(),
+  artifactVersion: z24.string().nullable(),
+  volumes: z24.record(z24.string(), z24.string()).optional()
 });
 var paginatedRunsSchema = createPaginatedResponseSchema(publicRunSchema);
-var createRunRequestSchema = z23.object({
+var createRunRequestSchema = z24.object({
   // Agent identification (one of: agent, agentId, sessionId, checkpointId)
-  agent: z23.string().optional(),
+  agent: z24.string().optional(),
   // Agent name
-  agentId: z23.string().optional(),
+  agentId: z24.string().optional(),
   // Agent ID
-  agentVersion: z23.string().optional(),
+  agentVersion: z24.string().optional(),
   // Version specifier (e.g., "latest", "v1", specific ID)
   // Continue session
-  sessionId: z23.string().optional(),
+  sessionId: z24.string().optional(),
   // Resume from checkpoint
-  checkpointId: z23.string().optional(),
+  checkpointId: z24.string().optional(),
   // Required
-  prompt: z23.string().min(1, "Prompt is required"),
+  prompt: z24.string().min(1, "Prompt is required"),
   // Optional configuration
-  variables: z23.record(z23.string(), z23.string()).optional(),
-  secrets: z23.record(z23.string(), z23.string()).optional(),
-  artifactName: z23.string().optional(),
+  variables: z24.record(z24.string(), z24.string()).optional(),
+  secrets: z24.record(z24.string(), z24.string()).optional(),
+  artifactName: z24.string().optional(),
   // Artifact name to mount
-  artifactVersion: z23.string().optional(),
+  artifactVersion: z24.string().optional(),
   // Artifact version (defaults to latest)
-  volumes: z23.record(z23.string(), z23.string()).optional()
+  volumes: z24.record(z24.string(), z24.string()).optional()
   // volume_name -> version
 });
 var runListQuerySchema = listQuerySchema.extend({
@@ -7767,8 +7931,8 @@ var publicRunByIdContract = c17.router({
     method: "GET",
     path: "/v1/runs/:id",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
     responses: {
       200: publicRunDetailSchema,
@@ -7785,10 +7949,10 @@ var publicRunCancelContract = c17.router({
     method: "POST",
     path: "/v1/runs/:id/cancel",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
-    body: z23.undefined(),
+    body: z24.undefined(),
     responses: {
       200: publicRunDetailSchema,
       400: publicApiErrorSchema,
@@ -7801,27 +7965,27 @@ var publicRunCancelContract = c17.router({
     description: "Cancel a pending or running execution"
   }
 });
-var logEntrySchema = z23.object({
+var logEntrySchema = z24.object({
   timestamp: timestampSchema,
-  type: z23.enum(["agent", "system", "network"]),
-  level: z23.enum(["debug", "info", "warn", "error"]),
-  message: z23.string(),
-  metadata: z23.record(z23.string(), z23.unknown()).optional()
+  type: z24.enum(["agent", "system", "network"]),
+  level: z24.enum(["debug", "info", "warn", "error"]),
+  message: z24.string(),
+  metadata: z24.record(z24.string(), z24.unknown()).optional()
 });
 var paginatedLogsSchema = createPaginatedResponseSchema(logEntrySchema);
 var logsQuerySchema = listQuerySchema.extend({
-  type: z23.enum(["agent", "system", "network", "all"]).default("all"),
+  type: z24.enum(["agent", "system", "network", "all"]).default("all"),
   since: timestampSchema.optional(),
   until: timestampSchema.optional(),
-  order: z23.enum(["asc", "desc"]).default("asc")
+  order: z24.enum(["asc", "desc"]).default("asc")
 });
 var publicRunLogsContract = c17.router({
   getLogs: {
     method: "GET",
     path: "/v1/runs/:id/logs",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
     query: logsQuerySchema,
     responses: {
@@ -7834,21 +7998,21 @@ var publicRunLogsContract = c17.router({
     description: "Get unified logs for a run. Combines agent, system, and network logs."
   }
 });
-var metricPointSchema = z23.object({
+var metricPointSchema = z24.object({
   timestamp: timestampSchema,
-  cpuPercent: z23.number(),
-  memoryUsedMb: z23.number(),
-  memoryTotalMb: z23.number(),
-  diskUsedMb: z23.number(),
-  diskTotalMb: z23.number()
-});
-var metricsSummarySchema = z23.object({
-  avgCpuPercent: z23.number(),
-  maxMemoryUsedMb: z23.number(),
-  totalDurationMs: z23.number().nullable()
-});
-var metricsResponseSchema2 = z23.object({
-  data: z23.array(metricPointSchema),
+  cpuPercent: z24.number(),
+  memoryUsedMb: z24.number(),
+  memoryTotalMb: z24.number(),
+  diskUsedMb: z24.number(),
+  diskTotalMb: z24.number()
+});
+var metricsSummarySchema = z24.object({
+  avgCpuPercent: z24.number(),
+  maxMemoryUsedMb: z24.number(),
+  totalDurationMs: z24.number().nullable()
+});
+var metricsResponseSchema2 = z24.object({
+  data: z24.array(metricPointSchema),
   summary: metricsSummarySchema
 });
 var publicRunMetricsContract = c17.router({
@@ -7856,8 +8020,8 @@ var publicRunMetricsContract = c17.router({
     method: "GET",
     path: "/v1/runs/:id/metrics",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
     responses: {
       200: metricsResponseSchema2,
@@ -7869,7 +8033,7 @@ var publicRunMetricsContract = c17.router({
     description: "Get CPU, memory, and disk metrics for a run"
   }
 });
-var sseEventTypeSchema = z23.enum([
+var sseEventTypeSchema = z24.enum([
   "status",
   // Run status change
   "output",
@@ -7881,10 +8045,10 @@ var sseEventTypeSchema = z23.enum([
   "heartbeat"
   // Keep-alive
 ]);
-var sseEventSchema = z23.object({
+var sseEventSchema = z24.object({
   event: sseEventTypeSchema,
-  data: z23.unknown(),
-  id: z23.string().optional()
+  data: z24.unknown(),
+  id: z24.string().optional()
   // For Last-Event-ID reconnection
 });
 var publicRunEventsContract = c17.router({
@@ -7892,15 +8056,15 @@ var publicRunEventsContract = c17.router({
     method: "GET",
     path: "/v1/runs/:id/events",
     headers: authHeadersSchema,
-    pathParams: z23.object({
-      id: z23.string().min(1, "Run ID is required")
+    pathParams: z24.object({
+      id: z24.string().min(1, "Run ID is required")
     }),
-    query: z23.object({
-      lastEventId: z23.string().optional()
+    query: z24.object({
+      lastEventId: z24.string().optional()
       // For reconnection
     }),
     responses: {
-      200: z23.any(),
+      200: z24.any(),
       // SSE stream - actual content is text/event-stream
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -7912,28 +8076,28 @@ var publicRunEventsContract = c17.router({
 });
 
 // ../../packages/core/src/contracts/public/artifacts.ts
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 var c18 = initContract();
-var publicArtifactSchema = z24.object({
-  id: z24.string(),
-  name: z24.string(),
-  currentVersionId: z24.string().nullable(),
-  size: z24.number(),
+var publicArtifactSchema = z25.object({
+  id: z25.string(),
+  name: z25.string(),
+  currentVersionId: z25.string().nullable(),
+  size: z25.number(),
   // Total size in bytes
-  fileCount: z24.number(),
+  fileCount: z25.number(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var artifactVersionSchema = z24.object({
-  id: z24.string(),
+var artifactVersionSchema = z25.object({
+  id: z25.string(),
   // SHA-256 content hash
-  artifactId: z24.string(),
-  size: z24.number(),
+  artifactId: z25.string(),
+  size: z25.number(),
   // Size in bytes
-  fileCount: z24.number(),
-  message: z24.string().nullable(),
+  fileCount: z25.number(),
+  message: z25.string().nullable(),
   // Optional commit message
-  createdBy: z24.string(),
+  createdBy: z25.string(),
   createdAt: timestampSchema
 });
 var publicArtifactDetailSchema = publicArtifactSchema.extend({
@@ -7963,8 +8127,8 @@ var publicArtifactByIdContract = c18.router({
     method: "GET",
     path: "/v1/artifacts/:id",
     headers: authHeadersSchema,
-    pathParams: z24.object({
-      id: z24.string().min(1, "Artifact ID is required")
+    pathParams: z25.object({
+      id: z25.string().min(1, "Artifact ID is required")
     }),
     responses: {
       200: publicArtifactDetailSchema,
@@ -7981,8 +8145,8 @@ var publicArtifactVersionsContract = c18.router({
     method: "GET",
     path: "/v1/artifacts/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z24.object({
-      id: z24.string().min(1, "Artifact ID is required")
+    pathParams: z25.object({
+      id: z25.string().min(1, "Artifact ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -8000,15 +8164,15 @@ var publicArtifactDownloadContract = c18.router({
     method: "GET",
     path: "/v1/artifacts/:id/download",
     headers: authHeadersSchema,
-    pathParams: z24.object({
-      id: z24.string().min(1, "Artifact ID is required")
+    pathParams: z25.object({
+      id: z25.string().min(1, "Artifact ID is required")
     }),
-    query: z24.object({
-      versionId: z24.string().optional()
+    query: z25.object({
+      versionId: z25.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z24.undefined(),
+      302: z25.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -8020,28 +8184,28 @@ var publicArtifactDownloadContract = c18.router({
 });
 
 // ../../packages/core/src/contracts/public/volumes.ts
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 var c19 = initContract();
-var publicVolumeSchema = z25.object({
-  id: z25.string(),
-  name: z25.string(),
-  currentVersionId: z25.string().nullable(),
-  size: z25.number(),
+var publicVolumeSchema = z26.object({
+  id: z26.string(),
+  name: z26.string(),
+  currentVersionId: z26.string().nullable(),
+  size: z26.number(),
   // Total size in bytes
-  fileCount: z25.number(),
+  fileCount: z26.number(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema
 });
-var volumeVersionSchema = z25.object({
-  id: z25.string(),
+var volumeVersionSchema = z26.object({
+  id: z26.string(),
   // SHA-256 content hash
-  volumeId: z25.string(),
-  size: z25.number(),
+  volumeId: z26.string(),
+  size: z26.number(),
   // Size in bytes
-  fileCount: z25.number(),
-  message: z25.string().nullable(),
+  fileCount: z26.number(),
+  message: z26.string().nullable(),
   // Optional commit message
-  createdBy: z25.string(),
+  createdBy: z26.string(),
   createdAt: timestampSchema
 });
 var publicVolumeDetailSchema = publicVolumeSchema.extend({
@@ -8069,8 +8233,8 @@ var publicVolumeByIdContract = c19.router({
     method: "GET",
     path: "/v1/volumes/:id",
     headers: authHeadersSchema,
-    pathParams: z25.object({
-      id: z25.string().min(1, "Volume ID is required")
+    pathParams: z26.object({
+      id: z26.string().min(1, "Volume ID is required")
     }),
     responses: {
       200: publicVolumeDetailSchema,
@@ -8087,8 +8251,8 @@ var publicVolumeVersionsContract = c19.router({
     method: "GET",
     path: "/v1/volumes/:id/versions",
     headers: authHeadersSchema,
-    pathParams: z25.object({
-      id: z25.string().min(1, "Volume ID is required")
+    pathParams: z26.object({
+      id: z26.string().min(1, "Volume ID is required")
     }),
     query: listQuerySchema,
     responses: {
@@ -8106,15 +8270,15 @@ var publicVolumeDownloadContract = c19.router({
     method: "GET",
     path: "/v1/volumes/:id/download",
     headers: authHeadersSchema,
-    pathParams: z25.object({
-      id: z25.string().min(1, "Volume ID is required")
+    pathParams: z26.object({
+      id: z26.string().min(1, "Volume ID is required")
     }),
-    query: z25.object({
-      versionId: z25.string().optional()
+    query: z26.object({
+      versionId: z26.string().optional()
       // Defaults to current version
     }),
     responses: {
-      302: z25.undefined(),
+      302: z26.undefined(),
       // Redirect to presigned URL
       401: publicApiErrorSchema,
       404: publicApiErrorSchema,
@@ -9172,6 +9336,7 @@ function buildEnvironmentVariables(context, apiUrl) {
     VM0_API_TOKEN: context.sandboxToken,
     VM0_PROMPT: context.prompt,
     VM0_WORKING_DIR: context.workingDir,
+    VM0_API_START_TIME: context.apiStartTime?.toString() ?? "",
     CLI_AGENT_TYPE: context.cliAgentType || "claude-code"
   };
   const vercelBypass = process.env.VERCEL_AUTOMATION_BYPASS_SECRET;
@@ -9743,18 +9908,27 @@ function setupSignalHandlers(state, handlers) {
       );
       state.mode = "draining";
       handlers.updateStatus();
+      handlers.onDrain();
     }
   });
 }
 
 // src/lib/runner/runner.ts
-var Runner = class {
+var Runner = class _Runner {
   config;
   statusFilePath;
   state;
   resources = null;
-  running = true;
   updateStatus;
+  // Ably subscription
+  subscription = null;
+  // Queue for jobs received while at capacity (max 100 to prevent unbounded growth)
+  static MAX_PENDING_QUEUE_SIZE = 100;
+  pendingJobs = [];
+  // Polling fallback interval
+  pollInterval = null;
+  // Shutdown coordination
+  resolveShutdown = null;
   constructor(config, statusFilePath) {
     this.config = config;
     this.statusFilePath = statusFilePath;
@@ -9768,9 +9942,19 @@ var Runner = class {
   }
   async start() {
     this.resources = await setupEnvironment({ config: this.config });
+    const shutdownPromise = new Promise((resolve) => {
+      this.resolveShutdown = resolve;
+    });
     setupSignalHandlers(this.state, {
       onShutdown: () => {
-        this.running = false;
+        this.resolveShutdown?.();
+      },
+      onDrain: () => {
+        this.pendingJobs.length = 0;
+        if (this.state.activeRuns.size === 0) {
+          console.log("[Maintenance] No active jobs, exiting immediately");
+          this.resolveShutdown?.();
+        }
       },
       updateStatus: this.updateStatus
     });
@@ -9782,7 +9966,36 @@ var Runner = class {
     console.log("Press Ctrl+C to stop");
     console.log("");
     this.updateStatus();
-    await this.runMainLoop();
+    console.log("Checking for pending jobs...");
+    await this.pollFallback();
+    console.log("Connecting to realtime job notifications...");
+    this.subscription = await subscribeToJobs(
+      this.config.server,
+      this.config.group,
+      (notification) => {
+        console.log(`Ably notification: ${notification.runId}`);
+        this.processJob(notification.runId).catch(console.error);
+      },
+      (connectionState, reason) => {
+        console.log(
+          `Ably connection: ${connectionState}${reason ? ` (${reason})` : ""}`
+        );
+      }
+    );
+    console.log("Connected to realtime job notifications");
+    this.pollInterval = setInterval(() => {
+      this.pollFallback().catch(console.error);
+    }, this.config.sandbox.poll_interval_ms);
+    console.log(
+      `Polling fallback enabled (every ${this.config.sandbox.poll_interval_ms / 1e3}s)`
+    );
+    await shutdownPromise;
+    if (this.pollInterval) {
+      clearInterval(this.pollInterval);
+    }
+    if (this.subscription) {
+      this.subscription.cleanup();
+    }
     if (this.state.jobPromises.size > 0) {
       console.log(
         `Waiting for ${this.state.jobPromises.size} active job(s) to complete...`
@@ -9795,50 +10008,52 @@ var Runner = class {
     console.log("Runner stopped");
     process.exit(0);
   }
-  async runMainLoop() {
-    while (this.running) {
-      if (this.state.mode === "draining") {
-        if (this.state.activeRuns.size === 0) {
-          console.log("[Maintenance] All jobs completed, exiting drain mode");
-          this.running = false;
-          break;
-        }
-        if (this.state.jobPromises.size > 0) {
-          await Promise.race(this.state.jobPromises);
-          this.updateStatus();
-        }
-        continue;
-      }
-      if (this.state.activeRuns.size >= this.config.sandbox.max_concurrent) {
-        if (this.state.jobPromises.size > 0) {
-          await Promise.race(this.state.jobPromises);
-          this.updateStatus();
-        }
-        continue;
-      }
-      try {
-        const job = await withRunnerTiming(
-          "poll",
-          () => pollForJob(this.config.server, this.config.group)
-        );
-        if (!job) {
-          await new Promise(
-            (resolve) => setTimeout(resolve, this.config.sandbox.poll_interval_ms)
-          );
-          continue;
-        }
-        console.log(`Found job: ${job.runId}`);
+  /**
+   * Poll for jobs as fallback mechanism.
+   * Catches jobs that may have been missed by push notifications.
+   */
+  async pollFallback() {
+    if (this.state.mode !== "running") return;
+    if (this.state.activeRuns.size >= this.config.sandbox.max_concurrent)
+      return;
+    try {
+      const job = await withRunnerTiming(
+        "poll",
+        () => pollForJob(this.config.server, this.config.group)
+      );
+      if (job) {
+        console.log(`Poll fallback found job: ${job.runId}`);
         await this.processJob(job.runId);
-      } catch (error) {
-        console.error(
-          "Polling error:",
-          error instanceof Error ? error.message : "Unknown error"
-        );
-        await new Promise((resolve) => setTimeout(resolve, 2e3));
       }
+    } catch (error) {
+      console.error(
+        `Poll fallback error:`,
+        error instanceof Error ? error.message : "Unknown error"
+      );
     }
   }
+  /**
+   * Process a job notification - claim and execute.
+   */
   async processJob(runId) {
+    if (this.state.mode !== "running") {
+      console.log(`Not running (${this.state.mode}), ignoring job ${runId}`);
+      return;
+    }
+    if (this.state.activeRuns.has(runId)) {
+      return;
+    }
+    if (this.state.activeRuns.size >= this.config.sandbox.max_concurrent) {
+      if (!this.pendingJobs.includes(runId) && this.pendingJobs.length < _Runner.MAX_PENDING_QUEUE_SIZE) {
+        console.log(`At capacity, queueing job ${runId}`);
+        this.pendingJobs.push(runId);
+      } else if (this.pendingJobs.length >= _Runner.MAX_PENDING_QUEUE_SIZE) {
+        console.log(
+          `Pending queue full (${_Runner.MAX_PENDING_QUEUE_SIZE}), dropping job ${runId}`
+        );
+      }
+      return;
+    }
     try {
       const context = await withRunnerTiming(
         "claim",
@@ -9856,6 +10071,17 @@ var Runner = class {
         this.state.activeRuns.delete(context.runId);
         this.state.jobPromises.delete(jobPromise);
         this.updateStatus();
+        if (this.state.mode === "draining" && this.state.activeRuns.size === 0) {
+          console.log("[Maintenance] All jobs completed, exiting");
+          this.resolveShutdown?.();
+          return;
+        }
+        if (this.pendingJobs.length > 0 && this.state.mode === "running") {
+          const nextJob = this.pendingJobs.shift();
+          if (nextJob) {
+            this.processJob(nextJob).catch(console.error);
+          }
+        }
       });
       this.state.jobPromises.add(jobPromise);
     } catch (error) {
@@ -10494,7 +10720,7 @@ var benchmarkCommand = new Command4("benchmark").description(
 });
 
 // src/index.ts
-var version = true ? "3.3.2" : "0.1.0";
+var version = true ? "3.5.0" : "0.1.0";
 program.name("vm0-runner").version(version).description("Self-hosted runner for VM0 agents");
 program.addCommand(startCommand);
 program.addCommand(doctorCommand);