@wjarka/cezarion 0.14.8 → 0.14.9-dev.1009

package/dist/contract/index.js

@@ -1,58 +1,103 @@
 // ../contract/src/events.ts
-import { z as z4 } from "zod";
+import { z as z9 } from "zod";
 
 // ../contract/src/conversations.ts
+import { z as z2 } from "zod";
+
+// ../contract/src/ask-schema.ts
 import { z } from "zod";
-var conversationAttributionSchema = z.object({
-  senderRunId: z.uuid(),
-  recipientRunId: z.uuid(),
-  kind: z.enum(["request", "progress", "follow-up", "reply"]),
-  requestId: z.uuid().optional()
+var askOptionSchema = z.object({
+  label: z.string().min(1).max(60),
+  description: z.string().max(280).optional()
+}).strict();
+var askQuestionSchema = z.object({
+  /** Stable key for the answer; defaults to the array index when omitted. */
+  id: z.string().min(1).max(64).optional(),
+  /** ≤12-char chip label (matches AskUserQuestion's `header`). */
+  header: z.string().min(1).max(12),
+  question: z.string().min(1).max(400),
+  options: z.array(askOptionSchema).min(2).max(4).refine((opts) => new Set(opts.map((o) => o.label)).size === opts.length, {
+    message: "option labels must be unique within a question"
+  }),
+  multiSelect: z.boolean().optional()
+}).strict();
+var askRequestSchema = z.object({
+  questions: z.array(askQuestionSchema).min(1).max(4).refine((qs) => new Set(qs.map((q) => q.question)).size === qs.length, {
+    message: "question texts must be unique"
+  })
+}).strict();
+
+// ../contract/src/conversations.ts
+var conversationAttributionSchema = z2.object({
+  senderRunId: z2.uuid(),
+  recipientRunId: z2.uuid(),
+  kind: z2.enum(["request", "progress", "follow-up", "reply"]),
+  requestId: z2.uuid().optional()
 }).strict();
 var conversationMessageSchema = conversationAttributionSchema.extend({
-  id: z.uuid(),
-  text: z.string().min(1).max(1e5),
-  createdAt: z.iso.datetime(),
-  deadline: z.iso.datetime().optional(),
-  requestHash: z.string().regex(/^[0-9a-f]{64}$/),
-  state: z.enum(["accepted", "continuation-required", "destroyed", "late"]),
+  id: z2.uuid(),
+  text: z2.string().min(1).max(1e5),
+  createdAt: z2.iso.datetime(),
+  deadline: z2.iso.datetime().optional(),
+  requestHash: z2.string().regex(/^[0-9a-f]{64}$/),
+  state: z2.enum(["accepted", "continuation-required", "destroyed", "late"]),
   /** A parent-authorized new execution; retained on exact message retries. */
-  resumed: z.literal(true).optional(),
-  instruction: z.string().max(2048).optional()
-});
-var requestOutcomeSchema = z.object({
-  requestId: z.uuid(),
-  status: z.enum(["replied", "completed-without-reply", "failed", "cancelled", "destroyed", "timed-out", "sender-closed"]),
-  observedAt: z.iso.datetime(),
-  replyId: z.uuid().optional()
+  resumed: z2.literal(true).optional(),
+  instruction: z2.string().max(2048).optional(),
+  /** A worker's question routed to its parent (#505): answered only by a reply naming it. */
+  question: askRequestSchema.optional()
+});
+var requestOutcomeSchema = z2.object({
+  requestId: z2.uuid(),
+  status: z2.enum(["replied", "completed-without-reply", "failed", "cancelled", "destroyed", "timed-out", "sender-closed", "human-fallback"]),
+  observedAt: z2.iso.datetime(),
+  replyId: z2.uuid().optional()
 }).strict();
-var conversationStateSchema = z.object({ messages: z.array(conversationMessageSchema).max(1024), outcomes: z.array(requestOutcomeSchema).max(1024) }).strict();
-var conversationSendRequestSchema = z.object({
-  id: z.uuid(),
-  recipientRunId: z.uuid(),
+var conversationStateSchema = z2.object({ messages: z2.array(conversationMessageSchema).max(1024), outcomes: z2.array(requestOutcomeSchema).max(1024) }).strict();
+var conversationInspectResultSchema = conversationStateSchema.extend({ hint: z2.string().optional() });
+var inboxReserveResultSchema = z2.object({
+  messages: z2.array(conversationMessageSchema).max(32),
+  outcomes: z2.array(requestOutcomeSchema).max(32),
+  receiptId: z2.uuid().optional(),
+  expiresAt: z2.iso.datetime().optional()
+}).strict().refine(
+  (value) => value.messages.length > 0 ? value.receiptId !== void 0 && value.expiresAt !== void 0 : value.receiptId === void 0 && value.expiresAt === void 0,
+  { message: "A nonempty inbox batch requires a receipt and expiry" }
+);
+var inboxReceiptRequestSchema = z2.object({ receiptId: z2.uuid() }).strict();
+var inboxReceiptResultSchema = z2.object({
+  receiptId: z2.uuid(),
+  status: z2.enum(["acknowledged", "already-acknowledged", "released"])
+}).strict();
+var conversationSendRequestSchema = z2.object({
+  id: z2.uuid(),
+  recipientRunId: z2.uuid(),
   kind: conversationAttributionSchema.shape.kind,
-  requestId: z.uuid().optional(),
-  text: z.string().min(1).max(1e5).refine((text) => text.trim().length > 0),
-  timeoutSeconds: z.number().int().min(1).max(1800).default(600),
-  resume: z.boolean().optional()
+  requestId: z2.uuid().optional(),
+  text: z2.string().min(1).max(1e5).refine((text) => text.trim().length > 0),
+  timeoutSeconds: z2.number().int().min(1).max(1800).default(600),
+  resume: z2.boolean().optional()
 }).strict().refine((value) => (value.kind === "reply" || value.kind === "follow-up") === (value.requestId !== void 0), { message: "Replies and follow-ups require a request ID; new messages must omit it" }).refine((value) => !value.resume || value.kind === "request" || value.kind === "progress", { message: "--resume requires a new request or progress instruction" });
-var conversationSendResultSchema = z.object({ message: conversationMessageSchema, delivery: z.enum(["queued", "delivered", "not-delivered"]), outcome: requestOutcomeSchema.optional() }).strict();
-var conversationInspectRequestSchema = z.object({ recipientRunId: z.uuid() }).strict();
-var conversationCancelRequestSchema = z.object({ requestId: z.uuid() }).strict();
-var requestWaitRequestSchema = z.object({
-  requestIds: z.array(z.uuid()).min(1).max(32).refine((ids) => new Set(ids).size === ids.length),
-  mode: z.enum(["one", "any", "all"]).optional(),
-  timeoutSeconds: z.number().int().min(1).max(1800).default(600)
+var conversationSendResultSchema = z2.object({ message: conversationMessageSchema, delivery: z2.enum(["queued", "delivered", "consumed", "not-delivered"]), outcome: requestOutcomeSchema.optional() }).strict();
+var conversationInspectRequestSchema = z2.object({ recipientRunId: z2.uuid() }).strict();
+var conversationCancelRequestSchema = z2.object({ requestId: z2.uuid() }).strict();
+var requestWaitRequestSchema = z2.object({
+  requestIds: z2.array(z2.uuid()).min(1).max(32).refine((ids) => new Set(ids).size === ids.length),
+  mode: z2.enum(["one", "any", "all"]).optional(),
+  timeoutSeconds: z2.number().int().min(1).max(1800).default(600)
 }).strict().refine((value) => value.mode !== "one" || value.requestIds.length === 1, { message: "one requires exactly one request" });
 
-// ../contract/src/delegation.ts
-import { z as z3 } from "zod";
+// ../contract/src/discovery.ts
+import { z as z7 } from "zod";
+
+// ../contract/src/workspace.ts
+import { z as z6 } from "zod";
 
 // ../contract/src/effort.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 var EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
-var effortLevelSchema = z2.enum(EFFORT_LEVELS);
-var effortFieldSchema = z2.string().max(32).optional();
+var effortLevelSchema = z3.enum(EFFORT_LEVELS);
+var effortFieldSchema = z3.string().max(32).optional();
 function parseEffort(value) {
   const trimmed = value?.trim().toLowerCase();
   if (!trimmed || trimmed === "auto") return void 0;
@@ -60,163 +105,599 @@ function parseEffort(value) {
   return parsed.success ? parsed.data : void 0;
 }
 
+// ../contract/src/health.ts
+import { z as z5 } from "zod";
+
+// ../contract/src/application-update.ts
+import { z as z4 } from "zod";
+var applicationUpdateStateSchema = z4.object({
+  status: z4.enum(["idle", "preparing", "ready", "restarting", "error"]),
+  supported: z4.boolean(),
+  targetVersion: z4.string().optional(),
+  message: z4.string().optional()
+});
+var applicationUpdateInputSchema = z4.record(z4.string(), z4.never());
+var applicationUpdateResponseSchema = z4.object({ state: applicationUpdateStateSchema });
+
+// ../contract/src/health.ts
+var runnerSchema = z5.enum(["claude", "codex", "opencode", "pi", "cursor"]);
+var repoInfoSchema = z5.object({
+  root: z5.string(),
+  branch: z5.string(),
+  remote: z5.string().optional()
+});
+var backendCheckSchema = z5.object({
+  name: z5.enum(["claude", "codex", "opencode", "pi", "cursor", "gh", "git"]),
+  available: z5.boolean(),
+  version: z5.string().optional(),
+  hint: z5.string().optional()
+});
+var forgeInfoSchema = z5.object({
+  kind: z5.literal("github"),
+  /**
+   * Whether the forge is reachable — **absent until the availability probe has warmed**.
+   *
+   * Health must never pay a `gh` shell-out, so it serves whatever the cache holds. Absent means
+   * "not determined yet", which is not the same as `false`, and the cockpit renders the two
+   * differently. Declaring it required is what made an earlier hand-written mirror wrong.
+   */
+  available: z5.boolean().optional(),
+  reason: z5.string().optional()
+});
+var capabilitiesSchema = z5.object({
+  localHandoff: z5.boolean(),
+  followups: z5.boolean(),
+  singleProject: z5.boolean(),
+  /**
+   * `true` means `CEZ_AUTOMATIONS=1` opted this server into GitHub automations (#801). Off — the
+   * default — the whole feature is absent: no `Automations` nav item anywhere it is rendered, the
+   * `/api/v1/…/automations*` family answers `409`, and the workspace scheduler never polls GitHub.
+   *
+   * REQUIRED for the same reason as `tokenMetrics` below: this server always sends it.
+   */
+  automations: z5.boolean(),
+  /**
+   * `false` means `CEZ_HIDE_TOKEN_METRICS=1` asks the browser to omit token counts and monetary
+   * cost (#481). The telemetry itself still rides in run/event payloads — this is presentation
+   * only.
+   *
+   * REQUIRED, because this server always sends it (`capabilities.ts` computes it from the env on
+   * every read) and this contract describes THIS server's wire. The DTO it replaces declared it
+   * optional so a newer cockpit could read an OLDER server, which is version skew a contract
+   * versioned in lockstep with the server cannot model. That tolerance lives where it belongs, in
+   * `web/src/lib/token-metrics.ts`, whose `!== false` read still treats an absent field as
+   * visible.
+   */
+  tokenMetrics: z5.boolean(),
+  /** Current token-count presentation policy. Required on current servers;
+   * older payload tolerance belongs in the browser resolver. */
+  tokenUsageMetrics: z5.boolean(),
+  /** Current backend-reported-cost presentation policy. */
+  costMetrics: z5.boolean()
+});
+var healthResponseSchema = z5.object({
+  version: z5.string(),
+  latestVersion: z5.string().optional(),
+  repoRoot: z5.string(),
+  repo: repoInfoSchema.nullable(),
+  checks: z5.array(backendCheckSchema),
+  defaultRunner: runnerSchema,
+  forge: forgeInfoSchema.nullable(),
+  capabilities: capabilitiesSchema,
+  // Always sent: `workspaceSummary()` returns both unconditionally, and an unreadable workspace
+  // degrades to `projects: []` rather than to an absent key. The hand-written DTO declared them
+  // optional, which was wider than the server has ever been.
+  projects: z5.array(z5.object({ id: z5.string(), name: z5.string() })),
+  bootProject: z5.string(),
+  applicationUpdate: applicationUpdateStateSchema.optional()
+});
+
+// ../contract/src/workspace.ts
+var workspaceConfigResponseSchema = z6.object({
+  /** Root exposed by the Add-project directory browser — stored as written (`~` kept). */
+  browseRoot: z6.string(),
+  /** Checkout root for GUI-cloned projects — stored as written (`~` kept). */
+  projectsDir: z6.string(),
+  /** Stored override; `null` means inherit `CEZ_SKILLS_AUTO_UPDATE`, then true. */
+  skillsAutoUpdate: z6.boolean().nullable(),
+  effectiveSkillsAutoUpdate: z6.boolean(),
+  composerDefaults: z6.object({
+    autonomous: z6.boolean().nullable(),
+    worktree: z6.boolean().nullable(),
+    /** `'source-dependent'` when no `CEZ_AUTONOMOUS_DEFAULT` pins it either way. */
+    inheritedAutonomous: z6.union([z6.boolean(), z6.literal("source-dependent")]),
+    inheritedWorktree: z6.boolean()
+  }),
+  resources: z6.object({
+    maxParallel: z6.number(),
+    maxMonitoringSessions: z6.number(),
+    monitoringWakeIntervalMinutes: z6.number().nullable(),
+    /** Resume a run a provider usage limit stopped, once the limit resets. Default `true`. */
+    autoResumeOnUsageLimit: z6.boolean(),
+    memoryLimitMb: z6.number().nullable(),
+    worktreeRetentionDefault: z6.number()
+  }),
+  /**
+   * What a repo that has set none of its own runs (spec 2026-07-29-agent-profiles).
+   *
+   * Both keys are OPTIONAL on the wire, and that is load-bearing rather than lax: absent means
+   * "this machine has no opinion, the built-in default applies", and it has to stay distinguishable
+   * from a value someone chose or the fallback collapses into "always claude". Consulted only where
+   * the repo's own `.ai/cezar/config.json` is silent — a repo that chose is never overruled.
+   */
+  agentDefaults: z6.object({
+    runner: runnerSchema.optional(),
+    models: z6.object({
+      claude: z6.string().optional(),
+      codex: z6.string().optional(),
+      opencode: z6.string().optional(),
+      pi: z6.string().optional(),
+      cursor: z6.string().optional()
+    }).optional()
+  })
+});
+var setWorkspaceConfigInputSchema = z6.object({
+  browseRoot: z6.string().trim().min(1).max(4096).optional(),
+  projectsDir: z6.string().trim().min(1).max(4096).optional(),
+  skillsAutoUpdate: z6.boolean().nullable().optional(),
+  composerDefaults: z6.object({
+    autonomous: z6.boolean().nullable().optional(),
+    worktree: z6.boolean().nullable().optional()
+  }).optional(),
+  /** Machine-wide agent defaults. `null` on a key CLEARS it back to "no opinion", which a bare
+   *  absent key cannot say in a partial patch. */
+  agentDefaults: z6.object({
+    runner: runnerSchema.nullable().optional(),
+    models: z6.object({
+      claude: z6.string().trim().min(1).max(200).nullable().optional(),
+      codex: z6.string().trim().min(1).max(200).nullable().optional(),
+      opencode: z6.string().trim().min(1).max(200).nullable().optional(),
+      pi: z6.string().trim().min(1).max(200).nullable().optional(),
+      cursor: z6.string().trim().min(1).max(200).nullable().optional()
+    }).optional()
+  }).optional(),
+  resources: z6.object({
+    maxParallel: z6.number().int().min(1).max(16).optional(),
+    maxMonitoringSessions: z6.number().int().min(0).max(16).optional(),
+    monitoringWakeIntervalMinutes: z6.number().int().min(1).max(60).nullable().optional(),
+    autoResumeOnUsageLimit: z6.boolean().optional(),
+    memoryLimitMb: z6.number().int().min(0).max(1048576).nullable().optional(),
+    worktreeRetentionDefault: z6.number().int().min(0).max(1e3).optional()
+  }).optional()
+});
+var appearanceSchema = z6.object({
+  accent: z6.enum(["cezarion", "lime", "violet"]).optional(),
+  density: z6.enum(["comfortable", "compact", "ultra"]).optional(),
+  width: z6.enum(["narrow", "wide"]).optional()
+});
+var taskTableUiStateSchema = z6.looseObject({
+  /** Explicit user choices only. Missing ids keep the registry-owned default. */
+  expandedColumns: z6.record(z6.string(), z6.boolean()).optional()
+});
+var uiStateSchema = z6.looseObject({
+  /** What the last started run used. `null` is a VALUE, not an absence: it records a run that
+   *  chose neither a skill nor a workflow (the plain built-in `quick-task`), which the composer
+   *  can now express since the source picker grew an empty state. Absent still means "no
+   *  run has been recorded here" — a cockpit reading either one selects nothing. */
+  lastTask: z6.object({ source: z6.enum(["workflow", "skill"]), ref: z6.string() }).nullable().optional(),
+  /** Most-recently-run sources, newest first (deduped, capped). Feeds the composer picker's
+   *  recency sort. */
+  recentSources: z6.array(z6.object({ source: z6.enum(["workflow", "skill"]), ref: z6.string() })).optional(),
+  /** The last worktree choice for a single-skill run. Absent → the default (isolated worktree). */
+  lastWorktree: z6.boolean().optional(),
+  /** The last autonomous choice — remembered like `lastWorktree`. Absent → off. */
+  lastAutonomous: z6.boolean().optional(),
+  /** Whether new runs should ask agents to append follow-up work. Absent → on. */
+  lastGenerateFollowups: z6.boolean().optional(),
+  /** Skill selection frequency (#408): name → times chosen, across BOTH composers. */
+  skillUsage: z6.record(z6.string(), z6.number()).optional(),
+  runsView: z6.enum(["list", "table"]).optional(),
+  /** The GitHub tab's last-selected sub-tab (#417). Absent → issues. */
+  githubView: z6.enum(["issues", "prs"]).optional(),
+  /** Settings → Appearance. The theme itself stays in localStorage (`cez-theme`) — it must
+   *  pre-paint, and it is per-browser by design. */
+  appearance: appearanceSchema.optional(),
+  /** Follow-up prompt templates (#413). Absent → the built-in defaults; present (even `[]`) is
+   *  the user's own edited list. `skills` are the skill names the template auto-applies for. */
+  promptTemplates: z6.array(
+    z6.object({
+      id: z6.string(),
+      label: z6.string(),
+      text: z6.string(),
+      skills: z6.array(z6.string()).optional()
+    })
+  ).optional(),
+  /** The open-mercato/skills promo banner (#391), dismissed for good. Legacy — the banner is
+   *  gone, replaced by `WorkspaceUiState.importedSkills`; retained so old files round-trip. */
+  dismissedSkillsBanner: z6.boolean().optional()
+});
+var workspaceLastLocationSchema = z6.strictObject({
+  projectId: z6.string().min(1).max(64),
+  pathname: z6.string().min(1).max(2048).startsWith("/p/"),
+  search: z6.string().max(4096).startsWith("?").optional(),
+  hash: z6.string().max(2048).startsWith("#").optional()
+});
+var workspaceUiStateSchema = z6.looseObject({
+  /** LEGACY — the sidebar's per-project collapse map (step 3.3). Still accepted and still
+   *  round-tripped so an older cockpit sharing this home keeps working, but the current cockpit
+   *  neither reads nor writes it: which groups are shut describes the WINDOW, not the workspace,
+   *  so it lives in that browser's localStorage (`packages/web/src/lib/sidebar-collapse.ts`).
+   *  One shared answer meant a phone collapsing a group collapsed it on the desktop too. */
+  sidebar: z6.looseObject({ collapsed: z6.record(z6.string(), z6.boolean()).optional() }).optional(),
+  /** Dismissed runtime-auth incident IDs, keyed by provider. An ID is only dismissed until the
+   *  provider reports a different incident, so this stays workspace-global with the browser
+   *  rather than one project checkout. */
+  dismissedProviderAuthFailures: z6.object({
+    claude: z6.string().optional(),
+    codex: z6.string().optional(),
+    opencode: z6.string().optional(),
+    pi: z6.string().optional(),
+    cursor: z6.string().optional()
+  }).optional(),
+  /** Settings → Appearance, GLOBAL since step 3.5: accent + density describe the person at the
+   *  keyboard, not a repo. */
+  appearance: appearanceSchema.optional(),
+  /** Settings → Notifications, GLOBAL since step 3.5 — one answer for the whole workspace, since
+   *  the delivering browser is one browser whichever project you are looking at. */
+  notifications: z6.looseObject({ enabled: z6.boolean().optional() }).optional(),
+  /** Desktop Tasks-table density, shared across every project in this workspace. */
+  taskTable: taskTableUiStateSchema.optional(),
+  /** LEGACY, exactly like `sidebar` above — the last settled project-scoped page, restored when
+   *  entering at the exact bare root. The shape is unchanged and still accepted, but the current
+   *  cockpit keeps it in localStorage (`packages/web/src/lib/last-location.ts`): stored here, the
+   *  last client to navigate decided where every OTHER client's next launch landed. */
+  lastLocation: workspaceLastLocationSchema.optional(),
+  /** The user's curated selection of default (vendor) skills. Tri-state: ABSENT means "not
+   *  curated", so every default skill shows; a PRESENT array (even `[]`) means only those names
+   *  show from that repo. */
+  importedSkills: z6.array(z6.string()).optional()
+});
+var WORKSPACE_UI_STATE_MAX_KEYS = 200;
+var TASK_TABLE_MAX_COLUMNS = 50;
+var setWorkspaceUiStateInputSchema = z6.looseObject({
+  ...workspaceUiStateSchema.shape,
+  sidebar: z6.looseObject({
+    collapsed: z6.record(z6.string().min(1).max(64), z6.boolean()).refine((map) => Object.keys(map).length <= WORKSPACE_UI_STATE_MAX_KEYS, {
+      message: `sidebar.collapsed must have at most ${WORKSPACE_UI_STATE_MAX_KEYS} entries`
+    }).optional()
+  }).optional(),
+  dismissedProviderAuthFailures: z6.strictObject({
+    claude: z6.string().min(1).max(128).optional(),
+    codex: z6.string().min(1).max(128).optional(),
+    opencode: z6.string().min(1).max(128).optional(),
+    pi: z6.string().min(1).max(128).optional(),
+    cursor: z6.string().min(1).max(128).optional()
+  }).optional(),
+  importedSkills: z6.array(z6.string().min(1).max(200)).max(WORKSPACE_UI_STATE_MAX_KEYS).optional(),
+  taskTable: taskTableUiStateSchema.extend({
+    expandedColumns: z6.record(z6.string().min(1).max(64), z6.boolean()).refine((map) => Object.keys(map).length <= TASK_TABLE_MAX_COLUMNS, {
+      message: `taskTable.expandedColumns must have at most ${TASK_TABLE_MAX_COLUMNS} entries`
+    }).optional()
+  }).optional()
+}).superRefine((data, ctx) => {
+  if (Object.keys(data).length > WORKSPACE_UI_STATE_MAX_KEYS) {
+    ctx.addIssue({
+      code: "custom",
+      message: `ui-state has too many keys (max ${WORKSPACE_UI_STATE_MAX_KEYS})`
+    });
+  }
+});
+var runnerModelsSchema = z6.object({
+  claude: z6.string().optional(),
+  codex: z6.string().optional(),
+  opencode: z6.string().optional(),
+  pi: z6.string().optional(),
+  cursor: z6.string().optional()
+});
+var configResponseSchema = z6.object({
+  baseBranch: z6.string().nullable(),
+  defaultRunner: runnerSchema,
+  systemPrompt: z6.string().nullable(),
+  defaultModels: runnerModelsSchema,
+  /** True when native coding-agent settings are authoritative and model picks are read-only. */
+  modelsLocked: z6.boolean(),
+  /** How many tasks run at once (1–16). */
+  maxParallel: z6.number(),
+  /** Per-task memory ceiling in MiB (whole process tree); null = no limit. */
+  memoryLimitMb: z6.number().nullable(),
+  /** Keep the last N finished worktrees on disk (#483); 0 = unlimited. Older ones are reclaimed
+   *  (directory only — branch kept, so work is recoverable). */
+  worktreeRetention: z6.number(),
+  /** Live title updates: null = no config key, the `CEZ_TITLE_UPDATES` env default (ON) decides. */
+  liveTitleUpdates: z6.boolean().nullable(),
+  /** Optional review gate (#489): null = no config key, the `CEZ_REVIEW_GATE` env default (OFF)
+   *  decides. */
+  reviewGate: z6.boolean().nullable()
+});
+var setConfigResponseSchema = configResponseSchema;
+var setConfigInputSchema = z6.object({
+  baseBranch: z6.string().trim().min(1).max(200).nullable().optional(),
+  defaultRunner: runnerSchema.optional(),
+  systemPrompt: z6.string().trim().max(2e4).nullable().optional(),
+  defaultModels: z6.object({
+    claude: z6.string().trim().max(200).nullable().optional(),
+    codex: z6.string().trim().max(200).nullable().optional(),
+    opencode: z6.string().trim().max(200).nullable().optional(),
+    pi: z6.string().trim().max(200).nullable().optional(),
+    cursor: z6.string().trim().max(200).nullable().optional()
+  }).optional(),
+  maxParallel: z6.number().int().min(1).max(16).optional(),
+  /** null or 0 clears the ceiling back to "no limit". */
+  memoryLimitMb: z6.number().int().min(0).max(1048576).nullable().optional(),
+  /** Keep last N finished worktrees (#483); 0 = unlimited, null clears back to the default (10). */
+  worktreeRetention: z6.number().int().min(0).max(1e3).nullable().optional(),
+  /** null clears the key back to the env-default behavior. */
+  liveTitleUpdates: z6.boolean().nullable().optional(),
+  /** null clears the key back to the env-default behavior (OFF). */
+  reviewGate: z6.boolean().nullable().optional()
+});
+var skillsUpdateStatusSchema = z6.enum([
+  "idle",
+  "checking",
+  "available",
+  "updating",
+  "current",
+  "unavailable",
+  "error"
+]);
+var skillsUpdateScopeStateSchema = z6.object({
+  scope: z6.enum(["project", "global"]),
+  status: skillsUpdateStatusSchema,
+  available: z6.boolean(),
+  skills: z6.array(z6.string()),
+  checkedAt: z6.string().nullable(),
+  updatedAt: z6.string().nullable(),
+  reason: z6.string().optional()
+});
+var skillsUpdateStateSchema = z6.object({
+  status: skillsUpdateStatusSchema,
+  available: z6.boolean(),
+  autoUpdateEnabled: z6.boolean(),
+  inherited: z6.boolean(),
+  checkedAt: z6.string().nullable(),
+  updatedAt: z6.string().nullable(),
+  scopes: z6.array(skillsUpdateScopeStateSchema),
+  needsUpgradeNotes: z6.boolean()
+});
+var providerIdSchema = runnerSchema;
+var providerConnectionStateSchema = z6.enum([
+  "connected",
+  "disconnected",
+  "not-installed",
+  "unknown"
+]);
+var providerStatusSchema = z6.object({
+  provider: providerIdSchema,
+  status: providerConnectionStateSchema,
+  enabled: z6.boolean().optional(),
+  hint: z6.string().optional(),
+  authFailureId: z6.string().optional(),
+  /** Which agent account this row describes (spec 2026-07-29-agent-profiles). ABSENT on
+   *  `GET /api/v1/providers/status`, which deliberately keeps answering exactly one row per
+   *  provider — the discovered default — so an older client sees no change at all. Per-account
+   *  rows are carried by `GET /api/v1/workspace/agent-profiles` instead. */
+  profileId: z6.string().optional()
+});
+var providerStatusResponseSchema = z6.object({
+  providers: z6.array(providerStatusSchema)
+});
+var providerConnectResponseSchema = z6.discriminatedUnion("opened", [
+  z6.object({ opened: z6.literal(true), command: z6.string() }),
+  z6.object({ opened: z6.literal(false), connected: z6.literal(true), command: z6.string() })
+]);
+var modelDiscoveryRunnerSchema = z6.enum(["claude", "codex", "opencode", "pi", "cursor"]);
+var MODEL_DISCOVERY_RUNNERS = modelDiscoveryRunnerSchema.options;
+function runnerDiscoversModels(runner) {
+  return MODEL_DISCOVERY_RUNNERS.includes(runner);
+}
+var runnerModelOptionSchema = z6.object({
+  id: z6.string(),
+  label: z6.string(),
+  description: z6.string(),
+  effortLevels: z6.array(effortLevelSchema).optional()
+});
+var runnerModelCatalogResponseSchema = z6.object({
+  runner: runnerSchema,
+  models: z6.array(runnerModelOptionSchema),
+  source: z6.enum(["live", "cache", "unavailable"]),
+  stale: z6.boolean(),
+  reason: z6.string().optional()
+});
+var openTargetSchema = z6.object({
+  id: z6.string(),
+  label: z6.string(),
+  /** A stable icon key (#361) the UI maps to a concrete icon. Optional: an older server omitting
+   *  it just renders the generic fallback icon. */
+  icon: z6.string().optional()
+});
+var openTargetsResponseSchema = z6.object({
+  targets: z6.array(openTargetSchema)
+});
+var openProjectInSchema = z6.object({
+  // A short bound (#429): matched against a downstream allowlist, so an app id is never long.
+  target: z6.string().trim().min(1, "target required").max(200)
+});
+var openProjectInResponseSchema = z6.object({
+  opened: z6.literal(true),
+  path: z6.string()
+});
+
+// ../contract/src/discovery.ts
+var discoveryRequestSchema = z7.discriminatedUnion("kind", [
+  z7.object({ kind: z7.literal("runners") }).strict(),
+  z7.object({ kind: z7.literal("models"), runner: modelDiscoveryRunnerSchema }).strict()
+]);
+var discoveredRunnerSchema = providerStatusSchema.omit({ provider: true, profileId: true }).extend({ runner: modelDiscoveryRunnerSchema });
+var discoveredRunnersSchema = z7.object({
+  scope: z7.literal("host-default-account"),
+  runners: z7.array(discoveredRunnerSchema)
+});
+var discoveryResponseSchema = z7.union([discoveredRunnersSchema, runnerModelCatalogResponseSchema]);
+var modelChoicesSchema = z7.object({
+  runner: modelDiscoveryRunnerSchema,
+  requestedModel: z7.string(),
+  availableModels: z7.array(runnerModelOptionSchema),
+  otherRunners: z7.array(modelDiscoveryRunnerSchema)
+});
+
 // ../contract/src/delegation.ts
-var workerOperationSchema = z3.enum(["spawn", "inspect", "steer", "stop", "destroy", "diff", "wait"]);
-var commitShaSchema = z3.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/);
-var requestHashSchema = z3.string().regex(/^[0-9a-f]{64}$/);
-var workerIdsSchema = z3.array(z3.uuid()).min(1).max(32).refine((ids) => new Set(ids).size === ids.length);
-var permissionsSchema = z3.array(workerOperationSchema).max(7).refine((operations) => new Set(operations).size === operations.length);
-var remainingSchema = z3.array(z3.enum(["process", "worktree", "branch"])).max(3).refine((resources) => new Set(resources).size === resources.length);
-var errorSchema = z3.string().max(2e3);
-var workerWorkspaceSchema = z3.object({
-  ownerRunId: z3.uuid(),
-  resourceId: z3.uuid(),
-  kind: z3.literal("owned-isolated"),
+import { z as z8 } from "zod";
+var workerOperationSchema = z8.enum(["spawn", "inspect", "steer", "stop", "destroy", "diff", "wait"]);
+var commitShaSchema = z8.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/);
+var requestHashSchema = z8.string().regex(/^[0-9a-f]{64}$/);
+var workerIdsSchema = z8.array(z8.uuid()).min(1).max(32).refine((ids) => new Set(ids).size === ids.length);
+var permissionsSchema = z8.array(workerOperationSchema).max(7).refine((operations) => new Set(operations).size === operations.length);
+var remainingSchema = z8.array(z8.enum(["process", "worktree", "branch"])).max(3).refine((resources) => new Set(resources).size === resources.length);
+var errorSchema = z8.string().max(2e3);
+var workerWorkspaceSchema = z8.object({
+  ownerRunId: z8.uuid(),
+  resourceId: z8.uuid(),
+  kind: z8.literal("owned-isolated"),
   /** Canonical creation path and original branch, never inferred from execution cwd. */
-  path: z3.string().min(1),
-  branch: z3.string().min(1),
+  path: z8.string().min(1),
+  branch: z8.string().min(1),
   baselineSha: commitShaSchema
 }).strict();
-var workerOutcomeSchema = z3.object({
-  workerId: z3.uuid(),
-  status: z3.enum(["review", "done", "failed", "cancelled"]),
-  observedAt: z3.iso.datetime(),
-  summary: z3.string().max(4e3).optional(),
-  revision: z3.number().int().nonnegative().optional()
+var workerOutcomeSchema = z8.object({
+  workerId: z8.uuid(),
+  status: z8.enum(["review", "done", "failed", "cancelled"]),
+  observedAt: z8.iso.datetime(),
+  summary: z8.string().max(4e3).optional(),
+  revision: z8.number().int().nonnegative().optional()
 }).strict();
-var workerWaitModeSchema = z3.enum(["one", "any", "all"]);
-var workerWaitSchema = z3.object({
-  id: z3.uuid(),
-  workerIds: z3.array(z3.uuid()).max(32).refine((ids) => new Set(ids).size === ids.length),
-  requestIds: z3.array(z3.uuid()).min(1).max(32).optional(),
-  requestOutcomes: z3.array(requestOutcomeSchema).max(32).optional(),
-  deadline: z3.iso.datetime(),
+var workerWaitModeSchema = z8.enum(["one", "any", "all"]);
+var workerWaitSchema = z8.object({
+  id: z8.uuid(),
+  workerIds: z8.array(z8.uuid()).max(32).refine((ids) => new Set(ids).size === ids.length),
+  requestIds: z8.array(z8.uuid()).min(1).max(32).optional(),
+  requestOutcomes: z8.array(requestOutcomeSchema).max(32).optional(),
+  deadline: z8.iso.datetime(),
   mode: workerWaitModeSchema.optional(),
-  revisions: z3.array(z3.object({ workerId: z3.uuid(), revision: z3.number().int().nonnegative() }).strict()).max(32).optional(),
-  reason: z3.enum(["outcome", "timeout", "cancelled", "message"]).optional(),
-  phase: z3.enum(["registered", "parked", "wake-pending"]),
-  outcomes: z3.array(workerOutcomeSchema).max(32),
-  wakeId: z3.uuid().optional()
+  revisions: z8.array(z8.object({ workerId: z8.uuid(), revision: z8.number().int().nonnegative() }).strict()).max(32).optional(),
+  reason: z8.enum(["outcome", "timeout", "cancelled", "message"]).optional(),
+  phase: z8.enum(["registered", "parked", "wake-pending"]),
+  outcomes: z8.array(workerOutcomeSchema).max(32),
+  wakeId: z8.uuid().optional()
 }).strict();
-var workerDestroySchema = z3.object({
-  requestedAt: z3.iso.datetime(),
-  phase: z3.enum(["requested", "terminating", "cleaning", "complete", "incomplete"]),
+var workerDestroySchema = z8.object({
+  requestedAt: z8.iso.datetime(),
+  phase: z8.enum(["requested", "terminating", "cleaning", "complete", "incomplete"]),
   remaining: remainingSchema,
   error: errorSchema.optional()
 }).strict();
-var workerCreationReceiptSchema = z3.object({
-  requestId: z3.uuid(),
-  workerId: z3.uuid(),
+var workerCreationReceiptSchema = z8.object({
+  requestId: z8.uuid(),
+  workerId: z8.uuid(),
   /** Hash of the original normalized spawn request, NOT the resolved commit or inherited settings. */
   requestHash: requestHashSchema,
-  deletion: z3.object({ phase: z3.enum(["pending", "complete"]), revision: z3.number().int().nonnegative(), resourceId: z3.uuid(), generation: z3.uuid() }).strict().optional()
+  deletion: z8.object({ phase: z8.enum(["pending", "complete"]), revision: z8.number().int().nonnegative(), resourceId: z8.uuid(), generation: z8.uuid() }).strict().optional()
 }).strict();
-var workerBackendSchema = z3.enum(["claude", "codex", "opencode", "pi", "cursor"]);
-var relativeInputPath = z3.string().min(1).max(4096).refine((path) => !/[\\\u0000-\u001f\u007f:]/.test(path) && !path.startsWith("/") && path.split("/").every((part) => part !== "" && part !== "." && part !== ".."));
-var workerContextReferenceSchema = z3.discriminatedUnion("kind", [
-  z3.object({ kind: z3.literal("baseline-file"), path: relativeInputPath }).strict(),
-  z3.object({ kind: z3.literal("parent-attachment"), id: z3.string().min(1).max(255).regex(/^[A-Za-z0-9_-][A-Za-z0-9._-]*$/).refine((id) => !id.includes("..")) }).strict()
+var workerBackendSchema = z8.enum(["claude", "codex", "opencode", "pi", "cursor"]);
+var relativeInputPath = z8.string().min(1).max(4096).refine((path) => !/[\\\u0000-\u001f\u007f:]/.test(path) && !path.startsWith("/") && path.split("/").every((part) => part !== "" && part !== "." && part !== ".."));
+var workerContextReferenceSchema = z8.discriminatedUnion("kind", [
+  z8.object({ kind: z8.literal("baseline-file"), path: relativeInputPath }).strict(),
+  z8.object({ kind: z8.literal("parent-attachment"), id: z8.string().min(1).max(255).regex(/^[A-Za-z0-9_-][A-Za-z0-9._-]*$/).refine((id) => !id.includes("..")) }).strict()
 ]);
-var workerContextSchema = z3.object({
-  text: z3.string().max(1e5).optional(),
-  artifacts: z3.array(workerContextReferenceSchema).max(32).optional()
+var workerContextSchema = z8.object({
+  text: z8.string().max(1e5).optional(),
+  artifacts: z8.array(workerContextReferenceSchema).max(32).optional()
 }).strict();
-var workerInputSchema = z3.object({
+var workerInputSchema = z8.object({
   source: workerContextReferenceSchema,
-  path: z3.string().min(1).max(8192),
+  path: z8.string().min(1).max(8192),
   /** Parent attachment: SHA-256 of copied bytes. Baseline file: SHA-256 of the pinned Git blob ID
    * (the lowercase hexadecimal ID as UTF-8 text), not of file contents. Interpret by source.kind. */
   sha256: requestHashSchema,
-  bytes: z3.number().int().min(0).max(Number.MAX_SAFE_INTEGER)
+  bytes: z8.number().int().min(0).max(Number.MAX_SAFE_INTEGER)
 }).strict();
-var workerInputRecipeSchema = z3.object({
-  text: z3.string().max(1e5).optional(),
-  inputs: z3.array(workerInputSchema).max(32)
+var workerInputRecipeSchema = z8.object({
+  text: z8.string().max(1e5).optional(),
+  inputs: z8.array(workerInputSchema).max(32)
 }).strict();
-var unavailableEvidenceSchema = z3.object({ state: z3.literal("unavailable"), reason: z3.enum(["no-assistant-output", "missing", "unreadable", "unverified"]), detail: errorSchema.optional() }).strict();
-var deletedEvidenceSchema = z3.object({ state: z3.literal("deleted"), reason: z3.literal("missing") }).strict();
-var executionOutcomeSchema = z3.enum(["running", "review-ready", "completed", "failed", "cancelled"]);
-var workerArtifactSchema = z3.discriminatedUnion("state", [
-  z3.object({ state: z3.literal("available"), id: z3.string().max(255), path: z3.string().max(8192) }).strict(),
-  unavailableEvidenceSchema.extend({ id: z3.string().max(255), path: z3.string().max(8192) }),
-  deletedEvidenceSchema.extend({ id: z3.string().max(255), path: z3.string().max(8192) })
+var unavailableEvidenceSchema = z8.object({ state: z8.literal("unavailable"), reason: z8.enum(["no-assistant-output", "missing", "unreadable", "unverified"]), detail: errorSchema.optional() }).strict();
+var deletedEvidenceSchema = z8.object({ state: z8.literal("deleted"), reason: z8.literal("missing") }).strict();
+var executionOutcomeSchema = z8.enum(["running", "review-ready", "completed", "failed", "cancelled"]);
+var workerArtifactSchema = z8.discriminatedUnion("state", [
+  z8.object({ state: z8.literal("available"), id: z8.string().max(255), path: z8.string().max(8192) }).strict(),
+  unavailableEvidenceSchema.extend({ id: z8.string().max(255), path: z8.string().max(8192) }),
+  deletedEvidenceSchema.extend({ id: z8.string().max(255), path: z8.string().max(8192) })
 ]);
-var workerCollectedResultSchema = z3.object({
-  workerId: z3.uuid(),
-  parentRunId: z3.uuid(),
-  revision: z3.number().int().nonnegative(),
-  observedAt: z3.iso.datetime(),
-  status: z3.enum(["queued", "running", "waiting", "review", "done", "failed", "cancelled"]),
-  outcome: z3.enum(["running", "review-ready", "completed", "failed", "cancelled", "destroyed"]),
+var workerCollectedResultSchema = z8.object({
+  workerId: z8.uuid(),
+  parentRunId: z8.uuid(),
+  revision: z8.number().int().nonnegative(),
+  observedAt: z8.iso.datetime(),
+  status: z8.enum(["queued", "running", "waiting", "review", "done", "failed", "cancelled"]),
+  outcome: z8.enum(["running", "review-ready", "completed", "failed", "cancelled", "destroyed"]),
   lastExecutionOutcome: executionOutcomeSchema,
-  partial: z3.boolean(),
-  settled: z3.boolean(),
+  partial: z8.boolean(),
+  settled: z8.boolean(),
   error: errorSchema.optional(),
   backend: workerBackendSchema.optional(),
-  model: z3.string().max(512).optional(),
+  model: z8.string().max(512).optional(),
   baselineSha: commitShaSchema,
-  workspace: workerWorkspaceSchema.extend({ state: z3.enum(["available", "unavailable", "deleted"]).optional() }),
-  cleanup: z3.enum(["retained", "requested", "terminating", "cleaning", "complete", "incomplete"]),
-  summary: z3.discriminatedUnion("state", [
-    z3.object({ state: z3.literal("available"), text: z3.string().min(1).max(4e3), source: z3.literal("assistant"), seq: z3.number().int().nonnegative(), truncated: z3.boolean() }).strict(),
+  workspace: workerWorkspaceSchema.extend({ state: z8.enum(["available", "unavailable", "deleted"]).optional() }),
+  cleanup: z8.enum(["retained", "requested", "terminating", "cleaning", "complete", "incomplete"]),
+  summary: z8.discriminatedUnion("state", [
+    z8.object({ state: z8.literal("available"), text: z8.string().min(1).max(4e3), source: z8.literal("assistant"), seq: z8.number().int().nonnegative(), truncated: z8.boolean() }).strict(),
     unavailableEvidenceSchema,
     deletedEvidenceSchema
   ]),
-  head: z3.discriminatedUnion("state", [
-    z3.object({ state: z3.literal("available"), sha: commitShaSchema }).strict(),
+  head: z8.discriminatedUnion("state", [
+    z8.object({ state: z8.literal("available"), sha: commitShaSchema }).strict(),
     unavailableEvidenceSchema.extend({ sha: commitShaSchema.optional() }),
     deletedEvidenceSchema.extend({ sha: commitShaSchema.optional() })
   ]),
-  diff: z3.discriminatedUnion("state", [
+  diff: z8.discriminatedUnion("state", [
     // path addresses a workerResultFileSchema JSON document; its diffSnapshot field contains the patch.
-    z3.object({ state: z3.literal("available"), snapshotId: z3.uuid(), path: z3.string().min(1).max(8192), truncated: z3.boolean() }).strict(),
+    z8.object({ state: z8.literal("available"), snapshotId: z8.uuid(), path: z8.string().min(1).max(8192), truncated: z8.boolean() }).strict(),
     unavailableEvidenceSchema,
     deletedEvidenceSchema
   ]),
-  artifacts: z3.discriminatedUnion("state", [
-    z3.object({ state: z3.literal("available"), items: z3.array(workerArtifactSchema).max(32), truncated: z3.boolean() }).strict(),
+  artifacts: z8.discriminatedUnion("state", [
+    z8.object({ state: z8.literal("available"), items: z8.array(workerArtifactSchema).max(32), truncated: z8.boolean() }).strict(),
     unavailableEvidenceSchema,
     deletedEvidenceSchema
   ])
 }).strict();
-var workerResultFileSchema = z3.object({ result: workerCollectedResultSchema, diffSnapshot: z3.string().max(4e5).optional() }).strict();
-var workerResultReferenceSchema = z3.object({
-  workerId: z3.uuid(),
-  revision: z3.number().int().nonnegative(),
-  snapshotId: z3.uuid(),
-  observedAt: z3.iso.datetime(),
+var workerResultFileSchema = z8.object({ result: workerCollectedResultSchema, diffSnapshot: z8.string().max(4e5).optional() }).strict();
+var workerResultReferenceSchema = z8.object({
+  workerId: z8.uuid(),
+  revision: z8.number().int().nonnegative(),
+  snapshotId: z8.uuid(),
+  observedAt: z8.iso.datetime(),
   lastExecutionOutcome: executionOutcomeSchema,
-  previous: z3.object({ revision: z3.number().int().nonnegative(), observedAt: z3.iso.datetime(), lastExecutionOutcome: executionOutcomeSchema }).strict().optional()
+  previous: z8.object({ revision: z8.number().int().nonnegative(), observedAt: z8.iso.datetime(), lastExecutionOutcome: executionOutcomeSchema }).strict().optional()
 }).strict();
-var delegationStateSchema = z3.discriminatedUnion("role", [
-  z3.object({
-    role: z3.literal("root"),
+var delegationStateSchema = z8.discriminatedUnion("role", [
+  z8.object({
+    role: z8.literal("root"),
     conversation: conversationStateSchema.optional(),
     permissions: permissionsSchema,
-    receipts: z3.array(workerCreationReceiptSchema).max(32).refine((receipts) => new Set(receipts.map((receipt) => receipt.requestId)).size === receipts.length && new Set(receipts.map((receipt) => receipt.workerId)).size === receipts.length),
+    receipts: z8.array(workerCreationReceiptSchema).max(32).refine((receipts) => new Set(receipts.map((receipt) => receipt.requestId)).size === receipts.length && new Set(receipts.map((receipt) => receipt.workerId)).size === receipts.length),
     wait: workerWaitSchema.optional(),
     lastWait: workerWaitSchema.optional(),
-    results: z3.array(workerResultReferenceSchema).max(32).refine((results) => new Set(results.map((result) => result.workerId)).size === results.length).optional(),
-    finishRequestedAt: z3.iso.datetime().optional(),
-    historyDeletion: z3.literal("pending").optional(),
-    completion: z3.object({ phase: z3.enum(["waiting", "attention"]), waitId: z3.uuid().optional() }).strict().optional()
+    results: z8.array(workerResultReferenceSchema).max(32).refine((results) => new Set(results.map((result) => result.workerId)).size === results.length).optional(),
+    finishRequestedAt: z8.iso.datetime().optional(),
+    historyDeletion: z8.literal("pending").optional(),
+    completion: z8.object({ phase: z8.enum(["waiting", "attention"]), waitId: z8.uuid().optional() }).strict().optional()
   }).strict(),
-  z3.object({
-    role: z3.literal("worker"),
+  z8.object({
+    role: z8.literal("worker"),
     wait: workerWaitSchema.optional(),
     lastWait: workerWaitSchema.optional(),
     permissions: permissionsSchema,
-    parentRunId: z3.uuid(),
+    parentRunId: z8.uuid(),
     workspace: workerWorkspaceSchema,
     destroy: workerDestroySchema.optional(),
     context: workerInputRecipeSchema.optional(),
-    executionRevision: z3.number().int().nonnegative().optional(),
-    executionStartSeq: z3.number().int().nonnegative().optional()
+    executionRevision: z8.number().int().nonnegative().optional(),
+    executionStartSeq: z8.number().int().nonnegative().optional()
   }).strict(),
   // A persisted quarantine is distinct from absent legacy metadata and grants no authority.
-  z3.object({ role: z3.literal("invalid") }).strict()
+  z8.object({ role: z8.literal("invalid") }).strict()
 ]);
-var runDelegationSummarySchema = z3.discriminatedUnion("role", [
+var runDelegationSummarySchema = z8.discriminatedUnion("role", [
   delegationStateSchema.options[0].pick({ role: true }).strip().extend({
     wait: workerWaitSchema.pick({ phase: true, requestIds: true }).strip().optional()
   }),
@@ -225,74 +706,89 @@ var runDelegationSummarySchema = z3.discriminatedUnion("role", [
   }),
   delegationStateSchema.options[2].strip()
 ]);
-var workerSpawnRequestSchema = z3.object({
-  task: z3.string().min(1).max(1e5),
-  baseline: z3.string().min(1).max(1024),
-  requestId: z3.uuid(),
+var workerSpawnRequestSchema = z8.object({
+  task: z8.string().min(1).max(1e5),
+  baseline: z8.string().min(1).max(1024),
+  requestId: z8.uuid(),
   context: workerContextSchema.optional(),
   backend: workerBackendSchema.optional(),
-  model: z3.string().trim().min(1).max(512).optional(),
+  model: z8.string().trim().min(1).max(512).optional(),
   effort: effortFieldSchema,
   /** Catalog workflow name (built-in quick-task or `.ai/cezar/workflows/*.yaml`, #451). Absent means quick-task. */
-  workflow: z3.string().trim().min(1).max(200).optional()
+  workflow: z8.string().trim().min(1).max(200).optional()
 }).strict().refine((request) => request.task.length + (request.context?.text?.length ?? 0) <= 1e5, { message: "Combined task and context exceed 100000 characters" });
-var workerSteerRequestSchema = z3.object({
-  text: z3.string().max(1e5).refine((text) => text.trim().length > 0)
+var workerSteerRequestSchema = z8.object({
+  text: z8.string().max(1e5).refine((text) => text.trim().length > 0)
 }).strict();
-var workerWaitRequestSchema = z3.object({
+var workerWaitRequestSchema = z8.object({
   workerIds: workerIdsSchema,
-  timeoutSeconds: z3.number().int().min(1).max(1800).default(600),
+  timeoutSeconds: z8.number().int().min(1).max(1800).default(600),
   mode: workerWaitModeSchema.optional()
 }).strict().refine((request) => request.mode !== "one" || request.workerIds.length === 1, { message: "one mode requires exactly one worker" });
-var agentInputSchema = z3.object({
+var inboxClaimSchema = z8.object({
+  receiptId: z8.uuid(),
+  generation: z8.uuid(),
+  expiresAt: z8.iso.datetime(),
+  acknowledgedAt: z8.iso.datetime().optional(),
+  /** Optional on read for receipts persisted before member manifests existed. */
+  memberIds: z8.array(z8.uuid()).min(1).max(32).refine((ids) => new Set(ids).size === ids.length).optional()
+}).strict();
+var agentInputSchema = z8.object({
   conversation: conversationAttributionSchema.optional(),
-  id: z3.uuid(),
-  source: z3.enum(["agent", "lifecycle"]),
-  parentRunId: z3.uuid(),
-  text: z3.string().min(1).max(1e5),
-  createdAt: z3.iso.datetime(),
-  deliveredAt: z3.iso.datetime().optional()
+  id: z8.uuid(),
+  source: z8.enum(["agent", "lifecycle"]),
+  parentRunId: z8.uuid(),
+  text: z8.string().min(1).max(1e5),
+  createdAt: z8.iso.datetime(),
+  deliveredAt: z8.iso.datetime().optional(),
+  /** The model received it, when the harness can show that (#505). Absent on
+   * unobservable backends and on records written before #505. */
+  consumedAt: z8.iso.datetime().optional(),
+  /** Accepted by a harness that reports reading, and not read yet. A restart replays
+   * such input; records written before #505 never carry it, so nothing historical replays. */
+  awaitingRead: z8.literal(true).optional(),
+  inboxClaim: inboxClaimSchema.optional()
 }).strict();
-var workerInspectionSchema = z3.object({
-  workerId: z3.uuid(),
-  parentRunId: z3.uuid(),
-  status: z3.enum(["queued", "running", "waiting", ...workerOutcomeSchema.shape.status.options]),
-  currentStepId: z3.string().optional(),
-  activity: z3.enum(["monitoring"]).optional(),
+var workerInspectionSchema = z8.object({
+  workerId: z8.uuid(),
+  parentRunId: z8.uuid(),
+  status: z8.enum(["queued", "running", "waiting", ...workerOutcomeSchema.shape.status.options]),
+  currentStepId: z8.string().optional(),
+  activity: z8.enum(["monitoring"]).optional(),
   workspace: workerWorkspaceSchema,
   backend: workerBackendSchema.optional(),
-  model: z3.string().max(512).optional(),
-  inputs: z3.array(workerInputSchema).max(32).optional(),
+  model: z8.string().max(512).optional(),
+  inputs: z8.array(workerInputSchema).max(32).optional(),
   wait: workerWaitSchema.optional(),
   destroy: workerDestroySchema.optional(),
   outcome: workerOutcomeSchema.optional()
 });
-var workerDiffSchema = z3.object({
-  workerId: z3.uuid(),
+var workerDiffSchema = z8.object({
+  workerId: z8.uuid(),
   baselineSha: commitShaSchema,
-  diff: z3.string().max(4e5),
-  truncated: z3.boolean()
-});
-var workerStopResultSchema = z3.object({
-  workerId: z3.uuid(),
-  state: z3.enum(["stopping", "terminated"])
-});
-var workerDestroyResultSchema = z3.object({
-  workerId: z3.uuid(),
-  state: z3.enum(["complete", "incomplete"]),
-  deleted: z3.array(z3.discriminatedUnion("kind", [
-    z3.object({ kind: z3.literal("worktree"), path: z3.string().max(8192) }).strict(),
-    z3.object({ kind: z3.literal("branch"), ref: z3.string().max(1024) }).strict()
+  diff: z8.string().max(4e5),
+  truncated: z8.boolean()
+});
+var workerStopResultSchema = z8.object({
+  workerId: z8.uuid(),
+  state: z8.enum(["stopping", "terminated"])
+});
+var workerDestroyResultSchema = z8.object({
+  workerId: z8.uuid(),
+  state: z8.enum(["complete", "incomplete"]),
+  deleted: z8.array(z8.discriminatedUnion("kind", [
+    z8.object({ kind: z8.literal("worktree"), path: z8.string().max(8192) }).strict(),
+    z8.object({ kind: z8.literal("branch"), ref: z8.string().max(1024) }).strict()
   ])).max(2).optional(),
   remaining: remainingSchema,
   error: errorSchema.optional()
 });
-var runRelationshipsSchema = z3.object({
-  parentRunId: z3.uuid().optional(),
-  workers: z3.array(workerInspectionSchema).max(32)
+var runRelationshipsSchema = z8.object({
+  parentRunId: z8.uuid().optional(),
+  workers: z8.array(workerInspectionSchema).max(32)
 });
-var delegationErrorResponseSchema = z3.object({
-  code: z3.enum([
+var delegationErrorResponseSchema = z8.object({
+  code: z8.enum([
     "unavailable_transport",
     "unauthenticated",
     "denied_scope",
@@ -303,98 +799,92 @@ var delegationErrorResponseSchema = z3.object({
     "unavailable_diff",
     "incomplete_cleanup"
   ]),
-  error: errorSchema
-});
-var workerParamsSchema = z3.object({ workerId: z3.uuid() }).strict();
-var workerSpawnResultSchema = z3.object({ workerId: z3.uuid(), baselineSha: commitShaSchema }).strict();
-var workerSteerResultSchema = z3.object({ workerId: z3.uuid(), state: z3.enum(["queued", "delivered"]) }).strict();
-var workerWaitResultSchema = z3.object({ wait: workerWaitSchema, instruction: z3.string().min(1).max(1e3) }).strict();
-var workerEmptyRequestSchema = z3.object({}).strict();
-var workerCancelWaitRequestSchema = z3.object({ waitId: z3.uuid() }).strict();
-var workerCancelWaitResultSchema = z3.object({ wait: workerWaitSchema }).strict();
+  error: errorSchema,
+  modelChoices: modelChoicesSchema.optional()
+});
+var workerParamsSchema = z8.object({ workerId: z8.uuid() }).strict();
+var workerSpawnResultSchema = z8.object({ workerId: z8.uuid(), baselineSha: commitShaSchema }).strict();
+var workerSteerResultSchema = z8.object({ workerId: z8.uuid(), state: z8.enum(["queued", "delivered"]) }).strict();
+var workerWaitResultSchema = z8.object({ wait: workerWaitSchema, instruction: z8.string().min(1).max(1e3) }).strict();
+var workerEmptyRequestSchema = z8.object({}).strict();
+var workerCancelWaitRequestSchema = z8.object({ waitId: z8.uuid() }).strict();
+var workerCancelWaitResultSchema = z8.object({ wait: workerWaitSchema }).strict();
 
 // ../contract/src/events.ts
-var runEventSchema = z4.looseObject({
-  seq: z4.number(),
-  ts: z4.string(),
-  stepId: z4.string().optional(),
-  type: z4.string()
-});
-var conversationMessageEventSchema = runEventSchema.extend({ type: z4.literal("conversation-message"), message: conversationMessageSchema, delivery: z4.enum(["queued", "delivered", "not-delivered"]), deliveredAt: z4.iso.datetime().optional() });
-var requestOutcomeEventSchema = runEventSchema.extend({ type: z4.literal("request-outcome"), outcome: requestOutcomeSchema });
+var runEventSchema = z9.looseObject({
+  seq: z9.number(),
+  ts: z9.string(),
+  stepId: z9.string().optional(),
+  type: z9.string()
+});
+var conversationMessageEventSchema = runEventSchema.extend({ type: z9.literal("conversation-message"), message: conversationMessageSchema, delivery: z9.enum(["queued", "delivered", "consumed", "not-delivered"]), deliveredAt: z9.iso.datetime().optional(), consumedAt: z9.iso.datetime().optional() });
+var requestOutcomeEventSchema = runEventSchema.extend({ type: z9.literal("request-outcome"), outcome: requestOutcomeSchema });
 var agentInputEventSchema = runEventSchema.extend({
-  type: z4.literal("agent-input"),
+  type: z9.literal("agent-input"),
   input: agentInputSchema
 });
 var humanInputDeliveredEventSchema = runEventSchema.extend({
-  type: z4.literal("human-input-delivered"),
-  askSeq: z4.number().int().nonnegative()
+  type: z9.literal("human-input-delivered"),
+  askSeq: z9.number().int().nonnegative(),
+  /** Who answered: absent (records before #505) or `human` is a person; `parent` is the
+   * owning parent's reply to a routed worker question. */
+  source: z9.enum(["human", "parent"]).optional()
+});
+var workerQuestionRoutedEventSchema = runEventSchema.extend({
+  type: z9.literal("worker-question-routed"),
+  askSeq: z9.number().int().nonnegative(),
+  messageId: z9.uuid(),
+  parentRunId: z9.uuid()
+});
+var workerQuestionFallbackEventSchema = runEventSchema.extend({
+  type: z9.literal("worker-question-fallback"),
+  askSeq: z9.number().int().nonnegative(),
+  reason: z9.string().min(1).max(200)
 });
 var workerOutcomeEventSchema = runEventSchema.extend({
-  type: z4.literal("worker-outcome"),
+  type: z9.literal("worker-outcome"),
   outcome: workerOutcomeSchema
 });
 var RUN_HISTORY_PAGE_ITEMS = 100;
-var runIdParamSchema = z4.object({
-  id: z4.string().min(1).max(128).regex(/^[A-Za-z0-9._-]+$/)
+var runIdParamSchema = z9.object({
+  id: z9.string().min(1).max(128).regex(/^[A-Za-z0-9._-]+$/)
 });
-var runHistoryCursorSchema = z4.string().min(1).max(2048);
-var runHistoryQuerySchema = z4.object({
+var runHistoryCursorSchema = z9.string().min(1).max(2048);
+var runHistoryQuerySchema = z9.object({
   cursor: runHistoryCursorSchema.optional()
 });
-var runEventsQuerySchema = z4.object({
+var runEventsQuerySchema = z9.object({
   cursor: runHistoryCursorSchema.optional(),
-  afterSeq: z4.coerce.number().int().nonnegative().optional()
-});
-var runHistoryEventSchema = z4.object({
-  seq: z4.number(),
-  ts: z4.string(),
-  stepId: z4.string().optional(),
-  type: z4.string()
-}).catchall(z4.any());
-var runHistoryPageSchema = z4.object({
-  events: z4.array(runHistoryEventSchema),
-  itemCount: z4.number().int().min(0).max(RUN_HISTORY_PAGE_ITEMS),
+  afterSeq: z9.coerce.number().int().nonnegative().optional()
+});
+var runHistoryEventSchema = z9.object({
+  seq: z9.number(),
+  ts: z9.string(),
+  stepId: z9.string().optional(),
+  type: z9.string()
+}).catchall(z9.any());
+var runHistoryPageSchema = z9.object({
+  events: z9.array(runHistoryEventSchema),
+  itemCount: z9.number().int().min(0).max(RUN_HISTORY_PAGE_ITEMS),
   olderCursor: runHistoryCursorSchema.optional(),
   newerCursor: runHistoryCursorSchema.optional(),
   liveCursor: runHistoryCursorSchema,
-  asOfSeq: z4.number().int().nonnegative(),
-  hasOlder: z4.boolean()
+  asOfSeq: z9.number().int().nonnegative(),
+  hasOlder: z9.boolean()
 });
-var runHistoryContextSchema = z4.object({
-  contextEvents: z4.array(runHistoryEventSchema),
-  asOfSeq: z4.number().int().nonnegative()
+var runHistoryContextSchema = z9.object({
+  contextEvents: z9.array(runHistoryEventSchema),
+  asOfSeq: z9.number().int().nonnegative()
 });
-var checkoutProgressEventSchema = z4.object({
-  checkoutId: z4.string().optional(),
-  name: z4.string(),
-  phase: z4.enum(["cloning", "done", "error"]),
-  line: z4.string().optional(),
-  error: z4.string().optional()
+var checkoutProgressEventSchema = z9.object({
+  checkoutId: z9.string().optional(),
+  name: z9.string(),
+  phase: z9.enum(["cloning", "done", "error"]),
+  line: z9.string().optional(),
+  error: z9.string().optional()
 });
 
 // ../contract/src/ask.ts
-import { z as z5 } from "zod";
-var askOptionSchema = z5.object({
-  label: z5.string().min(1).max(60),
-  description: z5.string().max(280).optional()
-}).strict();
-var askQuestionSchema = z5.object({
-  /** Stable key for the answer; defaults to the array index when omitted. */
-  id: z5.string().min(1).max(64).optional(),
-  /** ≤12-char chip label (matches AskUserQuestion's `header`). */
-  header: z5.string().min(1).max(12),
-  question: z5.string().min(1).max(400),
-  options: z5.array(askOptionSchema).min(2).max(4).refine((opts) => new Set(opts.map((o) => o.label)).size === opts.length, {
-    message: "option labels must be unique within a question"
-  }),
-  multiSelect: z5.boolean().optional()
-}).strict();
-var askRequestSchema = z5.object({
-  questions: z5.array(askQuestionSchema).min(1).max(4).refine((qs) => new Set(qs.map((q) => q.question)).size === qs.length, {
-    message: "question texts must be unique"
-  })
-}).strict();
 function advancePendingHumanAsk(pending, event) {
   if (event.type === "ask.requested" && typeof event.requestId === "string" && askRequestSchema.safeParse({ questions: event.questions }).success) return event;
   if (event.type === "human-input-delivered") {
@@ -409,102 +899,29 @@ function pendingHumanAsk(events) {
   return pending;
 }
 
-// ../contract/src/health.ts
-import { z as z6 } from "zod";
-var runnerSchema = z6.enum(["claude", "codex", "opencode", "pi", "cursor"]);
-var repoInfoSchema = z6.object({
-  root: z6.string(),
-  branch: z6.string(),
-  remote: z6.string().optional()
-});
-var backendCheckSchema = z6.object({
-  name: z6.enum(["claude", "codex", "opencode", "pi", "cursor", "gh", "git"]),
-  available: z6.boolean(),
-  version: z6.string().optional(),
-  hint: z6.string().optional()
-});
-var forgeInfoSchema = z6.object({
-  kind: z6.literal("github"),
-  /**
-   * Whether the forge is reachable — **absent until the availability probe has warmed**.
-   *
-   * Health must never pay a `gh` shell-out, so it serves whatever the cache holds. Absent means
-   * "not determined yet", which is not the same as `false`, and the cockpit renders the two
-   * differently. Declaring it required is what made an earlier hand-written mirror wrong.
-   */
-  available: z6.boolean().optional(),
-  reason: z6.string().optional()
-});
-var capabilitiesSchema = z6.object({
-  localHandoff: z6.boolean(),
-  followups: z6.boolean(),
-  singleProject: z6.boolean(),
-  /**
-   * `true` means `CEZ_AUTOMATIONS=1` opted this server into GitHub automations (#801). Off — the
-   * default — the whole feature is absent: no `Automations` nav item anywhere it is rendered, the
-   * `/api/v1/…/automations*` family answers `409`, and the workspace scheduler never polls GitHub.
-   *
-   * REQUIRED for the same reason as `tokenMetrics` below: this server always sends it.
-   */
-  automations: z6.boolean(),
-  /**
-   * `false` means `CEZ_HIDE_TOKEN_METRICS=1` asks the browser to omit token counts and monetary
-   * cost (#481). The telemetry itself still rides in run/event payloads — this is presentation
-   * only.
-   *
-   * REQUIRED, because this server always sends it (`capabilities.ts` computes it from the env on
-   * every read) and this contract describes THIS server's wire. The DTO it replaces declared it
-   * optional so a newer cockpit could read an OLDER server, which is version skew a contract
-   * versioned in lockstep with the server cannot model. That tolerance lives where it belongs, in
-   * `web/src/lib/token-metrics.ts`, whose `!== false` read still treats an absent field as
-   * visible.
-   */
-  tokenMetrics: z6.boolean(),
-  /** Current token-count presentation policy. Required on current servers;
-   * older payload tolerance belongs in the browser resolver. */
-  tokenUsageMetrics: z6.boolean(),
-  /** Current backend-reported-cost presentation policy. */
-  costMetrics: z6.boolean()
-});
-var healthResponseSchema = z6.object({
-  version: z6.string(),
-  latestVersion: z6.string().optional(),
-  repoRoot: z6.string(),
-  repo: repoInfoSchema.nullable(),
-  checks: z6.array(backendCheckSchema),
-  defaultRunner: runnerSchema,
-  forge: forgeInfoSchema.nullable(),
-  capabilities: capabilitiesSchema,
-  // Always sent: `workspaceSummary()` returns both unconditionally, and an unreadable workspace
-  // degrades to `projects: []` rather than to an absent key. The hand-written DTO declared them
-  // optional, which was wider than the server has ever been.
-  projects: z6.array(z6.object({ id: z6.string(), name: z6.string() })),
-  bootProject: z6.string()
-});
-
 // ../contract/src/ci-wait.ts
-import { z as z7 } from "zod";
+import { z as z10 } from "zod";
 var CI_WAIT_LIMITATION = "Passing reported checks does not prove that every expected workflow has appeared or that the PR is merge-ready. This observation is not merge approval.";
 var CI_WAIT_RECEIPT_INSTRUCTION = "End your turn to wait for CI; no marker is needed. " + CI_WAIT_LIMITATION;
 var prPattern = /^https:\/\/([a-zA-Z0-9](?:[a-zA-Z0-9.-]*[a-zA-Z0-9])?)\/([a-zA-Z0-9_-]+)\/([a-zA-Z0-9_.-]+)\/pull\/([1-9][0-9]*)$/;
-var ciPrUrlSchema = z7.string().max(2048).regex(prPattern).refine((value) => {
+var ciPrUrlSchema = z10.string().max(2048).regex(prPattern).refine((value) => {
   const match = prPattern.exec(value);
   return !!match && Number.isSafeInteger(Number(match[4])) && match[3] !== "." && match[3] !== "..";
 }, "Expected an HTTPS GitHub PR URL with a positive integer PR number");
-var ciWaitRequestSchema = z7.object({
+var ciWaitRequestSchema = z10.object({
   pr: ciPrUrlSchema,
-  timeout_seconds: z7.number().int().min(1).max(7200).default(1800)
+  timeout_seconds: z10.number().int().min(1).max(7200).default(1800)
 }).strict();
-var sha = z7.string().regex(/^[0-9a-f]{40}$/i);
-var ciPrIdentitySchema = z7.object({
+var sha = z10.string().regex(/^[0-9a-f]{40}$/i);
+var ciPrIdentitySchema = z10.object({
   prUrl: ciPrUrlSchema,
-  repository: z7.string().max(2048).regex(/^[a-zA-Z0-9_-]+\/[a-zA-Z0-9_.-]+$/),
-  prNumber: z7.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  repository: z10.string().max(2048).regex(/^[a-zA-Z0-9_-]+\/[a-zA-Z0-9_.-]+$/),
+  prNumber: z10.number().int().positive().max(Number.MAX_SAFE_INTEGER),
   headSha: sha
 }).strict();
-var ciWaitOutcomeSchema = z7.enum(["passed", "failed", "cancelled", "skipped", "no_checks", "head_changed", "deadline", "error"]);
-var ciWaitErrorCodeSchema = z7.enum(["invalid_request", "unsupported_host", "gh_missing", "authentication", "inaccessible_pr", "malformed_data", "output_limit", "query_timeout", "command_failed", "wait_conflict", "capacity", "unavailable", "unauthorized", "persistence"]);
-var ciWaitErrorSchema = z7.object({ code: ciWaitErrorCodeSchema, message: z7.string().max(4096) }).strict();
+var ciWaitOutcomeSchema = z10.enum(["passed", "failed", "cancelled", "skipped", "no_checks", "head_changed", "deadline", "error"]);
+var ciWaitErrorCodeSchema = z10.enum(["invalid_request", "unsupported_host", "gh_missing", "authentication", "inaccessible_pr", "malformed_data", "output_limit", "query_timeout", "command_failed", "wait_conflict", "capacity", "unavailable", "unauthorized", "persistence"]);
+var ciWaitErrorSchema = z10.object({ code: ciWaitErrorCodeSchema, message: z10.string().max(4096) }).strict();
 function utf8Bytes(value) {
   let bytes = 0;
   for (const char of value) {
@@ -513,113 +930,113 @@ function utf8Bytes(value) {
   }
   return bytes;
 }
-var ciWaitResultSchema = z7.object({
+var ciWaitResultSchema = z10.object({
   outcome: ciWaitOutcomeSchema,
   headSha: sha,
   observedHeadSha: sha.optional(),
-  observedAt: z7.iso.datetime(),
-  checks: z7.array(z7.object({ name: z7.string().max(256), state: z7.string().max(256), link: z7.string().max(2048) }).strict()).max(100),
-  totalChecks: z7.number().int().nonnegative(),
-  truncated: z7.boolean(),
-  diagnostic: z7.string().max(4096).refine((value) => utf8Bytes(value) <= 4096).optional()
+  observedAt: z10.iso.datetime(),
+  checks: z10.array(z10.object({ name: z10.string().max(256), state: z10.string().max(256), link: z10.string().max(2048) }).strict()).max(100),
+  totalChecks: z10.number().int().nonnegative(),
+  truncated: z10.boolean(),
+  diagnostic: z10.string().max(4096).refine((value) => utf8Bytes(value) <= 4096).optional()
 }).strict().refine((value) => utf8Bytes(JSON.stringify(value)) <= 32 * 1024, "CI result exceeds 32 KiB");
 var ciWaitSchema = ciPrIdentitySchema.extend({
-  id: z7.uuid(),
-  generation: z7.string().min(1).max(256),
-  turnId: z7.string().min(1).max(256),
-  timeoutSeconds: z7.number().int().min(1).max(7200),
-  registeredAt: z7.iso.datetime(),
-  deadline: z7.iso.datetime(),
-  phase: z7.enum(["registered", "parked", "wake-pending", "delivered", "withdrawn"]),
+  id: z10.uuid(),
+  generation: z10.string().min(1).max(256),
+  turnId: z10.string().min(1).max(256),
+  timeoutSeconds: z10.number().int().min(1).max(7200),
+  registeredAt: z10.iso.datetime(),
+  deadline: z10.iso.datetime(),
+  phase: z10.enum(["registered", "parked", "wake-pending", "delivered", "withdrawn"]),
   result: ciWaitResultSchema.optional(),
-  wakeId: z7.string().min(1).max(256).optional(),
-  deliveredAt: z7.iso.datetime().optional()
+  wakeId: z10.string().min(1).max(256).optional(),
+  deliveredAt: z10.iso.datetime().optional()
 }).strict();
 var ciWaitReceiptSchema = ciPrIdentitySchema.extend({
-  waitId: z7.uuid(),
-  registeredAt: z7.iso.datetime(),
-  deadline: z7.iso.datetime(),
+  waitId: z10.uuid(),
+  registeredAt: z10.iso.datetime(),
+  deadline: z10.iso.datetime(),
   phase: ciWaitSchema.shape.phase
 }).strict();
 
 // ../contract/src/runs.ts
-import { z as z10 } from "zod";
+import { z as z13 } from "zod";
 
 // ../contract/src/github.ts
-import { z as z8 } from "zod";
-var checksGlyphSchema = z8.enum(["passing", "failing", "pending"]).nullable();
-var githubItemSchema = z8.object({
-  kind: z8.enum(["issue", "pr"]),
-  number: z8.number(),
-  title: z8.string(),
-  author: z8.string(),
-  createdAt: z8.string(),
-  labels: z8.array(z8.string()),
-  body: z8.string(),
-  url: z8.string(),
-  comments: z8.number(),
+import { z as z11 } from "zod";
+var checksGlyphSchema = z11.enum(["passing", "failing", "pending"]).nullable();
+var githubItemSchema = z11.object({
+  kind: z11.enum(["issue", "pr"]),
+  number: z11.number(),
+  title: z11.string(),
+  author: z11.string(),
+  createdAt: z11.string(),
+  labels: z11.array(z11.string()),
+  body: z11.string(),
+  url: z11.string(),
+  comments: z11.number(),
   /** Issues only; absent on older servers. */
-  assignees: z8.array(z8.string()).optional(),
-  projectIds: z8.array(z8.string()).optional(),
+  assignees: z11.array(z11.string()).optional(),
+  projectIds: z11.array(z11.string()).optional(),
   /** PRs only. */
-  isDraft: z8.boolean().optional(),
-  additions: z8.number().optional(),
-  deletions: z8.number().optional(),
+  isDraft: z11.boolean().optional(),
+  additions: z11.number().optional(),
+  deletions: z11.number().optional(),
   checks: checksGlyphSchema.optional()
 });
-var githubProjectSchema = z8.object({
-  id: z8.string(),
-  title: z8.string(),
-  url: z8.string()
+var githubProjectSchema = z11.object({
+  id: z11.string(),
+  title: z11.string(),
+  url: z11.string()
 });
-var githubDataSchema = z8.object({
-  available: z8.boolean(),
+var githubDataSchema = z11.object({
+  available: z11.boolean(),
   /** Why it is unavailable (`gh` missing, no remote, offline…). Never an error — a hint. */
-  reason: z8.string().optional(),
+  reason: z11.string().optional(),
   /** owner/name, when known. */
-  repo: z8.string().optional(),
-  syncedAt: z8.string().optional(),
-  issues: z8.array(githubItemSchema),
-  prs: z8.array(githubItemSchema),
+  repo: z11.string().optional(),
+  syncedAt: z11.string().optional(),
+  issues: z11.array(githubItemSchema),
+  prs: z11.array(githubItemSchema),
   /** Repo-wide label name → 6-hex color (no `#`); lets chips tint like GitHub. Additive. */
-  labelColors: z8.record(z8.string(), z8.string()).optional(),
-  viewerLogin: z8.string().optional(),
+  labelColors: z11.record(z11.string(), z11.string()).optional(),
+  viewerLogin: z11.string().optional(),
   /** Repository-linked Projects v2. Absent when lookup is unavailable; [] means none. */
-  projects: z8.array(githubProjectSchema).optional(),
-  projectsReason: z8.string().optional()
+  projects: z11.array(githubProjectSchema).optional(),
+  projectsReason: z11.string().optional()
 });
-var githubChecksDataSchema = z8.discriminatedUnion("available", [
-  z8.object({
-    available: z8.literal(true),
-    checks: z8.record(z8.number(), checksGlyphSchema)
+var githubChecksDataSchema = z11.discriminatedUnion("available", [
+  z11.object({
+    available: z11.literal(true),
+    checks: z11.record(z11.number(), checksGlyphSchema)
   }),
-  z8.object({
-    available: z8.literal(false),
-    reason: z8.string()
+  z11.object({
+    available: z11.literal(false),
+    reason: z11.string()
   })
 ]);
 var GITHUB_SEARCH_MAX = 50;
-var githubSearchQuerySchema = z8.object({
-  kind: z8.enum(["issue", "pr"]),
-  q: z8.string().trim().min(1).max(256),
-  limit: z8.coerce.number().int().positive().max(GITHUB_SEARCH_MAX).optional()
+var githubSearchQuerySchema = z11.object({
+  kind: z11.enum(["issue", "pr"]),
+  q: z11.string().trim().min(1).max(256),
+  limit: z11.coerce.number().int().positive().max(GITHUB_SEARCH_MAX).optional()
 });
-var githubSearchDataSchema = z8.object({
-  available: z8.boolean(),
+var githubSearchDataSchema = z11.object({
+  available: z11.boolean(),
   /** Membership is unknown when lookup fails; never substitute empty projectIds. */
-  projectsReason: z8.string().optional(),
+  projectsReason: z11.string().optional(),
   /** Why it could not search (`gh` missing, no remote, rate-limited…). A hint, never an error. */
-  reason: z8.string().optional(),
+  reason: z11.string().optional(),
   /** The same rows the list ships. `checks` is always `null` here — hydrated lazily through
    *  `/github/checks`, exactly as list rows have been since #664. */
-  items: z8.array(githubItemSchema),
+  items: z11.array(githubItemSchema),
   /** The hit list filled the server's cap; there may be more matches on the forge. */
-  truncated: z8.boolean().optional(),
+  truncated: z11.boolean().optional(),
   /** Label name → 6-hex color for the labels these hits carry. A closed item often wears labels
    *  no open one does, which the repo-wide map from the list call would not cover. Additive. */
-  labelColors: z8.record(z8.string(), z8.string()).optional()
+  labelColors: z11.record(z11.string(), z11.string()).optional()
 });
-var referenceStatusSchema = z8.enum([
+var referenceStatusSchema = z11.enum([
   "draft",
   "review-required",
   "changes-requested",
@@ -632,13 +1049,13 @@ var referenceStatusSchema = z8.enum([
   "completed",
   "not-planned"
 ]);
-var recheckAfterMsSchema = z8.number().nullable();
+var recheckAfterMsSchema = z11.number().nullable();
 var REFERENCE_STATUS_MAX = 100;
-var githubRefStatusDataSchema = z8.discriminatedUnion("available", [
-  z8.object({
-    available: z8.literal(true),
-    prs: z8.record(z8.number(), referenceStatusSchema),
-    issues: z8.record(z8.number(), referenceStatusSchema),
+var githubRefStatusDataSchema = z11.discriminatedUnion("available", [
+  z11.object({
+    available: z11.literal(true),
+    prs: z11.record(z11.number(), referenceStatusSchema),
+    issues: z11.record(z11.number(), referenceStatusSchema),
     /**
      * The pull request numbers that do NOT merge cleanly into their base right now.
      *
@@ -658,28 +1075,28 @@ var githubRefStatusDataSchema = z8.discriminatedUnion("available", [
      * ever named — GitHub reports `UNKNOWN` for merged and closed ones, and `UNKNOWN` (which is
      * also what it answers while it is still computing) is never listed.
      */
-    conflicts: z8.array(z8.number()).optional(),
+    conflicts: z11.array(z11.number()).optional(),
     recheckAfterMs: recheckAfterMsSchema
   }),
-  z8.object({
-    available: z8.literal(false),
-    reason: z8.string(),
+  z11.object({
+    available: z11.literal(false),
+    reason: z11.string(),
     recheckAfterMs: recheckAfterMsSchema
   })
 ]);
-var githubCommentSchema = z8.object({
-  id: z8.number(),
+var githubCommentSchema = z11.object({
+  id: z11.number(),
   /** Author login, `'?'` fallback when gh omits the user. */
-  author: z8.string(),
-  avatarUrl: z8.string().optional(),
-  createdAt: z8.string(),
-  body: z8.string(),
-  kind: z8.enum(["comment", "review"]),
+  author: z11.string(),
+  avatarUrl: z11.string().optional(),
+  createdAt: z11.string(),
+  body: z11.string(),
+  kind: z11.enum(["comment", "review"]),
   /** Reviews only — drives the state chip. */
-  reviewState: z8.enum(["approved", "changes_requested", "commented", "dismissed"]).optional(),
-  url: z8.string()
+  reviewState: z11.enum(["approved", "changes_requested", "commented", "dismissed"]).optional(),
+  url: z11.string()
 });
-var githubTimelineEventKindSchema = z8.enum([
+var githubTimelineEventKindSchema = z11.enum([
   "committed",
   "labeled",
   "unlabeled",
@@ -692,134 +1109,134 @@ var githubTimelineEventKindSchema = z8.enum([
   "cross-referenced",
   "renamed"
 ]);
-var githubTimelineEventSchema = z8.object({
-  id: z8.string(),
+var githubTimelineEventSchema = z11.object({
+  id: z11.string(),
   kind: githubTimelineEventKindSchema,
   /** Login — or the git author name for `committed`, which carries no GitHub actor. */
-  actor: z8.string(),
+  actor: z11.string(),
   /** Absent for `committed`. */
-  avatarUrl: z8.string().optional(),
-  createdAt: z8.string(),
-  url: z8.string().optional(),
+  avatarUrl: z11.string().optional(),
+  createdAt: z11.string(),
+  url: z11.string().optional(),
   /** `committed` — full 40-char SHA. */
-  sha: z8.string().optional(),
+  sha: z11.string().optional(),
   /** `committed` — first line, capped at 120 chars. */
-  message: z8.string().optional(),
+  message: z11.string().optional(),
   /** `committed` — **absent** (lookup failed/skipped) and **`null`** (no CI configured) both
    *  render no glyph, but stay distinct values. */
   checks: checksGlyphSchema.optional(),
-  label: z8.object({ name: z8.string(), color: z8.string().optional() }).optional(),
+  label: z11.object({ name: z11.string(), color: z11.string().optional() }).optional(),
   /** `assigned`/`unassigned` login, or the new title for `renamed`. */
-  subject: z8.string().optional(),
-  refNumber: z8.number().optional(),
-  refTitle: z8.string().optional(),
-  refIsPr: z8.boolean().optional()
-});
-var githubCommentsDataSchema = z8.object({
-  available: z8.boolean(),
-  reason: z8.string().optional(),
+  subject: z11.string().optional(),
+  refNumber: z11.number().optional(),
+  refTitle: z11.string().optional(),
+  refIsPr: z11.boolean().optional()
+});
+var githubCommentsDataSchema = z11.object({
+  available: z11.boolean(),
+  reason: z11.string().optional(),
   /** Chronological, oldest first. */
-  comments: z8.array(githubCommentSchema),
+  comments: z11.array(githubCommentSchema),
   /** True when either stream hit its cap, or the timeline fetch stopped short. */
-  truncated: z8.boolean().optional(),
+  truncated: z11.boolean().optional(),
   /** Timeline events (#525) — additive; absent when the server degraded to the legacy
    *  comments-only fetch. Capped independently of `comments`. */
-  events: z8.array(githubTimelineEventSchema).optional()
-});
-var githubMergeMethodSchema = z8.enum(["merge", "squash", "rebase"]);
-var githubPrCheckSchema = z8.object({
-  name: z8.string(),
-  state: z8.enum(["passing", "failing", "pending", "unknown"]),
-  required: z8.boolean().nullable(),
-  url: z8.string().optional()
-});
-var githubPrMergeStateSchema = z8.object({
-  number: z8.number(),
-  title: z8.string(),
-  url: z8.string(),
-  state: z8.enum(["open", "closed", "merged"]),
-  isDraft: z8.boolean(),
-  headRef: z8.string(),
-  baseRef: z8.string(),
-  headSha: z8.string(),
-  mergeable: z8.enum(["mergeable", "conflicting", "unknown"]),
-  reviewDecision: z8.enum(["approved", "changes-requested", "review-required", "unknown"]),
-  checks: z8.array(githubPrCheckSchema),
-  methods: z8.array(githubMergeMethodSchema),
+  events: z11.array(githubTimelineEventSchema).optional()
+});
+var githubMergeMethodSchema = z11.enum(["merge", "squash", "rebase"]);
+var githubPrCheckSchema = z11.object({
+  name: z11.string(),
+  state: z11.enum(["passing", "failing", "pending", "unknown"]),
+  required: z11.boolean().nullable(),
+  url: z11.string().optional()
+});
+var githubPrMergeStateSchema = z11.object({
+  number: z11.number(),
+  title: z11.string(),
+  url: z11.string(),
+  state: z11.enum(["open", "closed", "merged"]),
+  isDraft: z11.boolean(),
+  headRef: z11.string(),
+  baseRef: z11.string(),
+  headSha: z11.string(),
+  mergeable: z11.enum(["mergeable", "conflicting", "unknown"]),
+  reviewDecision: z11.enum(["approved", "changes-requested", "review-required", "unknown"]),
+  checks: z11.array(githubPrCheckSchema),
+  methods: z11.array(githubMergeMethodSchema),
   defaultMethod: githubMergeMethodSchema.nullable(),
-  eligibility: z8.enum(["ready", "blocked", "pending", "unauthorized", "terminal", "unknown"]),
-  blockers: z8.array(z8.object({ code: z8.string(), message: z8.string() })),
-  canMerge: z8.boolean(),
-  canOverride: z8.boolean()
-});
-var githubPrMergeStateResponseSchema = z8.discriminatedUnion("available", [
-  z8.object({ available: z8.literal(true), mergeState: githubPrMergeStateSchema }),
-  z8.object({ available: z8.literal(false), reason: z8.string() })
+  eligibility: z11.enum(["ready", "blocked", "pending", "unauthorized", "terminal", "unknown"]),
+  blockers: z11.array(z11.object({ code: z11.string(), message: z11.string() })),
+  canMerge: z11.boolean(),
+  canOverride: z11.boolean()
+});
+var githubPrMergeStateResponseSchema = z11.discriminatedUnion("available", [
+  z11.object({ available: z11.literal(true), mergeState: githubPrMergeStateSchema }),
+  z11.object({ available: z11.literal(false), reason: z11.string() })
 ]);
-var githubMergeResponseSchema = z8.object({
-  merged: z8.literal(true),
-  number: z8.number(),
-  url: z8.string(),
+var githubMergeResponseSchema = z11.object({
+  merged: z11.literal(true),
+  number: z11.number(),
+  url: z11.string(),
   method: githubMergeMethodSchema,
-  mergeCommitSha: z8.string().optional()
-});
-var githubPrChangeSchema = z8.object({
-  path: z8.string(),
-  previousPath: z8.string().optional(),
-  status: z8.enum(["added", "modified", "removed", "renamed", "copied", "changed"]),
-  additions: z8.number(),
-  deletions: z8.number(),
-  patch: z8.string().optional(),
-  patchUnavailableReason: z8.enum(["binary", "too-large", "not-provided"]).optional(),
-  truncated: z8.boolean().optional()
-});
-var githubPrChangesDataSchema = z8.discriminatedUnion("available", [
-  z8.object({
-    available: z8.literal(true),
-    number: z8.number(),
-    headSha: z8.string(),
-    files: z8.array(githubPrChangeSchema),
-    additions: z8.number(),
-    deletions: z8.number(),
-    truncated: z8.boolean(),
+  mergeCommitSha: z11.string().optional()
+});
+var githubPrChangeSchema = z11.object({
+  path: z11.string(),
+  previousPath: z11.string().optional(),
+  status: z11.enum(["added", "modified", "removed", "renamed", "copied", "changed"]),
+  additions: z11.number(),
+  deletions: z11.number(),
+  patch: z11.string().optional(),
+  patchUnavailableReason: z11.enum(["binary", "too-large", "not-provided"]).optional(),
+  truncated: z11.boolean().optional()
+});
+var githubPrChangesDataSchema = z11.discriminatedUnion("available", [
+  z11.object({
+    available: z11.literal(true),
+    number: z11.number(),
+    headSha: z11.string(),
+    files: z11.array(githubPrChangeSchema),
+    additions: z11.number(),
+    deletions: z11.number(),
+    truncated: z11.boolean(),
     /** Present when the payload is complete but partial in some other way (a capped patch). */
-    reason: z8.string().optional()
+    reason: z11.string().optional()
   }),
-  z8.object({ available: z8.literal(false), reason: z8.string() })
+  z11.object({ available: z11.literal(false), reason: z11.string() })
 ]);
 
 // ../contract/src/workflows.ts
-import { z as z9 } from "zod";
-var workflowStepDefSchema = z9.object({
-  id: z9.string().min(1),
-  name: z9.string().optional(),
+import { z as z12 } from "zod";
+var workflowStepDefSchema = z12.object({
+  id: z12.string().min(1),
+  name: z12.string().optional(),
   // agent step
-  prompt: z9.string().optional(),
-  skill: z9.string().optional(),
-  model: z9.string().optional(),
-  effort: z9.string().max(32).optional(),
+  prompt: z12.string().optional(),
+  skill: z12.string().optional(),
+  model: z12.string().optional(),
+  effort: z12.string().max(32).optional(),
   /** Per-step agent backend override (falls back to the task / config default). */
   runner: runnerSchema.optional(),
   /** Agent account id for this step (spec 2026-07-29-agent-profiles); resolved per step for owned workers (#452). */
-  agentProfile: z9.string().min(1).max(64).optional(),
-  allowedTools: z9.array(z9.string()).optional(),
-  bashAllowlist: z9.array(z9.string()).optional(),
+  agentProfile: z12.string().min(1).max(64).optional(),
+  allowedTools: z12.array(z12.string()).optional(),
+  bashAllowlist: z12.array(z12.string()).optional(),
   // check step
-  command: z9.string().optional(),
-  onFail: z9.object({
-    retry: z9.string().min(1),
-    max: z9.number().int().positive().default(2)
+  command: z12.string().optional(),
+  onFail: z12.object({
+    retry: z12.string().min(1),
+    max: z12.number().int().positive().default(2)
   }).optional()
 }).refine((s) => Boolean(s.command) !== Boolean(s.prompt ?? s.skill), {
   message: "a step is either an agent step (prompt/skill) or a check step (command), not both"
 });
-var workflowDefSchema = z9.object({
-  name: z9.string(),
-  description: z9.string().optional(),
-  steps: z9.array(workflowStepDefSchema),
-  source: z9.enum(["built-in", "file"]),
+var workflowDefSchema = z12.object({
+  name: z12.string(),
+  description: z12.string().optional(),
+  steps: z12.array(workflowStepDefSchema),
+  source: z12.enum(["built-in", "file"]),
   /** Absent on built-ins — which is exactly what makes them undeletable. */
-  path: z9.string().optional()
+  path: z12.string().optional()
 });
 function providersRequiredByWorkflow(workflow, fallback) {
   const required = /* @__PURE__ */ new Set();
@@ -828,46 +1245,46 @@ function providersRequiredByWorkflow(workflow, fallback) {
   }
   return runnerSchema.options.filter((provider) => required.has(provider));
 }
-var workflowLoadIssueSchema = z9.object({
-  path: z9.string(),
-  message: z9.string()
-});
-var workflowsResponseSchema = z9.object({
-  workflows: z9.array(workflowDefSchema),
-  issues: z9.array(workflowLoadIssueSchema)
-});
-var saveWorkflowInputSchema = z9.object({
-  name: z9.string().trim().min(1).max(80),
-  description: z9.string().max(2e3, "must be at most 2000 characters").optional(),
-  steps: z9.array(workflowStepDefSchema).min(1).max(8).optional(),
-  skills: z9.array(z9.string().trim().min(1)).min(1).max(8).optional(),
-  overwrite: z9.boolean().optional()
+var workflowLoadIssueSchema = z12.object({
+  path: z12.string(),
+  message: z12.string()
+});
+var workflowsResponseSchema = z12.object({
+  workflows: z12.array(workflowDefSchema),
+  issues: z12.array(workflowLoadIssueSchema)
+});
+var saveWorkflowInputSchema = z12.object({
+  name: z12.string().trim().min(1).max(80),
+  description: z12.string().max(2e3, "must be at most 2000 characters").optional(),
+  steps: z12.array(workflowStepDefSchema).min(1).max(8).optional(),
+  skills: z12.array(z12.string().trim().min(1)).min(1).max(8).optional(),
+  overwrite: z12.boolean().optional()
 }).refine((b) => Boolean(b.steps) !== Boolean(b.skills), {
   message: 'provide either "steps" or "skills", not both'
 });
-var saveWorkflowResponseSchema = z9.object({
-  path: z9.string(),
-  name: z9.string()
+var saveWorkflowResponseSchema = z12.object({
+  path: z12.string(),
+  name: z12.string()
 });
-var parsedWorkflowSchema = z9.object({
-  name: z9.string(),
-  description: z9.string().optional(),
-  steps: z9.array(workflowStepDefSchema)
+var parsedWorkflowSchema = z12.object({
+  name: z12.string(),
+  description: z12.string().optional(),
+  steps: z12.array(workflowStepDefSchema)
 });
-var deleteWorkflowResponseSchema = z9.object({
-  ok: z9.literal(true),
-  path: z9.string()
+var deleteWorkflowResponseSchema = z12.object({
+  ok: z12.literal(true),
+  path: z12.string()
 });
-var planResponseSchema = z9.object({
+var planResponseSchema = z12.object({
   /** The kebab-case workflow title the planner proposed. Absent on the degraded fallback. */
-  name: z9.string().optional(),
-  steps: z9.array(workflowStepDefSchema),
-  rationale: z9.string(),
-  fallback: z9.boolean()
+  name: z12.string().optional(),
+  steps: z12.array(workflowStepDefSchema),
+  rationale: z12.string(),
+  fallback: z12.boolean()
 });
 
 // ../contract/src/runs.ts
-var runStatusSchema = z10.enum([
+var runStatusSchema = z13.enum([
   "queued",
   "running",
   "waiting",
@@ -876,8 +1293,8 @@ var runStatusSchema = z10.enum([
   "failed",
   "cancelled"
 ]);
-var runActivitySchema = z10.enum(["monitoring"]);
-var stepStatusSchema = z10.enum([
+var runActivitySchema = z13.enum(["monitoring"]);
+var stepStatusSchema = z13.enum([
   "pending",
   "running",
   "waiting",
@@ -887,16 +1304,16 @@ var stepStatusSchema = z10.enum([
   "cancelled",
   "skipped"
 ]);
-var usageCounterSchema = z10.number().finite().nonnegative();
-var stepStateSchema = z10.object({
-  id: z10.string(),
-  name: z10.string(),
-  kind: z10.enum(["agent", "check"]),
+var usageCounterSchema = z13.number().finite().nonnegative();
+var stepStateSchema = z13.object({
+  id: z13.string(),
+  name: z13.string(),
+  kind: z13.enum(["agent", "check"]),
   status: stepStatusSchema,
-  iterations: z10.number(),
+  iterations: z13.number(),
   /** Durable count of onFail retry loops consumed by this check. */
-  retriesUsed: z10.number().int().nonnegative().optional(),
-  tokensUsed: z10.number(),
+  retriesUsed: z13.number().int().nonnegative().optional(),
+  tokensUsed: z13.number(),
   inputTokens: usageCounterSchema.optional(),
   outputTokens: usageCounterSchema.optional(),
   usageInvocationsStarted: usageCounterSchema.optional(),
@@ -904,99 +1321,103 @@ var stepStateSchema = z10.object({
   usageTurnsStarted: usageCounterSchema.optional(),
   usageTurnsRecorded: usageCounterSchema.optional(),
   usageInvocationEpoch: usageCounterSchema.optional(),
-  startedAt: z10.string().optional(),
-  finishedAt: z10.string().optional(),
-  error: z10.string().optional(),
+  startedAt: z13.string().optional(),
+  finishedAt: z13.string().optional(),
+  error: z13.string().optional(),
   /** Latest agent session id — `claude --resume <id>` and friends. */
-  sessionId: z10.string().optional(),
+  sessionId: z13.string().optional(),
   /** Backend that owns `sessionId`; absent on records written before backend affinity. */
   backend: runnerSchema.optional(),
   /** Agent account (spec 2026-07-29-agent-profiles) that owns `sessionId` — `default`, or a
    *  stored profile id. The two are a PAIR: a session id only resolves inside the config dir
    *  that created it, so resume and Continue read this rather than the project's current
    *  selection. Absent on records written before accounts existed. */
-  profileId: z10.string().optional(),
-  costUsd: z10.number().optional(),
+  profileId: z13.string().optional(),
+  costUsd: z13.number().optional(),
   /** Explicit provenance for engine-generated continuation steps. */
-  synthetic: z10.literal("continuation").optional()
+  synthetic: z13.literal("continuation").optional()
 });
-var diffStatSchema = z10.object({
-  adds: z10.number(),
-  dels: z10.number(),
-  files: z10.number(),
+var diffStatSchema = z13.object({
+  adds: z13.number(),
+  dels: z13.number(),
+  files: z13.number(),
   /** Additive since #751, and present ONLY when true: the numbers were measured against a
    *  branch the agent checked out into the task's worktree, as the run found it, because the
    *  worktree's HEAD had been repointed off the task's own branch (every review/QA run does
    *  this) and the merge-base anchor would otherwise have reported that branch's entire diff
    *  as this task's. Absent on every normal run and on every record written before #751 — a
    *  consumer that ignores it sees exactly the old shape. */
-  repointed: z10.boolean().optional()
+  repointed: z13.boolean().optional()
 });
-var queuedMessageSchema = z10.object({
-  id: z10.string(),
-  text: z10.string(),
+var queuedMessageSchema = z13.object({
+  id: z13.string(),
+  text: z13.string(),
   /** `/api/v1/runs/:id/images/…` URLs — attachments are persisted, never inlined. Images and
    *  files share this one list; read `isImageAttachmentName` on the file name to tell them apart. */
-  images: z10.array(z10.string()).optional(),
-  createdAt: z10.string()
+  images: z13.array(z13.string()).optional(),
+  createdAt: z13.string()
 });
 var continuationMessageSchema = queuedMessageSchema.extend({
-  origin: z10.enum(["human", "lifecycle"]).optional(),
+  origin: z13.enum(["human", "lifecycle"]).optional(),
   /** An attributed parent message used as the opening prompt, never a human answer. */
-  agentInputId: z10.uuid().optional()
+  agentInputId: z13.uuid().optional()
 });
-var processUsageSchema = z10.object({
+var processUsageSchema = z13.object({
   /** Sum of `%cpu` across the tree — can exceed 100 on multi-core work. */
-  cpuPct: z10.number(),
-  rssBytes: z10.number(),
-  procCount: z10.number()
+  cpuPct: z13.number(),
+  rssBytes: z13.number(),
+  procCount: z13.number()
 });
-var runRecordSchema = z10.object({
-  id: z10.string(),
-  title: z10.string(),
+var runWebhookOutcomeSchema = z13.object({
+  lastDeliveredAt: z13.string().optional(),
+  lastError: z13.string().max(512).optional()
+});
+var runRecordSchema = z13.object({
+  id: z13.string(),
+  title: z13.string(),
   /** Display title (#389): auto-derived from the first agent turn, or the user's inline edit
    *  (`PATCH /runs/:id` sets it together with `title`). Show `titleSummary ?? title`. */
-  titleSummary: z10.string().optional(),
+  titleSummary: z13.string().optional(),
   /** Refreshed on every turn-end; absent until the first turn ends (and on worktree-less runs). */
   diffStat: diffStatSchema.optional(),
-  workflow: z10.string(),
-  task: z10.string(),
+  workflow: z13.string(),
+  task: z13.string(),
   /** Prompt messages stacked onto the run while it waited for a free agent slot (#472). Folded
    *  into the prompt at dequeue — never delivered as their own turns. Absent on pre-#472 runs. */
-  queuedMessages: z10.array(queuedMessageSchema).optional(),
+  queuedMessages: z13.array(queuedMessageSchema).optional(),
   /** Stop was accepted; execution termination is still pending. */
-  stopping: z10.boolean().optional(),
+  stopping: z13.boolean().optional(),
   /** Opening Continue message, retained until its first completed turn for crash recovery. */
   continuationMessage: continuationMessageSchema.optional(),
   /** The last turn carried a malformed explicit structured question. */
-  invalidAsk: z10.boolean().optional(),
+  invalidAsk: z13.boolean().optional(),
   /** Owned-run authority; absence is legacy, invalid is explicitly quarantined. */
   delegation: delegationStateSchema.optional(),
   /** Durable non-human input, kept separate from human prompt/answer queues. */
-  agentInputs: z10.array(agentInputSchema).optional(),
+  agentInputs: z13.array(agentInputSchema).optional(),
   ciWait: ciWaitSchema.optional(),
   lastCiWait: ciWaitSchema.optional(),
   /** Retained recovery observation when previous CI metadata cannot be trusted. */
-  lastCiWaitError: z10.string().max(256).optional(),
+  lastCiWaitError: z13.string().max(256).optional(),
   /** URLs of images and document attachments on the initial task prompt; branch on isImageAttachmentName. */
-  taskImages: z10.array(z10.string()).optional(),
-  model: z10.string().optional(),
+  taskImages: z13.array(z13.string()).optional(),
+  model: z13.string().optional(),
   /** Reasoning-effort pin (#45). Canonical `low`/`medium`/`high`/`xhigh`/`max`.
    *  Absent = harness default. Additive: pre-#45 records omit it and still parse. */
-  effort: z10.string().max(32).optional(),
+  effort: z13.string().max(32).optional(),
   /** Normalized provider/model identity used for attribution and reproducible replay. */
-  modelIdentity: z10.string().optional(),
+  modelIdentity: z13.string().optional(),
   runner: runnerSchema.optional(),
   /** The composer's per-task agent account (spec 2026-07-29-agent-profiles), applying to steps
    *  on `runner`. Absent = the run follows the project's own selection. */
-  agentProfile: z10.string().optional(),
+  agentProfile: z13.string().optional(),
   /** Echo of the extra system prompt the run used (POST override or config default). */
-  systemPrompt: z10.string().optional(),
+  systemPrompt: z13.string().optional(),
   /** false when the run deliberately disabled follow-up todo generation. Absent means enabled. */
-  generateFollowups: z10.boolean().optional(),
+  generateFollowups: z13.boolean().optional(),
   /** Autonomous mode (#autonomous): the run never parks at `waiting` or the terminal `review`
    *  gate. Absent = falsy = not autonomous. */
-  autonomous: z10.boolean().optional(),
+  autonomous: z13.boolean().optional(),
   /**
    * Provenance for a task a project GitHub automation launched (#694). Absent on every ordinary
    * run, which is what makes it additive — the cockpit shows the "from automation" link only when
@@ -1006,97 +1427,107 @@ var runRecordSchema = z10.object({
    * launching definition matched, recorded on the run for the audit trail, and `src/runs/store.ts`
    * persists it as free text so an older cezar can still read a record written by a newer one.
    */
-  automation: z10.object({
-    automationId: z10.string(),
-    automationRevision: z10.number(),
-    receiptId: z10.string(),
-    event: z10.string(),
-    githubUrl: z10.string()
+  automation: z13.object({
+    automationId: z13.string(),
+    automationRevision: z13.number(),
+    receiptId: z13.string(),
+    event: z13.string(),
+    githubUrl: z13.string()
   }).optional(),
+  /** Task webhook opt-in (#589): the project's webhook receives this run's status changes.
+   *  Absent = off. Changes after start through `POST /runs/:id/notify`, which is why it is not
+   *  part of the idempotent-start hash. */
+  notify: z13.boolean().optional(),
+  /** The last webhook delivery's outcome (#589). Absent until a delivery was attempted. */
+  webhook: runWebhookOutcomeSchema.optional(),
   status: runStatusSchema,
   /** `monitoring` while `status === 'running'` and the agent is working on downstream work.
    *  Absent on old runs; cleared on resume/end. */
   activity: runActivitySchema.optional(),
   /** Derived from valid human questions and matching delivery receipts in durable history.
    * List attention only; never authorization to deliver an answer or wake a worker. */
-  hasPendingHumanAsk: z10.boolean().optional(),
+  hasPendingHumanAsk: z13.boolean().optional(),
   /** Exact ISO-8601 deadline for the next automatic monitoring check. */
-  monitoringWakeAt: z10.string().optional(),
+  monitoringWakeAt: z13.string().optional(),
   /** The current live monitoring epoch exhausted its 40 automatic checks. */
-  monitoringWakeCapReached: z10.boolean().optional(),
+  monitoringWakeCapReached: z13.boolean().optional(),
   /** Exact ISO-8601 instant this run resumes itself after a provider usage limit stopped it
    *  (spec 2026-08-03-auto-resume-after-usage-limit). Present only on a `failed` run with a
    *  pending automatic resume — its absence is what "no resume is scheduled" looks like. */
-  autoResumeAt: z10.string().optional(),
+  autoResumeAt: z13.string().optional(),
   /** Consecutive automatic resumes since the last human turn, against the safety cap. */
-  autoResumeAttempts: z10.number().optional(),
-  createdAt: z10.string(),
-  startedAt: z10.string().optional(),
-  finishedAt: z10.string().optional(),
-  tokensUsed: z10.number(),
+  autoResumeAttempts: z13.number().optional(),
+  createdAt: z13.string(),
+  startedAt: z13.string().optional(),
+  finishedAt: z13.string().optional(),
+  tokensUsed: z13.number(),
   inputTokens: usageCounterSchema.optional(),
   outputTokens: usageCounterSchema.optional(),
-  costUsd: z10.number().optional(),
-  pullRequestUrl: z10.string().optional(),
+  costUsd: z13.number().optional(),
+  pullRequestUrl: z13.string().optional(),
   /** The PR this task is ABOUT (#407) — auto-discovered from conversation references. Display
    *  tier only: `pullRequestUrl` (the PR this task CREATED) wins, and the action gates ignore it. */
-  referencedPullRequestUrl: z10.string().optional(),
+  referencedPullRequestUrl: z13.string().optional(),
   /** The PR/issue number this task is ABOUT (task auto-naming spec) — display tier only. */
-  prNumber: z10.number().optional(),
-  issueNumber: z10.number().optional(),
+  prNumber: z13.number().optional(),
+  issueNumber: z13.number().optional(),
   /** Server-side provenance: referenced-issue discovery currently owns `issueNumber`. */
-  referencedIssueNumberSeeded: z10.boolean().optional(),
+  referencedIssueNumberSeeded: z13.boolean().optional(),
   /** 'user' = renamed via PATCH, never auto-overwritten; 'marker' = agent-declared via
    *  CEZ:TITLE (spec 2026-07-18-task-ref-markers); 'auto' = namer-owned. */
-  titleOrigin: z10.enum(["user", "auto", "marker"]).optional(),
+  titleOrigin: z13.enum(["user", "auto", "marker"]).optional(),
   /** References the agent declared via CEZ:PR/CEZ:ISSUE markers — authoritative over the namer
    *  for the matching kind. */
-  markerRefs: z10.object({ pr: z10.number().optional(), issue: z10.number().optional() }).optional(),
+  markerRefs: z13.object({ pr: z13.number().optional(), issue: z13.number().optional() }).optional(),
   /** The referenced tier's working set (distinct PR URLs spotted, capped server-side). */
-  referencedPrCandidates: z10.array(z10.string()).optional(),
+  referencedPrCandidates: z13.array(z13.string()).optional(),
   /** The issue this task is ABOUT (spec 2026-07-21-report-ref-discovery). Display-only. */
-  referencedIssueUrl: z10.string().optional(),
+  referencedIssueUrl: z13.string().optional(),
   /** The referenced-issue working set, persisted like `referencedPrCandidates`. Capped. */
-  referencedIssueCandidates: z10.array(z10.string()).optional(),
+  referencedIssueCandidates: z13.array(z13.string()).optional(),
   /** Explicit execution policy. `false` means the run intentionally uses the repo root;
    *  absent on older runs and for the default isolated-worktree mode. */
-  worktree: z10.literal(false).optional(),
+  worktree: z13.literal(false).optional(),
   /** Absent for in-place runs and after an isolated worktree is removed. */
-  worktreePath: z10.string().optional(),
-  branch: z10.string().optional(),
+  worktreePath: z13.string().optional(),
+  branch: z13.string().optional(),
   /** Stable baseline for session git views: a worktree's fork ref, or an in-place run's starting commit. */
-  baseBranch: z10.string().optional(),
+  baseBranch: z13.string().optional(),
   /** Set when count-based retention (#483) reclaimed the worktree DIRECTORY (the branch is
    *  kept): the dir is gone but recoverable. */
-  worktreeReclaimedAt: z10.string().optional(),
+  worktreeReclaimedAt: z13.string().optional(),
   /** Parallel variants (spec 010): runs sharing a groupId are one group. */
-  groupId: z10.string().optional(),
+  groupId: z13.string().optional(),
   /** Variant letter within the group — 'A' | 'B' | 'C'. */
-  variant: z10.string().optional(),
-  peakRssBytes: z10.number().optional(),
-  peakProcCount: z10.number().optional(),
-  archived: z10.boolean(),
-  archivedAt: z10.string().optional(),
+  variant: z13.string().optional(),
+  /** Idempotent start (#504): the caller's request id and the hash of the start payload it
+   *  named (`src/runs/client-request.ts`). Absent on every run started without one. */
+  clientRequestId: z13.string().optional(),
+  clientRequestHash: z13.string().optional(),
+  peakRssBytes: z13.number().optional(),
+  peakProcCount: z13.number().optional(),
+  archived: z13.boolean(),
+  archivedAt: z13.string().optional(),
   /** Pinned to the top of this project's task list (#935) — the `Pinned` group above
    *  `Needs you`. Optional, unlike `archived`: absent IS "not pinned", which is what every
    *  record written before this carries, and the store never writes `false`. Archiving
    *  clears it, because archiving is how a user resigns from a task. */
-  pinned: z10.boolean().optional(),
+  pinned: z13.boolean().optional(),
   /** When the pin was set. Deliberately WRITE-ONLY today, like the `archivedAt` above it:
    *  ordering inside `Pinned` uses the ordinary status/recency rules, so nothing reads this
    *  yet. It is here because a field on a protected surface is far cheaper to add now than to
    *  add later — "pinned oldest first" and "unpin what you pinned a month ago" both need it,
    *  and neither can be reconstructed after the fact. */
-  pinnedAt: z10.string().optional(),
+  pinnedAt: z13.string().optional(),
   /** Read receipt (#unread-done-items): ISO time the cockpit last opened this run's
    *  thread. A finished (`done`/`failed`) run reads as *unread* until seen since it
    *  finished — see `isUnread()` in the cockpit's `lib/read-state.ts`. Absent on old
    *  runs, on any run not yet opened, and on one deliberately put back to unread via
    *  `POST /runs/:id/unread` (#775) — all three count as unread. */
-  seenAt: z10.string().optional(),
-  currentStepId: z10.string().optional(),
-  error: z10.string().optional(),
-  steps: z10.array(stepStateSchema),
+  seenAt: z13.string().optional(),
+  currentStepId: z13.string().optional(),
+  error: z13.string().optional(),
+  steps: z13.array(stepStateSchema),
   /**
    * The persisted workflow definition, so a `queued` run survives a restart — including the ad-hoc
    * "(planned)" chains that exist nowhere else.
@@ -1114,48 +1545,48 @@ var runRecordSchema = z10.object({
 var apiRunSchema = runRecordSchema.extend({
   /** Read-only GET /runs/:id verdict: null permits Finish, a string explains refusal.
    * Absent on lists, stored records and mutation responses; absence is not permission. */
-  finishBlocked: z10.string().nullable().optional(),
+  finishBlocked: z13.string().nullable().optional(),
   /** Server-resolved Cursor CLI command, including the configured executable. Never persisted. */
-  cliResumeCommand: z10.string().optional(),
+  cliResumeCommand: z13.string().optional(),
   usage: processUsageSchema.optional()
 });
-var runIndexEntrySchema = z10.object({
+var runIndexEntrySchema = z13.object({
   /** The registered project this run belongs to. Joins against `GET /projects`. */
-  projectId: z10.string(),
-  id: z10.string(),
-  title: z10.string(),
-  titleSummary: z10.string().optional(),
-  titleOrigin: z10.enum(["user", "auto", "marker"]).optional(),
+  projectId: z13.string(),
+  id: z13.string(),
+  title: z13.string(),
+  titleSummary: z13.string().optional(),
+  titleOrigin: z13.enum(["user", "auto", "marker"]).optional(),
   status: runStatusSchema,
   activity: runActivitySchema.optional(),
   hasPendingHumanAsk: runRecordSchema.shape.hasPendingHumanAsk,
   /** Only the relationship role and wait phase used by list attention. */
   delegation: runDelegationSummarySchema.optional(),
-  createdAt: z10.string(),
-  finishedAt: z10.string().optional(),
+  createdAt: z13.string(),
+  finishedAt: z13.string().optional(),
   /** With `status`/`finishedAt`/`archived`, the four inputs `isUnread` reads — what lets the
    *  palette lead with "finished while you weren't looking" across every project, not just the
    *  one you happen to be standing in. */
-  seenAt: z10.string().optional(),
+  seenAt: z13.string().optional(),
   /** Always present, like `RunRecord.archived`: absent would read as "not archived", and the
    *  unread rule treats archiving as a stronger "done with this" than reading. */
-  archived: z10.boolean(),
+  archived: z13.boolean(),
   /** A run parked by a provider usage limit is `failed` on the record with a resume booked
    *  (spec 2026-08-03-auto-resume-after-usage-limit). Both `deriveAttention` and `isUnread` read
    *  it, so without it here a cross-project row would show a red "failed" dot and land in
    *  Recently finished for work that is simply waiting for its appointment. */
-  autoResumeAt: z10.string().optional(),
+  autoResumeAt: z13.string().optional(),
   /** The workflow the run executes — the global Tasks page shows it in a column and groups by
    *  it. Always present on the record (`RunRecord.workflow`), so required here; the display
    *  refinement `workflowLabel` applies needs `steps[]`, which this row deliberately omits, so
    *  a `(planned)` chain reads as itself here rather than as its first agent's name. */
-  workflow: z10.string(),
+  workflow: z13.string(),
   /** The task's branch, when it has one — a column on the global page, and the one field that
    *  makes a cross-project row identifiable at a glance without opening it. */
-  branch: z10.string().optional(),
+  branch: z13.string().optional(),
   /** When the agent actually started, as opposed to when the task was created. The global page's
    *  age column prefers it and falls back to `createdAt`, exactly as the per-project table does. */
-  startedAt: z10.string().optional(),
+  startedAt: z13.string().optional(),
   /**
    * The six fields `taskReference()` (`web/src/lib/tasks-table.ts`) reads to decide a task's PR
    * or issue chip. Carried verbatim rather than pre-resolved into a `{kind, number, url}` on the
@@ -1167,20 +1598,20 @@ var runIndexEntrySchema = z10.object({
    * Six scalars is still the slim row this schema exists to keep: `steps[]` and `workflowDef`,
    * the expensive half, stay off it.
    */
-  pullRequestUrl: z10.string().optional(),
-  referencedPullRequestUrl: z10.string().optional(),
-  prNumber: z10.number().optional(),
-  issueNumber: z10.number().optional(),
-  referencedIssueUrl: z10.string().optional(),
-  markerRefs: z10.object({ pr: z10.number().optional(), issue: z10.number().optional() }).optional(),
+  pullRequestUrl: z13.string().optional(),
+  referencedPullRequestUrl: z13.string().optional(),
+  prNumber: z13.number().optional(),
+  issueNumber: z13.number().optional(),
+  referencedIssueUrl: z13.string().optional(),
+  markerRefs: z13.object({ pr: z13.number().optional(), issue: z13.number().optional() }).optional(),
   /** What the run has cost so far. Absent means nothing was recorded, which is NOT `$0` — the
    *  cockpit prints an em dash rather than claiming a measurement that never happened. */
-  costUsd: z10.number().optional(),
+  costUsd: z13.number().optional(),
   /** The persisted high-water marks a FINISHED run leaves behind. `usage` below stops existing
    *  the moment the process tree does, so without these a finished row could say nothing at all
    *  about what it took to run. */
-  peakRssBytes: z10.number().optional(),
-  peakProcCount: z10.number().optional(),
+  peakRssBytes: z13.number().optional(),
+  peakProcCount: z13.number().optional(),
   /**
    * The live CPU/RSS sample of this run's process tree, attached on the way out exactly as
    * `GET /runs` attaches it (`withUsage`) — never persisted.
@@ -1192,90 +1623,90 @@ var runIndexEntrySchema = z10.object({
    */
   usage: processUsageSchema.optional()
 });
-var referenceStatusesByProjectSchema = z10.record(
-  z10.string(),
-  z10.object({
-    prs: z10.record(z10.number(), referenceStatusSchema),
-    issues: z10.record(z10.number(), referenceStatusSchema)
+var referenceStatusesByProjectSchema = z13.record(
+  z13.string(),
+  z13.object({
+    prs: z13.record(z13.number(), referenceStatusSchema),
+    issues: z13.record(z13.number(), referenceStatusSchema)
   })
 );
-var runsIndexResponseSchema = z10.object({
+var runsIndexResponseSchema = z13.object({
   /** Newest first, across every registered project. Archived runs are included — `GET /runs`
    *  carries them for the project you are standing in, and a finder that dropped them elsewhere
    *  would make a task vanish the moment you left its project. */
-  runs: z10.array(runIndexEntrySchema),
+  runs: z13.array(runIndexEntrySchema),
   /** Additive: absent statuses mean "nothing warm", never "nothing to show". */
   referenceStatuses: referenceStatusesByProjectSchema,
   /** The per-project cap that produced this list. */
-  perProjectLimit: z10.number(),
+  perProjectLimit: z13.number(),
   /** Ids of the projects that had more runs than the cap allowed. */
-  truncated: z10.array(z10.string())
+  truncated: z13.array(z13.string())
 });
-var createRunResponseSchema = z10.union([
+var createRunResponseSchema = z13.union([
   runRecordSchema,
-  z10.object({ runs: z10.array(runRecordSchema) })
+  z13.object({ runs: z13.array(runRecordSchema) })
 ]);
-var cancelResponseSchema = z10.object({ cancelled: z10.boolean() });
-var cancelAutoResumeResponseSchema = z10.object({ cancelled: z10.literal(true) });
-var archiveFinishedResponseSchema = z10.object({ archived: z10.number() });
-var markAllReadResponseSchema = z10.object({ read: z10.number() });
-var deleteRunResponseSchema = z10.object({ deleted: z10.literal(true) });
-var finishResponseSchema = z10.object({ finished: z10.literal(true) });
-var continueResponseSchema = z10.object({ continued: z10.literal(true) });
-var createPrResponseSchema = z10.object({
-  url: z10.string(),
-  dryRun: z10.boolean()
-});
-var messageResponseSchema = z10.union([
-  z10.object({ delivered: z10.literal(true) }),
-  z10.object({ queued: z10.literal(true), message: queuedMessageSchema }),
-  z10.object({ deferred: z10.literal(true) })
+var cancelResponseSchema = z13.object({ cancelled: z13.boolean() });
+var cancelAutoResumeResponseSchema = z13.object({ cancelled: z13.literal(true) });
+var archiveFinishedResponseSchema = z13.object({ archived: z13.number() });
+var markAllReadResponseSchema = z13.object({ read: z13.number() });
+var deleteRunResponseSchema = z13.object({ deleted: z13.literal(true) });
+var finishResponseSchema = z13.object({ finished: z13.literal(true) });
+var continueResponseSchema = z13.object({ continued: z13.literal(true) });
+var createPrResponseSchema = z13.object({
+  url: z13.string(),
+  dryRun: z13.boolean()
+});
+var messageResponseSchema = z13.union([
+  z13.object({ delivered: z13.literal(true) }),
+  z13.object({ queued: z13.literal(true), message: queuedMessageSchema }),
+  z13.object({ deferred: z13.literal(true) })
 ]);
-var editQueuedMessageResponseSchema = z10.object({ message: queuedMessageSchema });
-var removeQueuedMessageResponseSchema = z10.object({ removed: z10.literal(true) });
-var openInCliResponseSchema = z10.object({
-  opened: z10.literal(true),
-  command: z10.string()
-});
-var removeWorktreeResponseSchema = z10.object({ removed: z10.literal(true) });
-var gitCommitResponseSchema = z10.object({
-  committed: z10.literal(true),
-  sha: z10.string()
-});
-var gitPushResponseSchema = z10.object({
-  pushed: z10.literal(true),
-  branch: z10.string(),
-  remote: z10.string(),
-  upstreamSet: z10.boolean()
-});
-var runCommitSchema = z10.object({
-  sha: z10.string(),
-  subject: z10.string(),
-  author: z10.string(),
+var editQueuedMessageResponseSchema = z13.object({ message: queuedMessageSchema });
+var removeQueuedMessageResponseSchema = z13.object({ removed: z13.literal(true) });
+var openInCliResponseSchema = z13.object({
+  opened: z13.literal(true),
+  command: z13.string()
+});
+var removeWorktreeResponseSchema = z13.object({ removed: z13.literal(true) });
+var gitCommitResponseSchema = z13.object({
+  committed: z13.literal(true),
+  sha: z13.string()
+});
+var gitPushResponseSchema = z13.object({
+  pushed: z13.literal(true),
+  branch: z13.string(),
+  remote: z13.string(),
+  upstreamSet: z13.boolean()
+});
+var runCommitSchema = z13.object({
+  sha: z13.string(),
+  subject: z13.string(),
+  author: z13.string(),
   /** Relative time ("3 hours ago") — git's `%cr`. */
-  when: z10.string()
+  when: z13.string()
 });
-var runCommitsResponseSchema = z10.object({ commits: z10.array(runCommitSchema) });
-var groupVariantSchema = z10.object({
-  id: z10.string(),
+var runCommitsResponseSchema = z13.object({ commits: z13.array(runCommitSchema) });
+var groupVariantSchema = z13.object({
+  id: z13.string(),
   /** 'A' | 'B' | 'C' in practice; `'?'` for a record that lost its letter. */
-  variant: z10.string(),
-  title: z10.string(),
+  variant: z13.string(),
+  title: z13.string(),
   status: runStatusSchema,
-  archived: z10.boolean(),
-  tokensUsed: z10.number(),
+  archived: z13.boolean(),
+  tokensUsed: z13.number(),
   inputTokens: usageCounterSchema.optional(),
   outputTokens: usageCounterSchema.optional(),
-  costUsd: z10.number().optional(),
-  diffStat: z10.string(),
+  costUsd: z13.number().optional(),
+  diffStat: z13.string(),
   /** First lines of the handoff journal's "## Progress log" section, as markdown. */
-  handoffExcerpt: z10.string()
+  handoffExcerpt: z13.string()
 });
-var groupResponseSchema = z10.object({
-  groupId: z10.string(),
-  runs: z10.array(groupVariantSchema)
+var groupResponseSchema = z13.object({
+  groupId: z13.string(),
+  runs: z13.array(groupVariantSchema)
 });
-var pickVariantResponseSchema = z10.object({
+var pickVariantResponseSchema = z13.object({
   winner: runRecordSchema.optional()
 });
 var FILE_ATTACHMENT_MEDIA_TYPES = [
@@ -1298,174 +1729,189 @@ function isImageAttachmentName(name) {
   const ext = name.split(".").pop()?.toLowerCase();
   return ext !== void 0 && IMAGE_ATTACHMENT_EXTENSIONS.has(ext);
 }
-var attachmentFileParamSchema = z10.object({
-  id: z10.string().min(1),
-  file: z10.string().regex(/^[A-Za-z0-9_-][A-Za-z0-9._-]*$/).refine((name) => !name.includes(".."))
+var attachmentFileParamSchema = z13.object({
+  id: z13.string().min(1),
+  file: z13.string().regex(/^[A-Za-z0-9_-][A-Za-z0-9._-]*$/).refine((name) => !name.includes(".."))
 });
-var attachmentInputSchema = z10.object({
-  mediaType: z10.string().refine(isAttachmentMediaType, {
+var attachmentInputSchema = z13.object({
+  mediaType: z13.string().refine(isAttachmentMediaType, {
     message: "unsupported attachment type \u2014 images, plain text, markdown and PDF only"
   }),
-  data: z10.string().min(1).max(7e6)
+  data: z13.string().min(1).max(7e6)
 });
 var imageInputSchema = attachmentInputSchema;
-var createRunInputBaseSchema = z10.object({
-  workflow: z10.string().min(1).optional(),
+var CLIENT_REQUEST_VARIANTS_ERROR = "clientRequestId names one run; it cannot be combined with variants > 1";
+var createRunInputBaseSchema = z13.object({
+  workflow: z13.string().min(1).optional(),
   /** An inline chain (spec 008 — an approved plan runs as an ad-hoc workflow, never written to
    *  a file). The catalog's own step shape, not a copy of it. */
-  steps: z10.array(workflowStepDefSchema).min(1).max(8).optional(),
-  task: z10.string().min(1).max(1e5, "must be at most 100000 characters"),
-  model: z10.string().optional(),
+  steps: z13.array(workflowStepDefSchema).min(1).max(8).optional(),
+  task: z13.string().min(1).max(1e5, "must be at most 100000 characters"),
+  model: z13.string().optional(),
   /** Reasoning-effort pin (#45). Omit for the harness default; empty/`auto` stay implicit. */
-  effort: z10.string().max(32).optional(),
+  effort: z13.string().max(32).optional(),
   runner: runnerSchema.optional(),
   /** Agent account for this task (spec 2026-07-29-agent-profiles). Omit to follow the
    *  project's own selection; an id that no longer exists is a 400, not a silent default. */
-  agentProfile: z10.string().max(64).optional(),
+  agentProfile: z13.string().max(64).optional(),
   /** 1–3. Above 1 the response is `{ runs }` rather than a single record. */
-  variants: z10.number().int().min(1).max(3).optional(),
+  variants: z13.number().int().min(1).max(3).optional(),
   /** false → run in the repo working tree instead of an isolated worktree (read-only skills).
    *  Omit for the default. Ignored server-side when variants > 1. */
-  worktree: z10.boolean().optional(),
+  worktree: z13.boolean().optional(),
   /** true → autonomous run: never parks at "waiting"; auto-continues until done. */
-  autonomous: z10.boolean().optional(),
+  autonomous: z13.boolean().optional(),
   /** false → keep the handoff journal but do not expose or request a follow-up todos file.
    *  Omit for the default (enabled); a server with the capability off pins it to false. */
-  generateFollowups: z10.boolean().optional(),
+  generateFollowups: z13.boolean().optional(),
   /** Per-run system-prompt override (R2 2.3) — programmatic callers only. Wins over the
    *  config.json default; whitespace-only degrades to absent. */
-  systemPrompt: z10.string().trim().max(2e4, "must be at most 20000 characters").optional().transform((s) => s ? s : void 0),
+  systemPrompt: z13.string().trim().max(2e4, "must be at most 20000 characters").optional().transform((s) => s ? s : void 0),
   /** Attachments pasted into the new-task form — screenshots, and since #950 PDF/TXT/MD files
    *  too; delivered with the first agent step. The key keeps its name: the wire contract widened
    *  in place rather than growing a second list. */
-  images: z10.array(attachmentInputSchema).max(4).optional(),
+  images: z13.array(attachmentInputSchema).max(4).optional(),
   /** The inbox entry this task came from (#374). Best-effort bookkeeping: an unknown or
    *  already-started id never fails the run. For ×2/×3 the FIRST variant is recorded. */
-  todoId: z10.string().min(1).max(200, "must be at most 200 characters").optional()
-});
-var createRunInputSchema = createRunInputBaseSchema.refine(
+  todoId: z13.string().min(1).max(200, "must be at most 200 characters").optional()
+});
+var createRunInputSchema = createRunInputBaseSchema.extend({
+  /** Idempotent start (#504): a retry with the same id and payload answers `200` with the run
+   *  the first request created; a different payload answers `409`. Scoped to the project. Not
+   *  on the base schema, so an automation's task definition cannot carry one. */
+  clientRequestId: z13.string().uuid().optional(),
+  /** Task webhook opt-in (#589). Absent = off. `true` on a project with no webhook is a 400.
+   *  Not on the base schema, and not part of the idempotent-start hash: it can change later. */
+  notify: z13.boolean().optional()
+}).refine(
   (b) => Boolean(b.workflow) !== Boolean(b.steps),
   { message: 'provide either "workflow" or "steps", not both' }
-);
-var messageInputSchema = z10.object({
-  text: z10.string().max(1e5).default(""),
-  images: z10.array(attachmentInputSchema).max(4).default([])
+).refine((b) => !(b.clientRequestId && (b.variants ?? 1) > 1), {
+  message: CLIENT_REQUEST_VARIANTS_ERROR
+});
+var messageInputSchema = z13.object({
+  text: z13.string().max(1e5).default(""),
+  images: z13.array(attachmentInputSchema).max(4).default([])
 }).refine((m) => m.text.trim().length > 0 || m.images.length > 0, {
   message: "message needs text or at least one attachment"
 });
-var patchRunInputSchema = z10.object({
-  title: z10.string().trim().min(1).max(300).optional(),
-  task: z10.string().trim().min(1).max(1e5).optional()
+var patchRunInputSchema = z13.object({
+  title: z13.string().trim().min(1).max(300).optional(),
+  task: z13.string().trim().min(1).max(1e5).optional()
+});
+var pinRunInputSchema = z13.object({ pinned: z13.boolean().optional() });
+var notifyRunInputSchema = z13.object({
+  notify: z13.boolean(),
+  message: z13.string().trim().max(1e5).optional().transform((text) => text ? text : void 0)
 });
-var pinRunInputSchema = z10.object({ pinned: z10.boolean().optional() });
 
 // ../contract/src/repo.ts
-import { z as z11 } from "zod";
-var statusEntrySchema = z11.object({
-  status: z11.string(),
-  path: z11.string()
-});
-var logEntrySchema = z11.object({
-  hash: z11.string(),
-  subject: z11.string(),
-  author: z11.string(),
-  when: z11.string()
-});
-var repoResponseSchema = z11.union([
-  z11.object({
-    info: z11.null(),
-    status: z11.array(z11.never()),
-    log: z11.array(z11.never()),
-    branches: z11.array(z11.never()),
-    baseBranch: z11.null()
+import { z as z14 } from "zod";
+var statusEntrySchema = z14.object({
+  status: z14.string(),
+  path: z14.string()
+});
+var logEntrySchema = z14.object({
+  hash: z14.string(),
+  subject: z14.string(),
+  author: z14.string(),
+  when: z14.string()
+});
+var repoResponseSchema = z14.union([
+  z14.object({
+    info: z14.null(),
+    status: z14.array(z14.never()),
+    log: z14.array(z14.never()),
+    branches: z14.array(z14.never()),
+    baseBranch: z14.null()
   }),
-  z11.object({
+  z14.object({
     info: repoInfoSchema,
-    status: z11.array(statusEntrySchema),
-    log: z11.array(logEntrySchema),
-    branches: z11.array(z11.string()),
-    baseBranch: z11.string().nullable()
+    status: z14.array(statusEntrySchema),
+    log: z14.array(logEntrySchema),
+    branches: z14.array(z14.string()),
+    baseBranch: z14.string().nullable()
   })
 ]);
-var repoBranchResponseSchema = z11.object({
-  branch: z11.string(),
-  created: z11.boolean()
-});
-var repoPullBranchesResponseSchema = z11.object({ branches: z11.array(z11.string()) });
-var repoPullInputSchema = z11.object({
-  branch: z11.string().trim().min(1).max(200).optional(),
-  confirm: z11.boolean().optional()
-});
-var repoPullResponseSchema = z11.object({
-  branch: z11.string(),
-  pulled: z11.literal(true),
-  summary: z11.string()
-});
-var repoPullConfirmationSchema = z11.object({
-  error: z11.string(),
-  branch: z11.string(),
-  risks: z11.array(z11.enum(["active_runs", "dirty_tree"]))
-});
-var repoPullErrorSchema = z11.union([
+var repoBranchResponseSchema = z14.object({
+  branch: z14.string(),
+  created: z14.boolean()
+});
+var repoPullBranchesResponseSchema = z14.object({ branches: z14.array(z14.string()) });
+var repoPullInputSchema = z14.object({
+  branch: z14.string().trim().min(1).max(200).optional(),
+  confirm: z14.boolean().optional()
+});
+var repoPullResponseSchema = z14.object({
+  branch: z14.string(),
+  pulled: z14.literal(true),
+  summary: z14.string()
+});
+var repoPullConfirmationSchema = z14.object({
+  error: z14.string(),
+  branch: z14.string(),
+  risks: z14.array(z14.enum(["active_runs", "dirty_tree"]))
+});
+var repoPullErrorSchema = z14.union([
   repoPullConfirmationSchema,
-  z11.object({ error: z11.string() })
+  z14.object({ error: z14.string() })
 ]);
-var diffStatSchema2 = z11.object({
-  adds: z11.number(),
-  dels: z11.number(),
-  files: z11.number()
+var diffStatSchema2 = z14.object({
+  adds: z14.number(),
+  dels: z14.number(),
+  files: z14.number()
 });
-var changedFileSchema = z11.object({
-  path: z11.string(),
+var changedFileSchema = z14.object({
+  path: z14.string(),
   /** Rename/copy source — present only when `status` is renamed/copied. */
-  oldPath: z11.string().optional(),
-  status: z11.enum(["added", "modified", "deleted", "renamed", "copied"]),
-  adds: z11.number(),
-  dels: z11.number(),
+  oldPath: z14.string().optional(),
+  status: z14.enum(["added", "modified", "deleted", "renamed", "copied"]),
+  adds: z14.number(),
+  dels: z14.number(),
   /** Binary per numstat — there is no text patch to render. */
-  binary: z11.boolean(),
+  binary: z14.boolean(),
   /** True when the path is one the raw-bytes route serves as an `<img>` (#365) — present only
    *  when true, so old clients that never read it stay correct. */
-  image: z11.boolean().optional(),
+  image: z14.boolean().optional(),
   /** This file's unified-diff section; possibly `… (patch truncated)`, possibly empty. */
-  patch: z11.string()
+  patch: z14.string()
 });
-var changesPayloadSchema = z11.object({
-  files: z11.array(changedFileSchema),
+var changesPayloadSchema = z14.object({
+  files: z14.array(changedFileSchema),
   stat: diffStatSchema2,
   /** Additive context for review tasks whose worktree HEAD no longer matches their own branch. */
-  repointedHead: z11.object({ headBranch: z11.string(), taskBranch: z11.string() }).optional()
+  repointedHead: z14.object({ headBranch: z14.string(), taskBranch: z14.string() }).optional()
 });
-var repoCommitPayloadSchema = z11.object({
-  sha: z11.string(),
-  subject: z11.string(),
-  author: z11.string(),
+var repoCommitPayloadSchema = z14.object({
+  sha: z14.string(),
+  subject: z14.string(),
+  author: z14.string(),
   /** Relative time ("3 hours ago") — same `%cr` format as the /api/v1/repo log. */
-  when: z11.string(),
-  files: z11.array(changedFileSchema),
+  when: z14.string(),
+  files: z14.array(changedFileSchema),
   stat: diffStatSchema2
 });
-var worktreeDirEntrySchema = z11.object({
-  name: z11.string(),
-  type: z11.enum(["dir", "file"]),
-  size: z11.number().optional()
+var worktreeDirEntrySchema = z14.object({
+  name: z14.string(),
+  type: z14.enum(["dir", "file"]),
+  size: z14.number().optional()
 });
-var worktreeEntrySchema = z11.discriminatedUnion("type", [
-  z11.object({
-    type: z11.literal("dir"),
-    path: z11.string(),
-    entries: z11.array(worktreeDirEntrySchema)
+var worktreeEntrySchema = z14.discriminatedUnion("type", [
+  z14.object({
+    type: z14.literal("dir"),
+    path: z14.string(),
+    entries: z14.array(worktreeDirEntrySchema)
   }),
-  z11.object({
-    type: z11.literal("file"),
-    path: z11.string(),
-    size: z11.number(),
-    binary: z11.boolean(),
-    tooLarge: z11.boolean(),
-    content: z11.string().optional()
+  z14.object({
+    type: z14.literal("file"),
+    path: z14.string(),
+    size: z14.number(),
+    binary: z14.boolean(),
+    tooLarge: z14.boolean(),
+    content: z14.string().optional()
   })
 ]);
-var worktreeRunStatusSchema = z11.enum([
+var worktreeRunStatusSchema = z14.enum([
   "queued",
   "running",
   "waiting",
@@ -1474,41 +1920,41 @@ var worktreeRunStatusSchema = z11.enum([
   "failed",
   "cancelled"
 ]);
-var worktreeInfoSchema = z11.object({
-  runId: z11.string(),
-  title: z11.string(),
+var worktreeInfoSchema = z14.object({
+  runId: z14.string(),
+  title: z14.string(),
   status: worktreeRunStatusSchema,
-  branch: z11.string().nullable(),
-  sizeBytes: z11.number().nullable(),
-  finishedAt: z11.string().nullable(),
-  reclaimable: z11.boolean()
+  branch: z14.string().nullable(),
+  sizeBytes: z14.number().nullable(),
+  finishedAt: z14.string().nullable(),
+  reclaimable: z14.boolean()
 });
-var worktreesResponseSchema = z11.object({
-  worktrees: z11.array(worktreeInfoSchema),
-  totalBytes: z11.number().nullable(),
-  keep: z11.number()
+var worktreesResponseSchema = z14.object({
+  worktrees: z14.array(worktreeInfoSchema),
+  totalBytes: z14.number().nullable(),
+  keep: z14.number()
 });
-var reclaimWorktreesResponseSchema = z11.object({
-  reclaimed: z11.array(z11.string())
+var reclaimWorktreesResponseSchema = z14.object({
+  reclaimed: z14.array(z14.string())
 });
 
 // ../contract/src/projects.ts
-import { z as z12 } from "zod";
-var projectListEntrySchema = z12.object({
-  id: z12.string(),
-  name: z12.string(),
+import { z as z15 } from "zod";
+var projectListEntrySchema = z15.object({
+  id: z15.string(),
+  name: z15.string(),
   /** Absolute, realpath-normalized repo root. */
-  root: z12.string(),
-  addedAt: z12.string(),
-  lastOpenedAt: z12.string(),
-  source: z12.enum(["local", "checkout"]),
+  root: z15.string(),
+  addedAt: z15.string(),
+  lastOpenedAt: z15.string(),
+  source: z15.enum(["local", "checkout"]),
   /** `not-git` is fully usable (degraded single-queue mode); only `missing` blocks. */
-  status: z12.enum(["ok", "missing", "not-git"]),
+  status: z15.enum(["ok", "missing", "not-git"]),
   /** Current branch when cheaply available (omitted e.g. on an unborn HEAD). */
-  branch: z12.string().optional(),
+  branch: z15.string().optional(),
   /** Which forge this project's remote belongs to (#698) — classified server-side from the
    *  remote URL alone. Gates the project group's GitHub nav item; omitted = no forge remote. */
-  forge: z12.literal("github").optional(),
+  forge: z15.literal("github").optional(),
   /**
    * The remote's web root, `https://github.com/owner/repo`. Rebuilt server-side from the parsed
    * remote rather than passed through, so a remote carrying credentials cannot leak into the
@@ -1518,10 +1964,10 @@ var projectListEntrySchema = z12.object({
    * the global Tasks page has one row per project, so it cannot use any single repo's base the
    * way a project-scoped view can. With this, every reference it shows is a link.
    */
-  repoUrl: z12.string().optional(),
+  repoUrl: z15.string().optional(),
   /** Per-project cap on concurrently running tasks (spec 2026-07-22). Omitted = inherit the
    *  workspace `resources.maxParallel`; a number pins this project. */
-  maxParallel: z12.number().optional(),
+  maxParallel: z15.number().optional(),
   /**
    * Free-form labels grouping CONNECTED repositories — a `storefront` tag on the API, the web
    * app and the design system says those three are one piece of work spread over three repos.
@@ -1533,528 +1979,218 @@ var projectListEntrySchema = z12.object({
    * server-side (trimmed, deduped case-insensitively, sorted), so a consumer may compare them
    * directly.
    */
-  tags: z12.array(z12.string()).optional()
+  tags: z15.array(z15.string()).optional(),
+  /** The task webhook (#589). The token is write-only: the wire says only whether one is set. */
+  webhook: z15.object({ url: z15.string(), tokenSet: z15.boolean() }).optional()
 });
-var projectsResponseSchema = z12.object({
-  projects: z12.array(projectListEntrySchema),
-  bootProject: z12.string(),
-  projectsDir: z12.string()
+var projectsResponseSchema = z15.object({
+  projects: z15.array(projectListEntrySchema),
+  bootProject: z15.string(),
+  projectsDir: z15.string()
 });
-var registerProjectResponseSchema = z12.object({
+var registerProjectResponseSchema = z15.object({
   project: projectListEntrySchema,
-  error: z12.string().optional()
+  error: z15.string().optional()
 });
-var removeProjectResponseSchema = z12.object({
-  removed: z12.literal(true),
-  id: z12.string()
+var removeProjectResponseSchema = z15.object({
+  removed: z15.literal(true),
+  id: z15.string()
 });
-var updateProjectResponseSchema = z12.object({
+var updateProjectResponseSchema = z15.object({
   project: projectListEntrySchema
 });
 var PROJECT_TAG_MAX_LENGTH = 32;
 var PROJECT_TAGS_MAX = 20;
-var updateProjectInputSchema = z12.object({
-  maxParallel: z12.number().int().min(1).max(16).nullable().optional(),
-  tags: z12.array(z12.string().trim().min(1).max(PROJECT_TAG_MAX_LENGTH)).max(PROJECT_TAGS_MAX).nullable().optional()
+var PROJECT_WEBHOOK_URL_MAX_LENGTH = 2048;
+var PROJECT_WEBHOOK_TOKEN_MAX_LENGTH = 1024;
+var projectWebhookUrlSchema = z15.string().trim().max(PROJECT_WEBHOOK_URL_MAX_LENGTH).pipe(z15.url({ protocol: /^https?$/, error: "webhook url must be an http(s) URL" })).refine((value) => !/^https?:\/\/[^/?#]*@/i.test(value), "webhook url must not contain credentials; put the secret in the token");
+var projectWebhookInputSchema = z15.object({
+  url: projectWebhookUrlSchema,
+  token: z15.string().trim().max(PROJECT_WEBHOOK_TOKEN_MAX_LENGTH).optional()
+});
+var testProjectWebhookResponseSchema = z15.object({
+  ok: z15.boolean(),
+  status: z15.number().optional(),
+  error: z15.string().optional(),
+  dryRun: z15.boolean().optional()
+});
+var updateProjectInputSchema = z15.object({
+  maxParallel: z15.number().int().min(1).max(16).nullable().optional(),
+  tags: z15.array(z15.string().trim().min(1).max(PROJECT_TAG_MAX_LENGTH)).max(PROJECT_TAGS_MAX).nullable().optional(),
+  /**
+   * The task webhook (#589). `null` removes it. An omitted `token` keeps the stored one, so the
+   * settings form can change the URL without asking for a secret it never shows again; `''`
+   * clears the token.
+   */
+  webhook: projectWebhookInputSchema.nullable().optional()
 }).refine(
-  (body) => body.maxParallel !== void 0 || body.tags !== void 0,
-  "specify maxParallel or tags"
+  (body) => body.maxParallel !== void 0 || body.tags !== void 0 || body.webhook !== void 0,
+  "specify maxParallel, tags or webhook"
 );
-var checkoutProjectInputSchema = z12.object({
-  url: z12.string().trim().min(1).max(512),
-  name: z12.string().trim().max(128).optional(),
-  checkoutId: z12.string().trim().max(128).optional()
+var checkoutProjectInputSchema = z15.object({
+  url: z15.string().trim().min(1).max(512),
+  name: z15.string().trim().max(128).optional(),
+  checkoutId: z15.string().trim().max(128).optional()
 });
-var fsBrowseDirSchema = z12.object({
-  name: z12.string(),
-  path: z12.string(),
+var fsBrowseDirSchema = z15.object({
+  name: z15.string(),
+  path: z15.string(),
   /** Has a `.git` entry — drives the "git" badge. A non-repo folder is still selectable. */
-  isRepo: z12.boolean()
+  isRepo: z15.boolean()
 });
-var fsBrowseResponseSchema = z12.object({
+var fsBrowseResponseSchema = z15.object({
   /** The realpath'd directory actually listed — never the spelling asked for, so the breadcrumb
    *  shows where the picker really is. */
-  path: z12.string(),
+  path: z15.string(),
   /** `null` AT the browse root: there is no "up" out of it, and the dialog must render no parent
    *  row rather than one that 400s. */
-  parent: z12.string().nullable(),
-  dirs: z12.array(fsBrowseDirSchema),
+  parent: z15.string().nullable(),
+  dirs: z15.array(fsBrowseDirSchema),
   /** True when the listing was capped server-side — surfaced honestly instead of showing a
    *  silently short list. */
-  truncated: z12.boolean()
-});
-var launchKeyResponseSchema = z12.object({
-  key: z12.string()
-});
-
-// ../contract/src/workspace.ts
-import { z as z13 } from "zod";
-var workspaceConfigResponseSchema = z13.object({
-  /** Root exposed by the Add-project directory browser — stored as written (`~` kept). */
-  browseRoot: z13.string(),
-  /** Checkout root for GUI-cloned projects — stored as written (`~` kept). */
-  projectsDir: z13.string(),
-  /** Stored override; `null` means inherit `CEZ_SKILLS_AUTO_UPDATE`, then true. */
-  skillsAutoUpdate: z13.boolean().nullable(),
-  effectiveSkillsAutoUpdate: z13.boolean(),
-  composerDefaults: z13.object({
-    autonomous: z13.boolean().nullable(),
-    worktree: z13.boolean().nullable(),
-    /** `'source-dependent'` when no `CEZ_AUTONOMOUS_DEFAULT` pins it either way. */
-    inheritedAutonomous: z13.union([z13.boolean(), z13.literal("source-dependent")]),
-    inheritedWorktree: z13.boolean()
-  }),
-  resources: z13.object({
-    maxParallel: z13.number(),
-    maxMonitoringSessions: z13.number(),
-    monitoringWakeIntervalMinutes: z13.number().nullable(),
-    /** Resume a run a provider usage limit stopped, once the limit resets. Default `true`. */
-    autoResumeOnUsageLimit: z13.boolean(),
-    memoryLimitMb: z13.number().nullable(),
-    worktreeRetentionDefault: z13.number()
-  }),
-  /**
-   * What a repo that has set none of its own runs (spec 2026-07-29-agent-profiles).
-   *
-   * Both keys are OPTIONAL on the wire, and that is load-bearing rather than lax: absent means
-   * "this machine has no opinion, the built-in default applies", and it has to stay distinguishable
-   * from a value someone chose or the fallback collapses into "always claude". Consulted only where
-   * the repo's own `.ai/cezar/config.json` is silent — a repo that chose is never overruled.
-   */
-  agentDefaults: z13.object({
-    runner: runnerSchema.optional(),
-    models: z13.object({
-      claude: z13.string().optional(),
-      codex: z13.string().optional(),
-      opencode: z13.string().optional(),
-      pi: z13.string().optional(),
-      cursor: z13.string().optional()
-    }).optional()
-  })
-});
-var setWorkspaceConfigInputSchema = z13.object({
-  browseRoot: z13.string().trim().min(1).max(4096).optional(),
-  projectsDir: z13.string().trim().min(1).max(4096).optional(),
-  skillsAutoUpdate: z13.boolean().nullable().optional(),
-  composerDefaults: z13.object({
-    autonomous: z13.boolean().nullable().optional(),
-    worktree: z13.boolean().nullable().optional()
-  }).optional(),
-  /** Machine-wide agent defaults. `null` on a key CLEARS it back to "no opinion", which a bare
-   *  absent key cannot say in a partial patch. */
-  agentDefaults: z13.object({
-    runner: runnerSchema.nullable().optional(),
-    models: z13.object({
-      claude: z13.string().trim().min(1).max(200).nullable().optional(),
-      codex: z13.string().trim().min(1).max(200).nullable().optional(),
-      opencode: z13.string().trim().min(1).max(200).nullable().optional(),
-      pi: z13.string().trim().min(1).max(200).nullable().optional(),
-      cursor: z13.string().trim().min(1).max(200).nullable().optional()
-    }).optional()
-  }).optional(),
-  resources: z13.object({
-    maxParallel: z13.number().int().min(1).max(16).optional(),
-    maxMonitoringSessions: z13.number().int().min(0).max(16).optional(),
-    monitoringWakeIntervalMinutes: z13.number().int().min(1).max(60).nullable().optional(),
-    autoResumeOnUsageLimit: z13.boolean().optional(),
-    memoryLimitMb: z13.number().int().min(0).max(1048576).nullable().optional(),
-    worktreeRetentionDefault: z13.number().int().min(0).max(1e3).optional()
-  }).optional()
-});
-var appearanceSchema = z13.object({
-  accent: z13.enum(["cezarion", "lime", "violet"]).optional(),
-  density: z13.enum(["comfortable", "compact", "ultra"]).optional(),
-  width: z13.enum(["narrow", "wide"]).optional()
-});
-var taskTableUiStateSchema = z13.looseObject({
-  /** Explicit user choices only. Missing ids keep the registry-owned default. */
-  expandedColumns: z13.record(z13.string(), z13.boolean()).optional()
-});
-var uiStateSchema = z13.looseObject({
-  /** What the last started run used. `null` is a VALUE, not an absence: it records a run that
-   *  chose neither a skill nor a workflow (the plain built-in `quick-task`), which the composer
-   *  can now express since the source picker grew an empty state. Absent still means "no
-   *  run has been recorded here" — a cockpit reading either one selects nothing. */
-  lastTask: z13.object({ source: z13.enum(["workflow", "skill"]), ref: z13.string() }).nullable().optional(),
-  /** Most-recently-run sources, newest first (deduped, capped). Feeds the composer picker's
-   *  recency sort. */
-  recentSources: z13.array(z13.object({ source: z13.enum(["workflow", "skill"]), ref: z13.string() })).optional(),
-  /** The last worktree choice for a single-skill run. Absent → the default (isolated worktree). */
-  lastWorktree: z13.boolean().optional(),
-  /** The last autonomous choice — remembered like `lastWorktree`. Absent → off. */
-  lastAutonomous: z13.boolean().optional(),
-  /** Whether new runs should ask agents to append follow-up work. Absent → on. */
-  lastGenerateFollowups: z13.boolean().optional(),
-  /** Skill selection frequency (#408): name → times chosen, across BOTH composers. */
-  skillUsage: z13.record(z13.string(), z13.number()).optional(),
-  runsView: z13.enum(["list", "table"]).optional(),
-  /** The GitHub tab's last-selected sub-tab (#417). Absent → issues. */
-  githubView: z13.enum(["issues", "prs"]).optional(),
-  /** Settings → Appearance. The theme itself stays in localStorage (`cez-theme`) — it must
-   *  pre-paint, and it is per-browser by design. */
-  appearance: appearanceSchema.optional(),
-  /** Follow-up prompt templates (#413). Absent → the built-in defaults; present (even `[]`) is
-   *  the user's own edited list. `skills` are the skill names the template auto-applies for. */
-  promptTemplates: z13.array(
-    z13.object({
-      id: z13.string(),
-      label: z13.string(),
-      text: z13.string(),
-      skills: z13.array(z13.string()).optional()
-    })
-  ).optional(),
-  /** The open-mercato/skills promo banner (#391), dismissed for good. Legacy — the banner is
-   *  gone, replaced by `WorkspaceUiState.importedSkills`; retained so old files round-trip. */
-  dismissedSkillsBanner: z13.boolean().optional()
-});
-var workspaceLastLocationSchema = z13.strictObject({
-  projectId: z13.string().min(1).max(64),
-  pathname: z13.string().min(1).max(2048).startsWith("/p/"),
-  search: z13.string().max(4096).startsWith("?").optional(),
-  hash: z13.string().max(2048).startsWith("#").optional()
-});
-var workspaceUiStateSchema = z13.looseObject({
-  /** LEGACY — the sidebar's per-project collapse map (step 3.3). Still accepted and still
-   *  round-tripped so an older cockpit sharing this home keeps working, but the current cockpit
-   *  neither reads nor writes it: which groups are shut describes the WINDOW, not the workspace,
-   *  so it lives in that browser's localStorage (`packages/web/src/lib/sidebar-collapse.ts`).
-   *  One shared answer meant a phone collapsing a group collapsed it on the desktop too. */
-  sidebar: z13.looseObject({ collapsed: z13.record(z13.string(), z13.boolean()).optional() }).optional(),
-  /** Dismissed runtime-auth incident IDs, keyed by provider. An ID is only dismissed until the
-   *  provider reports a different incident, so this stays workspace-global with the browser
-   *  rather than one project checkout. */
-  dismissedProviderAuthFailures: z13.object({
-    claude: z13.string().optional(),
-    codex: z13.string().optional(),
-    opencode: z13.string().optional(),
-    pi: z13.string().optional(),
-    cursor: z13.string().optional()
-  }).optional(),
-  /** Settings → Appearance, GLOBAL since step 3.5: accent + density describe the person at the
-   *  keyboard, not a repo. */
-  appearance: appearanceSchema.optional(),
-  /** Settings → Notifications, GLOBAL since step 3.5 — one answer for the whole workspace, since
-   *  the delivering browser is one browser whichever project you are looking at. */
-  notifications: z13.looseObject({ enabled: z13.boolean().optional() }).optional(),
-  /** Desktop Tasks-table density, shared across every project in this workspace. */
-  taskTable: taskTableUiStateSchema.optional(),
-  /** LEGACY, exactly like `sidebar` above — the last settled project-scoped page, restored when
-   *  entering at the exact bare root. The shape is unchanged and still accepted, but the current
-   *  cockpit keeps it in localStorage (`packages/web/src/lib/last-location.ts`): stored here, the
-   *  last client to navigate decided where every OTHER client's next launch landed. */
-  lastLocation: workspaceLastLocationSchema.optional(),
-  /** The user's curated selection of default (vendor) skills. Tri-state: ABSENT means "not
-   *  curated", so every default skill shows; a PRESENT array (even `[]`) means only those names
-   *  show from that repo. */
-  importedSkills: z13.array(z13.string()).optional()
-});
-var WORKSPACE_UI_STATE_MAX_KEYS = 200;
-var TASK_TABLE_MAX_COLUMNS = 50;
-var setWorkspaceUiStateInputSchema = z13.looseObject({
-  ...workspaceUiStateSchema.shape,
-  sidebar: z13.looseObject({
-    collapsed: z13.record(z13.string().min(1).max(64), z13.boolean()).refine((map) => Object.keys(map).length <= WORKSPACE_UI_STATE_MAX_KEYS, {
-      message: `sidebar.collapsed must have at most ${WORKSPACE_UI_STATE_MAX_KEYS} entries`
-    }).optional()
-  }).optional(),
-  dismissedProviderAuthFailures: z13.strictObject({
-    claude: z13.string().min(1).max(128).optional(),
-    codex: z13.string().min(1).max(128).optional(),
-    opencode: z13.string().min(1).max(128).optional(),
-    pi: z13.string().min(1).max(128).optional(),
-    cursor: z13.string().min(1).max(128).optional()
-  }).optional(),
-  importedSkills: z13.array(z13.string().min(1).max(200)).max(WORKSPACE_UI_STATE_MAX_KEYS).optional(),
-  taskTable: taskTableUiStateSchema.extend({
-    expandedColumns: z13.record(z13.string().min(1).max(64), z13.boolean()).refine((map) => Object.keys(map).length <= TASK_TABLE_MAX_COLUMNS, {
-      message: `taskTable.expandedColumns must have at most ${TASK_TABLE_MAX_COLUMNS} entries`
-    }).optional()
-  }).optional()
-}).superRefine((data, ctx) => {
-  if (Object.keys(data).length > WORKSPACE_UI_STATE_MAX_KEYS) {
-    ctx.addIssue({
-      code: "custom",
-      message: `ui-state has too many keys (max ${WORKSPACE_UI_STATE_MAX_KEYS})`
-    });
-  }
-});
-var runnerModelsSchema = z13.object({
-  claude: z13.string().optional(),
-  codex: z13.string().optional(),
-  opencode: z13.string().optional(),
-  pi: z13.string().optional(),
-  cursor: z13.string().optional()
-});
-var configResponseSchema = z13.object({
-  baseBranch: z13.string().nullable(),
-  defaultRunner: runnerSchema,
-  systemPrompt: z13.string().nullable(),
-  defaultModels: runnerModelsSchema,
-  /** True when native coding-agent settings are authoritative and model picks are read-only. */
-  modelsLocked: z13.boolean(),
-  /** How many tasks run at once (1–16). */
-  maxParallel: z13.number(),
-  /** Per-task memory ceiling in MiB (whole process tree); null = no limit. */
-  memoryLimitMb: z13.number().nullable(),
-  /** Keep the last N finished worktrees on disk (#483); 0 = unlimited. Older ones are reclaimed
-   *  (directory only — branch kept, so work is recoverable). */
-  worktreeRetention: z13.number(),
-  /** Live title updates: null = no config key, the `CEZ_TITLE_UPDATES` env default (ON) decides. */
-  liveTitleUpdates: z13.boolean().nullable(),
-  /** Optional review gate (#489): null = no config key, the `CEZ_REVIEW_GATE` env default (OFF)
-   *  decides. */
-  reviewGate: z13.boolean().nullable()
-});
-var setConfigResponseSchema = configResponseSchema;
-var setConfigInputSchema = z13.object({
-  baseBranch: z13.string().trim().min(1).max(200).nullable().optional(),
-  defaultRunner: runnerSchema.optional(),
-  systemPrompt: z13.string().trim().max(2e4).nullable().optional(),
-  defaultModels: z13.object({
-    claude: z13.string().trim().max(200).nullable().optional(),
-    codex: z13.string().trim().max(200).nullable().optional(),
-    opencode: z13.string().trim().max(200).nullable().optional(),
-    pi: z13.string().trim().max(200).nullable().optional(),
-    cursor: z13.string().trim().max(200).nullable().optional()
-  }).optional(),
-  maxParallel: z13.number().int().min(1).max(16).optional(),
-  /** null or 0 clears the ceiling back to "no limit". */
-  memoryLimitMb: z13.number().int().min(0).max(1048576).nullable().optional(),
-  /** Keep last N finished worktrees (#483); 0 = unlimited, null clears back to the default (10). */
-  worktreeRetention: z13.number().int().min(0).max(1e3).nullable().optional(),
-  /** null clears the key back to the env-default behavior. */
-  liveTitleUpdates: z13.boolean().nullable().optional(),
-  /** null clears the key back to the env-default behavior (OFF). */
-  reviewGate: z13.boolean().nullable().optional()
-});
-var skillsUpdateStatusSchema = z13.enum([
-  "idle",
-  "checking",
-  "available",
-  "updating",
-  "current",
-  "unavailable",
-  "error"
-]);
-var skillsUpdateScopeStateSchema = z13.object({
-  scope: z13.enum(["project", "global"]),
-  status: skillsUpdateStatusSchema,
-  available: z13.boolean(),
-  skills: z13.array(z13.string()),
-  checkedAt: z13.string().nullable(),
-  updatedAt: z13.string().nullable(),
-  reason: z13.string().optional()
+  truncated: z15.boolean()
 });
-var skillsUpdateStateSchema = z13.object({
-  status: skillsUpdateStatusSchema,
-  available: z13.boolean(),
-  autoUpdateEnabled: z13.boolean(),
-  inherited: z13.boolean(),
-  checkedAt: z13.string().nullable(),
-  updatedAt: z13.string().nullable(),
-  scopes: z13.array(skillsUpdateScopeStateSchema),
-  needsUpgradeNotes: z13.boolean()
-});
-var providerIdSchema = runnerSchema;
-var providerConnectionStateSchema = z13.enum([
-  "connected",
-  "disconnected",
-  "not-installed",
-  "unknown"
-]);
-var providerStatusSchema = z13.object({
-  provider: providerIdSchema,
-  status: providerConnectionStateSchema,
-  enabled: z13.boolean().optional(),
-  hint: z13.string().optional(),
-  authFailureId: z13.string().optional(),
-  /** Which agent account this row describes (spec 2026-07-29-agent-profiles). ABSENT on
-   *  `GET /api/v1/providers/status`, which deliberately keeps answering exactly one row per
-   *  provider — the discovered default — so an older client sees no change at all. Per-account
-   *  rows are carried by `GET /api/v1/workspace/agent-profiles` instead. */
-  profileId: z13.string().optional()
-});
-var providerStatusResponseSchema = z13.object({
-  providers: z13.array(providerStatusSchema)
-});
-var providerConnectResponseSchema = z13.discriminatedUnion("opened", [
-  z13.object({ opened: z13.literal(true), command: z13.string() }),
-  z13.object({ opened: z13.literal(false), connected: z13.literal(true), command: z13.string() })
-]);
-var modelDiscoveryRunnerSchema = z13.enum(["claude", "codex", "opencode", "pi", "cursor"]);
-var MODEL_DISCOVERY_RUNNERS = modelDiscoveryRunnerSchema.options;
-function runnerDiscoversModels(runner) {
-  return MODEL_DISCOVERY_RUNNERS.includes(runner);
-}
-var runnerModelOptionSchema = z13.object({
-  id: z13.string(),
-  label: z13.string(),
-  description: z13.string(),
-  effortLevels: z13.array(effortLevelSchema).optional()
-});
-var runnerModelCatalogResponseSchema = z13.object({
-  runner: runnerSchema,
-  models: z13.array(runnerModelOptionSchema),
-  source: z13.enum(["live", "cache", "unavailable"]),
-  stale: z13.boolean(),
-  reason: z13.string().optional()
-});
-var openTargetSchema = z13.object({
-  id: z13.string(),
-  label: z13.string(),
-  /** A stable icon key (#361) the UI maps to a concrete icon. Optional: an older server omitting
-   *  it just renders the generic fallback icon. */
-  icon: z13.string().optional()
-});
-var openTargetsResponseSchema = z13.object({
-  targets: z13.array(openTargetSchema)
-});
-var openProjectInSchema = z13.object({
-  // A short bound (#429): matched against a downstream allowlist, so an app id is never long.
-  target: z13.string().trim().min(1, "target required").max(200)
-});
-var openProjectInResponseSchema = z13.object({
-  opened: z13.literal(true),
-  path: z13.string()
+var launchKeyResponseSchema = z15.object({
+  key: z15.string()
 });
 
 // ../contract/src/skills.ts
-import { z as z14 } from "zod";
-var skillSchema = z14.object({
-  name: z14.string(),
-  description: z14.string().optional(),
+import { z as z16 } from "zod";
+var skillSchema = z16.object({
+  name: z16.string(),
+  description: z16.string().optional(),
   /** Advisory hint for untouched composer run-mode choices. */
-  interactive: z14.literal(true).optional(),
-  body: z14.string(),
-  path: z14.string(),
-  source: z14.enum(["ai", "cezar", "agents", "global", "team"]),
+  interactive: z16.literal(true).optional(),
+  body: z16.string(),
+  path: z16.string(),
+  source: z16.enum(["ai", "cezar", "agents", "global", "team"]),
   /** Team skills only: where the definition lives in its skills repo. */
-  team: z14.object({
-    repo: z14.string(),
-    ref: z14.string(),
-    path: z14.string(),
+  team: z16.object({
+    repo: z16.string(),
+    ref: z16.string(),
+    path: z16.string(),
     /** True for the `SKILL.md` convention — a whole directory (references/…). */
-    dir: z14.boolean(),
+    dir: z16.boolean(),
     /**
      * The exact commit `ref` resolved to when the skill was read (#428).
      *
      * The hand-written DTO omitted this field entirely — it was NARROWER than the route,
      * which has served it since #428.
      */
-    commit: z14.string().optional()
+    commit: z16.string().optional()
   }).optional()
 });
-var importableSkillSchema = z14.object({
-  name: z14.string(),
-  description: z14.string().optional()
-});
-var todoItemSchema = z14.object({
-  id: z14.string(),
-  ts: z14.string().optional(),
-  taskId: z14.string().optional(),
-  summary: z14.string().min(1),
-  action: z14.string().optional(),
-  prUrl: z14.string().optional(),
-  suggestedSkill: z14.string().optional(),
-  suggestedArgs: z14.string().optional(),
-  suggestedPrompt: z14.string().optional(),
+var importableSkillSchema = z16.object({
+  name: z16.string(),
+  description: z16.string().optional()
+});
+var todoItemSchema = z16.object({
+  id: z16.string(),
+  ts: z16.string().optional(),
+  taskId: z16.string().optional(),
+  summary: z16.string().min(1),
+  action: z16.string().optional(),
+  prUrl: z16.string().optional(),
+  suggestedSkill: z16.string().optional(),
+  suggestedArgs: z16.string().optional(),
+  suggestedPrompt: z16.string().optional(),
   /** Explicit intent; missing infers from suggestedSkill/suggestedPrompt for old files. */
-  runnable: z14.boolean().optional(),
+  runnable: z16.boolean().optional(),
   /** Set once a task was started from this entry — it then leaves the inbox and stays as
    *  the audit trail. A later launch never overwrites the first. */
-  startedTaskId: z14.string().optional()
+  startedTaskId: z16.string().optional()
 });
-var removeTodoResponseSchema = z14.object({
-  removed: z14.literal(true)
+var removeTodoResponseSchema = z16.object({
+  removed: z16.literal(true)
 });
-var startTodoResponseSchema = z14.object({
+var startTodoResponseSchema = z16.object({
   run: runRecordSchema
 });
 
 // ../contract/src/agent-config.ts
-import { z as z15 } from "zod";
-var agentConfigFormatSchema = z15.enum(["json", "jsonc", "toml", "markdown"]);
-var agentConfigScopeSchema = z15.enum(["user", "project", "local"]);
-var agentConfigKindSchema = z15.enum(["settings", "memory", "mcp"]);
-var agentConfigTrackedSchema = z15.enum(["tracked", "gitignored", "outside-repo"]);
-var agentConfigFileSchema = z15.object({
+import { z as z17 } from "zod";
+var agentConfigFormatSchema = z17.enum(["json", "jsonc", "toml", "markdown"]);
+var agentConfigScopeSchema = z17.enum(["user", "project", "local"]);
+var agentConfigKindSchema = z17.enum(["settings", "memory", "mcp"]);
+var agentConfigTrackedSchema = z17.enum(["tracked", "gitignored", "outside-repo"]);
+var agentConfigFileSchema = z17.object({
   /** Stable, opaque, URL-safe — the ONLY thing a client may name (traversal-proof). */
-  id: z15.string(),
+  id: z17.string(),
   /** Every runner that reads this file: `<repo>/AGENTS.md` is one file, two readers. */
-  runners: z15.array(runnerSchema),
+  runners: z17.array(runnerSchema),
   kind: agentConfigKindSchema,
   scope: agentConfigScopeSchema,
-  label: z15.string(),
-  path: z15.string(),
+  label: z17.string(),
+  path: z17.string(),
   format: agentConfigFormatSchema,
   tracked: agentConfigTrackedSchema,
-  seeded: z15.boolean(),
-  holdsMcp: z15.boolean(),
+  seeded: z17.boolean(),
+  holdsMcp: z17.boolean(),
   /** VERBATIM from the vendor docs. Never computed, never generic. */
-  precedence: z15.string(),
+  precedence: z17.string(),
   /** Documented mid-run reload behaviour, or absent when the vendor is silent. */
-  hotReload: z15.string().optional(),
-  docsUrl: z15.string(),
-  exists: z15.boolean(),
-  size: z15.number(),
+  hotReload: z17.string().optional(),
+  docsUrl: z17.string(),
+  exists: z17.boolean(),
+  size: z17.number(),
   /** sha256 of the bytes, or null when absent. */
-  version: z15.string().nullable(),
+  version: z17.string().nullable(),
   /** False in hosted mode (whole feature) — the client renders read-only up front. */
-  writable: z15.boolean(),
-  readOnlyReason: z15.string().optional()
+  writable: z17.boolean(),
+  readOnlyReason: z17.string().optional()
 });
-var userMcpListingSchema = z15.object({
-  path: z15.string(),
-  servers: z15.array(z15.string()),
-  readable: z15.boolean()
+var userMcpListingSchema = z17.object({
+  path: z17.string(),
+  servers: z17.array(z17.string()),
+  readable: z17.boolean()
 });
-var agentConfigListingSchema = z15.object({
-  editable: z15.boolean(),
-  files: z15.array(agentConfigFileSchema),
+var agentConfigListingSchema = z17.object({
+  editable: z17.boolean(),
+  files: z17.array(agentConfigFileSchema),
   /** null in hosted mode (host-state disclosure guard). */
   userMcp: userMcpListingSchema.nullable()
 });
-var agentConfigFileContentSchema = z15.object({
-  id: z15.string(),
-  path: z15.string(),
-  exists: z15.boolean(),
-  content: z15.string(),
+var agentConfigFileContentSchema = z17.object({
+  id: z17.string(),
+  path: z17.string(),
+  exists: z17.boolean(),
+  content: z17.string(),
   /** sha256 of the bytes, or null when the file does not exist yet. */
-  version: z15.string().nullable()
+  version: z17.string().nullable()
 });
-var setAgentConfigInputSchema = z15.object({
-  content: z15.string().max(2e6),
-  version: z15.string().nullable()
+var setAgentConfigInputSchema = z17.object({
+  content: z17.string().max(2e6),
+  version: z17.string().nullable()
 });
 
 // ../contract/src/agent-profiles.ts
-import { z as z16 } from "zod";
+import { z as z18 } from "zod";
 var DEFAULT_AGENT_ACCOUNT_ID = "default";
-var agentAccountFileSchema = z16.object({
-  id: z16.string(),
+var agentAccountFileSchema = z18.object({
+  id: z18.string(),
   /** e.g. `settings.json` — the file's own name, since the folder is shown once on the account. */
-  label: z16.string(),
+  label: z18.string(),
   /** Absolute, resolved inside this account's config folder. */
-  path: z16.string(),
-  exists: z16.boolean()
+  path: z18.string(),
+  exists: z18.boolean()
 });
-var agentProfileSchema = z16.object({
+var agentProfileSchema = z18.object({
   /** `default` for the discovered profile, else the stored slug. */
-  id: z16.string(),
+  id: z18.string(),
   provider: providerIdSchema,
-  label: z16.string(),
+  label: z18.string(),
   /** As the user wrote it — a literal `~` is preserved, matching `browseRoot`/`projectsDir`. */
-  configDir: z16.string(),
+  configDir: z18.string(),
   /** Expanded absolute path. Same-origin route, like `ProjectListEntry.root`. */
-  path: z16.string(),
+  path: z18.string(),
   /** False for a dir the CLI has not created yet — legitimate, and NOT a reason to fall back
    *  to another account at run time (that would silently bill the wrong subscription). */
-  exists: z16.boolean(),
+  exists: z18.boolean(),
   /** Whether the dir carries this agent's own marker files. ADVISORY: an unrecognised dir is
    *  still accepted, because "add profile → Connect → the CLI creates it" is the real flow. */
-  looksValid: z16.boolean(),
+  looksValid: z18.boolean(),
   /** True for the profile cezar discovers from the environment. Never stored, never deletable. */
-  isDefault: z16.boolean(),
+  isDefault: z18.boolean(),
   /** This account's own authentication state — two Claude logins answer independently.
    *
    *  **Absent until the probe has warmed.** Every probe shells out to an agent CLI, and this
@@ -2065,36 +2201,36 @@ var agentProfileSchema = z16.object({
   status: providerStatusSchema.optional(),
   /** This agent's own user-scope config files, resolved inside THIS account's folder — so a
    *  second login's `settings.json` is the one you open, not the default account's. */
-  files: z16.array(agentAccountFileSchema)
+  files: z18.array(agentAccountFileSchema)
 });
 function agentAccountRouteId(profile) {
   return profile.isDefault ? `default:${profile.provider}` : profile.id;
 }
-var agentAccountSelectionSchema = z16.object({
-  claude: z16.string().optional(),
-  codex: z16.string().optional(),
-  opencode: z16.string().optional(),
-  pi: z16.string().optional(),
-  cursor: z16.string().optional()
-});
-var agentProfilesResponseSchema = z16.object({
-  editable: z16.boolean(),
-  profiles: z16.array(agentProfileSchema),
+var agentAccountSelectionSchema = z18.object({
+  claude: z18.string().optional(),
+  codex: z18.string().optional(),
+  opencode: z18.string().optional(),
+  pi: z18.string().optional(),
+  cursor: z18.string().optional()
+});
+var agentProfilesResponseSchema = z18.object({
+  editable: z18.boolean(),
+  profiles: z18.array(agentProfileSchema),
   /** Providers that can carry more than one account at all — what "Add account" is offered for.
    *  OpenCode is absent: its credentials live in a SQLite DB behind a separate `OPENCODE_DB`, so
    *  a config-dir profile would swap settings while still billing the other account. */
-  profileCapableProviders: z16.array(providerIdSchema),
+  profileCapableProviders: z18.array(providerIdSchema),
   /** Which account each project uses, keyed by the project's realpath'd ROOT.
    *
    *  Served here rather than on `GET /api/v1/projects` because it is stored beside the accounts it
    *  names (`~/.cezar/agent-accounts.json`) — one file, so deleting an account and scrubbing every
    *  reference to it is one atomic write, and neither can be dropped by a cezar version that never
    *  heard of accounts. Empty in hosted mode, where the whole family is withheld. */
-  selections: z16.record(z16.string(), agentAccountSelectionSchema),
+  selections: z18.record(z18.string(), agentAccountSelectionSchema),
   /** The machine-wide fallback account per provider, used by any repo that has chosen none. */
   defaults: agentAccountSelectionSchema
 });
-var selectAgentProfileInputSchema = z16.object({
+var selectAgentProfileInputSchema = z18.object({
   /**
    * Registry slug, or the reserved `default` boot alias. Resolved to a root server-side.
    *
@@ -2102,192 +2238,228 @@ var selectAgentProfileInputSchema = z16.object({
    * chosen nothing uses, so a second login is set up once rather than per checkout. A repo's own
    * choice always wins over it, which is what keeps this a default and not an override.
    */
-  projectId: z16.string().min(1).max(64).nullable(),
+  projectId: z18.string().min(1).max(64).nullable(),
   provider: providerIdSchema,
-  profileId: z16.string().max(64).nullable()
+  profileId: z18.string().max(64).nullable()
 });
-var agentProfileSelectionsResponseSchema = z16.object({
-  selections: z16.record(z16.string(), agentAccountSelectionSchema),
+var agentProfileSelectionsResponseSchema = z18.object({
+  selections: z18.record(z18.string(), agentAccountSelectionSchema),
   /** The machine-wide fallback, for repos with no selection of their own. */
   defaults: agentAccountSelectionSchema
 });
-var agentAccountStatusResponseSchema = z16.object({ status: providerStatusSchema });
-var agentAccountDetailsResponseSchema = z16.object({
-  available: z16.boolean(),
-  reason: z16.string().optional(),
-  fields: z16.array(z16.object({ label: z16.string(), value: z16.string() }))
+var agentAccountStatusResponseSchema = z18.object({ status: providerStatusSchema });
+var agentAccountDetailsResponseSchema = z18.object({
+  available: z18.boolean(),
+  reason: z18.string().optional(),
+  fields: z18.array(z18.object({ label: z18.string(), value: z18.string() }))
 });
-var openAgentAccountFileInputSchema = z16.object({
-  file: z16.string().min(1).max(200),
-  target: z16.string().min(1).max(64).optional()
+var openAgentAccountFileInputSchema = z18.object({
+  file: z18.string().min(1).max(200),
+  target: z18.string().min(1).max(64).optional()
 });
-var openAgentAccountFileResponseSchema = z16.object({
-  opened: z16.literal(true),
-  path: z16.string()
+var openAgentAccountFileResponseSchema = z18.object({
+  opened: z18.literal(true),
+  path: z18.string()
 });
-var createAgentProfileInputSchema = z16.object({
+var createAgentProfileInputSchema = z18.object({
   provider: providerIdSchema,
-  label: z16.string().trim().max(200).optional(),
+  label: z18.string().trim().max(200).optional(),
   /** Stored as written; validated absolute after `~` expansion, server-side. */
-  configDir: z16.string().trim().min(1).max(4096)
+  configDir: z18.string().trim().min(1).max(4096)
 });
-var agentProfileResponseSchema = z16.object({ profile: agentProfileSchema });
-var updateAgentProfileInputSchema = z16.object({
-  label: z16.string().trim().max(200).optional(),
-  configDir: z16.string().trim().min(1).max(4096).optional()
+var agentProfileResponseSchema = z18.object({ profile: agentProfileSchema });
+var updateAgentProfileInputSchema = z18.object({
+  label: z18.string().trim().max(200).optional(),
+  configDir: z18.string().trim().min(1).max(4096).optional()
 });
-var removeAgentProfileResponseSchema = z16.object({
-  removed: z16.literal(true),
-  id: z16.string()
+var removeAgentProfileResponseSchema = z18.object({
+  removed: z18.literal(true),
+  id: z18.string()
 });
 
 // ../contract/src/automations.ts
-import { z as z17 } from "zod";
-var automationEventSchema = z17.enum([
+import { z as z19 } from "zod";
+var automationEventSchema = z19.enum([
   "pull_request.opened",
   "issue.opened",
   "issue.labeled",
   "issue.unlabeled"
 ]);
-var automationFiltersSchema = z17.object({
-  authors: z17.array(z17.string()).optional(),
-  assignees: z17.array(z17.string()).optional(),
-  allLabels: z17.array(z17.string()).optional(),
-  anyLabels: z17.array(z17.string()).optional(),
-  excludeLabels: z17.array(z17.string()).optional(),
+var automationFiltersSchema = z19.object({
+  authors: z19.array(z19.string()).optional(),
+  assignees: z19.array(z19.string()).optional(),
+  allLabels: z19.array(z19.string()).optional(),
+  anyLabels: z19.array(z19.string()).optional(),
+  excludeLabels: z19.array(z19.string()).optional(),
   /** Required for the two label events — the server rejects a definition without it. */
-  changedLabels: z17.array(z17.string()).optional(),
-  lookbackDays: z17.number(),
-  maxRecords: z17.number()
+  changedLabels: z19.array(z19.string()).optional(),
+  lookbackDays: z19.number(),
+  maxRecords: z19.number()
 });
 var automationTaskSchema = createRunInputBaseSchema.omit({ task: true, images: true, todoId: true, systemPrompt: true }).extend({
   /** The prompt template. `{{github.number}}`, `{{github.title}}`, `{{github.url}}` and
    *  `{{github.labels}}` are substituted per match; GitHub content is appended as untrusted
    *  context, never interpolated into instructions. */
-  prompt: z17.string(),
-  variants: z17.union([z17.literal(1), z17.literal(2), z17.literal(3)]).optional(),
-  systemPrompt: z17.string().optional()
+  prompt: z19.string(),
+  variants: z19.union([z19.literal(1), z19.literal(2), z19.literal(3)]).optional(),
+  systemPrompt: z19.string().optional()
 });
-var automationDefinitionSchema = z17.object({
-  id: z17.string(),
+var automationDefinitionSchema = z19.object({
+  id: z19.string(),
   /** Bumped on every edit; a PUT must echo the revision it read (optimistic concurrency). */
-  revision: z17.number(),
-  name: z17.string(),
-  description: z17.string().optional(),
+  revision: z19.number(),
+  name: z19.string(),
+  description: z19.string().optional(),
   /** Always present: the storage schema defaults it to `false`, so a definition is created
    *  PAUSED and enabling it is a separate, baseline-establishing act. */
-  enabled: z17.boolean(),
-  events: z17.array(automationEventSchema),
-  intervalSeconds: z17.number(),
+  enabled: z19.boolean(),
+  events: z19.array(automationEventSchema),
+  intervalSeconds: z19.number(),
   filters: automationFiltersSchema,
   task: automationTaskSchema,
-  createdAt: z17.string(),
-  updatedAt: z17.string()
+  createdAt: z19.string(),
+  updatedAt: z19.string()
 });
-var automationCursorSchema = z17.object({
-  timestamp: z17.string(),
-  tieBreaker: z17.string().optional()
+var automationCursorSchema = z19.object({
+  timestamp: z19.string(),
+  tieBreaker: z19.string().optional()
 });
-var automationRuntimeStateSchema = z17.object({
+var automationRuntimeStateSchema = z19.object({
   /** The definition revision this state belongs to; a bumped revision re-baselines. */
-  revision: z17.number().optional(),
+  revision: z19.number().optional(),
   /** Enabling establishes a CURRENT-TIME baseline: records older than this never launch. */
-  baselineAt: z17.string().optional(),
+  baselineAt: z19.string().optional(),
   cursor: automationCursorSchema.optional(),
-  frozenHighWatermark: automationCursorSchema.extend({ tieBreaker: z17.string() }).optional(),
-  backlogAfter: automationCursorSchema.extend({ tieBreaker: z17.string() }).optional(),
-  nextCheckAt: z17.string().optional(),
-  lastSuccessAt: z17.string().optional(),
+  frozenHighWatermark: automationCursorSchema.extend({ tieBreaker: z19.string() }).optional(),
+  backlogAfter: automationCursorSchema.extend({ tieBreaker: z19.string() }).optional(),
+  nextCheckAt: z19.string().optional(),
+  lastSuccessAt: z19.string().optional(),
   /** Per-query GitHub ETags, so an unchanged page costs no rate-limit budget. */
-  etags: z17.record(z17.string(), z17.string()).optional(),
-  backoffUntil: z17.string().optional(),
-  consecutiveFailures: z17.number().optional()
+  etags: z19.record(z19.string(), z19.string()).optional(),
+  backoffUntil: z19.string().optional(),
+  consecutiveFailures: z19.number().optional()
 });
-var automationLogResultSchema = z17.enum([
+var automationLogResultSchema = z19.enum([
   "launched",
   "no-match",
   "duplicate",
   "rate-limited",
   "error",
   "baseline",
-  "preview"
+  "preview",
+  "skipped"
 ]);
-var automationLogRecordSchema = z17.object({
-  seq: z17.number(),
-  ts: z17.string(),
-  automationId: z17.string(),
-  revision: z17.number(),
+var automationLogRecordSchema = z19.object({
+  seq: z19.number(),
+  ts: z19.string(),
+  automationId: z19.string(),
+  revision: z19.number(),
   event: automationEventSchema.optional(),
   result: automationLogResultSchema,
-  reason: z17.string().optional(),
-  durationMs: z17.number().optional(),
-  receiptId: z17.string().optional(),
-  runId: z17.string().optional(),
-  githubNumber: z17.number().optional(),
-  githubTitle: z17.string().optional(),
-  githubUrl: z17.string().optional(),
-  rateLimit: z17.object({
-    bucket: z17.enum(["core", "search"]),
-    remaining: z17.number().optional(),
-    resetAt: z17.string().optional()
+  reason: z19.string().optional(),
+  durationMs: z19.number().optional(),
+  receiptId: z19.string().optional(),
+  runId: z19.string().optional(),
+  githubNumber: z19.number().optional(),
+  githubTitle: z19.string().optional(),
+  githubUrl: z19.string().optional(),
+  rateLimit: z19.object({
+    bucket: z19.enum(["core", "search"]),
+    remaining: z19.number().optional(),
+    resetAt: z19.string().optional()
   }).optional()
 });
-var automationCountsSchema = z17.object({
-  matches: z17.number(),
-  launched: z17.number(),
-  duplicates: z17.number(),
-  errors: z17.number()
+var automationCountsSchema = z19.object({
+  matches: z19.number(),
+  launched: z19.number(),
+  duplicates: z19.number(),
+  errors: z19.number()
 });
 var automationListEntrySchema = automationDefinitionSchema.extend({
   state: automationRuntimeStateSchema.optional(),
   latestLog: automationLogRecordSchema.optional(),
   counts: automationCountsSchema
 });
-var automationsResponseSchema = z17.object({
-  available: z17.boolean(),
-  reason: z17.string().optional(),
-  scheduler: z17.object({
-    state: z17.enum(["scheduled", "idle"]),
-    nextDue: z17.string().optional()
+var automationsResponseSchema = z19.object({
+  available: z19.boolean(),
+  reason: z19.string().optional(),
+  scheduler: z19.object({
+    state: z19.enum(["scheduled", "idle"]),
+    nextDue: z19.string().optional()
   }),
-  automations: z17.array(automationListEntrySchema)
+  automations: z19.array(automationListEntrySchema)
 });
-var automationResponseSchema = z17.object({ automation: automationDefinitionSchema });
-var automationDetailResponseSchema = z17.object({
+var automationResponseSchema = z19.object({ automation: automationDefinitionSchema });
+var automationDetailResponseSchema = z19.object({
   automation: automationDefinitionSchema,
   state: automationRuntimeStateSchema.optional(),
   latestLog: automationLogRecordSchema.optional()
 });
-var automationCheckSchema = z17.object({
-  id: z17.string(),
-  automationId: z17.string(),
-  mode: z17.enum(["preview", "execute"]),
-  status: z17.enum(["queued", "running", "complete", "error"]),
-  createdAt: z17.string(),
-  completedAt: z17.string().optional(),
-  matches: z17.number().optional(),
-  truncated: z17.boolean().optional(),
-  error: z17.string().optional()
-});
-var automationCheckQueuedResponseSchema = z17.object({ checkId: z17.string() });
-var automationLogResponseSchema = z17.object({
-  records: z17.array(automationLogRecordSchema)
-});
-var automationRetryResponseSchema = z17.object({
-  receiptId: z17.string(),
-  runId: z17.string()
-});
-var createAutomationInputSchema = automationDefinitionSchema.omit({ id: true, revision: true, createdAt: true, updatedAt: true, enabled: true }).extend({ enable: z17.boolean().optional() });
+var automationCheckSchema = z19.object({
+  id: z19.string(),
+  automationId: z19.string(),
+  mode: z19.enum(["preview", "execute"]),
+  status: z19.enum(["queued", "running", "complete", "error"]),
+  createdAt: z19.string(),
+  completedAt: z19.string().optional(),
+  matches: z19.number().optional(),
+  truncated: z19.boolean().optional(),
+  error: z19.string().optional()
+});
+var automationCheckQueuedResponseSchema = z19.object({ checkId: z19.string() });
+var automationLogResponseSchema = z19.object({
+  records: z19.array(automationLogRecordSchema)
+});
+var automationRetryResponseSchema = z19.object({
+  receiptId: z19.string(),
+  runId: z19.string()
+});
+var createAutomationInputSchema = automationDefinitionSchema.omit({ id: true, revision: true, createdAt: true, updatedAt: true, enabled: true }).extend({ enable: z19.boolean().optional() });
 var updateAutomationInputSchema = createAutomationInputSchema.omit({ enable: true }).extend({
-  enabled: z17.boolean().optional(),
-  expectedRevision: z17.number()
+  enabled: z19.boolean().optional(),
+  expectedRevision: z19.number()
 });
-var automationCheckInputSchema = z17.object({
-  mode: z17.enum(["preview", "execute"])
+var automationCheckInputSchema = z19.object({
+  mode: z19.enum(["preview", "execute"])
 });
+
+// ../contract/src/artifacts.ts
+import { z as z20 } from "zod";
+var pathSchema = z20.string().min(1).max(8192).refine((value) => !value.includes("\0"), "Path contains NUL");
+var publishedArtifactSchema = z20.object({
+  id: z20.uuid(),
+  runId: z20.uuid(),
+  name: z20.string().min(1).max(255),
+  sourcePath: pathSchema.refine((value) => /^(?:\/|[A-Za-z]:[\\/]|\\\\)/.test(value), "Expected an absolute source path"),
+  createdAt: z20.iso.datetime(),
+  size: z20.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  sha256: z20.string().regex(/^[a-f0-9]{64}$/)
+}).strict();
+var filePreviewDataSchema = z20.object({
+  type: z20.literal("file"),
+  path: pathSchema,
+  size: z20.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  binary: z20.boolean(),
+  tooLarge: z20.boolean(),
+  content: z20.string().optional(),
+  source: z20.enum(["worktree", "project", "artifact"]),
+  artifact: publishedArtifactSchema.optional()
+}).strict();
+var fileLinkResultSchema = z20.union([
+  filePreviewDataSchema,
+  z20.object({
+    type: z20.enum(["unavailable", "unpublished"]),
+    path: pathSchema,
+    reason: z20.string().min(1).max(4096)
+  }).strict()
+]);
+var artifactListSchema = z20.object({ artifacts: z20.array(publishedArtifactSchema).max(64) }).strict();
+var fileLinkQuerySchema = z20.object({ path: pathSchema, raw: z20.literal("1").optional() }).strict();
+var artifactParamsSchema = z20.object({ id: z20.uuid(), artifactId: z20.uuid() });
 export {
   CI_WAIT_LIMITATION,
   CI_WAIT_RECEIPT_INSTRUCTION,
+  CLIENT_REQUEST_VARIANTS_ERROR,
   DEFAULT_AGENT_ACCOUNT_ID,
   EFFORT_LEVELS,
   FILE_ATTACHMENT_MEDIA_TYPES,
@@ -2295,6 +2467,8 @@ export {
   MODEL_DISCOVERY_RUNNERS,
   PROJECT_TAGS_MAX,
   PROJECT_TAG_MAX_LENGTH,
+  PROJECT_WEBHOOK_TOKEN_MAX_LENGTH,
+  PROJECT_WEBHOOK_URL_MAX_LENGTH,
   REFERENCE_STATUS_MAX,
   RUN_HISTORY_PAGE_ITEMS,
   advancePendingHumanAsk,
@@ -2317,7 +2491,12 @@ export {
   agentProfileSelectionsResponseSchema,
   agentProfilesResponseSchema,
   apiRunSchema,
+  applicationUpdateInputSchema,
+  applicationUpdateResponseSchema,
+  applicationUpdateStateSchema,
   archiveFinishedResponseSchema,
+  artifactListSchema,
+  artifactParamsSchema,
   askOptionSchema,
   askQuestionSchema,
   askRequestSchema,
@@ -2365,6 +2544,7 @@ export {
   conversationAttributionSchema,
   conversationCancelRequestSchema,
   conversationInspectRequestSchema,
+  conversationInspectResultSchema,
   conversationMessageEventSchema,
   conversationMessageSchema,
   conversationSendRequestSchema,
@@ -2381,9 +2561,16 @@ export {
   deleteRunResponseSchema,
   deleteWorkflowResponseSchema,
   diffStatSchema,
+  discoveredRunnerSchema,
+  discoveredRunnersSchema,
+  discoveryRequestSchema,
+  discoveryResponseSchema,
   editQueuedMessageResponseSchema,
   effortFieldSchema,
   effortLevelSchema,
+  fileLinkQuerySchema,
+  fileLinkResultSchema,
+  filePreviewDataSchema,
   finishResponseSchema,
   forgeInfoSchema,
   fsBrowseDirSchema,
@@ -2414,6 +2601,10 @@ export {
   humanInputDeliveredEventSchema,
   imageInputSchema,
   importableSkillSchema,
+  inboxClaimSchema,
+  inboxReceiptRequestSchema,
+  inboxReceiptResultSchema,
+  inboxReserveResultSchema,
   isAttachmentMediaType,
   isImageAttachmentName,
   isImageMediaType,
@@ -2422,7 +2613,9 @@ export {
   markAllReadResponseSchema,
   messageInputSchema,
   messageResponseSchema,
+  modelChoicesSchema,
   modelDiscoveryRunnerSchema,
+  notifyRunInputSchema,
   openAgentAccountFileInputSchema,
   openAgentAccountFileResponseSchema,
   openInCliResponseSchema,
@@ -2439,6 +2632,8 @@ export {
   planResponseSchema,
   processUsageSchema,
   projectListEntrySchema,
+  projectWebhookInputSchema,
+  projectWebhookUrlSchema,
   projectsResponseSchema,
   providerConnectResponseSchema,
   providerConnectionStateSchema,
@@ -2446,6 +2641,7 @@ export {
   providerStatusResponseSchema,
   providerStatusSchema,
   providersRequiredByWorkflow,
+  publishedArtifactSchema,
   queuedMessageSchema,
   reclaimWorktreesResponseSchema,
   referenceStatusSchema,
@@ -2484,6 +2680,7 @@ export {
   runRecordSchema,
   runRelationshipsSchema,
   runStatusSchema,
+  runWebhookOutcomeSchema,
   runnerDiscoversModels,
   runnerModelCatalogResponseSchema,
   runnerModelOptionSchema,
@@ -2506,6 +2703,7 @@ export {
   statusEntrySchema,
   stepStateSchema,
   stepStatusSchema,
+  testProjectWebhookResponseSchema,
   todoItemSchema,
   uiStateSchema,
   updateAgentProfileInputSchema,
@@ -2531,6 +2729,8 @@ export {
   workerOutcomeEventSchema,
   workerOutcomeSchema,
   workerParamsSchema,
+  workerQuestionFallbackEventSchema,
+  workerQuestionRoutedEventSchema,
   workerResultFileSchema,
   workerResultReferenceSchema,
   workerSpawnRequestSchema,