agent-board-runner 0.1.1 → 0.1.2

package/dist/cli.js

@@ -163,21 +163,178 @@ async function logout() {
   if (existsSync2(SESSION_FILE)) rmSync(SESSION_FILE);
 }
 
+// ../../packages/shared-types/dist/index.js
+var BOARD_COLUMNS = [
+  "backlog",
+  "desenvolvimento",
+  "revisao",
+  "deploy",
+  "fim"
+];
+var COLUMN_SHELL_KINDS = ["shell", "claude"];
+var RUNNER_VERSION = "0.1.0";
+var CARD_ATTACHMENTS_BUCKET = "agent-board-card-images";
+var MAX_CARD_ATTACHMENT_BYTES = 25 * 1024 * 1024;
+
 // src/runner.ts
 import { createServer as createServer2 } from "node:http";
 
-// src/deploy.ts
-import { join as join6 } from "node:path";
+// src/agentEventsServer.ts
+import { parse as parse2 } from "node:url";
+import { WebSocketServer } from "ws";
 
-// src/devServer.ts
-import { spawn as spawn2 } from "node:child_process";
+// src/filesServer.ts
+import { execFile as execFile2 } from "node:child_process";
+import { randomUUID as randomUUID5 } from "node:crypto";
+import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync4, readdirSync, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { join as join8, resolve as resolve2, sep } from "node:path";
+import { parse } from "node:url";
+import { promisify as promisify2 } from "node:util";
 
-// src/cloudflared.ts
-import { spawn } from "node:child_process";
-import { accessSync, constants } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { delimiter, join as join3 } from "node:path";
-import { bin as bundledBinaryPath, install as downloadCloudflared } from "cloudflared";
+// src/agentActivity.ts
+var RECENT_WINDOW_MS = 6e3;
+var IDLE_AFTER_MS = 45e3;
+var IDLE_AFTER_MS_TOOL_PENDING = 3e5;
+var EVAL_INTERVAL_MS = 2e3;
+var ANSI_PATTERN = /\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g;
+var BOX_DRAWING_PATTERN = /[─-╿]/g;
+var WORKING_PATTERN = /esc to interrupt/i;
+function isAgentHookMoment(value) {
+  return value === "implementing" || value === "waiting_plan_approval" || value === "commit_detected" || value === "turn_stopped" || value === "notification";
+}
+var USAGE_LIMIT_PATTERN = /(usage limit reached|limit reached[^\n]{0,60}resets|reached your (?:usage|session) limit|out of (?:weekly|session) (?:usage|limit))/i;
+var PLAN_APPROVAL_PATTERN = /would you like to proceed\??/i;
+var USER_PROMPT_PATTERNS = [
+  /do you want to\b/i,
+  /would you like to\b/i,
+  /do you trust the files\b/i,
+  /press enter to continue/i,
+  /\(y\/n\)/i,
+  /❯\s*1\.\s/
+];
+var TOOL_CALL_MARKER = "\u23FA";
+var TOOL_RESULT_MARKER = "\u23BF";
+var COMMIT_SUCCESS_PATTERN = /\[\S+\s+[0-9a-f]{7,40}\]/;
+function normalizeTerminalOutput(raw) {
+  return raw.replace(ANSI_PATTERN, "").replace(BOX_DRAWING_PATTERN, " ").replace(/[ \t]+/g, " ");
+}
+function classifyAgentOutput(recentOutput, options) {
+  if (WORKING_PATTERN.test(recentOutput)) return "implementing";
+  if (options.usageLimited) return "usage_limited";
+  if (options.planApprovalPending) return "waiting_plan_approval";
+  if (USER_PROMPT_PATTERNS.some((pattern) => pattern.test(recentOutput))) return "waiting_user";
+  const idleThreshold = options.toolCallPending ? IDLE_AFTER_MS_TOOL_PENDING : IDLE_AFTER_MS;
+  if (options.silentForMs >= idleThreshold) return options.commitDetected ? "done" : "waiting_user";
+  return options.previous;
+}
+var AgentActivityWatcher = class {
+  constructor(onChange) {
+    this.onChange = onChange;
+    this.timer = setInterval(() => this.evaluate(), EVAL_INTERVAL_MS);
+    this.timer.unref();
+  }
+  chunks = [];
+  // Starts as "starting" (not "implementing"): nothing classifiable has arrived yet, and the
+  // caller stamps the session row the same way right when the pty is spawned — see
+  // orchestrator.spawnSessionPty.
+  state = "starting";
+  lastOutputAt = Date.now();
+  usageLimited = false;
+  planApprovalPending = false;
+  toolCallPending = false;
+  commitDetected = false;
+  timer;
+  push(chunk) {
+    const now = Date.now();
+    const text = normalizeTerminalOutput(chunk);
+    this.lastOutputAt = now;
+    this.chunks.push({ at: now, text });
+    if (USAGE_LIMIT_PATTERN.test(text)) this.usageLimited = true;
+    if (PLAN_APPROVAL_PATTERN.test(text)) this.planApprovalPending = true;
+    if (COMMIT_SUCCESS_PATTERN.test(text)) this.commitDetected = true;
+    const lastToolCallIdx = text.lastIndexOf(TOOL_CALL_MARKER);
+    const lastToolResultIdx = text.lastIndexOf(TOOL_RESULT_MARKER);
+    if (lastToolCallIdx !== -1 || lastToolResultIdx !== -1) this.toolCallPending = lastToolCallIdx > lastToolResultIdx;
+    if (WORKING_PATTERN.test(text)) {
+      this.usageLimited = false;
+      this.planApprovalPending = false;
+      this.commitDetected = false;
+    }
+    this.evaluate(now);
+  }
+  stop() {
+    clearInterval(this.timer);
+  }
+  /**
+   * Applies a precise moment reported by the agent-moment hook script (see
+   * agentMomentHookScript.ts, routed here via filesServer.ts's /agent-hook route and
+   * orchestrator.ts's registerAgentActivityWatcher) — takes priority over the text/idle-timer
+   * path below rather than racing it, since a hook firing means Claude Code itself just told
+   * us exactly what happened.
+   *
+   * `usageLimited` is still owned by the text path (no hook event exists for it — see
+   * USAGE_LIMIT_PATTERN): `turn_stopped`/`notification` must not clobber that latch just
+   * because the CLI also happens to stop/notify around a limit message.
+   */
+  reportHookMoment(moment) {
+    this.lastOutputAt = Date.now();
+    switch (moment) {
+      case "implementing":
+        this.usageLimited = false;
+        this.planApprovalPending = false;
+        this.commitDetected = false;
+        this.setState("implementing");
+        break;
+      case "waiting_plan_approval":
+        this.planApprovalPending = true;
+        this.setState("waiting_plan_approval");
+        break;
+      case "commit_detected":
+        this.commitDetected = true;
+        break;
+      case "turn_stopped":
+        if (this.usageLimited) break;
+        this.setState(this.commitDetected ? "done" : "waiting_user");
+        break;
+      case "notification":
+        if (this.usageLimited || this.planApprovalPending) break;
+        if (this.state === "implementing" || this.state === "starting") this.setState("waiting_user");
+        break;
+    }
+  }
+  evaluate(now = Date.now()) {
+    while (this.chunks.length > 0 && now - this.chunks[0].at > RECENT_WINDOW_MS) this.chunks.shift();
+    const next = classifyAgentOutput(this.chunks.map((chunk) => chunk.text).join(""), {
+      silentForMs: now - this.lastOutputAt,
+      usageLimited: this.usageLimited,
+      planApprovalPending: this.planApprovalPending,
+      toolCallPending: this.toolCallPending,
+      commitDetected: this.commitDetected,
+      previous: this.state
+    });
+    this.setState(next);
+  }
+  setState(next) {
+    if (next === this.state) return;
+    this.state = next;
+    this.onChange(next);
+  }
+};
+var activeWatchers = /* @__PURE__ */ new Map();
+function registerAgentActivityWatcher(sessionId, watcher) {
+  activeWatchers.set(sessionId, watcher);
+}
+function unregisterAgentActivityWatcher(sessionId) {
+  activeWatchers.delete(sessionId);
+}
+function handleAgentHookEvent(sessionId, moment) {
+  if (!isAgentHookMoment(moment)) return false;
+  const watcher = activeWatchers.get(sessionId);
+  if (!watcher) return false;
+  watcher.reportHookMoment(moment);
+  return true;
+}
 
 // src/logger.ts
 var ANSI = {
@@ -237,336 +394,533 @@ var logger = {
   card: scoped("CARD")
 };
 
-// src/cloudflared.ts
-var TRYCLOUDFLARE_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
-var STARTUP_TIMEOUT_MS = 2e4;
+// src/ptyRegistry.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join as join3 } from "node:path";
+var MAX_BUFFERED_CHUNKS = 2e3;
+var registry = /* @__PURE__ */ new Map();
+var PASTE_ROOT = join3(tmpdir(), "agent-board-pastes");
+var IMAGE_EXT_BY_CODE = ["png", "jpg", "gif", "webp"];
+async function savePastedImage(sessionId, extCode, bytes) {
+  const dir = join3(PASTE_ROOT, sessionId);
+  await mkdir(dir, { recursive: true });
+  const ext = IMAGE_EXT_BY_CODE[extCode] ?? "png";
+  const path = join3(dir, `paste-${Date.now()}-${randomUUID2().slice(0, 8)}.${ext}`);
+  await writeFile(path, bytes);
+  return path;
+}
+function registerPtySession(sessionId, pty, ticket) {
+  const handle = { pty, ticket, outputBuffer: [], sockets: /* @__PURE__ */ new Set(), readOnly: false };
+  pty.onData((data) => {
+    handle.outputBuffer.push(data);
+    if (handle.outputBuffer.length > MAX_BUFFERED_CHUNKS) handle.outputBuffer.shift();
+    for (const socket of handle.sockets) {
+      if (socket.readyState === socket.OPEN) socket.send(data);
+    }
+  });
+  registry.set(sessionId, handle);
+}
+function getPtySession(sessionId) {
+  return registry.get(sessionId);
+}
+function setPtySessionReadOnly(sessionId, readOnly) {
+  const handle = registry.get(sessionId);
+  if (handle) handle.readOnly = readOnly;
+}
+function resizePtySession(sessionId, cols, rows) {
+  const handle = registry.get(sessionId);
+  if (!handle) return;
+  handle.pty.resize(cols, rows);
+}
+function stopPtySession(sessionId) {
+  const handle = registry.get(sessionId);
+  if (!handle) return;
+  for (const socket of handle.sockets) socket.close(4e3, "Session ended");
+  handle.pty.kill();
+  registry.delete(sessionId);
+  void rm(join3(PASTE_ROOT, sessionId), { recursive: true, force: true }).catch(() => {
+  });
+}
+
+// src/shellSession.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { spawn } from "node-pty";
+var SHELL_COMMAND = process.platform === "win32" ? process.env.COMSPEC ?? "cmd.exe" : process.env.SHELL ?? "bash";
+function spawnShellPty(repoPath, sessionIdPrefix) {
+  const sessionId = `${sessionIdPrefix}:${randomUUID3()}`;
+  const ticket = randomUUID3();
+  const pty = spawn(SHELL_COMMAND, [], {
+    name: "xterm-color",
+    cols: 120,
+    rows: 32,
+    cwd: repoPath
+  });
+  registerPtySession(sessionId, pty, ticket);
+  pty.onExit(({ exitCode }) => {
+    logger.runner.info("SHELL", `Shell ${sessionId} exited (code ${exitCode}).`);
+    stopPtySession(sessionId);
+  });
+  return { sessionId, ticket };
+}
+function openShellSession(repoPath) {
+  return spawnShellPty(repoPath, "shell");
+}
+function closeShellSession(sessionId) {
+  stopPtySession(sessionId);
+}
+var columnShells = /* @__PURE__ */ new Map();
+function openOrReuseColumnShell(key, repoPath, initialCommand) {
+  const existing = columnShells.get(key);
+  if (existing && getPtySession(existing.sessionId)) return existing;
+  const shell = spawnShellPty(repoPath, "column-shell");
+  columnShells.set(key, shell);
+  if (initialCommand) getPtySession(shell.sessionId)?.pty.write(`${initialCommand}\r`);
+  return shell;
+}
+function closeColumnShell(key) {
+  const existing = columnShells.get(key);
+  if (existing) stopPtySession(existing.sessionId);
+  columnShells.delete(key);
+}
+
+// src/skillsServer.ts
+import { execFile } from "node:child_process";
+import { homedir as homedir2 } from "node:os";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
 var IS_WINDOWS = process.platform === "win32";
-var BINARY_NAME = IS_WINDOWS ? "cloudflared.exe" : "cloudflared";
-var CLOUDFLARED_INSTALL_DOCS_URL = "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/";
-function wellKnownDirectories() {
-  const home = homedir2();
-  if (IS_WINDOWS) {
-    const candidates = [
-      process.env.ProgramFiles && join3(process.env.ProgramFiles, "cloudflared"),
-      process.env["ProgramFiles(x86)"] && join3(process.env["ProgramFiles(x86)"], "cloudflared"),
-      process.env.LOCALAPPDATA && join3(process.env.LOCALAPPDATA, "Microsoft", "WinGet", "Links"),
-      join3(home, "scoop", "shims"),
-      process.env.ChocolateyInstall && join3(process.env.ChocolateyInstall, "bin")
-    ];
-    return candidates.filter((dir) => Boolean(dir));
+var ANSI_ESCAPE_RE = /\x1b\[[0-9;]*[A-Za-z]/g;
+function stripAnsi(text) {
+  return text.replace(ANSI_ESCAPE_RE, "");
+}
+var SKILLS_LIST_TIMEOUT_MS = 2e4;
+var SKILLS_FIND_TIMEOUT_MS = 2e4;
+var SKILLS_REMOVE_TIMEOUT_MS = 2e4;
+var SKILLS_INSTALL_TIMEOUT_MS = 6e4;
+var SKILLS_UPDATE_TIMEOUT_MS = 6e4;
+var MAX_SKILLS_BODY_BYTES = 1e4;
+var CLI_ERROR_MESSAGE_MAX_LENGTH = 2e3;
+var mutationLocksByScope = /* @__PURE__ */ new Map();
+function withScopeLock(scopeKey, task) {
+  const previous = mutationLocksByScope.get(scopeKey) ?? Promise.resolve();
+  const current = previous.then(task, task);
+  mutationLocksByScope.set(
+    scopeKey,
+    current.then(
+      () => void 0,
+      () => void 0
+    )
+  );
+  return current;
+}
+function resolveScope(query, isGlobal) {
+  if (isGlobal) {
+    if (!authenticateAgent(query)) throw new HttpError(401, "Ticket inv\xE1lido ou expirado.");
+    return { cwd: homedir2(), lockKey: "global", globalFlag: ["-g"] };
   }
-  return ["/usr/local/bin", "/usr/bin", "/opt/homebrew/bin", join3(home, ".local", "bin")];
+  const entry = authenticate(query);
+  if (!entry) throw new HttpError(401, "Ticket inv\xE1lido, expirado, ou projeto desconhecido.");
+  return { cwd: entry.repoRoot, lockKey: entry.repoRoot, globalFlag: [] };
 }
-function pathDirectories() {
-  return (process.env.PATH ?? "").split(delimiter).map((dir) => dir.trim().replace(/^"|"$/g, "")).filter(Boolean);
+async function runSkillsCli(args2, cwd, timeoutMs) {
+  try {
+    const { stdout } = await execFileAsync("npx", ["skills", ...args2], { cwd, timeout: timeoutMs, shell: IS_WINDOWS });
+    return stripAnsi(stdout);
+  } catch (err) {
+    const cliErr = err;
+    if (cliErr.killed) {
+      throw new HttpError(504, `Comando da CLI skills excedeu o tempo limite de ${Math.round(timeoutMs / 1e3)}s.`);
+    }
+    if (typeof cliErr.stderr === "string" && cliErr.stderr.trim()) {
+      throw new HttpError(400, cliErr.stderr.trim().slice(0, CLI_ERROR_MESSAGE_MAX_LENGTH));
+    }
+    throw new HttpError(500, err instanceof Error ? err.message : "Erro desconhecido ao executar a CLI skills.");
+  }
 }
-function isExecutableFile(path) {
+function sendSkillsError(res, err) {
+  if (err instanceof HttpError) {
+    sendJson(res, err.status, { error: err.message });
+    return;
+  }
+  logger.runner.error("SKILLS", "Unexpected error handling a skills request:", err);
+  sendJson(res, 500, { error: "Erro interno do runner." });
+}
+function parseListOutput(stdout) {
+  let parsed;
   try {
-    accessSync(path, constants.X_OK);
-    return true;
+    parsed = JSON.parse(stdout);
   } catch {
-    return false;
+    throw new HttpError(500, "Resposta inesperada da CLI skills (list).");
+  }
+  if (!Array.isArray(parsed)) throw new HttpError(500, "Resposta inesperada da CLI skills (list).");
+  return parsed;
+}
+var FIND_ENTRY_RE = /^(?<package>[^\s@]+)@(?<skill>\S+)\s+(?<installs>[\d.,]+[KM]?)\s+installs?$/;
+var FIND_URL_RE = /^└\s+(?<url>\S+)$/;
+function parseFindOutput(stdout) {
+  const lines = stdout.split(/\r?\n/);
+  const results = [];
+  for (let i = 0; i < lines.length; i++) {
+    const match = FIND_ENTRY_RE.exec(lines[i].trim());
+    if (!match?.groups) continue;
+    const urlMatch = i + 1 < lines.length ? FIND_URL_RE.exec(lines[i + 1].trim()) : null;
+    results.push({
+      package: match.groups.package,
+      skill: match.groups.skill,
+      installs: match.groups.installs,
+      url: urlMatch?.groups?.url ?? ""
+    });
+  }
+  return results;
+}
+var POPULAR_SEARCH_TERMS = ["design", "test", "code", "git", "docs", "review", "data", "deploy"];
+var POPULAR_SKILLS_LIMIT = 10;
+var POPULAR_SKILLS_TTL_MS = 12 * 60 * 60 * 1e3;
+function parseInstallsCount(installs) {
+  const match = /^([\d.]+)\s*([KM])?$/i.exec(installs.trim());
+  if (!match) return 0;
+  const value = Number.parseFloat(match[1]);
+  if (Number.isNaN(value)) return 0;
+  const suffix = match[2]?.toUpperCase();
+  if (suffix === "K") return value * 1e3;
+  if (suffix === "M") return value * 1e6;
+  return value;
+}
+var popularSkillsCache = null;
+var popularSkillsPromise = null;
+async function computePopularSkills(cwd) {
+  const perTerm = await Promise.all(
+    POPULAR_SEARCH_TERMS.map(
+      (term) => runSkillsCli(["find", term], cwd, SKILLS_FIND_TIMEOUT_MS).then(parseFindOutput).catch(() => [])
+    )
+  );
+  const byKey = /* @__PURE__ */ new Map();
+  for (const entry of perTerm.flat()) {
+    const key = `${entry.package}@${entry.skill}`;
+    if (!byKey.has(key)) byKey.set(key, entry);
+  }
+  return [...byKey.values()].sort((a, b) => parseInstallsCount(b.installs) - parseInstallsCount(a.installs)).slice(0, POPULAR_SKILLS_LIMIT);
+}
+function getPopularSkills(cwd) {
+  if (popularSkillsCache && Date.now() - popularSkillsCache.computedAt < POPULAR_SKILLS_TTL_MS) {
+    return Promise.resolve(popularSkillsCache.entries);
+  }
+  if (!popularSkillsPromise) {
+    popularSkillsPromise = computePopularSkills(cwd).then((entries) => {
+      popularSkillsCache = { computedAt: Date.now(), entries };
+      return entries;
+    }).finally(() => {
+      popularSkillsPromise = null;
+    });
   }
+  return popularSkillsPromise;
 }
-function findInstalledBinary() {
-  const override = process.env.AGENT_BOARD_CLOUDFLARED_PATH;
-  const directories = [...pathDirectories(), ...wellKnownDirectories()];
-  const candidates = [...override ? [override] : [], ...directories.map((dir) => join3(dir, BINARY_NAME))];
-  return candidates.find(isExecutableFile) ?? null;
+function parseCliResultOutput(stdout) {
+  const trimmed = stdout.trim();
+  if (!trimmed) return { output: "" };
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    return { output: trimmed };
+  }
 }
-async function locateCloudflared() {
-  const installed = findInstalledBinary();
-  if (installed) return installed;
-  if (isExecutableFile(bundledBinaryPath)) return bundledBinaryPath;
+async function handleSkillsList(res, query, isGlobal) {
   try {
-    logger.runner.info("CLOUDFLARE", "Downloading the cloudflared binary (first run only)...");
-    return await downloadCloudflared(bundledBinaryPath);
+    const { cwd, globalFlag } = resolveScope(query, isGlobal);
+    const stdout = await runSkillsCli(["list", "--json", ...globalFlag], cwd, SKILLS_LIST_TIMEOUT_MS);
+    sendJson(res, 200, { skills: parseListOutput(stdout) });
   } catch (err) {
-    logger.runner.error("CLOUDFLARE", `Failed to download cloudflared. Install it manually: ${CLOUDFLARED_INSTALL_DOCS_URL}`, err);
-    return null;
+    sendSkillsError(res, err);
   }
 }
-var lookup = null;
-function resolveCloudflaredPath() {
-  lookup ??= locateCloudflared().then((path) => {
-    if (!path) lookup = null;
-    return path;
-  });
-  return lookup;
+async function handleSkillsFind(res, query, isGlobal) {
+  try {
+    const { cwd } = resolveScope(query, isGlobal);
+    const q = typeof query.q === "string" ? query.q : "";
+    const owner = typeof query.owner === "string" ? query.owner : "";
+    const args2 = ["find"];
+    if (q) args2.push(q);
+    if (owner) args2.push("--owner", owner);
+    const stdout = await runSkillsCli(args2, cwd, SKILLS_FIND_TIMEOUT_MS);
+    sendJson(res, 200, { results: parseFindOutput(stdout) });
+  } catch (err) {
+    sendSkillsError(res, err);
+  }
 }
-async function startQuickTunnel(label, port) {
-  const executable = await resolveCloudflaredPath();
-  if (!executable) {
-    logger.runner.error("CLOUDFLARE", `No cloudflared binary available, so ${label} cannot be exposed.`);
-    return null;
+async function handleSkillsPopular(res, query, isGlobal) {
+  try {
+    const { cwd } = resolveScope(query, isGlobal);
+    const entries = await getPopularSkills(cwd);
+    sendJson(res, 200, { results: entries });
+  } catch (err) {
+    sendSkillsError(res, err);
   }
-  return new Promise((resolve5) => {
-    let child2;
+}
+async function handleSkillsInstall(req, res, query, isGlobal) {
+  try {
+    const { cwd, lockKey, globalFlag } = resolveScope(query, isGlobal);
+    const raw = await readRequestBody(req, MAX_SKILLS_BODY_BYTES);
+    let body;
     try {
-      child2 = spawn(executable, [
-        "tunnel",
-        "--url",
-        `http://localhost:${port}`,
-        "--http-host-header",
-        `localhost:${port}`
-      ]);
-    } catch (err) {
-      logger.runner.error("CLOUDFLARE", `Failed to spawn cloudflared for ${label}:`, err);
-      resolve5(null);
-      return;
+      body = JSON.parse(raw);
+    } catch {
+      throw new HttpError(400, "Corpo inv\xE1lido.");
     }
-    let settled = false;
-    const settle = (value) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve5(value);
-    };
-    const timer = setTimeout(() => {
-      logger.runner.warn("CLOUDFLARE", `cloudflared for ${label} did not print a trycloudflare.com URL within ${STARTUP_TIMEOUT_MS}ms.`);
-      settle(null);
-    }, STARTUP_TIMEOUT_MS);
-    const onOutput = (chunk) => {
-      if (settled) return;
-      const match = chunk.toString("utf-8").match(TRYCLOUDFLARE_URL_RE);
-      if (match) settle({ url: match[0], child: child2 });
-    };
-    child2.stdout?.on("data", onOutput);
-    child2.stderr?.on("data", onOutput);
-    child2.on("error", (err) => {
-      logger.runner.error("CLOUDFLARE", `cloudflared process error for ${label} (${executable}):`, err);
-      settle(null);
-    });
-    child2.on("exit", (code) => {
-      logger.runner.info("CLOUDFLARE", `cloudflared tunnel for ${label} exited (code ${code}).`);
-      settle(null);
-    });
-  });
-}
-function toTunnelHostname(url) {
-  return new URL(url).host;
-}
-
-// src/devServer.ts
-var STARTUP_TIMEOUT_MS2 = 45e3;
-var IS_WINDOWS2 = process.platform === "win32";
-var LOCAL_URL_PORT_RE = /https?:\/\/(?:localhost|127\.0\.0\.1|\[::1\]|0\.0\.0\.0):(\d{2,5})/i;
-var GENERIC_PORT_RE = /(?:listening|running|server).{0,40}?:?\s*(\d{4,5})\b/i;
-var ANSI_ESCAPE_RE = /\x1b\[[0-9;]*m/g;
-function detectPortFromOutput(chunk) {
-  const clean = chunk.replace(ANSI_ESCAPE_RE, "");
-  const match = LOCAL_URL_PORT_RE.exec(clean) ?? GENERIC_PORT_RE.exec(clean);
-  return match ? Number(match[1]) : null;
-}
-function killProcessTree(child2) {
-  if (child2.pid == null) return;
-  if (IS_WINDOWS2) {
-    spawn2("taskkill", ["/pid", String(child2.pid), "/t", "/f"], { stdio: "ignore" });
-  } else {
-    child2.kill();
+    if (!body.package || typeof body.package !== "string") throw new HttpError(400, "Campo package \xE9 obrigat\xF3rio.");
+    const args2 = ["add", body.package];
+    if (body.skill) args2.push("-s", body.skill);
+    if (body.agent) args2.push("-a", body.agent);
+    args2.push(...globalFlag, "-y", "--json");
+    const stdout = await withScopeLock(lockKey, () => runSkillsCli(args2, cwd, SKILLS_INSTALL_TIMEOUT_MS));
+    sendJson(res, 200, { result: parseCliResultOutput(stdout) });
+  } catch (err) {
+    sendSkillsError(res, err);
   }
 }
-var previews = /* @__PURE__ */ new Map();
-function ensurePreview(key, label, cwd, command2, cardId) {
-  const existing = previews.get(key);
-  if (existing) {
-    existing.cardIds.add(cardId);
-    return existing.result;
-  }
-  let child2;
+async function handleSkillsRemove(req, res, query, isGlobal) {
   try {
-    child2 = spawn2(command2, { cwd, shell: true, windowsHide: true });
+    const { cwd, lockKey, globalFlag } = resolveScope(query, isGlobal);
+    const raw = await readRequestBody(req, MAX_SKILLS_BODY_BYTES);
+    let body;
+    try {
+      body = JSON.parse(raw);
+    } catch {
+      throw new HttpError(400, "Corpo inv\xE1lido.");
+    }
+    if (!body.name || typeof body.name !== "string") throw new HttpError(400, "Campo name \xE9 obrigat\xF3rio.");
+    const args2 = ["remove", body.name, ...globalFlag, "--json"];
+    const stdout = await withScopeLock(lockKey, () => runSkillsCli(args2, cwd, SKILLS_REMOVE_TIMEOUT_MS));
+    sendJson(res, 200, { result: parseCliResultOutput(stdout) });
   } catch (err) {
-    logger.runner.error("DEV_SERVER", `Failed to spawn "${command2}" in ${cwd}:`, err);
-    return Promise.resolve(null);
-  }
-  const entry = { child: child2, tunnelChild: null, cardIds: /* @__PURE__ */ new Set([cardId]), result: null };
-  entry.result = new Promise((resolve5) => {
-    let settled = false;
-    const settle = (value) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      if (!value) {
-        killProcessTree(child2);
-        previews.delete(key);
-      }
-      resolve5(value);
-    };
-    const timer = setTimeout(() => {
-      logger.runner.warn("DEV_SERVER", `"${command2}" in ${cwd} did not reveal a port within ${STARTUP_TIMEOUT_MS2}ms.`);
-      settle(null);
-    }, STARTUP_TIMEOUT_MS2);
-    const onOutput = async (chunk) => {
-      if (settled) return;
-      const port = detectPortFromOutput(chunk.toString("utf-8"));
-      if (port == null) return;
-      settled = true;
-      clearTimeout(timer);
-      const tunnel = await startQuickTunnel(`dev server ${key}`, port);
-      if (!tunnel) {
-        logger.runner.warn("DEV_SERVER", `Detected port ${port} for ${key} but cloudflared could not tunnel it.`);
-        killProcessTree(child2);
-        previews.delete(key);
-        resolve5(null);
-        return;
-      }
-      entry.tunnelChild = tunnel.child;
-      logger.runner.info("DEV_SERVER", `${key} is up on port ${port}, tunneled at ${tunnel.url}.`);
-      resolve5({ label, url: tunnel.url });
-    };
-    child2.stdout?.on("data", onOutput);
-    child2.stderr?.on("data", onOutput);
-    child2.on("error", (err) => {
-      logger.runner.error("DEV_SERVER", `Dev server process error for ${key} (${command2} in ${cwd}):`, err);
-      settle(null);
-    });
-    child2.on("exit", (code) => {
-      logger.runner.info("DEV_SERVER", `Dev server for ${key} exited (code ${code}) before/without a usable preview.`);
-      settle(null);
-    });
-  });
-  previews.set(key, entry);
-  return entry.result;
-}
-function releaseCard(cardId) {
-  for (const [key, entry] of previews) {
-    if (!entry.cardIds.delete(cardId)) continue;
-    if (entry.cardIds.size > 0) continue;
-    killProcessTree(entry.child);
-    entry.tunnelChild?.kill();
-    previews.delete(key);
-  }
-}
-function stopProjectPreviews(projectId) {
-  const prefix = `${projectId}:`;
-  for (const [key, entry] of previews) {
-    if (!key.startsWith(prefix)) continue;
-    killProcessTree(entry.child);
-    entry.tunnelChild?.kill();
-    previews.delete(key);
+    sendSkillsError(res, err);
   }
 }
-function stopAll() {
-  for (const key of [...previews.keys()]) {
-    const entry = previews.get(key);
-    if (!entry) continue;
-    killProcessTree(entry.child);
-    entry.tunnelChild?.kill();
-    previews.delete(key);
+async function handleSkillsUpdate(req, res, query, isGlobal) {
+  try {
+    const { cwd, lockKey, globalFlag } = resolveScope(query, isGlobal);
+    const raw = await readRequestBody(req, MAX_SKILLS_BODY_BYTES);
+    let body = {};
+    if (raw.trim()) {
+      try {
+        body = JSON.parse(raw);
+      } catch {
+        throw new HttpError(400, "Corpo inv\xE1lido.");
+      }
+    }
+    const names = Array.isArray(body.names) ? body.names.filter((name) => typeof name === "string" && name.length > 0) : [];
+    const args2 = ["update", ...names, ...globalFlag, "-y", "--json"];
+    const stdout = await withScopeLock(lockKey, () => runSkillsCli(args2, cwd, SKILLS_UPDATE_TIMEOUT_MS));
+    sendJson(res, 200, { result: parseCliResultOutput(stdout) });
+  } catch (err) {
+    sendSkillsError(res, err);
   }
 }
 
-// src/git.ts
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-var execFileAsync = promisify(execFile);
-async function pushBranchToMain(repoPath) {
+// src/activityLog.ts
+async function logActivity(supabase, params) {
   try {
-    await execFileAsync("git", ["push", "origin", "HEAD:main"], { cwd: repoPath });
-    return { ok: true };
+    const { error } = await supabase.from("activity_log").insert({
+      project_id: params.projectId,
+      card_id: params.cardId,
+      user_id: params.userId,
+      event_type: params.eventType,
+      payload: params.payload ?? {}
+    });
+    if (error) throw error;
   } catch (err) {
-    const stderr = err.stderr;
-    const error = stderr?.trim() || (err instanceof Error ? err.message : String(err));
-    return { ok: false, error };
+    logger.runner.error("ACTIVITY", `Failed to record activity log entry (${params.eventType}):`, err);
   }
 }
 
-// src/orchestrator.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-
-// src/agentActivity.ts
-var RECENT_WINDOW_MS = 6e3;
-var IDLE_AFTER_MS = 45e3;
-var EVAL_INTERVAL_MS = 2e3;
-var ANSI_PATTERN = /\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g;
-var BOX_DRAWING_PATTERN = /[─-╿]/g;
-var WORKING_PATTERN = /esc to interrupt/i;
-var USAGE_LIMIT_PATTERN = /(usage limit reached|limit reached[^\n]{0,60}resets|reached your (?:usage|session) limit|out of (?:weekly|session) (?:usage|limit))/i;
-var PLAN_APPROVAL_PATTERN = /would you like to proceed\??/i;
-var USER_PROMPT_PATTERNS = [
-  /do you want to\b/i,
-  /would you like to\b/i,
-  /do you trust the files\b/i,
-  /press enter to continue/i,
-  /\(y\/n\)/i,
-  /❯\s*1\.\s/
-];
-function normalizeTerminalOutput(raw) {
-  return raw.replace(ANSI_PATTERN, "").replace(BOX_DRAWING_PATTERN, " ").replace(/[ \t]+/g, " ");
+// src/sessions.ts
+async function countRunningSessions(supabase, projectId, ownerUserId) {
+  const { count, error } = await supabase.from("sessions").select("id, cards!card_id!inner(project_id, assigned_user_id)", { count: "exact", head: true }).eq("cards.project_id", projectId).eq("cards.assigned_user_id", ownerUserId).eq("status", "running");
+  if (error) throw error;
+  return count ?? 0;
 }
-function classifyAgentOutput(recentOutput, options) {
-  if (WORKING_PATTERN.test(recentOutput)) return "implementing";
-  if (options.usageLimited) return "usage_limited";
-  if (options.planApprovalPending) return "waiting_plan_approval";
-  if (USER_PROMPT_PATTERNS.some((pattern) => pattern.test(recentOutput))) return "waiting_user";
-  if (options.silentForMs >= IDLE_AFTER_MS) return "waiting_user";
-  return options.previous;
+async function listQueuedSessionsForRunner(supabase, ownerUserId) {
+  const { data, error } = await supabase.from("sessions").select(
+    "id, card_id, claude_session_id, agent_state, created_at, cards!card_id!inner(project_id, assigned_user_id, title, instructions, file_references, plan_first)"
+  ).eq("cards.assigned_user_id", ownerUserId).eq("status", "queued").order("created_at", { ascending: true });
+  if (error) throw error;
+  return data;
 }
-var AgentActivityWatcher = class {
-  constructor(onChange) {
-    this.onChange = onChange;
-    this.timer = setInterval(() => this.evaluate(), EVAL_INTERVAL_MS);
-    this.timer.unref();
-  }
-  chunks = [];
-  state = "implementing";
-  lastOutputAt = Date.now();
-  usageLimited = false;
-  planApprovalPending = false;
-  timer;
-  push(chunk) {
-    const now = Date.now();
-    const text = normalizeTerminalOutput(chunk);
-    this.lastOutputAt = now;
-    this.chunks.push({ at: now, text });
-    if (USAGE_LIMIT_PATTERN.test(text)) this.usageLimited = true;
-    if (PLAN_APPROVAL_PATTERN.test(text)) this.planApprovalPending = true;
-    if (WORKING_PATTERN.test(text)) {
-      this.usageLimited = false;
-      this.planApprovalPending = false;
-    }
-    this.evaluate(now);
-  }
-  stop() {
-    clearInterval(this.timer);
+async function createSession(supabase, userId, cardId, resumeClaudeSessionId) {
+  const { data, error } = await supabase.from("sessions").insert({
+    card_id: cardId,
+    user_id: userId,
+    status: "queued",
+    // Pre-set so spawnSessionPty takes the resume path (see its doc comment) instead of
+    // starting a blank conversation and resending the card's instructions.
+    ...resumeClaudeSessionId ? { claude_session_id: resumeClaudeSessionId } : {}
+  }).select("id").single();
+  if (error) throw error;
+  return data.id;
+}
+async function updateSession(supabase, sessionId, changes, activityContext) {
+  const { error } = await supabase.from("sessions").update({
+    ...changes.status !== void 0 ? { status: changes.status } : {},
+    ...changes.agentState !== void 0 ? { agent_state: changes.agentState } : {},
+    ...changes.startedAt !== void 0 ? { started_at: changes.startedAt } : {},
+    ...changes.endedAt !== void 0 ? { ended_at: changes.endedAt } : {},
+    ...changes.terminalTicket !== void 0 ? { terminal_ticket: changes.terminalTicket } : {},
+    ...changes.terminalTicketExpiresAt !== void 0 ? { terminal_ticket_expires_at: changes.terminalTicketExpiresAt } : {},
+    ...changes.claudeSessionId !== void 0 ? { claude_session_id: changes.claudeSessionId } : {}
+  }).eq("id", sessionId);
+  if (error) throw error;
+  if (changes.status !== void 0 && activityContext) {
+    await logActivity(supabase, {
+      projectId: activityContext.projectId,
+      cardId: activityContext.cardId,
+      userId: activityContext.userId,
+      eventType: "session_status_changed",
+      payload: { status: changes.status }
+    });
   }
-  evaluate(now = Date.now()) {
-    while (this.chunks.length > 0 && now - this.chunks[0].at > RECENT_WINDOW_MS) this.chunks.shift();
-    const next = classifyAgentOutput(this.chunks.map((chunk) => chunk.text).join(""), {
-      silentForMs: now - this.lastOutputAt,
-      usageLimited: this.usageLimited,
-      planApprovalPending: this.planApprovalPending,
-      previous: this.state
+}
+async function getActiveSessionForCard(supabase, cardId) {
+  const { data, error } = await supabase.from("sessions").select("id, status").eq("card_id", cardId).in("status", ["queued", "running", "waiting_input", "paused"]).order("created_at", { ascending: false }).limit(1).maybeSingle();
+  if (error) throw error;
+  return data;
+}
+async function pauseRunningSession(supabase, sessionId, activityContext) {
+  const { data, error } = await supabase.from("sessions").update({ status: "paused" }).eq("id", sessionId).eq("status", "running").select("id");
+  if (error) throw error;
+  const applied = (data ?? []).length > 0;
+  if (applied) {
+    await logActivity(supabase, {
+      projectId: activityContext.projectId,
+      cardId: activityContext.cardId,
+      userId: activityContext.userId,
+      eventType: "session_status_changed",
+      payload: { status: "paused" }
     });
-    if (next === this.state) return;
-    this.state = next;
-    this.onChange(next);
   }
-};
-
-// src/agentSession.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { spawn as spawn3 } from "node-pty";
-
-// src/sessionName.ts
-var MAX_LENGTH = 60;
-var FALLBACK_NAME = "card";
-function toSessionName(title) {
-  const slug = title.normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  if (slug.length === 0) return FALLBACK_NAME;
-  if (slug.length <= MAX_LENGTH) return slug;
-  const truncated = slug.slice(0, MAX_LENGTH);
-  const lastHyphen = truncated.lastIndexOf("-");
-  return (lastHyphen > 0 ? truncated.slice(0, lastHyphen) : truncated).replace(/-+$/, "");
+  return applied;
 }
-
-// src/statuslineScript.ts
-import { writeFileSync as writeFileSync3 } from "node:fs";
-import { tmpdir } from "node:os";
+async function getLastClaudeSessionIdForCard(supabase, cardId) {
+  const { data, error } = await supabase.from("sessions").select("claude_session_id").eq("card_id", cardId).order("created_at", { ascending: false }).limit(1).maybeSingle();
+  if (error) throw error;
+  return data?.claude_session_id ?? null;
+}
+async function updateCard(supabase, cardId, changes) {
+  const { error } = await supabase.from("cards").update({
+    ...changes.column !== void 0 ? { column_name: changes.column } : {},
+    ...changes.previewUrls !== void 0 ? { preview_urls: changes.previewUrls } : {},
+    ...changes.deployError !== void 0 ? { deploy_error: changes.deployError } : {},
+    ...changes.customActionStatus !== void 0 ? { custom_action_status: changes.customActionStatus } : {},
+    ...changes.customActionOutput !== void 0 ? { custom_action_output: changes.customActionOutput } : {},
+    ...changes.requeueRequestedAt !== void 0 ? { requeue_requested_at: changes.requeueRequestedAt } : {}
+  }).eq("id", cardId);
+  if (error) throw error;
+}
+async function getProject(supabase, projectId) {
+  const { data, error } = await supabase.from("projects").select("*").eq("id", projectId).single();
+  if (error) throw error;
+  return data;
+}
+async function getProjectRepos(supabase, projectId) {
+  const { data, error } = await supabase.from("project_repos").select("subpath, dev_command, column_actions").eq("project_id", projectId);
+  if (error) throw error;
+  return data;
+}
+async function listCardsInColumn(supabase, projectId, column) {
+  const { data, error } = await supabase.from("cards").select(
+    "id, project_id, title, instructions, column_name, assigned_user_id, deploy_error, file_references, preview_urls, custom_action_status, requeue_requested_at"
+  ).eq("project_id", projectId).eq("column_name", column);
+  if (error) throw error;
+  return data;
+}
+async function clearProjectDeployRequest(supabase, projectId) {
+  const { error } = await supabase.from("projects").update({ deploy_requested_at: null }).eq("id", projectId);
+  if (error) throw error;
+}
+async function clearDevServerRestartRequest(supabase, projectId) {
+  const { error } = await supabase.from("projects").update({ dev_server_restart_requested_at: null }).eq("id", projectId);
+  if (error) throw error;
+}
+async function clearDeployActionRerunRequest(supabase, projectId) {
+  const { error } = await supabase.from("projects").update({ deploy_action_rerun_requested_at: null }).eq("id", projectId);
+  if (error) throw error;
+}
+async function updateProjectFilesTicket(supabase, projectId, ticket, expiresAt) {
+  const { error } = await supabase.from("projects").update({ files_ticket: ticket, files_ticket_expires_at: expiresAt }).eq("id", projectId);
+  if (error) throw error;
+}
+async function updateRunnerSetupTicket(supabase, runnerId, ticket, expiresAt, allowedRootPath) {
+  const { error } = await supabase.from("runners").update({ setup_ticket: ticket, setup_ticket_expires_at: expiresAt, allowed_root_path: allowedRootPath }).eq("id", runnerId);
+  if (error) throw error;
+}
+async function updateRunnerAgentTicket(supabase, runnerId, ticket, expiresAt) {
+  const { error } = await supabase.from("runners").update({ agent_ticket: ticket, agent_ticket_expires_at: expiresAt }).eq("id", runnerId);
+  if (error) throw error;
+}
+async function listMyProjects(supabase) {
+  const { data, error } = await supabase.from("projects").select("id, runner_id, repo_path, logo_path");
+  if (error) throw error;
+  return data;
+}
+async function listProjectRunnerIds(supabase, runnerId) {
+  const { data, error } = await supabase.from("project_runners").select("project_id").eq("runner_id", runnerId);
+  if (error) throw error;
+  return new Set(data.map((row) => row.project_id));
+}
+async function addProjectRunner(supabase, projectId, runnerId) {
+  const { error } = await supabase.from("project_runners").insert({ project_id: projectId, runner_id: runnerId });
+  if (error) throw error;
+}
+async function getRunnerMaxConcurrentProjects(supabase, runnerId) {
+  const { data, error } = await supabase.from("runners").select("max_concurrent_projects").eq("id", runnerId).single();
+  if (error) throw error;
+  return data.max_concurrent_projects;
+}
+async function updateProjectLogoPath(supabase, projectId, logoPath) {
+  const { error } = await supabase.from("projects").update({ logo_path: logoPath }).eq("id", projectId);
+  if (error) throw error;
+}
+async function upsertColumnShell(supabase, projectId, column, kind, sessionId, ticket) {
+  const { error } = await supabase.from("column_shells").upsert(
+    { project_id: projectId, column_name: column, kind, session_id: sessionId, ticket },
+    { onConflict: "project_id,column_name,kind" }
+  );
+  if (error) throw error;
+}
+async function deleteColumnShell(supabase, projectId, column, kind) {
+  const { error } = await supabase.from("column_shells").delete().eq("project_id", projectId).eq("column_name", column).eq("kind", kind);
+  if (error) throw error;
+}
+async function getClaudeUsage(supabase, userId) {
+  const { data, error } = await supabase.from("claude_usage").select("session_resets_at, week_resets_at").eq("user_id", userId).maybeSingle();
+  if (error) throw error;
+  if (!data) return null;
+  return { sessionResetsAt: data.session_resets_at, weekResetsAt: data.week_resets_at };
+}
+async function upsertClaudeUsage(supabase, userId, changes) {
+  const { error } = await supabase.from("claude_usage").upsert({
+    user_id: userId,
+    ...changes.sessionPercent !== void 0 ? { session_pct: changes.sessionPercent } : {},
+    ...changes.sessionResetsAt !== void 0 ? { session_resets_at: changes.sessionResetsAt } : {},
+    ...changes.weekPercent !== void 0 ? { week_pct: changes.weekPercent } : {},
+    ...changes.weekResetsAt !== void 0 ? { week_resets_at: changes.weekResetsAt } : {},
+    updated_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  if (error) throw error;
+}
+
+// src/usageMonitor.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { homedir as homedir3, tmpdir as tmpdir5 } from "node:os";
+import { join as join7 } from "node:path";
+import { spawn as spawn2 } from "node-pty";
+
+// src/agentMomentHookScript.ts
+import { writeFileSync as writeFileSync3 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
 import { join as join4 } from "node:path";
-var CLAUDE_BINARY = process.platform === "win32" ? "claude.exe" : "claude";
-var STATUSLINE_SCRIPT_PATH = join4(tmpdir(), "agent-board-statusline.cjs");
+var AGENT_MOMENT_HOOK_SCRIPT_PATH = join4(tmpdir2(), "agent-board-agent-moment-hook.cjs");
 var SCRIPT_SOURCE = `#!/usr/bin/env node
 "use strict";
 const http = require("node:http");
@@ -581,6 +935,229 @@ function readStdin() {
   });
 }
 
+// Mirrors agentActivity.ts's COMMIT_SUCCESS_PATTERN (git's own success banner, e.g.
+// "[main 1a2b3c4] fix: ..."), checked against the tool_response Claude Code hands back for a
+// Bash call rather than the raw scrollback \u2014 the banner can't have scrolled out of a sliding
+// text window if it's read straight off the command's own result.
+const COMMIT_SUCCESS_PATTERN = /\\[\\S+\\s+[0-9a-f]{7,40}\\]/;
+const GIT_COMMIT_COMMAND_PATTERN = /\\bgit\\b[^\\n]*\\bcommit\\b/i;
+
+// Which "moment" (if any) this hook invocation reports, from the single JSON payload Claude
+// Code gives a hook on stdin. Returning null means "nothing conclusive" \u2014 the hook exits
+// quietly and the runner's text-based fallback (agentActivity.ts) stays in charge.
+function detectMoment(input) {
+  const eventName = input.hook_event_name;
+
+  // A new turn actually starting \u2014 whether typed by a human in the terminal or submitted
+  // programmatically (the card's opening instructions, or the auto "continue" after a
+  // usage-limit wait \u2014 see agentSession.ts).
+  if (eventName === "UserPromptSubmit") return "implementing";
+
+  // Claude Code's own exit-plan-mode tool call: this is the precise instant it stops to ask
+  // "would you like to proceed?", before the CLI even renders the prompt.
+  if (eventName === "PreToolUse" && input.tool_name === "ExitPlanMode") return "waiting_plan_approval";
+
+  // The plan prompt resolving one way or the other: approved, the turn resumes implementing
+  // right away with no new UserPromptSubmit to catch it; asked to revise, a fresh
+  // UserPromptSubmit follows almost immediately anyway. Either way "implementing" is correct
+  // or self-corrects within a beat \u2014 never gets stuck on "waiting_plan_approval" forever.
+  if (eventName === "PostToolUse" && input.tool_name === "ExitPlanMode") return "implementing";
+
+  // A commit that actually succeeded, read off the Bash tool's own structured result instead
+  // of guessing from scrollback text (exact, and immune to locale/color/format changes to
+  // git's own banner).
+  if (eventName === "PostToolUse" && input.tool_name === "Bash") {
+    const command = String((input.tool_input && input.tool_input.command) || "");
+    if (!GIT_COMMIT_COMMAND_PATTERN.test(command)) return null;
+    const response = JSON.stringify(input.tool_response || "");
+    return COMMIT_SUCCESS_PATTERN.test(response) ? "commit_detected" : null;
+  }
+
+  // The turn actually ending \u2014 Claude Code back at its input box, no idle timer needed.
+  if (eventName === "Stop") return "turn_stopped";
+
+  // Claude Code's own notice that it's waiting on the user (permission prompts under normal
+  // permission modes, or its 60s-idle nudge) \u2014 a generic fallback for whatever specific
+  // prompt isn't one of the moments above.
+  if (eventName === "Notification") return "notification";
+
+  return null;
+}
+
+function reportToRunner(sessionId, ticket, port, moment) {
+  return new Promise((resolve) => {
+    try {
+      const body = JSON.stringify({ sessionId, ticket, moment });
+      const req = http.request(
+        {
+          host: "127.0.0.1",
+          port,
+          path: "/agent-hook",
+          method: "POST",
+          headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) },
+          timeout: 1000,
+        },
+        (res) => {
+          res.resume();
+          resolve();
+        },
+      );
+      req.on("error", () => resolve());
+      req.on("timeout", () => { req.destroy(); resolve(); });
+      req.end(body);
+    } catch {
+      resolve();
+    }
+  });
+}
+
+(async () => {
+  try {
+    const input = JSON.parse(await readStdin());
+    const moment = detectMoment(input);
+    if (moment) {
+      const sessionId = process.env.AGENT_BOARD_SESSION_ID;
+      const ticket = process.env.AGENT_BOARD_STATUSLINE_TICKET;
+      const port = Number(process.env.AGENT_BOARD_STATUSLINE_PORT);
+      if (sessionId && ticket && port) await reportToRunner(sessionId, ticket, port, moment);
+    }
+  } catch {
+    // A malformed/unexpected hook payload must never block the agent's own turn.
+  }
+  process.exit(0);
+})();
+`;
+function ensureAgentMomentHookScriptWritten() {
+  writeFileSync3(AGENT_MOMENT_HOOK_SCRIPT_PATH, SCRIPT_SOURCE, { mode: 493 });
+  logger.runner.info("AGENT-MOMENT-HOOK", `Agent-moment hook script written to ${AGENT_MOMENT_HOOK_SCRIPT_PATH}.`);
+}
+function agentMomentHookSettingsFragment() {
+  const hookEntry = {
+    type: "command",
+    command: `${JSON.stringify(process.execPath)} ${JSON.stringify(AGENT_MOMENT_HOOK_SCRIPT_PATH)}`
+  };
+  return {
+    hooks: {
+      UserPromptSubmit: [{ hooks: [hookEntry] }],
+      PreToolUse: [{ matcher: "ExitPlanMode", hooks: [hookEntry] }],
+      PostToolUse: [
+        { matcher: "ExitPlanMode", hooks: [hookEntry] },
+        { matcher: "Bash", hooks: [hookEntry] }
+      ],
+      Stop: [{ hooks: [hookEntry] }],
+      Notification: [{ hooks: [hookEntry] }]
+    }
+  };
+}
+
+// src/safetyHookScript.ts
+import { writeFileSync as writeFileSync4 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
+import { join as join5 } from "node:path";
+var SAFETY_HOOK_SCRIPT_PATH = join5(tmpdir3(), "agent-board-safety-hook.cjs");
+var SCRIPT_SOURCE2 = `#!/usr/bin/env node
+"use strict";
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let raw = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => { raw += chunk; });
+    process.stdin.on("end", () => resolve(raw));
+    process.stdin.on("error", () => resolve(raw));
+  });
+}
+
+const PROTECTED_NAMES = ["node", "claude", "pm2", "cloudflared"];
+
+// Each one matches a construct that kills by process name/pattern rather than by PID.
+const KILL_BY_NAME_CONSTRUCTS = [
+  /\\btaskkill\\b[^\\n]*\\/im\\b/i, // Windows: taskkill ... /IM <name>
+  /\\bstop-process\\b[^\\n]*-(?:process)?name\\b/i, // PowerShell: Stop-Process -Name/-ProcessName <name>
+  /\\bget-process\\b[^\\n]*\\|[^\\n]*\\bstop-process\\b/i, // PowerShell: Get-Process <name> | Stop-Process
+  /\\bwmic\\b[^\\n]*\\bprocess\\b[^\\n]*\\bcall\\s+terminate\\b/i, // wmic process where name='<name>' call terminate
+  /\\b(?:pkill|killall)\\b/i, // POSIX: pkill/killall <name or -f pattern>
+];
+
+function mentionsProtectedName(command) {
+  return PROTECTED_NAMES.some((name) => new RegExp(\`\\\\b\${name}(?:\\\\.exe)?\\\\b\`, "i").test(command));
+}
+
+function findViolation(command) {
+  if (!mentionsProtectedName(command)) return null;
+  const matched = KILL_BY_NAME_CONSTRUCTS.find((pattern) => pattern.test(command));
+  return matched ? PROTECTED_NAMES.find((name) => new RegExp(\`\\\\b\${name}(?:\\\\.exe)?\\\\b\`, "i").test(command)) : null;
+}
+
+(async () => {
+  try {
+    const input = JSON.parse(await readStdin());
+    if (input.hook_event_name === "PreToolUse" && input.tool_name === "Bash") {
+      const command = String((input.tool_input && input.tool_input.command) || "");
+      const violation = findViolation(command);
+      if (violation) {
+        process.stdout.write(JSON.stringify({
+          hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            permissionDecision: "deny",
+            permissionDecisionReason:
+              \`Blocked by Agent Board: this would kill every "\${violation}" process on the machine, not \` +
+              "just this project's \u2014 that includes the Agent Board runner itself, every other card's " +
+              "session, and other projects' dev-server previews. Target the specific PID instead (find it " +
+              'with "netstat -ano | findstr :<port>" or "Get-Process", then "taskkill /pid <pid> /t /f" or ' +
+              '"Stop-Process -Id <pid> -Force").',
+          },
+        }));
+      }
+    }
+  } catch {
+    // A malformed/unexpected hook payload must never block a legitimate command.
+  }
+  process.exit(0);
+})();
+`;
+function ensureSafetyHookScriptWritten() {
+  writeFileSync4(SAFETY_HOOK_SCRIPT_PATH, SCRIPT_SOURCE2, { mode: 493 });
+  logger.runner.info("SAFETY-HOOK", `Process-kill safety hook written to ${SAFETY_HOOK_SCRIPT_PATH}.`);
+}
+function safetyHookSettingsFragment() {
+  return {
+    hooks: {
+      PreToolUse: [
+        {
+          matcher: "Bash",
+          hooks: [
+            {
+              type: "command",
+              command: `${JSON.stringify(process.execPath)} ${JSON.stringify(SAFETY_HOOK_SCRIPT_PATH)}`
+            }
+          ]
+        }
+      ]
+    }
+  };
+}
+
+// src/statuslineScript.ts
+import { writeFileSync as writeFileSync5 } from "node:fs";
+import { tmpdir as tmpdir4 } from "node:os";
+import { join as join6 } from "node:path";
+var CLAUDE_BINARY = process.platform === "win32" ? "claude.exe" : "claude";
+var STATUSLINE_SCRIPT_PATH = join6(tmpdir4(), "agent-board-statusline.cjs");
+var SCRIPT_SOURCE3 = `#!/usr/bin/env node
+"use strict";
+const http = require("node:http");
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let raw = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => { raw += chunk; });
+    process.stdin.on("end", () => resolve(raw));
+    process.stdin.on("error", () => resolve(raw));
+  });
+}
+
 function formatPercent(value) {
   return typeof value === "number" ? \`\${Math.round(value)}%\` : "?";
 }
@@ -640,19 +1217,16 @@ function reportToRunner(sessionId, ticket, port, rateLimits) {
 })();
 `;
 function ensureStatuslineScriptWritten() {
-  writeFileSync3(STATUSLINE_SCRIPT_PATH, SCRIPT_SOURCE, { mode: 493 });
+  writeFileSync5(STATUSLINE_SCRIPT_PATH, SCRIPT_SOURCE3, { mode: 493 });
   logger.runner.info("STATUSLINE", `Status line script written to ${STATUSLINE_SCRIPT_PATH}.`);
 }
-function statuslineSettingsArgs() {
-  return [
-    "--settings",
-    JSON.stringify({
-      statusLine: {
-        type: "command",
-        command: `${JSON.stringify(process.execPath)} ${JSON.stringify(STATUSLINE_SCRIPT_PATH)}`
-      }
-    })
-  ];
+function statuslineSettingsFragment() {
+  return {
+    statusLine: {
+      type: "command",
+      command: `${JSON.stringify(process.execPath)} ${JSON.stringify(STATUSLINE_SCRIPT_PATH)}`
+    }
+  };
 }
 function statuslineEnv(sessionId, ticket) {
   return {
@@ -668,1221 +1242,1812 @@ function statuslineEnv(sessionId, ticket) {
   };
 }
 
-// src/agentSession.ts
-var TUI_IDLE_MS = 1500;
-var TUI_READY_TIMEOUT_MS = 6e4;
-var SUBMIT_DELAY_MS = 150;
-var PASTE_START = "\x1B[200~";
-var PASTE_END = "\x1B[201~";
-var SHIFT_TAB = "\x1B[Z";
-var SHIFT_TAB_PRESSES_TO_PLAN_MODE = 4;
-var SHIFT_TAB_DELAY_MS = 400;
-var PLAN_MODE_INDICATOR = /plan mode on/i;
-function spawnAgentPty(repoPath, cardId, cardTitle, instructions, sessionId, ticket, planFirst) {
-  const claudeSessionId = randomUUID2();
-  const pty = spawn3(
-    CLAUDE_BINARY,
-    [
-      "--dangerously-skip-permissions",
-      "--model",
-      "claude-sonnet-5",
-      "--session-id",
-      claudeSessionId,
-      ...statuslineSettingsArgs(),
-      `/rename ${toSessionName(cardTitle)}`
-    ],
-    {
-      name: "xterm-color",
-      cols: 120,
-      rows: 32,
-      cwd: repoPath,
-      env: statuslineEnv(sessionId, ticket)
+// src/claudeCliSettings.ts
+function mergeHookFragments(...fragments) {
+  const merged = {};
+  for (const fragment of fragments) {
+    const hooks = fragment.hooks ?? {};
+    for (const [eventName, entries] of Object.entries(hooks)) {
+      merged[eventName] = [...merged[eventName] ?? [], ...entries];
     }
-  );
-  sendMessageWhenIdle(pty, cardId, instructions, planFirst);
-  return { pty, claudeSessionId };
+  }
+  return merged;
 }
-function sendMessageWhenIdle(pty, cardId, message, planFirst) {
-  let idleTimer;
-  let deadlineTimer;
-  let dataSubscription;
-  let settled = false;
-  const stopWaiting = () => {
-    if (settled) return false;
-    settled = true;
-    clearTimeout(idleTimer);
-    clearTimeout(deadlineTimer);
-    dataSubscription?.dispose();
-    return true;
-  };
-  const send = async () => {
-    if (!stopWaiting()) return;
-    if (planFirst) await enterPlanMode(pty, cardId);
-    try {
-      pty.write(`${PASTE_START}${message}${PASTE_END}`);
-      setTimeout(() => {
-        try {
-          pty.write("\r");
-        } catch (err) {
-          logger.card.error(cardId, "Failed to submit the card instructions to the agent:", err);
-        }
-      }, SUBMIT_DELAY_MS);
-    } catch (err) {
-      logger.card.error(cardId, "Failed to send the card instructions to the agent:", err);
-    }
-  };
-  deadlineTimer = setTimeout(send, TUI_READY_TIMEOUT_MS);
-  dataSubscription = pty.onData(() => {
-    clearTimeout(idleTimer);
-    idleTimer = setTimeout(send, TUI_IDLE_MS);
-  });
-  pty.onExit(() => stopWaiting());
+function claudeCliSettingsArgs() {
+  return [
+    "--settings",
+    JSON.stringify({
+      ...statuslineSettingsFragment(),
+      hooks: mergeHookFragments(safetyHookSettingsFragment(), agentMomentHookSettingsFragment())
+    })
+  ];
 }
-async function enterPlanMode(pty, cardId) {
-  let recentOutput = "";
-  const subscription = pty.onData((chunk) => {
-    recentOutput += normalizeTerminalOutput(chunk);
-  });
+
+// src/usageMonitor.ts
+var SESSION_ID = "usage-monitor";
+var TICKET = randomUUID4();
+var SCRATCH_DIR = join7(tmpdir5(), "agent-board-usage-monitor");
+var POLL_INTERVAL_MS = Number(process.env.AGENT_BOARD_USAGE_POLL_INTERVAL_MS ?? 15 * 6e4);
+var IDLE_MS = 2e3;
+var HARD_TIMEOUT_MS = 6e4;
+function usageMonitorSessionId() {
+  return SESSION_ID;
+}
+function usageMonitorTicket() {
+  return TICKET;
+}
+function ensureScratchDirTrusted() {
+  const claudeJsonPath = join7(homedir3(), ".claude.json");
+  if (!existsSync3(claudeJsonPath)) return;
   try {
-    for (let attempt = 1; attempt <= SHIFT_TAB_PRESSES_TO_PLAN_MODE; attempt++) {
-      pty.write(SHIFT_TAB);
-      await new Promise((resolve5) => setTimeout(resolve5, SHIFT_TAB_DELAY_MS));
-    }
-    if (!PLAN_MODE_INDICATOR.test(recentOutput)) {
-      logger.card.warn(
-        cardId,
-        `Sent ${SHIFT_TAB_PRESSES_TO_PLAN_MODE} Shift+Tab presses but never saw the plan-mode indicator \u2014 the session may not actually be in Plan Mode.`
-      );
+    const raw = readFileSync3(claudeJsonPath, "utf8");
+    const data = JSON.parse(raw);
+    data.projects ??= {};
+    const keys = [SCRATCH_DIR, SCRATCH_DIR.replace(/\\/g, "/")];
+    const alreadyTrusted = keys.every((key) => data.projects[key]?.hasTrustDialogAccepted === true);
+    if (alreadyTrusted) return;
+    for (const key of keys) {
+      data.projects[key] = { ...data.projects[key], hasTrustDialogAccepted: true };
     }
+    writeFileSync6(claudeJsonPath, JSON.stringify(data, null, 2));
+    logger.runner.info("USAGE_MONITOR", `Pre-trusted scratch directory ${SCRATCH_DIR} in ~/.claude.json.`);
   } catch (err) {
-    logger.card.error(cardId, "Failed to switch the session into Plan Mode:", err);
-  } finally {
-    subscription.dispose();
+    logger.runner.error("USAGE_MONITOR", "Failed to pre-trust the usage-monitor scratch directory:", err);
   }
 }
-function sendContinue(pty, cardId) {
+function pollUsageOnce() {
+  let pty;
   try {
-    pty.write(`${PASTE_START}continue${PASTE_END}`);
-    setTimeout(() => {
-      try {
-        pty.write("\r");
-      } catch (err) {
-        logger.card.error(cardId, 'Failed to submit the auto-resume "continue" message:', err);
+    pty = spawn2(
+      CLAUDE_BINARY,
+      [
+        "--dangerously-skip-permissions",
+        "--model",
+        "claude-haiku-4-5",
+        // cheapest model — this exchange exists only to trigger a statusLine update
+        ...claudeCliSettingsArgs(),
+        "reply with just the word: ok"
+      ],
+      {
+        name: "xterm-color",
+        cols: 80,
+        rows: 24,
+        cwd: SCRATCH_DIR,
+        env: statuslineEnv(SESSION_ID, TICKET)
       }
-    }, SUBMIT_DELAY_MS);
+    );
   } catch (err) {
-    logger.card.error(cardId, 'Failed to send the auto-resume "continue" message:', err);
+    logger.runner.error("USAGE_MONITOR", "Failed to spawn the usage-poll session:", err);
+    return;
   }
-}
-function resumeAgentPty(repoPath, claudeSessionId, sessionId, ticket) {
-  return spawn3(
-    CLAUDE_BINARY,
-    [
-      "--dangerously-skip-permissions",
-      "--model",
-      "claude-sonnet-5",
-      "--resume",
-      claudeSessionId,
-      ...statuslineSettingsArgs()
-    ],
-    {
-      name: "xterm-color",
-      cols: 120,
-      rows: 32,
-      cwd: repoPath,
-      env: statuslineEnv(sessionId, ticket)
+  let settled = false;
+  let idleTimer;
+  const hardTimer = setTimeout(finish, HARD_TIMEOUT_MS);
+  function finish() {
+    if (settled) return;
+    settled = true;
+    clearTimeout(idleTimer);
+    clearTimeout(hardTimer);
+    try {
+      pty.kill();
+    } catch {
     }
-  );
+  }
+  pty.onData(() => {
+    clearTimeout(idleTimer);
+    idleTimer = setTimeout(finish, IDLE_MS);
+  });
+  pty.onExit(() => finish());
+}
+function startUsageMonitor() {
+  mkdirSync3(SCRATCH_DIR, { recursive: true });
+  ensureScratchDirTrusted();
+  pollUsageOnce();
+  setInterval(pollUsageOnce, POLL_INTERVAL_MS);
 }
 
-// ../../packages/shared-types/dist/index.js
-var CARD_IMAGES_BUCKET = "agent-board-card-images";
-var MAX_CARD_IMAGE_BYTES = 10 * 1024 * 1024;
-
-// src/cardImages.ts
-import { mkdir, writeFile } from "node:fs/promises";
-import { tmpdir as tmpdir2 } from "node:os";
-import { extname, join as join5 } from "node:path";
-var IMAGES_ROOT = join5(tmpdir2(), "agent-board", "card-images");
-function sanitizeFileName(fileName) {
-  return fileName.replace(/[^a-zA-Z0-9._-]/g, "_");
+// src/filesServer.ts
+var execFileAsync2 = promisify2(execFile2);
+var CLAUDE_BYPASS_COMMAND = "claude --dangerously-skip-permissions";
+var FILES_TICKET_TTL_MS = 15 * 60 * 1e3;
+var FILES_TICKET_REFRESH_MARGIN_MS = FILES_TICKET_TTL_MS / 3;
+var MAX_FILE_SIZE_BYTES = 1e6;
+var MAX_LOGO_SIZE_BYTES = 5e6;
+var IGNORED_ENTRY_NAMES = /* @__PURE__ */ new Set([".git", ".claude", "node_modules", "dist", "build"]);
+var AGENT_SAFE_SUBDIR_NAMES = /* @__PURE__ */ new Set(["skills", "commands", "agents", "rules"]);
+function ensureSkillsDirExists(claudeDir) {
+  try {
+    mkdirSync4(join8(claudeDir, "skills"), { recursive: true });
+  } catch (err) {
+    logger.runner.warn("FILES", "Could not create .claude/skills:", err);
+  }
 }
-async function downloadCardImages(supabase, cardId) {
-  const { data, error } = await supabase.from("card_images").select("id, storage_path, file_name").eq("card_id", cardId).order("created_at", { ascending: true });
-  if (error) {
-    logger.card.error(cardId, "Failed to list images:", error.message);
-    return [];
+var BRAND_ICON_BASE_NAMES = ["logo", "favicon"];
+var MIME_TYPES_BY_EXT = {
+  svg: "image/svg+xml",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  webp: "image/webp",
+  gif: "image/gif",
+  ico: "image/x-icon"
+};
+var ticketsByProject = /* @__PURE__ */ new Map();
+var setupTicket = null;
+var agentTicket = null;
+var statuslineSupabase = null;
+var statuslineConfig = null;
+var MAX_STATUSLINE_BODY_BYTES = 16e3;
+var HttpError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
   }
-  const rows = data ?? [];
-  if (rows.length === 0) return [];
-  const targetDir = join5(IMAGES_ROOT, cardId);
-  await mkdir(targetDir, { recursive: true });
-  const paths = [];
-  for (const row of rows) {
-    const baseName = sanitizeFileName(row.file_name);
-    const fileName = extname(baseName) ? baseName : `${baseName}${extname(row.storage_path)}`;
-    const localPath = join5(targetDir, `${row.id}-${fileName}`);
+};
+async function ensureFilesTickets(supabase, config) {
+  for (const project of config.registeredProjects) {
+    if (!project.isReferenceRunner) continue;
+    const existing = ticketsByProject.get(project.id);
+    if (existing && existing.expiresAt - Date.now() > FILES_TICKET_REFRESH_MARGIN_MS) continue;
+    const ticket = randomUUID5();
+    const expiresAtMs = Date.now() + FILES_TICKET_TTL_MS;
+    ticketsByProject.set(project.id, { ticket, expiresAt: expiresAtMs, repoRoot: resolve2(project.repoPath) });
     try {
-      const { data: blob, error: downloadError } = await supabase.storage.from(CARD_IMAGES_BUCKET).download(row.storage_path);
-      if (downloadError) throw downloadError;
-      await writeFile(localPath, Buffer.from(await blob.arrayBuffer()));
-      paths.push(localPath);
+      await updateProjectFilesTicket(supabase, project.id, ticket, new Date(expiresAtMs).toISOString());
     } catch (err) {
-      logger.card.error(cardId, `Failed to download image ${row.storage_path}:`, err);
+      logger.runner.error("FILES", `Failed to publish files ticket for project ${project.id}:`, err);
     }
   }
-  return paths;
-}
-function buildInstructionsWithImages(instructions, imagePaths) {
-  if (imagePaths.length === 0) return instructions;
-  const list = imagePaths.map((path) => `- ${path}`).join("\n");
-  return `${instructions}
-
-Images attached to this card (read each one before starting; they are part of the task):
-${list}`;
 }
-
-// src/fileReferences.ts
-function buildInstructionsWithFileReferences(instructions, fileReferences) {
-  if (fileReferences.length === 0) return instructions;
-  const list = fileReferences.map((path) => `- ${path}`).join("\n");
-  return `${instructions}
-
-Files/folders referenced on this card (read them before starting \u2014 they are part of the task):
-${list}`;
+function authenticate(query) {
+  const projectId = typeof query.projectId === "string" ? query.projectId : null;
+  const ticket = typeof query.ticket === "string" ? query.ticket : null;
+  if (!projectId || !ticket) return null;
+  const entry = ticketsByProject.get(projectId);
+  if (!entry || entry.ticket !== ticket || entry.expiresAt < Date.now()) return null;
+  return entry;
 }
-
-// src/ptyRegistry.ts
-var MAX_BUFFERED_CHUNKS = 2e3;
-var registry = /* @__PURE__ */ new Map();
-function registerPtySession(sessionId, pty, ticket) {
-  const handle = { pty, ticket, outputBuffer: [], sockets: /* @__PURE__ */ new Set() };
-  pty.onData((data) => {
-    handle.outputBuffer.push(data);
-    if (handle.outputBuffer.length > MAX_BUFFERED_CHUNKS) handle.outputBuffer.shift();
-    for (const socket of handle.sockets) {
-      if (socket.readyState === socket.OPEN) socket.send(data);
-    }
-  });
-  registry.set(sessionId, handle);
+async function ensureSetupTicket(supabase, config) {
+  if (!config.allowedRootPath) return;
+  if (setupTicket && setupTicket.expiresAt - Date.now() > FILES_TICKET_REFRESH_MARGIN_MS) return;
+  const ticket = randomUUID5();
+  const expiresAtMs = Date.now() + FILES_TICKET_TTL_MS;
+  setupTicket = { ticket, expiresAt: expiresAtMs, rootPath: resolve2(config.allowedRootPath) };
+  try {
+    await updateRunnerSetupTicket(supabase, config.runnerId, ticket, new Date(expiresAtMs).toISOString(), config.allowedRootPath);
+  } catch (err) {
+    logger.runner.error("FILES", `Failed to publish setup ticket for runner ${config.runnerId}:`, err);
+  }
 }
-function getPtySession(sessionId) {
-  return registry.get(sessionId);
+function authenticateSetup(query) {
+  const ticket = typeof query.ticket === "string" ? query.ticket : null;
+  if (!ticket || !setupTicket) return null;
+  if (setupTicket.ticket !== ticket || setupTicket.expiresAt < Date.now()) return null;
+  return setupTicket;
 }
-function resizePtySession(sessionId, cols, rows) {
-  const handle = registry.get(sessionId);
-  if (!handle) return;
-  handle.pty.resize(cols, rows);
+async function ensureAgentTicket(supabase, config) {
+  if (agentTicket && agentTicket.expiresAt - Date.now() > FILES_TICKET_REFRESH_MARGIN_MS) return;
+  const ticket = randomUUID5();
+  const expiresAtMs = Date.now() + FILES_TICKET_TTL_MS;
+  agentTicket = { ticket, expiresAt: expiresAtMs, repoRoot: resolve2(homedir4(), ".claude") };
+  try {
+    await updateRunnerAgentTicket(supabase, config.runnerId, ticket, new Date(expiresAtMs).toISOString());
+  } catch (err) {
+    logger.runner.error("FILES", `Failed to publish agent ticket for runner ${config.runnerId}:`, err);
+  }
 }
-function stopPtySession(sessionId) {
-  const handle = registry.get(sessionId);
-  if (!handle) return;
-  for (const socket of handle.sockets) socket.close(4e3, "Session ended");
-  handle.pty.kill();
-  registry.delete(sessionId);
+function authenticateAgent(query) {
+  const ticket = typeof query.ticket === "string" ? query.ticket : null;
+  if (!ticket || !agentTicket) return null;
+  if (agentTicket.ticket !== ticket || agentTicket.expiresAt < Date.now()) return null;
+  return agentTicket;
 }
-
-// src/activityLog.ts
-async function logActivity(supabase, params) {
-  try {
-    const { error } = await supabase.from("activity_log").insert({
-      project_id: params.projectId,
-      card_id: params.cardId,
-      user_id: params.userId,
-      event_type: params.eventType,
-      payload: params.payload ?? {}
-    });
-    if (error) throw error;
-  } catch (err) {
-    logger.runner.error("ACTIVITY", `Failed to record activity log entry (${params.eventType}):`, err);
+function resolveWithinRepo(repoRoot, relPath) {
+  const normalizedRel = relPath.replace(/^[/\\]+/, "");
+  const resolved = resolve2(repoRoot, normalizedRel);
+  const rootWithSep = repoRoot.endsWith(sep) ? repoRoot : repoRoot + sep;
+  if (resolved !== repoRoot && !resolved.startsWith(rootWithSep)) {
+    throw new HttpError(403, "Caminho fora do reposit\xF3rio.");
   }
+  return resolved;
 }
-
-// src/sessions.ts
-async function countRunningSessions(supabase, projectId, ownerUserId) {
-  const { count, error } = await supabase.from("sessions").select("id, cards!inner(project_id, assigned_user_id)", { count: "exact", head: true }).eq("cards.project_id", projectId).eq("cards.assigned_user_id", ownerUserId).eq("status", "running");
-  if (error) throw error;
-  return count ?? 0;
-}
-async function listQueuedSessionsForRunner(supabase, ownerUserId) {
-  const { data, error } = await supabase.from("sessions").select(
-    "id, card_id, claude_session_id, created_at, cards!inner(project_id, assigned_user_id, title, instructions, file_references, plan_first)"
-  ).eq("cards.assigned_user_id", ownerUserId).eq("status", "queued").order("created_at", { ascending: true });
-  if (error) throw error;
-  return data;
+function listDirectory(repoRoot, relPath, options) {
+  const target = resolveWithinRepo(repoRoot, relPath);
+  let stat;
+  try {
+    stat = lstatSync(target);
+  } catch {
+    throw new HttpError(404, "Diret\xF3rio n\xE3o encontrado.");
+  }
+  if (stat.isSymbolicLink()) throw new HttpError(403, "Links simb\xF3licos n\xE3o s\xE3o suportados.");
+  if (!stat.isDirectory()) throw new HttpError(400, "O caminho informado n\xE3o \xE9 um diret\xF3rio.");
+  const prefix = relPath.replace(/\/+$/, "");
+  return readdirSync(target, { withFileTypes: true }).filter(
+    (dirent) => !dirent.isSymbolicLink() && (!IGNORED_ENTRY_NAMES.has(dirent.name) || options?.includeDotClaude && dirent.name === ".claude")
+  ).map((dirent) => ({
+    name: dirent.name,
+    path: prefix ? `${prefix}/${dirent.name}` : dirent.name,
+    type: dirent.isDirectory() ? "dir" : "file"
+  })).sort((a, b) => a.type !== b.type ? a.type === "dir" ? -1 : 1 : a.name.localeCompare(b.name));
 }
-async function createSession(supabase, userId, cardId) {
-  const { data, error } = await supabase.from("sessions").insert({ card_id: cardId, user_id: userId, status: "queued" }).select("id").single();
-  if (error) throw error;
-  return data.id;
+function listSafeAgentDirectory(baseDir, relPath, atClaudeRoot) {
+  const segments = relPath === "" ? [] : relPath.split("/");
+  if (atClaudeRoot) {
+    if (segments.length === 0) {
+      ensureSkillsDirExists(baseDir);
+      const entries2 = listDirectory(baseDir, relPath, { includeDotClaude: true });
+      return entries2.filter(
+        (entry) => entry.type === "file" && entry.name === "CLAUDE.md" || entry.type === "dir" && AGENT_SAFE_SUBDIR_NAMES.has(entry.name)
+      );
+    }
+    return listDirectory(baseDir, relPath, { includeDotClaude: true });
+  }
+  const isRepoRootLevel = segments.length === 0 || segments.length === 1 && segments[0] !== ".claude";
+  if (isRepoRootLevel) {
+    ensureSkillsDirExists(join8(baseDir, relPath, ".claude"));
+    const entries2 = listDirectory(baseDir, relPath, { includeDotClaude: true });
+    return entries2.filter((entry) => entry.type === "file" && entry.name === "CLAUDE.md" || entry.type === "dir" && entry.name === ".claude");
+  }
+  const entries = listDirectory(baseDir, relPath, { includeDotClaude: true });
+  if (segments[segments.length - 1] === ".claude") {
+    return entries.filter((entry) => entry.type === "dir" && AGENT_SAFE_SUBDIR_NAMES.has(entry.name));
+  }
+  return entries;
 }
-async function updateSession(supabase, sessionId, changes, activityContext) {
-  const { error } = await supabase.from("sessions").update({
-    ...changes.status !== void 0 ? { status: changes.status } : {},
-    ...changes.agentState !== void 0 ? { agent_state: changes.agentState } : {},
-    ...changes.startedAt !== void 0 ? { started_at: changes.startedAt } : {},
-    ...changes.endedAt !== void 0 ? { ended_at: changes.endedAt } : {},
-    ...changes.terminalTicket !== void 0 ? { terminal_ticket: changes.terminalTicket } : {},
-    ...changes.terminalTicketExpiresAt !== void 0 ? { terminal_ticket_expires_at: changes.terminalTicketExpiresAt } : {},
-    ...changes.claudeSessionId !== void 0 ? { claude_session_id: changes.claudeSessionId } : {}
-  }).eq("id", sessionId);
-  if (error) throw error;
-  if (changes.status !== void 0 && activityContext) {
-    await logActivity(supabase, {
-      projectId: activityContext.projectId,
-      cardId: activityContext.cardId,
-      userId: activityContext.userId,
-      eventType: "session_status_changed",
-      payload: { status: changes.status }
-    });
+function assertSafeAgentPath(relPath, atClaudeRoot) {
+  const segments = relPath.split("/");
+  function matches(rest2) {
+    if (rest2.length === 1 && rest2[0] === "CLAUDE.md") return true;
+    if (atClaudeRoot) return rest2.length >= 2 && AGENT_SAFE_SUBDIR_NAMES.has(rest2[0]);
+    return rest2.length >= 3 && rest2[0] === ".claude" && AGENT_SAFE_SUBDIR_NAMES.has(rest2[1]);
   }
+  if (matches(segments)) return;
+  if (!atClaudeRoot && segments.length > 1 && matches(segments.slice(1))) return;
+  throw new HttpError(403, "Caminho fora da \xE1rea permitida para o Agente.");
 }
-async function getActiveSessionForCard(supabase, cardId) {
-  const { data, error } = await supabase.from("sessions").select("id").eq("card_id", cardId).in("status", ["queued", "running", "waiting_input"]).order("created_at", { ascending: false }).limit(1).maybeSingle();
-  if (error) throw error;
-  return data;
+function assertWritableAgentPath(relPath, atClaudeRoot) {
+  assertSafeAgentPath(relPath, atClaudeRoot);
+  const segments = relPath.split("/");
+  if (segments[segments.length - 1] !== "CLAUDE.md") {
+    throw new HttpError(403, "Apenas CLAUDE.md pode ser criado ou editado por aqui.");
+  }
 }
-async function updateCard(supabase, cardId, changes) {
-  const { error } = await supabase.from("cards").update({
-    ...changes.column !== void 0 ? { column_name: changes.column } : {},
-    ...changes.previewUrls !== void 0 ? { preview_urls: changes.previewUrls } : {},
-    ...changes.deployError !== void 0 ? { deploy_error: changes.deployError } : {}
-  }).eq("id", cardId);
-  if (error) throw error;
+function listDirectoryForBrowse(rootPath, relPath) {
+  return listDirectory(rootPath, relPath).map((entry) => ({
+    ...entry,
+    hasGit: entry.type === "dir" && existsSync4(join8(rootPath, entry.path, ".git"))
+  }));
 }
-async function getProject(supabase, projectId) {
-  const { data, error } = await supabase.from("projects").select("*").eq("id", projectId).single();
-  if (error) throw error;
-  return data;
+var SAFE_CLONE_URL_PATTERN = /^(https?:\/\/|git:\/\/|ssh:\/\/|git@[\w.-]+:)\S+$/i;
+function isSafeGitUrl(url) {
+  return url.length > 0 && !/\s/.test(url) && SAFE_CLONE_URL_PATTERN.test(url);
 }
-async function getProjectRepos(supabase, projectId) {
-  const { data, error } = await supabase.from("project_repos").select("subpath, dev_command").eq("project_id", projectId);
-  if (error) throw error;
-  return data;
+function deriveRepoFolderName(url) {
+  const lastSegment = url.replace(/\/+$/, "").split(/[/:]/).pop() ?? "";
+  const name = lastSegment.replace(/\.git$/i, "");
+  if (!/^[\w.-]+$/.test(name) || name === "." || name === "..") return null;
+  return name;
 }
-async function listCardsInColumn(supabase, projectId, column) {
-  const { data, error } = await supabase.from("cards").select("id, project_id, title, instructions, column_name, assigned_user_id, deploy_error, file_references, preview_urls").eq("project_id", projectId).eq("column_name", column);
-  if (error) throw error;
-  return data;
+async function handleCloneRequest(req, res, query) {
+  const setupEntry = authenticateSetup(query);
+  if (!setupEntry) {
+    sendJson(res, 401, { error: "Ticket inv\xE1lido, expirado, ou navega\xE7\xE3o de pastas desativada." });
+    return;
+  }
+  let body;
+  try {
+    const raw = await readRequestBody(req, 2e3);
+    body = JSON.parse(raw);
+  } catch (err) {
+    const status = err instanceof HttpError ? err.status : 400;
+    sendJson(res, status, { error: "Corpo inv\xE1lido." });
+    return;
+  }
+  const url = typeof body.url === "string" ? body.url.trim() : "";
+  if (!isSafeGitUrl(url)) {
+    sendJson(res, 400, { error: "URL de git inv\xE1lida. Use https://, ssh:// ou o formato git@host:caminho." });
+    return;
+  }
+  const folderName = deriveRepoFolderName(url);
+  if (!folderName) {
+    sendJson(res, 400, { error: "N\xE3o foi poss\xEDvel determinar o nome da pasta a partir da URL." });
+    return;
+  }
+  const destPath = join8(setupEntry.rootPath, folderName);
+  if (existsSync4(destPath)) {
+    sendJson(res, 409, { error: `J\xE1 existe uma pasta "${folderName}" na raiz permitida.` });
+    return;
+  }
+  try {
+    await execFileAsync2("git", ["clone", "--", url, destPath], { timeout: 9e4 });
+    sendJson(res, 200, { name: folderName, path: folderName, type: "dir", hasGit: true });
+  } catch (err) {
+    try {
+      rmSync2(destPath, { recursive: true, force: true });
+    } catch {
+    }
+    logger.runner.error("FILES", `git clone failed for ${url}:`, err);
+    const stderr = err && typeof err === "object" && "stderr" in err ? String(err.stderr ?? "").trim() : "";
+    const timedOut = err && typeof err === "object" && "killed" in err && err.killed;
+    sendJson(res, 502, {
+      error: timedOut ? "O clone excedeu o tempo limite do t\xFAnel (reposit\xF3rio muito grande?)." : stderr || "Falha ao clonar o reposit\xF3rio."
+    });
+  }
 }
-async function clearProjectDeployRequest(supabase, projectId) {
-  const { error } = await supabase.from("projects").update({ deploy_requested_at: null }).eq("id", projectId);
-  if (error) throw error;
+function looksBinary(buffer) {
+  const sample = buffer.subarray(0, Math.min(buffer.length, 8e3));
+  return sample.includes(0);
 }
-async function clearDevServerRestartRequest(supabase, projectId) {
-  const { error } = await supabase.from("projects").update({ dev_server_restart_requested_at: null }).eq("id", projectId);
-  if (error) throw error;
+function readTextFile(repoRoot, relPath) {
+  const target = resolveWithinRepo(repoRoot, relPath);
+  let stat;
+  try {
+    stat = lstatSync(target);
+  } catch {
+    throw new HttpError(404, "Arquivo n\xE3o encontrado.");
+  }
+  if (stat.isSymbolicLink()) throw new HttpError(403, "Links simb\xF3licos n\xE3o s\xE3o suportados.");
+  if (!stat.isFile()) throw new HttpError(400, "O caminho informado n\xE3o \xE9 um arquivo.");
+  if (stat.size > MAX_FILE_SIZE_BYTES) {
+    throw new HttpError(413, `Arquivo maior que o limite de ${MAX_FILE_SIZE_BYTES / 1e6}MB para visualiza\xE7\xE3o.`);
+  }
+  const buffer = readFileSync4(target);
+  if (looksBinary(buffer)) throw new HttpError(415, "Arquivo bin\xE1rio n\xE3o pode ser exibido.");
+  return { content: buffer.toString("utf8"), size: stat.size };
 }
-async function updateProjectFilesTicket(supabase, projectId, ticket, expiresAt) {
-  const { error } = await supabase.from("projects").update({ files_ticket: ticket, files_ticket_expires_at: expiresAt }).eq("id", projectId);
-  if (error) throw error;
+function writeTextFile(repoRoot, relPath, content) {
+  if (Buffer.byteLength(content, "utf8") > MAX_FILE_SIZE_BYTES) {
+    throw new HttpError(413, `Conte\xFAdo maior que o limite de ${MAX_FILE_SIZE_BYTES / 1e6}MB.`);
+  }
+  const target = resolveWithinRepo(repoRoot, relPath);
+  writeFileSync7(target, content, "utf8");
 }
-async function updateRunnerSetupTicket(supabase, runnerId, ticket, expiresAt, allowedRootPath) {
-  const { error } = await supabase.from("runners").update({ setup_ticket: ticket, setup_ticket_expires_at: expiresAt, allowed_root_path: allowedRootPath }).eq("id", runnerId);
-  if (error) throw error;
+function findBrandIconPath(repoRoot) {
+  const patterns = BRAND_ICON_BASE_NAMES.map((baseName) => ({
+    baseName,
+    pattern: new RegExp(`^${baseName}\\.[a-z0-9]+$`, "i")
+  }));
+  const candidatesByBaseName = new Map(
+    BRAND_ICON_BASE_NAMES.map((baseName) => [baseName, []])
+  );
+  function walk(dir, relDir, depth) {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.isSymbolicLink() || IGNORED_ENTRY_NAMES.has(entry.name)) continue;
+      const relPath = relDir ? `${relDir}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        walk(join8(dir, entry.name), relPath, depth + 1);
+      } else if (entry.isFile()) {
+        const match = patterns.find(({ pattern }) => pattern.test(entry.name));
+        if (match) candidatesByBaseName.get(match.baseName).push({ relPath, depth });
+      }
+    }
+  }
+  walk(repoRoot, "", 0);
+  for (const baseName of BRAND_ICON_BASE_NAMES) {
+    const candidates = candidatesByBaseName.get(baseName);
+    if (candidates.length === 0) continue;
+    candidates.sort((a, b) => a.depth - b.depth || a.relPath.localeCompare(b.relPath));
+    return candidates[0].relPath;
+  }
+  return null;
 }
-async function updateRunnerAgentTicket(supabase, runnerId, ticket, expiresAt) {
-  const { error } = await supabase.from("runners").update({ agent_ticket: ticket, agent_ticket_expires_at: expiresAt }).eq("id", runnerId);
-  if (error) throw error;
+function readImageFile(repoRoot, relPath) {
+  const target = resolveWithinRepo(repoRoot, relPath);
+  let stat;
+  try {
+    stat = lstatSync(target);
+  } catch {
+    throw new HttpError(404, "Arquivo de logo n\xE3o encontrado.");
+  }
+  if (stat.isSymbolicLink()) throw new HttpError(403, "Links simb\xF3licos n\xE3o s\xE3o suportados.");
+  if (!stat.isFile()) throw new HttpError(400, "O caminho configurado n\xE3o \xE9 um arquivo.");
+  if (stat.size > MAX_LOGO_SIZE_BYTES) {
+    throw new HttpError(413, `Arquivo maior que o limite de ${MAX_LOGO_SIZE_BYTES / 1e6}MB.`);
+  }
+  const ext = relPath.split(".").pop()?.toLowerCase() ?? "";
+  return { buffer: readFileSync4(target), contentType: MIME_TYPES_BY_EXT[ext] ?? "application/octet-stream" };
 }
-async function listMyProjects(supabase) {
-  const { data, error } = await supabase.from("projects").select("id, runner_id, repo_path, logo_path");
-  if (error) throw error;
-  return data;
+function sendJson(res, status, body) {
+  const payload = JSON.stringify(body);
+  res.writeHead(status, {
+    "Content-Type": "application/json; charset=utf-8",
+    // This runner is a trusted process on the user's own machine and the web app is served
+    // from a different origin (e.g. Vercel) — the ticket is the actual security boundary,
+    // so CORS is left wide open rather than trying to keep an allowlist of web origins.
+    "Access-Control-Allow-Origin": "*"
+  });
+  res.end(payload);
 }
-async function listProjectRunnerIds(supabase, runnerId) {
-  const { data, error } = await supabase.from("project_runners").select("project_id").eq("runner_id", runnerId);
-  if (error) throw error;
-  return new Set(data.map((row) => row.project_id));
-}
-async function addProjectRunner(supabase, projectId, runnerId) {
-  const { error } = await supabase.from("project_runners").insert({ project_id: projectId, runner_id: runnerId });
-  if (error) throw error;
-}
-async function getRunnerMaxConcurrentProjects(supabase, runnerId) {
-  const { data, error } = await supabase.from("runners").select("max_concurrent_projects").eq("id", runnerId).single();
-  if (error) throw error;
-  return data.max_concurrent_projects;
-}
-async function updateProjectLogoPath(supabase, projectId, logoPath) {
-  const { error } = await supabase.from("projects").update({ logo_path: logoPath }).eq("id", projectId);
-  if (error) throw error;
-}
-async function getClaudeUsage(supabase, userId) {
-  const { data, error } = await supabase.from("claude_usage").select("session_resets_at, week_resets_at").eq("user_id", userId).maybeSingle();
-  if (error) throw error;
-  if (!data) return null;
-  return { sessionResetsAt: data.session_resets_at, weekResetsAt: data.week_resets_at };
-}
-async function upsertClaudeUsage(supabase, userId, changes) {
-  const { error } = await supabase.from("claude_usage").upsert({
-    user_id: userId,
-    ...changes.sessionPercent !== void 0 ? { session_pct: changes.sessionPercent } : {},
-    ...changes.sessionResetsAt !== void 0 ? { session_resets_at: changes.sessionResetsAt } : {},
-    ...changes.weekPercent !== void 0 ? { week_pct: changes.weekPercent } : {},
-    ...changes.weekResetsAt !== void 0 ? { week_resets_at: changes.weekResetsAt } : {},
-    updated_at: (/* @__PURE__ */ new Date()).toISOString()
-  });
-  if (error) throw error;
-}
-
-// src/usageResume.ts
-var RESET_BUFFER_MS = 3e4;
-var UNKNOWN_RESET_RETRY_MS = 5 * 6e4;
-var pending = /* @__PURE__ */ new Map();
-function scheduleUsageResume(supabase, config, cardId, sessionId, pty) {
-  if (pending.has(sessionId)) return;
-  void (async () => {
-    const usage = await getClaudeUsage(supabase, config.ownerUserId).catch((err) => {
-      logger.card.error(cardId, "Failed to read claude_usage for usage-limit resume:", err);
-      return null;
+function readRequestBody(req, maxBytes) {
+  return new Promise((resolve5, reject) => {
+    let received = 0;
+    const chunks = [];
+    req.on("data", (chunk) => {
+      received += chunk.length;
+      if (received > maxBytes) {
+        req.destroy();
+        reject(new HttpError(413, "Corpo da requisi\xE7\xE3o excede o limite."));
+        return;
+      }
+      chunks.push(chunk);
     });
-    const now = Date.now();
-    const candidates = [usage?.sessionResetsAt, usage?.weekResetsAt].map((iso) => iso ? new Date(iso).getTime() : null).filter((ms) => ms !== null && ms > now);
-    const resetAt = candidates.length > 0 ? Math.min(...candidates) : null;
-    const delay = resetAt !== null ? resetAt - now + RESET_BUFFER_MS : UNKNOWN_RESET_RETRY_MS;
-    logger.card.info(
-      cardId,
-      resetAt !== null ? `Usage limit hit \u2014 will send "continue" automatically at ${new Date(resetAt).toISOString()}.` : `Usage limit hit but no reset time known yet \u2014 will retry in ${Math.round(delay / 6e4)}min.`
-    );
-    const timer = setTimeout(() => {
-      pending.delete(sessionId);
-      sendContinue(pty, cardId);
-    }, delay);
-    timer.unref();
-    pending.set(sessionId, timer);
-  })();
-}
-function cancelUsageResume(sessionId) {
-  const timer = pending.get(sessionId);
-  if (!timer) return;
-  clearTimeout(timer);
-  pending.delete(sessionId);
+    req.on("end", () => resolve5(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
 }
-
-// src/orchestrator.ts
-var TERMINAL_TICKET_TTL_MS = 60 * 60 * 1e3;
-var inFlightCardIds = /* @__PURE__ */ new Set();
-var activeSessionByCard = /* @__PURE__ */ new Map();
-var dispatchingRunner = false;
-async function scanForWork(supabase, config) {
-  for (const project of config.registeredProjects) {
-    await reconcileStaleSessions(supabase, config, project.id);
-    const { data: cards, error } = await supabase.from("cards").select("*").eq("project_id", project.id).eq("column_name", "desenvolvimento").eq("assigned_user_id", config.ownerUserId);
-    if (error) {
-      logger.runner.error("ORCHESTRATOR", `Failed to scan cards for project ${project.id}:`, error.message);
-      continue;
-    }
-    for (const card of cards ?? []) {
-      void enqueueCard(supabase, config, card);
-    }
+async function handleStatuslineReport(req, res, supabase, config) {
+  let body;
+  try {
+    const raw = await readRequestBody(req, MAX_STATUSLINE_BODY_BYTES);
+    body = JSON.parse(raw);
+  } catch (err) {
+    const status = err instanceof HttpError ? err.status : 400;
+    sendJson(res, status, { error: "Corpo inv\xE1lido." });
+    return;
   }
-  void dispatchRunnerQueue(supabase, config);
-}
-async function enqueueCard(supabase, config, card) {
-  if (inFlightCardIds.has(card.id)) return;
-  const registered = config.registeredProjects.find((project) => project.id === card.project_id);
-  if (!registered) {
-    logger.card.warn(card.id, `Ignoring card: project ${card.project_id} is not registered on this runner.`);
+  if (!body.sessionId || !body.ticket) {
+    sendJson(res, 400, { error: "sessionId e ticket s\xE3o obrigat\xF3rios." });
+    return;
+  }
+  const isMonitor = body.sessionId === usageMonitorSessionId();
+  const ticketValid = isMonitor ? body.ticket === usageMonitorTicket() : getPtySession(body.sessionId)?.ticket === body.ticket;
+  if (!ticketValid) {
+    sendJson(res, 403, { error: "Ticket inv\xE1lido para esta sess\xE3o." });
     return;
   }
-  if (card.assigned_user_id !== config.ownerUserId) return;
-  inFlightCardIds.add(card.id);
   try {
-    const active = await getActiveSessionForCard(supabase, card.id);
-    if (active) return;
-    await createQueuedSession(supabase, config, card);
-  } finally {
-    inFlightCardIds.delete(card.id);
+    await upsertClaudeUsage(supabase, config.ownerUserId, {
+      ...typeof body.fiveHour?.used_percentage === "number" ? { sessionPercent: body.fiveHour.used_percentage } : {},
+      ...typeof body.fiveHour?.resets_at === "number" ? { sessionResetsAt: new Date(body.fiveHour.resets_at * 1e3).toISOString() } : {},
+      ...typeof body.sevenDay?.used_percentage === "number" ? { weekPercent: body.sevenDay.used_percentage } : {},
+      ...typeof body.sevenDay?.resets_at === "number" ? { weekResetsAt: new Date(body.sevenDay.resets_at * 1e3).toISOString() } : {}
+    });
+    res.writeHead(204, { "Access-Control-Allow-Origin": "*" });
+    res.end();
+  } catch (err) {
+    logger.runner.error("STATUSLINE", `Failed to persist Claude usage from session ${body.sessionId}:`, err);
+    sendJson(res, 500, { error: "Erro interno do runner." });
   }
-  await dispatchRunnerQueue(supabase, config);
-}
-async function createQueuedSession(supabase, config, card) {
-  const sessionId = await createSession(supabase, config.ownerUserId, card.id);
-  logger.card.info(card.id, `"${card.title}" queued (session ${sessionId}).`);
 }
-async function reconcileStaleSessions(supabase, config, projectId) {
-  const { data, error } = await supabase.from("sessions").select("id, card_id, cards!inner(project_id, column_name, assigned_user_id)").eq("cards.project_id", projectId).eq("cards.assigned_user_id", config.ownerUserId).in("status", ["queued", "running", "waiting_input"]).neq("cards.column_name", "desenvolvimento");
-  if (error) {
-    logger.runner.error("ORCHESTRATOR", `Failed to scan stale sessions for project ${projectId}:`, error.message);
+async function handleAgentHookReport(req, res) {
+  let body;
+  try {
+    const raw = await readRequestBody(req, MAX_STATUSLINE_BODY_BYTES);
+    body = JSON.parse(raw);
+  } catch (err) {
+    const status = err instanceof HttpError ? err.status : 400;
+    sendJson(res, status, { error: "Corpo inv\xE1lido." });
     return;
   }
-  const stale = data ?? [];
-  if (stale.length === 0) return;
-  for (const { id: sessionId, card_id: cardId } of stale) {
-    stopPtySession(sessionId);
-    cancelUsageResume(sessionId);
-    activeSessionByCard.delete(cardId);
-    await updateSession(
-      supabase,
-      sessionId,
-      { status: "done", endedAt: (/* @__PURE__ */ new Date()).toISOString() },
-      { projectId, cardId, userId: config.ownerUserId }
-    );
-    logger.card.info(cardId, `Ended stale session ${sessionId} (its card left "desenvolvimento" while this runner missed the event).`);
+  if (!body.sessionId || !body.ticket || !body.moment) {
+    sendJson(res, 400, { error: "sessionId, ticket e moment s\xE3o obrigat\xF3rios." });
+    return;
   }
-  await dispatchRunnerQueue(supabase, config);
+  if (getPtySession(body.sessionId)?.ticket !== body.ticket) {
+    sendJson(res, 403, { error: "Ticket inv\xE1lido para esta sess\xE3o." });
+    return;
+  }
+  handleAgentHookEvent(body.sessionId, body.moment);
+  res.writeHead(204, { "Access-Control-Allow-Origin": "*" });
+  res.end();
 }
-async function dispatchRunnerQueue(supabase, config) {
-  if (dispatchingRunner) return;
-  dispatchingRunner = true;
+async function handleBranchRequest(entry, res, relPath) {
+  let cwd;
   try {
-    const queued = await listQueuedSessionsForRunner(supabase, config.ownerUserId);
-    if (queued.length === 0) return;
-    const maxConcurrentProjects = await getRunnerMaxConcurrentProjects(supabase, config.runnerId);
-    const runningProjectIds = /* @__PURE__ */ new Set();
-    for (const project of config.registeredProjects) {
-      const runningCount = await countRunningSessions(supabase, project.id, config.ownerUserId);
-      if (runningCount > 0) runningProjectIds.add(project.id);
-    }
-    let freeProjectSlots = maxConcurrentProjects - runningProjectIds.size;
-    if (freeProjectSlots <= 0) return;
-    const promotedThisPass = /* @__PURE__ */ new Set();
-    for (const entry of queued) {
-      const projectId = entry.cards.project_id;
-      if (runningProjectIds.has(projectId) || promotedThisPass.has(projectId)) continue;
-      if (freeProjectSlots <= 0) break;
-      try {
-        await promoteQueuedSession(supabase, config, entry);
-        promotedThisPass.add(projectId);
-        freeProjectSlots -= 1;
-      } catch (err) {
-        logger.card.error(entry.card_id, `Failed to promote queued session ${entry.id}:`, err);
-      }
+    cwd = relPath ? resolveWithinRepo(entry.repoRoot, relPath) : entry.repoRoot;
+  } catch (err) {
+    if (err instanceof HttpError) {
+      sendJson(res, err.status, { error: err.message });
+      return;
     }
-  } finally {
-    dispatchingRunner = false;
+    throw err;
+  }
+  try {
+    const { stdout } = await execFileAsync2("git", ["branch", "--show-current"], { cwd });
+    sendJson(res, 200, { branch: stdout.trim() });
+  } catch (err) {
+    logger.runner.error("FILES", "Unexpected error handling a branch request:", err);
+    sendJson(res, 500, { error: "Erro interno do runner." });
   }
 }
-async function promoteQueuedSession(supabase, config, entry) {
-  const spawned = await spawnSessionPty(supabase, config, entry);
-  if (spawned) logger.card.info(entry.card_id, "Promoted from queue.");
+var DIFF_EXEC_OPTIONS = { maxBuffer: 10 * 1024 * 1024 };
+function parseGitStatusPorcelain(output) {
+  return output.split("\n").filter((line) => line.length > 0).map((line) => {
+    const status = line.slice(0, 2).trim();
+    const rest2 = line.slice(3);
+    const arrowIndex = rest2.indexOf(" -> ");
+    const path = arrowIndex >= 0 ? rest2.slice(arrowIndex + 4) : rest2;
+    return { path, status };
+  });
 }
-async function spawnSessionPty(supabase, config, entry) {
-  const { id: sessionId, card_id: cardId, cards: card, claude_session_id: claudeSessionId } = entry;
-  const registered = config.registeredProjects.find((project) => project.id === card.project_id);
-  if (!registered) {
-    logger.card.error(cardId, `Session ${sessionId}: project ${card.project_id} is not registered \u2014 skipping.`);
-    await updateSession(
-      supabase,
-      sessionId,
-      { status: "failed", endedAt: (/* @__PURE__ */ new Date()).toISOString() },
-      { projectId: card.project_id, cardId, userId: config.ownerUserId }
-    );
-    return false;
+async function getRepoDiffForTarget(label, cwd) {
+  let files;
+  try {
+    const { stdout } = await execFileAsync2("git", ["status", "--porcelain=v1"], { cwd });
+    files = parseGitStatusPorcelain(stdout);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { label, files: [], diff: "", error: message };
   }
-  const ticket = randomUUID3();
-  let pty;
-  let newClaudeSessionId = null;
+  if (files.length === 0) return { label, files, diff: "" };
   try {
-    if (claudeSessionId) {
-      pty = resumeAgentPty(registered.repoPath, claudeSessionId, sessionId, ticket);
-    } else {
-      const imagePaths = await downloadCardImages(supabase, cardId);
-      const instructions = buildInstructionsWithFileReferences(
-        buildInstructionsWithImages(card.instructions, imagePaths),
-        card.file_references
-      );
-      const spawned = spawnAgentPty(registered.repoPath, cardId, card.title, instructions, sessionId, ticket, card.plan_first);
-      pty = spawned.pty;
-      newClaudeSessionId = spawned.claudeSessionId;
-    }
+    const { stdout } = await execFileAsync2("git", ["diff", "HEAD"], { ...DIFF_EXEC_OPTIONS, cwd });
+    return { label, files, diff: stdout };
+  } catch {
+    return { label, files, diff: "" };
+  }
+}
+async function handleDiffRequest(entry, res, projectId) {
+  try {
+    const children = statuslineSupabase && projectId ? await getProjectRepos(statuslineSupabase, projectId) : [];
+    const targets = children.length > 0 ? children.map((child2) => ({ label: child2.subpath, cwd: join8(entry.repoRoot, child2.subpath) })) : [{ label: null, cwd: entry.repoRoot }];
+    const repos = await Promise.all(targets.map((target) => getRepoDiffForTarget(target.label, target.cwd)));
+    sendJson(res, 200, { repos });
   } catch (err) {
-    logger.card.error(cardId, `Failed to spawn pty for session ${sessionId}:`, err);
-    await updateSession(
-      supabase,
-      sessionId,
-      { status: "failed", endedAt: (/* @__PURE__ */ new Date()).toISOString() },
-      { projectId: card.project_id, cardId, userId: config.ownerUserId }
-    );
-    return false;
+    logger.runner.error("FILES", "Unexpected error handling a diff request:", err);
+    sendJson(res, 500, { error: "Erro interno do runner." });
   }
-  registerPtySession(sessionId, pty, ticket);
-  activeSessionByCard.set(cardId, sessionId);
-  const activityWatcher = watchAgentActivity(supabase, config, cardId, sessionId, pty);
-  await updateSession(
-    supabase,
-    sessionId,
-    {
-      status: "running",
-      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      terminalTicket: ticket,
-      terminalTicketExpiresAt: new Date(Date.now() + TERMINAL_TICKET_TTL_MS).toISOString(),
-      // Only stamp a fresh spawn as "implementing" — a resumed session (claudeSessionId was
-      // already set) keeps whatever agent_state it had before the restart (e.g.
-      // "usage_limited"), so reconcileUsageLimitedSessions can find it afterwards. The
-      // freshly (re)constructed AgentActivityWatcher below will correct it the moment real
-      // output gives it something conclusive to classify.
-      ...newClaudeSessionId ? { agentState: "implementing", claudeSessionId: newClaudeSessionId } : {}
-    },
-    { projectId: card.project_id, cardId, userId: config.ownerUserId }
-  );
-  pty.onExit(({ exitCode }) => {
-    logger.card.warn(cardId, `Session exited (code ${exitCode}) \u2014 this only happens if the process crashed or was killed, the card doesn't auto-advance.`);
-    activityWatcher.stop();
-    cancelUsageResume(sessionId);
-    activeSessionByCard.delete(cardId);
+}
+async function handleAgentFileWrite(req, res, atClaudeRoot, query) {
+  const entry = atClaudeRoot ? authenticateAgent(query) : authenticate(query);
+  if (!entry) {
+    sendJson(res, 401, { error: "Ticket inv\xE1lido ou expirado." });
+    return;
+  }
+  let body;
+  try {
+    const raw = await readRequestBody(req, MAX_FILE_SIZE_BYTES + 1e3);
+    body = JSON.parse(raw);
+  } catch (err) {
+    const status = err instanceof HttpError ? err.status : 400;
+    sendJson(res, status, { error: "Corpo inv\xE1lido." });
+    return;
+  }
+  if (typeof body.content !== "string") {
+    sendJson(res, 400, { error: "Campo content \xE9 obrigat\xF3rio." });
+    return;
+  }
+  const relPath = typeof query.path === "string" ? query.path : "";
+  try {
+    assertWritableAgentPath(relPath, atClaudeRoot);
+    writeTextFile(entry.repoRoot, relPath, body.content);
+    sendJson(res, 200, { ok: true });
+  } catch (err) {
+    if (err instanceof HttpError) {
+      sendJson(res, err.status, { error: err.message });
+      return;
+    }
+    logger.runner.error("FILES", "Unexpected error handling an agent file write:", err);
+    sendJson(res, 500, { error: "Erro interno do runner." });
+  }
+}
+function handleRequest(req, res) {
+  if (req.method === "OPTIONS") {
+    res.writeHead(204, {
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+      // Needed since the new write routes below send a JSON body (Content-Type:
+      // application/json), which makes the browser preflight the request — unlike every
+      // other route here, which is a plain GET the browser never preflights.
+      "Access-Control-Allow-Headers": "Content-Type"
+    });
+    res.end();
+    return;
+  }
+  const { pathname, query } = parse(req.url ?? "", true);
+  if (pathname === "/agent-skills-list" || pathname === "/global-agent-skills-list") {
+    if (req.method !== "GET") {
+      sendJson(res, 405, { error: "M\xE9todo n\xE3o suportado." });
+      return;
+    }
+    void handleSkillsList(res, query, pathname === "/global-agent-skills-list");
+    return;
+  }
+  if (pathname === "/agent-skills-find" || pathname === "/global-agent-skills-find") {
+    if (req.method !== "GET") {
+      sendJson(res, 405, { error: "M\xE9todo n\xE3o suportado." });
+      return;
+    }
+    void handleSkillsFind(res, query, pathname === "/global-agent-skills-find");
+    return;
+  }
+  if (pathname === "/agent-skills-popular" || pathname === "/global-agent-skills-popular") {
+    if (req.method !== "GET") {
+      sendJson(res, 405, { error: "M\xE9todo n\xE3o suportado." });
+      return;
+    }
+    void handleSkillsPopular(res, query, pathname === "/global-agent-skills-popular");
+    return;
+  }
+  if (pathname === "/agent-skills-install" || pathname === "/global-agent-skills-install") {
+    if (req.method !== "POST") {
+      sendJson(res, 405, { error: "M\xE9todo n\xE3o suportado." });
+      return;
+    }
+    void handleSkillsInstall(req, res, query, pathname === "/global-agent-skills-install");
+    return;
+  }
+  if (pathname === "/agent-skills-remove" || pathname === "/global-agent-skills-remove") {
+    if (req.method !== "POST") {
+      sendJson(res, 405, { error: "M\xE9todo n\xE3o suportado." });
+      return;
+    }
+    void handleSkillsRemove(req, res, query, pathname === "/global-agent-skills-remove");
+    return;
+  }
+  if (pathname === "/agent-skills-update" || pathname === "/global-agent-skills-update") {
+    if (req.method !== "POST") {
+      sendJson(res, 405, { error: "M\xE9todo n\xE3o suportado." });
+      return;
+    }
+    void handleSkillsUpdate(req, res, query, pathname === "/global-agent-skills-update");
+    return;
+  }
+  if (req.method === "POST" && pathname === "/statusline") {
+    if (!statuslineSupabase || !statuslineConfig) {
+      sendJson(res, 500, { error: "Runner ainda n\xE3o inicializado." });
+      return;
+    }
+    void handleStatuslineReport(req, res, statuslineSupabase, statuslineConfig);
+    return;
+  }
+  if (req.method === "POST" && pathname === "/agent-hook") {
+    void handleAgentHookReport(req, res);
+    return;
+  }
+  if (req.method === "POST" && (pathname === "/agent-file" || pathname === "/global-agent-file")) {
+    void handleAgentFileWrite(req, res, pathname === "/global-agent-file", query);
+    return;
+  }
+  if (req.method === "POST" && pathname === "/clone") {
+    void handleCloneRequest(req, res, query);
+    return;
+  }
+  if (req.method !== "GET") {
+    sendJson(res, 405, { error: "M\xE9todo n\xE3o suportado." });
+    return;
+  }
+  const relPath = typeof query.path === "string" ? query.path : "";
+  if (pathname === "/browse") {
+    const setupEntry = authenticateSetup(query);
+    if (!setupEntry) {
+      sendJson(res, 401, { error: "Ticket inv\xE1lido, expirado, ou navega\xE7\xE3o de pastas desativada." });
+      return;
+    }
+    try {
+      sendJson(res, 200, { entries: listDirectoryForBrowse(setupEntry.rootPath, relPath) });
+    } catch (err) {
+      if (err instanceof HttpError) {
+        sendJson(res, err.status, { error: err.message });
+        return;
+      }
+      logger.runner.error("FILES", "Unexpected error handling a browse request:", err);
+      sendJson(res, 500, { error: "Erro interno do runner." });
+    }
+    return;
+  }
+  if (pathname === "/global-agent-tree" || pathname === "/global-agent-file") {
+    const agentEntry = authenticateAgent(query);
+    if (!agentEntry) {
+      sendJson(res, 401, { error: "Ticket inv\xE1lido ou expirado." });
+      return;
+    }
+    try {
+      if (pathname === "/global-agent-tree") {
+        sendJson(res, 200, { entries: listSafeAgentDirectory(agentEntry.repoRoot, relPath, true) });
+      } else {
+        assertSafeAgentPath(relPath, true);
+        sendJson(res, 200, readTextFile(agentEntry.repoRoot, relPath));
+      }
+    } catch (err) {
+      if (err instanceof HttpError) {
+        sendJson(res, err.status, { error: err.message });
+        return;
+      }
+      logger.runner.error("FILES", "Unexpected error handling a global agent request:", err);
+      sendJson(res, 500, { error: "Erro interno do runner." });
+    }
+    return;
+  }
+  const entry = authenticate(query);
+  if (!entry) {
+    sendJson(res, 401, { error: "Ticket inv\xE1lido, expirado, ou projeto desconhecido." });
+    return;
+  }
+  if (pathname === "/branch") {
+    void handleBranchRequest(entry, res, relPath);
+    return;
+  }
+  if (pathname === "/diff") {
+    const projectId = typeof query.projectId === "string" ? query.projectId : "";
+    void handleDiffRequest(entry, res, projectId);
+    return;
+  }
+  try {
+    if (pathname === "/tree") {
+      sendJson(res, 200, { entries: listDirectory(entry.repoRoot, relPath) });
+      return;
+    }
+    if (pathname === "/file") {
+      sendJson(res, 200, readTextFile(entry.repoRoot, relPath));
+      return;
+    }
+    if (pathname === "/agent-tree") {
+      sendJson(res, 200, { entries: listSafeAgentDirectory(entry.repoRoot, relPath, false) });
+      return;
+    }
+    if (pathname === "/agent-file") {
+      assertSafeAgentPath(relPath, false);
+      sendJson(res, 200, readTextFile(entry.repoRoot, relPath));
+      return;
+    }
+    if (pathname === "/logo") {
+      if (!relPath) throw new HttpError(404, "Nenhuma logo configurada para este projeto.");
+      const { buffer, contentType } = readImageFile(entry.repoRoot, relPath);
+      res.writeHead(200, {
+        "Content-Type": contentType,
+        "Content-Length": buffer.length,
+        "Cache-Control": "no-cache",
+        "Access-Control-Allow-Origin": "*"
+      });
+      res.end(buffer);
+      return;
+    }
+    if (pathname === "/shell/open") {
+      sendJson(res, 200, openShellSession(entry.repoRoot));
+      return;
+    }
+    if (pathname === "/shell/close") {
+      const sessionId = typeof query.sessionId === "string" ? query.sessionId : "";
+      if (!sessionId) throw new HttpError(400, "Par\xE2metro sessionId \xE9 obrigat\xF3rio.");
+      closeShellSession(sessionId);
+      sendJson(res, 200, { ok: true });
+      return;
+    }
+    if (pathname === "/column-shell/open" || pathname === "/column-shell/close") {
+      const projectId = typeof query.projectId === "string" ? query.projectId : "";
+      const column = typeof query.column === "string" ? query.column : null;
+      if (!column || !BOARD_COLUMNS.includes(column)) throw new HttpError(400, "Par\xE2metro column inv\xE1lido ou ausente.");
+      const kind = typeof query.kind === "string" ? query.kind : "shell";
+      if (!COLUMN_SHELL_KINDS.includes(kind)) throw new HttpError(400, "Par\xE2metro kind inv\xE1lido.");
+      const key = `${projectId}:${column}:${kind}`;
+      if (pathname === "/column-shell/open") {
+        const shell = openOrReuseColumnShell(key, entry.repoRoot, kind === "claude" ? CLAUDE_BYPASS_COMMAND : void 0);
+        if (statuslineSupabase) void upsertColumnShell(statuslineSupabase, projectId, column, kind, shell.sessionId, shell.ticket);
+        sendJson(res, 200, shell);
+        return;
+      }
+      closeColumnShell(key);
+      if (statuslineSupabase) void deleteColumnShell(statuslineSupabase, projectId, column, kind);
+      sendJson(res, 200, { ok: true });
+      return;
+    }
+    sendJson(res, 404, { error: "Rota desconhecida." });
+  } catch (err) {
+    if (err instanceof HttpError) {
+      sendJson(res, err.status, { error: err.message });
+      return;
+    }
+    logger.runner.error("FILES", "Unexpected error handling a files request:", err);
+    sendJson(res, 500, { error: "Erro interno do runner." });
+  }
+}
+function attachFilesServer(httpServer, supabase, config) {
+  statuslineSupabase = supabase;
+  statuslineConfig = config;
+  httpServer.on("request", handleRequest);
+  logger.runner.info("FILES", "Files HTTP handler attached.");
+}
+
+// src/agentEventsServer.ts
+var stateByProject = /* @__PURE__ */ new Map();
+var socketsByProject = /* @__PURE__ */ new Map();
+function sendSnapshot(socket, projectId) {
+  const states = Array.from(stateByProject.get(projectId)?.values() ?? []);
+  socket.send(JSON.stringify({ type: "snapshot", states }));
+}
+function publishAgentStateEvent(projectId, cardId, sessionId, agentState) {
+  let projectState = stateByProject.get(projectId);
+  if (!projectState) {
+    projectState = /* @__PURE__ */ new Map();
+    stateByProject.set(projectId, projectState);
+  }
+  projectState.set(cardId, { sessionId, cardId, agentState });
+  const sockets = socketsByProject.get(projectId);
+  if (!sockets || sockets.size === 0) return;
+  const payload = JSON.stringify({ type: "state", sessionId, cardId, agentState });
+  for (const socket of sockets) {
+    if (socket.readyState === socket.OPEN) socket.send(payload);
+  }
+}
+function attachAgentEventsServer() {
+  const wss = new WebSocketServer({ noServer: true });
+  wss.on("connection", (socket, request) => {
+    const { query } = parse2(request.url ?? "", true);
+    const projectId = typeof query.projectId === "string" ? query.projectId : null;
+    const entry = authenticate(query);
+    if (!projectId || !entry) {
+      logger.runner.warn("AGENT-EVENTS", "Agent events WS rejected: invalid or expired ticket.");
+      socket.close(4401, "Invalid or expired ticket");
+      return;
+    }
+    let sockets = socketsByProject.get(projectId);
+    if (!sockets) {
+      sockets = /* @__PURE__ */ new Set();
+      socketsByProject.set(projectId, sockets);
+    }
+    sockets.add(socket);
+    sendSnapshot(socket, projectId);
+    socket.on("close", () => {
+      sockets.delete(socket);
+    });
   });
-  return true;
+  logger.runner.info("AGENT-EVENTS", "Agent events WebSocket handler attached.");
+  return wss;
 }
-function watchAgentActivity(supabase, config, cardId, sessionId, pty) {
-  const watcher = new AgentActivityWatcher((state) => {
-    updateSession(supabase, sessionId, { agentState: state }).catch(
-      (err) => logger.card.error(cardId, `Failed to publish agent state "${state}" for session ${sessionId}:`, err)
+
+// src/columnActions.ts
+import { exec } from "node:child_process";
+import { join as join9 } from "node:path";
+import { promisify as promisify3 } from "node:util";
+var execAsync = promisify3(exec);
+var OUTPUT_TAIL_CHARS = 4e3;
+function tail(text) {
+  return text.length > OUTPUT_TAIL_CHARS ? text.slice(text.length - OUTPUT_TAIL_CHARS) : text;
+}
+function resolveTargets(project, children, repoRoot, column, timing) {
+  if (children.length > 0) {
+    return children.flatMap(
+      (child2) => (child2.column_actions[column] ?? []).filter((action) => action.timing === timing).map((action) => ({ label: child2.subpath, cwd: join9(repoRoot, child2.subpath), command: action.command }))
     );
-    if (state === "usage_limited") {
-      scheduleUsageResume(supabase, config, cardId, sessionId, pty);
+  }
+  return (project.column_actions[column] ?? []).filter((action) => action.timing === timing).map((action) => ({ label: null, cwd: repoRoot, command: action.command }));
+}
+var EXEC_OPTIONS = { maxBuffer: 10 * 1024 * 1024 };
+async function runCommand(target) {
+  try {
+    const { stdout, stderr } = await execAsync(target.command, { ...EXEC_OPTIONS, cwd: target.cwd });
+    return { ok: true, output: tail(`${stdout}${stderr}`) };
+  } catch (err) {
+    const { stdout, stderr } = err;
+    const message = err instanceof Error ? err.message : String(err);
+    return { ok: false, output: tail(`${stdout ?? ""}${stderr ?? ""}` || message) };
+  }
+}
+var inFlightColumns = /* @__PURE__ */ new Set();
+async function handleColumnEntered(supabase, config, card) {
+  const key = `${card.project_id}:${card.column_name}`;
+  if (inFlightColumns.has(key)) return;
+  inFlightColumns.add(key);
+  try {
+    const project = await getProject(supabase, card.project_id);
+    const children = await getProjectRepos(supabase, project.id);
+    const repoRoot = resolveRepoPath(config, project.repo_path);
+    const targets = resolveTargets(project, children, repoRoot, card.column_name, "before");
+    if (targets.length === 0) return;
+    const allCards = await listCardsInColumn(supabase, project.id, card.column_name);
+    const cards = allCards.filter((candidate) => candidate.assigned_user_id === config.ownerUserId);
+    if (cards.length === 0) return;
+    await Promise.all(
+      cards.map((candidate) => updateCard(supabase, candidate.id, { customActionStatus: "running", customActionOutput: null }))
+    );
+    let failure = null;
+    for (const target of targets) {
+      const result = await runCommand(target);
+      if (!result.ok) {
+        failure = { label: target.label, output: result.output };
+        break;
+      }
+    }
+    if (failure) {
+      const message = failure.label ? `[${failure.label}] ${failure.output}` : failure.output;
+      logger.runner.warn("COLUMN_ACTION", `Command failed for project ${project.id} in "${card.column_name}": ${message}`);
+      await Promise.all(
+        cards.map(
+          (candidate) => updateCard(supabase, candidate.id, { customActionStatus: "failed", customActionOutput: message })
+        )
+      );
     } else {
-      cancelUsageResume(sessionId);
+      logger.runner.info("COLUMN_ACTION", `Command passed for project ${project.id} in "${card.column_name}".`);
+      await Promise.all(
+        cards.map(
+          (candidate) => updateCard(supabase, candidate.id, { customActionStatus: "passed", customActionOutput: null })
+        )
+      );
+    }
+  } finally {
+    inFlightColumns.delete(key);
+  }
+}
+async function clearColumnActionStatus(supabase, card) {
+  if (card.custom_action_status === null) return;
+  await updateCard(supabase, card.id, { customActionStatus: null, customActionOutput: null });
+}
+async function runAfterColumnActions(project, children, repoRoot, column) {
+  const targets = resolveTargets(project, children, repoRoot, column, "after");
+  for (const target of targets) {
+    const result = await runCommand(target);
+    if (!result.ok) {
+      return { ok: false, error: target.label ? `${target.label}: ${result.output}` : result.output };
+    }
+  }
+  return { ok: true };
+}
+async function checkPendingColumnActions(supabase, config) {
+  for (const registered of config.registeredProjects) {
+    for (const column of BOARD_COLUMNS) {
+      const cards = await listCardsInColumn(supabase, registered.id, column);
+      const pending2 = cards.find(
+        (card) => card.assigned_user_id === config.ownerUserId && card.custom_action_status === null
+      );
+      if (pending2) await handleColumnEntered(supabase, config, pending2);
+    }
+  }
+}
+async function handleDeployActionRerunRequested(supabase, config, project) {
+  const allCards = await listCardsInColumn(supabase, project.id, "deploy");
+  const cards = allCards.filter((card) => card.assigned_user_id === config.ownerUserId);
+  if (cards.length === 0) {
+    logger.runner.info("COLUMN_ACTION", `Rerun requested for project ${project.id}'s "deploy" column but no card assigned to this runner's user is waiting there.`);
+  } else {
+    await handleColumnEntered(supabase, config, cards[0]);
+  }
+  await clearDeployActionRerunRequest(supabase, project.id);
+}
+async function checkPendingDeployActionReruns(supabase, config) {
+  for (const registered of config.registeredProjects) {
+    const project = await getProject(supabase, registered.id);
+    if (project.deploy_action_rerun_requested_at) {
+      await handleDeployActionRerunRequested(supabase, config, project);
+    }
+  }
+}
+
+// src/deploy.ts
+import { join as join12 } from "node:path";
+
+// src/devServer.ts
+import { spawn as spawn4 } from "node:child_process";
+
+// src/cloudflared.ts
+import { spawn as spawn3 } from "node:child_process";
+import { accessSync, constants } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { delimiter, join as join10 } from "node:path";
+import { bin as bundledBinaryPath, install as downloadCloudflared } from "cloudflared";
+var TRYCLOUDFLARE_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
+var STARTUP_TIMEOUT_MS = 2e4;
+var IS_WINDOWS2 = process.platform === "win32";
+var BINARY_NAME = IS_WINDOWS2 ? "cloudflared.exe" : "cloudflared";
+var CLOUDFLARED_INSTALL_DOCS_URL = "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/";
+function wellKnownDirectories() {
+  const home = homedir5();
+  if (IS_WINDOWS2) {
+    const candidates = [
+      process.env.ProgramFiles && join10(process.env.ProgramFiles, "cloudflared"),
+      process.env["ProgramFiles(x86)"] && join10(process.env["ProgramFiles(x86)"], "cloudflared"),
+      process.env.LOCALAPPDATA && join10(process.env.LOCALAPPDATA, "Microsoft", "WinGet", "Links"),
+      join10(home, "scoop", "shims"),
+      process.env.ChocolateyInstall && join10(process.env.ChocolateyInstall, "bin")
+    ];
+    return candidates.filter((dir) => Boolean(dir));
+  }
+  return ["/usr/local/bin", "/usr/bin", "/opt/homebrew/bin", join10(home, ".local", "bin")];
+}
+function pathDirectories() {
+  return (process.env.PATH ?? "").split(delimiter).map((dir) => dir.trim().replace(/^"|"$/g, "")).filter(Boolean);
+}
+function isExecutableFile(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function findInstalledBinary() {
+  const override = process.env.AGENT_BOARD_CLOUDFLARED_PATH;
+  const directories = [...pathDirectories(), ...wellKnownDirectories()];
+  const candidates = [...override ? [override] : [], ...directories.map((dir) => join10(dir, BINARY_NAME))];
+  return candidates.find(isExecutableFile) ?? null;
+}
+async function locateCloudflared() {
+  const installed = findInstalledBinary();
+  if (installed) return installed;
+  if (isExecutableFile(bundledBinaryPath)) return bundledBinaryPath;
+  try {
+    logger.runner.info("CLOUDFLARE", "Downloading the cloudflared binary (first run only)...");
+    return await downloadCloudflared(bundledBinaryPath);
+  } catch (err) {
+    logger.runner.error("CLOUDFLARE", `Failed to download cloudflared. Install it manually: ${CLOUDFLARED_INSTALL_DOCS_URL}`, err);
+    return null;
+  }
+}
+var lookup = null;
+function resolveCloudflaredPath() {
+  lookup ??= locateCloudflared().then((path) => {
+    if (!path) lookup = null;
+    return path;
+  });
+  return lookup;
+}
+async function startQuickTunnel(label, port) {
+  const executable = await resolveCloudflaredPath();
+  if (!executable) {
+    logger.runner.error("CLOUDFLARE", `No cloudflared binary available, so ${label} cannot be exposed.`);
+    return null;
+  }
+  return new Promise((resolve5) => {
+    let child2;
+    try {
+      child2 = spawn3(executable, [
+        "tunnel",
+        "--url",
+        `http://localhost:${port}`,
+        "--http-host-header",
+        `localhost:${port}`
+      ]);
+    } catch (err) {
+      logger.runner.error("CLOUDFLARE", `Failed to spawn cloudflared for ${label}:`, err);
+      resolve5(null);
+      return;
     }
+    let settled = false;
+    const settle = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve5(value);
+    };
+    const timer = setTimeout(() => {
+      logger.runner.warn("CLOUDFLARE", `cloudflared for ${label} did not print a trycloudflare.com URL within ${STARTUP_TIMEOUT_MS}ms.`);
+      settle(null);
+    }, STARTUP_TIMEOUT_MS);
+    const onOutput = (chunk) => {
+      if (settled) return;
+      const match = chunk.toString("utf-8").match(TRYCLOUDFLARE_URL_RE);
+      if (match) settle({ url: match[0], child: child2 });
+    };
+    child2.stdout?.on("data", onOutput);
+    child2.stderr?.on("data", onOutput);
+    child2.on("error", (err) => {
+      logger.runner.error("CLOUDFLARE", `cloudflared process error for ${label} (${executable}):`, err);
+      settle(null);
+    });
+    child2.on("exit", (code) => {
+      logger.runner.info("CLOUDFLARE", `cloudflared tunnel for ${label} exited (code ${code}).`);
+      settle(null);
+    });
+  });
+}
+function toTunnelHostname(url) {
+  return new URL(url).host;
+}
+
+// src/devServer.ts
+var STARTUP_TIMEOUT_MS2 = 45e3;
+var IS_WINDOWS3 = process.platform === "win32";
+var LOCAL_URL_PORT_RE = /https?:\/\/(?:localhost|127\.0\.0\.1|\[::1\]|0\.0\.0\.0):(\d{2,5})/i;
+var GENERIC_PORT_RE = /(?:listening|running|server).{0,40}?:?\s*(\d{4,5})\b/i;
+var ANSI_ESCAPE_RE2 = /\x1b\[[0-9;]*m/g;
+function detectPortFromOutput(chunk) {
+  const clean = chunk.replace(ANSI_ESCAPE_RE2, "");
+  const match = LOCAL_URL_PORT_RE.exec(clean) ?? GENERIC_PORT_RE.exec(clean);
+  return match ? Number(match[1]) : null;
+}
+function killProcessTree(child2) {
+  if (child2.pid == null) return;
+  if (IS_WINDOWS3) {
+    spawn4("taskkill", ["/pid", String(child2.pid), "/t", "/f"], { stdio: "ignore" });
+  } else {
+    child2.kill();
+  }
+}
+var previews = /* @__PURE__ */ new Map();
+function ensurePreview(key, label, cwd, command2, cardId) {
+  const existing = previews.get(key);
+  if (existing) {
+    existing.cardIds.add(cardId);
+    return existing.result;
+  }
+  let child2;
+  try {
+    child2 = spawn4(command2, { cwd, shell: true, windowsHide: true });
+  } catch (err) {
+    logger.runner.error("DEV_SERVER", `Failed to spawn "${command2}" in ${cwd}:`, err);
+    return Promise.resolve(null);
+  }
+  const entry = { child: child2, tunnelChild: null, cardIds: /* @__PURE__ */ new Set([cardId]), result: null };
+  entry.result = new Promise((resolve5) => {
+    let settled = false;
+    const settle = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (!value) {
+        killProcessTree(child2);
+        previews.delete(key);
+      }
+      resolve5(value);
+    };
+    const timer = setTimeout(() => {
+      logger.runner.warn("DEV_SERVER", `"${command2}" in ${cwd} did not reveal a port within ${STARTUP_TIMEOUT_MS2}ms.`);
+      settle(null);
+    }, STARTUP_TIMEOUT_MS2);
+    const onOutput = async (chunk) => {
+      if (settled) return;
+      const port = detectPortFromOutput(chunk.toString("utf-8"));
+      if (port == null) return;
+      settled = true;
+      clearTimeout(timer);
+      const tunnel = await startQuickTunnel(`dev server ${key}`, port);
+      if (!tunnel) {
+        logger.runner.warn("DEV_SERVER", `Detected port ${port} for ${key} but cloudflared could not tunnel it.`);
+        killProcessTree(child2);
+        previews.delete(key);
+        resolve5(null);
+        return;
+      }
+      entry.tunnelChild = tunnel.child;
+      logger.runner.info("DEV_SERVER", `${key} is up on port ${port}, tunneled at ${tunnel.url}.`);
+      resolve5({ label, url: tunnel.url });
+    };
+    child2.stdout?.on("data", onOutput);
+    child2.stderr?.on("data", onOutput);
+    child2.on("error", (err) => {
+      logger.runner.error("DEV_SERVER", `Dev server process error for ${key} (${command2} in ${cwd}):`, err);
+      settle(null);
+    });
+    child2.on("exit", (code) => {
+      logger.runner.info("DEV_SERVER", `Dev server for ${key} exited (code ${code}) before/without a usable preview.`);
+      settle(null);
+    });
   });
-  pty.onData((chunk) => watcher.push(chunk));
-  return watcher;
+  previews.set(key, entry);
+  return entry.result;
 }
-async function reconcileOrphanedSessions(supabase, config) {
-  for (const project of config.registeredProjects) {
-    const { data, error } = await supabase.from("sessions").select("id, card_id, claude_session_id, created_at, cards!inner(project_id, assigned_user_id, title, instructions, file_references, plan_first)").eq("cards.project_id", project.id).eq("cards.assigned_user_id", config.ownerUserId).eq("status", "running");
-    if (error) {
-      logger.runner.error("ORCHESTRATOR", `Failed to scan orphaned sessions for project ${project.id}:`, error.message);
-      continue;
-    }
-    for (const entry of data ?? []) {
-      let spawned;
-      try {
-        spawned = await spawnSessionPty(supabase, config, entry);
-      } catch (err) {
-        logger.card.error(entry.card_id, `Failed to re-spawn orphaned session ${entry.id}:`, err);
-        continue;
-      }
-      if (spawned) {
-        logger.card.info(entry.card_id, "Re-spawned orphaned session (runner restarted since it was last running).");
-      }
-    }
+function releaseCard(cardId) {
+  for (const [key, entry] of previews) {
+    if (!entry.cardIds.delete(cardId)) continue;
+    if (entry.cardIds.size > 0) continue;
+    killProcessTree(entry.child);
+    entry.tunnelChild?.kill();
+    previews.delete(key);
   }
 }
-async function reconcileUsageLimitedSessions(supabase, config) {
-  for (const project of config.registeredProjects) {
-    const { data, error } = await supabase.from("sessions").select("id, card_id, cards!inner(project_id, assigned_user_id)").eq("cards.project_id", project.id).eq("cards.assigned_user_id", config.ownerUserId).eq("status", "running").eq("agent_state", "usage_limited");
-    if (error) {
-      logger.runner.error("ORCHESTRATOR", `Failed to scan usage-limited sessions for project ${project.id}:`, error.message);
-      continue;
-    }
-    for (const { id: sessionId, card_id: cardId } of data ?? []) {
-      const handle = getPtySession(sessionId);
-      if (!handle) continue;
-      scheduleUsageResume(supabase, config, cardId, sessionId, handle.pty);
-    }
+function stopProjectPreviews(projectId) {
+  const prefix = `${projectId}:`;
+  for (const [key, entry] of previews) {
+    if (!key.startsWith(prefix)) continue;
+    killProcessTree(entry.child);
+    entry.tunnelChild?.kill();
+    previews.delete(key);
   }
 }
-async function stopCardSession(supabase, config, card) {
-  const sessionId = activeSessionByCard.get(card.id) ?? (await getActiveSessionForCard(supabase, card.id))?.id;
-  if (!sessionId) return;
-  stopPtySession(sessionId);
-  cancelUsageResume(sessionId);
-  activeSessionByCard.delete(card.id);
-  await updateSession(
-    supabase,
-    sessionId,
-    { status: "done", endedAt: (/* @__PURE__ */ new Date()).toISOString() },
-    { projectId: card.project_id, cardId: card.id, userId: config.ownerUserId }
-  );
-  logger.card.info(card.id, `Session ${sessionId} stopped.`);
-  await dispatchRunnerQueue(supabase, config);
-}
-
-// src/deploy.ts
-async function handleDeployRequested(supabase, config, project) {
-  const registered = config.registeredProjects.find((candidate) => candidate.id === project.id);
-  if (!registered) {
-    logger.runner.warn("DEPLOY", `Ignoring deploy request: project ${project.id} is not registered on this runner.`);
-    return;
-  }
-  const allCards = await listCardsInColumn(supabase, project.id, "deploy");
-  const cards = allCards.filter((card) => card.assigned_user_id === config.ownerUserId);
-  if (cards.length === 0) {
-    logger.runner.info("DEPLOY", `Deploy requested for project ${project.id} but no cards assigned to this runner's user are waiting in "deploy".`);
-    await clearProjectDeployRequest(supabase, project.id);
-    return;
-  }
-  const children = await getProjectRepos(supabase, project.id);
-  const repoRoot = resolveRepoPath(config, project.repo_path);
-  const targets = children.length > 0 ? children.map((child2) => ({ label: child2.subpath, path: join6(repoRoot, child2.subpath) })) : [{ label: null, path: repoRoot }];
-  const failures = [];
-  for (const target of targets) {
-    const result = await pushBranchToMain(target.path);
-    if (result.ok) {
-      logger.runner.info("DEPLOY", target.label ? `Pushed HEAD to main in "${target.label}".` : "Pushed HEAD to main.");
-    } else {
-      logger.runner.error("DEPLOY", target.label ? `Push to main failed in "${target.label}": ${result.error}` : `Push to main failed: ${result.error}`);
-      failures.push(target.label ? `${target.label}: ${result.error}` : result.error);
-    }
-  }
-  if (failures.length > 0) {
-    const message = failures.join("; ");
-    await Promise.all(cards.map((card) => updateCard(supabase, card.id, { deployError: message })));
-    await clearProjectDeployRequest(supabase, project.id);
-    return;
+function stopAll() {
+  for (const key of [...previews.keys()]) {
+    const entry = previews.get(key);
+    if (!entry) continue;
+    killProcessTree(entry.child);
+    entry.tunnelChild?.kill();
+    previews.delete(key);
   }
-  await Promise.all(cards.map((card) => updateCard(supabase, card.id, { deployError: null, column: "fim" })));
-  await clearProjectDeployRequest(supabase, project.id);
 }
-async function checkPendingDeploys(supabase, config) {
-  for (const registered of config.registeredProjects) {
-    const project = await getProject(supabase, registered.id);
-    if (project.deploy_requested_at) {
-      await handleDeployRequested(supabase, config, project);
-    }
+
+// src/git.ts
+import { execFile as execFile3 } from "node:child_process";
+import { promisify as promisify4 } from "node:util";
+var execFileAsync3 = promisify4(execFile3);
+async function pushBranchToMain(repoPath) {
+  try {
+    await execFileAsync3("git", ["push", "origin", "HEAD:main"], { cwd: repoPath });
+    return { ok: true };
+  } catch (err) {
+    const stderr = err.stderr;
+    const error = stderr?.trim() || (err instanceof Error ? err.message : String(err));
+    return { ok: false, error };
   }
 }
-async function handleCardReachedFim(supabase, config, card) {
-  await stopCardSession(supabase, config, card);
-  releaseCard(card.id);
-  logger.card.info(card.id, 'Reached "fim" \u2014 session stopped, preview tunnel (if any) closed.');
-}
 
-// src/filesServer.ts
-import { execFile as execFile2 } from "node:child_process";
+// src/orchestrator.ts
+import { randomUUID as randomUUID7 } from "node:crypto";
+
+// src/agentSession.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { existsSync as existsSync4, lstatSync, readdirSync, readFileSync as readFileSync4 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { join as join8, resolve as resolve2, sep } from "node:path";
-import { parse } from "node:url";
-import { promisify as promisify2 } from "node:util";
+import { spawn as spawn5 } from "node-pty";
 
-// src/shellSession.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
-import { spawn as spawn4 } from "node-pty";
-var SHELL_COMMAND = process.platform === "win32" ? process.env.COMSPEC ?? "cmd.exe" : process.env.SHELL ?? "bash";
-function openShellSession(repoPath) {
-  const sessionId = `shell:${randomUUID4()}`;
-  const ticket = randomUUID4();
-  const pty = spawn4(SHELL_COMMAND, [], {
-    name: "xterm-color",
-    cols: 120,
-    rows: 32,
-    cwd: repoPath
-  });
-  registerPtySession(sessionId, pty, ticket);
-  pty.onExit(({ exitCode }) => {
-    logger.runner.info("SHELL", `Standalone shell ${sessionId} exited (code ${exitCode}).`);
-    stopPtySession(sessionId);
-  });
-  return { sessionId, ticket };
+// src/sessionName.ts
+var MAX_LENGTH = 60;
+var FALLBACK_NAME = "card";
+function toSessionName(title) {
+  const slug = title.normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (slug.length === 0) return FALLBACK_NAME;
+  if (slug.length <= MAX_LENGTH) return slug;
+  const truncated = slug.slice(0, MAX_LENGTH);
+  const lastHyphen = truncated.lastIndexOf("-");
+  return (lastHyphen > 0 ? truncated.slice(0, lastHyphen) : truncated).replace(/-+$/, "");
 }
 
-// src/usageMonitor.ts
-import { randomUUID as randomUUID5 } from "node:crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir3, tmpdir as tmpdir3 } from "node:os";
-import { join as join7 } from "node:path";
-import { spawn as spawn5 } from "node-pty";
-var SESSION_ID = "usage-monitor";
-var TICKET = randomUUID5();
-var SCRATCH_DIR = join7(tmpdir3(), "agent-board-usage-monitor");
-var POLL_INTERVAL_MS = Number(process.env.AGENT_BOARD_USAGE_POLL_INTERVAL_MS ?? 15 * 6e4);
-var IDLE_MS = 2e3;
-var HARD_TIMEOUT_MS = 6e4;
-function usageMonitorSessionId() {
-  return SESSION_ID;
+// src/agentSession.ts
+var TUI_IDLE_MS = 1500;
+var TUI_READY_TIMEOUT_MS = 6e4;
+var SUBMIT_DELAY_MS = 150;
+var PASTE_START = "\x1B[200~";
+var PASTE_END = "\x1B[201~";
+var SHIFT_TAB = "\x1B[Z";
+var SHIFT_TAB_PRESSES_TO_PLAN_MODE = 4;
+var SHIFT_TAB_DELAY_MS = 400;
+var PLAN_MODE_INDICATOR = /plan mode on/i;
+function spawnAgentPty(repoPath, cardId, cardTitle, instructions, sessionId, ticket, planFirst) {
+  const claudeSessionId = randomUUID6();
+  const pty = spawn5(
+    CLAUDE_BINARY,
+    [
+      "--dangerously-skip-permissions",
+      "--model",
+      "claude-sonnet-5",
+      "--session-id",
+      claudeSessionId,
+      ...claudeCliSettingsArgs(),
+      `/rename ${toSessionName(cardTitle)}`
+    ],
+    {
+      name: "xterm-color",
+      cols: 120,
+      rows: 32,
+      cwd: repoPath,
+      env: statuslineEnv(sessionId, ticket)
+    }
+  );
+  sendMessageWhenIdle(pty, cardId, instructions, planFirst);
+  return { pty, claudeSessionId };
 }
-function usageMonitorTicket() {
-  return TICKET;
+function sendMessageWhenIdle(pty, cardId, message, planFirst) {
+  let idleTimer;
+  let deadlineTimer;
+  let dataSubscription;
+  let settled = false;
+  const stopWaiting = () => {
+    if (settled) return false;
+    settled = true;
+    clearTimeout(idleTimer);
+    clearTimeout(deadlineTimer);
+    dataSubscription?.dispose();
+    return true;
+  };
+  const send = async () => {
+    if (!stopWaiting()) return;
+    if (planFirst) await enterPlanMode(pty, cardId);
+    try {
+      pty.write(`${PASTE_START}${message}${PASTE_END}`);
+      setTimeout(() => {
+        try {
+          pty.write("\r");
+        } catch (err) {
+          logger.card.error(cardId, "Failed to submit the card instructions to the agent:", err);
+        }
+      }, SUBMIT_DELAY_MS);
+    } catch (err) {
+      logger.card.error(cardId, "Failed to send the card instructions to the agent:", err);
+    }
+  };
+  deadlineTimer = setTimeout(send, TUI_READY_TIMEOUT_MS);
+  dataSubscription = pty.onData(() => {
+    clearTimeout(idleTimer);
+    idleTimer = setTimeout(send, TUI_IDLE_MS);
+  });
+  pty.onExit(() => stopWaiting());
 }
-function ensureScratchDirTrusted() {
-  const claudeJsonPath = join7(homedir3(), ".claude.json");
-  if (!existsSync3(claudeJsonPath)) return;
+async function enterPlanMode(pty, cardId) {
+  let recentOutput = "";
+  const subscription = pty.onData((chunk) => {
+    recentOutput += normalizeTerminalOutput(chunk);
+  });
   try {
-    const raw = readFileSync3(claudeJsonPath, "utf8");
-    const data = JSON.parse(raw);
-    data.projects ??= {};
-    const keys = [SCRATCH_DIR, SCRATCH_DIR.replace(/\\/g, "/")];
-    const alreadyTrusted = keys.every((key) => data.projects[key]?.hasTrustDialogAccepted === true);
-    if (alreadyTrusted) return;
-    for (const key of keys) {
-      data.projects[key] = { ...data.projects[key], hasTrustDialogAccepted: true };
+    for (let attempt = 1; attempt <= SHIFT_TAB_PRESSES_TO_PLAN_MODE; attempt++) {
+      pty.write(SHIFT_TAB);
+      await new Promise((resolve5) => setTimeout(resolve5, SHIFT_TAB_DELAY_MS));
+    }
+    if (!PLAN_MODE_INDICATOR.test(recentOutput)) {
+      logger.card.warn(
+        cardId,
+        `Sent ${SHIFT_TAB_PRESSES_TO_PLAN_MODE} Shift+Tab presses but never saw the plan-mode indicator \u2014 the session may not actually be in Plan Mode.`
+      );
     }
-    writeFileSync4(claudeJsonPath, JSON.stringify(data, null, 2));
-    logger.runner.info("USAGE_MONITOR", `Pre-trusted scratch directory ${SCRATCH_DIR} in ~/.claude.json.`);
   } catch (err) {
-    logger.runner.error("USAGE_MONITOR", "Failed to pre-trust the usage-monitor scratch directory:", err);
+    logger.card.error(cardId, "Failed to switch the session into Plan Mode:", err);
+  } finally {
+    subscription.dispose();
   }
 }
-function pollUsageOnce() {
-  let pty;
+function sendContinue(pty, cardId) {
   try {
-    pty = spawn5(
-      CLAUDE_BINARY,
-      [
-        "--dangerously-skip-permissions",
-        "--model",
-        "claude-haiku-4-5",
-        // cheapest model — this exchange exists only to trigger a statusLine update
-        ...statuslineSettingsArgs(),
-        "reply with just the word: ok"
-      ],
-      {
-        name: "xterm-color",
-        cols: 80,
-        rows: 24,
-        cwd: SCRATCH_DIR,
-        env: statuslineEnv(SESSION_ID, TICKET)
+    pty.write(`${PASTE_START}continue${PASTE_END}`);
+    setTimeout(() => {
+      try {
+        pty.write("\r");
+      } catch (err) {
+        logger.card.error(cardId, 'Failed to submit the auto-resume "continue" message:', err);
       }
-    );
+    }, SUBMIT_DELAY_MS);
   } catch (err) {
-    logger.runner.error("USAGE_MONITOR", "Failed to spawn the usage-poll session:", err);
-    return;
-  }
-  let settled = false;
-  let idleTimer;
-  const hardTimer = setTimeout(finish, HARD_TIMEOUT_MS);
-  function finish() {
-    if (settled) return;
-    settled = true;
-    clearTimeout(idleTimer);
-    clearTimeout(hardTimer);
-    try {
-      pty.kill();
-    } catch {
-    }
+    logger.card.error(cardId, 'Failed to send the auto-resume "continue" message:', err);
   }
-  pty.onData(() => {
-    clearTimeout(idleTimer);
-    idleTimer = setTimeout(finish, IDLE_MS);
-  });
-  pty.onExit(() => finish());
 }
-function startUsageMonitor() {
-  mkdirSync3(SCRATCH_DIR, { recursive: true });
-  ensureScratchDirTrusted();
-  pollUsageOnce();
-  setInterval(pollUsageOnce, POLL_INTERVAL_MS);
+function resumeAgentPty(repoPath, claudeSessionId, sessionId, ticket) {
+  return spawn5(
+    CLAUDE_BINARY,
+    [
+      "--dangerously-skip-permissions",
+      "--model",
+      "claude-sonnet-5",
+      "--resume",
+      claudeSessionId,
+      ...claudeCliSettingsArgs()
+    ],
+    {
+      name: "xterm-color",
+      cols: 120,
+      rows: 32,
+      cwd: repoPath,
+      env: statuslineEnv(sessionId, ticket)
+    }
+  );
 }
 
-// src/filesServer.ts
-var execFileAsync2 = promisify2(execFile2);
-var FILES_TICKET_TTL_MS = 15 * 60 * 1e3;
-var FILES_TICKET_REFRESH_MARGIN_MS = FILES_TICKET_TTL_MS / 3;
-var MAX_FILE_SIZE_BYTES = 1e6;
-var MAX_LOGO_SIZE_BYTES = 5e6;
-var IGNORED_ENTRY_NAMES = /* @__PURE__ */ new Set([".git", ".claude", "node_modules", "dist", "build"]);
-var AGENT_SAFE_SUBDIR_NAMES = /* @__PURE__ */ new Set(["skills", "commands", "agents", "rules"]);
-var BRAND_ICON_BASE_NAMES = ["logo", "favicon"];
-var MIME_TYPES_BY_EXT = {
-  svg: "image/svg+xml",
-  png: "image/png",
-  jpg: "image/jpeg",
-  jpeg: "image/jpeg",
-  webp: "image/webp",
-  gif: "image/gif",
-  ico: "image/x-icon"
-};
-var ticketsByProject = /* @__PURE__ */ new Map();
-var setupTicket = null;
-var agentTicket = null;
-var statuslineSupabase = null;
-var statuslineConfig = null;
-var MAX_STATUSLINE_BODY_BYTES = 16e3;
-var HttpError = class extends Error {
-  constructor(status, message) {
-    super(message);
-    this.status = status;
+// src/cardAttachments.ts
+import { mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
+import { tmpdir as tmpdir6 } from "node:os";
+import { extname, join as join11 } from "node:path";
+var ATTACHMENTS_ROOT = join11(tmpdir6(), "agent-board", "card-attachments");
+function sanitizeFileName(fileName) {
+  return fileName.replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+async function downloadCardAttachments(supabase, cardId) {
+  const { data, error } = await supabase.from("card_attachments").select("id, storage_path, file_name").eq("card_id", cardId).order("created_at", { ascending: true });
+  if (error) {
+    logger.card.error(cardId, "Failed to list attachments:", error.message);
+    return [];
   }
-};
-async function ensureFilesTickets(supabase, config) {
-  for (const project of config.registeredProjects) {
-    if (!project.isReferenceRunner) continue;
-    const existing = ticketsByProject.get(project.id);
-    if (existing && existing.expiresAt - Date.now() > FILES_TICKET_REFRESH_MARGIN_MS) continue;
-    const ticket = randomUUID6();
-    const expiresAtMs = Date.now() + FILES_TICKET_TTL_MS;
-    ticketsByProject.set(project.id, { ticket, expiresAt: expiresAtMs, repoRoot: resolve2(project.repoPath) });
+  const rows = data ?? [];
+  if (rows.length === 0) return [];
+  const targetDir = join11(ATTACHMENTS_ROOT, cardId);
+  await mkdir2(targetDir, { recursive: true });
+  const paths = [];
+  for (const row of rows) {
+    const baseName = sanitizeFileName(row.file_name);
+    const fileName = extname(baseName) ? baseName : `${baseName}${extname(row.storage_path)}`;
+    const localPath = join11(targetDir, `${row.id}-${fileName}`);
     try {
-      await updateProjectFilesTicket(supabase, project.id, ticket, new Date(expiresAtMs).toISOString());
+      const { data: blob, error: downloadError } = await supabase.storage.from(CARD_ATTACHMENTS_BUCKET).download(row.storage_path);
+      if (downloadError) throw downloadError;
+      await writeFile2(localPath, Buffer.from(await blob.arrayBuffer()));
+      paths.push(localPath);
     } catch (err) {
-      logger.runner.error("FILES", `Failed to publish files ticket for project ${project.id}:`, err);
+      logger.card.error(cardId, `Failed to download attachment ${row.storage_path}:`, err);
     }
   }
+  return paths;
 }
-function authenticate(query) {
-  const projectId = typeof query.projectId === "string" ? query.projectId : null;
-  const ticket = typeof query.ticket === "string" ? query.ticket : null;
-  if (!projectId || !ticket) return null;
-  const entry = ticketsByProject.get(projectId);
-  if (!entry || entry.ticket !== ticket || entry.expiresAt < Date.now()) return null;
-  return entry;
-}
-async function ensureSetupTicket(supabase, config) {
-  if (!config.allowedRootPath) return;
-  if (setupTicket && setupTicket.expiresAt - Date.now() > FILES_TICKET_REFRESH_MARGIN_MS) return;
-  const ticket = randomUUID6();
-  const expiresAtMs = Date.now() + FILES_TICKET_TTL_MS;
-  setupTicket = { ticket, expiresAt: expiresAtMs, rootPath: resolve2(config.allowedRootPath) };
-  try {
-    await updateRunnerSetupTicket(supabase, config.runnerId, ticket, new Date(expiresAtMs).toISOString(), config.allowedRootPath);
-  } catch (err) {
-    logger.runner.error("FILES", `Failed to publish setup ticket for runner ${config.runnerId}:`, err);
-  }
-}
-function authenticateSetup(query) {
-  const ticket = typeof query.ticket === "string" ? query.ticket : null;
-  if (!ticket || !setupTicket) return null;
-  if (setupTicket.ticket !== ticket || setupTicket.expiresAt < Date.now()) return null;
-  return setupTicket;
+function buildInstructionsWithAttachments(instructions, attachmentPaths) {
+  if (attachmentPaths.length === 0) return instructions;
+  const list = attachmentPaths.map((path) => `- ${path}`).join("\n");
+  return `${instructions}
+
+Files attached to this card (use each one as part of the task):
+${list}`;
 }
-async function ensureAgentTicket(supabase, config) {
-  if (agentTicket && agentTicket.expiresAt - Date.now() > FILES_TICKET_REFRESH_MARGIN_MS) return;
-  const ticket = randomUUID6();
-  const expiresAtMs = Date.now() + FILES_TICKET_TTL_MS;
-  agentTicket = { ticket, expiresAt: expiresAtMs, repoRoot: resolve2(homedir4(), ".claude") };
-  try {
-    await updateRunnerAgentTicket(supabase, config.runnerId, ticket, new Date(expiresAtMs).toISOString());
-  } catch (err) {
-    logger.runner.error("FILES", `Failed to publish agent ticket for runner ${config.runnerId}:`, err);
-  }
+
+// src/fileReferences.ts
+function buildInstructionsWithFileReferences(instructions, fileReferences) {
+  if (fileReferences.length === 0) return instructions;
+  const list = fileReferences.map((path) => `- ${path}`).join("\n");
+  return `${instructions}
+
+Files/folders referenced on this card (read them before starting \u2014 they are part of the task):
+${list}`;
 }
-function authenticateAgent(query) {
-  const ticket = typeof query.ticket === "string" ? query.ticket : null;
-  if (!ticket || !agentTicket) return null;
-  if (agentTicket.ticket !== ticket || agentTicket.expiresAt < Date.now()) return null;
-  return agentTicket;
+
+// src/mcpContextNote.ts
+function buildInstructionsWithMcpContext(instructions, cardId, projectId) {
+  return `${instructions}
+
+Agent Board MCP: this card's id is \`${cardId}\` and its project id is \`${projectId}\` \u2014 pass these directly to board tools (\`update_card\`, \`create_card\`, \`add_card_comment\`, etc.), no lookup needed. If this task turns out too large for one session, use \`create_card\` to split it into subtask cards (chain them with \`prerequisiteCardId\` when one depends on another) instead of trying to fit everything here. Before finishing, post a short summary of what you did as a comment on this card via \`add_card_comment\` so the project's humans have visibility without opening this terminal.`;
 }
-function resolveWithinRepo(repoRoot, relPath) {
-  const normalizedRel = relPath.replace(/^[/\\]+/, "");
-  const resolved = resolve2(repoRoot, normalizedRel);
-  const rootWithSep = repoRoot.endsWith(sep) ? repoRoot : repoRoot + sep;
-  if (resolved !== repoRoot && !resolved.startsWith(rootWithSep)) {
-    throw new HttpError(403, "Caminho fora do reposit\xF3rio.");
-  }
-  return resolved;
+
+// src/usageResume.ts
+var RESET_BUFFER_MS = 3e4;
+var UNKNOWN_RESET_RETRY_MS = 5 * 6e4;
+var pending = /* @__PURE__ */ new Map();
+function scheduleUsageResume(supabase, config, cardId, sessionId, pty) {
+  if (pending.has(sessionId)) return;
+  void (async () => {
+    const usage = await getClaudeUsage(supabase, config.ownerUserId).catch((err) => {
+      logger.card.error(cardId, "Failed to read claude_usage for usage-limit resume:", err);
+      return null;
+    });
+    const now = Date.now();
+    const candidates = [usage?.sessionResetsAt, usage?.weekResetsAt].map((iso) => iso ? new Date(iso).getTime() : null).filter((ms) => ms !== null && ms > now);
+    const resetAt = candidates.length > 0 ? Math.min(...candidates) : null;
+    const delay = resetAt !== null ? resetAt - now + RESET_BUFFER_MS : UNKNOWN_RESET_RETRY_MS;
+    logger.card.info(
+      cardId,
+      resetAt !== null ? `Usage limit hit \u2014 will send "continue" automatically at ${new Date(resetAt).toISOString()}.` : `Usage limit hit but no reset time known yet \u2014 will retry in ${Math.round(delay / 6e4)}min.`
+    );
+    const timer = setTimeout(() => {
+      pending.delete(sessionId);
+      sendContinue(pty, cardId);
+    }, delay);
+    timer.unref();
+    pending.set(sessionId, timer);
+  })();
 }
-function listDirectory(repoRoot, relPath, options) {
-  const target = resolveWithinRepo(repoRoot, relPath);
-  let stat;
-  try {
-    stat = lstatSync(target);
-  } catch {
-    throw new HttpError(404, "Diret\xF3rio n\xE3o encontrado.");
-  }
-  if (stat.isSymbolicLink()) throw new HttpError(403, "Links simb\xF3licos n\xE3o s\xE3o suportados.");
-  if (!stat.isDirectory()) throw new HttpError(400, "O caminho informado n\xE3o \xE9 um diret\xF3rio.");
-  const prefix = relPath.replace(/\/+$/, "");
-  return readdirSync(target, { withFileTypes: true }).filter(
-    (dirent) => !dirent.isSymbolicLink() && (!IGNORED_ENTRY_NAMES.has(dirent.name) || options?.includeDotClaude && dirent.name === ".claude")
-  ).map((dirent) => ({
-    name: dirent.name,
-    path: prefix ? `${prefix}/${dirent.name}` : dirent.name,
-    type: dirent.isDirectory() ? "dir" : "file"
-  })).sort((a, b) => a.type !== b.type ? a.type === "dir" ? -1 : 1 : a.name.localeCompare(b.name));
+function cancelUsageResume(sessionId) {
+  const timer = pending.get(sessionId);
+  if (!timer) return;
+  clearTimeout(timer);
+  pending.delete(sessionId);
 }
-function listSafeAgentDirectory(baseDir, relPath, atClaudeRoot) {
-  const entries = listDirectory(baseDir, relPath, { includeDotClaude: true });
-  const segments = relPath === "" ? [] : relPath.split("/");
-  if (atClaudeRoot) {
-    if (segments.length === 0) {
-      return entries.filter(
-        (entry) => entry.type === "file" && entry.name === "CLAUDE.md" || entry.type === "dir" && AGENT_SAFE_SUBDIR_NAMES.has(entry.name)
-      );
+
+// src/orchestrator.ts
+var TERMINAL_TICKET_TTL_MS = 60 * 60 * 1e3;
+var inFlightCardIds = /* @__PURE__ */ new Set();
+var activeSessionByCard = /* @__PURE__ */ new Map();
+var intentionallyStoppedSessionIds = /* @__PURE__ */ new Set();
+var dispatchingRunner = false;
+async function scanForWork(supabase, config) {
+  for (const project of config.registeredProjects) {
+    await reconcileStaleSessions(supabase, config, project.id);
+    const { data: cards, error } = await supabase.from("cards").select("*").eq("project_id", project.id).eq("column_name", "desenvolvimento").eq("assigned_user_id", config.ownerUserId);
+    if (error) {
+      logger.runner.error("ORCHESTRATOR", `Failed to scan cards for project ${project.id}:`, error.message);
+      continue;
+    }
+    for (const card of cards ?? []) {
+      void enqueueCard(supabase, config, card);
     }
-    return entries;
-  }
-  const isRepoRootLevel = segments.length === 0 || segments.length === 1 && segments[0] !== ".claude";
-  if (isRepoRootLevel) {
-    return entries.filter((entry) => entry.type === "file" && entry.name === "CLAUDE.md" || entry.type === "dir" && entry.name === ".claude");
-  }
-  if (segments[segments.length - 1] === ".claude") {
-    return entries.filter((entry) => entry.type === "dir" && AGENT_SAFE_SUBDIR_NAMES.has(entry.name));
   }
-  return entries;
+  void dispatchRunnerQueue(supabase, config);
 }
-function assertSafeAgentPath(relPath, atClaudeRoot) {
-  const segments = relPath.split("/");
-  function matches(rest2) {
-    if (rest2.length === 1 && rest2[0] === "CLAUDE.md") return true;
-    if (atClaudeRoot) return rest2.length >= 2 && AGENT_SAFE_SUBDIR_NAMES.has(rest2[0]);
-    return rest2.length >= 3 && rest2[0] === ".claude" && AGENT_SAFE_SUBDIR_NAMES.has(rest2[1]);
+async function enqueueCard(supabase, config, card) {
+  if (inFlightCardIds.has(card.id)) return;
+  const registered = config.registeredProjects.find((project) => project.id === card.project_id);
+  if (!registered) {
+    logger.card.warn(card.id, `Ignoring card: project ${card.project_id} is not registered on this runner.`);
+    return;
   }
-  if (matches(segments)) return;
-  if (!atClaudeRoot && segments.length > 1 && matches(segments.slice(1))) return;
-  throw new HttpError(403, "Caminho fora da \xE1rea permitida para o Agente.");
-}
-function listDirectoryForBrowse(rootPath, relPath) {
-  return listDirectory(rootPath, relPath).map((entry) => ({
-    ...entry,
-    hasGit: entry.type === "dir" && existsSync4(join8(rootPath, entry.path, ".git"))
-  }));
-}
-function looksBinary(buffer) {
-  const sample = buffer.subarray(0, Math.min(buffer.length, 8e3));
-  return sample.includes(0);
-}
-function readTextFile(repoRoot, relPath) {
-  const target = resolveWithinRepo(repoRoot, relPath);
-  let stat;
+  if (card.assigned_user_id !== config.ownerUserId) return;
+  inFlightCardIds.add(card.id);
   try {
-    stat = lstatSync(target);
-  } catch {
-    throw new HttpError(404, "Arquivo n\xE3o encontrado.");
-  }
-  if (stat.isSymbolicLink()) throw new HttpError(403, "Links simb\xF3licos n\xE3o s\xE3o suportados.");
-  if (!stat.isFile()) throw new HttpError(400, "O caminho informado n\xE3o \xE9 um arquivo.");
-  if (stat.size > MAX_FILE_SIZE_BYTES) {
-    throw new HttpError(413, `Arquivo maior que o limite de ${MAX_FILE_SIZE_BYTES / 1e6}MB para visualiza\xE7\xE3o.`);
+    const active = await getActiveSessionForCard(supabase, card.id);
+    if (active) return;
+    await createQueuedSession(supabase, config, card);
+  } finally {
+    inFlightCardIds.delete(card.id);
   }
-  const buffer = readFileSync4(target);
-  if (looksBinary(buffer)) throw new HttpError(415, "Arquivo bin\xE1rio n\xE3o pode ser exibido.");
-  return { content: buffer.toString("utf8"), size: stat.size };
+  await dispatchRunnerQueue(supabase, config);
 }
-function findBrandIconPath(repoRoot) {
-  const patterns = BRAND_ICON_BASE_NAMES.map((baseName) => ({
-    baseName,
-    pattern: new RegExp(`^${baseName}\\.[a-z0-9]+$`, "i")
-  }));
-  const candidatesByBaseName = new Map(
-    BRAND_ICON_BASE_NAMES.map((baseName) => [baseName, []])
+async function createQueuedSession(supabase, config, card) {
+  const resumeClaudeSessionId = await getLastClaudeSessionIdForCard(supabase, card.id);
+  const sessionId = await createSession(supabase, config.ownerUserId, card.id, resumeClaudeSessionId);
+  logger.card.info(
+    card.id,
+    resumeClaudeSessionId ? `"${card.title}" queued (session ${sessionId}, will resume prior conversation ${resumeClaudeSessionId}).` : `"${card.title}" queued (session ${sessionId}).`
   );
-  function walk(dir, relDir, depth) {
-    let entries;
-    try {
-      entries = readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (entry.isSymbolicLink() || IGNORED_ENTRY_NAMES.has(entry.name)) continue;
-      const relPath = relDir ? `${relDir}/${entry.name}` : entry.name;
-      if (entry.isDirectory()) {
-        walk(join8(dir, entry.name), relPath, depth + 1);
-      } else if (entry.isFile()) {
-        const match = patterns.find(({ pattern }) => pattern.test(entry.name));
-        if (match) candidatesByBaseName.get(match.baseName).push({ relPath, depth });
-      }
-    }
-  }
-  walk(repoRoot, "", 0);
-  for (const baseName of BRAND_ICON_BASE_NAMES) {
-    const candidates = candidatesByBaseName.get(baseName);
-    if (candidates.length === 0) continue;
-    candidates.sort((a, b) => a.depth - b.depth || a.relPath.localeCompare(b.relPath));
-    return candidates[0].relPath;
-  }
-  return null;
 }
-function readImageFile(repoRoot, relPath) {
-  const target = resolveWithinRepo(repoRoot, relPath);
-  let stat;
-  try {
-    stat = lstatSync(target);
-  } catch {
-    throw new HttpError(404, "Arquivo de logo n\xE3o encontrado.");
+async function reconcileStaleSessions(supabase, config, projectId) {
+  const { data, error } = await supabase.from("sessions").select("id, card_id, cards!card_id!inner(project_id, column_name, assigned_user_id)").eq("cards.project_id", projectId).eq("cards.assigned_user_id", config.ownerUserId).in("status", ["queued", "running", "waiting_input", "paused"]).neq("cards.column_name", "desenvolvimento");
+  if (error) {
+    logger.runner.error("ORCHESTRATOR", `Failed to scan stale sessions for project ${projectId}:`, error.message);
+    return;
   }
-  if (stat.isSymbolicLink()) throw new HttpError(403, "Links simb\xF3licos n\xE3o s\xE3o suportados.");
-  if (!stat.isFile()) throw new HttpError(400, "O caminho configurado n\xE3o \xE9 um arquivo.");
-  if (stat.size > MAX_LOGO_SIZE_BYTES) {
-    throw new HttpError(413, `Arquivo maior que o limite de ${MAX_LOGO_SIZE_BYTES / 1e6}MB.`);
+  const stale = data ?? [];
+  if (stale.length === 0) return;
+  for (const { id: sessionId, card_id: cardId } of stale) {
+    intentionallyStoppedSessionIds.add(sessionId);
+    stopPtySession(sessionId);
+    cancelUsageResume(sessionId);
+    activeSessionByCard.delete(cardId);
+    await updateSession(
+      supabase,
+      sessionId,
+      { status: "done", endedAt: (/* @__PURE__ */ new Date()).toISOString() },
+      { projectId, cardId, userId: config.ownerUserId }
+    );
+    logger.card.info(cardId, `Ended stale session ${sessionId} (its card left "desenvolvimento" while this runner missed the event).`);
   }
-  const ext = relPath.split(".").pop()?.toLowerCase() ?? "";
-  return { buffer: readFileSync4(target), contentType: MIME_TYPES_BY_EXT[ext] ?? "application/octet-stream" };
-}
-function sendJson(res, status, body) {
-  const payload = JSON.stringify(body);
-  res.writeHead(status, {
-    "Content-Type": "application/json; charset=utf-8",
-    // This runner is a trusted process on the user's own machine and the web app is served
-    // from a different origin (e.g. Vercel) — the ticket is the actual security boundary,
-    // so CORS is left wide open rather than trying to keep an allowlist of web origins.
-    "Access-Control-Allow-Origin": "*"
-  });
-  res.end(payload);
-}
-function readRequestBody(req, maxBytes) {
-  return new Promise((resolve5, reject) => {
-    let received = 0;
-    const chunks = [];
-    req.on("data", (chunk) => {
-      received += chunk.length;
-      if (received > maxBytes) {
-        req.destroy();
-        reject(new HttpError(413, "Corpo da requisi\xE7\xE3o excede o limite."));
-        return;
-      }
-      chunks.push(chunk);
-    });
-    req.on("end", () => resolve5(Buffer.concat(chunks).toString("utf8")));
-    req.on("error", reject);
-  });
+  await dispatchRunnerQueue(supabase, config);
 }
-async function handleStatuslineReport(req, res, supabase, config) {
-  let body;
+async function dispatchRunnerQueue(supabase, config) {
+  if (dispatchingRunner) return;
+  dispatchingRunner = true;
   try {
-    const raw = await readRequestBody(req, MAX_STATUSLINE_BODY_BYTES);
-    body = JSON.parse(raw);
-  } catch (err) {
-    const status = err instanceof HttpError ? err.status : 400;
-    sendJson(res, status, { error: "Corpo inv\xE1lido." });
-    return;
+    const queued = await listQueuedSessionsForRunner(supabase, config.ownerUserId);
+    if (queued.length === 0) return;
+    const maxConcurrentProjects = await getRunnerMaxConcurrentProjects(supabase, config.runnerId);
+    const runningProjectIds = /* @__PURE__ */ new Set();
+    for (const project of config.registeredProjects) {
+      const runningCount = await countRunningSessions(supabase, project.id, config.ownerUserId);
+      if (runningCount > 0) runningProjectIds.add(project.id);
+    }
+    let freeProjectSlots = maxConcurrentProjects - runningProjectIds.size;
+    if (freeProjectSlots <= 0) return;
+    const promotedThisPass = /* @__PURE__ */ new Set();
+    for (const entry of queued) {
+      const projectId = entry.cards.project_id;
+      if (runningProjectIds.has(projectId) || promotedThisPass.has(projectId)) continue;
+      if (freeProjectSlots <= 0) break;
+      try {
+        await promoteQueuedSession(supabase, config, entry);
+        promotedThisPass.add(projectId);
+        freeProjectSlots -= 1;
+      } catch (err) {
+        logger.card.error(entry.card_id, `Failed to promote queued session ${entry.id}:`, err);
+      }
+    }
+  } finally {
+    dispatchingRunner = false;
   }
-  if (!body.sessionId || !body.ticket) {
-    sendJson(res, 400, { error: "sessionId e ticket s\xE3o obrigat\xF3rios." });
+}
+async function promoteQueuedSession(supabase, config, entry) {
+  const existingHandle = getPtySession(entry.id);
+  if (existingHandle) {
+    setPtySessionReadOnly(entry.id, false);
+    await updateSession(
+      supabase,
+      entry.id,
+      { status: "running" },
+      { projectId: entry.cards.project_id, cardId: entry.card_id, userId: config.ownerUserId }
+    );
+    activeSessionByCard.set(entry.card_id, entry.id);
+    logger.card.info(entry.card_id, "Resumed paused session from the front of the queue.");
     return;
   }
-  const isMonitor = body.sessionId === usageMonitorSessionId();
-  const ticketValid = isMonitor ? body.ticket === usageMonitorTicket() : getPtySession(body.sessionId)?.ticket === body.ticket;
-  if (!ticketValid) {
-    sendJson(res, 403, { error: "Ticket inv\xE1lido para esta sess\xE3o." });
-    return;
+  const spawned = await spawnSessionPty(supabase, config, entry);
+  if (spawned) logger.card.info(entry.card_id, "Promoted from queue.");
+}
+async function spawnSessionPty(supabase, config, entry) {
+  const { id: sessionId, card_id: cardId, cards: card, claude_session_id: claudeSessionId } = entry;
+  const registered = config.registeredProjects.find((project) => project.id === card.project_id);
+  if (!registered) {
+    logger.card.error(cardId, `Session ${sessionId}: project ${card.project_id} is not registered \u2014 skipping.`);
+    await updateSession(
+      supabase,
+      sessionId,
+      { status: "failed", endedAt: (/* @__PURE__ */ new Date()).toISOString() },
+      { projectId: card.project_id, cardId, userId: config.ownerUserId }
+    );
+    return false;
   }
+  const ticket = randomUUID7();
+  let pty;
+  let newClaudeSessionId = null;
   try {
-    await upsertClaudeUsage(supabase, config.ownerUserId, {
-      ...typeof body.fiveHour?.used_percentage === "number" ? { sessionPercent: body.fiveHour.used_percentage } : {},
-      ...typeof body.fiveHour?.resets_at === "number" ? { sessionResetsAt: new Date(body.fiveHour.resets_at * 1e3).toISOString() } : {},
-      ...typeof body.sevenDay?.used_percentage === "number" ? { weekPercent: body.sevenDay.used_percentage } : {},
-      ...typeof body.sevenDay?.resets_at === "number" ? { weekResetsAt: new Date(body.sevenDay.resets_at * 1e3).toISOString() } : {}
-    });
-    res.writeHead(204, { "Access-Control-Allow-Origin": "*" });
-    res.end();
+    if (claudeSessionId) {
+      pty = resumeAgentPty(registered.repoPath, claudeSessionId, sessionId, ticket);
+    } else {
+      const attachmentPaths = await downloadCardAttachments(supabase, cardId);
+      const instructions = buildInstructionsWithMcpContext(
+        buildInstructionsWithFileReferences(
+          buildInstructionsWithAttachments(card.instructions, attachmentPaths),
+          card.file_references
+        ),
+        cardId,
+        card.project_id
+      );
+      const spawned = spawnAgentPty(registered.repoPath, cardId, card.title, instructions, sessionId, ticket, card.plan_first);
+      pty = spawned.pty;
+      newClaudeSessionId = spawned.claudeSessionId;
+    }
   } catch (err) {
-    logger.runner.error("STATUSLINE", `Failed to persist Claude usage from session ${body.sessionId}:`, err);
-    sendJson(res, 500, { error: "Erro interno do runner." });
+    logger.card.error(cardId, `Failed to spawn pty for session ${sessionId}:`, err);
+    await updateSession(
+      supabase,
+      sessionId,
+      { status: "failed", endedAt: (/* @__PURE__ */ new Date()).toISOString() },
+      { projectId: card.project_id, cardId, userId: config.ownerUserId }
+    );
+    return false;
   }
+  registerPtySession(sessionId, pty, ticket);
+  activeSessionByCard.set(cardId, sessionId);
+  publishAgentStateEvent(card.project_id, cardId, sessionId, newClaudeSessionId ? "starting" : entry.agent_state ?? "starting");
+  const activityWatcher = watchAgentActivity(supabase, config, card.project_id, cardId, sessionId, pty);
+  await updateSession(
+    supabase,
+    sessionId,
+    {
+      status: "running",
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      terminalTicket: ticket,
+      terminalTicketExpiresAt: new Date(Date.now() + TERMINAL_TICKET_TTL_MS).toISOString(),
+      // Only stamp a fresh spawn as "starting" — a resumed session (claudeSessionId was
+      // already set) keeps whatever agent_state it had before the restart (e.g.
+      // "usage_limited"), so reconcileUsageLimitedSessions can find it afterwards. The
+      // freshly (re)constructed AgentActivityWatcher below will correct it the moment real
+      // output gives it something conclusive to classify.
+      ...newClaudeSessionId ? { agentState: "starting", claudeSessionId: newClaudeSessionId } : {}
+    },
+    { projectId: card.project_id, cardId, userId: config.ownerUserId }
+  );
+  pty.onExit(({ exitCode }) => {
+    const wasIntentional = intentionallyStoppedSessionIds.delete(sessionId);
+    logger.card.warn(cardId, `Session exited (code ${exitCode}) \u2014 this only happens if the process crashed or was killed, the card doesn't auto-advance.`);
+    activityWatcher.stop();
+    unregisterAgentActivityWatcher(sessionId);
+    cancelUsageResume(sessionId);
+    activeSessionByCard.delete(cardId);
+    if (!wasIntentional && exitCode !== 0) {
+      publishAgentState(supabase, card.project_id, cardId, sessionId, "error");
+    }
+  });
+  return true;
 }
-async function handleBranchRequest(entry, res, relPath) {
-  let cwd;
-  try {
-    cwd = relPath ? resolveWithinRepo(entry.repoRoot, relPath) : entry.repoRoot;
-  } catch (err) {
-    if (err instanceof HttpError) {
-      sendJson(res, err.status, { error: err.message });
-      return;
+function publishAgentState(supabase, projectId, cardId, sessionId, state) {
+  publishAgentStateEvent(projectId, cardId, sessionId, state);
+  updateSession(supabase, sessionId, { agentState: state }).catch(
+    (err) => logger.card.error(cardId, `Failed to persist agent state "${state}" for session ${sessionId}:`, err)
+  );
+}
+function watchAgentActivity(supabase, config, projectId, cardId, sessionId, pty) {
+  const watcher = new AgentActivityWatcher((state) => {
+    publishAgentState(supabase, projectId, cardId, sessionId, state);
+    if (state === "usage_limited") {
+      scheduleUsageResume(supabase, config, cardId, sessionId, pty);
+    } else {
+      cancelUsageResume(sessionId);
     }
-    throw err;
-  }
-  try {
-    const { stdout } = await execFileAsync2("git", ["branch", "--show-current"], { cwd });
-    sendJson(res, 200, { branch: stdout.trim() });
-  } catch (err) {
-    logger.runner.error("FILES", "Unexpected error handling a branch request:", err);
-    sendJson(res, 500, { error: "Erro interno do runner." });
-  }
+    if (state === "done") void pauseFinishedSession(supabase, config, projectId, cardId, sessionId);
+  });
+  pty.onData((chunk) => watcher.push(chunk));
+  registerAgentActivityWatcher(sessionId, watcher);
+  return watcher;
 }
-function handleRequest(req, res) {
-  if (req.method === "OPTIONS") {
-    res.writeHead(204, { "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Methods": "GET, POST, OPTIONS" });
-    res.end();
-    return;
+async function pauseFinishedSession(supabase, config, projectId, cardId, sessionId) {
+  const paused = await pauseRunningSession(supabase, sessionId, { projectId, cardId, userId: config.ownerUserId });
+  if (!paused) return;
+  setPtySessionReadOnly(sessionId, true);
+  logger.card.info(cardId, `Session ${sessionId} paused (agent reached "done") \u2014 WIP slot freed, pty stays viewable read-only.`);
+  await dispatchRunnerQueue(supabase, config);
+}
+async function requeuePausedCard(supabase, config, card) {
+  const active = await getActiveSessionForCard(supabase, card.id);
+  if (!active || active.status !== "paused") return;
+  await updateSession(
+    supabase,
+    active.id,
+    { status: "queued" },
+    { projectId: card.project_id, cardId: card.id, userId: config.ownerUserId }
+  );
+  await updateCard(supabase, card.id, { requeueRequestedAt: null });
+  logger.card.info(card.id, `Session ${active.id} requeued at the front of the line (was paused).`);
+  await dispatchRunnerQueue(supabase, config);
+}
+async function reconcileOrphanedSessions(supabase, config) {
+  for (const project of config.registeredProjects) {
+    const { data, error } = await supabase.from("sessions").select(
+      "id, card_id, claude_session_id, agent_state, created_at, status, cards!card_id!inner(project_id, assigned_user_id, title, instructions, file_references, plan_first)"
+    ).eq("cards.project_id", project.id).eq("cards.assigned_user_id", config.ownerUserId).in("status", ["running", "paused"]);
+    if (error) {
+      logger.runner.error("ORCHESTRATOR", `Failed to scan orphaned sessions for project ${project.id}:`, error.message);
+      continue;
+    }
+    for (const entry of data ?? []) {
+      let spawned;
+      try {
+        spawned = await spawnSessionPty(supabase, config, entry);
+      } catch (err) {
+        logger.card.error(entry.card_id, `Failed to re-spawn orphaned session ${entry.id}:`, err);
+        continue;
+      }
+      if (!spawned) continue;
+      if (entry.status === "paused") {
+        await updateSession(
+          supabase,
+          entry.id,
+          { status: "paused" },
+          { projectId: project.id, cardId: entry.card_id, userId: config.ownerUserId }
+        );
+        setPtySessionReadOnly(entry.id, true);
+        logger.card.info(entry.card_id, "Re-spawned paused session (runner restarted) \u2014 still read-only until requeued.");
+      } else {
+        logger.card.info(entry.card_id, "Re-spawned orphaned session (runner restarted since it was last running).");
+      }
+    }
   }
-  const { pathname, query } = parse(req.url ?? "", true);
-  if (req.method === "POST" && pathname === "/statusline") {
-    if (!statuslineSupabase || !statuslineConfig) {
-      sendJson(res, 500, { error: "Runner ainda n\xE3o inicializado." });
-      return;
+}
+async function reconcileUsageLimitedSessions(supabase, config) {
+  for (const project of config.registeredProjects) {
+    const { data, error } = await supabase.from("sessions").select("id, card_id, cards!card_id!inner(project_id, assigned_user_id)").eq("cards.project_id", project.id).eq("cards.assigned_user_id", config.ownerUserId).eq("status", "running").eq("agent_state", "usage_limited");
+    if (error) {
+      logger.runner.error("ORCHESTRATOR", `Failed to scan usage-limited sessions for project ${project.id}:`, error.message);
+      continue;
+    }
+    for (const { id: sessionId, card_id: cardId } of data ?? []) {
+      const handle = getPtySession(sessionId);
+      if (!handle) continue;
+      scheduleUsageResume(supabase, config, cardId, sessionId, handle.pty);
     }
-    void handleStatuslineReport(req, res, statuslineSupabase, statuslineConfig);
-    return;
   }
-  if (req.method !== "GET") {
-    sendJson(res, 405, { error: "M\xE9todo n\xE3o suportado." });
+}
+async function stopCardSession(supabase, config, card) {
+  const sessionId = activeSessionByCard.get(card.id) ?? (await getActiveSessionForCard(supabase, card.id))?.id;
+  if (!sessionId) return;
+  intentionallyStoppedSessionIds.add(sessionId);
+  stopPtySession(sessionId);
+  cancelUsageResume(sessionId);
+  activeSessionByCard.delete(card.id);
+  await updateSession(
+    supabase,
+    sessionId,
+    { status: "done", endedAt: (/* @__PURE__ */ new Date()).toISOString() },
+    { projectId: card.project_id, cardId: card.id, userId: config.ownerUserId }
+  );
+  logger.card.info(card.id, `Session ${sessionId} stopped.`);
+  await dispatchRunnerQueue(supabase, config);
+}
+
+// src/deploy.ts
+async function handleDeployRequested(supabase, config, project) {
+  const registered = config.registeredProjects.find((candidate) => candidate.id === project.id);
+  if (!registered) {
+    logger.runner.warn("DEPLOY", `Ignoring deploy request: project ${project.id} is not registered on this runner.`);
     return;
   }
-  const relPath = typeof query.path === "string" ? query.path : "";
-  if (pathname === "/browse") {
-    const setupEntry = authenticateSetup(query);
-    if (!setupEntry) {
-      sendJson(res, 401, { error: "Ticket inv\xE1lido, expirado, ou navega\xE7\xE3o de pastas desativada." });
-      return;
-    }
-    try {
-      sendJson(res, 200, { entries: listDirectoryForBrowse(setupEntry.rootPath, relPath) });
-    } catch (err) {
-      if (err instanceof HttpError) {
-        sendJson(res, err.status, { error: err.message });
-        return;
-      }
-      logger.runner.error("FILES", "Unexpected error handling a browse request:", err);
-      sendJson(res, 500, { error: "Erro interno do runner." });
-    }
+  const allCards = await listCardsInColumn(supabase, project.id, "deploy");
+  const cards = allCards.filter((card) => card.assigned_user_id === config.ownerUserId);
+  if (cards.length === 0) {
+    logger.runner.info("DEPLOY", `Deploy requested for project ${project.id} but no cards assigned to this runner's user are waiting in "deploy".`);
+    await clearProjectDeployRequest(supabase, project.id);
     return;
   }
-  if (pathname === "/global-agent-tree" || pathname === "/global-agent-file") {
-    const agentEntry = authenticateAgent(query);
-    if (!agentEntry) {
-      sendJson(res, 401, { error: "Ticket inv\xE1lido ou expirado." });
-      return;
-    }
-    try {
-      if (pathname === "/global-agent-tree") {
-        sendJson(res, 200, { entries: listSafeAgentDirectory(agentEntry.repoRoot, relPath, true) });
-      } else {
-        assertSafeAgentPath(relPath, true);
-        sendJson(res, 200, readTextFile(agentEntry.repoRoot, relPath));
-      }
-    } catch (err) {
-      if (err instanceof HttpError) {
-        sendJson(res, err.status, { error: err.message });
-        return;
-      }
-      logger.runner.error("FILES", "Unexpected error handling a global agent request:", err);
-      sendJson(res, 500, { error: "Erro interno do runner." });
+  const children = await getProjectRepos(supabase, project.id);
+  const repoRoot = resolveRepoPath(config, project.repo_path);
+  const targets = children.length > 0 ? children.map((child2) => ({ label: child2.subpath, path: join12(repoRoot, child2.subpath) })) : [{ label: null, path: repoRoot }];
+  const failures = [];
+  for (const target of targets) {
+    const result = await pushBranchToMain(target.path);
+    if (result.ok) {
+      logger.runner.info("DEPLOY", target.label ? `Pushed HEAD to main in "${target.label}".` : "Pushed HEAD to main.");
+    } else {
+      logger.runner.error("DEPLOY", target.label ? `Push to main failed in "${target.label}": ${result.error}` : `Push to main failed: ${result.error}`);
+      failures.push(target.label ? `${target.label}: ${result.error}` : result.error);
     }
-    return;
   }
-  const entry = authenticate(query);
-  if (!entry) {
-    sendJson(res, 401, { error: "Ticket inv\xE1lido, expirado, ou projeto desconhecido." });
+  if (failures.length > 0) {
+    const message = failures.join("; ");
+    await Promise.all(cards.map((card) => updateCard(supabase, card.id, { deployError: message })));
+    await clearProjectDeployRequest(supabase, project.id);
     return;
   }
-  if (pathname === "/branch") {
-    void handleBranchRequest(entry, res, relPath);
+  const columnActionResult = await runAfterColumnActions(project, children, repoRoot, "deploy");
+  if (!columnActionResult.ok) {
+    logger.runner.error("DEPLOY", `Deploy column action failed for project ${project.id}: ${columnActionResult.error}`);
+    await Promise.all(cards.map((card) => updateCard(supabase, card.id, { deployError: columnActionResult.error })));
+    await clearProjectDeployRequest(supabase, project.id);
     return;
   }
-  try {
-    if (pathname === "/tree") {
-      sendJson(res, 200, { entries: listDirectory(entry.repoRoot, relPath) });
-      return;
-    }
-    if (pathname === "/file") {
-      sendJson(res, 200, readTextFile(entry.repoRoot, relPath));
-      return;
-    }
-    if (pathname === "/agent-tree") {
-      sendJson(res, 200, { entries: listSafeAgentDirectory(entry.repoRoot, relPath, false) });
-      return;
-    }
-    if (pathname === "/agent-file") {
-      assertSafeAgentPath(relPath, false);
-      sendJson(res, 200, readTextFile(entry.repoRoot, relPath));
-      return;
-    }
-    if (pathname === "/logo") {
-      if (!relPath) throw new HttpError(404, "Nenhuma logo configurada para este projeto.");
-      const { buffer, contentType } = readImageFile(entry.repoRoot, relPath);
-      res.writeHead(200, {
-        "Content-Type": contentType,
-        "Content-Length": buffer.length,
-        "Cache-Control": "no-cache",
-        "Access-Control-Allow-Origin": "*"
-      });
-      res.end(buffer);
-      return;
-    }
-    if (pathname === "/shell/open") {
-      sendJson(res, 200, openShellSession(entry.repoRoot));
-      return;
-    }
-    sendJson(res, 404, { error: "Rota desconhecida." });
-  } catch (err) {
-    if (err instanceof HttpError) {
-      sendJson(res, err.status, { error: err.message });
-      return;
+  await Promise.all(cards.map((card) => updateCard(supabase, card.id, { deployError: null, column: "fim" })));
+  await clearProjectDeployRequest(supabase, project.id);
+}
+async function checkPendingDeploys(supabase, config) {
+  for (const registered of config.registeredProjects) {
+    const project = await getProject(supabase, registered.id);
+    if (project.deploy_requested_at) {
+      await handleDeployRequested(supabase, config, project);
     }
-    logger.runner.error("FILES", "Unexpected error handling a files request:", err);
-    sendJson(res, 500, { error: "Erro interno do runner." });
   }
 }
-function attachFilesServer(httpServer, supabase, config) {
-  statuslineSupabase = supabase;
-  statuslineConfig = config;
-  httpServer.on("request", handleRequest);
-  logger.runner.info("FILES", "Files HTTP handler attached.");
+async function handleCardReachedFim(supabase, config, card) {
+  await stopCardSession(supabase, config, card);
+  releaseCard(card.id);
+  logger.card.info(card.id, 'Reached "fim" \u2014 session stopped, preview tunnel (if any) closed.');
 }
 
 // src/repoValidation.ts
@@ -1978,7 +3143,7 @@ async function syncRegisteredProjects(supabase, config, registeredPaths) {
 }
 
 // src/review.ts
-import { join as join9 } from "node:path";
+import { join as join13 } from "node:path";
 var inFlightCardIds2 = /* @__PURE__ */ new Set();
 async function handleCardEnteredRevisao(supabase, config, card) {
   if (inFlightCardIds2.has(card.id)) return;
@@ -1987,7 +3152,7 @@ async function handleCardEnteredRevisao(supabase, config, card) {
     const project = await getProject(supabase, card.project_id);
     const children = await getProjectRepos(supabase, project.id);
     const repoRoot = resolveRepoPath(config, project.repo_path);
-    const targets = children.length > 0 ? children.filter((child2) => child2.dev_command).map((child2) => ({ label: child2.subpath, cwd: join9(repoRoot, child2.subpath), command: child2.dev_command })) : project.dev_command ? [{ label: "", cwd: repoRoot, command: project.dev_command }] : [];
+    const targets = children.length > 0 ? children.filter((child2) => child2.dev_command).map((child2) => ({ label: child2.subpath, cwd: join13(repoRoot, child2.subpath), command: child2.dev_command })) : project.dev_command ? [{ label: "", cwd: repoRoot, command: project.dev_command }] : [];
     if (targets.length === 0) {
       logger.card.info(card.id, `No dev_command configured for project ${project.id}, skipping automatic preview.`);
       return;
@@ -2045,12 +3210,14 @@ async function checkPendingDevServerRestarts(supabase, config) {
 }
 
 // src/terminalServer.ts
-import { parse as parse2 } from "node:url";
-import { WebSocketServer } from "ws";
-function attachTerminalServer(httpServer) {
-  const wss = new WebSocketServer({ server: httpServer });
+import { parse as parse3 } from "node:url";
+import { WebSocketServer as WebSocketServer2 } from "ws";
+var FRAME_TYPE_RESIZE = 0;
+var FRAME_TYPE_IMAGE = 1;
+function attachTerminalServer() {
+  const wss = new WebSocketServer2({ noServer: true });
   wss.on("connection", (socket, request) => {
-    const { query } = parse2(request.url ?? "", true);
+    const { query } = parse3(request.url ?? "", true);
     const sessionId = typeof query.sessionId === "string" ? query.sessionId : null;
     const ticket = typeof query.ticket === "string" ? query.ticket : null;
     if (!sessionId || !ticket) {
@@ -2068,14 +3235,28 @@ function attachTerminalServer(httpServer) {
     for (const chunk of handle.outputBuffer) socket.send(chunk);
     socket.on("message", (data, isBinary) => {
       if (isBinary) {
-        try {
-          const { cols, rows } = JSON.parse(data.toString("utf8"));
-          if (typeof cols === "number" && typeof rows === "number") resizePtySession(sessionId, cols, rows);
-        } catch (err) {
-          logger.runner.warn("TERMINAL", `Terminal WS: ignoring malformed resize frame for session ${sessionId}:`, err);
+        const buffer = data;
+        const frameType = buffer[0];
+        if (frameType === FRAME_TYPE_IMAGE) {
+          if (handle.readOnly) return;
+          const extCode = buffer[1];
+          const bytes = buffer.subarray(2);
+          savePastedImage(sessionId, extCode, bytes).then((path) => handle.pty.write(`${path} `)).catch((err) => logger.runner.warn("TERMINAL", `Terminal WS: failed to save pasted image for session ${sessionId}:`, err));
+          return;
+        }
+        if (frameType === FRAME_TYPE_RESIZE) {
+          try {
+            const { cols, rows } = JSON.parse(buffer.subarray(1).toString("utf8"));
+            if (typeof cols === "number" && typeof rows === "number") resizePtySession(sessionId, cols, rows);
+          } catch (err) {
+            logger.runner.warn("TERMINAL", `Terminal WS: ignoring malformed resize frame for session ${sessionId}:`, err);
+          }
+          return;
         }
+        logger.runner.warn("TERMINAL", `Terminal WS: ignoring binary frame with unknown type ${frameType} for session ${sessionId}.`);
         return;
       }
+      if (handle.readOnly) return;
       handle.pty.write(data.toString());
     });
     socket.on("close", () => {
@@ -2083,6 +3264,7 @@ function attachTerminalServer(httpServer) {
     });
   });
   logger.runner.info("TERMINAL", "Terminal WebSocket handler attached.");
+  return wss;
 }
 
 // src/terminalTunnel.ts
@@ -2157,6 +3339,16 @@ async function startRunner() {
   }
   config.ownerUserId = session.user.id;
   await supabase.auth.startAutoRefresh();
+  supabase.auth.onAuthStateChange((event) => {
+    logger.runner.info("AUTH", `Session state changed: ${event}.`);
+    if (event === "SIGNED_OUT") {
+      logger.runner.error(
+        "AUTH",
+        'Supabase session was lost (refresh failed or was revoked) \u2014 every write from now on will fail row-level security checks. Run "agent-board-runner login" again and restart the runner.'
+      );
+      process.exit(1);
+    }
+  });
   const { error: linkError } = await supabase.rpc("link_my_membership");
   if (linkError) {
     logger.runner.error("BOOT", "Failed to link pending project invites:", linkError);
@@ -2176,13 +3368,16 @@ async function startRunner() {
     id: config.runnerId,
     user_id: config.ownerUserId,
     name: config.runnerName,
-    auth_token_hash: config.authToken
+    auth_token_hash: config.authToken,
+    version: RUNNER_VERSION
   });
   if (runnerError) {
     logger.runner.error("BOOT", "Failed to upsert this runner's row in Supabase:", runnerError);
     process.exit(1);
   }
   const registeredPaths = new Set(config.registeredProjects.map((project) => project.id));
+  const lastKnownColumn = /* @__PURE__ */ new Map();
+  const lastKnownRequeueRequestedAt = /* @__PURE__ */ new Map();
   await syncRegisteredProjects(supabase, config, registeredPaths).catch((err) => logger.runner.error("PROJECT_SYNC", "syncRegisteredProjects failed:", err));
   logger.runner.info("BOOT", `Agent Board runner "${config.runnerName}" starting (${registeredPaths.size} project(s) registered).`);
   for (const project of config.registeredProjects) {
@@ -2192,9 +3387,22 @@ async function startRunner() {
   await reconcileUsageLimitedSessions(supabase, config).catch((err) => logger.runner.error("ORCHESTRATOR", "reconcileUsageLimitedSessions failed:", err));
   const terminalPort = Number(process.env.AGENT_BOARD_TERMINAL_PORT ?? 8787);
   ensureStatuslineScriptWritten();
+  ensureSafetyHookScriptWritten();
+  ensureAgentMomentHookScriptWritten();
   const httpServer = createServer2();
-  attachTerminalServer(httpServer);
+  const terminalWss = attachTerminalServer();
+  const agentEventsWss = attachAgentEventsServer();
   attachFilesServer(httpServer, supabase, config);
+  httpServer.on("upgrade", (request, socket, head) => {
+    const pathname = (request.url ?? "").split("?")[0];
+    if (pathname === "/terminal") {
+      terminalWss.handleUpgrade(request, socket, head, (ws) => terminalWss.emit("connection", ws, request));
+    } else if (pathname === "/agent-events") {
+      agentEventsWss.handleUpgrade(request, socket, head, (ws) => agentEventsWss.emit("connection", ws, request));
+    } else {
+      socket.destroy();
+    }
+  });
   let httpServerReady = false;
   let realtimeReady = false;
   function logRunnerReadyOnceBothUp() {
@@ -2212,16 +3420,28 @@ async function startRunner() {
   void ensureFilesTickets(supabase, config).catch((err) => logger.runner.error("FILES", "ensureFilesTickets failed:", err));
   void ensureSetupTicket(supabase, config).catch((err) => logger.runner.error("FILES", "ensureSetupTicket failed:", err));
   void ensureAgentTicket(supabase, config).catch((err) => logger.runner.error("FILES", "ensureAgentTicket failed:", err));
+  const presenceChannel = supabase.channel(`runner-presence:${config.runnerId}`);
+  presenceChannel.subscribe((status) => {
+    if (status === "SUBSCRIBED") {
+      void presenceChannel.track({ online: true, version: RUNNER_VERSION });
+    }
+  });
   let shuttingDown = false;
   for (const signal of ["SIGINT", "SIGTERM"]) {
     process.on(signal, () => {
       if (shuttingDown) return;
       shuttingDown = true;
       stopAll();
+      void presenceChannel.untrack();
       void stopTerminalTunnel(supabase, config).finally(() => process.exit(0));
     });
   }
+  const HEARTBEAT_WRITE_INTERVAL_MS = 5 * 6e4;
+  let lastHeartbeatWriteAt = 0;
   async function heartbeat() {
+    const now = Date.now();
+    if (now - lastHeartbeatWriteAt < HEARTBEAT_WRITE_INTERVAL_MS) return;
+    lastHeartbeatWriteAt = now;
     await supabase.from("runners").update({ last_heartbeat_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", config.runnerId);
   }
   supabase.channel(`runner:${config.runnerId}`).on(
@@ -2229,24 +3449,34 @@ async function startRunner() {
     { event: "UPDATE", schema: "agent_board", table: "cards" },
     (payload) => {
       const card = payload.new;
-      const previous = payload.old;
       if (!registeredPaths.has(card.project_id)) return;
       if (card.assigned_user_id !== config.ownerUserId) return;
+      const previousColumn = lastKnownColumn.get(card.id);
+      lastKnownColumn.set(card.id, card.column_name);
       if (card.column_name === "desenvolvimento") {
         void enqueueCard(supabase, config, card);
       }
-      if (previous.column_name === "desenvolvimento" && card.column_name !== "desenvolvimento") {
+      if (previousColumn === "desenvolvimento" && card.column_name !== "desenvolvimento") {
         void stopCardSession(supabase, config, card);
       }
-      if (card.column_name === "revisao" && previous.column_name !== "revisao") {
+      if (card.column_name === "revisao" && previousColumn !== "revisao") {
         void handleCardEnteredRevisao(supabase, config, card);
       }
-      if (previous.column_name === "revisao" && card.column_name !== "revisao") {
+      if (previousColumn === "revisao" && card.column_name !== "revisao") {
         releaseCard(card.id);
       }
-      if (card.column_name === "fim" && previous.column_name !== "fim") {
+      if (card.column_name === "fim" && previousColumn !== "fim") {
         void handleCardReachedFim(supabase, config, card);
       }
+      const previousRequeueRequestedAt = lastKnownRequeueRequestedAt.get(card.id);
+      lastKnownRequeueRequestedAt.set(card.id, card.requeue_requested_at);
+      if (card.requeue_requested_at && card.requeue_requested_at !== previousRequeueRequestedAt) {
+        void requeuePausedCard(supabase, config, card);
+      }
+      if (previousColumn !== void 0 && previousColumn !== card.column_name) {
+        void clearColumnActionStatus(supabase, card);
+        void handleColumnEntered(supabase, config, card);
+      }
     }
   ).on(
     "postgres_changes",
@@ -2261,6 +3491,9 @@ async function startRunner() {
       if (project.dev_server_restart_requested_at && project.dev_server_restart_requested_at !== previous.dev_server_restart_requested_at) {
         void handleDevServerRestartRequested(supabase, config, project);
       }
+      if (project.deploy_action_rerun_requested_at && project.deploy_action_rerun_requested_at !== previous.deploy_action_rerun_requested_at) {
+        void handleDeployActionRerunRequested(supabase, config, project);
+      }
     }
   ).subscribe((status) => {
     if (status === "SUBSCRIBED") {
@@ -2283,6 +3516,8 @@ async function startRunner() {
     await checkPendingDeploys(supabase, config).catch((err) => logger.runner.error("DEPLOY", "checkPendingDeploys failed:", err));
     await checkPendingPreviews(supabase, config).catch((err) => logger.runner.error("REVIEW", "checkPendingPreviews failed:", err));
     await checkPendingDevServerRestarts(supabase, config).catch((err) => logger.runner.error("REVIEW", "checkPendingDevServerRestarts failed:", err));
+    await checkPendingColumnActions(supabase, config).catch((err) => logger.runner.error("COLUMN_ACTION", "checkPendingColumnActions failed:", err));
+    await checkPendingDeployActionReruns(supabase, config).catch((err) => logger.runner.error("COLUMN_ACTION", "checkPendingDeployActionReruns failed:", err));
   }
   void tick();
   setInterval(() => void tick(), 6e4);