agent-tempo 1.0.1

package/dist/cli/commands.js

@@ -0,0 +1,2438 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.status = status;
+exports.init = init;
+exports.server = server;
+exports.up = up;
+exports.formatScheduleRecurrence = formatScheduleRecurrence;
+exports.lineupScheduleToEntry = lineupScheduleToEntry;
+exports.stopTemporalServer = stopTemporalServer;
+exports.down = down;
+exports.agentTypesCommand = agentTypesCommand;
+exports.broadcast = broadcast;
+exports.verbClient = verbClient;
+exports.destroy = destroy;
+exports.attachmentInfo = attachmentInfo;
+exports.hosts = hosts;
+exports.refreshHostProfile = refreshHostProfile;
+exports.recall = recall;
+exports.restore = restore;
+exports.ensembleCommand = ensembleCommand;
+exports.release = release;
+const readline = __importStar(require("readline"));
+const fs_1 = require("fs");
+const path_1 = require("path");
+const child_process_1 = require("child_process");
+const os_1 = require("os");
+const crypto_1 = require("crypto");
+const croner_1 = require("croner");
+const client_1 = require("@temporalio/client");
+const spawn_1 = require("../spawn");
+const config_1 = require("../config");
+const git_info_1 = require("../git-info");
+const connection_1 = require("../connection");
+const signals_1 = require("../workflows/signals");
+const scheduler_signals_1 = require("../workflows/scheduler-signals");
+const maestro_signals_1 = require("../workflows/maestro-signals");
+const duration_1 = require("../utils/duration");
+const attachment_format_1 = require("../utils/attachment-format");
+const default_part_1 = require("../utils/default-part");
+const preflight_1 = require("./preflight");
+const mcp_1 = require("./mcp");
+const loader_1 = require("../ensemble/loader");
+const saver_1 = require("../ensemble/saver");
+const agent_types_1 = require("../ensemble/agent-types");
+const validation_1 = require("../utils/validation");
+const search_attributes_1 = require("../utils/search-attributes");
+const daemon_1 = require("./daemon");
+const client_2 = require("../client");
+const constants_1 = require("../constants");
+const recall_format_1 = require("../utils/recall-format");
+const out = __importStar(require("./output"));
+/** Package root is two levels up from dist/cli/ */
+const PACKAGE_ROOT = (0, path_1.resolve)(__dirname, '..', '..');
+/**
+ * Ensure the Maestro workflow is running for the given ensemble.
+ * Idempotent — uses USE_EXISTING conflict policy.
+ */
+async function ensureMaestroWorkflow(client, config, ensemble) {
+    const wfId = (0, config_1.maestroWorkflowId)(ensemble);
+    try {
+        await client.workflow.start('agentMaestroWorkflow', {
+            workflowId: wfId,
+            taskQueue: config.taskQueue,
+            args: [{ ensemble }],
+            workflowIdConflictPolicy: client_1.WorkflowIdConflictPolicy.USE_EXISTING,
+            searchAttributes: {
+                AgentTempoEnsemble: [ensemble],
+            },
+        });
+    }
+    catch {
+        // Maestro is non-critical — log but don't fail
+    }
+}
+/**
+ * Resolve a conductor's session name. MUST equal both the spawned process's
+ * `ENV.PLAYER_NAME` and the workflow metadata's `playerId` — a mismatch
+ * confuses `who_am_i`, reports, and operator-run `restart`/`detach` by name
+ * (issue #172).
+ */
+function resolveConductorName(opts, lineup) {
+    if (lineup) {
+        return opts.name
+            || lineup.conductor?.name
+            || (opts.agent === 'copilot' ? `${opts.ensemble}-conductor` : 'conductor');
+    }
+    // No lineup: preserve legacy `copilot-${Date.now()}` for ad-hoc copilot
+    // conductors (changing that is out of scope for #172).
+    return opts.name || (opts.agent === 'copilot' ? `copilot-${Date.now()}` : 'conductor');
+}
+/** Resolve a player's session name. Returns undefined for claude, where
+ *  Claude Code auto-assigns on spawn. */
+function resolvePlayerName(opts) {
+    return opts.name || (opts.agent === 'copilot' ? `copilot-${Date.now()}` : undefined);
+}
+/**
+ * Issue #172 (v0.26): pre-create the conductor workflow, optionally with
+ * lineup-seeded `messages[]`. MUST run BEFORE the conductor process spawns
+ * — otherwise `USE_EXISTING` silently drops the seeded input if the spawned
+ * Claude Code MCP client registers the workflow first.
+ *
+ * Seeded messages (only when `lineup` is provided):
+ *   1. lineup instructions (`from: 'lineup'`) — role/phase/convention brief
+ *   2. banner + "wait for user, call `resume_ensemble` first" directive
+ *      (`from: 'system'`), only on `initialStartup: true`
+ *
+ * When `lineup` is undefined (plain `up` / `conduct`), the workflow is still
+ * pre-created with empty seeded messages — this matches the prior inline
+ * behavior that held signals safely before the Claude Code MCP client
+ * connected.
+ */
+async function seedConductorWorkflow(args) {
+    const { client, config, ensemble, lineup, initialStartup, conductorName } = args;
+    const conductorWfId = (0, config_1.conductorWorkflowId)(ensemble);
+    const { gitRoot: conductorGitRoot, gitBranch: conductorGitBranch } = (0, git_info_1.getGitInfo)(process.cwd());
+    const conductorSessionId = (0, crypto_1.randomUUID)();
+    const resolvedConductorType = lineup?.conductor?.type ? (0, agent_types_1.resolveAgentType)(lineup.conductor.type) : null;
+    // Issue #172 follow-up: seed the `from: 'system'` directive BEFORE the
+    // lineup's role/phase brief. Earlier messages carry more weight with the
+    // LLM — putting the "call resume_ensemble + release FIRST" framing ahead
+    // of the lineup instructions reduces the chance the model skims past it
+    // and broadcasts directly.
+    const seededMessages = [];
+    if (initialStartup && lineup) {
+        seededMessages.push({
+            id: (0, crypto_1.randomUUID)(),
+            from: 'system',
+            text: (0, constants_1.ensembleReadyDirective)(lineup.name, lineup.players.length),
+            timestamp: new Date().toISOString(),
+            delivered: false,
+        });
+    }
+    if (lineup?.conductor?.instructions) {
+        seededMessages.push({
+            id: (0, crypto_1.randomUUID)(),
+            from: 'lineup',
+            text: lineup.conductor.instructions,
+            timestamp: new Date().toISOString(),
+            delivered: false,
+        });
+    }
+    const conductorInput = {
+        metadata: {
+            playerId: conductorName,
+            ensemble,
+            hostname: (0, os_1.hostname)(),
+            workDir: process.cwd(),
+            gitRoot: conductorGitRoot,
+            gitBranch: conductorGitBranch,
+            isConductor: true,
+            agentType: args.conductorAgent,
+            sessionId: conductorSessionId,
+            ...(resolvedConductorType ? { playerType: resolvedConductorType.name, playerTypeDescription: resolvedConductorType.description || '' } : {}),
+        },
+        // Issue #450 — derive default `part` from the resolved player type so
+        // a typed conductor reads as `'<Role> session'` (still falls back to
+        // `'Conductor session'` when no type is resolved).
+        autoSummary: (0, default_part_1.defaultPart)({
+            playerType: resolvedConductorType?.name,
+            isConductor: true,
+            workDir: process.cwd(),
+            adapterType: args.conductorAgent,
+        }),
+        disableStaleDetection: true,
+        temporalConfig: {
+            temporalAddress: config.temporalAddress,
+            temporalNamespace: config.temporalNamespace,
+            taskQueue: config.taskQueue,
+        },
+        ...(seededMessages.length > 0 ? { messages: seededMessages } : {}),
+    };
+    await client.workflow.start('agentSessionWorkflow', {
+        workflowId: conductorWfId,
+        taskQueue: config.taskQueue,
+        args: [conductorInput],
+        workflowIdConflictPolicy: client_1.WorkflowIdConflictPolicy.USE_EXISTING,
+        searchAttributes: {
+            ...(conductorGitRoot ? { AgentTempoGitRoot: [conductorGitRoot] } : {}),
+            AgentTempoHostname: [(0, os_1.hostname)()],
+            AgentTempoEnsemble: [ensemble],
+            AgentTempoPlayerId: [conductorName],
+        },
+    });
+}
+/**
+ * Issue #172 (v0.26): pre-create player workflows (warm hold on initial
+ * startup), spawn their processes, create scheduled entries, and pause the
+ * whole ensemble. Called AFTER the conductor spawn so the conductor tab
+ * opens first. Does NOT pre-create the conductor workflow — that must
+ * already exist (via `seedConductorWorkflow`).
+ */
+async function applyLineupPlayersAndSchedules(args) {
+    const { client, config, ensemble, lineup, initialStartup, conductorName } = args;
+    // Pre-create and spawn players.
+    if (lineup.players.length > 0) {
+        console.log();
+        out.log(`Recruiting ${lineup.players.length} player${lineup.players.length !== 1 ? 's' : ''} from lineup...`);
+    }
+    for (const player of lineup.players) {
+        // ADR 0014 §4 — `agent: "mock"` is dev-only. Reject up-front rather than
+        // letting the spawn fail downstream so operators get a clear hint.
+        if (player.agent === 'mock' && !(0, config_1.isDevMode)()) {
+            out.warn(`Skipping player "${player.name}" — agent: "mock" requires dev mode. ` +
+                `Re-run with --dev to enable.`);
+            continue;
+        }
+        const playerAgent = player.agent === 'copilot' ? 'copilot' :
+            player.agent === 'claude' ? 'claude' :
+                player.agent === 'mock' ? 'mock' :
+                    args.conductorAgent;
+        const playerWorkDir = player.workDir || process.cwd();
+        const resolvedPlayerType = player.type ? (0, agent_types_1.resolveAgentType)(player.type) : null;
+        const playerSessionId = (0, crypto_1.randomUUID)();
+        const playerWfId = (0, config_1.sessionWorkflowId)(ensemble, player.name);
+        const { gitRoot: playerGitRoot, gitBranch: playerGitBranch } = (0, git_info_1.getGitInfo)(playerWorkDir);
+        const playerInput = {
+            metadata: {
+                playerId: player.name,
+                ensemble,
+                hostname: (0, os_1.hostname)(),
+                workDir: playerWorkDir,
+                gitRoot: playerGitRoot,
+                gitBranch: playerGitBranch,
+                isConductor: false,
+                agentType: playerAgent,
+                sessionId: playerSessionId,
+                recruitedBy: conductorName,
+                ...(resolvedPlayerType ? { playerType: resolvedPlayerType.name, playerTypeDescription: resolvedPlayerType.description || '' } : {}),
+            },
+            // Issue #450 — derive default `part` from the resolved player type
+            // so a freshly recruited lineup player reads as e.g.
+            // `'Engineer session'` instead of the role-agnostic
+            // `'Session in <basename>'` placeholder.
+            autoSummary: (0, default_part_1.defaultPart)({
+                playerType: resolvedPlayerType?.name,
+                isConductor: false,
+                workDir: (0, path_1.resolve)(playerWorkDir),
+                adapterType: playerAgent,
+            }),
+            disableStaleDetection: true,
+            temporalConfig: {
+                temporalAddress: config.temporalAddress,
+                temporalNamespace: config.temporalNamespace,
+                taskQueue: config.taskQueue,
+            },
+            ...(initialStartup
+                ? {
+                    outboxLocked: true,
+                    ...(player.instructions ? { heldMessage: player.instructions } : {}),
+                }
+                : (player.instructions ? {
+                    messages: [{
+                            id: (0, crypto_1.randomUUID)(),
+                            from: 'lineup',
+                            text: player.instructions,
+                            timestamp: new Date().toISOString(),
+                            delivered: false,
+                        }],
+                } : {})),
+        };
+        try {
+            await client.workflow.start('agentSessionWorkflow', {
+                workflowId: playerWfId,
+                taskQueue: config.taskQueue,
+                args: [playerInput],
+                workflowIdConflictPolicy: client_1.WorkflowIdConflictPolicy.USE_EXISTING,
+                searchAttributes: {
+                    ...(playerGitRoot ? { AgentTempoGitRoot: [playerGitRoot] } : {}),
+                    AgentTempoHostname: [(0, os_1.hostname)()],
+                    AgentTempoEnsemble: [ensemble],
+                    AgentTempoPlayerId: [player.name],
+                },
+            });
+        }
+        catch (err) {
+            out.warn(`Could not pre-create workflow for "${player.name}": ${err}`);
+            continue;
+        }
+        // Spawn the player process.
+        try {
+            if (playerAgent === 'mock') {
+                // PR-3 — `--scenario` CLI override wins over per-player lineup
+                // `mockScenario`. Forces `mockMode: scripted` because that's the
+                // only mode that consumes a scenario. Per-player `mockMode` (silent /
+                // chaos / echo) is preserved when no override is set.
+                const effectiveMode = args.scenarioOverride ? 'scripted' : (player.mockMode ?? 'echo');
+                const effectiveScenario = args.scenarioOverride ?? player.mockScenario;
+                (0, spawn_1.spawnMockAdapter)({
+                    name: player.name,
+                    ensemble,
+                    temporalAddress: config.temporalAddress,
+                    temporalNamespace: config.temporalNamespace,
+                    temporalApiKey: config.temporalApiKey,
+                    temporalTlsCertPath: config.temporalTlsCertPath,
+                    temporalTlsKeyPath: config.temporalTlsKeyPath,
+                    isConductor: false,
+                    workDir: playerWorkDir,
+                    mockMode: effectiveMode,
+                    ...(effectiveScenario ? { mockScenario: effectiveScenario } : {}),
+                });
+            }
+            else if (playerAgent === 'copilot') {
+                (0, spawn_1.spawnCopilotBridge)({
+                    name: player.name,
+                    ensemble,
+                    temporalAddress: config.temporalAddress,
+                    temporalNamespace: config.temporalNamespace,
+                    temporalApiKey: config.temporalApiKey,
+                    temporalTlsCertPath: config.temporalTlsCertPath,
+                    temporalTlsKeyPath: config.temporalTlsKeyPath,
+                    isConductor: false,
+                    workDir: playerWorkDir,
+                });
+            }
+            else {
+                const claudeArgs = [
+                    '--dangerously-skip-permissions',
+                    '--dangerously-load-development-channels', 'server:agent-tempo',
+                    // ENSEMBLE_SENTINEL_FLAG carries the ensemble name into the spawned
+                    // claude.exe's CommandLine so hard-terminate can scope `destroy --all`
+                    // kills by ensemble (#180, #259). Mirrors src/activities/outbox.ts.
+                    constants_1.ENSEMBLE_SENTINEL_FLAG, ensemble,
+                    '-n', player.name,
+                    ...(resolvedPlayerType?.nativeResolvable ? ['--agent', resolvedPlayerType.name] :
+                        resolvedPlayerType ? ['--system-prompt', resolvedPlayerType.path] : []),
+                ];
+                const playerEnvVars = {
+                    ...args.temporalEnvVars,
+                    [config_1.ENV.ENSEMBLE]: ensemble,
+                    [config_1.ENV.CONDUCTOR]: '',
+                    [config_1.ENV.PLAYER_NAME]: player.name,
+                };
+                if (resolvedPlayerType) {
+                    playerEnvVars[config_1.ENV.PLAYER_TYPE] = resolvedPlayerType.name;
+                }
+                (0, spawn_1.spawnInTerminal)(claudeArgs, playerWorkDir, playerEnvVars, { claudeBin: config.claudeBin });
+            }
+            out.log(`  ${out.green('ok')} ${out.bold(player.name)} in ${playerWorkDir}`);
+        }
+        catch (err) {
+            out.warn(`Could not spawn "${player.name}": ${err}`);
+        }
+    }
+    // Create schedules (independent of hold state).
+    if (lineup.schedules && lineup.schedules.length > 0) {
+        console.log();
+        out.log(`Creating ${lineup.schedules.length} schedule${lineup.schedules.length !== 1 ? 's' : ''}...`);
+        for (const sched of lineup.schedules) {
+            try {
+                const entry = lineupScheduleToEntry(sched);
+                const schedulerWfId = (0, config_1.schedulerWorkflowId)(ensemble);
+                try {
+                    const handle = client.workflow.getHandle(schedulerWfId);
+                    await handle.describe();
+                    await handle.signal(scheduler_signals_1.addScheduleSignal, entry);
+                }
+                catch {
+                    await client.workflow.start('agentSchedulerWorkflow', {
+                        workflowId: schedulerWfId,
+                        taskQueue: config.taskQueue,
+                        args: [{ ensemble, entries: [entry] }],
+                        workflowIdConflictPolicy: client_1.WorkflowIdConflictPolicy.USE_EXISTING,
+                        searchAttributes: {
+                            AgentTempoEnsemble: [ensemble],
+                        },
+                    });
+                }
+                out.check(sched.name, true, `→ ${sched.target}`);
+            }
+            catch (err) {
+                out.warn(`Could not create schedule "${sched.name}": ${err}`);
+            }
+        }
+    }
+    // Issue #172 (v0.26): on initial-startup, pause the whole ensemble so the
+    // scheduler, per-session outbox dispatch, and maestro all stay quiet while
+    // we wait for the user's first message. The system directive baked into
+    // the conductor's messages[] tells the LLM to call `resume_ensemble` before
+    // taking any action once the user speaks.
+    if (initialStartup) {
+        await setPausedState(client, ensemble, true);
+    }
+}
+/**
+ * #288: no longer exported — the `start`/`conduct` CLI verbs were removed.
+ * Still invoked internally by `up()` for its post-provisioning conductor +
+ * player spawn. Slice 7 will replace this internal usage with the new
+ * auto-provision flow, after which this function can be deleted outright.
+ */
+async function start(opts) {
+    const config = (0, config_1.getConfig)(opts);
+    const workDir = opts.dir || process.cwd();
+    if (!opts.skipPreflight) {
+        const result = await (0, preflight_1.runPreflight)({
+            dir: workDir,
+            ...opts,
+        });
+        for (const w of result.warnings)
+            out.warn(w);
+        if (!result.ok) {
+            for (const e of result.errors)
+                out.error(e);
+            process.exit(1);
+        }
+    }
+    const role = opts.conductor ? 'conductor' : 'player';
+    // Check if a conductor workflow already exists for this ensemble
+    if (opts.conductor) {
+        try {
+            const connection = await (0, connection_1.createTemporalConnection)(config);
+            const client = new client_1.Client({ connection, namespace: config.temporalNamespace });
+            const conductorWfId = (0, config_1.conductorWorkflowId)(opts.ensemble);
+            const handle = client.workflow.getHandle(conductorWfId);
+            const desc = await handle.describe();
+            if (desc.status.name === 'RUNNING') {
+                if (opts.replace) {
+                    out.log(`Stopping existing conductor for ensemble "${opts.ensemble}"...`);
+                    try {
+                        // PR-C commit 4: V2 `destroy` update — explicit operator termination.
+                        await handle.executeUpdate(signals_1.destroyUpdate, { args: [{ reason: 'conductor replace via CLI' }] });
+                        // Wait briefly for graceful shutdown
+                        for (let i = 0; i < 10; i++) {
+                            await new Promise(r => setTimeout(r, 500));
+                            const check = await handle.describe();
+                            if (check.status.name !== 'RUNNING')
+                                break;
+                        }
+                    }
+                    catch {
+                        // Force cancel if destroy fails (workflow may be stuck/corrupt)
+                        try {
+                            await handle.cancel();
+                        }
+                        catch { /* already gone */ }
+                    }
+                    out.success('Existing conductor stopped');
+                }
+                else if (opts.resume) {
+                    out.log(`Resuming conductor for ensemble "${opts.ensemble}" — reconnecting to existing workflow state.\n`);
+                }
+                else {
+                    out.error(`A conductor is already running for ensemble "${opts.ensemble}".`);
+                    out.log(`  ${out.dim('agent-tempo conduct --resume')}    Reconnect a new session to the existing workflow`);
+                    out.log(`  ${out.dim('agent-tempo conduct --replace')}   Stop the existing conductor and start fresh`);
+                    await connection.close();
+                    process.exit(1);
+                }
+            }
+            await connection.close();
+        }
+        catch {
+            // No existing conductor — proceed normally
+        }
+    }
+    // Issue #172: `conduct --lineup <name>` loads the lineup with the initial-
+    // startup semantics. Resolved here so a bad name/path fails before we spawn
+    // the process. Non-conductor `start` ignores `--lineup` (only `up` /
+    // `conduct` create ensembles from scratch). `--resume` also ignores it:
+    // reconnecting to an existing conductor must NOT re-seed messages (a no-op
+    // under `USE_EXISTING`), re-recruit players, or re-pause the ensemble.
+    let startLineup;
+    if (opts.conductor && opts.lineup) {
+        if (opts.resume) {
+            out.warn('`--lineup` is ignored with `--resume` — reconnecting to existing conductor without re-applying lineup.');
+        }
+        else {
+            try {
+                const resolution = (0, loader_1.resolveLineupPath)(opts.lineup);
+                startLineup = (0, loader_1.loadLineup)(resolution.path);
+            }
+            catch (err) {
+                out.error(err.message);
+                process.exit(1);
+            }
+        }
+    }
+    else if (!opts.conductor && opts.lineup) {
+        // Plain `start --lineup` silently dropped the flag; surface a warning so
+        // users notice the mistake.
+        out.warn('`--lineup` is only meaningful with `conduct` or `up`, not `start` — ignored.');
+    }
+    const startInitialStartup = Boolean(startLineup) && !opts.noHold;
+    out.log(`Starting ${out.bold(role)} in ensemble ${out.cyan(opts.ensemble)}${opts.agent === 'copilot' ? out.dim(' (copilot)') : ''}`);
+    // Always forward all resolved Temporal settings to child processes.
+    // Don't skip defaults — child processes may not have access to the same config file.
+    const temporalEnvVars = {
+        [config_1.ENV.TEMPORAL_ADDRESS]: config.temporalAddress,
+        [config_1.ENV.TEMPORAL_NAMESPACE]: config.temporalNamespace,
+    };
+    if (config.temporalApiKey)
+        temporalEnvVars[config_1.ENV.TEMPORAL_API_KEY] = config.temporalApiKey;
+    if (config.temporalTlsCertPath)
+        temporalEnvVars[config_1.ENV.TEMPORAL_TLS_CERT_PATH] = config.temporalTlsCertPath;
+    if (config.temporalTlsKeyPath)
+        temporalEnvVars[config_1.ENV.TEMPORAL_TLS_KEY_PATH] = config.temporalTlsKeyPath;
+    if (config.claudeBin)
+        temporalEnvVars[config_1.ENV.CLAUDE_BIN] = config.claudeBin;
+    // Resolve the session name ONCE so the spawn env var and the workflow
+    // metadata's `playerId` match. Conductor path requires a stable name;
+    // player path may leave it undefined for claude auto-assignment.
+    const sessionName = opts.conductor
+        ? resolveConductorName(opts, startLineup)
+        : resolvePlayerName(opts);
+    // Pre-seed the conductor workflow BEFORE spawning the Claude Code / copilot
+    // process. If the spawned process's MCP client wins the race and registers
+    // the workflow first, `USE_EXISTING` silently drops our seeded messages.
+    let conductorClient;
+    let conductorConnection;
+    if (opts.conductor) {
+        try {
+            conductorConnection = await (0, connection_1.createTemporalConnection)(config);
+            conductorClient = new client_1.Client({ connection: conductorConnection, namespace: config.temporalNamespace });
+            try {
+                await ensureMaestroWorkflow(conductorClient, config, opts.ensemble);
+            }
+            catch (err) {
+                if (process.env.DEBUG) {
+                    console.error('[agent-tempo:conduct] ensureMaestroWorkflow failed:', err);
+                }
+            }
+            if (startLineup) {
+                try {
+                    await seedConductorWorkflow({
+                        client: conductorClient,
+                        config,
+                        ensemble: opts.ensemble,
+                        lineup: startLineup,
+                        initialStartup: startInitialStartup,
+                        conductorName: sessionName,
+                        conductorAgent: opts.agent,
+                    });
+                }
+                catch (err) {
+                    out.warn(`Conductor workflow pre-seed failed: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+        catch (err) {
+            // Couldn't even connect — let the spawn proceed; the conductor's MCP
+            // client will surface a clearer error. Lineup seeding is lost though.
+            if (startLineup) {
+                out.warn(`Could not connect to Temporal to pre-seed lineup: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+    }
+    if (opts.agent === 'copilot') {
+        const { pid } = (0, spawn_1.spawnCopilotBridge)({
+            name: sessionName,
+            ensemble: opts.ensemble,
+            temporalAddress: config.temporalAddress,
+            temporalNamespace: config.temporalNamespace,
+            temporalApiKey: config.temporalApiKey,
+            temporalTlsCertPath: config.temporalTlsCertPath,
+            temporalTlsKeyPath: config.temporalTlsKeyPath,
+            isConductor: opts.conductor,
+            workDir,
+        });
+        out.success(`Launched copilot bridge "${sessionName}" (pid ${pid ?? 'unknown'})`);
+    }
+    else {
+        const claudeArgs = [
+            '--dangerously-skip-permissions',
+            '--dangerously-load-development-channels', 'server:agent-tempo',
+            // ENSEMBLE_SENTINEL_FLAG carries the ensemble name into the spawned
+            // claude.exe's CommandLine so hard-terminate can scope `destroy --all`
+            // kills by ensemble (#180, #259). Mirrors src/activities/outbox.ts.
+            constants_1.ENSEMBLE_SENTINEL_FLAG, opts.ensemble,
+        ];
+        if (opts.resume && sessionName) {
+            // Resume the previous Claude Code conversation by name
+            claudeArgs.push('--resume', sessionName);
+        }
+        else if (sessionName) {
+            claudeArgs.push('-n', sessionName);
+        }
+        const envVars = {
+            ...temporalEnvVars,
+            [config_1.ENV.ENSEMBLE]: opts.ensemble,
+            [config_1.ENV.CONDUCTOR]: opts.conductor ? 'true' : '',
+            [config_1.ENV.PLAYER_NAME]: sessionName || '',
+        };
+        const { pid } = (0, spawn_1.spawnInTerminal)(claudeArgs, workDir, envVars, { claudeBin: config.claudeBin });
+        out.success(`Launched ${role} session${sessionName ? ` "${sessionName}"` : ''} (pid ${pid ?? 'unknown'})`);
+    }
+    out.log(`  Ensemble: ${opts.ensemble}`);
+    out.log(`  Directory: ${workDir}`);
+    // Post-spawn: pre-create players, create schedules, pause ensemble.
+    // The conductor tab is already open so the user sees it first.
+    if (opts.conductor && startLineup && conductorClient) {
+        try {
+            await applyLineupPlayersAndSchedules({
+                client: conductorClient,
+                config,
+                ensemble: opts.ensemble,
+                lineup: startLineup,
+                initialStartup: startInitialStartup,
+                conductorName: sessionName,
+                temporalEnvVars,
+                conductorAgent: opts.agent,
+            });
+        }
+        catch (err) {
+            out.warn(`Lineup player/schedule setup encountered errors: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    // #93: resume flow — after the conductor is spawned, scan for orphaned
+    // player workflows on this host and enqueue `restart` entries on their
+    // outboxes so the daemon re-attaches. Reuses the same helper the daemon
+    // calls at boot (`reconcileOnBoot`). Only fires when the user explicitly
+    // chose the resume path (`--resume` or `up` option 2).
+    if (opts.conductor && opts.resume && conductorClient) {
+        try {
+            const { restoreOrphansOnce, formatRestoreOutcome } = await Promise.resolve().then(() => __importStar(require('../reconcile/orphans')));
+            const summary = await restoreOrphansOnce(conductorClient, { hostname: (0, os_1.hostname)(), invokerPlayerId: 'cli', policy: 'auto' });
+            if (summary.details.length > 0) {
+                console.log();
+                out.heading('Orphaned players');
+                for (const d of summary.details) {
+                    const text = `${d.playerId} — ${formatRestoreOutcome(d.outcome)}`;
+                    switch (d.outcome.kind) {
+                        case 'queued':
+                            out.success(text);
+                            break;
+                        case 'failed':
+                            out.warn(text);
+                            break;
+                        case 'skipped':
+                            out.log(`  ${out.dim(text)}`);
+                            break;
+                    }
+                }
+                out.log(`${summary.reattached} reattached, ${summary.skipped} skipped, ${summary.failed} failed.`);
+            }
+        }
+        catch (err) {
+            out.warn(`Orphan restore scan failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    if (conductorConnection) {
+        try {
+            await conductorConnection.close();
+        }
+        catch { /* best effort */ }
+    }
+    out.log(`\nCheck status: ${out.dim('agent-tempo status ' + opts.ensemble)}`);
+    if (startLineup && startInitialStartup) {
+        console.log();
+        out.log(`  ${(0, constants_1.ensembleReadyBanner)(startLineup.name, startLineup.players.length)}`);
+    }
+}
+async function status(opts) {
+    const config = (0, config_1.getConfig)(opts);
+    let connection;
+    try {
+        connection = await Promise.race([
+            (0, connection_1.createTemporalConnection)(config),
+            new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 3000)),
+        ]);
+    }
+    catch {
+        out.error(`Cannot connect to Temporal at ${config.temporalAddress}`);
+        out.log(`  Run: ${out.dim('temporal server start-dev')}`);
+        process.exit(1);
+        return; // unreachable, helps TS
+    }
+    const client = new client_1.Client({ connection, namespace: config.temporalNamespace });
+    // List all running session workflows, filter by ensemble using metadata queries.
+    // This avoids depending on custom search attributes which are eventually consistent.
+    const query = 'WorkflowType = "agentSessionWorkflow" AND ExecutionStatus = "Running"';
+    const sessions = [];
+    for await (const wf of client.workflow.list({ query })) {
+        try {
+            const handle = client.workflow.getHandle(wf.workflowId);
+            const [metadata, part] = await Promise.all([
+                handle.query('getMetadata').catch(() => ({})),
+                handle.query('getPart').catch(() => ''),
+            ]);
+            const meta = metadata;
+            const ensemble = meta.ensemble || '?';
+            // Filter by ensemble if specified
+            if (opts.ensemble && ensemble !== opts.ensemble)
+                continue;
+            // Attachment phase lives on the `AgentTempoAttachmentState` search attribute (post-#175).
+            const phase = (0, search_attributes_1.getAttachmentPhase)(wf);
+            sessions.push({
+                id: wf.workflowId,
+                name: meta.playerId || wf.workflowId.split('-').pop() || '?',
+                part: part || '',
+                ensemble,
+                workDir: meta.workDir || '?',
+                branch: meta.gitBranch || '',
+                host: meta.hostname || '',
+                conductor: meta.isConductor || false,
+                agentType: meta.agentType || 'claude',
+                phase,
+            });
+        }
+        catch {
+            // workflow may have closed between list and query
+        }
+    }
+    // Query scheduler workflows for active schedules. #586 — using
+    // `ScheduleEntry` directly (the wire shape) so the display formatter
+    // sees the canonical `'once' | 'interval' | 'cron'` discriminator and
+    // can pick up `cronExpression` / `timezone` for cron entries instead
+    // of falling through to "one-shot".
+    const schedulesByEnsemble = new Map();
+    const schedulerQuery = 'WorkflowType = "agentSchedulerWorkflow" AND ExecutionStatus = "Running"';
+    for await (const wf of client.workflow.list({ query: schedulerQuery })) {
+        try {
+            const handle = client.workflow.getHandle(wf.workflowId);
+            const entries = await handle.query('getSchedules');
+            if (entries.length > 0) {
+                // Extract ensemble from workflow ID: agent-scheduler-{ensemble}
+                const ensemble = wf.workflowId.replace('agent-scheduler-', '');
+                if (opts.ensemble && ensemble !== opts.ensemble)
+                    continue;
+                schedulesByEnsemble.set(ensemble, entries);
+            }
+        }
+        catch {
+            // scheduler may have just completed
+        }
+    }
+    await connection.close();
+    if (sessions.length === 0 && schedulesByEnsemble.size === 0) {
+        out.log(opts.ensemble
+            ? `No active sessions in ensemble "${opts.ensemble}".`
+            : 'No active sessions found.');
+        return;
+    }
+    // Group by ensemble
+    const byEnsemble = new Map();
+    for (const s of sessions) {
+        const list = byEnsemble.get(s.ensemble) || [];
+        list.push(s);
+        byEnsemble.set(s.ensemble, list);
+    }
+    for (const [ensemble, members] of byEnsemble) {
+        out.heading(`Ensemble: ${ensemble}`);
+        out.log(`  ${out.dim(`${members.length} active session${members.length !== 1 ? 's' : ''}`)}`);
+        console.log();
+        // Sort: conductor first, then alphabetical
+        members.sort((a, b) => {
+            if (a.conductor !== b.conductor)
+                return a.conductor ? -1 : 1;
+            return a.name.localeCompare(b.name);
+        });
+        // Option-B phase → tag mapping (see #176 PR):
+        //   booting → (pending); attached/processing/awaiting → no tag;
+        //   draining/detached → (disconnected); gone → (gone).
+        const phaseLabel = (phase) => {
+            if (phase === 'booting')
+                return out.dim(' (pending)');
+            if (phase === 'draining' || phase === 'detached')
+                return out.yellow(' (disconnected)');
+            if (phase === 'gone')
+                return out.dim(' (gone)');
+            return '';
+        };
+        for (const s of members) {
+            const role = s.conductor ? out.yellow(' (conductor)') : '';
+            const agent = s.agentType === 'copilot' ? out.dim(' [copilot]') : '';
+            const statusLabel = phaseLabel(s.phase);
+            // Show PID info for copilot bridge sessions
+            const pidInfo = s.agentType === 'copilot' ? getBridgePidInfo(s.name) : '';
+            const name = out.bold(s.name);
+            out.log(`  ${name}${role}${statusLabel}${agent}${pidInfo}`);
+            if (s.part)
+                out.log(`    ${out.dim(s.part)}`);
+            const details = [s.workDir, s.branch, s.host].filter(Boolean).join('  ');
+            if (details)
+                out.log(`    ${out.dim(details)}`);
+        }
+        // Show schedules for this ensemble
+        const ensembleSchedules = schedulesByEnsemble.get(ensemble);
+        if (ensembleSchedules && ensembleSchedules.length > 0) {
+            console.log();
+            out.log(`  ${out.dim(`${ensembleSchedules.length} active schedule${ensembleSchedules.length !== 1 ? 's' : ''}`)}`);
+            for (const sched of ensembleSchedules) {
+                const recur = formatScheduleRecurrence(sched);
+                const next = new Date(sched.nextFireAt).toLocaleTimeString();
+                const bounds = [];
+                if (sched.remainingCount != null)
+                    bounds.push(`${sched.firedCount}/${sched.firedCount + sched.remainingCount} fired`);
+                const boundsStr = bounds.length ? ` (${bounds.join(', ')})` : '';
+                out.log(`  ${out.bold(sched.name)} → ${sched.target} | ${recur}${boundsStr} | next: ${next}`);
+            }
+        }
+    }
+    console.log();
+}
+async function init(opts) {
+    if (opts.project) {
+        // Per-project .mcp.json mode
+        return initProject(opts.dir);
+    }
+    // Default: global install via `claude mcp add`
+    if ((0, mcp_1.isGlobalMcpRegistered)() || (0, mcp_1.isMcpConfigured)(opts.dir)) {
+        out.success('agent-tempo already registered');
+        out.log(`  ${out.dim('claude mcp list -s user')}`);
+        return;
+    }
+    const claudePath = (0, spawn_1.resolveClaudePath)();
+    if (claudePath === 'claude') {
+        out.warn('claude binary not found — falling back to project-level .mcp.json');
+        return initProject(opts.dir);
+    }
+    if ((0, mcp_1.addGlobalMcp)()) {
+        out.success('Registered agent-tempo globally (user scope)');
+        out.log(`  ${out.dim('Available in all Claude Code sessions')}`);
+    }
+    else {
+        out.warn('Failed to register globally — falling back to project-level .mcp.json');
+        return initProject(opts.dir);
+    }
+    out.log(`\nNext steps:`);
+    out.log(`  1. Start Temporal:  ${out.dim('temporal server start-dev')}`);
+    out.log(`  2. Start conductor: ${out.dim('agent-tempo conduct')}`);
+}
+/** Per-project .mcp.json install (legacy, used with --project flag). */
+function initProject(dir) {
+    const mcpPath = (0, path_1.join)(dir, '.mcp.json');
+    const entry = {
+        command: 'agent-tempo-server',
+    };
+    if ((0, fs_1.existsSync)(mcpPath)) {
+        try {
+            const existing = JSON.parse((0, fs_1.readFileSync)(mcpPath, 'utf8'));
+            // Backward-compat: detect either the new (`agent-tempo`) or legacy
+            // (`agent-tempo`) registration. Skip the rewrite if either is present —
+            // the migration verb is the one path that upgrades the key.
+            if (existing?.mcpServers?.['agent-tempo'] || existing?.mcpServers?.['agent-tempo']) {
+                out.success('.mcp.json already has an agent-tempo entry');
+                out.log(`  ${out.dim(mcpPath)}`);
+                return;
+            }
+            existing.mcpServers = existing.mcpServers || {};
+            existing.mcpServers['agent-tempo'] = entry;
+            (0, fs_1.writeFileSync)(mcpPath, JSON.stringify(existing, null, 2) + '\n');
+            out.success('Added agent-tempo to existing .mcp.json');
+        }
+        catch {
+            out.error(`Failed to parse ${mcpPath}. Fix the JSON or delete it and re-run.`);
+            process.exit(1);
+        }
+    }
+    else {
+        const config = {
+            mcpServers: {
+                'agent-tempo': entry,
+            },
+        };
+        (0, fs_1.writeFileSync)(mcpPath, JSON.stringify(config, null, 2) + '\n');
+        out.success('Created .mcp.json with agent-tempo config');
+    }
+    out.log(`  ${out.dim(mcpPath)}`);
+    out.log(`\nNext steps:`);
+    out.log(`  1. Start Temporal:  ${out.dim('temporal server start-dev')}`);
+    out.log(`  2. Start conductor: ${out.dim('agent-tempo conduct')}`);
+}
+// --- Temporal server management ---
+const DEFAULT_DB_PATH = (0, path_1.join)(config_1.AGENT_TEMPO_HOME, 'temporal-data.db');
+// Source of truth lives in `sa-preflight.ts` (REQUIRED_SEARCH_ATTRIBUTES) —
+// avoid drifting a second copy here.
+const sa_preflight_1 = require("./sa-preflight");
+async function isTemporalReachable(config) {
+    try {
+        const conn = await (0, connection_1.createTemporalConnection)(config);
+        try {
+            // Verify namespace is ready — a gRPC connection alone doesn't guarantee the server can serve requests
+            const client = new client_1.Client({ connection: conn, namespace: config.temporalNamespace || 'default' });
+            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+            for await (const _ of client.workflow.list({ query: 'WorkflowId = "__readiness_probe__"' })) {
+                break;
+            }
+        }
+        finally {
+            await conn.close();
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function temporalCliExists() {
+    const cmd = process.platform === 'win32' ? 'where' : 'which';
+    try {
+        (0, child_process_1.execFileSync)(cmd, ['temporal'], { stdio: 'ignore' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function registerSearchAttributes(temporalAddress, namespace = 'default') {
+    let failed = 0;
+    for (const attr of sa_preflight_1.REQUIRED_SEARCH_ATTRIBUTES) {
+        const r = (0, sa_preflight_1.registerSearchAttribute)(attr, temporalAddress, namespace);
+        switch (r.status) {
+            case 'created':
+                out.success(`Registered search attribute: ${attr.name}`);
+                break;
+            case 'already-exists':
+                out.dim(`  ${attr.name} (already registered)`);
+                break;
+            case 'failed':
+                // Surface the real error — pre-#605 this branch was silently
+                // labeled "already exists" and the operator only discovered the
+                // problem hours later when workflow start failed with
+                // INVALID_ARGUMENT. Most common cause on the SQLite dev server is
+                // the 10-Keyword-per-namespace cap (often hit when a namespace
+                // accumulates both old + new wire-rename attribute families).
+                failed++;
+                out.warn(`Failed to register ${attr.name}: ${r.detail}`);
+                break;
+        }
+    }
+    if (failed > 0) {
+        out.warn(`${failed} search attribute${failed === 1 ? '' : 's'} not registered — ` +
+            `workflow starts will fail. Resolve the errors above before continuing.`);
+    }
+    return { failed };
+}
+async function server(opts) {
+    const config = (0, config_1.getConfig)(opts);
+    if (!temporalCliExists()) {
+        out.error('temporal CLI not found on PATH');
+        out.log(`  Install: ${out.dim('https://docs.temporal.io/cli')}`);
+        process.exit(1);
+    }
+    // Check if already running
+    const alreadyRunning = await isTemporalReachable(config);
+    if (alreadyRunning) {
+        out.success(`Temporal already running at ${config.temporalAddress}`);
+        out.log('  Registering search attributes...');
+        registerSearchAttributes(config.temporalAddress, config.temporalNamespace);
+        return;
+    }
+    // Ensure data directory exists
+    (0, fs_1.mkdirSync)(config_1.AGENT_TEMPO_HOME, { recursive: true });
+    const port = config.temporalAddress.split(':')[1] || '7233';
+    const args = [
+        'server', 'start-dev',
+        '--port', port,
+        '--db-filename', DEFAULT_DB_PATH,
+    ];
+    out.log(`Starting Temporal dev server on port ${port}...`);
+    out.log(`  Data: ${out.dim(DEFAULT_DB_PATH)}`);
+    if (opts.background) {
+        const child = (0, child_process_1.spawn)('temporal', args, {
+            detached: true,
+            stdio: 'ignore',
+        });
+        child.unref();
+        out.success(`Temporal started in background (pid ${child.pid})`);
+        // Wait for it to be ready
+        for (let i = 0; i < 20; i++) {
+            await new Promise(r => setTimeout(r, 500));
+            if (await isTemporalReachable(config))
+                break;
+        }
+    }
+    else {
+        // Foreground — register attributes after startup, then hand over stdio
+        const child = (0, child_process_1.spawn)('temporal', args, {
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        // Wait for ready, then register attributes
+        const waitForReady = async () => {
+            for (let i = 0; i < 20; i++) {
+                await new Promise(r => setTimeout(r, 500));
+                if (await isTemporalReachable(config)) {
+                    out.success(`Temporal running at ${config.temporalAddress}`);
+                    out.log('  Registering search attributes...');
+                    registerSearchAttributes(config.temporalAddress, config.temporalNamespace);
+                    out.log(`\n  ${out.dim('Press Ctrl+C to stop')}\n`);
+                    return;
+                }
+            }
+            out.warn('Temporal started but not responding — search attributes not registered');
+        };
+        waitForReady();
+        // Pipe output through
+        child.stdout?.pipe(process.stdout);
+        child.stderr?.pipe(process.stderr);
+        // Forward signals for clean shutdown
+        const forward = (sig) => { child.kill(sig); };
+        process.on('SIGINT', () => forward('SIGINT'));
+        process.on('SIGTERM', () => forward('SIGTERM'));
+        await new Promise((resolve) => {
+            child.on('exit', (code) => {
+                if (code && code !== 0)
+                    out.error(`Temporal exited with code ${code}`);
+                resolve();
+            });
+        });
+    }
+    // Register search attributes (for background mode — foreground does it inline)
+    if (opts.background) {
+        out.log('  Registering search attributes...');
+        registerSearchAttributes(config.temporalAddress, config.temporalNamespace);
+        out.success('Temporal ready');
+    }
+}
+async function up(opts) {
+    const config = (0, config_1.getConfig)(opts);
+    out.heading('agent-tempo setup');
+    // Step 1: Check temporal CLI
+    if (!temporalCliExists()) {
+        out.error('temporal CLI not found');
+        out.log(`\n  Install the Temporal CLI first:`);
+        out.log(`  ${out.dim('https://docs.temporal.io/cli')}\n`);
+        process.exit(1);
+    }
+    out.check('temporal CLI installed', true);
+    // Step 2: Start Temporal if needed
+    const temporalUp = await isTemporalReachable(config);
+    if (temporalUp) {
+        out.check('Temporal running', true, config.temporalAddress);
+    }
+    else {
+        out.log(`  ${out.dim('...')} Starting Temporal dev server...`);
+        (0, fs_1.mkdirSync)(config_1.AGENT_TEMPO_HOME, { recursive: true });
+        const port = config.temporalAddress.split(':')[1] || '7233';
+        const child = (0, child_process_1.spawn)('temporal', [
+            'server', 'start-dev',
+            '--port', port,
+            '--db-filename', DEFAULT_DB_PATH,
+        ], { detached: true, stdio: 'ignore' });
+        child.unref();
+        // Wait for ready
+        let ready = false;
+        for (let i = 0; i < 20; i++) {
+            await new Promise(r => setTimeout(r, 500));
+            if (await isTemporalReachable(config)) {
+                ready = true;
+                break;
+            }
+        }
+        if (!ready) {
+            out.error('Temporal did not start within 10 seconds');
+            process.exit(1);
+        }
+        out.check('Temporal started', true, `pid ${child.pid}, data in ~/.agent-tempo/`);
+    }
+    // Step 3: Register search attributes
+    registerSearchAttributes(config.temporalAddress, config.temporalNamespace);
+    // Step 3.5: Install shipped agent types to ~/.claude/agents/ (if not already there)
+    const userAgentsDir = (0, path_1.join)((0, os_1.homedir)(), '.claude', 'agents');
+    const shippedAgentsPath = (0, path_1.join)(PACKAGE_ROOT, 'examples', 'agents');
+    if ((0, fs_1.existsSync)(shippedAgentsPath)) {
+        (0, fs_1.mkdirSync)(userAgentsDir, { recursive: true });
+        const shipped = (0, fs_1.readdirSync)(shippedAgentsPath).filter(f => f.endsWith('.md'));
+        let installed = 0;
+        for (const file of shipped) {
+            const dest = (0, path_1.join)(userAgentsDir, file);
+            if (!(0, fs_1.existsSync)(dest)) {
+                (0, fs_1.copyFileSync)((0, path_1.join)(shippedAgentsPath, file), dest);
+                installed++;
+            }
+        }
+        if (installed > 0) {
+            out.success(`Installed ${installed} agent type${installed !== 1 ? 's' : ''} to ~/.claude/agents/`);
+        }
+        else {
+            out.dim(`  Agent types already installed (${shipped.length} in ~/.claude/agents/)`);
+        }
+    }
+    // Step 3.7: Start worker daemon if not already running
+    if ((0, daemon_1.isDaemonRunning)()) {
+        const daemonStatus = (0, daemon_1.getDaemonStatus)();
+        out.check('Worker daemon running', true, `pid ${daemonStatus.pid}`);
+    }
+    else {
+        out.log(`  ${out.dim('...')} Starting worker daemon...`);
+        try {
+            const daemonPid = await (0, daemon_1.startDaemon)(config);
+            out.check('Worker daemon started', true, `pid ${daemonPid}`);
+        }
+        catch (err) {
+            out.error(`Failed to start worker daemon: ${err.message || err}`);
+            out.log(`  ${out.dim('You can start it manually: agent-tempo daemon start')}`);
+            process.exit(1);
+        }
+    }
+    // Step 4: Register MCP server if needed
+    if ((0, mcp_1.isMcpConfigured)(process.cwd())) {
+        out.check('MCP configured', true);
+    }
+    else {
+        await init({ dir: process.cwd() });
+        out.check('MCP configured', true);
+    }
+    // Always forward all resolved Temporal settings to child processes.
+    const temporalEnvVars = {
+        [config_1.ENV.TEMPORAL_ADDRESS]: config.temporalAddress,
+        [config_1.ENV.TEMPORAL_NAMESPACE]: config.temporalNamespace,
+    };
+    if (config.temporalApiKey)
+        temporalEnvVars[config_1.ENV.TEMPORAL_API_KEY] = config.temporalApiKey;
+    if (config.temporalTlsCertPath)
+        temporalEnvVars[config_1.ENV.TEMPORAL_TLS_CERT_PATH] = config.temporalTlsCertPath;
+    if (config.temporalTlsKeyPath)
+        temporalEnvVars[config_1.ENV.TEMPORAL_TLS_KEY_PATH] = config.temporalTlsKeyPath;
+    // Load lineup if --lineup is provided
+    let lineup;
+    const lineupArg = opts.lineup;
+    if (lineupArg) {
+        try {
+            const resolution = (0, loader_1.resolveLineupPath)(lineupArg);
+            lineup = (0, loader_1.loadLineup)(resolution.path);
+        }
+        catch (err) {
+            out.error(err.message);
+            process.exit(1);
+        }
+    }
+    if (lineup) {
+        out.check('Lineup loaded', true, lineup.name);
+    }
+    // Issue #172: initial-startup behavior is on by default when a lineup is
+    // loaded. `--no-hold` opts out and preserves legacy immediate-start. No
+    // lineup ⇒ the flag is a no-op (nothing to defer).
+    const initialStartup = Boolean(lineup) && !opts.noHold;
+    // Resolve conductor agent from lineup or CLI flags.
+    // `agent: "mock"` is dev-only — silently fall back to the CLI default
+    // outside dev mode so a mis-configured lineup doesn't spawn a real session
+    // unexpectedly (mirrors the player-level guard at ~line 209).
+    const conductorAgent = lineup?.conductor?.agent === 'copilot' ? 'copilot' :
+        lineup?.conductor?.agent === 'mock' && (0, config_1.isDevMode)() ? 'mock' :
+            opts.agent;
+    // Step 5: Connect to Temporal and check for existing conductor
+    console.log();
+    const connection = await (0, connection_1.createTemporalConnection)(config);
+    const client = new client_1.Client({ connection, namespace: config.temporalNamespace });
+    const conductorWfId = (0, config_1.conductorWorkflowId)(opts.ensemble);
+    // Check if a conductor is already running
+    try {
+        const existingHandle = client.workflow.getHandle(conductorWfId);
+        const desc = await existingHandle.describe();
+        if (desc.status.name === 'RUNNING') {
+            if (!process.stdin.isTTY) {
+                out.error(`A conductor is already running for ensemble "${opts.ensemble}".`);
+                out.log(`  Use ${out.dim('--resume')} to reconnect, or ${out.dim('agent-tempo start')} to join as a player.`);
+                process.exit(1);
+            }
+            out.warn(`A conductor is already running for ensemble "${opts.ensemble}".`);
+            console.log();
+            out.log(`  1) Join as a new player session`);
+            out.log(`  2) Reconnect to the existing conductor (--resume)`);
+            out.log(`  3) Tear down and start fresh`);
+            out.log(`  4) Cancel`);
+            console.log();
+            const choice = await new Promise((res) => {
+                const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+                rl.question(`  ${out.cyan('?')} Choose an option [1-4]: `, (answer) => {
+                    rl.close();
+                    res(answer.trim());
+                });
+            });
+            switch (choice) {
+                case '1':
+                    // Join as a player — delegate to start()
+                    console.log();
+                    out.log('Joining as a player session...');
+                    await start({
+                        ensemble: opts.ensemble,
+                        conductor: false,
+                        name: opts.name,
+                        skipPreflight: true, // infrastructure already verified above
+                        agent: opts.agent,
+                        dir: process.cwd(),
+                    });
+                    return;
+                case '2':
+                    // Reconnect to existing conductor
+                    console.log();
+                    out.log('Reconnecting to existing conductor...');
+                    await start({
+                        ensemble: opts.ensemble,
+                        conductor: true,
+                        resume: true,
+                        name: opts.name,
+                        skipPreflight: true,
+                        agent: opts.agent,
+                        dir: process.cwd(),
+                    });
+                    return;
+                case '3':
+                    // Terminate existing workflows, then fall through to normal up flow
+                    console.log();
+                    try {
+                        await client.workflow.getHandle(conductorWfId).terminate('up: fresh start');
+                    }
+                    catch { /* may not exist */ }
+                    try {
+                        await client.workflow.getHandle((0, config_1.schedulerWorkflowId)(opts.ensemble)).terminate('up: fresh start');
+                    }
+                    catch { /* may not exist */ }
+                    try {
+                        await client.workflow.getHandle((0, config_1.maestroWorkflowId)(opts.ensemble)).terminate('up: fresh start');
+                    }
+                    catch { /* may not exist */ }
+                    out.success('Existing ensemble torn down');
+                    // Fall through to normal up flow below
+                    break;
+                case '4':
+                default:
+                    out.log('Cancelled.');
+                    process.exit(0);
+            }
+        }
+    }
+    catch {
+        // No existing conductor — proceed normally
+    }
+    out.log(`Launching conductor in ensemble ${out.cyan(opts.ensemble)}${conductorAgent === 'copilot' ? out.dim(' (copilot)') : ''}...`);
+    const sessionName = resolveConductorName({ ...opts, agent: conductorAgent }, lineup);
+    // Legacy `lineup.conductor.agent` (string form, e.g. path to a system prompt)
+    // is passed through to the spawn CLI below — not to the workflow metadata.
+    const conductorType = lineup?.conductor?.agent && lineup.conductor.agent !== 'default' && lineup.conductor.agent !== 'copilot'
+        ? lineup.conductor.agent
+        : undefined;
+    const conductorTypeName = lineup?.conductor?.type;
+    const resolvedConductorType = conductorTypeName ? (0, agent_types_1.resolveAgentType)(conductorTypeName) : null;
+    await seedConductorWorkflow({
+        client,
+        config,
+        ensemble: opts.ensemble,
+        lineup,
+        initialStartup,
+        conductorName: sessionName,
+        conductorAgent,
+    });
+    out.check('Conductor workflow pre-created', true);
+    // Spawn the conductor process
+    let pid;
+    if (conductorAgent === 'mock') {
+        // Dev-mode mock conductor — mirrors the player mock-spawn path in
+        // applyLineupPlayersAndSchedules. isConductor: true so the mock
+        // adapter registers the session as the ensemble conductor.
+        const effectiveMode = lineup?.conductor?.mockMode ?? 'echo';
+        const effectiveScenario = lineup?.conductor?.mockScenario;
+        ({ pid } = (0, spawn_1.spawnMockAdapter)({
+            name: sessionName,
+            ensemble: opts.ensemble,
+            temporalAddress: config.temporalAddress,
+            temporalNamespace: config.temporalNamespace,
+            temporalApiKey: config.temporalApiKey,
+            temporalTlsCertPath: config.temporalTlsCertPath,
+            temporalTlsKeyPath: config.temporalTlsKeyPath,
+            isConductor: true,
+            workDir: process.cwd(),
+            mockMode: effectiveMode,
+            ...(effectiveScenario ? { mockScenario: effectiveScenario } : {}),
+        }));
+    }
+    else if (conductorAgent === 'copilot') {
+        ({ pid } = (0, spawn_1.spawnCopilotBridge)({
+            name: sessionName,
+            ensemble: opts.ensemble,
+            temporalAddress: config.temporalAddress,
+            temporalNamespace: config.temporalNamespace,
+            temporalApiKey: config.temporalApiKey,
+            temporalTlsCertPath: config.temporalTlsCertPath,
+            temporalTlsKeyPath: config.temporalTlsKeyPath,
+            isConductor: true,
+            workDir: process.cwd(),
+        }));
+    }
+    else {
+        const claudeArgs = [
+            '--dangerously-skip-permissions',
+            '--dangerously-load-development-channels', 'server:agent-tempo',
+            // ENSEMBLE_SENTINEL_FLAG carries the ensemble name into the spawned
+            // claude.exe's CommandLine so hard-terminate can scope `destroy --all`
+            // kills by ensemble (#180, #259). Mirrors src/activities/outbox.ts.
+            constants_1.ENSEMBLE_SENTINEL_FLAG, opts.ensemble,
+            '-n', sessionName,
+            ...(resolvedConductorType?.nativeResolvable ? ['--agent', resolvedConductorType.name] :
+                resolvedConductorType ? ['--system-prompt', resolvedConductorType.path] :
+                    conductorType ? ['--system-prompt', conductorType] : []),
+        ];
+        const conductorEnvVars = {
+            ...temporalEnvVars,
+            [config_1.ENV.ENSEMBLE]: opts.ensemble,
+            [config_1.ENV.CONDUCTOR]: 'true',
+            [config_1.ENV.PLAYER_NAME]: sessionName,
+        };
+        if (resolvedConductorType || conductorTypeName) {
+            conductorEnvVars[config_1.ENV.PLAYER_TYPE] = resolvedConductorType?.name || conductorTypeName || '';
+        }
+        ({ pid } = (0, spawn_1.spawnInTerminal)(claudeArgs, process.cwd(), conductorEnvVars, { claudeBin: config.claudeBin }));
+    }
+    out.success(`Conductor launched (pid ${pid ?? 'unknown'})`);
+    // Step 6: If lineup provided, recruit players, create schedules, and
+    // pause the ensemble for initial-startup — same code path as
+    // `conduct --lineup` via the shared helper.
+    if (lineup) {
+        await ensureMaestroWorkflow(client, config, opts.ensemble);
+        if (lineup.conductor?.instructions) {
+            out.check('Conductor instructions baked into workflow', true);
+        }
+        await applyLineupPlayersAndSchedules({
+            client,
+            config,
+            ensemble: opts.ensemble,
+            lineup,
+            initialStartup,
+            conductorName: sessionName,
+            temporalEnvVars,
+            conductorAgent,
+            ...(opts.scenario ? { scenarioOverride: opts.scenario } : {}),
+        });
+    }
+    await connection.close();
+    console.log();
+    out.success('You\'re all set!');
+    out.log(`  Ensemble: ${out.cyan(opts.ensemble)}`);
+    if (!lineup) {
+        out.log(`\n  ${out.bold('What next?')}`);
+        out.log(`  ${out.dim('agent-tempo start ' + opts.ensemble)}    Add a player session`);
+        out.log(`  ${out.dim('agent-tempo status ' + opts.ensemble)}   See who\'s active`);
+        out.log(`  Or ask the conductor to ${out.dim('recruit')} players for you`);
+    }
+    else {
+        out.log(`  Lineup: ${out.dim(lineup.name)}`);
+        out.log(`  Players: ${lineup.players.length}`);
+        if (lineup.schedules?.length)
+            out.log(`  Schedules: ${lineup.schedules.length}`);
+        out.log(`\n  ${out.dim('agent-tempo status ' + opts.ensemble)}   See who\'s active`);
+    }
+    // Issue #172: print the canonical "ensemble ready" banner on stdout so the
+    // user sees the same wording in their terminal, the conductor's tab, and
+    // the TUI. On `--no-hold` the legacy wording is preserved implicitly since
+    // nothing is deferred — we only surface the banner on initial-startup paths.
+    if (lineup && initialStartup) {
+        console.log();
+        out.log(`  ${(0, constants_1.ensembleReadyBanner)(lineup.name, lineup.players.length)}`);
+    }
+    console.log();
+}
+/**
+ * Format a `ScheduleEntry` recurrence for the `status` display.
+ *
+ * #586 — cron entries previously rendered as `'one-shot'` because the inline
+ * formatter only checked `sched.interval`. The display formatter now mirrors
+ * the wire-type triplet (`'once' | 'interval' | 'cron'`) from
+ * `ScheduleEntry.type` so cron schedules from the lineup loader (and the
+ * MCP `load_lineup` path) read correctly in `agent-tempo status`.
+ *
+ * Exported for unit tests.
+ */
+function formatScheduleRecurrence(sched) {
+    if (sched.type === 'cron' && sched.cronExpression) {
+        const tz = sched.timezone && sched.timezone !== 'UTC' ? ` ${sched.timezone}` : '';
+        return `cron: ${sched.cronExpression}${tz}`;
+    }
+    if (sched.interval) {
+        return `every ${(0, duration_1.formatDurationMs)(sched.interval)}`;
+    }
+    return 'one-shot';
+}
+/**
+ * Convert a lineup schedule definition to a ScheduleEntry for the scheduler
+ * workflow.
+ *
+ * #586 — cron entries now produce `type: 'cron'` with `cronExpression` +
+ * `timezone` populated; previously they fell through to the default
+ * `nextFireAt = now + 60_000` with `type: 'once'`, firing once and getting
+ * garbage-collected. The cron branch mirrors the MCP-side `load_lineup` tool
+ * at `src/tools/load-lineup.ts:280-300` so both load paths agree on the wire
+ * shape submitted to the scheduler workflow.
+ *
+ * Exported for unit tests; consumed internally by `up` /
+ * `ensembleCommand` after a lineup is parsed.
+ */
+function lineupScheduleToEntry(sched, 
+/** Injectable clock for deterministic tests. Defaults to `Date.now()`. */
+now = Date.now()) {
+    let nextFireAt;
+    let interval;
+    let cronExpression;
+    let timezone;
+    if (sched.cron) {
+        // #586 — cron branch matches MCP `load_lineup` (src/tools/load-lineup.ts:280).
+        // `croner` is a runtime dependency declared in package.json; the scheduler
+        // workflow uses it on the firing side too (src/activities/schedule-fire.ts).
+        cronExpression = sched.cron;
+        timezone = sched.timezone ?? 'UTC';
+        const job = new croner_1.Cron(cronExpression, { timezone });
+        const next = job.nextRun(new Date(now));
+        if (!next) {
+            throw new Error(`Cron expression "${sched.cron}" has no upcoming fire time (schedule "${sched.name}")`);
+        }
+        nextFireAt = next.toISOString();
+    }
+    else if (sched.every) {
+        interval = parseDuration(sched.every);
+        nextFireAt = sched.delay
+            ? new Date(now + parseDuration(sched.delay)).toISOString()
+            : new Date(now + interval).toISOString();
+    }
+    else if (sched.at) {
+        nextFireAt = new Date(sched.at).toISOString();
+    }
+    else if (sched.delay) {
+        nextFireAt = new Date(now + parseDuration(sched.delay)).toISOString();
+    }
+    else {
+        nextFireAt = new Date(now + 60_000).toISOString(); // default: 1 minute
+    }
+    const type = cronExpression
+        ? 'cron'
+        : interval
+            ? 'interval'
+            : 'once';
+    return {
+        name: sched.name,
+        message: sched.message,
+        target: sched.target,
+        createdBy: 'lineup',
+        nextFireAt,
+        interval,
+        cronExpression,
+        timezone,
+        until: sched.until,
+        remainingCount: sched.count,
+        firedCount: 0,
+        type,
+    };
+}
+/** Parse a human duration string like "10m", "1h", "30s" to milliseconds. */
+function parseDuration(s) {
+    const match = s.match(/^(\d+(?:\.\d+)?)\s*(s|m|h|d)$/);
+    if (!match)
+        throw new Error(`Invalid duration: "${s}"`);
+    const value = parseFloat(match[1]);
+    switch (match[2]) {
+        case 's': return value * 1_000;
+        case 'm': return value * 60_000;
+        case 'h': return value * 3_600_000;
+        case 'd': return value * 86_400_000;
+        default: throw new Error(`Unknown duration unit: "${match[2]}"`);
+    }
+}
+/** Prompt the user for y/n confirmation. Exits with code 1 in non-TTY environments. */
+async function confirmPrompt(message) {
+    if (!process.stdin.isTTY) {
+        out.error('Non-interactive environment: use --yes / -y to confirm teardown.');
+        process.exit(1);
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(`${message} [y/N] `, (answer) => {
+            rl.close();
+            resolve(answer.trim().toLowerCase() === 'y');
+        });
+    });
+}
+/**
+ * Require the user to type `expected` verbatim to confirm an irrecoverable
+ * action. Exits with code 1 in non-TTY environments.
+ */
+async function typedConfirmPrompt(message, expected) {
+    if (!process.stdin.isTTY) {
+        out.error('Non-interactive environment: use --yes / -y to skip this confirmation.');
+        process.exit(1);
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(`${message}\n  Type ${out.bold(expected)} to confirm: `, (answer) => {
+            rl.close();
+            resolve(answer.trim() === expected);
+        });
+    });
+}
+/**
+ * Stop the shared Temporal dev server, with the same cross-profile guard
+ * that `stopDaemon`'s zombie reaper already applies (ADR 0014 §5.6).
+ *
+ * The Temporal dev server is a single OS-wide process — `pkill -f` on
+ * POSIX and `taskkill /IM temporal.exe` on Windows kill it by name and
+ * cannot distinguish dev-profile vs prod-profile ownership. So when
+ * `agent-tempo --dev down` runs while the prod profile is also active,
+ * the unconditional kill takes down the prod profile's Temporal as
+ * collateral damage. This is exactly the bug `isOtherProfileLikelyRunning`
+ * was introduced to prevent on the daemon side; the missing piece was
+ * `down`'s own Temporal kill (#423).
+ *
+ * `--kill-shared-temporal` (passed as `killSharedTemporal: true`) is the
+ * explicit opt-in for the hard-reset case where the user accepts cross-
+ * profile collateral damage.
+ */
+function stopTemporalServer(opts) {
+    const otherLikelyRunning = opts.isOtherProfileLikelyRunning ?? daemon_1.isOtherProfileLikelyRunning;
+    const exec = opts.exec ?? ((cmd, args) => { (0, child_process_1.execFileSync)(cmd, args, { stdio: 'ignore' }); });
+    const platform = opts.platform ?? process.platform;
+    if (!opts.killSharedTemporal && otherLikelyRunning()) {
+        return { action: 'skipped-cross-profile' };
+    }
+    try {
+        if (platform === 'win32') {
+            exec('taskkill', ['/F', '/IM', 'temporal.exe']);
+        }
+        else {
+            exec('pkill', ['-f', 'temporal server start-dev']);
+        }
+        return { action: 'killed' };
+    }
+    catch (err) {
+        return { action: 'failed', error: err };
+    }
+}
+async function down(opts) {
+    const config = (0, config_1.getConfig)(opts);
+    out.heading('agent-tempo teardown');
+    out.log(opts.destroy
+        ? `  ${out.bold('Destroying all workflows')}, then stopping daemon + Temporal.`
+        : `  Stopping daemon + Temporal. Workflows stay parked for the next ${out.dim('agent-tempo up')}.`);
+    // Step 1 (destroy mode only): enumerate + terminate workflows across every
+    // ensemble, after a typed confirmation showing the user what's at stake.
+    const temporalUp = await isTemporalReachable(config);
+    if (opts.destroy && temporalUp) {
+        try {
+            const connection = await (0, connection_1.createTemporalConnection)(config);
+            const client = new client_1.Client({ connection, namespace: config.temporalNamespace });
+            try {
+                // Enumerate every workflow type we own, not just sessions. Previously
+                // we only listed `agentSessionWorkflow` and derived maestro/scheduler
+                // workflow IDs from each session's `AgentTempoEnsemble` search
+                // attribute. Two failure modes that left orphans behind:
+                //   1. Sessions started without the search attribute set (e.g. from
+                //      an older or partially-rebranded build) were added to
+                //      `sessionIds` but their ensemble name never made it into the
+                //      `runningEnsembles` set — and the early-return on
+                //      `runningEnsembles.size === 0` then bailed out without
+                //      terminating ANY of the buffered session IDs.
+                //   2. Maestro/scheduler workflows whose sessions had already exited
+                //      were invisible to a session-only query.
+                // Listing each type directly catches both cases.
+                const collect = async (query) => {
+                    const ids = [];
+                    for await (const wf of client.workflow.list({ query })) {
+                        ids.push(wf.workflowId);
+                    }
+                    return ids;
+                };
+                const baseFilter = 'ExecutionStatus = "Running"';
+                const [sessionIds, maestroIds, schedulerIds, globalMaestroIds] = await Promise.all([
+                    collect(`WorkflowType = "agentSessionWorkflow" AND ${baseFilter}`),
+                    collect(`WorkflowType = "agentMaestroWorkflow" AND ${baseFilter}`),
+                    collect(`WorkflowType = "agentSchedulerWorkflow" AND ${baseFilter}`),
+                    collect(`WorkflowType = "agentGlobalMaestroWorkflow" AND ${baseFilter}`),
+                ]);
+                // Ensemble names are best-effort display only — derived from
+                // workflow ID prefixes when present. We terminate by ID, not by
+                // ensemble, so a missing name no longer blocks cleanup.
+                const ensemblesFromIds = new Set();
+                for (const id of sessionIds) {
+                    // `agent-session-<ensemble>-<playerId>` / legacy `claude-session-<ensemble>-<playerId>`
+                    const m = id.match(/^(?:agent|claude)-session-(.+?)-[^-]+$/);
+                    if (m)
+                        ensemblesFromIds.add(m[1]);
+                }
+                for (const id of maestroIds) {
+                    // `agent-maestro-<ensemble>` (and `agent-maestro-global` which we exclude as global)
+                    const m = id.match(/^(?:agent|claude)-maestro-(.+)$/);
+                    if (m && m[1] !== 'global')
+                        ensemblesFromIds.add(m[1]);
+                }
+                const totalTargets = sessionIds.length + maestroIds.length + schedulerIds.length + globalMaestroIds.length;
+                if (totalTargets === 0) {
+                    out.log('  No active workflows to destroy.');
+                }
+                else {
+                    if (!opts.yes) {
+                        console.log();
+                        if (ensemblesFromIds.size > 0) {
+                            out.log('  The following ensembles will be destroyed:');
+                            for (const name of [...ensemblesFromIds].sort()) {
+                                out.log(`    - ${name}`);
+                            }
+                        }
+                        out.log(`  ${sessionIds.length} session${sessionIds.length !== 1 ? 's' : ''}, ` +
+                            `${maestroIds.length} maestro${maestroIds.length !== 1 ? 's' : ''}, ` +
+                            `${schedulerIds.length} scheduler${schedulerIds.length !== 1 ? 's' : ''}` +
+                            (globalMaestroIds.length > 0 ? `, ${globalMaestroIds.length} global maestro` : ''));
+                        console.log();
+                        const confirmed = await typedConfirmPrompt(`  This terminates every workflow (${totalTargets}) and cannot be undone.`, 'destroy');
+                        if (!confirmed) {
+                            out.log('Aborted.');
+                            process.exit(0);
+                        }
+                    }
+                    // Fan out terminations in parallel. Individual failures are
+                    // swallowed — closed workflows are fine, and the overall operation
+                    // is best-effort scorched-earth.
+                    const terminate = async (id) => {
+                        try {
+                            await client.workflow.getHandle(id).terminate('agent-tempo down --destroy');
+                            return true;
+                        }
+                        catch {
+                            return false;
+                        }
+                    };
+                    const targets = [...sessionIds, ...maestroIds, ...schedulerIds, ...globalMaestroIds];
+                    const results = await Promise.all(targets.map(terminate));
+                    const terminated = results.filter(Boolean).length;
+                    const ensembleCount = ensemblesFromIds.size;
+                    out.success(`Terminated ${terminated}/${totalTargets} workflow${terminated !== 1 ? 's' : ''}` +
+                        (ensembleCount > 0 ? ` across ${ensembleCount} ensemble${ensembleCount !== 1 ? 's' : ''}` : ''));
+                }
+            }
+            finally {
+                await connection.close();
+            }
+        }
+        catch (err) {
+            out.warn(`Could not terminate active workflows: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    // Step 2: Kill bridge processes via PID files
+    killBridgeProcesses();
+    // Step 3: Stop worker daemon unless `--keep-daemon`.
+    if (opts.keepDaemon) {
+        if ((0, daemon_1.isDaemonRunning)()) {
+            out.log(`  ${out.dim('Worker daemon left running (--keep-daemon)')}`);
+        }
+    }
+    else if ((0, daemon_1.stopDaemon)()) {
+        out.success('Worker daemon stopped');
+    }
+    // Step 4: Stop Temporal dev server.
+    //
+    // Cross-profile coexistence (ADR 0014 §5.6, #423): the dev-server is one
+    // OS-wide process and `pkill`/`taskkill` cannot distinguish profile
+    // ownership. Without the guard, `--dev down` kills the prod profile's
+    // Temporal as collateral damage (and vice versa). `stopTemporalServer`
+    // skips the kill when the OPPOSITE profile is likely active;
+    // `--kill-shared-temporal` is the explicit opt-in to override.
+    if (temporalUp) {
+        const result = stopTemporalServer({ killSharedTemporal: opts.killSharedTemporal });
+        switch (result.action) {
+            case 'killed':
+                out.success('Temporal server stopped');
+                break;
+            case 'failed':
+                out.warn('Could not stop Temporal server (may need to stop it manually)');
+                break;
+            case 'skipped-cross-profile': {
+                const otherProfile = (0, config_1.isDevMode)() ? 'prod' : 'dev';
+                out.warn(`Temporal server kept running — the ${otherProfile} profile appears active. ` +
+                    `Pass --kill-shared-temporal to override.`);
+                break;
+            }
+        }
+    }
+    else {
+        out.log(`  ${out.dim('Temporal not running')}`);
+    }
+    // Step 4: Check for npx usage, then remove MCP config
+    // npx check must happen BEFORE removal since step 4 deletes the entry
+    let hasNpxWarning = false;
+    const projectMcpPath = (0, path_1.join)(opts.dir, '.mcp.json');
+    if ((0, fs_1.existsSync)(projectMcpPath)) {
+        try {
+            const mcpContent = JSON.parse((0, fs_1.readFileSync)(projectMcpPath, 'utf8'));
+            // Backward-compat: check both the new (`agent-tempo`) and legacy (`agent-tempo`) keys.
+            const tempoEntry = mcpContent?.mcpServers?.['agent-tempo'] ?? mcpContent?.mcpServers?.['agent-tempo'];
+            if (tempoEntry) {
+                const cmd = tempoEntry.command ?? '';
+                const entryArgs = tempoEntry.args ?? [];
+                if (cmd === 'npx' || entryArgs.some((a) => a === 'npx')) {
+                    hasNpxWarning = true;
+                }
+            }
+        }
+        catch {
+            // Corrupt .mcp.json — ignore
+        }
+    }
+    if (opts.removeMcp) {
+        // Remove global registration
+        if ((0, mcp_1.isGlobalMcpRegistered)()) {
+            if ((0, mcp_1.removeGlobalMcp)()) {
+                out.success('Removed agent-tempo from global MCP config');
+            }
+            else {
+                out.warn('Could not remove global MCP entry');
+            }
+        }
+        // Also remove project-level .mcp.json entry if present.
+        // Backward-compat: clean up either the new (`agent-tempo`) or legacy (`agent-tempo`) key.
+        if ((0, fs_1.existsSync)(projectMcpPath)) {
+            try {
+                const existing = JSON.parse((0, fs_1.readFileSync)(projectMcpPath, 'utf8'));
+                const removedAny = (existing?.mcpServers?.['agent-tempo'] && (delete existing.mcpServers['agent-tempo'])) ||
+                    (existing?.mcpServers?.['agent-tempo'] && (delete existing.mcpServers['agent-tempo']));
+                if (removedAny) {
+                    if (Object.keys(existing.mcpServers).length === 0) {
+                        (0, fs_1.unlinkSync)(projectMcpPath);
+                        out.success('Removed .mcp.json (no other servers configured)');
+                    }
+                    else {
+                        (0, fs_1.writeFileSync)(projectMcpPath, JSON.stringify(existing, null, 2) + '\n');
+                        out.success('Removed agent-tempo from .mcp.json');
+                    }
+                }
+            }
+            catch {
+                out.warn(`Could not update ${projectMcpPath}`);
+            }
+        }
+    }
+    if (hasNpxWarning) {
+        console.log();
+        out.warn('Your .mcp.json uses npx which may cache stale versions.');
+        out.log(`  ${out.dim('Consider removing it — user-level registration is preferred.')}`);
+        out.log(`  ${out.dim('Run: agent-tempo init')}`);
+    }
+    console.log();
+    out.success('agent-tempo is shut down');
+    out.log(`  ${out.dim('Temporal data preserved in ~/.agent-tempo/ (delete manually to reset)')}`);
+    console.log();
+}
+/**
+ * Read PID info for a copilot bridge session from its PID file.
+ * Returns a formatted string like " (pid 12345)" or "" if no PID file found.
+ */
+function getBridgePidInfo(name) {
+    const pidPath = (0, path_1.join)(process.cwd(), 'logs', `${name}.pid`);
+    if (!(0, fs_1.existsSync)(pidPath))
+        return '';
+    try {
+        const pid = parseInt((0, fs_1.readFileSync)(pidPath, 'utf8').trim(), 10);
+        if (isNaN(pid))
+            return '';
+        // Check if process is still alive
+        try {
+            process.kill(pid, 0); // signal 0 = existence check, doesn't kill
+            return out.dim(` (pid ${pid})`);
+        }
+        catch {
+            return out.dim(` (pid ${pid}, dead)`);
+        }
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Kill all bridge processes found in logs/*.pid and clean up PID files.
+ */
+function killBridgeProcesses() {
+    const logsDir = (0, path_1.join)(process.cwd(), 'logs');
+    if (!(0, fs_1.existsSync)(logsDir))
+        return;
+    try {
+        const pidFiles = (0, fs_1.readdirSync)(logsDir).filter(f => f.endsWith('.pid'));
+        for (const pidFile of pidFiles) {
+            const pidPath = (0, path_1.join)(logsDir, pidFile);
+            try {
+                const pid = parseInt((0, fs_1.readFileSync)(pidPath, 'utf8').trim(), 10);
+                if (!isNaN(pid)) {
+                    try {
+                        process.kill(pid);
+                        out.log(`  ${out.dim(`Killed bridge process ${pidFile.replace('.pid', '')} (pid ${pid})`)}`);
+                    }
+                    catch {
+                        // already dead
+                    }
+                }
+                (0, fs_1.unlinkSync)(pidPath);
+            }
+            catch {
+                // unreadable — skip
+            }
+        }
+    }
+    catch {
+        // logs dir unreadable
+    }
+}
+async function agentTypesCommand(opts) {
+    switch (opts.subcommand) {
+        case 'list': {
+            const types = (0, agent_types_1.listAgentTypes)();
+            if (types.length === 0) {
+                out.log('No agent types found.');
+                out.log(`  Run ${out.dim('agent-tempo agent-types init')} to install shipped examples.`);
+                return;
+            }
+            out.heading('Available agent types');
+            for (const t of types) {
+                const src = t.source === 'shipped' ? out.dim('(shipped)') : t.source === 'user' ? out.dim('(user)') : out.dim('(project)');
+                out.log(`  ${out.bold(t.name)} ${src}`);
+                if (t.description)
+                    out.log(`    ${t.description}`);
+            }
+            console.log();
+            break;
+        }
+        case 'show': {
+            if (!opts.name) {
+                out.error('Usage: agent-tempo agent-types show <name>');
+                process.exit(1);
+            }
+            const info = (0, agent_types_1.resolveAgentType)(opts.name);
+            if (!info) {
+                out.error(`No agent type found named "${opts.name}"`);
+                out.log(`  Run ${out.dim('agent-tempo agent-types list')} to see available types.`);
+                process.exit(1);
+            }
+            out.log(`${out.bold(info.name)} ${out.dim(`(${info.source}: ${info.path})`)}\n`);
+            console.log((0, fs_1.readFileSync)(info.path, 'utf8'));
+            break;
+        }
+        case 'init': {
+            const shippedDir = (0, path_1.join)(PACKAGE_ROOT, 'examples', 'agents');
+            const targetDir = (0, path_1.join)((0, os_1.homedir)(), '.claude', 'agents');
+            (0, fs_1.mkdirSync)(targetDir, { recursive: true });
+            if (!(0, fs_1.existsSync)(shippedDir)) {
+                out.error(`Shipped examples not found at ${shippedDir}`);
+                process.exit(1);
+            }
+            const files = (0, fs_1.readdirSync)(shippedDir).filter(f => f.endsWith('.md'));
+            let copied = 0;
+            let skipped = 0;
+            for (const file of files) {
+                const target = (0, path_1.join)(targetDir, file);
+                if ((0, fs_1.existsSync)(target)) {
+                    out.log(`  ${out.dim('skip')} ${file} (already exists)`);
+                    skipped++;
+                }
+                else {
+                    (0, fs_1.copyFileSync)((0, path_1.join)(shippedDir, file), target);
+                    out.success(`${file} → ${target}`);
+                    copied++;
+                }
+            }
+            console.log();
+            out.log(`Copied ${copied} agent definitions to ${targetDir}${skipped ? ` (${skipped} skipped)` : ''}`);
+            break;
+        }
+        default:
+            out.error('Usage: agent-tempo agent-types <list|show|init> [name]');
+            out.log(`\n  ${out.dim('agent-tempo agent-types list')}          List available agent types`);
+            out.log(`  ${out.dim('agent-tempo agent-types show <name>')}   Display an agent definition`);
+            out.log(`  ${out.dim('agent-tempo agent-types init')}          Copy shipped examples to ~/.claude/agents/`);
+            process.exit(1);
+    }
+}
+async function broadcast(opts) {
+    const config = (0, config_1.getConfig)(opts);
+    let connection;
+    try {
+        connection = await Promise.race([
+            (0, connection_1.createTemporalConnection)(config),
+            new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 3000)),
+        ]);
+    }
+    catch {
+        out.error(`Cannot connect to Temporal at ${config.temporalAddress}`);
+        process.exit(1);
+        return;
+    }
+    const client = new client_1.Client({ connection, namespace: config.temporalNamespace });
+    const ensemble = opts.ensemble || config.ensemble;
+    const query = `WorkflowType = "agentSessionWorkflow" AND ExecutionStatus = "Running"`;
+    const targets = [];
+    for await (const wf of client.workflow.list({ query })) {
+        try {
+            const handle = client.workflow.getHandle(wf.workflowId);
+            const metadata = await handle.query('getMetadata');
+            if (metadata.ensemble !== ensemble)
+                continue;
+            // Filter by attachment phase (post-#176). Phase lives on the
+            // `AgentTempoAttachmentState` search attribute.
+            const phase = (0, search_attributes_1.getAttachmentPhase)(wf);
+            if (!(0, validation_1.shouldIncludeInBroadcast)(phase, !!opts.includeStale))
+                continue;
+            // Filter by player type if specified
+            if (opts.type && metadata.playerType !== opts.type)
+                continue;
+            targets.push({ playerId: metadata.playerId, workflowId: wf.workflowId });
+        }
+        catch {
+            // Workflow may have just completed — skip it
+        }
+    }
+    if (targets.length === 0) {
+        out.warn('No active players matched the broadcast filter.');
+        await connection.close();
+        return;
+    }
+    // Signal each target directly (CLI bypasses outbox)
+    let sent = 0;
+    for (const target of targets) {
+        try {
+            const handle = client.workflow.getHandle(target.workflowId);
+            await handle.signal('receiveMessage', {
+                from: 'cli',
+                text: opts.message,
+                responseRequested: false,
+            });
+            sent++;
+            out.log(`  ${out.green('✓')} ${target.playerId}`);
+        }
+        catch (err) {
+            out.warn(`  ${target.playerId}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    out.success(`Broadcast sent to ${sent}/${targets.length} player${targets.length === 1 ? '' : 's'}`);
+    await connection.close();
+}
+/**
+ * Shared connection + client helper for verb commands. Exported so the
+ * dev-mode verb dispatcher (`./dev-verbs.ts`) can use the same connection
+ * idiom — single source of truth for the 3-second timeout + error-exit
+ * behavior across all CLI verbs.
+ */
+async function verbClient(opts) {
+    const config = (0, config_1.getConfig)(opts);
+    let connection;
+    try {
+        connection = await Promise.race([
+            (0, connection_1.createTemporalConnection)(config),
+            new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 3000)),
+        ]);
+    }
+    catch {
+        out.error(`Cannot connect to Temporal at ${config.temporalAddress}`);
+        process.exit(1);
+    }
+    const client = new client_1.Client({ connection, namespace: config.temporalNamespace });
+    return { config, connection, client };
+}
+/**
+ * `agent-tempo destroy <ensemble> [-y]` — terminate every workflow in an
+ * ensemble (#288). Prompts with the ensemble name and workflow count unless
+ * `-y` is passed. The per-player destroy path lives in the TUI (`/destroy
+ * --player`).
+ */
+async function destroy(opts) {
+    const { config, connection, client } = await verbClient(opts);
+    try {
+        const handles = [];
+        const sessionQuery = `WorkflowType = "agentSessionWorkflow" AND ExecutionStatus = "Running" AND AgentTempoEnsemble = "${opts.ensemble}"`;
+        for await (const wf of client.workflow.list({ query: sessionQuery })) {
+            handles.push({ id: wf.workflowId, label: 'session' });
+        }
+        const probe = async (id, label) => {
+            try {
+                const desc = await client.workflow.getHandle(id).describe();
+                return desc.status.name === 'RUNNING' ? { id, label } : null;
+            }
+            catch {
+                return null;
+            }
+        };
+        const sidecars = await Promise.all([
+            probe((0, config_1.schedulerWorkflowId)(opts.ensemble), 'scheduler'),
+            probe((0, config_1.maestroWorkflowId)(opts.ensemble), 'maestro'),
+        ]);
+        for (const s of sidecars)
+            if (s)
+                handles.push(s);
+        if (handles.length === 0) {
+            out.log(`No active workflows in ensemble "${opts.ensemble}".`);
+            return;
+        }
+        if (!opts.yes) {
+            out.heading(`Destroy ensemble "${opts.ensemble}"`);
+            for (const h of handles) {
+                out.log(`  ${out.dim('-')} ${h.label}: ${h.id}`);
+            }
+            console.log();
+            const confirmed = await typedConfirmPrompt(`  This terminates ${handles.length} workflow${handles.length !== 1 ? 's' : ''} and cannot be undone.`, 'destroy');
+            if (!confirmed) {
+                out.log('Aborted.');
+                process.exit(0);
+            }
+        }
+        const results = await Promise.all(handles.map(async (h) => {
+            try {
+                await client.workflow.getHandle(h.id).terminate(`agent-tempo destroy ${opts.ensemble}`);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        }));
+        const terminated = results.filter(Boolean).length;
+        out.success(`Terminated ${terminated} workflow${terminated !== 1 ? 's' : ''} in "${opts.ensemble}".`);
+    }
+    catch (err) {
+        out.error(err?.message || String(err));
+        process.exit(1);
+    }
+    finally {
+        await connection.close();
+    }
+}
+async function attachmentInfo(opts) {
+    const { config, connection, client } = await verbClient(opts);
+    const ensemble = opts.ensemble || config.ensemble;
+    try {
+        const tempo = (0, client_2.createTempoClient)(client);
+        const info = await tempo.attachmentInfo(ensemble, opts.name);
+        // #264 carved the per-surface formatter out to src/utils/attachment-format.ts
+        // so the TUI's /attachment-info renders identical output including heartbeat
+        // age. The CLI is now a pure consumer; if you need to add a field, add it
+        // to the shared formatter so every surface picks it up at once.
+        for (const line of (0, attachment_format_1.formatAttachmentInfoForDisplay)(opts.name, info)) {
+            out.log(line);
+        }
+    }
+    catch (err) {
+        out.error(err?.message || String(err));
+        process.exit(1);
+    }
+    finally {
+        await connection.close();
+    }
+}
+async function hosts(opts) {
+    const { config, connection, client } = await verbClient(opts);
+    try {
+        const { listHosts } = await Promise.resolve().then(() => __importStar(require('../utils/hosts')));
+        const { formatHostList } = await Promise.resolve().then(() => __importStar(require('../utils/format-hosts')));
+        const list = await listHosts(client, {
+            force: true, // CLI always bypasses the cache — freshness expectation is "right now".
+            namespace: config.temporalNamespace,
+            taskQueue: config.taskQueue,
+        });
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(list, null, 2) + '\n');
+        }
+        else {
+            out.log(formatHostList(list, { includeStale: opts.all }));
+        }
+    }
+    catch (err) {
+        out.error(err?.message || String(err));
+        process.exit(1);
+    }
+    finally {
+        await connection.close();
+    }
+}
+/**
+ * #274 AC5d (M12) — manual re-signal of this host's profile to the
+ * global maestro. The daemon otherwise only re-signals on boot; this
+ * subcommand re-computes the profile + signals fresh.
+ *
+ * Exit semantics (per my implementation-time call to the conductor,
+ * approved): await ensureGlobalMaestro → signal → short poll on
+ * `hostProfiles()` to confirm the new version is visible → exit 0.
+ * Exits nonzero if the poll timeout elapses without confirmation.
+ */
+async function refreshHostProfile(opts) {
+    const { config, connection, client } = await verbClient(opts);
+    try {
+        const { computeHostProfile, scrubHostProfile, advertiseHostProfile } = await Promise.resolve().then(() => __importStar(require('../daemon')));
+        const { GLOBAL_MAESTRO_WORKFLOW_ID } = await Promise.resolve().then(() => __importStar(require('../config')));
+        const profile = scrubHostProfile(computeHostProfile(config));
+        const result = await advertiseHostProfile(client, profile, { log: (...a) => out.log(a.map(String).join(' ')) });
+        if (!result.ok) {
+            out.error(`hostProfile signal failed after ${result.attempts} attempts. Global Maestro may be unreachable.`);
+            process.exit(1);
+        }
+        // Short confirmation poll — give the workflow a moment to apply the
+        // signal and respond to the query with the fresh version. If the
+        // maestro is absent entirely, the query will throw and we exit 1.
+        const deadline = Date.now() + (opts.confirmTimeoutMs ?? 10_000);
+        const target = profile.version;
+        const handle = client.workflow.getHandle(GLOBAL_MAESTRO_WORKFLOW_ID);
+        while (Date.now() < deadline) {
+            try {
+                const profiles = (await handle.query('hostProfiles'));
+                const live = profiles[profile.hostname];
+                if (live && live.version === target) {
+                    out.success(`Host profile for "${profile.hostname}" refreshed (version ${target}).`);
+                    return;
+                }
+            }
+            catch {
+                // retry until deadline
+            }
+            await new Promise((r) => setTimeout(r, 500));
+        }
+        out.error(`Signal sent but not yet reflected in hostProfiles() query after ${opts.confirmTimeoutMs ?? 10_000}ms. May succeed shortly; re-run to confirm.`);
+        process.exit(1);
+    }
+    catch (err) {
+        out.error(err?.message || String(err));
+        process.exit(1);
+    }
+    finally {
+        await connection.close();
+    }
+}
+async function recall(opts) {
+    const { config, connection, client } = await verbClient(opts);
+    const ensemble = opts.ensemble || config.ensemble;
+    try {
+        const tempo = (0, client_2.createTempoClient)(client);
+        const { received, sent } = await tempo.recall(ensemble, opts.name);
+        const timeline = (0, recall_format_1.buildTimeline)(received, sent, Boolean(opts.includeSent));
+        const rendered = (0, recall_format_1.formatRecall)(timeline, {
+            limit: opts.limit,
+            offset: opts.offset,
+            previewLength: opts.previewLength,
+            since: opts.since,
+            from: opts.from,
+        });
+        if (opts.json) {
+            // Machine-readable. Includes the rendered text too so callers can
+            // either re-render or pass through. Pagination state is explicit so
+            // shell pipelines don't have to parse the header line.
+            process.stdout.write(JSON.stringify({
+                player: opts.name,
+                ensemble,
+                received,
+                sent: opts.includeSent ? sent : [],
+                total: rendered.total,
+                shown: rendered.shown,
+                hasMore: rendered.hasMore,
+                text: rendered.text,
+            }, null, 2) + '\n');
+        }
+        else {
+            out.log(rendered.text);
+        }
+    }
+    catch (err) {
+        out.error(err?.message || String(err));
+        process.exit(1);
+    }
+    finally {
+        await connection.close();
+    }
+}
+/**
+ * `agent-tempo restore <ensemble>` — delegate to {@link TempoClient.restore},
+ * which reattaches orphans AND unpauses maestro + scheduler (#298 — the
+ * direct-to-`restoreOrphansOnce` path left the ensemble paused after a
+ * `shutdown → restore` roundtrip). The TUI home view (#290) is the picker
+ * surface; the CLI is the scriptable bulk operation, one ensemble at a time.
+ *
+ * `--all-hosts` (#151): switches to cluster-view readonly listing — the
+ * positional `<ensemble>` becomes optional (when set, narrows the listing;
+ * when omitted, lists across every ensemble). Never enqueues a restart.
+ * See `formatCrossHostOrphans` for the output shape.
+ */
+async function restore(opts) {
+    if (opts.allHosts) {
+        await restoreAllHosts(opts);
+        return;
+    }
+    if (!opts.ensemble) {
+        out.error('Usage: agent-tempo restore <ensemble>   (or --all-hosts for cluster-view)');
+        process.exit(1);
+    }
+    const { connection, client } = await verbClient(opts);
+    try {
+        const { formatRestoreOutcome } = await Promise.resolve().then(() => __importStar(require('../reconcile/orphans')));
+        const tempo = (0, client_2.createTempoClient)(client);
+        const summary = await tempo.restore(opts.ensemble);
+        if (summary.details.length === 0) {
+            out.log(`No orphans in ensemble "${opts.ensemble}" on this host.`);
+            return;
+        }
+        out.heading(`Restored orphans in "${opts.ensemble}"`);
+        for (const d of summary.details) {
+            const text = `${d.playerId} — ${formatRestoreOutcome(d.outcome)}`;
+            switch (d.outcome.kind) {
+                case 'queued':
+                    out.success(text);
+                    break;
+                case 'failed':
+                    out.warn(text);
+                    break;
+                case 'skipped':
+                    out.log(`  ${out.dim(text)}`);
+                    break;
+            }
+        }
+        out.log(`\n${summary.reattached} reattached, ${summary.skipped} skipped, ${summary.failed} failed.`);
+    }
+    catch (err) {
+        out.error(err?.message || String(err));
+        process.exit(1);
+    }
+    finally {
+        await connection.close();
+    }
+}
+/**
+ * #151 — `agent-tempo restore --all-hosts` implementation.
+ *
+ * Read-only cluster-view: enumerates every orphan in the namespace (not
+ * just local) and groups by `preferredHost`. Each group is annotated with
+ * a liveness label (`[live]` / `[stale]` / `[missing]`) derived from
+ * `listHosts()`, and each orphan line includes the TUI `/migrate`
+ * command the operator would run to deliberately steal the session to
+ * the local host.
+ *
+ * Never enqueues a restart. The architect's spec (#151 refined Option D)
+ * is explicit: recovery happens reflexively when the remote daemon comes
+ * back (its own `reconcileOnBoot` picks up matching orphans), or by
+ * deliberate operator action via `/migrate`. A timer-based reclaim is
+ * disallowed (PR-F §3 Site 3) — a clock cannot distinguish "host
+ * decommissioned" from "weekend offline."
+ *
+ * Output format mirrors the existing `hosts` formatter's section style
+ * (per-host groupings, dimmed annotations). Liveness label semantics:
+ *
+ *   [live]    — host's daemon is polling now (`HOST_FRESHNESS_THRESHOLD_MS`,
+ *               60s). Recovery is imminent on its next reconcile tick.
+ *   [stale]   — host has a profile but no poller seen in the last minute.
+ *               Probably down; manual `/migrate` if recovery can't wait.
+ *   [missing] — host has no registered profile (never came back since boot,
+ *               or the maestro restarted and the profile expired). Almost
+ *               certainly safe to steal.
+ */
+async function restoreAllHosts(opts) {
+    const { connection, client } = await verbClient(opts);
+    try {
+        const localHost = (0, os_1.hostname)();
+        const { restoreOrphansOnce } = await Promise.resolve().then(() => __importStar(require('../reconcile/orphans')));
+        const { listHosts } = await Promise.resolve().then(() => __importStar(require('../utils/hosts')));
+        const { formatCrossHostOrphans } = await Promise.resolve().then(() => __importStar(require('../utils/restore-format')));
+        // Run the cluster-view query and the host enumeration concurrently —
+        // the join is cheap and both calls take 50-200ms apiece against a
+        // healthy Temporal.
+        const [summary, hosts] = await Promise.all([
+            restoreOrphansOnce(client, {
+                hostname: localHost,
+                invokerPlayerId: 'cli',
+                policy: 'auto',
+                mode: 'all-hosts-readonly',
+                ...(opts.ensemble ? { ensemble: opts.ensemble } : {}),
+            }),
+            listHosts(client, { force: true }),
+        ]);
+        const output = formatCrossHostOrphans(summary.details, hosts, {
+            localHost,
+            ...(opts.ensemble ? { ensemble: opts.ensemble } : {}),
+        });
+        out.log(output);
+    }
+    catch (err) {
+        out.error(err?.message || String(err));
+        process.exit(1);
+    }
+    finally {
+        await connection.close();
+    }
+}
+async function ensembleCommand(opts) {
+    switch (opts.subcommand) {
+        case 'save': {
+            const config = (0, config_1.getConfig)(opts);
+            const connection = await (0, connection_1.createTemporalConnection)(config);
+            const client = new client_1.Client({ connection, namespace: config.temporalNamespace });
+            const ensemble = opts.name || config.ensemble;
+            try {
+                const path = await (0, saver_1.saveLineup)(client, ensemble);
+                out.success(`Saved ensemble "${ensemble}" to ${path}`);
+            }
+            finally {
+                await connection.close();
+            }
+            break;
+        }
+        case 'list': {
+            const lineups = (0, saver_1.listLineups)();
+            if (lineups.length === 0) {
+                out.log('No saved ensembles. Use `agent-tempo ensemble save [name]` to save one.');
+                return;
+            }
+            out.heading('Saved ensembles');
+            for (const bp of lineups) {
+                out.log(`  ${out.bold(bp.name)}  ${out.dim(bp.path)}`);
+            }
+            console.log();
+            break;
+        }
+        case 'show': {
+            if (!opts.name) {
+                out.error('Usage: agent-tempo ensemble show <name>');
+                process.exit(1);
+            }
+            const content = (0, saver_1.readSavedLineup)(opts.name);
+            if (!content) {
+                out.error(`No saved ensemble named "${opts.name}"`);
+                out.log(`  Run ${out.dim('agent-tempo ensemble list')} to see available ensembles.`);
+                process.exit(1);
+            }
+            console.log(content);
+            break;
+        }
+        default:
+            out.error('Usage: agent-tempo ensemble <save|list|show> [name]');
+            out.log(`\n  ${out.dim('agent-tempo ensemble save [name]')}   Save current ensemble state`);
+            out.log(`  ${out.dim('agent-tempo ensemble list')}          List saved ensembles`);
+            out.log(`  ${out.dim('agent-tempo ensemble show <name>')}   Display a saved lineup`);
+            process.exit(1);
+    }
+}
+/** Release all held sessions in an ensemble (unlock outbox, deliver initial messages). */
+async function release(opts) {
+    const config = (0, config_1.getConfig)(opts);
+    let connection;
+    try {
+        connection = await Promise.race([
+            (0, connection_1.createTemporalConnection)(config),
+            new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 3000)),
+        ]);
+    }
+    catch {
+        out.error(`Cannot connect to Temporal at ${config.temporalAddress}`);
+        process.exit(1);
+        return;
+    }
+    const client = new client_1.Client({ connection, namespace: config.temporalNamespace });
+    const query = `WorkflowType = "agentSessionWorkflow" AND ExecutionStatus = "Running" AND AgentTempoEnsemble = "${opts.ensemble.replace(/["\\\n\r]/g, '')}"`;
+    let released = 0;
+    for await (const wf of client.workflow.list({ query })) {
+        try {
+            const handle = client.workflow.getHandle(wf.workflowId);
+            const locked = await handle.query(signals_1.outboxLockedQuery);
+            if (locked) {
+                await handle.signal(signals_1.releaseHeldSignal);
+                released++;
+                const sa = wf.searchAttributes || {};
+                const playerId = Array.isArray(sa.AgentTempoPlayerId) ? String(sa.AgentTempoPlayerId[0]) : wf.workflowId;
+                out.log(`  ${out.dim('released')} ${playerId}`);
+            }
+        }
+        catch {
+            // Skip failed queries (terminated workflows, etc.)
+        }
+    }
+    if (released > 0) {
+        out.success(`Released ${released} player${released !== 1 ? 's' : ''}`);
+    }
+    else {
+        out.log('No held players found.');
+    }
+    await connection.close();
+}
+/**
+ * Fan out the paused/unpaused state to every component of an ensemble —
+ * maestro hub, scheduler, and each session. Shared by the TUI `/pause` +
+ * `/play` surface and by the internal initial-startup hold in
+ * {@link applyLineupPlayersAndSchedules}.
+ */
+async function setPausedState(client, ensemble, paused) {
+    // 1. Signal maestro hub
+    try {
+        const mh = client.workflow.getHandle((0, config_1.maestroWorkflowId)(ensemble));
+        await mh.signal(maestro_signals_1.maestroSetPausedSignal, paused);
+    }
+    catch {
+        // Maestro may not be running — non-critical
+    }
+    // 2. Signal all active sessions
+    const sanitized = ensemble.replace(/["\\\n\r]/g, '');
+    const query = `WorkflowType = "agentSessionWorkflow" AND ExecutionStatus = "Running" AND AgentTempoEnsemble = "${sanitized}"`;
+    let count = 0;
+    for await (const wf of client.workflow.list({ query })) {
+        try {
+            const handle = client.workflow.getHandle(wf.workflowId);
+            await handle.signal(signals_1.setPausedSignal, paused);
+            count++;
+        }
+        catch {
+            // Skip failed signals
+        }
+    }
+    out.log(`  ${out.dim(paused ? 'paused' : 'resumed')} ${count} session${count !== 1 ? 's' : ''}`);
+    // 3. Signal scheduler
+    try {
+        const sh = client.workflow.getHandle((0, config_1.schedulerWorkflowId)(ensemble));
+        await sh.signal(scheduler_signals_1.setSchedulerPausedSignal, paused);
+        out.log(`  ${out.dim(paused ? 'paused' : 'resumed')} scheduler`);
+    }
+    catch {
+        // Scheduler may not be running — non-critical
+    }
+}
+// `help()`, `version()`, and `upgrade()` moved out of commands.ts (#157 PR C)
+// to keep them crash-proof under a broken Temporal SDK install:
+//   - help     → src/cli/help-text.ts         (dedicated minimal module)
+//   - version  → inlined in src/cli.ts         (package.json read only)
+//   - upgrade  → src/cli/upgrade-command.ts    (dynamic Temporal imports)
+// All three are routed directly from `src/cli.ts` before `./cli/commands`
+// is dynamic-imported, so they remain available as recovery levers.
+// See src/cli/upgrade-command.ts for the upgrade handler implementation.