codeden 0.6.2 → 0.6.3

package/dist/{main-hdQfX9V6.js → main-Bx58CdV4.js}

@@ -1,7 +1,7 @@
 import { n as __require, t as __commonJSMin } from "./rolldown-runtime-DegdyBIC.js";
-import { $ as StarterSetRequest, $n as InboxItemKind, $t as FactoryAllowLargeChangeRequest, A as BrowserHostClientMessage, An as EditQueuedMessageRequest, At as LOCAL_STT_SAMPLE_RATE, B as AUTOMATION_IMPORT_LIMITS, Bt as NOTICE_BATCH_CODE, C as RemoteAccessFile, Cn as AutomationGuards, Cr as providersWith, Ct as UpdateProjectRequest, D as SignInRequest, Dn as Session, Dt as READ_ALOUD_FULL_MAX_CHARS, E as SetNetworkPasswordResponse, En as TriagePolicy, Er as ReasoningEffort, Et as agentEventToNewEvent, F as BrowserNavigateRequest, Fn as SpeechSummaryRequest, Ft as UpdateInstallRequest, G as AutomationFileFrontmatter, Gn as ConflictDecision, Gr as string, Gt as GithubIssue, H as DuplicateAutomationRequest, Ht as CreateGithubIssueRequest, I as BrowserNewTabRequest, In as TerminalClientMessage, Ir as int, It as UpdateStatus, J as CreateAutomationRequest, Jn as Project, Jt as GithubPr, K as AutomationGuardsPatch, Kn as StartedBy, Kt as GithubLabelRequest, L as BrowserOpenRequest, Ln as TerminalQuery, Lt as compareVersions$1, M as BrowserClientMessage, Mn as GitPushRequest, Mr as array, Mt as SttQuery, N as BrowserDevServerRequest, Nn as RestoreFilesRequest, Nr as boolean, Nt as TtsRequest, O as passwordProblem, On as SessionStatus, Or as datetime, Ot as Settings, P as BrowserHistoryRequest, Pn as SessionResult, Pt as AppPointer, Q as SetAutomationEnabledRequest, Qn as InboxItem, Qr as prettifyError, Qt as parseGithubPrId, R as BrowserViewportRequest, Rn as RunnerCommandResults, Rt as isNewerVersion, S as PASSWORD_RULE_TEXT, Sn as AutomationAction, Sr as agentConfigFeatures, St as UiClientMessage, T as SetNetworkPasswordRequest, Tn as AutomationTrigger, Tr as ProviderId, Tt as AGENT_EVENT_PREFIX, U as ExportAutomationsQuery, Un as SessionOptions, Ut as GithubAuthorAssociation, V as AutomationImportSource, Vr as object, Vt as NoticeBatchData, W as ImportAutomationsRequest, Wn as ProjectConfigFile, Wt as GithubCommentRequest, X as ListAutomationsQuery, Xn as DEFAULT_VISION_PATH, Xr as toJSONSchema, Xt as TriageIssueRequest, Y as ListAutomationRunsQuery, Yn as sortProjects, Yr as ZodError, Yt as MergePrRequest, Z as RunAutomationRequest, Zn as FactoryLimits, Zt as githubPrId, _ as ListNoticesQuery, _n as FactorySetTypeRequest, _r as AgentConfigProvider, _t as SessionStartMeta, an as REVIEW_SUMMARY_MAX, ar as messageFrom, at as CreateProjectRequest, b as UpdateSessionRequest, bn as Artifact, br as McpServerTarget, bt as SteerRequest, c as UsageSettings, cn as SetAutonomyModeRequest, ct as ForkSessionRequest, d as RunnerLock, dn as FactoryAdmitRequest, dr as HookHandler, dt as LoginToolId, en as FactoryDecisionRequest, et as TriageDecisionRequest, f as RunnerToServerMessage, fn as FactoryAnalysisReport, fr as ShelvedHook, ft as ReorderProjectsRequest, g as ListConflictsQuery, gn as FactoryReproductionReport, gr as AgentConfigLocator, gt as SendMessageRequest, h as ArchiveSessionRequest, hn as FactoryPlanRoundRequest, hr as AgentConfigListQuery, ht as SecretKey, in as PutVisionRequest, it as UpdateAutomationRequest, j as summarizeActivity, jn as GitCommitRequest, jt as LocalSttModelParams, k as ImageTestRequest, kn as DiffScope, kr as _enum, kt as speechExcerpt, l as SessionFileQuery, ln as isFactoryMode, lr as McpServerTestRequest, lt as ListInboxQuery, mn as FactoryFinding, mr as AgentConfigDiffRequest, mt as RespondRequest, n as killTree$1, nn as KillSwitchRequest, nr as oneLineDescription, nt as UpcomingRunsQuery, o as CODEDEN_VERSION, on as ReviewVerdictSubmission, or as MCP_TEST_DEFAULT_TIMEOUT_MS, ot as FileReadQuery, p as ServerLock, pn as FactoryFileIssueRequest, pr as AgentConfigDeleteQuery, pt as ResolveInboxRequest, q as AutomationProjectRequest, qn as WorkKey, qt as GithubListQuery, rn as LEGACY_SIZE_LIMITS, rr as winningCommands, rt as UpdateAutomationProjectSettingsRequest, s as UsageQuery, sn as SCOUT_UNAVAILABLE, st as FileWriteRequest, t as isAlive, tn as FactoryTuning, tr as SessionUpdatedEvent, tt as TriageReport, un as truncateReviewSummary, ur as HookChangeRequest, ut as ListSessionsQuery, v as ResolveConflictRequest, vn as ScoutState, vr as AgentConfigWriteRequest, vt as SetSecretRequest, w as SetNetworkAccessRequest, wn as AutomationRun, wr as AutonomyLevel, wt as HealthResponse, x as NetworkStatus, xn as Automation, xr as McpServerUpsertRequest, xt as ThreadItemsQuery, y as RoleMessageRequest, yn as pipelineStep, yr as McpServerDiffRequest, yt as StartSessionRequest, z as BrowserWsQuery, zt as ConflictRecord } from "./tree-CF7Q8tXK.js";
-import { A as isElectronRuntime, C as installClaudeSdk, D as acquireInstallLock, E as resolveNpm, M as import_websocket_server, N as wrapper_default, O as brokenInstallMessage, S as importClaudeSdkFrom, T as runNpm, _ as claudeMemoryDir, a as bufferToFormData, b as claudeSdkSource, c as refreshProcessPath, d as ImageEngineRegistry, f as createImageEngineRegistry, g as ImageGenerationError, h as resolveImageOutput, i as tryDecodeURIComponent, j as ownNodeEnv, k as findExecutable, l as defaultShell, m as imageInfo, n as readLock, o as createAdaptorServer, p as IMAGE_ASPECT_RATIOS, r as Hono, s as upgradeWebSocket, u as shellCommandLine, v as findGitRoot, w as isClaudeSdkInstalled, x as CLAUDE_SDK_VERSION, y as mainRepoRoot } from "./runner-DYf8dV43.js";
-import { A as ListRootsResultSchema, C as InitializedNotificationSchema, G as isJSONRPCResultResponse, J as safeParse, K as getLiteralValue, N as LoggingLevelSchema, P as McpError, R as SUPPORTED_PROTOCOL_VERSIONS, T as LATEST_PROTOCOL_VERSION, U as isJSONRPCErrorResponse, V as isInitializeRequest, W as isJSONRPCRequest, _ as ElicitResultSchema, a as AjvJsonSchemaValidator, c as CallToolRequestSchema, f as CreateMessageResultSchema, i as assertToolsCallTaskCapability, j as ListToolsRequestSchema, l as CallToolResultSchema, m as CreateTaskResultSchema, o as Protocol, p as CreateMessageResultWithToolsSchema, q as getObjectShape, r as assertClientRequestTaskCapability, s as mergeCapabilities, t as isJsonContentType, v as EmptyResultSchema, w as JSONRPCMessageSchema, x as InitializeRequestSchema, y as ErrorCode, z as SetLevelRequestSchema } from "./mediaType-nJs-4z5U.js";
+import { $ as StarterSetRequest, $n as InboxItemKind, $r as ZodError, $t as FactoryAllowLargeChangeRequest, A as BrowserHostClientMessage, An as EditQueuedMessageRequest, Ar as ReasoningEffort, At as LOCAL_STT_SAMPLE_RATE, B as AUTOMATION_IMPORT_LIMITS, Br as int, Bt as NOTICE_BATCH_CODE, C as RemoteAccessFile, Cn as AutomationGuards, Cr as McpServerDiffRequest, Ct as UpdateProjectRequest, D as SignInRequest, Dn as Session, Dr as providersWith, Dt as READ_ALOUD_FULL_MAX_CHARS, E as SetNetworkPasswordResponse, En as TriagePolicy, Er as agentConfigFeatures, Et as agentEventToNewEvent, F as BrowserNavigateRequest, Fn as SpeechSummaryRequest, Ft as UpdateInstallRequest, G as AutomationFileFrontmatter, Gn as ConflictDecision, Gr as object, Gt as GithubIssue, H as DuplicateAutomationRequest, Ht as CreateGithubIssueRequest, I as BrowserNewTabRequest, In as TerminalClientMessage, Ir as array, It as UpdateStatus, J as CreateAutomationRequest, Jn as Project, Jt as GithubPr, K as AutomationGuardsPatch, Kn as StartedBy, Kt as GithubLabelRequest, L as BrowserOpenRequest, Ln as TerminalQuery, Lr as boolean, Lt as compareVersions$1, M as BrowserClientMessage, Mn as GitPushRequest, Mr as datetime, Mt as SttQuery, N as BrowserDevServerRequest, Nn as RestoreFilesRequest, Nr as _enum, Nt as TtsRequest, O as passwordProblem, On as SessionStatus, Or as AutonomyLevel, Ot as Settings, P as BrowserHistoryRequest, Pn as SessionResult, Pt as AppPointer, Q as SetAutomationEnabledRequest, Qn as InboxItem, Qt as parseGithubPrId, R as BrowserViewportRequest, Rn as RunnerCommandResults, Rt as isNewerVersion, S as PASSWORD_RULE_TEXT, Sn as AutomationAction, Sr as AgentConfigWriteRequest, St as UiClientMessage, T as SetNetworkPasswordRequest, Tn as AutomationTrigger, Tr as McpServerUpsertRequest, Tt as AGENT_EVENT_PREFIX, U as ExportAutomationsQuery, Un as SessionOptions, Ut as GithubAuthorAssociation, V as AutomationImportSource, Vt as NoticeBatchData, W as ImportAutomationsRequest, Wn as ProjectConfigFile, Wt as GithubCommentRequest, X as ListAutomationsQuery, Xn as DEFAULT_VISION_PATH, Xt as TriageIssueRequest, Y as ListAutomationRunsQuery, Yn as sortProjects, Yr as string, Yt as MergePrRequest, Z as RunAutomationRequest, Zn as FactoryLimits, Zt as githubPrId, _ as ListNoticesQuery, _n as FactorySetTypeRequest, _r as AgentConfigDeleteQuery, _t as SessionStartMeta, an as REVIEW_SUMMARY_MAX, ar as winningCommands, at as CreateProjectRequest, b as UpdateSessionRequest, bn as Artifact, br as AgentConfigLocator, bt as SteerRequest, c as UsageSettings, cn as SetAutonomyModeRequest, cr as messageFrom, ct as ForkSessionRequest, d as RunnerLock, dn as FactoryAdmitRequest, dt as LoginToolId, ei as toJSONSchema, en as FactoryDecisionRequest, et as TriageDecisionRequest, f as RunnerToServerMessage, fn as FactoryAnalysisReport, fr as McpServerTestRequest, ft as ReorderProjectsRequest, g as ListConflictsQuery, gn as FactoryReproductionReport, gr as ShelvedHook, gt as SendMessageRequest, h as ArchiveSessionRequest, hn as FactoryPlanRoundRequest, hr as HookHandler, ht as SecretKey, in as PutVisionRequest, ir as oneLineDescription, it as UpdateAutomationRequest, j as summarizeActivity, jn as GitCommitRequest, jt as LocalSttModelParams, k as ImageTestRequest, kn as DiffScope, kr as ProviderId, kt as speechExcerpt, l as SessionFileQuery, ln as isFactoryMode, lr as MCP_TEST_DEFAULT_TIMEOUT_MS, lt as ListInboxQuery, mn as FactoryFinding, mr as HookChangeRequest, mt as RespondRequest, n as killTree$1, ni as prettifyError, nn as KillSwitchRequest, nr as mergeItemDeltas, nt as UpcomingRunsQuery, o as CODEDEN_VERSION, on as ReviewVerdictSubmission, ot as FileReadQuery, p as ServerLock, pn as FactoryFileIssueRequest, pr as SkillSwitchRequest, pt as ResolveInboxRequest, q as AutomationProjectRequest, qn as WorkKey, qt as GithubListQuery, rn as LEGACY_SIZE_LIMITS, rr as ProjectCommandsQuery, rt as UpdateAutomationProjectSettingsRequest, s as UsageQuery, sn as SCOUT_UNAVAILABLE, st as FileWriteRequest, t as isAlive, tn as FactoryTuning, tr as SessionUpdatedEvent, tt as TriageReport, un as truncateReviewSummary, ut as ListSessionsQuery, v as ResolveConflictRequest, vn as ScoutState, vr as AgentConfigDiffRequest, vt as SetSecretRequest, w as SetNetworkAccessRequest, wn as AutomationRun, wr as McpServerTarget, wt as HealthResponse, x as NetworkStatus, xn as Automation, xr as AgentConfigProvider, xt as ThreadItemsQuery, y as RoleMessageRequest, yn as pipelineStep, yr as AgentConfigListQuery, yt as StartSessionRequest, z as BrowserWsQuery, zt as ConflictRecord } from "./tree-31WAOm5k.js";
+import { A as isElectronRuntime, C as installClaudeSdk, D as acquireInstallLock, E as resolveNpm, M as import_websocket_server, N as wrapper_default, O as brokenInstallMessage, S as importClaudeSdkFrom, T as runNpm, _ as claudeMemoryDir, a as bufferToFormData, b as claudeSdkSource, c as refreshProcessPath, d as ImageEngineRegistry, f as createImageEngineRegistry, g as ImageGenerationError, h as resolveImageOutput, i as tryDecodeURIComponent, j as ownNodeEnv, k as findExecutable, l as defaultShell, m as imageInfo, n as readLock, o as createAdaptorServer, p as IMAGE_ASPECT_RATIOS, r as Hono, s as upgradeWebSocket, u as shellCommandLine, v as findGitRoot, w as isClaudeSdkInstalled, x as CLAUDE_SDK_VERSION, y as mainRepoRoot } from "./runner-CiaiUWOE.js";
+import { A as ListRootsResultSchema, C as InitializedNotificationSchema, G as isJSONRPCResultResponse, J as safeParse, K as getLiteralValue, N as LoggingLevelSchema, P as McpError, R as SUPPORTED_PROTOCOL_VERSIONS, T as LATEST_PROTOCOL_VERSION, U as isJSONRPCErrorResponse, V as isInitializeRequest, W as isJSONRPCRequest, _ as ElicitResultSchema, a as AjvJsonSchemaValidator, c as CallToolRequestSchema, f as CreateMessageResultSchema, i as assertToolsCallTaskCapability, j as ListToolsRequestSchema, l as CallToolResultSchema, m as CreateTaskResultSchema, o as Protocol, p as CreateMessageResultWithToolsSchema, q as getObjectShape, r as assertClientRequestTaskCapability, s as mergeCapabilities, t as isJsonContentType, v as EmptyResultSchema, w as JSONRPCMessageSchema, x as InitializeRequestSchema, y as ErrorCode, z as SetLevelRequestSchema } from "./mediaType-BCz-hbZl.js";
 import { createRequire } from "node:module";
 import fs, { accessSync, appendFileSync, closeSync, constants, copyFileSync, cpSync, createReadStream, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, watch, writeFileSync } from "node:fs";
 import { homedir, networkInterfaces, tmpdir } from "node:os";
@@ -17,6 +17,57 @@ import { DatabaseSync } from "node:sqlite";
 import { createServer } from "node:net";
 import { createRequire as createRequire$1 } from "module";
 import { versions } from "node:process";
+// ../../packages/contracts/src/tool-output.ts
+/**
+* Tool output kept in transcript pages, live updates and the browser's live transcript. The
+* rest is fetched on demand (§6, `GET /api/sessions/:id/items/:itemId/output`).
+*/
+const OUTPUT_PREVIEW_CHARS = 16e3;
+/**
+* Most tool output the server stores on an item while it streams. Older output is dropped past
+* this, so every chunk rewrites a bounded row however long the command runs.
+*/
+const STREAMED_OUTPUT_CHARS = 64e3;
+/** Size of `text` in UTF-8 bytes, as Node's `Buffer.byteLength` counts it (works in browsers). */
+function utf8ByteLength(text) {
+	let bytes = 0;
+	for (let i = 0; i < text.length; i++) {
+		const code = text.charCodeAt(i);
+		if (code < 128) bytes += 1;
+		else if (code < 2048) bytes += 2;
+		else if (code >= 55296 && code <= 56319 && isLowSurrogate(text.charCodeAt(i + 1))) {
+			bytes += 4;
+			i++;
+		} else bytes += 3;
+	}
+	return bytes;
+}
+const isLowSurrogate = (code) => code >= 56320 && code <= 57343;
+/**
+* Append a streamed output chunk, keeping only the last `max` characters (the end of command
+* output is the useful part), marking the output `truncated` once anything is dropped and
+* counting every byte seen in `totalBytes`. The work per chunk is bounded by `max` and the
+* chunk, never by the output streamed so far. Pure.
+*/
+function appendToolOutput(output, chunk, max) {
+	const prev = output?.text ?? "";
+	const totalBytes = (output?.totalBytes ?? utf8ByteLength(prev)) + utf8ByteLength(chunk);
+	if (prev.length + chunk.length <= max) return {
+		...output,
+		text: prev + chunk,
+		truncated: output?.truncated ?? false,
+		totalBytes
+	};
+	const keep = max - chunk.length;
+	let text = keep > 0 ? prev.slice(prev.length - keep) + chunk : chunk.slice(chunk.length - max);
+	if (isLowSurrogate(text.charCodeAt(0))) text = text.slice(1);
+	return {
+		...output,
+		text,
+		truncated: true,
+		totalBytes
+	};
+}
 // ../../packages/contracts/src/vision.ts
 const SECTIONS = [
 	[/^goals?\b/i, "goals"],
@@ -7627,7 +7678,9 @@ const turns = sqliteTable("turns", {
 	completedAt: text("completed_at"),
 	error: json$3("error"),
 	/** Usage reported for this turn (latest `usage.updated` with this turnId). */
-	usage: json$3("usage")
+	usage: json$3("usage"),
+	/** The provider's fork point at the end of the turn (`forkPoint` on its end event, §9). */
+	forkPoint: text("fork_point")
 }, (t) => [primaryKey({ columns: [t.sessionId, t.id] })]);
 const items = sqliteTable("items", {
 	sessionId: text("session_id").notNull(),
@@ -8158,11 +8211,7 @@ function applyDelta(item, delta) {
 			if (item.kind !== "tool_call") return item;
 			return {
 				...item,
-				output: {
-					...item.output,
-					text: (item.output?.text ?? "") + delta.text,
-					truncated: item.output?.truncated ?? false
-				}
+				output: appendToolOutput(item.output, delta.text, STREAMED_OUTPUT_CHARS)
 			};
 		case "tool_input": return item;
 	}
@@ -9811,7 +9860,8 @@ function reduceAgentEvent(reader, sessionId, event, ts) {
 				sessionId,
 				status: "running",
 				startedAt: d.getTurn(sessionId, event.turnId)?.startedAt ?? ts,
-				completedAt: null
+				completedAt: null,
+				forkPoint: null
 			});
 			if (isRootThread(d, sessionId, event.threadId)) setStatus(d, sessionId, "running", ts);
 			break;
@@ -9870,7 +9920,8 @@ function onTurnEnded(d, sessionId, event, ts) {
 		sessionId,
 		status,
 		completedAt: ts,
-		error
+		error,
+		forkPoint: event.forkPoint ?? null
 	});
 	for (const record of d.openRequestItems(sessionId)) {
 		if (record.turnId !== event.turnId || !isRequestItem(record.item)) continue;
@@ -12693,8 +12744,6 @@ function mountBrowserSockets(app, services, log) {
 	return bridge;
 }
 // ../server/src/services/sessions/preview.ts
-/** Tool output kept in transcript pages and live updates; the rest is fetched on demand (§6). */
-const OUTPUT_PREVIEW_CHARS = 16e3;
 /**
 * Trim large tool outputs to their last `max` characters (the end of command output is the
 * useful part) and mark them truncated with the full size. Pure.
@@ -12787,24 +12836,6 @@ function clientEvent(event, artifacts) {
 function asDelta(e) {
 	return e.type === "agent.item.delta" ? e.payload : void 0;
 }
-function deltaText(d) {
-	return d.type === "tool_input" ? d.partialJson : d.text;
-}
-function mergeable(a, b) {
-	if (a.itemId !== b.itemId || a.turnId !== b.turnId || a.threadId !== b.threadId) return false;
-	if (a.delta.type !== b.delta.type) return false;
-	if (a.delta.type === "tool_output" && b.delta.type === "tool_output") return a.delta.stream === b.delta.stream;
-	return true;
-}
-function withText(d, text) {
-	return d.type === "tool_input" ? {
-		...d,
-		partialJson: text
-	} : {
-		...d,
-		text
-	};
-}
 /**
 * Merge runs of consecutive text deltas for the same item into one event carrying the last
 * seq and timestamp, so a burst of streamed tokens reaches the UI as one update. Order is
@@ -12816,11 +12847,8 @@ function coalesceEvents(events) {
 		const prev = out.at(-1);
 		const a = prev ? asDelta(prev) : void 0;
 		const b = asDelta(event);
-		if (prev && a && b && prev.sessionId === event.sessionId && mergeable(a, b)) {
-			const merged = {
-				...b,
-				delta: withText(b.delta, deltaText(a.delta) + deltaText(b.delta))
-			};
+		const merged = prev && a && b && prev.sessionId === event.sessionId ? mergeItemDeltas(a, b) : void 0;
+		if (merged) {
 			out[out.length - 1] = {
 				...event,
 				payload: merged
@@ -13539,8 +13567,9 @@ function errorResponse(error, c, log) {
 }
 // ../server/src/routes/agent-config.ts
 /**
-* `/api/agent-config` (§12.4): provider memory files, skills, subagents, MCP servers and hooks
-* in their native files. Every overwrite and delete is backed up first; `diff` routes preview.
+* `/api/agent-config` (§12.4): provider memory files, skills (and their switches), subagents,
+* MCP servers and hooks in their native files. Every overwrite and delete is backed up first;
+* `diff` routes preview.
 */
 function agentConfigRoutes(s) {
 	const ac = s.agentConfig;
@@ -13556,7 +13585,7 @@ function agentConfigRoutes(s) {
 	}).post("/diff", jsonBody(AgentConfigDiffRequest), (c) => {
 		const { content, ...locator } = c.req.valid("json");
 		return c.json(ac.files.diff(locator, content));
-	}).get("/mcp", queryOf(AgentConfigListQuery.pick({ projectId: true })), (c) => c.json({ servers: ac.mcpList(c.req.valid("query").projectId) })).put("/mcp", jsonBody(McpServerUpsertRequest), (c) => c.json(ac.mcpUpsert(c.req.valid("json")))).delete("/mcp", queryOf(McpServerTarget), (c) => c.json(ac.mcpDelete(c.req.valid("query")))).post("/mcp/diff", jsonBody(McpServerDiffRequest), (c) => c.json(ac.mcpDiff(c.req.valid("json")))).post("/mcp/test", jsonBody(McpServerTestRequest), async (c) => c.json(await ac.mcpTest(c.req.valid("json")))).get("/hooks", queryOf(AgentConfigListQuery.pick({ projectId: true })), (c) => c.json(ac.hooks.list(c.req.valid("query").projectId))).post("/hooks/diff", jsonBody(HookChangeRequest), (c) => c.json(ac.hooks.diff(c.req.valid("json")))).post("/hooks", jsonBody(HookChangeRequest), (c) => c.json(ac.hooks.apply(c.req.valid("json"))));
+	}).get("/mcp", queryOf(AgentConfigListQuery.pick({ projectId: true })), (c) => c.json({ servers: ac.mcpList(c.req.valid("query").projectId) })).put("/mcp", jsonBody(McpServerUpsertRequest), (c) => c.json(ac.mcpUpsert(c.req.valid("json")))).delete("/mcp", queryOf(McpServerTarget), (c) => c.json(ac.mcpDelete(c.req.valid("query")))).post("/mcp/diff", jsonBody(McpServerDiffRequest), (c) => c.json(ac.mcpDiff(c.req.valid("json")))).post("/mcp/test", jsonBody(McpServerTestRequest), async (c) => c.json(await ac.mcpTest(c.req.valid("json")))).get("/hooks", queryOf(AgentConfigListQuery.pick({ projectId: true })), (c) => c.json(ac.hooks.list(c.req.valid("query").projectId))).post("/hooks/diff", jsonBody(HookChangeRequest), (c) => c.json(ac.hooks.diff(c.req.valid("json")))).post("/hooks", jsonBody(HookChangeRequest), (c) => c.json(ac.hooks.apply(c.req.valid("json")))).get("/skills", queryOf(AgentConfigListQuery.pick({ projectId: true })), (c) => c.json({ skills: ac.skills.list(c.req.valid("query").projectId) })).post("/skills/diff", jsonBody(SkillSwitchRequest), (c) => c.json(ac.skills.diff(c.req.valid("json")))).post("/skills", jsonBody(SkillSwitchRequest), (c) => c.json(ac.skills.apply(c.req.valid("json"))));
 }
 /**
 * `GET /api/sessions/:id/agent-config/loaded` and `GET /api/sessions/:id/commands` (the
@@ -23054,17 +23083,6 @@ function conflictRoutes(s) {
 	const conflicts = s.orchestration.conflicts;
 	return new Hono().get("/", queryOf(ListConflictsQuery), (c) => c.json(conflicts.list(c.req.valid("query")))).get("/:id", (c) => c.json(conflicts.get(c.req.param("id")))).post("/:id/resolve", jsonBody(ResolveConflictRequest), async (c) => c.json(await conflicts.resolve(c.req.param("id"), c.req.valid("json"))));
 }
-// ../server/src/routes/projects.ts
-/**
-* `/api/projects`: add from a folder or clone, list, reorder, update (and pin), archive, and
-* re-detect the folder's git checkout and GitHub remote (`refresh`, `disconnect-github`).
-*/
-function projectRoutes(s) {
-	return new Hono().get("/", queryOf(object({ archived: _enum(["true", "false"]).optional() })), (c) => c.json(s.projects.list({ includeArchived: c.req.valid("query").archived === "true" }))).post("/", jsonBody(CreateProjectRequest), async (c) => c.json(await s.projects.create(c.req.valid("json")), 201)).put("/order", jsonBody(ReorderProjectsRequest), (c) => c.json({ projects: s.projects.reorder(c.req.valid("json").projectIds) })).get("/:id", (c) => c.json(s.projects.get(c.req.param("id")))).patch("/:id", jsonBody(UpdateProjectRequest), (c) => c.json(s.projects.update(c.req.param("id"), c.req.valid("json")))).post("/:id/refresh", async (c) => c.json(await s.redetector.refresh(c.req.param("id")))).post("/:id/disconnect-github", async (c) => c.json(await s.projects.disconnectGithub(c.req.param("id")))).delete("/:id", (c) => {
-		s.projects.archive(c.req.param("id"));
-		return c.json({ ok: true });
-	});
-}
 // ../server/src/services/files/path-guard.ts
 const caseInsensitive$1 = process.platform === "win32" || process.platform === "darwin";
 /** Real path of `p`, or of its nearest existing ancestor with the rest appended. */
@@ -23180,6 +23198,19 @@ function readSessionFile(root, path) {
 		truncated: stat.size > MAX_READ_BYTES$2
 	};
 }
+// ../server/src/routes/projects.ts
+/**
+* `/api/projects`: add from a folder or clone, list, reorder, update (and pin), archive, and
+* re-detect the folder's git checkout and GitHub remote (`refresh`, `disconnect-github`).
+* `commands` and `files` feed the composer's `/` and `@` menus in the New session draft, before
+* the session and its worktree exist: they read the project folder.
+*/
+function projectRoutes(s) {
+	return new Hono().get("/", queryOf(object({ archived: _enum(["true", "false"]).optional() })), (c) => c.json(s.projects.list({ includeArchived: c.req.valid("query").archived === "true" }))).post("/", jsonBody(CreateProjectRequest), async (c) => c.json(await s.projects.create(c.req.valid("json")), 201)).put("/order", jsonBody(ReorderProjectsRequest), (c) => c.json({ projects: s.projects.reorder(c.req.valid("json").projectIds) })).get("/:id", (c) => c.json(s.projects.get(c.req.param("id")))).patch("/:id", jsonBody(UpdateProjectRequest), (c) => c.json(s.projects.update(c.req.param("id"), c.req.valid("json")))).get("/:id/commands", queryOf(ProjectCommandsQuery), (c) => c.json(s.agentConfig.projectSlashCommands(c.req.param("id"), c.req.valid("query").provider))).get("/:id/files", (c) => c.json(listSessionFiles(s.projects.get(c.req.param("id")).path))).post("/:id/refresh", async (c) => c.json(await s.redetector.refresh(c.req.param("id")))).post("/:id/disconnect-github", async (c) => c.json(await s.projects.disconnectGithub(c.req.param("id")))).delete("/:id", (c) => {
+		s.projects.archive(c.req.param("id"));
+		return c.json({ ok: true });
+	});
+}
 // ../server/src/services/sessions/workdir.ts
 /** Shown wherever a cleaned-up worktree is needed before the session is resumed. */
 const WORKTREE_REMOVED_MESSAGE = "This session's worktree was cleaned up. Send the session a message to recreate it from its branch.";
@@ -23428,10 +23459,13 @@ function sessionRoutes(s) {
 		const { item } = record;
 		if (item.kind !== "tool_call") throw badRequest("Only tool calls have output", "no_output");
 		const text = item.output?.text ?? "";
+		const totalBytes = Buffer.byteLength(text, "utf8");
 		const body = {
 			itemId: item.id,
 			text,
-			totalBytes: Buffer.byteLength(text, "utf8")
+			totalBytes,
+			truncated: item.output?.truncated ?? false,
+			outputBytes: Math.max(totalBytes, item.output?.totalBytes ?? totalBytes)
 		};
 		return c.json(body);
 	});
@@ -25215,13 +25249,15 @@ function unattendedAnswers(item) {
 }
 /**
 * A question the provider asked through its own tool (not `ask_user`) in an unattended
-* session: answer it straight away with {@link UNATTENDED_ANSWER}, so the turn never waits.
+* session: answer it straight away with {@link UNATTENDED_ANSWER}, so the turn never waits. An
+* MCP server's form is left alone: its answers would go to the server as data, so
+* `UnwatchedApprovals` withdraws it instead, as it denies approvals.
 */
 async function answerProviderQuestion(ctx, respond, e) {
 	if (e.type !== "agent.item.started" || !e.sessionId) return false;
 	const item = e.payload.item;
 	if (item?.kind !== "user_question" || item.deferred || item.status !== "in_progress") return false;
-	if (!unattendedSession(ctx, e.sessionId)) return false;
+	if (item.mcpServer || !unattendedSession(ctx, e.sessionId)) return false;
 	try {
 		await respond(e.sessionId, {
 			requestId: item.requestId,
@@ -26337,7 +26373,7 @@ function projectLines(s, now, indent = "") {
 const OWN_TAG = /<(\/?codeden_(?:status|updates))/gi;
 const neutralizeTags = (line) => line.replace(OWN_TAG, "‹$1");
 /** A tagged block: the opening tag, the escaped lines, the closing tag. */
-function block(open, close, lines) {
+function block$1(open, close, lines) {
 	return [
 		open,
 		...lines.map(neutralizeTags),
@@ -26347,7 +26383,7 @@ function block(open, close, lines) {
 /** The PM's digest for its project. */
 function renderProjectDigest(s, now = Date.now()) {
 	const at = new Date(now).toISOString();
-	return block(`<codeden_status project=${quote(neutralizeTags(s.project.name))} mode="${s.project.mode}" at="${at}">`, "</codeden_status>", projectLines(s, now));
+	return block$1(`<codeden_status project=${quote(neutralizeTags(s.project.name))} mode="${s.project.mode}" at="${at}">`, "</codeden_status>", projectLines(s, now));
 }
 /** The orchestrator's digest: every project rolled up. */
 function renderOverviewDigest(o, now = Date.now()) {
@@ -26362,7 +26398,7 @@ function renderOverviewDigest(o, now = Date.now()) {
 		lines.push("Informational PM messages:");
 		for (const m of o.pmMessages) lines.push(`- ${m.projectId ?? "?"}: ${quote(m.text, 300)}`);
 	}
-	return block(`<codeden_status scope="all projects" at="${new Date(now).toISOString()}">`, "</codeden_status>", lines);
+	return block$1(`<codeden_status scope="all projects" at="${new Date(now).toISOString()}">`, "</codeden_status>", lines);
 }
 /**
 * "Updates since your last turn": one entry per notice, for the model, inside
@@ -26375,7 +26411,7 @@ function renderNotices(list, projectName) {
 		const where = n.projectId && projectName ? ` [${projectName(n.projectId)}]` : "";
 		lines.push(`- (${n.type})${where} ${n.title}${noticeDetail(n)}`);
 	}
-	return block("<codeden_updates>", "</codeden_updates>", lines);
+	return block$1("<codeden_updates>", "</codeden_updates>", lines);
 }
 function noticeDetail(n) {
 	switch (n.type) {
@@ -26666,6 +26702,489 @@ const orchestratorTools = [
 	askPm,
 	listInbox
 ];
+// ../server/src/services/automations/sources.ts
+const FILE_SOURCES = ["global_file", "project_file"];
+/** Repo-relative folder of project automation files. */
+const PROJECT_AUTOMATIONS_DIR = join(".codeden", "automations");
+/** The definition fields that, when changed in a file, update the stored automation. */
+function definitionKey(a) {
+	return JSON.stringify([
+		a.name,
+		a.description,
+		a.templateId,
+		a.trigger,
+		a.action,
+		a.target,
+		a.guards,
+		a.workKey ?? null
+	]);
+}
+/**
+* Automation definitions from Markdown files (§10): global ones in `~/.codeden/automations/`
+* (they target all projects) and each project's `.codeden/automations/` (that project only).
+* They are mirrored into the `automations` projection through `automation.saved` /
+* `automation.deleted`, keeping the enabled flag (files never enable anything). Folders are
+* watched, with a periodic rescan for folders created later. Built-in templates are read once.
+*/
+var AutomationSources = class {
+	deps;
+	paths = /* @__PURE__ */ new Map();
+	errors = [];
+	builtin = [];
+	globalTemplates = [];
+	watchers = /* @__PURE__ */ new Map();
+	timer;
+	rescan;
+	constructor(deps) {
+		this.deps = deps;
+		const dir = findTemplatesDir(deps.templatesDir);
+		if (dir) {
+			const { files, errors } = readAutomationDir(dir);
+			this.builtin = files.map((f) => toTemplate(f, "builtin"));
+			for (const e of errors) deps.log?.(`automations: built-in template ${e.path}: ${e.message}`);
+		} else deps.log?.("automations: built-in templates folder not found");
+	}
+	/** Built-in templates, then global automation files. */
+	templates() {
+		const builtinIds = new Set(this.builtin.map((t) => t.id));
+		return [...this.builtin, ...this.globalTemplates.filter((t) => !builtinIds.has(t.id))];
+	}
+	template(id) {
+		return this.templates().find((t) => t.id === id);
+	}
+	fileErrors() {
+		return this.errors;
+	}
+	pathOf(automationId) {
+		return this.paths.get(automationId) ?? null;
+	}
+	start() {
+		this.reload();
+		const every = this.deps.rescanMs ?? 6e4;
+		if (every > 0) {
+			this.rescan = setInterval(() => this.reload(), every);
+			this.rescan.unref();
+		}
+	}
+	stop() {
+		if (this.timer) clearTimeout(this.timer);
+		if (this.rescan) clearInterval(this.rescan);
+		for (const w of this.watchers.values()) w.close();
+		this.watchers.clear();
+	}
+	/** Re-read every folder and sync the projection. Returns true when anything changed. */
+	reload() {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const errors = [];
+		const found = [];
+		const paths = /* @__PURE__ */ new Map();
+		const add = (file, base) => {
+			const { parsed } = file;
+			found.push({
+				...base,
+				name: parsed.frontmatter.name,
+				description: parsed.frontmatter.description ?? null,
+				enabled: false,
+				templateId: parsed.id,
+				trigger: parsed.frontmatter.trigger,
+				action: parsed.action,
+				guards: parsed.guards,
+				workKey: parsed.workKey,
+				createdAt: now,
+				updatedAt: now
+			});
+			paths.set(base.id, file.path);
+		};
+		const global = readAutomationDir(this.deps.globalDir);
+		errors.push(...global.errors);
+		this.globalTemplates = global.files.map((f) => toTemplate(f, "global_file"));
+		for (const file of global.files) add(file, {
+			id: `global:${file.parsed.id}`,
+			source: "global_file",
+			target: { type: "all_projects" }
+		});
+		const dirs = [this.deps.globalDir];
+		for (const project of this.deps.projects.list()) {
+			if (project.archivedAt) continue;
+			const dir = join(project.path, PROJECT_AUTOMATIONS_DIR);
+			dirs.push(dir);
+			const local = readAutomationDir(dir);
+			errors.push(...local.errors);
+			for (const file of local.files) add(file, {
+				id: `project:${project.id}:${file.parsed.id}`,
+				source: "project_file",
+				target: {
+					type: "project",
+					projectId: project.id
+				}
+			});
+		}
+		this.errors = errors;
+		this.paths.clear();
+		for (const [k, v] of paths) this.paths.set(k, v);
+		this.watchDirs(dirs);
+		return this.sync(found);
+	}
+	/** Store new or changed file definitions and delete those whose file is gone. */
+	sync(found) {
+		const existing = new Map(this.deps.db.select().from(automations).where(inArray(automations.source, [...FILE_SOURCES])).all().map((r) => {
+			const a = rowToAutomation(r);
+			return [a.id, a];
+		}));
+		const events = [];
+		for (const next of found) {
+			const prev = existing.get(next.id);
+			existing.delete(next.id);
+			if (prev && definitionKey(prev) === definitionKey(next)) continue;
+			const automation = prev ? {
+				...next,
+				enabled: prev.enabled,
+				createdAt: prev.createdAt
+			} : next;
+			events.push({
+				type: "automation.saved",
+				sessionId: null,
+				payload: { automation }
+			});
+		}
+		for (const gone of existing.keys()) events.push({
+			type: "automation.deleted",
+			sessionId: null,
+			payload: { automationId: gone }
+		});
+		if (events.length === 0) return false;
+		this.deps.store.append(events);
+		this.deps.onChange?.();
+		return true;
+	}
+	watchDirs(dirs) {
+		const wanted = new Set(dirs.filter((d) => existsSync(d)));
+		for (const [dir, watcher] of this.watchers) if (!wanted.has(dir)) {
+			watcher.close();
+			this.watchers.delete(dir);
+		}
+		for (const dir of wanted) {
+			if (this.watchers.has(dir)) continue;
+			try {
+				const watcher = watch(dir, () => this.scheduleReload());
+				watcher.on("error", () => {
+					watcher.close();
+					this.watchers.delete(dir);
+				});
+				this.watchers.set(dir, watcher);
+			} catch (error) {
+				this.deps.log?.(`automations: cannot watch ${dir}: ${errorMessage$1(error)}`);
+			}
+		}
+	}
+	scheduleReload() {
+		if (this.timer) clearTimeout(this.timer);
+		this.timer = setTimeout(() => {
+			this.timer = void 0;
+			try {
+				this.reload();
+			} catch (error) {
+				this.deps.log?.(`automations: reload failed: ${errorMessage$1(error)}`);
+			}
+		}, 200);
+		this.timer.unref();
+	}
+};
+/** True when a project can run a template (GitHub-only templates need a GitHub project). */
+function templateFits(template, project) {
+	return !template.requiresGithub || project.kind === "github";
+}
+// ../server/src/services/automations/definitions.ts
+/** Id of a project's starter automation created from a template. */
+function starterId(projectId, templateId) {
+	return `starter:${projectId}:${templateId}`;
+}
+/** The fields that decide what an automation does, when and how often. */
+const BEHAVIOUR_FIELDS = [
+	"trigger",
+	"action",
+	"guards"
+];
+/**
+* Database-stored automations (§10): create (from a template or from scratch), update,
+* delete, enable and disable, and the starter set offered to new projects. File-based
+* automations are read-only here except for their enabled switch.
+*/
+var AutomationDefinitions = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	all() {
+		return this.deps.db.select().from(automations).all().map(rowToAutomation);
+	}
+	find(id) {
+		const row = this.deps.db.select().from(automations).where(eq(automations.id, id)).get();
+		return row ? rowToAutomation(row) : void 0;
+	}
+	get(id) {
+		const a = this.find(id);
+		if (!a) throw notFound(`No automation ${id}`, "automation_not_found");
+		return a;
+	}
+	create(req, opts = {}) {
+		const id = opts.id ?? randomUUID();
+		const template = req.templateId ? this.template(req.templateId) : void 0;
+		if (req.projectId) this.deps.projects.get(req.projectId);
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const trigger = req.trigger ?? template?.trigger;
+		const action = req.action ?? template?.action;
+		const name = req.name ?? template?.name;
+		if (!trigger || !action || !name) throw badRequest("name, trigger and action are required");
+		const automation = Automation.parse({
+			id,
+			name,
+			description: req.description !== void 0 ? req.description : template?.description ?? null,
+			enabled: req.enabled,
+			source: "database",
+			templateId: template?.id ?? null,
+			trigger,
+			action,
+			target: req.projectId ? {
+				type: "project",
+				projectId: req.projectId
+			} : { type: "all_projects" },
+			guards: AutomationGuards.parse({
+				...template?.guards,
+				...req.guards
+			}),
+			workKey: req.workKey ?? template?.workKey,
+			...opts.createdBy && opts.createdBy !== "user" ? { createdBy: opts.createdBy } : {},
+			createdAt: now,
+			updatedAt: now
+		});
+		validateAutomation(automation);
+		return this.save(automation);
+	}
+	update(id, req, opts = {}) {
+		const current = this.editable(id);
+		if (req.target?.type === "project") this.deps.projects.get(req.target.projectId);
+		const { workKey: _drop, ...rest } = current;
+		const workKey = req.workKey === null ? void 0 : req.workKey ?? current.workKey;
+		const next = Automation.parse({
+			...rest,
+			...req.name !== void 0 ? { name: req.name } : {},
+			...req.description !== void 0 ? { description: req.description } : {},
+			...req.trigger ? { trigger: req.trigger } : {},
+			...req.action ? { action: req.action } : {},
+			...req.target ? { target: req.target } : {},
+			guards: AutomationGuards.parse({
+				...current.guards,
+				...req.guards
+			}),
+			...workKey ? { workKey } : {},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		validateAutomation(next);
+		const switchOff = opts.switchOffOnChange && next.enabled && BEHAVIOUR_FIELDS.some((key) => req[key] !== void 0 && !isDeepStrictEqual(current[key], next[key]));
+		return this.save(switchOff ? {
+			...next,
+			enabled: false
+		} : next);
+	}
+	remove(id) {
+		this.editable(id);
+		this.deps.store.append([{
+			type: "automation.deleted",
+			sessionId: null,
+			payload: { automationId: id }
+		}]);
+		this.deps.schedules.removeAutomation(id);
+	}
+	/**
+	* Enable or disable. With `projectId` on an automation that targets all projects, only that
+	* project's override changes; otherwise the automation's own switch.
+	*/
+	setEnabled(id, enabled, projectId) {
+		const a = this.get(id);
+		if (projectId) this.deps.projects.get(projectId);
+		if (projectId && a.target.type === "all_projects") {
+			this.deps.schedules.upsert(id, projectId, { enabledOverride: enabled });
+			return a;
+		}
+		if (projectId && a.target.type === "project" && a.target.projectId !== projectId) throw notFound(`Automation ${id} does not belong to that project`, "automation_not_found");
+		if (a.enabled === enabled) return a;
+		return this.save({
+			...a,
+			enabled,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	}
+	/** Drop a project's override of an all-projects automation; it follows its own switch again. */
+	clearOverride(id, projectId) {
+		const a = this.get(id);
+		this.deps.projects.get(projectId);
+		if (a.target.type !== "all_projects") throw conflict("Only automations for all projects have per-project overrides", "no_override");
+		this.deps.schedules.upsert(id, projectId, { enabledOverride: null });
+		return a;
+	}
+	/**
+	* Create the project's starter set (§10) from the starter templates that fit the project,
+	* keeping existing ones; with `enable`, switch them all on.
+	*/
+	starterSet(projectId, enable) {
+		const project = this.deps.projects.get(projectId);
+		const out = [];
+		for (const template of this.deps.sources.templates()) {
+			if (!template.starter || template.source !== "builtin" || !templateFits(template, project)) continue;
+			const id = starterId(projectId, template.id);
+			const existing = this.find(id);
+			if (existing) {
+				out.push(enable ? this.setEnabled(id, true) : existing);
+				continue;
+			}
+			out.push(this.create({
+				templateId: template.id,
+				projectId,
+				enabled: enable
+			}, { id }));
+		}
+		return out;
+	}
+	/**
+	* An editable database copy of any automation (also file-based and built-in ones), off,
+	* named "<name> (copy)" unless a name is given. Targets `projectId`, else the original's
+	* target. The copy keeps the original's work key, so the two never run the same work at once.
+	*/
+	duplicate(id, req) {
+		const a = this.get(id);
+		const projectId = req.projectId ?? (a.target.type === "project" ? a.target.projectId : void 0);
+		return this.create({
+			projectId,
+			name: req.name ?? `${a.name} (copy)`.slice(0, 200),
+			description: a.description,
+			trigger: a.trigger,
+			action: a.action,
+			guards: a.guards,
+			workKey: a.workKey,
+			enabled: false
+		});
+	}
+	/**
+	* Import shared automation files (§10): re-parse the source with the file parser, then
+	* create each selected valid file as a database automation, always off and marked
+	* `createdBy: import`. Nothing runs.
+	*/
+	importFrom(req) {
+		if (req.projectId) this.deps.projects.get(req.projectId);
+		const select = req.select ? new Set(req.select) : null;
+		const items = previewImport(req.source).filter((i) => !select || select.has(i.fileName));
+		const created = [];
+		const failed = [];
+		for (const item of items) {
+			const draft = item.automation;
+			if (!draft) {
+				failed.push({
+					fileName: item.fileName,
+					error: item.error ?? "Invalid file"
+				});
+				continue;
+			}
+			created.push(this.create({
+				projectId: req.projectId,
+				name: draft.name,
+				description: draft.description,
+				trigger: draft.trigger,
+				action: draft.action,
+				guards: draft.guards,
+				workKey: draft.workKey,
+				enabled: false
+			}, { createdBy: "import" }));
+		}
+		return {
+			created,
+			failed
+		};
+	}
+	/** Parse an import without saving anything. */
+	previewImport(req) {
+		return previewImport(req);
+	}
+	template(id) {
+		const template = this.deps.sources.template(id);
+		if (!template) throw notFound(`No automation template ${id}`, "template_not_found");
+		return template;
+	}
+	editable(id) {
+		const a = this.get(id);
+		if (a.source !== "database") throw conflict("This automation is defined in a file; edit the file instead", "automation_read_only");
+		return a;
+	}
+	save(automation) {
+		this.deps.store.append([{
+			type: "automation.saved",
+			sessionId: null,
+			payload: { automation }
+		}]);
+		return automation;
+	}
+};
+// ../server/src/services/automations/pm-change-notice.ts
+const MAX_VALUE = 120;
+/** Inbox id of the notice about a PM's change to an automation; the next change replaces it. */
+function pmChangeInboxId(automationId) {
+	return `inbox:automation-changed:${automationId}`;
+}
+/** `path: before → after` for each trigger, action and guard setting that differs. */
+function automationChanges(before, after) {
+	const was = /* @__PURE__ */ new Map();
+	const now = /* @__PURE__ */ new Map();
+	for (const key of BEHAVIOUR_FIELDS) {
+		flatten(before[key], key, was);
+		flatten(after[key], key, now);
+	}
+	const out = [];
+	for (const path of /* @__PURE__ */ new Set([...was.keys(), ...now.keys()])) {
+		if (was.get(path) === now.get(path)) continue;
+		out.push(`${path}: ${shorten(was.get(path))} → ${shorten(now.get(path))}`);
+	}
+	return out;
+}
+function flatten(value, path, out) {
+	if (value === void 0) return;
+	if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+		for (const [key, v] of Object.entries(value)) flatten(v, `${path}.${key}`, out);
+		return;
+	}
+	out.set(path, JSON.stringify(value));
+}
+function shorten(text) {
+	if (text === void 0) return "none";
+	return text.length > MAX_VALUE ? `${text.slice(0, 119)}…` : text;
+}
+/**
+* The inbox item telling the user that the PM changed what an automation that was on does, so
+* it was switched off (§10): what changed, and that it runs again only once they switch it on.
+*/
+function pmChangeInbox(before, after, by, now) {
+	const name = after.name.length > 80 ? `${after.name.slice(0, 79)}…` : after.name;
+	return {
+		id: pmChangeInboxId(after.id),
+		kind: "message",
+		status: "open",
+		priority: "normal",
+		notify: "needs_you",
+		title: `Automation switched off: the project manager changed "${name}"`,
+		body: ["The project manager changed what this automation does, so it was switched off. It runs again only once you switch it on in Automations.", `Changed: ${automationChanges(before, after).join("; ")}.`].join("\n"),
+		projectId: by.projectId,
+		sessionId: by.sessionId,
+		threadId: null,
+		itemId: null,
+		requestId: null,
+		issue: null,
+		pr: null,
+		automationRunId: null,
+		createdAt: now,
+		updatedAt: now,
+		resolvedAt: null,
+		resolution: null
+	};
+}
 // ../server/src/mcp/tools/pm/automation-edit.ts
 const fields = {
 	name: string().trim().min(1).max(200),
@@ -26709,10 +27228,14 @@ const createAutomation = defineTool({
 		};
 	}
 });
-/** `update_automation` (§10): change an automation created in CodeDen (not a file). */
+/**
+* `update_automation` (§10): change an automation of this project created in CodeDen (not a
+* file). A change to what an automation that is on does (trigger, action, guards) switches it
+* off and tells the user, who switches it on again; automations for all projects are the user's.
+*/
 const updateAutomation = defineTool({
 	name: "update_automation",
-	description: "Change an automation of this project that lives in CodeDen (not a .md file): any of name, description, trigger, action, guards or work key. Validated like automation files. Does not switch it on or off. File-based automations are edited in their file.",
+	description: "Change an automation of this project that lives in CodeDen (not a .md file): any of name, description, trigger, action, guards or work key. Validated like automation files. Changing the trigger, action or guards of an automation that is on switches it OFF: tell the user, who reviews the change (it is in their inbox) and switches it on again in Automations. Renaming or a new description keeps it as it is. File-based automations are edited in their file; automations for all projects only by the user.",
 	roles: ["pm"],
 	scope: "project",
 	input: object({
@@ -26724,12 +27247,21 @@ const updateAutomation = defineTool({
 		guards: fields.guards.optional(),
 		workKey: fields.workKey.optional()
 	}),
-	handler: async ({ automationId, ...patch }, { services, projectId }) => {
+	handler: async ({ automationId, ...patch }, { services, projectId, sessionId }) => {
 		const current = services.automations.definitions.get(automationId);
-		if (current.target.type === "project" && current.target.projectId !== projectId) throw new Error(`Automation ${automationId} belongs to another project`);
-		const updated = services.automations.definitions.update(automationId, patch);
+		if (current.target.type === "all_projects") throw new ToolError(`Automation ${automationId} runs in all projects; only the user changes it, in Automations`);
+		if (current.target.projectId !== projectId) throw new ToolError(`Automation ${automationId} belongs to another project`);
+		const updated = services.automations.definitions.update(automationId, patch, { switchOffOnChange: true });
 		services.automations.refresh();
-		return { updated: summary(updated) };
+		if (!current.enabled || updated.enabled) return { updated: summary(updated) };
+		services.inbox.put(pmChangeInbox(current, updated, {
+			projectId,
+			sessionId
+		}, (/* @__PURE__ */ new Date()).toISOString()));
+		return {
+			updated: summary(updated),
+			note: "Switched off because it was on and you changed what it does. The user reviews the change in their inbox and switches it on again in Automations."
+		};
 	}
 });
 // ../server/src/mcp/tools/pm/automations.ts
@@ -28045,6 +28577,15 @@ function codexUserSkills(home) {
 	const r = homeRoot(home);
 	return [...skillsIn(r, join(home, ".codex", "skills"), "codex", "user"), ...skillsIn(r, join(home, ".agents", "skills"), "codex", "user")];
 }
+/** Every provider's user skills, plus the project's (the Skills tab's switches). */
+function listSkills(home, project) {
+	const r = project ? projectRoot(project) : null;
+	return [
+		...skillsIn(homeRoot(home), join(home, ".claude", "skills"), "claude", "user"),
+		...codexUserSkills(home),
+		...project && r ? [...skillsIn(r, join(project.path, ".claude", "skills"), "claude", "project"), ...skillsIn(r, join(project.path, ".agents", "skills"), "codex", "project")] : []
+	];
+}
 /** Dedupe by absolute path (case-insensitively on Windows and macOS), keeping the first. */
 function unique(items, key) {
 	const seen = /* @__PURE__ */ new Set();
@@ -28969,7 +29510,7 @@ function skipSpace(text, at) {
 	return i;
 }
 /** End offset (exclusive) of the string starting at `at` (an opening quote). */
-function skipString(text, at) {
+function skipString$1(text, at) {
 	let i = at + 1;
 	while (i < text.length) {
 		const ch = text[i];
@@ -28982,14 +29523,14 @@ function skipString(text, at) {
 /** End offset (exclusive) of the JSON value starting at `at`. */
 function skipValue(text, at) {
 	const ch = text[at];
-	if (ch === "\"") return skipString(text, at);
+	if (ch === "\"") return skipString$1(text, at);
 	if (ch === "{" || ch === "[") {
 		let depth = 0;
 		let i = at;
 		while (i < text.length) {
 			const c = text[i];
 			if (c === "\"") {
-				i = skipString(text, i);
+				i = skipString$1(text, i);
 				continue;
 			}
 			if (c === "{" || c === "[") depth++;
@@ -29014,7 +29555,7 @@ function scanTopLevel(text) {
 	while (text[i] !== "}") {
 		if (text[i] !== "\"") throw new Error(`Unexpected character at ${i}`);
 		const keyStart = i;
-		const keyEnd = skipString(text, i);
+		const keyEnd = skipString$1(text, i);
 		const key = JSON.parse(text.slice(keyStart, keyEnd));
 		i = skipSpace(text, keyEnd);
 		if (text[i] !== ":") throw new Error(`Expected ':' at ${i}`);
@@ -29080,14 +29621,14 @@ function setTopLevelMember(text, key, value) {
 	return text.slice(0, last.valueEnd) + comma + member + body + text.slice(last.valueEnd);
 }
 // ../server/src/services/agent-config/hooks.ts
-const isRecord$1 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-const isGroup = (v) => isRecord$1(v) && Array.isArray(v.hooks);
+const isRecord$2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const isGroup = (v) => isRecord$2(v) && Array.isArray(v.hooks);
 /**
 * A group's matcher exactly as written (whitespace can matter in a regex); missing or empty
 * means "match everything".
 */
 const matcherOf = (m) => typeof m === "string" && m !== "" ? m : null;
-const unparsable = (file, why) => new ServiceError(422, "config_unparsable", `${file} could not be parsed: ${why}`);
+const unparsable$2 = (file, why) => new ServiceError(422, "config_unparsable", `${file} could not be parsed: ${why}`);
 /** Claude Code's settings file for a scope. */
 function claudeHookFile(scope, home, project) {
 	if (scope === "user" || !project) return {
@@ -29149,7 +29690,7 @@ function unusableSource(f, error) {
 		error
 	};
 }
-function load$1(file) {
+function load$3(file) {
 	if (!existsSync(file)) return {
 		text: null,
 		doc: {}
@@ -29163,10 +29704,10 @@ function load$1(file) {
 	try {
 		doc = JSON.parse(text.replace(/^/, ""));
 	} catch (error) {
-		throw unparsable(file, error instanceof Error ? error.message : String(error));
+		throw unparsable$2(file, error instanceof Error ? error.message : String(error));
 	}
-	if (!isRecord$1(doc)) throw unparsable(file, "not a JSON object");
-	if (doc.hooks !== void 0 && !isRecord$1(doc.hooks)) throw unparsable(file, "`hooks` is not an object");
+	if (!isRecord$2(doc)) throw unparsable$2(file, "not a JSON object");
+	if (doc.hooks !== void 0 && !isRecord$2(doc.hooks)) throw unparsable$2(file, "`hooks` is not an object");
 	return {
 		text,
 		doc
@@ -29182,7 +29723,7 @@ function readHookFile(f) {
 	};
 	let loaded;
 	try {
-		loaded = load$1(f.file);
+		loaded = load$3(f.file);
 	} catch (error) {
 		return {
 			source: unusableSource(f, error instanceof Error ? error.message : String(error)),
@@ -29197,7 +29738,7 @@ function readHookFile(f) {
 	};
 	const disableAllHooks = typeof doc.disableAllHooks === "boolean" ? { disableAllHooks: doc.disableAllHooks } : {};
 	const hooks = [];
-	for (const [event, groups] of Object.entries(isRecord$1(doc.hooks) ? doc.hooks : {})) {
+	for (const [event, groups] of Object.entries(isRecord$2(doc.hooks) ? doc.hooks : {})) {
 		if (!Array.isArray(groups)) continue;
 		groups.forEach((group, groupIndex) => {
 			if (!isGroup(group)) return;
@@ -29225,8 +29766,8 @@ function readHookFile(f) {
 }
 /** The file text before and after applying `mutate` to its `hooks` object. */
 function renderHookChange(file, mutate) {
-	const { text, doc } = load$1(file);
-	const current = isRecord$1(doc.hooks) ? doc.hooks : {};
+	const { text, doc } = load$3(file);
+	const current = isRecord$2(doc.hooks) ? doc.hooks : {};
 	const hooks = structuredClone(current);
 	mutate(hooks);
 	const before = text ?? "";
@@ -29251,7 +29792,7 @@ function groupsOf(hooks, event, file) {
 		hooks[event] = [];
 		return hooks[event];
 	}
-	if (!Array.isArray(existing)) throw unparsable(file, `\`hooks.${event}\` is not a list`);
+	if (!Array.isArray(existing)) throw unparsable$2(file, `\`hooks.${event}\` is not a list`);
 	return existing;
 }
 /** Append a handler to the first group of `event` with the same matcher, or to a new group. */
@@ -29270,7 +29811,7 @@ function locate(hooks, file, t) {
 	const groups = hooks[t.event];
 	const group = Array.isArray(groups) ? groups[t.groupIndex] : void 0;
 	const current = isGroup(group) ? group.hooks[t.handlerIndex] : void 0;
-	if (!Array.isArray(groups) || !isGroup(group) || !isRecord$1(current)) throw notFound(`No such ${t.event} hook in ${file}; reload the list`, "hook_not_found");
+	if (!Array.isArray(groups) || !isGroup(group) || !isRecord$2(current)) throw notFound(`No such ${t.event} hook in ${file}; reload the list`, "hook_not_found");
 	if (!isDeepStrictEqual(current, t.expected)) throw conflict(`The hook changed in ${file} since it was listed; reload the list`, "hook_changed");
 	return {
 		groups,
@@ -29478,7 +30019,7 @@ var AgentConfigHooks = class {
 };
 /**
 * Refuse (403 `path_outside_root`) a settings file whose real path, following links on the file
-* and on every existing ancestor, leaves its scope's folder.
+* and on every existing ancestor, leaves its scope's folder. Also used for skill switches.
 */
 function guard(f) {
 	try {
@@ -36175,7 +36716,7 @@ function qo(e, t) {
 	return n.leadingBom ? `${i}` : i;
 }
 // ../server/src/services/agent-config/toml-edit.ts
-const isTable = (v) => typeof v === "object" && v !== null && !Array.isArray(v) && !(v instanceof Date);
+const isTable$1 = (v) => typeof v === "object" && v !== null && !Array.isArray(v) && !(v instanceof Date);
 const bare = (key) => /^[A-Za-z0-9_-]+$/.test(key) ? key : JSON.stringify(key);
 const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 /** `[mcp_servers.<name>]` with scalars and arrays, then one sub-table per flat map (env, headers). */
@@ -36184,11 +36725,11 @@ function serverBlock(name, server) {
 	const lines = [`[${head}]`];
 	const tables = [];
 	for (const [key, value] of Object.entries(server)) {
-		if (!isTable(value)) {
+		if (!isTable$1(value)) {
 			lines.push(qo({ [key]: value }).trim());
 			continue;
 		}
-		if (Object.values(value).some(isTable)) return null;
+		if (Object.values(value).some(isTable$1)) return null;
 		tables.push("", `[${head}.${bare(key)}]`);
 		for (const [k, v] of Object.entries(value)) tables.push(qo({ [k]: v }).trim());
 	}
@@ -36269,7 +36810,7 @@ function trimBlankRuns(lines) {
 */
 function editTomlServer(text, name, server) {
 	const doc = Ko(text);
-	const servers = isTable(doc.mcp_servers) ? { ...doc.mcp_servers } : {};
+	const servers = isTable$1(doc.mcp_servers) ? { ...doc.mcp_servers } : {};
 	if (server) servers[name] = server;
 	else delete servers[name];
 	const expected = {
@@ -36279,14 +36820,14 @@ function editTomlServer(text, name, server) {
 	if (!server && Object.keys(servers).length === 0) delete expected.mcp_servers;
 	const edited = blockEdit(text, name, server);
 	if (edited !== null) try {
-		if (isDeepStrictEqual(normalize(Ko(edited)), normalize(expected))) return edited;
+		if (isDeepStrictEqual(normalize$1(Ko(edited)), normalize$1(expected))) return edited;
 	} catch {}
 	return Ja(text, expected);
 }
 /** Plain JSON view for comparisons (dates become strings, empty `mcp_servers` dropped). */
-function normalize(value) {
+function normalize$1(value) {
 	const plain = JSON.parse(JSON.stringify(value));
-	if (isTable(plain.mcp_servers) && Object.keys(plain.mcp_servers).length === 0) delete plain.mcp_servers;
+	if (isTable$1(plain.mcp_servers) && Object.keys(plain.mcp_servers).length === 0) delete plain.mcp_servers;
 	return plain;
 }
 // ../server/src/services/agent-config/mcp.ts
@@ -36308,8 +36849,8 @@ const CODEX_TRANSPORT = [
 	"bearer_token_env_var",
 	"enabled"
 ];
-const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-const strings = (v) => isRecord(v) ? Object.fromEntries(Object.entries(v).map(([k, x]) => [k, String(x)])) : void 0;
+const isRecord$1 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const strings = (v) => isRecord$1(v) ? Object.fromEntries(Object.entries(v).map(([k, x]) => [k, String(x)])) : void 0;
 const stringList = (v) => Array.isArray(v) ? v.map((x) => String(x)) : void 0;
 const omit$1 = (o, keys) => Object.fromEntries(Object.entries(o).filter(([k]) => !keys.includes(k)));
 const compact = (o) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0));
@@ -36376,11 +36917,11 @@ function toNative(provider, spec, existing = {}) {
 /** `~/.claude.json` keys projects by path with forward slashes on Windows. */
 function claudeProjectKey(doc, projectPath) {
 	const key = process.platform === "win32" ? projectPath.replace(/\\/g, "/") : projectPath;
-	const projects = isRecord(doc.projects) ? doc.projects : {};
+	const projects = isRecord$1(doc.projects) ? doc.projects : {};
 	const fold = (s) => process.platform === "linux" ? s : s.toLowerCase();
 	return Object.keys(projects).find((k) => fold(k) === fold(key)) ?? key;
 }
-function load(source) {
+function load$2(source) {
 	if (!existsSync(source.file)) return {
 		text: null,
 		doc: {}
@@ -36388,7 +36929,7 @@ function load(source) {
 	const text = readFileSync(source.file, "utf8");
 	try {
 		const doc = source.format === "json" ? JSON.parse(text) : Ko(text);
-		if (!isRecord(doc)) throw new Error("not an object");
+		if (!isRecord$1(doc)) throw new Error("not an object");
 		return {
 			text,
 			doc
@@ -36401,7 +36942,7 @@ function tableAt(doc, keyPath, create) {
 	let node = doc;
 	for (const key of keyPath) {
 		const next = node[key];
-		if (!isRecord(next)) {
+		if (!isRecord$1(next)) {
 			if (!create) return void 0;
 			node[key] = {};
 		}
@@ -36411,8 +36952,8 @@ function tableAt(doc, keyPath, create) {
 }
 /** The servers defined in one source. */
 function readServers(source) {
-	const table = tableAt(load(source).doc, source.keyPath, false) ?? {};
-	return Object.entries(table).filter(([, native]) => isRecord(native)).map(([name, native]) => ({
+	const table = tableAt(load$2(source).doc, source.keyPath, false) ?? {};
+	return Object.entries(table).filter(([, native]) => isRecord$1(native)).map(([name, native]) => ({
 		provider: source.provider,
 		scope: source.scope,
 		name,
@@ -36423,12 +36964,12 @@ function readServers(source) {
 }
 /** The new file text for an upsert (`spec`) or removal (no `spec`). Pure apart from reading. */
 function renderChange(source, name, spec) {
-	const { text, doc } = load(source);
+	const { text, doc } = load$2(source);
 	const table = tableAt(doc, source.keyPath, spec !== void 0);
 	const current = table?.[name];
 	if (!spec && !(table && name in table)) throw new ServiceError(404, "server_not_found", `No MCP server named ${name} in ${source.file}`);
-	const native = spec ? toNative(source.provider, spec, isRecord(current) ? current : {}) : void 0;
-	if (native && isRecord(current) && isDeepStrictEqual(native, current)) return {
+	const native = spec ? toNative(source.provider, spec, isRecord$1(current) ? current : {}) : void 0;
+	if (native && isRecord$1(current) && isDeepStrictEqual(native, current)) return {
 		before: text ?? "",
 		after: text ?? "",
 		existed: text !== null
@@ -36498,7 +37039,7 @@ function sourceFor(target, home, project) {
 		format: "json",
 		keyPath: [
 			"projects",
-			claudeProjectKey(existsSync(claudeJson) ? load({
+			claudeProjectKey(existsSync(claudeJson) ? load$2({
 				file: claudeJson,
 				format: "json"
 			}).doc : {}, project.path),
@@ -36507,6 +37048,540 @@ function sourceFor(target, home, project) {
 		projectId: project.id
 	};
 }
+// ../server/src/services/agent-config/skill-overrides.ts
+const VALUES = /* @__PURE__ */ new Set([
+	"on",
+	"name-only",
+	"user-invocable-only",
+	"off"
+]);
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const unparsable$1 = (file, why) => new ServiceError(422, "config_unparsable", `${file} could not be parsed: ${why}`);
+function load$1(file) {
+	if (!existsSync(file)) return {
+		text: null,
+		doc: {},
+		overrides: {}
+	};
+	const text = readFileSync(file, "utf8");
+	if (!text.trim()) return {
+		text,
+		doc: {},
+		overrides: {}
+	};
+	let doc;
+	try {
+		doc = JSON.parse(text.replace(/^/, ""));
+	} catch (error) {
+		throw unparsable$1(file, errorMessage$1(error));
+	}
+	if (!isRecord(doc)) throw unparsable$1(file, "not a JSON object");
+	const overrides = isRecord(doc.skillOverrides) ? doc.skillOverrides : {};
+	return {
+		text,
+		doc,
+		overrides
+	};
+}
+/**
+* Read a settings file's overrides. For listing, a file that can't be used sets nothing. With
+* `strict` (planning a switch) its error is thrown instead: 403 `path_outside_root` for a link
+* leading outside its folder, 422 `config_unparsable` for a file that doesn't parse. A switch
+* must never pick its target while a file that applies can't be read, or it could write the
+* wrong file.
+*/
+function readOverrides(source, strict = false) {
+	try {
+		guard(source);
+		const { overrides } = load$1(source.file);
+		const known = Object.entries(overrides).filter((e) => typeof e[1] === "string" && VALUES.has(e[1]));
+		return {
+			source,
+			overrides: new Map(known)
+		};
+	} catch (error) {
+		if (strict) throw error;
+		return {
+			source,
+			overrides: /* @__PURE__ */ new Map(),
+			error: errorMessage$1(error)
+		};
+	}
+}
+/**
+* Settings files from highest precedence to lowest, given them lowest first (user, project,
+* local…): local files keep their order (the repository-root one wins over an older one in the
+* working folder), then project, then user.
+*/
+function highestFirst(files) {
+	return [...files.filter((f) => f.source.scope === "local"), ...files.filter((f) => f.source.scope !== "local").reverse()];
+}
+/** The file (highest precedence first) that decides a skill name, and its value. */
+function decidingOverride(highest, name) {
+	for (const file of highest) {
+		const value = file.overrides.get(name);
+		if (value) return {
+			file,
+			value
+		};
+	}
+	return null;
+}
+/** The value to write for a switch, and where (`userFile` when no file decides the name). */
+function planOverride(files, userFile, name, enabled) {
+	const highest = highestFirst(files);
+	const deciding = decidingOverride(highest, name);
+	const target = deciding?.file.source ?? userFile;
+	if (!enabled) return {
+		target,
+		value: "off"
+	};
+	const lower = decidingOverride(deciding ? highest.slice(highest.indexOf(deciding.file) + 1) : [], name)?.value;
+	return {
+		target,
+		value: lower && lower !== "on" ? "on" : void 0
+	};
+}
+/**
+* The file text before and after setting (or, with `value` undefined, removing) one skill's
+* entry in `skillOverrides`. Everything outside that value is kept byte for byte.
+*/
+function renderOverride(file, name, value) {
+	const { text, overrides } = load$1(file);
+	const entries = Object.entries(overrides);
+	const at = entries.findIndex(([key]) => key === name);
+	if (value === void 0) {
+		if (at >= 0) entries.splice(at, 1);
+	} else if (at >= 0) entries[at] = [name, value];
+	else entries.push([name, value]);
+	const next = Object.fromEntries(entries);
+	const before = text ?? "";
+	const existed = text !== null;
+	if (isDeepStrictEqual(next, overrides)) return {
+		before,
+		after: before,
+		existed,
+		changed: false
+	};
+	return {
+		before,
+		after: text?.trim() ? setTopLevelMember(text, "skillOverrides", next) : `${JSON.stringify({ skillOverrides: next }, null, 2)}\n`,
+		existed,
+		changed: true
+	};
+}
+// ../server/src/services/agent-config/toml-comments.ts
+/** End offset (exclusive) of a multi-line string whose body starts at `at`. */
+function skipMultiline(text, at, quote) {
+	let i = at;
+	while (i < text.length) {
+		if (quote === "\"\"\"" && text[i] === "\\") {
+			i += 2;
+			continue;
+		}
+		if (text.startsWith(quote, i)) {
+			let end = i + 3;
+			while (end < text.length && end < i + 5 && text[end] === quote[0]) end++;
+			return end;
+		}
+		i++;
+	}
+	return text.length;
+}
+/** End offset (exclusive) of a one-line string starting at the quote at `at`. */
+function skipString(text, at) {
+	const quote = text[at];
+	let i = at + 1;
+	while (i < text.length && text[i] !== "\n") {
+		if (quote === "\"" && text[i] === "\\") {
+			i += 2;
+			continue;
+		}
+		if (text[i] === quote) return i + 1;
+		i++;
+	}
+	return i;
+}
+/**
+* Every comment in a TOML text, whole-line or after a value, in order. A `#` inside a basic,
+* literal or multi-line string is not a comment.
+*/
+function tomlComments(text) {
+	const out = [];
+	let i = 0;
+	while (i < text.length) if (text.startsWith("\"\"\"", i)) i = skipMultiline(text, i + 3, "\"\"\"");
+	else if (text.startsWith("'''", i)) i = skipMultiline(text, i + 3, "'''");
+	else if (text[i] === "\"" || text[i] === "'") i = skipString(text, i);
+	else if (text[i] === "#") {
+		const newline = text.indexOf("\n", i);
+		const end = newline < 0 ? text.length : newline;
+		out.push({
+			start: i,
+			text: text.slice(i, end).replace(/\r$/, "").trimEnd()
+		});
+		i = end;
+	} else i++;
+	return out;
+}
+/** The comment that ends one line, if any (the line read on its own). */
+function lineComment(line) {
+	return tomlComments(line).at(-1)?.text ?? null;
+}
+/** True when both texts hold the same comments, each as often (order and position aside). */
+function sameComments(before, after) {
+	const list = (text) => tomlComments(text).map((c) => c.text).sort();
+	const a = list(before);
+	const b = list(after);
+	return a.length === b.length && a.every((c, i) => c === b[i]);
+}
+// ../server/src/services/agent-config/skill-rules.ts
+const isTable = (v) => typeof v === "object" && v !== null && !Array.isArray(v) && !(v instanceof Date);
+const fold$1 = (p) => {
+	const abs = resolve(p);
+	return process.platform === "linux" ? abs : abs.toLowerCase();
+};
+/** True when a rule entry selects the skill: by path when it has one, else by name. */
+function selects(entry, skill) {
+	if (!isTable(entry) || typeof entry.enabled !== "boolean") return false;
+	if (typeof entry.path === "string") return fold$1(entry.path) === fold$1(skill.path);
+	return typeof entry.name === "string" && entry.name === skill.name;
+}
+const unparsable = (file, why) => new ServiceError(422, "config_unparsable", `${file} could not be parsed: ${why}`);
+function load(file) {
+	if (!existsSync(file)) return {
+		text: null,
+		doc: {},
+		rules: []
+	};
+	const text = readFileSync(file, "utf8");
+	let doc;
+	try {
+		doc = Ko(text);
+	} catch (error) {
+		throw unparsable(file, errorMessage$1(error));
+	}
+	if (!isTable(doc)) throw unparsable(file, "not a table");
+	if (doc.skills !== void 0 && !isTable(doc.skills)) throw unparsable(file, "`skills` is not a table");
+	const config = isTable(doc.skills) ? doc.skills.config : void 0;
+	if (config !== void 0 && !Array.isArray(config)) throw unparsable(file, "`skills.config` is not a list");
+	return {
+		text,
+		doc,
+		rules: config ?? []
+	};
+}
+/** The rules in a config file; none when it is missing or can't be parsed. */
+function readRules(file) {
+	try {
+		return load(file).rules;
+	} catch {
+		return [];
+	}
+}
+/** Whether the rules leave a skill on, and whether any of them selects it. */
+function ruleState(rules, skill) {
+	let enabled = true;
+	let set = false;
+	for (const entry of rules) {
+		if (!selects(entry, skill)) continue;
+		enabled = entry.enabled === true;
+		set = true;
+	}
+	return {
+		enabled,
+		set
+	};
+}
+/**
+* What a switch does to the rules. Off: drop this skill's own entries of the selector used and
+* append one with `enabled = false`, by path for a user skill and by name for a project skill
+* (a project skill's path differs in every worktree). On: drop every entry that selects it.
+*/
+function ruleChange(rules, skill, byPath, enabled) {
+	const indices = (pick) => new Set(rules.flatMap((entry, i) => pick(entry) ? [i] : []));
+	if (enabled) return {
+		drop: indices((entry) => selects(entry, skill)),
+		append: null
+	};
+	const same = (entry) => isTable(entry) && (byPath ? typeof entry.path === "string" && fold$1(entry.path) === fold$1(skill.path) : entry.path === void 0 && entry.name === skill.name);
+	const append = byPath ? {
+		path: skill.path,
+		enabled: false
+	} : {
+		name: skill.name,
+		enabled: false
+	};
+	return {
+		drop: indices(same),
+		append
+	};
+}
+/** The rule list after a change. */
+function applyRuleChange(rules, change) {
+	const kept = rules.filter((_, i) => !change.drop.has(i));
+	return change.append ? [...kept, change.append] : kept;
+}
+/** One `[[skills.config]]` block, as lines. */
+function block(entry) {
+	return ["[[skills.config]]", ...Object.entries(entry).map(([k, v]) => qo({ [k]: v }).trim())];
+}
+const TABLE_HEADER = /^\s*\[/;
+const RULE_HEADER = /^\s*\[\[\s*skills\s*\.\s*config\s*\]\]\s*(#.*)?$/;
+/** Whole-line comment and blank lines: never removed by a text edit. */
+const KEPT = /^\s*(#.*)?$/;
+const isBlank = (line) => line !== void 0 && line.trim() === "";
+/**
+* Edit the `[[skills.config]]` blocks as text: a dropped entry loses its header and setting
+* lines, while every comment and blank line stays. A comment at the end of a dropped line stays
+* on a line of its own, indented like it (blank lines left doubled by the removal are
+* collapsed). An appended entry goes after the last remaining block, or at the end of the file.
+* Returns null when the entries aren't all written as such blocks (an inline array, say).
+*/
+function textEdit(text, rules, change) {
+	const eol = text.includes("\r\n") ? "\r\n" : "\n";
+	const lines = text === "" ? [] : text.split(/\r?\n/);
+	const starts = lines.flatMap((line, i) => RULE_HEADER.test(line) ? [i] : []);
+	if (starts.length !== rules.length) return null;
+	/** Dropped lines, each with what replaces it: its own comment, or nothing. */
+	const dropped = /* @__PURE__ */ new Map();
+	const drop = (i) => {
+		const line = lines[i] ?? "";
+		const comment = lineComment(line);
+		dropped.set(i, comment === null ? null : `${/^\s*/.exec(line)?.[0] ?? ""}${comment}`);
+	};
+	starts.forEach((start, k) => {
+		if (!change.drop.has(k)) return;
+		drop(start);
+		for (let i = start + 1; i < lines.length && !TABLE_HEADER.test(lines[i] ?? ""); i++) if (!KEPT.test(lines[i] ?? "")) drop(i);
+	});
+	const out = [];
+	let removedSinceText = false;
+	lines.forEach((line, i) => {
+		const replacement = dropped.get(i);
+		if (replacement !== void 0) {
+			removedSinceText = replacement === null;
+			if (replacement !== null) out.push(replacement);
+			return;
+		}
+		if (isBlank(line) && removedSinceText && (out.length === 0 || isBlank(out.at(-1)))) return;
+		out.push(line);
+		if (!isBlank(line)) removedSinceText = false;
+	});
+	if (!change.append) return out.join(eol);
+	const added = block(change.append);
+	const lastRule = out.findLastIndex((line) => RULE_HEADER.test(line));
+	if (lastRule < 0) {
+		while (out.length && isBlank(out.at(-1))) out.pop();
+		return [
+			...out,
+			...out.length ? [""] : [],
+			...added,
+			""
+		].join(eol);
+	}
+	let at = lastRule;
+	for (let i = lastRule + 1; i < out.length && !TABLE_HEADER.test(out[i] ?? ""); i++) if (!KEPT.test(out[i] ?? "")) at = i;
+	const next = out[at + 1];
+	out.splice(at + 1, 0, "", ...added, ...next !== void 0 && !isBlank(next) ? [""] : []);
+	return out.join(eol);
+}
+/** Plain JSON view for comparisons (dates become strings). */
+const plain$1 = (value) => JSON.parse(JSON.stringify(value));
+/** A document for comparisons: plain JSON, and an empty `[skills]` table counts as none. */
+function normalize(value) {
+	const doc = plain$1(value);
+	if (isTable(doc.skills) && Object.keys(doc.skills).length === 0) delete doc.skills;
+	return doc;
+}
+/**
+* The file text before and after a switch. The `[[skills.config]]` blocks are edited as text
+* (`textEdit`); when the entries are written some other way, the TOML library patches the
+* document. Either way the result must parse to the expected document and hold exactly the
+* same comments, whole-line and after values alike (`sameComments`), or the switch is refused
+* (422 `config_edit_unsafe`) rather than lose part of the file.
+*/
+function renderRuleSwitch(file, skill, byPath, on) {
+	const { text, doc, rules } = load(file);
+	const before = text ?? "";
+	const existed = text !== null;
+	const change = ruleChange(rules, skill, byPath, on);
+	const next = applyRuleChange(rules, change);
+	if (isDeepStrictEqual(plain$1(next), plain$1(rules))) return {
+		before,
+		after: before,
+		existed,
+		changed: false
+	};
+	const skills = isTable(doc.skills) ? { ...doc.skills } : {};
+	if (next.length) skills.config = next;
+	else delete skills.config;
+	const expected = normalize({
+		...doc,
+		skills
+	});
+	const safe = (candidate) => {
+		if (candidate === null || !sameComments(before, candidate)) return false;
+		try {
+			return isDeepStrictEqual(normalize(Ko(candidate)), expected);
+		} catch {
+			return false;
+		}
+	};
+	const edited = textEdit(before, rules, change);
+	if (safe(edited)) return {
+		before,
+		after: edited,
+		existed,
+		changed: true
+	};
+	const patched = Ja(before, expected);
+	if (safe(patched)) return {
+		before,
+		after: patched,
+		existed,
+		changed: true
+	};
+	throw new ServiceError(422, "config_edit_unsafe", `CodeDen can't change the skill settings in ${file} without losing other settings or comments; edit it by hand`);
+}
+// ../server/src/services/agent-config/skills-service.ts
+const fold = (p) => process.platform === "linux" ? p : p.toLowerCase();
+/**
+* Skill switches (§12.4): whether each skill is on, read from its provider's native setting,
+* and switching one on or off by writing that setting. Every write is previewed by `diff`,
+* backed up first and atomic. See `agent-config-skills.ts` in contracts for the rules.
+*/
+var AgentConfigSkills = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** The user's skills, plus the project's, with their state for the project's checkout. */
+	list(projectId) {
+		const project = projectId ? this.deps.project(projectId) : null;
+		return this.withState(listSkills(this.deps.home, project), this.pageContext(project));
+	}
+	/** The state of the skills a session in `cwd` finds (What's loaded, the `/` menu). */
+	forSession(skills, cwd, gitRoot, projectId) {
+		const context = claudeSessionHookFiles(this.deps.home, cwd, gitRoot, projectId);
+		return this.withState(skills, context);
+	}
+	diff(req) {
+		const plan = this.plan(req);
+		const { before, after, existed } = plan.render();
+		return {
+			...unifiedDiff(plan.file.file, existed, before, after),
+			scope: plan.scope
+		};
+	}
+	apply(req) {
+		const plan = this.plan(req);
+		const { after, existed, changed } = plan.render();
+		if (!changed) return {
+			file: null,
+			backupPath: null,
+			skills: this.list(req.listProjectId)
+		};
+		const backupPath = existed ? this.deps.backup(plan.file.file) : null;
+		mkdirSync(dirname(plan.file.file), { recursive: true });
+		guard(plan.file);
+		atomicWrite(plan.file.file, after);
+		return {
+			file: plan.file.file,
+			backupPath,
+			skills: this.list(req.listProjectId)
+		};
+	}
+	withState(skills, context) {
+		const claude = highestFirst(context.map((f) => readOverrides(f)));
+		const codexRules = this.codexRules();
+		return skills.map((skill) => {
+			if (skill.provider === "codex") {
+				const state = ruleState(codexRules, {
+					name: skill.name,
+					path: skill.file.absolutePath
+				});
+				return {
+					...skill,
+					enabled: state.enabled,
+					setIn: state.set ? this.codexConfig() : null
+				};
+			}
+			const deciding = decidingOverride(claude, skill.name);
+			const value = deciding?.value;
+			return {
+				...skill,
+				enabled: value !== "off",
+				...value === "name-only" || value === "user-invocable-only" ? { visibility: value } : {},
+				setIn: deciding?.file.source.file ?? null
+			};
+		});
+	}
+	/** Claude's settings files for the Agents page: the user's, plus the project's. */
+	pageContext(project) {
+		const home = this.deps.home;
+		const user = claudeHookFile("user", home, null);
+		if (!project) return [user];
+		return [
+			user,
+			claudeHookFile("project", home, project),
+			claudeHookFile("local", home, project)
+		];
+	}
+	codexConfig() {
+		return join(this.deps.home, ".codex", "config.toml");
+	}
+	/** Codex's rules for listing; none when config.toml leads outside home or doesn't parse. */
+	codexRules() {
+		try {
+			guard({
+				root: this.deps.home,
+				file: this.codexConfig()
+			});
+		} catch {
+			return [];
+		}
+		return readRules(this.codexConfig());
+	}
+	/**
+	* What a switch will do, with every input checked first: the skill must be one listed for
+	* `listProjectId` (404 `skill_not_found`); every settings file that applies must be readable
+	* and inside its folder (422 `config_unparsable`, 403 `path_outside_root`), so the target is
+	* never chosen around a file that can't be read; and the file written must stay inside its
+	* folder.
+	*/
+	plan(req) {
+		if (!agentConfigFeatures[req.provider].skillSwitches) throw badRequest(`CodeDen does not switch ${req.provider} skills`, "skills_unsupported");
+		const project = req.listProjectId ? this.deps.project(req.listProjectId) : null;
+		const { provider, enabled, listProjectId: _, ...locator } = req;
+		const absolutePath = fold(this.deps.resolve(locator).absolutePath);
+		const skill = listSkills(this.deps.home, project).find((s) => s.provider === provider && fold(s.file.absolutePath) === absolutePath);
+		if (!skill) throw notFound(`No ${provider} skill at ${req.path}; reload the list`, "skill_not_found");
+		if (provider === "codex") {
+			const file = {
+				root: this.deps.home,
+				file: this.codexConfig()
+			};
+			guard(file);
+			const target = {
+				name: skill.name,
+				path: skill.file.absolutePath
+			};
+			const byPath = skill.scope === "user";
+			return {
+				file,
+				scope: "user",
+				render: () => renderRuleSwitch(file.file, target, byPath, enabled)
+			};
+		}
+		const { target, value } = planOverride(this.pageContext(project).map((f) => readOverrides(f, true)), claudeHookFile("user", this.deps.home, null), skill.name, enabled);
+		guard(target);
+		return {
+			file: target,
+			scope: target.scope,
+			render: () => renderOverride(target.file, skill.name, value)
+		};
+	}
+};
 // ../server/src/services/agent-config/slash-commands.ts
 /**
 * The composer's `/` menu (§13): the skills and custom commands that apply to a session's
@@ -36620,13 +37695,14 @@ function reportedCommands(db, sessionId) {
 const MCP_TEST_SLACK_MS = 5e3;
 /**
 * Agent configuration (§12.4): discovery of each provider's memory files, skills, subagents,
-* MCP servers and hooks; edits in the native files with backups and diff previews; and the
-* "what's loaded" view of a session.
+* MCP servers and hooks; edits in the native files with backups and diff previews; skill
+* switches; and the "what's loaded" view of a session.
 */
 var AgentConfigService = class {
 	deps;
 	files;
 	hooks;
+	skills;
 	constructor(deps) {
 		this.deps = deps;
 		this.files = new AgentConfigFiles((l) => this.rootDir(l), deps.backupDir);
@@ -36636,6 +37712,12 @@ var AgentConfigService = class {
 			backup: (file) => this.files.backup(file),
 			shelf: new HookShelf(deps.disabledHooksFile)
 		});
+		this.skills = new AgentConfigSkills({
+			home: deps.home,
+			project: (id) => this.project(id),
+			backup: (file) => this.files.backup(file),
+			resolve: (locator) => this.files.resolve(locator)
+		});
 	}
 	list(query) {
 		const project = query.projectId ? this.project(query.projectId) : null;
@@ -36741,31 +37823,58 @@ var AgentConfigService = class {
 	}
 	/**
 	* The composer's `/` menu for a session (§13): the skills that apply to its working folder
-	* (as What's loaded finds them) and its provider's custom command files; once the provider
-	* has reported a non-empty list of what it runs for the session (built-in ones included),
-	* that list (`mergeSlashCommands`).
+	* (as What's loaded finds them, without those switched off) and its provider's custom
+	* command files; once the provider has reported a non-empty list of what it runs for the
+	* session (built-in ones included), that list (`mergeSlashCommands`).
 	* Role sessions get what applies to their own folder: the orchestrator, outside any
 	* project, only user-level entries.
 	*/
 	slashCommands(sessionId) {
 		const { session, gitRoot, files } = this.discover(sessionId);
-		const custom = session.provider === "claude" ? loadedClaudeCommands(this.deps.home, session.cwd, gitRoot) : [];
-		return mergeSlashCommands([...files.skills.map(skillCommand), ...custom], this.deps.reportedCommands(sessionId), session.provider);
+		return mergeSlashCommands(this.discoveredCommands(session.provider, session.cwd, gitRoot, files.skills), this.deps.reportedCommands(sessionId), session.provider);
 	}
-	/** A session's working folder, project and the native files its provider loads there. */
+	/**
+	* The `/` menu of a session that does not exist yet (the New session draft): what `provider`
+	* would load in the project folder. No provider has reported a list, so the files are the list.
+	*/
+	projectSlashCommands(projectId, provider) {
+		const project = this.project(projectId);
+		const { gitRoot, files } = this.discoverIn(provider, project.path, project);
+		return mergeSlashCommands(this.discoveredCommands(provider, project.path, gitRoot, files.skills), null, provider);
+	}
+	/** Skills that are switched on, then the provider's custom command files, in precedence order. */
+	discoveredCommands(provider, cwd, gitRoot, skills) {
+		const custom = provider === "claude" ? loadedClaudeCommands(this.deps.home, cwd, gitRoot) : [];
+		return [...skills.filter((s) => s.enabled).map(skillCommand), ...custom];
+	}
+	/**
+	* A session's working folder, project and the native files its provider loads there, with
+	* each skill's switch state for that folder.
+	*/
 	discover(sessionId) {
 		const session = this.deps.repo.get(sessionId);
 		const project = session.projectId ? this.project(session.projectId) : null;
-		const gitRoot = findGitRoot(session.cwd);
-		const home = this.deps.home;
 		return {
 			session,
 			project,
+			...this.discoverIn(session.provider, session.cwd, project)
+		};
+	}
+	/** The native files `provider` loads in `cwd` (skills with their switch state), and the git root. */
+	discoverIn(provider, cwd, project) {
+		const gitRoot = findGitRoot(cwd);
+		const home = this.deps.home;
+		const found = provider === "codex" ? loadedCodex(home, cwd, gitRoot, project) : provider === "claude" ? loadedClaude(home, cwd, gitRoot, project) : {
+			memory: [],
+			skills: [],
+			subagents: []
+		};
+		const skills = this.skills.forSession(found.skills, cwd, gitRoot, project?.id ?? null);
+		return {
 			gitRoot,
-			files: session.provider === "codex" ? loadedCodex(home, session.cwd, gitRoot, project) : session.provider === "claude" ? loadedClaude(home, session.cwd, gitRoot, project) : {
-				memory: [],
-				skills: [],
-				subagents: []
+			files: {
+				...found,
+				skills
 			}
 		};
 	}
@@ -36834,418 +37943,6 @@ var AgentConfigService = class {
 		];
 	}
 };
-// ../server/src/services/automations/sources.ts
-const FILE_SOURCES = ["global_file", "project_file"];
-/** Repo-relative folder of project automation files. */
-const PROJECT_AUTOMATIONS_DIR = join(".codeden", "automations");
-/** The definition fields that, when changed in a file, update the stored automation. */
-function definitionKey(a) {
-	return JSON.stringify([
-		a.name,
-		a.description,
-		a.templateId,
-		a.trigger,
-		a.action,
-		a.target,
-		a.guards,
-		a.workKey ?? null
-	]);
-}
-/**
-* Automation definitions from Markdown files (§10): global ones in `~/.codeden/automations/`
-* (they target all projects) and each project's `.codeden/automations/` (that project only).
-* They are mirrored into the `automations` projection through `automation.saved` /
-* `automation.deleted`, keeping the enabled flag (files never enable anything). Folders are
-* watched, with a periodic rescan for folders created later. Built-in templates are read once.
-*/
-var AutomationSources = class {
-	deps;
-	paths = /* @__PURE__ */ new Map();
-	errors = [];
-	builtin = [];
-	globalTemplates = [];
-	watchers = /* @__PURE__ */ new Map();
-	timer;
-	rescan;
-	constructor(deps) {
-		this.deps = deps;
-		const dir = findTemplatesDir(deps.templatesDir);
-		if (dir) {
-			const { files, errors } = readAutomationDir(dir);
-			this.builtin = files.map((f) => toTemplate(f, "builtin"));
-			for (const e of errors) deps.log?.(`automations: built-in template ${e.path}: ${e.message}`);
-		} else deps.log?.("automations: built-in templates folder not found");
-	}
-	/** Built-in templates, then global automation files. */
-	templates() {
-		const builtinIds = new Set(this.builtin.map((t) => t.id));
-		return [...this.builtin, ...this.globalTemplates.filter((t) => !builtinIds.has(t.id))];
-	}
-	template(id) {
-		return this.templates().find((t) => t.id === id);
-	}
-	fileErrors() {
-		return this.errors;
-	}
-	pathOf(automationId) {
-		return this.paths.get(automationId) ?? null;
-	}
-	start() {
-		this.reload();
-		const every = this.deps.rescanMs ?? 6e4;
-		if (every > 0) {
-			this.rescan = setInterval(() => this.reload(), every);
-			this.rescan.unref();
-		}
-	}
-	stop() {
-		if (this.timer) clearTimeout(this.timer);
-		if (this.rescan) clearInterval(this.rescan);
-		for (const w of this.watchers.values()) w.close();
-		this.watchers.clear();
-	}
-	/** Re-read every folder and sync the projection. Returns true when anything changed. */
-	reload() {
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const errors = [];
-		const found = [];
-		const paths = /* @__PURE__ */ new Map();
-		const add = (file, base) => {
-			const { parsed } = file;
-			found.push({
-				...base,
-				name: parsed.frontmatter.name,
-				description: parsed.frontmatter.description ?? null,
-				enabled: false,
-				templateId: parsed.id,
-				trigger: parsed.frontmatter.trigger,
-				action: parsed.action,
-				guards: parsed.guards,
-				workKey: parsed.workKey,
-				createdAt: now,
-				updatedAt: now
-			});
-			paths.set(base.id, file.path);
-		};
-		const global = readAutomationDir(this.deps.globalDir);
-		errors.push(...global.errors);
-		this.globalTemplates = global.files.map((f) => toTemplate(f, "global_file"));
-		for (const file of global.files) add(file, {
-			id: `global:${file.parsed.id}`,
-			source: "global_file",
-			target: { type: "all_projects" }
-		});
-		const dirs = [this.deps.globalDir];
-		for (const project of this.deps.projects.list()) {
-			if (project.archivedAt) continue;
-			const dir = join(project.path, PROJECT_AUTOMATIONS_DIR);
-			dirs.push(dir);
-			const local = readAutomationDir(dir);
-			errors.push(...local.errors);
-			for (const file of local.files) add(file, {
-				id: `project:${project.id}:${file.parsed.id}`,
-				source: "project_file",
-				target: {
-					type: "project",
-					projectId: project.id
-				}
-			});
-		}
-		this.errors = errors;
-		this.paths.clear();
-		for (const [k, v] of paths) this.paths.set(k, v);
-		this.watchDirs(dirs);
-		return this.sync(found);
-	}
-	/** Store new or changed file definitions and delete those whose file is gone. */
-	sync(found) {
-		const existing = new Map(this.deps.db.select().from(automations).where(inArray(automations.source, [...FILE_SOURCES])).all().map((r) => {
-			const a = rowToAutomation(r);
-			return [a.id, a];
-		}));
-		const events = [];
-		for (const next of found) {
-			const prev = existing.get(next.id);
-			existing.delete(next.id);
-			if (prev && definitionKey(prev) === definitionKey(next)) continue;
-			const automation = prev ? {
-				...next,
-				enabled: prev.enabled,
-				createdAt: prev.createdAt
-			} : next;
-			events.push({
-				type: "automation.saved",
-				sessionId: null,
-				payload: { automation }
-			});
-		}
-		for (const gone of existing.keys()) events.push({
-			type: "automation.deleted",
-			sessionId: null,
-			payload: { automationId: gone }
-		});
-		if (events.length === 0) return false;
-		this.deps.store.append(events);
-		this.deps.onChange?.();
-		return true;
-	}
-	watchDirs(dirs) {
-		const wanted = new Set(dirs.filter((d) => existsSync(d)));
-		for (const [dir, watcher] of this.watchers) if (!wanted.has(dir)) {
-			watcher.close();
-			this.watchers.delete(dir);
-		}
-		for (const dir of wanted) {
-			if (this.watchers.has(dir)) continue;
-			try {
-				const watcher = watch(dir, () => this.scheduleReload());
-				watcher.on("error", () => {
-					watcher.close();
-					this.watchers.delete(dir);
-				});
-				this.watchers.set(dir, watcher);
-			} catch (error) {
-				this.deps.log?.(`automations: cannot watch ${dir}: ${errorMessage$1(error)}`);
-			}
-		}
-	}
-	scheduleReload() {
-		if (this.timer) clearTimeout(this.timer);
-		this.timer = setTimeout(() => {
-			this.timer = void 0;
-			try {
-				this.reload();
-			} catch (error) {
-				this.deps.log?.(`automations: reload failed: ${errorMessage$1(error)}`);
-			}
-		}, 200);
-		this.timer.unref();
-	}
-};
-/** True when a project can run a template (GitHub-only templates need a GitHub project). */
-function templateFits(template, project) {
-	return !template.requiresGithub || project.kind === "github";
-}
-// ../server/src/services/automations/definitions.ts
-/** Id of a project's starter automation created from a template. */
-function starterId(projectId, templateId) {
-	return `starter:${projectId}:${templateId}`;
-}
-/**
-* Database-stored automations (§10): create (from a template or from scratch), update,
-* delete, enable and disable, and the starter set offered to new projects. File-based
-* automations are read-only here except for their enabled switch.
-*/
-var AutomationDefinitions = class {
-	deps;
-	constructor(deps) {
-		this.deps = deps;
-	}
-	all() {
-		return this.deps.db.select().from(automations).all().map(rowToAutomation);
-	}
-	find(id) {
-		const row = this.deps.db.select().from(automations).where(eq(automations.id, id)).get();
-		return row ? rowToAutomation(row) : void 0;
-	}
-	get(id) {
-		const a = this.find(id);
-		if (!a) throw notFound(`No automation ${id}`, "automation_not_found");
-		return a;
-	}
-	create(req, opts = {}) {
-		const id = opts.id ?? randomUUID();
-		const template = req.templateId ? this.template(req.templateId) : void 0;
-		if (req.projectId) this.deps.projects.get(req.projectId);
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const trigger = req.trigger ?? template?.trigger;
-		const action = req.action ?? template?.action;
-		const name = req.name ?? template?.name;
-		if (!trigger || !action || !name) throw badRequest("name, trigger and action are required");
-		const automation = Automation.parse({
-			id,
-			name,
-			description: req.description !== void 0 ? req.description : template?.description ?? null,
-			enabled: req.enabled,
-			source: "database",
-			templateId: template?.id ?? null,
-			trigger,
-			action,
-			target: req.projectId ? {
-				type: "project",
-				projectId: req.projectId
-			} : { type: "all_projects" },
-			guards: AutomationGuards.parse({
-				...template?.guards,
-				...req.guards
-			}),
-			workKey: req.workKey ?? template?.workKey,
-			...opts.createdBy && opts.createdBy !== "user" ? { createdBy: opts.createdBy } : {},
-			createdAt: now,
-			updatedAt: now
-		});
-		validateAutomation(automation);
-		return this.save(automation);
-	}
-	update(id, req) {
-		const current = this.editable(id);
-		if (req.target?.type === "project") this.deps.projects.get(req.target.projectId);
-		const { workKey: _drop, ...rest } = current;
-		const workKey = req.workKey === null ? void 0 : req.workKey ?? current.workKey;
-		const next = Automation.parse({
-			...rest,
-			...req.name !== void 0 ? { name: req.name } : {},
-			...req.description !== void 0 ? { description: req.description } : {},
-			...req.trigger ? { trigger: req.trigger } : {},
-			...req.action ? { action: req.action } : {},
-			...req.target ? { target: req.target } : {},
-			guards: AutomationGuards.parse({
-				...current.guards,
-				...req.guards
-			}),
-			...workKey ? { workKey } : {},
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		});
-		validateAutomation(next);
-		return this.save(next);
-	}
-	remove(id) {
-		this.editable(id);
-		this.deps.store.append([{
-			type: "automation.deleted",
-			sessionId: null,
-			payload: { automationId: id }
-		}]);
-		this.deps.schedules.removeAutomation(id);
-	}
-	/**
-	* Enable or disable. With `projectId` on an automation that targets all projects, only that
-	* project's override changes; otherwise the automation's own switch.
-	*/
-	setEnabled(id, enabled, projectId) {
-		const a = this.get(id);
-		if (projectId) this.deps.projects.get(projectId);
-		if (projectId && a.target.type === "all_projects") {
-			this.deps.schedules.upsert(id, projectId, { enabledOverride: enabled });
-			return a;
-		}
-		if (projectId && a.target.type === "project" && a.target.projectId !== projectId) throw notFound(`Automation ${id} does not belong to that project`, "automation_not_found");
-		if (a.enabled === enabled) return a;
-		return this.save({
-			...a,
-			enabled,
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		});
-	}
-	/** Drop a project's override of an all-projects automation; it follows its own switch again. */
-	clearOverride(id, projectId) {
-		const a = this.get(id);
-		this.deps.projects.get(projectId);
-		if (a.target.type !== "all_projects") throw conflict("Only automations for all projects have per-project overrides", "no_override");
-		this.deps.schedules.upsert(id, projectId, { enabledOverride: null });
-		return a;
-	}
-	/**
-	* Create the project's starter set (§10) from the starter templates that fit the project,
-	* keeping existing ones; with `enable`, switch them all on.
-	*/
-	starterSet(projectId, enable) {
-		const project = this.deps.projects.get(projectId);
-		const out = [];
-		for (const template of this.deps.sources.templates()) {
-			if (!template.starter || template.source !== "builtin" || !templateFits(template, project)) continue;
-			const id = starterId(projectId, template.id);
-			const existing = this.find(id);
-			if (existing) {
-				out.push(enable ? this.setEnabled(id, true) : existing);
-				continue;
-			}
-			out.push(this.create({
-				templateId: template.id,
-				projectId,
-				enabled: enable
-			}, { id }));
-		}
-		return out;
-	}
-	/**
-	* An editable database copy of any automation (also file-based and built-in ones), off,
-	* named "<name> (copy)" unless a name is given. Targets `projectId`, else the original's
-	* target. The copy keeps the original's work key, so the two never run the same work at once.
-	*/
-	duplicate(id, req) {
-		const a = this.get(id);
-		const projectId = req.projectId ?? (a.target.type === "project" ? a.target.projectId : void 0);
-		return this.create({
-			projectId,
-			name: req.name ?? `${a.name} (copy)`.slice(0, 200),
-			description: a.description,
-			trigger: a.trigger,
-			action: a.action,
-			guards: a.guards,
-			workKey: a.workKey,
-			enabled: false
-		});
-	}
-	/**
-	* Import shared automation files (§10): re-parse the source with the file parser, then
-	* create each selected valid file as a database automation, always off and marked
-	* `createdBy: import`. Nothing runs.
-	*/
-	importFrom(req) {
-		if (req.projectId) this.deps.projects.get(req.projectId);
-		const select = req.select ? new Set(req.select) : null;
-		const items = previewImport(req.source).filter((i) => !select || select.has(i.fileName));
-		const created = [];
-		const failed = [];
-		for (const item of items) {
-			const draft = item.automation;
-			if (!draft) {
-				failed.push({
-					fileName: item.fileName,
-					error: item.error ?? "Invalid file"
-				});
-				continue;
-			}
-			created.push(this.create({
-				projectId: req.projectId,
-				name: draft.name,
-				description: draft.description,
-				trigger: draft.trigger,
-				action: draft.action,
-				guards: draft.guards,
-				workKey: draft.workKey,
-				enabled: false
-			}, { createdBy: "import" }));
-		}
-		return {
-			created,
-			failed
-		};
-	}
-	/** Parse an import without saving anything. */
-	previewImport(req) {
-		return previewImport(req);
-	}
-	template(id) {
-		const template = this.deps.sources.template(id);
-		if (!template) throw notFound(`No automation template ${id}`, "template_not_found");
-		return template;
-	}
-	editable(id) {
-		const a = this.get(id);
-		if (a.source !== "database") throw conflict("This automation is defined in a file; edit the file instead", "automation_read_only");
-		return a;
-	}
-	save(automation) {
-		this.deps.store.append([{
-			type: "automation.saved",
-			sessionId: null,
-			payload: { automation }
-		}]);
-		return automation;
-	}
-};
 // ../server/src/services/sessions/conflicts.ts
 /** Session statuses that count as running or queued work for conflict detection (§8.4). */
 const ACTIVE_SESSION_STATUSES = [
@@ -39105,6 +39802,8 @@ const DONE_STAGES = [
 var FactoryStore = class {
 	db;
 	events;
+	/** When each project's loop last ticked (see `saveTick`); not persisted. */
+	lastTicks = /* @__PURE__ */ new Map();
 	constructor(db, events) {
 		this.db = db;
 		this.events = events;
@@ -39134,7 +39833,17 @@ var FactoryStore = class {
 			updatedAt: now.toISOString()
 		};
 	}
+	/**
+	* Save the loop; writes only when something besides its stamps (`lastTickAt`, `updatedAt`)
+	* changed. The log is never pruned (§6) and every loop event refreshes the open factory
+	* panels, while an idle factory ticks every 30 s.
+	*/
 	saveLoop(loop) {
+		const current = this.loop(loop.projectId);
+		if (current && sameLoop(current, loop)) return {
+			...loop,
+			updatedAt: current.updatedAt
+		};
 		const next = {
 			...loop,
 			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -39146,6 +39855,21 @@ var FactoryStore = class {
 		}]);
 		return next;
 	}
+	/**
+	* End a tick: remember when it ran and save the loop if the tick changed it. A tick that
+	* changed nothing saves nothing, so the time is kept in memory for the panel's "last check".
+	*/
+	saveTick(loop, at) {
+		this.lastTicks.set(loop.projectId, at);
+		return this.saveLoop({
+			...loop,
+			lastTickAt: at
+		});
+	}
+	/** When the project's loop last ticked in this process (none yet after a restart). */
+	lastTick(projectId) {
+		return this.lastTicks.get(projectId);
+	}
 	item(id) {
 		const item = this.db.select().from(factoryItems).where(eq(factoryItems.id, id)).get()?.item;
 		return item ? withItemDefaults(item) : void 0;
@@ -39258,6 +39982,11 @@ function withItemDefaults(item) {
 		...item
 	};
 }
+/** Same loop apart from the stamps a save sets; key order and `undefined` fields don't count. */
+function sameLoop(a, b) {
+	const content = ({ lastTickAt: _tick, updatedAt: _saved, ...rest }) => JSON.parse(JSON.stringify(rest));
+	return isDeepStrictEqual(content(a), content(b));
+}
 const TUNING_DEFAULTS = FactoryTuning.parse({});
 /** A loop as read from the projection: newer tuning knobs and the scout filled in. */
 function upgradeLoop(loop) {
@@ -41526,11 +42255,9 @@ async function runTick(ctx, projectId, hooks) {
 		state: deriveState(ctx, projectId, loop)
 	}, now);
 }
+/** Ticks that change nothing append nothing (the status shows the tick time from memory). */
 function save(ctx, loop, now) {
-	return ctx.store.saveLoop({
-		...loop,
-		lastTickAt: now.toISOString()
-	});
+	return ctx.store.saveTick(loop, now.toISOString());
 }
 /** The loop state the panel shows: the most advanced stage with work in it. */
 function deriveState(ctx, projectId, loop) {
@@ -42087,7 +42814,7 @@ async function buildStatus(ctx, projectId) {
 		scout: project.autonomyMode === "dark_factory" ? scoutStatus(ctx, project, loop, spend) : null,
 		visionExists: visionOf(project).exists,
 		lastDigest: ctx.store.digests(projectId, 1)[0] ?? null,
-		lastTickAt: loop.lastTickAt
+		lastTickAt: ctx.store.lastTick(projectId) ?? loop.lastTickAt
 	};
 }
 // ../server/src/services/factory/factory-service.ts
@@ -51470,6 +52197,20 @@ var SessionRepo = class {
 	turnCount(sessionId) {
 		return this.db.select({ n: sql`count(*)` }).from(turns).where(eq(turns.sessionId, sessionId)).get()?.n ?? 0;
 	}
+	/** One of the session's turns, or null when it has none with that id. */
+	turn(sessionId, turnId) {
+		const row = this.db.select().from(turns).where(and(eq(turns.sessionId, sessionId), eq(turns.id, turnId))).get();
+		return row ? rowToTurn(row) : null;
+	}
+	/** The index of the checkpoint written when a turn ended (§9), or null when there is none. */
+	turnCheckpoint(sessionId, turnId) {
+		return this.db.select({ index: checkpoints.index }).from(checkpoints).where(and(eq(checkpoints.sessionId, sessionId), eq(checkpoints.turnId, turnId))).orderBy(desc(checkpoints.index)).limit(1).get()?.index ?? null;
+	}
+	/** The ids of the session's root-thread turns, oldest first (by start); turn N is at N - 1. */
+	rootTurnIds(session) {
+		if (!session.rootThreadId) return [];
+		return this.db.select({ id: turns.id }).from(turns).where(and(eq(turns.sessionId, session.id), eq(turns.threadId, session.rootThreadId))).orderBy(asc(turns.startedAt), asc(sql`rowid`)).all().map((r) => r.id);
+	}
 	/** Follow-ups of the latest root-thread turn that produced some (§7.5). */
 	latestFollowups(session) {
 		if (!session.rootThreadId) return null;
@@ -51499,6 +52240,55 @@ function readProjectConfig(projectPath) {
 function projectDefaultProvider(project) {
 	return project.defaultProvider ?? readProjectConfig(project.path)?.defaultProvider ?? null;
 }
+// ../server/src/services/sessions/fork-turn.ts
+/** Runner error code (from the provider): the conversation no longer holds the fork point. */
+const FORK_POINT_MISSING = "fork_point_missing";
+/**
+* Check that `source` can be forked at `turnId`, before asking the runner anything: a turn of
+* its own root thread that has ended, and (unless it is the latest) one whose end recorded a
+* fork point and a checkpoint. Throws `ServiceError`s.
+*/
+function forkTurn(repo, source, turnId) {
+	const turn = repo.turn(source.id, turnId);
+	if (!turn) throw notFound("The session has no such turn", "turn_not_found");
+	if (turn.threadId !== source.rootThreadId) throw badRequest("Only the session's own turns can be forked from", "fork_unsupported");
+	if (turn.status === "running") throw conflict("Wait for the turn to finish before forking from it", "turn_running");
+	const rootTurns = repo.rootTurnIds(source);
+	const turnNumber = rootTurns.indexOf(turnId) + 1;
+	if (rootTurns.at(-1) === turnId) return {
+		turnId,
+		turnNumber,
+		latest: true
+	};
+	if (!turn.forkPoint) throw conflict("This turn can't be forked from: the provider didn't record where its conversation ended", "fork_point_unavailable");
+	const checkpoint = repo.turnCheckpoint(source.id, turnId);
+	if (checkpoint === null) throw conflict("CodeDen has no snapshot of the code at the end of this turn", "no_checkpoint");
+	return {
+		turnId,
+		turnNumber,
+		latest: false,
+		upTo: turn.forkPoint,
+		checkpoint
+	};
+}
+/**
+* The checkpoint of an earlier turn, once the runner confirms it still has it (`indexes` from
+* its settled list). Throws 409 `no_checkpoint` when it doesn't.
+*/
+function confirmedCheckpoint(at, indexes) {
+	if (!indexes.includes(at.checkpoint)) throw conflict("CodeDen has no snapshot of the code at the end of this turn", "no_checkpoint");
+	return at.checkpoint;
+}
+/**
+* A provider that no longer finds the fork point in the conversation (it was replaced or
+* deleted since the turn ended) answers 409 `fork_point_missing`; anything else is left to
+* the usual runner error mapping.
+*/
+function forkPointMissing(error) {
+	if (runnerErrorCode(error) !== FORK_POINT_MISSING) return null;
+	const detail = error instanceof Error ? ` (${error.message})` : "";
+	return conflict(`This turn can't be forked from any more: its conversation changed since it ended${detail}`, FORK_POINT_MISSING);
+}
 // ../server/src/services/sessions/fork.ts
 const BUSY$1 = /* @__PURE__ */ new Set(["running", "waiting"]);
 const NOT_STARTED$1 = /* @__PURE__ */ new Set([
@@ -51542,13 +52332,19 @@ function forkTitle(source) {
 * 2. a copy of its conversation, made now by the provider (`provider.fork`).
 * The source is only read. A turn that started meanwhile, even one that has already finished,
 * would make the two disagree, so that fails the fork (`sourceMoved`; the unused copy is left
-* behind, never resumed). Throws `ServiceError`s.
+* behind, never resumed).
+*
+* With `req.turnId` of an earlier turn ("Fork from here"), the code is that turn's checkpoint
+* and the copy ends with that turn (`upTo`, its fork point). Neither changes once the turn has
+* ended, so later turns don't affect it. The latest turn forks as above. Throws `ServiceError`s.
 */
 async function planFork(deps, sourceId, req) {
 	const { repo, runner } = deps;
 	const source = repo.get(sourceId);
 	const provider = runner.providers().find((p) => p.id === source.provider);
 	const project = forkProject(deps.projects, source, provider);
+	const at = req.turnId ? forkTurn(repo, source, req.turnId) : null;
+	const earlier = at && !at.latest ? at : null;
 	const turns = repo.turnCount(source.id);
 	const { checkpoints } = await runner.request({
 		name: "checkpoint.list",
@@ -51556,18 +52352,25 @@ async function planFork(deps, sourceId, req) {
 		sessionId: source.id,
 		settled: true
 	}, SETTLE_TIMEOUT_MS).catch(rethrow);
-	const checkpoint = checkpoints.at(-1)?.index ?? null;
+	const checkpoint = earlier ? confirmedCheckpoint(earlier, checkpoints.map((c) => c.index)) : checkpoints.at(-1)?.index ?? null;
 	const { resumeToken } = await runner.request({
 		name: "provider.fork",
 		providerId: source.provider,
 		resumeToken: source.resumeToken,
-		cwd: project.path
-	}, FORK_TIMEOUT_MS).catch(rethrow);
-	const late = sourceMoved(repo, source, turns, provider);
-	if (late) throw late;
+		cwd: project.path,
+		...earlier ? { upTo: earlier.upTo } : {}
+	}, FORK_TIMEOUT_MS).catch((error) => {
+		throw forkPointMissing(error) ?? toServiceError$1(error);
+	});
+	if (!earlier) {
+		const late = sourceMoved(repo, source, turns, provider);
+		if (late) throw late;
+	}
 	return forkPlan(source, project, {
 		checkpoint,
-		resumeToken
+		resumeToken,
+		turnId: at?.turnId,
+		turnNumber: at?.turnNumber
 	}, req);
 }
 /**
@@ -51596,10 +52399,11 @@ function forkProject(projects, source, provider) {
 * effort, permissions, plan mode, work and issue, started by the user, with its own copy of the
 * conversation (`resumeToken`). Its worktree branches from the source's branch and starts from
 * `checkpoint`; its pull request targets the source's base branch. There is no §8.4 conflict
-* check: the fork is a deliberate, visible duplicate (`forkedFrom`).
+* check: the fork is a deliberate, visible duplicate (`forkedFrom`, with the turn it was taken
+* at when one was named).
 */
 function forkPlan(source, project, origin, req) {
-	const { checkpoint } = origin;
+	const { checkpoint, turnId, turnNumber } = origin;
 	const now = (/* @__PURE__ */ new Date()).toISOString();
 	const session = {
 		id: randomUUID(),
@@ -51630,7 +52434,9 @@ function forkPlan(source, project, origin, req) {
 		rootThreadId: null,
 		forkedFrom: {
 			sessionId: source.id,
-			checkpoint
+			checkpoint,
+			...turnId ? { turnId } : {},
+			...turnId && turnNumber ? { turnNumber } : {}
 		},
 		createdAt: now,
 		updatedAt: now,
@@ -51988,8 +52794,8 @@ var SessionService = class {
 	}
 	/**
 	* Fork an agent session (§9): a new session with a copy of its conversation, in a new
-	* worktree started from its latest checkpoint (`fork.ts`). The worktree is made in the
-	* background.
+	* worktree started from its latest checkpoint, or from a named turn's ("Fork from here",
+	* `fork.ts`). The worktree is made in the background.
 	*/
 	async fork(id, req) {
 		const { repo, projects, runner } = this.deps;
@@ -52303,14 +53109,16 @@ function isUnwatched(session) {
 	return session.automationRunId !== null || session.startedBy.kind === "automation" || session.startedBy.kind === "pm";
 }
 /**
-* Approvals nobody is there to answer (§10.1, §11.2). Nothing here ever approves: it denies, with
-* guidance, so the agent carries on instead of waiting forever (fail closed).
-* - The PM and the factory's sessions in a dark factory are denied at once, as their questions
+* Approvals, and MCP servers' forms, nobody is there to answer (§10.1, §11.2). Nothing here ever
+* approves or fills in a form: an approval is denied, with guidance, and a form is withdrawn
+* (`cancel`, no data sent), so the agent carries on instead of waiting forever (fail closed).
+* - The PM and the factory's sessions in a dark factory are answered at once, as their questions
 *   are answered at once.
 * - Sessions started by an automation, a PM or the factory otherwise wait
-*   {@link UNWATCHED_APPROVAL_WAIT_MS} for the user, then are denied. A scheduled run then
-*   finishes instead of blocking the next ones.
-* Sessions the user started wait for the user, however long.
+*   {@link UNWATCHED_APPROVAL_WAIT_MS} for the user. A scheduled run then finishes instead of
+*   blocking the next ones.
+* Sessions the user started wait for the user, however long. The agent's own questions are left
+* to the factory's rules (`answerProviderQuestion`).
 */
 var UnwatchedApprovals = class {
 	deps;
@@ -52319,10 +53127,10 @@ var UnwatchedApprovals = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
-	/** Watch new approvals, and pick up the ones already open (a restart keeps their age). */
+	/** Watch new requests, and pick up the ones already open (a restart keeps their age). */
 	start() {
 		this.unsubscribe ??= this.deps.store.subscribe((events) => this.onEvents(events));
-		for (const item of this.deps.inbox.list()) if (item.kind === "approval") this.track(item);
+		for (const item of this.deps.inbox.list()) if (item.kind === "approval" || item.kind === "question") this.track(item);
 	}
 	stop() {
 		this.unsubscribe?.();
@@ -52334,7 +53142,7 @@ var UnwatchedApprovals = class {
 		for (const e of events) {
 			if (e.type !== "inbox.created" && e.type !== "inbox.updated") continue;
 			const { item } = e.payload;
-			if (item.kind !== "approval") continue;
+			if (item.kind !== "approval" && item.kind !== "question") continue;
 			if (item.status !== "open") {
 				clearTimeout(this.timers.get(item.id));
 				this.timers.delete(item.id);
@@ -52344,10 +53152,11 @@ var UnwatchedApprovals = class {
 	track(item) {
 		const { sessionId, requestId } = item;
 		if (item.status !== "open" || !sessionId || !requestId || this.timers.has(item.id)) return;
+		if (item.kind === "question" && !this.isMcpForm(item)) return;
 		const session = this.deps.repo.find(sessionId)?.session;
 		if (!session) return;
 		if (unattendedSession(this.deps, sessionId)) {
-			this.deny(item, UNATTENDED_APPROVAL);
+			this.close(item, UNATTENDED_APPROVAL);
 			return;
 		}
 		if (!isUnwatched(session)) return;
@@ -52355,26 +53164,33 @@ var UnwatchedApprovals = class {
 		const age = (this.deps.now?.() ?? Date.now()) - Date.parse(item.createdAt);
 		const timer = setTimeout(() => {
 			this.timers.delete(item.id);
-			this.deny(item, noAnswerDenial(waitMs));
+			this.close(item, noAnswerDenial(waitMs));
 		}, Math.max(0, waitMs - (Number.isFinite(age) ? age : 0)));
 		timer.unref?.();
 		this.timers.set(item.id, timer);
 	}
-	async deny(item, message) {
+	/** A question that is an MCP server's form (its transcript item names the server). */
+	isMcpForm(item) {
+		if (!item.sessionId || !item.itemId) return false;
+		const mirrored = this.deps.repo.item(item.sessionId, item.itemId)?.item;
+		return mirrored?.kind === "user_question" && mirrored.mcpServer !== void 0;
+	}
+	/** Deny an approval with `message`, or withdraw a form: never approve, never invent data. */
+	async close(item, message) {
 		if (this.deps.inbox.find(item.id)?.status !== "open") return;
 		if (!item.sessionId || !item.requestId) return;
 		try {
 			await this.deps.respond(item.sessionId, {
 				requestId: item.requestId,
-				response: {
+				response: item.kind === "approval" ? {
 					kind: "approval",
 					decision: "deny",
 					message,
 					decidedBy: "policy"
-				}
+				} : { kind: "cancel" }
 			});
 		} catch (error) {
-			this.deps.log?.(`approvals: deny ${item.id}: ${errorMessage$1(error)}`);
+			this.deps.log?.(`approvals: close ${item.id}: ${errorMessage$1(error)}`);
 		}
 	}
 };
@@ -57544,4 +58360,4 @@ main().then((code) => process.exit(code), (error) => {
 });
 export {};
 
-//# sourceMappingURL=main-hdQfX9V6.js.map
+//# sourceMappingURL=main-Bx58CdV4.js.map