nodal-agents 0.9.0 → 0.9.2

package/cli.js

@@ -11129,6 +11129,9 @@ var init_migrator2 = __esm({
 // ../../packages/db/src/migrate.ts
 var migrate_exports = {};
 __export(migrate_exports, {
+  findMigrationGaps: () => findMigrationGaps,
+  gapsBetween: () => gapsBetween,
+  repairMigrations: () => repairMigrations,
   runMigrations: () => runMigrations
 });
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -11142,6 +11145,7 @@ import {
   mkdirSync as mkdirSync3
 } from "fs";
 import { tmpdir } from "os";
+import { createHash as createHash2 } from "crypto";
 async function runMigrations(connectionString, opts = {}) {
   const sql2 = src_default(connectionString, {
     max: 1,
@@ -11151,13 +11155,24 @@ async function runMigrations(connectionString, opts = {}) {
     }
   });
   const db = drizzle(sql2);
-  const here = dirname2(fileURLToPath2(import.meta.url));
-  const sibling = join4(here, "migrations");
-  const sourceFolder = existsSync4(sibling) ? sibling : join4(here, "../migrations");
-  const migrationsFolder = opts.patchVectorAsText ? patchMigrationsForNoVector(sourceFolder) : sourceFolder;
+  const migrationsFolder = effectiveMigrationsFolder(opts);
   await migrate(db, { migrationsFolder });
   await sql2.end();
 }
+function sourceMigrationsFolder() {
+  const here = dirname2(fileURLToPath2(import.meta.url));
+  const sibling = join4(here, "migrations");
+  return existsSync4(sibling) ? sibling : join4(here, "../migrations");
+}
+function effectiveMigrationsFolder(opts) {
+  const source = sourceMigrationsFolder();
+  if (opts.patchVectorAsText !== true) return source;
+  const deja = dossiersPatches.get(source);
+  if (deja !== void 0) return deja;
+  const patche = patchMigrationsForNoVector(source);
+  dossiersPatches.set(source, patche);
+  return patche;
+}
 function patchMigrationsForNoVector(sourceFolder) {
   const tmpFolder = mkdtempSync(join4(tmpdir(), "nodalai-migrations-"));
   const metaDir = join4(tmpFolder, "meta");
@@ -11176,12 +11191,74 @@ function patchMigrationsForNoVector(sourceFolder) {
   }
   return tmpFolder;
 }
+function gapsBetween(journal, horodatagesAppliques) {
+  const applique = new Set(horodatagesAppliques.map((w) => Number(w)));
+  return journal.filter((e) => !applique.has(Number(e.when))).map((e) => ({ idx: e.idx, tag: e.tag, when: e.when }));
+}
+function readJournal(folder) {
+  const chemin = join4(folder, "meta", "_journal.json");
+  if (!existsSync4(chemin)) {
+    throw new Error(`migration journal not found at ${chemin}`);
+  }
+  const brut = JSON.parse(readFileSync3(chemin, "utf8"));
+  return brut.entries ?? [];
+}
+async function appliedWhen(sql2) {
+  const [present] = await sql2`
+    SELECT to_regclass('drizzle.__drizzle_migrations') IS NOT NULL AS ok`;
+  if (present?.ok !== true) return null;
+  const lignes = await sql2`
+    SELECT created_at FROM drizzle.__drizzle_migrations`;
+  return lignes.map((l) => Number(l.created_at)).filter((n) => Number.isFinite(n));
+}
+async function findMigrationGaps(connectionString, opts = {}) {
+  const sql2 = src_default(connectionString, { max: 1, onnotice: () => {
+  } });
+  try {
+    const applique = await appliedWhen(sql2);
+    if (applique === null) return [];
+    return gapsBetween(readJournal(effectiveMigrationsFolder(opts)), applique);
+  } finally {
+    await sql2.end();
+  }
+}
+async function repairMigrations(connectionString, opts = {}) {
+  const folder = effectiveMigrationsFolder(opts);
+  const sql2 = src_default(connectionString, { max: 1, onnotice: () => {
+  } });
+  try {
+    const applique = await appliedWhen(sql2);
+    if (applique === null) return [];
+    const trous = gapsBetween(readJournal(folder), applique);
+    for (const trou of trous) {
+      const fichier = join4(folder, `${trou.tag}.sql`);
+      if (!existsSync4(fichier)) {
+        throw new Error(`migration file missing for journal entry ${trou.tag}: ${fichier}`);
+      }
+      const contenu = readFileSync3(fichier, "utf8");
+      const hash = createHash2("sha256").update(contenu).digest("hex");
+      await sql2.begin(async (tx) => {
+        for (const instruction of contenu.split("--> statement-breakpoint")) {
+          if (instruction.trim() === "") continue;
+          await tx.unsafe(instruction).simple();
+        }
+        await tx`INSERT INTO drizzle.__drizzle_migrations ("hash", "created_at")
+                 VALUES (${hash}, ${trou.when})`;
+      });
+    }
+    return trous;
+  } finally {
+    await sql2.end();
+  }
+}
+var dossiersPatches;
 var init_migrate = __esm({
   "../../packages/db/src/migrate.ts"() {
     "use strict";
     init_src();
     init_postgres_js();
     init_migrator2();
+    dossiersPatches = /* @__PURE__ */ new Map();
   }
 });
 
@@ -11193,6 +11270,7 @@ __export(postgres_exports, {
   PG_USER: () => PG_USER,
   POSTMASTER_GAVE_UP: () => POSTMASTER_GAVE_UP,
   buildPgUrl: () => buildPgUrl,
+  findMigrationGaps: () => findMigrationGaps2,
   isPostgresAuthFailure: () => isPostgresAuthFailure,
   livePostmasterPid: () => livePostmasterPid,
   postgresProcessesForDataDir: () => postgresProcessesForDataDir,
@@ -11200,6 +11278,7 @@ __export(postgres_exports, {
   processStartedAtMs: () => processStartedAtMs,
   readPostmasterClaim: () => readPostmasterClaim,
   readPostmasterPid: () => readPostmasterPid,
+  repairMigrations: () => repairMigrations2,
   resolvePgCtl: () => resolvePgCtl,
   runMigrations: () => runMigrations2,
   startAndWaitUntilReady: () => startAndWaitUntilReady,
@@ -11346,8 +11425,8 @@ function postmasterHoldsDataDir(pid, dataDir) {
 function processStartedAtMs(pid) {
   if (process.platform !== "linux") return null;
   try {
-    const stat2 = readFileSync4(`/proc/${pid}/stat`, "utf-8");
-    const after = stat2.slice(stat2.lastIndexOf(")") + 2).split(" ");
+    const stat3 = readFileSync4(`/proc/${pid}/stat`, "utf-8");
+    const after = stat3.slice(stat3.lastIndexOf(")") + 2).split(" ");
     const ticksSinceBoot = Number.parseInt(after[19] ?? "", 10);
     if (!Number.isFinite(ticksSinceBoot)) return null;
     const uptimeSeconds = Number.parseFloat(
@@ -11637,6 +11716,14 @@ async function runMigrations2(databaseUrl, opts = {}) {
   const { runMigrations: migrate2 } = await Promise.resolve().then(() => (init_migrate(), migrate_exports));
   await migrate2(databaseUrl, opts);
 }
+async function findMigrationGaps2(databaseUrl, opts = {}) {
+  const { findMigrationGaps: chercher } = await Promise.resolve().then(() => (init_migrate(), migrate_exports));
+  return chercher(databaseUrl, opts);
+}
+async function repairMigrations2(databaseUrl, opts = {}) {
+  const { repairMigrations: reparer } = await Promise.resolve().then(() => (init_migrate(), migrate_exports));
+  return reparer(databaseUrl, opts);
+}
 var LEGACY_PG_PASSWORD, PG_USER, PG_DATABASE, READY_TIMEOUT_MS, POSTMASTER_GAVE_UP;
 var init_postgres = __esm({
   "src/lib/postgres.ts"() {
@@ -12651,6 +12738,13 @@ var init_webhook_trigger = __esm({
   }
 });
 
+// ../../packages/shared/src/entities/automation.ts
+var init_automation = __esm({
+  "../../packages/shared/src/entities/automation.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/shared/src/entities/skill.ts
 import { z as z16 } from "zod";
 var SkillOperationSchema, SkillRequiredConfigSchema, AgentSkillSchema, AgentSkillInsertSchema, AgentSkillAssignmentSchema, AgentSkillAssignmentInsertSchema;
@@ -13610,17 +13704,6 @@ var init_model_catalog = __esm({
             cacheWritePerMillionUsd: 6.25
           }
         },
-        {
-          modelId: "anthropic/claude-opus-5-fast",
-          label: "Claude Opus 5 (fast)",
-          capabilities: {
-            tools: true,
-            forcedToolChoice: true,
-            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
-          },
-          contextWindow: 1e6,
-          pricing: { inputPerMillionUsd: 10, outputPerMillionUsd: 50 }
-        },
         {
           modelId: "anthropic/claude-sonnet-5",
           label: "Claude Sonnet 5",
@@ -13653,6 +13736,34 @@ var init_model_catalog = __esm({
             cacheWritePerMillionUsd: 12.5
           }
         },
+        {
+          // The newest of the family (2026-09-01), read off /api/v1/models on
+          // 2026-09-22: same window, prices and modalities as Fable 5 except the
+          // cache READ price, four times lower (0.25 vs 1). Its `reasoning` object
+          // says mandatory:true with efforts max/xhigh/high/medium/low, so Off is
+          // hidden here — the Fable 5 entry above predates that object and still
+          // offers it (#417). No always-on `reasoning` flag, as for every Claude
+          // route in this file: the flag would flip openrouter.ts's default
+          // injection, and a mandatory model thinks anyway.
+          modelId: "anthropic/claude-fable-5.1",
+          label: "Claude Fable 5.1",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: {
+              kind: "effort",
+              levels: ["low", "medium", "high", "max"],
+              mandatory: true
+            }
+          },
+          contextWindow: 1e6,
+          pricing: {
+            inputPerMillionUsd: 10,
+            outputPerMillionUsd: 50,
+            cacheReadPerMillionUsd: 0.25,
+            cacheWritePerMillionUsd: 12.5
+          }
+        },
         // ─── OpenAI ───────────────────────────────────────────────────────────────
         // OpenAI was absent from the OpenRouter list entirely — not a curation
         // choice, a gap: the native `openai` provider carried gpt-5 while anyone
@@ -13705,6 +13816,107 @@ var init_model_catalog = __esm({
             cacheWritePerMillionUsd: 2.5
           }
         },
+        // The rest of the 5.6 series and GPT-6 Astra, read off OpenRouter's
+        // /api/v1/models on 2026-09-22 — including its `reasoning` object
+        // ({mandatory, default_enabled, supported_efforts}), which is what the
+        // control below follows. Sol, Sol Pro and Terra: mandatory:false,
+        // supported_efforts max/xhigh/high/medium/low/none → the Luna posture
+        // (four levels, Off offered). Astra and Astra Pro: mandatory:true, no
+        // 'none' → the same four levels with Off hidden. Prices are the
+        // STANDARD OpenAI service tier, the one the list endpoint reports; the
+        // endpoints list also carries a flex tier at half and a priority tier at
+        // double, and an override above 272K prompt tokens — the flat catalogue
+        // price is the standard tier, as for Luna and Terra Pro above. Upstream
+        // copy: Sol is the 5.6 flagship, Terra the balanced tier between Sol and
+        // Luna, Astra "OpenAI's flagship model for demanding end-to-end work".
+        {
+          modelId: "openai/gpt-5.6-terra",
+          label: "GPT-5.6 Terra",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
+          contextWindow: 105e4,
+          pricing: {
+            inputPerMillionUsd: 2,
+            outputPerMillionUsd: 12,
+            cacheReadPerMillionUsd: 0.2,
+            cacheWritePerMillionUsd: 2.5
+          }
+        },
+        {
+          modelId: "openai/gpt-5.6-sol",
+          label: "GPT-5.6 Sol",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
+          contextWindow: 105e4,
+          pricing: {
+            inputPerMillionUsd: 2,
+            outputPerMillionUsd: 10,
+            cacheReadPerMillionUsd: 0.2,
+            cacheWritePerMillionUsd: 2.5
+          }
+        },
+        {
+          modelId: "openai/gpt-5.6-sol-pro",
+          label: "GPT-5.6 Sol Pro",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
+          },
+          contextWindow: 105e4,
+          pricing: {
+            inputPerMillionUsd: 2,
+            outputPerMillionUsd: 10,
+            cacheReadPerMillionUsd: 0.2,
+            cacheWritePerMillionUsd: 2.5
+          }
+        },
+        {
+          modelId: "openai/gpt-6-astra",
+          label: "GPT-6 Astra",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: {
+              kind: "effort",
+              levels: ["low", "medium", "high", "max"],
+              mandatory: true
+            }
+          },
+          contextWindow: 105e4,
+          pricing: {
+            inputPerMillionUsd: 10,
+            outputPerMillionUsd: 50,
+            cacheReadPerMillionUsd: 1,
+            cacheWritePerMillionUsd: 12.5
+          }
+        },
+        {
+          modelId: "openai/gpt-6-astra-pro",
+          label: "GPT-6 Astra Pro",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: {
+              kind: "effort",
+              levels: ["low", "medium", "high", "max"],
+              mandatory: true
+            }
+          },
+          contextWindow: 105e4,
+          pricing: {
+            inputPerMillionUsd: 10,
+            outputPerMillionUsd: 50,
+            cacheReadPerMillionUsd: 1,
+            cacheWritePerMillionUsd: 12.5
+          }
+        },
         // Anthropic — reasoningControl WITHOUT the `reasoning` flag, on purpose:
         // the flag would flip openrouter.ts's always-on default injection; here
         // thinking is engaged only when the agent explicitly sets an effort.
@@ -13741,17 +13953,6 @@ var init_model_catalog = __esm({
             cacheWritePerMillionUsd: 6.25
           }
         },
-        {
-          modelId: "anthropic/claude-opus-4.7-fast",
-          label: "Claude Opus 4.7 (fast)",
-          capabilities: {
-            tools: true,
-            forcedToolChoice: true,
-            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
-          },
-          contextWindow: 1e6,
-          pricing: { inputPerMillionUsd: 30, outputPerMillionUsd: 150 }
-        },
         {
           modelId: "anthropic/claude-opus-4.8",
           label: "Claude Opus 4.8",
@@ -13768,17 +13969,6 @@ var init_model_catalog = __esm({
             cacheWritePerMillionUsd: 6.25
           }
         },
-        {
-          modelId: "anthropic/claude-opus-4.8-fast",
-          label: "Claude Opus 4.8 (fast)",
-          capabilities: {
-            tools: true,
-            forcedToolChoice: true,
-            reasoningControl: { kind: "effort", levels: ["low", "medium", "high", "max"] }
-          },
-          contextWindow: 1e6,
-          pricing: { inputPerMillionUsd: 10, outputPerMillionUsd: 50 }
-        },
         {
           modelId: "anthropic/claude-sonnet-4.6",
           label: "Claude Sonnet 4.6",
@@ -13869,6 +14059,58 @@ var init_model_catalog = __esm({
             cacheReadPerMillionUsd: 0.064902
           }
         },
+        {
+          // "The GA release of DeepSeek V4 Pro" (upstream copy) — the dated
+          // successor of the undated alias above. Pricing (DeepSeek's own
+          // endpoint), context and supported_parameters read off /api/v1/models
+          // on 2026-09-22. The levels follow the list endpoint's `reasoning`
+          // object: supported_efforts max/high/low, mandatory:false — so no
+          // 'medium', unlike the older entries above that predate that field.
+          modelId: "deepseek/deepseek-v4-pro-0813",
+          label: "DeepSeek V4 Pro (0813)",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            reasoningControl: { kind: "effort", levels: ["low", "high", "max"] }
+          },
+          contextWindow: 1048576,
+          providerOrder: ["deepseek"],
+          pricing: {
+            inputPerMillionUsd: 0.66,
+            outputPerMillionUsd: 1.98,
+            cacheReadPerMillionUsd: 0.022
+          }
+        },
+        {
+          // The newest Flash (2026-09-10), first on DeepSeek's Causal
+          // Encoder-Decoder architecture. One difference from every V4 Flash
+          // above: it takes IMAGE input (input_modalities: text, image), so it is
+          // in VISION_MODEL_IDS. Same reasoning caveat as its siblings; levels
+          // from the list endpoint's `reasoning` object (max/high/low,
+          // mandatory:false, default_enabled:true). forcedToolChoice:false —
+          // DeepSeek's own endpoint (the one providerOrder prefers) reports
+          // supports_tool_choice.required:false; some fallbacks (DeepInfra,
+          // Wafer) report true, and the runtime floor relaxes it anyway.
+          // 'max' → OpenRouter 'xhigh' and Auto → 'medium' are not in this
+          // model's supported_efforts; OpenRouter documents that it "will map
+          // your requested effort to the nearest supported level".
+          modelId: "deepseek/deepseek-v4.1-flash",
+          label: "DeepSeek V4.1 Flash",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: false,
+            reasoning: true,
+            reasoningControl: { kind: "effort", levels: ["low", "high", "max"] }
+          },
+          contextWindow: 1048576,
+          providerOrder: ["deepseek"],
+          pricing: {
+            inputPerMillionUsd: 0.15,
+            outputPerMillionUsd: 0.6,
+            cacheReadPerMillionUsd: 3e-3
+          }
+        },
         // Google — all three are thinking models on OpenRouter (supported_parameters
         // includes "reasoning", verified via openrouter.ai/google/… 2026-07-12).
         // reasoning:true makes the OpenRouter provider enable reasoning + round-trip
@@ -14120,6 +14362,93 @@ var init_model_catalog = __esm({
             cacheReadPerMillionUsd: 0.015
           }
         },
+        {
+          // "The high-speed variant of GLM-5.3-Flash ... up to 200 tokens/s"
+          // (upstream copy, 2026-09-18). Same model family as Flash: multimodal
+          // (text, image, video → VISION_MODEL_IDS), forcedToolChoice:false
+          // (supports_tool_choice.required:false on its endpoint). The control
+          // follows the list endpoint's `reasoning` object, read 2026-09-22:
+          // mandatory:true, supported_efforts max/high/low, default max — the
+          // full 5.3's posture, and the same object upstream now reports for
+          // Flash too (the Flash entry above predates that field). It differs
+          // from Flash on price (~5x) and context (1.05M, not 1.31M).
+          modelId: "z-ai/glm-5.3-flashx",
+          label: "GLM 5.3 FlashX",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: false,
+            reasoning: true,
+            reasoningControl: {
+              kind: "effort",
+              levels: ["low", "high", "max"],
+              mandatory: true
+            }
+          },
+          contextWindow: 1048576,
+          pricing: {
+            inputPerMillionUsd: 0.37,
+            outputPerMillionUsd: 1.25,
+            cacheReadPerMillionUsd: 0.075
+          }
+        },
+        // Xiaomi MiMo-V2.6 — the three 2.6 models OpenRouter serves (2026-09-21),
+        // all read off /api/v1/models and /models/<id>/endpoints on 2026-09-22:
+        // 1.05M context, 131K max output, input_modalities text+image+video+audio
+        // (→ VISION_MODEL_IDS), supported_parameters tools, tool_choice,
+        // reasoning, include_reasoning — and NO reasoning_effort. The list
+        // endpoint's `reasoning` object says only {mandatory:false}: no
+        // supported_efforts, so thinking can be switched on or off and nothing
+        // else — kind 'onoff', not a made-up scale. No always-on `reasoning`
+        // flag: Auto keeps the provider's default. forcedToolChoice:true —
+        // every endpoint reports supports_tool_choice.required:true.
+        // Upstream copy: Flash = 309B MoE / 15B active; Pro = the >1T flagship;
+        // Pro-UltraSpeed = the same Pro checkpoint "roughly 10x" faster, 10x the
+        // price.
+        {
+          modelId: "xiaomi/mimo-v2.6-flash",
+          label: "MiMo V2.6 Flash",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: { kind: "onoff" }
+          },
+          contextWindow: 1048576,
+          pricing: {
+            inputPerMillionUsd: 0.14,
+            outputPerMillionUsd: 0.28,
+            cacheReadPerMillionUsd: 28e-4
+          }
+        },
+        {
+          modelId: "xiaomi/mimo-v2.6-pro",
+          label: "MiMo V2.6 Pro",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: { kind: "onoff" }
+          },
+          contextWindow: 1048576,
+          pricing: {
+            inputPerMillionUsd: 0.435,
+            outputPerMillionUsd: 0.87,
+            cacheReadPerMillionUsd: 36e-4
+          }
+        },
+        {
+          modelId: "xiaomi/mimo-v2.6-pro-ultraspeed",
+          label: "MiMo V2.6 Pro UltraSpeed",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoningControl: { kind: "onoff" }
+          },
+          contextWindow: 1048576,
+          pricing: {
+            inputPerMillionUsd: 4.35,
+            outputPerMillionUsd: 8.7,
+            cacheReadPerMillionUsd: 0.036
+          }
+        },
         // Moonshot (Kimi)
         {
           modelId: "moonshotai/kimi-k2.6",
@@ -14198,6 +14527,56 @@ var init_model_catalog = __esm({
             cacheReadPerMillionUsd: 0.3
           }
         },
+        // Grok 4.6 (2026-08-12) and 4.7 (2026-09-21, "succeeding Grok 4.6" per
+        // upstream copy): same 500K context, same text+image+file input
+        // (→ VISION_MODEL_IDS), same supported_parameters as 4.5 (tools,
+        // tool_choice, reasoning, reasoning_effort), read off /api/v1/models and
+        // /models/<id>/endpoints on 2026-09-22. The control follows the list
+        // endpoint's `reasoning` object: mandatory:true (no Off), and — unlike
+        // 4.5, whose object stops at high — supported_efforts xhigh/high/medium/
+        // low, so 'max' (→ xhigh) is offered. Pricing: 4.6 = 4.5; 4.7 is 20%
+        // cheaper. Both double above 200K prompt tokens (an override the flat
+        // price does not carry, same as 4.5).
+        {
+          modelId: "x-ai/grok-4.6",
+          label: "Grok 4.6",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            reasoningControl: {
+              kind: "effort",
+              levels: ["low", "medium", "high", "max"],
+              mandatory: true
+            }
+          },
+          contextWindow: 5e5,
+          pricing: {
+            inputPerMillionUsd: 2,
+            outputPerMillionUsd: 6,
+            cacheReadPerMillionUsd: 0.5
+          }
+        },
+        {
+          modelId: "x-ai/grok-4.7",
+          label: "Grok 4.7",
+          capabilities: {
+            tools: true,
+            forcedToolChoice: true,
+            reasoning: true,
+            reasoningControl: {
+              kind: "effort",
+              levels: ["low", "medium", "high", "max"],
+              mandatory: true
+            }
+          },
+          contextWindow: 5e5,
+          pricing: {
+            inputPerMillionUsd: 1.6,
+            outputPerMillionUsd: 4.8,
+            cacheReadPerMillionUsd: 0.4
+          }
+        },
         // Qwen — both verified via OpenRouter /api/v1/models (2026-07-20): 1M
         // context, tools + tool_choice + reasoning params (no native
         // reasoning_effort — OpenRouter's unified param drives the hybrid
@@ -14280,13 +14659,12 @@ var init_model_catalog = __esm({
     VISION_MODEL_IDS = /* @__PURE__ */ new Set([
       // OpenRouter (verified via /api/v1/models)
       "anthropic/claude-fable-5",
+      // input_modalities ["text","image","file"] on /api/v1/models, 2026-09-22.
+      "anthropic/claude-fable-5.1",
       "anthropic/claude-haiku-4.5",
       "anthropic/claude-opus-4.7",
-      "anthropic/claude-opus-4.7-fast",
       "anthropic/claude-opus-4.8",
-      "anthropic/claude-opus-4.8-fast",
       "anthropic/claude-opus-5",
-      "anthropic/claude-opus-5-fast",
       "anthropic/claude-sonnet-4.6",
       "anthropic/claude-sonnet-5",
       "google/gemini-3.1-flash-lite-preview",
@@ -14302,14 +14680,35 @@ var init_model_catalog = __esm({
       "openai/gpt-5.6-luna",
       "openai/gpt-5.6-luna-pro",
       "openai/gpt-5.6-terra-pro",
+      // The rest of the 5.6 series and GPT-6 Astra: input_modalities
+      // ["file","image","text"] on /api/v1/models, 2026-09-22.
+      "openai/gpt-5.6-terra",
+      "openai/gpt-5.6-sol",
+      "openai/gpt-5.6-sol-pro",
+      "openai/gpt-6-astra",
+      "openai/gpt-6-astra-pro",
+      // deepseek/deepseek-v4.1-flash reports ["text","image"] (2026-09-22) — the
+      // first V4 Flash that does; v4-flash, v4-flash-0731 and both V4 Pro are
+      // text-only per the same source and deliberately NOT in this set.
+      "deepseek/deepseek-v4.1-flash",
       "qwen/qwen3.8-max",
       // Verified via OpenRouter /api/v1/models input_modalities on 2026-08-28:
       // z-ai/glm-5.3-flash reports ["text","image","video"]. The full z-ai/glm-5.3
       // reports ["text"] only and is deliberately NOT in this set.
       "z-ai/glm-5.3-flash",
+      // z-ai/glm-5.3-flashx reports the same ["text","image","video"] (2026-09-22).
+      "z-ai/glm-5.3-flashx",
+      // Xiaomi MiMo-V2.6: all three report ["text","image","video","audio"]
+      // (2026-09-22).
+      "xiaomi/mimo-v2.6-flash",
+      "xiaomi/mimo-v2.6-pro",
+      "xiaomi/mimo-v2.6-pro-ultraspeed",
       // Verified via OpenRouter /api/v1/models input_modalities (2026-07-20).
       // qwen/qwen3.7-max is deliberately absent — text-only per the same source.
       "x-ai/grok-4.5",
+      // 4.6 and 4.7 report the same ["text","image","file"] (2026-09-22).
+      "x-ai/grok-4.6",
+      "x-ai/grok-4.7",
       "qwen/qwen3.7-plus",
       // Native-provider forms
       "claude-fable-5",
@@ -14379,6 +14778,53 @@ var init_approval_explain = __esm({
   }
 });
 
+// ../../packages/shared/src/approval-rules-chain.ts
+var init_approval_rules_chain = __esm({
+  "../../packages/shared/src/approval-rules-chain.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/shared/src/approval-tool-default.ts
+var SAFE_BY_DEFAULT_TOOL_NAMES, SAFE_BY_DEFAULT;
+var init_approval_tool_default = __esm({
+  "../../packages/shared/src/approval-tool-default.ts"() {
+    "use strict";
+    init_approval_rules_chain();
+    SAFE_BY_DEFAULT_TOOL_NAMES = [
+      "attach_agent",
+      "attach_connector",
+      "attach_mcp",
+      "attach_skill",
+      "cloudflare_delete_worker",
+      "cloudflare_deploy",
+      "code_task",
+      "create_agent",
+      "create_connector",
+      "create_mcp",
+      "create_schedule",
+      "create_skill",
+      "declare_verification",
+      "detach_agent",
+      "detach_connector",
+      "detach_mcp",
+      "detach_skill",
+      "register_project",
+      "run_command",
+      "run_schedule",
+      "run_skill_script",
+      "skill_file_write",
+      "toggle_schedule",
+      "update_agent",
+      "update_schedule",
+      "update_skill",
+      "xlsx_delete_columns",
+      "xlsx_delete_rows"
+    ];
+    SAFE_BY_DEFAULT = new Set(SAFE_BY_DEFAULT_TOOL_NAMES);
+  }
+});
+
 // ../../packages/shared/src/untrusted.ts
 var init_untrusted = __esm({
   "../../packages/shared/src/untrusted.ts"() {
@@ -14599,7 +15045,7 @@ function parseVerificationSurfaces(raw) {
     shell: pick("shell")
   };
 }
-var VerificationSurfacesSchema, DEFAULT_VERIFICATION_SURFACES, VERIFICATION_SURFACE_TOOLS;
+var VerificationSurfacesSchema, DEFAULT_VERIFICATION_SURFACES, VERIFICATION_SURFACE_TOOLS, PROOF_REPAIR_ATTEMPTS_CHOICES;
 var init_verification_surfaces = __esm({
   "../../packages/shared/src/verification-surfaces.ts"() {
     "use strict";
@@ -14648,6 +15094,7 @@ var init_verification_surfaces = __esm({
       ],
       shell: ["run_command", "run_skill_script"]
     });
+    PROOF_REPAIR_ATTEMPTS_CHOICES = Object.freeze([0, 1, 2, 3]);
   }
 });
 
@@ -14694,6 +15141,7 @@ var init_src2 = __esm({
     init_approval();
     init_memory();
     init_webhook_trigger();
+    init_automation();
     init_skill();
     init_schedule();
     init_llm_key();
@@ -14712,6 +15160,8 @@ var init_src2 = __esm({
     init_redact_secrets();
     init_approval_impact();
     init_approval_explain();
+    init_approval_rules_chain();
+    init_approval_tool_default();
     init_untrusted();
     init_redact_transcript();
     init_agent_slug();
@@ -14845,10 +15295,10 @@ var init_entities = __esm({
         updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow(),
         lastCuratorRunAt: timestamp("last_curator_run_at", { withTimezone: true }),
         reflectionEnabled: boolean("reflection_enabled").notNull().default(false),
-        // Decoupled from reflection_enabled (which gates the skill-learning loop,
-        // opt-in). Gates the memory curator (Phase 2 LLM pass) — ON by default so
-        // memory curation runs even for entities that never opted into reflection.
-        memoryCurationEnabled: boolean("memory_curation_enabled").notNull().default(true),
+        // `memory_curation_enabled` lived here from 0.7.0 to migration 0122 (#411):
+        // a per-workspace gate on the memory curator that no screen ever exposed.
+        // Memory curation is now gated by the runner's MEMORY_CURATION_ENABLED
+        // kill-switch only; "do not touch this fact" is the pin on the fact.
         // Controls whether agent-authored skills are auto-assigned to the authoring
         // agent ('auto') or queued for the entity owner to approve ('approval').
         skillAssignmentMode: text("skill_assignment_mode").notNull().default("approval").$type(),
@@ -14880,9 +15330,27 @@ var init_entities = __esm({
          * vit dans le parseur, jamais deviné par un backfill (même leçon que
          * 0084 : un réglage est un geste, pas un état inventé).
          */
-        verificationSurfaces: jsonb("verification_surfaces").notNull().default(sql`'{}'::jsonb`)
+        verificationSurfaces: jsonb("verification_surfaces").notNull().default(sql`'{}'::jsonb`),
+        /**
+         * Combien de tours de réparation un run reçoit au plus après une preuve
+         * rouge (issue #377, migration 0121). La borne de #375 était écrite en
+         * dur dans `finalize.ts` ; elle se règle désormais par espace.
+         *
+         * `0` — le run finit avec le verdict rouge immédiatement, comme avant
+         * #375. `1` (défaut) — un tour, la décision D2 du plan. Jusqu'à `3`.
+         *
+         * LE CHECK EST EN BASE, pas seulement dans le formulaire : cette colonne
+         * borne une boucle du runner (invariant #8), et une valeur de 9 999 écrite
+         * par un script ferait tourner un agent toute la nuit sur une preuve qui
+         * ne passera jamais.
+         */
+        proofRepairAttempts: integer("proof_repair_attempts").notNull().default(1)
       },
       (table) => [
+        check(
+          "entities_proof_repair_attempts_check",
+          sql`${table.proofRepairAttempts} >= 0 AND ${table.proofRepairAttempts} <= 3`
+        ),
         uniqueIndex("entities_mcp_token_idx").on(table.mcpToken),
         index("idx_entities_user_id").on(table.userId),
         index("idx_entities_root_agent_id").on(table.rootAgentId)
@@ -15446,6 +15914,35 @@ var init_jobs = __esm({
          * référence déjà agent_jobs pour `registered_job_id`.
          */
         projectId: uuid("project_id"),
+        /**
+         * UN LIVRABLE DE CE RUN ATTEND LE REGARD DE LA PERSONNE (#255, migration
+         * 0118). L'instant où le run a livré ; NULL = rien n'attend.
+         *
+         * POSÉ par la porte terminale de succès (`finalizeJobSuccess`), dans la
+         * MÊME transaction que le statut terminal, quand le run a produit au moins
+         * un livrable `addressed AND produced` — nommé par un outil, ET réellement
+         * écrit. Les deux ensemble : `addressed` seul est une intention, qu'une
+         * écriture ratée laisse en place.
+         *
+         * EFFACÉ par le seul côté web, et par les deux gestes qui sont des
+         * regards : ouvrir le run (`getSpaceConversationAction`, la page qui
+         * MONTRE les livrables) ou ouvrir le fil (`markConversationRead`, au même
+         * endroit que le marqueur de lecture). Le runner ne l'efface jamais : une
+         * livraison de canal ne fait rien regarder à personne, exactement comme
+         * pour `conversation_reads`.
+         *
+         * PORTÉ PAR LE JOB DE TÊTE, jamais par le délégué qui a produit : c'est le
+         * run que la personne ouvre, et la page d'un run remonte déjà les
+         * livrables de toute sa descendance (`collectDescendants`). La chaîne est
+         * remontée à l'écriture, bornée par la profondeur de délégation.
+         *
+         * PAR ESPACE, pas par personne — au contraire de `conversation_reads`.
+         * C'est la règle de la PASTILLE d'attention, à laquelle ce fait s'ajoute :
+         * une approbation résolue par l'un tombe pour tous, et un livrable regardé
+         * par l'un aussi. Une colonne unique dit donc ici la même chose que les
+         * deux autres sources de la pastille.
+         */
+        deliverableCheckDueAt: timestamp("deliverable_check_due_at", { withTimezone: true }),
         completedAt: timestamp("completed_at", { withTimezone: true }),
         createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
         updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow()
@@ -15484,6 +15981,12 @@ var init_jobs = __esm({
         // liste des projets) — partiel, la colonne reste NULL sur l'immense
         // majorité des jobs.
         index("idx_agent_jobs_project").on(table.projectId).where(sql`${table.projectId} IS NOT NULL`),
+        // 0118 (#255) : la pastille d'attention relit « quels runs de cet espace
+        // attendent un regard » toutes les 15 secondes, sur toutes les pages du
+        // tableau de bord. PARTIEL : la colonne est NULL sur presque tous les
+        // jobs, et elle le redevient dès que la personne a regardé — l'index reste
+        // donc de la taille de ce qui attend, pas de celle de la table.
+        index("idx_agent_jobs_deliverable_check_due").on(table.entityId).where(sql`${table.deliverableCheckDueAt} IS NOT NULL`),
         check(
           "agent_jobs_status_check",
           sql`${table.status} IN ('pending','processing','completed','failed','awaiting_approval','awaiting_delegation','cancelled')`
@@ -16368,6 +16871,32 @@ var init_code_projects = __esm({
   }
 });
 
+// ../../packages/db/src/schema/excluded-project-paths.ts
+var excludedProjectPaths;
+var init_excluded_project_paths = __esm({
+  "../../packages/db/src/schema/excluded-project-paths.ts"() {
+    "use strict";
+    init_pg_core();
+    init_entities();
+    excludedProjectPaths = pgTable(
+      "excluded_project_paths",
+      {
+        id: uuid("id").primaryKey().defaultRandom(),
+        entityId: uuid("entity_id").notNull().references(() => entities.id, { onDelete: "cascade" }),
+        /** Chemin absolu slash-normalisé, tel qu'il s'affiche — jamais recasé après coup. */
+        projectPath: text("project_path").notNull(),
+        /** `projectKey(project_path)` — l'identité, et ce que porte l'unicité. */
+        projectKey: text("project_key").notNull(),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+      },
+      (table) => [
+        unique("excluded_project_paths_entity_key_unique").on(table.entityId, table.projectKey),
+        index("idx_excluded_project_paths_entity").on(table.entityId)
+      ]
+    );
+  }
+});
+
 // ../../packages/db/src/schema/auth.ts
 var sessions, accounts, verifications;
 var init_auth = __esm({
@@ -17193,6 +17722,7 @@ var init_job_checkpoints = __esm({
   "../../packages/db/src/schema/job-checkpoints.ts"() {
     "use strict";
     init_pg_core();
+    init_drizzle_orm();
     init_jobs();
     jobCheckpoints = pgTable(
       "job_checkpoints",
@@ -17205,7 +17735,23 @@ var init_job_checkpoints = __esm({
         workspace: text("workspace").notNull(),
         /** Le commit dans le magasin fantôme — l'état d'avant de ce tour. */
         sha: text("sha").notNull(),
-        takenAt: timestamp("taken_at", { withTimezone: true }).notNull().defaultNow()
+        takenAt: timestamp("taken_at", { withTimezone: true }).notNull().defaultNow(),
+        /**
+         * COMBIEN DE TEMPS LA PHOTO A PRIS, en millisecondes (#261, migration 0119).
+         *
+         * Mesurée autour du seul appel de `snapshot`, aux deux endroits qui
+         * photographient : le seam de `packages/tools` et le harnais CLI du runner.
+         *
+         * Elle existe pour que la montée d'un dossier SE VOIE avant qu'elle ne
+         * refuse quoi que ce soit : `git add` est borné à 30 secondes, et jusqu'ici
+         * la durée ne vivait que sur le chemin d'ÉCHEC, en mémoire, le temps de
+         * rendre la phrase du refus. Une photo qui réussit en 24 secondes ne
+         * laissait aucune trace — le cas qu'il faut justement voir venir.
+         *
+         * NULL = pas mesurée (une ligne d'avant la colonne). L'écran le dit ; il
+         * n'affiche jamais un zéro, qui se lirait « instantané » (invariant #4).
+         */
+        snapshotMs: integer("snapshot_ms")
       },
       (table) => [
         unique("job_checkpoints_job_turn_workspace_unique").on(
@@ -17213,7 +17759,19 @@ var init_job_checkpoints = __esm({
           table.turn,
           table.workspace
         ),
-        index("idx_job_checkpoints_job").on(table.jobId)
+        index("idx_job_checkpoints_job").on(table.jobId),
+        // 0119 (#261) : « la dernière photo de cet espace », un `ORDER BY taken_at
+        // DESC LIMIT 1` par espace. Sans lui, le parcours dégénère pour un espace
+        // SILENCIEUX — dont la dernière photo est justement la plus ancienne, donc
+        // la plus loin (revue C, passe 2 de la PR #324).
+        index("idx_job_checkpoints_taken_at").on(sql`${table.takenAt} DESC`),
+        // La durée est un CONSTAT, jamais négative. Pas de borne supérieure : une
+        // photo peut légitimement durer plus que le budget de `git add`, et une
+        // borne inventée refuserait la ligne au moment où elle intéresse le plus.
+        check(
+          "job_checkpoints_snapshot_ms_check",
+          sql`${table.snapshotMs} IS NULL OR ${table.snapshotMs} >= 0`
+        )
       ]
     );
   }
@@ -17313,6 +17871,7 @@ __export(schema_exports, {
   entityLlmKeys: () => entityLlmKeys,
   entityMembers: () => entityMembers,
   entitySettings: () => entitySettings,
+  excludedProjectPaths: () => excludedProjectPaths,
   jobCheckpoints: () => jobCheckpoints,
   jobDeliverableVerificationState: () => jobDeliverableVerificationState,
   jobDeliveries: () => jobDeliveries,
@@ -17353,6 +17912,7 @@ var init_schema2 = __esm({
     init_llm_keys();
     init_mcp();
     init_code_projects();
+    init_excluded_project_paths();
     init_auth();
     init_agent_connector_assignments();
     init_agent_workspaces();
@@ -17731,7 +18291,7 @@ var init_master_key_guard = __esm({
 });
 
 // ../../packages/db/src/queries/channel-identity.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 async function resolveOwnerConversation(db, agentId, channel) {
   if (channel === "telegram") {
     const [row2] = await db.select({ chatId: telegramAllowedChats.chatId }).from(telegramAllowedChats).where(
@@ -17807,7 +18367,7 @@ function credentialsFingerprint(creds) {
   const canonical = JSON.stringify(
     Object.keys(creds).sort().map((k) => [k, creds[k]])
   );
-  return createHash2("sha256").update(canonical).digest("hex");
+  return createHash3("sha256").update(canonical).digest("hex");
 }
 async function getBindingCredentials(db, agentId, channel) {
   if (channel === "telegram") {
@@ -18488,6 +19048,7 @@ __export(src_exports, {
   entityMembers: () => entityMembers,
   entitySettings: () => entitySettings,
   eq: () => eq,
+  excludedProjectPaths: () => excludedProjectPaths,
   getAppSetting: () => getAppSetting,
   getBindingCredentials: () => getBindingCredentials,
   getChannelBinding: () => getChannelBinding,
@@ -18627,7 +19188,7 @@ var init_local_auth = __esm({
 });
 
 // ../../packages/auth/src/lib/constant-time.ts
-import { createHash as createHash3, timingSafeEqual } from "crypto";
+import { createHash as createHash4, timingSafeEqual } from "crypto";
 var init_constant_time = __esm({
   "../../packages/auth/src/lib/constant-time.ts"() {
     "use strict";
@@ -19656,6 +20217,7 @@ var init_processes = __esm({
 // src/commands/up.ts
 var up_exports = {};
 __export(up_exports, {
+  migrationGapRefusal: () => migrationGapRefusal,
   runUp: () => runUp
 });
 import chalk from "chalk";
@@ -19690,6 +20252,21 @@ function printLogTail(service, lines) {
   ${service}: could not read ${logFile}`));
   }
 }
+function migrationGapRefusal(gaps, opts) {
+  const combien = `${gaps.length} migration${gaps.length === 1 ? "" : "s"}`;
+  return [
+    `The database is missing ${combien} the journal announces:`,
+    "",
+    ...gaps.map((g) => `    ${g.tag}`),
+    "",
+    "  Tables are short of columns the code expects, so writes to them will fail.",
+    "  Nodal-Agents will not serve a database in that state.",
+    "",
+    "  Apply them with:",
+    "",
+    `    nodal-agents up --repair-migrations${opts.dev ? " --dev" : ""}${opts.detach ? " --detach" : ""}`
+  ].join("\n");
+}
 async function runUp(opts = {}) {
   const binaries = await probeEmbeddedPostgres();
   if (!binaries.ok) {
@@ -19996,6 +20573,35 @@ ${lines}
     await pg.stop();
     throw err;
   }
+  const vectorPatched = { patchVectorAsText: !pg.vectorAvailable };
+  const gapSpinner = ora("Checking the migration journal\u2026").start();
+  let gaps = await findMigrationGaps2(databaseUrl, vectorPatched).catch(async (err) => {
+    gapSpinner.fail("Could not read the migration journal");
+    await pg.stop();
+    throw err;
+  });
+  if (gaps.length > 0 && opts.repairMigrations === true) {
+    gapSpinner.text = `Repairing ${gaps.length} skipped migration${gaps.length === 1 ? "" : "s"}\u2026`;
+    try {
+      const repaired = await repairMigrations2(databaseUrl, vectorPatched);
+      gapSpinner.succeed(chalk.green(`Repaired: ${repaired.map((g) => g.tag).join(", ")}`));
+    } catch (err) {
+      gapSpinner.fail("Repair failed");
+      await pg.stop();
+      throw err;
+    }
+    gaps = await findMigrationGaps2(databaseUrl, vectorPatched);
+  }
+  if (gaps.length > 0) {
+    gapSpinner.fail(
+      `${gaps.length} migration${gaps.length === 1 ? "" : "s"} in the journal never reached this database`
+    );
+    await pg.stop();
+    throw new Error(
+      migrationGapRefusal(gaps, { dev: opts.dev === true, detach: opts.detach === true })
+    );
+  }
+  gapSpinner.succeed(chalk.green("Migration journal complete"));
   {
     const { db, close } = createClient(databaseUrl, { max: 1 });
     try {
@@ -20683,8 +21289,45 @@ var init_logs = __esm({
   }
 });
 
+// ../../packages/shared/src/git-binary.ts
+import { stat } from "fs/promises";
+import { delimiter as PATH_DELIMITER } from "path";
+function enBarresObliques(chemin) {
+  return chemin.replace(/\\/g, "/");
+}
+async function estFichier(chemin) {
+  try {
+    return (await stat(chemin)).isFile();
+  } catch {
+    return false;
+  }
+}
+async function resolveGitBinary() {
+  gitBinaire ??= (async () => {
+    const chemins = (process.env["PATH"] ?? "").split(PATH_DELIMITER).filter((d) => d !== "");
+    const windows = process.platform === "win32";
+    for (const dossier of chemins) {
+      const base = `${enBarresObliques(dossier)}/git`;
+      for (const ext of windows ? EXTENSIONS_WINDOWS : [""]) {
+        if (await estFichier(base + ext)) return base + ext;
+      }
+    }
+    console.warn("[git] GIT_NOT_ON_PATH");
+    return null;
+  })();
+  return gitBinaire;
+}
+var EXTENSIONS_WINDOWS, gitBinaire;
+var init_git_binary = __esm({
+  "../../packages/shared/src/git-binary.ts"() {
+    "use strict";
+    EXTENSIONS_WINDOWS = [".exe", ".com"];
+    gitBinaire = null;
+  }
+});
+
 // ../../packages/checkpoints/src/failure.ts
-import { readdir, stat } from "fs/promises";
+import { readdir, stat as stat2 } from "fs/promises";
 import { basename, join as join13 } from "path";
 function checkpointFailureCode(cause, operation) {
   if (cause === "git_missing") return "git_missing";
@@ -20729,7 +21372,7 @@ async function measureWorkspace(workspace, limits = {}) {
       }
       files++;
       try {
-        bytes += (await stat(join13(dir, entry.name))).size;
+        bytes += (await stat2(join13(dir, entry.name))).size;
       } catch {
       }
     }
@@ -20842,7 +21485,7 @@ var init_failure = __esm({
 
 // ../../packages/checkpoints/src/checkpoints.ts
 import { execFile, spawn } from "child_process";
-import { createHash as createHash4, randomBytes as randomBytes6 } from "crypto";
+import { createHash as createHash5, randomBytes as randomBytes6 } from "crypto";
 import { mkdir, rm, writeFile } from "fs/promises";
 import { existsSync as existsSync13 } from "fs";
 import { join as join14 } from "path";
@@ -20869,7 +21512,13 @@ function isTimeoutError(err) {
   const e = err;
   return e.killed === true || e.code === "ETIMEDOUT";
 }
+async function gitBinary() {
+  const binaire = await resolveGitBinary();
+  if (binaire === null) throw new GitBinaryMissingError();
+  return binaire;
+}
 function isGitMissingError(err) {
+  if (err instanceof GitBinaryMissingError) return true;
   if (typeof err !== "object" || err === null) return false;
   const e = err;
   return e.code === "ENOENT" && typeof e.syscall === "string" && e.syscall.startsWith("spawn");
@@ -20917,7 +21566,7 @@ function workspaceKey(workspace) {
     norm = norm.toLowerCase().replace(/\//g, "\\");
   }
   norm = norm.replace(/[\\/]+$/, "");
-  return createHash4("sha256").update(norm).digest("hex").slice(0, 16);
+  return createHash5("sha256").update(norm).digest("hex").slice(0, 16);
 }
 function gitEnv(store, workspace, indexFile) {
   const key = workspaceKey(workspace);
@@ -20941,7 +21590,7 @@ function gitEnv(store, workspace, indexFile) {
   };
 }
 async function git(store, workspace, args, indexFile, timeoutMs = storeTimeoutMs()) {
-  const { stdout } = await run("git", args, {
+  const { stdout } = await run(await gitBinary(), args, {
     timeout: timeoutMs,
     windowsHide: true,
     env: gitEnv(store, workspace, indexFile)
@@ -20954,7 +21603,7 @@ async function ensureStore(store) {
   await writeFile(join14(store, "gitconfig"), "", { flag: "a" });
   if (!existsSync13(join14(gitDir, "HEAD"))) {
     await mkdir(gitDir, { recursive: true });
-    await run("git", ["init", "--bare", "--quiet", gitDir], {
+    await run(await gitBinary(), ["init", "--bare", "--quiet", gitDir], {
       timeout: GIT_TIMEOUT_MS,
       windowsHide: true
     });
@@ -21020,14 +21669,23 @@ async function restoreCheckpoint(store, workspace, sha) {
   await git(store, workspace, ["checkout", "-f", sha, "--", "."]);
   return { restored: sha, safety };
 }
-var run, GIT_TIMEOUT_MS, badTimeoutSaid, EXCLUDES, CHECKPOINT_COVERAGE_NOTE;
+var run, GIT_TIMEOUT_MS, badTimeoutSaid, GitBinaryMissingError, EXCLUDES, CHECKPOINT_COVERAGE_NOTE;
 var init_checkpoints = __esm({
   "../../packages/checkpoints/src/checkpoints.ts"() {
     "use strict";
+    init_git_binary();
     init_failure();
     run = promisify(execFile);
     GIT_TIMEOUT_MS = 3e4;
     badTimeoutSaid = false;
+    GitBinaryMissingError = class extends Error {
+      constructor() {
+        super(
+          "git is not on PATH: no checkpoint can be taken or read. Install git, or make it reachable from the process PATH."
+        );
+        this.name = "GitBinaryMissingError";
+      }
+    };
     EXCLUDES = [
       ...SKIPPED_DIRS.map((dir) => `${dir}/`),
       ...SKIPPED_FILE_SUFFIXES.map((suffixe) => `*${suffixe}`)
@@ -34835,10 +35493,17 @@ program.command("init").description("Interactive wizard \u2014 configure LLM, po
     process.exit(1);
   }
 });
-program.command("up").description("Start Postgres, runner, and web \u2014 open browser when ready").option("--dev", "Run web in `next dev` mode (HMR, no prebuild required)").option("-d, --detach", "Return to the prompt once healthy \u2014 services keep running").action(async (opts) => {
+program.command("up").description("Start Postgres, runner, and web \u2014 open browser when ready").option("--dev", "Run web in `next dev` mode (HMR, no prebuild required)").option("-d, --detach", "Return to the prompt once healthy \u2014 services keep running").option(
+  "--repair-migrations",
+  "Apply migrations the journal announces and this database never got"
+).action(async (opts) => {
   const { runUp: runUp2 } = await Promise.resolve().then(() => (init_up(), up_exports));
   try {
-    await runUp2({ dev: opts.dev, detach: opts.detach });
+    await runUp2({
+      dev: opts.dev,
+      detach: opts.detach,
+      repairMigrations: opts.repairMigrations
+    });
   } catch (err) {
     console.error(chalk8.red("Error:"), err instanceof Error ? err.message : String(err));
     process.exit(1);