openmates 0.14.7-alpha.9 → 0.14.8-alpha.0

package/dist/{chunk-ADAQQBYE.js → chunk-7BIVPFKJ.js}

@@ -27,6 +27,12 @@ var CIPHERTEXT_HEADER_LENGTH = 2 + FINGERPRINT_LENGTH;
 var API_KEY_PREFIX = "sk-api-";
 var API_KEY_RANDOM_LENGTH = 32;
 var API_KEY_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+var CHAT_RECOVERY_PROTOCOL_VERSION = 1;
+var CHAT_RECOVERY_MAX_PAYLOAD_BYTES = 16 * 1024 * 1024;
+var CHAT_RECOVERY_KEY_BYTES = 32;
+var CHAT_RECOVERY_NONCE_BYTES = 12;
+var CHAT_RECOVERY_AAD_PREFIX = new TextEncoder().encode("OMCR1");
+var CHAT_RECOVERY_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function base64ToBytes(input) {
   return new Uint8Array(Buffer.from(input, "base64"));
 }
@@ -38,6 +44,144 @@ function toArrayBuffer(input) {
   new Uint8Array(output).set(input);
   return output;
 }
+function bytesToBase64Url(input) {
+  return Buffer.from(input).toString("base64url");
+}
+function base64UrlToBytes(input, field, expectedLength) {
+  if (!input || input.includes("=")) {
+    throw new Error(`${field} must be non-empty unpadded base64url`);
+  }
+  const decoded = new Uint8Array(Buffer.from(input, "base64url"));
+  if (bytesToBase64Url(decoded) !== input) {
+    throw new Error(`${field} must be canonical base64url`);
+  }
+  if (expectedLength !== void 0 && decoded.length !== expectedLength) {
+    throw new Error(`${field} must decode to ${expectedLength} bytes`);
+  }
+  return decoded;
+}
+function uint32(value, field) {
+  if (!Number.isInteger(value) || value < 0 || value > 4294967295) {
+    throw new Error(`${field} must be an unsigned 32-bit integer`);
+  }
+  const encoded = new Uint8Array(4);
+  new DataView(encoded.buffer).setUint32(0, value, false);
+  return encoded;
+}
+function recoveryKeyVersion(value) {
+  if (value === 0) {
+    throw new Error("key_version must be greater than zero");
+  }
+  return uint32(value, "key_version");
+}
+function canonicalUuid(value, field) {
+  if (!CHAT_RECOVERY_UUID_PATTERN.test(value)) {
+    throw new Error(`${field} must be a canonical lowercase UUID`);
+  }
+  return new TextEncoder().encode(value);
+}
+function concatBytes(...values) {
+  const output = new Uint8Array(values.reduce((total, value) => total + value.length, 0));
+  let offset = 0;
+  for (const value of values) {
+    output.set(value, offset);
+    offset += value.length;
+  }
+  return output;
+}
+function lengthPrefix(value) {
+  return concatBytes(uint32(value.length, "length"), value);
+}
+async function sha256(input) {
+  return new Uint8Array(await cryptoApi.subtle.digest("SHA-256", toArrayBuffer(input)));
+}
+async function hkdfSha256(input, salt, info) {
+  const key = await cryptoApi.subtle.importKey("raw", toArrayBuffer(input), "HKDF", false, ["deriveBits"]);
+  const bits = await cryptoApi.subtle.deriveBits(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: toArrayBuffer(salt),
+      info: toArrayBuffer(info)
+    },
+    key,
+    256
+  );
+  return new Uint8Array(bits);
+}
+async function deriveChatCompletionRecoveryKeypair(chatKey, chatId, keyVersion) {
+  const rawChatKey = base64UrlToBytes(chatKey, "chat_key", CHAT_RECOVERY_KEY_BYTES);
+  const salt = await sha256(new TextEncoder().encode("openmates:chat-recovery:v1"));
+  const info = concatBytes(lengthPrefix(canonicalUuid(chatId, "chat_id")), recoveryKeyVersion(keyVersion));
+  const privateKey = await hkdfSha256(rawChatKey, salt, info);
+  return {
+    privateKey: bytesToBase64Url(privateKey),
+    publicKey: bytesToBase64Url(nacl.scalarMult.base(privateKey))
+  };
+}
+function buildRecoveryAssociatedData(values) {
+  const associatedData = concatBytes(
+    CHAT_RECOVERY_AAD_PREFIX,
+    lengthPrefix(canonicalUuid(values.owner_id, "owner_id")),
+    lengthPrefix(canonicalUuid(values.chat_id, "chat_id")),
+    lengthPrefix(canonicalUuid(values.turn_id, "turn_id")),
+    lengthPrefix(canonicalUuid(values.job_id, "job_id")),
+    lengthPrefix(canonicalUuid(values.assistant_message_id, "assistant_message_id")),
+    recoveryKeyVersion(values.key_version)
+  );
+  return bytesToBase64Url(associatedData);
+}
+function recoveryAssociatedData(identity) {
+  return base64UrlToBytes(
+    buildRecoveryAssociatedData({
+      owner_id: identity.ownerId,
+      chat_id: identity.chatId,
+      turn_id: identity.turnId,
+      job_id: identity.jobId,
+      assistant_message_id: identity.assistantMessageId,
+      key_version: identity.keyVersion
+    }),
+    "associated_data"
+  );
+}
+async function recoveryEnvelopeKey(sharedSecret, associatedData) {
+  if (sharedSecret.every((value) => value === 0)) {
+    throw new Error("X25519 shared secret must not be all zero");
+  }
+  const salt = await sha256(new TextEncoder().encode("openmates:chat-recovery-envelope:v1"));
+  return hkdfSha256(sharedSecret, salt, await sha256(associatedData));
+}
+async function openChatCompletionRecoveryEnvelope(envelope, options) {
+  if (!envelope || Object.keys(envelope).sort().join(",") !== "ciphertext,epk,nonce,v" || envelope.v !== CHAT_RECOVERY_PROTOCOL_VERSION) {
+    throw new Error("invalid recovery envelope fields or version");
+  }
+  const recoveryPrivateKey = base64UrlToBytes(
+    options.recoveryPrivateKey,
+    "recovery_private_key",
+    CHAT_RECOVERY_KEY_BYTES
+  );
+  const ephemeralPublicKey = base64UrlToBytes(envelope.epk, "epk", CHAT_RECOVERY_KEY_BYTES);
+  const nonce = base64UrlToBytes(envelope.nonce, "nonce", CHAT_RECOVERY_NONCE_BYTES);
+  const ciphertext = base64UrlToBytes(envelope.ciphertext, "ciphertext");
+  if (ciphertext.length < 16 || ciphertext.length - 16 > CHAT_RECOVERY_MAX_PAYLOAD_BYTES) {
+    throw new Error("ciphertext payload size is invalid");
+  }
+  const associatedData = recoveryAssociatedData(options);
+  const sharedSecret = nacl.scalarMult(recoveryPrivateKey, ephemeralPublicKey);
+  const envelopeKeyBytes = await recoveryEnvelopeKey(sharedSecret, associatedData);
+  const envelopeKey = await cryptoApi.subtle.importKey(
+    "raw",
+    toArrayBuffer(envelopeKeyBytes),
+    { name: "AES-GCM" },
+    false,
+    ["decrypt"]
+  );
+  return new Uint8Array(await cryptoApi.subtle.decrypt(
+    { name: "AES-GCM", iv: toArrayBuffer(nonce), additionalData: toArrayBuffer(associatedData) },
+    envelopeKey,
+    toArrayBuffer(ciphertext)
+  ));
+}
 function generateSalt(length = EMAIL_SALT_LENGTH) {
   return cryptoApi.getRandomValues(new Uint8Array(length));
 }
@@ -54,9 +198,9 @@ function generateSecureRecoveryKey(length = 24) {
     const chars = requiredSets[index];
     result[index] = chars.charAt(randomByte % chars.length);
   }
-  const randomBytes3 = cryptoApi.getRandomValues(new Uint8Array(length));
+  const randomBytes4 = cryptoApi.getRandomValues(new Uint8Array(length));
   for (let index = requiredSets.length; index < length; index += 1) {
-    result[index] = allChars.charAt(randomBytes3[index] % allChars.length);
+    result[index] = allChars.charAt(randomBytes4[index] % allChars.length);
   }
   for (let index = result.length - 1; index > 0; index -= 1) {
     const randomByte = cryptoApi.getRandomValues(new Uint8Array(1))[0];
@@ -409,6 +553,9 @@ var OpenMatesHttpClient = class {
   async patch(path, body, headers = {}) {
     return this.request("PATCH", path, body, headers);
   }
+  async put(path, body, headers = {}) {
+    return this.request("PUT", path, body, headers);
+  }
   async getBinary(path, headers = {}) {
     const url = `${this.apiUrl}${path.startsWith("/") ? path : `/${path}`}`;
     const requestHeaders = {
@@ -1042,6 +1189,29 @@ var SUB_CHAT_EVENT_TYPES = /* @__PURE__ */ new Set([
 ]);
 var SUB_CHAT_PARENT_STATUS_MESSAGE = "I've started the sub-chats and will continue once they finish.";
 var SUB_CHAT_COMPLETION_TIMEOUT_MS = 10 * 6e4;
+var CLIENT_UPDATE_REQUIRED_GUIDANCE = "OpenMates CLI update required. Run `openmates upgrade` and retry.";
+var WebSocketProtocolError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "WebSocketProtocolError";
+    this.code = code;
+  }
+};
+function websocketProtocolError(envelope) {
+  const payload = envelope.payload && typeof envelope.payload === "object" ? envelope.payload : {};
+  const code = envelope.type === "client_update_required" ? envelope.type : envelope.type === "error" && typeof payload.code === "string" ? payload.code : null;
+  if (code === "client_update_required") {
+    return new WebSocketProtocolError(code, CLIENT_UPDATE_REQUIRED_GUIDANCE);
+  }
+  if (envelope.type === "error") {
+    return new WebSocketProtocolError(
+      code ?? "websocket_error",
+      typeof payload.message === "string" ? payload.message : "Unknown WebSocket error"
+    );
+  }
+  return null;
+}
 var OpenMatesWsClient = class {
   socket;
   constructor(options) {
@@ -1111,13 +1281,23 @@ var OpenMatesWsClient = class {
   }
   waitForMessage(expectedType, predicate, timeoutMs = 2e4) {
     return new Promise((resolve7, reject) => {
+      const seenTypes = /* @__PURE__ */ new Set();
+      let predicateMisses = 0;
       const onMessage = (rawData) => {
         try {
           const parsed = JSON.parse(rawData.toString());
+          if (typeof parsed.type === "string") seenTypes.add(parsed.type);
+          const protocolError = websocketProtocolError(parsed);
+          if (protocolError) {
+            cleanup();
+            reject(protocolError);
+            return;
+          }
           if (parsed.type !== expectedType) {
             return;
           }
           if (predicate && !predicate(parsed.payload)) {
+            predicateMisses += 1;
             return;
           }
           cleanup();
@@ -1135,7 +1315,12 @@ var OpenMatesWsClient = class {
       };
       const timeout = setTimeout(() => {
         cleanup();
-        reject(new Error(`Timeout waiting for '${expectedType}'`));
+        const observed = [...seenTypes].sort().join(", ") || "none";
+        reject(
+          new Error(
+            `Timeout waiting for '${expectedType}' (seen types: ${observed}; predicate misses: ${predicateMisses})`
+          )
+        );
       }, timeoutMs);
       const cleanup = () => {
         clearTimeout(timeout);
@@ -1159,6 +1344,12 @@ var OpenMatesWsClient = class {
       const onMessage = (rawData) => {
         try {
           const parsed = JSON.parse(rawData.toString());
+          const protocolError = websocketProtocolError(parsed);
+          if (protocolError) {
+            cleanup();
+            reject(protocolError);
+            return;
+          }
           if (parsed.type === terminatorType) {
             cleanup();
             resolve7(collected);
@@ -1218,6 +1409,7 @@ var OpenMatesWsClient = class {
       let taskId = null;
       let category = null;
       let modelName = null;
+      let recoveryJobId = null;
       let followUpSuggestions = [];
       let newChatSuggestions = [];
       const subChatEvents = [];
@@ -1248,6 +1440,8 @@ var OpenMatesWsClient = class {
         if (typeof p.category === "string" && p.category) category = p.category;
         if (typeof p.model_name === "string" && p.model_name)
           modelName = p.model_name;
+        if (typeof p.recovery_job_id === "string" && p.recovery_job_id && p.recovery_protocol_version === 1)
+          recoveryJobId = p.recovery_job_id;
       };
       const extractMessageContent = (message) => {
         if (typeof message.content === "string") return message.content;
@@ -1279,7 +1473,8 @@ var OpenMatesWsClient = class {
             followUpSuggestions,
             newChatSuggestions,
             embeds: [...embeds.values()],
-            subChatEvents
+            subChatEvents,
+            recoveryJobId
           });
           return;
         }
@@ -1299,7 +1494,8 @@ var OpenMatesWsClient = class {
               followUpSuggestions,
               newChatSuggestions,
               embeds: [...embeds.values()],
-              subChatEvents
+              subChatEvents,
+              recoveryJobId
             });
           }, asyncEmbedWaitMs);
           return;
@@ -1316,7 +1512,8 @@ var OpenMatesWsClient = class {
           followUpSuggestions,
           newChatSuggestions,
           embeds: [...embeds.values()],
-          subChatEvents
+          subChatEvents,
+          recoveryJobId
         });
       };
       const handleSubChatEvent = (type, p) => {
@@ -1388,13 +1585,10 @@ var OpenMatesWsClient = class {
           const parsed = JSON.parse(rawData.toString());
           const p = parsed.payload ?? {};
           const type = parsed.type;
-          if (type === "error") {
+          const protocolError = websocketProtocolError(parsed);
+          if (protocolError) {
             cleanup();
-            reject(
-              new Error(
-                typeof p.message === "string" ? p.message : "Unknown chat error"
-              )
-            );
+            reject(protocolError);
             return;
           }
           if (SUB_CHAT_EVENT_TYPES.has(type)) {
@@ -1530,7 +1724,8 @@ var OpenMatesWsClient = class {
             followUpSuggestions,
             newChatSuggestions,
             embeds: [...embeds.values()],
-            subChatEvents
+            subChatEvents,
+            recoveryJobId
           });
           return;
         }
@@ -1957,7 +2152,7 @@ async function encryptEmbed(embed, masterKey, chatKey, chatId, messageId, userId
     const hashedMessageId = computeSHA256(messageId);
     const hashedUserId = computeSHA256(userId);
     const wrappedWithMaster = await wrapKey(embedKey, masterKey);
-    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const nowSeconds2 = Math.floor(Date.now() / 1e3);
     const embedKeys = [
       {
         hashed_embed_id: hashedEmbedId,
@@ -1965,7 +2160,7 @@ async function encryptEmbed(embed, masterKey, chatKey, chatId, messageId, userId
         hashed_chat_id: null,
         encrypted_embed_key: wrappedWithMaster,
         hashed_user_id: hashedUserId,
-        created_at: nowSeconds
+        created_at: nowSeconds2
       }
     ];
     if (chatKey) {
@@ -1976,7 +2171,7 @@ async function encryptEmbed(embed, masterKey, chatKey, chatId, messageId, userId
         hashed_chat_id: hashedChatId,
         encrypted_embed_key: wrappedWithChat,
         hashed_user_id: hashedUserId,
-        created_at: nowSeconds
+        created_at: nowSeconds2
       });
     }
     return {
@@ -1991,8 +2186,8 @@ async function encryptEmbed(embed, masterKey, chatKey, chatId, messageId, userId
       file_path: embed.filePath,
       content_hash: embed.contentHash,
       text_length_chars: embed.textLengthChars,
-      created_at: nowSeconds,
-      updated_at: nowSeconds,
+      created_at: nowSeconds2,
+      updated_at: nowSeconds2,
       embed_keys: embedKeys
     };
   } catch (error) {
@@ -2137,11 +2332,11 @@ async function decryptConnectedAccountCliTransferPayload(encryptedPayload, passc
     throw new Error("Unsupported connected account import payload format.");
   }
   try {
-    const key = await deriveTransferKey(passcode, base64UrlToBytes(envelope.kdf.salt), envelope.kdf.iterations);
+    const key = await deriveTransferKey(passcode, base64UrlToBytes2(envelope.kdf.salt), envelope.kdf.iterations);
     const plaintext = await webcrypto5.subtle.decrypt(
-      { name: "AES-GCM", iv: toArrayBuffer3(base64UrlToBytes(envelope.cipher.iv)) },
+      { name: "AES-GCM", iv: toArrayBuffer3(base64UrlToBytes2(envelope.cipher.iv)) },
       key,
-      toArrayBuffer3(base64UrlToBytes(envelope.cipher.text))
+      toArrayBuffer3(base64UrlToBytes2(envelope.cipher.text))
     );
     return validateTransferPayload(JSON.parse(new TextDecoder().decode(plaintext)));
   } catch (error) {
@@ -2189,7 +2384,7 @@ async function buildEncryptedConnectedAccountImportRow(params) {
 }
 function parseEnvelope(encodedEnvelope) {
   try {
-    return JSON.parse(new TextDecoder().decode(base64UrlToBytes(encodedEnvelope)));
+    return JSON.parse(new TextDecoder().decode(base64UrlToBytes2(encodedEnvelope)));
   } catch {
     throw new Error("Connected account import payload is malformed.");
   }
@@ -2269,7 +2464,7 @@ function defaultProviderLabel(providerId) {
 function sha256Hex2(value) {
   return createHash4("sha256").update(value).digest("hex");
 }
-function base64UrlToBytes(value) {
+function base64UrlToBytes2(value) {
   return base64ToBytes(value.replace(/-/g, "+").replace(/_/g, "/"));
 }
 function toArrayBuffer3(input) {
@@ -2863,6 +3058,15 @@ var MEMORY_TYPE_REGISTRY = {
     properties: { url: { type: "string" }, notes: { type: "string" } }
   }
 };
+function reconcileAuthoritativeChats(chats, evidence) {
+  const deletedIds = new Set(evidence.deleted_chat_ids ?? []);
+  const authoritativeIds = evidence.authoritative && evidence.authoritative_chat_ids ? new Set(evidence.authoritative_chat_ids) : null;
+  if (!authoritativeIds && deletedIds.size === 0) return chats;
+  return chats.filter((chat) => {
+    const chatId = String(chat.details.id ?? "");
+    return (!authoritativeIds || authoritativeIds.has(chatId)) && !deletedIds.has(chatId);
+  });
+}
 var MATE_NAMES = {
   software_development: "Sophia",
   business_development: "Burton",
@@ -3635,6 +3839,157 @@ var OpenMatesClient = class _OpenMatesClient {
       hasMore: offset + limit < total
     };
   }
+  async saveDraft(params) {
+    const markdown = params.markdown.trim();
+    if (!markdown) throw new Error("Draft markdown must not be empty.");
+    const masterKey = this.getMasterKeyBytes();
+    const encrypted = await this.saveEncryptedDraft({
+      chatId: params.chatId ?? randomUUID3(),
+      encryptedDraftMd: await encryptWithAesGcmCombined(markdown, masterKey),
+      encryptedDraftPreview: params.preview ? await encryptWithAesGcmCombined(params.preview, masterKey) : null
+    });
+    return { ...encrypted, markdown, preview: params.preview ?? null };
+  }
+  async saveEncryptedDraft(params) {
+    const { ws } = await this.openWsClient();
+    try {
+      const receipt = ws.waitForMessage(
+        "draft_update_receipt",
+        (payload) => payload.chat_id === params.chatId
+      );
+      await ws.sendAsync("update_draft", {
+        chat_id: params.chatId,
+        encrypted_draft_md: params.encryptedDraftMd,
+        encrypted_draft_preview: params.encryptedDraftPreview ?? null
+      });
+      const response = await receipt;
+      const draftV = Number(response.payload.draft_v ?? 0);
+      this.storeEncryptedDraft({
+        chatId: params.chatId,
+        encryptedDraftMd: params.encryptedDraftMd,
+        encryptedDraftPreview: params.encryptedDraftPreview ?? null,
+        draftV
+      });
+      return {
+        chatId: params.chatId,
+        encryptedDraftMd: params.encryptedDraftMd,
+        encryptedDraftPreview: params.encryptedDraftPreview ?? null,
+        draftV
+      };
+    } finally {
+      ws.close();
+    }
+  }
+  async listDrafts(forceRefresh = false) {
+    if (forceRefresh) await this.reconcileDraftVersions();
+    const cache = await this.ensureSynced(forceRefresh);
+    const drafts = [];
+    for (const chat of cache.chats) {
+      const draft = await this.decryptCachedDraft(chat);
+      if (draft) drafts.push(draft);
+    }
+    return drafts;
+  }
+  async getDraft(chatId, forceRefresh = false) {
+    if (forceRefresh) await this.reconcileDraftVersions();
+    const cache = await this.ensureSynced(forceRefresh);
+    const chat = cache.chats.find((entry) => String(entry.details.id ?? "") === chatId);
+    return chat ? this.decryptCachedDraft(chat) : null;
+  }
+  async clearDraft(chatId) {
+    const { ws } = await this.openWsClient();
+    try {
+      const receipt = ws.waitForMessage(
+        "draft_delete_receipt",
+        (payload) => payload.chat_id === chatId
+      );
+      await ws.sendAsync("delete_draft", { chat_id: chatId });
+      await receipt;
+    } finally {
+      ws.close();
+    }
+    const cache = loadSyncCache();
+    if (!cache) return;
+    const chat = cache.chats.find((entry) => String(entry.details.id ?? "") === chatId);
+    if (chat) {
+      delete chat.details.encrypted_draft_md;
+      delete chat.details.encrypted_draft_preview;
+      chat.details.draft_v = 0;
+      if (chat.messages.length === 0 && !chat.details.encrypted_chat_key) {
+        cache.chats = cache.chats.filter((entry) => entry !== chat);
+      }
+      saveSyncCache(cache);
+    }
+  }
+  async reconcileDraftVersions() {
+    const cache = loadSyncCache();
+    const drafts = (cache?.chats ?? []).filter(
+      (chat) => typeof chat.details.encrypted_draft_md === "string"
+    );
+    if (drafts.length === 0) return {};
+    const { ws } = await this.openWsClient();
+    try {
+      const response = ws.waitForMessage("draft_versions_response");
+      await ws.sendAsync("get_draft_versions", {
+        chats: drafts.map((chat) => ({
+          chat_id: String(chat.details.id),
+          client_draft_v: Number(chat.details.draft_v ?? 0)
+        }))
+      });
+      const frame = await response;
+      const versions = frame.payload.versions ?? {};
+      for (const chat of drafts) {
+        const chatId = String(chat.details.id);
+        if (versions[chatId] === 0) {
+          delete chat.details.encrypted_draft_md;
+          delete chat.details.encrypted_draft_preview;
+          chat.details.draft_v = 0;
+        }
+      }
+      if (cache) saveSyncCache(cache);
+      return versions;
+    } finally {
+      ws.close();
+    }
+  }
+  storeEncryptedDraft(draft) {
+    const cache = loadSyncCache() ?? {
+      syncedAt: 0,
+      totalChatCount: 0,
+      loadedChatCount: 0,
+      chats: [],
+      embeds: [],
+      embedKeys: []
+    };
+    let chat = cache.chats.find((entry) => String(entry.details.id ?? "") === draft.chatId);
+    if (!chat) {
+      chat = { details: { id: draft.chatId }, messages: [] };
+      cache.chats.unshift(chat);
+    }
+    chat.details.encrypted_draft_md = draft.encryptedDraftMd;
+    chat.details.encrypted_draft_preview = draft.encryptedDraftPreview;
+    chat.details.draft_v = draft.draftV;
+    cache.syncedAt = Date.now();
+    cache.loadedChatCount = cache.chats.length;
+    saveSyncCache(cache);
+  }
+  async decryptCachedDraft(chat) {
+    const encryptedDraftMd = chat.details.encrypted_draft_md;
+    if (typeof encryptedDraftMd !== "string") return null;
+    const encryptedPreview = typeof chat.details.encrypted_draft_preview === "string" ? chat.details.encrypted_draft_preview : null;
+    const masterKey = this.getMasterKeyBytes();
+    const markdown = await decryptWithAesGcmCombined(encryptedDraftMd, masterKey);
+    if (markdown === null) throw new Error("Failed to decrypt draft markdown.");
+    const preview = encryptedPreview ? await decryptWithAesGcmCombined(encryptedPreview, masterKey) : markdown.slice(0, 160);
+    return {
+      chatId: String(chat.details.id ?? ""),
+      encryptedDraftMd,
+      encryptedDraftPreview: encryptedPreview,
+      draftV: Number(chat.details.draft_v ?? 0),
+      markdown,
+      preview
+    };
+  }
   async searchChats(query) {
     const cache = await this.ensureSynced();
     const masterKey = this.getMasterKeyBytes();
@@ -3727,8 +4082,8 @@ var OpenMatesClient = class _OpenMatesClient {
       );
       let msgEmbedIds = [];
       if (clientMsgId && cache.embeds.length > 0) {
-        const { createHash: createHash7 } = await import("crypto");
-        const hashed = createHash7("sha256").update(clientMsgId).digest("hex");
+        const { createHash: createHash8 } = await import("crypto");
+        const hashed = createHash8("sha256").update(clientMsgId).digest("hex");
         msgEmbedIds = cache.embeds.filter(
           (e) => e.hashed_message_id === hashed && // Only include parent embeds (no parent_embed_id).
           // Child embeds inherit the parent's key and are loaded
@@ -3775,8 +4130,8 @@ var OpenMatesClient = class _OpenMatesClient {
       );
     }
     const embedId = String(embed.embed_id ?? embed.id ?? "");
-    const { createHash: createHash7 } = await import("crypto");
-    const hashedEmbedId = createHash7("sha256").update(embedId).digest("hex");
+    const { createHash: createHash8 } = await import("crypto");
+    const hashedEmbedId = createHash8("sha256").update(embedId).digest("hex");
     const embedKeyBytes = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -3884,7 +4239,7 @@ var OpenMatesClient = class _OpenMatesClient {
   async resolveEmbedKey(cache, masterKey, embed, embedId, hashedEmbedId, visited = /* @__PURE__ */ new Set()) {
     if (visited.has(embedId)) return null;
     visited.add(embedId);
-    const { createHash: createHash7 } = await import("crypto");
+    const { createHash: createHash8 } = await import("crypto");
     const masterKeyEntry = cache.embedKeys.find(
       (ek) => ek.hashed_embed_id === hashedEmbedId && String(ek.key_type) === "master"
     );
@@ -3901,7 +4256,7 @@ var OpenMatesClient = class _OpenMatesClient {
     if (chatKeyEntry && typeof chatKeyEntry.encrypted_embed_key === "string") {
       const hashedChatId = String(chatKeyEntry.hashed_chat_id ?? "");
       const owningChat = cache.chats.find((c) => {
-        const chatHash = createHash7("sha256").update(String(c.details.id ?? "")).digest("hex");
+        const chatHash = createHash8("sha256").update(String(c.details.id ?? "")).digest("hex");
         return chatHash === hashedChatId;
       });
       if (owningChat) {
@@ -3930,7 +4285,7 @@ var OpenMatesClient = class _OpenMatesClient {
         const parentFullId = String(
           parentEmbed2.embed_id ?? parentEmbed2.id ?? ""
         );
-        const parentHashedId = createHash7("sha256").update(parentFullId).digest("hex");
+        const parentHashedId = createHash8("sha256").update(parentFullId).digest("hex");
         const parentKey = await this.resolveEmbedKey(
           cache,
           masterKey,
@@ -4074,7 +4429,11 @@ var OpenMatesClient = class _OpenMatesClient {
         }
       }
     }
-    const { ws, session } = await this.openWsClient();
+    const { ws, session, ownerId } = await this.openWsClient();
+    if (!params.incognito && !ownerId) {
+      ws.close();
+      throw new Error("Authenticated user identity is required for saved chat recovery.");
+    }
     const messageId = randomUUID3();
     const createdAt = Math.floor(Date.now() / 1e3);
     const isNewChat = !params.chatId;
@@ -4089,6 +4448,40 @@ var OpenMatesClient = class _OpenMatesClient {
     }) : [];
     assertNoConnectedAccountSecretLeak(connectedAccountTokenRefs);
     const piiMappings = params.piiMappings ?? [];
+    let chatKeyBytes = null;
+    let encryptedChatKey = null;
+    let baselineMessagesV = 0;
+    let savedTurnId = null;
+    if (!params.incognito) {
+      const masterKey = this.getMasterKeyBytes();
+      if (isNewChat) {
+        chatKeyBytes = globalThis.crypto ? new Uint8Array(globalThis.crypto.getRandomValues(new Uint8Array(32))) : new Uint8Array(
+          (await import("crypto")).webcrypto.getRandomValues(
+            new Uint8Array(32)
+          )
+        );
+        encryptedChatKey = await encryptBytesWithAesGcm(
+          chatKeyBytes,
+          masterKey
+        );
+      } else {
+        const cache = loadSyncCache() ?? await this.ensureSynced();
+        const chat = cache.chats.find(
+          (c) => String(c.details.id ?? "") === chatId || String(c.details.id ?? "").startsWith(chatId)
+        );
+        if (chat) {
+          baselineMessagesV = typeof chat.details.messages_v === "number" ? chat.details.messages_v : 0;
+          const encKey = typeof chat.details.encrypted_chat_key === "string" ? chat.details.encrypted_chat_key : null;
+          if (encKey) {
+            chatKeyBytes = await decryptBytesWithAesGcm(encKey, masterKey);
+            encryptedChatKey = encKey;
+          }
+        }
+        if (!chatKeyBytes || !encryptedChatKey) {
+          throw new Error(`Encrypted chat key not found for chat '${chatId}'. Sync and try again.`);
+        }
+      }
+    }
     const messagePayload = {
       chat_id: chatId,
       is_incognito: Boolean(params.incognito),
@@ -4103,6 +4496,9 @@ var OpenMatesClient = class _OpenMatesClient {
         chat_has_title: Boolean(params.chatId)
       }
     };
+    if (isNewChat && encryptedChatKey) {
+      messagePayload.encrypted_chat_key = encryptedChatKey;
+    }
     if (memoryMetadataKeys.length > 0) {
       messagePayload.app_settings_memories_metadata = memoryMetadataKeys;
     }
@@ -4144,37 +4540,6 @@ var OpenMatesClient = class _OpenMatesClient {
         created_at: historyMessage.created_at
       }));
     }
-    let chatKeyBytes = null;
-    let encryptedChatKey = null;
-    let baselineMessagesV = 0;
-    if (!params.incognito) {
-      const masterKey = this.getMasterKeyBytes();
-      if (isNewChat) {
-        chatKeyBytes = globalThis.crypto ? new Uint8Array(globalThis.crypto.getRandomValues(new Uint8Array(32))) : new Uint8Array(
-          (await import("crypto")).webcrypto.getRandomValues(
-            new Uint8Array(32)
-          )
-        );
-        encryptedChatKey = await encryptBytesWithAesGcm(
-          chatKeyBytes,
-          masterKey
-        );
-        messagePayload.encrypted_chat_key = encryptedChatKey;
-      } else {
-        const cache = loadSyncCache() ?? await this.ensureSynced();
-        const chat = cache.chats.find(
-          (c) => String(c.details.id ?? "") === chatId || String(c.details.id ?? "").startsWith(chatId)
-        );
-        if (chat) {
-          baselineMessagesV = typeof chat.details.messages_v === "number" ? chat.details.messages_v : 0;
-          const encKey = typeof chat.details.encrypted_chat_key === "string" ? chat.details.encrypted_chat_key : null;
-          if (encKey) {
-            chatKeyBytes = await decryptBytesWithAesGcm(encKey, masterKey);
-            encryptedChatKey = encKey;
-          }
-        }
-      }
-    }
     if (params.preparedEmbeds && params.preparedEmbeds.length > 0) {
       messagePayload.embeds = params.preparedEmbeds.map((embed) => ({
         embed_id: embed.embedId,
@@ -4202,47 +4567,93 @@ var OpenMatesClient = class _OpenMatesClient {
     if (encryptedEmbeds.length > 0) {
       messagePayload.encrypted_embeds = encryptedEmbeds;
     }
-    const precollectedResponse = params.precollectResponse ? ws.collectAiResponse(messageId, chatId, { onStream: params.onStream }) : null;
-    const confirmed = ws.waitForMessage(
-      "chat_message_confirmed",
-      (payload) => {
-        const eventPayload = payload;
-        return eventPayload.chat_id === chatId && eventPayload.message_id === messageId;
-      },
-      2e4
-    );
-    await ws.sendAsync("chat_message_added", messagePayload);
-    await confirmed;
-    if (!params.incognito && chatKeyBytes) {
+    let precollectedResponse = params.precollectResponse && params.incognito ? ws.collectAiResponse(messageId, chatId, { onStream: params.onStream }) : null;
+    if (!params.incognito && chatKeyBytes && encryptedChatKey) {
+      const protocolVersion = 1;
+      const chatKeyVersion = 1;
+      const turnId = randomUUID3();
+      savedTurnId = turnId;
+      const recoveryKeypair = await deriveChatCompletionRecoveryKeypair(
+        Buffer.from(chatKeyBytes).toString("base64url"),
+        chatId,
+        chatKeyVersion
+      );
       const encryptedContent = await encryptWithAesGcmCombined(
         params.message,
         chatKeyBytes
       );
-      const encryptedSenderName = await encryptWithAesGcmCombined(
-        "User",
-        chatKeyBytes
-      );
-      const metadataPayload = {
+      const encryptedUserMessage = {
+        client_message_id: messageId,
         chat_id: chatId,
-        message_id: messageId,
         encrypted_content: encryptedContent,
-        encrypted_sender_name: encryptedSenderName,
+        role: "user",
         created_at: createdAt,
-        encrypted_chat_key: encryptedChatKey,
-        versions: {
-          messages_v: 0,
-          title_v: 0,
-          last_edited_overall_timestamp: createdAt
-        }
+        updated_at: createdAt
       };
       if (piiMappings.length > 0) {
-        metadataPayload.encrypted_pii_mappings = await encryptWithAesGcmCombined(
+        encryptedUserMessage.encrypted_pii_mappings = await encryptWithAesGcmCombined(
           JSON.stringify(piiMappings),
           chatKeyBytes
         );
       }
-      ws.send("encrypted_chat_metadata", metadataPayload);
+      Object.assign(messagePayload, {
+        turn_id: turnId,
+        recovery_public_key: recoveryKeypair.publicKey,
+        chat_key_version: chatKeyVersion
+      });
+      const preflightPayload = {
+        protocol_version: protocolVersion,
+        chat_id: chatId,
+        turn_id: turnId,
+        message_id: messageId,
+        chat_key_version: chatKeyVersion,
+        encrypted_chat_key: encryptedChatKey,
+        recovery_public_key: recoveryKeypair.publicKey,
+        expected_messages_v: baselineMessagesV,
+        encrypted_user_message: encryptedUserMessage,
+        inference_request: messagePayload
+      };
+      if (isNewChat) {
+        preflightPayload.encrypted_chat_metadata = {
+          encrypted_title: await encryptWithAesGcmCombined("", chatKeyBytes),
+          encrypted_chat_key: encryptedChatKey,
+          created_at: createdAt,
+          updated_at: createdAt
+        };
+      }
+      const preflightAck = ws.waitForMessage("chat_turn_preflight_ack");
+      let ackPayload;
+      try {
+        await ws.sendAsync("chat_turn_preflight", preflightPayload);
+        ackPayload = (await preflightAck).payload;
+      } catch (error) {
+        ws.close();
+        throw error;
+      }
+      if (typeof ackPayload.preflight_id !== "string" || !ackPayload.preflight_id) {
+        ws.close();
+        throw new Error("Encrypted chat preflight acknowledgement omitted preflight_id.");
+      }
+      Object.assign(messagePayload, {
+        protocol_version: protocolVersion,
+        preflight_id: ackPayload.preflight_id
+      });
+    }
+    if (params.precollectResponse && !params.incognito) {
+      precollectedResponse = ws.collectAiResponse(messageId, chatId, {
+        onStream: params.onStream
+      });
     }
+    const confirmed = ws.waitForMessage(
+      "chat_message_confirmed",
+      (payload) => {
+        const eventPayload = payload;
+        return eventPayload.chat_id === chatId && eventPayload.message_id === messageId;
+      },
+      2e4
+    );
+    await ws.sendAsync("chat_message_added", messagePayload);
+    await confirmed;
     let assistant = "";
     let assistantMessageId = null;
     let category = null;
@@ -4442,7 +4853,7 @@ var OpenMatesClient = class _OpenMatesClient {
       }
     } else {
       try {
-        const resp = await ws.collectAiResponse(messageId, chatId, streamOpts);
+        const resp = await (precollectedResponse ?? ws.collectAiResponse(messageId, chatId, streamOpts));
         assistantMessageId = resp.messageId;
         assistant = resp.content;
         category = resp.category;
@@ -4463,47 +4874,110 @@ var OpenMatesClient = class _OpenMatesClient {
             appSettingsMemoryRequests
           };
         }
-        if (chatKeyBytes && assistant) {
+        if (chatKeyBytes) {
+          if (!resp.recoveryJobId || !savedTurnId || !ownerId) {
+            throw new Error("Saved chat completion did not include recoverable terminal identity.");
+          }
+          const recoveryJobId = resp.recoveryJobId;
+          const claimPromise = ws.waitForMessage(
+            "recovery_job_claimed",
+            (payload) => payload.job_id === recoveryJobId,
+            2e4
+          );
+          await ws.sendAsync("recovery_job_claim", {
+            protocol_version: 1,
+            job_id: recoveryJobId
+          });
+          const claim = (await claimPromise).payload;
+          const leaseToken = typeof claim.lease_token === "string" ? claim.lease_token : null;
+          const leaseGeneration = typeof claim.lease_generation === "number" && Number.isSafeInteger(claim.lease_generation) ? claim.lease_generation : null;
+          const assistantId = typeof claim.assistant_message_id === "string" ? claim.assistant_message_id : null;
+          const keyVersion = typeof claim.chat_key_version === "number" && Number.isSafeInteger(claim.chat_key_version) ? claim.chat_key_version : null;
+          if (claim.state !== "LEASED" || !leaseToken || leaseGeneration === null || leaseGeneration < 1 || !assistantId || keyVersion === null || keyVersion !== 1 || claim.chat_id !== chatId || claim.turn_id !== savedTurnId || typeof claim.sealed_payload !== "string") {
+            throw new Error("Recovery job claim returned invalid lease or identity data.");
+          }
+          const recoveryKeypair = await deriveChatCompletionRecoveryKeypair(
+            Buffer.from(chatKeyBytes).toString("base64url"),
+            chatId,
+            keyVersion
+          );
+          let envelope;
+          try {
+            envelope = JSON.parse(claim.sealed_payload);
+          } catch {
+            throw new Error("Recovery job contained an invalid sealed envelope.");
+          }
+          const plaintext = await openChatCompletionRecoveryEnvelope(
+            envelope,
+            {
+              recoveryPrivateKey: recoveryKeypair.privateKey,
+              ownerId,
+              chatId,
+              turnId: savedTurnId,
+              jobId: recoveryJobId,
+              assistantMessageId: assistantId,
+              keyVersion
+            }
+          );
+          let recovered;
+          try {
+            recovered = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(plaintext));
+          } catch {
+            throw new Error("Recovery job plaintext was not valid UTF-8 JSON.");
+          }
+          const expectedRecoveryFields = [
+            "assistant_message_id",
+            "category",
+            "chat_id",
+            "content",
+            "job_id",
+            "key_version",
+            "model_name",
+            "turn_id"
+          ];
+          if (Object.keys(recovered).sort().join(",") !== expectedRecoveryFields.join(",") || recovered.assistant_message_id !== assistantId || recovered.chat_id !== chatId || recovered.turn_id !== savedTurnId || recovered.job_id !== recoveryJobId || recovered.key_version !== keyVersion || typeof recovered.content !== "string" || recovered.category !== null && typeof recovered.category !== "string" || recovered.model_name !== null && typeof recovered.model_name !== "string" || recovered.content !== assistant || recovered.category !== category || recovered.model_name !== modelName) {
+            throw new Error("Recovery job plaintext did not match the terminal completion identity.");
+          }
           const completedAt = Math.floor(Date.now() / 1e3);
           const encryptedAssistantContent = await encryptWithAesGcmCombined(
-            assistant,
+            recovered.content,
             chatKeyBytes
           );
-          const encryptedCategory = category ? await encryptWithAesGcmCombined(category, chatKeyBytes) : void 0;
-          const encryptedModelName = modelName ? await encryptWithAesGcmCombined(modelName, chatKeyBytes) : void 0;
-          const persistedAssistantMessageId = assistantMessageId ?? randomUUID3();
-          ws.send("ai_response_completed", {
-            chat_id: chatId,
-            message: {
-              message_id: persistedAssistantMessageId,
+          const encryptedSenderName = await encryptWithAesGcmCombined("Assistant", chatKeyBytes);
+          const encryptedCategory = recovered.category ? await encryptWithAesGcmCombined(recovered.category, chatKeyBytes) : void 0;
+          const encryptedModelName = recovered.model_name ? await encryptWithAesGcmCombined(recovered.model_name, chatKeyBytes) : void 0;
+          const persistedPromise = ws.waitForMessage(
+            "recovery_job_persisted",
+            (payload) => payload.job_id === recoveryJobId,
+            2e4
+          );
+          await ws.sendAsync("recovery_job_persist", {
+            protocol_version: 1,
+            job_id: recoveryJobId,
+            lease_token: leaseToken,
+            lease_generation: leaseGeneration,
+            expected_messages_v: baselineMessagesV + 1,
+            encrypted_assistant_message: {
+              client_message_id: assistantId,
               chat_id: chatId,
-              role: "assistant",
-              created_at: completedAt,
-              status: "synced",
-              user_message_id: messageId,
               encrypted_content: encryptedAssistantContent,
+              encrypted_sender_name: encryptedSenderName,
               encrypted_category: encryptedCategory,
-              encrypted_model_name: encryptedModelName
-            },
-            versions: {
-              messages_v: baselineMessagesV + 2,
-              last_edited_overall_timestamp: completedAt
+              encrypted_model_name: encryptedModelName,
+              role: "assistant",
+              user_message_id: messageId,
+              created_at: completedAt,
+              updated_at: completedAt
             }
           });
-          await ws.waitForMessage(
-            "ai_response_storage_confirmed",
-            (payload) => {
-              const p = payload;
-              return p.message_id === persistedAssistantMessageId;
-            },
-            2e4
-          );
+          await persistedPromise;
+          assistantMessageId = assistantId;
           await this.persistStreamedEmbeds({
             ws,
             embeds: resp.embeds,
             chatId,
             chatKeyBytes,
-            fallbackMessageId: persistedAssistantMessageId
+            fallbackMessageId: assistantId
           });
           await this.persistPostProcessingMetadata({
             ws,
@@ -5041,6 +5515,30 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     return response.data.workflow;
   }
+  async validateWorkflowYaml(source) {
+    this.requireSession();
+    const response = await this.http.post("/v1/workflows/validate", { source }, this.getCliRequestHeaders());
+    if (!response.ok || !response.data.validation) {
+      throw new Error(`Workflow YAML validation failed with HTTP ${response.status}`);
+    }
+    return response.data.validation;
+  }
+  async createWorkflowYaml(source) {
+    this.requireSession();
+    const response = await this.http.post("/v1/workflows/yaml", { source }, this.getCliRequestHeaders());
+    if (!response.ok || !response.data.workflow || !response.data.validation) {
+      throw new Error(`Workflow YAML create failed with HTTP ${response.status}`);
+    }
+    return { workflow: response.data.workflow, validation: response.data.validation };
+  }
+  async updateWorkflowYaml(workflowId, source) {
+    this.requireSession();
+    const createLike = await this.http.post(`/v1/workflows/${encodeURIComponent(workflowId)}/yaml`, { source }, this.getCliRequestHeaders());
+    if (!createLike.ok || !createLike.data.workflow || !createLike.data.validation) {
+      throw new Error(`Workflow YAML update failed with HTTP ${createLike.status}`);
+    }
+    return { workflow: createLike.data.workflow, validation: createLike.data.validation };
+  }
   async getWorkflow(workflowId) {
     this.requireSession();
     const response = await this.http.get(
@@ -5099,12 +5597,15 @@ var OpenMatesClient = class _OpenMatesClient {
   async disableWorkflow(workflowId) {
     return this.setWorkflowEnabled(workflowId, false);
   }
-  async runWorkflow(workflowId, params = {}) {
+  async runWorkflow(workflowId, params) {
     this.requireSession();
+    if (!params.idempotencyKey.trim()) {
+      throw new Error("Workflow run requires a stable idempotencyKey");
+    }
     const response = await this.http.post(
       `/v1/workflows/${encodeURIComponent(workflowId)}/run`,
       { mode: params.mode ?? "manual", input: params.input ?? {} },
-      this.getCliRequestHeaders()
+      { ...this.getCliRequestHeaders(), "Idempotency-Key": params.idempotencyKey }
     );
     if (!response.ok || !response.data.run) {
       throw new Error(`Workflow run failed with HTTP ${response.status}`);
@@ -5133,6 +5634,42 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     return response.data.run;
   }
+  async cancelWorkflowRun(workflowId, runId) {
+    this.requireSession();
+    const response = await this.http.post(
+      `/v1/workflows/${encodeURIComponent(workflowId)}/runs/${encodeURIComponent(runId)}/cancel`,
+      {},
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok || response.data.status !== "cancellation_requested" && response.data.status !== "cancelled") {
+      throw new Error(`Workflow run cancellation failed with HTTP ${response.status}`);
+    }
+    return response.data;
+  }
+  async testWorkflowStep(workflowId, stepId, params = {}) {
+    this.requireSession();
+    const response = await this.http.post(
+      `/v1/workflows/${encodeURIComponent(workflowId)}/steps/${encodeURIComponent(stepId)}/test`,
+      { input: params.input ?? {}, confirmed: params.confirmed === true },
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok || !response.data.run) {
+      throw new Error(`Workflow step test failed with HTTP ${response.status}`);
+    }
+    return response.data.run;
+  }
+  async respondToWorkflowRun(workflowId, runId, stepId, input) {
+    this.requireSession();
+    const response = await this.http.post(
+      `/v1/workflows/${encodeURIComponent(workflowId)}/runs/${encodeURIComponent(runId)}/respond`,
+      { step_id: stepId, input },
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok || !response.data.run) {
+      throw new Error(`Workflow response failed with HTTP ${response.status}`);
+    }
+    return response.data.run;
+  }
   async listWorkflowCapabilities() {
     this.requireSession();
     const response = await this.http.get(
@@ -5144,6 +5681,114 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     return response.data.capabilities ?? [];
   }
+  async upsertWorkflowTemplateProjection(workflowId, params) {
+    this.requireSession();
+    const response = await this.http.put(
+      `/v1/workflows/${encodeURIComponent(workflowId)}/template-projection`,
+      {
+        template_id: params.templateId,
+        source_version: params.sourceVersion,
+        ciphertext: params.ciphertext,
+        ciphertext_checksum: params.ciphertextChecksum,
+        owner_wrapped_key: params.ownerWrappedKey,
+        projection_schema_version: params.projectionSchemaVersion
+      },
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Workflow template projection upsert failed with HTTP ${response.status}`);
+    }
+    return response.data;
+  }
+  async getPublicWorkflowTemplateProjection(templateId) {
+    const response = await this.http.get(
+      `/v1/workflows/template-projections/${encodeURIComponent(templateId)}`,
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Workflow template projection retrieval failed with HTTP ${response.status}`);
+    }
+    return response.data;
+  }
+  async revokeWorkflowTemplateProjection(workflowId) {
+    this.requireSession();
+    const response = await this.http.post(
+      `/v1/workflows/${encodeURIComponent(workflowId)}/template-projection/revoke`,
+      {},
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Workflow template projection revoke failed with HTTP ${response.status}`);
+    }
+    return response.data;
+  }
+  async unrevokeWorkflowTemplateProjection(workflowId) {
+    this.requireSession();
+    const response = await this.http.post(
+      `/v1/workflows/${encodeURIComponent(workflowId)}/template-projection/unrevoke`,
+      {},
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Workflow template projection unrevoke failed with HTTP ${response.status}`);
+    }
+    return response.data;
+  }
+  async completeImportedWorkflowBinding(workflowId, params) {
+    this.requireSession();
+    const response = await this.http.post(
+      `/v1/workflows/${encodeURIComponent(workflowId)}/binding-requirements/complete`,
+      { type: params.type, node_id: params.nodeId },
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Workflow imported binding completion failed with HTTP ${response.status}`);
+    }
+    return response.data;
+  }
+  async createWorkflowTemplateShortUrl(params) {
+    this.requireSession();
+    const response = await this.http.post(
+      "/v1/share/short-url",
+      {
+        token: params.token,
+        encrypted_url: params.encryptedUrl,
+        content_type: "workflow_template",
+        content_id: params.templateId,
+        password_protected: params.passwordProtected ?? false,
+        ...params.ttlSeconds !== void 0 ? { ttl_seconds: params.ttlSeconds } : {}
+      },
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Workflow template short URL create failed with HTTP ${response.status}`);
+    }
+    return response.data;
+  }
+  async revokeShortUrl(token) {
+    this.requireSession();
+    const response = await this.http.delete(
+      `/v1/share/short-url/${encodeURIComponent(token)}`,
+      void 0,
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`Short URL revoke failed with HTTP ${response.status}`);
+    }
+    return response.data;
+  }
+  async importWorkflowTemplate(payload) {
+    this.requireSession();
+    const response = await this.http.post(
+      "/v1/workflows/template-import",
+      payload,
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok || !response.data.workflow) {
+      throw new Error(`Workflow template import failed with HTTP ${response.status}`);
+    }
+    return response.data.workflow;
+  }
   async startWorkflowInput(params) {
     this.requireSession();
     const response = await this.http.post(
@@ -5314,6 +5959,54 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     return response.data.task;
   }
+  async deleteUserTask(taskId) {
+    this.requireSession();
+    const response = await this.http.delete(
+      `/v1/user-tasks/${encodeURIComponent(taskId)}`,
+      void 0,
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`User task delete failed with HTTP ${response.status}`);
+    }
+    return response.data;
+  }
+  async completeUserTask(taskId, input = {}) {
+    return this.postUserTaskAction(taskId, "complete", input);
+  }
+  async blockUserTask(taskId, input = {}) {
+    return this.postUserTaskAction(taskId, "block", input);
+  }
+  async unblockUserTask(taskId, input = {}) {
+    return this.postUserTaskAction(taskId, "unblock", input);
+  }
+  async skipUserTask(taskId, input = {}) {
+    return this.postUserTaskAction(taskId, "skip", input);
+  }
+  async reorderUserTasks(input) {
+    this.requireSession();
+    const response = await this.http.post(
+      "/v1/user-tasks/reorder",
+      input,
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok) {
+      throw new Error(`User task reorder failed with HTTP ${response.status}`);
+    }
+    return response.data.tasks ?? [];
+  }
+  async postUserTaskAction(taskId, action, input = {}) {
+    this.requireSession();
+    const response = await this.http.post(
+      `/v1/user-tasks/${encodeURIComponent(taskId)}/${encodeURIComponent(action)}`,
+      input,
+      this.getCliRequestHeaders()
+    );
+    if (!response.ok || !response.data.task) {
+      throw new Error(`User task ${action} failed with HTTP ${response.status}`);
+    }
+    return response.data.task;
+  }
   // -------------------------------------------------------------------------
   // User plans
   // -------------------------------------------------------------------------
@@ -6194,7 +6887,7 @@ Required: ${schema.required.join(", ")}`
     const session = this.requireSession();
     const masterKey = base64ToBytes(session.masterKeyExportedB64);
     const cache = await this.ensureSynced();
-    const { createHash: createHash7 } = await import("crypto");
+    const { createHash: createHash8 } = await import("crypto");
     const embed = cache.embeds.find(
       (e) => String(e.embed_id ?? "").startsWith(embedIdOrShort) || String(e.id ?? "").startsWith(embedIdOrShort)
     );
@@ -6202,7 +6895,7 @@ Required: ${schema.required.join(", ")}`
       throw new Error(`Embed '${embedIdOrShort}' not found in local cache.`);
     }
     const embedId = String(embed.embed_id ?? embed.id ?? "");
-    const hashedEmbedId = createHash7("sha256").update(embedId).digest("hex");
+    const hashedEmbedId = createHash8("sha256").update(embedId).digest("hex");
     const embedKeyBytes = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -6262,8 +6955,8 @@ Required: ${schema.required.join(", ")}`
     if (!embed) {
       throw new Error(`Embed '${embedId}' not found in local cache. Run 'openmates chats list' to sync first.`);
     }
-    const { createHash: createHash7 } = await import("crypto");
-    const hashedEmbedId = createHash7("sha256").update(embedId).digest("hex");
+    const { createHash: createHash8 } = await import("crypto");
+    const hashedEmbedId = createHash8("sha256").update(embedId).digest("hex");
     const embedKey = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -6357,8 +7050,8 @@ Required: ${schema.required.join(", ")}`
     if (!embed) {
       throw new Error(`Embed '${embedId}' not found in local cache. Run 'openmates chats list' to sync first.`);
     }
-    const { createHash: createHash7 } = await import("crypto");
-    const hashedEmbedId = createHash7("sha256").update(embedId).digest("hex");
+    const { createHash: createHash8 } = await import("crypto");
+    const hashedEmbedId = createHash8("sha256").update(embedId).digest("hex");
     const embedKey = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -6550,11 +7243,11 @@ Required: ${schema.required.join(", ")}`
    * so every WebSocket usage gets a fresh HMAC token automatically.
    */
   async openWsClient() {
-    await this.refreshWsToken();
+    const ownerId = await this.refreshWsToken();
     const session = this.requireSession();
     const ws = this.makeWsClient(session);
     await ws.open();
-    return { ws, session };
+    return { ws, session, ownerId };
   }
   /**
    * Refresh the ws_token by calling /auth/session.
@@ -6571,7 +7264,9 @@ Required: ${schema.required.join(", ")}`
       }
       session.cookies = this.http.getCookieMap();
       saveSession(session);
+      return typeof res.data.user?.id === "string" ? res.data.user.id : typeof res.data.user?.user_id === "string" ? res.data.user.user_id : null;
     } catch {
+      return null;
     }
   }
   /**
@@ -6616,6 +7311,7 @@ Required: ${schema.required.join(", ")}`
     const embedKeys = [];
     let newChatSuggestions = [];
     let totalChatCount = 0;
+    let reconciliation = { authoritative: false };
     const pendingAIResponses = [];
     try {
       ws.send("phased_sync_request", {
@@ -6642,6 +7338,11 @@ Required: ${schema.required.join(", ")}`
         } else if (frame.type === "phase_2_last_20_chats_ready") {
           const p = frame.payload;
           totalChatCount = p.total_chat_count ?? 0;
+          reconciliation = {
+            authoritative: p.authoritative === true,
+            authoritative_chat_ids: p.authoritative_chat_ids,
+            deleted_chat_ids: p.deleted_chat_ids
+          };
           for (const wrapper of p.chats ?? []) {
             const details = wrapper.chat_details;
             if (!details || typeof details.id !== "string") continue;
@@ -6721,12 +7422,21 @@ Required: ${schema.required.join(", ")}`
         }
       }
     }
+    const reconciledChats = reconcileAuthoritativeChats(chats, reconciliation);
+    chats.splice(0, chats.length, ...reconciledChats);
+    if (reconciliation.deleted_chat_ids?.length) {
+      const { createHash: createHash8 } = await import("crypto");
+      const deletedHashes = new Set(
+        reconciliation.deleted_chat_ids.map((id) => createHash8("sha256").update(id).digest("hex"))
+      );
+      const keptEmbeds = embeds.filter((embed) => !deletedHashes.has(String(embed.hashed_chat_id ?? "")));
+      const keptKeys = embedKeys.filter((key) => !deletedHashes.has(String(key.hashed_chat_id ?? "")));
+      embeds.splice(0, embeds.length, ...keptEmbeds);
+      embedKeys.splice(0, embedKeys.length, ...keptKeys);
+    }
     chats.sort(
       (a, b) => (typeof b.details.last_edited_overall_timestamp === "number" ? b.details.last_edited_overall_timestamp : 0) - (typeof a.details.last_edited_overall_timestamp === "number" ? a.details.last_edited_overall_timestamp : 0)
     );
-    if (totalChatCount > 0 && chats.length > totalChatCount) {
-      chats.length = totalChatCount;
-    }
     try {
       await this.persistPendingAIResponsesFromSync(ws, chats, pendingAIResponses);
     } finally {
@@ -6979,10 +7689,10 @@ function printLogo() {
 
 // src/cli.ts
 import { createInterface as createInterface4 } from "readline/promises";
-import { realpathSync, writeFileSync as writeFileSync6 } from "fs";
+import { readFileSync as readFileSync9, realpathSync, writeFileSync as writeFileSync6 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { basename as basename3, dirname as dirname3 } from "path";
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import WebSocket2 from "ws";
 
 // ../secret-scanner/src/registry.ts
@@ -28597,6 +29307,11 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
         }
       }
     },
+    models3d: {
+      generate: {
+        text: "Generate 3D model"
+      }
+    },
     music: {
       generate: {
         text: "Generate",
@@ -30936,6 +31651,27 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
     save: {
       text: "Save"
     },
+    detail_title_hint: {
+      text: "Enter to save \xB7 Escape to cancel"
+    },
+    detail_description_hint: {
+      text: "Ctrl/Command+Enter to save \xB7 Escape to cancel"
+    },
+    detail_save_error: {
+      text: "Your changes were not saved."
+    },
+    detail_loading: {
+      text: "Loading {item}\u2026"
+    },
+    detail_load_error: {
+      text: "{item} could not be loaded."
+    },
+    detail_untitled: {
+      text: "Untitled {item}"
+    },
+    detail_items_count: {
+      text: "{count} items"
+    },
     settings: {
       text: "Settings"
     },
@@ -36566,6 +37302,22 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
     },
     privacy: {
       providers: {
+        model_generation: {
+          heading: {
+            text: "3D model generation (only when you use a 3D model skill)"
+          },
+          description: {
+            text: "This provider is only used when you invoke a 3D model generation skill. If you never use the 3D models app, none of your data is shared with it."
+          },
+          hi3d: {
+            heading: {
+              text: "Hi3D (3D model generation)"
+            },
+            description: {
+              text: "Hi3D receives reference images you supply or images generated from your text prompt, plus generation settings. Its Terms license Inputs and Outputs for AI model improvement and training. Hi3D publishes no exact API retention period or per-task deletion endpoint; its policy provides account and personal-data deletion rights. OpenMates requires your confirmation before first use."
+            }
+          }
+        },
         fitness: {
           heading: {
             text: "Fitness search (only when you use the fitness skill)"
@@ -40656,6 +41408,42 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
       description: {
         text: "Manage your credits, purchases, and what you used credits for."
       },
+      apple_support: {
+        text: "Support OpenMates"
+      },
+      apple_usage_details: {
+        text: "View usage details"
+      },
+      apple_purchased_gift_cards: {
+        text: "Purchased"
+      },
+      apple_no_gift_cards: {
+        text: "No gift cards yet"
+      },
+      apple_gift_card_purchase_unavailable: {
+        text: "Gift card purchase is unavailable until your account email is fully synchronized."
+      },
+      apple_support_amount: {
+        text: "Amount in EUR"
+      },
+      apple_create_bank_transfer: {
+        text: "Create bank transfer"
+      },
+      apple_invalid_support_amount: {
+        text: "Enter a valid amount and make sure your account has an email address."
+      },
+      apple_fulfillment_delayed: {
+        text: "Your purchase is awaiting fulfillment. It remains retryable and will not be marked complete yet."
+      },
+      apple_product_not_found: {
+        text: "This product is not available in the App Store."
+      },
+      apple_credits_count: {
+        text: "{credits} credits"
+      },
+      apple_bank_transfer_reference: {
+        text: "Bank transfer reference: {reference}"
+      },
       text: "Billing & Usage",
       title: {
         text: "Billing & Credits"
@@ -41436,6 +42224,12 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
     learning_mode_disabled: {
       text: "Learning Mode disabled."
     },
+    learning_mode_attempts_remaining: {
+      text: "{count} attempts remaining."
+    },
+    learning_mode_locked: {
+      text: "Deactivation is locked for 24 hours after too many incorrect attempts."
+    },
     learning_mode_age_group_prompt: {
       text: "Learner age group: under_10, 10_12, 13_15, 16_18, or adult"
     },
@@ -42680,6 +43474,73 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
       },
       share_debug_logs_admin_notice: {
         text: "You are an admin. Therefore your debug logs are automatically shared already. Regular users can turn on/off debug logs sharing here."
+      },
+      native: {
+        save_error: {
+          text: "Could not save this privacy setting. Please try again."
+        },
+        master_key_unavailable: {
+          text: "Your encryption key is unavailable. Sign in again to manage this setting."
+        },
+        debug_session: {
+          description: {
+            text: "Temporarily share sanitized native diagnostics with support. Message content, encryption keys, credentials, file names, and personal data are never shared."
+          },
+          duration: {
+            text: "Duration"
+          },
+          start: {
+            text: "Start sharing debug logs"
+          },
+          activating: {
+            text: "Activating..."
+          },
+          active: {
+            text: "Active debug session"
+          },
+          id: {
+            text: "Your Debug ID"
+          },
+          share_hint: {
+            text: "Share this ID with the support team so they can find your sanitized logs."
+          },
+          stop: {
+            text: "Stop sharing"
+          },
+          stopping: {
+            text: "Stopping..."
+          },
+          no_expiry: {
+            text: "Active until manually stopped"
+          },
+          error: {
+            text: "Could not update the debug sharing session. Please try again."
+          },
+          duration_5m: {
+            text: "5 minutes"
+          },
+          duration_1h: {
+            text: "1 hour"
+          },
+          duration_3d: {
+            text: "3 days"
+          },
+          duration_7d: {
+            text: "7 days"
+          },
+          duration_none: {
+            text: "No time limit"
+          },
+          minutes_remaining: {
+            text: "{count}m remaining"
+          },
+          hours_remaining: {
+            text: "{count}h remaining"
+          },
+          days_remaining: {
+            text: "{count}d remaining"
+          }
+        }
       }
     },
     terms_and_conditions: {
@@ -44490,6 +45351,21 @@ As of mid-2026, the severe supply shocks from the 2024\u20132025 avian flu have
       pair_server_use_custom: {
         text: "Use custom"
       },
+      pair_self_hosted_edition: {
+        text: "Connect self-hosted edition"
+      },
+      pair_self_hosted_placeholder: {
+        text: "Server URL"
+      },
+      pair_self_hosted_connect: {
+        text: "Connect"
+      },
+      pair_self_hosted_invalid_url: {
+        text: "Enter a valid HTTPS server URL."
+      },
+      pair_use_production: {
+        text: "Use OpenMates.org"
+      },
       pair_connect_apple_watch_title: {
         text: "Connect Apple Watch"
       },
@@ -46945,6 +47821,17 @@ function createInitialTuiState() {
     selectedInterests: [],
     examples: [],
     activeExample: null,
+    workflows: [],
+    activeWorkflow: null,
+    workflowRuns: [],
+    tasks: [],
+    activeTask: null,
+    workflowTab: "graph",
+    selectedWorkflowNodeIndex: 0,
+    selectedWorkflowRunIndex: 0,
+    expandedWorkflowNodeId: null,
+    expandedWorkflowRunNodeId: null,
+    workflowEdit: null,
     messages: [],
     status: null,
     isBusy: false
@@ -46978,6 +47865,7 @@ Files:
 
 More:
   openmates apps list
+  openmates workflows list
   openmates mentions list
   openmates embeds show <embed-id>
   openmates help
@@ -47000,7 +47888,7 @@ function renderTuiFrame(state, width, height) {
   const contentHeight = safeHeight - 4;
   const body = renderBody(state, innerWidth);
   const visible = sliceForScroll(body, contentHeight, state.scrollOffset, state.screen === "chat");
-  const inputLine = state.screen === "interests" || state.screen === "examples" ? renderHintLine(state, innerWidth) : `> ${state.input || inputPlaceholder(state)}`;
+  const inputLine = state.screen === "interests" || state.screen === "examples" || state.screen === "workflows" || state.screen === "workflow" || state.screen === "tasks" || state.screen === "task" ? renderHintLine(state, innerWidth) : `> ${state.input || inputPlaceholder(state)}`;
   const lines = [
     header2,
     ...padLines(visible, contentHeight, innerWidth).map((line) => boxed(line, innerWidth)),
@@ -47026,6 +47914,14 @@ function renderBody(state, width) {
       return renderStatus(state, width);
     case "embed":
       return renderStatus(state, width);
+    case "workflows":
+      return renderWorkflows(state, width);
+    case "workflow":
+      return renderWorkflowDetail(state, width);
+    case "tasks":
+      return renderTasks(state, width);
+    case "task":
+      return renderTaskDetail(state, width);
     case "start":
     default:
       return renderStart(width);
@@ -47047,7 +47943,7 @@ function renderStart(width) {
     "Type @./notes.md, @~/Downloads/report.pdf, or @src/app.ts in your message.",
     "Images, PDFs, audio, and code files are attached as encrypted embeds when you are signed in.",
     "",
-    "Shortcuts: /help  /login  /signup  /examples  /exit"
+    "Shortcuts: /help  /login  /signup  /examples  /tasks  /exit"
   ].flatMap((line) => wrap(line, width));
 }
 function renderHelp(width) {
@@ -47067,6 +47963,9 @@ function renderHelp(width) {
     "",
     "Commands",
     "  /examples          Choose example chats",
+    "  /workflows         List and run saved workflows",
+    "  /workflow <id>     Open a workflow by ID",
+    "  /tasks             Open your task workspace",
     "  /login             Pair-auth login",
     "  /signup            Leave TUI and run guided signup",
     "  /embed <id>        Open an embed detail view",
@@ -47075,6 +47974,150 @@ function renderHelp(width) {
     "Outside TUI: openmates --help, openmates chats --help, openmates apps --help"
   ].flatMap((line) => wrap(line, width));
 }
+function renderTasks(state, width) {
+  const lines = ["Tasks", ""];
+  if (state.tasks.length === 0) {
+    lines.push("No tasks found.", "Create one outside TUI with: openmates tasks create --title <title>");
+    return lines.flatMap((line) => wrap(line, width));
+  }
+  const visibleCount = Math.max(1, CONTENT_PREVIEW_LINES);
+  const start = Math.max(0, Math.min(state.selectedIndex, state.tasks.length - visibleCount));
+  for (let i = 0; i < state.tasks.slice(start, start + visibleCount).length; i += 1) {
+    const absoluteIndex = start + i;
+    const task = state.tasks[absoluteIndex];
+    const cursor = absoluteIndex === state.selectedIndex ? ">" : " ";
+    const assignee = task.assigneeType === "ai" ? "OpenMates" : task.assigneeHash ?? "user";
+    lines.push(`${cursor} ${task.shortId}  ${task.status}  ${assignee}  ${task.title}`);
+    if (task.queueState !== "none") lines.push(`    queue: ${task.queueState}`);
+    if (task.description) lines.push(`    ${task.description}`);
+    lines.push("");
+  }
+  return lines.flatMap((line) => wrap(line, width));
+}
+function renderTaskDetail(state, width) {
+  const task = state.activeTask;
+  if (!task) return renderTasks(state, width);
+  const assignee = task.assigneeType === "ai" ? "OpenMates" : task.assigneeHash ?? "user";
+  const lines = [
+    `Task: ${task.shortId}`,
+    `Title: ${task.title}`,
+    `Status: ${task.status}`,
+    `Assignee: ${assignee}`,
+    `Queue: ${task.queueState}`,
+    `ID: ${task.taskId}`,
+    task.description ? `Description: ${task.description}` : null,
+    task.primaryChatId ? `Chat: ${task.primaryChatId}` : null,
+    task.linkedProjectIds.length > 0 ? `Projects: ${task.linkedProjectIds.join(", ")}` : null,
+    task.blockedReasonCode ? `Blocked reason: ${task.blockedReasonCode}` : null,
+    task.aiExecutionState ? `AI state: ${task.aiExecutionState}` : null,
+    "",
+    "Actions: c create, e edit, x delete, r reorder, s start, d done, b block, u unblock, k skip, Esc back"
+  ].filter((line) => line !== null);
+  return lines.flatMap((line) => wrap(line, width));
+}
+function renderWorkflows(state, width) {
+  const lines = ["Workflows", ""];
+  if (state.workflows.length === 0) {
+    lines.push("No workflows found.", "Create one outside TUI with: openmates workflows create --file workflow.yml");
+    return lines.flatMap((line) => wrap(line, width));
+  }
+  const visibleCount = Math.max(1, CONTENT_PREVIEW_LINES);
+  const start = Math.max(0, Math.min(state.selectedIndex, state.workflows.length - visibleCount));
+  for (let i = 0; i < state.workflows.slice(start, start + visibleCount).length; i += 1) {
+    const absoluteIndex = start + i;
+    const workflow = state.workflows[absoluteIndex];
+    const cursor = absoluteIndex === state.selectedIndex ? ">" : " ";
+    const status = workflow.enabled ? "enabled" : "disabled";
+    const lastRun = workflow.last_run_status ? ` last: ${workflow.last_run_status}` : "";
+    lines.push(`${cursor} ${workflow.title} (${status})${lastRun}`);
+    lines.push(`    ${workflow.id}`);
+    if (workflow.trigger_summary) lines.push(`    ${workflow.trigger_summary}`);
+    lines.push("");
+  }
+  return lines.flatMap((line) => wrap(line, width));
+}
+function renderWorkflowDetail(state, width) {
+  const workflow = state.activeWorkflow;
+  if (!workflow) return renderWorkflows(state, width);
+  const graphNodes = workflow.graph?.nodes ?? [];
+  const selectedRun = state.workflowRuns[state.selectedWorkflowRunIndex] ?? null;
+  const lines = [
+    `Workflow: ${workflow.title}`,
+    `ID: ${workflow.id}`,
+    `Status: ${workflow.enabled ? "enabled" : "disabled"}`,
+    workflow.trigger_summary ? `Trigger: ${workflow.trigger_summary}` : null,
+    workflow.next_run_at ? `Next run: ${formatTimestamp(workflow.next_run_at)}` : null,
+    workflow.last_run_status ? `Last run: ${workflow.last_run_status}` : null,
+    "",
+    state.workflowTab === "graph" ? "[Graph]  Runs" : "Graph  [Runs]",
+    ""
+  ].filter((line) => line !== null);
+  if (state.workflowTab === "runs") {
+    lines.push(...renderRunSelector(state, width), "");
+    if (selectedRun) {
+      lines.push(`Run graph: ${selectedRun.id} (${selectedRun.status})`);
+      lines.push(...renderWorkflowGraph({ nodes: graphNodes, state, width, run: selectedRun }));
+    } else {
+      lines.push("No runs yet.");
+    }
+  } else {
+    lines.push("Graph");
+    lines.push(...renderWorkflowGraph({ nodes: graphNodes, state, width, run: null }));
+    if (state.workflowEdit) lines.push("", `Editing ${state.workflowEdit.field}: ${state.workflowEdit.value}`);
+  }
+  if (state.status) lines.push("", state.status);
+  return lines.flatMap((line) => wrap(line, width));
+}
+function renderRunSelector(state, width) {
+  if (state.workflowRuns.length === 0) return ["Runs", "No runs yet."];
+  const lines = ["Runs"];
+  const visibleRuns = state.workflowRuns.slice(0, 5);
+  for (let index = 0; index < visibleRuns.length; index += 1) {
+    const run = visibleRuns[index];
+    const cursor = index === state.selectedWorkflowRunIndex ? ">" : " ";
+    lines.push(`${cursor} ${run.id}  ${run.status}  ${formatTimestamp(run.started_at)}`);
+  }
+  return lines.map((line) => truncateVisible(line, width));
+}
+function renderWorkflowGraph(params) {
+  const { nodes, state, run } = params;
+  if (nodes.length === 0) return ["No graph nodes available."];
+  const lines = [];
+  const selectedIndex = state.workflowTab === "runs" ? selectedRunGraphNodeIndex(nodes, state) : state.selectedWorkflowNodeIndex;
+  const expandedId = state.workflowTab === "runs" ? state.expandedWorkflowRunNodeId : state.expandedWorkflowNodeId;
+  const nodeRunsById = new Map((run?.node_runs ?? []).map((nodeRun) => [nodeRun.node_id, nodeRun]));
+  for (let index = 0; index < nodes.length; index += 1) {
+    const node = nodes[index];
+    const nodeRun = nodeRunsById.get(node.id) ?? null;
+    const cursor = index === selectedIndex ? ">" : " ";
+    const status = nodeRun ? ` [${nodeRun.status}]` : "";
+    lines.push(`${cursor} [${nodeTypeLabel(node.type)}] ${node.title ?? cardSummary(node)}${status}`);
+    if (nodeRun?.output_summary) lines.push(`    output: ${summarizeObject(nodeRun.output_summary)}`);
+    if (nodeRun?.error_summary) lines.push(`    error: ${nodeRun.error_summary}`);
+    if (expandedId === node.id) {
+      lines.push(...renderExpandedNode(node, nodeRun));
+    }
+    if (index < nodes.length - 1) lines.push("    |");
+  }
+  return lines;
+}
+function selectedRunGraphNodeIndex(nodes, state) {
+  const run = state.workflowRuns[state.selectedWorkflowRunIndex];
+  const nodeRun = run?.node_runs?.find((candidate) => candidate.node_id === state.expandedWorkflowRunNodeId);
+  if (!nodeRun) return Math.min(state.selectedWorkflowNodeIndex, Math.max(0, nodes.length - 1));
+  return Math.max(0, nodes.findIndex((node) => node.id === nodeRun.node_id));
+}
+function renderExpandedNode(node, nodeRun) {
+  const lines = [
+    `    id: ${node.id}`,
+    `    type: ${node.type}`
+  ];
+  if (node.config && Object.keys(node.config).length > 0) lines.push(`    config: ${summarizeObject(node.config)}`);
+  if (node.input_mapping && Object.keys(node.input_mapping).length > 0) lines.push(`    input: ${summarizeObject(node.input_mapping)}`);
+  if (nodeRun?.input_summary) lines.push(`    run input: ${summarizeObject(nodeRun.input_summary)}`);
+  if (nodeRun?.output_summary) lines.push(`    run output: ${summarizeObject(nodeRun.output_summary)}`);
+  return lines;
+}
 function renderInterests(state, width) {
   const lines = [
     "Private local personalization",
@@ -47169,13 +48212,55 @@ function renderMessageContent(content, width) {
 }
 function renderHintLine(state, width) {
   if (state.screen === "interests") return truncateVisible("\u2191/\u2193 move   Space select   Enter continue   Esc back", width);
+  if (state.screen === "tasks") return truncateVisible("\u2191/\u2193 choose   Enter open   c create   Esc back", width);
+  if (state.screen === "task") return truncateVisible("c create   e edit   x delete   r reorder   s start   d done   b block   u unblock   k skip", width);
+  if (state.screen === "workflows") return truncateVisible("\u2191/\u2193 choose   Enter open   Esc back", width);
+  if (state.screen === "workflow" && state.workflowEdit) return truncateVisible("Enter save title   Esc cancel edit", width);
+  if (state.screen === "workflow") return truncateVisible("g graph   r runs   \u2191/\u2193 select   Enter expand   e title   E config   x run   u refresh   c cancel", width);
   return truncateVisible("\u2191/\u2193 choose   Enter open   /search filter   Esc back", width);
 }
 function inputPlaceholder(state) {
   if (state.screen === "example") return "Continue from this example, or ask your own question...";
   if (state.screen === "chat") return "Ask a follow-up, use @file, or type /help";
+  if (state.screen === "workflow" || state.screen === "workflows" || state.screen === "tasks" || state.screen === "task") return "Use shortcuts below, or type /help";
   return "Ask anything...";
 }
+function nodeTypeLabel(type) {
+  switch (type) {
+    case "manual_trigger":
+      return "manual trigger";
+    case "schedule_trigger":
+      return "schedule";
+    case "app_skill_action":
+      return "app skill";
+    case "send_notification":
+      return "notification";
+    case "ask_user":
+      return "ask user";
+    default:
+      return type.replaceAll("_", " ");
+  }
+}
+function cardSummary(node) {
+  const config = node.config ?? {};
+  if (node.type === "app_skill_action") {
+    const app = typeof config.app === "string" ? config.app : "app";
+    const skill = typeof config.skill === "string" ? config.skill : "skill";
+    return `${app}.${skill}`;
+  }
+  if (node.type === "decision") return "If condition";
+  if (node.type === "send_notification") return "Send notification";
+  if (node.type === "ask_user") return "Ask for user input";
+  return node.id;
+}
+function formatTimestamp(value) {
+  if (!value) return "-";
+  return new Date(value * 1e3).toISOString().replace("T", " ").slice(0, 16);
+}
+function summarizeObject(value) {
+  const entries = Object.entries(value).slice(0, 3).map(([key, item]) => `${key}=${String(item)}`);
+  return entries.join(", ") || "object";
+}
 function interestScore(haystack, interest) {
   let score = haystack.includes(interest) ? 10 : 0;
   for (const token of interest.split(/\s+|&/).filter((part) => part.length > 2)) {
@@ -47226,6 +48311,221 @@ function boxed(line, width) {
   return `\u2502 ${line.padEnd(width)} \u2502`;
 }
 
+// src/tasksCli.ts
+import { createHash as createHash7, randomBytes as randomBytes3, randomUUID as randomUUID5 } from "crypto";
+var TASK_STATUSES = ["backlog", "todo", "in_progress", "blocked", "done"];
+var DEFAULT_STANDALONE_PREFIX = "TASK";
+function normalizeTaskStatus(value) {
+  if (value === void 0) return void 0;
+  if (TASK_STATUSES.includes(value)) return value;
+  throw new Error(`Unknown task status '${value}'. Expected one of: ${TASK_STATUSES.join(", ")}`);
+}
+function parseAssignee(value) {
+  if (!value || value === "user") return { assigneeType: "user", assigneeHash: null };
+  if (["ai", "openmates", "OpenMates"].includes(value)) return { assigneeType: "ai", assigneeHash: null };
+  return { assigneeType: "user", assigneeHash: value };
+}
+function splitCsvFlag(value) {
+  if (typeof value !== "string") return [];
+  return value.split(/[,\n]/).map((item) => item.trim()).filter(Boolean);
+}
+function parseDueAt(value) {
+  if (value === void 0) return void 0;
+  if (value === false || value === true) throw new Error("--due requires a timestamp or date value.");
+  const numeric = Number(value);
+  if (Number.isFinite(numeric) && numeric > 0) return Math.floor(numeric);
+  const parsed = Date.parse(value);
+  if (Number.isNaN(parsed)) throw new Error(`Invalid --due value '${value}'.`);
+  return Math.floor(parsed / 1e3);
+}
+async function buildCreateUserTaskInput(masterKey, input) {
+  const taskKey = randomBytes3(32);
+  const encryptedTaskKey = await encryptBytesWithAesGcm(taskKey, masterKey);
+  const timestamp = nowSeconds();
+  const assignee = parseAssignee(input.assign);
+  const linkedProjectIds = input.projectIds ?? [];
+  const status = input.status ?? (assignee.assigneeType === "ai" && !input.dueAt ? "in_progress" : "todo");
+  return {
+    task_id: randomUUIDCompat(),
+    short_id: void 0,
+    encrypted_task_key: encryptedTaskKey,
+    encrypted_title: await encryptWithAesGcmCombined(input.title, taskKey),
+    encrypted_description: await encryptWithAesGcmCombined(input.description ?? "", taskKey),
+    encrypted_tags: await encryptWithAesGcmCombined("[]", taskKey),
+    encrypted_linked_project_ids: await encryptWithAesGcmCombined(JSON.stringify(linkedProjectIds), taskKey),
+    status,
+    assignee_type: assignee.assigneeType,
+    assignee_hash: assignee.assigneeHash,
+    primary_chat_id: input.chatId ?? null,
+    linked_project_ids: linkedProjectIds,
+    plan_id: input.planId ?? null,
+    due_at: input.dueAt ?? null,
+    priority: 0,
+    position: timestamp,
+    created_at: timestamp,
+    updated_at: timestamp
+  };
+}
+async function buildUpdateUserTaskInput(task, masterKey, input) {
+  const taskKey = await taskKeyFromRecord(task.encrypted, masterKey);
+  const patch = { version: task.version, updated_at: nowSeconds() };
+  if (input.title !== void 0) patch.encrypted_title = await encryptWithAesGcmCombined(input.title, taskKey);
+  if (input.description !== void 0) patch.encrypted_description = await encryptWithAesGcmCombined(input.description, taskKey);
+  if (input.status !== void 0) patch.status = input.status;
+  if (input.assign !== void 0) {
+    const assignee = parseAssignee(input.assign);
+    patch.assignee_type = assignee.assigneeType;
+    patch.assignee_hash = assignee.assigneeHash;
+  }
+  if (input.chatId !== void 0) patch.primary_chat_id = input.chatId;
+  if (input.projectIds !== void 0) {
+    patch.linked_project_ids = input.projectIds;
+    patch.encrypted_linked_project_ids = await encryptWithAesGcmCombined(JSON.stringify(input.projectIds), taskKey);
+  }
+  if (input.planId !== void 0) patch.plan_id = input.planId;
+  return patch;
+}
+async function decryptUserTask(record, masterKey) {
+  const taskKey = await taskKeyFromRecord(record, masterKey);
+  const tags = parseStringArray(await decryptOptional(record.encrypted_tags, taskKey));
+  const linkedProjectIds = parseStringArray(await decryptOptional(record.encrypted_linked_project_ids, taskKey));
+  return {
+    taskId: record.task_id,
+    shortId: record.short_id || deriveShortId(record),
+    title: await decryptOptional(record.encrypted_title, taskKey) || "(untitled task)",
+    description: await decryptOptional(record.encrypted_description, taskKey),
+    tags,
+    latestInstruction: await decryptOptional(record.encrypted_latest_instruction, taskKey),
+    status: record.status,
+    assigneeType: record.assignee_type,
+    assigneeHash: record.assignee_hash ?? null,
+    primaryChatId: record.primary_chat_id ?? null,
+    linkedProjectIds: linkedProjectIds.length > 0 ? linkedProjectIds : record.linked_project_ids ?? [],
+    planId: record.plan_id ?? null,
+    dueAt: record.due_at ?? null,
+    priority: record.priority ?? 0,
+    position: record.position ?? 0,
+    queueState: record.queue_state ?? "none",
+    blockedReasonCode: record.blocked_reason_code ?? null,
+    aiExecutionState: record.ai_execution_state ?? null,
+    version: record.version ?? 1,
+    encrypted: record
+  };
+}
+async function decryptUserTasks(records, masterKey) {
+  const output = [];
+  for (const record of records) output.push(await decryptUserTask(record, masterKey));
+  return output;
+}
+function findTask(tasks, id) {
+  const task = tasks.find((candidate) => candidate.taskId === id || candidate.shortId === id);
+  if (!task) throw new Error(`Task '${id}' was not found in the current task list.`);
+  return task;
+}
+function renderTaskList(tasks) {
+  if (tasks.length === 0) return "No tasks found.";
+  const lines = ["Tasks", "ID        Status       Assignee    Queue       Title"];
+  for (const task of tasks) {
+    lines.push(`${pad(task.shortId, 9)} ${pad(task.status, 12)} ${pad(assigneeLabel(task), 11)} ${pad(task.queueState, 11)} ${task.title}`);
+  }
+  return lines.join("\n");
+}
+function renderTaskDetail2(task) {
+  const lines = [
+    `Task ${task.shortId}`,
+    `Title: ${task.title}`,
+    `Status: ${task.status}`,
+    `Assignee: ${assigneeLabel(task)}`,
+    `Queue: ${task.queueState}`,
+    `Task ID: ${task.taskId}`
+  ];
+  if (task.description) lines.push(`Description: ${task.description}`);
+  if (task.primaryChatId) lines.push(`Chat: ${task.primaryChatId}`);
+  if (task.linkedProjectIds.length > 0) lines.push(`Projects: ${task.linkedProjectIds.join(", ")}`);
+  if (task.planId) lines.push(`Plan: ${task.planId}`);
+  if (task.blockedReasonCode) lines.push(`Blocked reason: ${task.blockedReasonCode}`);
+  if (task.aiExecutionState) lines.push(`AI state: ${task.aiExecutionState}`);
+  return lines.join("\n");
+}
+function renderTaskBoard(tasks, width = process.stdout.columns || 100) {
+  const columns = TASK_STATUSES.map((status) => ({ status, tasks: tasks.filter((task) => task.status === status).sort(compareTasks) }));
+  if (width < 96) {
+    const lines2 = ["OpenMates Tasks Board"];
+    for (const column of columns) {
+      lines2.push("", `${columnTitle(column.status)} (${column.tasks.length})`, "-".repeat(24));
+      lines2.push(...boardColumnLines(column.tasks, 8));
+    }
+    return lines2.join("\n");
+  }
+  const perColumn = 6;
+  const columnWidth = 22;
+  const lines = ["OpenMates Tasks Board", ""];
+  lines.push(columns.map((column) => pad(`${columnTitle(column.status)} (${column.tasks.length})`, columnWidth)).join("  "));
+  lines.push(columns.map(() => "-".repeat(columnWidth)).join("  "));
+  const renderedColumns = columns.map((column) => boardColumnLines(column.tasks, perColumn).map((line) => truncate(line, columnWidth)));
+  const maxRows = Math.max(...renderedColumns.map((column) => column.length));
+  for (let row = 0; row < maxRows; row += 1) {
+    lines.push(renderedColumns.map((column) => pad(column[row] ?? "", columnWidth)).join("  "));
+  }
+  return lines.join("\n");
+}
+function boardColumnLines(tasks, limit) {
+  if (tasks.length === 0) return ["No tasks here."];
+  const visible = tasks.slice(0, limit).flatMap((task) => [
+    `[${task.shortId}] ${task.title}`,
+    ` ${assigneeLabel(task)} ${task.queueState === "none" ? "" : task.queueState}`.trimEnd()
+  ]);
+  if (tasks.length > limit) visible.push(`... ${tasks.length - limit} more`);
+  return visible;
+}
+function compareTasks(a, b) {
+  return a.position - b.position || a.title.localeCompare(b.title);
+}
+function columnTitle(status) {
+  if (status === "in_progress") return "In progress";
+  return status.slice(0, 1).toUpperCase() + status.slice(1).replace("_", " ");
+}
+function assigneeLabel(task) {
+  return task.assigneeType === "ai" ? "OpenMates" : task.assigneeHash ?? "user";
+}
+async function taskKeyFromRecord(record, masterKey) {
+  if (!record.encrypted_task_key) throw new Error(`Task ${record.task_id} is missing encrypted task key.`);
+  const taskKey = await decryptBytesWithAesGcm(record.encrypted_task_key, masterKey);
+  if (!taskKey) throw new Error(`Failed to decrypt task key for ${record.task_id}.`);
+  return taskKey;
+}
+async function decryptOptional(value, key) {
+  if (!value) return "";
+  return await decryptWithAesGcmCombined(value, key) ?? "";
+}
+function parseStringArray(value) {
+  if (!value) return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : [];
+  } catch {
+    return [];
+  }
+}
+function deriveShortId(record) {
+  const prefix = record.short_id_prefix || DEFAULT_STANDALONE_PREFIX;
+  const source = record.task_id || `${record.created_at ?? ""}-${record.position ?? ""}`;
+  const digest = createHash7("sha256").update(source).digest("hex").slice(0, 4).toUpperCase();
+  return `${prefix}-${parseInt(digest, 16) % 1e4}`;
+}
+function nowSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
+function randomUUIDCompat() {
+  return randomUUID5();
+}
+function pad(value, length) {
+  return truncate(value, length).padEnd(length);
+}
+function truncate(value, length) {
+  return value.length <= length ? value : `${value.slice(0, Math.max(0, length - 3))}...`;
+}
+
 // src/tui.ts
 function defaultModeForStreams(input, output) {
   return input.isTTY === true && output.isTTY === true ? "tui" : "quickstart";
@@ -47268,11 +48568,78 @@ async function handleKey(params) {
     return;
   }
   if (key.name === "escape") {
-    state.screen = "start";
+    if (state.workflowEdit) {
+      state.workflowEdit = null;
+      render();
+      return;
+    }
+    state.screen = state.screen === "workflow" ? "workflows" : state.screen === "task" ? "tasks" : "start";
     state.input = "";
     render();
     return;
   }
+  if (state.screen === "workflow" && state.workflowEdit) {
+    if (key.name === "return") {
+      await saveWorkflowNodeTitle({ state, client, render });
+      return;
+    }
+    if (key.name === "backspace") {
+      state.workflowEdit.value = state.workflowEdit.value.slice(0, -1);
+      render();
+      return;
+    }
+    if (!key.ctrl && !key.meta && chunk && chunk >= " ") {
+      state.workflowEdit.value += chunk;
+      render();
+    }
+    return;
+  }
+  if (state.screen === "workflow" && !state.input && !key.ctrl && !key.meta) {
+    if (chunk === "g") {
+      state.workflowTab = "graph";
+      render();
+      return;
+    }
+    if (chunk === "r") {
+      state.workflowTab = "runs";
+      render();
+      return;
+    }
+    if (chunk === "x") {
+      await runActiveWorkflow({ state, client, render });
+      return;
+    }
+    if (chunk === "u") {
+      await refreshActiveWorkflowRuns({ state, client, render });
+      return;
+    }
+    if (chunk === "c") {
+      await cancelLatestWorkflowRun({ state, client, render });
+      return;
+    }
+    if (chunk === "e") {
+      startWorkflowNodeEdit(state, "title");
+      render();
+      return;
+    }
+    if (chunk === "E") {
+      startWorkflowNodeEdit(state, "config");
+      render();
+      return;
+    }
+  }
+  if ((state.screen === "tasks" || state.screen === "task") && !state.input && !key.ctrl && !key.meta) {
+    if (chunk === "c") {
+      await createTaskFromTui({ state, client, terminal, render });
+      return;
+    }
+  }
+  if (state.screen === "task" && !state.input && !key.ctrl && !key.meta) {
+    if (["s", "d", "b", "u", "k", "e", "x", "r"].includes(chunk)) {
+      await handleActiveTaskAction({ state, client, terminal, actionKey: chunk, render });
+      return;
+    }
+  }
   if (key.name === "up") {
     moveSelectionOrScroll(state, -1);
     render();
@@ -47317,6 +48684,9 @@ async function handleKey(params) {
     await handleEnter({ state, client, terminal, render, finish });
     return;
   }
+  if (state.screen === "workflow" || state.screen === "workflows" || state.screen === "tasks" || state.screen === "task") {
+    return;
+  }
   if (!key.ctrl && !key.meta && chunk && chunk >= " ") {
     state.input += chunk;
     render();
@@ -47335,6 +48705,23 @@ async function handleEnter(params) {
     render();
     return;
   }
+  if (state.screen === "workflows") {
+    const selected = state.workflows[state.selectedIndex];
+    if (selected) await openWorkflowDetail({ state, client, workflow: selected, render });
+    render();
+    return;
+  }
+  if (state.screen === "tasks") {
+    const selected = state.tasks[state.selectedIndex];
+    if (selected) openTaskDetail(state, selected);
+    render();
+    return;
+  }
+  if (state.screen === "workflow") {
+    toggleSelectedWorkflowNode(state);
+    render();
+    return;
+  }
   const text = state.input.trim();
   if (!text) return;
   state.input = "";
@@ -47361,6 +48748,22 @@ async function handleCommand(params) {
     render();
     return;
   }
+  if (name === "/workflows") {
+    await openWorkflowList({ state, client, render });
+    return;
+  }
+  if (name === "/tasks") {
+    await openTaskList({ state, client, render });
+    return;
+  }
+  if (name === "/workflow") {
+    if (!arg) {
+      await openWorkflowList({ state, client, render });
+      return;
+    }
+    await openWorkflowById({ state, client, workflowId: arg, render });
+    return;
+  }
   if (name === "/signup") {
     finish({ action: "signup" });
     return;
@@ -47464,8 +48867,368 @@ function moveSelectionOrScroll(state, direction) {
     state.selectedIndex = clamp(state.selectedIndex + direction, 0, Math.max(0, state.examples.length - 1));
     return;
   }
+  if (state.screen === "workflows") {
+    state.selectedIndex = clamp(state.selectedIndex + direction, 0, Math.max(0, state.workflows.length - 1));
+    return;
+  }
+  if (state.screen === "tasks") {
+    state.selectedIndex = clamp(state.selectedIndex + direction, 0, Math.max(0, state.tasks.length - 1));
+    return;
+  }
+  if (state.screen === "workflow") {
+    if (state.workflowTab === "runs") {
+      state.selectedWorkflowRunIndex = clamp(state.selectedWorkflowRunIndex + direction, 0, Math.max(0, state.workflowRuns.length - 1));
+      const selectedRun = state.workflowRuns[state.selectedWorkflowRunIndex];
+      state.selectedWorkflowNodeIndex = firstRunNodeIndex(state, selectedRun);
+      return;
+    }
+    const nodeCount = state.activeWorkflow?.graph.nodes.length ?? 0;
+    state.selectedWorkflowNodeIndex = clamp(state.selectedWorkflowNodeIndex + direction, 0, Math.max(0, nodeCount - 1));
+    return;
+  }
   state.scrollOffset = Math.max(0, state.scrollOffset - direction);
 }
+function toggleSelectedWorkflowNode(state) {
+  const workflow = state.activeWorkflow;
+  if (!workflow) return;
+  const node = workflow.graph.nodes[state.selectedWorkflowNodeIndex];
+  if (!node) return;
+  if (state.workflowTab === "runs") {
+    state.expandedWorkflowRunNodeId = state.expandedWorkflowRunNodeId === node.id ? null : node.id;
+  } else {
+    state.expandedWorkflowNodeId = state.expandedWorkflowNodeId === node.id ? null : node.id;
+  }
+}
+function firstRunNodeIndex(state, run) {
+  const workflow = state.activeWorkflow;
+  const firstNodeRun = run?.node_runs?.[0];
+  if (!workflow || !firstNodeRun) return 0;
+  return Math.max(0, workflow.graph.nodes.findIndex((node) => node.id === firstNodeRun.node_id));
+}
+async function openTaskList(params) {
+  const { state, client, render } = params;
+  state.screen = "status";
+  state.status = "Loading tasks...";
+  render();
+  try {
+    state.tasks = await decryptUserTasks(await client.listUserTasks(), client.getMasterKeyBytes());
+    state.selectedIndex = 0;
+    state.scrollOffset = 0;
+    state.activeTask = null;
+    state.status = null;
+    state.screen = "tasks";
+  } catch (error) {
+    state.status = taskError(error, "Could not load tasks. Use /login first if you are not signed in.");
+    state.screen = "status";
+  }
+  render();
+}
+function openTaskDetail(state, task) {
+  state.activeTask = task;
+  state.screen = "task";
+  state.scrollOffset = 0;
+}
+async function handleActiveTaskAction(params) {
+  const { state, client, terminal, actionKey, render } = params;
+  const task = state.activeTask;
+  if (!task) return;
+  state.status = "Updating task...";
+  render();
+  try {
+    if (actionKey === "e") {
+      const title = await promptLine(terminal, `New title for ${task.shortId}: `);
+      if (!title.trim()) {
+        state.status = "Edit cancelled.";
+        render();
+        return;
+      }
+      const patch = await buildUpdateUserTaskInput(task, client.getMasterKeyBytes(), { title: title.trim() });
+      const updated2 = await client.updateUserTask(task.taskId, patch);
+      const decrypted2 = await decryptUserTask(updated2, client.getMasterKeyBytes());
+      replaceTask(state, decrypted2);
+      state.activeTask = decrypted2;
+      state.status = null;
+      state.screen = "task";
+      render();
+      return;
+    }
+    if (actionKey === "x") {
+      const confirmation = await promptLine(terminal, `Type DELETE to delete ${task.shortId}: `);
+      if (confirmation !== "DELETE") {
+        state.status = "Delete cancelled.";
+        render();
+        return;
+      }
+      await client.deleteUserTask(task.taskId);
+      state.tasks = state.tasks.filter((candidate) => candidate.taskId !== task.taskId);
+      state.activeTask = null;
+      state.selectedIndex = Math.min(state.selectedIndex, Math.max(0, state.tasks.length - 1));
+      state.status = `Deleted ${task.shortId}.`;
+      state.screen = "tasks";
+      render();
+      return;
+    }
+    if (actionKey === "r") {
+      const positionText = await promptLine(terminal, `New numeric position for ${task.shortId}: `);
+      const position = Number(positionText.trim());
+      if (!Number.isFinite(position)) {
+        state.status = "Reorder cancelled: position must be a number.";
+        render();
+        return;
+      }
+      const updated2 = await client.reorderUserTasks({ moves: [{ task_id: task.taskId, position }] });
+      const [decrypted2] = await decryptUserTasks(updated2, client.getMasterKeyBytes());
+      if (decrypted2) {
+        replaceTask(state, decrypted2);
+        state.activeTask = decrypted2;
+      }
+      state.status = null;
+      state.screen = "task";
+      render();
+      return;
+    }
+    const payload = actionKey === "b" ? { version: task.version, blocked_reason_code: "needs_user_input" } : { version: task.version };
+    const updated = actionKey === "s" ? await client.startUserTaskWithAI(task.taskId, {
+      version: task.version,
+      primary_chat_id: task.primaryChatId ?? void 0,
+      linked_project_ids: task.linkedProjectIds,
+      plaintext_title: task.title,
+      plaintext_description: task.description,
+      plaintext_latest_instruction: task.latestInstruction
+    }) : actionKey === "d" ? await client.completeUserTask(task.taskId, payload) : actionKey === "b" ? await client.blockUserTask(task.taskId, payload) : actionKey === "u" ? await client.unblockUserTask(task.taskId, payload) : await client.skipUserTask(task.taskId, payload);
+    const decrypted = await decryptUserTask(updated, client.getMasterKeyBytes());
+    replaceTask(state, decrypted);
+    state.activeTask = decrypted;
+    state.status = null;
+    state.screen = "task";
+  } catch (error) {
+    state.status = taskError(error, "Could not update task.");
+    state.screen = "status";
+  }
+  render();
+}
+async function createTaskFromTui(params) {
+  const { state, client, terminal, render } = params;
+  state.status = "Creating task...";
+  render();
+  try {
+    const title = await promptLine(terminal, "Task title: ");
+    if (!title.trim()) {
+      state.status = "Create cancelled.";
+      render();
+      return;
+    }
+    const description = await promptLine(terminal, "Description (optional): ");
+    const input = await buildCreateUserTaskInput(client.getMasterKeyBytes(), {
+      title: title.trim(),
+      description: description.trim(),
+      assign: "user"
+    });
+    const created = await client.createUserTask(input);
+    const decrypted = await decryptUserTask(created, client.getMasterKeyBytes());
+    replaceTask(state, decrypted);
+    state.activeTask = decrypted;
+    state.selectedIndex = Math.max(0, state.tasks.findIndex((task) => task.taskId === decrypted.taskId));
+    state.status = null;
+    state.screen = "task";
+  } catch (error) {
+    state.status = taskError(error, "Could not create task.");
+    state.screen = "status";
+  }
+  render();
+}
+async function promptLine(terminal, prompt) {
+  return terminal.suspend(async () => {
+    const rl = createInterface3({ input: nodeStdin, output: nodeStdout });
+    try {
+      return await rl.question(prompt);
+    } finally {
+      rl.close();
+    }
+  });
+}
+function replaceTask(state, task) {
+  const index = state.tasks.findIndex((candidate) => candidate.taskId === task.taskId);
+  if (index >= 0) state.tasks[index] = task;
+  else state.tasks.unshift(task);
+}
+function taskError(error, fallback) {
+  return error instanceof Error ? `${fallback} ${error.message}` : fallback;
+}
+async function openWorkflowList(params) {
+  const { state, client, render } = params;
+  state.screen = "status";
+  state.status = "Loading workflows...";
+  render();
+  try {
+    state.workflows = await client.listWorkflows();
+    state.selectedIndex = 0;
+    state.scrollOffset = 0;
+    state.status = null;
+    state.screen = "workflows";
+  } catch (error) {
+    state.status = workflowError(error, "Could not load workflows. Use /login first if you are not signed in.");
+    state.screen = "status";
+  }
+  render();
+}
+async function openWorkflowById(params) {
+  const { state, client, workflowId, render } = params;
+  state.screen = "status";
+  state.status = `Loading workflow ${workflowId}...`;
+  render();
+  try {
+    const workflow = await client.getWorkflow(workflowId);
+    await openWorkflowDetail({ state, client, workflow, render });
+  } catch (error) {
+    state.status = workflowError(error, `Could not load workflow ${workflowId}.`);
+    state.screen = "status";
+    render();
+  }
+}
+async function openWorkflowDetail(params) {
+  const { state, client, workflow, render } = params;
+  state.status = `Loading workflow ${workflow.id}...`;
+  render();
+  let detail;
+  try {
+    detail = await client.getWorkflow(workflow.id);
+  } catch (error) {
+    state.status = workflowError(error, `Could not load workflow ${workflow.id}.`);
+    state.screen = "status";
+    render();
+    return;
+  }
+  state.activeWorkflow = detail;
+  state.workflowRuns = [];
+  state.workflowTab = "graph";
+  state.selectedWorkflowNodeIndex = 0;
+  state.selectedWorkflowRunIndex = 0;
+  state.expandedWorkflowNodeId = null;
+  state.expandedWorkflowRunNodeId = null;
+  state.workflowEdit = null;
+  state.screen = "workflow";
+  state.scrollOffset = 0;
+  state.status = null;
+  render();
+  await refreshActiveWorkflowRuns({ state, client, render });
+}
+async function refreshActiveWorkflowRuns(params) {
+  const { state, client, render } = params;
+  const workflow = state.activeWorkflow;
+  if (!workflow) return;
+  state.status = "Refreshing workflow runs...";
+  render();
+  try {
+    state.workflowRuns = await client.listWorkflowRuns(workflow.id);
+    state.selectedWorkflowRunIndex = clamp(state.selectedWorkflowRunIndex, 0, Math.max(0, state.workflowRuns.length - 1));
+    state.status = null;
+    state.screen = "workflow";
+  } catch (error) {
+    state.status = workflowError(error, "Could not refresh workflow runs.");
+  }
+  render();
+}
+async function saveWorkflowNodeTitle(params) {
+  const { state, client, render } = params;
+  const workflow = state.activeWorkflow;
+  const edit = state.workflowEdit;
+  if (!workflow || !edit) return;
+  let parsedConfig = null;
+  if (edit.field === "config") {
+    try {
+      const parsed = JSON.parse(edit.value || "{}");
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Config must be a JSON object");
+      parsedConfig = parsed;
+    } catch (error) {
+      state.status = workflowError(error, "Invalid config JSON.");
+      render();
+      return;
+    }
+  }
+  const graph = {
+    ...workflow.graph,
+    nodes: workflow.graph.nodes.map((node) => {
+      if (node.id !== edit.nodeId) return node;
+      if (edit.field === "config") return { ...node, config: parsedConfig ?? {} };
+      return { ...node, title: edit.value.trim() || null };
+    })
+  };
+  state.status = `Saving node ${edit.field}...`;
+  render();
+  try {
+    state.activeWorkflow = await client.updateWorkflow(workflow.id, { graph });
+    state.workflowEdit = null;
+    state.status = `Saved node ${edit.field}.`;
+  } catch (error) {
+    state.status = workflowError(error, "Could not save node title.");
+  }
+  render();
+}
+function startWorkflowNodeEdit(state, field) {
+  const workflow = state.activeWorkflow;
+  if (!workflow || state.workflowTab !== "graph") {
+    state.status = "Switch to the Graph tab before editing node details.";
+    return;
+  }
+  const node = workflow.graph.nodes[state.selectedWorkflowNodeIndex];
+  if (!node) return;
+  state.workflowEdit = {
+    nodeId: node.id,
+    field,
+    value: field === "config" ? JSON.stringify(node.config ?? {}) : node.title ?? ""
+  };
+  state.expandedWorkflowNodeId = node.id;
+  state.status = `Editing ${field} for ${node.id}.`;
+}
+async function runActiveWorkflow(params) {
+  const { state, client, render } = params;
+  const workflow = state.activeWorkflow;
+  if (!workflow) return;
+  if (!workflow.enabled) {
+    state.status = "Enable this workflow outside TUI before running it.";
+    render();
+    return;
+  }
+  state.status = "Starting workflow run...";
+  render();
+  try {
+    const run = await client.runWorkflow(workflow.id, {
+      idempotencyKey: `tui-${workflow.id}-${Date.now()}`,
+      mode: "manual",
+      input: {}
+    });
+    state.workflowRuns = [run, ...state.workflowRuns.filter((candidate) => candidate.id !== run.id)];
+    state.status = `Started run ${run.id}. Press u to refresh.`;
+  } catch (error) {
+    state.status = workflowError(error, "Could not start workflow run.");
+  }
+  render();
+}
+async function cancelLatestWorkflowRun(params) {
+  const { state, client, render } = params;
+  const workflow = state.activeWorkflow;
+  const run = state.workflowRuns.find((candidate) => ["queued", "running", "waiting"].includes(candidate.status));
+  if (!workflow || !run) {
+    state.status = "No active workflow run to cancel.";
+    render();
+    return;
+  }
+  state.status = `Cancelling run ${run.id}...`;
+  render();
+  try {
+    const result = await client.cancelWorkflowRun(workflow.id, run.id);
+    state.status = `Run ${result.run_id} ${result.status}.`;
+    await refreshActiveWorkflowRuns({ state, client, render });
+  } catch (error) {
+    state.status = workflowError(error, "Could not cancel workflow run.");
+    render();
+  }
+}
+function workflowError(error, fallback) {
+  const details = error instanceof Error ? error.message : String(error);
+  return `${fallback} ${details}`;
+}
 function toggleInterest(state) {
   const interest = TUI_INTERESTS[state.selectedIndex];
   if (!interest) return;
@@ -47963,6 +49726,10 @@ async function main() {
       printChatsHelp();
       return;
     }
+    if (command === "drafts") {
+      printDraftsHelp();
+      return;
+    }
     if (command === "apps") {
       printAppsHelp();
       return;
@@ -47975,6 +49742,10 @@ async function main() {
       printWorkflowsHelp();
       return;
     }
+    if (command === "tasks") {
+      printTasksHelp();
+      return;
+    }
     if (command === "connected-accounts") {
       printConnectedAccountsHelp();
       return;
@@ -48085,6 +49856,14 @@ async function main() {
     await handleChats(client, subcommand, rest, parsed.flags, redactor);
     return;
   }
+  if (command === "tasks") {
+    await handleTasks(client, subcommand, rest, parsed.flags);
+    return;
+  }
+  if (command === "drafts") {
+    await handleDrafts(client, subcommand, rest, parsed.flags);
+    return;
+  }
   if (command === "apps") {
     await handleApps(client, subcommand, rest, parsed.flags);
     return;
@@ -48222,6 +50001,172 @@ function handleCliVersion(flags) {
   }
   console.log("OpenMates CLI is up to date.");
 }
+async function handleTasks(client, subcommand, rest, flags) {
+  if (!subcommand || subcommand === "help" || flags.help === true) {
+    printTasksHelp();
+    return;
+  }
+  const masterKey = client.getMasterKeyBytes();
+  const scope = taskScopeFromFlags(flags);
+  if (subcommand === "list" || subcommand === "status") {
+    if (subcommand === "status" && rest[0]) {
+      const task = await resolveTask(client, masterKey, rest[0], scope);
+      printTaskOutput(task, flags);
+      return;
+    }
+    const tasks = await loadTasks(client, masterKey, scope);
+    if (flags.json === true) printJson2({ tasks: tasks.map(taskToJson) });
+    else console.log(renderTaskList(tasks));
+    return;
+  }
+  if (subcommand === "board") {
+    const tasks = await loadTasks(client, masterKey, scope);
+    if (flags.json === true) printJson2({ tasks: tasks.map(taskToJson) });
+    else console.log(renderTaskBoard(tasks));
+    return;
+  }
+  if (subcommand === "show") {
+    const id = rest[0];
+    if (!id) throw new Error("Missing task ID. Usage: openmates tasks show <task-id>");
+    const task = await resolveTask(client, masterKey, id, scope);
+    printTaskOutput(task, flags);
+    return;
+  }
+  if (subcommand === "create") {
+    const title = taskTitleFromFlagsOrRest(flags, rest);
+    const input = await buildCreateUserTaskInput(masterKey, {
+      title,
+      description: typeof flags.description === "string" ? flags.description : "",
+      status: normalizeTaskStatus(typeof flags.status === "string" ? flags.status : void 0),
+      assign: taskAssignFlag(flags),
+      chatId: typeof flags.chat === "string" ? flags.chat : null,
+      projectIds: splitCsvFlag(flags.project ?? flags.projects),
+      planId: typeof flags.plan === "string" ? flags.plan : null,
+      dueAt: parseDueAt(flags.due)
+    });
+    const created = await client.createUserTask(input);
+    printTaskOutput(await decryptUserTask(created, masterKey), flags);
+    return;
+  }
+  if (subcommand === "edit") {
+    const id = rest[0];
+    if (!id) throw new Error("Missing task ID. Usage: openmates tasks edit <task-id> [--title ...]");
+    const task = await resolveTask(client, masterKey, id, scope);
+    const patch = await buildUpdateUserTaskInput(task, masterKey, {
+      title: typeof flags.title === "string" ? flags.title : void 0,
+      description: typeof flags.description === "string" ? flags.description : void 0,
+      status: normalizeTaskStatus(typeof flags.status === "string" ? flags.status : void 0),
+      assign: taskAssignFlag(flags),
+      chatId: flags.chat === true ? null : typeof flags.chat === "string" ? flags.chat : void 0,
+      projectIds: flags.project || flags.projects ? splitCsvFlag(flags.project ?? flags.projects) : void 0,
+      planId: flags.plan === true ? null : typeof flags.plan === "string" ? flags.plan : void 0
+    });
+    const updated = await client.updateUserTask(task.taskId, patch);
+    printTaskOutput(await decryptUserTask(updated, masterKey), flags);
+    return;
+  }
+  if (subcommand === "delete") {
+    const task = await requiredResolvedTask(client, masterKey, rest[0], scope, "delete");
+    if (flags.confirm !== true) throw new Error("Deleting a task requires --confirm.");
+    const result = await client.deleteUserTask(task.taskId);
+    if (flags.json === true) printJson2(result);
+    else console.log(`Task deleted: ${task.shortId}`);
+    return;
+  }
+  if (subcommand === "start") {
+    const task = await requiredResolvedTask(client, masterKey, rest[0], scope, "start");
+    const started = await client.startUserTaskWithAI(task.taskId, {
+      version: task.version,
+      primary_chat_id: task.primaryChatId ?? void 0,
+      linked_project_ids: task.linkedProjectIds,
+      plaintext_title: task.title,
+      plaintext_description: task.description,
+      plaintext_latest_instruction: task.latestInstruction
+    });
+    printTaskOutput(await decryptUserTask(started, masterKey), flags);
+    return;
+  }
+  if (["block", "unblock", "skip", "done"].includes(subcommand)) {
+    const task = await requiredResolvedTask(client, masterKey, rest[0], scope, subcommand);
+    const payload = { version: task.version };
+    if (subcommand === "block") {
+      if (typeof flags.reason !== "string") throw new Error("Blocking a task requires --reason <code>.");
+      payload.blocked_reason_code = flags.reason;
+    }
+    const updated = subcommand === "block" ? await client.blockUserTask(task.taskId, payload) : subcommand === "unblock" ? await client.unblockUserTask(task.taskId, payload) : subcommand === "skip" ? await client.skipUserTask(task.taskId, payload) : await client.completeUserTask(task.taskId, payload);
+    printTaskOutput(await decryptUserTask(updated, masterKey), flags);
+    return;
+  }
+  if (subcommand === "reorder") {
+    const task = await requiredResolvedTask(client, masterKey, rest[0], scope, "reorder");
+    const move = { task_id: task.taskId };
+    if (typeof flags.before === "string") move.before_task_id = (await resolveTask(client, masterKey, flags.before, scope)).taskId;
+    if (typeof flags.after === "string") move.after_task_id = (await resolveTask(client, masterKey, flags.after, scope)).taskId;
+    if (typeof flags.status === "string") move.status = normalizeTaskStatus(flags.status);
+    if (typeof flags.position === "string") move.position = Number(flags.position);
+    const updated = await client.reorderUserTasks({ moves: [move] });
+    const decrypted = await decryptUserTasks(updated, masterKey);
+    if (flags.json === true) printJson2({ tasks: decrypted.map(taskToJson) });
+    else console.log(`Task reordered: ${task.shortId}`);
+    return;
+  }
+  throw new Error(`Unknown tasks command '${subcommand}'. Run 'openmates tasks --help'.`);
+}
+function taskScopeFromFlags(flags) {
+  return {
+    status: normalizeTaskStatus(typeof flags.status === "string" ? flags.status : void 0),
+    chatId: typeof flags.chat === "string" ? flags.chat : void 0,
+    projectId: typeof flags.project === "string" ? flags.project : void 0,
+    planId: typeof flags.plan === "string" ? flags.plan : void 0
+  };
+}
+async function loadTasks(client, masterKey, scope) {
+  const records = await client.listUserTasks({ status: scope.status, chatId: scope.chatId, projectId: scope.projectId });
+  const tasks = await decryptUserTasks(records, masterKey);
+  return scope.planId ? tasks.filter((task) => task.planId === scope.planId) : tasks;
+}
+async function resolveTask(client, masterKey, id, scope) {
+  return findTask(await loadTasks(client, masterKey, { ...scope, status: void 0 }), id);
+}
+async function requiredResolvedTask(client, masterKey, id, scope, action) {
+  if (!id) throw new Error(`Missing task ID. Usage: openmates tasks ${action} <task-id>`);
+  return resolveTask(client, masterKey, id, scope);
+}
+function printTaskOutput(task, flags) {
+  if (flags.json === true) printJson2({ task: taskToJson(task) });
+  else console.log(renderTaskDetail2(task));
+}
+function taskToJson(task) {
+  return {
+    task_id: task.taskId,
+    short_id: task.shortId,
+    title: task.title,
+    description: task.description,
+    tags: task.tags,
+    latest_instruction: task.latestInstruction,
+    status: task.status,
+    assignee_type: task.assigneeType,
+    assignee_hash: task.assigneeHash,
+    primary_chat_id: task.primaryChatId,
+    linked_project_ids: task.linkedProjectIds,
+    plan_id: task.planId,
+    due_at: task.dueAt,
+    priority: task.priority,
+    position: task.position,
+    queue_state: task.queueState,
+    blocked_reason_code: task.blockedReasonCode,
+    ai_execution_state: task.aiExecutionState,
+    version: task.version
+  };
+}
+function taskTitleFromFlagsOrRest(flags, rest) {
+  const title = typeof flags.title === "string" ? flags.title : rest.join(" ").trim();
+  if (!title) throw new Error("Missing task title. Usage: openmates tasks create --title <title>");
+  return title;
+}
+function taskAssignFlag(flags) {
+  return typeof flags.assign === "string" ? flags.assign : typeof flags.assignee === "string" ? flags.assignee : void 0;
+}
 async function handleRemoteAccess(client, subcommand, rest, flags) {
   if (!subcommand || subcommand === "help" || flags.help === true) {
     printRemoteAccessHelp();
@@ -48232,7 +50177,7 @@ async function handleRemoteAccess(client, subcommand, rest, flags) {
     if (!rootPath) {
       throw new Error("Missing source path. Usage: openmates remote-access start --path <folder>");
     }
-    const sourceId = typeof flags["source-id"] === "string" ? flags["source-id"] : randomUUID5();
+    const sourceId = typeof flags["source-id"] === "string" ? flags["source-id"] : randomUUID6();
     const projectId = typeof flags.project === "string" ? flags.project : void 0;
     validateRemoteSourceRegistrationFlags(projectId, flags);
     const sourceType = parseRemoteAccessSourceType(flags.type);
@@ -48338,11 +50283,57 @@ function parseJsonFlag(value, flagName) {
     throw new Error(`Invalid JSON for ${flagName}: ${message}`);
   }
 }
+async function handleDrafts(client, subcommand, rest, flags) {
+  if (!subcommand || subcommand === "help" || flags.help === true) {
+    printDraftsHelp();
+    return;
+  }
+  if (subcommand === "create" || subcommand === "update") {
+    const chatId = subcommand === "update" ? rest[0] : typeof flags.chat === "string" ? flags.chat : void 0;
+    const markdown = subcommand === "update" ? rest.slice(1).join(" ").trim() : rest.join(" ").trim();
+    if (subcommand === "update" && !chatId) throw new Error("Missing chat ID for draft update.");
+    if (!markdown) throw new Error(`Missing draft text for draft ${subcommand}.`);
+    const draft = await client.saveDraft({
+      chatId,
+      markdown,
+      preview: typeof flags.preview === "string" ? flags.preview : markdown.slice(0, 160)
+    });
+    printJson2(draft);
+    return;
+  }
+  if (subcommand === "list") {
+    const drafts = await client.listDrafts(flags.refresh === true);
+    printJson2({ drafts });
+    return;
+  }
+  if (subcommand === "get") {
+    const chatId = rest[0];
+    if (!chatId) throw new Error("Missing chat ID for draft get.");
+    printJson2({ draft: await client.getDraft(chatId, flags.refresh === true) });
+    return;
+  }
+  if (subcommand === "clear") {
+    const chatId = rest[0];
+    if (!chatId) throw new Error("Missing chat ID for draft clear.");
+    await client.clearDraft(chatId);
+    printJson2({ success: true, chat_id: chatId });
+    return;
+  }
+  if (subcommand === "sync") {
+    printJson2({ versions: await client.reconcileDraftVersions() });
+    return;
+  }
+  throw new Error(`Unknown drafts subcommand '${subcommand}'.`);
+}
 async function handleChats(client, subcommand, rest, flags, redactor) {
   if (!subcommand || subcommand === "help" || flags.help === true) {
     printChatsHelp();
     return;
   }
+  if (rest[0] === "tasks") {
+    await handleTasks(client, rest[1], rest.slice(2), { ...flags, chat: subcommand });
+    return;
+  }
   if (subcommand === "list") {
     const limit = typeof flags.limit === "string" ? parseInt(flags.limit, 10) : 10;
     const page = typeof flags.page === "string" ? parseInt(flags.page, 10) : 1;
@@ -49025,7 +51016,37 @@ async function handleWorkflows(client, subcommand, rest, flags) {
     }
     return;
   }
+  if (subcommand === "validate") {
+    const file = typeof flags.file === "string" ? flags.file : "";
+    if (!file) throw new Error("Missing --file. Example: openmates workflows validate --file workflow.yml");
+    const validation = await client.validateWorkflowYaml(readFileSync9(file, "utf8"));
+    if (flags.json === true) {
+      printJson2(validation);
+    } else {
+      kv("Draft valid", validation.draft_valid ? "yes" : "no");
+      kv("Ready to enable", validation.enable_ready ? "yes" : "no");
+      for (const diagnostic of validation.diagnostics) {
+        console.log(`  - ${String(diagnostic.path ?? "$")}: ${String(diagnostic.message ?? diagnostic.code ?? "invalid")}`);
+      }
+    }
+    if (!validation.draft_valid) process.exitCode = 1;
+    return;
+  }
   if (subcommand === "create") {
+    const yamlFile = typeof flags.file === "string" ? flags.file : "";
+    if (yamlFile) {
+      const result = await client.createWorkflowYaml(readFileSync9(yamlFile, "utf8"));
+      if (flags.json === true) {
+        printJson2(result);
+      } else {
+        printWorkflowDetail(result.workflow);
+        kv("Ready to enable", result.validation.enable_ready ? "yes" : "no");
+        for (const diagnostic of result.validation.diagnostics) {
+          console.log(`  - ${String(diagnostic.path ?? "$")}: ${String(diagnostic.message ?? diagnostic.code ?? "input required")}`);
+        }
+      }
+      return;
+    }
     const title = typeof flags.title === "string" ? flags.title.trim() : "";
     const graphJson = typeof flags.graph === "string" ? flags.graph : "";
     if (!title) throw new Error("Missing --title for workflow create.");
@@ -49043,6 +51064,22 @@ async function handleWorkflows(client, subcommand, rest, flags) {
     }
     return;
   }
+  if (subcommand === "update") {
+    const workflowId = rest[0];
+    const yamlFile = typeof flags.file === "string" ? flags.file : "";
+    if (!workflowId || !yamlFile) throw new Error("Missing workflow ID or --file. Example: openmates workflows update <id> --file workflow.yml");
+    const result = await client.updateWorkflowYaml(workflowId, readFileSync9(yamlFile, "utf8"));
+    if (flags.json === true) {
+      printJson2(result);
+    } else {
+      printWorkflowDetail(result.workflow);
+      kv("Ready to enable", result.validation.enable_ready ? "yes" : "no");
+      for (const diagnostic of result.validation.diagnostics) {
+        console.log(`  - ${String(diagnostic.path ?? "$")}: ${String(diagnostic.message ?? diagnostic.code ?? "input required")}`);
+      }
+    }
+    return;
+  }
   if (subcommand === "input") {
     const text = typeof flags.text === "string" ? flags.text : rest.join(" ").trim();
     if (!text) throw new Error('Missing workflow input text. Example: openmates workflows input "alert me if it rains"');
@@ -49149,9 +51186,11 @@ async function handleWorkflows(client, subcommand, rest, flags) {
   if (subcommand === "run") {
     const workflowId = rest[0];
     if (!workflowId) throw new Error("Missing workflow ID. Example: openmates workflows run <id>");
+    const idempotencyKey = typeof flags["idempotency-key"] === "string" ? flags["idempotency-key"] : "";
+    if (!idempotencyKey) throw new Error("Missing --idempotency-key. Reuse this stable key when retrying the same workflow run.");
     const mode = flags.mode === "test" ? "test" : "manual";
     const input = typeof flags.input === "string" ? parseJsonFlag(flags.input, "--input") : {};
-    const run = await client.runWorkflow(workflowId, { mode, input });
+    const run = await client.runWorkflow(workflowId, { idempotencyKey, mode, input });
     if (flags.json === true) {
       printJson2(run);
     } else {
@@ -49182,6 +51221,58 @@ async function handleWorkflows(client, subcommand, rest, flags) {
     }
     return;
   }
+  if (subcommand === "run-cancel") {
+    const workflowId = rest[0];
+    const runId = rest[1];
+    if (!workflowId || !runId) throw new Error("Missing workflow/run ID. Example: openmates workflows run-cancel <workflow-id> <run-id>");
+    const result = await client.cancelWorkflowRun(workflowId, runId);
+    if (flags.json === true) {
+      printJson2(result);
+    } else {
+      kv("Status", result.status);
+    }
+    return;
+  }
+  if (subcommand === "step-test") {
+    const workflowId = rest[0];
+    const stepId = rest[1];
+    if (!workflowId || !stepId) throw new Error("Missing workflow/step ID. Example: openmates workflows step-test <workflow-id> <step-id> --yes");
+    const input = typeof flags.input === "string" ? parseJsonFlag(flags.input, "--input") : {};
+    const run = await client.testWorkflowStep(workflowId, stepId, { input, confirmed: flags.yes === true });
+    if (flags.json === true) {
+      printJson2(run);
+    } else {
+      printWorkflowRun(run);
+    }
+    return;
+  }
+  if (subcommand === "respond") {
+    const workflowId = rest[0];
+    const runId = rest[1];
+    const stepId = rest[2];
+    if (!workflowId || !runId || !stepId) throw new Error(`Missing workflow/run/step ID. Example: openmates workflows respond <workflow-id> <run-id> <step-id> --input '{"answer":"Berlin"}'`);
+    const input = typeof flags.input === "string" ? parseJsonFlag(flags.input, "--input") : {};
+    const run = await client.respondToWorkflowRun(workflowId, runId, stepId, input);
+    if (flags.json === true) {
+      printJson2(run);
+    } else {
+      printWorkflowRun(run);
+    }
+    return;
+  }
+  if (subcommand === "help-app") {
+    const capabilityId = rest[0];
+    if (!capabilityId) throw new Error("Missing app skill. Example: openmates workflows help-app weather.forecast");
+    const capabilities = await client.listWorkflowCapabilities();
+    const capability = capabilities.find((item) => item.id === capabilityId || item.id === capabilityId.replace(":", "."));
+    if (!capability) throw new Error(`Workflow capability not found: ${capabilityId}`);
+    if (flags.json === true) {
+      printJson2(capability);
+    } else {
+      printWorkflowCapabilityHelp(capability);
+    }
+    return;
+  }
   throw new Error(`Unknown workflows command '${subcommand}'. Run 'openmates workflows --help'.`);
 }
 function printWorkflowList(workflows) {
@@ -49251,6 +51342,30 @@ function printWorkflowCapabilities(capabilities) {
     kv(capability.id, `${capability.title} \xB7 ${state}`, 24);
   }
 }
+function printWorkflowCapabilityHelp(capability) {
+  header(`${capability.title}
+`);
+  kv("ID", capability.id);
+  kv("Type", capability.type);
+  kv("Enabled", capability.enabled ? "yes" : "no");
+  if (capability.reason) kv("Reason", capability.reason);
+  const metadata = capability.metadata ?? {};
+  const workflow = metadata.workflow;
+  if (workflow) {
+    kv("Effect", String(workflow.effect ?? "unknown"));
+    kv("Execution", String(workflow.execution_mode ?? "unknown"));
+    kv("Approval", String(workflow.approval ?? "unknown"));
+    kv("Unattended", workflow.unattended === true ? "yes" : "no");
+  }
+  if (metadata.input_schema) {
+    console.log("\nInput schema:");
+    console.log(JSON.stringify(metadata.input_schema, null, 2));
+  }
+  if (workflow?.test_example_input) {
+    console.log("\nTest example:");
+    console.log(JSON.stringify(workflow.test_example_input, null, 2));
+  }
+}
 async function handleApps(client, subcommand, rest, flags) {
   const apiKey = resolveApiKey(flags) ?? void 0;
   if (!subcommand || subcommand === "help") {
@@ -49487,7 +51602,7 @@ Run with --help for full parameter details:
       }
     }
     try {
-      const inputData = buildSkillInput(flags, inlineTokens, schemaParams);
+      const inputData = app === "models3d" && skill === "generate" ? await buildModels3DGenerateInput(client, flags, inlineTokens, schemaParams) : buildSkillInput(flags, inlineTokens, schemaParams);
       const data = await client.runSkill({ app, skill, inputData, apiKey });
       if (flags.json === true) {
         printJson2(data);
@@ -49692,6 +51807,27 @@ function buildSkillInput(flags, inlineTokens, schemaParams) {
   }
   return {};
 }
+async function buildModels3DGenerateInput(client, flags, inlineTokens, schemaParams) {
+  const imagePath = typeof flags.image === "string" ? flags.image : void 0;
+  if (!imagePath) return buildSkillInput(flags, inlineTokens, schemaParams);
+  if (typeof flags.input === "string" || inlineTokens.length > 0) {
+    throw new Error("Use either a text prompt or --image <path> for 3D generation, not both.");
+  }
+  if (!client.hasSession()) {
+    throw new Error("Image-based 3D generation requires `openmates login` to upload the reference image.");
+  }
+  const processed = processFiles([imagePath], null);
+  if (processed.blocked.length > 0 || processed.errors.length > 0 || processed.embeds.length !== 1) {
+    const reason = [...processed.blocked, ...processed.errors].map((entry) => entry.error).join("; ") || "no image embed produced";
+    throw new Error(`Failed to prepare 3D reference image: ${reason}`);
+  }
+  const fileEmbed = processed.embeds[0];
+  if (!fileEmbed.requiresUpload || !fileEmbed.localPath || fileEmbed.embed.type !== "image") {
+    throw new Error("3D generation requires a supported image file.");
+  }
+  const uploadResult = await uploadFile(fileEmbed.localPath, client.getSession());
+  return { image_embed_refs: [uploadResult.embed_id] };
+}
 function getEffectiveRequiredParams(schemaParams) {
   const required = schemaParams.filter((p) => p.required);
   if (required.length > 0) return required;
@@ -50236,7 +52372,7 @@ async function confirmOrExit(question) {
     process.exit(0);
   }
 }
-async function promptLine(question) {
+async function promptLine2(question) {
   const rl = await import("readline");
   const iface = rl.createInterface({ input: process.stdin, output: process.stdout });
   const answer = await new Promise((resolve7) => iface.question(question, resolve7));
@@ -50245,7 +52381,7 @@ async function promptLine(question) {
 }
 async function promptSecret(question) {
   if (!process.stdin.isTTY) {
-    return promptLine(question);
+    return promptLine2(question);
   }
   return new Promise((resolve7) => {
     const stdin2 = process.stdin;
@@ -50332,8 +52468,8 @@ async function writeSecretFile(filePath, content, force = false) {
   return filePath;
 }
 async function generateProvisioningPassword() {
-  const { randomBytes: randomBytes3 } = await import("crypto");
-  return `OM-${randomBytes3(18).toString("base64url")}-aA2#`;
+  const { randomBytes: randomBytes4 } = await import("crypto");
+  return `OM-${randomBytes4(18).toString("base64url")}-aA2#`;
 }
 function decodeBase32(input) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
@@ -50368,7 +52504,7 @@ async function runSecuritySetup(client, flags, options = {}) {
     result.otpSecret = setup.secret ?? null;
     if (setup.otpauth_url) client.renderTotpQrCode(setup.otpauth_url);
     if (setup.secret) console.log(`Manual TOTP secret: ${setup.secret}`);
-    const code = typeof process.env.OPENMATES_CLI_SIGNUP_TOTP_CODE === "string" ? process.env.OPENMATES_CLI_SIGNUP_TOTP_CODE : options.autoGenerateTotp && setup.secret ? await generateTotpCode(setup.secret) : await promptLine("Enter current 2FA code: ");
+    const code = typeof process.env.OPENMATES_CLI_SIGNUP_TOTP_CODE === "string" ? process.env.OPENMATES_CLI_SIGNUP_TOTP_CODE : options.autoGenerateTotp && setup.secret ? await generateTotpCode(setup.secret) : await promptLine2("Enter current 2FA code: ");
     await client.verifyTotpSetup(code);
     const provider = typeof flags.provider === "string" ? flags.provider : "Authenticator app";
     await client.setTotpProvider(provider);
@@ -50408,8 +52544,8 @@ async function handleSignup(client, flags, options = {}) {
   if (flags.password !== void 0) {
     throw new Error("Passwords must be entered through hidden prompts, not command-line flags.");
   }
-  const email = typeof flags.email === "string" ? flags.email : await promptLine("Email: ");
-  const username = typeof flags.username === "string" ? flags.username : await promptLine("Username: ");
+  const email = typeof flags.email === "string" ? flags.email : await promptLine2("Email: ");
+  const username = typeof flags.username === "string" ? flags.username : await promptLine2("Username: ");
   const inviteCode = typeof flags["invite-code"] === "string" ? flags["invite-code"] : "";
   const language = typeof flags.language === "string" ? flags.language : "en";
   const password = process.env.OPENMATES_CLI_SIGNUP_PASSWORD ?? await promptSecret("Password: ");
@@ -50418,7 +52554,7 @@ async function handleSignup(client, flags, options = {}) {
     if (password !== confirmPassword) throw new Error("Passwords do not match.");
   }
   await client.requestSignupEmailCode({ email, inviteCode, language });
-  const emailCode = process.env.OPENMATES_CLI_SIGNUP_EMAIL_CODE ?? await promptLine("Email verification code: ");
+  const emailCode = process.env.OPENMATES_CLI_SIGNUP_EMAIL_CODE ?? await promptLine2("Email verification code: ");
   await client.verifySignupEmailCode({ email, username, inviteCode, code: emailCode, language });
   const signup = await client.setupPasswordAccount({ email, username, password, inviteCode, language });
   const security = await runSecuritySetup(client, flags, options);
@@ -50460,13 +52596,15 @@ async function handleE2E(client, subcommand, rest, flags) {
     throw new Error("E2E provisioning refuses production API URLs.");
   }
   if (flags.password !== void 0) throw new Error("Use generated passwords or OPENMATES_CLI_SIGNUP_PASSWORD, not --password.");
+  const inviteCode = process.env.OPENMATES_CLI_SIGNUP_INVITE_CODE;
+  if (!inviteCode) throw new Error("OPENMATES_CLI_SIGNUP_INVITE_CODE is required for E2E provisioning.");
   const slot = parseRequiredNumber(flags.slot, "--slot");
-  if (![15, 16, 17, 18, 19, 20].includes(slot)) {
-    throw new Error("Only reserved slots 15-20 are supported.");
+  if (![14, 15, 16, 17, 18, 19, 20].includes(slot)) {
+    throw new Error("Only reserved slots 14-20 are supported.");
   }
   const artifact = typeof flags.artifact === "string" ? flags.artifact : `test-results/credential-updates/slot-${slot}.env`;
   const domain = typeof flags.domain === "string" ? flags.domain : process.env.OPENMATES_CLI_E2E_EMAIL_DOMAIN;
-  const email = typeof flags.email === "string" ? flags.email : domain ? `cli-e2e-slot-${slot}-${Date.now()}@${domain}` : await promptLine("E2E account email: ");
+  const email = typeof flags.email === "string" ? flags.email : domain ? `cli-e2e-slot-${slot}-${Date.now()}@${domain}` : await promptLine2("E2E account email: ");
   const username = typeof flags.username === "string" ? flags.username : `cli_e2e_slot_${slot}_${Date.now()}`;
   const generatedPassword = process.env.OPENMATES_CLI_SIGNUP_PASSWORD ?? await generateProvisioningPassword();
   const originalSignupPassword = process.env.OPENMATES_CLI_SIGNUP_PASSWORD;
@@ -50477,6 +52615,7 @@ async function handleE2E(client, subcommand, rest, flags) {
       ...flags,
       email,
       username,
+      "invite-code": inviteCode,
       yes: true,
       json: false,
       "backup-codes-output": typeof flags["backup-codes-output"] === "string" ? flags["backup-codes-output"] : `${artifact}.backup-codes`,
@@ -50671,10 +52810,10 @@ async function handleSettings(client, subcommand, rest, flags) {
       await confirmOrExit("Delete this account and all associated data? [y/N] ");
     }
     await client.requestDeleteAccountEmailCode();
-    const emailCode = await promptLine("Enter email verification code: ");
+    const emailCode = await promptLine2("Enter email verification code: ");
     await client.verifyDeleteAccountEmailCode(emailCode);
     const authMethods = await client.getAuthMethodsStatus();
-    const totpCode = authMethods.has_2fa ? await promptLine("Enter 2FA code: ") : void 0;
+    const totpCode = authMethods.has_2fa ? await promptLine2("Enter 2FA code: ") : void 0;
     const result = await client.deleteAccountWithCliVerification(totpCode);
     if (flags.json === true) printJson2(result);
     else console.log("\x1B[32m\u2713\x1B[0m Account deletion requested and local CLI session cleared");
@@ -51393,11 +53532,11 @@ function ansiMateBlock(category, mateName) {
   const [r, g, b] = CATEGORY_ANSI_COLORS[category];
   return `\x1B[48;2;${r};${g};${b}m\x1B[97m ${label} \x1B[0m`;
 }
-function formatTimestamp(ts) {
+function formatTimestamp2(ts) {
   if (!ts) return "\u2014";
   const d = new Date(ts * 1e3);
-  const pad = (n) => String(n).padStart(2, "0");
-  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${pad(d.getHours())}:${pad(d.getMinutes())}`;
+  const pad2 = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())} ${pad2(d.getHours())}:${pad2(d.getMinutes())}`;
 }
 function printChatsTable(result) {
   const { chats, total, page, limit, hasMore } = result;
@@ -51416,7 +53555,7 @@ function printChatsTable(result) {
   );
   for (const chat of chats) {
     const block = ansiColorBlock(chat.category);
-    const time = formatTimestamp(chat.updatedAt);
+    const time = formatTimestamp2(chat.updatedAt);
     const title = chat.title ?? "(no title)";
     const idStr = chat.shortId;
     const sourceLabel = chat.source === "example" ? "  \x1B[33mEXAMPLE CHAT\x1B[0m" : "";
@@ -51977,7 +54116,7 @@ async function renderMessageText(text, embedRefIndex, client) {
 async function printChatConversation(client, chat, messages, followUpSuggestions, options = {}) {
   const block = ansiColorBlock(chat.category);
   const title = chat.title ?? "(no title)";
-  const ts = formatTimestamp(chat.updatedAt);
+  const ts = formatTimestamp2(chat.updatedAt);
   if (options.example) {
     process.stdout.write("\x1B[33mEXAMPLE CHAT\x1B[0m\n");
     process.stdout.write("\x1B[2mThis is a public example chat. Log in to create and sync your own private chats.\x1B[0m\n\n");
@@ -52007,7 +54146,7 @@ async function printChatConversation(client, chat, messages, followUpSuggestions
   const embedRefIndex = hasEmbedRefs ? await client.buildEmbedRefIndex(parentEmbedIds) : /* @__PURE__ */ new Map();
   for (let i = 0; i < messages.length; i++) {
     const msg = messages[i];
-    const msgTs = formatTimestamp(msg.createdAt);
+    const msgTs = formatTimestamp2(msg.createdAt);
     process.stdout.write(`${SEP}
 `);
     if (msg.role === "user") {
@@ -52068,7 +54207,7 @@ async function printChatConversation(client, chat, messages, followUpSuggestions
 }
 async function printChatConversationRaw(chat, messages, options = {}) {
   const title = chat.title ?? "(no title)";
-  const ts = formatTimestamp(chat.updatedAt);
+  const ts = formatTimestamp2(chat.updatedAt);
   if (options.example) {
     process.stdout.write("EXAMPLE CHAT\n");
     process.stdout.write("This is a public example chat. Log in to create and sync your own private chats.\n\n");
@@ -52083,7 +54222,7 @@ async function printChatConversationRaw(chat, messages, options = {}) {
     return;
   }
   for (const msg of messages) {
-    const msgTs = formatTimestamp(msg.createdAt);
+    const msgTs = formatTimestamp2(msg.createdAt);
     process.stdout.write(`${SEP}
 `);
     const role = msg.role === "user" ? "You" : msg.senderName ?? msg.role;
@@ -52586,18 +54725,18 @@ function printWhoAmI(user) {
   }
 }
 function printGenericObject(value, indent = 0) {
-  const pad = "  ".repeat(indent);
+  const pad2 = "  ".repeat(indent);
   if (value === null || value === void 0) {
-    console.log(`${pad}(empty)`);
+    console.log(`${pad2}(empty)`);
     return;
   }
   if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-    console.log(`${pad}${value}`);
+    console.log(`${pad2}${value}`);
     return;
   }
   if (Array.isArray(value)) {
     if (value.length === 0) {
-      console.log(`${pad}(empty list)`);
+      console.log(`${pad2}(empty list)`);
       return;
     }
     for (let i = 0; i < value.length; i++) {
@@ -52605,11 +54744,11 @@ function printGenericObject(value, indent = 0) {
       if (item && typeof item === "object") {
         printGenericObject(item, indent);
         if (i < value.length - 1) {
-          process.stdout.write(`${pad}\x1B[2m${"\u2500".repeat(40)}\x1B[0m
+          process.stdout.write(`${pad2}\x1B[2m${"\u2500".repeat(40)}\x1B[0m
 `);
         }
       } else {
-        console.log(`${pad}${String(item)}`);
+        console.log(`${pad2}${String(item)}`);
       }
     }
     return;
@@ -52629,34 +54768,34 @@ function printGenericObject(value, indent = 0) {
       if (Array.isArray(v)) {
         if (v.length === 0) {
           process.stdout.write(
-            `${pad}  \x1B[2m${k.padEnd(20)}\x1B[0m (none)
+            `${pad2}  \x1B[2m${k.padEnd(20)}\x1B[0m (none)
 `
           );
         } else if (v.length > 0 && typeof v[0] === "object") {
           process.stdout.write(
             `
-${pad}  \x1B[1m${k}\x1B[0m  \x1B[2m(${v.length})\x1B[0m
+${pad2}  \x1B[1m${k}\x1B[0m  \x1B[2m(${v.length})\x1B[0m
 `
           );
           printGenericObject(v, indent + 1);
         } else {
           process.stdout.write(
-            `${pad}  \x1B[2m${k.padEnd(20)}\x1B[0m ${v.join(", ")}
+            `${pad2}  \x1B[2m${k.padEnd(20)}\x1B[0m ${v.join(", ")}
 `
           );
         }
       } else if (typeof v === "object") {
-        process.stdout.write(`${pad}  \x1B[1m${k}\x1B[0m
+        process.stdout.write(`${pad2}  \x1B[1m${k}\x1B[0m
 `);
         printGenericObject(v, indent + 1);
       } else {
-        process.stdout.write(`${pad}  \x1B[2m${k.padEnd(20)}\x1B[0m ${v}
+        process.stdout.write(`${pad2}  \x1B[2m${k.padEnd(20)}\x1B[0m ${v}
 `);
       }
     }
     return;
   }
-  console.log(`${pad}${String(value)}`);
+  console.log(`${pad2}${String(value)}`);
 }
 function printBillingResponse(obj) {
   header("Billing\n");
@@ -52732,7 +54871,7 @@ function printMemoriesList(memories) {
   header(`Memories  (${memories.length})
 `);
   for (const mem of memories) {
-    const ts = formatTimestamp(mem.updated_at);
+    const ts = formatTimestamp2(mem.updated_at);
     process.stdout.write(
       `\x1B[1m${mem.app_id}/${mem.item_type}\x1B[0m  \x1B[2mv${mem.item_version}  ${ts}  id:${mem.id.slice(0, 8)}\x1B[0m
 `
@@ -52982,46 +55121,46 @@ async function handleMentions(client, subcommand, _rest, flags) {
   process.exit(1);
 }
 function serializeToYaml(data, indent = 0) {
-  const pad = "  ".repeat(indent);
+  const pad2 = "  ".repeat(indent);
   let out = "";
   for (const [key, val] of Object.entries(data)) {
     if (val === null || val === void 0) {
-      out += `${pad}${key}: null
+      out += `${pad2}${key}: null
 `;
     } else if (typeof val === "boolean" || typeof val === "number") {
-      out += `${pad}${key}: ${val}
+      out += `${pad2}${key}: ${val}
 `;
     } else if (typeof val === "string") {
       if (val.includes("\n")) {
-        out += `${pad}${key}: |
+        out += `${pad2}${key}: |
 `;
         for (const line of val.split("\n")) {
-          out += `${pad}  ${line}
+          out += `${pad2}  ${line}
 `;
         }
       } else {
         const needsQuote = val.includes(":") || val.includes("#") || val.startsWith("{") || val.startsWith("[") || val.startsWith("'") || val.startsWith('"') || val === "" || val === "true" || val === "false" || val === "null";
-        out += `${pad}${key}: ${needsQuote ? `"${val.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"` : val}
+        out += `${pad2}${key}: ${needsQuote ? `"${val.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"` : val}
 `;
       }
     } else if (Array.isArray(val)) {
-      out += `${pad}${key}:
+      out += `${pad2}${key}:
 `;
       for (const item of val) {
         if (typeof item === "object" && item !== null) {
-          out += `${pad}- 
+          out += `${pad2}- 
 `;
           out += serializeToYaml(
             item,
             indent + 2
           );
         } else {
-          out += `${pad}- ${item}
+          out += `${pad2}- ${item}
 `;
         }
       }
     } else if (typeof val === "object") {
-      out += `${pad}${key}:
+      out += `${pad2}${key}:
 `;
       out += serializeToYaml(val, indent + 1);
     }
@@ -53109,6 +55248,8 @@ Commands:
   openmates logout                           Log out and clear session
   openmates whoami [--json]                  Show account info
   openmates chats [--help]                   Chat commands (list, search, show, ...)
+  openmates tasks [--help]                   Task commands (list, create, board, ...)
+  openmates drafts [--help]                  Encrypted draft lifecycle commands
   openmates apps [--help]                    App skill commands (list, run, ...)
   openmates workflows [--help]               Server-side workflow commands
   openmates mentions [--help]                List available @mentions
@@ -53247,7 +55388,7 @@ Creates local ignored credential artifacts for reserved E2E auth accounts. The
 command refuses production API URLs and does not upload GitHub secrets.
 
 Options:
-  --slot <15-20>                     Reserved auth-account slot
+  --slot <14-20>                     Reserved auth-account slot
   --artifact <path>                  Output .env artifact path
   --email <email>                    Test email; prompted/generated when omitted
   --domain <mail-domain>             Generate email at this domain
@@ -53361,6 +55502,46 @@ Examples:
   openmates chats share last --expires 604800
   openmates chats share d262cb68 --password mypass`);
 }
+function printTasksHelp() {
+  console.log(`Tasks commands:
+  openmates tasks list [--status <status>] [--chat <id>] [--project <id>] [--json]
+  openmates tasks board [--chat <id>] [--project <id>] [--json]
+  openmates tasks show <task-id|short-id> [--json]
+  openmates tasks create --title <title> [--description <text>] [--assign user|ai] [--chat <id>] [--project <id>] [--status <status>] [--due <date>] [--json]
+  openmates tasks edit <task-id|short-id> [--title <title>] [--description <text>] [--assign user|ai] [--status <status>] [--json]
+  openmates tasks delete <task-id|short-id> --confirm [--json]
+  openmates tasks start <task-id|short-id> [--json]
+  openmates tasks status [<task-id|short-id>] [--json]
+  openmates tasks block <task-id|short-id> --reason <code> [--json]
+  openmates tasks unblock <task-id|short-id> [--json]
+  openmates tasks skip <task-id|short-id> [--json]
+  openmates tasks done <task-id|short-id> [--json]
+  openmates tasks reorder <task-id|short-id> [--before <task-id>] [--after <task-id>] [--position <n>] [--status <status>] [--json]
+
+Chat-scoped aliases:
+  openmates chats <chat-id> tasks list
+  openmates chats <chat-id> tasks board
+  openmates chats <chat-id> tasks create --title <title>
+
+Statuses:
+  backlog, todo, in_progress, blocked, done
+
+Notes:
+  Task IDs accept full task_id or human short IDs such as OM-6.
+  Normal output decrypts task title and description locally; use --json for machine-readable plaintext fields.`);
+}
+function printDraftsHelp() {
+  console.log(`Draft commands:
+  openmates drafts create <text> [--chat <uuid>] [--preview <text>] [--json]
+  openmates drafts update <chat-id> <text> [--preview <text>] [--json]
+  openmates drafts list [--refresh] [--json]
+  openmates drafts get <chat-id> [--refresh] [--json]
+  openmates drafts clear <chat-id> [--json]
+  openmates drafts sync [--json]
+
+Draft plaintext is encrypted locally with the account master key. Only Format-D
+ciphertext and version metadata are sent to the server or written to CLI cache.`);
+}
 function printAppsHelp() {
   console.log(`Apps commands:
   openmates apps list [--json]
@@ -53369,6 +55550,7 @@ function printAppsHelp() {
   openmates apps skill-info <app-id> <skill-id> [--json]
   openmates apps <app-id> <skill-id> "<query>" [--json]
   openmates apps <app-id> <skill-id> --input '<json>' [--json]
+  openmates apps models3d generate --image ./reference.png [--json]
   openmates apps code run --language python --code 'print("Hello")'
   openmates apps code run --entry main.py --file main.py [--file requirements.txt]
   openmates apps code run --entry main.py --dir ./project [--exclude node_modules]
@@ -53384,6 +55566,7 @@ Examples:
   openmates apps web search "latest AI news"
   openmates apps news search "climate change"
   openmates apps ai ask "Summarise this: ..."
+  openmates apps models3d generate --image ./chair.png
   openmates apps code run --language python --filename hello.py --code 'print("Hello from CLI")'
   openmates apps travel search_connections --input '{"requests":[{"legs":[{"origin":"BER","destination":"LHR","date":"2026-04-15"}]}]}'
   openmates apps travel booking-link --token "<booking_token from search result>"
@@ -53393,6 +55576,9 @@ function printWorkflowsHelp() {
   console.log(`Workflows commands:
   openmates workflows list [--json]
   openmates workflows capabilities [--json]
+  openmates workflows validate --file workflow.yml [--json]
+  openmates workflows create --file workflow.yml [--json]
+  openmates workflows update <workflow-id> --file workflow.yml [--json]
   openmates workflows create --title <title> --graph '<json>' [--enabled] [--run-content-retention last_5|none] [--json]
   openmates workflows input <text> [--workflow-id <id>] [--project-id <id>] [--json]
   openmates workflows input-show <session-id> [--json]
@@ -53403,9 +55589,13 @@ function printWorkflowsHelp() {
   openmates workflows show <workflow-id> [--json]
   openmates workflows enable <workflow-id> [--json]
   openmates workflows disable <workflow-id> [--json]
-  openmates workflows run <workflow-id> [--mode manual|test] [--input '<json>'] [--json]
+  openmates workflows run <workflow-id> --idempotency-key <stable-key> [--mode manual|test] [--input '<json>'] [--json]
   openmates workflows runs <workflow-id> [--json]
   openmates workflows run-show <workflow-id> <run-id> [--json]
+  openmates workflows run-cancel <workflow-id> <run-id> [--json]
+  openmates workflows step-test <workflow-id> <step-id> [--input '<json>'] [--yes] [--json]
+  openmates workflows respond <workflow-id> <run-id> <step-id> --input '<json>' [--json]
+  openmates workflows help-app <app.skill> [--json]
   openmates workflows delete <workflow-id> --yes [--json]
 
 Workflows run on the OpenMates server, not in this terminal process. The CLI
@@ -53415,6 +55605,7 @@ and Apple clients.
 Examples:
   openmates workflows list
   openmates workflows capabilities --json
+  openmates workflows help-app weather.forecast
   openmates workflows input "alert me if it rains tomorrow"
   openmates workflows run wf_123 --mode test --json`);
 }
@@ -53666,9 +55857,12 @@ if (isCliEntrypoint()) {
 }
 
 export {
+  deriveChatCompletionRecoveryKeypair,
+  openChatCompletionRecoveryEnvelope,
   unwrapApiKeyMasterKey,
   decryptWithAesGcmCombined,
   decryptBytesWithAesGcm,
+  encryptBytesWithAesGcm,
   encryptWithAesGcmCombined,
   hashItemKey,
   generateChatShareBlob,
@@ -53681,6 +55875,7 @@ export {
   INTEREST_TAG_IDS,
   normalizeInterestTagIds,
   MEMORY_TYPE_REGISTRY,
+  reconcileAuthoritativeChats,
   MATE_NAMES,
   deriveAppUrl,
   OpenMatesClient,