orkestrator 2.29.0-beta → 2.30.0-beta

package/dist/client.js

@@ -6557,6 +6557,70 @@ var PUBLIC_ACTIONS = {
     milestone: "D",
     summary: "Read one page of a session's turns, each with the backend's change projection."
   },
+  "attention.list": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "What needs attention: pending questions and approvals, the caller's runs that settled and environments whose setup finished, since a cursor."
+  },
+  "ticket.list": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "List a project's Kanban tickets."
+  },
+  "ticket.get": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "Read one Kanban ticket with its description, criteria and latest comments."
+  },
+  "ticket.create": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Create a Kanban ticket in a project."
+  },
+  "ticket.update": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Change a Kanban ticket's title, description, criteria or column."
+  },
+  "ticket.comment": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Append a comment to a Kanban ticket."
+  },
+  "mail.mailboxes": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "List agent mailboxes a message can be sent to."
+  },
+  "mail.send": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Place a message in one tab's inbox; external messages are never injected into a turn."
+  },
   "run.get": {
     version: 1,
     mutation: false,
@@ -6752,6 +6816,8 @@ var PUBLIC_API_LIMITS = Object.freeze({
   transcriptTextMaxChars: 20000,
   interactionsMax: 32,
   historyMaxEntries: 100,
+  attentionDefaultItems: 20,
+  attentionMaxItems: 50,
   responseMaxBytes: 8 * 1024 * 1024,
   requestMaxBytes: 1024 * 1024,
   execArgvMaxItems: 256,
@@ -7444,7 +7510,7 @@ import path4 from "path";
 // ../../apps/backend/package.json
 var package_default = {
   name: "@orkestrator/backend",
-  version: "2.29.0-beta",
+  version: "2.30.0-beta",
   private: true,
   type: "module",
   exports: {
@@ -7459,7 +7525,7 @@ var package_default = {
     "start:web-public": "bun dist/main.js --tailscale-serve --allowed-origins https://orkestrator.dev,https://www.orkestrator.dev",
     test: "bun test --preload ../../tests/setup-node.ts src tests --parallel",
     "test:workspace": "bun test --preload ../../tests/setup-node.ts src tests --only-failures ${ORKESTRATOR_TEST_TIMINGS_DIR:+--timings=$ORKESTRATOR_TEST_TIMINGS_DIR/backend.json --update-timings} $ORKESTRATOR_BACKEND_TEST_IGNORE --parallel=${ORKESTRATOR_BACKEND_TEST_WORKERS:-${ORKESTRATOR_TEST_WORKERS:-2}}",
-    typecheck: "bunx tsc --noEmit -p tsconfig.json && bunx tsc --noEmit -p tsconfig.test.json"
+    typecheck: "bun check -p tsconfig.json && bun check -p tsconfig.test.json"
   },
   dependencies: {
     "@modelcontextprotocol/node": "2.1.1",
@@ -7998,269 +8064,37 @@ function runFixProcess(argv, version) {
   });
 }
 
-// ../protocol/src/public-api-resources.ts
-var PUBLIC_CHANGE_SCOPES = Object.freeze(["environment"]);
-var AGENT_PLATFORM_KEYS = ["claude", "codex", "cursor", "grok", "opencode", "pi"];
-function agentSettingDescriptors(scope) {
-  const application = "next-session";
-  return [
-    {
-      key: "agent.defaultAgent",
-      scope,
-      type: "agent",
-      inherits: true,
-      application,
-      description: "Agent platform used when a launch does not name one."
-    },
-    ...AGENT_PLATFORM_KEYS.flatMap((platform) => [
-      {
-        key: `agent.${platform}.mode`,
-        scope,
-        type: "agent-mode",
-        inherits: true,
-        application,
-        description: `Launch mode (native or terminal) for ${platform}.`
-      },
-      {
-        key: `agent.${platform}.model`,
-        scope,
-        type: "string",
-        inherits: true,
-        application,
-        description: `Default model for new ${platform} sessions.`
-      },
-      {
-        key: `agent.${platform}.reasoningEffort`,
-        scope,
-        type: "string",
-        inherits: true,
-        application,
-        description: `Default reasoning level for new ${platform} sessions.`
-      },
-      {
-        key: `agent.${platform}.fastMode`,
-        scope,
-        type: "boolean",
-        inherits: true,
-        application,
-        description: `Default speed for new ${platform} sessions (true is Fast).`
-      }
-    ])
-  ];
-}
-var PUBLIC_PROJECT_SETTINGS = Object.freeze([
-  {
-    key: "defaultBranch",
-    scope: "project",
-    type: "string",
-    inherits: false,
-    application: "next-environment",
-    description: "Branch new environments are created from."
-  },
-  {
-    key: "prBaseBranch",
-    scope: "project",
-    type: "string",
-    inherits: false,
-    application: "applied",
-    description: "Base branch for pull requests and diff baselines."
-  },
-  {
-    key: "defaultPortMappings",
-    scope: "project",
-    type: "port-mappings",
-    inherits: false,
-    environmentTypes: ["container"],
-    application: "next-environment",
-    description: "Port mappings copied into new container environments."
-  },
-  {
-    key: "filesToCopy",
-    scope: "project",
-    type: "string-list",
-    inherits: false,
-    application: "next-environment",
-    description: "Untracked files copied into new environments."
-  },
-  {
-    key: "entryPort",
-    scope: "project",
-    type: "port",
-    inherits: false,
-    application: "next-environment",
-    description: "Default preview entry port for new environments."
-  },
-  ...agentSettingDescriptors("project")
-]);
-var PUBLIC_ENVIRONMENT_SETTINGS = Object.freeze([
-  {
-    key: "portMappings",
-    scope: "environment",
-    type: "port-mappings",
-    inherits: false,
-    environmentTypes: ["container"],
-    application: "next-start",
-    description: "Container port mappings; a running container adopts them on recreate."
-  },
-  {
-    key: "allowedDomains",
-    scope: "environment",
-    type: "domain-list",
-    inherits: true,
-    environmentTypes: ["container"],
-    application: "next-start",
-    description: "Restricted-network allowlist; unset inherits the global list. A running container whose image supports it applies the change immediately (reported as applied)."
-  },
-  ...agentSettingDescriptors("environment")
-]);
-
-// src/client/format.ts
-function table(headers, rows) {
-  if (rows.length === 0)
-    return ["(none)"];
-  const widths = headers.map((header, index) => Math.min(60, Math.max(header.length, ...rows.map((row) => (row[index] ?? "").length))));
-  const line = (cells) => cells.map((cell, index) => {
-    const text = cell.length > widths[index] ? `${cell.slice(0, widths[index] - 1)}\u2026` : cell;
-    return text.padEnd(widths[index]);
-  }).join("  ").trimEnd();
-  return [line(headers), ...rows.map(line)];
+// src/client/wait.ts
+class ObservationStopped extends Error {
+  reason;
+  signalName;
+  constructor(reason, signalName) {
+    super(reason === "deadline" ? "Observation deadline passed" : "Observation interrupted");
+    this.reason = reason;
+    this.signalName = signalName;
+  }
 }
-function keyValues(entries) {
-  const width = Math.max(...entries.map(([key]) => key.length));
-  return entries.filter(([, value]) => value !== undefined).map(([key, value]) => {
-    const text = value === null ? "-" : typeof value === "object" ? JSON.stringify(value) : String(value);
-    return `${key.padEnd(width)}  ${text}`;
+function defaultSleep(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal?.aborted) {
+      resolve();
+      return;
+    }
+    const timer = setTimeout(done, ms);
+    function done() {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", done);
+      resolve();
+    }
+    signal?.addEventListener("abort", done, { once: true });
   });
 }
-function projectLines(project) {
-  return keyValues([
-    ["id", project.id],
-    ["name", project.name],
-    ["remote", project.gitUrl],
-    ["path", project.localPath],
-    ["folder", project.folder],
-    ["environments", project.environmentCount],
-    ["revision", project.revision]
-  ]);
-}
-function projectRows(projects) {
-  return table(["ID", "NAME", "ENVS", "PATH"], projects.map((project) => [
-    project.id,
-    project.name,
-    String(project.environmentCount),
-    project.localPath ?? "-"
-  ]));
-}
-function environmentLines(environment) {
-  return keyValues([
-    ["id", environment.id],
-    ["project", environment.projectId],
-    ["name", environment.name],
-    ["branch", environment.branch],
-    ["type", environment.environmentType],
-    ["status", environment.status],
-    ["ready", environment.ready],
-    ["setup", `${environment.setup.phase}${environment.setup.overridden ? " (overridden)" : ""}`],
-    ["activity", environment.activity.state],
-    ["lifecycle error", environment.lifecycle.error],
-    ["workspace", environment.workspacePath],
-    ["base", environment.base.commit ?? environment.base.branch],
-    ["startup session", environment.startupSession?.sessionId]
-  ]);
+function signalName(signal) {
+  return signal?.reason === "SIGTERM" ? "SIGTERM" : "SIGINT";
 }
-function environmentRows(environments) {
-  return table(["ID", "NAME", "TYPE", "STATUS", "READY"], environments.map((environment) => [
-    environment.id,
-    environment.name,
-    environment.environmentType,
-    environment.status,
-    environment.ready ? "yes" : "no"
-  ]));
-}
-function sessionRows(sessions) {
-  return table(["SESSION", "AGENT", "TAB", "ACTIVITY", "TITLE"], sessions.map((session) => [
-    session.id,
-    session.agent,
-    session.tabId,
-    session.activity,
-    session.title ?? ""
-  ]));
-}
-function sessionLines(session) {
-  return keyValues([
-    ["id", session.id],
-    ["environment", session.environmentId],
-    ["tab", session.tabId],
-    ["agent", session.agent],
-    ["title", session.title],
-    ["activity", session.activity],
-    ["latest request", session.latestRequestId],
-    ["pending interactions", session.pendingInteractionCount],
-    ["recoverable dispatch", session.recoverableDispatch]
-  ]);
-}
-function receiptLines(receipt) {
-  return keyValues([
-    ["operation", receipt.operationId],
-    ["action", receipt.action],
-    ["state", receipt.state],
-    ["stage", receipt.stage],
-    ["request", `${receipt.requestId} (${receipt.namespace})`],
-    ["replayed", receipt.replayed],
-    ["resources", receipt.resources],
-    ["dispatch", receipt.dispatch?.state],
-    ["execution", receipt.execution?.state],
-    ["evidence", receipt.execution?.evidence],
-    ["exit code", receipt.execution?.exitCode],
-    ["error", receipt.error ? `${receipt.error.code}: ${receipt.error.message}` : undefined],
-    ["updated", receipt.updatedAt],
-    ["retained until", receipt.retainedUntil]
-  ]);
-}
-function settingsLines(snapshot) {
-  return [
-    `revision ${snapshot.revision}`,
-    ...table(["KEY", "VALUE", "EFFECTIVE", "SOURCE", "APPLIES"], snapshot.settings.map((setting) => [
-      setting.key,
-      setting.value === null || setting.value === undefined ? "-" : JSON.stringify(setting.value),
-      setting.effective === null || setting.effective === undefined ? "-" : JSON.stringify(setting.effective),
-      setting.source,
-      setting.application
-    ]))
-  ];
-}
-
-// src/client/wait.ts
-class ObservationStopped extends Error {
-  reason;
-  signalName;
-  constructor(reason, signalName) {
-    super(reason === "deadline" ? "Observation deadline passed" : "Observation interrupted");
-    this.reason = reason;
-    this.signalName = signalName;
-  }
-}
-function defaultSleep(ms, signal) {
-  return new Promise((resolve) => {
-    if (signal?.aborted) {
-      resolve();
-      return;
-    }
-    const timer = setTimeout(done, ms);
-    function done() {
-      clearTimeout(timer);
-      signal?.removeEventListener("abort", done);
-      resolve();
-    }
-    signal?.addEventListener("abort", done, { once: true });
-  });
-}
-function signalName(signal) {
-  return signal?.reason === "SIGTERM" ? "SIGTERM" : "SIGINT";
-}
-function throwIfInterrupted(signal) {
-  if (signal?.aborted)
-    throw new CliError("observation-interrupted", "Interrupted");
+function throwIfInterrupted(signal) {
+  if (signal?.aborted)
+    throw new CliError("observation-interrupted", "Interrupted");
 }
 async function observe(check, options2) {
   if (options2.timeoutMs > PUBLIC_API_LIMITS.waitMaxMs) {
@@ -8284,6 +8118,61 @@ async function observe(check, options2) {
   }
 }
 
+// ../protocol/src/public-api-wait.ts
+function isTerminalPublicReceipt(receipt) {
+  return !["admitted", "running", "unknown"].includes(receipt.state);
+}
+function classifyReceiptForWait(receipt, options2 = {}) {
+  if (isTerminalPublicReceipt(receipt)) {
+    return { kind: "terminal", succeeded: receipt.state === "succeeded" };
+  }
+  const execution = receipt.execution;
+  if (execution?.state === "waiting-for-input" && !options2.continueOnInteraction) {
+    return {
+      kind: "stopped",
+      code: "interaction-required",
+      message: "The run is waiting for an answer to a pending interaction",
+      interactions: execution.interactions ?? []
+    };
+  }
+  if (receipt.state === "unknown" && receipt.dispatch?.state === "unknown") {
+    return {
+      kind: "stopped",
+      code: "dispatch-unknown",
+      message: "The provider may or may not have received the prompt; retry it under the same key or discard it",
+      retryable: true
+    };
+  }
+  if (receipt.state === "unknown") {
+    return {
+      kind: "stopped",
+      code: "run-unknown",
+      message: receipt.error?.message ?? "The outcome of this run is not known"
+    };
+  }
+  if (execution?.state === "unsupported") {
+    return {
+      kind: "stopped",
+      code: "capability-unavailable",
+      message: execution.reason ?? "Completion of this run cannot be observed for its provider"
+    };
+  }
+  return { kind: "pending" };
+}
+function terminalReceiptErrorCode(receipt) {
+  if (receipt.state === "succeeded")
+    return null;
+  if (receipt.state === "partial")
+    return "partial-failure";
+  if (receipt.state === "cancelled")
+    return "run-cancelled";
+  if (receipt.state === "interrupted")
+    return "run-interrupted";
+  if (receipt.state === "unknown")
+    return "run-unknown";
+  return receipt.error?.code ?? "operation-failed";
+}
+
 // src/client/commands/common.ts
 var REQUEST_ID_OPTION = {
   name: "request-id",
@@ -8394,7 +8283,7 @@ async function readOperation(session, operationId, timeoutMs) {
   return receipt;
 }
 function isTerminalReceipt(receipt) {
-  return !["admitted", "running", "unknown"].includes(receipt.state);
+  return isTerminalPublicReceipt(receipt);
 }
 function stoppedError(error, action, receipt, what) {
   if (error.reason === "signal") {
@@ -8410,12 +8299,15 @@ function stoppedError(error, action, receipt, what) {
   });
 }
 function receiptFailure(receipt) {
-  if (receipt.state === "succeeded")
+  const code = terminalReceiptErrorCode(receipt);
+  if (!code)
     return;
   const message = receipt.error?.message ?? `Operation ended ${receipt.state}`;
-  const code = receipt.state === "partial" ? "partial-failure" : receipt.state === "cancelled" ? "run-cancelled" : receipt.state === "interrupted" ? "run-interrupted" : receipt.state === "unknown" ? "run-unknown" : receipt.error?.code ?? "operation-failed";
   return new CliError(code, message, { receipt, action: receipt.action });
 }
+var CLI_STOP_MESSAGES = {
+  "dispatch-unknown": "The provider may or may not have received the prompt; use `run retry` (same key) or `run discard`"
+};
 async function waitForOperation(context, session, initial, timeoutMs, options2 = {}) {
   let latest = initial;
   const deadline = Date.now() + timeoutMs;
@@ -8432,94 +8324,423 @@ async function waitForOperation(context, session, initial, timeoutMs, options2 =
           throw new ObservationStopped("deadline");
         throw error;
       }
-      if (isTerminalReceipt(latest))
+      const verdict = classifyReceiptForWait(latest, options2);
+      if (verdict.kind === "terminal")
         return { done: true, value: latest };
-      const execution = latest.execution;
-      if (execution?.state === "waiting-for-input" && !options2.continueOnInteraction) {
-        throw new CliError("interaction-required", "The run is waiting for an answer to a pending interaction", {
+      if (verdict.kind === "stopped") {
+        throw new CliError(verdict.code, CLI_STOP_MESSAGES[verdict.code] ?? verdict.message, {
           receipt: latest,
           action: latest.action,
-          details: { interactions: execution.interactions ?? [] }
+          ...verdict.retryable ? { retryable: true } : {},
+          ...verdict.interactions ? { details: { interactions: verdict.interactions } } : {}
         });
       }
-      if (latest.state === "unknown" && latest.dispatch?.state === "unknown") {
-        throw new CliError("dispatch-unknown", "The provider may or may not have received the prompt; use `run retry` (same key) or `run discard`", { receipt: latest, action: latest.action, retryable: true });
+      return { done: false };
+    }, { timeoutMs, signal: context.signal });
+  } catch (error) {
+    if (error instanceof ObservationStopped) {
+      throw stoppedError(error, latest.action, latest, "the operation");
+    }
+    throw error;
+  }
+}
+async function waitForEnvironment(context, session, environmentId, condition, receipt, timeoutMs) {
+  let latestReceipt = receipt;
+  const conditionMet = (environment) => {
+    if (condition === "deleted")
+      return environment === null;
+    if (!environment)
+      return false;
+    if (condition === "running")
+      return environment.status === "running";
+    if (condition === "stopped")
+      return environment.status === "stopped";
+    return environment.ready;
+  };
+  try {
+    return await observe(async () => {
+      if (latestReceipt && !isTerminalReceipt(latestReceipt)) {
+        latestReceipt = await readOperation(session, latestReceipt.operationId);
+      }
+      if (latestReceipt && isTerminalReceipt(latestReceipt)) {
+        const failure = receiptFailure(latestReceipt);
+        if (failure)
+          throw failure;
       }
-      if (latest.state === "unknown") {
-        throw new CliError("run-unknown", latest.error?.message ?? "The outcome of this run is not known", {
-          receipt: latest,
-          action: latest.action
+      let environment;
+      try {
+        environment = await session.read("environment.get", {
+          environmentId
         });
+      } catch (error) {
+        if (error instanceof CliError && error.code === "not-found")
+          environment = null;
+        else
+          throw error;
       }
-      if (execution?.state === "unsupported") {
-        throw new CliError("capability-unavailable", execution.reason ?? "Completion of this run cannot be observed for its provider", { receipt: latest, action: latest.action });
+      if (condition !== "deleted" && !environment) {
+        throw new CliError("not-found", "The environment no longer exists", latestReceipt ? { receipt: latestReceipt } : {});
+      }
+      if (environment && (condition === "ready" || condition === "running")) {
+        if (environment.setup.phase === "failed" || environment.status === "error") {
+          throw new CliError("setup-failed", environment.lifecycle.error ?? "Environment setup failed", { ...latestReceipt ? { receipt: latestReceipt } : {}, details: { environmentId } });
+        }
+      }
+      const operationSettled = !latestReceipt || isTerminalReceipt(latestReceipt) || condition === "running" && latestReceipt.stage === "setup";
+      if (operationSettled && conditionMet(environment)) {
+        return {
+          done: true,
+          value: { environment, ...latestReceipt ? { receipt: latestReceipt } : {} }
+        };
       }
       return { done: false };
     }, { timeoutMs, signal: context.signal });
   } catch (error) {
     if (error instanceof ObservationStopped) {
-      throw stoppedError(error, latest.action, latest, "the operation");
+      throw stoppedError(error, latestReceipt?.action ?? "environment.get", latestReceipt, `the environment (${condition})`);
     }
     throw error;
   }
 }
-async function waitForEnvironment(context, session, environmentId, condition, receipt, timeoutMs) {
-  let latestReceipt = receipt;
-  const conditionMet = (environment) => {
-    if (condition === "deleted")
-      return environment === null;
-    if (!environment)
-      return false;
-    if (condition === "running")
-      return environment.status === "running";
-    if (condition === "stopped")
-      return environment.status === "stopped";
-    return environment.ready;
-  };
-  try {
-    return await observe(async () => {
-      if (latestReceipt && !isTerminalReceipt(latestReceipt)) {
-        latestReceipt = await readOperation(session, latestReceipt.operationId);
-      }
-      if (latestReceipt && isTerminalReceipt(latestReceipt)) {
-        const failure = receiptFailure(latestReceipt);
-        if (failure)
-          throw failure;
-      }
-      let environment;
-      try {
-        environment = await session.read("environment.get", {
-          environmentId
-        });
-      } catch (error) {
-        if (error instanceof CliError && error.code === "not-found")
-          environment = null;
-        else
-          throw error;
-      }
-      if (condition !== "deleted" && !environment) {
-        throw new CliError("not-found", "The environment no longer exists", latestReceipt ? { receipt: latestReceipt } : {});
-      }
-      if (environment && (condition === "ready" || condition === "running")) {
-        if (environment.setup.phase === "failed" || environment.status === "error") {
-          throw new CliError("setup-failed", environment.lifecycle.error ?? "Environment setup failed", { ...latestReceipt ? { receipt: latestReceipt } : {}, details: { environmentId } });
-        }
-      }
-      const operationSettled = !latestReceipt || isTerminalReceipt(latestReceipt) || condition === "running" && latestReceipt.stage === "setup";
-      if (operationSettled && conditionMet(environment)) {
-        return {
-          done: true,
-          value: { environment, ...latestReceipt ? { receipt: latestReceipt } : {} }
-        };
-      }
-      return { done: false };
-    }, { timeoutMs, signal: context.signal });
-  } catch (error) {
-    if (error instanceof ObservationStopped) {
-      throw stoppedError(error, latestReceipt?.action ?? "environment.get", latestReceipt, `the environment (${condition})`);
-    }
-    throw error;
-  }
+
+// src/client/commands/attention.ts
+function attentionLine(item) {
+  if (item.kind === "interaction") {
+    return `${item.blocking ? "waiting" : "pending"}  ${item.agent} in ${item.environmentName}: ${item.title}  (${item.sessionId} ${item.interactionId} rev ${item.revision})`;
+  }
+  if (item.kind === "setup") {
+    return `setup ${item.phase}  ${item.environmentName}  (${item.environmentId})`;
+  }
+  return `run ${item.state}  ${item.action}${item.errorCode ? ` ${item.errorCode}` : ""}  (${item.operationId})`;
+}
+function itemKey(item) {
+  if (item.kind === "interaction")
+    return `interaction:${item.interactionId}:${item.revision}`;
+  if (item.kind === "setup")
+    return `setup:${item.environmentId}:${item.at}`;
+  return `run:${item.operationId}:${item.state}`;
+}
+var attentionCommands = [
+  {
+    path: ["attention"],
+    action: "attention.list",
+    summary: "What needs attention: questions, approvals, settled runs, finished setups.",
+    description: "Lists pending questions and approvals (always), and the runs this client started and setups that finished since --cursor (default: the last hour). --follow --jsonl polls and prints each new item once, which is how a voice runtime or notifier can hear about work without asking; it stops at --timeout or Ctrl+C and never changes anything.",
+    positionals: [],
+    options: [
+      {
+        name: "cursor",
+        kind: "string",
+        valueName: "CURSOR",
+        description: "cursor from a previous read: only what changed since."
+      },
+      { name: "limit", kind: "integer", valueName: "N", description: "Most items (max 50)." },
+      {
+        name: "follow",
+        kind: "boolean",
+        description: "Keep polling and print new items (use --jsonl for machines)."
+      },
+      TIMEOUT_OPTION
+    ],
+    jsonl: true,
+    async run(context, parsed) {
+      const session = await context.session();
+      const input = {};
+      if (parsed.options.cursor !== undefined)
+        input.cursor = parsed.options.cursor;
+      if (parsed.options.limit !== undefined)
+        input.limit = parsed.options.limit;
+      if (parsed.options.follow !== true) {
+        if (context.global.output === "jsonl") {
+          throw new CliError("invalid-input", "--jsonl needs --follow");
+        }
+        const page = await session.read("attention.list", input);
+        return {
+          action: "attention.list",
+          result: page,
+          connection: session.identity,
+          human: [
+            ...page.items.length ? page.items.map(attentionLine) : ["Nothing needs attention."],
+            ...page.more ? [`and ${page.more} more (raise --limit)`] : [],
+            `cursor: ${page.cursor}`
+          ]
+        };
+      }
+      const seen = new Set;
+      let cursor = input.cursor;
+      let emitted = 0;
+      try {
+        await observe(async () => {
+          const page = await session.read("attention.list", {
+            ...input,
+            ...cursor ? { cursor } : {}
+          });
+          cursor = page.cursor;
+          for (const item of page.items) {
+            const key = itemKey(item);
+            if (seen.has(key))
+              continue;
+            seen.add(key);
+            emitted += 1;
+            if (context.global.output === "jsonl") {
+              context.io.stdout(`${JSON.stringify({ type: "attention", item })}
+`);
+            } else if (context.global.output === "human") {
+              context.io.stdout(`${attentionLine(item)}
+`);
+            }
+          }
+          if (seen.size > 1e4)
+            seen.clear();
+          return { done: false };
+        }, {
+          timeoutMs: parsed.options.timeout ?? DEFAULT_WAIT_MS,
+          signal: context.signal
+        });
+      } catch (error) {
+        if (!(error instanceof ObservationStopped))
+          throw error;
+      }
+      return {
+        action: "attention.list",
+        result: { followed: true, emitted, cursor: cursor ?? null },
+        connection: session.identity,
+        human: []
+      };
+    }
+  }
+];
+
+// ../protocol/src/public-api-resources.ts
+var PUBLIC_CHANGE_SCOPES = Object.freeze(["environment"]);
+var AGENT_PLATFORM_KEYS = ["claude", "codex", "cursor", "grok", "opencode", "pi"];
+function agentSettingDescriptors(scope) {
+  const application = "next-session";
+  return [
+    {
+      key: "agent.defaultAgent",
+      scope,
+      type: "agent",
+      inherits: true,
+      application,
+      description: "Agent platform used when a launch does not name one."
+    },
+    ...AGENT_PLATFORM_KEYS.flatMap((platform) => [
+      {
+        key: `agent.${platform}.mode`,
+        scope,
+        type: "agent-mode",
+        inherits: true,
+        application,
+        description: `Launch mode (native or terminal) for ${platform}.`
+      },
+      {
+        key: `agent.${platform}.model`,
+        scope,
+        type: "string",
+        inherits: true,
+        application,
+        description: `Default model for new ${platform} sessions.`
+      },
+      {
+        key: `agent.${platform}.reasoningEffort`,
+        scope,
+        type: "string",
+        inherits: true,
+        application,
+        description: `Default reasoning level for new ${platform} sessions.`
+      },
+      {
+        key: `agent.${platform}.fastMode`,
+        scope,
+        type: "boolean",
+        inherits: true,
+        application,
+        description: `Default speed for new ${platform} sessions (true is Fast).`
+      }
+    ])
+  ];
+}
+var PUBLIC_PROJECT_SETTINGS = Object.freeze([
+  {
+    key: "defaultBranch",
+    scope: "project",
+    type: "string",
+    inherits: false,
+    application: "next-environment",
+    description: "Branch new environments are created from."
+  },
+  {
+    key: "prBaseBranch",
+    scope: "project",
+    type: "string",
+    inherits: false,
+    application: "applied",
+    description: "Base branch for pull requests and diff baselines."
+  },
+  {
+    key: "defaultPortMappings",
+    scope: "project",
+    type: "port-mappings",
+    inherits: false,
+    environmentTypes: ["container"],
+    application: "next-environment",
+    description: "Port mappings copied into new container environments."
+  },
+  {
+    key: "filesToCopy",
+    scope: "project",
+    type: "string-list",
+    inherits: false,
+    application: "next-environment",
+    description: "Untracked files copied into new environments."
+  },
+  {
+    key: "entryPort",
+    scope: "project",
+    type: "port",
+    inherits: false,
+    application: "next-environment",
+    description: "Default preview entry port for new environments."
+  },
+  ...agentSettingDescriptors("project")
+]);
+var PUBLIC_ENVIRONMENT_SETTINGS = Object.freeze([
+  {
+    key: "portMappings",
+    scope: "environment",
+    type: "port-mappings",
+    inherits: false,
+    environmentTypes: ["container"],
+    application: "next-start",
+    description: "Container port mappings; a running container adopts them on recreate."
+  },
+  {
+    key: "allowedDomains",
+    scope: "environment",
+    type: "domain-list",
+    inherits: true,
+    environmentTypes: ["container"],
+    application: "next-start",
+    description: "Restricted-network allowlist; unset inherits the global list. A running container whose image supports it applies the change immediately (reported as applied)."
+  },
+  ...agentSettingDescriptors("environment")
+]);
+
+// src/client/format.ts
+function table(headers, rows) {
+  if (rows.length === 0)
+    return ["(none)"];
+  const widths = headers.map((header, index) => Math.min(60, Math.max(header.length, ...rows.map((row) => (row[index] ?? "").length))));
+  const line = (cells) => cells.map((cell, index) => {
+    const text = cell.length > widths[index] ? `${cell.slice(0, widths[index] - 1)}\u2026` : cell;
+    return text.padEnd(widths[index]);
+  }).join("  ").trimEnd();
+  return [line(headers), ...rows.map(line)];
+}
+function keyValues(entries) {
+  const width = Math.max(...entries.map(([key]) => key.length));
+  return entries.filter(([, value]) => value !== undefined).map(([key, value]) => {
+    const text = value === null ? "-" : typeof value === "object" ? JSON.stringify(value) : String(value);
+    return `${key.padEnd(width)}  ${text}`;
+  });
+}
+function projectLines(project) {
+  return keyValues([
+    ["id", project.id],
+    ["name", project.name],
+    ["remote", project.gitUrl],
+    ["path", project.localPath],
+    ["folder", project.folder],
+    ["environments", project.environmentCount],
+    ["revision", project.revision]
+  ]);
+}
+function projectRows(projects) {
+  return table(["ID", "NAME", "ENVS", "PATH"], projects.map((project) => [
+    project.id,
+    project.name,
+    String(project.environmentCount),
+    project.localPath ?? "-"
+  ]));
+}
+function environmentLines(environment) {
+  return keyValues([
+    ["id", environment.id],
+    ["project", environment.projectId],
+    ["name", environment.name],
+    ["branch", environment.branch],
+    ["type", environment.environmentType],
+    ["status", environment.status],
+    ["ready", environment.ready],
+    ["setup", `${environment.setup.phase}${environment.setup.overridden ? " (overridden)" : ""}`],
+    ["activity", environment.activity.state],
+    ["lifecycle error", environment.lifecycle.error],
+    ["workspace", environment.workspacePath],
+    ["base", environment.base.commit ?? environment.base.branch],
+    ["startup session", environment.startupSession?.sessionId]
+  ]);
+}
+function environmentRows(environments) {
+  return table(["ID", "NAME", "TYPE", "STATUS", "READY"], environments.map((environment) => [
+    environment.id,
+    environment.name,
+    environment.environmentType,
+    environment.status,
+    environment.ready ? "yes" : "no"
+  ]));
+}
+function sessionRows(sessions) {
+  return table(["SESSION", "AGENT", "TAB", "ACTIVITY", "TITLE"], sessions.map((session) => [
+    session.id,
+    session.agent,
+    session.tabId,
+    session.activity,
+    session.title ?? ""
+  ]));
+}
+function sessionLines(session) {
+  return keyValues([
+    ["id", session.id],
+    ["environment", session.environmentId],
+    ["tab", session.tabId],
+    ["agent", session.agent],
+    ["title", session.title],
+    ["activity", session.activity],
+    ["latest request", session.latestRequestId],
+    ["pending interactions", session.pendingInteractionCount],
+    ["recoverable dispatch", session.recoverableDispatch]
+  ]);
+}
+function receiptLines(receipt) {
+  return keyValues([
+    ["operation", receipt.operationId],
+    ["action", receipt.action],
+    ["state", receipt.state],
+    ["stage", receipt.stage],
+    ["request", `${receipt.requestId} (${receipt.namespace})`],
+    ["replayed", receipt.replayed],
+    ["resources", receipt.resources],
+    ["dispatch", receipt.dispatch?.state],
+    ["execution", receipt.execution?.state],
+    ["evidence", receipt.execution?.evidence],
+    ["exit code", receipt.execution?.exitCode],
+    ["error", receipt.error ? `${receipt.error.code}: ${receipt.error.message}` : undefined],
+    ["updated", receipt.updatedAt],
+    ["retained until", receipt.retainedUntil]
+  ]);
+}
+function settingsLines(snapshot) {
+  return [
+    `revision ${snapshot.revision}`,
+    ...table(["KEY", "VALUE", "EFFECTIVE", "SOURCE", "APPLIES"], snapshot.settings.map((setting) => [
+      setting.key,
+      setting.value === null || setting.value === undefined ? "-" : JSON.stringify(setting.value),
+      setting.effective === null || setting.effective === undefined ? "-" : JSON.stringify(setting.effective),
+      setting.source,
+      setting.application
+    ]))
+  ];
 }
 
 // src/client/commands/changes.ts
@@ -8625,6 +8846,7 @@ function changesHistoryLines(history) {
 var changesCommands = [
   {
     path: ["changes", "view"],
+    action: "changes.view",
     summary: "Show an environment's file and line changes as the backend measures them.",
     description: "Read-only: prints the backend's change projection for the environment \u2014 the numbers the desktop shows \u2014 and one page of changed files. Counts carry their quality: ~ partial or estimated, ? unknown, \u2265/\u2264 a bound; binary files and submodules have no line counts. Nothing is ever shown as zero unless the backend measured zero. Pass the printed cursor as --cursor for the next page; a cursor stops working once the changes move on. --json prints the action result verbatim ({projection, files}).",
     positionals: [{ name: "environment", required: true, description: "Environment ID." }],
@@ -8674,6 +8896,7 @@ var changesCommands = [
   },
   {
     path: ["changes", "history"],
+    action: "changes.history",
     summary: "List a session's turns, oldest first, with the changes each one made.",
     description: "Read-only: each turn's backend measurement from its start to its end, with the same count qualities as `changes view`. No workspace scan, transcript or provider read. Pass the printed cursor as --cursor for newer turns.",
     positionals: [{ name: "session", required: true, description: "Session ID (ses_\u2026)." }],
@@ -9900,6 +10123,7 @@ function settingsCommands(scope) {
   return [
     {
       path: [scope, "config", "get"],
+      action: `${scope}.config.get`,
       summary: `Show ${scope} settings with effective values, sources and application timing.`,
       positionals: [{ name: idName, required: true }],
       options: [],
@@ -9918,6 +10142,7 @@ function settingsCommands(scope) {
     },
     {
       path: [scope, "config", "set"],
+      action: `${scope}.config.set`,
       summary: `Set and/or unset ${scope} settings atomically.`,
       description: `Settable keys:
 ${keysHelp}
@@ -10015,6 +10240,8 @@ ${applies}`,
     },
     {
       path: [scope, "config", "unset"],
+      action: `${scope}.config.set`,
+      inputFields: { key: "unset" },
       summary: `Unset ${scope} settings, restoring inheritance.`,
       positionals: [
         { name: idName, required: true },
@@ -10092,6 +10319,7 @@ async function lifecycle(context, parsed, action, conditions, extraInput = {}) {
 var environmentCommands = [
   {
     path: ["environment", "list"],
+    action: "environment.list",
     summary: "List environments from the backend snapshot.",
     positionals: [],
     options: [
@@ -10138,6 +10366,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "get"],
+    action: "environment.get",
     summary: "Show one environment by ID, or by --project and --name when unique.",
     positionals: [{ name: "environment", required: false }],
     options: [
@@ -10173,6 +10402,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "create"],
+    action: "environment.create",
     summary: "Create an environment record (does not start it).",
     description: "--base-branch with --base-commit (a full 40-character SHA) pins the exact base; the backend validates it and records what was used. Without them the project's default branch is used at start time.",
     positionals: [],
@@ -10231,6 +10461,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "start"],
+    action: "environment.start",
     summary: "Start an environment; setup continues in the backend.",
     description: "`--wait running` returns once processes run; `--wait ready` also requires setup to complete (an explicit setup override is reported, never applied by the CLI). Setup failure exits 1 with the recorded reason.",
     positionals: [{ name: "environment", required: true }],
@@ -10240,6 +10471,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "stop"],
+    action: "environment.stop",
     summary: "Stop an environment's processes (and container).",
     positionals: [{ name: "environment", required: true }],
     options: [waitOption(["stopped"]), TIMEOUT_OPTION, REQUEST_ID_OPTION],
@@ -10248,6 +10480,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "recreate"],
+    action: "environment.recreate",
     summary: "Rebuild the container, keeping its files; with --discard, DESTRUCTIVELY reset it (container environments only).",
     description: "Without --discard the workspace (tracked, untracked and ignored files, unpushed commits) and the preserved agent session state are copied to a new container and verified before it replaces the old one, which is kept stopped as a recovery copy. The rebuild is refused, with nothing changed, when the image or Docker engine cannot preserve them. --discard instead deletes the container's local files, installed tools and container-local agent sessions. Local worktree environments cannot be recreated.",
     positionals: [{ name: "environment", required: true }],
@@ -10266,6 +10499,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "delete"],
+    action: "environment.delete",
     summary: "DESTRUCTIVE: stop and delete the environment, its worktree or container, and its record.",
     description: "Uncommitted work in the environment is lost. Cleanup is tracked by the operation; a failed cleanup stays inspectable and can be retried with a new request.",
     positionals: [{ name: "environment", required: true }],
@@ -10275,6 +10509,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "fork"],
+    action: "environment.fork",
     summary: "Create a new environment from this environment's current state.",
     positionals: [{ name: "environment", required: true }],
     options: [TYPE_OPTION, REQUEST_ID_OPTION],
@@ -10295,6 +10530,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "rename"],
+    action: "environment.rename",
     summary: "Rename an environment (and its branch).",
     positionals: [
       { name: "environment", required: true },
@@ -10317,6 +10553,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "launch"],
+    action: "environment.launch",
     summary: "Create and start an environment whose startup agent receives one first prompt.",
     description: "The backend owns the whole flow: create, start, setup, then exactly one initial prompt to the startup session. Do not follow it with `session start`. --wait ready observes setup; follow the prompt's run with `run wait`.",
     positionals: [],
@@ -10427,6 +10664,8 @@ var environmentCommands = [
   },
   {
     path: ["environment", "exec"],
+    action: "environment.exec",
+    inputFields: { "stdin-file": "stdinBase64", "exec-timeout": "timeoutMs" },
     summary: "Run one command in the environment workspace and report its exit status.",
     description: "Arguments after `--` are passed as argv without a shell; use `-- sh -c '...'` to opt into shell expansion. The command runs in a backend-owned worker that outlives this client; --wait observes it and exits with the operation's result (`--exit-code` passes the child's exit code through instead). Output is kept in bounded private artifacts; read it with `run output`.",
     positionals: [{ name: "environment", required: true }],
@@ -10646,6 +10885,7 @@ async function waitForReceipt(context, session, receipt, limit, action) {
 function taskCommand(spec) {
   return {
     path: spec.path,
+    action: spec.action,
     summary: spec.summary,
     ...spec.description ? { description: spec.description } : {},
     positionals: [],
@@ -10677,6 +10917,7 @@ function taskCommand(spec) {
 var hostCommands = [
   {
     path: ["host", "status"],
+    action: "host.status",
     summary: "Show the Orkestrator version on the backend's computer, its updater and any update.",
     positionals: [],
     options: [],
@@ -10693,6 +10934,7 @@ var hostCommands = [
   },
   {
     path: ["host", "update", "channel"],
+    action: "host.update.channel",
     summary: "Choose the host's update channel: stable, beta or unstable.",
     positionals: [{ name: "channel", required: true, description: "stable, beta or unstable" }],
     options: [REQUEST_ID_OPTION],
@@ -10713,6 +10955,7 @@ var hostCommands = [
   },
   {
     path: ["host", "update", "check"],
+    action: "host.update.check",
     summary: "Ask the backend's computer to check for an Orkestrator update.",
     positionals: [],
     options: [WAIT_OPTION, TIMEOUT_OPTION, REQUEST_ID_OPTION],
@@ -10747,6 +10990,13 @@ var hostCommands = [
   },
   {
     path: ["host", "update", "apply"],
+    action: "host.update.apply",
+    inputFields: {
+      release: "version",
+      yes: "confirm",
+      "when-idle": "drain",
+      "max-wait": "maxWaitSeconds"
+    },
     summary: "Install an Orkestrator update on the backend's computer. It restarts there after a 60 s countdown.",
     description: "Someone at that computer can postpone the restart; the update then installs the next time the app quits. Restarting ends agent turns and terminals running on that computer; containers keep running.",
     positionals: [],
@@ -10820,6 +11070,7 @@ var hostCommands = [
   },
   {
     path: ["host", "update", "cancel"],
+    action: "host.update.cancel",
     summary: "Cancel the host's update before it restarts.",
     positionals: [],
     options: [REQUEST_ID_OPTION],
@@ -10862,6 +11113,98 @@ var hostCommands = [
   })
 ];
 
+// src/client/commands/mail.ts
+var mailCommands = [
+  {
+    path: ["mail", "mailboxes"],
+    action: "mail.mailboxes",
+    summary: "List agent mailboxes a message can be sent to.",
+    positionals: [],
+    options: [
+      { name: "q", kind: "string", valueName: "TEXT", description: "Filter by name." },
+      { name: "offset", kind: "integer", valueName: "N", description: "Rows to skip." },
+      { name: "limit", kind: "integer", valueName: "N", description: "Rows (max 200)." }
+    ],
+    async run(context, parsed) {
+      const session = await context.session();
+      const page = await session.read("mail.mailboxes", {
+        ...parsed.options.q !== undefined ? { q: parsed.options.q } : {},
+        ...parsed.options.offset !== undefined ? { offset: parsed.options.offset } : {},
+        ...parsed.options.limit !== undefined ? { limit: parsed.options.limit } : {}
+      });
+      return {
+        action: "mail.mailboxes",
+        result: page,
+        connection: session.identity,
+        human: table(["ENVIRONMENT", "TAB", "NAME", "PRESENCE"], page.mailboxes.map((mailbox) => [
+          mailbox.environmentId,
+          mailbox.tabId,
+          `${mailbox.environmentName} / ${mailbox.displayName}`,
+          mailbox.presence
+        ]))
+      };
+    }
+  },
+  {
+    path: ["mail", "send"],
+    action: "mail.send",
+    summary: "Place a message in one tab's inbox (never injected into a turn).",
+    positionals: [
+      { name: "environment", required: true },
+      { name: "tab", required: true }
+    ],
+    options: [
+      { name: "subject", kind: "string", valueName: "TEXT", description: "Subject line." },
+      { name: "body", kind: "string", valueName: "TEXT", description: "Message text." },
+      {
+        name: "body-file",
+        kind: "string",
+        valueName: "PATH",
+        description: "Read the message from a local file."
+      },
+      { name: "body-stdin", kind: "boolean", description: "Read the message from stdin." },
+      REQUEST_ID_OPTION
+    ],
+    inputFields: {
+      environment: "toEnvironmentId",
+      tab: "toTabId",
+      "body-file": "body",
+      "body-stdin": "body"
+    },
+    idOutput: "message ID",
+    async run(context, parsed) {
+      const body = await readTextSource(context.io, {
+        file: parsed.options["body-file"],
+        stdin: parsed.options["body-stdin"],
+        inline: parsed.options.body,
+        label: "Message",
+        maxBytes: 32 * 1024,
+        names: { file: "--body-file", stdin: "--body-stdin", inline: "--body" },
+        required: true
+      });
+      const subject = stringOption(parsed.options, "subject");
+      if (subject !== undefined && subject.trim().length === 0) {
+        throw new CliError("invalid-input", "--subject is empty");
+      }
+      const { session, result, receipt, warnings } = await submit(context, "mail.send", {
+        toEnvironmentId: parsed.positionals.environment,
+        toTabId: parsed.positionals.tab,
+        body,
+        ...subject ? { subject } : {}
+      }, parsed.options);
+      return {
+        action: "mail.send",
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: result.messageId ? [result.messageId] : [],
+        human: [`sent message ${result.messageId ?? ""}`.trim()]
+      };
+    }
+  }
+];
+
 // src/client/commands/service.ts
 import { spawnSync } from "child_process";
 import { existsSync as existsSync5 } from "fs";
@@ -11477,6 +11820,7 @@ var PAGE_OPTIONS = [
 var projectCommands = [
   {
     path: ["project", "list"],
+    action: "project.list",
     summary: "List projects.",
     positionals: [],
     options: PAGE_OPTIONS,
@@ -11501,6 +11845,7 @@ var projectCommands = [
   },
   {
     path: ["project", "get"],
+    action: "project.get",
     summary: "Show one project by ID, or by --name when unique.",
     positionals: [{ name: "project", required: false }],
     options: [
@@ -11526,6 +11871,7 @@ var projectCommands = [
   },
   {
     path: ["project", "add"],
+    action: "project.add",
     summary: "Register a repository, attach a backend checkout, or clone into a backend path.",
     description: "--remote alone registers the remote. --path alone attaches an existing checkout on the BACKEND's filesystem and reads its origin there. Both together attach the checkout if it exists, or clone the remote into that backend path when it is missing or empty. No GitHub repository is created.",
     positionals: [],
@@ -11560,6 +11906,7 @@ var projectCommands = [
   },
   {
     path: ["project", "create"],
+    action: "project.create",
     summary: "Create a new repository: git init, a PRIVATE GitHub repository, and a push.",
     description: "This creates an external repository on GitHub using the backend's GitHub CLI credentials, pushes the initial commit, and registers the project. It requires --github-private to confirm that effect. Local-only initialization is not supported.",
     positionals: [],
@@ -11599,6 +11946,15 @@ var projectCommands = [
   },
   {
     path: ["project", "update"],
+    action: "project.update",
+    inputFields: {
+      name: "set",
+      folder: "set",
+      "no-folder": "set",
+      remote: "set",
+      path: "set",
+      "no-path": "set"
+    },
     summary: "Edit project metadata (does not move checkouts or rewrite .git/config).",
     positionals: [{ name: "project", required: true }],
     options: [
@@ -11668,6 +12024,7 @@ var projectCommands = [
   },
   {
     path: ["project", "remove"],
+    action: "project.remove",
     summary: "Remove an empty project registration (refused while environments exist).",
     description: "Only the registration is removed. The checkout on disk and any remote repository are never deleted.",
     positionals: [{ name: "project", required: true }],
@@ -11693,6 +12050,7 @@ var projectCommands = [
 var runCommands = [
   {
     path: ["run", "get"],
+    action: "run.get",
     summary: "Show an operation by ID, or by its original --request-id.",
     description: "Lookup by request key finds the operation even when the original response was lost. `history-expired` (exit 3) means the key's namespace was retired and its outcome is no longer retained; it is not evidence that nothing ran.",
     positionals: [{ name: "operation", required: false }],
@@ -11749,6 +12107,7 @@ var runCommands = [
   },
   {
     path: ["run", "wait"],
+    action: "run.get",
     summary: "Observe an operation until it finishes (exit 0 only on success).",
     description: "Exit codes: 0 succeeded, 1 failed/cancelled/interrupted, 5 --timeout passed (still running), 6 waiting for an interaction answer, 7 dispatch or outcome unknown. Ctrl+C stops observing only.",
     positionals: [{ name: "operation", required: true }],
@@ -11779,6 +12138,7 @@ var runCommands = [
   },
   {
     path: ["run", "retry"],
+    action: "run.retry",
     summary: "Retry the exact parked prompt/steer of an unknown dispatch under its original key.",
     description: "Never sends a different prompt and never mints a new key.",
     positionals: [{ name: "operation", required: true }],
@@ -11799,6 +12159,7 @@ var runCommands = [
   },
   {
     path: ["run", "discard"],
+    action: "run.discard",
     summary: "Clear the recovery state of an unknown dispatch (does NOT undo a turn that ran).",
     positionals: [{ name: "operation", required: true }],
     options: [REQUEST_ID_OPTION],
@@ -11818,6 +12179,7 @@ var runCommands = [
   },
   {
     path: ["run", "cancel"],
+    action: "run.cancel",
     summary: "Cancel a running exec operation (its exact worker and descendants).",
     positionals: [{ name: "operation", required: true }],
     options: [REQUEST_ID_OPTION],
@@ -11837,6 +12199,8 @@ var runCommands = [
   },
   {
     path: ["run", "output"],
+    action: "run.output",
+    inputFields: { tail: "tailBytes" },
     summary: "Read a bounded window of an exec operation's stdout or stderr.",
     positionals: [{ name: "operation", required: true }],
     options: [
@@ -12039,6 +12403,7 @@ function parseAnswers(options2) {
 var sessionCommands = [
   {
     path: ["agent", "options"],
+    action: "agent.options",
     summary: "Enabled agents, model catalogues (with freshness), and supported controls.",
     description: "Reads the backend's cached catalogues; --refresh asks providers again, which can take a while. An `empty` catalogue is a successful empty answer; `stale`/`unavailable` means the backend could not read it.",
     positionals: [],
@@ -12084,6 +12449,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "list"],
+    action: "session.list",
     summary: "List native-agent sessions of an environment (no transcripts are read).",
     positionals: [],
     options: [
@@ -12112,6 +12478,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "get"],
+    action: "session.get",
     summary: "Show one session (activity, latest request, pending interactions).",
     positionals: [{ name: "session", required: true }],
     options: [],
@@ -12132,6 +12499,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "start"],
+    action: "session.start",
     summary: "Start an independent conversation in a ready environment and send its first prompt.",
     description: "Creates a new agent tab without focusing it. The response is a submission receipt; add --wait (or run `run wait`) to observe the turn. Independent sessions in one environment share its files.",
     positionals: [],
@@ -12194,6 +12562,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "prompt"],
+    action: "session.prompt",
     summary: "Send a follow-up prompt to an idle session.",
     description: "Busy sessions are refused (exit 8); use `session steer` to redirect an active turn. The target must be the exact session: a vanished session is never replaced by a new one.",
     positionals: [{ name: "session", required: true }],
@@ -12232,6 +12601,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "stop"],
+    action: "session.stop",
     summary: "Stop the session's current turn (not the environment).",
     description: "--expect-run binds the stop to that run: if a different turn is now active the stop is refused (exit 8). Success requires the provider to confirm the turn ended; otherwise the result is unknown (exit 7).",
     positionals: [{ name: "session", required: true }],
@@ -12263,6 +12633,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "steer"],
+    action: "session.steer",
     summary: "Redirect the active turn (providers that support steering only).",
     positionals: [{ name: "session", required: true }],
     options: [
@@ -12311,6 +12682,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "config", "get"],
+    action: "session.config.get",
     summary: "Show the live session's effective controls.",
     positionals: [{ name: "session", required: true }],
     options: [],
@@ -12329,6 +12701,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "config", "set"],
+    action: "session.config.set",
     summary: "Change the live session's controls (not environment defaults).",
     description: "Applies to this conversation now, as validated by its provider; the response shows the values actually in force (a provider may clamp them). To change defaults for future sessions use `environment config set`.",
     positionals: [{ name: "session", required: true }],
@@ -12350,6 +12723,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "history"],
+    action: "session.history",
     summary: "List earlier provider conversations this session can resume.",
     positionals: [{ name: "session", required: true }],
     options: [],
@@ -12372,6 +12746,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "resume"],
+    action: "session.resume",
     summary: "Rebind the session to an earlier conversation from `session history`.",
     description: "The current conversation's history is kept; nothing is deleted.",
     positionals: [
@@ -12386,6 +12761,8 @@ var sessionCommands = [
   },
   {
     path: ["session", "fork"],
+    action: "session.fork",
+    inputFields: { message: "messageId" },
     summary: "Fork the conversation into a new session (optionally at a message).",
     positionals: [{ name: "session", required: true }],
     options: [
@@ -12416,6 +12793,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "interactions", "list"],
+    action: "session.interactions",
     summary: "List pending questions and approvals with their permitted answers.",
     positionals: [{ name: "session", required: true }],
     options: [],
@@ -12440,6 +12818,8 @@ var sessionCommands = [
   },
   {
     path: ["session", "interactions", "resolve"],
+    action: "session.interaction.resolve",
+    inputFields: { revision: "expectedRevision", choose: "answers", text: "answers" },
     summary: "Answer one pending interaction at its current revision.",
     description: "--revision must match the interaction's current revision; a replaced or expired interaction is refused (exit 8), never answered. Nothing is approved implicitly.",
     positionals: [
@@ -12511,6 +12891,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "transcript"],
+    action: "session.transcript",
     summary: "Read a bounded transcript page; --follow polls for new messages.",
     description: "Pages are oldest-first and hold at most --limit messages (max 100). Pass the returned olderCursor as --before for earlier history. --follow --jsonl streams one record per new message by polling snapshots; it stops at --timeout or Ctrl+C and never affects the session.",
     positionals: [{ name: "session", required: true }],
@@ -12621,6 +13002,243 @@ var sessionCommands = [
   }
 ];
 
+// src/client/commands/ticket.ts
+var STATUSES = ["backlog", "in-progress", "review", "done"];
+var PROJECT_OPTION = {
+  name: "project",
+  kind: "string",
+  valueName: "PROJECT_ID",
+  description: "Project ID (project list)."
+};
+var STATUS_OPTION = {
+  name: "status",
+  kind: "string",
+  valueName: "COLUMN",
+  description: `Column: ${STATUSES.join(", ")}.`
+};
+var TEXT_FIELD_OPTIONS = [
+  { name: "title", kind: "string", valueName: "TEXT", description: "Ticket title." },
+  {
+    name: "description",
+    kind: "string",
+    valueName: "TEXT",
+    description: "Description (or --description-file)."
+  },
+  {
+    name: "description-file",
+    kind: "string",
+    valueName: "PATH",
+    description: "Read the description from a local file."
+  },
+  {
+    name: "criteria",
+    kind: "string",
+    valueName: "TEXT",
+    description: "Acceptance criteria."
+  }
+];
+function requireProject(options2) {
+  const projectId = stringOption(options2, "project");
+  if (!projectId)
+    throw new CliError("invalid-input", "--project is required");
+  return projectId;
+}
+async function ticketFields(io, options2) {
+  const description = await readTextSource(io, {
+    file: options2["description-file"],
+    inline: options2.description,
+    label: "Description",
+    maxBytes: 400000,
+    names: { file: "--description-file", stdin: "--description-stdin", inline: "--description" },
+    required: false
+  });
+  return {
+    ...stringOption(options2, "title") !== undefined ? { title: options2.title } : {},
+    ...description !== undefined ? { description } : {},
+    ...stringOption(options2, "criteria") !== undefined ? { acceptanceCriteria: options2.criteria } : {},
+    ...options2.status !== undefined ? { status: oneOf(options2.status, STATUSES, "--status") } : {}
+  };
+}
+function ticketRows(tickets) {
+  return table(["ID", "STATUS", "TITLE", "COMMENTS"], tickets.map((ticket) => [ticket.id, ticket.status, ticket.title, String(ticket.commentCount)]));
+}
+function ticketLines(ticket) {
+  return [
+    ...keyValues([
+      ["id", ticket.id],
+      ["project", ticket.projectId],
+      ["status", ticket.status],
+      ["title", ticket.title],
+      ["environment", ticket.environmentId],
+      ["pr", ticket.pr.url]
+    ]),
+    ...ticket.description ? ["", ticket.description] : [],
+    ...ticket.acceptanceCriteria ? ["", "Acceptance criteria:", ticket.acceptanceCriteria] : [],
+    ...ticket.comments.flatMap((comment) => ["", `[${comment.createdAt}] ${comment.text}`])
+  ];
+}
+var ticketCommands = [
+  {
+    path: ["ticket", "list"],
+    action: "ticket.list",
+    summary: "List a project's Kanban tickets.",
+    positionals: [],
+    options: [
+      PROJECT_OPTION,
+      STATUS_OPTION,
+      { name: "limit", kind: "integer", valueName: "N", description: "Items per page (max 200)." },
+      {
+        name: "cursor",
+        kind: "string",
+        valueName: "CURSOR",
+        description: "Continue from a previous page."
+      }
+    ],
+    idOutput: "ticket IDs, one per line",
+    async run(context, parsed) {
+      const session = await context.session();
+      const page = await session.read("ticket.list", {
+        projectId: requireProject(parsed.options),
+        ...parsed.options.status !== undefined ? { status: oneOf(parsed.options.status, STATUSES, "--status") } : {},
+        ...parsed.options.limit !== undefined ? { limit: parsed.options.limit } : {},
+        ...parsed.options.cursor !== undefined ? { cursor: parsed.options.cursor } : {}
+      });
+      return {
+        action: "ticket.list",
+        result: page,
+        connection: session.identity,
+        ids: page.items.map((ticket) => ticket.id),
+        human: [
+          ...ticketRows(page.items),
+          ...page.nextCursor ? [`more: --cursor ${page.nextCursor}`] : []
+        ]
+      };
+    }
+  },
+  {
+    path: ["ticket", "get"],
+    action: "ticket.get",
+    summary: "Show one ticket with its description, criteria and latest comments.",
+    positionals: [{ name: "ticket", required: true }],
+    options: [PROJECT_OPTION],
+    inputFields: { ticket: "ticketId" },
+    idOutput: "ticket ID",
+    async run(context, parsed) {
+      const session = await context.session();
+      const ticket = await session.read("ticket.get", {
+        projectId: requireProject(parsed.options),
+        ticketId: parsed.positionals.ticket
+      });
+      return {
+        action: "ticket.get",
+        result: ticket,
+        connection: session.identity,
+        ids: [ticket.id],
+        human: ticketLines(ticket)
+      };
+    }
+  },
+  {
+    path: ["ticket", "create"],
+    action: "ticket.create",
+    summary: "Create a Kanban ticket.",
+    positionals: [],
+    options: [PROJECT_OPTION, ...TEXT_FIELD_OPTIONS, STATUS_OPTION, REQUEST_ID_OPTION],
+    inputFields: {
+      "description-file": "description",
+      criteria: "acceptanceCriteria"
+    },
+    idOutput: "ticket ID",
+    async run(context, parsed) {
+      const fields = await ticketFields(context.io, parsed.options);
+      if (typeof fields.title !== "string")
+        throw new CliError("invalid-input", "--title is required");
+      const { session, result, receipt, warnings } = await submit(context, "ticket.create", { projectId: requireProject(parsed.options), ...fields }, parsed.options);
+      return {
+        action: "ticket.create",
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: [result.ticketId],
+        human: [`created ticket ${result.ticketId}`]
+      };
+    }
+  },
+  {
+    path: ["ticket", "update"],
+    action: "ticket.update",
+    summary: "Change a ticket's title, description, criteria or column.",
+    positionals: [{ name: "ticket", required: true }],
+    options: [PROJECT_OPTION, ...TEXT_FIELD_OPTIONS, STATUS_OPTION, REQUEST_ID_OPTION],
+    inputFields: {
+      ticket: "ticketId",
+      "description-file": "description",
+      criteria: "acceptanceCriteria"
+    },
+    idOutput: "ticket ID",
+    async run(context, parsed) {
+      const fields = await ticketFields(context.io, parsed.options);
+      if (Object.keys(fields).length === 0) {
+        throw new CliError("invalid-input", "Pass at least one field to change");
+      }
+      const { session, result, receipt, warnings } = await submit(context, "ticket.update", {
+        projectId: requireProject(parsed.options),
+        ticketId: parsed.positionals.ticket,
+        ...fields
+      }, parsed.options);
+      return {
+        action: "ticket.update",
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: [result.ticketId],
+        human: [`updated ticket ${result.ticketId}`]
+      };
+    }
+  },
+  {
+    path: ["ticket", "comment"],
+    action: "ticket.comment",
+    summary: "Append a comment to a ticket.",
+    positionals: [{ name: "ticket", required: true }],
+    options: [
+      PROJECT_OPTION,
+      { name: "text", kind: "string", valueName: "TEXT", description: "Comment text." },
+      {
+        name: "text-file",
+        kind: "string",
+        valueName: "PATH",
+        description: "Read the comment from a local file."
+      },
+      REQUEST_ID_OPTION
+    ],
+    inputFields: { ticket: "ticketId", "text-file": "text" },
+    idOutput: "ticket ID",
+    async run(context, parsed) {
+      const text = await readTextSource(context.io, {
+        file: parsed.options["text-file"],
+        inline: parsed.options.text,
+        label: "Comment",
+        maxBytes: 80000,
+        names: { file: "--text-file", stdin: "--text-stdin", inline: "--text" },
+        required: true
+      });
+      const { session, result, receipt, warnings } = await submit(context, "ticket.comment", { projectId: requireProject(parsed.options), ticketId: parsed.positionals.ticket, text }, parsed.options);
+      return {
+        action: "ticket.comment",
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: [result.ticketId],
+        human: [`commented on ticket ${result.ticketId}`]
+      };
+    }
+  }
+];
+
 // src/client/commands/toolchain.ts
 import path18 from "path";
 function dataDirectory2(context, parsed) {
@@ -13046,6 +13664,9 @@ var CLIENT_COMMANDS = [
   ...environmentCommands,
   ...sessionCommands,
   ...changesCommands,
+  ...attentionCommands,
+  ...ticketCommands,
+  ...mailCommands,
   ...runCommands,
   ...toolchainCommands,
   ...hostCommands,