orkestrator 2.29.0-beta → 2.31.0-beta

package/dist/client.js

@@ -4876,26 +4876,26 @@ import {
   symlink as symlink2,
   utimes
 } from "fs/promises";
-import path15 from "path";
+import path16 from "path";
 import { pipeline } from "stream/promises";
 import { createGunzip } from "zlib";
 function delay(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
 function artifactDirectory(rootDir, artifact) {
-  return path15.join(rootDir, artifact.name, artifact.version, `${artifact.platform}-${artifact.architecture}`);
+  return path16.join(rootDir, artifact.name, artifact.version, `${artifact.platform}-${artifact.architecture}`);
 }
 function artifactExecutablePath(rootDir, artifact) {
-  return path15.join(artifactDirectory(rootDir, artifact), artifact.executable.fileName);
+  return path16.join(artifactDirectory(rootDir, artifact), artifact.executable.fileName);
 }
 function upstreamExecutablePath(rootDir, artifact) {
-  return path15.join(artifactDirectory(rootDir, artifact), `.upstream-${artifact.executable.fileName}`);
+  return path16.join(artifactDirectory(rootDir, artifact), `.upstream-${artifact.executable.fileName}`);
 }
 function artifactCompanions(artifact) {
   return artifact.companions ?? [];
 }
 function companionPath(rootDir, artifact, companion) {
-  return path15.join(artifactDirectory(rootDir, artifact), companion.fileName);
+  return path16.join(artifactDirectory(rootDir, artifact), companion.fileName);
 }
 function artifactArchiveBytes(artifact) {
   return artifactCompanions(artifact).reduce((total, companion) => total + companion.archive.size, artifact.archive.size);
@@ -4919,7 +4919,7 @@ function assertValidArtifactMetadata(artifact) {
     }
     const paths = new Set;
     for (const file of artifact.archive.bundleFiles) {
-      const normalized = path15.posix.normalize(file.path);
+      const normalized = path16.posix.normalize(file.path);
       if (normalized !== file.path || normalized.startsWith("../") || normalized.startsWith("/") || normalized.includes("\\") || paths.has(normalized) || !Number.isSafeInteger(file.size) || file.size < 1 || !/^[a-f0-9]{64}$/.test(file.sha256)) {
         throw new Error(`${artifact.name} manifest has an unsafe bundle file`);
       }
@@ -4945,7 +4945,7 @@ function assertValidArtifactMetadata(artifact) {
   }
   const activationNames = new Set([artifact.name, artifact.executable.fileName]);
   for (const alias of artifact.activationAliases ?? []) {
-    if (!alias || alias.startsWith(".") || alias.includes("/") || alias.includes("\\") || alias !== path15.basename(alias) || activationNames.has(alias)) {
+    if (!alias || alias.startsWith(".") || alias.includes("/") || alias.includes("\\") || alias !== path16.basename(alias) || activationNames.has(alias)) {
       throw new Error(`${artifact.name} manifest has an unsafe or duplicate activation alias`);
     }
     activationNames.add(alias);
@@ -4955,7 +4955,7 @@ function assertValidArtifactMetadata(artifact) {
     if (companion.archive.format !== "zip" && companion.archive.format !== "tar.gz") {
       throw new Error(`${artifact.name} companion has an unsupported archive format`);
     }
-    if (!companion.fileName || companion.fileName.startsWith(".") || companion.fileName.includes("/") || companion.fileName.includes("\\") || companion.fileName !== path15.basename(companion.fileName)) {
+    if (!companion.fileName || companion.fileName.startsWith(".") || companion.fileName.includes("/") || companion.fileName.includes("\\") || companion.fileName !== path16.basename(companion.fileName)) {
       throw new Error(`${artifact.name} companion has an unsafe file name`);
     }
     if (companionNames.has(companion.fileName)) {
@@ -5021,7 +5021,7 @@ async function isValidExecutable(rootDir, artifact) {
     if (!await isValidUpstreamExecutable(rootDir, artifact))
       return false;
     for (const bundled of artifact.archive.bundleFiles ?? []) {
-      if (!await isValidFile(path15.join(artifactDirectory(rootDir, artifact), ...bundled.path.split("/")), bundled)) {
+      if (!await isValidFile(path16.join(artifactDirectory(rootDir, artifact), ...bundled.path.split("/")), bundled)) {
         return false;
       }
     }
@@ -5038,7 +5038,7 @@ async function isValidExecutable(rootDir, artifact) {
     if ((file.mode & 511) !== 320)
       await chmod(executablePath, 320);
     for (const bundled of artifact.archive.bundleFiles ?? []) {
-      if (!await isValidFile(path15.join(artifactDirectory(rootDir, artifact), ...bundled.path.split("/")), bundled)) {
+      if (!await isValidFile(path16.join(artifactDirectory(rootDir, artifact), ...bundled.path.split("/")), bundled)) {
         return false;
       }
     }
@@ -5059,7 +5059,7 @@ async function bundleTreeEntries(directory, artifact) {
   const visit = async (currentDirectory, prefix = "") => {
     for (const entry of await readdir2(currentDirectory, { withFileTypes: true })) {
       const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
-      const filePath = path15.join(currentDirectory, entry.name);
+      const filePath = path16.join(currentDirectory, entry.name);
       if (entry.isDirectory()) {
         await visit(filePath, relativePath);
       } else if (entry.isFile() && !entry.isSymbolicLink()) {
@@ -5174,7 +5174,7 @@ async function initializeInstallLock(lockPath, owner, openLockFile) {
   }
 }
 async function acquireInstallLock(rootDir, onProgress, timings, openLockFile, ownerProcessExists) {
-  const lockPath = path15.join(rootDir, INSTALL_LOCK);
+  const lockPath = path16.join(rootDir, INSTALL_LOCK);
   const startedAt = Date.now();
   let announcedWait = false;
   while (Date.now() - startedAt < timings.lockWaitTimeoutMs) {
@@ -5355,8 +5355,8 @@ async function extractTarGzipBundle(archivePath, destinationDirectory, label, ar
       stream.resume();
       return;
     }
-    const normalized = path15.posix.normalize(relative);
-    if (normalized.startsWith("../") || normalized.startsWith("/") || normalized.includes("\\") || path15.isAbsolute(normalized)) {
+    const normalized = path16.posix.normalize(relative);
+    if (normalized.startsWith("../") || normalized.startsWith("/") || normalized.includes("\\") || path16.isAbsolute(normalized)) {
       extract2.destroy(new Error(`Unsafe path in ${label} bundle`));
       stream.resume();
       return;
@@ -5368,7 +5368,7 @@ async function extractTarGzipBundle(archivePath, destinationDirectory, label, ar
       stream.resume();
       return;
     }
-    const destination = path15.join(destinationDirectory, ...normalized.split("/"));
+    const destination = path16.join(destinationDirectory, ...normalized.split("/"));
     if (header.type === "directory") {
       stream.once("end", next);
       stream.resume();
@@ -5386,7 +5386,7 @@ async function extractTarGzipBundle(archivePath, destinationDirectory, label, ar
     }
     if (header.name === archive.entryPath)
       foundExecutable = true;
-    mkdir3(path15.dirname(destination), { recursive: true, mode: 448 }).then(() => pipeline(stream, createWriteStream(destination, {
+    mkdir3(path16.dirname(destination), { recursive: true, mode: 448 }).then(() => pipeline(stream, createWriteStream(destination, {
       flags: "wx",
       mode: (header.mode ?? 0) & 73 ? 320 : 256
     }))).then(() => next(), (error) => extract2.destroy(error instanceof Error ? error : new Error(String(error))));
@@ -5548,7 +5548,7 @@ async function repairInvalidMacSignature(executablePath, artifact, timeoutMs, sp
   await runCodesign(["--sign", "-", "--force", executablePath], `${artifact.name} could not be ad-hoc signed after source verification`, timeoutMs, spawnProcess);
 }
 async function prepareRepairableExecutable(sourcePath, executablePath, artifact, skipExecutableProbeForTests, processTimeoutMs, spawnProcess) {
-  const temporaryPath = path15.join(path15.dirname(executablePath), `.repair-${artifact.executable.fileName}-${randomUUID4()}.tmp`);
+  const temporaryPath = path16.join(path16.dirname(executablePath), `.repair-${artifact.executable.fileName}-${randomUUID4()}.tmp`);
   try {
     await copyFile2(sourcePath, temporaryPath);
     await chmod(temporaryPath, 448);
@@ -5580,8 +5580,8 @@ async function refreshRepairableArtifact(rootDir, artifact, skipExecutableProbeF
 async function stageCompanions(stagingDirectory, artifact, companions, fetchImpl, onBytes, startBytes, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess) {
   let downloadedBytes = startBytes;
   for (const companion of companions) {
-    const companionArchivePath = path15.join(stagingDirectory, `.archive-${companion.fileName}.${archiveExtension(companion.archive)}`);
-    const companionFilePath = path15.join(stagingDirectory, companion.fileName);
+    const companionArchivePath = path16.join(stagingDirectory, `.archive-${companion.fileName}.${archiveExtension(companion.archive)}`);
+    const companionFilePath = path16.join(stagingDirectory, companion.fileName);
     const precedingBytes = downloadedBytes;
     await downloadArchive(companion.fileName, companion.archive, companionArchivePath, fetchImpl, (received) => onBytes(precedingBytes + received), allowInsecureDownloadsForTests, timings.downloadTimeoutMs);
     downloadedBytes += companion.archive.size;
@@ -5606,28 +5606,28 @@ async function stageCompanions(stagingDirectory, artifact, companions, fetchImpl
   }
 }
 async function repairArtifactCompanions(rootDir, artifact, companions, fetchImpl, onBytes, onVerify, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess) {
-  const stagingDirectory = await mkdtemp2(path15.join(rootDir, `.staging-${artifact.name}-`));
+  const stagingDirectory = await mkdtemp2(path16.join(rootDir, `.staging-${artifact.name}-`));
   try {
     await stageCompanions(stagingDirectory, artifact, companions, fetchImpl, onBytes, 0, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess);
     onVerify();
     const destinationDirectory = artifactDirectory(rootDir, artifact);
     for (const companion of companions) {
-      await rename2(path15.join(stagingDirectory, companion.fileName), path15.join(destinationDirectory, companion.fileName));
+      await rename2(path16.join(stagingDirectory, companion.fileName), path16.join(destinationDirectory, companion.fileName));
     }
   } finally {
     await rm3(stagingDirectory, { recursive: true, force: true });
   }
 }
 async function installArtifact(rootDir, artifact, fetchImpl, onBytes, onVerify, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess) {
-  const stagingDirectory = await mkdtemp2(path15.join(rootDir, `.staging-${artifact.name}-`));
-  const archivePath = path15.join(stagingDirectory, `archive.${archiveExtension(artifact.archive)}`);
-  const executablePath = path15.join(stagingDirectory, artifact.executable.fileName);
-  const extractedPath = artifact.executable.repairInvalidMacSignature ? path15.join(stagingDirectory, `.upstream-${artifact.executable.fileName}`) : executablePath;
+  const stagingDirectory = await mkdtemp2(path16.join(rootDir, `.staging-${artifact.name}-`));
+  const archivePath = path16.join(stagingDirectory, `archive.${archiveExtension(artifact.archive)}`);
+  const executablePath = path16.join(stagingDirectory, artifact.executable.fileName);
+  const extractedPath = artifact.executable.repairInvalidMacSignature ? path16.join(stagingDirectory, `.upstream-${artifact.executable.fileName}`) : executablePath;
   try {
     await downloadArchive(artifact.name, artifact.archive, archivePath, fetchImpl, onBytes, allowInsecureDownloadsForTests, timings.downloadTimeoutMs);
     if (artifact.archive.bundleRoot) {
       await extractTarGzipBundle(archivePath, stagingDirectory, artifact.name, artifact.archive);
-      const bundledExecutable = path15.join(stagingDirectory, ...artifact.archive.entryPath.slice(artifact.archive.bundleRoot.length).split("/"));
+      const bundledExecutable = path16.join(stagingDirectory, ...artifact.archive.entryPath.slice(artifact.archive.bundleRoot.length).split("/"));
       if (bundledExecutable !== extractedPath) {
         await rename2(bundledExecutable, extractedPath);
       }
@@ -5678,7 +5678,7 @@ async function installArtifact(rootDir, artifact, fetchImpl, onBytes, onVerify,
     await stageCompanions(stagingDirectory, artifact, artifactCompanions(artifact), fetchImpl, onBytes, artifact.archive.size, allowInsecureDownloadsForTests, skipExecutableProbeForTests, timings, spawnProcess);
     onVerify();
     const destinationDirectory = artifactDirectory(rootDir, artifact);
-    await mkdir3(path15.dirname(destinationDirectory), { recursive: true, mode: 448 });
+    await mkdir3(path16.dirname(destinationDirectory), { recursive: true, mode: 448 });
     await rm3(destinationDirectory, { recursive: true, force: true });
     await rename2(stagingDirectory, destinationDirectory);
     await chmod(destinationDirectory, 448);
@@ -5690,16 +5690,16 @@ async function installArtifact(rootDir, artifact, fetchImpl, onBytes, onVerify,
 }
 async function cleanStagingDirectories(rootDir) {
   const entries = await readdir2(rootDir, { withFileTypes: true });
-  await Promise.all(entries.filter((entry) => entry.isDirectory() && entry.name.startsWith(".staging-")).map((entry) => rm3(path15.join(rootDir, entry.name), { recursive: true, force: true })));
+  await Promise.all(entries.filter((entry) => entry.isDirectory() && entry.name.startsWith(".staging-")).map((entry) => rm3(path16.join(rootDir, entry.name), { recursive: true, force: true })));
 }
 async function touchArtifactDirectory(rootDir, artifact) {
   const now = new Date;
-  await utimes(path15.dirname(artifactDirectory(rootDir, artifact)), now, now).catch(() => {
+  await utimes(path16.dirname(artifactDirectory(rootDir, artifact)), now, now).catch(() => {
     return;
   });
 }
 function versionLeaseDirectory(rootDir, name, version) {
-  return path15.join(rootDir, LEASE_DIRECTORY, name, version);
+  return path16.join(rootDir, LEASE_DIRECTORY, name, version);
 }
 async function acquireVersionLease(rootDir, artifact, openLeaseFile) {
   const leaseKey = `${rootDir}\x00${artifact.name}\x00${artifact.version}`;
@@ -5714,7 +5714,7 @@ async function acquireVersionLease(rootDir, artifact, openLeaseFile) {
   };
   const directory = versionLeaseDirectory(rootDir, artifact.name, artifact.version);
   await mkdir3(directory, { recursive: true, mode: 448 });
-  const leasePath = path15.join(directory, `${owner.pid}-${owner.token}.json`);
+  const leasePath = path16.join(directory, `${owner.pid}-${owner.token}.json`);
   const handle = await openLeaseFile(leasePath, "wx", 384);
   try {
     await handle.writeFile(JSON.stringify(owner), "utf8");
@@ -5735,7 +5735,7 @@ async function versionHasLiveLease(rootDir, name, version, ownerProcessExists) {
   const entries = await readdir2(directory, { withFileTypes: true }).catch(() => []);
   let live = false;
   await Promise.all(entries.filter((entry) => entry.isFile()).map(async (entry) => {
-    const leasePath = path15.join(directory, entry.name);
+    const leasePath = path16.join(directory, entry.name);
     try {
       const parsed = JSON.parse(await readFile2(leasePath, "utf8"));
       if (typeof parsed.token === "string" && typeof parsed.pid === "number" && typeof parsed.createdAt === "string" && ownerProcessExists(parsed.pid)) {
@@ -5758,11 +5758,11 @@ async function pruneSupersededVersions(rootDir, artifacts, retainSupersededMs, o
   }
   const staleBefore = Date.now() - retainSupersededMs;
   await Promise.all(Array.from(keepByName, async ([name, keep]) => {
-    const toolDir = path15.join(rootDir, name);
+    const toolDir = path16.join(rootDir, name);
     try {
       const entries = await readdir2(toolDir, { withFileTypes: true });
       await Promise.all(entries.filter((entry) => entry.isDirectory() && !keep.has(entry.name)).map(async (entry) => {
-        const versionDir = path15.join(toolDir, entry.name);
+        const versionDir = path16.join(toolDir, entry.name);
         try {
           if ((await stat2(versionDir)).mtimeMs > staleBefore)
             return;
@@ -5803,8 +5803,8 @@ function activationSetId(artifacts) {
   return createHash4("sha256").update(JSON.stringify(identity)).digest("hex");
 }
 async function activateExecutables(rootDir, artifacts) {
-  const binRoot = path15.join(rootDir, "bin");
-  const binDir = path15.join(binRoot, activationSetId(artifacts));
+  const binRoot = path16.join(rootDir, "bin");
+  const binDir = path16.join(binRoot, activationSetId(artifacts));
   await mkdir3(binRoot, { recursive: true, mode: 448 });
   const binRootEntry = await lstat(binRoot);
   if (!binRootEntry.isDirectory() || binRootEntry.isSymbolicLink()) {
@@ -5819,8 +5819,8 @@ async function activateExecutables(rootDir, artifacts) {
   await chmod(binDir, 448);
   const executables = {};
   const activate = async (linkName, target) => {
-    const activePath = path15.join(binDir, linkName);
-    const temporaryLink = path15.join(binDir, `.${linkName}-${randomUUID4()}.tmp`);
+    const activePath = path16.join(binDir, linkName);
+    const temporaryLink = path16.join(binDir, `.${linkName}-${randomUUID4()}.tmp`);
     const existingTarget = await readlink(activePath).catch(() => null);
     if (existingTarget !== target) {
       await symlink2(target, temporaryLink, "file");
@@ -5868,7 +5868,7 @@ async function ensurePinnedToolchains(options2) {
   const timings = { ...DEFAULT_TIMINGS, ...options2.timingsForTests };
   const spawnProcess = options2.spawnForTests ?? spawn;
   const ownerProcessExists = options2.processExistsForTests ?? ((pid) => processExists(pid, options2.processKillForTests));
-  const rootDir = path15.join(options2.dataDir, TOOLCHAIN_DIRECTORY);
+  const rootDir = path16.join(options2.dataDir, TOOLCHAIN_DIRECTORY);
   const totalTools = artifacts.length;
   const toolFractions = new Map(artifacts.map((artifact) => [artifact.name, 0]));
   const progress = (value) => {
@@ -6033,7 +6033,7 @@ var init_agent_platforms = __esm(() => {
 
 // ../toolchain/src/platform-selection.ts
 import { promises as fs7 } from "fs";
-import path16 from "path";
+import path17 from "path";
 async function readJsonFile(filePath) {
   try {
     return JSON.parse(await fs7.readFile(filePath, "utf8"));
@@ -6042,7 +6042,7 @@ async function readJsonFile(filePath) {
   }
 }
 async function loadAgentPlatformSelection(dataDir) {
-  const config = await readJsonFile(path16.join(dataDir, AGENT_CONFIG_FILE));
+  const config = await readJsonFile(path17.join(dataDir, AGENT_CONFIG_FILE));
   if (config && typeof config === "object" && !Array.isArray(config)) {
     const global2 = config.global;
     if (global2 && typeof global2 === "object" && !Array.isArray(global2)) {
@@ -6058,7 +6058,7 @@ async function loadAgentPlatformSelection(dataDir) {
       needsFirstRunChoice: false
     };
   }
-  const sidecar = await readJsonFile(path16.join(dataDir, AGENT_PLATFORM_SELECTION_FILE));
+  const sidecar = await readJsonFile(path17.join(dataDir, AGENT_PLATFORM_SELECTION_FILE));
   if (sidecar && typeof sidecar === "object" && !Array.isArray(sidecar)) {
     const enabled = normalizeAgentPlatforms(sidecar.enabled, []);
     if (enabled.length > 0)
@@ -6074,7 +6074,7 @@ var init_platform_selection = __esm(() => {
 // ../toolchain/src/install.ts
 import { randomUUID as randomUUID5 } from "crypto";
 import { lstat as lstat2, mkdir as mkdir4, readdir as readdir3, readlink as readlink2, rename as rename3, rm as rm4, symlink as symlink3 } from "fs/promises";
-import path17 from "path";
+import path18 from "path";
 async function resolveToolchainSelection(options2) {
   const known = Object.keys(PINNED_TOOL_VERSIONS);
   const withSupportTools = (chosen) => known.filter((name) => chosen.has(name) || isSupportToolName(name));
@@ -6133,16 +6133,16 @@ async function installPinnedToolchains(options2) {
   };
 }
 async function toolsInCurrent(rootDir) {
-  const entries = await readdir3(path17.join(rootDir, "bin", CURRENT_TOOLCHAIN_LINK)).catch(() => []);
+  const entries = await readdir3(path18.join(rootDir, "bin", CURRENT_TOOLCHAIN_LINK)).catch(() => []);
   return Object.keys(PINNED_TOOL_VERSIONS).filter((tool) => entries.includes(tool));
 }
 async function pointCurrentAt(rootDir, binDir) {
-  const binRoot = path17.join(rootDir, "bin");
-  if (path17.dirname(binDir) !== binRoot) {
+  const binRoot = path18.join(rootDir, "bin");
+  if (path18.dirname(binDir) !== binRoot) {
     throw new Error(`Activation directory ${binDir} is not directly inside ${binRoot}`);
   }
-  const link = path17.join(binRoot, CURRENT_TOOLCHAIN_LINK);
-  const target = path17.basename(binDir);
+  const link = path18.join(binRoot, CURRENT_TOOLCHAIN_LINK);
+  const target = path18.basename(binDir);
   await mkdir4(binRoot, { recursive: true, mode: 448 });
   const existing = await lstat2(link).catch(() => null);
   if (existing && !existing.isSymbolicLink()) {
@@ -6150,7 +6150,7 @@ async function pointCurrentAt(rootDir, binDir) {
   }
   if (existing && await readlink2(link) === target)
     return link;
-  const temporary = path17.join(binRoot, `.${CURRENT_TOOLCHAIN_LINK}-${randomUUID5()}.tmp`);
+  const temporary = path18.join(binRoot, `.${CURRENT_TOOLCHAIN_LINK}-${randomUUID5()}.tmp`);
   await symlink3(target, temporary, "dir");
   try {
     await rename3(temporary, link);
@@ -6294,7 +6294,15 @@ var PUBLIC_ACTIONS = {
     effects: ["metadata"],
     observation: "receipt",
     milestone: "B",
-    summary: "Remove an empty project registration; never deletes checkouts or remotes."
+    summary: "Remove a project registration (with cascade, after deleting its environments); never deletes checkouts or remotes."
+  },
+  "project.init": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata", "filesystem"],
+    observation: "receipt",
+    milestone: "B",
+    summary: "Initialize a local-only Git repository (initial commit, no remote) at a backend path and register it."
   },
   "project.config.get": {
     version: 1,
@@ -6459,7 +6467,23 @@ var PUBLIC_ACTIONS = {
     effects: ["provider-session"],
     observation: "run",
     milestone: "C",
-    summary: "Send a follow-up prompt to one explicit idle conversation."
+    summary: "Send a follow-up prompt to one explicit idle conversation, or queue it behind a busy one."
+  },
+  "session.commands": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "C",
+    summary: "List the session's slash-command catalogue (IDs, availability, argument policy)."
+  },
+  "session.command": {
+    version: 1,
+    mutation: true,
+    effects: ["provider-session"],
+    observation: "run",
+    milestone: "C",
+    summary: "Run one selected slash command; a stale or unavailable selection fails, never sends text."
   },
   "session.stop": {
     version: 1,
@@ -6533,6 +6557,14 @@ var PUBLIC_ACTIONS = {
     milestone: "C",
     summary: "Answer one exact pending interaction at an expected revision."
   },
+  "session.interaction.hold": {
+    version: 1,
+    mutation: true,
+    effects: ["provider-session"],
+    observation: "receipt",
+    milestone: "C",
+    summary: "Pause or resume one pending interaction's countdown where its deadline is enforced."
+  },
   "session.transcript": {
     version: 1,
     mutation: false,
@@ -6557,6 +6589,206 @@ var PUBLIC_ACTIONS = {
     milestone: "D",
     summary: "Read one page of a session's turns, each with the backend's change projection."
   },
+  "review.launch": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata", "provider-session"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Start an environment's Multi Review, as the Multi Review button does: reviewers, consolidation, then optional Fix and PR, with saved defaults for what is omitted; an active review is reused."
+  },
+  "review.list": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "List an environment's Multi Reviews, newest first."
+  },
+  "review.get": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "Read one Multi Review: phase, reviewers, consolidation, Fix and PR steps."
+  },
+  "review.open": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Open or focus a Multi Review's root tab or its Fix tab; starts no work."
+  },
+  "review.address": {
+    version: 1,
+    mutation: true,
+    effects: ["provider-session"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Address a Multi Review's findings: hand them to its Fix session (the Address findings button)."
+  },
+  "review.cancel": {
+    version: 1,
+    mutation: true,
+    effects: ["process", "provider-session"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Cancel a running Multi Review; its record and tabs are kept."
+  },
+  "pr.create": {
+    version: 1,
+    mutation: true,
+    effects: ["provider-session", "external-repository"],
+    observation: "run",
+    milestone: "D",
+    summary: "Start the Create PR agent session in an environment (the PR tab): commit, push and open a pull request against the target branch. It never merges."
+  },
+  "pr.resolve": {
+    version: 1,
+    mutation: true,
+    effects: ["provider-session", "external-repository"],
+    observation: "run",
+    milestone: "D",
+    summary: "Start the Resolve Conflicts agent session in an environment (the Resolve tab): merge the target branch, resolve and validate conflicts, commit and push."
+  },
+  "attention.list": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "What needs attention: pending questions and approvals, the caller's runs that settled and environments whose setup finished, since a cursor."
+  },
+  "ticket.list": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "List a project's Kanban tickets."
+  },
+  "ticket.get": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "Read one Kanban ticket with its description, criteria and latest comments."
+  },
+  "ticket.create": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Create a Kanban ticket in a project."
+  },
+  "ticket.update": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Change a Kanban ticket's title, description, criteria or column."
+  },
+  "ticket.comment": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Append a comment to a Kanban ticket."
+  },
+  "mail.mailboxes": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "List agent mailboxes a message can be sent to."
+  },
+  "mail.send": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Place a message in one tab's inbox; external messages are never injected into a turn."
+  },
+  "node.list": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "List this machine and the leaf nodes (remote machines) it controls, and whether each can run actions; pass its nodeId to any other action to run it there."
+  },
+  "schedule.list": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "List scheduled jobs with their next fire time, owner and last outcome."
+  },
+  "schedule.get": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "Read one scheduled job with its bounded fire history."
+  },
+  "schedule.create": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Schedule an action, a prompt to an agent tab or an environment launch, once or on a cron or interval."
+  },
+  "schedule.update": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Change a scheduled job's name, time, time zone, catch-up window or action."
+  },
+  "schedule.pause": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Pause a scheduled job; nothing fires until it is resumed."
+  },
+  "schedule.resume": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Resume a paused scheduled job from its next future slot."
+  },
+  "schedule.run": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Fire a scheduled job now, once, without changing its schedule."
+  },
+  "schedule.delete": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Delete a scheduled job and its history."
+  },
   "run.get": {
     version: 1,
     mutation: false,
@@ -6696,6 +6928,7 @@ var PUBLIC_ERROR_EXIT = {
   "not-found": PUBLIC_EXIT.notFound,
   "ambiguous-target": PUBLIC_EXIT.notFound,
   "history-expired": PUBLIC_EXIT.notFound,
+  "node-not-found": PUBLIC_EXIT.notFound,
   "connection-failed": PUBLIC_EXIT.connection,
   "connection-not-configured": PUBLIC_EXIT.connection,
   "profile-unavailable": PUBLIC_EXIT.connection,
@@ -6703,11 +6936,13 @@ var PUBLIC_ERROR_EXIT = {
   "identity-mismatch": PUBLIC_EXIT.connection,
   "response-invalid": PUBLIC_EXIT.connection,
   "transport-uncertain": PUBLIC_EXIT.connection,
+  "node-unavailable": PUBLIC_EXIT.connection,
   "deadline-exceeded": PUBLIC_EXIT.deadline,
   "observation-interrupted": PUBLIC_SIGNAL_EXIT.SIGINT,
   "interaction-required": PUBLIC_EXIT.interactionRequired,
   "dispatch-unknown": PUBLIC_EXIT.unknownDispatch,
   "run-unknown": PUBLIC_EXIT.unknownDispatch,
+  "node-outcome-unknown": PUBLIC_EXIT.unknownDispatch,
   conflict: PUBLIC_EXIT.conflict,
   "request-conflict": PUBLIC_EXIT.conflict,
   "revision-conflict": PUBLIC_EXIT.conflict,
@@ -6723,7 +6958,8 @@ var PUBLIC_ERROR_EXIT = {
   "target-mismatch": PUBLIC_EXIT.conflict,
   "session-idle": PUBLIC_EXIT.conflict,
   "interaction-stale": PUBLIC_EXIT.conflict,
-  "dispatch-parked": PUBLIC_EXIT.conflict
+  "dispatch-parked": PUBLIC_EXIT.conflict,
+  "node-unsupported": PUBLIC_EXIT.conflict
 };
 function isPublicErrorCode(value) {
   return typeof value === "string" && Object.hasOwn(PUBLIC_ERROR_EXIT, value);
@@ -6752,8 +6988,14 @@ var PUBLIC_API_LIMITS = Object.freeze({
   transcriptTextMaxChars: 20000,
   interactionsMax: 32,
   historyMaxEntries: 100,
+  attentionDefaultItems: 20,
+  attentionMaxItems: 50,
   responseMaxBytes: 8 * 1024 * 1024,
   requestMaxBytes: 1024 * 1024,
+  promptAttachmentsMaxItems: 8,
+  promptAttachmentsMaxBytes: 256 * 1024,
+  promptAttachmentNameMaxChars: 128,
+  commandArgumentsMaxBytes: 64 * 1024,
   execArgvMaxItems: 256,
   execArgvMaxBytes: 256 * 1024,
   execEnvMaxEntries: 64,
@@ -6792,6 +7034,17 @@ var TERMINAL_EXECUTION_PHASES = Object.freeze([
   "cancelled",
   "interrupted"
 ]);
+var PUBLIC_ALL_NODES = "all";
+var PUBLIC_AGGREGATE_ACTIONS = Object.freeze([
+  "project.list",
+  "environment.list",
+  "attention.list"
+]);
+var PUBLIC_LOCAL_ONLY_ACTIONS = Object.freeze(["node.list"]);
+var NODE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/;
+function isPublicNodeTarget(value) {
+  return typeof value === "string" && NODE_ID_PATTERN.test(value);
+}
 function isPublicActionAvailable(capabilities, action) {
   const entry = capabilities.actions[action];
   return entry?.available === true && entry.version === PUBLIC_ACTIONS[action].version;
@@ -6812,7 +7065,7 @@ var OPERATION_STATES = [
 function isPublicReceipt(value) {
   if (!isRecord(value))
     return false;
-  return typeof value.operationId === "string" && value.operationId.length > 0 && typeof value.namespace === "string" && isPublicRequestId(value.requestId) && isPublicActionName(value.action) && OPERATION_STATES.includes(value.state) && typeof value.stage === "string" && typeof value.replayed === "boolean" && isRecord(value.resources) && typeof value.createdAt === "string" && typeof value.updatedAt === "string" && typeof value.retainedUntil === "string" && (value.dispatch === undefined || isRecord(value.dispatch)) && (value.execution === undefined || isRecord(value.execution));
+  return typeof value.operationId === "string" && value.operationId.length > 0 && typeof value.namespace === "string" && isPublicRequestId(value.requestId) && isPublicActionName(value.action) && OPERATION_STATES.includes(value.state) && typeof value.stage === "string" && typeof value.replayed === "boolean" && isRecord(value.resources) && typeof value.createdAt === "string" && typeof value.updatedAt === "string" && typeof value.retainedUntil === "string" && (value.dispatch === undefined || isRecord(value.dispatch)) && (value.execution === undefined || isRecord(value.execution)) && (value.result === undefined || isRecord(value.result));
 }
 function isEnvelopeError(value) {
   return isRecord(value) && isPublicErrorCode(value.code) && typeof value.message === "string" && typeof value.exitCode === "number" && (value.exitCode === exitCodeForError(value.code) || value.code === "observation-interrupted" && value.exitCode === PUBLIC_SIGNAL_EXIT.SIGTERM) && (value.details === undefined || isRecord(value.details));
@@ -6829,6 +7082,9 @@ function isPublicActionResponse(value) {
   if (value.backend !== undefined && !(isRecord(value.backend) && typeof value.backend.installationId === "string" && typeof value.backend.generation === "string")) {
     return false;
   }
+  if (value.node !== undefined && !(isRecord(value.node) && typeof value.node.nodeId === "string" && typeof value.node.name === "string")) {
+    return false;
+  }
   if (value.ok === true) {
     return Object.hasOwn(value, "result") && value.error === undefined && (value.warnings === undefined || Array.isArray(value.warnings) && value.warnings.every((w) => typeof w === "string"));
   }
@@ -6873,6 +7129,7 @@ function parsePublicDuration(value) {
 // src/client/errors.ts
 class CliError extends Error {
   code;
+  node;
   details;
   receipt;
   retryable;
@@ -6881,6 +7138,7 @@ class CliError extends Error {
     super(message);
     this.name = "CliError";
     this.code = code;
+    this.node = options2.node;
     this.details = options2.details;
     this.receipt = options2.receipt;
     this.retryable = options2.retryable;
@@ -6902,6 +7160,12 @@ var GLOBAL_OPTIONS = [
     valueName: "NAME",
     description: "Use a running isolated development profile (`mise run dev:test`)."
   },
+  {
+    name: "node",
+    kind: "string",
+    valueName: "NODE_ID|all",
+    description: "Run on a leaf node the connected command node controls (`node list`); `all` for project list, environment list and attention across nodes."
+  },
   { name: "json", kind: "boolean", description: "Print exactly one JSON envelope on stdout." },
   {
     name: "output",
@@ -7100,6 +7364,12 @@ function parseInvocation(tree, argv) {
   }
   if (typeof globalState.values.profile === "string")
     global2.profile = globalState.values.profile;
+  if (typeof globalState.values.node === "string") {
+    if (!isPublicNodeTarget(globalState.values.node)) {
+      throw new CliError("invalid-input", "--node expects a node ID from `node list`, or all");
+    }
+    global2.node = globalState.values.node;
+  }
   if (global2.connection && global2.profile) {
     throw new CliError("invalid-input", "--connection and --profile select different backends; pass only one");
   }
@@ -7444,7 +7714,7 @@ import path4 from "path";
 // ../../apps/backend/package.json
 var package_default = {
   name: "@orkestrator/backend",
-  version: "2.29.0-beta",
+  version: "2.31.0-beta",
   private: true,
   type: "module",
   exports: {
@@ -7459,7 +7729,7 @@ var package_default = {
     "start:web-public": "bun dist/main.js --tailscale-serve --allowed-origins https://orkestrator.dev,https://www.orkestrator.dev",
     test: "bun test --preload ../../tests/setup-node.ts src tests --parallel",
     "test:workspace": "bun test --preload ../../tests/setup-node.ts src tests --only-failures ${ORKESTRATOR_TEST_TIMINGS_DIR:+--timings=$ORKESTRATOR_TEST_TIMINGS_DIR/backend.json --update-timings} $ORKESTRATOR_BACKEND_TEST_IGNORE --parallel=${ORKESTRATOR_BACKEND_TEST_WORKERS:-${ORKESTRATOR_TEST_WORKERS:-2}}",
-    typecheck: "bunx tsc --noEmit -p tsconfig.json && bunx tsc --noEmit -p tsconfig.test.json"
+    typecheck: "bun check -p tsconfig.json && bun check -p tsconfig.test.json"
   },
   dependencies: {
     "@modelcontextprotocol/node": "2.1.1",
@@ -7998,247 +8268,15 @@ function runFixProcess(argv, version) {
   });
 }
 
-// ../protocol/src/public-api-resources.ts
-var PUBLIC_CHANGE_SCOPES = Object.freeze(["environment"]);
-var AGENT_PLATFORM_KEYS = ["claude", "codex", "cursor", "grok", "opencode", "pi"];
-function agentSettingDescriptors(scope) {
-  const application = "next-session";
-  return [
-    {
-      key: "agent.defaultAgent",
-      scope,
-      type: "agent",
-      inherits: true,
-      application,
-      description: "Agent platform used when a launch does not name one."
-    },
-    ...AGENT_PLATFORM_KEYS.flatMap((platform) => [
-      {
-        key: `agent.${platform}.mode`,
-        scope,
-        type: "agent-mode",
-        inherits: true,
-        application,
-        description: `Launch mode (native or terminal) for ${platform}.`
-      },
-      {
-        key: `agent.${platform}.model`,
-        scope,
-        type: "string",
-        inherits: true,
-        application,
-        description: `Default model for new ${platform} sessions.`
-      },
-      {
-        key: `agent.${platform}.reasoningEffort`,
-        scope,
-        type: "string",
-        inherits: true,
-        application,
-        description: `Default reasoning level for new ${platform} sessions.`
-      },
-      {
-        key: `agent.${platform}.fastMode`,
-        scope,
-        type: "boolean",
-        inherits: true,
-        application,
-        description: `Default speed for new ${platform} sessions (true is Fast).`
-      }
-    ])
-  ];
-}
-var PUBLIC_PROJECT_SETTINGS = Object.freeze([
-  {
-    key: "defaultBranch",
-    scope: "project",
-    type: "string",
-    inherits: false,
-    application: "next-environment",
-    description: "Branch new environments are created from."
-  },
-  {
-    key: "prBaseBranch",
-    scope: "project",
-    type: "string",
-    inherits: false,
-    application: "applied",
-    description: "Base branch for pull requests and diff baselines."
-  },
-  {
-    key: "defaultPortMappings",
-    scope: "project",
-    type: "port-mappings",
-    inherits: false,
-    environmentTypes: ["container"],
-    application: "next-environment",
-    description: "Port mappings copied into new container environments."
-  },
-  {
-    key: "filesToCopy",
-    scope: "project",
-    type: "string-list",
-    inherits: false,
-    application: "next-environment",
-    description: "Untracked files copied into new environments."
-  },
-  {
-    key: "entryPort",
-    scope: "project",
-    type: "port",
-    inherits: false,
-    application: "next-environment",
-    description: "Default preview entry port for new environments."
-  },
-  ...agentSettingDescriptors("project")
-]);
-var PUBLIC_ENVIRONMENT_SETTINGS = Object.freeze([
-  {
-    key: "portMappings",
-    scope: "environment",
-    type: "port-mappings",
-    inherits: false,
-    environmentTypes: ["container"],
-    application: "next-start",
-    description: "Container port mappings; a running container adopts them on recreate."
-  },
-  {
-    key: "allowedDomains",
-    scope: "environment",
-    type: "domain-list",
-    inherits: true,
-    environmentTypes: ["container"],
-    application: "next-start",
-    description: "Restricted-network allowlist; unset inherits the global list. A running container whose image supports it applies the change immediately (reported as applied)."
-  },
-  ...agentSettingDescriptors("environment")
-]);
-
-// src/client/format.ts
-function table(headers, rows) {
-  if (rows.length === 0)
-    return ["(none)"];
-  const widths = headers.map((header, index) => Math.min(60, Math.max(header.length, ...rows.map((row) => (row[index] ?? "").length))));
-  const line = (cells) => cells.map((cell, index) => {
-    const text = cell.length > widths[index] ? `${cell.slice(0, widths[index] - 1)}\u2026` : cell;
-    return text.padEnd(widths[index]);
-  }).join("  ").trimEnd();
-  return [line(headers), ...rows.map(line)];
-}
-function keyValues(entries) {
-  const width = Math.max(...entries.map(([key]) => key.length));
-  return entries.filter(([, value]) => value !== undefined).map(([key, value]) => {
-    const text = value === null ? "-" : typeof value === "object" ? JSON.stringify(value) : String(value);
-    return `${key.padEnd(width)}  ${text}`;
-  });
-}
-function projectLines(project) {
-  return keyValues([
-    ["id", project.id],
-    ["name", project.name],
-    ["remote", project.gitUrl],
-    ["path", project.localPath],
-    ["folder", project.folder],
-    ["environments", project.environmentCount],
-    ["revision", project.revision]
-  ]);
-}
-function projectRows(projects) {
-  return table(["ID", "NAME", "ENVS", "PATH"], projects.map((project) => [
-    project.id,
-    project.name,
-    String(project.environmentCount),
-    project.localPath ?? "-"
-  ]));
-}
-function environmentLines(environment) {
-  return keyValues([
-    ["id", environment.id],
-    ["project", environment.projectId],
-    ["name", environment.name],
-    ["branch", environment.branch],
-    ["type", environment.environmentType],
-    ["status", environment.status],
-    ["ready", environment.ready],
-    ["setup", `${environment.setup.phase}${environment.setup.overridden ? " (overridden)" : ""}`],
-    ["activity", environment.activity.state],
-    ["lifecycle error", environment.lifecycle.error],
-    ["workspace", environment.workspacePath],
-    ["base", environment.base.commit ?? environment.base.branch],
-    ["startup session", environment.startupSession?.sessionId]
-  ]);
-}
-function environmentRows(environments) {
-  return table(["ID", "NAME", "TYPE", "STATUS", "READY"], environments.map((environment) => [
-    environment.id,
-    environment.name,
-    environment.environmentType,
-    environment.status,
-    environment.ready ? "yes" : "no"
-  ]));
-}
-function sessionRows(sessions) {
-  return table(["SESSION", "AGENT", "TAB", "ACTIVITY", "TITLE"], sessions.map((session) => [
-    session.id,
-    session.agent,
-    session.tabId,
-    session.activity,
-    session.title ?? ""
-  ]));
-}
-function sessionLines(session) {
-  return keyValues([
-    ["id", session.id],
-    ["environment", session.environmentId],
-    ["tab", session.tabId],
-    ["agent", session.agent],
-    ["title", session.title],
-    ["activity", session.activity],
-    ["latest request", session.latestRequestId],
-    ["pending interactions", session.pendingInteractionCount],
-    ["recoverable dispatch", session.recoverableDispatch]
-  ]);
-}
-function receiptLines(receipt) {
-  return keyValues([
-    ["operation", receipt.operationId],
-    ["action", receipt.action],
-    ["state", receipt.state],
-    ["stage", receipt.stage],
-    ["request", `${receipt.requestId} (${receipt.namespace})`],
-    ["replayed", receipt.replayed],
-    ["resources", receipt.resources],
-    ["dispatch", receipt.dispatch?.state],
-    ["execution", receipt.execution?.state],
-    ["evidence", receipt.execution?.evidence],
-    ["exit code", receipt.execution?.exitCode],
-    ["error", receipt.error ? `${receipt.error.code}: ${receipt.error.message}` : undefined],
-    ["updated", receipt.updatedAt],
-    ["retained until", receipt.retainedUntil]
-  ]);
-}
-function settingsLines(snapshot) {
-  return [
-    `revision ${snapshot.revision}`,
-    ...table(["KEY", "VALUE", "EFFECTIVE", "SOURCE", "APPLIES"], snapshot.settings.map((setting) => [
-      setting.key,
-      setting.value === null || setting.value === undefined ? "-" : JSON.stringify(setting.value),
-      setting.effective === null || setting.effective === undefined ? "-" : JSON.stringify(setting.effective),
-      setting.source,
-      setting.application
-    ]))
-  ];
-}
-
-// src/client/wait.ts
-class ObservationStopped extends Error {
-  reason;
-  signalName;
-  constructor(reason, signalName) {
-    super(reason === "deadline" ? "Observation deadline passed" : "Observation interrupted");
-    this.reason = reason;
-    this.signalName = signalName;
-  }
+// src/client/wait.ts
+class ObservationStopped extends Error {
+  reason;
+  signalName;
+  constructor(reason, signalName) {
+    super(reason === "deadline" ? "Observation deadline passed" : "Observation interrupted");
+    this.reason = reason;
+    this.signalName = signalName;
+  }
 }
 function defaultSleep(ms, signal) {
   return new Promise((resolve) => {
@@ -8284,6 +8322,61 @@ async function observe(check, options2) {
   }
 }
 
+// ../protocol/src/public-api-wait.ts
+function isTerminalPublicReceipt(receipt) {
+  return !["admitted", "running", "unknown"].includes(receipt.state);
+}
+function classifyReceiptForWait(receipt, options2 = {}) {
+  if (isTerminalPublicReceipt(receipt)) {
+    return { kind: "terminal", succeeded: receipt.state === "succeeded" };
+  }
+  const execution = receipt.execution;
+  if (execution?.state === "waiting-for-input" && !options2.continueOnInteraction) {
+    return {
+      kind: "stopped",
+      code: "interaction-required",
+      message: "The run is waiting for an answer to a pending interaction",
+      interactions: execution.interactions ?? []
+    };
+  }
+  if (receipt.state === "unknown" && receipt.dispatch?.state === "unknown") {
+    return {
+      kind: "stopped",
+      code: "dispatch-unknown",
+      message: "The provider may or may not have received the prompt; retry it under the same key or discard it",
+      retryable: true
+    };
+  }
+  if (receipt.state === "unknown") {
+    return {
+      kind: "stopped",
+      code: "run-unknown",
+      message: receipt.error?.message ?? "The outcome of this run is not known"
+    };
+  }
+  if (execution?.state === "unsupported") {
+    return {
+      kind: "stopped",
+      code: "capability-unavailable",
+      message: execution.reason ?? "Completion of this run cannot be observed for its provider"
+    };
+  }
+  return { kind: "pending" };
+}
+function terminalReceiptErrorCode(receipt) {
+  if (receipt.state === "succeeded")
+    return null;
+  if (receipt.state === "partial")
+    return "partial-failure";
+  if (receipt.state === "cancelled")
+    return "run-cancelled";
+  if (receipt.state === "interrupted")
+    return "run-interrupted";
+  if (receipt.state === "unknown")
+    return "run-unknown";
+  return receipt.error?.code ?? "operation-failed";
+}
+
 // src/client/commands/common.ts
 var REQUEST_ID_OPTION = {
   name: "request-id",
@@ -8343,7 +8436,7 @@ async function submitForWait(context, action, input, options2, timeoutMs) {
   } catch (error) {
     const requestId = error instanceof CliError ? error.details?.requestId : undefined;
     const namespace = error instanceof CliError ? error.details?.namespace : undefined;
-    if (!(error instanceof CliError) || error.code !== "transport-uncertain" || typeof requestId !== "string" || typeof namespace !== "string")
+    if (!(error instanceof CliError) || !["transport-uncertain", "node-outcome-unknown"].includes(error.code) || typeof requestId !== "string" || typeof namespace !== "string")
       throw error;
     let receipt;
     try {
@@ -8387,139 +8480,485 @@ async function submitForWait(context, action, input, options2, timeoutMs) {
     };
   }
 }
-async function readOperation(session, operationId, timeoutMs) {
-  const { receipt } = await session.readWithReceipt("run.get", { operationId }, timeoutMs);
-  if (!receipt)
-    throw new CliError("response-invalid", "run.get returned no receipt");
-  return receipt;
+async function readOperation(session, operationId, timeoutMs) {
+  const { receipt } = await session.readWithReceipt("run.get", { operationId }, timeoutMs);
+  if (!receipt)
+    throw new CliError("response-invalid", "run.get returned no receipt");
+  return receipt;
+}
+function isTerminalReceipt(receipt) {
+  return isTerminalPublicReceipt(receipt);
+}
+function stoppedError(error, action, receipt, what) {
+  if (error.reason === "signal") {
+    return new CliError("observation-interrupted", `Stopped observing ${what}; it continues in the backend`, {
+      action,
+      ...receipt ? { receipt } : {},
+      details: { signal: error.signalName ?? "SIGINT" }
+    });
+  }
+  return new CliError("deadline-exceeded", `Timed out observing ${what}; it continues in the backend`, {
+    action,
+    ...receipt ? { receipt } : {}
+  });
+}
+function receiptFailure(receipt) {
+  const code = terminalReceiptErrorCode(receipt);
+  if (!code)
+    return;
+  const message = receipt.error?.message ?? `Operation ended ${receipt.state}`;
+  return new CliError(code, message, { receipt, action: receipt.action });
+}
+var CLI_STOP_MESSAGES = {
+  "dispatch-unknown": "The provider may or may not have received the prompt; use `run retry` (same key) or `run discard`"
+};
+async function waitForOperation(context, session, initial, timeoutMs, options2 = {}) {
+  let latest = initial;
+  const deadline = Date.now() + timeoutMs;
+  try {
+    return await observe(async () => {
+      if (Date.now() >= deadline)
+        throw new ObservationStopped("deadline");
+      try {
+        latest = await readOperation(session, initial.operationId, Math.max(1, deadline - Date.now()));
+      } catch (error) {
+        if (context.signal?.aborted)
+          throw new ObservationStopped("signal", signalName(context.signal));
+        if (Date.now() >= deadline && error instanceof CliError && error.code === "connection-failed")
+          throw new ObservationStopped("deadline");
+        throw error;
+      }
+      const verdict = classifyReceiptForWait(latest, options2);
+      if (verdict.kind === "terminal")
+        return { done: true, value: latest };
+      if (verdict.kind === "stopped") {
+        throw new CliError(verdict.code, CLI_STOP_MESSAGES[verdict.code] ?? verdict.message, {
+          receipt: latest,
+          action: latest.action,
+          ...verdict.retryable ? { retryable: true } : {},
+          ...verdict.interactions ? { details: { interactions: verdict.interactions } } : {}
+        });
+      }
+      return { done: false };
+    }, { timeoutMs, signal: context.signal });
+  } catch (error) {
+    if (error instanceof ObservationStopped) {
+      throw stoppedError(error, latest.action, latest, "the operation");
+    }
+    throw error;
+  }
+}
+async function waitForEnvironment(context, session, environmentId, condition, receipt, timeoutMs) {
+  let latestReceipt = receipt;
+  const conditionMet = (environment) => {
+    if (condition === "deleted")
+      return environment === null;
+    if (!environment)
+      return false;
+    if (condition === "running")
+      return environment.status === "running";
+    if (condition === "stopped")
+      return environment.status === "stopped";
+    return environment.ready;
+  };
+  try {
+    return await observe(async () => {
+      if (latestReceipt && !isTerminalReceipt(latestReceipt)) {
+        latestReceipt = await readOperation(session, latestReceipt.operationId);
+      }
+      if (latestReceipt && isTerminalReceipt(latestReceipt)) {
+        const failure = receiptFailure(latestReceipt);
+        if (failure)
+          throw failure;
+      }
+      let environment;
+      try {
+        environment = await session.read("environment.get", {
+          environmentId
+        });
+      } catch (error) {
+        if (error instanceof CliError && error.code === "not-found")
+          environment = null;
+        else
+          throw error;
+      }
+      if (condition !== "deleted" && !environment) {
+        throw new CliError("not-found", "The environment no longer exists", latestReceipt ? { receipt: latestReceipt } : {});
+      }
+      if (environment && (condition === "ready" || condition === "running")) {
+        if (environment.setup.phase === "failed" || environment.status === "error") {
+          throw new CliError("setup-failed", environment.lifecycle.error ?? "Environment setup failed", { ...latestReceipt ? { receipt: latestReceipt } : {}, details: { environmentId } });
+        }
+      }
+      const operationSettled = !latestReceipt || isTerminalReceipt(latestReceipt) || condition === "running" && latestReceipt.stage === "setup";
+      if (operationSettled && conditionMet(environment)) {
+        return {
+          done: true,
+          value: { environment, ...latestReceipt ? { receipt: latestReceipt } : {} }
+        };
+      }
+      return { done: false };
+    }, { timeoutMs, signal: context.signal });
+  } catch (error) {
+    if (error instanceof ObservationStopped) {
+      throw stoppedError(error, latestReceipt?.action ?? "environment.get", latestReceipt, `the environment (${condition})`);
+    }
+    throw error;
+  }
+}
+
+// src/client/commands/attention.ts
+function attentionLine(item) {
+  const tagged = item;
+  const prefix = tagged.nodeId ? `[${tagged.nodeName ?? tagged.nodeId} --node ${tagged.nodeId}]  ` : "";
+  return prefix + attentionDetail(item);
+}
+function attentionDetail(item) {
+  if (item.kind === "interaction") {
+    return `${item.blocking ? "waiting" : "pending"}  ${item.agent} in ${item.environmentName}: ${item.title}  (${item.sessionId} ${item.interactionId} rev ${item.revision})`;
+  }
+  if (item.kind === "setup") {
+    return `setup ${item.phase}  ${item.environmentName}  (${item.environmentId})`;
+  }
+  return `run ${item.state}  ${item.action}${item.errorCode ? ` ${item.errorCode}` : ""}  (${item.operationId})`;
+}
+function itemKey(item) {
+  if (item.kind === "interaction")
+    return `${item.nodeId ?? ""}:interaction:${item.interactionId}:${item.revision}`;
+  if (item.kind === "setup")
+    return `${item.nodeId ?? ""}:setup:${item.environmentId}:${item.at}`;
+  return `${item.nodeId ?? ""}:run:${item.operationId}:${item.state}`;
+}
+var attentionCommands = [
+  {
+    path: ["attention"],
+    action: "attention.list",
+    summary: "What needs attention: questions, approvals, settled runs, finished setups.",
+    description: "Lists pending questions and approvals (always), and the runs this client started and setups that finished since --cursor (default: the last hour). --follow --jsonl polls and prints each new item once, which is how a voice runtime or notifier can hear about work without asking; it stops at --timeout or Ctrl+C and never changes anything.",
+    positionals: [],
+    options: [
+      {
+        name: "cursor",
+        kind: "string",
+        valueName: "CURSOR",
+        description: "cursor from a previous read: only what changed since."
+      },
+      { name: "limit", kind: "integer", valueName: "N", description: "Most items (max 50)." },
+      {
+        name: "follow",
+        kind: "boolean",
+        description: "Keep polling and print new items (use --jsonl for machines)."
+      },
+      TIMEOUT_OPTION
+    ],
+    jsonl: true,
+    async run(context, parsed) {
+      const session = await context.session();
+      const input = {};
+      if (parsed.options.cursor !== undefined)
+        input.cursor = parsed.options.cursor;
+      if (parsed.options.limit !== undefined)
+        input.limit = parsed.options.limit;
+      if (parsed.options.follow === true && context.global.node === "all") {
+        throw new CliError("invalid-input", "--follow follows one node; pass its --node");
+      }
+      if (parsed.options.follow !== true) {
+        if (context.global.output === "jsonl") {
+          throw new CliError("invalid-input", "--jsonl needs --follow");
+        }
+        const page = await session.read("attention.list", input);
+        return {
+          action: "attention.list",
+          result: page,
+          connection: session.identity,
+          human: [
+            ...page.items.length ? page.items.map(attentionLine) : ["Nothing needs attention."],
+            ...page.more ? [`and ${page.more} more (raise --limit)`] : [],
+            ...page.cursor ? [`cursor: ${page.cursor}`] : (page.nodes ?? []).filter((node) => node.cursor).map((node) => `cursor (${node.name}): ${node.cursor}`)
+          ]
+        };
+      }
+      const seen = new Set;
+      let cursor = input.cursor;
+      let emitted = 0;
+      try {
+        await observe(async () => {
+          const page = await session.read("attention.list", {
+            ...input,
+            ...cursor ? { cursor } : {}
+          });
+          cursor = page.cursor;
+          for (const item of page.items) {
+            const key = itemKey(item);
+            if (seen.has(key))
+              continue;
+            seen.add(key);
+            emitted += 1;
+            if (context.global.output === "jsonl") {
+              context.io.stdout(`${JSON.stringify({ type: "attention", item })}
+`);
+            } else if (context.global.output === "human") {
+              context.io.stdout(`${attentionLine(item)}
+`);
+            }
+          }
+          if (seen.size > 1e4)
+            seen.clear();
+          return { done: false };
+        }, {
+          timeoutMs: parsed.options.timeout ?? DEFAULT_WAIT_MS,
+          signal: context.signal
+        });
+      } catch (error) {
+        if (!(error instanceof ObservationStopped))
+          throw error;
+      }
+      return {
+        action: "attention.list",
+        result: { followed: true, emitted, cursor: cursor ?? null },
+        connection: session.identity,
+        human: []
+      };
+    }
+  }
+];
+
+// ../protocol/src/public-api-resources.ts
+var PUBLIC_CHANGE_SCOPES = Object.freeze(["environment"]);
+var AGENT_PLATFORM_KEYS = ["claude", "codex", "cursor", "grok", "opencode", "pi"];
+function agentSettingDescriptors(scope) {
+  const application = "next-session";
+  return [
+    {
+      key: "agent.defaultAgent",
+      scope,
+      type: "agent",
+      inherits: true,
+      application,
+      description: "Agent platform used when a launch does not name one."
+    },
+    ...AGENT_PLATFORM_KEYS.flatMap((platform) => [
+      {
+        key: `agent.${platform}.mode`,
+        scope,
+        type: "agent-mode",
+        inherits: true,
+        application,
+        description: `Launch mode (native or terminal) for ${platform}.`
+      },
+      {
+        key: `agent.${platform}.model`,
+        scope,
+        type: "string",
+        inherits: true,
+        application,
+        description: `Default model for new ${platform} sessions.`
+      },
+      {
+        key: `agent.${platform}.reasoningEffort`,
+        scope,
+        type: "string",
+        inherits: true,
+        application,
+        description: `Default reasoning level for new ${platform} sessions.`
+      },
+      {
+        key: `agent.${platform}.fastMode`,
+        scope,
+        type: "boolean",
+        inherits: true,
+        application,
+        description: `Default speed for new ${platform} sessions (true is Fast).`
+      }
+    ])
+  ];
+}
+var PUBLIC_PROJECT_SETTINGS = Object.freeze([
+  {
+    key: "defaultBranch",
+    scope: "project",
+    type: "string",
+    inherits: false,
+    application: "next-environment",
+    description: "Branch new environments are created from."
+  },
+  {
+    key: "prBaseBranch",
+    scope: "project",
+    type: "string",
+    inherits: false,
+    application: "applied",
+    description: "Base branch for pull requests and diff baselines."
+  },
+  {
+    key: "defaultPortMappings",
+    scope: "project",
+    type: "port-mappings",
+    inherits: false,
+    environmentTypes: ["container"],
+    application: "next-environment",
+    description: "Port mappings copied into new container environments."
+  },
+  {
+    key: "filesToCopy",
+    scope: "project",
+    type: "string-list",
+    inherits: false,
+    application: "next-environment",
+    description: "Untracked files copied into new environments."
+  },
+  {
+    key: "entryPort",
+    scope: "project",
+    type: "port",
+    inherits: false,
+    application: "next-environment",
+    description: "Default preview entry port for new environments."
+  },
+  ...agentSettingDescriptors("project")
+]);
+var PUBLIC_ENVIRONMENT_SETTINGS = Object.freeze([
+  {
+    key: "portMappings",
+    scope: "environment",
+    type: "port-mappings",
+    inherits: false,
+    environmentTypes: ["container"],
+    application: "next-start",
+    description: "Container port mappings; a running container adopts them on recreate."
+  },
+  {
+    key: "allowedDomains",
+    scope: "environment",
+    type: "domain-list",
+    inherits: true,
+    environmentTypes: ["container"],
+    application: "next-start",
+    description: "Restricted-network allowlist; unset inherits the global list. A running container whose image supports it applies the change immediately (reported as applied)."
+  },
+  ...agentSettingDescriptors("environment")
+]);
+
+// src/client/format.ts
+function table(headers, rows) {
+  if (rows.length === 0)
+    return ["(none)"];
+  const widths = headers.map((header, index) => Math.min(60, Math.max(header.length, ...rows.map((row) => (row[index] ?? "").length))));
+  const line = (cells) => cells.map((cell, index) => {
+    const text = cell.length > widths[index] ? `${cell.slice(0, widths[index] - 1)}\u2026` : cell;
+    return text.padEnd(widths[index]);
+  }).join("  ").trimEnd();
+  return [line(headers), ...rows.map(line)];
+}
+function keyValues(entries) {
+  const width = Math.max(...entries.map(([key]) => key.length));
+  return entries.filter(([, value]) => value !== undefined).map(([key, value]) => {
+    const text = value === null ? "-" : typeof value === "object" ? JSON.stringify(value) : String(value);
+    return `${key.padEnd(width)}  ${text}`;
+  });
+}
+function projectLines(project) {
+  return keyValues([
+    ["id", project.id],
+    ["name", project.name],
+    ["remote", project.gitUrl],
+    ["path", project.localPath],
+    ["folder", project.folder],
+    ["environments", project.environmentCount],
+    ["revision", project.revision]
+  ]);
 }
-function isTerminalReceipt(receipt) {
-  return !["admitted", "running", "unknown"].includes(receipt.state);
+function withNodeColumn(items, headers, rows) {
+  const names = items.map((item) => item.nodeName);
+  if (!names.some((name) => typeof name === "string"))
+    return table(headers, rows);
+  return table(["NODE", ...headers], rows.map((row, index) => [String(names[index] ?? ""), ...row]));
 }
-function stoppedError(error, action, receipt, what) {
-  if (error.reason === "signal") {
-    return new CliError("observation-interrupted", `Stopped observing ${what}; it continues in the backend`, {
-      action,
-      ...receipt ? { receipt } : {},
-      details: { signal: error.signalName ?? "SIGINT" }
-    });
-  }
-  return new CliError("deadline-exceeded", `Timed out observing ${what}; it continues in the backend`, {
-    action,
-    ...receipt ? { receipt } : {}
-  });
+function projectRows(projects) {
+  return withNodeColumn(projects, ["ID", "NAME", "ENVS", "PATH"], projects.map((project) => [
+    project.id,
+    project.name,
+    String(project.environmentCount),
+    project.localPath ?? "-"
+  ]));
 }
-function receiptFailure(receipt) {
-  if (receipt.state === "succeeded")
-    return;
-  const message = receipt.error?.message ?? `Operation ended ${receipt.state}`;
-  const code = receipt.state === "partial" ? "partial-failure" : receipt.state === "cancelled" ? "run-cancelled" : receipt.state === "interrupted" ? "run-interrupted" : receipt.state === "unknown" ? "run-unknown" : receipt.error?.code ?? "operation-failed";
-  return new CliError(code, message, { receipt, action: receipt.action });
+function environmentLines(environment) {
+  return keyValues([
+    ["id", environment.id],
+    ["project", environment.projectId],
+    ["name", environment.name],
+    ["branch", environment.branch],
+    ["type", environment.environmentType],
+    ["status", environment.status],
+    ["ready", environment.ready],
+    ["setup", `${environment.setup.phase}${environment.setup.overridden ? " (overridden)" : ""}`],
+    ["activity", environment.activity.state],
+    ["lifecycle error", environment.lifecycle.error],
+    ["workspace", environment.workspacePath],
+    ["base", environment.base.commit ?? environment.base.branch],
+    ["startup session", environment.startupSession?.sessionId]
+  ]);
 }
-async function waitForOperation(context, session, initial, timeoutMs, options2 = {}) {
-  let latest = initial;
-  const deadline = Date.now() + timeoutMs;
-  try {
-    return await observe(async () => {
-      if (Date.now() >= deadline)
-        throw new ObservationStopped("deadline");
-      try {
-        latest = await readOperation(session, initial.operationId, Math.max(1, deadline - Date.now()));
-      } catch (error) {
-        if (context.signal?.aborted)
-          throw new ObservationStopped("signal", signalName(context.signal));
-        if (Date.now() >= deadline && error instanceof CliError && error.code === "connection-failed")
-          throw new ObservationStopped("deadline");
-        throw error;
-      }
-      if (isTerminalReceipt(latest))
-        return { done: true, value: latest };
-      const execution = latest.execution;
-      if (execution?.state === "waiting-for-input" && !options2.continueOnInteraction) {
-        throw new CliError("interaction-required", "The run is waiting for an answer to a pending interaction", {
-          receipt: latest,
-          action: latest.action,
-          details: { interactions: execution.interactions ?? [] }
-        });
-      }
-      if (latest.state === "unknown" && latest.dispatch?.state === "unknown") {
-        throw new CliError("dispatch-unknown", "The provider may or may not have received the prompt; use `run retry` (same key) or `run discard`", { receipt: latest, action: latest.action, retryable: true });
-      }
-      if (latest.state === "unknown") {
-        throw new CliError("run-unknown", latest.error?.message ?? "The outcome of this run is not known", {
-          receipt: latest,
-          action: latest.action
-        });
-      }
-      if (execution?.state === "unsupported") {
-        throw new CliError("capability-unavailable", execution.reason ?? "Completion of this run cannot be observed for its provider", { receipt: latest, action: latest.action });
-      }
-      return { done: false };
-    }, { timeoutMs, signal: context.signal });
-  } catch (error) {
-    if (error instanceof ObservationStopped) {
-      throw stoppedError(error, latest.action, latest, "the operation");
-    }
-    throw error;
-  }
+function environmentRows(environments) {
+  return withNodeColumn(environments, ["ID", "NAME", "TYPE", "STATUS", "READY"], environments.map((environment) => [
+    environment.id,
+    environment.name,
+    environment.environmentType,
+    environment.status,
+    environment.ready ? "yes" : "no"
+  ]));
 }
-async function waitForEnvironment(context, session, environmentId, condition, receipt, timeoutMs) {
-  let latestReceipt = receipt;
-  const conditionMet = (environment) => {
-    if (condition === "deleted")
-      return environment === null;
-    if (!environment)
-      return false;
-    if (condition === "running")
-      return environment.status === "running";
-    if (condition === "stopped")
-      return environment.status === "stopped";
-    return environment.ready;
-  };
-  try {
-    return await observe(async () => {
-      if (latestReceipt && !isTerminalReceipt(latestReceipt)) {
-        latestReceipt = await readOperation(session, latestReceipt.operationId);
-      }
-      if (latestReceipt && isTerminalReceipt(latestReceipt)) {
-        const failure = receiptFailure(latestReceipt);
-        if (failure)
-          throw failure;
-      }
-      let environment;
-      try {
-        environment = await session.read("environment.get", {
-          environmentId
-        });
-      } catch (error) {
-        if (error instanceof CliError && error.code === "not-found")
-          environment = null;
-        else
-          throw error;
-      }
-      if (condition !== "deleted" && !environment) {
-        throw new CliError("not-found", "The environment no longer exists", latestReceipt ? { receipt: latestReceipt } : {});
-      }
-      if (environment && (condition === "ready" || condition === "running")) {
-        if (environment.setup.phase === "failed" || environment.status === "error") {
-          throw new CliError("setup-failed", environment.lifecycle.error ?? "Environment setup failed", { ...latestReceipt ? { receipt: latestReceipt } : {}, details: { environmentId } });
-        }
-      }
-      const operationSettled = !latestReceipt || isTerminalReceipt(latestReceipt) || condition === "running" && latestReceipt.stage === "setup";
-      if (operationSettled && conditionMet(environment)) {
-        return {
-          done: true,
-          value: { environment, ...latestReceipt ? { receipt: latestReceipt } : {} }
-        };
-      }
-      return { done: false };
-    }, { timeoutMs, signal: context.signal });
-  } catch (error) {
-    if (error instanceof ObservationStopped) {
-      throw stoppedError(error, latestReceipt?.action ?? "environment.get", latestReceipt, `the environment (${condition})`);
-    }
-    throw error;
-  }
+function sessionRows(sessions) {
+  return table(["SESSION", "AGENT", "TAB", "ACTIVITY", "TITLE"], sessions.map((session) => [
+    session.id,
+    session.agent,
+    session.tabId,
+    session.activity,
+    session.title ?? ""
+  ]));
+}
+function sessionLines(session) {
+  return keyValues([
+    ["id", session.id],
+    ["environment", session.environmentId],
+    ["tab", session.tabId],
+    ["agent", session.agent],
+    ["title", session.title],
+    ["activity", session.activity],
+    ["latest request", session.latestRequestId],
+    ["pending interactions", session.pendingInteractionCount],
+    ["recoverable dispatch", session.recoverableDispatch]
+  ]);
+}
+function receiptLines(receipt) {
+  return keyValues([
+    ["operation", receipt.operationId],
+    ["action", receipt.action],
+    ["state", receipt.state],
+    ["stage", receipt.stage],
+    ["request", `${receipt.requestId} (${receipt.namespace})`],
+    ["replayed", receipt.replayed],
+    ["resources", receipt.resources],
+    ["dispatch", receipt.dispatch?.state],
+    ["execution", receipt.execution?.state],
+    ["evidence", receipt.execution?.evidence],
+    ["exit code", receipt.execution?.exitCode],
+    ["error", receipt.error ? `${receipt.error.code}: ${receipt.error.message}` : undefined],
+    ["updated", receipt.updatedAt],
+    ["retained until", receipt.retainedUntil]
+  ]);
+}
+function settingsLines(snapshot) {
+  return [
+    `revision ${snapshot.revision}`,
+    ...table(["KEY", "VALUE", "EFFECTIVE", "SOURCE", "APPLIES"], snapshot.settings.map((setting) => [
+      setting.key,
+      setting.value === null || setting.value === undefined ? "-" : JSON.stringify(setting.value),
+      setting.effective === null || setting.effective === undefined ? "-" : JSON.stringify(setting.effective),
+      setting.source,
+      setting.application
+    ]))
+  ];
 }
 
 // src/client/commands/changes.ts
@@ -8625,6 +9064,7 @@ function changesHistoryLines(history) {
 var changesCommands = [
   {
     path: ["changes", "view"],
+    action: "changes.view",
     summary: "Show an environment's file and line changes as the backend measures them.",
     description: "Read-only: prints the backend's change projection for the environment \u2014 the numbers the desktop shows \u2014 and one page of changed files. Counts carry their quality: ~ partial or estimated, ? unknown, \u2265/\u2264 a bound; binary files and submodules have no line counts. Nothing is ever shown as zero unless the backend measured zero. Pass the printed cursor as --cursor for the next page; a cursor stops working once the changes move on. --json prints the action result verbatim ({projection, files}).",
     positionals: [{ name: "environment", required: true, description: "Environment ID." }],
@@ -8674,6 +9114,7 @@ var changesCommands = [
   },
   {
     path: ["changes", "history"],
+    action: "changes.history",
     summary: "List a session's turns, oldest first, with the changes each one made.",
     description: "Read-only: each turn's backend measurement from its start to its end, with the same count qualities as `changes view`. No workspace scan, transcript or provider read. Pass the printed cursor as --cursor for newer turns.",
     positionals: [{ name: "session", required: true, description: "Session ID (ses_\u2026)." }],
@@ -8710,6 +9151,201 @@ var changesCommands = [
   }
 ];
 
+// src/client/commands/completion.ts
+var SHELLS = ["bash", "zsh", "fish"];
+function flagsOf(options2) {
+  return options2.flatMap((option) => [
+    `--${option.name}`,
+    ...option.short ? [`-${option.short}`] : [],
+    ...option.negatable ? [`--no-${option.name}`] : []
+  ]);
+}
+function completionTable(commands) {
+  const next = new Map;
+  const flags = new Map;
+  const values = new Map;
+  const valueFlags = (options2) => flagsOf(options2.filter((option) => option.kind !== "boolean"));
+  values.set("", valueFlags(GLOBAL_OPTIONS));
+  const add = (prefix, word) => {
+    const words = next.get(prefix) ?? [];
+    if (!words.includes(word))
+      words.push(word);
+    next.set(prefix, words);
+  };
+  for (const command of commands) {
+    command.path.forEach((word, index) => {
+      const prefix = command.path.slice(0, index).join(" ");
+      add(prefix, word);
+      if (!values.has(prefix))
+        values.set(prefix, valueFlags(GLOBAL_OPTIONS));
+    });
+    flags.set(command.path.join(" "), flagsOf(command.options));
+    values.set(command.path.join(" "), [
+      ...valueFlags(GLOBAL_OPTIONS),
+      ...valueFlags(command.options)
+    ]);
+  }
+  add("", "help");
+  add("", "version");
+  return { next, flags, globals: flagsOf(GLOBAL_OPTIONS), values };
+}
+function words(list) {
+  return list.join(" ");
+}
+function bashScript(table) {
+  const cases = [...table.next].map(([prefix, list]) => `    "${prefix}") echo "${words(list)}" ;;`);
+  const flagCases = [...table.flags].map(([path, list]) => `    "${path}") flags="${words(list)}" ;;`);
+  return [
+    "# orkestrator bash completion. Install: orkestrator completion bash > ~/.local/share/bash-completion/completions/orkestrator",
+    "_orkestrator_next() {",
+    '  case "$1" in',
+    ...cases,
+    "  esac",
+    "}",
+    "_orkestrator_takes_value() {",
+    '  case "$1:$2" in',
+    ...[...table.values].filter(([, flags]) => flags.length).map(([path, flags]) => `    ${flags.map((flag) => `"${path}:${flag}"`).join("|")}) return 0 ;;`),
+    "  esac",
+    "  return 1",
+    "}",
+    "_orkestrator() {",
+    '  local cur="${COMP_WORDS[COMP_CWORD]}" command_path="" word i flags="" skip=0',
+    "  COMPREPLY=()",
+    "  for ((i = 1; i < COMP_CWORD; i++)); do",
+    '    word="${COMP_WORDS[i]}"',
+    '    if ((skip)); then [[ "$word" == "=" ]] || skip=0; continue; fi',
+    '    [[ "$word" == "--" ]] && return 0',
+    '    [[ "$word" == --*=* ]] && continue',
+    '    if _orkestrator_takes_value "$command_path" "$word"; then skip=1; continue; fi',
+    '    [[ "$word" == -* ]] && continue',
+    '    if [[ " $(_orkestrator_next "$command_path") " == *" $word "* ]]; then command_path="${command_path:+$command_path }$word"; fi',
+    "  done",
+    "  ((skip)) && return 0",
+    '  case "$command_path" in',
+    ...flagCases,
+    "  esac",
+    "  local candidates candidate",
+    '  if [[ "$cur" == -* ]]; then',
+    `    candidates="$flags ${words(table.globals)}"`,
+    "  else",
+    '    candidates="$(_orkestrator_next "$command_path")"',
+    "  fi",
+    "  for candidate in $candidates; do",
+    '    [[ "$candidate" == "$cur"* ]] && COMPREPLY+=("$candidate")',
+    "  done",
+    "  return 0",
+    "}",
+    "complete -o default -F _orkestrator orkestrator",
+    ""
+  ].join(`
+`);
+}
+function zshScript(table) {
+  return [
+    "#compdef orkestrator",
+    '# orkestrator zsh completion (through bashcompinit). Install: orkestrator completion zsh > "${fpath[1]}/_orkestrator"',
+    "autoload -U +X bashcompinit && bashcompinit",
+    bashScript(table).split(`
+`).slice(1).join(`
+`).replace(`_orkestrator() {
+`, `_orkestrator() {
+  emulate -L ksh
+`)
+  ].join(`
+`);
+}
+function fishScript(table) {
+  const lines = [
+    "# orkestrator fish completion. Install: orkestrator completion fish > ~/.config/fish/completions/orkestrator.fish",
+    "function __orkestrator_next",
+    "  switch $argv[1]",
+    ...[...table.next].map(([prefix, list]) => `    case '${prefix}'
+      echo '${words(list)}'`),
+    "  end",
+    "end",
+    "function __orkestrator_takes_value",
+    '  switch "$argv[1]:$argv[2]"',
+    ...[...table.values].filter(([, flags]) => flags.length).map(([path, flags]) => `    case ${flags.map((flag) => `'${path}:${flag}'`).join(" ")}
+      return 0`),
+    "  end",
+    "  return 1",
+    "end",
+    "function __orkestrator_path",
+    "  set -l tokens (commandline -opc)",
+    "  set -e tokens[1]",
+    "  set -l path ''",
+    "  set -l skip 0",
+    "  for token in $tokens",
+    "    if test $skip = 1",
+    "      set skip 0",
+    "      continue",
+    "    end",
+    '    if test "$token" = "--"',
+    "      echo __rest",
+    "      return",
+    "    end",
+    "    string match -q -- '--*=*' $token; and continue",
+    '    if __orkestrator_takes_value "$path" "$token"',
+    "      set skip 1",
+    "      continue",
+    "    end",
+    "    string match -q -- '-*' $token; and continue",
+    "    if contains -- $token (string split ' ' -- (__orkestrator_next $path))",
+    '      set path (string trim -- "$path $token")',
+    "    end",
+    "  end",
+    "  if test $skip = 1",
+    "    echo __value",
+    "    return",
+    "  end",
+    '  echo "$path"',
+    "end",
+    "complete -c orkestrator -f"
+  ];
+  for (const [prefix, list] of table.next) {
+    lines.push(`complete -c orkestrator -n 'test (__orkestrator_path) = "${prefix}"' -a '${words(list)}'`);
+  }
+  for (const [path, list] of table.flags) {
+    for (const flag of list) {
+      lines.push(`complete -c orkestrator -n 'test (__orkestrator_path) = "${path}"' ${flag.startsWith("--") ? `-l '${flag.slice(2)}'` : `-s '${flag.slice(1)}'`}${table.values.get(path)?.includes(flag) ? " -r" : ""}`);
+    }
+  }
+  for (const flag of table.globals) {
+    lines.push(`complete -c orkestrator ${flag.startsWith("--") ? `-l '${flag.slice(2)}'` : `-s '${flag.slice(1)}'`}${table.values.get("")?.includes(flag) ? " -r" : ""}`);
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+function completionScript(shell, commands) {
+  const table = completionTable(commands);
+  return shell === "bash" ? bashScript(table) : shell === "zsh" ? zshScript(table) : fishScript(table);
+}
+function completionCommands(commands) {
+  return [
+    {
+      path: ["completion"],
+      summary: "Print a shell completion script (bash, zsh or fish).",
+      description: "Completes nouns, verbs and flags from this build's command table; it never contacts a backend, so IDs are not completed. Example: `orkestrator completion bash > ~/.local/share/bash-completion/completions/orkestrator`.",
+      positionals: [{ name: "shell", required: true, description: "bash, zsh or fish." }],
+      options: [],
+      local: true,
+      async run(_context, parsed) {
+        const shell = parsed.positionals.shell;
+        if (!SHELLS.includes(shell)) {
+          throw new CliError("invalid-input", "Shell must be one of: bash, zsh, fish");
+        }
+        const script = completionScript(shell, commands());
+        return {
+          action: "completion",
+          result: { shell, script },
+          human: [script.replace(/\n$/, "")]
+        };
+      }
+    }
+  ];
+}
+
 // src/client/commands/connection.ts
 import path9 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
@@ -8797,8 +9433,11 @@ import { promises as fs2 } from "fs";
 import path6 from "path";
 var MAX_LOCAL_RECEIPTS_PER_INSTALLATION = 1000;
 var MAX_RECEIPT_BYTES = 8 * 1024;
-function receiptKey(action, requestId) {
-  return createHash("sha256").update(action).update("\x00").update(requestId).digest("hex");
+function receiptKey(action, requestId, node) {
+  const hash = createHash("sha256").update(action).update("\x00").update(requestId);
+  if (node)
+    hash.update("\x00node:").update(node);
+  return hash.digest("hex");
 }
 function safeSegment(value) {
   return /^[A-Za-z0-9._-]{1,200}$/.test(value) ? value : createHash("sha256").update(value).digest("hex");
@@ -8812,18 +9451,18 @@ class LocalReceiptStore {
   directory(installationId) {
     return path6.join(this.root, safeSegment(installationId));
   }
-  file(installationId, action, requestId) {
-    return path6.join(this.directory(installationId), `${receiptKey(action, requestId)}.json`);
+  file(installationId, action, requestId, node) {
+    return path6.join(this.directory(installationId), `${receiptKey(action, requestId, node)}.json`);
   }
-  async find(installationId, action, requestId) {
-    return this.readFile(this.file(installationId, action, requestId));
+  async find(installationId, action, requestId, node) {
+    return this.readFile(this.file(installationId, action, requestId, node));
   }
   async save(receipt) {
     const text = `${JSON.stringify(receipt)}
 `;
     if (Buffer.byteLength(text) > MAX_RECEIPT_BYTES)
       return;
-    await writePrivateFile(this.file(receipt.installationId, receipt.action, receipt.requestId), text);
+    await writePrivateFile(this.file(receipt.installationId, receipt.action, receipt.requestId, receipt.node), text);
     await this.prune(receipt.installationId);
   }
   async update(receipt, remote) {
@@ -8858,7 +9497,7 @@ class LocalReceiptStore {
       if (!stat.isFile() || stat.size > MAX_RECEIPT_BYTES)
         return null;
       const value = JSON.parse(await fs2.readFile(file, "utf8"));
-      if (value.version !== 1 || typeof value.installationId !== "string" || typeof value.action !== "string" || !isPublicRequestId(value.requestId) || !isPublicNamespace(value.namespace) || typeof value.intentDigest !== "string" || typeof value.createdAt !== "string" || typeof value.updatedAt !== "string") {
+      if (value.version !== 1 || typeof value.installationId !== "string" || value.node !== undefined && typeof value.node !== "string" || typeof value.action !== "string" || !isPublicRequestId(value.requestId) || !isPublicNamespace(value.namespace) || typeof value.intentDigest !== "string" || typeof value.createdAt !== "string" || typeof value.updatedAt !== "string") {
         return null;
       }
       return value;
@@ -9040,6 +9679,14 @@ class ClientSession {
   options;
   capabilitiesPromise = null;
   transport;
+  readWarnings = new Set;
+  responseNode;
+  get warnings() {
+    return [...this.readWarnings];
+  }
+  get nodeTag() {
+    return this.responseNode ?? (this.options.node && this.options.node !== PUBLIC_ALL_NODES ? { nodeId: this.options.node, name: this.options.node } : undefined);
+  }
   constructor(target, receipts, options2 = {}) {
     this.target = target;
     this.receipts = receipts;
@@ -9049,6 +9696,27 @@ class ClientSession {
   get identity() {
     return this.target.identity;
   }
+  get node() {
+    return this.options.node;
+  }
+  routingChecked = null;
+  ensureNodeRouting() {
+    this.routingChecked ??= (async () => {
+      const response = await this.call("capabilities", {}, undefined, false, undefined, false);
+      if (!response.ok)
+        throw envelopeError(response);
+      if (!isPublicCapabilities(response.result)) {
+        throw new CliError("response-invalid", "The backend returned invalid capabilities");
+      }
+      if (response.result.features.nodeRouting !== true) {
+        throw new CliError("backend-incompatible", "The connected backend cannot run actions on other nodes; upgrade it to use --node");
+      }
+    })().catch((error) => {
+      this.routingChecked = null;
+      throw error;
+    });
+    return this.routingChecked;
+  }
   capabilities() {
     this.capabilitiesPromise ??= this.loadCapabilities().catch((error) => {
       this.capabilitiesPromise = null;
@@ -9082,6 +9750,9 @@ class ClientSession {
   async mutate(action, input, requestId) {
     if (!PUBLIC_ACTIONS[action].mutation)
       throw new Error(`${action} is not a mutation`);
+    if (this.options.node === PUBLIC_ALL_NODES) {
+      throw new CliError("invalid-input", "--node all is only for project list, environment list and attention; name one node");
+    }
     if (requestId !== undefined && !isPublicRequestId(requestId)) {
       throw new CliError("invalid-input", "--request-id must be 1\u2013200 characters of letters, digits and . _ : @ / + = -, starting with a letter or digit");
     }
@@ -9093,7 +9764,7 @@ class ClientSession {
     const installationId = capabilities.backend.installationId;
     const key = requestId ?? `cli-${randomUUID2()}`;
     const intentDigest = createHash2("sha256").update(canonicalJson({ action, input })).digest("hex");
-    const existing = await this.receipts.find(installationId, action, key);
+    const existing = await this.receipts.find(installationId, action, key, this.options.node);
     if (existing && existing.intentDigest !== intentDigest) {
       throw new CliError("request-conflict", "This saved request ID was used for a different intent", {
         action,
@@ -9106,6 +9777,7 @@ class ClientSession {
       version: 1,
       installationId,
       connection: this.target.identity.name,
+      ...this.options.node ? { node: this.options.node } : {},
       action,
       requestId: key,
       namespace,
@@ -9122,10 +9794,12 @@ class ClientSession {
       if (error instanceof CliError && error.code === "transport-uncertain") {
         throw new CliError(error.code, error.message, {
           action,
+          node: this.nodeTag,
           details: {
             requestId: key,
             namespace,
-            recovery: `orkestrator run get --request-id ${key} --action ${action}`
+            ...this.nodeTag ? { node: this.nodeTag } : {},
+            recovery: `orkestrator run get --request-id ${key} --action ${action}${this.options.node ? ` --node ${quoteArgument(this.options.node)}` : ""}`
           }
         });
       }
@@ -9135,27 +9809,56 @@ class ClientSession {
       await this.receipts.update(local, response.receipt).catch(() => {
         return;
       });
-    if (!response.ok)
+    if (!response.ok) {
+      if (response.error.code === "node-outcome-unknown") {
+        throw new CliError(response.error.code, response.error.message, {
+          action,
+          node: this.nodeTag,
+          retryable: response.error.retryable,
+          details: {
+            ...response.error.details,
+            requestId: key,
+            namespace,
+            recovery: `orkestrator run get --request-id ${key} --action ${action}${this.options.node ? ` --node ${quoteArgument(this.options.node)}` : ""}`
+          }
+        });
+      }
       throw envelopeError(response);
+    }
     return {
       result: response.result,
+      ...this.nodeTag ? { node: this.nodeTag } : {},
       ...response.receipt ? { receipt: response.receipt } : {},
       ...response.warnings ? { warnings: response.warnings } : {}
     };
   }
-  async call(action, input, request, mutation, timeoutMs) {
+  async call(action, input, request, mutation, timeoutMs, routed = true) {
+    const node = routed && this.options.node && !PUBLIC_LOCAL_ONLY_ACTIONS.includes(action) ? this.options.node : undefined;
+    if (node)
+      await this.ensureNodeRouting();
     const body = {
       schemaVersion: PUBLIC_API_SCHEMA_VERSION,
       action,
       actionVersion: PUBLIC_ACTIONS[action].version,
       input,
-      ...request ? { request } : {}
+      ...request ? { request } : {},
+      ...node && !(node === PUBLIC_ALL_NODES && action === "capabilities") ? { node } : {}
     };
     const raw = await this.transport.invoke(PUBLIC_ACTION_COMMAND, body, { mutation, signal: this.options.signal, timeoutMs });
     if (!isPublicActionResponse(raw)) {
       throw new CliError(mutation ? "transport-uncertain" : "response-invalid", "The backend returned a response that does not match the public contract");
     }
     await this.verifyIdentity(raw);
+    if (raw.node)
+      this.responseNode = raw.node;
+    if (!mutation && raw.ok) {
+      for (const warning of raw.warnings ?? [])
+        this.readWarnings.add(warning);
+      const nodes = raw.result?.nodes;
+      for (const failed of nodes?.filter((entry) => !entry.ok) ?? []) {
+        this.readWarnings.add(`${failed.name} (${failed.nodeId}): ${failed.error?.message ?? "not checked"}`);
+      }
+    }
     return raw;
   }
   async verifyIdentity(response) {
@@ -9174,11 +9877,15 @@ class ClientSession {
 function envelopeError(response) {
   return new CliError(response.error.code, response.error.message, {
     action: response.action,
+    ...response.node ? { node: response.node } : {},
     ...response.error.details ? { details: response.error.details } : {},
     ...response.receipt ? { receipt: response.receipt } : {},
     ...response.error.retryable !== undefined ? { retryable: response.error.retryable } : {}
   });
 }
+function quoteArgument(value) {
+  return /^[A-Za-z0-9_.:@/+=-]+$/.test(value) ? value : "'" + value.replaceAll("'", `'"'"'`) + "'";
+}
 
 // src/client/targets.ts
 import { promises as fs3 } from "fs";
@@ -9900,6 +10607,7 @@ function settingsCommands(scope) {
   return [
     {
       path: [scope, "config", "get"],
+      action: `${scope}.config.get`,
       summary: `Show ${scope} settings with effective values, sources and application timing.`,
       positionals: [{ name: idName, required: true }],
       options: [],
@@ -9918,6 +10626,7 @@ function settingsCommands(scope) {
     },
     {
       path: [scope, "config", "set"],
+      action: `${scope}.config.set`,
       summary: `Set and/or unset ${scope} settings atomically.`,
       description: `Settable keys:
 ${keysHelp}
@@ -10015,6 +10724,8 @@ ${applies}`,
     },
     {
       path: [scope, "config", "unset"],
+      action: `${scope}.config.set`,
+      inputFields: { key: "unset" },
       summary: `Unset ${scope} settings, restoring inheritance.`,
       positionals: [
         { name: idName, required: true },
@@ -10092,6 +10803,7 @@ async function lifecycle(context, parsed, action, conditions, extraInput = {}) {
 var environmentCommands = [
   {
     path: ["environment", "list"],
+    action: "environment.list",
     summary: "List environments from the backend snapshot.",
     positionals: [],
     options: [
@@ -10138,6 +10850,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "get"],
+    action: "environment.get",
     summary: "Show one environment by ID, or by --project and --name when unique.",
     positionals: [{ name: "environment", required: false }],
     options: [
@@ -10173,6 +10886,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "create"],
+    action: "environment.create",
     summary: "Create an environment record (does not start it).",
     description: "--base-branch with --base-commit (a full 40-character SHA) pins the exact base; the backend validates it and records what was used. Without them the project's default branch is used at start time.",
     positionals: [],
@@ -10231,6 +10945,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "start"],
+    action: "environment.start",
     summary: "Start an environment; setup continues in the backend.",
     description: "`--wait running` returns once processes run; `--wait ready` also requires setup to complete (an explicit setup override is reported, never applied by the CLI). Setup failure exits 1 with the recorded reason.",
     positionals: [{ name: "environment", required: true }],
@@ -10240,6 +10955,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "stop"],
+    action: "environment.stop",
     summary: "Stop an environment's processes (and container).",
     positionals: [{ name: "environment", required: true }],
     options: [waitOption(["stopped"]), TIMEOUT_OPTION, REQUEST_ID_OPTION],
@@ -10248,6 +10964,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "recreate"],
+    action: "environment.recreate",
     summary: "Rebuild the container, keeping its files; with --discard, DESTRUCTIVELY reset it (container environments only).",
     description: "Without --discard the workspace (tracked, untracked and ignored files, unpushed commits) and the preserved agent session state are copied to a new container and verified before it replaces the old one, which is kept stopped as a recovery copy. The rebuild is refused, with nothing changed, when the image or Docker engine cannot preserve them. --discard instead deletes the container's local files, installed tools and container-local agent sessions. Local worktree environments cannot be recreated.",
     positionals: [{ name: "environment", required: true }],
@@ -10266,6 +10983,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "delete"],
+    action: "environment.delete",
     summary: "DESTRUCTIVE: stop and delete the environment, its worktree or container, and its record.",
     description: "Uncommitted work in the environment is lost. Cleanup is tracked by the operation; a failed cleanup stays inspectable and can be retried with a new request.",
     positionals: [{ name: "environment", required: true }],
@@ -10275,6 +10993,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "fork"],
+    action: "environment.fork",
     summary: "Create a new environment from this environment's current state.",
     positionals: [{ name: "environment", required: true }],
     options: [TYPE_OPTION, REQUEST_ID_OPTION],
@@ -10295,6 +11014,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "rename"],
+    action: "environment.rename",
     summary: "Rename an environment (and its branch).",
     positionals: [
       { name: "environment", required: true },
@@ -10317,6 +11037,7 @@ var environmentCommands = [
   },
   {
     path: ["environment", "launch"],
+    action: "environment.launch",
     summary: "Create and start an environment whose startup agent receives one first prompt.",
     description: "The backend owns the whole flow: create, start, setup, then exactly one initial prompt to the startup session. Do not follow it with `session start`. --wait ready observes setup; follow the prompt's run with `run wait`.",
     positionals: [],
@@ -10427,6 +11148,8 @@ var environmentCommands = [
   },
   {
     path: ["environment", "exec"],
+    action: "environment.exec",
+    inputFields: { "stdin-file": "stdinBase64", "exec-timeout": "timeoutMs" },
     summary: "Run one command in the environment workspace and report its exit status.",
     description: "Arguments after `--` are passed as argv without a shell; use `-- sh -c '...'` to opt into shell expansion. The command runs in a backend-owned worker that outlives this client; --wait observes it and exits with the operation's result (`--exit-code` passes the child's exit code through instead). Output is kept in bounded private artifacts; read it with `run output`.",
     positionals: [{ name: "environment", required: true }],
@@ -10646,6 +11369,7 @@ async function waitForReceipt(context, session, receipt, limit, action) {
 function taskCommand(spec) {
   return {
     path: spec.path,
+    action: spec.action,
     summary: spec.summary,
     ...spec.description ? { description: spec.description } : {},
     positionals: [],
@@ -10677,6 +11401,7 @@ function taskCommand(spec) {
 var hostCommands = [
   {
     path: ["host", "status"],
+    action: "host.status",
     summary: "Show the Orkestrator version on the backend's computer, its updater and any update.",
     positionals: [],
     options: [],
@@ -10693,6 +11418,7 @@ var hostCommands = [
   },
   {
     path: ["host", "update", "channel"],
+    action: "host.update.channel",
     summary: "Choose the host's update channel: stable, beta or unstable.",
     positionals: [{ name: "channel", required: true, description: "stable, beta or unstable" }],
     options: [REQUEST_ID_OPTION],
@@ -10713,6 +11439,7 @@ var hostCommands = [
   },
   {
     path: ["host", "update", "check"],
+    action: "host.update.check",
     summary: "Ask the backend's computer to check for an Orkestrator update.",
     positionals: [],
     options: [WAIT_OPTION, TIMEOUT_OPTION, REQUEST_ID_OPTION],
@@ -10747,6 +11474,13 @@ var hostCommands = [
   },
   {
     path: ["host", "update", "apply"],
+    action: "host.update.apply",
+    inputFields: {
+      release: "version",
+      yes: "confirm",
+      "when-idle": "drain",
+      "max-wait": "maxWaitSeconds"
+    },
     summary: "Install an Orkestrator update on the backend's computer. It restarts there after a 60 s countdown.",
     description: "Someone at that computer can postpone the restart; the update then installs the next time the app quits. Restarting ends agent turns and terminals running on that computer; containers keep running.",
     positionals: [],
@@ -10796,70 +11530,632 @@ var hostCommands = [
         ...whenIdle ? { drain: "when-idle" } : {},
         ...typeof maxWait === "number" ? { maxWaitSeconds: Math.round(maxWait / 1000) } : {}
       }, parsed.options);
-      const latest = wait && receipt ? await waitForReceipt(context, session, receipt, limit, "host.update.apply") : receipt;
-      const failure = latest && isTerminalReceipt(latest) ? receiptFailure(latest) : undefined;
-      const host = wait ? await readHost(session).catch(() => null) : null;
-      const human = [
-        `Update ${result.jobId}: ${latest?.state ?? "accepted"} (${latest?.stage ?? ""})`
-      ];
-      if (host)
-        human.push(...hostLines(host));
-      else if (!wait)
-        human.push("Follow it with `orkestrator host status`.");
+      const latest = wait && receipt ? await waitForReceipt(context, session, receipt, limit, "host.update.apply") : receipt;
+      const failure = latest && isTerminalReceipt(latest) ? receiptFailure(latest) : undefined;
+      const host = wait ? await readHost(session).catch(() => null) : null;
+      const human = [
+        `Update ${result.jobId}: ${latest?.state ?? "accepted"} (${latest?.stage ?? ""})`
+      ];
+      if (host)
+        human.push(...hostLines(host));
+      else if (!wait)
+        human.push("Follow it with `orkestrator host status`.");
+      return {
+        action: "host.update.apply",
+        result: { ...result, ...host ? { host } : {} },
+        receipt: latest,
+        warnings,
+        connection: session.identity,
+        ids: receipt ? [receipt.operationId] : [],
+        human,
+        ...failure ? { failure } : {}
+      };
+    }
+  },
+  {
+    path: ["host", "update", "cancel"],
+    action: "host.update.cancel",
+    summary: "Cancel the host's update before it restarts.",
+    positionals: [],
+    options: [REQUEST_ID_OPTION],
+    async run(context, parsed) {
+      const { session, result, receipt, warnings } = await submit(context, "host.update.cancel", {}, parsed.options);
+      return {
+        action: "host.update.cancel",
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        human: [`Cancelled update ${result.jobId}.`]
+      };
+    }
+  },
+  taskCommand({
+    path: ["host", "toolchain", "repair"],
+    action: "host.toolchain.repair",
+    summary: "Reinstall whatever of the host's pinned agent tools is missing or fails its digest.",
+    input: {}
+  }),
+  taskCommand({
+    path: ["host", "image", "update"],
+    action: "host.image.update",
+    summary: "Pull the release container image matching the backend and use it for new environments.",
+    description: "Running environments keep their image; `host status` lists those to rebuild afterwards.",
+    input: {}
+  }),
+  taskCommand({
+    path: ["host", "gh", "latest"],
+    action: "host.gh.update",
+    summary: "Make the host use the newest gh release instead of its pin (unqualified).",
+    input: { channel: "latest" }
+  }),
+  taskCommand({
+    path: ["host", "gh", "pinned"],
+    action: "host.gh.update",
+    summary: "Make the host use the gh this Orkestrator release pins.",
+    input: { channel: "pinned" }
+  })
+];
+
+// ../protocol/src/schedule-time.ts
+var CRON_SEARCH_DAYS = 366 * 5;
+var formatters = new Map;
+
+// ../protocol/src/scheduled-jobs.ts
+var SCHEDULED_JOB_LIMITS = Object.freeze({
+  maxSchedules: 1000,
+  maxPerOwner: 50,
+  historyEntries: 20,
+  nameMaxChars: 120,
+  promptMaxChars: 1e5,
+  minIntervalSeconds: 60,
+  maxIntervalSeconds: 366 * 24 * 60 * 60,
+  defaultCatchUpMinutes: 15,
+  maxCatchUpMinutes: 7 * 24 * 60,
+  onTimeToleranceMs: 60000,
+  actionInputMaxBytes: 64 * 1024,
+  busyRetryWindowMs: 15 * 60000,
+  busyRetryDelayMs: 30000,
+  fireStaleMs: 90000,
+  fireHeartbeatMs: 20000,
+  maxFireAttempts: 3
+});
+function describeScheduleTrigger(trigger, timeZone) {
+  switch (trigger.kind) {
+    case "once":
+      return `once at ${trigger.at}`;
+    case "cron":
+      return `cron "${trigger.expression}" (${timeZone})`;
+    case "interval": {
+      const seconds = trigger.everySeconds;
+      const text = seconds % 86400 === 0 ? `${seconds / 86400}d` : seconds % 3600 === 0 ? `${seconds / 3600}h` : seconds % 60 === 0 ? `${seconds / 60}m` : `${seconds}s`;
+      return `every ${text}`;
+    }
+  }
+}
+
+// src/client/commands/schedule.ts
+var SCHEDULE_ID = { name: "schedule", required: true, description: "Schedule ID (sch_...)." };
+var TIMING_OPTIONS = [
+  {
+    name: "at",
+    kind: "string",
+    valueName: "TIME",
+    description: "Once: HH:MM (next occurrence), YYYY-MM-DDTHH:MM, an ISO time with an offset, or +15m."
+  },
+  {
+    name: "cron",
+    kind: "string",
+    valueName: "EXPR",
+    description: 'Recurring: five-field cron, e.g. "0 9 * * 1-5", or @daily.'
+  },
+  {
+    name: "every",
+    kind: "duration",
+    valueName: "DURATION",
+    description: "Recurring: a fixed interval (at least 1m)."
+  },
+  {
+    name: "start-at",
+    kind: "string",
+    valueName: "TIME",
+    description: "With --every: the first fire."
+  },
+  {
+    name: "time-zone",
+    kind: "string",
+    valueName: "ZONE",
+    description: "IANA zone for --at and --cron, e.g. Europe/London. Default: the backend host's."
+  },
+  {
+    name: "catch-up-minutes",
+    kind: "integer",
+    valueName: "N",
+    description: "Run a fire missed while the backend was down if at most N minutes late (default 15)."
+  },
+  { name: "name", kind: "string", valueName: "TEXT", description: "Label shown in lists." }
+];
+var ACTION_OPTIONS = [
+  {
+    name: "mail",
+    kind: "string",
+    valueName: "ENV:TAB",
+    description: "Action: send agent mail (mail.send) to this mailbox."
+  },
+  { name: "subject", kind: "string", valueName: "TEXT", description: "With --mail: subject." },
+  { name: "body", kind: "string", valueName: "TEXT", description: "With --mail: message text." },
+  {
+    name: "body-file",
+    kind: "string",
+    valueName: "PATH",
+    description: "With --mail: read the text from a file."
+  },
+  {
+    name: "session",
+    kind: "string",
+    valueName: "SESSION",
+    description: "Action: prompt this idle session (session.prompt); give the prompt with --prompt\u2026"
+  },
+  {
+    name: "launch-project",
+    kind: "string",
+    valueName: "PROJECT_ID",
+    description: "Action: launch an environment in this project (environment.launch)."
+  },
+  {
+    name: "agent",
+    kind: "string",
+    valueName: "AGENT",
+    description: "With --launch-project: agent platform."
+  },
+  {
+    name: "type",
+    kind: "string",
+    valueName: "TYPE",
+    description: "With --launch-project: local (default) or container."
+  },
+  {
+    name: "model",
+    kind: "string",
+    valueName: "MODEL",
+    description: "With --launch-project: model ID."
+  },
+  {
+    name: "base-branch",
+    kind: "string",
+    valueName: "BRANCH",
+    description: "With --launch-project: base branch."
+  },
+  {
+    name: "base-commit",
+    kind: "string",
+    valueName: "SHA",
+    description: "With --launch-project: pin this commit; omitted, the branch's newest commit at fire time."
+  },
+  {
+    name: "mode",
+    kind: "string",
+    valueName: "MODE",
+    description: "With --session or --launch-project: plan or build."
+  },
+  {
+    name: "action",
+    kind: "string",
+    valueName: "ACTION",
+    description: "Action: any public mutation by name (e.g. ticket.comment) with --input-json."
+  },
+  {
+    name: "input-json",
+    kind: "string",
+    valueName: "JSON",
+    description: "With --action: its input object."
+  },
+  ...PROMPT_OPTIONS
+];
+var ACTION_INPUT_FIELDS = Object.fromEntries(ACTION_OPTIONS.map((option) => [option.name, "action"]));
+function timingInput(options2) {
+  const every = options2.every;
+  if (typeof every === "number" && every % 1000 !== 0) {
+    throw new CliError("invalid-input", "--every must be whole seconds");
+  }
+  const at = stringOption(options2, "at");
+  const cron = stringOption(options2, "cron");
+  const startAt = stringOption(options2, "start-at");
+  const timeZone = stringOption(options2, "time-zone");
+  const name = stringOption(options2, "name");
+  return {
+    ...at !== undefined ? { at } : {},
+    ...cron !== undefined ? { cron } : {},
+    ...typeof every === "number" ? { everySeconds: every / 1000 } : {},
+    ...startAt !== undefined ? { startAt } : {},
+    ...timeZone !== undefined ? { timeZone } : {},
+    ...typeof options2["catch-up-minutes"] === "number" ? { catchUpMinutes: options2["catch-up-minutes"] } : {},
+    ...name !== undefined ? { name } : {}
+  };
+}
+async function actionInput(io, options2) {
+  const chosen = ["mail", "session", "launch-project", "action"].filter((name) => options2[name] !== undefined);
+  if (chosen.length === 0)
+    return;
+  if (chosen.length > 1) {
+    throw new CliError("invalid-input", `--${chosen.join(", --")} are mutually exclusive`);
+  }
+  const prompt = () => readTextSource(io, {
+    file: options2["prompt-file"],
+    stdin: options2["prompt-stdin"],
+    inline: options2.prompt,
+    label: "Prompt",
+    maxBytes: 400000,
+    names: { file: "--prompt-file", stdin: "--prompt-stdin", inline: "--prompt" },
+    required: true
+  });
+  const mode = options2.mode !== undefined ? { mode: oneOf(options2.mode, ["plan", "build"], "--mode") } : {};
+  switch (chosen[0]) {
+    case "mail": {
+      const [environmentId, tabId, extra] = String(options2.mail).split(":");
+      if (!environmentId || !tabId || extra !== undefined) {
+        throw new CliError("invalid-input", "--mail expects ENVIRONMENT_ID:TAB_ID");
+      }
+      const body = await readTextSource(io, {
+        file: options2["body-file"],
+        inline: options2.body,
+        label: "Message",
+        maxBytes: 32 * 1024,
+        names: { file: "--body-file", stdin: "--body-stdin", inline: "--body" },
+        required: true
+      });
+      const subject = stringOption(options2, "subject");
+      return {
+        kind: "action",
+        action: "mail.send",
+        input: {
+          toEnvironmentId: environmentId,
+          toTabId: tabId,
+          body,
+          ...subject ? { subject } : {}
+        }
+      };
+    }
+    case "session":
+      return { kind: "prompt", sessionId: options2.session, prompt: await prompt(), ...mode };
+    case "launch-project": {
+      const agent = stringOption(options2, "agent");
+      if (!agent)
+        throw new CliError("invalid-input", "--launch-project needs --agent");
+      const type = options2.type === undefined ? "local" : oneOf(options2.type, ["local", "container"], "--type");
+      const model = stringOption(options2, "model");
+      const baseBranch = stringOption(options2, "base-branch");
+      const baseCommit = stringOption(options2, "base-commit");
+      return {
+        kind: "launch",
+        projectId: options2["launch-project"],
+        agent,
+        type,
+        prompt: await prompt(),
+        ...mode,
+        ...model ? { model } : {},
+        ...baseBranch ? { baseBranch } : {},
+        ...baseCommit ? { baseCommit } : {}
+      };
+    }
+    default: {
+      let input = {};
+      const raw = stringOption(options2, "input-json");
+      if (raw !== undefined) {
+        try {
+          input = JSON.parse(raw);
+        } catch {
+          throw new CliError("invalid-input", "--input-json is not valid JSON");
+        }
+      }
+      if (!input || typeof input !== "object" || Array.isArray(input)) {
+        throw new CliError("invalid-input", "--input-json must be a JSON object");
+      }
+      return { kind: "action", action: options2.action, input };
+    }
+  }
+}
+function lastOutcome(job) {
+  const fire = job.activeFire ?? job.lastFire;
+  if (!fire)
+    return "-";
+  return fire.error ? `${fire.state}: ${fire.error.code}` : fire.state;
+}
+function scheduleLines(job) {
+  return [
+    ...keyValues([
+      ["id", job.id],
+      ["name", job.name],
+      ["owner", job.ownerLabel],
+      ["state", job.pausedReason ? `${job.state} (${job.pausedReason})` : job.state],
+      ["when", describeScheduleTrigger(job.trigger, job.timeZone)],
+      ["time zone", job.timeZone],
+      ["next fire", job.nextFireAt ?? "-"],
+      ["catch-up", `${job.catchUpMinutes} min`],
+      ["action", job.action.kind === "action" ? job.action.action : job.action.kind]
+    ]),
+    "",
+    ...table(["FIRE", "SLOT", "STATE", "ERROR"], [...job.fires].reverse().map((fire) => [
+      fire.fireId,
+      fire.scheduledFor,
+      fire.state,
+      fire.error ? `${fire.error.code}: ${fire.error.message}` : ""
+    ]))
+  ];
+}
+function simpleMutation(verb, summary) {
+  const action = `schedule.${verb}`;
+  return {
+    path: ["schedule", verb],
+    action,
+    summary,
+    positionals: [SCHEDULE_ID],
+    options: [REQUEST_ID_OPTION],
+    inputFields: { schedule: "scheduleId" },
+    idOutput: "schedule ID",
+    async run(context, parsed) {
+      const { session, result, receipt, warnings } = await submit(context, action, { scheduleId: parsed.positionals.schedule }, parsed.options);
+      return {
+        action,
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: [String(parsed.positionals.schedule)],
+        human: keyValues(Object.entries(result))
+      };
+    }
+  };
+}
+var scheduleCommands = [
+  {
+    path: ["schedule", "list"],
+    action: "schedule.list",
+    summary: "List scheduled jobs with their next fire, owner and last outcome.",
+    positionals: [],
+    options: [
+      {
+        name: "project",
+        kind: "string",
+        valueName: "PROJECT_ID",
+        description: "Owned in or aimed at this project."
+      },
+      {
+        name: "state",
+        kind: "string",
+        valueName: "STATE",
+        description: "active, paused or completed."
+      },
+      {
+        name: "owner-kind",
+        kind: "string",
+        valueName: "KIND",
+        description: "operator, control-mcp, agent or coordinator."
+      },
+      { name: "offset", kind: "integer", valueName: "N", description: "Rows to skip." },
+      { name: "limit", kind: "integer", valueName: "N", description: "Rows (max 200)." }
+    ],
+    async run(context, parsed) {
+      const session = await context.session();
+      const options2 = parsed.options;
+      const page = await session.read("schedule.list", {
+        ...options2.project !== undefined ? { projectId: options2.project } : {},
+        ...options2.state !== undefined ? { state: options2.state } : {},
+        ...options2["owner-kind"] !== undefined ? { ownerKind: options2["owner-kind"] } : {},
+        ...options2.offset !== undefined ? { offset: options2.offset } : {},
+        ...options2.limit !== undefined ? { limit: options2.limit } : {}
+      });
+      return {
+        action: "schedule.list",
+        result: page,
+        connection: session.identity,
+        human: table(["ID", "NAME", "STATE", "NEXT FIRE", "OWNER", "LAST"], page.schedules.map((job) => [
+          job.id,
+          job.name,
+          job.state,
+          job.nextFireAt ?? "-",
+          job.ownerLabel,
+          lastOutcome(job)
+        ]))
+      };
+    }
+  },
+  {
+    path: ["schedule", "get"],
+    action: "schedule.get",
+    summary: "Show one scheduled job and its fire history.",
+    positionals: [SCHEDULE_ID],
+    options: [],
+    inputFields: { schedule: "scheduleId" },
+    async run(context, parsed) {
+      const session = await context.session();
+      const result = await session.read("schedule.get", {
+        scheduleId: parsed.positionals.schedule
+      });
+      return {
+        action: "schedule.get",
+        result,
+        connection: session.identity,
+        human: scheduleLines(result.schedule)
+      };
+    }
+  },
+  {
+    path: ["schedule", "create"],
+    action: "schedule.create",
+    summary: "Schedule mail, a prompt, an environment launch or another action.",
+    description: "Give one of --at, --cron or --every, and one action: --mail ENV:TAB with --body, --session SES with --prompt, --launch-project P with --agent and --prompt, or --action NAME with --input-json.",
+    positionals: [],
+    options: [
+      ...TIMING_OPTIONS,
+      { name: "paused", kind: "boolean", description: "Create it paused." },
+      ...ACTION_OPTIONS,
+      REQUEST_ID_OPTION
+    ],
+    inputFields: { ...ACTION_INPUT_FIELDS, every: "everySeconds", "start-at": "startAt" },
+    idOutput: "schedule ID",
+    examples: [
+      'orkestrator schedule create --at 03:12 --mail env-1:startup-agent --body "Resume the stalled workers."',
+      'orkestrator schedule create --cron "0 9 * * 1-5" --session ses_... --prompt "Summarise CI failures."'
+    ],
+    async run(context, parsed) {
+      const action = await actionInput(context.io, parsed.options);
+      if (!action)
+        throw new CliError("invalid-input", "Choose an action: --mail, --session, --launch-project or --action");
+      const { session, result, receipt, warnings } = await submit(context, "schedule.create", {
+        ...timingInput(parsed.options),
+        ...parsed.options.paused === true ? { paused: true } : {},
+        action
+      }, parsed.options);
+      return {
+        action: "schedule.create",
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: [result.scheduleId],
+        human: [`scheduled ${result.scheduleId}; next fire ${result.nextFireAt ?? "none"}`]
+      };
+    }
+  },
+  {
+    path: ["schedule", "update"],
+    action: "schedule.update",
+    summary: "Change a schedule's time, zone, catch-up window, name or action.",
+    positionals: [SCHEDULE_ID],
+    options: [
+      ...TIMING_OPTIONS,
+      ...ACTION_OPTIONS,
+      {
+        name: "expected-revision",
+        kind: "integer",
+        valueName: "N",
+        description: "Apply only at this revision."
+      },
+      REQUEST_ID_OPTION
+    ],
+    inputFields: {
+      ...ACTION_INPUT_FIELDS,
+      schedule: "scheduleId",
+      every: "everySeconds",
+      "start-at": "startAt"
+    },
+    idOutput: "schedule ID",
+    async run(context, parsed) {
+      const action = await actionInput(context.io, parsed.options);
+      const { session, result, receipt, warnings } = await submit(context, "schedule.update", {
+        scheduleId: parsed.positionals.schedule,
+        ...timingInput(parsed.options),
+        ...action ? { action } : {},
+        ...typeof parsed.options["expected-revision"] === "number" ? { expectedRevision: parsed.options["expected-revision"] } : {}
+      }, parsed.options);
       return {
-        action: "host.update.apply",
-        result: { ...result, ...host ? { host } : {} },
-        receipt: latest,
+        action: "schedule.update",
+        result,
+        receipt,
         warnings,
         connection: session.identity,
-        ids: receipt ? [receipt.operationId] : [],
-        human,
-        ...failure ? { failure } : {}
+        ids: [String(parsed.positionals.schedule)],
+        human: keyValues(Object.entries(result))
       };
     }
   },
+  simpleMutation("pause", "Pause a schedule; nothing fires until it is resumed."),
+  simpleMutation("resume", "Resume a paused schedule from its next future slot."),
+  simpleMutation("run", "Fire a schedule once now, leaving its regular slots unchanged."),
+  simpleMutation("delete", "Delete a schedule and its history.")
+];
+
+// src/client/commands/mail.ts
+var mailCommands = [
   {
-    path: ["host", "update", "cancel"],
-    summary: "Cancel the host's update before it restarts.",
+    path: ["mail", "mailboxes"],
+    action: "mail.mailboxes",
+    summary: "List agent mailboxes a message can be sent to.",
     positionals: [],
-    options: [REQUEST_ID_OPTION],
+    options: [
+      { name: "q", kind: "string", valueName: "TEXT", description: "Filter by name." },
+      { name: "offset", kind: "integer", valueName: "N", description: "Rows to skip." },
+      { name: "limit", kind: "integer", valueName: "N", description: "Rows (max 200)." }
+    ],
     async run(context, parsed) {
-      const { session, result, receipt, warnings } = await submit(context, "host.update.cancel", {}, parsed.options);
+      const session = await context.session();
+      const page = await session.read("mail.mailboxes", {
+        ...parsed.options.q !== undefined ? { q: parsed.options.q } : {},
+        ...parsed.options.offset !== undefined ? { offset: parsed.options.offset } : {},
+        ...parsed.options.limit !== undefined ? { limit: parsed.options.limit } : {}
+      });
       return {
-        action: "host.update.cancel",
+        action: "mail.mailboxes",
+        result: page,
+        connection: session.identity,
+        human: table(["ENVIRONMENT", "TAB", "NAME", "PRESENCE"], page.mailboxes.map((mailbox) => [
+          mailbox.environmentId,
+          mailbox.tabId,
+          `${mailbox.environmentName} / ${mailbox.displayName}`,
+          mailbox.presence
+        ]))
+      };
+    }
+  },
+  {
+    path: ["mail", "send"],
+    action: "mail.send",
+    summary: "Place a message in one tab's inbox (never injected into a turn).",
+    positionals: [
+      { name: "environment", required: true },
+      { name: "tab", required: true }
+    ],
+    options: [
+      { name: "subject", kind: "string", valueName: "TEXT", description: "Subject line." },
+      { name: "body", kind: "string", valueName: "TEXT", description: "Message text." },
+      {
+        name: "body-file",
+        kind: "string",
+        valueName: "PATH",
+        description: "Read the message from a local file."
+      },
+      { name: "body-stdin", kind: "boolean", description: "Read the message from stdin." },
+      REQUEST_ID_OPTION
+    ],
+    inputFields: {
+      environment: "toEnvironmentId",
+      tab: "toTabId",
+      "body-file": "body",
+      "body-stdin": "body"
+    },
+    idOutput: "message ID",
+    async run(context, parsed) {
+      const body = await readTextSource(context.io, {
+        file: parsed.options["body-file"],
+        stdin: parsed.options["body-stdin"],
+        inline: parsed.options.body,
+        label: "Message",
+        maxBytes: 32 * 1024,
+        names: { file: "--body-file", stdin: "--body-stdin", inline: "--body" },
+        required: true
+      });
+      const subject = stringOption(parsed.options, "subject");
+      if (subject !== undefined && subject.trim().length === 0) {
+        throw new CliError("invalid-input", "--subject is empty");
+      }
+      const { session, result, receipt, warnings } = await submit(context, "mail.send", {
+        toEnvironmentId: parsed.positionals.environment,
+        toTabId: parsed.positionals.tab,
+        body,
+        ...subject ? { subject } : {}
+      }, parsed.options);
+      return {
+        action: "mail.send",
         result,
         receipt,
         warnings,
         connection: session.identity,
-        human: [`Cancelled update ${result.jobId}.`]
+        ids: result.messageId ? [result.messageId] : [],
+        human: [`sent message ${result.messageId ?? ""}`.trim()]
       };
     }
-  },
-  taskCommand({
-    path: ["host", "toolchain", "repair"],
-    action: "host.toolchain.repair",
-    summary: "Reinstall whatever of the host's pinned agent tools is missing or fails its digest.",
-    input: {}
-  }),
-  taskCommand({
-    path: ["host", "image", "update"],
-    action: "host.image.update",
-    summary: "Pull the release container image matching the backend and use it for new environments.",
-    description: "Running environments keep their image; `host status` lists those to rebuild afterwards.",
-    input: {}
-  }),
-  taskCommand({
-    path: ["host", "gh", "latest"],
-    action: "host.gh.update",
-    summary: "Make the host use the newest gh release instead of its pin (unqualified).",
-    input: { channel: "latest" }
-  }),
-  taskCommand({
-    path: ["host", "gh", "pinned"],
-    action: "host.gh.update",
-    summary: "Make the host use the gh this Orkestrator release pins.",
-    input: { channel: "pinned" }
-  })
+  }
 ];
 
 // src/client/commands/service.ts
@@ -11477,6 +12773,7 @@ var PAGE_OPTIONS = [
 var projectCommands = [
   {
     path: ["project", "list"],
+    action: "project.list",
     summary: "List projects.",
     positionals: [],
     options: PAGE_OPTIONS,
@@ -11501,6 +12798,7 @@ var projectCommands = [
   },
   {
     path: ["project", "get"],
+    action: "project.get",
     summary: "Show one project by ID, or by --name when unique.",
     positionals: [{ name: "project", required: false }],
     options: [
@@ -11526,6 +12824,7 @@ var projectCommands = [
   },
   {
     path: ["project", "add"],
+    action: "project.add",
     summary: "Register a repository, attach a backend checkout, or clone into a backend path.",
     description: "--remote alone registers the remote. --path alone attaches an existing checkout on the BACKEND's filesystem and reads its origin there. Both together attach the checkout if it exists, or clone the remote into that backend path when it is missing or empty. No GitHub repository is created.",
     positionals: [],
@@ -11560,8 +12859,9 @@ var projectCommands = [
   },
   {
     path: ["project", "create"],
+    action: "project.create",
     summary: "Create a new repository: git init, a PRIVATE GitHub repository, and a push.",
-    description: "This creates an external repository on GitHub using the backend's GitHub CLI credentials, pushes the initial commit, and registers the project. It requires --github-private to confirm that effect. Local-only initialization is not supported.",
+    description: "This creates an external repository on GitHub using the backend's GitHub CLI credentials, pushes the initial commit, and registers the project. It requires --github-private to confirm that effect. For a repository with no remote, use `project init`.",
     positionals: [],
     options: [
       {
@@ -11597,8 +12897,49 @@ var projectCommands = [
       };
     }
   },
+  {
+    path: ["project", "init"],
+    action: "project.init",
+    summary: "Create a local-only repository (git init, initial commit, no remote) and register it.",
+    description: "Runs on the BACKEND host: the path must be new or an empty directory there. Nothing reaches GitHub or the network. Environments start from the repository's own branch; without a remote, container environments cannot clone it and pull requests are unavailable.",
+    positionals: [],
+    options: [
+      {
+        name: "path",
+        kind: "string",
+        valueName: "BACKEND_PATH",
+        description: "New, empty directory on the backend host."
+      },
+      REQUEST_ID_OPTION
+    ],
+    idOutput: "project ID",
+    async run(context, parsed) {
+      const backendPath = stringOption(parsed.options, "path");
+      if (!backendPath)
+        throw new CliError("invalid-input", "--path is required");
+      const { session, result, receipt, warnings } = await submit(context, "project.init", { path: backendPath }, parsed.options);
+      return {
+        action: "project.init",
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: [result.project.id],
+        human: projectLines(result.project)
+      };
+    }
+  },
   {
     path: ["project", "update"],
+    action: "project.update",
+    inputFields: {
+      name: "set",
+      folder: "set",
+      "no-folder": "set",
+      remote: "set",
+      path: "set",
+      "no-path": "set"
+    },
     summary: "Edit project metadata (does not move checkouts or rewrite .git/config).",
     positionals: [{ name: "project", required: true }],
     options: [
@@ -11668,13 +13009,47 @@ var projectCommands = [
   },
   {
     path: ["project", "remove"],
-    summary: "Remove an empty project registration (refused while environments exist).",
-    description: "Only the registration is removed. The checkout on disk and any remote repository are never deleted.",
+    action: "project.remove",
+    summary: "Remove a project registration; --cascade deletes its environments first.",
+    description: "Without --cascade a project that still has environments is refused (exit 8). With --cascade the backend deletes each environment through the normal lifecycle, one by one, reports a result for each, and removes the registration only if all were deleted (otherwise the operation is partial and the project is kept). The checkout on disk and any remote repository are never deleted. --wait observes a cascade until it ends.",
     positionals: [{ name: "project", required: true }],
-    options: [REQUEST_ID_OPTION],
+    options: [
+      {
+        name: "cascade",
+        kind: "boolean",
+        description: "Delete every environment of the project first."
+      },
+      { name: "wait", kind: "boolean", description: "Observe the removal until it ends." },
+      TIMEOUT_OPTION,
+      REQUEST_ID_OPTION
+    ],
     idOutput: "operation ID",
     async run(context, parsed) {
-      const { session, result, receipt, warnings } = await submit(context, "project.remove", { projectId: parsed.positionals.project }, parsed.options);
+      const options2 = parsed.options;
+      if (options2.timeout !== undefined && options2.wait !== true) {
+        throw new CliError("invalid-input", "--timeout needs --wait");
+      }
+      if (typeof options2.timeout === "number" && options2.timeout > PUBLIC_API_LIMITS.waitMaxMs) {
+        throw new CliError("invalid-input", "--timeout may be at most 24h");
+      }
+      const { session, result, receipt, warnings } = await submit(context, "project.remove", {
+        projectId: parsed.positionals.project,
+        ...options2.cascade === true ? { cascade: true } : {}
+      }, options2);
+      if (options2.wait === true && receipt) {
+        const final = await waitForOperation(context, session, receipt, options2.timeout ?? DEFAULT_WAIT_MS);
+        const failure = receiptFailure(final);
+        return {
+          action: "project.remove",
+          result: final.result ?? result,
+          receipt: final,
+          warnings,
+          connection: session.identity,
+          ids: [final.operationId],
+          human: receiptLines(final),
+          ...failure ? { failure } : {}
+        };
+      }
       return {
         action: "project.remove",
         result,
@@ -11693,6 +13068,7 @@ var projectCommands = [
 var runCommands = [
   {
     path: ["run", "get"],
+    action: "run.get",
     summary: "Show an operation by ID, or by its original --request-id.",
     description: "Lookup by request key finds the operation even when the original response was lost. `history-expired` (exit 3) means the key's namespace was retired and its outcome is no longer retained; it is not evidence that nothing ran.",
     positionals: [{ name: "operation", required: false }],
@@ -11731,7 +13107,7 @@ var runCommands = [
       let namespace = stringOption(parsed.options, "namespace");
       if (requestId && !namespace && action) {
         const capabilities = await session.capabilities();
-        const local = await new LocalReceiptStore(context.configStore.receiptsDirectory).find(capabilities.backend.installationId, action, requestId);
+        const local = await new LocalReceiptStore(context.configStore.receiptsDirectory).find(capabilities.backend.installationId, action, requestId, session.node);
         namespace = local?.namespace;
       }
       const { receipt } = await session.readWithReceipt("run.get", operationId ? { operationId } : { requestId, ...action ? { action } : {}, ...namespace ? { namespace } : {} });
@@ -11739,7 +13115,7 @@ var runCommands = [
         throw new CliError("response-invalid", "run.get returned no receipt");
       return {
         action: "run.get",
-        result: null,
+        result: receipt.result ?? null,
         receipt,
         connection: session.identity,
         ids: [receipt.operationId],
@@ -11749,6 +13125,7 @@ var runCommands = [
   },
   {
     path: ["run", "wait"],
+    action: "run.get",
     summary: "Observe an operation until it finishes (exit 0 only on success).",
     description: "Exit codes: 0 succeeded, 1 failed/cancelled/interrupted, 5 --timeout passed (still running), 6 waiting for an interaction answer, 7 dispatch or outcome unknown. Ctrl+C stops observing only.",
     positionals: [{ name: "operation", required: true }],
@@ -11768,7 +13145,7 @@ var runCommands = [
       const failure = receiptFailure(final);
       return {
         action: "run.wait",
-        result: null,
+        result: final.result ?? null,
         receipt: final,
         connection: session.identity,
         ids: [final.operationId],
@@ -11779,6 +13156,7 @@ var runCommands = [
   },
   {
     path: ["run", "retry"],
+    action: "run.retry",
     summary: "Retry the exact parked prompt/steer of an unknown dispatch under its original key.",
     description: "Never sends a different prompt and never mints a new key.",
     positionals: [{ name: "operation", required: true }],
@@ -11799,6 +13177,7 @@ var runCommands = [
   },
   {
     path: ["run", "discard"],
+    action: "run.discard",
     summary: "Clear the recovery state of an unknown dispatch (does NOT undo a turn that ran).",
     positionals: [{ name: "operation", required: true }],
     options: [REQUEST_ID_OPTION],
@@ -11818,6 +13197,7 @@ var runCommands = [
   },
   {
     path: ["run", "cancel"],
+    action: "run.cancel",
     summary: "Cancel a running exec operation (its exact worker and descendants).",
     positionals: [{ name: "operation", required: true }],
     options: [REQUEST_ID_OPTION],
@@ -11837,6 +13217,8 @@ var runCommands = [
   },
   {
     path: ["run", "output"],
+    action: "run.output",
+    inputFields: { tail: "tailBytes" },
     summary: "Read a bounded window of an exec operation's stdout or stderr.",
     positionals: [{ name: "operation", required: true }],
     options: [
@@ -11913,9 +13295,10 @@ var runCommands = [
       return {
         action: "run.receipts",
         result: { items: receipts },
-        human: table(["REQUEST", "ACTION", "OPERATION", "STATE", "UPDATED"], receipts.map((receipt) => [
+        human: table(["REQUEST", "ACTION", "NODE", "OPERATION", "STATE", "UPDATED"], receipts.map((receipt) => [
           receipt.requestId,
           receipt.action,
+          receipt.node ?? "(connected node)",
           receipt.operationId ?? "(no response)",
           receipt.state ?? "-",
           receipt.updatedAt
@@ -11926,6 +13309,7 @@ var runCommands = [
 ];
 
 // src/client/commands/session.ts
+import path15 from "path";
 var WAIT_OPTIONS = [
   { name: "wait", kind: "boolean", description: "Observe this run until its turn ends." },
   TIMEOUT_OPTION,
@@ -11961,6 +13345,44 @@ var CONTROL_OPTIONS = [
     description: "Conversation mode."
   }
 ];
+var LITERAL_OPTION = {
+  name: "literal",
+  kind: "boolean",
+  description: "Send the prompt as plain text: a leading /name never runs a provider command (by default it does)."
+};
+var ENQUEUE_OPTION = {
+  name: "enqueue",
+  kind: "boolean",
+  description: "If the session is busy, queue this behind its current work (the backend sends it later) instead of refusing."
+};
+var ATTACH_OPTION = {
+  name: "attach",
+  kind: "list",
+  valueName: "FILE",
+  description: `Send a local file with the prompt (repeatable; at most ${PUBLIC_API_LIMITS.promptAttachmentsMaxItems} files, ${PUBLIC_API_LIMITS.promptAttachmentsMaxBytes / 1024} KiB in total).`
+};
+async function readAttachments(context, options2) {
+  const files = options2.attach ?? [];
+  if (files.length === 0)
+    return;
+  if (files.length > PUBLIC_API_LIMITS.promptAttachmentsMaxItems) {
+    throw new CliError("input-too-large", `At most ${PUBLIC_API_LIMITS.promptAttachmentsMaxItems} attachments are allowed`);
+  }
+  let remaining = PUBLIC_API_LIMITS.promptAttachmentsMaxBytes;
+  const names = new Set;
+  const attachments = [];
+  for (const file of files) {
+    const name = path15.basename(file);
+    if (names.has(name)) {
+      throw new CliError("invalid-input", `Two attachments are both named ${name}`);
+    }
+    names.add(name);
+    const bytes = await readBinaryFile(context.io, file, `Attachment ${name}`, remaining);
+    remaining -= bytes.byteLength;
+    attachments.push({ name, dataBase64: Buffer.from(bytes).toString("base64") });
+  }
+  return attachments;
+}
 function waitBudget(options2) {
   return options2.timeout ?? DEFAULT_WAIT_MS;
 }
@@ -12007,6 +13429,17 @@ function controlsInput(options2) {
     input.mode = oneOf(options2.mode, ["plan", "build"], "--mode");
   return input;
 }
+function holdLabel(hold) {
+  if (!hold)
+    return "";
+  if (hold.heldAt !== undefined) {
+    return `  (paused${hold.reason ? `, ${hold.reason}` : ""}; resume with interactions hold --resume)`;
+  }
+  if (hold.available) {
+    return `  (pausable${hold.reason ? `, ${hold.reason}` : ""} with interactions hold)`;
+  }
+  return `  (not pausable${hold.reason ? `: ${hold.reason}` : ""})`;
+}
 function parseAnswers(options2) {
   const answers = new Map;
   const entry = (questionId) => {
@@ -12039,6 +13472,7 @@ function parseAnswers(options2) {
 var sessionCommands = [
   {
     path: ["agent", "options"],
+    action: "agent.options",
     summary: "Enabled agents, model catalogues (with freshness), and supported controls.",
     description: "Reads the backend's cached catalogues; --refresh asks providers again, which can take a while. An `empty` catalogue is a successful empty answer; `stale`/`unavailable` means the backend could not read it.",
     positionals: [],
@@ -12084,6 +13518,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "list"],
+    action: "session.list",
     summary: "List native-agent sessions of an environment (no transcripts are read).",
     positionals: [],
     options: [
@@ -12112,6 +13547,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "get"],
+    action: "session.get",
     summary: "Show one session (activity, latest request, pending interactions).",
     positionals: [{ name: "session", required: true }],
     options: [],
@@ -12132,6 +13568,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "start"],
+    action: "session.start",
     summary: "Start an independent conversation in a ready environment and send its first prompt.",
     description: "Creates a new agent tab without focusing it. The response is a submission receipt; add --wait (or run `run wait`) to observe the turn. Independent sessions in one environment share its files.",
     positionals: [],
@@ -12151,9 +13588,12 @@ var sessionCommands = [
       { name: "title", kind: "string", valueName: "TITLE", description: "Tab title." },
       ...CONTROL_OPTIONS,
       ...PROMPT_OPTIONS,
+      LITERAL_OPTION,
+      ATTACH_OPTION,
       ...WAIT_OPTIONS,
       REQUEST_ID_OPTION
     ],
+    inputFields: { attach: "attachments" },
     idOutput: "session ID",
     async run(context, parsed) {
       const options2 = parsed.options;
@@ -12164,12 +13604,15 @@ var sessionCommands = [
         throw new CliError("invalid-input", "--environment and --agent are required");
       }
       const prompt = await readPrompt(context.io, options2);
+      const attachments = await readAttachments(context, options2);
       const { session, result, receipt, warnings, recoveryDeadline } = await submitRun(context, "session.start", {
         environmentId,
         agent,
         prompt,
         ...options2.title !== undefined ? { title: options2.title } : {},
-        ...controlsInput(options2)
+        ...controlsInput(options2),
+        ...options2.literal === true ? { literal: true } : {},
+        ...attachments ? { attachments } : {}
       }, options2);
       const fromReceipt = (final) => ({
         result: {
@@ -12194,8 +13637,9 @@ var sessionCommands = [
   },
   {
     path: ["session", "prompt"],
-    summary: "Send a follow-up prompt to an idle session.",
-    description: "Busy sessions are refused (exit 8); use `session steer` to redirect an active turn. The target must be the exact session: a vanished session is never replaced by a new one.",
+    action: "session.prompt",
+    summary: "Send a follow-up prompt to an idle session, or queue it behind a busy one.",
+    description: "Busy sessions are refused (exit 8) unless --enqueue puts the prompt in the backend's durable queue; use `session steer` to redirect an active turn. A leading /name runs that provider command unless --literal is given. The target must be the exact session: a vanished session is never replaced by a new one.",
     positionals: [{ name: "session", required: true }],
     options: [
       {
@@ -12205,18 +13649,26 @@ var sessionCommands = [
         description: "Conversation mode for this turn."
       },
       ...PROMPT_OPTIONS,
+      LITERAL_OPTION,
+      ENQUEUE_OPTION,
+      ATTACH_OPTION,
       ...WAIT_OPTIONS,
       REQUEST_ID_OPTION
     ],
+    inputFields: { attach: "attachments" },
     idOutput: "operation (run) ID",
     async run(context, parsed) {
       const options2 = parsed.options;
       validateWaitOptions(options2);
       const prompt = await readPrompt(context.io, options2);
+      const attachments = await readAttachments(context, options2);
       const { session, result, receipt, warnings, recoveryDeadline } = await submitRun(context, "session.prompt", {
         sessionId: parsed.positionals.session,
         prompt,
-        ...options2.mode !== undefined ? { mode: oneOf(options2.mode, ["plan", "build"], "--mode") } : {}
+        ...options2.mode !== undefined ? { mode: oneOf(options2.mode, ["plan", "build"], "--mode") } : {},
+        ...options2.literal === true ? { literal: true } : {},
+        ...options2.enqueue === true ? { enqueue: true } : {},
+        ...attachments ? { attachments } : {}
       }, options2);
       const runId = result?.runId ?? receipt.operationId;
       return finishRun(context, parsed, {
@@ -12230,8 +13682,101 @@ var sessionCommands = [
       }, recoveryDeadline);
     }
   },
+  {
+    path: ["session", "commands"],
+    action: "session.commands",
+    summary: "List the session's slash commands (ID, name, availability, argument policy).",
+    description: "Reads the catalogue the backend already holds; --refresh asks the provider again. Use an ID (or a unique name) with `session command`.",
+    positionals: [{ name: "session", required: true }],
+    options: [
+      { name: "refresh", kind: "boolean", description: "Ask the provider for its list again." }
+    ],
+    idOutput: "command IDs, one per line",
+    async run(context, parsed) {
+      const session = await context.session();
+      const list = await session.read("session.commands", {
+        sessionId: parsed.positionals.session,
+        ...parsed.options.refresh === true ? { refresh: true } : {}
+      });
+      return {
+        action: "session.commands",
+        result: list,
+        connection: session.identity,
+        ids: list.commands.map((command) => command.id),
+        human: [
+          `catalogue ${list.catalogue.status}${list.catalogue.error ? ` (${list.catalogue.error})` : ""}`,
+          ...table(["NAME", "ID", "ARGS", "AVAILABLE", "DESCRIPTION"], list.commands.map((command) => [
+            command.name,
+            command.id,
+            command.arguments,
+            command.available ? "yes" : `no: ${command.unavailableReason ?? ""}`,
+            (command.description ?? "").slice(0, 60)
+          ]))
+        ]
+      };
+    }
+  },
+  {
+    path: ["session", "command"],
+    action: "session.command",
+    summary: "Run one selected slash command in a session.",
+    description: "Pass the command's ID or unique name with --command and its arguments after `--`. The command is sent as a selection: if it is missing, ambiguous, unavailable or changed (--expected-binding-revision), the request fails (exit 3 or 8) and nothing is sent as text. Busy sessions are refused unless --enqueue.",
+    positionals: [{ name: "session", required: true }],
+    options: [
+      {
+        name: "command",
+        kind: "string",
+        valueName: "ID|NAME",
+        description: "Command ID or name from `session commands`."
+      },
+      {
+        name: "expected-binding-revision",
+        kind: "string",
+        valueName: "REV",
+        description: "Refuse if the command changed since `session commands` listed this revision."
+      },
+      ENQUEUE_OPTION,
+      ...WAIT_OPTIONS,
+      REQUEST_ID_OPTION
+    ],
+    acceptsRest: true,
+    idOutput: "operation (run) ID",
+    examples: [
+      "orkestrator session command ses_\u2026 --command /review -- the open diff",
+      "orkestrator session command ses_\u2026 --command /compact --wait"
+    ],
+    async run(context, parsed) {
+      const options2 = parsed.options;
+      validateWaitOptions(options2);
+      const command = stringOption(options2, "command");
+      if (!command)
+        throw new CliError("invalid-input", "--command is required");
+      const args = parsed.rest.join(" ");
+      if (Buffer.byteLength(args) > PUBLIC_API_LIMITS.commandArgumentsMaxBytes) {
+        throw new CliError("input-too-large", "Command arguments are too large");
+      }
+      const { session, result, receipt, warnings, recoveryDeadline } = await submitRun(context, "session.command", {
+        sessionId: parsed.positionals.session,
+        command,
+        ...args.trim() ? { arguments: args } : {},
+        ...options2["expected-binding-revision"] !== undefined ? { expectedBindingRevision: options2["expected-binding-revision"] } : {},
+        ...options2.enqueue === true ? { enqueue: true } : {}
+      }, options2);
+      const runId = result?.runId ?? receipt.operationId;
+      return finishRun(context, parsed, {
+        action: "session.command",
+        result: result ?? { runId },
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: [runId],
+        human: receipt ? receiptLines(receipt) : [`run ${runId}`]
+      }, recoveryDeadline);
+    }
+  },
   {
     path: ["session", "stop"],
+    action: "session.stop",
     summary: "Stop the session's current turn (not the environment).",
     description: "--expect-run binds the stop to that run: if a different turn is now active the stop is refused (exit 8). Success requires the provider to confirm the turn ended; otherwise the result is unknown (exit 7).",
     positionals: [{ name: "session", required: true }],
@@ -12263,6 +13808,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "steer"],
+    action: "session.steer",
     summary: "Redirect the active turn (providers that support steering only).",
     positionals: [{ name: "session", required: true }],
     options: [
@@ -12311,6 +13857,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "config", "get"],
+    action: "session.config.get",
     summary: "Show the live session's effective controls.",
     positionals: [{ name: "session", required: true }],
     options: [],
@@ -12329,6 +13876,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "config", "set"],
+    action: "session.config.set",
     summary: "Change the live session's controls (not environment defaults).",
     description: "Applies to this conversation now, as validated by its provider; the response shows the values actually in force (a provider may clamp them). To change defaults for future sessions use `environment config set`.",
     positionals: [{ name: "session", required: true }],
@@ -12350,6 +13898,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "history"],
+    action: "session.history",
     summary: "List earlier provider conversations this session can resume.",
     positionals: [{ name: "session", required: true }],
     options: [],
@@ -12372,6 +13921,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "resume"],
+    action: "session.resume",
     summary: "Rebind the session to an earlier conversation from `session history`.",
     description: "The current conversation's history is kept; nothing is deleted.",
     positionals: [
@@ -12386,6 +13936,8 @@ var sessionCommands = [
   },
   {
     path: ["session", "fork"],
+    action: "session.fork",
+    inputFields: { message: "messageId" },
     summary: "Fork the conversation into a new session (optionally at a message).",
     positionals: [{ name: "session", required: true }],
     options: [
@@ -12416,6 +13968,7 @@ var sessionCommands = [
   },
   {
     path: ["session", "interactions", "list"],
+    action: "session.interactions",
     summary: "List pending questions and approvals with their permitted answers.",
     positionals: [{ name: "session", required: true }],
     options: [],
@@ -12432,6 +13985,7 @@ var sessionCommands = [
         ids: interactions.items.map((item) => item.id),
         human: interactions.items.length ? interactions.items.flatMap((item) => [
           `${item.id}  ${item.kind}  revision ${item.revision}  ${item.title}`,
+          ...item.expiresAt !== undefined ? [`  expires ${new Date(item.expiresAt).toISOString()}${holdLabel(item.hold)}`] : [],
           ...item.questions.map((question) => `  ${question.id}: ${question.prompt} [${question.options.map((option) => option.id).join(", ")}]${question.allowFreeText ? " (free text)" : ""}`),
           `  actions: ${item.actions.join(", ")}`
         ]) : ["(no pending interactions)"]
@@ -12440,6 +13994,8 @@ var sessionCommands = [
   },
   {
     path: ["session", "interactions", "resolve"],
+    action: "session.interaction.resolve",
+    inputFields: { revision: "expectedRevision", choose: "answers", text: "answers" },
     summary: "Answer one pending interaction at its current revision.",
     description: "--revision must match the interaction's current revision; a replaced or expired interaction is refused (exit 8), never answered. Nothing is approved implicitly.",
     positionals: [
@@ -12509,8 +14065,44 @@ var sessionCommands = [
       };
     }
   },
+  {
+    path: ["session", "interactions", "hold"],
+    action: "session.interaction.hold",
+    inputFields: { resume: "held" },
+    summary: "Pause one pending interaction's countdown; --resume restarts a fresh window.",
+    description: "The pause is enforced by the provider bridge: a paused request still ends at the 24-hour hold ceiling or the provider's own sooner limit (the moved expiresAt). An interaction with no countdown, or whose bridge predates pausing, is refused (exit 8). Nothing is answered.",
+    positionals: [
+      { name: "session", required: true },
+      { name: "interaction", required: true }
+    ],
+    options: [
+      {
+        name: "resume",
+        kind: "boolean",
+        description: "Resume the countdown instead of pausing it."
+      },
+      REQUEST_ID_OPTION
+    ],
+    async run(context, parsed) {
+      const held = parsed.options.resume !== true;
+      const { session, result, receipt, warnings } = await submit(context, "session.interaction.hold", {
+        sessionId: parsed.positionals.session,
+        interactionId: parsed.positionals.interaction,
+        held
+      }, parsed.options);
+      return {
+        action: "session.interaction.hold",
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        human: receipt ? receiptLines(receipt) : [held ? "paused" : "resumed"]
+      };
+    }
+  },
   {
     path: ["session", "transcript"],
+    action: "session.transcript",
     summary: "Read a bounded transcript page; --follow polls for new messages.",
     description: "Pages are oldest-first and hold at most --limit messages (max 100). Pass the returned olderCursor as --before for earlier history. --follow --jsonl streams one record per new message by polling snapshots; it stops at --timeout or Ctrl+C and never affects the session.",
     positionals: [{ name: "session", required: true }],
@@ -12612,19 +14204,256 @@ var sessionCommands = [
           throw error;
       }
       return {
-        action: "session.transcript",
-        result: { followed: true, emitted },
+        action: "session.transcript",
+        result: { followed: true, emitted },
+        connection: session.identity,
+        human: []
+      };
+    }
+  }
+];
+
+// src/client/commands/ticket.ts
+var STATUSES = ["backlog", "in-progress", "review", "done"];
+var PROJECT_OPTION = {
+  name: "project",
+  kind: "string",
+  valueName: "PROJECT_ID",
+  description: "Project ID (project list)."
+};
+var STATUS_OPTION = {
+  name: "status",
+  kind: "string",
+  valueName: "COLUMN",
+  description: `Column: ${STATUSES.join(", ")}.`
+};
+var TEXT_FIELD_OPTIONS = [
+  { name: "title", kind: "string", valueName: "TEXT", description: "Ticket title." },
+  {
+    name: "description",
+    kind: "string",
+    valueName: "TEXT",
+    description: "Description (or --description-file)."
+  },
+  {
+    name: "description-file",
+    kind: "string",
+    valueName: "PATH",
+    description: "Read the description from a local file."
+  },
+  {
+    name: "criteria",
+    kind: "string",
+    valueName: "TEXT",
+    description: "Acceptance criteria."
+  }
+];
+function requireProject(options2) {
+  const projectId = stringOption(options2, "project");
+  if (!projectId)
+    throw new CliError("invalid-input", "--project is required");
+  return projectId;
+}
+async function ticketFields(io, options2) {
+  const description = await readTextSource(io, {
+    file: options2["description-file"],
+    inline: options2.description,
+    label: "Description",
+    maxBytes: 400000,
+    names: { file: "--description-file", stdin: "--description-stdin", inline: "--description" },
+    required: false
+  });
+  return {
+    ...stringOption(options2, "title") !== undefined ? { title: options2.title } : {},
+    ...description !== undefined ? { description } : {},
+    ...stringOption(options2, "criteria") !== undefined ? { acceptanceCriteria: options2.criteria } : {},
+    ...options2.status !== undefined ? { status: oneOf(options2.status, STATUSES, "--status") } : {}
+  };
+}
+function ticketRows(tickets) {
+  return table(["ID", "STATUS", "TITLE", "COMMENTS"], tickets.map((ticket) => [ticket.id, ticket.status, ticket.title, String(ticket.commentCount)]));
+}
+function ticketLines(ticket) {
+  return [
+    ...keyValues([
+      ["id", ticket.id],
+      ["project", ticket.projectId],
+      ["status", ticket.status],
+      ["title", ticket.title],
+      ["environment", ticket.environmentId],
+      ["pr", ticket.pr.url]
+    ]),
+    ...ticket.description ? ["", ticket.description] : [],
+    ...ticket.acceptanceCriteria ? ["", "Acceptance criteria:", ticket.acceptanceCriteria] : [],
+    ...ticket.comments.flatMap((comment) => ["", `[${comment.createdAt}] ${comment.text}`])
+  ];
+}
+var ticketCommands = [
+  {
+    path: ["ticket", "list"],
+    action: "ticket.list",
+    summary: "List a project's Kanban tickets.",
+    positionals: [],
+    options: [
+      PROJECT_OPTION,
+      STATUS_OPTION,
+      { name: "limit", kind: "integer", valueName: "N", description: "Items per page (max 200)." },
+      {
+        name: "cursor",
+        kind: "string",
+        valueName: "CURSOR",
+        description: "Continue from a previous page."
+      }
+    ],
+    idOutput: "ticket IDs, one per line",
+    async run(context, parsed) {
+      const session = await context.session();
+      const page = await session.read("ticket.list", {
+        projectId: requireProject(parsed.options),
+        ...parsed.options.status !== undefined ? { status: oneOf(parsed.options.status, STATUSES, "--status") } : {},
+        ...parsed.options.limit !== undefined ? { limit: parsed.options.limit } : {},
+        ...parsed.options.cursor !== undefined ? { cursor: parsed.options.cursor } : {}
+      });
+      return {
+        action: "ticket.list",
+        result: page,
         connection: session.identity,
-        human: []
+        ids: page.items.map((ticket) => ticket.id),
+        human: [
+          ...ticketRows(page.items),
+          ...page.nextCursor ? [`more: --cursor ${page.nextCursor}`] : []
+        ]
+      };
+    }
+  },
+  {
+    path: ["ticket", "get"],
+    action: "ticket.get",
+    summary: "Show one ticket with its description, criteria and latest comments.",
+    positionals: [{ name: "ticket", required: true }],
+    options: [PROJECT_OPTION],
+    inputFields: { ticket: "ticketId" },
+    idOutput: "ticket ID",
+    async run(context, parsed) {
+      const session = await context.session();
+      const ticket = await session.read("ticket.get", {
+        projectId: requireProject(parsed.options),
+        ticketId: parsed.positionals.ticket
+      });
+      return {
+        action: "ticket.get",
+        result: ticket,
+        connection: session.identity,
+        ids: [ticket.id],
+        human: ticketLines(ticket)
+      };
+    }
+  },
+  {
+    path: ["ticket", "create"],
+    action: "ticket.create",
+    summary: "Create a Kanban ticket.",
+    positionals: [],
+    options: [PROJECT_OPTION, ...TEXT_FIELD_OPTIONS, STATUS_OPTION, REQUEST_ID_OPTION],
+    inputFields: {
+      "description-file": "description",
+      criteria: "acceptanceCriteria"
+    },
+    idOutput: "ticket ID",
+    async run(context, parsed) {
+      const fields = await ticketFields(context.io, parsed.options);
+      if (typeof fields.title !== "string")
+        throw new CliError("invalid-input", "--title is required");
+      const { session, result, receipt, warnings } = await submit(context, "ticket.create", { projectId: requireProject(parsed.options), ...fields }, parsed.options);
+      return {
+        action: "ticket.create",
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: [result.ticketId],
+        human: [`created ticket ${result.ticketId}`]
+      };
+    }
+  },
+  {
+    path: ["ticket", "update"],
+    action: "ticket.update",
+    summary: "Change a ticket's title, description, criteria or column.",
+    positionals: [{ name: "ticket", required: true }],
+    options: [PROJECT_OPTION, ...TEXT_FIELD_OPTIONS, STATUS_OPTION, REQUEST_ID_OPTION],
+    inputFields: {
+      ticket: "ticketId",
+      "description-file": "description",
+      criteria: "acceptanceCriteria"
+    },
+    idOutput: "ticket ID",
+    async run(context, parsed) {
+      const fields = await ticketFields(context.io, parsed.options);
+      if (Object.keys(fields).length === 0) {
+        throw new CliError("invalid-input", "Pass at least one field to change");
+      }
+      const { session, result, receipt, warnings } = await submit(context, "ticket.update", {
+        projectId: requireProject(parsed.options),
+        ticketId: parsed.positionals.ticket,
+        ...fields
+      }, parsed.options);
+      return {
+        action: "ticket.update",
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: [result.ticketId],
+        human: [`updated ticket ${result.ticketId}`]
+      };
+    }
+  },
+  {
+    path: ["ticket", "comment"],
+    action: "ticket.comment",
+    summary: "Append a comment to a ticket.",
+    positionals: [{ name: "ticket", required: true }],
+    options: [
+      PROJECT_OPTION,
+      { name: "text", kind: "string", valueName: "TEXT", description: "Comment text." },
+      {
+        name: "text-file",
+        kind: "string",
+        valueName: "PATH",
+        description: "Read the comment from a local file."
+      },
+      REQUEST_ID_OPTION
+    ],
+    inputFields: { ticket: "ticketId", "text-file": "text" },
+    idOutput: "ticket ID",
+    async run(context, parsed) {
+      const text = await readTextSource(context.io, {
+        file: parsed.options["text-file"],
+        inline: parsed.options.text,
+        label: "Comment",
+        maxBytes: 80000,
+        names: { file: "--text-file", stdin: "--text-stdin", inline: "--text" },
+        required: true
+      });
+      const { session, result, receipt, warnings } = await submit(context, "ticket.comment", { projectId: requireProject(parsed.options), ticketId: parsed.positionals.ticket, text }, parsed.options);
+      return {
+        action: "ticket.comment",
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: [result.ticketId],
+        human: [`commented on ticket ${result.ticketId}`]
       };
     }
   }
 ];
 
 // src/client/commands/toolchain.ts
-import path18 from "path";
+import path19 from "path";
 function dataDirectory2(context, parsed) {
-  return path18.resolve(stringOption(parsed.options, "data-dir") ?? context.io.env.ORKESTRATOR_DATA_DIR ?? defaultDataDir(process.platform, context.io.env));
+  return path19.resolve(stringOption(parsed.options, "data-dir") ?? context.io.env.ORKESTRATOR_DATA_DIR ?? defaultDataDir(process.platform, context.io.env));
 }
 function requestedTools(parsed) {
   const raw = parsed.options.tool;
@@ -12727,7 +14556,7 @@ var toolchainCommands = [
       const rows = installed.tools.map((tool) => ({
         tool,
         version: installed.versions[tool] ?? "",
-        executable: path18.join(installed.currentBinDir, path18.basename(installed.executables[tool]))
+        executable: path19.join(installed.currentBinDir, path19.basename(installed.executables[tool]))
       }));
       return {
         action: "toolchain.install",
@@ -12757,6 +14586,337 @@ var toolchainCommands = [
   }
 ];
 
+// src/client/commands/workflows.ts
+init_agent_platforms();
+function parseSelection(raw, flag) {
+  const equals = raw.indexOf("=");
+  const agent = raw.slice(0, equals);
+  if (equals <= 0 || !AGENT_PLATFORMS.includes(agent)) {
+    throw new CliError("invalid-input", `${flag} expects AGENT=MODEL[@EFFORT] with AGENT one of ${AGENT_PLATFORMS.join(", ")}`);
+  }
+  const rest = raw.slice(equals + 1);
+  const at = rest.lastIndexOf("@");
+  const model = at > 0 ? rest.slice(0, at) : rest;
+  const reasoningEffort = at > 0 ? rest.slice(at + 1) : undefined;
+  if (!model)
+    throw new CliError("invalid-input", `${flag} needs a model`);
+  return { agent, model, ...reasoningEffort ? { reasoningEffort } : {} };
+}
+var SELECTION_HELP = "AGENT=MODEL[@EFFORT], e.g. codex=gpt-5.5@high.";
+var AGENT_OPTIONS = [
+  {
+    name: "agent",
+    kind: "string",
+    valueName: "AGENT",
+    description: "Agent platform. Omitted: the action's configured default."
+  },
+  { name: "model", kind: "string", valueName: "MODEL", description: "Requires --agent." },
+  {
+    name: "reasoning",
+    kind: "string",
+    valueName: "LEVEL",
+    description: "Reasoning level; requires --model."
+  },
+  {
+    name: "fast",
+    kind: "boolean",
+    negatable: true,
+    description: "Fast speed where supported."
+  }
+];
+function reviewLines(review) {
+  return keyValues([
+    ["review", review.id],
+    ["environment", review.environmentId],
+    ["phase", review.phase],
+    ...review.targetBranch ? [["target", review.targetBranch]] : [],
+    ...review.error ? [["error", review.error]] : []
+  ]);
+}
+function reviewMutation(path, action, summary) {
+  return {
+    path: ["review", path],
+    action,
+    summary,
+    positionals: [{ name: "workflow", required: true, description: "Multi Review ID." }],
+    options: [REQUEST_ID_OPTION],
+    inputFields: { workflow: "workflowId" },
+    idOutput: "workflow ID",
+    async run(context, parsed) {
+      const workflowId = parsed.positionals.workflow;
+      const { session, result, receipt, warnings } = await submit(context, action, { workflowId }, parsed.options);
+      return {
+        action,
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: [workflowId],
+        human: keyValues([
+          ["review", workflowId],
+          ["phase", result.phase ?? receipt?.state ?? ""]
+        ])
+      };
+    }
+  };
+}
+function prCommand(verb) {
+  const action = verb === "create" ? "pr.create" : "pr.resolve";
+  return {
+    path: ["pr", verb],
+    action,
+    summary: verb === "create" ? "Start the Create PR agent: commit, push and open a pull request (never merges)." : "Start the Resolve Conflicts agent: merge the target branch, resolve, validate and push.",
+    description: "Opens the same agent tab as the environment's button, without focusing it. The response is a run receipt; add --wait (or `run wait`) to observe it.",
+    positionals: [{ name: "environment", required: true, description: "Ready environment." }],
+    options: [
+      {
+        name: "target-branch",
+        kind: "string",
+        valueName: "BRANCH",
+        description: verb === "create" ? "Pull request base. Omitted: the project's PR base branch." : "Branch to merge in. Omitted: the environment's PR base branch."
+      },
+      ...AGENT_OPTIONS,
+      ...WAIT_OPTIONS,
+      REQUEST_ID_OPTION
+    ],
+    idOutput: "session ID",
+    async run(context, parsed) {
+      const options2 = parsed.options;
+      validateWaitOptions(options2);
+      const fast = optionalBoolean(options2, "fast");
+      const input = {
+        environmentId: parsed.positionals.environment,
+        ...options2["target-branch"] !== undefined ? { targetBranch: options2["target-branch"] } : {},
+        ...options2.agent !== undefined ? { agent: options2.agent } : {},
+        ...options2.model !== undefined ? { model: options2.model } : {},
+        ...options2.reasoning !== undefined ? { reasoning: options2.reasoning } : {},
+        ...fast !== undefined ? { fastMode: fast } : {}
+      };
+      const { session, result, receipt, warnings, recoveryDeadline } = await submitRun(context, action, input, options2);
+      const fromReceipt = (final) => ({
+        result: {
+          sessionId: final.resources.sessionId ?? null,
+          tabId: final.resources.tabId ?? null,
+          runId: final.operationId
+        },
+        ids: final.resources.sessionId ? [final.resources.sessionId] : []
+      });
+      return finishRun(context, parsed, {
+        action,
+        ...result ? { result, ids: [result.sessionId] } : fromReceipt(receipt),
+        receipt,
+        warnings,
+        connection: session.identity,
+        human: result ? keyValues([
+          ["session", result.sessionId],
+          ["run", result.runId]
+        ]) : []
+      }, recoveryDeadline, result ? undefined : fromReceipt);
+    }
+  };
+}
+var workflowCommands = [
+  {
+    path: ["node", "list"],
+    action: "node.list",
+    summary: "List this node and the leaf nodes it controls; pass a node's ID with --node.",
+    positionals: [],
+    options: [],
+    idOutput: "node IDs",
+    async run(context) {
+      if (context.global.node) {
+        throw new CliError("invalid-input", "node list always lists the connected node; omit --node");
+      }
+      const session = await context.session();
+      const list = await session.read("node.list", {});
+      return {
+        action: "node.list",
+        result: list,
+        connection: session.identity,
+        ids: list.items.map((node) => node.nodeId),
+        human: table(["NODE", "NAME", "STATE", "VERSION", "ACTIONS"], list.items.map((node) => [
+          node.nodeId,
+          node.self ? `${node.name} (this node)` : node.name,
+          node.state,
+          node.version ?? "",
+          node.publicActions ? "yes" : node.reason ?? "no"
+        ]))
+      };
+    }
+  },
+  {
+    path: ["review", "launch"],
+    action: "review.launch",
+    summary: "Start an environment's Multi Review, as its button does (an active one is reused).",
+    description: "Omitted reviewers, models and auto-actions use the saved Multi Review settings. The review continues in the backend; follow it with `review get`.",
+    positionals: [{ name: "environment", required: true, description: "Environment to review." }],
+    options: [
+      {
+        name: "reviewer",
+        kind: "list",
+        valueName: "SELECTION",
+        description: `Reviewer row (repeatable): ${SELECTION_HELP}`
+      },
+      {
+        name: "review-model",
+        kind: "string",
+        valueName: "SELECTION",
+        description: `Preparation and consolidation model: ${SELECTION_HELP}`
+      },
+      {
+        name: "fix-model",
+        kind: "string",
+        valueName: "SELECTION",
+        description: `Fix model: ${SELECTION_HELP}`
+      },
+      {
+        name: "auto-fix",
+        kind: "boolean",
+        negatable: true,
+        description: "Start the Fix when consolidation reports findings."
+      },
+      {
+        name: "auto-pr",
+        kind: "boolean",
+        negatable: true,
+        description: "Open the pull request after the Fix (never merges)."
+      },
+      {
+        name: "target-branch",
+        kind: "string",
+        valueName: "BRANCH",
+        description: "Branch to review against. Omitted: the project's PR base branch."
+      },
+      {
+        name: "instruction-file",
+        kind: "string",
+        valueName: "PATH",
+        description: "Read the review instruction from a local file (empty: none)."
+      },
+      REQUEST_ID_OPTION
+    ],
+    inputFields: {
+      reviewer: "reviewers",
+      "instruction-file": "reviewInstruction"
+    },
+    idOutput: "workflow ID",
+    async run(context, parsed) {
+      const options2 = parsed.options;
+      const reviewers = (options2.reviewer ?? []).map((raw) => parseSelection(raw, "--reviewer"));
+      const reviewModel = stringOption(options2, "review-model");
+      const fixModel = stringOption(options2, "fix-model");
+      const autoFix = optionalBoolean(options2, "auto-fix");
+      const autoPr = optionalBoolean(options2, "auto-pr");
+      const instructionFile = stringOption(options2, "instruction-file");
+      const reviewInstruction = instructionFile !== undefined ? await readTextSource(context.io, {
+        file: instructionFile,
+        label: "Review instruction",
+        maxBytes: 1e5,
+        names: { file: "--instruction-file", stdin: "--instruction-file -" },
+        required: false
+      }) : undefined;
+      const { session, result, receipt, warnings } = await submit(context, "review.launch", {
+        environmentId: parsed.positionals.environment,
+        ...reviewers.length ? { reviewers } : {},
+        ...reviewModel ? { reviewModel: parseSelection(reviewModel, "--review-model") } : {},
+        ...fixModel ? { fixModel: parseSelection(fixModel, "--fix-model") } : {},
+        ...autoFix !== undefined ? { autoFix } : {},
+        ...autoPr !== undefined ? { autoPr } : {},
+        ...options2["target-branch"] !== undefined ? { targetBranch: options2["target-branch"] } : {},
+        ...reviewInstruction !== undefined ? { reviewInstruction } : {}
+      }, options2);
+      return {
+        action: "review.launch",
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: [result.workflowId],
+        human: keyValues([
+          ["review", result.workflowId],
+          ["phase", result.phase ?? ""],
+          ["reused", result.reused ? "yes" : "no"]
+        ])
+      };
+    }
+  },
+  {
+    path: ["review", "list"],
+    action: "review.list",
+    summary: "List an environment's Multi Reviews, newest first.",
+    positionals: [{ name: "environment", required: true }],
+    options: [],
+    idOutput: "workflow IDs",
+    async run(context, parsed) {
+      const session = await context.session();
+      const page = await session.read("review.list", {
+        environmentId: parsed.positionals.environment
+      });
+      return {
+        action: "review.list",
+        result: page,
+        connection: session.identity,
+        ids: page.items.map((review) => review.id),
+        human: table(["REVIEW", "PHASE", "TARGET", "CREATED"], page.items.map((review) => [
+          review.id,
+          review.phase,
+          review.targetBranch ?? "",
+          review.createdAt ?? ""
+        ]))
+      };
+    }
+  },
+  {
+    path: ["review", "get"],
+    action: "review.get",
+    summary: "Read one Multi Review.",
+    positionals: [{ name: "workflow", required: true, description: "Multi Review ID." }],
+    options: [],
+    inputFields: { workflow: "workflowId" },
+    async run(context, parsed) {
+      const session = await context.session();
+      const review = await session.read("review.get", {
+        workflowId: parsed.positionals.workflow
+      });
+      return {
+        action: "review.get",
+        result: review,
+        connection: session.identity,
+        human: reviewLines(review)
+      };
+    }
+  },
+  {
+    path: ["review", "open"],
+    action: "review.open",
+    summary: "Open or focus a Multi Review's tab (--fix: its Fix tab); starts no work.",
+    positionals: [{ name: "workflow", required: true, description: "Multi Review ID." }],
+    options: [
+      { name: "fix", kind: "boolean", description: "Open the Fix session tab instead." },
+      REQUEST_ID_OPTION
+    ],
+    inputFields: { workflow: "workflowId", fix: "surface" },
+    idOutput: "workflow ID",
+    async run(context, parsed) {
+      const workflowId = parsed.positionals.workflow;
+      const { session, result, receipt, warnings } = await submit(context, "review.open", { workflowId, ...parsed.options.fix === true ? { surface: "fix" } : {} }, parsed.options);
+      return {
+        action: "review.open",
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: [workflowId],
+        human: [`opened review ${workflowId}`]
+      };
+    }
+  },
+  reviewMutation("address", "review.address", "Address a Multi Review's findings: hand them to its Fix session."),
+  reviewMutation("cancel", "review.cancel", "Cancel a running Multi Review; its record is kept."),
+  prCommand("create"),
+  prCommand("resolve")
+];
+
 // src/client/help.ts
 var GROUP_SUMMARIES = {
   connection: "Select and verify the backend this client talks to.",
@@ -12891,6 +15051,7 @@ class OutputWriter {
         ok: true,
         ...outcome.connection ? { connection: outcome.connection } : {},
         result: outcome.result ?? null,
+        ...outcome.node ? { node: outcome.node } : {},
         ...outcome.receipt ? { receipt: outcome.receipt } : {},
         ...outcome.warnings && outcome.warnings.length > 0 ? { warnings: outcome.warnings } : {}
       };
@@ -12914,7 +15075,7 @@ class OutputWriter {
       this.io.stderr(`warning: ${warning}
 `);
     if (outcome.receipt)
-      this.io.stderr(`${receiptHint(outcome.receipt)}
+      this.io.stderr(`${receiptHint(outcome.receipt, outcome.node)}
 `);
     return outcome.exitCodeOverride ?? 0;
   }
@@ -12922,12 +15083,14 @@ class OutputWriter {
     const cliError = error instanceof CliError ? error : new CliError("internal-error", error instanceof Error ? boundMessage(error.message) : "Unexpected client failure");
     const exitCode = exitCodeForError(cliError.code);
     const receipt = cliError.receipt ?? context.receipt;
+    const node = cliError.node ?? context.node;
     if (this.mode === "json" || this.mode === "jsonl") {
       const envelope = {
         schemaVersion: PUBLIC_API_SCHEMA_VERSION,
         action: cliError.action ?? context.action ?? "cli",
         ok: false,
         ...context.connection ? { connection: context.connection } : {},
+        ...node ? { node } : {},
         error: {
           code: cliError.code,
           message: cliError.message,
@@ -12942,9 +15105,12 @@ class OutputWriter {
       return exitCode;
     }
     this.io.stderr(`error [${cliError.code}]: ${cliError.message}
+`);
+    if (typeof cliError.details?.recovery === "string")
+      this.io.stderr(`recover with \`${cliError.details.recovery}\`
 `);
     if (receipt)
-      this.io.stderr(`${receiptHint(receipt)}
+      this.io.stderr(`${receiptHint(receipt, node)}
 `);
     return exitCode;
   }
@@ -12955,6 +15121,7 @@ class OutputWriter {
       this.io.stdout(`${JSON.stringify({
         schemaVersion: PUBLIC_API_SCHEMA_VERSION,
         action: context.action,
+        ...context.node ? { node: context.node } : {},
         ok: false,
         ...context.connection ? { connection: context.connection } : {},
         error: {
@@ -12971,13 +15138,13 @@ class OutputWriter {
     this.io.stderr(`${message}
 `);
     if (context.receipt)
-      this.io.stderr(`${receiptHint(context.receipt)}
+      this.io.stderr(`${receiptHint(context.receipt, context.node)}
 `);
     return code;
   }
 }
-function receiptHint(receipt) {
-  return `operation ${receipt.operationId} (${receipt.action}) is ${receipt.state}; inspect with \`orkestrator run get ${receipt.operationId}\``;
+function receiptHint(receipt, node) {
+  return `operation ${receipt.operationId} (${receipt.action}) is ${receipt.state}; inspect with \`orkestrator run get ${receipt.operationId}${node ? ` --node ${node.nodeId}` : ""}\``;
 }
 function boundMessage(message, max = 500) {
   const single = message.replace(/\s+/g, " ").trim();
@@ -13046,10 +15213,16 @@ var CLIENT_COMMANDS = [
   ...environmentCommands,
   ...sessionCommands,
   ...changesCommands,
+  ...workflowCommands,
+  ...attentionCommands,
+  ...ticketCommands,
+  ...mailCommands,
+  ...scheduleCommands,
   ...runCommands,
   ...toolchainCommands,
   ...hostCommands,
-  ...serviceCommands
+  ...serviceCommands,
+  ...completionCommands(() => CLIENT_COMMANDS)
 ];
 var COMMAND_TREE = { commands: CLIENT_COMMANDS };
 function stripHelpWord(argv) {
@@ -13115,11 +15288,15 @@ async function runClient(argv, options2) {
       session = new ClientSession(target, new LocalReceiptStore(configStore.receiptsDirectory), {
         fetchImpl: options2.fetchImpl,
         requestTimeoutMs: parsed.global.requestTimeoutMs,
-        signal
+        signal,
+        ...parsed.global.node ? { node: parsed.global.node } : {}
       });
       return session;
     }
   };
+  if (command.spec.local && parsed.global.node) {
+    return output.failure(new CliError("invalid-input", `'${command.spec.path.join(" ")}' does not use --node`), { action });
+  }
   if (command.spec.local && (parsed.global.connection || parsed.global.profile)) {
     if (!(command.spec.path[0] === "connection" && command.spec.path[1] === "check")) {
       return output.failure(new CliError("invalid-input", `'${command.spec.path.join(" ")}' does not use --connection or --profile`), { action });
@@ -13129,12 +15306,14 @@ async function runClient(argv, options2) {
   try {
     outcome = await command.spec.run(context, command);
   } catch (error) {
-    const connection = session ? session.identity : undefined;
+    const failedSession = session;
+    const connection = failedSession?.identity;
     if (signal.aborted && !(error instanceof CliError && error.code === "observation-interrupted")) {
       return output.interrupted(signalName(signal), {
         action,
         ...error instanceof CliError && error.receipt ? { receipt: error.receipt } : {},
-        ...connection ? { connection } : {}
+        ...connection ? { connection } : {},
+        ...failedSession?.nodeTag ? { node: failedSession.nodeTag } : {}
       });
     }
     if (error instanceof CliError && error.code === "observation-interrupted") {
@@ -13142,12 +15321,22 @@ async function runClient(argv, options2) {
         action: error.action ?? action,
         details: error.details,
         ...error.receipt ? { receipt: error.receipt } : {},
-        ...connection ? { connection } : {}
+        ...connection ? { connection } : {},
+        ...failedSession?.nodeTag ? { node: failedSession.nodeTag } : {}
       });
     }
-    return output.failure(error, { action, ...connection ? { connection } : {} });
+    return output.failure(error, {
+      action,
+      ...connection ? { connection } : {},
+      ...failedSession?.nodeTag ? { node: failedSession.nodeTag } : {}
+    });
   }
-  return output.success(outcome);
+  const activeSession = session;
+  return output.success({
+    ...outcome,
+    ...activeSession?.nodeTag ? { node: activeSession.nodeTag } : {},
+    warnings: [...new Set([...outcome.warnings ?? [], ...activeSession?.warnings ?? []])]
+  });
 }
 async function runClientProcess(argv, version) {
   const controller = new AbortController;