orkestrator 2.34.5-beta → 2.35.1-beta

package/resources/claude-bridge/dist/index.js

@@ -4812,6 +4812,7 @@ var COORDINATOR_CONTROL_TOOL_NAMES = Object.freeze([
   "stop_node_environment",
   "stop_worker_turn",
   "switch_provider_account",
+  "set_account_auto_switch",
   "transfer_files",
   "update_schedule",
   "update_ticket"
@@ -8864,6 +8865,8 @@ function claudeLaunchConflict(runtime, request) {
     return "adaptive thinking";
   if (request.bypassCapable && !runtime.bypassCapable)
     return "bypass permission capability";
+  if (request.repositoryInstructions !== undefined && runtime.repositoryInstructions !== request.repositoryInstructions)
+    return "repository instructions";
   if (request.plugins !== undefined && runtime.plugins !== request.plugins)
     return "plugins";
   if (request.credentials !== undefined && runtime.credentials !== request.credentials)
@@ -13686,7 +13689,11 @@ function claudeUserMcpQueryOptions(policy) {
 async function loadScopedMcpServers(cwd, scope) {
   if (scope === "none") {
     const sources = { user: "excluded", project: "excluded" };
-    return { configs: {}, revision: { fingerprint: revisionFingerprint(sources), sources, scope } };
+    return {
+      configs: {},
+      layers: new Map,
+      revision: { fingerprint: revisionFingerprint(sources), sources, scope }
+    };
   }
   const path = claudeJsonPath();
   const [global2, projectGlobal, projectLocal] = await Promise.all([
@@ -13699,11 +13706,22 @@ async function loadScopedMcpServers(cwd, scope) {
     ...projectGlobal?.value,
     ...projectLocal?.value
   };
+  const layers = new Map;
+  for (const name of Object.keys(global2.value ?? {}))
+    layers.set(name, "user");
+  for (const name of Object.keys(projectGlobal?.value ?? {}))
+    layers.set(name, "local");
+  for (const name of Object.keys(projectLocal?.value ?? {}))
+    layers.set(name, "project");
   const sources = {
     user: sourceDigest(global2.digest),
     project: projectLocal ? sourceDigest(projectLocal.digest) : "excluded"
   };
-  return { configs, revision: { fingerprint: revisionFingerprint(sources), sources, scope } };
+  return {
+    configs,
+    layers,
+    revision: { fingerprint: revisionFingerprint(sources), sources, scope }
+  };
 }
 async function claudeAccountOnlyMcpServerNames(cwd, settingSources, declared, strictMcpConfig = false) {
   const path = claudeAccountJsonPath();
@@ -13723,21 +13741,28 @@ async function getMcpRuntimeConfig(cwd, env = process.env, connection, sources =
   const scoped = await loadScopedMcpServers(cwd, normalizeScope(sources));
   const { revision } = scoped;
   const configs = allowConfigured ? Object.fromEntries(Object.entries(scoped.configs).filter(([name]) => allowConfigured(name))) : scoped.configs;
-  const agentServer = getOrkestratorAgentMcpServerFromConnection(connection) ?? getOrkestratorAgentMcpServer(env);
   const servers = toSdkServers(configs);
+  const layers = new Map(Array.from(scoped.layers).filter(([name]) => Object.hasOwn(servers, name)));
+  const agentServer = getOrkestratorAgentMcpServerFromConnection(connection) ?? getOrkestratorAgentMcpServer(env);
   if (agentServer) {
     servers[AGENT_MCP_SERVER_NAME] = agentServer;
-    if (connection?.design)
+    layers.set(AGENT_MCP_SERVER_NAME, "orkestrator");
+    if (connection?.design) {
       servers["orkestrator-design"] = {
         ...agentServer,
         url: new URL("/design-mcp", agentServer.url).toString()
       };
+      layers.set("orkestrator-design", "orkestrator");
+    }
   }
   const artifactServer = getOrkestratorArtifactMcpServer(connection);
-  if (artifactServer)
+  if (artifactServer) {
     servers[ORKESTRATOR_ARTIFACT_MCP_SERVER_NAME] = artifactServer;
-  else
+    layers.set(ORKESTRATOR_ARTIFACT_MCP_SERVER_NAME, "orkestrator");
+  } else {
     delete servers[ORKESTRATOR_ARTIFACT_MCP_SERVER_NAME];
+    layers.delete(ORKESTRATOR_ARTIFACT_MCP_SERVER_NAME);
+  }
   const research = normalizeScope(sources) === "none" ? coordinatorResearchMcpServersFromEnv(env) : [];
   for (const server of research)
     servers[server.name] = { type: "http", url: server.url };
@@ -13749,6 +13774,7 @@ async function getMcpRuntimeConfig(cwd, env = process.env, connection, sources =
       ...artifactServer ? [ORKESTRATOR_ARTIFACT_MCP_SERVER_NAME] : [],
       ...research.map((server) => server.name)
     ]),
+    layers,
     revision
   };
 }
@@ -13756,6 +13782,384 @@ async function getMcpRuntimeConfig(cwd, env = process.env, connection, sources =
 // ../../bridges/claude-bridge/src/services/session-manager-commands.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
 
+// ../../bridges/claude-bridge/src/services/claude-model-catalog.ts
+import { homedir as homedir2 } from "node:os";
+import { join as join12 } from "node:path";
+import { stat as stat5 } from "node:fs/promises";
+
+// ../../bridges/claude-bridge/src/services/live-claude-control.ts
+var LIVE_CLAUDE_READ_TIMEOUT_MS = 5000;
+function readsProbeSettings(settingSources) {
+  if (settingSources === undefined)
+    return false;
+  try {
+    const sources = JSON.parse(settingSources);
+    return Array.isArray(sources) && ["user", "project", "local"].every((source) => sources.includes(source));
+  } catch {
+    return false;
+  }
+}
+function liveClaudeControls() {
+  const runtimes = [];
+  for (const session of sessions.values()) {
+    const runtime = session.claudeRuntime;
+    if (runtime?.state !== "open" || runtime.abortController.signal.aborted)
+      continue;
+    if (session.queryControlDraining === runtime.control || session.deleting)
+      continue;
+    if (!readsProbeSettings(runtime.launch.settingSources))
+      continue;
+    runtimes.push(runtime);
+  }
+  return runtimes.sort((left, right) => right.lastFrameAt - left.lastFrameAt).map((runtime) => runtime.control);
+}
+async function readFromLiveClaude(read, timeoutMs = LIVE_CLAUDE_READ_TIMEOUT_MS) {
+  for (const control of liveClaudeControls()) {
+    let timer;
+    try {
+      const answer = read(control);
+      if (answer === undefined)
+        continue;
+      answer.catch(() => {
+        return;
+      });
+      const value = await Promise.race([
+        answer,
+        new Promise((resolve) => {
+          timer = setTimeout(() => resolve(undefined), timeoutMs);
+        })
+      ]);
+      if (value !== undefined)
+        return value;
+    } catch (error) {
+      debugLog("[live-claude-control] A running CLI could not answer:", error);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  return;
+}
+function liveInitializationResult(control) {
+  if (typeof control.initializationResult !== "function")
+    return;
+  return control.initializationResult().then((result) => result && typeof result === "object" ? result : undefined);
+}
+
+// ../../bridges/claude-bridge/src/services/claude-sign-in.ts
+var AUTH_CACHE_TTL_MS = 30000;
+var FAILED_AUTH_CACHE_TTL_MS = 5000;
+var CLAUDE_SIGN_IN = {
+  kind: "terminal",
+  hint: "Sign in to Claude from the sign-in card in this tab or from Settings → Claude."
+};
+var CLAUDE_SIGN_IN_REQUIRED_MESSAGE = "Claude isn't signed in. Sign in to Claude to keep working.";
+var authCache;
+var authRead;
+var authReadGeneration;
+var authRefreshPending = false;
+var authGeneration = 0;
+var turnAuthenticationFailedUntil = 0;
+var reuseLiveAccounts = true;
+function withTurnFailure(value) {
+  return Date.now() < turnAuthenticationFailedUntil && value.state === "signed-in" ? { ...value, state: "expired" } : value;
+}
+function presentSource(value) {
+  return value && value !== "none" ? value : undefined;
+}
+function normalizeClaudeAccount(account) {
+  const source = presentSource(account.apiKeySource) ?? presentSource(account.tokenSource);
+  const externalProvider = account.apiProvider && account.apiProvider !== "firstParty" ? account.apiProvider : undefined;
+  const signedIn = Boolean(source || account.subscriptionType || account.organization || externalProvider);
+  const label = account.organization || account.subscriptionType || externalProvider;
+  return {
+    state: signedIn ? "signed-in" : "needs-auth",
+    ...label ? {
+      account: {
+        label,
+        ...account.subscriptionType ? { plan: account.subscriptionType } : {}
+      }
+    } : {},
+    signIn: CLAUDE_SIGN_IN,
+    signOut: false
+  };
+}
+function claudeAccountKey(status) {
+  return JSON.stringify([status.state, status.account?.label, status.account?.plan]);
+}
+function claudeObservedAccountKey() {
+  const value = authCache?.value;
+  return value && value.state !== "unknown" ? claudeAccountKey(value) : undefined;
+}
+function liveSignedInAccount() {
+  return readFromLiveClaude((control) => liveInitializationResult(control)?.then((result) => {
+    const account = result?.account;
+    if (!account || typeof account !== "object")
+      return;
+    const status = normalizeClaudeAccount(account);
+    return status.state === "signed-in" ? status : undefined;
+  }));
+}
+async function probeAccount() {
+  if (reuseLiveAccounts) {
+    const live = await liveSignedInAccount();
+    if (live && reuseLiveAccounts)
+      return live;
+  }
+  let probe;
+  try {
+    probe = controlOnlyQuery({
+      cwd: process.env.CWD || process.cwd(),
+      env: { ...process.env },
+      ...claudeExecutableOptions()
+    });
+    return normalizeClaudeAccount(await probe.accountInfo());
+  } finally {
+    await Promise.resolve(probe?.close()).catch(() => {
+      return;
+    });
+  }
+}
+function readClaudeAuthStatus() {
+  if (authCache && authCache.expiresAt > Date.now()) {
+    return Promise.resolve(withTurnFailure(authCache.value));
+  }
+  if (authRead)
+    return authRead;
+  const generation = authGeneration;
+  const read = probeAccount().then((value) => ({ value, ttl: AUTH_CACHE_TTL_MS }), () => ({
+    value: {
+      state: "unknown",
+      signIn: CLAUDE_SIGN_IN,
+      signOut: false
+    },
+    ttl: FAILED_AUTH_CACHE_TTL_MS
+  })).then(({ value, ttl }) => {
+    if (generation === authGeneration) {
+      authCache = { expiresAt: Date.now() + ttl, value };
+    }
+    return withTurnFailure(value);
+  }).finally(() => {
+    if (authRead !== read)
+      return;
+    authRead = undefined;
+    authReadGeneration = undefined;
+    if (authRefreshPending) {
+      authRefreshPending = false;
+      readClaudeAuthStatus();
+    }
+  });
+  authReadGeneration = generation;
+  authRead = read;
+  return read;
+}
+function noteClaudeAuthenticationFailure() {
+  reuseLiveAccounts = false;
+  turnAuthenticationFailedUntil = Date.now() + AUTH_CACHE_TTL_MS;
+  authCache = undefined;
+  if (authRead && authReadGeneration !== authGeneration)
+    authRefreshPending = true;
+  readClaudeAuthStatus();
+}
+function noteClaudeAuthenticationWorked() {
+  reuseLiveAccounts = true;
+  authGeneration += 1;
+  authRefreshPending = false;
+  turnAuthenticationFailedUntil = 0;
+  if (authCache?.value.state === "needs-auth")
+    authCache = undefined;
+}
+function claudeReadiness() {
+  const cached = authCache;
+  if (cached?.value.state !== "needs-auth")
+    return;
+  if (cached.expiresAt <= Date.now())
+    readClaudeAuthStatus();
+  return {
+    state: "authentication-required",
+    message: CLAUDE_SIGN_IN_REQUIRED_MESSAGE,
+    signIn: CLAUDE_SIGN_IN
+  };
+}
+
+// ../../bridges/claude-bridge/src/services/claude-model-catalog.ts
+var CLAUDE_MODEL_CACHE_TTL_MS = 60 * 60000;
+var CLAUDE_MODEL_PROBE_TIMEOUT_MS = 25000;
+var remembered;
+var liveAnswers = new WeakMap;
+var invalidLiveAnswers = new WeakSet;
+var generation = 0;
+var probe;
+function invalidateClaudeModelCatalog() {
+  for (const control of liveClaudeControls())
+    invalidLiveAnswers.add(control);
+  remembered = undefined;
+  generation += 1;
+}
+function catalogModels(models) {
+  return models.map((model) => ({
+    id: model.value,
+    resolvedModel: model.resolvedModel,
+    name: model.displayName,
+    description: model.description,
+    supportsFastMode: model.supportsFastMode,
+    supportsEffort: model.supportsEffort,
+    supportedEffortLevels: model.supportedEffortLevels,
+    supportsAdaptiveThinking: model.supportsAdaptiveThinking,
+    supportsAutoMode: model.supportsAutoMode
+  }));
+}
+async function claudeCliIdentity() {
+  const configDir = process.env.CLAUDE_CONFIG_DIR?.trim() || join12(homedir2(), ".claude");
+  const executable = process.env.CLAUDE_CLI_PATH?.trim();
+  const resolved = executable ? Bun.which(executable, { PATH: process.env.PATH }) || executable : undefined;
+  const cwd = process.env.CWD || process.cwd();
+  const paths = [
+    resolved,
+    join12(configDir, "settings.json"),
+    join12(cwd, ".claude/settings.json"),
+    join12(cwd, ".claude/settings.local.json")
+  ];
+  const files = await Promise.all(paths.map(async (path) => {
+    const file = path ? await stat5(path).catch(() => {
+      return;
+    }) : undefined;
+    return [path, file?.size, file?.mtimeMs, file?.ctimeMs];
+  }));
+  return JSON.stringify([configDir, cwd, files]);
+}
+function accountKeyOf(account) {
+  if (!account || typeof account !== "object")
+    return;
+  return claudeAccountKey(normalizeClaudeAccount(account));
+}
+async function rememberModels(models, account, at = generation, cli, expiresAt) {
+  if (!account || typeof account !== "object" || models.length === 0)
+    return;
+  const status = normalizeClaudeAccount(account);
+  if (status.state !== "signed-in")
+    return;
+  const identity = cli ?? await claudeCliIdentity();
+  if (at !== generation)
+    return;
+  remembered = {
+    cli: identity,
+    account: claudeAccountKey(status),
+    models,
+    expiresAt: expiresAt ?? Date.now() + CLAUDE_MODEL_CACHE_TTL_MS
+  };
+}
+async function rememberedModels() {
+  const entry = remembered;
+  if (!entry || entry.expiresAt <= Date.now())
+    return;
+  const observed = claudeObservedAccountKey();
+  if (observed !== undefined && observed !== entry.account)
+    return;
+  return entry.cli === await claudeCliIdentity() ? entry.models : undefined;
+}
+async function liveModels() {
+  const observed = claudeObservedAccountKey();
+  const at = generation;
+  const cli = await claudeCliIdentity();
+  return readFromLiveClaude(async (control) => {
+    if (invalidLiveAnswers.has(control))
+      return;
+    let identity = liveAnswers.get(control);
+    if (!identity) {
+      identity = { cli, expiresAt: Date.now() + CLAUDE_MODEL_CACHE_TTL_MS };
+      liveAnswers.set(control, identity);
+    }
+    if (identity.cli !== cli || identity.expiresAt <= Date.now())
+      return;
+    const result = await liveInitializationResult(control);
+    if (at !== generation || invalidLiveAnswers.has(control))
+      return;
+    if (!Array.isArray(result?.models) || result.models.length === 0)
+      return;
+    const account = accountKeyOf(result.account);
+    if (observed !== undefined && account !== undefined && account !== observed)
+      return;
+    return { models: result.models, account: result.account, at, ...identity };
+  });
+}
+function fallbackCatalog() {
+  return {
+    source: "fallback",
+    models: CLAUDE_FALLBACK_MODEL_CATALOG.map((model) => ({
+      ...model,
+      ...model.supportedEffortLevels ? { supportedEffortLevels: [...model.supportedEffortLevels] } : {}
+    }))
+  };
+}
+async function probeModels(at) {
+  let q;
+  let timer;
+  try {
+    const cwd = process.env.CWD || process.cwd();
+    debugLog("[session-manager] Fetching supported models", { cwd });
+    q = controlOnlyQuery({
+      cwd,
+      env: { ...process.env },
+      ...claudeExecutableOptions()
+    });
+    const control = q;
+    const answer = Promise.all([
+      control.supportedModels(),
+      typeof control.accountInfo === "function" ? control.accountInfo().catch(() => {
+        return;
+      }) : undefined
+    ]);
+    answer.catch(() => {
+      return;
+    });
+    const [models, account] = await Promise.race([
+      answer,
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new Error("The model probe did not answer in time")), CLAUDE_MODEL_PROBE_TIMEOUT_MS);
+      })
+    ]);
+    debugLog("[session-manager] Supported models fetched", { count: models.length });
+    await rememberModels(models, account, at);
+    return { source: "sdk", models: catalogModels(models) };
+  } catch (error) {
+    console.error("[session-manager] Error fetching supported models:", error);
+    return fallbackCatalog();
+  } finally {
+    clearTimeout(timer);
+    if (q?.return) {
+      try {
+        await q.return();
+      } catch (error) {
+        debugLog("[session-manager] Failed to clean up model query:", error);
+      }
+    }
+  }
+}
+function sharedProbe() {
+  if (probe?.generation === generation)
+    return probe.read;
+  const read = probeModels(generation).finally(() => {
+    if (probe?.read === read)
+      probe = undefined;
+  });
+  probe = { generation, read };
+  return read;
+}
+async function getAvailableModelCatalog() {
+  const live = liveClaudeControls().length ? await liveModels() : undefined;
+  if (live) {
+    debugLog("[session-manager] Supported models read from a running CLI", {
+      count: live.models.length
+    });
+    await rememberModels(live.models, live.account, live.at, live.cli, live.expiresAt);
+    return { source: "sdk", models: catalogModels(live.models) };
+  }
+  const known = await rememberedModels();
+  if (known)
+    return { source: "sdk", models: catalogModels(known) };
+  return sharedProbe();
+}
+
 // ../protocol/src/agent-command-catalogue.ts
 var NATIVE_AGENT_COMMAND_CATALOGUE_VERSION = 1;
 var COMMAND_CATALOGUE_LIMITS = Object.freeze({
@@ -14060,7 +14464,7 @@ function idleSteerPromptReply(prompt, agentLabel) {
 
 // ../../bridges/claude-bridge/src/services/claude-terminal-commands.ts
 import { mkdir as mkdir5, readFile as readFile6, rename as rename5, writeFile as writeFile5 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 var FILE_NAME = "terminal-slash-commands.json";
 var MAX_VERSIONS = 4;
 var MAX_NAMES = 512;
@@ -14071,7 +14475,7 @@ var dirty = false;
 var entries = [];
 var writes = Promise.resolve();
 function filePath() {
-  return join12(claudeOrkestratorDir(), FILE_NAME);
+  return join13(claudeOrkestratorDir(), FILE_NAME);
 }
 function validVersion(value) {
   return typeof value === "string" && value.length > 0 && value.length <= MAX_VERSION_LENGTH;
@@ -14118,89 +14522,31 @@ function recordTerminalSlashCommands(version, commands) {
   const previous = entries.find((entry) => entry.version === version);
   if (previous && JSON.stringify(previous.commands) === JSON.stringify(names) && !dirty)
     return;
-  dirty = true;
-  entries = [
-    { version, commands: names },
-    ...entries.filter((entry) => entry.version !== version)
-  ].slice(0, MAX_VERSIONS);
-  writes = writes.then(async () => {
-    await load();
-    const directory = claudeOrkestratorDir();
-    await mkdir5(directory, { recursive: true });
-    const target = filePath();
-    const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
-    const snapshot = entries;
-    await writeFile5(temporary, `${JSON.stringify({ versions: snapshot })}
-`, {
-      mode: 384
-    });
-    await rename5(temporary, target);
-    if (entries === snapshot)
-      dirty = false;
-  }).catch(() => {});
-}
-
-// ../../bridges/claude-bridge/src/services/session-manager-catalog.ts
-import { createHash as createHash10 } from "node:crypto";
-
-// ../../bridges/claude-bridge/src/services/live-claude-control.ts
-var LIVE_CLAUDE_READ_TIMEOUT_MS = 5000;
-function readsProbeSettings(settingSources) {
-  if (settingSources === undefined)
-    return false;
-  try {
-    const sources = JSON.parse(settingSources);
-    return Array.isArray(sources) && ["user", "project", "local"].every((source) => sources.includes(source));
-  } catch {
-    return false;
-  }
-}
-function liveClaudeControls() {
-  const runtimes = [];
-  for (const session of sessions.values()) {
-    const runtime = session.claudeRuntime;
-    if (runtime?.state !== "open" || runtime.abortController.signal.aborted)
-      continue;
-    if (session.queryControlDraining === runtime.control || session.deleting)
-      continue;
-    if (!readsProbeSettings(runtime.launch.settingSources))
-      continue;
-    runtimes.push(runtime);
-  }
-  return runtimes.sort((left, right) => right.lastFrameAt - left.lastFrameAt).map((runtime) => runtime.control);
-}
-async function readFromLiveClaude(read, timeoutMs = LIVE_CLAUDE_READ_TIMEOUT_MS) {
-  for (const control of liveClaudeControls()) {
-    let timer;
-    try {
-      const answer = read(control);
-      if (answer === undefined)
-        continue;
-      answer.catch(() => {
-        return;
-      });
-      const value = await Promise.race([
-        answer,
-        new Promise((resolve) => {
-          timer = setTimeout(() => resolve(undefined), timeoutMs);
-        })
-      ]);
-      if (value !== undefined)
-        return value;
-    } catch (error) {
-      debugLog("[live-claude-control] A running CLI could not answer:", error);
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-  return;
-}
-function liveInitializationResult(control) {
-  if (typeof control.initializationResult !== "function")
-    return;
-  return control.initializationResult().then((result) => result && typeof result === "object" ? result : undefined);
+  dirty = true;
+  entries = [
+    { version, commands: names },
+    ...entries.filter((entry) => entry.version !== version)
+  ].slice(0, MAX_VERSIONS);
+  writes = writes.then(async () => {
+    await load();
+    const directory = claudeOrkestratorDir();
+    await mkdir5(directory, { recursive: true });
+    const target = filePath();
+    const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
+    const snapshot = entries;
+    await writeFile5(temporary, `${JSON.stringify({ versions: snapshot })}
+`, {
+      mode: 384
+    });
+    await rename5(temporary, target);
+    if (entries === snapshot)
+      dirty = false;
+  }).catch(() => {});
 }
 
+// ../../bridges/claude-bridge/src/services/session-manager-catalog.ts
+import { createHash as createHash10 } from "node:crypto";
+
 // ../protocol/src/secret-redaction.ts
 var TEXT_RULES = [
   {
@@ -14237,7 +14583,11 @@ function redactSecrets(value) {
 }
 
 // ../../bridges/claude-bridge/src/services/mcp-runtime-status.ts
-function mcpScope(scope, name, source) {
+var FOREIGN_MCP_SOURCES = new Set(["plugin", "sdk", "claudeai"]);
+function mcpScope(scope, name, source, layers) {
+  const layer = FOREIGN_MCP_SOURCES.has(source ?? "") ? undefined : layers?.get(name);
+  if (layer)
+    return layer;
   if (name === "orkestrator")
     return "orkestrator";
   if (source?.includes("plugin") || scope?.includes("plugin"))
@@ -14259,145 +14609,16 @@ function mcpRuntimeState(status) {
       return "unknown";
   }
 }
-function initMcpServerStatus(raw) {
+function initMcpServerStatus(raw, layers) {
   const source = typeof raw.source === "string" ? raw.source : undefined;
   return {
     name: raw.name,
     status: mcpRuntimeState(raw.status),
-    ...source ? { scope: mcpScope(source, raw.name) } : {},
+    ...source || layers?.has(raw.name) ? { scope: mcpScope(source, raw.name, source, layers) } : {},
     ...typeof raw.error === "string" && raw.error ? { error: raw.error } : {},
     ...Array.isArray(raw.tools) ? { tools: raw.tools.filter((tool) => typeof tool === "string") } : {}
   };
 }
-
-// ../../bridges/claude-bridge/src/services/claude-sign-in.ts
-var AUTH_CACHE_TTL_MS = 30000;
-var FAILED_AUTH_CACHE_TTL_MS = 5000;
-var CLAUDE_SIGN_IN = {
-  kind: "terminal",
-  hint: "Sign in to Claude from the sign-in card in this tab or from Settings → Claude."
-};
-var CLAUDE_SIGN_IN_REQUIRED_MESSAGE = "Claude isn't signed in. Sign in to Claude to keep working.";
-var authCache;
-var authRead;
-var authReadGeneration;
-var authRefreshPending = false;
-var authGeneration = 0;
-var turnAuthenticationFailedUntil = 0;
-var reuseLiveAccounts = true;
-function withTurnFailure(value) {
-  return Date.now() < turnAuthenticationFailedUntil && value.state === "signed-in" ? { ...value, state: "expired" } : value;
-}
-function presentSource(value) {
-  return value && value !== "none" ? value : undefined;
-}
-function normalizeClaudeAccount(account) {
-  const source = presentSource(account.apiKeySource) ?? presentSource(account.tokenSource);
-  const externalProvider = account.apiProvider && account.apiProvider !== "firstParty" ? account.apiProvider : undefined;
-  const signedIn = Boolean(source || account.subscriptionType || account.organization || externalProvider);
-  const label = account.organization || account.subscriptionType || externalProvider;
-  return {
-    state: signedIn ? "signed-in" : "needs-auth",
-    ...label ? {
-      account: {
-        label,
-        ...account.subscriptionType ? { plan: account.subscriptionType } : {}
-      }
-    } : {},
-    signIn: CLAUDE_SIGN_IN,
-    signOut: false
-  };
-}
-function liveSignedInAccount() {
-  return readFromLiveClaude((control) => liveInitializationResult(control)?.then((result) => {
-    const account = result?.account;
-    if (!account || typeof account !== "object")
-      return;
-    const status = normalizeClaudeAccount(account);
-    return status.state === "signed-in" ? status : undefined;
-  }));
-}
-async function probeAccount() {
-  if (reuseLiveAccounts) {
-    const live = await liveSignedInAccount();
-    if (live && reuseLiveAccounts)
-      return live;
-  }
-  let probe;
-  try {
-    probe = controlOnlyQuery({
-      cwd: process.env.CWD || process.cwd(),
-      env: { ...process.env },
-      ...claudeExecutableOptions()
-    });
-    return normalizeClaudeAccount(await probe.accountInfo());
-  } finally {
-    await Promise.resolve(probe?.close()).catch(() => {
-      return;
-    });
-  }
-}
-function readClaudeAuthStatus() {
-  if (authCache && authCache.expiresAt > Date.now()) {
-    return Promise.resolve(withTurnFailure(authCache.value));
-  }
-  if (authRead)
-    return authRead;
-  const generation = authGeneration;
-  const read = probeAccount().then((value) => ({ value, ttl: AUTH_CACHE_TTL_MS }), () => ({
-    value: {
-      state: "unknown",
-      signIn: CLAUDE_SIGN_IN,
-      signOut: false
-    },
-    ttl: FAILED_AUTH_CACHE_TTL_MS
-  })).then(({ value, ttl }) => {
-    if (generation === authGeneration) {
-      authCache = { expiresAt: Date.now() + ttl, value };
-    }
-    return withTurnFailure(value);
-  }).finally(() => {
-    if (authRead !== read)
-      return;
-    authRead = undefined;
-    authReadGeneration = undefined;
-    if (authRefreshPending) {
-      authRefreshPending = false;
-      readClaudeAuthStatus();
-    }
-  });
-  authReadGeneration = generation;
-  authRead = read;
-  return read;
-}
-function noteClaudeAuthenticationFailure() {
-  reuseLiveAccounts = false;
-  turnAuthenticationFailedUntil = Date.now() + AUTH_CACHE_TTL_MS;
-  authCache = undefined;
-  if (authRead && authReadGeneration !== authGeneration)
-    authRefreshPending = true;
-  readClaudeAuthStatus();
-}
-function noteClaudeAuthenticationWorked() {
-  reuseLiveAccounts = true;
-  authGeneration += 1;
-  authRefreshPending = false;
-  turnAuthenticationFailedUntil = 0;
-  if (authCache?.value.state === "needs-auth")
-    authCache = undefined;
-}
-function claudeReadiness() {
-  const cached = authCache;
-  if (cached?.value.state !== "needs-auth")
-    return;
-  if (cached.expiresAt <= Date.now())
-    readClaudeAuthStatus();
-  return {
-    state: "authentication-required",
-    message: CLAUDE_SIGN_IN_REQUIRED_MESSAGE,
-    signIn: CLAUDE_SIGN_IN
-  };
-}
 // ../../bridges/claude-bridge/src/services/session-manager-catalog.ts
 function readableControl(session) {
   if (!session)
@@ -14548,7 +14769,7 @@ function mcpTransport(status) {
 function mcpError(error) {
   return redactSecrets(error).slice(0, 2000);
 }
-function normalizeMcp(status) {
+function normalizeMcp(status, layers) {
   const mappedStatus = status.status === "pending" ? "connecting" : status.status;
   const tools = (status.tools ?? []).map((tool) => tool.name).filter(Boolean).slice(0, 256);
   const actions = status.status === "disabled" ? ["enable"] : status.status === "needs-auth" ? ["sign-in", "reconnect", "disable"] : ["reconnect", "disable"];
@@ -14557,7 +14778,7 @@ function normalizeMcp(status) {
     id: status.name,
     name: status.serverInfo?.name || status.name,
     status: mappedStatus,
-    scope: mcpScope(status.scope, status.name, status.source),
+    scope: mcpScope(status.scope, status.name, status.source, layers),
     ...transport ? { transport } : {},
     toolCount: tools.length,
     ...tools.length ? { tools } : {},
@@ -14565,18 +14786,11 @@ function normalizeMcp(status) {
     actions
   };
 }
-async function readSessionMcpServers(sessionId) {
-  const session = sessions.get(sessionId);
-  if (!session)
-    return [];
-  const control = readableControl(session);
-  if (control?.mcpServerStatus) {
-    try {
-      session.mcpInventory = (await control.mcpServerStatus()).slice(0, 128).map(normalizeMcp);
-    } catch (error) {
-      rethrowUnlessClosedTransport(error);
-    }
-  } else if (!session.mcpInventory && session.initData?.mcpServers) {
+function liveMcpInventory(session, statuses) {
+  return statuses.slice(0, 128).map((status) => normalizeMcp(status, session.mcpServerLayers));
+}
+function retainedMcpInventory(session) {
+  if (!session.mcpInventory && session.initData?.mcpServers) {
     session.mcpInventory = session.initData.mcpServers.slice(0, 128).map((server) => ({
       id: server.name,
       name: server.name,
@@ -14588,7 +14802,34 @@ async function readSessionMcpServers(sessionId) {
       ...server.error ? { error: mcpError(server.error) } : {}
     }));
   }
-  return session.mcpInventory ?? [];
+  return session.mcpInventory;
+}
+function applyProbeMcpStatus(session, serverId, statuses) {
+  const status = statuses.find((candidate) => candidate.name === serverId);
+  if (!status)
+    return;
+  const inventory = retainedMcpInventory(session);
+  session.mcpInventory = inventory?.map((row) => {
+    if (row.id !== serverId)
+      return row;
+    const updated = normalizeMcp(status, session.mcpServerLayers);
+    return { ...updated, scope: row.scope ?? updated.scope };
+  });
+}
+async function readSessionMcpServers(sessionId) {
+  const session = sessions.get(sessionId);
+  if (!session)
+    return [];
+  const control = readableControl(session);
+  if (control?.mcpServerStatus) {
+    try {
+      session.mcpInventory = liveMcpInventory(session, await control.mcpServerStatus());
+    } catch (error) {
+      rethrowUnlessClosedTransport(error);
+    }
+    return session.mcpInventory ?? [];
+  }
+  return retainedMcpInventory(session) ?? [];
 }
 async function performSessionMcpAction(sessionId, serverId, action) {
   const session = sessions.get(sessionId);
@@ -14611,7 +14852,11 @@ async function performSessionMcpAction(sessionId, serverId, action) {
       await control.reconnectMcpServer?.(serverId);
     }
     if (control.mcpServerStatus) {
-      session.mcpInventory = (await control.mcpServerStatus()).slice(0, 128).map(normalizeMcp);
+      const statuses = await control.mcpServerStatus();
+      if (probe)
+        applyProbeMcpStatus(session, serverId, statuses);
+      else
+        session.mcpInventory = liveMcpInventory(session, statuses);
     }
     return {};
   } finally {
@@ -15232,6 +15477,7 @@ async function refreshClaudeCommandCatalogue(sessionId) {
   }
 }
 async function refreshClaudeCatalogs() {
+  invalidateClaudeModelCatalog();
   const sessionIds = Array.from(sessions.keys()).slice(0, 128);
   let next = 0;
   await Promise.allSettled(Array.from({ length: Math.min(8, sessionIds.length) }, async () => {
@@ -15332,7 +15578,6 @@ function createClaudeRuntimeMcp(servers, declared, accountOnly = []) {
     accountOnly: loadedOnlyByAccount
   };
 }
-var FOREIGN_SOURCES = new Set(["plugin", "sdk", "claudeai"]);
 var MAX_REPORTED_STALE_SERVERS = 256;
 function conflict(message) {
   return sessionOperationError("conflict", message);
@@ -15387,7 +15632,7 @@ async function syncClaudeRuntimeMcp(runtime, next) {
     runtime.mcpServers = "";
     throw conflict("Claude required MCP server is not connected; retry the prompt");
   }
-  const stillRuns = (name) => statuses ? statuses.some((server) => server.name === name && server.status !== "disabled" && !FOREIGN_SOURCES.has(server.source ?? "")) : !removed?.has(name);
+  const stillRuns = (name) => statuses ? statuses.some((server) => server.name === name && server.status !== "disabled" && !FOREIGN_MCP_SOURCES.has(server.source ?? "")) : !removed?.has(name);
   for (const name of Array.from(mcp.stale)) {
     if (next.names.has(name) || !stillRuns(name)) {
       mcp.stale.delete(name);
@@ -15686,6 +15931,60 @@ function claudeArtifactServerTools(servers) {
   return ARTIFACT_TOOL_NAMES.map((name) => `mcp__${ORKESTRATOR_ARTIFACT_MCP_SERVER_NAME}__${name}`);
 }
 
+// ../protocol/src/node/repository-instructions.ts
+import { open as open3, realpath as realpath3 } from "node:fs/promises";
+import { join as join14, relative as relative2, isAbsolute as isAbsolute4 } from "node:path";
+
+// ../protocol/src/agent-system-instructions.ts
+var AGENT_IMAGE_PREVIEW_INSTRUCTION = "Orkestrator renders Markdown images inline in the transcript. When you show the user an image in your reply (a screenshot, rendered preview, or chart) using Markdown image syntax, reference it by its absolute path. In a managed worktree or container environment, save the file inside the working directory, preferably in a git-ignored folder so preview files stay out of the change set. Local image previews are limited to Orkestrator-managed workspace storage or the container's /workspace. Project-home checkouts are excluded from host preview reads, even when they are the working directory, so images saved there cannot be previewed from a local Markdown path. Paths outside previewable storage, such as /tmp, also show a placeholder.";
+var AGENT_DOCUMENT_INSTRUCTION = "When the user asks for a document (a report, design doc, plan, analysis, guide, or other writing to keep), prefer writing it as a Markdown file in a `docs/` folder at the root of the working directory, and tell the user the file's path. Project instructions (such as AGENTS.md or CLAUDE.md), local skills, and the user's own request take priority over this default when they say where or how to write documents.";
+var GENERAL_AGENT_INSTRUCTIONS = [
+  AGENT_IMAGE_PREVIEW_INSTRUCTION,
+  AGENT_DOCUMENT_INSTRUCTION
+];
+function agentSystemInstructions(providerSpecific = []) {
+  return [...GENERAL_AGENT_INSTRUCTIONS, ...providerSpecific].filter((line) => line.trim().length > 0).join(`
+
+`);
+}
+var REPOSITORY_INSTRUCTIONS_FILE = "AGENTS.md";
+function repositoryInstructionsBlock(path, content, truncated) {
+  return [
+    `# Repository instructions (${REPOSITORY_INSTRUCTIONS_FILE})`,
+    `This session does not load the repository's ${REPOSITORY_INSTRUCTIONS_FILE} on its own, so Orkestrator includes it here. Follow it as project instructions. Contents of ${path}:`,
+    content.trimEnd(),
+    ...truncated ? [
+      `[${REPOSITORY_INSTRUCTIONS_FILE} is longer than this session can hold, so it is cut here. Read the rest from ${path} before relying on anything it may say.]`
+    ] : []
+  ].join(`
+
+`);
+}
+
+// ../protocol/src/node/repository-instructions.ts
+var MAX_REPOSITORY_INSTRUCTIONS_BYTES = 256 * 1024;
+async function readRepositoryInstructions(cwd, maxBytes = MAX_REPOSITORY_INSTRUCTIONS_BYTES) {
+  const path = join14(cwd, REPOSITORY_INSTRUCTIONS_FILE);
+  try {
+    const [root, target] = await Promise.all([realpath3(cwd), realpath3(path)]);
+    const inside = relative2(root, target);
+    if (!inside || inside.startsWith("..") || isAbsolute4(inside))
+      return;
+    const handle = await open3(target, "r");
+    try {
+      const buffer = Buffer.alloc(maxBytes + 1);
+      const { bytesRead } = await handle.read(buffer, 0, maxBytes + 1, 0);
+      const truncated = bytesRead > maxBytes;
+      const text = new TextDecoder().decode(buffer.subarray(0, Math.min(bytesRead, maxBytes))).replace(/�$/, "");
+      return text.trim() ? repositoryInstructionsBlock(path, text, truncated) : undefined;
+    } finally {
+      await handle.close();
+    }
+  } catch {
+    return;
+  }
+}
+
 // ../protocol/src/claude-background-commands.ts
 var CLAUDE_BASH_MAX_TIMEOUT_ENV = "BASH_MAX_TIMEOUT_MS";
 var CLAUDE_BASH_DEFAULT_TIMEOUT_ENV = "BASH_DEFAULT_TIMEOUT_MS";
@@ -15734,6 +16033,17 @@ function backgroundCommandInstruction(env) {
   return `Background shell commands in this session are stopped when they reach their timeout (${defaultText} by default, ${maxText} at most). Pass a longer \`timeout\` when a background command needs more than ${defaultText}. For a dev server or watcher that must keep running longer than ${maxText}, tell the user to start it in an Orkestrator terminal tab instead of running it yourself.`;
 }
 
+// ../../bridges/claude-bridge/src/services/system-prompt-append.ts
+var READ_BEFORE_EDIT_INSTRUCTION = "IMPORTANT: You MUST read a file before editing or writing to it. The Edit and Write tools will fail if you have not first used the Read tool to read the file in this conversation. Always read files before attempting to modify them.";
+var CLAUDE_DOCS_INSTRUCTION = "Write a requested document as that Markdown file rather than as a Claude Doc or claude.ai artifact: Orkestrator cannot open those, so the user would never see it.";
+function claudeSystemPromptAppend(env) {
+  return agentSystemInstructions([
+    CLAUDE_DOCS_INSTRUCTION,
+    READ_BEFORE_EDIT_INSTRUCTION,
+    backgroundCommandInstruction(env)
+  ]);
+}
+
 // ../protocol/src/agent-interaction-deadline.ts
 var SYSTEM_CLOCK = {
   now: () => Date.now(),
@@ -16076,61 +16386,6 @@ function getSessionInitData(sessionId) {
   const session = sessions.get(sessionId);
   return session?.initData;
 }
-function catalogModels(models) {
-  return models.map((model) => ({
-    id: model.value,
-    resolvedModel: model.resolvedModel,
-    name: model.displayName,
-    description: model.description,
-    supportsFastMode: model.supportsFastMode,
-    supportsEffort: model.supportsEffort,
-    supportedEffortLevels: model.supportedEffortLevels,
-    supportsAdaptiveThinking: model.supportsAdaptiveThinking,
-    supportsAutoMode: model.supportsAutoMode
-  }));
-}
-function liveModels() {
-  return readFromLiveClaude((control) => liveInitializationResult(control)?.then((result) => Array.isArray(result?.models) && result.models.length > 0 ? result.models : undefined));
-}
-async function getAvailableModelCatalog() {
-  const live = await liveModels();
-  if (live) {
-    debugLog("[session-manager] Supported models read from a running CLI", {
-      count: live.length
-    });
-    return { source: "sdk", models: catalogModels(live) };
-  }
-  let q;
-  try {
-    const cwd = process.env.CWD || process.cwd();
-    debugLog("[session-manager] Fetching supported models", { cwd });
-    q = controlOnlyQuery({
-      cwd,
-      env: { ...process.env },
-      ...claudeExecutableOptions()
-    });
-    const models = await q.supportedModels();
-    debugLog("[session-manager] Supported models fetched", { count: models.length });
-    return { source: "sdk", models: catalogModels(models) };
-  } catch (error) {
-    console.error("[session-manager] Error fetching supported models:", error);
-    return {
-      source: "fallback",
-      models: CLAUDE_FALLBACK_MODEL_CATALOG.map((model) => ({
-        ...model,
-        ...model.supportedEffortLevels ? { supportedEffortLevels: [...model.supportedEffortLevels] } : {}
-      }))
-    };
-  } finally {
-    if (q?.return) {
-      try {
-        await q.return();
-      } catch (error) {
-        debugLog("[session-manager] Failed to clean up model query:", error);
-      }
-    }
-  }
-}
 async function getClaudeRuntimeVersions() {
   let sdkVersion;
   let bundledCliVersion;
@@ -16568,9 +16823,15 @@ async function resolveQueryPlan(turn, sdkTextPrompt, testHooks) {
   };
   const settingSources = claudeTurnSettingSources(session, options);
   session.commandDiscoveryInputs.includeLocalSettings = settingSources.includes("local");
+  const repositoryInstructions = options?.readOnly || policy?.id === "coordinator-read-only" || settingSources.includes("project") ? undefined : await readRepositoryInstructions(cwd);
   const readOnlyCommandSandbox = isCoordinatorReadOnlyPolicy(policy) ? claudeReadOnlyCommandSandbox() : undefined;
   const [
-    { servers: mcpServers, names: mcpServerNames, revision: mcpConfigRevision },
+    {
+      servers: mcpServers,
+      names: mcpServerNames,
+      layers: mcpServerLayers,
+      revision: mcpConfigRevision
+    },
     { plugins, coordinatorSkills }
   ] = await Promise.all([
     getMcpRuntimeConfig(cwd, process.env, options?.agentMcp, mcpSourceScopeForPolicy(policy), userMcpServerFilter(policy)),
@@ -16645,11 +16906,13 @@ async function resolveQueryPlan(turn, sdkTextPrompt, testHooks) {
   const mcpServersKey = createHash11("sha256").update(JSON.stringify(mcpServers)).digest("hex");
   return {
     settingSources,
+    repositoryInstructions,
     cwd,
     policy,
     effortLevel,
     mcpServers,
     mcpServerNames,
+    mcpServerLayers,
     accountOnlyMcpServers,
     mcpConfigRevision,
     plugins,
@@ -16671,6 +16934,7 @@ async function resolveQueryPlan(turn, sdkTextPrompt, testHooks) {
 }
 function recordMcpConfigRevision(session, plan, mcp) {
   const { mcpConfigRevision } = plan;
+  session.mcpServerLayers = plan.mcpServerLayers;
   if (!mcpConfigRevision)
     return;
   const staleServers = reportedStaleServers(mcp);
@@ -16753,11 +17017,9 @@ function claudeQueryOptions(turn, plan, turnFor, mcp) {
     systemPrompt: {
       type: "preset",
       preset: "claude_code",
-      append: coordinatorReadOnly ? "You are a read-only coordinator. Inspect the checkout with reading tools and use the trusted research tools available for this turn. Delegate all mutations and artifact creation to worker environments through Orkestrator tools. Present findings directly in your response." : [
-        "IMPORTANT: You MUST read a file before editing or writing to it. The Edit and Write tools will fail if you have not first used the Read tool to read the file in this conversation. Always read files before attempting to modify them.",
-        backgroundCommandInstruction(queryEnvironment),
-        "When the user asks for a document (a report, design doc, plan, analysis, guide, or other writing to keep), prefer writing it as a Markdown file in a `docs/` folder at the root of the working directory over creating a Claude Doc or claude.ai artifact, and tell the user the file's path. Project instructions (such as CLAUDE.md or AGENTS.md), local skills, and the user's own request take priority over this default when they say where or how to write documents.",
-        "When you show the user an image in your reply (a screenshot, rendered preview, or chart) using Markdown image syntax, reference it by its absolute path. In a managed worktree or container environment, save the file inside the working directory, preferably in a git-ignored folder so preview files stay out of the change set. Local image previews are limited to Orkestrator-managed workspace storage or the container's /workspace. Project-home checkouts are excluded from host preview reads, even when they are the working directory, so images saved there cannot be previewed from a local Markdown path. Paths outside previewable storage, such as /tmp, also show a placeholder."
+      append: [
+        coordinatorReadOnly ? "You are a read-only coordinator. Inspect the checkout with reading tools and use the trusted research tools available for this turn. Delegate all mutations and artifact creation to worker environments through Orkestrator tools. Present findings directly in your response." : claudeSystemPromptAppend(queryEnvironment),
+        ...plan.repositoryInstructions ? [plan.repositoryInstructions] : []
       ].join(`
 
 `)
@@ -17092,7 +17354,7 @@ async function handleInitMessage(turn, message) {
   }
   const allMcpServers = initMsg.mcp_servers || [];
   const regularMcpServers = allMcpServers.filter((s) => !s.name?.startsWith("plugin:"));
-  const mcpServerStatuses = regularMcpServers.map(initMcpServerStatus);
+  const mcpServerStatuses = regularMcpServers.map((server) => initMcpServerStatus(server, session.mcpServerLayers));
   const { statuses: pluginStatuses, errors: pluginErrors } = pluginStatusesFromInit(initMsg);
   const previousPluginErrors = new Set(session.pluginErrorSignatures);
   session.pluginErrorSignatures = pluginErrors.map(({ plugin, type, message, path, loaded }) => JSON.stringify([plugin, type, message, path, loaded]));
@@ -17279,6 +17541,28 @@ var LEAF_MESSAGE_HANDLERS = {
   conversation_reset: handleConversationReset
 };
 
+// ../protocol/src/agent-usage-limits.ts
+var USAGE_LIMIT_PATTERNS = [
+  /usage[\s_-]?limit/i,
+  /hit your (?:usage |session |weekly )?limit/i,
+  /\b(?:5|five)[\s-]?hour limit\b/i,
+  /\bweekly limit\b/i,
+  /\b(?:usage|quota|credits?|allowance) (?:is |has been )?(?:exhausted|exceeded|used up)\b/i,
+  /\bquota exceeded\b|\binsufficient_quota\b|\bout of (?:credits|usage)\b/i,
+  /\bUSAGE_EXHAUSTED\b|\bPAYMENT_REQUIRED\b/,
+  /\b(?:usage|plan|session|daily|weekly|monthly|go) limit reached\b/i
+];
+function classifyUsageLimitError(text) {
+  if (typeof text !== "string" || !text.trim())
+    return null;
+  const bounded = text.slice(0, 2000);
+  if (!USAGE_LIMIT_PATTERNS.some((pattern) => pattern.test(bounded)))
+    return null;
+  const reset = bounded.match(/\b(?:resets?|try again)(?:\s+(?:at|in|after))?\s+([^.\n·]{1,60})/i);
+  const hint = reset?.[1]?.trim();
+  return hint ? { resetHint: hint } : {};
+}
+
 // ../../bridges/claude-bridge/src/services/session-manager-prompt-handlers/result.ts
 function claudeStartupFailureMessage(reason) {
   switch (reason) {
@@ -17324,6 +17608,7 @@ function claudeStartupFailureMessage(reason) {
       return "Claude requires a working command sandbox, and it cannot run here (for example, bubblewrap is missing or the platform is unsupported). Make the sandbox available or have the requirement changed, then retry.";
   }
 }
+var MAX_USAGE_LIMIT_ERROR_CHARS = 500;
 var STOPPED_TERMINAL_REASONS = new Set([
   "aborted_streaming",
   "aborted_tools"
@@ -17456,8 +17741,9 @@ async function handleResultMessage(turn, message) {
       isError: resultIsError
     });
     const startupFailure = resultMsg.startup_failure_reason ? claudeStartupFailureMessage(resultMsg.startup_failure_reason) : undefined;
+    const usageLimit = resultMsg.subtype === "success" && classifyUsageLimitError(resultMsg.result) ? resultMsg.result.trim().slice(0, MAX_USAGE_LIMIT_ERROR_CHARS) : undefined;
     const resultError = startupFailure || resultMsg.errors?.filter(Boolean).join(`
-`) || (resultMsg.subtype === "success" ? "Claude ended the turn on an API error." : `Claude query failed: ${resultMsg.subtype}`);
+`) || usageLimit || (resultMsg.subtype === "success" ? "Claude ended the turn on an API error." : `Claude query failed: ${resultMsg.subtype}`);
     if (startupFailure) {
       appendTranscriptNotice(session, sessionId, (event) => eventEmitter.emit(event), {
         type: "status",
@@ -18389,7 +18675,8 @@ async function prepareJoin(turn, plan, running) {
   const required = mcpServers[AGENT_MCP_SERVER_NAME] ? [AGENT_MCP_SERVER_NAME, ...options?.agentMcp?.design ? ["orkestrator-design"] : []] : [];
   await assertClaudeRuntimeAccepts(session, options, {
     ...claudeLaunchResourceProfile(plugins, queryEnvironment),
-    settingSources: JSON.stringify(plan.settingSources)
+    settingSources: JSON.stringify(plan.settingSources),
+    repositoryInstructions: plan.repositoryInstructions ?? ""
   }, plan.readOnlyCommandSandbox);
   session.queryControl = running.control;
   turn.queryIteratorControl = running.control;
@@ -18449,6 +18736,7 @@ function launchClaudeRuntime(turn, plan) {
     launch: {
       ...claudeLaunchedProfile(session, options, plan.readOnlyCommandSandbox),
       settingSources: JSON.stringify(plan.settingSources),
+      repositoryInstructions: plan.repositoryInstructions ?? "",
       ...claudeLaunchResourceProfile(plugins, queryEnvironment)
     },
     mcpServers: mcpServersKey,
@@ -18505,6 +18793,7 @@ function joinableRuntime(turn, plan) {
   const requested = {
     ...claudeLaunchProfile(turn.session, turn.options, plan.readOnlyCommandSandbox),
     settingSources: JSON.stringify(plan.settingSources),
+    repositoryInstructions: plan.repositoryInstructions ?? "",
     ...claudeLaunchResourceProfile(plan.plugins, plan.queryEnvironment)
   };
   return claudeLaunchConflict(running.launch, requested) ? undefined : running;
@@ -18899,6 +19188,8 @@ async function settlesBy(work, deadline) {
 // ../../bridges/claude-bridge/src/routes/config.ts
 var config = new Hono2;
 config.get("/models", async (c) => {
+  if (c.req.query("forceRefresh") === "true")
+    invalidateClaudeModelCatalog();
   const startedAt = Date.now();
   console.log("[config] /models requested");
   const [{ models, source }, versions] = await Promise.all([