overlord-cli 0.2607122001.0 → 0.2607141312.0

package/dist/index.js

@@ -53,46 +53,6 @@ var init_errors = __esm({
   }
 });
 
-// src/version.ts
-import { existsSync, readFileSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-function resolvePackageJsonPath() {
-  let dir = path.dirname(fileURLToPath(import.meta.url));
-  while (true) {
-    const candidate = path.join(dir, "package.json");
-    if (existsSync(candidate)) {
-      const packageJson = JSON.parse(readFileSync(candidate, "utf8"));
-      if (packageJson.name === "overlord-cli") {
-        return candidate;
-      }
-    }
-    const parent = path.dirname(dir);
-    if (parent === dir) {
-      break;
-    }
-    dir = parent;
-  }
-  throw new Error("Cannot locate overlord-cli package.json");
-}
-function getCliVersion() {
-  const packageJson = JSON.parse(readFileSync(resolvePackageJsonPath(), "utf8"));
-  return packageJson.version;
-}
-function runVersionCommand({ json = false } = {}) {
-  const version = getCliVersion();
-  if (json) {
-    console.log(JSON.stringify({ version, node: process.version }));
-    return;
-  }
-  console.log(`Overlord CLI ${version}`);
-}
-var init_version = __esm({
-  "src/version.ts"() {
-    "use strict";
-  }
-});
-
 // src/args.ts
 function parseArgs(argv) {
   const positional = [];
@@ -164,6 +124,46 @@ var init_args = __esm({
   }
 });
 
+// src/version.ts
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+function resolvePackageJsonPath() {
+  let dir = path.dirname(fileURLToPath(import.meta.url));
+  while (true) {
+    const candidate = path.join(dir, "package.json");
+    if (existsSync(candidate)) {
+      const packageJson = JSON.parse(readFileSync(candidate, "utf8"));
+      if (packageJson.name === "overlord-cli") {
+        return candidate;
+      }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) {
+      break;
+    }
+    dir = parent;
+  }
+  throw new Error("Cannot locate overlord-cli package.json");
+}
+function getCliVersion() {
+  const packageJson = JSON.parse(readFileSync(resolvePackageJsonPath(), "utf8"));
+  return packageJson.version;
+}
+function runVersionCommand({ json = false } = {}) {
+  const version = getCliVersion();
+  if (json) {
+    console.log(JSON.stringify({ version, node: process.version }));
+    return;
+  }
+  console.log(`Overlord CLI ${version}`);
+}
+var init_version = __esm({
+  "src/version.ts"() {
+    "use strict";
+  }
+});
+
 // src/output.ts
 function printJson(value) {
   process.stdout.write(`${JSON.stringify(value, null, 2)}
@@ -1540,6 +1540,9 @@ function readStoredAuthCredentials() {
     if (typeof raw.token !== "string" || !raw.token.trim()) return null;
     if (raw.type !== "session_bearer" && raw.type !== "user_token") return null;
     if (typeof raw.backendUrl !== "string" || !raw.backendUrl.trim()) return null;
+    if (raw.expiresAt !== void 0 && raw.expiresAt !== null && typeof raw.expiresAt !== "string") {
+      raw.expiresAt = null;
+    }
     return raw;
   } catch {
     return null;
@@ -1548,7 +1551,8 @@ function readStoredAuthCredentials() {
 function writeStoredAuthCredentials({
   type,
   token,
-  backendUrl
+  backendUrl,
+  expiresAt = null
 }) {
   const filePath = authCredentialsPath();
   mkdirSync2(path4.dirname(filePath), { recursive: true });
@@ -1556,7 +1560,8 @@ function writeStoredAuthCredentials({
     type,
     token,
     backendUrl: backendUrl.replace(/\/+$/, ""),
-    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    expiresAt: expiresAt ?? null
   };
   writeFileSync2(filePath, `${JSON.stringify(payload, null, 2)}
 `, { mode: 384 });
@@ -1816,7 +1821,12 @@ async function createFullUserTokenFromSession({
   const payload = await readResponseJson(response);
   if (response.ok && payload && typeof payload === "object") {
     const secret = payload.secret;
-    if (typeof secret === "string" && secret.startsWith("out_")) return secret;
+    if (typeof secret === "string" && secret.startsWith("out_")) {
+      const tokenDto = payload.token;
+      const rawExpiry = tokenDto && typeof tokenDto === "object" ? tokenDto.expiresAt : void 0;
+      const expiresAt = typeof rawExpiry === "string" && rawExpiry.trim() ? rawExpiry : null;
+      return { secret, expiresAt };
+    }
   }
   throw new CliError({
     message: errorMessageFromJson(payload) ?? `Could not create CLI USER_TOKEN (${response.status}). Check your account permissions.`
@@ -1882,15 +1892,16 @@ async function runInteractiveAuthLogin({
   });
   await validateBearerToken({ backendUrl: normalizedBackendUrl, token: sessionToken });
   if (passwordCredentialTarget === "full_user_token") {
-    const userToken = await createFullUserTokenFromSession({
+    const minted = await createFullUserTokenFromSession({
       backendUrl: normalizedBackendUrl,
       sessionToken
     });
-    await validateBearerToken({ backendUrl: normalizedBackendUrl, token: userToken });
+    await validateBearerToken({ backendUrl: normalizedBackendUrl, token: minted.secret });
     writeStoredAuthCredentials({
       type: "user_token",
-      token: userToken,
-      backendUrl: normalizedBackendUrl
+      token: minted.secret,
+      backendUrl: normalizedBackendUrl,
+      expiresAt: minted.expiresAt
     });
     return {
       ok: true,
@@ -1927,6 +1938,21 @@ __export(auth_status_exports, {
   resolveAuthCredentialSource: () => resolveAuthCredentialSource,
   resolveAuthStatus: () => resolveAuthStatus
 });
+function resolveExpiry(expiresAt) {
+  if (typeof expiresAt !== "string" || !expiresAt.trim()) {
+    return { expiresAt: null, expiresInDays: null, expired: false };
+  }
+  const parsed = new Date(expiresAt);
+  if (Number.isNaN(parsed.getTime())) {
+    return { expiresAt: null, expiresInDays: null, expired: false };
+  }
+  const msRemaining = parsed.getTime() - Date.now();
+  return {
+    expiresAt: parsed.toISOString(),
+    expiresInDays: Math.floor(msRemaining / (24 * 60 * 60 * 1e3)),
+    expired: msRemaining <= 0
+  };
+}
 function normalizeBaseUrl3(value) {
   return value.replace(/\/+$/, "");
 }
@@ -1972,6 +1998,9 @@ async function resolveAuthStatus({
   const configPath = findEffectiveConfigPath();
   const credential = resolveAuthCredentialSource({ backendUrl, env });
   const token = resolveAuthBearerToken({ backendUrl, env });
+  const expiry = resolveExpiry(
+    credential.source === "stored" || credential.source === "stored_mismatch" ? readStoredAuthCredentials()?.expiresAt : null
+  );
   if (!token) {
     return {
       backendUrl,
@@ -1981,7 +2010,8 @@ async function resolveAuthStatus({
       credentialSource: credential.source,
       credentialType: credential.type,
       credentialsPath: credential.credentialsPath,
-      validationError: credential.source === "stored_mismatch" ? `Stored credentials are for ${readStoredAuthCredentials()?.backendUrl ?? "another backend"}.` : null
+      validationError: credential.source === "stored_mismatch" ? `Stored credentials are for ${readStoredAuthCredentials()?.backendUrl ?? "another backend"}.` : null,
+      ...expiry
     };
   }
   try {
@@ -1994,7 +2024,8 @@ async function resolveAuthStatus({
       credentialSource: credential.source,
       credentialType: credential.type,
       credentialsPath: credential.credentialsPath,
-      validationError: null
+      validationError: null,
+      ...expiry
     };
   } catch (error) {
     return {
@@ -2005,7 +2036,8 @@ async function resolveAuthStatus({
       credentialSource: credential.source,
       credentialType: credential.type,
       credentialsPath: credential.credentialsPath,
-      validationError: error instanceof Error ? error.message : String(error)
+      validationError: error instanceof Error ? error.message : String(error),
+      ...expiry
     };
   }
 }
@@ -2925,12 +2957,12 @@ function createBackendClient() {
   const clientDevice = clientDeviceIdentity();
   async function request({
     method,
-    path: path26,
+    path: path27,
     body,
     extraHeaders,
     rawBody
   }) {
-    const url = `${baseUrl}${path26.startsWith("/") ? path26 : `/${path26}`}`;
+    const url = `${baseUrl}${path27.startsWith("/") ? path27 : `/${path27}`}`;
     const auth = resolveAuthHeaders({ baseUrl });
     let response;
     try {
@@ -2957,15 +2989,14 @@ Start the Desktop/local backend or run \`ovld config set cloud <url>\`.
     const payload = await readResponseJson2(response);
     if (!response.ok) {
       if (response.status === 401 && auth.headers.Authorization) {
-        if (auth.fromStored) clearStoredAuthCredentials();
-        const detail = errorMessageFromJson2(payload) ?? `Backend request failed: ${method} ${path26} (${response.status})`;
+        const detail = errorMessageFromJson2(payload) ?? `Backend request failed: ${method} ${path27} (${response.status})`;
         throw new CliError({
           message: `${detail}
-` + (auth.fromStored ? "Saved credentials were cleared. Run `ovld auth login` to sign in again." : "Run `ovld auth login` or refresh your USER_TOKEN environment variable.")
+` + (auth.fromStored ? "Your saved credentials were rejected. Run `ovld auth login` to sign in again." : "Run `ovld auth login` or refresh your USER_TOKEN environment variable.")
         });
       }
       throw new CliError({
-        message: errorMessageFromJson2(payload) ?? `Backend request failed: ${method} ${path26} (${response.status})`
+        message: errorMessageFromJson2(payload) ?? `Backend request failed: ${method} ${path27} (${response.status})`
       });
     }
     return payload;
@@ -2973,13 +3004,13 @@ Start the Desktop/local backend or run \`ovld config set cloud <url>\`.
   return {
     baseUrl,
     health: () => request({ method: "GET", path: "/api/health" }),
-    get: (path26) => request({ method: "GET", path: path26 }),
-    post: ({ path: path26, body }) => request({ method: "POST", path: path26, body }),
-    patch: ({ path: path26, body }) => request({ method: "PATCH", path: path26, body }),
-    delete: (path26) => request({ method: "DELETE", path: path26 }),
-    postRaw: ({ path: path26, body, contentType, filename }) => request({
+    get: (path27) => request({ method: "GET", path: path27 }),
+    post: ({ path: path27, body }) => request({ method: "POST", path: path27, body }),
+    patch: ({ path: path27, body }) => request({ method: "PATCH", path: path27, body }),
+    delete: (path27) => request({ method: "DELETE", path: path27 }),
+    postRaw: ({ path: path27, body, contentType, filename }) => request({
       method: "POST",
-      path: path26,
+      path: path27,
       rawBody: body,
       extraHeaders: {
         "Content-Type": contentType || "application/octet-stream",
@@ -3509,7 +3540,10 @@ async function runFullSetupCommand({ json }) {
   const backend = await configureBackendForSetup();
   const auth = await configureAuthForSetup({
     backendUrl: backend.url,
-    passwordCredentialTarget: backend.mode === "cloud" ? "full_user_token" : "session_bearer"
+    // Mint a long-lived (90-day) user token in both modes; see the note in
+    // management.ts. Avoids the ~7-day session_bearer lifetime local logins used
+    // to get.
+    passwordCredentialTarget: "full_user_token"
   });
   const agents = await configureAgentsForSetup();
   const runtime = openCliRuntime();
@@ -4121,8 +4155,47 @@ async function runAuthStatusCommand({ json }) {
   console.log(`credential_source=${status.credentialSource}`);
   if (status.credentialType) console.log(`credential_type=${status.credentialType}`);
   if (status.credentialsPath) console.log(`credentials_path=${status.credentialsPath}`);
+  if (status.expiresAt) {
+    const remaining = status.expired ? "expired" : status.expiresInDays !== null ? `${status.expiresInDays} day(s) remaining` : "unknown";
+    console.log(`expires_at=${status.expiresAt} (${remaining})`);
+  }
   if (status.validationError) console.log(`validation_error=${status.validationError}`);
 }
+async function runAuthRepairCommand({
+  rest,
+  json
+}) {
+  const { resolveAuthStatus: resolveAuthStatus2 } = await Promise.resolve().then(() => (init_auth_status(), auth_status_exports));
+  const status = await resolveAuthStatus2();
+  if (status.loggedIn) {
+    if (json) {
+      printJson({ ok: true, action: "none", reason: "healthy", status });
+    } else {
+      console.log("Authentication is healthy; no repair needed.");
+      if (status.expiresAt && !status.expired && status.expiresInDays !== null) {
+        console.log(
+          `Credential expires ${status.expiresAt} (${status.expiresInDays} day(s) remaining).`
+        );
+      }
+    }
+    return;
+  }
+  if (status.credentialSource === "environment") {
+    throw new CliError({
+      message: `Your credential comes from an environment variable (OVERLORD_USER_TOKEN / OVLD_USER_TOKEN / USER_TOKEN) and cannot be repaired from disk.
+Refresh that variable with a valid token${status.validationError ? ` (backend said: ${status.validationError})` : ""}.`
+    });
+  }
+  const { clearStoredAuthCredentials: clearStoredAuthCredentials2, readStoredAuthCredentials: readStoredAuthCredentials2 } = await Promise.resolve().then(() => (init_auth_credentials(), auth_credentials_exports));
+  const hadStored = readStoredAuthCredentials2() !== null;
+  if (hadStored) {
+    clearStoredAuthCredentials2();
+    if (!json) console.log("Cleared stale stored credentials; re-authenticating...");
+  } else if (!json) {
+    console.log("No stored credentials found; starting a fresh login...");
+  }
+  await runAuthLoginFlow({ parsed: parseArgs(rest.filter((arg) => arg !== "repair")), json });
+}
 async function runAuthCommand({ rest, json }) {
   const parsed = parseArgs(rest);
   const sub = parsed.positional[0] ?? "login";
@@ -4130,11 +4203,21 @@ async function runAuthCommand({ rest, json }) {
     await runAuthStatusCommand({ json });
     return;
   }
+  if (sub === "repair") {
+    await runAuthRepairCommand({ rest, json });
+    return;
+  }
   if (sub !== "login") {
     throw new CliError({
-      message: "Usage: ovld auth login [--token <out_...>] | ovld auth status [--json]"
+      message: "Usage: ovld auth login [--token <out_...>] | ovld auth status [--json] | ovld auth repair [--json]"
     });
   }
+  await runAuthLoginFlow({ parsed, json });
+}
+async function runAuthLoginFlow({
+  parsed,
+  json
+}) {
   const tokenFlag = flagValue(parsed.flags, "--token");
   const { findEffectiveConfigPath: findEffectiveConfigPath2, hasExplicitBackendConfig: hasExplicitBackendConfig2, loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
   let config = loadConfig2();
@@ -4155,7 +4238,12 @@ async function runAuthCommand({ rest, json }) {
   const { loginWithUserToken: loginWithUserToken2, runInteractiveAuthLogin: runInteractiveAuthLogin2 } = await Promise.resolve().then(() => (init_auth_login(), auth_login_exports));
   const login = tokenFlag ? await loginWithUserToken2({ backendUrl, token: tokenFlag }) : await runInteractiveAuthLogin2({
     backendUrl,
-    passwordCredentialTarget: mode === "cloud" ? "full_user_token" : "session_bearer"
+    // Always exchange the password sign-in for a long-lived (90-day) user
+    // token, regardless of backend mode. Storing the raw Better Auth session
+    // token (session_bearer) gave local-mode logins a ~7-day lifetime while
+    // cloud logins got 90 days; minting a full_user_token in both modes keeps
+    // the lifetime consistent and avoids surprise "token expired" churn.
+    passwordCredentialTarget: "full_user_token"
   });
   if (json) {
     printJson({
@@ -4445,6 +4533,164 @@ var init_serve = __esm({
   }
 });
 
+// src/contract.ts
+var contract_exports = {};
+__export(contract_exports, {
+  runContractCommand: () => runContractCommand,
+  validateAgainstSchema: () => validateAgainstSchema,
+  validateManifest: () => validateManifest
+});
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "node:fs";
+import path10 from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { parse as parseYaml } from "yaml";
+function schemaPath() {
+  const packaged = path10.join(
+    path10.dirname(fileURLToPath5(import.meta.url)),
+    "contract",
+    "conformance-manifest.schema.yaml"
+  );
+  if (existsSync10(packaged)) return packaged;
+  let dir = process.cwd();
+  while (true) {
+    const candidate = path10.join(dir, "contract", "conformance-manifest.schema.yaml");
+    if (existsSync10(candidate)) return candidate;
+    const parent = path10.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return resolveRepoPath("contract/conformance-manifest.schema.yaml");
+}
+function loadSchema() {
+  if (cachedSchema) return cachedSchema;
+  const file = schemaPath();
+  if (!existsSync10(file)) {
+    throw new CliError({
+      message: `Could not find conformance-manifest.schema.yaml (looked at ${file}).`
+    });
+  }
+  cachedSchema = parseYaml(readFileSync8(file, "utf8"));
+  return cachedSchema;
+}
+function validateAgainstSchema(value, schema, location = "$") {
+  const errors = [];
+  if (schema.type === "object") {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+      return [`${location}: must be an object`];
+    }
+    const obj = value;
+    for (const key of schema.required ?? []) {
+      if (!(key in obj) || obj[key] === void 0 || obj[key] === "") {
+        errors.push(`${location}: missing required field "${key}"`);
+      }
+    }
+    if (schema.additionalProperties === false) {
+      const allowed = new Set(Object.keys(schema.properties ?? {}));
+      for (const key of Object.keys(obj)) {
+        if (!allowed.has(key)) {
+          errors.push(`${location}: unexpected field "${key}"`);
+        }
+      }
+    }
+    for (const [key, propSchema] of Object.entries(schema.properties ?? {})) {
+      if (obj[key] === void 0) continue;
+      errors.push(...validateAgainstSchema(obj[key], propSchema, `${location}.${key}`));
+    }
+    return errors;
+  }
+  if (schema.type === "array") {
+    if (!Array.isArray(value)) {
+      return [`${location}: must be an array`];
+    }
+    if (schema.uniqueItems) {
+      const seen = /* @__PURE__ */ new Set();
+      value.forEach((item) => {
+        const key = JSON.stringify(item);
+        if (seen.has(key)) errors.push(`${location}: duplicate item ${key}`);
+        seen.add(key);
+      });
+    }
+    if (schema.items) {
+      value.forEach((item, index) => {
+        errors.push(...validateAgainstSchema(item, schema.items, `${location}[${index}]`));
+      });
+    }
+    return errors;
+  }
+  if (schema.type === "string") {
+    if (typeof value !== "string") {
+      return [`${location}: must be a string`];
+    }
+    if (schema.enum && !schema.enum.includes(value)) {
+      errors.push(`${location}: must be one of ${schema.enum.join(", ")} (got "${value}")`);
+    }
+    if (schema.pattern && !new RegExp(schema.pattern).test(value)) {
+      errors.push(`${location}: must match pattern ${schema.pattern} (got "${value}")`);
+    }
+    return errors;
+  }
+  return errors;
+}
+function validateManifest(manifest) {
+  const schema = loadSchema();
+  return validateAgainstSchema(manifest, schema, "$");
+}
+function readManifest(manifestPathArg) {
+  const resolved = path10.resolve(process.cwd(), manifestPathArg);
+  if (!existsSync10(resolved)) {
+    throw new CliError({ message: `Manifest not found: ${manifestPathArg}` });
+  }
+  return parseYaml(readFileSync8(resolved, "utf8"));
+}
+function runContractCheck({ args, json }) {
+  const manifestPathArg = args.find((arg) => !arg.startsWith("--"));
+  if (!manifestPathArg) {
+    throw new CliError({ message: "Usage: ovld contract check <manifest-path> [--json]" });
+  }
+  const manifest = readManifest(manifestPathArg);
+  const errors = validateManifest(manifest);
+  const valid = errors.length === 0;
+  if (json) {
+    console.log(JSON.stringify({ valid, manifest: manifestPathArg, errors }, null, 2));
+  } else if (valid) {
+    console.log(`\u2713 ${manifestPathArg} conforms to conformance-manifest.schema.yaml`);
+  } else {
+    console.log(`\u2717 ${manifestPathArg} does not conform to conformance-manifest.schema.yaml:`);
+    for (const error of errors) {
+      console.log(`  - ${error}`);
+    }
+  }
+  if (!valid) {
+    throw new CliError({ message: `${errors.length} conformance error(s) found.` });
+  }
+}
+async function runContractCommand({
+  subcommand,
+  args,
+  primaryCommand
+}) {
+  const json = args.includes("--json");
+  const rest = args.filter((arg) => arg !== "--json");
+  switch (subcommand) {
+    case "check":
+      runContractCheck({ args: rest, json });
+      return;
+    default:
+      throw new CliError({
+        message: `Unknown contract subcommand: ${subcommand}
+Usage: ${primaryCommand} contract check <manifest-path> [--json]`
+      });
+  }
+}
+var cachedSchema;
+var init_contract = __esm({
+  "src/contract.ts"() {
+    "use strict";
+    init_config();
+    init_errors();
+  }
+});
+
 // ../packages/core/dist/service/util.js
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
@@ -4460,12 +4706,12 @@ var init_util2 = __esm({
 });
 
 // ../packages/core/dist/service/local-target/project-metadata.js
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "node:fs";
-import path10 from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
+import path11 from "node:path";
 function parseProjectJson(projectJsonPath) {
-  if (!existsSync10(projectJsonPath))
+  if (!existsSync11(projectJsonPath))
     return null;
-  const parsed = JSON.parse(readFileSync8(projectJsonPath, "utf8"));
+  const parsed = JSON.parse(readFileSync9(projectJsonPath, "utf8"));
   if (typeof parsed.projectId !== "string" || typeof parsed.resourceId !== "string")
     return null;
   const resourceIdsByExecutionTarget = parsed.resourceIdsByExecutionTarget && typeof parsed.resourceIdsByExecutionTarget === "object" && !Array.isArray(parsed.resourceIdsByExecutionTarget) ? Object.fromEntries(Object.entries(parsed.resourceIdsByExecutionTarget).filter((entry) => typeof entry[0] === "string" && entry[0].trim().length > 0 && typeof entry[1] === "string" && entry[1].trim().length > 0)) : {};
@@ -4495,11 +4741,11 @@ function readProjectJsonLink(projectJsonPath, options = {}) {
   };
 }
 function writeProjectJson({ directoryPath, projectId, resourceId, resourceKey, executionTargetId, isPrimary }) {
-  const overlordDir = path10.join(directoryPath, ".overlord");
+  const overlordDir = path11.join(directoryPath, ".overlord");
   mkdirSync5(overlordDir, { recursive: true });
-  mkdirSync5(path10.join(overlordDir, "tmp"), { recursive: true });
-  mkdirSync5(path10.join(overlordDir, "logs"), { recursive: true });
-  const projectJsonPath = path10.join(overlordDir, "project.json");
+  mkdirSync5(path11.join(overlordDir, "tmp"), { recursive: true });
+  mkdirSync5(path11.join(overlordDir, "logs"), { recursive: true });
+  const projectJsonPath = path11.join(overlordDir, "project.json");
   const existing = readProjectJsonLink(projectJsonPath);
   const resourceIdsByExecutionTarget = {
     ...existing?.projectId === projectId ? existing.resourceIdsByExecutionTarget : {}
@@ -4531,7 +4777,7 @@ var init_project_metadata = __esm({
 
 // ../packages/core/dist/repository/git-tree.js
 import { execFileSync } from "node:child_process";
-import path11 from "node:path";
+import path12 from "node:path";
 function runGit(cwd, args) {
   try {
     return execFileSync("git", args, {
@@ -4554,17 +4800,17 @@ function gitPath(cwd, args) {
   }
 }
 function addDirectoryAncestors(paths, filePath) {
-  let parent = path11.posix.dirname(filePath);
+  let parent = path12.posix.dirname(filePath);
   while (parent !== "." && parent !== "/") {
     paths.add(parent);
-    parent = path11.posix.dirname(parent);
+    parent = path12.posix.dirname(parent);
   }
 }
 function toEntry(entryPath, type) {
-  const parentPath = path11.posix.dirname(entryPath);
+  const parentPath = path12.posix.dirname(entryPath);
   return {
     path: entryPath,
-    name: path11.posix.basename(entryPath),
+    name: path12.posix.basename(entryPath),
     type,
     parentPath: parentPath === "." ? null : parentPath,
     depth: entryPath.split("/").length - 1
@@ -4576,7 +4822,7 @@ function compareEntries(a, b) {
   return a.path < b.path ? -1 : 1;
 }
 function readRepositoryTree(rootPath, options = {}) {
-  const resolvedRoot = path11.resolve(rootPath);
+  const resolvedRoot = path12.resolve(rootPath);
   const gitRoot = gitPath(resolvedRoot, ["rev-parse", "--show-toplevel"]);
   if (!gitRoot) {
     throw new RepositoryReadError("not_git_repository", `${resolvedRoot} is not inside a git repository.`);
@@ -4599,7 +4845,7 @@ function readRepositoryTree(rootPath, options = {}) {
   const truncated = entries.length > maxEntries;
   return {
     rootPath: resolvedRoot,
-    gitRoot: path11.resolve(gitRoot),
+    gitRoot: path12.resolve(gitRoot),
     branch: gitPath(gitRoot, ["branch", "--show-current"]),
     commit: gitPath(gitRoot, ["rev-parse", "--short", "HEAD"]),
     entries: truncated ? entries.slice(0, maxEntries) : entries,
@@ -4660,13 +4906,13 @@ var init_git_run = __esm({
 });
 
 // ../packages/core/dist/service/local-target/worktree-git.js
-import { existsSync as existsSync11, realpathSync } from "node:fs";
-import path12 from "node:path";
+import { existsSync as existsSync12, realpathSync } from "node:fs";
+import path13 from "node:path";
 function resolveRealPath(targetPath) {
   try {
     return realpathSync.native(targetPath);
   } catch {
-    return path12.resolve(targetPath);
+    return path13.resolve(targetPath);
   }
 }
 function worktreeIsDirty(worktreePath) {
@@ -4696,7 +4942,7 @@ function removeGitWorktree({ primaryRepoPath, worktreePath, force }) {
   args.push(worktreePath);
   runGitResult(primaryRepoPath, args);
   runGitResult(primaryRepoPath, ["worktree", "prune"]);
-  return !existsSync11(worktreePath);
+  return !existsSync12(worktreePath);
 }
 function collectManagedWorktrees({ worktreeRoot, projects }) {
   const resolvedRoot = resolveRealPath(worktreeRoot);
@@ -4704,7 +4950,7 @@ function collectManagedWorktrees({ worktreeRoot, projects }) {
   const seen = /* @__PURE__ */ new Set();
   for (const project of projects) {
     const repoPath = project.primaryRepoPath;
-    if (!repoPath || !existsSync11(repoPath))
+    if (!repoPath || !existsSync12(repoPath))
       continue;
     const out = runGitResult(repoPath, ["worktree", "list", "--porcelain"]);
     if (!out.ok)
@@ -4715,7 +4961,7 @@ function collectManagedWorktrees({ worktreeRoot, projects }) {
       if (!currentPath)
         return;
       const resolved = resolveRealPath(currentPath);
-      const underRoot = resolved === resolvedRoot || resolved.startsWith(resolvedRoot + path12.sep);
+      const underRoot = resolved === resolvedRoot || resolved.startsWith(resolvedRoot + path13.sep);
       if (underRoot && !seen.has(resolved)) {
         seen.add(resolved);
         entries.push({
@@ -4743,7 +4989,7 @@ function collectManagedWorktrees({ worktreeRoot, projects }) {
   return entries;
 }
 function removeManagedWorktree({ path: worktreePath, primaryRepoPath, force }) {
-  const target = path12.resolve(worktreePath);
+  const target = path13.resolve(worktreePath);
   if (!force && worktreeIsDirty(target)) {
     return {
       removed: [],
@@ -4757,7 +5003,7 @@ function purgeManagedWorktrees({ entries }) {
   const removed = [];
   const skipped = [];
   for (const entry of entries) {
-    const target = path12.resolve(entry.path);
+    const target = path13.resolve(entry.path);
     if (worktreeIsDirty(target)) {
       skipped.push({ path: target, reason: "uncommitted changes" });
       continue;
@@ -4782,10 +5028,10 @@ var init_worktree_git = __esm({
 });
 
 // ../packages/core/dist/service/local-target/branch-actions-git.js
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 function integrateBranch(input) {
   const { branchName, baseBranch, worktreePath, primaryRepoPath } = input;
-  if (!existsSync12(worktreePath)) {
+  if (!existsSync13(worktreePath)) {
     return {
       ok: false,
       code: "BRANCH_NO_WORKTREE",
@@ -4867,7 +5113,7 @@ function commitBranch(input) {
       message: "A commit message is required."
     };
   }
-  if (!existsSync12(worktreePath)) {
+  if (!existsSync13(worktreePath)) {
     return {
       ok: false,
       code: "BRANCH_NO_WORKTREE",
@@ -4923,7 +5169,7 @@ function pushParent(input) {
     };
   }
   let summary = `Pushed ${baseBranch} to origin.`;
-  if (existsSync12(worktreePath) && !worktreeIsDirty(worktreePath)) {
+  if (existsSync13(worktreePath) && !worktreeIsDirty(worktreePath)) {
     if (removeGitWorktree({ primaryRepoPath, worktreePath, force: false })) {
       summary += ` Removed the merged worktree for ${branchName}.`;
     }
@@ -4932,7 +5178,7 @@ function pushParent(input) {
 }
 function publishBranch(input) {
   const { branchName, worktreePath, primaryRepoPath } = input;
-  const repo = existsSync12(worktreePath) ? worktreePath : primaryRepoPath;
+  const repo = existsSync13(worktreePath) ? worktreePath : primaryRepoPath;
   const push = runGitResult(repo, ["push", "-u", "origin", branchName]);
   if (!push.ok) {
     return {
@@ -4982,7 +5228,7 @@ var init_branch_status_git = __esm({
 });
 
 // ../packages/core/dist/service/local-target/commit-message-diff-git.js
-import { existsSync as existsSync13 } from "node:fs";
+import { existsSync as existsSync14 } from "node:fs";
 function collectWorktreeChanges(worktreePath) {
   const status = runGitResult(worktreePath, ["status", "--porcelain"]);
   const diff = runGitResult(worktreePath, ["diff", "HEAD"]);
@@ -4998,7 +5244,7 @@ ${diff.stdout}`);
   return sections.join("\n\n");
 }
 function gatherCommitMessageDiff(worktreePath) {
-  if (!existsSync13(worktreePath)) {
+  if (!existsSync14(worktreePath)) {
     return {
       ok: false,
       code: "BRANCH_NO_WORKTREE",
@@ -5059,7 +5305,7 @@ var init_result = __esm({
 });
 
 // ../packages/core/dist/service/local-target/in-process-provider.js
-import { existsSync as existsSync14 } from "node:fs";
+import { existsSync as existsSync15 } from "node:fs";
 var InProcessProvider;
 var init_in_process_provider = __esm({
   "../packages/core/dist/service/local-target/in-process-provider.js"() {
@@ -5087,7 +5333,7 @@ var init_in_process_provider = __esm({
        */
       async observeResource(input) {
         const observedAt = (/* @__PURE__ */ new Date()).toISOString();
-        const state = existsSync14(input.path) ? "available" : "missing";
+        const state = existsSync15(input.path) ? "available" : "missing";
         return ok(this.target, { state, observedAt });
       }
       /**
@@ -5334,7 +5580,7 @@ var init_local_target_mutation_runner = __esm({
 });
 
 // ../packages/core/dist/service/project-resource-key.js
-import path13 from "node:path";
+import path14 from "node:path";
 function deriveProjectResourceKey({ resourceKey, label, directoryPath }) {
   const explicit = resourceKey?.trim();
   if (explicit)
@@ -5342,7 +5588,7 @@ function deriveProjectResourceKey({ resourceKey, label, directoryPath }) {
   const labelKey = label?.trim();
   if (labelKey)
     return slugify(labelKey);
-  return slugify(path13.basename(path13.resolve(directoryPath)));
+  return slugify(path14.basename(path14.resolve(directoryPath)));
 }
 var init_project_resource_key = __esm({
   "../packages/core/dist/service/project-resource-key.js"() {
@@ -5352,7 +5598,7 @@ var init_project_resource_key = __esm({
 });
 
 // src/branch-planning.ts
-import path14 from "node:path";
+import path15 from "node:path";
 function stripCombiningMarks(value) {
   return value.normalize("NFKD").replace(/[\u0300-\u036f]/g, "");
 }
@@ -5385,7 +5631,7 @@ function missionWorktreePath({
   branch
 }) {
   const key = resourceKey.trim() || "project";
-  return path14.join(worktreeRoot, projectSlug || "project", key, branchLeaf(branch));
+  return path15.join(worktreeRoot, projectSlug || "project", key, branchLeaf(branch));
 }
 function normalizeRemoteRef(ref) {
   return ref.replace(/^origin\//, "").replace(/^refs\/heads\//, "").replace(/^refs\/remotes\/origin\//, "");
@@ -5460,9 +5706,9 @@ var init_branch_planning = __esm({
 
 // src/branch-preparation.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync15, mkdirSync as mkdirSync6, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync6, statSync as statSync3 } from "node:fs";
 import os3 from "node:os";
-import path15 from "node:path";
+import path16 from "node:path";
 function runGit3(cwd, args, options = {}) {
   try {
     return execFileSync4("git", args, {
@@ -5483,7 +5729,7 @@ function lines(value) {
 function resolveGitRoot(workingDirectory) {
   const root = runGit3(workingDirectory, ["rev-parse", "--show-toplevel"]);
   if (!root) throw new Error(`${workingDirectory} is not inside a git repository.`);
-  return path15.resolve(root);
+  return path16.resolve(root);
 }
 function repoDefaultBranch(gitRoot) {
   const symbolic = runGit3(gitRoot, ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], {
@@ -5617,9 +5863,9 @@ function missionSequence(mission, missionId) {
 }
 function resolveWorktreeRoot() {
   const override = process.env.OVERLORD_WORKTREE_ROOT?.trim();
-  if (override) return path15.resolve(override);
+  if (override) return path16.resolve(override);
   const home = process.env.OVLD_HOME?.trim() || process.env.OVERLORD_HOME?.trim();
-  return path15.join(home ? path15.resolve(home) : path15.join(os3.homedir(), ".ovld"), "worktrees");
+  return path16.join(home ? path16.resolve(home) : path16.join(os3.homedir(), ".ovld"), "worktrees");
 }
 function ensureBranchRef(gitRoot, decision) {
   if (decision.action === "reuse") return;
@@ -5630,8 +5876,8 @@ function ensureBranchRef(gitRoot, decision) {
 }
 function ensureWorktree(gitRoot, decision) {
   ensureBranchRef(gitRoot, decision);
-  mkdirSync6(path15.dirname(decision.worktreePath), { recursive: true });
-  if (existsSync15(decision.worktreePath)) {
+  mkdirSync6(path16.dirname(decision.worktreePath), { recursive: true });
+  if (existsSync16(decision.worktreePath)) {
     if (!statSync3(decision.worktreePath).isDirectory()) {
       throw new Error(`Worktree path exists and is not a directory: ${decision.worktreePath}`);
     }
@@ -5772,7 +6018,7 @@ var init_branch_preparation = __esm({
 });
 
 // src/discover-project-local.ts
-import path16 from "node:path";
+import path17 from "node:path";
 async function resolvePreferredExecutionTargetId({
   backend
 }) {
@@ -5789,9 +6035,9 @@ function discoverProjectJsonFromFilesystem({
   workingDirectory,
   preferredExecutionTargetId
 }) {
-  let current = path16.resolve(workingDirectory);
+  let current = path17.resolve(workingDirectory);
   while (true) {
-    const projectJsonPath = path16.join(current, ".overlord", "project.json");
+    const projectJsonPath = path17.join(current, ".overlord", "project.json");
     const raw = readProjectJsonLink(projectJsonPath, { preferredExecutionTargetId });
     if (raw) {
       return {
@@ -5801,7 +6047,7 @@ function discoverProjectJsonFromFilesystem({
         isPrimary: raw.isPrimary
       };
     }
-    const parent = path16.dirname(current);
+    const parent = path17.dirname(current);
     if (parent === current) break;
     current = parent;
   }
@@ -5843,7 +6089,7 @@ async function discoverProjectOnClient({
   const resolvedLocal = localWithTarget ?? local;
   if (!resolvedLocal) {
     throw new CliError({
-      message: `No linked Overlord project found for ${path16.resolve(workingDirectory)}. Run \`ovld add-cwd\` or \`ovld create-project\`.`
+      message: `No linked Overlord project found for ${path17.resolve(workingDirectory)}. Run \`ovld add-cwd\` or \`ovld create-project\`.`
     });
   }
   const project = await resolveProjectByIdOrName({ backend, projectRef: resolvedLocal.projectId });
@@ -6143,7 +6389,7 @@ var init_terminal_launcher = __esm({
 // src/launch.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { chmodSync as chmodSync3, writeFileSync as writeFileSync5 } from "node:fs";
-import path17 from "node:path";
+import path18 from "node:path";
 function overlordLaunchEnv({
   backendUrl,
   missionId,
@@ -6275,7 +6521,7 @@ function launchScriptPath({
   executionRequestId
 }) {
   const requestPart = executionRequestId ? safeLaunchScriptPart(executionRequestId) : `${process.pid}`;
-  return path17.join(tmpDir, `launch-${safeLaunchScriptPart(displayId)}-${requestPart}.sh`);
+  return path18.join(tmpDir, `launch-${safeLaunchScriptPart(displayId)}-${requestPart}.sh`);
 }
 async function buildLaunchPlan({
   runtime,
@@ -6284,7 +6530,7 @@ async function buildLaunchPlan({
   const context = await loadMissionContext({ runtime, missionId: options.missionId });
   pruneStaleProjectTmp({ workingDirectory: options.workingDirectory, create: true });
   const tmpDir = ensureProjectTmpDir(options.workingDirectory);
-  const contextFile = path17.join(
+  const contextFile = path18.join(
     tmpDir,
     `mission-${context.displayId.replace(/[^a-zA-Z0-9_-]/g, "-")}.md`
   );
@@ -6394,16 +6640,16 @@ var init_launch = __esm({
 
 // src/native-session.ts
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync16, readdirSync as readdirSync3, readFileSync as readFileSync9, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync17, readdirSync as readdirSync3, readFileSync as readFileSync10, statSync as statSync4 } from "node:fs";
 import { homedir } from "node:os";
-import path18 from "node:path";
+import path19 from "node:path";
 function sessionCachePath({
   agent,
   missionId,
   workingDirectory
 }) {
-  const key = createHash3("sha256").update(`${path18.resolve(workingDirectory)}\0${missionId}\0${agent}`).digest("hex");
-  return path18.join(resolveGlobalDataDir(), "native-sessions", key);
+  const key = createHash3("sha256").update(`${path19.resolve(workingDirectory)}\0${missionId}\0${agent}`).digest("hex");
+  return path19.join(resolveGlobalDataDir(), "native-sessions", key);
 }
 function readCachedNativeSessionId({
   agent,
@@ -6412,20 +6658,20 @@ function readCachedNativeSessionId({
 }) {
   try {
     const filePath = sessionCachePath({ agent, missionId, workingDirectory });
-    if (!existsSync16(filePath)) return void 0;
-    const raw = JSON.parse(readFileSync9(filePath, "utf8"));
+    if (!existsSync17(filePath)) return void 0;
+    const raw = JSON.parse(readFileSync10(filePath, "utf8"));
     return typeof raw.externalSessionId === "string" && raw.externalSessionId.trim() ? raw.externalSessionId.trim() : void 0;
   } catch {
     return void 0;
   }
 }
 function detectCodexSessionIdFromDisk(workingDirectory) {
-  const sessionsDir = path18.join(homedir(), ".codex", "sessions");
-  if (!existsSync16(sessionsDir)) return void 0;
+  const sessionsDir = path19.join(homedir(), ".codex", "sessions");
+  if (!existsSync17(sessionsDir)) return void 0;
   const candidates = [];
   const visit = (dir) => {
     for (const entry of readdirSync3(dir, { withFileTypes: true })) {
-      const filePath = path18.join(dir, entry.name);
+      const filePath = path19.join(dir, entry.name);
       if (entry.isDirectory()) {
         visit(filePath);
         continue;
@@ -6450,7 +6696,7 @@ function detectCodexSessionIdFromDisk(workingDirectory) {
     let nativeId;
     let cwd;
     try {
-      const [firstLine = ""] = readFileSync9(candidate.filePath, "utf8").split(/\r?\n/, 1);
+      const [firstLine = ""] = readFileSync10(candidate.filePath, "utf8").split(/\r?\n/, 1);
       const obj = JSON.parse(firstLine);
       const payload = obj.payload && typeof obj.payload === "object" ? obj.payload : obj;
       if (typeof payload.id === "string") nativeId = payload.id.match(UUID_RE)?.[0];
@@ -6458,10 +6704,10 @@ function detectCodexSessionIdFromDisk(workingDirectory) {
     } catch {
       nativeId = void 0;
     }
-    nativeId ??= path18.basename(candidate.filePath).match(UUID_RE)?.[0];
+    nativeId ??= path19.basename(candidate.filePath).match(UUID_RE)?.[0];
     if (!nativeId) continue;
     fallback ??= nativeId;
-    if (cwd && path18.resolve(cwd) === path18.resolve(workingDirectory)) return nativeId;
+    if (cwd && path19.resolve(cwd) === path19.resolve(workingDirectory)) return nativeId;
   }
   return fallback;
 }
@@ -6498,8 +6744,8 @@ var init_native_session = __esm({
 });
 
 // src/org-setup.ts
-import { readFileSync as readFileSync10 } from "node:fs";
-import path19 from "node:path";
+import { readFileSync as readFileSync11 } from "node:fs";
+import path20 from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 function suggestSlug(name) {
   const cleaned = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -6578,12 +6824,12 @@ async function runOrgSetupCommand({
   let logoWarning = null;
   if (logoPath) {
     try {
-      const resolvedPath = path19.resolve(logoPath);
-      const bytes = readFileSync10(resolvedPath);
+      const resolvedPath = path20.resolve(logoPath);
+      const bytes = readFileSync11(resolvedPath);
       const stored = await runtime.backend.postRaw({
         path: "/api/uploads/organization-images",
         body: bytes,
-        filename: path19.basename(resolvedPath)
+        filename: path20.basename(resolvedPath)
       });
       await runtime.backend.patch({
         path: `/api/organizations/${encodeURIComponent(organization.id)}`,
@@ -7017,17 +7263,17 @@ var init_protocol_help = __esm({
 
 // src/vcs-sessions.ts
 import { createHash as createHash4 } from "node:crypto";
-import { existsSync as existsSync17, mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "node:fs";
-import path20 from "node:path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "node:fs";
+import path21 from "node:path";
 function manifestPath2(workingDirectory) {
-  const key = createHash4("sha256").update(path20.resolve(workingDirectory)).digest("hex");
-  return path20.join(resolveGlobalDataDir(), "vcs-sessions", `${key}.json`);
+  const key = createHash4("sha256").update(path21.resolve(workingDirectory)).digest("hex");
+  return path21.join(resolveGlobalDataDir(), "vcs-sessions", `${key}.json`);
 }
 function readEntries(workingDirectory) {
   try {
     const target = manifestPath2(workingDirectory);
-    if (!existsSync17(target)) return [];
-    const raw = JSON.parse(readFileSync11(target, "utf8"));
+    if (!existsSync18(target)) return [];
+    const raw = JSON.parse(readFileSync12(target, "utf8"));
     if (!Array.isArray(raw.entries)) return [];
     const now = Date.now();
     return raw.entries.flatMap((entry) => {
@@ -7046,7 +7292,7 @@ function readEntries(workingDirectory) {
 function writeEntries(workingDirectory, entries) {
   try {
     const target = manifestPath2(workingDirectory);
-    mkdirSync7(path20.dirname(target), { recursive: true });
+    mkdirSync7(path21.dirname(target), { recursive: true });
     writeFileSync6(target, JSON.stringify({ entries }));
   } catch {
   }
@@ -7100,20 +7346,20 @@ var init_vcs_sessions = __esm({
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
 import {
-  existsSync as existsSync18,
+  existsSync as existsSync19,
   mkdirSync as mkdirSync8,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   realpathSync as realpathSync2,
   rmSync as rmSync3,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import path21 from "node:path";
+import path22 from "node:path";
 function normalizePath(filePath) {
   return filePath.replace(/\\/g, "/").trim();
 }
 function sameWorkingDirectory(left, right) {
-  return typeof left === "string" && path21.resolve(left) === path21.resolve(right);
+  return typeof left === "string" && path22.resolve(left) === path22.resolve(right);
 }
 function parsePorcelainLine(line) {
   const trimmedEnd = line.replace(/\s+$/, "");
@@ -7164,13 +7410,13 @@ function sessionKeyHash({
   workingDirectory,
   missionId
 }) {
-  return createHash5("sha256").update(`${path21.resolve(workingDirectory)}\0${missionId}`).digest("hex");
+  return createHash5("sha256").update(`${path22.resolve(workingDirectory)}\0${missionId}`).digest("hex");
 }
 function baselineFilePath({
   workingDirectory,
   missionId
 }) {
-  return path21.join(
+  return path22.join(
     resolveGlobalDataDir(),
     "vcs-baselines",
     `${sessionKeyHash({ workingDirectory, missionId })}.json`
@@ -7180,7 +7426,7 @@ function touchedFilesPath({
   workingDirectory,
   missionId
 }) {
-  return path21.join(
+  return path22.join(
     resolveGlobalDataDir(),
     "vcs-touched",
     `${sessionKeyHash({ workingDirectory, missionId })}.json`
@@ -7190,7 +7436,7 @@ function rationaleNotesPath({
   workingDirectory,
   missionId
 }) {
-  return path21.join(
+  return path22.join(
     resolveGlobalDataDir(),
     "vcs-rationale-notes",
     `${sessionKeyHash({ workingDirectory, missionId })}.json`
@@ -7200,7 +7446,7 @@ function bashSnapshotPath({
   workingDirectory,
   missionId
 }) {
-  return path21.join(
+  return path22.join(
     resolveGlobalDataDir(),
     "vcs-touched",
     `${sessionKeyHash({ workingDirectory, missionId })}.bash-snapshot.json`
@@ -7212,8 +7458,8 @@ function readBashSnapshot({
 }) {
   try {
     const target = bashSnapshotPath({ workingDirectory, missionId });
-    if (!existsSync18(target)) return /* @__PURE__ */ new Map();
-    const raw = JSON.parse(readFileSync12(target, "utf8"));
+    if (!existsSync19(target)) return /* @__PURE__ */ new Map();
+    const raw = JSON.parse(readFileSync13(target, "utf8"));
     const byPath = /* @__PURE__ */ new Map();
     if (Array.isArray(raw.files)) {
       for (const entry of raw.files) {
@@ -7238,7 +7484,7 @@ function writeBashSnapshot({
 }) {
   try {
     const target = bashSnapshotPath({ workingDirectory, missionId });
-    mkdirSync8(path21.dirname(target), { recursive: true });
+    mkdirSync8(path22.dirname(target), { recursive: true });
     writeFileSync7(target, JSON.stringify({ updatedAt: (/* @__PURE__ */ new Date()).toISOString(), files }));
   } catch {
   }
@@ -7272,12 +7518,12 @@ function recordBashObservedChanges({
   }
 }
 function normalizeAbsolute(filePath) {
-  const resolved = path21.resolve(filePath);
+  const resolved = path22.resolve(filePath);
   try {
     return realpathSync2(resolved).replace(/\\/g, "/");
   } catch {
     try {
-      return path21.join(realpathSync2(path21.dirname(resolved)), path21.basename(resolved)).replace(/\\/g, "/");
+      return path22.join(realpathSync2(path22.dirname(resolved)), path22.basename(resolved)).replace(/\\/g, "/");
     } catch {
       return resolved.replace(/\\/g, "/");
     }
@@ -7304,7 +7550,7 @@ function resetTouchedFiles({
       touchedFilesPath({ workingDirectory, missionId }),
       bashSnapshotPath({ workingDirectory, missionId })
     ]) {
-      if (existsSync18(target)) rmSync3(target);
+      if (existsSync19(target)) rmSync3(target);
     }
   } catch {
   }
@@ -7315,7 +7561,7 @@ function resetRationaleNotes({
 }) {
   try {
     const target = rationaleNotesPath({ workingDirectory, missionId });
-    if (existsSync18(target)) rmSync3(target);
+    if (existsSync19(target)) rmSync3(target);
   } catch {
   }
 }
@@ -7330,8 +7576,8 @@ function readRationaleNotes({
 }) {
   try {
     const target = rationaleNotesPath({ workingDirectory, missionId });
-    if (!existsSync18(target)) return [];
-    const raw = JSON.parse(readFileSync12(target, "utf8"));
+    if (!existsSync19(target)) return [];
+    const raw = JSON.parse(readFileSync13(target, "utf8"));
     if (!Array.isArray(raw.notes)) return [];
     return raw.notes.flatMap((note) => {
       if (typeof note !== "object" || note === null || typeof note.filePath !== "string") {
@@ -7365,7 +7611,7 @@ function recordRationaleNotes({
       intent: truncateNoteText(note.intent),
       transcriptContext: truncateNoteText(note.transcriptContext)
     })).filter((note) => note.filePath).map((note) => {
-      const absolute = normalizeAbsolute(path21.resolve(workingDirectory, note.filePath));
+      const absolute = normalizeAbsolute(path22.resolve(workingDirectory, note.filePath));
       return {
         filePath: absolute,
         toolName: note.toolName,
@@ -7373,14 +7619,14 @@ function recordRationaleNotes({
         transcriptContext: note.transcriptContext,
         contentHash: hashWorktreeFile({
           workingDirectory,
-          filePath: path21.relative(workingDirectory, absolute)
+          filePath: path22.relative(workingDirectory, absolute)
         }),
         recordedAt: (/* @__PURE__ */ new Date()).toISOString()
       };
     });
     if (additions.length === 0) return;
     const target = rationaleNotesPath({ workingDirectory, missionId });
-    mkdirSync8(path21.dirname(target), { recursive: true });
+    mkdirSync8(path22.dirname(target), { recursive: true });
     const prior = readRationaleNotes({ workingDirectory, missionId });
     const notesToKeep = [...prior, ...additions].slice(-200);
     writeFileSync7(
@@ -7396,16 +7642,16 @@ function recordTouchedFiles({
   files
 }) {
   try {
-    const additions = files.map((filePath) => (filePath ?? "").trim()).filter(Boolean).map((filePath) => normalizeAbsolute(path21.resolve(workingDirectory, filePath)));
+    const additions = files.map((filePath) => (filePath ?? "").trim()).filter(Boolean).map((filePath) => normalizeAbsolute(path22.resolve(workingDirectory, filePath)));
     if (additions.length === 0) return;
     const target = touchedFilesPath({ workingDirectory, missionId });
-    mkdirSync8(path21.dirname(target), { recursive: true });
+    mkdirSync8(path22.dirname(target), { recursive: true });
     const existing = readTouchedLog({ workingDirectory, missionId })?.paths ?? /* @__PURE__ */ new Set();
     for (const filePath of additions) existing.add(filePath);
     writeFileSync7(
       target,
       JSON.stringify({
-        workingDirectory: path21.resolve(workingDirectory),
+        workingDirectory: path22.resolve(workingDirectory),
         missionId,
         updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
         paths: Array.from(existing)
@@ -7418,7 +7664,7 @@ function hasTouchedFilesLog({
   workingDirectory,
   missionId
 }) {
-  return existsSync18(touchedFilesPath({ workingDirectory, missionId }));
+  return existsSync19(touchedFilesPath({ workingDirectory, missionId }));
 }
 function readTouchedLog({
   workingDirectory,
@@ -7426,8 +7672,8 @@ function readTouchedLog({
 }) {
   try {
     const target = touchedFilesPath({ workingDirectory, missionId });
-    if (!existsSync18(target)) return null;
-    const raw = JSON.parse(readFileSync12(target, "utf8"));
+    if (!existsSync19(target)) return null;
+    const raw = JSON.parse(readFileSync13(target, "utf8"));
     const result = /* @__PURE__ */ new Set();
     if (Array.isArray(raw.paths)) {
       for (const entry of raw.paths) {
@@ -7460,9 +7706,9 @@ function writeBaseline({
 }) {
   try {
     const target = baselineFilePath({ workingDirectory, missionId });
-    mkdirSync8(path21.dirname(target), { recursive: true });
+    mkdirSync8(path22.dirname(target), { recursive: true });
     const snapshot = {
-      workingDirectory: path21.resolve(workingDirectory),
+      workingDirectory: path22.resolve(workingDirectory),
       missionId,
       capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
       files: snapshotBaselineFiles({ workingDirectory, files })
@@ -7479,13 +7725,13 @@ function readPeerTouchedClaims({
     readActiveSessions(workingDirectory).map((entry) => entry.missionId.trim()).filter(Boolean)
   );
   if (activeMissionIds.size === 0) return [];
-  const directory = path21.join(resolveGlobalDataDir(), "vcs-touched");
-  if (!existsSync18(directory)) return [];
+  const directory = path22.join(resolveGlobalDataDir(), "vcs-touched");
+  if (!existsSync19(directory)) return [];
   const claims = [];
   for (const name of readdirSync4(directory)) {
     if (!name.endsWith(".json") || name.endsWith(".bash-snapshot.json")) continue;
     try {
-      const raw = JSON.parse(readFileSync12(path21.join(directory, name), "utf8"));
+      const raw = JSON.parse(readFileSync13(path22.join(directory, name), "utf8"));
       const candidateMissionId = typeof raw.missionId === "string" && raw.missionId.trim() ? raw.missionId.trim() : null;
       if (!candidateMissionId || candidateMissionId === missionId) continue;
       if (!activeMissionIds.has(candidateMissionId)) continue;
@@ -7510,8 +7756,8 @@ function readBaselineSnapshot({
 }) {
   try {
     const target = baselineFilePath({ workingDirectory, missionId });
-    if (!existsSync18(target)) return /* @__PURE__ */ new Map();
-    const raw = JSON.parse(readFileSync12(target, "utf8"));
+    if (!existsSync19(target)) return /* @__PURE__ */ new Map();
+    const raw = JSON.parse(readFileSync13(target, "utf8"));
     if (Array.isArray(raw.files)) {
       const byPath = /* @__PURE__ */ new Map();
       for (const entry of raw.files) {
@@ -7605,10 +7851,10 @@ function compileIgnorePattern(rawPattern) {
 }
 function loadIgnoreRules(repoRoot) {
   try {
-    const target = path21.join(repoRoot, OVERLORD_IGNORE_FILENAME);
-    if (!existsSync18(target)) return [];
+    const target = path22.join(repoRoot, OVERLORD_IGNORE_FILENAME);
+    if (!existsSync19(target)) return [];
     const rules = [];
-    for (const rawLine of readFileSync12(target, "utf8").split("\n")) {
+    for (const rawLine of readFileSync13(target, "utf8").split("\n")) {
       const line = rawLine.replace(/\r$/, "").trim();
       if (!line || line.startsWith("#")) continue;
       const rule = compileIgnorePattern(line);
@@ -7642,7 +7888,7 @@ function filterRunAttributableChanges({
       return [];
     }
     if (!touched) return [{ filePath: entry.filePath, vcsStatus: entry.vcsStatus }];
-    const absolute = normalizeAbsolute(path21.resolve(repoRoot, entry.filePath));
+    const absolute = normalizeAbsolute(path22.resolve(repoRoot, entry.filePath));
     if (touched.paths.has(absolute)) {
       return [
         {
@@ -7673,7 +7919,7 @@ function filterRunAttributableChanges({
   });
 }
 function titleFromPath(filePath) {
-  const base = path21.basename(filePath).replace(/\.[^.]+$/, "");
+  const base = path22.basename(filePath).replace(/\.[^.]+$/, "");
   const words = base.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[-_]+/g, " ").trim();
   if (!words) return `Update ${filePath}`;
   return `Update ${words.replace(/\b\w/g, (char) => char.toUpperCase())}`;
@@ -7696,7 +7942,7 @@ function draftChangeRationalesFromNotes({
   if (notes.length === 0 || files.length === 0) return [];
   const repoRoot = gitRepoRoot(workingDirectory) ?? workingDirectory;
   return files.flatMap((file) => {
-    const absolute = normalizeAbsolute(path21.resolve(repoRoot, file.filePath));
+    const absolute = normalizeAbsolute(path22.resolve(repoRoot, file.filePath));
     const currentHash = hashWorktreeFile({ workingDirectory, filePath: file.filePath });
     const note = latestRelevantNote({ notes, filePath: absolute, currentHash });
     if (!note) return [];
@@ -7736,8 +7982,8 @@ var init_vcs = __esm({
 });
 
 // src/record-touched.ts
-import { readFileSync as readFileSync13 } from "node:fs";
-import path22 from "node:path";
+import { readFileSync as readFileSync14 } from "node:fs";
+import path23 from "node:path";
 function collectCandidates(toolInput) {
   const counts = /* @__PURE__ */ new Map();
   const order = [];
@@ -7786,7 +8032,7 @@ function editIntent({
 function recentAssistantContext(transcriptPath) {
   if (typeof transcriptPath !== "string" || !transcriptPath.trim()) return null;
   try {
-    const lines2 = readFileSync13(transcriptPath, "utf8").split("\n").slice(-200);
+    const lines2 = readFileSync14(transcriptPath, "utf8").split("\n").slice(-200);
     for (let index = lines2.length - 1; index >= 0; index -= 1) {
       const line = lines2[index]?.trim();
       if (!line) continue;
@@ -7836,7 +8082,7 @@ function recordTouchedFromPayload({
   const toolInput = toolInputRaw && typeof toolInputRaw === "object" ? toolInputRaw : {};
   const toolName = typeof payload.tool_name === "string" && payload.tool_name.trim() ? payload.tool_name.trim() : "file edit";
   const cwd = typeof payload.cwd === "string" && payload.cwd.trim() ? payload.cwd.trim() : fallbackCwd;
-  const workingDirectory = path22.resolve(cwd);
+  const workingDirectory = path23.resolve(cwd);
   const trimmedOverride = missionOverride?.trim();
   let missionId;
   let ambiguous = false;
@@ -7940,9 +8186,9 @@ var init_resource_observations = __esm({
 
 // src/runner-service.ts
 import { execFile } from "node:child_process";
-import { chmodSync as chmodSync4, existsSync as existsSync19, mkdirSync as mkdirSync9, readFileSync as readFileSync14, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "node:fs";
+import { chmodSync as chmodSync4, existsSync as existsSync20, mkdirSync as mkdirSync9, readFileSync as readFileSync15, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "node:fs";
 import os4 from "node:os";
-import path23 from "node:path";
+import path24 from "node:path";
 import { promisify } from "node:util";
 function writeServiceFile(filePath, contents) {
   writeFileSync8(filePath, contents, { mode: 384 });
@@ -7964,13 +8210,13 @@ function emptyRunnerServiceState() {
   };
 }
 function runnerServiceStatePath(dataDir = resolveGlobalDataDir()) {
-  return path23.join(dataDir, RUNNER_SERVICE_STATE_FILENAME);
+  return path24.join(dataDir, RUNNER_SERVICE_STATE_FILENAME);
 }
 function readRunnerServiceState(dataDir = resolveGlobalDataDir()) {
   const filePath = runnerServiceStatePath(dataDir);
-  if (!existsSync19(filePath)) return emptyRunnerServiceState();
+  if (!existsSync20(filePath)) return emptyRunnerServiceState();
   try {
-    const parsed = JSON.parse(readFileSync14(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync15(filePath, "utf8"));
     return { ...emptyRunnerServiceState(), ...parsed };
   } catch {
     return emptyRunnerServiceState();
@@ -7986,14 +8232,33 @@ function patchRunnerServiceState(patch, dataDir = resolveGlobalDataDir()) {
   writeRunnerServiceState(next, dataDir);
   return next;
 }
+function runnerFocusStatePath(dataDir = resolveGlobalDataDir()) {
+  return path24.join(dataDir, RUNNER_FOCUS_STATE_FILENAME);
+}
+function readDesktopFocusState(dataDir = resolveGlobalDataDir()) {
+  const filePath = runnerFocusStatePath(dataDir);
+  if (!existsSync20(filePath)) return { lastFocusedAt: null };
+  try {
+    const parsed = JSON.parse(readFileSync15(filePath, "utf8"));
+    return { lastFocusedAt: parsed.lastFocusedAt ?? null };
+  } catch {
+    return { lastFocusedAt: null };
+  }
+}
+function withinWindow(timestamp, now, windowMs) {
+  if (!timestamp) return false;
+  const ms = Date.parse(timestamp);
+  if (Number.isNaN(ms)) return false;
+  return now - ms <= windowMs;
+}
 function selectBasePollIntervalMs({
   lastLaunchedAt,
+  lastDesktopFocusAt = null,
   now
 }) {
-  if (!lastLaunchedAt) return SLOW_POLL_INTERVAL_MS;
-  const launchedMs = Date.parse(lastLaunchedAt);
-  if (Number.isNaN(launchedMs)) return SLOW_POLL_INTERVAL_MS;
-  return now - launchedMs <= IDLE_BACKOFF_MS ? FAST_POLL_INTERVAL_MS : SLOW_POLL_INTERVAL_MS;
+  const jobActive = withinWindow(lastLaunchedAt, now, IDLE_BACKOFF_MS);
+  const focusActive = withinWindow(lastDesktopFocusAt, now, DESKTOP_FOCUS_WINDOW_MS);
+  return jobActive || focusActive ? FAST_POLL_INTERVAL_MS : SLOW_POLL_INTERVAL_MS;
 }
 function applyPollJitter(intervalMs, random = Math.random) {
   const spread = intervalMs * 0.1;
@@ -8005,16 +8270,16 @@ function nextRunnerLastError(pollError) {
 function resolveOverlordAppInvocation({
   platform: platform2 = process.platform,
   homedir: homedir2 = os4.homedir(),
-  exists = existsSync19
+  exists = existsSync20
 } = {}) {
   if (platform2 !== "darwin") return null;
   const appDirs = [
     "/Applications/Overlord.app",
-    path23.join(homedir2, "Applications", "Overlord.app")
+    path24.join(homedir2, "Applications", "Overlord.app")
   ];
   for (const appDir of appDirs) {
-    const program = path23.join(appDir, "Contents", "MacOS", "Overlord");
-    const script = path23.join(appDir, "Contents", "Resources", "cli", "bin", "ovld.mjs");
+    const program = path24.join(appDir, "Contents", "MacOS", "Overlord");
+    const script = path24.join(appDir, "Contents", "Resources", "cli", "bin", "ovld.mjs");
     if (exists(program) && exists(script)) {
       return { program, args: [script, "runner", "supervise"], runAsElectronNode: true };
     }
@@ -8026,7 +8291,7 @@ function resolveOvldInvocation(argv = process.argv, execPath = process.execPath)
   if (override) {
     return { program: override, args: ["runner", "supervise"] };
   }
-  const scriptPath = argv[1] ? path23.resolve(argv[1]) : "";
+  const scriptPath = argv[1] ? path24.resolve(argv[1]) : "";
   if (process.env.ELECTRON_RUN_AS_NODE) {
     return scriptPath ? { program: execPath, args: [scriptPath, "runner", "supervise"], runAsElectronNode: true } : { program: execPath, args: ["runner", "supervise"], runAsElectronNode: true };
   }
@@ -8059,7 +8324,7 @@ function buildRunnerServiceEnv({
     PATH: process.env.PATH?.trim() || "/usr/local/bin:/usr/bin:/bin"
   };
   const home = overlordHome?.trim() || process.env.OVLD_HOME?.trim();
-  if (home) env.OVLD_HOME = path23.resolve(home);
+  if (home) env.OVLD_HOME = path24.resolve(home);
   const token = process.env.OVERLORD_USER_TOKEN?.trim() || process.env.OVLD_USER_TOKEN?.trim();
   if (token) env.OVERLORD_USER_TOKEN = token;
   if (runAsElectronNode || process.env.ELECTRON_RUN_AS_NODE) env.ELECTRON_RUN_AS_NODE = "1";
@@ -8098,9 +8363,9 @@ ${envEntries}
   <key>KeepAlive</key>
   <true/>
   <key>StandardOutPath</key>
-  <string>${xmlEscape(path23.join(logDir, "runner-service.out.log"))}</string>
+  <string>${xmlEscape(path24.join(logDir, "runner-service.out.log"))}</string>
   <key>StandardErrorPath</key>
-  <string>${xmlEscape(path23.join(logDir, "runner-service.err.log"))}</string>
+  <string>${xmlEscape(path24.join(logDir, "runner-service.err.log"))}</string>
   <key>ProcessType</key>
   <string>Background</string>
 </dict>
@@ -8131,12 +8396,12 @@ WantedBy=default.target
 `;
 }
 function launchAgentsDir() {
-  return path23.join(os4.homedir(), "Library", "LaunchAgents");
+  return path24.join(os4.homedir(), "Library", "LaunchAgents");
 }
 function systemdUserDir() {
   const xdg = process.env.XDG_CONFIG_HOME?.trim();
-  const base = xdg ? path23.resolve(xdg) : path23.join(os4.homedir(), ".config");
-  return path23.join(base, "systemd", "user");
+  const base = xdg ? path24.resolve(xdg) : path24.join(os4.homedir(), ".config");
+  return path24.join(base, "systemd", "user");
 }
 async function runCommand(program, args) {
   const { stdout } = await execFileAsync(program, args);
@@ -8147,35 +8412,37 @@ function resolveServiceManager(platform2 = process.platform) {
   if (platform2 === "linux") return new SystemdUserManager();
   return null;
 }
-var execFileAsync, RUNNER_SERVICE_STATE_FILENAME, LAUNCHD_LABEL, SYSTEMD_UNIT_NAME, FAST_POLL_INTERVAL_MS, SLOW_POLL_INTERVAL_MS, IDLE_BACKOFF_MS, LaunchdManager, SystemdUserManager;
+var execFileAsync, RUNNER_SERVICE_STATE_FILENAME, RUNNER_FOCUS_STATE_FILENAME, LAUNCHD_LABEL, SYSTEMD_UNIT_NAME, FAST_POLL_INTERVAL_MS, SLOW_POLL_INTERVAL_MS, IDLE_BACKOFF_MS, DESKTOP_FOCUS_WINDOW_MS, LaunchdManager, SystemdUserManager;
 var init_runner_service = __esm({
   "src/runner-service.ts"() {
     "use strict";
     init_config();
     execFileAsync = promisify(execFile);
     RUNNER_SERVICE_STATE_FILENAME = "runner-service.json";
+    RUNNER_FOCUS_STATE_FILENAME = "runner-focus.json";
     LAUNCHD_LABEL = "io.overlord.runner";
     SYSTEMD_UNIT_NAME = "overlord-runner";
     FAST_POLL_INTERVAL_MS = 3e3;
-    SLOW_POLL_INTERVAL_MS = 1e4;
+    SLOW_POLL_INTERVAL_MS = 5e3;
     IDLE_BACKOFF_MS = 2 * 60 * 60 * 1e3;
+    DESKTOP_FOCUS_WINDOW_MS = 30 * 60 * 1e3;
     LaunchdManager = class {
       kind = "launchd";
       identifier = LAUNCHD_LABEL;
       unitPath() {
-        return path23.join(launchAgentsDir(), `${LAUNCHD_LABEL}.plist`);
+        return path24.join(launchAgentsDir(), `${LAUNCHD_LABEL}.plist`);
       }
       render(opts) {
         return renderLaunchdPlist({
           label: LAUNCHD_LABEL,
           invocation: opts.invocation,
           env: opts.env,
-          logDir: path23.join(resolveGlobalDataDir(), "logs")
+          logDir: path24.join(resolveGlobalDataDir(), "logs")
         });
       }
       async install(opts) {
         mkdirSync9(launchAgentsDir(), { recursive: true });
-        mkdirSync9(path23.join(resolveGlobalDataDir(), "logs"), { recursive: true });
+        mkdirSync9(path24.join(resolveGlobalDataDir(), "logs"), { recursive: true });
         writeServiceFile(this.unitPath(), this.render(opts));
         if (opts.autoStart) await this.start();
       }
@@ -8205,10 +8472,10 @@ var init_runner_service = __esm({
           await this.stop();
         } catch {
         }
-        if (existsSync19(this.unitPath())) rmSync4(this.unitPath());
+        if (existsSync20(this.unitPath())) rmSync4(this.unitPath());
       }
       async status() {
-        const installed = existsSync19(this.unitPath());
+        const installed = existsSync20(this.unitPath());
         try {
           const { stdout } = await runCommand("launchctl", ["list"]);
           const line = stdout.split("\n").find((row) => row.includes(LAUNCHD_LABEL));
@@ -8224,7 +8491,7 @@ var init_runner_service = __esm({
       kind = "systemd";
       identifier = `${SYSTEMD_UNIT_NAME}.service`;
       unitPath() {
-        return path23.join(systemdUserDir(), `${SYSTEMD_UNIT_NAME}.service`);
+        return path24.join(systemdUserDir(), `${SYSTEMD_UNIT_NAME}.service`);
       }
       render(opts) {
         return renderSystemdUnit(opts);
@@ -8251,14 +8518,14 @@ var init_runner_service = __esm({
           await runCommand("systemctl", ["--user", "disable", this.identifier]);
         } catch {
         }
-        if (existsSync19(this.unitPath())) rmSync4(this.unitPath());
+        if (existsSync20(this.unitPath())) rmSync4(this.unitPath());
         try {
           await runCommand("systemctl", ["--user", "daemon-reload"]);
         } catch {
         }
       }
       async status() {
-        const installed = existsSync19(this.unitPath());
+        const installed = existsSync20(this.unitPath());
         try {
           const { stdout } = await runCommand("systemctl", ["--user", "is-active", this.identifier]);
           return { installed, running: stdout.trim() === "active" ? "running" : "stopped" };
@@ -8325,14 +8592,14 @@ var init_select_prompt = __esm({
 
 // src/session-key.ts
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync20, mkdirSync as mkdirSync10, readFileSync as readFileSync15, rmSync as rmSync5, writeFileSync as writeFileSync9 } from "node:fs";
-import path24 from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync16, rmSync as rmSync5, writeFileSync as writeFileSync9 } from "node:fs";
+import path25 from "node:path";
 function sessionKeyCachePath({
   missionId,
   workingDirectory
 }) {
-  const key = createHash6("sha256").update(`${path24.resolve(workingDirectory)}\0${missionId}`).digest("hex");
-  return path24.join(resolveGlobalDataDir(), "protocol-session-keys", key);
+  const key = createHash6("sha256").update(`${path25.resolve(workingDirectory)}\0${missionId}`).digest("hex");
+  return path25.join(resolveGlobalDataDir(), "protocol-session-keys", key);
 }
 function readCachedSessionKey({
   missionId,
@@ -8340,8 +8607,8 @@ function readCachedSessionKey({
 }) {
   try {
     const filePath = sessionKeyCachePath({ missionId, workingDirectory });
-    if (!existsSync20(filePath)) return void 0;
-    const raw = JSON.parse(readFileSync15(filePath, "utf8"));
+    if (!existsSync21(filePath)) return void 0;
+    const raw = JSON.parse(readFileSync16(filePath, "utf8"));
     return typeof raw.sessionKey === "string" && raw.sessionKey.trim() ? raw.sessionKey.trim() : void 0;
   } catch {
     return void 0;
@@ -8356,7 +8623,7 @@ function writeCachedSessionKey({
     const trimmed = sessionKey.trim();
     if (!trimmed) return;
     const filePath = sessionKeyCachePath({ missionId, workingDirectory });
-    mkdirSync10(path24.dirname(filePath), { recursive: true });
+    mkdirSync10(path25.dirname(filePath), { recursive: true });
     writeFileSync9(
       filePath,
       JSON.stringify({ sessionKey: trimmed, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }),
@@ -8371,7 +8638,7 @@ function clearCachedSessionKey({
 }) {
   try {
     const filePath = sessionKeyCachePath({ missionId, workingDirectory });
-    if (existsSync20(filePath)) rmSync5(filePath);
+    if (existsSync21(filePath)) rmSync5(filePath);
   } catch {
   }
 }
@@ -8389,9 +8656,9 @@ __export(commands_exports, {
   runManagementCommand: () => runManagementCommand,
   runProtocolCommand: () => runProtocolCommand
 });
-import { existsSync as existsSync21, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync17 } from "node:fs";
 import os5 from "node:os";
-import path25 from "node:path";
+import path26 from "node:path";
 function writeProjectJsonFromResource({
   directory,
   projectId,
@@ -8425,7 +8692,7 @@ function readChangedFilesFromFlags(flags, stdin) {
   if (typeof fileFlag === "string") {
     const raw = fileFlag === "-" ? stdin ?? "" : (() => {
       try {
-        return readFileSync16(fileFlag, "utf8");
+        return readFileSync17(fileFlag, "utf8");
       } catch {
         return "";
       }
@@ -8477,7 +8744,7 @@ function readJsonFlagContent({
   if (typeof filePath === "string") {
     if (fileInputs[fileFlag] !== void 0) return fileInputs[fileFlag];
     try {
-      return readFileSync16(filePath, "utf8");
+      return readFileSync17(filePath, "utf8");
     } catch {
       return void 0;
     }
@@ -8768,7 +9035,7 @@ async function resolveProtocolFileInputs({
     } else if (process.stdin.isTTY) {
       stdinContent = "";
     } else {
-      stdinContent = readFileSync16(0, "utf8");
+      stdinContent = readFileSync17(0, "utf8");
     }
     return stdinContent;
   };
@@ -8782,7 +9049,7 @@ async function resolveProtocolFileInputs({
       fileInputs[flagName] = content;
       stdinPayload = content;
     } else {
-      fileInputs[flagName] = readFileSync16(filePath, "utf8");
+      fileInputs[flagName] = readFileSync17(filePath, "utf8");
     }
   }
   if (stdinPayload === void 0 && stdin !== void 0 && Object.keys(fileInputs).length === 0) {
@@ -8825,7 +9092,7 @@ async function runProtocolCommand({
   });
   if (subcommand === "record-touched") {
     const missionOverride = flagValue(parsed.flags, "--mission-id") ?? process.env.MISSION_ID ?? process.env.OVERLORD_MISSION_ID;
-    const rawPayload = stdin ?? (process.stdin.isTTY ? "" : readFileSync16(0, "utf8"));
+    const rawPayload = stdin ?? (process.stdin.isTTY ? "" : readFileSync17(0, "utf8"));
     const result2 = recordTouchedFromPayload({
       rawPayload,
       missionOverride,
@@ -8940,7 +9207,7 @@ async function runProtocolCommand({
   if (subcommand === "deliver" && missionId) {
     clearCachedSessionKey({ missionId, workingDirectory });
     removeActiveSession({ workingDirectory, missionId });
-    const connectorInstallsEditHook = existsSync21(path25.join(os5.homedir(), ".claude"));
+    const connectorInstallsEditHook = existsSync22(path26.join(os5.homedir(), ".claude"));
     if (connectorInstallsEditHook && !hasTouchedFilesLog({ workingDirectory, missionId }) && readChangedFiles(workingDirectory).length > 0) {
       const warning = `[overlord] warning: no touched-files log found at deliver for mission ${missionId} in ${workingDirectory}, even though this connector installs a PostToolUse edit hook. Deliver is falling back to baseline-only attribution, which can misattribute concurrent sessions' edits. Check ~/.ovld/logs/post-tool-use-hook.log for why the hook did not record any touched files.`;
       console.error(warning);
@@ -9031,7 +9298,7 @@ async function runManagementCommand({
     case "add-cwd": {
       const directory = flagValue(parsed.flags, "--directory") ?? process.cwd();
       const existingProjectJson = readProjectJsonLink(
-        path25.join(directory, ".overlord", "project.json")
+        path26.join(directory, ".overlord", "project.json")
       );
       const resourceKey = flagValue(parsed.flags, "--key") ?? existingProjectJson?.resourceKey;
       let projectId = flagValue(parsed.flags, "--project-id");
@@ -9266,13 +9533,13 @@ async function runManagementCommand({
         rationales: `/api/missions/${encodeURIComponent(missionId)}/file-changes`,
         deliveries: `/api/missions/${encodeURIComponent(missionId)}/events`
       };
-      const path26 = sub ? pathBySub[sub] : void 0;
-      if (!path26) {
+      const path27 = sub ? pathBySub[sub] : void 0;
+      if (!path27) {
         throw new CliError({
           message: "Usage: ovld mission context|events|deliveries|artifacts|rationales <missionId> [--json]"
         });
       }
-      const result = await runtime.backend.get(path26);
+      const result = await runtime.backend.get(path27);
       if (json || sub === "context") printJson(result);
       else if (Array.isArray(result)) for (const row of result) console.log(JSON.stringify(row));
       else printJson(result);
@@ -9468,8 +9735,10 @@ async function runRunnerSupervisor({
       lastError = error instanceof Error ? error.message : String(error);
     }
     const state = readRunnerServiceState();
+    const focus = readDesktopFocusState();
     const base = selectBasePollIntervalMs({
       lastLaunchedAt: launched ? now.toISOString() : state.lastLaunchedAt,
+      lastDesktopFocusAt: focus.lastFocusedAt,
       now: now.getTime()
     });
     patchRunnerServiceState({
@@ -9637,8 +9906,129 @@ var init_commands = __esm({
 });
 
 // src/index.ts
+init_args();
 init_errors();
 
+// src/flag-registry.ts
+init_errors();
+var GLOBAL_FLAGS = ["--json", "--help", "-h"];
+var LAUNCH_FLAGS = [
+  "--agent",
+  "--mission-id",
+  "--objective-id",
+  "--working-directory",
+  "--terminal",
+  "--no-terminal",
+  "--dry-run",
+  "--branch",
+  "--no-worktree",
+  "--model",
+  "--thinking",
+  "--flag",
+  "--pre-command"
+];
+var COMMAND_FLAGS = {
+  version: [],
+  update: ["--check", "--force", "--no-fund"],
+  serve: ["--host", "--port", "--db"],
+  init: [],
+  doctor: [],
+  setup: [],
+  "agent-setup": ["--dry-run", "--home"],
+  config: ["--path", "--url"],
+  auth: ["--token", "--organization-id"],
+  "user-token": ["--label", "--expires-in", "--no-expiry", "--scope", "--id"],
+  prune: [],
+  "create-project": ["--name", "--directory", "--no-directory"],
+  "org-setup": [
+    "--org-name",
+    "--workspace-name",
+    "--workspace-slug",
+    "--logo",
+    "--no-input",
+    "--if-needed"
+  ],
+  "add-cwd": ["--directory", "--key", "--project-id", "--primary"],
+  "add-url": ["--url", "--project-id", "--key", "--primary"],
+  create: ["--objectives-json", "--objective", "--prompt", "--project-id", "--title", "--resource"],
+  prompt: [
+    "--objectives-json",
+    "--objective",
+    "--prompt",
+    "--project-id",
+    "--title",
+    "--resource",
+    "--agent"
+  ],
+  attach: ["--mission-id", "--agent", "--objective-id", "--model", "--thinking"],
+  execution: ["--mission-id", "--agent", "--objective-id", "--model", "--thinking"],
+  launch: LAUNCH_FLAGS,
+  restart: LAUNCH_FLAGS,
+  run: LAUNCH_FLAGS,
+  connect: LAUNCH_FLAGS,
+  resume: LAUNCH_FLAGS,
+  runner: [
+    "--project-id",
+    "--poll-interval-ms",
+    "--dry-run",
+    "--branch",
+    "--no-worktree",
+    "--terminal",
+    "--no-terminal",
+    "--no-start"
+  ],
+  missions: ["--status", "--query", "--project-id", "--limit"],
+  mission: [],
+  changes: ["--mission-id", "--objective-id"]
+};
+function editDistance(a, b) {
+  let prev = Array.from({ length: b.length + 1 }, (_unused, j) => j);
+  for (let i = 1; i <= a.length; i += 1) {
+    const curr = new Array(b.length + 1);
+    curr[0] = i;
+    for (let j = 1; j <= b.length; j += 1) {
+      const cost = a.charAt(i - 1) === b.charAt(j - 1) ? 0 : 1;
+      curr[j] = Math.min((curr[j - 1] ?? 0) + 1, (prev[j] ?? 0) + 1, (prev[j - 1] ?? 0) + cost);
+    }
+    prev = curr;
+  }
+  return prev[b.length] ?? 0;
+}
+function suggestFlag(unknown, allowed) {
+  let best;
+  let bestDistance = Infinity;
+  for (const candidate of allowed) {
+    const distance = editDistance(unknown, candidate);
+    if (distance < bestDistance) {
+      bestDistance = distance;
+      best = candidate;
+    }
+  }
+  const threshold = Math.max(2, Math.floor(unknown.length / 3));
+  return best !== void 0 && bestDistance <= threshold ? best : void 0;
+}
+function assertKnownFlags({
+  command,
+  flags,
+  primaryCommand
+}) {
+  const allowed = COMMAND_FLAGS[command];
+  if (!allowed) return;
+  const allowedSet = /* @__PURE__ */ new Set([...GLOBAL_FLAGS, ...allowed]);
+  const unknown = [...flags.keys()].filter((flag) => flag.startsWith("--") && !allowedSet.has(flag));
+  if (unknown.length === 0) return;
+  const suggestionPool = [...GLOBAL_FLAGS, ...allowed];
+  const details = unknown.map((flag) => {
+    const suggestion = suggestFlag(flag, suggestionPool);
+    return suggestion ? `${flag} (did you mean ${suggestion}?)` : flag;
+  }).join(", ");
+  const label = unknown.length === 1 ? "Unknown flag" : "Unknown flags";
+  throw new CliError({
+    message: `${label} for \`${primaryCommand} ${command}\`: ${details}
+Run \`${primaryCommand} help\` for usage.`
+  });
+}
+
 // src/help.ts
 function printHelp({ primaryCommand }) {
   console.log(`Overlord CLI
@@ -9663,6 +10053,8 @@ General:
   ${primaryCommand} serve [--host <h>] [--port <p>] [--db <path>] [--json]
                                                  Boot the web/REST server (creates + migrates the DB on first run)
   ${primaryCommand} doctor [--json]              Validate backend and connector installs
+  ${primaryCommand} contract check <manifest-path> [--json]
+                                                 Validate a conformance-manifest.yaml against the contract schema
   ${primaryCommand} prune [--json]               Delete the contents of .overlord/tmp in the current directory
   ${primaryCommand} config list [--json]         Show local configuration
   ${primaryCommand} config set                   Choose local/cloud backend interactively
@@ -9750,7 +10142,8 @@ var DB_FREE_COMMANDS = /* @__PURE__ */ new Set([
   "config",
   "auth",
   "user-token",
-  "prune"
+  "prune",
+  "contract"
 ]);
 var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   ...DB_FREE_COMMANDS,
@@ -9791,6 +10184,9 @@ async function dispatchCommand({
   args,
   stdin
 }) {
+  if (command !== void 0) {
+    assertKnownFlags({ command, flags: parseArgs(args).flags, primaryCommand });
+  }
   switch (command) {
     case void 0:
     case "help":
@@ -9825,6 +10221,15 @@ async function dispatchCommand({
       await runServeCommand2({ rest: args });
       return;
     }
+    case "contract": {
+      const [subcommand, ...rest] = args;
+      if (!subcommand) {
+        throw new CliError({ message: "Usage: ovld contract <subcommand> [flags]" });
+      }
+      const { runContractCommand: runContractCommand2 } = await Promise.resolve().then(() => (init_contract(), contract_exports));
+      await runContractCommand2({ subcommand, args: rest, primaryCommand });
+      return;
+    }
     case "protocol": {
       const [subcommand, ...rest] = args;
       if (!subcommand) {