usebeeline 0.0.37 → 0.0.44

package/dist/usebeeline.mjs

@@ -307,14 +307,14 @@ __export(self_update_exports, {
   writeUpdateAttemptFixture: () => writeUpdateAttemptFixture,
   writeUpdateState: () => writeUpdateState
 });
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
-import { access, chmod as chmod3, lstat as lstat2, mkdir as mkdir9, open, readFile as readFile4, rename as rename3, rm as rm4, symlink as symlink2, writeFile as writeFile6 } from "node:fs/promises";
+import { access, chmod as chmod3, lstat as lstat2, mkdir as mkdir10, open, readFile as readFile8, rename as rename3, rm as rm4, symlink as symlink2, writeFile as writeFile8 } from "node:fs/promises";
 import { spawn as spawn4 } from "node:child_process";
 import { homedir as homedir9 } from "node:os";
-import { dirname as dirname8, join as join6, resolve as resolve14 } from "node:path";
+import { dirname as dirname9, join as join6, resolve as resolve18 } from "node:path";
 function anchorLayout(rawLibDir) {
-  const libDir = resolve14(rawLibDir);
+  const libDir = resolve18(rawLibDir);
   const segments = libDir.split(/[/\\]/);
   const idx = segments.lastIndexOf(RELEASES_SEGMENT);
   if (idx >= 2 && segments[idx - 1] === "lib") {
@@ -330,9 +330,9 @@ function anchorLayout(rawLibDir) {
     // prefix's bin, NOT <prefix>/lib/bin — deriving it one level up was the
     // defect that made activateRelease write its stable forwarders where
     // nothing executed them, leaving stale raw wrappers in <prefix>/bin.
-    binDir: resolve14(libDir, "../../bin"),
+    binDir: resolve18(libDir, "../../bin"),
     libDir,
-    releasesRoot: resolve14(libDir, `../${RELEASES_SEGMENT}`)
+    releasesRoot: resolve18(libDir, `../${RELEASES_SEGMENT}`)
   };
 }
 function beelineInstallLayout(env = process.env) {
@@ -343,7 +343,7 @@ function beelineInstallLayout(env = process.env) {
 }
 function defaultBeelineInstallLayout(env = process.env) {
   const home = env.HOME?.trim() || homedir9();
-  return anchorLayout(resolve14(home, ".local", "lib", "beeline"));
+  return anchorLayout(resolve18(home, ".local", "lib", "beeline"));
 }
 function hostPlatformKey() {
   const os = process.platform === "linux" ? "linux" : process.platform === "darwin" ? "darwin" : "";
@@ -359,7 +359,7 @@ async function readBundleJson(bundleDir) {
   let raw;
   for (const candidate of bundleJsonCandidates(bundleDir)) {
     try {
-      raw = await readFile4(candidate, "utf8");
+      raw = await readFile8(candidate, "utf8");
       break;
     } catch {
     }
@@ -381,14 +381,14 @@ function updateStatePath(layout) {
 }
 async function readUpdateState(layout) {
   try {
-    return JSON.parse(await readFile4(updateStatePath(layout), "utf8"));
+    return JSON.parse(await readFile8(updateStatePath(layout), "utf8"));
   } catch {
     return {};
   }
 }
 async function writeUpdateState(layout, state) {
-  await mkdir9(join6(layout.releasesRoot, ".state"), { recursive: true });
-  await writeFile6(updateStatePath(layout), `${JSON.stringify(state, null, 2)}
+  await mkdir10(join6(layout.releasesRoot, ".state"), { recursive: true });
+  await writeFile8(updateStatePath(layout), `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
 async function readInstalledBundleIdentity(layout, _state = {}) {
@@ -489,29 +489,29 @@ function requiredBundlePaths() {
 }
 async function stageRelease(layout, manifestUrl, published, opts = {}) {
   const fetchImpl = opts.fetchImpl ?? fetch;
-  const log = opts.logger ?? ((line) => console.log(`[body] self-update: ${line}`));
+  const log2 = opts.logger ?? ((line) => console.log(`[body] self-update: ${line}`));
   const releaseId = sanitizeReleaseId(published.commit ?? published.version ?? `release-${Date.now()}`);
   const releaseDir = join6(layout.releasesRoot, releaseId);
   const okMarker = join6(releaseDir, ".stage-ok");
   let previouslyVerified = false;
   try {
-    const recorded = await readFile4(okMarker, "utf8");
+    const recorded = await readFile8(okMarker, "utf8");
     if (recorded.trim() === published.sha256)
       return releaseId;
     previouslyVerified = true;
   } catch {
   }
-  await mkdir9(releaseDir, { recursive: true });
+  await mkdir10(releaseDir, { recursive: true });
   const tempArchive = join6(layout.releasesRoot, `.download-${releaseId}-${process.pid}.tar.gz`);
   try {
-    log(`downloading ${published.file}`);
+    log2(`downloading ${published.file}`);
     const response = await fetchImpl(archiveUrlFor(manifestUrl, published.file), {
       signal: AbortSignal.timeout(10 * 6e4)
     });
     if (!response.ok || !response.body) {
       throw new Error(`downloading ${published.file} failed: HTTP ${response.status}`);
     }
-    const hash = createHash2("sha256");
+    const hash = createHash3("sha256");
     const chunks = [];
     for await (const chunk of response.body) {
       const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
@@ -522,7 +522,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
     if (actual !== published.sha256.toLowerCase()) {
       throw new Error(`checksum mismatch for ${published.file}: expected ${published.sha256}, got ${actual} \u2014 aborting without touching the installed bundle`);
     }
-    await writeFile6(tempArchive, Buffer.concat(chunks), { mode: 384 });
+    await writeFile8(tempArchive, Buffer.concat(chunks), { mode: 384 });
     const entries = (await new Promise((resolveList, rejectList) => {
       const child = spawn4("tar", ["-tzf", tempArchive], { stdio: ["ignore", "pipe", "inherit"] });
       let out = "";
@@ -553,9 +553,9 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
         throw new Error(`staged bundle failed its startup smoke test (--version exited ${probe.status})${probe.stderr ? `: ${probe.stderr.trim()}` : ""}`);
       }
     }
-    await writeFile6(okMarker, `${published.sha256}
+    await writeFile8(okMarker, `${published.sha256}
 `, "utf8");
-    log(`staged release ${releaseId} (sha256 verified)`);
+    log2(`staged release ${releaseId} (sha256 verified)`);
     return releaseId;
   } catch (error) {
     if (!previouslyVerified)
@@ -581,15 +581,15 @@ function forwarderScript(tool) {
 }
 async function replaceFile(path, contents, mode) {
   const temp = `${path}.new-${process.pid}`;
-  await writeFile6(temp, contents, { mode });
+  await writeFile8(temp, contents, { mode });
   await chmod3(temp, mode);
   await rename3(temp, path);
 }
 async function activateRelease(layout, releaseId) {
   const releaseDir = join6(layout.releasesRoot, releaseId);
   await access(join6(releaseDir, BUNDLE_ENTRYPOINT), fsConstants.F_OK);
-  await mkdir9(layout.releasesRoot, { recursive: true });
-  await mkdir9(layout.binDir, { recursive: true });
+  await mkdir10(layout.releasesRoot, { recursive: true });
+  await mkdir10(layout.binDir, { recursive: true });
   let previousReleaseId = await activeReleaseId(layout);
   const kind = await pathKind(layout.libDir);
   if (kind === "directory") {
@@ -611,7 +611,7 @@ async function activateRelease(layout, releaseId) {
   await rm4(tempLink, { force: true });
   await symlink2(join6("beeline-releases", releaseId), tempLink);
   await rename3(tempLink, layout.libDir);
-  await fsyncDir(dirname8(layout.libDir));
+  await fsyncDir(dirname9(layout.libDir));
   await writeBinForwarders(layout, releaseDir);
   return { previousReleaseId };
 }
@@ -628,7 +628,7 @@ async function normalizeLegacyBundleShape(bundleDir) {
   }
   if (!anyFlat)
     return;
-  await mkdir9(innerLib, { recursive: true });
+  await mkdir10(innerLib, { recursive: true });
   for (const name of LEGACY_FLAT_BUNDLE_FILES) {
     try {
       await access(join6(innerLib, name), fsConstants.F_OK);
@@ -655,13 +655,13 @@ async function repairInstallForwarders(layout, opts = {}) {
   const forwarderPath = join6(layout.binDir, "beeline");
   let current;
   try {
-    current = await readFile4(forwarderPath, "utf8");
+    current = await readFile8(forwarderPath, "utf8");
   } catch {
     current = void 0;
   }
   if (current === forwarderScript("beeline"))
     return false;
-  await mkdir9(layout.binDir, { recursive: true });
+  await mkdir10(layout.binDir, { recursive: true });
   await writeBinForwarders(layout, layout.libDir);
   opts.logger?.(`[body] self-update: repaired <prefix>/bin forwarders to follow the active-bundle anchor (${layout.libDir})`);
   return true;
@@ -676,14 +676,14 @@ async function rollbackToPreviousRelease(layout, previousReleaseId) {
   await rm4(tempLink, { force: true });
   await symlink2(join6("beeline-releases", previousReleaseId), tempLink);
   await rename3(tempLink, layout.libDir);
-  await fsyncDir(dirname8(layout.libDir));
+  await fsyncDir(dirname9(layout.libDir));
 }
 function updateAttemptPath(layout) {
   return join6(layout.releasesRoot, ".state", "update-attempt.json");
 }
 async function readUpdateAttempt(layout) {
   try {
-    const raw = JSON.parse(await readFile4(updateAttemptPath(layout), "utf8"));
+    const raw = JSON.parse(await readFile8(updateAttemptPath(layout), "utf8"));
     if (raw.version !== 1 || typeof raw.appliedAt !== "number" || typeof raw.confirmBy !== "number" || typeof raw.releaseId !== "string" || !["pending", "confirmed", "reverted"].includes(raw.status)) {
       return void 0;
     }
@@ -693,10 +693,10 @@ async function readUpdateAttempt(layout) {
   }
 }
 async function writeUpdateAttempt(layout, record2) {
-  await mkdir9(join6(layout.releasesRoot, ".state"), { recursive: true });
+  await mkdir10(join6(layout.releasesRoot, ".state"), { recursive: true });
   const path = updateAttemptPath(layout);
   const staged = `${path}.${process.pid}.tmp`;
-  await writeFile6(staged, `${JSON.stringify(record2, null, 2)}
+  await writeFile8(staged, `${JSON.stringify(record2, null, 2)}
 `, { mode: 384 });
   await rename3(staged, path);
 }
@@ -955,8 +955,8 @@ var init_self_update = __esm({
 });
 
 // apps/body/dist/cli.js
-import { dirname as dirname13, resolve as resolve21 } from "node:path";
-import { readFile as readFile9, unlink as unlink3, writeFile as writeFile12 } from "node:fs/promises";
+import { dirname as dirname15, resolve as resolve25 } from "node:path";
+import { readFile as readFile13, unlink as unlink3, writeFile as writeFile14 } from "node:fs/promises";
 import { stdin as stdin4, stdout as stdout5 } from "node:process";
 
 // node_modules/@clack/core/dist/index.mjs
@@ -2057,6 +2057,49 @@ var MULTISELECT_INSTRUCTIONS = [
   `${styleText2("dim", "Space:")} select`,
   `${styleText2("dim", "Enter:")} confirm`
 ];
+var log = {
+  message: (s = [], {
+    symbol: e = styleText2("gray", S_BAR),
+    secondarySymbol: r2 = styleText2("gray", S_BAR),
+    output: m2 = process.stdout,
+    spacing: l2 = 1,
+    withGuide: c2
+  } = {}) => {
+    const t2 = [], o = c2 ?? settings.withGuide, f = o ? r2 : "", O = o ? `${e}  ` : "", u4 = o ? `${r2}  ` : "";
+    for (let i3 = 0; i3 < l2; i3++)
+      t2.push(f);
+    const g2 = Array.isArray(s) ? s : s.split(`
+`);
+    if (g2.length > 0) {
+      const [i3, ...y] = g2;
+      i3.length > 0 ? t2.push(`${O}${i3}`) : t2.push(o ? e : "");
+      for (const p of y)
+        p.length > 0 ? t2.push(`${u4}${p}`) : t2.push(o ? r2 : "");
+    }
+    m2.write(`${t2.join(`
+`)}
+`);
+  },
+  info: (s, e) => {
+    log.message(s, { ...e, symbol: styleText2("blue", S_INFO) });
+  },
+  success: (s, e) => {
+    log.message(s, { ...e, symbol: styleText2("green", S_SUCCESS) });
+  },
+  step: (s, e) => {
+    log.message(s, { ...e, symbol: styleText2("green", S_STEP_SUBMIT) });
+  },
+  warn: (s, e) => {
+    log.message(s, { ...e, symbol: styleText2("yellow", S_WARN) });
+  },
+  /** alias for `log.warn()`. */
+  warning: (s, e) => {
+    log.warn(s, e);
+  },
+  error: (s, e) => {
+    log.message(s, { ...e, symbol: styleText2("red", S_ERROR) });
+  }
+};
 var cancel = (o = "", t2) => {
   const i3 = t2?.output ?? process.stdout, e = t2?.withGuide ?? settings.withGuide ? `${styleText2("gray", S_BAR_END)}  ` : "";
   i3.write(`${e}${styleText2("red", o)}
@@ -3099,6 +3142,9 @@ function agentMessageChunkText(update) {
 }
 var CHUNK_CONTINUES_PREVIOUS_WORD = /^[\s'\u2018\u2019\u02bc.,!?;:%)\]}-]/;
 var PI_ACP_HARNESS = /(^|[/\\])pi-acp(?:\.[a-z]+)?$/i;
+function isPiAcpHarness(agentLabel) {
+  return Boolean(agentLabel && PI_ACP_HARNESS.test(agentLabel));
+}
 function withoutOneTrailingLineEnding(text2) {
   if (/\r?\n\r?\n$/.test(text2))
     return text2;
@@ -3166,6 +3212,19 @@ function finalAgentMessageText(updates, agentLabel) {
     return "";
   return last;
 }
+function describeEmptyTurn(result, agentLabel) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const { update } of result.updates) {
+    const kind = typeof update.sessionUpdate === "string" ? update.sessionUpdate : "unknown";
+    if (kind === "session_info_update" || kind === "available_commands_update")
+      continue;
+    counts.set(kind, (counts.get(kind) ?? 0) + 1);
+  }
+  const stream = counts.size ? `the stream carried only ${[...counts].map(([kind, count]) => `${kind}\xD7${count}`).join(", ")}` : "the stream carried no content updates";
+  const lastRun = agentMessageRuns(result.updates, agentLabel).at(-1);
+  const narration = lastRun && isPureRetryNarration(lastRun) ? `; the last message was retry narration "${lastRun.trim().slice(0, 80)}"` : "";
+  return `harness ended the turn (${result.stopReason}) with no answer text; ${stream}${narration}`;
+}
 function updateText(update) {
   const content = update.content;
   if (typeof content === "string")
@@ -3186,7 +3245,7 @@ var THOUGHT_UPDATE_TYPES = /* @__PURE__ */ new Set([
 ]);
 function agentStreamSnapshot(updates, agentLabel) {
   const completedMessages = [];
-  let messageText = "";
+  let messageText2 = "";
   let lastWasMessage = false;
   let thoughtText = "";
   let thoughtRunOpen = false;
@@ -3196,20 +3255,20 @@ function agentStreamSnapshot(updates, agentLabel) {
       const delta = normalizeStreamDelta(agentMessageChunkText(update), agentLabel);
       if (!delta)
         continue;
-      if (!lastWasMessage && messageText && !/\s$/.test(messageText) && !CHUNK_CONTINUES_PREVIOUS_WORD.test(delta)) {
-        if (!completedMessages.includes(messageText))
-          completedMessages.push(messageText);
-        messageText = "";
+      if (!lastWasMessage && messageText2 && !/\s$/.test(messageText2) && !CHUNK_CONTINUES_PREVIOUS_WORD.test(delta)) {
+        if (!completedMessages.includes(messageText2))
+          completedMessages.push(messageText2);
+        messageText2 = "";
       }
-      messageText += delta;
+      messageText2 += delta;
       lastWasMessage = true;
       thoughtRunOpen = false;
       continue;
     }
-    if (lastWasMessage && messageText) {
-      if (!completedMessages.includes(messageText))
-        completedMessages.push(messageText);
-      messageText = "";
+    if (lastWasMessage && messageText2) {
+      if (!completedMessages.includes(messageText2))
+        completedMessages.push(messageText2);
+      messageText2 = "";
     }
     lastWasMessage = false;
     if (THOUGHT_UPDATE_TYPES.has(kind)) {
@@ -3225,7 +3284,7 @@ function agentStreamSnapshot(updates, agentLabel) {
     }
   }
   return {
-    messageText,
+    messageText: messageText2,
     ...thoughtText || completedMessages.length ? { thoughtText: thoughtText || completedMessages.at(-1) } : {}
   };
 }
@@ -3720,7 +3779,7 @@ var AcpClient = class extends EventEmitter {
     const current = this.activeRunIds.get(sessionId);
     if (current)
       return Promise.resolve(current);
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve26, reject) => {
       const onUpdate = (update) => {
         if (update.sessionId !== sessionId)
           return;
@@ -3728,7 +3787,7 @@ var AcpClient = class extends EventEmitter {
         if (!runId)
           return;
         cleanup();
-        resolve22(runId);
+        resolve26(runId);
       };
       const timer = setTimeout(() => {
         cleanup();
@@ -3748,23 +3807,23 @@ var AcpClient = class extends EventEmitter {
     const tracked = metadataKey ? this.toolCallMetadata.get(metadataKey) : void 0;
     if (tracked)
       p.toolCall = { ...tracked, ...p.toolCall };
-    let decision = this.autoApprove ? "allow" : "reject";
+    let decision2 = this.autoApprove ? "allow" : "reject";
     if (!this.autoApprove && this.permissionAllowlist) {
       try {
-        decision = this.permissionAllowlist(p) ? "allow" : "reject";
+        decision2 = this.permissionAllowlist(p) ? "allow" : "reject";
       } catch (error) {
         this.emit("permission/error", error);
-        decision = "reject";
+        decision2 = "reject";
       }
     } else if (this.permissionHandler) {
       try {
-        decision = await this.permissionHandler(p);
+        decision2 = await this.permissionHandler(p);
       } catch (error) {
         this.emit("permission/error", error);
-        decision = "reject";
+        decision2 = "reject";
       }
     }
-    if (decision === "allow") {
+    if (decision2 === "allow") {
       const allow = p?.options?.find((o) => o.kind === "allow_once" || o.kind === "allow_always") ?? p?.options?.[0];
       if (allow?.optionId) {
         if (metadataKey)
@@ -3812,13 +3871,13 @@ var AcpClient = class extends EventEmitter {
     }
     const id = this.nextId++;
     const payload = { jsonrpc: "2.0", id, method, params };
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve26, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         reject(new AcpRequestTimeoutError(method, timeoutMs, this.stderrTail, Boolean(onStart)));
       }, timeoutMs);
       this.pending.set(id, {
-        resolve: resolve22,
+        resolve: resolve26,
         reject,
         timer,
         method,
@@ -4157,12 +4216,25 @@ async function applyAgentModelSelection(client, sessionId, advertisedOptions, se
 }
 
 // apps/body/dist/model-catalog.js
+function modelCatalogProbeEnvironment(agent, agentEnv, scratchCwd) {
+  if (agent.kind !== "goose")
+    return agentEnv;
+  return {
+    ...agentEnv,
+    GOOSE_PATH_ROOT: resolve4(scratchCwd, "goose")
+  };
+}
+function filterAgentModelCatalog(agent, raw, agentEnv) {
+  const allowed = filterAllowedModelConfigOptions(raw);
+  return agent.kind === "goose" ? allowed : filterModelOptionsByCredentials(allowed, agentEnv);
+}
 async function withAgentModelCatalog(agent, agentEnv, selection, inspect) {
   const scratchCwd = await mkdtemp(resolve4(tmpdir(), "beeline-pair-model-check-"));
+  const probeEnv = modelCatalogProbeEnvironment(agent, agentEnv, scratchCwd);
   const client = new AcpClient({
     agentCommand: agent.command,
     agentArgs: agentArgsWithModelSelection(agent, selection),
-    agentEnv,
+    agentEnv: probeEnv,
     agentCwd: scratchCwd,
     // The wizard probe runs on the human's own machine for a few seconds —
     // inherit the caller's environment so harness launchers resolve (`pi`,
@@ -4175,7 +4247,7 @@ async function withAgentModelCatalog(agent, agentEnv, selection, inspect) {
     await client.start();
     const { sessionId, raw: sessionRaw } = await client.sessionNew({ cwd: scratchCwd });
     const raw = parseAdvertisedConfigOptions(sessionRaw, selection?.model, isGrokAgentCommand(agent));
-    const catalog = filterModelOptionsByCredentials(filterAllowedModelConfigOptions(raw), agentEnv);
+    const catalog = filterAgentModelCatalog(agent, raw, probeEnv);
     return await inspect({ client, sessionId, raw, catalog });
   } finally {
     await client.stop().catch(() => void 0);
@@ -4236,31 +4308,433 @@ async function applyRuntimeModelPreflight(config, agent, selection, validate = v
   config.modelUnavailable = await revalidateRuntimeModelSelection(agent, config.agentEnv, selection, validate);
 }
 
-// apps/body/dist/room-runtime.js
-import { execFile as execFile3 } from "node:child_process";
+// apps/body/dist/model-catalog-sync.js
 import { createHash } from "node:crypto";
+import { readFile, writeFile } from "node:fs/promises";
+import { resolve as resolve5 } from "node:path";
+var MODEL_CATALOG_PROBE_TIMEOUT_MS = 3e4;
+var MODEL_CATALOG_HASH_FILE = "model-catalog.sha256";
+function modelCatalogHash(options, selection) {
+  return createHash("sha256").update(JSON.stringify({ options, selection: selection ?? null })).digest("hex");
+}
+async function withTimeout(work, timeoutMs, what) {
+  let timer;
+  const expiry = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`${what} timed out after ${timeoutMs}ms`)), timeoutMs);
+  });
+  try {
+    return await Promise.race([work, expiry]);
+  } finally {
+    clearTimeout(timer);
+    work.catch(() => void 0);
+  }
+}
+async function syncAgentModelCatalog(input) {
+  const log2 = input.log ?? ((line) => console.log(line));
+  const fetchCatalog = input.fetchCatalog ?? fetchAgentModelCatalog;
+  const hashPath = resolve5(input.runtimeDir, MODEL_CATALOG_HASH_FILE);
+  try {
+    const configuration = await input.api.execute("getAgentConfiguration", {
+      agentId: input.agentId
+    });
+    const selection = configuration.model || configuration.effort ? {
+      ...configuration.model ? { model: configuration.model } : {},
+      ...configuration.effort ? { effort: configuration.effort } : {}
+    } : input.runtimeSelection;
+    const { catalog } = await withTimeout(fetchCatalog(input.agent, input.agentEnv, selection), input.timeoutMs ?? MODEL_CATALOG_PROBE_TIMEOUT_MS, "model catalog probe");
+    const hash = modelCatalogHash(catalog, selection);
+    const previous = await readFile(hashPath, "utf8").catch(() => "");
+    if (previous.trim() === hash)
+      return "unchanged";
+    await input.api.execute("postAgentModelCatalog", {
+      agentId: input.agentId,
+      workspaceId: input.workspaceId,
+      // `fetchAgentModelCatalog` already applied the category allow-list.
+      options: catalog,
+      ...selection ? { selection } : {}
+    });
+    await writeFile(hashPath, `${hash}
+`, { mode: 384 });
+    log2(`[body] model catalog posted: ${catalog.length} axis(es)` + (selection?.model ? `, model ${selection.model}` : "") + (selection?.effort ? `, effort ${selection.effort}` : ""));
+    return "posted";
+  } catch (error) {
+    log2(`[body] model catalog not posted this activation: ${error instanceof Error ? error.message : String(error)}`);
+    return "failed";
+  }
+}
+
+// apps/body/dist/room-runtime.js
+import { execFile as execFile4 } from "node:child_process";
+import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync4, mkdirSync } from "node:fs";
-import { mkdir as mkdir6, rm as rm3 } from "node:fs/promises";
-import { dirname as dirname4, resolve as resolve10 } from "node:path";
+import { mkdir as mkdir8, rm as rm3 } from "node:fs/promises";
+import { dirname as dirname6, resolve as resolve15 } from "node:path";
 import { promisify as promisify3 } from "node:util";
 
+// apps/body/dist/grant-runner.js
+import { execFile } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { readFile as readFile3 } from "node:fs/promises";
+import { createServer } from "node:http";
+import { dirname as dirname3, resolve as resolve7 } from "node:path";
+
+// packages/api-contract/dist/agent-grants.js
+var AGENT_GRANT_KINDS = ["path", "host", "secret", "device", "budget", "command"];
+var SHELL_METACHARACTERS = /[;&|<>$`\\'"(){}\n\r\t*?[\]~#!]/;
+var SECRET_NAME = /^[A-Z][A-Z0-9_]{0,63}$/;
+function parseCommandGrantTarget(target) {
+  if (typeof target !== "string" || !target.trim()) {
+    throw new Error("command target is required");
+  }
+  if (target !== target.trim() || /\s{2,}/.test(target)) {
+    throw new Error("command target must be one line with single spaces");
+  }
+  if (SHELL_METACHARACTERS.test(target)) {
+    throw new Error("command target must not contain shell metacharacters");
+  }
+  const words = target.split(" ");
+  const argv = [];
+  const secrets = [];
+  for (let index = 0; index < words.length; index += 1) {
+    const word = words[index];
+    if (word === "--with") {
+      const name = words[index + 1];
+      if (!name || !SECRET_NAME.test(name)) {
+        throw new Error("--with must name one UPPER_CASE secret");
+      }
+      if (!secrets.includes(name))
+        secrets.push(name);
+      index += 1;
+      continue;
+    }
+    if (secrets.length)
+      throw new Error("--with suffixes must come after the command words");
+    argv.push(word);
+  }
+  if (!argv.length)
+    throw new Error("command target must name a command");
+  return { argv, secrets };
+}
+function commandGrantMatches(rule, requested) {
+  if (requested.length < rule.argv.length)
+    return false;
+  return rule.argv.every((word, index) => requested[index] === word);
+}
+var DECISION_LINE = new RegExp(`^(.+?) (approved once|approved|declined) (${AGENT_GRANT_KINDS.join("|")}) (.+)$`, "s");
+function parseGrantDecisionLine(body) {
+  const match = DECISION_LINE.exec(body);
+  if (!match)
+    return void 0;
+  const decision2 = match[2] === "approved once" ? "once" : match[2] === "approved" ? "always" : "deny";
+  return {
+    deciderName: match[1],
+    decision: decision2,
+    kind: match[3],
+    target: match[4]
+  };
+}
+
+// apps/body/dist/provider-key-store.js
+import { chmod, mkdir, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname2, resolve as resolve6 } from "node:path";
+var PROVIDER_KEY_ENV_VARS = {
+  openrouter: "OPENROUTER_API_KEY",
+  openai: "OPENAI_API_KEY",
+  anthropic: "ANTHROPIC_API_KEY",
+  google: "GOOGLE_API_KEY",
+  xai: "XAI_API_KEY"
+};
+var GOOGLE_ENV_ALIAS = "GEMINI_API_KEY";
+function providerKeyStorePath(env = process.env) {
+  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve6(homedir2(), ".config");
+  return resolve6(configRoot, "beeline", "providers.json");
+}
+async function readProviderKeyStore(env = process.env) {
+  const path = providerKeyStorePath(env);
+  const raw = await readFile2(path, "utf8").catch(() => void 0);
+  if (!raw)
+    return {};
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      return {};
+    const entries = Object.entries(parsed).filter((entry) => entry[0] in PROVIDER_KEY_ENV_VARS && typeof entry[1] === "string" && entry[1].length > 0);
+    return Object.fromEntries(entries);
+  } catch {
+    return {};
+  }
+}
+async function readSavedProviderKey(provider, env = process.env) {
+  return (await readProviderKeyStore(env))[provider];
+}
+async function saveProviderKey(provider, key, env = process.env) {
+  const path = providerKeyStorePath(env);
+  const store = { ...await readProviderKeyStore(env), [provider]: key };
+  await mkdir(dirname2(path), { recursive: true, mode: 448 });
+  await writeFile2(path, `${JSON.stringify(store, null, 2)}
+`, { mode: 384 });
+  await chmod(path, 384);
+}
+function providerKeyFromEnvironment(provider, env = process.env) {
+  const primary = env[PROVIDER_KEY_ENV_VARS[provider]]?.trim();
+  if (primary)
+    return primary;
+  if (provider === "google")
+    return env[GOOGLE_ENV_ALIAS]?.trim() || void 0;
+  return void 0;
+}
+function maskProviderKey(key) {
+  const trimmed = key.trim();
+  if (trimmed.length <= 9)
+    return "\u2026";
+  return `${trimmed.slice(0, 6)}\u2026${trimmed.slice(-3)}`;
+}
+
+// apps/body/dist/grant-runner.js
+var GRANT_COMMAND_TIMEOUT_MS = 10 * 6e4;
+var GRANT_COMMAND_OUTPUT_CAP_BYTES = 64 * 1024;
+var ARGV_MAX_WORDS = 256;
+var ARGV_WORD_MAX_LENGTH = 4096;
+function operatorSecretResolver(env = process.env) {
+  const providerByEnvVar = new Map(Object.entries(PROVIDER_KEY_ENV_VARS).map(([provider, envVar]) => [envVar, provider]));
+  return async (name) => {
+    const provider = providerByEnvVar.get(name);
+    if (provider) {
+      const saved = (await readProviderKeyStore(env))[provider];
+      if (saved)
+        return saved;
+    }
+    const raw = await readFile3(resolve7(dirname3(providerKeyStorePath(env)), "secrets.json"), "utf8").catch(() => void 0);
+    if (!raw)
+      return void 0;
+    try {
+      const parsed = JSON.parse(raw);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return void 0;
+      const value = parsed[name];
+      return typeof value === "string" && value.length > 0 ? value : void 0;
+    } catch {
+      return void 0;
+    }
+  };
+}
+function validateGrantArgv(value) {
+  if (!Array.isArray(value) || value.length === 0)
+    throw new Error("argv must be a non-empty array");
+  if (value.length > ARGV_MAX_WORDS)
+    throw new Error(`argv exceeds ${ARGV_MAX_WORDS} words`);
+  return value.map((word) => {
+    if (typeof word !== "string" || !word)
+      throw new Error("argv words must be non-empty strings");
+    if (word.length > ARGV_WORD_MAX_LENGTH || /[\0\r\n]/.test(word)) {
+      throw new Error("argv words must be single-line and bounded");
+    }
+    return word;
+  });
+}
+function matchCommandGrant(grants, workspaceId, argv) {
+  for (const grant of grants) {
+    if (grant.kind !== "command" || grant.workspaceId !== workspaceId)
+      continue;
+    let rule;
+    try {
+      rule = parseCommandGrantTarget(grant.target);
+    } catch {
+      continue;
+    }
+    if (commandGrantMatches(rule, argv))
+      return { grant, rule };
+  }
+  return void 0;
+}
+function capOutput(value, cap) {
+  if (Buffer.byteLength(value) <= cap)
+    return value;
+  const half = Math.floor(cap / 2);
+  const bytes = Buffer.from(value);
+  return `${bytes.subarray(0, half).toString("utf8")}
+\u2026[${bytes.length - cap} bytes omitted]\u2026
+${bytes.subarray(bytes.length - half).toString("utf8")}`;
+}
+function scrubSecrets(value, secrets) {
+  let scrubbed = value;
+  for (const [name, secret] of secrets) {
+    if (secret.length >= 4)
+      scrubbed = scrubbed.split(secret).join(`[${name}]`);
+  }
+  return scrubbed;
+}
+var GrantCommandRunner = class {
+  options;
+  rooms = /* @__PURE__ */ new Map();
+  resolveSecret;
+  constructor(options) {
+    this.options = options;
+    this.resolveSecret = options.resolveSecret ?? operatorSecretResolver(options.env ?? process.env);
+  }
+  register(roomId, room) {
+    this.rooms.set(roomId, room);
+  }
+  unregister(roomId) {
+    this.rooms.delete(roomId);
+  }
+  async run(input) {
+    if (typeof input.roomId !== "string" || !input.roomId)
+      throw new Error("roomId is required");
+    const room = this.rooms.get(input.roomId);
+    if (!room)
+      throw new Error("this daemon is not serving that Room");
+    const argv = validateGrantArgv(input.argv);
+    const live = await this.options.api.execute("listAgentGrants", { agentId: this.options.agentId });
+    const match = matchCommandGrant(live.grants, room.workspaceId, argv);
+    if (!match) {
+      throw new Error(`no approved command grant matches: ${argv.join(" ")}. Ask with request_grant kind=command first.`);
+    }
+    const { grant, rule } = match;
+    const secrets = /* @__PURE__ */ new Map();
+    for (const name of rule.secrets) {
+      const value = await this.resolveSecret(name);
+      if (!value)
+        throw new Error(`secret ${name} is not in the operator key store`);
+      secrets.set(name, value);
+    }
+    if (grant.status === "once") {
+      await this.options.api.execute("consumeAgentGrant", { grantId: grant.grantId });
+    }
+    const source = this.options.env ?? process.env;
+    const env = {
+      ...source.PATH ? { PATH: source.PATH } : {},
+      ...source.HOME ? { HOME: source.HOME } : {},
+      ...Object.fromEntries(secrets)
+    };
+    const cap = this.options.outputCapBytes ?? GRANT_COMMAND_OUTPUT_CAP_BYTES;
+    const outcome = await new Promise((resolveRun) => {
+      const child = execFile(argv[0], argv.slice(1), {
+        cwd: room.cwd,
+        env,
+        timeout: this.options.timeoutMs ?? GRANT_COMMAND_TIMEOUT_MS,
+        killSignal: "SIGKILL",
+        maxBuffer: cap * 4,
+        encoding: "utf8"
+      }, (error, stdout6, stderr) => {
+        const combined = [stdout6, stderr].filter(Boolean).join(stderr && stdout6 ? "\n" : "");
+        const failure = error;
+        const spawnFailure = Boolean(failure && typeof failure.code === "string");
+        resolveRun({
+          exitCode: spawnFailure ? null : child.exitCode ?? (typeof failure?.code === "number" ? failure.code : 0),
+          ...failure?.signal ? { signal: failure.signal } : {},
+          timedOut: Boolean(failure?.killed && failure?.signal === "SIGKILL"),
+          output: spawnFailure ? `${combined}${combined ? "\n" : ""}${failure.message}` : combined
+        });
+      });
+    });
+    const output = capOutput(scrubSecrets(outcome.output, secrets), cap);
+    const turn = room.turn();
+    const requester = turn?.requester ?? {
+      pubkey: grant.requestedBy,
+      ...grant.requestedByName ? { name: grant.requestedByName } : {}
+    };
+    const status = outcome.timedOut ? "timed out" : outcome.exitCode === null ? "error" : `exit ${outcome.exitCode}`;
+    await this.options.api.execute("postAgentActivity", {
+      agentId: this.options.agentId,
+      roomId: input.roomId,
+      requestId: turn?.requestId ?? `grant:${grant.grantId}`,
+      activity: [
+        {
+          kind: "tool",
+          title: `ran ${argv.join(" ")} under grant ${grant.grantId} \xB7 asked by ${requester.name ?? requester.pubkey.slice(0, 12)}`,
+          operation: "execute",
+          status,
+          command: argv.join(" "),
+          ...output ? { output } : {},
+          requestedBy: requester
+        }
+      ]
+    });
+    return {
+      grantId: grant.grantId,
+      exitCode: outcome.exitCode,
+      ...outcome.signal ? { signal: outcome.signal } : {},
+      timedOut: outcome.timedOut,
+      output
+    };
+  }
+};
+var GrantRunnerServer = class {
+  runner;
+  server;
+  endpoint;
+  constructor(runner) {
+    this.runner = runner;
+  }
+  async start() {
+    if (this.endpoint)
+      return this.endpoint;
+    const token = randomBytes(32).toString("base64url");
+    const server = createServer((request, response) => {
+      void this.handle(request, response, token);
+    });
+    await new Promise((resolveListen, reject) => {
+      server.once("error", reject);
+      server.listen(0, "127.0.0.1", () => resolveListen());
+    });
+    server.unref?.();
+    const address = server.address();
+    this.server = server;
+    this.endpoint = { url: `http://127.0.0.1:${address.port}`, token };
+    return this.endpoint;
+  }
+  async close() {
+    const server = this.server;
+    this.server = void 0;
+    this.endpoint = void 0;
+    if (!server)
+      return;
+    await new Promise((resolveClose) => server.close(() => resolveClose()));
+  }
+  async handle(request, response, token) {
+    const send = (status, body) => {
+      response.writeHead(status, { "content-type": "application/json" });
+      response.end(JSON.stringify(body));
+    };
+    if (request.headers.authorization !== `Bearer ${token}`) {
+      send(401, { error: "grant runner token required" });
+      return;
+    }
+    if (request.method !== "POST" || request.url !== "/run") {
+      send(404, { error: "not found" });
+      return;
+    }
+    const chunks = [];
+    for await (const chunk of request)
+      chunks.push(chunk);
+    try {
+      const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+      send(200, await this.runner.run({ roomId: body.roomId, argv: body.argv }));
+    } catch (error) {
+      send(400, { error: error instanceof Error ? error.message : String(error) });
+    }
+  }
+};
+
 // apps/body/dist/monolith-corner-turn.js
-import { execFile as execFile2 } from "node:child_process";
-import { mkdir as mkdir4 } from "node:fs/promises";
-import { homedir as homedir5 } from "node:os";
+import { execFile as execFile3 } from "node:child_process";
+import { mkdir as mkdir6 } from "node:fs/promises";
+import { homedir as homedir6 } from "node:os";
 import { join as join4 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 
 // apps/body/dist/agent-home.js
 import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { chmod, copyFile, lstat, mkdir, readdir, realpath, rename, rm as rm2, symlink, unlink, writeFile } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { basename as basename3, dirname as dirname2, relative, resolve as resolve6, sep } from "node:path";
+import { chmod as chmod2, copyFile, lstat, mkdir as mkdir3, readdir, realpath, rename, rm as rm2, symlink, unlink, writeFile as writeFile4 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { basename as basename3, dirname as dirname4, relative, resolve as resolve10, sep } from "node:path";
 
 // apps/body/dist/beeline-skill.js
 import { readFileSync as readFileSync3 } from "node:fs";
-import { resolve as resolve5 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 var USING_BEELINE_SKILL_NAME = "using-beeline";
 var BEELINE_ROOM_CAPABILITIES = [
   "The repository filesystem is read-only in this Room session.",
@@ -4272,6 +4746,7 @@ var BEELINE_ROOM_CAPABILITIES = [
   "To send a file, call beeline-agent attach_file with a path inside your checkout; it is attached to your reply.",
   "To run something later or repeatedly, call beeline-agent create_schedule (interval in minutes or a 5-field cron, optional maxRuns); list_schedules / delete_schedule manage them.",
   "When repository work is needed, you MUST call beeline-agent open_corner with a complete objective of no more than 24 words. The host-governed call is the only way to start write work.",
+  "When open_corner succeeds, the server posts the corner card: do not announce or restate the opening. End the turn with nothing more unless the person asked something else.",
   "Never claim an action or reply happened unless the prompt or a tool result proves it."
 ].join(" ");
 var BEELINE_DM_CAPABILITIES = [
@@ -4304,7 +4779,7 @@ function runningBeelineReleaseId(env = process.env, read = (path) => readFileSyn
     const lib = env.BEELINE_LIB_DIR;
     if (!lib)
       return "source";
-    const manifest = JSON.parse(read(resolve5(lib, "bundle.json")));
+    const manifest = JSON.parse(read(resolve8(lib, "bundle.json")));
     return [manifest.version, manifest.commit].filter(Boolean).join("-") || "source";
   } catch {
     return "source";
@@ -4340,6 +4815,226 @@ var SQUIRE_GOVERNED_TOOLS = [
 ];
 var SQUIRE_GOVERNED_TOOL_SET = new Set(SQUIRE_GOVERNED_TOOLS);
 
+// apps/body/dist/openrouter-routing.js
+import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
+import { resolve as resolve9 } from "node:path";
+var OPENROUTER_ENDPOINTS_BASE_URL = "https://openrouter.ai/api/v1/models";
+var OPENROUTER_ROUTING_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+var OPENROUTER_ROUTING_FETCH_TIMEOUT_MS = 1e4;
+var OPENROUTER_UPTIME_BAR = 98;
+var OPENROUTER_UPTIME_BAR_RELAXED = 95;
+var OPENROUTER_MIN_PROVIDERS = 2;
+var OPENROUTER_FALLBACK_PROVIDERS = ["deepinfra", "novita"];
+function openRouterModelId(model, env = {}) {
+  const trimmed = model?.trim();
+  if (!trimmed)
+    return void 0;
+  if (trimmed.startsWith("openrouter/")) {
+    const id = trimmed.slice("openrouter/".length);
+    return id.includes("/") ? id : void 0;
+  }
+  if (env.OPENROUTER_API_KEY?.trim() && /^[^/\s]+\/[^/\s][^\s]*$/.test(trimmed))
+    return trimmed;
+  return void 0;
+}
+function parseOpenRouterEndpoints(payload) {
+  const data = payload?.data;
+  const record2 = data && typeof data === "object" ? data : {};
+  const raw = Array.isArray(record2.endpoints) ? record2.endpoints : [];
+  const endpoints = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object")
+      continue;
+    const endpoint2 = entry;
+    const tag = typeof endpoint2.tag === "string" ? endpoint2.tag : "";
+    const provider = tag.split("/")[0]?.trim() ?? "";
+    if (!provider)
+      continue;
+    const uptime = typeof endpoint2.uptime_last_30m === "number" ? endpoint2.uptime_last_30m : 0;
+    const contextLength = typeof endpoint2.context_length === "number" ? endpoint2.context_length : 0;
+    const supported = Array.isArray(endpoint2.supported_parameters) ? endpoint2.supported_parameters : [];
+    endpoints.push({ provider, uptime, contextLength, tools: supported.includes("tools") });
+  }
+  return {
+    endpoints,
+    contextLength: typeof record2.context_length === "number" ? record2.context_length : advertisedContextLength(endpoints)
+  };
+}
+function advertisedContextLength(endpoints) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const endpoint2 of endpoints) {
+    if (!endpoint2.tools || endpoint2.contextLength <= 0)
+      continue;
+    counts.set(endpoint2.contextLength, (counts.get(endpoint2.contextLength) ?? 0) + 1);
+  }
+  let best;
+  for (const [length, count] of counts) {
+    if (best === void 0) {
+      best = length;
+      continue;
+    }
+    const bestCount = counts.get(best) ?? 0;
+    if (count > bestCount || count === bestCount && length > best)
+      best = length;
+  }
+  return best;
+}
+function selectReliableOpenRouterProviders(endpoints, contextLength) {
+  const eligible = endpoints.filter((endpoint2) => endpoint2.tools && (contextLength === void 0 || endpoint2.contextLength >= contextLength));
+  const atBar = (bar) => {
+    const seen = /* @__PURE__ */ new Set();
+    return eligible.filter((endpoint2) => endpoint2.uptime >= bar).sort((left, right) => right.uptime - left.uptime).map((endpoint2) => endpoint2.provider).filter((provider) => seen.has(provider) ? false : (seen.add(provider), true));
+  };
+  const strict = atBar(OPENROUTER_UPTIME_BAR);
+  if (strict.length >= OPENROUTER_MIN_PROVIDERS) {
+    return { providers: strict, bar: OPENROUTER_UPTIME_BAR, contextLength };
+  }
+  const relaxed = atBar(OPENROUTER_UPTIME_BAR_RELAXED);
+  if (relaxed.length > 0) {
+    return { providers: relaxed, bar: OPENROUTER_UPTIME_BAR_RELAXED, contextLength };
+  }
+  return { providers: [], bar: null, contextLength };
+}
+function openRouterRoutingFor(providers) {
+  return {
+    only: [...providers],
+    order: [...providers],
+    allow_fallbacks: true,
+    require_parameters: false
+  };
+}
+function openRouterRoutingCacheDir(runtimeDir) {
+  return resolve9(runtimeDir, "openrouter-routing");
+}
+function cachePath(cacheDir, model) {
+  return resolve9(cacheDir, `${model.replace(/[^A-Za-z0-9._-]+/g, "_")}.json`);
+}
+async function readCache(cacheDir, model) {
+  try {
+    const parsed = JSON.parse(await readFile4(cachePath(cacheDir, model), "utf8"));
+    if (!parsed || typeof parsed !== "object")
+      return void 0;
+    const cached = parsed;
+    if (cached.model !== model || typeof cached.fetchedAt !== "number" || !Array.isArray(cached.providers) || !cached.providers.every((provider) => typeof provider === "string" && provider.length > 0)) {
+      return void 0;
+    }
+    return {
+      model,
+      fetchedAt: cached.fetchedAt,
+      providers: cached.providers,
+      bar: typeof cached.bar === "number" ? cached.bar : null
+    };
+  } catch {
+    return void 0;
+  }
+}
+async function writeCache(cacheDir, value) {
+  await mkdir2(cacheDir, { recursive: true, mode: 448 });
+  await writeFile3(cachePath(cacheDir, value.model), `${JSON.stringify(value, null, 2)}
+`, {
+    mode: 384
+  });
+}
+function decision(model, providers, bar, source, note) {
+  const criteria = bar === null ? "fallback pair" : `uptime \u2265${bar}%, tools`;
+  const suffix = [
+    bar === OPENROUTER_UPTIME_BAR_RELAXED ? "bar lowered: fewer than 2 providers at 98%" : "",
+    source === "cache" ? "cached" : "",
+    source === "stale-cache" ? "stale cache" : "",
+    note ?? ""
+  ].filter(Boolean).join("; ");
+  return {
+    model,
+    routing: openRouterRoutingFor(providers),
+    providers: [...providers],
+    bar,
+    source,
+    line: `[body] openrouter routing for ${model}: ${providers.join(", ")} (${criteria}` + (suffix ? `; ${suffix})` : ")")
+  };
+}
+async function resolveOpenRouterRouting(input) {
+  const now2 = input.now ?? Date.now;
+  const cached = await readCache(input.cacheDir, input.model);
+  if (cached && now2() - cached.fetchedAt < OPENROUTER_ROUTING_CACHE_TTL_MS) {
+    return decision(input.model, cached.providers, cached.bar, "cache");
+  }
+  let failure;
+  try {
+    const doFetch = input.fetchImpl ?? fetch;
+    const response = await doFetch(`${OPENROUTER_ENDPOINTS_BASE_URL}/${input.model}/endpoints`, {
+      signal: AbortSignal.timeout(input.timeoutMs ?? OPENROUTER_ROUTING_FETCH_TIMEOUT_MS)
+    });
+    if (!response.ok)
+      throw new Error(`HTTP ${response.status}`);
+    const { endpoints, contextLength } = parseOpenRouterEndpoints(await response.json());
+    if (endpoints.length === 0)
+      throw new Error("no endpoints listed");
+    const selected = selectReliableOpenRouterProviders(endpoints, contextLength);
+    if (selected.providers.length === 0) {
+      return decision(input.model, OPENROUTER_FALLBACK_PROVIDERS, null, "fallback", "no provider met the bar");
+    }
+    await writeCache(input.cacheDir, {
+      model: input.model,
+      fetchedAt: now2(),
+      providers: selected.providers,
+      bar: selected.bar
+    }).catch(() => void 0);
+    return decision(input.model, selected.providers, selected.bar, "live");
+  } catch (error) {
+    failure = error instanceof Error ? error.message : String(error);
+  }
+  if (cached) {
+    return decision(input.model, cached.providers, cached.bar, "stale-cache", `api unreachable: ${failure}`);
+  }
+  return decision(input.model, OPENROUTER_FALLBACK_PROVIDERS, null, "fallback", `api unreachable: ${failure}`);
+}
+function withOpenRouterModelRouting(value, pin) {
+  const root = value && typeof value === "object" && !Array.isArray(value) ? { ...value } : {};
+  const applyOverride = (provider) => {
+    if (!pin)
+      return provider;
+    const overrides = provider.modelOverrides && typeof provider.modelOverrides === "object" && !Array.isArray(provider.modelOverrides) ? { ...provider.modelOverrides } : {};
+    const existing = overrides[pin.model];
+    const override = existing && typeof existing === "object" && !Array.isArray(existing) ? { ...existing } : {};
+    const compat = override.compat && typeof override.compat === "object" && !Array.isArray(override.compat) ? { ...override.compat } : {};
+    override.compat = { ...compat, openRouterRouting: pin.routing };
+    overrides[pin.model] = override;
+    return { ...provider, modelOverrides: overrides };
+  };
+  if (Array.isArray(root.providers)) {
+    if (!pin)
+      return root;
+    const providers2 = root.providers.map((provider) => provider && typeof provider === "object" ? { ...provider } : provider);
+    const index = providers2.findIndex((provider) => provider && typeof provider === "object" && provider.name === "openrouter");
+    const current = applyOverride(index >= 0 ? providers2[index] : { name: "openrouter" });
+    if (index >= 0)
+      providers2[index] = current;
+    else
+      providers2.push(current);
+    root.providers = providers2;
+    return root;
+  }
+  const providers = root.providers && typeof root.providers === "object" ? { ...root.providers } : {};
+  if (pin) {
+    const current = providers.openrouter && typeof providers.openrouter === "object" && !Array.isArray(providers.openrouter) ? { ...providers.openrouter } : {};
+    providers.openrouter = applyOverride(current);
+  }
+  root.providers = providers;
+  return root;
+}
+function openRouterRoutingInput(config, selection, fetchImpl) {
+  const model = openRouterModelId(selection?.model, config.agentEnv);
+  if (!model || !config.openRouterRoutingCacheDir)
+    return {};
+  return {
+    openRouterRouting: {
+      model,
+      cacheDir: config.openRouterRoutingCacheDir,
+      ...fetchImpl ? { fetchImpl } : {}
+    }
+  };
+}
+
 // apps/body/dist/toml-section.js
 function scanLine(line, openString) {
   if (openString.kind) {
@@ -4523,54 +5218,21 @@ var PI_CUSTOM_MODEL_CONFIG = {
   source: ".pi/agent/models.json",
   target: "models.json"
 };
-var OPENROUTER_RELIABLE_PROVIDERS = ["deepinfra", "novita"];
-function withReliableOpenRouterRouting(value) {
-  const root = value && typeof value === "object" && !Array.isArray(value) ? { ...value } : {};
-  const routing = {
-    only: [...OPENROUTER_RELIABLE_PROVIDERS],
-    order: [...OPENROUTER_RELIABLE_PROVIDERS],
-    allow_fallbacks: false,
-    require_parameters: true
-  };
-  if (Array.isArray(root.providers)) {
-    const providers2 = root.providers.map((provider) => provider && typeof provider === "object" ? { ...provider } : provider);
-    const index = providers2.findIndex((provider) => provider && typeof provider === "object" && provider.name === "openrouter");
-    const current2 = index >= 0 ? providers2[index] : { name: "openrouter" };
-    const compat2 = current2.compat && typeof current2.compat === "object" && !Array.isArray(current2.compat) ? { ...current2.compat } : {};
-    current2.compat = { ...compat2, openRouterRouting: routing };
-    if (index >= 0)
-      providers2[index] = current2;
-    else
-      providers2.push(current2);
-    root.providers = providers2;
-    return root;
-  }
-  const providers = root.providers && typeof root.providers === "object" ? { ...root.providers } : {};
-  const current = providers.openrouter && typeof providers.openrouter === "object" && !Array.isArray(providers.openrouter) ? { ...providers.openrouter } : {};
-  const compat = current.compat && typeof current.compat === "object" && !Array.isArray(current.compat) ? { ...current.compat } : {};
-  current.compat = {
-    ...compat,
-    openRouterRouting: routing
-  };
-  providers.openrouter = current;
-  root.providers = providers;
-  return root;
-}
 var CODEX_ROOM_AGENT_LOCKDOWN_TOML = "[agents]\nenabled = false\n";
 var CODEX_ROOM_WEB_SEARCH_TOML = "[features]\nstandalone_web_search = true\n";
 var HOME_SUBDIRS = ["user", "claude", "codex", "grok", "pi", "state", "cache", "tmp"];
 async function prepareRoomAgentHome(input) {
-  const root = resolve6(input.root);
-  const operatorHome = input.operatorHome ?? homedir2();
+  const root = resolve10(input.root);
+  const operatorHome = input.operatorHome ?? homedir3();
   try {
-    await mkdir(root, { recursive: true, mode: 448 });
+    await mkdir3(root, { recursive: true, mode: 448 });
     const rootStats = await lstat(root);
     if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) {
       throw new AgentHomeSecurityError(`agent home root is not an ordinary directory: ${root}`);
     }
     for (const subdir of HOME_SUBDIRS) {
-      const path = resolve6(root, subdir);
-      await mkdir(path, { recursive: true, mode: 448 });
+      const path = resolve10(root, subdir);
+      await mkdir3(path, { recursive: true, mode: 448 });
       await assertRealContainedDirectory(path, root);
     }
   } catch (error) {
@@ -4580,14 +5242,14 @@ async function prepareRoomAgentHome(input) {
     return {};
   }
   for (const credential of SHARED_CREDENTIALS) {
-    const source = resolve6(operatorHome, credential.source);
-    const target = resolve6(root, credential.dir, credential.target);
+    const source = resolve10(operatorHome, credential.source);
+    const target = resolve10(root, credential.dir, credential.target);
     if (!existsSync3(source) || existsSync3(target))
       continue;
     await symlink(source, target).catch(() => void 0);
   }
   const prior = agentHomeProvisionQueues.get(root) ?? Promise.resolve();
-  const provision = prior.catch(() => void 0).then(() => provisionAgentSkillsAndMcp(root, operatorHome, input.skillReleaseId ?? runningBeelineReleaseId(), input.failClosed ?? false, input.sharedSkills ?? []));
+  const provision = prior.catch(() => void 0).then(() => provisionAgentSkillsAndMcp(root, operatorHome, input.skillReleaseId ?? runningBeelineReleaseId(), input.failClosed ?? false, input.sharedSkills ?? [], input.openRouterRouting));
   agentHomeProvisionQueues.set(root, provision);
   try {
     await provision;
@@ -4597,19 +5259,19 @@ async function prepareRoomAgentHome(input) {
   }
   return roomAgentHomeEnv(root);
 }
-async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, failClosed, sharedSkills) {
+async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, failClosed, sharedSkills, openRouterRouting) {
   const managedSkills = [
     { name: USING_BEELINE_SKILL_NAME, content: usingBeelineSkillMarkdown(skillReleaseId) }
   ];
   const shared = await resolveSharedSkillSources(operatorHome, sharedSkills);
   for (const dir of AGENT_SKILL_DIRS) {
-    const target = resolve6(root, dir, "skills");
+    const target = resolve10(root, dir, "skills");
     await provisionManagedSkillsDir(target, managedSkills, shared, sharedSkills.length === 0);
   }
   for (const config of HARNESS_MCP_CONFIGS) {
     try {
-      const source = resolve6(operatorHome, config.toml);
-      const target = resolve6(root, config.dir, "config.toml");
+      const source = resolve10(operatorHome, config.toml);
+      const target = resolve10(root, config.dir, "config.toml");
       const mcpSection = existsSync3(source) ? filteredHarnessMcpToml(readFileSync4(source, "utf8")) : void 0;
       const section = config.dir === "codex" ? [CODEX_ROOM_AGENT_LOCKDOWN_TOML, CODEX_ROOM_WEB_SEARCH_TOML, mcpSection].filter(Boolean).join("\n") : mcpSection;
       if (!section) {
@@ -4624,8 +5286,8 @@ async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, fa
     }
   }
   try {
-    const claudeJson = resolve6(operatorHome, ".claude.json");
-    const claudeTarget = resolve6(root, "claude", ".claude.json");
+    const claudeJson = resolve10(operatorHome, ".claude.json");
+    const claudeTarget = resolve10(root, "claude", ".claude.json");
     const mcpServers = existsSync3(claudeJson) ? readClaudeUserScopeMcpServers(claudeJson) : void 0;
     if (mcpServers && Object.keys(mcpServers).length > 0) {
       await writeIsolatedHarnessFile(claudeTarget, `${JSON.stringify({ mcpServers }, null, 2)}
@@ -4640,22 +5302,28 @@ async function provisionAgentSkillsAndMcp(root, operatorHome, skillReleaseId, fa
   }
   try {
     const settings2 = { permissions: { allow: ["WebSearch"] } };
-    await writeIsolatedHarnessFile(resolve6(root, "claude", "settings.json"), `${JSON.stringify(settings2, null, 2)}
+    await writeIsolatedHarnessFile(resolve10(root, "claude", "settings.json"), `${JSON.stringify(settings2, null, 2)}
 `);
   } catch (error) {
     if (failClosed)
       throw error;
     console.warn("[body] claude web-search settings provisioning failed:", error);
   }
-  await provisionPiCustomModelConfig(root, operatorHome, failClosed);
+  await provisionPiCustomModelConfig(root, operatorHome, failClosed, openRouterRouting);
 }
-async function provisionPiCustomModelConfig(root, operatorHome, failClosed) {
-  const source = resolve6(operatorHome, PI_CUSTOM_MODEL_CONFIG.source);
-  const target = resolve6(root, "pi", PI_CUSTOM_MODEL_CONFIG.target);
+async function provisionPiCustomModelConfig(root, operatorHome, failClosed, openRouterRouting) {
+  const source = resolve10(operatorHome, PI_CUSTOM_MODEL_CONFIG.source);
+  const target = resolve10(root, "pi", PI_CUSTOM_MODEL_CONFIG.target);
+  let decision2;
+  if (openRouterRouting) {
+    decision2 = await resolveOpenRouterRouting(openRouterRouting);
+    console.log(decision2.line);
+  }
+  const pin = decision2 ? { model: decision2.model, routing: decision2.routing } : void 0;
   try {
     const sourceStats = await lstat(source).catch(() => void 0);
     if (!sourceStats) {
-      await writeIsolatedHarnessFile(target, `${JSON.stringify(withReliableOpenRouterRouting({}), null, 2)}
+      await writeIsolatedHarnessFile(target, `${JSON.stringify(withOpenRouterModelRouting({}, pin), null, 2)}
 `);
       return;
     }
@@ -4667,7 +5335,7 @@ async function provisionPiCustomModelConfig(root, operatorHome, failClosed) {
       throw new AgentHomeSecurityError(`Pi custom model config resolves through a link: ${source}`);
     }
     const sourceValue = JSON.parse(readFileSync4(resolvedSource, "utf8"));
-    await writeIsolatedHarnessFile(target, `${JSON.stringify(withReliableOpenRouterRouting(sourceValue), null, 2)}
+    await writeIsolatedHarnessFile(target, `${JSON.stringify(withOpenRouterModelRouting(sourceValue, pin), null, 2)}
 `);
   } catch (error) {
     await unlink(target).catch(() => void 0);
@@ -4702,16 +5370,16 @@ function filteredHarnessMcpToml(source) {
   return extractTomlSections(source, ["mcp_servers"], excluded);
 }
 async function provisionManagedSkillsDir(target, managedSkills, sharedSkills, optionalShares) {
-  const parent = dirname2(target);
-  await assertRealContainedDirectory(parent, dirname2(parent));
-  const staged = resolve6(parent, `.skills.${process.pid}.${randomUUID()}.tmp`);
-  await mkdir(staged, { mode: 448 });
+  const parent = dirname4(target);
+  await assertRealContainedDirectory(parent, dirname4(parent));
+  const staged = resolve10(parent, `.skills.${process.pid}.${randomUUID()}.tmp`);
+  await mkdir3(staged, { mode: 448 });
   const names = new Set(managedSkills.map((skill) => skill.name));
   try {
     for (const skill of managedSkills) {
-      const skillDir = resolve6(staged, skill.name);
-      await mkdir(skillDir, { recursive: true });
-      await writeIsolatedHarnessFile(resolve6(skillDir, "SKILL.md"), skill.content);
+      const skillDir = resolve10(staged, skill.name);
+      await mkdir3(skillDir, { recursive: true });
+      await writeIsolatedHarnessFile(resolve10(skillDir, "SKILL.md"), skill.content);
     }
     for (const shared of sharedSkills) {
       if (names.has(shared.name)) {
@@ -4719,7 +5387,7 @@ async function provisionManagedSkillsDir(target, managedSkills, sharedSkills, op
       }
       names.add(shared.name);
       try {
-        await copySafeSkillTree(shared.source, resolve6(staged, shared.name), shared.source);
+        await copySafeSkillTree(shared.source, resolve10(staged, shared.name), shared.source);
       } catch (error) {
         if (!optionalShares)
           throw error;
@@ -4740,20 +5408,20 @@ async function resolveSharedSkillSources(operatorHome, names) {
   const seen = /* @__PURE__ */ new Set();
   const resolved = [];
   for (const relativeRoot of OPERATOR_SKILL_SOURCE_DIRS) {
-    const sourceRoot = resolve6(operatorHome, relativeRoot);
+    const sourceRoot = resolve10(operatorHome, relativeRoot);
     const rootStats = await lstat(sourceRoot).catch(() => void 0);
     if (!rootStats?.isDirectory() || rootStats.isSymbolicLink())
       continue;
     for (const entry of await readdir(sourceRoot)) {
       if (!isSharedSkillName(entry) || seen.has(entry))
         continue;
-      const candidate = resolve6(sourceRoot, entry);
+      const candidate = resolve10(sourceRoot, entry);
       try {
         const candidateStats = await lstat(candidate);
         if (!candidateStats.isDirectory() || candidateStats.isSymbolicLink())
           continue;
         assertContained(sourceRoot, candidate);
-        const skillMd = resolve6(candidate, "SKILL.md");
+        const skillMd = resolve10(candidate, "SKILL.md");
         const skillStats = await lstat(skillMd);
         if (!skillStats.isFile() || skillStats.isSymbolicLink() || skillStats.nlink !== 1) {
           throw new Error(`shared skill requires an ordinary SKILL.md: ${entry}`);
@@ -4777,8 +5445,8 @@ async function resolveExplicitSkillSources(operatorHome, names) {
   for (const name of unique) {
     const matches = [];
     for (const relativeRoot of OPERATOR_SKILL_SOURCE_DIRS) {
-      const sourceRoot = resolve6(operatorHome, relativeRoot);
-      const candidate = resolve6(sourceRoot, name);
+      const sourceRoot = resolve10(operatorHome, relativeRoot);
+      const candidate = resolve10(sourceRoot, name);
       const rootStats = await lstat(sourceRoot).catch(() => void 0);
       const candidateStats = await lstat(candidate).catch(() => void 0);
       if (!candidateStats)
@@ -4795,7 +5463,7 @@ async function resolveExplicitSkillSources(operatorHome, names) {
     if (matches.length !== 1) {
       throw new Error(matches.length === 0 ? `shared skill is unavailable: ${name}` : `shared skill source is ambiguous: ${name}`);
     }
-    const skillMd = resolve6(matches[0], "SKILL.md");
+    const skillMd = resolve10(matches[0], "SKILL.md");
     const skillStats = await lstat(skillMd).catch(() => void 0);
     if (!skillStats?.isFile() || skillStats.isSymbolicLink() || skillStats.nlink !== 1) {
       throw new Error(`shared skill requires an ordinary SKILL.md: ${name}`);
@@ -4806,7 +5474,7 @@ async function resolveExplicitSkillSources(operatorHome, names) {
 }
 function assertContained(root, candidate) {
   const rel = relative(root, candidate);
-  if (rel === ".." || rel.startsWith(`..${sep}`) || resolve6(root, rel) !== resolve6(candidate)) {
+  if (rel === ".." || rel.startsWith(`..${sep}`) || resolve10(root, rel) !== resolve10(candidate)) {
     throw new Error(`path escapes the agent skill boundary: ${candidate}`);
   }
 }
@@ -4821,7 +5489,7 @@ var BLOCKED_SHARED_FILENAMES = /^(?:\.env(?:\..*)?|auth\.json|\.credentials\.jso
 async function copySafeSkillTree(source, target, sourceRoot) {
   assertContained(sourceRoot, source);
   const resolvedSource = await realpath(source);
-  if (resolvedSource !== resolve6(source)) {
+  if (resolvedSource !== resolve10(source)) {
     throw new Error(`shared skill path resolves through a link: ${source}`);
   }
   assertContained(sourceRoot, resolvedSource);
@@ -4832,11 +5500,11 @@ async function copySafeSkillTree(source, target, sourceRoot) {
     throw new Error(`shared skill contains credential or configuration material: ${source}`);
   }
   if (stats.isDirectory()) {
-    await mkdir(target, { mode: 448 });
+    await mkdir3(target, { mode: 448 });
     for (const entry of await readdir(resolvedSource)) {
       if (entry === "." || entry === "..")
         throw new Error("invalid shared skill entry");
-      await copySafeSkillTree(resolve6(source, entry), resolve6(target, entry), sourceRoot);
+      await copySafeSkillTree(resolve10(source, entry), resolve10(target, entry), sourceRoot);
     }
     return;
   }
@@ -4844,34 +5512,34 @@ async function copySafeSkillTree(source, target, sourceRoot) {
     throw new Error(`shared skill contains a nonordinary file: ${source}`);
   }
   await copyFile(resolvedSource, target);
-  await chmod(target, 384);
+  await chmod2(target, 384);
 }
 async function writeIsolatedHarnessFile(path, content) {
-  const parent = dirname2(path);
+  const parent = dirname4(path);
   const parentStats = await lstat(parent);
   if (!parentStats.isDirectory() || parentStats.isSymbolicLink()) {
     throw new Error(`isolated harness parent is not a real directory: ${parent}`);
   }
-  const temporary = resolve6(parent, `.${basename3(path)}.${process.pid}.${randomUUID()}.tmp`);
+  const temporary = resolve10(parent, `.${basename3(path)}.${process.pid}.${randomUUID()}.tmp`);
   try {
-    await writeFile(temporary, content, { mode: 384, flag: "wx" });
-    await chmod(temporary, 384);
+    await writeFile4(temporary, content, { mode: 384, flag: "wx" });
+    await chmod2(temporary, 384);
     await rename(temporary, path);
   } finally {
     await unlink(temporary).catch(() => void 0);
   }
 }
 function roomAgentHomeEnv(root) {
-  const resolved = resolve6(root);
+  const resolved = resolve10(root);
   return {
-    HOME: resolve6(resolved, "user"),
-    CLAUDE_CONFIG_DIR: resolve6(resolved, "claude"),
-    CODEX_HOME: resolve6(resolved, "codex"),
-    GROK_HOME: resolve6(resolved, "grok"),
-    PI_CODING_AGENT_DIR: resolve6(resolved, "pi"),
-    XDG_STATE_HOME: resolve6(resolved, "state"),
-    XDG_CACHE_HOME: resolve6(resolved, "cache"),
-    TMPDIR: resolve6(resolved, "tmp")
+    HOME: resolve10(resolved, "user"),
+    CLAUDE_CONFIG_DIR: resolve10(resolved, "claude"),
+    CODEX_HOME: resolve10(resolved, "codex"),
+    GROK_HOME: resolve10(resolved, "grok"),
+    PI_CODING_AGENT_DIR: resolve10(resolved, "pi"),
+    XDG_STATE_HOME: resolve10(resolved, "state"),
+    XDG_CACHE_HOME: resolve10(resolved, "cache"),
+    TMPDIR: resolve10(resolved, "tmp")
   };
 }
 var HARNESS_STATE_ENV_VARS = [
@@ -4888,14 +5556,14 @@ function harnessStateDirsFromEnv(env) {
   for (const name of HARNESS_STATE_ENV_VARS) {
     const value = env[name];
     if (value)
-      stateDirs.push(resolve6(value));
+      stateDirs.push(resolve10(value));
   }
   const tmp = env.TMPDIR;
-  return { stateDirs, ...tmp ? { tmpDir: resolve6(tmp) } : {} };
+  return { stateDirs, ...tmp ? { tmpDir: resolve10(tmp) } : {} };
 }
 
 // apps/body/dist/attachment-delivery.js
-import { mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
+import { mkdir as mkdir4, writeFile as writeFile5 } from "node:fs/promises";
 import { basename as basename4, extname, join as join2 } from "node:path";
 var MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
 var FETCH_TIMEOUT_MS = 3e4;
@@ -4913,7 +5581,7 @@ async function deliverAttachments(attachments, dir, fetchImpl = fetch) {
   if (!attachments.length)
     return [];
   const taken = /* @__PURE__ */ new Set();
-  await mkdir2(dir, { recursive: true });
+  await mkdir4(dir, { recursive: true });
   return Promise.all(attachments.map(async (attachment, index) => {
     const tooLarge = (bytes) => ({
       attachment,
@@ -4934,7 +5602,7 @@ async function deliverAttachments(attachments, dir, fetchImpl = fetch) {
       if (bytes.length > MAX_ATTACHMENT_BYTES)
         return tooLarge(bytes.length);
       const path = join2(dir, safeFileName(attachment, index, taken));
-      await writeFile2(path, bytes);
+      await writeFile5(path, bytes);
       const mimeType = attachment.mimeType ?? response.headers.get("content-type") ?? "";
       return {
         attachment,
@@ -5046,9 +5714,70 @@ function sanitizeAgentReply(message) {
   }
   return lines.slice(1).join("\n").trim();
 }
+var CORNER_OPEN_ECHO = /^(?:(?:ok(?:ay)?|done|sure|great|alright)[,.!:]?\s+)?(?:i(?:'ve| have|'ll| will|'m| am)?\s+)?(?:just\s+)?open(?:ed|ing)?\s+(?:up\s+)?(?:a\s+|the\s+|your\s+)?(?:new\s+|write(?:-enabled)?\s+|repository\s+)*corner\b/iu;
+var CORNER_OPEN_ECHO_MAX_CHARS = 320;
+function stripCornerOpenEcho(message) {
+  const visible = message.trim();
+  if (!visible)
+    return "";
+  const paragraphs = visible.split(/\n\s*\n/);
+  const first = paragraphs[0].trim();
+  if (first.length > CORNER_OPEN_ECHO_MAX_CHARS || !CORNER_OPEN_ECHO.test(first))
+    return visible;
+  return paragraphs.slice(1).join("\n\n").trim();
+}
+var STATUS_FILLER = new Set("a an the this that it its is are was were be been being has have had do does did now still remains remain remaining ready for review reviewing pr pull request all every both and or so to of in on at as with by no not nothing new further more else needed needs need required action actions change changes changed status state update updates updated waiting wait awaiting pending running progress idle done ok okay good great well fine confirmed confirm already again yet just currently right i we will can should would github remote upstream branch head latest current report reported noted note see looks look like everything nothing appears appear seems seem there here which what from without any".split(/\s+/));
+var STATUS_SYNONYMS = {
+  passed: ["pass", "passed", "passing", "passes", "green", "succeeded", "success", "successful", "successfully"],
+  failed: ["fail", "failed", "failing", "fails", "red", "broke", "broken", "failure", "failures"],
+  check: ["check", "checks", "ci", "run", "runs", "workflow", "workflows", "build", "builds", "test", "tests", "suite"],
+  started: ["start", "started", "starting", "began", "begun", "kicked", "off", "queued"],
+  merged: ["merge", "merged", "merging", "landed", "closed"]
+};
+var STATUS_RESTATEMENT_MAX_CHARS = 200;
+var STATUS_RESTATEMENT_MAX_SENTENCES = 2;
+function statusWords(text2) {
+  return (text2.toLowerCase().match(/[\p{L}\p{N}'-]+/gu) ?? []).map((word) => word.replace(/^'+|'+$/g, "").replace(/'s$/, ""));
+}
+function isCornerStatusRestatement(reply, systemLines) {
+  const text2 = reply.trim();
+  if (!text2)
+    return true;
+  if (text2.length > STATUS_RESTATEMENT_MAX_CHARS)
+    return false;
+  if (/https?:\/\/\S+/i.test(text2))
+    return false;
+  const sentences = text2.split(/[.!?]+(?:\s+|$)/).filter((part) => part.trim());
+  if (sentences.length > STATUS_RESTATEMENT_MAX_SENTENCES)
+    return false;
+  const admitted = new Set(STATUS_FILLER);
+  for (const line of systemLines) {
+    for (const word of statusWords(line)) {
+      admitted.add(word);
+      for (const synonym of STATUS_SYNONYMS[word] ?? [])
+        admitted.add(synonym);
+    }
+  }
+  return statusWords(text2).every((word) => !word || admitted.has(word));
+}
+
+// apps/body/dist/turn-failure-reason.js
+var TURN_FAILURE_REASON_MAX = 200;
+function redactToolDetail(value) {
+  return value.replace(/\b(["']?)(api[_-]?key|token|secret|password|passwd|authorization|credential|cookie|private[_-]?key)\1\s*[:=]\s*(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,}\]]+)/gi, '"$2": "[REDACTED]"').replace(/\b(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*=(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\S+)/g, (assignment) => `${assignment.slice(0, assignment.indexOf("="))}=[REDACTED]`).replace(/\b(?:gh[pousr]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{12,})\b/gi, "[REDACTED]").replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(/\b(Bearer\s+)[^\s,]+/gi, "$1[REDACTED]").replace(/\bsk-[A-Za-z0-9_-]{12,}\b/g, "[REDACTED]").replace(/(--?(?:api[_-]?key|token|secret|password|authorization|credential|cookie)\s+)(?:"[^"]*"|'[^']*'|\S+)/gi, "$1[REDACTED]");
+}
+function distillTurnFailureReason(error) {
+  const raw = error instanceof Error ? error.message : typeof error === "string" ? error : error && typeof error === "object" && "message" in error ? String(error.message) : error == null ? "" : String(error);
+  const firstLine = raw.split(/\r?\n/).map((line) => line.trim()).find((line) => line && !/^at\s/.test(line)) ?? "";
+  const stripped = firstLine.replace(/^(?:[A-Za-z]*Error|Error):\s*/, "").replace(/\s+/g, " ");
+  const clean4 = redactToolDetail(stripped).trim();
+  if (!clean4)
+    return "turn failed";
+  return clean4.length > TURN_FAILURE_REASON_MAX ? `${clean4.slice(0, TURN_FAILURE_REASON_MAX - 1)}\u2026` : clean4;
+}
 
 // apps/body/dist/room-session.js
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve11 } from "node:path";
 
 // apps/body/dist/read-only-policy.js
 var READ_ONLY_MCP_SERVER_NAME = "beeline-readonly-mcp";
@@ -5180,7 +5909,11 @@ function beelineAgentMcpServer(config, api, context) {
       { name: "BEELINE_DAEMON_ROOM_ID", value: context.roomId },
       { name: "BEELINE_DAEMON_WORKSPACE_ID", value: context.workspaceId },
       ...context.cornerId ? [{ name: "BEELINE_DAEMON_CORNER_ID", value: context.cornerId }] : [],
-      ...context.attachRoot ? [{ name: "BEELINE_ATTACH_ROOT", value: context.attachRoot }] : []
+      ...context.attachRoot ? [{ name: "BEELINE_ATTACH_ROOT", value: context.attachRoot }] : [],
+      ...context.grantRunner ? [
+        { name: "BEELINE_GRANT_RUNNER_URL", value: context.grantRunner.url },
+        { name: "BEELINE_GRANT_RUNNER_TOKEN", value: context.grantRunner.token }
+      ] : []
     ]
   };
 }
@@ -5194,14 +5927,14 @@ function readOnlyMcpServer(config, cwd, agentMemoryDir) {
     command: config.readonlyMcpCommand,
     args: [...config.readonlyMcpArgs ?? []],
     env: [
-      { name: "BEELINE_READONLY_ROOT", value: resolve7(cwd) },
+      { name: "BEELINE_READONLY_ROOT", value: resolve11(cwd) },
       ...config.agentHomeRoot ? [
         {
           name: "BEELINE_READONLY_AGENT_SKILLS_ROOT",
-          value: resolve7(config.agentHomeRoot, skillDir, "skills")
+          value: resolve11(config.agentHomeRoot, skillDir, "skills")
         }
       ] : [],
-      ...agentMemoryDir ? [{ name: "BEELINE_READONLY_AGENT_MEMORY_ROOT", value: resolve7(agentMemoryDir) }] : []
+      ...agentMemoryDir ? [{ name: "BEELINE_READONLY_AGENT_MEMORY_ROOT", value: resolve11(agentMemoryDir) }] : []
     ]
   };
 }
@@ -5209,8 +5942,8 @@ function readOnlyMcpServer(config, cwd, agentMemoryDir) {
 // apps/body/dist/bwrap-sandbox.js
 import { spawnSync } from "node:child_process";
 import { lstatSync as lstatSync2 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve8 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve12 } from "node:path";
 var DEFAULT_SANDBOX_POLICY = "bwrap";
 function isSandboxPolicy(value) {
   return value === "bwrap" || value === "off";
@@ -5242,12 +5975,12 @@ var HARNESS_HOME_STATE_DIRS = [
     dirs: [".grok"]
   }
 ];
-function harnessHomeStateDirs(agentCommand, home = homedir3()) {
+function harnessHomeStateDirs(agentCommand, home = homedir4()) {
   if (!agentCommand)
     return [];
   for (const { match, dirs } of HARNESS_HOME_STATE_DIRS) {
     if (match.test(agentCommand))
-      return dirs.map((dir) => resolve8(home, dir));
+      return dirs.map((dir) => resolve12(home, dir));
   }
   return [];
 }
@@ -5259,7 +5992,7 @@ var KNOWN_CREDENTIAL_MASK_PATHS = [
   ".git-credentials",
   ".secrets.env"
 ];
-function credentialMaskPaths(extraPaths, home = homedir3(), stat3 = (path) => {
+function credentialMaskPaths(extraPaths, home = homedir4(), stat3 = (path) => {
   try {
     const info = lstatSync2(path);
     return { isDirectory: info.isDirectory() };
@@ -5267,10 +6000,10 @@ function credentialMaskPaths(extraPaths, home = homedir3(), stat3 = (path) => {
     return void 0;
   }
 }, requiredPaths = []) {
-  const required = new Set(requiredPaths.map((path) => resolve8(path)));
+  const required = new Set(requiredPaths.map((path) => resolve12(path)));
   const candidates = [
-    ...KNOWN_CREDENTIAL_MASK_PATHS.map((entry) => resolve8(home, entry)),
-    ...(extraPaths ?? []).map((entry) => resolve8(entry))
+    ...KNOWN_CREDENTIAL_MASK_PATHS.map((entry) => resolve12(home, entry)),
+    ...(extraPaths ?? []).map((entry) => resolve12(entry))
   ];
   const seen = /* @__PURE__ */ new Set();
   const masks = [];
@@ -5297,7 +6030,7 @@ function normalize(paths) {
   for (const path of paths) {
     if (!path)
       continue;
-    seen.add(resolve8(path));
+    seen.add(resolve12(path));
   }
   return Array.from(seen).sort();
 }
@@ -5335,7 +6068,7 @@ function sandboxMountPlan(spec) {
     writable,
     quotaTmpfs: spec.workbench ? [
       {
-        target: resolve8(spec.workbench.dir),
+        target: resolve12(spec.workbench.dir),
         maxBytes: spec.workbench.maxBytes,
         maxInodes: spec.workbench.maxInodes,
         blockGit: true
@@ -5390,7 +6123,7 @@ function buildBwrapArgv(input) {
   for (const binding of quotaTmpfs) {
     args.push("--dir", binding.target, "--size", String(binding.maxBytes), "--tmpfs", binding.target);
     if (binding.blockGit)
-      args.push("--ro-bind", "/dev/null", resolve8(binding.target, ".git"));
+      args.push("--ro-bind", "/dev/null", resolve12(binding.target, ".git"));
   }
   args.push("--chdir", input.cwd);
   args.push("--die-with-parent");
@@ -5454,13 +6187,176 @@ function detectBwrapSandbox(options = {}) {
   };
 }
 
+// apps/body/dist/pi-turn-record.js
+import { readdir as readdir2, readFile as readFile5 } from "node:fs/promises";
+import { resolve as resolve13 } from "node:path";
+function summarizeProviderError(errorMessage2) {
+  const trimmed = errorMessage2.trim();
+  const statusMatch = /^(\d{3}):\s*([\s\S]*)$/.exec(trimmed);
+  const status = statusMatch ? Number(statusMatch[1]) : void 0;
+  let body = statusMatch ? statusMatch[2].trim() : trimmed;
+  if (body.startsWith("{")) {
+    try {
+      const parsed = JSON.parse(body);
+      const message = typeof parsed.message === "string" ? parsed.message : typeof parsed.error === "string" ? parsed.error : typeof parsed.error?.message === "string" ? parsed.error.message : void 0;
+      if (message)
+        body = message;
+    } catch {
+    }
+  }
+  const firstLine = body.split(/\r?\n/).find((line) => line.trim()) ?? "";
+  const reason = `provider error${status === void 0 ? "" : ` ${status}`}${firstLine ? `: ${firstLine.trim()}` : ""}`;
+  return status === void 0 ? { reason } : { reason, status };
+}
+async function sessionFileFromMap(home, sessionId) {
+  try {
+    const raw = await readFile5(resolve13(home, ".pi", "pi-acp", "session-map.json"), "utf8");
+    const map = JSON.parse(raw);
+    const file = map.sessions?.[sessionId]?.sessionFile;
+    return typeof file === "string" && file ? file : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function sessionFileFromLayout(piDir, sessionId) {
+  const sessionsRoot = resolve13(piDir, "sessions");
+  const suffix = `_${sessionId}.jsonl`;
+  let projects;
+  try {
+    projects = await readdir2(sessionsRoot);
+  } catch {
+    return void 0;
+  }
+  for (const project of projects) {
+    const dir = resolve13(sessionsRoot, project);
+    let files;
+    try {
+      files = await readdir2(dir);
+    } catch {
+      continue;
+    }
+    const match = files.find((file) => file.endsWith(suffix));
+    if (match)
+      return resolve13(dir, match);
+  }
+  return void 0;
+}
+function messageText(content) {
+  if (!Array.isArray(content))
+    return "";
+  return content.map((block2) => block2 && typeof block2 === "object" && block2.type === "text" ? String(block2.text ?? "") : "").join("").trim();
+}
+async function readPiTurnRecord(input) {
+  const piDir = input.agentEnv.PI_CODING_AGENT_DIR;
+  if (!piDir || !input.sessionId)
+    return void 0;
+  const file = (input.agentEnv.HOME ? await sessionFileFromMap(input.agentEnv.HOME, input.sessionId) : void 0) ?? await sessionFileFromLayout(piDir, input.sessionId);
+  if (!file)
+    return void 0;
+  let raw;
+  try {
+    raw = await readFile5(file, "utf8");
+  } catch {
+    return void 0;
+  }
+  let sawUser = false;
+  let last;
+  for (const line of raw.split(/\r?\n/)) {
+    if (!line.trim())
+      continue;
+    let entry;
+    try {
+      entry = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (entry.type !== "message" || !entry.message)
+      continue;
+    if (entry.message.role === "user") {
+      sawUser = true;
+      last = void 0;
+    } else if (entry.message.role === "assistant") {
+      last = entry.message;
+    }
+  }
+  if (!sawUser && !last)
+    return void 0;
+  if (!last)
+    return { kind: "missing" };
+  if (last.stopReason === "error") {
+    return {
+      kind: "error",
+      ...summarizeProviderError(typeof last.errorMessage === "string" && last.errorMessage.trim() ? last.errorMessage : "unknown error")
+    };
+  }
+  const text2 = messageText(last.content);
+  if (text2)
+    return { kind: "answer", text: text2 };
+  return {
+    kind: "empty",
+    stopReason: typeof last.stopReason === "string" ? last.stopReason : "unknown"
+  };
+}
+
+// apps/body/dist/empty-turn.js
+async function explainEmptyAgentTurn(input) {
+  const streamFact = describeEmptyTurn(input.result, input.agentLabel);
+  if (!isPiAcpHarness(input.agentLabel))
+    return { reason: streamFact };
+  const record2 = await readPiTurnRecord({ agentEnv: input.agentEnv, sessionId: input.sessionId });
+  if (!record2)
+    return { reason: `pi left no readable turn record; ${streamFact}` };
+  switch (record2.kind) {
+    case "error":
+      return { reason: record2.reason, record: record2 };
+    case "empty":
+      return {
+        reason: `the model ended its turn with no text (stop reason ${record2.stopReason})`,
+        record: record2
+      };
+    case "answer":
+      return {
+        recoveredText: record2.text,
+        reason: "pi recorded the answer but the ACP stream delivered no text",
+        record: record2
+      };
+    case "missing":
+      return { reason: `pi recorded no assistant message for this turn; ${streamFact}`, record: record2 };
+  }
+}
+function isAccountOrProviderRefusal(record2) {
+  if (!record2 || record2.kind !== "error" || record2.status === void 0)
+    return false;
+  return [401, 402, 403, 407, 408, 429].includes(record2.status) || record2.status >= 500;
+}
+
+// apps/body/dist/corner-checks.js
+var COMPLETED_CHECK_NOTE = /\b(passed|failed) a check\b/i;
+var STARTED_CHECK_NOTE = /\bstarted a check\b/i;
+function verbOf(item) {
+  return item.systemEvent?.verb ?? item.body;
+}
+function completedCheckNote(item) {
+  if (item.type !== "system")
+    return void 0;
+  const match = COMPLETED_CHECK_NOTE.exec(verbOf(item));
+  return match ? match[1].toLowerCase() : void 0;
+}
+function isCheckStartNote(item) {
+  return item.type === "system" && STARTED_CHECK_NOTE.test(verbOf(item));
+}
+function checksStateFromLifecycle(lifecycle) {
+  const state = lifecycle?.checksSummary?.status ?? lifecycle?.checks;
+  return state === "passing" || state === "failing" || state === "pending" ? state : void 0;
+}
+
 // apps/body/dist/runtime.js
-import { randomBytes as randomBytes5 } from "node:crypto";
-import { execFile } from "node:child_process";
+import { randomBytes as randomBytes6 } from "node:crypto";
+import { execFile as execFile2 } from "node:child_process";
 import { closeSync, openSync } from "node:fs";
-import { mkdir as mkdir3, readFile, readdir as readdir2, rename as rename2, stat, writeFile as writeFile3 } from "node:fs/promises";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname3, resolve as resolve9 } from "node:path";
+import { mkdir as mkdir5, readFile as readFile6, readdir as readdir3, rename as rename2, stat, writeFile as writeFile6 } from "node:fs/promises";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname5, resolve as resolve14 } from "node:path";
 import { spawn as spawn2 } from "node:child_process";
 import { promisify } from "node:util";
 
@@ -5608,7 +6504,7 @@ function createHasher(hashCons, info = {}) {
   Object.assign(hashC, info);
   return Object.freeze(hashC);
 }
-function randomBytes(bytesLength = 32) {
+function randomBytes2(bytesLength = 32) {
   anumber(bytesLength, "bytesLength");
   const cr = typeof globalThis === "object" ? globalThis.crypto : null;
   if (typeof cr?.getRandomValues !== "function")
@@ -5926,7 +6822,7 @@ var bytesToHex2 = bytesToHex;
 var concatBytes2 = (...arrays) => concatBytes(...arrays);
 var hexToBytes2 = (hex) => hexToBytes(hex);
 var isBytes2 = isBytes;
-var randomBytes2 = (bytesLength) => randomBytes(bytesLength);
+var randomBytes3 = (bytesLength) => randomBytes2(bytesLength);
 var _0n = /* @__PURE__ */ BigInt(0);
 var _1n = /* @__PURE__ */ BigInt(1);
 var atitle2 = (title) => title ? `"${title}" ` : "";
@@ -6518,18 +7414,18 @@ function validateTableBytes(numPoints, fpBytes) {
   if (bytes > TABLE_BYTES_MAX)
     throw new Error("invalid window size: table would need ~" + Math.ceil(bytes / 2 ** 20) + " MiB, max " + TABLE_BYTES_MAX / 2 ** 20 + " MiB");
 }
-function probeRandomBytes(randomBytes6, length) {
-  if (randomBytes6 === void 0)
+function probeRandomBytes(randomBytes7, length) {
+  if (randomBytes7 === void 0)
     return void 0;
-  afunction(randomBytes6, "randomBytes");
+  afunction(randomBytes7, "randomBytes");
   try {
-    const probe = randomBytes6(length);
+    const probe = randomBytes7(length);
     if (!isBytes2(probe) || probe.length !== length)
       return void 0;
   } catch {
     return void 0;
   }
-  return randomBytes6;
+  return randomBytes7;
 }
 function validateMSMPoints(points, c2) {
   aarray(points, "points");
@@ -6622,9 +7518,9 @@ var ScalarMultiplier = class {
   baseCanBeBlinded;
   bits;
   // Parametrized with a given Point class (not individual point)
-  constructor(Point, randomBytes6) {
+  constructor(Point, randomBytes7) {
     validatePointCons(Point);
-    this.randomBytes = probeRandomBytes(randomBytes6, BLIND_BYTES);
+    this.randomBytes = probeRandomBytes(randomBytes7, BLIND_BYTES);
     this.Point = Point;
     this.BASE = Point.BASE;
     this.ZERO = Point.ZERO;
@@ -6912,7 +7808,7 @@ function weierstrass(params, extraOpts = {}) {
     randomBytes: "function"
   });
   const { endo, allowInfinityPoint } = extraOpts;
-  const randomBytes6 = extraOpts.randomBytes === void 0 ? randomBytes2 : extraOpts.randomBytes;
+  const randomBytes7 = extraOpts.randomBytes === void 0 ? randomBytes3 : extraOpts.randomBytes;
   if (endo) {
     if (!Fp.is0(CURVE.a) || typeof endo.beta !== "bigint" || !Array.isArray(endo.basises)) {
       throw new Error('invalid endo: expected "beta": bigint and "basises": array');
@@ -7324,7 +8220,7 @@ function weierstrass(params, extraOpts = {}) {
     }
   }
   const normalize2 = (points) => normalizeZ(Point, points);
-  const wnaf = new ScalarMultiplier(Point, randomBytes6);
+  const wnaf = new ScalarMultiplier(Point, randomBytes7);
   if (wnaf.bits >= 6)
     Point.BASE.precompute(6);
   Object.freeze(Point.prototype);
@@ -7433,7 +8329,7 @@ function challenge(...args) {
 function schnorrGetPublicKey(secretKey) {
   return schnorrGetExtPubKey(secretKey).bytes;
 }
-function schnorrSign(message, secretKey, auxRand = randomBytes(32)) {
+function schnorrSign(message, secretKey, auxRand = randomBytes2(32)) {
   const { Fn, BASE } = Pointk1;
   const m2 = abytes2(message, void 0, "message");
   const { bytes: px, scalar: d } = schnorrGetExtPubKey(secretKey);
@@ -7483,7 +8379,7 @@ var schnorr = /* @__PURE__ */ (() => {
   const size = 32;
   const seedLength = 48;
   const randomSecretKey = (seed) => {
-    seed = seed === void 0 ? randomBytes(seedLength) : seed;
+    seed = seed === void 0 ? randomBytes2(seedLength) : seed;
     return mapHashToField(abytes2(seed, seedLength, "seed"), secp256k1_CURVE.n);
   };
   return Object.freeze({
@@ -7630,7 +8526,7 @@ function createHasher2(hashCons, info = {}) {
   Object.assign(hashC, info);
   return Object.freeze(hashC);
 }
-function randomBytes3(bytesLength = 32) {
+function randomBytes4(bytesLength = 32) {
   const cr = typeof globalThis === "object" ? globalThis.crypto : null;
   if (typeof cr?.getRandomValues !== "function")
     throw new Error("crypto.getRandomValues must be defined");
@@ -9326,7 +10222,7 @@ function getWLengths2(Fp, Fn) {
 }
 function ecdh(Point, ecdhOpts = {}) {
   const { Fn } = Point;
-  const randomBytes_ = ecdhOpts.randomBytes || randomBytes3;
+  const randomBytes_ = ecdhOpts.randomBytes || randomBytes4;
   const lengths = Object.assign(getWLengths2(Point.Fp, Fn), { seed: getMinHashLength2(Fn.ORDER) });
   function isValidSecretKey(secretKey) {
     try {
@@ -9391,7 +10287,7 @@ function ecdsa2(Point, hash, ecdsaOpts = {}) {
     bits2int_modN: "function"
   });
   ecdsaOpts = Object.assign({}, ecdsaOpts);
-  const randomBytes6 = ecdsaOpts.randomBytes || randomBytes3;
+  const randomBytes7 = ecdsaOpts.randomBytes || randomBytes4;
   const hmac2 = ecdsaOpts.hmac || ((key, msg) => hmac(hash, key, msg));
   const { Fp, Fn } = Point;
   const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
@@ -9533,7 +10429,7 @@ function ecdsa2(Point, hash, ecdsaOpts = {}) {
       throw new Error("invalid private key");
     const seedArgs = [int2octets(d), int2octets(h1int)];
     if (extraEntropy != null && extraEntropy !== false) {
-      const e = extraEntropy === true ? randomBytes6(lengths.secretKey) : extraEntropy;
+      const e = extraEntropy === true ? randomBytes7(lengths.secretKey) : extraEntropy;
       seedArgs.push(abytes3(e, void 0, "extraEntropy"));
     }
     const seed = concatBytes3(...seedArgs);
@@ -9700,7 +10596,7 @@ function challenge2(...args) {
 function schnorrGetPublicKey2(secretKey) {
   return schnorrGetExtPubKey2(secretKey).bytes;
 }
-function schnorrSign2(message, secretKey, auxRand = randomBytes3(32)) {
+function schnorrSign2(message, secretKey, auxRand = randomBytes4(32)) {
   const { Fn } = Pointk12;
   const m2 = abytes3(message, void 0, "message");
   const { bytes: px, scalar: d } = schnorrGetExtPubKey2(secretKey);
@@ -9742,7 +10638,7 @@ function schnorrVerify2(signature, message, publicKey) {
 var schnorr2 = /* @__PURE__ */ (() => {
   const size = 32;
   const seedLength = 48;
-  const randomSecretKey = (seed = randomBytes3(seedLength)) => {
+  const randomSecretKey = (seed = randomBytes4(seedLength)) => {
     return mapHashToField2(seed, secp256k1_CURVE2.n);
   };
   return {
@@ -12106,7 +13002,7 @@ function encrypt2(secretKey, pubkey, text2) {
   const privkey = secretKey instanceof Uint8Array ? secretKey : hexToBytes3(secretKey);
   const key = secp256k1.getSharedSecret(privkey, hexToBytes3("02" + pubkey));
   const normalizedKey = getNormalizedX(key);
-  let iv = Uint8Array.from(randomBytes3(16));
+  let iv = Uint8Array.from(randomBytes4(16));
   let plaintext = utf8Encoder.encode(text2);
   let ciphertext = cbc(normalizedKey, iv).encrypt(plaintext);
   let ctb64 = base64.encode(new Uint8Array(ciphertext));
@@ -12477,7 +13373,7 @@ function decodePayload(payload) {
     mac: data.subarray(-32)
   };
 }
-function encrypt22(plaintext, conversationKey, nonce = randomBytes3(32)) {
+function encrypt22(plaintext, conversationKey, nonce = randomBytes4(32)) {
   const { chacha_key, chacha_nonce, hmac_key } = getMessageKeys(conversationKey, nonce);
   const padded = pad(plaintext);
   const ciphertext = chacha20(chacha_key, chacha_nonce, padded);
@@ -13992,23 +14888,23 @@ function decodeNsec(nsec) {
 }
 
 // apps/body/dist/runtime.js
-var execFileAsync = promisify(execFile);
+var execFileAsync = promisify(execFile2);
 var DEFAULT_AGENT_IDENTITY_NAME = "beeline-agent";
 var DEFAULT_BODY_IDENTITY_NAME = "beeline-body";
 var DEFAULT_DAEMON_MONOLITH_BASE_URL = "https://server.usebeeline.app";
 function defaultSupervisorRoot(env = process.env) {
-  return resolve9(env.XDG_STATE_HOME ?? resolve9(homedir4(), ".local", "state"));
+  return resolve14(env.XDG_STATE_HOME ?? resolve14(homedir5(), ".local", "state"));
 }
 function runtimeDirectory(supervisorRoot, publicKey) {
   if (!/^[0-9a-f]{64}$/i.test(publicKey))
     throw new Error("invalid agent public key");
-  return resolve9(supervisorRoot, "beeline", "agents", publicKey.toLowerCase());
+  return resolve14(supervisorRoot, "beeline", "agents", publicKey.toLowerCase());
 }
 function runtimeConfigPath(supervisorRoot, publicKey) {
-  return resolve9(runtimeDirectory(supervisorRoot, publicKey), "runtime.json");
+  return resolve14(runtimeDirectory(supervisorRoot, publicKey), "runtime.json");
 }
 function identityFromKey(value, name) {
-  const secretKey = value ? value.startsWith("nsec1") ? decodeNsec(value) : Uint8Array.from(Buffer.from(value, "hex")) : randomBytes5(32);
+  const secretKey = value ? value.startsWith("nsec1") ? decodeNsec(value) : Uint8Array.from(Buffer.from(value, "hex")) : randomBytes6(32);
   if (secretKey.length !== 32)
     throw new Error("identity secret key must be 32 bytes");
   return { name, secretKey, publicKey: getPublicKey2(secretKey) };
@@ -14035,15 +14931,15 @@ function runtimeAgentCommand(runtime) {
 }
 async function writeRuntimeRecord(runtime) {
   const path = runtimeConfigPath(runtime.supervisorRoot, runtime.agent.publicKey);
-  await mkdir3(dirname3(path), { recursive: true, mode: 448 });
+  await mkdir5(dirname5(path), { recursive: true, mode: 448 });
   const staged = `${path}.${process.pid}.tmp`;
-  await writeFile3(staged, `${JSON.stringify(runtime, null, 2)}
+  await writeFile6(staged, `${JSON.stringify(runtime, null, 2)}
 `, { mode: 384 });
   await rename2(staged, path);
   return path;
 }
 async function readRuntimeRecord(path) {
-  const parsed = JSON.parse(await readFile(path, "utf8"));
+  const parsed = JSON.parse(await readFile6(path, "utf8"));
   if (parsed.version !== 2 || !parsed.agent || !parsed.body || !parsed.communityId) {
     throw new Error(`invalid agent runtime record: ${path}`);
   }
@@ -14061,7 +14957,7 @@ async function migrateRuntimeRecordAccessPolicy(path) {
   return { runtime, migrated: true };
 }
 async function stageMonolithAgentRuntime(input) {
-  const supervisorRoot = input.supervisorRoot ? resolve9(input.supervisorRoot) : defaultSupervisorRoot();
+  const supervisorRoot = input.supervisorRoot ? resolve14(input.supervisorRoot) : defaultSupervisorRoot();
   const configPath = runtimeConfigPath(supervisorRoot, input.agentIdentity.publicKey);
   const configuredBaseUrl = input.monolithBaseUrl ?? DEFAULT_DAEMON_MONOLITH_BASE_URL;
   const baseUrl = new URL(configuredBaseUrl).origin;
@@ -14106,9 +15002,9 @@ async function stageMonolithAgentRuntime(input) {
   return { runtime, configPath };
 }
 async function runtimePaths(root) {
-  const agents = resolve9(root, "beeline", "agents");
-  const entries = await readdir2(agents, { withFileTypes: true }).catch(() => []);
-  return entries.filter((entry) => entry.isDirectory()).map((entry) => resolve9(agents, entry.name, "runtime.json"));
+  const agents = resolve14(root, "beeline", "agents");
+  const entries = await readdir3(agents, { withFileTypes: true }).catch(() => []);
+  return entries.filter((entry) => entry.isDirectory()).map((entry) => resolve14(agents, entry.name, "runtime.json"));
 }
 async function findAgentRuntimeConfigPaths(env = process.env, _cwd = process.cwd()) {
   return runtimePaths(defaultSupervisorRoot(env));
@@ -14117,13 +15013,13 @@ async function findRuntimeConfigPaths(cwd = process.cwd(), env = process.env) {
   return findAgentRuntimeConfigPaths(env, cwd);
 }
 async function resolveRuntimeConfigPath(path) {
-  return resolve9(path);
+  return resolve14(path);
 }
 async function selectRuntimeConfigPaths(options) {
   const hostScope = true;
   const configs = await options.findHostRuntimes(options.cwd);
   const requestedPubkey = options.requestedPubkey;
-  const paths = requestedPubkey ? configs.filter((path) => dirname3(path).endsWith(requestedPubkey)) : [...new Set(configs)];
+  const paths = requestedPubkey ? configs.filter((path) => dirname5(path).endsWith(requestedPubkey)) : [...new Set(configs)];
   if (!paths.length)
     throw new Error(options.noRuntimeMessage(hostScope));
   if (options.requestedPubkey && paths.length > 1)
@@ -14132,7 +15028,7 @@ async function selectRuntimeConfigPaths(options) {
 }
 async function runtimeDaemonPid(configPath) {
   try {
-    const pid = Number((await readFile(resolve9(dirname3(configPath), "daemon.pid"), "utf8")).trim());
+    const pid = Number((await readFile6(resolve14(dirname5(configPath), "daemon.pid"), "utf8")).trim());
     if (!Number.isSafeInteger(pid) || pid <= 0)
       return null;
     process.kill(pid, 0);
@@ -14143,13 +15039,13 @@ async function runtimeDaemonPid(configPath) {
 }
 async function daemonIsThisRuntime(pid, configPath) {
   try {
-    const argv = (await readFile(`/proc/${pid}/cmdline`, "utf8")).split("\0").filter(Boolean);
+    const argv = (await readFile6(`/proc/${pid}/cmdline`, "utf8")).split("\0").filter(Boolean);
     const flag = argv.lastIndexOf("--config");
-    return flag > 0 && argv[flag - 1] === "daemon" && resolve9(argv[flag + 1]) === resolve9(configPath);
+    return flag > 0 && argv[flag - 1] === "daemon" && resolve14(argv[flag + 1]) === resolve14(configPath);
   } catch {
     try {
       const { stdout: stdout6 } = await execFileAsync("ps", ["-p", String(pid), "-o", "command="]);
-      return stdout6.includes(" daemon ") && stdout6.includes(resolve9(configPath));
+      return stdout6.includes(" daemon ") && stdout6.includes(resolve14(configPath));
     } catch {
       return false;
     }
@@ -14175,14 +15071,14 @@ async function stopRuntimeDaemon(path, opts = {}) {
   throw new Error(`agent daemon ${pid} did not stop after ${timeout}ms`);
 }
 async function launchRuntimeDaemon(configPath, opts = {}) {
-  const directory = dirname3(configPath);
-  await mkdir3(directory, { recursive: true, mode: 448 });
+  const directory = dirname5(configPath);
+  await mkdir5(directory, { recursive: true, mode: 448 });
   const foreground = opts.foreground === true;
-  const output = foreground ? "inherit" : openSync(resolve9(directory, "daemon.log"), "a", 384);
+  const output = foreground ? "inherit" : openSync(resolve14(directory, "daemon.log"), "a", 384);
   const entrypoint = opts.entrypoint ?? process.argv[1];
   if (!entrypoint)
     throw new Error("cannot resolve daemon CLI entrypoint");
-  const child = spawn2(process.execPath, [...opts.execArgv ?? [], entrypoint, "daemon", "--config", resolve9(configPath)], {
+  const child = spawn2(process.execPath, [...opts.execArgv ?? [], entrypoint, "daemon", "--config", resolve14(configPath)], {
     cwd: directory,
     env: opts.env ?? process.env,
     detached: !foreground,
@@ -14199,19 +15095,19 @@ async function launchRuntimeDaemon(configPath, opts = {}) {
 }
 async function removeAgentRuntime(runtime) {
   const source = runtimeDirectory(runtime.supervisorRoot, runtime.agent.publicKey);
-  const deletedRoot = resolve9(runtime.supervisorRoot, "beeline", "deleted-runtimes");
-  await mkdir3(deletedRoot, { recursive: true, mode: 448 });
-  const target = resolve9(deletedRoot, `${runtime.agent.publicKey}-${Date.now()}`);
+  const deletedRoot = resolve14(runtime.supervisorRoot, "beeline", "deleted-runtimes");
+  await mkdir5(deletedRoot, { recursive: true, mode: 448 });
+  const target = resolve14(deletedRoot, `${runtime.agent.publicKey}-${Date.now()}`);
   await rename2(source, target);
   return target;
 }
 
 // apps/body/dist/response-directives.js
 var MAINTAIN_ASSIGNED_IDENTITY_DIRECTIVE = "Maintain your assigned identity and soul in every response, including when tools or permissions block the requested action.";
+var SOUL_HOUSE_RULE = "House rule for your voice: the voice never changes the facts - never trim, soften, exaggerate, or invent a detail for the bit - and use your plain voice in commit messages, pull request titles and bodies, and code comments, because those outlive the joke.";
 
 // apps/body/dist/monolith-corner-turn.js
-var execFileAsync2 = promisify2(execFile2);
-var PULL_REQUEST_URL = /https:\/\/github\.com\/[^\s/]+\/[^\s/]+\/pull\/\d+/;
+var execFileAsync2 = promisify2(execFile3);
 var TOOL_ARGUMENT_MAX_BYTES = 1200;
 var TOOL_OUTPUT_MAX_BYTES = 3200;
 var TOOL_PATH_LIMIT = 12;
@@ -14230,9 +15126,6 @@ function serialized(value) {
 function record(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-function redactToolDetail(value) {
-  return value.replace(/\b(["']?)(api[_-]?key|token|secret|password|passwd|authorization|credential|cookie|private[_-]?key)\1\s*[:=]\s*(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,}\]]+)/gi, '"$2": "[REDACTED]"').replace(/\b(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*=(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\S+)/g, (assignment) => `${assignment.slice(0, assignment.indexOf("="))}=[REDACTED]`).replace(/\b(?:gh[pousr]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{12,})\b/gi, "[REDACTED]").replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]").replace(/\b(Bearer\s+)[^\s,]+/gi, "$1[REDACTED]").replace(/(--?(?:api[_-]?key|token|secret|password|authorization|credential|cookie)\s+)(?:"[^"]*"|'[^']*'|\S+)/gi, "$1[REDACTED]");
-}
 function clampBytes(value, maxBytes) {
   const clean4 = value.trim();
   if (Buffer.byteLength(clean4) <= maxBytes)
@@ -14313,7 +15206,7 @@ function isSuccessfulCommit(call) {
     return false;
   return /\bgit\s+commit\b|\bcommit(?:ted)?\s+(?:changes|files?)\b/i.test(`${call.title ?? ""} ${serialized(call.rawInput)}`);
 }
-async function cornerToolActivity(call, worktreePath) {
+async function cornerToolActivity(call, worktreePath, requestedBy) {
   const operation = oneLine(call.kind ?? "") || "tool";
   let title = oneLine(redactToolDetail(call.title ?? "")) || `${operation} tool`;
   if (isSuccessfulCommit(call)) {
@@ -14336,6 +15229,7 @@ async function cornerToolActivity(call, worktreePath) {
     status: resultStatus(call),
     ...argumentsSummary,
     ...output ? { output } : {},
+    ...requestedBy ? { requestedBy } : {},
     ...paths.length ? { files: paths.map((path) => ({ path })) } : {}
   };
 }
@@ -14348,6 +15242,8 @@ var MonolithCornerTurnLoop = class {
   agent;
   client;
   sessionId;
+  /** The live session's environment, read back for pi's own turn record. */
+  agentEnv = {};
   turnIdentityInstructions = "";
   busy = false;
   forcedStop = false;
@@ -14355,9 +15251,19 @@ var MonolithCornerTurnLoop = class {
   activityTail = Promise.resolve();
   /** Session scratch directory attachments are downloaded into (`TMPDIR/beeline-attachments`). */
   attachmentDir;
+  /** The turn in flight and who asked for it, for ledger rows and the grant runner. */
+  currentTurn;
+  memberNames = /* @__PURE__ */ new Map();
+  /** The last server check state that started a turn; the same state never starts another. */
+  lastChecksState;
   constructor(options) {
     this.options = options;
     this.agent = runtimeIdentity(options.runtime.agent);
+    options.grantRunner?.register(options.cornerId, {
+      workspaceId: options.workspaceId,
+      cwd: options.worktreePath,
+      turn: () => this.currentTurn
+    });
   }
   isBusy() {
     return this.busy;
@@ -14376,11 +15282,13 @@ var MonolithCornerTurnLoop = class {
       this.client.sessionCancel(this.sessionId);
     await this.options.scheduler.forceSuspend(this.options.cornerId);
   }
-  roster() {
-    return this.options.api.execute("getWorkspaceRoster", {
+  async roster() {
+    const roster = await this.options.api.execute("getWorkspaceRoster", {
       agentId: this.agent.publicKey,
       workspaceId: this.options.workspaceId
     });
+    this.memberNames = new Map(roster.members.map((member) => [member.identityId, member.name]));
+    return roster;
   }
   async activate() {
     if (this.client?.isAlive && this.sessionId)
@@ -14392,30 +15300,32 @@ var MonolithCornerTurnLoop = class {
       }),
       this.roster()
     ]);
-    await mkdir4(this.options.worktreePath, { recursive: true });
+    await mkdir6(this.options.worktreePath, { recursive: true });
+    const selection = configuration.model || configuration.effort ? { model: configuration.model, effort: configuration.effort } : this.options.config.modelSelection;
     const homeOverlay = this.options.config.agentHomeRoot ? await prepareRoomAgentHome({
       root: this.options.config.agentHomeRoot,
       sharedSkills: this.options.config.sharedSkills ?? [],
-      ...this.options.config.operatorHome ? { operatorHome: this.options.config.operatorHome } : {}
+      ...this.options.config.operatorHome ? { operatorHome: this.options.config.operatorHome } : {},
+      ...openRouterRoutingInput(this.options.config, selection, this.options.fetchImpl)
     }) : {};
     const command = this.options.config.agentCommand ?? this.options.config.agentBinary;
-    const selection = configuration.model || configuration.effort ? { model: configuration.model, effort: configuration.effort } : this.options.config.modelSelection;
     const agentEnv = {
       ...this.options.config.agentEnv,
       ...homeOverlay,
       GH_TOKEN: this.options.githubToken,
       GITHUB_TOKEN: this.options.githubToken
     };
+    this.agentEnv = agentEnv;
     const agentArgs = agentArgsWithModelSelection({
       kind: this.options.config.agentKind,
       command,
       args: this.options.config.agentArgs ?? []
     }, selection);
-    const operatorHome = this.options.config.operatorHome ?? homedir5();
+    const operatorHome = this.options.config.operatorHome ?? homedir6();
     const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
     this.attachmentDir = tmpDir ? join4(tmpDir, "beeline-attachments") : void 0;
     const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
-    await Promise.all(homeStateDirs.map((dir) => mkdir4(dir, { recursive: true })));
+    await Promise.all(homeStateDirs.map((dir) => mkdir6(dir, { recursive: true })));
     const spawnCommand = wrapAgentCommand({
       bwrapPath: this.options.config.bwrapPath,
       spec: {
@@ -14461,13 +15371,17 @@ var MonolithCornerTurnLoop = class {
         roomId: this.options.parentRoomId,
         workspaceId: this.options.workspaceId,
         cornerId: this.options.cornerId,
-        attachRoot: this.options.worktreePath
+        attachRoot: this.options.worktreePath,
+        ...this.options.grantRunnerEndpoint ? { grantRunner: this.options.grantRunnerEndpoint } : {}
       })
     ];
     const self = roster.members.find((member) => member.identityId === this.agent.publicKey);
     const persona = configuration.soul ?? self?.soul;
     const identityInstructions = `Your Beeline identity is ${self?.name ?? this.agent.name}.`;
-    const personaInstructions = persona?.instructions ? `Human-authored Workspace persona: ${persona.name}. ${persona.instructions}` : "";
+    const personaInstructions = [
+      ...persona?.instructions ? [`Human-authored Workspace persona: ${persona.name}. ${persona.instructions}`] : [],
+      SOUL_HOUSE_RULE
+    ].join("\n");
     this.turnIdentityInstructions = harnessHonorsSessionSystemPrompt(command) ? "" : [identityInstructions, personaInstructions].filter(Boolean).join("\n\n");
     const opened = await this.client.sessionNew({
       cwd: this.options.worktreePath,
@@ -14483,6 +15397,7 @@ var MonolithCornerTurnLoop = class {
         "Merge the PR yourself only after the checks-passed event shows every check green; if any check failed or is still running, say exactly which and stop - never merge red.",
         "If any human in this corner says hold or do not merge, do not merge until a later human explicitly resumes it.",
         "Do not tag the user when a corner turn finishes: the server posts the merge summary card and its push already cover completion. Tag a human only mid-turn, and only when you need a decision or input.",
+        'GitHub check and merge notes are server lines already in the corner: never restate them (no "checks passed", "CI is green", "PR ready for review"). On a checks turn, say nothing unless you act - a merge or a pushed fix - and then one short line about that.',
         "A human approval in the app asks the server to merge. When approval is pending, wait for the server close request instead of racing it with gh. If checks passed, no hold exists, and no approval is pending, merge the pull request yourself with gh.",
         "Never push directly to the target branch. Never merge a different pull request."
       ].filter(Boolean).join("\n\n")
@@ -14506,8 +15421,14 @@ var MonolithCornerTurnLoop = class {
       }
     };
   }
-  async prompt(requestId, trigger, attachments = []) {
+  async prompt(requestId, trigger, attachments = [], requestedById, restates) {
     const { api, cornerId } = this.options;
+    const spoken = (text2) => restates && isCornerStatusRestatement(text2, restates) ? "" : text2;
+    const requester = requestedById ? {
+      pubkey: requestedById,
+      ...this.memberNames.get(requestedById) ? { name: this.memberNames.get(requestedById) } : {}
+    } : void 0;
+    this.currentTurn = { requestId, ...requester ? { requester } : {} };
     await api.execute("postAgentTurnReceipt", {
       agentId: this.agent.publicKey,
       roomId: cornerId,
@@ -14526,6 +15447,9 @@ var MonolithCornerTurnLoop = class {
           this.attachmentDir && attachments.length ? deliverAttachments(attachments, join4(this.attachmentDir, requestId.replace(/[^\w-]/g, "_")), this.options.fetchImpl) : Promise.resolve([])
         ]);
         const names = new Map(roster.members.map((member) => [member.identityId, member.name]));
+        const requestedBy = requester && !requester.name && names.get(requester.pubkey) ? { ...requester, name: names.get(requester.pubkey) } : requester;
+        if (requestedBy)
+          this.currentTurn = { requestId, requester: requestedBy };
         const transcript = conversation.items.slice(-120).map((message) => `${names.get(message.authorId) ?? "Beeline"} [${message.type}]: ${message.body}`).join("\n");
         const prompt = [
           this.turnIdentityInstructions,
@@ -14557,7 +15481,7 @@ ${trigger}`, ...attachmentPromptLines(attachments, delivered)].join("\n"),
           const start = narrationPostedChars;
           narrationPostedChars = segmentEnd;
           narrationSegments += 1;
-          const trimmed = segment.trim();
+          const trimmed = spoken(segment.trim());
           if (!trimmed)
             return;
           this.activityTail = this.activityTail.catch(() => void 0).then(async () => {
@@ -14578,7 +15502,7 @@ ${trigger}`, ...attachmentPromptLines(attachments, delivered)].join("\n"),
               return;
             publishedToolCalls.add(key);
             this.activityTail = this.activityTail.catch(() => void 0).then(async () => {
-              const activity = await cornerToolActivity(call, this.options.worktreePath);
+              const activity = await cornerToolActivity(call, this.options.worktreePath, requestedBy);
               await api.execute("postAgentActivity", {
                 agentId: this.agent.publicKey,
                 roomId: cornerId,
@@ -14605,10 +15529,21 @@ ${trigger}`, ...attachmentPromptLines(attachments, delivered)].join("\n"),
         await this.activityTail;
         await this.draftTail;
         await this.activityTail;
-        const reply = stripAgentReplyPreamble(result.agentText).trim();
-        if (!reply)
-          throw new Error("ACP corner turn produced no durable reply");
-        const durableTail = narrationPostedChars > 0 ? stripAgentReplyPreamble(result.agentText.slice(narrationPostedChars)).trim() : reply;
+        let reply = stripAgentReplyPreamble(result.agentText).trim();
+        if (!reply) {
+          const explained = await explainEmptyAgentTurn({
+            agentLabel: this.options.config.agentCommand ?? this.options.config.agentBinary,
+            agentEnv: this.agentEnv,
+            sessionId,
+            result
+          });
+          reply = explained.recoveredText ? stripAgentReplyPreamble(explained.recoveredText).trim() : "";
+          if (!reply && !(restates && !isAccountOrProviderRefusal(explained.record))) {
+            throw new Error(explained.reason);
+          }
+          console.warn(`[thin-core] corner ${cornerId} turn ${requestId}: ${explained.reason}`);
+        }
+        const durableTail = spoken(narrationPostedChars > 0 ? stripAgentReplyPreamble(result.agentText.slice(narrationPostedChars)).trim() : reply);
         if (durableTail) {
           await api.execute("postRoomMessage", {
             roomId: cornerId,
@@ -14617,17 +15552,6 @@ ${trigger}`, ...attachmentPromptLines(attachments, delivered)].join("\n"),
             presentation: "message"
           });
         }
-        const pullRequest = reply.match(PULL_REQUEST_URL)?.[0];
-        const alreadyReady = conversation.items.some((item) => /\bPR ready for review\b/i.test(item.body));
-        if (pullRequest && !alreadyReady) {
-          await api.execute("postRoomMessage", {
-            roomId: cornerId,
-            requestId,
-            text: `PR ready for review
-${pullRequest}`,
-            presentation: "system"
-          });
-        }
         await api.execute("retractAgentLiveOutput", {
           agentId: this.agent.publicKey,
           roomId: cornerId,
@@ -14648,12 +15572,28 @@ ${pullRequest}`,
         roomId: cornerId,
         requestId,
         status: "failed",
-        generationId: `${this.agent.publicKey}:${cornerId}`
+        generationId: `${this.agent.publicKey}:${cornerId}`,
+        reason: distillTurnFailureReason(error)
       });
       throw error;
     } finally {
       this.busy = false;
+      this.currentTurn = void 0;
+    }
+  }
+  /** The server's check state for this head, or the notes' own verdict when the server carries none. */
+  async checksState(notes) {
+    try {
+      const restore = await this.options.api.execute("getCornerRestoreState", {
+        cornerId: this.options.cornerId
+      });
+      const fromServer = checksStateFromLifecycle(restore.lifecycle);
+      if (fromServer)
+        return fromServer;
+    } catch (error) {
+      console.error(`[thin-core] corner ${this.options.cornerId} check state read failed:`, error);
     }
+    return notes.some((note) => completedCheckNote(note) === "failed") ? "failing" : "passing";
   }
   async run() {
     const { api, cornerId, signal } = this.options;
@@ -14675,6 +15615,7 @@ ${pullRequest}`,
             await this.options.onCloseRequested();
             return;
           }
+          const checkNotes = [];
           for (const item of inbox.items) {
             if (item.type === "message") {
               if (item.authorId === this.agent.publicKey)
@@ -14685,12 +15626,30 @@ ${pullRequest}`,
               });
               if (!authority.member || authority.principalKind !== "human")
                 continue;
-              await this.prompt(item.id, item.body, item.attachments);
+              await this.prompt(item.id, item.body, item.attachments, item.authorId);
+              pollWithoutWait = true;
+              continue;
+            }
+            const grantDecision = item.type === "system" && item.mentionIds.includes(this.agent.publicKey) && parseGrantDecisionLine(item.body) !== void 0;
+            if (grantDecision) {
+              await this.prompt(item.id, `${item.body}
+This answers your grant request; resume the paused work. If approved and it is a command grant, run it with run_granted_command and the exact argv; if declined, try another way or say what you cannot do.`, [], item.authorId);
               pollWithoutWait = true;
               continue;
             }
-            if (/\bchecks?\b/i.test(item.body)) {
-              await this.prompt(item.id, item.body);
+            if (isCheckStartNote(item)) {
+              this.lastChecksState = void 0;
+              continue;
+            }
+            if (completedCheckNote(item))
+              checkNotes.push(item);
+          }
+          if (checkNotes.length) {
+            const state = await this.checksState(checkNotes);
+            if (state && state !== "pending" && state !== this.lastChecksState) {
+              this.lastChecksState = state;
+              const lines = checkNotes.map((note) => note.body);
+              await this.prompt(checkNotes[checkNotes.length - 1].id, lines.join("\n"), [], void 0, lines);
               pollWithoutWait = true;
             }
           }
@@ -14707,6 +15666,7 @@ ${pullRequest}`,
         }
       }
     } finally {
+      this.options.grantRunner?.unregister(cornerId);
       await this.options.scheduler.suspend(cornerId);
     }
   }
@@ -14726,13 +15686,13 @@ async function wait(ms, signal) {
 }
 
 // apps/body/dist/monolith-room-turn.js
-import { mkdir as mkdir5 } from "node:fs/promises";
-import { homedir as homedir6 } from "node:os";
+import { mkdir as mkdir7 } from "node:fs/promises";
+import { homedir as homedir7 } from "node:os";
 import { join as join5 } from "node:path";
 
 // packages/api-contract/dist/scheduled-prompts.js
 var SCHEDULE_SCHEDULER_NAME = "Beeline Scheduler";
-var SCHEDULED_PROMPT_PREFIX = "Scheduled: ";
+var SCHEDULE_RAN_VERB = "ran a schedule for";
 
 // apps/body/dist/monolith-room-turn.js
 function isRoomMcpPermissionRequest(request) {
@@ -14744,14 +15704,25 @@ function roomPrincipalMayAddressAgent(authority, humanPermitted) {
   return authority.member && (authority.principalKind === "agent" || authority.principalKind === "human" && humanPermitted);
 }
 function isScheduledPrompt(item, agentId) {
-  return item.type === "system" && item.body.startsWith(SCHEDULED_PROMPT_PREFIX) && item.mentionIds.includes(agentId);
+  return item.type === "system" && item.systemEvent?.verb === SCHEDULE_RAN_VERB && item.mentionIds.includes(agentId);
+}
+function inboxItemPromptBody(item, agentId) {
+  return isScheduledPrompt(item, agentId) ? item.systemEvent?.consequence ?? item.body : item.body;
+}
+function isGrantDecisionLine(item, agentId) {
+  return item.type === "system" && item.mentionIds.includes(agentId) && parseGrantDecisionLine(item.body) !== void 0;
 }
 function inboxItemTriggersTurn(item, agentId) {
   if (item.authorId === agentId)
     return false;
   if (!item.mentionIds.includes(agentId))
     return false;
-  return item.type === "message" || isScheduledPrompt(item, agentId);
+  return item.type === "message" || isScheduledPrompt(item, agentId) || isGrantDecisionLine(item, agentId);
+}
+function pendingGrantToolCall(call) {
+  if (!/(?:^|[._:/-])request_grant$/i.test(call.title ?? ""))
+    return false;
+  return /pending, card posted/i.test(typeof call.content === "string" ? call.content : JSON.stringify(call.content ?? ""));
 }
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -14789,6 +15760,8 @@ var MonolithRoomTurnLoop = class {
   agent;
   client;
   sessionId;
+  /** The live session's environment, read back for pi's own turn record. */
+  agentEnv = {};
   busy = false;
   turnInstructionPrefix = "";
   draftTail = Promise.resolve();
@@ -14798,13 +15771,36 @@ var MonolithRoomTurnLoop = class {
   attachmentDir;
   /** Local copies already delivered this session, by message id, so transcript renders reuse them. */
   deliveredAttachments = /* @__PURE__ */ new Map();
+  /** Names from the latest roster read, for ledger bylines the runner writes. */
+  memberNames = /* @__PURE__ */ new Map();
+  /** The request id of the turn that paused on a grant card, until its decision arrives. */
+  pausedOnGrantRequestId;
   constructor(options) {
     this.options = options;
     this.agent = runtimeIdentity(options.runtime.agent);
+    options.grantRunner?.register(options.roomId, {
+      workspaceId: options.workspaceId,
+      cwd: options.cwd,
+      turn: () => this.currentTurnForRunner()
+    });
   }
   isBusy() {
     return this.busy;
   }
+  /** The turn a `request_grant` paused, if any (cleared when its decision resumes it). */
+  pausedGrantRequestId() {
+    return this.pausedOnGrantRequestId;
+  }
+  currentTurnForRunner() {
+    const active = this.activeTurn;
+    if (!active)
+      return void 0;
+    return { requestId: active.item.id, requester: this.requesterOf(active.item.authorId) };
+  }
+  requesterOf(authorId) {
+    const name = this.memberNames.get(authorId);
+    return { pubkey: authorId, ...name ? { name } : {} };
+  }
   currentPrincipalCanDrive(_workspaceId, principalId) {
     return Promise.resolve(isSenderPermitted(this.options.config.accessPolicy ?? LEGACY_ACCESS_POLICY, principalId, this.options.config.accessOwnerPubkey, this.options.config.accessAllowlist));
   }
@@ -14818,11 +15814,13 @@ var MonolithRoomTurnLoop = class {
       this.client.sessionCancel(this.sessionId);
     await this.options.scheduler.forceSuspend(this.options.roomId);
   }
-  roster() {
-    return this.options.api.execute("getWorkspaceRoster", {
+  async roster() {
+    const roster = await this.options.api.execute("getWorkspaceRoster", {
       agentId: this.agent.publicKey,
       workspaceId: this.options.workspaceId
     });
+    this.memberNames = new Map(roster.members.map((member) => [member.identityId, member.name]));
+    return roster;
   }
   /** Download a message's attachments into the session scratch directory once. */
   async deliver(item) {
@@ -14847,25 +15845,27 @@ var MonolithRoomTurnLoop = class {
       this.options.api.execute("getRoomRepositoryState", { roomId: this.options.roomId })
     ]);
     const directMessage = Array.isArray(repositoryState.directParticipants) && repositoryState.directParticipants.length === 2;
-    await mkdir5(this.options.cwd, { recursive: true });
+    await mkdir7(this.options.cwd, { recursive: true });
+    const selection = configuration.model || configuration.effort ? { model: configuration.model, effort: configuration.effort } : this.options.config.modelSelection;
     const homeOverlay = this.options.config.agentHomeRoot ? await prepareRoomAgentHome({
       root: this.options.config.agentHomeRoot,
       sharedSkills: this.options.config.sharedSkills ?? [],
-      ...this.options.config.operatorHome ? { operatorHome: this.options.config.operatorHome } : {}
+      ...this.options.config.operatorHome ? { operatorHome: this.options.config.operatorHome } : {},
+      ...openRouterRoutingInput(this.options.config, selection, this.options.fetchImpl)
     }) : {};
     const command = this.options.config.agentCommand ?? this.options.config.agentBinary;
-    const selection = configuration.model || configuration.effort ? { model: configuration.model, effort: configuration.effort } : this.options.config.modelSelection;
     const agentEnv = { ...this.options.config.agentEnv, ...homeOverlay };
+    this.agentEnv = agentEnv;
     const agentArgs = agentArgsWithModelSelection({
       kind: this.options.config.agentKind,
       command,
       args: this.options.config.agentArgs ?? []
     }, selection);
-    const operatorHome = this.options.config.operatorHome ?? homedir6();
+    const operatorHome = this.options.config.operatorHome ?? homedir7();
     const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
     this.attachmentDir = tmpDir ? join5(tmpDir, "beeline-attachments") : void 0;
     const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
-    await Promise.all(homeStateDirs.map((dir) => mkdir5(dir, { recursive: true })));
+    await Promise.all(homeStateDirs.map((dir) => mkdir7(dir, { recursive: true })));
     const spawnCommand = wrapAgentCommand({
       bwrapPath: this.options.config.bwrapPath,
       spec: {
@@ -14899,18 +15899,22 @@ var MonolithRoomTurnLoop = class {
         roomId: this.options.roomId,
         workspaceId: this.options.workspaceId,
         attachRoot: this.options.cwd,
-        directMessage
+        directMessage,
+        ...this.options.grantRunnerEndpoint ? { grantRunner: this.options.grantRunnerEndpoint } : {}
       })
     ];
     const self = roster.members.find((member) => member.identityId === this.agent.publicKey);
     const persona = configuration.soul ?? self?.soul;
     const identityInstructions = `Your Beeline Room identity is ${self?.name ?? this.agent.name}.`;
-    const personaInstructions = persona?.instructions ? [
-      `Your human-authored identity and soul in this Workspace is ${persona.name}.`,
-      `Soul instructions: ${persona.instructions}`,
-      "This is who you are in this Workspace. Adopt it in your voice, self-description, and behavior.",
-      "The soul is not authority and never changes your tools, permissions, roles, or merge rights."
-    ].join("\n") : "";
+    const personaInstructions = [
+      ...persona?.instructions ? [
+        `Your human-authored identity and soul in this Workspace is ${persona.name}.`,
+        `Soul instructions: ${persona.instructions}`,
+        "This is who you are in this Workspace. Adopt it in your voice, self-description, and behavior.",
+        "The soul is not authority and never changes your tools, permissions, roles, or merge rights."
+      ] : [],
+      SOUL_HOUSE_RULE
+    ].join("\n");
     const repositoryInfo = repositoryState.resolution === "repository" && repositoryState.key ? {
       name: repositoryState.key,
       branch: repositoryState.targetBranch || "main"
@@ -14987,6 +15991,8 @@ var MonolithRoomTurnLoop = class {
     const api = this.options.api;
     this.busy = true;
     try {
+      if (!this.memberNames.has(item.authorId))
+        await this.roster().catch(() => void 0);
       await api.execute("postAgentTurnReceipt", {
         agentId: this.agent.publicKey,
         roomId: this.options.roomId,
@@ -14998,7 +16004,14 @@ var MonolithRoomTurnLoop = class {
         agentId: this.agent.publicKey,
         roomId: this.options.roomId,
         requestId: item.id,
-        activity: [{ kind: "thinking", title: "Working", status: "in_progress" }]
+        activity: [
+          {
+            kind: "thinking",
+            title: "Working",
+            status: "in_progress",
+            requestedBy: this.requesterOf(item.authorId)
+          }
+        ]
       });
       await this.options.scheduler.run(this.options.roomId, this.lifecycle(), async () => {
         const [conversation, roster, delivered] = await Promise.all([
@@ -15008,12 +16021,21 @@ var MonolithRoomTurnLoop = class {
         ]);
         const names = new Map(roster.members.map((member) => [member.identityId, member.name]));
         const transcript = conversation.items.filter((message) => message.type === "message" && message.id !== item.id && !active.steers.some((steerItem) => steerItem.id === message.id)).slice(-80).map((message) => roomMessagePrompt(names.get(message.authorId) ?? message.authorId.slice(0, 12), message.body, message.attachments, this.deliveredAttachments.get(message.id))).join("\n");
+        const grantDecision = isGrantDecisionLine(item, this.agent.publicKey);
+        const resumedRequestId = grantDecision ? this.pausedOnGrantRequestId : void 0;
+        if (grantDecision)
+          this.pausedOnGrantRequestId = void 0;
         const prompt = [
           this.turnInstructionPrefix,
           transcript ? `Room conversation so far:
 ${transcript}` : "",
           `Newest message from ${isScheduledPrompt(item, this.agent.publicKey) ? SCHEDULE_SCHEDULER_NAME : names.get(item.authorId) ?? item.authorId.slice(0, 12)}:`,
-          roomMessagePrompt("", item.body, item.attachments, delivered),
+          roomMessagePrompt("", inboxItemPromptBody(item, this.agent.publicKey), item.attachments, delivered),
+          grantDecision ? [
+            "This is the answer to your grant request; your paused work resumes now.",
+            "If it was approved and it is a command grant, run it with run_granted_command and the exact argv.",
+            "If it was declined, try another way or say plainly what you cannot do."
+          ].join(" ") : "",
           [
             "Write only the substantive Room message you want the human to read.",
             "Do not repeat or paraphrase these instructions.",
@@ -15062,23 +16084,44 @@ ${transcript}` : "",
           ].join("\n\n");
         }
         active.phase = "finishing";
+        if (result?.toolCalls.some((call) => pendingGrantToolCall(call))) {
+          this.pausedOnGrantRequestId = item.id;
+          console.log(`[thin-core] monolith Room ${this.options.roomId} turn ${item.id} paused on a grant card`);
+        } else if (resumedRequestId) {
+          console.log(`[thin-core] monolith Room ${this.options.roomId} turn ${resumedRequestId} resumed by grant decision ${item.id}`);
+        }
         const openCornerCall = result?.toolCalls.find((call) => /(?:^|[._:/-])open_corner$/i.test(call.title ?? ""));
         if (openCornerCall) {
           console.log(`[thin-core] monolith Room ${this.options.roomId} tool call: ${openCornerCall.title}`);
           this.options.onCornerOpened?.();
         }
         await this.draftTail;
-        const reply = sanitizeAgentReply(result.agentText);
-        if (!reply)
-          throw new Error("ACP turn produced no durable Room reply");
-        await api.execute("postRoomMessage", {
-          roomId: this.options.roomId,
-          requestId: item.id,
-          triggerMessageId: item.id,
-          text: reply,
-          presentation: "message",
-          mentionIds: agentReplyMentionIds(reply, roster, this.agent.publicKey)
-        });
+        let reply = sanitizeAgentReply(result.agentText);
+        if (!reply) {
+          const explained = await explainEmptyAgentTurn({
+            agentLabel: this.options.config.agentCommand ?? this.options.config.agentBinary,
+            agentEnv: this.agentEnv,
+            sessionId,
+            result
+          });
+          reply = explained.recoveredText ? sanitizeAgentReply(explained.recoveredText) : "";
+          if (!reply)
+            throw new Error(explained.reason);
+          console.warn(`[thin-core] monolith Room ${this.options.roomId} turn ${item.id}: ${explained.reason}`);
+        }
+        if (openCornerCall && !/failed|error|denied/i.test(openCornerCall.status ?? "")) {
+          reply = stripCornerOpenEcho(reply);
+        }
+        if (reply) {
+          await api.execute("postRoomMessage", {
+            roomId: this.options.roomId,
+            requestId: item.id,
+            triggerMessageId: item.id,
+            text: reply,
+            presentation: "message",
+            mentionIds: agentReplyMentionIds(reply, roster, this.agent.publicKey)
+          });
+        }
         await api.execute("retractAgentLiveOutput", {
           agentId: this.agent.publicKey,
           roomId: this.options.roomId,
@@ -15099,7 +16142,8 @@ ${transcript}` : "",
         roomId: this.options.roomId,
         requestId: item.id,
         status: "failed",
-        generationId: `${this.agent.publicKey}:${this.options.roomId}`
+        generationId: `${this.agent.publicKey}:${this.options.roomId}`,
+        reason: distillTurnFailureReason(error)
       });
       throw error;
     } finally {
@@ -15138,7 +16182,7 @@ ${transcript}` : "",
           for (const item of inbox.items) {
             if (!inboxItemTriggersTurn(item, this.agent.publicKey))
               continue;
-            if (!isScheduledPrompt(item, this.agent.publicKey)) {
+            if (!isScheduledPrompt(item, this.agent.publicKey) && !isGrantDecisionLine(item, this.agent.publicKey)) {
               const authority = await api.execute("getRoomAuthority", {
                 roomId,
                 principalId: item.authorId
@@ -15168,6 +16212,7 @@ ${transcript}` : "",
       }
     } finally {
       clearInterval(heartbeat);
+      this.options.grantRunner?.unregister(roomId);
       if (this.activeTurn?.phase === "prompting" && this.client && this.sessionId) {
         this.client.sessionCancel(this.sessionId);
       }
@@ -15547,7 +16592,7 @@ async function mapWithConcurrency(values, limit, visit) {
     }
   }));
 }
-var execFileAsync3 = promisify3(execFile3);
+var execFileAsync3 = promisify3(execFile4);
 var RoomRuntimeCoordinator = class {
   configPath;
   baseConfig;
@@ -15567,6 +16612,9 @@ var RoomRuntimeCoordinator = class {
   workspaceRemovalConfirmations = 0;
   roomRemovalConfirmations = /* @__PURE__ */ new Map();
   confirmationPending = false;
+  /** One command-grant runner per daemon; Rooms and corners register their checkouts on it. */
+  grantRunner;
+  grantRunnerServer;
   constructor(runtime, configPath, baseConfig, options) {
     this.configPath = configPath;
     this.baseConfig = baseConfig;
@@ -15576,6 +16624,11 @@ var RoomRuntimeCoordinator = class {
     this.runtime = runtime;
     this.agent = runtimeIdentity(runtime.agent);
     this.now = options.now ?? Date.now;
+    this.grantRunner = new GrantCommandRunner({
+      api: options.daemonApi,
+      agentId: this.agent.publicKey
+    });
+    this.grantRunnerServer = new GrantRunnerServer(this.grantRunner);
     this.watchdogStaleMs = options.watchdogStaleMs ?? DEFAULT_ROOM_WATCHDOG_STALE_MS;
     this.reconcileHeartbeatMs = options.reconcileHeartbeatMs ?? DEFAULT_RECONCILE_HEARTBEAT_MS;
     this.drainDeadlineMs = options.drainDeadlineMs ?? DEFAULT_DRAIN_DEADLINE_MS;
@@ -15602,7 +16655,15 @@ var RoomRuntimeCoordinator = class {
     return this.reconcileHeartbeatMs;
   }
   isWorkspaceIdle() {
-    return [...this.running.values()].every((room) => !room.body.isBusy());
+    return this.activeTurnCount() === 0;
+  }
+  /** Turns executing right now. Serving a Room or corner with no turn in flight is idle. */
+  activeTurnCount() {
+    let count = 0;
+    for (const room of this.running.values())
+      if (room.body.isBusy())
+        count += 1;
+    return count;
   }
   quiesceForUpdateIfIdle() {
     if (!this.isWorkspaceIdle())
@@ -15698,13 +16759,13 @@ var RoomRuntimeCoordinator = class {
     return this.runtime.rooms.find((room) => room.channelId === roomId);
   }
   roomRoot(roomId) {
-    return this.roomRecord(roomId)?.root ?? resolve10(dirname4(this.configPath), "rooms", roomId);
+    return this.roomRecord(roomId)?.root ?? resolve15(dirname6(this.configPath), "rooms", roomId);
   }
   roomAgentHomeRoot(workspaceRoot, required = false) {
     const flag = process.env.BUZZY_BODY_ROOM_HOME;
     if (!required && flag === "0")
       return void 0;
-    const home = resolve10(workspaceRoot, "agent-home");
+    const home = resolve15(workspaceRoot, "agent-home");
     if (!required && flag !== "1" && !existsSync4(home) && existsSync4(workspaceRoot))
       return void 0;
     try {
@@ -15721,19 +16782,30 @@ var RoomRuntimeCoordinator = class {
     return {
       ...this.baseConfig,
       workspaceRoot,
-      agentPrivateRoot: resolve10(workspaceRoot, "agent-private"),
-      agentMemoryRoot: resolve10(dirname4(this.configPath), "memory"),
+      agentPrivateRoot: resolve15(workspaceRoot, "agent-private"),
+      agentMemoryRoot: resolve15(dirname6(this.configPath), "memory"),
+      openRouterRoutingCacheDir: openRouterRoutingCacheDir(dirname6(this.configPath)),
       ...agentHomeRoot ? { agentHomeRoot } : {}
     };
   }
+  /** The loopback door for run_granted_command; started once, on first use. */
+  grantRunnerEndpoint() {
+    return this.grantRunnerServer.start().catch((error) => {
+      console.error("[thin-core] grant runner unavailable; run_granted_command is off:", error);
+      return void 0;
+    });
+  }
   async startRoom(roomId) {
     const controller = new AbortController();
     const cwd = await this.materializeRoomCheckout(roomId);
+    const grantRunnerEndpoint = await this.grantRunnerEndpoint();
     const startedAt = this.now();
     const loop = new MonolithRoomTurnLoop({
       roomId,
       workspaceId: this.runtime.communityId,
       cwd,
+      grantRunner: this.grantRunner,
+      ...grantRunnerEndpoint ? { grantRunnerEndpoint } : {},
       runtime: this.runtime,
       config: this.roomConfig(roomId),
       api: this.options.daemonApi,
@@ -15778,12 +16850,12 @@ var RoomRuntimeCoordinator = class {
       return this.roomRoot(roomId);
     const remote = roomCheckoutRemote(repository.remote);
     const targetBranch = repository.targetBranch || "main";
-    const checkoutId = createHash("sha256").update(`${remote}\0${targetBranch}`).digest("hex").slice(0, 24);
-    const path = resolve10(this.runtime.supervisorRoot, "beeline", "room-checkouts", checkoutId);
-    await mkdir6(dirname4(path), { recursive: true, mode: 448 });
+    const checkoutId = createHash2("sha256").update(`${remote}\0${targetBranch}`).digest("hex").slice(0, 24);
+    const path = resolve15(this.runtime.supervisorRoot, "beeline", "room-checkouts", checkoutId);
+    await mkdir8(dirname6(path), { recursive: true, mode: 448 });
     const token = remote.startsWith("https://github.com/") ? await this.options.daemonApi.execute("getRoomGitHubToken", { roomId }) : void 0;
     const env = token ? githubGitEnv(token.token) : process.env;
-    if (!existsSync4(resolve10(path, ".git"))) {
+    if (!existsSync4(resolve15(path, ".git"))) {
       await execFileAsync3("git", ["clone", "--no-checkout", remote, path], {
         env,
         maxBuffer: 4 * 1024 * 1024
@@ -15845,9 +16917,12 @@ var RoomRuntimeCoordinator = class {
         });
       }
       const controller = new AbortController();
+      const grantRunnerEndpoint = await this.grantRunnerEndpoint();
       const startedAt = this.now();
       const loop = new MonolithCornerTurnLoop({
         cornerId: corner.cornerId,
+        grantRunner: this.grantRunner,
+        ...grantRunnerEndpoint ? { grantRunnerEndpoint } : {},
         parentRoomId: corner.parentRoomId,
         workspaceId: this.runtime.communityId,
         objective,
@@ -15900,13 +16975,13 @@ var RoomRuntimeCoordinator = class {
   }
   async materializeCornerWorktree(input) {
     const remote = githubHttpsRemote(input.remote);
-    const repositoryHash = createHash("sha256").update(remote).digest("hex").slice(0, 24);
-    const gitCommonDir = resolve10(this.runtime.supervisorRoot, "beeline", "repositories", `${repositoryHash}.git`);
-    const path = resolve10(this.runtime.supervisorRoot, "beeline", "corners", input.cornerId);
-    await mkdir6(dirname4(gitCommonDir), { recursive: true, mode: 448 });
-    await mkdir6(dirname4(path), { recursive: true, mode: 448 });
+    const repositoryHash = createHash2("sha256").update(remote).digest("hex").slice(0, 24);
+    const gitCommonDir = resolve15(this.runtime.supervisorRoot, "beeline", "repositories", `${repositoryHash}.git`);
+    const path = resolve15(this.runtime.supervisorRoot, "beeline", "corners", input.cornerId);
+    await mkdir8(dirname6(gitCommonDir), { recursive: true, mode: 448 });
+    await mkdir8(dirname6(path), { recursive: true, mode: 448 });
     const authEnv = githubGitEnv(input.token);
-    if (!existsSync4(resolve10(gitCommonDir, "HEAD"))) {
+    if (!existsSync4(resolve15(gitCommonDir, "HEAD"))) {
       await execFileAsync3("git", ["clone", "--bare", remote, gitCommonDir], {
         env: authEnv,
         maxBuffer: 4 * 1024 * 1024
@@ -15919,7 +16994,7 @@ var RoomRuntimeCoordinator = class {
       "origin",
       `+refs/heads/${input.targetBranch}:refs/remotes/origin/${input.targetBranch}`
     ], { env: authEnv, maxBuffer: 4 * 1024 * 1024 });
-    if (!existsSync4(resolve10(path, ".git"))) {
+    if (!existsSync4(resolve15(path, ".git"))) {
       await rm3(path, { recursive: true, force: true });
       await execFileAsync3("git", [
         `--git-dir=${gitCommonDir}`,
@@ -15956,7 +17031,7 @@ var RoomRuntimeCoordinator = class {
       `${this.agent.publicKey.slice(0, 16)}@users.noreply.github.com`
     ]);
     const top = await execFileAsync3("git", ["-C", path, "rev-parse", "--show-toplevel"]);
-    if (resolve10(top.stdout.trim()) !== resolve10(path)) {
+    if (resolve15(top.stdout.trim()) !== resolve15(path)) {
       throw new Error(`corner worktree escaped its isolated root: ${top.stdout.trim()}`);
     }
     return { path, gitCommonDir };
@@ -16023,6 +17098,7 @@ var RoomRuntimeCoordinator = class {
       await Promise.allSettled(rooms.map((room) => room.body.forceRecoverRoom()));
       await drained;
     }
+    await this.grantRunnerServer.close();
     await this.scheduler.dispose();
   }
 };
@@ -16081,6 +17157,9 @@ var ThinDaemonCore = class {
   isWorkspaceIdle() {
     return this.roomRuntime.isWorkspaceIdle();
   }
+  activeTurnCount() {
+    return this.roomRuntime.activeTurnCount();
+  }
   quiesceForUpdateIfIdle() {
     return this.roomRuntime.quiesceForUpdateIfIdle();
   }
@@ -16127,7 +17206,7 @@ var ThinDaemonCore = class {
 };
 
 // apps/body/dist/daemon-api-client.js
-import { resolve as resolve11 } from "node:path";
+import { resolve as resolve16 } from "node:path";
 var DaemonApiError = class extends Error {
   status;
   retryable;
@@ -16186,8 +17265,8 @@ var DaemonApiClient = class {
 };
 async function activateDaemonTransport(path, fetchImpl = fetch) {
   const runtime = await readRuntimeRecord(path);
-  const expectedPath = resolve11(runtimeDirectory(runtime.supervisorRoot, runtime.agent.publicKey), "runtime.json");
-  if (resolve11(path) !== expectedPath) {
+  const expectedPath = resolve16(runtimeDirectory(runtime.supervisorRoot, runtime.agent.publicKey), "runtime.json");
+  if (resolve16(path) !== expectedPath) {
     throw new Error(`refusing daemon token exchange outside canonical runtime path: ${path}`);
   }
   const transport = runtime.transport;
@@ -16226,17 +17305,17 @@ async function activateDaemonTransport(path, fetchImpl = fetch) {
 }
 
 // apps/body/dist/start-command.js
-import { dirname as dirname6 } from "node:path";
+import { dirname as dirname8 } from "node:path";
 var import_picocolors = __toESM(require_picocolors(), 1);
 
 // apps/body/dist/systemd.js
-import { execFile as execFile4 } from "node:child_process";
-import { mkdir as mkdir7, readFile as readFile2, writeFile as writeFile4 } from "node:fs/promises";
-import { homedir as homedir7 } from "node:os";
-import { dirname as dirname5, resolve as resolve12 } from "node:path";
+import { execFile as execFile5 } from "node:child_process";
+import { mkdir as mkdir9, readFile as readFile7, writeFile as writeFile7 } from "node:fs/promises";
+import { homedir as homedir8 } from "node:os";
+import { dirname as dirname7, resolve as resolve17 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { promisify as promisify4 } from "node:util";
-var execFileAsync4 = promisify4(execFile4);
+var execFileAsync4 = promisify4(execFile5);
 var DELIBERATE_REMOVAL_EXIT_STATUS = 78;
 var DAEMON_DISTRESS_EXIT_STATUS = 77;
 var UNKNOWN_AGENT_EXIT_STATUS = 79;
@@ -16274,10 +17353,10 @@ WantedBy=default.target
 `;
 }
 function isCanonicalInstalledLauncher(env = process.env, invocationPath = process.argv[1]) {
-  const home = env.HOME?.trim() || homedir7();
-  const expectedLibDir = resolve12(home, ".local", "lib", "beeline");
+  const home = env.HOME?.trim() || homedir8();
+  const expectedLibDir = resolve17(home, ".local", "lib", "beeline");
   const expectedPrefix = `${expectedLibDir}/`;
-  return resolve12(env.BEELINE_LIB_DIR?.trim() || "/") === expectedLibDir && Boolean(invocationPath) && resolve12(invocationPath).startsWith(expectedPrefix);
+  return resolve17(env.BEELINE_LIB_DIR?.trim() || "/") === expectedLibDir && Boolean(invocationPath) && resolve17(invocationPath).startsWith(expectedPrefix);
 }
 function assertCanonicalInstalledLauncher(env, invocationPath) {
   if (isCanonicalInstalledLauncher(env, invocationPath))
@@ -16285,8 +17364,8 @@ function assertCanonicalInstalledLauncher(env, invocationPath) {
   throw new Error("refusing to modify the shared Beeline systemd unit outside the canonical ~/.local/bin/beeline launcher");
 }
 function systemdUserUnitPath(env = process.env) {
-  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve12(homedir7(), ".config");
-  return resolve12(configRoot, "systemd", "user", SYSTEMD_UNIT_NAME);
+  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve17(homedir8(), ".config");
+  return resolve17(configRoot, "systemd", "user", SYSTEMD_UNIT_NAME);
 }
 var runSystemctl = async (args) => {
   const result = await execFileAsync4("systemctl", ["--user", ...args], {
@@ -16302,10 +17381,10 @@ async function installAgentService(publicKey, options = {}) {
   assertCanonicalInstalledLauncher(env, options.invocationPath);
   const path = systemdUserUnitPath(env);
   const content = agentServiceUnit();
-  const existing = await readFile2(path, "utf8").catch(() => "");
+  const existing = await readFile7(path, "utf8").catch(() => "");
   if (existing !== content) {
-    await mkdir7(dirname5(path), { recursive: true, mode: 448 });
-    await writeFile4(path, content, { mode: 384 });
+    await mkdir9(dirname7(path), { recursive: true, mode: 448 });
+    await writeFile7(path, content, { mode: 384 });
   }
   const run2 = options.run ?? runSystemctl;
   await run2(["daemon-reload"]);
@@ -16357,6 +17436,9 @@ async function notify(fields) {
     return;
   await execFileAsync4("systemd-notify", fields, { timeout: SYSTEMD_COMMAND_TIMEOUT_MS });
 }
+async function extendSystemdStartTimeout(ms) {
+  await notify([`EXTEND_TIMEOUT_USEC=${Math.max(0, Math.round(ms)) * 1e3}`]).catch(() => void 0);
+}
 var SystemdNotifier = class {
   async ready(status) {
     await notify(["--ready", `--status=${status}`]);
@@ -16443,7 +17525,7 @@ async function runStartCommand(args, interactiveUi) {
       continue;
     }
     const spinnerHandle = spinner();
-    spinnerHandle.start(`Starting ${dirname6(path)}\u2026`);
+    spinnerHandle.start(`Starting ${dirname8(path)}\u2026`);
     try {
       await startRuntime(path, spinnerHandle);
       spinnerHandle.stop(import_picocolors.default.green("Started."));
@@ -16459,9 +17541,9 @@ async function runStartCommand(args, interactiveUi) {
 
 // apps/body/dist/connect-command.js
 import { spawn as spawn5 } from "node:child_process";
-import { createHash as createHash3 } from "node:crypto";
-import { chmod as chmod4, mkdir as mkdir10, readFile as readFile5, unlink as unlink2, writeFile as writeFile7 } from "node:fs/promises";
-import { dirname as dirname9, resolve as resolve15 } from "node:path";
+import { createHash as createHash4 } from "node:crypto";
+import { chmod as chmod4, mkdir as mkdir11, readFile as readFile9, unlink as unlink2, writeFile as writeFile9 } from "node:fs/promises";
+import { dirname as dirname10, resolve as resolve19 } from "node:path";
 import { stdin as stdin3, stdout as stdout4 } from "node:process";
 
 // packages/api-contract/dist/agent-pairing-code.js
@@ -16771,63 +17853,6 @@ async function pairDevice(grant, options = {}) {
   return { runtime: activated.runtime, configPath: staged.configPath, pid };
 }
 
-// apps/body/dist/provider-key-store.js
-import { chmod as chmod2, mkdir as mkdir8, readFile as readFile3, writeFile as writeFile5 } from "node:fs/promises";
-import { homedir as homedir8 } from "node:os";
-import { dirname as dirname7, resolve as resolve13 } from "node:path";
-var PROVIDER_KEY_ENV_VARS = {
-  openrouter: "OPENROUTER_API_KEY",
-  openai: "OPENAI_API_KEY",
-  anthropic: "ANTHROPIC_API_KEY",
-  google: "GOOGLE_API_KEY",
-  xai: "XAI_API_KEY"
-};
-var GOOGLE_ENV_ALIAS = "GEMINI_API_KEY";
-function providerKeyStorePath(env = process.env) {
-  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve13(homedir8(), ".config");
-  return resolve13(configRoot, "beeline", "providers.json");
-}
-async function readProviderKeyStore(env = process.env) {
-  const path = providerKeyStorePath(env);
-  const raw = await readFile3(path, "utf8").catch(() => void 0);
-  if (!raw)
-    return {};
-  try {
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-      return {};
-    const entries = Object.entries(parsed).filter((entry) => entry[0] in PROVIDER_KEY_ENV_VARS && typeof entry[1] === "string" && entry[1].length > 0);
-    return Object.fromEntries(entries);
-  } catch {
-    return {};
-  }
-}
-async function readSavedProviderKey(provider, env = process.env) {
-  return (await readProviderKeyStore(env))[provider];
-}
-async function saveProviderKey(provider, key, env = process.env) {
-  const path = providerKeyStorePath(env);
-  const store = { ...await readProviderKeyStore(env), [provider]: key };
-  await mkdir8(dirname7(path), { recursive: true, mode: 448 });
-  await writeFile5(path, `${JSON.stringify(store, null, 2)}
-`, { mode: 384 });
-  await chmod2(path, 384);
-}
-function providerKeyFromEnvironment(provider, env = process.env) {
-  const primary = env[PROVIDER_KEY_ENV_VARS[provider]]?.trim();
-  if (primary)
-    return primary;
-  if (provider === "google")
-    return env[GOOGLE_ENV_ALIAS]?.trim() || void 0;
-  return void 0;
-}
-function maskProviderKey(key) {
-  const trimmed = key.trim();
-  if (trimmed.length <= 9)
-    return "\u2026";
-  return `${trimmed.slice(0, 6)}\u2026${trimmed.slice(-3)}`;
-}
-
 // apps/body/dist/connect-command.js
 init_self_update();
 init_self_update_manifest();
@@ -16874,14 +17899,32 @@ function brassEnabled(env, output) {
     return "256";
   return "plain";
 }
+var BRASS_TRUECOLOR = "\x1B[38;2;215;175;95m";
+var BRASS_256 = "\x1B[38;5;179m";
 function brass(value, env = process.env, output = stdout4) {
   const level = brassEnabled(env, output);
   if (level === "truecolor")
-    return `\x1B[38;2;194;147;60m${value}\x1B[39m`;
+    return `${BRASS_TRUECOLOR}${value}\x1B[39m`;
   if (level === "256")
-    return `\x1B[38;5;178m${value}\x1B[39m`;
+    return `${BRASS_256}${value}\x1B[39m`;
   return value;
 }
+function brassRails(text2, env = process.env, output = stdout4) {
+  const level = brassEnabled(env, output);
+  if (level === "plain")
+    return text2;
+  return text2.replace(/\u001b\[(?:36|96)m/g, level === "truecolor" ? BRASS_TRUECOLOR : BRASS_256);
+}
+function paintWizardBrass(output = stdout4) {
+  const original = output.write;
+  const patched = function write(chunk, ...rest) {
+    return original.call(this, typeof chunk === "string" ? brassRails(chunk, process.env, output) : chunk, ...rest);
+  };
+  output.write = patched;
+  return () => {
+    output.write = original;
+  };
+}
 var clackPrompts = {
   async select(input) {
     clackPromptOutput();
@@ -16906,12 +17949,12 @@ var clackPrompts = {
     }), "Connection cancelled.");
   }
 };
-function connectModelPickerFromAxes(axes, fallbackModel, harness) {
+function connectModelPickerFromAxes(axes, fallbackModel, harness, rawAxes = axes) {
   const filtered = axes.find((axis) => axis.category === "model");
   if (filtered?.options.length) {
     return { currentValue: filtered.currentValue, options: filtered.options };
   }
-  const raw = axes.find((axis) => axis.category === "model" && axis.options.length);
+  const raw = rawAxes.find((axis) => axis.category === "model" && axis.options.length);
   if (raw) {
     return { currentValue: raw.currentValue, options: raw.options };
   }
@@ -16929,7 +17972,7 @@ async function loadConnectModelCatalog(input) {
     ...input.apiKey ? { apiKey: input.apiKey } : {},
     model: defaultConnectModel(input.harness, input.provider)
   }));
-  return connectModelPickerFromAxes(catalog.catalog, defaultConnectModel(input.harness, input.provider), input.harness);
+  return connectModelPickerFromAxes(catalog.catalog, defaultConnectModel(input.harness, input.provider), input.harness, catalog.raw);
 }
 async function collectConnectWizard(prompts = clackPrompts, loadModels = loadConnectModelCatalog, keyStore = fileConnectKeyStore, env = process.env, verifyKey = (input) => verifyProviderKey(input)) {
   const harness = await prompts.select({
@@ -17006,25 +18049,11 @@ async function collectConnectWizard(prompts = clackPrompts, loadModels = loadCon
     placeholder: "Type to filter available models\u2026",
     maxItems: 12
   });
-  const name = await prompts.text({
-    message: brass("Agent name"),
-    validate: (value) => {
-      if (!value.trim())
-        return "Agent name is required";
-      return isReasonableAgentName(value) ? void 0 : `Use letters, spaces, hyphens, or apostrophes (${AGENT_NAME_MAX_LENGTH} characters max)`;
-    }
-  });
-  const soul = await prompts.text({
-    message: brass("Input soul"),
-    validate: (value) => value.trim() ? void 0 : "Soul is required"
-  });
   return {
-    name: name.trim().replace(/\s+/g, " "),
     harness,
     ...provider ? { provider } : {},
     ...apiKey ? { apiKey: apiKey.trim() } : {},
-    model: model.trim(),
-    soul: soul.trim()
+    model: model.trim()
   };
 }
 async function jsonRequest(url, body, fetchImpl) {
@@ -17044,17 +18073,25 @@ function requestConnectGrant(baseUrl, pairingCode, selection, fetchImpl) {
   const normalizedPairingCode = normalizeAgentPairingCode(pairingCode);
   if (!normalizedPairingCode)
     throw new Error("invalid pairing code");
-  const avatarSeed = createHash3("sha256").update(normalizedPairingCode.toUpperCase()).digest("hex").slice(0, 32);
+  const avatarSeed = createHash4("sha256").update(normalizedPairingCode.toUpperCase()).digest("hex").slice(0, 32);
   return jsonRequest(`${baseUrl}/auth/agent/connect`, {
     pairing_code: normalizedPairingCode,
     harness: selection.harness,
     ...selection.provider ? { provider: selection.provider } : {},
     model: selection.model,
-    soul: selection.soul,
-    avatar_seed: avatarSeed,
-    agent_name: selection.name
+    avatar_seed: avatarSeed
   }, fetchImpl);
 }
+async function renameConnectedAgent(baseUrl, pairingCode, name, fetchImpl) {
+  const normalizedPairingCode = normalizeAgentPairingCode(pairingCode);
+  if (!normalizedPairingCode)
+    throw new Error("invalid pairing code");
+  const renamed = await jsonRequest(`${baseUrl}/auth/agent/connect/name`, { pairing_code: normalizedPairingCode, agent_name: name.trim().replace(/\s+/g, " ") }, fetchImpl);
+  return renamed.agent_name;
+}
+function seededIdentityLine(grant) {
+  return grant.agent_face ? `${grant.agent_name} the ${grant.agent_face}` : grant.agent_name;
+}
 async function installCurrentRelease(fetchImpl) {
   const manifestUrl = resolveManifestUrl(process.env);
   const response = await fetchImpl(manifestUrl, { signal: AbortSignal.timeout(3e4) });
@@ -17069,7 +18106,7 @@ async function installCurrentRelease(fetchImpl) {
   });
   await activateRelease(layout, releaseId);
   return {
-    binary: resolve15(layout.binDir, "beeline"),
+    binary: resolve19(layout.binDir, "beeline"),
     version: published.version ?? releaseId
   };
 }
@@ -17092,8 +18129,8 @@ function providerEnvironment(selection) {
   };
 }
 async function writePrivateJson(path, value) {
-  await mkdir10(dirname9(path), { recursive: true, mode: 448 });
-  await writeFile7(path, `${JSON.stringify(value, null, 2)}
+  await mkdir11(dirname10(path), { recursive: true, mode: 448 });
+  await writeFile9(path, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
   await chmod4(path, 384);
 }
@@ -17101,10 +18138,10 @@ async function writeProviderEnv(selection, agentPubkey) {
   const values = providerEnvironment(selection);
   if (Object.keys(values).length === 0)
     return void 0;
-  const path = resolve15(defaultSupervisorRoot(process.env), "beeline", "connect", `${agentPubkey}.env`);
-  await mkdir10(dirname9(path), { recursive: true, mode: 448 });
+  const path = resolve19(defaultSupervisorRoot(process.env), "beeline", "connect", `${agentPubkey}.env`);
+  await mkdir11(dirname10(path), { recursive: true, mode: 448 });
   const contents = Object.entries(values).map(([key, value]) => `${key}=${JSON.stringify(value)}`).join("\n");
-  await writeFile7(path, `${contents}
+  await writeFile9(path, `${contents}
 `, { mode: 384 });
   await chmod4(path, 384);
   return path;
@@ -17147,18 +18184,26 @@ async function runConnectCommand(code, options = {}) {
   if (!stdin3.isTTY || !stdout4.isTTY) {
     throw new Error("`usebeeline connect` needs an interactive terminal");
   }
+  const restoreRails = paintWizardBrass();
+  try {
+    await runConnectWizard(code, options.fetchImpl ?? fetch);
+  } finally {
+    restoreRails();
+  }
+}
+async function runConnectWizard(code, fetchImpl) {
   intro(brass("Beeline connect"));
-  const fetchImpl = options.fetchImpl ?? fetch;
   const pairingCode = code?.trim() || await clackPrompts.text({
     message: brass("Pairing code from the app"),
     validate: (value) => normalizeAgentPairingCode(value) ? void 0 : "Enter the pairing code shown in the app"
   });
   const selection = await collectConnectWizard(clackPrompts, loadConnectModelCatalog, fileConnectKeyStore, process.env, (input) => verifyProviderKey({ ...input, fetchImpl }));
   const baseUrl = (process.env.BEELINE_AUTH_URL ?? "https://server.usebeeline.app").replace(/\/$/, "");
-  const grant = await brassSpinner("Connecting to your Beeline Workspace\u2026", () => requestConnectGrant(baseUrl, pairingCode, selection, fetchImpl), (connectedGrant) => `Connected to ${connectedGrant.workspace_name}`);
+  const claimed = await brassSpinner("Connecting to your Beeline Workspace\u2026", () => requestConnectGrant(baseUrl, pairingCode, selection, fetchImpl), (connectedGrant) => `Connected to ${connectedGrant.workspace_name}`);
+  const grant = { ...claimed, agent_name: await confirmSeededName(baseUrl, pairingCode, claimed, fetchImpl) };
   const installedRelease = await brassSpinner("Installing the Beeline daemon\u2026", () => installCurrentRelease(fetchImpl), (release) => `Installed Beeline helper ${release.version}`);
   const llmEnvFile = await writeProviderEnv(selection, grant.agent_pubkey);
-  const grantPath = resolve15(defaultSupervisorRoot(process.env), "beeline", "connect", `grant-${process.pid}-${Date.now()}.json`);
+  const grantPath = resolve19(defaultSupervisorRoot(process.env), "beeline", "connect", `grant-${process.pid}-${Date.now()}.json`);
   await writePrivateJson(grantPath, {
     agentSecretKey: grant.agent_secret_key,
     bodySecretKey: grant.body_secret_key,
@@ -17175,10 +18220,38 @@ async function runConnectCommand(code, options = {}) {
   });
   await brassSpinner("Starting your agent\u2026", () => runInstalledFinish(installedRelease.binary, grantPath), () => `Started ${grant.agent_name}`);
   console.log("");
-  console.log(`${brass("Agent")}      ${grant.agent_name}`);
+  console.log(`${brass("Agent")}      ${seededIdentityLine(grant)}`);
   console.log(`${brass("Workspace")}  ${grant.workspace_name}`);
   outro(brass("Say hi in the app."));
 }
+async function confirmSeededName(baseUrl, pairingCode, grant, fetchImpl, prompts = clackPrompts) {
+  log.info(brass(`Your agent is ${seededIdentityLine(grant)}.`));
+  const choice = await prompts.select({
+    message: brass("Name"),
+    initialValue: "keep",
+    options: [
+      { value: "keep", label: `Keep ${grant.agent_name}`, hint: "default" },
+      { value: "rename", label: "Rename this agent" }
+    ]
+  });
+  if (choice === "keep")
+    return grant.agent_name;
+  const renamed = await prompts.text({
+    message: brass("Agent name"),
+    initialValue: grant.agent_name,
+    validate: (value) => {
+      if (!value.trim())
+        return "Agent name is required";
+      return isReasonableAgentName(value) ? void 0 : `Use letters, spaces, hyphens, or apostrophes (${AGENT_NAME_MAX_LENGTH} characters max)`;
+    }
+  });
+  try {
+    return await renameConnectedAgent(baseUrl, pairingCode, renamed, fetchImpl);
+  } catch (error) {
+    log.warn(brass(`Could not rename this agent (${error instanceof Error ? error.message : String(error)}); it stays ${grant.agent_name}. Rename it in the app.`));
+    return grant.agent_name;
+  }
+}
 function isDevicePairingGrant(value) {
   if (!value || typeof value !== "object")
     return false;
@@ -17209,11 +18282,22 @@ async function runConnectFinishCommand(path) {
     throw new Error("connect-finish may run only from the canonical installed Beeline launcher");
   }
   try {
-    const grant = JSON.parse(await readFile5(resolve15(path), "utf8"));
+    const grant = JSON.parse(await readFile9(resolve19(path), "utf8"));
     if (!isDevicePairingGrant(grant))
       throw new Error("device connection grant is invalid");
-    await completeDevicePairing(grant);
-    await unlink2(resolve15(path));
+    const connected = await completeDevicePairing(grant);
+    await unlink2(resolve19(path));
+    const providerEnv = grant.llmEnvFile ? await readFile9(grant.llmEnvFile, "utf8").catch(() => "") : "";
+    const model = openRouterModelId(grant.model, {
+      OPENROUTER_API_KEY: /^OPENROUTER_API_KEY=\S/m.test(providerEnv) ? "set" : ""
+    });
+    if (model) {
+      const decision2 = await resolveOpenRouterRouting({
+        model,
+        cacheDir: openRouterRoutingCacheDir(dirname10(connected.configPath))
+      });
+      console.log(decision2.line);
+    }
   } catch (error) {
     throw new ConnectFailureError(connectPlainFailure(error));
   }
@@ -17227,20 +18311,20 @@ init_self_update_manifest();
 // apps/body/dist/managed-update.js
 init_self_update();
 import { spawn as spawn6 } from "node:child_process";
-import { mkdir as mkdir12, rm as rm5, stat as stat2, writeFile as writeFile9 } from "node:fs/promises";
-import { dirname as dirname11, resolve as resolve17 } from "node:path";
+import { mkdir as mkdir13, rm as rm5, stat as stat2, writeFile as writeFile11 } from "node:fs/promises";
+import { dirname as dirname12, resolve as resolve21 } from "node:path";
 
 // apps/body/dist/update-rollback-alert.js
-import { mkdir as mkdir11, readFile as readFile6, rename as rename4, writeFile as writeFile8 } from "node:fs/promises";
-import { dirname as dirname10, resolve as resolve16 } from "node:path";
+import { mkdir as mkdir12, readFile as readFile10, rename as rename4, writeFile as writeFile10 } from "node:fs/promises";
+import { dirname as dirname11, resolve as resolve20 } from "node:path";
 function updateRollbackAlertPath(runtimeDir) {
-  return resolve16(runtimeDir, "update-rollback-alert.json");
+  return resolve20(runtimeDir, "update-rollback-alert.json");
 }
 async function writeAlert(runtimeDir, alert) {
   const path = updateRollbackAlertPath(runtimeDir);
   const staged = `${path}.${process.pid}.tmp`;
-  await mkdir11(dirname10(path), { recursive: true });
-  await writeFile8(staged, `${JSON.stringify(alert, null, 2)}
+  await mkdir12(dirname11(path), { recursive: true });
+  await writeFile10(staged, `${JSON.stringify(alert, null, 2)}
 `, { mode: 384 });
   await rename4(staged, path);
 }
@@ -17252,7 +18336,7 @@ async function queueUpdateRollbackAlert(runtimeDir, releaseId, now2 = Date.now()
 }
 async function readUpdateRollbackAlert(runtimeDir) {
   try {
-    const value = JSON.parse(await readFile6(updateRollbackAlertPath(runtimeDir), "utf8"));
+    const value = JSON.parse(await readFile10(updateRollbackAlertPath(runtimeDir), "utf8"));
     if (value.version !== 1 || typeof value.releaseId !== "string")
       return void 0;
     return value;
@@ -17277,13 +18361,13 @@ var LOCK_STALE_MS = UPDATE_WORKER_DEADLINE_MS + 5 * 6e4;
 var DEFAULT_UPDATE_INITIAL_DELAY_MS = 0;
 async function withInstallLock(layout, work, options = {}) {
   const now2 = options.now ?? Date.now;
-  const lock = resolve17(layout.releasesRoot, ".state", "install.lock");
+  const lock = resolve21(layout.releasesRoot, ".state", "install.lock");
   const deadline = now2() + (options.waitMs ?? 1e4);
-  await mkdir12(dirname11(lock), { recursive: true });
+  await mkdir13(dirname12(lock), { recursive: true });
   for (; ; ) {
     try {
-      await mkdir12(lock);
-      await writeFile9(resolve17(lock, "owner"), `${process.pid}
+      await mkdir13(lock);
+      await writeFile11(resolve21(lock, "owner"), `${process.pid}
 ${now2()}
 `, "utf8");
       break;
@@ -17320,7 +18404,6 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
   #requested = false;
   #restartRequest;
   #stagedReleaseId;
-  #drainDeadlineLogged = false;
   constructor(options) {
     this.#layout = options.layout;
     this.#loadedRelease = options.loadedRelease;
@@ -17407,7 +18490,7 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
       if (!attempt || attempt.releaseId !== desiredRelease || attempt.status !== "pending") {
         const from = await readInstalledBundleIdentity({
           ...this.#layout,
-          libDir: resolve17(this.#layout.releasesRoot, this.#loadedRelease)
+          libDir: resolve21(this.#layout.releasesRoot, this.#loadedRelease)
         }).catch(() => void 0) ?? {};
         const to = await readInstalledBundleIdentity(this.#layout).catch(() => void 0) ?? {};
         const record2 = {
@@ -17444,11 +18527,13 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
   }
   /**
    * Resolve one handoff tick against the daemon's authoritative turn registry.
-   * A staged release stays inert while accepted work is running.
-   * `quiesceIfIdle` closes intake in the same synchronous transition that
-   * proves idle, so a new turn cannot race activation. Expiring the bounded
-   * drain window records delayed convergence; it never turns a routine update
-   * into an ACP cancellation or a failed Room receipt.
+   * Busy means a turn is executing right now; serving Rooms and corners with
+   * no turn in flight is idle. `quiesceIfIdle` closes intake in the same
+   * synchronous transition that proves idle, so a new turn cannot race
+   * activation. A staged release stays inert while a turn runs — until the
+   * absolute drain deadline, when the restart is forced (`forced: true`) and
+   * the caller cancels the running turn; the convergence contract outranks a
+   * stuck turn. `ManagedUpdateDrain` enforces that deadline with a timer.
    */
   async restartRequest(quiesceIfIdle) {
     const activeDrift = await this.check();
@@ -17457,12 +18542,11 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
     const request = this.#restartRequest;
     if (!request)
       throw new Error("update drift was detected without an in-memory restart request");
+    let forced = false;
     if (!quiesceIfIdle()) {
-      if (this.#now() >= request.drainDeadlineAt && !this.#drainDeadlineLogged) {
-        console.log(`[thin-core] update drain window elapsed with active work; keeping the staged release ${request.desiredRelease} inert instead of interrupting the Room turn`);
-        this.#drainDeadlineLogged = true;
-      }
-      return { kind: "waiting", request };
+      if (this.#now() < request.drainDeadlineAt)
+        return { kind: "waiting", request };
+      forced = true;
     }
     if (this.#stagedReleaseId) {
       const stagedReleaseId = this.#stagedReleaseId;
@@ -17482,7 +18566,7 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
       this.#restartRequest = void 0;
       await this.#journalDrift(stagedReleaseId);
     }
-    return { kind: "restart", request: this.#restartRequest ?? request };
+    return { kind: "restart", request: this.#restartRequest ?? request, forced };
   }
 };
 async function coordinateManagedUpdateHandoff(update, quiesceIfIdle, restart, waiting = async () => void 0) {
@@ -17493,9 +18577,88 @@ async function coordinateManagedUpdateHandoff(update, quiesceIfIdle, restart, wa
     await waiting(next.request);
     return "waiting-for-idle";
   }
-  await restart(next.request);
+  await restart(next.request, next.forced ? "forced" : "drained");
   return "restarting";
 }
+var UPDATE_DRAIN_WAIT_LOG_INTERVAL_MS = 6e4;
+var ManagedUpdateDrain = class {
+  #options;
+  #now;
+  #log;
+  #setTimer;
+  #clearTimer;
+  #deadlineTimer;
+  #waitLogTimer;
+  #resolving;
+  #restarting = false;
+  constructor(options) {
+    this.#options = options;
+    this.#now = options.now ?? Date.now;
+    this.#log = options.log ?? ((line) => console.log(line));
+    this.#setTimer = options.setTimer ?? ((callback, ms) => setTimeout(callback, ms));
+    this.#clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
+  }
+  /** Called from every completed core progress tick. */
+  tick() {
+    return this.#resolve();
+  }
+  #resolve() {
+    if (this.#restarting)
+      return Promise.resolve("restarting");
+    if (this.#resolving)
+      return this.#resolving;
+    this.#resolving = this.#step().finally(() => {
+      this.#resolving = void 0;
+    });
+    return this.#resolving;
+  }
+  async #step() {
+    const { update, quiesceIfIdle, activeTurnCount } = this.#options;
+    let armed;
+    const progress = await coordinateManagedUpdateHandoff(update, quiesceIfIdle, async (request, mode) => {
+      this.#disarm();
+      if (mode === "forced") {
+        this.#log(`[thin-core] update restart forced: drain deadline reached with ${activeTurnCount()} active turn(s); cancelling them and restarting onto ${request.desiredRelease}`);
+      }
+      await this.#options.restart(request, mode);
+      this.#restarting = true;
+    }, async (request) => {
+      armed = request;
+      await this.#options.waiting?.(request);
+    });
+    if (armed && !this.#deadlineTimer)
+      this.#arm(armed);
+    return progress;
+  }
+  #arm(request) {
+    this.#logWaiting(request);
+    this.#scheduleWaitLog(request);
+    this.#deadlineTimer = this.#setTimer(() => void this.#resolve().catch((error) => {
+      this.#log(`[thin-core] update restart at the drain deadline failed; retrying on the next tick: ${error instanceof Error ? error.message : String(error)}`);
+    }), Math.max(0, request.drainDeadlineAt - this.#now()));
+  }
+  #scheduleWaitLog(request) {
+    this.#waitLogTimer = this.#setTimer(() => {
+      this.#waitLogTimer = void 0;
+      if (this.#restarting)
+        return;
+      this.#logWaiting(request);
+      this.#scheduleWaitLog(request);
+    }, UPDATE_DRAIN_WAIT_LOG_INTERVAL_MS);
+  }
+  #logWaiting(request) {
+    const minutesLeft = Math.max(0, Math.ceil((request.drainDeadlineAt - this.#now()) / 6e4));
+    this.#log(`[thin-core] update restart waiting: ${this.#options.activeTurnCount()} active turn(s); deadline in ${minutesLeft}m`);
+  }
+  #disarm() {
+    if (this.#deadlineTimer !== void 0)
+      this.#clearTimer(this.#deadlineTimer);
+    if (this.#waitLogTimer !== void 0)
+      this.#clearTimer(this.#waitLogTimer);
+    this.#deadlineTimer = void 0;
+    this.#waitLogTimer = void 0;
+  }
+};
 function numberEnv(env, name, fallback) {
   const value = Number(env[name]);
   return Number.isFinite(value) && value >= 0 ? value : fallback;
@@ -17614,7 +18777,7 @@ async function proveLoadedReleaseReady(layout, runtimeDir, loadedRelease, option
   });
   if (!accepted)
     return false;
-  await writeFile9(resolve17(runtimeDir, "daemon-ready.json"), `${JSON.stringify({
+  await writeFile11(resolve21(runtimeDir, "daemon-ready.json"), `${JSON.stringify({
     readyAt: (options.now ?? Date.now)(),
     loadedRelease,
     functionalProof: options.functionalProof
@@ -17819,16 +18982,16 @@ async function runUpdateCommand(args) {
 init_self_update();
 
 // apps/body/dist/daemon-failure.js
-import { mkdir as mkdir13, readFile as readFile7, rename as rename5, rm as rm6, writeFile as writeFile10 } from "node:fs/promises";
-import { dirname as dirname12, resolve as resolve18 } from "node:path";
+import { mkdir as mkdir14, readFile as readFile11, rename as rename5, rm as rm6, writeFile as writeFile12 } from "node:fs/promises";
+import { dirname as dirname13, resolve as resolve22 } from "node:path";
 var DAEMON_FAILURE_LIMIT = 3;
 var DAEMON_FAILURE_WINDOW_MS = 5 * 6e4;
 function daemonFailurePath(runtimeDir) {
-  return resolve18(runtimeDir, "daemon-distress.json");
+  return resolve22(runtimeDir, "daemon-distress.json");
 }
 async function readFailureRecord(runtimeDir) {
   try {
-    const value = JSON.parse(await readFile7(daemonFailurePath(runtimeDir), "utf8"));
+    const value = JSON.parse(await readFile11(daemonFailurePath(runtimeDir), "utf8"));
     if (value.version !== 1 || !Array.isArray(value.failures) || value.failures.some((failure) => typeof failure !== "number") || typeof value.lastError !== "string") {
       return void 0;
     }
@@ -17840,8 +19003,8 @@ async function readFailureRecord(runtimeDir) {
 async function writeFailureRecord(runtimeDir, record2) {
   const path = daemonFailurePath(runtimeDir);
   const staged = `${path}.${process.pid}.tmp`;
-  await mkdir13(dirname12(path), { recursive: true, mode: 448 });
-  await writeFile10(staged, `${JSON.stringify(record2, null, 2)}
+  await mkdir14(dirname13(path), { recursive: true, mode: 448 });
+  await writeFile12(staged, `${JSON.stringify(record2, null, 2)}
 `, { mode: 384 });
   await rename5(staged, path);
 }
@@ -17863,21 +19026,45 @@ async function clearDaemonStartFailures(runtimeDir) {
 }
 
 // apps/body/dist/update-functional-probe.js
-import { mkdir as mkdir14, rm as rm7 } from "node:fs/promises";
+import { mkdir as mkdir15, rm as rm7 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { resolve as resolve19 } from "node:path";
+import { resolve as resolve23 } from "node:path";
 var UPDATE_PROBE_SESSION_TIMEOUT_MS = 1e4;
 var UPDATE_PROBE_SESSION_OPEN_TIMEOUT_MS = 2e4;
 var UPDATE_PROBE_TURN_TIMEOUT_MS = 45e3;
 var UpdateFunctionalProbeError = class extends Error {
   reason;
   code = "BEELINE_UPDATE_FUNCTIONAL_PROBE_FAILED";
+  /** Present when the turn failed on a provider refusal with an HTTP status. */
+  providerRefusal;
   constructor(reason, detail, options) {
     super(`functional update probe failed (${reason}): ${detail}`, options);
     this.reason = reason;
     this.name = "UpdateFunctionalProbeError";
+    this.providerRefusal = options?.providerRefusal;
   }
 };
+async function probeOutcome(run2) {
+  try {
+    await run2();
+    return { kind: "served" };
+  } catch (error) {
+    if (error instanceof UpdateFunctionalProbeError && error.providerRefusal) {
+      return { kind: "refused", ...error.providerRefusal };
+    }
+    return { kind: "unavailable", reason: error instanceof Error ? error.message : String(error) };
+  }
+}
+function describeCurrentReleaseOutcome(outcome) {
+  switch (outcome.kind) {
+    case "served":
+      return "the current release answered";
+    case "refused":
+      return `the current release got a different refusal (${outcome.reason})`;
+    case "unavailable":
+      return `the current release could not be compared (${outcome.reason})`;
+  }
+}
 async function runUpdateFunctionalProbe(input) {
   const command = input.config.agentCommand ?? input.config.agentBinary;
   const harness = input.config.agentKind ?? command;
@@ -17887,11 +19074,11 @@ async function runUpdateFunctionalProbe(input) {
   if (input.sandboxRequired && !input.config.bwrapPath) {
     throw new UpdateFunctionalProbeError("sandbox-unavailable", "the configured bubblewrap boundary did not pass its startup self-test");
   }
-  const root = resolve19(input.runtimeDir, "update-functional-probe");
-  const cwd = resolve19(root, "checkout");
-  const homeRoot = resolve19(root, "agent-home");
+  const root = input.probeRoot ?? resolve23(input.runtimeDir, "update-functional-probe");
+  const cwd = resolve23(root, "checkout");
+  const homeRoot = resolve23(root, "agent-home");
   await rm7(root, { recursive: true, force: true });
-  await mkdir14(cwd, { recursive: true, mode: 448 });
+  await mkdir15(cwd, { recursive: true, mode: 448 });
   let client;
   try {
     const agentEnv = {
@@ -17901,7 +19088,8 @@ async function runUpdateFunctionalProbe(input) {
         operatorHome: input.config.operatorHome ?? homedir10(),
         sharedSkills: input.config.sharedSkills ?? [],
         skillReleaseId: input.releaseId,
-        failClosed: true
+        failClosed: true,
+        ...openRouterRoutingInput({ ...input.config, openRouterRoutingCacheDir: openRouterRoutingCacheDir(input.runtimeDir) }, input.config.modelSelection)
       })
     };
     const selectedAgent = {
@@ -17913,11 +19101,12 @@ async function runUpdateFunctionalProbe(input) {
       command,
       args: agentArgsWithModelSelection(selectedAgent, input.config.modelSelection)
     };
+    let modelAnswer = {};
     if (input.config.bwrapPath) {
       const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
       const operatorHome = input.config.operatorHome ?? homedir10();
       const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
-      await Promise.all(homeStateDirs.map((dir) => mkdir14(dir, { recursive: true })));
+      await Promise.all(homeStateDirs.map((dir) => mkdir15(dir, { recursive: true })));
       spawnCommand = wrapAgentCommand({
         bwrapPath: input.config.bwrapPath,
         spec: {
@@ -17956,10 +19145,39 @@ async function runUpdateFunctionalProbe(input) {
       }
       try {
         const served = await client.sessionPrompt(opened.sessionId, "Reply READY.", input.turnTimeoutMs ?? UPDATE_PROBE_TURN_TIMEOUT_MS);
-        if (!served.agentText.trim()) {
-          throw new UpdateFunctionalProbeError("turn-failed", "the harness completed a session/prompt without an agent answer");
+        if (served.agentText.trim()) {
+          modelAnswer = { modelAnswer: "served" };
+        } else {
+          const explained = await explainEmptyAgentTurn({
+            agentLabel: command,
+            agentEnv,
+            sessionId: opened.sessionId,
+            result: served
+          });
+          const modelSide = isAccountOrProviderRefusal(explained.record) || explained.record?.kind === "empty";
+          if (!modelSide) {
+            const refusal = explained.record?.kind === "error" && explained.record.status !== void 0 ? { status: explained.record.status, reason: explained.record.reason } : void 0;
+            const detail = `the harness completed a session/prompt without an agent answer: ${explained.reason}`;
+            if (!refusal || !input.compareWithCurrentRelease) {
+              throw new UpdateFunctionalProbeError("turn-failed", detail, {
+                ...refusal ? { providerRefusal: refusal } : {}
+              });
+            }
+            const current = await input.compareWithCurrentRelease(refusal);
+            if (current.kind !== "refused" || current.status !== refusal.status) {
+              throw new UpdateFunctionalProbeError("turn-failed", `${detail}; ${describeCurrentReleaseOutcome(current)}`, { providerRefusal: refusal });
+            }
+            const reason = `${explained.reason} (the current release gets the same ${refusal.status})`;
+            console.warn(`[body] update probe: the provider refused this release and the current release alike (${refusal.reason}); that refusal is not this bundle's doing, so the probe passes as inconclusive`);
+            modelAnswer = { modelAnswer: "unavailable", modelAnswerReason: reason };
+          } else {
+            console.warn(`[body] update probe: the bundle reached the model boundary but the model answered nothing (${explained.reason}); that is the model's own answer on any release, so the probe passes without one`);
+            modelAnswer = { modelAnswer: "unavailable", modelAnswerReason: explained.reason };
+          }
         }
       } catch (error) {
+        if (error instanceof UpdateFunctionalProbeError)
+          throw error;
         throw new UpdateFunctionalProbeError("turn-failed", error instanceof Error ? error.message : String(error), { cause: error });
       }
     } catch (error) {
@@ -17972,7 +19190,8 @@ async function runUpdateFunctionalProbe(input) {
       sandboxed: Boolean(input.config.bwrapPath),
       sessionStarted: true,
       turnCompleted: true,
-      nativeTools: []
+      nativeTools: [],
+      ...modelAnswer
     };
   } finally {
     await client?.stop().catch(() => void 0);
@@ -17980,9 +19199,140 @@ async function runUpdateFunctionalProbe(input) {
   }
 }
 
+// apps/body/dist/current-release-probe.js
+import { spawn as spawn7 } from "node:child_process";
+import { dirname as dirname14, join as join7 } from "node:path";
+init_self_update();
+var CURRENT_RELEASE_PROBE_TIMEOUT_MS = 8e4;
+var UPDATE_PROBE_COMMAND = "update-probe";
+function parseReport(line) {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return void 0;
+  }
+  if (!parsed || typeof parsed !== "object")
+    return void 0;
+  const report = parsed;
+  if (report.probe === "served")
+    return { probe: "served" };
+  if (report.probe === "refused" && typeof report.status === "number" && typeof report.reason === "string") {
+    return { probe: "refused", status: report.status, reason: report.reason };
+  }
+  if (report.probe === "failed" && typeof report.reason === "string") {
+    return { probe: "failed", reason: report.reason };
+  }
+  return void 0;
+}
+function outcomeFromReport(report) {
+  switch (report.probe) {
+    case "served":
+      return { kind: "served" };
+    case "refused":
+      return { kind: "refused", status: report.status, reason: report.reason };
+    case "failed":
+      return { kind: "unavailable", reason: report.reason };
+  }
+}
+async function probeReleaseInSubprocess(input) {
+  const bundleDir = join7(input.layout.releasesRoot, input.releaseId);
+  const entrypoint = await resolveBundleEntrypoint(bundleDir);
+  if (!entrypoint) {
+    return { kind: "unavailable", reason: `release ${input.releaseId} has no runnable CLI entrypoint` };
+  }
+  const timeoutMs = input.timeoutMs ?? CURRENT_RELEASE_PROBE_TIMEOUT_MS;
+  return new Promise((resolve26) => {
+    const child = spawn7(input.execPath ?? process.execPath, [entrypoint, UPDATE_PROBE_COMMAND, "--config", input.runtimeConfigPath], { env: input.env ?? process.env, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout6 = "";
+    let stderr = "";
+    let settled = false;
+    const finish = (outcome) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      resolve26(outcome);
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish({
+        kind: "unavailable",
+        reason: `release ${input.releaseId} did not finish its probe within ${timeoutMs}ms`
+      });
+    }, timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      stdout6 += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", (error) => {
+      finish({ kind: "unavailable", reason: `release ${input.releaseId} could not be spawned: ${error.message}` });
+    });
+    child.on("close", (code, signal) => {
+      const lines = stdout6.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+      for (let index = lines.length - 1; index >= 0; index -= 1) {
+        const report = parseReport(lines[index]);
+        if (report) {
+          finish(outcomeFromReport(report));
+          return;
+        }
+      }
+      const tail = stderr.trim().split(/\r?\n/).slice(-3).join(" | ").slice(0, 300);
+      finish({
+        kind: "unavailable",
+        reason: `release ${input.releaseId} printed no probe report (exit ${signal ?? code})` + (tail ? `: ${tail}` : "")
+      });
+    });
+  });
+}
+async function runUpdateProbeCommand(args, options = {}) {
+  const env = options.env ?? process.env;
+  const write = options.write ?? ((line) => process.stdout.write(`${line}
+`));
+  const configFlag = args.indexOf("--config");
+  const configArg = configFlag >= 0 ? args[configFlag + 1] : void 0;
+  if (!configArg)
+    throw new Error(`${UPDATE_PROBE_COMMAND} requires --config <runtime.json>`);
+  const configPath = await resolveRuntimeConfigPath(configArg);
+  const runtime = await readRuntimeRecord(configPath);
+  const agent = runtimeAgentCommand(runtime);
+  const config = loadBodyConfig({
+    workspaceRoot: join7(dirname14(configPath), "workspace"),
+    llmEnvFile: runtime.llmEnvFile,
+    env: { ...env, BUZZ_AGENT_BIN: agent.command, BUZZ_DEV_MCP_BIN: runtime.mcpBinary },
+    agent
+  });
+  if (runtime.sharedSkills)
+    config.sharedSkills = [...runtime.sharedSkills];
+  if (runtime.modelSelection)
+    config.modelSelection = runtime.modelSelection;
+  config.runtimeConfigPath = configPath;
+  const sandbox = detectBwrapSandbox({ ...runtime.sandbox ? { policy: runtime.sandbox } : {}, env });
+  if (sandbox.path)
+    config.bwrapPath = sandbox.path;
+  if (runtime.sandboxMaskPaths?.length) {
+    config.sandboxMaskPaths = [...config.sandboxMaskPaths ?? [], ...runtime.sandboxMaskPaths];
+  }
+  const layout = beelineInstallLayout(env);
+  const releaseId = (layout && await activeReleaseId(layout).catch(() => void 0)) ?? "unknown";
+  const runtimeDir = dirname14(configPath);
+  const outcome = await probeOutcome(() => (options.probe ?? runUpdateFunctionalProbe)({
+    config,
+    runtimeDir,
+    releaseId,
+    sandboxRequired: runtime.sandbox !== "off",
+    // The successor's probe still holds `<runtimeDir>/update-functional-probe`.
+    probeRoot: join7(runtimeDir, "current-release-probe")
+  }));
+  const report = outcome.kind === "served" ? { probe: "served" } : outcome.kind === "refused" ? { probe: "refused", status: outcome.status, reason: outcome.reason } : { probe: "failed", reason: outcome.reason };
+  write(JSON.stringify(report));
+}
+
 // apps/body/dist/release-status.js
-import { readFile as readFile8, readdir as readdir3, rename as rename6, writeFile as writeFile11 } from "node:fs/promises";
-import { resolve as resolve20 } from "node:path";
+import { readFile as readFile12, readdir as readdir4, rename as rename6, writeFile as writeFile13 } from "node:fs/promises";
+import { resolve as resolve24 } from "node:path";
 var DAEMON_RELEASE_STATUS_FILE = "release-status.json";
 var RELEASE_VERSION = /^v\d+\.\d+\.\d+$/;
 var SOURCE_SHA = /^[0-9a-f]{7,64}$/;
@@ -17999,9 +19349,9 @@ async function writeDaemonReleaseStatus(runtimeDir, agentPubkey, identity, optio
     pid: options.pid ?? process.pid,
     readyAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
   };
-  const target = resolve20(runtimeDir, DAEMON_RELEASE_STATUS_FILE);
+  const target = resolve24(runtimeDir, DAEMON_RELEASE_STATUS_FILE);
   const temporary = `${target}.${status.pid}.tmp`;
-  await writeFile11(temporary, `${JSON.stringify(status, null, 2)}
+  await writeFile13(temporary, `${JSON.stringify(status, null, 2)}
 `, { mode: 384 });
   await rename6(temporary, target);
   return status;
@@ -18042,7 +19392,7 @@ var DaemonExitError = class extends Error {
 };
 async function runStoredDaemon(pathOrPointer) {
   const configPath = await resolveRuntimeConfigPath(pathOrPointer);
-  daemonFailureRuntimeDir = dirname13(configPath);
+  daemonFailureRuntimeDir = dirname15(configPath);
   const accessMigration = await migrateRuntimeRecordAccessPolicy(configPath);
   let runtime = accessMigration.runtime;
   if (!runtime.transport) {
@@ -18054,7 +19404,7 @@ async function runStoredDaemon(pathOrPointer) {
   runtime = activated.runtime;
   const daemonApi = activated.client;
   const agent = runtimeAgentCommand(runtime);
-  await writeFile12(resolve21(dirname13(configPath), "daemon.pid"), `${process.pid}
+  await writeFile14(resolve25(dirname15(configPath), "daemon.pid"), `${process.pid}
 `, { mode: 384 });
   const env = {
     ...process.env,
@@ -18062,7 +19412,7 @@ async function runStoredDaemon(pathOrPointer) {
     BUZZ_DEV_MCP_BIN: runtime.mcpBinary
   };
   const config = loadBodyConfig({
-    workspaceRoot: resolve21(dirname13(configPath), "workspace"),
+    workspaceRoot: resolve25(dirname15(configPath), "workspace"),
     llmEnvFile: runtime.llmEnvFile,
     env,
     agent
@@ -18097,7 +19447,7 @@ async function runStoredDaemon(pathOrPointer) {
   const stop = () => controller.abort();
   process.once("SIGINT", stop);
   process.once("SIGTERM", stop);
-  const runtimeDir = dirname13(configPath);
+  const runtimeDir = dirname15(configPath);
   const layout = beelineInstallLayout(process.env);
   const notifier = new SystemdNotifier();
   let rollbackAlertDrain;
@@ -18143,11 +19493,28 @@ async function runStoredDaemon(pathOrPointer) {
   let stoppingStatus = "daemon stopped";
   try {
     const core = new ThinDaemonCore(runtime, configPath, config, { daemonApi });
+    const updateDrain = update ? new ManagedUpdateDrain({
+      update,
+      quiesceIfIdle: () => core.quiesceForUpdateIfIdle(),
+      activeTurnCount: () => core.activeTurnCount(),
+      restart: async ({ desiredRelease, drainDeadlineAt }, mode) => {
+        if (mode === "forced")
+          await core.prepareForForcedUpdateRestart();
+        core.setDrainDeadlineAt(drainDeadlineAt);
+        stoppingStatus = `update pending, converging; loaded_release=${loadedRelease ?? "unknown"}; desired_release=${desiredRelease}; ${mode === "forced" ? "active work cancelled at the drain deadline" : "active work drained"}; intake quiesced; exit_deadline=${new Date(drainDeadlineAt).toISOString()}`;
+        await notifier.stopping(stoppingStatus);
+        controller.abort();
+      },
+      waiting: async ({ desiredRelease, drainDeadlineAt }) => {
+        await notifier.progress(`loaded_release=${loadedRelease ?? "unknown"}; update ready; active agent work is still running; handoff deferred; desired_release=${desiredRelease}; exit_deadline=${new Date(drainDeadlineAt).toISOString()}`);
+      }
+    }) : void 0;
     const result = await core.run({
       signal: controller.signal,
       onEstablished: async () => {
         let functionalProof;
         if (layout && pendingSuccessor) {
+          const currentReleaseId = (await readUpdateAttempt(layout))?.previousReleaseId;
           const gate = await gateManagedSuccessor({
             layout,
             runtimeDir,
@@ -18157,7 +19524,18 @@ async function runStoredDaemon(pathOrPointer) {
               config,
               runtimeDir,
               releaseId: loadedRelease ?? "unknown",
-              sandboxRequired: runtime.sandbox !== "off"
+              sandboxRequired: runtime.sandbox !== "off",
+              ...currentReleaseId ? {
+                compareWithCurrentRelease: async (refusal) => {
+                  console.warn(`[thin-core] successor probe refused by the provider (${refusal.reason}); probing the current release ${currentReleaseId} for the same refusal`);
+                  await extendSystemdStartTimeout(CURRENT_RELEASE_PROBE_TIMEOUT_MS + 15e3);
+                  return probeReleaseInSubprocess({
+                    layout,
+                    releaseId: currentReleaseId,
+                    runtimeConfigPath: configPath
+                  });
+                }
+              } : {}
             })
           });
           if (gate.kind === "failed") {
@@ -18166,28 +19544,26 @@ async function runStoredDaemon(pathOrPointer) {
           }
           functionalProof = gate.proof;
           pendingSuccessor = false;
-          console.log(`[thin-core] successor functional probe passed on exact release ${loadedRelease}: ${functionalProof?.harness ?? "unknown"} session/new + turn`);
+          console.log(`[thin-core] successor functional probe passed on exact release ${loadedRelease}: ${functionalProof?.harness ?? "unknown"} session/new + turn` + (functionalProof?.modelAnswer === "unavailable" ? ` (model answer unavailable: ${functionalProof.modelAnswerReason})` : ""));
         }
         await clearDaemonStartFailures(runtimeDir);
         await writeDaemonReleaseStatus(runtimeDir, runtime.agent.publicKey, loadedReleaseIdentity);
         await notifier.ready(`ready; loaded_release=${loadedRelease ?? "development"}`);
         ready = true;
+        void syncAgentModelCatalog({
+          api: daemonApi,
+          agent,
+          agentEnv: config.agentEnv,
+          agentId: runtime.agent.publicKey,
+          workspaceId: runtime.communityId,
+          runtimeDir,
+          ...runtime.modelSelection ? { runtimeSelection: runtime.modelSelection } : {}
+        });
       },
       onProgress: async (status) => {
         void drainRollbackAlert(core.activeRoomIds()[0] ?? runtime.rooms[0]?.channelId);
         await notifier.progress(`loaded_release=${loadedRelease ?? "development"}; ${status}`);
-        if (!update)
-          return;
-        await coordinateManagedUpdateHandoff(update, () => core.quiesceForUpdateIfIdle(), async ({ desiredRelease, drainDeadlineAt }) => {
-          if (Date.now() >= drainDeadlineAt)
-            await core.prepareForForcedUpdateRestart();
-          core.setDrainDeadlineAt(drainDeadlineAt);
-          stoppingStatus = `update pending, converging; loaded_release=${loadedRelease ?? "unknown"}; desired_release=${desiredRelease}; active work drained; intake quiesced; exit_deadline=${new Date(drainDeadlineAt).toISOString()}`;
-          await notifier.stopping(stoppingStatus);
-          controller.abort();
-        }, async ({ desiredRelease, drainDeadlineAt }) => {
-          await notifier.progress(`loaded_release=${loadedRelease ?? "unknown"}; update ready; active agent work is still running; handoff deferred; desired_release=${desiredRelease}; exit_deadline=${new Date(drainDeadlineAt).toISOString()}`);
-        });
+        await updateDrain?.tick();
       }
     });
     if (result === "agent-removed") {
@@ -18209,8 +19585,8 @@ async function runStoredDaemon(pathOrPointer) {
     throw error;
   } finally {
     await notifier.stopping(stoppingStatus).catch(() => void 0);
-    const pidPath = resolve21(dirname13(configPath), "daemon.pid");
-    const recorded = Number((await readFile9(pidPath, "utf8").catch(() => "")).trim());
+    const pidPath = resolve25(dirname15(configPath), "daemon.pid");
+    const recorded = Number((await readFile13(pidPath, "utf8").catch(() => "")).trim());
     if (recorded === process.pid) {
       await unlink3(pidPath).catch(() => void 0);
     }
@@ -18266,20 +19642,24 @@ async function main() {
     const agentPubkey = agentFlag >= 0 ? args[agentFlag + 1] : void 0;
     if (!configPath && agentPubkey) {
       const configs = await findAgentRuntimeConfigPaths(process.env, process.cwd());
-      configPath = configs.find((candidate) => dirname13(candidate).endsWith(agentPubkey));
+      configPath = configs.find((candidate) => dirname15(candidate).endsWith(agentPubkey));
     }
     if (!configPath && agentPubkey) {
       throw new DaemonExitError(`unknown agent ${agentPubkey}: no durable runtime exists; refusing systemd restart loop`, UNKNOWN_AGENT_EXIT_STATUS);
     }
     if (!configPath)
       throw new Error("daemon requires --config <runtime.json> or --agent <pubkey>");
-    await runStoredDaemon(resolve21(configPath));
+    await runStoredDaemon(resolve25(configPath));
     return;
   }
   if (command === "update") {
     await runUpdateCommand(args);
     return;
   }
+  if (command === UPDATE_PROBE_COMMAND) {
+    await runUpdateProbeCommand(args);
+    return;
+  }
   if (command === "start") {
     await runStartCommand(args, interactiveUi);
     return;
@@ -18290,7 +19670,7 @@ async function main() {
     if (!agentPubkey)
       throw new Error("stop requires --agent <pubkey>");
     const configs = await findAgentRuntimeConfigPaths(process.env, process.cwd());
-    const configPath = configs.find((candidate) => dirname13(candidate).endsWith(agentPubkey));
+    const configPath = configs.find((candidate) => dirname15(candidate).endsWith(agentPubkey));
     if (!configPath)
       throw new Error(`no stored runtime found for agent ${agentPubkey}`);
     const runtime = await readRuntimeRecord(configPath);