npm - werkmeister - Versions diffs - 0.15.0 → 0.16.0 - Mend

werkmeister 0.15.0 → 0.16.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/dist/main.js +1005 -581
package/dist/mcp.js +576 -248
package/dist/sandbox-workspaces.vsix +0 -0
package/infra/compose/scripts/sandbox-install-startup.sh +53 -4
package/infra/skills/sb-pr/SKILL.md +2 -2
package/infra/skills/sb-research/SKILL.md +3 -1
package/infra/templates/docker-compose.feature.yml.njk +19 -3
package/package.json +2 -2

package/dist/main.js CHANGED Viewed

@@ -44,7 +44,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var define_SANDBOX_BUILD_default;
 var init_define_SANDBOX_BUILD = __esm({
   "<define:__SANDBOX_BUILD__>"() {
-    define_SANDBOX_BUILD_default = { sha: "8bf0338bcc3351a5e1154beba68c1b6f9beea71a", dirty: false };
+    define_SANDBOX_BUILD_default = { sha: "79cdadc2a1a4f3138deddeb36dbdcbfe124eccef", dirty: false };
   }
 });
@@ -1171,8 +1171,8 @@ var require_command = __commonJS({
     init_define_SANDBOX_BUILD();
     var EventEmitter2 = __require("node:events").EventEmitter;
     var childProcess = __require("node:child_process");
-    var path73 = __require("node:path");
-    var fs65 = __require("node:fs");
+    var path74 = __require("node:path");
+    var fs66 = __require("node:fs");
     var process4 = __require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -2153,7 +2153,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} subcommandName
        */
       _checkForMissingExecutable(executableFile, executableDir, subcommandName) {
-        if (fs65.existsSync(executableFile)) return;
+        if (fs66.existsSync(executableFile)) return;
         const executableDirMessage = executableDir ? `searched for local subcommand relative to directory '${executableDir}'` : "no directory for search for local subcommand, use .executableDir() to supply a custom directory";
         const executableMissing = `'${executableFile}' does not exist
  - if '${subcommandName}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead
@@ -2171,11 +2171,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path73.resolve(baseDir, baseName);
-          if (fs65.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path73.extname(baseName))) return void 0;
+          const localBin = path74.resolve(baseDir, baseName);
+          if (fs66.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path74.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs65.existsSync(`${localBin}${ext}`)
+            (ext) => fs66.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -2187,21 +2187,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs65.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs66.realpathSync(this._scriptPath);
           } catch {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path73.resolve(
-            path73.dirname(resolvedScriptPath),
+          executableDir = path74.resolve(
+            path74.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path73.basename(
+            const legacyName = path74.basename(
               this._scriptPath,
-              path73.extname(this._scriptPath)
+              path74.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -2212,7 +2212,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path73.extname(executableFile));
+        launchWithNode = sourceExt.includes(path74.extname(executableFile));
         let proc;
         if (process4.platform !== "win32") {
           if (launchWithNode) {
@@ -3059,7 +3059,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path73.basename(filename, path73.extname(filename));
+        this._name = path74.basename(filename, path74.extname(filename));
         return this;
       }
       /**
@@ -3073,9 +3073,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path74) {
-        if (path74 === void 0) return this._executableDir;
-        this._executableDir = path74;
+      executableDir(path75) {
+        if (path75 === void 0) return this._executableDir;
+        this._executableDir = path75;
         return this;
       }
       /**
@@ -3462,17 +3462,17 @@ var require_visit = __commonJS({
     visit2.BREAK = BREAK;
     visit2.SKIP = SKIP;
     visit2.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path73) {
-      const ctrl = callVisitor(key, node, visitor, path73);
+    function visit_(key, node, visitor, path74) {
+      const ctrl = callVisitor(key, node, visitor, path74);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path73, ctrl);
-        return visit_(key, ctrl, visitor, path73);
+        replaceNode(key, path74, ctrl);
+        return visit_(key, ctrl, visitor, path74);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path73 = Object.freeze(path73.concat(node));
+          path74 = Object.freeze(path74.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = visit_(i, node.items[i], visitor, path73);
+            const ci = visit_(i, node.items[i], visitor, path74);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -3483,13 +3483,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path73 = Object.freeze(path73.concat(node));
-          const ck = visit_("key", node.key, visitor, path73);
+          path74 = Object.freeze(path74.concat(node));
+          const ck = visit_("key", node.key, visitor, path74);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = visit_("value", node.value, visitor, path73);
+          const cv = visit_("value", node.value, visitor, path74);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -3510,17 +3510,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path73) {
-      const ctrl = await callVisitor(key, node, visitor, path73);
+    async function visitAsync_(key, node, visitor, path74) {
+      const ctrl = await callVisitor(key, node, visitor, path74);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path73, ctrl);
-        return visitAsync_(key, ctrl, visitor, path73);
+        replaceNode(key, path74, ctrl);
+        return visitAsync_(key, ctrl, visitor, path74);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path73 = Object.freeze(path73.concat(node));
+          path74 = Object.freeze(path74.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = await visitAsync_(i, node.items[i], visitor, path73);
+            const ci = await visitAsync_(i, node.items[i], visitor, path74);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -3531,13 +3531,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path73 = Object.freeze(path73.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path73);
+          path74 = Object.freeze(path74.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path74);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path73);
+          const cv = await visitAsync_("value", node.value, visitor, path74);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -3564,23 +3564,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path73) {
+    function callVisitor(key, node, visitor, path74) {
       if (typeof visitor === "function")
-        return visitor(key, node, path73);
+        return visitor(key, node, path74);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path73);
+        return visitor.Map?.(key, node, path74);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path73);
+        return visitor.Seq?.(key, node, path74);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path73);
+        return visitor.Pair?.(key, node, path74);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path73);
+        return visitor.Scalar?.(key, node, path74);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path73);
+        return visitor.Alias?.(key, node, path74);
       return void 0;
     }
-    function replaceNode(key, path73, node) {
-      const parent = path73[path73.length - 1];
+    function replaceNode(key, path74, node) {
+      const parent = path74[path74.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node;
       } else if (identity.isPair(parent)) {
@@ -4199,10 +4199,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path73, value) {
+    function collectionFromPath(schema, path74, value) {
       let v = value;
-      for (let i = path73.length - 1; i >= 0; --i) {
-        const k = path73[i];
+      for (let i = path74.length - 1; i >= 0; --i) {
+        const k = path74[i];
         if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
           const a = [];
           a[k] = v;
@@ -4221,7 +4221,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path73) => path73 == null || typeof path73 === "object" && !!path73[Symbol.iterator]().next().done;
+    var isEmptyPath = (path74) => path74 == null || typeof path74 === "object" && !!path74[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -4251,11 +4251,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path73, value) {
-        if (isEmptyPath(path73))
+      addIn(path74, value) {
+        if (isEmptyPath(path74))
           this.add(value);
         else {
-          const [key, ...rest] = path73;
+          const [key, ...rest] = path74;
           const node = this.get(key, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
@@ -4269,8 +4269,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path73) {
-        const [key, ...rest] = path73;
+      deleteIn(path74) {
+        const [key, ...rest] = path74;
         if (rest.length === 0)
           return this.delete(key);
         const node = this.get(key, true);
@@ -4284,8 +4284,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path73, keepScalar) {
-        const [key, ...rest] = path73;
+      getIn(path74, keepScalar) {
+        const [key, ...rest] = path74;
         const node = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -4303,8 +4303,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path73) {
-        const [key, ...rest] = path73;
+      hasIn(path74) {
+        const [key, ...rest] = path74;
         if (rest.length === 0)
           return this.has(key);
         const node = this.get(key, true);
@@ -4314,8 +4314,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path73, value) {
-        const [key, ...rest] = path73;
+      setIn(path74, value) {
+        const [key, ...rest] = path74;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -6865,9 +6865,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path73, value) {
+      addIn(path74, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path73, value);
+          this.contents.addIn(path74, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -6942,14 +6942,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path73) {
-        if (Collection.isEmptyPath(path73)) {
+      deleteIn(path74) {
+        if (Collection.isEmptyPath(path74)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path73) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path74) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -6964,10 +6964,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path73, keepScalar) {
-        if (Collection.isEmptyPath(path73))
+      getIn(path74, keepScalar) {
+        if (Collection.isEmptyPath(path74))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path73, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path74, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -6978,10 +6978,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path73) {
-        if (Collection.isEmptyPath(path73))
+      hasIn(path74) {
+        if (Collection.isEmptyPath(path74))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path73) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path74) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -6998,13 +6998,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path73, value) {
-        if (Collection.isEmptyPath(path73)) {
+      setIn(path74, value) {
+        if (Collection.isEmptyPath(path74)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path73), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path74), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path73, value);
+          this.contents.setIn(path74, value);
         }
       }
       /**
@@ -8984,9 +8984,9 @@ var require_cst_visit = __commonJS({
     visit2.BREAK = BREAK;
     visit2.SKIP = SKIP;
     visit2.REMOVE = REMOVE;
-    visit2.itemAtPath = (cst, path73) => {
+    visit2.itemAtPath = (cst, path74) => {
       let item = cst;
-      for (const [field, index] of path73) {
+      for (const [field, index] of path74) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index];
@@ -8995,23 +8995,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit2.parentCollection = (cst, path73) => {
-      const parent = visit2.itemAtPath(cst, path73.slice(0, -1));
-      const field = path73[path73.length - 1][0];
+    visit2.parentCollection = (cst, path74) => {
+      const parent = visit2.itemAtPath(cst, path74.slice(0, -1));
+      const field = path74[path74.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path73, item, visitor) {
-      let ctrl = visitor(item, path73);
+    function _visit(path74, item, visitor) {
+      let ctrl = visitor(item, path74);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path73.concat([[field, i]])), token.items[i], visitor);
+            const ci = _visit(Object.freeze(path74.concat([[field, i]])), token.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -9022,10 +9022,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path73);
+            ctrl = ctrl(item, path74);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path73) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path74) : ctrl;
     }
     exports.visit = visit2;
   }
@@ -10331,14 +10331,14 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs65 = this.flowScalar(this.type);
+              const fs66 = this.flowScalar(this.type);
               if (atNextItem || it.value) {
-                map.items.push({ start: start2, key: fs65, sep: [] });
+                map.items.push({ start: start2, key: fs66, sep: [] });
                 this.onKeyLine = true;
               } else if (it.sep) {
-                this.stack.push(fs65);
+                this.stack.push(fs66);
               } else {
-                Object.assign(it, { key: fs65, sep: [] });
+                Object.assign(it, { key: fs66, sep: [] });
                 this.onKeyLine = true;
               }
               return;
@@ -10466,13 +10466,13 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs65 = this.flowScalar(this.type);
+              const fs66 = this.flowScalar(this.type);
               if (!it || it.value)
-                fc.items.push({ start: [], key: fs65, sep: [] });
+                fc.items.push({ start: [], key: fs66, sep: [] });
               else if (it.sep)
-                this.stack.push(fs65);
+                this.stack.push(fs66);
               else
-                Object.assign(it, { key: fs65, sep: [] });
+                Object.assign(it, { key: fs66, sep: [] });
               return;
             }
             case "flow-map-end":
@@ -10920,14 +10920,14 @@ function loadConfig() {
   const data = (0, import_yaml.parse)(fs3.readFileSync(p, "utf8"));
   return isDict(data) ? data : {};
 }
-function registryPath(overrideKey, envName, basename26) {
+function registryPath(overrideKey, envName, basename27) {
   const override = loadConfig()["overrides"]?.[overrideKey];
   if (override)
     return path3.resolve(expandUser(String(override)));
   const fromEnv = envVar(envName);
   if (fromEnv)
     return path3.resolve(expandUser(fromEnv));
-  return path3.join(sandboxHome(), basename26);
+  return path3.join(sandboxHome(), basename27);
 }
 function servicesYamlPath() {
   return registryPath("services_yaml", "SERVICES_YAML", "services.yaml");
@@ -11163,7 +11163,7 @@ function monorepoRoot() {
   }
   return sandboxRoot();
 }
-var import_yaml;
+var import_yaml, IDLE_SERVICE_TYPES;
 var init_config = __esm({
   "../../packages/sandbox-core/dist/config.js"() {
     "use strict";
@@ -11171,6 +11171,7 @@ var init_config = __esm({
     import_yaml = __toESM(require_dist(), 1);
     init_dot_dir();
     init_reporter();
+    IDLE_SERVICE_TYPES = ["cli", "library", "extension"];
   }
 });
@@ -11845,6 +11846,8 @@ function fromGh(ref, i) {
     ref,
     title: i.title?.trim() || void 0,
     status: titleCase(i.state),
+    ...i.state?.toUpperCase() === "CLOSED" ? { statusCategory: "done" } : {},
+    labels: i.labels?.map((l) => l.name),
     type: i.labels?.map((l) => l.name).join(", ") || void 0,
     assignee: i.assignees?.map((a) => a.login).join(", ") || void 0,
     description: i.body?.trim() || void 0,
@@ -11863,7 +11866,7 @@ async function view(ref, fields) {
     return null;
   }
 }
-var GITHUB_ISSUE_PATTERN, FULL_RE, CLOSED, OPEN, STATUS_LABEL_COLOR, ghBin, titleCase, github;
+var GITHUB_ISSUE_PATTERN, FULL_RE, CLOSED, NOT_PLANNED, STATUS_PREFIX, OPEN, STATUS_LABEL_COLOR, ghBin, titleCase, github;
 var init_github = __esm({
   "../../packages/sandbox-core/dist/issue_trackers/github.js"() {
     "use strict";
@@ -11874,7 +11877,9 @@ var init_github = __esm({
     init_proc();
     GITHUB_ISSUE_PATTERN = "^([A-Za-z0-9_.-]+/)?[A-Za-z0-9_.-]+#[0-9]+$";
     FULL_RE = /^([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)#(\d+)$/;
-    CLOSED = /* @__PURE__ */ new Set(["closed", "close", "done"]);
+    CLOSED = /* @__PURE__ */ new Set(["closed", "close", "done", "completed"]);
+    NOT_PLANNED = /* @__PURE__ */ new Set(["not planned", "abandoned"]);
+    STATUS_PREFIX = "status:";
     OPEN = /* @__PURE__ */ new Set(["open", "reopen", "reopened"]);
     STATUS_LABEL_COLOR = "1D76DB";
     ghBin = () => envVar("GH_BIN") || "gh";
@@ -11918,12 +11923,24 @@ var init_github = __esm({
         if (status2) {
           const s = status2.toLowerCase();
           if (CLOSED.has(s))
-            await gh(["issue", "close", n, "-R", repo]);
+            await gh(["issue", "close", n, "-R", repo, "--reason", "completed"]);
+          else if (NOT_PLANNED.has(s))
+            await gh(["issue", "close", n, "-R", repo, "--reason", "not planned"]);
           else if (OPEN.has(s))
             await gh(["issue", "reopen", n, "-R", repo]);
           else {
+            const stale = s.startsWith(STATUS_PREFIX) ? ((await view(ref, "labels"))?.labels ?? []).filter((l) => l.toLowerCase().startsWith(STATUS_PREFIX) && l.toLowerCase() !== s) : [];
             await gh(["label", "create", status2, "-R", repo, "--color", STATUS_LABEL_COLOR, "--force"]);
-            await gh(["issue", "edit", n, "-R", repo, "--add-label", status2]);
+            await gh([
+              "issue",
+              "edit",
+              n,
+              "-R",
+              repo,
+              "--add-label",
+              status2,
+              ...stale.length ? ["--remove-label", stale.join(",")] : []
+            ]);
           }
         }
         if (update.comment)
@@ -12053,19 +12070,19 @@ async function updateIssueRest(key, update) {
   const creds = await jiraCreds();
   if (!creds)
     return null;
-  const path73 = `/rest/api/2/issue/${encodeURIComponent(key)}`;
+  const path74 = `/rest/api/2/issue/${encodeURIComponent(key)}`;
   if (update.status) {
     const want = update.status.trim().toLowerCase();
-    const { transitions = [] } = await jiraGet(creds, `${path73}/transitions`);
+    const { transitions = [] } = await jiraGet(creds, `${path74}/transitions`);
     const t = transitions.find((x) => x.to?.name?.toLowerCase() === want) ?? transitions.find((x) => x.name?.toLowerCase() === want);
     if (!t) {
       const names = transitions.map((x) => x.to?.name ?? x.name).filter(Boolean).join(", ");
       throw new Error(`${key} has no transition to "${update.status}" (available: ${names || "none"})`);
     }
-    await jiraFetch(creds, `${path73}/transitions`, { transition: { id: t.id } });
+    await jiraFetch(creds, `${path74}/transitions`, { transition: { id: t.id } });
   }
   if (update.comment)
-    await jiraFetch(creds, `${path73}/comment`, { body: update.comment });
+    await jiraFetch(creds, `${path74}/comment`, { body: update.comment });
   return true;
 }
 var JIRA_PLACEHOLDERS, isJiraPlaceholder, ISSUE_FIELDS;
@@ -12119,6 +12136,7 @@ function fromRest(r) {
     ref: r.key,
     title: str(f.summary),
     status: str(f.status?.name),
+    statusCategory: category(f.status?.statusCategory?.key),
     type: str(f.issuetype?.name),
     assignee: str(f.assignee?.displayName),
     description: str(f.description),
@@ -12129,7 +12147,7 @@ function fromRest(r) {
 async function fetchViaMcp(key) {
   const parsed = await askClaudeJson(`You are a data extractor, not an agent. Do exactly two things and nothing else:
 1. Fetch Jira issue ${key} INCLUDING ITS COMMENTS using getJiraIssue ${jiraSitePhrase()} \u2014 request fields ["summary","status","issuetype","assignee","description","comment"].
-2. Output ONLY a JSON object between <result> and </result> tags with keys "title","status","type","assignee","description" (strings, "" when unavailable) and "comments" (an array of {"author","created","body"}, oldest first). ` + READ_ONLY + "\nIf you cannot fetch the issue, output <result>{}</result> and nothing else.", { tools: true });
+2. Output ONLY a JSON object between <result> and </result> tags with keys "title","status","statusCategory" (the status category key: new, indeterminate or done), "type","assignee","description" (strings, "" when unavailable) and "comments" (an array of {"author","created","body"}, oldest first). ` + READ_ONLY + "\nIf you cannot fetch the issue, output <result>{}</result> and nothing else.", { tools: true });
   if (!parsed || !str(parsed.title))
     return null;
   const comments = Array.isArray(parsed.comments) ? parsed.comments.flatMap((c) => {
@@ -12143,6 +12161,7 @@ async function fetchViaMcp(key) {
     ref: key,
     title: str(parsed.title),
     status: str(parsed.status),
+    statusCategory: category(parsed.statusCategory),
     type: str(parsed.type),
     assignee: str(parsed.assignee),
     description: str(parsed.description),
@@ -12173,7 +12192,7 @@ ${update.comment}`
   if (parsed?.ok !== true)
     throw new Error(str(parsed?.error) ?? `Could not update ${key} through the Atlassian MCP`);
 }
-var KEY_RE, str, READ_ONLY, SANDBOX_ISSUES_REPO, ISSUE_TYPES, jira;
+var KEY_RE, str, CATEGORIES, category, READ_ONLY, SANDBOX_ISSUES_REPO, ISSUE_TYPES, jira;
 var init_jira = __esm({
   "../../packages/sandbox-core/dist/issue_trackers/jira.js"() {
     "use strict";
@@ -12183,6 +12202,8 @@ var init_jira = __esm({
     init_jira_rest();
     KEY_RE = /[A-Za-z][A-Za-z0-9]+-\d+/;
     str = (v) => typeof v === "string" && v.trim() ? v.trim() : void 0;
+    CATEGORIES = ["new", "indeterminate", "done"];
+    category = (v) => CATEGORIES.find((c) => c === str(v)?.toLowerCase());
     READ_ONLY = "Do not create, edit, transition, or comment on anything; write no prose outside the tags.";
     SANDBOX_ISSUES_REPO = "jbbz-sandbox/werkmeister";
     ISSUE_TYPES = { bug: "Bug", feature: "Story", task: "Task" };
@@ -12420,7 +12441,8 @@ function readAutonomous(workspaceRoot) {
   return isTrue(readWorkspaceField(workspaceRoot, "autonomous"));
 }
 function readAutoStop(workspaceRoot) {
-  return isTrue(readWorkspaceField(workspaceRoot, "auto_stop"));
+  const value = readWorkspaceField(workspaceRoot, "auto_stop");
+  return value === void 0 || value === null || value === "" ? readAutonomous(workspaceRoot) : isTrue(value);
 }
 function readModel(workspaceRoot) {
   const model = readWorkspaceField(workspaceRoot, "model");
@@ -12795,7 +12817,7 @@ var init_workspace_prompts = __esm({
       {
         key: "auto_stop",
         label: "Auto-stop on session end",
-        help: "Off by default. On: when a Claude session in the workspace ends and no other one is open there, a SessionEnd hook runs `sandbox stop --if-idle`, which stops this feature's containers (slot and volumes kept; `sandbox up` resumes). Shared infra is never stopped.",
+        help: "On by default for autonomous workspaces, off otherwise. On: when a Claude session in the workspace ends and no other one is open there, a SessionEnd hook runs `sandbox stop --if-idle`, which stops this feature's containers (slot and volumes kept; `sandbox up` resumes). Shared infra is never stopped.",
         boolean: true
       },
       {
@@ -13311,7 +13333,16 @@ var init_hooks_gen = __esm({
       // No-arg forms act on the cwd's FEATURE; `autonomousRules` adds the named ones.
       "Bash(sandbox up)",
       "Bash(sandbox restart)",
-      ...["status", "pr", "issue view", "init-workspace", "skills", "standards", "notes context"].map((cmd) => `Bash(sandbox ${cmd}:*)`),
+      ...[
+        "status",
+        "pr",
+        "issue view",
+        "issue start",
+        "init-workspace",
+        "skills",
+        "standards",
+        "notes context"
+      ].map((cmd) => `Bash(sandbox ${cmd}:*)`),
       "Bash(docker ps:*)",
       // Local build and test; no `npm install`, so a new dependency waits for a person.
       ...["npm ci", "npm run", "npm test", "npx", "node", "python3"].map((cmd) => `Bash(${cmd}:*)`),
@@ -13560,8 +13591,8 @@ Lifecycle: \`working \u2192 ready \u2192 pr-open \u2192 merged \u2192 shipped \u
 | \`sandbox pr status\` | record merged / shipped / closed from GitHub and release tags |
 | \`sandbox pr adopt <pr-number\\|url> [repo]\` | the fix landed outside this workspace: write the PR file from that PR, then record its status |
 | \`sandbox pr adopt --no-pr "<reason>" [repo]\` | the fix is already on base with no PR: write a \`closed\` PR file with the reason |
-| \`sandbox close-out\` | after ship: close the issue, write \`closeout.md\`, remove the workspace, delete merged branches |
-| \`sandbox close-out --abandon "<reason>"\` | give up: record the reason, push and keep every branch, remove the workspace |
+| \`sandbox close-out\` | after ship: move the issue to done if shipping didn't, write \`closeout.md\`, remove the workspace, delete merged branches |
+| \`sandbox close-out --abandon "<reason>"\` | give up: record the reason, comment it on the issue, push and keep every branch, remove the workspace |
 `;
 }
 var init_pr_rules = __esm({
@@ -14184,7 +14215,7 @@ var init_icm_templates = __esm({
           "One commit per code repo touched, on that worktree's branch",
           "`output/pr-<repo>.md` per repo"
         ],
-        humanCheck: "Read each `pr-*.md`. Set `status: approved` on each one to open \u2014 that flip is the approval. Then `sandbox pr open` runs the gate and opens it. Merging is yours. After the release, `sandbox pr status`, then `sandbox close-out`.",
+        humanCheck: "Read each `pr-*.md`. Set `status: approved` on each one to open \u2014 that flip is the approval. Then `sandbox pr open` runs the gate and opens it. Merging is yours. After the release, `sandbox pr status`, then ask the person before `sandbox close-out`.",
         selfCheck: "Review each `pr-*.md` once against `../../BRIEF.md` and the live issue. Add `## Recommendations for reviewer` to its body \u2014 every decision and question collected on the way \u2014 then set `status: approved` yourself and run `sandbox pr open`. Stop at the PR URL. Merging is the person's."
       })
     };
@@ -14462,6 +14493,7 @@ function renderIssueRef(issue) {
     "",
     `${name}${title}. ${copy}`,
     "Before each stage, re-read the live issue for newer direction: `sandbox issue view`",
+    "Its status moves by itself (In Progress \u2192 In Review \u2192 Done): `docs/workspace-lifecycle.md` \xA7 Issue status in the sandbox repo.",
     ""
   ].join("\n");
 }
@@ -14495,6 +14527,17 @@ function proposeDir(stages) {
   const i = stages.findIndex((s) => s.name === "propose");
   return i < 0 ? null : stageDirs(stages)[i];
 }
+function restartLine(feature2, services) {
+  const [servicesConfig] = loadSandboxServiceConfigs();
+  const isIdle = (s) => IDLE_SERVICE_TYPES.includes(servicesConfig[s]?.type ?? "");
+  const names = (list2) => list2.map((s) => `\`${feature2}-${s}\``).join(", ");
+  const restarted = services.filter((s) => !isIdle(s));
+  const idle = services.filter(isIdle);
+  return [
+    restarted.length ? restarted.map((s) => `\`docker restart ${feature2}-${s}\``).join(", ") : "",
+    idle.length ? `${names(idle)} run no watcher, so a restart rebuilds nothing: build and test inside them with \`docker exec\` as \`.sandbox/sandbox-context.md\` \xA7 Test commands shows` : ""
+  ].filter(Boolean).join("; ");
+}
 function vars(ctx, stages) {
   const dirs = stageDirs(stages);
   const feature2 = (ctx.meta["FEATURE"] ?? "").trim();
@@ -14503,8 +14546,7 @@ function vars(ctx, stages) {
   return {
     at: (name) => `../${dirs[stages.findIndex((s) => s.name === name)]}`,
     repos: repos.length ? repos.map((r) => `\`../../${r}/\``).join(", ") : "the code worktrees in this workspace",
-    // Container names follow docker-compose.feature.yml.njk: <feature>-<service>.
-    restart: feature2 && services.length ? services.map((s) => `\`docker restart ${feature2}-${s}\``).join(", ") : "restart whatever serves the change as `.sandbox/sandbox-context.md` describes",
+    restart: feature2 && services.length ? restartLine(feature2, services) : "restart whatever serves the change as `.sandbox/sandbox-context.md` describes",
     standards: "",
     autonomous: isTrue(ctx.inputs["autonomous"])
   };
@@ -14555,7 +14597,7 @@ function standardsRef(tier, r) {
   const rows = tier === "all" ? r.active : r.active.filter((d) => universal.includes(d));
   return `- Reference (every run): \`../../_shared/standards.md\` \u2014 rows ${[...rows, "ponytail"].map((d) => `\`${d}\``).join(", ")}`;
 }
-function renderContract(dir, stage, v) {
+function renderContract(dir, stage, v, startsIssue = false) {
   const c = stage.contract(v);
   return [
     `# ${dir} \u2014 ${stage.job}`,
@@ -14569,6 +14611,8 @@ function renderContract(dir, stage, v) {
     `Do NOT load: ${c.doNotLoad}`,
     "",
     "## Process",
+    // Step 0, so the contracts' own "steps 1–3" references keep their numbers.
+    ...startsIssue ? [`0. ${START_ISSUE}`] : [],
     ...c.process.map((p, i) => `${i + 1}. ${p}`),
     "",
     "## Outputs",
@@ -14615,7 +14659,7 @@ function renderClaudeMd(ctx, stages) {
     ...proposeDir(stages) ? [
       "| asked to open or create a PR \u2014 including `/create-pr` or `finishing-a-development-branch` | `_shared/pr-rules.md`, then `sandbox pr open`, then Auto-fix on (rule 5) | PR URL is in the PR file and Auto-fix is on |"
     ] : [],
-    "| a PR merged or released, or asked to close out | `sandbox pr status`, then `sandbox close-out` | closed out |",
+    "| a PR merged or released, or asked to close out | `sandbox pr status`, then ask the person before `sandbox close-out` | closed out after the person says yes |",
     "| asked for status | `ls stages/*/output/` | report which stages hold artifacts |",
     "| containers / ports / routing broken | `.sandbox/sandbox-context.md` | \u2014 |",
     "| you hit a bug or need to log a feature/task \u2014 in the `sandbox` tool or in a repo's code | `_shared/issues-report.md`: if this workspace's changes caused a bug, fix it here; otherwise file an issue where it belongs | fixed, or issue URL reported to the person |",
@@ -14695,10 +14739,7 @@ function render(ctx) {
   if (propose2)
     files["_shared/pr-rules.md"] = buildPrRulesMd(`stages/${propose2}/output/`, base.autonomous);
   stages.forEach((stage, i) => {
-    files[`stages/${dirs[i]}/CONTEXT.md`] = renderContract(dirs[i], stage, {
-      ...base,
-      standards: standardsRef(stage.standards, r)
-    });
+    files[`stages/${dirs[i]}/CONTEXT.md`] = renderContract(dirs[i], stage, { ...base, standards: standardsRef(stage.standards, r) }, i === 0 && Boolean(issueIdOfMeta(ctx.meta)));
   });
   return files;
 }
@@ -14768,7 +14809,7 @@ function init(ctx) {
   }
   icm.refresh(root);
 }
-var PONYTAIL_ROW, ONE_RULE, NO_PROMPT, READ_ISSUE, PLACEHOLDER_BRIEF_RE, icm;
+var PONYTAIL_ROW, START_ISSUE, ONE_RULE, NO_PROMPT, READ_ISSUE, PLACEHOLDER_BRIEF_RE, icm;
 var init_icm = __esm({
   "../../packages/sandbox-core/dist/strategies/icm.js"() {
     "use strict";
@@ -14786,6 +14827,7 @@ var init_icm = __esm({
     init_icm_templates();
     init_issue_section();
     PONYTAIL_ROW = "| ponytail | already loaded: the ponytail plugin's SessionStart hook prints `PONYTAIL MODE ACTIVE` in every session. Invoke the `ponytail` skill only if that line is missing from your session context | any code edit |";
+    START_ISSUE = "Run `sandbox issue start`: it moves the issue to In Progress, and does nothing when the issue is already past that or the tracker refuses.";
     ONE_RULE = [
       "## The one rule",
       "",
@@ -15095,69 +15137,69 @@ var require_chownr = __commonJS({
   "../../node_modules/chownr/chownr.js"(exports, module) {
     "use strict";
     init_define_SANDBOX_BUILD();
-    var fs65 = __require("fs");
-    var path73 = __require("path");
-    var LCHOWN = fs65.lchown ? "lchown" : "chown";
-    var LCHOWNSYNC = fs65.lchownSync ? "lchownSync" : "chownSync";
-    var needEISDIRHandled = fs65.lchown && !process.version.match(/v1[1-9]+\./) && !process.version.match(/v10\.[6-9]/);
-    var lchownSync = (path74, uid, gid) => {
+    var fs66 = __require("fs");
+    var path74 = __require("path");
+    var LCHOWN = fs66.lchown ? "lchown" : "chown";
+    var LCHOWNSYNC = fs66.lchownSync ? "lchownSync" : "chownSync";
+    var needEISDIRHandled = fs66.lchown && !process.version.match(/v1[1-9]+\./) && !process.version.match(/v10\.[6-9]/);
+    var lchownSync = (path75, uid, gid) => {
       try {
-        return fs65[LCHOWNSYNC](path74, uid, gid);
+        return fs66[LCHOWNSYNC](path75, uid, gid);
       } catch (er) {
         if (er.code !== "ENOENT")
           throw er;
       }
     };
-    var chownSync = (path74, uid, gid) => {
+    var chownSync = (path75, uid, gid) => {
       try {
-        return fs65.chownSync(path74, uid, gid);
+        return fs66.chownSync(path75, uid, gid);
       } catch (er) {
         if (er.code !== "ENOENT")
           throw er;
       }
     };
-    var handleEISDIR = needEISDIRHandled ? (path74, uid, gid, cb) => (er) => {
+    var handleEISDIR = needEISDIRHandled ? (path75, uid, gid, cb) => (er) => {
       if (!er || er.code !== "EISDIR")
         cb(er);
       else
-        fs65.chown(path74, uid, gid, cb);
+        fs66.chown(path75, uid, gid, cb);
     } : (_, __, ___, cb) => cb;
-    var handleEISDirSync = needEISDIRHandled ? (path74, uid, gid) => {
+    var handleEISDirSync = needEISDIRHandled ? (path75, uid, gid) => {
       try {
-        return lchownSync(path74, uid, gid);
+        return lchownSync(path75, uid, gid);
       } catch (er) {
         if (er.code !== "EISDIR")
           throw er;
-        chownSync(path74, uid, gid);
+        chownSync(path75, uid, gid);
       }
-    } : (path74, uid, gid) => lchownSync(path74, uid, gid);
+    } : (path75, uid, gid) => lchownSync(path75, uid, gid);
     var nodeVersion = process.version;
-    var readdir = (path74, options, cb) => fs65.readdir(path74, options, cb);
-    var readdirSync19 = (path74, options) => fs65.readdirSync(path74, options);
+    var readdir = (path75, options, cb) => fs66.readdir(path75, options, cb);
+    var readdirSync20 = (path75, options) => fs66.readdirSync(path75, options);
     if (/^v4\./.test(nodeVersion))
-      readdir = (path74, options, cb) => fs65.readdir(path74, cb);
+      readdir = (path75, options, cb) => fs66.readdir(path75, cb);
     var chown = (cpath, uid, gid, cb) => {
-      fs65[LCHOWN](cpath, uid, gid, handleEISDIR(cpath, uid, gid, (er) => {
+      fs66[LCHOWN](cpath, uid, gid, handleEISDIR(cpath, uid, gid, (er) => {
         cb(er && er.code !== "ENOENT" ? er : null);
       }));
     };
     var chownrKid = (p, child, uid, gid, cb) => {
       if (typeof child === "string")
-        return fs65.lstat(path73.resolve(p, child), (er, stats) => {
+        return fs66.lstat(path74.resolve(p, child), (er, stats) => {
           if (er)
             return cb(er.code !== "ENOENT" ? er : null);
           stats.name = child;
           chownrKid(p, stats, uid, gid, cb);
         });
       if (child.isDirectory()) {
-        chownr(path73.resolve(p, child.name), uid, gid, (er) => {
+        chownr(path74.resolve(p, child.name), uid, gid, (er) => {
           if (er)
             return cb(er);
-          const cpath = path73.resolve(p, child.name);
+          const cpath = path74.resolve(p, child.name);
           chown(cpath, uid, gid, cb);
         });
       } else {
-        const cpath = path73.resolve(p, child.name);
+        const cpath = path74.resolve(p, child.name);
         chown(cpath, uid, gid, cb);
       }
     };
@@ -15187,7 +15229,7 @@ var require_chownr = __commonJS({
     var chownrKidSync = (p, child, uid, gid) => {
       if (typeof child === "string") {
         try {
-          const stats = fs65.lstatSync(path73.resolve(p, child));
+          const stats = fs66.lstatSync(path74.resolve(p, child));
           stats.name = child;
           child = stats;
         } catch (er) {
@@ -15198,13 +15240,13 @@ var require_chownr = __commonJS({
         }
       }
       if (child.isDirectory())
-        chownrSync(path73.resolve(p, child.name), uid, gid);
-      handleEISDirSync(path73.resolve(p, child.name), uid, gid);
+        chownrSync(path74.resolve(p, child.name), uid, gid);
+      handleEISDirSync(path74.resolve(p, child.name), uid, gid);
     };
     var chownrSync = (p, uid, gid) => {
       let children;
       try {
-        children = readdirSync19(p, { withFileTypes: true });
+        children = readdirSync20(p, { withFileTypes: true });
       } catch (er) {
         if (er.code === "ENOENT")
           return;
@@ -15355,7 +15397,7 @@ var require_buffer_list = __commonJS({
         }
       }, {
         key: "join",
-        value: function join52(s) {
+        value: function join53(s) {
           if (this.length === 0) return "";
           var p = this.head;
           var ret = "" + p.data;
@@ -19200,9 +19242,9 @@ var require_pump = __commonJS({
     init_define_SANDBOX_BUILD();
     var once = require_once();
     var eos = require_end_of_stream2();
-    var fs65;
+    var fs66;
     try {
-      fs65 = __require("fs");
+      fs66 = __require("fs");
     } catch (e) {
     }
     var noop = function() {
@@ -19213,8 +19255,8 @@ var require_pump = __commonJS({
     };
     var isFS = function(stream) {
       if (!ancient) return false;
-      if (!fs65) return false;
-      return (stream instanceof (fs65.ReadStream || noop) || stream instanceof (fs65.WriteStream || noop)) && isFn(stream.close);
+      if (!fs66) return false;
+      return (stream instanceof (fs66.ReadStream || noop) || stream instanceof (fs66.WriteStream || noop)) && isFn(stream.close);
     };
     var isRequest = function(stream) {
       return stream.setHeader && isFn(stream.abort);
@@ -19274,8 +19316,8 @@ var require_pump = __commonJS({
 var require_mkdirp_classic = __commonJS({
   "../../node_modules/mkdirp-classic/index.js"(exports, module) {
     init_define_SANDBOX_BUILD();
-    var path73 = __require("path");
-    var fs65 = __require("fs");
+    var path74 = __require("path");
+    var fs66 = __require("fs");
     var _0777 = parseInt("0777", 8);
     module.exports = mkdirP.mkdirp = mkdirP.mkdirP = mkdirP;
     function mkdirP(p, opts, f, made) {
@@ -19286,14 +19328,14 @@ var require_mkdirp_classic = __commonJS({
         opts = { mode: opts };
       }
       var mode = opts.mode;
-      var xfs = opts.fs || fs65;
+      var xfs = opts.fs || fs66;
       if (mode === void 0) {
         mode = _0777 & ~process.umask();
       }
       if (!made) made = null;
       var cb = f || function() {
       };
-      p = path73.resolve(p);
+      p = path74.resolve(p);
       xfs.mkdir(p, mode, function(er) {
         if (!er) {
           made = made || p;
@@ -19301,7 +19343,7 @@ var require_mkdirp_classic = __commonJS({
         }
         switch (er.code) {
           case "ENOENT":
-            mkdirP(path73.dirname(p), opts, function(er2, made2) {
+            mkdirP(path74.dirname(p), opts, function(er2, made2) {
               if (er2) cb(er2, made2);
               else mkdirP(p, opts, cb, made2);
             });
@@ -19323,19 +19365,19 @@ var require_mkdirp_classic = __commonJS({
         opts = { mode: opts };
       }
       var mode = opts.mode;
-      var xfs = opts.fs || fs65;
+      var xfs = opts.fs || fs66;
       if (mode === void 0) {
         mode = _0777 & ~process.umask();
       }
       if (!made) made = null;
-      p = path73.resolve(p);
+      p = path74.resolve(p);
       try {
         xfs.mkdirSync(p, mode);
         made = made || p;
       } catch (err0) {
         switch (err0.code) {
           case "ENOENT":
-            made = sync(path73.dirname(p), opts, made);
+            made = sync(path74.dirname(p), opts, made);
             sync(p, opts, made);
             break;
           // In the case of any other error, just see if there's a dir
@@ -19365,8 +19407,8 @@ var require_tar_fs = __commonJS({
     var tar2 = require_tar_stream();
     var pump = require_pump();
     var mkdirp = require_mkdirp_classic();
-    var fs65 = __require("fs");
-    var path73 = __require("path");
+    var fs66 = __require("fs");
+    var path74 = __require("path");
     var os21 = __require("os");
     var win32 = os21.platform() === "win32";
     var noop = function() {
@@ -19377,23 +19419,23 @@ var require_tar_fs = __commonJS({
     var normalize = !win32 ? echo : function(name) {
       return name.replace(/\\/g, "/").replace(/[:?<>|]/g, "_");
     };
-    var statAll = function(fs66, stat, cwd, ignore, entries, sort) {
+    var statAll = function(fs67, stat, cwd, ignore, entries, sort) {
       var queue = entries || ["."];
       for (var i = 0; i < queue.length; i++) {
-        if (!inCwd(path73.resolve(cwd, queue[i]), cwd)) throw new Error(queue[i] + " is not a valid path");
+        if (!inCwd(path74.resolve(cwd, queue[i]), cwd)) throw new Error(queue[i] + " is not a valid path");
       }
       return function loop(callback) {
         if (!queue.length) return callback();
         var next = queue.shift();
-        var nextAbs = path73.join(cwd, next);
-        stat.call(fs66, nextAbs, function(err, stat2) {
+        var nextAbs = path74.join(cwd, next);
+        stat.call(fs67, nextAbs, function(err, stat2) {
           if (err) return callback(err);
           if (!stat2.isDirectory()) return callback(null, next, stat2);
-          fs66.readdir(nextAbs, function(err2, files) {
+          fs67.readdir(nextAbs, function(err2, files) {
             if (err2) return callback(err2);
             if (sort) files.sort();
             for (var i2 = 0; i2 < files.length; i2++) {
-              if (!ignore(path73.join(cwd, next, files[i2]))) queue.push(path73.join(next, files[i2]));
+              if (!ignore(path74.join(cwd, next, files[i2]))) queue.push(path74.join(next, files[i2]));
             }
             callback(null, next, stat2);
           });
@@ -19404,7 +19446,7 @@ var require_tar_fs = __commonJS({
       return function(header) {
         header.name = header.name.split("/").slice(level).join("/");
         var linkname = header.linkname;
-        if (linkname && (header.type === "link" || path73.isAbsolute(linkname))) {
+        if (linkname && (header.type === "link" || path74.isAbsolute(linkname))) {
           header.linkname = linkname.split("/").slice(level).join("/");
         }
         return map(header);
@@ -19413,7 +19455,7 @@ var require_tar_fs = __commonJS({
     exports.pack = function(cwd, opts) {
       if (!cwd) cwd = ".";
       if (!opts) opts = {};
-      var xfs = opts.fs || fs65;
+      var xfs = opts.fs || fs66;
       var ignore = opts.ignore || opts.filter || noop;
       var map = opts.map || noop;
       var mapStream = opts.mapStream || echo;
@@ -19434,7 +19476,7 @@ var require_tar_fs = __commonJS({
         fmode |= parseInt(222, 8);
       }
       var onsymlink = function(filename, header) {
-        xfs.readlink(path73.join(cwd, filename), function(err, linkname) {
+        xfs.readlink(path74.join(cwd, filename), function(err, linkname) {
           if (err) return pack2.destroy(err);
           header.linkname = normalize(linkname);
           pack2.entry(header, onnextentry);
@@ -19475,7 +19517,7 @@ var require_tar_fs = __commonJS({
         }
         var entry = pack2.entry(header, onnextentry);
         if (!entry) return;
-        var rs = mapStream(xfs.createReadStream(path73.join(cwd, filename), { start: 0, end: header.size > 0 ? header.size - 1 : header.size }), header);
+        var rs = mapStream(xfs.createReadStream(path74.join(cwd, filename), { start: 0, end: header.size > 0 ? header.size - 1 : header.size }), header);
         rs.on("error", function(err2) {
           entry.destroy(err2);
         });
@@ -19500,7 +19542,7 @@ var require_tar_fs = __commonJS({
     exports.extract = function(cwd, opts) {
       if (!cwd) cwd = ".";
       if (!opts) opts = {};
-      var xfs = opts.fs || fs65;
+      var xfs = opts.fs || fs66;
       var ignore = opts.ignore || opts.filter || noop;
       var map = opts.map || noop;
       var mapStream = opts.mapStream || echo;
@@ -19553,14 +19595,14 @@ var require_tar_fs = __commonJS({
       extract.on("entry", function(header, stream, next) {
         header = map(header) || header;
         header.name = normalize(header.name);
-        var name = path73.join(cwd, path73.join("/", header.name));
+        var name = path74.join(cwd, path74.join("/", header.name));
         if (ignore(name, header)) {
           stream.resume();
           return next();
         }
         var stat = function(err) {
           if (err) return next(err);
-          if (path73.join(name, ".") === path73.join(cwd, ".")) return next();
+          if (path74.join(name, ".") === path74.join(cwd, ".")) return next();
           utimes(name, header, function(err2) {
             if (err2) return next(err2);
             if (win32) return next();
@@ -19570,9 +19612,9 @@ var require_tar_fs = __commonJS({
         var onsymlink = function() {
           if (win32) return next();
           xfs.unlink(name, function() {
-            var dst = path73.resolve(path73.dirname(name), header.linkname);
+            var dst = path74.resolve(path74.dirname(name), header.linkname);
             if (!inCwd(dst, cwd)) return next(new Error(name + " is not a valid symlink"));
-            validateNotSymlink(xfs, dst, path73.resolve(cwd), function(err, valid) {
+            validateNotSymlink(xfs, dst, path74.resolve(cwd), function(err, valid) {
               if (err) return next(err);
               if (!valid) return next(new Error(name + " is not a valid symlink"));
               xfs.symlink(header.linkname, name, stat);
@@ -19582,7 +19624,7 @@ var require_tar_fs = __commonJS({
         var onlink = function() {
           if (win32) return next();
           xfs.unlink(name, function() {
-            var srcpath = path73.join(cwd, path73.join("/", header.linkname));
+            var srcpath = path74.join(cwd, path74.join("/", header.linkname));
             xfs.realpath(srcpath, function(err, dst) {
               if (err || !inCwd(dst, cwd)) return next(new Error(name + " is not a valid hardlink"));
               xfs.link(dst, name, function(err2) {
@@ -19622,8 +19664,8 @@ var require_tar_fs = __commonJS({
             gid: header.gid
           }, stat);
         }
-        var dir = path73.dirname(name);
-        validate(xfs, dir, path73.join(cwd, "."), function(err, valid) {
+        var dir = path74.dirname(name);
+        validate(xfs, dir, path74.join(cwd, "."), function(err, valid) {
           if (err) return next(err);
           if (!valid) return next(new Error(dir + " is not a valid path"));
           mkdirfix(dir, {
@@ -19650,20 +19692,20 @@ var require_tar_fs = __commonJS({
       if (opts.finish) extract.on("finish", opts.finish);
       return extract;
     };
-    function validate(fs66, name, root, cb) {
+    function validate(fs67, name, root, cb) {
       if (name === root) return cb(null, true);
-      fs66.lstat(name, function(err, st) {
+      fs67.lstat(name, function(err, st) {
         if (err && err.code !== "ENOENT") return cb(err);
-        if (err || st.isDirectory()) return validate(fs66, path73.join(name, ".."), root, cb);
+        if (err || st.isDirectory()) return validate(fs67, path74.join(name, ".."), root, cb);
         cb(null, false);
       });
     }
-    function validateNotSymlink(fs66, name, root, cb) {
+    function validateNotSymlink(fs67, name, root, cb) {
       if (name === root) return cb(null, true);
-      if (!name.startsWith(root + path73.sep)) return cb(null, false);
-      fs66.lstat(name, function(err, st) {
+      if (!name.startsWith(root + path74.sep)) return cb(null, false);
+      fs67.lstat(name, function(err, st) {
         if (err && err.code !== "ENOENT" && err.code !== "EPERM") return cb(err);
-        if (err || !st.isSymbolicLink()) return validateNotSymlink(fs66, path73.join(name, ".."), root, cb);
+        if (err || !st.isSymbolicLink()) return validateNotSymlink(fs67, path74.join(name, ".."), root, cb);
         cb(null, false);
       });
     }
@@ -19677,8 +19719,8 @@ var require_tar_fs = __commonJS({
       });
     }
     function inCwd(dst, cwd) {
-      cwd = path73.resolve(cwd);
-      return cwd === dst || dst.startsWith(cwd + path73.sep);
+      cwd = path74.resolve(cwd);
+      return cwd === dst || dst.startsWith(cwd + path74.sep);
     }
   }
 });
@@ -22548,11 +22590,11 @@ var require_lib = __commonJS({
     function lookupEscape(ch) {
       return escapeMap[ch];
     }
-    function _prettifyError(path73, withInternals, err) {
+    function _prettifyError(path74, withInternals, err) {
       if (!err.Update) {
         err = new _exports.TemplateError(err);
       }
-      err.Update(path73);
+      err.Update(path74);
       if (!withInternals) {
         var old = err;
         err = new Error(old.message);
@@ -22613,8 +22655,8 @@ var require_lib = __commonJS({
       err.lineno = lineno;
       err.colno = colno;
       err.firstUpdate = true;
-      err.Update = function Update(path73) {
-        var msg = "(" + (path73 || "unknown path") + ")";
+      err.Update = function Update(path74) {
+        var msg = "(" + (path74 || "unknown path") + ")";
         if (this.firstUpdate) {
           if (this.lineno && this.colno) {
             msg += " [Line " + this.lineno + ", Column " + this.colno + "]";
@@ -26464,7 +26506,7 @@ var require_filters = __commonJS({
       return r.copySafeness(str3, res);
     }
     _exports.indent = indent;
-    function join52(arr, del, attr) {
+    function join53(arr, del, attr) {
       del = del || "";
       if (attr) {
         arr = lib.map(arr, function(v) {
@@ -26473,7 +26515,7 @@ var require_filters = __commonJS({
       }
       return arr.join(del);
     }
-    _exports.join = join52;
+    _exports.join = join53;
     function last(arr) {
       return arr[arr.length - 1];
     }
@@ -26826,7 +26868,7 @@ var require_loader = __commonJS({
       };
       return _setPrototypeOf(o, p);
     }
-    var path73 = __require("path");
+    var path74 = __require("path");
     var _require = require_object();
     var EmitterObj = _require.EmitterObj;
     module.exports = /* @__PURE__ */ function(_EmitterObj) {
@@ -26836,7 +26878,7 @@ var require_loader = __commonJS({
       }
       var _proto = Loader.prototype;
       _proto.resolve = function resolve13(from, to) {
-        return path73.resolve(path73.dirname(from), to);
+        return path74.resolve(path74.dirname(from), to);
       };
       _proto.isRelative = function isRelative(filename) {
         return filename.indexOf("./") === 0 || filename.indexOf("../") === 0;
@@ -26910,8 +26952,8 @@ var require_node_loaders = __commonJS({
       };
       return _setPrototypeOf(o, p);
     }
-    var fs65 = __require("fs");
-    var path73 = __require("path");
+    var fs66 = __require("fs");
+    var path74 = __require("path");
     var Loader = require_loader();
     var _require = require_precompiled_loader();
     var PrecompiledLoader = _require.PrecompiledLoader;
@@ -26929,7 +26971,7 @@ var require_node_loaders = __commonJS({
         _this.noCache = !!opts.noCache;
         if (searchPaths) {
           searchPaths = Array.isArray(searchPaths) ? searchPaths : [searchPaths];
-          _this.searchPaths = searchPaths.map(path73.normalize);
+          _this.searchPaths = searchPaths.map(path74.normalize);
         } else {
           _this.searchPaths = ["."];
         }
@@ -26939,10 +26981,10 @@ var require_node_loaders = __commonJS({
           } catch (e) {
             throw new Error("watch requires chokidar to be installed");
           }
-          var paths = _this.searchPaths.filter(fs65.existsSync);
+          var paths = _this.searchPaths.filter(fs66.existsSync);
           var watcher = chokidar.watch(paths);
           watcher.on("all", function(event, fullname) {
-            fullname = path73.resolve(fullname);
+            fullname = path74.resolve(fullname);
             if (event === "change" && fullname in _this.pathsToNames) {
               _this.emit("update", _this.pathsToNames[fullname], fullname);
             }
@@ -26958,9 +27000,9 @@ var require_node_loaders = __commonJS({
         var fullpath = null;
         var paths = this.searchPaths;
         for (var i = 0; i < paths.length; i++) {
-          var basePath = path73.resolve(paths[i]);
-          var p = path73.resolve(paths[i], name);
-          if (p.indexOf(basePath) === 0 && fs65.existsSync(p)) {
+          var basePath = path74.resolve(paths[i]);
+          var p = path74.resolve(paths[i], name);
+          if (p.indexOf(basePath) === 0 && fs66.existsSync(p)) {
             fullpath = p;
             break;
           }
@@ -26970,7 +27012,7 @@ var require_node_loaders = __commonJS({
         }
         this.pathsToNames[fullpath] = name;
         var source = {
-          src: fs65.readFileSync(fullpath, "utf-8"),
+          src: fs66.readFileSync(fullpath, "utf-8"),
           path: fullpath,
           noCache: this.noCache
         };
@@ -27022,7 +27064,7 @@ var require_node_loaders = __commonJS({
         }
         this.pathsToNames[fullpath] = name;
         var source = {
-          src: fs65.readFileSync(fullpath, "utf-8"),
+          src: fs66.readFileSync(fullpath, "utf-8"),
           path: fullpath,
           noCache: this.noCache
         };
@@ -27229,13 +27271,13 @@ var require_express_app = __commonJS({
   "../../node_modules/nunjucks/src/express-app.js"(exports, module) {
     "use strict";
     init_define_SANDBOX_BUILD();
-    var path73 = __require("path");
+    var path74 = __require("path");
     module.exports = function express(env, app) {
       function NunjucksView(name, opts) {
         this.name = name;
         this.path = name;
         this.defaultEngine = opts.defaultEngine;
-        this.ext = path73.extname(name);
+        this.ext = path74.extname(name);
         if (!this.ext && !this.defaultEngine) {
           throw new Error("No default engine was specified and no extension was provided.");
         }
@@ -27616,7 +27658,7 @@ var require_environment = __commonJS({
         return _Obj2.apply(this, arguments) || this;
       }
       var _proto3 = Template2.prototype;
-      _proto3.init = function init3(src, env, path73, eagerCompile) {
+      _proto3.init = function init3(src, env, path74, eagerCompile) {
         this.env = env || new Environment();
         if (lib.isObject(src)) {
           switch (src.type) {
@@ -27634,7 +27676,7 @@ var require_environment = __commonJS({
         } else {
           throw new Error("src must be a string or an object describing the source");
         }
-        this.path = path73;
+        this.path = path74;
         if (eagerCompile) {
           try {
             this._compile();
@@ -27786,8 +27828,8 @@ var require_precompile = __commonJS({
   "../../node_modules/nunjucks/src/precompile.js"(exports, module) {
     "use strict";
     init_define_SANDBOX_BUILD();
-    var fs65 = __require("fs");
-    var path73 = __require("path");
+    var fs66 = __require("fs");
+    var path74 = __require("path");
     var _require = require_lib();
     var _prettifyError = _require._prettifyError;
     var compiler = require_compiler();
@@ -27819,14 +27861,14 @@ var require_precompile = __commonJS({
       if (opts.isString) {
         return precompileString(input2, opts);
       }
-      var pathStats = fs65.existsSync(input2) && fs65.statSync(input2);
+      var pathStats = fs66.existsSync(input2) && fs66.statSync(input2);
       var precompiled = [];
       var templates = [];
       function addTemplates(dir) {
-        fs65.readdirSync(dir).forEach(function(file) {
-          var filepath = path73.join(dir, file);
-          var subpath = filepath.substr(path73.join(input2, "/").length);
-          var stat = fs65.statSync(filepath);
+        fs66.readdirSync(dir).forEach(function(file) {
+          var filepath = path74.join(dir, file);
+          var subpath = filepath.substr(path74.join(input2, "/").length);
+          var stat = fs66.statSync(filepath);
           if (stat && stat.isDirectory()) {
             subpath += "/";
             if (!match(subpath, opts.exclude)) {
@@ -27838,13 +27880,13 @@ var require_precompile = __commonJS({
         });
       }
       if (pathStats.isFile()) {
-        precompiled.push(_precompile(fs65.readFileSync(input2, "utf-8"), opts.name || input2, env));
+        precompiled.push(_precompile(fs66.readFileSync(input2, "utf-8"), opts.name || input2, env));
       } else if (pathStats.isDirectory()) {
         addTemplates(input2);
         for (var i = 0; i < templates.length; i++) {
-          var name = templates[i].replace(path73.join(input2, "/"), "");
+          var name = templates[i].replace(path74.join(input2, "/"), "");
           try {
-            precompiled.push(_precompile(fs65.readFileSync(templates[i], "utf-8"), name, env));
+            precompiled.push(_precompile(fs66.readFileSync(templates[i], "utf-8"), name, env));
           } catch (e) {
             if (opts.force) {
               console.error(e);
@@ -28223,11 +28265,11 @@ var require_nunjucks = __commonJS({
       reset: function reset() {
         e = void 0;
       },
-      compile: function compile(src, env, path73, eagerCompile) {
+      compile: function compile(src, env, path74, eagerCompile) {
         if (!e) {
           configure();
         }
-        return new Template(src, env, path73, eagerCompile);
+        return new Template(src, env, path74, eagerCompile);
       },
       render: function render2(name, ctx, cb) {
         if (!e) {
@@ -28279,12 +28321,12 @@ function resolveSecrets(all, servicesConfig, serviceNames, overrides = {}) {
 function getSecretsPath() {
   return secretsPath();
 }
-function loadSecrets(path73) {
-  if (!(fs26.existsSync(path73) && fs26.statSync(path73).isFile())) {
+function loadSecrets(path74) {
+  if (!(fs26.existsSync(path74) && fs26.statSync(path74).isFile())) {
     return {};
   }
   const result = {};
-  for (const rawLine of fs26.readFileSync(path73, "utf8").split("\n")) {
+  for (const rawLine of fs26.readFileSync(path74, "utf8").split("\n")) {
     const line = rawLine.trim();
     if (!line || line.startsWith("#") || !line.includes("=")) {
       continue;
@@ -28575,6 +28617,7 @@ function getTemplateOrNull(env, name) {
 function composeHeader(feature2, source) {
   return `# Sandbox docker-compose for feature: ${feature2}
 # Generated by: ${source}
+# Regenerated by \`sandbox up\` whenever stale; do not hand-edit.
 #
 # Run from workspace root:
 #   docker compose up -d --build   (start)
@@ -28742,6 +28785,7 @@ function renderFeatureCompose(feature2, slot, localServices, config, workspaceOv
       base_port: portStart,
       local_services: svcObjects,
       services_config: servicesConfig,
+      idle_types: IDLE_SERVICE_TYPES,
       setup_configs: setupConfigs,
       ports_config: portsConfig,
       workspace_path: workspaceRoot,
@@ -29298,9 +29342,9 @@ async function generateWorkspaceCompose(feature2, servicesStr, workspaceRoot, te
       continue;
     }
     const stripped = (svcDef["path"] ?? "").replace(/\/+$/, "");
-    const basename26 = stripped.includes("/") ? stripped.slice(stripped.lastIndexOf("/") + 1) : stripped;
-    if (basename26 !== svcName) {
-      pathAliases[basename26] = svcName;
+    const basename27 = stripped.includes("/") ? stripped.slice(stripped.lastIndexOf("/") + 1) : stripped;
+    if (basename27 !== svcName) {
+      pathAliases[basename27] = svcName;
     }
   }
   const resolve13 = (name) => {
@@ -29482,6 +29526,18 @@ function refreshKubeconfig() {
   }
   return fs29.existsSync(kubeconfig) && fs29.statSync(kubeconfig).isFile();
 }
+function clusterReachable() {
+  try {
+    return run(["kubectl", "--request-timeout=3s", "get", "--raw", "/readyz"], {
+      capture: true,
+      timeout: 20
+    }).status === 0;
+  } catch (e) {
+    if (e instanceof ProcError)
+      return false;
+    throw e;
+  }
+}
 function ensurePortForwardsHealthy() {
   const health = checkPortForwardHealth();
   if (health["k8s-forwards"] ?? false) {
@@ -29493,6 +29549,10 @@ function ensurePortForwardsHealthy() {
     error("Not restarting k8s-forwards without a kubeconfig file to mount");
     return "failed";
   }
+  if (!clusterReachable()) {
+    warn("No reachable k8s cluster \u2014 skipping port-forwards; services not run locally are unavailable");
+    return "failed";
+  }
   const { argv, env } = composeInvocation();
   try {
     const result = run([...argv, "up", "-d", "--force-recreate", "k8s-forwards"], {
@@ -30070,7 +30130,8 @@ async function up(feature2, workspace, { signal } = {}) {
     generateFeatureEnv(feature2, slot, localServices, config, workspace);
   } else if (isFeatureComposeStale(feature2, slot, localServices, config, workspace)) {
     staleCompose = true;
-    warn(`${COMPOSE_FILE} predates the current service registry \u2014 run 'sandbox init-workspace' in the workspace to regenerate it.`);
+    warn(`${COMPOSE_FILE} predates the current template or registry \u2014 regenerating...`);
+    generateFeatureCompose(feature2, slot, localServices, config, workspace, "sandbox up");
   }
   generateSupergraphConfig(feature2, slot, localServices, config, workspace);
   raw(`
@@ -30169,27 +30230,119 @@ function refuseInsideOwnContainer(feature2, verb) {
        Run it from the host: cd to the workspace and run 'sandbox ${verb}'.`, "INSIDE_OWN_CONTAINER");
   }
 }
-function otherLiveSessions(workspaceRoot, sessionId, sessionsDir = path30.join(os8.homedir(), ".claude", "sessions")) {
+function liveSessions(workspaceRoot, sessionsDir = path30.join(os8.homedir(), ".claude", "sessions")) {
   let names;
   try {
     names = fs31.readdirSync(sessionsDir).filter((n) => n.endsWith(".json"));
   } catch {
     return [];
   }
-  const pids = [];
+  const sessions = [];
   for (const name of names) {
     try {
       const s = JSON.parse(fs31.readFileSync(path30.join(sessionsDir, name), "utf8"));
       const cwd = String(s.cwd ?? "");
       const inWorkspace = cwd === workspaceRoot || cwd.startsWith(workspaceRoot + path30.sep);
-      if (!inWorkspace || s.sessionId === sessionId || !Number.isInteger(s.pid))
+      if (!inWorkspace || !Number.isInteger(s.pid))
         continue;
       process.kill(s.pid, 0);
-      pids.push(s.pid);
+      sessions.push({
+        pid: s.pid,
+        sessionId: typeof s.sessionId === "string" ? s.sessionId : null,
+        status: typeof s.status === "string" ? s.status : null,
+        statusUpdatedAt: Number.isFinite(s.statusUpdatedAt) ? s.statusUpdatedAt : null
+      });
     } catch {
     }
   }
-  return pids;
+  return sessions;
+}
+function otherLiveSessions(workspaceRoot, sessionId, sessionsDir) {
+  return liveSessions(workspaceRoot, sessionsDir).filter((s) => s.sessionId !== sessionId).map((s) => s.pid);
+}
+function busyReason(f, input2, cutoff) {
+  const active = input2.sessions(f.workspace).some((s) => s.status !== "idle" || (s.statusUpdatedAt ?? Infinity) > cutoff);
+  if (active)
+    return "session active";
+  if (f.startedAt.some((t) => t > cutoff))
+    return `started < ${input2.minutes} min ago`;
+  if ((input2.lastExec(f.workspace) ?? 0) > cutoff)
+    return `gate ran < ${input2.minutes} min ago`;
+  return null;
+}
+function idleStopMinutes() {
+  const v = load()["overrides"]?.["idle_stop_minutes"];
+  return Number.isInteger(v) && v >= 0 ? v : 30;
+}
+function lastExecMarker(workspaceRoot) {
+  return path30.join(dotDir(workspaceRoot), "last-exec");
+}
+function mtimeMs(p) {
+  try {
+    return fs31.statSync(p).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+function runningFeatures(runCmd) {
+  try {
+    const ids = runCmd(["docker", "ps", "-q", "--filter", `label=${LABEL_FEATURE2}`]);
+    if (ids.status !== 0)
+      return null;
+    const list2 = ids.stdout.split("\n").filter(Boolean);
+    if (!list2.length)
+      return [];
+    const fmt = `{{index .Config.Labels "${LABEL_FEATURE2}"}}	{{index .Config.Labels "${LABEL_WORKDIR}"}}	{{.State.StartedAt}}`;
+    const inspect = runCmd(["docker", "inspect", "--format", fmt, ...list2]);
+    if (inspect.status !== 0)
+      return null;
+    const byFeature = /* @__PURE__ */ new Map();
+    for (const line of inspect.stdout.split("\n").filter(Boolean)) {
+      const [feature2, workspace, started] = line.split("	");
+      if (!feature2 || !workspace)
+        continue;
+      const f = byFeature.get(feature2) ?? { feature: feature2, workspace, startedAt: [] };
+      f.startedAt.push(Date.parse(started));
+      byFeature.set(feature2, f);
+    }
+    return [...byFeature.values()];
+  } catch {
+    return null;
+  }
+}
+async function stopIdle(minutes, opts = {}) {
+  const runCmd = opts.run ?? ((cmd) => run(cmd, { capture: true, timeout: 20 }));
+  const found = runningFeatures(runCmd);
+  if (!found)
+    return { ok: true, lines: ["docker unavailable \u2014 nothing reaped"] };
+  const running = found.filter((f) => !opts.only || f.feature === opts.only);
+  if (!running.length)
+    return { ok: true, lines: ["no running feature containers"] };
+  const input2 = {
+    minutes,
+    now: opts.now ?? Date.now(),
+    running,
+    sessions: (ws) => liveSessions(ws, opts.sessionsDir),
+    lastExec: (ws) => mtimeMs(lastExecMarker(ws))
+  };
+  const cutoff = input2.now - minutes * 6e4;
+  const lines = [];
+  let ok = true;
+  for (const f of running) {
+    const why = f.feature === "infra" ? "shared infra" : insideOwnContainer(f.feature) ? "running inside its own container" : busyReason(f, input2, cutoff);
+    if (why) {
+      lines.push(`${f.feature}: kept (${why})`);
+      continue;
+    }
+    try {
+      await (opts.stop ?? stop)(f.feature);
+      lines.push(`${f.feature}: stopped (idle \u2265 ${minutes} min)`);
+    } catch (e) {
+      ok = false;
+      lines.push(`${f.feature}: stop failed \u2014 ${e.message}`);
+    }
+  }
+  return { ok, lines };
 }
 function idleStopFeature(input2) {
   const { feature: feature2, workspaceRoot, sessionId, reason: reason2, entrypoint, sessionsDir } = input2;
@@ -30514,7 +30667,7 @@ async function teardownNotes(feature2) {
     graduated
   };
 }
-var _CONTINUING_REASONS, REAL_PROXY_OPS;
+var _CONTINUING_REASONS, LABEL_FEATURE2, LABEL_WORKDIR, REAL_PROXY_OPS;
 var init_lifecycle = __esm({
   "../../packages/sandbox-core/dist/lifecycle.js"() {
     "use strict";
@@ -30525,17 +30678,22 @@ var init_lifecycle = __esm({
     init_compose_file();
     init_config();
     init_docker();
+    init_dot_dir();
     init_errors();
     init_feature_routing();
     init_generate();
+    init_global_config();
     init_graduate();
     init_k8s();
     init_notes();
+    init_proc();
     init_reporter();
     init_secrets();
     init_slots();
     init_strategies();
     _CONTINUING_REASONS = /* @__PURE__ */ new Set(["clear", "resume"]);
+    LABEL_FEATURE2 = "com.sandbox.local.feature";
+    LABEL_WORKDIR = "com.docker.compose.project.working_dir";
     REAL_PROXY_OPS = {
       generate: () => generateCaddyfile(),
       slots: () => getAllSlots(),
@@ -31434,6 +31592,7 @@ async function run3(args) {
   console.log(`
 ${Colors.BOLD}=== sandbox up: ${feature2} ===${Colors.RESET}
 `);
+  if (args.dev) process.env.SANDBOX_DEV = "1";
   printSummary(await up(feature2, workspace, { signal: interruptSignal() }));
 }
 var init_up = __esm({
@@ -31954,6 +32113,17 @@ async function run8(args) {
     stopIfIdle();
     return;
   }
+  if (args.idle != null) {
+    const minutes = Number(args.idle);
+    if (!Number.isInteger(minutes) || minutes < 1) {
+      error("--idle takes whole minutes \u2265 1");
+      process.exit(1);
+    }
+    const result = await stopIdle(minutes, { only: args.feature ?? void 0 });
+    console.log(result.lines.join("\n"));
+    if (!result.ok) process.exit(1);
+    return;
+  }
   const dotenv = loadDotenv(process.cwd());
   const feature2 = args.feature || dotenv["FEATURE"];
   if (!feature2) {
@@ -32565,16 +32735,19 @@ function discoverFragments(reposRoot) {
       continue;
     if (fs40.statSync(path39.join(reposRoot, repo, ".git"), { throwIfNoEntry: false })?.isFile())
       continue;
-    let doc;
-    try {
-      doc = (0, import_yaml2.parse)(fs40.readFileSync(file, "utf8"));
-    } catch (e) {
-      throw new RegistryError(`${file}: ${e instanceof Error ? e.message : String(e)}`);
-    }
-    out.push({ repo, path: file, doc: isDict7(doc) ? doc : {} });
+    out.push(readFragment(repo, file));
   }
   return out;
 }
+function readFragment(repo, file) {
+  let doc;
+  try {
+    doc = (0, import_yaml2.parse)(fs40.readFileSync(file, "utf8"));
+  } catch (e) {
+    throw new RegistryError(`${file}: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  return { repo, path: file, doc: isDict7(doc) ? doc : {} };
+}
 function expandPlaceholders(value, paths) {
   if (typeof value === "string") {
     return value.replace(PLACEHOLDER, (_m, key) => paths[key]);
@@ -32736,6 +32909,18 @@ function readLocalOverlay(localPath) {
     throw new RegistryError(`${localPath}: must be a map of registry keys`);
   return doc;
 }
+function branchRegistry(repo, worktree, reposRoot = getReposRoot()) {
+  const file = path39.join(worktree, FRAGMENT_REL);
+  if (!fs40.existsSync(file))
+    return null;
+  const fragments = discoverFragments(reposRoot).filter((f) => f.repo !== repo);
+  fragments.push(readFragment(repo, file));
+  return mergeRegistry(fragments, {
+    defaults: REGISTRY_DEFAULTS,
+    local: readLocalOverlay(servicesLocalYamlPath()),
+    paths: placeholderPaths()
+  });
+}
 function syncRegistry(opts = {}) {
   const label = "config services.yaml";
   const reposRoot = opts.reposRoot ?? getReposRoot();
@@ -37633,8 +37818,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path73) {
-      let input2 = path73;
+    function removeDotSegments(path74) {
+      let input2 = path74;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -38044,8 +38229,8 @@ var require_schemes = __commonJS({
       }
       if (wsComponent.resourceName) {
         const queryIndex = wsComponent.resourceName.indexOf("?");
-        const path73 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
-        wsComponent.path = path73 && path73 !== "/" ? path73 : void 0;
+        const path74 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
+        wsComponent.path = path74 && path74 !== "/" ? path74 : void 0;
         wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
@@ -49517,10 +49702,10 @@ var require_lib3 = __commonJS({
     exports.analyse = analyse;
     var detectFile = (filepath, opts = {}) => new Promise((resolve13, reject) => {
       let fd;
-      const fs65 = (0, node_1.default)();
+      const fs66 = (0, node_1.default)();
       const handler = (err, buffer) => {
         if (fd) {
-          fs65.closeSync(fd);
+          fs66.closeSync(fd);
         }
         if (err) {
           reject(err);
@@ -49532,9 +49717,9 @@ var require_lib3 = __commonJS({
       };
       const sampleSize = (opts === null || opts === void 0 ? void 0 : opts.sampleSize) || 0;
       if (sampleSize > 0) {
-        fd = fs65.openSync(filepath, "r");
+        fd = fs66.openSync(filepath, "r");
         let sample = Buffer.allocUnsafe(sampleSize);
-        fs65.read(fd, sample, 0, sampleSize, opts.offset, (err, bytesRead) => {
+        fs66.read(fd, sample, 0, sampleSize, opts.offset, (err, bytesRead) => {
           if (err) {
             handler(err, null);
           } else {
@@ -49546,22 +49731,22 @@ var require_lib3 = __commonJS({
         });
         return;
       }
-      fs65.readFile(filepath, handler);
+      fs66.readFile(filepath, handler);
     });
     exports.detectFile = detectFile;
     var detectFileSync = (filepath, opts = {}) => {
-      const fs65 = (0, node_1.default)();
+      const fs66 = (0, node_1.default)();
       if (opts && opts.sampleSize) {
-        const fd = fs65.openSync(filepath, "r");
+        const fd = fs66.openSync(filepath, "r");
         let sample = Buffer.allocUnsafe(opts.sampleSize);
-        const bytesRead = fs65.readSync(fd, sample, 0, opts.sampleSize, opts.offset);
+        const bytesRead = fs66.readSync(fd, sample, 0, opts.sampleSize, opts.offset);
         if (bytesRead < opts.sampleSize) {
           sample = sample.subarray(0, bytesRead);
         }
-        fs65.closeSync(fd);
+        fs66.closeSync(fd);
         return (0, exports.detect)(sample);
       }
-      return (0, exports.detect)(fs65.readFileSync(filepath));
+      return (0, exports.detect)(fs66.readFileSync(filepath));
     };
     exports.detectFileSync = detectFileSync;
     exports.default = {
@@ -54328,8 +54513,8 @@ function parseRect(size, position) {
   const [x, y] = (position ?? "60,60").split(",").map(Number);
   return { width, height: height2, x, y };
 }
-async function wdFetch(port, path73, method, body) {
-  const r = await fetch(`http://127.0.0.1:${port}${path73}`, {
+async function wdFetch(port, path74, method, body) {
+  const r = await fetch(`http://127.0.0.1:${port}${path74}`, {
     method,
     headers: body !== void 0 ? { "Content-Type": "application/json" } : void 0,
     body: body !== void 0 ? JSON.stringify(body) : void 0
@@ -54337,7 +54522,7 @@ async function wdFetch(port, path73, method, body) {
   const data = await r.json().catch(() => ({}));
   if (!r.ok || data?.value?.error) {
     const msg = data?.value?.message || data?.value?.error || `HTTP ${r.status}`;
-    throw new Error(`safaridriver ${method} ${path73} failed: ${msg}`);
+    throw new Error(`safaridriver ${method} ${path74} failed: ${msg}`);
   }
   return data.value;
 }
@@ -55175,11 +55360,131 @@ var init_issue_snapshot = __esm({
   }
 });
+// ../../packages/sandbox-core/dist/issue_status.js
+import * as fs49 from "node:fs";
+import * as path57 from "node:path";
+function resolveIssueStatuses(overrides, tracker) {
+  const map = overrides["issue_statuses"] ?? {};
+  const out = { ...DEFAULTS[tracker] };
+  for (const point of ISSUE_POINTS) {
+    const alias = ALIASES[point];
+    if (Object.hasOwn(map, point))
+      out[point] = blankToNull(map[point]);
+    else if (alias && overrides[alias] !== void 0)
+      out[point] = blankToNull(overrides[alias]);
+  }
+  return out;
+}
+function issuePosition(issue, statuses) {
+  const names = new Set([issue.status, ...issue.labels ?? []].flatMap((n) => n ? [n.trim().toLowerCase()] : []));
+  const is = (point) => {
+    const s = statuses[point];
+    return s !== null && names.has(s.toLowerCase());
+  };
+  if (issue.statusCategory === "done" || is("done"))
+    return 4;
+  if (is("merged"))
+    return 3;
+  if (is("in_review"))
+    return 2;
+  if (is("in_progress"))
+    return 1;
+  return issue.statusCategory === "indeterminate" ? 1 : 0;
+}
+async function moveIssue(tracker, ref, point, statuses, opts) {
+  const status2 = statuses[point];
+  try {
+    if (status2 === null) {
+      if (!opts.alwaysComment)
+        return "";
+      await tracker.updateIssue(ref, { comment: opts.comment });
+      return `${ref} commented (no ${point} status configured)`;
+    }
+    const issue = await tracker.fetchIssue(ref);
+    if (!issue)
+      return `${ref} not moved to "${status2}": could not read its current status`;
+    const pos = issuePosition(issue, statuses);
+    if (!(RANK[point] > pos || opts.back && pos >= 2 && pos < 4)) {
+      if (opts.alwaysComment)
+        await tracker.updateIssue(ref, { comment: opts.comment });
+      const label = issue.labels?.find((l) => ISSUE_POINTS.some((p) => statuses[p]?.toLowerCase() === l.toLowerCase()));
+      return `${ref} already ${issue.status ?? "past that"}${label ? ` (${label})` : ""}`;
+    }
+    await tracker.updateIssue(ref, { status: status2, comment: opts.comment });
+    return `${ref} \u2192 ${status2}`;
+  } catch (e) {
+    return `${ref} not moved to "${status2 ?? point}": ${e.message}`;
+  }
+}
+function currentStage(ws) {
+  let dirs;
+  try {
+    dirs = fs49.readdirSync(path57.join(ws, "stages")).filter((d) => /^\d+_/.test(d)).sort();
+  } catch {
+    return "research phase";
+  }
+  const empty = dirs.find((d) => {
+    try {
+      return !fs49.readdirSync(path57.join(ws, "stages", d, "output")).some((f) => !f.startsWith("."));
+    } catch {
+      return true;
+    }
+  });
+  return `stage ${empty ?? dirs[0] ?? "01"}`;
+}
+async function startIssue(ws, tracker = issueTracker(), statuses = resolveIssueStatuses(load()["overrides"] ?? {}, loadIssueTracker())) {
+  const ref = issueIdOf(loadConfigFile(ws, null));
+  if (!ref)
+    return "no issue";
+  return moveIssue(tracker, ref, "in_progress", statuses, {
+    comment: `Work started: ${currentStage(ws)} in workspace ${path57.basename(ws)}.`
+  });
+}
+var ISSUE_POINTS, DEFAULTS, ALIASES, RANK, blankToNull;
+var init_issue_status = __esm({
+  "../../packages/sandbox-core/dist/issue_status.js"() {
+    "use strict";
+    init_define_SANDBOX_BUILD();
+    init_global_config();
+    init_issue_tracker();
+    init_workspace_prompts();
+    ISSUE_POINTS = ["in_progress", "in_review", "merged", "done", "abandoned"];
+    DEFAULTS = {
+      jira: {
+        in_progress: "In Progress",
+        in_review: "In Review",
+        merged: null,
+        done: "Done",
+        abandoned: null
+      },
+      github: {
+        in_progress: "status: in progress",
+        in_review: "status: in review",
+        merged: null,
+        done: "closed",
+        abandoned: "not planned"
+      }
+    };
+    ALIASES = {
+      in_review: "issue_review_status",
+      done: "issue_done_status"
+    };
+    RANK = {
+      in_progress: 1,
+      in_review: 2,
+      merged: 3,
+      done: 4,
+      abandoned: 4
+    };
+    blankToNull = (v) => v === null || v === void 0 || String(v).trim() === "" ? null : String(v).trim();
+  }
+});
 // ../../packages/sandbox-core/dist/pr_lifecycle.js
 import { execFile } from "node:child_process";
-import * as fs49 from "node:fs";
+import * as fs50 from "node:fs";
 import * as os16 from "node:os";
-import * as path57 from "node:path";
+import * as path58 from "node:path";
 async function httpStatus(url) {
   try {
     return (await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(5e3) })).status;
@@ -55196,27 +55501,51 @@ function defaultDeps() {
     archetypes: loadArchetypes(),
     repos: loadReposConfig(),
     tracker: issueTracker(),
-    reviewStatus: String(overrides["issue_review_status"] ?? "In Review"),
-    doneStatus: String(overrides["issue_done_status"] ?? (loadIssueTracker() === "github" ? "closed" : "Done")),
+    statuses: resolveIssueStatuses(overrides, loadIssueTracker()),
     commitRecord: commitAndPush,
     remove: (name) => removeWorkspace(name, { closedOut: true }),
     terminals: (ws) => openTerminalSessions(ws),
     sourceOf: async (dir) => (await worktreeSources([dir]))[0] ?? null,
-    session: (ws) => callbackFields(ws, process.env)
+    session: (ws) => callbackFields(ws, process.env),
+    branchRegistry: (repo, worktree) => branchRegistry(repo, worktree),
+    stop: stopWorkspace,
+    reapIdle: async () => {
+      const minutes = idleStopMinutes();
+      return minutes ? stopIdle(minutes) : { lines: [] };
+    }
   };
 }
+async function stopWorkspace(ws) {
+  const feature2 = readEnv(ws, "FEATURE");
+  if (!feature2)
+    return "containers already stopped";
+  try {
+    await stop(feature2);
+    return "containers stopped (slot and volumes kept; `werkmeister up` resumes)";
+  } catch (e) {
+    if (e.code === "NOT_RUNNING")
+      return "containers already stopped";
+    return `could not stop containers \u2014 ${e.message}`;
+  }
+}
+function touchExecMarker(ws) {
+  try {
+    fs50.writeFileSync(lastExecMarker(ws), "");
+  } catch {
+  }
+}
 function prFileDir(ws) {
   let names;
   try {
-    names = fs49.readdirSync(path57.join(ws, "stages")).sort();
+    names = fs50.readdirSync(path58.join(ws, "stages")).sort();
   } catch {
-    return path57.join(dotDir(ws), "notes");
+    return path58.join(dotDir(ws), "notes");
   }
   const dir = names.find((n) => /^\d+_propose$/.test(n)) ?? names.find((n) => /^\d+_ship$/.test(n));
-  return dir ? path57.join(ws, "stages", dir, "output") : null;
+  return dir ? path58.join(ws, "stages", dir, "output") : null;
 }
 function parsePrFile(p) {
-  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(fs49.readFileSync(p, "utf8"));
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(fs50.readFileSync(p, "utf8"));
   let fm = null;
   let yamlError = "";
   try {
@@ -55230,7 +55559,7 @@ function parsePrFile(p) {
   const heading2 = /^#\s+(.+)$/m.exec(m[2]);
   return {
     path: p,
-    dir: path57.basename(p).replace(/^pr-/, "").replace(/\.md$/, ""),
+    dir: path58.basename(p).replace(/^pr-/, "").replace(/\.md$/, ""),
     fm,
     title: heading2 ? heading2[1].trim() : "",
     body: heading2 ? m[2].slice(heading2.index + heading2[0].length).replace(/^\s*\n/, "") : m[2]
@@ -55242,10 +55571,10 @@ function readPrFiles(ws) {
     return [];
   let names = [];
   try {
-    names = fs49.readdirSync(dir).filter((n) => /^pr-.+\.md$/.test(n)).sort();
+    names = fs50.readdirSync(dir).filter((n) => /^pr-.+\.md$/.test(n)).sort();
   } catch {
   }
-  return names.map((n) => parsePrFile(path57.join(dir, n)));
+  return names.map((n) => parsePrFile(path58.join(dir, n)));
 }
 function writePrFields(file, fields) {
   updateNoteStatus(file.path, fields);
@@ -55260,18 +55589,18 @@ function passTable(text) {
 }
 function stagesCheck(ws) {
   const prDir = prFileDir(ws);
-  if (!fs49.existsSync(path57.join(ws, "stages"))) {
-    const open = openDecisions(ws).map((n) => path57.basename(n.path));
+  if (!fs50.existsSync(path58.join(ws, "stages"))) {
+    const open = openDecisions(ws).map((n) => path58.basename(n.path));
     return {
       name: "stages",
       ok: open.length === 0,
       detail: open.length ? `open decision notes: ${open.join(", ")}` : "no open decisions"
     };
   }
-  const own = prDir ? path57.basename(path57.dirname(prDir)) : "";
-  const empty = fs49.readdirSync(path57.join(ws, "stages")).sort().filter((d) => d < own).filter((d) => {
+  const own = prDir ? path58.basename(path58.dirname(prDir)) : "";
+  const empty = fs50.readdirSync(path58.join(ws, "stages")).sort().filter((d) => d < own).filter((d) => {
     try {
-      return !fs49.readdirSync(path57.join(ws, "stages", d, "output")).some((f) => !f.startsWith("."));
+      return !fs50.readdirSync(path58.join(ws, "stages", d, "output")).some((f) => !f.startsWith("."));
     } catch {
       return true;
     }
@@ -55283,14 +55612,14 @@ function stagesCheck(ws) {
   };
 }
 function exerciseFile(ws) {
-  if (!fs49.existsSync(path57.join(ws, "stages"))) {
-    const p = path57.join(dotDir(ws), "notes", "exercise.md");
-    return fs49.existsSync(p) ? p : null;
+  if (!fs50.existsSync(path58.join(ws, "stages"))) {
+    const p = path58.join(dotDir(ws), "notes", "exercise.md");
+    return fs50.existsSync(p) ? p : null;
   }
   for (const name of ["exercise.md", "verify.md"]) {
-    for (const d of fs49.readdirSync(path57.join(ws, "stages")).sort()) {
-      const p = path57.join(ws, "stages", d, "output", name);
-      if (fs49.existsSync(p))
+    for (const d of fs50.readdirSync(path58.join(ws, "stages")).sort()) {
+      const p = path58.join(ws, "stages", d, "output", name);
+      if (fs50.existsSync(p))
         return p;
     }
   }
@@ -55318,7 +55647,7 @@ function mapTouched(files, repo) {
 }
 function readEnv(ws, key) {
   try {
-    for (const line of fs49.readFileSync(path57.join(ws, ".env"), "utf8").split(/\r?\n/)) {
+    for (const line of fs50.readFileSync(path58.join(ws, ".env"), "utf8").split(/\r?\n/)) {
       const eq = line.indexOf("=");
       if (eq > 0 && line.slice(0, eq).trim() === key)
         return line.slice(eq + 1).trim();
@@ -55332,14 +55661,24 @@ async function runGate(ws, file, deps = defaultDeps()) {
   const add = (name, ok, detail) => checks.push({ name, ok, detail });
   const table = passTable(file.body);
   add("acceptance", table === null, table ? `PR file ${table}` : "all PASS");
-  const dir = path57.join(ws, file.dir);
+  const dir = path58.join(ws, file.dir);
   const status2 = await deps.run("git", ["-C", dir, "status", "--porcelain"]);
   add("clean", status2.code === 0 && status2.stdout.trim() === "", status2.code ? status2.stderr.trim() : status2.stdout.trim() ? `uncommitted:
 ${status2.stdout.trimEnd()}` : "clean");
+  let services = deps.services;
+  let repo = deps.repos[file.dir] ?? {};
+  try {
+    const own = deps.branchRegistry(file.dir, dir);
+    if (own) {
+      services = own.services;
+      repo = own.repos[file.dir] ?? {};
+    }
+  } catch (e) {
+    add("registry", false, `branch fragment: ${e instanceof Error ? e.message : String(e)}`);
+  }
   const cfg = loadConfigFile(ws, null);
   const feature2 = String(cfg["feature"] ?? readEnv(ws, "FEATURE")).trim();
   const local = new Set(String(cfg["services"] ?? "").split(",").map((s) => s.trim()).filter(Boolean));
-  const repo = deps.repos[file.dir] ?? {};
   const ps = await deps.run("docker", ["ps", "--format", "{{.Names}}"]);
   const running = new Set(ps.stdout.split("\n").map((s) => s.trim()).filter(Boolean));
   const containerFor = (svc) => {
@@ -55357,7 +55696,7 @@ ${status2.stdout.trimEnd()}` : "clean");
   const touched = diff.code === 0 ? mapTouched(diff.stdout.split("\n").filter(Boolean), repo) : [];
   const skips = file.fm["skip_tests"] ?? {};
   for (const svc of touched) {
-    const cmd = serviceTestCommand(svc, deps.services[svc], deps.archetypes);
+    const cmd = serviceTestCommand(svc, services[svc], deps.archetypes);
     const why = reason(skips[svc]);
     if (!cmd) {
       add(`test ${svc}`, Boolean(why), why ? `skipped: ${why}` : "no test command registered \u2014 add `test:` to its registry entry, or `skip_tests: { " + svc + ": <reason> }`");
@@ -55368,16 +55707,17 @@ ${status2.stdout.trimEnd()}` : "clean");
       add(`test ${svc}`, Boolean(why), why ? `skipped: ${why}` : "no running container for this repo \u2014 run `sandbox up`");
       continue;
     }
+    touchExecMarker(ws);
     const res = await deps.run("docker", ["exec", container, "sh", "-c", cmd]);
     add(`test ${svc}`, res.code === 0, `${cmd} \u2192 exit ${res.code}${res.code ? `
 ${(res.stdout + res.stderr).trimEnd().split("\n").slice(-15).join("\n")}` : ""}`);
   }
   const evidence = exerciseFile(ws);
-  const evidenceProblem = evidence ? passTable(fs49.readFileSync(evidence, "utf8")) : "is missing";
-  add("exercise", evidenceProblem === null, evidence ? `${path57.relative(ws, evidence)} ${evidenceProblem ?? "all PASS"}` : "no exercise.md \u2014 record the exercise checks first");
+  const evidenceProblem = evidence ? passTable(fs50.readFileSync(evidence, "utf8")) : "is missing";
+  add("exercise", evidenceProblem === null, evidence ? `${path58.relative(ws, evidence)} ${evidenceProblem ?? "all PASS"}` : "no exercise.md \u2014 record the exercise checks first");
   const slot = Number(readEnv(ws, "SANDBOX_SLOT"));
   for (const svc of touched.filter((s) => local.has(s))) {
-    const def = deps.services[svc] ?? {};
+    const def = services[svc] ?? {};
     if (!running.has(`${feature2}-${svc}`)) {
       add(`baseline ${svc}`, false, "container not running \u2014 run `sandbox up`");
       continue;
@@ -55398,6 +55738,7 @@ ${(res.stdout + res.stderr).trimEnd().split("\n").slice(-15).join("\n")}` : ""}`
     else if (!container)
       add("release", false, "no running container for this repo \u2014 run `sandbox up`");
     else {
+      touchExecMarker(ws);
       const res = await deps.run("docker", ["exec", container, "sh", "-c", repo["release_check"]]);
       add("release", res.code === 0, `${repo["release_check"]} \u2192 exit ${res.code}${res.code ? `
 ${(res.stdout + res.stderr).trimEnd().split("\n").slice(-5).join("\n")}` : ""}`);
@@ -55444,7 +55785,7 @@ async function openPrs(ws, only, deps = defaultDeps()) {
       lines.push(...formatGate(f.dir, g));
       continue;
     }
-    const dir = path57.join(ws, f.dir);
+    const dir = path58.join(ws, f.dir);
     const branch = String(f.fm["branch"] ?? "");
     const push = await deps.run("git", ["-C", dir, "push", "-u", "origin", branch]);
     if (push.code !== 0) {
@@ -55468,8 +55809,8 @@ async function openPrs(ws, only, deps = defaultDeps()) {
     ], dir);
     let url = existing2.code === 0 ? existing2.stdout.trim() : "";
     if (!url) {
-      const bodyFile = path57.join(fs49.mkdtempSync(path57.join(os16.tmpdir(), "sandbox-pr-")), "body.md");
-      fs49.writeFileSync(bodyFile, f.body);
+      const bodyFile = path58.join(fs50.mkdtempSync(path58.join(os16.tmpdir(), "sandbox-pr-")), "body.md");
+      fs50.writeFileSync(bodyFile, f.body);
       const created = await deps.run("gh", [
         "pr",
         "create",
@@ -55484,7 +55825,7 @@ async function openPrs(ws, only, deps = defaultDeps()) {
         "--body-file",
         bodyFile
       ], dir);
-      fs49.rmSync(path57.dirname(bodyFile), { recursive: true, force: true });
+      fs50.rmSync(path58.dirname(bodyFile), { recursive: true, force: true });
       url = created.stdout.trim().split("\n").pop() ?? "";
       if (created.code !== 0 || !url.startsWith("http")) {
         ok = false;
@@ -55493,53 +55834,76 @@ async function openPrs(ws, only, deps = defaultDeps()) {
       }
     }
     writePrFields(f, { status: "open", url, ...await deps.session(ws) });
-    opened.push(path57.relative(ws, f.path));
+    opened.push(path58.relative(ws, f.path));
     lines.push(`${f.dir}: open ${url}`);
     const ref = issueIdOf(loadConfigFile(ws, null));
     if (ref) {
-      try {
-        await deps.tracker.updateIssue(ref, { status: deps.reviewStatus });
-      } catch (e) {
-        lines.push(`  (issue ${ref} not moved to ${deps.reviewStatus}: ${e.message})`);
-      }
+      const moved = await moveIssue(deps.tracker, ref, "in_review", deps.statuses, {
+        comment: `PR opened: ${url}`
+      });
+      if (moved)
+        lines.push(`  issue ${moved}`);
     }
   }
   if (opened.length)
     lines.push((await deps.commitRecord(ws, "chore: record opened PR(s)", opened)).message);
+  if (ok && opened.length)
+    lines.push(await deps.stop(ws));
   return { ok, lines };
 }
 async function refreshPrStatus(ws, deps = defaultDeps()) {
   const lines = [];
   const changed = [];
+  const seen = {
+    shipped: [],
+    merged: [],
+    closed: [],
+    changesRequested: [],
+    reReview: []
+  };
   for (const f of readPrFiles(ws)) {
     const before = statusOf(f);
+    const reviewBefore = f.fm["review"];
     if (before === "open" && f.fm["url"]) {
       const v = await deps.run("gh", [
         "pr",
         "view",
         String(f.fm["url"]),
         "--json",
-        "state,mergeCommit"
+        "state,mergeCommit,reviewDecision,latestReviews"
       ]);
       if (v.code !== 0) {
         lines.push(`${f.dir}: gh pr view failed \u2014 ${v.stderr.trim()}`);
         continue;
       }
       const view2 = JSON.parse(v.stdout);
-      if (view2.state === "MERGED")
+      const changesRequested = view2.reviewDecision === "CHANGES_REQUESTED" || (view2.latestReviews ?? []).some((r) => r.state === "CHANGES_REQUESTED");
+      const url = String(f.fm["url"]);
+      if (view2.state === "MERGED") {
         writePrFields(f, { status: "merged", merge_sha: view2.mergeCommit?.oid ?? "" });
-      else if (view2.state === "CLOSED")
+        seen.merged.push(url);
+      } else if (view2.state === "CLOSED") {
         writePrFields(f, {
           status: "closed",
           reason: reason(f.fm["reason"]) || "closed on GitHub"
         });
+        seen.closed.push(url);
+      } else if (changesRequested) {
+        if (reviewBefore !== "changes_requested") {
+          writePrFields(f, { review: "changes_requested" });
+          seen.changesRequested.push(url);
+        }
+      } else if (reviewBefore === "changes_requested") {
+        writePrFields(f, { review: void 0 });
+        seen.reReview.push(url);
+      }
     }
     if (statusOf(f) === "merged") {
       const repo = deps.repos[f.dir] ?? {};
       if (repo["ship"] !== "tag") {
         writePrFields(f, { status: "shipped" });
       } else {
-        const dir = path57.join(ws, f.dir);
+        const dir = path58.join(ws, f.dir);
         await deps.run("git", ["-C", dir, "fetch", "-q", "--tags", "origin"]);
         const tags = await deps.run("git", [
           "-C",
@@ -55557,16 +55921,43 @@ async function refreshPrStatus(ws, deps = defaultDeps()) {
       }
     }
     const after = statusOf(f);
-    if (after !== before)
-      changed.push(path57.relative(ws, f.path));
+    if (after === "shipped" && before !== "shipped")
+      seen.shipped.push(f);
+    if (after !== before || f.fm["review"] !== reviewBefore)
+      changed.push(path58.relative(ws, f.path));
     lines.push(`${f.dir}: ${after}${f.fm["release"] ? ` (${f.fm["release"]})` : ""}${f.fm["url"] ? ` ${f.fm["url"]}` : ""}`);
   }
+  const moved = await moveIssueForPrs(ws, seen, deps);
+  if (moved)
+    lines.push(`issue ${moved}`);
+  if (seen.merged.length || seen.shipped.length)
+    lines.push(await deps.stop(ws));
   if (changed.length)
     lines.push((await deps.commitRecord(ws, "chore: record PR status", changed)).message);
   return { lines, changed: changed.length > 0 };
 }
+async function moveIssueForPrs(ws, seen, deps) {
+  const anything = Object.values(seen).some((v) => v.length);
+  const ref = anything ? issueIdOf(loadConfigFile(ws, null)) : "";
+  if (!ref)
+    return "";
+  const files = readPrFiles(ws);
+  const state = lifecycleOf(ws).state;
+  const move = (point, comment, back = false) => moveIssue(deps.tracker, ref, point, deps.statuses, { comment, back });
+  if (seen.shipped.length && state === "shipped")
+    return move("done", shippedComment(files.filter((f) => statusOf(f) === "shipped")));
+  if (seen.merged.length && files.every((f) => PAST_MERGE.has(statusOf(f))))
+    return move("merged", `Merged: ${seen.merged.join(", ")}`);
+  if (seen.changesRequested.length)
+    return move("in_progress", `Changes requested: ${seen.changesRequested.join(", ")}`, true);
+  if (seen.closed.length && !files.some((f) => statusOf(f) === "open"))
+    return move("in_progress", `PR closed without merging: ${seen.closed.join(", ")}`, true);
+  if (seen.reReview.length)
+    return move("in_review", `Back in review: ${seen.reReview.join(", ")}`);
+  return "";
+}
 async function callbackFields(ws, env) {
-  const session = env["CLAUDE_CODE_SESSION_ID"] || (await resolveSessionSource(path57.basename(ws)).catch(() => null))?.sessionId;
+  const session = env["CLAUDE_CODE_SESSION_ID"] || (await resolveSessionSource(path58.basename(ws)).catch(() => null))?.sessionId;
   if (!session)
     return {};
   const host = env["CLAUDE_CODE_HOST_SESSION_ID"];
@@ -55584,23 +55975,23 @@ function callbackMessage(status2, url, release) {
 function takeLock(file) {
   for (let i = 0; i < 2; i++) {
     try {
-      fs49.closeSync(fs49.openSync(file, "wx"));
+      fs50.closeSync(fs50.openSync(file, "wx"));
       return true;
     } catch (e) {
       if (e.code !== "EEXIST")
         throw e;
       try {
-        if (Date.now() - fs49.statSync(file).mtimeMs < LOCK_STALE_MS)
+        if (Date.now() - fs50.statSync(file).mtimeMs < LOCK_STALE_MS)
           return false;
-        fs49.rmSync(file, { force: true });
+        fs50.rmSync(file, { force: true });
       } catch {
       }
     }
   }
   return false;
 }
-async function claimCallbacks(workspaces, opts, deps = defaultDeps(), lockFile = path57.join(sandboxHome(), "pr-callbacks.lock")) {
-  fs49.mkdirSync(path57.dirname(lockFile), { recursive: true });
+async function claimCallbacks(workspaces, opts, deps = defaultDeps(), lockFile = path58.join(sandboxHome(), "pr-callbacks.lock")) {
+  fs50.mkdirSync(path58.dirname(lockFile), { recursive: true });
   if (!takeLock(lockFile))
     return { claimed: [], lines: ["another PR watch pass is running"] };
   const claimed2 = [];
@@ -55619,7 +56010,7 @@ async function claimCallbacks(workspaces, opts, deps = defaultDeps(), lockFile =
         continue;
       if (before.some((f) => statusOf(f) === "open" || statusOf(f) === "merged"))
         for (const l of (await refreshPrStatus(ws, deps)).lines)
-          lines.push(`${path57.basename(ws)}/${l}`);
+          lines.push(`${path58.basename(ws)}/${l}`);
       const changed = [];
       for (const f of callbacks()) {
         const status2 = statusOf(f);
@@ -55637,23 +56028,23 @@ async function claimCallbacks(workspaces, opts, deps = defaultDeps(), lockFile =
             message
           });
         writePrFields(f, SETTLED.has(status2) ? { session: void 0, host_session: void 0, notified: void 0 } : { notified: status2 });
-        changed.push(path57.relative(ws, f.path));
+        changed.push(path58.relative(ws, f.path));
       }
       if (changed.length)
         lines.push((await deps.commitRecord(ws, "chore: record PR callback", changed)).message);
     }
   } finally {
-    fs49.rmSync(lockFile, { force: true });
+    fs50.rmSync(lockFile, { force: true });
   }
   return { claimed: claimed2, lines };
 }
 async function deliverHeadless(cb) {
-  const name = path57.basename(cb.ws);
+  const name = path58.basename(cb.ws);
   if ((await resolveSessionSource(name, cb.session)).sessionId !== cb.session)
     throw new WorkspaceError(`session ${cb.session} is gone`);
   await sendToClaudeSession(name, cb.message, cb.session);
 }
-async function watchPrs(opts, deps = defaultDeps(), send = deliverHeadless) {
+async function watchPrs(opts, deps = defaultDeps(), send = deliverHeadless, idleLock = path58.join(sandboxHome(), "idle-stop.lock")) {
   const { workspaces } = await listWorkspaces();
   const { claimed: claimed2, lines } = await claimCallbacks(workspaces.map((w) => w.path), opts, deps);
   const desktop = [];
@@ -55669,6 +56060,15 @@ async function watchPrs(opts, deps = defaultDeps(), send = deliverHeadless) {
       lines.push(`${cb.dir}: could not resume session ${cb.session}: ${e.message}`);
     }
   }
+  fs50.mkdirSync(path58.dirname(idleLock), { recursive: true });
+  if (takeLock(idleLock)) {
+    try {
+      lines.push(...(await deps.reapIdle()).lines);
+    } finally {
+      fs50.rmSync(idleLock, { force: true });
+    }
+  } else
+    lines.push("another idle-stop pass is running");
   return { ok: true, lines, desktop };
 }
 async function adoptPr(ws, opts, deps = defaultDeps()) {
@@ -55682,8 +56082,8 @@ async function adoptPr(ws, opts, deps = defaultDeps()) {
       throw new WorkspaceError(`Name the repo \u2014 this workspace has ${wts.map((w) => w.repo).join(", ") || "no code worktree"}.`);
     repo = wts[0].repo;
   }
-  const file = path57.join(dir, `pr-${repo}.md`);
-  if (fs49.existsSync(file))
+  const file = path58.join(dir, `pr-${repo}.md`);
+  if (fs50.existsSync(file))
     throw new WorkspaceError(`${file} already exists \u2014 remove it first to adopt.`);
   let fm;
   let title;
@@ -55695,7 +56095,7 @@ async function adoptPr(ws, opts, deps = defaultDeps()) {
   } else {
     if (!opts.pr)
       throw new WorkspaceError("Give a PR number or URL, or --no-pr <reason>.");
-    const v = await deps.run("gh", ["pr", "view", opts.pr, "--json", "url,headRefName,baseRefName,title,state,mergeCommit"], path57.join(ws, repo));
+    const v = await deps.run("gh", ["pr", "view", opts.pr, "--json", "url,headRefName,baseRefName,title,state,mergeCommit"], path58.join(ws, repo));
     if (v.code !== 0)
       throw new WorkspaceError(`gh pr view ${opts.pr} failed \u2014 ${v.stderr.trim()}`);
     const pr = JSON.parse(v.stdout);
@@ -55713,7 +56113,7 @@ async function adoptPr(ws, opts, deps = defaultDeps()) {
     };
     title = pr.title;
   }
-  fs49.writeFileSync(file, `---
+  fs50.writeFileSync(file, `---
 ${import_yaml14.default.stringify(fm)}---
 # ${title}
@@ -55722,7 +56122,7 @@ Adopted with \`sandbox pr adopt\`: the work landed outside this workspace.
   const lines = [`${repo}: adopted as ${fm["status"]}`];
   if (fm["status"] !== "closed")
     lines.push(...(await refreshPrStatus(ws, deps)).lines);
-  lines.push((await deps.commitRecord(ws, "chore: adopt PR", [path57.relative(ws, file)])).message);
+  lines.push((await deps.commitRecord(ws, "chore: adopt PR", [path58.relative(ws, file)])).message);
   return { ok: true, lines };
 }
 function lifecycleOf(ws) {
@@ -55738,7 +56138,7 @@ function lifecycleOf(ws) {
   }));
   const all = (set) => prs.every((p) => set.has(p.status));
   let state;
-  if (fs49.existsSync(path57.join(ws, "closeout.md")))
+  if (fs50.existsSync(path58.join(ws, "closeout.md")))
     state = "closed-out";
   else if (!prs.length)
     state = "working";
@@ -55757,7 +56157,7 @@ function lifecycleOf(ws) {
   return { state, prs };
 }
 async function removalBlockers(ws, worktrees, run34 = execRun) {
-  if (fs49.existsSync(path57.join(ws, "closeout.md")))
+  if (fs50.existsSync(path58.join(ws, "closeout.md")))
     return [];
   const files = readPrFiles(ws);
   const out = [];
@@ -55802,7 +56202,7 @@ function abandonWorkspace(ws, why) {
   for (const f of files)
     if (!SETTLED.has(statusOf(f)))
       writePrFields(f, { status: "abandoned", reason: why });
-  fs49.writeFileSync(path57.join(ws, "closeout.md"), renderCloseout(files, "not closed (abandoned)", `Abandoned: ${why}`));
+  fs50.writeFileSync(path58.join(ws, "closeout.md"), renderCloseout(files, "not closed (abandoned)", `Abandoned: ${why}`));
 }
 async function openTerminalSessions(ws, run34 = execRun) {
   const ps = await run34("ps", ["-axo", "pid=,tty=,comm="]);
@@ -55811,7 +56211,7 @@ async function openTerminalSessions(ws, run34 = execRun) {
   const ttys = /* @__PURE__ */ new Map();
   for (const line of ps.stdout.split("\n")) {
     const m = /^\s*(\d+)\s+(\S+)\s+(.+?)\s*$/.exec(line);
-    if (m && path57.basename(m[3]) === "claude" && m[2] !== "??" && m[2] !== "?")
+    if (m && path58.basename(m[3]) === "claude" && m[2] !== "??" && m[2] !== "?")
       ttys.set(m[1], m[2]);
   }
   if (!ttys.size)
@@ -55824,7 +56224,7 @@ async function openTerminalSessions(ws, run34 = execRun) {
       pid = line.slice(1);
     else if (line.startsWith("n") && ttys.has(pid)) {
       const cwd = line.slice(1);
-      if (cwd === ws || cwd.startsWith(ws + path57.sep))
+      if (cwd === ws || cwd.startsWith(ws + path58.sep))
         out.push(`terminal session: pid ${pid} on ${ttys.get(pid)} in ${cwd} \u2014 /exit it`);
     }
   }
@@ -55850,28 +56250,26 @@ async function closeOut(name, opts = {}, deps = defaultDeps()) {
   const ref = issueIdOf(cfg);
   let issueLine = "none";
   if (ref) {
-    const done = deps.doneStatus.toLowerCase();
-    const current = (await deps.tracker.fetchIssue(ref))?.status ?? "";
-    if (abandoned) {
+    if (why) {
+      issueLine = await moveIssue(deps.tracker, ref, "abandoned", deps.statuses, {
+        comment: `Abandoned: ${why}`,
+        alwaysComment: true
+      });
+    } else if (abandoned) {
+      const current = (await deps.tracker.fetchIssue(ref))?.status ?? "";
       issueLine = `${ref} left ${current || "as is"} (abandoned)`;
-    } else if ([done, "closed", "done"].includes(current.toLowerCase())) {
-      issueLine = `${ref} already ${current}`;
     } else {
-      const files2 = readPrFiles(ws);
-      const shipped = files2.filter((f) => statusOf(f) === "shipped").map((f) => `${f.fm["release"] ?? "merge"} \u2014 ${f.fm["url"]}`);
-      await deps.tracker.updateIssue(ref, {
-        status: deps.doneStatus,
-        comment: `Shipped: ${shipped.join("; ") || "no PRs"}`
-      });
-      issueLine = `${ref} \u2192 ${deps.doneStatus}`;
+      issueLine = await moveIssue(deps.tracker, ref, "done", deps.statuses, {
+        comment: shippedComment(readPrFiles(ws).filter((f) => statusOf(f) === "shipped"))
+      }) || `${ref} left as is (no done status configured)`;
     }
     lines.push(`Issue: ${issueLine}`);
   }
   const files = readPrFiles(ws);
-  fs49.writeFileSync(path57.join(ws, "closeout.md"), renderCloseout(files, issueLine, why ? `Abandoned: ${why}` : void 0));
+  fs50.writeFileSync(path58.join(ws, "closeout.md"), renderCloseout(files, issueLine, why ? `Abandoned: ${why}` : void 0));
   const branches = [];
   for (const f of abandoned ? [] : files.filter((x) => (statusOf(x) === "merged" || statusOf(x) === "shipped") && !x.fm["adopted"])) {
-    const src = await deps.sourceOf(path57.join(ws, f.dir));
+    const src = await deps.sourceOf(path58.join(ws, f.dir));
     if (src && f.fm["branch"])
       branches.push({ src, branch: String(f.fm["branch"]) });
   }
@@ -55900,7 +56298,7 @@ async function closeOut(name, opts = {}, deps = defaultDeps()) {
   const command = `sandbox close-out ${name}${why ? " --abandon" : ""}`;
   return { command, output: lines.filter(Boolean).join("\n"), path: ws, terminals };
 }
-var import_yaml14, SETTLED, PAST_MERGE, execRun, statusOf, reason, PASS_CELL, FAIL_CELL, LOCK_STALE_MS;
+var import_yaml14, SETTLED, PAST_MERGE, execRun, statusOf, reason, PASS_CELL, FAIL_CELL, shippedComment, LOCK_STALE_MS;
 var init_pr_lifecycle = __esm({
   "../../packages/sandbox-core/dist/pr_lifecycle.js"() {
     "use strict";
@@ -55911,8 +56309,11 @@ var init_pr_lifecycle = __esm({
     init_config();
     init_global_config();
     init_graduate();
+    init_issue_status();
     init_issue_tracker();
+    init_lifecycle();
     init_notes();
+    init_registry_sync();
     init_sandbox();
     init_slots();
     init_workspace_prompts();
@@ -55932,6 +56333,7 @@ var init_pr_lifecycle = __esm({
     reason = (v) => typeof v === "string" ? v.trim() : "";
     PASS_CELL = /\|\s*PASS\s*\|/;
     FAIL_CELL = /\|\s*FAIL\s*\|/;
+    shippedComment = (files) => `Shipped: ${files.map((f) => `${f.fm["release"] ?? "merge"} \u2014 ${f.fm["url"]}`).join("; ") || "no PRs"}`;
     LOCK_STALE_MS = 15 * 6e4;
   }
 });
@@ -56746,12 +57148,12 @@ function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
   }
   return result;
 }
-function findNodeAtLocation(root, path73) {
+function findNodeAtLocation(root, path74) {
   if (!root) {
     return void 0;
   }
   let node = root;
-  for (let segment of path73) {
+  for (let segment of path74) {
     if (typeof segment === "string") {
       if (node.type !== "object" || !Array.isArray(node.children)) {
         return void 0;
@@ -57118,14 +57520,14 @@ var init_parser = __esm({
 // ../../node_modules/jsonc-parser/lib/esm/impl/edit.js
 function setProperty(text, originalPath, value, options) {
-  const path73 = originalPath.slice();
+  const path74 = originalPath.slice();
   const errors = [];
   const root = parseTree(text, errors);
   let parent = void 0;
   let lastSegment = void 0;
-  while (path73.length > 0) {
-    lastSegment = path73.pop();
-    parent = findNodeAtLocation(root, path73);
+  while (path74.length > 0) {
+    lastSegment = path74.pop();
+    parent = findNodeAtLocation(root, path74);
     if (parent === void 0 && value !== void 0) {
       if (typeof lastSegment === "string") {
         value = { [lastSegment]: value };
@@ -57269,8 +57671,8 @@ var init_edit = __esm({
 });
 // ../../node_modules/jsonc-parser/lib/esm/main.js
-function modify(text, path73, value, options) {
-  return setProperty(text, path73, value, options);
+function modify(text, path74, value, options) {
+  return setProperty(text, path74, value, options);
 }
 function applyEdits(text, edits) {
   let sortedEdits = edits.slice(0).sort((a, b) => {
@@ -57352,20 +57754,20 @@ var init_main2 = __esm({
 });
 // ../../packages/sandbox-core/dist/plugin_check.js
-import * as fs50 from "node:fs";
+import * as fs51 from "node:fs";
 import * as os17 from "node:os";
-import * as path58 from "node:path";
+import * as path59 from "node:path";
 function defaultRepoPluginDir() {
-  return path58.join(sandboxRoot(), "plugins", PLUGIN_NAME);
+  return path59.join(sandboxRoot(), "plugins", PLUGIN_NAME);
 }
 function defaultClaudePluginsDir() {
-  return path58.join(os17.homedir(), ".claude", "plugins");
+  return path59.join(os17.homedir(), ".claude", "plugins");
 }
 function repoPluginVersion(repoPluginDir) {
-  const manifest = path58.join(repoPluginDir, ".claude-plugin", "plugin.json");
+  const manifest = path59.join(repoPluginDir, ".claude-plugin", "plugin.json");
   let data;
   try {
-    data = JSON.parse(fs50.readFileSync(manifest, "utf8"));
+    data = JSON.parse(fs51.readFileSync(manifest, "utf8"));
   } catch {
     return null;
   }
@@ -57373,10 +57775,10 @@ function repoPluginVersion(repoPluginDir) {
   return version ? String(version) : null;
 }
 function loadRegistry(claudePluginsDir) {
-  const registry = path58.join(claudePluginsDir, "installed_plugins.json");
+  const registry = path59.join(claudePluginsDir, "installed_plugins.json");
   let data;
   try {
-    data = JSON.parse(fs50.readFileSync(registry, "utf8"));
+    data = JSON.parse(fs51.readFileSync(registry, "utf8"));
   } catch {
     return null;
   }
@@ -57409,7 +57811,7 @@ function skillBodies(skillsDir) {
   const bodies = /* @__PURE__ */ new Map();
   let isDir6 = false;
   try {
-    isDir6 = fs50.statSync(skillsDir).isDirectory();
+    isDir6 = fs51.statSync(skillsDir).isDirectory();
   } catch {
     isDir6 = false;
   }
@@ -57418,14 +57820,14 @@ function skillBodies(skillsDir) {
   }
   let entries;
   try {
-    entries = fs50.readdirSync(skillsDir, { withFileTypes: true });
+    entries = fs51.readdirSync(skillsDir, { withFileTypes: true });
   } catch {
     return bodies;
   }
   const names = entries.filter((e) => e.isDirectory()).map((e) => e.name).sort();
   for (const name of names) {
     try {
-      bodies.set(name, fs50.readFileSync(path58.join(skillsDir, name, "SKILL.md"), "utf8"));
+      bodies.set(name, fs51.readFileSync(path59.join(skillsDir, name, "SKILL.md"), "utf8"));
     } catch {
       continue;
     }
@@ -57459,7 +57861,7 @@ function pluginDriftWarnings(repoPluginDir, claudePluginsDir) {
   }
   let repoSkillsIsDir = false;
   try {
-    repoSkillsIsDir = fs50.statSync(path58.join(repoPluginDir, "skills")).isDirectory();
+    repoSkillsIsDir = fs51.statSync(path59.join(repoPluginDir, "skills")).isDirectory();
   } catch {
     repoSkillsIsDir = false;
   }
@@ -57480,7 +57882,7 @@ function pluginDriftWarnings(repoPluginDir, claudePluginsDir) {
       `${PLUGIN_NAME} plugin is not installed \u2014 the ops skills (${PLUGIN_NAME}:diagnose, ${PLUGIN_NAME}:status, ${PLUGIN_NAME}:workspace, \u2026) will not surface in Claude Code sessions. Run \`w9r setup\` to install it (or use /plugin in Claude Code). The sb-* skills are unaffected \u2014 they are projected into each workspace by init-workspace.`
     ];
   }
-  const drift = skillDrift(path58.join(repoPluginDir, "skills"), path58.join(installPath, "skills"));
+  const drift = skillDrift(path59.join(repoPluginDir, "skills"), path59.join(installPath, "skills"));
   if (!drift.length) {
     return [];
   }
@@ -57506,15 +57908,15 @@ var init_plugin_check = __esm({
 });
 // ../../packages/sandbox-core/dist/test_run.js
-import * as fs51 from "node:fs";
+import * as fs52 from "node:fs";
 import { createRequire } from "node:module";
-import * as path59 from "node:path";
+import * as path60 from "node:path";
 function playwrightSearchDirs(workspace) {
   const dirs = [workspace];
   try {
-    for (const entry of fs51.readdirSync(workspace, { withFileTypes: true })) {
-      if (entry.isDirectory() && fs51.existsSync(path59.join(workspace, entry.name, ".git"))) {
-        dirs.push(path59.join(workspace, entry.name));
+    for (const entry of fs52.readdirSync(workspace, { withFileTypes: true })) {
+      if (entry.isDirectory() && fs52.existsSync(path60.join(workspace, entry.name, ".git"))) {
+        dirs.push(path60.join(workspace, entry.name));
       }
     }
   } catch {
@@ -57523,20 +57925,20 @@ function playwrightSearchDirs(workspace) {
 }
 function playwrightCwd(dirs) {
   for (const dir of dirs) {
-    if (!(fs51.existsSync(dir) && fs51.statSync(dir).isDirectory())) {
+    if (!(fs52.existsSync(dir) && fs52.statSync(dir).isDirectory())) {
       continue;
     }
-    if (CONFIG_NAMES.some((name) => fs51.existsSync(path59.join(dir, name)))) {
+    if (CONFIG_NAMES.some((name) => fs52.existsSync(path60.join(dir, name)))) {
       return dir;
     }
   }
   return null;
 }
 function noSuiteMessage(workspace) {
-  const repoNames = playwrightSearchDirs(workspace).slice(1).map((d) => path59.basename(d));
+  const repoNames = playwrightSearchDirs(workspace).slice(1).map((d) => path60.basename(d));
   let services = "";
   try {
-    services = /^SERVICES=(.*)$/m.exec(fs51.readFileSync(path59.join(workspace, ".env"), "utf8"))?.[1] ?? "";
+    services = /^SERVICES=(.*)$/m.exec(fs52.readFileSync(path60.join(workspace, ".env"), "utf8"))?.[1] ?? "";
   } catch {
   }
   const selected = services.split(",").map((s) => s.trim()).filter(Boolean);
@@ -57550,8 +57952,8 @@ ${lines.join("\n")}` : "");
 }
 function installedPlaywrightVersion(cwd) {
   try {
-    const pkg = createRequire(path59.join(cwd, "package.json")).resolve("@playwright/test/package.json");
-    return JSON.parse(fs51.readFileSync(pkg, "utf8")).version ?? null;
+    const pkg = createRequire(path60.join(cwd, "package.json")).resolve("@playwright/test/package.json");
+    return JSON.parse(fs52.readFileSync(pkg, "utf8")).version ?? null;
   } catch {
     return null;
   }
@@ -57631,9 +58033,9 @@ var init_test_run = __esm({
 });
 // ../../packages/sandbox-core/dist/machine_setup.js
-import * as fs52 from "node:fs";
+import * as fs53 from "node:fs";
 import * as os18 from "node:os";
-import * as path60 from "node:path";
+import * as path61 from "node:path";
 function briefOutput(out, maxLines = 4) {
   const lines = out.split("\n").map((l) => l.trimEnd()).filter((l) => l.trim() && !/^\s*[✔✓⣾⣽⣻⢿⡿⣟⣯⣷]/.test(l));
   if (!lines.length)
@@ -57737,17 +58139,17 @@ function defaultInteractiveRunner(cmd) {
 function readJson2(p) {
   let data;
   try {
-    data = JSON.parse(fs52.readFileSync(p, "utf8"));
+    data = JSON.parse(fs53.readFileSync(p, "utf8"));
   } catch {
     return null;
   }
   return typeof data === "object" && data !== null && !Array.isArray(data) ? data : null;
 }
 function knownMarketplaces(claudePluginsDir) {
-  return readJson2(path60.join(claudePluginsDir, "known_marketplaces.json")) || {};
+  return readJson2(path61.join(claudePluginsDir, "known_marketplaces.json")) || {};
 }
 function installedVersion(claudePluginsDir, spec) {
-  const registry = readJson2(path60.join(claudePluginsDir, "installed_plugins.json")) || {};
+  const registry = readJson2(path61.join(claudePluginsDir, "installed_plugins.json")) || {};
   const plugins = registry["plugins"];
   if (typeof plugins !== "object" || plugins === null || Array.isArray(plugins)) {
     return null;
@@ -57840,9 +58242,9 @@ function syncOptionalPlugin(spec, claudePluginsDir, runner, checkOnly, install)
   }));
 }
 function syncRepo(reposRoot, spec, runner, checkOnly) {
-  const dest = path60.join(reposRoot, spec.name);
+  const dest = path61.join(reposRoot, spec.name);
   const label = `repo ${spec.name}`;
-  if (!fs52.existsSync(dest)) {
+  if (!fs53.existsSync(dest)) {
     if (checkOnly) {
       return [
         {
@@ -57861,7 +58263,7 @@ function syncRepo(reposRoot, spec, runner, checkOnly) {
     const detail2 = notFound ? `${spec.url} is not reachable \u2014 it may not exist yet, or you may not be authenticated to GitHub (\`gh auth login\`, or check your git credential helper). ${spec.missingConsequence}` : `clone failed: ${briefOutput(out3)}`;
     return [{ label, ok: false, optional: true, detail: detail2 }];
   }
-  if (!fs52.existsSync(path60.join(dest, ".git"))) {
+  if (!fs53.existsSync(path61.join(dest, ".git"))) {
     return [
       {
         label,
@@ -57894,8 +58296,8 @@ function syncPathDirs(checkOnly, dirs) {
       continue;
     const target = expandUser(value);
     const label = `paths.${key}`;
-    if (fs52.existsSync(target)) {
-      if (!fs52.statSync(target).isDirectory()) {
+    if (fs53.existsSync(target)) {
+      if (!fs53.statSync(target).isDirectory()) {
         steps.push({ label, ok: false, detail: `${target} exists but is not a directory` });
       } else {
         steps.push({ label, ok: true, detail: target });
@@ -57907,7 +58309,7 @@ function syncPathDirs(checkOnly, dirs) {
       continue;
     }
     try {
-      fs52.mkdirSync(target, { recursive: true });
+      fs53.mkdirSync(target, { recursive: true });
       steps.push({ label, ok: true, detail: `created ${target}` });
     } catch (e) {
       steps.push({ label, ok: false, detail: `could not create ${target}: ${e}` });
@@ -57916,7 +58318,7 @@ function syncPathDirs(checkOnly, dirs) {
   return steps;
 }
 function syncRegistryConfigs(checkOnly, options = {}) {
-  const legacyDir = options.legacyDir === void 0 ? path60.join(sandboxRoot(), LEGACY_CONFIG_DIR) : options.legacyDir;
+  const legacyDir = options.legacyDir === void 0 ? path61.join(sandboxRoot(), LEGACY_CONFIG_DIR) : options.legacyDir;
   const files = [
     [
       "services.local.yaml",
@@ -57935,12 +58337,12 @@ function syncRegistryConfigs(checkOnly, options = {}) {
   const steps = [];
   for (const [name, dest, legacyName, content] of files) {
     const label2 = `config ${name}`;
-    if (fs52.existsSync(dest)) {
+    if (fs53.existsSync(dest)) {
       steps.push({ label: label2, ok: true, detail: `present at ${dest}` });
       continue;
     }
-    const legacy = legacyDir && legacyName ? path60.join(legacyDir, legacyName) : null;
-    const migratable = legacy !== null && fs52.existsSync(legacy);
+    const legacy = legacyDir && legacyName ? path61.join(legacyDir, legacyName) : null;
+    const migratable = legacy !== null && fs53.existsSync(legacy);
     if (checkOnly) {
       steps.push({
         label: label2,
@@ -57951,8 +58353,8 @@ function syncRegistryConfigs(checkOnly, options = {}) {
     }
     try {
       if (migratable) {
-        fs52.mkdirSync(path60.dirname(dest), { recursive: true });
-        fs52.copyFileSync(legacy, dest);
+        fs53.mkdirSync(path61.dirname(dest), { recursive: true });
+        fs53.copyFileSync(legacy, dest);
         steps.push({ label: label2, ok: true, detail: `migrated from ${legacy}` });
       } else {
         const result = seedFile(dest, content());
@@ -57964,7 +58366,7 @@ function syncRegistryConfigs(checkOnly, options = {}) {
   }
   const label = "config secrets.env";
   const secrets = secretsPath();
-  if (fs52.existsSync(secrets)) {
+  if (fs53.existsSync(secrets)) {
     steps.push({ label, ok: true, detail: `present at ${secrets}` });
   } else if (checkOnly) {
     steps.push({ label, ok: true, detail: `absent \u2014 would write a template to ${secrets}` });
@@ -57985,11 +58387,11 @@ function syncRegistryConfigs(checkOnly, options = {}) {
 function resolveCertScript(startDir) {
   let dir = startDir ?? sandboxRoot();
   for (let i = 0; i < 5; i++) {
-    const candidate = path60.join(dir, "bin", "generate-certs.sh");
-    if (fs52.existsSync(candidate)) {
+    const candidate = path61.join(dir, "bin", "generate-certs.sh");
+    if (fs53.existsSync(candidate)) {
       return candidate;
     }
-    const parent = path60.dirname(dir);
+    const parent = path61.dirname(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -58102,15 +58504,15 @@ ${JIRA_CONFIG_SNIPPET}`
   ];
 }
 function vscodeSettingsPath() {
-  return process.platform === "darwin" ? path60.join(os18.homedir(), "Library", "Application Support", "Code", "User", "settings.json") : path60.join(os18.homedir(), ".config", "Code", "User", "settings.json");
+  return process.platform === "darwin" ? path61.join(os18.homedir(), "Library", "Application Support", "Code", "User", "settings.json") : path61.join(os18.homedir(), ".config", "Code", "User", "settings.json");
 }
-function editorSchemaState(settingsPath = vscodeSettingsPath(), schemasDir = path60.join(sandboxRoot(), "infra", "schemas")) {
+function editorSchemaState(settingsPath = vscodeSettingsPath(), schemasDir = path61.join(sandboxRoot(), "infra", "schemas")) {
   const state = { present: false, set: {}, drop: [], text: "{}" };
-  if (!fs52.existsSync(path60.dirname(settingsPath)))
+  if (!fs53.existsSync(path61.dirname(settingsPath)))
     return state;
   state.present = true;
-  if (fs52.existsSync(settingsPath))
-    state.text = fs52.readFileSync(settingsPath, "utf8");
+  if (fs53.existsSync(settingsPath))
+    state.text = fs53.readFileSync(settingsPath, "utf8");
   const errors = [];
   const data = parse7(state.text, errors, { allowTrailingComma: true });
   if (errors.length) {
@@ -58120,7 +58522,7 @@ function editorSchemaState(settingsPath = vscodeSettingsPath(), schemasDir = pat
   const mapped = data?.["yaml.schemas"] ?? {};
   const covers = (v, glob) => v === glob || Array.isArray(v) && v.includes(glob);
   for (const [file, glob] of Object.entries(EDITOR_SCHEMAS)) {
-    const want = path60.join(schemasDir, file);
+    const want = path61.join(schemasDir, file);
     if (!covers(mapped[want], glob))
       state.set[want] = glob;
     for (const [key, v] of Object.entries(mapped)) {
@@ -58165,11 +58567,11 @@ function syncEditorSchemas(checkOnly, install, settingsPath = vscodeSettingsPath
   for (const [key, glob] of Object.entries(state.set)) {
     text = applyEdits(text, modify(text, ["yaml.schemas", key], glob, fmt));
   }
-  fs52.writeFileSync(settingsPath, text);
+  fs53.writeFileSync(settingsPath, text);
   return [{ label, ok: true, optional: true, detail: `mapped in ${settingsPath}` }];
 }
 function claudeUserSettingsPath() {
-  return path60.join(os18.homedir(), ".claude", "settings.json");
+  return path61.join(os18.homedir(), ".claude", "settings.json");
 }
 function claudeStandardsDirState(settingsPath = claudeUserSettingsPath(), dir = standardsDirPath()) {
   const state = {
@@ -58178,12 +58580,12 @@ function claudeStandardsDirState(settingsPath = claudeUserSettingsPath(), dir =
     granted: false,
     text: "{}"
   };
-  state.present = fs52.existsSync(path60.dirname(settingsPath));
-  state.dirMissing = !(fs52.existsSync(dir) && fs52.statSync(dir).isDirectory());
+  state.present = fs53.existsSync(path61.dirname(settingsPath));
+  state.dirMissing = !(fs53.existsSync(dir) && fs53.statSync(dir).isDirectory());
   if (!state.present || state.dirMissing)
     return state;
-  if (fs52.existsSync(settingsPath))
-    state.text = fs52.readFileSync(settingsPath, "utf8");
+  if (fs53.existsSync(settingsPath))
+    state.text = fs53.readFileSync(settingsPath, "utf8");
   const errors = [];
   const data = parse7(state.text, errors, { allowTrailingComma: true });
   if (errors.length) {
@@ -58195,8 +58597,8 @@ function claudeStandardsDirState(settingsPath = claudeUserSettingsPath(), dir =
     state.error = "permissions.additionalDirectories is not an array";
     return state;
   }
-  const want = path60.resolve(dir);
-  state.granted = (dirs ?? []).some((d) => path60.resolve(expandUser(String(d))) === want);
+  const want = path61.resolve(dir);
+  state.granted = (dirs ?? []).some((d) => path61.resolve(expandUser(String(d))) === want);
   return state;
 }
 function syncClaudeStandardsDir(checkOnly, install, settingsPath = claudeUserSettingsPath(), dir = standardsDirPath()) {
@@ -58226,18 +58628,18 @@ function syncClaudeStandardsDir(checkOnly, install, settingsPath = claudeUserSet
     ...fmt,
     isArrayInsertion: true
   }) : modify(state.text, ["permissions", "additionalDirectories"], [dir], fmt);
-  fs52.writeFileSync(settingsPath, applyEdits(state.text, edits));
+  fs53.writeFileSync(settingsPath, applyEdits(state.text, edits));
   return [{ label, ok: true, optional: true, detail: `granted in ${settingsPath}` }];
 }
 function vscodeExtensionState(runner = defaultRunner, root = sandboxRoot()) {
   const [rc, out] = runner(["code", "--list-extensions", "--show-versions"]);
   const prefix = `${VSCODE_EXTENSION_ID}@`;
   const line = rc === 0 ? out.split("\n").find((l) => l.trim().toLowerCase().startsWith(prefix)) : void 0;
-  const vsix = path60.join(root, BUNDLED_VSIX_REL);
+  const vsix = path61.join(root, BUNDLED_VSIX_REL);
   return {
     cli: rc === 0,
     installed: line ? line.trim().slice(prefix.length) : null,
-    bundled: fs52.existsSync(vsix) ? { path: vsix, version: readJson2(path60.join(root, "package.json"))?.version } : null
+    bundled: fs53.existsSync(vsix) ? { path: vsix, version: readJson2(path61.join(root, "package.json"))?.version } : null
   };
 }
 function syncVscodeExtension(checkOnly, install, state = vscodeExtensionState(), runner = defaultRunner) {
@@ -58391,7 +58793,7 @@ function syncPlaywright(runner, checkOnly, interactive) {
     const dirs = [...out.matchAll(/Install location:\s*(\S.*)$/gm)].map((m) => m[1].trim());
     if (rc2 !== 0 || dirs.length === 0)
       return null;
-    return dirs.filter((d) => !fs52.existsSync(path60.join(d, "INSTALLATION_COMPLETE")));
+    return dirs.filter((d) => !fs53.existsSync(path61.join(d, "INSTALLATION_COMPLETE")));
   };
   const before = missingDirs();
   if (before === null) {
@@ -58435,8 +58837,8 @@ function syncPlaywright(runner, checkOnly, interactive) {
 async function runSetup(options = {}) {
   const checkOnly = options.checkOnly ?? false;
   const reposRoot = options.reposRoot ?? getReposRoot();
-  const claudePluginsDir = options.claudePluginsDir ?? path60.join(os18.homedir(), ".claude", "plugins");
-  const repoPluginDir = options.repoPluginDir ?? path60.join(sandboxRoot(), "plugins", PLUGIN_NAME);
+  const claudePluginsDir = options.claudePluginsDir ?? path61.join(os18.homedir(), ".claude", "plugins");
+  const repoPluginDir = options.repoPluginDir ?? path61.join(sandboxRoot(), "plugins", PLUGIN_NAME);
   const runner = options.runner ?? defaultRunner;
   const jira2 = options.jira ?? loadJira();
   const steps = [];
@@ -58480,7 +58882,7 @@ async function runSetup(options = {}) {
       detail: "no workspace repo configured and `gh` could not name one \u2014 set overrides.workspace_repo (or run `gh auth login`, then `sandbox setup`). Workspaces will fall back to plain directories."
     });
   }
-  if (options.demo || fs52.existsSync(path60.join(reposRoot, DEMO_SERVICES_REPO))) {
+  if (options.demo || fs53.existsSync(path61.join(reposRoot, DEMO_SERVICES_REPO))) {
     steps.push(...syncRepo(reposRoot, DEMO_SERVICES_SPEC, runner, checkOnly));
   }
   steps.push(...syncRegistry({ reposRoot, checkOnly }));
@@ -58554,7 +58956,7 @@ var init_machine_setup = __esm({
       url: DEMO_SERVICES_REPO_URL,
       missingConsequence: "The demo backend/frontend services will not start until it is cloned there."
     };
-    LEGACY_CONFIG_DIR = path60.join("infra", "config");
+    LEGACY_CONFIG_DIR = path61.join("infra", "config");
     JIRA_TOKEN_URL = "https://id.atlassian.com/manage-profile/security/api-tokens";
     JIRA_REQUIRED_KEYS = ["base_url", "email", "api_token"];
     JIRA_CONFIG_SNIPPET = "jira:\n  base_url: https://your-org.atlassian.net\n  email: <your-atlassian-login-email>\n  api_token: PASTE_TOKEN_HERE";
@@ -58563,13 +58965,13 @@ var init_machine_setup = __esm({
       "workspace.schema.json": "**/.sandbox/workspace.yml"
     };
     VSCODE_EXTENSION_ID = "jbbz.werkmeister-vscode";
-    BUNDLED_VSIX_REL = path60.join("dist", "sandbox-workspaces.vsix");
+    BUNDLED_VSIX_REL = path61.join("dist", "sandbox-workspaces.vsix");
   }
 });
 // ../../packages/sandbox-core/dist/mcp_gen.js
-import * as fs53 from "node:fs";
-import * as path61 from "node:path";
+import * as fs54 from "node:fs";
+import * as path62 from "node:path";
 function resolveWorkspaceMcpServers(presentArchetypes2, archetypes) {
   const names = /* @__PURE__ */ new Set();
   for (const archName of Object.keys(presentArchetypes2)) {
@@ -58610,12 +59012,12 @@ function substituteVars(value, vars2) {
   return value;
 }
 function writeWorkspaceMcp(workspaceRoot, serverNames, definitions, vars2 = {}) {
-  const mcpPath = path61.join(workspaceRoot, ".mcp.json");
-  const isFile4 = fs53.existsSync(mcpPath) && fs53.statSync(mcpPath).isFile();
+  const mcpPath = path62.join(workspaceRoot, ".mcp.json");
+  const isFile4 = fs54.existsSync(mcpPath) && fs54.statSync(mcpPath).isFile();
   let config = {};
   if (isFile4) {
     try {
-      const existing2 = JSON.parse(fs53.readFileSync(mcpPath, "utf8"));
+      const existing2 = JSON.parse(fs54.readFileSync(mcpPath, "utf8"));
       if (typeof existing2 === "object" && existing2 !== null && !Array.isArray(existing2)) {
         config = existing2;
       } else {
@@ -58646,7 +59048,7 @@ function writeWorkspaceMcp(workspaceRoot, serverNames, definitions, vars2 = {})
   if (legacy?.headers?.["X-Sandbox-Feature"] !== void 0)
     delete servers[LEGACY_SERVER];
   Object.assign(servers, wanted);
-  fs53.writeFileSync(mcpPath, JSON.stringify(config, null, 2) + "\n");
+  fs54.writeFileSync(mcpPath, JSON.stringify(config, null, 2) + "\n");
   return mcpPath;
 }
 var LEGACY_SERVER;
@@ -58659,9 +59061,9 @@ var init_mcp_gen = __esm({
 });
 // ../../packages/sandbox-core/dist/workspace_init.js
-import * as fs54 from "node:fs";
+import * as fs55 from "node:fs";
 import * as os19 from "node:os";
-import * as path62 from "node:path";
+import * as path63 from "node:path";
 function fail2(message) {
   error(message);
   throw new WorkspaceInitError(message);
@@ -58684,7 +59086,7 @@ async function resolveIssueCopy(root, issueId, opts) {
 }
 function isDir4(p) {
   try {
-    return fs54.statSync(p).isDirectory();
+    return fs55.statSync(p).isDirectory();
   } catch {
     return false;
   }
@@ -58701,26 +59103,26 @@ function splitMultiValue(value) {
   return value.split(",").map((s) => s.trim()).filter((s) => s);
 }
 function hasWorkspaceConfig(workspaceRoot, override) {
-  if (override && fs54.existsSync(expandUserPath(override))) {
+  if (override && fs55.existsSync(expandUserPath(override))) {
     return true;
   }
   const envOverride = envVar("WORKSPACE_CONFIG");
-  if (envOverride && fs54.existsSync(expandUserPath(envOverride))) {
+  if (envOverride && fs55.existsSync(expandUserPath(envOverride))) {
     return true;
   }
   const sandbox = dotDir(workspaceRoot);
-  return _WORKSPACE_CONFIG_NAMES.some((name) => fs54.existsSync(path62.join(sandbox, name)));
+  return _WORKSPACE_CONFIG_NAMES.some((name) => fs55.existsSync(path63.join(sandbox, name)));
 }
 function writeWorkspaceConfig(workspaceRoot, resolved) {
   if (Object.keys(resolved).length === 0) {
     return;
   }
   const sandboxDir = dotDir(workspaceRoot);
-  const target = path62.join(sandboxDir, _WORKSPACE_CONFIG_NAMES[0]);
-  const legacies = _WORKSPACE_CONFIG_NAMES.slice(1).map((name) => path62.join(sandboxDir, name));
+  const target = path63.join(sandboxDir, _WORKSPACE_CONFIG_NAMES[0]);
+  const legacies = _WORKSPACE_CONFIG_NAMES.slice(1).map((name) => path63.join(sandboxDir, name));
   let existing2 = {};
   for (const source of [target, ...legacies]) {
-    if (fs54.existsSync(source) && fs54.statSync(source).isFile()) {
+    if (fs55.existsSync(source) && fs55.statSync(source).isFile()) {
       try {
         const data = loadWorkspaceConfig(source);
         if (typeof data === "object" && data !== null && !Array.isArray(data)) {
@@ -58742,21 +59144,23 @@ function writeWorkspaceConfig(workspaceRoot, resolved) {
       }
       if (field === "autonomous" || field === "auto_stop")
         value = value === "true";
+      if (field === "auto_stop" && value === false && !(field in existing2))
+        continue;
       merged[field] = value;
     }
   }
   const body = YAML8.stringify(merged, { sortMapEntries: true, blockQuote: "literal" });
   const serialized = _WORKSPACE_CONFIG_HEADER + body;
-  if (fs54.existsSync(target) && fs54.readFileSync(target, "utf8") === serialized) {
+  if (fs55.existsSync(target) && fs55.readFileSync(target, "utf8") === serialized) {
     return;
   }
-  fs54.mkdirSync(sandboxDir, { recursive: true });
-  fs54.writeFileSync(target, serialized);
+  fs55.mkdirSync(sandboxDir, { recursive: true });
+  fs55.writeFileSync(target, serialized);
   success(`Persisted inputs to ${target}`);
   for (const legacy of legacies) {
-    if (fs54.existsSync(legacy)) {
-      fs54.unlinkSync(legacy);
-      info(`Removed legacy ${path62.basename(legacy)} (superseded by workspace.yml)`);
+    if (fs55.existsSync(legacy)) {
+      fs55.unlinkSync(legacy);
+      info(`Removed legacy ${path63.basename(legacy)} (superseded by workspace.yml)`);
     }
   }
 }
@@ -58774,16 +59178,16 @@ function resolveReposRoot() {
 function resolveWorkspacesRoot() {
   const configured = loadPaths()["workspaces_root"];
   if (configured) {
-    return path62.resolve(expandUser(configured));
+    return path63.resolve(expandUser(configured));
   }
-  return path62.resolve(path62.join(os19.homedir(), "workspace"));
+  return path63.resolve(path63.join(os19.homedir(), "workspace"));
 }
 function createWorkspaceRoot(workspaceDir, branch, force) {
   const reposRoot = resolveReposRoot();
-  const rootRepoSrc = path62.join(reposRoot, WORKSPACE_ROOT_REPO);
+  const rootRepoSrc = path63.join(reposRoot, WORKSPACE_ROOT_REPO);
   info(`Workspace:  ${workspaceDir}`);
   info(`Branch:     ${branch}`);
-  if (fs54.existsSync(path62.join(rootRepoSrc, ".git"))) {
+  if (fs55.existsSync(path63.join(rootRepoSrc, ".git"))) {
     try {
       createWorktree(rootRepoSrc, workspaceDir, branch, { force });
     } catch (exc) {
@@ -58792,11 +59196,11 @@ function createWorkspaceRoot(workspaceDir, branch, force) {
     success(`Created workspace root (worktree of ${WORKSPACE_ROOT_REPO}) at ${workspaceDir}`);
   } else {
     warn(`No '${WORKSPACE_ROOT_REPO}' repo at ${rootRepoSrc} \u2014 workspace root will be a plain directory (no git history for notes/config).`);
-    fs54.mkdirSync(workspaceDir, { recursive: true });
+    fs55.mkdirSync(workspaceDir, { recursive: true });
   }
 }
 function commitWorkspaceState(workspaceDir, workspaceName) {
-  if (!fs54.existsSync(path62.join(workspaceDir, ".git"))) {
+  if (!fs55.existsSync(path63.join(workspaceDir, ".git"))) {
     return;
   }
   try {
@@ -58836,9 +59240,9 @@ function candidateWorkspaceRoots() {
   const roots = [];
   const configured = loadPaths()["workspaces_root"];
   if (configured) {
-    roots.push(path62.resolve(expandUserPath(configured)));
+    roots.push(path63.resolve(expandUserPath(configured)));
   }
-  roots.push(path62.join(os19.homedir(), "workspace"));
+  roots.push(path63.join(os19.homedir(), "workspace"));
   const seen = /* @__PURE__ */ new Set();
   const unique = [];
   for (const r of roots) {
@@ -58850,20 +59254,20 @@ function candidateWorkspaceRoots() {
   return unique;
 }
 function findWorkspaceRoot2() {
-  const cwd = path62.resolve(process.cwd());
+  const cwd = path63.resolve(process.cwd());
   for (const root of candidateWorkspaceRoots()) {
-    const rel = path62.relative(root, cwd);
-    if (rel === ".." || rel.startsWith(".." + path62.sep) || path62.isAbsolute(rel)) {
+    const rel = path63.relative(root, cwd);
+    if (rel === ".." || rel.startsWith(".." + path63.sep) || path63.isAbsolute(rel)) {
       continue;
     }
     if (rel === "") {
       continue;
     }
-    return path62.join(root, rel.split(path62.sep)[0]);
+    return path63.join(root, rel.split(path63.sep)[0]);
   }
   for (const directory of [cwd, ...ancestors(cwd)]) {
-    if (fs54.existsSync(path62.join(directory, ".git"))) {
-      return path62.dirname(directory);
+    if (fs55.existsSync(path63.join(directory, ".git"))) {
+      return path63.dirname(directory);
     }
   }
   const rootsDisplay = candidateWorkspaceRoots().join(", ");
@@ -58874,7 +59278,7 @@ function ancestors(p) {
   const result = [];
   let cur = p;
   while (true) {
-    const parent = path62.dirname(cur);
+    const parent = path63.dirname(cur);
     if (parent === cur) {
       break;
     }
@@ -58893,16 +59297,16 @@ function getBranch(p) {
   return result2.stdout.trim() || "unknown";
 }
 function discoverRepos(workspaceRoot) {
-  return repoDirs(workspaceRoot).map((d) => [path62.basename(d), getBranch(d)]);
+  return repoDirs(workspaceRoot).map((d) => [path63.basename(d), getBranch(d)]);
 }
 function workspaceBranch(workspaceRoot) {
-  if (fs54.existsSync(path62.join(workspaceRoot, ".git"))) {
+  if (fs55.existsSync(path63.join(workspaceRoot, ".git"))) {
     const branch = getBranch(workspaceRoot);
     if (branch && branch !== "unknown") {
       return branch;
     }
   }
-  return `${getuser()}/${path62.basename(workspaceRoot)}`;
+  return `${getuser()}/${path63.basename(workspaceRoot)}`;
 }
 function reconcileWorktrees(workspaceRoot, desiredRepos, force) {
   const reposRoot = getReposRoot();
@@ -58911,12 +59315,12 @@ function reconcileWorktrees(workspaceRoot, desiredRepos, force) {
   const present = new Set(discoverRepos(workspaceRoot).map(([name]) => name));
   const toCreate = desired.filter((r) => !present.has(r));
   const toRemove = [...present].filter((r) => !desiredSet.has(r)).sort();
-  const missingSrc = toCreate.filter((r) => !isDir4(path62.join(reposRoot, r)));
+  const missingSrc = toCreate.filter((r) => !isDir4(path63.join(reposRoot, r)));
   if (missingSrc.length) {
     fail2(`Source repo(s) not found under ${reposRoot}: ${missingSrc.join(", ")}. Clone them there (or fix \`repos\` in .sandbox/workspace.yml) and rerun.`);
   }
   if (toRemove.length && !force) {
-    const dirty = toRemove.filter((r) => worktreeIsDirty(path62.join(workspaceRoot, r)));
+    const dirty = toRemove.filter((r) => worktreeIsDirty(path63.join(workspaceRoot, r)));
     if (dirty.length) {
       fail2(`Refusing to remove worktree(s) with uncommitted changes: ${dirty.join(", ")}. Commit or stash them, or rerun with --force to discard them.`);
     }
@@ -58926,7 +59330,7 @@ function reconcileWorktrees(workspaceRoot, desiredRepos, force) {
   }
   const branch = workspaceBranch(workspaceRoot);
   for (const repo of toRemove) {
-    const [ok, message] = removeWorktree(path62.join(reposRoot, repo), path62.join(workspaceRoot, repo), branch);
+    const [ok, message] = removeWorktree(path63.join(reposRoot, repo), path63.join(workspaceRoot, repo), branch);
     if (ok) {
       success(`Removed worktree '${repo}' (no longer in workspace.yml).`);
       if (message) {
@@ -58939,8 +59343,8 @@ function reconcileWorktrees(workspaceRoot, desiredRepos, force) {
   const created = [];
   try {
     for (const repo of toCreate) {
-      const src = path62.join(reposRoot, repo);
-      const dest = path62.join(workspaceRoot, repo);
+      const src = path63.join(reposRoot, repo);
+      const dest = path63.join(workspaceRoot, repo);
       createWorktree(src, dest, branch, { force });
       created.push([dest, src]);
     }
@@ -58968,10 +59372,10 @@ function resolveTask(argsTask, workspaceName, readStdinTask2) {
   return [slugToTask(workspaceName), {}];
 }
 function warnIfExisting(claudeMdPath) {
-  if (!fs54.existsSync(claudeMdPath)) {
+  if (!fs55.existsSync(claudeMdPath)) {
     return;
   }
-  const existing2 = fs54.readFileSync(claudeMdPath, "utf8");
+  const existing2 = fs55.readFileSync(claudeMdPath, "utf8");
   if (existing2.includes("## Layout")) {
     warn("CLAUDE.md already initialised \u2014 overwriting with fresh content.");
   } else {
@@ -58994,7 +59398,7 @@ function logMeta(task, meta) {
 }
 async function initWorkspace(args, workspaceRootOverride, opts = {}) {
   const workspaceRoot = workspaceRootOverride ?? findWorkspaceRoot2();
-  const workspaceName = path62.basename(workspaceRoot);
+  const workspaceName = path63.basename(workspaceRoot);
   info(`Workspace root: ${workspaceRoot}`);
   const inputs = resolveInputs(args, workspaceRoot);
   const strategy = strategyById(parseStrategyId(inputs["context_strategy"]));
@@ -59023,7 +59427,7 @@ async function initWorkspace(args, workspaceRootOverride, opts = {}) {
     }
     reconcileWorktrees(workspaceRoot, desiredRepos, Boolean(args["force"]));
   }
-  const claudeMdPath = path62.join(workspaceRoot, "CLAUDE.md");
+  const claudeMdPath = path63.join(workspaceRoot, "CLAUDE.md");
   warnIfExisting(claudeMdPath);
   info("Scanning for git repos...");
   const repos = discoverRepos(workspaceRoot);
@@ -59080,7 +59484,7 @@ async function initWorkspace(args, workspaceRootOverride, opts = {}) {
   for (const warning of pluginDriftWarnings()) {
     warn(warning);
   }
-  const envPath = path62.join(workspaceRoot, ".env");
+  const envPath = path63.join(workspaceRoot, ".env");
   seedWorkspaceMetadataEnv(envPath, meta);
   success(`Wrote ${envPath}`);
   const feature2 = (meta["FEATURE"] ?? "").trim();
@@ -59139,8 +59543,8 @@ async function provisionWorkspace(resolved, opts = {}) {
     fail2(`Workspace name '${workspaceName}' is not a valid slug (expected lowercase letters, digits, and single hyphens).`);
   }
   const branch = buildBranchName(os19.userInfo().username, workspaceName);
-  const workspaceDir = path62.join(resolveWorkspacesRoot(), workspaceName);
-  if (fs54.existsSync(workspaceDir)) {
+  const workspaceDir = path63.join(resolveWorkspacesRoot(), workspaceName);
+  if (fs55.existsSync(workspaceDir)) {
     info(`Workspace already exists: ${workspaceDir} \u2014 re-running init-workspace.`);
   } else {
     const repos = await selectRepos(resolved.repos, resolved.services);
@@ -59297,21 +59701,21 @@ __export(sandbox_exports, {
 import { execFile as execFile2, spawn as spawn8 } from "node:child_process";
 import { EventEmitter } from "node:events";
 import { createReadStream } from "node:fs";
-import fs55 from "node:fs/promises";
+import fs56 from "node:fs/promises";
 import os20 from "node:os";
-import path63 from "node:path";
+import path64 from "node:path";
 import readline5 from "node:readline";
 import { promisify } from "node:util";
 async function isDir5(p) {
   try {
-    return (await fs55.stat(p)).isDirectory();
+    return (await fs56.stat(p)).isDirectory();
   } catch {
     return false;
   }
 }
 async function isFile3(p) {
   try {
-    return (await fs55.stat(p)).isFile();
+    return (await fs56.stat(p)).isFile();
   } catch {
     return false;
   }
@@ -59322,23 +59726,23 @@ async function resolveSandboxBin(opts = {}) {
     return explicit;
   const root = envVar("ROOT");
   if (root) {
-    const cand = path63.join(root, "sandbox");
+    const cand = path64.join(root, "sandbox");
     if (await isExecutable(cand))
       return cand;
   }
   let dir = opts.from ?? import.meta.dirname;
   for (let i = 0; i < 8; i++) {
-    const cand = path63.join(dir, "sandbox");
-    const hasCli = await isDir5(path63.join(dir, "apps", "cli"));
+    const cand = path64.join(dir, "sandbox");
+    const hasCli = await isDir5(path64.join(dir, "apps", "cli"));
     if (await isExecutable(cand) && hasCli) {
       return cand;
     }
-    const parent = path63.dirname(dir);
+    const parent = path64.dirname(dir);
     if (parent === dir)
       break;
     dir = parent;
   }
-  const local = path63.join(os20.homedir(), ".local", "bin", "sandbox");
+  const local = path64.join(os20.homedir(), ".local", "bin", "sandbox");
   if (await isExecutable(local))
     return local;
   throw new WorkspaceError("Could not locate the `sandbox` CLI. Set SANDBOX_ROOT to your sandbox checkout (or SANDBOX_BIN to the wrapper itself), or ensure the repo with its ./sandbox wrapper is reachable.");
@@ -59435,7 +59839,7 @@ async function readServicesRegistry() {
   if (!p)
     return null;
   try {
-    return await fs55.readFile(p, "utf-8");
+    return await fs56.readFile(p, "utf-8");
   } catch {
     return null;
   }
@@ -59592,7 +59996,7 @@ function pickValidServices(raw2, known) {
 }
 async function readWorkspaceConfig(workspaceDir) {
   try {
-    const text = await fs55.readFile(path63.join(dotDir(workspaceDir), "workspace.yml"), "utf-8");
+    const text = await fs56.readFile(path64.join(dotDir(workspaceDir), "workspace.yml"), "utf-8");
     const data = (0, import_yaml15.parse)(text);
     const issueId = issueIdOf(data) || null;
     const labels = Array.isArray(data?.labels) ? data.labels.filter((l) => typeof l === "string") : [];
@@ -59606,19 +60010,19 @@ async function listWorkspaces() {
   const root = workspacesRoot();
   let entries;
   try {
-    entries = await fs55.readdir(root, { withFileTypes: true });
+    entries = await fs56.readdir(root, { withFileTypes: true });
   } catch (e) {
     throw new WorkspaceError(`Could not read workspaces root ${root}: ${e.message}`);
   }
   const names = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).sort((a, b) => a.localeCompare(b));
   const workspaces = await Promise.all(names.map(async (name) => {
-    const p = path63.join(root, name);
+    const p = path64.join(root, name);
     const { issueId, labels, model } = await readWorkspaceConfig(p);
     return {
       name,
       path: p,
       // vscode://file + an absolute path (already leading-slash) → single slash.
-      vscodeUri: `vscode://file${p.split(path63.sep).map(encodeURIComponent).join("/")}`,
+      vscodeUri: `vscode://file${p.split(path64.sep).map(encodeURIComponent).join("/")}`,
       issueId,
       issueUrl: issueId ? issueTracker().url(issueId) : null,
       labels,
@@ -59795,7 +60199,7 @@ async function resolveWorkspaceDir(name) {
   if (!clean || clean.includes("/") || clean.includes("\\") || clean.includes("..")) {
     throw new WorkspaceError(`Invalid workspace name: ${JSON.stringify(name)}`);
   }
-  const target = path63.join(workspacesRoot(), clean);
+  const target = path64.join(workspacesRoot(), clean);
   if (!await isDir5(target)) {
     throw new WorkspaceError(`No such workspace: ${clean}`);
   }
@@ -59806,7 +60210,7 @@ function reconcileDirForKey(name) {
   if (!slug || slug.includes("/") || slug.includes("\\") || slug.includes("..")) {
     throw new WorkspaceError(`Invalid reconcile session: ${JSON.stringify(name)}`);
   }
-  return path63.join(reconcileRoot(), slug);
+  return path64.join(reconcileRoot(), slug);
 }
 async function resolveSessionDir(name) {
   if ((name ?? "").startsWith(RECONCILE_PREFIX)) {
@@ -59826,7 +60230,7 @@ async function openWorkspace(name) {
 }
 async function readEnvValue(dir, key) {
   try {
-    const text = await fs55.readFile(path63.join(dir, ".env"), "utf-8");
+    const text = await fs56.readFile(path64.join(dir, ".env"), "utf-8");
     for (const line of text.split(/\r?\n/)) {
       const eq = line.indexOf("=");
       if (eq > 0 && line.slice(0, eq).trim() === key)
@@ -59838,7 +60242,7 @@ async function readEnvValue(dir, key) {
 }
 async function readWorkspaceFeature(dir) {
   try {
-    const text = await fs55.readFile(path63.join(dotDir(dir), "workspace.yml"), "utf-8");
+    const text = await fs56.readFile(path64.join(dotDir(dir), "workspace.yml"), "utf-8");
     const m = /^feature: *["']?([^"'\s#]+)/m.exec(text);
     return m ? m[1] : null;
   } catch {
@@ -59846,7 +60250,7 @@ async function readWorkspaceFeature(dir) {
   }
 }
 async function readFileTail(file, maxBytes = 131072) {
-  const fh = await fs55.open(file, "r");
+  const fh = await fs56.open(file, "r");
   try {
     const { size } = await fh.stat();
     const start2 = Math.max(0, size - maxBytes);
@@ -59942,7 +60346,7 @@ async function loadPortsDoc() {
   if (!file)
     return null;
   try {
-    return (0, import_yaml15.parse)(await fs55.readFile(file, "utf8")) ?? null;
+    return (0, import_yaml15.parse)(await fs56.readFile(file, "utf8")) ?? null;
   } catch {
     return null;
   }
@@ -59953,12 +60357,12 @@ function slotPortLabel(slot, ports) {
 }
 async function getWorkspaceStatuses() {
   const root = workspacesRoot();
-  const entries = await fs55.readdir(root, { withFileTypes: true }).catch(() => []);
+  const entries = await fs56.readdir(root, { withFileTypes: true }).catch(() => []);
   const names = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).sort((a, b) => a.localeCompare(b));
   const projects = await dockerComposeProjects();
   const portsDoc = await loadPortsDoc();
   const statuses = await Promise.all(names.map(async (name) => {
-    const dir = path63.join(root, name);
+    const dir = path64.join(root, name);
     let project = await readEnvValue(dir, "COMPOSE_PROJECT_NAME");
     if (!project) {
       const feature2 = await readWorkspaceFeature(dir);
@@ -60037,19 +60441,19 @@ async function getIntercepts() {
 }
 async function hasGit(dir) {
   try {
-    await fs55.access(path63.join(dir, ".git"));
+    await fs56.access(path64.join(dir, ".git"));
     return true;
   } catch {
     return false;
   }
 }
 async function listRepoWorktrees(workspaceDir) {
-  const entries = await fs55.readdir(workspaceDir, { withFileTypes: true }).catch(() => []);
+  const entries = await fs56.readdir(workspaceDir, { withFileTypes: true }).catch(() => []);
   const out = [];
   for (const e of entries) {
     if (!e.isDirectory() || e.name.startsWith("."))
       continue;
-    const dir = path63.join(workspaceDir, e.name);
+    const dir = path64.join(workspaceDir, e.name);
     if (await hasGit(dir))
       out.push({ repo: e.name, dir });
   }
@@ -60091,10 +60495,10 @@ async function ghPrForWorktree(repoDir) {
 }
 async function getWorkspacePRs() {
   const root = workspacesRoot();
-  const entries = await fs55.readdir(root, { withFileTypes: true }).catch(() => []);
+  const entries = await fs56.readdir(root, { withFileTypes: true }).catch(() => []);
   const names = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).sort((a, b) => a.localeCompare(b));
   return Promise.all(names.map(async (name) => {
-    const repos = await listRepoWorktrees(path63.join(root, name));
+    const repos = await listRepoWorktrees(path64.join(root, name));
     const repoPrs = await Promise.all(repos.map(async ({ repo, dir }) => ({ repo, ...await ghPrForWorktree(dir) })));
     return { name, repos: repoPrs };
   }));
@@ -60302,7 +60706,7 @@ async function worktreeSources(worktrees) {
     if (res && res.code === 0) {
       const common2 = stripAnsi(res.stdout).trim();
       if (common2)
-        srcs.add(path63.dirname(common2));
+        srcs.add(path64.dirname(common2));
     }
   }
   return [...srcs];
@@ -60311,8 +60715,8 @@ function gitErrorLine(text) {
   const lines = stripAnsi(text).trim().split("\n");
   return (lines.find((l) => /^\s*!\s|^(error|fatal):/.test(l)) ?? lines[0]).trim().replace(/\s+/g, " ");
 }
-async function commitAndPush(dir, message = `chore: handoff ${path63.basename(dir)} before workspace teardown`, paths = []) {
-  const label = path63.basename(dir);
+async function commitAndPush(dir, message = `chore: handoff ${path64.basename(dir)} before workspace teardown`, paths = []) {
+  const label = path64.basename(dir);
   const br = await runCapture("git", ["-C", dir, "rev-parse", "--abbrev-ref", "HEAD"]).catch(() => null);
   const branch = br && br.code === 0 ? stripAnsi(br.stdout).trim() : null;
   if (!branch || branch === "HEAD")
@@ -60394,7 +60798,7 @@ ${parts.join("\n")}`);
         parts.push(detail);
     }
   }
-  await fs55.rm(target, { recursive: true, force: true });
+  await fs56.rm(target, { recursive: true, force: true });
   for (const src of sources) {
     await runCapture("git", ["-C", src, "worktree", "prune"]).catch(() => {
     });
@@ -60559,17 +60963,17 @@ function encodeClaudeProjectDir(p) {
   return p.replace(/[^a-zA-Z0-9]/g, "-");
 }
 async function findClaudeProjectDir(workspacePath) {
-  const root = path63.join(os20.homedir(), ".claude", "projects");
+  const root = path64.join(os20.homedir(), ".claude", "projects");
   const want = encodeClaudeProjectDir(workspacePath);
   let entries;
   try {
-    entries = await fs55.readdir(root, { withFileTypes: true });
+    entries = await fs56.readdir(root, { withFileTypes: true });
   } catch {
     return null;
   }
   for (const e of entries) {
     if (e.isDirectory() && encodeClaudeProjectDir(e.name) === want) {
-      return path63.join(root, e.name);
+      return path64.join(root, e.name);
     }
   }
   return null;
@@ -60577,7 +60981,7 @@ async function findClaudeProjectDir(workspacePath) {
 async function listSessionFiles(projectDir) {
   let names;
   try {
-    names = await fs55.readdir(projectDir);
+    names = await fs56.readdir(projectDir);
   } catch {
     return [];
   }
@@ -60586,8 +60990,8 @@ async function listSessionFiles(projectDir) {
     if (!n.endsWith(".jsonl"))
       continue;
     try {
-      const st = await fs55.stat(path63.join(projectDir, n));
-      out.push({ file: path63.join(projectDir, n), mtime: st.mtime });
+      const st = await fs56.stat(path64.join(projectDir, n));
+      out.push({ file: path64.join(projectDir, n), mtime: st.mtime });
     } catch {
     }
   }
@@ -60597,7 +61001,7 @@ function pickSession(sessions, sessionId) {
   if (!sessions.length)
     return null;
   if (sessionId) {
-    const match = sessions.find((s) => path63.basename(s.file, ".jsonl") === sessionId);
+    const match = sessions.find((s) => path64.basename(s.file, ".jsonl") === sessionId);
     if (match)
       return match;
   }
@@ -60640,7 +61044,7 @@ async function listSessions(name) {
     return [];
   const files = await listSessionFiles(projectDir);
   return Promise.all(files.map(async (f, i) => {
-    const sessionId = path63.basename(f.file, ".jsonl");
+    const sessionId = path64.basename(f.file, ".jsonl");
     return {
       sessionId,
       title: await readSessionTitle(f.file, sessionId),
@@ -60802,7 +61206,7 @@ async function loadPriceTable() {
   if (!p)
     return DEFAULT_PRICES;
   try {
-    const doc = (0, import_yaml15.parse)(await fs55.readFile(p, "utf-8"));
+    const doc = (0, import_yaml15.parse)(await fs56.readFile(p, "utf-8"));
     return doc?.models && Object.keys(doc.models).length ? doc.models : DEFAULT_PRICES;
   } catch {
     return DEFAULT_PRICES;
@@ -60827,7 +61231,7 @@ async function getWorkspaceUsage(name) {
   for (const f of files) {
     let text;
     try {
-      text = await fs55.readFile(f.file, "utf-8");
+      text = await fs56.readFile(f.file, "utf-8");
     } catch {
       continue;
     }
@@ -60848,7 +61252,7 @@ async function getWorkspaceUsage(name) {
       if (usd != null)
         sessionUsd = (sessionUsd ?? 0) + usd;
     }
-    const sessionId = path63.basename(f.file, ".jsonl");
+    const sessionId = path64.basename(f.file, ".jsonl");
     sessions.push({
       sessionId,
       title: await readSessionTitle(f.file, sessionId),
@@ -60893,7 +61297,7 @@ async function resolveSessionSource(name, sessionId) {
     workspacePath: target,
     projectDir,
     sessionFile: chosen.file,
-    sessionId: path63.basename(chosen.file, ".jsonl"),
+    sessionId: path64.basename(chosen.file, ".jsonl"),
     sessionCount: sessions.length,
     updatedAt: chosen.mtime.toISOString()
   };
@@ -60914,10 +61318,10 @@ async function getClaudeTranscript(name, limit = 20, sessionId) {
   const chosen = pickSession(sessions, sessionId);
   if (!chosen)
     return empty;
-  const resolvedId = path63.basename(chosen.file, ".jsonl");
+  const resolvedId = path64.basename(chosen.file, ".jsonl");
   let text;
   try {
-    text = await fs55.readFile(chosen.file, "utf-8");
+    text = await fs56.readFile(chosen.file, "utf-8");
   } catch (e) {
     throw new WorkspaceError(`Could not read session file: ${e.message}`);
   }
@@ -61019,7 +61423,7 @@ async function getK8sForwardsHealth() {
   if (!file) {
     throw new WorkspaceError("Could not locate the service registry (~/.sandbox/services.yaml) \u2014 run `sandbox setup`.");
   }
-  const doc = (0, import_yaml15.parse)(await fs55.readFile(file, "utf-8")) ?? {};
+  const doc = (0, import_yaml15.parse)(await fs56.readFile(file, "utf-8")) ?? {};
   const forwards = await Promise.all(forwardSpecs(doc.services, doc.infrastructure).map(async (d) => {
     const r = await checkForwardHealth(d.listen, d.health);
     return { name: d.name, port: d.listen, healthy: r.ok, detail: r.detail };
@@ -61111,16 +61515,16 @@ async function launchPrReconcile(url, issueRef) {
   }
   const { repo, number } = parseRepoAndNumber(url);
   const slug = `${repo}-${number}`;
-  const dir = path63.join(reconcileRoot(), slug);
-  await fs55.mkdir(dir, { recursive: true });
+  const dir = path64.join(reconcileRoot(), slug);
+  await fs56.mkdir(dir, { recursive: true });
   const [issue, pr, diffRes] = await Promise.all([
     fetchIssueCard(issueRef || url),
     ghPrView(url),
     runCapture("gh", ["pr", "diff", url]).catch(() => null)
   ]);
   const diff = diffRes && diffRes.code === 0 ? stripAnsi(diffRes.stdout) : "";
-  const ctxFile = path63.join(dir, "reconcile-context.md");
-  await fs55.writeFile(ctxFile, buildReconcileContext(issue, pr, diff), "utf-8");
+  const ctxFile = path64.join(dir, "reconcile-context.md");
+  await fs56.writeFile(ctxFile, buildReconcileContext(issue, pr, diff), "utf-8");
   await openTerminalRunning(`cd ${shellQuote(dir)} && claude -p --disallowedTools Bash Edit Write --append-system-prompt-file ${shellQuote(ctxFile)} ${shellQuote(RECONCILE_PROMPT)}`, false);
   return { sessionKey: `${RECONCILE_PREFIX}${slug}`, slug, issue };
 }
@@ -61174,7 +61578,7 @@ var init_sandbox = __esm({
       "/Applications/Visual Studio Code.app/Contents/Resources/app/bin/code"
     ].filter((p) => Boolean(p));
     DISTILLED = ["feature", "task", "description", "starting_prompt", "services"];
-    reconcileRoot = () => path63.join(dotDir(os20.homedir()), "reconcile");
+    reconcileRoot = () => path64.join(dotDir(os20.homedir()), "reconcile");
     RECONCILE_PREFIX = "reconcile:";
     APPROVAL_LABEL = "ready-for-human-approval";
     FAILING_CONCLUSIONS = /* @__PURE__ */ new Set([
@@ -61464,8 +61868,8 @@ __export(detect_exports, {
   run: () => run10,
   runDetect: () => runDetect
 });
-import * as fs56 from "node:fs";
-import * as path64 from "node:path";
+import * as fs57 from "node:fs";
+import * as path65 from "node:path";
 function mark(fv) {
   return fv.confidence === "stated" ? "" : ` ${Colors.YELLOW}[${fv.confidence}]${Colors.RESET}`;
 }
@@ -61518,8 +61922,8 @@ function printPlan(plan) {
 async function runDetect(args, deps) {
   let root;
   if (args.repo) {
-    root = path64.resolve(deps.cwd, args.repo);
-    if (!fs56.statSync(root, { throwIfNoEntry: false })?.isDirectory()) {
+    root = path65.resolve(deps.cwd, args.repo);
+    if (!fs57.statSync(root, { throwIfNoEntry: false })?.isDirectory()) {
       warn(`${root} is not a directory \u2014 pass the repo path: sandbox detect <repo>`);
       return 2;
     }
@@ -61828,18 +62232,18 @@ var open_exports = {};
 __export(open_exports, {
   run: () => run15
 });
-import * as fs57 from "node:fs";
-import * as path65 from "node:path";
+import * as fs58 from "node:fs";
+import * as path66 from "node:path";
 function loadWorkspaceYaml(start2) {
-  let dir = path65.resolve(start2);
+  let dir = path66.resolve(start2);
   for (; ; ) {
     for (const name of ["workspace.yml", "workspace.yaml"]) {
-      const p = path65.join(dotDir(dir), name);
-      if (fs57.existsSync(p) && fs57.statSync(p).isFile()) {
+      const p = path66.join(dotDir(dir), name);
+      if (fs58.existsSync(p) && fs58.statSync(p).isFile()) {
         return readWorkspaceYaml(dir);
       }
     }
-    const parent = path65.dirname(dir);
+    const parent = path66.dirname(dir);
     if (parent === dir) return {};
     dir = parent;
   }
@@ -61969,8 +62373,8 @@ var init_clean = __esm({
 });
 // ../../packages/sandbox-core/dist/stats.js
-import * as fs58 from "node:fs";
-import * as path66 from "node:path";
+import * as fs59 from "node:fs";
+import * as path67 from "node:path";
 function sleep4(seconds, signal) {
   return new Promise((resolve13) => {
     if (signal?.aborted)
@@ -62068,12 +62472,12 @@ function pad2(n) {
   return String(n).padStart(2, "0");
 }
 function saveReport(stats, recommendations) {
-  const statsDir = path66.join(sandboxRoot(), "stats");
-  if (!fs58.existsSync(statsDir))
-    fs58.mkdirSync(statsDir);
+  const statsDir = path67.join(sandboxRoot(), "stats");
+  if (!fs59.existsSync(statsDir))
+    fs59.mkdirSync(statsDir);
   const now = /* @__PURE__ */ new Date();
   const timestamp = `${now.getFullYear()}${pad2(now.getMonth() + 1)}${pad2(now.getDate())}-${pad2(now.getHours())}${pad2(now.getMinutes())}${pad2(now.getSeconds())}`;
-  const csvPath = path66.join(statsDir, `docker-stats-${timestamp}.csv`);
+  const csvPath = path67.join(statsDir, `docker-stats-${timestamp}.csv`);
   const csvRows = [
     ["container", "avg_cpu_pct", "max_cpu_pct", "avg_mem_mib", "max_mem_mib", "samples"].join(",")
   ];
@@ -62088,8 +62492,8 @@ function saveReport(stats, recommendations) {
       String(s.samples)
     ].join(","));
   }
-  fs58.writeFileSync(csvPath, csvRows.join("\r\n") + "\r\n");
-  const summaryPath = path66.join(statsDir, `resource-summary-${timestamp}.txt`);
+  fs59.writeFileSync(csvPath, csvRows.join("\r\n") + "\r\n");
+  const summaryPath = path67.join(statsDir, `resource-summary-${timestamp}.txt`);
   const generated = `${now.getFullYear()}-${pad2(now.getMonth() + 1)}-${pad2(now.getDate())} ${pad2(now.getHours())}:${pad2(now.getMinutes())}:${pad2(now.getSeconds())}`;
   let out = "";
   out += "Docker Resource Usage Summary\n";
@@ -62107,7 +62511,7 @@ function saveReport(stats, recommendations) {
     out += `  ${r.name.padEnd(35)}  cpus: ${r.recommended_cpus.padStart(5)}  memory: ${r.recommended_memory.padStart(5)}
 `;
   }
-  fs58.writeFileSync(summaryPath, out);
+  fs59.writeFileSync(summaryPath, out);
   return summaryPath;
 }
 async function runCollection(durationMinutes, intervalSeconds, save2, signal) {
@@ -62559,14 +62963,14 @@ var init_standards2 = __esm({
 });
 // ../../packages/sandbox-core/dist/pr_guard.js
-import * as fs59 from "node:fs";
-import * as path67 from "node:path";
+import * as fs60 from "node:fs";
+import * as path68 from "node:path";
 function findRecordRoot(start2) {
-  let dir = path67.resolve(start2);
+  let dir = path68.resolve(start2);
   for (; ; ) {
-    if (fs59.existsSync(path67.join(dotDir(dir), "workspace.yml")))
+    if (fs60.existsSync(path68.join(dotDir(dir), "workspace.yml")))
       return dir;
-    const parent = path67.dirname(dir);
+    const parent = path68.dirname(dir);
     if (parent === dir)
       return null;
     dir = parent;
@@ -62574,11 +62978,11 @@ function findRecordRoot(start2) {
 }
 function prFileDirName(root) {
   try {
-    const names = fs59.readdirSync(path67.join(root, "stages")).sort();
+    const names = fs60.readdirSync(path68.join(root, "stages")).sort();
     const dir = names.find((n) => /^\d+_propose$/.test(n)) ?? names.find((n) => /^\d+_ship$/.test(n));
     return dir ? `stages/${dir}/output/` : "the propose stage's output/";
   } catch {
-    return `${path67.basename(dotDir(root))}/notes/`;
+    return `${path68.basename(dotDir(root))}/notes/`;
   }
 }
 function decide2(input2) {
@@ -62590,13 +62994,13 @@ function decide2(input2) {
   const opensPr = tool === "Bash" && GH_PR_CREATE.test(command) || MCP_CREATE_PR.test(tool);
   if (!opensPr)
     return null;
-  const rules = ["_shared/pr-rules.md", ...DOT_DIRS.map((d) => `${d}/pr-rules.md`)].find((p) => fs59.existsSync(path67.join(root, p))) ?? "docs/workspace-lifecycle.md in the sandbox repo";
-  return `Inside sandbox workspace \`${path67.basename(root)}\`, PRs open only through \`sandbox pr open\`: it runs the pre-PR gate and records the URL. Write the PR file in \`${prFileDirName(root)}\`, have the person set \`status: approved\`, then run \`sandbox pr open\`. Rules: \`${rules}\`.`;
+  const rules = ["_shared/pr-rules.md", ...DOT_DIRS.map((d) => `${d}/pr-rules.md`)].find((p) => fs60.existsSync(path68.join(root, p))) ?? "docs/workspace-lifecycle.md in the sandbox repo";
+  return `Inside sandbox workspace \`${path68.basename(root)}\`, PRs open only through \`sandbox pr open\`: it runs the pre-PR gate and records the URL. Write the PR file in \`${prFileDirName(root)}\`, have the person set \`status: approved\`, then run \`sandbox pr open\`. Rules: \`${rules}\`.`;
 }
 function main2() {
   let reason2 = null;
   try {
-    const raw2 = process.stdin.isTTY ? "" : fs59.readFileSync(0, "utf8");
+    const raw2 = process.stdin.isTTY ? "" : fs60.readFileSync(0, "utf8");
     const parsed = raw2.trim() ? JSON.parse(raw2) : {};
     if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed))
       reason2 = decide2(parsed);
@@ -62661,13 +63065,13 @@ __export(init_workspace_exports, {
   readStdinTask: () => readStdinTask,
   run: () => run23
 });
-import * as fs60 from "node:fs";
+import * as fs61 from "node:fs";
 function readStdinTask() {
   if (process.stdin.isTTY) {
     return "";
   }
   try {
-    return fs60.readFileSync(0, "utf8");
+    return fs61.readFileSync(0, "utf8");
   } catch {
     return "";
   }
@@ -62700,8 +63104,8 @@ __export(workspace_exports, {
   browserFormCommand: () => browserFormCommand,
   run: () => run24
 });
-import * as fs61 from "node:fs";
-import * as path68 from "node:path";
+import * as fs62 from "node:fs";
+import * as path69 from "node:path";
 async function resolveWorkspaceInputs(args) {
   const base = process.cwd();
   let resolved = resolveInputs(args, base);
@@ -62737,12 +63141,12 @@ async function resolveWorkspaceInputs(args) {
   return { resolved, issue };
 }
 function which2(cmd) {
-  const dirs = (process.env.PATH || "").split(path68.delimiter);
+  const dirs = (process.env.PATH || "").split(path69.delimiter);
   for (const dir of dirs) {
     if (!dir) continue;
-    const full = path68.join(dir, cmd);
+    const full = path69.join(dir, cmd);
     try {
-      fs61.accessSync(full, fs61.constants.X_OK);
+      fs62.accessSync(full, fs62.constants.X_OK);
       return full;
     } catch {
     }
@@ -62763,8 +63167,8 @@ function browserFormCommand(node, cliJs, args) {
   return cmd;
 }
 function runBrowserForm(args) {
-  const cliJs = path68.join(getMonorepoRoot(), "apps", "sandbox-dashboard", "dist", "form-cli.js");
-  if (!(fs61.existsSync(cliJs) && fs61.statSync(cliJs).isFile())) {
+  const cliJs = path69.join(getMonorepoRoot(), "apps", "sandbox-dashboard", "dist", "form-cli.js");
+  if (!(fs62.existsSync(cliJs) && fs62.statSync(cliJs).isFile())) {
     error(
       `Browser form not built: ${cliJs} is missing. Run \`npm --prefix apps/sandbox-dashboard run build\` (or \`sandbox dashboard\` once) first.`
     );
@@ -62887,7 +63291,7 @@ __export(issue_exports, {
   run: () => run26,
   updateFromArgs: () => updateFromArgs
 });
-import * as fs62 from "node:fs";
+import * as fs63 from "node:fs";
 function updateFromArgs(args) {
   const status2 = args.status || void 0;
   const comment = args.comment || void 0;
@@ -62895,7 +63299,7 @@ function updateFromArgs(args) {
     return "Nothing to update: pass --status <name> and/or --comment <text>.";
   return { status: status2, comment };
 }
-function newIssueFromArgs(args, read = (p) => fs62.readFileSync(p, "utf8")) {
+function newIssueFromArgs(args, read = (p) => fs63.readFileSync(p, "utf8")) {
   const project = (args.project ?? "").trim().toUpperCase();
   const type = args.type ?? "";
   const title = (args.title ?? "").trim();
@@ -62935,6 +63339,14 @@ async function run26(args) {
     }
     return;
   }
+  if (args.action === "start") {
+    const workspace = findWorkspaceRoot(process.cwd());
+    if (workspace === null)
+      fail3("Not inside a sandbox workspace (no .sandbox/ directory found above CWD).");
+    const line = await startIssue(workspace) || "left as is (no in_progress status configured)";
+    (line.includes("not moved") ? warn : success)(`Issue: ${line}`);
+    return;
+  }
   const update = args.action === "update" ? updateFromArgs(args) : null;
   if (typeof update === "string") fail3(update);
   let text = args.ref ?? "";
@@ -62974,6 +63386,7 @@ var init_issue = __esm({
     "use strict";
     init_define_SANDBOX_BUILD();
     init_gate();
+    init_issue_status();
     init_issue_tracker();
     init_workspace_prompts();
     init_config2();
@@ -63063,10 +63476,10 @@ var close_out_exports = {};
 __export(close_out_exports, {
   run: () => run29
 });
-import path69 from "node:path";
+import path70 from "node:path";
 async function run29(args) {
   const root = findRecordRoot(process.cwd());
-  const name = args.name ?? (root ? path69.basename(root) : null);
+  const name = args.name ?? (root ? path70.basename(root) : null);
   if (!name) {
     error("No workspace given and not inside one.");
     process.exit(1);
@@ -63118,9 +63531,9 @@ async function run30(args) {
     error("Feature name required: pass it as an argument or set FEATURE in a .env file.");
     process.exit(1);
   }
-  const { path: path73 } = await openWorkspace(name);
+  const { path: path74 } = await openWorkspace(name);
   console.log(
-    `${Colors.GREEN}Opened '${name}' in VS Code${Colors.RESET}  ${Colors.DIM}${path73}${Colors.RESET}`
+    `${Colors.GREEN}Opened '${name}' in VS Code${Colors.RESET}  ${Colors.DIM}${path74}${Colors.RESET}`
   );
 }
 var init_code = __esm({
@@ -63138,8 +63551,8 @@ var setup_exports = {};
 __export(setup_exports, {
   run: () => run31
 });
-import * as fs63 from "node:fs";
-import * as path70 from "node:path";
+import * as fs64 from "node:fs";
+import * as path71 from "node:path";
 function heading(text) {
   console.log(`
 ${Colors.BOLD}${text}${Colors.RESET}`);
@@ -63245,7 +63658,7 @@ async function configureMachine(interactive) {
       interactive
     );
   }
-  if (!fs63.existsSync(servicesLocalYamlPath()) && interactive) {
+  if (!fs64.existsSync(servicesLocalYamlPath()) && interactive) {
     k8sContext = await prompt(
       "Kube context for `sandbox intercept` (services.local.yaml k8s_context)",
       k8sContext
@@ -63407,9 +63820,9 @@ async function configureMachine(interactive) {
   info(
     `${zshrcPath()}: ${completionChanged ? "installed tab completion" : "tab completion already installed"}`
   );
-  if (fs63.existsSync(desktopConfigPath())) {
+  if (fs64.existsSync(desktopConfigPath())) {
     info(
-      `${path70.basename(desktopConfigPath())}: ${desktopChanged ? "dropped stale env block" : "no env block to remove"}`
+      `${path71.basename(desktopConfigPath())}: ${desktopChanged ? "dropped stale env block" : "no env block to remove"}`
     );
   }
   return {
@@ -63520,8 +63933,8 @@ var config_exports = {};
 __export(config_exports, {
   run: () => run32
 });
-import * as fs64 from "node:fs";
-import * as path71 from "node:path";
+import * as fs65 from "node:fs";
+import * as path72 from "node:path";
 function show(cfg) {
   const paths = cfg.paths || {};
   console.log(`${Colors.BOLD}config file:${Colors.RESET} ${configPath()}`);
@@ -63616,9 +64029,9 @@ async function run32(args) {
   info(`Regenerated ${envSh}`);
   info(`${zshenvPath()}: ${zshChanged ? "updated" : "already sources env.sh"}`);
   const desktopPath = desktopConfigPath();
-  if (fs64.existsSync(desktopPath)) {
+  if (fs65.existsSync(desktopPath)) {
     info(
-      `${path71.basename(desktopPath)}: ${desktopChanged ? "dropped stale env block" : "no env block to remove"}`
+      `${path72.basename(desktopPath)}: ${desktopChanged ? "dropped stale env block" : "no env block to remove"}`
     );
   }
   info("Open a new shell (or `source ~/.zshenv`) for the exports to take effect.");
@@ -63669,7 +64082,7 @@ var init_registry = __esm({
 // src/main.ts
 init_define_SANDBOX_BUILD();
-import path72 from "node:path";
+import path73 from "node:path";
 import { fileURLToPath } from "node:url";
 // ../../node_modules/commander/esm.mjs
@@ -63723,7 +64136,7 @@ function staleBuildWarning(build, repoRoot) {
 // src/main.ts
 init_interrupt();
-var _REPO_ROOT = path72.resolve(path72.dirname(fileURLToPath(import.meta.url)), "..");
+var _REPO_ROOT = path73.resolve(path73.dirname(fileURLToPath(import.meta.url)), "..");
 if (!envVar("ROOT")) {
   process.env.SANDBOX_ROOT = _REPO_ROOT;
 }
@@ -63744,11 +64157,15 @@ var SPECS = [
       ).option(
         "-w, --workspace <path>",
         "Path to directory containing repo checkouts. Default: ~/workspace (override with WORKSPACE env var)."
+      ).option(
+        "--dev",
+        "Run the file watchers in cli/library/extension containers, which otherwise idle."
       );
     },
     namespace: ([feature2], o) => ({
       feature: feature2 ?? null,
-      workspace: o.workspace ?? null
+      workspace: o.workspace ?? null,
+      dev: o.dev ?? false
     })
   },
   {
@@ -63819,9 +64236,16 @@ var SPECS = [
       ).option(
         "--if-idle",
         "SessionEnd hook mode: stop the workspace's own feature unless another Claude session is open there; silent, always exits 0, never stops infra"
+      ).option(
+        "--idle <minutes>",
+        "Stop every workspace's feature containers nothing has used for <minutes> (a busy or recently active session, a gate exec or a fresh start all count as use); with [feature], only that one"
       );
     },
-    namespace: ([feature2], o) => ({ feature: feature2 ?? null, if_idle: Boolean(o.ifIdle) })
+    namespace: ([feature2], o) => ({
+      feature: feature2 ?? null,
+      if_idle: Boolean(o.ifIdle),
+      idle: o.idle ?? null
+    })
   },
   {
     name: "status",
@@ -64157,8 +64581,8 @@ var SPECS = [
       ).addArgument(
         new Argument(
           "<action>",
-          "view: print the issue; update: change its status and/or add a comment; create: file a new issue and print its URL (Jira)"
-        ).choices(["view", "update", "create"])
+          "view: print the issue; update: change its status and/or add a comment; create: file a new issue and print its URL (Jira); start: move the workspace's issue to in progress (forward only)"
+        ).choices(["view", "update", "create", "start"])
       ).argument(
         "[ref]",
         "Issue ID; omit inside a workspace to use its .sandbox/workspace.yml issue"
@@ -64456,7 +64880,7 @@ ${_RED}Interrupted${_RESET}`));
     return completeLine(program2);
   }
   if (process.argv[2] !== "hooks" && !process.argv.includes("--if-idle")) {
-    const warning = staleBuildWarning(BUILD_STAMP, path72.resolve(_REPO_ROOT, "../.."));
+    const warning = staleBuildWarning(BUILD_STAMP, path73.resolve(_REPO_ROOT, "../.."));
     if (warning) console.error(warning);
   }
   if (process.argv.length <= 2) {