From ca3bd76f3baae96675aac548595e0da629bd676b Mon Sep 17 00:00:00 2001
From: "roomote-community[bot]"
 <311835222+roomote-community[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 01:33:59 -0400
Subject: [PATCH 01/24] [Fix] Discord automation replies disappear after task
 resume (#1017)

Co-authored-by: Matt Rubens <2600+mrubens@users.noreply.github.com>
---
 .../communication-thread-replies.test.ts      | 41 +++++++++++++++++++
 .../mcp/communication-thread-replies.ts       | 18 +++++---
 .../handlers/__tests__/auto-resume.test.ts    | 39 ++++++++++++++++++
 .../preview-proxy/src/handlers/auto-resume.ts |  4 ++
 apps/web/src/trpc/commands/snapshots/index.ts |  4 ++
 5 files changed, 100 insertions(+), 6 deletions(-)

diff --git a/apps/api/src/handlers/mcp/__tests__/communication-thread-replies.test.ts b/apps/api/src/handlers/mcp/__tests__/communication-thread-replies.test.ts
index 8f7fd6347..aaf6ada5c 100644
--- a/apps/api/src/handlers/mcp/__tests__/communication-thread-replies.test.ts
+++ b/apps/api/src/handlers/mcp/__tests__/communication-thread-replies.test.ts
@@ -304,6 +304,47 @@ describe('maybeSendCommunicationThreadReply (Discord)', () => {
     expect(discordCreateThreadFromMessageMock).not.toHaveBeenCalled();
   });
 
+  it('recovers a missing automation thread from its saved root message', async () => {
+    getTaskAutomationInitiatorKeyMock.mockResolvedValue('custom_automation');
+
+    await maybeSendCommunicationThreadReply({
+      taskRun: {
+        ...discordTaskRun,
+        payload: {
+          communicationProvider: 'discord',
+          communicationChannelId: 'channel-1',
+          communicationMessageId: 'report-root',
+        },
+      },
+      parsedBody: { text: 'Follow-up result', images: [] },
+    });
+
+    expect(discordPostMessageMock).toHaveBeenCalledWith(
+      expect.objectContaining({ replyToMessageId: 'report-root' }),
+    );
+    expect(discordCreateThreadFromMessageMock).toHaveBeenCalledWith({
+      channelId: 'channel-1',
+      messageId: 'report-root',
+      name: 'Follow-up result',
+    });
+    expect(
+      sqlMock.mock.calls.map(([strings, ...values]) => ({
+        text: Array.from(strings as string[]).join('?'),
+        values,
+      })),
+    ).toContainEqual(
+      expect.objectContaining({
+        text: expect.stringContaining("communicationThreadId' IS NULL"),
+        values: expect.arrayContaining(['report-root']),
+      }),
+    );
+    expect(sqlMock.mock.calls.flatMap((call) => call.slice(1))).toContainEqual(
+      expect.stringContaining(
+        '"communicationThreadId":"automation-thread-1","discordTaskThread":true',
+      ),
+    );
+  });
+
   it('attaches to the investigating opener when only a root message id is present', async () => {
     const response = await maybeSendCommunicationThreadReply({
       taskRun: {
diff --git a/apps/api/src/handlers/mcp/communication-thread-replies.ts b/apps/api/src/handlers/mcp/communication-thread-replies.ts
index 399b3eacf..a3c5de2bd 100644
--- a/apps/api/src/handlers/mcp/communication-thread-replies.ts
+++ b/apps/api/src/handlers/mcp/communication-thread-replies.ts
@@ -237,6 +237,15 @@ async function bindLateCommunicationReportThread(params: {
           }
         : {}),
   });
+  const unboundReportCondition = discordThread
+    ? sql`(
+        ${taskRuns.payload}->>'communicationMessageId' IS NULL
+        OR (
+          ${taskRuns.payload}->>'communicationMessageId' = ${params.messageId}
+          AND ${taskRuns.payload}->>'communicationThreadId' IS NULL
+        )
+      )`
+    : sql`${taskRuns.payload}->>'communicationMessageId' IS NULL`;
   await db.transaction(async (tx) => {
     const boundRuns = await tx
       .update(taskRuns)
@@ -244,10 +253,7 @@ async function bindLateCommunicationReportThread(params: {
         payload: sql`coalesce(${taskRuns.payload}, '{}'::jsonb) || ${patch}::jsonb`,
       })
       .where(
-        and(
-          eq(taskRuns.taskId, params.taskRun.taskId),
-          sql`${taskRuns.payload}->>'communicationMessageId' IS NULL`,
-        ),
+        and(eq(taskRuns.taskId, params.taskRun.taskId), unboundReportCondition),
       )
       .returning({ id: taskRuns.id });
 
@@ -695,8 +701,8 @@ async function sendDiscordThreadReply(params: {
   await bindLateCommunicationReportThread({
     taskRun: params.taskRun,
     provider: 'discord',
-    messageId: reply.messageId,
-    ...(!threadId && !messageId
+    messageId: messageId ?? reply.messageId,
+    ...(!threadId
       ? {
           discordProvider: provider,
           ...(text ? { discordThreadName: text } : {}),
diff --git a/apps/preview-proxy/src/handlers/__tests__/auto-resume.test.ts b/apps/preview-proxy/src/handlers/__tests__/auto-resume.test.ts
index 9488ecad6..399e46858 100644
--- a/apps/preview-proxy/src/handlers/__tests__/auto-resume.test.ts
+++ b/apps/preview-proxy/src/handlers/__tests__/auto-resume.test.ts
@@ -138,4 +138,43 @@ describe('triggerAutoResume', () => {
       }),
     );
   });
+
+  it('preserves Discord reply context when creating a snapshot resume run', async () => {
+    const resolution = createMockResolvedRequest({
+      status: 'resumable',
+      snapshotId: 'snap-preview-discord',
+      taskRun: {
+        ...createMockTaskRun({
+          id: 44,
+          payload: {
+            repo: 'owner/repo',
+            communicationProvider: 'discord',
+            communicationChannelId: 'channel-1',
+            communicationThreadId: 'thread-1',
+            communicationMessageId: 'message-1',
+          },
+        }),
+        port: 3000,
+      },
+    });
+
+    await triggerAutoResume(resolution, {
+      userId: 'viewer-user',
+      tokenType: 'pt',
+      version: 1,
+    });
+
+    expect(mockEnqueueTask).toHaveBeenCalledWith(
+      expect.objectContaining({
+        task: expect.objectContaining({
+          payload: expect.objectContaining({
+            communicationProvider: 'discord',
+            communicationChannelId: 'channel-1',
+            communicationThreadId: 'thread-1',
+            communicationMessageId: 'message-1',
+          }),
+        }),
+      }),
+    );
+  });
 });
diff --git a/apps/preview-proxy/src/handlers/auto-resume.ts b/apps/preview-proxy/src/handlers/auto-resume.ts
index a0327ee2b..cc8e08c51 100644
--- a/apps/preview-proxy/src/handlers/auto-resume.ts
+++ b/apps/preview-proxy/src/handlers/auto-resume.ts
@@ -2,6 +2,7 @@ import {
   type TaskPayload,
   TaskPayloadKind,
   activeRunStatuses,
+  populateSnapshotResumeCommunicationMetadata,
   populateSnapshotResumeSlackMetadata,
   restoreSnapshotResumeVisiblePromptFields,
   type PreviewTokenContext,
@@ -111,6 +112,9 @@ export async function triggerAutoResume(
     populateSnapshotResumeSlackMetadata(payload, {
       sourcePayload: taskRun.payload,
     });
+    populateSnapshotResumeCommunicationMetadata(payload, {
+      sourcePayload: taskRun.payload,
+    });
     restoreSnapshotResumeVisiblePromptFields(payload, sourcePayload);
 
     // Resumes never create tasks and carry no initiator; the resuming human
diff --git a/apps/web/src/trpc/commands/snapshots/index.ts b/apps/web/src/trpc/commands/snapshots/index.ts
index cb20ba581..f1ed630c7 100644
--- a/apps/web/src/trpc/commands/snapshots/index.ts
+++ b/apps/web/src/trpc/commands/snapshots/index.ts
@@ -4,6 +4,7 @@ import {
   runningRunStatuses,
   TaskPayloadKind,
   ORPHANED_PENDING_THRESHOLD_MS,
+  populateSnapshotResumeCommunicationMetadata,
   populateSnapshotResumeSlackMetadata,
   EXPIRED_SNAPSHOT_RESUME_ERROR,
   isTaskResumeCapableComputeProvider,
@@ -494,6 +495,9 @@ export async function restoreTaskRunSnapshotCommand(
       sourcePayload,
       threadTs: sourceTask.slackThreadTs,
     });
+    populateSnapshotResumeCommunicationMetadata(payload, {
+      sourcePayload,
+    });
 
     await inheritSnapshotResumeVisiblePromptFields(
       payload,

From 40b0c7c446eea253f3efffa6de94e966c6319a8a Mon Sep 17 00:00:00 2001
From: "roomote-roomote[bot]"
 <301996811+roomote-roomote[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 10:49:16 +0100
Subject: [PATCH 02/24] [Improve] Add personal settings shortcut to user menu
 (#1019)

* feat: add personal settings shortcut to user menu

* fix: close user menu after settings navigation

---------

Co-authored-by: Roomote <roomote@roomote.dev>
---
 apps/web/src/app/(centered)/layout.tsx        |  2 +-
 .../(onboarding)/setup/SetupLayoutClient.tsx  |  1 +
 .../layout/UserMenu.client.test.tsx           | 87 +++++++++++++++++++
 apps/web/src/components/layout/UserMenu.tsx   | 24 ++++-
 4 files changed, 110 insertions(+), 4 deletions(-)
 create mode 100644 apps/web/src/components/layout/UserMenu.client.test.tsx

diff --git a/apps/web/src/app/(centered)/layout.tsx b/apps/web/src/app/(centered)/layout.tsx
index faaea15d3..6c0cce9e5 100644
--- a/apps/web/src/app/(centered)/layout.tsx
+++ b/apps/web/src/app/(centered)/layout.tsx
@@ -36,7 +36,7 @@ export default function OnboardingLayout({
       surfaceClassName="relative flex items-center justify-center"
     >
       <div className="absolute top-8 right-8 flex items-center gap-2 animate-enter-down">
-        <UserMenu />
+        <UserMenu showPersonalSettings={!redirect.startsWith('/setup')} />
       </div>
       <div className="flex flex-col gap-8">{children}</div>
     </FramedSurface>
diff --git a/apps/web/src/app/(onboarding)/setup/SetupLayoutClient.tsx b/apps/web/src/app/(onboarding)/setup/SetupLayoutClient.tsx
index d1d42f39b..d32fdd091 100644
--- a/apps/web/src/app/(onboarding)/setup/SetupLayoutClient.tsx
+++ b/apps/web/src/app/(onboarding)/setup/SetupLayoutClient.tsx
@@ -88,6 +88,7 @@ export function SetupLayoutClient({ children }: { children: React.ReactNode }) {
                 <UserMenu
                   portalContainer={userMenuPortalContainer}
                   menuSide="top"
+                  showPersonalSettings={false}
                 />
               </div>
             </>
diff --git a/apps/web/src/components/layout/UserMenu.client.test.tsx b/apps/web/src/components/layout/UserMenu.client.test.tsx
new file mode 100644
index 000000000..07c300b1b
--- /dev/null
+++ b/apps/web/src/components/layout/UserMenu.client.test.tsx
@@ -0,0 +1,87 @@
+import type { ButtonHTMLAttributes, ReactNode } from 'react';
+import { render, screen } from '@testing-library/react';
+
+const { useQueryMock } = vi.hoisted(() => ({
+  useQueryMock: vi.fn(),
+}));
+
+vi.mock('@tanstack/react-query', () => ({
+  useQuery: useQueryMock,
+}));
+
+vi.mock('@/components/system', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/components/system')>();
+
+  return {
+    ...actual,
+    DropdownMenu: ({ children }: { children: ReactNode }) => <>{children}</>,
+    DropdownMenuContent: ({ children }: { children: ReactNode }) => (
+      <div>{children}</div>
+    ),
+    DropdownMenuItem: ({ children }: { children: ReactNode }) => (
+      <div data-slot="dropdown-menu-item">{children}</div>
+    ),
+    DropdownMenuSeparator: () => <hr />,
+    DropdownMenuTrigger: ({
+      children,
+      ...props
+    }: ButtonHTMLAttributes<HTMLButtonElement> & { children: ReactNode }) => (
+      <button type="button" {...props}>
+        {children}
+      </button>
+    ),
+  };
+});
+
+vi.mock('@/hooks/useUser', () => ({
+  useUser: () => ({
+    isSignedIn: true,
+    user: {
+      name: 'Ada Lovelace',
+      primaryEmail: 'ada@example.com',
+      resource: {
+        imageUrl: null,
+        primaryEmailAddress: { emailAddress: 'ada@example.com' },
+      },
+    },
+  }),
+}));
+
+vi.mock('@/trpc/client', () => ({
+  useTRPC: () => ({
+    releases: {
+      status: {
+        queryOptions: vi.fn(() => ({ queryKey: ['releases.status'] })),
+      },
+    },
+  }),
+}));
+
+import { UserMenu } from './UserMenu';
+
+describe('UserMenu', () => {
+  beforeEach(() => {
+    useQueryMock.mockReturnValue({ data: null });
+  });
+
+  it('links to personal settings from the user summary', () => {
+    render(<UserMenu />);
+
+    const settingsLink = screen.getByRole('link', {
+      name: 'Personal settings',
+    });
+
+    expect(settingsLink).toHaveAttribute('href', '/settings/personal');
+    expect(
+      settingsLink.closest('[data-slot="dropdown-menu-item"]'),
+    ).toBeInTheDocument();
+  });
+
+  it('hides personal settings while setup is incomplete', () => {
+    render(<UserMenu showPersonalSettings={false} />);
+
+    expect(
+      screen.queryByRole('link', { name: 'Personal settings' }),
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/apps/web/src/components/layout/UserMenu.tsx b/apps/web/src/components/layout/UserMenu.tsx
index f355b353e..6f21bb0a9 100644
--- a/apps/web/src/components/layout/UserMenu.tsx
+++ b/apps/web/src/components/layout/UserMenu.tsx
@@ -2,6 +2,8 @@
 
 import { useState } from 'react';
 import { useQuery } from '@tanstack/react-query';
+import Link from 'next/link';
+import Image from 'next/image';
 
 import {
   Avatar,
@@ -15,6 +17,7 @@ import {
   ExternalLink,
   Info,
   LogOut,
+  Settings,
 } from '@/components/system';
 
 import { useUser } from '@/hooks/useUser';
@@ -22,6 +25,7 @@ import { authClient } from '@/lib/auth-client';
 import { DOCS_BASE_URL } from '@/lib/docs';
 import { isParsableProductVersion, toReleaseTag } from '@/lib/product-version';
 import { GITHUB_RELEASES_BASE_URL } from '@/lib/release-links';
+import { SETTINGS_PATHS } from '@/lib/settings';
 import { PERSONAL_THEME_STORAGE_KEY } from '@/types/preferences';
 import { cn } from '@/lib/utils';
 import { useTRPC } from '@/trpc/client';
@@ -33,17 +37,18 @@ import {
   DropdownMenuSeparator,
   DropdownMenuTrigger,
 } from '@/components/system';
-import Image from 'next/image';
 
 export const UserMenu = ({
   portalContainer,
   expanded = false,
   menuSide = 'left',
+  showPersonalSettings = true,
   switchOrgRedirectPath,
 }: {
   portalContainer?: HTMLElement | null;
   expanded?: boolean;
   menuSide?: 'top' | 'right' | 'bottom' | 'left';
+  showPersonalSettings?: boolean;
   switchOrgRedirectPath?: string;
 } = {}) => {
   const { isSignedIn, user } = useUser();
@@ -57,6 +62,7 @@ export const UserMenu = ({
       expanded={expanded}
       menuSide={menuSide}
       portalContainer={portalContainer}
+      showPersonalSettings={showPersonalSettings}
       switchOrgRedirectPath={switchOrgRedirectPath}
       user={user}
     />
@@ -67,11 +73,13 @@ function SignedInUserMenu({
   portalContainer,
   expanded,
   menuSide,
+  showPersonalSettings,
   user,
 }: {
   portalContainer?: HTMLElement | null;
   expanded: boolean;
   menuSide: 'top' | 'right' | 'bottom' | 'left';
+  showPersonalSettings: boolean;
   switchOrgRedirectPath?: string;
   user: NonNullable<ReturnType<typeof useUser>['user']>;
 }) {
@@ -140,8 +148,8 @@ function SignedInUserMenu({
               size="md"
               alt={userDisplayName}
             />
-            <div className="flex flex-1 items-start justify-between">
-              <div className="flex flex-col items-start">
+            <div className="flex min-w-0 flex-1 items-start justify-between gap-2">
+              <div className="flex min-w-0 flex-col items-start">
                 <div className="text-sm font-medium whitespace-nowrap ph-no-capture">
                   {userDisplayName}
                 </div>
@@ -149,6 +157,16 @@ function SignedInUserMenu({
                   {userEmail}
                 </div>
               </div>
+              {showPersonalSettings ? (
+                <DropdownMenuItem asChild className="size-8 justify-center p-0">
+                  <Link
+                    href={SETTINGS_PATHS.personal}
+                    aria-label="Personal settings"
+                  >
+                    <Settings />
+                  </Link>
+                </DropdownMenuItem>
+              ) : null}
             </div>
           </div>
 

From 9c5e488f3025347c8d64b4961f3c490d822c5fd8 Mon Sep 17 00:00:00 2001
From: "roomote-roomote[bot]"
 <301996811+roomote-roomote[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 10:55:50 +0100
Subject: [PATCH 03/24] [Improve] Rework Automations settings experience
 (#1020)

* feat: rework automations settings UX

* improve: refine automation card details

---------

Co-authored-by: Roomote <roomote@roomote.dev>
---
 apps/docs/automations.mdx                     |   20 +-
 ...AutomationsSettings.render.client.test.tsx |  239 ++-
 .../automations/AutomationsSettings.tsx       | 1683 ++++++++---------
 .../automations/CustomAutomationsSection.tsx  |  388 ++--
 .../src/components/system/primitives/icons.ts |    1 +
 5 files changed, 1236 insertions(+), 1095 deletions(-)

diff --git a/apps/docs/automations.mdx b/apps/docs/automations.mdx
index eeff3f4bd..185bc476a 100644
--- a/apps/docs/automations.mdx
+++ b/apps/docs/automations.mdx
@@ -78,11 +78,9 @@ Create arbitrary scheduled agent runs with:
 
 Admins can also choose **Custom schedule** and enter either a standard
 five-field cron expression or a natural-language schedule such as “weekdays at
-9am.” Roomote previews the interpreted schedule before saving. A schedule that
-names a day but no time runs at 3am local, matching the daily and weekly
-cadences, and Roomote asks for clarification rather than guessing when the
-recurrence itself is ambiguous. Custom schedules do not support seconds or
-cron macros.
+9am.” Roomote previews the interpreted schedule before saving and asks for
+clarification rather than guessing when the recurrence itself is ambiguous.
+Custom schedules do not support seconds or cron macros.
 
 On each due tick, Roomote launches a normal task with that prompt in that
 environment. When a report destination is set, the run is anchored to that
@@ -93,9 +91,7 @@ chatter in between. Without a destination, the run happens silently and its
 results appear only in the task view. Use **Run now** on an enabled
 automation to test it immediately.
 
-Daily and weekly custom automations use the same local-hour window as the
-other scheduled automations (around 3am in the workspace timezone). Cap is
-25 custom automations per deployment.
+The deployment cap is 25 custom automations.
 
 The **Scheduling timezone** setting is available on both the Automations and
 Deployment settings pages. It applies to all scheduled automations and to
@@ -179,10 +175,10 @@ runs) and posts digests there. You cannot pick an existing Telegram thread —
 Roomote owns the recurring topic. When you select Teams, digests go to the
 primary Teams conversation captured for the deployment.
 
-Cards also show capability badges for what each automation supports today:
-the chat surfaces it can report to and the source-control providers it works
-with. Triage Dependabot Alerts and Triage CodeQL Alerts are GitHub-only by
-nature. CI Failure Triage supports GitHub Actions, GitLab Pipelines, Azure
+Cards also show a plain provider-support line for what each automation supports
+today: the chat surfaces it can report to and the source-control providers it
+works with. Triage Dependabot Alerts and Triage CodeQL Alerts are GitHub-only
+by nature. CI Failure Triage supports GitHub Actions, GitLab Pipelines, Azure
 DevOps builds, Bitbucket Pipelines, and Gitea Actions. Triage Issues supports GitHub, GitLab,
 and Gitea issues.
 Security Auditor, Code Quality Auditor, Weekly Manager
diff --git a/apps/web/src/components/settings/automations/AutomationsSettings.render.client.test.tsx b/apps/web/src/components/settings/automations/AutomationsSettings.render.client.test.tsx
index 8a417aeb1..18219b032 100644
--- a/apps/web/src/components/settings/automations/AutomationsSettings.render.client.test.tsx
+++ b/apps/web/src/components/settings/automations/AutomationsSettings.render.client.test.tsx
@@ -1,9 +1,39 @@
 import type { ReactNode } from 'react';
-import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import {
+  act,
+  fireEvent,
+  render,
+  screen,
+  waitFor,
+} from '@testing-library/react';
 const managerInstructionsPlaceholder =
   /Optional guidance for which ideas to prioritize or avoid/;
 
 const state = vi.hoisted(() => ({
+  customAutomations: [] as Array<{
+    id: string;
+    name: string;
+    prompt: string;
+    enabled: boolean;
+    scheduleMode: 'weekly';
+    cronExpression: null;
+    model: null;
+    environmentId: string;
+    target: {
+      provider: 'slack';
+      externalRef: string;
+      metadata?: Record<string, unknown>;
+    };
+    lastRunAt: null;
+    lastSucceededAt: null;
+    lastFailedAt: null;
+    lastError: null;
+    lastLaunchedTaskId: null;
+    createdByName: string;
+    createdAt: Date;
+    updatedAt: Date;
+  }>,
+  environments: [] as Array<{ id: string; name: string }>,
   nextUpdateSettingsResult: null as {
     success: true;
     settings: Record<string, unknown>;
@@ -254,7 +284,7 @@ vi.mock('@tanstack/react-query', () => ({
     }
 
     if (key1 === 'listCustomAutomations') {
-      return { isPending: false, data: [] };
+      return { isPending: false, data: state.customAutomations };
     }
 
     if (queryOptions.queryKey?.[0] === 'taskModels') {
@@ -314,7 +344,7 @@ vi.mock('@tanstack/react-query', () => ({
     ) {
       // environments.list and any leftover channel listszheimer
       if (queryOptions.queryKey?.[0] === 'environments') {
-        return { isPending: false, data: [] };
+        return { isPending: false, data: state.environments };
       }
     }
 
@@ -436,16 +466,24 @@ import { AutomationsSettings } from './AutomationsSettings';
 
 async function openSuggesterCard() {
   fireEvent.click(
-    await screen.findByRole('button', { name: 'Expand Suggest Ideas' }),
+    await screen.findByRole('button', {
+      name: /(?:Set up|Configure) Suggest Ideas/,
+    }),
   );
 }
 
 async function openReviewerCard() {
   fireEvent.click(
-    await screen.findByRole('button', { name: 'Expand Review Code' }),
+    await screen.findByRole('button', {
+      name: /(?:Set up|Configure) Review Code/,
+    }),
   );
 }
 
+function closeAutomationDialog() {
+  fireEvent.click(screen.getByRole('button', { name: 'Close' }));
+}
+
 describe('AutomationsSettings', () => {
   beforeEach(() => {
     vi.clearAllMocks();
@@ -459,8 +497,17 @@ describe('AutomationsSettings', () => {
     state.settingsQuery.data.settings.announcerDiscordChannelId = null;
     state.settingsQuery.data.settings.platformIssueDiscordChannelId = null;
     state.settingsQuery.data.settings.managerSlackChannelId = 'C123MANAGER';
+    state.settingsQuery.data.slackChannelDisplayNames.managerSlackChannel =
+      '#roomote-managers';
     state.settingsQuery.data.settings.managerDiscordChannelId = null;
     state.settingsQuery.data.settings.managerStatsFrequency = 'off' as never;
+    state.settingsQuery.data.settings.channelAutoStartSlackChannels = [
+      {
+        channelId: 'C123BUGS',
+        instructions: 'Treat each message as a bug report.',
+        launchMode: 'always_start' as const,
+      },
+    ];
     state.settingsQuery.data.settings.sentryTriageFrequency = 'off' as never;
     state.settingsQuery.data.settings.dependabotTriageFrequency =
       'off' as never;
@@ -474,6 +521,8 @@ describe('AutomationsSettings', () => {
     state.settingsQuery.data.settings.reviewCodeInstructions = null;
     state.settingsQuery.data.reviewer.relayReviewResultsToTask = false;
     state.settingsQuery.data.reviewer.relayUsers = [];
+    state.customAutomations = [];
+    state.environments = [];
     for (const key of Object.keys(
       state.settingsQuery.data.resolvedDestinations,
     )) {
@@ -493,7 +542,7 @@ describe('AutomationsSettings', () => {
 
     expect(
       await screen.findByRole('button', {
-        name: 'Expand Weekly Manager Stats',
+        name: /(?:Set up|Configure) Weekly Manager Stats/,
       }),
     ).toBeInTheDocument();
     expect(screen.queryByText('Beta')).not.toBeInTheDocument();
@@ -529,30 +578,38 @@ describe('AutomationsSettings', () => {
 
     fireEvent.click(
       await screen.findByRole('button', {
-        name: 'Expand Weekly Manager Stats',
+        name: /(?:Set up|Configure) Weekly Manager Stats/,
       }),
     );
+    expect(
+      screen.getByLabelText('Post summaries to this Slack channel'),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText('Reports to: not configured — set a Manager Channel.'),
+    ).toBeInTheDocument();
+    closeAutomationDialog();
     fireEvent.click(
-      screen.getByRole('button', { name: 'Expand Triage Sentry Issues' }),
+      screen.getByRole('button', {
+        name: /(?:Set up|Configure) Triage Sentry Issues/,
+      }),
     );
+    expect(
+      screen.getByLabelText('Post follow-up work to this Slack channel'),
+    ).toBeInTheDocument();
+    closeAutomationDialog();
     fireEvent.click(
-      screen.getByRole('button', { name: 'Expand Triage Dependabot Alerts' }),
+      screen.getByRole('button', {
+        name: /(?:Set up|Configure) Triage Dependabot Alerts/,
+      }),
     );
 
     expect(
-      screen.getByLabelText('Post summaries to this Slack channel'),
+      screen.getByLabelText('Post follow-up work to this Slack channel'),
     ).toBeInTheDocument();
+    expect(screen.getByText('Select a Slack channel')).toBeInTheDocument();
     expect(
-      screen.getAllByLabelText('Post follow-up work to this Slack channel')
-        .length,
-    ).toBeGreaterThan(1);
-    expect(
-      screen.getAllByText('Select a Slack channel').length,
-    ).toBeGreaterThan(0);
-    expect(
-      screen.getAllByText('Reports to: not configured — set a Manager Channel.')
-        .length,
-    ).toBeGreaterThan(1);
+      screen.getByText('Reports to: not configured — set a Manager Channel.'),
+    ).toBeInTheDocument();
   });
 
   it('shows a saved Discord destination and a provider-neutral placeholder when Discord is connected', async () => {
@@ -576,19 +633,22 @@ describe('AutomationsSettings', () => {
 
     fireEvent.click(
       await screen.findByRole('button', {
-        name: 'Expand Weekly Manager Stats',
+        name: /(?:Set up|Configure) Weekly Manager Stats/,
       }),
     );
+    expect(
+      screen.getByText('#automation-reports (Discord)'),
+    ).toBeInTheDocument();
+    closeAutomationDialog();
     fireEvent.click(
-      screen.getByRole('button', { name: 'Expand Triage Sentry Issues' }),
+      screen.getByRole('button', {
+        name: /(?:Set up|Configure) Triage Sentry Issues/,
+      }),
     );
 
     // The saved Discord channel is the selected destination.
-    expect(
-      screen.getByText('#automation-reports (Discord)'),
-    ).toBeInTheDocument();
     // Pickers without a saved value use the provider-neutral placeholder.
-    expect(screen.getAllByText('Select a channel').length).toBeGreaterThan(0);
+    expect(screen.getByText('Select a channel')).toBeInTheDocument();
     expect(
       screen.queryByText('Select a Slack channel'),
     ).not.toBeInTheDocument();
@@ -611,6 +671,11 @@ describe('AutomationsSettings', () => {
 
     render(<AutomationsSettings />);
 
+    fireEvent.click(
+      await screen.findByRole('button', {
+        name: /(?:Set up|Configure) Automation output/,
+      }),
+    );
     const destination = await screen.findByRole('button', {
       name: /#automation-reports \(Discord\)/,
     });
@@ -642,7 +707,7 @@ describe('AutomationsSettings', () => {
 
     fireEvent.click(
       await screen.findByRole('button', {
-        name: 'Expand Alert on Config Errors',
+        name: /(?:Set up|Configure) Alert on Config Errors/,
       }),
     );
 
@@ -658,7 +723,7 @@ describe('AutomationsSettings', () => {
     render(<AutomationsSettings />);
 
     const expandButton = await screen.findByRole('button', {
-      name: 'Expand Auto-respond to channels',
+      name: /(?:Set up|Configure) Auto-respond to channels/,
     });
     fireEvent.click(expandButton);
 
@@ -693,43 +758,105 @@ describe('AutomationsSettings', () => {
     ).toBeInTheDocument();
   });
 
-  it('shows exception-only capability badges from the shared descriptors', async () => {
+  it('shows provider support as plain text instead of badges', async () => {
+    render(<AutomationsSettings />);
+
+    await screen.findByText('Triage Dependabot Alerts');
+    const providerSupport = screen.getAllByText('GitHub only')[0]!;
+    expect(providerSupport.tagName).toBe('P');
+    expect(providerSupport).toHaveClass('text-sm', 'text-foreground');
+  });
+
+  it('groups built-in automations into Enabled and Available sections', async () => {
+    render(<AutomationsSettings />);
+
+    expect(await screen.findByText('Enabled')).toBeInTheDocument();
+    expect(screen.getByText('Available')).toBeInTheDocument();
+    expect(screen.queryByText('Source Code automations')).toBeNull();
+    expect(screen.queryByText('Meta automations')).toBeNull();
+  });
+
+  it('uses plain text empty states for built-in and custom automations', async () => {
+    state.settingsQuery.data.settings.channelAutoStartSlackChannels = [];
+    state.settingsQuery.data.settings.managerSlackChannelId = null as never;
+    state.settingsQuery.data.slackChannelDisplayNames.managerSlackChannel =
+      null as never;
+
+    render(<AutomationsSettings />);
+
+    const builtInEmptyState = await screen.findByText(
+      'No built-in automations enabled yet.',
+    );
+    expect(builtInEmptyState.tagName).toBe('P');
+    expect(builtInEmptyState).toHaveClass('text-sm', 'text-muted-foreground');
+    const customEmptyState = screen.getByText(
+      'No custom automations created yet.',
+    );
+    expect(customEmptyState.tagName).toBe('P');
+    expect(customEmptyState).toHaveClass('text-sm', 'text-muted-foreground');
+  });
+
+  it('opens a built-in automation modal from its existing hash permalink', async () => {
+    window.location.hash = '#reviewer';
+
     render(<AutomationsSettings />);
 
-    // Dependabot and CodeQL stay GitHub-only; Issue Fixer supports
-    // GitHub/GitLab/Gitea, and manager stats is provider-neutral now and
-    // shows no source-control badge.
-    expect((await screen.findAllByText('GitHub only')).length).toBe(2);
-    // Full chat coverage for the suggester (no limited-comms badge); the other
-    // manager automations already cover all communication providers.
-    expect(screen.queryByText('Slack only')).toBeNull();
-    expect(screen.queryByText('Slack · Discord · Telegram only')).toBeNull();
-    expect(screen.queryByText(/Telegram only$/)).toBeNull();
-    // conflict_resolver supports Gitea alongside GitHub, GitLab, and Azure
-    // DevOps. Bitbucket remains excluded because it has no conflict signal or
-    // label-based opt-in. ci_failure_triage covers all five SCM providers, so
-    // it no longer shows a limited-SCM badge.
-    expect(
-      screen.getAllByText('GitHub · GitLab · Azure DevOps · Gitea only').length,
-    ).toBe(1);
     expect(
-      screen.queryByText(
-        'GitHub · GitLab · Azure DevOps · Bitbucket Cloud only',
-      ),
-    ).toBeNull();
-    // Full coverage shows nothing — absence of a warning is the signal.
-    expect(screen.queryByText('All chat channels')).toBeNull();
-    expect(screen.queryByText('All source control')).toBeNull();
+      await screen.findByRole('dialog', { name: 'Review Code' }),
+    ).toBeInTheDocument();
   });
 
-  it('renders the Source Code and Meta automation sections', async () => {
+  it('renders custom automations as a compact control list and honors their permalinks', async () => {
+    state.environments = [{ id: 'env-1', name: 'Production' }];
+    state.customAutomations = [
+      {
+        id: 'automation-1',
+        name: 'Weekly flaky-test scan',
+        prompt: 'Find flaky tests.',
+        enabled: true,
+        scheduleMode: 'weekly',
+        cronExpression: null,
+        model: null,
+        environmentId: 'env-1',
+        target: { provider: 'slack', externalRef: 'C123MANAGER' },
+        lastRunAt: null,
+        lastSucceededAt: null,
+        lastFailedAt: null,
+        lastError: null,
+        lastLaunchedTaskId: null,
+        createdByName: 'Ada',
+        createdAt: new Date('2026-01-01T00:00:00Z'),
+        updatedAt: new Date('2026-01-01T00:00:00Z'),
+      },
+    ];
     render(<AutomationsSettings />);
 
     expect(
-      await screen.findByText('Source Code automations'),
+      await screen.findByRole('switch', {
+        name: 'Toggle Weekly flaky-test scan',
+      }),
+    ).toBeChecked();
+    expect(
+      screen.getByText(
+        'Weekly · Production · slack:#roomote-managers · Created by Ada',
+      ),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole('button', {
+        name: 'Configure Weekly flaky-test scan',
+      }),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole('button', { name: 'Delete Weekly flaky-test scan' }),
+    ).toBeInTheDocument();
+
+    act(() => {
+      window.location.hash = '#custom-automation-automation-1';
+      window.dispatchEvent(new HashChangeEvent('hashchange'));
+    });
+    expect(
+      await screen.findByRole('dialog', { name: 'Edit custom automation' }),
     ).toBeInTheDocument();
-    expect(screen.getByText('Meta automations')).toBeInTheDocument();
-    expect(screen.queryByText('Other automations')).toBeNull();
   });
 
   it('reflects the reviewer all-author setting in the review scope copy', async () => {
diff --git a/apps/web/src/components/settings/automations/AutomationsSettings.tsx b/apps/web/src/components/settings/automations/AutomationsSettings.tsx
index 3fcc30d10..da31d3ca0 100644
--- a/apps/web/src/components/settings/automations/AutomationsSettings.tsx
+++ b/apps/web/src/components/settings/automations/AutomationsSettings.tsx
@@ -71,21 +71,20 @@ import {
   AlertCircle,
   AlertDescription,
   AlertTitle,
-  Badge,
   BasicTooltip,
   BellElectric,
   BrandIcon,
   Button,
   Card,
-  CardContent,
   CardHeader,
   CardTitle,
   ChartColumnIncreasing,
   Check,
-  ChevronRight,
-  Collapsible,
-  CollapsibleContent,
-  CollapsibleTrigger,
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
   GitMergeConflict,
   GitPullRequest,
   Info,
@@ -94,6 +93,7 @@ import {
   Lightbulb,
   Megaphone,
   Play,
+  Plus,
   RefreshCcw,
   Select,
   SelectContent,
@@ -106,6 +106,7 @@ import {
   SquarePen,
   Slack,
   Spinner,
+  Settings2,
   Switch,
   Textarea,
   TriangleAlert,
@@ -532,6 +533,12 @@ const AUTOMATION_DEFINITIONS: Record<AutomationId, AutomationDefinition> = {
 };
 
 const HASH_ALIAS_TO_AUTOMATION_ID: Record<string, AutomationId> = {
+  ...Object.fromEntries(
+    Object.keys(AUTOMATION_DEFINITIONS).map((automationId) => [
+      automationId.toLowerCase(),
+      automationId,
+    ]),
+  ),
   'auto-respond-channels': 'channelAutoStart',
   autorespondchannels: 'channelAutoStart',
   'auto-start-tasks': 'channelAutoStart',
@@ -1447,25 +1454,59 @@ function AutomationCard({
 }) {
   const Icon = automation.icon;
   const open = !disabled && (alwaysOpen || isOpen);
-  const content = (
-    <>
-      <CardContent className="space-y-4 pl-4 pt-5 md:pl-8">
-        {children}
-        {debugSection}
-      </CardContent>
-      {footer ? (
-        <div className="flex items-center md:pl-8 mt-4">{footer}</div>
-      ) : null}
-    </>
-  );
+  const actionLabel = iconEnabled
+    ? `Configure ${automation.label}`
+    : `Set up ${automation.label}`;
 
   return (
     <div
       id={automation.id}
-      className="scroll-mt-24"
+      className={cn('scroll-mt-24', iconEnabled ? 'order-[-20]' : 'order-0')}
       aria-disabled={disabled || undefined}
     >
-      <Collapsible
+      <Card className={cn('h-full gap-3', disabled && 'opacity-50')}>
+        <CardHeader>
+          <div className="flex items-start justify-between gap-3">
+            <div className="flex min-w-0 items-start gap-3">
+              <div className="mt-0.5 flex w-[34px] shrink-0 items-start justify-center">
+                <div className="rounded-xl border border-border/70 bg-muted/30 p-2">
+                  <Icon className="size-5" />
+                </div>
+              </div>
+              <div className="min-w-0 space-y-1">
+                <CardTitle className="text-base">{automation.label}</CardTitle>
+                {automation.commsBadge || automation.scmBadge ? (
+                  <p className="text-sm text-foreground">
+                    {[automation.commsBadge, automation.scmBadge]
+                      .filter(Boolean)
+                      .join(' · ')}
+                  </p>
+                ) : null}
+                <p className="text-sm text-muted-foreground">
+                  {automation.description}
+                </p>
+              </div>
+            </div>
+            <div className="flex shrink-0 items-center gap-1">
+              {runAction && iconEnabled && !disabled ? runAction : null}
+              <BasicTooltip content={actionLabel}>
+                <Button
+                  type="button"
+                  size="icon"
+                  variant="ghost"
+                  aria-label={actionLabel}
+                  disabled={disabled}
+                  onClick={() => onOpenChange(true)}
+                >
+                  {iconEnabled ? <Settings2 /> : <Plus />}
+                </Button>
+              </BasicTooltip>
+            </div>
+          </div>
+        </CardHeader>
+      </Card>
+
+      <Dialog
         open={open}
         onOpenChange={(nextOpen) => {
           if (!disabled) {
@@ -1473,129 +1514,22 @@ function AutomationCard({
           }
         }}
       >
-        <Card
-          className={cn(
-            'gap-0 overflow-hidden px-4 py-4',
-            disabled && 'opacity-50',
-          )}
-        >
-          <CardHeader className="p-0">
-            <div className="flex items-start gap-3">
-              {alwaysOpen ? (
-                <div className="flex items-start gap-2 grow group pl-2">
-                  <Icon
-                    className={cn(
-                      'mt-1 size-5 shrink-0',
-                      iconEnabled
-                        ? 'text-accent-foreground'
-                        : 'text-muted-foreground/50',
-                    )}
-                  />
-                  <div className="min-w-0 flex-1 space-y-1 pr-2">
-                    <CardTitle className="text-base leading-6 group-hover:text-accent-foreground">
-                      <AutomationTitle automation={automation} />
-                    </CardTitle>
-                    <p className="text-sm opacity-60 group-hover:text-accent-foreground">
-                      {automation.description}
-                    </p>
-                  </div>
-                </div>
-              ) : disabled ? (
-                <div className="flex items-start gap-2 grow cursor-not-allowed">
-                  <Button
-                    variant="ghost"
-                    size="icon"
-                    aria-label={`${automation.label} is disabled until a Manager Channel is saved`}
-                    className="mt-0.5 shrink-0"
-                    disabled
-                  >
-                    <ChevronRight />
-                  </Button>
-                  <span className="shrink-0 p-1 -mt-0.5 rounded-full size-8 inline-flex items-center justify-center bg-transparent">
-                    <Icon className="size-5 text-muted-foreground/50" />
-                  </span>
-                  <div className="min-w-0 flex-1 space-y-1 pr-2">
-                    <CardTitle className="text-base leading-6">
-                      <AutomationTitle automation={automation} />
-                    </CardTitle>
-                    <p className="text-sm opacity-60">
-                      {automation.description}
-                    </p>
-                  </div>
-                </div>
-              ) : (
-                <CollapsibleTrigger asChild>
-                  <div className="flex items-start gap-2 cursor-pointer grow group">
-                    <Button
-                      variant="ghost"
-                      size="icon"
-                      aria-label={`${open ? 'Collapse' : 'Expand'} ${automation.label}`}
-                      className="group mt-0.5 shrink-0"
-                    >
-                      <ChevronRight className="transition-transform duration-200 group-data-[state=open]:rotate-90" />
-                    </Button>
-                    <span
-                      className={cn(
-                        'shrink-0 p-1 -mt-0.5 rounded-full size-8 inline-flex items-center justify-center',
-                        iconEnabled ? 'bg-accent-foreground' : 'bg-transparent',
-                      )}
-                    >
-                      <Icon
-                        className={cn(
-                          'size-5',
-                          iconEnabled
-                            ? 'text-black'
-                            : 'text-muted-foreground/50',
-                        )}
-                      />
-                    </span>
-                    <div className="min-w-0 flex-1 space-y-1 pr-2">
-                      <CardTitle className="text-base leading-6 group-hover:text-accent-foreground">
-                        <AutomationTitle automation={automation} />
-                      </CardTitle>
-                      <p className="text-sm opacity-60 group-hover:text-accent-foreground">
-                        {automation.description}
-                      </p>
-                    </div>
-                  </div>
-                </CollapsibleTrigger>
-              )}
-              {runAction && !disabled ? (
-                <div className="shrink-0">{runAction}</div>
-              ) : null}
-            </div>
-          </CardHeader>
-          {alwaysOpen && !disabled ? (
-            content
-          ) : !disabled ? (
-            <CollapsibleContent className="overflow-hidden data-[state=closed]:animate-slideUp data-[state=open]:animate-slideDown">
-              {content}
-            </CollapsibleContent>
-          ) : null}
-        </Card>
-      </Collapsible>
+        <DialogContent size="lg">
+          <DialogHeader>
+            <DialogTitle>{automation.label}</DialogTitle>
+            <DialogDescription>{automation.description}</DialogDescription>
+          </DialogHeader>
+          <div className="space-y-4">
+            {children}
+            {debugSection}
+            {footer ? <div className="flex items-center">{footer}</div> : null}
+          </div>
+        </DialogContent>
+      </Dialog>
     </div>
   );
 }
 
-function AutomationTitle({ automation }: { automation: AutomationDefinition }) {
-  return (
-    <span className="inline-flex flex-wrap items-center gap-2">
-      <span>{automation.label}</span>
-      {automation.commsBadge ? (
-        <Badge variant="outline" className="font-normal text-muted-foreground">
-          {automation.commsBadge}
-        </Badge>
-      ) : null}
-      {automation.scmBadge ? (
-        <Badge variant="outline" className="font-normal text-muted-foreground">
-          {automation.scmBadge}
-        </Badge>
-      ) : null}
-    </span>
-  );
-}
-
 function ScheduledAutomationCard<TFrequency extends string>({
   automation,
   isOpen,
@@ -2116,6 +2050,13 @@ export function AutomationsSettings() {
         }
         return next;
       });
+
+      if (typeof window !== 'undefined') {
+        const nextUrl = open
+          ? `${window.location.pathname}${window.location.search}#${automationId}`
+          : `${window.location.pathname}${window.location.search}`;
+        window.history.replaceState(null, '', nextUrl);
+      }
     },
     [],
   );
@@ -2715,11 +2656,18 @@ export function AutomationsSettings() {
         <LoadingSkeleton />
       ) : (
         <div className="space-y-4">
-          <div className="space-y-3">
-            <h2 className="text-base font-semibold text-foreground">
-              Source Code automations
+          <div className="grid gap-4 md:grid-cols-2">
+            <h2 className="order-[-30] col-span-full text-sm font-semibold text-foreground">
+              Enabled
+            </h2>
+            {Object.values(iconEnabled).some(Boolean) ? null : (
+              <p className="order-[-20] col-span-full text-sm text-muted-foreground">
+                No built-in automations enabled yet.
+              </p>
+            )}
+            <h2 className="order-[-10] col-span-full text-sm font-semibold text-foreground">
+              Available
             </h2>
-
             <AutomationCard
               automation={AUTOMATION_DEFINITIONS.reviewer}
               isOpen={openAutomationIds.has('reviewer')}
@@ -3541,10 +3489,6 @@ export function AutomationsSettings() {
 
             <CustomAutomationsSection />
 
-            <h2 className="pt-2 text-base font-semibold text-foreground">
-              Channel automations
-            </h2>
-
             <AutomationCard
               automation={AUTOMATION_DEFINITIONS.channelAutoStart}
               isOpen={openAutomationIds.has('channelAutoStart')}
@@ -3600,807 +3544,808 @@ export function AutomationsSettings() {
               />
             </AutomationCard>
 
-            <h2 className="pt-2 text-base font-semibold text-foreground">
-              Automations for Roomote Managers
-            </h2>
+            <AutomationCard
+              automation={AUTOMATION_DEFINITIONS.managerChannel}
+              isOpen={openAutomationIds.has('managerChannel')}
+              onOpenChange={(open) => setAutomationOpen('managerChannel', open)}
+              iconEnabled={iconEnabled.managerChannel}
+            >
+              <div className="space-y-2">
+                {showManagerChannelForm ? (
+                  <>
+                    <Label htmlFor="manager-channel">
+                      Where should Roomote post manager-facing updates?
+                    </Label>
+                    <p className="text-sm text-muted-foreground">
+                      Make sure the Roomote app is added to the channel.
+                    </p>
+                    <div className="max-w-md space-y-2">
+                      <div className="flex items-center gap-2">
+                        <Select
+                          value={managerChannelSelectValue}
+                          onValueChange={(value) => {
+                            if (value === CLEAR_MANAGER_CHANNEL_SELECT_VALUE) {
+                              setIsEnteringCustomManagerChannel(false);
+                              setFormState((prev) =>
+                                prev
+                                  ? {
+                                      ...prev,
+                                      managerSlackChannel: '',
+                                      managerDiscordChannel: '',
+                                    }
+                                  : prev,
+                              );
+                              return;
+                            }
+
+                            if (value === CUSTOM_MANAGER_CHANNEL_SELECT_VALUE) {
+                              setIsEnteringCustomManagerChannel(true);
+                              setFormState((prev) =>
+                                prev && selectedManagerChannelOption
+                                  ? {
+                                      ...prev,
+                                      managerSlackChannel: '',
+                                      managerDiscordChannel: '',
+                                    }
+                                  : prev,
+                              );
+                              return;
+                            }
+
+                            if (
+                              value.startsWith(
+                                DISCORD_DESTINATION_OPTION_PREFIX,
+                              )
+                            ) {
+                              setIsEnteringCustomManagerChannel(false);
+                              setFormState((prev) =>
+                                prev
+                                  ? {
+                                      ...prev,
+                                      managerSlackChannel: '',
+                                      managerDiscordChannel: value.slice(
+                                        DISCORD_DESTINATION_OPTION_PREFIX.length,
+                                      ),
+                                    }
+                                  : prev,
+                              );
+                              return;
+                            }
+
+                            const selectedChannel = managerChannelOptions.find(
+                              (channel) => channel.id === value,
+                            );
+
+                            if (!selectedChannel) {
+                              return;
+                            }
 
-            <div id="managerChannel" className="scroll-mt-24 space-y-2 my-8">
-              {showManagerChannelForm ? (
-                <>
-                  <Label htmlFor="manager-channel">
-                    Where should Roomote post manager-facing updates?
-                  </Label>
-                  <p className="text-sm text-muted-foreground">
-                    Make sure the Roomote app is added to the channel.
-                  </p>
-                  <div className="max-w-md space-y-2">
-                    <div className="flex items-center gap-2">
-                      <Select
-                        value={managerChannelSelectValue}
-                        onValueChange={(value) => {
-                          if (value === CLEAR_MANAGER_CHANNEL_SELECT_VALUE) {
                             setIsEnteringCustomManagerChannel(false);
                             setFormState((prev) =>
                               prev
                                 ? {
                                     ...prev,
-                                    managerSlackChannel: '',
+                                    managerSlackChannel: selectedChannel.label,
                                     managerDiscordChannel: '',
                                   }
                                 : prev,
                             );
-                            return;
-                          }
-
-                          if (value === CUSTOM_MANAGER_CHANNEL_SELECT_VALUE) {
+                          }}
+                          disabled={managerChannelSelectionDisabled}
+                        >
+                          <SelectTrigger
+                            id="manager-channel"
+                            aria-label="Select manager channel"
+                            autoFocus={isEditingManagerChannel}
+                            className="w-full"
+                          >
+                            <span className="truncate text-left">
+                              {managerChannelSelectLabel}
+                            </span>
+                          </SelectTrigger>
+                          <SelectContent align="start">
+                            {managerChannelHasValue ? (
+                              <>
+                                <SelectItem
+                                  value={CLEAR_MANAGER_CHANNEL_SELECT_VALUE}
+                                >
+                                  Clear selection
+                                </SelectItem>
+                                <SelectSeparator />
+                              </>
+                            ) : null}
+                            {slackChannelsQuery.isPending ||
+                            discordChannelsQuery.isPending ? (
+                              <SelectItem value="__loading__" disabled>
+                                Loading channels...
+                              </SelectItem>
+                            ) : slackChannelsQuery.isError ||
+                              discordChannelsQuery.isError ? (
+                              <SelectItem value="__error__" disabled>
+                                Could not load channels. Try refreshing.
+                              </SelectItem>
+                            ) : managerChannelOptions.length > 0 ||
+                              managerDiscordChannelOptions.length > 0 ? (
+                              [
+                                ...managerChannelOptions,
+                                ...managerDiscordChannelOptions,
+                              ].map((channel) => (
+                                <SelectItem key={channel.id} value={channel.id}>
+                                  {channel.label}
+                                </SelectItem>
+                              ))
+                            ) : (
+                              <SelectItem value="__empty__" disabled>
+                                No channels found.
+                              </SelectItem>
+                            )}
+                            <SelectSeparator />
+                            <SelectItem
+                              value={CUSTOM_MANAGER_CHANNEL_SELECT_VALUE}
+                            >
+                              Private or manual channel
+                            </SelectItem>
+                          </SelectContent>
+                        </Select>
+                        {managerChannelOptions.length > 0 ||
+                        managerDiscordChannelOptions.length > 0 ? (
+                          <Button
+                            type="button"
+                            variant="ghost"
+                            size="icon"
+                            aria-label="Refresh channels"
+                            title="Refresh channels"
+                            disabled={
+                              (!capabilities?.slackConnected &&
+                                !capabilities?.discordConnected) ||
+                              slackChannelsQuery.isFetching ||
+                              discordChannelsQuery.isFetching
+                            }
+                            onClick={() => {
+                              void Promise.all([
+                                slackChannelsQuery.refetch(),
+                                discordChannelsQuery.refetch(),
+                              ]);
+                            }}
+                          >
+                            <RefreshCcw
+                              className={cn(
+                                (slackChannelsQuery.isFetching ||
+                                  discordChannelsQuery.isFetching) &&
+                                  'animate-spin',
+                              )}
+                            />
+                          </Button>
+                        ) : null}
+                      </div>
+                      {showCustomManagerChannelInput ? (
+                        <Input
+                          value={formState.managerSlackChannel}
+                          onChange={(event) => {
                             setIsEnteringCustomManagerChannel(true);
-                            setFormState((prev) =>
-                              prev && selectedManagerChannelOption
-                                ? {
-                                    ...prev,
-                                    managerSlackChannel: '',
-                                    managerDiscordChannel: '',
-                                  }
-                                : prev,
-                            );
-                            return;
-                          }
-
-                          if (
-                            value.startsWith(DISCORD_DESTINATION_OPTION_PREFIX)
-                          ) {
-                            setIsEnteringCustomManagerChannel(false);
                             setFormState((prev) =>
                               prev
                                 ? {
                                     ...prev,
-                                    managerSlackChannel: '',
-                                    managerDiscordChannel: value.slice(
-                                      DISCORD_DESTINATION_OPTION_PREFIX.length,
-                                    ),
+                                    managerSlackChannel: event.target.value,
+                                    managerDiscordChannel: '',
                                   }
                                 : prev,
                             );
-                            return;
-                          }
-
-                          const selectedChannel = managerChannelOptions.find(
-                            (channel) => channel.id === value,
-                          );
-
-                          if (!selectedChannel) {
-                            return;
+                          }}
+                          placeholder="Enter a private channel name or Slack channel ID"
+                          autoCapitalize="off"
+                          autoCorrect="off"
+                          spellCheck={false}
+                        />
+                      ) : null}
+                    </div>
+                    <p className="text-xs text-muted-foreground">
+                      Private channels may not appear in the list. Use the
+                      manual option to paste a private channel name or raw Slack
+                      channel ID.
+                    </p>
+                    {showManagerSlackChannelWarning ? (
+                      <SlackChannelAccessWarning
+                        slackAppMention={slackAppMention}
+                      />
+                    ) : null}
+                    {fieldErrors.managerSlackChannel ||
+                    fieldErrors.managerDiscordChannel ? (
+                      <p className="text-xs text-destructive">
+                        {fieldErrors.managerSlackChannel ??
+                          fieldErrors.managerDiscordChannel}
+                      </p>
+                    ) : null}
+                    {showManagerChannelMigrationNote ? (
+                      <Alert variant="light">
+                        <AlertDescription>
+                          Some older automations still point at different Slack
+                          channels. Pick the shared Manager Channel here to
+                          migrate future manager-facing posts onto one
+                          destination.
+                        </AlertDescription>
+                      </Alert>
+                    ) : null}
+                    <div className="flex items-center gap-2 pt-2">
+                      <AutomationFooter
+                        isDirty={isDirty.managerChannel}
+                        isPending={
+                          updateMutation.isPending &&
+                          savingAutomation === 'managerChannel'
+                        }
+                        onSave={() => saveAgent('managerChannel')}
+                        onReset={() => {
+                          resetAgent('managerChannel');
+                          if (managerChannelConfigured) {
+                            setIsEditingManagerChannel(false);
                           }
-
-                          setIsEnteringCustomManagerChannel(false);
-                          setFormState((prev) =>
-                            prev
-                              ? {
-                                  ...prev,
-                                  managerSlackChannel: selectedChannel.label,
-                                  managerDiscordChannel: '',
-                                }
-                              : prev,
-                          );
                         }}
-                        disabled={managerChannelSelectionDisabled}
-                      >
-                        <SelectTrigger
-                          id="manager-channel"
-                          aria-label="Select manager channel"
-                          autoFocus={isEditingManagerChannel}
-                          className="w-full"
-                        >
-                          <span className="truncate text-left">
-                            {managerChannelSelectLabel}
-                          </span>
-                        </SelectTrigger>
-                        <SelectContent align="start">
-                          {managerChannelHasValue ? (
-                            <>
-                              <SelectItem
-                                value={CLEAR_MANAGER_CHANNEL_SELECT_VALUE}
-                              >
-                                Clear selection
-                              </SelectItem>
-                              <SelectSeparator />
-                            </>
-                          ) : null}
-                          {slackChannelsQuery.isPending ||
-                          discordChannelsQuery.isPending ? (
-                            <SelectItem value="__loading__" disabled>
-                              Loading channels...
-                            </SelectItem>
-                          ) : slackChannelsQuery.isError ||
-                            discordChannelsQuery.isError ? (
-                            <SelectItem value="__error__" disabled>
-                              Could not load channels. Try refreshing.
-                            </SelectItem>
-                          ) : managerChannelOptions.length > 0 ||
-                            managerDiscordChannelOptions.length > 0 ? (
-                            [
-                              ...managerChannelOptions,
-                              ...managerDiscordChannelOptions,
-                            ].map((channel) => (
-                              <SelectItem key={channel.id} value={channel.id}>
-                                {channel.label}
-                              </SelectItem>
-                            ))
-                          ) : (
-                            <SelectItem value="__empty__" disabled>
-                              No channels found.
-                            </SelectItem>
-                          )}
-                          <SelectSeparator />
-                          <SelectItem
-                            value={CUSTOM_MANAGER_CHANNEL_SELECT_VALUE}
-                          >
-                            Private or manual channel
-                          </SelectItem>
-                        </SelectContent>
-                      </Select>
-                      {managerChannelOptions.length > 0 ||
-                      managerDiscordChannelOptions.length > 0 ? (
+                      />
+                      {managerChannelConfigured &&
+                      isEditingManagerChannel &&
+                      !isDirty.managerChannel ? (
                         <Button
-                          type="button"
-                          variant="ghost"
-                          size="icon"
-                          aria-label="Refresh channels"
-                          title="Refresh channels"
-                          disabled={
-                            (!capabilities?.slackConnected &&
-                              !capabilities?.discordConnected) ||
-                            slackChannelsQuery.isFetching ||
-                            discordChannelsQuery.isFetching
-                          }
-                          onClick={() => {
-                            void Promise.all([
-                              slackChannelsQuery.refetch(),
-                              discordChannelsQuery.refetch(),
-                            ]);
-                          }}
+                          variant="outline"
+                          size="sm"
+                          onClick={() => setIsEditingManagerChannel(false)}
                         >
-                          <RefreshCcw
-                            className={cn(
-                              (slackChannelsQuery.isFetching ||
-                                discordChannelsQuery.isFetching) &&
-                                'animate-spin',
-                            )}
-                          />
+                          Cancel
                         </Button>
                       ) : null}
                     </div>
-                    {showCustomManagerChannelInput ? (
-                      <Input
-                        value={formState.managerSlackChannel}
-                        onChange={(event) => {
-                          setIsEnteringCustomManagerChannel(true);
-                          setFormState((prev) =>
-                            prev
-                              ? {
-                                  ...prev,
-                                  managerSlackChannel: event.target.value,
-                                  managerDiscordChannel: '',
-                                }
-                              : prev,
-                          );
-                        }}
-                        placeholder="Enter a private channel name or Slack channel ID"
-                        autoCapitalize="off"
-                        autoCorrect="off"
-                        spellCheck={false}
-                      />
-                    ) : null}
-                  </div>
-                  <p className="text-xs text-muted-foreground">
-                    Private channels may not appear in the list. Use the manual
-                    option to paste a private channel name or raw Slack channel
-                    ID.
+                  </>
+                ) : (
+                  <p className="text-sm text-muted-foreground">
+                    Posting manager-facing updates to{' '}
+                    <Button
+                      type="button"
+                      variant="link"
+                      className="h-auto p-0 align-baseline text-sm font-normal"
+                      onClick={() => setIsEditingManagerChannel(true)}
+                    >
+                      {savedManagerChannelLabel}
+                      <SquarePen className="size-3.5" />
+                    </Button>
                   </p>
-                  {showManagerSlackChannelWarning ? (
-                    <SlackChannelAccessWarning
-                      slackAppMention={slackAppMention}
-                    />
-                  ) : null}
-                  {fieldErrors.managerSlackChannel ||
-                  fieldErrors.managerDiscordChannel ? (
-                    <p className="text-xs text-destructive">
-                      {fieldErrors.managerSlackChannel ??
-                        fieldErrors.managerDiscordChannel}
-                    </p>
-                  ) : null}
-                  {showManagerChannelMigrationNote ? (
-                    <Alert variant="light">
-                      <AlertDescription>
-                        Some older automations still point at different Slack
-                        channels. Pick the shared Manager Channel here to
-                        migrate future manager-facing posts onto one
-                        destination.
-                      </AlertDescription>
-                    </Alert>
-                  ) : null}
-                  <div className="flex items-center gap-2 pt-2">
-                    <AutomationFooter
-                      isDirty={isDirty.managerChannel}
-                      isPending={
-                        updateMutation.isPending &&
-                        savingAutomation === 'managerChannel'
-                      }
-                      onSave={() => saveAgent('managerChannel')}
-                      onReset={() => {
-                        resetAgent('managerChannel');
-                        if (managerChannelConfigured) {
-                          setIsEditingManagerChannel(false);
-                        }
-                      }}
-                    />
-                    {managerChannelConfigured &&
-                    isEditingManagerChannel &&
-                    !isDirty.managerChannel ? (
-                      <Button
-                        variant="outline"
-                        size="sm"
-                        onClick={() => setIsEditingManagerChannel(false)}
-                      >
-                        Cancel
-                      </Button>
-                    ) : null}
-                  </div>
-                </>
-              ) : (
-                <p className="text-sm text-muted-foreground">
-                  Posting manager-facing updates to{' '}
+                )}
+              </div>
+            </AutomationCard>
+
+            <AutomationCard
+              automation={AUTOMATION_DEFINITIONS.managerStats}
+              isOpen={openAutomationIds.has('managerStats')}
+              onOpenChange={(open) => setAutomationOpen('managerStats', open)}
+              iconEnabled={iconEnabled.managerStats}
+              debugSection={renderDebugRunsSection('managerStats')}
+              runAction={
+                <BasicTooltip
+                  content={getRunTooltip('managerStats', managerStatsIsEnabled)}
+                >
                   <Button
-                    type="button"
-                    variant="link"
-                    className="h-auto p-0 align-baseline text-sm font-normal"
-                    onClick={() => setIsEditingManagerChannel(true)}
+                    variant="ghost"
+                    size="icon"
+                    onClick={() =>
+                      triggerMutation.mutate({ automationKey: 'manager_stats' })
+                    }
+                    disabled={isRunDisabled(
+                      'managerStats',
+                      managerStatsIsEnabled,
+                    )}
                   >
-                    {savedManagerChannelLabel}
-                    <SquarePen className="size-3.5" />
+                    <Play />
                   </Button>
-                </p>
-              )}
-            </div>
-          </div>
-
-          <AutomationCard
-            automation={AUTOMATION_DEFINITIONS.managerStats}
-            isOpen={openAutomationIds.has('managerStats')}
-            onOpenChange={(open) => setAutomationOpen('managerStats', open)}
-            iconEnabled={iconEnabled.managerStats}
-            debugSection={renderDebugRunsSection('managerStats')}
-            runAction={
-              <BasicTooltip
-                content={getRunTooltip('managerStats', managerStatsIsEnabled)}
-              >
-                <Button
-                  variant="ghost"
-                  size="icon"
-                  onClick={() =>
-                    triggerMutation.mutate({ automationKey: 'manager_stats' })
-                  }
-                  disabled={isRunDisabled(
-                    'managerStats',
-                    managerStatsIsEnabled,
-                  )}
-                >
-                  <Play />
-                </Button>
-              </BasicTooltip>
-            }
-            footer={
-              <AutomationFooter
-                isDirty={isDirty.managerStats}
-                isPending={
-                  updateMutation.isPending &&
-                  savingAutomation === 'managerStats'
-                }
-                onSave={() => saveAgent('managerStats')}
-                onReset={() => resetAgent('managerStats')}
-              />
-            }
-          >
-            <div className="space-y-5">
-              <div className="flex items-center gap-2">
-                <Switch
-                  id="manager-stats-enabled"
-                  checked={managerStatsIsEnabled}
-                  onCheckedChange={(enabled) =>
-                    setFormState((prev) =>
-                      prev
-                        ? {
-                            ...prev,
-                            managerStatsFrequency: enabled ? 'weekly' : 'off',
-                          }
-                        : prev,
-                    )
+                </BasicTooltip>
+              }
+              footer={
+                <AutomationFooter
+                  isDirty={isDirty.managerStats}
+                  isPending={
+                    updateMutation.isPending &&
+                    savingAutomation === 'managerStats'
                   }
+                  onSave={() => saveAgent('managerStats')}
+                  onReset={() => resetAgent('managerStats')}
                 />
-                <Label htmlFor="manager-stats-enabled" className="text-sm">
-                  Enabled
-                </Label>
+              }
+            >
+              <div className="space-y-5">
+                <div className="flex items-center gap-2">
+                  <Switch
+                    id="manager-stats-enabled"
+                    checked={managerStatsIsEnabled}
+                    onCheckedChange={(enabled) =>
+                      setFormState((prev) =>
+                        prev
+                          ? {
+                              ...prev,
+                              managerStatsFrequency: enabled ? 'weekly' : 'off',
+                            }
+                          : prev,
+                      )
+                    }
+                  />
+                  <Label htmlFor="manager-stats-enabled" className="text-sm">
+                    Enabled
+                  </Label>
+                </div>
+
+                {managerStatsIsEnabled ? (
+                  <div className="space-y-5">
+                    {renderSlackDestinationField({
+                      field: 'managerStatsSlackChannel',
+                      inputId: 'manager-stats-slack-channel',
+                      label: 'Post summaries to this Slack channel',
+                      helperText:
+                        'Choose where Roomote should post the Friday manager digest.',
+                      savedChannelId:
+                        settingsQuery.data?.settings
+                          .managerStatsSlackChannelId ?? null,
+                      savedDiscordChannelId:
+                        settingsQuery.data?.settings
+                          .managerStatsDiscordChannelId ?? null,
+                      warningChannelId:
+                        slackChannelAccessWarnings.managerStatsSlackChannel,
+                    })}
+
+                    <p className="text-xs text-muted-foreground md:max-w-160">
+                      Posts a weekly summary on Fridays.
+                    </p>
+                  </div>
+                ) : null}
               </div>
+            </AutomationCard>
 
-              {managerStatsIsEnabled ? (
-                <div className="space-y-5">
-                  {renderSlackDestinationField({
-                    field: 'managerStatsSlackChannel',
-                    inputId: 'manager-stats-slack-channel',
-                    label: 'Post summaries to this Slack channel',
-                    helperText:
-                      'Choose where Roomote should post the Friday manager digest.',
-                    savedChannelId:
-                      settingsQuery.data?.settings.managerStatsSlackChannelId ??
-                      null,
-                    savedDiscordChannelId:
-                      settingsQuery.data?.settings
-                        .managerStatsDiscordChannelId ?? null,
-                    warningChannelId:
-                      slackChannelAccessWarnings.managerStatsSlackChannel,
-                  })}
-
-                  <p className="text-xs text-muted-foreground md:max-w-160">
-                    Posts a weekly summary on Fridays.
-                  </p>
-                </div>
-              ) : null}
-            </div>
-          </AutomationCard>
-
-          <AutomationCard
-            automation={AUTOMATION_DEFINITIONS.sentryTriage}
-            isOpen={openAutomationIds.has('sentryTriage')}
-            onOpenChange={(open) => setAutomationOpen('sentryTriage', open)}
-            iconEnabled={iconEnabled.sentryTriage}
-            debugSection={renderDebugRunsSection('sentryTriage')}
-            runAction={
-              <BasicTooltip
-                content={getRunTooltip(
-                  'sentryTriage',
-                  sentryTriageIsEnabled,
-                  sentryTriageBlockedReason,
-                )}
-              >
-                <Button
-                  variant="ghost"
-                  size="icon"
-                  onClick={() =>
-                    triggerMutation.mutate({ automationKey: 'sentry_triage' })
-                  }
-                  disabled={isRunDisabled(
+            <AutomationCard
+              automation={AUTOMATION_DEFINITIONS.sentryTriage}
+              isOpen={openAutomationIds.has('sentryTriage')}
+              onOpenChange={(open) => setAutomationOpen('sentryTriage', open)}
+              iconEnabled={iconEnabled.sentryTriage}
+              debugSection={renderDebugRunsSection('sentryTriage')}
+              runAction={
+                <BasicTooltip
+                  content={getRunTooltip(
                     'sentryTriage',
                     sentryTriageIsEnabled,
-                    sentryTriageBlockedReason != null,
+                    sentryTriageBlockedReason,
                   )}
                 >
-                  <Play />
-                </Button>
-              </BasicTooltip>
-            }
-            footer={
-              <AutomationFooter
-                isDirty={isDirty.sentryTriage}
-                isPending={
-                  updateMutation.isPending &&
-                  savingAutomation === 'sentryTriage'
-                }
-                saveDisabled={sentryTriageSaveDisabled}
-                onSave={() => saveAgent('sentryTriage')}
-                onReset={() => resetAgent('sentryTriage')}
-              />
-            }
-          >
-            <div className="space-y-5">
-              <Select
-                value={formState.sentryTriageFrequency}
-                onValueChange={(value) => {
-                  const frequency = value as SentryTriageFrequency;
-
-                  if (
-                    !canSelectSentryTriageFrequency({
-                      sentryConnected: sentryConnected,
-                      frequency,
-                    })
-                  ) {
-                    toast.error(
-                      'Configure Sentry in Settings > Integrations before enabling Triage Sentry Issues.',
-                    );
-                    return;
+                  <Button
+                    variant="ghost"
+                    size="icon"
+                    onClick={() =>
+                      triggerMutation.mutate({ automationKey: 'sentry_triage' })
+                    }
+                    disabled={isRunDisabled(
+                      'sentryTriage',
+                      sentryTriageIsEnabled,
+                      sentryTriageBlockedReason != null,
+                    )}
+                  >
+                    <Play />
+                  </Button>
+                </BasicTooltip>
+              }
+              footer={
+                <AutomationFooter
+                  isDirty={isDirty.sentryTriage}
+                  isPending={
+                    updateMutation.isPending &&
+                    savingAutomation === 'sentryTriage'
                   }
+                  saveDisabled={sentryTriageSaveDisabled}
+                  onSave={() => saveAgent('sentryTriage')}
+                  onReset={() => resetAgent('sentryTriage')}
+                />
+              }
+            >
+              <div className="space-y-5">
+                <Select
+                  value={formState.sentryTriageFrequency}
+                  onValueChange={(value) => {
+                    const frequency = value as SentryTriageFrequency;
+
+                    if (
+                      !canSelectSentryTriageFrequency({
+                        sentryConnected: sentryConnected,
+                        frequency,
+                      })
+                    ) {
+                      toast.error(
+                        'Configure Sentry in Settings > Integrations before enabling Triage Sentry Issues.',
+                      );
+                      return;
+                    }
 
-                  setFormState((prev) =>
-                    prev
-                      ? {
-                          ...prev,
-                          sentryTriageFrequency: frequency,
-                        }
-                      : prev,
-                  );
-                }}
-              >
-                <SelectTrigger
-                  id="sentry-triage-frequency"
-                  aria-label="Triage Sentry Issues schedule"
-                  className="w-full md:w-56"
+                    setFormState((prev) =>
+                      prev
+                        ? {
+                            ...prev,
+                            sentryTriageFrequency: frequency,
+                          }
+                        : prev,
+                    );
+                  }}
                 >
-                  <SelectValue placeholder="Select a schedule" />
-                </SelectTrigger>
-                <SelectContent>
-                  {SENTRY_TRIAGE_FREQUENCY_OPTIONS.map((option) => (
-                    <SelectItem
-                      key={option.value}
-                      value={option.value}
-                      disabled={
-                        !canSelectSentryTriageFrequency({
-                          sentryConnected: sentryConnected,
-                          frequency: option.value,
-                        })
-                      }
-                    >
-                      {option.label}
-                    </SelectItem>
-                  ))}
-                </SelectContent>
-              </Select>
-
-              {!sentryConnected ? (
-                <Alert variant="light" className="md:max-w-160">
-                  <AlertCircle className="mt-0.5 size-4 shrink-0" />
-                  <AlertTitle>Connect Sentry first</AlertTitle>
-                  <AlertDescription>
-                    <div className="flex flex-col gap-3 sm:flex-row sm:items-center">
-                      <span>
-                        Connect the workspace Sentry integration before enabling
-                        scheduled Sentry triage.
-                      </span>
-                      <Button asChild size="sm" variant="outline">
-                        <a
-                          href={`${SETTINGS_PATHS.integrations}?highlight=sentry-mcp`}
-                        >
-                          Configure Sentry
-                        </a>
-                      </Button>
-                    </div>
-                  </AlertDescription>
-                </Alert>
-              ) : null}
-
-              {sentryTriageIsEnabled ? (
-                <div className="space-y-5">
-                  {renderSlackDestinationField({
-                    field: 'sentryTriageSlackChannel',
-                    inputId: 'sentry-triage-slack-channel',
-                    label: 'Post follow-up work to this Slack channel',
-                    helperText:
-                      'Choose where Roomote should post actionable Sentry follow-up work.',
-                    savedChannelId:
-                      settingsQuery.data?.settings.sentryTriageSlackChannelId ??
-                      null,
-                    savedDiscordChannelId:
-                      settingsQuery.data?.settings
-                        .sentryTriageDiscordChannelId ?? null,
-                    warningChannelId:
-                      slackChannelAccessWarnings.sentryTriageSlackChannel,
-                  })}
-
-                  <p className="text-xs text-muted-foreground md:max-w-160">
-                    Requires Sentry to be configured in Settings &gt;
-                    Integrations.
-                  </p>
+                  <SelectTrigger
+                    id="sentry-triage-frequency"
+                    aria-label="Triage Sentry Issues schedule"
+                    className="w-full md:w-56"
+                  >
+                    <SelectValue placeholder="Select a schedule" />
+                  </SelectTrigger>
+                  <SelectContent>
+                    {SENTRY_TRIAGE_FREQUENCY_OPTIONS.map((option) => (
+                      <SelectItem
+                        key={option.value}
+                        value={option.value}
+                        disabled={
+                          !canSelectSentryTriageFrequency({
+                            sentryConnected: sentryConnected,
+                            frequency: option.value,
+                          })
+                        }
+                      >
+                        {option.label}
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+
+                {!sentryConnected ? (
+                  <Alert variant="light" className="md:max-w-160">
+                    <AlertCircle className="mt-0.5 size-4 shrink-0" />
+                    <AlertTitle>Connect Sentry first</AlertTitle>
+                    <AlertDescription>
+                      <div className="flex flex-col gap-3 sm:flex-row sm:items-center">
+                        <span>
+                          Connect the workspace Sentry integration before
+                          enabling scheduled Sentry triage.
+                        </span>
+                        <Button asChild size="sm" variant="outline">
+                          <a
+                            href={`${SETTINGS_PATHS.integrations}?highlight=sentry-mcp`}
+                          >
+                            Configure Sentry
+                          </a>
+                        </Button>
+                      </div>
+                    </AlertDescription>
+                  </Alert>
+                ) : null}
+
+                {sentryTriageIsEnabled ? (
+                  <div className="space-y-5">
+                    {renderSlackDestinationField({
+                      field: 'sentryTriageSlackChannel',
+                      inputId: 'sentry-triage-slack-channel',
+                      label: 'Post follow-up work to this Slack channel',
+                      helperText:
+                        'Choose where Roomote should post actionable Sentry follow-up work.',
+                      savedChannelId:
+                        settingsQuery.data?.settings
+                          .sentryTriageSlackChannelId ?? null,
+                      savedDiscordChannelId:
+                        settingsQuery.data?.settings
+                          .sentryTriageDiscordChannelId ?? null,
+                      warningChannelId:
+                        slackChannelAccessWarnings.sentryTriageSlackChannel,
+                    })}
 
-                  <div className="space-y-2">
-                    <Label htmlFor="sentry-triage-projects">
-                      Project slugs
-                    </Label>
-                    <Textarea
-                      id="sentry-triage-projects"
-                      value={formState.sentryTriageProjectSlugs}
-                      onChange={(event) =>
-                        setFormState((prev) =>
-                          prev
-                            ? {
-                                ...prev,
-                                sentryTriageProjectSlugs: event.target.value,
-                              }
-                            : prev,
-                        )
-                      }
-                      rows={3}
-                      placeholder="Optional, one Sentry project slug per line"
-                    />
                     <p className="text-xs text-muted-foreground md:max-w-160">
-                      Leave blank to scan all projects available to the Sentry
-                      token.
+                      Requires Sentry to be configured in Settings &gt;
+                      Integrations.
                     </p>
-                    {fieldErrors.sentryTriageProjectSlugs ? (
-                      <p className="text-xs text-destructive">
-                        {fieldErrors.sentryTriageProjectSlugs}
+
+                    <div className="space-y-2">
+                      <Label htmlFor="sentry-triage-projects">
+                        Project slugs
+                      </Label>
+                      <Textarea
+                        id="sentry-triage-projects"
+                        value={formState.sentryTriageProjectSlugs}
+                        onChange={(event) =>
+                          setFormState((prev) =>
+                            prev
+                              ? {
+                                  ...prev,
+                                  sentryTriageProjectSlugs: event.target.value,
+                                }
+                              : prev,
+                          )
+                        }
+                        rows={3}
+                        placeholder="Optional, one Sentry project slug per line"
+                      />
+                      <p className="text-xs text-muted-foreground md:max-w-160">
+                        Leave blank to scan all projects available to the Sentry
+                        token.
                       </p>
-                    ) : null}
+                      {fieldErrors.sentryTriageProjectSlugs ? (
+                        <p className="text-xs text-destructive">
+                          {fieldErrors.sentryTriageProjectSlugs}
+                        </p>
+                      ) : null}
+                    </div>
                   </div>
-                </div>
-              ) : null}
-            </div>
-          </AutomationCard>
-
-          <AutomationCard
-            automation={AUTOMATION_DEFINITIONS.suggester}
-            isOpen={openAutomationIds.has('suggester')}
-            onOpenChange={(open) => setAutomationOpen('suggester', open)}
-            iconEnabled={iconEnabled.suggester}
-            disabled={slackAutomationsDisabled}
-            debugSection={renderDebugRunsSection('suggester')}
-            runAction={
-              <BasicTooltip
-                content={getRunTooltip('suggester', suggesterIsEnabled)}
-              >
-                <Button
-                  variant="ghost"
-                  size="icon"
-                  onClick={() =>
-                    triggerMutation.mutate({ automationKey: 'suggester' })
+                ) : null}
+              </div>
+            </AutomationCard>
+
+            <AutomationCard
+              automation={AUTOMATION_DEFINITIONS.suggester}
+              isOpen={openAutomationIds.has('suggester')}
+              onOpenChange={(open) => setAutomationOpen('suggester', open)}
+              iconEnabled={iconEnabled.suggester}
+              disabled={slackAutomationsDisabled}
+              debugSection={renderDebugRunsSection('suggester')}
+              runAction={
+                <BasicTooltip
+                  content={getRunTooltip('suggester', suggesterIsEnabled)}
+                >
+                  <Button
+                    variant="ghost"
+                    size="icon"
+                    onClick={() =>
+                      triggerMutation.mutate({ automationKey: 'suggester' })
+                    }
+                    disabled={isRunDisabled('suggester', suggesterIsEnabled)}
+                  >
+                    <Play />
+                  </Button>
+                </BasicTooltip>
+              }
+              footer={
+                <AutomationFooter
+                  isDirty={isDirty.suggester}
+                  isPending={
+                    updateMutation.isPending && savingAutomation === 'suggester'
                   }
-                  disabled={isRunDisabled('suggester', suggesterIsEnabled)}
+                  onSave={() => saveAgent('suggester')}
+                  onReset={() => resetAgent('suggester')}
+                />
+              }
+            >
+              <div className="space-y-5">
+                <Select
+                  value={formState.suggesterFrequency}
+                  onValueChange={(value) => {
+                    setFormState((prev) =>
+                      prev
+                        ? {
+                            ...prev,
+                            suggesterFrequency: value as SuggesterFrequency,
+                          }
+                        : prev,
+                    );
+                  }}
                 >
-                  <Play />
-                </Button>
-              </BasicTooltip>
-            }
-            footer={
-              <AutomationFooter
-                isDirty={isDirty.suggester}
-                isPending={
-                  updateMutation.isPending && savingAutomation === 'suggester'
-                }
-                onSave={() => saveAgent('suggester')}
-                onReset={() => resetAgent('suggester')}
-              />
-            }
-          >
-            <div className="space-y-5">
-              <Select
-                value={formState.suggesterFrequency}
-                onValueChange={(value) => {
-                  setFormState((prev) =>
-                    prev
-                      ? {
-                          ...prev,
-                          suggesterFrequency: value as SuggesterFrequency,
-                        }
-                      : prev,
-                  );
-                }}
-              >
-                <SelectTrigger
-                  id="suggester-frequency"
-                  aria-label="Suggest Ideas schedule"
-                  className="w-full md:w-56"
+                  <SelectTrigger
+                    id="suggester-frequency"
+                    aria-label="Suggest Ideas schedule"
+                    className="w-full md:w-56"
+                  >
+                    <SelectValue placeholder="Select a schedule" />
+                  </SelectTrigger>
+                  <SelectContent>
+                    {SUGGESTER_FREQUENCY_OPTIONS.map((option) => (
+                      <SelectItem key={option.value} value={option.value}>
+                        {option.label}
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+
+                {suggesterIsEnabled ? (
+                  <div className="space-y-5">
+                    <>
+                      {renderSlackDestinationField({
+                        field: 'suggesterSlackChannel',
+                        inputId: 'suggester-slack-channel',
+                        label: 'Post suggestions to this Slack channel',
+                        helperText:
+                          'Choose where Roomote should post its suggestion digests.',
+                        savedChannelId:
+                          settingsQuery.data?.settings
+                            .suggesterSlackChannelId ?? null,
+                        savedDiscordChannelId:
+                          settingsQuery.data?.settings
+                            .suggesterDiscordChannelId ?? null,
+                        warningChannelId:
+                          slackChannelAccessWarnings.suggesterSlackChannel,
+                        allowTelegram: true,
+                        savedTelegramSelected: Boolean(
+                          settingsQuery.data?.settings.suggesterTelegramChatId,
+                        ),
+                        allowTeams: true,
+                        savedTeamsSelected: Boolean(
+                          settingsQuery.data?.settings.suggesterTeamsChannelId,
+                        ),
+                      })}
+
+                      <div className="space-y-2">
+                        <Label htmlFor="suggester-instructions">
+                          Additional instructions
+                        </Label>
+                        <Textarea
+                          id="suggester-instructions"
+                          value={formState.suggesterInstructions}
+                          onChange={(event) =>
+                            setFormState((prev) =>
+                              prev
+                                ? {
+                                    ...prev,
+                                    suggesterInstructions: event.target.value,
+                                  }
+                                : prev,
+                            )
+                          }
+                          rows={4}
+                          placeholder="Optional guidance for which ideas to prioritize or avoid"
+                        />
+                        {fieldErrors.suggesterInstructions ? (
+                          <p className="text-xs text-destructive">
+                            {fieldErrors.suggesterInstructions}
+                          </p>
+                        ) : null}
+                      </div>
+                    </>
+                  </div>
+                ) : null}
+              </div>
+            </AutomationCard>
+
+            <AutomationCard
+              automation={AUTOMATION_DEFINITIONS.announcer}
+              isOpen={openAutomationIds.has('announcer')}
+              onOpenChange={(open) => setAutomationOpen('announcer', open)}
+              iconEnabled={iconEnabled.announcer}
+              disabled={slackAutomationsDisabled}
+              debugSection={renderDebugRunsSection('announcer')}
+              runAction={
+                <BasicTooltip
+                  content={getRunTooltip('announcer', announcerIsEnabled)}
                 >
-                  <SelectValue placeholder="Select a schedule" />
-                </SelectTrigger>
-                <SelectContent>
-                  {SUGGESTER_FREQUENCY_OPTIONS.map((option) => (
-                    <SelectItem key={option.value} value={option.value}>
-                      {option.label}
-                    </SelectItem>
-                  ))}
-                </SelectContent>
-              </Select>
-
-              {suggesterIsEnabled ? (
-                <div className="space-y-5">
-                  <>
+                  <Button
+                    variant="ghost"
+                    size="icon"
+                    onClick={() =>
+                      triggerMutation.mutate({ automationKey: 'announcer' })
+                    }
+                    disabled={isRunDisabled('announcer', announcerIsEnabled)}
+                  >
+                    <Play />
+                  </Button>
+                </BasicTooltip>
+              }
+              footer={
+                <AutomationFooter
+                  isDirty={isDirty.announcer}
+                  isPending={
+                    updateMutation.isPending && savingAutomation === 'announcer'
+                  }
+                  onSave={() => saveAgent('announcer')}
+                  onReset={() => resetAgent('announcer')}
+                />
+              }
+            >
+              <div className="space-y-5">
+                <Select
+                  value={formState.announcerFrequency}
+                  onValueChange={(value) =>
+                    setFormState((prev) =>
+                      prev
+                        ? {
+                            ...prev,
+                            announcerFrequency: value as AnnouncerFrequency,
+                          }
+                        : prev,
+                    )
+                  }
+                >
+                  <SelectTrigger
+                    id="announcer-frequency"
+                    aria-label="Summarize Merged PRs schedule"
+                    className="w-full md:w-56"
+                  >
+                    <SelectValue placeholder="Select a schedule" />
+                  </SelectTrigger>
+                  <SelectContent>
+                    {ANNOUNCER_FREQUENCY_OPTIONS.map((option) => (
+                      <SelectItem key={option.value} value={option.value}>
+                        {option.label}
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+
+                {announcerIsEnabled ? (
+                  <div className="space-y-5">
                     {renderSlackDestinationField({
-                      field: 'suggesterSlackChannel',
-                      inputId: 'suggester-slack-channel',
-                      label: 'Post suggestions to this Slack channel',
+                      field: 'announcerSlackChannel',
+                      inputId: 'announcer-slack-channel',
+                      label: 'Post summaries to this Slack channel',
                       helperText:
-                        'Choose where Roomote should post its suggestion digests.',
+                        'Choose where Roomote should post merged-PR summaries.',
                       savedChannelId:
-                        settingsQuery.data?.settings.suggesterSlackChannelId ??
+                        settingsQuery.data?.settings.announcerSlackChannelId ??
                         null,
                       savedDiscordChannelId:
                         settingsQuery.data?.settings
-                          .suggesterDiscordChannelId ?? null,
+                          .announcerDiscordChannelId ?? null,
                       warningChannelId:
-                        slackChannelAccessWarnings.suggesterSlackChannel,
-                      allowTelegram: true,
-                      savedTelegramSelected: Boolean(
-                        settingsQuery.data?.settings.suggesterTelegramChatId,
-                      ),
-                      allowTeams: true,
-                      savedTeamsSelected: Boolean(
-                        settingsQuery.data?.settings.suggesterTeamsChannelId,
-                      ),
+                        slackChannelAccessWarnings.announcerSlackChannel,
                     })}
 
                     <div className="space-y-2">
-                      <Label htmlFor="suggester-instructions">
+                      <Label htmlFor="announcer-instructions">
                         Additional instructions
                       </Label>
                       <Textarea
-                        id="suggester-instructions"
-                        value={formState.suggesterInstructions}
+                        id="announcer-instructions"
+                        value={formState.announcerInstructions}
                         onChange={(event) =>
                           setFormState((prev) =>
                             prev
                               ? {
                                   ...prev,
-                                  suggesterInstructions: event.target.value,
+                                  announcerInstructions: event.target.value,
                                 }
                               : prev,
                           )
                         }
                         rows={4}
-                        placeholder="Optional guidance for which ideas to prioritize or avoid"
+                        placeholder="Optional guidance for summary tone and focus"
                       />
-                      {fieldErrors.suggesterInstructions ? (
+                      {fieldErrors.announcerInstructions ? (
                         <p className="text-xs text-destructive">
-                          {fieldErrors.suggesterInstructions}
+                          {fieldErrors.announcerInstructions}
                         </p>
                       ) : null}
                     </div>
-                  </>
-                </div>
-              ) : null}
-            </div>
-          </AutomationCard>
-
-          <AutomationCard
-            automation={AUTOMATION_DEFINITIONS.announcer}
-            isOpen={openAutomationIds.has('announcer')}
-            onOpenChange={(open) => setAutomationOpen('announcer', open)}
-            iconEnabled={iconEnabled.announcer}
-            disabled={slackAutomationsDisabled}
-            debugSection={renderDebugRunsSection('announcer')}
-            runAction={
-              <BasicTooltip
-                content={getRunTooltip('announcer', announcerIsEnabled)}
-              >
-                <Button
-                  variant="ghost"
-                  size="icon"
-                  onClick={() =>
-                    triggerMutation.mutate({ automationKey: 'announcer' })
-                  }
-                  disabled={isRunDisabled('announcer', announcerIsEnabled)}
-                >
-                  <Play />
-                </Button>
-              </BasicTooltip>
-            }
-            footer={
-              <AutomationFooter
-                isDirty={isDirty.announcer}
-                isPending={
-                  updateMutation.isPending && savingAutomation === 'announcer'
-                }
-                onSave={() => saveAgent('announcer')}
-                onReset={() => resetAgent('announcer')}
-              />
-            }
-          >
-            <div className="space-y-5">
-              <Select
-                value={formState.announcerFrequency}
-                onValueChange={(value) =>
-                  setFormState((prev) =>
-                    prev
-                      ? {
-                          ...prev,
-                          announcerFrequency: value as AnnouncerFrequency,
-                        }
-                      : prev,
-                  )
-                }
-              >
-                <SelectTrigger
-                  id="announcer-frequency"
-                  aria-label="Summarize Merged PRs schedule"
-                  className="w-full md:w-56"
-                >
-                  <SelectValue placeholder="Select a schedule" />
-                </SelectTrigger>
-                <SelectContent>
-                  {ANNOUNCER_FREQUENCY_OPTIONS.map((option) => (
-                    <SelectItem key={option.value} value={option.value}>
-                      {option.label}
-                    </SelectItem>
-                  ))}
-                </SelectContent>
-              </Select>
-
-              {announcerIsEnabled ? (
-                <div className="space-y-5">
-                  {renderSlackDestinationField({
-                    field: 'announcerSlackChannel',
-                    inputId: 'announcer-slack-channel',
-                    label: 'Post summaries to this Slack channel',
-                    helperText:
-                      'Choose where Roomote should post merged-PR summaries.',
-                    savedChannelId:
-                      settingsQuery.data?.settings.announcerSlackChannelId ??
-                      null,
-                    savedDiscordChannelId:
-                      settingsQuery.data?.settings.announcerDiscordChannelId ??
-                      null,
-                    warningChannelId:
-                      slackChannelAccessWarnings.announcerSlackChannel,
-                  })}
-
-                  <div className="space-y-2">
-                    <Label htmlFor="announcer-instructions">
-                      Additional instructions
-                    </Label>
-                    <Textarea
-                      id="announcer-instructions"
-                      value={formState.announcerInstructions}
-                      onChange={(event) =>
-                        setFormState((prev) =>
-                          prev
-                            ? {
-                                ...prev,
-                                announcerInstructions: event.target.value,
-                              }
-                            : prev,
-                        )
-                      }
-                      rows={4}
-                      placeholder="Optional guidance for summary tone and focus"
-                    />
-                    {fieldErrors.announcerInstructions ? (
-                      <p className="text-xs text-destructive">
-                        {fieldErrors.announcerInstructions}
-                      </p>
-                    ) : null}
                   </div>
-                </div>
-              ) : null}
-            </div>
-          </AutomationCard>
-
-          <h2 className="pt-2 text-base font-semibold text-foreground">
-            Meta automations
-          </h2>
+                ) : null}
+              </div>
+            </AutomationCard>
 
-          <AutomationCard
-            automation={AUTOMATION_DEFINITIONS.platformIssueAlerts}
-            isOpen={openAutomationIds.has('platformIssueAlerts')}
-            onOpenChange={(open) =>
-              setAutomationOpen('platformIssueAlerts', open)
-            }
-            iconEnabled={iconEnabled.platformIssueAlerts}
-            footer={
-              <AutomationFooter
-                isDirty={isDirty.platformIssueAlerts}
-                isPending={
-                  updateMutation.isPending &&
-                  savingAutomation === 'platformIssueAlerts'
-                }
-                onSave={() => saveAgent('platformIssueAlerts')}
-                onReset={() => resetAgent('platformIssueAlerts')}
-              />
-            }
-          >
-            <div className="space-y-5">
-              {renderSlackDestinationField({
-                field: 'platformIssueSlackChannel',
-                inputId: 'platform-issue-slack-channel',
-                label: 'Post alerts to this Slack channel',
-                helperText:
-                  'Choose where Roomote should post configuration issues that need an admin. Leave empty to use the Manager Channel.',
-                savedChannelId:
-                  settingsQuery.data?.settings.platformIssueSlackChannelId ??
-                  null,
-                savedDiscordChannelId:
-                  settingsQuery.data?.settings.platformIssueDiscordChannelId ??
-                  null,
-                warningChannelId:
-                  slackChannelAccessWarnings.platformIssueSlackChannel,
-              })}
-            </div>
-          </AutomationCard>
+            <AutomationCard
+              automation={AUTOMATION_DEFINITIONS.platformIssueAlerts}
+              isOpen={openAutomationIds.has('platformIssueAlerts')}
+              onOpenChange={(open) =>
+                setAutomationOpen('platformIssueAlerts', open)
+              }
+              iconEnabled={iconEnabled.platformIssueAlerts}
+              footer={
+                <AutomationFooter
+                  isDirty={isDirty.platformIssueAlerts}
+                  isPending={
+                    updateMutation.isPending &&
+                    savingAutomation === 'platformIssueAlerts'
+                  }
+                  onSave={() => saveAgent('platformIssueAlerts')}
+                  onReset={() => resetAgent('platformIssueAlerts')}
+                />
+              }
+            >
+              <div className="space-y-5">
+                {renderSlackDestinationField({
+                  field: 'platformIssueSlackChannel',
+                  inputId: 'platform-issue-slack-channel',
+                  label: 'Post alerts to this Slack channel',
+                  helperText:
+                    'Choose where Roomote should post configuration issues that need an admin. Leave empty to use the Manager Channel.',
+                  savedChannelId:
+                    settingsQuery.data?.settings.platformIssueSlackChannelId ??
+                    null,
+                  savedDiscordChannelId:
+                    settingsQuery.data?.settings
+                      .platformIssueDiscordChannelId ?? null,
+                  warningChannelId:
+                    slackChannelAccessWarnings.platformIssueSlackChannel,
+                })}
+              </div>
+            </AutomationCard>
+          </div>
         </div>
       )}
     </div>
diff --git a/apps/web/src/components/settings/automations/CustomAutomationsSection.tsx b/apps/web/src/components/settings/automations/CustomAutomationsSection.tsx
index 75635423e..a4673d6ff 100644
--- a/apps/web/src/components/settings/automations/CustomAutomationsSection.tsx
+++ b/apps/web/src/components/settings/automations/CustomAutomationsSection.tsx
@@ -1,6 +1,6 @@
 'use client';
 
-import { useMemo, useState } from 'react';
+import { useEffect, useMemo, useState } from 'react';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import { toast } from 'sonner';
 import {
@@ -9,25 +9,29 @@ import {
 } from '@roomote/types';
 
 import { tryParseCronSchedule } from '@/lib/cron-schedule';
-import { formatDistanceToNowCompact, formatTimeZone } from '@/lib/formatters';
+import { formatTimeZone } from '@/lib/formatters';
 import { useTRPC } from '@/trpc/client';
 import type { CustomAutomationListItem } from '@/trpc/commands/automations';
 
 import {
   Button,
+  BasicTooltip,
   Card,
   CardContent,
-  CardHeader,
-  CardTitle,
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
   Input,
   Label,
-  Play,
   Plus,
   Select,
   SelectContent,
   SelectItem,
   SelectTrigger,
   SelectValue,
+  SlidersHorizontal,
   Switch,
   Textarea,
   Trash2,
@@ -124,6 +128,29 @@ function formFromRow(row: CustomAutomationListItem): CustomAutomationFormState {
   };
 }
 
+function writeInputFromRow(row: CustomAutomationListItem) {
+  const target = targetFromRow(row);
+
+  return {
+    name: row.name,
+    prompt: row.prompt,
+    enabled: row.enabled,
+    scheduleMode: row.scheduleMode,
+    cronExpression: row.cronExpression,
+    model: row.model,
+    environmentId: row.environmentId ?? '',
+    ...(target.provider !== 'none'
+      ? {
+          targetProvider: target.provider,
+          targetChannelId: target.channelId,
+        }
+      : {}),
+    ...(target.provider === 'teams' && target.serviceUrl
+      ? { targetServiceUrl: target.serviceUrl }
+      : {}),
+  };
+}
+
 // The LLM summary usually already names the timezone; only append it when
 // missing so it never shows twice.
 function scheduleSummaryLine(summary: string, timeZone: string): string {
@@ -133,22 +160,6 @@ function scheduleSummaryLine(summary: string, timeZone: string): string {
     : `${summary} (${timeZoneLabel})`;
 }
 
-function statusLine(row: CustomAutomationListItem): string {
-  if (row.lastError) {
-    return `Last error: ${row.lastError}`;
-  }
-
-  if (row.lastSucceededAt) {
-    return `Last ran ${formatDistanceToNowCompact(row.lastSucceededAt)}`;
-  }
-
-  if (row.lastRunAt) {
-    return `Last attempted ${formatDistanceToNowCompact(row.lastRunAt)}`;
-  }
-
-  return 'Never ran';
-}
-
 export function CustomAutomationsSection() {
   const trpc = useTRPC();
   const queryClient = useQueryClient();
@@ -237,6 +248,11 @@ export function CustomAutomationsSection() {
         setForm(EMPTY_FORM);
         setResolvedCron(null);
         setScheduleSummary(null);
+        window.history.replaceState(
+          null,
+          '',
+          `${window.location.pathname}${window.location.search}`,
+        );
         await invalidate();
       },
       onError: (error) => {
@@ -245,37 +261,29 @@ export function CustomAutomationsSection() {
     }),
   );
 
-  const deleteMutation = useMutation(
-    trpc.automations.deleteCustomAutomation.mutationOptions({
+  const toggleMutation = useMutation(
+    trpc.automations.updateCustomAutomation.mutationOptions({
       onSuccess: async () => {
-        toast.success('Custom automation deleted');
         await invalidate();
       },
       onError: (error) => {
-        toast.error(error.message || 'Failed to delete custom automation');
+        toast.error(error.message || 'Failed to update custom automation');
       },
     }),
   );
 
-  const triggerMutation = useMutation(
-    trpc.automations.triggerCustomAutomation.mutationOptions({
-      onSuccess: async (result) => {
-        if (result.outcome === 'launched') {
-          toast.success('Custom automation started');
-        } else if (result.outcome === 'skipped') {
-          toast.message(result.reason);
-        } else if (result.outcome === 'failed') {
-          toast.error(result.error);
-        } else {
-          toast.success('Custom automation completed');
-        }
+  const deleteMutation = useMutation(
+    trpc.automations.deleteCustomAutomation.mutationOptions({
+      onSuccess: async () => {
+        toast.success('Custom automation deleted');
         await invalidate();
       },
       onError: (error) => {
-        toast.error(error.message || 'Failed to run custom automation');
+        toast.error(error.message || 'Failed to delete custom automation');
       },
     }),
   );
+
   const resolveScheduleMutation = useMutation(
     trpc.automations.resolveCustomAutomationSchedule.mutationOptions({
       onSuccess: (result, variables) => {
@@ -322,13 +330,66 @@ export function CustomAutomationsSection() {
       ? scheduleSummaryLine(clientParsedCron.summary, schedulingTimeZone)
       : scheduleSummary;
 
-  const rows = listQuery.data ?? [];
+  const rows = useMemo(() => listQuery.data ?? [], [listQuery.data]);
   const atCap = rows.length >= MAX_CUSTOM_AUTOMATIONS;
   const busy =
     createMutation.isPending ||
     updateMutation.isPending ||
     deleteMutation.isPending ||
-    triggerMutation.isPending;
+    toggleMutation.isPending;
+
+  const closeEditor = () => {
+    setIsCreating(false);
+    setEditingId(null);
+    setForm(EMPTY_FORM);
+    setResolvedCron(null);
+    setScheduleSummary(null);
+    if (window.location.hash.startsWith('#custom-automation-')) {
+      window.history.replaceState(
+        null,
+        '',
+        `${window.location.pathname}${window.location.search}`,
+      );
+    }
+  };
+
+  const editAutomation = (row: CustomAutomationListItem) => {
+    setEditingId(row.id);
+    setIsCreating(false);
+    setForm(formFromRow(row));
+    setResolvedCron(row.cronExpression ?? null);
+    setScheduleSummary(null);
+    window.history.replaceState(
+      null,
+      '',
+      `${window.location.pathname}${window.location.search}#custom-automation-${row.id}`,
+    );
+  };
+
+  useEffect(() => {
+    const openLinkedAutomation = () => {
+      const prefix = '#custom-automation-';
+      if (!window.location.hash.startsWith(prefix)) {
+        return;
+      }
+
+      const row = rows.find(
+        (candidate) =>
+          candidate.id === window.location.hash.slice(prefix.length),
+      );
+      if (row) {
+        setEditingId(row.id);
+        setIsCreating(false);
+        setForm(formFromRow(row));
+        setResolvedCron(row.cronExpression ?? null);
+        setScheduleSummary(null);
+      }
+    };
+
+    openLinkedAutomation();
+    window.addEventListener('hashchange', openLinkedAutomation);
+    return () => window.removeEventListener('hashchange', openLinkedAutomation);
+  }, [rows]);
 
   const saveForm = () => {
     if (!form.environmentId) {
@@ -379,13 +440,16 @@ export function CustomAutomationsSection() {
   };
 
   const renderEditor = () => (
-    <Card variant="snug" className="border-dashed">
-      <CardHeader>
-        <CardTitle className="text-sm font-medium">
+    <DialogContent size="lg">
+      <DialogHeader>
+        <DialogTitle>
           {editingId ? 'Edit custom automation' : 'New custom automation'}
-        </CardTitle>
-      </CardHeader>
-      <CardContent className="space-y-4">
+        </DialogTitle>
+        <DialogDescription>
+          Configure what runs, when it runs, and where the result is sent.
+        </DialogDescription>
+      </DialogHeader>
+      <div className="space-y-4">
         <div className="space-y-2">
           <Label htmlFor="custom-automation-name">Name</Label>
           <Input
@@ -669,13 +733,7 @@ export function CustomAutomationsSection() {
               type="button"
               variant="outline"
               disabled={busy}
-              onClick={() => {
-                setIsCreating(false);
-                setEditingId(null);
-                setForm(EMPTY_FORM);
-                setResolvedCron(null);
-                setScheduleSummary(null);
-              }}
+              onClick={closeEditor}
             >
               Cancel
             </Button>
@@ -684,21 +742,26 @@ export function CustomAutomationsSection() {
             </Button>
           </div>
         </div>
-      </CardContent>
-    </Card>
+      </div>
+    </DialogContent>
   );
 
   return (
-    <div className="space-y-3">
+    <section
+      className="order-[-40] col-span-full space-y-3"
+      aria-labelledby="custom-automations-heading"
+    >
       <div className="flex items-start justify-between gap-3 pt-2">
         <div className="space-y-1">
-          <h2 className="text-base font-semibold text-foreground">
-            Custom automations
+          <h2
+            id="custom-automations-heading"
+            className="text-sm font-semibold text-foreground"
+          >
+            Custom
           </h2>
           <p className="text-sm text-muted-foreground">
             Create your own scheduled agent runs with a prompt, cadence,
-            environment, and optional report channel. Daily and weekly runs fire
-            around local 3am, matching the other automations.
+            environment, and optional report channel.
           </p>
         </div>
         {!isCreating && !editingId ? (
@@ -728,113 +791,122 @@ export function CustomAutomationsSection() {
         ) : null}
       </div>
 
-      {isCreating || editingId ? renderEditor() : null}
+      <Dialog
+        open={isCreating || Boolean(editingId)}
+        onOpenChange={(open) => {
+          if (!open) closeEditor();
+        }}
+      >
+        {isCreating || editingId ? renderEditor() : null}
+      </Dialog>
 
       {listQuery.isPending ? (
         <p className="text-sm text-muted-foreground">
           Loading custom automations…
         </p>
       ) : rows.length === 0 && !isCreating ? (
-        <Card variant="snug">
-          <CardContent className="text-muted-foreground">
-            No custom automations yet. Example: every Monday, summarize flaky
-            tests and post to #eng-quality.
-          </CardContent>
-        </Card>
+        <p className="text-sm text-muted-foreground">
+          No custom automations created yet.
+        </p>
       ) : (
-        <div className="space-y-3">
-          {rows.map((row) => {
-            const environmentName =
-              environmentOptions.find(
-                (environment) => environment.id === row.environmentId,
-              )?.name ?? 'Environment missing';
-            const target = targetFromRow(row);
-            const destinationLabel =
-              target.provider === 'none'
-                ? 'no report channel'
-                : target.provider === 'slack'
-                  ? (slackOptions.find(
-                      (option) =>
-                        option.id === target.channelId ||
-                        option.name === target.channelId,
-                    )?.label ?? target.channelId)
-                  : target.provider === 'discord'
-                    ? (discordOptions.find(
-                        (option) => option.id === target.channelId,
-                      )?.label ?? target.channelId)
-                    : target.channelId;
-
-            return (
-              <Card key={row.id} variant="snug">
-                <CardHeader className="flex flex-row items-start justify-between gap-3 space-y-0 pb-2">
-                  <div className="space-y-1">
-                    <CardTitle className="text-sm font-medium">
-                      {row.name}
-                    </CardTitle>
-                    <p className="text-xs text-muted-foreground">
-                      {row.scheduleMode === 'cron'
-                        ? row.cronExpression
-                        : scheduleLabel(row.scheduleMode)}{' '}
-                      · {environmentName} ·{' '}
-                      {target.provider === 'none'
-                        ? destinationLabel
-                        : `${target.provider}:${destinationLabel}`}{' '}
-                      · {statusLine(row)}
-                      {row.model ? ` · ${row.model}` : null}
-                      {row.createdByName ? ` · by ${row.createdByName}` : null}
-                    </p>
-                  </div>
-                  <div className="flex items-center gap-1">
-                    <Button
-                      type="button"
-                      size="sm"
-                      variant="ghost"
-                      disabled={busy || !row.enabled}
-                      onClick={() => triggerMutation.mutate({ id: row.id })}
-                      aria-label={`Run ${row.name} now`}
-                    >
-                      <Play className="size-4" />
-                    </Button>
-                    <Button
-                      type="button"
-                      size="sm"
-                      variant="ghost"
-                      disabled={busy}
-                      onClick={() => {
-                        setEditingId(row.id);
-                        setIsCreating(false);
-                        setForm(formFromRow(row));
-                        setResolvedCron(row.cronExpression ?? null);
-                        setScheduleSummary(null);
-                      }}
-                    >
-                      Edit
-                    </Button>
-                    <Button
-                      type="button"
-                      size="sm"
-                      variant="ghost"
-                      disabled={busy}
-                      onClick={() => {
-                        if (
-                          window.confirm(
-                            `Delete custom automation “${row.name}”?`,
-                          )
-                        ) {
-                          deleteMutation.mutate({ id: row.id });
+        <Card variant="snug">
+          <CardContent>
+            <div className="divide-y divide-background">
+              {rows.map((row) => {
+                const environmentName =
+                  environmentOptions.find(
+                    (environment) => environment.id === row.environmentId,
+                  )?.name ?? 'Environment missing';
+                const target = targetFromRow(row);
+                const destinationLabel =
+                  target.provider === 'none'
+                    ? 'no report channel'
+                    : target.provider === 'slack'
+                      ? (slackOptions.find(
+                          (option) =>
+                            option.id === target.channelId ||
+                            option.name === target.channelId,
+                        )?.label ?? target.channelId)
+                      : target.provider === 'discord'
+                        ? (discordOptions.find(
+                            (option) => option.id === target.channelId,
+                          )?.label ?? target.channelId)
+                        : target.channelId;
+
+                return (
+                  <div
+                    key={row.id}
+                    className="flex flex-col gap-3 py-3 first:pt-0 last:pb-0 sm:flex-row sm:items-start sm:justify-between"
+                  >
+                    <div className="flex min-w-0 items-start gap-3">
+                      <Switch
+                        aria-label={`Toggle ${row.name}`}
+                        checked={row.enabled}
+                        disabled={busy}
+                        className="mt-0.5"
+                        onCheckedChange={(enabled) =>
+                          toggleMutation.mutate({
+                            id: row.id,
+                            ...writeInputFromRow(row),
+                            enabled,
+                          })
                         }
-                      }}
-                      aria-label={`Delete ${row.name}`}
-                    >
-                      <Trash2 className="size-4" />
-                    </Button>
+                      />
+                      <div className="min-w-0 space-y-1">
+                        <p className="text-sm font-semibold">{row.name}</p>
+                        <p className="text-xs text-muted-foreground">
+                          {row.scheduleMode === 'cron'
+                            ? row.cronExpression
+                            : scheduleLabel(row.scheduleMode)}{' '}
+                          · {environmentName} ·{' '}
+                          {target.provider === 'none'
+                            ? destinationLabel
+                            : `${target.provider}:${destinationLabel}`}{' '}
+                          · Created by {row.createdByName ?? 'Unknown'}
+                        </p>
+                      </div>
+                    </div>
+                    <div className="flex shrink-0 items-center gap-1 self-end sm:self-auto">
+                      <BasicTooltip content="Configure">
+                        <Button
+                          type="button"
+                          size="icon"
+                          variant="ghost"
+                          disabled={busy}
+                          aria-label={`Configure ${row.name}`}
+                          onClick={() => editAutomation(row)}
+                        >
+                          <SlidersHorizontal />
+                        </Button>
+                      </BasicTooltip>
+                      <BasicTooltip content="Delete">
+                        <Button
+                          type="button"
+                          size="sm"
+                          variant="ghost"
+                          disabled={busy}
+                          onClick={() => {
+                            if (
+                              window.confirm(
+                                `Delete custom automation “${row.name}”?`,
+                              )
+                            ) {
+                              deleteMutation.mutate({ id: row.id });
+                            }
+                          }}
+                          aria-label={`Delete ${row.name}`}
+                        >
+                          <Trash2 />
+                        </Button>
+                      </BasicTooltip>
+                    </div>
                   </div>
-                </CardHeader>
-              </Card>
-            );
-          })}
-        </div>
+                );
+              })}
+            </div>
+          </CardContent>
+        </Card>
       )}
-    </div>
+    </section>
   );
 }
diff --git a/apps/web/src/components/system/primitives/icons.ts b/apps/web/src/components/system/primitives/icons.ts
index e04fe1a41..49fbf1edc 100644
--- a/apps/web/src/components/system/primitives/icons.ts
+++ b/apps/web/src/components/system/primitives/icons.ts
@@ -168,6 +168,7 @@ export {
   Shapes,
   Slack,
   Slash,
+  SlidersHorizontal,
   Sparkles,
   Square,
   SquareArrowOutUpRight,

From d8bcecdaaf5ca0ee52c1e12ac472f1a28b6ae8ef Mon Sep 17 00:00:00 2001
From: "roomote-roomote[bot]"
 <301996811+roomote-roomote[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:18:29 +0100
Subject: [PATCH 04/24] docs: guide agents through self-hosting setup (#976)

Co-authored-by: Roomote <roomote@roomote.dev>
---
 apps/docs/docs.json | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/apps/docs/docs.json b/apps/docs/docs.json
index f5498ac0d..e3e883952 100644
--- a/apps/docs/docs.json
+++ b/apps/docs/docs.json
@@ -3,6 +3,17 @@
   "theme": "mint",
   "name": "Roomote Docs",
   "description": "Documentation for Roomote, the open, self-hostable platform for cloud coding agents.",
+  "markdown": {
+    "instructions": [
+      "When helping someone deploy Roomote, distinguish self-hosting from contributing to Roomote. Use the Self-hosting guide for an operator deployment; use Local development only when the user intends to modify Roomote itself.",
+      "Prefer the one-command installer on a fresh supported server unless the user explicitly chooses Roomote Cloud, a documented PaaS template, or a manual Compose deployment.",
+      "Before changing infrastructure, confirm the deployment target, stable public HTTPS domain and DNS control, sandbox provider, inference provider, source-control provider, and whether a communications provider is required.",
+      "Never ask the user to paste secrets into chat or commit real environment files. Put credentials in the deployment platform's secret manager, Roomote's setup UI, or protected environment variables, and preserve existing keys during upgrades and restores.",
+      "Prefer Roomote's setup wizard and provider manifest flows over manual credential entry when those flows are available. Ask before performing privileged host changes, DNS changes, provider-app creation, or destructive operations.",
+      "A setup is not complete when the services merely start. Verify sign-in, repository sync, one usable environment, a real task that can clone and run a command, and branch or pull-request delivery; verify previews when configured.",
+      "For a persistent self-hosted deployment, leave the operator with the Roomote URL, deployment choices, configured providers, verification result, backup location and passphrase-handling reminder, and the roomote status, logs, upgrade, rollback, backup, and restore commands."
+    ]
+  },
   "colors": {
     "primary": "#B0CD26",
     "light": "#D6EE26",

From 395ec5a6fd3306ad86e113ca9cb99de5b117964f Mon Sep 17 00:00:00 2001
From: "roomote-roomote[bot]"
 <301996811+roomote-roomote[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 12:25:36 +0100
Subject: [PATCH 05/24] [Docs] Add homelab deployment guide (#977)

* docs: add homelab deployment guide

* docs: run homelab installer as root

---------

Co-authored-by: Roomote <roomote@roomote.dev>
---
 apps/docs/docs.json        |   2 +-
 apps/docs/homelab.mdx      | 252 +++++++++++++++++++++++++++++++++++++
 apps/docs/self-hosting.mdx |   4 +
 3 files changed, 257 insertions(+), 1 deletion(-)
 create mode 100644 apps/docs/homelab.mdx

diff --git a/apps/docs/docs.json b/apps/docs/docs.json
index e3e883952..b9229ce28 100644
--- a/apps/docs/docs.json
+++ b/apps/docs/docs.json
@@ -42,7 +42,7 @@
     "groups": [
       {
         "group": "Getting Started",
-        "pages": ["index", "self-hosting"]
+        "pages": ["index", "self-hosting", "homelab"]
       },
       {
         "group": "Using Roomote",
diff --git a/apps/docs/homelab.mdx b/apps/docs/homelab.mdx
new file mode 100644
index 000000000..6e8c3f823
--- /dev/null
+++ b/apps/docs/homelab.mdx
@@ -0,0 +1,252 @@
+---
+title: Homelab deployment
+icon: house-plug
+description: Run Roomote on a Proxmox VM or another Linux server in your homelab.
+---
+
+Run Roomote on hardware you control with a dedicated Linux VM, private
+administration over Tailscale, and a public HTTPS origin for provider callbacks
+and task previews.
+
+This guide uses **Proxmox VE with a Debian or Ubuntu VM** as the worked example.
+Proxmox and Tailscale are not Roomote requirements: a bare-metal Linux server,
+another hypervisor, WireGuard, or a conventional VPN can provide the same
+roles.
+
+<Note>
+  Use a full virtual machine rather than an LXC container for the default Docker
+  sandbox provider. Roomote depends on Docker networking, cgroups, packet-filter
+  rules, and writable-layer quotas that are much easier to operate reliably in
+  a VM. LXC installations require host-specific privileged-container changes
+  and are not covered by this guide.
+</Note>
+
+## Plan the deployment
+
+The recommended homelab shape separates private administration from public
+application traffic:
+
+- **Proxmox VM:** runs Roomote, its datastores, and the default Docker task
+  sandboxes
+- **Tailscale:** provides private SSH and administrative access to the VM
+- **Public HTTPS origin:** receives source-control and communications-provider
+  callbacks and serves links generated by Roomote
+- **Caddy:** terminates traffic for the application and task preview hostnames
+
+Roomote supports x86_64 and arm64. The installer requires at least 4 GB of RAM.
+For a deployment that runs Docker task sandboxes on the same host, start with:
+
+| Resource | Recommended starting point |
+| --- | --- |
+| CPU | 4 vCPU, host CPU type |
+| Memory | 8 GB |
+| Disk | 60 GB or more on quota-capable storage |
+| OS | Debian 12 or later, or Ubuntu 24.04 LTS |
+
+The default limit for each Docker task is 2 CPUs, 4 GiB of memory, and a 20 GiB
+writable layer. Increase the VM resources for concurrent or Docker-heavy tasks,
+or use a [hosted sandbox provider](/compute) so task workloads do not compete
+with the Roomote services.
+
+## Create the Proxmox VM
+
+Create a VM from a Debian or Ubuntu cloud image or installation ISO:
+
+1. allocate at least 4 vCPU, 8 GB RAM, and 60 GB of disk
+2. set the CPU type to `host` and use VirtIO for disk and networking
+3. install and enable `qemu-guest-agent`
+4. assign a DHCP reservation or static address on the LAN
+5. enable SSH and apply operating-system updates
+
+A bare-metal mini PC, an existing Debian or Ubuntu server, or a VM on another
+hypervisor works too. The important boundary is a clean Linux host where Docker
+Engine and its networking and storage controls can operate normally.
+
+## Add private administration with Tailscale
+
+Install Tailscale on the VM using the
+[official Linux instructions](https://tailscale.com/kb/1031/install-linux), then
+confirm you can reach the host over its tailnet address before changing router
+or firewall rules. Use Tailscale SSH or regular SSH over the tailnet for host
+administration.
+
+Tailscale does not replace Roomote's public application origin. GitHub, Slack,
+and other providers must reach callbacks from outside your tailnet. Live task
+previews also use per-task hostnames, including wildcard preview DNS in the
+normal production configuration.
+
+<Warning>
+  Docker task sandboxes block private, link-local, shared-address, cloud
+  metadata, and Tailscale ranges by default. A repository hosted only on your
+  LAN or tailnet may be reachable from the VM but unreachable from a Roomote
+  task. Give self-hosted GitLab or Gitea a public, worker-reachable hostname
+  instead of disabling the sandbox network guard.
+</Warning>
+
+## Choose public ingress
+
+Choose one stable hostname before completing the setup wizard. Changing it
+later also means updating source-control, sign-in, and communications-provider
+redirect and webhook URLs.
+
+| Path | Best for | Tradeoffs |
+| --- | --- | --- |
+| Public DNS and port forwarding | Public IPv4, router control, and the simplest data path | Requires forwarding ports 80 and 443; dynamic addresses need DDNS |
+| Cloudflare Tunnel | CGNAT or networks where inbound ports should stay closed | Requires tunnel and wildcard-hostname configuration |
+| Tailscale Funnel | A limited public trial without router changes | Does not provide the wildcard hostname model needed for full live previews |
+
+### Public DNS and port forwarding
+
+Create DNS records for the application, preview root, and wildcard previews:
+
+```text
+roomote.example.com            A/AAAA  <home public address>
+preview.roomote.example.com    A/AAAA  <home public address>
+*.preview.roomote.example.com  A/AAAA  <home public address>
+```
+
+Forward TCP ports 80 and 443 from the router to the VM, then run:
+
+```sh
+curl -fsSL https://get.roomote.dev | sudo bash -s -- \
+  --domain roomote.example.com
+```
+
+The installer defaults the preview root to `preview.<domain>`. Use
+`--preview-domain <host>` when your DNS layout differs. If the public address
+changes, configure DDNS for all three records. This path does not work behind
+carrier-grade NAT unless the ISP supplies a public address.
+
+### Cloudflare Tunnel
+
+Cloudflare Tunnel can publish Roomote without forwarding inbound router ports.
+Install Roomote with Caddy's internal TLS mode because Cloudflare terminates the
+public certificate:
+
+```sh
+curl -fsSL https://get.roomote.dev | sudo bash -s -- \
+  --domain roomote.example.com \
+  --tls-mode internal
+```
+
+Route both the application hostname and preview wildcard through the same Caddy
+instance rather than routing directly to individual Roomote containers. Standard
+Cloudflare certificates require Roomote's flat preview-hostname layout; follow
+the canonical
+[Cloudflare Tunnel and flat preview hostname configuration](https://github.com/RooCodeInc/Roomote/blob/main/SELF_HOSTING.md#flat-preview-hostnames)
+for the required environment values, tunnel ingress, origin TLS setting, and
+**Match SNI to Host** option. Apply those values in `/opt/roomote/.env` and run
+`sudo roomote up` before testing or exposing task previews; the install command
+above otherwise retains the default nested preview hostname layout.
+
+### Tailscale Funnel
+
+Tailscale Funnel can expose a stable tailnet hostname to public callback
+providers, but it does not support Roomote's normal wildcard preview hostname
+layout. Treat it as a limited dashboard and callback trial, not the default
+full deployment path. Use public DNS or Cloudflare Tunnel when users need live
+task previews.
+
+## Let a local agent prepare the host
+
+Paste the following prompt into a local coding agent running on the VM or one
+that can SSH to it. The agent prepares the host and installer; you complete
+credential and authorization steps in Roomote's browser wizard.
+
+```text
+Set up a self-hosted Roomote deployment on this homelab server.
+
+Safety and scope:
+- Work only on a dedicated Debian 12+ or Ubuntu 24.04+ VM or bare-metal host.
+- Stop if this is an LXC container or if fewer than 4 GB RAM or 40 GB free disk
+  are available. Warn me and ask before continuing if other production
+  workloads share the host.
+- Explain changes before using sudo. Do not disable the firewall or expose
+  database, Redis, object-storage, API, or queue-dashboard ports.
+- Never ask me to paste model, GitHub, Slack, or other provider secrets into
+  chat or the shell. Those belong in Roomote's browser setup wizard.
+
+Process:
+1. Report the OS, architecture, CPU count, memory, free disk, default route,
+   public IPv4 detection result, and current Docker/storage configuration if
+   Docker is already installed. Do not change anything yet.
+2. Ask me to choose one ingress path: public DNS plus ports 80/443, or
+   Cloudflare Tunnel. If I am behind CGNAT, recommend Cloudflare Tunnel. Ask for
+   the final application domain and optional preview domain.
+3. Ask whether to install Tailscale for private SSH/admin access. If approved,
+   use Tailscale's official Linux package instructions and confirm access. Do
+   not treat the tailnet hostname as Roomote's public application origin.
+4. For public DNS, tell me the exact app, preview, and wildcard DNS records and
+   router forwards I must create, then wait for me. Verify public DNS and ports
+   from outside the LAN where possible. For Cloudflare Tunnel, guide me through
+   creating the app and wildcard public hostnames without asking me to reveal a
+   tunnel token, and use Roomote's documented internal-TLS and flat-preview
+   configuration.
+5. Download https://get.roomote.dev to a temporary file, show me the file path
+   and the exact installer flags you will use, and ask me to inspect it before
+   approval. Then run it with --domain and, for Cloudflare Tunnel, --tls-mode
+   internal. Do not write a new installer or manually recreate the Compose
+   stack.
+6. Run `sudo roomote status`. If healthy, tell me to run `sudo roomote
+   setup-url` in a separate trusted terminal and open the result. Do not print,
+   capture, or repeat the tokenized URL in agent output or transcripts. Stop
+   while I complete sign-in, source control, inference, communications, and
+   environment setup in the browser.
+7. After I confirm setup is complete, validate Docker's writable-layer quota
+   support, a small Roomote task, repository cloning, artifact upload, and a
+   configured preview. Summarize any failure and the relevant `roomote logs`
+   output without printing secrets.
+```
+
+## Complete setup in the browser
+
+The installer sets up Docker, Compose, generated secrets, Caddy, the Roomote
+services, a systemd unit, and the `roomote` host CLI. When it finishes, open the
+tokenized setup URL it prints and configure:
+
+1. the first admin account
+2. a source-control provider and repository access
+3. a ChatGPT subscription or inference provider
+4. Docker or a hosted sandbox provider
+5. an optional communications provider such as Slack
+6. the first environment and Roomote task
+
+Keep provider credentials in the setup wizard or your deployment secret store,
+not in shell history or an agent conversation.
+
+## Verify the homelab path
+
+After setup:
+
+1. run `roomote status` on the VM and confirm the services are healthy
+2. open the public Roomote URL from a device outside the home network
+3. confirm the expected repositories appear in Roomote
+4. validate the sandbox provider from **Settings > Sandboxes**
+5. run a small task and confirm it clones, executes, and uploads an artifact
+6. test a configured live preview from outside the home network
+7. if configured, mention the Roomote app in Slack and confirm it replies
+
+Common homelab failures include:
+
+- **The public URL works on cellular but not on Wi-Fi.** The router may not
+  support hairpin NAT. Add split-horizon DNS for LAN clients or use a resolver
+  that returns the correct internal route.
+- **An `sslip.io` hostname does not resolve on the LAN.** DNS-rebind protection
+  may reject names that resolve to private addresses. Use a domain you control
+  or allow the exact hostname in the local resolver.
+- **Certificates never issue.** Confirm public DNS, router forwarding, and host
+  firewall rules for ports 80 and 443. With a tunnel, use `--tls-mode internal`
+  and check the tunnel-to-Caddy origin TLS settings.
+- **Port forwarding has no effect.** Compare the router WAN address with an
+  external public-IP check. Different addresses usually indicate CGNAT; use a
+  tunnel or request a public address from the ISP.
+- **A task cannot clone a LAN repository.** Use a public, worker-reachable
+  source-control hostname. Do not remove the sandbox private-network guard.
+
+## Back up and update
+
+Use `roomote backup`, `roomote upgrade`, and `roomote rollback` for supported
+day-2 operations. A Proxmox snapshot is useful before host maintenance, but it
+does not replace an encrypted Roomote backup stored off the VM with its
+passphrase stored separately. See [Self-hosting](/self-hosting#day-2-operations)
+for backup, restore, and upgrade behavior.
diff --git a/apps/docs/self-hosting.mdx b/apps/docs/self-hosting.mdx
index 9eef67544..ccea1110b 100644
--- a/apps/docs/self-hosting.mdx
+++ b/apps/docs/self-hosting.mdx
@@ -30,6 +30,10 @@ team needs them.
 - **Your own server** gives you the most infrastructure control with the
   one-command installer below.
 
+Running Roomote on Proxmox or another server at home? Follow the
+[Homelab deployment guide](/homelab) for VM sizing, Tailscale administration,
+public ingress, and a prompt that a local agent can follow.
+
 By the end of setup, you should have a reachable Roomote URL, sign-in, a
 source-control provider, a ChatGPT subscription or inference provider, at least
 one environment, and a first reviewable Roomote task.

From e0ff87fd99cf54e3a2b6ed73f103b05639cab3aa Mon Sep 17 00:00:00 2001
From: "roomote-roomote[bot]"
 <301996811+roomote-roomote[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 12:35:40 +0100
Subject: [PATCH 06/24] [Feat] Add self-hosted license purchase entry points
 (#937)

* feat: add self-hosted license purchase entry points

* chore: remove obsolete telemetry exports

* Disable invites at seat capacity

* Responsive fixes

* Add self-hosted license usage sync

* fix: guard self-hosted license sync

* test: cover license usage retry after cloud outage

* fix: guard concurrent license activations

---------

Co-authored-by: Roomote <roomote@roomote.dev>
Co-authored-by: Bruno Bergher <bruno@roocode.com>
---
 README.md                                     |    22 +-
 SELF_HOSTING.md                               |    16 +-
 apps/bullmq/src/scheduled-jobs/index.ts       |     1 +
 .../src/scheduled-jobs/instance-ping.test.ts  |    82 +
 .../src/scheduled-jobs/instance-ping.ts       |     2 +-
 .../scheduled-jobs/license-usage-sync.test.ts |    67 +
 .../src/scheduled-jobs/license-usage-sync.ts  |    45 +
 apps/bullmq/src/scheduler.ts                  |    23 +
 apps/bullmq/src/types.ts                      |     2 +
 apps/docs/index.mdx                           |     5 +-
 apps/docs/users.mdx                           |    22 +-
 .../settings/UsersSettings.client.test.tsx    |    59 +
 .../src/components/settings/UsersSettings.tsx |   173 +-
 .../src/lib/server/__tests__/license.test.ts  |    27 +-
 .../server/__tests__/user-management.test.ts  |     2 +
 apps/web/src/lib/server/auth-context.test.ts  |     2 +
 apps/web/src/lib/server/auth-context.ts       |    21 +-
 apps/web/src/lib/server/license.ts            |   277 +-
 apps/web/src/lib/server/user-management.ts    |     9 +-
 .../trpc/commands/access-policy/index.test.ts |     1 +
 .../src/trpc/commands/access-policy/index.ts  |    65 +-
 knip.ts                                       |     3 -
 packages/db/drizzle/0028_aspiring_thena.sql   |    13 +
 packages/db/drizzle/meta/0028_snapshot.json   | 10019 ++++++++++++++++
 packages/db/drizzle/meta/_journal.json        |     7 +
 packages/db/src/lib/deployment-license.ts     |   309 +
 packages/db/src/lib/instance-report.ts        |    12 +
 .../db/src/lib/license-usage-observations.ts  |    79 +
 packages/db/src/schema.ts                     |    45 +
 packages/db/src/server.ts                     |     3 +
 packages/env/src/index.ts                     |     7 +
 packages/sdk/src/server/index.ts              |     1 +
 .../src/server/lib/request-instance-ping.ts   |    22 +
 .../src/__tests__/instance-report.test.ts     |    89 +
 .../src/__tests__/license-cloud.test.ts       |   164 +
 packages/telemetry/src/index.ts               |    19 +
 packages/telemetry/src/server/index.ts        |     9 +-
 .../telemetry/src/server/license-cloud.ts     |   191 +
 38 files changed, 11541 insertions(+), 374 deletions(-)
 create mode 100644 apps/bullmq/src/scheduled-jobs/instance-ping.test.ts
 create mode 100644 apps/bullmq/src/scheduled-jobs/license-usage-sync.test.ts
 create mode 100644 apps/bullmq/src/scheduled-jobs/license-usage-sync.ts
 create mode 100644 packages/db/drizzle/0028_aspiring_thena.sql
 create mode 100644 packages/db/drizzle/meta/0028_snapshot.json
 create mode 100644 packages/db/src/lib/deployment-license.ts
 create mode 100644 packages/db/src/lib/license-usage-observations.ts
 create mode 100644 packages/telemetry/src/__tests__/instance-report.test.ts
 create mode 100644 packages/telemetry/src/__tests__/license-cloud.test.ts
 create mode 100644 packages/telemetry/src/server/license-cloud.ts

diff --git a/README.md b/README.md
index 9455053b4..910ebfb28 100644
--- a/README.md
+++ b/README.md
@@ -177,8 +177,8 @@ copy-pasting.
   or bring API keys from any supported provider. Switch models per task. No
   markup on tokens.
 - **Read every line.** The full source is here. Audit it, extend it, fork it.
-- **No per-seat SaaS pricing.** Free for up to 10 users. Need more? Email
-  [help@roomote.dev](mailto:help@roomote.dev) for a license.
+- **No per-seat SaaS pricing.** Free for up to 10 users. Need more? [Buy a
+  self-hosted license on Roomote Cloud](https://cloud.roomote.dev/sign-up).
 
 ---
 
@@ -213,7 +213,9 @@ Need SSO, custom SLAs, or dedicated support? Get in touch:
 It is source-available under the [Fair Core License 1.0](LICENSE) (FCL-1.0-ALv2).
 You can read, modify, and self-host the code. Free for up to 10 users. Larger
 deployments need a license. Email
-[help@roomote.dev](mailto:help@roomote.dev). After the license period, the code
+[help@roomote.dev](mailto:help@roomote.dev) for teams larger than 100 users, or
+[buy a self-hosted license on Roomote Cloud](https://cloud.roomote.dev/sign-up).
+After the license period, the code
 converts to Apache 2.0.
 
 **How is this different from Cursor / Copilot / Claude Code?**
@@ -244,7 +246,8 @@ GitHub, GitLab, Gitea, Azure DevOps, and Bitbucket Cloud. Connect one or many.
 Self-hosting is free for up to 10 registered users. You pay your own model
 provider for tokens (or use the models bundled with your ChatGPT subscription).
 Cloud starts at $49/mo, depending on total user count.
-For larger teams, licenses are available by emailing
+For 11–100 users, [buy a self-hosted license on Roomote
+Cloud](https://cloud.roomote.dev/sign-up). For larger teams, email
 [help@roomote.dev](mailto:help@roomote.dev).
 
 **I already pay for ChatGPT Plus. Do I need an API key too?**
@@ -281,7 +284,10 @@ Report vulnerabilities privately. See [SECURITY.md](SECURITY.md).
 ## License
 
 [Fair Core License 1.0 (FCL-1.0-ALv2)](LICENSE). Free for up to 10 users.
-Licenses for larger deployments are available by emailing
-[help@roomote.dev](mailto:help@roomote.dev). The license key functionality may
-not be disabled or circumvented. [TRADEMARKS.md](TRADEMARKS.md) covers trademark
-usage.
+Licenses for 11–100 users are available through [Roomote
+Cloud](https://cloud.roomote.dev/sign-up); larger teams can email
+[help@roomote.dev](mailto:help@roomote.dev). Purchased licenses report their
+current user count for subscription billing. Refresh purchased keys annually in
+the Roomote Cloud portal, then replace the key in Settings or `R_LICENSE_KEY`.
+The license key functionality may not be disabled or circumvented.
+[TRADEMARKS.md](TRADEMARKS.md) covers trademark usage.
diff --git a/SELF_HOSTING.md b/SELF_HOSTING.md
index 48d5b16d5..9d49a38d1 100644
--- a/SELF_HOSTING.md
+++ b/SELF_HOSTING.md
@@ -943,15 +943,25 @@ Roomote is licensed under the Fair Core License 1.0 (FCL-1.0-ALv2, see
 registered user account counts toward the limit, whichever sign-in path or
 surface it uses. Removing a user frees their seat.
 
-To go beyond 10 users, obtain a license key from the Roomote maintainers and
-apply it in either of these ways:
+To go beyond 10 users, [buy a self-hosted license on Roomote
+Cloud](https://cloud.roomote.dev/sign-up) and apply its key in either of these
+ways:
 
 - Enter it in **Settings → Users → License** as an admin, or
 - Set `R_LICENSE_KEY` in the deployment environment (for example
   `.env.production` / Compose). When set, the env var takes precedence over
   any key stored in Settings.
 
-Keys are verified offline; your deployment never phones home.
+Purchased keys are issued annually. While the subscription is active, refresh
+the key in the Roomote Cloud portal and replace the value in Settings or
+`R_LICENSE_KEY` before its displayed expiry date. Keys are verified offline;
+usage reporting does not activate or validate them.
+
+Licensed deployments report the license ID and current registered-user count to
+Roomote's Ping service for subscription billing, even when anonymous analytics
+is disabled. Other instance statistics remain controlled by the anonymous
+analytics setting. Contact [help@roomote.dev](mailto:help@roomote.dev) for teams
+larger than 100 users.
 
 When a deployment is at its seat limit, existing users are unaffected — only
 new sign-ups are blocked until a seat is freed (Settings → Users → remove a
diff --git a/apps/bullmq/src/scheduled-jobs/index.ts b/apps/bullmq/src/scheduled-jobs/index.ts
index 0ac7585ef..31167ca45 100644
--- a/apps/bullmq/src/scheduled-jobs/index.ts
+++ b/apps/bullmq/src/scheduled-jobs/index.ts
@@ -3,5 +3,6 @@ export { sleepCheckJob } from './sleep-check';
 export { refreshSnapshotsJob } from './refresh-snapshots';
 export { pullRequestAnalyticsSyncJob } from './pull-request-analytics-sync';
 export { instancePingJob } from './instance-ping';
+export { licenseUsageSyncJob } from './license-usage-sync';
 export { webhookCleanupJob } from './webhook-cleanup';
 export { standbyRetentionJob } from './standby-retention';
diff --git a/apps/bullmq/src/scheduled-jobs/instance-ping.test.ts b/apps/bullmq/src/scheduled-jobs/instance-ping.test.ts
new file mode 100644
index 000000000..51fa2b156
--- /dev/null
+++ b/apps/bullmq/src/scheduled-jobs/instance-ping.test.ts
@@ -0,0 +1,82 @@
+const mocks = vi.hoisted(() => ({
+  checkLatestVersion: vi.fn(),
+  collectInstanceReportStats: vi.fn(),
+  collectLicensedUserCount: vi.fn(),
+  getDeploymentLicenseState: vi.fn(),
+  isAnonymousAnalyticsEnabled: vi.fn(),
+  isTelemetryEnvAllowed: vi.fn(),
+  recordLatestKnownVersion: vi.fn(),
+  sendInstanceReport: vi.fn(),
+}));
+
+vi.mock('@roomote/db/server', () => ({
+  collectInstanceReportStats: mocks.collectInstanceReportStats,
+  collectLicensedUserCount: mocks.collectLicensedUserCount,
+  getDeploymentLicenseState: mocks.getDeploymentLicenseState,
+  recordLatestKnownVersion: mocks.recordLatestKnownVersion,
+}));
+
+vi.mock('@roomote/telemetry/server', () => ({
+  checkLatestVersion: mocks.checkLatestVersion,
+  isAnonymousAnalyticsEnabled: mocks.isAnonymousAnalyticsEnabled,
+  isTelemetryEnvAllowed: mocks.isTelemetryEnvAllowed,
+  sendInstanceReport: mocks.sendInstanceReport,
+}));
+
+import { instancePingJob } from './instance-ping';
+
+describe('instancePingJob', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.isTelemetryEnvAllowed.mockReturnValue(true);
+    mocks.checkLatestVersion.mockResolvedValue(null);
+    mocks.getDeploymentLicenseState.mockResolvedValue({
+      status: 'unlicensed',
+      seatLimit: 10,
+    });
+    mocks.isAnonymousAnalyticsEnabled.mockResolvedValue(true);
+    mocks.collectInstanceReportStats.mockResolvedValue({ users: { total: 7 } });
+    mocks.collectLicensedUserCount.mockResolvedValue({ users: { total: 7 } });
+    mocks.sendInstanceReport.mockResolvedValue(true);
+  });
+
+  it('sends the full instance report when anonymous analytics is enabled', async () => {
+    const report = { users: { total: 7 }, tasks: { total: 12 } };
+    mocks.collectInstanceReportStats.mockResolvedValue(report);
+
+    await instancePingJob();
+
+    expect(mocks.collectInstanceReportStats).toHaveBeenCalledOnce();
+    expect(mocks.collectLicensedUserCount).not.toHaveBeenCalled();
+    expect(mocks.sendInstanceReport).toHaveBeenCalledWith(report);
+  });
+
+  it('does not send licensed usage to Ping after analytics opt-out', async () => {
+    mocks.isAnonymousAnalyticsEnabled.mockResolvedValue(false);
+    mocks.getDeploymentLicenseState.mockResolvedValue({
+      status: 'valid',
+      seatLimit: 100,
+      licenseId: 'lic_sh_123',
+      licensee: 'Engineering',
+      maxSeats: 100,
+      issuedAt: new Date('2026-01-01T00:00:00Z'),
+      expiresAt: new Date('2027-01-01T00:00:00Z'),
+    });
+
+    await instancePingJob();
+
+    expect(mocks.collectInstanceReportStats).not.toHaveBeenCalled();
+    expect(mocks.collectLicensedUserCount).not.toHaveBeenCalled();
+    expect(mocks.sendInstanceReport).not.toHaveBeenCalled();
+  });
+
+  it('skips the report after opt-out when there is no valid license', async () => {
+    mocks.isAnonymousAnalyticsEnabled.mockResolvedValue(false);
+
+    await instancePingJob();
+
+    expect(mocks.collectInstanceReportStats).not.toHaveBeenCalled();
+    expect(mocks.collectLicensedUserCount).not.toHaveBeenCalled();
+    expect(mocks.sendInstanceReport).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/bullmq/src/scheduled-jobs/instance-ping.ts b/apps/bullmq/src/scheduled-jobs/instance-ping.ts
index 4d97a1292..b21fd39bd 100644
--- a/apps/bullmq/src/scheduled-jobs/instance-ping.ts
+++ b/apps/bullmq/src/scheduled-jobs/instance-ping.ts
@@ -16,7 +16,7 @@ const LOG_PREFIX = '[instancePing]';
  * 1. Version check against the Ping service (mandatory; carries only the
  *    anonymous instance id + running version). The result is stored for the
  *    in-app "update available" notice.
- * 2. Anonymous instance stats report (covered by the admin opt-out).
+ * 2. Anonymous instance stats report, honoring the admin opt-out.
  *
  * Sends nothing at all in environments where telemetry is not allowed
  * (non-production / no RELEASE_VERSION, unless force-enabled with an explicit
diff --git a/apps/bullmq/src/scheduled-jobs/license-usage-sync.test.ts b/apps/bullmq/src/scheduled-jobs/license-usage-sync.test.ts
new file mode 100644
index 000000000..bd13d514b
--- /dev/null
+++ b/apps/bullmq/src/scheduled-jobs/license-usage-sync.test.ts
@@ -0,0 +1,67 @@
+const mocks = vi.hoisted(() => ({
+  listPendingLicenseUsageObservations: vi.fn(),
+  markLicenseUsageObservationAttempt: vi.fn(),
+  markLicenseUsageObservationDelivered: vi.fn(),
+  recordDailyLicenseUsageObservation: vi.fn(),
+  syncLicenseWithCloud: vi.fn(),
+}));
+
+vi.mock('@roomote/db/server', () => ({
+  listPendingLicenseUsageObservations:
+    mocks.listPendingLicenseUsageObservations,
+  markLicenseUsageObservationAttempt: mocks.markLicenseUsageObservationAttempt,
+  markLicenseUsageObservationDelivered:
+    mocks.markLicenseUsageObservationDelivered,
+  recordDailyLicenseUsageObservation: mocks.recordDailyLicenseUsageObservation,
+}));
+
+vi.mock('@roomote/telemetry/server', () => ({
+  syncLicenseWithCloud: mocks.syncLicenseWithCloud,
+}));
+
+import { licenseUsageSyncJob } from './license-usage-sync';
+
+describe('licenseUsageSyncJob', () => {
+  const observation = {
+    id: 'license-e2e-observation-1',
+    observedAt: new Date('2026-08-03T10:00:00.000Z'),
+    activeUsers: 11,
+  };
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.listPendingLicenseUsageObservations.mockResolvedValue([observation]);
+    mocks.markLicenseUsageObservationAttempt.mockResolvedValue(undefined);
+    mocks.markLicenseUsageObservationDelivered.mockResolvedValue(undefined);
+    mocks.syncLicenseWithCloud.mockResolvedValue({ status: 'synced' });
+  });
+
+  it('keeps a failed observation pending and delivers the same event on retry', async () => {
+    mocks.syncLicenseWithCloud
+      .mockResolvedValueOnce({ status: 'failed' })
+      .mockResolvedValueOnce({ status: 'synced' });
+
+    await expect(licenseUsageSyncJob()).rejects.toThrow(
+      'License usage delivery failed',
+    );
+
+    expect(mocks.markLicenseUsageObservationAttempt).toHaveBeenCalledWith(
+      observation.id,
+    );
+    expect(mocks.syncLicenseWithCloud).toHaveBeenCalledWith({
+      eventId: observation.id,
+      observedAt: observation.observedAt,
+      activeUsers: observation.activeUsers,
+    });
+    expect(mocks.markLicenseUsageObservationDelivered).not.toHaveBeenCalled();
+
+    await expect(licenseUsageSyncJob()).resolves.toBeUndefined();
+
+    expect(mocks.markLicenseUsageObservationAttempt).toHaveBeenCalledTimes(2);
+    expect(mocks.syncLicenseWithCloud).toHaveBeenCalledTimes(2);
+    expect(mocks.markLicenseUsageObservationDelivered).toHaveBeenCalledTimes(1);
+    expect(mocks.markLicenseUsageObservationDelivered).toHaveBeenCalledWith(
+      observation.id,
+    );
+  });
+});
diff --git a/apps/bullmq/src/scheduled-jobs/license-usage-sync.ts b/apps/bullmq/src/scheduled-jobs/license-usage-sync.ts
new file mode 100644
index 000000000..878caf159
--- /dev/null
+++ b/apps/bullmq/src/scheduled-jobs/license-usage-sync.ts
@@ -0,0 +1,45 @@
+import {
+  listPendingLicenseUsageObservations,
+  markLicenseUsageObservationAttempt,
+  markLicenseUsageObservationDelivered,
+  recordDailyLicenseUsageObservation,
+} from '@roomote/db/server';
+import { syncLicenseWithCloud } from '@roomote/telemetry/server';
+
+/** Drains durable self-hosted license usage observations to Roomote Cloud. */
+export async function licenseUsageSyncJob(options?: {
+  heartbeat?: boolean;
+}): Promise<void> {
+  if (options?.heartbeat) {
+    await recordDailyLicenseUsageObservation();
+  }
+
+  let transientFailure = false;
+  for (const observation of await listPendingLicenseUsageObservations()) {
+    await markLicenseUsageObservationAttempt(observation.id);
+    const result = await syncLicenseWithCloud({
+      eventId: observation.id,
+      observedAt: observation.observedAt,
+      activeUsers: observation.activeUsers,
+    });
+
+    if (result.status === 'synced' || result.status === 'not_licensed') {
+      await markLicenseUsageObservationDelivered(observation.id);
+      continue;
+    }
+
+    if (result.status === 'license_in_use' || result.status === 'rejected') {
+      console.warn(
+        `[license-usage] observation ${observation.id} was rejected (${result.status})`,
+      );
+      await markLicenseUsageObservationDelivered(observation.id);
+      continue;
+    }
+
+    transientFailure = true;
+  }
+
+  if (transientFailure) {
+    throw new Error('License usage delivery failed');
+  }
+}
diff --git a/apps/bullmq/src/scheduler.ts b/apps/bullmq/src/scheduler.ts
index 85e01a955..68070f36b 100644
--- a/apps/bullmq/src/scheduler.ts
+++ b/apps/bullmq/src/scheduler.ts
@@ -27,6 +27,7 @@ import {
   refreshSnapshotsJob,
   pullRequestAnalyticsSyncJob,
   instancePingJob,
+  licenseUsageSyncJob,
   webhookCleanupJob,
   standbyRetentionJob,
 } from './scheduled-jobs';
@@ -161,6 +162,24 @@ async function createJobs(queue: Queue): Promise<void> {
     { every: 24 * 60 * 60 * 1000 }, // Every 24 hours.
   );
 
+  await queue.upsertJobScheduler(
+    ScheduledJobName.LicenseUsageSync,
+    { every: 15 * 60 * 1000 }, // Drain durable usage observations promptly.
+  );
+
+  await queue.upsertJobScheduler(
+    ScheduledJobName.LicenseUsageHeartbeat,
+    { every: 24 * 60 * 60 * 1000 }, // Daily billing liveness observation.
+  );
+
+  // An environment-provided license has no Settings mutation to trigger an
+  // activation request, so establish or renew its Cloud lease at startup.
+  await queue.add(
+    ScheduledJobName.LicenseUsageHeartbeat,
+    { reason: 'scheduler-startup' },
+    { jobId: `license-usage-startup-${Date.now()}` },
+  );
+
   await queue.upsertJobScheduler(
     ScheduledJobName.WebhookCleanup,
     { every: 24 * 60 * 60 * 1000 }, // Every 24 hours.
@@ -189,6 +208,10 @@ const runJobs = async (job: ScheduledJob): Promise<void> => {
       return pullRequestAnalyticsSyncJob(job.data ?? {});
     case ScheduledJobName.InstancePing:
       return instancePingJob();
+    case ScheduledJobName.LicenseUsageSync:
+      return licenseUsageSyncJob();
+    case ScheduledJobName.LicenseUsageHeartbeat:
+      return licenseUsageSyncJob({ heartbeat: true });
     case ScheduledJobName.WebhookCleanup:
       return webhookCleanupJob();
     case ScheduledJobName.StandbyRetention:
diff --git a/apps/bullmq/src/types.ts b/apps/bullmq/src/types.ts
index 9a0e1f163..c63a24cfd 100644
--- a/apps/bullmq/src/types.ts
+++ b/apps/bullmq/src/types.ts
@@ -9,6 +9,8 @@ export enum ScheduledJobName {
   SleepCheck = 'SleepCheck',
   PullRequestAnalyticsSync = 'PullRequestAnalyticsSync',
   InstancePing = 'InstancePing',
+  LicenseUsageSync = 'LicenseUsageSync',
+  LicenseUsageHeartbeat = 'LicenseUsageHeartbeat',
   WebhookCleanup = 'WebhookCleanup',
   StandbyRetention = 'StandbyRetention',
   CustomAutomations = 'custom_automations',
diff --git a/apps/docs/index.mdx b/apps/docs/index.mdx
index 952a68195..4b7cdd590 100644
--- a/apps/docs/index.mdx
+++ b/apps/docs/index.mdx
@@ -54,7 +54,10 @@ Roomote is released under the Fair Core License 1.0 (FCL-1.0-ALv2) —
 source-available, with each release converting to Apache-2.0 two years after it
 is published. A deployment is free for up to 10 registered users;
 adding more users requires a paid license key (Settings → Users, or the
-`R_LICENSE_KEY` environment variable). The license prohibits disabling or
+`R_LICENSE_KEY` environment variable). You can [buy a self-hosted license on
+Roomote Cloud](https://cloud.roomote.dev/sign-up); purchased keys are refreshed
+annually from the Cloud portal, and licensed deployments report their current
+user count for subscription billing. The license prohibits disabling or
 circumventing the license key functionality. See
 the [LICENSE](https://github.com/RooCodeInc/Roomote/blob/main/LICENSE)
 file for details.
diff --git a/apps/docs/users.mdx b/apps/docs/users.mdx
index f4bd0e2ac..f8a87af5b 100644
--- a/apps/docs/users.mdx
+++ b/apps/docs/users.mdx
@@ -66,15 +66,29 @@ A Roomote deployment is free for up to 10 users. Every registered user
 account in the deployment counts toward the limit, whichever sign-in path or
 surface they use. Removed users free their seat.
 
-To add more than 10 users, apply a license key from the Roomote maintainers in
-either of these ways:
+To add more than 10 users, [buy a self-hosted license on Roomote
+Cloud](https://cloud.roomote.dev/sign-up), then apply its key in either of these
+ways:
 
 - enter it in **Settings > Users > License** as an admin, or
 - set `R_LICENSE_KEY` on the deployment (for example in Compose / `.env.production`);
   when that env var is set, it takes precedence over any key stored in Settings
 
-The License section shows the current seat usage, license status, and licensee.
-Keys are verified offline; the deployment never contacts a license server.
+The License section shows the current seat usage, license status, licensee, and
+expiry date. Purchased keys are issued annually and can be refreshed from the
+Roomote Cloud portal while the subscription is active. Replace the key in
+Settings or `R_LICENSE_KEY` after refreshing it.
+
+Keys are signature-verified locally, then activated with Roomote Cloud for the
+deployment's stable installation ID. A paid seat limit remains active while
+the Cloud activation lease is current (up to 72 hours); without it, the
+deployment uses the free-seat limit. Roomote Cloud records the current user
+count and short-lived peaks for subscription billing, independently of
+anonymous analytics. License usage is not sent to the Ping analytics service.
+
+Each license may be active on one deployment at a time. If you move a
+deployment, contact Roomote support to reset the existing activation before
+using its license key on the replacement.
 
 When all seats are in use, existing users keep working normally — only new
 sign-ups are blocked until a seat is freed by removing a user or a license key
diff --git a/apps/web/src/components/settings/UsersSettings.client.test.tsx b/apps/web/src/components/settings/UsersSettings.client.test.tsx
index 63819abd7..859b5937e 100644
--- a/apps/web/src/components/settings/UsersSettings.client.test.tsx
+++ b/apps/web/src/components/settings/UsersSettings.client.test.tsx
@@ -36,6 +36,7 @@ type LicenseSummary = {
   seatLimit: number;
   seatsUsed: number;
   freeSeatLimit: number;
+  licenseId: string | null;
   licensee: string | null;
   expiresAt: Date | null;
   fromEnv: boolean;
@@ -46,6 +47,7 @@ const unlicensedLicense: LicenseSummary = {
   seatLimit: 10,
   seatsUsed: 1,
   freeSeatLimit: 10,
+  licenseId: null,
   licensee: null,
   expiresAt: null,
   fromEnv: false,
@@ -76,6 +78,7 @@ const {
   mockCreatePasswordResetLink,
   mockSetLicenseKey,
   mockClipboardWriteText,
+  mockCapture,
 } = vi.hoisted(() => ({
   mockAuthorizedUser: {
     current: { userId: 'user-1', cloudEnabled: false },
@@ -92,6 +95,7 @@ const {
         seatLimit: 10,
         seatsUsed: 1,
         freeSeatLimit: 10,
+        licenseId: null,
         licensee: null,
         expiresAt: null,
         fromEnv: false,
@@ -156,6 +160,7 @@ const {
     saved: true,
   })),
   mockClipboardWriteText: vi.fn(async (_value: string) => undefined),
+  mockCapture: vi.fn(),
 }));
 
 vi.mock('sonner', () => ({
@@ -167,6 +172,11 @@ vi.mock('sonner', () => ({
 
 vi.mock('@/hooks/useUser', () => ({
   useAuthorizedUser: () => mockAuthorizedUser.current,
+  useUser: () => ({ user: { anonymousAnalyticsEnabled: true } }),
+}));
+
+vi.mock('@/hooks/useTelemetry', () => ({
+  useTelemetry: () => ({ capture: mockCapture, enabled: true }),
 }));
 
 vi.mock('@/trpc/client', () => ({
@@ -626,6 +636,19 @@ describe('UsersSettings', () => {
 
     expect(await screen.findByText('4 of 10 seats used')).toBeInTheDocument();
     expect(screen.getByText('Free tier')).toBeInTheDocument();
+    const purchaseLink = screen.getByRole('link', {
+      name: 'Buy a license on Roomote Cloud',
+    });
+    expect(purchaseLink).toHaveAttribute(
+      'href',
+      'https://cloud.roomote.dev/sign-up?utm_source=self-host&utm_medium=settings_users&utm_campaign=license_purchase',
+    );
+    fireEvent.click(purchaseLink);
+    expect(mockCapture).toHaveBeenCalledWith('license_purchase_cta_clicked', {
+      seatsUsed: 4,
+      seatLimit: 10,
+      licenseStatus: 'unlicensed',
+    });
     expect(
       screen.queryByRole('button', { name: 'Remove key' }),
     ).not.toBeInTheDocument();
@@ -655,6 +678,9 @@ describe('UsersSettings', () => {
     expect(screen.getByText('Users')).toBeInTheDocument();
     expect(screen.queryByText('License')).not.toBeInTheDocument();
     expect(screen.queryByLabelText('License key')).not.toBeInTheDocument();
+    expect(
+      screen.queryByRole('link', { name: 'Buy a license on Roomote Cloud' }),
+    ).not.toBeInTheDocument();
   });
 
   it('shows licensed state, at-limit warning, and removes the key', async () => {
@@ -665,6 +691,7 @@ describe('UsersSettings', () => {
         seatLimit: 25,
         seatsUsed: 25,
         freeSeatLimit: 10,
+        licenseId: 'lic_manual',
         licensee: 'Acme Corp',
         expiresAt: null,
         fromEnv: false,
@@ -677,6 +704,12 @@ describe('UsersSettings', () => {
     expect(screen.getByText('25 of 25 seats used')).toBeInTheDocument();
     expect(screen.getByText(/Licensed to Acme Corp/)).toBeInTheDocument();
     expect(screen.getByText(/All seats are in use/)).toBeInTheDocument();
+    expect(
+      screen.getByRole('button', { name: 'Create invite' }),
+    ).toBeDisabled();
+
+    fireEvent.submit(screen.getByLabelText(/Label/).closest('form')!);
+    expect(mockCreateInvite).not.toHaveBeenCalled();
 
     fireEvent.click(screen.getByRole('button', { name: 'Remove key' }));
 
@@ -696,6 +729,7 @@ describe('UsersSettings', () => {
         seatLimit: 50,
         seatsUsed: 4,
         freeSeatLimit: 10,
+        licenseId: 'lic_manual',
         licensee: 'Acme Corp',
         expiresAt: null,
         fromEnv: true,
@@ -723,4 +757,29 @@ describe('UsersSettings', () => {
       screen.queryByRole('button', { name: 'Remove key' }),
     ).not.toBeInTheDocument();
   });
+
+  it('points purchased licenses to the Cloud portal when expiry is near', async () => {
+    mockSettingsState.current = {
+      ...mockSettingsState.current,
+      license: {
+        status: 'valid',
+        seatLimit: 100,
+        seatsUsed: 20,
+        freeSeatLimit: 10,
+        licenseId: 'lic_sh_123',
+        licensee: 'Engineering',
+        expiresAt: new Date(Date.now() + 20 * 24 * 60 * 60 * 1000),
+        fromEnv: false,
+      },
+    };
+
+    renderUsersSettings();
+
+    expect(
+      await screen.findByText('This license expires soon.', { exact: false }),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole('link', { name: 'Refresh the key in Roomote Cloud' }),
+    ).toHaveAttribute('href', 'https://cloud.roomote.dev/');
+  });
 });
diff --git a/apps/web/src/components/settings/UsersSettings.tsx b/apps/web/src/components/settings/UsersSettings.tsx
index 3aa58240b..c075f7965 100644
--- a/apps/web/src/components/settings/UsersSettings.tsx
+++ b/apps/web/src/components/settings/UsersSettings.tsx
@@ -5,6 +5,7 @@ import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import { toast } from 'sonner';
 
 import { useAuthorizedUser } from '@/hooks/useUser';
+import { useTelemetry } from '@/hooks/useTelemetry';
 import { useTRPC } from '@/trpc/client';
 import {
   AlertCircle,
@@ -40,6 +41,11 @@ import {
 import { Section } from '@/components/settings';
 import { formatDistanceToNow } from 'date-fns';
 
+const LICENSE_PURCHASE_URL =
+  'https://cloud.roomote.dev/sign-up?utm_source=self-host&utm_medium=settings_users&utm_campaign=license_purchase';
+const LICENSE_PORTAL_URL = 'https://cloud.roomote.dev/';
+const LICENSE_EXPIRY_WARNING_MS = 30 * 24 * 60 * 60 * 1000;
+
 function formatJoinedDate(value: Date | string | null): string {
   if (!value) {
     return '—';
@@ -72,6 +78,7 @@ export function UsersSettings() {
   const trpc = useTRPC();
   const queryClient = useQueryClient();
   const { userId: currentUserId, cloudEnabled } = useAuthorizedUser();
+  const { capture } = useTelemetry();
   const settingsQueryKey = trpc.accessPolicy.get.queryKey();
   const settingsQuery = useQuery(trpc.accessPolicy.get.queryOptions());
   const [label, setLabel] = useState('');
@@ -246,6 +253,13 @@ export function UsersSettings() {
   const adminCount = members.filter((member) => member.role === 'admin').length;
   const visibleInvites = invites.filter((invite) => invite.revokedAt == null);
   const seatsRemaining = license.seatLimit - license.seatsUsed;
+  const isAtSeatCapacity = seatsRemaining <= 0;
+  const purchasedLicenseExpiringSoon =
+    license.status === 'valid' &&
+    license.licenseId?.startsWith('lic_sh_') === true &&
+    license.expiresAt != null &&
+    new Date(license.expiresAt).getTime() - Date.now() <=
+      LICENSE_EXPIRY_WARNING_MS;
   const licenseBadge =
     license.status === 'valid' ? (
       <Badge variant="success">Licensed</Badge>
@@ -269,10 +283,29 @@ export function UsersSettings() {
     setLicenseKey.mutate({ licenseKey });
   };
 
+  const licensePurchaseButton = (
+    <Button asChild size="sm" variant="outline">
+      <a
+        href={LICENSE_PURCHASE_URL}
+        target="_blank"
+        rel="noreferrer"
+        onClick={() =>
+          capture('license_purchase_cta_clicked', {
+            seatsUsed: license.seatsUsed,
+            seatLimit: license.seatLimit,
+            licenseStatus: license.status,
+          })
+        }
+      >
+        Buy a license on Roomote Cloud
+      </a>
+    </Button>
+  );
+
   const handleCreate = (event?: FormEvent<HTMLFormElement>) => {
     event?.preventDefault();
 
-    if (createInvite.isPending) {
+    if (createInvite.isPending || isAtSeatCapacity) {
       return;
     }
 
@@ -308,19 +341,43 @@ export function UsersSettings() {
               </p>
             </div>
 
-            {seatsRemaining <= 0 ? (
-              <div className="flex items-start gap-2 rounded-lg border border-destructive/30 bg-destructive/5 p-3 text-sm text-destructive">
+            {seatsRemaining <= 1 ? (
+              <div className="flex flex-col items-start gap-3 rounded-lg border border-warning/30 bg-warning/5 p-3 text-sm sm:flex-row sm:items-center sm:justify-between">
+                <div className="flex items-start gap-2">
+                  <AlertCircle className="mt-0.5 size-4 shrink-0" />
+                  <p>
+                    {seatsRemaining <= 0
+                      ? 'All seats are in use. New users cannot sign in until a seat is freed or the license limit is raised.'
+                      : 'One seat remaining. Buy a license before inviting more users.'}
+                  </p>
+                </div>
+                {licensePurchaseButton}
+              </div>
+            ) : (
+              <div className="flex flex-col items-start gap-2 sm:flex-row sm:items-center">
+                <p className="text-sm text-muted-foreground">
+                  Need more than {license.freeSeatLimit} users?
+                </p>
+                {licensePurchaseButton}
+              </div>
+            )}
+
+            {purchasedLicenseExpiringSoon ? (
+              <div className="flex items-start gap-2 rounded-lg border border-warning/30 bg-warning/5 p-3 text-sm">
                 <AlertCircle className="mt-0.5 size-4 shrink-0" />
                 <p>
-                  All seats are in use. New users cannot sign in until a seat is
-                  freed or a license key with more seats is added.
+                  This license expires soon.{' '}
+                  <a
+                    className="font-medium underline underline-offset-4"
+                    href={LICENSE_PORTAL_URL}
+                    target="_blank"
+                    rel="noreferrer"
+                  >
+                    Refresh the key in Roomote Cloud
+                  </a>{' '}
+                  and replace it here before it expires.
                 </p>
               </div>
-            ) : seatsRemaining === 1 ? (
-              <p className="text-sm text-muted-foreground">
-                One seat remaining. Add a license key to raise the limit before
-                inviting more users.
-              </p>
             ) : null}
 
             {license.fromEnv ? (
@@ -366,8 +423,8 @@ export function UsersSettings() {
             )}
             <p className="text-sm text-muted-foreground">
               Deployments are free for up to {license.freeSeatLimit} users. A
-              license key from the Roomote maintainers unlocks more seats. You
-              can also set <span className="font-mono">R_LICENSE_KEY</span> in
+              license purchased on Roomote Cloud unlocks more seats. Apply it
+              here or set <span className="font-mono">R_LICENSE_KEY</span> in
               the deployment environment.
             </p>
           </div>
@@ -470,7 +527,10 @@ export function UsersSettings() {
                 disabled={createInvite.isPending}
               />
             </div>
-            <Button type="submit" disabled={createInvite.isPending}>
+            <Button
+              type="submit"
+              disabled={createInvite.isPending || isAtSeatCapacity}
+            >
               {createInvite.isPending ? <Spinner /> : null}
               Create invite
             </Button>
@@ -677,48 +737,55 @@ export function UsersSettings() {
             return (
               <div
                 key={member.id}
-                className="flex items-center gap-3 py-3 first:pt-0 last:pb-0"
+                className="flex flex-col md:flex-row md:items-center md:justify-between gap-3 py-3 first:pt-0 last:pb-0"
               >
-                <Avatar
-                  imageUrl={member.imageUrl}
-                  name={member.name}
-                  email={member.email}
-                  size="md"
-                  alt={member.name || member.email}
-                />
-                <div className="min-w-0 flex-1">
-                  <p className="flex items-center gap-2 text-sm font-medium">
-                    <span className="truncate">
-                      {member.name || member.email}
-                    </span>
-                  </p>
-                  <p className="truncate text-sm text-muted-foreground">
-                    <span>{member.email}</span>
-                    {' · Joined '}
-                    {formatJoinedDate(member.createdAt)}
-                  </p>
+                <div className="flex flex-row gap-3 items-start md:items-center">
+                  <Avatar
+                    imageUrl={member.imageUrl}
+                    name={member.name}
+                    email={member.email}
+                    size="md"
+                    alt={member.name || member.email}
+                  />
+                  <div className="min-w-0 flex-1">
+                    <p className="flex items-center gap-2 text-sm font-medium">
+                      <span className="truncate">
+                        {member.name || member.email}
+                      </span>
+                    </p>
+                    <p className="truncate text-sm text-muted-foreground">
+                      <span>{member.email}</span>
+                      <span className="hidden md:inline"> · </span>
+                      <span className="block md:inline">
+                        {'Joined '}
+                        {formatJoinedDate(member.createdAt)}
+                      </span>
+                    </p>
+                  </div>
+                </div>
+                <div className="flex flex-row gap-3 items-center">
+                  {roleLockReason ? (
+                    <BasicTooltip content={roleLockReason}>
+                      <span>{roleSelect}</span>
+                    </BasicTooltip>
+                  ) : (
+                    roleSelect
+                  )}
+                  {removeLockReason ? (
+                    <BasicTooltip content={removeLockReason}>
+                      <span>{removeButton}</span>
+                    </BasicTooltip>
+                  ) : (
+                    removeButton
+                  )}
+                  {resetLockReason ? (
+                    <BasicTooltip content={resetLockReason}>
+                      <span>{resetButton}</span>
+                    </BasicTooltip>
+                  ) : (
+                    resetButton
+                  )}
                 </div>
-                {roleLockReason ? (
-                  <BasicTooltip content={roleLockReason}>
-                    <span>{roleSelect}</span>
-                  </BasicTooltip>
-                ) : (
-                  roleSelect
-                )}
-                {removeLockReason ? (
-                  <BasicTooltip content={removeLockReason}>
-                    <span>{removeButton}</span>
-                  </BasicTooltip>
-                ) : (
-                  removeButton
-                )}
-                {resetLockReason ? (
-                  <BasicTooltip content={resetLockReason}>
-                    <span>{resetButton}</span>
-                  </BasicTooltip>
-                ) : (
-                  resetButton
-                )}
               </div>
             );
           })}
diff --git a/apps/web/src/lib/server/__tests__/license.test.ts b/apps/web/src/lib/server/__tests__/license.test.ts
index 50a034507..67ef4fd2e 100644
--- a/apps/web/src/lib/server/__tests__/license.test.ts
+++ b/apps/web/src/lib/server/__tests__/license.test.ts
@@ -1,18 +1,5 @@
-vi.mock('@roomote/db/server', () => ({
-  db: {},
-  deploymentSettings: { id: 'deployment_settings.id' },
-  eq: vi.fn(),
-}));
-
-vi.mock('../env', () => ({
-  Env: {
-    R_LICENSE_KEY: undefined as string | undefined,
-  },
-}));
-
 import { generateKeyPairSync, sign } from 'node:crypto';
 
-import { Env } from '../env';
 import {
   FREE_SEAT_LIMIT,
   getEnvLicenseKey,
@@ -20,8 +7,7 @@ import {
   resolveLicenseState,
   verifyLicenseKey,
 } from '../license';
-
-const envMock = Env as { R_LICENSE_KEY: string | undefined };
+import { initializeWebRuntimeEnv } from '../env';
 
 const { privateKey, publicKey } = generateKeyPairSync('ed25519');
 const publicKeySpkiB64 = publicKey
@@ -188,11 +174,18 @@ describe('resolveLicenseState', () => {
 
 describe('resolveConfiguredLicenseKey', () => {
   beforeEach(() => {
-    envMock.R_LICENSE_KEY = undefined;
+    vi.stubEnv('R_LICENSE_KEY', '');
+    initializeWebRuntimeEnv();
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    initializeWebRuntimeEnv();
   });
 
   it('prefers R_LICENSE_KEY when set', () => {
-    envMock.R_LICENSE_KEY = `  ${issueKey(validPayload)}  `;
+    vi.stubEnv('R_LICENSE_KEY', `  ${issueKey(validPayload)}  `);
+    initializeWebRuntimeEnv();
 
     expect(getEnvLicenseKey()).toBe(issueKey(validPayload));
     expect(resolveConfiguredLicenseKey('RMLK1.db-key.signature')).toBe(
diff --git a/apps/web/src/lib/server/__tests__/user-management.test.ts b/apps/web/src/lib/server/__tests__/user-management.test.ts
index 702d4e42a..1e89145e3 100644
--- a/apps/web/src/lib/server/__tests__/user-management.test.ts
+++ b/apps/web/src/lib/server/__tests__/user-management.test.ts
@@ -24,6 +24,7 @@ const { state } = vi.hoisted(() => ({
 
 vi.mock('@roomote/sdk/server/request-instance-ping', () => ({
   requestInstancePing: vi.fn(async () => undefined),
+  requestLicenseUsageSync: vi.fn(async () => undefined),
 }));
 
 vi.mock('../auth', () => ({
@@ -104,6 +105,7 @@ vi.mock('@roomote/db/server', () => {
   const telegramUserMappingsTable = {};
 
   return {
+    recordLicenseUsageObservation: vi.fn(async () => undefined),
     and: vi.fn(),
     authUsers: authUsersTable,
     authAccounts: {},
diff --git a/apps/web/src/lib/server/auth-context.test.ts b/apps/web/src/lib/server/auth-context.test.ts
index 670aadf99..6049f47da 100644
--- a/apps/web/src/lib/server/auth-context.test.ts
+++ b/apps/web/src/lib/server/auth-context.test.ts
@@ -32,6 +32,7 @@ const {
 
 vi.mock('@roomote/sdk/server/request-instance-ping', () => ({
   requestInstancePing: vi.fn(async () => undefined),
+  requestLicenseUsageSync: vi.fn(async () => undefined),
 }));
 
 vi.mock('next/headers', () => ({
@@ -39,6 +40,7 @@ vi.mock('next/headers', () => ({
 }));
 
 vi.mock('@roomote/db/server', () => ({
+  recordLicenseUsageObservation: vi.fn(async () => undefined),
   db: {
     query: {
       deploymentSettings: {
diff --git a/apps/web/src/lib/server/auth-context.ts b/apps/web/src/lib/server/auth-context.ts
index 9ab7fece4..2c61dfdab 100644
--- a/apps/web/src/lib/server/auth-context.ts
+++ b/apps/web/src/lib/server/auth-context.ts
@@ -1,15 +1,25 @@
 import { headers } from 'next/headers';
 import { APIError } from 'better-auth/api';
 
-import { db, deploymentSettings, eq, invites, users } from '@roomote/db/server';
+import {
+  db,
+  deploymentSettings,
+  eq,
+  invites,
+  recordLicenseUsageObservation,
+  users,
+} from '@roomote/db/server';
+import type { UserRole } from '@roomote/types';
 import {
   evaluateFeatureFlagsFromMetadata,
   isAnonymousAnalyticsEnabledFromMetadata,
   normalizeMetadataRecord,
 } from '@roomote/feature-flags';
-import type { UserRole } from '@roomote/types';
 import { getManagedDeploymentAccessFromMetadata } from '@roomote/types';
-import { requestInstancePing } from '@roomote/sdk/server/request-instance-ping';
+import {
+  requestInstancePing,
+  requestLicenseUsageSync,
+} from '@roomote/sdk/server/request-instance-ping';
 import { isTelemetryEnvAllowed } from '@roomote/telemetry/server';
 
 import {
@@ -198,6 +208,7 @@ async function ensureDeploymentIdentity({
       }
 
       if (!invitedByInviteId) {
+        await recordLicenseUsageObservation(tx, now);
         return insertRole;
       }
 
@@ -207,6 +218,7 @@ async function ensureDeploymentIdentity({
         throw new InviteRedemptionFailedError();
       }
 
+      await recordLicenseUsageObservation(tx, now);
       return insertRole;
     });
 
@@ -215,6 +227,7 @@ async function ensureDeploymentIdentity({
     // A new admission changes the instance's user counts; refresh the
     // anonymous report instead of waiting for the daily tick.
     void requestInstancePing('user-admitted');
+    void requestLicenseUsageSync('user-admitted');
   } else {
     // Removal deletes the Better Auth user, so a removed user normally can
     // never reach this branch again. If a soft-deleted row's auth user still
@@ -254,7 +267,9 @@ async function ensureDeploymentIdentity({
           .update(users)
           .set({ ...profileUpdate, deletedAt: null, role })
           .where(eq(users.id, userId));
+        await recordLicenseUsageObservation(tx, now);
       });
+      void requestLicenseUsageSync('user-restored');
     } else if (
       existingUser.name !== name ||
       existingUser.email !== email ||
diff --git a/apps/web/src/lib/server/license.ts b/apps/web/src/lib/server/license.ts
index 944ab88c0..e379cf810 100644
--- a/apps/web/src/lib/server/license.ts
+++ b/apps/web/src/lib/server/license.ts
@@ -1,267 +1,12 @@
-import { createPublicKey, verify as verifySignature } from 'node:crypto';
-
-import {
-  db,
-  type DatabaseOrTransaction,
-  deploymentSettings,
-  eq,
-  isNull,
-  sql,
-  users,
+export {
+  FREE_SEAT_LIMIT,
+  SeatLimitExceededError,
+  assertSeatAvailable,
+  getEffectiveDeploymentSeatLimit,
+  getDeploymentLicenseState,
+  getEnvLicenseKey,
+  hasSeatAvailable,
+  resolveConfiguredLicenseKey,
+  resolveLicenseState,
+  verifyLicenseKey,
 } from '@roomote/db/server';
-
-import { Env } from './env';
-
-const DEFAULT_DEPLOYMENT_ID = 'default';
-
-/**
- * Deployments run free up to this many active (non-deleted) user accounts; a
- * valid license key raises the limit to the key's seat count. This gate is
- * license key functionality under FCL-1.0-ALv2 (see LICENSE, "Limitations"):
- * moving, changing, disabling, or circumventing it is not a permitted use of
- * the Software.
- */
-export const FREE_SEAT_LIMIT = 10;
-
-/** Version prefix for Roomote license keys: RMLK1.<payload>.<signature>. */
-const LICENSE_KEY_PREFIX = 'RMLK1';
-
-/** Ed25519 public half of the Roomote license signing key (SPKI DER, base64). */
-const LICENSE_PUBLIC_KEY_SPKI_B64 =
-  'MCowBQYDK2VwAyEALp8Px1N98T1Gh4a8zbj6EnpyWbxF3VJNqTKmXvxK8xc=';
-
-type LicensePayload = {
-  /** Stable identifier for the issued license, e.g. "lic_ab12cd34". */
-  licenseId: string;
-  /** Display name of the license holder. */
-  licensee: string;
-  /** Total active user accounts the deployment may have. */
-  maxSeats: number;
-  issuedAt: Date;
-  /** Null for perpetual licenses. */
-  expiresAt: Date | null;
-};
-
-type DeploymentLicenseState =
-  | { status: 'unlicensed'; seatLimit: number }
-  | { status: 'invalid'; seatLimit: number }
-  | ({ status: 'valid' | 'expired'; seatLimit: number } & LicensePayload);
-
-function parseIsoDate(value: unknown): Date | null {
-  if (typeof value !== 'string') {
-    return null;
-  }
-
-  const date = new Date(value);
-
-  return Number.isNaN(date.getTime()) ? null : date;
-}
-
-/**
- * Verify a license key's signature and shape. Returns the signed payload, or
- * null when the key is malformed or not signed by the Roomote licensing key.
- * Expiry is not checked here; callers decide what an expired license means.
- */
-export function verifyLicenseKey(
-  licenseKey: string,
-  publicKeySpkiB64: string = LICENSE_PUBLIC_KEY_SPKI_B64,
-): LicensePayload | null {
-  const [prefix, payloadB64, signatureB64, ...rest] = licenseKey
-    .trim()
-    .split('.');
-
-  if (
-    prefix !== LICENSE_KEY_PREFIX ||
-    !payloadB64 ||
-    !signatureB64 ||
-    rest.length > 0
-  ) {
-    return null;
-  }
-
-  let payload: Record<string, unknown>;
-
-  try {
-    const payloadBytes = Buffer.from(payloadB64, 'base64url');
-    const signature = Buffer.from(signatureB64, 'base64url');
-    const publicKey = createPublicKey({
-      key: Buffer.from(publicKeySpkiB64, 'base64'),
-      format: 'der',
-      type: 'spki',
-    });
-
-    if (!verifySignature(null, payloadBytes, publicKey, signature)) {
-      return null;
-    }
-
-    payload = JSON.parse(payloadBytes.toString('utf8')) as Record<
-      string,
-      unknown
-    >;
-  } catch {
-    return null;
-  }
-
-  const issuedAt = parseIsoDate(payload.issuedAt);
-  const expiresAt =
-    payload.expiresAt == null ? null : parseIsoDate(payload.expiresAt);
-
-  if (
-    typeof payload.licenseId !== 'string' ||
-    !payload.licenseId ||
-    typeof payload.licensee !== 'string' ||
-    !payload.licensee ||
-    typeof payload.maxSeats !== 'number' ||
-    !Number.isInteger(payload.maxSeats) ||
-    payload.maxSeats < 1 ||
-    issuedAt == null ||
-    (payload.expiresAt != null && expiresAt == null)
-  ) {
-    return null;
-  }
-
-  return {
-    licenseId: payload.licenseId,
-    licensee: payload.licensee,
-    maxSeats: payload.maxSeats,
-    issuedAt,
-    expiresAt,
-  };
-}
-
-/**
- * Resolve a stored license key (or its absence) into the deployment's seat
- * limit. Expired and invalid keys fall back to the free limit rather than
- * locking anyone out; the gate only ever blocks adding users beyond the limit.
- */
-export function resolveLicenseState(
-  licenseKey: string | null | undefined,
-  now: Date = new Date(),
-  publicKeySpkiB64: string = LICENSE_PUBLIC_KEY_SPKI_B64,
-): DeploymentLicenseState {
-  if (!licenseKey || !licenseKey.trim()) {
-    return { status: 'unlicensed', seatLimit: FREE_SEAT_LIMIT };
-  }
-
-  const payload = verifyLicenseKey(licenseKey, publicKeySpkiB64);
-
-  if (!payload) {
-    return { status: 'invalid', seatLimit: FREE_SEAT_LIMIT };
-  }
-
-  if (
-    payload.expiresAt != null &&
-    payload.expiresAt.getTime() <= now.getTime()
-  ) {
-    return { ...payload, status: 'expired', seatLimit: FREE_SEAT_LIMIT };
-  }
-
-  return {
-    ...payload,
-    status: 'valid',
-    seatLimit: Math.max(payload.maxSeats, FREE_SEAT_LIMIT),
-  };
-}
-
-/**
- * Operator-owned license key from `R_LICENSE_KEY`, when set. Takes precedence
- * over the key stored in deployment_settings so self-hosted deploys can
- * provision licensing via their secret store / Compose env without using the
- * Settings UI.
- */
-export function getEnvLicenseKey(): string | null {
-  const value = Env.R_LICENSE_KEY?.trim();
-  return value || null;
-}
-
-/**
- * Effective license key for the deployment: env var when present, otherwise
- * the DB-backed Settings → Users key.
- */
-export function resolveConfiguredLicenseKey(
-  storedLicenseKey: string | null | undefined,
-): string | null {
-  return getEnvLicenseKey() ?? (storedLicenseKey?.trim() || null);
-}
-
-/**
- * Read the deployment's license key and resolve its state. Pass a transaction
- * to read the settings row under that transaction's locks (the seat gate does
- * this with the row locked FOR UPDATE to serialize concurrent admissions).
- */
-export async function getDeploymentLicenseState(
-  executor: DatabaseOrTransaction = db,
-): Promise<DeploymentLicenseState> {
-  const envLicenseKey = getEnvLicenseKey();
-  if (envLicenseKey) {
-    return resolveLicenseState(envLicenseKey);
-  }
-
-  const [settings] = await executor
-    .select({ licenseKey: deploymentSettings.licenseKey })
-    .from(deploymentSettings)
-    .where(eq(deploymentSettings.id, DEFAULT_DEPLOYMENT_ID))
-    .limit(1);
-
-  return resolveLicenseState(settings?.licenseKey);
-}
-
-/** Thrown to roll back user creation when the deployment is at its seat limit. */
-export class SeatLimitExceededError extends Error {
-  constructor(seatLimit: number) {
-    super(
-      `This deployment has reached its licensed limit of ${seatLimit} users.`,
-    );
-    this.name = 'SeatLimitExceededError';
-  }
-}
-
-/**
- * Read-only seat availability check for UX gates (e.g. rejecting sign-up
- * before an auth user is created, so the form can show the seat-limit error
- * inline). Takes no lock; the authoritative gate is assertSeatAvailable()
- * inside the admission transaction.
- */
-export async function hasSeatAvailable(): Promise<boolean> {
-  const [licenseState, [activeUsers]] = await Promise.all([
-    getDeploymentLicenseState(),
-    db
-      .select({ count: sql<number>`count(*)::int` })
-      .from(users)
-      .where(isNull(users.deletedAt)),
-  ]);
-
-  return (activeUsers?.count ?? 0) < licenseState.seatLimit;
-}
-
-/**
- * The seat gate (license key functionality under FCL-1.0-ALv2): throws
- * SeatLimitExceededError unless the deployment has a free seat for one more
- * active user. Must run inside the transaction that admits the user — it
- * locks the deployment_settings row FOR UPDATE so concurrent admissions
- * serialize on the count and cannot pass the gate together.
- */
-export async function assertSeatAvailable(
-  tx: DatabaseOrTransaction,
-): Promise<void> {
-  // Still lock the settings row so concurrent admissions serialize even when
-  // the license key itself comes from R_LICENSE_KEY rather than the DB.
-  const [settings] = await tx
-    .select({ licenseKey: deploymentSettings.licenseKey })
-    .from(deploymentSettings)
-    .where(eq(deploymentSettings.id, DEFAULT_DEPLOYMENT_ID))
-    .for('update');
-
-  const [activeUsers] = await tx
-    .select({ count: sql<number>`count(*)::int` })
-    .from(users)
-    .where(isNull(users.deletedAt));
-
-  const licenseState = resolveLicenseState(
-    resolveConfiguredLicenseKey(settings?.licenseKey),
-  );
-
-  if ((activeUsers?.count ?? 0) >= licenseState.seatLimit) {
-    throw new SeatLimitExceededError(licenseState.seatLimit);
-  }
-}
diff --git a/apps/web/src/lib/server/user-management.ts b/apps/web/src/lib/server/user-management.ts
index 0e44d1d0e..5a7e2d964 100644
--- a/apps/web/src/lib/server/user-management.ts
+++ b/apps/web/src/lib/server/user-management.ts
@@ -7,11 +7,15 @@ import {
   eq,
   isNull,
   ne,
+  recordLicenseUsageObservation,
   slackUserMappings,
   telegramUserMappings,
   users,
 } from '@roomote/db/server';
-import { requestInstancePing } from '@roomote/sdk/server/request-instance-ping';
+import {
+  requestInstancePing,
+  requestLicenseUsageSync,
+} from '@roomote/sdk/server/request-instance-ping';
 import type { UserRole } from '@roomote/types';
 
 import {
@@ -175,6 +179,8 @@ export async function removeUser({
       .set({ deletedAt: now, updatedAt: now })
       .where(eq(users.id, targetUserId));
 
+    await recordLicenseUsageObservation(tx, now);
+
     await tx
       .delete(slackUserMappings)
       .where(eq(slackUserMappings.userId, targetUserId));
@@ -192,6 +198,7 @@ export async function removeUser({
     // A removal changes the instance's user counts; refresh the anonymous
     // report instead of waiting for the daily tick.
     void requestInstancePing('user-removed');
+    void requestLicenseUsageSync('user-removed');
   }
 
   return result;
diff --git a/apps/web/src/trpc/commands/access-policy/index.test.ts b/apps/web/src/trpc/commands/access-policy/index.test.ts
index f1e77494b..bd870367a 100644
--- a/apps/web/src/trpc/commands/access-policy/index.test.ts
+++ b/apps/web/src/trpc/commands/access-policy/index.test.ts
@@ -70,6 +70,7 @@ vi.mock('@/lib/server', () => ({
     status: 'unlicensed',
     seatLimit: 10,
   })),
+  getEffectiveDeploymentSeatLimit: vi.fn(async () => 10),
   getEnvLicenseKey: getEnvLicenseKeyMock,
   isInviteUsable: vi.fn(() => true),
   listInvites: vi.fn(async () => []),
diff --git a/apps/web/src/trpc/commands/access-policy/index.ts b/apps/web/src/trpc/commands/access-policy/index.ts
index 9af2a9ac5..09cef036f 100644
--- a/apps/web/src/trpc/commands/access-policy/index.ts
+++ b/apps/web/src/trpc/commands/access-policy/index.ts
@@ -1,6 +1,7 @@
 import {
   and,
   authAccounts,
+  collectLicensedUserCount,
   db,
   deploymentSettings,
   eq,
@@ -8,8 +9,9 @@ import {
   isNull,
   users,
 } from '@roomote/db/server';
+import { randomUUID } from 'node:crypto';
 import type { UserRole } from '@roomote/types';
-import { captureEvent } from '@roomote/telemetry/server';
+import { captureEvent, syncLicenseWithCloud } from '@roomote/telemetry/server';
 
 import type { UserAuthSuccess } from '@/types';
 import {
@@ -18,6 +20,7 @@ import {
   createInvite,
   FREE_SEAT_LIMIT,
   getDeploymentAccessPolicy,
+  getEffectiveDeploymentSeatLimit,
   getDeploymentLicenseState,
   getEnvLicenseKey,
   isInviteUsable,
@@ -106,6 +109,7 @@ type LicenseSummary = {
   seatLimit: number;
   seatsUsed: number;
   freeSeatLimit: number;
+  licenseId: string | null;
   licensee: string | null;
   expiresAt: Date | null;
   /** True when `R_LICENSE_KEY` supplies the active key (UI cannot override). */
@@ -124,21 +128,29 @@ export async function getAccessPolicySettingsCommand(
 }> {
   assertAdmin(auth);
 
-  const [policy, providerConfig, invites, activeUsers, licenseState] =
-    await Promise.all([
-      getDeploymentAccessPolicy(),
-      resolveAuthProviderConfig(),
-      listInvites(),
-      listActiveUsers(),
-      getDeploymentLicenseState(),
-    ]);
+  const [
+    policy,
+    providerConfig,
+    invites,
+    activeUsers,
+    licenseState,
+    seatLimit,
+  ] = await Promise.all([
+    getDeploymentAccessPolicy(),
+    resolveAuthProviderConfig(),
+    listInvites(),
+    listActiveUsers(),
+    getDeploymentLicenseState(),
+    getEffectiveDeploymentSeatLimit(),
+  ]);
 
   return {
     license: {
       status: licenseState.status,
-      seatLimit: licenseState.seatLimit,
+      seatLimit,
       seatsUsed: activeUsers.length,
       freeSeatLimit: FREE_SEAT_LIMIT,
+      licenseId: 'licenseId' in licenseState ? licenseState.licenseId : null,
       licensee: 'licensee' in licenseState ? licenseState.licensee : null,
       expiresAt: 'expiresAt' in licenseState ? licenseState.expiresAt : null,
       fromEnv: getEnvLicenseKey() != null,
@@ -193,14 +205,43 @@ export async function setLicenseKeyCommand(
 
     if (state.status === 'expired') {
       throw new Error(
-        'That license key has expired. Contact Roomote for a renewal.',
+        'That license key has expired. Refresh it in Roomote Cloud or contact Roomote for help.',
       );
     }
+
+    const usage = await collectLicensedUserCount();
+    const activation = await syncLicenseWithCloud({
+      eventId: randomUUID(),
+      observedAt: new Date(),
+      activeUsers: usage.users.total,
+      licenseKey,
+    });
+    if (activation.status === 'license_in_use') {
+      throw new Error(
+        'That license is already active on another deployment. Contact Roomote support to transfer it.',
+      );
+    }
+    if (activation.status === 'rejected') {
+      throw new Error(
+        'Roomote Cloud rejected the activation response. Contact Roomote support if this continues.',
+      );
+    }
+    if (activation.status !== 'synced') {
+      throw new Error(
+        'Roomote Cloud could not activate this license. Check your network connection and try again.',
+      );
+    }
+  }
+
+  if (licenseKey != null) {
+    // syncLicenseWithCloud persists the new key and its Cloud lease in one
+    // guarded update, so a stale scheduled sync cannot restore an old lease.
+    return { saved: true };
   }
 
   await db
     .update(deploymentSettings)
-    .set({ licenseKey, updatedAt: new Date() })
+    .set({ licenseKey: null, licenseCloudState: null, updatedAt: new Date() })
     .where(eq(deploymentSettings.id, DEFAULT_DEPLOYMENT_ID));
 
   return { saved: true };
diff --git a/knip.ts b/knip.ts
index 38db1c0a4..7bee864c5 100644
--- a/knip.ts
+++ b/knip.ts
@@ -50,9 +50,6 @@ const config: KnipConfig = {
         'src/**/*.stories.{ts,tsx}',
       ],
       project: ['src/**/*.{ts,tsx}'],
-      // Public capture API for anonymous analytics; kept available for
-      // product code even before the first in-repo consumer lands.
-      ignore: ['src/hooks/useTelemetry.ts'],
       // Used to satisfy vulnerable peer resolution edges in Storybook/Sentry, not imported directly.
       ignoreDependencies: ['webpack'],
     },
diff --git a/packages/db/drizzle/0028_aspiring_thena.sql b/packages/db/drizzle/0028_aspiring_thena.sql
new file mode 100644
index 000000000..ad0a00b33
--- /dev/null
+++ b/packages/db/drizzle/0028_aspiring_thena.sql
@@ -0,0 +1,13 @@
+CREATE TABLE "license_usage_observations" (
+	"id" text PRIMARY KEY NOT NULL,
+	"observed_at" timestamp NOT NULL,
+	"active_users" integer NOT NULL,
+	"delivered_at" timestamp,
+	"attempts" integer DEFAULT 0 NOT NULL,
+	"last_attempted_at" timestamp,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "deployment_settings" ADD COLUMN "license_cloud_state" jsonb;--> statement-breakpoint
+CREATE INDEX "license_usage_observations_pending_idx" ON "license_usage_observations" USING btree ("delivered_at","observed_at");
\ No newline at end of file
diff --git a/packages/db/drizzle/meta/0028_snapshot.json b/packages/db/drizzle/meta/0028_snapshot.json
new file mode 100644
index 000000000..df326fdcb
--- /dev/null
+++ b/packages/db/drizzle/meta/0028_snapshot.json
@@ -0,0 +1,10019 @@
+{
+  "id": "bbf7530d-0d50-4529-8e58-243a150a5b55",
+  "prevId": "7ac28ef9-b3cd-4628-9b9e-b7ed6d608c2a",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.auth_accounts": {
+      "name": "auth_accounts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "auth_accounts_user_id_idx": {
+          "name": "auth_accounts_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "auth_accounts_provider_account_unique": {
+          "name": "auth_accounts_provider_account_unique",
+          "columns": [
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "auth_accounts_user_id_auth_users_id_fk": {
+          "name": "auth_accounts_user_id_auth_users_id_fk",
+          "tableFrom": "auth_accounts",
+          "tableTo": "auth_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.auth_sessions": {
+      "name": "auth_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "auth_sessions_token_unique": {
+          "name": "auth_sessions_token_unique",
+          "columns": [
+            {
+              "expression": "token",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "auth_sessions_user_id_idx": {
+          "name": "auth_sessions_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "auth_sessions_user_id_auth_users_id_fk": {
+          "name": "auth_sessions_user_id_auth_users_id_fk",
+          "tableFrom": "auth_sessions",
+          "tableTo": "auth_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.auth_users": {
+      "name": "auth_users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "auth_users_email_unique": {
+          "name": "auth_users_email_unique",
+          "columns": [
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "auth_users_created_at_idx": {
+          "name": "auth_users_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.auth_verifications": {
+      "name": "auth_verifications",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "auth_verifications_identifier_idx": {
+          "name": "auth_verifications_identifier_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.automations": {
+      "name": "automations",
+      "schema": "",
+      "columns": {
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "internal": {
+          "name": "internal",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "schedule": {
+          "name": "schedule",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "instructions": {
+          "name": "instructions",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "settings": {
+          "name": "settings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "targets": {
+          "name": "targets",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "last_run_at": {
+          "name": "last_run_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_succeeded_at": {
+          "name": "last_succeeded_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_failed_at": {
+          "name": "last_failed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scan_cursor": {
+          "name": "scan_cursor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.compute_provider_usage": {
+      "name": "compute_provider_usage",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_usage_id": {
+          "name": "provider_usage_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "auth_kind": {
+          "name": "auth_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "task_id": {
+          "name": "task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "instance_id": {
+          "name": "instance_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "launch_mode": {
+          "name": "launch_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lifecycle_action": {
+          "name": "lifecycle_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "measurement_source": {
+          "name": "measurement_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "configured_vcpus": {
+          "name": "configured_vcpus",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "configured_cpu_cores": {
+          "name": "configured_cpu_cores",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "configured_memory_mib": {
+          "name": "configured_memory_mib",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "wall_clock_duration_ms": {
+          "name": "wall_clock_duration_ms",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "active_cpu_duration_ms": {
+          "name": "active_cpu_duration_ms",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "observed_memory_mib_milliseconds": {
+          "name": "observed_memory_mib_milliseconds",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "network_ingress_bytes": {
+          "name": "network_ingress_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "network_egress_bytes": {
+          "name": "network_egress_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "compute_provider_usage_provider_usage_id_unique": {
+          "name": "compute_provider_usage_provider_usage_id_unique",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_usage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "compute_provider_usage_run_id_idx": {
+          "name": "compute_provider_usage_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "compute_provider_usage_task_id_idx": {
+          "name": "compute_provider_usage_task_id_idx",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "compute_provider_usage_created_at_idx": {
+          "name": "compute_provider_usage_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "compute_provider_usage_run_id_task_runs_id_fk": {
+          "name": "compute_provider_usage_run_id_task_runs_id_fk",
+          "tableFrom": "compute_provider_usage",
+          "tableTo": "task_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "compute_provider_usage_task_id_tasks_id_fk": {
+          "name": "compute_provider_usage_task_id_tasks_id_fk",
+          "tableFrom": "compute_provider_usage",
+          "tableTo": "tasks",
+          "columnsFrom": ["task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.compute_provider_usage_samples": {
+      "name": "compute_provider_usage_samples",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_usage_id": {
+          "name": "provider_usage_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "task_id": {
+          "name": "task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "instance_id": {
+          "name": "instance_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sampled_at": {
+          "name": "sampled_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cpu_usage_ns_total": {
+          "name": "cpu_usage_ns_total",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "memory_usage_bytes": {
+          "name": "memory_usage_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "memory_peak_usage_bytes": {
+          "name": "memory_peak_usage_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "compute_provider_usage_samples_provider_usage_sampled_at_unique": {
+          "name": "compute_provider_usage_samples_provider_usage_sampled_at_unique",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_usage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sampled_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "compute_provider_usage_samples_run_id_idx": {
+          "name": "compute_provider_usage_samples_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "compute_provider_usage_samples_task_id_idx": {
+          "name": "compute_provider_usage_samples_task_id_idx",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "compute_provider_usage_samples_created_at_idx": {
+          "name": "compute_provider_usage_samples_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "compute_provider_usage_samples_run_id_task_runs_id_fk": {
+          "name": "compute_provider_usage_samples_run_id_task_runs_id_fk",
+          "tableFrom": "compute_provider_usage_samples",
+          "tableTo": "task_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "compute_provider_usage_samples_task_id_tasks_id_fk": {
+          "name": "compute_provider_usage_samples_task_id_tasks_id_fk",
+          "tableFrom": "compute_provider_usage_samples",
+          "tableTo": "tasks",
+          "columnsFrom": ["task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.custom_automations": {
+      "name": "custom_automations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "prompt": {
+          "name": "prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "schedule_mode": {
+          "name": "schedule_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'off'"
+        },
+        "cron_expression": {
+          "name": "cron_expression",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target": {
+          "name": "target",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_at": {
+          "name": "last_run_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_succeeded_at": {
+          "name": "last_succeeded_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_failed_at": {
+          "name": "last_failed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_launched_task_id": {
+          "name": "last_launched_task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "launch_claimed_at": {
+          "name": "launch_claimed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "custom_automations_name_unique_idx": {
+          "name": "custom_automations_name_unique_idx",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "custom_automations_enabled_idx": {
+          "name": "custom_automations_enabled_idx",
+          "columns": [
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "custom_automations_environment_id_idx": {
+          "name": "custom_automations_environment_id_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "custom_automations_environment_id_environments_id_fk": {
+          "name": "custom_automations_environment_id_environments_id_fk",
+          "tableFrom": "custom_automations",
+          "tableTo": "environments",
+          "columnsFrom": ["environment_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "custom_automations_created_by_user_id_users_id_fk": {
+          "name": "custom_automations_created_by_user_id_users_id_fk",
+          "tableFrom": "custom_automations",
+          "tableTo": "users",
+          "columnsFrom": ["created_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "custom_automations_last_launched_task_id_tasks_id_fk": {
+          "name": "custom_automations_last_launched_task_id_tasks_id_fk",
+          "tableFrom": "custom_automations",
+          "tableTo": "tasks",
+          "columnsFrom": ["last_launched_task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.deployment_mcp_enablements": {
+      "name": "deployment_mcp_enablements",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "mcp_id": {
+          "name": "mcp_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "enabled_by_user_id": {
+          "name": "enabled_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_tools": {
+          "name": "disabled_tools",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "deployment_mcp_enablements_enabled_by_user_id_users_id_fk": {
+          "name": "deployment_mcp_enablements_enabled_by_user_id_users_id_fk",
+          "tableFrom": "deployment_mcp_enablements",
+          "tableTo": "users",
+          "columnsFrom": ["enabled_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "deployment_mcp_enablements_mcp_unique": {
+          "name": "deployment_mcp_enablements_mcp_unique",
+          "nullsNotDistinct": false,
+          "columns": ["mcp_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.deployment_secrets": {
+      "name": "deployment_secrets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "deployment_secrets_name_unique": {
+          "name": "deployment_secrets_name_unique",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.deployment_settings": {
+      "name": "deployment_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "task_model_settings": {
+          "name": "task_model_settings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "router_debug_provider": {
+          "name": "router_debug_provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "router_debug_channel_id": {
+          "name": "router_debug_channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "router_debug_disabled": {
+          "name": "router_debug_disabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "router_debug_slack_channel_id": {
+          "name": "router_debug_slack_channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_model_config": {
+          "name": "runtime_model_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_compute_config": {
+          "name": "runtime_compute_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_policy": {
+          "name": "access_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "license_key": {
+          "name": "license_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "license_cloud_state": {
+          "name": "license_cloud_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "instance_analytics_id": {
+          "name": "instance_analytics_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_known_version": {
+          "name": "latest_known_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_version_checked_at": {
+          "name": "latest_version_checked_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "setup_completed_at": {
+          "name": "setup_completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "setup_new_state": {
+          "name": "setup_new_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slack_onboarding_stage": {
+          "name": "slack_onboarding_stage",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "manager_slack_channel_id": {
+          "name": "manager_slack_channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "manager_discord_channel_id": {
+          "name": "manager_discord_channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "global_agent_instructions": {
+          "name": "global_agent_instructions",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "time_zone": {
+          "name": "time_zone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "time_zone_updated_at": {
+          "name": "time_zone_updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "authorship_instructions": {
+          "name": "authorship_instructions",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "compiled_authorship_rules": {
+          "name": "compiled_authorship_rules",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "compiled_authorship_issues": {
+          "name": "compiled_authorship_issues",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "compiled_authorship_at": {
+          "name": "compiled_authorship_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "style_guidance": {
+          "name": "style_guidance",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slack_summon_emoji": {
+          "name": "slack_summon_emoji",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slack_ack_emoji": {
+          "name": "slack_ack_emoji",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'eyes'"
+        },
+        "slack_completion_emoji": {
+          "name": "slack_completion_emoji",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'white_check_mark'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.discord_gateway_sessions": {
+      "name": "discord_gateway_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resume_gateway_url": {
+          "name": "resume_gateway_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sequence": {
+          "name": "sequence",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "shard_count": {
+          "name": "shard_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_connected_at": {
+          "name": "last_connected_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_heartbeat_ack_at": {
+          "name": "last_heartbeat_ack_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disconnected_at": {
+          "name": "disconnected_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.discord_installation_channels": {
+      "name": "discord_installation_channels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "discord_installation_id": {
+          "name": "discord_installation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "channel_id": {
+          "name": "channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "channel_name": {
+          "name": "channel_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "channel_type": {
+          "name": "channel_type",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "permissions": {
+          "name": "permissions",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_available": {
+          "name": "is_available",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "discord_installation_channels_installation_id_idx": {
+          "name": "discord_installation_channels_installation_id_idx",
+          "columns": [
+            {
+              "expression": "discord_installation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "discord_installation_channels_unique": {
+          "name": "discord_installation_channels_unique",
+          "columns": [
+            {
+              "expression": "discord_installation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "channel_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "discord_installation_channels_discord_installation_id_discord_installations_id_fk": {
+          "name": "discord_installation_channels_discord_installation_id_discord_installations_id_fk",
+          "tableFrom": "discord_installation_channels",
+          "tableTo": "discord_installations",
+          "columnsFrom": ["discord_installation_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.discord_installations": {
+      "name": "discord_installations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "guild_id": {
+          "name": "guild_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "guild_name": {
+          "name": "guild_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bot_user_id": {
+          "name": "bot_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "installed_by_user_id": {
+          "name": "installed_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "default_channel_id": {
+          "name": "default_channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "default_channel_name": {
+          "name": "default_channel_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "default_channel_type": {
+          "name": "default_channel_type",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "discord_installations_guild_id_unique": {
+          "name": "discord_installations_guild_id_unique",
+          "columns": [
+            {
+              "expression": "guild_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "discord_installations_active_idx": {
+          "name": "discord_installations_active_idx",
+          "columns": [
+            {
+              "expression": "is_active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "discord_installations_default_channel_idx": {
+          "name": "discord_installations_default_channel_idx",
+          "columns": [
+            {
+              "expression": "default_channel_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "discord_installations_installed_by_user_id_users_id_fk": {
+          "name": "discord_installations_installed_by_user_id_users_id_fk",
+          "tableFrom": "discord_installations",
+          "tableTo": "users",
+          "columnsFrom": ["installed_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.discord_user_mappings": {
+      "name": "discord_user_mappings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "discord_user_id": {
+          "name": "discord_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "discord_username": {
+          "name": "discord_username",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "discord_global_name": {
+          "name": "discord_global_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "discord_dm_channel_id": {
+          "name": "discord_dm_channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "discord_user_mappings_user_id_idx": {
+          "name": "discord_user_mappings_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "discord_user_mappings_discord_user_id_unique": {
+          "name": "discord_user_mappings_discord_user_id_unique",
+          "columns": [
+            {
+              "expression": "discord_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "discord_user_mappings_user_id_users_id_fk": {
+          "name": "discord_user_mappings_user_id_users_id_fk",
+          "tableFrom": "discord_user_mappings",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_config_versions": {
+      "name": "environment_config_versions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_config_versions_environment_id_idx": {
+          "name": "environment_config_versions_environment_id_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_config_versions_environment_version_unique": {
+          "name": "environment_config_versions_environment_version_unique",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_config_versions_environment_id_environments_id_fk": {
+          "name": "environment_config_versions_environment_id_environments_id_fk",
+          "tableFrom": "environment_config_versions",
+          "tableTo": "environments",
+          "columnsFrom": ["environment_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_config_versions_created_by_user_id_users_id_fk": {
+          "name": "environment_config_versions_created_by_user_id_users_id_fk",
+          "tableFrom": "environment_config_versions",
+          "tableTo": "users",
+          "columnsFrom": ["created_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_repository_mappings": {
+      "name": "environment_repository_mappings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "repository_id": {
+          "name": "repository_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "env_repo_mappings_env_id_idx": {
+          "name": "env_repo_mappings_env_id_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "env_repo_mappings_repo_id_idx": {
+          "name": "env_repo_mappings_repo_id_idx",
+          "columns": [
+            {
+              "expression": "repository_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_repository_mappings_environment_id_environments_id_fk": {
+          "name": "environment_repository_mappings_environment_id_environments_id_fk",
+          "tableFrom": "environment_repository_mappings",
+          "tableTo": "environments",
+          "columnsFrom": ["environment_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_repository_mappings_repository_id_repositories_id_fk": {
+          "name": "environment_repository_mappings_repository_id_repositories_id_fk",
+          "tableFrom": "environment_repository_mappings",
+          "tableTo": "repositories",
+          "columnsFrom": ["repository_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "env_repo_mappings_unique": {
+          "name": "env_repo_mappings_unique",
+          "nullsNotDistinct": false,
+          "columns": ["environment_id", "repository_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_snapshots": {
+      "name": "environment_snapshots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "snapshot_id": {
+          "name": "snapshot_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot_created_at": {
+          "name": "snapshot_created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot_expires_at": {
+          "name": "snapshot_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot_status": {
+          "name": "snapshot_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_snapshots_environment_id_idx": {
+          "name": "environment_snapshots_environment_id_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_snapshots_env_provider_unique": {
+          "name": "environment_snapshots_env_provider_unique",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environment_snapshots\".\"deleted_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_snapshots_environment_id_environments_id_fk": {
+          "name": "environment_snapshots_environment_id_environments_id_fk",
+          "tableFrom": "environment_snapshots",
+          "tableTo": "environments",
+          "columnsFrom": ["environment_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_variables": {
+      "name": "environment_variables",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_updated_by_user_id": {
+          "name": "last_updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_variables_user_id_idx": {
+          "name": "environment_variables_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_variables_name_unique": {
+          "name": "environment_variables_name_unique",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_variables_user_id_users_id_fk": {
+          "name": "environment_variables_user_id_users_id_fk",
+          "tableFrom": "environment_variables",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_variables_created_by_user_id_users_id_fk": {
+          "name": "environment_variables_created_by_user_id_users_id_fk",
+          "tableFrom": "environment_variables",
+          "tableTo": "users",
+          "columnsFrom": ["created_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "environment_variables_last_updated_by_user_id_users_id_fk": {
+          "name": "environment_variables_last_updated_by_user_id_users_id_fk",
+          "tableFrom": "environment_variables",
+          "tableTo": "users",
+          "columnsFrom": ["last_updated_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environments": {
+      "name": "environments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_eval": {
+          "name": "is_eval",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "declarative_source": {
+          "name": "declarative_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_verified": {
+          "name": "is_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "verification_task_id": {
+          "name": "verification_task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "verified_at": {
+          "name": "verified_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "verification_error": {
+          "name": "verification_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot_id": {
+          "name": "snapshot_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot_created_at": {
+          "name": "snapshot_created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot_expires_at": {
+          "name": "snapshot_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot_status": {
+          "name": "snapshot_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environments_user_id_idx": {
+          "name": "environments_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_created_by_user_id_idx": {
+          "name": "environments_created_by_user_id_idx",
+          "columns": [
+            {
+              "expression": "created_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_snapshot_expires_at_idx": {
+          "name": "environments_snapshot_expires_at_idx",
+          "columns": [
+            {
+              "expression": "snapshot_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_name_unique": {
+          "name": "environments_name_unique",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environments_user_id_users_id_fk": {
+          "name": "environments_user_id_users_id_fk",
+          "tableFrom": "environments",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environments_created_by_user_id_users_id_fk": {
+          "name": "environments_created_by_user_id_users_id_fk",
+          "tableFrom": "environments",
+          "tableTo": "users",
+          "columnsFrom": ["created_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.github_installations": {
+      "name": "github_installations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "installation_id": {
+          "name": "installation_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "app_id": {
+          "name": "app_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "account_login": {
+          "name": "account_login",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "account_type": {
+          "name": "account_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permissions": {
+          "name": "permissions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "installed_by_user_id": {
+          "name": "installed_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "members_count": {
+          "name": "members_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "suspended_at": {
+          "name": "suspended_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "github_installations_account_login_idx": {
+          "name": "github_installations_account_login_idx",
+          "columns": [
+            {
+              "expression": "account_login",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "github_installations_deployment_installation_unique": {
+          "name": "github_installations_deployment_installation_unique",
+          "columns": [
+            {
+              "expression": "installation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "github_installations_user_id_users_id_fk": {
+          "name": "github_installations_user_id_users_id_fk",
+          "tableFrom": "github_installations",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "github_installations_installed_by_user_id_users_id_fk": {
+          "name": "github_installations_installed_by_user_id_users_id_fk",
+          "tableFrom": "github_installations",
+          "tableTo": "users",
+          "columnsFrom": ["installed_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.github_pending_installations": {
+      "name": "github_pending_installations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_user_id": {
+          "name": "requested_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "app_id": {
+          "name": "app_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "github_pending_installations_requested_by_user_id_idx": {
+          "name": "github_pending_installations_requested_by_user_id_idx",
+          "columns": [
+            {
+              "expression": "requested_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "github_pending_installations_user_id_users_id_fk": {
+          "name": "github_pending_installations_user_id_users_id_fk",
+          "tableFrom": "github_pending_installations",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "github_pending_installations_requested_by_user_id_users_id_fk": {
+          "name": "github_pending_installations_requested_by_user_id_users_id_fk",
+          "tableFrom": "github_pending_installations",
+          "tableTo": "users",
+          "columnsFrom": ["requested_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.github_user_mappings": {
+      "name": "github_user_mappings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "github_login": {
+          "name": "github_login",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "github_user_id": {
+          "name": "github_user_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_expires_at": {
+          "name": "token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "github_user_mappings_github_login_idx": {
+          "name": "github_user_mappings_github_login_idx",
+          "columns": [
+            {
+              "expression": "github_login",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "github_user_mappings_user_id_idx": {
+          "name": "github_user_mappings_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "github_user_mappings_user_id_users_id_fk": {
+          "name": "github_user_mappings_user_id_users_id_fk",
+          "tableFrom": "github_user_mappings",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "github_user_mappings_unique": {
+          "name": "github_user_mappings_unique",
+          "nullsNotDistinct": false,
+          "columns": ["github_user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.invites": {
+      "name": "invites",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invited_by_user_id": {
+          "name": "invited_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'member'"
+        },
+        "max_uses": {
+          "name": "max_uses",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "used_count": {
+          "name": "used_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "invites_token_hash_unique": {
+          "name": "invites_token_hash_unique",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invites_created_at_idx": {
+          "name": "invites_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "invites_invited_by_user_id_users_id_fk": {
+          "name": "invites_invited_by_user_id_users_id_fk",
+          "tableFrom": "invites",
+          "tableTo": "users",
+          "columnsFrom": ["invited_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.license_usage_observations": {
+      "name": "license_usage_observations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "observed_at": {
+          "name": "observed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "active_users": {
+          "name": "active_users",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "delivered_at": {
+          "name": "delivered_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempts": {
+          "name": "attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_attempted_at": {
+          "name": "last_attempted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "license_usage_observations_pending_idx": {
+          "name": "license_usage_observations_pending_idx",
+          "columns": [
+            {
+              "expression": "delivered_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "observed_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.linear_pending_selections": {
+      "name": "linear_pending_selections",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "linear_organization_id": {
+          "name": "linear_organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "step": {
+          "name": "step",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'awaiting_workspace'"
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "selected_repo": {
+          "name": "selected_repo",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_options": {
+          "name": "workspace_options",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "linear_pending_selections_expires_at_idx": {
+          "name": "linear_pending_selections_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "linear_pending_selections_step_idx": {
+          "name": "linear_pending_selections_step_idx",
+          "columns": [
+            {
+              "expression": "step",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "linear_pending_selections_user_id_users_id_fk": {
+          "name": "linear_pending_selections_user_id_users_id_fk",
+          "tableFrom": "linear_pending_selections",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "linear_pending_selections_session_id_unique": {
+          "name": "linear_pending_selections_session_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["session_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.task_inference_usage_events": {
+      "name": "task_inference_usage_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'opencode'"
+        },
+        "usage_type": {
+          "name": "usage_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'inference'"
+        },
+        "task_id": {
+          "name": "task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "event_key": {
+          "name": "event_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_session_id": {
+          "name": "harness_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "message_id": {
+          "name": "message_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model_id": {
+          "name": "model_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent": {
+          "name": "agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "reasoning_tokens": {
+          "name": "reasoning_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cache_read_tokens": {
+          "name": "cache_read_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cache_write_tokens": {
+          "name": "cache_write_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_tokens": {
+          "name": "total_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "context_tokens": {
+          "name": "context_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cost_micro_usd": {
+          "name": "cost_micro_usd",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cost_source": {
+          "name": "cost_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pricing_metadata": {
+          "name": "pricing_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "message_created_at": {
+          "name": "message_created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "message_completed_at": {
+          "name": "message_completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "task_inference_usage_events_session_message_unique": {
+          "name": "task_inference_usage_events_session_message_unique",
+          "columns": [
+            {
+              "expression": "harness_session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "message_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_inference_usage_events_event_key_unique": {
+          "name": "task_inference_usage_events_event_key_unique",
+          "columns": [
+            {
+              "expression": "event_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_inference_usage_events_task_id_idx": {
+          "name": "task_inference_usage_events_task_id_idx",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_inference_usage_events_run_id_idx": {
+          "name": "task_inference_usage_events_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_inference_usage_events_user_id_idx": {
+          "name": "task_inference_usage_events_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_inference_usage_events_environment_id_idx": {
+          "name": "task_inference_usage_events_environment_id_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_inference_usage_events_provider_model_idx": {
+          "name": "task_inference_usage_events_provider_model_idx",
+          "columns": [
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "model_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_inference_usage_events_created_at_idx": {
+          "name": "task_inference_usage_events_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "task_inference_usage_events_task_id_tasks_id_fk": {
+          "name": "task_inference_usage_events_task_id_tasks_id_fk",
+          "tableFrom": "task_inference_usage_events",
+          "tableTo": "tasks",
+          "columnsFrom": ["task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "task_inference_usage_events_run_id_task_runs_id_fk": {
+          "name": "task_inference_usage_events_run_id_task_runs_id_fk",
+          "tableFrom": "task_inference_usage_events",
+          "tableTo": "task_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "task_inference_usage_events_user_id_users_id_fk": {
+          "name": "task_inference_usage_events_user_id_users_id_fk",
+          "tableFrom": "task_inference_usage_events",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "task_inference_usage_events_environment_id_environments_id_fk": {
+          "name": "task_inference_usage_events_environment_id_environments_id_fk",
+          "tableFrom": "task_inference_usage_events",
+          "tableTo": "environments",
+          "columnsFrom": ["environment_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.mcp_connections": {
+      "name": "mcp_connections",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_id": {
+          "name": "mcp_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_role": {
+          "name": "connection_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "auth_config": {
+          "name": "auth_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "auth_status": {
+          "name": "auth_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_expires_at": {
+          "name": "token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scopes": {
+          "name": "scopes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "mcp_connections_user_id_idx": {
+          "name": "mcp_connections_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "mcp_connections_role_idx": {
+          "name": "mcp_connections_role_idx",
+          "columns": [
+            {
+              "expression": "mcp_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "mcp_connections_user_id_users_id_fk": {
+          "name": "mcp_connections_user_id_users_id_fk",
+          "tableFrom": "mcp_connections",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "mcp_connections_user_mcp_id_unique": {
+          "name": "mcp_connections_user_mcp_id_unique",
+          "nullsNotDistinct": true,
+          "columns": ["user_id", "mcp_id", "connection_role"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.mcp_oauth_replays": {
+      "name": "mcp_oauth_replays",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_id": {
+          "name": "mcp_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_role": {
+          "name": "connection_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "redirect_to": {
+          "name": "redirect_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "mcp_oauth_replays_connection_id_idx": {
+          "name": "mcp_oauth_replays_connection_id_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "mcp_oauth_replays_user_id_idx": {
+          "name": "mcp_oauth_replays_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "mcp_oauth_replays_expires_at_idx": {
+          "name": "mcp_oauth_replays_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "mcp_oauth_replays_connection_id_mcp_connections_id_fk": {
+          "name": "mcp_oauth_replays_connection_id_mcp_connections_id_fk",
+          "tableFrom": "mcp_oauth_replays",
+          "tableTo": "mcp_connections",
+          "columnsFrom": ["connection_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "mcp_oauth_replays_user_id_users_id_fk": {
+          "name": "mcp_oauth_replays_user_id_users_id_fk",
+          "tableFrom": "mcp_oauth_replays",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "mcp_oauth_replays_token_unique": {
+          "name": "mcp_oauth_replays_token_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.microsoft_auth_user_mappings": {
+      "name": "microsoft_auth_user_mappings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "auth_account_id": {
+          "name": "auth_account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "microsoft_tenant_id": {
+          "name": "microsoft_tenant_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "microsoft_aad_object_id": {
+          "name": "microsoft_aad_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "microsoft_auth_user_mappings_user_id_idx": {
+          "name": "microsoft_auth_user_mappings_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "microsoft_auth_user_mappings_account_id_idx": {
+          "name": "microsoft_auth_user_mappings_account_id_idx",
+          "columns": [
+            {
+              "expression": "account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "microsoft_auth_user_mappings_auth_account_idx": {
+          "name": "microsoft_auth_user_mappings_auth_account_idx",
+          "columns": [
+            {
+              "expression": "auth_account_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "microsoft_auth_user_mappings_aad_object_unique": {
+          "name": "microsoft_auth_user_mappings_aad_object_unique",
+          "columns": [
+            {
+              "expression": "microsoft_tenant_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "microsoft_aad_object_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "microsoft_auth_user_mappings_auth_account_id_auth_accounts_id_fk": {
+          "name": "microsoft_auth_user_mappings_auth_account_id_auth_accounts_id_fk",
+          "tableFrom": "microsoft_auth_user_mappings",
+          "tableTo": "auth_accounts",
+          "columnsFrom": ["auth_account_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "microsoft_auth_user_mappings_user_id_auth_users_id_fk": {
+          "name": "microsoft_auth_user_mappings_user_id_auth_users_id_fk",
+          "tableFrom": "microsoft_auth_user_mappings",
+          "tableTo": "auth_users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.oauth_state": {
+      "name": "oauth_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "replay_token": {
+          "name": "replay_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "oauth_state_connection_id_idx": {
+          "name": "oauth_state_connection_id_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oauth_state_replay_token_idx": {
+          "name": "oauth_state_replay_token_idx",
+          "columns": [
+            {
+              "expression": "replay_token",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oauth_state_expires_at_idx": {
+          "name": "oauth_state_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "oauth_state_connection_id_mcp_connections_id_fk": {
+          "name": "oauth_state_connection_id_mcp_connections_id_fk",
+          "tableFrom": "oauth_state",
+          "tableTo": "mcp_connections",
+          "columnsFrom": ["connection_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pull_request_facts": {
+      "name": "pull_request_facts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "repository_id": {
+          "name": "repository_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "repository_full_name": {
+          "name": "repository_full_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_control_provider": {
+          "name": "source_control_provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'github'"
+        },
+        "external_pull_request_id": {
+          "name": "external_pull_request_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pr_number": {
+          "name": "pr_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "html_url": {
+          "name": "html_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_login": {
+          "name": "author_login",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at_remote": {
+          "name": "created_at_remote",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at_remote": {
+          "name": "updated_at_remote",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "closed_at_remote": {
+          "name": "closed_at_remote",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "merged_at_remote": {
+          "name": "merged_at_remote",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_seen_at": {
+          "name": "first_seen_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "synced_at": {
+          "name": "synced_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pull_request_facts_deployment_repo_pr_unique": {
+          "name": "pull_request_facts_deployment_repo_pr_unique",
+          "columns": [
+            {
+              "expression": "repository_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pr_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pull_request_facts_deployment_created_idx": {
+          "name": "pull_request_facts_deployment_created_idx",
+          "columns": [
+            {
+              "expression": "created_at_remote",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pull_request_facts_deployment_repo_created_idx": {
+          "name": "pull_request_facts_deployment_repo_created_idx",
+          "columns": [
+            {
+              "expression": "repository_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at_remote",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pull_request_facts_deployment_state_created_idx": {
+          "name": "pull_request_facts_deployment_state_created_idx",
+          "columns": [
+            {
+              "expression": "state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at_remote",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pull_request_facts_deployment_author_created_idx": {
+          "name": "pull_request_facts_deployment_author_created_idx",
+          "columns": [
+            {
+              "expression": "author_login",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at_remote",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pull_request_facts_deployment_updated_idx": {
+          "name": "pull_request_facts_deployment_updated_idx",
+          "columns": [
+            {
+              "expression": "updated_at_remote",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pull_request_facts_repository_id_repositories_id_fk": {
+          "name": "pull_request_facts_repository_id_repositories_id_fk",
+          "tableFrom": "pull_request_facts",
+          "tableTo": "repositories",
+          "columnsFrom": ["repository_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pull_request_facts_source_control_provider_check": {
+          "name": "pull_request_facts_source_control_provider_check",
+          "value": "\"pull_request_facts\".\"source_control_provider\" in ('github', 'gitlab', 'gitea', 'ado', 'bitbucket')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pull_request_sync_states": {
+      "name": "pull_request_sync_states",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "repository_id": {
+          "name": "repository_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_incremental_updated_at": {
+          "name": "last_incremental_updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "backfill_completed_at": {
+          "name": "backfill_completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cooldown_until": {
+          "name": "cooldown_until",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_successful_sync_at": {
+          "name": "last_successful_sync_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_attempted_sync_at": {
+          "name": "last_attempted_sync_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_at": {
+          "name": "last_error_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_message": {
+          "name": "last_error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pull_request_sync_states_repo_unique": {
+          "name": "pull_request_sync_states_repo_unique",
+          "columns": [
+            {
+              "expression": "repository_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pull_request_sync_states_deployment_updated_idx": {
+          "name": "pull_request_sync_states_deployment_updated_idx",
+          "columns": [
+            {
+              "expression": "last_successful_sync_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pull_request_sync_states_cooldown_idx": {
+          "name": "pull_request_sync_states_cooldown_idx",
+          "columns": [
+            {
+              "expression": "cooldown_until",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pull_request_sync_states_repository_id_repositories_id_fk": {
+          "name": "pull_request_sync_states_repository_id_repositories_id_fk",
+          "tableFrom": "pull_request_sync_states",
+          "tableTo": "repositories",
+          "columnsFrom": ["repository_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.repositories": {
+      "name": "repositories",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "source_control_provider": {
+          "name": "source_control_provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'github'"
+        },
+        "installation_id": {
+          "name": "installation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "github_repo_id": {
+          "name": "github_repo_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_repo_id": {
+          "name": "external_repo_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "host": {
+          "name": "host",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "full_name": {
+          "name": "full_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "private": {
+          "name": "private",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "default_branch": {
+          "name": "default_branch",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'main'"
+        },
+        "clone_url": {
+          "name": "clone_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "html_url": {
+          "name": "html_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permissions": {
+          "name": "permissions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "linked_by_user_id": {
+          "name": "linked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "repositories_source_control_provider_idx": {
+          "name": "repositories_source_control_provider_idx",
+          "columns": [
+            {
+              "expression": "source_control_provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "repositories_installation_id_idx": {
+          "name": "repositories_installation_id_idx",
+          "columns": [
+            {
+              "expression": "installation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "repositories_full_name_idx": {
+          "name": "repositories_full_name_idx",
+          "columns": [
+            {
+              "expression": "full_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "repositories_provider_host_full_name_idx": {
+          "name": "repositories_provider_host_full_name_idx",
+          "columns": [
+            {
+              "expression": "source_control_provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "host",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "full_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "repositories_deployment_active_installation_idx": {
+          "name": "repositories_deployment_active_installation_idx",
+          "columns": [
+            {
+              "expression": "is_active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "installation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "repositories_deployment_github_repo_unique": {
+          "name": "repositories_deployment_github_repo_unique",
+          "columns": [
+            {
+              "expression": "github_repo_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "repositories_provider_host_external_repo_unique": {
+          "name": "repositories_provider_host_external_repo_unique",
+          "columns": [
+            {
+              "expression": "source_control_provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "coalesce(\"host\", '')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_repo_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "repositories_provider_host_full_name_unique": {
+          "name": "repositories_provider_host_full_name_unique",
+          "columns": [
+            {
+              "expression": "source_control_provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "coalesce(\"host\", '')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "full_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "repositories_installation_id_github_installations_id_fk": {
+          "name": "repositories_installation_id_github_installations_id_fk",
+          "tableFrom": "repositories",
+          "tableTo": "github_installations",
+          "columnsFrom": ["installation_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "repositories_user_id_users_id_fk": {
+          "name": "repositories_user_id_users_id_fk",
+          "tableFrom": "repositories",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "repositories_linked_by_user_id_users_id_fk": {
+          "name": "repositories_linked_by_user_id_users_id_fk",
+          "tableFrom": "repositories",
+          "tableTo": "users",
+          "columnsFrom": ["linked_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "repositories_source_control_provider_check": {
+          "name": "repositories_source_control_provider_check",
+          "value": "\"repositories\".\"source_control_provider\" in ('github', 'gitlab', 'gitea', 'ado', 'bitbucket')"
+        },
+        "repositories_github_shape_check": {
+          "name": "repositories_github_shape_check",
+          "value": "\"repositories\".\"source_control_provider\" != 'github' OR (\"repositories\".\"installation_id\" IS NOT NULL AND \"repositories\".\"github_repo_id\" IS NOT NULL)"
+        },
+        "repositories_gitlab_shape_check": {
+          "name": "repositories_gitlab_shape_check",
+          "value": "\"repositories\".\"source_control_provider\" != 'gitlab' OR \"repositories\".\"external_repo_id\" IS NOT NULL"
+        },
+        "repositories_gitea_shape_check": {
+          "name": "repositories_gitea_shape_check",
+          "value": "\"repositories\".\"source_control_provider\" != 'gitea' OR \"repositories\".\"external_repo_id\" IS NOT NULL"
+        },
+        "repositories_ado_shape_check": {
+          "name": "repositories_ado_shape_check",
+          "value": "\"repositories\".\"source_control_provider\" != 'ado' OR \"repositories\".\"external_repo_id\" IS NOT NULL"
+        },
+        "repositories_bitbucket_shape_check": {
+          "name": "repositories_bitbucket_shape_check",
+          "value": "\"repositories\".\"source_control_provider\" != 'bitbucket' OR \"repositories\".\"external_repo_id\" IS NOT NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.sandbox_oidc_targets": {
+      "name": "sandbox_oidc_targets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "compute_provider": {
+          "name": "compute_provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "compute_provider_id": {
+          "name": "compute_provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_kind": {
+          "name": "target_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "audience": {
+          "name": "audience",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_file": {
+          "name": "token_file",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "aws_role_arn": {
+          "name": "aws_role_arn",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "aws_region": {
+          "name": "aws_region",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_at": {
+          "name": "refresh_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "sandbox_oidc_targets_environment_id_idx": {
+          "name": "sandbox_oidc_targets_environment_id_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sandbox_oidc_targets_run_id_idx": {
+          "name": "sandbox_oidc_targets_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sandbox_oidc_targets_refresh_at_idx": {
+          "name": "sandbox_oidc_targets_refresh_at_idx",
+          "columns": [
+            {
+              "expression": "refresh_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sandbox_oidc_targets_provider_target_file_unique": {
+          "name": "sandbox_oidc_targets_provider_target_file_unique",
+          "columns": [
+            {
+              "expression": "compute_provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "compute_provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "token_file",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "sandbox_oidc_targets_environment_id_environments_id_fk": {
+          "name": "sandbox_oidc_targets_environment_id_environments_id_fk",
+          "tableFrom": "sandbox_oidc_targets",
+          "tableTo": "environments",
+          "columnsFrom": ["environment_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "sandbox_oidc_targets_run_id_task_runs_id_fk": {
+          "name": "sandbox_oidc_targets_run_id_task_runs_id_fk",
+          "tableFrom": "sandbox_oidc_targets",
+          "tableTo": "task_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "sandbox_oidc_targets_owner_required": {
+          "name": "sandbox_oidc_targets_owner_required",
+          "value": "run_id IS NOT NULL"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.setup_qualification_blocks": {
+      "name": "setup_qualification_blocks",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'blocked'"
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email_domain": {
+          "name": "email_domain",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "github_account_login": {
+          "name": "github_account_login",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "github_account_type": {
+          "name": "github_account_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_blocked_at": {
+          "name": "first_blocked_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_blocked_at": {
+          "name": "last_blocked_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lifted_by_admin_user_id": {
+          "name": "lifted_by_admin_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lifted_by_admin_email": {
+          "name": "lifted_by_admin_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "setup_qualification_blocks_deployment_user_reason_unique": {
+          "name": "setup_qualification_blocks_deployment_user_reason_unique",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "reason",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "setup_qualification_blocks_deployment_status_idx": {
+          "name": "setup_qualification_blocks_deployment_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "setup_qualification_blocks_user_status_idx": {
+          "name": "setup_qualification_blocks_user_status_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "setup_qualification_blocks_user_id_users_id_fk": {
+          "name": "setup_qualification_blocks_user_id_users_id_fk",
+          "tableFrom": "setup_qualification_blocks",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.slack_auth_tokens": {
+      "name": "slack_auth_tokens",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slack_user_id": {
+          "name": "slack_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slack_team_id": {
+          "name": "slack_team_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "channel": {
+          "name": "channel",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_ts": {
+          "name": "thread_ts",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "original_text": {
+          "name": "original_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "slack_auth_tokens_expires_at_idx": {
+          "name": "slack_auth_tokens_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "slack_auth_tokens_token_unique": {
+          "name": "slack_auth_tokens_token_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.slack_conversation_messages": {
+      "name": "slack_conversation_messages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "subject_user_id": {
+          "name": "subject_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slack_team_id": {
+          "name": "slack_team_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_slack_user_id": {
+          "name": "subject_slack_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sender_user_id": {
+          "name": "sender_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sender_slack_user_id": {
+          "name": "sender_slack_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slack_channel_id": {
+          "name": "slack_channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "conversation_kind": {
+          "name": "conversation_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_ts": {
+          "name": "thread_ts",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "message_ts": {
+          "name": "message_ts",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message_at": {
+          "name": "message_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "direction": {
+          "name": "direction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_kind": {
+          "name": "author_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "text": {
+          "name": "text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "task_id": {
+          "name": "task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slack_quick_answer_id": {
+          "name": "slack_quick_answer_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "slack_conversation_messages_deployment_user_message_at_idx": {
+          "name": "slack_conversation_messages_deployment_user_message_at_idx",
+          "columns": [
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "message_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "slack_conversation_messages_deployment_user_thread_idx": {
+          "name": "slack_conversation_messages_deployment_user_thread_idx",
+          "columns": [
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slack_channel_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "thread_ts",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "message_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "slack_conversation_messages_task_id_idx": {
+          "name": "slack_conversation_messages_task_id_idx",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "slack_conversation_messages_run_id_idx": {
+          "name": "slack_conversation_messages_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "slack_conversation_messages_team_channel_message_unique": {
+          "name": "slack_conversation_messages_team_channel_message_unique",
+          "columns": [
+            {
+              "expression": "slack_team_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slack_channel_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "message_ts",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "slack_conversation_messages_subject_user_id_users_id_fk": {
+          "name": "slack_conversation_messages_subject_user_id_users_id_fk",
+          "tableFrom": "slack_conversation_messages",
+          "tableTo": "users",
+          "columnsFrom": ["subject_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "slack_conversation_messages_sender_user_id_users_id_fk": {
+          "name": "slack_conversation_messages_sender_user_id_users_id_fk",
+          "tableFrom": "slack_conversation_messages",
+          "tableTo": "users",
+          "columnsFrom": ["sender_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "slack_conversation_messages_task_id_tasks_id_fk": {
+          "name": "slack_conversation_messages_task_id_tasks_id_fk",
+          "tableFrom": "slack_conversation_messages",
+          "tableTo": "tasks",
+          "columnsFrom": ["task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "slack_conversation_messages_run_id_task_runs_id_fk": {
+          "name": "slack_conversation_messages_run_id_task_runs_id_fk",
+          "tableFrom": "slack_conversation_messages",
+          "tableTo": "task_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "slack_conversation_messages_slack_quick_answer_id_slack_quick_answers_id_fk": {
+          "name": "slack_conversation_messages_slack_quick_answer_id_slack_quick_answers_id_fk",
+          "tableFrom": "slack_conversation_messages",
+          "tableTo": "slack_quick_answers",
+          "columnsFrom": ["slack_quick_answer_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.slack_installation_channels": {
+      "name": "slack_installation_channels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "slack_installation_id": {
+          "name": "slack_installation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "channel_id": {
+          "name": "channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "slack_installation_channels_installation_id_idx": {
+          "name": "slack_installation_channels_installation_id_idx",
+          "columns": [
+            {
+              "expression": "slack_installation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "slack_installation_channels_slack_installation_id_slack_installations_id_fk": {
+          "name": "slack_installation_channels_slack_installation_id_slack_installations_id_fk",
+          "tableFrom": "slack_installation_channels",
+          "tableTo": "slack_installations",
+          "columnsFrom": ["slack_installation_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "slack_installation_channels_unique": {
+          "name": "slack_installation_channels_unique",
+          "nullsNotDistinct": false,
+          "columns": ["slack_installation_id", "channel_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.slack_installations": {
+      "name": "slack_installations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "team_name": {
+          "name": "team_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "team_domain": {
+          "name": "team_domain",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enterprise_id": {
+          "name": "enterprise_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enterprise_name": {
+          "name": "enterprise_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "app_id": {
+          "name": "app_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bot_user_id": {
+          "name": "bot_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bot_name": {
+          "name": "bot_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "app_name": {
+          "name": "app_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "bot_access_token": {
+          "name": "bot_access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_access_token": {
+          "name": "user_access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scopes": {
+          "name": "scopes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_type": {
+          "name": "token_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'bot'"
+        },
+        "installed_by_user_id": {
+          "name": "installed_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "member_count_snapshot": {
+          "name": "member_count_snapshot",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "member_count_snapshot_at": {
+          "name": "member_count_snapshot_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "slack_installations_bot_user_id_idx": {
+          "name": "slack_installations_bot_user_id_idx",
+          "columns": [
+            {
+              "expression": "bot_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "slack_installations_active_idx": {
+          "name": "slack_installations_active_idx",
+          "columns": [
+            {
+              "expression": "is_active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "slack_installations_installed_by_user_id_users_id_fk": {
+          "name": "slack_installations_installed_by_user_id_users_id_fk",
+          "tableFrom": "slack_installations",
+          "tableTo": "users",
+          "columnsFrom": ["installed_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "slack_installations_team_id_unique": {
+          "name": "slack_installations_team_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["team_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.slack_quick_answers": {
+      "name": "slack_quick_answers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slack_channel": {
+          "name": "slack_channel",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slack_thread_ts": {
+          "name": "slack_thread_ts",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "messages": {
+          "name": "messages",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "slack_quick_answers_deployment_channel_thread_unique": {
+          "name": "slack_quick_answers_deployment_channel_thread_unique",
+          "columns": [
+            {
+              "expression": "slack_channel",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slack_thread_ts",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "slack_quick_answers_deployment_user_idx": {
+          "name": "slack_quick_answers_deployment_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "slack_quick_answers_user_id_users_id_fk": {
+          "name": "slack_quick_answers_user_id_users_id_fk",
+          "tableFrom": "slack_quick_answers",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.slack_user_mappings": {
+      "name": "slack_user_mappings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "slack_user_id": {
+          "name": "slack_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slack_team_id": {
+          "name": "slack_team_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "slack_user_mappings_user_id_idx": {
+          "name": "slack_user_mappings_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "slack_user_mappings_user_id_users_id_fk": {
+          "name": "slack_user_mappings_user_id_users_id_fk",
+          "tableFrom": "slack_user_mappings",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "slack_user_mappings_unique": {
+          "name": "slack_user_mappings_unique",
+          "nullsNotDistinct": false,
+          "columns": ["slack_user_id", "slack_team_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.task_artifacts": {
+      "name": "task_artifacts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "task_id": {
+          "name": "task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "artifact_type": {
+          "name": "artifact_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'general'"
+        },
+        "content_type": {
+          "name": "content_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "size": {
+          "name": "size",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uploaded": {
+          "name": "uploaded",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "task_artifacts_task_id_idx": {
+          "name": "task_artifacts_task_id_idx",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_artifacts_run_id_idx": {
+          "name": "task_artifacts_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_artifacts_uploaded_idx": {
+          "name": "task_artifacts_uploaded_idx",
+          "columns": [
+            {
+              "expression": "uploaded",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_artifacts_created_at_idx": {
+          "name": "task_artifacts_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_artifacts_path_idx": {
+          "name": "task_artifacts_path_idx",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "task_artifacts_task_id_tasks_id_fk": {
+          "name": "task_artifacts_task_id_tasks_id_fk",
+          "tableFrom": "task_artifacts",
+          "tableTo": "tasks",
+          "columnsFrom": ["task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "task_artifacts_run_id_task_runs_id_fk": {
+          "name": "task_artifacts_run_id_task_runs_id_fk",
+          "tableFrom": "task_artifacts",
+          "tableTo": "task_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "task_artifacts_task_id_path_version_unique": {
+          "name": "task_artifacts_task_id_path_version_unique",
+          "nullsNotDistinct": false,
+          "columns": ["task_id", "path", "version"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.task_messages": {
+      "name": "task_messages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "task_id": {
+          "name": "task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ts": {
+          "name": "ts",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "protocol": {
+          "name": "protocol",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content_blocks": {
+          "name": "content_blocks",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "task_messages_task_id_ts_idx": {
+          "name": "task_messages_task_id_ts_idx",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ts",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_messages_run_id_idx": {
+          "name": "task_messages_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_messages_created_at_idx": {
+          "name": "task_messages_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "task_messages_run_id_task_runs_id_fk": {
+          "name": "task_messages_run_id_task_runs_id_fk",
+          "tableFrom": "task_messages",
+          "tableTo": "task_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "task_messages_task_id_tasks_id_fk": {
+          "name": "task_messages_task_id_tasks_id_fk",
+          "tableFrom": "task_messages",
+          "tableTo": "tasks",
+          "columnsFrom": ["task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "task_messages_user_id_users_id_fk": {
+          "name": "task_messages_user_id_users_id_fk",
+          "tableFrom": "task_messages",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "task_messages_task_protocol_ts_event_type_unique": {
+          "name": "task_messages_task_protocol_ts_event_type_unique",
+          "nullsNotDistinct": false,
+          "columns": ["task_id", "protocol", "ts", "event_type"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.task_pins": {
+      "name": "task_pins",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "task_id": {
+          "name": "task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "task_pins_deployment_user_task_unique": {
+          "name": "task_pins_deployment_user_task_unique",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_pins_deployment_user_updated_at_idx": {
+          "name": "task_pins_deployment_user_updated_at_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_pins_task_id_idx": {
+          "name": "task_pins_task_id_idx",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "task_pins_task_id_tasks_id_fk": {
+          "name": "task_pins_task_id_tasks_id_fk",
+          "tableFrom": "task_pins",
+          "tableTo": "tasks",
+          "columnsFrom": ["task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "task_pins_user_id_users_id_fk": {
+          "name": "task_pins_user_id_users_id_fk",
+          "tableFrom": "task_pins",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.task_platform_issue_reports": {
+      "name": "task_platform_issue_reports",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "task_id": {
+          "name": "task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "task_message_id": {
+          "name": "task_message_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "report": {
+          "name": "report",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slack_posted_at": {
+          "name": "slack_posted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "task_platform_issue_reports_created_at_idx": {
+          "name": "task_platform_issue_reports_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_platform_issue_reports_task_id_created_at_idx": {
+          "name": "task_platform_issue_reports_task_id_created_at_idx",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_platform_issue_reports_run_id_created_at_idx": {
+          "name": "task_platform_issue_reports_run_id_created_at_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_platform_issue_reports_task_message_id_unique": {
+          "name": "task_platform_issue_reports_task_message_id_unique",
+          "columns": [
+            {
+              "expression": "task_message_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "task_platform_issue_reports_task_id_tasks_id_fk": {
+          "name": "task_platform_issue_reports_task_id_tasks_id_fk",
+          "tableFrom": "task_platform_issue_reports",
+          "tableTo": "tasks",
+          "columnsFrom": ["task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "task_platform_issue_reports_run_id_task_runs_id_fk": {
+          "name": "task_platform_issue_reports_run_id_task_runs_id_fk",
+          "tableFrom": "task_platform_issue_reports",
+          "tableTo": "task_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "task_platform_issue_reports_task_message_id_task_messages_id_fk": {
+          "name": "task_platform_issue_reports_task_message_id_task_messages_id_fk",
+          "tableFrom": "task_platform_issue_reports",
+          "tableTo": "task_messages",
+          "columnsFrom": ["task_message_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.task_pull_requests": {
+      "name": "task_pull_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "task_id": {
+          "name": "task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_control_provider": {
+          "name": "source_control_provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'github'"
+        },
+        "host": {
+          "name": "host",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repository_id": {
+          "name": "repository_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pr_url": {
+          "name": "pr_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pr_number": {
+          "name": "pr_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pr_title": {
+          "name": "pr_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repository": {
+          "name": "repository",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pr_sha": {
+          "name": "pr_sha",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pr_base_ref": {
+          "name": "pr_base_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pr_base_sha": {
+          "name": "pr_base_sha",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "github_reaction_id": {
+          "name": "github_reaction_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "github_check_run_id": {
+          "name": "github_check_run_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "github_review_comment_id": {
+          "name": "github_review_comment_id",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_roomote": {
+          "name": "created_by_roomote",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auto_handle_feedback_by_user_id": {
+          "name": "auto_handle_feedback_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "detected_at": {
+          "name": "detected_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "task_pull_requests_task_id_idx": {
+          "name": "task_pull_requests_task_id_idx",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_pull_requests_repository_id_idx": {
+          "name": "task_pull_requests_repository_id_idx",
+          "columns": [
+            {
+              "expression": "repository_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_pull_requests_provider_repository_pr_number_idx": {
+          "name": "task_pull_requests_provider_repository_pr_number_idx",
+          "columns": [
+            {
+              "expression": "source_control_provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "repository",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pr_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "task_pull_requests_task_id_tasks_id_fk": {
+          "name": "task_pull_requests_task_id_tasks_id_fk",
+          "tableFrom": "task_pull_requests",
+          "tableTo": "tasks",
+          "columnsFrom": ["task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "task_pull_requests_repository_id_repositories_id_fk": {
+          "name": "task_pull_requests_repository_id_repositories_id_fk",
+          "tableFrom": "task_pull_requests",
+          "tableTo": "repositories",
+          "columnsFrom": ["repository_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "task_pull_requests_auto_handle_feedback_by_user_id_users_id_fk": {
+          "name": "task_pull_requests_auto_handle_feedback_by_user_id_users_id_fk",
+          "tableFrom": "task_pull_requests",
+          "tableTo": "users",
+          "columnsFrom": ["auto_handle_feedback_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "task_pull_requests_task_pr_unique": {
+          "name": "task_pull_requests_task_pr_unique",
+          "nullsNotDistinct": false,
+          "columns": ["task_id", "pr_url"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "task_pull_requests_source_control_provider_check": {
+          "name": "task_pull_requests_source_control_provider_check",
+          "value": "\"task_pull_requests\".\"source_control_provider\" in ('github', 'gitlab', 'gitea', 'ado', 'bitbucket')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.task_run_events": {
+      "name": "task_run_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "task_id": {
+          "name": "task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "task_run_events_run_id_created_at_idx": {
+          "name": "task_run_events_run_id_created_at_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_run_events_task_id_created_at_idx": {
+          "name": "task_run_events_task_id_created_at_idx",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_run_events_created_at_idx": {
+          "name": "task_run_events_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_run_events_source_created_at_idx": {
+          "name": "task_run_events_source_created_at_idx",
+          "columns": [
+            {
+              "expression": "source",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "task_run_events_run_id_task_runs_id_fk": {
+          "name": "task_run_events_run_id_task_runs_id_fk",
+          "tableFrom": "task_run_events",
+          "tableTo": "task_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "task_run_events_task_id_tasks_id_fk": {
+          "name": "task_run_events_task_id_tasks_id_fk",
+          "tableFrom": "task_run_events",
+          "tableTo": "tasks",
+          "columnsFrom": ["task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.task_runs": {
+      "name": "task_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "identity": {
+            "type": "always",
+            "name": "task_runs_id_seq",
+            "schema": "public",
+            "increment": "1",
+            "startWith": "1",
+            "minValue": "1",
+            "maxValue": "2147483647",
+            "cache": "1",
+            "cycle": false
+          }
+        },
+        "task_id": {
+          "name": "task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'fresh'"
+        },
+        "source_run_id": {
+          "name": "source_run_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "acting_user_id": {
+          "name": "acting_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_kind": {
+          "name": "payload_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "harness": {
+          "name": "harness",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'opencode-server'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "queue_scope": {
+          "name": "queue_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "task_phase": {
+          "name": "task_phase",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "prompt": {
+          "name": "prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log": {
+          "name": "log",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "artifacts": {
+          "name": "artifacts",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "machine_id": {
+          "name": "machine_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sandbox_cmd_id": {
+          "name": "sandbox_cmd_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "machine_domain": {
+          "name": "machine_domain",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "machine_domains": {
+          "name": "machine_domains",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "initial_paths": {
+          "name": "initial_paths",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "primary_port_name": {
+          "name": "primary_port_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sandbox_server_url": {
+          "name": "sandbox_server_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proxy_ports": {
+          "name": "proxy_ports",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "worker_release_tag": {
+          "name": "worker_release_tag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "worker_version": {
+          "name": "worker_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "worker_commit": {
+          "name": "worker_commit",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "vendor": {
+          "name": "vendor",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "port": {
+          "name": "port",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "configured_vcpus": {
+          "name": "configured_vcpus",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "configured_cpu_cores": {
+          "name": "configured_cpu_cores",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "configured_memory_mib": {
+          "name": "configured_memory_mib",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot_id": {
+          "name": "snapshot_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot_requested_at": {
+          "name": "snapshot_requested_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot_created_at": {
+          "name": "snapshot_created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot_failed_at": {
+          "name": "snapshot_failed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "keepalive_ms": {
+          "name": "keepalive_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sleep_at": {
+          "name": "sleep_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sleep_requested_at": {
+          "name": "sleep_requested_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "worker_heartbeat_at": {
+          "name": "worker_heartbeat_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_snapshot_id": {
+          "name": "source_snapshot_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_bypass_value": {
+          "name": "auth_bypass_value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_bypass_header_name": {
+          "name": "auth_bypass_header_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "dequeued_at": {
+          "name": "dequeued_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provision_started_at": {
+          "name": "provision_started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provision_ready_at": {
+          "name": "provision_ready_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "setup_completed_at": {
+          "name": "setup_completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "environment_setup_state": {
+          "name": "environment_setup_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "environment_setup_completed_at": {
+          "name": "environment_setup_completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_started_at": {
+          "name": "harness_started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_task_started_at": {
+          "name": "runtime_task_started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_assistant_output_at": {
+          "name": "first_assistant_output_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancel_requested_at": {
+          "name": "cancel_requested_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canceled_at": {
+          "name": "canceled_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "launch_mode": {
+          "name": "launch_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "task_runs_task_id_idx": {
+          "name": "task_runs_task_id_idx",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_runs_queue_scope_idx": {
+          "name": "task_runs_queue_scope_idx",
+          "columns": [
+            {
+              "expression": "queue_scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_runs_acting_user_id_idx": {
+          "name": "task_runs_acting_user_id_idx",
+          "columns": [
+            {
+              "expression": "acting_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_runs_snapshot_id_idx": {
+          "name": "task_runs_snapshot_id_idx",
+          "columns": [
+            {
+              "expression": "snapshot_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_runs_sleep_at_idx": {
+          "name": "task_runs_sleep_at_idx",
+          "columns": [
+            {
+              "expression": "sleep_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_runs_worker_heartbeat_at_idx": {
+          "name": "task_runs_worker_heartbeat_at_idx",
+          "columns": [
+            {
+              "expression": "worker_heartbeat_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_runs_sleep_check_due_v2_idx": {
+          "name": "task_runs_sleep_check_due_v2_idx",
+          "columns": [
+            {
+              "expression": "sleep_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "vendor",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"task_runs\".\"status\" IN ('running', 'idle') AND \"task_runs\".\"machine_id\" IS NOT NULL AND \"task_runs\".\"sleep_at\" IS NOT NULL AND \"task_runs\".\"sleep_requested_at\" IS NULL AND \"task_runs\".\"snapshot_id\" IS NULL AND \"task_runs\".\"snapshot_requested_at\" IS NULL AND \"task_runs\".\"vendor\" IN ('modal', 'daytona', 'e2b', 'docker', 'blaxel', 'roomote', 'azure')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_runs_sleep_check_stale_worker_v2_idx": {
+          "name": "task_runs_sleep_check_stale_worker_v2_idx",
+          "columns": [
+            {
+              "expression": "worker_heartbeat_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "vendor",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"task_runs\".\"status\" IN ('running', 'idle') AND \"task_runs\".\"machine_id\" IS NOT NULL AND \"task_runs\".\"worker_heartbeat_at\" IS NOT NULL AND \"task_runs\".\"sleep_requested_at\" IS NULL AND \"task_runs\".\"snapshot_id\" IS NULL AND \"task_runs\".\"snapshot_requested_at\" IS NULL AND \"task_runs\".\"vendor\" IN ('modal', 'daytona', 'e2b', 'docker', 'blaxel', 'roomote', 'azure')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_runs_sleep_check_active_v2_idx": {
+          "name": "task_runs_sleep_check_active_v2_idx",
+          "columns": [
+            {
+              "expression": "vendor",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"task_runs\".\"status\" IN ('running', 'idle') AND \"task_runs\".\"machine_id\" IS NOT NULL AND \"task_runs\".\"sleep_requested_at\" IS NULL AND \"task_runs\".\"snapshot_id\" IS NULL AND \"task_runs\".\"snapshot_requested_at\" IS NULL AND \"task_runs\".\"vendor\" IN ('modal', 'daytona', 'e2b', 'docker', 'blaxel', 'roomote', 'azure')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_runs_source_snapshot_id_idx": {
+          "name": "task_runs_source_snapshot_id_idx",
+          "columns": [
+            {
+              "expression": "source_snapshot_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_runs_source_run_id_idx": {
+          "name": "task_runs_source_run_id_idx",
+          "columns": [
+            {
+              "expression": "source_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_runs_discord_source_event_unique": {
+          "name": "task_runs_discord_source_event_unique",
+          "columns": [
+            {
+              "expression": "(\"payload\"->>'communicationSourceEventId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"task_runs\".\"payload\"->>'communicationProvider' = 'discord' AND \"task_runs\".\"payload\"->>'communicationSourceEventId' IS NOT NULL AND \"task_runs\".\"canceled_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_runs_first_assistant_output_at_idx": {
+          "name": "task_runs_first_assistant_output_at_idx",
+          "columns": [
+            {
+              "expression": "first_assistant_output_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "task_runs_task_id_tasks_id_fk": {
+          "name": "task_runs_task_id_tasks_id_fk",
+          "tableFrom": "task_runs",
+          "tableTo": "tasks",
+          "columnsFrom": ["task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "task_runs_source_run_id_task_runs_id_fk": {
+          "name": "task_runs_source_run_id_task_runs_id_fk",
+          "tableFrom": "task_runs",
+          "tableTo": "task_runs",
+          "columnsFrom": ["source_run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "task_runs_acting_user_id_users_id_fk": {
+          "name": "task_runs_acting_user_id_users_id_fk",
+          "tableFrom": "task_runs",
+          "tableTo": "users",
+          "columnsFrom": ["acting_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "task_runs_kind_check": {
+          "name": "task_runs_kind_check",
+          "value": "\"task_runs\".\"kind\" in ('fresh', 'resume')"
+        },
+        "task_runs_harness_check": {
+          "name": "task_runs_harness_check",
+          "value": "\"task_runs\".\"harness\" in ('opencode-server')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.task_slack_reply_details": {
+      "name": "task_slack_reply_details",
+      "schema": "",
+      "columns": {
+        "detail_id": {
+          "name": "detail_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "task_id": {
+          "name": "task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "findings": {
+          "name": "findings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "task_slack_reply_details_task_id_idx": {
+          "name": "task_slack_reply_details_task_id_idx",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_slack_reply_details_deployment_task_detail_unique": {
+          "name": "task_slack_reply_details_deployment_task_detail_unique",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "detail_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "task_slack_reply_details_task_id_tasks_id_fk": {
+          "name": "task_slack_reply_details_task_id_tasks_id_fk",
+          "tableFrom": "task_slack_reply_details",
+          "tableTo": "tasks",
+          "columnsFrom": ["task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.task_start_parallel_counts": {
+      "name": "task_start_parallel_counts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "task_id": {
+          "name": "task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload_kind": {
+          "name": "payload_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parallel_count": {
+          "name": "parallel_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activity_window_seconds": {
+          "name": "activity_window_seconds",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ended_at": {
+          "name": "ended_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "task_start_parallel_counts_run_id_unique": {
+          "name": "task_start_parallel_counts_run_id_unique",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_start_parallel_counts_task_id_started_at_idx": {
+          "name": "task_start_parallel_counts_task_id_started_at_idx",
+          "columns": [
+            {
+              "expression": "task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "task_start_parallel_counts_started_at_idx": {
+          "name": "task_start_parallel_counts_started_at_idx",
+          "columns": [
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "task_start_parallel_counts_task_id_tasks_id_fk": {
+          "name": "task_start_parallel_counts_task_id_tasks_id_fk",
+          "tableFrom": "task_start_parallel_counts",
+          "tableTo": "tasks",
+          "columnsFrom": ["task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "task_start_parallel_counts_run_id_task_runs_id_fk": {
+          "name": "task_start_parallel_counts_run_id_task_runs_id_fk",
+          "tableFrom": "task_start_parallel_counts",
+          "tableTo": "task_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tasks": {
+      "name": "tasks",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workflow": {
+          "name": "workflow",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "surface": {
+          "name": "surface",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'visible'"
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "initiator_kind": {
+          "name": "initiator_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "initiator_user_id": {
+          "name": "initiator_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "initiator_automation": {
+          "name": "initiator_automation",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_external_id": {
+          "name": "actor_external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_display_name": {
+          "name": "actor_display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "commit_author_kind": {
+          "name": "commit_author_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "commit_author_user_id": {
+          "name": "commit_author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "commit_author_login": {
+          "name": "commit_author_login",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "commit_author_external_id": {
+          "name": "commit_author_external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pr_assignee_login": {
+          "name": "pr_assignee_login",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slack_channel_id": {
+          "name": "slack_channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slack_thread_ts": {
+          "name": "slack_thread_ts",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linear_session_id": {
+          "name": "linear_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linear_issue_id": {
+          "name": "linear_issue_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linear_organization_id": {
+          "name": "linear_organization_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness": {
+          "name": "harness",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'opencode-server'"
+        },
+        "harness_session_id": {
+          "name": "harness_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model_provider": {
+          "name": "model_provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title_edited_by_user_at": {
+          "name": "title_edited_by_user_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "llm_title_checkpoint": {
+          "name": "llm_title_checkpoint",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "prompt": {
+          "name": "prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "draft_prompt": {
+          "name": "draft_prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_work_kind": {
+          "name": "requested_work_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "requested_work_kind_source": {
+          "name": "requested_work_kind_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system_default'"
+        },
+        "requested_work_kind_confidence": {
+          "name": "requested_work_kind_confidence",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_instructions": {
+          "name": "harness_instructions",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "compute_duration_ms": {
+          "name": "compute_duration_ms",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "timestamp": {
+          "name": "timestamp",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "activity_at": {
+          "name": "activity_at",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "repository_url": {
+          "name": "repository_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repository_name": {
+          "name": "repository_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "default_branch": {
+          "name": "default_branch",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tasks_initiator_user_id_idx": {
+          "name": "tasks_initiator_user_id_idx",
+          "columns": [
+            {
+              "expression": "initiator_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tasks_initiator_automation_idx": {
+          "name": "tasks_initiator_automation_idx",
+          "columns": [
+            {
+              "expression": "initiator_automation",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tasks_workflow_idx": {
+          "name": "tasks_workflow_idx",
+          "columns": [
+            {
+              "expression": "workflow",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tasks_visibility_activity_at_idx": {
+          "name": "tasks_visibility_activity_at_idx",
+          "columns": [
+            {
+              "expression": "visibility",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "activity_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tasks_harness_session_id_idx": {
+          "name": "tasks_harness_session_id_idx",
+          "columns": [
+            {
+              "expression": "harness_session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tasks_timestamp_idx": {
+          "name": "tasks_timestamp_idx",
+          "columns": [
+            {
+              "expression": "timestamp",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tasks_deployment_activity_at_idx": {
+          "name": "tasks_deployment_activity_at_idx",
+          "columns": [
+            {
+              "expression": "activity_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tasks_created_at_idx": {
+          "name": "tasks_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tasks_initiator_user_id_users_id_fk": {
+          "name": "tasks_initiator_user_id_users_id_fk",
+          "tableFrom": "tasks",
+          "tableTo": "users",
+          "columnsFrom": ["initiator_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "tasks_initiator_automation_automations_key_fk": {
+          "name": "tasks_initiator_automation_automations_key_fk",
+          "tableFrom": "tasks",
+          "tableTo": "automations",
+          "columnsFrom": ["initiator_automation"],
+          "columnsTo": ["key"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "tasks_commit_author_user_id_users_id_fk": {
+          "name": "tasks_commit_author_user_id_users_id_fk",
+          "tableFrom": "tasks",
+          "tableTo": "users",
+          "columnsFrom": ["commit_author_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "tasks_initiator_shape_check": {
+          "name": "tasks_initiator_shape_check",
+          "value": "(\"tasks\".\"initiator_kind\" = 'user' AND \"tasks\".\"initiator_automation\" IS NULL AND (\"tasks\".\"initiator_user_id\" IS NOT NULL OR \"tasks\".\"actor_external_id\" IS NOT NULL)) OR (\"tasks\".\"initiator_kind\" = 'automation' AND \"tasks\".\"initiator_automation\" IS NOT NULL AND \"tasks\".\"initiator_user_id\" IS NULL)"
+        },
+        "tasks_workflow_check": {
+          "name": "tasks_workflow_check",
+          "value": "\"tasks\".\"workflow\" in ('standard', 'pr_review', 'pr_conflict_resolve', 'scan', 'mcp_recommendations', 'setup_onboarding', 'env_snapshot', 'eval')"
+        },
+        "tasks_surface_check": {
+          "name": "tasks_surface_check",
+          "value": "\"tasks\".\"surface\" in ('web', 'api', 'slack', 'teams', 'telegram', 'discord', 'linear', 'github', 'gitlab', 'gitea', 'ado', 'bitbucket', 'system')"
+        },
+        "tasks_trigger_check": {
+          "name": "tasks_trigger_check",
+          "value": "\"tasks\".\"trigger\" in ('message', 'webhook', 'schedule', 'manual')"
+        },
+        "tasks_visibility_check": {
+          "name": "tasks_visibility_check",
+          "value": "\"tasks\".\"visibility\" in ('visible', 'hidden')"
+        },
+        "tasks_state_check": {
+          "name": "tasks_state_check",
+          "value": "\"tasks\".\"state\" in ('active', 'completed', 'failed', 'canceled')"
+        },
+        "tasks_harness_check": {
+          "name": "tasks_harness_check",
+          "value": "\"tasks\".\"harness\" in ('opencode-server')"
+        },
+        "tasks_requested_work_kind_check": {
+          "name": "tasks_requested_work_kind_check",
+          "value": "\"tasks\".\"requested_work_kind\" in ('question', 'plan', 'implement', 'unknown')"
+        },
+        "tasks_requested_work_kind_source_check": {
+          "name": "tasks_requested_work_kind_source_check",
+          "value": "\"tasks\".\"requested_work_kind_source\" in ('explicit_bootstrap', 'task_tool', 'llm_classifier', 'inherited', 'system_default')"
+        },
+        "tasks_commit_author_kind_check": {
+          "name": "tasks_commit_author_kind_check",
+          "value": "\"tasks\".\"commit_author_kind\" IS NULL OR \"tasks\".\"commit_author_kind\" in ('roomote', 'user', 'external')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.teams_installations": {
+      "name": "teams_installations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "installation_key": {
+          "name": "installation_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "team_name": {
+          "name": "team_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "channel_id": {
+          "name": "channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "channel_name": {
+          "name": "channel_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "conversation_id": {
+          "name": "conversation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "conversation_type": {
+          "name": "conversation_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "bot_app_id": {
+          "name": "bot_app_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bot_user_id": {
+          "name": "bot_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "bot_name": {
+          "name": "bot_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "service_url": {
+          "name": "service_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "last_activity_at": {
+          "name": "last_activity_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "teams_installations_tenant_id_idx": {
+          "name": "teams_installations_tenant_id_idx",
+          "columns": [
+            {
+              "expression": "tenant_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "teams_installations_team_id_idx": {
+          "name": "teams_installations_team_id_idx",
+          "columns": [
+            {
+              "expression": "team_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "teams_installations_conversation_id_idx": {
+          "name": "teams_installations_conversation_id_idx",
+          "columns": [
+            {
+              "expression": "conversation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "teams_installations_active_idx": {
+          "name": "teams_installations_active_idx",
+          "columns": [
+            {
+              "expression": "is_active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "teams_installations_installation_key_unique": {
+          "name": "teams_installations_installation_key_unique",
+          "nullsNotDistinct": false,
+          "columns": ["installation_key"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.teams_user_mappings": {
+      "name": "teams_user_mappings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "teams_user_id": {
+          "name": "teams_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "teams_tenant_id": {
+          "name": "teams_tenant_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "teams_aad_object_id": {
+          "name": "teams_aad_object_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "teams_user_mappings_aad_object_idx": {
+          "name": "teams_user_mappings_aad_object_idx",
+          "columns": [
+            {
+              "expression": "teams_aad_object_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "teams_tenant_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "teams_user_mappings_user_id_idx": {
+          "name": "teams_user_mappings_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "teams_user_mappings_user_id_users_id_fk": {
+          "name": "teams_user_mappings_user_id_users_id_fk",
+          "tableFrom": "teams_user_mappings",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "teams_user_mappings_unique": {
+          "name": "teams_user_mappings_unique",
+          "nullsNotDistinct": false,
+          "columns": ["teams_user_id", "teams_tenant_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.telegram_user_mappings": {
+      "name": "telegram_user_mappings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "telegram_user_id": {
+          "name": "telegram_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "telegram_chat_id": {
+          "name": "telegram_chat_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "telegram_username": {
+          "name": "telegram_username",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "telegram_user_mappings_user_id_idx": {
+          "name": "telegram_user_mappings_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "telegram_user_mappings_user_id_users_id_fk": {
+          "name": "telegram_user_mappings_user_id_users_id_fk",
+          "tableFrom": "telegram_user_mappings",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "telegram_user_mappings_unique": {
+          "name": "telegram_user_mappings_unique",
+          "nullsNotDistinct": false,
+          "columns": ["telegram_user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tracked_messages": {
+      "name": "tracked_messages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "surface": {
+          "name": "surface",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "dedupe_key": {
+          "name": "dedupe_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "channel_id": {
+          "name": "channel_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message_ts": {
+          "name": "message_ts",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "thread_ts": {
+          "name": "thread_ts",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "work_item_id": {
+          "name": "work_item_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "automation_key": {
+          "name": "automation_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary_text": {
+          "name": "summary_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "posted_at": {
+          "name": "posted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "dismissed_at": {
+          "name": "dismissed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tracked_messages_kind_dedupe_key_unique": {
+          "name": "tracked_messages_kind_dedupe_key_unique",
+          "columns": [
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "dedupe_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tracked_messages_work_item_id_idx": {
+          "name": "tracked_messages_work_item_id_idx",
+          "columns": [
+            {
+              "expression": "work_item_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tracked_messages_channel_message_idx": {
+          "name": "tracked_messages_channel_message_idx",
+          "columns": [
+            {
+              "expression": "channel_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "message_ts",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tracked_messages_automation_channel_posted_idx": {
+          "name": "tracked_messages_automation_channel_posted_idx",
+          "columns": [
+            {
+              "expression": "automation_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "channel_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "posted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tracked_messages_work_item_id_work_items_id_fk": {
+          "name": "tracked_messages_work_item_id_work_items_id_fk",
+          "tableFrom": "tracked_messages",
+          "tableTo": "work_items",
+          "columnsFrom": ["work_item_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tracked_messages_automation_key_automations_key_fk": {
+          "name": "tracked_messages_automation_key_automations_key_fk",
+          "tableFrom": "tracked_messages",
+          "tableTo": "automations",
+          "columnsFrom": ["automation_key"],
+          "columnsTo": ["key"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tracked_messages_created_by_user_id_users_id_fk": {
+          "name": "tracked_messages_created_by_user_id_users_id_fk",
+          "tableFrom": "tracked_messages",
+          "tableTo": "users",
+          "columnsFrom": ["created_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_api_keys": {
+      "name": "user_api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "api_key": {
+          "name": "api_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_api_keys_user_id_idx": {
+          "name": "user_api_keys_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_api_keys_user_deployment_provider_unique": {
+          "name": "user_api_keys_user_deployment_provider_unique",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_api_keys_user_id_users_id_fk": {
+          "name": "user_api_keys_user_id_users_id_fk",
+          "tableFrom": "user_api_keys",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.users": {
+      "name": "users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "image_url": {
+          "name": "image_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity": {
+          "name": "entity",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'member'"
+        },
+        "analytics_id": {
+          "name": "analytics_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cookie_consented_at": {
+          "name": "cookie_consented_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "onboarding_completed_at": {
+          "name": "onboarding_completed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invited_by_invite_id": {
+          "name": "invited_by_invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_sync_at": {
+          "name": "last_sync_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "users_email_idx": {
+          "name": "users_email_idx",
+          "columns": [
+            {
+              "expression": "email",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "users_created_at_idx": {
+          "name": "users_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "users_analytics_id_unique_idx": {
+          "name": "users_analytics_id_unique_idx",
+          "columns": [
+            {
+              "expression": "analytics_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.webhooks": {
+      "name": "webhooks",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "delivery_id": {
+          "name": "delivery_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event": {
+          "name": "event",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "succeeded_at": {
+          "name": "succeeded_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failed_at": {
+          "name": "failed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "webhooks_provider_delivery_id_unique": {
+          "name": "webhooks_provider_delivery_id_unique",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "delivery_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhooks_event_idx": {
+          "name": "webhooks_event_idx",
+          "columns": [
+            {
+              "expression": "event",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "webhooks_created_at_idx": {
+          "name": "webhooks_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "webhooks_status_exclusive": {
+          "name": "webhooks_status_exclusive",
+          "value": "(\n        (succeeded_at IS NOT NULL)::int +\n        (failed_at IS NOT NULL)::int\n      ) <= 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.work_items": {
+      "name": "work_items",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "automation_key": {
+          "name": "automation_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_task_id": {
+          "name": "source_task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "selected_by_user_id": {
+          "name": "selected_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_work_item_id": {
+          "name": "source_work_item_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "brief": {
+          "name": "brief",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_prompt": {
+          "name": "execution_prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "investigation_context": {
+          "name": "investigation_context",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "category": {
+          "name": "category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "priority": {
+          "name": "priority",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action_kind": {
+          "name": "action_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disposition": {
+          "name": "disposition",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "repository_ids": {
+          "name": "repository_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "target_repository_full_name": {
+          "name": "target_repository_full_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_environment_id": {
+          "name": "target_environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_readiness": {
+          "name": "workspace_readiness",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "readiness_message": {
+          "name": "readiness_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fingerprint": {
+          "name": "fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "launch_claimed_at": {
+          "name": "launch_claimed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "launched_task_id": {
+          "name": "launched_task_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "launched_at": {
+          "name": "launched_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failed_at": {
+          "name": "failed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "launch_error": {
+          "name": "launch_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "dismissed_at": {
+          "name": "dismissed_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "work_items_source_task_idx": {
+          "name": "work_items_source_task_idx",
+          "columns": [
+            {
+              "expression": "source_task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "work_items_kind_status_idx": {
+          "name": "work_items_kind_status_idx",
+          "columns": [
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "work_items_automation_key_fingerprint_idx": {
+          "name": "work_items_automation_key_fingerprint_idx",
+          "columns": [
+            {
+              "expression": "automation_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "work_items_fingerprint_idx": {
+          "name": "work_items_fingerprint_idx",
+          "columns": [
+            {
+              "expression": "fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "work_items_launched_task_id_idx": {
+          "name": "work_items_launched_task_id_idx",
+          "columns": [
+            {
+              "expression": "launched_task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "work_items_source_task_kind_sort_order_unique": {
+          "name": "work_items_source_task_kind_sort_order_unique",
+          "columns": [
+            {
+              "expression": "source_task_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sort_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "work_items_automation_key_automations_key_fk": {
+          "name": "work_items_automation_key_automations_key_fk",
+          "tableFrom": "work_items",
+          "tableTo": "automations",
+          "columnsFrom": ["automation_key"],
+          "columnsTo": ["key"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "work_items_source_task_id_tasks_id_fk": {
+          "name": "work_items_source_task_id_tasks_id_fk",
+          "tableFrom": "work_items",
+          "tableTo": "tasks",
+          "columnsFrom": ["source_task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "work_items_selected_by_user_id_users_id_fk": {
+          "name": "work_items_selected_by_user_id_users_id_fk",
+          "tableFrom": "work_items",
+          "tableTo": "users",
+          "columnsFrom": ["selected_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "work_items_source_work_item_id_work_items_id_fk": {
+          "name": "work_items_source_work_item_id_work_items_id_fk",
+          "tableFrom": "work_items",
+          "tableTo": "work_items",
+          "columnsFrom": ["source_work_item_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "work_items_target_environment_id_environments_id_fk": {
+          "name": "work_items_target_environment_id_environments_id_fk",
+          "tableFrom": "work_items",
+          "tableTo": "environments",
+          "columnsFrom": ["target_environment_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "work_items_launched_task_id_tasks_id_fk": {
+          "name": "work_items_launched_task_id_tasks_id_fk",
+          "tableFrom": "work_items",
+          "tableTo": "tasks",
+          "columnsFrom": ["launched_task_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/packages/db/drizzle/meta/_journal.json b/packages/db/drizzle/meta/_journal.json
index beabfe8e7..05c0a42a3 100644
--- a/packages/db/drizzle/meta/_journal.json
+++ b/packages/db/drizzle/meta/_journal.json
@@ -197,6 +197,13 @@
       "when": 1785686208286,
       "tag": "0027_strange_the_hunter",
       "breakpoints": true
+    },
+    {
+      "idx": 28,
+      "version": "7",
+      "when": 1785748471387,
+      "tag": "0028_aspiring_thena",
+      "breakpoints": true
     }
   ]
 }
diff --git a/packages/db/src/lib/deployment-license.ts b/packages/db/src/lib/deployment-license.ts
new file mode 100644
index 000000000..cae61b77a
--- /dev/null
+++ b/packages/db/src/lib/deployment-license.ts
@@ -0,0 +1,309 @@
+import { createPublicKey, verify as verifySignature } from 'node:crypto';
+
+import { Env } from '@roomote/env';
+
+import { db, type DatabaseOrTransaction } from '../db';
+import {
+  deploymentSettings,
+  type LicenseCloudEntitlements,
+  type LicenseCloudState,
+  users,
+} from '../schema';
+import { eq, isNull, sql } from 'drizzle-orm';
+
+const DEFAULT_DEPLOYMENT_ID = 'default';
+
+/** Free active-user limit before a paid license key is required. */
+export const FREE_SEAT_LIMIT = 10;
+
+const LICENSE_KEY_PREFIX = 'RMLK1';
+const LICENSE_PUBLIC_KEY_SPKI_B64 =
+  'MCowBQYDK2VwAyEAs8vzncSsZYeJCxOYCeSbzH5VEDFJNhh/c6HTBu4N+Sk=';
+
+export type LicensePayload = {
+  licenseId: string;
+  licensee: string;
+  maxSeats: number;
+  issuedAt: Date;
+  expiresAt: Date | null;
+};
+
+export type DeploymentLicenseState =
+  | { status: 'unlicensed'; seatLimit: number }
+  | { status: 'invalid'; seatLimit: number }
+  | ({ status: 'valid' | 'expired'; seatLimit: number } & LicensePayload);
+
+export type LicenseCloudLease = LicenseCloudState;
+
+function parseIsoDate(value: unknown): Date | null {
+  if (typeof value !== 'string') {
+    return null;
+  }
+
+  const date = new Date(value);
+  return Number.isNaN(date.getTime()) ? null : date;
+}
+
+export function verifyLicenseKey(
+  licenseKey: string,
+  publicKeySpkiB64: string = LICENSE_PUBLIC_KEY_SPKI_B64,
+): LicensePayload | null {
+  const [prefix, payloadB64, signatureB64, ...rest] = licenseKey
+    .trim()
+    .split('.');
+
+  if (
+    prefix !== LICENSE_KEY_PREFIX ||
+    !payloadB64 ||
+    !signatureB64 ||
+    rest.length > 0
+  ) {
+    return null;
+  }
+
+  let payload: Record<string, unknown>;
+
+  try {
+    const payloadBytes = Buffer.from(payloadB64, 'base64url');
+    const signature = Buffer.from(signatureB64, 'base64url');
+    const publicKey = createPublicKey({
+      key: Buffer.from(publicKeySpkiB64, 'base64'),
+      format: 'der',
+      type: 'spki',
+    });
+
+    if (!verifySignature(null, payloadBytes, publicKey, signature)) {
+      return null;
+    }
+
+    payload = JSON.parse(payloadBytes.toString('utf8')) as Record<
+      string,
+      unknown
+    >;
+  } catch {
+    return null;
+  }
+
+  const issuedAt = parseIsoDate(payload.issuedAt);
+  const expiresAt =
+    payload.expiresAt == null ? null : parseIsoDate(payload.expiresAt);
+
+  if (
+    typeof payload.licenseId !== 'string' ||
+    !payload.licenseId ||
+    typeof payload.licensee !== 'string' ||
+    !payload.licensee ||
+    typeof payload.maxSeats !== 'number' ||
+    !Number.isInteger(payload.maxSeats) ||
+    payload.maxSeats < 1 ||
+    issuedAt == null ||
+    (payload.expiresAt != null && expiresAt == null)
+  ) {
+    return null;
+  }
+
+  return {
+    licenseId: payload.licenseId,
+    licensee: payload.licensee,
+    maxSeats: payload.maxSeats,
+    issuedAt,
+    expiresAt,
+  };
+}
+
+export function resolveLicenseState(
+  licenseKey: string | null | undefined,
+  now: Date = new Date(),
+  publicKeySpkiB64: string = LICENSE_PUBLIC_KEY_SPKI_B64,
+): DeploymentLicenseState {
+  if (!licenseKey || !licenseKey.trim()) {
+    return { status: 'unlicensed', seatLimit: FREE_SEAT_LIMIT };
+  }
+
+  const payload = verifyLicenseKey(licenseKey, publicKeySpkiB64);
+
+  if (!payload) {
+    return { status: 'invalid', seatLimit: FREE_SEAT_LIMIT };
+  }
+
+  if (
+    payload.expiresAt != null &&
+    payload.expiresAt.getTime() <= now.getTime()
+  ) {
+    return { ...payload, status: 'expired', seatLimit: FREE_SEAT_LIMIT };
+  }
+
+  return {
+    ...payload,
+    status: 'valid',
+    seatLimit: Math.max(payload.maxSeats, FREE_SEAT_LIMIT),
+  };
+}
+
+/**
+ * A paid signed key only raises the seat limit while the matching deployment
+ * has a current lease from Roomote Cloud. The signature remains the source of
+ * truth for the license identity and expiry; Cloud binds that identity to one
+ * installation.
+ */
+export function hasCurrentLicenseActivation(
+  licenseState: DeploymentLicenseState,
+  cloudState: LicenseCloudLease | null | undefined,
+  deploymentId: string,
+  now: Date = new Date(),
+): boolean {
+  const activationExpiresAt = cloudState
+    ? new Date(cloudState.activationExpiresAt)
+    : null;
+  return (
+    licenseState.status === 'valid' &&
+    cloudState?.licenseId === licenseState.licenseId &&
+    cloudState.deploymentId === deploymentId &&
+    activationExpiresAt != null &&
+    !Number.isNaN(activationExpiresAt.getTime()) &&
+    activationExpiresAt.getTime() > now.getTime()
+  );
+}
+
+export function getEffectiveSeatLimit(
+  licenseState: DeploymentLicenseState,
+  cloudState: LicenseCloudLease | null | undefined,
+  deploymentId: string,
+  now: Date = new Date(),
+): number {
+  return hasCurrentLicenseActivation(
+    licenseState,
+    cloudState,
+    deploymentId,
+    now,
+  )
+    ? licenseState.seatLimit
+    : FREE_SEAT_LIMIT;
+}
+
+export function getCurrentLicenseEntitlements(
+  licenseState: DeploymentLicenseState,
+  cloudState: LicenseCloudLease | null | undefined,
+  deploymentId: string,
+  now: Date = new Date(),
+): LicenseCloudEntitlements | null {
+  if (
+    !hasCurrentLicenseActivation(licenseState, cloudState, deploymentId, now) ||
+    !cloudState ||
+    Number.isNaN(new Date(cloudState.entitlementsExpiresAt).getTime()) ||
+    new Date(cloudState.entitlementsExpiresAt).getTime() <= now.getTime()
+  ) {
+    return null;
+  }
+
+  return cloudState.entitlements;
+}
+
+export function getEnvLicenseKey(): string | null {
+  const value = Env.R_LICENSE_KEY?.trim();
+  return value || null;
+}
+
+export function resolveConfiguredLicenseKey(
+  storedLicenseKey: string | null | undefined,
+): string | null {
+  return getEnvLicenseKey() ?? (storedLicenseKey?.trim() || null);
+}
+
+export async function getDeploymentLicenseState(
+  executor: DatabaseOrTransaction = db,
+): Promise<DeploymentLicenseState> {
+  const envLicenseKey = getEnvLicenseKey();
+  if (envLicenseKey) {
+    return resolveLicenseState(envLicenseKey);
+  }
+
+  const [settings] = await executor
+    .select({ licenseKey: deploymentSettings.licenseKey })
+    .from(deploymentSettings)
+    .where(eq(deploymentSettings.id, DEFAULT_DEPLOYMENT_ID))
+    .limit(1);
+
+  return resolveLicenseState(settings?.licenseKey);
+}
+
+export async function getEffectiveDeploymentSeatLimit(): Promise<number> {
+  const [licenseState, settings] = await Promise.all([
+    getDeploymentLicenseState(),
+    db.query.deploymentSettings.findFirst({
+      where: eq(deploymentSettings.id, DEFAULT_DEPLOYMENT_ID),
+      columns: { licenseCloudState: true, instanceAnalyticsId: true },
+    }),
+  ]);
+
+  return getEffectiveSeatLimit(
+    licenseState,
+    settings?.licenseCloudState,
+    Env.R_INSTANCE_ID ?? settings?.instanceAnalyticsId ?? '',
+  );
+}
+
+export class SeatLimitExceededError extends Error {
+  constructor(seatLimit: number) {
+    super(
+      `This deployment has reached its licensed limit of ${seatLimit} users.`,
+    );
+    this.name = 'SeatLimitExceededError';
+  }
+}
+
+export async function hasSeatAvailable(): Promise<boolean> {
+  const [licenseState, settings, [activeUsers]] = await Promise.all([
+    getDeploymentLicenseState(),
+    db.query.deploymentSettings.findFirst({
+      where: eq(deploymentSettings.id, DEFAULT_DEPLOYMENT_ID),
+      columns: { licenseCloudState: true, instanceAnalyticsId: true },
+    }),
+    db
+      .select({ count: sql<number>`count(*)::int` })
+      .from(users)
+      .where(isNull(users.deletedAt)),
+  ]);
+
+  const deploymentId = Env.R_INSTANCE_ID ?? settings?.instanceAnalyticsId ?? '';
+  const seatLimit = getEffectiveSeatLimit(
+    licenseState,
+    settings?.licenseCloudState,
+    deploymentId,
+  );
+  return (activeUsers?.count ?? 0) < seatLimit;
+}
+
+export async function assertSeatAvailable(
+  tx: DatabaseOrTransaction,
+): Promise<void> {
+  const [settings] = await tx
+    .select({
+      licenseKey: deploymentSettings.licenseKey,
+      licenseCloudState: deploymentSettings.licenseCloudState,
+      instanceAnalyticsId: deploymentSettings.instanceAnalyticsId,
+    })
+    .from(deploymentSettings)
+    .where(eq(deploymentSettings.id, DEFAULT_DEPLOYMENT_ID))
+    .for('update');
+
+  const [activeUsers] = await tx
+    .select({ count: sql<number>`count(*)::int` })
+    .from(users)
+    .where(isNull(users.deletedAt));
+
+  const licenseState = resolveLicenseState(
+    resolveConfiguredLicenseKey(settings?.licenseKey),
+  );
+
+  const deploymentId = Env.R_INSTANCE_ID ?? settings?.instanceAnalyticsId ?? '';
+  const seatLimit = getEffectiveSeatLimit(
+    licenseState,
+    settings?.licenseCloudState,
+    deploymentId,
+  );
+
+  if ((activeUsers?.count ?? 0) >= seatLimit) {
+    throw new SeatLimitExceededError(seatLimit);
+  }
+}
diff --git a/packages/db/src/lib/instance-report.ts b/packages/db/src/lib/instance-report.ts
index 501b39b1c..9490d73a5 100644
--- a/packages/db/src/lib/instance-report.ts
+++ b/packages/db/src/lib/instance-report.ts
@@ -855,3 +855,15 @@ export async function collectInstanceReportStats(
     },
   };
 }
+
+/** Minimal licensed-usage payload sent even when anonymous analytics is off. */
+export async function collectLicensedUserCount(): Promise<{
+  users: { total: number };
+}> {
+  const [userTotals] = await db
+    .select({ total: count() })
+    .from(users)
+    .where(isNull(users.deletedAt));
+
+  return { users: { total: userTotals?.total ?? 0 } };
+}
diff --git a/packages/db/src/lib/license-usage-observations.ts b/packages/db/src/lib/license-usage-observations.ts
new file mode 100644
index 000000000..2fcdd1aa4
--- /dev/null
+++ b/packages/db/src/lib/license-usage-observations.ts
@@ -0,0 +1,79 @@
+import { nanoid } from 'nanoid';
+import { and, asc, eq, isNull, sql } from 'drizzle-orm';
+
+import { db, type DatabaseOrTransaction } from '../db';
+import { licenseUsageObservations, users } from '../schema';
+
+const OBSERVATION_BATCH_SIZE = 100;
+
+export type LicenseUsageObservation = {
+  id: string;
+  observedAt: Date;
+  activeUsers: number;
+};
+
+/** Record the post-mutation active-user count in the caller's transaction. */
+export async function recordLicenseUsageObservation(
+  executor: DatabaseOrTransaction,
+  observedAt: Date = new Date(),
+): Promise<LicenseUsageObservation> {
+  const [totals] = await executor
+    .select({ total: sql<number>`count(*)::int` })
+    .from(users)
+    .where(isNull(users.deletedAt));
+  const observation: LicenseUsageObservation = {
+    id: nanoid(),
+    observedAt,
+    activeUsers: totals?.total ?? 0,
+  };
+
+  await executor.insert(licenseUsageObservations).values(observation);
+  return observation;
+}
+
+/** Adds the daily heartbeat observation and returns undelivered work. */
+export async function recordDailyLicenseUsageObservation(): Promise<LicenseUsageObservation> {
+  return recordLicenseUsageObservation(db);
+}
+
+export async function listPendingLicenseUsageObservations(): Promise<
+  LicenseUsageObservation[]
+> {
+  return db
+    .select({
+      id: licenseUsageObservations.id,
+      observedAt: licenseUsageObservations.observedAt,
+      activeUsers: licenseUsageObservations.activeUsers,
+    })
+    .from(licenseUsageObservations)
+    .where(isNull(licenseUsageObservations.deliveredAt))
+    .orderBy(asc(licenseUsageObservations.observedAt))
+    .limit(OBSERVATION_BATCH_SIZE);
+}
+
+export async function markLicenseUsageObservationAttempt(
+  id: string,
+): Promise<void> {
+  await db
+    .update(licenseUsageObservations)
+    .set({
+      attempts: sql`${licenseUsageObservations.attempts} + 1`,
+      lastAttemptedAt: new Date(),
+      updatedAt: new Date(),
+    })
+    .where(
+      and(
+        eq(licenseUsageObservations.id, id),
+        isNull(licenseUsageObservations.deliveredAt),
+      ),
+    );
+}
+
+export async function markLicenseUsageObservationDelivered(
+  id: string,
+): Promise<void> {
+  await db
+    .update(licenseUsageObservations)
+    .set({ deliveredAt: new Date(), updatedAt: new Date() })
+    .where(eq(licenseUsageObservations.id, id));
+}
diff --git a/packages/db/src/schema.ts b/packages/db/src/schema.ts
index 066db8249..e9d491ca0 100644
--- a/packages/db/src/schema.ts
+++ b/packages/db/src/schema.ts
@@ -80,6 +80,22 @@ import type {
 } from './lib/setup-qualification';
 import { generateTaskId } from './lib/task-id';
 
+export type LicenseCloudEntitlements = Record<
+  string,
+  string | number | boolean
+>;
+
+/** Cached self-hosted licensing lease issued by Roomote Cloud. */
+export type LicenseCloudState = {
+  licenseId: string;
+  deploymentId: string;
+  activationExpiresAt: string;
+  entitlementsVersion: string;
+  entitlements: LicenseCloudEntitlements;
+  entitlementsExpiresAt: string;
+  lastSyncedAt: string;
+};
+
 /**
  * users
  */
@@ -158,6 +174,10 @@ export const deploymentSettings = pgTable('deployment_settings', {
   // deployment's seat limit above the free tier; null for unlicensed
   // deployments. Verified at read time, never trusted as stored.
   licenseKey: text('license_key'),
+  // Last lease issued by Roomote Cloud for the effective self-hosted license.
+  // This is separate from metadata so local feature-flag writes cannot alter
+  // Cloud-owned entitlements.
+  licenseCloudState: jsonb('license_cloud_state').$type<LicenseCloudState>(),
   // Anonymous instance identifier (short random id, lazily generated by
   // getInstanceAnalyticsId). Stable across versions, never derived from any
   // customer data, and never editable through any user-facing mutation.
@@ -216,6 +236,31 @@ export const deploymentSettings = pgTable('deployment_settings', {
   updatedAt: timestamp('updated_at').notNull().defaultNow(),
 });
 
+/**
+ * Immutable active-user observations awaiting delivery to Roomote Cloud.
+ * Keeping these in Postgres makes billed high-water marks survive Redis or
+ * worker outages.
+ */
+export const licenseUsageObservations = pgTable(
+  'license_usage_observations',
+  {
+    id: text('id').notNull().primaryKey(),
+    observedAt: timestamp('observed_at').notNull(),
+    activeUsers: integer('active_users').notNull(),
+    deliveredAt: timestamp('delivered_at'),
+    attempts: integer('attempts').notNull().default(0),
+    lastAttemptedAt: timestamp('last_attempted_at'),
+    createdAt: timestamp('created_at').notNull().defaultNow(),
+    updatedAt: timestamp('updated_at').notNull().defaultNow(),
+  },
+  (table) => [
+    index('license_usage_observations_pending_idx').on(
+      table.deliveredAt,
+      table.observedAt,
+    ),
+  ],
+);
+
 /**
  * invites
  *
diff --git a/packages/db/src/server.ts b/packages/db/src/server.ts
index fcefd4ccd..46f6c6886 100644
--- a/packages/db/src/server.ts
+++ b/packages/db/src/server.ts
@@ -81,6 +81,8 @@ export * from './lib/setup-qualification';
 export * from './lib/repositories';
 export * from './lib/telemetry-ids';
 export * from './lib/instance-report';
+export * from './lib/deployment-license';
+export * from './lib/license-usage-observations';
 export * from './lib/invocation-identities';
 export * from './lib/webhook-retention';
 export * from './lib/managed-access';
@@ -89,6 +91,7 @@ export {
   users,
   userRelations,
   deploymentSettings,
+  licenseUsageObservations,
   invites,
   authUsers,
   authSessions,
diff --git a/packages/env/src/index.ts b/packages/env/src/index.ts
index 8e9519db8..5a6cbab9d 100644
--- a/packages/env/src/index.ts
+++ b/packages/env/src/index.ts
@@ -288,6 +288,12 @@ const serverSchema = {
   // Optional Roomote license key (RMLK1.…). When set, takes precedence over
   // the key stored in deployment_settings via Settings → Users.
   R_LICENSE_KEY: z.string().optional(),
+  // Roomote Cloud endpoint used to activate self-hosted licenses and report
+  // licensed seat usage. This is deliberately distinct from Ping telemetry.
+  R_LICENSE_CLOUD_BASE_URL: z
+    .string()
+    .url()
+    .default('https://cloud.roomote.dev'),
   PREVIEW_TOKEN_TTL_SECONDS: z.coerce.number().int().positive().default(3600),
   SLACK_API_TIMEOUT_MS: z.coerce.number().int().positive().default(10_000),
   // How long recorded webhook payloads are kept before the WebhookCleanup
@@ -528,6 +534,7 @@ const OPTIONAL_NON_EMPTY_KEYS = new Set([
   'R_MODEL_ENV_KEYS',
   'R_ALLOWED_EMAILS',
   'R_LICENSE_KEY',
+  'R_LICENSE_CLOUD_BASE_URL',
   'R_GITHUB_APP_SLUG',
 ]);
 
diff --git a/packages/sdk/src/server/index.ts b/packages/sdk/src/server/index.ts
index a66ca8648..1fba1362a 100644
--- a/packages/sdk/src/server/index.ts
+++ b/packages/sdk/src/server/index.ts
@@ -324,5 +324,6 @@ export {
 
 export {
   requestInstancePing,
+  requestLicenseUsageSync,
   resetInstancePingQueueForTests,
 } from './lib/request-instance-ping';
diff --git a/packages/sdk/src/server/lib/request-instance-ping.ts b/packages/sdk/src/server/lib/request-instance-ping.ts
index 088b6e4cf..72dec37e0 100644
--- a/packages/sdk/src/server/lib/request-instance-ping.ts
+++ b/packages/sdk/src/server/lib/request-instance-ping.ts
@@ -10,6 +10,7 @@ import { getRedis } from '@roomote/redis';
  */
 const SCHEDULED_JOBS_QUEUE = 'scheduled-jobs';
 const INSTANCE_PING_JOB = 'InstancePing';
+const LICENSE_USAGE_SYNC_JOB = 'LicenseUsageSync';
 
 let queue: Queue | null = null;
 
@@ -58,3 +59,24 @@ export async function requestInstancePing(reason: string): Promise<void> {
     );
   }
 }
+
+/**
+ * Requests prompt delivery of durable licensed-usage observations. Unlike
+ * telemetry, missed queue requests are harmless because the scheduler drains
+ * the database outbox again.
+ */
+export async function requestLicenseUsageSync(reason: string): Promise<void> {
+  try {
+    const minuteBucket = Math.floor(Date.now() / 60_000);
+    await getQueue().add(
+      LICENSE_USAGE_SYNC_JOB,
+      { reason },
+      { jobId: `license-usage-sync-request-${minuteBucket}` },
+    );
+  } catch (error) {
+    console.warn(
+      `[requestLicenseUsageSync] failed to enqueue (reason=${reason}):`,
+      error instanceof Error ? error.message : error,
+    );
+  }
+}
diff --git a/packages/telemetry/src/__tests__/instance-report.test.ts b/packages/telemetry/src/__tests__/instance-report.test.ts
new file mode 100644
index 000000000..249721a29
--- /dev/null
+++ b/packages/telemetry/src/__tests__/instance-report.test.ts
@@ -0,0 +1,89 @@
+const mocks = vi.hoisted(() => ({
+  findSettings: vi.fn(),
+  getDeploymentLicenseState: vi.fn(),
+  getInstanceAnalyticsId: vi.fn(),
+  isAnonymousAnalyticsEnabledFromMetadata: vi.fn(),
+}));
+
+vi.mock('@roomote/env', () => ({
+  Env: {
+    APP_ENV: 'production',
+    RELEASE_VERSION: 'v1.2.3',
+    ROOMOTE_FORCE_TELEMETRY: undefined,
+    R_PING_BASE_URL: 'https://ping.roomote.dev',
+    R_CLOUD_ENABLED: 'false',
+  },
+  isRoomoteCloudEnabled: () => false,
+}));
+
+vi.mock('@roomote/db/server', () => ({
+  db: {
+    query: {
+      deploymentSettings: { findFirst: mocks.findSettings },
+    },
+  },
+  deploymentSettings: { id: 'id' },
+  eq: vi.fn(),
+  getDeploymentLicenseState: mocks.getDeploymentLicenseState,
+  getInstanceAnalyticsId: mocks.getInstanceAnalyticsId,
+  getUserAnalyticsId: vi.fn(),
+  taskRuns: {},
+}));
+
+vi.mock('@roomote/feature-flags', () => ({
+  isAnonymousAnalyticsEnabledFromMetadata:
+    mocks.isAnonymousAnalyticsEnabledFromMetadata,
+}));
+
+import { sendInstanceReport } from '../server';
+
+describe('sendInstanceReport', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.findSettings.mockResolvedValue({ metadata: {} });
+    mocks.getInstanceAnalyticsId.mockResolvedValue('instance-123');
+    mocks.isAnonymousAnalyticsEnabledFromMetadata.mockReturnValue(false);
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue({ ok: true, status: 200 }),
+    );
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it('does not send licensed usage to Ping when analytics is disabled', async () => {
+    mocks.getDeploymentLicenseState.mockResolvedValue({
+      status: 'valid',
+      seatLimit: 100,
+      licenseId: 'lic_sh_123',
+      licensee: 'Engineering',
+      maxSeats: 100,
+      issuedAt: new Date('2026-01-01T00:00:00Z'),
+      expiresAt: new Date('2027-01-01T00:00:00Z'),
+    });
+
+    await expect(sendInstanceReport({ users: { total: 17 } })).resolves.toBe(
+      false,
+    );
+    expect(fetch).not.toHaveBeenCalled();
+  });
+
+  it('does not report an expired license after analytics opt-out', async () => {
+    mocks.getDeploymentLicenseState.mockResolvedValue({
+      status: 'expired',
+      seatLimit: 10,
+      licenseId: 'lic_sh_123',
+      licensee: 'Engineering',
+      maxSeats: 100,
+      issuedAt: new Date('2025-01-01T00:00:00Z'),
+      expiresAt: new Date('2026-01-01T00:00:00Z'),
+    });
+
+    await expect(sendInstanceReport({ users: { total: 17 } })).resolves.toBe(
+      false,
+    );
+    expect(fetch).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/telemetry/src/__tests__/license-cloud.test.ts b/packages/telemetry/src/__tests__/license-cloud.test.ts
new file mode 100644
index 000000000..5f8c9a983
--- /dev/null
+++ b/packages/telemetry/src/__tests__/license-cloud.test.ts
@@ -0,0 +1,164 @@
+const mocks = vi.hoisted(() => ({
+  getDeploymentLicenseState: vi.fn(),
+  getInstanceAnalyticsId: vi.fn(),
+  resolveConfiguredLicenseKey: vi.fn(),
+  resolveLicenseState: vi.fn(),
+  findSettings: vi.fn(),
+  and: vi.fn(),
+  isNull: vi.fn(),
+  updateSet: vi.fn(),
+  updateWhere: vi.fn(),
+}));
+
+vi.mock('@roomote/env', () => ({
+  Env: {
+    RELEASE_VERSION: 'v1.2.3',
+    R_LICENSE_CLOUD_BASE_URL: 'https://cloud.example.com/',
+  },
+}));
+
+vi.mock('@roomote/db/server', () => ({
+  db: {
+    query: { deploymentSettings: { findFirst: mocks.findSettings } },
+    update: vi.fn(() => ({
+      set: mocks.updateSet.mockReturnValue({ where: mocks.updateWhere }),
+    })),
+  },
+  deploymentSettings: { id: 'id', licenseKey: 'licenseKey' },
+  and: mocks.and,
+  eq: vi.fn(),
+  isNull: mocks.isNull,
+  getDeploymentLicenseState: mocks.getDeploymentLicenseState,
+  getInstanceAnalyticsId: mocks.getInstanceAnalyticsId,
+  resolveConfiguredLicenseKey: mocks.resolveConfiguredLicenseKey,
+  resolveLicenseState: mocks.resolveLicenseState,
+}));
+
+import { syncLicenseWithCloud } from '../server/license-cloud';
+
+describe('syncLicenseWithCloud', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.getDeploymentLicenseState.mockResolvedValue({
+      status: 'valid',
+      seatLimit: 25,
+      licenseId: 'lic_123',
+    });
+    mocks.findSettings.mockResolvedValue({ licenseKey: 'RMLK1.payload.sig' });
+    mocks.resolveConfiguredLicenseKey.mockReturnValue('RMLK1.payload.sig');
+    mocks.getInstanceAnalyticsId.mockResolvedValue('deployment-123');
+    mocks.updateWhere.mockResolvedValue(undefined);
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({
+          licenseId: 'lic_123',
+          activationExpiresAt: '2026-08-03T00:00:00.000Z',
+          entitlementsVersion: '2026-08-01',
+          entitlements: { premiumFeature: true, maxProjects: 20 },
+          entitlementsExpiresAt: '2026-08-03T00:00:00.000Z',
+        }),
+      }),
+    );
+  });
+
+  afterEach(() => vi.unstubAllGlobals());
+
+  it('reports a stable deployment observation and caches the returned lease', async () => {
+    await expect(
+      syncLicenseWithCloud({
+        eventId: 'event-123',
+        observedAt: new Date('2026-08-01T12:00:00.000Z'),
+        activeUsers: 17,
+      }),
+    ).resolves.toEqual({ status: 'synced' });
+
+    expect(fetch).toHaveBeenCalledWith(
+      'https://cloud.example.com/api/v1/licenses/report',
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: 'License RMLK1.payload.sig',
+        }),
+      }),
+    );
+    const request = vi.mocked(fetch).mock.calls[0]?.[1];
+    expect(JSON.parse(String(request?.body))).toEqual({
+      contractVersion: 1,
+      deploymentId: 'deployment-123',
+      eventId: 'event-123',
+      observedAt: '2026-08-01T12:00:00.000Z',
+      appVersion: 'v1.2.3',
+      usage: { activeUsers: 17 },
+    });
+    expect(mocks.updateSet).toHaveBeenCalledWith(
+      expect.objectContaining({
+        licenseCloudState: expect.objectContaining({
+          licenseId: 'lic_123',
+          deploymentId: 'deployment-123',
+          entitlements: { premiumFeature: true, maxProjects: 20 },
+        }),
+      }),
+    );
+    expect(mocks.and).toHaveBeenCalledOnce();
+  });
+
+  it('does not issue a lease when Cloud reports another installation', async () => {
+    vi.mocked(fetch).mockResolvedValueOnce({
+      ok: false,
+      status: 409,
+    } as Response);
+
+    await expect(
+      syncLicenseWithCloud({
+        eventId: 'event-123',
+        observedAt: new Date(),
+        activeUsers: 17,
+      }),
+    ).resolves.toEqual({ status: 'license_in_use' });
+    expect(mocks.updateSet).not.toHaveBeenCalled();
+  });
+
+  it('persists an interactive activation key with its lease', async () => {
+    mocks.resolveLicenseState.mockReturnValue({
+      status: 'valid',
+      seatLimit: 25,
+      licenseId: 'lic_123',
+    });
+
+    await expect(
+      syncLicenseWithCloud({
+        eventId: 'event-123',
+        observedAt: new Date(),
+        activeUsers: 17,
+        licenseKey: 'RMLK1.new-payload.sig',
+      }),
+    ).resolves.toEqual({ status: 'synced' });
+
+    expect(mocks.updateSet).toHaveBeenCalledWith(
+      expect.objectContaining({ licenseKey: 'RMLK1.new-payload.sig' }),
+    );
+  });
+
+  it('rejects a successful response with non-scalar entitlements', async () => {
+    vi.mocked(fetch).mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({
+        licenseId: 'lic_123',
+        activationExpiresAt: '2026-08-03T00:00:00.000Z',
+        entitlementsVersion: '2026-08-01',
+        entitlements: { premiumFeature: true, nested: { enabled: true } },
+        entitlementsExpiresAt: '2026-08-03T00:00:00.000Z',
+      }),
+    } as Response);
+
+    await expect(
+      syncLicenseWithCloud({
+        eventId: 'event-123',
+        observedAt: new Date(),
+        activeUsers: 17,
+      }),
+    ).resolves.toEqual({ status: 'rejected' });
+    expect(mocks.updateSet).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/telemetry/src/index.ts b/packages/telemetry/src/index.ts
index 68dd8cd1c..ae82ebd40 100644
--- a/packages/telemetry/src/index.ts
+++ b/packages/telemetry/src/index.ts
@@ -115,3 +115,22 @@ export interface PingVersionCheckResponse {
   latestVersion: string | null;
   checkedAt?: string;
 }
+
+export type LicenseEntitlementValue = string | number | boolean;
+
+export interface LicenseUsageReportRequest {
+  contractVersion: 1;
+  deploymentId: string;
+  eventId: string;
+  observedAt: string;
+  appVersion?: string;
+  usage: { activeUsers: number };
+}
+
+export interface LicenseUsageReportResponse {
+  licenseId: string;
+  activationExpiresAt: string;
+  entitlementsVersion: string;
+  entitlements: Record<string, LicenseEntitlementValue>;
+  entitlementsExpiresAt: string;
+}
diff --git a/packages/telemetry/src/server/index.ts b/packages/telemetry/src/server/index.ts
index 89d8e42e5..f5951a1c4 100644
--- a/packages/telemetry/src/server/index.ts
+++ b/packages/telemetry/src/server/index.ts
@@ -35,6 +35,11 @@ import {
   buildActivationTaskProperties,
 } from '../index';
 
+export {
+  syncLicenseWithCloud,
+  type LicenseCloudSyncResult,
+} from './license-cloud';
+
 const LOG_PREFIX = '[telemetry]';
 const REQUEST_TIMEOUT_MS = 5_000;
 const FLUSH_INTERVAL_MS = 10_000;
@@ -422,8 +427,8 @@ export async function checkLatestVersion(): Promise<PingVersionCheckResponse | n
 }
 
 /**
- * Sends the daily anonymous instance report. Gated by the analytics
- * setting; never throws. Returns whether the report was accepted.
+ * Sends the daily anonymous instance report. Never throws. Returns whether
+ * the report was accepted.
  */
 export async function sendInstanceReport(
   report: Record<string, unknown>,
diff --git a/packages/telemetry/src/server/license-cloud.ts b/packages/telemetry/src/server/license-cloud.ts
new file mode 100644
index 000000000..ec40ad27d
--- /dev/null
+++ b/packages/telemetry/src/server/license-cloud.ts
@@ -0,0 +1,191 @@
+import { Env } from '@roomote/env';
+import {
+  and,
+  db,
+  deploymentSettings,
+  eq,
+  getDeploymentLicenseState,
+  getInstanceAnalyticsId,
+  resolveConfiguredLicenseKey,
+  resolveLicenseState,
+  isNull,
+} from '@roomote/db/server';
+
+import type {
+  LicenseEntitlementValue,
+  LicenseUsageReportRequest,
+  LicenseUsageReportResponse,
+} from '../index';
+
+const REQUEST_TIMEOUT_MS = 5_000;
+const DEFAULT_LICENSE_CLOUD_BASE_URL = 'https://cloud.roomote.dev';
+
+export type LicenseCloudSyncResult =
+  | { status: 'synced' }
+  | { status: 'not_licensed' }
+  | { status: 'license_in_use' }
+  | { status: 'rejected' }
+  | { status: 'failed' };
+
+function getLicenseCloudBaseUrl(): string {
+  return (
+    Env.R_LICENSE_CLOUD_BASE_URL ?? DEFAULT_LICENSE_CLOUD_BASE_URL
+  ).replace(/\/+$/, '');
+}
+
+function isScalarEntitlementValue(
+  value: unknown,
+): value is LicenseEntitlementValue {
+  return (
+    typeof value === 'string' ||
+    typeof value === 'number' ||
+    typeof value === 'boolean'
+  );
+}
+
+function parseResponse(value: unknown): LicenseUsageReportResponse | null {
+  if (value == null || typeof value !== 'object') {
+    return null;
+  }
+
+  const response = value as Record<string, unknown>;
+  if (
+    typeof response.licenseId !== 'string' ||
+    !response.licenseId ||
+    typeof response.activationExpiresAt !== 'string' ||
+    Number.isNaN(new Date(response.activationExpiresAt).getTime()) ||
+    typeof response.entitlementsVersion !== 'string' ||
+    typeof response.entitlementsExpiresAt !== 'string' ||
+    Number.isNaN(new Date(response.entitlementsExpiresAt).getTime()) ||
+    response.entitlements == null ||
+    typeof response.entitlements !== 'object' ||
+    Array.isArray(response.entitlements)
+  ) {
+    return null;
+  }
+
+  const entitlementEntries = Object.entries(response.entitlements);
+  // A partially usable entitlement response is unsafe: it could silently
+  // downgrade a capability while appearing to have renewed successfully.
+  // Cloud must return a complete scalar map or the whole lease is rejected.
+  if (
+    entitlementEntries.some(
+      ([, entitlement]) => !isScalarEntitlementValue(entitlement),
+    )
+  ) {
+    return null;
+  }
+
+  const entitlements = Object.fromEntries(entitlementEntries);
+
+  return {
+    licenseId: response.licenseId,
+    activationExpiresAt: response.activationExpiresAt,
+    entitlementsVersion: response.entitlementsVersion,
+    entitlements,
+    entitlementsExpiresAt: response.entitlementsExpiresAt,
+  };
+}
+
+/**
+ * Activates a valid self-hosted license for this deployment and reports an
+ * immutable user-count observation. Cloud leases paid-seat capacity back to
+ * the deployment, so a copied key cannot activate a second installation.
+ */
+export async function syncLicenseWithCloud(input: {
+  eventId: string;
+  observedAt: Date;
+  activeUsers: number;
+  licenseKey?: string;
+}): Promise<LicenseCloudSyncResult> {
+  const licenseState = input.licenseKey
+    ? resolveLicenseState(input.licenseKey)
+    : await getDeploymentLicenseState();
+  if (licenseState.status !== 'valid') {
+    return { status: 'not_licensed' };
+  }
+
+  const [settings, deploymentId] = await Promise.all([
+    db.query.deploymentSettings.findFirst({
+      where: eq(deploymentSettings.id, 'default'),
+      columns: { licenseKey: true },
+    }),
+    getInstanceAnalyticsId(),
+  ]);
+  const licenseKey =
+    input.licenseKey ?? resolveConfiguredLicenseKey(settings?.licenseKey);
+  if (!licenseKey) {
+    return { status: 'not_licensed' };
+  }
+
+  const request: LicenseUsageReportRequest = {
+    contractVersion: 1,
+    deploymentId,
+    eventId: input.eventId,
+    observedAt: input.observedAt.toISOString(),
+    ...(Env.RELEASE_VERSION?.trim() && {
+      appVersion: Env.RELEASE_VERSION.trim(),
+    }),
+    usage: { activeUsers: input.activeUsers },
+  };
+
+  try {
+    const response = await fetch(
+      `${getLicenseCloudBaseUrl()}/api/v1/licenses/report`,
+      {
+        method: 'POST',
+        headers: {
+          Authorization: `License ${licenseKey}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(request),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+      },
+    );
+
+    if (response.status === 409) {
+      return { status: 'license_in_use' };
+    }
+    if (!response.ok) {
+      return { status: 'rejected' };
+    }
+
+    const payload = parseResponse(await response.json());
+    if (!payload || payload.licenseId !== licenseState.licenseId) {
+      return { status: 'rejected' };
+    }
+
+    const update = db.update(deploymentSettings).set({
+      // An interactive activation must persist its key and lease together.
+      // This prevents an older scheduled sync from replacing the lease after
+      // the key has changed.
+      ...(input.licenseKey != null && { licenseKey }),
+      licenseCloudState: {
+        ...payload,
+        deploymentId,
+        lastSyncedAt: new Date().toISOString(),
+      },
+      updatedAt: new Date(),
+    });
+
+    // Compare with the value read before the Cloud request. This makes both
+    // scheduled reports and interactive activations safe if another admin
+    // changes the configured key while this request is in flight.
+    await update.where(
+      and(
+        eq(deploymentSettings.id, 'default'),
+        settings?.licenseKey == null
+          ? isNull(deploymentSettings.licenseKey)
+          : eq(deploymentSettings.licenseKey, settings.licenseKey),
+      ),
+    );
+
+    return { status: 'synced' };
+  } catch (error) {
+    console.warn(
+      '[license-cloud] report failed:',
+      error instanceof Error ? error.message : error,
+    );
+    return { status: 'failed' };
+  }
+}

From 94914783e22208e8844205c87e4224efd832d8e8 Mon Sep 17 00:00:00 2001
From: "roomote-community[bot]"
 <311835222+roomote-community[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:37:43 -0400
Subject: [PATCH 07/24] [Fix] Discord drops task request when user links
 account (#1022)

Co-authored-by: Matt Rubens <2600+mrubens@users.noreply.github.com>
---
 .../__tests__/channel-auto-start.test.ts      |  11 ++
 .../handlers/discord/__tests__/index.test.ts  | 183 ++++++++++++++++++
 .../pending-account-link-task.test.ts         |  94 +++++++++
 .../handlers/discord/channel-auto-start.ts    |   9 +
 apps/api/src/handlers/discord/index.ts        |  38 ++++
 .../discord/pending-account-link-task.ts      |  69 +++++++
 6 files changed, 404 insertions(+)
 create mode 100644 apps/api/src/handlers/discord/__tests__/pending-account-link-task.test.ts
 create mode 100644 apps/api/src/handlers/discord/pending-account-link-task.ts

diff --git a/apps/api/src/handlers/discord/__tests__/channel-auto-start.test.ts b/apps/api/src/handlers/discord/__tests__/channel-auto-start.test.ts
index 6418f000b..54c57fc0f 100644
--- a/apps/api/src/handlers/discord/__tests__/channel-auto-start.test.ts
+++ b/apps/api/src/handlers/discord/__tests__/channel-auto-start.test.ts
@@ -7,6 +7,7 @@ const mocks = vi.hoisted(() => ({
     scard: vi.fn(),
     ttl: vi.fn(),
     set: vi.fn(),
+    eval: vi.fn(),
     get: vi.fn(),
     del: vi.fn(),
   },
@@ -158,6 +159,7 @@ describe('maybeHandleDiscordChannelAutoStart', () => {
     mocks.redis.scard.mockResolvedValue(1);
     // Routing lock + nudge dedupe acquire successfully.
     mocks.redis.set.mockResolvedValue('OK');
+    mocks.redis.eval.mockResolvedValue(1);
     mocks.redis.get.mockResolvedValue(null);
     mocks.redis.del.mockResolvedValue(1);
     mocks.getBackgroundAgentSettings.mockResolvedValue(
@@ -304,6 +306,15 @@ describe('maybeHandleDiscordChannelAutoStart', () => {
     expect(mocks.postMessage.mock.calls[0]?.[0]?.text).toMatch(
       /\[Settings → Personal → Linked Accounts\]\([^)]+\/settings\/personal\)/,
     );
+    expect(mocks.redis.eval).toHaveBeenCalledWith(
+      expect.stringContaining('current.receivedAt > ARGV[1]'),
+      1,
+      'discord:pending_account_link_task:discord-user-1',
+      '2026-07-17T15:00:00.000Z',
+      'message-1',
+      expect.any(String),
+      String(10 * 60),
+    );
     expect(mocks.startNewTask).not.toHaveBeenCalled();
     expect(mocks.addReaction).not.toHaveBeenCalled();
   });
diff --git a/apps/api/src/handlers/discord/__tests__/index.test.ts b/apps/api/src/handlers/discord/__tests__/index.test.ts
index d6bba85f3..eeda20be2 100644
--- a/apps/api/src/handlers/discord/__tests__/index.test.ts
+++ b/apps/api/src/handlers/discord/__tests__/index.test.ts
@@ -43,7 +43,9 @@ const mocks = vi.hoisted(() => ({
   attachOutOfBand: vi.fn(),
   releaseOutOfBand: vi.fn(),
   redisSet: vi.fn(),
+  redisEval: vi.fn(),
   redisGet: vi.fn(),
+  redisGetdel: vi.fn(),
   redisDel: vi.fn(),
   buildContinuation: vi.fn(),
   releaseContinuation: vi.fn(),
@@ -59,7 +61,9 @@ vi.mock('@roomote/redis', async (importOriginal) => {
     ...actual,
     getRedis: () => ({
       set: mocks.redisSet,
+      eval: mocks.redisEval,
       get: mocks.redisGet,
+      getdel: mocks.redisGetdel,
       del: mocks.redisDel,
     }),
   };
@@ -257,7 +261,9 @@ describe('Discord Gateway event handler', () => {
     mocks.createDirectMessage.mockResolvedValue({ id: 'dm-private-1' });
     mocks.postMessage.mockResolvedValue({ messageId: 'dm-msg-1' });
     mocks.redisSet.mockResolvedValue('OK');
+    mocks.redisEval.mockResolvedValue(1);
     mocks.redisGet.mockResolvedValue(null);
+    mocks.redisGetdel.mockResolvedValue(null);
     mocks.redisDel.mockResolvedValue(1);
     mocks.component.mockResolvedValue('handled');
     mocks.channelAutoStart.mockResolvedValue(false);
@@ -1793,6 +1799,183 @@ describe('Discord Gateway event handler', () => {
     );
   });
 
+  it('continues the most recent task request after linking', async () => {
+    mocks.findMappedUserId.mockResolvedValueOnce(null);
+    mocks.getChannel.mockImplementation(async (channelId: string) =>
+      channelId === 'dm-1'
+        ? { id: 'dm-1', name: 'Direct message', type: 1 }
+        : {
+            id: 'channel-1',
+            guildId: 'guild-1',
+            name: 'general',
+            type: 0,
+          },
+    );
+    const originalEvent = envelope(
+      message({
+        channel_id: 'channel-1',
+        guild_id: 'guild-1',
+        content: '<@bot-1> fix this',
+        mentions: [{ id: 'bot-1', username: 'Roomote', bot: true }],
+      }),
+    );
+
+    const unlinkedResponse = await postEvent(originalEvent);
+
+    expect(unlinkedResponse.status).toBe(200);
+    const pendingTaskCall = mocks.redisEval.mock.calls.find(
+      ([, , key]) => key === 'discord:pending_account_link_task:discord-user-1',
+    );
+    expect(pendingTaskCall?.slice(1, 6)).toEqual([
+      1,
+      'discord:pending_account_link_task:discord-user-1',
+      originalEvent.receivedAt,
+      originalEvent.eventId,
+      expect.any(String),
+    ]);
+    expect(pendingTaskCall?.[6]).toBe(String(10 * 60));
+    expect(JSON.parse(pendingTaskCall?.[5] as string)).toMatchObject(
+      originalEvent,
+    );
+
+    mocks.consumeLinkCode.mockResolvedValue('roomote-user-1');
+    mocks.findMappedUserId.mockResolvedValue('roomote-user-1');
+    mocks.redisGetdel.mockResolvedValue(pendingTaskCall?.[5]);
+    const interaction = {
+      id: 'interaction-link',
+      application_id: 'app-1',
+      type: 2,
+      token: 'interaction-token',
+      channel_id: 'dm-1',
+      user: { id: 'discord-user-1', username: 'matt' },
+      data: {
+        name: 'link',
+        type: 1,
+        options: [{ name: 'code', type: 3, value: 'link-abcdefghijklmnop' }],
+      },
+    };
+
+    const linkedResponse = await postEvent(
+      envelope(interaction, 'INTERACTION_CREATE'),
+    );
+
+    expect(linkedResponse.status).toBe(200);
+    expect(mocks.startNewTask).toHaveBeenCalledWith(
+      expect.objectContaining({
+        requesterDiscordUserId: 'discord-user-1',
+        launchOwnerUserId: 'roomote-user-1',
+        queuedMessage: expect.objectContaining({
+          text: 'fix this',
+          ts: 'message-1',
+          userId: 'roomote-user-1',
+        }),
+        channel: expect.objectContaining({ channelId: 'channel-1' }),
+      }),
+    );
+    expect(mocks.reply).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        text: expect.stringContaining(
+          'I also picked up your most recent task request.',
+        ),
+      }),
+    );
+  });
+
+  it('restores the pending request and link code when continuation fails', async () => {
+    const originalEvent = envelope(message());
+    mocks.consumeLinkCode.mockResolvedValue('roomote-user-1');
+    mocks.findMappedUserId.mockResolvedValue('roomote-user-1');
+    mocks.redisGetdel.mockResolvedValue(JSON.stringify(originalEvent));
+    mocks.startNewTask.mockRejectedValue(new Error('launch failed'));
+    const interaction = {
+      id: 'interaction-link',
+      application_id: 'app-1',
+      type: 2,
+      token: 'interaction-token',
+      channel_id: 'dm-1',
+      user: { id: 'discord-user-1', username: 'matt' },
+      data: {
+        name: 'link',
+        type: 1,
+        options: [{ name: 'code', type: 3, value: 'link-abcdefghijklmnop' }],
+      },
+    };
+
+    const response = await postEvent(
+      envelope(interaction, 'INTERACTION_CREATE'),
+    );
+
+    expect(response.status).toBe(500);
+    expect(mocks.redisEval).toHaveBeenCalledWith(
+      expect.stringContaining('current.receivedAt > ARGV[1]'),
+      1,
+      'discord:pending_account_link_task:discord-user-1',
+      originalEvent.receivedAt,
+      originalEvent.eventId,
+      JSON.stringify(originalEvent),
+      String(10 * 60),
+    );
+    expect(mocks.restoreLinkCode).toHaveBeenCalledWith(
+      'link-abcdefghijklmnop',
+      'roomote-user-1',
+    );
+  });
+
+  it('replays a pending configured-channel request after linking', async () => {
+    const originalEvent = envelope(
+      message({
+        channel_id: 'channel-1',
+        guild_id: 'guild-1',
+        content: 'A new bug report',
+      }),
+    );
+    mocks.consumeLinkCode.mockResolvedValue('roomote-user-1');
+    mocks.redisGetdel.mockResolvedValue(JSON.stringify(originalEvent));
+    mocks.channelAutoStart.mockResolvedValue(true);
+    mocks.getChannel.mockImplementation(async (channelId: string) =>
+      channelId === 'dm-1'
+        ? { id: 'dm-1', name: 'Direct message', type: 1 }
+        : {
+            id: 'channel-1',
+            guildId: 'guild-1',
+            name: 'bugs',
+            type: 0,
+          },
+    );
+    const interaction = {
+      id: 'interaction-link',
+      application_id: 'app-1',
+      type: 2,
+      token: 'interaction-token',
+      channel_id: 'dm-1',
+      user: { id: 'discord-user-1', username: 'matt' },
+      data: {
+        name: 'link',
+        type: 1,
+        options: [{ name: 'code', type: 3, value: 'link-abcdefghijklmnop' }],
+      },
+    };
+
+    const response = await postEvent(
+      envelope(interaction, 'INTERACTION_CREATE'),
+    );
+
+    expect(response.status).toBe(200);
+    expect(mocks.channelAutoStart).toHaveBeenCalledWith(
+      expect.objectContaining({
+        event: expect.objectContaining(originalEvent),
+      }),
+    );
+    expect(mocks.startNewTask).not.toHaveBeenCalled();
+    expect(mocks.reply).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        text: expect.stringContaining(
+          'I also picked up your most recent task request.',
+        ),
+      }),
+    );
+  });
+
   it('requires /link in a DM without consuming the one-shot code', async () => {
     mocks.getChannel.mockResolvedValue({
       id: 'channel-1',
diff --git a/apps/api/src/handlers/discord/__tests__/pending-account-link-task.test.ts b/apps/api/src/handlers/discord/__tests__/pending-account-link-task.test.ts
new file mode 100644
index 000000000..a5bc803a1
--- /dev/null
+++ b/apps/api/src/handlers/discord/__tests__/pending-account-link-task.test.ts
@@ -0,0 +1,94 @@
+import type { DiscordGatewayEvent } from '@roomote/communication/discord-event';
+
+const mocks = vi.hoisted(() => ({
+  eval: vi.fn(),
+  getdel: vi.fn(),
+}));
+
+vi.mock('@roomote/redis', () => ({
+  getRedis: () => mocks,
+}));
+
+import {
+  claimPendingDiscordAccountLinkTask,
+  rememberPendingDiscordAccountLinkTask,
+} from '../pending-account-link-task.js';
+
+function event(id: string, receivedAt: string): DiscordGatewayEvent {
+  return {
+    eventId: id,
+    eventType: 'MESSAGE_CREATE',
+    payload: {
+      id,
+      channel_id: 'dm-1',
+      content: id,
+      author: { id: 'discord-user-1', username: 'matt' },
+      mentions: [],
+      attachments: [],
+    },
+    receivedAt,
+  };
+}
+
+describe('pending Discord account-link tasks', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('uses an atomic timestamp comparison so an older completion cannot replace a newer request', async () => {
+    const stored = new Map<string, DiscordGatewayEvent>();
+    mocks.eval.mockImplementation(
+      async (
+        script: string,
+        keyCount: number,
+        key: string,
+        receivedAt: string,
+        eventId: string,
+        serialized: string,
+        ttl: string,
+      ) => {
+        expect(script).toContain("redis.call('GET', KEYS[1])");
+        expect(script).toContain('current.receivedAt > ARGV[1]');
+        expect(script).toContain('current.eventId >= ARGV[2]');
+        expect(keyCount).toBe(1);
+        expect(ttl).toBe(String(10 * 60));
+
+        const current = stored.get(key);
+        if (
+          current &&
+          (current.receivedAt > receivedAt ||
+            (current.receivedAt === receivedAt &&
+              BigInt(current.eventId) >= BigInt(eventId)))
+        ) {
+          return 0;
+        }
+        stored.set(key, JSON.parse(serialized) as DiscordGatewayEvent);
+        return 1;
+      },
+    );
+    const newer = event('200', '2026-08-03T12:00:01.000Z');
+    const older = event('100', '2026-08-03T12:00:00.000Z');
+
+    await rememberPendingDiscordAccountLinkTask({
+      discordUserId: 'discord-user-1',
+      event: newer,
+    });
+    await rememberPendingDiscordAccountLinkTask({
+      discordUserId: 'discord-user-1',
+      event: older,
+    });
+
+    expect(
+      stored.get('discord:pending_account_link_task:discord-user-1'),
+    ).toEqual(newer);
+  });
+
+  it('claims and parses the stored event', async () => {
+    const pending = event('200', '2026-08-03T12:00:01.000Z');
+    mocks.getdel.mockResolvedValue(JSON.stringify(pending));
+
+    await expect(
+      claimPendingDiscordAccountLinkTask('discord-user-1'),
+    ).resolves.toEqual(pending);
+  });
+});
diff --git a/apps/api/src/handlers/discord/channel-auto-start.ts b/apps/api/src/handlers/discord/channel-auto-start.ts
index c19164b42..2cff01b55 100644
--- a/apps/api/src/handlers/discord/channel-auto-start.ts
+++ b/apps/api/src/handlers/discord/channel-auto-start.ts
@@ -29,6 +29,7 @@ import {
   releaseAccountLinkDmSlot,
 } from './account-link.js';
 import { processDiscordAttachments } from './attachments.js';
+import { rememberPendingDiscordAccountLinkTask } from './pending-account-link-task.js';
 import { startNewDiscordTask } from './task-orchestration.js';
 import {
   discordMetadataForChannel,
@@ -214,6 +215,14 @@ export async function maybeHandleDiscordChannelAutoStart(input: {
     const mappedUserId = await findDiscordMappedUserId(message.author.id);
 
     if (!mappedUserId) {
+      await rememberPendingDiscordAccountLinkTask({
+        discordUserId: message.author.id,
+        event,
+      }).catch((error) => {
+        apiLogger.warn(
+          `[DiscordChannelAutoStart] Failed to remember pending task for unlinked user ${message.author.id}: ${error instanceof Error ? error.message : String(error)}`,
+        );
+      });
       await sendLinkNudgeBestEffort({
         provider,
         discordUserId: message.author.id,
diff --git a/apps/api/src/handlers/discord/index.ts b/apps/api/src/handlers/discord/index.ts
index a01f26cfd..8730ed824 100644
--- a/apps/api/src/handlers/discord/index.ts
+++ b/apps/api/src/handlers/discord/index.ts
@@ -58,6 +58,10 @@ import {
 } from './auth.js';
 import { handleDiscordComponentInteraction } from './callback-actions.js';
 import { maybeHandleDiscordChannelAutoStart } from './channel-auto-start.js';
+import {
+  claimPendingDiscordAccountLinkTask,
+  rememberPendingDiscordAccountLinkTask,
+} from './pending-account-link-task.js';
 import {
   claimDiscordApiEvent,
   completeDiscordApiEvent,
@@ -346,6 +350,28 @@ async function processDiscordGatewayEvent(event: DiscordGatewayEvent) {
       await restoreDiscordLinkCode(command.code!, linkedUserId);
       throw error;
     }
+    const pendingTask = await claimPendingDiscordAccountLinkTask(
+      sender.id,
+    ).catch((error) => {
+      apiLogger.warn(
+        `[discord] Failed to claim pending task after linking user ${sender.id}: ${error instanceof Error ? error.message : String(error)}`,
+      );
+      return null;
+    });
+    if (pendingTask) {
+      try {
+        await processDiscordGatewayEvent(pendingTask);
+      } catch (error) {
+        await Promise.allSettled([
+          rememberPendingDiscordAccountLinkTask({
+            discordUserId: sender.id,
+            event: pendingTask,
+          }),
+          restoreDiscordLinkCode(command.code!, linkedUserId),
+        ]);
+        throw error;
+      }
+    }
     await replyToDiscordEvent({
       provider: resolved.provider,
       applicationId: resolved.applicationId,
@@ -353,6 +379,9 @@ async function processDiscordGatewayEvent(event: DiscordGatewayEvent) {
       interaction: interactionReplyContext(event),
       text: [
         '✅ Linked! This Discord account is now connected to your Roomote account. Tasks you start here are attributed to you.',
+        ...(pendingTask
+          ? ['I also picked up your most recent task request.']
+          : []),
         DISCORD_HELP_MESSAGE,
       ].join('\n\n'),
       ephemeral: true,
@@ -453,6 +482,15 @@ async function processDiscordGatewayEvent(event: DiscordGatewayEvent) {
       };
     }
 
+    await rememberPendingDiscordAccountLinkTask({
+      discordUserId: sender.id,
+      event,
+    }).catch((error) => {
+      apiLogger.warn(
+        `[discord] Failed to remember pending task for unlinked user ${sender.id}: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    });
+
     await promptDiscordAccountLink({
       provider: resolved.provider,
       applicationId: resolved.applicationId,
diff --git a/apps/api/src/handlers/discord/pending-account-link-task.ts b/apps/api/src/handlers/discord/pending-account-link-task.ts
new file mode 100644
index 000000000..ec613d938
--- /dev/null
+++ b/apps/api/src/handlers/discord/pending-account-link-task.ts
@@ -0,0 +1,69 @@
+import {
+  parseDiscordGatewayEvent,
+  type DiscordGatewayEvent,
+} from '@roomote/communication/discord-event';
+import { getRedis } from '@roomote/redis';
+
+const PENDING_ACCOUNT_LINK_TASK_PREFIX = 'discord:pending_account_link_task:';
+const PENDING_ACCOUNT_LINK_TASK_TTL_SECONDS = 10 * 60;
+
+const REMEMBER_PENDING_ACCOUNT_LINK_TASK_SCRIPT = `
+local raw = redis.call('GET', KEYS[1])
+if raw then
+  local ok, current = pcall(cjson.decode, raw)
+  if ok and type(current) == 'table' and type(current.receivedAt) == 'string' and type(current.eventId) == 'string' then
+    local currentIsNewer = current.receivedAt > ARGV[1]
+    if current.receivedAt == ARGV[1] then
+      local currentIdIsNumeric = string.match(current.eventId, '^%d+$') ~= nil
+      local incomingIdIsNumeric = string.match(ARGV[2], '^%d+$') ~= nil
+      if currentIdIsNumeric and incomingIdIsNumeric and string.len(current.eventId) ~= string.len(ARGV[2]) then
+        currentIsNewer = string.len(current.eventId) > string.len(ARGV[2])
+      else
+        currentIsNewer = current.eventId >= ARGV[2]
+      end
+    end
+    if currentIsNewer then
+      return 0
+    end
+  end
+end
+redis.call('SET', KEYS[1], ARGV[3], 'EX', ARGV[4])
+return 1
+`;
+
+function pendingAccountLinkTaskKey(discordUserId: string): string {
+  return `${PENDING_ACCOUNT_LINK_TASK_PREFIX}${discordUserId}`;
+}
+
+function parsePendingAccountLinkTask(value: string | null) {
+  if (!value) return null;
+  try {
+    const parsed = parseDiscordGatewayEvent(JSON.parse(value));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function rememberPendingDiscordAccountLinkTask(input: {
+  discordUserId: string;
+  event: DiscordGatewayEvent;
+}): Promise<void> {
+  await getRedis().eval(
+    REMEMBER_PENDING_ACCOUNT_LINK_TASK_SCRIPT,
+    1,
+    pendingAccountLinkTaskKey(input.discordUserId),
+    input.event.receivedAt,
+    input.event.eventId,
+    JSON.stringify(input.event),
+    PENDING_ACCOUNT_LINK_TASK_TTL_SECONDS.toString(),
+  );
+}
+
+export async function claimPendingDiscordAccountLinkTask(
+  discordUserId: string,
+): Promise<DiscordGatewayEvent | null> {
+  return parsePendingAccountLinkTask(
+    await getRedis().getdel(pendingAccountLinkTaskKey(discordUserId)),
+  );
+}

From 99911dac6a99dd17ffbfb5f9082e6192218fca81 Mon Sep 17 00:00:00 2001
From: "roomote-roomote[bot]"
 <301996811+roomote-roomote[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 13:49:54 +0100
Subject: [PATCH 08/24] fix: focus Discord setup on account linking (#1023)

Co-authored-by: Roomote <roomote@roomote.dev>
---
 .../setup/StepDiscordSetup.client.test.tsx    | 44 ++++++++++++++-----
 .../(onboarding)/setup/StepDiscordSetup.tsx   | 10 +++--
 2 files changed, 41 insertions(+), 13 deletions(-)

diff --git a/apps/web/src/app/(onboarding)/setup/StepDiscordSetup.client.test.tsx b/apps/web/src/app/(onboarding)/setup/StepDiscordSetup.client.test.tsx
index 251f69e0e..d4353fe82 100644
--- a/apps/web/src/app/(onboarding)/setup/StepDiscordSetup.client.test.tsx
+++ b/apps/web/src/app/(onboarding)/setup/StepDiscordSetup.client.test.tsx
@@ -1,11 +1,16 @@
 import { fireEvent, render, screen, waitFor } from '@testing-library/react';
 
-const { invalidateQueriesMock, linkedAccountState, toastWarningMock } =
-  vi.hoisted(() => ({
-    invalidateQueriesMock: vi.fn().mockResolvedValue(undefined),
-    linkedAccountState: { mapping: null as { discordUserId: string } | null },
-    toastWarningMock: vi.fn(),
-  }));
+const {
+  invalidateQueriesMock,
+  linkedAccountState,
+  providerSetupState,
+  toastWarningMock,
+} = vi.hoisted(() => ({
+  invalidateQueriesMock: vi.fn().mockResolvedValue(undefined),
+  linkedAccountState: { mapping: null as { discordUserId: string } | null },
+  providerSetupState: { satisfied: false },
+  toastWarningMock: vi.fn(),
+}));
 
 vi.mock('sonner', () => ({
   toast: { error: vi.fn(), warning: toastWarningMock },
@@ -31,7 +36,7 @@ vi.mock('@tanstack/react-query', () => ({
           ],
           runtimeSatisfied: true,
           savedSatisfied: false,
-          setupSatisfied: false,
+          setupSatisfied: providerSetupState.satisfied,
           discord: {
             installations: [],
           },
@@ -73,8 +78,8 @@ vi.mock('@/hooks/linked-accounts', () => ({
   useDiscordLinkedAccount: () => ({ data: linkedAccountState }),
 }));
 
-vi.mock('@/components/settings/DiscordSetupStatus', () => ({
-  DiscordSetupStatus: () => <div>Connect Discord server</div>,
+vi.mock('@/components/settings/DiscordLinkAccountStep', () => ({
+  DiscordLinkAccountStep: () => <div>Link Discord account step</div>,
 }));
 
 vi.mock('./ProviderSetupExperience', () => ({
@@ -89,6 +94,22 @@ import { StepDiscordSetup } from './StepDiscordSetup';
 describe('StepDiscordSetup', () => {
   beforeEach(() => {
     linkedAccountState.mapping = null;
+    providerSetupState.satisfied = false;
+  });
+
+  it('shows only account linking when Discord is already configured', () => {
+    providerSetupState.satisfied = true;
+
+    render(<StepDiscordSetup onContinue={vi.fn()} onBack={vi.fn()} />);
+
+    expect(
+      screen.getByRole('heading', { name: 'Link Discord Account' }),
+    ).toBeInTheDocument();
+    expect(screen.getByText('Link Discord account step')).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: 'Continue' })).toBeDisabled();
+    expect(
+      screen.queryByRole('button', { name: 'Save and connect Discord' }),
+    ).not.toBeInTheDocument();
   });
 
   it('warns when connection finishing fails and refreshes setup state', async () => {
@@ -109,7 +130,10 @@ describe('StepDiscordSetup', () => {
     expect(invalidateQueriesMock).toHaveBeenCalledWith({
       queryKey: ['linkedAccounts.discord'],
     });
-    expect(screen.getByText('Connect Discord server')).toBeInTheDocument();
+    expect(
+      screen.getByRole('heading', { name: 'Link Discord Account' }),
+    ).toBeInTheDocument();
+    expect(screen.getByText('Link Discord account step')).toBeInTheDocument();
   });
 
   it('continues after account linking without requiring a destination', async () => {
diff --git a/apps/web/src/app/(onboarding)/setup/StepDiscordSetup.tsx b/apps/web/src/app/(onboarding)/setup/StepDiscordSetup.tsx
index e96e98bb6..d778d54e3 100644
--- a/apps/web/src/app/(onboarding)/setup/StepDiscordSetup.tsx
+++ b/apps/web/src/app/(onboarding)/setup/StepDiscordSetup.tsx
@@ -6,7 +6,7 @@ import { toast } from 'sonner';
 
 import { useTRPC } from '@/trpc/client';
 import { ArrowRight, Button, Spinner } from '@/components/system';
-import { DiscordSetupStatus } from '@/components/settings/DiscordSetupStatus';
+import { DiscordLinkAccountStep } from '@/components/settings/DiscordLinkAccountStep';
 import { useDiscordLinkedAccount } from '@/hooks/linked-accounts';
 
 import {
@@ -15,6 +15,7 @@ import {
   getSetupVisibleFields,
   ProviderSetupExperience,
 } from './ProviderSetupExperience';
+import { StepTitle } from './StepTitle';
 import { SetupFooter } from './SetupFooter';
 
 export function StepDiscordSetup({
@@ -113,8 +114,11 @@ export function StepDiscordSetup({
             }))
           }
         />
-      ) : provider?.discord ? (
-        <DiscordSetupStatus status={provider.discord} />
+      ) : provider && isConfigured ? (
+        <div className="space-y-4">
+          <StepTitle text="Link Discord Account" />
+          <DiscordLinkAccountStep />
+        </div>
       ) : status.isError ? (
         <p className="text-sm text-destructive">
           Unable to load Discord setup. Refresh and try again.

From aa69e73235481df8af67b2585e9bf4f665d59d5b Mon Sep 17 00:00:00 2001
From: "roomote-community[bot]"
 <311835222+roomote-community[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 09:21:45 -0400
Subject: [PATCH 09/24] [Chore] Use Sonnet 5 for default code reviews (#1024)

Co-authored-by: Matt Rubens <2600+mrubens@users.noreply.github.com>
---
 .../types/src/model-provider-config.test.ts   | 66 ++++++++++++++++++-
 packages/types/src/model-provider-config.ts   | 60 ++++++++++++-----
 2 files changed, 108 insertions(+), 18 deletions(-)

diff --git a/packages/types/src/model-provider-config.test.ts b/packages/types/src/model-provider-config.test.ts
index c818c125e..4ff668d9c 100644
--- a/packages/types/src/model-provider-config.test.ts
+++ b/packages/types/src/model-provider-config.test.ts
@@ -806,18 +806,77 @@ describe('buildRecommendedDeploymentModelConfig', () => {
       roomoteModel: 'anthropic/claude-sonnet-5',
       roomoteSmallModel: 'anthropic/claude-haiku-4-5',
       roomoteVisionModel: null,
-      roomoteCodeReviewModel: 'anthropic/claude-opus-5',
+      roomoteCodeReviewModel: 'anthropic/claude-sonnet-5',
       roomoteExploreModel: 'anthropic/claude-haiku-4-5',
       roomotePlanningModel: 'anthropic/claude-opus-5',
       roomoteModelReasoningEffort: null,
       roomoteSmallModelReasoningEffort: null,
       roomoteVisionModelReasoningEffort: null,
-      roomoteCodeReviewModelReasoningEffort: null,
+      roomoteCodeReviewModelReasoningEffort: 'medium',
       roomoteExploreModelReasoningEffort: null,
       roomotePlanningModelReasoningEffort: null,
     });
   });
 
+  it.each([
+    [
+      'openrouter',
+      'balanced',
+      'openrouter/anthropic/claude-sonnet-5',
+      'openrouter/anthropic/claude-opus-5',
+    ],
+    [
+      'openrouter',
+      'quick-turnaround',
+      'openrouter/anthropic/claude-sonnet-5',
+      'openrouter/anthropic/claude-opus-5',
+    ],
+    [
+      'vercel',
+      undefined,
+      'vercel/anthropic/claude-sonnet-5',
+      'vercel/anthropic/claude-opus-5',
+    ],
+    [
+      'anthropic',
+      undefined,
+      'anthropic/claude-sonnet-5',
+      'anthropic/claude-opus-5',
+    ],
+    [
+      'opencode',
+      undefined,
+      'opencode/claude-sonnet-5',
+      'opencode/claude-opus-5',
+    ],
+    [
+      'amazon-bedrock',
+      undefined,
+      'bedrock-mantle/anthropic.claude-sonnet-5',
+      'bedrock-mantle/anthropic.claude-opus-5',
+    ],
+    [
+      'github-copilot',
+      undefined,
+      'github-copilot/claude-sonnet-5',
+      'github-copilot/claude-opus-5',
+    ],
+  ] as const)(
+    'recommends Sonnet 5 with medium reasoning for %s code review',
+    (providerId, presetId, codeReviewModel, planningModel) => {
+      expect(
+        buildRecommendedDeploymentModelConfig(
+          getSetupModelProvider(providerId),
+          presetId,
+        ),
+      ).toMatchObject({
+        roomoteCodeReviewModel: codeReviewModel,
+        roomoteCodeReviewModelReasoningEffort: 'medium',
+        roomotePlanningModel: planningModel,
+      });
+    },
+  );
+
   it('recommends only the coding default for providers without a role mapping', () => {
     expect(
       buildRecommendedDeploymentModelConfig(getSetupModelProvider('xai')),
@@ -873,6 +932,7 @@ describe('buildRecommendedDeploymentModelConfig', () => {
     const presets = getRecommendedModelPresets({
       defaultRoomoteModel: 'example/coding',
       recommendedRoleModels: { helper: 'example/helper' },
+      recommendedRoleReasoningEfforts: { helper: 'low' },
     });
 
     expect(presets).toEqual([
@@ -882,7 +942,7 @@ describe('buildRecommendedDeploymentModelConfig', () => {
         default: true,
         roles: {
           coding: { modelId: 'example/coding' },
-          helper: { modelId: 'example/helper' },
+          helper: { modelId: 'example/helper', reasoningEffort: 'low' },
         },
       },
     ]);
diff --git a/packages/types/src/model-provider-config.ts b/packages/types/src/model-provider-config.ts
index 7f4b4182d..61d8126ad 100644
--- a/packages/types/src/model-provider-config.ts
+++ b/packages/types/src/model-provider-config.ts
@@ -96,6 +96,10 @@ export type RecommendedRoleModels = Partial<
   Record<Exclude<TaskModelRole, 'coding'>, string>
 >;
 
+export type RecommendedRoleReasoningEfforts = Partial<
+  Record<Exclude<TaskModelRole, 'coding'>, ReasoningEffort>
+>;
+
 export type RecommendedPresetRole = {
   modelId: string;
   displayName?: string;
@@ -184,6 +188,8 @@ export type SetupModelProviderDescriptor = {
   recommendedPresets?: readonly RecommendedModelPreset[];
   /** Legacy single-mapping shape used to synthesize a default preset. */
   recommendedRoleModels?: RecommendedRoleModels;
+  /** Optional reasoning levels for roles in the legacy single mapping. */
+  recommendedRoleReasoningEfforts?: RecommendedRoleReasoningEfforts;
 };
 
 export const DEFAULT_SETUP_MODEL_PROVIDER_ID: SetupModelProviderId =
@@ -277,8 +283,8 @@ export const SETUP_MODEL_PROVIDER_CATALOG = [
             reasoningEffort: 'low',
           },
           codeReview: {
-            modelId: 'openrouter/anthropic/claude-opus-5',
-            reasoningEffort: 'high',
+            modelId: 'openrouter/anthropic/claude-sonnet-5',
+            reasoningEffort: 'medium',
           },
           explore: {
             modelId: 'openrouter/google/gemini-3.6-flash',
@@ -303,7 +309,7 @@ export const SETUP_MODEL_PROVIDER_CATALOG = [
             reasoningEffort: 'low',
           },
           codeReview: {
-            modelId: 'openrouter/anthropic/claude-opus-5',
+            modelId: 'openrouter/anthropic/claude-sonnet-5',
             reasoningEffort: 'medium',
           },
           explore: {
@@ -349,10 +355,11 @@ export const SETUP_MODEL_PROVIDER_CATALOG = [
     // work follows the coding model ("same as coding").
     recommendedRoleModels: {
       helper: 'vercel/google/gemini-3.6-flash',
-      codeReview: 'vercel/anthropic/claude-opus-5',
+      codeReview: 'vercel/anthropic/claude-sonnet-5',
       explore: 'vercel/google/gemini-3.6-flash',
       planning: 'vercel/anthropic/claude-opus-5',
     },
+    recommendedRoleReasoningEfforts: { codeReview: 'medium' },
   },
   {
     id: 'requesty',
@@ -493,10 +500,11 @@ export const SETUP_MODEL_PROVIDER_CATALOG = [
     }),
     recommendedRoleModels: {
       helper: 'anthropic/claude-haiku-4-5',
-      codeReview: 'anthropic/claude-opus-5',
+      codeReview: 'anthropic/claude-sonnet-5',
       explore: 'anthropic/claude-haiku-4-5',
       planning: 'anthropic/claude-opus-5',
     },
+    recommendedRoleReasoningEfforts: { codeReview: 'medium' },
   },
   {
     id: 'moonshotai',
@@ -585,10 +593,11 @@ export const SETUP_MODEL_PROVIDER_CATALOG = [
     recommendedRoleModels: {
       helper: 'opencode/gemini-3.6-flash',
       vision: 'opencode/claude-sonnet-5',
-      codeReview: 'opencode/claude-opus-5',
+      codeReview: 'opencode/claude-sonnet-5',
       explore: 'opencode/gemini-3.6-flash',
       planning: 'opencode/claude-opus-5',
     },
+    recommendedRoleReasoningEfforts: { codeReview: 'medium' },
   },
   {
     // Bedrock's current console issues API keys for the Mantle endpoint. The
@@ -625,10 +634,11 @@ export const SETUP_MODEL_PROVIDER_CATALOG = [
     }),
     recommendedRoleModels: {
       helper: 'bedrock-mantle/anthropic.claude-haiku-4-5',
-      codeReview: 'bedrock-mantle/anthropic.claude-opus-5',
+      codeReview: 'bedrock-mantle/anthropic.claude-sonnet-5',
       explore: 'bedrock-mantle/anthropic.claude-haiku-4-5',
       planning: 'bedrock-mantle/anthropic.claude-opus-5',
     },
+    recommendedRoleReasoningEfforts: { codeReview: 'medium' },
   },
   {
     // Provider id matches the models.dev/opencode `google` provider (Gemini
@@ -748,10 +758,11 @@ export const SETUP_MODEL_PROVIDER_CATALOG = [
     }),
     recommendedRoleModels: {
       helper: 'github-copilot/claude-haiku-4.5',
-      codeReview: 'github-copilot/claude-opus-5',
+      codeReview: 'github-copilot/claude-sonnet-5',
       explore: 'github-copilot/claude-haiku-4.5',
       planning: 'github-copilot/claude-opus-5',
     },
+    recommendedRoleReasoningEfforts: { codeReview: 'medium' },
   },
   {
     id: OPENAI_COMPATIBLE_PROVIDER_ID,
@@ -1058,7 +1069,10 @@ const DEFAULT_RECOMMENDED_PRESET_ID = 'default';
 export function getRecommendedModelPresets(
   provider: Pick<
     SetupModelProviderDescriptor,
-    'defaultRoomoteModel' | 'recommendedPresets' | 'recommendedRoleModels'
+    | 'defaultRoomoteModel'
+    | 'recommendedPresets'
+    | 'recommendedRoleModels'
+    | 'recommendedRoleReasoningEfforts'
   >,
 ): readonly RecommendedModelPreset[] {
   if (provider.recommendedPresets?.length) {
@@ -1074,10 +1088,20 @@ export function getRecommendedModelPresets(
       roles: {
         coding: { modelId: provider.defaultRoomoteModel },
         ...Object.fromEntries(
-          Object.entries(roleModels).map(([role, modelId]) => [
-            role,
-            { modelId },
-          ]),
+          Object.entries(roleModels).map(([role, modelId]) => {
+            const reasoningEffort =
+              provider.recommendedRoleReasoningEfforts?.[
+                role as keyof RecommendedRoleReasoningEfforts
+              ];
+
+            return [
+              role,
+              {
+                modelId,
+                ...(reasoningEffort ? { reasoningEffort } : {}),
+              },
+            ];
+          }),
         ),
       },
     },
@@ -1087,7 +1111,10 @@ export function getRecommendedModelPresets(
 export function getDefaultRecommendedModelPreset(
   provider: Pick<
     SetupModelProviderDescriptor,
-    'defaultRoomoteModel' | 'recommendedPresets' | 'recommendedRoleModels'
+    | 'defaultRoomoteModel'
+    | 'recommendedPresets'
+    | 'recommendedRoleModels'
+    | 'recommendedRoleReasoningEfforts'
   >,
 ): RecommendedModelPreset {
   const presets = getRecommendedModelPresets(provider);
@@ -1213,7 +1240,10 @@ export function normalizeDeploymentModelConfig(
 export function buildRecommendedDeploymentModelConfig(
   provider: Pick<
     SetupModelProviderDescriptor,
-    'defaultRoomoteModel' | 'recommendedPresets' | 'recommendedRoleModels'
+    | 'defaultRoomoteModel'
+    | 'recommendedPresets'
+    | 'recommendedRoleModels'
+    | 'recommendedRoleReasoningEfforts'
   >,
   presetId?: string,
 ): DeploymentModelConfig {

From 542a6397870ea5010ac85822cd45a260b12355ca Mon Sep 17 00:00:00 2001
From: Daniel <57051444+daniel-lxs@users.noreply.github.com>
Date: Mon, 3 Aug 2026 09:17:38 -0500
Subject: [PATCH 10/24] [Fix] ChatGPT device-code dialog waits forever on codes
 that can never succeed (#1025)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: stop ChatGPT device auth waiting on codes that can never succeed

The device-code endpoint returns an expires_at roughly fifteen minutes
out, but startChatGptDeviceAuth dropped it and the connect dialog had no
expiry timer, so an aged-out code kept polling behind a "Waiting for
authorization" spinner forever. Return the expiry alongside the interval
and stop the loop at the deadline with a restart prompt.

Polling also mapped every 403 and 404 to pending. Only 403 with the
structured code deviceauth_authorization_pending means the user has not
entered the code yet; 404 (deviceauth_not_found) means the issuer no
longer knows the code, and a 403 carrying any other code is a refusal
waiting cannot resolve, most often an org policy blocking the OAuth app.
Classify on error.code rather than the bare status, and give the blocked
and expired cases their own copy. An unrecognized error body still falls
back to pending, now bounded by the expiry deadline.

Rate-limited polls back off instead of failing, and the poll loop gets
the .catch() it was missing so a rejected request surfaces in the dialog
instead of rejecting unobserved.

🤖 Generated with Claude Code

* refactor: extract the deviceauth refusal branch into a pure classifier

The 403/404 handling was four sequential returns whose correctness
depended on the unrecognized-code fallback sitting between the two
specific checks. Move it to `classifyDeviceAuthRefusal`, a pure switch
keyed only on the structured error code, so the mapping reads as a table
and can be tested directly instead of through a fetch mock.

The HTTP status is deliberately absent from the signature: the issuer
reuses 403 for both pending and terminal refusals, so it carries no
information the code does not already give.

🤖 Generated with Claude Code
---
 .../chatgpt-device-auth-terminal-states.md    |  11 ++
 .../settings/ChatGptConnectDialog.test.tsx    | 118 ++++++++++++
 .../settings/ChatGptConnectDialog.tsx         | 148 ++++++++++-----
 .../commands/chatgpt-subscription/index.ts    |  20 ++-
 .../__tests__/chatgpt-subscription.test.ts    | 168 +++++++++++++++++-
 packages/db/src/lib/chatgpt-subscription.ts   | 129 +++++++++++++-
 packages/types/src/chatgpt-subscription.ts    |  24 +++
 7 files changed, 558 insertions(+), 60 deletions(-)
 create mode 100644 .changeset/chatgpt-device-auth-terminal-states.md
 create mode 100644 apps/web/src/components/settings/ChatGptConnectDialog.test.tsx

diff --git a/.changeset/chatgpt-device-auth-terminal-states.md b/.changeset/chatgpt-device-auth-terminal-states.md
new file mode 100644
index 000000000..bef7482fa
--- /dev/null
+++ b/.changeset/chatgpt-device-auth-terminal-states.md
@@ -0,0 +1,11 @@
+---
+'@roomote/types': patch
+'@roomote/db': patch
+'@roomote/web': patch
+---
+
+Fix the ChatGPT subscription connect dialog waiting forever on a device code that can never succeed. The device-code endpoint returns an `expires_at` roughly fifteen minutes out, but Roomote dropped it and the dialog had no expiry timer, so once a code aged out the dialog kept polling a dead code behind a "Waiting for authorization…" spinner with no way to tell that the code was gone. The dialog now stops at the issuer's stated expiry and prompts for a restart.
+
+Polling also treated every HTTP 403 and 404 from the device-token endpoint as "pending". Only 403 with the structured error code `deviceauth_authorization_pending` actually means the user has not entered the code yet: 404 means the issuer no longer recognizes the code, and a 403 carrying any other code is a refusal that waiting cannot resolve, most commonly an organization policy blocking the OAuth app. Polling now classifies on the structured error code and gives each terminal case its own message, so a blocked deployment says the workspace policy blocks the app and to contact an admin instead of rendering the same spinner as a code nobody has typed in yet. An unrecognized error body still falls back to pending, now bounded by the expiry deadline rather than looping indefinitely.
+
+Rate-limited polls back off instead of failing, and a rejected poll request surfaces its error in the dialog rather than stopping the loop while leaving the promise unhandled.
diff --git a/apps/web/src/components/settings/ChatGptConnectDialog.test.tsx b/apps/web/src/components/settings/ChatGptConnectDialog.test.tsx
new file mode 100644
index 000000000..a6d1ec621
--- /dev/null
+++ b/apps/web/src/components/settings/ChatGptConnectDialog.test.tsx
@@ -0,0 +1,118 @@
+import { render, screen, waitFor } from '@testing-library/react';
+
+const { pollMock, startResult } = vi.hoisted(() => ({
+  pollMock: vi.fn(),
+  startResult: {
+    current: {
+      deviceAuthId: 'dev-1',
+      userCode: 'ABCD-EFGHI',
+      verificationUrl: 'https://auth.openai.com/codex/device',
+      intervalMs: 5,
+      expiresInMs: 60_000,
+    },
+  },
+}));
+
+vi.mock('sonner', () => ({ toast: { success: vi.fn(), error: vi.fn() } }));
+
+vi.mock('@/trpc/client', () => {
+  const queryKey = () => ['stub'];
+  return {
+    useTRPC: () => ({
+      chatgptSubscription: {
+        startDeviceAuth: {
+          mutationOptions: (options: Record<string, unknown>) => ({
+            mutationKey: ['start'],
+            ...options,
+          }),
+        },
+        pollDeviceAuth: { mutationOptions: () => ({ mutationKey: ['poll'] }) },
+        status: { queryKey },
+      },
+      taskModels: {
+        providerSetup: { queryKey },
+        get: { queryKey },
+        launchOptions: { queryKey },
+      },
+      subscriptionUsage: { list: { queryKey } },
+    }),
+  };
+});
+
+vi.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    invalidateQueries: vi.fn().mockResolvedValue(undefined),
+  }),
+  useMutation: (options: {
+    mutationKey: string[];
+    onSuccess?: (result: unknown) => void;
+  }) =>
+    options.mutationKey[0] === 'start'
+      ? {
+          mutate: () => options.onSuccess?.(startResult.current),
+          isPending: false,
+          isError: false,
+          reset: vi.fn(),
+        }
+      : { mutateAsync: pollMock },
+}));
+
+import { ChatGptConnectDialog } from './ChatGptConnectDialog';
+
+describe('ChatGptConnectDialog', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    startResult.current = {
+      deviceAuthId: 'dev-1',
+      userCode: 'ABCD-EFGHI',
+      verificationUrl: 'https://auth.openai.com/codex/device',
+      intervalMs: 5,
+      expiresInMs: 60_000,
+    };
+  });
+
+  it('stops polling and prompts a restart once the device code expires', async () => {
+    startResult.current = { ...startResult.current, expiresInMs: 30 };
+    pollMock.mockResolvedValue({ status: 'pending' });
+
+    render(<ChatGptConnectDialog open onOpenChange={vi.fn()} />);
+
+    await screen.findByText(/authorization code expired/i);
+
+    const callsAtExpiry = pollMock.mock.calls.length;
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    expect(pollMock.mock.calls.length).toBe(callsAtExpiry);
+    expect(screen.getByRole('button', { name: 'Restart' })).toBeInTheDocument();
+  });
+
+  it('reports an org policy block instead of waiting forever', async () => {
+    pollMock.mockResolvedValue({
+      status: 'failed',
+      error: 'ChatGPT device authorization was refused (deviceauth_forbidden).',
+      reason: 'blocked',
+    });
+
+    render(<ChatGptConnectDialog open onOpenChange={vi.fn()} />);
+
+    await screen.findByText(/deviceauth_forbidden/);
+    expect(
+      screen.getByText(/workspace policy blocks the Codex app/i),
+    ).toBeInTheDocument();
+    // The dead code is no longer presented as something to type in.
+    expect(
+      screen.queryByText(/Waiting for authorization/i),
+    ).not.toBeInTheDocument();
+    await waitFor(() => expect(pollMock).toHaveBeenCalledTimes(1));
+  });
+
+  it('surfaces a rejected poll instead of leaving the promise unhandled', async () => {
+    pollMock.mockRejectedValue(new Error('network down'));
+
+    render(<ChatGptConnectDialog open onOpenChange={vi.fn()} />);
+
+    await screen.findByText('network down');
+    expect(
+      screen.queryByText(/Waiting for authorization/i),
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/apps/web/src/components/settings/ChatGptConnectDialog.tsx b/apps/web/src/components/settings/ChatGptConnectDialog.tsx
index 9434088f1..f8336b451 100644
--- a/apps/web/src/components/settings/ChatGptConnectDialog.tsx
+++ b/apps/web/src/components/settings/ChatGptConnectDialog.tsx
@@ -24,12 +24,18 @@ type DeviceAuthStartResult = {
   userCode: string;
   verificationUrl: string;
   intervalMs: number;
+  expiresInMs: number;
 };
 
+type DevicePollFailureReason = 'blocked' | 'expired';
+
 type DevicePollResult =
-  | { status: 'pending' }
+  | { status: 'pending'; intervalMs?: number }
   | { status: 'success' }
-  | { status: 'failed'; error: string };
+  | { status: 'failed'; error: string; reason?: DevicePollFailureReason };
+
+const EXPIRED_CODE_ERROR =
+  'ChatGPT authorization code expired. Restart the connection to get a new code.';
 
 type ChatGptConnectDialogProps = {
   open: boolean;
@@ -55,8 +61,20 @@ export function ChatGptConnectDialog({
   );
   const [polling, setPolling] = useState(false);
   const [error, setError] = useState<string | null>(null);
+  const [failureReason, setFailureReason] =
+    useState<DevicePollFailureReason | null>(null);
   const pollingRef = useRef(false);
 
+  function stopPolling(
+    message: string,
+    reason: DevicePollFailureReason | null = null,
+  ) {
+    pollingRef.current = false;
+    setPolling(false);
+    setError(message);
+    setFailureReason(reason);
+  }
+
   const startMutation = useMutation(
     trpc.chatgptSubscription.startDeviceAuth.mutationOptions({
       onSuccess: (result) => {
@@ -73,44 +91,10 @@ export function ChatGptConnectDialog({
     }),
   );
 
+  // Poll results drive the loop below rather than mutation callbacks, so a
+  // single code path owns both stopping the loop and reporting the outcome.
   const pollMutation = useMutation(
-    trpc.chatgptSubscription.pollDeviceAuth.mutationOptions({
-      onSuccess: async (result: DevicePollResult) => {
-        if (result.status === 'success') {
-          toast.success('ChatGPT subscription connected.');
-          await queryClient.invalidateQueries({
-            queryKey: trpc.taskModels.providerSetup.queryKey(),
-          });
-          await queryClient.invalidateQueries({
-            queryKey: trpc.taskModels.get.queryKey(),
-          });
-          await queryClient.invalidateQueries({
-            queryKey: trpc.taskModels.launchOptions.queryKey(),
-          });
-          await queryClient.invalidateQueries({
-            queryKey: trpc.chatgptSubscription.status.queryKey(),
-          });
-          await queryClient.invalidateQueries({
-            queryKey: trpc.subscriptionUsage.list.queryKey(),
-          });
-          await onConnected?.();
-          handleOpenChange(false);
-        } else if (result.status === 'failed') {
-          setError(result.error);
-          pollingRef.current = false;
-          setPolling(false);
-        }
-      },
-      onError: (mutationError) => {
-        setError(
-          mutationError instanceof Error
-            ? mutationError.message
-            : 'ChatGPT authorization polling failed.',
-        );
-        pollingRef.current = false;
-        setPolling(false);
-      },
-    }),
+    trpc.chatgptSubscription.pollDeviceAuth.mutationOptions(),
   );
 
   useEffect(() => {
@@ -119,6 +103,7 @@ export function ChatGptConnectDialog({
       setPolling(false);
       setDeviceAuth(null);
       setError(null);
+      setFailureReason(null);
       return;
     }
 
@@ -145,24 +130,83 @@ export function ChatGptConnectDialog({
     pollingRef.current = true;
     setPolling(true);
 
+    // The issuer stops accepting the code at this deadline; polling past it
+    // only ever yields `deviceauth_not_found`.
+    const expiresAt = Date.now() + deviceAuth.expiresInMs;
+
     const poll = async () => {
-      while (pollingRef.current && deviceAuth) {
-        await pollMutation.mutateAsync({
+      let intervalMs = deviceAuth.intervalMs;
+
+      while (pollingRef.current) {
+        if (Date.now() >= expiresAt) {
+          stopPolling(EXPIRED_CODE_ERROR, 'expired');
+          return;
+        }
+
+        const result: DevicePollResult = await pollMutation.mutateAsync({
           deviceAuthId: deviceAuth.deviceAuthId,
           userCode: deviceAuth.userCode,
         });
 
         if (!pollingRef.current) {
-          break;
+          return;
+        }
+
+        if (result.status === 'success') {
+          pollingRef.current = false;
+          setPolling(false);
+          toast.success('ChatGPT subscription connected.');
+          await Promise.all([
+            queryClient.invalidateQueries({
+              queryKey: trpc.taskModels.providerSetup.queryKey(),
+            }),
+            queryClient.invalidateQueries({
+              queryKey: trpc.taskModels.get.queryKey(),
+            }),
+            queryClient.invalidateQueries({
+              queryKey: trpc.taskModels.launchOptions.queryKey(),
+            }),
+            queryClient.invalidateQueries({
+              queryKey: trpc.chatgptSubscription.status.queryKey(),
+            }),
+            queryClient.invalidateQueries({
+              queryKey: trpc.subscriptionUsage.list.queryKey(),
+            }),
+          ]);
+          await onConnected?.();
+          handleOpenChange(false);
+          return;
+        }
+
+        if (result.status === 'failed') {
+          stopPolling(result.error, result.reason ?? null);
+          return;
+        }
+
+        // A rate-limited poll returns the interval to back off to.
+        if (result.intervalMs) {
+          intervalMs = result.intervalMs;
+        }
+
+        const remainingMs = expiresAt - Date.now();
+        if (remainingMs <= 0) {
+          stopPolling(EXPIRED_CODE_ERROR, 'expired');
+          return;
         }
 
         await new Promise((resolve) =>
-          setTimeout(resolve, deviceAuth.intervalMs),
+          setTimeout(resolve, Math.min(intervalMs, remainingMs)),
         );
       }
     };
 
-    void poll();
+    void poll().catch((pollError: unknown) => {
+      stopPolling(
+        pollError instanceof Error
+          ? pollError.message
+          : 'ChatGPT authorization polling failed.',
+      );
+    });
 
     return () => {
       pollingRef.current = false;
@@ -179,6 +223,7 @@ export function ChatGptConnectDialog({
   function handleRestart() {
     setDeviceAuth(null);
     setError(null);
+    setFailureReason(null);
     // Clear the prior failed mutation state so the start effect can fire
     // again, then kick off a fresh device-code request.
     startMutation.reset();
@@ -208,12 +253,19 @@ export function ChatGptConnectDialog({
           ) : null}
 
           {error ? (
-            <p className="text-sm text-destructive" role="alert">
-              {error}
-            </p>
+            <div className="space-y-2" role="alert">
+              <p className="text-sm text-destructive">{error}</p>
+              {failureReason === 'blocked' ? (
+                <p className="text-sm text-muted-foreground">
+                  This usually means your ChatGPT workspace policy blocks the
+                  Codex app. Ask an admin of that workspace to allow it, then
+                  restart the connection. Waiting will not clear this.
+                </p>
+              ) : null}
+            </div>
           ) : null}
 
-          {deviceAuth ? (
+          {deviceAuth && !error ? (
             <>
               <div className="space-y-2">
                 <p className="text-sm">
diff --git a/apps/web/src/trpc/commands/chatgpt-subscription/index.ts b/apps/web/src/trpc/commands/chatgpt-subscription/index.ts
index 6feb18835..d725a1b4d 100644
--- a/apps/web/src/trpc/commands/chatgpt-subscription/index.ts
+++ b/apps/web/src/trpc/commands/chatgpt-subscription/index.ts
@@ -5,6 +5,7 @@ import {
   pollChatGptDeviceAuth,
   startChatGptDeviceAuth,
   updateChatGptSubscriptionFastMode,
+  type ChatGptDevicePollFailureReason,
   type ChatGptSubscriptionPublicStatus,
 } from '@roomote/db/server';
 
@@ -39,9 +40,13 @@ export async function startChatGptDeviceAuthCommand(
 }
 
 type PollChatGptDeviceAuthResult =
-  | { status: 'pending' }
+  | { status: 'pending'; intervalMs?: number }
   | { status: 'success' }
-  | { status: 'failed'; error: string };
+  | {
+      status: 'failed';
+      error: string;
+      reason?: ChatGptDevicePollFailureReason;
+    };
 
 export async function pollChatGptDeviceAuthCommand(
   auth: UserAuthSuccess,
@@ -58,10 +63,17 @@ export async function pollChatGptDeviceAuthCommand(
   }
 
   if (result.status === 'failed') {
-    return { status: 'failed', error: result.error };
+    return {
+      status: 'failed',
+      error: result.error,
+      ...(result.reason && { reason: result.reason }),
+    };
   }
 
-  return { status: 'pending' };
+  return {
+    status: 'pending',
+    ...(result.intervalMs && { intervalMs: result.intervalMs }),
+  };
 }
 
 export async function disconnectChatGptSubscriptionCommand(
diff --git a/packages/db/src/lib/__tests__/chatgpt-subscription.test.ts b/packages/db/src/lib/__tests__/chatgpt-subscription.test.ts
index ebb4aa8f3..9e08820fa 100644
--- a/packages/db/src/lib/__tests__/chatgpt-subscription.test.ts
+++ b/packages/db/src/lib/__tests__/chatgpt-subscription.test.ts
@@ -347,9 +347,111 @@ describe('getFreshChatGptAccessToken', () => {
   });
 });
 
+describe('startChatGptDeviceAuth', () => {
+  function makeStartFetch(body: Record<string, unknown>) {
+    return vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        device_auth_id: 'dev-1',
+        user_code: 'CODE',
+        interval: '5',
+        ...body,
+      }),
+    });
+  }
+
+  it('derives the poll deadline from the issuer expires_at', async () => {
+    const now = Date.parse('2026-07-31T22:04:00.000Z');
+    const fetchImpl = makeStartFetch({
+      expires_at: '2026-07-31T22:19:00.000Z',
+    });
+    const { startChatGptDeviceAuth } = await import('../chatgpt-subscription');
+
+    const result = await startChatGptDeviceAuth(fetchImpl as never, now);
+
+    expect(result.expiresInMs).toBe(15 * 60 * 1000);
+    expect(result.intervalMs).toBe(5000);
+  });
+
+  it('falls back to the default TTL when expires_at is absent or unparseable', async () => {
+    const now = Date.now();
+    const { startChatGptDeviceAuth } = await import('../chatgpt-subscription');
+
+    const missing = await startChatGptDeviceAuth(
+      makeStartFetch({}) as never,
+      now,
+    );
+    const garbage = await startChatGptDeviceAuth(
+      makeStartFetch({ expires_at: 'not-a-date' }) as never,
+      now,
+    );
+
+    expect(missing.expiresInMs).toBe(900 * 1000);
+    expect(garbage.expiresInMs).toBe(900 * 1000);
+  });
+
+  it('never returns a non-positive window for an already expired code', async () => {
+    const now = Date.parse('2026-07-31T22:30:00.000Z');
+    const fetchImpl = makeStartFetch({
+      expires_at: '2026-07-31T22:19:00.000Z',
+    });
+    const { startChatGptDeviceAuth } = await import('../chatgpt-subscription');
+
+    const result = await startChatGptDeviceAuth(fetchImpl as never, now);
+
+    expect(result.expiresInMs).toBeGreaterThan(0);
+  });
+});
+
+describe('classifyDeviceAuthRefusal', () => {
+  it('maps each structured error code to its poll result', async () => {
+    const { classifyDeviceAuthRefusal } =
+      await import('../chatgpt-subscription');
+
+    expect(
+      classifyDeviceAuthRefusal('deviceauth_authorization_pending'),
+    ).toEqual({ status: 'pending' });
+    expect(classifyDeviceAuthRefusal('deviceauth_not_found')).toMatchObject({
+      status: 'failed',
+      reason: 'expired',
+    });
+    expect(classifyDeviceAuthRefusal('deviceauth_forbidden')).toMatchObject({
+      status: 'failed',
+      reason: 'blocked',
+    });
+    // No usable code: stay pending, bounded by the caller's expiry deadline.
+    expect(classifyDeviceAuthRefusal(undefined)).toEqual({ status: 'pending' });
+  });
+
+  it('names the offending code so a blocked deployment is diagnosable', async () => {
+    const { classifyDeviceAuthRefusal } =
+      await import('../chatgpt-subscription');
+
+    const result = classifyDeviceAuthRefusal('deviceauth_org_policy');
+
+    expect(result).toMatchObject({ status: 'failed', reason: 'blocked' });
+    expect(result.status === 'failed' && result.error).toContain(
+      'deviceauth_org_policy',
+    );
+  });
+});
+
 describe('pollChatGptDeviceAuth', () => {
+  function makeErrorFetch(status: number, code?: string) {
+    return vi.fn().mockResolvedValue({
+      status,
+      json: async () => ({
+        error: {
+          message: 'irrelevant prose',
+          type: 'invalid_request_error',
+          code,
+        },
+      }),
+    });
+  }
+
   it('returns pending while the user has not authorized', async () => {
-    const fetchImpl = vi.fn().mockResolvedValue({ status: 403 });
+    const fetchImpl = makeErrorFetch(403, 'deviceauth_authorization_pending');
     const { pollChatGptDeviceAuth } = await import('../chatgpt-subscription');
 
     const result = await pollChatGptDeviceAuth({
@@ -361,6 +463,70 @@ describe('pollChatGptDeviceAuth', () => {
     expect(result).toEqual({ status: 'pending' });
   });
 
+  it('fails as blocked on a 403 that is not the pending code', async () => {
+    const fetchImpl = makeErrorFetch(403, 'deviceauth_forbidden');
+    const { pollChatGptDeviceAuth } = await import('../chatgpt-subscription');
+
+    const result = await pollChatGptDeviceAuth({
+      deviceAuthId: 'dev-1',
+      userCode: 'CODE',
+      fetchImpl: fetchImpl as never,
+    });
+
+    expect(result.status).toBe('failed');
+    expect(result).toMatchObject({ reason: 'blocked' });
+  });
+
+  it('fails as expired when the issuer no longer knows the code', async () => {
+    const fetchImpl = makeErrorFetch(404, 'deviceauth_not_found');
+    const { pollChatGptDeviceAuth } = await import('../chatgpt-subscription');
+
+    const result = await pollChatGptDeviceAuth({
+      deviceAuthId: 'dev-1',
+      userCode: 'CODE',
+      fetchImpl: fetchImpl as never,
+    });
+
+    expect(result.status).toBe('failed');
+    expect(result).toMatchObject({ reason: 'expired' });
+  });
+
+  it('stays pending when the error body carries no structured code', async () => {
+    const { pollChatGptDeviceAuth } = await import('../chatgpt-subscription');
+
+    const noCode = await pollChatGptDeviceAuth({
+      deviceAuthId: 'dev-1',
+      userCode: 'CODE',
+      fetchImpl: makeErrorFetch(403) as never,
+    });
+    const unparseable = await pollChatGptDeviceAuth({
+      deviceAuthId: 'dev-1',
+      userCode: 'CODE',
+      fetchImpl: vi.fn().mockResolvedValue({
+        status: 403,
+        json: async () => {
+          throw new Error('not json');
+        },
+      }) as never,
+    });
+
+    expect(noCode).toEqual({ status: 'pending' });
+    expect(unparseable).toEqual({ status: 'pending' });
+  });
+
+  it('backs off instead of failing when polling is rate limited', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue({ status: 429 });
+    const { pollChatGptDeviceAuth } = await import('../chatgpt-subscription');
+
+    const result = await pollChatGptDeviceAuth({
+      deviceAuthId: 'dev-1',
+      userCode: 'CODE',
+      fetchImpl: fetchImpl as never,
+    });
+
+    expect(result).toEqual({ status: 'pending', intervalMs: 5000 });
+  });
+
   it('returns success after exchanging the device authorization code', async () => {
     const fetchImpl = vi.fn();
     fetchImpl
diff --git a/packages/db/src/lib/chatgpt-subscription.ts b/packages/db/src/lib/chatgpt-subscription.ts
index e296ee1be..ad8acb493 100644
--- a/packages/db/src/lib/chatgpt-subscription.ts
+++ b/packages/db/src/lib/chatgpt-subscription.ts
@@ -2,6 +2,9 @@ import { sql } from 'drizzle-orm';
 
 import {
   CHATGPT_DEFAULT_ACCESS_TOKEN_TTL_MS,
+  CHATGPT_DEVICE_AUTH_NOT_FOUND_ERROR_CODE,
+  CHATGPT_DEVICE_AUTH_PENDING_ERROR_CODE,
+  CHATGPT_DEVICE_CODE_DEFAULT_TTL_MS,
   CHATGPT_OAUTH_CLIENT_ID,
   CHATGPT_OAUTH_DEVICE_CODE_ENDPOINT,
   CHATGPT_OAUTH_DEVICE_CALLBACK_REDIRECT_URI,
@@ -10,6 +13,7 @@ import {
   CHATGPT_OAUTH_ISSUER,
   CHATGPT_OAUTH_TOKEN_ENDPOINT,
   CHATGPT_OPENCODE_PROVIDER_ID,
+  CHATGPT_POLL_SLOW_DOWN_MS,
   CHATGPT_REFRESH_SAFETY_MARGIN_MS,
 } from '@roomote/types';
 
@@ -88,6 +92,8 @@ interface DeviceUserCodeResponse {
   device_auth_id: string;
   user_code: string;
   interval: string;
+  /** ISO 8601 timestamp after which the user code stops being accepted. */
+  expires_at?: string;
 }
 
 interface DeviceTokenPendingResponse {
@@ -95,6 +101,14 @@ interface DeviceTokenPendingResponse {
   code_verifier: string;
 }
 
+/** Error envelope the deviceauth endpoints return on a non-2xx response. */
+interface DeviceAuthErrorResponse {
+  error?: {
+    code?: string;
+    message?: string;
+  };
+}
+
 function parseJwtClaims(token: string): IdTokenClaims | undefined {
   const parts = token.split('.');
   if (parts.length !== 3) {
@@ -481,15 +495,22 @@ export async function resolveOpenCodeAuthContent(
  * Initiate the OpenAI device-code authorization flow. Returns the user code
  * and verification URL the operator enters in a browser. The caller polls
  * {@link pollChatGptDeviceAuth} with the returned `deviceAuthId` and
- * `userCode` until it resolves to tokens.
+ * `userCode` until it resolves to tokens, and stops once `expiresInMs`
+ * elapses. The issuer stops accepting the code at that point and every later
+ * poll returns `deviceauth_not_found`.
+ *
+ * `expiresInMs` is relative rather than absolute so a clock skew between this
+ * server and the operator's browser cannot expire the code early or late.
  */
 export async function startChatGptDeviceAuth(
   fetchImpl: typeof fetch = fetch,
+  now: number = Date.now(),
 ): Promise<{
   deviceAuthId: string;
   userCode: string;
   verificationUrl: string;
   intervalMs: number;
+  expiresInMs: number;
 }> {
   const response = await fetchImpl(CHATGPT_OAUTH_DEVICE_CODE_ENDPOINT, {
     method: 'POST',
@@ -514,20 +535,110 @@ export async function startChatGptDeviceAuth(
     userCode: data.user_code,
     verificationUrl: CHATGPT_OAUTH_DEVICE_VERIFICATION_URL,
     intervalMs: intervalSeconds * 1000,
+    expiresInMs: resolveDeviceCodeExpiresInMs(data.expires_at, now),
   };
 }
 
+function resolveDeviceCodeExpiresInMs(
+  expiresAt: string | undefined,
+  now: number,
+): number {
+  const parsed = expiresAt ? Date.parse(expiresAt) : Number.NaN;
+
+  if (Number.isNaN(parsed)) {
+    return CHATGPT_DEVICE_CODE_DEFAULT_TTL_MS;
+  }
+
+  // Never hand back a non-positive window; a code that is already expired
+  // should still give the dialog one poll before it reports expiry.
+  return Math.max(parsed - now, 1_000);
+}
+
+/**
+ * Why a poll ended terminally, so the dialog can show guidance the operator
+ * can act on instead of a generic error:
+ * - `blocked`: the issuer refused the app, typically an org policy on the
+ *   ChatGPT workspace. Only an admin of that workspace can clear it.
+ * - `expired`: the code aged out or was already consumed; restart the flow.
+ */
+export type ChatGptDevicePollFailureReason = 'blocked' | 'expired';
+
 export type ChatGptDevicePollResult =
-  | { status: 'pending' }
+  | { status: 'pending'; intervalMs?: number }
   | { status: 'success'; record: ChatGptSubscriptionRecord }
-  | { status: 'failed'; error: string };
+  | {
+      status: 'failed';
+      error: string;
+      reason?: ChatGptDevicePollFailureReason;
+    };
 
 /**
  * Poll the OpenAI device-token endpoint once. Returns `pending` while the
- * operator has not yet completed authorization (HTTP 403/404), `success`
- * with the persisted subscription record once tokens are exchanged, or
- * `failed` on a terminal error.
+ * operator has not yet completed authorization, `success` with the persisted
+ * subscription record once tokens are exchanged, or `failed` on a terminal
+ * error.
+ *
+ * The endpoint signals pending with HTTP 403 and the structured error code
+ * `deviceauth_authorization_pending`, and reuses 403 for refusals that no
+ * amount of waiting resolves (an org policy blocking the OAuth app). Classify
+ * on the structured code rather than the status alone so a blocked deployment
+ * is not rendered as an endless "waiting" spinner. When the body carries no
+ * recognizable code we fall back to `pending`; the caller's expiry deadline
+ * bounds that fallback.
  */
+/**
+ * Read the structured `error.code` from a deviceauth error response, or
+ * `undefined` when the body is absent, unparseable, or carries no code. Only
+ * the code is inspected; the human-readable `message` is not matched on.
+ */
+async function readDeviceAuthErrorCode(
+  response: Response,
+): Promise<string | undefined> {
+  try {
+    const body = (await response.json()) as DeviceAuthErrorResponse;
+    const code = body?.error?.code;
+    return typeof code === 'string' && code.length > 0 ? code : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Map a refused device-token poll to a result, keyed only on the structured
+ * `error.code`. The HTTP status is deliberately not part of the decision: the
+ * issuer reuses 403 for both "not entered yet" and refusals no amount of
+ * waiting resolves, so the status alone cannot tell them apart.
+ *
+ * `undefined` means the body carried no usable code, which stays `pending` to
+ * preserve the behavior that shipped before this was classified at all. The
+ * caller stops at the device code's expiry, so that fallback is bounded.
+ *
+ * Pure, so the branch table is testable without an HTTP mock.
+ */
+export function classifyDeviceAuthRefusal(
+  errorCode: string | undefined,
+): ChatGptDevicePollResult {
+  switch (errorCode) {
+    case CHATGPT_DEVICE_AUTH_PENDING_ERROR_CODE:
+      return { status: 'pending' };
+    case CHATGPT_DEVICE_AUTH_NOT_FOUND_ERROR_CODE:
+      return {
+        status: 'failed',
+        reason: 'expired',
+        error:
+          'ChatGPT authorization code expired. Restart the connection to get a new code.',
+      };
+    case undefined:
+      return { status: 'pending' };
+    default:
+      return {
+        status: 'failed',
+        reason: 'blocked',
+        error: `ChatGPT device authorization was refused (${errorCode}).`,
+      };
+  }
+}
+
 export async function pollChatGptDeviceAuth(input: {
   deviceAuthId: string;
   userCode: string;
@@ -549,8 +660,12 @@ export async function pollChatGptDeviceAuth(input: {
     }),
   });
 
+  if (response.status === 429) {
+    return { status: 'pending', intervalMs: CHATGPT_POLL_SLOW_DOWN_MS };
+  }
+
   if (response.status === 403 || response.status === 404) {
-    return { status: 'pending' };
+    return classifyDeviceAuthRefusal(await readDeviceAuthErrorCode(response));
   }
 
   if (!response.ok) {
diff --git a/packages/types/src/chatgpt-subscription.ts b/packages/types/src/chatgpt-subscription.ts
index 4702f3ce6..521f85259 100644
--- a/packages/types/src/chatgpt-subscription.ts
+++ b/packages/types/src/chatgpt-subscription.ts
@@ -114,3 +114,27 @@ export const CHATGPT_REFRESH_SAFETY_MARGIN_MS = 10 * 60 * 1000;
  * `expires_in`. Matches opencode's fallback.
  */
 export const CHATGPT_DEFAULT_ACCESS_TOKEN_TTL_MS = 3600 * 1000;
+
+/**
+ * Fallback device-code lifetime (15 minutes) when the device-code endpoint
+ * omits `expires_at` or returns an unparseable value. Matches the ~15 minute
+ * window OpenAI currently issues.
+ */
+export const CHATGPT_DEVICE_CODE_DEFAULT_TTL_MS = 900 * 1000;
+
+/** Poll backoff applied when OpenAI rate-limits the device-token endpoint. */
+export const CHATGPT_POLL_SLOW_DOWN_MS = 5_000;
+
+/**
+ * Structured `error.code` the device-token endpoint returns (alongside HTTP
+ * 403) while the operator has not yet entered the code. Any other 403 code is
+ * terminal, most commonly an org policy that blocks the Codex OAuth app.
+ */
+export const CHATGPT_DEVICE_AUTH_PENDING_ERROR_CODE =
+  'deviceauth_authorization_pending';
+
+/**
+ * Structured `error.code` returned (alongside HTTP 404) for a device code the
+ * issuer no longer recognizes, i.e. expired or already consumed.
+ */
+export const CHATGPT_DEVICE_AUTH_NOT_FOUND_ERROR_CODE = 'deviceauth_not_found';

From dc1a0059c3ee25866b1a0caf1482e22e8229ba25 Mon Sep 17 00:00:00 2001
From: Daniel <57051444+daniel-lxs@users.noreply.github.com>
Date: Mon, 3 Aug 2026 09:42:13 -0500
Subject: [PATCH 11/24] refactor: extract shared device-code polling lifecycle
 into useDeviceCodeFlow (#1028)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ChatGPT, xAI, and GitHub Copilot connect dialogs each reimplemented
the same device-code lifecycle (start-once guard, expiry deadline,
slow-down backoff, terminal states, restart) with drift between them.
Move the lifecycle into one hook; the dialogs become presentational
shells supplying provider-specific mutations, query keys, and copy.

The hook takes the strongest behavior from each source. From ChatGPT:
expiry deadline, failure reasons with dedicated copy, rate-limit
backoff, and the poll .catch(). From xAI: generation-counter
cancellation instead of a shared boolean, which closes a race where
cancel + quick reopen could flip the boolean back to true and revive a
stale loop still polling the previous device code. xAI and Copilot gain
the race protection and terminal polish; all three now hide the dead
code input once a terminal error is shown.

The per-provider "authorization code expired" sentence is now one config
value per dialog instead of duplicated literals. Server-side copies stay
as-is and remain produce-only.

🤖 Generated with Claude Code
---
 .changeset/shared-device-code-flow-hook.md    |   7 +
 .../settings/ChatGptConnectDialog.tsx         | 239 +++------------
 .../settings/GitHubCopilotConnectDialog.tsx   | 168 +++--------
 .../components/settings/XaiConnectDialog.tsx  | 196 +++---------
 apps/web/src/hooks/useDeviceCodeFlow.ts       | 282 ++++++++++++++++++
 5 files changed, 404 insertions(+), 488 deletions(-)
 create mode 100644 .changeset/shared-device-code-flow-hook.md
 create mode 100644 apps/web/src/hooks/useDeviceCodeFlow.ts

diff --git a/.changeset/shared-device-code-flow-hook.md b/.changeset/shared-device-code-flow-hook.md
new file mode 100644
index 000000000..965898f14
--- /dev/null
+++ b/.changeset/shared-device-code-flow-hook.md
@@ -0,0 +1,7 @@
+---
+'@roomote/web': patch
+---
+
+Extract the OAuth device-code polling lifecycle shared by the ChatGPT, xAI, and GitHub Copilot connect dialogs into one `useDeviceCodeFlow` hook, leaving each dialog a thin presentational shell that supplies its provider-specific mutations, query invalidations, and copy. The three dialogs had drifted: each reimplemented the start-once guard, expiry deadline, slow-down backoff, and terminal states with small differences.
+
+The hook combines the strongest behavior from each implementation. From the ChatGPT dialog: the client-side expiry deadline, distinct failure reasons driving dedicated copy, rate-limit backoff, and surfacing a rejected poll instead of leaving the promise unhandled. From the xAI dialog: monotonic generation-counter cancellation instead of a shared boolean, closing a race where cancelling and quickly reopening a dialog could revive a stale polling loop still holding the previous device code. The xAI and GitHub Copilot dialogs gain that race protection plus the polished terminal handling, and all three now hide the dead device code once a terminal error is shown instead of leaving it next to the error message.
diff --git a/apps/web/src/components/settings/ChatGptConnectDialog.tsx b/apps/web/src/components/settings/ChatGptConnectDialog.tsx
index f8336b451..6604e72c0 100644
--- a/apps/web/src/components/settings/ChatGptConnectDialog.tsx
+++ b/apps/web/src/components/settings/ChatGptConnectDialog.tsx
@@ -1,11 +1,9 @@
 'use client';
 
-import { useEffect, useRef, useState } from 'react';
-import { useMutation, useQueryClient } from '@tanstack/react-query';
 import { ExternalLink, Loader2 } from 'lucide-react';
-import { toast } from 'sonner';
 
 import { useTRPC } from '@/trpc/client';
+import { useDeviceCodeFlow } from '@/hooks/useDeviceCodeFlow';
 import {
   Badge,
   Button,
@@ -27,16 +25,6 @@ type DeviceAuthStartResult = {
   expiresInMs: number;
 };
 
-type DevicePollFailureReason = 'blocked' | 'expired';
-
-type DevicePollResult =
-  | { status: 'pending'; intervalMs?: number }
-  | { status: 'success' }
-  | { status: 'failed'; error: string; reason?: DevicePollFailureReason };
-
-const EXPIRED_CODE_ERROR =
-  'ChatGPT authorization code expired. Restart the connection to get a new code.';
-
 type ChatGptConnectDialogProps = {
   open: boolean;
   onOpenChange: (open: boolean) => void;
@@ -55,183 +43,48 @@ export function ChatGptConnectDialog({
   onConnected,
 }: ChatGptConnectDialogProps) {
   const trpc = useTRPC();
-  const queryClient = useQueryClient();
-  const [deviceAuth, setDeviceAuth] = useState<DeviceAuthStartResult | null>(
-    null,
-  );
-  const [polling, setPolling] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-  const [failureReason, setFailureReason] =
-    useState<DevicePollFailureReason | null>(null);
-  const pollingRef = useRef(false);
-
-  function stopPolling(
-    message: string,
-    reason: DevicePollFailureReason | null = null,
-  ) {
-    pollingRef.current = false;
-    setPolling(false);
-    setError(message);
-    setFailureReason(reason);
-  }
-
-  const startMutation = useMutation(
-    trpc.chatgptSubscription.startDeviceAuth.mutationOptions({
-      onSuccess: (result) => {
-        setDeviceAuth(result);
-        setError(null);
-      },
-      onError: (mutationError) => {
-        setError(
-          mutationError instanceof Error
-            ? mutationError.message
-            : 'Failed to start ChatGPT authorization.',
-        );
-      },
-    }),
-  );
 
-  // Poll results drive the loop below rather than mutation callbacks, so a
-  // single code path owns both stopping the loop and reporting the outcome.
-  const pollMutation = useMutation(
-    trpc.chatgptSubscription.pollDeviceAuth.mutationOptions(),
-  );
-
-  useEffect(() => {
-    if (!open) {
-      pollingRef.current = false;
-      setPolling(false);
-      setDeviceAuth(null);
-      setError(null);
-      setFailureReason(null);
-      return;
-    }
-
-    // Only auto-start the device-code flow once per open. Guard on
-    // startMutation.isError so a failed start does not re-fire on the next
-    // render (deviceAuth stays null and isPending returns to false, which
-    // would otherwise loop with no backoff). The user clicks Restart to
-    // retry explicitly.
-    if (
-      open &&
-      !deviceAuth &&
-      !startMutation.isPending &&
-      !startMutation.isError
-    ) {
-      startMutation.mutate();
+  const {
+    deviceAuth,
+    error,
+    failureReason,
+    polling,
+    isStartPending,
+    handleOpenChange,
+    restart,
+  } = useDeviceCodeFlow<
+    DeviceAuthStartResult,
+    {
+      deviceAuthId: string;
+      userCode: string;
     }
-  }, [open, deviceAuth, startMutation]);
-
-  useEffect(() => {
-    if (!open || !deviceAuth || pollingRef.current) {
-      return;
-    }
-
-    pollingRef.current = true;
-    setPolling(true);
-
-    // The issuer stops accepting the code at this deadline; polling past it
-    // only ever yields `deviceauth_not_found`.
-    const expiresAt = Date.now() + deviceAuth.expiresInMs;
-
-    const poll = async () => {
-      let intervalMs = deviceAuth.intervalMs;
-
-      while (pollingRef.current) {
-        if (Date.now() >= expiresAt) {
-          stopPolling(EXPIRED_CODE_ERROR, 'expired');
-          return;
-        }
-
-        const result: DevicePollResult = await pollMutation.mutateAsync({
-          deviceAuthId: deviceAuth.deviceAuthId,
-          userCode: deviceAuth.userCode,
-        });
-
-        if (!pollingRef.current) {
-          return;
-        }
-
-        if (result.status === 'success') {
-          pollingRef.current = false;
-          setPolling(false);
-          toast.success('ChatGPT subscription connected.');
-          await Promise.all([
-            queryClient.invalidateQueries({
-              queryKey: trpc.taskModels.providerSetup.queryKey(),
-            }),
-            queryClient.invalidateQueries({
-              queryKey: trpc.taskModels.get.queryKey(),
-            }),
-            queryClient.invalidateQueries({
-              queryKey: trpc.taskModels.launchOptions.queryKey(),
-            }),
-            queryClient.invalidateQueries({
-              queryKey: trpc.chatgptSubscription.status.queryKey(),
-            }),
-            queryClient.invalidateQueries({
-              queryKey: trpc.subscriptionUsage.list.queryKey(),
-            }),
-          ]);
-          await onConnected?.();
-          handleOpenChange(false);
-          return;
-        }
-
-        if (result.status === 'failed') {
-          stopPolling(result.error, result.reason ?? null);
-          return;
-        }
-
-        // A rate-limited poll returns the interval to back off to.
-        if (result.intervalMs) {
-          intervalMs = result.intervalMs;
-        }
-
-        const remainingMs = expiresAt - Date.now();
-        if (remainingMs <= 0) {
-          stopPolling(EXPIRED_CODE_ERROR, 'expired');
-          return;
-        }
-
-        await new Promise((resolve) =>
-          setTimeout(resolve, Math.min(intervalMs, remainingMs)),
-        );
-      }
-    };
-
-    void poll().catch((pollError: unknown) => {
-      stopPolling(
-        pollError instanceof Error
-          ? pollError.message
-          : 'ChatGPT authorization polling failed.',
-      );
-    });
-
-    return () => {
-      pollingRef.current = false;
-    };
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [open, deviceAuth]);
-
-  function handleOpenChange(next: boolean) {
-    pollingRef.current = false;
-    setPolling(false);
-    onOpenChange(next);
-  }
-
-  function handleRestart() {
-    setDeviceAuth(null);
-    setError(null);
-    setFailureReason(null);
-    // Clear the prior failed mutation state so the start effect can fire
-    // again, then kick off a fresh device-code request.
-    startMutation.reset();
-    startMutation.mutate();
-  }
-
-  const userCode = deviceAuth?.userCode;
-  const verificationUrl = deviceAuth?.verificationUrl;
+  >({
+    open,
+    onOpenChange,
+    onConnected,
+    startMutationOptions: (handlers) =>
+      trpc.chatgptSubscription.startDeviceAuth.mutationOptions(handlers),
+    pollMutationOptions: () =>
+      trpc.chatgptSubscription.pollDeviceAuth.mutationOptions(),
+    getPollInput: (auth) => ({
+      deviceAuthId: auth.deviceAuthId,
+      userCode: auth.userCode,
+    }),
+    invalidateQueryKeys: () => [
+      trpc.taskModels.providerSetup.queryKey(),
+      trpc.taskModels.get.queryKey(),
+      trpc.taskModels.launchOptions.queryKey(),
+      trpc.chatgptSubscription.status.queryKey(),
+      trpc.subscriptionUsage.list.queryKey(),
+    ],
+    successToast: 'ChatGPT subscription connected.',
+    copy: {
+      expired:
+        'ChatGPT authorization code expired. Restart the connection to get a new code.',
+      startFailed: 'Failed to start ChatGPT authorization.',
+      pollFailed: 'ChatGPT authorization polling failed.',
+    },
+  });
 
   return (
     <Dialog open={open} onOpenChange={handleOpenChange}>
@@ -245,7 +98,7 @@ export function ChatGptConnectDialog({
         </DialogHeader>
 
         <div className="space-y-4">
-          {startMutation.isPending && !deviceAuth ? (
+          {isStartPending && !deviceAuth ? (
             <div className="flex items-center gap-2 text-sm text-muted-foreground">
               <Spinner />
               Starting authorization…
@@ -273,13 +126,13 @@ export function ChatGptConnectDialog({
                 </p>
                 <Input
                   readOnly
-                  value={userCode ?? ''}
+                  value={deviceAuth.userCode}
                   aria-label="ChatGPT device authorization code"
                   className="font-mono text-lg tracking-wider"
                   onFocus={(event) => event.currentTarget.select()}
                 />
                 <a
-                  href={verificationUrl}
+                  href={deviceAuth.verificationUrl}
                   target="_blank"
                   rel="noreferrer"
                   className="inline-flex items-center gap-1 text-sm underline underline-offset-4"
@@ -306,12 +159,12 @@ export function ChatGptConnectDialog({
           <Button
             variant="ghost"
             onClick={() => handleOpenChange(false)}
-            disabled={startMutation.isPending}
+            disabled={isStartPending}
           >
             Cancel
           </Button>
           {error ? (
-            <Button variant="outline" onClick={handleRestart}>
+            <Button variant="outline" onClick={restart}>
               Restart
             </Button>
           ) : null}
diff --git a/apps/web/src/components/settings/GitHubCopilotConnectDialog.tsx b/apps/web/src/components/settings/GitHubCopilotConnectDialog.tsx
index db0d63c5f..b225e822d 100644
--- a/apps/web/src/components/settings/GitHubCopilotConnectDialog.tsx
+++ b/apps/web/src/components/settings/GitHubCopilotConnectDialog.tsx
@@ -1,10 +1,7 @@
 'use client';
 
-import { useEffect, useRef, useState } from 'react';
-import { useMutation, useQueryClient } from '@tanstack/react-query';
-import { toast } from 'sonner';
-
 import { useTRPC } from '@/trpc/client';
+import { useDeviceCodeFlow } from '@/hooks/useDeviceCodeFlow';
 import {
   Button,
   Dialog,
@@ -36,125 +33,36 @@ export function GitHubCopilotConnectDialog({
   onConnected?: () => void | Promise<void>;
 }) {
   const trpc = useTRPC();
-  const queryClient = useQueryClient();
-  const [deviceAuth, setDeviceAuth] = useState<DeviceAuth | null>(null);
-  const [error, setError] = useState<string | null>(null);
-  const pollingRef = useRef(false);
 
-  const startMutation = useMutation(
-    trpc.githubCopilotSubscription.startDeviceAuth.mutationOptions({
-      onSuccess: (result) => {
-        setDeviceAuth(result);
-        setError(null);
+  const { deviceAuth, error, isStartPending, handleOpenChange, restart } =
+    useDeviceCodeFlow<DeviceAuth, { deviceCode: string }>({
+      open,
+      onOpenChange,
+      onConnected,
+      startMutationOptions: (handlers) =>
+        trpc.githubCopilotSubscription.startDeviceAuth.mutationOptions(
+          handlers,
+        ),
+      pollMutationOptions: () =>
+        trpc.githubCopilotSubscription.pollDeviceAuth.mutationOptions(),
+      getPollInput: (auth) => ({ deviceCode: auth.deviceCode }),
+      invalidateQueryKeys: () => [
+        trpc.taskModels.providerSetup.queryKey(),
+        trpc.taskModels.get.queryKey(),
+        trpc.taskModels.launchOptions.queryKey(),
+        trpc.githubCopilotSubscription.status.queryKey(),
+        trpc.subscriptionUsage.list.queryKey(),
+      ],
+      successToast: 'GitHub Copilot subscription connected.',
+      copy: {
+        expired: 'GitHub authorization code expired. Restart the connection.',
+        startFailed: 'Failed to start GitHub authorization.',
+        pollFailed: 'GitHub authorization polling failed.',
       },
-      onError: (mutationError) => setError(mutationError.message),
-    }),
-  );
-  const pollMutation = useMutation(
-    trpc.githubCopilotSubscription.pollDeviceAuth.mutationOptions(),
-  );
-
-  function close(next: boolean) {
-    if (!next) pollingRef.current = false;
-    onOpenChange(next);
-  }
-
-  useEffect(() => {
-    if (!open) {
-      pollingRef.current = false;
-      setDeviceAuth(null);
-      setError(null);
-      return;
-    }
-    if (!deviceAuth && !startMutation.isPending && !startMutation.isError) {
-      startMutation.mutate();
-    }
-  }, [deviceAuth, open, startMutation]);
-
-  useEffect(() => {
-    if (!open || !deviceAuth || pollingRef.current) return;
-    pollingRef.current = true;
-
-    const expiresAt = Date.now() + deviceAuth.expiresInMs;
-
-    const poll = async () => {
-      let intervalMs = deviceAuth.intervalMs;
-      while (pollingRef.current) {
-        if (Date.now() >= expiresAt) {
-          pollingRef.current = false;
-          setError(
-            'GitHub authorization code expired. Restart the connection.',
-          );
-          return;
-        }
-
-        const result = await pollMutation.mutateAsync({
-          deviceCode: deviceAuth.deviceCode,
-        });
-        if (result.status === 'success') {
-          pollingRef.current = false;
-          toast.success('GitHub Copilot subscription connected.');
-          await Promise.all([
-            queryClient.invalidateQueries({
-              queryKey: trpc.taskModels.providerSetup.queryKey(),
-            }),
-            queryClient.invalidateQueries({
-              queryKey: trpc.taskModels.get.queryKey(),
-            }),
-            queryClient.invalidateQueries({
-              queryKey: trpc.taskModels.launchOptions.queryKey(),
-            }),
-            queryClient.invalidateQueries({
-              queryKey: trpc.githubCopilotSubscription.status.queryKey(),
-            }),
-            queryClient.invalidateQueries({
-              queryKey: trpc.subscriptionUsage.list.queryKey(),
-            }),
-          ]);
-          await onConnected?.();
-          close(false);
-          return;
-        }
-        if (result.status === 'failed') {
-          pollingRef.current = false;
-          setError(result.error);
-          return;
-        }
-        // slow_down returns the new absolute poll interval, not a delta.
-        if (result.intervalMs) intervalMs = result.intervalMs;
-
-        const remainingMs = expiresAt - Date.now();
-        if (remainingMs <= 0) {
-          pollingRef.current = false;
-          setError(
-            'GitHub authorization code expired. Restart the connection.',
-          );
-          return;
-        }
-        await new Promise((resolve) =>
-          setTimeout(resolve, Math.min(intervalMs, remainingMs)),
-        );
-      }
-    };
-
-    void poll().catch((pollError: unknown) => {
-      pollingRef.current = false;
-      setError(
-        pollError instanceof Error
-          ? pollError.message
-          : 'GitHub authorization polling failed.',
-      );
     });
-    return () => {
-      pollingRef.current = false;
-    };
-    // The polling lifecycle is intentionally keyed only to the active device
-    // flow; mutation/query objects are recreated by hooks between renders.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [deviceAuth, open]);
 
   return (
-    <Dialog open={open} onOpenChange={close}>
+    <Dialog open={open} onOpenChange={handleOpenChange}>
       <DialogContent size="md">
         <DialogHeader>
           <DialogTitle>Connect GitHub Copilot</DialogTitle>
@@ -163,7 +71,7 @@ export function GitHubCopilotConnectDialog({
           </DialogDescription>
         </DialogHeader>
 
-        {deviceAuth ? (
+        {deviceAuth && !error ? (
           <div className="space-y-3">
             <p className="text-sm text-muted-foreground">
               Open GitHub, then enter this one-time code:
@@ -188,29 +96,23 @@ export function GitHubCopilotConnectDialog({
               Waiting for authorization…
             </p>
           </div>
-        ) : startMutation.isPending ? (
+        ) : isStartPending ? (
           <div className="flex justify-center py-8">
             <Spinner />
           </div>
         ) : null}
 
-        {error ? <p className="text-sm text-destructive">{error}</p> : null}
+        {error ? (
+          <p className="text-sm text-destructive" role="alert">
+            {error}
+          </p>
+        ) : null}
 
         <DialogFooter>
-          <Button variant="outline" onClick={() => close(false)}>
+          <Button variant="outline" onClick={() => handleOpenChange(false)}>
             Cancel
           </Button>
-          {error ? (
-            <Button
-              onClick={() => {
-                setError(null);
-                setDeviceAuth(null);
-                startMutation.reset();
-              }}
-            >
-              Restart
-            </Button>
-          ) : null}
+          {error ? <Button onClick={restart}>Restart</Button> : null}
         </DialogFooter>
       </DialogContent>
     </Dialog>
diff --git a/apps/web/src/components/settings/XaiConnectDialog.tsx b/apps/web/src/components/settings/XaiConnectDialog.tsx
index 59504620a..fcadf5504 100644
--- a/apps/web/src/components/settings/XaiConnectDialog.tsx
+++ b/apps/web/src/components/settings/XaiConnectDialog.tsx
@@ -1,10 +1,7 @@
 'use client';
 
-import { useEffect, useRef, useState } from 'react';
-import { useMutation, useQueryClient } from '@tanstack/react-query';
-import { toast } from 'sonner';
-
 import { useTRPC } from '@/trpc/client';
+import { useDeviceCodeFlow } from '@/hooks/useDeviceCodeFlow';
 import {
   Button,
   Dialog,
@@ -36,153 +33,35 @@ export function XaiConnectDialog({
   onConnected?: () => void | Promise<void>;
 }) {
   const trpc = useTRPC();
-  const queryClient = useQueryClient();
-  const [deviceAuth, setDeviceAuth] = useState<DeviceAuth | null>(null);
-  const [error, setError] = useState<string | null>(null);
-  /**
-   * Monotonic generation bumped whenever a poll loop must die (close, restart,
-   * unmount). A shared boolean is not enough: cancel + reopen can flip the
-   * flag back to true and revive a stale loop that still holds the previous
-   * device code.
-   */
-  const pollGenerationRef = useRef(0);
 
-  const startMutation = useMutation(
-    trpc.xaiSubscription.startDeviceAuth.mutationOptions({
-      onSuccess: (result) => {
-        setDeviceAuth(result);
-        setError(null);
+  const { deviceAuth, error, isStartPending, handleOpenChange, restart } =
+    useDeviceCodeFlow<DeviceAuth, { deviceCode: string }>({
+      open,
+      onOpenChange,
+      onConnected,
+      startMutationOptions: (handlers) =>
+        trpc.xaiSubscription.startDeviceAuth.mutationOptions(handlers),
+      pollMutationOptions: () =>
+        trpc.xaiSubscription.pollDeviceAuth.mutationOptions(),
+      getPollInput: (auth) => ({ deviceCode: auth.deviceCode }),
+      invalidateQueryKeys: () => [
+        trpc.taskModels.providerSetup.queryKey(),
+        trpc.taskModels.get.queryKey(),
+        trpc.taskModels.launchOptions.queryKey(),
+        trpc.xaiSubscription.status.queryKey(),
+        trpc.subscriptionUsage.list.queryKey(),
+      ],
+      successToast: 'xAI Grok subscription connected.',
+      copy: {
+        expired:
+          'xAI device authorization code expired. Restart the connection.',
+        startFailed: 'Failed to start xAI authorization.',
+        pollFailed: 'xAI authorization polling failed.',
       },
-      onError: (mutationError) => setError(mutationError.message),
-    }),
-  );
-  const pollMutation = useMutation(
-    trpc.xaiSubscription.pollDeviceAuth.mutationOptions(),
-  );
-
-  function invalidatePollLoops() {
-    pollGenerationRef.current += 1;
-  }
-
-  function close(next: boolean) {
-    if (!next) {
-      invalidatePollLoops();
-    }
-    onOpenChange(next);
-  }
-
-  useEffect(() => {
-    if (!open) {
-      invalidatePollLoops();
-      setDeviceAuth(null);
-      setError(null);
-      return;
-    }
-    if (!deviceAuth && !startMutation.isPending && !startMutation.isError) {
-      startMutation.mutate();
-    }
-  }, [deviceAuth, open, startMutation]);
-
-  useEffect(() => {
-    if (!open || !deviceAuth) {
-      return;
-    }
-
-    const generation = ++pollGenerationRef.current;
-    const activeDeviceCode = deviceAuth.deviceCode;
-    const expiresAt = Date.now() + deviceAuth.expiresInMs;
-
-    const poll = async () => {
-      let intervalMs = deviceAuth.intervalMs;
-      while (pollGenerationRef.current === generation) {
-        if (Date.now() >= expiresAt) {
-          setError(
-            'xAI device authorization code expired. Restart the connection.',
-          );
-          return;
-        }
-
-        const result = await pollMutation.mutateAsync({
-          deviceCode: activeDeviceCode,
-        });
-        // Another open/close/restart may have started while we awaited.
-        if (pollGenerationRef.current !== generation) {
-          return;
-        }
-        if (result.status === 'success') {
-          toast.success('xAI Grok subscription connected.');
-          await Promise.all([
-            queryClient.invalidateQueries({
-              queryKey: trpc.taskModels.providerSetup.queryKey(),
-            }),
-            queryClient.invalidateQueries({
-              queryKey: trpc.taskModels.get.queryKey(),
-            }),
-            queryClient.invalidateQueries({
-              queryKey: trpc.taskModels.launchOptions.queryKey(),
-            }),
-            queryClient.invalidateQueries({
-              queryKey: trpc.xaiSubscription.status.queryKey(),
-            }),
-            queryClient.invalidateQueries({
-              queryKey: trpc.subscriptionUsage.list.queryKey(),
-            }),
-          ]);
-          if (pollGenerationRef.current !== generation) {
-            return;
-          }
-          await onConnected?.();
-          if (pollGenerationRef.current !== generation) {
-            return;
-          }
-          close(false);
-          return;
-        }
-        if (result.status === 'failed') {
-          setError(result.error);
-          return;
-        }
-        // slow_down returns the new absolute poll interval, not a delta.
-        if (result.intervalMs) {
-          intervalMs = result.intervalMs;
-        }
-
-        const remainingMs = expiresAt - Date.now();
-        if (remainingMs <= 0) {
-          setError(
-            'xAI device authorization code expired. Restart the connection.',
-          );
-          return;
-        }
-        await new Promise((resolve) =>
-          setTimeout(resolve, Math.min(intervalMs, remainingMs)),
-        );
-      }
-    };
-
-    void poll().catch((pollError: unknown) => {
-      if (pollGenerationRef.current !== generation) {
-        return;
-      }
-      setError(
-        pollError instanceof Error
-          ? pollError.message
-          : 'xAI authorization polling failed.',
-      );
     });
-    return () => {
-      // Invalidate only this effect's generation when deviceAuth/open change.
-      if (pollGenerationRef.current === generation) {
-        pollGenerationRef.current += 1;
-      }
-    };
-    // The polling lifecycle is intentionally keyed only to the active device
-    // flow; mutation/query objects are recreated by hooks between renders.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [deviceAuth, open]);
 
   return (
-    <Dialog open={open} onOpenChange={close}>
+    <Dialog open={open} onOpenChange={handleOpenChange}>
       <DialogContent size="md">
         <DialogHeader>
           <DialogTitle>Connect xAI Grok subscription</DialogTitle>
@@ -192,7 +71,7 @@ export function XaiConnectDialog({
           </DialogDescription>
         </DialogHeader>
 
-        {deviceAuth ? (
+        {deviceAuth && !error ? (
           <div className="space-y-3">
             <p className="text-sm text-muted-foreground">
               Open xAI, then enter this one-time code:
@@ -217,30 +96,23 @@ export function XaiConnectDialog({
               Waiting for authorization…
             </p>
           </div>
-        ) : startMutation.isPending ? (
+        ) : isStartPending ? (
           <div className="flex justify-center py-8">
             <Spinner />
           </div>
         ) : null}
 
-        {error ? <p className="text-sm text-destructive">{error}</p> : null}
+        {error ? (
+          <p className="text-sm text-destructive" role="alert">
+            {error}
+          </p>
+        ) : null}
 
         <DialogFooter>
-          <Button variant="outline" onClick={() => close(false)}>
+          <Button variant="outline" onClick={() => handleOpenChange(false)}>
             Cancel
           </Button>
-          {error ? (
-            <Button
-              onClick={() => {
-                invalidatePollLoops();
-                setError(null);
-                setDeviceAuth(null);
-                startMutation.reset();
-              }}
-            >
-              Restart
-            </Button>
-          ) : null}
+          {error ? <Button onClick={restart}>Restart</Button> : null}
         </DialogFooter>
       </DialogContent>
     </Dialog>
diff --git a/apps/web/src/hooks/useDeviceCodeFlow.ts b/apps/web/src/hooks/useDeviceCodeFlow.ts
new file mode 100644
index 000000000..17074ba33
--- /dev/null
+++ b/apps/web/src/hooks/useDeviceCodeFlow.ts
@@ -0,0 +1,282 @@
+'use client';
+
+import { useEffect, useRef, useState } from 'react';
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import type { QueryKey, UseMutationOptions } from '@tanstack/react-query';
+import { toast } from 'sonner';
+
+/**
+ * Shared lifecycle for OAuth device-code connect dialogs (ChatGPT, xAI,
+ * GitHub Copilot). The dialogs supply provider-specific config (mutations,
+ * query keys, copy) and render the result; this hook owns the polling loop.
+ *
+ * Lifecycle semantics follow the hardened ChatGPT dialog (expiry deadline,
+ * failure reasons, slow-down backoff, rejected-poll surfacing). Cancellation
+ * uses the xAI dialog's monotonic generation counter rather than a shared
+ * boolean: cancel + reopen can flip a boolean back to true and revive a stale
+ * loop that still holds the previous device code, while a retired generation
+ * can never match again.
+ */
+
+/** Minimum shape every provider's start mutation must resolve to. */
+type DeviceCodeStartResult = {
+  userCode: string;
+  verificationUrl: string;
+  intervalMs: number;
+  /**
+   * Relative validity window rather than an absolute timestamp so clock skew
+   * between server and browser cannot expire a code early or late.
+   */
+  expiresInMs: number;
+};
+
+/**
+ * Why a poll ended terminally. `blocked` is a refusal waiting cannot resolve
+ * (e.g. an org policy blocking the OAuth app); `expired` means the code aged
+ * out, whether reported by the issuer or by the client-side deadline.
+ */
+type DeviceCodePollFailureReason = 'blocked' | 'expired';
+
+type DeviceCodePollResult =
+  | { status: 'pending'; intervalMs?: number }
+  | { status: 'success' }
+  | { status: 'failed'; error: string; reason?: DeviceCodePollFailureReason };
+
+type StartMutationHandlers<TAuth> = {
+  onSuccess: (result: TAuth) => void;
+  onError: (error: unknown) => void;
+};
+
+type UseDeviceCodeFlowConfig<
+  TAuth extends DeviceCodeStartResult,
+  TPollInput,
+> = {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  /** Invoked once after a successful connect, after query invalidations. */
+  onConnected?: () => void | Promise<void>;
+  /**
+   * Build the start mutation's options with the hook's handlers attached,
+   * e.g. `(handlers) => trpc.x.startDeviceAuth.mutationOptions(handlers)`.
+   * The handlers must reach the returned options untouched; the hook relies
+   * on them to receive the device auth result.
+   *
+   * Typed as `object` rather than tanstack's `UseMutationOptions` because
+   * tRPC's generated option type carries its own error and context generics
+   * that do not structurally assign to the plain tanstack shape; the runtime
+   * contract is identical and the hook casts at the `useMutation` boundary.
+   */
+  startMutationOptions: (handlers: StartMutationHandlers<TAuth>) => object;
+  /** Build the poll mutation's options, with no handlers attached. */
+  pollMutationOptions: () => object;
+  /** Map the start result to the poll mutation's input payload. */
+  getPollInput: (auth: TAuth) => TPollInput;
+  /** Query keys to invalidate after a successful connect. */
+  invalidateQueryKeys: () => QueryKey[];
+  successToast: string;
+  copy: {
+    /** Shown when the client-side expiry deadline passes. */
+    expired: string;
+    /** Fallback when the start mutation rejects without an Error message. */
+    startFailed: string;
+    /** Fallback when a poll rejects without an Error message. */
+    pollFailed: string;
+  };
+};
+
+export function useDeviceCodeFlow<
+  TAuth extends DeviceCodeStartResult,
+  TPollInput,
+>(config: UseDeviceCodeFlowConfig<TAuth, TPollInput>) {
+  const {
+    open,
+    onOpenChange,
+    onConnected,
+    getPollInput,
+    invalidateQueryKeys,
+    successToast,
+    copy,
+  } = config;
+  const queryClient = useQueryClient();
+  const [deviceAuth, setDeviceAuth] = useState<TAuth | null>(null);
+  const [polling, setPolling] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [failureReason, setFailureReason] =
+    useState<DeviceCodePollFailureReason | null>(null);
+  /**
+   * Monotonic generation bumped whenever every in-flight poll loop must die
+   * (close, restart, terminal outcome, effect cleanup). A loop only acts
+   * while its own generation is still current.
+   */
+  const generationRef = useRef(0);
+
+  const startMutation = useMutation(
+    config.startMutationOptions({
+      onSuccess: (result) => {
+        setDeviceAuth(result);
+        setError(null);
+      },
+      onError: (startError) => {
+        setError(
+          startError instanceof Error ? startError.message : copy.startFailed,
+        );
+      },
+    }) as UseMutationOptions<TAuth, Error, void>,
+  );
+
+  // Poll results drive the loop below rather than mutation callbacks, so a
+  // single code path owns both stopping the loop and reporting the outcome.
+  const pollMutation = useMutation(
+    config.pollMutationOptions() as UseMutationOptions<
+      DeviceCodePollResult,
+      Error,
+      TPollInput
+    >,
+  );
+
+  useEffect(() => {
+    if (!open) {
+      generationRef.current += 1;
+      setPolling(false);
+      setDeviceAuth(null);
+      setError(null);
+      setFailureReason(null);
+      return;
+    }
+
+    // Only auto-start the device-code flow once per open. Guard on
+    // startMutation.isError so a failed start does not re-fire on the next
+    // render (deviceAuth stays null and isPending returns to false, which
+    // would otherwise loop with no backoff). The user clicks Restart to
+    // retry explicitly.
+    if (!deviceAuth && !startMutation.isPending && !startMutation.isError) {
+      startMutation.mutate();
+    }
+  }, [open, deviceAuth, startMutation]);
+
+  useEffect(() => {
+    if (!open || !deviceAuth) {
+      return;
+    }
+
+    const generation = ++generationRef.current;
+    const isCurrent = () => generationRef.current === generation;
+    // The issuer stops accepting the code at this deadline; polling past it
+    // can never succeed.
+    const expiresAt = Date.now() + deviceAuth.expiresInMs;
+    setPolling(true);
+
+    const fail = (
+      message: string,
+      reason: DeviceCodePollFailureReason | null = null,
+    ) => {
+      generationRef.current += 1;
+      setPolling(false);
+      setError(message);
+      setFailureReason(reason);
+    };
+
+    const poll = async () => {
+      let intervalMs = deviceAuth.intervalMs;
+
+      while (isCurrent()) {
+        if (Date.now() >= expiresAt) {
+          fail(copy.expired, 'expired');
+          return;
+        }
+
+        const result = await pollMutation.mutateAsync(getPollInput(deviceAuth));
+
+        // Another open/close/restart may have started while we awaited.
+        if (!isCurrent()) {
+          return;
+        }
+
+        if (result.status === 'success') {
+          // Retire this loop before the awaits below so a slow invalidation
+          // cannot overlap a restarted flow.
+          generationRef.current += 1;
+          setPolling(false);
+          toast.success(successToast);
+          await Promise.all(
+            invalidateQueryKeys().map((queryKey) =>
+              queryClient.invalidateQueries({ queryKey }),
+            ),
+          );
+          await onConnected?.();
+          onOpenChange(false);
+          return;
+        }
+
+        if (result.status === 'failed') {
+          fail(result.error, result.reason ?? null);
+          return;
+        }
+
+        // A slow-down/rate-limited poll returns the new absolute interval to
+        // back off to, not a delta.
+        if (result.intervalMs) {
+          intervalMs = result.intervalMs;
+        }
+
+        const remainingMs = expiresAt - Date.now();
+        if (remainingMs <= 0) {
+          fail(copy.expired, 'expired');
+          return;
+        }
+
+        await new Promise((resolve) =>
+          setTimeout(resolve, Math.min(intervalMs, remainingMs)),
+        );
+      }
+    };
+
+    void poll().catch((pollError: unknown) => {
+      // A stale loop's rejection must not clobber a newer flow's state.
+      if (!isCurrent()) {
+        return;
+      }
+      fail(pollError instanceof Error ? pollError.message : copy.pollFailed);
+    });
+
+    return () => {
+      // Invalidate only this effect's generation when deviceAuth/open change.
+      if (isCurrent()) {
+        generationRef.current += 1;
+      }
+    };
+    // The polling lifecycle is intentionally keyed only to the active device
+    // flow; mutation/query objects are recreated by hooks between renders.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [open, deviceAuth]);
+
+  function handleOpenChange(next: boolean) {
+    if (!next) {
+      generationRef.current += 1;
+      setPolling(false);
+    }
+    onOpenChange(next);
+  }
+
+  function restart() {
+    generationRef.current += 1;
+    setPolling(false);
+    setDeviceAuth(null);
+    setError(null);
+    setFailureReason(null);
+    // Clear the prior failed mutation state so the start effect can fire
+    // again, then kick off a fresh device-code request.
+    startMutation.reset();
+    startMutation.mutate();
+  }
+
+  return {
+    deviceAuth,
+    error,
+    failureReason,
+    polling,
+    isStartPending: startMutation.isPending,
+    handleOpenChange,
+    restart,
+  };
+}

From 36e5569e2fc09a297b84d610c3b13151479a078c Mon Sep 17 00:00:00 2001
From: "roomote-roomote[bot]"
 <301996811+roomote-roomote[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 15:52:35 +0100
Subject: [PATCH 12/24] [Improve] Share product tips while task environments
 start (#1021)

* feat: show product tips during task startup

* fix: show startup tips for tasks without transcripts

* feat: improve product tip rotation

* remove debug content

* feat(web): surface practical Roomote use cases

---------

Co-authored-by: Roomote <roomote@roomote.dev>
Co-authored-by: Bruno Bergher <bruno@roocode.com>
---
 .../task/[taskId]/LiveContent.client.test.tsx |   8 +-
 .../(sandbox)/task/[taskId]/LiveContent.tsx   |  36 ++-
 .../task/[taskId]/TaskInputStack.tsx          |  25 +--
 .../task/[taskId]/page.client.test.tsx        |   3 +
 .../src/app/(sandbox)/task/[taskId]/page.tsx  |  39 ++--
 .../startup/ProductTips.client.test.tsx       |  74 +++++++
 .../task/[taskId]/startup/ProductTips.tsx     | 209 ++++++++++++++++++
 .../startup/StartupMessage.client.test.tsx    |  13 +-
 .../task/[taskId]/startup/StartupMessage.tsx  |  50 ++---
 .../(sandbox)/task/[taskId]/startup/index.ts  |   1 +
 .../src/components/system/primitives/icons.ts |   1 +
 11 files changed, 373 insertions(+), 86 deletions(-)
 create mode 100644 apps/web/src/app/(sandbox)/task/[taskId]/startup/ProductTips.client.test.tsx
 create mode 100644 apps/web/src/app/(sandbox)/task/[taskId]/startup/ProductTips.tsx

diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/LiveContent.client.test.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/LiveContent.client.test.tsx
index 913e28711..5b0505f75 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/LiveContent.client.test.tsx
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/LiveContent.client.test.tsx
@@ -32,10 +32,6 @@ vi.mock('./prompt-input', () => ({
   PromptInput: () => <div data-testid="prompt-input" />,
 }));
 
-vi.mock('./startup', () => ({
-  Startup: () => <div data-testid="startup" />,
-}));
-
 import { TaskInputStack } from './TaskInputStack';
 
 const baseSession: TaskSession = {
@@ -70,7 +66,7 @@ describe('TaskInputStack', () => {
     });
   });
 
-  it('shows the startup surface instead of the prompt input while booting', () => {
+  it('leaves the input area empty while startup renders in the conversation', () => {
     render(
       <TaskInputStack
         session={{
@@ -84,7 +80,6 @@ describe('TaskInputStack', () => {
       />,
     );
 
-    expect(screen.getByTestId('startup')).toBeInTheDocument();
     expect(screen.queryByTestId('prompt-input')).not.toBeInTheDocument();
   });
 
@@ -100,6 +95,5 @@ describe('TaskInputStack', () => {
     );
 
     expect(screen.getByTestId('prompt-input')).toBeInTheDocument();
-    expect(screen.queryByTestId('startup')).not.toBeInTheDocument();
   });
 });
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/LiveContent.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/LiveContent.tsx
index b77e6faae..d8f540960 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/LiveContent.tsx
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/LiveContent.tsx
@@ -32,6 +32,7 @@ import { ConnectionStatusBanner } from './ErrorFallback';
 import { PendingUserInputRequestStateProvider } from './PendingUserInputRequestPanel';
 import { TaskInputStack } from './TaskInputStack';
 import { OnboardingCompletionMessage } from './OnboardingCompletionMessage';
+import { ProductTips, Startup } from './startup';
 
 interface LiveContentProps {
   session: TaskSession;
@@ -89,6 +90,8 @@ function LiveContentInner({
   }, [onTaskPhaseChange, taskPhase]);
 
   const asleep = isTaskRunAsleep(session.taskRun);
+  const bootingTaskRun =
+    session.sessionState === 'booting' ? session.taskRun : null;
 
   const [messagesInitialScrollBehavior, setMessagesInitialScrollBehavior] =
     useState<'smooth' | 'instant'>('smooth');
@@ -251,11 +254,33 @@ function LiveContentInner({
                   scrollRef={messagesRef}
                   initialScrollBehavior={messagesInitialScrollBehavior}
                   footer={
-                    session.onboardingEnvironment ? (
-                      <OnboardingCompletionMessage
-                        environment={session.onboardingEnvironment}
-                      />
-                    ) : undefined
+                    <>
+                      {session.onboardingEnvironment && (
+                        <OnboardingCompletionMessage
+                          environment={session.onboardingEnvironment}
+                        />
+                      )}
+                      {bootingTaskRun && (
+                        <>
+                          <Startup
+                            runId={bootingTaskRun.id}
+                            taskId={session.taskId}
+                            initialTaskRun={bootingTaskRun}
+                            prompt={
+                              session.prompt &&
+                              session.prompt.visibleInTranscript !== false
+                                ? {
+                                    text: session.prompt.text,
+                                    images: session.prompt.images,
+                                  }
+                                : null
+                            }
+                            onStatusChange={onBootStatusChange}
+                          />
+                          <ProductTips />
+                        </>
+                      )}
+                    </>
                   }
                 />
                 <div className="mx-auto w-full overflow-clip rounded-t-md bg-card @[56rem]:rounded-t-lg transition-colors border-2 border-background rounded-b-3xl">
@@ -265,7 +290,6 @@ function LiveContentInner({
                       promptInputRef={promptInputRef}
                       onFileSearchOpen={handleFileSearchOpen}
                       onCommandSearchOpen={handleCommandSearchOpen}
-                      onBootStatusChange={onBootStatusChange}
                       scrollToBottom={scrollToBottom}
                     />
                   </PendingUserInputRequestStateProvider>
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/TaskInputStack.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/TaskInputStack.tsx
index 4de01f857..fb9f1e11a 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/TaskInputStack.tsx
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/TaskInputStack.tsx
@@ -10,7 +10,6 @@ import {
 import { PendingEnvVarRequestPanel } from './PendingEnvVarRequestPanel';
 import { PromptInput, type PromptInputHandle } from './prompt-input';
 import { QueuedMessages } from './QueuedMessages';
-import { Startup } from './startup';
 import { ActiveSubtasksList } from './ActiveSubtasksList';
 import { TodoList } from './TodoList';
 
@@ -19,22 +18,19 @@ export function TaskInputStack({
   promptInputRef,
   onFileSearchOpen,
   onCommandSearchOpen,
-  onBootStatusChange,
   scrollToBottom,
 }: {
   session: TaskSession;
   promptInputRef: { current: PromptInputHandle | null };
   onFileSearchOpen: (insertPosition?: number) => void;
   onCommandSearchOpen: (insertPosition?: number) => void;
-  onBootStatusChange?: () => void;
   scrollToBottom: () => void;
 }) {
   const { shouldHidePromptInput } = usePendingUserInputRequestState();
   const [visibleEnvVarRequestKey, setVisibleEnvVarRequestKey] = useState<
     string | null
   >(null);
-  const bootingTaskRun =
-    session.sessionState === 'booting' ? session.taskRun : null;
+  const isBooting = session.sessionState === 'booting';
 
   useEffect(() => {
     setVisibleEnvVarRequestKey(null);
@@ -53,24 +49,7 @@ export function TaskInputStack({
         onVisibleRequestKeyChange={setVisibleEnvVarRequestKey}
       />
       <QueuedMessages />
-      {bootingTaskRun ? (
-        <div className="mx-auto flex max-h-[50vh] min-h-0 w-full max-w-4xl flex-col">
-          <Startup
-            runId={bootingTaskRun.id}
-            taskId={session.taskId}
-            initialTaskRun={bootingTaskRun}
-            prompt={
-              session.prompt && session.prompt.visibleInTranscript !== false
-                ? {
-                    text: session.prompt.text,
-                    images: session.prompt.images,
-                  }
-                : null
-            }
-            onStatusChange={onBootStatusChange}
-          />
-        </div>
-      ) : (
+      {!isBooting && (
         <div className={shouldHidePromptInput ? 'hidden' : undefined}>
           <PromptInput
             ref={promptInputRef}
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/page.client.test.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/page.client.test.tsx
index afca3a427..b28a93452 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/page.client.test.tsx
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/page.client.test.tsx
@@ -84,6 +84,7 @@ vi.mock('./hooks', () => ({
 
 vi.mock('./startup', () => ({
   Startup: () => <div data-testid="startup" />,
+  ProductTips: () => <div data-testid="product-tips" />,
   SnapshotResumeFailureFooter: () => (
     <div data-testid="snapshot-resume-failure-footer" />
   ),
@@ -208,6 +209,7 @@ describe('SandboxPage', () => {
     renderPage();
 
     expect(screen.getByTestId('startup')).toBeInTheDocument();
+    expect(screen.getByTestId('product-tips')).toBeInTheDocument();
     expect(screen.queryByTestId('sandbox-provider')).not.toBeInTheDocument();
   });
 
@@ -323,6 +325,7 @@ describe('SandboxPage', () => {
     renderPage();
 
     expect(screen.getByTestId('startup')).toBeInTheDocument();
+    expect(screen.queryByTestId('product-tips')).not.toBeInTheDocument();
     expect(screen.queryByTestId('historical-content')).not.toBeInTheDocument();
     expect(
       screen.queryByTestId('snapshot-resume-failure-footer'),
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/page.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/page.tsx
index bc7d33fd7..eec5a064f 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/page.tsx
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/page.tsx
@@ -34,7 +34,7 @@ import {
   useTaskMessageEnvelopes,
 } from './hooks';
 
-import { SnapshotResumeFailureFooter, Startup } from './startup';
+import { ProductTips, SnapshotResumeFailureFooter, Startup } from './startup';
 import { DraftPromptBanner } from './DraftPromptBanner';
 import { Header } from './Header';
 import { HistoricalContent } from './HistoricalContent';
@@ -280,13 +280,17 @@ export default function SandboxPage() {
     return (
       <div className="flex h-full min-h-0 min-w-0 flex-1 flex-col">
         <Header session={session} />
-        <Startup
-          runId={taskRun.id}
-          taskId={taskId}
-          initialTaskRun={taskRun}
-          prompt={startupPrompt}
-          onStatusChange={handleBootStatusChange}
-        />
+        <div className="min-h-0 flex-1 overflow-y-auto p-4">
+          <div className="mx-auto flex w-full max-w-4xl flex-col gap-2">
+            <Startup
+              runId={taskRun.id}
+              taskId={taskId}
+              initialTaskRun={taskRun}
+              prompt={startupPrompt}
+              onStatusChange={handleBootStatusChange}
+            />
+          </div>
+        </div>
         {session.draftPrompt && (
           <DraftPromptBanner draftPrompt={session.draftPrompt} />
         )}
@@ -298,13 +302,18 @@ export default function SandboxPage() {
     return (
       <div className="flex h-full min-h-0 min-w-0 flex-1 flex-col">
         <Header session={session} />
-        <Startup
-          runId={taskRun.id}
-          taskId={taskId}
-          initialTaskRun={taskRun}
-          prompt={startupPrompt}
-          onStatusChange={handleBootStatusChange}
-        />
+        <div className="min-h-0 flex-1 overflow-y-auto p-4">
+          <div className="mx-auto flex w-full max-w-4xl flex-col gap-2">
+            <Startup
+              runId={taskRun.id}
+              taskId={taskId}
+              initialTaskRun={taskRun}
+              prompt={startupPrompt}
+              onStatusChange={handleBootStatusChange}
+            />
+            <ProductTips />
+          </div>
+        </div>
         {session.draftPrompt && (
           <DraftPromptBanner draftPrompt={session.draftPrompt} />
         )}
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/startup/ProductTips.client.test.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/startup/ProductTips.client.test.tsx
new file mode 100644
index 000000000..c27d345bd
--- /dev/null
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/startup/ProductTips.client.test.tsx
@@ -0,0 +1,74 @@
+import type { ReactNode } from 'react';
+import { act, fireEvent, render, screen } from '@testing-library/react';
+
+vi.mock('@/components/ai-elements', () => ({
+  Message: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  MessageContent: ({ children }: { children: ReactNode }) => (
+    <div>{children}</div>
+  ),
+}));
+
+vi.mock('@/components/system', () => ({
+  ArrowRight: () => null,
+  BasicTooltip: ({ children }: { children: ReactNode }) => <>{children}</>,
+  Button: ({
+    children,
+    onClick,
+    ...props
+  }: React.ButtonHTMLAttributes<HTMLButtonElement>) => (
+    <button type="button" onClick={onClick} {...props}>
+      {children}
+    </button>
+  ),
+  Lightbulb: () => null,
+  X: () => null,
+}));
+
+import {
+  getTipDisplayDurationMs,
+  PRODUCT_TIPS,
+  ProductTips,
+} from './ProductTips';
+
+describe('ProductTips', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    vi.spyOn(Math, 'random').mockReturnValue(0.99);
+    window.localStorage.clear();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    vi.useRealTimers();
+  });
+
+  it('cycles through the shuffled tips using reading-time durations', () => {
+    render(<ProductTips />);
+
+    act(() => {});
+    expect(screen.getByText(PRODUCT_TIPS[0].title)).toBeInTheDocument();
+
+    act(() => {
+      vi.advanceTimersByTime(getTipDisplayDurationMs(PRODUCT_TIPS[0]));
+    });
+
+    expect(screen.getByText(PRODUCT_TIPS[1].title)).toBeInTheDocument();
+  });
+
+  it('persists dismissal and stays hidden on later mounts', () => {
+    const { unmount } = render(<ProductTips />);
+
+    act(() => {});
+    fireEvent.click(screen.getByRole('button', { name: 'Hide product tips' }));
+
+    expect(screen.queryByText(PRODUCT_TIPS[0].title)).not.toBeInTheDocument();
+
+    unmount();
+    render(<ProductTips />);
+    act(() => {});
+
+    expect(
+      screen.queryByRole('button', { name: 'Hide product tips' }),
+    ).toBeNull();
+  });
+});
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/startup/ProductTips.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/startup/ProductTips.tsx
new file mode 100644
index 000000000..514307c33
--- /dev/null
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/startup/ProductTips.tsx
@@ -0,0 +1,209 @@
+'use client';
+
+import { useEffect, useRef, useState } from 'react';
+
+import {
+  ArrowRight,
+  BasicTooltip,
+  Button,
+  Lightbulb,
+  X,
+} from '@/components/system';
+import { Message, MessageContent } from '@/components/ai-elements';
+
+const PRODUCT_TIPS_DISMISSED_STORAGE_KEY = 'roomote:product-tips-dismissed:v1';
+
+const MIN_TIP_DURATION_MS = 8_000;
+const MAX_TIP_DURATION_MS = 15_000;
+const READING_CHARS_PER_SECOND = 10;
+
+export const PRODUCT_TIPS = [
+  {
+    title: 'Debug production backward',
+    description:
+      'Ask Roomote to inspect a Sentry issue, deployment logs, or Grafana alert, trace it into the codebase, and prepare the smallest verified fix.',
+  },
+  {
+    title: 'Turn failed CI into a fix',
+    description:
+      'CI Failure Triage can detect a persistent failure on the default branch, reproduce it in the configured environment, and open a fix PR.',
+  },
+  {
+    title: 'Investigate surprising metrics',
+    description:
+      'Connect PostHog and ask why a metric moved. Roomote can inspect events, experiments, and feature flags, then trace likely causes into the code.',
+  },
+  {
+    title: 'Debug with real database state',
+    description:
+      'Use read-only Supabase or Neon access to investigate data-dependent bugs, compare the live schema with application assumptions, and plan a safe fix.',
+  },
+  {
+    title: 'Build directly from the spec',
+    description:
+      'Point Roomote at a Notion spec or Linear issue and ask it to trace affected code, identify missing decisions, implement the change, and link the PR back.',
+  },
+  {
+    title: 'Turn support into engineering work',
+    description:
+      'Auto-respond in a support or bug channel so new reports become repository-grounded investigations—even when nobody explicitly mentions Roomote.',
+  },
+  {
+    title: 'Triage issues as they arrive',
+    description:
+      'Roomote can investigate each newly opened issue and post a concrete implementation plan with the relevant code paths before anyone picks it up.',
+  },
+  {
+    title: 'Keep old PRs mergeable',
+    description:
+      'Label selected pull requests for automatic conflict resolution. Roomote periodically rebases the work, resolves safe conflicts, and updates the branch.',
+  },
+  {
+    title: 'Audit what just shipped',
+    description:
+      'Run security and code-quality auditors over recently merged PRs to surface high-confidence risks and maintainability problems as follow-up work.',
+  },
+  {
+    title: 'Schedule repository-aware work',
+    description:
+      'Create recurring tasks such as release-readiness checks, dependency audits, or weekly product reports that can inspect your code and connected tools.',
+  },
+] as const;
+
+type ProductTip = (typeof PRODUCT_TIPS)[number];
+
+export function getTipDisplayDurationMs(tip: ProductTip): number {
+  const readingTime =
+    Math.ceil(
+      `${tip.title} ${tip.description}`.length / READING_CHARS_PER_SECOND,
+    ) * 1_000;
+
+  return Math.min(
+    MAX_TIP_DURATION_MS,
+    Math.max(MIN_TIP_DURATION_MS, readingTime),
+  );
+}
+
+function shuffleTips(): ProductTip[] {
+  const tips = [...PRODUCT_TIPS];
+
+  for (let index = tips.length - 1; index > 0; index -= 1) {
+    const swapIndex = Math.floor(Math.random() * (index + 1));
+    [tips[index], tips[swapIndex]] = [tips[swapIndex]!, tips[index]!];
+  }
+
+  return tips;
+}
+
+export function ProductTips() {
+  const initialized = useRef(false);
+  const [tips, setTips] = useState<ProductTip[]>([]);
+  const [tipIndex, setTipIndex] = useState(0);
+
+  useEffect(() => {
+    if (initialized.current) {
+      return;
+    }
+
+    initialized.current = true;
+
+    if (
+      window.localStorage.getItem(PRODUCT_TIPS_DISMISSED_STORAGE_KEY) === '1'
+    ) {
+      return;
+    }
+
+    setTips(shuffleTips());
+  }, []);
+
+  useEffect(() => {
+    const tip = tips[tipIndex];
+
+    if (!tip || tips.length < 2) {
+      return;
+    }
+
+    const durationMs = getTipDisplayDurationMs(tip);
+
+    const timer = window.setTimeout(() => {
+      setTipIndex((currentIndex) => (currentIndex + 1) % tips.length);
+    }, durationMs);
+
+    return () => {
+      window.clearTimeout(timer);
+    };
+  }, [tipIndex, tips]);
+
+  const tip = tips[tipIndex];
+
+  if (!tip) {
+    return null;
+  }
+
+  const dismiss = () => {
+    window.localStorage.setItem(PRODUCT_TIPS_DISMISSED_STORAGE_KEY, '1');
+    setTips([]);
+  };
+
+  const showNextTip = () => {
+    setTipIndex((currentIndex) => (currentIndex + 1) % tips.length);
+  };
+
+  const durationMs = getTipDisplayDurationMs(tip);
+  const totalSeconds = Math.ceil(durationMs / 1_000);
+
+  return (
+    <Message from="assistant">
+      <MessageContent>
+        <div className="relative flex gap-3 rounded-xl bg-card p-6 pr-10 text-sm mt-8">
+          <Lightbulb className="mt-0.5 size-6 shrink-0 text-muted-foreground enter-up" />
+          <div
+            key={tip.title}
+            className="min-w-0 animate-in fade-in duration-1000 space-y-1"
+          >
+            <div className="font-semibold">{tip.title}</div>
+            <div className="text-muted-foreground max-w-xl">
+              {tip.description}
+            </div>
+            <Button
+              type="button"
+              variant="default"
+              size="xs"
+              className="relative mt-3 overflow-hidden"
+              onClick={showNextTip}
+            >
+              <span
+                aria-hidden="true"
+                className="pointer-events-none absolute inset-y-0 left-0 bg-card/35"
+                style={{
+                  animation: `product-tip-progress ${totalSeconds}s linear forwards`,
+                }}
+              />
+              <span className="relative z-10 flex gap-1 items-center">
+                Next tip <ArrowRight />
+              </span>
+            </Button>
+          </div>
+          <BasicTooltip content="Stop showing these">
+            <Button
+              type="button"
+              variant="ghost"
+              size="icon"
+              className="absolute right-1 top-1"
+              aria-label="Hide product tips"
+              onClick={dismiss}
+            >
+              <X />
+            </Button>
+          </BasicTooltip>
+        </div>
+        <style>{`
+          @keyframes product-tip-progress {
+            from { width: 0%; }
+            to { width: 100%; }
+          }
+        `}</style>
+      </MessageContent>
+    </Message>
+  );
+}
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/startup/StartupMessage.client.test.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/startup/StartupMessage.client.test.tsx
index a693ec65d..8b930e954 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/startup/StartupMessage.client.test.tsx
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/startup/StartupMessage.client.test.tsx
@@ -47,6 +47,7 @@ vi.mock('@/components/system', () => ({
   ThumbsDown: () => null,
   SquareDashedMousePointer: () => null,
   MessageSquareIcon: () => null,
+  MessageSquareWarning: () => null,
   RotateCcw: () => null,
 }));
 
@@ -182,7 +183,7 @@ describe('StartupSequence', () => {
     ).toHaveAttribute('href', 'https://example.com/shot.png');
   });
 
-  it('uses a flex-bounded scroll container when startup content exceeds the available height', () => {
+  it('renders startup content inline without its own scroll surface', () => {
     const { container } = render(
       <StartupSequence
         steps={[
@@ -197,14 +198,8 @@ describe('StartupSequence', () => {
     );
 
     const outerContainer = container.firstChild as HTMLElement | null;
-    const innerContent = outerContainer?.firstChild as HTMLElement | null;
 
-    expect(outerContainer).toHaveClass(
-      'flex-1',
-      'min-h-0',
-      'overflow-y-auto',
-      'p-4',
-    );
-    expect(innerContent).toHaveClass('mx-auto', 'w-full', 'max-w-4xl', 'px-2');
+    expect(outerContainer).toHaveClass('flex', 'flex-col', 'gap-2');
+    expect(outerContainer).not.toHaveClass('overflow-y-auto', 'p-4');
   });
 });
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/startup/StartupMessage.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/startup/StartupMessage.tsx
index ac130aa64..1797ba054 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/startup/StartupMessage.tsx
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/startup/StartupMessage.tsx
@@ -22,7 +22,7 @@ import { getTaskRunErrorDisplayMessage } from '@/lib/task-run-errors';
 import { Message, MessageContent, Shimmer } from '@/components/ai-elements';
 
 import { SandboxLogsTerminal } from '@/components/sandbox';
-import { MessageSquareWarning, RotateCcw } from 'lucide-react';
+import { MessageSquareWarning, RotateCcw } from '@/components/system';
 
 export interface StartupStep {
   status: RunStatus;
@@ -324,32 +324,30 @@ export const StartupSequence = ({
       : -1;
 
   return (
-    <div className="flex-1 min-h-0 overflow-y-auto p-4">
-      <div className="mx-auto flex min-h-full w-full max-w-4xl flex-col gap-2 px-2">
-        {steps.map((step, index) => (
-          <div key={`${step.status}-${index}`}>
-            <StartupMessage
-              step={step}
-              isActive={index === steps.length - 1 && !step.completed}
+    <div className="flex flex-col gap-2">
+      {steps.map((step, index) => (
+        <div key={`${step.status}-${index}`}>
+          <StartupMessage
+            step={step}
+            isActive={index === steps.length - 1 && !step.completed}
+          />
+          {index === logInsertIndex && (
+            <SandboxLogsTerminal
+              logs={logs || []}
+              isConnected={logsConnected}
+              error={logsError}
+              className="max-w-2xl py-1 pl-6"
             />
-            {index === logInsertIndex && (
-              <SandboxLogsTerminal
-                logs={logs || []}
-                isConnected={logsConnected}
-                error={logsError}
-                className="max-w-2xl pl-6 py-1"
-              />
-            )}
-          </div>
-        ))}
-        <StartupFailureMessage
-          status={status}
-          error={error}
-          errorCode={errorCode}
-          prompt={prompt}
-          retryAction={retryAction}
-        />
-      </div>
+          )}
+        </div>
+      ))}
+      <StartupFailureMessage
+        status={status}
+        error={error}
+        errorCode={errorCode}
+        prompt={prompt}
+        retryAction={retryAction}
+      />
     </div>
   );
 };
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/startup/index.ts b/apps/web/src/app/(sandbox)/task/[taskId]/startup/index.ts
index 42f9e2828..77c7bec10 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/startup/index.ts
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/startup/index.ts
@@ -1 +1,2 @@
 export * from './Startup';
+export * from './ProductTips';
diff --git a/apps/web/src/components/system/primitives/icons.ts b/apps/web/src/components/system/primitives/icons.ts
index 49fbf1edc..9ee447ac7 100644
--- a/apps/web/src/components/system/primitives/icons.ts
+++ b/apps/web/src/components/system/primitives/icons.ts
@@ -124,6 +124,7 @@ export {
   MessageSquareIcon,
   MessageSquarePlus,
   MessageSquareText,
+  MessageSquareWarning,
   MessagesSquare,
   Mic,
   MicOff,

From 0415eb7f9a96945a840194ec7fbc70a9f2ddc49f Mon Sep 17 00:00:00 2001
From: "roomote-roomote[bot]"
 <301996811+roomote-roomote[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 15:56:12 +0100
Subject: [PATCH 13/24] feat: report automation usage in instance ping (#1030)

Co-authored-by: Roomote <roomote@roomote.dev>
---
 .../src/lib/__tests__/instance-report.test.ts | 27 ++++++++++
 packages/db/src/lib/instance-report.ts        | 54 +++++++++++++++++++
 2 files changed, 81 insertions(+)

diff --git a/packages/db/src/lib/__tests__/instance-report.test.ts b/packages/db/src/lib/__tests__/instance-report.test.ts
index 9dcb147c3..6ca1cdad4 100644
--- a/packages/db/src/lib/__tests__/instance-report.test.ts
+++ b/packages/db/src/lib/__tests__/instance-report.test.ts
@@ -25,6 +25,7 @@ import {
   collectInstanceReportStats,
   dedupeAuthoredPullRequests,
   median,
+  summarizeAutomations,
   summarizePullRequestCohort,
 } from '../instance-report';
 
@@ -65,6 +66,32 @@ describe('instance-report pure helpers', () => {
     expect(median([10, 20, 30, 40])).toBe(25);
   });
 
+  it('summarizes automation totals from dynamic built-in rows', () => {
+    expect(
+      summarizeAutomations({
+        customTotal: 4,
+        customEnabled: 2,
+        builtInRows: [
+          { key: 'review_code', enabled: true },
+          { key: 'future_automation', enabled: true },
+          { key: 'disabled_automation', enabled: false },
+        ],
+      }),
+    ).toEqual({
+      custom: {
+        total: 4,
+        enabled: 2,
+      },
+      builtIn: {
+        enabled: 2,
+        enabledByKey: {
+          review_code: true,
+          future_automation: true,
+        },
+      },
+    });
+  });
+
   it('dedupes by repo#number using earliest detection and latest status', () => {
     const now = new Date('2026-07-10T12:00:00.000Z');
     const earlier = new Date(now.getTime() - 2 * 60 * 60 * 1000);
diff --git a/packages/db/src/lib/instance-report.ts b/packages/db/src/lib/instance-report.ts
index 9490d73a5..56b691497 100644
--- a/packages/db/src/lib/instance-report.ts
+++ b/packages/db/src/lib/instance-report.ts
@@ -24,6 +24,8 @@ import {
 
 import { db } from '../db';
 import {
+  automations,
+  customAutomations,
   taskRuns,
   deploymentMcpEnablements,
   deploymentSettings,
@@ -125,6 +127,17 @@ export type InstanceReportPullRequests7d = {
   medianTimeToMergeSeconds: number | null;
 };
 
+export type InstanceReportAutomations = {
+  custom: {
+    total: number;
+    enabled: number;
+  };
+  builtIn: {
+    enabled: number;
+    enabledByKey: Record<string, true>;
+  };
+};
+
 /**
  * Anonymous daily instance stats blob sent to the Ping service and forwarded
  * to PostHog. Extensible: add fields freely, never repurpose existing ones.
@@ -175,6 +188,7 @@ export type InstanceReportStats = {
   mcp: {
     enabled: string[];
   };
+  automations: InstanceReportAutomations;
 };
 
 type AuthoredPullRequestRow = {
@@ -208,6 +222,29 @@ function toNumber(value: string | number | null | undefined): number {
   return Number.isFinite(parsed) ? parsed : 0;
 }
 
+export function summarizeAutomations(options: {
+  customTotal: string | number | null | undefined;
+  customEnabled: string | number | null | undefined;
+  builtInRows: Array<{ key: string; enabled: boolean }>;
+}): InstanceReportAutomations {
+  const enabledByKey = Object.fromEntries(
+    options.builtInRows
+      .filter((automation) => automation.enabled)
+      .map((automation) => [automation.key, true] as const),
+  );
+
+  return {
+    custom: {
+      total: toNumber(options.customTotal),
+      enabled: toNumber(options.customEnabled),
+    },
+    builtIn: {
+      enabled: Object.keys(enabledByKey).length,
+      enabledByKey,
+    },
+  };
+}
+
 function getAuthoredPullRequestKey(row: {
   sourceControlProvider: string;
   host: string | null;
@@ -652,6 +689,9 @@ export async function collectInstanceReportStats(
     mcpEnablements,
     mcpConnectionIds,
     pullRequests7d,
+    customAutomationTotals,
+    enabledCustomAutomationTotals,
+    builtInAutomationRows,
   ] = await Promise.all([
     db.query.deploymentSettings.findFirst({
       where: eq(deploymentSettings.id, DEFAULT_DEPLOYMENT_ID),
@@ -767,6 +807,15 @@ export async function collectInstanceReportStats(
       .from(mcpConnections)
       .where(eq(mcpConnections.enabled, true)),
     collectPullRequests7d(now),
+    db.select({ total: count() }).from(customAutomations),
+    db
+      .select({ total: count() })
+      .from(customAutomations)
+      .where(eq(customAutomations.enabled, true)),
+    db
+      .select({ key: automations.key, enabled: automations.enabled })
+      .from(automations)
+      .where(eq(automations.internal, false)),
   ]);
 
   const comms: string[] = [];
@@ -853,6 +902,11 @@ export async function collectInstanceReportStats(
     mcp: {
       enabled: mcpEnabled,
     },
+    automations: summarizeAutomations({
+      customTotal: customAutomationTotals[0]?.total,
+      customEnabled: enabledCustomAutomationTotals[0]?.total,
+      builtInRows: builtInAutomationRows,
+    }),
   };
 }
 

From 576da8f787c0b7a17acc34a507fa7760dbebc7f4 Mon Sep 17 00:00:00 2001
From: "roomote-roomote[bot]"
 <301996811+roomote-roomote[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 16:20:26 +0100
Subject: [PATCH 14/24] feat: hide fully used invites from settings (#1032)

Co-authored-by: Roomote <roomote@roomote.dev>
---
 .../settings/UsersSettings.client.test.tsx    | 20 ++++++++++++++++++-
 .../src/components/settings/UsersSettings.tsx |  8 +++++++-
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/apps/web/src/components/settings/UsersSettings.client.test.tsx b/apps/web/src/components/settings/UsersSettings.client.test.tsx
index 859b5937e..ea8e59beb 100644
--- a/apps/web/src/components/settings/UsersSettings.client.test.tsx
+++ b/apps/web/src/components/settings/UsersSettings.client.test.tsx
@@ -330,7 +330,7 @@ describe('UsersSettings', () => {
     });
   });
 
-  it('lists only non-revoked invites and removes revoked ones', async () => {
+  it('lists only open invites and removes revoked or fully used ones', async () => {
     mockSettingsState.current = {
       ...mockSettingsState.current,
       invites: [
@@ -358,6 +358,18 @@ describe('UsersSettings', () => {
           createdAt: new Date('2026-06-01T00:00:00Z'),
           usable: false,
         },
+        {
+          id: 'invite-3',
+          label: 'Used link',
+          role: 'member',
+          maxUses: 2,
+          usedCount: 2,
+          acceptedUserCount: 2,
+          expiresAt: null,
+          revokedAt: null,
+          createdAt: new Date('2026-06-15T00:00:00Z'),
+          usable: false,
+        },
       ],
     };
 
@@ -368,7 +380,13 @@ describe('UsersSettings', () => {
     ).toBeInTheDocument();
     expect(screen.getByText(/2 of 5 used/)).toBeInTheDocument();
     expect(screen.queryByText('Invite for Old link')).not.toBeInTheDocument();
+    expect(screen.queryByText('Invite for Used link')).not.toBeInTheDocument();
     expect(screen.queryByText('revoked')).not.toBeInTheDocument();
+    expect(
+      screen.getByText(
+        'Invites are removed from the list after fully used, to keep things clean.',
+      ),
+    ).toBeInTheDocument();
     // The admin invite is badged; the member invite is not.
     expect(
       within(
diff --git a/apps/web/src/components/settings/UsersSettings.tsx b/apps/web/src/components/settings/UsersSettings.tsx
index c075f7965..7823837c3 100644
--- a/apps/web/src/components/settings/UsersSettings.tsx
+++ b/apps/web/src/components/settings/UsersSettings.tsx
@@ -251,7 +251,9 @@ export function UsersSettings() {
     license,
   } = settingsQuery.data;
   const adminCount = members.filter((member) => member.role === 'admin').length;
-  const visibleInvites = invites.filter((invite) => invite.revokedAt == null);
+  const visibleInvites = invites.filter(
+    (invite) => invite.revokedAt == null && invite.usedCount < invite.maxUses,
+  );
   const seatsRemaining = license.seatLimit - license.seatsUsed;
   const isAtSeatCapacity = seatsRemaining <= 0;
   const purchasedLicenseExpiringSoon =
@@ -613,6 +615,10 @@ export function UsersSettings() {
             })}
           </div>
         ) : null}
+        <p className="text-sm text-muted-foreground">
+          Invites are removed from the list after fully used, to keep things
+          clean.
+        </p>
       </Section>
 
       <Dialog

From 46282f274793406e77c2cfea90662f856242bf0f Mon Sep 17 00:00:00 2001
From: Matt Rubens <mrubens@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:41:54 -0400
Subject: [PATCH 15/24] Stop premature sandbox aborts and offer retry on late
 failures (#1026)

---
 .../compute-providers/spawn-azure-worker.ts   |   8 +-
 .../compute-providers/spawn-blaxel-worker.ts  |   8 +-
 .../compute-providers/spawn-daytona-worker.ts |   8 +-
 .../src/compute-providers/spawn-e2b-worker.ts |   8 +-
 .../compute-providers/spawn-modal-worker.ts   |   8 +-
 .../src/compute-providers/timeouts.ts         |  29 ++++
 .../HistoricalContent.client.test.tsx         | 128 +++++++++++++++++-
 .../task/[taskId]/HistoricalContent.tsx       |  55 +++++++-
 .../task/[taskId]/hooks/use-task-session.ts   |   2 +
 .../trpc/commands/sandbox-session/index.ts    |   9 +-
 .../cloud-agents/src/server/task-run-queue.ts |  59 ++++++--
 11 files changed, 291 insertions(+), 31 deletions(-)
 create mode 100644 apps/controller/src/compute-providers/timeouts.ts

diff --git a/apps/controller/src/compute-providers/spawn-azure-worker.ts b/apps/controller/src/compute-providers/spawn-azure-worker.ts
index d95aae643..1ea9ea160 100644
--- a/apps/controller/src/compute-providers/spawn-azure-worker.ts
+++ b/apps/controller/src/compute-providers/spawn-azure-worker.ts
@@ -31,6 +31,10 @@ import {
   updateTaskRunMachine,
 } from '../utils';
 import { resolveTaskSandboxMemoryMiB } from './task-sandbox-resources';
+import {
+  COMPUTE_BOOTSTRAP_TIMEOUT_MS,
+  COMPUTE_CREATE_INSTANCE_TIMEOUT_MS,
+} from './timeouts';
 
 const AZURE_LAUNCH_OUTPUT_TEXT_LIMIT = 500;
 
@@ -344,8 +348,8 @@ export async function spawnAzureWorker(
     tags: azureTags,
     timeoutMs: azureTimeoutMs,
     localTarballPath,
-    createInstanceTimeoutMs: 180_000,
-    bootstrapTimeoutMs: 120_000,
+    createInstanceTimeoutMs: COMPUTE_CREATE_INSTANCE_TIMEOUT_MS,
+    bootstrapTimeoutMs: COMPUTE_BOOTSTRAP_TIMEOUT_MS,
     computeClient,
     onMutation: recordMutation,
     ...launchOptions,
diff --git a/apps/controller/src/compute-providers/spawn-blaxel-worker.ts b/apps/controller/src/compute-providers/spawn-blaxel-worker.ts
index 1efeaf209..b0af22fec 100644
--- a/apps/controller/src/compute-providers/spawn-blaxel-worker.ts
+++ b/apps/controller/src/compute-providers/spawn-blaxel-worker.ts
@@ -27,6 +27,10 @@ import {
   updateTaskRunMachine,
 } from '../utils';
 import { resolveTaskSandboxMemoryMiB } from './task-sandbox-resources';
+import {
+  COMPUTE_BOOTSTRAP_TIMEOUT_MS,
+  COMPUTE_CREATE_INSTANCE_TIMEOUT_MS,
+} from './timeouts';
 
 export async function spawnBlaxelWorker(
   taskRun: TaskRun,
@@ -120,8 +124,8 @@ export async function spawnBlaxelWorker(
     tags: config.blaxelTags,
     timeoutMs: config.blaxelTimeoutMs,
     localTarballPath: config.localTarballPath,
-    createInstanceTimeoutMs: 180_000,
-    bootstrapTimeoutMs: 120_000,
+    createInstanceTimeoutMs: COMPUTE_CREATE_INSTANCE_TIMEOUT_MS,
+    bootstrapTimeoutMs: COMPUTE_BOOTSTRAP_TIMEOUT_MS,
     computeClient,
     onMutation: recordMutation,
     ...launchOptions,
diff --git a/apps/controller/src/compute-providers/spawn-daytona-worker.ts b/apps/controller/src/compute-providers/spawn-daytona-worker.ts
index 055e020aa..152e56d34 100644
--- a/apps/controller/src/compute-providers/spawn-daytona-worker.ts
+++ b/apps/controller/src/compute-providers/spawn-daytona-worker.ts
@@ -28,6 +28,10 @@ import {
   updateTaskRunMachine,
 } from '../utils';
 import { resolveTaskSandboxMemoryMiB } from './task-sandbox-resources';
+import {
+  COMPUTE_BOOTSTRAP_TIMEOUT_MS,
+  COMPUTE_CREATE_INSTANCE_TIMEOUT_MS,
+} from './timeouts';
 
 const DAYTONA_LAUNCH_OUTPUT_TEXT_LIMIT = 500;
 
@@ -255,8 +259,8 @@ export async function spawnDaytonaWorker(
     tags: daytonaTags,
     timeoutMs: daytonaTimeoutMs,
     localTarballPath,
-    createInstanceTimeoutMs: 180_000,
-    bootstrapTimeoutMs: 120_000,
+    createInstanceTimeoutMs: COMPUTE_CREATE_INSTANCE_TIMEOUT_MS,
+    bootstrapTimeoutMs: COMPUTE_BOOTSTRAP_TIMEOUT_MS,
     computeClient,
     onMutation: recordMutation,
     ...launchOptions,
diff --git a/apps/controller/src/compute-providers/spawn-e2b-worker.ts b/apps/controller/src/compute-providers/spawn-e2b-worker.ts
index 65fc9c7bd..afdf2f8b9 100644
--- a/apps/controller/src/compute-providers/spawn-e2b-worker.ts
+++ b/apps/controller/src/compute-providers/spawn-e2b-worker.ts
@@ -27,6 +27,10 @@ import {
   shouldEnableAuthBypassForTaskRun,
   updateTaskRunMachine,
 } from '../utils';
+import {
+  COMPUTE_BOOTSTRAP_TIMEOUT_MS,
+  COMPUTE_CREATE_INSTANCE_TIMEOUT_MS,
+} from './timeouts';
 
 const E2B_LAUNCH_OUTPUT_TEXT_LIMIT = 500;
 
@@ -249,8 +253,8 @@ export async function spawnE2bWorker(
     tags: e2bTags,
     timeoutMs: e2bTimeoutMs,
     localTarballPath,
-    createInstanceTimeoutMs: 180_000,
-    bootstrapTimeoutMs: 120_000,
+    createInstanceTimeoutMs: COMPUTE_CREATE_INSTANCE_TIMEOUT_MS,
+    bootstrapTimeoutMs: COMPUTE_BOOTSTRAP_TIMEOUT_MS,
     computeClient,
     onMutation: recordMutation,
     ...launchOptions,
diff --git a/apps/controller/src/compute-providers/spawn-modal-worker.ts b/apps/controller/src/compute-providers/spawn-modal-worker.ts
index c1a08c969..bd30374d0 100644
--- a/apps/controller/src/compute-providers/spawn-modal-worker.ts
+++ b/apps/controller/src/compute-providers/spawn-modal-worker.ts
@@ -31,6 +31,10 @@ import {
   updateTaskRunMachine,
 } from '../utils';
 import { resolveTaskSandboxMemoryMiB } from './task-sandbox-resources';
+import {
+  COMPUTE_BOOTSTRAP_TIMEOUT_MS,
+  COMPUTE_CREATE_INSTANCE_TIMEOUT_MS,
+} from './timeouts';
 
 const MODAL_LAUNCH_OUTPUT_TEXT_LIMIT = 500;
 
@@ -367,8 +371,8 @@ export async function spawnModalWorker(
     tags: modalTags,
     timeoutMs: modalTimeoutMs,
     localTarballPath,
-    createInstanceTimeoutMs: 180_000,
-    bootstrapTimeoutMs: 120_000,
+    createInstanceTimeoutMs: COMPUTE_CREATE_INSTANCE_TIMEOUT_MS,
+    bootstrapTimeoutMs: COMPUTE_BOOTSTRAP_TIMEOUT_MS,
     computeClient,
     onMutation: recordMutation,
     ...launchOptions,
diff --git a/apps/controller/src/compute-providers/timeouts.ts b/apps/controller/src/compute-providers/timeouts.ts
new file mode 100644
index 000000000..455663887
--- /dev/null
+++ b/apps/controller/src/compute-providers/timeouts.ts
@@ -0,0 +1,29 @@
+/**
+ * Shared sandbox-provisioning deadlines for every compute provider.
+ *
+ * These were duplicated as literals in each spawn-*-worker module, so the
+ * creation deadline could only be tuned five times or not at all.
+ */
+
+/**
+ * How long to wait for a provider to hand back a running instance.
+ *
+ * Raised from three minutes after that deadline was observed manufacturing
+ * false failures: under sandbox-creation rate limiting, creation routinely
+ * outlasts three minutes, the run is marked `failed`, and then the sandbox
+ * comes up anyway and the agent posts its work minutes later — leaving the
+ * user an error banner on top of a finished task whose thread is dead
+ * (roomote nightly, 2026-08-03: run failed at 3m00s, assistant output
+ * arrived 12 minutes later; 4 of 42 failed runs that week did the same).
+ *
+ * Waiting longer is the cheaper mistake: a slow start still shows the
+ * startup sequence, while a premature abort throws away real work.
+ */
+export const COMPUTE_CREATE_INSTANCE_TIMEOUT_MS = 10 * 60_000;
+
+/**
+ * How long to wait for a created instance to finish bootstrapping. Unchanged
+ * — bootstrap runs after the provider has already given us the machine, so
+ * it is not subject to the creation-queue contention above.
+ */
+export const COMPUTE_BOOTSTRAP_TIMEOUT_MS = 2 * 60_000;
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/HistoricalContent.client.test.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/HistoricalContent.client.test.tsx
index 19dafc708..e2af1e84d 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/HistoricalContent.client.test.tsx
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/HistoricalContent.client.test.tsx
@@ -1,8 +1,9 @@
 import type { ReactNode } from 'react';
-import { render, screen } from '@testing-library/react';
+import { fireEvent, render, screen } from '@testing-library/react';
 
-const { isTaskRunAsleepMock } = vi.hoisted(() => ({
+const { isTaskRunAsleepMock, retryFailedStartMutate } = vi.hoisted(() => ({
   isTaskRunAsleepMock: vi.fn(() => false),
+  retryFailedStartMutate: vi.fn(),
 }));
 
 vi.mock('@/components/system', () => ({
@@ -10,8 +11,18 @@ vi.mock('@/components/system', () => ({
   ArrowRight: () => <svg aria-hidden="true" />,
   Badge: ({ children }: { children: ReactNode }) => <span>{children}</span>,
   BasicTooltip: ({ children }: { children: ReactNode }) => <>{children}</>,
-  Button: ({ children }: { children: ReactNode }) => (
-    <button>{children}</button>
+  Button: ({
+    children,
+    onClick,
+    disabled,
+  }: {
+    children: ReactNode;
+    onClick?: () => void;
+    disabled?: boolean;
+  }) => (
+    <button onClick={onClick} disabled={disabled}>
+      {children}
+    </button>
   ),
   Check: () => <svg aria-hidden="true" />,
   HelpCircle: () => <svg aria-hidden="true" />,
@@ -20,6 +31,13 @@ vi.mock('@/components/system', () => ({
   X: () => <svg aria-hidden="true" />,
 }));
 
+vi.mock('@/hooks/task-runs', () => ({
+  useRetryFailedTaskStart: () => ({
+    mutate: retryFailedStartMutate,
+    isPending: false,
+  }),
+}));
+
 vi.mock('@/components/ai-elements', () => ({
   Message: ({ children }: { children: ReactNode }) => <div>{children}</div>,
   MessageContent: ({ children }: { children: ReactNode }) => (
@@ -174,6 +192,108 @@ describe('HistoricalContent', () => {
     ).toBeInTheDocument();
   });
 
+  it('offers a retry when the server says the start can be relaunched', () => {
+    render(
+      <HistoricalContent
+        session={
+          {
+            sessionState: 'historical',
+            draftPrompt: null,
+            taskRun: {
+              id: 3734,
+              status: 'failed',
+              payloadKind: 'standard',
+              canRetryFailedStart: true,
+              error: 'The operation was aborted due to timeout',
+              result: null,
+              snapshotId: null,
+              createdAt: new Date('2026-08-03T13:14:56.000Z'),
+              startedAt: null,
+            },
+            taskId: 'task-123',
+            artifacts: [],
+          } as never
+        }
+      />,
+    );
+
+    fireEvent.click(screen.getByRole('button', { name: 'Retry' }));
+
+    expect(retryFailedStartMutate).toHaveBeenCalledWith({
+      taskId: 'task-123',
+      runId: 3734,
+    });
+  });
+
+  it('offers no retry once the late transcript has landed', () => {
+    // The sandbox came up after the provisioning deadline: the run is
+    // failed but the agent's work is in the thread, so the server refuses
+    // the relaunch (it would redo work that already happened) and reports
+    // canRetryFailedStart: false.
+    render(
+      <HistoricalContent
+        session={
+          {
+            sessionState: 'historical',
+            draftPrompt: null,
+            taskRun: {
+              id: 3734,
+              status: 'failed',
+              payloadKind: 'standard',
+              canRetryFailedStart: false,
+              error: 'The operation was aborted due to timeout',
+              result: null,
+              snapshotId: null,
+              createdAt: new Date('2026-08-03T13:14:56.000Z'),
+              startedAt: null,
+            },
+            taskId: 'task-123',
+            artifacts: [],
+          } as never
+        }
+      />,
+    );
+
+    expect(
+      screen.getByText('Task ended because of an error:'),
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByRole('button', { name: 'Retry' }),
+    ).not.toBeInTheDocument();
+  });
+
+  it('offers no retry when the run carries no server verdict', () => {
+    render(
+      <HistoricalContent
+        session={
+          {
+            sessionState: 'historical',
+            draftPrompt: null,
+            taskRun: {
+              id: 3734,
+              status: 'failed',
+              payloadKind: 'snapshot_resume',
+              error: 'The operation was aborted due to timeout',
+              result: null,
+              snapshotId: null,
+              createdAt: new Date('2026-08-03T13:14:56.000Z'),
+              startedAt: null,
+            },
+            taskId: 'task-123',
+            artifacts: [],
+          } as never
+        }
+      />,
+    );
+
+    expect(
+      screen.getByText('Task ended because of an error:'),
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByRole('button', { name: 'Retry' }),
+    ).not.toBeInTheDocument();
+  });
+
   it('prefers an explicit footer over the generic task error footer', () => {
     render(
       <HistoricalContent
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/HistoricalContent.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/HistoricalContent.tsx
index 073c1fcd0..75c016662 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/HistoricalContent.tsx
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/HistoricalContent.tsx
@@ -2,8 +2,8 @@
 
 import { useEffect, useMemo, useState, type ReactNode } from 'react';
 import { RunStatus } from '@roomote/types';
-import { MessageSquareWarning } from 'lucide-react';
-import { Sun } from '@/components/system';
+import { MessageSquareWarning, RotateCcw } from 'lucide-react';
+import { Button, Sun } from '@/components/system';
 import { Message, MessageContent, Shimmer } from '@/components/ai-elements';
 import { FramedSurface } from '@/components/layout';
 
@@ -15,6 +15,7 @@ import {
   useClosePreviewOnSleep,
 } from './hooks';
 import { getTaskRunDisplayError } from '@/lib/task-run-errors';
+import { useRetryFailedTaskStart } from '@/hooks/task-runs';
 
 import { SidebarActions } from './sidebar-actions';
 import { isTaskRunAsleep } from './sidebar-actions/utils';
@@ -40,6 +41,7 @@ export function HistoricalContent({ session, footer }: HistoricalContentProps) {
   const shouldShowWakeTaskInput = isAsleep && Boolean(taskRun?.snapshotId);
   const [messagesInitialScrollBehavior, setMessagesInitialScrollBehavior] =
     useState<'smooth' | 'instant'>('smooth');
+  const retryFailedStart = useRetryFailedTaskStart();
   const taskFailureFooter = useMemo(() => {
     const displayError = getTaskRunDisplayError(taskRun);
 
@@ -52,8 +54,30 @@ export function HistoricalContent({ session, footer }: HistoricalContentProps) {
       return null;
     }
 
-    return <TaskFailureMessage error={displayError} />;
-  }, [taskRun]);
+    // The server decides: `enqueueTaskRelaunch` refuses a run that already
+    // produced agent output, because relaunching would redo work it did —
+    // a review it posted would post twice. Reading its verdict rather than
+    // re-deriving the rules here is what keeps the button from appearing
+    // where it would only error, or hiding where a retry would have
+    // worked.
+    const canRetry = taskRun.canRetryFailedStart === true;
+
+    return (
+      <TaskFailureMessage
+        error={displayError}
+        onRetry={
+          canRetry
+            ? () =>
+                retryFailedStart.mutate({
+                  taskId: session.taskId,
+                  runId: taskRun.id,
+                })
+            : undefined
+        }
+        retryPending={retryFailedStart.isPending}
+      />
+    );
+  }, [retryFailedStart, session.taskId, taskRun]);
   const messagesFooter = useMemo(() => {
     const onboardingCompletionFooter = onboardingEnvironment ? (
       <OnboardingCompletionMessage environment={onboardingEnvironment} />
@@ -145,7 +169,15 @@ function WakingUpMessage() {
   );
 }
 
-function TaskFailureMessage({ error }: { error: string }) {
+function TaskFailureMessage({
+  error,
+  onRetry,
+  retryPending = false,
+}: {
+  error: string;
+  onRetry?: (() => void) | undefined;
+  retryPending?: boolean;
+}) {
   return (
     <Message from="assistant">
       <MessageContent>
@@ -156,6 +188,19 @@ function TaskFailureMessage({ error }: { error: string }) {
             <div className="text-foreground whitespace-pre-wrap wrap-break-word">
               {error}
             </div>
+            {onRetry && (
+              <div className="pt-1">
+                <Button
+                  variant="outline"
+                  size="sm"
+                  onClick={onRetry}
+                  disabled={retryPending}
+                >
+                  <RotateCcw className="size-4" />
+                  Retry
+                </Button>
+              </div>
+            )}
           </div>
         </div>
       </MessageContent>
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/hooks/use-task-session.ts b/apps/web/src/app/(sandbox)/task/[taskId]/hooks/use-task-session.ts
index be955ee49..655832f78 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/hooks/use-task-session.ts
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/hooks/use-task-session.ts
@@ -48,6 +48,8 @@ export type SessionTaskRun = TaskRunDetail & {
   prRepo: string | null;
   prNumber: number | null;
   previewProxyBaseUrl?: string;
+  /** Server-derived: whether a failed start may be relaunched. */
+  canRetryFailedStart?: boolean;
 };
 
 /**
diff --git a/apps/web/src/trpc/commands/sandbox-session/index.ts b/apps/web/src/trpc/commands/sandbox-session/index.ts
index 3b81fe7d5..dc16ef54d 100644
--- a/apps/web/src/trpc/commands/sandbox-session/index.ts
+++ b/apps/web/src/trpc/commands/sandbox-session/index.ts
@@ -1,3 +1,4 @@
+import { canRetryFailedStart } from '@roomote/cloud-agents/server';
 import {
   RunStatus,
   TaskPayloadKind,
@@ -572,7 +573,13 @@ async function getResolvedSandboxTaskRunForTaskAccess(
 
   return {
     task: taskById,
-    taskRun,
+    taskRun: {
+      ...taskRun,
+      // Whether `enqueueTaskRelaunch` would accept this run, so the
+      // failure UI can offer retry exactly where it works instead of
+      // approximating the command's rules client-side.
+      canRetryFailedStart: await canRetryFailedStart(taskRun),
+    },
   };
 }
 
diff --git a/packages/cloud-agents/src/server/task-run-queue.ts b/packages/cloud-agents/src/server/task-run-queue.ts
index b47f76377..65ea543c0 100644
--- a/packages/cloud-agents/src/server/task-run-queue.ts
+++ b/packages/cloud-agents/src/server/task-run-queue.ts
@@ -1724,6 +1724,53 @@ const RELAUNCHABLE_FAILED_START_PAYLOAD_KINDS: ReadonlySet<TaskPayloadKind> =
     TaskPayloadKind.McpRecommendations,
   ]);
 
+/**
+ * Whether the run's transcript holds anything the agent produced.
+ *
+ * Provider kickoff/start rows (for example Slack "started") are written
+ * before provisioning and must not block restart after a failed start;
+ * anything else means the run did work a relaunch would redo.
+ */
+async function hasNonKickoffTaskMessages(runId: number): Promise<boolean> {
+  const priorHarnessMessage = await db.query.taskMessages.findFirst({
+    where: and(
+      eq(taskMessages.runId, runId),
+      sql`coalesce(${taskMessages.metadata}->>'source', '') <> ${TASK_KICKOFF_MESSAGE_SOURCE}`,
+    ),
+    columns: { id: true },
+  });
+
+  return Boolean(priorHarnessMessage);
+}
+
+/**
+ * Whether `enqueueTaskRelaunch` would accept this run, so a caller can offer
+ * the control only where it works. Deriving it here rather than
+ * re-implementing the rules in the UI is what keeps the button and the
+ * command from disagreeing — a client-side approximation previously either
+ * offered a retry that always errored, or hid one that would have worked.
+ */
+export async function canRetryFailedStart(sourceRun: {
+  id: number;
+  status: TaskRun['status'];
+  payloadKind: TaskRun['payloadKind'];
+  payload: TaskRun['payload'];
+}): Promise<boolean> {
+  if (sourceRun.status !== RunStatus.Failed) {
+    return false;
+  }
+
+  if (!isRelaunchableFailedStartPayloadKind(sourceRun.payloadKind)) {
+    return false;
+  }
+
+  if (!sourceRun.payload?.repo && !sourceRun.payload?.environmentId) {
+    return false;
+  }
+
+  return !(await hasNonKickoffTaskMessages(sourceRun.id));
+}
+
 export function isRelaunchableFailedStartPayloadKind(
   payloadKind: TaskPayloadKind,
 ): boolean {
@@ -1804,17 +1851,7 @@ export async function enqueueTaskRelaunch(
     );
   }
 
-  // Provider kickoff/start rows (for example Slack “started”) are written
-  // before provisioning and must not block restart after a failed start.
-  const priorHarnessMessage = await db.query.taskMessages.findFirst({
-    where: and(
-      eq(taskMessages.runId, sourceRun.id),
-      sql`coalesce(${taskMessages.metadata}->>'source', '') <> ${TASK_KICKOFF_MESSAGE_SOURCE}`,
-    ),
-    columns: { id: true },
-  });
-
-  if (priorHarnessMessage) {
+  if (await hasNonKickoffTaskMessages(sourceRun.id)) {
     throw new Error(
       'Only failed environment starts can be restarted. This run already has task messages.',
     );

From 65561264e3dd33aee8c8416085779ec6fbe38adf Mon Sep 17 00:00:00 2001
From: "roomote-community[bot]"
 <311835222+roomote-community[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 12:13:15 -0400
Subject: [PATCH 16/24] [Improve] Catch visual inconsistencies in UI proof
 (#1031)

Co-authored-by: sky <136036952+easonLiangWorldedtech@users.noreply.github.com>
---
 .../__tests__/proof-runner-prompt.test.ts     | 24 +++++++++++++++++++
 .../src/run-task/proof-runner-prompt.ts       |  7 +++---
 2 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/apps/worker/src/run-task/__tests__/proof-runner-prompt.test.ts b/apps/worker/src/run-task/__tests__/proof-runner-prompt.test.ts
index 04109a52d..4d9e03d58 100644
--- a/apps/worker/src/run-task/__tests__/proof-runner-prompt.test.ts
+++ b/apps/worker/src/run-task/__tests__/proof-runner-prompt.test.ts
@@ -1,6 +1,30 @@
 import { createProofRunnerAgentPrompt } from '../proof-runner-prompt';
 
 describe('createProofRunnerAgentPrompt', () => {
+  it('requires a full-frame visual quality check before upload', () => {
+    const prompt = createProofRunnerAgentPrompt('http://127.0.0.1:3000');
+
+    expect(prompt).toContain(
+      'Verify both the specific proof sentence and the full captured frame for obvious visual regressions',
+    );
+    expect(prompt).toContain(
+      'inconsistent light/dark theme treatment, unreadable contrast, clipping or overflow, broken layout, unintended loading or error states',
+    );
+    expect(prompt).toContain('styling that conflicts with the surrounding UI');
+    expect(prompt).toContain(
+      'Do not approve or upload an artifact just because its focal element satisfies the proof sentence.',
+    );
+    expect(prompt).toContain(
+      'If the failed self-review is caused by the capture itself, retry the artifact once.',
+    );
+    expect(prompt).toContain(
+      'If the UI is plainly wrong because of the implementation, report that as blocked instead of uploading it as successful proof.',
+    );
+    expect(prompt).toContain(
+      'self-review outcome covering both claim accuracy and full-frame visual quality',
+    );
+  });
+
   it('returns artifact IDs and explicit parent sharing guidance', () => {
     const prompt = createProofRunnerAgentPrompt('http://127.0.0.1:3000');
 
diff --git a/apps/worker/src/run-task/proof-runner-prompt.ts b/apps/worker/src/run-task/proof-runner-prompt.ts
index 8d9173e32..0c4786ef6 100644
--- a/apps/worker/src/run-task/proof-runner-prompt.ts
+++ b/apps/worker/src/run-task/proof-runner-prompt.ts
@@ -18,7 +18,7 @@ export function createProofRunnerAgentPrompt(browserTarget: string): string {
     '1. Decide the smallest concrete capture plan that proves the claim for the requested package, covering every checklist item from the brief.',
     '2. Reach the required product state, including authentication when needed.',
     '3. Capture the final screenshots and screencasts under `/tmp/capture-visual-proof/`.',
-    '4. Self-review each captured screenshot and screencast keyframe against its proof sentence before upload. If your model cannot inspect images directly, say so explicitly in the final report so the parent can validate the captures with the visual subagent instead.',
+    '4. Self-review each captured screenshot and screencast keyframe before upload. Verify both the specific proof sentence and the full captured frame for obvious visual regressions, including inconsistent light/dark theme treatment, unreadable contrast, clipping or overflow, broken layout, unintended loading or error states, and styling that conflicts with the surrounding UI. If your model cannot inspect images directly, say so explicitly in the final report so the parent can validate the captures with the visual subagent instead.',
     '5. Upload each approved screenshot, screencast, and keyframe with the `manage_artifacts` MCP tool using the `upload` action and `type` set to `visual-proof`. Treat the `artifactId`, `viewUrl`, and `rawUrl` values returned by each upload tool result as the only canonical artifact references. Never invent, guess, or reconstruct artifact IDs or URLs.',
     '6. Return one final report containing the uploaded artifact IDs and URLs from those tool results.',
     '',
@@ -49,7 +49,8 @@ export function createProofRunnerAgentPrompt(browserTarget: string): string {
     '- For screencasts, start recording before the interaction that matters, stop as soon as the proof is visible, validate the clip with `ffprobe`, and extract 3 to 5 keyframes under `/tmp/capture-visual-proof/`.',
     '- Retry a screenshot or screencast once when the first honest capture is obviously blank, clipped, or misses the required visible state.',
     '- If you capture only partial supporting evidence and the remaining checklist items cannot be shown honestly, return the run as blocked instead of reporting a narrowed success.',
-    '- If the UI is plainly wrong because of the implementation itself, report that as blocked instead of inventing proof.',
+    '- Do not approve or upload an artifact just because its focal element satisfies the proof sentence. Treat an obvious visual defect anywhere in the captured frame as a failed self-review.',
+    '- If the failed self-review is caused by the capture itself, retry the artifact once. If the UI is plainly wrong because of the implementation, report that as blocked instead of uploading it as successful proof.',
     '',
     'Final report contract:',
     '',
@@ -58,7 +59,7 @@ export function createProofRunnerAgentPrompt(browserTarget: string): string {
     '- `Summary`: what was captured and what it proves, or the blocker.',
     '- `Blocked`: `true` or `false`, with a short `Blocker type` and blocker description when blocked. Set blocked to true when any materially distinct checklist item remains unproved.',
     '- `Coverage`: the claim scope, covered checklist items, and missing checklist items.',
-    '- `Screenshots` and `Screencasts` (when present): one entry per artifact with its name, proof sentence, local file path, self-review outcome, and the `artifactId`, `viewUrl`, and `rawUrl` returned by its `manage_artifacts` upload result. Include keyframe artifact IDs and URLs for each screencast.',
+    '- `Screenshots` and `Screencasts` (when present): one entry per artifact with its name, proof sentence, local file path, self-review outcome covering both claim accuracy and full-frame visual quality, and the `artifactId`, `viewUrl`, and `rawUrl` returned by its `manage_artifacts` upload result. Include keyframe artifact IDs and URLs for each screencast.',
     '- `Sharing note`: only when the report contains at least one uploaded artifact, end with this guidance for the parent: "Visual-proof uploads are not posted to chat automatically. If `send_chat_reply` with `imageArtifactIds` is available and this proof may be relevant to the user in the originating thread, share the screenshot artifact IDs listed above. For non-image proof, include the `viewUrl` links in the reply text." Omit the section entirely when no artifacts were uploaded.',
     '',
     'Report only artifact URLs that appeared verbatim in `manage_artifacts` upload tool results. When an upload fails, retry it once with the verified local artifact path, then report the exact upload failure instead of treating a local path as final output.',

From 09819a6bf2792d2ffac64cd96ff186da95e8bc0b Mon Sep 17 00:00:00 2001
From: "roomote-roomote[bot]"
 <301996811+roomote-roomote[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 17:21:15 +0100
Subject: [PATCH 17/24] [Improve] Refine Automations filtering and editing
 (#1036)

* feat: improve automations filtering and editing

* improve: refine automations editor layout

---------

Co-authored-by: Roomote <roomote@roomote.dev>
---
 .../settings/DeploymentTimeZoneSetting.tsx    |   5 +
 ...AutomationsSettings.render.client.test.tsx |  63 ++++-
 .../automations/AutomationsSettings.tsx       | 187 ++++++++++++-
 .../automations/CustomAutomationsSection.tsx  | 245 ++++++++++--------
 .../src/components/system/primitives/icons.ts |   1 -
 5 files changed, 381 insertions(+), 120 deletions(-)

diff --git a/apps/web/src/components/settings/DeploymentTimeZoneSetting.tsx b/apps/web/src/components/settings/DeploymentTimeZoneSetting.tsx
index e152c9441..6f39e6445 100644
--- a/apps/web/src/components/settings/DeploymentTimeZoneSetting.tsx
+++ b/apps/web/src/components/settings/DeploymentTimeZoneSetting.tsx
@@ -21,6 +21,7 @@ import {
   Popover,
   PopoverContent,
   PopoverTrigger,
+  Skeleton,
 } from '@/components/system';
 
 const FALLBACK_TIME_ZONES = [
@@ -83,6 +84,10 @@ export function DeploymentTimeZoneSetting() {
 
   const effectiveTimeZone = settings.data?.effectiveTimeZone ?? 'UTC';
 
+  if (settings.isPending) {
+    return <Skeleton className="h-5 w-64" />;
+  }
+
   if (!isEditing) {
     return (
       <p className="text-sm text-muted-foreground">
diff --git a/apps/web/src/components/settings/automations/AutomationsSettings.render.client.test.tsx b/apps/web/src/components/settings/automations/AutomationsSettings.render.client.test.tsx
index 18219b032..eede21ef9 100644
--- a/apps/web/src/components/settings/automations/AutomationsSettings.render.client.test.tsx
+++ b/apps/web/src/components/settings/automations/AutomationsSettings.render.client.test.tsx
@@ -10,6 +10,7 @@ const managerInstructionsPlaceholder =
   /Optional guidance for which ideas to prioritize or avoid/;
 
 const state = vi.hoisted(() => ({
+  customAutomationsPending: false,
   customAutomations: [] as Array<{
     id: string;
     name: string;
@@ -284,7 +285,10 @@ vi.mock('@tanstack/react-query', () => ({
     }
 
     if (key1 === 'listCustomAutomations') {
-      return { isPending: false, data: state.customAutomations };
+      return {
+        isPending: state.customAutomationsPending,
+        data: state.customAutomations,
+      };
     }
 
     if (queryOptions.queryKey?.[0] === 'taskModels') {
@@ -522,6 +526,8 @@ describe('AutomationsSettings', () => {
     state.settingsQuery.data.reviewer.relayReviewResultsToTask = false;
     state.settingsQuery.data.reviewer.relayUsers = [];
     state.customAutomations = [];
+    state.customAutomationsPending = false;
+    state.settingsQuery.isPending = false;
     state.environments = [];
     for (const key of Object.keys(
       state.settingsQuery.data.resolvedDestinations,
@@ -776,6 +782,50 @@ describe('AutomationsSettings', () => {
     expect(screen.queryByText('Meta automations')).toBeNull();
   });
 
+  it('filters available automations by category and provider-aware search', async () => {
+    render(<AutomationsSettings />);
+
+    const categoryFilter = await screen.findByRole('combobox', {
+      name: 'Filter available automations by category',
+    });
+    expect(categoryFilter).toHaveTextContent('All');
+
+    fireEvent.change(
+      screen.getByRole('textbox', { name: 'Search available automations' }),
+      { target: { value: 'Discord' } },
+    );
+
+    expect(screen.getByText('Auto-respond to channels')).toBeInTheDocument();
+    expect(screen.queryByText('Review Code')).not.toBeInTheDocument();
+    fireEvent.click(
+      screen.getByRole('button', { name: 'Clear automation filters' }),
+    );
+    expect(screen.getByText('Review Code')).toBeInTheDocument();
+
+    fireEvent.click(categoryFilter);
+    fireEvent.click(await screen.findByRole('option', { name: 'Operations' }));
+    expect(screen.getByText('Triage Sentry Issues')).toBeInTheDocument();
+    expect(screen.queryByText('Review Code')).not.toBeInTheDocument();
+  });
+
+  it('shows independent structural skeletons for custom and built-in automations', () => {
+    state.customAutomationsPending = true;
+    state.settingsQuery.isPending = true;
+
+    render(<AutomationsSettings />);
+
+    expect(
+      screen
+        .getByTestId('custom-automations-skeleton')
+        .querySelectorAll('[data-slot="skeleton"]'),
+    ).toHaveLength(6);
+    expect(
+      screen
+        .getByTestId('built-in-automations-skeleton')
+        .querySelectorAll('[data-slot="skeleton"]'),
+    ).toHaveLength(17);
+  });
+
   it('uses plain text empty states for built-in and custom automations', async () => {
     state.settingsQuery.data.settings.channelAutoStartSlackChannels = [];
     state.settingsQuery.data.settings.managerSlackChannelId = null as never;
@@ -857,6 +907,17 @@ describe('AutomationsSettings', () => {
     expect(
       await screen.findByRole('dialog', { name: 'Edit custom automation' }),
     ).toBeInTheDocument();
+    expect(screen.getByText('Schedule')).toBeInTheDocument();
+    expect(screen.getByText('Destination')).toBeInTheDocument();
+    expect(screen.getByText('Channel')).toBeInTheDocument();
+    expect(screen.queryByText('Cadence')).not.toBeInTheDocument();
+    expect(screen.queryByText('Frequency')).not.toBeInTheDocument();
+    expect(screen.queryByText('Destination provider')).not.toBeInTheDocument();
+    expect(
+      screen.queryByText(
+        'Configure what runs, when it runs, and where the result is sent.',
+      ),
+    ).not.toBeInTheDocument();
   });
 
   it('reflects the reviewer all-author setting in the review scope copy', async () => {
diff --git a/apps/web/src/components/settings/automations/AutomationsSettings.tsx b/apps/web/src/components/settings/automations/AutomationsSettings.tsx
index da31d3ca0..e054eff12 100644
--- a/apps/web/src/components/settings/automations/AutomationsSettings.tsx
+++ b/apps/web/src/components/settings/automations/AutomationsSettings.tsx
@@ -95,6 +95,7 @@ import {
   Play,
   Plus,
   RefreshCcw,
+  Search,
   Select,
   SelectContent,
   SelectItem,
@@ -111,6 +112,7 @@ import {
   Textarea,
   TriangleAlert,
   Users,
+  X,
 } from '@/components/system';
 
 type FieldErrors = Partial<
@@ -228,12 +230,26 @@ type AutomationDefinition = {
   label: string;
   description: string;
   icon: ComponentType<{ className?: string }>;
+  category: AutomationCategory;
+  searchTerms?: string[];
   /** Compact label for the chat surfaces the automation can report to. */
   commsBadge?: string;
   /** Compact label for the source-control providers the automation supports. */
   scmBadge?: string;
 };
 
+type AutomationCategory = 'source-code' | 'communication' | 'operations';
+
+const AUTOMATION_CATEGORY_OPTIONS: Array<{
+  value: AutomationCategory | 'all';
+  label: string;
+}> = [
+  { value: 'all', label: 'All' },
+  { value: 'source-code', label: 'Source code' },
+  { value: 'communication', label: 'Communication' },
+  { value: 'operations', label: 'Operations' },
+];
+
 /**
  * Where an automation's next run will report, as resolved server-side through
  * the destination waterfall (own target -> Manager Channel -> primary
@@ -335,12 +351,12 @@ const TRIGGERABLE_AUTOMATION_SCHEDULE_LABELS = {
  */
 function getAutomationCapabilityBadges(
   automationKey: BackgroundAutomationKey,
-): Pick<AutomationDefinition, 'commsBadge' | 'scmBadge'> {
+): Pick<AutomationDefinition, 'commsBadge' | 'scmBadge' | 'searchTerms'> {
   const descriptor =
     getTriggerableBackgroundAutomationDescriptorByKey(automationKey);
 
   if (!descriptor) {
-    return {};
+    return { searchTerms: [] };
   }
 
   const comms: readonly CommunicationProvider[] =
@@ -364,6 +380,10 @@ function getAutomationCapabilityBadges(
     : undefined;
 
   return {
+    searchTerms: [
+      ...comms.map(getCommunicationProviderDisplayName),
+      ...scm.map(getSourceControlProviderLabel),
+    ],
     ...(commsBadge ? { commsBadge } : {}),
     ...(scmBadge ? { scmBadge } : {}),
   };
@@ -386,6 +406,7 @@ function getAutomationDefinition(
     label: descriptor.label,
     description: TRIGGERABLE_AUTOMATION_DESCRIPTIONS[automationKey],
     icon,
+    category: automationKey === 'sentry_triage' ? 'operations' : 'source-code',
     ...getAutomationCapabilityBadges(automationKey),
   };
 }
@@ -450,6 +471,7 @@ const SCHEDULE_ONLY_AUTOMATION_DEFINITIONS = Object.fromEntries(
       description:
         SCHEDULE_ONLY_AUTOMATION_UI_DEFINITIONS[automation.id].description,
       icon: SCHEDULE_ONLY_AUTOMATION_UI_DEFINITIONS[automation.id].icon,
+      category: 'source-code',
       ...getAutomationCapabilityBadges(automation.automationKey),
     },
   ]),
@@ -475,6 +497,8 @@ const AUTOMATION_DEFINITIONS: Record<AutomationId, AutomationDefinition> = {
     description:
       'Start tasks from selected Slack or Discord channels, each with its own custom instructions.',
     icon: MessagesSquare,
+    category: 'communication',
+    searchTerms: ['Slack', 'Discord'],
   },
   managerChannel: {
     id: 'managerChannel',
@@ -482,6 +506,8 @@ const AUTOMATION_DEFINITIONS: Record<AutomationId, AutomationDefinition> = {
     description:
       'Shared Slack or Discord channel for manager-facing Roomote asks, summaries, and alerts.',
     icon: Users,
+    category: 'communication',
+    searchTerms: ['Slack', 'Discord'],
   },
   managerStats: {
     ...getAutomationDefinition(
@@ -489,6 +515,7 @@ const AUTOMATION_DEFINITIONS: Record<AutomationId, AutomationDefinition> = {
       'manager_stats',
       ChartColumnIncreasing,
     ),
+    category: 'communication',
   },
   sentryTriage: {
     ...getAutomationDefinition('sentryTriage', 'sentry_triage', SentryIcon),
@@ -509,6 +536,8 @@ const AUTOMATION_DEFINITIONS: Record<AutomationId, AutomationDefinition> = {
     label: 'Review Code',
     description: `Review PRs automatically and on-demand.`,
     icon: GitPullRequest,
+    category: 'source-code',
+    searchTerms: sourceControlProviders.map(getSourceControlProviderLabel),
   },
   conflictResolver: {
     ...getAutomationDefinition(
@@ -519,9 +548,11 @@ const AUTOMATION_DEFINITIONS: Record<AutomationId, AutomationDefinition> = {
   },
   suggester: {
     ...getAutomationDefinition('suggester', 'suggester', Lightbulb),
+    category: 'communication',
   },
   announcer: {
     ...getAutomationDefinition('announcer', 'announcer', Megaphone),
+    category: 'communication',
   },
   platformIssueAlerts: {
     id: 'platformIssueAlerts',
@@ -529,6 +560,8 @@ const AUTOMATION_DEFINITIONS: Record<AutomationId, AutomationDefinition> = {
     description:
       'Alert on Slack or Discord when a task runs into admin-fixable issues.',
     icon: BellElectric,
+    category: 'operations',
+    searchTerms: ['Slack', 'Discord'],
   },
 };
 
@@ -1176,8 +1209,12 @@ function shouldShowChannelAutoStartWarning(params: {
 
 function LoadingSkeleton() {
   return (
-    <div className="space-y-4">
-      {Array.from({ length: 6 }).map((_, index) => (
+    <div
+      className="grid gap-4 md:grid-cols-2"
+      data-testid="built-in-automations-skeleton"
+    >
+      <Skeleton className="col-span-full h-5 w-20" />
+      {Array.from({ length: 4 }).map((_, index) => (
         <Card key={index} className="gap-0 overflow-hidden py-4">
           <CardHeader className="p-0">
             <div className="flex items-start gap-3">
@@ -1434,6 +1471,7 @@ function AutomationCard({
   isOpen,
   onOpenChange,
   iconEnabled,
+  isAvailableMatch = true,
   runAction,
   debugSection,
   footer,
@@ -1445,6 +1483,7 @@ function AutomationCard({
   isOpen: boolean;
   onOpenChange: (open: boolean) => void;
   iconEnabled: boolean;
+  isAvailableMatch?: boolean;
   runAction?: React.ReactNode;
   debugSection?: React.ReactNode;
   footer?: React.ReactNode;
@@ -1458,6 +1497,10 @@ function AutomationCard({
     ? `Configure ${automation.label}`
     : `Set up ${automation.label}`;
 
+  if (!iconEnabled && !isAvailableMatch) {
+    return null;
+  }
+
   return (
     <div
       id={automation.id}
@@ -1535,6 +1578,7 @@ function ScheduledAutomationCard<TFrequency extends string>({
   isOpen,
   onOpenChange,
   iconEnabled,
+  isAvailableMatch,
   disabled = false,
   debugSection,
   runTooltip,
@@ -1556,6 +1600,7 @@ function ScheduledAutomationCard<TFrequency extends string>({
   isOpen: boolean;
   onOpenChange: (open: boolean) => void;
   iconEnabled: boolean;
+  isAvailableMatch: boolean;
   disabled?: boolean;
   debugSection?: React.ReactNode;
   runTooltip: string;
@@ -1579,6 +1624,7 @@ function ScheduledAutomationCard<TFrequency extends string>({
       isOpen={isOpen}
       onOpenChange={onOpenChange}
       iconEnabled={iconEnabled}
+      isAvailableMatch={isAvailableMatch}
       disabled={disabled}
       debugSection={debugSection}
       runAction={
@@ -1655,6 +1701,10 @@ export function AutomationsSettings() {
   const [isEditingManagerChannel, setIsEditingManagerChannel] = useState(false);
   const [isEnteringCustomManagerChannel, setIsEnteringCustomManagerChannel] =
     useState(false);
+  const [availableCategory, setAvailableCategory] = useState<
+    AutomationCategory | 'all'
+  >('all');
+  const [availableSearch, setAvailableSearch] = useState('');
   const formStateRef = useRef<FormState | null>(null);
   const savedStateRef = useRef<FormState | null>(null);
   const didApplyInitialHashRef = useRef(false);
@@ -2539,6 +2589,28 @@ export function AutomationsSettings() {
     announcer: announcerIsEnabled,
     platformIssueAlerts: isPlatformIssueAlertsEnabled(formState),
   } satisfies Record<AutomationId, boolean>;
+  const normalizedAvailableSearch = availableSearch.trim().toLowerCase();
+  const availableAutomationMatches = new Set(
+    Object.values(AUTOMATION_DEFINITIONS)
+      .filter(
+        (automation) =>
+          !iconEnabled[automation.id] &&
+          (availableCategory === 'all' ||
+            automation.category === availableCategory) &&
+          (!normalizedAvailableSearch ||
+            [
+              automation.label,
+              automation.description,
+              ...(automation.searchTerms ?? []),
+            ]
+              .join(' ')
+              .toLowerCase()
+              .includes(normalizedAvailableSearch)),
+      )
+      .map((automation) => automation.id),
+  );
+  const hasAvailableFilters =
+    availableCategory !== 'all' || Boolean(normalizedAvailableSearch);
 
   const isAutomationSaving = (automationId: AutomationId) =>
     updateMutation.isPending && savingAutomation === automationId;
@@ -2652,6 +2724,8 @@ export function AutomationsSettings() {
         </Alert>
       ) : null}
 
+      <CustomAutomationsSection />
+
       {settingsQuery.isPending || !formState ? (
         <LoadingSkeleton />
       ) : (
@@ -2665,11 +2739,71 @@ export function AutomationsSettings() {
                 No built-in automations enabled yet.
               </p>
             )}
-            <h2 className="order-[-10] col-span-full text-sm font-semibold text-foreground">
-              Available
-            </h2>
+            <div className="order-[-10] col-span-full flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between">
+              <h2 className="text-sm font-semibold text-foreground">
+                Available
+              </h2>
+              <div className="flex flex-wrap items-center gap-2">
+                <Select
+                  value={availableCategory}
+                  onValueChange={(value) =>
+                    setAvailableCategory(value as AutomationCategory | 'all')
+                  }
+                >
+                  <SelectTrigger
+                    size="sm"
+                    aria-label="Filter available automations by category"
+                    className="w-36"
+                  >
+                    <SelectValue />
+                  </SelectTrigger>
+                  <SelectContent>
+                    {AUTOMATION_CATEGORY_OPTIONS.map((option) => (
+                      <SelectItem key={option.value} value={option.value}>
+                        {option.label}
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+                <div className="relative">
+                  <Search className="pointer-events-none absolute left-2.5 top-1/2 size-3.5 -translate-y-1/2 text-muted-foreground" />
+                  <Input
+                    value={availableSearch}
+                    onChange={(event) =>
+                      setAvailableSearch(event.currentTarget.value)
+                    }
+                    placeholder="Search"
+                    aria-label="Search available automations"
+                    className="h-8 w-36 pl-8 text-sm"
+                  />
+                </div>
+                {hasAvailableFilters ? (
+                  <BasicTooltip content="Clear filters">
+                    <Button
+                      type="button"
+                      size="icon"
+                      className="size-8"
+                      variant="ghost"
+                      aria-label="Clear automation filters"
+                      onClick={() => {
+                        setAvailableCategory('all');
+                        setAvailableSearch('');
+                      }}
+                    >
+                      <X />
+                    </Button>
+                  </BasicTooltip>
+                ) : null}
+              </div>
+            </div>
+            {availableAutomationMatches.size === 0 ? (
+              <p className="order-0 col-span-full text-sm text-muted-foreground">
+                No available automations match these filters.
+              </p>
+            ) : null}
             <AutomationCard
               automation={AUTOMATION_DEFINITIONS.reviewer}
+              isAvailableMatch={availableAutomationMatches.has('reviewer')}
               isOpen={openAutomationIds.has('reviewer')}
               onOpenChange={(open) => setAutomationOpen('reviewer', open)}
               iconEnabled={iconEnabled.reviewer}
@@ -2818,6 +2952,9 @@ export function AutomationsSettings() {
                 <AutomationCard
                   key={automation.id}
                   automation={AUTOMATION_DEFINITIONS[automation.id]}
+                  isAvailableMatch={availableAutomationMatches.has(
+                    automation.id,
+                  )}
                   isOpen={openAutomationIds.has(automation.id)}
                   onOpenChange={(open) =>
                     setAutomationOpen(automation.id, open)
@@ -2894,6 +3031,9 @@ export function AutomationsSettings() {
 
             <AutomationCard
               automation={AUTOMATION_DEFINITIONS.conflictResolver}
+              isAvailableMatch={availableAutomationMatches.has(
+                'conflictResolver',
+              )}
               isOpen={openAutomationIds.has('conflictResolver')}
               onOpenChange={(open) =>
                 setAutomationOpen('conflictResolver', open)
@@ -3100,6 +3240,9 @@ export function AutomationsSettings() {
                 <AutomationCard
                   key={automation.id}
                   automation={AUTOMATION_DEFINITIONS[automation.id]}
+                  isAvailableMatch={availableAutomationMatches.has(
+                    automation.id,
+                  )}
                   isOpen={openAutomationIds.has(automation.id)}
                   onOpenChange={(open) =>
                     setAutomationOpen(automation.id, open)
@@ -3212,6 +3355,9 @@ export function AutomationsSettings() {
 
             <ScheduledAutomationCard
               automation={AUTOMATION_DEFINITIONS.dependabotTriage}
+              isAvailableMatch={availableAutomationMatches.has(
+                'dependabotTriage',
+              )}
               isOpen={openAutomationIds.has('dependabotTriage')}
               onOpenChange={(open) =>
                 setAutomationOpen('dependabotTriage', open)
@@ -3287,6 +3433,7 @@ export function AutomationsSettings() {
 
             <ScheduledAutomationCard
               automation={AUTOMATION_DEFINITIONS.codeqlTriage}
+              isAvailableMatch={availableAutomationMatches.has('codeqlTriage')}
               isOpen={openAutomationIds.has('codeqlTriage')}
               onOpenChange={(open) => setAutomationOpen('codeqlTriage', open)}
               iconEnabled={iconEnabled.codeqlTriage}
@@ -3377,6 +3524,9 @@ export function AutomationsSettings() {
                 <AutomationCard
                   key={automation.id}
                   automation={AUTOMATION_DEFINITIONS[automation.id]}
+                  isAvailableMatch={availableAutomationMatches.has(
+                    automation.id,
+                  )}
                   isOpen={openAutomationIds.has(automation.id)}
                   onOpenChange={(open) =>
                     setAutomationOpen(automation.id, open)
@@ -3487,10 +3637,11 @@ export function AutomationsSettings() {
               );
             })}
 
-            <CustomAutomationsSection />
-
             <AutomationCard
               automation={AUTOMATION_DEFINITIONS.channelAutoStart}
+              isAvailableMatch={availableAutomationMatches.has(
+                'channelAutoStart',
+              )}
               isOpen={openAutomationIds.has('channelAutoStart')}
               onOpenChange={(open) =>
                 setAutomationOpen('channelAutoStart', open)
@@ -3546,6 +3697,9 @@ export function AutomationsSettings() {
 
             <AutomationCard
               automation={AUTOMATION_DEFINITIONS.managerChannel}
+              isAvailableMatch={availableAutomationMatches.has(
+                'managerChannel',
+              )}
               isOpen={openAutomationIds.has('managerChannel')}
               onOpenChange={(open) => setAutomationOpen('managerChannel', open)}
               iconEnabled={iconEnabled.managerChannel}
@@ -3814,6 +3968,7 @@ export function AutomationsSettings() {
 
             <AutomationCard
               automation={AUTOMATION_DEFINITIONS.managerStats}
+              isAvailableMatch={availableAutomationMatches.has('managerStats')}
               isOpen={openAutomationIds.has('managerStats')}
               onOpenChange={(open) => setAutomationOpen('managerStats', open)}
               iconEnabled={iconEnabled.managerStats}
@@ -3826,7 +3981,9 @@ export function AutomationsSettings() {
                     variant="ghost"
                     size="icon"
                     onClick={() =>
-                      triggerMutation.mutate({ automationKey: 'manager_stats' })
+                      triggerMutation.mutate({
+                        automationKey: 'manager_stats',
+                      })
                     }
                     disabled={isRunDisabled(
                       'managerStats',
@@ -3898,6 +4055,7 @@ export function AutomationsSettings() {
 
             <AutomationCard
               automation={AUTOMATION_DEFINITIONS.sentryTriage}
+              isAvailableMatch={availableAutomationMatches.has('sentryTriage')}
               isOpen={openAutomationIds.has('sentryTriage')}
               onOpenChange={(open) => setAutomationOpen('sentryTriage', open)}
               iconEnabled={iconEnabled.sentryTriage}
@@ -3914,7 +4072,9 @@ export function AutomationsSettings() {
                     variant="ghost"
                     size="icon"
                     onClick={() =>
-                      triggerMutation.mutate({ automationKey: 'sentry_triage' })
+                      triggerMutation.mutate({
+                        automationKey: 'sentry_triage',
+                      })
                     }
                     disabled={isRunDisabled(
                       'sentryTriage',
@@ -4074,6 +4234,7 @@ export function AutomationsSettings() {
 
             <AutomationCard
               automation={AUTOMATION_DEFINITIONS.suggester}
+              isAvailableMatch={availableAutomationMatches.has('suggester')}
               isOpen={openAutomationIds.has('suggester')}
               onOpenChange={(open) => setAutomationOpen('suggester', open)}
               iconEnabled={iconEnabled.suggester}
@@ -4197,6 +4358,7 @@ export function AutomationsSettings() {
 
             <AutomationCard
               automation={AUTOMATION_DEFINITIONS.announcer}
+              isAvailableMatch={availableAutomationMatches.has('announcer')}
               isOpen={openAutomationIds.has('announcer')}
               onOpenChange={(open) => setAutomationOpen('announcer', open)}
               iconEnabled={iconEnabled.announcer}
@@ -4310,6 +4472,9 @@ export function AutomationsSettings() {
 
             <AutomationCard
               automation={AUTOMATION_DEFINITIONS.platformIssueAlerts}
+              isAvailableMatch={availableAutomationMatches.has(
+                'platformIssueAlerts',
+              )}
               isOpen={openAutomationIds.has('platformIssueAlerts')}
               onOpenChange={(open) =>
                 setAutomationOpen('platformIssueAlerts', open)
diff --git a/apps/web/src/components/settings/automations/CustomAutomationsSection.tsx b/apps/web/src/components/settings/automations/CustomAutomationsSection.tsx
index a4673d6ff..e23fff447 100644
--- a/apps/web/src/components/settings/automations/CustomAutomationsSection.tsx
+++ b/apps/web/src/components/settings/automations/CustomAutomationsSection.tsx
@@ -20,7 +20,6 @@ import {
   CardContent,
   Dialog,
   DialogContent,
-  DialogDescription,
   DialogHeader,
   DialogTitle,
   Input,
@@ -31,7 +30,8 @@ import {
   SelectItem,
   SelectTrigger,
   SelectValue,
-  SlidersHorizontal,
+  Settings2,
+  Skeleton,
   Switch,
   Textarea,
   Trash2,
@@ -440,14 +440,11 @@ export function CustomAutomationsSection() {
   };
 
   const renderEditor = () => (
-    <DialogContent size="lg">
+    <DialogContent size="4xl" aria-describedby={undefined}>
       <DialogHeader>
         <DialogTitle>
           {editingId ? 'Edit custom automation' : 'New custom automation'}
         </DialogTitle>
-        <DialogDescription>
-          Configure what runs, when it runs, and where the result is sent.
-        </DialogDescription>
       </DialogHeader>
       <div className="space-y-4">
         <div className="space-y-2">
@@ -482,9 +479,9 @@ export function CustomAutomationsSection() {
           />
         </div>
 
-        <div className="grid gap-4 sm:grid-cols-2">
-          <div className="space-y-2">
-            <Label>Cadence</Label>
+        <div className="space-y-2">
+          <Label htmlFor="custom-automation-schedule">Schedule</Label>
+          <div className="flex flex-col gap-2 sm:flex-row">
             <Select
               value={form.scheduleMode}
               disabled={busy}
@@ -497,7 +494,10 @@ export function CustomAutomationsSection() {
                 }));
               }}
             >
-              <SelectTrigger>
+              <SelectTrigger
+                id="custom-automation-schedule"
+                className="w-full sm:w-52"
+              >
                 <SelectValue />
               </SelectTrigger>
               <SelectContent>
@@ -508,13 +508,12 @@ export function CustomAutomationsSection() {
                 ))}
               </SelectContent>
             </Select>
-          </div>
 
-          {form.scheduleMode === 'cron' ? (
-            <div className="space-y-2">
-              <Label htmlFor="custom-automation-cron">Custom schedule</Label>
+            {form.scheduleMode === 'cron' ? (
               <Input
                 id="custom-automation-cron"
+                aria-label="Custom schedule"
+                className="flex-1"
                 value={form.cronExpression}
                 disabled={busy}
                 placeholder="Weekdays at 9am or 0 9 * * 1-5"
@@ -543,22 +542,22 @@ export function CustomAutomationsSection() {
                   }
                 }}
               />
-              {resolveScheduleMutation.isPending ? (
-                <p className="text-sm text-muted-foreground">
-                  Interpreting schedule...
-                </p>
-              ) : effectiveScheduleSummary ? (
-                <p className="text-sm text-muted-foreground">
-                  {effectiveScheduleSummary}
-                </p>
-              ) : null}
-            </div>
+            ) : null}
+          </div>
+          {resolveScheduleMutation.isPending ? (
+            <p className="text-sm text-muted-foreground">
+              Interpreting schedule...
+            </p>
+          ) : effectiveScheduleSummary ? (
+            <p className="text-sm text-muted-foreground">
+              {effectiveScheduleSummary}
+            </p>
           ) : null}
         </div>
 
-        <div className="grid gap-4 sm:grid-cols-2">
-          <div className="space-y-2">
-            <Label>Environment</Label>
+        <div className="flex flex-col gap-4 sm:flex-row">
+          <div className="space-y-2 sm:w-52">
+            <Label htmlFor="custom-automation-environment">Environment</Label>
             <Select
               value={form.environmentId || undefined}
               disabled={busy || environmentOptions.length === 0}
@@ -569,7 +568,10 @@ export function CustomAutomationsSection() {
                 }))
               }
             >
-              <SelectTrigger>
+              <SelectTrigger
+                id="custom-automation-environment"
+                className="w-full"
+              >
                 <SelectValue placeholder="Select environment" />
               </SelectTrigger>
               <SelectContent>
@@ -585,7 +587,6 @@ export function CustomAutomationsSection() {
           <div className="space-y-2">
             <Label>Model</Label>
             <ModelSelect
-              className="w-full"
               size="default"
               ariaLabel="Automation model"
               value={form.model}
@@ -598,9 +599,9 @@ export function CustomAutomationsSection() {
           </div>
         </div>
 
-        <div className="grid gap-4 sm:grid-cols-2">
-          <div className="space-y-2">
-            <Label>Destination provider</Label>
+        <div className="space-y-2">
+          <Label htmlFor="custom-automation-destination">Destination</Label>
+          <div className="flex flex-col gap-2 sm:flex-row">
             <Select
               value={form.targetProvider}
               disabled={busy}
@@ -619,7 +620,11 @@ export function CustomAutomationsSection() {
                 }))
               }
             >
-              <SelectTrigger>
+              <SelectTrigger
+                id="custom-automation-destination"
+                aria-label="Destination provider"
+                className="w-full sm:w-52"
+              >
                 <SelectValue />
               </SelectTrigger>
               <SelectContent>
@@ -630,20 +635,22 @@ export function CustomAutomationsSection() {
                 <SelectItem value="telegram">Telegram</SelectItem>
               </SelectContent>
             </Select>
-          </div>
 
-          {form.targetProvider === 'none' ? (
-            <div className="space-y-2">
-              <Label>Destination channel</Label>
-              <p className="pt-2 text-sm text-muted-foreground">
+            {form.targetProvider === 'none' ? (
+              <p className="self-center text-sm text-muted-foreground">
                 Results appear only in the task view.
               </p>
-            </div>
-          ) : (
-            <div className="space-y-2">
-              <Label>Destination channel</Label>
-              {form.targetProvider === 'slack' ? (
+            ) : form.targetProvider === 'slack' ? (
+              <div className="flex min-w-0 flex-1 items-center gap-2">
+                <Label
+                  htmlFor="custom-automation-destination-channel"
+                  className="shrink-0"
+                >
+                  Channel
+                </Label>
                 <SlackChannelSelect
+                  id="custom-automation-destination-channel"
+                  className="flex-1"
                   value={form.targetChannelId || null}
                   options={slackOptions}
                   disabled={busy}
@@ -654,7 +661,10 @@ export function CustomAutomationsSection() {
                     }))
                   }
                 />
-              ) : form.targetProvider === 'discord' ? (
+              </div>
+            ) : form.targetProvider === 'discord' ? (
+              <div className="flex min-w-0 flex-1 items-center gap-2">
+                <Label className="shrink-0">Channel</Label>
                 <Select
                   value={form.targetChannelId || undefined}
                   disabled={busy}
@@ -665,7 +675,10 @@ export function CustomAutomationsSection() {
                     }))
                   }
                 >
-                  <SelectTrigger>
+                  <SelectTrigger
+                    aria-label="Destination channel"
+                    className="flex-1"
+                  >
                     <SelectValue placeholder="Select Discord channel" />
                   </SelectTrigger>
                   <SelectContent>
@@ -676,8 +689,13 @@ export function CustomAutomationsSection() {
                     ))}
                   </SelectContent>
                 </Select>
-              ) : (
+              </div>
+            ) : (
+              <div className="flex min-w-0 flex-1 items-center gap-2">
+                <Label className="shrink-0">Channel</Label>
                 <Input
+                  aria-label="Destination channel"
+                  className="flex-1"
                   value={form.targetChannelId}
                   disabled={busy}
                   onChange={(event) =>
@@ -692,30 +710,33 @@ export function CustomAutomationsSection() {
                       : 'Telegram chat ID'
                   }
                 />
-              )}
-            </div>
-          )}
-        </div>
-
-        {form.targetProvider === 'teams' ? (
-          <div className="space-y-2">
-            <Label htmlFor="custom-automation-service-url">
-              Teams service URL (optional)
-            </Label>
-            <Input
-              id="custom-automation-service-url"
-              value={form.targetServiceUrl}
-              disabled={busy}
-              onChange={(event) =>
-                setForm((current) => ({
-                  ...current,
-                  targetServiceUrl: event.target.value,
-                }))
-              }
-              placeholder="https://smba.trafficmanager.net/..."
-            />
+              </div>
+            )}
+            {form.targetProvider === 'teams' ? (
+              <div className="flex min-w-0 flex-1 items-center gap-2">
+                <Label
+                  htmlFor="custom-automation-service-url"
+                  className="shrink-0"
+                >
+                  Service URL
+                </Label>
+                <Input
+                  id="custom-automation-service-url"
+                  className="flex-1"
+                  value={form.targetServiceUrl}
+                  disabled={busy}
+                  onChange={(event) =>
+                    setForm((current) => ({
+                      ...current,
+                      targetServiceUrl: event.target.value,
+                    }))
+                  }
+                  placeholder="Optional"
+                />
+              </div>
+            ) : null}
           </div>
-        ) : null}
+        </div>
 
         <div className="flex items-center justify-between gap-3">
           <div className="flex items-center gap-2">
@@ -747,10 +768,7 @@ export function CustomAutomationsSection() {
   );
 
   return (
-    <section
-      className="order-[-40] col-span-full space-y-3"
-      aria-labelledby="custom-automations-heading"
-    >
+    <section className="space-y-3" aria-labelledby="custom-automations-heading">
       <div className="flex items-start justify-between gap-3 pt-2">
         <div className="space-y-1">
           <h2
@@ -760,7 +778,7 @@ export function CustomAutomationsSection() {
             Custom
           </h2>
           <p className="text-sm text-muted-foreground">
-            Create your own scheduled agent runs with a prompt, cadence,
+            Create your own scheduled agent runs with a prompt, frequency,
             environment, and optional report channel.
           </p>
         </div>
@@ -801,9 +819,24 @@ export function CustomAutomationsSection() {
       </Dialog>
 
       {listQuery.isPending ? (
-        <p className="text-sm text-muted-foreground">
-          Loading custom automations…
-        </p>
+        <Card variant="snug" data-testid="custom-automations-skeleton">
+          <CardContent>
+            <div className="divide-y divide-background">
+              {Array.from({ length: 2 }).map((_, index) => (
+                <div
+                  key={index}
+                  className="flex items-start gap-3 py-3 first:pt-0 last:pb-0"
+                >
+                  <Skeleton className="mt-0.5 h-5 w-9 rounded-full" />
+                  <div className="flex-1 space-y-2">
+                    <Skeleton className="h-4 w-48" />
+                    <Skeleton className="h-3 w-full max-w-lg" />
+                  </div>
+                </div>
+              ))}
+            </div>
+          </CardContent>
+        </Card>
       ) : rows.length === 0 && !isCreating ? (
         <p className="text-sm text-muted-foreground">
           No custom automations created yet.
@@ -836,37 +869,35 @@ export function CustomAutomationsSection() {
                 return (
                   <div
                     key={row.id}
-                    className="flex flex-col gap-3 py-3 first:pt-0 last:pb-0 sm:flex-row sm:items-start sm:justify-between"
+                    className="grid grid-cols-[1fr_auto] gap-3 py-3 first:pt-0 last:pb-0 sm:grid-cols-[auto_1fr_auto] sm:items-start"
                   >
-                    <div className="flex min-w-0 items-start gap-3">
-                      <Switch
-                        aria-label={`Toggle ${row.name}`}
-                        checked={row.enabled}
-                        disabled={busy}
-                        className="mt-0.5"
-                        onCheckedChange={(enabled) =>
-                          toggleMutation.mutate({
-                            id: row.id,
-                            ...writeInputFromRow(row),
-                            enabled,
-                          })
-                        }
-                      />
-                      <div className="min-w-0 space-y-1">
-                        <p className="text-sm font-semibold">{row.name}</p>
-                        <p className="text-xs text-muted-foreground">
-                          {row.scheduleMode === 'cron'
-                            ? row.cronExpression
-                            : scheduleLabel(row.scheduleMode)}{' '}
-                          · {environmentName} ·{' '}
-                          {target.provider === 'none'
-                            ? destinationLabel
-                            : `${target.provider}:${destinationLabel}`}{' '}
-                          · Created by {row.createdByName ?? 'Unknown'}
-                        </p>
-                      </div>
+                    <Switch
+                      aria-label={`Toggle ${row.name}`}
+                      checked={row.enabled}
+                      disabled={busy}
+                      className="col-start-1 row-start-2 mt-0.5 sm:row-start-1"
+                      onCheckedChange={(enabled) =>
+                        toggleMutation.mutate({
+                          id: row.id,
+                          ...writeInputFromRow(row),
+                          enabled,
+                        })
+                      }
+                    />
+                    <div className="col-span-2 row-start-1 min-w-0 space-y-1 sm:col-span-1 sm:col-start-2">
+                      <p className="text-sm font-semibold">{row.name}</p>
+                      <p className="text-xs text-muted-foreground">
+                        {row.scheduleMode === 'cron'
+                          ? row.cronExpression
+                          : scheduleLabel(row.scheduleMode)}{' '}
+                        · {environmentName} ·{' '}
+                        {target.provider === 'none'
+                          ? destinationLabel
+                          : `${target.provider}:${destinationLabel}`}{' '}
+                        · Created by {row.createdByName ?? 'Unknown'}
+                      </p>
                     </div>
-                    <div className="flex shrink-0 items-center gap-1 self-end sm:self-auto">
+                    <div className="col-start-2 row-start-2 flex shrink-0 items-center gap-1 sm:col-start-3 sm:row-start-1">
                       <BasicTooltip content="Configure">
                         <Button
                           type="button"
@@ -876,7 +907,7 @@ export function CustomAutomationsSection() {
                           aria-label={`Configure ${row.name}`}
                           onClick={() => editAutomation(row)}
                         >
-                          <SlidersHorizontal />
+                          <Settings2 />
                         </Button>
                       </BasicTooltip>
                       <BasicTooltip content="Delete">
diff --git a/apps/web/src/components/system/primitives/icons.ts b/apps/web/src/components/system/primitives/icons.ts
index 9ee447ac7..bac8767c1 100644
--- a/apps/web/src/components/system/primitives/icons.ts
+++ b/apps/web/src/components/system/primitives/icons.ts
@@ -169,7 +169,6 @@ export {
   Shapes,
   Slack,
   Slash,
-  SlidersHorizontal,
   Sparkles,
   Square,
   SquareArrowOutUpRight,

From 4e1c966e75f443451e55552ac3bb43fe5b507c66 Mon Sep 17 00:00:00 2001
From: tebieshi <197311053+tebieshi@users.noreply.github.com>
Date: Mon, 3 Aug 2026 13:02:48 -0400
Subject: [PATCH 18/24] [Fix] ACA Sandboxes wake-loop fix and improved suspend
 state management (#1018)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .../aca-sandboxes-sleep-wake-remediation.md   |   5 +
 apps/bullmq/src/jobs/snapshot.test.ts         |   2 +-
 .../__tests__/sleep-check.test.ts             | 119 ++++++++-
 .../__tests__/standby-retention.test.ts       | 233 ++++++++++++++++++
 apps/bullmq/src/scheduled-jobs/sleep-check.ts |  67 +++++
 .../src/scheduled-jobs/standby-retention.ts   | 120 ++++++++-
 .../compute-providers/spawn-azure-worker.ts   |  23 ++
 .../run-task/polling/worker-heartbeat.test.ts |  30 +++
 .../src/run-task/polling/worker-heartbeat.ts  |  27 ++
 .../src/__tests__/azure.contract.test.ts      |  92 ++++++-
 .../compute-providers/src/adapters/azure.ts   |  56 ++++-
 11 files changed, 763 insertions(+), 11 deletions(-)
 create mode 100644 .changeset/aca-sandboxes-sleep-wake-remediation.md
 create mode 100644 apps/bullmq/src/scheduled-jobs/__tests__/standby-retention.test.ts

diff --git a/.changeset/aca-sandboxes-sleep-wake-remediation.md b/.changeset/aca-sandboxes-sleep-wake-remediation.md
new file mode 100644
index 000000000..0437ac167
--- /dev/null
+++ b/.changeset/aca-sandboxes-sleep-wake-remediation.md
@@ -0,0 +1,5 @@
+---
+'@roomote/web': patch
+---
+
+Fix an Azure Container Apps Sandboxes sleep/wake loop where waking a suspended task repeatedly died on "waking up" and sandboxes never stayed suspended. Workers revived from a suspended sandbox now terminate themselves once the server reports their run as finalized (instead of idling as zombies holding the sandbox-server port), resume launches reap leftover workers before booting the new one, retained standby sandboxes found Running are re-suspended automatically, runs whose sandboxes were deleted are finalized instead of retried forever, and sandbox ports use Manual activation so inbound traffic no longer wakes sandboxes out-of-band.
diff --git a/apps/bullmq/src/jobs/snapshot.test.ts b/apps/bullmq/src/jobs/snapshot.test.ts
index 198d05f0f..8de73eed4 100644
--- a/apps/bullmq/src/jobs/snapshot.test.ts
+++ b/apps/bullmq/src/jobs/snapshot.test.ts
@@ -33,7 +33,7 @@ const {
   setFn,
   updateFn,
 } = vi.hoisted(() => {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- suppressed for oxlint; ESLint's own rule is offloaded and reports this directive as unused, which is a false positive
   type AnyMock = Mock<(...args: any[]) => any>;
 
   const andFn: AnyMock = vi.fn(() => 'and-condition');
diff --git a/apps/bullmq/src/scheduled-jobs/__tests__/sleep-check.test.ts b/apps/bullmq/src/scheduled-jobs/__tests__/sleep-check.test.ts
index 5e32b0f21..1ec24397c 100644
--- a/apps/bullmq/src/scheduled-jobs/__tests__/sleep-check.test.ts
+++ b/apps/bullmq/src/scheduled-jobs/__tests__/sleep-check.test.ts
@@ -35,14 +35,14 @@ const {
   selectFn,
   inArrayFn,
 } = vi.hoisted(() => {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- suppressed for oxlint; ESLint's own rule is offloaded and reports this directive as unused, which is a false positive
   type AnyMock = Mock<(...args: any[]) => any>;
 
   const returningFn: AnyMock = vi.fn(() => Promise.resolve([]));
   const updateWhereFn: AnyMock = vi.fn(() => {
     const result = Promise.resolve([]);
     // Support both .returning() (optimistic lock) and .catch() (rollback) call patterns.
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- suppressed for oxlint (see above)
     (result as any).returning = returningFn;
     return result;
   });
@@ -109,6 +109,18 @@ vi.mock('@roomote/compute-providers', () => ({
     mockGetComputeProviderCapabilities(...args) ?? {
       supportsSnapshots: true,
     },
+  // Mirrors the real adapter error: sleep-check finalizes runs only on a
+  // definitive 404 from this class.
+  AzureDataPlaneError: class AzureDataPlaneError extends Error {
+    constructor(
+      message: string,
+      public readonly status: number,
+      public readonly code?: string,
+    ) {
+      super(message);
+      this.name = 'AzureDataPlaneError';
+    }
+  },
 }));
 
 vi.mock('@roomote/sdk/server', () => ({
@@ -336,7 +348,7 @@ describe('sleepCheckJob', () => {
     );
     updateWhereFn.mockImplementation(() => {
       const result = Promise.resolve([]);
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- suppressed for oxlint (see above)
       (result as any).returning = returningFn;
       return result;
     });
@@ -894,6 +906,107 @@ describe('sleepCheckJob', () => {
     );
   });
 
+  it('finalizes a run whose azure instance no longer exists instead of retrying forever', async () => {
+    const mockJob = {
+      id: 100,
+      machineId: 'sb-gone',
+      payloadKind: TaskPayloadKind.StandardTask,
+      status: RunStatus.Running,
+      taskPhase: 'waiting_for_prompt',
+      vendor: 'azure',
+      snapshotId: null,
+      sleepRequestedAt: null,
+      snapshotRequestedAt: null,
+      sleepAt: new Date(Date.now() + 30 * 60 * 1_000),
+    };
+
+    mockJobQueries({ hardLimitJobs: [mockJob] });
+    const { AzureDataPlaneError } = await import('@roomote/compute-providers');
+    mockGetInstanceStatus.mockRejectedValue(
+      new AzureDataPlaneError('Requested document not found.', 404),
+    );
+
+    await sleepCheckJob();
+
+    expect(mockGetInstanceStatus).toHaveBeenCalledWith({
+      instanceId: 'sb-gone',
+    });
+    expect(mockFinishRun).toHaveBeenCalledWith({
+      id: 100,
+      status: RunStatus.Failed,
+      error: expect.stringContaining('no longer exists'),
+    });
+    // No claim-clearing rollback: the generic retry path must not run, or
+    // the run would be re-evaluated (and fail identically) every minute.
+    expect(setFn).not.toHaveBeenCalledWith({
+      sleepRequestedAt: null,
+      snapshotRequestedAt: null,
+    });
+    expect(mockDestroyInstance).not.toHaveBeenCalled();
+    expect(mockEnterStandby).not.toHaveBeenCalled();
+  });
+
+  it('completes an idle run whose azure instance no longer exists', async () => {
+    mockJobQueries({
+      dueJobs: [
+        {
+          id: 42,
+          machineId: 'sb-gone-idle',
+          payloadKind: TaskPayloadKind.StandardTask,
+          status: RunStatus.Idle,
+          vendor: 'azure',
+          snapshotId: null,
+          sleepRequestedAt: null,
+          snapshotRequestedAt: null,
+        },
+      ],
+    });
+    const { AzureDataPlaneError } = await import('@roomote/compute-providers');
+    mockGetInstanceStatus.mockRejectedValue(
+      new AzureDataPlaneError('Requested document not found.', 404),
+    );
+    returningFn.mockResolvedValue([{ id: 42 }]);
+
+    await sleepCheckJob();
+
+    expect(mockFinishRun).toHaveBeenCalledWith({
+      id: 42,
+      status: RunStatus.Completed,
+      error: 'Instance sb-gone-idle no longer exists.',
+    });
+    expect(mockEnterStandby).not.toHaveBeenCalled();
+  });
+
+  it('keeps retrying on transient provider errors instead of finalizing', async () => {
+    const mockJob = {
+      id: 101,
+      machineId: 'sb-flaky',
+      payloadKind: TaskPayloadKind.StandardTask,
+      status: RunStatus.Running,
+      taskPhase: 'waiting_for_prompt',
+      vendor: 'azure',
+      snapshotId: null,
+      sleepRequestedAt: null,
+      snapshotRequestedAt: null,
+      sleepAt: new Date(Date.now() + 30 * 60 * 1_000),
+    };
+
+    mockJobQueries({ hardLimitJobs: [mockJob] });
+    const { AzureDataPlaneError } = await import('@roomote/compute-providers');
+    mockGetInstanceStatus.mockRejectedValue(
+      new AzureDataPlaneError('Upstream timeout.', 502),
+    );
+
+    await sleepCheckJob();
+
+    // Transient error: generic catch clears claims so the next tick retries.
+    expect(mockFinishRun).not.toHaveBeenCalled();
+    expect(setFn).toHaveBeenLastCalledWith({
+      sleepRequestedAt: null,
+      snapshotRequestedAt: null,
+    });
+  });
+
   it('skips job when optimistic lock fails', async () => {
     const mockJob = {
       id: 77,
diff --git a/apps/bullmq/src/scheduled-jobs/__tests__/standby-retention.test.ts b/apps/bullmq/src/scheduled-jobs/__tests__/standby-retention.test.ts
new file mode 100644
index 000000000..10e8a7582
--- /dev/null
+++ b/apps/bullmq/src/scheduled-jobs/__tests__/standby-retention.test.ts
@@ -0,0 +1,233 @@
+import type { Mock } from 'vitest';
+
+const {
+  mockCreateComputeProviderClient,
+  mockGetInstanceStatus,
+  mockEnterStandby,
+  mockDestroyInstance,
+  mockResolveComputeProviderEnvValues,
+  selectResultsQueue,
+  selectFn,
+  updateFn,
+} = vi.hoisted(() => {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- suppressed for oxlint; ESLint's own rule is offloaded and reports this directive as unused, which is a false positive
+  type AnyMock = Mock<(...args: any[]) => any>;
+
+  // Each db.select(...) call consumes one entry; entries resolve in call
+  // order. getCandidates chains .orderBy(...), the other queries await the
+  // where-result directly, so both shapes must resolve to the same rows.
+  const selectResultsQueue: { current: unknown[][] } = { current: [] };
+
+  const makeQueryResult = (rows: unknown[]) => {
+    const result = Promise.resolve(rows);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- suppressed for oxlint (see above)
+    (result as any).orderBy = () => Promise.resolve(rows);
+    return result;
+  };
+
+  const whereFn: AnyMock = vi.fn(() =>
+    makeQueryResult(selectResultsQueue.current.shift() ?? []),
+  );
+  const fromFn: AnyMock = vi.fn(() => ({ where: whereFn }));
+  const selectFn: AnyMock = vi.fn(() => ({ from: fromFn }));
+
+  const updateWhereFn: AnyMock = vi.fn(() => Promise.resolve([]));
+  const setFn: AnyMock = vi.fn(() => ({ where: updateWhereFn }));
+  const updateFn: AnyMock = vi.fn(() => ({ set: setFn }));
+
+  return {
+    mockCreateComputeProviderClient: vi.fn() as AnyMock,
+    mockGetInstanceStatus: vi.fn() as AnyMock,
+    mockEnterStandby: vi.fn() as AnyMock,
+    mockDestroyInstance: vi.fn() as AnyMock,
+    mockResolveComputeProviderEnvValues: vi.fn() as AnyMock,
+    selectResultsQueue,
+    selectFn,
+    updateFn,
+  };
+});
+
+vi.mock('@roomote/db/server', () => ({
+  db: {
+    select: selectFn,
+    update: updateFn,
+  },
+  taskRuns: {
+    id: 'id',
+    taskId: 'taskId',
+    vendor: 'vendor',
+    status: 'status',
+    machineId: 'machineId',
+    snapshotId: 'snapshotId',
+    snapshotCreatedAt: 'snapshotCreatedAt',
+    sourceSnapshotId: 'sourceSnapshotId',
+  },
+  and: vi.fn(),
+  desc: vi.fn(),
+  eq: vi.fn(),
+  inArray: vi.fn(),
+  isNotNull: vi.fn(),
+  or: vi.fn(),
+  resolveComputeProviderEnvValues: mockResolveComputeProviderEnvValues,
+}));
+
+vi.mock('@roomote/compute-providers', () => ({
+  createComputeProviderClient: mockCreateComputeProviderClient,
+}));
+
+// Import after mocks are set up.
+import { standbyRetentionJob } from '../standby-retention';
+
+/**
+ * standbyRetentionJob iterates docker, blaxel, azure. Each provider's
+ * eviction pass runs two selects (candidates, protected handles); azure
+ * additionally runs the orphan re-suspend pass (candidates, protected
+ * handles, in-use handles). Queue entries in consumption order.
+ */
+function queueSelectResults({
+  azureReSuspendCandidates = [],
+  azureReSuspendProtected = [],
+  azureReSuspendInUse = [],
+}: {
+  azureReSuspendCandidates?: unknown[];
+  azureReSuspendProtected?: unknown[];
+  azureReSuspendInUse?: unknown[];
+}) {
+  selectResultsQueue.current = [
+    [], // docker eviction candidates
+    [], // docker eviction protected
+    [], // blaxel eviction candidates
+    [], // blaxel eviction protected
+    [], // azure eviction candidates
+    [], // azure eviction protected
+    azureReSuspendCandidates,
+    azureReSuspendProtected,
+    azureReSuspendInUse,
+  ];
+}
+
+describe('standbyRetentionJob orphan re-suspend', () => {
+  let logSpy: ReturnType<typeof vi.spyOn>;
+  let errorSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    selectResultsQueue.current = [];
+    logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+
+    mockResolveComputeProviderEnvValues.mockResolvedValue({});
+    mockCreateComputeProviderClient.mockReturnValue({
+      destroyInstance: mockDestroyInstance,
+      getInstanceStatus: mockGetInstanceStatus,
+      enterStandby: mockEnterStandby,
+    });
+    mockGetInstanceStatus.mockResolvedValue({ status: 'running' });
+    mockEnterStandby.mockResolvedValue({ resumeHandle: 'sb-1' });
+  });
+
+  afterEach(() => {
+    logSpy.mockRestore();
+    errorSpy.mockRestore();
+  });
+
+  it('re-suspends a retained azure standby found Running with no managing run', async () => {
+    queueSelectResults({
+      azureReSuspendCandidates: [
+        {
+          runId: 32,
+          taskId: 'task-1',
+          provider: 'azure',
+          handle: 'sb-1',
+          createdAt: new Date(),
+        },
+      ],
+    });
+
+    await standbyRetentionJob();
+
+    expect(mockGetInstanceStatus).toHaveBeenCalledWith({
+      instanceId: 'sb-1',
+    });
+    expect(mockEnterStandby).toHaveBeenCalledWith({ instanceId: 'sb-1' });
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining('re-suspended orphaned azure standby sb-1'),
+    );
+  });
+
+  it('skips retained handles owned by an active wake session', async () => {
+    queueSelectResults({
+      azureReSuspendCandidates: [
+        {
+          runId: 32,
+          taskId: 'task-1',
+          provider: 'azure',
+          handle: 'sb-1',
+          createdAt: new Date(),
+        },
+      ],
+      azureReSuspendInUse: [{ machineId: 'sb-1', snapshotId: null }],
+    });
+
+    await standbyRetentionJob();
+
+    expect(mockEnterStandby).not.toHaveBeenCalled();
+  });
+
+  it('skips handles protected by an active resume run', async () => {
+    queueSelectResults({
+      azureReSuspendCandidates: [
+        {
+          runId: 32,
+          taskId: 'task-1',
+          provider: 'azure',
+          handle: 'sb-1',
+          createdAt: new Date(),
+        },
+      ],
+      azureReSuspendProtected: [{ handle: 'sb-1' }],
+    });
+
+    await standbyRetentionJob();
+
+    expect(mockEnterStandby).not.toHaveBeenCalled();
+  });
+
+  it('skips handles that are not live instances (genuine snapshot ids)', async () => {
+    queueSelectResults({
+      azureReSuspendCandidates: [
+        {
+          runId: 32,
+          taskId: 'task-1',
+          provider: 'azure',
+          handle: 'snap-1',
+          createdAt: new Date(),
+        },
+      ],
+    });
+    mockGetInstanceStatus.mockRejectedValue(new Error('not found'));
+
+    await standbyRetentionJob();
+
+    expect(mockEnterStandby).not.toHaveBeenCalled();
+  });
+
+  it('does not touch retained instances that are already suspended', async () => {
+    queueSelectResults({
+      azureReSuspendCandidates: [
+        {
+          runId: 32,
+          taskId: 'task-1',
+          provider: 'azure',
+          handle: 'sb-1',
+          createdAt: new Date(),
+        },
+      ],
+    });
+    mockGetInstanceStatus.mockResolvedValue({ status: 'stopped' });
+
+    await standbyRetentionJob();
+
+    expect(mockEnterStandby).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/bullmq/src/scheduled-jobs/sleep-check.ts b/apps/bullmq/src/scheduled-jobs/sleep-check.ts
index 0cec98f68..2f9362d54 100644
--- a/apps/bullmq/src/scheduled-jobs/sleep-check.ts
+++ b/apps/bullmq/src/scheduled-jobs/sleep-check.ts
@@ -31,6 +31,7 @@ import {
   syncTaskStateFromRuns,
 } from '@roomote/db/server';
 import {
+  AzureDataPlaneError,
   createComputeProviderClient,
   type ComputeProviderClient,
 } from '@roomote/compute-providers';
@@ -445,6 +446,16 @@ export const sleepCheckJob = async () => {
         failed += result.failed;
       }
     } catch (error) {
+      if (isInstanceNotFoundError(error)) {
+        // The instance is gone for good — every future evaluation would fail
+        // the same way (observed as an endless hard_limit retry loop on azure
+        // runs whose sandboxes were deleted out-of-band). Finalize the run
+        // instead of retrying forever.
+        failed += 1;
+        await finalizeRunForMissingInstance(preferredJob, fallbackPath);
+        continue;
+      }
+
       await db
         .update(taskRuns)
         .set({
@@ -884,6 +895,62 @@ async function resolveSweptJobFinalStatus(
   return job?.cancelRequestedAt ? RunStatus.Canceled : RunStatus.Failed;
 }
 
+/**
+ * Whether the error definitively means the provider instance no longer
+ * exists (as opposed to a transient API failure). Only definitive not-found
+ * errors may finalize runs; anything else must keep retrying. Azure throws
+ * AzureDataPlaneError 404 for deleted sandboxes; other providers' not-found
+ * shapes can extend this classifier as needed.
+ */
+function isInstanceNotFoundError(error: unknown): boolean {
+  return error instanceof AzureDataPlaneError && error.status === 404;
+}
+
+/**
+ * Finalize a candidate whose provider instance is gone. Mirrors the
+ * not-running branch of the timed/heartbeat handlers: idle runs complete
+ * without a snapshot; anything else fails (or cancels after a stop request).
+ */
+async function finalizeRunForMissingInstance(
+  job: SleepCheckJob,
+  path: SleepCheckPath,
+): Promise<void> {
+  const details = {
+    path,
+    decision: 'instance_not_found',
+    ...buildSleepCheckDetails(job),
+  };
+
+  if (job.status === RunStatus.Idle) {
+    await recordSleepCheckEvent(
+      job,
+      'decision',
+      `${describeSleepCheckPath(path)} found that idle instance ${job.machineId} no longer exists; completing task run #${job.id} without a snapshot.`,
+      details,
+    );
+    await completeIdleJobWithoutSnapshot(
+      job,
+      `Instance ${job.machineId} no longer exists.`,
+      details,
+    );
+    return;
+  }
+
+  const finalStatus = await resolveSweptJobFinalStatus(job.id);
+
+  await recordSleepCheckEvent(
+    job,
+    finalStatus === RunStatus.Canceled ? 'decision' : 'failed',
+    `${describeSleepCheckPath(path)} found that instance ${job.machineId} no longer exists; finalizing task run #${job.id} as ${finalStatus}.`,
+    details,
+  );
+  await finishRun({
+    id: job.id,
+    status: finalStatus,
+    error: `${describeSleepCheckPath(path)} found that instance ${job.machineId} no longer exists`,
+  });
+}
+
 async function handleTimedSleepCandidate(params: {
   job: SleepCheckJob;
   path: 'due_sleep' | 'hard_limit';
diff --git a/apps/bullmq/src/scheduled-jobs/standby-retention.ts b/apps/bullmq/src/scheduled-jobs/standby-retention.ts
index 5f28419b8..ef5b0e470 100644
--- a/apps/bullmq/src/scheduled-jobs/standby-retention.ts
+++ b/apps/bullmq/src/scheduled-jobs/standby-retention.ts
@@ -5,6 +5,7 @@ import {
   eq,
   inArray,
   isNotNull,
+  or,
   resolveComputeProviderEnvValues,
   taskRuns,
 } from '@roomote/db/server';
@@ -15,6 +16,10 @@ const LOG_PREFIX = '[standbyRetention]';
 const MS_PER_HOUR = 60 * 60 * 1_000;
 const STANDBY_PROVIDERS = ['docker', 'blaxel', 'azure'] as const;
 
+// Providers whose retained handles are live instances that can (and must) be
+// re-suspended when found Running with no managing run.
+const RE_SUSPEND_PROVIDERS: readonly StandbyProvider[] = ['azure'];
+
 type StandbyProvider = (typeof STANDBY_PROVIDERS)[number];
 
 type StandbyCandidate = {
@@ -107,6 +112,43 @@ async function createClient(provider: StandbyProvider) {
   });
 }
 
+/**
+ * Handles referenced by any active run — as its machine (a live wake session
+ * owns the sandbox) or as its retained standby handle. Re-suspending one of
+ * these would kill a live session, so the orphan sweep must skip them.
+ */
+async function getInUseHandles(
+  provider: StandbyProvider,
+  handles: string[],
+): Promise<Set<string>> {
+  if (handles.length === 0) return new Set();
+
+  const rows = await db
+    .select({
+      machineId: taskRuns.machineId,
+      snapshotId: taskRuns.snapshotId,
+    })
+    .from(taskRuns)
+    .where(
+      and(
+        eq(taskRuns.vendor, provider),
+        inArray(taskRuns.status, activeRunStatuses as readonly RunStatus[]),
+        or(
+          inArray(taskRuns.machineId, handles),
+          inArray(taskRuns.snapshotId, handles),
+        ),
+      ),
+    );
+
+  return new Set(
+    rows.flatMap((row) =>
+      [row.machineId, row.snapshotId].flatMap((handle) =>
+        handle === null ? [] : [handle],
+      ),
+    ),
+  );
+}
+
 async function getProtectedHandles(provider: StandbyProvider) {
   const rows = await db
     .select({ handle: taskRuns.sourceSnapshotId })
@@ -210,6 +252,76 @@ async function enforceProviderRetention(
   return removed;
 }
 
+/**
+ * Re-suspend retained standby instances found Running. A retained instance
+ * has no living run: its worker token was finalized at suspend time, so any
+ * out-of-band wake (traffic on legacy OnDemand ports, portal actions, a wake
+ * that resumed the sandbox before bootstrap failed) leaves it idling and
+ * billing with no Roomote run to manage it. Sleep-check deliberately
+ * excludes retained runs (its candidacy requires snapshotId IS NULL), so
+ * this sweep is the only re-suspend path.
+ *
+ * Wake-race note: a deliberate wake stamps the resume run's sourceSnapshotId
+ * with the handle at enqueue time, which getProtectedHandles covers, so the
+ * window for stopping a sandbox mid-wake is limited to the wake's own
+ * resume+launch seconds. A lost race fails that wake attempt cleanly and the
+ * user retries; the next sweep re-heals the orphan either way.
+ */
+async function reSuspendOrphanedStandbys(
+  provider: StandbyProvider,
+): Promise<number> {
+  const candidates = await getCandidates(provider);
+  if (candidates.length === 0) return 0;
+
+  const protectedHandles = await getProtectedHandles(provider);
+  const inUseHandles = await getInUseHandles(
+    provider,
+    candidates.map((candidate) => candidate.handle),
+  );
+  const client = await createClient(provider);
+
+  if (!client.enterStandby) return 0;
+
+  let resuspended = 0;
+
+  for (const candidate of candidates) {
+    if (
+      protectedHandles.has(candidate.handle) ||
+      inUseHandles.has(candidate.handle)
+    ) {
+      continue;
+    }
+
+    let status: string;
+    try {
+      const result = await client.getInstanceStatus({
+        instanceId: candidate.handle,
+      });
+      status = result.status;
+    } catch {
+      // Not a live instance (a genuine snapshot id, or already deleted) —
+      // the retention eviction policy owns its lifecycle.
+      continue;
+    }
+
+    if (status !== 'running') continue;
+
+    try {
+      await client.enterStandby({ instanceId: candidate.handle });
+      resuspended += 1;
+      console.log(
+        `${LOG_PREFIX} re-suspended orphaned ${provider} standby ${candidate.handle} from task run #${candidate.runId}`,
+      );
+    } catch (error) {
+      console.error(
+        `${LOG_PREFIX} failed to re-suspend ${provider} standby ${candidate.handle}: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
+  return resuspended;
+}
+
 export async function standbyRetentionJob(
   now: Date = new Date(),
 ): Promise<void> {
@@ -217,12 +329,18 @@ export async function standbyRetentionJob(
     STANDBY_PROVIDERS.map(async (provider) => ({
       provider,
       removed: await enforceProviderRetention(provider, now),
+      resuspended: RE_SUSPEND_PROVIDERS.includes(provider)
+        ? await reSuspendOrphanedStandbys(provider)
+        : 0,
     })),
   );
 
   console.log(
     `${LOG_PREFIX} completed ${results
-      .map(({ provider, removed }) => `${provider}=${removed}`)
+      .map(
+        ({ provider, removed, resuspended }) =>
+          `${provider}(removed=${removed},resuspended=${resuspended})`,
+      )
       .join(' ')}`,
   );
 }
diff --git a/apps/controller/src/compute-providers/spawn-azure-worker.ts b/apps/controller/src/compute-providers/spawn-azure-worker.ts
index 1ea9ea160..8876db48e 100644
--- a/apps/controller/src/compute-providers/spawn-azure-worker.ts
+++ b/apps/controller/src/compute-providers/spawn-azure-worker.ts
@@ -403,6 +403,29 @@ export async function spawnAzureWorker(
       )}`,
     );
 
+    if (
+      launchOptions.launchMode === 'task_standby' ||
+      launchOptions.launchMode === 'task_snapshot'
+    ) {
+      // Suspend/resume and snapshot/restore revive previously frozen worker
+      // processes whose runs were finalized while they were away — dead
+      // tokens, and they hold the sandbox-server port, which kills the
+      // incoming worker's boot. Reap them before launch. pkill exits 1 when
+      // nothing matches; that is the common case and not an error.
+      await computeClient
+        .runCommand({
+          instanceId: machine.machineId,
+          cmd: 'pkill',
+          args: ['-f', '/sandbox/worker/dist/worker.js'],
+          signal: AbortSignal.timeout(15_000),
+        })
+        .catch((error) => {
+          console.warn(
+            `[spawnAzureWorker] Pre-launch worker reaper failed for task run #${taskRun.id}: ${error instanceof Error ? error.message : String(error)}`,
+          );
+        });
+    }
+
     await recordMutation({
       provider: 'azure',
       operation: 'run_command',
diff --git a/apps/worker/src/run-task/polling/worker-heartbeat.test.ts b/apps/worker/src/run-task/polling/worker-heartbeat.test.ts
index 660195ee9..f25b30345 100644
--- a/apps/worker/src/run-task/polling/worker-heartbeat.test.ts
+++ b/apps/worker/src/run-task/polling/worker-heartbeat.test.ts
@@ -196,6 +196,36 @@ describe('createWorkerHeartbeatInterval', () => {
     }
   });
 
+  it('terminates the worker when the server reports the run as finalized', async () => {
+    const warn = vi.fn();
+    const exitSpy = vi
+      .spyOn(process, 'exit')
+      .mockImplementation((() => undefined) as never);
+    mockTouchWorkerHeartbeat.mockRejectedValue(
+      new Error('Cannot access resources from a different run'),
+    );
+
+    const interval = createWorkerHeartbeatInterval({
+      runId: 200,
+      logger: { warn } as never,
+    });
+
+    try {
+      await vi.advanceTimersByTimeAsync(0);
+
+      expect(warn).toHaveBeenCalledWith(
+        '[workerHeartbeat] Task run 200 is finalized server-side; terminating this worker.',
+      );
+      expect(exitSpy).toHaveBeenCalledWith(0);
+      // No failure-streak bookkeeping or Sentry noise for an authoritative
+      // terminal signal.
+      expect(captureWorkerMessageMock).not.toHaveBeenCalled();
+    } finally {
+      clearInterval(interval);
+      exitSpy.mockRestore();
+    }
+  });
+
   it('does not start a new heartbeat while the previous request is still pending', async () => {
     const deferred = createDeferred<void>();
     mockTouchWorkerHeartbeat
diff --git a/apps/worker/src/run-task/polling/worker-heartbeat.ts b/apps/worker/src/run-task/polling/worker-heartbeat.ts
index 74be28e43..93d242f87 100644
--- a/apps/worker/src/run-task/polling/worker-heartbeat.ts
+++ b/apps/worker/src/run-task/polling/worker-heartbeat.ts
@@ -3,6 +3,18 @@ import { sdk } from '@roomote/sdk/client';
 import { captureWorkerMessage } from '../../monitoring/sentry';
 
 const HEARTBEAT_SENTRY_THRESHOLD = 3;
+
+/**
+ * Server message (run-token guard) returned when the persisted run is in a
+ * terminal status. The control plane finalizes standby/swept runs while
+ * their workers may still be alive — a suspended-then-woken worker resumes
+ * with a dead token and must terminate itself instead of idling forever as
+ * a zombie (holding the sandbox-server port and killing its successor's
+ * boot). This is authoritative server-side truth, not a transient failure.
+ */
+const RUN_TERMINAL_HEARTBEAT_MESSAGE =
+  'Cannot access resources from a different run';
+
 export const WORKER_HEARTBEAT_RPC_TIMEOUT_MS =
   WORKER_HEARTBEAT_INTERVAL_MS - 5_000;
 
@@ -58,6 +70,21 @@ async function sendHeartbeat({
     hasReportedFailureStreakRef.current = false;
   } catch (error) {
     const heartbeatError = getHeartbeatError(controller, runId, error);
+
+    if (
+      heartbeatError instanceof Error &&
+      heartbeatError.message.includes(RUN_TERMINAL_HEARTBEAT_MESSAGE)
+    ) {
+      logger.warn(
+        `[workerHeartbeat] Task run ${runId} is finalized server-side; terminating this worker.`,
+      );
+      // The run this worker belongs to no longer exists as an active run —
+      // every control-plane call will fail the same way, so graceful
+      // teardown has nothing useful left to do. Exit promptly so the
+      // sandbox is free for its next wake.
+      process.exit(0);
+    }
+
     consecutiveFailureCountRef.current += 1;
     logger.warn(
       `[workerHeartbeat] Failed to update heartbeat for task run ${runId}: ${
diff --git a/packages/compute-providers/src/__tests__/azure.contract.test.ts b/packages/compute-providers/src/__tests__/azure.contract.test.ts
index ff3eea822..bf4eed16b 100644
--- a/packages/compute-providers/src/__tests__/azure.contract.test.ts
+++ b/packages/compute-providers/src/__tests__/azure.contract.test.ts
@@ -165,7 +165,9 @@ describe('azure adapter contract', () => {
     expect(portAdd?.body).toMatchObject({
       port: 3000,
       auth: { anonymous: true },
-      activationMode: 'OnDemand',
+      // Manual activation: wake stays deliberate; OnDemand wakes orphaned
+      // standby sandboxes on any inbound traffic.
+      activationMode: 'Manual',
     });
   });
 
@@ -238,6 +240,94 @@ describe('azure adapter contract', () => {
     expect(result.domains['8080']).toContain('--8080.');
   });
 
+  it('migrates a legacy OnDemand port to Manual activation on conflict', async () => {
+    let addAttempts = 0;
+    const { fetchImpl, requests } = createFetchMock({
+      onRequest: (request) => {
+        if (request.url.includes('/ports/add')) {
+          addAttempts += 1;
+          // The legacy add conflicts; the post-remove re-add succeeds.
+          if (addAttempts === 1) {
+            return jsonResponse({ title: 'PortAlreadyExists' }, 409);
+          }
+          return jsonResponse({});
+        }
+        if (
+          request.method === 'GET' &&
+          request.url.includes(`${SANDBOX_ID}?`)
+        ) {
+          return jsonResponse({
+            id: SANDBOX_ID,
+            state: 'Running',
+            ports: [
+              {
+                port: 8080,
+                auth: { anonymous: true },
+                activationMode: 'OnDemand',
+              },
+            ],
+          });
+        }
+        return undefined;
+      },
+    });
+    const client = createClient(fetchImpl);
+
+    const result = await client.getInstanceDomains!({
+      instanceId: SANDBOX_ID,
+      ports: [8080],
+    });
+
+    expect(result.domains['8080']).toContain('--8080.');
+    const portRemove = requests.find((r) => r.url.includes('/ports/remove'));
+    expect(portRemove?.body).toMatchObject({ port: 8080 });
+    const portAdds = requests.filter((r) => r.url.includes('/ports/add'));
+    expect(portAdds).toHaveLength(2);
+    expect(portAdds[1]?.body).toMatchObject({
+      port: 8080,
+      auth: { anonymous: true },
+      activationMode: 'Manual',
+    });
+  });
+
+  it('leaves an existing Manual port untouched on conflict', async () => {
+    const { fetchImpl, requests } = createFetchMock({
+      onRequest: (request) => {
+        if (request.url.includes('/ports/add')) {
+          return jsonResponse({ title: 'PortAlreadyExists' }, 409);
+        }
+        if (
+          request.method === 'GET' &&
+          request.url.includes(`${SANDBOX_ID}?`)
+        ) {
+          return jsonResponse({
+            id: SANDBOX_ID,
+            state: 'Running',
+            ports: [
+              {
+                port: 8080,
+                auth: { anonymous: true },
+                activationMode: 'Manual',
+              },
+            ],
+          });
+        }
+        return undefined;
+      },
+    });
+    const client = createClient(fetchImpl);
+
+    await client.getInstanceDomains!({
+      instanceId: SANDBOX_ID,
+      ports: [8080],
+    });
+
+    expect(requests.some((r) => r.url.includes('/ports/remove'))).toBe(false);
+    expect(requests.filter((r) => r.url.includes('/ports/add'))).toHaveLength(
+      1,
+    );
+  });
+
   it('runs a blocking command with cwd and returns output', async () => {
     const { fetchImpl, requests } = createFetchMock({});
     const client = createClient(fetchImpl);
diff --git a/packages/compute-providers/src/adapters/azure.ts b/packages/compute-providers/src/adapters/azure.ts
index e7d50715e..f45f13ec3 100644
--- a/packages/compute-providers/src/adapters/azure.ts
+++ b/packages/compute-providers/src/adapters/azure.ts
@@ -903,10 +903,19 @@ export class AzureClient implements ComputeProviderClient {
   }
 
   /**
-   * Add the requested ports (anonymous, OnDemand activation so inbound
-   * traffic wakes a suspended sandbox — measured 2026-07-28) and return
-   * deterministic per-port URLs. Re-adding an existing port is a 409, which
-   * is treated as success.
+   * Add the requested ports (anonymous, Manual activation) and return
+   * deterministic per-port URLs. A 409 means the port already exists —
+   * and ports persist across stop/resume, so sandboxes created before
+   * Manual activation shipped would keep OnDemand forever if the conflict
+   * were silently accepted. Conflicts therefore go through a migration
+   * check: legacy (non-Manual) ports are removed and re-added.
+   *
+   * Activation is deliberately NOT OnDemand: OnDemand resumes a suspended
+   * sandbox on ANY inbound traffic (measured 2026-07-28), but Roomote
+   * finalizes standby runs at suspend time — an out-of-band wake resumes a
+   * worker whose run token is dead, the worker exits, and the sandbox idles
+   * Running, invisible to sleep-check (which excludes retained runs). Wake
+   * must stay deliberate (wake prompt / message send → resumeFromStandby).
    */
   private async ensurePorts(
     sandboxId: string,
@@ -920,19 +929,56 @@ export class AzureClient implements ComputeProviderClient {
           body: {
             port,
             auth: { anonymous: true },
-            activationMode: 'OnDemand',
+            activationMode: 'Manual',
           },
           signal,
           abortMessage: `Exposing port ${port} on Azure sandbox ${sandboxId} was aborted`,
         });
       } catch (error) {
         if (!isPortConflict(error)) throw error;
+        await this.migrateLegacyPortActivation(sandboxId, port, signal);
       }
       domains[String(port)] = this.computePortUrl(sandboxId, port);
     }
     return domains;
   }
 
+  /**
+   * Migrate an existing port to Manual activation. Triggered on a 409 from
+   * ports/add: ports persist across stop/resume, so legacy OnDemand ports
+   * keep waking the sandbox out-of-band on any inbound traffic unless they
+   * are recreated. Uses ports/remove + ports/add — the PUT /ports
+   * replace-all endpoint is unreliable (see service reference). A port
+   * already on Manual is left untouched.
+   */
+  private async migrateLegacyPortActivation(
+    sandboxId: string,
+    port: number,
+    signal?: AbortSignal,
+  ): Promise<void> {
+    const sandbox = await this.getSandbox(sandboxId, signal);
+    const existing = sandbox.ports?.find((p) => p.port === port);
+
+    if (!existing || existing.activationMode === 'Manual') {
+      return;
+    }
+
+    await this.request('POST', `${this.sandboxPath(sandboxId)}/ports/remove`, {
+      body: { port },
+      signal,
+      abortMessage: `Migrating port ${port} on Azure sandbox ${sandboxId} to Manual activation was aborted`,
+    });
+    await this.request('POST', `${this.sandboxPath(sandboxId)}/ports/add`, {
+      body: {
+        port,
+        auth: { anonymous: true },
+        activationMode: 'Manual',
+      },
+      signal,
+      abortMessage: `Re-adding port ${port} with Manual activation on Azure sandbox ${sandboxId} was aborted`,
+    });
+  }
+
   /**
    * Port URLs are deterministic: {sandboxId}--{port}.{region}.adcproxy.io
    * (measured 2026-07-28).

From 2187995a45cd42fde0c5a8b4e82cf4da5ceeab99 Mon Sep 17 00:00:00 2001
From: "roomote-community[bot]"
 <311835222+roomote-community[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 13:11:48 -0400
Subject: [PATCH 19/24] [Fix] Upgrade retries reject backups after a failed
 image pull (#1009)

Co-authored-by: tebieshi <197311053+tebieshi@users.noreply.github.com>
---
 .github/workflows/CI.yml                    |  2 +
 deploy/ci/validate-deployment-artifacts.mjs |  1 +
 deploy/host/roomote                         | 32 +++++--
 deploy/host/tests/upgrade-failed-pull.sh    | 95 +++++++++++++++++++++
 4 files changed, 122 insertions(+), 8 deletions(-)
 create mode 100755 deploy/host/tests/upgrade-failed-pull.sh

diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index abfb42436..ab96df0f9 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -217,6 +217,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Verify a failed image pull preserves deployment metadata
+        run: bash deploy/host/tests/upgrade-failed-pull.sh
       - name: Restore an encrypted bundle onto empty volumes
         run: bash deploy/host/tests/backup-restore.integration.sh
 
diff --git a/deploy/ci/validate-deployment-artifacts.mjs b/deploy/ci/validate-deployment-artifacts.mjs
index 3fbc20b6c..9f11043c1 100644
--- a/deploy/ci/validate-deployment-artifacts.mjs
+++ b/deploy/ci/validate-deployment-artifacts.mjs
@@ -483,6 +483,7 @@ for (const script of [
   'deploy/ci/deployment-smoke.sh',
   'deploy/ci/upgrade-compatibility.sh',
   'deploy/host/tests/backup-restore.integration.sh',
+  'deploy/host/tests/upgrade-failed-pull.sh',
 ]) {
   execFileSync('bash', ['-n', join(root, script)], { stdio: 'pipe' });
 }
diff --git a/deploy/host/roomote b/deploy/host/roomote
index 92cb39c92..19d3baf88 100755
--- a/deploy/host/roomote
+++ b/deploy/host/roomote
@@ -462,6 +462,27 @@ pre_upgrade_backup() {
   log "Pre-upgrade backup written to $bundle"
 }
 
+cleanup_upgrade() {
+  local status="$?"
+
+  trap - EXIT
+  if [ "$status" -ne 0 ] && [ -n "${upgrade_rollback_dir:-}" ] && [ -d "$upgrade_rollback_dir" ]; then
+    log "Upgrade failed; restoring the previous deployment configuration"
+    install -m 600 "$upgrade_rollback_dir/.env" "$env_file"
+    install -m 600 "$upgrade_rollback_dir/docker-compose.prod.yml" "$compose_file"
+    if [ -f "$upgrade_rollback_dir/Caddyfile" ]; then
+      install -m 600 "$upgrade_rollback_dir/Caddyfile" "$install_root/caddy/Caddyfile"
+    else
+      rm -f "$install_root/caddy/Caddyfile"
+    fi
+    if [ "${upgrade_controller_stopped:-false}" = 'true' ]; then
+      compose start controller || true
+    fi
+  fi
+  rm -rf "${upgrade_rollback_dir:-}"
+  exit "$status"
+}
+
 cmd_upgrade() {
   local version=''
   local skip_backup='false'
@@ -517,8 +538,9 @@ cmd_upgrade() {
   # scope on a set -e failure in a nested call.
   mkdir -p "$install_root/backups"
   upgrade_rollback_dir="$(mktemp -d "$install_root/backups/.upgrade-staging.XXXXXX")"
+  upgrade_controller_stopped='false'
   chmod 700 "$upgrade_rollback_dir"
-  trap 'rm -rf "${upgrade_rollback_dir:-}"' EXIT
+  trap cleanup_upgrade EXIT
   install -m 600 "$env_file" "$upgrade_rollback_dir/.env"
   install -m 600 "$compose_file" "$upgrade_rollback_dir/docker-compose.prod.yml"
   if [ -f "$install_root/caddy/Caddyfile" ]; then
@@ -579,6 +601,7 @@ cmd_upgrade() {
   compose config >/dev/null
   log "Stopping the controller so new tasks stay queued during the rollout"
   compose stop controller || true
+  upgrade_controller_stopped='true'
   log "Pulling images for $version"
   docker pull "$worker_image"
   compose pull
@@ -587,13 +610,6 @@ cmd_upgrade() {
   # the schema back and the previous release keeps serving.
   log "Applying database migrations for $version before replacing services"
   if ! compose run --rm db-migrate; then
-    log "Migration failed; restoring the previous deployment configuration"
-    install -m 600 "$upgrade_rollback_dir/.env" "$env_file"
-    install -m 600 "$upgrade_rollback_dir/docker-compose.prod.yml" "$compose_file"
-    if [ -f "$upgrade_rollback_dir/Caddyfile" ]; then
-      install -m 600 "$upgrade_rollback_dir/Caddyfile" "$install_root/caddy/Caddyfile"
-    fi
-    compose start controller || true
     die "database migrations for $version failed and were rolled back; the previous release${previous_version:+ ($previous_version)} is still running"
   fi
   rm -rf "$upgrade_rollback_dir"
diff --git a/deploy/host/tests/upgrade-failed-pull.sh b/deploy/host/tests/upgrade-failed-pull.sh
new file mode 100755
index 000000000..acb8ccab9
--- /dev/null
+++ b/deploy/host/tests/upgrade-failed-pull.sh
@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../.." && pwd)"
+roomote_cli="$repo_root/deploy/host/roomote"
+work_dir="$(mktemp -d)"
+install_root="$work_dir/install"
+fake_bin="$work_dir/bin"
+docker_log="$work_dir/docker.log"
+output_log="$work_dir/output.log"
+
+cleanup() {
+  rm -rf "$work_dir"
+}
+trap cleanup EXIT
+
+mkdir -p "$install_root/backups" "$install_root/caddy" "$fake_bin"
+cat >"$install_root/.env" <<'EOF'
+ROOMOTE_REPO=RooCodeInc/Roomote
+ROOMOTE_VERSION=v1.0.0
+ROOMOTE_PREVIOUS_VERSION=v0.9.0
+ROOMOTE_APP_DOMAIN=roomote.example.com
+IMAGE_REGISTRY=ghcr.io
+IMAGE_NAMESPACE=roocodeinc
+DOCKER_WORKER_IMAGE=ghcr.io/roocodeinc/roomote-worker:v1.0.0
+MODAL_BASE_IMAGE_REF=ghcr.io/roocodeinc/roomote-worker:v1.0.0
+R_DISCORD_GATEWAY_SECRET=test-secret
+EOF
+printf 'original compose\n' >"$install_root/docker-compose.prod.yml"
+printf 'original caddy\n' >"$install_root/caddy/Caddyfile"
+cp "$install_root/.env" "$work_dir/original.env"
+cp "$install_root/docker-compose.prod.yml" "$work_dir/original-compose.yml"
+cp "$install_root/caddy/Caddyfile" "$work_dir/original-Caddyfile"
+
+cat >"$fake_bin/curl" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+output=''
+url=''
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    -o)
+      output="$2"
+      shift 2
+      ;;
+    http*)
+      url="$1"
+      shift
+      ;;
+    *) shift ;;
+  esac
+done
+
+case "$url" in
+  */docker-compose.prod.yml) printf 'refreshed compose\n' >"$output" ;;
+  */Caddyfile) printf 'refreshed caddy\n' >"$output" ;;
+  *) exit 1 ;;
+esac
+EOF
+
+cat >"$fake_bin/docker" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+printf '%s\n' "$*" >>"$MOCK_DOCKER_LOG"
+if [ "${1:-}" = 'pull' ]; then
+  exit 1
+fi
+EOF
+
+chmod +x "$fake_bin/curl" "$fake_bin/docker"
+
+set +e
+env PATH="$fake_bin:$PATH" \
+  MOCK_DOCKER_LOG="$docker_log" \
+  ROOMOTE_FETCH_BASE='https://example.invalid' \
+  ROOMOTE_INSTALL_ROOT="$install_root" \
+  ROOMOTE_TEST_MODE=true \
+  "$roomote_cli" upgrade missing-tag --skip-backup >"$output_log" 2>&1
+status=$?
+set -e
+
+[ "$status" -ne 0 ]
+cmp "$work_dir/original.env" "$install_root/.env"
+cmp "$work_dir/original-compose.yml" "$install_root/docker-compose.prod.yml"
+cmp "$work_dir/original-Caddyfile" "$install_root/caddy/Caddyfile"
+grep -q '^compose .* start controller$' "$docker_log"
+grep -q 'Upgrade failed; restoring the previous deployment configuration' "$output_log"
+if compgen -G "$install_root/backups/.upgrade-staging.*" >/dev/null; then
+  printf 'upgrade staging directory was not cleaned up\n' >&2
+  exit 1
+fi
+
+printf 'Failed image pull preserved the deployed release metadata.\n'

From 92ce1343028e98092aedc07ddec8f13f95142c20 Mon Sep 17 00:00:00 2001
From: Matt Rubens <mrubens@users.noreply.github.com>
Date: Mon, 3 Aug 2026 13:41:11 -0400
Subject: [PATCH 20/24] [Fix] Restore command output display in the web task
 view (#1054)

---
 .changeset/task-view-command-output.md             |  5 +++++
 .../messages/acp/AcpCommandOutputMessage.tsx       | 11 ++++++-----
 .../AcpCommandOutputMessage.client.test.tsx        | 14 +++++++-------
 .../messages/acp/tool-detail-visibility.ts         |  5 +----
 4 files changed, 19 insertions(+), 16 deletions(-)
 create mode 100644 .changeset/task-view-command-output.md

diff --git a/.changeset/task-view-command-output.md b/.changeset/task-view-command-output.md
new file mode 100644
index 000000000..45375656f
--- /dev/null
+++ b/.changeset/task-view-command-output.md
@@ -0,0 +1,5 @@
+---
+'@roomote/web': patch
+---
+
+Show command output again in the web task view. Terminal commands render their output as a collapsible block (collapsed by default, capped at 400px) with a copy button, and expanded details are restored for command items inside grouped tool calls. Expanded file-read contents remain hidden.
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/AcpCommandOutputMessage.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/AcpCommandOutputMessage.tsx
index adeb906c1..962755f2c 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/AcpCommandOutputMessage.tsx
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/AcpCommandOutputMessage.tsx
@@ -46,6 +46,7 @@ export const AcpCommandOutputMessage = ({
 
   const output = sanitizeSandboxPathString(cmd.text);
 
+  const isOutputPresent = output.trim().length > 0;
   const isExitCodePresent = cmd.exitCode !== undefined;
   const isPending =
     status === 'in_progress' || (status === null && !isExitCodePresent);
@@ -69,14 +70,14 @@ export const AcpCommandOutputMessage = ({
           code={output}
           language="bash"
           variant="compact"
-          collapsible={false}
-          defaultCollapsed={false}
+          collapsible={isOutputPresent}
+          defaultCollapsed={isOutputPresent}
           forceDark={true}
-          renderContent={false}
-          maxHeight={undefined}
+          renderContent={isOutputPresent}
+          maxHeight={isOutputPresent ? 400 : undefined}
           command={command ?? ''}
           showCommandCopy
-          showOutputCopy={false}
+          showOutputCopy={isOutputPresent}
         >
           <CodeBlockHeader className="w-full">
             <CodeBlockTitle>
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/__tests__/AcpCommandOutputMessage.client.test.tsx b/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/__tests__/AcpCommandOutputMessage.client.test.tsx
index 4f6f9bd35..ec649cdfb 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/__tests__/AcpCommandOutputMessage.client.test.tsx
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/__tests__/AcpCommandOutputMessage.client.test.tsx
@@ -50,7 +50,7 @@ describe('AcpCommandOutputMessage', () => {
     codeBlockCommandSpy.mockClear();
   });
 
-  it('renders command headers without expandable raw output', () => {
+  it('renders command output blocks as collapsible and collapsed by default', () => {
     const msg: AcpToolResultUiMessage = {
       ...baseMsg,
       text: '$ pnpm test\nPASS src/example.test.ts',
@@ -75,17 +75,17 @@ describe('AcpCommandOutputMessage', () => {
     expect(codeBlockSpy).toHaveBeenCalledTimes(1);
     expect(codeBlockSpy).toHaveBeenCalledWith(
       expect.objectContaining({
-        collapsible: false,
-        defaultCollapsed: false,
-        renderContent: false,
-        maxHeight: undefined,
+        collapsible: true,
+        defaultCollapsed: true,
+        renderContent: true,
+        maxHeight: 400,
         showCommandCopy: true,
-        showOutputCopy: false,
+        showOutputCopy: true,
       }),
     );
   });
 
-  it('keeps command output blocks non-collapsible even when there is no output to show', () => {
+  it('does not enable collapsible mode when there is no output to show', () => {
     const msg: AcpToolCallUiMessage = {
       ...baseMsg,
       text: '   \n',
diff --git a/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/tool-detail-visibility.ts b/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/tool-detail-visibility.ts
index 4af75fca0..da53510ec 100644
--- a/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/tool-detail-visibility.ts
+++ b/apps/web/src/app/(sandbox)/task/[taskId]/messages/acp/tool-detail-visibility.ts
@@ -84,9 +84,6 @@ export function hidesExpandedToolResult(
   return (
     isInternalDebugToolCallMessage(msg) ||
     msg.data.kind === 'read' ||
-    msg.data.kind === 'execute' ||
-    msg.data.kind === 'execute_command' ||
-    data.isRead === true ||
-    data.isExecute === true
+    data.isRead === true
   );
 }

From 39c62023bbe1325979776f708cc991e5b515c524 Mon Sep 17 00:00:00 2001
From: "roomote-roomote[bot]"
 <301996811+roomote-roomote[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 15:05:59 -0400
Subject: [PATCH 21/24] [Feat] Add native Amazon Bedrock models alongside
 Mantle (#1055)

Co-authored-by: Matt Rubens <2600+mrubens@users.noreply.github.com>
---
 .../__tests__/inference-gateway.test.ts       | 157 ++++++++++++++++++
 apps/api/src/handlers/inference/registry.ts   |  23 ++-
 .../providers/inference/amazon-bedrock.mdx    |  29 +++-
 .../InferenceProviderSection.test.tsx         |  23 ++-
 .../settings/ModelSettingsSection.test.tsx    |  36 ++++
 .../settings/ModelSettingsSection.tsx         |   4 +
 .../commands/task-models/models-dev.test.ts   |  30 ++++
 apps/worker/src/run-task/agent-home.test.ts   |  91 ++++++++++
 apps/worker/src/run-task/agent-home.ts        | 119 +++++++++++--
 .../src/__tests__/inference-gateway.test.ts   |  20 +++
 .../src/__tests__/opencode-reasoning.test.ts  |  48 ++++++
 packages/types/src/inference-gateway.ts       |  17 ++
 .../types/src/model-provider-config.test.ts   |   4 +-
 packages/types/src/model-provider-config.ts   |   4 +-
 packages/types/src/opencode-reasoning.ts      |  52 ++++++
 15 files changed, 618 insertions(+), 39 deletions(-)

diff --git a/apps/api/src/handlers/inference/__tests__/inference-gateway.test.ts b/apps/api/src/handlers/inference/__tests__/inference-gateway.test.ts
index d05d701dd..e913f057d 100644
--- a/apps/api/src/handlers/inference/__tests__/inference-gateway.test.ts
+++ b/apps/api/src/handlers/inference/__tests__/inference-gateway.test.ts
@@ -115,6 +115,7 @@ describe('inference gateway', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     vi.unstubAllGlobals();
+    vi.unstubAllEnvs();
     mockFindTaskRun.mockResolvedValue({ id: 42 });
     mockGetGitHubCopilotAccessToken.mockResolvedValue(null);
     mockGetFreshXaiAccessToken.mockResolvedValue(null);
@@ -431,6 +432,33 @@ describe('inference gateway', () => {
     expect(url).toBe('https://open.bigmodel.cn/api/paas/v4/chat/completions');
   });
 
+  it('preserves persisted Z.AI region precedence with a runtime API key', async () => {
+    vi.stubEnv('ZAI_API_KEY', 'runtime-provider-key');
+    mockResolveModelProviderEnvValue.mockImplementation(
+      async (names: string | readonly string[]) => {
+        const nameList = typeof names === 'string' ? [names] : names;
+
+        return nameList.includes('ZAI_REGION')
+          ? 'china'
+          : 'runtime-provider-key';
+      },
+    );
+
+    const fetchMock = stubUpstreamFetch();
+    const response = await postMessages(
+      createApp(createRunToken()),
+      '/api/inference/zai/chat/completions',
+    );
+
+    expect(response.status).toBe(200);
+    const [url] = fetchMock.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe('https://open.bigmodel.cn/api/paas/v4/chat/completions');
+    expect(mockResolveModelProviderEnvValue).toHaveBeenCalledWith(
+      ['ZAI_REGION'],
+      {},
+    );
+  });
+
   it('proxies Z.AI Coding Plan to its international coding endpoint', async () => {
     const fetchMock = stubUpstreamFetch();
     const response = await postMessages(
@@ -662,6 +690,135 @@ describe('inference gateway', () => {
     );
   });
 
+  it('proxies native Bedrock Converse requests with bearer authentication', async () => {
+    const fetchMock = stubUpstreamFetch();
+    mockResolveModelProviderEnvValue.mockImplementation(
+      async (names: string | readonly string[]) => {
+        const nameList = typeof names === 'string' ? [names] : names;
+
+        return nameList.includes('AWS_REGION')
+          ? 'eu-west-1'
+          : 'provider-secret-key';
+      },
+    );
+
+    const response = await postMessages(
+      createApp(createRunToken()),
+      '/api/inference/amazon-bedrock/model/eu.anthropic.claude-sonnet-5/converse',
+    );
+
+    expect(response.status).toBe(200);
+    const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe(
+      'https://bedrock-runtime.eu-west-1.amazonaws.com/model/eu.anthropic.claude-sonnet-5/converse',
+    );
+    expect(new Headers(init.headers).get('authorization')).toBe(
+      'Bearer provider-secret-key',
+    );
+  });
+
+  it('uses the persisted Bedrock region when the API key is persisted', async () => {
+    vi.stubEnv('AWS_REGION', 'us-west-2');
+    vi.stubEnv('AWS_BEARER_TOKEN_BEDROCK', '');
+    const fetchMock = stubUpstreamFetch();
+    mockResolveModelProviderEnvValue.mockImplementation(
+      async (
+        names: string | readonly string[],
+        options?: { runtimeEnv?: Record<string, string> },
+      ) => {
+        const nameList = typeof names === 'string' ? [names] : names;
+
+        if (nameList.includes('AWS_REGION')) {
+          return options?.runtimeEnv ? 'eu-west-1' : 'us-west-2';
+        }
+
+        return 'provider-secret-key';
+      },
+    );
+
+    const response = await postMessages(
+      createApp(createRunToken()),
+      '/api/inference/amazon-bedrock/model/eu.anthropic.claude-sonnet-5/converse',
+    );
+
+    expect(response.status).toBe(200);
+    const [url] = fetchMock.mock.calls[0] as [string];
+    expect(url).toBe(
+      'https://bedrock-runtime.eu-west-1.amazonaws.com/model/eu.anthropic.claude-sonnet-5/converse',
+    );
+    expect(mockResolveModelProviderEnvValue).toHaveBeenCalledWith(
+      ['AWS_REGION'],
+      { runtimeEnv: {} },
+    );
+  });
+
+  it('uses the runtime Bedrock region when the API key is configured at runtime', async () => {
+    vi.stubEnv('AWS_REGION', 'us-west-2');
+    vi.stubEnv('AWS_BEARER_TOKEN_BEDROCK', 'runtime-provider-key');
+    const fetchMock = stubUpstreamFetch();
+    mockResolveModelProviderEnvValue.mockImplementation(
+      async (
+        names: string | readonly string[],
+        options?: { runtimeEnv?: Record<string, string> },
+      ) => {
+        const nameList = typeof names === 'string' ? [names] : names;
+
+        if (nameList.includes('AWS_REGION')) {
+          return options?.runtimeEnv ? 'eu-west-1' : 'us-west-2';
+        }
+
+        return 'runtime-provider-key';
+      },
+    );
+
+    const response = await postMessages(
+      createApp(createRunToken()),
+      '/api/inference/amazon-bedrock/model/us.anthropic.claude-sonnet-5/converse',
+    );
+
+    expect(response.status).toBe(200);
+    const [url] = fetchMock.mock.calls[0] as [string];
+    expect(url).toBe(
+      'https://bedrock-runtime.us-west-2.amazonaws.com/model/us.anthropic.claude-sonnet-5/converse',
+    );
+    expect(
+      mockResolveModelProviderEnvValue.mock.calls.some(([names]) =>
+        (typeof names === 'string' ? [names] : names).includes('AWS_REGION'),
+      ),
+    ).toBe(false);
+  });
+
+  it('uses the default Bedrock region when a runtime API key has no runtime region', async () => {
+    vi.stubEnv('AWS_REGION', '');
+    vi.stubEnv('AWS_BEARER_TOKEN_BEDROCK', 'runtime-provider-key');
+    const fetchMock = stubUpstreamFetch();
+    mockResolveModelProviderEnvValue.mockImplementation(
+      async (names: string | readonly string[]) => {
+        const nameList = typeof names === 'string' ? [names] : names;
+
+        return nameList.includes('AWS_REGION')
+          ? 'eu-west-1'
+          : 'runtime-provider-key';
+      },
+    );
+
+    const response = await postMessages(
+      createApp(createRunToken()),
+      '/api/inference/amazon-bedrock/model/anthropic.claude-sonnet-5/converse',
+    );
+
+    expect(response.status).toBe(200);
+    const [url] = fetchMock.mock.calls[0] as [string];
+    expect(url).toBe(
+      'https://bedrock-runtime.us-east-1.amazonaws.com/model/anthropic.claude-sonnet-5/converse',
+    );
+    expect(
+      mockResolveModelProviderEnvValue.mock.calls.some(([names]) =>
+        (typeof names === 'string' ? [names] : names).includes('AWS_REGION'),
+      ),
+    ).toBe(false);
+  });
+
   it('proxies Bedrock Mantle OpenAI Responses requests', async () => {
     const fetchMock = stubUpstreamFetch();
     const response = await postMessages(
diff --git a/apps/api/src/handlers/inference/registry.ts b/apps/api/src/handlers/inference/registry.ts
index 3df354a8e..27e8808c7 100644
--- a/apps/api/src/handlers/inference/registry.ts
+++ b/apps/api/src/handlers/inference/registry.ts
@@ -54,9 +54,21 @@ export async function resolveGatewayUpstream(
     return resolveXaiUpstream(provider, upstreamPath, search);
   }
 
+  const requiresSourceCoupledRegion =
+    provider.region?.envVarName === 'AWS_REGION' &&
+    provider.envVarNames.includes('AWS_BEARER_TOKEN_BEDROCK');
+  const hasRuntimeApiKey =
+    requiresSourceCoupledRegion &&
+    provider.envVarNames.some((envVarName) => process.env[envVarName]?.trim());
   const [apiKey, upstreamBaseUrl] = await Promise.all([
     resolveModelProviderEnvValue(provider.envVarNames),
-    resolveProviderUpstreamBaseUrl(provider),
+    resolveProviderUpstreamBaseUrl(provider, {
+      regionSource: requiresSourceCoupledRegion
+        ? hasRuntimeApiKey
+          ? 'runtime'
+          : 'persisted'
+        : undefined,
+    }),
   ]);
 
   if (!apiKey && !provider.optionalApiKey) {
@@ -236,6 +248,7 @@ function hasTraversalOrEncodedSlash(upstreamPath: string): boolean {
  */
 async function resolveProviderUpstreamBaseUrl(
   provider: InferenceGatewayProvider,
+  options: { regionSource?: 'runtime' | 'persisted' } = {},
 ): Promise<string> {
   if (provider.upstreamBaseUrlEnvVarName) {
     const configuredBaseUrl = await resolveModelProviderEnvValue([
@@ -281,8 +294,12 @@ async function resolveProviderUpstreamBaseUrl(
   }
 
   const region =
-    (await resolveModelProviderEnvValue([provider.region.envVarName])) ??
-    provider.region.default;
+    (options.regionSource === 'runtime'
+      ? process.env[provider.region.envVarName]?.trim() || undefined
+      : await resolveModelProviderEnvValue(
+          [provider.region.envVarName],
+          options.regionSource === 'persisted' ? { runtimeEnv: {} } : {},
+        )) ?? provider.region.default;
 
   // Providers with discrete regional hosts select a base outright; the
   // `{region}` template and its cloud-region pattern do not apply to them.
diff --git a/apps/docs/providers/inference/amazon-bedrock.mdx b/apps/docs/providers/inference/amazon-bedrock.mdx
index f9c2e5214..e58d4da98 100644
--- a/apps/docs/providers/inference/amazon-bedrock.mdx
+++ b/apps/docs/providers/inference/amazon-bedrock.mdx
@@ -1,12 +1,13 @@
 ---
 title: Amazon Bedrock
 icon: 'https://unpkg.com/@lobehub/icons-static-svg@1.94.0/icons/bedrock.svg'
-description: Connect Roomote to models served through the Amazon Bedrock Mantle API.
+description: Connect Roomote to native Amazon Bedrock and Bedrock Mantle models.
 ---
 
 Amazon Bedrock provides managed access to models from multiple model developers
-inside AWS. Roomote uses Bedrock's Mantle API-key endpoint, so setup does not
-require long-lived IAM access-key and secret-key credentials.
+inside AWS. Roomote supports both native Bedrock Runtime models and models
+served through Bedrock's Mantle endpoints. Both use a Bedrock API key, so setup
+does not require long-lived IAM access-key and secret-key credentials.
 
 ## Get a Mantle API key
 
@@ -24,9 +25,20 @@ AWS_BEARER_TOKEN_BEDROCK=...
 AWS_REGION=us-east-1
 ```
 
-Roomote exposes supported models with the `bedrock-mantle/` prefix. The region
-defaults to `us-east-1` when omitted. Enable the models your account and region
-can access, then choose the default and role mappings.
+Roomote exposes Mantle models with the `bedrock-mantle/` prefix and OpenCode's
+native Bedrock provider models with the `amazon-bedrock/` prefix. The region
+defaults to `us-east-1` when omitted. Native Claude and other Bedrock Runtime
+models can use regional and cross-region inference-profile prefixes, such as
+`eu.`, `us.`, or `global.`. OpenAI models selected through the native provider
+continue to use Mantle's Responses endpoint automatically. Enable only models
+your account and configured region can access, then choose the default and role
+mappings.
+
+Roomote keeps Mantle models as the recommended defaults. Use native Bedrock
+models when you need standard Bedrock Runtime behavior or a regional inference
+profile that is not available through Mantle. Inference-profile ARNs are not
+supported through Roomote's hosted inference gateway; use the plain model or
+cross-region profile ID instead.
 
 ## Cost behavior
 
@@ -39,7 +51,7 @@ rates on the [Bedrock pricing page](https://aws.amazon.com/bedrock/pricing/).
 
 1. save the Mantle API key and matching region
 2. confirm Amazon Bedrock models appear in **Settings > Models**
-3. enable a model available in that region and assign it to a role
+3. enable a Mantle or native model available in that region and assign it to a role
 4. run a small task and confirm usage appears in the task and AWS account
 
 ## Common issues
@@ -48,5 +60,8 @@ rates on the [Bedrock pricing page](https://aws.amazon.com/bedrock/pricing/).
   access key, and that it was created in the configured region.
 - **A model fails although it is listed.** Confirm the model is available to
   your AWS account in `AWS_REGION` and that any required model access is enabled.
+- **A native Anthropic model is denied.** Complete Anthropic's first-time-use
+  and AWS Marketplace access requirements for Bedrock Runtime. These
+  requirements do not apply to the same model through Mantle.
 - **Costs differ from Roomote's estimate.** AWS may apply regional, caching,
   provisioned-throughput, or model-specific pricing that changes independently.
diff --git a/apps/web/src/components/settings/InferenceProviderSection.test.tsx b/apps/web/src/components/settings/InferenceProviderSection.test.tsx
index 2b5b493e8..a5eb8fa75 100644
--- a/apps/web/src/components/settings/InferenceProviderSection.test.tsx
+++ b/apps/web/src/components/settings/InferenceProviderSection.test.tsx
@@ -255,9 +255,9 @@ function buildProviderSetup(
                 id: 'amazon-bedrock' as SetupModelProviderId,
                 label: 'Amazon Bedrock',
                 envVarName: 'AWS_BEARER_TOKEN_BEDROCK',
-                envVarLabel: 'Mantle API key',
+                envVarLabel: 'API key',
                 credentialHelp: {
-                  text: 'Paste a key generated from the Bedrock Mantle API-key console. Switch the AWS console to the same region you enter below before generating it.',
+                  text: 'Paste a key generated from the Bedrock API-key console. The same regional key serves native Bedrock and Mantle models.',
                   href: 'https://us-east-1.console.aws.amazon.com/bedrock-mantle/api-keys',
                   linkLabel: 'Open AWS Bedrock API keys',
                 },
@@ -763,13 +763,13 @@ describe('InferenceProviderSection', () => {
 
     fireEvent.click(
       screen.getByRole('button', {
-        name: 'Edit Amazon Bedrock Mantle API key',
+        name: 'Edit Amazon Bedrock API key',
       }),
     );
 
-    expect(
-      screen.getByLabelText('New Mantle API key for Amazon Bedrock'),
-    ).toHaveValue('');
+    expect(screen.getByLabelText('New API key for Amazon Bedrock')).toHaveValue(
+      '',
+    );
     expect(screen.getByLabelText('AWS region for Amazon Bedrock')).toHaveValue(
       'us-west-2',
     );
@@ -799,7 +799,7 @@ describe('InferenceProviderSection', () => {
 
     fireEvent.click(
       screen.getByRole('button', {
-        name: 'Edit Amazon Bedrock Mantle API key',
+        name: 'Edit Amazon Bedrock API key',
       }),
     );
 
@@ -895,7 +895,7 @@ describe('InferenceProviderSection', () => {
       screen.getByRole('combobox', { name: 'Provider to add' }),
     ).toHaveTextContent('Amazon Bedrock');
     expect(
-      screen.getByLabelText('Mantle API key for Amazon Bedrock'),
+      screen.getByLabelText('API key for Amazon Bedrock'),
     ).toBeInTheDocument();
     expect(
       screen.getByRole('link', { name: 'Open AWS Bedrock API keys' }),
@@ -905,10 +905,9 @@ describe('InferenceProviderSection', () => {
     );
 
     await act(async () => {
-      fireEvent.change(
-        screen.getByLabelText('Mantle API key for Amazon Bedrock'),
-        { target: { value: 'bedrock-key' } },
-      );
+      fireEvent.change(screen.getByLabelText('API key for Amazon Bedrock'), {
+        target: { value: 'bedrock-key' },
+      });
       fireEvent.change(screen.getByLabelText('AWS region for Amazon Bedrock'), {
         target: { value: 'us-west-2' },
       });
diff --git a/apps/web/src/components/settings/ModelSettingsSection.test.tsx b/apps/web/src/components/settings/ModelSettingsSection.test.tsx
index a3cbe91c5..6ad634152 100644
--- a/apps/web/src/components/settings/ModelSettingsSection.test.tsx
+++ b/apps/web/src/components/settings/ModelSettingsSection.test.tsx
@@ -322,6 +322,11 @@ function buildProviderSetupData(
         buildProvider('openrouter', 'OpenRouter', 'OPENROUTER_API_KEY'),
         buildProvider('openai', 'OpenAI', 'OPENAI_API_KEY'),
         buildProvider('anthropic', 'Anthropic', 'ANTHROPIC_API_KEY'),
+        buildProvider(
+          'amazon-bedrock',
+          'Amazon Bedrock',
+          'AWS_BEARER_TOKEN_BEDROCK',
+        ),
         {
           id: 'chatgpt' as SetupModelProviderId,
           label: 'ChatGPT (subscription)',
@@ -1300,6 +1305,37 @@ describe('ModelSettingsSection', () => {
     }
   });
 
+  it('keeps a fully prefixed Mantle model id in the Amazon Bedrock picker', async () => {
+    settingsData.current = buildSettingsData();
+    providerSetupData.current = buildProviderSetupData({
+      connectedProviderIds: ['amazon-bedrock'],
+    });
+    lookupMutateAsyncMock.mockResolvedValue({
+      modelId: 'bedrock-mantle/anthropic.claude-opus-4-8',
+      displayName: 'Claude Opus 4.8',
+      family: 'Claude',
+      metadata: null,
+    });
+    vi.useFakeTimers();
+
+    try {
+      renderModelSettingsSection();
+
+      fireEvent.change(screen.getByLabelText('New model slug'), {
+        target: { value: 'bedrock-mantle/anthropic.claude-opus-4-8' },
+      });
+      await act(async () => {
+        vi.advanceTimersByTime(600);
+      });
+
+      expect(lookupMutateAsyncMock).toHaveBeenCalledWith({
+        modelId: 'bedrock-mantle/anthropic.claude-opus-4-8',
+      });
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it('groups openai/ models under ChatGPT when a subscription is connected', () => {
     settingsData.current = {
       ...buildSettingsData(),
diff --git a/apps/web/src/components/settings/ModelSettingsSection.tsx b/apps/web/src/components/settings/ModelSettingsSection.tsx
index 7e4300e27..6dd79ccb2 100644
--- a/apps/web/src/components/settings/ModelSettingsSection.tsx
+++ b/apps/web/src/components/settings/ModelSettingsSection.tsx
@@ -471,6 +471,10 @@ function composeNewModelId(
     return '';
   }
 
+  if (modelSlug.startsWith('bedrock-mantle/')) {
+    return modelSlug;
+  }
+
   if (modelSlug.startsWith(`${provider}/`)) {
     modelSlug = modelSlug.slice(provider.length + 1);
   }
diff --git a/apps/web/src/trpc/commands/task-models/models-dev.test.ts b/apps/web/src/trpc/commands/task-models/models-dev.test.ts
index 18ed19ab5..bb31ba999 100644
--- a/apps/web/src/trpc/commands/task-models/models-dev.test.ts
+++ b/apps/web/src/trpc/commands/task-models/models-dev.test.ts
@@ -233,6 +233,36 @@ describe('lookupModelMetadataFromCatalog', () => {
     expect(result.displayName).toBe('Claude Sonnet 5');
   });
 
+  it('resolves native Bedrock metadata from its provider catalog', () => {
+    const catalog = buildCatalog({
+      providers: {
+        'amazon-bedrock': {
+          models: {
+            'eu.anthropic.claude-sonnet-5': {
+              name: 'Claude Sonnet 5 (EU)',
+              modalities: { input: ['text', 'image'] },
+              limit: { context: 200000 },
+              cost: { input: 3, output: 15 },
+            },
+          },
+        },
+      },
+    });
+
+    const result = lookupModelMetadataFromCatalog(
+      catalog,
+      'amazon-bedrock/eu.anthropic.claude-sonnet-5',
+    );
+
+    expect(result.displayName).toBe('Claude Sonnet 5 (EU)');
+    expect(result.metadata).toEqual({
+      contextWindow: 200000,
+      inputTypes: ['text', 'image'],
+      inputPricePerToken: 3 / 1_000_000,
+      outputPricePerToken: 15 / 1_000_000,
+    });
+  });
+
   it('prefers the vercel gateway entry for vercel-routed models', () => {
     const catalog = buildCatalog({
       gatewayModelsByLowerSlug: {
diff --git a/apps/worker/src/run-task/agent-home.test.ts b/apps/worker/src/run-task/agent-home.test.ts
index 129987ba2..a8aa6a66e 100644
--- a/apps/worker/src/run-task/agent-home.test.ts
+++ b/apps/worker/src/run-task/agent-home.test.ts
@@ -77,6 +77,34 @@ describe('generateOpenCodeConfig provider support', () => {
     ).toBeDefined();
   });
 
+  it('routes native Bedrock OpenAI models through the Mantle Responses provider', () => {
+    const result = generateOpenCodeConfig({
+      homeDir: createHomeDir(),
+      runtimeEnv: {
+        R_MODEL: 'amazon-bedrock/openai.gpt-5.6-sol',
+        AWS_BEARER_TOKEN_BEDROCK: 'bedrock-key',
+        AWS_REGION: 'eu-west-1',
+        R_INFERENCE_GATEWAY_URL: 'https://api.example.com/api/inference',
+        R_INFERENCE_GATEWAY_KEYS: 'AWS_BEARER_TOKEN_BEDROCK',
+      },
+    });
+    const config = JSON.parse(result.configContent) as {
+      provider: Record<string, { models?: Record<string, unknown> }>;
+    };
+
+    expect(config.provider['bedrock-mantle-openai']).toMatchObject({
+      options: {
+        baseURL:
+          'https://api.example.com/api/inference/bedrock-mantle-openai/v1',
+        apiKey: '{env:ROOMOTE_CLOUD_TOKEN}',
+      },
+      models: {
+        'openai.gpt-5.6-sol': {},
+      },
+    });
+    expect(config.provider['amazon-bedrock']).toBeUndefined();
+  });
+
   it('ignores a disabled launch-time model override', () => {
     const runtimeEnv = {
       R_MODEL: 'openrouter/openai/gpt-5.6-terra',
@@ -188,6 +216,43 @@ describe('generateOpenCodeConfig provider support', () => {
     );
   });
 
+  it('registers native Amazon Bedrock models without overriding the direct endpoint', () => {
+    const result = generateOpenCodeConfig({
+      homeDir: createHomeDir(),
+      runtimeEnv: {
+        R_MODEL: 'amazon-bedrock/eu.anthropic.claude-sonnet-5',
+        R_MODEL_REASONING_EFFORT: 'high',
+        AWS_BEARER_TOKEN_BEDROCK: 'bedrock-key',
+        AWS_REGION: 'eu-west-1',
+      },
+    });
+    const config = JSON.parse(result.configContent) as {
+      provider: Record<string, unknown>;
+    };
+
+    expect(config.provider['amazon-bedrock']).toMatchObject({
+      npm: '@ai-sdk/amazon-bedrock',
+      name: 'Amazon Bedrock',
+      options: {
+        apiKey: '{env:AWS_BEARER_TOKEN_BEDROCK}',
+      },
+      models: {
+        'eu.anthropic.claude-sonnet-5': {
+          name: 'eu.anthropic.claude-sonnet-5',
+          options: {
+            reasoningConfig: {
+              type: 'adaptive',
+              maxReasoningEffort: 'high',
+              display: 'summarized',
+            },
+          },
+        },
+      },
+    });
+    expect(result.configContent).not.toContain('baseURL');
+    expect(result.configContent).not.toContain('bedrock-key');
+  });
+
   it('rejects invalid AWS regions before building a provider URL', () => {
     expect(() =>
       generateOpenCodeConfig({
@@ -374,6 +439,32 @@ describe('generateOpenCodeConfig provider support', () => {
     expect(config.provider['bedrock-mantle']).toBeUndefined();
   });
 
+  it('rebases native Amazon Bedrock models onto the gateway', () => {
+    const result = generateOpenCodeConfig({
+      homeDir: createHomeDir(),
+      runtimeEnv: {
+        R_MODEL: 'amazon-bedrock/eu.anthropic.claude-sonnet-5',
+        AWS_REGION: 'eu-west-1',
+        R_INFERENCE_GATEWAY_URL: 'https://api.example.com/api/inference',
+        R_INFERENCE_GATEWAY_KEYS: 'AWS_BEARER_TOKEN_BEDROCK',
+      },
+    });
+    const config = JSON.parse(result.configContent) as {
+      provider: Record<string, unknown>;
+    };
+
+    expect(config.provider['amazon-bedrock']).toMatchObject({
+      npm: '@ai-sdk/amazon-bedrock',
+      options: {
+        baseURL: 'https://api.example.com/api/inference/amazon-bedrock',
+        apiKey: '{env:ROOMOTE_CLOUD_TOKEN}',
+      },
+      models: {
+        'eu.anthropic.claude-sonnet-5': {},
+      },
+    });
+  });
+
   it('rebases the openai provider onto the ChatGPT gateway segment in gateway mode', () => {
     const result = generateOpenCodeConfig({
       homeDir: createHomeDir(),
diff --git a/apps/worker/src/run-task/agent-home.ts b/apps/worker/src/run-task/agent-home.ts
index 8363dc8f0..4f7efb38b 100644
--- a/apps/worker/src/run-task/agent-home.ts
+++ b/apps/worker/src/run-task/agent-home.ts
@@ -2,6 +2,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import {
+  AMAZON_BEDROCK_OPENCODE_PROVIDER_ID,
   applyImplicitLiteLlmModelPrefix,
   BEDROCK_MANTLE_OPENAI_OPENCODE_PROVIDER_ID,
   BEDROCK_MANTLE_OPENCODE_PROVIDER_ID,
@@ -775,14 +776,85 @@ function mergeBedrockMantleOpenAiProviderConfig(
   };
 }
 
+function mergeAmazonBedrockProviderConfig(
+  providerConfig: Record<string, unknown>,
+  runtimeEnv: Record<string, string>,
+  modelIds: Array<string | undefined>,
+): Record<string, unknown> {
+  const prefix = `${AMAZON_BEDROCK_OPENCODE_PROVIDER_ID}/`;
+  const bedrockModelIds = [
+    ...new Set(
+      modelIds.flatMap((modelId) => {
+        const normalized = modelId?.trim();
+
+        return normalized?.startsWith(prefix)
+          ? [normalized.slice(prefix.length)]
+          : [];
+      }),
+    ),
+  ];
+
+  if (bedrockModelIds.length === 0) {
+    return providerConfig;
+  }
+
+  const region = runtimeEnv.AWS_REGION?.trim() || DEFAULT_BEDROCK_MANTLE_REGION;
+
+  if (!INFERENCE_GATEWAY_REGION_PATTERN.test(region)) {
+    throw new Error(
+      `AWS_REGION must be a valid AWS region for Amazon Bedrock. Received "${region}".`,
+    );
+  }
+
+  const existingProvider = asRecord(
+    providerConfig[AMAZON_BEDROCK_OPENCODE_PROVIDER_ID],
+  );
+  const existingOptions = asRecord(existingProvider.options);
+  const existingModels = asRecord(existingProvider.models);
+
+  return {
+    ...providerConfig,
+    [AMAZON_BEDROCK_OPENCODE_PROVIDER_ID]: {
+      ...existingProvider,
+      npm: '@ai-sdk/amazon-bedrock',
+      name: 'Amazon Bedrock',
+      options: {
+        apiKey: '{env:AWS_BEARER_TOKEN_BEDROCK}',
+        ...existingOptions,
+      },
+      models: {
+        ...existingModels,
+        ...Object.fromEntries(
+          bedrockModelIds.map((modelId) => [
+            modelId,
+            {
+              name: modelId,
+              ...asRecord(existingModels[modelId]),
+            },
+          ]),
+        ),
+      },
+    },
+  };
+}
+
 function toBedrockMantleRuntimeModelId(modelId: string): string {
-  const prefix = `${BEDROCK_MANTLE_OPENCODE_PROVIDER_ID}/openai.`;
+  const mantlePrefix = `${BEDROCK_MANTLE_OPENCODE_PROVIDER_ID}/openai.`;
+  const nativePrefix = `${AMAZON_BEDROCK_OPENCODE_PROVIDER_ID}/openai.`;
 
-  return modelId.startsWith(prefix)
-    ? `${BEDROCK_MANTLE_OPENAI_OPENCODE_PROVIDER_ID}/${modelId.slice(
-        BEDROCK_MANTLE_OPENCODE_PROVIDER_ID.length + 1,
-      )}`
-    : modelId;
+  if (modelId.startsWith(mantlePrefix)) {
+    return `${BEDROCK_MANTLE_OPENAI_OPENCODE_PROVIDER_ID}/${modelId.slice(
+      BEDROCK_MANTLE_OPENCODE_PROVIDER_ID.length + 1,
+    )}`;
+  }
+
+  if (modelId.startsWith(nativePrefix)) {
+    return `${BEDROCK_MANTLE_OPENAI_OPENCODE_PROVIDER_ID}/${modelId.slice(
+      AMAZON_BEDROCK_OPENCODE_PROVIDER_ID.length + 1,
+    )}`;
+  }
+
+  return modelId;
 }
 
 /**
@@ -919,6 +991,23 @@ function mergeInferenceGatewayProviderConfig(
     );
   }
 
+  const amazonBedrockProvider = getInferenceGatewayProvider(
+    AMAZON_BEDROCK_OPENCODE_PROVIDER_ID,
+  );
+  if (
+    amazonBedrockProvider &&
+    modelIds.some((modelId) =>
+      modelId?.trim().startsWith(`${AMAZON_BEDROCK_OPENCODE_PROVIDER_ID}/`),
+    )
+  ) {
+    merged = rebaseProviderOntoGateway(
+      merged,
+      AMAZON_BEDROCK_OPENCODE_PROVIDER_ID,
+      gatewayUrl,
+      amazonBedrockProvider,
+    );
+  }
+
   // These providers are configured explicitly because OpenCode has no catalog
   // entries for their arbitrary model IDs. Rebase only registered gateway
   // providers: vLLM stays direct until the gateway declares its route.
@@ -1615,16 +1704,20 @@ function resolveModelBackedOpenCodeConfig(
     : providerReasoningConfig;
   const providerConfig = mergeInferenceGatewayProviderConfig(
     mergeAzureCognitiveServicesProviderConfig(
-      mergeBedrockMantleProviderConfig(
-        mergeBedrockMantleOpenAiProviderConfig(
-          mergeOpenAiCompatibleProviderConfig(
-            mergeOpenRouterVariantAliasModels(
-              providerModelConfig,
-              variantAliases,
+      mergeAmazonBedrockProviderConfig(
+        mergeBedrockMantleProviderConfig(
+          mergeBedrockMantleOpenAiProviderConfig(
+            mergeOpenAiCompatibleProviderConfig(
+              mergeOpenRouterVariantAliasModels(
+                providerModelConfig,
+                variantAliases,
+              ),
+              runtimeEnv,
+              configuredModelIds,
+              visionModel ?? effectiveCodingModel,
             ),
             runtimeEnv,
             configuredModelIds,
-            visionModel ?? effectiveCodingModel,
           ),
           runtimeEnv,
           configuredModelIds,
diff --git a/packages/types/src/__tests__/inference-gateway.test.ts b/packages/types/src/__tests__/inference-gateway.test.ts
index c47b61b4f..70ef8dfc9 100644
--- a/packages/types/src/__tests__/inference-gateway.test.ts
+++ b/packages/types/src/__tests__/inference-gateway.test.ts
@@ -54,6 +54,26 @@ describe('inference gateway URL builders', () => {
     );
   });
 
+  it('registers native Amazon Bedrock with its regional runtime endpoint', () => {
+    const provider = getInferenceGatewayProvider('amazon-bedrock');
+
+    expect(provider).toMatchObject({
+      envVarNames: ['AWS_BEARER_TOKEN_BEDROCK'],
+      upstreamBaseUrl: 'https://bedrock-runtime.{region}.amazonaws.com',
+      region: { envVarName: 'AWS_REGION', default: 'us-east-1' },
+      authHeader: { name: 'authorization', scheme: 'bearer' },
+      allowedPaths: ['/model'],
+      allowNestedPaths: true,
+      openCodeBaseUrlSuffix: '',
+    });
+    expect(
+      buildInferenceGatewayOpenCodeBaseUrl(
+        'https://api.example.com/api/inference',
+        provider!,
+      ),
+    ).toBe('https://api.example.com/api/inference/amazon-bedrock');
+  });
+
   it.each([
     [
       'azure',
diff --git a/packages/types/src/__tests__/opencode-reasoning.test.ts b/packages/types/src/__tests__/opencode-reasoning.test.ts
index a7614d0e1..e55261667 100644
--- a/packages/types/src/__tests__/opencode-reasoning.test.ts
+++ b/packages/types/src/__tests__/opencode-reasoning.test.ts
@@ -128,6 +128,54 @@ describe('buildOpenCodeModelReasoningOptions', () => {
     });
   });
 
+  it('maps native Bedrock Claude models like the Anthropic provider', () => {
+    expect(
+      buildOpenCodeModelReasoningOptions(
+        'amazon-bedrock/eu.anthropic.claude-sonnet-5',
+        'high',
+      ),
+    ).toEqual({
+      reasoningConfig: {
+        type: 'adaptive',
+        maxReasoningEffort: 'high',
+        display: 'summarized',
+      },
+    });
+    expect(
+      buildOpenCodeModelReasoningOptions(
+        'amazon-bedrock/anthropic.claude-haiku-4-5-20251001-v1:0',
+        'high',
+      ),
+    ).toEqual({
+      reasoningConfig: { type: 'enabled', budgetTokens: 16_000 },
+    });
+  });
+
+  it('maps native Bedrock Nova reasoning to supported effort levels', () => {
+    expect(
+      buildOpenCodeModelReasoningOptions(
+        'amazon-bedrock/us.amazon.nova-2-lite-v1:0',
+        'medium',
+      ),
+    ).toEqual({
+      reasoningConfig: { type: 'enabled', maxReasoningEffort: 'medium' },
+    });
+    expect(
+      buildOpenCodeModelReasoningOptions(
+        'amazon-bedrock/us.amazon.nova-2-lite-v1:0',
+        'max',
+      ),
+    ).toEqual({
+      reasoningConfig: { type: 'enabled', maxReasoningEffort: 'high' },
+    });
+    expect(
+      buildOpenCodeModelReasoningOptions(
+        'amazon-bedrock/meta.llama3-70b-instruct-v1:0',
+        'medium',
+      ),
+    ).toBeNull();
+  });
+
   it('maps Copilot Claude budget reasoning to thinking_budget', () => {
     expect(
       buildOpenCodeModelReasoningOptions(
diff --git a/packages/types/src/inference-gateway.ts b/packages/types/src/inference-gateway.ts
index b0a185e6b..1ab236900 100644
--- a/packages/types/src/inference-gateway.ts
+++ b/packages/types/src/inference-gateway.ts
@@ -34,6 +34,9 @@ export const BEDROCK_MANTLE_OPENCODE_PROVIDER_ID = 'bedrock-mantle';
 export const BEDROCK_MANTLE_OPENAI_OPENCODE_PROVIDER_ID =
   'bedrock-mantle-openai';
 
+/** OpenCode's native Amazon Bedrock provider id. */
+export const AMAZON_BEDROCK_OPENCODE_PROVIDER_ID = 'amazon-bedrock';
+
 /** Matches valid cloud regions like `us-east-1`. */
 export const INFERENCE_GATEWAY_REGION_PATTERN =
   /^[a-z]{2}(?:-[a-z0-9]+)+-\d+$/u;
@@ -470,6 +473,20 @@ export const INFERENCE_GATEWAY_PROVIDERS: readonly InferenceGatewayProvider[] =
       allowedPaths: OPENAI_RESPONSES_INFERENCE_PATHS,
       openCodeBaseUrlSuffix: '/v1',
     },
+    {
+      id: AMAZON_BEDROCK_OPENCODE_PROVIDER_ID,
+      name: 'Amazon Bedrock',
+      envVarNames: ['AWS_BEARER_TOKEN_BEDROCK'],
+      upstreamBaseUrl: 'https://bedrock-runtime.{region}.amazonaws.com',
+      region: {
+        envVarName: 'AWS_REGION',
+        default: DEFAULT_BEDROCK_MANTLE_REGION,
+      },
+      authHeader: { name: 'authorization', scheme: 'bearer' },
+      allowedPaths: ['/model'],
+      allowNestedPaths: true,
+      openCodeBaseUrlSuffix: '',
+    },
     {
       id: 'openai-compatible',
       name: 'OpenAI-compatible',
diff --git a/packages/types/src/model-provider-config.test.ts b/packages/types/src/model-provider-config.test.ts
index 4ff668d9c..4b855bdaf 100644
--- a/packages/types/src/model-provider-config.test.ts
+++ b/packages/types/src/model-provider-config.test.ts
@@ -457,9 +457,9 @@ describe('SETUP_MODEL_PROVIDER_CATALOG', () => {
     expect(bedrockProvider).toMatchObject({
       label: 'Amazon Bedrock',
       envVarName: 'AWS_BEARER_TOKEN_BEDROCK',
-      envVarLabel: 'Mantle API key',
+      envVarLabel: 'API key',
       credentialHelp: {
-        text: 'Paste a key generated from the Bedrock Mantle API-key console. Switch the AWS console to the same region you enter below before generating it.',
+        text: 'Paste a key generated from the Bedrock API-key console. The same regional key serves native Bedrock and Mantle models.',
         href: 'https://us-east-1.console.aws.amazon.com/bedrock-mantle/api-keys',
         linkLabel: 'Open AWS Bedrock API keys',
       },
diff --git a/packages/types/src/model-provider-config.ts b/packages/types/src/model-provider-config.ts
index 61d8126ad..538e9bdfa 100644
--- a/packages/types/src/model-provider-config.ts
+++ b/packages/types/src/model-provider-config.ts
@@ -606,9 +606,9 @@ export const SETUP_MODEL_PROVIDER_CATALOG = [
     id: 'amazon-bedrock',
     label: 'Amazon Bedrock',
     envVarName: 'AWS_BEARER_TOKEN_BEDROCK',
-    envVarLabel: 'Mantle API key',
+    envVarLabel: 'API key',
     credentialHelp: {
-      text: 'Paste a key generated from the Bedrock Mantle API-key console. Switch the AWS console to the same region you enter below before generating it.',
+      text: 'Paste a key generated from the Bedrock API-key console. The same regional key serves native Bedrock and Mantle models.',
       href: 'https://us-east-1.console.aws.amazon.com/bedrock-mantle/api-keys',
       linkLabel: 'Open AWS Bedrock API keys',
     },
diff --git a/packages/types/src/opencode-reasoning.ts b/packages/types/src/opencode-reasoning.ts
index dedb4cf20..2204e76db 100644
--- a/packages/types/src/opencode-reasoning.ts
+++ b/packages/types/src/opencode-reasoning.ts
@@ -116,6 +116,51 @@ function buildAnthropicReasoningOptions(
   };
 }
 
+function buildAmazonBedrockReasoningOptions(
+  modelID: string,
+  reasoningEffort: ReasoningEffort,
+): Record<string, unknown> | null {
+  const normalizedModelID = modelID.toLowerCase();
+
+  if (normalizedModelID.includes('anthropic.')) {
+    const mode = resolveAnthropicThinkingMode(modelID);
+
+    if (mode === 'budget') {
+      return {
+        reasoningConfig: {
+          type: 'enabled',
+          budgetTokens: ANTHROPIC_THINKING_BUDGET_TOKENS[reasoningEffort],
+        },
+      };
+    }
+
+    return {
+      reasoningConfig: {
+        type: 'adaptive',
+        maxReasoningEffort:
+          mode === 'adaptive-no-xhigh' && reasoningEffort === 'xhigh'
+            ? 'high'
+            : reasoningEffort,
+        ...(mode === 'adaptive' ? { display: 'summarized' } : {}),
+      },
+    };
+  }
+
+  if (normalizedModelID.includes('amazon.nova')) {
+    return {
+      reasoningConfig: {
+        type: 'enabled',
+        maxReasoningEffort:
+          reasoningEffort === 'low' || reasoningEffort === 'medium'
+            ? reasoningEffort
+            : 'high',
+      },
+    };
+  }
+
+  return null;
+}
+
 function buildGitHubCopilotReasoningOptions(
   modelID: string,
   reasoningEffort: ReasoningEffort,
@@ -179,6 +224,13 @@ export function buildOpenCodeModelReasoningOptions(
     return null;
   }
 
+  if (selection.providerID === 'amazon-bedrock') {
+    return buildAmazonBedrockReasoningOptions(
+      selection.modelID,
+      reasoningEffort,
+    );
+  }
+
   switch (selection.providerID) {
     case 'openrouter': {
       // OpenRouter only accepts `xhigh` on OpenAI reasoning models; clamp it

From be10fa583cec910bd8c046bfab36120f9510c8d4 Mon Sep 17 00:00:00 2001
From: "roomote-community[bot]"
 <311835222+roomote-community[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 14:09:18 -0500
Subject: [PATCH 22/24] [Feat] Let operators disable curated integrations
 (#1033)

* feat: add bulk integration disable action

* fix: prevent integrations when deployment disables them

* fix: enforce integration policy for active Linear flows

* test: update Linear env mock for integration policy

* feat: disable curated integrations by default

Flip R_CURATED_INTEGRATIONS_ENABLED to an opt-in policy so curated
integrations stay off unless the operator explicitly enables them.

* test: fix formatting and enable integrations policy in route-policy test

* feat: invert policy to R_CURATED_INTEGRATIONS_DISABLED opt-out

Curated integrations stay enabled for all deployments by default; operators
set R_CURATED_INTEGRATIONS_DISABLED=true to switch the catalog off.

---------

Co-authored-by: Roomote <roomote@roomote.dev>
Co-authored-by: daniel-lxs <ricciodaniel98@gmail.com>
---
 .env.production.example                       |  3 +
 .../linear-active-run-priority.test.ts        | 31 +++++++--
 apps/api/src/handlers/linear/index.ts         |  6 +-
 apps/api/src/handlers/mcp/index.ts            | 18 ++++-
 apps/api/src/handlers/mcp/routing.ts          | 15 +++-
 apps/docs/environment-variables.mdx           |  1 +
 apps/docs/integrations/index.mdx              |  7 ++
 .../callback/__tests__/route.test.ts          | 16 +++++
 .../src/app/api/mcp-oauth/callback/route.ts   |  4 ++
 .../[connectionId]/__tests__/route.test.ts    | 18 +++++
 .../initiate/[connectionId]/route.ts          |  6 ++
 .../app/api/mcp-oauth/replay/[token]/route.ts |  7 ++
 .../components/settings/Integrations.test.tsx | 21 ++++++
 .../src/components/settings/Integrations.tsx  | 17 +++++
 apps/web/src/hooks/mcp-connections/index.ts   |  1 +
 .../useCuratedIntegrationsAvailability.ts     | 11 +++
 .../lib/server/curated-integrations.test.ts   | 20 ++++++
 .../src/lib/server/curated-integrations.ts    | 15 ++++
 apps/web/src/lib/server/env.ts                |  2 +
 .../src/trpc/commands/linear/index.test.ts    |  8 ++-
 .../src/trpc/commands/linear/oauth-setup.ts   |  2 +
 .../trpc/commands/mcp-connections/index.ts    | 22 +++++-
 apps/web/src/trpc/routers/_app.ts             |  5 ++
 docker-compose.production.yml                 |  1 +
 docker-compose.self-host.yml                  |  1 +
 packages/env/src/__tests__/index.test.ts      | 20 ++++++
 packages/env/src/index.ts                     | 19 ++++++
 .../server/routers/linear-sessions.test.ts    | 68 +++++++++++++++++++
 .../sdk/src/server/routers/linear-sessions.ts |  5 ++
 .../server/routers/mcp-connections.test.ts    | 21 ++++++
 .../sdk/src/server/routers/mcp-connections.ts |  9 +++
 31 files changed, 389 insertions(+), 11 deletions(-)
 create mode 100644 apps/web/src/hooks/mcp-connections/useCuratedIntegrationsAvailability.ts
 create mode 100644 apps/web/src/lib/server/curated-integrations.test.ts
 create mode 100644 apps/web/src/lib/server/curated-integrations.ts
 create mode 100644 packages/sdk/src/server/routers/linear-sessions.test.ts

diff --git a/.env.production.example b/.env.production.example
index b1354fd8f..041299408 100644
--- a/.env.production.example
+++ b/.env.production.example
@@ -143,6 +143,9 @@ DEFAULT_COMPUTE_PROVIDER=docker
 # GITLAB_WEBHOOK_SIGNING_TOKEN=
 
 # Optional integrations.
+# Set to true to prevent curated integrations from being configured or used.
+# Existing connections remain stored and become available again once unset.
+# R_CURATED_INTEGRATIONS_DISABLED=true
 # SLACK_APP_ID=
 # R_SLACK_SIGNING_SECRET=
 # R_TELEGRAM_BOT_TOKEN=
diff --git a/apps/api/src/handlers/linear/__tests__/linear-active-run-priority.test.ts b/apps/api/src/handlers/linear/__tests__/linear-active-run-priority.test.ts
index 0325079b0..ca119b35e 100644
--- a/apps/api/src/handlers/linear/__tests__/linear-active-run-priority.test.ts
+++ b/apps/api/src/handlers/linear/__tests__/linear-active-run-priority.test.ts
@@ -16,6 +16,13 @@ const { createLinearAgentRunMock } = vi.hoisted(() => ({
     .mockResolvedValue({ status: 'ok', runId: 77, taskId: 'task-77' }),
 }));
 
+const envState = vi.hoisted(() => ({
+  R_LINEAR_WEBHOOK_SECRET: 'test-linear-secret',
+  R_APP_URL: 'https://app.roomote.example',
+  PREVIEW_PROXY_BASE_URL: 'https://preview.roomote.example',
+  R_CURATED_INTEGRATIONS_DISABLED: false,
+}));
+
 const {
   findLinearDeploymentMcpConnectionByIdentityMock,
   findLinearUserMcpConnectionByIdentityMock,
@@ -40,11 +47,7 @@ vi.mock('@roomote/env', async (importOriginal) => {
 
   return {
     ...actual,
-    Env: {
-      R_LINEAR_WEBHOOK_SECRET: 'test-linear-secret',
-      R_APP_URL: 'https://app.roomote.example',
-      PREVIEW_PROXY_BASE_URL: 'https://preview.roomote.example',
-    },
+    Env: envState,
   };
 });
 
@@ -276,6 +279,24 @@ describe('CLO-1133: active task run takes priority over routing confirmation and
     app = new Hono();
     app.route('/linear', linear);
     vi.clearAllMocks();
+    envState.R_CURATED_INTEGRATIONS_DISABLED = false;
+  });
+
+  it('acknowledges without processing when curated integrations are disabled', async () => {
+    envState.R_CURATED_INTEGRATIONS_DISABLED = true;
+    const { rawBody, headers } = createSignedRequest(makePayload());
+
+    const response = await app.request('/linear', {
+      method: 'POST',
+      headers,
+      body: rawBody,
+    });
+
+    expect(response.status).toBe(204);
+    expect(createLinearAgentRunMock).not.toHaveBeenCalled();
+    expect(
+      findLinearDeploymentMcpConnectionByIdentityMock,
+    ).not.toHaveBeenCalled();
   });
 
   it('delivers free-text reply to active task run even when routing confirmation key exists in Redis', async () => {
diff --git a/apps/api/src/handlers/linear/index.ts b/apps/api/src/handlers/linear/index.ts
index 88dbe8533..f6a7cea4d 100644
--- a/apps/api/src/handlers/linear/index.ts
+++ b/apps/api/src/handlers/linear/index.ts
@@ -12,7 +12,7 @@ import {
   PRODUCT_NAME,
   restoreSnapshotResumeVisiblePromptFields,
 } from '@roomote/types';
-import { Env } from '@roomote/env';
+import { Env, areCuratedIntegrationsDisabled } from '@roomote/env';
 import {
   type RoutingDebugInfo,
   enqueueTask,
@@ -254,6 +254,10 @@ export const linear = new Hono();
  * The handler must emit a "thought" activity within 10 seconds to acknowledge receipt.
  */
 linear.post('/', async (c) => {
+  if (areCuratedIntegrationsDisabled(Env.R_CURATED_INTEGRATIONS_DISABLED)) {
+    return c.body(null, 204);
+  }
+
   const headers = c.req.header();
   const rawBody = await c.req.text();
 
diff --git a/apps/api/src/handlers/mcp/index.ts b/apps/api/src/handlers/mcp/index.ts
index 9ede9cd0b..b71b3b316 100644
--- a/apps/api/src/handlers/mcp/index.ts
+++ b/apps/api/src/handlers/mcp/index.ts
@@ -1,4 +1,5 @@
-import { Hono } from 'hono';
+import { Hono, type MiddlewareHandler } from 'hono';
+import { Env, areCuratedIntegrationsDisabled } from '@roomote/env';
 import { isNativeMcpIntegration, MCP_INTEGRATIONS } from '@roomote/types';
 
 import type { Variables } from '../../types';
@@ -19,6 +20,21 @@ import { vercelMcp } from './vercel';
 
 export const mcp = new Hono<{ Variables: Variables }>();
 
+const requireCuratedIntegrations: MiddlewareHandler<{
+  Variables: Variables;
+}> = async (c, next) => {
+  if (areCuratedIntegrationsDisabled(Env.R_CURATED_INTEGRATIONS_DISABLED)) {
+    return c.notFound();
+  }
+
+  await next();
+};
+
+for (const integration of MCP_INTEGRATIONS) {
+  mcp.use(`/${integration.id}`, requireCuratedIntegrations);
+  mcp.use(`/${integration.id}/*`, requireCuratedIntegrations);
+}
+
 mcp.route('/asana', asanaMcp);
 mcp.route('/grafana', grafanaMcp);
 mcp.route('/linear', linearMcp);
diff --git a/apps/api/src/handlers/mcp/routing.ts b/apps/api/src/handlers/mcp/routing.ts
index 5b41be4f3..3210a0e86 100644
--- a/apps/api/src/handlers/mcp/routing.ts
+++ b/apps/api/src/handlers/mcp/routing.ts
@@ -1,4 +1,5 @@
-import { Hono } from 'hono';
+import { Hono, type MiddlewareHandler } from 'hono';
+import { Env, areCuratedIntegrationsDisabled } from '@roomote/env';
 
 import type { Variables } from '../../types';
 
@@ -15,7 +16,19 @@ import { roomoteMcp } from './roomote';
  */
 export const mcpRouting = new Hono<{ Variables: Variables }>();
 
+const requireCuratedIntegrations: MiddlewareHandler<{
+  Variables: Variables;
+}> = async (c, next) => {
+  if (areCuratedIntegrationsDisabled(Env.R_CURATED_INTEGRATIONS_DISABLED)) {
+    return c.notFound();
+  }
+
+  await next();
+};
+
 mcpRouting.route('/roomote', roomoteMcp);
+mcpRouting.use('/linear', requireCuratedIntegrations);
+mcpRouting.use('/linear/*', requireCuratedIntegrations);
 mcpRouting.route(
   '/linear',
   createLinearMcp({
diff --git a/apps/docs/environment-variables.mdx b/apps/docs/environment-variables.mdx
index 6ee6f6445..2f540d8d5 100644
--- a/apps/docs/environment-variables.mdx
+++ b/apps/docs/environment-variables.mdx
@@ -125,6 +125,7 @@ as per-task auth tokens or workspace paths.
 | `R_INSTANCE_ID`         | Optional             | Stable anonymous deployment identifier sent with telemetry and version checks. Use a random, non-identifying value when overriding it.                                                                                                                                                                                                                                                                                                  |
 | `ROOMOTE_FORCE_TELEMETRY` | Development only   | Force-enables telemetry in development or preview environments when a Ping endpoint is explicitly configured.                                                                                                                                                                                                                                                                                                                           |
 | `R_CLOUD_ENABLED`       | Roomote Cloud only   | Deployment-managed switch for Roomote Cloud behavior, including required anonymous analytics and Cloud support integrations. Do not set this for self-hosted deployments.                                                                                                                                                                                                                                                                |
+| `R_CURATED_INTEGRATIONS_DISABLED` | Optional | Operator policy for the curated **Settings > Integrations** catalog, which is enabled by default. Set to `true` and restart Roomote to prevent those integrations from being configured or used. Existing connections remain stored while disabled and become available again once the value is unset. Communications, source-control, inference, sandbox providers, and environment-defined MCP servers are unaffected. |
 | `R_GITHUB_APP_SLUG`     | GitHub setup         | GitHub App slug used by server-rendered setup and GitHub integration flows.                                                                                                                                                                                                                                                                                                                                                             |
 | `SETUP_TOKEN`           | Required (non-local) | One-time bootstrap token that admits the first admin at `/setup`. Required on every non-local deployment — tokenless bootstrap is allowed only when `NODE_ENV` is not `production` and `R_APP_ENV` is `development`, so anything running with `NODE_ENV=production` needs it. Without it, first-admin bootstrap stays closed so nobody can claim the founding-admin slot by reaching the URL first. Optional only in local development. |
 | `DASHBOARD_PASSWORD`    | Production           | Local fallback/admin password value used by the deployment. Generate a strong secret.                                                                                                                                                                                                                                                                                                                                                   |
diff --git a/apps/docs/integrations/index.mdx b/apps/docs/integrations/index.mdx
index afecc1d97..24fd1d9c9 100644
--- a/apps/docs/integrations/index.mdx
+++ b/apps/docs/integrations/index.mdx
@@ -14,6 +14,13 @@ This section does not list provider categories that have their own setup paths:
 communications providers, source-control providers, inference providers, and
 sandbox providers. Configure those from the provider-specific docs instead.
 
+Deployment operators can prevent every integration in this curated catalog
+from being configured or used by setting
+`R_CURATED_INTEGRATIONS_DISABLED=true` and restarting Roomote. Existing
+connections remain stored but inactive, so unsetting the value restores
+them. This policy does not affect the separate provider categories above or
+MCP servers defined on an environment.
+
 ## Connection patterns
 
 You will usually see one of these setup models:
diff --git a/apps/web/src/app/api/mcp-oauth/callback/__tests__/route.test.ts b/apps/web/src/app/api/mcp-oauth/callback/__tests__/route.test.ts
index abf30c14c..b6bc24a51 100644
--- a/apps/web/src/app/api/mcp-oauth/callback/__tests__/route.test.ts
+++ b/apps/web/src/app/api/mcp-oauth/callback/__tests__/route.test.ts
@@ -171,6 +171,22 @@ describe('GET /api/mcp-oauth/callback', () => {
     expect(discoverOAuthEndpointsMock).not.toHaveBeenCalled();
   });
 
+  it('rejects a pending callback when integrations become disabled', async () => {
+    bootstrapWebRuntimeEnvMock.mockResolvedValue({
+      R_APP_URL: 'http://localhost:13000',
+      R_PUBLIC_URL: 'https://customer.example',
+      R_CURATED_INTEGRATIONS_DISABLED: true,
+    });
+
+    const response = await GET(buildRequest('?code=auth-code&state=state-1'));
+
+    expect(response.headers.get('location')).toBe(
+      'https://customer.example/settings?mcp=error&reason=callback_failed',
+    );
+    expect(consumeOAuthStateMock).not.toHaveBeenCalled();
+    expect(exchangeCodeForTokensMock).not.toHaveBeenCalled();
+  });
+
   it('falls back to R_APP_URL for token exchange redirect_uri when R_PUBLIC_URL is unset', async () => {
     bootstrapWebRuntimeEnvMock.mockResolvedValue({
       R_APP_URL: 'http://localhost:13000',
diff --git a/apps/web/src/app/api/mcp-oauth/callback/route.ts b/apps/web/src/app/api/mcp-oauth/callback/route.ts
index c8e42bb25..1a3e11550 100644
--- a/apps/web/src/app/api/mcp-oauth/callback/route.ts
+++ b/apps/web/src/app/api/mcp-oauth/callback/route.ts
@@ -166,6 +166,10 @@ export async function GET(request: NextRequest) {
   const redirectToResult = (result: McpOAuthResult) =>
     redirectWithMcpResult(webUrl, redirectPath, result, state);
 
+  if (webEnv.R_CURATED_INTEGRATIONS_DISABLED === true) {
+    return redirectToResult({ status: 'error', reason: 'callback_failed' });
+  }
+
   // Handle OAuth errors
   if (error) {
     const reason: McpOAuthErrorReason =
diff --git a/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/__tests__/route.test.ts b/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/__tests__/route.test.ts
index 21eda8459..2c4201233 100644
--- a/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/__tests__/route.test.ts
+++ b/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/__tests__/route.test.ts
@@ -181,6 +181,24 @@ describe('GET /api/mcp-oauth/initiate/[connectionId]', () => {
     });
   });
 
+  it('rejects OAuth before authentication when integrations are disabled', async () => {
+    bootstrapWebRuntimeEnvMock.mockResolvedValue({
+      R_APP_URL: 'http://localhost:13000',
+      R_PUBLIC_URL: 'https://customer.example',
+      R_CURATED_INTEGRATIONS_DISABLED: true,
+    });
+
+    const response = await GET(buildRequest(), {
+      params: Promise.resolve({ connectionId: CONNECTION_ID }),
+    });
+
+    expect(response.headers.get('location')).toBe(
+      'https://customer.example/settings?mcp=error&reason=disabled',
+    );
+    expect(authorizeMock).not.toHaveBeenCalled();
+    expect(mcpConnectionsFindFirstMock).not.toHaveBeenCalled();
+  });
+
   it('uses the Linear API OAuth flow instead of Linear MCP OAuth', async () => {
     getMcpIntegrationOauthEndpointsMock.mockReturnValue({
       authorizationEndpoint: 'https://linear.app/oauth/authorize',
diff --git a/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/route.ts b/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/route.ts
index 126234dd9..638f6d120 100644
--- a/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/route.ts
+++ b/apps/web/src/app/api/mcp-oauth/initiate/[connectionId]/route.ts
@@ -160,6 +160,12 @@ export async function GET(
     DEFAULT_REDIRECT_PATH;
   const replayToken = requestUrl.searchParams.get('replayToken');
 
+  if (webEnv.R_CURATED_INTEGRATIONS_DISABLED === true) {
+    return NextResponse.redirect(
+      withMcpQuery(webUrl, redirectPath, 'error', 'disabled'),
+    );
+  }
+
   const authResult = await authorize();
   if (!authResult.success) {
     return NextResponse.redirect(
diff --git a/apps/web/src/app/api/mcp-oauth/replay/[token]/route.ts b/apps/web/src/app/api/mcp-oauth/replay/[token]/route.ts
index b47041d2c..05cb74077 100644
--- a/apps/web/src/app/api/mcp-oauth/replay/[token]/route.ts
+++ b/apps/web/src/app/api/mcp-oauth/replay/[token]/route.ts
@@ -27,6 +27,13 @@ export async function GET(
   const webEnv = await bootstrapWebRuntimeEnv();
   const webUrl = getPublicAppUrl(webEnv);
   const { token } = await params;
+
+  if (webEnv.R_CURATED_INTEGRATIONS_DISABLED === true) {
+    return NextResponse.redirect(
+      new URL('/error?message=Integrations are disabled', webUrl),
+    );
+  }
+
   const replay = await getMcpOauthReplay(token);
 
   if (!replay) {
diff --git a/apps/web/src/components/settings/Integrations.test.tsx b/apps/web/src/components/settings/Integrations.test.tsx
index 45563600c..9d2ce8baf 100644
--- a/apps/web/src/components/settings/Integrations.test.tsx
+++ b/apps/web/src/components/settings/Integrations.test.tsx
@@ -12,6 +12,7 @@ import { toast } from 'sonner';
 import { MCP_TOOL_CATALOG_REQUIRES_PERSONAL_CONNECTION } from '@/lib/mcp-tool-errors';
 
 const state = vi.hoisted(() => ({
+  integrationsEnabled: true,
   deploymentEnablements: [] as Array<{ mcpId: string; enabled: boolean }>,
   oauthReadiness: [{ mcpId: 'linear', status: 'ready' as const }] as Array<{
     mcpId: string;
@@ -192,6 +193,9 @@ vi.mock('@/hooks/linear', () => ({
 }));
 
 vi.mock('@/hooks/mcp-connections', () => ({
+  useCuratedIntegrationsAvailability: () => ({
+    data: { enabled: state.integrationsEnabled },
+  }),
   useDeploymentMcpEnablements: () => ({
     data: state.deploymentEnablements,
   }),
@@ -429,6 +433,7 @@ describe('Integrations settings', () => {
     vi.clearAllMocks();
     window.history.replaceState(null, '', '/settings/integrations');
     state.deploymentEnablements = [];
+    state.integrationsEnabled = true;
     state.oauthReadiness = [{ mcpId: 'linear', status: 'ready' }];
     state.userConnections = [];
     state.mcpTools = null;
@@ -855,6 +860,22 @@ describe('Integrations settings', () => {
     ).toBeInTheDocument();
   });
 
+  it('shows operator policy instead of integration controls when disabled', () => {
+    state.integrationsEnabled = false;
+
+    render(<Integrations />);
+
+    expect(
+      screen.getByText('Integrations disabled by deployment operator'),
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByRole('heading', { name: 'Connected' }),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByRole('button', { name: 'Disable Linear' }),
+    ).not.toBeInTheDocument();
+  });
+
   it('connects and enables an org-scoped MCP from the integrations page', () => {
     render(<Integrations />);
 
diff --git a/apps/web/src/components/settings/Integrations.tsx b/apps/web/src/components/settings/Integrations.tsx
index ef159afd2..d1850f2c5 100644
--- a/apps/web/src/components/settings/Integrations.tsx
+++ b/apps/web/src/components/settings/Integrations.tsx
@@ -21,6 +21,7 @@ import {
 import {
   useAsanaConnection,
   useConnectMcp,
+  useCuratedIntegrationsAvailability,
   useDisconnectMcp,
   useGrafanaConnection,
   useDeploymentMcpEnablements,
@@ -43,6 +44,9 @@ import {
 } from '@/types';
 
 import {
+  Alert,
+  AlertDescription,
+  AlertTitle,
   BasicTooltip,
   Button,
   Card,
@@ -1148,6 +1152,7 @@ export function Integrations() {
   const disconnectLinear = useDisconnectLinear();
 
   const deploymentEnablements = useDeploymentMcpEnablements();
+  const integrationsAvailability = useCuratedIntegrationsAvailability();
   const oauthReadiness = useMcpOauthReadiness();
   const linearOauthStatus = oauthReadiness.data?.find(
     (entry) => entry.mcpId === 'linear',
@@ -1988,6 +1993,18 @@ export function Integrations() {
     });
   };
 
+  if (integrationsAvailability.data?.enabled === false) {
+    return (
+      <Alert>
+        <AlertTitle>Integrations disabled by deployment operator</AlertTitle>
+        <AlertDescription>
+          Curated integrations cannot be connected or used on this Roomote
+          instance.
+        </AlertDescription>
+      </Alert>
+    );
+  }
+
   return (
     <div className="space-y-8">
       <McpToolManagementDialog
diff --git a/apps/web/src/hooks/mcp-connections/index.ts b/apps/web/src/hooks/mcp-connections/index.ts
index d7133e7d4..cd40b54e7 100644
--- a/apps/web/src/hooks/mcp-connections/index.ts
+++ b/apps/web/src/hooks/mcp-connections/index.ts
@@ -1,5 +1,6 @@
 // Queries
 export { useDeploymentMcpEnablements } from './useDeploymentMcpEnablements';
+export { useCuratedIntegrationsAvailability } from './useCuratedIntegrationsAvailability';
 export { useUserMcpConnections } from './useUserMcpConnections';
 export { useMcpConnectionTools } from './useMcpConnectionTools';
 export { useMcpOauthReadiness } from './useMcpOauthReadiness';
diff --git a/apps/web/src/hooks/mcp-connections/useCuratedIntegrationsAvailability.ts b/apps/web/src/hooks/mcp-connections/useCuratedIntegrationsAvailability.ts
new file mode 100644
index 000000000..b0ad570a6
--- /dev/null
+++ b/apps/web/src/hooks/mcp-connections/useCuratedIntegrationsAvailability.ts
@@ -0,0 +1,11 @@
+'use client';
+
+import { useQuery } from '@tanstack/react-query';
+
+import { useTRPC } from '@/trpc/client';
+
+export function useCuratedIntegrationsAvailability() {
+  const trpc = useTRPC();
+
+  return useQuery(trpc.mcpConnections.availability.queryOptions());
+}
diff --git a/apps/web/src/lib/server/curated-integrations.test.ts b/apps/web/src/lib/server/curated-integrations.test.ts
new file mode 100644
index 000000000..23a090174
--- /dev/null
+++ b/apps/web/src/lib/server/curated-integrations.test.ts
@@ -0,0 +1,20 @@
+import {
+  CURATED_INTEGRATIONS_DISABLED_MESSAGE,
+  assertCuratedIntegrationsEnabled,
+} from './curated-integrations';
+
+describe('assertCuratedIntegrationsEnabled', () => {
+  it('allows the default and non-disabled values', () => {
+    expect(() => assertCuratedIntegrationsEnabled(undefined)).not.toThrow();
+    expect(() => assertCuratedIntegrationsEnabled(false)).not.toThrow();
+  });
+
+  it('rejects operator-disabled integrations', () => {
+    expect(() => assertCuratedIntegrationsEnabled(true)).toThrow(
+      CURATED_INTEGRATIONS_DISABLED_MESSAGE,
+    );
+    expect(() => assertCuratedIntegrationsEnabled('true')).toThrow(
+      CURATED_INTEGRATIONS_DISABLED_MESSAGE,
+    );
+  });
+});
diff --git a/apps/web/src/lib/server/curated-integrations.ts b/apps/web/src/lib/server/curated-integrations.ts
new file mode 100644
index 000000000..558c03920
--- /dev/null
+++ b/apps/web/src/lib/server/curated-integrations.ts
@@ -0,0 +1,15 @@
+import { Env, areCuratedIntegrationsDisabled } from './env';
+
+export const CURATED_INTEGRATIONS_DISABLED_MESSAGE =
+  'Integrations are disabled by the deployment operator.';
+
+export function assertCuratedIntegrationsEnabled(
+  disabledFlag:
+    | string
+    | boolean
+    | undefined = Env.R_CURATED_INTEGRATIONS_DISABLED,
+) {
+  if (areCuratedIntegrationsDisabled(disabledFlag)) {
+    throw new Error(CURATED_INTEGRATIONS_DISABLED_MESSAGE);
+  }
+}
diff --git a/apps/web/src/lib/server/env.ts b/apps/web/src/lib/server/env.ts
index 5904b2348..f988cd908 100644
--- a/apps/web/src/lib/server/env.ts
+++ b/apps/web/src/lib/server/env.ts
@@ -3,6 +3,7 @@ import path from 'node:path';
 
 import * as dotenvx from '@dotenvx/dotenvx';
 import {
+  areCuratedIntegrationsDisabled,
   createRoomoteEnv,
   getAllowedDevOrigins as getSharedAllowedDevOrigins,
   getArtifactSigningKey,
@@ -195,6 +196,7 @@ function getWebRuntimeEnv(): RoomoteEnv {
 }
 
 export {
+  areCuratedIntegrationsDisabled,
   getArtifactSigningKey,
   getArtifactSigningKeyPrevious,
   getBetterAuthSecret,
diff --git a/apps/web/src/trpc/commands/linear/index.test.ts b/apps/web/src/trpc/commands/linear/index.test.ts
index 2799424c6..ca32d9429 100644
--- a/apps/web/src/trpc/commands/linear/index.test.ts
+++ b/apps/web/src/trpc/commands/linear/index.test.ts
@@ -7,7 +7,7 @@ const {
   resolveDeploymentEnvVarMock,
   upsertDeploymentEnvironmentVariablesMock,
 } = vi.hoisted(() => ({
-  envState: {} as Record<string, string | undefined>,
+  envState: {} as Record<string, string | boolean | undefined>,
   deletedConnectionsState: [] as Array<{ id: string }>,
   persistedEnvVarNamesState: [] as string[],
   deleteDeploymentEnvironmentVariablesMock: vi.fn(),
@@ -16,7 +16,11 @@ const {
   upsertDeploymentEnvironmentVariablesMock: vi.fn(),
 }));
 
-vi.mock('@/lib/server/env', () => ({ Env: envState }));
+vi.mock('@/lib/server/env', () => ({
+  Env: envState,
+  areCuratedIntegrationsDisabled: (value: string | boolean | undefined) =>
+    value === true || value === 'true' || value === '1',
+}));
 vi.mock('@/lib/server/get-public-app-url', () => ({
   getPublicAppUrl: () => 'https://roomote.example',
 }));
diff --git a/apps/web/src/trpc/commands/linear/oauth-setup.ts b/apps/web/src/trpc/commands/linear/oauth-setup.ts
index e134c6070..abfaeab9d 100644
--- a/apps/web/src/trpc/commands/linear/oauth-setup.ts
+++ b/apps/web/src/trpc/commands/linear/oauth-setup.ts
@@ -11,6 +11,7 @@ import {
 import { LINEAR_ORG_CONNECTION_ROLE } from '@roomote/sdk/server';
 
 import { Env } from '@/lib/server/env';
+import { assertCuratedIntegrationsEnabled } from '@/lib/server/curated-integrations';
 import { getPublicAppUrl } from '@/lib/server/get-public-app-url';
 import type { UserAuthSuccess } from '@/types';
 
@@ -185,6 +186,7 @@ export async function saveLinearOauthSetupCommand(
   input: SaveLinearOauthSetupInput,
 ) {
   assertAdmin(auth);
+  assertCuratedIntegrationsEnabled();
   const runtimeEnv = getLinearRuntimeEnv();
 
   const currentValues = await Promise.all(
diff --git a/apps/web/src/trpc/commands/mcp-connections/index.ts b/apps/web/src/trpc/commands/mcp-connections/index.ts
index 30d5d799e..5d12237bf 100644
--- a/apps/web/src/trpc/commands/mcp-connections/index.ts
+++ b/apps/web/src/trpc/commands/mcp-connections/index.ts
@@ -34,7 +34,8 @@ import { getValidAccessToken } from '@roomote/sdk/server';
 import type { UserAuthSuccess } from '@/types';
 import type { StaticOauthReadiness } from '@/lib/server/mcp-static-oauth';
 import { getDeploymentStaticOauthReadiness } from '@/lib/server/deployment-static-oauth';
-import { Env } from '@/lib/server/env';
+import { Env, areCuratedIntegrationsDisabled } from '@/lib/server/env';
+import { assertCuratedIntegrationsEnabled } from '@/lib/server/curated-integrations';
 import { MCP_TOOL_CATALOG_REQUIRES_PERSONAL_CONNECTION } from '@/lib/mcp-tool-errors';
 import type {
   SaveAsanaConnectionInput,
@@ -521,6 +522,14 @@ export async function getDeploymentMcpEnablementsCommand(
   });
 }
 
+export function getCuratedIntegrationsAvailabilityCommand() {
+  return {
+    enabled: !areCuratedIntegrationsDisabled(
+      Env.R_CURATED_INTEGRATIONS_DISABLED,
+    ),
+  };
+}
+
 /**
  * Return public-safe OAuth setup status for integrations that require a
  * deployment-configured client. Credential names and values never leave the
@@ -553,6 +562,10 @@ export async function setDeploymentMcpEnabledCommand(
 ) {
   assertAdmin(auth);
 
+  if (input.enabled) {
+    assertCuratedIntegrationsEnabled();
+  }
+
   if (!ALL_DEPLOYMENT_CONTROLLED_APP_IDS.has(input.mcpId)) {
     throw new Error(`Unknown deployment-controlled app: ${input.mcpId}`);
   }
@@ -788,6 +801,7 @@ export async function saveSnowflakeConnectionCommand(
   input: SaveSnowflakeConnectionCommandInput,
 ) {
   assertAdmin(auth);
+  assertCuratedIntegrationsEnabled();
 
   const existingConnection = await db.query.mcpConnections.findFirst({
     where: and(
@@ -937,6 +951,7 @@ export async function saveAsanaConnectionCommand(
   input: SaveAsanaConnectionInput,
 ) {
   assertAdmin(auth);
+  assertCuratedIntegrationsEnabled();
 
   const existingConnection = await db.query.mcpConnections.findFirst({
     where: and(
@@ -1020,6 +1035,7 @@ export async function saveVercelConnectionCommand(
   input: SaveVercelConnectionInput,
 ) {
   assertAdmin(auth);
+  assertCuratedIntegrationsEnabled();
 
   const existingConnection = await db.query.mcpConnections.findFirst({
     where: and(
@@ -1107,6 +1123,7 @@ export async function saveGrafanaConnectionCommand(
   input: SaveGrafanaConnectionInput,
 ) {
   assertAdmin(auth);
+  assertCuratedIntegrationsEnabled();
 
   const existingConnection = await db.query.mcpConnections.findFirst({
     where: and(
@@ -1192,6 +1209,7 @@ export async function listDeploymentMcpIntegrationToolsCommand(
   input: { mcpId: string },
 ) {
   assertAdmin(auth);
+  assertCuratedIntegrationsEnabled();
   const integration = getMcpIntegration(input.mcpId);
   if (!integration) {
     throw new Error(`Unknown MCP integration: ${input.mcpId}`);
@@ -1218,6 +1236,7 @@ export async function setDeploymentDisabledMcpIntegrationToolsCommand(
   input: { mcpId: string; disabledTools: string[] },
 ) {
   assertAdmin(auth);
+  assertCuratedIntegrationsEnabled();
   const integration = getMcpIntegration(input.mcpId);
   if (!integration) {
     throw new Error(`Unknown MCP integration: ${input.mcpId}`);
@@ -1259,6 +1278,7 @@ export async function connectMcpCommand(
   auth: UserAuthSuccess,
   input: { mcpId: string; redirectTo?: string; role?: McpConnectionRole },
 ) {
+  assertCuratedIntegrationsEnabled();
   const integration = getMcpIntegration(input.mcpId);
   if (!integration) {
     throw new Error(`Unknown MCP integration: ${input.mcpId}`);
diff --git a/apps/web/src/trpc/routers/_app.ts b/apps/web/src/trpc/routers/_app.ts
index 958b0180c..f3c18f437 100644
--- a/apps/web/src/trpc/routers/_app.ts
+++ b/apps/web/src/trpc/routers/_app.ts
@@ -190,6 +190,7 @@ import {
 } from '../commands/sandbox-session';
 import {
   getDeploymentMcpEnablementsCommand,
+  getCuratedIntegrationsAvailabilityCommand,
   getMcpOauthReadinessCommand,
   setDeploymentMcpEnabledCommand,
   getUserMcpConnectionsCommand,
@@ -1542,6 +1543,10 @@ export const appRouter = createRouter({
   }),
 
   mcpConnections: createRouter({
+    availability: protectedProcedure.query(() =>
+      getCuratedIntegrationsAvailabilityCommand(),
+    ),
+
     deploymentEnablements: protectedProcedure.query(({ ctx: { auth } }) =>
       getDeploymentMcpEnablementsCommand(auth),
     ),
diff --git a/docker-compose.production.yml b/docker-compose.production.yml
index f9c377755..994a91aa9 100644
--- a/docker-compose.production.yml
+++ b/docker-compose.production.yml
@@ -22,6 +22,7 @@ x-roomote-production-env: &roomote-production-env
   R_APP_URL: https://${ROOMOTE_APP_DOMAIN:?ROOMOTE_APP_DOMAIN is required}
   R_PUBLIC_URL: https://${ROOMOTE_APP_DOMAIN:?ROOMOTE_APP_DOMAIN is required}
   R_INSTANCE_ID: ${R_INSTANCE_ID:-}
+  R_CURATED_INTEGRATIONS_DISABLED: ${R_CURATED_INTEGRATIONS_DISABLED:-false}
   TRPC_URL: http://api:3001
   PREVIEW_PROXY_BASE_URL: https://${ROOMOTE_PREVIEW_DOMAIN:?ROOMOTE_PREVIEW_DOMAIN is required}
   NEXT_PUBLIC_PREVIEW_PROXY_BASE_URL: https://${ROOMOTE_PREVIEW_DOMAIN:?ROOMOTE_PREVIEW_DOMAIN is required}
diff --git a/docker-compose.self-host.yml b/docker-compose.self-host.yml
index 7565540c8..b2f30730e 100644
--- a/docker-compose.self-host.yml
+++ b/docker-compose.self-host.yml
@@ -21,6 +21,7 @@ x-roomote-env: &roomote-env
   S3_BUCKET_ARTIFACTS: ${S3_BUCKET_ARTIFACTS:-roomote-artifacts}
   R_APP_URL: ${R_PUBLIC_URL:-http://localhost:13000}
   R_INSTANCE_ID: ${R_INSTANCE_ID:-}
+  R_CURATED_INTEGRATIONS_DISABLED: ${R_CURATED_INTEGRATIONS_DISABLED:-false}
   TRPC_URL: http://api:3001
   PREVIEW_PROXY_BASE_URL: ${PREVIEW_PROXY_BASE_URL:-http://localhost:18081}
   PREVIEW_DOMAINS: ${PREVIEW_DOMAINS:-localhost,127.0.0.1,roomotepreview.localhost}
diff --git a/packages/env/src/__tests__/index.test.ts b/packages/env/src/__tests__/index.test.ts
index ce498505e..98a991ae6 100644
--- a/packages/env/src/__tests__/index.test.ts
+++ b/packages/env/src/__tests__/index.test.ts
@@ -1,5 +1,6 @@
 import {
   Env,
+  areCuratedIntegrationsDisabled,
   assertSecureBootBinding,
   createRoomoteEnv,
   getActiveInsecureLocalSecrets,
@@ -199,6 +200,25 @@ describe('Env', () => {
     expect(isRoomoteCloudEnabled('false')).toBe(false);
   });
 
+  it('enables curated integrations by default and accepts an operator opt-out', () => {
+    const runtimeEnv = { ...process.env };
+    delete runtimeEnv.SKIP_ENV_VALIDATION;
+    delete runtimeEnv.R_CURATED_INTEGRATIONS_DISABLED;
+
+    expect(createRoomoteEnv(runtimeEnv).R_CURATED_INTEGRATIONS_DISABLED).toBe(
+      false,
+    );
+    expect(
+      createRoomoteEnv({
+        ...runtimeEnv,
+        R_CURATED_INTEGRATIONS_DISABLED: 'true',
+      }).R_CURATED_INTEGRATIONS_DISABLED,
+    ).toBe(true);
+    expect(areCuratedIntegrationsDisabled(undefined)).toBe(false);
+    expect(areCuratedIntegrationsDisabled('1')).toBe(true);
+    expect(areCuratedIntegrationsDisabled('0')).toBe(false);
+  });
+
   it('accepts valid Ping instance IDs and rejects invalid ones', () => {
     const runtimeEnv = { ...process.env };
     delete runtimeEnv.SKIP_ENV_VALIDATION;
diff --git a/packages/env/src/index.ts b/packages/env/src/index.ts
index 5a6cbab9d..7fce23605 100644
--- a/packages/env/src/index.ts
+++ b/packages/env/src/index.ts
@@ -118,6 +118,10 @@ const serverSchema = {
   // Roomote Cloud-only analytics and support integrations. These values are
   // intentionally not used by self-hosted deployments.
   R_CLOUD_ENABLED: optInBoolean(),
+  // Operator policy for the curated Settings > Integrations catalog. Enabled
+  // by default; operators opt out explicitly. Existing connections remain
+  // stored but cannot be configured or used while disabled.
+  R_CURATED_INTEGRATIONS_DISABLED: optInBoolean(),
   R_INTERCOM_APP_ID: z.string().min(1).optional(),
   R_POSTHOG_PROJECT_KEY: z.string().min(1).optional(),
   R_POSTHOG_HOST: z.string().url().optional(),
@@ -566,6 +570,21 @@ export function isRoomoteCloudEnabled(
   );
 }
 
+/**
+ * Whether the operator has switched off curated integrations on this
+ * deployment. Enabled unless explicitly disabled.
+ */
+export function areCuratedIntegrationsDisabled(
+  value: string | boolean | undefined,
+): boolean {
+  if (typeof value === 'string') {
+    const normalized = value.trim().toLowerCase();
+    return normalized === 'true' || normalized === '1';
+  }
+
+  return value === true;
+}
+
 /**
  * Whether the deployment opted into generating missing auth keypairs at boot
  * and persisting them in the database (`R_AUTO_GENERATE_KEYS=true`).
diff --git a/packages/sdk/src/server/routers/linear-sessions.test.ts b/packages/sdk/src/server/routers/linear-sessions.test.ts
new file mode 100644
index 000000000..7a49875a1
--- /dev/null
+++ b/packages/sdk/src/server/routers/linear-sessions.test.ts
@@ -0,0 +1,68 @@
+import type { AuthTokenContext } from '@roomote/types';
+
+const { envState, findConnectionMock, getValidAccessTokenMock } = vi.hoisted(
+  () => ({
+    envState: { R_CURATED_INTEGRATIONS_DISABLED: false },
+    findConnectionMock: vi.fn(),
+    getValidAccessTokenMock: vi.fn(),
+  }),
+);
+
+vi.mock('@roomote/env', () => ({
+  Env: envState,
+  areCuratedIntegrationsDisabled: (value: boolean | undefined) =>
+    value === true,
+}));
+
+vi.mock('@roomote/db/server', () => ({
+  db: { query: { taskRuns: { findFirst: vi.fn() } } },
+  taskRuns: { id: 'taskRuns.id' },
+  eq: vi.fn(),
+}));
+
+vi.mock('@roomote/linear', () => ({
+  createLinearClient: vi.fn(),
+  drainLinearMessagesToResumeRun: vi.fn(),
+}));
+
+vi.mock('../lib/mcp/data', () => ({
+  getValidAccessToken: getValidAccessTokenMock,
+}));
+
+vi.mock('../lib/mcp/linear-connections', () => ({
+  findLinearDeploymentMcpConnection: findConnectionMock,
+  getLinearDeploymentMetadata: vi.fn(),
+}));
+
+import { linearSessionsRouter } from './linear-sessions';
+
+function createCaller() {
+  const auth: AuthTokenContext = {
+    userId: 'user-1',
+    tokenType: 'auth',
+    version: 1,
+  };
+
+  return linearSessionsRouter.createCaller({ auth, req: undefined });
+}
+
+describe('linearSessionsRouter operator policy', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    envState.R_CURATED_INTEGRATIONS_DISABLED = false;
+  });
+
+  it('blocks existing Linear sessions when curated integrations are disabled', async () => {
+    envState.R_CURATED_INTEGRATIONS_DISABLED = true;
+
+    await expect(createCaller().hasActiveConnection()).resolves.toBe(false);
+    await expect(
+      createCaller().emitThought({
+        sessionId: 'session-1',
+        content: 'Working',
+      }),
+    ).rejects.toThrow('Linear connection not found.');
+    expect(findConnectionMock).not.toHaveBeenCalled();
+    expect(getValidAccessTokenMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/sdk/src/server/routers/linear-sessions.ts b/packages/sdk/src/server/routers/linear-sessions.ts
index 1ba826784..392ad5840 100644
--- a/packages/sdk/src/server/routers/linear-sessions.ts
+++ b/packages/sdk/src/server/routers/linear-sessions.ts
@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { Env, areCuratedIntegrationsDisabled } from '@roomote/env';
 
 import { TaskPayloadKind } from '@roomote/types';
 import { db, taskRuns, eq } from '@roomote/db/server';
@@ -21,6 +22,10 @@ import {
 } from '../trpc';
 
 async function findActiveConnection() {
+  if (areCuratedIntegrationsDisabled(Env.R_CURATED_INTEGRATIONS_DISABLED)) {
+    return null;
+  }
+
   return findLinearDeploymentMcpConnection();
 }
 
diff --git a/packages/sdk/src/server/routers/mcp-connections.test.ts b/packages/sdk/src/server/routers/mcp-connections.test.ts
index aa70944dd..80ee051c6 100644
--- a/packages/sdk/src/server/routers/mcp-connections.test.ts
+++ b/packages/sdk/src/server/routers/mcp-connections.test.ts
@@ -1,5 +1,15 @@
 import type { AuthTokenContext, RunTokenContext } from '@roomote/types';
 
+const mockEnv = vi.hoisted(() => ({
+  R_CURATED_INTEGRATIONS_DISABLED: false,
+}));
+
+vi.mock('@roomote/env', () => ({
+  Env: mockEnv,
+  areCuratedIntegrationsDisabled: (value: boolean | undefined) =>
+    value === true,
+}));
+
 const {
   mockFindTaskRun,
   mockFindEnablements,
@@ -178,6 +188,7 @@ function buildEnabledOnlyRow(mcpId: string) {
 describe('mcpConnectionsRouter.getMcpServerConfigs', () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    mockEnv.R_CURATED_INTEGRATIONS_DISABLED = false;
     mockFindTaskRun.mockResolvedValue({
       actingUserId: null,
     });
@@ -186,6 +197,16 @@ describe('mcpConnectionsRouter.getMcpServerConfigs', () => {
     mockOrderBy.mockResolvedValue([buildJoinedConnectionRow()]);
   });
 
+  it('returns no curated servers when the operator disables integrations', async () => {
+    mockEnv.R_CURATED_INTEGRATIONS_DISABLED = true;
+
+    const result = await createCaller().getMcpServerConfigs();
+
+    expect(result).toEqual({ servers: {} });
+    expect(mockSelect).not.toHaveBeenCalled();
+    expect(mockGetValidAccessToken).not.toHaveBeenCalled();
+  });
+
   it('returns Notion proxy config without raw OAuth bearer token', async () => {
     mockGetValidAccessToken.mockResolvedValue('notion-raw-access-token');
 
diff --git a/packages/sdk/src/server/routers/mcp-connections.ts b/packages/sdk/src/server/routers/mcp-connections.ts
index 7f070ea47..ac82b931b 100644
--- a/packages/sdk/src/server/routers/mcp-connections.ts
+++ b/packages/sdk/src/server/routers/mcp-connections.ts
@@ -1,5 +1,6 @@
 import { TRPCError } from '@trpc/server';
 import { z } from 'zod';
+import { Env, areCuratedIntegrationsDisabled } from '@roomote/env';
 import {
   db,
   desc,
@@ -64,6 +65,10 @@ export const mcpConnectionsRouter = router({
       }),
     )
     .query(async ({ input }) => {
+      if (areCuratedIntegrationsDisabled(Env.R_CURATED_INTEGRATIONS_DISABLED)) {
+        return false;
+      }
+
       // Deployment-scoped enablement: valid for any authenticated
       // principal, including deployment-service-principal run tokens.
       const enablement = await db.query.deploymentMcpEnablements.findFirst({
@@ -133,6 +138,10 @@ export const mcpConnectionsRouter = router({
    * Returns a map of sanitized server names to { url, headers }.
    */
   getMcpServerConfigs: authenticatedProcedure.query(async ({ ctx }) => {
+    if (areCuratedIntegrationsDisabled(Env.R_CURATED_INTEGRATIONS_DISABLED)) {
+      return { servers: {} };
+    }
+
     const actorContext = await resolveActorScopedUserContext(ctx.auth);
 
     const connectionFilters = [];

From 4538fadf21a0cf992b0662ff36c92b18f2137f02 Mon Sep 17 00:00:00 2001
From: "roomote-roomote[bot]"
 <301996811+roomote-roomote[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 20:19:47 +0100
Subject: [PATCH 23/24] [Docs] Add copyable Roomote Cookbook recipes (#1035)

* docs: add Roomote Cookbook recipes

* docs: add cookbook recipe issue flow

* docs: refine cookbook recipes

* docs: generate cookbook index from recipes

* docs: standardize cookbook recipe format

* docs: refine cookbook metadata

* docs: simplify cookbook recipes

* docs: format cookbook contributor links

* docs: polish cookbook presentation

* docs: update cookbook contributors

* fixes

* fix: run docs scripts with pinned Mintlify CLI

* fix

---------

Co-authored-by: Roomote <roomote@roomote.dev>
Co-authored-by: Bruno Bergher <bruno@roocode.com>
---
 .github/ISSUE_TEMPLATE/cookbook-recipe.yml    | 103 ++++++++++++++++
 .github/workflows/docs.yml                    |  44 +++++++
 apps/docs/README.md                           |   4 +-
 apps/docs/automations.mdx                     |  16 +++
 apps/docs/cookbook/ci-failure-auto-fix.mdx    |  49 ++++++++
 apps/docs/cookbook/index.mdx                  |  27 +++++
 .../cookbook/product-updates-newsletter.mdx   |  73 ++++++++++++
 apps/docs/cookbook/scheduled-housekeeping.mdx |  83 +++++++++++++
 apps/docs/cookbook/support-channel.mdx        | 111 ++++++++++++++++++
 apps/docs/cookbook/template.mdx               |  74 ++++++++++++
 apps/docs/cookbook/vendor-outage-triage.mdx   |  91 ++++++++++++++
 apps/docs/docs.json                           |   4 +
 apps/docs/integrations/better-stack.mdx       |   4 +
 apps/docs/integrations/grafana.mdx            |   4 +
 apps/docs/integrations/neon.mdx               |   4 +
 apps/docs/integrations/sentry.mdx             |   4 +
 apps/docs/integrations/snowflake.mdx          |   4 +
 apps/docs/integrations/supabase.mdx           |   4 +
 apps/docs/package.json                        |  14 ++-
 apps/docs/scripts/generate-cookbook-index.mjs | 103 ++++++++++++++++
 apps/docs/skills.mdx                          |   3 +
 pnpm-lock.yaml                                |   6 +-
 22 files changed, 822 insertions(+), 7 deletions(-)
 create mode 100644 .github/ISSUE_TEMPLATE/cookbook-recipe.yml
 create mode 100644 .github/workflows/docs.yml
 create mode 100644 apps/docs/cookbook/ci-failure-auto-fix.mdx
 create mode 100644 apps/docs/cookbook/index.mdx
 create mode 100644 apps/docs/cookbook/product-updates-newsletter.mdx
 create mode 100644 apps/docs/cookbook/scheduled-housekeeping.mdx
 create mode 100644 apps/docs/cookbook/support-channel.mdx
 create mode 100644 apps/docs/cookbook/template.mdx
 create mode 100644 apps/docs/cookbook/vendor-outage-triage.mdx
 create mode 100644 apps/docs/scripts/generate-cookbook-index.mjs

diff --git a/.github/ISSUE_TEMPLATE/cookbook-recipe.yml b/.github/ISSUE_TEMPLATE/cookbook-recipe.yml
new file mode 100644
index 000000000..8f12a7dba
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/cookbook-recipe.yml
@@ -0,0 +1,103 @@
+name: Cookbook recipe
+description: Propose a reusable Roomote workflow for the public Cookbook.
+title: "[Cookbook]: "
+labels: ["documentation", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form to propose a complete, reusable Roomote workflow for the Cookbook.
+        Start with the [contributing recipes guide](https://docs.roomote.dev/cookbook/template),
+        paste the completed recipe below, and keep credentials, customer data, and
+        private operational details out of the example.
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Preflight
+      options:
+        - label: I searched the existing Cookbook and docs for a duplicate or closely related recipe.
+          required: true
+        - label: I removed secrets, tokens, private keys, customer data, and private repository details.
+          required: true
+        - label: I stated provider support, permission boundaries, and other limitations plainly.
+          required: true
+  - type: textarea
+    id: recipe
+    attributes:
+      label: Recipe
+      description: Paste the completed Markdown recipe from the contributing recipes guide.
+      placeholder: |
+        ---
+        title: Outcome-first recipe title
+        description: One sentence explaining the finished system and why it matters.
+        icon: lucide-icon-name
+        contributor: Name or team
+        contributor_url: https://example.com/contributor
+        contributor_company: Company
+        contributor_company_url: https://example.com/company
+        ---
+
+        ## Overview
+
+        Explain the recurring problem and the outcome this recipe creates.
+
+        - **Trigger**: Trigger type
+        - **Setup time**: About N minutes
+        - **Requires**: Product access, integrations, permissions
+        - **Serves**: Teams or roles
+        - **Cooked By**: Name or team from Company
+
+        ## Ingredients
+
+        - Ingredient
+
+        ## Steps
+
+        1. First step.
+
+        ## Paste-ready configuration
+
+        ```text
+        Configuration or prompt
+        ```
+
+        ## Variations
+
+        - Variation
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Validation and limitations
+      description: Explain what you tested, which providers or integrations it requires, and any known limitations.
+    validations:
+      required: true
+  - type: input
+    id: contributor
+    attributes:
+      label: Contributor
+      description: Name the person or team contributing this recipe.
+    validations:
+      required: true
+  - type: input
+    id: contributor_url
+    attributes:
+      label: Contributor URL
+      description: Link to the contributor's public profile or website, if available.
+    validations:
+      required: false
+  - type: input
+    id: contributor_company
+    attributes:
+      label: Contributor company
+      description: Name of the contributor's company, if applicable.
+    validations:
+      required: false
+  - type: input
+    id: contributor_company_url
+    attributes:
+      label: Contributor company URL
+      description: Link to the contributor's company website, if available.
+    validations:
+      required: false
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
new file mode 100644
index 000000000..d568c003e
--- /dev/null
+++ b/.github/workflows/docs.yml
@@ -0,0 +1,44 @@
+name: Docs
+
+on:
+  push:
+    branches: [main, develop]
+    paths:
+      - "apps/docs/**"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - ".github/actions/setup-environment/**"
+      - ".github/workflows/docs.yml"
+  pull_request:
+    branches: [main, develop]
+    paths:
+      - "apps/docs/**"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - ".github/actions/setup-environment/**"
+      - ".github/workflows/docs.yml"
+
+permissions:
+  contents: read
+
+env:
+  NODE_VERSION: 24.13.1
+  PNPM_VERSION: 10.29.3
+
+jobs:
+  docs:
+    name: Validate docs
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Setup environment
+        uses: ./.github/actions/setup-environment
+        with:
+          frozen-lockfile: 'true'
+          node-version: ${{ env.NODE_VERSION }}
+          pnpm-version: ${{ env.PNPM_VERSION }}
+      - name: Check generated Cookbook index
+        run: pnpm --filter @roomote/docs check-cookbook-index
+      - name: Validate docs and links
+        run: pnpm --filter @roomote/docs check
diff --git a/apps/docs/README.md b/apps/docs/README.md
index dcaaea11e..b7098508c 100644
--- a/apps/docs/README.md
+++ b/apps/docs/README.md
@@ -20,10 +20,10 @@ and assets all live in this directory and do not depend on `@roomote/web`.
 
 ## Local development
 
-Install the Mintlify CLI (`mint`) globally, then run the dev server:
+The docs scripts download a pinned Mintlify CLI automatically, so no global
+install is required. Run the dev server with:
 
 ```bash
-npm install -g mint
 pnpm --filter @roomote/docs dev
 ```
 
diff --git a/apps/docs/automations.mdx b/apps/docs/automations.mdx
index 185bc476a..1dbb83c80 100644
--- a/apps/docs/automations.mdx
+++ b/apps/docs/automations.mdx
@@ -12,6 +12,10 @@ or a communications provider when an automation depends on those services.
 Automations are most useful when your team already trusts the normal task
 review flow and wants Roomote to keep an eye on repeated work.
 
+<Tip>
+  Unsure of how Automations can help? Get inspiration from the [Cookbook](/cookbook).
+</Tip>
+
 ## Before you turn them on
 
 Make sure the basics are in place:
@@ -93,6 +97,11 @@ automation to test it immediately.
 
 The deployment cap is 25 custom automations.
 
+See [Schedule maintenance](/cookbook/scheduled-housekeeping)
+for three copyable custom automation prompts, or
+[draft a product-updates newsletter](/cookbook/product-updates-newsletter) with
+a custom MCP server and a natural-language schedule.
+
 The **Scheduling timezone** setting is available on both the Automations and
 Deployment settings pages. It applies to all scheduled automations and to
 natural-language schedule interpretation. Existing deployments continue using
@@ -136,6 +145,10 @@ Start with a low-risk channel first. Auto-response can feel noisy if the
 channel mixes casual discussion with requests that should become Roomote
 tasks.
 
+See how channel instructions and launch criteria work together in the
+[vendor outage triage](/cookbook/vendor-outage-triage) and
+[support channel](/cookbook/support-channel) recipes.
+
 ## Manager automations
 
 The manager section controls the shared Manager Channel plus recurring
@@ -228,6 +241,9 @@ For Gitea, repository webhook resync includes the `workflow_run` event so
 Actions completions reach Roomote; host matching uses the deployment
 `GITEA_BASE_URL`.
 
+Follow the [CI failure auto-fix recipe](/cookbook/ci-failure-auto-fix) for a
+copyable noise-control configuration.
+
 ## Add instructions to reduce noise
 
 Several automations include an **Additional instructions** field. Use it to
diff --git a/apps/docs/cookbook/ci-failure-auto-fix.mdx b/apps/docs/cookbook/ci-failure-auto-fix.mdx
new file mode 100644
index 000000000..93c459e67
--- /dev/null
+++ b/apps/docs/cookbook/ci-failure-auto-fix.mdx
@@ -0,0 +1,49 @@
+---
+title: Fix CI failures
+description: Keep the build green by having Roomote verify and fix CI breakages automatically.
+contributor: Matt Rubens
+contributor_url: https://github.com/mrubens
+contributor_company: Roomote
+contributor_company_url: https://roomote.dev
+---
+
+## Overview
+
+When CI fails on your default branch, Roomote reacts immediately. It checks
+that the failure is real, reproduces the failing job inside the repository's
+environment, finds the root cause, opens a PR with the fix, and posts one
+summary to the Manager Channel. The team finds a green PR waiting instead of a
+red branch. This is a built-in automation, so the recipe is one toggle plus
+clear instructions.
+
+- **Trigger**: Webhook
+- **Setup time**: About 10 minutes
+- **Requires**: Admin access, source control, Manager Channel
+- **Serves**: Engineers
+- **Cooked By**: [Matt Rubens](https://github.com/mrubens) from [Roomote](https://roomote.dev)
+
+## Ingredients
+
+- [CI Failure Triage](/automations#manager-automations)
+- A Manager Channel destination configured under **Automation output**
+- An environment for every repository you want triaged. Repositories outside an environment are skipped.
+
+## Steps
+
+1. Set the Manager Channel under **Settings > Automations > Automation output**.
+2. Enable **CI Failure Triage**.
+3. Confirm each repository you care about belongs to a configured environment.
+5. Use **Run now** to test the configuration, or wait for the next default-branch failure.
+
+## Variations
+
+- Keep experimental repositories out of environments to exclude them from triage.
+- Route the summary to a dedicated `#ci-triage` channel instead of the shared Manager Channel.
+
+CI Failure Triage reacts only to failures on the default branch. It supports
+GitHub Actions, GitLab Pipelines, Azure DevOps builds, Bitbucket Pipelines, and
+Gitea Actions. GitLab requires Pipeline Hooks on the webhook, and Bitbucket
+requires the Pipelines OAuth scope.
+
+**Pairs well with:** [scheduled housekeeping](/cookbook/scheduled-housekeeping) ·
+[vendor outage triage](/cookbook/vendor-outage-triage)
diff --git a/apps/docs/cookbook/index.mdx b/apps/docs/cookbook/index.mdx
new file mode 100644
index 000000000..d2172a276
--- /dev/null
+++ b/apps/docs/cookbook/index.mdx
@@ -0,0 +1,27 @@
+---
+title: Cookbook
+icon: cooking-pot
+description: Copyable recipes for turning Roomote automations, skills, and integrations into standing team systems.
+---
+
+Roomote's abilities go way beyond ad hoc prompt → PR interactions. With integrations and automations, you can put many of your team's workflows on autopilot, from investigation to resolution and beyond.
+
+This cookbook collects proven recipes to help you boost your team's productivity
+and the quality of your output.
+
+{/* cookbook-recipes:start */}
+| Recipe | Use to |
+| --- | --- |
+| [Draft product updates](/cookbook/product-updates-newsletter) | Turn recent product work into a customer-ready draft |
+| [Evaluate outage impact](/cookbook/vendor-outage-triage) | Filter vendor status noise by comparing each incident with your real code, regions, and feature usage. |
+| [Fix CI failures](/cookbook/ci-failure-auto-fix) | Keep the build green by having Roomote verify and fix CI breakages automatically. |
+| [Schedule maintenance](/cookbook/scheduled-housekeeping) | Turn flaky-test scans, feature-flag audits, and dependency reviews into recurring Roomote work. |
+| [Triage customer issues](/cookbook/support-channel) | Give support escalations a repeatable path through production evidence, data, and code. |
+{/* cookbook-recipes:end */}
+
+## Contribute a recipe
+
+Have a Roomote workflow other teams could reuse? Start with
+[contributing recipes](/cookbook/template), fill in every section, and open a
+[Cookbook recipe issue](https://github.com/RooCodeInc/Roomote/issues/new?template=cookbook-recipe.yml)
+on the Roomote repository.
diff --git a/apps/docs/cookbook/product-updates-newsletter.mdx b/apps/docs/cookbook/product-updates-newsletter.mdx
new file mode 100644
index 000000000..982015f05
--- /dev/null
+++ b/apps/docs/cookbook/product-updates-newsletter.mdx
@@ -0,0 +1,73 @@
+---
+title: Draft product updates
+description: Turn recent product work into a customer-ready draft
+contributor: Bruno Bergher
+contributor_url: https://github.com/brunobergher
+contributor_company: Roomote
+contributor_company_url: https://roomote.dev
+---
+
+## Overview
+
+Product-update emails are chronically late because someone has to remember what
+shipped, translate commit-speak into customer language, and then fight the
+email tool. This automation does all three: every week it reads merged PRs
+across your product repositories, writes the newsletter, and creates a draft in
+Resend through a custom MCP server, ready for review.
+
+It's how we actually generate the ones we send every Friday.
+
+- **Trigger**: Schedule
+- **Setup time**: About 30 minutes
+- **Requires**: Admin access, custom Resend MCP server
+- **Serves**: PMs, Founders, Marketing
+- **Cooked By**: [Bruno Bergher](https://github.com/brunobergher) from [Roomote](https://roomote.dev)
+
+## Ingredients
+
+- A [custom automation](/automations#custom-automations)
+- An environment covering the product repositories
+- The Resend MCP server configured under **Settings > Integrations**, with a Resend API key
+- A report destination such as `#product-updates`, so the draft lands in a replyable thread
+
+## Steps
+
+1. Add the Resend MCP server and confirm its tools are available in the environment.
+2. Create a custom automation named **Product Updates Newsletter**. Choose **Custom schedule**, enter `Mondays at 9am`, and select the environment.
+3. Paste the prompt below.
+4. Set the report destination to `#product-updates`.
+5. Use **Run now** to generate the first draft, then calibrate its tone by replying in the thread.
+
+## Automation prompt
+
+```text
+Write this week's product-updates newsletter.
+
+1. Collect the PRs merged to the default branch in the last 7 days across the
+   product repositories.
+2. Keep only customer-visible changes: features, improvements, and fixes a
+   user would notice. Skip refactors, internal tooling, and dependency bumps.
+3. Write the newsletter:
+   - a one-line subject
+   - a two-sentence introduction
+   - one short section per change: what is new, why it matters, how to try it
+   Use plain language. Do not include ticket numbers or internal codenames.
+4. Using the Resend MCP server, create a DRAFT broadcast with this content for
+   the "Product updates" audience. Do not send it.
+5. Post the draft content and the Resend draft link in this thread for review.
+
+If nothing customer-visible shipped this week, say so in the thread and skip
+the draft. Do not pad the newsletter.
+```
+
+## Variations
+
+- Without Resend, remove step 4 and post ready-to-paste Markdown for any email tool.
+- Run monthly with `first Monday of the month at 9am`.
+- Use separate automations for customer notes and a technical internal changelog.
+
+This recipe showcases custom MCP servers, natural-language scheduling, and
+replyable automation threads. Review the draft before sending it; the automation
+is deliberately instructed to create a draft, not send a broadcast.
+
+**Pairs well with:** [scheduled housekeeping](/cookbook/scheduled-housekeeping)
diff --git a/apps/docs/cookbook/scheduled-housekeeping.mdx b/apps/docs/cookbook/scheduled-housekeeping.mdx
new file mode 100644
index 000000000..ba7d5f47e
--- /dev/null
+++ b/apps/docs/cookbook/scheduled-housekeeping.mdx
@@ -0,0 +1,83 @@
+---
+title: Schedule maintenance
+description: Turn flaky-test scans, feature-flag audits, and dependency reviews into recurring Roomote work.
+contributor: Bruno Bergher
+contributor_url: https://github.com/brunobergher
+contributor_company: Roomote
+contributor_company_url: https://roomote.dev
+---
+
+## Overview
+
+Every team has maintenance work that only happens when someone feels guilty:
+flaky tests, stale feature flags, and aging dependencies. A custom automation
+turns each chore into a standing appointment: a prompt, a cadence, and a channel
+where results land in a replyable thread. Once you have built one, you will
+start spotting more work that fits the pattern.
+
+- **Trigger**: Schedule
+- **Setup time**: About 15 minutes
+- **Requires**: Admin access
+- **Serves**: Engineers, Leads
+- **Cooked By**: [Bruno Bergher](https://github.com/brunobergher) from [Roomote](https://roomote.dev)
+
+
+## Ingredients
+
+- One [custom automation](/automations#custom-automations) per chore, within the deployment cap of 25
+- One environment per automation
+- A report destination such as `#eng-maintenance`
+
+## Steps
+
+1. Under **Settings > Automations > Custom automations**, create an automation.
+2. Pick a prompt below, choose a cadence, and select the environment. Natural-language schedules such as `weekdays at 9am` are supported under **Custom schedule**.
+3. Set a report destination so results become a conversation rather than a log line.
+4. Use **Run now** to check the first report, then let the schedule take over.
+5. Reply in the thread to steer a run, for example `Open the PR for item 2`, without changing the automation.
+
+## Prompt: flaky tests
+
+Run weekly:
+
+```text
+Find flaky tests. Look at recent CI runs for tests that failed and then passed
+with no related code change. For each suspect, read the test and identify the
+likely cause: timing, shared state, network, or ordering. Report the top 3 with
+evidence. If one has an obvious, safe fix, open a PR for that one only.
+```
+
+## Prompt: stale feature flags
+
+Run weekly or monthly:
+
+```text
+Audit feature flags. List every flag defined in the codebase. Flag the ones
+that are fully rolled out and effectively always on, referenced nowhere, or
+whose code paths are dead. Report which can be removed and what removing them
+simplifies. Open a cleanup PR for at most one clearly dead flag per run.
+```
+
+## Prompt: dependency review
+
+Run weekly:
+
+```text
+Review our dependencies for updates worth taking: security patches first,
+then major versions of core frameworks. For each candidate, summarize what
+changed upstream and the migration risk for our codebase specifically. Do not
+open PRs. End with a ranked shortlist of updates worth scheduling this sprint.
+```
+
+## Variations
+
+- Create a Monday briefing that summarizes open PRs, stale branches, and work waiting on review.
+- Compare `apps/docs` with customer-visible changes shipped in the last week and report documentation drift.
+- Use a model override for heavyweight audits and the deployment default for cheaper checks.
+
+Custom automations also support five-field cron expressions, **Run now**, and
+replyable result threads. Without a report destination, runs are silent and
+their results appear only in the task view.
+
+**Pairs well with:** [CI failure auto-fix](/cookbook/ci-failure-auto-fix) ·
+[product-updates newsletter](/cookbook/product-updates-newsletter)
diff --git a/apps/docs/cookbook/support-channel.mdx b/apps/docs/cookbook/support-channel.mdx
new file mode 100644
index 000000000..9dcf8d3ac
--- /dev/null
+++ b/apps/docs/cookbook/support-channel.mdx
@@ -0,0 +1,111 @@
+---
+title: Triage customer issues
+description: Give support escalations a repeatable path through production evidence, data, and code.
+contributor: John Stearns
+contributor_company: Roo Vet
+contributor_company_url: https://roo.vet
+---
+
+## Overview
+
+Customer-facing teams post escalations into an operations channel, often from a
+ticketing system. A custom skill teaches Roomote your triage procedure: check
+logs, inspect data, read code, and classify the problem as a product bug, a
+data-state issue, or expected behavior. Roomote answers in the thread with
+evidence, and a PR when the resolution is a code fix. Engineers only see what
+survives triage.
+
+- **Trigger**: Channel event
+- **Setup time**: About 45 minutes
+- **Requires**: Admin access, Slack or Discord, observability or data integration
+- **Serves**: Support, Engineers
+- **Cooked By**: John Stearns from [Roo Vet](https://roo.vet)
+
+## Ingredients
+
+- A channel receiving support escalations, such as `#support-inbound`, with Roomote invited
+- [Auto-respond channels](/automations#channel-automations), or a ticketing workflow that mentions Roomote
+- A [custom skill](/skills#when-to-use-a-custom-skill), enabled for the product environment
+- Observability and data integrations such as [Sentry](/integrations/sentry), [Grafana](/integrations/grafana), [Better Stack](/integrations/better-stack), [Supabase](/integrations/supabase), [Neon](/integrations/neon), or [Snowflake](/integrations/snowflake), or a custom MCP server for your stack
+- An environment for the product repositories, with read-only production credentials where integrations do not cover the required system
+
+## Steps
+
+1. Connect the integrations your triage needs under **Settings > Integrations**.
+2. Under **Settings > Skills**, add the custom skill below and enable it for the environment your product runs in.
+3. Add the escalation channel under **Settings > Automations > Auto-respond to channels** and paste the launch criteria.
+4. Repost a resolved historical ticket and compare Roomote's triage with what actually happened.
+5. Tighten the skill with what you learn. The skill is the control you will keep tuning.
+
+## Custom skill
+
+Create a custom skill with these field values. The Roomote UI stores the slug,
+description, and content separately.
+
+**Slug**
+
+```text
+support-investigation
+```
+
+**Description**
+
+```text
+Use when a customer issue or support escalation needs triage: classify it as a
+product bug, a data-state problem, or expected behavior, then resolve it or
+prepare the escalation.
+```
+
+**Content**
+
+```markdown
+When a support escalation arrives:
+
+1. Restate the problem: which customer, which feature, what they expected,
+   and what actually happened.
+2. Check errors first: search Sentry for exceptions matching the feature and
+   time window. Note anything correlated.
+3. Check the data: query the production database with read-only access to
+   inspect the customer's relevant records. Never write to production.
+4. Read the code path involved, then classify:
+   - Product bug: implement the fix and open a PR; link it in the thread.
+   - Data-state problem: identify the exact records and describe the
+     corrective action for an operator. Do not modify data yourself.
+   - Expected behavior or user error: draft a reply the support agent can
+     send, citing the relevant docs.
+5. Reply in the thread with the classification, evidence (queries run, error
+   links, and code references), and the PR, proposed data fix, or reply draft.
+
+Escalate to an engineer only when the fix needs a product decision or a
+production data change.
+```
+
+## Launch criteria
+
+```text
+Launch for messages describing a specific customer-reported problem or support
+escalation, usually posted by the ticketing bot or a support teammate.
+
+Do not launch for general questions, internal discussion, status updates on
+tickets already being worked, or messages that only link a ticket without
+describing the problem.
+
+If an earlier message about the same ticket already launched, launch again
+only if the customer reports the problem recurring after it was thought
+resolved.
+```
+
+## Variations
+
+- Ask Roomote to propose, but not run, a data-repair script as a reviewed PR against an operations repository.
+- Create separate skills by product area, each with a sharper description so the right one activates.
+- On Teams, have the ticketing workflow mention Roomote and name `support-investigation`; auto-respond is not available there today.
+
+This recipe is most valuable with real log and read-only database access. Grant
+scoped, read-only credentials through integrations or environment variables.
+The skill says never to write to production; admins should also enforce the
+boundary with database roles and MCP tool policies. A prompt is not a security
+boundary.
+
+**Pairs well with:** [vendor outage triage](/cookbook/vendor-outage-triage) ·
+[CI failure auto-fix](/cookbook/ci-failure-auto-fix)
diff --git a/apps/docs/cookbook/template.mdx b/apps/docs/cookbook/template.mdx
new file mode 100644
index 000000000..111564f89
--- /dev/null
+++ b/apps/docs/cookbook/template.mdx
@@ -0,0 +1,74 @@
+---
+title: Contributing recipes
+description: Propose a reusable Roomote system for the Cookbook through a repository issue.
+icon: plus
+contributor: Name or team
+contributor_url: https://example.com/contributor
+contributor_company: Company
+contributor_company_url: https://example.com/company
+---
+
+Use this skeleton when proposing a Cookbook recipe. Replace every placeholder
+and remove the comments before opening a
+[Cookbook recipe issue](https://github.com/RooCodeInc/Roomote/issues/new?template=cookbook-recipe.yml).
+Do not open a pull request unless a maintainer invites you to. Fill in the
+contributor fields in the frontmatter and repeat the contributor in the
+Overview metadata. If the recipe comes from another team, use those fields for
+the attribution.
+
+````markdown
+---
+title: Outcome-first recipe title
+description: One sentence explaining the finished system and why it matters.
+icon: lucide-icon-name
+contributor: Name or team
+contributor_url: https://example.com/contributor
+contributor_company: Company
+contributor_company_url: https://example.com/company
+---
+
+## Overview
+
+<!-- Explain the recurring problem and the outcome this recipe creates. -->
+
+Overview paragraph.
+
+- **Trigger**: Trigger type
+- **Setup time**: About N minutes
+- **Requires**: Product access, integrations, permissions
+- **Serves**: Teams or roles
+- **Cooked By**: [Name or team](https://example.com/contributor) from [Company](https://example.com/company)
+
+## Ingredients
+
+<!-- List product features, integrations, permissions, environments, and channels. -->
+
+- Ingredient
+
+## Steps
+
+<!-- Use exact labels and Settings paths from the current product. -->
+
+1. First step.
+
+## Paste-ready configuration
+
+<!-- Name the exact field for every paste block. Never include real credentials. -->
+
+```text
+Configuration or prompt
+```
+
+## Variations
+
+<!-- Offer useful adaptations without turning them into separate recipes. -->
+
+- Variation
+
+<!-- State provider support, permission boundaries, and other limitations plainly. -->
+
+**Pairs well with:** [Related recipe](/cookbook/example)
+````
+
+Before submitting, test every paste block against the current product and make
+sure the recipe never relies on a prompt alone to enforce a security boundary.
diff --git a/apps/docs/cookbook/vendor-outage-triage.mdx b/apps/docs/cookbook/vendor-outage-triage.mdx
new file mode 100644
index 000000000..a2a8627dc
--- /dev/null
+++ b/apps/docs/cookbook/vendor-outage-triage.mdx
@@ -0,0 +1,91 @@
+---
+title: Evaluate outage impact
+description: Filter vendor status noise by comparing each incident with your real code, regions, and feature usage.
+contributor: Matt Rubens
+contributor_url: https://github.com/mrubens
+contributor_company: Roomote
+contributor_company_url: https://roomote.dev
+---
+
+## Overview
+
+Every vendor you depend on publishes status updates, and almost none of them
+affect you, until one does. Pipe them into one channel and let Roomote read each
+incident against your actual code: which SDKs you call, which regions you run
+in, and which features you use. You stop triaging vendor noise by hand and only
+hear about the outages that matter. This is how we run it at Roo.
+
+- **Trigger**: Channel event
+- **Setup time**: About 20 minutes
+- **Requires**: Admin access, Slack or Discord
+- **Serves**: On-call, Support
+- **Cooked By**: [Matt Rubens](https://github.com/mrubens)
+
+## Ingredients
+
+- A Slack or Discord channel such as `#vendor-status` receiving vendor status
+  feeds. Most vendors offer Subscribe via Slack, RSS-to-channel, or
+  email-to-channel.
+- [Auto-respond channels](/automations#channel-automations)
+- An [environment](/environments) covering the repositories that use these
+  vendors
+- Roomote invited to the channel on Slack, or able to see it on Discord
+
+## Steps
+
+1. Create `#vendor-status` and subscribe it to every upstream status page you care about.
+2. Invite Roomote to the channel.
+3. Under **Settings > Automations > Auto-respond to channels**, add the channel.
+4. Paste the launch criteria and instructions below.
+5. Post a fake incident and confirm a task launches. Then post a scheduled-maintenance notice and confirm it does not.
+
+## Launch criteria
+
+Paste this into the channel's **Launch criteria** field:
+
+```text
+Launch only for messages reporting a new incident, a worsening incident, or an
+incident that regressed after being resolved, from one of our upstream vendors.
+
+Do not launch for scheduled-maintenance announcements, "monitoring" or
+"resolved" updates to an incident already investigated, changelog or marketing
+posts, or duplicate notifications about the same incident.
+
+Treat a message as an escalation when it adds affected components, expands
+impact, or reports a worse status than before. When unsure whether an incident
+could plausibly touch something we depend on in production, launch: a wasted
+check is cheaper than a missed outage.
+```
+
+## Instructions
+
+Paste this into the channel's **Instructions** field. Roomote gives these
+instructions to every task launched from the channel.
+
+```text
+A vendor has posted a status incident. Determine whether it affects us:
+
+1. Identify the vendor and the affected components, regions, and features
+   from the message.
+2. Search the codebase for how we actually use this vendor: SDKs, API
+   endpoints, features, and regions we depend on.
+3. Compare our real usage against what the incident says is affected.
+4. Reply in the thread with a clear verdict:
+   - "Affects us": which features or code paths, likely user impact, and a
+     suggested action.
+   - "Safe to ignore": why our usage is not touched.
+
+Keep it short. The on-call engineer reads this thread. Do not page anyone.
+```
+
+## Variations
+
+- Name the vendors explicitly in the criteria to ignore feeds subscribed to just in case.
+- Ask Roomote to describe how to verify recovery whenever the verdict is **Affects us**.
+- Use a multi-repository environment so the usage search covers every service.
+
+Auto-respond channels support Slack and Discord today. On Teams or Telegram,
+forward status events to a supported channel or mention Roomote from a workflow.
+
+**Pairs well with:** [CI failure auto-fix](/cookbook/ci-failure-auto-fix) ·
+[support channel](/cookbook/support-channel)
diff --git a/apps/docs/docs.json b/apps/docs/docs.json
index b9229ce28..c369d0646 100644
--- a/apps/docs/docs.json
+++ b/apps/docs/docs.json
@@ -48,6 +48,10 @@
         "group": "Using Roomote",
         "pages": ["how-roomote-works", "use-cases", "tasks", "file-attachments"]
       },
+      {
+        "group": "Cookbook",
+        "pages": ["cookbook/index", "cookbook/template"]
+      },
       {
         "group": "Provider Configuration",
         "pages": [
diff --git a/apps/docs/integrations/better-stack.mdx b/apps/docs/integrations/better-stack.mdx
index 7778e3eef..62cc38b66 100644
--- a/apps/docs/integrations/better-stack.mdx
+++ b/apps/docs/integrations/better-stack.mdx
@@ -23,3 +23,7 @@ Admins connect Better Stack once from **Settings > Integrations**.
 Roomote uses Better Stack as task context for investigation and triage. Code
 changes, validation, and review still happen through the normal Roomote task and
 repository workflow.
+
+## Recipes using this
+
+- [Triage customer issues](/cookbook/support-channel)
diff --git a/apps/docs/integrations/grafana.mdx b/apps/docs/integrations/grafana.mdx
index c1147bdd0..32c0c0a91 100644
--- a/apps/docs/integrations/grafana.mdx
+++ b/apps/docs/integrations/grafana.mdx
@@ -25,3 +25,7 @@ instance URL and a shared service account token.
 The current Grafana integration is read-only. It gives Roomote monitoring
 context during a task, but it does not create dashboards, edit alerts, or change
 Grafana configuration.
+
+## Recipes using this
+
+- [Triage customer issues](/cookbook/support-channel)
diff --git a/apps/docs/integrations/neon.mdx b/apps/docs/integrations/neon.mdx
index e7236bcf8..08c2a3310 100644
--- a/apps/docs/integrations/neon.mdx
+++ b/apps/docs/integrations/neon.mdx
@@ -23,3 +23,7 @@ need it.
 
 Neon gives Roomote database context inside the task. Keep any repository changes
 and human review on the normal Roomote and Git workflow.
+
+## Recipes using this
+
+- [Triage customer issues](/cookbook/support-channel)
diff --git a/apps/docs/integrations/sentry.mdx b/apps/docs/integrations/sentry.mdx
index bd4e5c7c9..3d63d153e 100644
--- a/apps/docs/integrations/sentry.mdx
+++ b/apps/docs/integrations/sentry.mdx
@@ -22,3 +22,7 @@ Admins connect Sentry once from **Settings > Integrations**.
 Sentry gives Roomote incident and performance context during a task. It can also
 support scheduled read-only Sentry triage. The final decision, code change, and
 review still happen in the normal task and repository flow.
+
+## Recipes using this
+
+- [Triage customer issues](/cookbook/support-channel)
diff --git a/apps/docs/integrations/snowflake.mdx b/apps/docs/integrations/snowflake.mdx
index 1490ab1c0..dfc1bc6be 100644
--- a/apps/docs/integrations/snowflake.mdx
+++ b/apps/docs/integrations/snowflake.mdx
@@ -32,3 +32,7 @@ when the key is encrypted.
 Snowflake provides shared data warehouse context inside Roomote tasks.
 Engineering changes and approvals still happen through your normal task and
 repository review flow.
+
+## Recipes using this
+
+- [Triage customer issues](/cookbook/support-channel)
diff --git a/apps/docs/integrations/supabase.mdx b/apps/docs/integrations/supabase.mdx
index fbc8ec20e..8581ff3c9 100644
--- a/apps/docs/integrations/supabase.mdx
+++ b/apps/docs/integrations/supabase.mdx
@@ -23,3 +23,7 @@ when they need it.
 
 Supabase gives Roomote read-only database context during a task. Code changes,
 migrations, and review still go through your normal engineering workflow.
+
+## Recipes using this
+
+- [Triage customer issues](/cookbook/support-channel)
diff --git a/apps/docs/package.json b/apps/docs/package.json
index 8723bb0ca..8ce330940 100644
--- a/apps/docs/package.json
+++ b/apps/docs/package.json
@@ -3,9 +3,15 @@
   "version": "0.0.3",
   "private": true,
   "scripts": {
-    "dev": "mint dev",
-    "validate": "mint validate",
-    "check-links": "mint broken-links",
-    "check": "mint validate && mint broken-links"
+    "generate-cookbook-index": "node scripts/generate-cookbook-index.mjs",
+    "check-cookbook-index": "node scripts/generate-cookbook-index.mjs --check",
+    "dev": "pnpm run generate-cookbook-index && pnpm dlx --package mint@4.2.650 mint dev",
+    "validate": "pnpm run generate-cookbook-index && pnpm dlx --package mint@4.2.650 mint validate",
+    "check-links": "pnpm dlx --package mint@4.2.650 mint broken-links",
+    "check": "pnpm run validate && pnpm run check-links",
+    "build": "pnpm run generate-cookbook-index && pnpm dlx --package mint@4.2.650 mint validate"
+  },
+  "dependencies": {
+    "yaml": "^2.9.0"
   }
 }
diff --git a/apps/docs/scripts/generate-cookbook-index.mjs b/apps/docs/scripts/generate-cookbook-index.mjs
new file mode 100644
index 000000000..dd85ff042
--- /dev/null
+++ b/apps/docs/scripts/generate-cookbook-index.mjs
@@ -0,0 +1,103 @@
+import { readdir, readFile, writeFile } from 'node:fs/promises';
+import { basename, dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parse } from 'yaml';
+
+const scriptDirectory = dirname(fileURLToPath(import.meta.url));
+const cookbookDirectory = join(scriptDirectory, '..', 'cookbook');
+const indexPath = join(cookbookDirectory, 'index.mdx');
+const tableStart = '{/* cookbook-recipes:start */}';
+const tableEnd = '{/* cookbook-recipes:end */}';
+
+const requiredFields = ['title', 'description', 'contributor'];
+
+function parseFrontmatter(source, fileName) {
+  const match = source.match(/^---\s*\n([\s\S]*?)\n---\s*(?:\n|$)/);
+
+  if (!match) {
+    throw new Error(`Missing frontmatter in ${fileName}`);
+  }
+
+  const metadata = parse(match[1]);
+
+  for (const field of requiredFields) {
+    if (typeof metadata[field] !== 'string' || metadata[field].trim() === '') {
+      throw new Error(`Missing ${field} in ${fileName}`);
+    }
+  }
+
+  return metadata;
+}
+
+function escapeTableCell(value) {
+  return value.replaceAll('|', '\\|').replaceAll('\n', ' ').trim();
+}
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function renderLinkedValue(value, url) {
+  const text = escapeTableCell(value);
+  return url ? `[${text}](${url})` : text;
+}
+
+async function readRecipe(fileName) {
+  const source = await readFile(join(cookbookDirectory, fileName), 'utf8');
+  const metadata = parseFrontmatter(source, fileName);
+  const slug = `/cookbook/${basename(fileName, '.mdx')}`;
+
+  return {
+    title: metadata.title,
+    description: metadata.description,
+    contributor: metadata.contributor,
+    contributorUrl: metadata.contributor_url,
+    contributorCompany: metadata.contributor_company,
+    contributorCompanyUrl: metadata.contributor_company_url,
+    slug,
+  };
+}
+
+function renderTable(recipes) {
+  const rows = recipes
+    .sort((left, right) => left.title.localeCompare(right.title))
+    .map((recipe) => {
+      return `| [${escapeTableCell(recipe.title)}](${recipe.slug}) | ${escapeTableCell(recipe.description)} |`;
+    });
+
+  return ['| Recipe | Use to |', '| --- | --- |', ...rows].join(
+    '\n',
+  );
+}
+
+const recipeFiles = (await readdir(cookbookDirectory))
+  .filter((fileName) => fileName.endsWith('.mdx'))
+  .filter((fileName) => !['index.mdx', 'template.mdx'].includes(fileName))
+  .sort();
+const recipes = await Promise.all(recipeFiles.map(readRecipe));
+const indexSource = await readFile(indexPath, 'utf8');
+const tablePattern = new RegExp(
+  `${escapeRegExp(tableStart)}[\\s\\S]*?${escapeRegExp(tableEnd)}`,
+);
+
+if (!tablePattern.test(indexSource)) {
+  throw new Error('Cookbook index is missing the generated table markers');
+}
+
+const generatedTable = `${tableStart}\n${renderTable(recipes)}\n${tableEnd}`;
+const nextIndexSource = indexSource.replace(tablePattern, generatedTable);
+const checkOnly = process.argv.includes('--check');
+
+if (nextIndexSource !== indexSource) {
+  if (checkOnly) {
+    console.error(
+      'Cookbook index is out of date; run generate-cookbook-index.',
+    );
+    process.exitCode = 1;
+  } else {
+    await writeFile(indexPath, nextIndexSource);
+    console.log(`Updated cookbook index with ${recipes.length} recipes`);
+  }
+} else {
+  console.log(`Cookbook index is up to date with ${recipes.length} recipes`);
+}
diff --git a/apps/docs/skills.mdx b/apps/docs/skills.mdx
index 91318deca..d8be6d2fd 100644
--- a/apps/docs/skills.mdx
+++ b/apps/docs/skills.mdx
@@ -47,6 +47,9 @@ Good custom skills include:
 - a database migration review guide
 - a customer-escalation triage playbook
 
+The [support channel recipe](/cookbook/support-channel) shows a complete custom
+skill with launch criteria and a production-safe investigation flow.
+
 If the instruction is only one sentence, it probably belongs in
 [Agent Guidance](/agent-guidance),
 [environment guidance](/environments), or the task prompt instead.
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b785dcc49..4219f5bc3 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -451,7 +451,11 @@ importers:
         specifier: ^4.1.1
         version: 4.1.1(@edge-runtime/vm@3.2.0)(@opentelemetry/api@1.9.1)(@types/node@24.13.1)(jsdom@26.1.0(bufferutil@4.1.0)(utf-8-validate@6.0.6))(vite@7.3.5(@types/node@24.13.1)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.48.0)(tsx@4.20.4)(yaml@2.9.0))
 
-  apps/docs: {}
+  apps/docs:
+    dependencies:
+      yaml:
+        specifier: ^2.9.0
+        version: 2.9.0
 
   apps/preview-proxy:
     dependencies:

From cff848cb3693b2a18803db3f547753cbd368414c Mon Sep 17 00:00:00 2001
From: "roomote-roomote[bot]"
 <301996811+roomote-roomote[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 15:35:00 -0400
Subject: [PATCH 24/24] Release Roomote 0.31.0 (#1059)

Co-authored-by: Matt Rubens <2600+mrubens@users.noreply.github.com>
---
 .../aca-sandboxes-sleep-wake-remediation.md   |  5 ---
 .../chatgpt-device-auth-terminal-states.md    | 11 ------
 .changeset/shared-device-code-flow-hook.md    |  7 ----
 .changeset/task-view-command-output.md        |  5 ---
 CHANGELOG.md                                  | 34 +++++++++++++++++++
 package.json                                  |  2 +-
 6 files changed, 35 insertions(+), 29 deletions(-)
 delete mode 100644 .changeset/aca-sandboxes-sleep-wake-remediation.md
 delete mode 100644 .changeset/chatgpt-device-auth-terminal-states.md
 delete mode 100644 .changeset/shared-device-code-flow-hook.md
 delete mode 100644 .changeset/task-view-command-output.md

diff --git a/.changeset/aca-sandboxes-sleep-wake-remediation.md b/.changeset/aca-sandboxes-sleep-wake-remediation.md
deleted file mode 100644
index 0437ac167..000000000
--- a/.changeset/aca-sandboxes-sleep-wake-remediation.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@roomote/web': patch
----
-
-Fix an Azure Container Apps Sandboxes sleep/wake loop where waking a suspended task repeatedly died on "waking up" and sandboxes never stayed suspended. Workers revived from a suspended sandbox now terminate themselves once the server reports their run as finalized (instead of idling as zombies holding the sandbox-server port), resume launches reap leftover workers before booting the new one, retained standby sandboxes found Running are re-suspended automatically, runs whose sandboxes were deleted are finalized instead of retried forever, and sandbox ports use Manual activation so inbound traffic no longer wakes sandboxes out-of-band.
diff --git a/.changeset/chatgpt-device-auth-terminal-states.md b/.changeset/chatgpt-device-auth-terminal-states.md
deleted file mode 100644
index bef7482fa..000000000
--- a/.changeset/chatgpt-device-auth-terminal-states.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-'@roomote/types': patch
-'@roomote/db': patch
-'@roomote/web': patch
----
-
-Fix the ChatGPT subscription connect dialog waiting forever on a device code that can never succeed. The device-code endpoint returns an `expires_at` roughly fifteen minutes out, but Roomote dropped it and the dialog had no expiry timer, so once a code aged out the dialog kept polling a dead code behind a "Waiting for authorization…" spinner with no way to tell that the code was gone. The dialog now stops at the issuer's stated expiry and prompts for a restart.
-
-Polling also treated every HTTP 403 and 404 from the device-token endpoint as "pending". Only 403 with the structured error code `deviceauth_authorization_pending` actually means the user has not entered the code yet: 404 means the issuer no longer recognizes the code, and a 403 carrying any other code is a refusal that waiting cannot resolve, most commonly an organization policy blocking the OAuth app. Polling now classifies on the structured error code and gives each terminal case its own message, so a blocked deployment says the workspace policy blocks the app and to contact an admin instead of rendering the same spinner as a code nobody has typed in yet. An unrecognized error body still falls back to pending, now bounded by the expiry deadline rather than looping indefinitely.
-
-Rate-limited polls back off instead of failing, and a rejected poll request surfaces its error in the dialog rather than stopping the loop while leaving the promise unhandled.
diff --git a/.changeset/shared-device-code-flow-hook.md b/.changeset/shared-device-code-flow-hook.md
deleted file mode 100644
index 965898f14..000000000
--- a/.changeset/shared-device-code-flow-hook.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-'@roomote/web': patch
----
-
-Extract the OAuth device-code polling lifecycle shared by the ChatGPT, xAI, and GitHub Copilot connect dialogs into one `useDeviceCodeFlow` hook, leaving each dialog a thin presentational shell that supplies its provider-specific mutations, query invalidations, and copy. The three dialogs had drifted: each reimplemented the start-once guard, expiry deadline, slow-down backoff, and terminal states with small differences.
-
-The hook combines the strongest behavior from each implementation. From the ChatGPT dialog: the client-side expiry deadline, distinct failure reasons driving dedicated copy, rate-limit backoff, and surfacing a rejected poll instead of leaving the promise unhandled. From the xAI dialog: monotonic generation-counter cancellation instead of a shared boolean, closing a race where cancelling and quickly reopening a dialog could revive a stale polling loop still holding the previous device code. The xAI and GitHub Copilot dialogs gain that race protection plus the polished terminal handling, and all three now hide the dead device code once a terminal error is shown instead of leaving it next to the error message.
diff --git a/.changeset/task-view-command-output.md b/.changeset/task-view-command-output.md
deleted file mode 100644
index 45375656f..000000000
--- a/.changeset/task-view-command-output.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@roomote/web': patch
----
-
-Show command output again in the web task view. Terminal commands render their output as a collapsible block (collapsed by default, capped at 400px) with a copy button, and expanded details are restored for command items inside grouped tool calls. Expanded file-read contents remain hidden.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 85736fb7d..ca6363986 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,40 @@
 
 This file tracks product releases for Roomote (single monorepo version). Automated release entries are prepended by `pnpm run version`.
 
+## 0.31.0 (2026-08-03)
+
+This release expands Amazon Bedrock and deployment controls, refreshes Automations and self-hosted licensing, and adds copyable Cookbook recipes for common workflows.
+
+### Highlights
+
+- Use native Amazon Bedrock Runtime models alongside Mantle, including regional inference profiles and supported reasoning settings.
+- Find and manage custom and built-in automations through a redesigned, filterable Automations experience.
+- Disable curated integrations through a deployment policy without deleting saved credentials or affecting other provider types.
+- Copy ready-to-use Cookbook recipes for outage triage, support investigations, CI fixes, product updates, and scheduled maintenance.
+
+### Minor changes
+
+- Redesign Automations settings around scannable Custom, Enabled, and Available sections, with permalinked configuration dialogs, responsive custom automation controls, and category and provider-aware filtering.
+- Let deployment operators disable the curated integrations catalog and its existing connections through an environment policy without deleting saved credentials or affecting other provider types.
+- Let operators use native Amazon Bedrock Runtime models alongside Mantle, including regional inference profiles and supported reasoning settings, without changing existing Mantle configurations.
+- Add direct Roomote Cloud purchase and renewal paths to self-hosted License settings, including low-seat and upcoming-expiry guidance for administrators.
+- Show useful, dismissible product tips alongside task startup progress so users can discover Roomote capabilities while an environment boots.
+- Add a copyable Roomote Cookbook with ready-to-use recipes for vendor outage triage, support investigations, CI failure fixes, product update newsletters, and scheduled maintenance.
+
+### Patch changes
+
+- Keep Azure Container Apps sandboxes suspended until Roomote deliberately wakes them, recover cleanly from leftover workers, and stop retrying runs whose sandboxes were deleted. Thanks to @tebieshi for contributing this improvement.
+- Stop ChatGPT subscription connections from waiting forever on expired or blocked device codes, explain why authorization stopped, and offer a clean restart. Thanks to @daniel-lxs for contributing this improvement.
+- Recommend Claude Sonnet 5 at medium reasoning for code review when operators apply supported provider presets, while retaining Opus for planning.
+- Keep Discord task requests through account linking, focus onboarding on the required personal account connection, and preserve automation reply threads when tasks resume.
+- Keep the Users settings invite list focused on links that still have uses remaining while retaining consumed invite records.
+- Add a direct Personal settings shortcut to the signed-in user menu.
+- Make ChatGPT, xAI, and GitHub Copilot device connections handle expiry, rate limits, restarts, and stale polling consistently, with clearer terminal errors across all three providers. Thanks to @daniel-lxs for contributing this improvement.
+- Give sandbox providers more time to finish rate-limited starts before aborting, and offer a retry when a task start fails before producing output.
+- Show terminal command output again in the web task view, with collapsible details and a copy button for easier inspection.
+- Restore the previous deployment metadata and controller after a failed self-hosted image pull so operators can retry upgrades without breaking the next backup.
+- Make UI proof reject obvious visual defects elsewhere in captured frames instead of accepting evidence that only satisfies the focal claim.
+
 ## 0.30.2 (2026-08-03)
 
 This patch improves GitHub App recovery and Discord automation follow-ups, refreshes the DeepSeek recommendation, and retires the current experimental toggles.
diff --git a/package.json b/package.json
index 38a979dad..53f08cfb8 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "roomote",
-  "version": "0.30.2",
+  "version": "0.31.0",
   "license": "FCL-1.0-ALv2",
   "packageManager": "pnpm@10.29.3",
   "engines": {