diff --git a/Cargo.lock b/Cargo.lock
index 8133cafdc..7b030cd71 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -583,14 +583,14 @@ dependencies = [
 
 [[package]]
 name = "axum"
-version = "0.7.9"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
- "async-trait",
  "axum-core",
  "base64 0.22.1",
  "bytes",
+ "form_urlencoded",
  "futures-util",
  "http",
  "http-body",
@@ -603,15 +603,14 @@ dependencies = [
  "mime",
  "percent-encoding",
  "pin-project-lite",
- "rustversion",
- "serde",
+ "serde_core",
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
  "sha1",
  "sync_wrapper",
  "tokio",
- "tokio-tungstenite 0.24.0",
+ "tokio-tungstenite 0.29.0",
  "tower 0.5.3",
  "tower-layer",
  "tower-service",
@@ -620,19 +619,17 @@ dependencies = [
 
 [[package]]
 name = "axum-core"
-version = "0.4.5"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
 dependencies = [
- "async-trait",
  "bytes",
- "futures-util",
+ "futures-core",
  "http",
  "http-body",
  "http-body-util",
  "mime",
  "pin-project-lite",
- "rustversion",
  "sync_wrapper",
  "tower-layer",
  "tower-service",
@@ -5470,9 +5467,9 @@ dependencies = [
 
 [[package]]
 name = "matchit"
-version = "0.7.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
 name = "matrixmultiply"
@@ -8135,7 +8132,7 @@ dependencies = [
  "tokio-rustls",
  "tokio-util",
  "tower 0.5.3",
- "tower-http",
+ "tower-http 0.6.11",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -8180,7 +8177,7 @@ dependencies = [
  "tokio-rustls",
  "tokio-util",
  "tower 0.5.3",
- "tower-http",
+ "tower-http 0.6.11",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -10659,26 +10656,26 @@ dependencies = [
 
 [[package]]
 name = "tokio-tungstenite"
-version = "0.24.0"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9"
+checksum = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857"
 dependencies = [
  "futures-util",
  "log",
  "tokio",
- "tungstenite 0.24.0",
+ "tungstenite 0.28.0",
 ]
 
 [[package]]
 name = "tokio-tungstenite"
-version = "0.28.0"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857"
+checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
 dependencies = [
  "futures-util",
  "log",
  "tokio",
- "tungstenite 0.28.0",
+ "tungstenite 0.29.0",
 ]
 
 [[package]]
@@ -10908,6 +10905,21 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "tower-http"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b11f75e912b0c2be01b63d8cf8057b8c3f97cf34abb3d431a3a4c8675498e233"
+dependencies = [
+ "bitflags 2.12.1",
+ "bytes",
+ "http",
+ "percent-encoding",
+ "pin-project-lite",
+ "tower-layer",
+ "tower-service",
+]
+
 [[package]]
 name = "tower-layer"
 version = "0.3.3"
@@ -11109,27 +11121,26 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "tungstenite"
-version = "0.24.0"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18e5b8366ee7a95b16d32197d0b2604b43a0be89dc5fac9f8e96ccafbaedda8a"
+checksum = "8628dcc84e5a09eb3d8423d6cb682965dea9133204e8fb3efee74c2a0c259442"
 dependencies = [
- "byteorder",
  "bytes",
  "data-encoding",
  "http",
  "httparse",
  "log",
- "rand 0.8.6",
+ "rand 0.9.4",
  "sha1",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "utf-8",
 ]
 
 [[package]]
 name = "tungstenite"
-version = "0.28.0"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8628dcc84e5a09eb3d8423d6cb682965dea9133204e8fb3efee74c2a0c259442"
+checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
 dependencies = [
  "bytes",
  "data-encoding",
@@ -11139,7 +11150,6 @@ dependencies = [
  "rand 0.9.4",
  "sha1",
  "thiserror 2.0.18",
- "utf-8",
 ]
 
 [[package]]
@@ -11669,7 +11679,7 @@ dependencies = [
  "serde",
  "serde_json",
  "tokio",
- "tower-http",
+ "tower-http 0.7.0",
  "tracing",
  "tracing-subscriber",
  "uuid 1.23.4",
@@ -11898,7 +11908,7 @@ dependencies = [
  "tokio-tungstenite 0.28.0",
  "toml 0.8.23",
  "tower 0.4.13",
- "tower-http",
+ "tower-http 0.7.0",
  "tracing",
  "tracing-opentelemetry",
  "tracing-subscriber",
diff --git a/Cargo.toml b/Cargo.toml
index 2f0652388..98f56dee2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -88,9 +88,9 @@ portable-pty = "0.9"
 uuid = { version = "1", features = ["v4"] }
 
 # HTTP server (daemon mode)
-axum = "0.7"
+axum = "0.8"
 tower = { version = "0.4", features = ["util"] }
-tower-http = { version = "0.6", features = ["cors", "set-header"] }
+tower-http = { version = "0.7", features = ["cors", "set-header"] }
 
 # SQLite (session store)
 rusqlite = { version = "0.40", features = ["bundled"] }
diff --git a/vibe-indexer/src/main.rs b/vibe-indexer/src/main.rs
index ae961f9c7..d0c1c413f 100644
--- a/vibe-indexer/src/main.rs
+++ b/vibe-indexer/src/main.rs
@@ -9,7 +9,7 @@
 //! | Method | Path                  | Description                          |
 //! |--------|-----------------------|--------------------------------------|
 //! | POST   | `/index`              | Start a new indexing job             |
-//! | GET    | `/index/status/:id`   | Poll job progress                    |
+//! | GET    | `/index/status/{id}`   | Poll job progress                    |
 //! | POST   | `/search`             | Semantic search over indexed content |
 //! | GET    | `/health`             | Liveness probe                       |
 //!
@@ -205,7 +205,7 @@ async fn start_index(
     .into_response()
 }
 
-/// GET /index/status/:id — poll a job.
+/// GET /index/status/{id} — poll a job.
 async fn index_status(
     State(state): State<Arc<AppState>>,
     Path(id): Path<String>,
@@ -365,7 +365,7 @@ async fn main() -> anyhow::Result<()> {
         .route("/health", get(health))
         .route("/index", post(start_index))
         .route("/index/jobs", get(list_jobs))
-        .route("/index/status/:id", get(index_status))
+        .route("/index/status/{id}", get(index_status))
         .route("/search", post(search))
         .with_state(state)
         .layer(
@@ -378,7 +378,7 @@ async fn main() -> anyhow::Result<()> {
     let addr = format!("0.0.0.0:{}", port);
     info!("vibe-indexer listening on http://{}", addr);
     info!("  POST /index           — start indexing job");
-    info!("  GET  /index/status/:id — poll job");
+    info!("  GET  /index/status/{{id}} — poll job");
     info!("  GET  /index/jobs       — list all jobs");
     info!("  POST /search          — semantic search");
     info!("  GET  /health          — liveness probe");
diff --git a/vibe-rl-py/pyproject.toml b/vibe-rl-py/pyproject.toml
index 6ceb39e96..e303de5fa 100644
--- a/vibe-rl-py/pyproject.toml
+++ b/vibe-rl-py/pyproject.toml
@@ -19,11 +19,11 @@ dependencies = [
 mujoco = ["mujoco>=3.0", "gymnasium[mujoco]>=0.29"]
 atari = ["gymnasium[atari,accept-rom-license]>=0.29"]
 box2d = ["gymnasium[box2d]>=0.29", "swig"]
-onnx = ["onnx>=1.15", "onnxruntime>=1.16"]
+onnx = ["onnx>=1.22.0", "onnxruntime>=1.16"]
 # Slice 7a — distill + quantize + prune. Distill reuses the base PPO loop
 # (no extra dep). Quantize needs onnx + onnxruntime.quantization. Prune
 # uses torch.nn.utils.prune which is in core torch already.
-opt = ["onnx>=1.15", "onnxruntime>=1.16"]
+opt = ["onnx>=1.22.0", "onnxruntime>=1.16"]
 # Slice 7b — multi-agent. PettingZoo provides the env API; mpe2 is the
 # maintained replacement for PettingZoo's deprecated MPE suite (the
 # canonical cooperative-MARL benchmarks). supersuit gives us
@@ -39,7 +39,7 @@ marl = [
 # dep — DPO loss is ~30 lines of math. Reward-model training (for PPO-
 # style alignment) is 7c-extras.
 rlhf = [
-    "transformers>=4.40,<5.0",
+    "transformers>=5.3.0,<6.0",
     "accelerate>=0.27,<2.0",
 ]
 dev = ["pytest>=7", "pytest-timeout>=2"]
diff --git a/vibe-rl-py/uv.lock b/vibe-rl-py/uv.lock
index 48e2c5e86..8433a760e 100644
--- a/vibe-rl-py/uv.lock
+++ b/vibe-rl-py/uv.lock
@@ -56,6 +56,28 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/4b/dc/55f404bf4c8a2c707ef05eba9a8986fc943d192e26d2b4bb6889de02abc9/ale_py-0.11.2-cp312-cp312-win_amd64.whl", hash = "sha256:bb8c4d6d8b6cbecfff2915c9f1787101f033719b66f8149dbc4685a2ff22514a", size = 3471735, upload-time = "2025-07-12T22:19:01.895Z" },
 ]
 
+[[package]]
+name = "annotated-doc"
+version = "0.0.4"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/57/ba/046ceea27344560984e26a590f90bc7f4a75b06701f653222458922b558c/annotated_doc-0.0.4.tar.gz", hash = "sha256:fbcda96e87e9c92ad167c2e53839e57503ecfda18804ea28102353485033faa4", size = 7288, upload-time = "2025-11-10T22:07:42.062Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/1e/d3/26bf1008eb3d2daa8ef4cacc7f3bfdc11818d111f7e2d0201bc6e3b49d45/annotated_doc-0.0.4-py3-none-any.whl", hash = "sha256:571ac1dc6991c450b25a9c2d84a3705e2ae7a53467b5d111c24fa8baabbed320", size = 5303, upload-time = "2025-11-10T22:07:40.673Z" },
+]
+
+[[package]]
+name = "anyio"
+version = "4.14.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "idna" },
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/3b/72/5562aabb8dd7181e8e860622a38bea08d17842b99ecd4c91f84ac95251b0/anyio-4.14.1.tar.gz", hash = "sha256:8d648a3544c1a700e3ff78615cd679e4c5c3f149904287e73687b2596963629e", size = 254831, upload-time = "2026-06-24T20:56:06.017Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b0/7b/90df4a0a816d98d6ea26f559d87836d494a2cf1fcf063be67df50a7bcc30/anyio-4.14.1-py3-none-any.whl", hash = "sha256:4e5533c5b8ff0a24f5d7a176cbe6877129cd183893f66b537f8f227d10527d72", size = 124875, upload-time = "2026-06-24T20:56:04.413Z" },
+]
+
 [[package]]
 name = "box2d"
 version = "2.3.10"
@@ -89,44 +111,15 @@ wheels = [
 ]
 
 [[package]]
-name = "charset-normalizer"
-version = "3.4.7"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/e7/a1/67fe25fac3c7642725500a3f6cfe5821ad557c3abb11c9d20d12c7008d3e/charset_normalizer-3.4.7.tar.gz", hash = "sha256:ae89db9e5f98a11a4bf50407d4363e7b09b31e55bc117b4f7d80aab97ba009e5", size = 144271, upload-time = "2026-04-02T09:28:39.342Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/c2/d7/b5b7020a0565c2e9fa8c09f4b5fa6232feb326b8c20081ccded47ea368fd/charset_normalizer-3.4.7-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:7641bb8895e77f921102f72833904dcd9901df5d6d72a2ab8f31d04b7e51e4e7", size = 309705, upload-time = "2026-04-02T09:26:02.191Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/53/58c29116c340e5456724ecd2fff4196d236b98f3da97b404bc5e51ac3493/charset_normalizer-3.4.7-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:202389074300232baeb53ae2569a60901f7efadd4245cf3a3bf0617d60b439d7", size = 206419, upload-time = "2026-04-02T09:26:03.583Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/02/e8146dc6591a37a00e5144c63f29fb7c97a734ea8a111190783c0e60ab63/charset_normalizer-3.4.7-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:30b8d1d8c52a48c2c5690e152c169b673487a2a58de1ec7393196753063fcd5e", size = 227901, upload-time = "2026-04-02T09:26:04.738Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/73/77486c4cd58f1267bf17db420e930c9afa1b3be3fe8c8b8ebbebc9624359/charset_normalizer-3.4.7-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:532bc9bf33a68613fd7d65e4b1c71a6a38d7d42604ecf239c77392e9b4e8998c", size = 222742, upload-time = "2026-04-02T09:26:06.36Z" },
-    { url = "https://files.pythonhosted.org/packages/a1/fa/f74eb381a7d94ded44739e9d94de18dc5edc9c17fb8c11f0a6890696c0a9/charset_normalizer-3.4.7-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2fe249cb4651fd12605b7288b24751d8bfd46d35f12a20b1ba33dea122e690df", size = 214061, upload-time = "2026-04-02T09:26:08.347Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/92/42bd3cefcf7687253fb86694b45f37b733c97f59af3724f356fa92b8c344/charset_normalizer-3.4.7-cp311-cp311-manylinux_2_31_armv7l.whl", hash = "sha256:65bcd23054beab4d166035cabbc868a09c1a49d1efe458fe8e4361215df40265", size = 199239, upload-time = "2026-04-02T09:26:09.823Z" },
-    { url = "https://files.pythonhosted.org/packages/4c/3d/069e7184e2aa3b3cddc700e3dd267413dc259854adc3380421c805c6a17d/charset_normalizer-3.4.7-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:08e721811161356f97b4059a9ba7bafb23ea5ee2255402c42881c214e173c6b4", size = 210173, upload-time = "2026-04-02T09:26:10.953Z" },
-    { url = "https://files.pythonhosted.org/packages/62/51/9d56feb5f2e7074c46f93e0ebdbe61f0848ee246e2f0d89f8e20b89ebb8f/charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:e060d01aec0a910bdccb8be71faf34e7799ce36950f8294c8bf612cba65a2c9e", size = 209841, upload-time = "2026-04-02T09:26:12.142Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/59/893d8f99cc4c837dda1fe2f1139079703deb9f321aabcb032355de13b6c7/charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:38c0109396c4cfc574d502df99742a45c72c08eff0a36158b6f04000043dbf38", size = 200304, upload-time = "2026-04-02T09:26:13.711Z" },
-    { url = "https://files.pythonhosted.org/packages/7d/1d/ee6f3be3464247578d1ed5c46de545ccc3d3ff933695395c402c21fa6b77/charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:1c2a768fdd44ee4a9339a9b0b130049139b8ce3c01d2ce09f67f5a68048d477c", size = 229455, upload-time = "2026-04-02T09:26:14.941Z" },
-    { url = "https://files.pythonhosted.org/packages/54/bb/8fb0a946296ea96a488928bdce8ef99023998c48e4713af533e9bb98ef07/charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:1a87ca9d5df6fe460483d9a5bbf2b18f620cbed41b432e2bddb686228282d10b", size = 210036, upload-time = "2026-04-02T09:26:16.478Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/bc/015b2387f913749f82afd4fcba07846d05b6d784dd16123cb66860e0237d/charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:d635aab80466bc95771bb78d5370e74d36d1fe31467b6b29b8b57b2a3cd7d22c", size = 224739, upload-time = "2026-04-02T09:26:17.751Z" },
-    { url = "https://files.pythonhosted.org/packages/17/ab/63133691f56baae417493cba6b7c641571a2130eb7bceba6773367ab9ec5/charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:ae196f021b5e7c78e918242d217db021ed2a6ace2bc6ae94c0fc596221c7f58d", size = 216277, upload-time = "2026-04-02T09:26:18.981Z" },
-    { url = "https://files.pythonhosted.org/packages/06/6d/3be70e827977f20db77c12a97e6a9f973631a45b8d186c084527e53e77a4/charset_normalizer-3.4.7-cp311-cp311-win32.whl", hash = "sha256:adb2597b428735679446b46c8badf467b4ca5f5056aae4d51a19f9570301b1ad", size = 147819, upload-time = "2026-04-02T09:26:20.295Z" },
-    { url = "https://files.pythonhosted.org/packages/20/d9/5f67790f06b735d7c7637171bbfd89882ad67201891b7275e51116ed8207/charset_normalizer-3.4.7-cp311-cp311-win_amd64.whl", hash = "sha256:8e385e4267ab76874ae30db04c627faaaf0b509e1ccc11a95b3fc3e83f855c00", size = 159281, upload-time = "2026-04-02T09:26:21.74Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/83/6413f36c5a34afead88ce6f66684d943d91f233d76dd083798f9602b75ae/charset_normalizer-3.4.7-cp311-cp311-win_arm64.whl", hash = "sha256:d4a48e5b3c2a489fae013b7589308a40146ee081f6f509e047e0e096084ceca1", size = 147843, upload-time = "2026-04-02T09:26:22.901Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/eb/4fc8d0a7110eb5fc9cc161723a34a8a6c200ce3b4fbf681bc86feee22308/charset_normalizer-3.4.7-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:eca9705049ad3c7345d574e3510665cb2cf844c2f2dcfe675332677f081cbd46", size = 311328, upload-time = "2026-04-02T09:26:24.331Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/e3/0fadc706008ac9d7b9b5be6dc767c05f9d3e5df51744ce4cc9605de7b9f4/charset_normalizer-3.4.7-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6178f72c5508bfc5fd446a5905e698c6212932f25bcdd4b47a757a50605a90e2", size = 208061, upload-time = "2026-04-02T09:26:25.568Z" },
-    { url = "https://files.pythonhosted.org/packages/42/f0/3dd1045c47f4a4604df85ec18ad093912ae1344ac706993aff91d38773a2/charset_normalizer-3.4.7-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:e1421b502d83040e6d7fb2fb18dff63957f720da3d77b2fbd3187ceb63755d7b", size = 229031, upload-time = "2026-04-02T09:26:26.865Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/67/675a46eb016118a2fbde5a277a5d15f4f69d5f3f5f338e5ee2f8948fcf43/charset_normalizer-3.4.7-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:edac0f1ab77644605be2cbba52e6b7f630731fc42b34cb0f634be1a6eface56a", size = 225239, upload-time = "2026-04-02T09:26:28.044Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/f8/d0118a2f5f23b02cd166fa385c60f9b0d4f9194f574e2b31cef350ad7223/charset_normalizer-3.4.7-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5649fd1c7bade02f320a462fdefd0b4bd3ce036065836d4f42e0de958038e116", size = 216589, upload-time = "2026-04-02T09:26:29.239Z" },
-    { url = "https://files.pythonhosted.org/packages/b1/f1/6d2b0b261b6c4ceef0fcb0d17a01cc5bc53586c2d4796fa04b5c540bc13d/charset_normalizer-3.4.7-cp312-cp312-manylinux_2_31_armv7l.whl", hash = "sha256:203104ed3e428044fd943bc4bf45fa73c0730391f9621e37fe39ecf477b128cb", size = 202733, upload-time = "2026-04-02T09:26:30.5Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/c0/7b1f943f7e87cc3db9626ba17807d042c38645f0a1d4415c7a14afb5591f/charset_normalizer-3.4.7-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:298930cec56029e05497a76988377cbd7457ba864beeea92ad7e844fe74cd1f1", size = 212652, upload-time = "2026-04-02T09:26:31.709Z" },
-    { url = "https://files.pythonhosted.org/packages/38/dd/5a9ab159fe45c6e72079398f277b7d2b523e7f716acc489726115a910097/charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:708838739abf24b2ceb208d0e22403dd018faeef86ddac04319a62ae884c4f15", size = 211229, upload-time = "2026-04-02T09:26:33.282Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/ff/531a1cad5ca855d1c1a8b69cb71abfd6d85c0291580146fda7c82857caa1/charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:0f7eb884681e3938906ed0434f20c63046eacd0111c4ba96f27b76084cd679f5", size = 203552, upload-time = "2026-04-02T09:26:34.845Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/4c/a5fb52d528a8ca41f7598cb619409ece30a169fbdf9cdce592e53b46c3a6/charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:4dc1e73c36828f982bfe79fadf5919923f8a6f4df2860804db9a98c48824ce8d", size = 230806, upload-time = "2026-04-02T09:26:36.152Z" },
-    { url = "https://files.pythonhosted.org/packages/59/7a/071feed8124111a32b316b33ae4de83d36923039ef8cf48120266844285b/charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:aed52fea0513bac0ccde438c188c8a471c4e0f457c2dd20cdbf6ea7a450046c7", size = 212316, upload-time = "2026-04-02T09:26:37.672Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/35/f7dba3994312d7ba508e041eaac39a36b120f32d4c8662b8814dab876431/charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:fea24543955a6a729c45a73fe90e08c743f0b3334bbf3201e6c4bc1b0c7fa464", size = 227274, upload-time = "2026-04-02T09:26:38.93Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/2d/a572df5c9204ab7688ec1edc895a73ebded3b023bb07364710b05dd1c9be/charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:bb6d88045545b26da47aa879dd4a89a71d1dce0f0e549b1abcb31dfe4a8eac49", size = 218468, upload-time = "2026-04-02T09:26:40.17Z" },
-    { url = "https://files.pythonhosted.org/packages/86/eb/890922a8b03a568ca2f336c36585a4713c55d4d67bf0f0c78924be6315ca/charset_normalizer-3.4.7-cp312-cp312-win32.whl", hash = "sha256:2257141f39fe65a3fdf38aeccae4b953e5f3b3324f4ff0daf9f15b8518666a2c", size = 148460, upload-time = "2026-04-02T09:26:41.416Z" },
-    { url = "https://files.pythonhosted.org/packages/35/d9/0e7dffa06c5ab081f75b1b786f0aefc88365825dfcd0ac544bdb7b2b6853/charset_normalizer-3.4.7-cp312-cp312-win_amd64.whl", hash = "sha256:5ed6ab538499c8644b8a3e18debabcd7ce684f3fa91cf867521a7a0279cab2d6", size = 159330, upload-time = "2026-04-02T09:26:42.554Z" },
-    { url = "https://files.pythonhosted.org/packages/9e/5d/481bcc2a7c88ea6b0878c299547843b2521ccbc40980cb406267088bc701/charset_normalizer-3.4.7-cp312-cp312-win_arm64.whl", hash = "sha256:56be790f86bfb2c98fb742ce566dfb4816e5a83384616ab59c49e0604d49c51d", size = 147828, upload-time = "2026-04-02T09:26:44.075Z" },
-    { url = "https://files.pythonhosted.org/packages/db/8f/61959034484a4a7c527811f4721e75d02d653a35afb0b6054474d8185d4c/charset_normalizer-3.4.7-py3-none-any.whl", hash = "sha256:3dce51d0f5e7951f8bb4900c257dad282f49190fdbebecd4ba99bcc41fef404d", size = 61958, upload-time = "2026-04-02T09:28:37.794Z" },
+name = "click"
+version = "8.4.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/76/d4/81420972a676e8ffea40450d8c8c92943e7218a78fe9b64359836cc9876b/click-8.4.2.tar.gz", hash = "sha256:9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c4917a15f6", size = 338000, upload-time = "2026-06-24T17:45:15.148Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fb/e2/79c688af8b210d232694e31e59da9f6ec747bae31c3f5946e4e9b98860d5/click-8.4.2-py3-none-any.whl", hash = "sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76", size = 119243, upload-time = "2026-06-24T17:45:13.73Z" },
 ]
 
 [[package]]
@@ -334,39 +327,78 @@ mujoco = [
     { name = "packaging" },
 ]
 
+[[package]]
+name = "h11"
+version = "0.16.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/01/ee/02a2c011bdab74c6fb3c75474d40b3052059d95df7e73351460c8588d963/h11-0.16.0.tar.gz", hash = "sha256:4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208ee5ff1", size = 101250, upload-time = "2025-04-24T03:35:25.427Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/04/4b/29cac41a4d98d144bf5f6d33995617b185d14b22401f75ca86f384e87ff1/h11-0.16.0-py3-none-any.whl", hash = "sha256:63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86", size = 37515, upload-time = "2025-04-24T03:35:24.344Z" },
+]
+
 [[package]]
 name = "hf-xet"
-version = "1.4.3"
+version = "1.5.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/4b/2d/57fd21d84d93efb4bd0b962383790e19dd1bc053501b4264c97903b4e83e/hf_xet-1.5.1.tar.gz", hash = "sha256:51ef4500dab3764b41135ee1381a4b62ce56fc54d4c92b719b59e597d6df5bf6", size = 876636, upload-time = "2026-06-08T23:02:53.897Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7a/d8/5e54cf37434759d1f4f2ba9b66077ff9d4c4e1f37b6bd7975da5c40d94ab/hf_xet-1.5.1-cp37-abi3-macosx_10_12_x86_64.whl", hash = "sha256:6abd35c3221eff63836618ddfb954dcf84798603f71d8e33e3ed7b04acfdbe6e", size = 4077794, upload-time = "2026-06-08T23:02:40.656Z" },
+    { url = "https://files.pythonhosted.org/packages/35/94/4b2ecfbad8f8b04701a23aefb62f540b9137d058b7e1dbef16a32676f0e9/hf_xet-1.5.1-cp37-abi3-macosx_11_0_arm64.whl", hash = "sha256:94e761bbd266bf4c03cee73753916062665ce8365aa40ed321f45afcb934b41e", size = 3845354, upload-time = "2026-06-08T23:02:42.702Z" },
+    { url = "https://files.pythonhosted.org/packages/de/cc/f99f4bc7295023d7bd9ebbfd51f75cc530ca262c1227666268b8208f4b77/hf_xet-1.5.1-cp37-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:892e3a3a3aecc12aded8b93cf4f9cd059282c7de0732f7d55026f3abdf474350", size = 4514864, upload-time = "2026-06-08T23:02:44.497Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/6e/21f7e5a2381278bd3b7b7a5a4d90038518bb6308a0c1daf5d9f8268bb178/hf_xet-1.5.1-cp37-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:a93df2039190502835b1db8cd7e178b0b7b889fe9ab51299d5ced26e0dd879a4", size = 4303784, upload-time = "2026-06-08T23:02:46.203Z" },
+    { url = "https://files.pythonhosted.org/packages/35/0e/f992bb6927ac1cb30ef74e62268f551f338bc32b2191f7c96a44c6f7283e/hf_xet-1.5.1-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:0c97106032ef70467b4f6bc2d0ccc266d7613ee076afc56516c502f87ce1c4a6", size = 4500703, upload-time = "2026-06-08T23:02:47.628Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/d1/90a498d05447980b977b1669246eeeeae4cfb0ea3e7a286eaba627f91bf9/hf_xet-1.5.1-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:6208adb15d192b90e4c2ad2a27ed864359b2cb0f2494eb6d7c7f3699ac02e2bf", size = 4719498, upload-time = "2026-06-08T23:02:49.268Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/b6/20f99cfe97cc663a711f7b33cc21d4793e51968e9a26125b4afcd77315ba/hf_xet-1.5.1-cp37-abi3-win_amd64.whl", hash = "sha256:f7b3002f95d1c13e24bcb4537baa8f0eb3838957067c91bb4959bc004a6435f5", size = 4026419, upload-time = "2026-06-08T23:02:50.829Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/fa/77453694888f03e5a8c8852d1514a0894d8e81c622d39edbaf308ea0dcf4/hf_xet-1.5.1-cp37-abi3-win_arm64.whl", hash = "sha256:93d090b57b211133f6c0dab0205ef5cb6d89162979ba75a74845045cc3063b8e", size = 3855178, upload-time = "2026-06-08T23:02:52.452Z" },
+]
+
+[[package]]
+name = "httpcore"
+version = "1.0.9"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "certifi" },
+    { name = "h11" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/06/94/82699a10bca87a5556c9c59b5963f2d039dbd239f25bc2a63907a05a14cb/httpcore-1.0.9.tar.gz", hash = "sha256:6e34463af53fd2ab5d807f399a9b45ea31c3dfa2276f15a2c3f00afff6e176e8", size = 85484, upload-time = "2025-04-24T22:06:22.219Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7e/f5/f66802a942d491edb555dd61e3a9961140fd64c90bce1eafd741609d334d/httpcore-1.0.9-py3-none-any.whl", hash = "sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55", size = 78784, upload-time = "2025-04-24T22:06:20.566Z" },
+]
+
+[[package]]
+name = "httpx"
+version = "0.28.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/53/92/ec9ad04d0b5728dca387a45af7bc98fbb0d73b2118759f5f6038b61a57e8/hf_xet-1.4.3.tar.gz", hash = "sha256:8ddedb73c8c08928c793df2f3401ec26f95be7f7e516a7bee2fbb546f6676113", size = 670477, upload-time = "2026-03-31T22:40:07.874Z" }
+dependencies = [
+    { name = "anyio" },
+    { name = "certifi" },
+    { name = "httpcore" },
+    { name = "idna" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b1/df/48c586a5fe32a0f01324ee087459e112ebb7224f646c0b5023f5e79e9956/httpx-0.28.1.tar.gz", hash = "sha256:75e98c5f16b0f35b567856f597f06ff2270a374470a5c2392242528e3e3e42fc", size = 141406, upload-time = "2024-12-06T15:37:23.222Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ac/9f/9c23e4a447b8f83120798f9279d0297a4d1360bdbf59ef49ebec78fe2545/hf_xet-1.4.3-cp37-abi3-macosx_10_12_x86_64.whl", hash = "sha256:d0da85329eaf196e03e90b84c2d0aca53bd4573d097a75f99609e80775f98025", size = 3805048, upload-time = "2026-03-31T22:39:53.105Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/f8/7aacb8e5f4a7899d39c787b5984e912e6c18b11be136ef13947d7a66d265/hf_xet-1.4.3-cp37-abi3-macosx_11_0_arm64.whl", hash = "sha256:e23717ce4186b265f69afa66e6f0069fe7efbf331546f5c313d00e123dc84583", size = 3562178, upload-time = "2026-03-31T22:39:51.295Z" },
-    { url = "https://files.pythonhosted.org/packages/df/9a/a24b26dc8a65f0ecc0fe5be981a19e61e7ca963b85e062c083f3a9100529/hf_xet-1.4.3-cp37-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fc360b70c815bf340ed56c7b8c63aacf11762a4b099b2fe2c9bd6d6068668c08", size = 4212320, upload-time = "2026-03-31T22:39:42.922Z" },
-    { url = "https://files.pythonhosted.org/packages/53/60/46d493db155d2ee2801b71fb1b0fd67696359047fdd8caee2c914cc50c79/hf_xet-1.4.3-cp37-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:39f2d2e9654cd9b4319885733993807aab6de9dfbd34c42f0b78338d6617421f", size = 3991546, upload-time = "2026-03-31T22:39:41.335Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/f5/067363e1c96c6b17256910830d1b54099d06287e10f4ec6ec4e7e08371fc/hf_xet-1.4.3-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:49ad8a8cead2b56051aa84d7fce3e1335efe68df3cf6c058f22a65513885baac", size = 4193200, upload-time = "2026-03-31T22:40:01.936Z" },
-    { url = "https://files.pythonhosted.org/packages/42/4b/53951592882d9c23080c7644542fda34a3813104e9e11fa1a7d82d419cb8/hf_xet-1.4.3-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:7716d62015477a70ea272d2d68cd7cad140f61c52ee452e133e139abfe2c17ba", size = 4429392, upload-time = "2026-03-31T22:40:03.492Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/21/75a6c175b4e79662ad8e62f46a40ce341d8d6b206b06b4320d07d55b188c/hf_xet-1.4.3-cp37-abi3-win_amd64.whl", hash = "sha256:6b591fcad34e272a5b02607485e4f2a1334aebf1bc6d16ce8eb1eb8978ac2021", size = 3677359, upload-time = "2026-03-31T22:40:13.619Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/7c/44314ecd0e89f8b2b51c9d9e5e7a60a9c1c82024ac471d415860557d3cd8/hf_xet-1.4.3-cp37-abi3-win_arm64.whl", hash = "sha256:7c2c7e20bcfcc946dc67187c203463f5e932e395845d098cc2a93f5b67ca0b47", size = 3533664, upload-time = "2026-03-31T22:40:12.152Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/39/e50c7c3a983047577ee07d2a9e53faf5a69493943ec3f6a384bdc792deb2/httpx-0.28.1-py3-none-any.whl", hash = "sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad", size = 73517, upload-time = "2024-12-06T15:37:21.509Z" },
 ]
 
 [[package]]
 name = "huggingface-hub"
-version = "0.36.2"
+version = "1.21.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
+    { name = "click" },
     { name = "filelock" },
     { name = "fsspec" },
-    { name = "hf-xet", marker = "platform_machine == 'aarch64' or platform_machine == 'amd64' or platform_machine == 'arm64' or platform_machine == 'x86_64'" },
+    { name = "hf-xet", marker = "platform_machine == 'AMD64' or platform_machine == 'aarch64' or platform_machine == 'amd64' or platform_machine == 'arm64' or platform_machine == 'x86_64'" },
+    { name = "httpx" },
     { name = "packaging" },
     { name = "pyyaml" },
-    { name = "requests" },
     { name = "tqdm" },
+    { name = "typer" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/7c/b7/8cb61d2eece5fb05a83271da168186721c450eb74e3c31f7ef3169fa475b/huggingface_hub-0.36.2.tar.gz", hash = "sha256:1934304d2fb224f8afa3b87007d58501acfda9215b334eed53072dd5e815ff7a", size = 649782, upload-time = "2026-02-06T09:24:13.098Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/8f/77/ce3331f40cb2d021fe9b24c46c41e72faf74493621138e5eddac12bf5e1c/huggingface_hub-1.21.0.tar.gz", hash = "sha256:a44f222cd8f2f7c2eade30b5e7a04cac984a3235fa61ea87a0a5a31db77d561f", size = 861572, upload-time = "2026-06-25T13:09:26.356Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a8/af/48ac8483240de756d2438c380746e7130d1c6f75802ef22f3c6d49982787/huggingface_hub-0.36.2-py3-none-any.whl", hash = "sha256:48f0c8eac16145dfce371e9d2d7772854a4f591bcb56c9cf548accf531d54270", size = 566395, upload-time = "2026-02-06T09:24:11.133Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/85/b505a99a133d9f99d21af182af416e9baef70bdeef019983479651e494c2/huggingface_hub-1.21.0-py3-none-any.whl", hash = "sha256:eadaa3678c512c82aea69e8675d90a184861e68de32f1105668628b4dce0e7cd", size = 721078, upload-time = "2026-06-25T13:09:24.402Z" },
 ]
 
 [[package]]
@@ -729,7 +761,7 @@ wheels = [
 
 [[package]]
 name = "onnx"
-version = "1.21.0"
+version = "1.22.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "ml-dtypes" },
@@ -737,20 +769,21 @@ dependencies = [
     { name = "protobuf" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c5/93/942d2a0f6a70538eea042ce0445c8aefd46559ad153469986f29a743c01c/onnx-1.21.0.tar.gz", hash = "sha256:4d8b67d0aaec5864c87633188b91cc520877477ec0254eda122bef8be43cd764", size = 12074608, upload-time = "2026-03-27T21:33:36.118Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/04/19/8ea73a64b368b75fe339771a20a02bc61ea1f551484c9e3d9d0bfbd0450f/onnx-1.22.0.tar.gz", hash = "sha256:ef40c0aaf0b643857ea9306fc7eddce17eaf9fb0407e4801f1fc5758443a38e0", size = 12024721, upload-time = "2026-06-15T12:50:05.354Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/45/48/32e383aa6bc40b72a9fd419937aaa647078190c9bfccdc97b316d2dee687/onnx-1.21.0-cp311-cp311-macosx_12_0_universal2.whl", hash = "sha256:2aca19949260875c14866fc77ea0bc37e4e809b24976108762843d328c92d3ce", size = 17968053, upload-time = "2026-03-27T21:32:29.558Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/26/5726e8df7d36e96bb3c679912d1a86af42f393d77aa17d6b98a97d4289ce/onnx-1.21.0-cp311-cp311-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:82aa6ab51144df07c58c4850cb78d4f1ae969d8c0bf657b28041796d49ba6974", size = 17534821, upload-time = "2026-03-27T21:32:32.351Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/2b/021dcd2dd50c3c71b7959d7368526da384a295c162fb4863f36057973f78/onnx-1.21.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:10c3185a232089335581fabb98fba4e86d3e8246b8140f2e406082438100ebda", size = 17616664, upload-time = "2026-03-27T21:32:34.921Z" },
-    { url = "https://files.pythonhosted.org/packages/12/00/afa32a46fa122a7ed42df1cfe8796922156a3725ba8fc581c4779c96e2fc/onnx-1.21.0-cp311-cp311-win32.whl", hash = "sha256:f53b3c15a3b539c16b99655c43c365622046d68c49b680c48eba4da2a4fb6f27", size = 16289035, upload-time = "2026-03-27T21:32:37.783Z" },
-    { url = "https://files.pythonhosted.org/packages/73/8d/483cc980a24d4c0131d0af06d0ff6a37fb08ae90a7848ece8cef645194f1/onnx-1.21.0-cp311-cp311-win_amd64.whl", hash = "sha256:5f78c411743db317a76e5d009f84f7e3d5380411a1567a868e82461a1e5c775d", size = 16443748, upload-time = "2026-03-27T21:32:40.337Z" },
-    { url = "https://files.pythonhosted.org/packages/38/78/9d06fd5aaaed1ec9cb8a3b70fbbf00c1bdc18db610771e96379f0ed58112/onnx-1.21.0-cp311-cp311-win_arm64.whl", hash = "sha256:ab6a488dabbb172eebc9f3b3e7ac68763f32b0c571626d4a5004608f866cc83d", size = 16406123, upload-time = "2026-03-27T21:32:45.159Z" },
-    { url = "https://files.pythonhosted.org/packages/7d/ae/cb644ec84c25e63575d9d8790fdcc5d1a11d67d3f62f872edb35fa38d158/onnx-1.21.0-cp312-abi3-macosx_12_0_universal2.whl", hash = "sha256:fc2635400fe39ff37ebc4e75342cc54450eadadf39c540ff132c319bf4960095", size = 17965930, upload-time = "2026-03-27T21:32:48.089Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/b6/eeb5903586645ef8a49b4b7892580438741acc3df91d7a5bd0f3a59ea9cb/onnx-1.21.0-cp312-abi3-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9003d5206c01fa2ff4b46311566865d8e493e1a6998d4009ec6de39843f1b59b", size = 17531344, upload-time = "2026-03-27T21:32:50.837Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/00/4823f06357892d1e60d6f34e7299d2ba4ed2108c487cc394f7ce85a3ff14/onnx-1.21.0-cp312-abi3-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a9261bd580fb8548c9c37b3c6750387eb8f21ea43c63880d37b2c622e1684285", size = 17613697, upload-time = "2026-03-27T21:32:54.222Z" },
-    { url = "https://files.pythonhosted.org/packages/23/1d/391f3c567ae068c8ac4f1d1316bae97c9eb45e702f05975fe0e17ad441f0/onnx-1.21.0-cp312-abi3-win32.whl", hash = "sha256:9ea4e824964082811938a9250451d89c4ec474fe42dd36c038bfa5df31993d1e", size = 16287200, upload-time = "2026-03-27T21:32:57.277Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/a6/5eefbe5b40ea96de95a766bd2e0e751f35bdea2d4b951991ec9afaa69531/onnx-1.21.0-cp312-abi3-win_amd64.whl", hash = "sha256:458d91948ad9a7729a347550553b49ab6939f9af2cddf334e2116e45467dc61f", size = 16441045, upload-time = "2026-03-27T21:33:00.081Z" },
-    { url = "https://files.pythonhosted.org/packages/63/c4/0ed8dc037a39113d2a4d66e0005e07751c299c46b993f1ad5c2c35664c20/onnx-1.21.0-cp312-abi3-win_arm64.whl", hash = "sha256:ca14bc4842fccc3187eb538f07eabeb25a779b39388b006db4356c07403a7bbb", size = 16403134, upload-time = "2026-03-27T21:33:03.987Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/55/30825c02c92a0380ce84c3feeeec95d329fa77548ba58cb10ad4bbfd83c6/onnx-1.22.0-cp311-cp311-macosx_12_0_universal2.whl", hash = "sha256:2d8f229a553fa440fe623ed7b36fca5e7762da3af871c3f8f8ce451df73e2914", size = 20167891, upload-time = "2026-06-15T12:49:14.212Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/24/cd4ab52ecaf41c3fbed674772ccbfe39041cb257b8471a47a37e48bff3f8/onnx-1.22.0-cp311-cp311-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a1a89a7cb9ba13d78f009bdec448ec82a98972589734f157022a2bff7a5973a6", size = 18892720, upload-time = "2026-06-15T12:49:16.904Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/a0/c9d9d56ceadb1c0a90a7cbec5a0510520ab6538938944fa84548e4b5b054/onnx-1.22.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1d0a2bdb15eb2b3cb65c438f3423d9620d14fdce32f92380e6bb1b2e09568ef5", size = 19110720, upload-time = "2026-06-15T12:49:19.812Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/6e/e43e5a68d9cadde55df75310027f87127333a77e5ddcea14c73e96a10cac/onnx-1.22.0-cp311-cp311-win32.whl", hash = "sha256:239958534464612fbcb6ed23d5228aaa925b39b8773f58726809ffdccb4edd1c", size = 17083746, upload-time = "2026-06-15T12:49:22.935Z" },
+    { url = "https://files.pythonhosted.org/packages/54/57/cc0a9f2cf4522e42829d089927b4b75924d32f50dca237482e7b741df003/onnx-1.22.0-cp311-cp311-win_amd64.whl", hash = "sha256:8561a2c00041c07e08db0c228593b5b4694100398685f348532af7dbb84189da", size = 17215684, upload-time = "2026-06-15T12:49:26.084Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/99/0f049f9eaa06c8383060c5f0a338e3a6caac8822e6e326c9162f05abf95a/onnx-1.22.0-cp311-cp311-win_arm64.whl", hash = "sha256:8907b9b9389893bc0dc6314cc00ee1e3a69844e48d689eacc6a0340411a7da58", size = 17210398, upload-time = "2026-06-15T12:49:29.091Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/6a/481561f1093834376ed493e4ca42a73e5be0d50031f2969c86593bdc7c96/onnx-1.22.0-cp312-abi3-macosx_12_0_universal2.whl", hash = "sha256:596fbf0490947533c1c1045ba860851dc9fb77471023dac9a71ba5b42ceab103", size = 20167081, upload-time = "2026-06-15T12:49:32.078Z" },
+    { url = "https://files.pythonhosted.org/packages/84/55/b34fc2aa30aa54b4a775402d24c4082242c720283a274fe976ac8eb94480/onnx-1.22.0-cp312-abi3-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ae5a563f281cd9d2845622cecf6c092a57e4ee1b138f66fdbbdd4200567a5e16", size = 18889249, upload-time = "2026-06-15T12:49:34.7Z" },
+    { url = "https://files.pythonhosted.org/packages/09/a6/bd32357e6cc1ecb473afd78193d7231724f284435d2db25696ecfaaa1503/onnx-1.22.0-cp312-abi3-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:955e02e1f6d385b53d52f9cd7b9cdf5caf417c300bcfe3c64c6d542be763845b", size = 19106514, upload-time = "2026-06-15T12:49:37.424Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/9d/3af461ac6c714b8b369cb71499659932f4f12cfb066250b62f7567c3d530/onnx-1.22.0-cp312-abi3-pyemscripten_2025_0_wasm32.whl", hash = "sha256:82e9f27fc1223cb06d68a56bed6f9d3caf3d0dad1b61bce45006d529b15bd94c", size = 16966387, upload-time = "2026-06-15T12:49:40.918Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/f0/68195b5e5a53e333faf2660f5352ee43738d0e42fc5216cc6b1871a9fbfb/onnx-1.22.0-cp312-abi3-win32.whl", hash = "sha256:cc8b66b312f8f03a53e268afb67180a2d97dd12cc79e2b61361c6c0073448016", size = 17081568, upload-time = "2026-06-15T12:49:43.398Z" },
+    { url = "https://files.pythonhosted.org/packages/13/a8/734725bb703c5fabb687f79c79e51249475212b3eb37771ac4a4ac9b487f/onnx-1.22.0-cp312-abi3-win_amd64.whl", hash = "sha256:72ccebab3bac07215c204ce8848d42e78eaaa666badbf72d25cd359b9f269e3a", size = 17213290, upload-time = "2026-06-15T12:49:45.933Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/2a/8ce48d8ae26a8761ad4e5dc771961b155c5c3c7c8540ec7f2f2d71b69af0/onnx-1.22.0-cp312-abi3-win_arm64.whl", hash = "sha256:f3c120dcdb70ad738f3c061b32798f408ea299eb69f84dd69ab4a6bf3c2ec01f", size = 17207030, upload-time = "2026-06-15T12:49:48.635Z" },
 ]
 
 [[package]]
@@ -1037,21 +1070,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/c9/27/049df16ec6a6828ccd72add3c7f54b4df029669bea8e9817df6fff58be90/regex-2026.4.4-cp312-cp312-win_arm64.whl", hash = "sha256:4ce255cc05c1947a12989c6db801c96461947adb7a59990f1360b5983fab4983", size = 270568, upload-time = "2026-04-03T20:54:09.484Z" },
 ]
 
-[[package]]
-name = "requests"
-version = "2.33.1"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "certifi" },
-    { name = "charset-normalizer" },
-    { name = "idna" },
-    { name = "urllib3" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/5f/a4/98b9c7c6428a668bf7e42ebb7c79d576a1c3c1e3ae2d47e674b468388871/requests-2.33.1.tar.gz", hash = "sha256:18817f8c57c6263968bc123d237e3b8b08ac046f5456bd1e307ee8f4250d3517", size = 134120, upload-time = "2026-03-30T16:09:15.531Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/d7/8e/7540e8a2036f79a125c1d2ebadf69ed7901608859186c856fa0388ef4197/requests-2.33.1-py3-none-any.whl", hash = "sha256:4e6d1ef462f3626a1f0a0a9c42dd93c63bad33f9f1c1937509b8c5c8718ab56a", size = 64947, upload-time = "2026-03-30T16:09:13.83Z" },
-]
-
 [[package]]
 name = "rich"
 version = "15.0.0"
@@ -1127,6 +1145,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/e1/e3/c164c88b2e5ce7b24d667b9bd83589cf4f3520d97cad01534cd3c4f55fdb/setuptools-81.0.0-py3-none-any.whl", hash = "sha256:fdd925d5c5d9f62e4b74b30d6dd7828ce236fd6ed998a08d81de62ce5a6310d6", size = 1062021, upload-time = "2026-02-06T21:10:37.175Z" },
 ]
 
+[[package]]
+name = "shellingham"
+version = "1.5.4"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/58/15/8b3609fd3830ef7b27b655beb4b4e9c62313a4e8da8c676e142cc210d58e/shellingham-1.5.4.tar.gz", hash = "sha256:8dbca0739d487e5bd35ab3ca4b36e11c4078f3a234bfce294b0a0291363404de", size = 10310, upload-time = "2023-10-24T04:13:40.426Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e0/f9/0595336914c5619e5f28a1fb793285925a8cd4b432c9da0a987836c7f822/shellingham-1.5.4-py2.py3-none-any.whl", hash = "sha256:7ecfff8f2fd72616f7481040475a65b2bf8af90a56c89140852d1120324e8686", size = 9755, upload-time = "2023-10-24T04:13:38.866Z" },
+]
+
 [[package]]
 name = "shtab"
 version = "1.8.0"
@@ -1289,23 +1316,22 @@ wheels = [
 
 [[package]]
 name = "transformers"
-version = "4.57.6"
+version = "5.3.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "filelock" },
     { name = "huggingface-hub" },
     { name = "numpy" },
     { name = "packaging" },
     { name = "pyyaml" },
     { name = "regex" },
-    { name = "requests" },
     { name = "safetensors" },
     { name = "tokenizers" },
     { name = "tqdm" },
+    { name = "typer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c4/35/67252acc1b929dc88b6602e8c4a982e64f31e733b804c14bc24b47da35e6/transformers-4.57.6.tar.gz", hash = "sha256:55e44126ece9dc0a291521b7e5492b572e6ef2766338a610b9ab5afbb70689d3", size = 10134912, upload-time = "2026-01-16T10:38:39.284Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/fc/1a/70e830d53ecc96ce69cfa8de38f163712d2b43ac52fbd743f39f56025c31/transformers-5.3.0.tar.gz", hash = "sha256:009555b364029da9e2946d41f1c5de9f15e6b1df46b189b7293f33a161b9c557", size = 8830831, upload-time = "2026-03-04T17:41:46.119Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/03/b8/e484ef633af3887baeeb4b6ad12743363af7cce68ae51e938e00aaa0529d/transformers-4.57.6-py3-none-any.whl", hash = "sha256:4c9e9de11333ddfe5114bc872c9f370509198acf0b87a832a0ab9458e2bd0550", size = 11993498, upload-time = "2026-01-16T10:38:31.289Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/88/ae8320064e32679a5429a2c9ebbc05c2bf32cefb6e076f9b07f6d685a9b4/transformers-5.3.0-py3-none-any.whl", hash = "sha256:50ac8c89c3c7033444fb3f9f53138096b997ebb70d4b5e50a2e810bf12d3d29a", size = 10661827, upload-time = "2026-03-04T17:41:42.722Z" },
 ]
 
 [[package]]
@@ -1331,6 +1357,21 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/91/88/b55b3117287a8540b76dbdd87733808d4d01c8067a3b339408c250bb3600/typeguard-4.5.1-py3-none-any.whl", hash = "sha256:44d2bf329d49a244110a090b55f5f91aa82d9a9834ebfd30bcc73651e4a8cc40", size = 36745, upload-time = "2026-02-19T16:09:01.6Z" },
 ]
 
+[[package]]
+name = "typer"
+version = "0.25.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "annotated-doc" },
+    { name = "click" },
+    { name = "rich" },
+    { name = "shellingham" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/e4/51/9aed62104cea109b820bbd6c14245af756112017d309da813ef107d42e7e/typer-0.25.1.tar.gz", hash = "sha256:9616eb8853a09ffeabab1698952f33c6f29ffdbceb4eaeecf571880e8d7664cc", size = 122276, upload-time = "2026-04-30T19:32:16.964Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/3f/f9/2b3ff4e56e5fa7debfaf9eb135d0da96f3e9a1d5b27222223c7296336e5f/typer-0.25.1-py3-none-any.whl", hash = "sha256:75caa44ed46a03fb2dab8808753ffacdbfea88495e74c85a28c5eefcf5f39c89", size = 58409, upload-time = "2026-04-30T19:32:18.271Z" },
+]
+
 [[package]]
 name = "typing-extensions"
 version = "4.15.0"
@@ -1357,15 +1398,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/bb/bc/943b35b1a139a602a730e56592a3639bf796a87c91eebcd40cc51043ee5b/tyro-0.9.35-py3-none-any.whl", hash = "sha256:82d656389d3041c04dd68542f8ba9b77baf91a4aaaa627cd5c88af3b3dc6a2cd", size = 132641, upload-time = "2025-10-13T08:55:56.54Z" },
 ]
 
-[[package]]
-name = "urllib3"
-version = "2.7.0"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
-]
-
 [[package]]
 name = "vibe-rl"
 version = "0.1.0"
@@ -1423,8 +1455,8 @@ requires-dist = [
     { name = "mpe2", marker = "extra == 'marl'", specifier = ">=1.0,<2.0" },
     { name = "mujoco", marker = "extra == 'mujoco'", specifier = ">=3.0" },
     { name = "numpy", specifier = ">=1.26,<3.0" },
-    { name = "onnx", marker = "extra == 'onnx'", specifier = ">=1.15" },
-    { name = "onnx", marker = "extra == 'opt'", specifier = ">=1.15" },
+    { name = "onnx", marker = "extra == 'onnx'", specifier = ">=1.22.0" },
+    { name = "onnx", marker = "extra == 'opt'", specifier = ">=1.22.0" },
     { name = "onnxruntime", marker = "extra == 'onnx'", specifier = ">=1.16" },
     { name = "onnxruntime", marker = "extra == 'opt'", specifier = ">=1.16" },
     { name = "pettingzoo", marker = "extra == 'marl'", specifier = ">=1.24,<2.0" },
@@ -1435,7 +1467,7 @@ requires-dist = [
     { name = "swig", marker = "extra == 'box2d'" },
     { name = "tensorboardx", specifier = ">=2.6,<3.0" },
     { name = "torch", specifier = ">=2.2,<3.0" },
-    { name = "transformers", marker = "extra == 'rlhf'", specifier = ">=4.40,<5.0" },
+    { name = "transformers", marker = "extra == 'rlhf'", specifier = ">=5.3.0,<6.0" },
     { name = "tyro", specifier = ">=0.7,<1.0" },
 ]
 provides-extras = ["mujoco", "atari", "box2d", "onnx", "opt", "marl", "rlhf", "dev"]
diff --git a/vibecli/vibecli-cli/src/a2a_http.rs b/vibecli/vibecli-cli/src/a2a_http.rs
index 766af4fbc..8ef442a9a 100644
--- a/vibecli/vibecli-cli/src/a2a_http.rs
+++ b/vibecli/vibecli-cli/src/a2a_http.rs
@@ -82,7 +82,7 @@ pub async fn serve_agent(agent: Shared) -> Result<ServerHandle, String> {
     let app = Router::new()
         .route("/a2a/card", get(get_card))
         .route("/a2a/tasks", post(submit_task))
-        .route("/a2a/tasks/:id", get(get_task))
+        .route("/a2a/tasks/{id}", get(get_task))
         .route("/a2a/events", get(sse_events))
         .with_state(state);
 
diff --git a/vibecli/vibecli-cli/src/serve.rs b/vibecli/vibecli-cli/src/serve.rs
index 7a785b22b..df59fa9e2 100644
--- a/vibecli/vibecli-cli/src/serve.rs
+++ b/vibecli/vibecli-cli/src/serve.rs
@@ -10,14 +10,14 @@
 //! | POST   | `/chat`                   | Single-turn chat (non-streaming)     |
 //! | POST   | `/chat/stream`            | Streaming chat as SSE                |
 //! | POST   | `/agent`                  | Start an agent task → returns `{session_id}` |
-//! | GET    | `/stream/:session_id`     | SSE stream of agent events           |
+//! | GET    | `/stream/{session_id}`     | SSE stream of agent events           |
 //! | GET    | `/jobs`                   | List all persisted job records       |
-//! | GET    | `/jobs/:id`               | Get a single job record              |
-//! | POST   | `/jobs/:id/cancel`        | Cancel a running job                 |
+//! | GET    | `/jobs/{id}`               | Get a single job record              |
+//! | POST   | `/jobs/{id}/cancel`        | Cancel a running job                 |
 //! | GET    | `/sessions`               | HTML index of all agent sessions     |
 //! | GET    | `/sessions.json`          | JSON list of all sessions            |
-//! | GET    | `/view/:id`               | HTML page for a specific session     |
-//! | GET    | `/share/:id`              | Shareable readonly session view (adds "Shared" banner) |
+//! | GET    | `/view/{id}`               | HTML page for a specific session     |
+//! | GET    | `/share/{id}`              | Shareable readonly session view (adds "Shared" banner) |
 //! | POST   | `/memory/add`             | Add a cognitive memory               |
 //! | POST   | `/memory/query`           | Semantic query with composite scoring |
 //! | GET    | `/memory/list`            | List all memories                    |
@@ -1751,7 +1751,7 @@ async fn list_tasks(
     Ok(Json(tasks))
 }
 
-/// GET /api/tasks/:id — fetch one task.
+/// GET /api/tasks/{id} — fetch one task.
 async fn get_task(
     Path(id): Path<String>,
     State(_state): State<ServeState>,
@@ -1784,7 +1784,7 @@ struct UpdateTaskRequest {
     session_id: Option<String>,
 }
 
-/// PATCH /api/tasks/:id — update status and/or link a session.
+/// PATCH /api/tasks/{id} — update status and/or link a session.
 async fn update_task(
     Path(id): Path<String>,
     State(_state): State<ServeState>,
@@ -1833,7 +1833,7 @@ async fn update_task(
     Ok(Json(row))
 }
 
-/// Query params for `DELETE /api/tasks/:id`.
+/// Query params for `DELETE /api/tasks/{id}`.
 #[derive(Debug, serde::Deserialize)]
 struct DeleteTaskQuery {
     /// Permanently remove the task *now* instead of soft-deleting it. Goes
@@ -1847,7 +1847,7 @@ struct DeleteTaskQuery {
     remove_worktree: bool,
 }
 
-/// DELETE /api/tasks/:id — **soft-delete** a task by default: it moves to the
+/// DELETE /api/tasks/{id} — **soft-delete** a task by default: it moves to the
 /// Trashed state (recoverable, worktree untouched) and the reaper reclaims the
 /// worktree after the grace window. Pass `?purge=true` to remove it permanently
 /// now (still safe — unmerged work is preserved at `refs/trash/<id>`).
@@ -1893,7 +1893,7 @@ async fn delete_task(
         })));
     }
 
-    // Default: soft-delete (Trashed). Reversible via POST /api/tasks/:id/restore.
+    // Default: soft-delete (Trashed). Reversible via POST /api/tasks/{id}/restore.
     let trashed = store.trash(&id, now).map_err(|e| {
         json_error(
             StatusCode::INTERNAL_SERVER_ERROR,
@@ -1908,7 +1908,7 @@ async fn delete_task(
     })))
 }
 
-/// POST /api/tasks/:id/archive — mark a task Archived: its branch is kept
+/// POST /api/tasks/{id}/archive — mark a task Archived: its branch is kept
 /// forever, the reaper frees the worktree directory, and restore re-creates it.
 async fn archive_task(
     Path(id): Path<String>,
@@ -1937,7 +1937,7 @@ async fn archive_task(
     Ok(Json(serde_json::json!({ "archived": true })))
 }
 
-/// POST /api/tasks/:id/restore — bring a Trashed/Archived task back to Active,
+/// POST /api/tasks/{id}/restore — bring a Trashed/Archived task back to Active,
 /// re-materializing its worktree from the (possibly preserved) branch.
 async fn restore_task(
     Path(id): Path<String>,
@@ -1972,7 +1972,7 @@ async fn restore_task(
     })))
 }
 
-/// POST /api/tasks/:id/merge — merge the task's worktree branch back into the
+/// POST /api/tasks/{id}/merge — merge the task's worktree branch back into the
 /// project's current branch, then (on success) remove the worktree and delete
 /// the task row. On merge conflict the merge is aborted and the task is left
 /// intact so the user can resolve it manually. Tasks with no worktree fall
@@ -2064,7 +2064,7 @@ async fn merge_task(
     })))
 }
 
-/// GET /api/tasks/:id/history — reconstruct a task's conversation from the
+/// GET /api/tasks/{id}/history — reconstruct a task's conversation from the
 /// durable `job_events` log so a finished chat can be re-rendered in VibeX
 /// (VX bug-3). Returns the task title/status plus the ordered event payloads
 /// (`replay_events` reads from persistence, so this works after a run ends).
@@ -2904,7 +2904,7 @@ async fn v1_list_tasks(State(state): State<ServeState>) -> impl IntoResponse {
     Json(serde_json::json!({ "tasks": statuses, "total": statuses.len() }))
 }
 
-/// GET /v1/tasks/:id — Get task status.
+/// GET /v1/tasks/{id} — Get task status.
 async fn v1_get_task(State(state): State<ServeState>, Path(id): Path<String>) -> impl IntoResponse {
     match state.job_manager.get(&id).await {
         Some(job) => {
@@ -2933,7 +2933,7 @@ async fn v1_jobs_metrics(State(state): State<ServeState>) -> impl IntoResponse {
     Json(snap)
 }
 
-/// POST /v1/tasks/:id/cancel — Cancel a running task.
+/// POST /v1/tasks/{id}/cancel — Cancel a running task.
 async fn v1_cancel_task(
     State(state): State<ServeState>,
     Path(id): Path<String>,
@@ -2967,7 +2967,7 @@ async fn v1_cancel_task(
     }
 }
 
-/// POST /v1/tasks/:id/feedback — Submit human feedback on a task.
+/// POST /v1/tasks/{id}/feedback — Submit human feedback on a task.
 async fn v1_task_feedback(
     State(state): State<ServeState>,
     Path(id): Path<String>,
@@ -3041,7 +3041,7 @@ async fn v1_create_browse(
     (StatusCode::CREATED, Json(status)).into_response()
 }
 
-/// GET /v1/browse/:id — Get browse task status.
+/// GET /v1/browse/{id} — Get browse task status.
 async fn v1_get_browse(
     State(state): State<ServeState>,
     Path(id): Path<String>,
@@ -3070,7 +3070,7 @@ async fn v1_get_browse(
     }
 }
 
-/// GET /v1/browse/:id/screenshots — Get screenshot history.
+/// GET /v1/browse/{id}/screenshots — Get screenshot history.
 async fn v1_browse_screenshots(
     State(state): State<ServeState>,
     Path(id): Path<String>,
@@ -3120,7 +3120,7 @@ async fn v1_browse_screenshots(
     }
 }
 
-/// POST /v1/browse/:id/intervene — Human takeover of a browse session.
+/// POST /v1/browse/{id}/intervene — Human takeover of a browse session.
 async fn v1_browse_intervene(
     State(state): State<ServeState>,
     Path(id): Path<String>,
@@ -3277,7 +3277,7 @@ fn default_generator() -> String {
     "heuristic".to_string()
 }
 
-/// PATCH /v1/recap/:id request body. All three fields required — a
+/// PATCH /v1/recap/{id} request body. All three fields required — a
 /// user edit replaces the prior heuristic/LLM output wholesale. The
 /// row's id, subject_id, last_message_id, generated_at, and artifacts
 /// are preserved by the daemon (artifacts are inferred from steps,
@@ -3773,7 +3773,7 @@ async fn v1_recap_delete(
 // ── /goal — G1.2 daemon HTTP CRUD ──────────────────────────────────────────
 //
 // Routes registered in `authed_routes` below: POST/GET/PATCH/DELETE
-// `/v1/goals` + `/v1/goals/:id`. Plan/link/start/recap routes added in
+// `/v1/goals` + `/v1/goals/{id}`. Plan/link/start/recap routes added in
 // G1.3 / G1.6. All work happens in `pub(crate) do_v1_exec_goal_*`
 // helpers so they're unit-testable without spinning up a server.
 
@@ -4444,7 +4444,7 @@ async fn v1_skillopt_train(
 /// - `error` — once, on launch failure (e.g. unknown skill/provider)
 ///
 /// Keep-alive pings every 15s mirror [`chat_stream`]. The client may cancel
-/// the run at any time with `POST /v1/skillopt/cancel/:job`; the next epoch
+/// the run at any time with `POST /v1/skillopt/cancel/{job}`; the next epoch
 /// boundary observes the token, the run stops, and a final `done` event
 /// carries the `cancelled` state.
 async fn v1_skillopt_train_stream(
@@ -4881,7 +4881,7 @@ pub(crate) fn do_v1_exec_goal_start(
         kind: crate::exec_goal::GoalLinkKind::Session,
         target_id: session_id.clone(),
         linked_at: chrono::Utc::now(),
-        note: Some("auto-linked via /v1/goals/:id/start".to_string()),
+        note: Some("auto-linked via /v1/goals/{id}/start".to_string()),
     };
     let link_id = link.id.clone();
     if let Err(e) = store.insert_goal_link(&link) {
@@ -5140,7 +5140,7 @@ async fn v1_exec_goal_start(
 // aggregator returns a freeform JSON that the UI can render alongside
 // per-session recaps without conflating schemas.
 
-/// G4.5 — body for `POST /v1/goals/:id/recap`. Both fields default to
+/// G4.5 — body for `POST /v1/goals/{id}/recap`. Both fields default to
 /// `None`; when both are present (and the named provider is reachable)
 /// the daemon synthesizes the headline + bullets with the LLM and tags
 /// the response `recap_synthesizer: "llm"`. Otherwise the heuristic
@@ -6139,7 +6139,7 @@ struct EvalResultsUpsertResponse {
     upserted: usize,
 }
 
-/// POST `/v1/rl/eval/runs/:run_id/results?suite_id=<id>` — record one or
+/// POST `/v1/rl/eval/runs/{run_id}/results?suite_id=<id>` — record one or
 /// more eval metrics for `run_id` under `suite_id`. Idempotent: re-posting
 /// the same `(run_id, suite_id, metric_name)` overwrites the previous row.
 /// External eval harnesses (the sidecar's `eval` command, CI scripts,
@@ -6579,35 +6579,35 @@ pub(crate) fn build_router(state: ServeState, port: u16) -> Router {
         .route("/chat", post(chat))
         .route("/chat/stream", post(chat_stream))
         .route("/agent", post(start_agent))
-        .route("/stream/:session_id", get(stream_agent))
+        .route("/stream/{session_id}", get(stream_agent))
         .route("/jobs", get(list_jobs))
-        .route("/jobs/:id", get(get_job))
-        .route("/jobs/:id/cancel", post(cancel_job))
+        .route("/jobs/{id}", get(get_job))
+        .route("/jobs/{id}/cancel", post(cancel_job))
         // VibeX task API (VX-112): task-card CRUD + lifecycle status.
         .route("/api/tasks", post(create_task).get(list_tasks))
         .route(
-            "/api/tasks/:id",
+            "/api/tasks/{id}",
             get(get_task).patch(update_task).delete(delete_task),
         )
-        .route("/api/tasks/:id/merge", post(merge_task))
-        .route("/api/tasks/:id/archive", post(archive_task))
-        .route("/api/tasks/:id/restore", post(restore_task))
-        .route("/api/tasks/:id/history", get(task_history))
+        .route("/api/tasks/{id}/merge", post(merge_task))
+        .route("/api/tasks/{id}/archive", post(archive_task))
+        .route("/api/tasks/{id}/restore", post(restore_task))
+        .route("/api/tasks/{id}/history", get(task_history))
         // VibeX environment API (VX-109/202/110): read-only git + file inspection.
         .route("/api/vibex/git/status", get(vibex_git_status))
         .route("/api/vibex/git/diff", get(vibex_git_diff))
         .route("/api/vibex/files", get(vibex_files))
         .route("/collab/rooms", post(create_collab_room))
         .route("/collab/rooms", get(list_collab_rooms))
-        .route("/collab/rooms/:room_id/peers", get(list_collab_peers))
+        .route("/collab/rooms/{room_id}/peers", get(list_collab_peers))
         .route("/acp/v1/tasks", post(acp_create_task))
-        .route("/acp/v1/tasks/:id", get(acp_get_task))
+        .route("/acp/v1/tasks/{id}", get(acp_get_task))
         // Session viewer & skill webhook now require auth
         .route("/sessions", get(sessions_index_html))
         .route("/sessions.json", get(sessions_json))
-        .route("/view/:id", get(view_session))
-        .route("/share/:id", get(share_session))
-        .route("/webhook/skill/:skill_name", post(skill_webhook_handler))
+        .route("/view/{id}", get(view_session))
+        .route("/share/{id}", get(share_session))
+        .route("/webhook/skill/{skill_name}", post(skill_webhook_handler))
         // OpenMemory — cognitive memory engine REST API
         .route("/memory/add", post(memory_add))
         .route("/memory/query", post(memory_query))
@@ -6643,14 +6643,14 @@ pub(crate) fn build_router(state: ServeState, port: u16) -> Router {
         // Agent-as-a-Service v1 API
         .route("/v1/tasks", post(v1_create_task))
         .route("/v1/tasks", get(v1_list_tasks))
-        .route("/v1/tasks/:id", get(v1_get_task))
-        .route("/v1/tasks/:id/cancel", post(v1_cancel_task))
-        .route("/v1/tasks/:id/feedback", post(v1_task_feedback))
+        .route("/v1/tasks/{id}", get(v1_get_task))
+        .route("/v1/tasks/{id}/cancel", post(v1_cancel_task))
+        .route("/v1/tasks/{id}/feedback", post(v1_task_feedback))
         .route("/v1/metrics/jobs", get(v1_jobs_metrics))
         .route("/v1/browse", post(v1_create_browse))
-        .route("/v1/browse/:id", get(v1_get_browse))
-        .route("/v1/browse/:id/screenshots", get(v1_browse_screenshots))
-        .route("/v1/browse/:id/intervene", post(v1_browse_intervene))
+        .route("/v1/browse/{id}", get(v1_get_browse))
+        .route("/v1/browse/{id}/screenshots", get(v1_browse_screenshots))
+        .route("/v1/browse/{id}/intervene", post(v1_browse_intervene))
         // DREAD #1 Slice G part 2 — tainted-argument confirmation bridge.
         // SSE stream of pending prompts; POST a decision to resolve one.
         // See docs/security/tainted-data-flow.md §8.
@@ -6660,92 +6660,92 @@ pub(crate) fn build_router(state: ServeState, port: u16) -> Router {
         // See docs/design/rl-os/01-persistence.md
         .route("/v1/rl/runs", post(rl_create_run))
         .route("/v1/rl/runs", get(rl_list_runs_h))
-        .route("/v1/rl/runs/:id", get(rl_get_run))
-        .route("/v1/rl/runs/:id", axum::routing::delete(rl_delete_run))
-        .route("/v1/rl/runs/:id/start", post(rl_start_run))
-        .route("/v1/rl/runs/:id/stop", post(rl_stop_run))
-        .route("/v1/rl/runs/:id/cancel", post(rl_cancel_run))
-        .route("/v1/rl/runs/:id/metrics", get(rl_get_metrics))
-        .route("/v1/rl/runs/:id/episodes", get(rl_get_episodes))
-        .route("/v1/rl/runs/:id/artifacts", get(rl_get_artifacts))
+        .route("/v1/rl/runs/{id}", get(rl_get_run))
+        .route("/v1/rl/runs/{id}", axum::routing::delete(rl_delete_run))
+        .route("/v1/rl/runs/{id}/start", post(rl_start_run))
+        .route("/v1/rl/runs/{id}/stop", post(rl_stop_run))
+        .route("/v1/rl/runs/{id}/cancel", post(rl_cancel_run))
+        .route("/v1/rl/runs/{id}/metrics", get(rl_get_metrics))
+        .route("/v1/rl/runs/{id}/episodes", get(rl_get_episodes))
+        .route("/v1/rl/runs/{id}/artifacts", get(rl_get_artifacts))
         // RL-OS slice 3 — environment registry
         .route("/v1/rl/envs", get(rl_list_envs_h))
-        .route("/v1/rl/envs/:id", get(rl_get_env_h))
-        .route("/v1/rl/envs/:id", axum::routing::delete(rl_delete_env_h))
+        .route("/v1/rl/envs/{id}", get(rl_get_env_h))
+        .route("/v1/rl/envs/{id}", axum::routing::delete(rl_delete_env_h))
         .route("/v1/rl/envs/refresh", post(rl_refresh_envs_h))
         .route("/v1/rl/envs/custom", post(rl_register_custom_env_h))
         // RL-OS slice 4 — eval suites + results + compare
         .route("/v1/rl/eval/suites", post(rl_eval_create_suite))
         .route("/v1/rl/eval/suites", get(rl_eval_list_suites))
-        .route("/v1/rl/eval/suites/:id", get(rl_eval_get_suite))
+        .route("/v1/rl/eval/suites/{id}", get(rl_eval_get_suite))
         .route(
-            "/v1/rl/eval/suites/:id",
+            "/v1/rl/eval/suites/{id}",
             axum::routing::delete(rl_eval_delete_suite),
         )
         .route("/v1/rl/eval/results", get(rl_eval_list_results))
         .route(
-            "/v1/rl/eval/runs/:run_id/results",
+            "/v1/rl/eval/runs/{run_id}/results",
             post(rl_eval_upsert_results),
         )
         .route("/v1/rl/eval/compare", post(rl_eval_compare))
         // RL-OS slice 5 — policy registry + lineage + reward decomposition
         .route("/v1/rl/policies", post(rl_register_policy))
         .route("/v1/rl/policies", get(rl_list_policies_h))
-        .route("/v1/rl/policies/:id", get(rl_get_policy))
+        .route("/v1/rl/policies/{id}", get(rl_get_policy))
         .route(
-            "/v1/rl/policies/:id",
+            "/v1/rl/policies/{id}",
             axum::routing::delete(rl_delete_policy),
         )
-        .route("/v1/rl/policies/:id/lineage", get(rl_get_policy_lineage))
-        .route("/v1/rl/policies/:id/card", get(rl_get_policy_card))
+        .route("/v1/rl/policies/{id}/lineage", get(rl_get_policy_lineage))
+        .route("/v1/rl/policies/{id}/card", get(rl_get_policy_card))
         .route(
-            "/v1/rl/runs/:id/reward-components",
+            "/v1/rl/runs/{id}/reward-components",
             get(rl_get_reward_components),
         )
         // RL-OS slice 6 — deployment management (inference wired in 6.5)
         .route("/v1/rl/serve/deployments", post(rl_create_deployment))
         .route("/v1/rl/serve/deployments", get(rl_list_deployments_h))
-        .route("/v1/rl/serve/deployments/:id", get(rl_get_deployment))
+        .route("/v1/rl/serve/deployments/{id}", get(rl_get_deployment))
         .route(
-            "/v1/rl/serve/deployments/:id/promote",
+            "/v1/rl/serve/deployments/{id}/promote",
             post(rl_promote_deployment),
         )
         .route(
-            "/v1/rl/serve/deployments/:id/rollback",
+            "/v1/rl/serve/deployments/{id}/rollback",
             post(rl_rollback_deployment),
         )
         .route(
-            "/v1/rl/serve/deployments/:id/stop",
+            "/v1/rl/serve/deployments/{id}/stop",
             post(rl_stop_deployment),
         )
         .route(
-            "/v1/rl/serve/deployments/:id/health",
+            "/v1/rl/serve/deployments/{id}/health",
             get(rl_get_deployment_health_h),
         )
-        .route("/v1/rl/serve/:name/act", post(rl_serve_act))
+        .route("/v1/rl/serve/{name}/act", post(rl_serve_act))
         // RL-OS slice 7 — RLHF + Optimization + Multi-Agent
         .route("/v1/rl/rlhf/preferences", post(rl_create_preference))
         .route("/v1/rl/rlhf/preferences", get(rl_list_preferences))
         .route(
-            "/v1/rl/rlhf/preferences/:id/judge",
+            "/v1/rl/rlhf/preferences/{id}/judge",
             post(rl_judge_preference),
         )
-        .route("/v1/rl/rlhf/runs/:id/alignment", get(rl_alignment_metrics))
+        .route("/v1/rl/rlhf/runs/{id}/alignment", get(rl_alignment_metrics))
         .route("/v1/rl/optimization/runs", get(rl_optimization_runs_h))
         .route("/v1/rl/multi-agent/runs", get(rl_multi_agent_runs_h))
         // Recap & Resume v1 — F1.2 (Session-only, heuristic-only)
         .route("/v1/recap", post(v1_recap_post))
         .route("/v1/recap", get(v1_recap_list))
-        .route("/v1/recap/:id", get(v1_recap_get))
-        .route("/v1/recap/:id", axum::routing::patch(v1_recap_patch))
-        .route("/v1/recap/:id", axum::routing::delete(v1_recap_delete))
+        .route("/v1/recap/{id}", get(v1_recap_get))
+        .route("/v1/recap/{id}", axum::routing::patch(v1_recap_patch))
+        .route("/v1/recap/{id}", axum::routing::delete(v1_recap_delete))
         // Recap & Resume v1 — F1.3 (resume handles)
         .route("/v1/resume", post(v1_resume_post))
-        .route("/v1/resume/:handle", get(v1_resume_get))
+        .route("/v1/resume/{handle}", get(v1_resume_get))
         // /goal — G1.2 CRUD + G1.3 plan/link/start.
         .route("/v1/goals", post(v1_exec_goal_post))
         .route("/v1/goals", get(v1_exec_goal_list))
-        // G4.4 — register `/v1/goals/current` before the `/v1/goals/:id`
+        // G4.4 — register `/v1/goals/current` before the `/v1/goals/{id}`
         // parameterized routes so axum's matchit picks the static path.
         .route("/v1/goals/current", get(v1_exec_goal_current_get))
         .route(
@@ -6756,22 +6756,22 @@ pub(crate) fn build_router(state: ServeState, port: u16) -> Router {
             "/v1/goals/current",
             axum::routing::delete(v1_exec_goal_current_delete),
         )
-        .route("/v1/goals/:id", get(v1_exec_goal_get))
-        .route("/v1/goals/:id", axum::routing::patch(v1_exec_goal_patch))
-        .route("/v1/goals/:id", axum::routing::delete(v1_exec_goal_delete))
-        .route("/v1/goals/:id/plan", post(v1_exec_goal_plan))
-        .route("/v1/goals/:id/link", post(v1_exec_goal_link))
-        .route("/v1/goals/:id/start", post(v1_exec_goal_start))
-        .route("/v1/goals/:id/recap", post(v1_exec_goal_recap))
-        .route("/v1/goals/:id/children", get(v1_exec_goal_children))
-        .route("/v1/goals/:id/tree", get(v1_exec_goal_tree))
+        .route("/v1/goals/{id}", get(v1_exec_goal_get))
+        .route("/v1/goals/{id}", axum::routing::patch(v1_exec_goal_patch))
+        .route("/v1/goals/{id}", axum::routing::delete(v1_exec_goal_delete))
+        .route("/v1/goals/{id}/plan", post(v1_exec_goal_plan))
+        .route("/v1/goals/{id}/link", post(v1_exec_goal_link))
+        .route("/v1/goals/{id}/start", post(v1_exec_goal_start))
+        .route("/v1/goals/{id}/recap", post(v1_exec_goal_recap))
+        .route("/v1/goals/{id}/children", get(v1_exec_goal_children))
+        .route("/v1/goals/{id}/tree", get(v1_exec_goal_tree))
         // /graph/* — kodegraph code-knowledge-graph (no LLM call; provider-agnostic rule moot).
         .route("/v1/graph/build", post(v1_graph_build))
         .route("/v1/graph/status", get(v1_graph_status))
         .route("/v1/graph/query", post(v1_graph_query))
-        .route("/v1/graph/node/:name", get(v1_graph_node))
-        .route("/v1/graph/neighbors/:name", get(v1_graph_neighbors))
-        .route("/v1/graph/path/:from/:to", get(v1_graph_path))
+        .route("/v1/graph/node/{name}", get(v1_graph_node))
+        .route("/v1/graph/neighbors/{name}", get(v1_graph_neighbors))
+        .route("/v1/graph/path/{from}/{to}", get(v1_graph_path))
         .route("/v1/graph/blast", post(v1_graph_blast))
         .route("/v1/graph/report", get(v1_graph_report))
         // SkillForge — SkillLens (analyse) + SkillOpt (train). Catalog list/
@@ -6779,15 +6779,15 @@ pub(crate) fn build_router(state: ServeState, port: u16) -> Router {
         // provider+model in the body (toolbar selection), never config.toml.
         // See `skillforge_index.rs` + notes/skillforge/.
         .route("/v1/skilllens/skills", get(v1_skilllens_skills))
-        .route("/v1/skilllens/skills/:name", get(v1_skilllens_skill))
+        .route("/v1/skilllens/skills/{name}", get(v1_skilllens_skill))
         .route("/v1/skilllens/refresh", post(v1_skilllens_refresh))
         .route("/v1/skilllens/convert", post(v1_skilllens_convert))
         .route("/v1/skilllens/extract", post(v1_skilllens_extract))
         .route("/v1/skilllens/score", post(v1_skilllens_score))
         .route("/v1/skillopt/train", post(v1_skillopt_train))
         .route("/v1/skillopt/train/stream", post(v1_skillopt_train_stream))
-        .route("/v1/skillopt/status/:job", get(v1_skillopt_status))
-        .route("/v1/skillopt/cancel/:job", post(v1_skillopt_cancel))
+        .route("/v1/skillopt/status/{job}", get(v1_skillopt_status))
+        .route("/v1/skillopt/cancel/{job}", post(v1_skillopt_cancel))
         .route("/v1/skillopt/promote", post(v1_skillopt_promote))
         // Recap & Resume v1 — D1.1 (diffcomplete chain autosave).
         // Patent re-audit: PASS (1–5 unchanged). Writes happen only
@@ -6796,44 +6796,44 @@ pub(crate) fn build_router(state: ServeState, port: u16) -> Router {
         // Mobile Gateway — machine registration & dispatch (iOS/Android remote management)
         .route("/mobile/machines", get(mobile_list_machines))
         .route("/mobile/machines", post(mobile_register_machine))
-        .route("/mobile/machines/:id", get(mobile_get_machine))
+        .route("/mobile/machines/{id}", get(mobile_get_machine))
         .route(
-            "/mobile/machines/:id",
+            "/mobile/machines/{id}",
             axum::routing::delete(mobile_unregister_machine),
         )
-        .route("/mobile/machines/:id/heartbeat", post(mobile_heartbeat))
+        .route("/mobile/machines/{id}/heartbeat", post(mobile_heartbeat))
         .route("/mobile/pairing", post(mobile_create_pairing))
-        .route("/mobile/pairing/:id/accept", post(mobile_accept_pairing))
-        .route("/mobile/pairing/:id/verify", post(mobile_verify_pin))
-        .route("/mobile/pairing/:id/reject", post(mobile_reject_pairing))
+        .route("/mobile/pairing/{id}/accept", post(mobile_accept_pairing))
+        .route("/mobile/pairing/{id}/verify", post(mobile_verify_pin))
+        .route("/mobile/pairing/{id}/reject", post(mobile_reject_pairing))
         .route("/mobile/devices", get(mobile_list_devices))
         .route(
-            "/mobile/devices/:id/push-token",
+            "/mobile/devices/{id}/push-token",
             post(mobile_update_push_token),
         )
         .route(
-            "/mobile/devices/:device_id/machines/:machine_id/unpair",
+            "/mobile/devices/{device_id}/machines/{machine_id}/unpair",
             post(mobile_unpair),
         )
         .route("/mobile/dispatch", post(mobile_dispatch))
-        .route("/mobile/dispatch/:id", get(mobile_get_dispatch))
-        .route("/mobile/dispatch/:id/cancel", post(mobile_cancel_dispatch))
-        .route("/mobile/dispatch/:id/update", post(mobile_update_dispatch))
+        .route("/mobile/dispatch/{id}", get(mobile_get_dispatch))
+        .route("/mobile/dispatch/{id}/cancel", post(mobile_cancel_dispatch))
+        .route("/mobile/dispatch/{id}/update", post(mobile_update_dispatch))
         .route(
-            "/mobile/dispatches/machine/:id",
+            "/mobile/dispatches/machine/{id}",
             get(mobile_machine_dispatches),
         )
         .route(
-            "/mobile/dispatches/device/:id",
+            "/mobile/dispatches/device/{id}",
             get(mobile_device_dispatches),
         )
         .route(
-            "/mobile/notifications/:device_id",
+            "/mobile/notifications/{device_id}",
             get(mobile_notifications),
         )
         .route("/mobile/stats", get(mobile_stats))
         .route("/mobile/sessions", get(mobile_sessions))
-        .route("/mobile/sessions/:id/context", get(mobile_session_context))
+        .route("/mobile/sessions/{id}/context", get(mobile_session_context))
         // F3.x — cross-device active session. Mobile claims with PUT;
         // VibeUI polls GET to follow the claim. Mirrors the
         // /watch/active-session pattern from W1.1.
@@ -6856,7 +6856,7 @@ pub(crate) fn build_router(state: ServeState, port: u16) -> Router {
         .route("/pair", get(pairing_handler))
         .route("/acp/v1/capabilities", get(acp_capabilities))
         .route("/v1/capabilities", get(v1_capabilities))
-        .route("/ws/collab/:room_id", get(ws_collab_handler))
+        .route("/ws/collab/{room_id}", get(ws_collab_handler))
         .route("/mobile/beacon", get(mobile_beacon))
         .route_layer(middleware::from_fn_with_state(public_limiter, rate_limit));
 
@@ -7535,7 +7535,7 @@ async fn handle_collab_ws(
                 message: e.to_string(),
             };
             if let Ok(json) = serde_json::to_string(&err_msg) {
-                let _ = socket.send(WsMessage::Text(json)).await;
+                let _ = socket.send(WsMessage::Text(json.into())).await;
             }
             return;
         }
@@ -7549,14 +7549,14 @@ async fn handle_collab_ws(
         peers,
     };
     let welcome_json = serde_json::to_string(&welcome).unwrap_or_default();
-    if socket.send(WsMessage::Text(welcome_json)).await.is_err() {
+    if socket.send(WsMessage::Text(welcome_json.into())).await.is_err() {
         room.remove_peer(&peer_id).await;
         return;
     }
 
     // Send current doc state as SyncStep1
     let state_msg = room.encode_state().await;
-    if socket.send(WsMessage::Binary(state_msg)).await.is_err() {
+    if socket.send(WsMessage::Binary(state_msg.into())).await.is_err() {
         room.remove_peer(&peer_id).await;
         return;
     }
@@ -7581,11 +7581,11 @@ async fn handle_collab_ws(
                 match msg {
                     Some(Ok(WsMessage::Binary(data))) => {
                         // Binary frame = Yjs sync protocol
-                        let data_vec: Vec<u8> = data;
+                        let data_vec: Vec<u8> = data.into();
                         match room.apply_message(&data_vec).await {
                             Ok(Some(reply)) => {
                                 // Send reply (e.g. SyncStep2) back to sender
-                                let _ = socket.send(WsMessage::Binary(reply)).await;
+                                let _ = socket.send(WsMessage::Binary(reply.into())).await;
                             }
                             Ok(None) => {}
                             Err(e) => {
@@ -7621,13 +7621,13 @@ async fn handle_collab_ws(
                         if let Ok(text) = std::str::from_utf8(data) {
                             if text.starts_with('{') {
                                 // JSON text message
-                                let _ = socket.send(WsMessage::Text(text.to_string())).await;
+                                let _ = socket.send(WsMessage::Text(text.to_string().into())).await;
                             } else {
-                                let _ = socket.send(WsMessage::Binary(data.clone())).await;
+                                let _ = socket.send(WsMessage::Binary(data.clone().into())).await;
                             }
                         } else {
                             // Binary Yjs update
-                            let _ = socket.send(WsMessage::Binary(data.clone())).await;
+                            let _ = socket.send(WsMessage::Binary(data.clone().into())).await;
                         }
                     }
                     Err(_) => break, // channel closed
@@ -7727,7 +7727,7 @@ async fn sessions_json() -> impl IntoResponse {
     }
 }
 
-/// Shareable readonly view of a session — identical to `/view/:id` but injects
+/// Shareable readonly view of a session — identical to `/view/{id}` but injects
 /// a green "Shared" banner and a `noindex` meta tag so search engines don't index it.
 async fn share_session(Path(id): Path<String>) -> impl IntoResponse {
     match SessionStore::open_default() {
@@ -9238,7 +9238,7 @@ async fn mobile_sessions(State(state): State<ServeState>) -> Json<serde_json::Va
     Json(serde_json::json!({ "sessions": sessions }))
 }
 
-/// `GET /mobile/sessions/:id/context` — auth required.
+/// `GET /mobile/sessions/{id}/context` — auth required.
 ///
 /// Returns a HandoffContext JSON bundle for the requested session so the
 /// mobile app can "continue" it with full conversation history. Phase 7
@@ -9286,7 +9286,7 @@ async fn mobile_session_context(
     }
 }
 
-/// Pure builder for the `/mobile/sessions/:id/context` response body.
+/// Pure builder for the `/mobile/sessions/{id}/context` response body.
 // ── F3.x: cross-device active session ───────────────────────────────────────
 
 /// `PUT /mobile/active-session` request body.
@@ -10988,7 +10988,7 @@ mod tests {
             assert_eq!(json.as_array().unwrap().len(), 0);
         }
 
-        // ── GET /jobs/:id for nonexistent job → 404 ──────────────────
+        // ── GET /jobs/{id} for nonexistent job → 404 ──────────────────
 
         #[tokio::test]
         async fn get_nonexistent_job_returns_404() {
@@ -11002,7 +11002,7 @@ mod tests {
             assert_eq!(resp.status(), StatusCode::NOT_FOUND);
         }
 
-        // ── POST /jobs/:id/cancel for nonexistent job → 404 ──────────
+        // ── POST /jobs/{id}/cancel for nonexistent job → 404 ──────────
 
         #[tokio::test]
         async fn cancel_nonexistent_job_returns_404() {
@@ -11272,7 +11272,7 @@ mod tests {
             let (status, _) = send(&app, "POST", "/v1/goals", tok, Some(dup)).await;
             assert_eq!(status, StatusCode::CONFLICT);
 
-            // 5. GET /v1/goals/:id — detail + links.
+            // 5. GET /v1/goals/{id} — detail + links.
             let (status, body) =
                 send(&app, "GET", &format!("/v1/goals/{goal_id}"), tok, None).await;
             assert_eq!(status, StatusCode::OK);
@@ -11332,7 +11332,7 @@ mod tests {
             assert_eq!(status, StatusCode::CREATED);
 
             // 10. Create a child goal, reparent it under our goal,
-            //     and confirm GET /:id/children returns just it.
+            //     and confirm GET /{id}/children returns just it.
             let (_, child_body) = send(
                 &app,
                 "POST",
@@ -11404,7 +11404,7 @@ mod tests {
             }
         }
 
-        // ── GET /jobs/:id 404 body contains error message ───────────
+        // ── GET /jobs/{id} 404 body contains error message ───────────
 
         #[tokio::test]
         async fn get_nonexistent_job_body_has_error_message() {
diff --git a/vibecli/vibecli-cli/src/watch_bridge.rs b/vibecli/vibecli-cli/src/watch_bridge.rs
index 20a6b38bf..e96633782 100644
--- a/vibecli/vibecli-cli/src/watch_bridge.rs
+++ b/vibecli/vibecli-cli/src/watch_bridge.rs
@@ -14,11 +14,11 @@
 //!   POST /watch/refresh-token                — renew access token
 //!   POST /watch/wrist                        — wrist-on/off event
 //!   GET  /watch/sessions                     — list recent sessions (watch-optimised)
-//!   GET  /watch/sessions/:id/messages        — get messages for session
-//!   GET  /watch/stream/:id                   — SSE stream (watch-optimised events)
+//!   GET  /watch/sessions/{id}/messages        — get messages for session
+//!   GET  /watch/stream/{id}                   — SSE stream (watch-optimised events)
 //!   POST /watch/dispatch                     — send message / start session
 //!   GET  /watch/devices                      — list registered watch devices
-//!   DELETE /watch/devices/:id                — revoke watch device
+//!   DELETE /watch/devices/{id}                — revoke watch device
 //!
 //! This module is imported and wired into `serve.rs` via `build_watch_router()`.
 
@@ -185,14 +185,14 @@ pub fn build_watch_router(state: WatchBridgeState) -> Router {
         .route("/refresh-token", post(watch_refresh_token))
         .route("/wrist", post(watch_wrist_event))
         .route("/sessions", get(watch_list_sessions))
-        .route("/sessions/:id/messages", get(watch_session_messages))
-        .route("/sessions/:id/recap", get(watch_session_recap))
+        .route("/sessions/{id}/messages", get(watch_session_messages))
+        .route("/sessions/{id}/recap", get(watch_session_recap))
         .route("/jobs", get(watch_list_jobs))
-        .route("/jobs/:id/recap", get(watch_job_recap))
+        .route("/jobs/{id}/recap", get(watch_job_recap))
         .route("/goals", get(watch_list_goals))
-        .route("/goals/:id", get(watch_get_goal))
-        .route("/goals/:id/start", post(watch_start_goal))
-        .route("/stream/:id", get(watch_stream))
+        .route("/goals/{id}", get(watch_get_goal))
+        .route("/goals/{id}/start", post(watch_start_goal))
+        .route("/stream/{id}", get(watch_stream))
         .route("/dispatch", post(watch_dispatch))
         .route(
             "/active-session",
@@ -204,7 +204,7 @@ pub fn build_watch_router(state: WatchBridgeState) -> Router {
             get(watch_get_sandbox_chat_session).put(watch_set_sandbox_chat_session),
         )
         .route("/devices", get(watch_list_devices))
-        .route("/devices/:id", delete(watch_revoke_device))
+        .route("/devices/{id}", delete(watch_revoke_device))
         // DREAD #1 Slice G part 3 (watch) — tainted-argument bridge.
         // Bridges to the same `HttpPromptQueue` powering /v1/tainted/*
         // so a prompt enqueued by an agent's tool-call surfaces on
@@ -221,7 +221,7 @@ pub fn build_watch_router(state: WatchBridgeState) -> Router {
         // a compact catalog count + a one-line skill summary. The heavy
         // train/promote mutations stay desktop-only. Reuses serve.rs helpers.
         .route("/skilllens/skills", get(watch_skilllens_skills))
-        .route("/skilllens/skills/:name", get(watch_skilllens_skill))
+        .route("/skilllens/skills/{name}", get(watch_skilllens_skill))
         .with_state(state)
 }
 
@@ -300,7 +300,7 @@ async fn watch_skilllens_skills() -> impl IntoResponse {
     (s, Json(compact))
 }
 
-/// `GET /skilllens/skills/:name` → one-line `{name, summary, category}`.
+/// `GET /skilllens/skills/{name}` → one-line `{name, summary, category}`.
 async fn watch_skilllens_skill(
     axum::extract::Path(name): axum::extract::Path<String>,
 ) -> impl IntoResponse {
@@ -500,7 +500,7 @@ async fn watch_list_sessions(
     Json(serde_json::json!({"sessions": summaries})).into_response()
 }
 
-/// GET /watch/sessions/:id/messages — paginated message list.
+/// GET /watch/sessions/{id}/messages — paginated message list.
 /// Auth: Watch-Token (watch/wear) OR Bearer (phone apps / VibeUI).
 async fn watch_session_messages(
     State(state): State<WatchBridgeState>,
@@ -558,7 +558,7 @@ async fn watch_session_messages(
     .into_response()
 }
 
-/// GET /watch/sessions/:id/recap — read-only freshest recap for a session.
+/// GET /watch/sessions/{id}/recap — read-only freshest recap for a session.
 ///
 /// Returns `{"recap": <Recap json>}` when a recap exists, or
 /// `{"recap": null}` when none has been generated yet. Watch never
@@ -638,7 +638,7 @@ async fn watch_list_jobs(
     Json(serde_json::json!({"jobs": slim})).into_response()
 }
 
-/// W1.2 — GET /watch/jobs/:id/recap — read-only freshest job recap.
+/// W1.2 — GET /watch/jobs/{id}/recap — read-only freshest job recap.
 /// Mirrors `watch_session_recap` but reads from `jobs.db` (J1.1
 /// schema, decrypted on read). Watch never generates recaps; the
 /// daemon's J1.2 terminal-state hook owns generation.
@@ -671,7 +671,7 @@ async fn watch_job_recap(
     }
 }
 
-/// GET /watch/stream/:id — SSE stream with Watch-optimised payloads.
+/// GET /watch/stream/{id} — SSE stream with Watch-optimised payloads.
 async fn watch_stream(
     State(state): State<WatchBridgeState>,
     headers: axum::http::HeaderMap,
@@ -1058,7 +1058,7 @@ async fn watch_list_devices(
     Json(serde_json::json!({"devices": safe})).into_response()
 }
 
-/// DELETE /watch/devices/:id — revoke a watch device (requires bearer token).
+/// DELETE /watch/devices/{id} — revoke a watch device (requires bearer token).
 async fn watch_revoke_device(
     State(state): State<WatchBridgeState>,
     headers: axum::http::HeaderMap,
@@ -1087,8 +1087,8 @@ async fn watch_revoke_device(
 //
 // `/watch/goals` returns a compact summary list (id, title, status,
 // workspace short-name) so the watch tile/picker can render without
-// pulling full plan/link payloads. `/watch/goals/:id` returns the full
-// goal + links — same shape as `/v1/goals/:id` since the watch detail
+// pulling full plan/link payloads. `/watch/goals/{id}` returns the full
+// goal + links — same shape as `/v1/goals/{id}` since the watch detail
 // view shows everything anyway.
 
 #[derive(serde::Serialize)]
diff --git a/vibewatch/VibeCodyWear/gradle/libs.versions.toml b/vibewatch/VibeCodyWear/gradle/libs.versions.toml
index 8526f7993..387abb95d 100644
--- a/vibewatch/VibeCodyWear/gradle/libs.versions.toml
+++ b/vibewatch/VibeCodyWear/gradle/libs.versions.toml
@@ -22,7 +22,7 @@ okhttp = "5.4.0"
 moshi = "1.15.1"
 
 # Coroutines
-coroutinesPlayServices = "1.8.1"
+coroutinesPlayServices = "1.11.0"
 
 # Security crypto
 securityCrypto = "1.1.0"
@@ -30,7 +30,7 @@ securityCrypto = "1.1.0"
 # Tiles support — async + preview
 guava = "33.6.0-android"
 concurrentFutures = "1.2.0"
-composeUiToolingPreview = "1.7.6"
+composeUiToolingPreview = "1.11.4"
 
 [libraries]
 # Activity
diff --git a/vibewatch/VibeCodyWear/gradle/wrapper/gradle-wrapper.jar b/vibewatch/VibeCodyWear/gradle/wrapper/gradle-wrapper.jar
old mode 100755
new mode 100644
index 13372aef5..b1b8ef56b
Binary files a/vibewatch/VibeCodyWear/gradle/wrapper/gradle-wrapper.jar and b/vibewatch/VibeCodyWear/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/vibewatch/VibeCodyWear/gradle/wrapper/gradle-wrapper.properties b/vibewatch/VibeCodyWear/gradle/wrapper/gradle-wrapper.properties
index df97d72b8..a351597e6 100644
--- a/vibewatch/VibeCodyWear/gradle/wrapper/gradle-wrapper.properties
+++ b/vibewatch/VibeCodyWear/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.10.2-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
diff --git a/vibewatch/VibeCodyWear/gradlew b/vibewatch/VibeCodyWear/gradlew
index 9d82f7891..249efbb03 100755
--- a/vibewatch/VibeCodyWear/gradlew
+++ b/vibewatch/VibeCodyWear/gradlew
@@ -1,74 +1,128 @@
-#!/usr/bin/env bash
+#!/bin/sh
+
+#
+# Copyright © 2015 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
 
 ##############################################################################
-##
-##  Gradle start up script for UN*X
-##
+#
+#   gradlew start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh gradlew
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/3d91ce3b8caaf77ad09f381f43615b715b53f72c/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
 ##############################################################################
 
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS=""
+# Attempt to set APP_HOME
 
-APP_NAME="Gradle"
-APP_BASE_NAME=`basename "$0"`
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
-MAX_FD="maximum"
+MAX_FD=maximum
 
-warn ( ) {
+warn () {
     echo "$*"
-}
+} >&2
 
-die ( ) {
+die () {
     echo
     echo "$*"
     echo
     exit 1
-}
+} >&2
 
 # OS specific support (must be 'true' or 'false').
 cygwin=false
 msys=false
 darwin=false
-case "`uname`" in
-  CYGWIN* )
-    cygwin=true
-    ;;
-  Darwin* )
-    darwin=true
-    ;;
-  MINGW* )
-    msys=true
-    ;;
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
 esac
 
-# Attempt to set APP_HOME
-# Resolve links: $0 may be a link
-PRG="$0"
-# Need this for relative symlinks.
-while [ -h "$PRG" ] ; do
-    ls=`ls -ld "$PRG"`
-    link=`expr "$ls" : '.*-> \(.*\)$'`
-    if expr "$link" : '/.*' > /dev/null; then
-        PRG="$link"
-    else
-        PRG=`dirname "$PRG"`"/$link"
-    fi
-done
-SAVED="`pwd`"
-cd "`dirname \"$PRG\"`/" >/dev/null
-APP_HOME="`pwd -P`"
-cd "$SAVED" >/dev/null
 
-CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
 
 # Determine the Java command to use to start the JVM.
 if [ -n "$JAVA_HOME" ] ; then
     if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
         # IBM's JDK on AIX uses strange locations for the executables
-        JAVACMD="$JAVA_HOME/jre/sh/java"
+        JAVACMD=$JAVA_HOME/jre/sh/java
     else
-        JAVACMD="$JAVA_HOME/bin/java"
+        JAVACMD=$JAVA_HOME/bin/java
     fi
     if [ ! -x "$JAVACMD" ] ; then
         die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
@@ -77,84 +131,118 @@ Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
     fi
 else
-    JAVACMD="java"
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
+    fi
 fi
 
 # Increase the maximum file descriptors if we can.
-if [ "$cygwin" = "false" -a "$darwin" = "false" ] ; then
-    MAX_FD_LIMIT=`ulimit -H -n`
-    if [ $? -eq 0 ] ; then
-        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
-            MAX_FD="$MAX_FD_LIMIT"
-        fi
-        ulimit -n $MAX_FD
-        if [ $? -ne 0 ] ; then
-            warn "Could not set maximum file descriptor limit: $MAX_FD"
-        fi
-    else
-        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
-    fi
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
 fi
 
-# For Darwin, add options to specify how the application appears in the dock
-if $darwin; then
-    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
-fi
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
 
-# For Cygwin, switch paths to Windows format before running java
-if $cygwin ; then
-    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
-    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
-    JAVACMD=`cygpath --unix "$JAVACMD"`
-
-    # We build the pattern for arguments to be converted via cygpath
-    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
-    SEP=""
-    for dir in $ROOTDIRSRAW ; do
-        ROOTDIRS="$ROOTDIRS$SEP$dir"
-        SEP="|"
-    done
-    OURCYGPATTERN="(^($ROOTDIRS))"
-    # Add a user-defined pattern to the cygpath arguments
-    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
-        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
-    fi
     # Now convert the arguments - kludge to limit ourselves to /bin/sh
-    i=0
-    for arg in "$@" ; do
-        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
-        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
-
-        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
-            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
-        else
-            eval `echo args$i`="\"$arg\""
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
         fi
-        i=$((i+1))
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
     done
-    case $i in
-        (0) set -- ;;
-        (1) set -- "$args0" ;;
-        (2) set -- "$args0" "$args1" ;;
-        (3) set -- "$args0" "$args1" "$args2" ;;
-        (4) set -- "$args0" "$args1" "$args2" "$args3" ;;
-        (5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
-        (6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
-        (7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
-        (8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
-        (9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
-    esac
 fi
 
-# Split up the JVM_OPTS And GRADLE_OPTS values into an array, following the shell quoting and substitution rules
-function splitJvmOpts() {
-    JVM_OPTS=("$@")
-}
-eval splitJvmOpts $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS
-JVM_OPTS[${#JVM_OPTS[*]}]="-Dorg.gradle.appname=$APP_BASE_NAME"
 
-exec "$JAVACMD" "${JVM_OPTS[@]}" -classpath "$CLASSPATH" org.gradle.wrapper.GradleWrapperMain "$@"
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"
diff --git a/vibewatch/VibeCodyWear/gradlew.bat b/vibewatch/VibeCodyWear/gradlew.bat
old mode 100755
new mode 100644
index aec99730b..8508ef684
--- a/vibewatch/VibeCodyWear/gradlew.bat
+++ b/vibewatch/VibeCodyWear/gradlew.bat
@@ -1,90 +1,82 @@
-@if "%DEBUG%" == "" @echo off
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
 @rem ##########################################################################
 @rem
-@rem  Gradle startup script for Windows
+@rem  gradlew startup script for Windows
 @rem
 @rem ##########################################################################
 
-@rem Set local scope for the variables with windows NT shell
-if "%OS%"=="Windows_NT" setlocal
-
-@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-set DEFAULT_JVM_OPTS=
+@rem Set local scope for the variables, and ensure extensions are enabled
+setlocal EnableExtensions
 
 set DIRNAME=%~dp0
-if "%DIRNAME%" == "" set DIRNAME=.
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
 set APP_BASE_NAME=%~n0
 set APP_HOME=%DIRNAME%
 
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
 @rem Find java.exe
 if defined JAVA_HOME goto findJavaFromJavaHome
 
 set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
-if "%ERRORLEVEL%" == "0" goto init
+if %ERRORLEVEL% equ 0 goto execute
 
-echo.
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
-goto fail
+"%COMSPEC%" /c exit 1
 
 :findJavaFromJavaHome
 set JAVA_HOME=%JAVA_HOME:"=%
 set JAVA_EXE=%JAVA_HOME%/bin/java.exe
 
-if exist "%JAVA_EXE%" goto init
-
-echo.
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
-
-goto fail
-
-:init
-@rem Get command-line arguments, handling Windowz variants
+if exist "%JAVA_EXE%" goto execute
 
-if not "%OS%" == "Windows_NT" goto win9xME_args
-if "%@eval[2+2]" == "4" goto 4NT_args
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
-:win9xME_args
-@rem Slurp the command line arguments.
-set CMD_LINE_ARGS=
-set _SKIP=2
-
-:win9xME_args_slurp
-if "x%~1" == "x" goto execute
-
-set CMD_LINE_ARGS=%*
-goto execute
-
-:4NT_args
-@rem Get arguments from the 4NT Shell from JP Software
-set CMD_LINE_ARGS=%$
+"%COMSPEC%" /c exit 1
 
 :execute
 @rem Setup the command line
 
-set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
-
-@rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS%
-
-:end
-@rem End local scope for the variables with windows NT shell
-if "%ERRORLEVEL%"=="0" goto mainEnd
 
-:fail
-rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
-rem the _cmd.exe /c_ return code!
-if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
-exit /b 1
 
-:mainEnd
-if "%OS%"=="Windows_NT" endlocal
+@rem Execute gradlew
+@rem endlocal doesn't take effect until after the line is parsed and variables are expanded
+@rem which allows us to clear the local environment before executing the java command
+endlocal & "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* & call :exitWithErrorLevel
 
-:omega
+:exitWithErrorLevel
+@rem Use "%COMSPEC%" /c exit to allow operators to work properly in scripts
+"%COMSPEC%" /c exit %ERRORLEVEL%