@4pm/cli 1.19.7 → 1.20.0

package/dist/index.js

@@ -29519,8 +29519,8 @@ async function runLink(serverUrl, explicitProfile, token = null) {
 }
 
 // src/commands/start.ts
-import { spawn as spawn10 } from "child_process";
-import { join as join36 } from "path";
+import { spawn as spawn11 } from "child_process";
+import { join as join37 } from "path";
 
 // src/core/update.ts
 import { execSync as execSync2 } from "child_process";
@@ -32732,9 +32732,9 @@ async function checkAndUpdate(serverUrl, autoUpdate) {
 
 // src/core/ws-client.ts
 init_wrapper();
-import { randomUUID as randomUUID3 } from "crypto";
-import { basename as basename7, join as join31 } from "path";
-import { existsSync as existsSync16, mkdirSync as mkdirSync7 } from "fs";
+import { randomUUID as randomUUID4 } from "crypto";
+import { basename as basename7, join as join32 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync8 } from "fs";
 
 // vendor/@4pm/utils/helpers.ts
 function backoffJitterMs(attempt, baseMs = 500, maxMs = 1e4) {
@@ -37191,7 +37191,6 @@ var toolRuleSchema = external_exports.string().min(1).max(500);
 var agentToolsPermissionsSchema = external_exports.object({
   defaultMode: external_exports.enum(["default", "acceptEdits", "plan", "bypassPermissions"]),
   allow: external_exports.array(toolRuleSchema).max(500),
-  ask: external_exports.array(toolRuleSchema).max(500),
   deny: external_exports.array(toolRuleSchema).max(500)
 });
 var agentToolsReadQuerySchema = external_exports.object({
@@ -37681,6 +37680,50 @@ async function commitAndPushSubmodules(root, submodules, emit) {
     emit("submodule-push-failed", `Submodules committed locally but the push failed: ${msg}`);
   }
 }
+function providerSlug(url) {
+  const provider = /github\.com/i.test(url) ? "gh" : /gitlab\.com/i.test(url) ? "glab" : null;
+  const m2 = /(?:github|gitlab)\.com[/:]+([^/]+\/.+?)(?:\.git)?\/?$/i.exec(url);
+  return { provider, slug: m2?.[1] ?? "" };
+}
+async function commitAndOpenPr(root, repo, emit) {
+  emit("commit", "Committing the scaffolded project\u2026");
+  await run2("git", ["add", "-A"], { cwd: root, timeout: 6e4 });
+  const staged = (await run2("git", ["diff", "--cached", "--name-only"], { cwd: root, timeout: 3e4 })).stdout.trim();
+  if (!staged) {
+    emit("commit", "Nothing to commit \u2014 skipping the pull request.");
+    return;
+  }
+  const commitArgs = ["commit", "-m", "chore: scaffold project (4PM)"];
+  try {
+    await run2("git", commitArgs, { cwd: root, timeout: 6e4 });
+  } catch {
+    await run2("git", ["-c", "user.name=4PM", "-c", "user.email=noreply@4pm.app", ...commitArgs], { cwd: root, timeout: 6e4 });
+  }
+  const branch = (repo.branch ?? "").trim();
+  emit("push", "Pushing the scaffold branch\u2026");
+  try {
+    await run2("git", ["push", "-u", "origin", ...branch ? [branch] : ["HEAD"]], { cwd: root, timeout: 12e4 });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    emit("push-failed", `Scaffold committed locally but the push failed: ${msg} \u2014 push it from the Git tab when credentials are available.`);
+    return;
+  }
+  const { provider, slug } = providerSlug(repo.url ?? "");
+  if (!provider) {
+    emit("pr", "Unknown git host \u2014 skipping the pull request.");
+    return;
+  }
+  emit("pr", `Opening a pull request via ${provider}\u2026`);
+  try {
+    const args = provider === "glab" ? ["mr", "create", "--fill", ...slug ? ["-R", slug] : []] : ["pr", "create", "--fill", ...slug ? ["-R", slug] : []];
+    const { stdout } = await run2(provider, args, { cwd: root, timeout: 12e4 });
+    const link2 = stdout.trim().split(/\s+/).find((s3) => /^https?:\/\//.test(s3)) ?? stdout.trim().split("\n").pop() ?? "";
+    emit("pr", `Pull request opened${link2 ? `: ${link2}` : "."}`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    emit("pr-failed", `Could not open a pull request (${provider}): ${msg}`);
+  }
+}
 function cloneArgs(url, dest, branch) {
   const b2 = (branch ?? "").trim();
   return b2 ? ["clone", "-b", b2, url, dest] : ["clone", url, dest];
@@ -37787,18 +37830,20 @@ async function scaffoldProject(payload, profileDir2, onProgress) {
     if (!repo) throw new Error("A project must declare one repo (ADR-0314).");
     emit("git", "Cloning repository\u2026");
     await provisionRepo(target, repo, emit, { createMissingBranch: true });
-    await scaffoldRepo(target, payload.projectName, payload.spec, emit);
+    await scaffoldRepo(target, payload.projectName, payload.spec, emit, { resetClaude: true });
     await attachSubmodules(target, submodulesOf(reposOf(payload.spec)), emit, true);
     emit("version", "Writing .4pm/.4pm.json\u2026");
     await writeTemplateMarker(target);
+    await commitAndOpenPr(target, repo, emit);
     onProgress?.({ projectId: payload.projectId, step: "done", message: "Scaffold complete.", done: true });
     return { ok: true, path: target };
   } catch (err) {
     return { ok: false, error: err instanceof Error ? err.message : String(err), step: lastStep };
   }
 }
-async function scaffoldRepo(dir2, label, spec, emit) {
+async function scaffoldRepo(dir2, label, spec, emit, opts = {}) {
   await mkdir(dir2, { recursive: true });
+  if (opts.resetClaude) await resetTemplateManagedClaude(dir2, label, emit);
   emit("copy", `Copying the sample template into ${label}\u2026`);
   await cp(sampleDir(), dir2, { recursive: true, force: false, errorOnExist: false });
   if (spec) {
@@ -37807,6 +37852,13 @@ async function scaffoldRepo(dir2, label, spec, emit) {
     await aiInit(dir2, spec, emit);
   }
 }
+async function resetTemplateManagedClaude(dir2, label, emit) {
+  const claude = join6(dir2, ".claude");
+  if (!existsSync4(claude)) return;
+  emit("copy", `Resetting template .claude config in ${label}\u2026`);
+  await rm(join6(claude, "settings.json"), { force: true });
+  await rm(join6(claude, "skills"), { recursive: true, force: true });
+}
 async function writeTemplateMarker(target) {
   const dir2 = join6(target, ".4pm");
   await mkdir(dir2, { recursive: true });
@@ -37854,15 +37906,20 @@ ${specJson}`
 ${specJson}` + (guideInstructions ? `
 Also incorporate these additional instructions/content:
 ${guideInstructions}
-` : "")
+` : ""),
+    guideInstructions
   );
 }
-async function generateFile(path, prompt) {
+async function generateFile(path, prompt, fallback) {
   try {
     const text = await aiGenerate(prompt);
-    if (text.trim()) await writeFile(path, text.trim() + "\n", "utf8");
+    if (text.trim()) {
+      await writeFile(path, text.trim() + "\n", "utf8");
+      return;
+    }
   } catch {
   }
+  if (fallback && fallback.trim()) await writeFile(path, fallback.trim() + "\n", "utf8");
 }
 async function addProject(payload, profileDir2, onProgress) {
   let lastStep = "start";
@@ -38332,6 +38389,12 @@ var WsChannels = {
   // AI knowledge distill (ADR-0190): server → project cli request–reply. The worker runs the AI CLI
   // in the project's working dir with a distillation prompt and replies with the composed markdown.
   KNOWLEDGE_COMPOSE: "knowledge.compose",
+  // Ticket → FAQ synthesis (ADR-0333): server (platform-pool dispatcher) → platform-pool cli
+  // request–reply. The dispatcher sends the selected support tickets + the 4pm-faq repo with a
+  // short-lived WRITE token; the worker runs an agent-write that distils the tickets into FAQ
+  // entries, commits, pushes a branch, opens a PR, then wipes the token/clone, and replies with the
+  // PR URL. The write token never persists on the worker (leak-safety on release/reassign).
+  FAQ_COMPOSE: "faq.compose",
   // Shared AI memory (ADR-0245): cli → server one-way write-back of the compacted rolling memory for
   // the project it serves (persisted per project × machine-user link). The read direction rides
   // `ws_token` (seeds the cli cache on connect); this channel only carries updates.
@@ -42360,7 +42423,8 @@ async function gitRepos(root) {
   if (!top || !(top === base || top.startsWith(base + sep8))) return { repos: [] };
   const repos = [];
   const rootRemote = (await git(base, ["remote", "get-url", "origin"])).trim();
-  repos.push({ subdir: "", name: "", remote: rootRemote || null });
+  const rootBranch = (await git(base, ["rev-parse", "--abbrev-ref", "HEAD"])).trim();
+  repos.push({ subdir: "", name: "", remote: rootRemote || null, branch: rootBranch || null });
   const subOut = await git(base, ["submodule", "status"]);
   for (const line of subOut.split("\n")) {
     const m2 = line.trim().match(/^[-+U ]?[0-9a-f]{7,40}\s+(\S+)/);
@@ -42369,7 +42433,8 @@ async function gitRepos(root) {
     const abs = resolve8(base, subPath);
     if (!(abs === base || abs.startsWith(base + sep8))) continue;
     const remote = (await git(abs, ["remote", "get-url", "origin"])).trim();
-    repos.push({ subdir: subPath, name: subPath, remote: remote || null });
+    const branch = (await git(abs, ["rev-parse", "--abbrev-ref", "HEAD"])).trim();
+    repos.push({ subdir: subPath, name: subPath, remote: remote || null, branch: branch || null });
   }
   return { repos };
 }
@@ -42740,6 +42805,145 @@ async function runKnowledgeCompose(req, ai2, physicRoot) {
   return { bodyMarkdown: "", error: lastReason };
 }
 
+// src/core/faq-compose.ts
+import { spawn as spawn9, execFile as execFile10 } from "child_process";
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, rmSync as rmSync7 } from "fs";
+import { randomUUID as randomUUID3 } from "crypto";
+import { join as join24 } from "path";
+import { tmpdir as tmpdir3 } from "os";
+import { promisify as promisify10 } from "util";
+var execFileAsync2 = promisify10(execFile10);
+var NO_USAGE2 = { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 };
+var COMPOSE_TIMEOUT_MS2 = 10 * 60 * 1e3;
+function authedUrl2(url, token) {
+  if (url.startsWith("https://")) return url.replace("https://", `https://x-access-token:${token}@`);
+  return url;
+}
+function buildPrompt4(tickets) {
+  const transcript = tickets.map((t2) => {
+    const thread = t2.messages.map((m2) => `  [${m2.author}] ${m2.body}`).join("\n");
+    return `### Ticket ${t2.id} \u2014 ${t2.subject} (${t2.category})
+${thread}`;
+  }).join("\n\n");
+  return [
+    "You are maintaining the 4PM product FAQ, stored as markdown in THIS git repository (your CWD).",
+    "From the resolved support tickets below, distil reusable, product-general FAQ entries and add or",
+    "update the appropriate markdown file(s) in this repo (e.g. an FAQ.md, or the closest existing",
+    "topic file \u2014 inspect the repo first and match its structure/style).",
+    "",
+    "Rules:",
+    "- Write generalized Q&A, NOT ticket-specific replies; never include customer names, emails, ids,",
+    "  org names or any personal data from the tickets.",
+    "- Merge with existing entries instead of duplicating; keep the existing formatting and headings.",
+    "- If a ticket yields no reusable FAQ value, skip it. If nothing is worth adding, make NO changes.",
+    "- Only edit markdown documentation files; do not touch code, CI, or unrelated files.",
+    "- Do NOT run git commit/push or open a PR yourself \u2014 just leave the edited files in the working",
+    "  tree; the surrounding tooling handles commit + PR.",
+    "",
+    "===== RESOLVED TICKETS =====",
+    transcript
+  ].join("\n");
+}
+function runClaudeOnce2(cmd, profile, prompt, cwd2, extraEnv) {
+  return new Promise((resolve10, reject) => {
+    const isClaude = cmd.includes("claude");
+    const args = [
+      "-p",
+      ...profile?.model ? ["--model", profile.model] : [],
+      ...isClaude ? ["--output-format", "stream-json", "--verbose"] : [],
+      // Write-capable headless agent (ADR-0271): auto-approve tools so it never stalls on a prompt.
+      ...isClaude ? ["--permission-mode", "bypassPermissions"] : [],
+      ...cmd.includes("codex") ? ["--dangerously-bypass-approvals-and-sandbox"] : []
+    ];
+    const env3 = {
+      ...process.env,
+      ...extraEnv,
+      ...profile ? { CLAUDE_CONFIG_DIR: profile.dir } : {}
+    };
+    const child = spawn9(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: cwd2, env: env3 });
+    const parser = createAiStreamParser(cmd);
+    let out = "";
+    let err = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      reject(new Error("faq-compose agent timed out"));
+    }, COMPOSE_TIMEOUT_MS2);
+    timer.unref();
+    child.stdout.on("data", (d) => out += parser.push(d.toString()));
+    child.stderr.on("data", (d) => err += d.toString());
+    child.on("error", (e) => {
+      clearTimeout(timer);
+      reject(e);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      out += parser.flush();
+      resolve10({ code: code ?? -1, out, err, usage: parser.usage() });
+    });
+    child.stdin.write(prompt);
+    child.stdin.end();
+  });
+}
+async function runClaudeWithFailover2(prompt, cwd2, ai2) {
+  const attempts = ai2.profiles.length > 0 ? ai2.profiles : [null];
+  let lastReason = "no attempt";
+  for (let i = 0; i < attempts.length; i++) {
+    const { code, out, err, usage } = await runClaudeOnce2(ai2.cmd, attempts[i], prompt, cwd2, ai2.env);
+    if (code === 0) return usage;
+    lastReason = `exited ${code}: ${(err || out).slice(0, 500)}`;
+    if (i === attempts.length - 1) break;
+  }
+  throw new Error(`claude ${lastReason}`);
+}
+async function runFaqCompose(req, ai2) {
+  if (!req.repo.token) return { prUrl: "", error: "no write token" };
+  const workDir = join24(tmpdir3(), "4pm-faq-sync", randomUUID3());
+  const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+  const authed = authedUrl2(req.repo.url, req.repo.token);
+  try {
+    mkdirSync7(workDir, { recursive: true });
+    await execFileAsync2("git", ["clone", "--depth", "1", "--branch", req.repo.branch, authed, workDir], { env: gitEnv });
+    await execFileAsync2("git", ["-C", workDir, "config", "user.name", "4PM FAQ Bot"], { env: gitEnv });
+    await execFileAsync2("git", ["-C", workDir, "config", "user.email", "faq-bot@4pm.app"], { env: gitEnv });
+    await execFileAsync2("git", ["-C", workDir, "checkout", "-b", req.headBranch], { env: gitEnv });
+    const usage = await runClaudeWithFailover2(buildPrompt4(req.tickets), workDir, ai2);
+    await execFileAsync2("git", ["-C", workDir, "add", "-A"], { env: gitEnv });
+    const staged = await execFileAsync2("git", ["-C", workDir, "diff", "--cached", "--name-only"], { env: gitEnv });
+    if (!staged.stdout.trim()) return { prUrl: "", tokens: usage.tokens || estimateTokens2(""), finishedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    await execFileAsync2("git", ["-C", workDir, "commit", "-m", "docs(faq): synthesize from support tickets (4PM)"], { env: gitEnv });
+    await execFileAsync2("git", ["-C", workDir, "push", "-u", "origin", req.headBranch], { env: gitEnv });
+    let prUrl = "";
+    try {
+      const pr2 = await execFileAsync2(
+        "gh",
+        ["pr", "create", "--fill", "--head", req.headBranch, "--base", req.repo.branch],
+        { cwd: workDir, env: { ...gitEnv, GH_TOKEN: req.repo.token } }
+      );
+      prUrl = pr2.stdout.trim().split("\n").pop() ?? "";
+    } catch (err) {
+      logger.warn("faq.compose.pr.failed", { error: String(err) });
+    }
+    const u2 = usage.tokens > 0 ? usage : { ...NO_USAGE2 };
+    return {
+      prUrl,
+      branch: req.headBranch,
+      tokens: u2.tokens,
+      ...usage.tokens > 0 ? { tokensBreakdown: { input: usage.input, output: usage.output, cacheRead: usage.cacheRead, cacheCreation: usage.cacheCreation } } : {},
+      finishedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  } catch (err) {
+    logger.warn("faq.compose.failed", { error: String(err) });
+    return { prUrl: "", error: String(err) };
+  } finally {
+    if (existsSync14(workDir)) {
+      try {
+        rmSync7(workDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+}
+
 // src/core/ws-client/handlers/support.ts
 function handleSupportChannels(ctx, message, payload) {
   switch (message.channel) {
@@ -42796,6 +43000,28 @@ function handleSupportChannels(ctx, message, payload) {
       }).finally(() => ctx.bus.endBusy("knowledge-compose"));
       return true;
     }
+    case WsChannels.FAQ_COMPOSE: {
+      const freq = payload;
+      const fcfg = readProfileConfig(ctx.profileDir);
+      const fcmd = fcfg.aiCli || "claude";
+      const fai = {
+        cmd: fcmd,
+        profiles: resolveClaudeProfiles(fcfg, getWorkingProfile(ctx.profileDir, fcmd)),
+        env: fcfg.aiEnv
+      };
+      ctx.bus.push({ source: "server", kind: "aireq", text: `${fcmd} \u2039 synthesize FAQ (${freq.tickets.length} tickets)` });
+      ctx.bus.startBusy("faq-compose");
+      void runFaqCompose(freq, fai).then((reply) => {
+        if (reply.error) {
+          ctx.bus.push({ source: "server", kind: "log", text: `faq-compose failed: ${reply.error}`, level: "warn" });
+        } else {
+          ctx.bus.push({ source: "server", kind: "aires", text: `${fcmd} \u203A ${reply.prUrl || "no changes"}` });
+        }
+        reportToolResult(fcmd, !reply.error, reply.error);
+        ctx.send(WsChannels.FAQ_COMPOSE, reply, message.id);
+      }).finally(() => ctx.bus.endBusy("faq-compose"));
+      return true;
+    }
     default:
       return false;
   }
@@ -42894,7 +43120,7 @@ function handleToolsChannels(ctx, message, payload) {
 
 // src/core/agents.ts
 import { readFile as readFile10, writeFile as writeFile8, mkdir as mkdir8, readdir as readdir4, rm as rm5 } from "fs/promises";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 var AGENTS_REL = ".claude/agents";
 var SKILLS_REL = ".claude/skills";
 var MEMORY_DIRS = /* @__PURE__ */ new Set(["short-memory", "long-memory"]);
@@ -42918,17 +43144,17 @@ async function listAgents(root) {
   const subagents = [];
   const skills = [];
   try {
-    for (const e of await readdir4(join24(root, AGENTS_REL), { withFileTypes: true })) {
+    for (const e of await readdir4(join25(root, AGENTS_REL), { withFileTypes: true })) {
       if (!e.isFile() || !e.name.endsWith(".md") || MEMORY_DIRS.has(e.name)) continue;
-      const fm = frontmatter(await readText2(join24(root, AGENTS_REL, e.name)));
+      const fm = frontmatter(await readText2(join25(root, AGENTS_REL, e.name)));
       subagents.push({ name: e.name.replace(/\.md$/, ""), description: fm.description });
     }
   } catch {
   }
   try {
-    for (const e of await readdir4(join24(root, SKILLS_REL), { withFileTypes: true })) {
+    for (const e of await readdir4(join25(root, SKILLS_REL), { withFileTypes: true })) {
       if (!e.isDirectory()) continue;
-      const fm = frontmatter(await readText2(join24(root, SKILLS_REL, e.name, "SKILL.md")));
+      const fm = frontmatter(await readText2(join25(root, SKILLS_REL, e.name, "SKILL.md")));
       skills.push({ name: e.name, description: fm.description });
     }
   } catch {
@@ -42939,15 +43165,15 @@ async function listAgents(root) {
 }
 function itemPath(root, kind, name) {
   const n = safeName(name);
-  return kind === "subagent" ? join24(root, AGENTS_REL, `${n}.md`) : join24(root, SKILLS_REL, n, "SKILL.md");
+  return kind === "subagent" ? join25(root, AGENTS_REL, `${n}.md`) : join25(root, SKILLS_REL, n, "SKILL.md");
 }
 async function readAgent(root, kind, name) {
   const content = await readText2(itemPath(root, kind, name));
   if (kind !== "subagent") return { content };
   const n = safeName(name);
   const [short, long] = await Promise.all([
-    readText2(join24(root, AGENTS_REL, "short-memory", `${n}.md`)),
-    readText2(join24(root, AGENTS_REL, "long-memory", `${n}.md`))
+    readText2(join25(root, AGENTS_REL, "short-memory", `${n}.md`)),
+    readText2(join25(root, AGENTS_REL, "long-memory", `${n}.md`))
   ]);
   return { content, memory: { short, long } };
 }
@@ -42957,12 +43183,12 @@ async function writeAgent(root, req) {
   try {
     if (req.action === "delete") {
       if (req.kind === "subagent") await rm5(itemPath(root, "subagent", n), { force: true });
-      else await rm5(join24(root, SKILLS_REL, n), { recursive: true, force: true });
+      else await rm5(join25(root, SKILLS_REL, n), { recursive: true, force: true });
       return { ok: true };
     }
     if (req.content === void 0) return { ok: false, error: "content is required" };
     const path = itemPath(root, req.kind, n);
-    await mkdir8(join24(path, ".."), { recursive: true });
+    await mkdir8(join25(path, ".."), { recursive: true });
     await writeFile8(path, req.content, "utf8");
     return { ok: true };
   } catch (err) {
@@ -42972,7 +43198,7 @@ async function writeAgent(root, req) {
 
 // src/core/secrets.ts
 import { readFile as readFile11, writeFile as writeFile9 } from "fs/promises";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 var SECURITY_REL = "AI_SECURITY.md";
 var PLACEHOLDER_REL = "AI_PLACEHOLDER.md";
 var SECRETS_REL = "project.secrets.json";
@@ -42985,7 +43211,7 @@ async function readText3(path, fallback = "") {
 }
 async function readSecretsObject(root) {
   try {
-    const v2 = JSON.parse(await readFile11(join25(root, SECRETS_REL), "utf8"));
+    const v2 = JSON.parse(await readFile11(join26(root, SECRETS_REL), "utf8"));
     return v2 && typeof v2 === "object" ? v2 : {};
   } catch {
     return {};
@@ -43004,8 +43230,8 @@ function placeholderKeys(text) {
 }
 async function readSecrets(root) {
   const [security, placeholder, secrets] = await Promise.all([
-    readText3(join25(root, SECURITY_REL)),
-    readText3(join25(root, PLACEHOLDER_REL)),
+    readText3(join26(root, SECURITY_REL)),
+    readText3(join26(root, PLACEHOLDER_REL)),
     readSecretsObject(root)
   ]);
   const names = /* @__PURE__ */ new Set([...placeholderKeys(placeholder), ...Object.keys(secrets)]);
@@ -43018,14 +43244,14 @@ async function readSecrets(root) {
 async function writeSecrets(root, req) {
   try {
     if (req.kind === "security") {
-      await writeFile9(join25(root, SECURITY_REL), req.content, "utf8");
+      await writeFile9(join26(root, SECURITY_REL), req.content, "utf8");
     } else if (req.kind === "placeholder") {
-      await writeFile9(join25(root, PLACEHOLDER_REL), req.content, "utf8");
+      await writeFile9(join26(root, PLACEHOLDER_REL), req.content, "utf8");
     } else {
       const secrets = await readSecretsObject(root);
       if (req.kind === "secret") secrets[req.key] = req.value;
       else delete secrets[req.key];
-      await writeFile9(join25(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
+      await writeFile9(join26(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
     }
     return { ok: true };
   } catch (err) {
@@ -43035,13 +43261,12 @@ async function writeSecrets(root, req) {
 
 // src/core/agent-tools.ts
 import { readFile as readFile12, writeFile as writeFile10, mkdir as mkdir9 } from "fs/promises";
-import { dirname as dirname8, join as join26 } from "path";
+import { dirname as dirname8, join as join27 } from "path";
 var SHARED_REL = ".claude/settings.json";
 var LOCAL_REL = ".claude/settings.local.json";
 var SECRETS_DENY = "Read(./project.secrets.json)";
-var MODES = ["default", "acceptEdits", "plan", "bypassPermissions"];
 function fileFor(root, scope) {
-  return join26(root, scope === "shared" ? SHARED_REL : LOCAL_REL);
+  return join27(root, scope === "shared" ? SHARED_REL : LOCAL_REL);
 }
 async function readSettingsObject(path) {
   try {
@@ -43053,9 +43278,8 @@ async function readSettingsObject(path) {
 }
 function normalizePermissions(raw) {
   const p2 = raw && typeof raw === "object" ? raw : {};
-  const mode = MODES.includes(p2.defaultMode) ? p2.defaultMode : "default";
   const list = (v2) => Array.isArray(v2) ? v2.filter((x) => typeof x === "string") : [];
-  return { defaultMode: mode, allow: list(p2.allow), ask: list(p2.ask), deny: list(p2.deny) };
+  return { defaultMode: "bypassPermissions", allow: list(p2.allow), deny: list(p2.deny) };
 }
 async function readAgentTools(root, scope) {
   const obj = await readSettingsObject(fileFor(root, scope));
@@ -43079,7 +43303,7 @@ async function writeAgentTools(root, scope, permissions) {
 // src/core/packages.ts
 import { createHash as createHash4 } from "crypto";
 import { readFile as readFile13, writeFile as writeFile11, mkdir as mkdir10, readdir as readdir5, rm as rm6, stat as stat4 } from "fs/promises";
-import { dirname as dirname9, join as join27, relative } from "path";
+import { dirname as dirname9, join as join28, relative } from "path";
 var AGENTS_REL2 = ".claude/agents";
 var SKILLS_REL2 = ".claude/skills";
 var MANIFEST_REL = ".claude/.4pm-packages.json";
@@ -43103,7 +43327,7 @@ async function listFilesRel(dir2) {
       return;
     }
     for (const e of entries2) {
-      const full = join27(d, e.name);
+      const full = join28(d, e.name);
       if (e.isDirectory()) await walk2(full);
       else if (e.isFile()) out.push(relative(dir2, full));
     }
@@ -43114,16 +43338,16 @@ async function listFilesRel(dir2) {
 async function readArtifactFiles(root, kind, slug) {
   const files = [];
   if (kind === "subagent") {
-    const agent = await readMaybe(join27(root, AGENTS_REL2, `${slug}.md`));
+    const agent = await readMaybe(join28(root, AGENTS_REL2, `${slug}.md`));
     if (agent) files.push({ path: "agent.md", contentBase64: agent.toString("base64") });
-    const short = await readMaybe(join27(root, AGENTS_REL2, "short-memory", `${slug}.md`));
+    const short = await readMaybe(join28(root, AGENTS_REL2, "short-memory", `${slug}.md`));
     if (short) files.push({ path: "short-memory.md", contentBase64: short.toString("base64") });
-    const long = await readMaybe(join27(root, AGENTS_REL2, "long-memory", `${slug}.md`));
+    const long = await readMaybe(join28(root, AGENTS_REL2, "long-memory", `${slug}.md`));
     if (long) files.push({ path: "long-memory.md", contentBase64: long.toString("base64") });
   } else {
-    const base = join27(root, SKILLS_REL2, slug);
+    const base = join28(root, SKILLS_REL2, slug);
     for (const rel of await listFilesRel(base)) {
-      const buf = await readMaybe(join27(base, rel));
+      const buf = await readMaybe(join28(base, rel));
       if (buf) files.push({ path: rel.split("\\").join("/"), contentBase64: buf.toString("base64") });
     }
   }
@@ -43141,7 +43365,7 @@ async function artifactSha256(root, kind, slug) {
   return h.digest("hex");
 }
 async function artifactExists(root, kind, slug) {
-  const target = kind === "subagent" ? join27(root, AGENTS_REL2, `${slug}.md`) : join27(root, SKILLS_REL2, slug);
+  const target = kind === "subagent" ? join28(root, AGENTS_REL2, `${slug}.md`) : join28(root, SKILLS_REL2, slug);
   try {
     await stat4(target);
     return true;
@@ -43150,7 +43374,7 @@ async function artifactExists(root, kind, slug) {
   }
 }
 async function readManifest(root) {
-  const buf = await readMaybe(join27(root, MANIFEST_REL));
+  const buf = await readMaybe(join28(root, MANIFEST_REL));
   if (!buf) return {};
   try {
     return JSON.parse(buf.toString("utf8"));
@@ -43159,7 +43383,7 @@ async function readManifest(root) {
   }
 }
 async function writeManifest(root, manifest) {
-  const path = join27(root, MANIFEST_REL);
+  const path = join28(root, MANIFEST_REL);
   await mkdir10(dirname9(path), { recursive: true });
   await writeFile11(path, JSON.stringify(manifest, null, 2), "utf8");
 }
@@ -43168,24 +43392,24 @@ async function writeArtifactFiles(root, kind, slug, files) {
   if (kind === "subagent") {
     const agent = byPath.get("agent.md");
     if (agent) {
-      await mkdir10(join27(root, AGENTS_REL2), { recursive: true });
-      await writeFile11(join27(root, AGENTS_REL2, `${slug}.md`), agent);
+      await mkdir10(join28(root, AGENTS_REL2), { recursive: true });
+      await writeFile11(join28(root, AGENTS_REL2, `${slug}.md`), agent);
     }
     const short = byPath.get("short-memory.md");
     if (short) {
-      await mkdir10(join27(root, AGENTS_REL2, "short-memory"), { recursive: true });
-      await writeFile11(join27(root, AGENTS_REL2, "short-memory", `${slug}.md`), short);
+      await mkdir10(join28(root, AGENTS_REL2, "short-memory"), { recursive: true });
+      await writeFile11(join28(root, AGENTS_REL2, "short-memory", `${slug}.md`), short);
     }
     const long = byPath.get("long-memory.md");
     if (long) {
-      await mkdir10(join27(root, AGENTS_REL2, "long-memory"), { recursive: true });
-      await writeFile11(join27(root, AGENTS_REL2, "long-memory", `${slug}.md`), long);
+      await mkdir10(join28(root, AGENTS_REL2, "long-memory"), { recursive: true });
+      await writeFile11(join28(root, AGENTS_REL2, "long-memory", `${slug}.md`), long);
     }
   } else {
-    const base = join27(root, SKILLS_REL2, slug);
+    const base = join28(root, SKILLS_REL2, slug);
     for (const [rel, buf] of byPath) {
       if (rel.includes("..") || rel.startsWith("/")) continue;
-      const dest = join27(base, rel);
+      const dest = join28(base, rel);
       await mkdir10(dirname9(dest), { recursive: true });
       await writeFile11(dest, buf);
     }
@@ -43251,11 +43475,11 @@ async function removePackage(root, slug) {
     const entry = manifest[n];
     if (!entry) return { ok: false, error: "not installed" };
     if (entry.kind === "subagent") {
-      await rm6(join27(root, AGENTS_REL2, `${n}.md`), { force: true });
-      await rm6(join27(root, AGENTS_REL2, "short-memory", `${n}.md`), { force: true });
-      await rm6(join27(root, AGENTS_REL2, "long-memory", `${n}.md`), { force: true });
+      await rm6(join28(root, AGENTS_REL2, `${n}.md`), { force: true });
+      await rm6(join28(root, AGENTS_REL2, "short-memory", `${n}.md`), { force: true });
+      await rm6(join28(root, AGENTS_REL2, "long-memory", `${n}.md`), { force: true });
     } else {
-      await rm6(join27(root, SKILLS_REL2, n), { recursive: true, force: true });
+      await rm6(join28(root, SKILLS_REL2, n), { recursive: true, force: true });
     }
     delete manifest[n];
     await writeManifest(root, manifest);
@@ -43267,7 +43491,7 @@ async function removePackage(root, slug) {
 
 // src/core/graph.ts
 import { readFile as readFile14, readdir as readdir6 } from "fs/promises";
-import { join as join28, relative as relative2, dirname as dirname10, resolve as resolve9, extname as extname2, basename as basename6 } from "path";
+import { join as join29, relative as relative2, dirname as dirname10, resolve as resolve9, extname as extname2, basename as basename6 } from "path";
 var MAX_FILES = 2e3;
 var MAX_NODES = 3e3;
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "out", "coverage", ".turbo"]);
@@ -43287,7 +43511,7 @@ async function walk(root, accept) {
       if (e.name.startsWith(".") && e.name !== ".claude") {
         if (e.isDirectory()) continue;
       }
-      const full = join28(dir2, e.name);
+      const full = join29(dir2, e.name);
       if (e.isDirectory()) {
         if (!SKIP_DIRS.has(e.name)) stack.push(full);
       } else if (accept(full)) {
@@ -43407,12 +43631,12 @@ async function buildGraph(root, mode) {
 
 // src/core/rag.ts
 import { readFile as readFile15, writeFile as writeFile12, statfs as statfs2, mkdir as mkdir11 } from "fs/promises";
-import { existsSync as existsSync14 } from "fs";
-import { execFile as execFile10, spawn as spawn9 } from "child_process";
+import { existsSync as existsSync15 } from "fs";
+import { execFile as execFile11, spawn as spawn10 } from "child_process";
 import { totalmem as totalmem2, cpus as cpus2 } from "os";
-import { join as join29 } from "path";
-import { promisify as promisify10 } from "util";
-var run10 = promisify10(execFile10);
+import { join as join30 } from "path";
+import { promisify as promisify11 } from "util";
+var run10 = promisify11(execFile11);
 var RAG_REL = ".claude/rag";
 async function tryRun(cmd, args) {
   try {
@@ -43431,7 +43655,7 @@ async function detectPython() {
 }
 async function installLog(root) {
   try {
-    const text = await readFile15(join29(root, RAG_REL, "install.log"), "utf8");
+    const text = await readFile15(join30(root, RAG_REL, "install.log"), "utf8");
     return text.split("\n").filter((l) => l.length > 0).slice(-200);
   } catch {
     return [];
@@ -43493,14 +43717,14 @@ async function ragStatus(root) {
   };
   let modelName = "";
   try {
-    modelName = (await readFile15(join29(root, RAG_REL, ".installed"), "utf8")).trim();
+    modelName = (await readFile15(join30(root, RAG_REL, ".installed"), "utf8")).trim();
   } catch {
     modelName = "";
   }
   const modelPresent = modelName.length > 0;
   return {
     installed: fastembed && sqliteVec && modelPresent,
-    installing: existsSync14(join29(root, RAG_REL, ".installing")),
+    installing: existsSync15(join30(root, RAG_REL, ".installing")),
     python: { found: py.found, version: py.version },
     deps: { pip, fastembed, sqliteVec },
     model: { present: modelPresent, name: modelName },
@@ -43511,9 +43735,9 @@ async function ragStatus(root) {
   };
 }
 async function readIndexMeta(root) {
-  const indexing = existsSync14(join29(root, RAG_REL, ".indexing"));
+  const indexing = existsSync15(join30(root, RAG_REL, ".indexing"));
   try {
-    const m2 = JSON.parse(await readFile15(join29(root, RAG_REL, ".index.json"), "utf8"));
+    const m2 = JSON.parse(await readFile15(join30(root, RAG_REL, ".index.json"), "utf8"));
     return {
       present: true,
       indexing,
@@ -43580,14 +43804,14 @@ if __name__ == "__main__":
     elif cmd == "query": query(sys.argv[2], int(sys.argv[3]) if len(sys.argv) > 3 else 8)
 `;
 async function ensureEngine(root) {
-  await mkdir11(join29(root, RAG_REL), { recursive: true }).catch(() => void 0);
-  await writeFile12(join29(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
+  await mkdir11(join30(root, RAG_REL), { recursive: true }).catch(() => void 0);
+  await writeFile12(join30(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
 }
 async function ragReindex(root) {
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found" };
-  if (!existsSync14(join29(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
-  if (existsSync14(join29(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
+  if (!existsSync15(join30(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
+  if (existsSync15(join30(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
   await ensureEngine(root);
   const script = `
 set +e
@@ -43595,7 +43819,7 @@ touch "${RAG_REL}/.indexing"
 { echo "[reindex] $(date)"; "$RAG_PY" "${RAG_REL}/rag_engine.py" reindex 2>&1; } >> "${RAG_REL}/index.log" 2>&1
 rm -f "${RAG_REL}/.indexing"
 `;
-  const child = spawn9("bash", ["-c", script], {
+  const child = spawn10("bash", ["-c", script], {
     cwd: root,
     env: { ...process.env, RAG_PY: py.bin },
     detached: true,
@@ -43607,12 +43831,12 @@ rm -f "${RAG_REL}/.indexing"
 async function ragQuery(root, queryText, k2 = 8) {
   const py = await detectPython();
   if (!py.found) return { results: [], error: "python3 not found" };
-  if (!existsSync14(join29(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
+  if (!existsSync15(join30(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
   await ensureEngine(root);
   try {
     const { stdout } = await run10(
       py.bin,
-      [join29(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k2, 1), 20))],
+      [join30(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k2, 1), 20))],
       { cwd: root, timeout: 3e4, maxBuffer: 4 * 1024 * 1024 }
     );
     const parsed = JSON.parse(stdout.trim() || '{"results":[]}');
@@ -43627,9 +43851,9 @@ async function ragInstall(root, model) {
   }
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found on the worker" };
-  if (existsSync14(join29(root, RAG_REL, ".installing"))) return { ok: true, started: true };
+  if (existsSync15(join30(root, RAG_REL, ".installing"))) return { ok: true, started: true };
   try {
-    await mkdir11(join29(root, RAG_REL), { recursive: true });
+    await mkdir11(join30(root, RAG_REL), { recursive: true });
   } catch {
   }
   const script = `
@@ -43645,7 +43869,7 @@ rm -f "${RAG_REL}/.installed"
 } >> "${RAG_REL}/install.log" 2>&1
 rm -f "${RAG_REL}/.installing"
 `;
-  const child = spawn9("bash", ["-c", script], {
+  const child = spawn10("bash", ["-c", script], {
     cwd: root,
     env: { ...process.env, RAG_PY: py.bin, RAG_MODEL: model },
     detached: true,
@@ -43656,8 +43880,8 @@ rm -f "${RAG_REL}/.installing"
 }
 
 // src/core/config-sync.ts
-import { existsSync as existsSync15, readFileSync as readFileSync16 } from "fs";
-import { join as join30 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync16 } from "fs";
+import { join as join31 } from "path";
 var SERVER_MANAGED_KEYS = [
   "physicPath",
   "sessionSwitchPct",
@@ -43674,8 +43898,8 @@ var SERVER_MANAGED_KEYS = [
   "projectAiMemoryBudgetChars"
 ];
 function readConfigText(profileDir2) {
-  const path = join30(profileDir2, "config.json");
-  if (existsSync15(path)) {
+  const path = join31(profileDir2, "config.json");
+  if (existsSync16(path)) {
     try {
       return readFileSync16(path, "utf8");
     } catch {
@@ -44464,7 +44688,7 @@ var WsClient = class {
     }
     const { payload, nonce } = encryptPayload(this.sessionKey, data);
     const envelope = {
-      id: randomUUID3(),
+      id: randomUUID4(),
       replyTo,
       channel,
       wsToken: this.wsToken,
@@ -44485,7 +44709,7 @@ var WsClient = class {
       }
       const { payload, nonce } = encryptPayload(this.sessionKey, data);
       const envelope = {
-        id: randomUUID3(),
+        id: randomUUID4(),
         replyTo: null,
         channel,
         wsToken: this.wsToken,
@@ -44552,8 +44776,8 @@ var WsClient = class {
   /** Create the physic folder at an absolute path if missing (best-effort). */
   ensurePhysicFolderPath(folder) {
     try {
-      if (!existsSync16(folder)) {
-        mkdirSync7(folder, { recursive: true });
+      if (!existsSync17(folder)) {
+        mkdirSync8(folder, { recursive: true });
         this.bus.log(t("project.createdFolder", { folder }));
       }
     } catch (err) {
@@ -44567,7 +44791,7 @@ var WsClient = class {
    */
   physicFolderPath(projectName) {
     const safe = projectName.replace(/[/\\]/g, "_").replace(/\.\./g, "_").trim();
-    return safe ? join31(this.context.profileDir, safe) : null;
+    return safe ? join32(this.context.profileDir, safe) : null;
   }
   /**
    * Report machine.status: version + the state of the physic project being served
@@ -44582,7 +44806,7 @@ var WsClient = class {
       projects: [],
       version: CLI_VERSION,
       physicPath,
-      physicPathExists: physicPath ? existsSync16(physicPath) : void 0,
+      physicPathExists: physicPath ? existsSync17(physicPath) : void 0,
       // Real coarse state (ADR-0152): !paused and a recent tick (was hard-coded false).
       autonomousRunning: physicPath ? isAutonomousRunning(physicPath, this.context.profileDir) : false,
       // The machine-user AI-run limit (0 = unlimited) + profile count so a dispatch can resolve the
@@ -44676,7 +44900,7 @@ var WsClient = class {
    */
   uploadLog() {
     try {
-      const upload = readLogUpload(join31(this.context.profileDir, "logs"));
+      const upload = readLogUpload(join32(this.context.profileDir, "logs"));
       if (!upload) return;
       const sig = `${upload.fileName}:${upload.totalBytes}`;
       if (sig === this.lastLogSig) return;
@@ -44838,10 +45062,10 @@ var WsClient = class {
 };
 
 // src/core/instance-lock.ts
-import { readFileSync as readFileSync17, rmSync as rmSync7, writeFileSync as writeFileSync9 } from "fs";
-import { join as join32 } from "path";
+import { readFileSync as readFileSync17, rmSync as rmSync8, writeFileSync as writeFileSync9 } from "fs";
+import { join as join33 } from "path";
 function lockPath(profileDir2) {
-  return join32(profileDir2, "start.lock");
+  return join33(profileDir2, "start.lock");
 }
 function isAlive(pid) {
   try {
@@ -44867,14 +45091,14 @@ function acquireInstanceLock(profileDir2) {
 function releaseInstanceLock(profileDir2) {
   try {
     const pid = Number.parseInt(readFileSync17(lockPath(profileDir2), "utf8").trim(), 10);
-    if (pid === process.pid) rmSync7(lockPath(profileDir2), { force: true });
+    if (pid === process.pid) rmSync8(lockPath(profileDir2), { force: true });
   } catch {
   }
 }
 
 // src/core/session-bus.ts
 import { EventEmitter } from "events";
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 var REPLAY_CAP = 500;
 var SessionBus = class {
   emitter = new EventEmitter();
@@ -44905,7 +45129,7 @@ var SessionBus = class {
   /** Producer → consumers: push one transcript entry. Returns its id (for `updateEntry`). */
   push(input) {
     const entry = {
-      id: randomUUID4(),
+      id: randomUUID5(),
       level: "info",
       ...input,
       ts: Date.now()
@@ -45162,8 +45386,8 @@ var SessionBus = class {
 
 // src/core/control-server.ts
 import { createServer } from "net";
-import { chmodSync as chmodSync4, rmSync as rmSync8 } from "fs";
-import { join as join34 } from "path";
+import { chmodSync as chmodSync4, rmSync as rmSync9 } from "fs";
+import { join as join35 } from "path";
 
 // src/core/control-protocol.ts
 var CONTROL_SOCKET_FILE = "control.sock";
@@ -45194,9 +45418,9 @@ function createFrameParser() {
 // src/core/control-token.ts
 import { chmodSync as chmodSync3, readFileSync as readFileSync18, writeFileSync as writeFileSync10 } from "fs";
 import { randomBytes as randomBytes3, timingSafeEqual } from "crypto";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 function controlTokenPath(profileDir2) {
-  return join33(profileDir2, CONTROL_TOKEN_FILE);
+  return join34(profileDir2, CONTROL_TOKEN_FILE);
 }
 function writeControlToken(profileDir2) {
   const token = randomBytes3(32).toString("hex");
@@ -45225,9 +45449,9 @@ function tokenMatches(expected, given) {
 
 // src/core/control-server.ts
 function startControlServer(bus, profileDir2, info) {
-  const socketPath = join34(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join35(profileDir2, CONTROL_SOCKET_FILE);
   try {
-    rmSync8(socketPath, { force: true });
+    rmSync9(socketPath, { force: true });
   } catch {
   }
   const clients = /* @__PURE__ */ new Set();
@@ -45313,8 +45537,8 @@ function startControlServer(bus, profileDir2, info) {
     clients.clear();
     server.close();
     try {
-      rmSync8(socketPath, { force: true });
-      rmSync8(controlTokenPath(profileDir2), { force: true });
+      rmSync9(socketPath, { force: true });
+      rmSync9(controlTokenPath(profileDir2), { force: true });
     } catch {
     }
   };
@@ -50977,15 +51201,15 @@ var import_react21 = __toESM(require_react(), 1);
 var import_react26 = __toESM(require_react(), 1);
 
 // src/core/input-history.ts
-import { existsSync as existsSync18, readFileSync as readFileSync20, writeFileSync as writeFileSync11 } from "fs";
-import { join as join35 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync20, writeFileSync as writeFileSync11 } from "fs";
+import { join as join36 } from "path";
 var MAX_HISTORY = 200;
 function historyPath(profileDir2) {
-  return join35(profileDir2, "input-history.json");
+  return join36(profileDir2, "input-history.json");
 }
 function loadInputHistory(profileDir2) {
   const path = historyPath(profileDir2);
-  if (!existsSync18(path)) return [];
+  if (!existsSync19(path)) return [];
   try {
     const data = JSON.parse(readFileSync20(path, "utf8"));
     return Array.isArray(data) ? data.filter((x) => typeof x === "string") : [];
@@ -51595,7 +51819,7 @@ async function runStart(profileDir2, profileName) {
     return;
   }
   logger.configure({
-    dir: join36(profileDir2, "logs"),
+    dir: join37(profileDir2, "logs"),
     level: resolveLogLevel(),
     base: { version: CLI_VERSION, profile: profileName, scope: credential.scope }
   });
@@ -51615,7 +51839,7 @@ async function runStart(profileDir2, profileName) {
   if (result.action === "updated") {
     logger.info("update.updated", { version: result.version });
     console.log(t("start.restarting"));
-    const child = spawn10(process.execPath, process.argv.slice(1), {
+    const child = spawn11(process.execPath, process.argv.slice(1), {
       stdio: "inherit",
       env: { ...process.env, FOURPM_NO_UPDATE: "1" }
     });
@@ -51704,7 +51928,7 @@ async function runStart(profileDir2, profileName) {
 }
 
 // src/commands/attach.ts
-import { join as join37 } from "path";
+import { join as join38 } from "path";
 
 // src/core/control-client.ts
 import { connect as connect2 } from "net";
@@ -51813,7 +52037,7 @@ async function runAttach(profileDir2, profileName) {
     process.exitCode = 1;
     return;
   }
-  const socketPath = join37(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join38(profileDir2, CONTROL_SOCKET_FILE);
   const bus = new SessionBus();
   let conn;
   try {
@@ -51844,11 +52068,11 @@ async function runAttach(profileDir2, profileName) {
 
 // src/commands/auto-run.ts
 import { connect as connect3 } from "net";
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 var AUTO_RUN_TIMEOUT_MS = 3 * 60 * 60 * 1e3;
 async function runAutoRun(profileDir2, profileName) {
   initI18n(readProfileConfig(profileDir2).locale);
-  const socketPath = join38(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join39(profileDir2, CONTROL_SOCKET_FILE);
   const token = readControlToken(profileDir2);
   const code = await new Promise((resolve10) => {
     let settled = false;
@@ -51904,12 +52128,12 @@ async function runAutoRun(profileDir2, profileName) {
 }
 
 // src/commands/ai-login.ts
-import { spawn as spawn11 } from "child_process";
-import { mkdirSync as mkdirSync8 } from "fs";
+import { spawn as spawn12 } from "child_process";
+import { mkdirSync as mkdirSync9 } from "fs";
 import { basename as basename8 } from "path";
 function runProviderLogin(cmd, envVar, dir2) {
   return new Promise((resolve10) => {
-    const child = spawn11(cmd, [], {
+    const child = spawn12(cmd, [], {
       stdio: "inherit",
       env: { ...process.env, [envVar]: dir2 }
     });
@@ -51942,7 +52166,7 @@ async function runAiLogin(profileDir2, profileName, aiFilter) {
       continue;
     }
     const dir2 = resolveHomePath(cred.profile);
-    mkdirSync8(dir2, { recursive: true });
+    mkdirSync9(dir2, { recursive: true });
     console.log(t("aiLogin.loggingIn", { provider: cred.provider, profile: cred.profile, envVar, dir: dir2 }));
     console.log(t("aiLogin.completeSignIn"));
     const code = await runProviderLogin(cred.provider, envVar, dir2);
@@ -51954,7 +52178,7 @@ async function runAiLogin(profileDir2, profileName, aiFilter) {
 }
 
 // src/commands/unlink.ts
-import { rmSync as rmSync9 } from "fs";
+import { rmSync as rmSync10 } from "fs";
 async function runUnlink(profileDir2, profileName) {
   initI18n(readProfileConfig(profileDir2).locale);
   const cred = readCredential(profileDir2, profileName);
@@ -51968,7 +52192,7 @@ async function runUnlink(profileDir2, profileName) {
   } catch (err) {
     console.log(t("unlink.revokeFailed", { message: err.message }));
   }
-  rmSync9(profileDir2, { recursive: true, force: true });
+  rmSync10(profileDir2, { recursive: true, force: true });
   clearDefaultProfileIf(profileName);
   console.log(t("unlink.deleted"));
 }

package/dist/project-sample/.claude/settings.json

@@ -8,7 +8,6 @@
   "permissions": {
     "defaultMode": "bypassPermissions",
     "allow": [],
-    "ask": [],
     "deny": []
   },
   "enableAllProjectMcpServers": true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4pm/cli",
-  "version": "1.19.7",
+  "version": "1.20.0",
   "private": false,
   "description": "4PM CLI — drives Claude/Codex CLIs on AI worker machines (Node + TypeScript)",
   "license": "LicenseRef-4PM-Source-Available",