@4pm/cli 1.21.0 → 1.22.0

package/dist/index.js

@@ -5713,14 +5713,14 @@ var require_react_development = __commonJS({
               var thenableResult = result;
               var wasAwaited = false;
               var thenable = {
-                then: function(resolve10, reject) {
+                then: function(resolve11, reject) {
                   wasAwaited = true;
                   thenableResult.then(function(returnValue2) {
                     popActScope(prevActScopeDepth);
                     if (actScopeDepth === 0) {
-                      recursivelyFlushAsyncActWork(returnValue2, resolve10, reject);
+                      recursivelyFlushAsyncActWork(returnValue2, resolve11, reject);
                     } else {
-                      resolve10(returnValue2);
+                      resolve11(returnValue2);
                     }
                   }, function(error2) {
                     popActScope(prevActScopeDepth);
@@ -5750,20 +5750,20 @@ var require_react_development = __commonJS({
                   ReactCurrentActQueue.current = null;
                 }
                 var _thenable = {
-                  then: function(resolve10, reject) {
+                  then: function(resolve11, reject) {
                     if (ReactCurrentActQueue.current === null) {
                       ReactCurrentActQueue.current = [];
-                      recursivelyFlushAsyncActWork(returnValue, resolve10, reject);
+                      recursivelyFlushAsyncActWork(returnValue, resolve11, reject);
                     } else {
-                      resolve10(returnValue);
+                      resolve11(returnValue);
                     }
                   }
                 };
                 return _thenable;
               } else {
                 var _thenable2 = {
-                  then: function(resolve10, reject) {
-                    resolve10(returnValue);
+                  then: function(resolve11, reject) {
+                    resolve11(returnValue);
                   }
                 };
                 return _thenable2;
@@ -5779,7 +5779,7 @@ var require_react_development = __commonJS({
             actScopeDepth = prevActScopeDepth;
           }
         }
-        function recursivelyFlushAsyncActWork(returnValue, resolve10, reject) {
+        function recursivelyFlushAsyncActWork(returnValue, resolve11, reject) {
           {
             var queue = ReactCurrentActQueue.current;
             if (queue !== null) {
@@ -5788,16 +5788,16 @@ var require_react_development = __commonJS({
                 enqueueTask(function() {
                   if (queue.length === 0) {
                     ReactCurrentActQueue.current = null;
-                    resolve10(returnValue);
+                    resolve11(returnValue);
                   } else {
-                    recursivelyFlushAsyncActWork(returnValue, resolve10, reject);
+                    recursivelyFlushAsyncActWork(returnValue, resolve11, reject);
                   }
                 });
               } catch (error2) {
                 reject(error2);
               }
             } else {
-              resolve10(returnValue);
+              resolve11(returnValue);
             }
           }
         }
@@ -28329,7 +28329,10 @@ function defaultProfileConfig() {
     webBlockedCommands: ["quit", "config"],
     // Shared AI memory (ADR-0245) — off by default (opt-in; costs a compaction call per turn).
     aiMemoryEnabled: false,
-    aiMemoryBudgetChars: 1e3
+    aiMemoryBudgetChars: 1e3,
+    // Bounded native resume (ADR-0339) — resume only a warm (≤5 min), not-too-large session.
+    aiResumeMaxIdleMinutes: 5,
+    aiResumeMaxContextTokens: 1e5
   };
 }
 function resolveMemoryConfig(config) {
@@ -28339,6 +28342,14 @@ function resolveMemoryConfig(config) {
   const budgetChars = projectBudget > 0 ? projectBudget : config.aiMemoryBudgetChars ?? 1e3;
   return { enabled, budgetChars };
 }
+function resolveResumePolicy(config) {
+  const idleMin = config.aiResumeMaxIdleMinutes ?? 5;
+  const maxCtx = config.aiResumeMaxContextTokens ?? 1e5;
+  return {
+    maxIdleMs: idleMin > 0 ? idleMin * 6e4 : Number.POSITIVE_INFINITY,
+    maxContextTokens: maxCtx > 0 ? maxCtx : Number.POSITIVE_INFINITY
+  };
+}
 function resolveIdleAutoClearMinutes(config) {
   const project = config.projectAutoClearIdleMinutes ?? 0;
   return project > 0 ? project : config.autoClearIdleMinutes ?? 10;
@@ -28628,6 +28639,16 @@ var UsageMetric = {
   COMMANDS: "commands",
   AUTONOMOUS_MINUTES: "autonomous_minutes"
 };
+var AiTokenProvider = {
+  CLAUDE: "claude",
+  CODEX: "codex",
+  ANTIGRAVITY: "antigravity"
+};
+var AI_TOKEN_PROVIDERS = [
+  AiTokenProvider.CLAUDE,
+  AiTokenProvider.CODEX,
+  AiTokenProvider.ANTIGRAVITY
+];
 
 // vendor/@4pm/constants/roles.ts
 var Role = {
@@ -32732,7 +32753,7 @@ async function checkAndUpdate(serverUrl, autoUpdate) {
 
 // src/core/ws-client.ts
 init_wrapper();
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 import { basename as basename7, join as join32 } from "path";
 import { existsSync as existsSync17, mkdirSync as mkdirSync8 } from "fs";
 
@@ -37498,7 +37519,13 @@ var contactChangeConfirmSchema = external_exports.object({
   token: external_exports.string().min(1)
 });
 var activityHeartbeatSchema = external_exports.object({
-  projectId: external_exports.string().uuid().optional()
+  projectId: external_exports.string().uuid().optional(),
+  /** ADR-0342 — the client is idle (5 min no input · tab hidden) ⇒ presence `idle`. */
+  idle: external_exports.boolean().optional()
+});
+var USER_CARDS_MAX_IDS = 100;
+var userCardsQuerySchema = external_exports.object({
+  ids: external_exports.string().transform((v2) => [...new Set(v2.split(",").map((s3) => s3.trim()).filter(Boolean))]).pipe(external_exports.array(external_exports.string().uuid()).min(1).max(USER_CARDS_MAX_IDS))
 });
 
 // src/core/scaffold.ts
@@ -37506,19 +37533,49 @@ import { cp, mkdir, mkdtemp, rm, writeFile } from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
 import { execFile as execFile2 } from "child_process";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname3, join as join6, resolve } from "path";
+import { dirname as dirname3, join as join6, resolve as resolve2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { promisify as promisify2 } from "util";
 
 // src/core/ai-assist.ts
 import { execFile } from "child_process";
 import { promisify } from "util";
+
+// src/utils/agent-deny.ts
+import { isAbsolute, resolve } from "path";
+var HOME_SECRET_PATTERNS = [
+  "~/.4pm/**",
+  "~/.ssh/**",
+  "~/.config/gh/**",
+  "~/.git-credentials",
+  "~/.claude*",
+  "~/.claude*/**"
+];
+function absDirPattern(dir2) {
+  const abs = (isAbsolute(dir2) ? dir2 : resolve(dir2)).replace(/\\/g, "/").replace(/\/+$/, "");
+  return `/${abs.startsWith("/") ? abs : `/${abs}`}/**`;
+}
+function agentDenyRules(profileDirs2 = []) {
+  const patterns = new Set(HOME_SECRET_PATTERNS);
+  for (const dir2 of profileDirs2) {
+    if (dir2 && dir2.trim()) patterns.add(absDirPattern(dir2.trim()));
+  }
+  const rules = [];
+  for (const p2 of patterns) rules.push(`Read(${p2})`, `Edit(${p2})`);
+  return rules;
+}
+function denySettingsArgs(cmd, profileDirs2 = []) {
+  if (!cmd.includes("claude")) return [];
+  return ["--settings", JSON.stringify({ permissions: { deny: agentDenyRules(profileDirs2) } })];
+}
+
+// src/core/ai-assist.ts
 var run = promisify(execFile);
 function aiCli() {
   return process.env.AI_CLI || "claude";
 }
 function aiArgs(cli, prompt) {
-  if (cli === "claude") return ["-p", prompt, "--output-format", "json"];
+  if (cli === "claude") return ["-p", prompt, "--output-format", "json", ...denySettingsArgs(cli, [process.env.CLAUDE_CONFIG_DIR])];
   if (cli === "codex") return ["exec", "--json", prompt];
   return ["-p", prompt];
 }
@@ -37810,8 +37867,8 @@ async function ensureReposCloned(physicRoot, repos, emit) {
 function sampleDir() {
   if (process.env.SCAFFOLD_SAMPLE_DIR) return process.env.SCAFFOLD_SAMPLE_DIR;
   const here = dirname3(fileURLToPath3(import.meta.url));
-  const bundled = resolve(here, "project-sample");
-  for (const candidate of [bundled, resolve(here, "../project-sample"), resolve(here, "../../project-sample")]) {
+  const bundled = resolve2(here, "project-sample");
+  for (const candidate of [bundled, resolve2(here, "../project-sample"), resolve2(here, "../../project-sample")]) {
     if (existsSync4(candidate)) return candidate;
   }
   return bundled;
@@ -37823,7 +37880,7 @@ async function scaffoldProject(payload, profileDir2, onProgress) {
     onProgress?.({ projectId: payload.projectId, step, message });
   };
   try {
-    const root = process.env.SCAFFOLD_ROOT ? resolve(process.env.SCAFFOLD_ROOT) : resolve(profileDir2);
+    const root = process.env.SCAFFOLD_ROOT ? resolve2(process.env.SCAFFOLD_ROOT) : resolve2(profileDir2);
     const target = join6(root, payload.projectName);
     await mkdir(target, { recursive: true });
     const repo = singleRepo(reposOf(payload.spec));
@@ -37928,7 +37985,7 @@ async function addProject(payload, profileDir2, onProgress) {
     onProgress?.({ projectId: payload.projectId, step, message });
   };
   try {
-    const root = process.env.SCAFFOLD_ROOT ? resolve(process.env.SCAFFOLD_ROOT) : resolve(profileDir2);
+    const root = process.env.SCAFFOLD_ROOT ? resolve2(process.env.SCAFFOLD_ROOT) : resolve2(profileDir2);
     const target = join6(root, payload.projectName);
     await mkdir(target, { recursive: true });
     const repo = singleRepo(payload.repos ?? []);
@@ -38568,8 +38625,8 @@ function resolveInstallTimeoutMs(sec) {
   return sec && sec > 0 ? sec * 1e3 : TOOL_INSTALL_TIMEOUT_DEFAULT_MS;
 }
 function sleep(ms2) {
-  return new Promise((resolve10) => {
-    const t2 = setTimeout(resolve10, ms2);
+  return new Promise((resolve11) => {
+    const t2 = setTimeout(resolve11, ms2);
     t2.unref?.();
   });
 }
@@ -38597,14 +38654,14 @@ function classifyToolFailure(code, out) {
   return { reason: "other", retryable: false };
 }
 function run3(cmd, args, onLine, timeoutMs = 18e4) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     let out = "";
     let buf = "";
     let child = null;
     const done = (code) => {
       clearTimeout(timer);
       if (onLine && buf.trim()) onLine(buf.trim());
-      resolve10({ code, out });
+      resolve11({ code, out });
     };
     const timer = setTimeout(() => {
       child?.kill();
@@ -39034,7 +39091,7 @@ function clearPinnedCredential(profileDir2) {
 // src/utils/ai-cli.ts
 import { readFileSync as readFileSync8 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename, isAbsolute, join as join9 } from "path";
+import { basename, isAbsolute as isAbsolute2, join as join9 } from "path";
 var REQUIRED_AI_ARGS = {
   claude: ["-p", "--output-format", "stream-json", "--verbose"],
   codex: ["exec", "--json"],
@@ -39171,13 +39228,22 @@ function claudeCredentialKeys(config) {
 }
 function resolveHomePath(value) {
   if (value.startsWith("~")) return join9(homedir3(), value.slice(1).replace(/^[/\\]/, ""));
-  if (isAbsolute(value)) return value;
+  if (isAbsolute2(value)) return value;
   return join9(homedir3(), value);
 }
 function profileDirs(profiles) {
   if (!profiles) return [];
   return profiles.filter(isUsableProfile).map((p2) => resolveHomePath(p2.profile));
 }
+function allAiProfileDirs(config) {
+  const dirs = [
+    ...profileDirs(config.claudeHome),
+    ...profileDirs(config.codexHome),
+    ...profileDirs(config.antigravityHome),
+    ...profileDirs(config.aiProfiles)
+  ];
+  return [...new Set(dirs)];
+}
 function folderScopeGuard(folder, prompt) {
   return [
     `IMPORTANT: You are working inside the project folder \`${folder}\`. Only read, use, and`,
@@ -39201,7 +39267,7 @@ function overrideEnv(cmd, o) {
   const budget = THINKING_TOKENS[o.thinking];
   return budget ? { MAX_THINKING_TOKENS: String(budget) } : {};
 }
-function buildRunArgs(profile, cmd, resumeId, oneShot = false, override, readOnly = false, bypass = false) {
+function buildRunArgs(profile, cmd, resumeId, oneShot = false, override, readOnly = false, bypass = false, denyDirs = []) {
   const extras = profile.args ?? [];
   const model = override?.model?.trim() || profile.model?.trim();
   const modelArgs = model ? ["--model", model] : [];
@@ -39213,6 +39279,10 @@ function buildRunArgs(profile, cmd, resumeId, oneShot = false, override, readOnl
     ...extras,
     ...modelArgs,
     ...overrideArgs(cmd, override),
+    // Secret-path deny rules (ADR-0347) — every configured credential dir + ~/.4pm, ~/.ssh, gh, git
+    // credentials, ~/.claude*. A single-value flag, placed before the mode caps so their non-variadic
+    // terminator still bounds `--disallowedTools`.
+    ...denySettingsArgs(cmd, denyDirs),
     ...modeExtra
   ];
 }
@@ -39265,7 +39335,7 @@ function planUnifiedRun(prompt, config, workingCredential, resume, oneShot, over
     return {
       cmd: active,
       attempts: [
-        { cmd: active, label: "default", dir: null, key: null, args: buildRunArgs({ profile: "" }, active, void 0, oneShot, override, readOnly, bypass), stdin: prompt, env: { ...baseEnv, ...overrideEnv(active, override) } }
+        { cmd: active, label: "default", dir: null, key: null, args: buildRunArgs({ profile: "" }, active, void 0, oneShot, override, readOnly, bypass, allAiProfileDirs(config)), stdin: prompt, env: { ...baseEnv, ...overrideEnv(active, override) } }
       ]
     };
   }
@@ -39283,7 +39353,7 @@ function planUnifiedRun(prompt, config, workingCredential, resume, oneShot, over
     label: cred.label?.trim() || profileDisplayLabel(dir2),
     dir: dir2,
     key,
-    args: buildRunArgs(cred, cmd, resume.get(key), oneShot, override, readOnly, bypass),
+    args: buildRunArgs(cred, cmd, resume.get(key), oneShot, override, readOnly, bypass, [...allAiProfileDirs(config), dir2]),
     stdin: prompt,
     env: envVar ? { ...baseEnv, [envVar]: dir2, ...overrideEnv(cmd, override) } : { ...baseEnv, ...overrideEnv(cmd, override) }
   }));
@@ -39296,7 +39366,7 @@ function planLegacyRun(prompt, config, workingDir, resume, oneShot, override, re
   const defaultPlan = {
     cmd,
     attempts: [
-      { cmd, label: "default", dir: null, key: null, args: buildRunArgs({ profile: "" }, cmd, void 0, oneShot, override, readOnly, bypass), stdin: prompt, env: { ...baseEnv, ...overrideEnv(cmd, override) } }
+      { cmd, label: "default", dir: null, key: null, args: buildRunArgs({ profile: "" }, cmd, void 0, oneShot, override, readOnly, bypass, allAiProfileDirs(config)), stdin: prompt, env: { ...baseEnv, ...overrideEnv(cmd, override) } }
     ]
   };
   if (!envVar) return defaultPlan;
@@ -39313,7 +39383,7 @@ function planLegacyRun(prompt, config, workingDir, resume, oneShot, override, re
       label: profileDisplayLabel(dir2),
       dir: dir2,
       key,
-      args: buildRunArgs(profile, cmd, resume.get(key), oneShot, override, readOnly, bypass),
+      args: buildRunArgs(profile, cmd, resume.get(key), oneShot, override, readOnly, bypass, [...allAiProfileDirs(config), dir2]),
       stdin: prompt,
       env: { ...baseEnv, [envVar]: dir2, ...overrideEnv(cmd, override) }
     };
@@ -39356,16 +39426,16 @@ async function fetchUsage(token) {
   }
 }
 function runUsageCli(dir2, aiCli2) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     let out = "";
     let child = null;
     const finish = () => {
       clearTimeout(timer);
-      resolve10(out);
+      resolve11(out);
     };
     const timer = setTimeout(() => {
       child?.kill();
-      resolve10(out);
+      resolve11(out);
     }, 3e4);
     timer.unref?.();
     try {
@@ -39688,9 +39758,9 @@ function pruneCommandOutputByAge(days) {
 import { spawn as spawn4 } from "child_process";
 import { execFile as execFile3 } from "child_process";
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, readdirSync as readdirSync5, readFileSync as readFileSync12, rmSync as rmSync5, statSync as statSync4, writeFileSync as writeFileSync7 } from "fs";
-import { randomUUID } from "crypto";
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync2, readdirSync as readdirSync5, readFileSync as readFileSync12, rmSync as rmSync5, statSync as statSync4, writeFileSync as writeFileSync7 } from "fs";
 import { join as join14 } from "path";
+import { tmpdir as tmpdir3 } from "os";
 import { promisify as promisify3 } from "util";
 
 // src/core/ai-stream.ts
@@ -39720,12 +39790,16 @@ function createAiStreamParser(cli) {
         acc.output = ev.usage.output_tokens ?? 0;
         acc.cacheRead = ev.usage.cache_read_input_tokens ?? 0;
         acc.cacheCreation = ev.usage.cache_creation_input_tokens ?? 0;
-        acc.tokens = acc.input + acc.output;
+        acc.tokens = acc.input + acc.output + acc.cacheRead + acc.cacheCreation;
         if (typeof ev.total_cost_usd === "number") acc.costUsd = ev.total_cost_usd;
       }
       return "";
     }
     if (ev.type === "assistant") {
+      const u2 = ev.message?.usage;
+      if (u2) {
+        acc.contextTokens = (u2.input_tokens ?? 0) + (u2.cache_read_input_tokens ?? 0) + (u2.cache_creation_input_tokens ?? 0) + (u2.output_tokens ?? 0);
+      }
       const text = assistantText(ev);
       return text ? `${text}
 ` : "";
@@ -39734,11 +39808,12 @@ function createAiStreamParser(cli) {
   }
   function handleCodex(ev) {
     if (ev.type === "turn.completed" && ev.usage) {
-      acc.input = ev.usage.input_tokens ?? 0;
+      const cached = ev.usage.cached_input_tokens ?? 0;
+      acc.input = Math.max(0, (ev.usage.input_tokens ?? 0) - cached);
       acc.output = (ev.usage.output_tokens ?? 0) + (ev.usage.reasoning_output_tokens ?? 0);
-      acc.cacheRead = ev.usage.cached_input_tokens ?? 0;
+      acc.cacheRead = cached;
       acc.cacheCreation = 0;
-      acc.tokens = acc.input + acc.output;
+      acc.tokens = acc.input + acc.output + acc.cacheRead;
       return "";
     }
     if (ev.type === "item.completed" && ev.item?.type === "agent_message") {
@@ -39786,10 +39861,65 @@ function createAiStreamParser(cli) {
     apiError: () => ({ ...apiError })
   };
 }
+function aiProviderOf(cmd) {
+  if (cmd.includes("codex")) return "codex";
+  if (cmd.includes("antigravity")) return "antigravity";
+  return "claude";
+}
 function estimateTokens2(text) {
   return Math.max(1, Math.ceil(text.length / 4));
 }
 
+// src/core/agent-sandbox.ts
+var ENV_ALLOW = /* @__PURE__ */ new Set([
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "LANG",
+  "TERM",
+  "TZ",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "ALL_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "no_proxy",
+  "all_proxy",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+  "NODE_EXTRA_CA_CERTS",
+  "SYSTEMROOT",
+  "SYSTEMDRIVE",
+  "WINDIR",
+  "COMSPEC",
+  "PATHEXT",
+  "USERPROFILE",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "PROGRAMDATA",
+  "PROGRAMFILES"
+]);
+var ENV_ALLOW_PREFIXES = ["LC_", "XDG_", "ANTHROPIC_", "CLAUDE_", "CODEX_", "OPENAI_", "AWS_", "GOOGLE_", "CLOUD_ML_", "VERTEX_"];
+function agentEnv(extraEnv, overrides) {
+  const env3 = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value === void 0) continue;
+    if (ENV_ALLOW.has(key) || ENV_ALLOW_PREFIXES.some((p2) => key.startsWith(p2))) env3[key] = value;
+  }
+  return { ...env3, ...extraEnv, ...overrides };
+}
+function gitAuthArgs(user, password) {
+  if (!user && !password) return [];
+  const basic = Buffer.from(`${user}:${password}`).toString("base64");
+  return ["-c", `http.extraHeader=Authorization: Basic ${basic}`];
+}
+
 // src/core/support-answer.ts
 var NO_USAGE = { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 };
 var execFileAsync = promisify3(execFile3);
@@ -39803,18 +39933,34 @@ function repoDir(profileDir2, url, branch) {
   const key = createHash3("sha1").update(`${url}#${branch}`).digest("hex").slice(0, 16);
   return join14(kbRoot(profileDir2), key);
 }
-function authedUrl(url, token) {
-  if (!token) return url;
-  if (url.startsWith("https://")) return url.replace("https://", `https://${token}@`);
-  return url;
+var DENIED_TOOLS = ["Bash", "Edit", "Write", "NotebookEdit", "WebFetch", "WebSearch", "Task"];
+var KB_STALE_MS = 24 * 60 * 60 * 1e3;
+var kbTokens = /* @__PURE__ */ new Map();
+function kbAuth(token) {
+  return token ? gitAuthArgs(token, "") : [];
+}
+async function pullKb(dir2) {
+  const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+  await execFileAsync("git", [...kbAuth(kbTokens.get(dir2)), "-C", dir2, "pull", "--ff-only"], { env: gitEnv });
 }
 async function ensureRepo(profileDir2, repo) {
   const dir2 = repoDir(profileDir2, repo.url, repo.branch);
-  if (existsSync10(join14(dir2, ".git"))) return dir2;
-  const url = authedUrl(repo.url, repo.token);
   const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+  if (repo.token) kbTokens.set(dir2, repo.token);
+  else kbTokens.delete(dir2);
+  if (existsSync10(join14(dir2, ".git"))) {
+    const current2 = await execFileAsync("git", ["-C", dir2, "remote", "get-url", "origin"], { env: gitEnv }).then((r) => r.stdout.trim()).catch(() => repo.url);
+    if (current2 !== repo.url) {
+      await execFileAsync("git", ["-C", dir2, "remote", "set-url", "origin", repo.url], { env: gitEnv }).catch(() => void 0);
+    }
+    const marker = existsSync10(join14(dir2, ".git", "FETCH_HEAD")) ? join14(dir2, ".git", "FETCH_HEAD") : join14(dir2, ".git", "HEAD");
+    if (Date.now() - statSync4(marker).mtimeMs > KB_STALE_MS) {
+      void pullKb(dir2).catch((err) => logger.warn("support.kb.refresh.failed", { dir: dir2, error: String(err) }));
+    }
+    return dir2;
+  }
   mkdirSync5(kbRoot(profileDir2), { recursive: true });
-  await execFileAsync("git", ["clone", "--depth", "1", "--branch", repo.branch, url, dir2], {
+  await execFileAsync("git", [...kbAuth(repo.token), "clone", "--depth", "1", "--branch", repo.branch, repo.url, dir2], {
     env: gitEnv
   });
   return dir2;
@@ -39822,12 +39968,11 @@ async function ensureRepo(profileDir2, repo) {
 async function refreshSupportKb(profileDir2) {
   const root = kbRoot(profileDir2);
   if (!existsSync10(root)) return;
-  const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
   for (const entry of readdirSync5(root)) {
     const dir2 = join14(root, entry);
     if (!existsSync10(join14(dir2, ".git"))) continue;
     try {
-      await execFileAsync("git", ["-C", dir2, "pull", "--ff-only"], { env: gitEnv });
+      await pullKb(dir2);
     } catch (err) {
       logger.warn("support.kb.refresh.failed", { dir: dir2, error: String(err) });
     }
@@ -39890,6 +40035,33 @@ function buildPrompt(docs, question, askerRole) {
     question
   ].join("\n");
 }
+function buildDraftPrompt(docs, context, task) {
+  const goal = task === "reply_draft" ? [
+    "You are drafting a reply FROM the 4PM support team TO the customer in the support ticket below.",
+    "Address the customer's latest message, using the whole conversation for context. Be accurate,",
+    "friendly and concise. Write in the language the customer uses in the ticket."
+  ] : [
+    "You are drafting an outreach message FROM the 4PM platform team TO the customer organizations.",
+    "Use the subject and any current draft below as the starting point. Be clear, friendly and concise.",
+    "Write in the language of the subject/draft (or of the admin's instructions when those are empty)."
+  ];
+  return [
+    ...goal,
+    "Use the documentation and FAQ below for any product facts; never invent features, prices or",
+    "commitments that are not in the docs \u2014 leave a clear [placeholder] for the admin to fill instead.",
+    "Follow the admin's instructions when given. A human admin reviews and edits your draft before",
+    "sending it.",
+    "",
+    "Output ONLY the message body in markdown \u2014 no subject line, no preamble, no explanation, no code",
+    "fences around the whole message.",
+    "",
+    "===== DOCUMENTATION =====",
+    docs,
+    "",
+    "===== CONTEXT =====",
+    context
+  ].join("\n");
+}
 function imageExt(mime) {
   switch (mime) {
     case "image/png":
@@ -39904,9 +40076,8 @@ function imageExt(mime) {
       return "png";
   }
 }
-function materializeImages2(profileDir2, images, question) {
-  const dir2 = join14(profileDir2, "help-images", randomUUID());
-  mkdirSync5(dir2, { recursive: true });
+function materializeImages2(images, question) {
+  const dir2 = mkdtempSync2(join14(tmpdir3(), "4pm-help-images-"));
   let rewritten = question;
   images.forEach((img, i) => {
     const file = join14(dir2, `image-${i + 1}.${imageExt(img.mime)}`);
@@ -39932,23 +40103,32 @@ function parseModeratedAnswer(text) {
   }
   return { body: text.trim() };
 }
-function runClaudeOnce(cmd, profile, prompt, extraEnv, imageDir) {
-  return new Promise((resolve10, reject) => {
+function runClaudeOnce(cmd, profile, prompt, extraEnv, imageDir, denyDirs = []) {
+  return new Promise((resolve11, reject) => {
     const isClaude = cmd.includes("claude");
     const args = [
       "-p",
       ...profile?.model ? ["--model", profile.model] : [],
       ...isClaude ? ["--output-format", "stream-json", "--verbose"] : [],
-      // When the question references pasted images (ADR-0273), allow the agent to Read them from the
-      // materialized folder (the question already carries their absolute paths).
-      ...isClaude && imageDir ? ["--add-dir", imageDir, "--allowedTools", "Read"] : []
+      // No shell / edits / web for an untrusted question (ADR-0346). Reads need no grant inside the
+      // (empty) working dir and any added dir; anywhere else they would need an approval a headless
+      // run never gets.
+      // Secret-path deny rules (ADR-0347) — reads are not confined to the working dir.
+      ...denySettingsArgs(cmd, [...denyDirs, profile?.dir]),
+      ...isClaude ? ["--disallowedTools", ...DENIED_TOOLS] : [],
+      // When the question references pasted images (ADR-0273), add the materialized folder so the
+      // agent can Read them (the question already carries their absolute paths) — scoped to it only.
+      ...isClaude && imageDir ? ["--add-dir", imageDir] : []
     ];
-    const env3 = {
-      ...process.env,
-      ...extraEnv,
-      ...profile ? { CLAUDE_CONFIG_DIR: profile.dir } : {}
+    const env3 = agentEnv(extraEnv, profile ? { CLAUDE_CONFIG_DIR: profile.dir } : void 0);
+    const cwd2 = mkdtempSync2(join14(tmpdir3(), "4pm-support-"));
+    const cleanup = () => {
+      try {
+        rmSync5(cwd2, { recursive: true, force: true });
+      } catch {
+      }
     };
-    const child = spawn4(cmd, args, { stdio: ["pipe", "pipe", "pipe"], env: env3 });
+    const child = spawn4(cmd, args, { stdio: ["pipe", "pipe", "pipe"], env: env3, cwd: cwd2 });
     const parser = createAiStreamParser(cmd);
     let out = "";
     let err = "";
@@ -39961,12 +40141,14 @@ function runClaudeOnce(cmd, profile, prompt, extraEnv, imageDir) {
     child.stderr.on("data", (d) => err += d.toString());
     child.on("error", (e) => {
       clearTimeout(timer);
+      cleanup();
       reject(e);
     });
     child.on("close", (code) => {
       clearTimeout(timer);
+      cleanup();
       out += parser.flush();
-      resolve10({ code: code ?? -1, out, err, usage: parser.usage() });
+      resolve11({ code: code ?? -1, out, err, usage: parser.usage() });
     });
     child.stdin.write(prompt);
     child.stdin.end();
@@ -39976,7 +40158,7 @@ async function runClaudeWithFailover(prompt, ai2, imageDir) {
   const attempts = ai2.profiles.length > 0 ? ai2.profiles : [null];
   let lastReason = "no attempt";
   for (let i = 0; i < attempts.length; i++) {
-    const { code, out, err, usage } = await runClaudeOnce(ai2.cmd, attempts[i], prompt, ai2.env, imageDir);
+    const { code, out, err, usage } = await runClaudeOnce(ai2.cmd, attempts[i], prompt, ai2.env, imageDir, ai2.profiles.map((p2) => p2.dir));
     if (code === 0 && out.trim()) return { text: out.trim(), usage };
     const combined = err || out;
     lastReason = `exited ${code}: ${combined.slice(0, 500)}`;
@@ -39988,7 +40170,7 @@ async function runSupportAnswer(req, ai2, profileDir2) {
   let imageDir;
   let question = req.question;
   if (req.images?.length) {
-    const m2 = materializeImages2(profileDir2, req.images, req.question);
+    const m2 = materializeImages2(req.images, req.question);
     imageDir = m2.dir;
     question = m2.question;
   }
@@ -39996,13 +40178,10 @@ async function runSupportAnswer(req, ai2, profileDir2) {
     const dir2 = await ensureRepo(profileDir2, req.repo);
     const docs = collectDocs(dir2);
     if (!docs.trim()) return { body: "", error: "KB repo has no documentation" };
-    const { text, usage } = await runClaudeWithFailover(
-      buildPrompt(docs, question, req.askerRole),
-      ai2,
-      imageDir
-    );
+    const prompt = req.task ? buildDraftPrompt(docs, question, req.task) : buildPrompt(docs, question, req.askerRole);
+    const { text, usage } = await runClaudeWithFailover(prompt, ai2, imageDir);
     if (!text) return { body: "", error: "empty answer" };
-    const { body, moderation } = parseModeratedAnswer(text);
+    const { body, moderation } = req.task ? { body: text.trim(), moderation: void 0 } : parseModeratedAnswer(text);
     if (!body) return { body: "", error: "empty answer" };
     const u2 = usage.tokens > 0 ? usage : { ...NO_USAGE, tokens: estimateTokens2(body) };
     return {
@@ -40237,10 +40416,10 @@ async function crontabList() {
   }
 }
 async function crontabSet(content) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     const child = spawn5("crontab", ["-"], { stdio: ["pipe", "ignore", "ignore"] });
-    child.on("error", () => resolve10(false));
-    child.on("close", (code) => resolve10(code === 0));
+    child.on("error", () => resolve11(false));
+    child.on("close", (code) => resolve11(code === 0));
     child.stdin.end(content.endsWith("\n") ? content : content + "\n");
   });
 }
@@ -40409,14 +40588,14 @@ function detectContainerized() {
   }
 }
 function canReach(host, port) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     const socket = connect({ host, port });
     let done = false;
     const finish = (ok) => {
       if (done) return;
       done = true;
       socket.destroy();
-      resolve10(ok);
+      resolve11(ok);
     };
     socket.setTimeout(PROBE_TIMEOUT_MS);
     socket.once("connect", () => finish(true));
@@ -40588,7 +40767,7 @@ async function runCommand(dispatch, emit, opts) {
   });
   child.stdout?.on("data", (data) => batcher.push(data.toString("utf8")));
   child.stderr?.on("data", (data) => batcher.push(data.toString("utf8")));
-  await new Promise((resolve10) => {
+  await new Promise((resolve11) => {
     child.on("close", (exitCode) => {
       clearTimers();
       batcher.flush();
@@ -40601,7 +40780,7 @@ async function runCommand(dispatch, emit, opts) {
         // server settles the command as failed and the web surfaces the note instead of spinning.
         exitCode: timedOut ? 124 : exitCode ?? -1
       });
-      resolve10();
+      resolve11();
     });
     child.on("error", (err) => {
       clearTimers();
@@ -40613,7 +40792,7 @@ async function runCommand(dispatch, emit, opts) {
         done: true,
         exitCode: -1
       });
-      resolve10();
+      resolve11();
     });
   });
 }
@@ -40636,15 +40815,15 @@ function isOutOfCredits(text) {
   );
 }
 function runAttempt(commandId, cmd, args, stdin, cwd2, env3, onChunk, timeoutMs) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     runCommand(
       { commandId, cmd, args, path: cwd2, env: env3 },
       (out) => {
         if (out.chunk) onChunk(out.chunk);
-        if (out.done) resolve10(out.exitCode ?? -1);
+        if (out.done) resolve11(out.exitCode ?? -1);
       },
       { stdin, ...timeoutMs > 0 ? { timeoutMs } : {} }
-    ).catch(() => resolve10(-1));
+    ).catch(() => resolve11(-1));
   });
 }
 async function runAiFailover(plan, commandId, cwd2, handlers, timeoutMs = 0) {
@@ -41122,6 +41301,24 @@ function runSlashCommand(line, base) {
 
 // src/core/memory-compact.ts
 import { spawn as spawn7 } from "child_process";
+function parseJsonResult(out) {
+  let parsed;
+  try {
+    parsed = JSON.parse(out.trim());
+  } catch {
+    return null;
+  }
+  if (parsed.is_error || typeof parsed.result !== "string") return null;
+  const u2 = parsed.usage;
+  const usage = u2 ? {
+    input: u2.input_tokens ?? 0,
+    output: u2.output_tokens ?? 0,
+    cacheRead: u2.cache_read_input_tokens ?? 0,
+    cacheCreation: u2.cache_creation_input_tokens ?? 0,
+    tokens: (u2.input_tokens ?? 0) + (u2.output_tokens ?? 0) + (u2.cache_read_input_tokens ?? 0) + (u2.cache_creation_input_tokens ?? 0)
+  } : null;
+  return { text: parsed.result, usage };
+}
 var COMPACT_TIMEOUT_MS = 6e4;
 function buildPrompt2(input) {
   return [
@@ -41141,9 +41338,21 @@ function buildPrompt2(input) {
     input.answer
   ].join("\n");
 }
-function runOnce(cmd, profile, prompt, cwd2, extraEnv) {
-  return new Promise((resolve10, reject) => {
-    const args = ["-p", ...profile?.model ? ["--model", profile.model] : []];
+function runOnce(cmd, profile, prompt, cwd2, extraEnv, denyDirs = []) {
+  return new Promise((resolve11, reject) => {
+    const args = [
+      "-p",
+      "--output-format",
+      "json",
+      ...profile?.model ? ["--model", profile.model] : [],
+      // Secret-path deny rules (ADR-0347) — before the variadic `--disallowedTools`.
+      ...denySettingsArgs(cmd, [...denyDirs, profile?.dir]),
+      "--max-turns=1",
+      "--disallowedTools",
+      ONE_SHOT_DISALLOWED_CLAUDE_TOOLS,
+      "--permission-mode",
+      "default"
+    ];
     const env3 = {
       ...process.env,
       ...extraEnv,
@@ -41165,7 +41374,7 @@ function runOnce(cmd, profile, prompt, cwd2, extraEnv) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve10({ code: code ?? -1, out, err });
+      resolve11({ code: code ?? -1, out, err });
     });
     child.stdin.write(prompt);
     child.stdin.end();
@@ -41176,17 +41385,19 @@ async function runMemoryCompaction(ai2, cwd2, input) {
   const attempts = ai2.profiles.length > 0 ? ai2.profiles : [null];
   for (let i = 0; i < attempts.length; i++) {
     try {
-      const { code, out } = await runOnce(ai2.cmd, attempts[i], prompt, cwd2, ai2.env);
-      if (code === 0 && out.trim()) {
+      const profile = attempts[i];
+      const { code, out } = await runOnce(ai2.cmd, profile, prompt, cwd2, ai2.env, ai2.profiles.map((p2) => p2.dir));
+      const parsed = code === 0 ? parseJsonResult(out) : null;
+      if (parsed && parsed.text.trim()) {
         reportToolResult(ai2.cmd, true);
-        return out.trim().slice(0, input.budgetChars);
+        return { memory: parsed.text.trim().slice(0, input.budgetChars), usage: parsed.usage, dir: profile?.dir ?? null };
       }
       if (i === attempts.length - 1) break;
     } catch {
       break;
     }
   }
-  return "";
+  return { memory: "", usage: null, dir: null };
 }
 
 // src/core/git-commit-identity.ts
@@ -41361,6 +41572,7 @@ async function runAiPrompt(ctx, prompt, commandId, origin, oneShot = false, imag
   const guardedPrompt = ctx.restrictToFolder && ctx.physicRoot ? folderScopeGuard(ctx.physicRoot, aiBodyPrompt) : aiBodyPrompt;
   const hint = unified ? { credential: startCred ?? workingCred } : { dir: startDir ?? workingDir };
   const memCfg = resolveMemoryConfig(config);
+  pruneResumableSessions(ctx, resolveResumePolicy(config), Date.now());
   const firstAttempt = planAiRun(guardedPrompt, config, hint, /* @__PURE__ */ new Map(), oneShot, aiConfig, readOnly, bypass).attempts[0];
   const resumeId = memCfg.enabled && firstAttempt?.key && firstAttempt.cmd === "claude" ? ctx.sessionIdByKey.get(firstAttempt.key) : void 0;
   let effectivePrompt = guardedPrompt;
@@ -41508,6 +41720,8 @@ ${guardedPrompt}`;
       outputTokens: result.usage.output,
       cacheReadTokens: result.usage.cacheRead,
       cacheCreationTokens: result.usage.cacheCreation,
+      // Provider → the server's per-provider quota-token weights (ADR-0340).
+      provider: aiProviderOf(result.workedCmd ?? plan.cmd),
       // Auth mode for billing split (ADR-0192 §5): subscription (OAuth) vs api-key (API-billed).
       authMode: resolveClaudeAuthMode(config)
     });
@@ -41525,9 +41739,23 @@ ${guardedPrompt}`;
   if (memCfg.enabled && result.exitCode === 0) {
     if (result.workedKey && result.sessionId) {
       ctx.sessionIdByKey.set(result.workedKey, result.sessionId);
+      ctx.sessionMetaByKey.set(result.workedKey, { at: Date.now(), contextTokens: result.usage.contextTokens ?? 0 });
     }
     void updateSharedMemory(ctx, config, prompt, answerText, memCfg.budgetChars).catch(() => {
     });
+  } else if (result.exitCode !== 0) {
+    ctx.sessionIdByKey.clear();
+    ctx.sessionMetaByKey.clear();
+  }
+}
+function pruneResumableSessions(ctx, policy, now) {
+  for (const key of [...ctx.sessionIdByKey.keys()]) {
+    const meta = ctx.sessionMetaByKey.get(key);
+    const stale = !meta || now - meta.at > policy.maxIdleMs || meta.contextTokens > policy.maxContextTokens;
+    if (stale) {
+      ctx.sessionIdByKey.delete(key);
+      ctx.sessionMetaByKey.delete(key);
+    }
   }
 }
 async function runWebSlashCommand(ctx, line, commandId) {
@@ -41635,11 +41863,29 @@ async function updateSharedMemory(ctx, config, userPrompt, answer, budgetChars)
   if (!answer.trim()) return;
   const profiles = resolveClaudeProfiles(config, ctx.physicRoot);
   const cwd2 = ctx.physicRoot ?? process.cwd();
-  const newMemory = await runMemoryCompaction(
+  const { memory: newMemory, usage, dir: dir2 } = await runMemoryCompaction(
     { cmd: "claude", profiles, env: config.aiEnv },
     cwd2,
     { oldMemory: ctx.aiMemory, prompt: userPrompt, answer, budgetChars }
   );
+  if (usage && usage.tokens > 0) {
+    ctx.reportUsage(
+      [
+        {
+          metric: UsageMetric.AI_TOKENS,
+          amount: usage.tokens,
+          occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+          inputTokens: usage.input,
+          outputTokens: usage.output,
+          cacheReadTokens: usage.cacheRead,
+          cacheCreationTokens: usage.cacheCreation,
+          provider: "claude",
+          authMode: resolveClaudeAuthMode(config)
+        }
+      ],
+      dir2 ? profileDisplayLabel(dir2) : null
+    );
+  }
   if (!newMemory) return;
   ctx.aiMemory = newMemory;
   ctx.send(WsChannels.MEMORY_UPDATE, { text: newMemory });
@@ -41647,6 +41893,7 @@ async function updateSharedMemory(ctx, config, userPrompt, answer, budgetChars)
 function resetMemorySession(ctx) {
   ctx.aiMemory = "";
   ctx.sessionIdByKey.clear();
+  ctx.sessionMetaByKey.clear();
   ctx.send(WsChannels.MEMORY_UPDATE, { text: "" });
 }
 function profileUnderSessionPressure(ctx, config, cmd, workingDir) {
@@ -41719,7 +41966,7 @@ function rejectByReview(ctx, commandId, origin, prompt, reasons) {
 }
 
 // src/core/autonomous-cycle.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID } from "crypto";
 import { appendFile as appendFile2, mkdir as mkdir3, readFile as readFile5, readdir as readdir2, rm as rm2, stat } from "fs/promises";
 import { join as join20 } from "path";
 function buildAutonomousCyclePrompt() {
@@ -41859,7 +42106,7 @@ async function runAutonomousCycle(ctx) {
     hist.ticks = { day: today, count: todayTickCount(hist, today) + 1 };
     await writeHistories(root, hist);
     await log(`[run] cycle (tick ${hist.ticks.count}/${today})`);
-    const commandId = randomUUID2();
+    const commandId = randomUUID();
     const override = cfg.model ? { model: cfg.model } : void 0;
     try {
       await runAiPrompt(ctx, buildAutonomousCyclePrompt(), commandId, "local", false, void 0, override, false, true);
@@ -41963,11 +42210,11 @@ async function allAiProfilesExhausted(ctx, cfg) {
 
 // src/core/fs-browse.ts
 import { readdir as readdir3 } from "fs/promises";
-import { resolve as resolve2, sep as sep2 } from "path";
+import { resolve as resolve3, sep as sep2 } from "path";
 async function listDir(path, root) {
   if (!root) return { path: "", entries: [] };
-  const base = resolve2(root);
-  const requested = resolve2(base, path && path.trim() ? path : ".");
+  const base = resolve3(root);
+  const requested = resolve3(base, path && path.trim() ? path : ".");
   const target = requested === base || requested.startsWith(base + sep2) ? requested : base;
   try {
     const dirents = await readdir3(target, { withFileTypes: true });
@@ -41986,12 +42233,12 @@ async function listDir(path, root) {
 
 // src/core/fs-read.ts
 import { readFile as readFile6 } from "fs/promises";
-import { resolve as resolve3, sep as sep3 } from "path";
+import { resolve as resolve4, sep as sep3 } from "path";
 var MAX_BYTES = 256 * 1024;
 function resolveInRoot(root, relPath) {
   if (!root) return null;
-  const base = resolve3(root);
-  const target = resolve3(base, relPath || ".");
+  const base = resolve4(root);
+  const target = resolve4(base, relPath || ".");
   return target === base || target.startsWith(base + sep3) ? target : null;
 }
 async function readWorkerFile(root, path) {
@@ -42011,12 +42258,12 @@ async function readWorkerFile(root, path) {
 
 // src/core/fs-write.ts
 import { mkdir as mkdir4, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname4, resolve as resolve4, sep as sep4 } from "path";
+import { dirname as dirname4, resolve as resolve5, sep as sep4 } from "path";
 var MAX_BYTES2 = 2 * 1024 * 1024;
 function resolveInRoot2(root, relPath) {
   if (!root) return null;
-  const base = resolve4(root);
-  const target = resolve4(base, relPath || ".");
+  const base = resolve5(root);
+  const target = resolve5(base, relPath || ".");
   return target === base || target.startsWith(base + sep4) ? target : null;
 }
 async function writeWorkerFile(root, relPath, content) {
@@ -42039,11 +42286,11 @@ async function writeWorkerFile(root, relPath, content) {
 
 // src/core/fs-mutate.ts
 import { mkdir as mkdir5, writeFile as writeFile6, rename, rm as rm3, stat as stat2 } from "fs/promises";
-import { basename as basename3, dirname as dirname5, resolve as resolve5, sep as sep5 } from "path";
+import { basename as basename3, dirname as dirname5, resolve as resolve6, sep as sep5 } from "path";
 var MAX_BYTES3 = 2 * 1024 * 1024;
 function resolveInRoot3(root, rel) {
-  const base = resolve5(root);
-  const target = resolve5(base, rel || ".");
+  const base = resolve6(root);
+  const target = resolve6(base, rel || ".");
   return target === base || target.startsWith(base + sep5) ? target : null;
 }
 async function isDir(p2) {
@@ -42068,13 +42315,13 @@ async function mutateFs(root, req) {
     switch (req.op) {
       case "mkdir": {
         const target = resolveInRoot3(root, req.path ?? "");
-        if (!target || target === resolve5(root)) return escaped(req.path ?? "");
+        if (!target || target === resolve6(root)) return escaped(req.path ?? "");
         await mkdir5(target, { recursive: true });
         return { ok: true, path: target };
       }
       case "create": {
         const target = resolveInRoot3(root, req.path ?? "");
-        if (!target || target === resolve5(root)) return escaped(req.path ?? "");
+        if (!target || target === resolve6(root)) return escaped(req.path ?? "");
         if (await exists(target)) return { ok: false, path: target, error: "already exists" };
         const content = req.content ?? "";
         if (Buffer.byteLength(content, "utf8") > MAX_BYTES3) {
@@ -42088,9 +42335,9 @@ async function mutateFs(root, req) {
         const from = resolveInRoot3(root, req.from ?? "");
         let to2 = resolveInRoot3(root, req.to ?? "");
         if (!from || !to2) return escaped(req.from ?? req.to ?? "");
-        if (from === resolve5(root)) return { ok: false, path: from, error: "cannot move the project root" };
-        if (await isDir(to2)) to2 = resolve5(to2, basename3(from));
-        if (to2 !== resolve5(root) && !to2.startsWith(resolve5(root) + sep5)) return escaped(req.to ?? "");
+        if (from === resolve6(root)) return { ok: false, path: from, error: "cannot move the project root" };
+        if (await isDir(to2)) to2 = resolve6(to2, basename3(from));
+        if (to2 !== resolve6(root) && !to2.startsWith(resolve6(root) + sep5)) return escaped(req.to ?? "");
         if (await exists(to2)) return { ok: false, path: to2, error: "destination already exists" };
         await mkdir5(dirname5(to2), { recursive: true });
         await rename(from, to2);
@@ -42099,7 +42346,7 @@ async function mutateFs(root, req) {
       case "delete": {
         const target = resolveInRoot3(root, req.path ?? "");
         if (!target) return escaped(req.path ?? "");
-        if (target === resolve5(root)) return { ok: false, path: target, error: "cannot delete the project root" };
+        if (target === resolve6(root)) return { ok: false, path: target, error: "cannot delete the project root" };
         await rm3(target, { recursive: true, force: true });
         return { ok: true, path: target };
       }
@@ -42113,11 +42360,11 @@ async function mutateFs(root, req) {
 
 // src/core/fs-transfer.ts
 import { mkdir as mkdir6, readFile as readFile7, stat as stat3, writeFile as writeFile7 } from "fs/promises";
-import { basename as basename4, dirname as dirname6, extname, resolve as resolve6, sep as sep6 } from "path";
+import { basename as basename4, dirname as dirname6, extname, resolve as resolve7, sep as sep6 } from "path";
 function resolveInRoot4(root, relPath) {
   if (!root) return null;
-  const base = resolve6(root);
-  const target = resolve6(base, relPath || ".");
+  const base = resolve7(root);
+  const target = resolve7(base, relPath || ".");
   return target === base || target.startsWith(base + sep6) ? target : null;
 }
 var MIME_BY_EXT = {
@@ -42233,13 +42480,13 @@ function handleFsChannels(ctx, message, payload) {
 // src/core/git-diff.ts
 import { readFile as readFile8 } from "fs/promises";
 import { execFile as execFile6 } from "child_process";
-import { basename as basename5, dirname as dirname7, resolve as resolve7, sep as sep7 } from "path";
+import { basename as basename5, dirname as dirname7, resolve as resolve8, sep as sep7 } from "path";
 import { promisify as promisify6 } from "util";
 var run6 = promisify6(execFile6);
 function resolveInRoot5(root, relPath) {
   if (!root) return null;
-  const base = resolve7(root);
-  const target = resolve7(base, relPath || ".");
+  const base = resolve8(root);
+  const target = resolve8(base, relPath || ".");
   return target === base || target.startsWith(base + sep7) ? target : null;
 }
 function looksBinary(buf) {
@@ -42393,15 +42640,15 @@ async function manageSshKey(op, profileDir2) {
 
 // src/core/git-history.ts
 import { execFile as execFile9 } from "child_process";
-import { resolve as resolve8, sep as sep8 } from "path";
+import { resolve as resolve9, sep as sep8 } from "path";
 import { promisify as promisify9 } from "util";
 var run9 = promisify9(execFile9);
 var FS = "";
 var RS = "";
 function resolveRepo(root, repo) {
   if (!root) return null;
-  const base = resolve8(root);
-  const requested = resolve8(base, repo && repo.trim() ? repo : ".");
+  const base = resolve9(root);
+  const requested = resolve9(base, repo && repo.trim() ? repo : ".");
   return requested === base || requested.startsWith(base + sep8) ? requested : base;
 }
 async function git(cwd2, args) {
@@ -42418,7 +42665,7 @@ async function git(cwd2, args) {
 }
 async function gitRepos(root) {
   if (!root) return { repos: [] };
-  const base = resolve8(root);
+  const base = resolve9(root);
   const top = (await git(base, ["rev-parse", "--show-toplevel"])).trim();
   if (!top || !(top === base || top.startsWith(base + sep8))) return { repos: [] };
   const repos = [];
@@ -42430,7 +42677,7 @@ async function gitRepos(root) {
     const m2 = line.trim().match(/^[-+U ]?[0-9a-f]{7,40}\s+(\S+)/);
     const subPath = m2?.[1];
     if (!subPath) continue;
-    const abs = resolve8(base, subPath);
+    const abs = resolve9(base, subPath);
     if (!(abs === base || abs.startsWith(base + sep8))) continue;
     const remote = (await git(abs, ["remote", "get-url", "origin"])).trim();
     const branch = (await git(abs, ["rev-parse", "--abbrev-ref", "HEAD"])).trim();
@@ -42752,9 +42999,9 @@ Extra focus from the author: ${req.prompt}` : "";
     "Output ONLY the Markdown article, no preamble or code fences around the whole thing." + focus
   ].join("\n");
 }
-function runOnce2(cmd, profile, prompt, cwd2, extraEnv) {
-  return new Promise((resolve10, reject) => {
-    const args = ["-p", ...profile?.model ? ["--model", profile.model] : []];
+function runOnce2(cmd, profile, prompt, cwd2, extraEnv, denyDirs = []) {
+  return new Promise((resolve11, reject) => {
+    const args = ["-p", ...profile?.model ? ["--model", profile.model] : [], ...denySettingsArgs(cmd, [...denyDirs, profile?.dir])];
     const env3 = {
       ...process.env,
       ...extraEnv,
@@ -42776,7 +43023,7 @@ function runOnce2(cmd, profile, prompt, cwd2, extraEnv) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve10({ code: code ?? -1, out, err });
+      resolve11({ code: code ?? -1, out, err });
     });
     child.stdin.write(prompt);
     child.stdin.end();
@@ -42788,7 +43035,7 @@ async function runKnowledgeCompose(req, ai2, physicRoot) {
   let lastReason = "no attempt";
   for (let i = 0; i < attempts.length; i++) {
     try {
-      const { code, out, err } = await runOnce2(ai2.cmd, attempts[i], prompt, physicRoot, ai2.env);
+      const { code, out, err } = await runOnce2(ai2.cmd, attempts[i], prompt, physicRoot, ai2.env, ai2.profiles.map((p2) => p2.dir));
       if (code === 0 && out.trim()) {
         reportToolResult(ai2.cmd, true);
         return { bodyMarkdown: out.trim() };
@@ -42808,17 +43055,14 @@ async function runKnowledgeCompose(req, ai2, physicRoot) {
 // src/core/faq-compose.ts
 import { spawn as spawn9, execFile as execFile10 } from "child_process";
 import { existsSync as existsSync14, mkdirSync as mkdirSync7, rmSync as rmSync7 } from "fs";
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { join as join24 } from "path";
-import { tmpdir as tmpdir3 } from "os";
+import { tmpdir as tmpdir4 } from "os";
 import { promisify as promisify10 } from "util";
 var execFileAsync2 = promisify10(execFile10);
 var NO_USAGE2 = { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 };
 var COMPOSE_TIMEOUT_MS2 = 10 * 60 * 1e3;
-function authedUrl2(url, token) {
-  if (url.startsWith("https://")) return url.replace("https://", `https://x-access-token:${token}@`);
-  return url;
-}
+var AGENT_DENIED_TOOLS = ["Bash", "WebFetch", "WebSearch", "NotebookEdit", "Task"];
 function buildPrompt4(tickets, customPrompt) {
   const transcript = tickets.map((t2) => {
     const thread = t2.messages.map((m2) => `  [${m2.author}] ${m2.body}`).join("\n");
@@ -42879,22 +43123,22 @@ function parsePerTicket(text) {
   }
   return [];
 }
-function runClaudeOnce2(cmd, profile, prompt, cwd2, extraEnv) {
-  return new Promise((resolve10, reject) => {
+function runClaudeOnce2(cmd, profile, prompt, cwd2, extraEnv, denyDirs = []) {
+  return new Promise((resolve11, reject) => {
     const isClaude = cmd.includes("claude");
     const args = [
       "-p",
       ...profile?.model ? ["--model", profile.model] : [],
       ...isClaude ? ["--output-format", "stream-json", "--verbose"] : [],
-      // Write-capable headless agent (ADR-0271): auto-approve tools so it never stalls on a prompt.
-      ...isClaude ? ["--permission-mode", "bypassPermissions"] : [],
-      ...cmd.includes("codex") ? ["--dangerously-bypass-approvals-and-sandbox"] : []
+      // Secret-path deny rules (ADR-0347): reads are not confined to the clone, so the credential
+      // dirs / cli profile / ssh / gh / git credentials are explicitly denied.
+      ...denySettingsArgs(cmd, [...denyDirs, profile?.dir]),
+      // Edit-only headless agent (ADR-0346): file edits are auto-accepted, everything else (Bash, web)
+      // is denied, since the prompt carries untrusted ticket text. git/PR are done by this module.
+      ...isClaude ? ["--permission-mode", "acceptEdits", "--disallowedTools", ...AGENT_DENIED_TOOLS] : [],
+      ...cmd.includes("codex") ? ["--sandbox", "workspace-write"] : []
     ];
-    const env3 = {
-      ...process.env,
-      ...extraEnv,
-      ...profile ? { CLAUDE_CONFIG_DIR: profile.dir } : {}
-    };
+    const env3 = agentEnv(extraEnv, profile ? { CLAUDE_CONFIG_DIR: profile.dir } : void 0);
     const child = spawn9(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: cwd2, env: env3 });
     const parser = createAiStreamParser(cmd);
     let out = "";
@@ -42913,7 +43157,7 @@ function runClaudeOnce2(cmd, profile, prompt, cwd2, extraEnv) {
     child.on("close", (code) => {
       clearTimeout(timer);
       out += parser.flush();
-      resolve10({ code: code ?? -1, out, err, usage: parser.usage() });
+      resolve11({ code: code ?? -1, out, err, usage: parser.usage() });
     });
     child.stdin.write(prompt);
     child.stdin.end();
@@ -42923,7 +43167,7 @@ async function runClaudeWithFailover2(prompt, cwd2, ai2) {
   const attempts = ai2.profiles.length > 0 ? ai2.profiles : [null];
   let lastReason = "no attempt";
   for (let i = 0; i < attempts.length; i++) {
-    const { code, out, err, usage } = await runClaudeOnce2(ai2.cmd, attempts[i], prompt, cwd2, ai2.env);
+    const { code, out, err, usage } = await runClaudeOnce2(ai2.cmd, attempts[i], prompt, cwd2, ai2.env, ai2.profiles.map((p2) => p2.dir));
     if (code === 0) return { usage, text: out.trim() };
     lastReason = `exited ${code}: ${(err || out).slice(0, 500)}`;
     if (i === attempts.length - 1) break;
@@ -42933,12 +43177,12 @@ async function runClaudeWithFailover2(prompt, cwd2, ai2) {
 var MAX_OUTPUT_CHARS = 8e3;
 async function runFaqCompose(req, ai2) {
   if (!req.repo.token) return { prUrl: "", error: "no write token" };
-  const workDir = join24(tmpdir3(), "4pm-faq-sync", randomUUID3());
+  const workDir = join24(tmpdir4(), "4pm-faq-sync", randomUUID2());
   const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
-  const authed = authedUrl2(req.repo.url, req.repo.token);
+  const auth = gitAuthArgs("x-access-token", req.repo.token);
   try {
     mkdirSync7(workDir, { recursive: true });
-    await execFileAsync2("git", ["clone", "--depth", "1", "--branch", req.repo.branch, authed, workDir], { env: gitEnv });
+    await execFileAsync2("git", [...auth, "clone", "--depth", "1", "--branch", req.repo.branch, req.repo.url, workDir], { env: gitEnv });
     await execFileAsync2("git", ["-C", workDir, "config", "user.name", "4PM FAQ Bot"], { env: gitEnv });
     await execFileAsync2("git", ["-C", workDir, "config", "user.email", "faq-bot@4pm.app"], { env: gitEnv });
     await execFileAsync2("git", ["-C", workDir, "checkout", "-b", req.headBranch], { env: gitEnv });
@@ -42951,7 +43195,7 @@ async function runFaqCompose(req, ai2) {
       return { prUrl: "", output, perTicket, tokens: usage.tokens || estimateTokens2(text), finishedAt: (/* @__PURE__ */ new Date()).toISOString() };
     }
     await execFileAsync2("git", ["-C", workDir, "commit", "-m", "docs(faq): synthesize from support tickets (4PM)"], { env: gitEnv });
-    await execFileAsync2("git", ["-C", workDir, "push", "-u", "origin", req.headBranch], { env: gitEnv });
+    await execFileAsync2("git", [...auth, "-C", workDir, "push", "-u", "origin", req.headBranch], { env: gitEnv });
     let prUrl = "";
     try {
       const pr2 = await execFileAsync2(
@@ -43533,7 +43777,7 @@ async function removePackage(root, slug) {
 
 // src/core/graph.ts
 import { readFile as readFile14, readdir as readdir6 } from "fs/promises";
-import { join as join29, relative as relative2, dirname as dirname10, resolve as resolve9, extname as extname2, basename as basename6 } from "path";
+import { join as join29, relative as relative2, dirname as dirname10, resolve as resolve10, extname as extname2, basename as basename6 } from "path";
 var MAX_FILES = 2e3;
 var MAX_NODES = 3e3;
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "out", "coverage", ".turbo"]);
@@ -43588,7 +43832,7 @@ async function buildDocs(root) {
     for (const m2 of text.matchAll(/\[[^\]]*\]\(([^)]+)\)/g)) {
       const href = (m2[1] ?? "").split("#")[0].trim();
       if (!href || !href.endsWith(".md") || href.startsWith("http")) continue;
-      const target = relative2(root, resolve9(dirname10(f2), href)).split("\\").join("/");
+      const target = relative2(root, resolve10(dirname10(f2), href)).split("\\").join("/");
       if (ids.has(target) && target !== rel) {
         const key = `${rel}->${target}`;
         if (!seen.has(key)) {
@@ -44220,6 +44464,7 @@ var WsClient = class {
    */
   aiMemory = "";
   sessionIdByKey = /* @__PURE__ */ new Map();
+  sessionMetaByKey = /* @__PURE__ */ new Map();
   stopped = false;
   /** Resolver to wake the backoff sleep early (set while waiting) — for /reconnect. */
   wakeReconnect = null;
@@ -44313,6 +44558,7 @@ var WsClient = class {
       serverUrl: this.context.credential.serverUrl,
       startedAtMs: this.startedAtMs,
       sessionIdByKey: this.sessionIdByKey,
+      sessionMetaByKey: this.sessionMetaByKey,
       get machineUsername() {
         return self.machineUsername;
       },
@@ -44425,14 +44671,14 @@ var WsClient = class {
    */
   awaitConnected(timeoutMs) {
     if (this.sessionKey && this.bus.status === "connected") return Promise.resolve(true);
-    return new Promise((resolve10) => {
+    return new Promise((resolve11) => {
       const waiter = () => {
         clearTimeout(timer);
-        resolve10(true);
+        resolve11(true);
       };
       const timer = setTimeout(() => {
         this.connectWaiters = this.connectWaiters.filter((w2) => w2 !== waiter);
-        resolve10(false);
+        resolve11(false);
       }, timeoutMs);
       this.connectWaiters.push(waiter);
     });
@@ -44459,16 +44705,16 @@ var WsClient = class {
       this.forceReconnect = false;
       return Promise.resolve();
     }
-    return new Promise((resolve10) => {
+    return new Promise((resolve11) => {
       const timer = setTimeout(() => {
         this.wakeReconnect = null;
-        resolve10();
+        resolve11();
       }, ms2);
       this.wakeReconnect = () => {
         clearTimeout(timer);
         this.wakeReconnect = null;
         this.forceReconnect = false;
-        resolve10();
+        resolve11();
       };
     });
   }
@@ -44522,7 +44768,7 @@ var WsClient = class {
    * One WS session: token → connect → handshake → handle messages until close.
    */
   connectOnce() {
-    return new Promise((resolve10, reject) => {
+    return new Promise((resolve11, reject) => {
       void (async () => {
         this.sessionEstablished = false;
         this.bus.setStatus("connecting");
@@ -44618,7 +44864,7 @@ var WsClient = class {
           if (code === CLOSE_DRAINING) {
             this.bus.log(t("error.serverDraining"));
           }
-          resolve10();
+          resolve11();
         });
         socket.on("error", (err) => {
           this.clearHeartbeat();
@@ -44730,7 +44976,7 @@ var WsClient = class {
     }
     const { payload, nonce } = encryptPayload(this.sessionKey, data);
     const envelope = {
-      id: randomUUID4(),
+      id: randomUUID3(),
       replyTo,
       channel,
       wsToken: this.wsToken,
@@ -44744,14 +44990,14 @@ var WsClient = class {
    * Used for quota.check before spawning an AI cli (ADR-0020).
    */
   request(channel, data) {
-    return new Promise((resolve10, reject) => {
+    return new Promise((resolve11, reject) => {
       if (!this.socket || !this.sessionKey) {
         reject(new Error("Not connected to the server."));
         return;
       }
       const { payload, nonce } = encryptPayload(this.sessionKey, data);
       const envelope = {
-        id: randomUUID4(),
+        id: randomUUID3(),
         replyTo: null,
         channel,
         wsToken: this.wsToken,
@@ -44764,7 +45010,7 @@ var WsClient = class {
       }, 15e3);
       timer.unref?.();
       this.pending.set(envelope.id, {
-        resolve: (value) => resolve10(value),
+        resolve: (value) => resolve11(value),
         timer
       });
       this.socket.send(JSON.stringify(envelope));
@@ -45140,7 +45386,7 @@ function releaseInstanceLock(profileDir2) {
 
 // src/core/session-bus.ts
 import { EventEmitter } from "events";
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 var REPLAY_CAP = 500;
 var SessionBus = class {
   emitter = new EventEmitter();
@@ -45171,7 +45417,7 @@ var SessionBus = class {
   /** Producer → consumers: push one transcript entry. Returns its id (for `updateEntry`). */
   push(input) {
     const entry = {
-      id: randomUUID5(),
+      id: randomUUID4(),
       level: "info",
       ...input,
       ts: Date.now()
@@ -50875,8 +51121,8 @@ var Ink = class {
     }
   }
   async waitUntilExit() {
-    this.exitPromise ||= new Promise((resolve10, reject) => {
-      this.resolveExitPromise = resolve10;
+    this.exitPromise ||= new Promise((resolve11, reject) => {
+      this.resolveExitPromise = resolve11;
       this.rejectExitPromise = reject;
     });
     return this.exitPromise;
@@ -51929,7 +52175,7 @@ async function runStart(profileDir2, profileName) {
           logger.error("ws.run.crash", { message: e.message, stack: e.stack });
           if (client.isStopped) return;
           bus.log(t("start.recovered", { message: e.message }), "error");
-          await new Promise((resolve10) => setTimeout(resolve10, 1e3));
+          await new Promise((resolve11) => setTimeout(resolve11, 1e3));
         }
       }
     };
@@ -51975,7 +52221,7 @@ import { join as join38 } from "path";
 // src/core/control-client.ts
 import { connect as connect2 } from "net";
 function connectControl(socketPath, bus, token) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     const socket = connect2(socketPath);
     socket.setEncoding("utf8");
     let ready = false;
@@ -52028,7 +52274,7 @@ function connectControl(socketPath, bus, token) {
           bus.setTokens(frame.tokens);
           for (const entry of frame.transcript) bus.pushEntry(entry);
           ready = true;
-          resolve10({ info: frame.info, close });
+          resolve11({ info: frame.info, close });
           break;
         case "transcript":
           bus.pushEntry(frame.entry);
@@ -52116,7 +52362,7 @@ async function runAutoRun(profileDir2, profileName) {
   initI18n(readProfileConfig(profileDir2).locale);
   const socketPath = join39(profileDir2, CONTROL_SOCKET_FILE);
   const token = readControlToken(profileDir2);
-  const code = await new Promise((resolve10) => {
+  const code = await new Promise((resolve11) => {
     let settled = false;
     const done = (c) => {
       if (settled) return;
@@ -52126,7 +52372,7 @@ async function runAutoRun(profileDir2, profileName) {
         socket.destroy();
       } catch {
       }
-      resolve10(c);
+      resolve11(c);
     };
     const socket = connect3(socketPath);
     socket.setEncoding("utf8");
@@ -52174,16 +52420,16 @@ import { spawn as spawn12 } from "child_process";
 import { mkdirSync as mkdirSync9 } from "fs";
 import { basename as basename8 } from "path";
 function runProviderLogin(cmd, envVar, dir2) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     const child = spawn12(cmd, [], {
       stdio: "inherit",
       env: { ...process.env, [envVar]: dir2 }
     });
     child.on("error", (err) => {
       console.error(t("aiLogin.launchFailed", { cmd, message: err.message }));
-      resolve10(1);
+      resolve11(1);
     });
-    child.on("exit", (code) => resolve10(code ?? 0));
+    child.on("exit", (code) => resolve11(code ?? 0));
   });
 }
 async function runAiLogin(profileDir2, profileName, aiFilter) {
@@ -52323,10 +52569,10 @@ function Picker({
   ] });
 }
 function selectFromList(items, title) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     let chosen = null;
     const app = render_default(/* @__PURE__ */ (0, import_jsx_runtime7.jsx)(Picker, { items, title, onDone: (v2) => chosen = v2 }));
-    void app.waitUntilExit().then(() => resolve10(chosen));
+    void app.waitUntilExit().then(() => resolve11(chosen));
   });
 }