@4pm/cli 1.5.11 → 1.5.15

package/dist/index.js

@@ -28323,14 +28323,14 @@ function defaultProfileConfig() {
     webBlockedCommands: ["quit", "config"],
     // Shared AI memory (ADR-0245) — off by default (opt-in; costs a compaction call per turn).
     aiMemoryEnabled: false,
-    aiMemoryBudgetChars: 6e3
+    aiMemoryBudgetChars: 1e3
   };
 }
 function resolveMemoryConfig(config) {
   const mode = config.projectAiMemoryMode ?? "inherit";
   const enabled = mode === "on" ? true : mode === "off" ? false : config.aiMemoryEnabled ?? false;
   const projectBudget = config.projectAiMemoryBudgetChars ?? 0;
-  const budgetChars = projectBudget > 0 ? projectBudget : config.aiMemoryBudgetChars ?? 6e3;
+  const budgetChars = projectBudget > 0 ? projectBudget : config.aiMemoryBudgetChars ?? 1e3;
   return { enabled, budgetChars };
 }
 function resolveIdleAutoClearMinutes(config) {
@@ -28599,7 +28599,7 @@ async function runLink(serverUrl, explicitProfile, token = null) {
 
 // src/commands/start.ts
 import { spawn as spawn10 } from "child_process";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 
 // src/core/update.ts
 import { execSync as execSync2 } from "child_process";
@@ -28775,7 +28775,7 @@ async function checkAndUpdate(serverUrl, autoUpdate) {
 // src/core/ws-client.ts
 init_wrapper();
 import { randomUUID } from "crypto";
-import { basename as basename4, join as join25 } from "path";
+import { basename as basename4, join as join26 } from "path";
 
 // vendor/@4pm/utils/helpers.ts
 function backoffJitterMs(attempt, baseMs = 500, maxMs = 1e4) {
@@ -32913,6 +32913,29 @@ var deletedFilterSchema = external_exports.enum(["true", "false"]).transform((v)
 // vendor/@4pm/dto/command.ts
 var COMMAND_MAX_LEN = 8e3;
 var AI_PROMPT_MAX_LEN = 5e5;
+var COMMAND_IMAGE_MAX_BYTES = 5 * 1024 * 1024;
+var COMMAND_IMAGE_MAX_COUNT = 10;
+var COMMAND_IMAGE_MIME_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif"];
+function commandImageExt(mime) {
+  switch (mime) {
+    case "image/png":
+      return "png";
+    case "image/jpeg":
+      return "jpg";
+    case "image/webp":
+      return "webp";
+    case "image/gif":
+      return "gif";
+    default:
+      return "bin";
+  }
+}
+var commandImageRefSchema = external_exports.object({
+  id: external_exports.string().min(1).max(200),
+  placeholder: external_exports.string().min(1).max(40),
+  name: external_exports.string().max(255),
+  mime: external_exports.enum(COMMAND_IMAGE_MIME_TYPES)
+});
 var dispatchCommandRequestSchema = external_exports.object({
   projectId: external_exports.string().uuid(),
   // Target cli. Required unless `pick` is set — with `pick:"idle"` the server chooses the
@@ -32946,6 +32969,13 @@ var dispatchCommandRequestSchema = external_exports.object({
    * against the git allowlist (`isGitCommandAllowed`). Absent ⇒ normal console dispatch.
    */
   gitOp: external_exports.enum(["read", "write"]).optional(),
+  /**
+   * Console image attachments (ADR-0257): up to `COMMAND_IMAGE_MAX_COUNT` uploaded images the
+   * prompt references by `[Image#N]` placeholders. Only meaningful with `ai:true` on a full agent
+   * run (one-shot spec-assist disallows `Read`). Rejected with `IMAGE_UPLOAD_BLOCKED` when the
+   * project has `outboundReview.blockImages`.
+   */
+  images: external_exports.array(commandImageRefSchema).max(COMMAND_IMAGE_MAX_COUNT).optional(),
   /**
    * One-shot AI mode (ADR-0249): the prompt is a text-in → text-out task (spec review /
    * compose / suggest / generators) that must NOT trigger the AI CLI's agentic tool loop.
@@ -33760,6 +33790,10 @@ var WsChannels = {
   // server → cli: the project was deleted ⇒ delete the physic folder; the cli keeps
   // its pairing and goes idle (ADR-0068).
   PHYSIC_DELETE: "physic.delete",
+  // server → cli (ADR-0256): a project's token settings were saved ⇒ push the fresh knobs to every
+  // serving cli so a change (e.g. aiRunTimeoutSec) applies on the next run, not only after a
+  // reconnect. `ws_token` seeds these on connect; this channel only carries updates.
+  PROJECT_TOKENS: "project.tokens",
   // command lifecycle
   COMMAND_ANNOUNCE: "command.announce",
   // console transcript sync (ADR-0150): the cli streams its authoritative SessionBus
@@ -33798,6 +33832,9 @@ var WsChannels = {
   // the worker uploads its pending log tail (+ any queued history) then acks, so the release
   // sweep can finalise without waiting the full 5-minute timeout when the worker is online.
   RENTAL_FLUSH: "rental.flush",
+  // cli → server (reply): fetch a Console prompt image blob to materialize on the worker before
+  // spawning the AI CLI (ADR-0257) — the server reads it from @4pm/storage (org-scoped by link).
+  IMAGE_FETCH: "image.fetch",
   // outbound review (ADR-0082): machine→server request, server→outbound evaluate, result back
   REVIEW_REQUEST: "review.request",
   REVIEW_EVALUATE: "review.evaluate",
@@ -33867,7 +33904,7 @@ function decryptPayload(key, payloadBase64, nonceBase64) {
 }
 
 // src/core/ws-client.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync5, rmSync as rmSync4 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync6, rmSync as rmSync5 } from "fs";
 import { randomUUID as randomCommandId } from "crypto";
 
 // src/core/update-scheduler.ts
@@ -33979,6 +34016,35 @@ ${content.slice(-LOG_UPLOAD_CONTENT_MAX)}`;
 // src/core/worker-tools.ts
 import { spawn } from "child_process";
 var NPM_NAME = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+var TOOL_INSTALL_TIMEOUT_DEFAULT_MS = 3e5;
+var TOOL_INSTALL_MAX_ATTEMPTS = 3;
+var TOOL_RETRY_BASE_MS = 5e3;
+function resolveInstallTimeoutMs(sec) {
+  return sec && sec > 0 ? sec * 1e3 : TOOL_INSTALL_TIMEOUT_DEFAULT_MS;
+}
+function sleep(ms) {
+  return new Promise((resolve8) => {
+    const t = setTimeout(resolve8, ms);
+    t.unref?.();
+  });
+}
+function classifyToolFailure(code, out) {
+  if (code === 124) return { reason: "timeout", retryable: true };
+  const t = out.toLowerCase();
+  if (/e404|not found|no such package|is not in this registry|404 not found/.test(t)) {
+    return { reason: "not-found", retryable: false };
+  }
+  if (/etarget|no matching version|notarget/.test(t)) return { reason: "not-found", retryable: false };
+  if (/unsupported_engine|npm error engine|err_pnpm_unsupported_engine/.test(t)) {
+    return { reason: "engine", retryable: false };
+  }
+  if (/econnreset|etimedout|eai_again|enotfound|econnrefused|socket hang up|err_socket|network|network_request_failed|registry.*(50\d|timeout)|request to https?:\/\/.*failed/.test(
+    t
+  )) {
+    return { reason: "network", retryable: true };
+  }
+  return { reason: "other", retryable: false };
+}
 function run(cmd, args, onLine, timeoutMs = 18e4) {
   return new Promise((resolve8) => {
     let out = "";
@@ -34095,13 +34161,13 @@ function opArgs(op, manager, pkg) {
   const target = op === "update" ? `${pkg}@latest` : pkg;
   return manager === "pnpm" ? ["add", "-g", target] : ["install", "-g", target];
 }
-async function runWorkerToolOp(op, name, manager, onLine) {
+async function runWorkerToolOp(op, name, manager, onLine, timeoutMs = TOOL_INSTALL_TIMEOUT_DEFAULT_MS) {
   const resolved = resolvePackage(name, op);
   if (resolved.error || !resolved.pkg) {
     return { ok: false, exitCode: 1, error: resolved.error ?? "Invalid package." };
   }
   onLine(`$ ${manager} ${opArgs(op, manager, resolved.pkg).join(" ")}`);
-  const { code } = await run(manager, opArgs(op, manager, resolved.pkg), onLine);
+  const { code } = await run(manager, opArgs(op, manager, resolved.pkg), onLine, timeoutMs);
   return { ok: code === 0, exitCode: code, error: code === 0 ? void 0 : `${manager} exited ${code}` };
 }
 function setToolAutoUpdate(profileDir2, name, enabled) {
@@ -34114,25 +34180,40 @@ function setToolAutoUpdate(profileDir2, name, enabled) {
   writeProfileConfig(profileDir2, { autoUpdateTools: [...set] });
   return { ok: true };
 }
-async function autoUpdateFlaggedTools(tools, onLine) {
+async function autoUpdateFlaggedTools(tools, onLine, timeoutMs = TOOL_INSTALL_TIMEOUT_DEFAULT_MS) {
   for (const name of tools) {
-    const res = await runWorkerToolOp("update", name, "npm", onLine).catch(
+    const res = await runWorkerToolOp("update", name, "npm", onLine, timeoutMs).catch(
       (err) => ({ ok: false, exitCode: 1, error: String(err) })
     );
     onLine(res.ok ? `\u2713 ${name} updated` : `\u2717 ${name}: ${res.error ?? "failed"}`);
   }
 }
-async function installPinned(name, version, manager, onLine) {
+async function installPinned(name, version, manager, onLine, timeoutMs = TOOL_INSTALL_TIMEOUT_DEFAULT_MS) {
   const resolved = resolvePackage(name, "update");
-  if (resolved.error || !resolved.pkg) return { ok: false, error: resolved.error ?? "Invalid package." };
+  if (resolved.error || !resolved.pkg) {
+    return { ok: false, error: resolved.error ?? "Invalid package.", reason: "other", retryable: false };
+  }
   const target = `${resolved.pkg}@${version}`;
   const args = manager === "pnpm" ? ["add", "-g", target] : ["install", "-g", target];
-  onLine(`$ ${manager} ${args.join(" ")}`);
-  const { code } = await run(manager, args, onLine);
-  return { ok: code === 0, error: code === 0 ? void 0 : `${manager} exited ${code}` };
-}
-async function reconcileTools(manifest, onLine) {
-  if (manifest.length === 0) return;
+  for (let attempt = 1; attempt <= TOOL_INSTALL_MAX_ATTEMPTS; attempt++) {
+    const suffix = attempt > 1 ? ` (attempt ${attempt}/${TOOL_INSTALL_MAX_ATTEMPTS})` : "";
+    onLine(`$ ${manager} ${args.join(" ")}${suffix}`);
+    const { code, out } = await run(manager, args, onLine, timeoutMs);
+    if (code === 0) return { ok: true };
+    const { reason, retryable } = classifyToolFailure(code, out);
+    if (!retryable || attempt === TOOL_INSTALL_MAX_ATTEMPTS) {
+      return { ok: false, error: `${manager} exited ${code}`, reason, retryable };
+    }
+    const base = TOOL_RETRY_BASE_MS * 3 ** (attempt - 1);
+    const wait = Math.round(base * (0.8 + Math.random() * 0.4));
+    onLine(`retrying in ${Math.round(wait / 1e3)}s (${reason})\u2026`);
+    await sleep(wait);
+  }
+  return { ok: false, error: `${manager} failed`, reason: "other", retryable: false };
+}
+async function reconcileTools(manifest, onLine, timeoutMs = TOOL_INSTALL_TIMEOUT_DEFAULT_MS) {
+  const failed = [];
+  if (manifest.length === 0) return failed;
   const { catalog, extras } = await detectWorkerTools();
   const versionByName = new Map(
     [...catalog, ...extras].filter((r) => r.installed && r.version).map((r) => [r.id, r.version])
@@ -34141,11 +34222,27 @@ async function reconcileTools(manifest, onLine) {
     const current = versionByName.get(entry.name);
     if (current && current.includes(entry.version)) continue;
     onLine(`Restoring ${entry.name}@${entry.version}\u2026`);
-    const res = await installPinned(entry.name, entry.version, entry.manager, onLine).catch(
-      (err) => ({ ok: false, error: String(err) })
+    const res = await installPinned(entry.name, entry.version, entry.manager, onLine, timeoutMs).catch(
+      (err) => ({
+        ok: false,
+        error: String(err),
+        reason: "other",
+        retryable: false
+      })
     );
-    onLine(res.ok ? `\u2713 ${entry.name}@${entry.version}` : `\u2717 ${entry.name}: ${res.error ?? "failed"}`);
+    if (res.ok) {
+      onLine(`\u2713 ${entry.name}@${entry.version}`);
+    } else {
+      onLine(`\u2717 ${entry.name}: ${res.error ?? "failed"}`);
+      failed.push({
+        name: entry.name,
+        version: entry.version,
+        reason: res.reason ?? "other",
+        retryable: res.retryable ?? false
+      });
+    }
   }
+  return failed;
 }
 
 // src/core/update-scheduler.ts
@@ -34259,10 +34356,12 @@ var UpdateScheduler = class {
   }
   /** Update each tool flagged for auto-update in config.json to @latest (ADR-0253) — best-effort. */
   async updateFlaggedTools() {
-    const tools = readProfileConfig(this.profileDir).autoUpdateTools ?? [];
+    const config = readProfileConfig(this.profileDir);
+    const tools = config.autoUpdateTools ?? [];
     if (tools.length === 0) return;
     this.bus.log(`Scheduled tool auto-update: ${tools.join(", ")}\u2026`);
-    await autoUpdateFlaggedTools(tools, (line) => logger.info("update.tool.line", { line })).catch(
+    const timeoutMs = resolveInstallTimeoutMs(config.toolInstallTimeoutSec);
+    await autoUpdateFlaggedTools(tools, (line) => logger.info("update.tool.line", { line }), timeoutMs).catch(
       (err) => logger.warn("update.tool.error", { error: String(err) })
     );
     this.onToolsChanged?.();
@@ -35247,23 +35346,86 @@ function finishCommand(commandId, exitCode, usage) {
   persist();
 }
 
+// src/core/command-images.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readdirSync as readdirSync3, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
+import { join as join11 } from "path";
+function attachmentsBaseDir(physicRoot) {
+  return join11(physicRoot, ".4pm", "attachments");
+}
+var ATTACHMENT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+async function materializeImages(physicRoot, commandId, images, fetch2) {
+  const map = /* @__PURE__ */ new Map();
+  if (!images.length) return map;
+  const dir2 = join11(attachmentsBaseDir(physicRoot), commandId);
+  mkdirSync3(dir2, { recursive: true });
+  let n = 0;
+  for (const img of images) {
+    n += 1;
+    try {
+      const reply = await fetch2(img.id);
+      if (!reply.dataBase64) {
+        logger.warn("command.image.fetch.empty", { commandId, imageId: img.id, error: reply.error });
+        continue;
+      }
+      const ext = commandImageExt(reply.mime ?? img.mime);
+      const file = join11(dir2, `img-${n}.${ext}`);
+      writeFileSync6(file, Buffer.from(reply.dataBase64, "base64"));
+      map.set(img.placeholder, file);
+    } catch (err) {
+      logger.warn("command.image.fetch.failed", {
+        commandId,
+        imageId: img.id,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return map;
+}
+function rewriteImagePlaceholders(prompt, paths) {
+  let out = prompt;
+  for (const [placeholder, file] of paths) {
+    out = out.split(placeholder).join(`\`${file}\``);
+  }
+  return out;
+}
+function sweepOldAttachments(physicRoot, maxAgeMs = ATTACHMENT_MAX_AGE_MS) {
+  const base = attachmentsBaseDir(physicRoot);
+  if (!existsSync7(base)) return 0;
+  const cutoff = Date.now() - maxAgeMs;
+  let removed = 0;
+  try {
+    for (const entry of readdirSync3(base)) {
+      const dir2 = join11(base, entry);
+      try {
+        if (statSync2(dir2).mtimeMs < cutoff) {
+          rmSync3(dir2, { recursive: true, force: true });
+          removed += 1;
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return removed;
+}
+
 // src/core/command-output-store.ts
 import {
   appendFileSync,
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync3,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync4,
   readFileSync as readFileSync11,
-  readdirSync as readdirSync3,
-  rmSync as rmSync3,
-  statSync as statSync2
+  readdirSync as readdirSync4,
+  rmSync as rmSync4,
+  statSync as statSync3
 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 var KEEP_FILES = 200;
 var dir = null;
 function initCommandOutput(profileDir2) {
-  dir = join11(profileDir2, "command-output");
+  dir = join12(profileDir2, "command-output");
   try {
-    mkdirSync3(dir, { recursive: true });
+    mkdirSync4(dir, { recursive: true });
     prune();
   } catch {
   }
@@ -35271,14 +35433,14 @@ function initCommandOutput(profileDir2) {
 function appendCommandOutput(commandId, text) {
   if (!dir || !text) return;
   try {
-    appendFileSync(join11(dir, `${commandId}.log`), text, "utf8");
+    appendFileSync(join12(dir, `${commandId}.log`), text, "utf8");
   } catch {
   }
 }
 function readCommandOutput(commandId) {
   if (!dir) return null;
-  const path = join11(dir, `${commandId}.log`);
-  if (!existsSync7(path)) return null;
+  const path = join12(dir, `${commandId}.log`);
+  if (!existsSync8(path)) return null;
   try {
     return readFileSync11(path, "utf8");
   } catch {
@@ -35288,8 +35450,8 @@ function readCommandOutput(commandId) {
 function prune() {
   if (!dir) return;
   try {
-    const files = readdirSync3(dir).filter((f) => f.endsWith(".log")).map((f) => ({ f, t: statSync2(join11(dir, f)).mtimeMs })).sort((a, b) => b.t - a.t);
-    for (const { f } of files.slice(KEEP_FILES)) rmSync3(join11(dir, f), { force: true });
+    const files = readdirSync4(dir).filter((f) => f.endsWith(".log")).map((f) => ({ f, t: statSync3(join12(dir, f)).mtimeMs })).sort((a, b) => b.t - a.t);
+    for (const { f } of files.slice(KEEP_FILES)) rmSync4(join12(dir, f), { force: true });
   } catch {
   }
 }
@@ -35297,9 +35459,9 @@ function pruneCommandOutputByAge(days) {
   if (!dir || days <= 0) return;
   const cutoff = Date.now() - days * 24 * 60 * 60 * 1e3;
   try {
-    for (const f of readdirSync3(dir).filter((n) => n.endsWith(".log"))) {
-      const p = join11(dir, f);
-      if (statSync2(p).mtimeMs < cutoff) rmSync3(p, { force: true });
+    for (const f of readdirSync4(dir).filter((n) => n.endsWith(".log"))) {
+      const p = join12(dir, f);
+      if (statSync3(p).mtimeMs < cutoff) rmSync4(p, { force: true });
     }
   } catch {
   }
@@ -35376,8 +35538,8 @@ async function writeWorkerFile(root, relPath, content) {
 import { spawn as spawn5 } from "child_process";
 import { execFile as execFile2 } from "child_process";
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync4 } from "fs";
+import { join as join13 } from "path";
 import { promisify as promisify2 } from "util";
 var NO_USAGE = { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 };
 var execFileAsync = promisify2(execFile2);
@@ -35385,11 +35547,11 @@ var MAX_CONTEXT_CHARS = 12e4;
 var ANSWER_TIMEOUT_MS = 12e4;
 var DOC_EXTENSIONS = [".md", ".mdx", ".txt"];
 function kbRoot(profileDir2) {
-  return join12(profileDir2, "support-kb");
+  return join13(profileDir2, "support-kb");
 }
 function repoDir(profileDir2, url, branch) {
   const key = createHash3("sha1").update(`${url}#${branch}`).digest("hex").slice(0, 16);
-  return join12(kbRoot(profileDir2), key);
+  return join13(kbRoot(profileDir2), key);
 }
 function authedUrl(url, token) {
   if (!token) return url;
@@ -35398,10 +35560,10 @@ function authedUrl(url, token) {
 }
 async function ensureRepo(profileDir2, repo) {
   const dir2 = repoDir(profileDir2, repo.url, repo.branch);
-  if (existsSync8(join12(dir2, ".git"))) return dir2;
+  if (existsSync9(join13(dir2, ".git"))) return dir2;
   const url = authedUrl(repo.url, repo.token);
   const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
-  mkdirSync4(kbRoot(profileDir2), { recursive: true });
+  mkdirSync5(kbRoot(profileDir2), { recursive: true });
   await execFileAsync("git", ["clone", "--depth", "1", "--branch", repo.branch, url, dir2], {
     env: gitEnv
   });
@@ -35409,11 +35571,11 @@ async function ensureRepo(profileDir2, repo) {
 }
 async function refreshSupportKb(profileDir2) {
   const root = kbRoot(profileDir2);
-  if (!existsSync8(root)) return;
+  if (!existsSync9(root)) return;
   const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
-  for (const entry of readdirSync4(root)) {
-    const dir2 = join12(root, entry);
-    if (!existsSync8(join12(dir2, ".git"))) continue;
+  for (const entry of readdirSync5(root)) {
+    const dir2 = join13(root, entry);
+    if (!existsSync9(join13(dir2, ".git"))) continue;
     try {
       await execFileAsync("git", ["-C", dir2, "pull", "--ff-only"], { env: gitEnv });
     } catch (err) {
@@ -35426,10 +35588,10 @@ function collectDocs(dir2) {
   let total = 0;
   const walk2 = (current) => {
     if (total >= MAX_CONTEXT_CHARS) return;
-    for (const entry of readdirSync4(current)) {
+    for (const entry of readdirSync5(current)) {
       if (entry === ".git" || entry === "node_modules") continue;
-      const full = join12(current, entry);
-      const st = statSync3(full);
+      const full = join13(current, entry);
+      const st = statSync4(full);
       if (st.isDirectory()) {
         walk2(full);
       } else if (DOC_EXTENSIONS.some((ext) => entry.toLowerCase().endsWith(ext))) {
@@ -35653,7 +35815,7 @@ async function runKnowledgeCompose(req, ai, physicRoot) {
 import { readFile as readFile3, writeFile as writeFile2, chmod } from "fs/promises";
 import { readFileSync as readFileSync13 } from "fs";
 import { execFile as execFile3, spawn as spawn7 } from "child_process";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 import { promisify as promisify3 } from "util";
 var run3 = promisify3(execFile3);
 var SETTINGS_REL = ".claude/.autonomous.settings.json";
@@ -35685,7 +35847,7 @@ function parseJson(text) {
   }
 }
 function tickScript(root) {
-  return join13(root, TICK_REL);
+  return join14(root, TICK_REL);
 }
 async function crontabList() {
   try {
@@ -35708,8 +35870,8 @@ async function cronInstalled(root) {
   return (await crontabList()).split("\n").some((l) => l.includes(script) && !l.trim().startsWith("#"));
 }
 async function getAutonomousStatus(root) {
-  const settings = parseJson(await readText(join13(root, SETTINGS_REL))) ?? {};
-  const hist = parseJson(await readText(join13(root, HISTORIES_REL))) ?? {};
+  const settings = parseJson(await readText(join14(root, SETTINGS_REL))) ?? {};
+  const hist = parseJson(await readText(join14(root, HISTORIES_REL))) ?? {};
   const records = Array.isArray(hist.records) ? hist.records : [];
   const last = records[records.length - 1];
   const ticks = hist.ticks ?? {};
@@ -35726,9 +35888,9 @@ async function getAutonomousStatus(root) {
 }
 function isAutonomousRunning(root) {
   try {
-    const s = JSON.parse(readFileSync13(join13(root, SETTINGS_REL), "utf8"));
+    const s = JSON.parse(readFileSync13(join14(root, SETTINGS_REL), "utf8"));
     if (s.paused === true) return false;
-    const h = JSON.parse(readFileSync13(join13(root, HISTORIES_REL), "utf8"));
+    const h = JSON.parse(readFileSync13(join14(root, HISTORIES_REL), "utf8"));
     const ts = h.records?.[h.records.length - 1]?.ts;
     if (!ts) return false;
     const t = Date.parse(ts.replace(" ", "T"));
@@ -35739,10 +35901,10 @@ function isAutonomousRunning(root) {
 }
 async function readAutonomous(root) {
   const [settings, approvals, status, ...books] = await Promise.all([
-    readText(join13(root, SETTINGS_REL)),
-    readText(join13(root, APPROVALS_REL), "{}"),
+    readText(join14(root, SETTINGS_REL)),
+    readText(join14(root, APPROVALS_REL), "{}"),
     getAutonomousStatus(root),
-    ...Object.values(BOOK_FILES).map((f) => readText(join13(root, f)))
+    ...Object.values(BOOK_FILES).map((f) => readText(join14(root, f)))
   ]);
   const keys = Object.keys(BOOK_FILES);
   const bookMap = {};
@@ -35751,7 +35913,7 @@ async function readAutonomous(root) {
 }
 async function readAutonomousLogs(root, date) {
   const day = date && /^\d{4}-\d{2}-\d{2}$/.test(date) ? date : (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const text = await readText(join13(root, LOG_DIR_REL, `autonomous-tick-${day}.log`));
+  const text = await readText(join14(root, LOG_DIR_REL, `autonomous-tick-${day}.log`));
   const lines = text ? text.split("\n").filter((l) => l.length > 0).slice(-500) : [];
   return { date: day, lines };
 }
@@ -35775,24 +35937,24 @@ async function writeAutonomous(root, req, by) {
     switch (req.kind) {
       case "settings": {
         if (!parseJson(req.settings)) return { ok: false, error: "settings is not valid JSON" };
-        await writeFile2(join13(root, SETTINGS_REL), req.settings, "utf8");
+        await writeFile2(join14(root, SETTINGS_REL), req.settings, "utf8");
         break;
       }
       case "approvals": {
-        const map = parseJson(await readText(join13(root, APPROVALS_REL), "{}")) ?? {};
+        const map = parseJson(await readText(join14(root, APPROVALS_REL), "{}")) ?? {};
         if (req.approved) map[req.taskId] = { approved: true, by, at: (/* @__PURE__ */ new Date()).toISOString() };
         else delete map[req.taskId];
-        await writeFile2(join13(root, APPROVALS_REL), JSON.stringify(map, null, 2) + "\n", "utf8");
+        await writeFile2(join14(root, APPROVALS_REL), JSON.stringify(map, null, 2) + "\n", "utf8");
         break;
       }
       case "userTodo": {
-        const cur = await readText(join13(root, BOOK_FILES.userTodo));
+        const cur = await readText(join14(root, BOOK_FILES.userTodo));
         const block = `
 
 > posted by ${by} at ${(/* @__PURE__ */ new Date()).toISOString()}
 ${req.content.trim()}
 `;
-        await writeFile2(join13(root, BOOK_FILES.userTodo), cur.trimEnd() + block, "utf8");
+        await writeFile2(join14(root, BOOK_FILES.userTodo), cur.trimEnd() + block, "utf8");
         break;
       }
       case "cron": {
@@ -35809,7 +35971,7 @@ ${req.content.trim()}
 
 // src/core/agents.ts
 import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir3, readdir as readdir3, rm } from "fs/promises";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 var AGENTS_REL = ".claude/agents";
 var SKILLS_REL = ".claude/skills";
 var MEMORY_DIRS = /* @__PURE__ */ new Set(["short-memory", "long-memory"]);
@@ -35833,17 +35995,17 @@ async function listAgents(root) {
   const subagents = [];
   const skills = [];
   try {
-    for (const e of await readdir3(join14(root, AGENTS_REL), { withFileTypes: true })) {
+    for (const e of await readdir3(join15(root, AGENTS_REL), { withFileTypes: true })) {
       if (!e.isFile() || !e.name.endsWith(".md") || MEMORY_DIRS.has(e.name)) continue;
-      const fm = frontmatter(await readText2(join14(root, AGENTS_REL, e.name)));
+      const fm = frontmatter(await readText2(join15(root, AGENTS_REL, e.name)));
       subagents.push({ name: e.name.replace(/\.md$/, ""), description: fm.description });
     }
   } catch {
   }
   try {
-    for (const e of await readdir3(join14(root, SKILLS_REL), { withFileTypes: true })) {
+    for (const e of await readdir3(join15(root, SKILLS_REL), { withFileTypes: true })) {
       if (!e.isDirectory()) continue;
-      const fm = frontmatter(await readText2(join14(root, SKILLS_REL, e.name, "SKILL.md")));
+      const fm = frontmatter(await readText2(join15(root, SKILLS_REL, e.name, "SKILL.md")));
       skills.push({ name: e.name, description: fm.description });
     }
   } catch {
@@ -35854,15 +36016,15 @@ async function listAgents(root) {
 }
 function itemPath(root, kind, name) {
   const n = safeName(name);
-  return kind === "subagent" ? join14(root, AGENTS_REL, `${n}.md`) : join14(root, SKILLS_REL, n, "SKILL.md");
+  return kind === "subagent" ? join15(root, AGENTS_REL, `${n}.md`) : join15(root, SKILLS_REL, n, "SKILL.md");
 }
 async function readAgent(root, kind, name) {
   const content = await readText2(itemPath(root, kind, name));
   if (kind !== "subagent") return { content };
   const n = safeName(name);
   const [short, long] = await Promise.all([
-    readText2(join14(root, AGENTS_REL, "short-memory", `${n}.md`)),
-    readText2(join14(root, AGENTS_REL, "long-memory", `${n}.md`))
+    readText2(join15(root, AGENTS_REL, "short-memory", `${n}.md`)),
+    readText2(join15(root, AGENTS_REL, "long-memory", `${n}.md`))
   ]);
   return { content, memory: { short, long } };
 }
@@ -35872,12 +36034,12 @@ async function writeAgent(root, req) {
   try {
     if (req.action === "delete") {
       if (req.kind === "subagent") await rm(itemPath(root, "subagent", n), { force: true });
-      else await rm(join14(root, SKILLS_REL, n), { recursive: true, force: true });
+      else await rm(join15(root, SKILLS_REL, n), { recursive: true, force: true });
       return { ok: true };
     }
     if (req.content === void 0) return { ok: false, error: "content is required" };
     const path = itemPath(root, req.kind, n);
-    await mkdir3(join14(path, ".."), { recursive: true });
+    await mkdir3(join15(path, ".."), { recursive: true });
     await writeFile3(path, req.content, "utf8");
     return { ok: true };
   } catch (err) {
@@ -35888,7 +36050,7 @@ async function writeAgent(root, req) {
 // src/core/packages.ts
 import { createHash as createHash4 } from "crypto";
 import { readFile as readFile5, writeFile as writeFile4, mkdir as mkdir4, readdir as readdir4, rm as rm2, stat } from "fs/promises";
-import { dirname as dirname4, join as join15, relative } from "path";
+import { dirname as dirname4, join as join16, relative } from "path";
 var AGENTS_REL2 = ".claude/agents";
 var SKILLS_REL2 = ".claude/skills";
 var MANIFEST_REL = ".claude/.4pm-packages.json";
@@ -35912,7 +36074,7 @@ async function listFilesRel(dir2) {
       return;
     }
     for (const e of entries2) {
-      const full = join15(d, e.name);
+      const full = join16(d, e.name);
       if (e.isDirectory()) await walk2(full);
       else if (e.isFile()) out.push(relative(dir2, full));
     }
@@ -35923,16 +36085,16 @@ async function listFilesRel(dir2) {
 async function readArtifactFiles(root, kind, slug) {
   const files = [];
   if (kind === "subagent") {
-    const agent = await readMaybe(join15(root, AGENTS_REL2, `${slug}.md`));
+    const agent = await readMaybe(join16(root, AGENTS_REL2, `${slug}.md`));
     if (agent) files.push({ path: "agent.md", contentBase64: agent.toString("base64") });
-    const short = await readMaybe(join15(root, AGENTS_REL2, "short-memory", `${slug}.md`));
+    const short = await readMaybe(join16(root, AGENTS_REL2, "short-memory", `${slug}.md`));
     if (short) files.push({ path: "short-memory.md", contentBase64: short.toString("base64") });
-    const long = await readMaybe(join15(root, AGENTS_REL2, "long-memory", `${slug}.md`));
+    const long = await readMaybe(join16(root, AGENTS_REL2, "long-memory", `${slug}.md`));
     if (long) files.push({ path: "long-memory.md", contentBase64: long.toString("base64") });
   } else {
-    const base = join15(root, SKILLS_REL2, slug);
+    const base = join16(root, SKILLS_REL2, slug);
     for (const rel of await listFilesRel(base)) {
-      const buf = await readMaybe(join15(base, rel));
+      const buf = await readMaybe(join16(base, rel));
       if (buf) files.push({ path: rel.split("\\").join("/"), contentBase64: buf.toString("base64") });
     }
   }
@@ -35950,7 +36112,7 @@ async function artifactSha256(root, kind, slug) {
   return h.digest("hex");
 }
 async function artifactExists(root, kind, slug) {
-  const target = kind === "subagent" ? join15(root, AGENTS_REL2, `${slug}.md`) : join15(root, SKILLS_REL2, slug);
+  const target = kind === "subagent" ? join16(root, AGENTS_REL2, `${slug}.md`) : join16(root, SKILLS_REL2, slug);
   try {
     await stat(target);
     return true;
@@ -35959,7 +36121,7 @@ async function artifactExists(root, kind, slug) {
   }
 }
 async function readManifest(root) {
-  const buf = await readMaybe(join15(root, MANIFEST_REL));
+  const buf = await readMaybe(join16(root, MANIFEST_REL));
   if (!buf) return {};
   try {
     return JSON.parse(buf.toString("utf8"));
@@ -35968,7 +36130,7 @@ async function readManifest(root) {
   }
 }
 async function writeManifest(root, manifest) {
-  const path = join15(root, MANIFEST_REL);
+  const path = join16(root, MANIFEST_REL);
   await mkdir4(dirname4(path), { recursive: true });
   await writeFile4(path, JSON.stringify(manifest, null, 2), "utf8");
 }
@@ -35977,24 +36139,24 @@ async function writeArtifactFiles(root, kind, slug, files) {
   if (kind === "subagent") {
     const agent = byPath.get("agent.md");
     if (agent) {
-      await mkdir4(join15(root, AGENTS_REL2), { recursive: true });
-      await writeFile4(join15(root, AGENTS_REL2, `${slug}.md`), agent);
+      await mkdir4(join16(root, AGENTS_REL2), { recursive: true });
+      await writeFile4(join16(root, AGENTS_REL2, `${slug}.md`), agent);
     }
     const short = byPath.get("short-memory.md");
     if (short) {
-      await mkdir4(join15(root, AGENTS_REL2, "short-memory"), { recursive: true });
-      await writeFile4(join15(root, AGENTS_REL2, "short-memory", `${slug}.md`), short);
+      await mkdir4(join16(root, AGENTS_REL2, "short-memory"), { recursive: true });
+      await writeFile4(join16(root, AGENTS_REL2, "short-memory", `${slug}.md`), short);
     }
     const long = byPath.get("long-memory.md");
     if (long) {
-      await mkdir4(join15(root, AGENTS_REL2, "long-memory"), { recursive: true });
-      await writeFile4(join15(root, AGENTS_REL2, "long-memory", `${slug}.md`), long);
+      await mkdir4(join16(root, AGENTS_REL2, "long-memory"), { recursive: true });
+      await writeFile4(join16(root, AGENTS_REL2, "long-memory", `${slug}.md`), long);
     }
   } else {
-    const base = join15(root, SKILLS_REL2, slug);
+    const base = join16(root, SKILLS_REL2, slug);
     for (const [rel, buf] of byPath) {
       if (rel.includes("..") || rel.startsWith("/")) continue;
-      const dest = join15(base, rel);
+      const dest = join16(base, rel);
       await mkdir4(dirname4(dest), { recursive: true });
       await writeFile4(dest, buf);
     }
@@ -36060,11 +36222,11 @@ async function removePackage(root, slug) {
     const entry = manifest[n];
     if (!entry) return { ok: false, error: "not installed" };
     if (entry.kind === "subagent") {
-      await rm2(join15(root, AGENTS_REL2, `${n}.md`), { force: true });
-      await rm2(join15(root, AGENTS_REL2, "short-memory", `${n}.md`), { force: true });
-      await rm2(join15(root, AGENTS_REL2, "long-memory", `${n}.md`), { force: true });
+      await rm2(join16(root, AGENTS_REL2, `${n}.md`), { force: true });
+      await rm2(join16(root, AGENTS_REL2, "short-memory", `${n}.md`), { force: true });
+      await rm2(join16(root, AGENTS_REL2, "long-memory", `${n}.md`), { force: true });
     } else {
-      await rm2(join15(root, SKILLS_REL2, n), { recursive: true, force: true });
+      await rm2(join16(root, SKILLS_REL2, n), { recursive: true, force: true });
     }
     delete manifest[n];
     await writeManifest(root, manifest);
@@ -36075,7 +36237,7 @@ async function removePackage(root, slug) {
 }
 
 // src/core/network-probe.ts
-import { existsSync as existsSync9, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync14 } from "fs";
 import { connect } from "net";
 var CANARY_TARGETS = [
   { host: "1.1.1.1", port: 443 },
@@ -36084,7 +36246,7 @@ var CANARY_TARGETS = [
 var PROBE_TIMEOUT_MS = 2500;
 function detectContainerized() {
   try {
-    if (existsSync9("/.dockerenv")) return true;
+    if (existsSync10("/.dockerenv")) return true;
     const cgroup = readFileSync14("/proc/1/cgroup", "utf8");
     return /docker|containerd|kubepods|libpod/.test(cgroup);
   } catch {
@@ -36152,9 +36314,9 @@ async function probeNetwork() {
 }
 
 // src/core/git-auth.ts
-import { writeFileSync as writeFileSync6 } from "fs";
+import { writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 function tokenTarget(method) {
   if (method === "gitlab-group-token") {
     return { host: process.env.FOURPM_GIT_HOST || "gitlab.com", user: "oauth2" };
@@ -36172,7 +36334,7 @@ function applyGitAuth(method) {
   try {
     const line = `https://${target.user}:${token}@${target.host}
 `;
-    writeFileSync6(join16(homedir4(), ".git-credentials"), line, { encoding: "utf8", mode: 384 });
+    writeFileSync7(join17(homedir4(), ".git-credentials"), line, { encoding: "utf8", mode: 384 });
     return true;
   } catch {
     return false;
@@ -36181,7 +36343,7 @@ function applyGitAuth(method) {
 
 // src/core/secrets.ts
 import { readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 var SECURITY_REL = "AI_SECURITY.md";
 var PLACEHOLDER_REL = "AI_PLACEHOLDER.md";
 var SECRETS_REL = "project.secrets.json";
@@ -36194,7 +36356,7 @@ async function readText3(path, fallback = "") {
 }
 async function readSecretsObject(root) {
   try {
-    const v = JSON.parse(await readFile6(join17(root, SECRETS_REL), "utf8"));
+    const v = JSON.parse(await readFile6(join18(root, SECRETS_REL), "utf8"));
     return v && typeof v === "object" ? v : {};
   } catch {
     return {};
@@ -36213,8 +36375,8 @@ function placeholderKeys(text) {
 }
 async function readSecrets(root) {
   const [security, placeholder, secrets] = await Promise.all([
-    readText3(join17(root, SECURITY_REL)),
-    readText3(join17(root, PLACEHOLDER_REL)),
+    readText3(join18(root, SECURITY_REL)),
+    readText3(join18(root, PLACEHOLDER_REL)),
     readSecretsObject(root)
   ]);
   const names = /* @__PURE__ */ new Set([...placeholderKeys(placeholder), ...Object.keys(secrets)]);
@@ -36227,14 +36389,14 @@ async function readSecrets(root) {
 async function writeSecrets(root, req) {
   try {
     if (req.kind === "security") {
-      await writeFile5(join17(root, SECURITY_REL), req.content, "utf8");
+      await writeFile5(join18(root, SECURITY_REL), req.content, "utf8");
     } else if (req.kind === "placeholder") {
-      await writeFile5(join17(root, PLACEHOLDER_REL), req.content, "utf8");
+      await writeFile5(join18(root, PLACEHOLDER_REL), req.content, "utf8");
     } else {
       const secrets = await readSecretsObject(root);
       if (req.kind === "secret") secrets[req.key] = req.value;
       else delete secrets[req.key];
-      await writeFile5(join17(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
+      await writeFile5(join18(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
     }
     return { ok: true };
   } catch (err) {
@@ -36244,13 +36406,13 @@ async function writeSecrets(root, req) {
 
 // src/core/agent-tools.ts
 import { readFile as readFile7, writeFile as writeFile6, mkdir as mkdir5 } from "fs/promises";
-import { dirname as dirname5, join as join18 } from "path";
+import { dirname as dirname5, join as join19 } from "path";
 var SHARED_REL = ".claude/settings.json";
 var LOCAL_REL = ".claude/settings.local.json";
 var SECRETS_DENY = "Read(./project.secrets.json)";
 var MODES = ["default", "acceptEdits", "plan", "bypassPermissions"];
 function fileFor(root, scope) {
-  return join18(root, scope === "shared" ? SHARED_REL : LOCAL_REL);
+  return join19(root, scope === "shared" ? SHARED_REL : LOCAL_REL);
 }
 async function readSettingsObject(path) {
   try {
@@ -36287,7 +36449,7 @@ async function writeAgentTools(root, scope, permissions) {
 
 // src/core/graph.ts
 import { readFile as readFile8, readdir as readdir5 } from "fs/promises";
-import { join as join19, relative as relative2, dirname as dirname6, resolve as resolve4, extname, basename as basename2 } from "path";
+import { join as join20, relative as relative2, dirname as dirname6, resolve as resolve4, extname, basename as basename2 } from "path";
 var MAX_FILES = 2e3;
 var MAX_NODES = 3e3;
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "out", "coverage", ".turbo"]);
@@ -36307,7 +36469,7 @@ async function walk(root, accept) {
       if (e.name.startsWith(".") && e.name !== ".claude") {
         if (e.isDirectory()) continue;
       }
-      const full = join19(dir2, e.name);
+      const full = join20(dir2, e.name);
       if (e.isDirectory()) {
         if (!SKIP_DIRS.has(e.name)) stack.push(full);
       } else if (accept(full)) {
@@ -36427,10 +36589,10 @@ async function buildGraph(root, mode) {
 
 // src/core/rag.ts
 import { readFile as readFile9, writeFile as writeFile7, statfs as statfs2, mkdir as mkdir6 } from "fs/promises";
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 import { execFile as execFile4, spawn as spawn8 } from "child_process";
 import { totalmem as totalmem2, cpus as cpus2 } from "os";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 import { promisify as promisify4 } from "util";
 var run4 = promisify4(execFile4);
 var RAG_REL = ".claude/rag";
@@ -36451,7 +36613,7 @@ async function detectPython() {
 }
 async function installLog(root) {
   try {
-    const text = await readFile9(join20(root, RAG_REL, "install.log"), "utf8");
+    const text = await readFile9(join21(root, RAG_REL, "install.log"), "utf8");
     return text.split("\n").filter((l) => l.length > 0).slice(-200);
   } catch {
     return [];
@@ -36513,14 +36675,14 @@ async function ragStatus(root) {
   };
   let modelName = "";
   try {
-    modelName = (await readFile9(join20(root, RAG_REL, ".installed"), "utf8")).trim();
+    modelName = (await readFile9(join21(root, RAG_REL, ".installed"), "utf8")).trim();
   } catch {
     modelName = "";
   }
   const modelPresent = modelName.length > 0;
   return {
     installed: fastembed && sqliteVec && modelPresent,
-    installing: existsSync10(join20(root, RAG_REL, ".installing")),
+    installing: existsSync11(join21(root, RAG_REL, ".installing")),
     python: { found: py.found, version: py.version },
     deps: { pip, fastembed, sqliteVec },
     model: { present: modelPresent, name: modelName },
@@ -36531,9 +36693,9 @@ async function ragStatus(root) {
   };
 }
 async function readIndexMeta(root) {
-  const indexing = existsSync10(join20(root, RAG_REL, ".indexing"));
+  const indexing = existsSync11(join21(root, RAG_REL, ".indexing"));
   try {
-    const m = JSON.parse(await readFile9(join20(root, RAG_REL, ".index.json"), "utf8"));
+    const m = JSON.parse(await readFile9(join21(root, RAG_REL, ".index.json"), "utf8"));
     return {
       present: true,
       indexing,
@@ -36600,14 +36762,14 @@ if __name__ == "__main__":
     elif cmd == "query": query(sys.argv[2], int(sys.argv[3]) if len(sys.argv) > 3 else 8)
 `;
 async function ensureEngine(root) {
-  await mkdir6(join20(root, RAG_REL), { recursive: true }).catch(() => void 0);
-  await writeFile7(join20(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
+  await mkdir6(join21(root, RAG_REL), { recursive: true }).catch(() => void 0);
+  await writeFile7(join21(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
 }
 async function ragReindex(root) {
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found" };
-  if (!existsSync10(join20(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
-  if (existsSync10(join20(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
+  if (!existsSync11(join21(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
+  if (existsSync11(join21(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
   await ensureEngine(root);
   const script = `
 set +e
@@ -36627,12 +36789,12 @@ rm -f "${RAG_REL}/.indexing"
 async function ragQuery(root, queryText, k = 8) {
   const py = await detectPython();
   if (!py.found) return { results: [], error: "python3 not found" };
-  if (!existsSync10(join20(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
+  if (!existsSync11(join21(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
   await ensureEngine(root);
   try {
     const { stdout } = await run4(
       py.bin,
-      [join20(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k, 1), 20))],
+      [join21(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k, 1), 20))],
       { cwd: root, timeout: 3e4, maxBuffer: 4 * 1024 * 1024 }
     );
     const parsed = JSON.parse(stdout.trim() || '{"results":[]}');
@@ -36647,9 +36809,9 @@ async function ragInstall(root, model) {
   }
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found on the worker" };
-  if (existsSync10(join20(root, RAG_REL, ".installing"))) return { ok: true, started: true };
+  if (existsSync11(join21(root, RAG_REL, ".installing"))) return { ok: true, started: true };
   try {
-    await mkdir6(join20(root, RAG_REL), { recursive: true });
+    await mkdir6(join21(root, RAG_REL), { recursive: true });
   } catch {
   }
   const script = `
@@ -36737,12 +36899,12 @@ ${stderr}`;
 // src/core/git-ssh-key.ts
 import { execFile as execFile7 } from "child_process";
 import { readFile as readFile11, rm as rm3, mkdir as mkdir7 } from "fs/promises";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 import { promisify as promisify7 } from "util";
 var run7 = promisify7(execFile7);
 function keyPaths(profileDir2) {
-  const dir2 = join21(profileDir2, ".ssh");
-  const key = join21(dir2, "id_4pm");
+  const dir2 = join22(profileDir2, ".ssh");
+  const key = join22(dir2, "id_4pm");
   return { dir: dir2, key, pub: `${key}.pub` };
 }
 async function readPublicKey(pub) {
@@ -36934,7 +37096,7 @@ async function setCommitAuthor(cwd2, machineUsername) {
 // src/core/scaffold.ts
 import { cp, mkdir as mkdir8, writeFile as writeFile8 } from "fs/promises";
 import { execFile as execFile10 } from "child_process";
-import { dirname as dirname8, join as join22, resolve as resolve7 } from "path";
+import { dirname as dirname8, join as join23, resolve as resolve7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { promisify as promisify10 } from "util";
 var run10 = promisify10(execFile10);
@@ -36963,7 +37125,7 @@ async function provisionRepos(target, repos, emit, opts = {}) {
       }
       continue;
     }
-    const dir2 = join22(target, subDirName(repo));
+    const dir2 = join23(target, subDirName(repo));
     if (repo.url) {
       emit("git", `Cloning sub-repo ${repo.url}\u2026`);
       await run10("git", ["clone", repo.url, dir2], { timeout: 12e4 });
@@ -36983,14 +37145,14 @@ async function scaffoldProject(payload, profileDir2, onProgress) {
   const emit = (step, message) => onProgress?.({ projectId: payload.projectId, step, message });
   try {
     const root = process.env.SCAFFOLD_ROOT ? resolve7(process.env.SCAFFOLD_ROOT) : resolve7(profileDir2);
-    const target = join22(root, payload.projectName);
+    const target = join23(root, payload.projectName);
     await mkdir8(target, { recursive: true });
     emit("copy", "Copying the sample template\u2026");
     await cp(sampleDir(), target, { recursive: true, force: false, errorOnExist: false });
     if (payload.spec) {
       emit("spec", "Writing project.spec.json\u2026");
       await writeFile8(
-        join22(target, "project.spec.json"),
+        join23(target, "project.spec.json"),
         JSON.stringify(payload.spec, null, 2),
         "utf8"
       );
@@ -37008,7 +37170,7 @@ async function aiInit(target, spec, emit) {
   emit("ai-init", "AI init: subagents, README, CLAUDE.md\u2026");
   const subagents = Array.isArray(spec.subagents) ? spec.subagents : [];
   if (subagents.length > 0) {
-    await mkdir8(join22(target, ".claude", "agents"), { recursive: true });
+    await mkdir8(join23(target, ".claude", "agents"), { recursive: true });
     for (const sa of subagents) {
       const name = (sa.name || "").trim().replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "");
       if (!name) continue;
@@ -37018,17 +37180,17 @@ name: ${name}
 
 ${(sa.description || "").trim()}
 `;
-      await writeFile8(join22(target, ".claude", "agents", `${name}.md`), body, "utf8");
+      await writeFile8(join23(target, ".claude", "agents", `${name}.md`), body, "utf8");
     }
   }
   const specJson = JSON.stringify(spec);
   await generateFile(
-    join22(target, "README.md"),
+    join23(target, "README.md"),
     `Write a concise README.md (Markdown only, no preamble) for this project from its spec JSON:
 ${specJson}`
   );
   await generateFile(
-    join22(target, "CLAUDE.md"),
+    join23(target, "CLAUDE.md"),
     `Write a CLAUDE.md (Markdown only, no preamble) with guidance/conventions for AI agents working in this project, derived from its spec JSON:
 ${specJson}`
   );
@@ -37044,7 +37206,7 @@ async function addProject(payload, profileDir2, onProgress) {
   const emit = (step, message) => onProgress?.({ projectId: payload.projectId, step, message });
   try {
     const root = process.env.SCAFFOLD_ROOT ? resolve7(process.env.SCAFFOLD_ROOT) : resolve7(profileDir2);
-    const target = join22(root, payload.projectName);
+    const target = join23(root, payload.projectName);
     await mkdir8(target, { recursive: true });
     const repos = payload.repos ?? [];
     if (repos.length > 0) await provisionRepos(target, repos, emit, { clonePrimary: true });
@@ -37056,8 +37218,8 @@ async function addProject(payload, profileDir2, onProgress) {
 }
 
 // src/ui/slash-commands.ts
-import { existsSync as existsSync11 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { join as join24 } from "path";
 var CONFIG_KEYS = [
   "aiCli",
   "claudeHome",
@@ -37069,7 +37231,7 @@ var CONFIG_KEYS = [
   "aiEnv"
 ];
 function configPath(profileDir2) {
-  return join23(profileDir2, "config.json");
+  return join24(profileDir2, "config.json");
 }
 function parseConfigAssignment(key, valueTokens) {
   const value = valueTokens.join(" ").trim();
@@ -37119,7 +37281,7 @@ function runConfig(ctx) {
       ctx.print(`\u2714 ${verb} default config: ${path}`);
       ctx.print("add claude profiles: /config set claudeHome .claude .claude-1 (tried in order)");
     };
-    if (existsSync11(path)) {
+    if (existsSync12(path)) {
       ctx.confirm(
         `config exists: ${path} \u2014 replace it with defaults? (y/N)`,
         () => writeDefaults("replaced with")
@@ -37204,7 +37366,7 @@ function runOutput(ctx) {
 }
 function runLogs(ctx) {
   const n = Math.max(1, Math.min(200, Number(ctx.args[0]) || 20));
-  const dir2 = join23(ctx.info.profileDir, "logs");
+  const dir2 = join24(ctx.info.profileDir, "logs");
   const lines = readRecentLogLines(dir2, n);
   if (lines.length === 0) {
     ctx.print("No log lines yet.");
@@ -37517,8 +37679,8 @@ async function runMemoryCompaction(ai, cwd2, input) {
 }
 
 // src/core/config-sync.ts
-import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync15 } from "fs";
+import { join as join25 } from "path";
 var SERVER_MANAGED_KEYS = [
   "physicPath",
   "sessionSwitchPct",
@@ -37535,8 +37697,8 @@ var SERVER_MANAGED_KEYS = [
   "projectAiMemoryBudgetChars"
 ];
 function readConfigText(profileDir2) {
-  const path = join24(profileDir2, "config.json");
-  if (existsSync12(path)) {
+  const path = join25(profileDir2, "config.json");
+  if (existsSync13(path)) {
     try {
       return readFileSync15(path, "utf8");
     } catch {
@@ -37606,8 +37768,9 @@ var WsClient = class {
       context.credential.serverUrl,
       context.profileDir,
       context.bus,
-      // After the idle daily tick updates flagged tools, report the fresh snapshot (ADR-0254).
-      () => void this.reportWorkerTools()
+      // After the idle daily tick updates flagged tools, report the fresh snapshot (ADR-0254). The
+      // `daily` trigger lets the server re-drive a still-failing restore on this spaced tick (ADR-0258).
+      () => void this.reportWorkerTools("daily")
     );
     context.bus.onLocalSubmit((input) => void this.runLocalCommand(input));
     context.bus.onReconnect(() => this.reconnectNow());
@@ -37727,13 +37890,21 @@ var WsClient = class {
   /**
    * Detect the worker's tools and report the snapshot to the server (ADR-0254, `tools.report`) so the
    * DB-backed Tools panel + restore target stay current. One-way, best-effort — a detect/send failure
-   * never disrupts the session. Called after each tool op, after the daily tick, and after a restore.
+   * never disrupts the session. Called after each tool op (`op`), after the daily tick (`daily`), and
+   * after a restore reconcile (`boot`/`manual`). `trigger` gates the server re-drive (ADR-0258: only
+   * `daily` re-drives a still-failing restore); `restoreFailed` is passed only after a reconcile — a
+   * plain `op`/`daily` report omits it so the server preserves the last known failed set.
    */
-  async reportWorkerTools() {
+  async reportWorkerTools(trigger = "op", restoreFailed) {
     try {
       const autoUpdate = readProfileConfig(this.context.profileDir).autoUpdateTools ?? [];
       const { catalog, extras } = await detectWorkerTools(autoUpdate);
-      this.send(WsChannels.TOOLS_REPORT, { catalog, extras });
+      this.send(WsChannels.TOOLS_REPORT, {
+        catalog,
+        extras,
+        trigger,
+        ...restoreFailed !== void 0 ? { restoreFailed } : {}
+      });
     } catch (err) {
       logger.warn("tools.report.error", { error: String(err) });
     }
@@ -37879,6 +38050,7 @@ var WsClient = class {
           pruneCommandHistoryByAge(token.cliRetentionDays);
           pruneCommandOutputByAge(token.cliRetentionDays);
         }
+        if (this.physicRoot) sweepOldAttachments(this.physicRoot);
         writeProfileConfig(this.context.profileDir, {
           sessionSwitchPct: token.projectTokens?.sessionSwitchPct ?? 0,
           perPromptTokenLimit: token.projectTokens?.perPromptTokenLimit ?? 0,
@@ -38047,8 +38219,8 @@ var WsClient = class {
           const oldRoot = this.physicFolderPath(sync.oldName);
           if (oldRoot) void uninstallCron(oldRoot).catch(() => void 0);
         }
-        if (sync.oldName) rmSync4(join25(this.context.profileDir, sync.oldName), { recursive: true, force: true });
-        mkdirSync5(join25(this.context.profileDir, sync.newName), { recursive: true });
+        if (sync.oldName) rmSync5(join26(this.context.profileDir, sync.oldName), { recursive: true, force: true });
+        mkdirSync6(join26(this.context.profileDir, sync.newName), { recursive: true });
         this.physicRoot = this.physicFolderPath(sync.newName);
         this.bus.setProject(sync.newName);
         this.bus.log(`Physic project folder synced \u2192 ${sync.newName}`);
@@ -38059,7 +38231,7 @@ var WsClient = class {
         if (del.name) {
           const delRoot = this.physicFolderPath(del.name);
           if (delRoot) void uninstallCron(delRoot).catch(() => void 0);
-          rmSync4(join25(this.context.profileDir, del.name), { recursive: true, force: true });
+          rmSync5(join26(this.context.profileDir, del.name), { recursive: true, force: true });
           this.bus.log(`Physic project folder deleted (project removed) \u2192 ${del.name}`);
         }
         void manageSshKey("delete", this.context.profileDir).catch(() => void 0);
@@ -38067,6 +38239,23 @@ var WsClient = class {
         this.physicRoot = null;
         break;
       }
+      case WsChannels.PROJECT_TOKENS: {
+        const tokens = payload;
+        writeProfileConfig(this.context.profileDir, {
+          sessionSwitchPct: tokens.sessionSwitchPct ?? 0,
+          perPromptTokenLimit: tokens.perPromptTokenLimit ?? 0,
+          projectAiRunTimeoutSec: tokens.aiRunTimeoutSec ?? 0,
+          projectAutoClearIdleMinutes: tokens.autoClearIdleMinutes ?? 0,
+          projectAiMemoryMode: tokens.memory?.mode ?? "inherit",
+          projectAiMemoryBudgetChars: tokens.memory?.budgetChars ?? 0
+        });
+        this.restrictToFolder = tokens.restrictToFolder === true;
+        logger.info("project.tokens.applied", {
+          aiRunTimeoutSec: tokens.aiRunTimeoutSec ?? 0,
+          autoClearIdleMinutes: tokens.autoClearIdleMinutes ?? 0
+        });
+        break;
+      }
       case WsChannels.COMMAND_DISPATCH: {
         const dispatch = payload;
         if (this.handledCommands.has(dispatch.commandId)) {
@@ -38083,7 +38272,13 @@ var WsClient = class {
           if (dispatch.cmd.trimStart().startsWith("/")) {
             void this.runWebSlashCommand(dispatch.cmd, dispatch.commandId);
           } else {
-            void this.runAiPrompt(dispatch.cmd, dispatch.commandId, "server", dispatch.aiOneShot ?? false);
+            void this.runAiPrompt(
+              dispatch.cmd,
+              dispatch.commandId,
+              "server",
+              dispatch.aiOneShot ?? false,
+              dispatch.images
+            );
           }
           break;
         }
@@ -38385,11 +38580,15 @@ var WsClient = class {
         const req = payload;
         const op = message.channel === WsChannels.TOOLS_INSTALL ? "install" : message.channel === WsChannels.TOOLS_UPDATE ? "update" : "uninstall";
         this.send(message.channel, { started: true }, message.id);
+        const opTimeoutMs = resolveInstallTimeoutMs(
+          readProfileConfig(this.context.profileDir).toolInstallTimeoutSec
+        );
         void runWorkerToolOp(
           op,
           req.name,
           req.manager,
-          (line) => this.send(WsChannels.TOOLS_PROGRESS, { opId: req.opId, line })
+          (line) => this.send(WsChannels.TOOLS_PROGRESS, { opId: req.opId, line }),
+          opTimeoutMs
         ).then((res) => {
           this.send(WsChannels.TOOLS_DONE, {
             opId: req.opId,
@@ -38403,16 +38602,45 @@ var WsClient = class {
       }
       case WsChannels.TOOLS_RESTORE: {
         const req = payload;
-        void reconcileTools(
-          req.manifest.map((m) => ({ name: m.name, version: m.version, manager: m.manager })),
-          (line) => this.bus.log(line)
-        ).then(() => this.reportWorkerTools()).then(() => this.send(WsChannels.TOOLS_RESTORE, { ok: true }, message.id)).catch(
-          (err) => this.send(
-            WsChannels.TOOLS_RESTORE,
-            { ok: false, error: String(err) },
-            message.id
-          )
+        const restoreTrigger = req.trigger === "manual" ? "manual" : "boot";
+        const installTimeoutMs = resolveInstallTimeoutMs(
+          readProfileConfig(this.context.profileDir).toolInstallTimeoutSec
         );
+        const manifest = req.manifest.map((m) => ({ name: m.name, version: m.version, manager: m.manager }));
+        const opId = req.opId;
+        if (opId) {
+          this.send(WsChannels.TOOLS_RESTORE, { ok: true }, message.id);
+          void reconcileTools(
+            manifest,
+            (line) => {
+              this.bus.log(line);
+              this.send(WsChannels.TOOLS_PROGRESS, { opId, line });
+            },
+            installTimeoutMs
+          ).then(async (restoreFailed) => {
+            this.send(WsChannels.TOOLS_DONE, {
+              opId,
+              ok: restoreFailed.length === 0,
+              exitCode: restoreFailed.length === 0 ? 0 : 1
+            });
+            await this.reportWorkerTools(restoreTrigger, restoreFailed);
+          }).catch(
+            (err) => this.send(WsChannels.TOOLS_DONE, {
+              opId,
+              ok: false,
+              exitCode: 1,
+              error: String(err)
+            })
+          );
+        } else {
+          void reconcileTools(manifest, (line) => this.bus.log(line), installTimeoutMs).then((restoreFailed) => this.reportWorkerTools(restoreTrigger, restoreFailed)).then(() => this.send(WsChannels.TOOLS_RESTORE, { ok: true }, message.id)).catch(
+            (err) => this.send(
+              WsChannels.TOOLS_RESTORE,
+              { ok: false, error: String(err) },
+              message.id
+            )
+          );
+        }
         break;
       }
       case WsChannels.GIT_DIFF:
@@ -38460,7 +38688,7 @@ var WsClient = class {
       }
       case WsChannels.LOG_READ: {
         const limit = Math.min(Math.max(payload.limit ?? 200, 1), 2e3);
-        const lines = readRecentLogLines(join25(this.context.profileDir, "logs"), limit);
+        const lines = readRecentLogLines(join26(this.context.profileDir, "logs"), limit);
         this.send(WsChannels.LOG_READ, { lines }, message.id);
         break;
       }
@@ -38539,7 +38767,7 @@ var WsClient = class {
    * exactly like typing the prompt in the cli (tries profiles, meters real tokens) instead
    * of spawning the text as a raw command. Streams output to the transcript AND the server.
    */
-  async runAiPrompt(prompt, commandId, origin, oneShot = false) {
+  async runAiPrompt(prompt, commandId, origin, oneShot = false, images) {
     const config = readProfileConfig(this.context.profileDir);
     const projectTimeoutSec = config.projectAiRunTimeoutSec ?? 0;
     const machineTimeoutSec = config.aiRunTimeoutSec ?? 0;
@@ -38597,7 +38825,18 @@ var WsClient = class {
         text: `session ${this.usageSnapshot?.session.utilizationPct ?? 0}% \u2265 ${config.sessionSwitchPct}% \u2014 switching to Claude profile "${labelFromCredentialKey(startCred)}"`
       });
     }
-    const guardedPrompt = this.restrictToFolder && this.physicRoot ? folderScopeGuard(this.physicRoot, prompt) : prompt;
+    if (this.physicRoot) sweepOldAttachments(this.physicRoot);
+    let aiBodyPrompt = prompt;
+    if (images?.length && this.physicRoot && !oneShot) {
+      const paths = await materializeImages(
+        this.physicRoot,
+        commandId,
+        images,
+        (imageId) => this.imageFetch(commandId, imageId)
+      );
+      if (paths.size) aiBodyPrompt = rewriteImagePlaceholders(prompt, paths);
+    }
+    const guardedPrompt = this.restrictToFolder && this.physicRoot ? folderScopeGuard(this.physicRoot, aiBodyPrompt) : aiBodyPrompt;
     const hint = unified ? { credential: startCred ?? workingCred } : { dir: startDir ?? workingDir };
     const memCfg = resolveMemoryConfig(config);
     const firstAttempt = planAiRun(guardedPrompt, config, hint).attempts[0];
@@ -39181,6 +39420,13 @@ ${guardedPrompt}`;
   checkQuota(metric, amount = 1) {
     return this.request(WsChannels.QUOTA_CHECK, { metric, amount });
   }
+  /** Fetch a Console prompt image blob from the server to materialize on the worker (ADR-0257). */
+  imageFetch(commandId, imageId) {
+    return this.request(WsChannels.IMAGE_FETCH, {
+      commandId,
+      imageId
+    });
+  }
   /** usage.report batched to the server (ADR-0020); tags each event with the AI profile. */
   reportUsage(events, profile) {
     const tagged = profile ? events.map((e) => ({ ...e, profile })) : events;
@@ -39218,8 +39464,8 @@ ${guardedPrompt}`;
   /** Create the physic folder at an absolute path if missing (best-effort). */
   ensurePhysicFolderPath(folder) {
     try {
-      if (!existsSync13(folder)) {
-        mkdirSync5(folder, { recursive: true });
+      if (!existsSync14(folder)) {
+        mkdirSync6(folder, { recursive: true });
         this.bus.log(`Created physic project folder: ${folder}`);
       }
     } catch (err) {
@@ -39233,7 +39479,7 @@ ${guardedPrompt}`;
    */
   physicFolderPath(projectName) {
     const safe = projectName.replace(/[/\\]/g, "_").replace(/\.\./g, "_").trim();
-    return safe ? join25(this.context.profileDir, safe) : null;
+    return safe ? join26(this.context.profileDir, safe) : null;
   }
   /**
    * Report machine.status: version + the state of the physic project being served
@@ -39242,14 +39488,19 @@ ${guardedPrompt}`;
   sendMachineStatus() {
     const config = readProfileConfig(this.context.profileDir);
     const physicPath = config.physicPath ?? null;
+    const aiProfileCount = Array.isArray(config.aiProfiles) ? config.aiProfiles.length : (config.claudeHome?.length ?? 0) + (config.codexHome?.length ?? 0) + (config.antigravityHome?.length ?? 0);
     this.send(WsChannels.MACHINE_STATUS, {
       status: "online",
       projects: [],
       version: CLI_VERSION,
       physicPath,
-      physicPathExists: physicPath ? existsSync13(physicPath) : void 0,
+      physicPathExists: physicPath ? existsSync14(physicPath) : void 0,
       // Real coarse state (ADR-0152): !paused and a recent tick (was hard-coded false).
-      autonomousRunning: physicPath ? isAutonomousRunning(physicPath) : false
+      autonomousRunning: physicPath ? isAutonomousRunning(physicPath) : false,
+      // The machine-user AI-run limit (0 = unlimited) + profile count so a dispatch can resolve the
+      // effective timeout and derive the SSE reply windows server-side (ADR-0256).
+      aiRunTimeoutSec: config.aiRunTimeoutSec ?? 0,
+      aiProfileCount
     });
   }
   /** Heartbeat every 30s: ping + periodically re-report machine.status. */
@@ -39337,7 +39588,7 @@ ${guardedPrompt}`;
    */
   uploadLog() {
     try {
-      const upload = readLogUpload(join25(this.context.profileDir, "logs"));
+      const upload = readLogUpload(join26(this.context.profileDir, "logs"));
       if (!upload) return;
       const sig = `${upload.fileName}:${upload.totalBytes}`;
       if (sig === this.lastLogSig) return;
@@ -39365,10 +39616,10 @@ ${guardedPrompt}`;
 };
 
 // src/core/instance-lock.ts
-import { readFileSync as readFileSync16, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
-import { join as join26 } from "path";
+import { readFileSync as readFileSync16, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
+import { join as join27 } from "path";
 function lockPath(profileDir2) {
-  return join26(profileDir2, "start.lock");
+  return join27(profileDir2, "start.lock");
 }
 function isAlive(pid) {
   try {
@@ -39388,13 +39639,13 @@ function lockHolder(profileDir2) {
 }
 function acquireInstanceLock(profileDir2) {
   if (lockHolder(profileDir2) !== null) return false;
-  writeFileSync7(lockPath(profileDir2), String(process.pid), "utf8");
+  writeFileSync8(lockPath(profileDir2), String(process.pid), "utf8");
   return true;
 }
 function releaseInstanceLock(profileDir2) {
   try {
     const pid = Number.parseInt(readFileSync16(lockPath(profileDir2), "utf8").trim(), 10);
-    if (pid === process.pid) rmSync5(lockPath(profileDir2), { force: true });
+    if (pid === process.pid) rmSync6(lockPath(profileDir2), { force: true });
   } catch {
   }
 }
@@ -39667,8 +39918,8 @@ var SessionBus = class {
 
 // src/core/control-server.ts
 import { createServer } from "net";
-import { rmSync as rmSync6 } from "fs";
-import { join as join27 } from "path";
+import { rmSync as rmSync7 } from "fs";
+import { join as join28 } from "path";
 
 // src/core/control-protocol.ts
 var CONTROL_SOCKET_FILE = "control.sock";
@@ -39697,9 +39948,9 @@ function createFrameParser() {
 
 // src/core/control-server.ts
 function startControlServer(bus, profileDir2, info) {
-  const socketPath = join27(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join28(profileDir2, CONTROL_SOCKET_FILE);
   try {
-    rmSync6(socketPath, { force: true });
+    rmSync7(socketPath, { force: true });
   } catch {
   }
   const clients = /* @__PURE__ */ new Set();
@@ -39765,7 +40016,7 @@ function startControlServer(bus, profileDir2, info) {
     clients.clear();
     server.close();
     try {
-      rmSync6(socketPath, { force: true });
+      rmSync7(socketPath, { force: true });
     } catch {
     }
   };
@@ -45428,15 +45679,15 @@ var import_react21 = __toESM(require_react(), 1);
 var import_react26 = __toESM(require_react(), 1);
 
 // src/core/input-history.ts
-import { existsSync as existsSync15, readFileSync as readFileSync18, writeFileSync as writeFileSync8 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync18, writeFileSync as writeFileSync9 } from "fs";
+import { join as join29 } from "path";
 var MAX_HISTORY = 200;
 function historyPath(profileDir2) {
-  return join28(profileDir2, "input-history.json");
+  return join29(profileDir2, "input-history.json");
 }
 function loadInputHistory(profileDir2) {
   const path = historyPath(profileDir2);
-  if (!existsSync15(path)) return [];
+  if (!existsSync16(path)) return [];
   try {
     const data = JSON.parse(readFileSync18(path, "utf8"));
     return Array.isArray(data) ? data.filter((x) => typeof x === "string") : [];
@@ -45449,7 +45700,7 @@ function appendInputHistory(profileDir2, line, current) {
   if (!trimmed || current[current.length - 1] === trimmed) return current;
   const next = [...current, trimmed].slice(-MAX_HISTORY);
   try {
-    writeFileSync8(historyPath(profileDir2), JSON.stringify(next), "utf8");
+    writeFileSync9(historyPath(profileDir2), JSON.stringify(next), "utf8");
   } catch {
   }
   return next;
@@ -46053,7 +46304,7 @@ async function runStart(profileDir2, profileName) {
     return;
   }
   logger.configure({
-    dir: join29(profileDir2, "logs"),
+    dir: join30(profileDir2, "logs"),
     level: resolveLogLevel(),
     base: { version: CLI_VERSION, profile: profileName, scope: credential.scope }
   });
@@ -46163,7 +46414,7 @@ async function runStart(profileDir2, profileName) {
 }
 
 // src/commands/attach.ts
-import { join as join30 } from "path";
+import { join as join31 } from "path";
 
 // src/core/control-client.ts
 import { connect as connect2 } from "net";
@@ -46262,7 +46513,7 @@ async function runAttach(profileDir2, profileName) {
     process.exitCode = 1;
     return;
   }
-  const socketPath = join30(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join31(profileDir2, CONTROL_SOCKET_FILE);
   const bus = new SessionBus();
   let conn;
   try {
@@ -46295,7 +46546,7 @@ async function runAttach(profileDir2, profileName) {
 
 // src/commands/ai-login.ts
 import { spawn as spawn11 } from "child_process";
-import { mkdirSync as mkdirSync6 } from "fs";
+import { mkdirSync as mkdirSync7 } from "fs";
 import { basename as basename5 } from "path";
 function runProviderLogin(cmd, envVar, dir2) {
   return new Promise((resolve8) => {
@@ -46333,7 +46584,7 @@ async function runAiLogin(profileDir2, profileName, aiFilter) {
       continue;
     }
     const dir2 = resolveHomePath(cred.profile);
-    mkdirSync6(dir2, { recursive: true });
+    mkdirSync7(dir2, { recursive: true });
     console.log(`
 \u25B6 Logging in ${cred.provider} \xB7 ${cred.profile} (${envVar}=${dir2})`);
     console.log(`  Complete the provider's own sign-in (claude: type \`/login\`; codex: follow its prompt), then exit.`);
@@ -46347,7 +46598,7 @@ Tip: for the credentials to survive \`docker rm\`/recreate, keep each profile pa
 }
 
 // src/commands/unlink.ts
-import { rmSync as rmSync7 } from "fs";
+import { rmSync as rmSync8 } from "fs";
 async function runUnlink(profileDir2, profileName) {
   const cred = readCredential(profileDir2, profileName);
   if (!cred) {
@@ -46362,7 +46613,7 @@ async function runUnlink(profileDir2, profileName) {
       `\u26A0 Could not reach the server to revoke \u2014 revoke it at web /machines. (${err.message})`
     );
   }
-  rmSync7(profileDir2, { recursive: true, force: true });
+  rmSync8(profileDir2, { recursive: true, force: true });
   clearDefaultProfileIf(profileName);
   console.log("\u2714 Deleted the profile and its physic project folder.");
 }