@4pm/cli 1.8.4 → 1.9.0-b

package/dist/index.js

@@ -29506,17 +29506,38 @@ MCowBQYDK2VwAyEARlfzjaFhe5bhRrMp/ZuH6sVqg/S7f8B1dliuF21iDTw=
 `;
 
 // src/version.ts
+import { execFileSync } from "child_process";
 import { readFileSync as readFileSync4 } from "fs";
 import { dirname, join as join4 } from "path";
 import { fileURLToPath } from "url";
+function gitDescribeVersion(cwd2) {
+  try {
+    const out = execFileSync("git", ["describe", "--tags", "--match", "cli-v*"], {
+      cwd: cwd2,
+      timeout: 3e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).toString().trim();
+    const stripped = out.replace(/^cli-v/, "");
+    return stripped || null;
+  } catch {
+    return null;
+  }
+}
 function readCliVersion() {
+  const envVersion = process.env.FOURPM_CLI_VERSION?.trim();
+  if (envVersion) return envVersion.replace(/^cli-v/, "");
+  let version = "0.0.0";
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     const pkg = JSON.parse(readFileSync4(join4(here, "..", "package.json"), "utf8"));
-    return pkg.version ?? "0.0.0";
+    version = pkg.version ?? "0.0.0";
+    if (version === "0.0.0") {
+      const dev = gitDescribeVersion(here);
+      if (dev) version = dev;
+    }
   } catch {
-    return "0.0.0";
   }
+  return version;
 }
 var CLI_VERSION = readCliVersion();
 
@@ -33965,6 +33986,14 @@ var issueProvisioningTokenRequestSchema = external_exports.object({
   /** TTL seconds (0/absent ⇒ a default short TTL applied server-side). */
   ttlSec: external_exports.number().int().min(0).max(2592e3).optional()
 });
+var provisionRequestSchema = external_exports.object({
+  mode: external_exports.enum(["sync", "force"]).optional().default("sync")
+});
+var provisionForUserRequestSchema = external_exports.object({
+  userId: external_exports.string().uuid(),
+  projectId: external_exports.string().uuid(),
+  mode: external_exports.enum(["sync", "force"]).optional().default("sync")
+});
 var listWorkersQuerySchema = baseRequestSchema.extend({
   status: external_exports.enum(["online", "offline"]).optional(),
   /** Only workers whose live CPU/memory/disk usage % ≥ the given threshold (0–100). */
@@ -34240,7 +34269,13 @@ var repoSpecSchema = external_exports.object({
   /** Clone url — `https` or `ssh` (required; ADR-0172). */
   url: external_exports.string().max(500).regex(GIT_URL_RE, "must be an https or ssh git url"),
   /** Sub-repo subfolder under the target root (empty ⇒ derived from role/name). */
-  subdir: external_exports.string().max(120).optional().default("")
+  subdir: external_exports.string().max(120).optional().default(""),
+  /**
+   * Primary branch to clone / check out (ADR-0292). Empty ⇒ the repo's default branch. The
+   * worker clones with `-b <branch>` and the on-demand "update repos" action checks it out +
+   * fast-forward pulls it.
+   */
+  branch: external_exports.string().max(200).optional().default("")
 });
 function repoName(url) {
   const last = (url || "").trim().replace(/\/+$/, "").split(/[/:]/).pop() ?? "";
@@ -34367,9 +34402,282 @@ var activityHeartbeatSchema = external_exports.object({
   projectId: external_exports.string().uuid().optional()
 });
 
+// src/core/scaffold.ts
+import { cp, mkdir, readdir, rename, rm, writeFile } from "fs/promises";
+import { existsSync as existsSync4 } from "fs";
+import { execFile as execFile2 } from "child_process";
+import { dirname as dirname3, join as join6, resolve } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import { promisify as promisify2 } from "util";
+
+// src/core/ai-assist.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var run = promisify(execFile);
+function aiCli() {
+  return process.env.AI_CLI || "claude";
+}
+function aiArgs(cli, prompt) {
+  if (cli === "claude") return ["-p", prompt, "--output-format", "json"];
+  if (cli === "codex") return ["exec", "--json", prompt];
+  return ["-p", prompt];
+}
+function estimateTokens(prompt, output) {
+  return Math.max(1, Math.ceil((prompt.length + output.length) / 4));
+}
+function parseAi(cli, stdout, prompt) {
+  if (cli === "claude") {
+    try {
+      const j = JSON.parse(stdout);
+      const text2 = (j.result ?? "").trim();
+      const tokens = (j.usage?.input_tokens ?? 0) + (j.usage?.output_tokens ?? 0);
+      if (text2 || tokens) return { text: text2, tokens: tokens || estimateTokens(prompt, text2) };
+    } catch {
+    }
+  }
+  if (cli === "codex") {
+    try {
+      let text2 = "";
+      let tokens = 0;
+      for (const line of stdout.split("\n").filter(Boolean)) {
+        const obj = JSON.parse(line);
+        if (obj.text) text2 = obj.text;
+        else if (obj.message) text2 = obj.message;
+        if (obj.usage) {
+          tokens = obj.usage.total_tokens ?? (obj.usage.input_tokens ?? 0) + (obj.usage.output_tokens ?? 0);
+        }
+      }
+      if (text2 || tokens) return { text: text2.trim(), tokens: tokens || estimateTokens(prompt, text2) };
+    } catch {
+    }
+  }
+  const text = stdout.trim();
+  return { text, tokens: estimateTokens(prompt, text) };
+}
+async function runAi(prompt) {
+  const cli = aiCli();
+  const { stdout } = await run(cli, aiArgs(cli, prompt), {
+    timeout: 12e4,
+    maxBuffer: 8 * 1024 * 1024
+  });
+  return parseAi(cli, stdout, prompt);
+}
+async function aiGenerate(prompt) {
+  const { text } = await runAi(prompt);
+  return text;
+}
+async function aiOutboundReview(input, allowedRepos, projectPath) {
+  const prompt = `You are a security reviewer for an autonomous coding agent. Decide if the following INPUT is SAFE to run. It is UNSAFE if it: (1) asks the AI using secret VALUES (api keys, env values, passwords); (2) would affect other environments (only the sandbox project is allowed, no ssh/deploy/prod); (3) edits outside the project folder "${projectPath}"; (4) commits/pushes to a repo not in this allowlist: ${allowedRepos.length ? allowedRepos.join(", ") : "(none declared)"}. Reply with ONLY JSON: {"ok": <true|false>, "reasons": ["secret"|"environment"|"path"|"repo", ...]}. INPUT:
+${input}`;
+  const { text, tokens } = await runAi(prompt);
+  const start = text.indexOf("{");
+  const end = text.lastIndexOf("}");
+  if (start < 0 || end <= start) return { ok: false, reasons: ["ai_parse"], tokens };
+  try {
+    const j = JSON.parse(text.slice(start, end + 1));
+    const reasons = Array.isArray(j.reasons) ? j.reasons.filter((r) => typeof r === "string") : [];
+    return { ok: j.ok === true && reasons.length === 0, reasons, tokens };
+  } catch {
+    return { ok: false, reasons: ["ai_parse"], tokens };
+  }
+}
+
+// src/core/scaffold.ts
+var run2 = promisify2(execFile2);
+function reposOf(spec) {
+  const repos = spec?.repos;
+  return Array.isArray(repos) ? repos : [];
+}
+function subDirName(repo) {
+  const raw = (repo.subdir || repo.role || repoName(repo.url ?? "") || "repo").trim();
+  return raw.replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "") || "repo";
+}
+function cloneArgs(url, dest, branch) {
+  const b = (branch ?? "").trim();
+  return b ? ["clone", "-b", b, url, dest] : ["clone", url, dest];
+}
+async function updateRepo(dir2, label, branch, emit) {
+  const b = (branch ?? "").trim();
+  emit("git", `Updating ${label} (fetch + ${b ? `checkout ${b} + ` : ""}fast-forward pull)\u2026`);
+  await run2("git", ["fetch", "origin", "--prune"], { cwd: dir2, timeout: 12e4 });
+  if (b) await run2("git", ["checkout", b], { cwd: dir2, timeout: 6e4 });
+  await run2("git", ["pull", "--ff-only"], { cwd: dir2, timeout: 12e4 });
+}
+async function provisionRepos(target, repos, emit, opts = {}) {
+  const mode = opts.mode ?? "clone";
+  const subDirsToKeep = new Set(repos.filter((r) => !r.primary && r.url).map((r) => subDirName(r)));
+  for (const repo of repos) {
+    if (repo.primary) {
+      if (opts.clonePrimary && repo.url) {
+        if (existsSync4(join6(target, ".git"))) {
+          if (mode === "sync") {
+            await updateRepo(target, "primary repo", repo.branch, emit);
+          } else if (mode === "force") {
+            emit("git", `Re-cloning ${repo.url} (force)\u2026`);
+            const tmp = `${target}.4pm-reclone`;
+            await rm(tmp, { recursive: true, force: true });
+            await run2("git", cloneArgs(repo.url, tmp, repo.branch), { timeout: 12e4 });
+            for (const entry of await readdir(target)) {
+              if (subDirsToKeep.has(entry)) continue;
+              await rm(join6(target, entry), { recursive: true, force: true });
+            }
+            for (const entry of await readdir(tmp)) {
+              if (subDirsToKeep.has(entry)) continue;
+              await rename(join6(tmp, entry), join6(target, entry));
+            }
+            await rm(tmp, { recursive: true, force: true });
+          } else {
+            emit("git", `Primary repo already present \u2014 skipping clone.`);
+          }
+          continue;
+        }
+        emit("git", `Cloning ${repo.url}\u2026`);
+        await run2("git", cloneArgs(repo.url, target, repo.branch), { timeout: 12e4 });
+        continue;
+      }
+      emit("git", "Initializing the primary repo\u2026");
+      await run2("git", ["init"], { cwd: target, timeout: 2e4 });
+      if (repo.url) {
+        await run2("git", ["remote", "add", "origin", repo.url], { cwd: target, timeout: 2e4 }).catch(
+          () => void 0
+        );
+      }
+      continue;
+    }
+    const dir2 = join6(target, subDirName(repo));
+    if (repo.url) {
+      if (existsSync4(join6(dir2, ".git"))) {
+        if (mode === "sync") {
+          await updateRepo(dir2, `sub-repo ${subDirName(repo)}`, repo.branch, emit);
+        } else if (mode === "force") {
+          emit("git", `Re-cloning sub-repo ${repo.url} (force)\u2026`);
+          await rm(dir2, { recursive: true, force: true });
+          await run2("git", cloneArgs(repo.url, dir2, repo.branch), { timeout: 12e4 });
+        } else {
+          emit("git", `Sub-repo ${subDirName(repo)} already present \u2014 skipping clone.`);
+        }
+        continue;
+      }
+      emit("git", `Cloning sub-repo ${repo.url}\u2026`);
+      await run2("git", cloneArgs(repo.url, dir2, repo.branch), { timeout: 12e4 });
+    } else {
+      emit("git", `Initializing sub-repo ${subDirName(repo)}\u2026`);
+      await mkdir(dir2, { recursive: true });
+      await run2("git", ["init"], { cwd: dir2, timeout: 2e4 });
+    }
+  }
+}
+async function ensureReposCloned(physicRoot, repos, emit) {
+  if (repos.length === 0) return;
+  await provisionRepos(physicRoot, repos, emit ?? (() => void 0), { clonePrimary: true });
+}
+function sampleDir() {
+  if (process.env.SCAFFOLD_SAMPLE_DIR) return process.env.SCAFFOLD_SAMPLE_DIR;
+  const here = dirname3(fileURLToPath3(import.meta.url));
+  const bundled = resolve(here, "project-sample");
+  for (const candidate of [bundled, resolve(here, "../project-sample"), resolve(here, "../../project-sample")]) {
+    if (existsSync4(candidate)) return candidate;
+  }
+  return bundled;
+}
+async function scaffoldProject(payload, profileDir2, onProgress) {
+  let lastStep = "start";
+  const emit = (step, message) => {
+    lastStep = step;
+    onProgress?.({ projectId: payload.projectId, step, message });
+  };
+  try {
+    const root = process.env.SCAFFOLD_ROOT ? resolve(process.env.SCAFFOLD_ROOT) : resolve(profileDir2);
+    const target = join6(root, payload.projectName);
+    await mkdir(target, { recursive: true });
+    emit("copy", "Copying the sample template\u2026");
+    await cp(sampleDir(), target, { recursive: true, force: false, errorOnExist: false });
+    if (payload.spec) {
+      emit("spec", "Writing project.spec.json\u2026");
+      await writeFile(
+        join6(target, "project.spec.json"),
+        JSON.stringify(payload.spec, null, 2),
+        "utf8"
+      );
+    }
+    const repos = reposOf(payload.spec);
+    if (repos.length > 0) await provisionRepos(target, repos, emit);
+    if (payload.spec) await aiInit(target, payload.spec, emit);
+    emit("version", "Writing .4pm/.4pm.json\u2026");
+    await writeTemplateMarker(target);
+    onProgress?.({ projectId: payload.projectId, step: "done", message: "Scaffold complete.", done: true });
+    return { ok: true, path: target };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err), step: lastStep };
+  }
+}
+async function writeTemplateMarker(target) {
+  const dir2 = join6(target, ".4pm");
+  await mkdir(dir2, { recursive: true });
+  const marker = { templateVersion: PROJECT_TEMPLATE.version, scaffoldedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  await writeFile(join6(dir2, ".4pm.json"), JSON.stringify(marker, null, 2) + "\n", "utf8");
+}
+async function aiInit(target, spec, emit) {
+  emit("ai-init", "AI init: subagents, README, CLAUDE.md\u2026");
+  const subagents = Array.isArray(spec.subagents) ? spec.subagents : [];
+  if (subagents.length > 0) {
+    await mkdir(join6(target, ".claude", "agents"), { recursive: true });
+    for (const sa of subagents) {
+      const name = (sa.name || "").trim().replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "");
+      if (!name) continue;
+      const body = `---
+name: ${name}
+---
+
+${(sa.description || "").trim()}
+`;
+      await writeFile(join6(target, ".claude", "agents", `${name}.md`), body, "utf8");
+    }
+  }
+  const specJson = JSON.stringify(spec);
+  await generateFile(
+    join6(target, "README.md"),
+    `Write a concise README.md (Markdown only, no preamble) for this project from its spec JSON:
+${specJson}`
+  );
+  await generateFile(
+    join6(target, "CLAUDE.md"),
+    `Write a CLAUDE.md (Markdown only, no preamble) with guidance/conventions for AI agents working in this project, derived from its spec JSON:
+${specJson}`
+  );
+}
+async function generateFile(path, prompt) {
+  try {
+    const text = await aiGenerate(prompt);
+    if (text.trim()) await writeFile(path, text.trim() + "\n", "utf8");
+  } catch {
+  }
+}
+async function addProject(payload, profileDir2, onProgress) {
+  let lastStep = "start";
+  const emit = (step, message) => {
+    lastStep = step;
+    onProgress?.({ projectId: payload.projectId, step, message });
+  };
+  try {
+    const root = process.env.SCAFFOLD_ROOT ? resolve(process.env.SCAFFOLD_ROOT) : resolve(profileDir2);
+    const target = join6(root, payload.projectName);
+    await mkdir(target, { recursive: true });
+    const repos = payload.repos ?? [];
+    const mode = payload.mode ?? "clone";
+    if (repos.length > 0) await provisionRepos(target, repos, emit, { clonePrimary: true, mode });
+    onProgress?.({ projectId: payload.projectId, step: "done", message: "Project added.", done: true });
+    return { ok: true, path: target };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    onProgress?.({ projectId: payload.projectId, step: "error", message: `Failed: ${message}`, done: true });
+    return { ok: false, error: message, step: lastStep };
+  }
+}
+
 // src/core/worker-metrics.ts
 import { statfs, readFile } from "fs/promises";
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { totalmem, freemem, cpus, platform, arch } from "os";
 var CGROUP = "/sys/fs/cgroup";
 var MB = 1024 * 1024;
@@ -34419,7 +34727,7 @@ function parseMaybeMax(text) {
   return Number.isFinite(n) ? n : null;
 }
 function createWorkerMetricsSampler(diskPath) {
-  const cgroupV2 = existsSync4(`${CGROUP}/cpu.stat`) && existsSync4(`${CGROUP}/memory.current`);
+  const cgroupV2 = existsSync5(`${CGROUP}/cpu.stat`) && existsSync5(`${CGROUP}/memory.current`);
   let cgPrev = null;
   let osPrev = null;
   async function cgroupCpuCount() {
@@ -34734,6 +35042,10 @@ var WsChannels = {
   // serving cli so a change (e.g. aiRunTimeoutSec) applies on the next run, not only after a
   // reconnect. `ws_token` seeds these on connect; this channel only carries updates.
   PROJECT_TOKENS: "project.tokens",
+  // server → cli (ADR-0289): update the cli to the latest version now (idle-aware self-update +
+  // re-exec). Sent by the manual operator "Update" action and the update-on-connect hook when the
+  // connecting cli is outdated. No payload; honours the machine's local autoUpdate opt-out.
+  CLI_UPDATE: "cli.update",
   // command lifecycle
   COMMAND_ANNOUNCE: "command.announce",
   // console transcript sync (ADR-0150): the cli streams its authoritative SessionBus
@@ -34847,9 +35159,9 @@ function decryptPayload(key, payloadBase64, nonceBase64) {
 import { spawn as spawn2 } from "child_process";
 
 // src/common/logger/logger.ts
-import { appendFile, mkdir, readdir, unlink } from "fs/promises";
+import { appendFile, mkdir as mkdir2, readdir as readdir2, unlink } from "fs/promises";
 import { readdirSync as readdirSync2, readFileSync as readFileSync6, statSync } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var LEVEL_ORDER = { error: 0, warn: 1, info: 2, debug: 3 };
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_RETENTION_DAYS = 14;
@@ -34898,8 +35210,8 @@ var CliLogger = class {
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
     const entry = { timestamp, level, ...this.base, event, ...fields };
     const line = JSON.stringify(entry) + "\n";
-    const path = join6(dir2, `cli-${timestamp.slice(0, 10)}.jsonl`);
-    this.queue = this.queue.then(() => mkdir(dir2, { recursive: true })).then(() => appendFile(path, line, "utf8")).catch((err) => {
+    const path = join7(dir2, `cli-${timestamp.slice(0, 10)}.jsonl`);
+    this.queue = this.queue.then(() => mkdir2(dir2, { recursive: true })).then(() => appendFile(path, line, "utf8")).catch((err) => {
       console.warn(`Failed to write cli log: ${err}`);
     });
   }
@@ -34907,13 +35219,13 @@ var CliLogger = class {
   async cleanupOldLogs() {
     const dir2 = this.dir;
     if (!dir2) return;
-    const files = await readdir(dir2).catch(() => []);
+    const files = await readdir2(dir2).catch(() => []);
     const cutoff = Date.now() - this.retentionDays * DAY_MS;
     for (const file of files) {
       const match = /^cli-(\d{4}-\d{2}-\d{2})\.jsonl$/.exec(file);
       if (!match) continue;
       if ((/* @__PURE__ */ new Date(`${match[1]}T00:00:00Z`)).getTime() < cutoff) {
-        await unlink(join6(dir2, file)).catch(() => void 0);
+        await unlink(join7(dir2, file)).catch(() => void 0);
       }
     }
   }
@@ -34924,7 +35236,7 @@ function readRecentLogLines(dir2, limit) {
     const files = readdirSync2(dir2).filter((f) => /^cli-\d{4}-\d{2}-\d{2}\.jsonl$/.test(f)).sort();
     const latest = files[files.length - 1];
     if (!latest) return [];
-    const lines = readFileSync6(join6(dir2, latest), "utf8").split("\n").filter(Boolean);
+    const lines = readFileSync6(join7(dir2, latest), "utf8").split("\n").filter(Boolean);
     return lines.slice(-limit);
   } catch {
     return [];
@@ -34937,8 +35249,8 @@ function readLogUpload(dir2) {
     const latest = files[files.length - 1];
     if (!latest) return null;
     let totalBytes = 0;
-    for (const f of files) totalBytes += statSync(join6(dir2, f)).size;
-    let content = readFileSync6(join6(dir2, latest), "utf8");
+    for (const f of files) totalBytes += statSync(join7(dir2, f)).size;
+    let content = readFileSync6(join7(dir2, latest), "utf8");
     if (content.length > LOG_UPLOAD_CONTENT_MAX) {
       content = `\u2026[truncated]
 ${content.slice(-LOG_UPLOAD_CONTENT_MAX)}`;
@@ -34981,7 +35293,7 @@ function classifyToolFailure(code, out) {
   }
   return { reason: "other", retryable: false };
 }
-function run(cmd, args, onLine, timeoutMs = 18e4) {
+function run3(cmd, args, onLine, timeoutMs = 18e4) {
   return new Promise((resolve10) => {
     let out = "";
     let buf = "";
@@ -35021,13 +35333,13 @@ function run(cmd, args, onLine, timeoutMs = 18e4) {
   });
 }
 async function detectOne(cmd, versionArg) {
-  const { code, out } = await run(cmd, [versionArg], void 0, 15e3);
+  const { code, out } = await run3(cmd, [versionArg], void 0, 15e3);
   if (code !== 0) return null;
   const first = out.split("\n").map((l) => l.trim()).find(Boolean);
   return first ?? "";
 }
 async function listExtras(autoUpdateSet = /* @__PURE__ */ new Set()) {
-  const { out } = await run("npm", ["ls", "-g", "--depth=0", "--json"], void 0, 2e4);
+  const { out } = await run3("npm", ["ls", "-g", "--depth=0", "--json"], void 0, 2e4);
   if (!out.trim()) return [];
   let deps = {};
   try {
@@ -35103,7 +35415,7 @@ async function runWorkerToolOp(op, name, manager, onLine, timeoutMs = TOOL_INSTA
     return { ok: false, exitCode: 1, error: resolved.error ?? "Invalid package." };
   }
   onLine(`$ ${manager} ${opArgs(op, manager, resolved.pkg).join(" ")}`);
-  const { code } = await run(manager, opArgs(op, manager, resolved.pkg), onLine, timeoutMs);
+  const { code } = await run3(manager, opArgs(op, manager, resolved.pkg), onLine, timeoutMs);
   return { ok: code === 0, exitCode: code, error: code === 0 ? void 0 : `${manager} exited ${code}` };
 }
 function setToolAutoUpdate(profileDir2, name, enabled) {
@@ -35134,7 +35446,7 @@ async function installPinned(name, version, manager, onLine, timeoutMs = TOOL_IN
   for (let attempt = 1; attempt <= TOOL_INSTALL_MAX_ATTEMPTS; attempt++) {
     const suffix = attempt > 1 ? ` (attempt ${attempt}/${TOOL_INSTALL_MAX_ATTEMPTS})` : "";
     onLine(`$ ${manager} ${args.join(" ")}${suffix}`);
-    const { code, out } = await run(manager, args, onLine, timeoutMs);
+    const { code, out } = await run3(manager, args, onLine, timeoutMs);
     if (code === 0) return { ok: true };
     const { reason, retryable } = classifyToolFailure(code, out);
     if (!retryable || attempt === TOOL_INSTALL_MAX_ATTEMPTS) {
@@ -35200,6 +35512,9 @@ var UpdateScheduler = class {
   lastDoneDateKey = null;
   /** Date key marked due but deferred because the cli was busy (stays set past the hour). */
   pendingDateKey = null;
+  /** A push/connect-triggered update requested now (ADR-0289) — runs when idle, independent of the
+   *  daily policy; cleared once it runs. */
+  forcedPending = false;
   /** Guards against a second update while one is in flight. */
   updating = false;
   /** Apply the latest policy (called on each ws_token) and start the tick timer once. */
@@ -35210,6 +35525,25 @@ var UpdateScheduler = class {
       this.timer.unref?.();
     }
   }
+  /**
+   * Request an update to latest NOW (ADR-0289) — the server's `cli.update` push or the
+   * update-on-connect hook. Idle-aware like the daily tick (defers while a command runs) and
+   * honours the local `autoUpdate:false` opt-out, but is independent of the daily org policy. Also
+   * ensures the tick timer is running so the request is served even before the first ws_token.
+   */
+  updateNow() {
+    if (this.optedOutLocally()) {
+      logger.info("update.push.optedOut");
+      return;
+    }
+    if (CLI_VERSION.startsWith("0.0.0")) return;
+    this.forcedPending = true;
+    if (!this.timer) {
+      this.timer = setInterval(() => void this.tick(), TICK_MS);
+      this.timer.unref?.();
+    }
+    void this.tick();
+  }
   /** Stop the scheduler when the session ends (logout / replaced / stopped). */
   stop() {
     if (this.timer) {
@@ -35242,12 +35576,19 @@ var UpdateScheduler = class {
       return null;
     }
   }
-  /** One evaluation: mark the update due at the target hour, then update once idle. */
+  /** One evaluation: run a forced (push/connect) update if pending, else the daily-scheduled one. */
   async tick() {
-    const p = this.policy;
-    if (!p || !p.autoUpdateDaily || this.updating) return;
+    if (this.updating) return;
     if (CLI_VERSION.startsWith("0.0.0")) return;
     if (this.optedOutLocally()) return;
+    if (this.forcedPending) {
+      if (this.bus.busy !== null) return;
+      this.forcedPending = false;
+      await this.runUpdate();
+      return;
+    }
+    const p = this.policy;
+    if (!p || !p.autoUpdateDaily) return;
     const clock = this.orgClock();
     if (!clock) return;
     if (clock.dateKey === this.lastDoneDateKey) return;
@@ -35305,14 +35646,14 @@ var UpdateScheduler = class {
 };
 
 // src/core/ai-profile-state.ts
-import { existsSync as existsSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { join as join8 } from "path";
 function statePath(profileDir2) {
-  return join7(profileDir2, "ai-profiles.json");
+  return join8(profileDir2, "ai-profiles.json");
 }
 function readState(profileDir2) {
   const path = statePath(profileDir2);
-  if (!existsSync5(path)) return {};
+  if (!existsSync6(path)) return {};
   try {
     return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
@@ -35370,7 +35711,7 @@ function clearPinnedCredential(profileDir2) {
 // src/utils/ai-cli.ts
 import { readFileSync as readFileSync8 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename, isAbsolute, join as join8 } from "path";
+import { basename, isAbsolute, join as join9 } from "path";
 var REQUIRED_AI_ARGS = {
   claude: ["-p", "--output-format", "stream-json", "--verbose"],
   codex: ["exec", "--json"],
@@ -35507,9 +35848,9 @@ function claudeCredentialKeys(config) {
   return claudeProfilesOf(config).filter(isUsableProfile).map((p) => credentialKey("claude", resolveHomePath(p.profile)));
 }
 function resolveHomePath(value) {
-  if (value.startsWith("~")) return join8(homedir3(), value.slice(1).replace(/^[/\\]/, ""));
+  if (value.startsWith("~")) return join9(homedir3(), value.slice(1).replace(/^[/\\]/, ""));
   if (isAbsolute(value)) return value;
-  return join8(homedir3(), value);
+  return join9(homedir3(), value);
 }
 function profileDirs(profiles) {
   if (!profiles) return [];
@@ -35555,11 +35896,11 @@ function buildRunArgs(profile, cmd, resumeId, oneShot = false, override, readOnl
 }
 function claudeHomeDirs(config) {
   const dirs = profileDirs(claudeProfilesOf(config));
-  return dirs.length > 0 ? dirs : [join8(homedir3(), ".claude")];
+  return dirs.length > 0 ? dirs : [join9(homedir3(), ".claude")];
 }
 function profileDisplayLabel(dir2) {
   try {
-    const raw = JSON.parse(readFileSync8(join8(dir2, ".claude.json"), "utf8"));
+    const raw = JSON.parse(readFileSync8(join9(dir2, ".claude.json"), "utf8"));
     const email = raw.oauthAccount?.emailAddress;
     if (email && email.trim()) return email;
   } catch {
@@ -35661,11 +36002,11 @@ function planLegacyRun(prompt, config, workingDir, resume, oneShot, override, re
 // src/core/claude-usage.ts
 import { spawn as spawn3 } from "child_process";
 import { readFileSync as readFileSync9 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 function readCreds(dir2) {
   try {
-    const raw = JSON.parse(readFileSync9(join9(dir2, ".credentials.json"), "utf8"));
+    const raw = JSON.parse(readFileSync9(join10(dir2, ".credentials.json"), "utf8"));
     const oauth = raw.claudeAiOauth ?? raw;
     return oauth.accessToken ? oauth : null;
   } catch {
@@ -35774,8 +36115,8 @@ async function checkClaudeUsage(dirs, aiCli2 = "claude") {
 }
 
 // src/core/command-history.ts
-import { existsSync as existsSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { join as join11 } from "path";
 var MAX_ENTRIES = 1e3;
 var filePath = null;
 var entries = [];
@@ -35837,8 +36178,8 @@ async function uploadHistory(cfg) {
   }
 }
 function initCommandHistory(profileDir2, profileName, uploadMinutes = 10) {
-  filePath = join10(profileDir2, "command-history.json");
-  if (existsSync6(filePath)) {
+  filePath = join11(profileDir2, "command-history.json");
+  if (existsSync7(filePath)) {
     try {
       entries = JSON.parse(readFileSync10(filePath, "utf8"));
     } catch {
@@ -35894,16 +36235,16 @@ function finishCommand(commandId, exitCode, usage) {
 }
 
 // src/core/command-images.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync3, readdirSync as readdirSync3, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync3, readdirSync as readdirSync3, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
+import { join as join12 } from "path";
 function attachmentsBaseDir(physicRoot) {
-  return join11(physicRoot, ".4pm", "attachments");
+  return join12(physicRoot, ".4pm", "attachments");
 }
 var ATTACHMENT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 async function materializeImages(physicRoot, commandId, images, fetch2) {
   const map = /* @__PURE__ */ new Map();
   if (!images.length) return map;
-  const dir2 = join11(attachmentsBaseDir(physicRoot), commandId);
+  const dir2 = join12(attachmentsBaseDir(physicRoot), commandId);
   mkdirSync3(dir2, { recursive: true });
   let n = 0;
   for (const img of images) {
@@ -35915,7 +36256,7 @@ async function materializeImages(physicRoot, commandId, images, fetch2) {
         continue;
       }
       const ext = commandImageExt(reply.mime ?? img.mime);
-      const file = join11(dir2, `img-${n}.${ext}`);
+      const file = join12(dir2, `img-${n}.${ext}`);
       writeFileSync6(file, Buffer.from(reply.dataBase64, "base64"));
       map.set(img.placeholder, file);
     } catch (err) {
@@ -35937,12 +36278,12 @@ function rewriteImagePlaceholders(prompt, paths) {
 }
 function sweepOldAttachments(physicRoot, maxAgeMs = ATTACHMENT_MAX_AGE_MS) {
   const base = attachmentsBaseDir(physicRoot);
-  if (!existsSync7(base)) return 0;
+  if (!existsSync8(base)) return 0;
   const cutoff = Date.now() - maxAgeMs;
   let removed = 0;
   try {
     for (const entry of readdirSync3(base)) {
-      const dir2 = join11(base, entry);
+      const dir2 = join12(base, entry);
       try {
         if (statSync2(dir2).mtimeMs < cutoff) {
           rmSync3(dir2, { recursive: true, force: true });
@@ -35959,18 +36300,18 @@ function sweepOldAttachments(physicRoot, maxAgeMs = ATTACHMENT_MAX_AGE_MS) {
 // src/core/command-output-store.ts
 import {
   appendFileSync,
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync11,
   readdirSync as readdirSync4,
   rmSync as rmSync4,
   statSync as statSync3
 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 var KEEP_FILES = 200;
 var dir = null;
 function initCommandOutput(profileDir2) {
-  dir = join12(profileDir2, "command-output");
+  dir = join13(profileDir2, "command-output");
   try {
     mkdirSync4(dir, { recursive: true });
     prune();
@@ -35980,14 +36321,14 @@ function initCommandOutput(profileDir2) {
 function appendCommandOutput(commandId, text) {
   if (!dir || !text) return;
   try {
-    appendFileSync(join12(dir, `${commandId}.log`), text, "utf8");
+    appendFileSync(join13(dir, `${commandId}.log`), text, "utf8");
   } catch {
   }
 }
 function readCommandOutput(commandId) {
   if (!dir) return null;
-  const path = join12(dir, `${commandId}.log`);
-  if (!existsSync8(path)) return null;
+  const path = join13(dir, `${commandId}.log`);
+  if (!existsSync9(path)) return null;
   try {
     return readFileSync11(path, "utf8");
   } catch {
@@ -35997,8 +36338,8 @@ function readCommandOutput(commandId) {
 function prune() {
   if (!dir) return;
   try {
-    const files = readdirSync4(dir).filter((f) => f.endsWith(".log")).map((f) => ({ f, t: statSync3(join12(dir, f)).mtimeMs })).sort((a, b) => b.t - a.t);
-    for (const { f } of files.slice(KEEP_FILES)) rmSync4(join12(dir, f), { force: true });
+    const files = readdirSync4(dir).filter((f) => f.endsWith(".log")).map((f) => ({ f, t: statSync3(join13(dir, f)).mtimeMs })).sort((a, b) => b.t - a.t);
+    for (const { f } of files.slice(KEEP_FILES)) rmSync4(join13(dir, f), { force: true });
   } catch {
   }
 }
@@ -36007,7 +36348,7 @@ function pruneCommandOutputByAge(days) {
   const cutoff = Date.now() - days * 24 * 60 * 60 * 1e3;
   try {
     for (const f of readdirSync4(dir).filter((n) => n.endsWith(".log"))) {
-      const p = join12(dir, f);
+      const p = join13(dir, f);
       if (statSync3(p).mtimeMs < cutoff) rmSync4(p, { force: true });
     }
   } catch {
@@ -36016,12 +36357,12 @@ function pruneCommandOutputByAge(days) {
 
 // src/core/support-answer.ts
 import { spawn as spawn4 } from "child_process";
-import { execFile } from "child_process";
+import { execFile as execFile3 } from "child_process";
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readdirSync as readdirSync5, readFileSync as readFileSync12, rmSync as rmSync5, statSync as statSync4, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, readdirSync as readdirSync5, readFileSync as readFileSync12, rmSync as rmSync5, statSync as statSync4, writeFileSync as writeFileSync7 } from "fs";
 import { randomUUID } from "crypto";
-import { join as join13 } from "path";
-import { promisify } from "util";
+import { join as join14 } from "path";
+import { promisify as promisify3 } from "util";
 
 // src/core/ai-stream.ts
 function assistantText(ev) {
@@ -36116,22 +36457,22 @@ function createAiStreamParser(cli) {
     apiError: () => ({ ...apiError })
   };
 }
-function estimateTokens(text) {
+function estimateTokens2(text) {
   return Math.max(1, Math.ceil(text.length / 4));
 }
 
 // src/core/support-answer.ts
 var NO_USAGE = { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 };
-var execFileAsync = promisify(execFile);
+var execFileAsync = promisify3(execFile3);
 var MAX_CONTEXT_CHARS = 12e4;
 var ANSWER_TIMEOUT_MS = 12e4;
 var DOC_EXTENSIONS = [".md", ".mdx", ".txt"];
 function kbRoot(profileDir2) {
-  return join13(profileDir2, "support-kb");
+  return join14(profileDir2, "support-kb");
 }
 function repoDir(profileDir2, url, branch) {
   const key = createHash3("sha1").update(`${url}#${branch}`).digest("hex").slice(0, 16);
-  return join13(kbRoot(profileDir2), key);
+  return join14(kbRoot(profileDir2), key);
 }
 function authedUrl(url, token) {
   if (!token) return url;
@@ -36140,7 +36481,7 @@ function authedUrl(url, token) {
 }
 async function ensureRepo(profileDir2, repo) {
   const dir2 = repoDir(profileDir2, repo.url, repo.branch);
-  if (existsSync9(join13(dir2, ".git"))) return dir2;
+  if (existsSync10(join14(dir2, ".git"))) return dir2;
   const url = authedUrl(repo.url, repo.token);
   const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
   mkdirSync5(kbRoot(profileDir2), { recursive: true });
@@ -36151,11 +36492,11 @@ async function ensureRepo(profileDir2, repo) {
 }
 async function refreshSupportKb(profileDir2) {
   const root = kbRoot(profileDir2);
-  if (!existsSync9(root)) return;
+  if (!existsSync10(root)) return;
   const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
   for (const entry of readdirSync5(root)) {
-    const dir2 = join13(root, entry);
-    if (!existsSync9(join13(dir2, ".git"))) continue;
+    const dir2 = join14(root, entry);
+    if (!existsSync10(join14(dir2, ".git"))) continue;
     try {
       await execFileAsync("git", ["-C", dir2, "pull", "--ff-only"], { env: gitEnv });
     } catch (err) {
@@ -36170,7 +36511,7 @@ function collectDocs(dir2) {
     if (total >= MAX_CONTEXT_CHARS) return;
     for (const entry of readdirSync5(current2)) {
       if (entry === ".git" || entry === "node_modules") continue;
-      const full = join13(current2, entry);
+      const full = join14(current2, entry);
       const st = statSync4(full);
       if (st.isDirectory()) {
         walk2(full);
@@ -36235,11 +36576,11 @@ function imageExt(mime) {
   }
 }
 function materializeImages2(profileDir2, images, question) {
-  const dir2 = join13(profileDir2, "help-images", randomUUID());
+  const dir2 = join14(profileDir2, "help-images", randomUUID());
   mkdirSync5(dir2, { recursive: true });
   let rewritten = question;
   images.forEach((img, i) => {
-    const file = join13(dir2, `image-${i + 1}.${imageExt(img.mime)}`);
+    const file = join14(dir2, `image-${i + 1}.${imageExt(img.mime)}`);
     writeFileSync7(file, Buffer.from(img.dataBase64, "base64"));
     if (img.placeholder) rewritten = rewritten.split(img.placeholder).join(file);
   });
@@ -36334,7 +36675,7 @@ async function runSupportAnswer(req, ai, profileDir2) {
     if (!text) return { body: "", error: "empty answer" };
     const { body, moderation } = parseModeratedAnswer(text);
     if (!body) return { body: "", error: "empty answer" };
-    const u = usage.tokens > 0 ? usage : { ...NO_USAGE, tokens: estimateTokens(body) };
+    const u = usage.tokens > 0 ? usage : { ...NO_USAGE, tokens: estimateTokens2(body) };
     return {
       body,
       ...moderation ? { moderation } : {},
@@ -36381,12 +36722,12 @@ function reportToolResult(tool, ok, message) {
 }
 
 // src/core/autonomous.ts
-import { readFile as readFile2, writeFile, chmod } from "fs/promises";
+import { readFile as readFile2, writeFile as writeFile2, chmod } from "fs/promises";
 import { readFileSync as readFileSync13 } from "fs";
-import { execFile as execFile2, spawn as spawn5 } from "child_process";
-import { join as join14 } from "path";
-import { promisify as promisify2 } from "util";
-var run2 = promisify2(execFile2);
+import { execFile as execFile4, spawn as spawn5 } from "child_process";
+import { join as join15 } from "path";
+import { promisify as promisify4 } from "util";
+var run4 = promisify4(execFile4);
 var SETTINGS_REL = ".claude/.autonomous.settings.json";
 var HISTORIES_REL = ".claude/.autonomous.histories.json";
 var APPROVALS_REL = ".claude/.autonomous.approvals.json";
@@ -36419,11 +36760,11 @@ function tableCell(value) {
   return value.replace(/\r?\n/g, " ").replace(/\|/g, "\\|").trim();
 }
 function tickScript(root) {
-  return join14(root, TICK_REL);
+  return join15(root, TICK_REL);
 }
 async function crontabList() {
   try {
-    const { stdout } = await run2("crontab", ["-l"], { timeout: 1e4 });
+    const { stdout } = await run4("crontab", ["-l"], { timeout: 1e4 });
     return stdout;
   } catch {
     return "";
@@ -36442,8 +36783,8 @@ async function cronInstalled(root) {
   return (await crontabList()).split("\n").some((l) => l.includes(script) && !l.trim().startsWith("#"));
 }
 async function getAutonomousStatus(root) {
-  const settings = parseJson(await readText(join14(root, SETTINGS_REL))) ?? {};
-  const hist = parseJson(await readText(join14(root, HISTORIES_REL))) ?? {};
+  const settings = parseJson(await readText(join15(root, SETTINGS_REL))) ?? {};
+  const hist = parseJson(await readText(join15(root, HISTORIES_REL))) ?? {};
   const records = Array.isArray(hist.records) ? hist.records : [];
   const last = records[records.length - 1];
   const ticks = hist.ticks ?? {};
@@ -36460,9 +36801,9 @@ async function getAutonomousStatus(root) {
 }
 function isAutonomousRunning(root) {
   try {
-    const s = JSON.parse(readFileSync13(join14(root, SETTINGS_REL), "utf8"));
+    const s = JSON.parse(readFileSync13(join15(root, SETTINGS_REL), "utf8"));
     if (s.paused === true) return false;
-    const h = JSON.parse(readFileSync13(join14(root, HISTORIES_REL), "utf8"));
+    const h = JSON.parse(readFileSync13(join15(root, HISTORIES_REL), "utf8"));
     const ts = h.records?.[h.records.length - 1]?.ts;
     if (!ts) return false;
     const t2 = Date.parse(ts.replace(" ", "T"));
@@ -36473,10 +36814,10 @@ function isAutonomousRunning(root) {
 }
 async function readAutonomous(root) {
   const [settings, approvals, status, ...books] = await Promise.all([
-    readText(join14(root, SETTINGS_REL)),
-    readText(join14(root, APPROVALS_REL), "{}"),
+    readText(join15(root, SETTINGS_REL)),
+    readText(join15(root, APPROVALS_REL), "{}"),
     getAutonomousStatus(root),
-    ...Object.values(BOOK_FILES).map((f) => readText(join14(root, f)))
+    ...Object.values(BOOK_FILES).map((f) => readText(join15(root, f)))
   ]);
   const keys = Object.keys(BOOK_FILES);
   const bookMap = {};
@@ -36485,7 +36826,7 @@ async function readAutonomous(root) {
 }
 async function readAutonomousLogs(root, date) {
   const day = date && /^\d{4}-\d{2}-\d{2}$/.test(date) ? date : (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const text = await readText(join14(root, LOG_DIR_REL, `autonomous-tick-${day}.log`));
+  const text = await readText(join15(root, LOG_DIR_REL, `autonomous-tick-${day}.log`));
   const lines = text ? text.split("\n").filter((l) => l.length > 0).slice(-500) : [];
   return { date: day, lines };
 }
@@ -36509,22 +36850,22 @@ async function writeAutonomous(root, req, by) {
     switch (req.kind) {
       case "settings": {
         if (!parseJson(req.settings)) return { ok: false, error: "settings is not valid JSON" };
-        await writeFile(join14(root, SETTINGS_REL), req.settings, "utf8");
+        await writeFile2(join15(root, SETTINGS_REL), req.settings, "utf8");
         break;
       }
       case "approvals": {
-        const map = parseJson(await readText(join14(root, APPROVALS_REL), "{}")) ?? {};
+        const map = parseJson(await readText(join15(root, APPROVALS_REL), "{}")) ?? {};
         if (req.approved) map[req.taskId] = { approved: true, by, at: (/* @__PURE__ */ new Date()).toISOString() };
         else delete map[req.taskId];
-        await writeFile(join14(root, APPROVALS_REL), JSON.stringify(map, null, 2) + "\n", "utf8");
+        await writeFile2(join15(root, APPROVALS_REL), JSON.stringify(map, null, 2) + "\n", "utf8");
         break;
       }
       case "userTodo": {
-        const cur = await readText(join14(root, BOOK_FILES.userTodo));
+        const cur = await readText(join15(root, BOOK_FILES.userTodo));
         const trace = `posted by ${tableCell(by)} at ${(/* @__PURE__ */ new Date()).toISOString()}`;
         const row = `| | ${tableCell(req.content)} | ${trace} |
 `;
-        await writeFile(join14(root, BOOK_FILES.userTodo), cur.replace(/\s*$/, "\n") + row, "utf8");
+        await writeFile2(join15(root, BOOK_FILES.userTodo), cur.replace(/\s*$/, "\n") + row, "utf8");
         break;
       }
       case "cron": {
@@ -36540,7 +36881,7 @@ async function writeAutonomous(root, req, by) {
 }
 
 // src/core/network-probe.ts
-import { existsSync as existsSync10, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync14 } from "fs";
 import { connect } from "net";
 var CANARY_TARGETS = [
   { host: "1.1.1.1", port: 443 },
@@ -36549,7 +36890,7 @@ var CANARY_TARGETS = [
 var PROBE_TIMEOUT_MS = 2500;
 function detectContainerized() {
   try {
-    if (existsSync10("/.dockerenv")) return true;
+    if (existsSync11("/.dockerenv")) return true;
     const cgroup = readFileSync14("/proc/1/cgroup", "utf8");
     return /docker|containerd|kubepods|libpod/.test(cgroup);
   } catch {
@@ -36619,7 +36960,7 @@ async function probeNetwork() {
 // src/core/git-auth.ts
 import { writeFileSync as writeFileSync8 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 function tokenTarget(method) {
   if (method === "gitlab-group-token") {
     return { host: process.env.FOURPM_GIT_HOST || "gitlab.com", user: "oauth2" };
@@ -36637,7 +36978,7 @@ function applyGitAuth(method) {
   try {
     const line = `https://${target.user}:${token}@${target.host}
 `;
-    writeFileSync8(join15(homedir4(), ".git-credentials"), line, { encoding: "utf8", mode: 384 });
+    writeFileSync8(join16(homedir4(), ".git-credentials"), line, { encoding: "utf8", mode: 384 });
     return true;
   } catch {
     return false;
@@ -36822,7 +37163,7 @@ async function runAiFailover(plan, commandId, cwd2, handlers, timeoutMs = 0) {
     const apiErr = parser.apiError();
     if (finalExit === 0 && !apiErr.isError) {
       const usage = parser.usage();
-      if (usage.tokens === 0) usage.tokens = estimateTokens(captured);
+      if (usage.tokens === 0) usage.tokens = estimateTokens2(captured);
       reportToolResult(attempt.cmd, true);
       return {
         exitCode: 0,
@@ -36874,8 +37215,8 @@ function formatTimestampInZone(date, timeZone) {
 }
 
 // src/ui/slash-commands.ts
-import { existsSync as existsSync11 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { join as join17 } from "path";
 var CONFIG_KEYS = [
   "aiCli",
   "claudeHome",
@@ -36887,7 +37228,7 @@ var CONFIG_KEYS = [
   "aiEnv"
 ];
 function configPath(profileDir2) {
-  return join16(profileDir2, "config.json");
+  return join17(profileDir2, "config.json");
 }
 function parseConfigAssignment(key, valueTokens) {
   const value = valueTokens.join(" ").trim();
@@ -36937,7 +37278,7 @@ function runConfig(ctx) {
       ctx.print(t("slash.config.wroteDefault", { verb, path }));
       ctx.print(t("slash.config.addClaudeHint"));
     };
-    if (existsSync11(path)) {
+    if (existsSync12(path)) {
       ctx.confirm(
         t("slash.config.replaceConfirm", { path }),
         () => writeDefaults(t("slash.config.verbReplaced"))
@@ -37022,7 +37363,7 @@ function runOutput(ctx) {
 }
 function runLogs(ctx) {
   const n = Math.max(1, Math.min(200, Number(ctx.args[0]) || 20));
-  const dir2 = join16(ctx.info.profileDir, "logs");
+  const dir2 = join17(ctx.info.profileDir, "logs");
   const lines = readRecentLogLines(dir2, n);
   if (lines.length === 0) {
     ctx.print(t("slash.logs.none"));
@@ -37337,13 +37678,13 @@ async function runMemoryCompaction(ai, cwd2, input) {
 }
 
 // src/core/git-commit-identity.ts
-import { execFile as execFile3 } from "child_process";
-import { promisify as promisify3 } from "util";
-var run3 = promisify3(execFile3);
+import { execFile as execFile5 } from "child_process";
+import { promisify as promisify5 } from "util";
+var run5 = promisify5(execFile5);
 async function setCommitAuthor(cwd2, machineUsername) {
   if (!machineUsername) return;
   try {
-    await run3("git", ["config", "--local", "user.name", machineUsername], { cwd: cwd2, timeout: 8e3 });
+    await run5("git", ["config", "--local", "user.name", machineUsername], { cwd: cwd2, timeout: 8e3 });
   } catch {
   }
 }
@@ -37442,7 +37783,7 @@ async function runAiPrompt(ctx, prompt, commandId, origin, oneShot = false, imag
   const aiRunTimeoutMs = timeoutSec > 0 ? timeoutSec * 1e3 : 0;
   const perPromptLimit = config.perPromptTokenLimit ?? 0;
   if (perPromptLimit > 0) {
-    const estimated = estimateTokens(prompt);
+    const estimated = estimateTokens2(prompt);
     if (estimated > perPromptLimit) {
       rejectPromptOverLimit(ctx, commandId, origin, prompt, estimated, perPromptLimit);
       return;
@@ -37859,15 +38200,15 @@ function rejectByReview(ctx, commandId, origin, prompt, reasons) {
 }
 
 // src/core/fs-browse.ts
-import { readdir as readdir2 } from "fs/promises";
-import { resolve, sep as sep2 } from "path";
+import { readdir as readdir3 } from "fs/promises";
+import { resolve as resolve2, sep as sep2 } from "path";
 async function listDir(path, root) {
   if (!root) return { path: "", entries: [] };
-  const base = resolve(root);
-  const requested = resolve(base, path && path.trim() ? path : ".");
+  const base = resolve2(root);
+  const requested = resolve2(base, path && path.trim() ? path : ".");
   const target = requested === base || requested.startsWith(base + sep2) ? requested : base;
   try {
-    const dirents = await readdir2(target, { withFileTypes: true });
+    const dirents = await readdir3(target, { withFileTypes: true });
     const entries2 = dirents.map((d) => ({
       name: d.name,
       type: d.isDirectory() ? "dir" : "file"
@@ -37883,12 +38224,12 @@ async function listDir(path, root) {
 
 // src/core/fs-read.ts
 import { readFile as readFile3 } from "fs/promises";
-import { resolve as resolve2, sep as sep3 } from "path";
+import { resolve as resolve3, sep as sep3 } from "path";
 var MAX_BYTES = 256 * 1024;
 function resolveInRoot(root, relPath) {
   if (!root) return null;
-  const base = resolve2(root);
-  const target = resolve2(base, relPath || ".");
+  const base = resolve3(root);
+  const target = resolve3(base, relPath || ".");
   return target === base || target.startsWith(base + sep3) ? target : null;
 }
 async function readWorkerFile(root, path) {
@@ -37907,13 +38248,13 @@ async function readWorkerFile(root, path) {
 }
 
 // src/core/fs-write.ts
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname3, resolve as resolve3, sep as sep4 } from "path";
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname4, resolve as resolve4, sep as sep4 } from "path";
 var MAX_BYTES2 = 2 * 1024 * 1024;
 function resolveInRoot2(root, relPath) {
   if (!root) return null;
-  const base = resolve3(root);
-  const target = resolve3(base, relPath || ".");
+  const base = resolve4(root);
+  const target = resolve4(base, relPath || ".");
   return target === base || target.startsWith(base + sep4) ? target : null;
 }
 async function writeWorkerFile(root, relPath, content) {
@@ -37926,8 +38267,8 @@ async function writeWorkerFile(root, relPath, content) {
     return { ok: false, path: target, bytes: 0, error: `content too large (max ${MAX_BYTES2} bytes)` };
   }
   try {
-    await mkdir2(dirname3(target), { recursive: true });
-    await writeFile2(target, content, "utf8");
+    await mkdir3(dirname4(target), { recursive: true });
+    await writeFile3(target, content, "utf8");
     return { ok: true, path: target, bytes };
   } catch (err) {
     return { ok: false, path: target, bytes: 0, error: err instanceof Error ? err.message : String(err) };
@@ -37935,12 +38276,12 @@ async function writeWorkerFile(root, relPath, content) {
 }
 
 // src/core/fs-mutate.ts
-import { mkdir as mkdir3, writeFile as writeFile3, rename, rm, stat } from "fs/promises";
-import { basename as basename3, dirname as dirname4, resolve as resolve4, sep as sep5 } from "path";
+import { mkdir as mkdir4, writeFile as writeFile4, rename as rename2, rm as rm2, stat } from "fs/promises";
+import { basename as basename3, dirname as dirname5, resolve as resolve5, sep as sep5 } from "path";
 var MAX_BYTES3 = 2 * 1024 * 1024;
 function resolveInRoot3(root, rel) {
-  const base = resolve4(root);
-  const target = resolve4(base, rel || ".");
+  const base = resolve5(root);
+  const target = resolve5(base, rel || ".");
   return target === base || target.startsWith(base + sep5) ? target : null;
 }
 async function isDir(p) {
@@ -37965,39 +38306,39 @@ async function mutateFs(root, req) {
     switch (req.op) {
       case "mkdir": {
         const target = resolveInRoot3(root, req.path ?? "");
-        if (!target || target === resolve4(root)) return escaped(req.path ?? "");
-        await mkdir3(target, { recursive: true });
+        if (!target || target === resolve5(root)) return escaped(req.path ?? "");
+        await mkdir4(target, { recursive: true });
         return { ok: true, path: target };
       }
       case "create": {
         const target = resolveInRoot3(root, req.path ?? "");
-        if (!target || target === resolve4(root)) return escaped(req.path ?? "");
+        if (!target || target === resolve5(root)) return escaped(req.path ?? "");
         if (await exists(target)) return { ok: false, path: target, error: "already exists" };
         const content = req.content ?? "";
         if (Buffer.byteLength(content, "utf8") > MAX_BYTES3) {
           return { ok: false, path: target, error: `content too large (max ${MAX_BYTES3} bytes)` };
         }
-        await mkdir3(dirname4(target), { recursive: true });
-        await writeFile3(target, content, "utf8");
+        await mkdir4(dirname5(target), { recursive: true });
+        await writeFile4(target, content, "utf8");
         return { ok: true, path: target };
       }
       case "move": {
         const from = resolveInRoot3(root, req.from ?? "");
         let to = resolveInRoot3(root, req.to ?? "");
         if (!from || !to) return escaped(req.from ?? req.to ?? "");
-        if (from === resolve4(root)) return { ok: false, path: from, error: "cannot move the project root" };
-        if (await isDir(to)) to = resolve4(to, basename3(from));
-        if (to !== resolve4(root) && !to.startsWith(resolve4(root) + sep5)) return escaped(req.to ?? "");
+        if (from === resolve5(root)) return { ok: false, path: from, error: "cannot move the project root" };
+        if (await isDir(to)) to = resolve5(to, basename3(from));
+        if (to !== resolve5(root) && !to.startsWith(resolve5(root) + sep5)) return escaped(req.to ?? "");
         if (await exists(to)) return { ok: false, path: to, error: "destination already exists" };
-        await mkdir3(dirname4(to), { recursive: true });
-        await rename(from, to);
+        await mkdir4(dirname5(to), { recursive: true });
+        await rename2(from, to);
         return { ok: true, path: to };
       }
       case "delete": {
         const target = resolveInRoot3(root, req.path ?? "");
         if (!target) return escaped(req.path ?? "");
-        if (target === resolve4(root)) return { ok: false, path: target, error: "cannot delete the project root" };
-        await rm(target, { recursive: true, force: true });
+        if (target === resolve5(root)) return { ok: false, path: target, error: "cannot delete the project root" };
+        await rm2(target, { recursive: true, force: true });
         return { ok: true, path: target };
       }
       default:
@@ -38009,12 +38350,12 @@ async function mutateFs(root, req) {
 }
 
 // src/core/fs-transfer.ts
-import { mkdir as mkdir4, readFile as readFile4, stat as stat2, writeFile as writeFile4 } from "fs/promises";
-import { basename as basename4, dirname as dirname5, extname, resolve as resolve5, sep as sep6 } from "path";
+import { mkdir as mkdir5, readFile as readFile4, stat as stat2, writeFile as writeFile5 } from "fs/promises";
+import { basename as basename4, dirname as dirname6, extname, resolve as resolve6, sep as sep6 } from "path";
 function resolveInRoot4(root, relPath) {
   if (!root) return null;
-  const base = resolve5(root);
-  const target = resolve5(base, relPath || ".");
+  const base = resolve6(root);
+  const target = resolve6(base, relPath || ".");
   return target === base || target.startsWith(base + sep6) ? target : null;
 }
 var MIME_BY_EXT = {
@@ -38053,8 +38394,8 @@ async function uploadBinaryFile(root, relPath, contentBase64) {
     return { ok: false, path: target, bytes: 0, error: `file too large (max ${FS_TRANSFER_MAX_BYTES} bytes)` };
   }
   try {
-    await mkdir4(dirname5(target), { recursive: true });
-    await writeFile4(target, buf);
+    await mkdir5(dirname6(target), { recursive: true });
+    await writeFile5(target, buf);
     return { ok: true, path: target, bytes: buf.byteLength };
   } catch (err) {
     return { ok: false, path: target, bytes: 0, error: err instanceof Error ? err.message : String(err) };
@@ -38129,14 +38470,14 @@ function handleFsChannels(ctx, message, payload) {
 
 // src/core/git-diff.ts
 import { readFile as readFile5 } from "fs/promises";
-import { execFile as execFile4 } from "child_process";
-import { basename as basename5, dirname as dirname6, resolve as resolve6, sep as sep7 } from "path";
-import { promisify as promisify4 } from "util";
-var run4 = promisify4(execFile4);
+import { execFile as execFile6 } from "child_process";
+import { basename as basename5, dirname as dirname7, resolve as resolve7, sep as sep7 } from "path";
+import { promisify as promisify6 } from "util";
+var run6 = promisify6(execFile6);
 function resolveInRoot5(root, relPath) {
   if (!root) return null;
-  const base = resolve6(root);
-  const target = resolve6(base, relPath || ".");
+  const base = resolve7(root);
+  const target = resolve7(base, relPath || ".");
   return target === base || target.startsWith(base + sep7) ? target : null;
 }
 function looksBinary(buf) {
@@ -38151,7 +38492,7 @@ async function gitDiff(root, path) {
   if (!target) {
     return { path, oldContent: "", newContent: "", isBinary: false };
   }
-  const dir2 = dirname6(target);
+  const dir2 = dirname7(target);
   const base = basename5(target);
   let newBuf = null;
   try {
@@ -38160,7 +38501,7 @@ async function gitDiff(root, path) {
   }
   let oldBuf = null;
   try {
-    const { stdout } = await run4("git", ["show", `HEAD:./${base}`], {
+    const { stdout } = await run6("git", ["show", `HEAD:./${base}`], {
       cwd: dir2,
       timeout: 15e3,
       maxBuffer: FS_TRANSFER_MAX_BYTES + 1024,
@@ -38190,12 +38531,12 @@ async function gitDiff(root, path) {
 }
 
 // src/core/git-env.ts
-import { execFile as execFile5 } from "child_process";
-import { promisify as promisify5 } from "util";
-var run5 = promisify5(execFile5);
+import { execFile as execFile7 } from "child_process";
+import { promisify as promisify7 } from "util";
+var run7 = promisify7(execFile7);
 async function hasBinary(bin, args = ["--version"]) {
   try {
-    await run5(bin, args, { timeout: 5e3 });
+    await run7(bin, args, { timeout: 5e3 });
     return true;
   } catch {
     return false;
@@ -38208,7 +38549,7 @@ async function checkGitEnv(provider) {
   let account = null;
   if (installed) {
     try {
-      const { stdout, stderr } = await run5(bin, ["auth", "status"], { timeout: 8e3 });
+      const { stdout, stderr } = await run7(bin, ["auth", "status"], { timeout: 8e3 });
       const out = `${stdout}
 ${stderr}`;
       authenticated = /logged in|logged into|✓/i.test(out);
@@ -38221,14 +38562,14 @@ ${stderr}`;
 }
 
 // src/core/git-ssh-key.ts
-import { execFile as execFile6 } from "child_process";
-import { readFile as readFile6, rm as rm2, mkdir as mkdir5 } from "fs/promises";
-import { join as join17 } from "path";
-import { promisify as promisify6 } from "util";
-var run6 = promisify6(execFile6);
+import { execFile as execFile8 } from "child_process";
+import { readFile as readFile6, rm as rm3, mkdir as mkdir6 } from "fs/promises";
+import { join as join18 } from "path";
+import { promisify as promisify8 } from "util";
+var run8 = promisify8(execFile8);
 function keyPaths(profileDir2) {
-  const dir2 = join17(profileDir2, ".ssh");
-  const key = join17(dir2, "id_4pm");
+  const dir2 = join18(profileDir2, ".ssh");
+  const key = join18(dir2, "id_4pm");
   return { dir: dir2, key, pub: `${key}.pub` };
 }
 async function readPublicKey(pub) {
@@ -38240,14 +38581,14 @@ async function readPublicKey(pub) {
 }
 async function fingerprintOf(pub) {
   try {
-    const { stdout } = await run6("ssh-keygen", ["-lf", pub], { timeout: 5e3 });
+    const { stdout } = await run8("ssh-keygen", ["-lf", pub], { timeout: 5e3 });
     return stdout.match(/SHA256:[A-Za-z0-9+/=]+/)?.[0] ?? null;
   } catch {
     return null;
   }
 }
 async function configureGit(key) {
-  await run6(
+  await run8(
     "git",
     ["config", "--global", "core.sshCommand", `ssh -i ${key} -o IdentitiesOnly=yes`],
     { timeout: 5e3 }
@@ -38255,10 +38596,10 @@ async function configureGit(key) {
 }
 async function generate(profileDir2) {
   const { dir: dir2, key, pub } = keyPaths(profileDir2);
-  await mkdir5(dir2, { recursive: true });
-  await rm2(key, { force: true });
-  await rm2(pub, { force: true });
-  await run6("ssh-keygen", ["-t", "ed25519", "-f", key, "-N", "", "-C", "4pm-deploy-key"], {
+  await mkdir6(dir2, { recursive: true });
+  await rm3(key, { force: true });
+  await rm3(pub, { force: true });
+  await run8("ssh-keygen", ["-t", "ed25519", "-f", key, "-N", "", "-C", "4pm-deploy-key"], {
     timeout: 15e3
   });
   await configureGit(key);
@@ -38266,9 +38607,9 @@ async function generate(profileDir2) {
 }
 async function remove(profileDir2) {
   const { key, pub } = keyPaths(profileDir2);
-  await rm2(key, { force: true });
-  await rm2(pub, { force: true });
-  await run6("git", ["config", "--global", "--unset", "core.sshCommand"], { timeout: 5e3 }).catch(
+  await rm3(key, { force: true });
+  await rm3(pub, { force: true });
+  await run8("git", ["config", "--global", "--unset", "core.sshCommand"], { timeout: 5e3 }).catch(
     () => void 0
   );
   return { publicKey: null, fingerprint: null };
@@ -38289,22 +38630,22 @@ async function manageSshKey(op, profileDir2) {
 }
 
 // src/core/git-history.ts
-import { readdir as readdir3 } from "fs/promises";
-import { execFile as execFile7 } from "child_process";
-import { resolve as resolve7, sep as sep8 } from "path";
-import { promisify as promisify7 } from "util";
-var run7 = promisify7(execFile7);
+import { readdir as readdir4 } from "fs/promises";
+import { execFile as execFile9 } from "child_process";
+import { resolve as resolve8, sep as sep8 } from "path";
+import { promisify as promisify9 } from "util";
+var run9 = promisify9(execFile9);
 var FS = "";
 var RS = "";
 function resolveRepo(root, repo) {
   if (!root) return null;
-  const base = resolve7(root);
-  const requested = resolve7(base, repo && repo.trim() ? repo : ".");
+  const base = resolve8(root);
+  const requested = resolve8(base, repo && repo.trim() ? repo : ".");
   return requested === base || requested.startsWith(base + sep8) ? requested : base;
 }
 async function git(cwd2, args) {
   try {
-    const { stdout } = await run7("git", args, {
+    const { stdout } = await run9("git", args, {
       cwd: cwd2,
       timeout: 15e3,
       maxBuffer: 8 * 1024 * 1024
@@ -38316,7 +38657,7 @@ async function git(cwd2, args) {
 }
 async function gitRepos(root) {
   if (!root) return { repos: [] };
-  const base = resolve7(root);
+  const base = resolve8(root);
   const found = /* @__PURE__ */ new Set();
   const repos = [];
   const add = async (dir2) => {
@@ -38330,16 +38671,16 @@ async function gitRepos(root) {
   };
   await add(base);
   try {
-    const lvl1 = await readdir3(base, { withFileTypes: true });
+    const lvl1 = await readdir4(base, { withFileTypes: true });
     for (const d of lvl1) {
       if (!d.isDirectory() || d.name === ".git" || d.name === "node_modules") continue;
-      const p1 = resolve7(base, d.name);
+      const p1 = resolve8(base, d.name);
       await add(p1);
       try {
-        const lvl2 = await readdir3(p1, { withFileTypes: true });
+        const lvl2 = await readdir4(p1, { withFileTypes: true });
         for (const d2 of lvl2) {
           if (!d2.isDirectory() || d2.name === ".git" || d2.name === "node_modules") continue;
-          await add(resolve7(p1, d2.name));
+          await add(resolve8(p1, d2.name));
         }
       } catch {
       }
@@ -38457,79 +38798,7 @@ function handleGitChannels(ctx, message, payload) {
 }
 
 // src/core/ws-client/handlers/misc.ts
-import { join as join18 } from "path";
-
-// src/core/ai-assist.ts
-import { execFile as execFile8 } from "child_process";
-import { promisify as promisify8 } from "util";
-var run8 = promisify8(execFile8);
-function aiCli() {
-  return process.env.AI_CLI || "claude";
-}
-function aiArgs(cli, prompt) {
-  if (cli === "claude") return ["-p", prompt, "--output-format", "json"];
-  if (cli === "codex") return ["exec", "--json", prompt];
-  return ["-p", prompt];
-}
-function estimateTokens2(prompt, output) {
-  return Math.max(1, Math.ceil((prompt.length + output.length) / 4));
-}
-function parseAi(cli, stdout, prompt) {
-  if (cli === "claude") {
-    try {
-      const j = JSON.parse(stdout);
-      const text2 = (j.result ?? "").trim();
-      const tokens = (j.usage?.input_tokens ?? 0) + (j.usage?.output_tokens ?? 0);
-      if (text2 || tokens) return { text: text2, tokens: tokens || estimateTokens2(prompt, text2) };
-    } catch {
-    }
-  }
-  if (cli === "codex") {
-    try {
-      let text2 = "";
-      let tokens = 0;
-      for (const line of stdout.split("\n").filter(Boolean)) {
-        const obj = JSON.parse(line);
-        if (obj.text) text2 = obj.text;
-        else if (obj.message) text2 = obj.message;
-        if (obj.usage) {
-          tokens = obj.usage.total_tokens ?? (obj.usage.input_tokens ?? 0) + (obj.usage.output_tokens ?? 0);
-        }
-      }
-      if (text2 || tokens) return { text: text2.trim(), tokens: tokens || estimateTokens2(prompt, text2) };
-    } catch {
-    }
-  }
-  const text = stdout.trim();
-  return { text, tokens: estimateTokens2(prompt, text) };
-}
-async function runAi(prompt) {
-  const cli = aiCli();
-  const { stdout } = await run8(cli, aiArgs(cli, prompt), {
-    timeout: 12e4,
-    maxBuffer: 8 * 1024 * 1024
-  });
-  return parseAi(cli, stdout, prompt);
-}
-async function aiGenerate(prompt) {
-  const { text } = await runAi(prompt);
-  return text;
-}
-async function aiOutboundReview(input, allowedRepos, projectPath) {
-  const prompt = `You are a security reviewer for an autonomous coding agent. Decide if the following INPUT is SAFE to run. It is UNSAFE if it: (1) asks the AI using secret VALUES (api keys, env values, passwords); (2) would affect other environments (only the sandbox project is allowed, no ssh/deploy/prod); (3) edits outside the project folder "${projectPath}"; (4) commits/pushes to a repo not in this allowlist: ${allowedRepos.length ? allowedRepos.join(", ") : "(none declared)"}. Reply with ONLY JSON: {"ok": <true|false>, "reasons": ["secret"|"environment"|"path"|"repo", ...]}. INPUT:
-${input}`;
-  const { text, tokens } = await runAi(prompt);
-  const start = text.indexOf("{");
-  const end = text.lastIndexOf("}");
-  if (start < 0 || end <= start) return { ok: false, reasons: ["ai_parse"], tokens };
-  try {
-    const j = JSON.parse(text.slice(start, end + 1));
-    const reasons = Array.isArray(j.reasons) ? j.reasons.filter((r) => typeof r === "string") : [];
-    return { ok: j.ok === true && reasons.length === 0, reasons, tokens };
-  } catch {
-    return { ok: false, reasons: ["ai_parse"], tokens };
-  }
-}
+import { join as join19 } from "path";
 
 // src/core/outbound-review.ts
 function compilePatterns(sources, fallback) {
@@ -38605,9 +38874,13 @@ async function evaluateReview(payload) {
 // src/core/ws-client/handlers/misc.ts
 function handleMiscChannels(ctx, message, payload) {
   switch (message.channel) {
+    case WsChannels.CLI_UPDATE: {
+      ctx.updateCliNow();
+      return true;
+    }
     case WsChannels.LOG_READ: {
       const limit = Math.min(Math.max(payload.limit ?? 200, 1), 2e3);
-      const lines = readRecentLogLines(join18(ctx.profileDir, "logs"), limit);
+      const lines = readRecentLogLines(join19(ctx.profileDir, "logs"), limit);
       ctx.send(WsChannels.LOG_READ, { lines }, message.id);
       return true;
     }
@@ -38640,161 +38913,6 @@ function handleMiscChannels(ctx, message, payload) {
 // src/core/ws-client/handlers/project.ts
 import { existsSync as existsSync13, mkdirSync as mkdirSync6, renameSync, rmSync as rmSync6 } from "fs";
 import { join as join20 } from "path";
-
-// src/core/scaffold.ts
-import { cp, mkdir as mkdir6, writeFile as writeFile5 } from "fs/promises";
-import { existsSync as existsSync12 } from "fs";
-import { execFile as execFile9 } from "child_process";
-import { dirname as dirname7, join as join19, resolve as resolve8 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
-import { promisify as promisify9 } from "util";
-var run9 = promisify9(execFile9);
-function reposOf(spec) {
-  const repos = spec?.repos;
-  return Array.isArray(repos) ? repos : [];
-}
-function subDirName(repo) {
-  const raw = (repo.subdir || repo.role || repoName(repo.url ?? "") || "repo").trim();
-  return raw.replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "") || "repo";
-}
-async function provisionRepos(target, repos, emit, opts = {}) {
-  for (const repo of repos) {
-    if (repo.primary) {
-      if (opts.clonePrimary && repo.url) {
-        if (existsSync12(join19(target, ".git"))) {
-          emit("git", `Primary repo already present \u2014 skipping clone.`);
-          continue;
-        }
-        emit("git", `Cloning ${repo.url}\u2026`);
-        await run9("git", ["clone", repo.url, target], { timeout: 12e4 });
-        continue;
-      }
-      emit("git", "Initializing the primary repo\u2026");
-      await run9("git", ["init"], { cwd: target, timeout: 2e4 });
-      if (repo.url) {
-        await run9("git", ["remote", "add", "origin", repo.url], { cwd: target, timeout: 2e4 }).catch(
-          () => void 0
-        );
-      }
-      continue;
-    }
-    const dir2 = join19(target, subDirName(repo));
-    if (repo.url) {
-      if (existsSync12(join19(dir2, ".git"))) {
-        emit("git", `Sub-repo ${subDirName(repo)} already present \u2014 skipping clone.`);
-        continue;
-      }
-      emit("git", `Cloning sub-repo ${repo.url}\u2026`);
-      await run9("git", ["clone", repo.url, dir2], { timeout: 12e4 });
-    } else {
-      emit("git", `Initializing sub-repo ${subDirName(repo)}\u2026`);
-      await mkdir6(dir2, { recursive: true });
-      await run9("git", ["init"], { cwd: dir2, timeout: 2e4 });
-    }
-  }
-}
-function sampleDir() {
-  if (process.env.SCAFFOLD_SAMPLE_DIR) return process.env.SCAFFOLD_SAMPLE_DIR;
-  const here = dirname7(fileURLToPath3(import.meta.url));
-  const bundled = resolve8(here, "project-sample");
-  for (const candidate of [bundled, resolve8(here, "../project-sample"), resolve8(here, "../../project-sample")]) {
-    if (existsSync12(candidate)) return candidate;
-  }
-  return bundled;
-}
-async function scaffoldProject(payload, profileDir2, onProgress) {
-  let lastStep = "start";
-  const emit = (step, message) => {
-    lastStep = step;
-    onProgress?.({ projectId: payload.projectId, step, message });
-  };
-  try {
-    const root = process.env.SCAFFOLD_ROOT ? resolve8(process.env.SCAFFOLD_ROOT) : resolve8(profileDir2);
-    const target = join19(root, payload.projectName);
-    await mkdir6(target, { recursive: true });
-    emit("copy", "Copying the sample template\u2026");
-    await cp(sampleDir(), target, { recursive: true, force: false, errorOnExist: false });
-    if (payload.spec) {
-      emit("spec", "Writing project.spec.json\u2026");
-      await writeFile5(
-        join19(target, "project.spec.json"),
-        JSON.stringify(payload.spec, null, 2),
-        "utf8"
-      );
-    }
-    const repos = reposOf(payload.spec);
-    if (repos.length > 0) await provisionRepos(target, repos, emit);
-    if (payload.spec) await aiInit(target, payload.spec, emit);
-    emit("version", "Writing .4pm/.4pm.json\u2026");
-    await writeTemplateMarker(target);
-    onProgress?.({ projectId: payload.projectId, step: "done", message: "Scaffold complete.", done: true });
-    return { ok: true, path: target };
-  } catch (err) {
-    return { ok: false, error: err instanceof Error ? err.message : String(err), step: lastStep };
-  }
-}
-async function writeTemplateMarker(target) {
-  const dir2 = join19(target, ".4pm");
-  await mkdir6(dir2, { recursive: true });
-  const marker = { templateVersion: PROJECT_TEMPLATE.version, scaffoldedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  await writeFile5(join19(dir2, ".4pm.json"), JSON.stringify(marker, null, 2) + "\n", "utf8");
-}
-async function aiInit(target, spec, emit) {
-  emit("ai-init", "AI init: subagents, README, CLAUDE.md\u2026");
-  const subagents = Array.isArray(spec.subagents) ? spec.subagents : [];
-  if (subagents.length > 0) {
-    await mkdir6(join19(target, ".claude", "agents"), { recursive: true });
-    for (const sa of subagents) {
-      const name = (sa.name || "").trim().replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "");
-      if (!name) continue;
-      const body = `---
-name: ${name}
----
-
-${(sa.description || "").trim()}
-`;
-      await writeFile5(join19(target, ".claude", "agents", `${name}.md`), body, "utf8");
-    }
-  }
-  const specJson = JSON.stringify(spec);
-  await generateFile(
-    join19(target, "README.md"),
-    `Write a concise README.md (Markdown only, no preamble) for this project from its spec JSON:
-${specJson}`
-  );
-  await generateFile(
-    join19(target, "CLAUDE.md"),
-    `Write a CLAUDE.md (Markdown only, no preamble) with guidance/conventions for AI agents working in this project, derived from its spec JSON:
-${specJson}`
-  );
-}
-async function generateFile(path, prompt) {
-  try {
-    const text = await aiGenerate(prompt);
-    if (text.trim()) await writeFile5(path, text.trim() + "\n", "utf8");
-  } catch {
-  }
-}
-async function addProject(payload, profileDir2, onProgress) {
-  let lastStep = "start";
-  const emit = (step, message) => {
-    lastStep = step;
-    onProgress?.({ projectId: payload.projectId, step, message });
-  };
-  try {
-    const root = process.env.SCAFFOLD_ROOT ? resolve8(process.env.SCAFFOLD_ROOT) : resolve8(profileDir2);
-    const target = join19(root, payload.projectName);
-    await mkdir6(target, { recursive: true });
-    const repos = payload.repos ?? [];
-    if (repos.length > 0) await provisionRepos(target, repos, emit, { clonePrimary: true });
-    onProgress?.({ projectId: payload.projectId, step: "done", message: "Project added.", done: true });
-    return { ok: true, path: target };
-  } catch (err) {
-    return { ok: false, error: err instanceof Error ? err.message : String(err), step: lastStep };
-  }
-}
-
-// src/core/ws-client/handlers/project.ts
 function handleProjectChannels(ctx, message, payload) {
   switch (message.channel) {
     case WsChannels.PHYSIC_SYNC: {
@@ -38815,6 +38933,7 @@ function handleProjectChannels(ctx, message, payload) {
       ctx.physicRoot = ctx.physicFolderPath(sync.newName);
       ctx.bus.setProject(sync.newName);
       ctx.bus.log(t("project.folderSynced", { name: sync.newName }));
+      void ctx.cloneServingRepos().catch(() => void 0);
       return true;
     }
     case WsChannels.PHYSIC_DELETE: {
@@ -39088,7 +39207,7 @@ function handleToolsChannels(ctx, message, payload) {
 }
 
 // src/core/agents.ts
-import { readFile as readFile7, writeFile as writeFile6, mkdir as mkdir7, readdir as readdir4, rm as rm3 } from "fs/promises";
+import { readFile as readFile7, writeFile as writeFile6, mkdir as mkdir7, readdir as readdir5, rm as rm4 } from "fs/promises";
 import { join as join21 } from "path";
 var AGENTS_REL = ".claude/agents";
 var SKILLS_REL = ".claude/skills";
@@ -39113,7 +39232,7 @@ async function listAgents(root) {
   const subagents = [];
   const skills = [];
   try {
-    for (const e of await readdir4(join21(root, AGENTS_REL), { withFileTypes: true })) {
+    for (const e of await readdir5(join21(root, AGENTS_REL), { withFileTypes: true })) {
       if (!e.isFile() || !e.name.endsWith(".md") || MEMORY_DIRS.has(e.name)) continue;
       const fm = frontmatter(await readText2(join21(root, AGENTS_REL, e.name)));
       subagents.push({ name: e.name.replace(/\.md$/, ""), description: fm.description });
@@ -39121,7 +39240,7 @@ async function listAgents(root) {
   } catch {
   }
   try {
-    for (const e of await readdir4(join21(root, SKILLS_REL), { withFileTypes: true })) {
+    for (const e of await readdir5(join21(root, SKILLS_REL), { withFileTypes: true })) {
       if (!e.isDirectory()) continue;
       const fm = frontmatter(await readText2(join21(root, SKILLS_REL, e.name, "SKILL.md")));
       skills.push({ name: e.name, description: fm.description });
@@ -39151,8 +39270,8 @@ async function writeAgent(root, req) {
   if (!n) return { ok: false, error: "invalid name" };
   try {
     if (req.action === "delete") {
-      if (req.kind === "subagent") await rm3(itemPath(root, "subagent", n), { force: true });
-      else await rm3(join21(root, SKILLS_REL, n), { recursive: true, force: true });
+      if (req.kind === "subagent") await rm4(itemPath(root, "subagent", n), { force: true });
+      else await rm4(join21(root, SKILLS_REL, n), { recursive: true, force: true });
       return { ok: true };
     }
     if (req.content === void 0) return { ok: false, error: "content is required" };
@@ -39273,7 +39392,7 @@ async function writeAgentTools(root, scope, permissions) {
 
 // src/core/packages.ts
 import { createHash as createHash4 } from "crypto";
-import { readFile as readFile10, writeFile as writeFile9, mkdir as mkdir9, readdir as readdir5, rm as rm4, stat as stat3 } from "fs/promises";
+import { readFile as readFile10, writeFile as writeFile9, mkdir as mkdir9, readdir as readdir6, rm as rm5, stat as stat3 } from "fs/promises";
 import { dirname as dirname9, join as join24, relative } from "path";
 var AGENTS_REL2 = ".claude/agents";
 var SKILLS_REL2 = ".claude/skills";
@@ -39293,7 +39412,7 @@ async function listFilesRel(dir2) {
   async function walk2(d) {
     let entries2;
     try {
-      entries2 = await readdir5(d, { withFileTypes: true });
+      entries2 = await readdir6(d, { withFileTypes: true });
     } catch {
       return;
     }
@@ -39446,11 +39565,11 @@ async function removePackage(root, slug) {
     const entry = manifest[n];
     if (!entry) return { ok: false, error: "not installed" };
     if (entry.kind === "subagent") {
-      await rm4(join24(root, AGENTS_REL2, `${n}.md`), { force: true });
-      await rm4(join24(root, AGENTS_REL2, "short-memory", `${n}.md`), { force: true });
-      await rm4(join24(root, AGENTS_REL2, "long-memory", `${n}.md`), { force: true });
+      await rm5(join24(root, AGENTS_REL2, `${n}.md`), { force: true });
+      await rm5(join24(root, AGENTS_REL2, "short-memory", `${n}.md`), { force: true });
+      await rm5(join24(root, AGENTS_REL2, "long-memory", `${n}.md`), { force: true });
     } else {
-      await rm4(join24(root, SKILLS_REL2, n), { recursive: true, force: true });
+      await rm5(join24(root, SKILLS_REL2, n), { recursive: true, force: true });
     }
     delete manifest[n];
     await writeManifest(root, manifest);
@@ -39461,7 +39580,7 @@ async function removePackage(root, slug) {
 }
 
 // src/core/graph.ts
-import { readFile as readFile11, readdir as readdir6 } from "fs/promises";
+import { readFile as readFile11, readdir as readdir7 } from "fs/promises";
 import { join as join25, relative as relative2, dirname as dirname10, resolve as resolve9, extname as extname2, basename as basename6 } from "path";
 var MAX_FILES = 2e3;
 var MAX_NODES = 3e3;
@@ -39474,7 +39593,7 @@ async function walk(root, accept) {
     const dir2 = stack.pop();
     let entries2;
     try {
-      entries2 = await readdir6(dir2, { withFileTypes: true });
+      entries2 = await readdir7(dir2, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -40170,6 +40289,9 @@ var WsClient = class {
   /** The physic project folder root this cli serves (null = no project) — fs.list is
    *  scoped to it so the web FsPicker can only browse inward, never out. */
   physicRoot = null;
+  /** Declared repos of the served project (ADR-0289), from each ws_token — cloned into the physic
+   *  root on connect (and after a PHYSIC_SYNC creates the folder) when any is missing its `.git`. */
+  servingRepos = [];
   /** This machine-user's username — the git commit author for this project (ADR-0097).
    *  Push uses the account already logged in with gh/glab on the worker. */
   machineUsername = "";
@@ -40287,9 +40409,24 @@ var WsClient = class {
       setConsoleWatching: (on) => self.setConsoleWatching(on),
       setMetricsWatching: (on) => self.setMetricsWatching(on),
       ensurePhysicFolderPath: (folder) => self.ensurePhysicFolderPath(folder),
-      physicFolderPath: (projectName) => self.physicFolderPath(projectName)
+      physicFolderPath: (projectName) => self.physicFolderPath(projectName),
+      cloneServingRepos: () => self.ensureServingReposCloned(),
+      updateCliNow: () => self.updateScheduler.updateNow()
     };
   }
+  /**
+   * Clone any declared repo missing from the served physic root (ADR-0289) — idempotent (skips a
+   * repo that already has `.git`). Best-effort: a clone failure never disrupts the session (the web
+   * still surfaces "not provisioned"). No-op when idle (no physic root) or no repos declared.
+   */
+  async ensureServingReposCloned() {
+    if (!this.physicRoot || this.servingRepos.length === 0) return;
+    try {
+      await ensureReposCloned(this.physicRoot, this.servingRepos, (_step, message) => this.bus.log(message));
+    } catch (err) {
+      logger.warn("repos.clone.failed", { error: err instanceof Error ? err.message : String(err) });
+    }
+  }
   /**
    * Detect the worker's tools and report the snapshot to the server (ADR-0254, `tools.report`) so the
    * DB-backed Tools panel + restore target stay current. One-way, best-effort — a detect/send failure
@@ -40473,6 +40610,8 @@ var WsClient = class {
         this.restrictToFolder = token.aiRestrictToFolder === true;
         applyGitAuth(token.gitAuth ?? null);
         this.machineUsername = token.machineUsername ?? "";
+        this.servingRepos = token.repos ?? [];
+        void this.ensureServingReposCloned();
         if (token.scope && token.scope !== this.credential.scope) {
           this.credential.scope = token.scope;
           writeCredential(this.context.profileDir, this.credential);