@agentbridge1/cli 0.0.1

package/dist/commands/watch.js

@@ -0,0 +1,1718 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDirtyWorkingTreeFiles = void 0;
+exports.renderScopedApprovalConfirmation = renderScopedApprovalConfirmation;
+exports.renderCrossingContext = renderCrossingContext;
+exports.shouldRenderSupervisionSummary = shouldRenderSupervisionSummary;
+exports.syncAndBuildSupervisionSnapshot = syncAndBuildSupervisionSnapshot;
+exports.renderWatchTaskScopeUsage = renderWatchTaskScopeUsage;
+exports.renderWatchStartupHeader = renderWatchStartupHeader;
+exports.buildWatchBlockingIssue = buildWatchBlockingIssue;
+exports.renderWatchBlockingIssue = renderWatchBlockingIssue;
+exports.overlayLocalChangedFilesOnSupervision = overlayLocalChangedFilesOnSupervision;
+exports.isHandoffRequiredCloseError = isHandoffRequiredCloseError;
+exports.renderIdleCloseFailure = renderIdleCloseFailure;
+exports.openOrResumeServerSessionForWatch = openOrResumeServerSessionForWatch;
+exports.normalizeDirtyWorkingTreeFiles = normalizeDirtyWorkingTreeFiles;
+exports.ensureWatchRepoClean = ensureWatchRepoClean;
+exports.runWatch = runWatch;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_process_1 = require("node:process");
+const promises_1 = require("node:readline/promises");
+const node_child_process_1 = require("node:child_process");
+const config_1 = require("../config");
+const errors_1 = require("../errors");
+const authority_request_1 = require("../authority-request");
+const domain_resolution_1 = require("../domain-resolution");
+const briefing_1 = require("../briefing");
+const session_1 = require("../session");
+const session_state_1 = require("../session-state");
+const watch_core_1 = require("../watch-core");
+const watcher_1 = require("../watcher");
+const server_sync_1 = require("../server-sync");
+const watch_packet_handshake_1 = require("../watch-packet-handshake");
+const work_context_resolver_1 = require("../work-context-resolver");
+const test_runner_1 = require("../test-runner");
+const revert_crossing_1 = require("../revert-crossing");
+const supervision_1 = require("../supervision");
+const http_1 = require("../http");
+const error_catalog_1 = require("../error-catalog");
+const session_state_2 = require("../session-state");
+const file_fingerprints_1 = require("../file-fingerprints");
+const start_1 = require("./start");
+const gates_1 = require("../gates");
+const git_status_1 = require("../git-status");
+Object.defineProperty(exports, "getDirtyWorkingTreeFiles", { enumerable: true, get: function () { return git_status_1.getDirtyWorkingTreeFiles; } });
+const IDLE_CLOSE_MS = 5_000;
+const WATCH_STARTUP_TIMEOUT_MS = 12_000;
+const WATCH_START_TASK_TIMEOUT_MS = 60_000;
+function acceptanceRolloutOptionsFromGates(gates) {
+    return {
+        rolloutProofTooWeak: gates.rollout_proof_too_weak,
+        rolloutProofNotRelevant: gates.rollout_proof_not_relevant,
+        rolloutImpactCoverageGap: gates.rollout_impact_coverage_gap,
+    };
+}
+function createWatchTimingTracker() {
+    const enabled = process.env.AGENTBRIDGE_TIMING === "1";
+    const totals = new Map();
+    const totalStart = process.hrtime.bigint();
+    const add = (phase, elapsedMs) => {
+        totals.set(phase, (totals.get(phase) ?? 0) + elapsedMs);
+    };
+    const nowMs = () => Number(process.hrtime.bigint()) / 1_000_000;
+    return {
+        trackSync(phase, work) {
+            if (!enabled)
+                return work();
+            const started = nowMs();
+            try {
+                return work();
+            }
+            finally {
+                add(phase, nowMs() - started);
+            }
+        },
+        async trackAsync(phase, work) {
+            if (!enabled)
+                return work();
+            const started = nowMs();
+            try {
+                return await work();
+            }
+            finally {
+                add(phase, nowMs() - started);
+            }
+        },
+        flushTotal() {
+            if (!enabled)
+                return;
+            const totalMs = Number(process.hrtime.bigint() - totalStart) / 1_000_000;
+            add("total", totalMs);
+            for (const [phase, elapsed] of totals.entries()) {
+                process.stdout.write(`[agentbridge:timing] ${phase}=${Math.round(elapsed)}ms\n`);
+            }
+        },
+    };
+}
+function renderScopedApprovalConfirmation(agent, file, domain) {
+    return `Approved scoped crossing: ${agent} may modify ${file} for this session only. No wider ${domain ?? "target"} authority granted.`;
+}
+function renderCrossingContext(input) {
+    return [
+        "Crossing context:",
+        `- current task: ${input.changeRequestId ?? "unknown"}`,
+        `- active run: ${input.workSessionId}`,
+        `- worker: ${input.worker}`,
+        `- claimed lane/domain: ${input.claimedLaneDomain ?? "unclassified"}`,
+        `- touched domain: ${input.touchedDomain ?? "unknown"}`,
+        `- file: ${input.file}`,
+        `- tier: ${input.tier}`,
+        "- required action: approve, handoff, limit, deny, abandon, or revert",
+    ].join("\n");
+}
+function shouldRenderSupervisionSummary(lastSignature, snapshot) {
+    const nextSignature = (0, supervision_1.supervisionSignature)(snapshot);
+    return {
+        shouldRender: nextSignature !== lastSignature,
+        nextSignature,
+    };
+}
+async function syncAndBuildSupervisionSnapshot(input) {
+    const { ctx, state, cfgDomains, changedFile, outcome, changeRequestId, unresolvedProtectedCrossing, rollout, timing, } = input;
+    const contextError = (err) => (err instanceof Error ? err.message : String(err));
+    if (!state.serverSessionId || !ctx) {
+        return {
+            supervision: (0, supervision_1.fallbackSupervisionSnapshot)({
+                workSessionId: state.serverSessionId ?? state.id,
+                changeRequestId,
+                changedFiles: [...state.changedFiles],
+                domains: cfgDomains,
+                unresolvedProtectedCrossing,
+                blocked: state.status === "blocked",
+            }),
+            acceptanceReport: null,
+        };
+    }
+    const serverSessionId = state.serverSessionId;
+    let syncError;
+    const syncDiff = () => (0, server_sync_1.postObservedDiff)(ctx, { workSessionId: serverSessionId }, {
+        activeLaneDomain: state.laneDomain ?? null,
+        sourceHead: (() => {
+            try {
+                return (0, node_child_process_1.execFileSync)("git", ["rev-parse", "HEAD"], {
+                    stdio: ["ignore", "pipe", "ignore"],
+                })
+                    .toString("utf8")
+                    .trim();
+            }
+            catch {
+                return undefined;
+            }
+        })(),
+        changedFiles: [...state.changedFiles],
+        fileFingerprints: (0, file_fingerprints_1.computeFileFingerprints)(state.changedFiles),
+        changedFileEntries: [
+            {
+                path: changedFile,
+                status: "modified",
+                owningDomain: outcome.crossingDomain ?? state.laneDomain ?? null,
+                activeLaneDomain: state.laneDomain ?? null,
+                crossing: Boolean(outcome.crossingDomain) && outcome.crossingDomain !== state.laneDomain,
+                severity: outcome.crossingTier,
+            },
+        ],
+        boundaryCrossings: outcome.crossingDomain && state.laneDomain && outcome.crossingDomain !== state.laneDomain
+            ? [
+                {
+                    file: changedFile,
+                    fromDomain: state.laneDomain,
+                    toDomain: outcome.crossingDomain,
+                    severity: outcome.crossingTier,
+                },
+            ]
+            : [],
+    });
+    try {
+        if (timing) {
+            await timing.trackAsync("observed_diff_sync", syncDiff);
+        }
+        else {
+            await syncDiff();
+        }
+    }
+    catch (err) {
+        syncError = contextError(err);
+    }
+    const fetchAcceptance = () => (0, server_sync_1.fetchAcceptanceCheck)(ctx, { workSessionId: serverSessionId, ...rollout });
+    try {
+        const report = timing
+            ? await timing.trackAsync("acceptance_check_fetch", fetchAcceptance)
+            : await fetchAcceptance();
+        return {
+            supervision: overlayLocalChangedFilesOnSupervision((0, supervision_1.supervisionFromAcceptance)(report, cfgDomains), state.changedFiles),
+            syncError,
+            acceptanceReport: report,
+        };
+    }
+    catch (err) {
+        return {
+            supervision: (0, supervision_1.fallbackSupervisionSnapshot)({
+                workSessionId: state.serverSessionId ?? state.id,
+                changeRequestId,
+                changedFiles: [...state.changedFiles],
+                domains: cfgDomains,
+                unresolvedProtectedCrossing,
+                blocked: state.status === "blocked",
+                serverAcceptanceUnavailable: contextError(err),
+            }),
+            syncError,
+            acceptanceReport: null,
+        };
+    }
+}
+function normalizeInline(value) {
+    return value.trim().replaceAll("\\", "/");
+}
+function normalizeTaskSummary(value) {
+    return value.trim().replace(/\s+/g, " ").toLowerCase();
+}
+function isActiveLocalSession(state) {
+    return Boolean(state && state.status !== "closed" && state.id !== "none");
+}
+function renderWatchTaskScopeUsage() {
+    return [
+        "Usage:",
+        "  agentbridge watch",
+    ].join("\n");
+}
+function parseTaskScopeInput(options) {
+    const task = options.task?.trim();
+    const scope = options.scope?.trim();
+    return {
+        ...(task ? { task } : {}),
+        ...(scope ? { scope } : {}),
+    };
+}
+function inferTaskFromFiles(files, domains) {
+    if (files.length === 0)
+        return "Inferred from changed files/current work";
+    const byDomain = new Map();
+    let docsOnly = true;
+    for (const file of files) {
+        const resolved = (0, domain_resolution_1.resolveDomainForFile)(file, domains).domain ?? "Unknown";
+        byDomain.set(resolved, (byDomain.get(resolved) ?? 0) + 1);
+        if (!file.startsWith("docs/"))
+            docsOnly = false;
+    }
+    if (docsOnly)
+        return "Editing docs files";
+    if (byDomain.size === 1) {
+        const [domain] = [...byDomain.keys()];
+        if (domain === "Unknown")
+            return "Unknown task";
+        return `Working in ${domain} domain`;
+    }
+    return "Inferred from changed files/current work";
+}
+function renderBrainstormingStatus() {
+    return [
+        "No coding changes detected yet.",
+        "Mode: brainstorming/planning",
+        "Next: When your agent starts changing files, AgentBridge will review proof/scope risk.",
+        "",
+    ].join("\n");
+}
+function renderCodingDetection(changedFiles, inferredTask) {
+    return [
+        "AgentBridge detected coding work.",
+        `Task: ${inferredTask}`,
+        "Mode: coding/implementation",
+        "Changed files:",
+        ...changedFiles.map((file) => `- ${file}`),
+        "",
+    ].join("\n");
+}
+function detectInferredDomainDrift(files, domains) {
+    if (files.length <= 1)
+        return null;
+    const touched = new Map();
+    for (const file of files) {
+        const resolved = (0, domain_resolution_1.resolveDomainForFile)(file, domains);
+        const domain = resolved.domain ?? "Unknown";
+        const tier = resolved.tier ?? "tier_d";
+        const existing = touched.get(domain);
+        touched.set(domain, existing ? { count: existing.count + 1, tier: existing.tier } : { count: 1, tier });
+    }
+    if (touched.size <= 1)
+        return null;
+    const highRisk = [...touched.values()].some((entry) => entry.tier === "tier_a" || entry.tier === "tier_b");
+    const changedFiles = [...files];
+    const issue = {
+        errorCode: "POSSIBLE_DOMAIN_DRIFT",
+        whatHappened: "Changes span multiple project areas without an explicit scope.",
+        whyItMatters: highRisk
+            ? "Cross-domain changes touching protected areas are high-risk without clear scoping."
+            : "Multi-area edits can hide accidental drift and make review harder.",
+        files: changedFiles,
+        suggestedPrompt: [
+            "AgentBridge noticed changes across multiple project areas.",
+            "Explain why these files belong to the same task, or split the work into separate steps.",
+            `Changed files: ${changedFiles.join(", ")}`,
+        ].join("\n"),
+        nextAction: highRisk
+            ? "Explain/split the work, then rerun watch."
+            : "Review intent for each area; split if needed.",
+    };
+    return { issue, blocking: highRisk };
+}
+async function resolveCurrentSessionTaskSummary(state) {
+    if (!state.changeRequestId)
+        return null;
+    try {
+        const cr = await (0, server_sync_1.getChangeRequest)((0, config_1.contextFromConfig)(), state.changeRequestId);
+        return cr.title?.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+function renderWatchStartupHeader(input) {
+    const modeLine = input.mode === "explicit"
+        ? "Mode: coding/implementation (scoped policy active)"
+        : "Mode: inferred (brainstorming/planning or coding/implementation)";
+    return [
+        "AgentBridge is watching",
+        modeLine,
+        `Task: ${input.task}`,
+        ...(input.scope ? [`Scope: ${input.scope}`] : []),
+        `Current status: ${input.currentStatus}`,
+        `Next guidance: ${input.nextGuidance}`,
+        "",
+    ].join("\n");
+}
+function renderStartupPhase(step, status) {
+    const verb = status === "starting" ? "starting" : status === "done" ? "done" : "skipped";
+    return `[startup] ${step}: ${verb}\n`;
+}
+async function withTimeout(work, timeoutMs, onTimeout) {
+    let timer = null;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => reject(onTimeout()), timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+async function flushStdout() {
+    if (process.stdout.writableNeedDrain) {
+        await new Promise((resolveDrain) => process.stdout.once("drain", resolveDrain));
+    }
+    await new Promise((resolveTick) => setImmediate(resolveTick));
+}
+function buildWatchBlockingIssue(report, options) {
+    if (options.strictScope && (report.out_of_scope_files ?? []).length > 0) {
+        const files = [...new Set(report.out_of_scope_files ?? [])];
+        return {
+            errorCode: "SCOPE_DRIFT_OUT_OF_SCOPE_FILE",
+            whatHappened: "Files were changed outside the declared scope.",
+            whyItMatters: "Out-of-scope edits can invalidate task boundaries and watch results.",
+            files,
+            suggestedPrompt: [
+                "You changed files outside the allowed scope.",
+                "Revert them, justify why they are required and ask to expand scope, or split them into a separate task.",
+                `Out-of-scope files: ${files.join(", ")}`,
+            ].join("\n"),
+            nextAction: "Revert out-of-scope files, then run: agentbridge check",
+        };
+    }
+    if (report.decision === "stale_evidence") {
+        const staleFiles = [...new Set(report.stale_files ?? report.evidence_missing ?? report.changed_files)];
+        return {
+            errorCode: "PROOF_STALE_AFTER_CHANGE",
+            whatHappened: "Verification proof is stale because files changed after the last passing verify.",
+            whyItMatters: "Acceptance needs proof that matches the final edited files.",
+            files: staleFiles,
+            suggestedPrompt: [
+                "Your proof is stale because files changed after verification.",
+                "Rerun verification after your final edit, then rerun AgentBridge watch.",
+                `Files: ${staleFiles.join(", ")}`,
+            ].join("\n"),
+            nextAction: "Run a verification command for the final changed files.",
+        };
+    }
+    if (report.decision === "failed") {
+        return {
+            errorCode: "VERIFICATION_FAILED",
+            whatHappened: "verification failed",
+            whyItMatters: "Failed verification cannot be used as acceptance proof.",
+            files: [...new Set(report.changed_files)],
+            suggestedPrompt: [
+                "The last verification command failed.",
+                "Please fix the failure and rerun verification with a passing result before handoff.",
+            ].join("\n"),
+            nextAction: "Fix verification failures, then rerun verification on final files.",
+        };
+    }
+    if (report.decision === "needs_proof") {
+        const files = [...new Set(report.changed_files)];
+        return {
+            errorCode: "PROOF_MISSING",
+            whatHappened: "No valid verification proof is attached to the current work.",
+            whyItMatters: "Work cannot be accepted without fresh proof for the current scope.",
+            files,
+            suggestedPrompt: [
+                "Your work is not ready. AgentBridge found changed files with no proof attached.",
+                "Run verification for the changed files, then rerun AgentBridge watch.",
+                `Files: ${files.join(", ") || "current files"}`,
+            ].join("\n"),
+            nextAction: "Run a verification command for the changed files.",
+        };
+    }
+    return null;
+}
+function buildFallbackWatchBlockingIssue(supervision) {
+    if (supervision.decision === "needs_proof") {
+        return {
+            errorCode: "PROOF_MISSING",
+            whatHappened: "No valid verification proof is attached to the current work.",
+            whyItMatters: "Work cannot be accepted without fresh proof for the current scope.",
+            files: [],
+            suggestedPrompt: [
+                "Your work is not ready. AgentBridge found changed files with no proof attached.",
+                "Run verification for the changed files, then rerun AgentBridge watch.",
+                `Files: ${supervision.changedFiles.length > 0 ? supervision.changedFiles.join(", ") : "current files"}`,
+            ].join("\n"),
+            nextAction: "Run a verification command for the changed files.",
+        };
+    }
+    if (supervision.decision === "failed") {
+        return {
+            errorCode: "VERIFICATION_FAILED",
+            whatHappened: "Current task run is blocked and cannot complete.",
+            whyItMatters: "Blocked runs must be resolved before the task can be marked done.",
+            files: supervision.changedFiles,
+            suggestedPrompt: [
+                "Resolve the problem in this run before completing the task.",
+                `Files in current blocked state: ${supervision.changedFiles.join(", ") || "none listed"}`,
+            ].join("\n"),
+            nextAction: "Resolve proof/scope problems, then rerun watch.",
+        };
+    }
+    return null;
+}
+function renderWatchBlockingIssue(issue) {
+    const filesLine = issue.files.length > 0 ? issue.files.join(", ") : "none listed";
+    return [
+        "AgentBridge caught an issue",
+        `What happened: ${issue.whatHappened}`,
+        `Why it matters: ${issue.whyItMatters}`,
+        `Files: ${filesLine}`,
+        `Error code: ${issue.errorCode}`,
+        "Suggested prompt to send back to agent:",
+        "```text",
+        issue.suggestedPrompt,
+        "```",
+        `Next action: ${issue.nextAction}`,
+        "",
+    ].join("\n");
+}
+function overlayLocalChangedFilesOnSupervision(supervision, localChangedFiles) {
+    if (supervision.changedFiles.length > 0 || localChangedFiles.length === 0) {
+        return supervision;
+    }
+    const nextChangedFiles = [...new Set(localChangedFiles)].sort();
+    const nextWorkType = supervision.workType === "unknown" ? (0, supervision_1.inferSupervisionWorkType)(nextChangedFiles) : supervision.workType;
+    return {
+        ...supervision,
+        changedFiles: nextChangedFiles,
+        workType: nextWorkType,
+    };
+}
+function isCrAlreadyInSessionError(err) {
+    if (!(err instanceof http_1.CliHttpError) || err.status !== 422)
+        return false;
+    return /current:\s*in_session/i.test(err.body) || /in_session/i.test(err.body);
+}
+function isHandoffRequiredCloseError(err) {
+    if (!(err instanceof http_1.CliHttpError))
+        return false;
+    if (![400, 409, 422].includes(err.status))
+        return false;
+    try {
+        const parsed = JSON.parse(err.body);
+        const text = `${String(parsed.code ?? "")} ${String(parsed.error ?? "")} ${String(parsed.message ?? "")}`.toLowerCase();
+        return text.includes("handoff_required");
+    }
+    catch {
+        return err.message.toLowerCase().includes("handoff_required");
+    }
+}
+function renderIdleCloseFailure(err) {
+    if (isHandoffRequiredCloseError(err)) {
+        return "Close pending: completion summary required before the tracked session can close.\nNext: provide the completion summary and continue supervision.";
+    }
+    return `Server close sync failed: ${String(err)}`;
+}
+async function openOrResumeServerSessionForWatch(input) {
+    const { ctx, changeRequestId, executionSurfaceId, file, activeAgentId, inferredLaneDomain } = input;
+    try {
+        const serverSession = await (0, server_sync_1.openServerSession)(ctx, {
+            changeRequestId,
+            executionSurfaceId,
+            intent: "Watched local work session",
+            claimedPaths: [file],
+            activeAgentId,
+            inferredLaneDomain,
+        });
+        return { workSessionId: serverSession.workSessionId, resumed: false };
+    }
+    catch (err) {
+        if (!isCrAlreadyInSessionError(err))
+            throw err;
+        const resolved = await (0, work_context_resolver_1.findSingleActiveSessionForChangeRequest)(ctx, changeRequestId);
+        if (!resolved)
+            return null;
+        if ("ambiguous" in resolved) {
+            process.stdout.write(`Multiple active runs for task ${changeRequestId}; cannot resume automatically.\n` +
+                `${resolved.ambiguous.map((s) => `  - ${s.id} (${s.status})`).join("\n")}\n` +
+                "Use agentbridge session list and session abandon to reduce to one.\n");
+            return null;
+        }
+        return { workSessionId: resolved.workSessionId, resumed: true };
+    }
+}
+async function promptDecision() {
+    const rl = (0, promises_1.createInterface)({ input: process.stdin, output: process.stdout });
+    try {
+        while (true) {
+            const value = (await rl.question("Decision [a/d/l/h/x]: ")).trim().toLowerCase();
+            if (value === "a")
+                return { decision: "approve" };
+            if (value === "d")
+                return { decision: "deny" };
+            if (value === "l") {
+                const narrowed = (await rl.question("Limit scope: [1] file-only [2] read-only domain [3] deny all writes\n> "))
+                    .trim()
+                    .toLowerCase();
+                if (narrowed === "2" || narrowed === "3") {
+                    return { decision: "limit_scope", limitMode: "read_only" };
+                }
+                return { decision: "limit_scope", limitMode: "file_only" };
+            }
+            if (value === "h")
+                return { decision: "handoff" };
+            if (value === "x")
+                return { decision: "abandon" };
+        }
+    }
+    finally {
+        rl.close();
+    }
+}
+function normalizeDirtyFilePath(file) {
+    const trimmed = file.trim();
+    if (!trimmed)
+        return "";
+    // For rename entries in porcelain output, keep the destination path.
+    const renamed = trimmed.includes(" -> ") ? trimmed.split(" -> ").at(-1) ?? trimmed : trimmed;
+    return renamed.replaceAll("\\", "/").replace(/^\.\/+/, "");
+}
+function normalizeDirtyWorkingTreeFiles(files) {
+    const expandDirectoryToFiles = (path) => {
+        const absolute = (0, node_path_1.resolve)((0, node_process_1.cwd)(), path);
+        try {
+            const stats = (0, node_fs_1.statSync)(absolute);
+            if (!stats.isDirectory())
+                return [path];
+        }
+        catch {
+            return [path];
+        }
+        const collected = [];
+        const stack = [absolute];
+        while (stack.length > 0) {
+            const current = stack.pop();
+            if (!current)
+                continue;
+            let entries;
+            try {
+                entries = (0, node_fs_1.readdirSync)(current, { withFileTypes: true, encoding: "utf8" });
+            }
+            catch {
+                continue;
+            }
+            for (const entry of entries) {
+                const child = (0, node_path_1.resolve)(current, entry.name);
+                if (entry.isDirectory()) {
+                    stack.push(child);
+                    continue;
+                }
+                if (!entry.isFile())
+                    continue;
+                const rel = (0, node_path_1.relative)((0, node_process_1.cwd)(), child).replaceAll("\\", "/");
+                if (rel && !rel.startsWith(".."))
+                    collected.push(rel);
+            }
+        }
+        if (collected.length === 0)
+            return [path];
+        return collected.sort();
+    };
+    const seen = new Set();
+    const ordered = [];
+    for (const raw of files) {
+        const normalized = normalizeDirtyFilePath(raw);
+        if (!normalized || normalized.startsWith(".."))
+            continue;
+        if (normalized === ".agentbridge" || normalized.startsWith(".agentbridge/"))
+            continue;
+        const expanded = expandDirectoryToFiles(normalized);
+        for (const candidate of expanded) {
+            const flat = normalizeDirtyFilePath(candidate);
+            if (!flat || flat.startsWith(".."))
+                continue;
+            if (flat === ".agentbridge" || flat.startsWith(".agentbridge/"))
+                continue;
+            if (seen.has(flat))
+                continue;
+            seen.add(flat);
+            ordered.push(flat);
+        }
+    }
+    return ordered;
+}
+function filterIgnoredDirtyFiles(files, ignored) {
+    if (ignored.size === 0)
+        return files;
+    return files.filter((file) => !ignored.has(file.replaceAll("\\", "/")));
+}
+function fileWithinScopedPaths(file, scopedPaths) {
+    if (scopedPaths.length === 0)
+        return false;
+    return scopedPaths.some((claim) => {
+        const normalized = claim.trim().replaceAll("\\", "/");
+        if (!normalized)
+            return false;
+        if (normalized === file)
+            return true;
+        if (normalized.endsWith("/**")) {
+            const prefix = normalized.slice(0, -3);
+            return file.startsWith(prefix);
+        }
+        if (normalized.includes("*")) {
+            const withDouble = normalized.replaceAll("**", "__DOUBLE_STAR__");
+            const withSingle = withDouble.replaceAll("*", "__SINGLE_STAR__");
+            const escaped = withSingle
+                .replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+                .replaceAll("__DOUBLE_STAR__", ".*")
+                .replaceAll("__SINGLE_STAR__", "[^/]*");
+            return new RegExp(`^${escaped}$`).test(file);
+        }
+        return file.startsWith(normalized.endsWith("/") ? normalized : `${normalized}/`);
+    });
+}
+function startupDirtyClassification(input) {
+    const workspaceDirtySnapshot = [...new Set(input.dirtyFiles)].sort();
+    const localChanged = new Set(input.localState?.changedFiles ?? []);
+    const localClaimedPaths = [...new Set(input.localState?.claimedPaths ?? [])]
+        .map((claim) => claim.trim())
+        .filter(Boolean);
+    const lanePatterns = input.localState?.laneDomain != null
+        ? (input.domains.find((domain) => domain.domain === input.localState?.laneDomain)?.pathPatterns ?? [])
+        : [];
+    const claimedPaths = [...new Set([...input.claimedPaths, ...localClaimedPaths])]
+        .map((claim) => claim.trim())
+        .filter(Boolean);
+    const scopeProven = claimedPaths.length > 0 || lanePatterns.length > 0 || (input.localState?.changedFiles.length ?? 0) > 0;
+    if (input.inferredMode) {
+        return {
+            acceptanceCandidateFiles: workspaceDirtySnapshot,
+            workspaceDirtySnapshot,
+            unscopedStartupDirty: [],
+            scopeProven: workspaceDirtySnapshot.length > 0,
+        };
+    }
+    const acceptanceCandidateFiles = workspaceDirtySnapshot.filter((file) => {
+        if (localChanged.has(file))
+            return true;
+        if (claimedPaths.length > 0) {
+            return fileWithinScopedPaths(file, claimedPaths);
+        }
+        if (fileWithinScopedPaths(file, lanePatterns))
+            return true;
+        return false;
+    });
+    const scopedSet = new Set(acceptanceCandidateFiles);
+    const unscopedStartupDirty = workspaceDirtySnapshot.filter((file) => !scopedSet.has(file));
+    return {
+        acceptanceCandidateFiles,
+        workspaceDirtySnapshot,
+        unscopedStartupDirty,
+        scopeProven,
+    };
+}
+function mtimeMsForFile(file) {
+    try {
+        return (0, node_fs_1.statSync)((0, node_path_1.resolve)((0, node_process_1.cwd)(), file)).mtimeMs;
+    }
+    catch {
+        return null;
+    }
+}
+function buildStartupScopeDriftIssue(input) {
+    const { unscopedStartupDirty, acceptanceCandidateFiles, claimedPaths } = input;
+    if (unscopedStartupDirty.length === 0)
+        return null;
+    const scopeAnchors = claimedPaths
+        .map((claim) => normalizeInline(claim))
+        .filter((claim) => claim.length > 0)
+        .map((claim) => {
+        if (claim.endsWith("/**"))
+            return claim.slice(0, -3);
+        if (claim.includes("*"))
+            return claim.split("*")[0] ?? claim;
+        if (claim.endsWith("/"))
+            return claim.slice(0, -1);
+        const slashIdx = claim.lastIndexOf("/");
+        return slashIdx >= 0 ? claim.slice(0, slashIdx) : claim;
+    })
+        .filter((anchor) => anchor.length > 0);
+    const scopeFileTimes = acceptanceCandidateFiles
+        .map((file) => mtimeMsForFile(file))
+        .filter((mtime) => typeof mtime === "number");
+    const referenceMtime = scopeFileTimes.length > 0 ? Math.max(...scopeFileTimes) : null;
+    const RECENT_WINDOW_MS = 10 * 1000;
+    const likelyCurrentTaskFiles = unscopedStartupDirty.filter((file) => {
+        const inScopeNeighborhood = scopeAnchors.length === 0 ||
+            scopeAnchors.some((anchor) => file === anchor || file.startsWith(`${anchor}/`));
+        if (!inScopeNeighborhood)
+            return false;
+        const mtime = mtimeMsForFile(file);
+        if (referenceMtime == null)
+            return true;
+        if (mtime == null)
+            return true;
+        return Math.abs(referenceMtime - mtime) <= RECENT_WINDOW_MS;
+    });
+    if (likelyCurrentTaskFiles.length === 0 && acceptanceCandidateFiles.length > 0) {
+        // Keep ambient unrelated dirt in debug output only.
+        return null;
+    }
+    const files = likelyCurrentTaskFiles.length > 0 ? likelyCurrentTaskFiles : unscopedStartupDirty;
+    return {
+        errorCode: "SCOPE_DRIFT_OUT_OF_SCOPE_FILE",
+        whatHappened: "Outside promised scope.",
+        whyItMatters: "Out-of-scope edits break the declared task boundary and block acceptance.",
+        files,
+        suggestedPrompt: [
+            "You changed files outside the allowed scope.",
+            "Revert them, justify why they are required and ask to expand scope, or split them into a separate task.",
+            `Out-of-scope files: ${files.join(", ")}`,
+        ].join("\n"),
+        nextAction: "Revert out-of-scope files (or explicitly expand scope), then rerun watch/check.",
+    };
+}
+async function ensureWatchRepoClean(allowDirty = false, ignoredDirtyFiles = new Set()) {
+    if (allowDirty)
+        return;
+    const dirtyFiles = filterIgnoredDirtyFiles((0, git_status_1.getDirtyWorkingTreeFiles)(), ignoredDirtyFiles);
+    if (dirtyFiles.length === 0)
+        return;
+    const rl = (0, promises_1.createInterface)({ input: process.stdin, output: process.stdout });
+    try {
+        process.stdout.write("This repo already has uncommitted changes. AgentBridge may treat them as part of the session.\n");
+        while (true) {
+            const answer = (await rl.question("[c] continue anyway  [s] show dirty files  [q] quit\n> "))
+                .trim()
+                .toLowerCase();
+            if (answer === "c")
+                return;
+            if (answer === "s") {
+                process.stdout.write(`Dirty files:\n${dirtyFiles.map((f) => `- ${f}`).join("\n")}\n`);
+                continue;
+            }
+            if (answer === "q" || answer === "") {
+                throw new errors_1.SafeCliError("Watch cancelled due to pre-existing dirty working tree. Use --allow-dirty to bypass.");
+            }
+        }
+    }
+    finally {
+        rl.close();
+    }
+}
+function currentGitHead() {
+    try {
+        const head = (0, node_child_process_1.execFileSync)("git", ["rev-parse", "HEAD"], {
+            stdio: ["ignore", "pipe", "ignore"],
+        })
+            .toString("utf8")
+            .trim();
+        return head.length > 0 ? head : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * One-shot Agent Watch fast path. Collapses cold-create / resume + observed-diff
+ * sync + acceptance check into a single bounded server call, then renders the same
+ * supervision summary + blocking issues the legacy multi-call path produces.
+ *
+ * Returns `{ handled: false }` when the connected server predates the
+ * `/watch/review-once` endpoint so the caller falls back to the legacy flow.
+ * Correctness is preserved: proof/scope/session checks all run server-side and
+ * the local session is left active for subsequent verify/follow-up.
+ */
+async function runWatchOnceFastPath(input) {
+    const { cfg, activeAgentId, task, scope, changeRequestId, allowDirty, timing } = input;
+    const ignoredDirtyFiles = input.ignoredDirtyFiles ?? new Set();
+    let ctx;
+    try {
+        ctx = (0, config_1.contextFromConfig)();
+    }
+    catch {
+        // No server context (offline / unconfigured) — defer to legacy local flow.
+        return { handled: false, hadBlockingIssue: false };
+    }
+    const dirtyFiles = timing.trackSync("git_snapshot", () => normalizeDirtyWorkingTreeFiles(filterIgnoredDirtyFiles((0, git_status_1.getDirtyWorkingTreeFiles)(), ignoredDirtyFiles)));
+    const localState = (0, session_state_1.readSessionState)();
+    const claimedPaths = [
+        ...new Set([scope, ...(localState?.claimedPaths ?? [])].map((path) => path.trim()).filter(Boolean)),
+    ];
+    const classification = timing.trackSync("baseline_classification", () => startupDirtyClassification({
+        dirtyFiles,
+        localState,
+        claimedPaths,
+        domains: cfg.domains ?? [],
+        inferredMode: false,
+    }));
+    const changedFiles = classification.workspaceDirtySnapshot;
+    const fingerprints = timing.trackSync("file_fingerprints", () => (0, file_fingerprints_1.computeFileFingerprints)(changedFiles));
+    const sourceHead = timing.trackSync("git_head", () => currentGitHead());
+    let result;
+    try {
+        result = await timing.trackAsync("watch_review_once", async () => withTimeout((0, server_sync_1.reviewOnceForWatch)(ctx, {
+            taskSummary: task,
+            scope,
+            domain: null,
+            localSessionId: localState?.serverSessionId ?? null,
+            localChangeRequestId: changeRequestId,
+            changedFiles,
+            scopedFiles: classification.acceptanceCandidateFiles,
+            outOfScopeFiles: classification.unscopedStartupDirty,
+            fileFingerprints: fingerprints,
+            sourceHead,
+            allowDirty,
+        }), WATCH_START_TASK_TIMEOUT_MS, () => new errors_1.SafeCliError({
+            code: "WATCH_STARTUP_TIMEOUT",
+            category: "WATCH_ERROR",
+            what: "Watch startup timed out while running the one-shot review.",
+            why: "The server did not return the consolidated review in time.",
+            next: "Run `agentbridge doctor`, then retry `agentbridge start`.",
+            suggestedPrompt: "AgentBridge could not start watching this task quickly. Run doctor, confirm project access, then retry.",
+        })));
+    }
+    catch (err) {
+        if ((0, server_sync_1.isWatchFastPathUnavailable)(err)) {
+            // Older server build without the consolidated endpoint — fall back.
+            return { handled: false, hadBlockingIssue: false };
+        }
+        // WS2: Hard session binding — server rejected our local_session_id because
+        // the scope/task doesn't match (WORK_CONTEXT_SCOPE_MISMATCH) or the session
+        // no longer exists (WORK_CONTEXT_STALE_LOCAL_SESSION). These are hard-stops:
+        // clear the stale local session so the next invocation starts clean, then
+        // surface the structured catalog error instead of crashing with a raw throw.
+        if ((0, http_1.isCliHttpError)(err)) {
+            const parsed = (0, http_1.parseCliHttpErrorBody)(err);
+            const rawCode = parsed?.["code"] ?? parsed?.["error"] ?? "";
+            const catalogCode = (0, error_catalog_1.mapServerCodeToCatalog)(rawCode);
+            const SESSION_BINDING_ERRORS = new Set([
+                "WORK_CONTEXT_SCOPE_MISMATCH",
+                "WORK_CONTEXT_STALE_LOCAL_SESSION",
+                "WORK_CONTEXT_MISSING",
+                "WORK_CONTEXT_AMBIGUOUS_SESSIONS",
+            ]);
+            if (catalogCode && SESSION_BINDING_ERRORS.has(catalogCode)) {
+                // Drop the stale local session so the user/agent doesn't keep hitting it.
+                (0, session_state_2.clearSessionState)();
+                const entry = (0, error_catalog_1.catalogEntryForCode)(catalogCode);
+                throw new errors_1.SafeCliError({
+                    code: entry?.code ?? catalogCode,
+                    category: entry?.category ?? "WORK_CONTEXT_ERROR",
+                    what: entry?.what ?? err.message,
+                    why: entry?.why ?? "The server rejected the local session binding.",
+                    next: entry?.next ?? 'Run `agentbridge start` to create a new session.',
+                    suggestedPrompt: "AgentBridge found a different active task/scope. Do not continue on the wrong task. Clear or resolve the current run, then start the intended task again.",
+                });
+            }
+        }
+        throw err;
+    }
+    // Persist a local session bound to the server session so verify/follow-up
+    // works and the session stays alive after this one-shot run.
+    const lane = (0, domain_resolution_1.inferLaneFromFiles)(classification.acceptanceCandidateFiles.length > 0
+        ? classification.acceptanceCandidateFiles
+        : changedFiles, cfg.domains ?? []);
+    const persistedClaimed = result.claimed_paths.length > 0 ? result.claimed_paths : claimedPaths;
+    (0, session_1.openLocalSession)({
+        agentId: activeAgentId,
+        laneDomain: lane.laneDomain,
+        claimedPaths: persistedClaimed,
+        domains: cfg.domains ?? [],
+        changeRequestId: result.change_request_id ?? undefined,
+        serverSessionId: result.work_session_id,
+    });
+    if (result.change_request_id) {
+        (0, config_1.updateConfig)({ activeChangeRequestId: result.change_request_id });
+    }
+    process.stdout.write(renderStartupPhase("starting task", "done"));
+    await flushStdout();
+    process.stdout.write(`[startup] session ${result.created_or_resumed}: ${result.work_session_id}\n`);
+    await flushStdout();
+    let hadBlockingIssue = false;
+    const acceptance = result.acceptance;
+    const supervision = (0, supervision_1.supervisionFromAcceptance)(acceptance, cfg.domains ?? []);
+    timing.trackSync("render_output", () => {
+        process.stdout.write(`${(0, supervision_1.renderSupervisionSummary)(supervision)}\n`);
+    });
+    const blockingIssue = timing.trackSync("proof_fingerprint_comparison", () => buildWatchBlockingIssue(acceptance, { strictScope: true }));
+    if (blockingIssue) {
+        timing.trackSync("render_output", () => {
+            process.stdout.write(renderWatchBlockingIssue(blockingIssue));
+        });
+        hadBlockingIssue = true;
+    }
+    // Surface scope drift from out-of-scope startup dirt unless the acceptance
+    // report already raised the same scope-drift issue (avoid double render).
+    if (blockingIssue?.errorCode !== "SCOPE_DRIFT_OUT_OF_SCOPE_FILE") {
+        const scopeDriftIssue = buildStartupScopeDriftIssue({
+            unscopedStartupDirty: classification.unscopedStartupDirty,
+            acceptanceCandidateFiles: classification.acceptanceCandidateFiles,
+            claimedPaths: persistedClaimed,
+        });
+        if (scopeDriftIssue) {
+            timing.trackSync("render_output", () => {
+                process.stdout.write(renderWatchBlockingIssue(scopeDriftIssue));
+            });
+            hadBlockingIssue = true;
+        }
+    }
+    return { handled: true, hadBlockingIssue };
+}
+async function runWatch(options = {}) {
+    const timing = createWatchTimingTracker();
+    const cfg = timing.trackSync("config_load", () => (0, config_1.readConfig)());
+    const repoRoot = (0, node_process_1.cwd)();
+    const gitignoreSessionEntry = (0, gates_1.ensureGitignoreSessionEntry)(repoRoot);
+    const ignoredDirtyFiles = new Set();
+    if (gitignoreSessionEntry.changed) {
+        ignoredDirtyFiles.add(".gitignore");
+    }
+    const gatesState = (0, gates_1.ensureGatesFile)(repoRoot);
+    if (gatesState.malformed) {
+        process.stdout.write("[agentbridge] WARNING: .agentbridge/gates.json is unreadable or malformed — treating all gates as warn_only.\n");
+        process.stderr.write(`[agentbridge:audit] ${JSON.stringify({
+            eventType: "GATES_FILE_PARSE_ERROR",
+            message: gatesState.parseError ?? "unknown parse error",
+            gates_path: gatesState.path,
+        })}\n`);
+    }
+    const acceptanceRolloutOptions = acceptanceRolloutOptionsFromGates(gatesState.gates);
+    const taskScopeInput = parseTaskScopeInput(options);
+    const localSession = timing.trackSync("local_session_read", () => (0, session_state_1.readSessionState)());
+    const hasActiveLocalSession = isActiveLocalSession(localSession);
+    const explicitStrictMode = Boolean(taskScopeInput.task && taskScopeInput.scope);
+    if (hasActiveLocalSession && explicitStrictMode) {
+        const activeLocalSession = localSession;
+        if (!activeLocalSession)
+            return;
+        const scopeMatch = (activeLocalSession.claimedPaths ?? []).map(normalizeInline).includes(normalizeInline(taskScopeInput.scope));
+        const currentTaskSummary = await timing.trackAsync("task_summary_resolution", async () => resolveCurrentSessionTaskSummary(activeLocalSession));
+        const taskMatch = currentTaskSummary != null &&
+            normalizeTaskSummary(currentTaskSummary) === normalizeTaskSummary(taskScopeInput.task);
+        if (!scopeMatch || !taskMatch) {
+            process.stdout.write([
+                "A different AgentBridge task is already active.",
+                "",
+                `Current task: ${currentTaskSummary ?? "(unknown)"}`,
+                `Current scope: ${(activeLocalSession.claimedPaths ?? []).join(", ") || "(unknown)"}`,
+                "",
+                "Next action:",
+                "- Finish/clear the current task (agentbridge done or agentbridge session abandon --reason \"...\")",
+                '- Or explicitly start a new one: agentbridge start --summary "<new task>" --scope "<new scope>"',
+                "",
+            ].join("\n"));
+            process.exitCode = 1;
+            return;
+        }
+    }
+    const startupScope = explicitStrictMode
+        ? taskScopeInput.scope ?? localSession?.claimedPaths?.[0] ?? "(scope unavailable)"
+        : taskScopeInput.scope;
+    const startupTask = explicitStrictMode
+        ? taskScopeInput.task ?? "Current AgentBridge task"
+        : taskScopeInput.task ?? "Inferred from changed files/current work";
+    process.stdout.write(renderWatchStartupHeader({
+        mode: explicitStrictMode ? "explicit" : "inferred",
+        task: startupTask,
+        scope: startupScope,
+        currentStatus: "Starting watch runtime.",
+        nextGuidance: explicitStrictMode
+            ? "AgentBridge will enforce explicit scope and proof checks."
+            : "AgentBridge will classify brainstorming vs coding and infer task/scope from repo activity.",
+    }));
+    await flushStdout();
+    process.stdout.write(renderStartupPhase("resolving project", "starting"));
+    await flushStdout();
+    timing.trackSync("identity_resolution", () => {
+        if (!cfg.activeAgentId) {
+            throw new errors_1.SafeCliError({
+                code: "IDENTITY_NO_ACTIVE_AGENT",
+                category: "IDENTITY_ERROR",
+                what: "No active agent configured.",
+                why: "Watch needs a WorkIdentity selected for this repo.",
+                next: "Run `agentbridge identity list` then `agentbridge use <agent-id>`.",
+            });
+        }
+        if (!cfg.domains || cfg.domains.length === 0) {
+            throw new errors_1.SafeCliError({
+                code: "CONFIG_NO_DOMAIN_MAP",
+                category: "CONFIG_ERROR",
+                what: "No recovered domain map found in .agentbridge/config.json.",
+                why: "Watch uses domain boundaries to enforce scoped file tracking.",
+                next: "Run `agentbridge init` to recover domains for this repo.",
+            });
+        }
+    });
+    let activeAgentId = cfg.activeAgentId;
+    if (options.changeRequestId || options.executionSurfaceId) {
+        (0, config_1.updateConfig)({
+            ...(options.changeRequestId ? { activeChangeRequestId: options.changeRequestId } : {}),
+            ...(options.executionSurfaceId ? { executionSurfaceId: options.executionSurfaceId } : {}),
+        });
+    }
+    if (!options.once) {
+        try {
+            await timing.trackAsync("project_access_check", async () => withTimeout((async () => {
+                const requestedCr = options.changeRequestId ?? cfg.activeChangeRequestId ?? null;
+                const hasLocalServerSession = Boolean((0, session_state_1.readSessionState)()?.serverSessionId);
+                if (requestedCr || hasLocalServerSession) {
+                    const resolution = await (0, work_context_resolver_1.resolveWorkContext)((0, config_1.contextFromConfig)(), {
+                        changeRequestId: requestedCr,
+                    });
+                    if (resolution.state === "mismatch") {
+                        process.stdout.write(`${(0, work_context_resolver_1.renderWorkContextLines)(resolution).join("\n")}\n`);
+                        return;
+                    }
+                }
+            })(), WATCH_STARTUP_TIMEOUT_MS, () => new errors_1.SafeCliError({
+                code: "WATCH_STARTUP_TIMEOUT",
+                category: "WATCH_ERROR",
+                what: "Watch startup timed out while resolving project context.",
+                why: "Project/session context could not be resolved in time.",
+                next: "Run `agentbridge doctor`, then retry `agentbridge start`.",
+                suggestedPrompt: "AgentBridge could not start watching this task quickly. Run doctor, confirm project access, then retry.",
+            })));
+        }
+        catch {
+            // If network context is unavailable, continue in local-only mode.
+        }
+    }
+    process.stdout.write(renderStartupPhase("resolving project", "done"));
+    await flushStdout();
+    // Fast path: collapse the one-shot review into a single bounded server call.
+    // Falls through to the legacy multi-call flow when the server predates the
+    // consolidated endpoint or no server context is available. `startingTaskAnnounced`
+    // guards against re-printing the "starting task" phase line in the fallback path.
+    let startingTaskAnnounced = false;
+    const canUseFastPath = acceptanceRolloutOptions.rolloutProofTooWeak === "warn_only" &&
+        acceptanceRolloutOptions.rolloutProofNotRelevant === "warn_only" &&
+        acceptanceRolloutOptions.rolloutImpactCoverageGap === "warn_only";
+    if (options.once && explicitStrictMode && canUseFastPath) {
+        process.stdout.write(renderStartupPhase("starting task", "starting"));
+        await flushStdout();
+        startingTaskAnnounced = true;
+        const fast = await runWatchOnceFastPath({
+            cfg,
+            activeAgentId,
+            task: taskScopeInput.task,
+            scope: taskScopeInput.scope,
+            changeRequestId: hasActiveLocalSession
+                ? options.changeRequestId ?? cfg.activeChangeRequestId ?? null
+                : options.changeRequestId ?? null,
+            allowDirty: Boolean(options.allowDirty) || Boolean(options.daemon),
+            timing,
+            ignoredDirtyFiles,
+        });
+        if (fast.handled) {
+            process.stdout.write("[startup] ready: one-shot run complete.\n");
+            await flushStdout();
+            process.exitCode = fast.hadBlockingIssue ? 1 : 0;
+            timing.flushTotal();
+            return;
+        }
+    }
+    if (options.once && explicitStrictMode && !canUseFastPath) {
+        process.stdout.write("[startup] fast path disabled: rollout gates are active; using full acceptance-check flow.\n");
+    }
+    if (!hasActiveLocalSession && explicitStrictMode) {
+        if (!startingTaskAnnounced) {
+            process.stdout.write(renderStartupPhase("starting task", "starting"));
+            await flushStdout();
+        }
+        try {
+            await timing.trackAsync("start_or_resume", async () => withTimeout((0, start_1.runStart)({
+                summary: taskScopeInput.task,
+                scope: taskScopeInput.scope,
+            }), WATCH_START_TASK_TIMEOUT_MS, () => new errors_1.SafeCliError({
+                code: "WATCH_STARTUP_TIMEOUT",
+                category: "WATCH_ERROR",
+                what: "Watch startup timed out while starting scoped task/session.",
+                why: "Internal start did not complete before timeout.",
+                next: "Run `agentbridge start --summary \"...\" --scope \"...\"` manually and retry watch.",
+                suggestedPrompt: "AgentBridge could not start watching this task quickly. Run doctor, confirm project access, then retry.",
+            })));
+        }
+        catch (startErr) {
+            if (startErr instanceof errors_1.SafeCliError)
+                throw startErr;
+            const reason = startErr instanceof Error ? startErr.message : String(startErr);
+            throw new errors_1.SafeCliError({
+                code: "WATCH_STARTUP_TASK_CREATE_FAILED",
+                category: "WATCH_ERROR",
+                what: "Watch could not create or resume the scoped task/session.",
+                why: reason,
+                next: "Run `agentbridge start --summary \"...\" --scope \"...\"` and retry watch.",
+            });
+        }
+        process.stdout.write(renderStartupPhase("starting task", "done"));
+    }
+    else {
+        process.stdout.write(renderStartupPhase("starting task", "skipped"));
+    }
+    await flushStdout();
+    const startupSession = (0, session_state_1.readSessionState)();
+    if (explicitStrictMode) {
+        if (!startupSession || startupSession.status === "closed" || startupSession.id === "none") {
+            throw new errors_1.SafeCliError({
+                code: "WATCH_STARTUP_SESSION_MISSING",
+                category: "WATCH_ERROR",
+                what: "Watch startup could not find an active local session.",
+                why: "Session creation/resume did not complete.",
+                next: "Run `agentbridge start --summary \"...\" --scope \"...\"` and retry watch.",
+            });
+        }
+        process.stdout.write(`[startup] session created/resumed: ${startupSession.id}\n`);
+        await flushStdout();
+    }
+    else {
+        process.stdout.write("[startup] session: inferred mode (will start tracking when coding begins)\n");
+        await flushStdout();
+    }
+    // In daemon mode, skip interactive dirty-file prompt (treat as --allow-dirty).
+    await timing.trackAsync("repo_clean_check", async () => ensureWatchRepoClean(Boolean(options.allowDirty) || Boolean(options.daemon), ignoredDirtyFiles));
+    process.stdout.write(renderStartupPhase("checking workspace", "done"));
+    await flushStdout();
+    const domainPacketsLoaded = new Set();
+    if (!options.once) {
+        try {
+            const packetCtx = (0, config_1.contextFromConfig)();
+            const projectPacket = await timing.trackAsync("project_packet_fetch", async () => withTimeout((0, server_sync_1.fetchProjectPacket)(packetCtx), WATCH_STARTUP_TIMEOUT_MS, () => new errors_1.SafeCliError({
+                code: "WATCH_STARTUP_TIMEOUT",
+                category: "WATCH_ERROR",
+                what: "Watch startup timed out while loading project packet.",
+                why: "Project packet fetch did not finish promptly.",
+                next: "Run `agentbridge doctor`; watch will continue with packet load skipped.",
+                suggestedPrompt: "AgentBridge could not start watching this task quickly. Run doctor, confirm project access, then retry.",
+            })));
+            if (process.stdout.isTTY) {
+                process.stdout.write(`${(0, watch_packet_handshake_1.renderProjectPacketBanner)(projectPacket, cfg.domains ?? [])}\n\n`);
+            }
+            else {
+                process.stdout.write(`${(0, watch_packet_handshake_1.renderProjectPacketOneLiner)(projectPacket)}\n`);
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            process.stdout.write(`Packet load skipped: ${message}\n`);
+            process.stdout.write("Domain memory unavailable at watch startup; continuing with empty obligations. Memory-derived proof requirements may be incomplete for this run.\n");
+        }
+    }
+    let idleTimer = null;
+    let handling = Promise.resolve();
+    let lastSupervisionSignature = null;
+    let lastBlockingIssueSignature = null;
+    let lastDriftIssueSignature = null;
+    let hadBlockingIssue = false;
+    const closeIdleSession = async () => {
+        const state = (0, session_state_1.readSessionState)();
+        if (!state || state.status === "closed" || state.id === "none")
+            return;
+        const result = (0, session_1.closeLocalSession)(state);
+        if (!result.ok) {
+            process.stdout.write(`Session remains open: ${result.reason}\n`);
+            return;
+        }
+        if (state.serverSessionId) {
+            try {
+                const ctx = (0, config_1.contextFromConfig)();
+                await (0, server_sync_1.closeServerSession)(ctx, { workSessionId: state.serverSessionId }, {
+                    closeOutcome: state.crossings.some((crossing) => crossing.status === "unresolved")
+                        ? "blocked"
+                        : "completed",
+                    closeReason: state.closeReason === "abandoned"
+                        ? "abandoned"
+                        : state.crossings.some((crossing) => crossing.status === "unresolved")
+                            ? "blocked"
+                            : "completed",
+                    note: "Idle-close from local watch lifecycle.",
+                    changedFiles: [...state.changedFiles],
+                    domainBreakdown: state.changedFiles.reduce((acc, changed) => {
+                        const domain = (0, domain_resolution_1.resolveDomainForFile)(changed, state.domains).domain ?? "unclassified";
+                        acc[domain] = (acc[domain] ?? 0) + 1;
+                        return acc;
+                    }, {}),
+                    crossings: state.crossings.map((crossing) => ({
+                        file: crossing.file,
+                        domain: crossing.domain,
+                        status: crossing.status,
+                        tier: crossing.tier,
+                    })),
+                    scopedApprovals: state.approvals.map((approval) => ({
+                        domain: approval.domain,
+                        file: approval.file,
+                        mode: approval.mode,
+                    })),
+                    implementationHandoff: {
+                        feature_or_fix: "Local watcher session close",
+                        last_implemented: {
+                            summary: "Closed due to idle timeout.",
+                            files_changed: state.changedFiles,
+                            behavior_added: [],
+                            behavior_modified: [],
+                            assumptions_made: [],
+                            migration_or_schema_changes: [],
+                            config_changes: [],
+                        },
+                        last_tested: {
+                            actual: "Test runner executed on idle close.",
+                        },
+                        next_debug_start: [],
+                    },
+                });
+            }
+            catch (err) {
+                process.stdout.write(`${renderIdleCloseFailure(err)}\n`);
+            }
+        }
+        const testRun = await (0, test_runner_1.runDetectedTests)();
+        process.stdout.write(`${(0, briefing_1.renderSessionBriefing)({ state, testRun })}\n`);
+    };
+    const resetIdle = () => {
+        if (idleTimer)
+            clearTimeout(idleTimer);
+        idleTimer = setTimeout(() => {
+            void closeIdleSession();
+        }, IDLE_CLOSE_MS);
+    };
+    const onAbsolutePathChange = async (absolutePath) => {
+        handling = handling.then(async () => {
+            const file = (0, node_path_1.relative)((0, node_process_1.cwd)(), absolutePath).replaceAll("\\", "/");
+            if (!file || file.startsWith(".."))
+                return;
+            // Fix D: Don't reset the idle timer in --once mode.  Only accept/abandon/done
+            // should close the session; --once should leave it open for follow-up commands.
+            if (!options.once)
+                resetIdle();
+            let state = (0, session_state_1.readSessionState)();
+            if (!state || state.status === "closed" || state.id === "none") {
+                const lane = (0, domain_resolution_1.inferLaneFromFiles)([file], cfg.domains ?? []);
+                let serverSessionId;
+                const changeRequestId = explicitStrictMode
+                    ? options.changeRequestId ?? cfg.activeChangeRequestId
+                    : options.changeRequestId ?? state?.changeRequestId;
+                const executionSurfaceId = options.executionSurfaceId ?? cfg.executionSurfaceId;
+                if (changeRequestId && executionSurfaceId) {
+                    try {
+                        const ctx = (0, config_1.contextFromConfig)();
+                        const opened = await openOrResumeServerSessionForWatch({
+                            ctx,
+                            changeRequestId,
+                            executionSurfaceId,
+                            file,
+                            activeAgentId,
+                            inferredLaneDomain: lane.laneDomain,
+                        });
+                        if (opened) {
+                            serverSessionId = opened.workSessionId;
+                            if (opened.resumed) {
+                                process.stdout.write(`Resumed existing run: ${opened.workSessionId}\n`);
+                            }
+                        }
+                        else {
+                            process.stdout.write("Task is already running but no unique active run could be resolved; continuing local-only.\n");
+                        }
+                    }
+                    catch (err) {
+                        process.stdout.write(`Server session open failed; continuing local-only: ${String(err)}\n`);
+                    }
+                }
+                state = (0, session_1.openLocalSession)({
+                    agentId: activeAgentId,
+                    laneDomain: lane.laneDomain,
+                    claimedPaths: [file],
+                    domains: cfg.domains ?? [],
+                    serverSessionId,
+                });
+                process.stdout.write([
+                    "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━",
+                    "  AgentBridge session started",
+                    "",
+                    `  Identity        ${state.agentId}`,
+                    `  Allowed lane    ${state.laneDomain ?? "unclassified"}`,
+                    `  Server sync     ${state.serverSessionId ? "enabled" : "local-only"}`,
+                    "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━",
+                    "",
+                ].join("\n"));
+            }
+            const outcome = (0, watch_core_1.applyFileChange)(state, file);
+            (0, session_state_1.writeSessionState)(state);
+            const unresolvedProtectedCrossing = state.crossings.some((crossing) => crossing.status === "unresolved" &&
+                (crossing.tier === "tier_a" || crossing.tier === "tier_b"));
+            let ctx = null;
+            if (state.serverSessionId) {
+                try {
+                    ctx = (0, config_1.contextFromConfig)();
+                }
+                catch {
+                    ctx = null;
+                }
+            }
+            const supervisionResult = await syncAndBuildSupervisionSnapshot({
+                ctx,
+                state,
+                cfgDomains: cfg.domains ?? [],
+                changedFile: file,
+                outcome,
+                changeRequestId: options.changeRequestId ?? cfg.activeChangeRequestId ?? null,
+                unresolvedProtectedCrossing,
+                rollout: acceptanceRolloutOptions,
+                timing,
+            });
+            if (supervisionResult.syncError) {
+                process.stdout.write(`Observed-diff sync failed: ${supervisionResult.syncError}\n`);
+            }
+            const supervision = supervisionResult.supervision;
+            const nextSummary = shouldRenderSupervisionSummary(lastSupervisionSignature, supervision);
+            if (nextSummary.shouldRender) {
+                timing.trackSync("render_output", () => {
+                    process.stdout.write(`${(0, supervision_1.renderSupervisionSummary)(supervision)}\n`);
+                });
+                lastSupervisionSignature = nextSummary.nextSignature;
+            }
+            if (supervisionResult.acceptanceReport) {
+                const blockingIssue = timing.trackSync("proof_fingerprint_comparison", () => buildWatchBlockingIssue(supervisionResult.acceptanceReport, {
+                    strictScope: explicitStrictMode,
+                }));
+                const issueSignature = blockingIssue ? JSON.stringify(blockingIssue) : null;
+                if (blockingIssue && issueSignature && issueSignature !== lastBlockingIssueSignature) {
+                    timing.trackSync("render_output", () => {
+                        process.stdout.write(renderWatchBlockingIssue(blockingIssue));
+                    });
+                    hadBlockingIssue = true;
+                    lastBlockingIssueSignature = issueSignature;
+                }
+                else if (!issueSignature) {
+                    lastBlockingIssueSignature = null;
+                }
+            }
+            else {
+                const blockingIssue = timing.trackSync("proof_fingerprint_comparison", () => buildFallbackWatchBlockingIssue(supervision));
+                const issueSignature = blockingIssue ? JSON.stringify(blockingIssue) : null;
+                if (blockingIssue && issueSignature && issueSignature !== lastBlockingIssueSignature) {
+                    timing.trackSync("render_output", () => {
+                        process.stdout.write(renderWatchBlockingIssue(blockingIssue));
+                    });
+                    hadBlockingIssue = true;
+                    lastBlockingIssueSignature = issueSignature;
+                }
+                else if (!issueSignature) {
+                    lastBlockingIssueSignature = null;
+                }
+            }
+            if (!explicitStrictMode) {
+                const drift = timing.trackSync("proof_fingerprint_comparison", () => detectInferredDomainDrift(state.changedFiles, cfg.domains ?? []));
+                const driftSignature = drift ? JSON.stringify(drift.issue) : null;
+                if (drift && driftSignature && driftSignature !== lastDriftIssueSignature) {
+                    timing.trackSync("render_output", () => {
+                        process.stdout.write(renderWatchBlockingIssue(drift.issue));
+                    });
+                    if (drift.blocking) {
+                        hadBlockingIssue = true;
+                    }
+                    lastDriftIssueSignature = driftSignature;
+                }
+                else if (!driftSignature) {
+                    lastDriftIssueSignature = null;
+                }
+            }
+            if (!outcome.requiresAuthorityPrompt)
+                return;
+            if (outcome.requestType === "handshake") {
+                const crossingDomain = outcome.crossingDomain;
+                if (crossingDomain && !domainPacketsLoaded.has(crossingDomain)) {
+                    domainPacketsLoaded.add(crossingDomain);
+                    try {
+                        const packetCtx = (0, config_1.contextFromConfig)();
+                        const domainPacket = await (0, server_sync_1.fetchDomainPacket)(packetCtx, {
+                            domainName: crossingDomain,
+                            claimedPaths: [file],
+                        });
+                        const entry = domainPacket.domains[0];
+                        if (entry) {
+                            process.stdout.write(`${(0, watch_packet_handshake_1.renderDomainPacketBanner)(entry)}\n\n`);
+                        }
+                    }
+                    catch (err) {
+                        const message = err instanceof Error ? err.message : String(err);
+                        process.stdout.write(`Packet load skipped: ${message}\n`);
+                    }
+                }
+                process.stdout.write(`${(0, watch_packet_handshake_1.renderHandshakeRefusalBlock)(file, crossingDomain)}\n\n`);
+                (0, watch_packet_handshake_1.applyHandshakeRefusal)(state, file, outcome, (targetFile) => {
+                    (0, revert_crossing_1.revertCrossingFile)(targetFile);
+                });
+                (0, session_state_1.writeSessionState)(state);
+                return;
+            }
+            const owner = (0, domain_resolution_1.resolveDomainForFile)(file, cfg.domains ?? []).ownerAgentId ?? `${outcome.crossingDomain} Agent`;
+            process.stdout.write(`${(0, authority_request_1.renderAuthorityRequest)({
+                requestingAgent: state.agentId,
+                currentTask: "Watched local session",
+                authorizedLane: state.laneDomain ?? "unclassified",
+                targetFile: file,
+                targetDomainOwner: owner,
+                severity: outcome.crossingTier,
+            })}\n`);
+            process.stdout.write(`${renderCrossingContext({
+                changeRequestId: options.changeRequestId ?? cfg.activeChangeRequestId ?? null,
+                workSessionId: state.serverSessionId ?? state.id,
+                worker: state.agentId,
+                claimedLaneDomain: state.laneDomain ?? null,
+                touchedDomain: outcome.crossingDomain ?? null,
+                file,
+                tier: outcome.crossingTier,
+            })}\n`);
+            const response = options.daemon
+                ? { decision: "deny" }
+                : await promptDecision();
+            if (options.daemon) {
+                process.stdout.write(`[daemon] Domain crossing denied automatically (no interactive prompt in daemon mode). Use the dashboard to approve.\n`);
+            }
+            try {
+                (0, watch_core_1.applyBoundaryDecision)(state, file, response.decision, {
+                    revertFile: (targetFile) => {
+                        (0, revert_crossing_1.revertCrossingFile)(targetFile);
+                        process.stdout.write(`Denied ${targetFile}; reverted/deleted out-of-lane file.\n`);
+                    },
+                    revertAll: (files) => {
+                        for (const targetFile of files) {
+                            (0, revert_crossing_1.revertCrossingFile)(targetFile);
+                        }
+                        process.stdout.write(`Abandoning session and reverting ${files.length} file(s).\n`);
+                    },
+                }, { limitMode: response.limitMode });
+            }
+            catch (err) {
+                process.stdout.write(`Failed to apply ${response.decision} on ${file}: ${err instanceof Error ? err.message : String(err)}\n`);
+                process.stdout.write("Session remains blocked. Retry deny/abandon or resolve crossing manually.\n");
+                state.status = "blocked";
+                state.blockedAt = state.blockedAt ?? new Date().toISOString();
+                (0, session_state_1.writeSessionState)(state);
+                return;
+            }
+            if (state.serverSessionId && outcome.crossingDomain) {
+                try {
+                    const ctx = (0, config_1.contextFromConfig)();
+                    await (0, server_sync_1.postScopedApproval)(ctx, { workSessionId: state.serverSessionId }, {
+                        decision: response.decision,
+                        activeAgentId: state.agentId,
+                        ownerAgentId: owner,
+                        targetDomain: outcome.crossingDomain,
+                        approvedFiles: [file],
+                        limitMode: response.decision === "limit_scope"
+                            ? response.limitMode === "read_only"
+                                ? "read_only"
+                                : "file_only"
+                            : undefined,
+                        reason: `Decision from watch prompt: ${response.decision}`,
+                    });
+                }
+                catch (err) {
+                    process.stdout.write(`Approval sync failed: ${String(err)}\n`);
+                }
+            }
+            if (response.decision === "approve") {
+                process.stdout.write(`${renderScopedApprovalConfirmation(state.agentId, file, outcome.crossingDomain)}\n`);
+            }
+            if (response.decision === "handoff") {
+                state.pendingHandoffToAgent = owner;
+                state.pendingHandoffDomain = outcome.crossingDomain;
+                (0, session_state_1.archiveClosedSession)(state);
+                (0, session_state_1.archiveHandoff)(state);
+                activeAgentId = owner;
+                (0, config_1.updateConfig)({ activeAgentId: owner });
+                process.stdout.write(`Handoff requested. Active agent switched to ${owner} for takeover.\n`);
+                if (state.serverSessionId) {
+                    try {
+                        const ctx = (0, config_1.contextFromConfig)();
+                        await (0, server_sync_1.closeServerSession)(ctx, { workSessionId: state.serverSessionId }, {
+                            closeOutcome: "blocked",
+                            closeReason: "handoff_required",
+                            note: `Handoff required to ${owner}.`,
+                            targetAgentId: owner,
+                            targetDomain: outcome.crossingDomain ?? null,
+                            filesInvolved: [file],
+                            changedFiles: [...state.changedFiles],
+                            implementationHandoff: {
+                                feature_or_fix: "Cross-domain handoff",
+                                next_debug_start: [file],
+                                next_prompt: `Continue this task as ${owner} in domain ${outcome.crossingDomain ?? "unknown"}.`,
+                            },
+                        });
+                    }
+                    catch (err) {
+                        process.stdout.write(`Server handoff close failed: ${String(err)}\n`);
+                    }
+                }
+                const takeoverSession = (0, session_1.openLocalSession)({
+                    agentId: owner,
+                    laneDomain: outcome.crossingDomain,
+                    claimedPaths: [file],
+                    domains: cfg.domains ?? [],
+                });
+                (0, session_state_1.writeSessionState)(takeoverSession);
+                process.stdout.write(`Takeover session started for ${owner} in ${outcome.crossingDomain ?? "unclassified"}.\n`);
+                return;
+            }
+            if (response.decision === "abandon") {
+                (0, session_state_1.archiveClosedSession)(state);
+            }
+            if (response.decision === "abandon" && state.serverSessionId) {
+                try {
+                    const ctx = (0, config_1.contextFromConfig)();
+                    await (0, server_sync_1.closeServerSession)(ctx, { workSessionId: state.serverSessionId }, {
+                        closeOutcome: "blocked",
+                        closeReason: "abandoned",
+                        note: "Session abandoned by local watcher decision.",
+                        changedFiles: [...state.changedFiles],
+                        filesInvolved: [...state.changedFiles],
+                        crossings: state.crossings.map((crossing) => ({
+                            file: crossing.file,
+                            domain: crossing.domain,
+                            status: crossing.status,
+                            tier: crossing.tier,
+                        })),
+                        scopedApprovals: state.approvals.map((approval) => ({
+                            domain: approval.domain,
+                            file: approval.file,
+                            mode: approval.mode,
+                        })),
+                    });
+                }
+                catch (err) {
+                    process.stdout.write(`Server abandon close failed: ${String(err)}\n`);
+                }
+            }
+            (0, session_state_1.writeSessionState)(state);
+        });
+        await handling;
+    };
+    const processStartupDirty = async () => {
+        const startupDirtyFiles = timing.trackSync("git_snapshot", () => normalizeDirtyWorkingTreeFiles(filterIgnoredDirtyFiles((0, git_status_1.getDirtyWorkingTreeFiles)(), ignoredDirtyFiles)));
+        if (startupDirtyFiles.length === 0) {
+            if (!explicitStrictMode) {
+                process.stdout.write(`${renderBrainstormingStatus()}\n`);
+            }
+            return;
+        }
+        let startupState = (0, session_state_1.readSessionState)();
+        const changeRequestId = explicitStrictMode
+            ? options.changeRequestId ?? cfg.activeChangeRequestId ?? null
+            : options.changeRequestId ?? startupState?.changeRequestId ?? null;
+        let startupClaimedPaths = [];
+        let startupServerSessionId = null;
+        startupClaimedPaths = [...(startupState?.claimedPaths ?? [])];
+        if (startupState?.serverSessionId) {
+            startupServerSessionId = startupState.serverSessionId;
+        }
+        else if (changeRequestId) {
+            try {
+                const ctx = (0, config_1.contextFromConfig)();
+                const resolved = await (0, work_context_resolver_1.findSingleActiveSessionForChangeRequest)(ctx, changeRequestId);
+                if (resolved && !("ambiguous" in resolved)) {
+                    startupServerSessionId = resolved.workSessionId;
+                }
+            }
+            catch {
+                startupServerSessionId = null;
+            }
+        }
+        if (startupServerSessionId) {
+            try {
+                const ctx = (0, config_1.contextFromConfig)();
+                const report = await timing.trackAsync("acceptance_check_fetch", async () => (0, server_sync_1.fetchAcceptanceCheck)(ctx, { workSessionId: startupServerSessionId, ...acceptanceRolloutOptions }));
+                startupClaimedPaths = [...new Set([...startupClaimedPaths, ...(report.claimed_paths ?? [])])];
+            }
+            catch {
+                // Keep local claimed paths when server claimed paths are unavailable.
+            }
+        }
+        const startupClassification = timing.trackSync("baseline_classification", () => startupDirtyClassification({
+            dirtyFiles: startupDirtyFiles,
+            localState: startupState,
+            claimedPaths: startupClaimedPaths,
+            domains: cfg.domains ?? [],
+            inferredMode: !explicitStrictMode,
+        }));
+        if (startupClassification.workspaceDirtySnapshot.length === 0 && !explicitStrictMode) {
+            process.stdout.write(renderBrainstormingStatus());
+        }
+        else if (!explicitStrictMode) {
+            const inferredTask = inferTaskFromFiles(startupClassification.workspaceDirtySnapshot, cfg.domains ?? []);
+            process.stdout.write(renderCodingDetection(startupClassification.workspaceDirtySnapshot, inferredTask));
+        }
+        else {
+            process.stdout.write(`Startup dirty snapshot detected ${startupClassification.workspaceDirtySnapshot.length} file(s).\n`);
+            process.stdout.write(`Startup acceptance candidates: ${startupClassification.acceptanceCandidateFiles.length} file(s).\n`);
+            process.stdout.write(`Startup unscoped dirty files: ${startupClassification.unscopedStartupDirty.length} file(s).\n`);
+            if (startupClassification.unscopedStartupDirty.length > 0) {
+                process.stdout.write(`Workspace dirty snapshot (debug only):\n${startupClassification.workspaceDirtySnapshot
+                    .map((file) => `- ${file}`)
+                    .join("\n")}\n`);
+                process.stdout.write(`Unscoped startup dirty (not posted as observed diff):\n${startupClassification.unscopedStartupDirty
+                    .map((file) => `- ${file}`)
+                    .join("\n")}\n`);
+            }
+        }
+        if (options.once && explicitStrictMode) {
+            const startupScopeDriftIssue = timing.trackSync("proof_fingerprint_comparison", () => buildStartupScopeDriftIssue({
+                unscopedStartupDirty: startupClassification.unscopedStartupDirty,
+                acceptanceCandidateFiles: startupClassification.acceptanceCandidateFiles,
+                claimedPaths: startupClaimedPaths,
+            }));
+            if (startupScopeDriftIssue) {
+                timing.trackSync("render_output", () => {
+                    process.stdout.write(renderWatchBlockingIssue(startupScopeDriftIssue));
+                });
+                hadBlockingIssue = true;
+            }
+        }
+        if (!startupClassification.scopeProven && explicitStrictMode) {
+            process.stdout.write("Startup dirty files detected, but no scoped current work is proven.\nRun with --change-request or claim scope.\n");
+        }
+        else if (startupClassification.acceptanceCandidateFiles.length === 0 && explicitStrictMode) {
+            process.stdout.write("Startup dirty snapshot is outside current scoped work. Waiting for in-scope changes.\n");
+        }
+        if (startupClassification.scopeProven &&
+            startupClassification.acceptanceCandidateFiles.length > 0 &&
+            startupServerSessionId &&
+            (!startupState || startupState.status === "closed" || startupState.id === "none")) {
+            const lane = (0, domain_resolution_1.inferLaneFromFiles)(startupClassification.acceptanceCandidateFiles, cfg.domains ?? []);
+            startupState = (0, session_1.openLocalSession)({
+                agentId: activeAgentId,
+                laneDomain: lane.laneDomain,
+                claimedPaths: startupClaimedPaths.length > 0
+                    ? startupClaimedPaths
+                    : [...startupClassification.acceptanceCandidateFiles],
+                domains: cfg.domains ?? [],
+                serverSessionId: startupServerSessionId,
+            });
+            (0, session_state_1.writeSessionState)(startupState);
+            process.stdout.write(`Linked local session ${startupState.id} to server session ${startupServerSessionId} before startup supervision.\n`);
+        }
+        for (const file of startupClassification.acceptanceCandidateFiles) {
+            await onAbsolutePathChange((0, node_path_1.resolve)((0, node_process_1.cwd)(), file));
+        }
+    };
+    let stop = null;
+    if (!options.once) {
+        process.stdout.write(renderStartupPhase("starting watcher", "starting"));
+        await flushStdout();
+        stop = timing.trackSync("watcher_startup", () => (0, watcher_1.startWatcher)((0, node_process_1.cwd)(), (absolutePath) => {
+            void onAbsolutePathChange(absolutePath);
+        }));
+        process.stdout.write(renderStartupPhase("starting watcher", "done"));
+        await flushStdout();
+    }
+    else {
+        process.stdout.write(renderStartupPhase("starting watcher", "skipped"));
+        await flushStdout();
+    }
+    await processStartupDirty();
+    process.stdout.write("[startup] ready: watch runtime is live.\n");
+    await flushStdout();
+    if (options.once) {
+        if (idleTimer)
+            clearTimeout(idleTimer);
+        process.stdout.write("[startup] ready: one-shot run complete.\n");
+        process.exitCode = hadBlockingIssue ? 1 : 0;
+        timing.flushTotal();
+        return;
+    }
+    process.on("SIGINT", () => {
+        if (idleTimer)
+            clearTimeout(idleTimer);
+        stop?.();
+        process.stdout.write("\nagentbridge watch stopped.\n");
+        process.exit(0);
+    });
+}