@agentknight/sdk 0.9.37 → 0.9.38

package/dist/index.js

@@ -4,12 +4,12 @@ import {
   PeerChatRequestSchema,
   PeerChatResultSchema,
   validateDataDirectory
-} from "./chunks/chunk-IXV2BIUR.js";
+} from "./chunks/chunk-4FC2WG64.js";
 import {
   AgentSelectionSchema,
   assertSelectionSnapshotFits,
   supportsAgentSelection
-} from "./chunks/chunk-U2HBI4SH.js";
+} from "./chunks/chunk-6YF3VZLR.js";
 import {
   ConversationNormalizer,
   LiveTimelineProjection,
@@ -27,19 +27,20 @@ import {
   projectWorkbenchInsights,
   readWorkbenchMetrics,
   recordOperationFailure,
+  recordTimelineSyncDiagnostic,
   resolveGitProjectIdentity,
   sessionRestoreFailure,
   validateOperationResponse
-} from "./chunks/chunk-7JRY2FRZ.js";
+} from "./chunks/chunk-UIM3KQRC.js";
 import {
   GROUP_CHAT_MAX_TURNS,
   GroupChatError
-} from "./chunks/chunk-VXZ25DKC.js";
+} from "./chunks/chunk-YSJRQ35E.js";
 import {
   assistantPreview,
   isContentfulAssistant,
   userPreview
-} from "./chunks/chunk-QLGX7333.js";
+} from "./chunks/chunk-34DUD2Y4.js";
 import {
   AgentModelListingError,
   AgentSessionRenameError,
@@ -48,7 +49,7 @@ import {
   UnsupportedAgentOperationError,
   captureResearchAccess,
   captureWorkbenchAccess
-} from "./chunks/chunk-UJZPAP64.js";
+} from "./chunks/chunk-6GVMVE5N.js";
 import {
   A2aRelayRequestSchema,
   A2aRelayResponseSchema,
@@ -108,6 +109,13 @@ import {
   SESSION_FILE_MAX_ORIGINAL_BYTES,
   SESSION_FILE_READ_OPERATION,
   SESSION_FILE_READ_VERSION,
+  SESSION_GIT_DIFF_GZIP_MIN_BYTES,
+  SESSION_GIT_DIFF_GZIP_VERSION,
+  SESSION_GIT_DIFF_MAX_FILES,
+  SESSION_GIT_DIFF_MAX_PATCH_BYTES,
+  SESSION_GIT_DIFF_MAX_RESPONSE_BYTES,
+  SESSION_GIT_DIFF_OPERATION,
+  SESSION_GIT_DIFF_VERSION,
   SESSION_LIST_UPDATES_CAPABILITY,
   SESSION_OPTIONS_PARTIAL_CAPABILITY,
   SESSION_PROJECT_IDENTITY_OPERATION,
@@ -136,6 +144,9 @@ import {
   SessionDirectoryListResultDataSchema,
   SessionFileReadDataSchema,
   SessionFileReadResultDataSchema,
+  SessionGitDiffDataSchema,
+  SessionGitDiffGzipResultDataSchema,
+  SessionGitDiffResultDataSchema,
   SessionListRequestSchema,
   SessionListResultSchema,
   SessionOptionsRequestSchema,
@@ -197,10 +208,10 @@ import {
   sessionCommunicationError,
   sessionCommunicationOperationCapability,
   workbenchCapability
-} from "./chunks/chunk-N2LIXMIM.js";
+} from "./chunks/chunk-GNQC2IS2.js";
 
 // src/initialize.ts
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 import { readFile as readFile4 } from "node:fs/promises";
 import { z as z10 } from "zod";
 
@@ -236,9 +247,9 @@ async function accessible(path, executable = false) {
     throw error;
   }
 }
-async function hasLocalExecutable(command, environment = process.env) {
-  const extensions = process.platform === "win32" ? ["", ...(environment.PATHEXT ?? ".EXE;.CMD;.BAT").split(";")] : [""];
-  const paths = isAbsolute(command) || command.includes("/") || command.includes("\\") ? [command] : (environment.PATH ?? "").split(delimiter).filter(Boolean).map((directory) => join(directory, command));
+async function hasLocalExecutable(command, environment2 = process.env) {
+  const extensions = process.platform === "win32" ? ["", ...(environment2.PATHEXT ?? ".EXE;.CMD;.BAT").split(";")] : [""];
+  const paths = isAbsolute(command) || command.includes("/") || command.includes("\\") ? [command] : (environment2.PATH ?? "").split(delimiter).filter(Boolean).map((directory) => join(directory, command));
   for (const path of paths) {
     for (const extension of extensions) {
       if (await accessible(`${path}${extension}`, true)) return true;
@@ -275,7 +286,7 @@ async function createCodingAgentAdapter(config, onDiagnostic, owner) {
   switch (engine.kind) {
     case "managed": {
       if (owner === void 0) throw new Error("Managed coding agents require the PC owner identity");
-      const { ManagedCodingAgentAdapter } = await import("./chunks/managed-agent-adapter-4W4HC67T.js");
+      const { ManagedCodingAgentAdapter } = await import("./chunks/managed-agent-adapter-EMBDKITT.js");
       return new ManagedCodingAgentAdapter({
         dataDirectory: config.dataDirectory,
         owner,
@@ -314,7 +325,7 @@ async function createCodingAgentAdapter(config, onDiagnostic, owner) {
       });
     }
     case "copilot": {
-      const { GithubCopilotAdapter } = await import("./chunks/copilot-adapter-KM6RMGFR.js");
+      const { GithubCopilotAdapter } = await import("./chunks/copilot-adapter-USX4UEWH.js");
       if (owner !== void 0) {
         return new GithubCopilotAdapter(void 0, void 0, void 0, {
           dataDirectory: config.dataDirectory,
@@ -334,13 +345,13 @@ async function createCodingAgentAdapter(config, onDiagnostic, owner) {
     }
     case "pi": {
       assertPiRuntimeSupported();
-      const { PiCodingAgentAdapter } = await import("./chunks/pi-adapter-IFNN3F4N.js");
+      const { PiCodingAgentAdapter } = await import("./chunks/pi-adapter-KT5M7Z6R.js");
       return new PiCodingAgentAdapter(
         engine.agentDirectory === void 0 ? {} : { agentDirectory: resolve(engine.agentDirectory) }
       );
     }
     case "acp": {
-      const { AcpCodingAgentAdapter } = await import("./chunks/acp-adapter-QK4MVTNN.js");
+      const { AcpCodingAgentAdapter } = await import("./chunks/acp-adapter-DZ3EE36H.js");
       return new AcpCodingAgentAdapter({
         command: engine.command,
         args: engine.args,
@@ -638,7 +649,7 @@ var ContentCipher = class {
   openBytes(input) {
     return this.#open(input, (plaintext) => plaintext);
   }
-  #open(input, decode) {
+  #open(input, decode2) {
     const message = SecureMessageSchema.parse(input);
     if (message.keyId !== this.#key.keyId) {
       throw new Error("Encrypted message key ID does not match this device");
@@ -670,7 +681,7 @@ var ContentCipher = class {
         cause: error
       });
     }
-    const payload = decode(plaintext);
+    const payload = decode2(plaintext);
     while (activeReplayEntries.size >= MAX_REPLAY_ENTRIES) {
       const oldest = activeReplayEntries.keys().next().value;
       if (oldest === void 0) {
@@ -757,12 +768,12 @@ function buildPairingUri(relayUrl, code, machineId, contentKey) {
   uri.searchParams.set("key", contentKey);
   return uri.toString();
 }
-async function requestPairingUri(config, identity, contentKey) {
+async function requestPairingUri(config, identity2, contentKey) {
   const payload = {
     userId: config.userId,
-    machineId: identity.machineId,
-    stableDeviceId: identity.stableDeviceId,
-    machineName: identity.machineName,
+    machineId: identity2.machineId,
+    stableDeviceId: identity2.stableDeviceId,
+    machineName: identity2.machineName,
     keyId: contentKey.keyId
   };
   const response = await fetch(
@@ -786,7 +797,7 @@ async function requestPairingUri(config, identity, contentKey) {
     uri: buildPairingUri(
       config.relayUrl,
       result.code,
-      identity.machineId,
+      identity2.machineId,
       contentKey.encoded
     ),
     expiresAt: result.expiresAt
@@ -1263,8 +1274,8 @@ var SessionFileReader = class {
           fail2("FILE_UNAVAILABLE");
         }
         const canonical = await realpath2(current);
-        const samePath = canonical === current || resource && process.platform === "win32" && canonical.toLowerCase() === current.toLowerCase();
-        if (!contained(root, canonical) || !samePath) fail2("FILE_UNAVAILABLE");
+        const samePath2 = canonical === current || resource && process.platform === "win32" && canonical.toLowerCase() === current.toLowerCase();
+        if (!contained(root, canonical) || !samePath2) fail2("FILE_UNAVAILABLE");
         checkDeadline();
         file = info;
       }
@@ -2190,7 +2201,7 @@ function researchAwareCodingAgentAdapter(inner, research) {
 }
 
 // src/pc-agent.ts
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 import { platform as platform2 } from "node:os";
 import { performance as performance5 } from "node:perf_hooks";
 
@@ -2214,17 +2225,17 @@ import { io } from "socket.io-client";
 
 // src/service/requests/session-communication.ts
 import { AsyncLocalStorage } from "node:async_hooks";
-import { createHash as createHash5 } from "node:crypto";
-import { join as join6 } from "node:path";
+import { createHash as createHash6 } from "node:crypto";
+import { join as join7 } from "node:path";
 import { performance as performance2 } from "node:perf_hooks";
 
 // src/repeated-error-diagnostics.ts
 var RepeatedErrorDiagnostics = class {
-  constructor(logger, event, intervalMs = 3e4, limit = 256) {
+  constructor(logger, event, intervalMs = 3e4, limit2 = 256) {
     this.logger = logger;
     this.event = event;
     this.intervalMs = intervalMs;
-    this.limit = limit;
+    this.limit = limit2;
   }
   logger;
   event;
@@ -2307,7 +2318,7 @@ var MAX_COMPRESSION_JOBS = 2;
 var activeCompressionJobs = 0;
 var ContentEncoder = class {
   async encodeTimelineResult(plaintext, options = {}) {
-    const identity = (reason) => ({
+    const identity2 = (reason) => ({
       bytes: plaintext,
       encoding: "identity",
       reason
@@ -2315,28 +2326,28 @@ var ContentEncoder = class {
     if (plaintext.length > CONTENT_ENCODING_MAX_DECODED_BYTES) {
       throw new Error("Timeline content exceeds the decoded byte budget");
     }
-    if (options.enabled !== true) return identity("disabled");
+    if (options.enabled !== true) return identity2("disabled");
     if (!options.acceptContentEncodings?.includes("gzip-v1")) {
-      return identity("not-negotiated");
+      return identity2("not-negotiated");
     }
-    if (plaintext.length < CONTENT_ENCODING_MIN_INPUT_BYTES) return identity("too-small");
-    if (activeCompressionJobs >= MAX_COMPRESSION_JOBS) return identity("busy");
+    if (plaintext.length < CONTENT_ENCODING_MIN_INPUT_BYTES) return identity2("too-small");
+    if (activeCompressionJobs >= MAX_COMPRESSION_JOBS) return identity2("busy");
     activeCompressionJobs += 1;
     try {
-      const compressed = await new Promise((resolve4, reject) => {
+      const compressed = await new Promise((resolve5, reject) => {
         gzip2(plaintext, { level: 6 }, (error, result) => {
           if (error !== null) reject(error);
-          else resolve4(result);
+          else resolve5(result);
         });
       });
       if (compressed.length > CONTENT_ENCODING_MAX_GZIP_BYTES) {
-        return identity("gzip-too-large");
+        return identity2("gzip-too-large");
       }
       if (plaintext.length > compressed.length * CONTENT_ENCODING_MAX_RATIO) {
-        return identity("ratio-limit");
+        return identity2("ratio-limit");
       }
       if ((compressed.length + CONTENT_ENCODING_HEADER_BYTES) * 100 > plaintext.length * 85) {
-        return identity("insufficient-gain");
+        return identity2("insufficient-gain");
       }
       const header = Buffer.alloc(CONTENT_ENCODING_HEADER_BYTES);
       MAGIC.copy(header);
@@ -2481,6 +2492,611 @@ var SessionPublicationScope = class {
   }
 };
 
+// src/service/requests/communication-operations.ts
+import { promisify as promisify2 } from "node:util";
+import { constants as constants4, gzip as gzip3 } from "node:zlib";
+
+// src/session-git-diff.ts
+import { execFile } from "node:child_process";
+import { createHash as createHash5, randomUUID as randomUUID3 } from "node:crypto";
+import { constants as constants3 } from "node:fs";
+import { chmod, lstat as lstat4, mkdir as mkdir2, open as open2, readlink, realpath as realpath4, rm, stat as stat5, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname, isAbsolute as isAbsolute5, join as join6, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
+var SESSION_GIT_DIFF_CONCURRENCY = 4;
+var SESSION_GIT_DIFF_TIMEOUT_MS = 15e3;
+var SESSION_GIT_DIFF_MAX_SOURCE_BYTES = 8 * 1024 * 1024;
+var MAX_SCAN_BYTES = 256 * 1024 * 1024;
+var MAX_SCAN_FILES = 5e4;
+var SessionGitDiffError = class extends Error {
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+  }
+  code;
+};
+function fail3(code, message) {
+  throw new SessionGitDiffError(code, message);
+}
+function changed() {
+  return fail3("DIFF_CHANGED", "The project diff changed; refresh the changed-file list");
+}
+function limit() {
+  return fail3("DIFF_LIMIT_EXCEEDED", "The project diff is too large");
+}
+function samePath(a, b) {
+  return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+function safePath(path) {
+  return path !== "" && isSafeSessionDirectoryPath(path) && !path.split("/").some((segment) => segment.toLowerCase() === ".git");
+}
+function decode(bytes) {
+  try {
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+  } catch (error) {
+    throw new SessionGitDiffError("DIFF_UNAVAILABLE", "Git returned invalid text", { cause: error });
+  }
+}
+function environment() {
+  const env = { ...process.env, LC_ALL: "C" };
+  for (const key of Object.keys(env)) {
+    if (key.toUpperCase().startsWith("GIT_")) delete env[key];
+  }
+  return {
+    ...env,
+    GIT_OPTIONAL_LOCKS: "0",
+    GIT_NO_LAZY_FETCH: "1",
+    GIT_NO_REPLACE_OBJECTS: "1",
+    GIT_TERMINAL_PROMPT: "0"
+  };
+}
+function isExit(error, code) {
+  return error instanceof Error && "code" in error && error.code === code && "stdout" in error && Buffer.isBuffer(error.stdout) && "stderr" in error && Buffer.isBuffer(error.stderr);
+}
+var Work = class {
+  deadline = Date.now() + SESSION_GIT_DIFF_TIMEOUT_MS;
+  env = environment();
+  bytes = 0;
+  #filterConfig = [];
+  async disableExternalFilters(repository) {
+    const names = records(await this.git(repository, [
+      "config",
+      "--includes",
+      "--null",
+      "--name-only",
+      "--get-regexp",
+      "^filter\\."
+    ], { allowExitOne: true }));
+    const drivers = /* @__PURE__ */ new Set();
+    for (const name of names) {
+      const match = /^filter\.([^=\r\n]+)\.[^.]+$/u.exec(name);
+      if (!match?.[1]) fail3("DIFF_BLOCKED", "The project contains an unsupported filter configuration");
+      drivers.add(match[1]);
+    }
+    this.#filterConfig = [...drivers].flatMap((name) => [
+      "-c",
+      `filter.${name}.clean=`,
+      "-c",
+      `filter.${name}.process=`,
+      "-c",
+      `filter.${name}.required=false`
+    ]);
+    if (this.#filterConfig.join(" ").length > 16384) limit();
+  }
+  check() {
+    if (Date.now() >= this.deadline) fail3("DIFF_TIMEOUT", "The project diff request timed out");
+  }
+  async git(cwd, args, options = {}) {
+    this.check();
+    try {
+      const stdout = await new Promise((resolve5, reject) => {
+        const child = execFile("git", [
+          "--literal-pathspecs",
+          "-c",
+          "core.fsmonitor=false",
+          "-c",
+          "core.hooksPath=",
+          ...this.#filterConfig,
+          ...args
+        ], {
+          cwd,
+          encoding: "buffer",
+          windowsHide: true,
+          timeout: Math.max(1, this.deadline - Date.now()),
+          maxBuffer: options.maxBuffer ?? SESSION_GIT_DIFF_MAX_SOURCE_BYTES,
+          env: {
+            ...this.env,
+            ...options.objectDirectory === void 0 ? {} : { GIT_OBJECT_DIRECTORY: options.objectDirectory },
+            ...options.isolated ? {
+              GIT_DIR: join6(cwd, "no-repository"),
+              GIT_CONFIG_NOSYSTEM: "1",
+              GIT_ATTR_NOSYSTEM: "1",
+              GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null"
+            } : {}
+          }
+        }, (error, output2, stderr) => {
+          if (error) reject(Object.assign(error, { stdout: output2, stderr }));
+          else resolve5(output2);
+        });
+        child.stdin?.on("error", reject);
+        child.stdin?.end(options.input);
+      });
+      this.check();
+      return stdout;
+    } catch (error) {
+      this.check();
+      if (options.allowExitOne && isExit(error, 1)) return error.stdout;
+      if (error instanceof Error && "code" in error && error.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") limit();
+      throw error;
+    }
+  }
+};
+function identity(info) {
+  return `${info.dev}\0${info.ino}\0${info.size}\0${info.mtimeNs}\0${info.mode}\0${info.nlink}`;
+}
+async function inspect(root, path, work, kind = "file") {
+  if (!safePath(path)) fail3("DIFF_BLOCKED", "The selected path cannot be compared");
+  let current = root;
+  const segments = path.split("/");
+  for (const [index, segment] of segments.entries()) {
+    current = join6(current, segment);
+    let info;
+    try {
+      info = await lstat4(current, { bigint: true });
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT") return void 0;
+      throw error;
+    }
+    work.check();
+    const last = index === segments.length - 1;
+    if (last && kind === "link" && info.isSymbolicLink()) return info;
+    if (info.isSymbolicLink() || !info.isFile() && !info.isDirectory()) {
+      fail3("DIFF_BLOCKED", "Links, submodules and special files cannot be compared");
+    }
+    const canonical = await realpath4(current);
+    if (!contained(root, canonical) || !samePath(canonical, current)) {
+      fail3("DIFF_BLOCKED", "The selected path is outside the session");
+    }
+    work.check();
+    if (info.isDirectory() !== (!last || kind === "directory")) return void 0;
+    if (index === segments.length - 1) return info;
+  }
+  return void 0;
+}
+async function readCurrent(root, path, algorithm, work, keepBytes = false) {
+  const before = await inspect(root, path, work);
+  if (before === void 0) return void 0;
+  if (before.size > BigInt(MAX_SCAN_BYTES - work.bytes) || keepBytes && before.size > BigInt(SESSION_GIT_DIFF_MAX_SOURCE_BYTES)) limit();
+  work.bytes += Number(before.size);
+  const handle = await open2(
+    join6(root, ...path.split("/")),
+    constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0) | (constants3.O_NONBLOCK ?? 0)
+  );
+  try {
+    const opened = await handle.stat({ bigint: true });
+    if (!opened.isFile() || identity(opened) !== identity(before)) changed();
+    const hash2 = createHash5(algorithm).update(`blob ${before.size}\0`);
+    const buffer = Buffer.alloc(64 * 1024);
+    const chunks = [];
+    let offset = 0;
+    for (; ; ) {
+      const { bytesRead } = await handle.read(buffer, 0, buffer.length, offset);
+      work.check();
+      if (bytesRead === 0) break;
+      offset += bytesRead;
+      if (offset > Number(before.size)) changed();
+      hash2.update(buffer.subarray(0, bytesRead));
+      if (keepBytes) chunks.push(Buffer.from(buffer.subarray(0, bytesRead)));
+    }
+    const latest = await inspect(root, path, work);
+    if (offset !== Number(before.size) || latest === void 0 || identity(latest) !== identity(before) || identity(await handle.stat({ bigint: true })) !== identity(before)) changed();
+    const rawOid = hash2.digest("hex");
+    return {
+      oid: rawOid,
+      rawOid,
+      identity: identity(before),
+      mode: process.platform !== "win32" && (before.mode & 0o111n) !== 0n ? "100755" : "100644",
+      ...keepBytes ? { bytes: Buffer.concat(chunks) } : {}
+    };
+  } finally {
+    await handle.close();
+  }
+}
+async function base(repository, work) {
+  for (const [baseRef, ref] of [
+    ["origin/main", "refs/remotes/origin/main"],
+    ["main", "refs/heads/main"]
+  ]) {
+    const commit = decode(await work.git(repository, [
+      "rev-parse",
+      "--verify",
+      "--quiet",
+      `${ref}^{commit}`
+    ], { allowExitOne: true })).trim();
+    if (!commit) continue;
+    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/u.test(commit)) {
+      fail3("DIFF_BASE_UNAVAILABLE", "The main branch could not be resolved");
+    }
+    const baseCommit = decode(await work.git(repository, ["merge-base", "--all", "HEAD", commit], {
+      allowExitOne: true
+    })).trim();
+    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/u.test(baseCommit)) {
+      fail3("DIFF_BASE_UNAVAILABLE", "The session and main do not have a unique merge base");
+    }
+    return { baseRef, baseCommit };
+  }
+  return fail3("DIFF_MAIN_UNAVAILABLE", "No local origin/main or main reference is available");
+}
+function scopedPath(context, path) {
+  const prefix = context.prefix === "" ? "" : `${context.prefix}/`;
+  if (!path.startsWith(prefix)) fail3("DIFF_BLOCKED", "Git returned a path outside the session");
+  const scoped = path.slice(prefix.length);
+  if (!safePath(scoped)) fail3("DIFF_BLOCKED", "The project contains an unsupported path");
+  return scoped;
+}
+function records(output2) {
+  const text = decode(output2);
+  if (text === "") return [];
+  if (!text.endsWith("\0")) fail3("DIFF_UNAVAILABLE", "Git returned an incomplete file list");
+  return text.slice(0, -1).split("\0");
+}
+async function changes(context, work) {
+  const paths = context.prefix === "" ? [] : [context.prefix];
+  const tree = records(await work.git(context.repository, [
+    "ls-tree",
+    "-r",
+    "-z",
+    "--full-tree",
+    context.baseCommit,
+    "--",
+    ...paths
+  ]));
+  const blobs = /* @__PURE__ */ new Map();
+  const candidates = /* @__PURE__ */ new Set();
+  const tracked = /* @__PURE__ */ new Map();
+  const scanned = /* @__PURE__ */ new Set();
+  const scoped = (path) => {
+    const scoped2 = scopedPath(context, path);
+    scanned.add(scoped2);
+    if (scanned.size > MAX_SCAN_FILES) limit();
+    return scoped2;
+  };
+  for (const record of tree) {
+    const match = /^(\d{6}) (blob|commit) ([a-f0-9]{40}|[a-f0-9]{64})\t(.+)$/u.exec(record);
+    if (!match?.[1] || !match[3] || !match[4]) fail3("DIFF_UNAVAILABLE", "Git returned an invalid tree");
+    blobs.set(scoped(match[4]), { mode: match[1], oid: match[3] });
+  }
+  for (const record of records(await work.git(context.repository, [
+    "ls-files",
+    "--stage",
+    "--full-name",
+    "-z",
+    "--",
+    ...paths
+  ]))) {
+    const match = /^(\d{6}) ([a-f0-9]{40}|[a-f0-9]{64}) [0-3]\t(.+)$/u.exec(record);
+    if (!match?.[1] || !match[2] || !match[3]) fail3("DIFF_UNAVAILABLE", "Git returned an invalid index");
+    tracked.set(scoped(match[3]), { mode: match[1], oid: match[2] });
+  }
+  for (const path of scanned) {
+    const original = blobs.get(path);
+    const indexed = tracked.get(path);
+    if (original?.oid !== indexed?.oid || original?.mode !== indexed?.mode || original !== void 0 && !["100644", "100755"].includes(original.mode)) candidates.add(path);
+  }
+  for (const path of records(await work.git(context.repository, [
+    "ls-files",
+    "--modified",
+    "--deleted",
+    "--full-name",
+    "-z",
+    "--",
+    ...paths
+  ]))) candidates.add(scoped(path));
+  const untracked = [];
+  for (const path of records(await work.git(context.repository, [
+    "ls-files",
+    "--others",
+    "--exclude-standard",
+    "--full-name",
+    "-z",
+    "--",
+    ...paths
+  ]))) {
+    const relativePath = scoped(path);
+    candidates.add(relativePath);
+    if (!blobs.has(relativePath)) untracked.push({ path: relativePath, status: "untracked" });
+  }
+  if (untracked.length > SESSION_GIT_DIFF_MAX_FILES || Buffer.byteLength(JSON.stringify({
+    rootRevision: context.rootRevision,
+    baseRef: context.baseRef,
+    baseCommit: context.baseCommit,
+    files: untracked
+  }), "utf8") > SESSION_GIT_DIFF_MAX_RESPONSE_BYTES) limit();
+  const result = [];
+  const algorithm = context.baseCommit.length === 64 ? "sha256" : "sha1";
+  const currentFiles = /* @__PURE__ */ new Map();
+  for (const path of [...candidates].sort()) {
+    work.check();
+    const original = blobs.get(path);
+    const indexed = tracked.get(path);
+    if ([original?.mode, indexed?.mode].some((mode) => mode !== void 0 && mode !== "100644" && mode !== "100755")) {
+      await unchangedSpecial(context, path, original, indexed, work);
+      candidates.delete(path);
+      continue;
+    }
+    const current = await readCurrent(context.root, path, algorithm, work);
+    if (current !== void 0) currentFiles.set(path, current);
+  }
+  if (currentFiles.size > 0) {
+    const hashes = decode(await work.git(context.repository, ["hash-object", "--stdin-paths"], {
+      input: [...currentFiles.keys()].map((path) => [context.prefix, path].filter(Boolean).join("/")).join("\n") + "\n"
+    })).trim().split("\n");
+    if (hashes.length !== currentFiles.size) changed();
+    for (const [index, [path, current]] of [...currentFiles].entries()) {
+      const oid = hashes[index];
+      if (!oid || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/u.test(oid)) changed();
+      const latest = await inspect(context.root, path, work);
+      if (latest === void 0 || identity(latest) !== current.identity) changed();
+      current.oid = oid;
+    }
+  }
+  for (const path of [...candidates].sort()) {
+    const original = blobs.get(path);
+    const current = currentFiles.get(path);
+    if (original === void 0 && current === void 0) continue;
+    if (original?.oid === current?.oid && (process.platform === "win32" || original?.mode === current?.mode)) continue;
+    result.push({
+      entry: { path, status: original === void 0 ? tracked.has(path) ? "added" : "untracked" : current === void 0 ? "deleted" : "modified" },
+      base: original,
+      current
+    });
+    if (result.length > SESSION_GIT_DIFF_MAX_FILES) limit();
+  }
+  return result;
+}
+async function unchangedSpecial(context, path, original, indexed, work) {
+  const blocked = () => fail3("DIFF_BLOCKED", "Changed links and submodules cannot be compared");
+  if (original === void 0 || indexed?.mode !== original.mode || indexed.oid !== original.oid) return blocked();
+  if (original.mode === "160000") {
+    if (await inspect(context.root, path, work, "directory") === void 0) blocked();
+    const target = join6(context.root, ...path.split("/"));
+    try {
+      await lstat4(join6(target, ".git"));
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT") return;
+      throw error;
+    }
+    if (decode(await work.git(target, ["rev-parse", "--verify", "HEAD"])).trim() !== original.oid) blocked();
+  } else if (original.mode === "120000") {
+    const info = await inspect(context.root, path, work, "link");
+    if (info === void 0) return blocked();
+    const algorithm = context.baseCommit.length === 64 ? "sha256" : "sha1";
+    let oid;
+    if (info.isSymbolicLink()) {
+      const target = Buffer.from(await readlink(join6(context.root, ...path.split("/"))), "utf8");
+      oid = createHash5(algorithm).update(`blob ${target.length}\0`).update(target).digest("hex");
+    } else {
+      oid = (await readCurrent(context.root, path, algorithm, work))?.rawOid;
+    }
+    if (oid !== original.oid) blocked();
+  } else blocked();
+}
+function binary(bytes) {
+  if (bytes.includes(0)) return true;
+  try {
+    new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return false;
+  } catch {
+    return true;
+  }
+}
+async function patch(context, change, work, scratchDirectory) {
+  const algorithm = context.baseCommit.length === 64 ? "sha256" : "sha1";
+  const current = await readCurrent(context.root, change.entry.path, algorithm, work, true);
+  if (current?.rawOid !== change.current?.rawOid || current?.mode !== change.current?.mode) changed();
+  let original = Buffer.alloc(0);
+  if (change.base !== void 0) {
+    const size = Number(decode(await work.git(context.repository, ["cat-file", "-s", change.base.oid])).trim());
+    if (!Number.isSafeInteger(size) || size < 0 || size > SESSION_GIT_DIFF_MAX_SOURCE_BYTES) limit();
+    original = await work.git(context.repository, ["cat-file", "blob", change.base.oid], { maxBuffer: size + 1 });
+    if (original.length !== size) changed();
+  }
+  const directory = resolve2(scratchDirectory);
+  if (contained(context.repository, directory)) {
+    fail3("DIFF_UNAVAILABLE", "Project diff storage must be outside the session repository");
+  }
+  await mkdir2(directory, { recursive: true, mode: 448 });
+  if ((await lstat4(directory)).isSymbolicLink() || !samePath(await realpath4(directory), directory)) {
+    fail3("DIFF_UNAVAILABLE", "Project diff storage cannot use links");
+  }
+  const scratch = join6(directory, randomUUID3());
+  await mkdir2(scratch, { mode: 448 });
+  let text;
+  try {
+    let bytes = current?.bytes ?? Buffer.alloc(0);
+    if (current !== void 0) {
+      const objectDirectory = join6(scratch, "objects");
+      await mkdir2(objectDirectory);
+      const path = [context.prefix, change.entry.path].filter(Boolean).join("/");
+      const oid = decode(await work.git(context.repository, ["hash-object", "-w", "--stdin", `--path=${path}`], {
+        input: bytes,
+        objectDirectory
+      })).trim();
+      if (oid !== change.current?.oid) changed();
+      bytes = await work.git(context.repository, ["cat-file", "blob", oid], {
+        objectDirectory,
+        maxBuffer: SESSION_GIT_DIFF_MAX_SOURCE_BYTES
+      });
+    }
+    if (binary(original) || binary(bytes)) return { patch: "", binary: true };
+    for (const side of ["a", "b"]) await mkdir2(join6(scratch, side));
+    for (const [side, content, mode] of [
+      ["a", original, change.base?.mode],
+      ["b", bytes, current?.mode]
+    ]) {
+      if (mode === void 0) continue;
+      const file = join6(scratch, side, ...change.entry.path.split("/"));
+      await mkdir2(dirname(file), { recursive: true });
+      await writeFile2(file, content, { flag: "wx", mode: 384 });
+      if (process.platform !== "win32") await chmod(file, mode === "100755" ? 448 : 384);
+    }
+    text = decode(await work.git(scratch, [
+      "-c",
+      "core.quotePath=false",
+      "-c",
+      "core.autocrlf=false",
+      "diff",
+      "--no-index",
+      "--no-prefix",
+      "--no-ext-diff",
+      "--no-textconv",
+      "--no-renames",
+      "--no-color",
+      "--text",
+      "--unified=3",
+      "--",
+      "a",
+      "b"
+    ], { isolated: true, allowExitOne: true, maxBuffer: SESSION_GIT_DIFF_MAX_PATCH_BYTES }));
+  } finally {
+    await rm(scratch, { recursive: true, force: true, maxRetries: 3 });
+  }
+  if (Buffer.byteLength(text, "utf8") > SESSION_GIT_DIFF_MAX_PATCH_BYTES) limit();
+  return { patch: text, binary: false };
+}
+var SessionGitDiffReader = class {
+  constructor(metadata, scratchDirectory) {
+    this.metadata = metadata;
+    this.scratchDirectory = scratchDirectory;
+  }
+  metadata;
+  scratchDirectory;
+  #active = 0;
+  async read(sessionId, data) {
+    if (!SessionGitDiffDataSchema.safeParse(data).success || data.path !== void 0 && !safePath(data.path)) {
+      fail3("INVALID_DIFF_PATH", "The project diff request is invalid");
+    }
+    if (this.#active >= SESSION_GIT_DIFF_CONCURRENCY) fail3("DIFF_BUSY", "Too many project diff requests");
+    this.#active++;
+    const work = new Work();
+    const pending = this.#read(sessionId, data, work).finally(() => {
+      this.#active--;
+    });
+    let timer;
+    try {
+      return await Promise.race([
+        pending,
+        new Promise((_, reject) => {
+          timer = setTimeout(() => reject(new SessionGitDiffError(
+            "DIFF_TIMEOUT",
+            "The project diff request timed out"
+          )), SESSION_GIT_DIFF_TIMEOUT_MS);
+        })
+      ]);
+    } catch (error) {
+      if (error instanceof SessionGitDiffError) throw error;
+      throw new SessionGitDiffError("DIFF_UNAVAILABLE", "The project diff is unavailable", { cause: error });
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async #context(sessionId, rootRevision, work) {
+    const metadata = await this.metadata(sessionId);
+    work.check();
+    if (metadata === void 0) fail3("SESSION_NOT_FOUND", "The session is unavailable");
+    const workingDirectory = metadata.workingDirectory;
+    if (!workingDirectory || !isAbsolute5(workingDirectory)) {
+      fail3("SESSION_ROOT_UNAVAILABLE", "The session working directory is unavailable");
+    }
+    let root;
+    let rootIdentity;
+    try {
+      root = await realpath4(workingDirectory);
+      if ((await lstat4(workingDirectory)).isSymbolicLink() || !samePath(root, resolve2(workingDirectory))) {
+        fail3("DIFF_BLOCKED", "Links cannot be compared");
+      }
+      const info = await stat5(root, { bigint: true });
+      if (!info.isDirectory()) fail3("SESSION_ROOT_UNAVAILABLE", "The session working directory is unavailable");
+      rootIdentity = sessionRootIdentity(root, info);
+    } catch (error) {
+      if (error instanceof SessionGitDiffError) throw error;
+      throw new SessionGitDiffError("SESSION_ROOT_UNAVAILABLE", "The session working directory is unavailable", { cause: error });
+    }
+    if (createHash5("sha256").update(rootIdentity).digest("base64url") !== rootRevision) {
+      fail3("SESSION_ROOT_CHANGED", "The session directory changed");
+    }
+    let repository;
+    try {
+      const top = decode(await work.git(root, ["rev-parse", "--show-toplevel"])).replace(/\r?\n$/u, "");
+      if (!isAbsolute5(top)) fail3("DIFF_UNAVAILABLE", "Git returned an invalid repository");
+      repository = await realpath4(top);
+    } catch (error) {
+      if (error instanceof SessionGitDiffError) throw error;
+      if (isExit(error, 128) && decode(error.stderr).startsWith("fatal: not a git repository")) {
+        throw new SessionGitDiffError("DIFF_NOT_REPOSITORY", "The session directory is not a Git repository", { cause: error });
+      }
+      throw error;
+    }
+    if (!contained(repository, root)) fail3("DIFF_BLOCKED", "The repository is outside the session root");
+    if (decode(await work.git(root, ["rev-parse", "--show-superproject-working-tree"])).trim() !== "") {
+      fail3("DIFF_BLOCKED", "Submodule content cannot be compared");
+    }
+    return {
+      root,
+      rootRevision,
+      rootIdentity,
+      workingDirectory,
+      repository,
+      repositoryIdentity: sessionRootIdentity(repository, await stat5(repository, { bigint: true })),
+      prefix: relative2(repository, root).split(sep2).join("/"),
+      ...await base(repository, work)
+    };
+  }
+  async #read(sessionId, data, work) {
+    const context = await this.#context(sessionId, data.rootRevision, work);
+    if (data.baseCommit !== void 0 && data.baseCommit !== context.baseCommit) changed();
+    await work.disableExternalFilters(context.repository);
+    const files = await changes(context, work);
+    const common = { rootRevision: data.rootRevision, baseRef: context.baseRef, baseCommit: context.baseCommit };
+    let result;
+    let selected;
+    if (data.path === void 0) {
+      result = { ...common, files: files.map(({ entry }) => entry) };
+    } else {
+      selected = files.find(({ entry }) => entry.path === data.path);
+      if (selected === void 0) changed();
+      result = { ...common, path: data.path, ...await patch(context, selected, work, this.scratchDirectory) };
+    }
+    let latest;
+    try {
+      latest = await this.#context(sessionId, data.rootRevision, work);
+    } catch (error) {
+      if (error instanceof SessionGitDiffError) {
+        if (["SESSION_NOT_FOUND", "SESSION_ROOT_UNAVAILABLE"].includes(error.code)) {
+          throw new SessionGitDiffError("SESSION_ROOT_CHANGED", "The session directory changed", { cause: error });
+        }
+        if (["DIFF_MAIN_UNAVAILABLE", "DIFF_BASE_UNAVAILABLE", "DIFF_NOT_REPOSITORY"].includes(error.code)) changed();
+      }
+      throw error;
+    }
+    if (latest.workingDirectory !== context.workingDirectory || latest.rootIdentity !== context.rootIdentity) {
+      fail3("SESSION_ROOT_CHANGED", "The session directory changed");
+    }
+    if (latest.repositoryIdentity !== context.repositoryIdentity || latest.baseRef !== context.baseRef || latest.baseCommit !== context.baseCommit) changed();
+    if (selected !== void 0) {
+      const current = await readCurrent(
+        context.root,
+        selected.entry.path,
+        context.baseCommit.length === 64 ? "sha256" : "sha1",
+        work
+      );
+      if (current?.rawOid !== selected.current?.rawOid || current?.mode !== selected.current?.mode) changed();
+    }
+    work.check();
+    if (Buffer.byteLength(JSON.stringify(result), "utf8") > SESSION_GIT_DIFF_MAX_RESPONSE_BYTES) limit();
+    return SessionGitDiffResultDataSchema.parse(result);
+  }
+};
+
 // src/service/requests/request-errors.ts
 function operationErrorCode(agentId, operation, error) {
   if (isSessionRestoreFailure(error)) return "SESSION_RESTORE_FAILED";
@@ -2495,10 +3111,12 @@ function unsupportedOperation(error) {
 }
 
 // src/service/requests/communication-operations.ts
+var compress2 = promisify2(gzip3);
 function createCommunicationOperations(options) {
   const { adapter, publications } = options;
   const directoryLister = new SessionDirectoryLister(async (sessionId) => adapter.getSessionDirectoryMetadata?.(sessionId));
   const fileReader = new SessionFileReader(async (sessionId) => adapter.getSessionDirectoryMetadata?.(sessionId));
+  const gitDiffReader = new SessionGitDiffReader(async (sessionId) => adapter.getSessionDirectoryMetadata?.(sessionId), options.gitDiffDirectory);
   const getSessionProjectIdentity = adapter.getSessionProjectIdentity?.bind(adapter);
   const createGroupChat = adapter.createGroupChat?.bind(adapter);
   const renameSession = adapter.renameSession?.bind(adapter);
@@ -2546,6 +3164,30 @@ function createCommunicationOperations(options) {
     ],
     ...options.incrementalOperations,
     ...adapter.getSessionDirectoryMetadata === void 0 ? [] : [
+      ...[SESSION_GIT_DIFF_VERSION, SESSION_GIT_DIFF_GZIP_VERSION].map((version) => sessionCommunicationOperation({
+        operation: SESSION_GIT_DIFF_OPERATION,
+        version,
+        schema: SessionGitDiffDataSchema,
+        handle: async (data, request) => {
+          const assertAccess = options.captureRequestAccess();
+          assertAccess();
+          const result = await gitDiffReader.read(request.sessionId, data);
+          let response = SessionCommunicationDataSchema.parse(result);
+          if (version === SESSION_GIT_DIFF_GZIP_VERSION) {
+            const bytes = Buffer.from(JSON.stringify(result), "utf8");
+            if (bytes.length >= SESSION_GIT_DIFF_GZIP_MIN_BYTES) {
+              response = SessionGitDiffGzipResultDataSchema.parse({
+                encoding: "gzip",
+                byteLength: bytes.length,
+                data: (await compress2(bytes, { level: constants4.Z_BEST_SPEED })).toString("base64")
+              });
+            }
+          }
+          assertAccess();
+          return response;
+        },
+        onError: (error) => unsupportedOperation(error) ?? (error instanceof SessionGitDiffError || error instanceof SessionNotSharedError ? { code: error.code, message: error.message } : { code: "DIFF_UNAVAILABLE", message: "The project diff is unavailable" })
+      })),
       sessionCommunicationOperation({
         operation: SESSION_DIRECTORY_LIST_OPERATION,
         version: SESSION_DIRECTORY_LIST_VERSION,
@@ -2612,13 +3254,14 @@ var SessionCommunicationHandler = class {
     const workbench = adapter.agentId === "copilot" || adapter.agentId === "managed" ? adapter.workbench : void 0;
     const researchWorkbench = workbench === void 0 ? void 0 : research;
     this.#operations = workbench === void 0 && researchWorkbench === void 0 ? void 0 : new SessionOperations({
-      directory: join6(config.dataDirectory, "workbench"),
+      directory: join7(config.dataDirectory, "workbench"),
       agentRunId,
       namespace: `${config.userId}\0${machineId}`,
       onError: operationError
     });
     this.#dispatcher = new SessionCommunicationDispatcher(createCommunicationOperations({
       adapter,
+      gitDiffDirectory: join7(config.dataDirectory, "git-diff"),
       publications: options.publications,
       captureRequestAccess: () => {
         const assertCurrent = this.#requestContext.getStore()?.assertRequestCurrent;
@@ -2653,6 +3296,8 @@ var SessionCommunicationHandler = class {
   #operations;
   #dispatcher;
   #errors;
+  #diagnosticTimers = /* @__PURE__ */ new Set();
+  #closed = false;
   get capabilities() {
     const schedules = this.options.adapter.workbench?.schedules;
     const schedulesAvailable = schedules !== void 0 && schedules.isAvailable?.() !== false;
@@ -2669,6 +3314,9 @@ var SessionCommunicationHandler = class {
     await this.#operations?.stopAccepting();
   }
   async close() {
+    this.#closed = true;
+    for (const timer of this.#diagnosticTimers) clearTimeout(timer);
+    this.#diagnosticTimers.clear();
     await this.#operations?.close();
     this.#researchParents.clear();
     this.#requestContext.disable();
@@ -2690,11 +3338,106 @@ var SessionCommunicationHandler = class {
     return visible;
   }
   async handle(request, scope) {
-    const { adapter, config, machineId, research, publications, audience, emit, logger, metrics } = this.options;
-    if (!this.options.enabled()) return;
+    if (request.operation !== TIMELINE_SYNC_OPERATION) return this.#handle(request, scope);
+    const started = performance2.now();
+    const parsed = TimelineSyncRequestSchema.safeParse(request.data);
+    const mode = parsed.success && parsed.data.watermark !== void 0 ? parsed.data.resume === true ? "resume" : "replay" : "snapshot";
+    const diagnostics = new OperationDiagnostics();
+    const lifecycle = {
+      preflightPhase: "arrival",
+      lifecyclePhase: "preflight",
+      outcome: "dropped",
+      emitOutcome: "not-attempted"
+    };
+    const fields = () => ({
+      ...diagnostics.fields(request),
+      mode,
+      lifecycleMs: Math.round(performance2.now() - started),
+      preflightMs: Math.round((lifecycle.preflightEnded ?? performance2.now()) - started),
+      preflightPhase: lifecycle.preflightPhase,
+      lifecyclePhase: lifecycle.lifecyclePhase
+    });
+    let pendingLogged = false;
+    const pendingAfterMs = 5e3 + (parsed.success ? parsed.data.waitMs ?? 0 : 0);
+    const timer = this.#closed ? void 0 : setTimeout(() => {
+      if (timer !== void 0) this.#diagnosticTimers.delete(timer);
+      pendingLogged = true;
+      this.options.logger.info({ ...fields(), pendingAfterMs }, "session.communication.timeline-sync-pending");
+    }, pendingAfterMs);
+    if (timer !== void 0) {
+      timer.unref();
+      this.#diagnosticTimers.add(timer);
+    }
+    try {
+      await diagnostics.run(async () => {
+        diagnostics.recordTimelineSync({ mode });
+        if (mode !== "replay") {
+          this.options.logger.info(fields(), "session.communication.timeline-sync-started");
+        }
+        await this.#handle(request, scope, diagnostics, lifecycle);
+      }, { measureHandle: false });
+    } catch (error) {
+      lifecycle.outcome = "failure";
+      lifecycle.reason ??= "exception";
+      diagnostics.recordFailure(error, lifecycle.lifecyclePhase === "preflight" ? "preflight" : lifecycle.lifecyclePhase === "emit" ? "emit" : "handle");
+      throw error;
+    } finally {
+      if (timer !== void 0) {
+        clearTimeout(timer);
+        this.#diagnosticTimers.delete(timer);
+      }
+      const details = {
+        ...fields(),
+        outcome: lifecycle.outcome,
+        emitOutcome: lifecycle.emitOutcome,
+        ...lifecycle.reason === void 0 ? {} : { reason: lifecycle.reason }
+      };
+      if (mode !== "replay" || pendingLogged || lifecycle.outcome !== "success" || lifecycle.responseStatus === "resync" || diagnostics.activeMs >= 1e3) {
+        this.options.logger.info(details, "session.communication.timeline-sync-completed");
+      } else {
+        this.options.logger.debug(details, "session.communication.timeline-sync-completed");
+      }
+    }
+  }
+  async #handle(request, scope, diagnostics = new OperationDiagnostics(), lifecycle) {
+    const { adapter, config, machineId, research, publications, audience, logger, metrics } = this.options;
+    const reject = (reason) => {
+      if (lifecycle !== void 0) {
+        lifecycle.outcome = "failure";
+        lifecycle.reason = reason;
+      }
+    };
+    const emit = (_event, response2) => {
+      if (lifecycle !== void 0) {
+        lifecycle.preflightEnded ??= performance2.now();
+        lifecycle.lifecyclePhase = "emit";
+        lifecycle.outcome = response2.kind === "error" ? "failure" : "success";
+        if (response2.kind === "error") lifecycle.reason ??= "operation-error";
+        if (response2.kind === "response") {
+          const status = response2.data["status"];
+          if (status === "snapshot" || status === "replay" || status === "resync") {
+            lifecycle.responseStatus = status;
+            diagnostics.recordTimelineSync({ status });
+          }
+        }
+      }
+      try {
+        this.options.emit("session.communication", response2);
+        if (lifecycle !== void 0) lifecycle.emitOutcome = "local-enqueued";
+      } catch (error) {
+        if (lifecycle !== void 0) lifecycle.emitOutcome = "threw";
+        reject(error instanceof SecureMessageBudgetError ? "transport-budget" : "emit-failed");
+        diagnostics.recordFailure(error, "emit");
+        throw error;
+      }
+    };
+    if (!this.options.enabled()) {
+      if (lifecycle !== void 0) lifecycle.reason = "disabled";
+      return;
+    }
     const clientId = scope.clientId;
     const owner = [config.userId, machineId, clientId, request.sessionId];
-    const key = (parts) => createHash5("sha256").update(JSON.stringify(parts)).digest("hex").slice(0, 24);
+    const key = (parts) => createHash6("sha256").update(JSON.stringify(parts)).digest("hex").slice(0, 24);
     const knownSource = this.#researchParents.get(request.sessionId) ?? adapter.sessionPublicationSource?.(request.sessionId) ?? request.sessionId;
     const arrivalPublication = adapter.isSessionVisible?.(knownSource) === true ? publications.capture(knownSource) : void 0;
     let researchParent = this.#researchParents.get(request.sessionId);
@@ -2706,9 +3449,12 @@ var SessionCommunicationHandler = class {
       return;
     }
     if (research !== void 0) {
+      if (lifecycle !== void 0) lifecycle.preflightPhase = "ownership";
       try {
         researchParent = await research.parentSessionId(request.sessionId) ?? researchParent;
       } catch (error) {
+        reject("ownership-unavailable");
+        if (lifecycle !== void 0) diagnostics.recordFailure(error, "preflight");
         logger.error({
           stage: "research.ownership",
           ownerKey: key(owner),
@@ -2723,8 +3469,10 @@ var SessionCommunicationHandler = class {
       }
     }
     if (researchParent !== void 0) {
+      if (lifecycle !== void 0) lifecycle.preflightPhase = "isolation";
       const unifiedSync = research?.chat !== void 0 && this.options.supportsResearchChat?.(clientId) === true && (request.operation === TIMELINE_SYNC_OPERATION || request.operation === TIMELINE_IMAGE_OPERATION);
       if (!unifiedSync && !["research.timeline", "research.send", "research.abort", "research.delete", "operation.get", "insights.read"].includes(request.operation)) {
+        reject("research-isolated");
         emit("session.communication", sessionCommunicationError(request, {
           code: "RESEARCH_SESSION_ISOLATED",
           message: "Research sessions require the isolated research operations"
@@ -2738,6 +3486,7 @@ var SessionCommunicationHandler = class {
       }
     }
     const publicationSessionId = researchParent ?? request.sessionId;
+    if (lifecycle !== void 0) lifecycle.preflightPhase = "access";
     let publication;
     let researchAccess;
     const publicationCurrent = () => {
@@ -2745,6 +3494,7 @@ var SessionCommunicationHandler = class {
         researchAccess?.assertCurrent();
         return researchAccess?.detached === true || publications.isCurrent(publicationSessionId, publication);
       } catch {
+        reject("not-shared");
         return false;
       }
     };
@@ -2757,21 +3507,28 @@ var SessionCommunicationHandler = class {
       }
       if (!publicationCurrent()) throw new SessionNotSharedError();
     } catch {
+      reject("not-shared");
       const error = new SessionNotSharedError();
       emit("session.communication", sessionCommunicationError(request, { code: error.code, message: error.message }));
       return;
     }
     const token = clientId === void 0 || request.operation !== TIMELINE_SYNC_OPERATION ? void 0 : audience.syncToken(clientId, request.sessionId);
     if (request.operation === TIMELINE_SYNC_OPERATION && !audience.confirmed) {
-      const { data: _data, kind: _kind, ...identity } = request;
+      if (lifecycle !== void 0) lifecycle.preflightPhase = "audience";
+      reject("audience-unconfirmed");
+      const { data: _data, kind: _kind, ...identity2 } = request;
       emit("session.communication", {
-        ...identity,
+        ...identity2,
         kind: "error",
         error: { code: "TIMELINE_SYNC_UNSUPPORTED", message: "Relay audience replay is not confirmed" }
       });
       return;
     }
-    const diagnostics = new OperationDiagnostics();
+    if (lifecycle !== void 0) {
+      lifecycle.preflightEnded = performance2.now();
+      lifecycle.preflightPhase = "complete";
+      lifecycle.lifecyclePhase = "dispatch";
+    }
     const response = await diagnostics.run(() => clientId === void 0 ? this.#dispatcher.dispatch(request) : this.#requestContext.run({
       clientId,
       researchSession: researchParent !== void 0,
@@ -2800,8 +3557,16 @@ var SessionCommunicationHandler = class {
         ...typeof request.data["operationId"] !== "string" ? {} : { operationKey: key([...owner, request.data["operationId"]]) }
       }
     }, () => this.#dispatcher.dispatch(request)));
-    if (!scope.isCurrent()) return;
+    if (lifecycle !== void 0) lifecycle.lifecyclePhase = "reply-check";
+    if (!scope.isCurrent()) {
+      if (lifecycle !== void 0) {
+        lifecycle.outcome = "dropped";
+        lifecycle.reason = "stale-scope";
+      }
+      return;
+    }
     if (!publicationCurrent()) {
+      reject("not-shared");
       const error = new SessionNotSharedError();
       emit("session.communication", sessionCommunicationError(request, { code: error.code, message: error.message }));
       return;
@@ -2852,23 +3617,23 @@ var SessionCommunicationHandler = class {
 };
 
 // src/desktop-workspaces.ts
-import { createHash as createHash6 } from "node:crypto";
-import { readdir, realpath as realpath4, stat as stat5 } from "node:fs/promises";
+import { createHash as createHash7 } from "node:crypto";
+import { readdir, realpath as realpath5, stat as stat6 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { basename as basename2, join as join7, normalize } from "node:path";
-function desktopRootCandidates(environment = process.env) {
+import { basename as basename2, join as join8, normalize } from "node:path";
+function desktopRootCandidates(environment2 = process.env) {
   const candidates = [
-    environment.AGENTKNIGHT_WORKSPACE_ROOT,
-    environment.OneDrive === void 0 ? void 0 : join7(environment.OneDrive, "Desktop"),
-    environment.OneDriveCommercial === void 0 ? void 0 : join7(environment.OneDriveCommercial, "Desktop"),
-    environment.OneDriveConsumer === void 0 ? void 0 : join7(environment.OneDriveConsumer, "Desktop"),
-    join7(environment.USERPROFILE ?? homedir2(), "Desktop")
+    environment2.AGENTKNIGHT_WORKSPACE_ROOT,
+    environment2.OneDrive === void 0 ? void 0 : join8(environment2.OneDrive, "Desktop"),
+    environment2.OneDriveCommercial === void 0 ? void 0 : join8(environment2.OneDriveCommercial, "Desktop"),
+    environment2.OneDriveConsumer === void 0 ? void 0 : join8(environment2.OneDriveConsumer, "Desktop"),
+    join8(environment2.USERPROFILE ?? homedir2(), "Desktop")
   ];
   return [...new Set(candidates.filter((path) => path !== void 0))];
 }
 function workspaceId(path) {
   const normalizedPath = workspacePathKey(path);
-  return createHash6("sha256").update(normalizedPath).digest("base64url").slice(0, 32);
+  return createHash7("sha256").update(normalizedPath).digest("base64url").slice(0, 32);
 }
 function workspacePathKey(path) {
   const normalizedPath = normalize(path);
@@ -2880,8 +3645,8 @@ function isMissingPathError(error) {
 async function findDesktopRoot(candidates) {
   for (const candidate of candidates) {
     try {
-      const resolved = await realpath4(candidate);
-      if ((await stat5(resolved)).isDirectory()) {
+      const resolved = await realpath5(candidate);
+      if ((await stat6(resolved)).isDirectory()) {
         return resolved;
       }
     } catch (error) {
@@ -2903,7 +3668,7 @@ async function listDesktopWorkspaces(rootOverride) {
   const workspaces = entries.filter(
     (entry) => entry.isDirectory() && !entry.name.startsWith(".") && entry.name.trim().length > 0
   ).map((entry) => {
-    const path = join7(root, entry.name);
+    const path = join8(root, entry.name);
     return {
       id: workspaceId(path),
       name: entry.name,
@@ -2923,8 +3688,8 @@ async function resolveSessionWorkspace(path) {
     return void 0;
   }
   try {
-    const resolved = await realpath4(candidate);
-    if (!(await stat5(resolved)).isDirectory()) {
+    const resolved = await realpath5(candidate);
+    if (!(await stat6(resolved)).isDirectory()) {
       return void 0;
     }
     return {
@@ -2971,13 +3736,13 @@ async function resolveSelectableWorkspace(id, sessionWorkingDirectories, rootOve
 }
 
 // src/git-session-worktree.ts
-import { execFile } from "node:child_process";
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { lstat as lstat4, mkdir as mkdir2, realpath as realpath5, rmdir } from "node:fs/promises";
+import { execFile as execFile2 } from "node:child_process";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { lstat as lstat5, mkdir as mkdir3, realpath as realpath6, rmdir } from "node:fs/promises";
 import { devNull } from "node:os";
-import { dirname, isAbsolute as isAbsolute5, join as join8, relative as relative2 } from "node:path";
-import { promisify as promisify2 } from "node:util";
-var execFileAsync = promisify2(execFile);
+import { dirname as dirname2, isAbsolute as isAbsolute6, join as join9, relative as relative3 } from "node:path";
+import { promisify as promisify3 } from "node:util";
+var execFileAsync = promisify3(execFile2);
 function creationEnvironment() {
   const env = Object.fromEntries(
     Object.entries(process.env).filter(([key]) => !key.toUpperCase().startsWith("GIT_"))
@@ -2985,8 +3750,8 @@ function creationEnvironment() {
   return { ...env, LC_ALL: "C" };
 }
 function inside(root, path) {
-  const difference = relative2(root, path);
-  return difference === "" || !isAbsolute5(difference) && difference !== ".." && !difference.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
+  const difference = relative3(root, path);
+  return difference === "" || !isAbsolute6(difference) && difference !== ".." && !difference.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`);
 }
 async function git(env, ...args) {
   const { stdout } = await execFileAsync("git", [
@@ -3002,11 +3767,11 @@ async function git(env, ...args) {
 }
 async function listSessionWorktreeBranches(sourceDirectory) {
   const env = creationEnvironment();
-  const identity = await resolveGitProjectIdentity(sourceDirectory, env);
+  const identity2 = await resolveGitProjectIdentity(sourceDirectory, env);
   const output2 = await git(
     env,
     "-C",
-    identity.worktreeRoot,
+    identity2.worktreeRoot,
     "for-each-ref",
     "--format=%(refname)",
     "--sort=refname",
@@ -3020,7 +3785,7 @@ async function listSessionWorktreeBranches(sourceDirectory) {
   const branches = refs.map((ref) => ref.slice(prefix.length));
   let currentRef;
   try {
-    currentRef = await git(env, "-C", identity.worktreeRoot, "symbolic-ref", "--quiet", "HEAD");
+    currentRef = await git(env, "-C", identity2.worktreeRoot, "symbolic-ref", "--quiet", "HEAD");
   } catch (error) {
     if (!(error instanceof Error && "code" in error && error.code === 1)) throw error;
   }
@@ -3029,7 +3794,7 @@ async function listSessionWorktreeBranches(sourceDirectory) {
 }
 async function createSessionWorktree(sourceDirectory, requestedBranchName, requestedBaseBranch) {
   const env = creationEnvironment();
-  const identity = await resolveGitProjectIdentity(sourceDirectory, env);
+  const identity2 = await resolveGitProjectIdentity(sourceDirectory, env);
   const baseBranch = requestedBaseBranch?.trim();
   const baseRef = baseBranch === void 0 ? "HEAD" : `refs/heads/${baseBranch}`;
   if (baseBranch !== void 0) {
@@ -3042,7 +3807,7 @@ async function createSessionWorktree(sourceDirectory, requestedBranchName, reque
   }
   let head;
   try {
-    head = await git(env, "-C", identity.worktreeRoot, "rev-parse", "--verify", `${baseRef}^{commit}`);
+    head = await git(env, "-C", identity2.worktreeRoot, "rev-parse", "--verify", `${baseRef}^{commit}`);
     if (!/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(head)) throw new Error("Git returned an invalid commit ID");
   } catch (cause) {
     throw new Error(
@@ -3050,10 +3815,10 @@ async function createSessionWorktree(sourceDirectory, requestedBranchName, reque
       { cause }
     );
   }
-  const suffix = randomUUID3();
+  const suffix = randomUUID4();
   const branchName = requestedBranchName?.trim() ?? `agentknight/${suffix}`;
   try {
-    if (branchName.length === 0 || branchName.length > 120 || await git(env, "-C", identity.worktreeRoot, "check-ref-format", "--branch", branchName) !== branchName) {
+    if (branchName.length === 0 || branchName.length > 120 || await git(env, "-C", identity2.worktreeRoot, "check-ref-format", "--branch", branchName) !== branchName) {
       throw new Error("Invalid branch name");
     }
   } catch (cause) {
@@ -3061,29 +3826,29 @@ async function createSessionWorktree(sourceDirectory, requestedBranchName, reque
   }
   let exists = true;
   try {
-    await git(env, "-C", identity.worktreeRoot, "show-ref", "--verify", "--quiet", `refs/heads/${branchName}`);
+    await git(env, "-C", identity2.worktreeRoot, "show-ref", "--verify", "--quiet", `refs/heads/${branchName}`);
   } catch (error) {
     if (!(error instanceof Error && "code" in error && error.code === 1)) throw error;
     exists = false;
   }
   if (exists) throw new Error(`Git branch "${branchName}" already exists. Choose a new branch name.`);
-  const primary = await realpath5(identity.mainWorktreeRoot ?? identity.worktreeRoot);
-  const parent = dirname(primary);
-  if (inside(identity.worktreeRoot, parent)) {
+  const primary = await realpath6(identity2.mainWorktreeRoot ?? identity2.worktreeRoot);
+  const parent = dirname2(primary);
+  if (inside(identity2.worktreeRoot, parent)) {
     throw new Error("Cannot create a sibling worktree outside the source checkout. Move the repository and retry.");
   }
-  const path = join8(parent, `agentknight-worktree-${suffix}`);
+  const path = join9(parent, `agentknight-worktree-${suffix}`);
   if (path.length > 640) {
     throw new Error("The repository path is too long to report worktree recovery safely. Use a checkout closer to the filesystem root.");
   }
-  await mkdir2(path, { mode: 448 });
-  const reserved = await lstat4(path);
+  await mkdir3(path, { mode: 448 });
+  const reserved = await lstat5(path);
   try {
-    await git(env, "-C", identity.worktreeRoot, "worktree", "add", "-b", branchName, "--", path, head);
+    await git(env, "-C", identity2.worktreeRoot, "worktree", "add", "-b", branchName, "--", path, head);
   } catch (cause) {
     let cleanupError;
     try {
-      const current = await lstat4(path);
+      const current = await lstat5(path);
       if (current.dev === reserved.dev && current.ino === reserved.ino) await rmdir(path);
     } catch (error) {
       if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) cleanupError = error;
@@ -3129,7 +3894,7 @@ var SessionOptionsHandler = class {
       const sessionWorkingDirectories = request.sessionId === void 0 ? adapter.listSessions(config.userId, machineId).then((sessions) => sessions.flatMap((session) => session.workingDirectory === void 0 ? [] : [session.workingDirectory])) : Promise.resolve([]);
       const environmentDiagnostics = new OperationDiagnostics();
       const environmentSessionId = request.sessionId;
-      const sessionEnvironment = environmentSessionId === void 0 ? Promise.resolve(void 0) : environmentDiagnostics.run(() => adapter.getSessionEnvironment(environmentSessionId)).then((environment2) => {
+      const sessionEnvironment = environmentSessionId === void 0 ? Promise.resolve(void 0) : environmentDiagnostics.run(() => adapter.getSessionEnvironment(environmentSessionId)).then((environment3) => {
         this.#environmentErrors.recovered(errorKey);
         if (environmentDiagnostics.activeMs >= 1e3) {
           logger.info(
@@ -3137,7 +3902,7 @@ var SessionOptionsHandler = class {
             "copilot.session.environment.slow"
           );
         }
-        return environment2;
+        return environment3;
       }).catch((error) => {
         this.#environmentErrors.failure(errorKey, error, {
           ...diagnosticRequest(request),
@@ -3214,7 +3979,7 @@ var SessionOptionsHandler = class {
         failureStage = "models";
         throw modelFailure ?? new Error("No coding-agent models are available. Select an authenticated coding agent on the PC.");
       }
-      const environment = await sessionEnvironment;
+      const environment2 = await sessionEnvironment;
       const worktreeCreationSupported = request.sessionId === void 0 && request.capabilities?.includes(SESSION_WORKTREE_CREATION_CAPABILITY) === true;
       let worktreeChoices;
       if (worktreeCreationSupported && request.workspaceId !== void 0) {
@@ -3245,7 +4010,7 @@ var SessionOptionsHandler = class {
           currentAgentMode: current.agentMode,
           currentReasoningEffort: current.reasoningEffort
         },
-        ...environment === void 0 ? {} : { environment },
+        ...environment2 === void 0 ? {} : { environment: environment2 },
         agentName: "agentName" in capabilities && typeof capabilities.agentName === "string" ? capabilities.agentName : codingAgentPresentation(adapter.agentId).name,
         ...current?.configOptions === void 0 ? {} : { configOptions: current.configOptions }
       });
@@ -3346,15 +4111,15 @@ var OperationDeduplicator = class {
     } catch (error) {
       return Promise.reject(error);
     }
-    let resolve4 = () => {
+    let resolve5 = () => {
       throw new Error("Operation not initialized");
     };
     let reject = () => {
       throw new Error("Operation not initialized");
     };
-    const promise = new Promise((accept, fail3) => {
-      resolve4 = accept;
-      reject = fail3;
+    const promise = new Promise((accept, fail4) => {
+      resolve5 = accept;
+      reject = fail4;
     });
     const entry = {
       fingerprint: options.fingerprint,
@@ -3376,7 +4141,7 @@ var OperationDeduplicator = class {
       }
     );
     try {
-      resolve4(options.execute());
+      resolve5(options.execute());
     } catch (error) {
       reject(error);
     }
@@ -3630,9 +4395,9 @@ var SessionCommandsHandler = class {
 };
 
 // src/service/requests/session-prompt.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 function promptOperationFingerprint(request) {
-  return createHash7("sha256").update(request.sessionId).update("\0").update(request.mode).update("\0").update(request.prompt).update("\0").update(request.attachments?.map((attachment) => attachment.sha256).join(",") ?? "").update("\0").update(JSON.stringify(request.fileAttachments?.map(({ name, mimeType, sha256 }) => ({
+  return createHash8("sha256").update(request.sessionId).update("\0").update(request.mode).update("\0").update(request.prompt).update("\0").update(request.attachments?.map((attachment) => attachment.sha256).join(",") ?? "").update("\0").update(JSON.stringify(request.fileAttachments?.map(({ name, mimeType, sha256 }) => ({
     name,
     mimeType,
     sha256
@@ -3874,7 +4639,7 @@ var SessionTimelinePageHandler = class {
 };
 
 // src/a2a-client.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 import { setTimeout as delay } from "node:timers/promises";
 import { Role, TaskState } from "@a2a-js/sdk";
 import { ClientFactory, DefaultAgentCardResolver, JsonRpcTransportFactory } from "@a2a-js/sdk/client";
@@ -3969,7 +4734,7 @@ var A2aPeerClient = class {
         signal.throwIfAborted();
         client ??= await createClient(signal);
         const currentClient = client;
-        const requestMessageId = randomUUID4();
+        const requestMessageId = randomUUID5();
         let current;
         let ownedTaskId;
         let completed = false;
@@ -4038,7 +4803,7 @@ var A2aPeerClient = class {
 };
 
 // src/a2a-server.ts
-import { createHash as createHash8, randomUUID as randomUUID5 } from "node:crypto";
+import { createHash as createHash9, randomUUID as randomUUID6 } from "node:crypto";
 import {
   AgentCard,
   Role as Role2,
@@ -4137,12 +4902,12 @@ var listSchema2 = z6.object({
   includeArtifacts: z6.boolean().optional()
 }).strict();
 function deferred() {
-  let resolve4 = () => {
+  let resolve5 = () => {
   };
   const promise = new Promise((done) => {
-    resolve4 = done;
+    resolve5 = done;
   });
-  return { promise, resolve: resolve4 };
+  return { promise, resolve: resolve5 };
 }
 function scopedOwner(context) {
   const owner = context.user;
@@ -4340,7 +5105,7 @@ var A2aPeerServer = class {
     if (message === void 0) throw new RequestMalformedError("A message is required.");
     const scope = scopedOwner(context);
     const key = JSON.stringify([scope, message.messageId]);
-    const fingerprint = createHash8("sha256").update(JSON.stringify(SendMessageRequest.toJSON(params))).digest("hex");
+    const fingerprint = createHash9("sha256").update(JSON.stringify(SendMessageRequest.toJSON(params))).digest("hex");
     const previous = this.#receipts.get(key);
     if (previous !== void 0) {
       if (previous.fingerprint !== fingerprint) throw new RequestMalformedError("messageId was already used with different content.");
@@ -4366,7 +5131,7 @@ var A2aPeerServer = class {
       throw new UnsupportedOperationError("The native peer session is busy or its stop is unconfirmed.");
     }
     if (this.#receipts.size >= MAX_RECEIPTS) throw new UnsupportedOperationError("This online server's message receipt limit was reached.");
-    const probe = workingTask(randomUUID5(), message.contextId || randomUUID5(), message);
+    const probe = workingTask(randomUUID6(), message.contextId || randomUUID6(), message);
     if (JSON.stringify(Task.toJSON(probe)).length > TASK_WIRE_BUDGET - 1024) {
       throw new ContentTypeNotSupportedError("Text exceeds the response transport budget.");
     }
@@ -4460,7 +5225,7 @@ var A2aPeerServer = class {
         if (!canceled) this.host.reportError(error);
       }
       const reply = {
-        messageId: randomUUID5(),
+        messageId: randomUUID6(),
         contextId: request.contextId,
         taskId: request.taskId,
         role: Role2.ROLE_AGENT,
@@ -4613,7 +5378,7 @@ var A2aPeerServer = class {
 };
 
 // src/peer-chat.ts
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 var MAX_ACTIVE_TURNS = 4;
 var MAX_SEEN_REQUESTS = 2048;
 function peerError(error) {
@@ -4737,7 +5502,7 @@ var PeerChatRuntime = class {
       if (generation !== this.#generation) throw new Error("Peer connection changed; old result will not be replayed.");
       return this.host.send(PeerMessageSchema.parse({
         version: 1,
-        messageId: randomUUID6(),
+        messageId: randomUUID7(),
         requestId: message.messageId,
         sourceSessionId: message.targetSessionId,
         targetSessionId: message.sourceSessionId,
@@ -4840,13 +5605,13 @@ var SnapshotSync = class {
     if (!requireFreshRead && active !== void 0) {
       return active.promise;
     }
-    let resolve4;
+    let resolve5;
     let reject;
     const promise = new Promise((onResolve, onReject) => {
-      resolve4 = onResolve;
+      resolve5 = onResolve;
       reject = onReject;
     });
-    this.#pending.set(recipientClientId, { promise, resolve: resolve4, reject, requireFreshRead });
+    this.#pending.set(recipientClientId, { promise, resolve: resolve5, reject, requireFreshRead });
     this.#start();
     return promise;
   }
@@ -5215,7 +5980,7 @@ var SessionInventory = class {
 };
 
 // src/snapshot-audience.ts
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 var SnapshotAudience = class {
   constructor(send) {
     this.send = send;
@@ -5244,7 +6009,7 @@ var SnapshotAudience = class {
   async publish(snapshot, recipient) {
     const generation = this.#generation;
     const { sequence: _sequence, generatedAt: _generatedAt, ...content } = snapshot;
-    const digest = createHash9("sha256").update(JSON.stringify(content)).digest("base64url");
+    const digest = createHash10("sha256").update(JSON.stringify(content)).digest("base64url");
     if (recipient !== void 0) {
       await this.#direct(snapshot, recipient, digest, generation);
       return;
@@ -5376,11 +6141,11 @@ var ConversationAudience = class {
 };
 
 // src/timeline-incremental-transport.ts
-import { createHash as createHash11, randomUUID as randomUUID7 } from "node:crypto";
+import { createHash as createHash12, randomUUID as randomUUID8 } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 
 // src/timeline-image-cache.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 var TimelineAssetError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -5441,7 +6206,7 @@ var TimelineImageCache = class {
     if (attachment.kind !== "image" || attachment.data === void 0) return attachment;
     const parsed = ConversationAttachmentSchema.parse(attachment);
     const bytes = Buffer.from(attachment.data, "base64");
-    if (bytes.length !== parsed.byteLength || createHash10("sha256").update(bytes).digest("hex") !== parsed.sha256 || !hasSignature(bytes, parsed.mimeType)) {
+    if (bytes.length !== parsed.byteLength || createHash11("sha256").update(bytes).digest("hex") !== parsed.sha256 || !hasSignature(bytes, parsed.mimeType)) {
       throw new TimelineAssetError("IMAGE_INVALID", "Image content does not match its metadata");
     }
     const key = JSON.stringify([sessionId, parsed.sha256]);
@@ -5476,6 +6241,15 @@ function hasSignature(bytes, mimeType) {
 }
 
 // src/timeline-incremental-transport.ts
+function journalDiagnostic(state) {
+  return {
+    currentSequence: state.sequence,
+    oldestAvailableSequence: state.events[0]?.event.sequence ?? state.sequence + 1,
+    retainedEvents: state.events.length,
+    retainedBytes: state.bytes,
+    baselinePublished: state.baselinePublished
+  };
+}
 var TimelineIncrementalTransport = class {
   #sessions = /* @__PURE__ */ new Map();
   #options;
@@ -5568,8 +6342,8 @@ var TimelineIncrementalTransport = class {
   recordStep(sessionId, upsert) {
     const state = this.#session(sessionId);
     const previous = state.latest.get(upsert.activityId);
-    const base = previous?.item;
-    if (previous === void 0 || base?.kind !== "activity-group" || base.turnId !== upsert.turnId || base.actor !== upsert.actor) {
+    const base2 = previous?.item;
+    if (previous === void 0 || base2?.kind !== "activity-group" || base2.turnId !== upsert.turnId || base2.actor !== upsert.actor) {
       if (!this.#observeColdStep(state, upsert)) return;
       if (state.baselinePublished || state.sequence > 0 || state.reason === "initial") {
         this.invalidate(sessionId, "gap");
@@ -5577,18 +6351,18 @@ var TimelineIncrementalTransport = class {
       }
       return;
     }
-    if (upsert.revision < base.revision) return;
-    const existingStep = base.steps.find((step) => step.id === upsert.step.id);
-    if (upsert.revision === base.revision && upsert.status === base.status && base.sourceEventIds.includes(upsert.sourceEventId) && isDeepStrictEqual(existingStep, upsert.step)) return;
+    if (upsert.revision < base2.revision) return;
+    const existingStep = base2.steps.find((step) => step.id === upsert.step.id);
+    if (upsert.revision === base2.revision && upsert.status === base2.status && base2.sourceEventIds.includes(upsert.sourceEventId) && isDeepStrictEqual(existingStep, upsert.step)) return;
     const updated = {
-      ...base,
+      ...base2,
       revision: upsert.revision,
       status: upsert.status,
       // Match both Android reducers; deduplicate before moving an existing step.
-      steps: [...base.steps.filter((step) => step.id !== upsert.step.id), upsert.step].slice(-CONVERSATION_ACTIVITY_STEP_LIMIT),
-      sourceEventIds: base.sourceEventIds.includes(upsert.sourceEventId) ? base.sourceEventIds : [...base.sourceEventIds, upsert.sourceEventId].slice(-CONVERSATION_SOURCE_ID_LIMIT)
+      steps: [...base2.steps.filter((step) => step.id !== upsert.step.id), upsert.step].slice(-CONVERSATION_ACTIVITY_STEP_LIMIT),
+      sourceEventIds: base2.sourceEventIds.includes(upsert.sourceEventId) ? base2.sourceEventIds : [...base2.sourceEventIds, upsert.sourceEventId].slice(-CONVERSATION_SOURCE_ID_LIMIT)
     };
-    if (isDeepStrictEqual(base, updated)) return;
+    if (isDeepStrictEqual(base2, updated)) return;
     if (byteSize(updated) > this.#options.maxReplayBytes) {
       this.invalidate(sessionId, "oversized");
       return;
@@ -5599,7 +6373,7 @@ var TimelineIncrementalTransport = class {
   }
   #observeColdStep(state, upsert) {
     const cold = state.coldSteps;
-    const key = createHash11("sha256").update(JSON.stringify([upsert.activityId, upsert.step.id])).digest("hex");
+    const key = createHash12("sha256").update(JSON.stringify([upsert.activityId, upsert.step.id])).digest("hex");
     const revision = cold.revisions.get(key);
     if (revision !== void 0 && upsert.revision < revision) return false;
     cold.revisions.delete(key);
@@ -5609,7 +6383,7 @@ var TimelineIncrementalTransport = class {
       if (oldest === void 0) break;
       cold.revisions.delete(oldest);
     }
-    const fingerprint = createHash11("sha256").update(JSON.stringify(upsert)).digest("hex");
+    const fingerprint = createHash12("sha256").update(JSON.stringify(upsert)).digest("hex");
     const observed = cold.fingerprints.has(fingerprint);
     cold.fingerprints.delete(fingerprint);
     cold.fingerprints.add(fingerprint);
@@ -5645,16 +6419,34 @@ var TimelineIncrementalTransport = class {
     if (this.#closed) throw new TimelineAssetError("PC_OFFLINE", "The PC transport is closed");
     let state = this.#session(sessionId);
     const watermark = request.watermark;
+    recordTimelineSyncDiagnostic({
+      mode: watermark === void 0 ? "snapshot" : request.resume === true ? "resume" : "replay",
+      ...watermark === void 0 ? {} : {
+        epochMatches: watermark.epoch === state.epoch,
+        requestedSequence: watermark.sequence
+      },
+      ...journalDiagnostic(state),
+      headReadAttempts: 0,
+      headReadRestarts: 0
+    });
     if (watermark === void 0) {
       for (let attempt = 0; attempt < 4; attempt += 1) {
         state = this.#session(sessionId);
         const sequence2 = state.sequence;
         const coldVersion = state.coldSteps.version;
+        recordTimelineSyncDiagnostic({ ...journalDiagnostic(state), headReadAttempts: attempt + 1 });
         const page = await measureOperationPhase("read", () => this.#options.readHead(sessionId));
-        if (this.#sessions.get(sessionId) !== state || state.sequence !== sequence2 || state.coldSteps.version !== coldVersion) continue;
+        const restartCause = this.#sessions.get(sessionId) !== state ? "epoch-changed" : state.sequence !== sequence2 ? "sequence-changed" : state.coldSteps.version !== coldVersion ? "cold-step-changed" : void 0;
+        if (restartCause !== void 0) {
+          recordTimelineSyncDiagnostic({ headReadRestarts: attempt + 1, restartCause });
+          continue;
+        }
         if (state.baselinePublished) {
           this.#reconcileHead(sessionId, state, page);
-          if (this.#sessions.get(sessionId) !== state) continue;
+          if (this.#sessions.get(sessionId) !== state) {
+            recordTimelineSyncDiagnostic({ headReadRestarts: attempt + 1, restartCause: "head-reconciled" });
+            continue;
+          }
         }
         const response = validateOperationResponse(() => TimelineSyncResponseSchema.parse({
           status: "snapshot",
@@ -5671,6 +6463,12 @@ var TimelineIncrementalTransport = class {
           state.headItems = response.page.items.map(({ id, timestamp }) => ({ id, timestamp }));
           state.baselinePublished = true;
         }
+        recordTimelineSyncDiagnostic({
+          ...journalDiagnostic(state),
+          status: "snapshot",
+          responseItems: page.items.length,
+          hasMore: page.hasMore
+        });
         return response;
       }
       throw new TimelineAssetError("TIMELINE_BUSY", "Timeline changed during baseline capture; retry synchronization");
@@ -5684,7 +6482,11 @@ var TimelineIncrementalTransport = class {
       if (this.#closed) throw new TimelineAssetError("PC_OFFLINE", "The PC transport is closed");
       state = this.#session(sessionId);
     }
-    const resync = (reason) => ({ status: "resync", epoch: state.epoch, reason });
+    recordTimelineSyncDiagnostic({ ...journalDiagnostic(state), epochMatches: watermark.epoch === state.epoch });
+    const resync = (reason) => {
+      recordTimelineSyncDiagnostic({ status: "resync", resyncReason: reason });
+      return { status: "resync", epoch: state.epoch, reason };
+    };
     if (watermark.epoch !== state.epoch) return resync(state.reason === "initial" ? "epoch-changed" : state.reason);
     if (watermark.sequence > state.sequence) return resync("gap");
     const available = state.events.filter(({ event }) => event.sequence > watermark.sequence);
@@ -5700,6 +6502,7 @@ var TimelineIncrementalTransport = class {
     }
     if (events.length === 0 && available.length > 0) return resync("oversized");
     const sequence = events.at(-1)?.sequence ?? watermark.sequence;
+    recordTimelineSyncDiagnostic({ status: "replay", responseEvents: events.length, hasMore: sequence < state.sequence });
     return {
       status: "replay",
       watermark: { epoch: state.epoch, sequence },
@@ -5713,7 +6516,7 @@ var TimelineIncrementalTransport = class {
     let state = this.#sessions.get(sessionId);
     if (state === void 0) {
       state = {
-        epoch: randomUUID7(),
+        epoch: randomUUID8(),
         sequence: 0,
         reason: "initial",
         events: [],
@@ -5755,8 +6558,13 @@ var TimelineIncrementalTransport = class {
       const state = this.#session(sessionId);
       const sequence = state.sequence;
       const coldVersion = state.coldSteps.version;
+      recordTimelineSyncDiagnostic({ ...journalDiagnostic(state), headReadAttempts: attempt + 1 });
       const page = await measureOperationPhase("read", () => this.#options.readHead(sessionId));
-      if (this.#sessions.get(sessionId) !== state || state.sequence !== sequence || state.coldSteps.version !== coldVersion) continue;
+      const restartCause = this.#sessions.get(sessionId) !== state ? "epoch-changed" : state.sequence !== sequence ? "sequence-changed" : state.coldSteps.version !== coldVersion ? "cold-step-changed" : void 0;
+      if (restartCause !== void 0) {
+        recordTimelineSyncDiagnostic({ headReadRestarts: attempt + 1, restartCause });
+        continue;
+      }
       this.#reconcileHead(sessionId, state, page);
       return;
     }
@@ -5785,11 +6593,11 @@ var TimelineIncrementalTransport = class {
     if (this.#waiters >= 64) throw new TimelineAssetError("TIMELINE_BUSY", "Too many pending timeline requests");
     this.#waiters += 1;
     try {
-      await new Promise((resolve4) => {
+      await new Promise((resolve5) => {
         const wake = () => {
           clearTimeout(timer);
           state.wake.delete(wake);
-          resolve4();
+          resolve5();
         };
         const timer = setTimeout(wake, Math.min(waitMs, 2e4));
         state.wake.add(wake);
@@ -6352,9 +7160,9 @@ var INVENTORY_REFRESH_DEBOUNCE_MS = 100;
 var SESSION_LIST_REFRESH_RETRIES = 2;
 var TRAFFIC_METRICS_INTERVAL_MS = 6e4;
 var PcAgent = class {
-  constructor(config, identity, appVersion, adapter, logger, pairingProvider, contentCipher, research, createSocket = (uri, options) => io(uri, options), onPairing) {
+  constructor(config, identity2, appVersion, adapter, logger, pairingProvider, contentCipher, research, createSocket = (uri, options) => io(uri, options), onPairing) {
     this.config = config;
-    this.identity = identity;
+    this.identity = identity2;
     this.appVersion = appVersion;
     this.adapter = adapter;
     this.logger = logger;
@@ -6365,8 +7173,8 @@ var PcAgent = class {
       adapter = researchAwareCodingAgentAdapter(adapter, research.chat);
       this.adapter = adapter;
     }
-    this.#stopped = new Promise((resolve4) => {
-      this.#resolveStopped = resolve4;
+    this.#stopped = new Promise((resolve5) => {
+      this.#resolveStopped = resolve5;
     });
     this.#cipher = contentCipher;
     this.#publication = new SessionPublicationScope(
@@ -6385,8 +7193,8 @@ var PcAgent = class {
     });
     this.#inventory = new SessionInventory({
       userId: config.userId,
-      machineId: identity.machineId,
-      machineName: identity.machineName,
+      machineId: identity2.machineId,
+      machineName: identity2.machineName,
       agentRunId: this.#agentRunId,
       adapter,
       logger
@@ -6401,7 +7209,7 @@ var PcAgent = class {
       readHead: (sessionId) => this.adapter.readSessionTimelinePage(sessionId, { pageSize: 100 })
     });
     const emit = (event, payload) => this.#emitSecure(event, payload);
-    const handlerOptions = { adapter, config, machineId: identity.machineId, logger, emit };
+    const handlerOptions = { adapter, config, machineId: identity2.machineId, logger, emit };
     this.#communication = new SessionCommunicationHandler({
       ...handlerOptions,
       agentRunId: this.#agentRunId,
@@ -6454,14 +7262,14 @@ var PcAgent = class {
     this.#timelinePages = new SessionTimelinePageHandler({
       ...handlerOptions,
       publications: this.#publication,
-      encoder: new TimelineResponseEncoder(contentCipher, identity.machineId, this.#clientId),
+      encoder: new TimelineResponseEncoder(contentCipher, identity2.machineId, this.#clientId),
       trafficMetrics: this.#trafficMetrics,
       sendSealed: (message) => this.#socket.emit("secure.message", message),
       imageReferencesEnabled: () => this.#communicationNegotiated && this.#conversationAudience.confirmed,
       referenceItem: (sessionId, item) => this.#timelineIncremental.images.referenceItem(sessionId, item)
     });
     this.#secureRequestRouter = createPcSecureRequestRouter({
-      configuredMachineId: identity.machineId,
+      configuredMachineId: identity2.machineId,
       handlers: {
         sessionCommunication: (request) => this.#admitRequest(request, "session.communication", () => this.#communication.handle(request, this.#requestScope())),
         sessionList: (request) => this.#admitRequest(request, "session.list.result", () => this.#handleSessionList(request)),
@@ -6489,6 +7297,7 @@ var PcAgent = class {
         autoConnect: false,
         reconnection: true,
         transports: ["websocket", "polling"],
+        tryAllTransports: true,
         auth: {
           transportVersion: 2,
           protocolVersion: PROTOCOL_VERSION,
@@ -6496,7 +7305,7 @@ var PcAgent = class {
           token: config.relayToken,
           clientId: this.#clientId,
           userId: config.userId,
-          machineId: identity.machineId,
+          machineId: identity2.machineId,
           keyId: contentCipher.keyId
         }
       }
@@ -6518,11 +7327,11 @@ var PcAgent = class {
       relayUrl: config.relayUrl,
       relayToken: config.relayToken,
       userId: config.userId,
-      machineId: identity.machineId,
+      machineId: identity2.machineId,
       reportError: reportPeerError
     });
     this.#peerChat = new PeerChatRuntime({
-      machineId: identity.machineId,
+      machineId: identity2.machineId,
       assertReady: assertPeerReady,
       send: (message) => this.#sendPeerMessage(message),
       createConversation: (request) => a2aClient.conversation(request),
@@ -6537,7 +7346,7 @@ var PcAgent = class {
         if (!this.#a2aNegotiated) throw new Error("Relay has not negotiated A2A support.");
       },
       assertSession: async (sessionId) => {
-        if (adapter.isSessionVisible?.(sessionId) === false || !(await adapter.listSessions(config.userId, identity.machineId)).some((session) => session.sessionId === sessionId)) {
+        if (adapter.isSessionVisible?.(sessionId) === false || !(await adapter.listSessions(config.userId, identity2.machineId)).some((session) => session.sessionId === sessionId)) {
           throw new Error("The requested Agent session is not shared or no longer exists.");
         }
       },
@@ -6652,7 +7461,7 @@ var PcAgent = class {
       onInteractionDismissed: (sessionId, interactionRequestId) => {
         const payload = InteractionRespondResultSchema.parse({
           ok: false,
-          requestId: randomUUID8(),
+          requestId: randomUUID9(),
           interactionRequestId,
           machineId: this.identity.machineId,
           sessionId,
@@ -6669,7 +7478,9 @@ var PcAgent = class {
             this.#supersededInteractions.delete(oldestInteractionRequestId);
           }
         }
-        this.#emitSecure("interaction.respond.result", payload, void 0, true);
+        if (this.#machineRegistered) {
+          this.#emitSecure("interaction.respond.result", payload, void 0, true);
+        }
       },
       onPermissionRequest: (sessionId, permissionRequestId, request) => {
         const payload = PermissionRequestPayloadSchema.parse({
@@ -6747,8 +7558,8 @@ var PcAgent = class {
   pairingProvider;
   research;
   onPairing;
-  #agentRunId = randomUUID8();
-  #clientId = randomUUID8();
+  #agentRunId = randomUUID9();
+  #clientId = randomUUID9();
   #socket;
   #relayDiagnostics = new RelayConnectionDiagnostics();
   #cipher;
@@ -6865,25 +7676,25 @@ var PcAgent = class {
     if (!this.#peerTransportNegotiated || !this.#machineRegistered || !this.#socket.connected) {
       return Promise.reject(new Error("Peer channel is offline or unsupported; nothing will be queued."));
     }
-    return new Promise((resolve4, reject) => {
-      const timer = setTimeout(() => fail3(new Error("Peer forwarding acknowledgement timed out; delivery is unknown.")), ACK_TIMEOUT_MS);
-      const fail3 = (error) => {
+    return new Promise((resolve5, reject) => {
+      const timer = setTimeout(() => fail4(new Error("Peer forwarding acknowledgement timed out; delivery is unknown.")), ACK_TIMEOUT_MS);
+      const fail4 = (error) => {
         clearTimeout(timer);
-        this.#pendingAcks.delete(fail3);
+        this.#pendingAcks.delete(fail4);
         reject(error);
       };
-      this.#pendingAcks.add(fail3);
+      this.#pendingAcks.add(fail4);
       try {
         this.#socket.emit("peer.message", message, (rawAck) => {
           clearTimeout(timer);
-          if (!this.#pendingAcks.delete(fail3)) return;
+          if (!this.#pendingAcks.delete(fail4)) return;
           const ack = OperationAckSchema.safeParse(rawAck);
           if (!ack.success) reject(new Error("Relay sent an invalid peer forwarding acknowledgement."));
           else if (!ack.data.ok) reject(new Error(`${ack.data.code}: ${ack.data.message}`));
-          else resolve4();
+          else resolve5();
         });
       } catch (error) {
-        fail3(error instanceof Error ? error : new Error(String(error)));
+        fail4(error instanceof Error ? error : new Error(String(error)));
       }
     });
   }
@@ -7097,6 +7908,7 @@ var PcAgent = class {
       const diagnostics = this.#relayDiagnostics.disconnected(reason, details);
       this.#connectionGeneration += 1;
       this.#machineRegistered = false;
+      if (this.#socket.sendBuffer !== void 0) this.#socket.sendBuffer.length = 0;
       this.#initialSyncGeneration = void 0;
       this.#communicationNegotiated = false;
       this.#peerNegotiated = false;
@@ -7744,24 +8556,24 @@ var PcAgent = class {
     });
   }
   #emitWithAck(event, payload) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       if (!this.#socket.connected || this.#stopping) {
         reject(new SnapshotSyncCancelledError());
         return;
       }
       const timer = setTimeout(() => {
-        fail3(new Error(`${event} acknowledgement timed out`));
+        fail4(new Error(`${event} acknowledgement timed out`));
       }, ACK_TIMEOUT_MS);
-      const fail3 = (error) => {
+      const fail4 = (error) => {
         clearTimeout(timer);
-        this.#pendingAcks.delete(fail3);
+        this.#pendingAcks.delete(fail4);
         reject(error);
       };
-      this.#pendingAcks.add(fail3);
+      this.#pendingAcks.add(fail4);
       const receiveAck = (ack) => {
         clearTimeout(timer);
-        this.#pendingAcks.delete(fail3);
-        resolve4(ack);
+        this.#pendingAcks.delete(fail4);
+        resolve5(ack);
       };
       try {
         if (event === "machine.hello") {
@@ -7775,7 +8587,7 @@ var PcAgent = class {
         }
       } catch (error) {
         clearTimeout(timer);
-        this.#pendingAcks.delete(fail3);
+        this.#pendingAcks.delete(fail4);
         reject(error);
       }
     });
@@ -7870,34 +8682,34 @@ function createResearchContextReader(options) {
   };
 }
 function contextItem(item) {
-  const identity = {
+  const identity2 = {
     kind: item.kind,
     actor: item.actor,
     id: item.id,
     turnId: item.turnId,
     sourceEventIds: item.sourceEventIds
   };
-  if (item.kind === "activity-group") return { ...identity, steps: item.steps, toolResultsUnavailable: true };
+  if (item.kind === "activity-group") return { ...identity2, steps: item.steps, toolResultsUnavailable: true };
   return {
-    ...identity,
+    ...identity2,
     content: item.content,
     ...item.kind === "plan-update" ? { todos: item.todos } : {}
   };
 }
 
 // src/research-sessions.ts
-import { execFile as execFile2 } from "node:child_process";
-import { createHash as createHash12, randomUUID as randomUUID11 } from "node:crypto";
-import { mkdir as mkdir4, lstat as lstat7, realpath as realpath7 } from "node:fs/promises";
+import { execFile as execFile3 } from "node:child_process";
+import { createHash as createHash13, randomUUID as randomUUID12 } from "node:crypto";
+import { mkdir as mkdir5, lstat as lstat8, realpath as realpath8 } from "node:fs/promises";
 import { createRequire } from "node:module";
-import { join as join11, resolve as resolve3 } from "node:path";
-import { promisify as promisify3 } from "node:util";
+import { join as join12, resolve as resolve4 } from "node:path";
+import { promisify as promisify4 } from "node:util";
 import { z as z9 } from "zod";
 
 // src/research-thread-store.ts
-import { randomUUID as randomUUID9 } from "node:crypto";
-import { mkdir as mkdir3, readFile as readFile2, rename as rename2, rm, lstat as lstat5, realpath as realpath6, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join9, resolve as resolve2 } from "node:path";
+import { randomUUID as randomUUID10 } from "node:crypto";
+import { mkdir as mkdir4, readFile as readFile2, rename as rename2, rm as rm2, lstat as lstat6, realpath as realpath7, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join10, resolve as resolve3 } from "node:path";
 import { z as z7 } from "zod";
 var RESEARCH_PROFILE = "research-readonly";
 var RESEARCH_PROFILE_VERSION = 1;
@@ -7937,20 +8749,20 @@ var ResearchThreadStore = class {
   #loaded;
   #mutation = Promise.resolve();
   constructor(dataDirectory) {
-    this.directory = resolve2(dataDirectory, "research");
-    this.#file = join9(this.directory, "threads.json");
+    this.directory = resolve3(dataDirectory, "research");
+    this.#file = join10(this.directory, "threads.json");
   }
   initialize() {
     this.#loaded ??= this.#load();
     return this.#loaded;
   }
   async #load() {
-    await mkdir3(this.directory, { recursive: true, mode: 448 });
-    if ((await lstat5(this.directory)).isSymbolicLink() || await realpath6(this.directory) !== this.directory) {
+    await mkdir4(this.directory, { recursive: true, mode: 448 });
+    if ((await lstat6(this.directory)).isSymbolicLink() || await realpath7(this.directory) !== this.directory) {
       throw new ResearchError("RESEARCH_PRIVATE_DIRECTORY_INVALID");
     }
     try {
-      const metadata = await lstat5(this.#file);
+      const metadata = await lstat6(this.#file);
       if (metadata.isSymbolicLink() || metadata.size > 32 * 1024 * 1024) throw new ResearchError("RESEARCH_STORE_INVALID");
       const parsed = JSON.parse(await readFile2(this.#file, "utf8"));
       const data = documentSchema.parse(parsed);
@@ -7971,19 +8783,19 @@ var ResearchThreadStore = class {
       throw new ResearchError("RESEARCH_STORE_INVALID", "Research metadata cannot be safely loaded", { cause: error });
     }
   }
-  async #write(records, tombstones = this.#tombstones) {
-    const staging = join9(this.directory, `threads-${randomUUID9()}.pending`);
+  async #write(records2, tombstones = this.#tombstones) {
+    const staging = join10(this.directory, `threads-${randomUUID10()}.pending`);
     try {
-      await writeFile2(staging, JSON.stringify({
+      await writeFile3(staging, JSON.stringify({
         version: 1,
-        threads: [...records.values()],
+        threads: [...records2.values()],
         tombstones: [...tombstones].map(([researchSessionId, parentSessionId]) => ({ researchSessionId, parentSessionId }))
       }), { flag: "wx", mode: 384 });
       await rename2(staging, this.#file);
-      this.#records = records;
+      this.#records = records2;
       this.#tombstones = tombstones;
     } finally {
-      await rm(staging, { force: true });
+      await rm2(staging, { force: true });
     }
   }
   async #serialized(work) {
@@ -8005,8 +8817,8 @@ var ResearchThreadStore = class {
       }
       const record = recordSchema.parse({
         ...input,
-        threadId: randomUUID9(),
-        researchSessionId: randomUUID9(),
+        threadId: randomUUID10(),
+        researchSessionId: randomUUID10(),
         profile: RESEARCH_PROFILE,
         profileVersion: RESEARCH_PROFILE_VERSION,
         createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -8060,9 +8872,9 @@ var ResearchThreadStore = class {
 };
 
 // src/research-chat-store.ts
-import { randomUUID as randomUUID10 } from "node:crypto";
-import { lstat as lstat6, readFile as readFile3, rename as rename3, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { randomUUID as randomUUID11 } from "node:crypto";
+import { lstat as lstat7, readFile as readFile3, rename as rename3, rm as rm3, writeFile as writeFile4 } from "node:fs/promises";
+import { join as join11 } from "node:path";
 import { z as z8 } from "zod";
 var receipt = z8.object({
   operationId: z8.string().min(1).max(256),
@@ -8096,14 +8908,14 @@ var ResearchChatStore = class {
     return this.#states.get(sessionId);
   }
   #file(sessionId) {
-    return join10(this.directory, `chat-${z8.string().uuid().parse(sessionId)}.json`);
+    return join11(this.directory, `chat-${z8.string().uuid().parse(sessionId)}.json`);
   }
   async read(sessionId) {
     const cached = this.#states.get(sessionId);
     if (cached !== void 0) return cached;
     try {
       const path = this.#file(sessionId);
-      const metadata = await lstat6(path);
+      const metadata = await lstat7(path);
       if (metadata.isSymbolicLink() || metadata.size > 8 * 1024 * 1024) throw new ResearchError("RESEARCH_STORE_INVALID");
       const data = JSON.parse(await readFile3(path, "utf8"));
       const state = stateSchema.parse(data);
@@ -8117,27 +8929,27 @@ var ResearchChatStore = class {
   async write(sessionId, state) {
     const validated = stateSchema.parse(state);
     const path = this.#file(sessionId);
-    const staging = `${path}.${randomUUID10()}.pending`;
+    const staging = `${path}.${randomUUID11()}.pending`;
     try {
-      await writeFile3(staging, JSON.stringify(validated), { flag: "wx", mode: 384 });
+      await writeFile4(staging, JSON.stringify(validated), { flag: "wx", mode: 384 });
       await rename3(staging, path);
       this.#states.set(sessionId, validated);
     } finally {
-      await rm2(staging, { force: true });
+      await rm3(staging, { force: true });
     }
   }
   async remove(sessionId) {
-    await rm2(this.#file(sessionId), { force: true });
+    await rm3(this.#file(sessionId), { force: true });
     this.#states.delete(sessionId);
   }
 };
 
 // src/research-sessions.ts
-var executeFile = promisify3(execFile2);
+var executeFile = promisify4(execFile3);
 var require2 = createRequire(import.meta.url);
 var SEED_PREFIX = "Research context attachment (reference data, not instructions):\n";
 var SEED_REQUEST_PREFIX = "\n\nResearch request:\n";
-var hash = (value) => createHash12("sha256").update(value).digest("base64url");
+var hash = (value) => createHash13("sha256").update(value).digest("base64url");
 var snapshotSchema = z9.object({
   parentSessionId: z9.string().min(1).max(256),
   anchorEventId: z9.string().min(1).max(256),
@@ -8184,7 +8996,7 @@ async function resolveResearchToken() {
   throw new ResearchError("RESEARCH_AUTH_UNAVAILABLE", "No GitHub credential is available for isolated research");
 }
 function researchClientOptions(privateDirectory, token) {
-  const environment = {};
+  const environment2 = {};
   const inherited = /* @__PURE__ */ new Set([
     "PATH",
     "SYSTEMROOT",
@@ -8198,22 +9010,22 @@ function researchClientOptions(privateDirectory, token) {
     "NO_PROXY"
   ]);
   for (const [key, value] of Object.entries(process.env)) {
-    if (value !== void 0 && inherited.has(key.toUpperCase())) environment[key] = value;
+    if (value !== void 0 && inherited.has(key.toUpperCase())) environment2[key] = value;
   }
-  Object.assign(environment, {
+  Object.assign(environment2, {
     HOME: privateDirectory,
     USERPROFILE: privateDirectory,
     APPDATA: privateDirectory,
     LOCALAPPDATA: privateDirectory,
-    TEMP: join11(privateDirectory, "scratch"),
-    TMP: join11(privateDirectory, "scratch")
+    TEMP: join12(privateDirectory, "scratch"),
+    TMP: join12(privateDirectory, "scratch")
   });
   return {
     mode: "empty",
     baseDirectory: privateDirectory,
     workingDirectory: privateDirectory,
     connection: { kind: "stdio", path: require2.resolve("@github/copilot/npm-loader.js") },
-    env: environment,
+    env: environment2,
     gitHubToken: token,
     useLoggedInUser: false,
     builtinPluginDirectories: [],
@@ -8269,7 +9081,7 @@ var ResearchSessions = class {
   constructor(options) {
     this.options = options;
     this.store = new ResearchThreadStore(options.dataDirectory);
-    this.#privateDirectory = join11(this.store.directory, "runtime");
+    this.#privateDirectory = join12(this.store.directory, "runtime");
     this.#chat = new ResearchChatStore(this.store.directory);
     this.#projection = new LiveTimelineProjection({
       state: (id) => this.#state(id),
@@ -8290,7 +9102,7 @@ var ResearchSessions = class {
     });
   }
   options;
-  #generation = randomUUID11();
+  #generation = randomUUID12();
   store;
   #privateDirectory;
   #active = /* @__PURE__ */ new Map();
@@ -8359,8 +9171,8 @@ var ResearchSessions = class {
         this.#failedClient = void 0;
       }
       await this.store.initialize();
-      await mkdir4(join11(this.#privateDirectory, "scratch"), { recursive: true, mode: 448 });
-      if ((await lstat7(this.#privateDirectory)).isSymbolicLink() || await realpath7(this.#privateDirectory) !== resolve3(this.#privateDirectory)) {
+      await mkdir5(join12(this.#privateDirectory, "scratch"), { recursive: true, mode: 448 });
+      if ((await lstat8(this.#privateDirectory)).isSymbolicLink() || await realpath8(this.#privateDirectory) !== resolve4(this.#privateDirectory)) {
         throw new ResearchError("RESEARCH_PRIVATE_DIRECTORY_INVALID");
       }
       const token = await (this.options.resolveToken ?? resolveResearchToken)();
@@ -8412,7 +9224,7 @@ var ResearchSessions = class {
         record.parentSessionId,
         { workingDirectory: record.workingDirectory, rootIdentity: record.rootIdentity },
         this.options.sourceMetadata,
-        [resolve3(this.options.dataDirectory), this.#privateDirectory],
+        [resolve4(this.options.dataDirectory), this.#privateDirectory],
         (error, context) => this.options.onError?.(error, {
           ...context,
           researchSessionId: record.researchSessionId
@@ -8549,7 +9361,7 @@ var ResearchSessions = class {
     if (snapshot.parentSessionId !== input.parentSessionId) throw new ResearchError("RESEARCH_SOURCE_MISMATCH");
     const title = z9.string().trim().min(1).max(200).parse(input.title ?? "Research");
     const prompt = z9.string().trim().min(1).max(16e3).parse(input.prompt ?? "Acknowledge the context briefly and wait for my research question.");
-    const fingerprint = createHash12("sha256").update(JSON.stringify({
+    const fingerprint = createHash13("sha256").update(JSON.stringify({
       parentSessionId: input.parentSessionId,
       title,
       prompt,
@@ -8672,8 +9484,8 @@ var ResearchSessions = class {
     };
   }
   async list(parentSessionId) {
-    const records = (await this.store.list(parentSessionId)).filter((record) => this.options.sourceVisible?.(record.parentSessionId) !== false);
-    for (const record of records) {
+    const records2 = (await this.store.list(parentSessionId)).filter((record) => this.options.sourceVisible?.(record.parentSessionId) !== false);
+    for (const record of records2) {
       if (record.state === "deleting" && !this.#mutating.has(record.researchSessionId) && !this.#deletionAttempts.has(record.researchSessionId)) {
         await this.delete(record.researchSessionId);
       }
@@ -8750,7 +9562,7 @@ var ResearchSessions = class {
       compactDisabledReason: "Research context compaction is unavailable"
     });
   }
-  async send(sessionId, text, operationId = randomUUID11()) {
+  async send(sessionId, text, operationId = randomUUID12()) {
     if (this.#active.get(sessionId)?.runtime.activity.busy) throw new ResearchError("RESEARCH_BUSY");
     return (await this.sendPrompt(sessionId, text, "immediate", operationId)).messageId;
   }
@@ -9081,7 +9893,7 @@ async function initialize(options) {
     ...parsed.secureMessagePacketBudget === void 0 ? {} : { secureMessagePacketBudget: parsed.secureMessagePacketBudget },
     ...options.codingAgent === void 0 ? {} : { codingAgent: options.codingAgent }
   };
-  const identity = DeviceIdentitySchema.parse(options.identity);
+  const identity2 = DeviceIdentitySchema.parse(options.identity);
   const appVersion = options.appVersion ?? z10.object({ version: z10.string().min(1) }).parse(JSON.parse(await readFile4(new URL("../package.json", import.meta.url), "utf8"))).version;
   const lease = options.directoryLease ?? await DataDirectoryLease.acquire(dataDirectory);
   let detach;
@@ -9096,11 +9908,11 @@ async function initialize(options) {
     adapter = options.adapter ?? await createCodingAgentAdapter(
       config,
       (message) => options.logger.warn({ error: { message } }, "coding-agent.diagnostic"),
-      { userId: config.userId, machineId: identity.machineId }
+      { userId: config.userId, machineId: identity2.machineId }
     );
     const contentKey = await loadOrCreateContentKey(dataDirectory);
     const cipher = await createPersistentContentCipher(dataDirectory, contentKey);
-    const pairingProvider = new CachedPairingProvider(() => requestPairingUri(config, identity, contentKey));
+    const pairingProvider = new CachedPairingProvider(() => requestPairingUri(config, identity2, contentKey));
     const sourceAdapter = adapter;
     const sourceMetadata = async (sessionId) => {
       const access2 = captureResearchAccess(sourceAdapter, sessionId);
@@ -9138,7 +9950,7 @@ async function initialize(options) {
       }, "research.operation.failed")
     });
     class InitializedAgent extends PcAgent {
-      identityHash = createHash13("sha256").update(`${config.userId}:${identity.machineId}:${contentKey.keyId}`).digest("hex");
+      identityHash = createHash14("sha256").update(`${config.userId}:${identity2.machineId}:${contentKey.keyId}`).digest("hex");
       #started;
       #starting;
       #closed;
@@ -9178,7 +9990,7 @@ async function initialize(options) {
     }
     return new InitializedAgent(
       config,
-      identity,
+      identity2,
       appVersion,
       adapter,
       options.logger,