@ai-development-environment/control-agent 0.0.29 → 0.0.31

package/dist/control-agent.js

@@ -1506,6 +1506,8 @@ var WORKTREE_BRANCH_JOB_KIND = "worktree.branch";
 var WORKTREE_MOVE_PUSH_JOB_KIND = "worktree.move.push";
 var WORKTREE_MOVE_CHECKOUT_JOB_KIND = "worktree.move.checkout";
 var WORKTREE_DELETE_JOB_KIND = "worktree.delete";
+var WORKTREE_DIFF_JOB_KIND = "worktree.diff.inspect";
+var WORKTREE_DIFF_ASSET_JOB_KIND = "worktree.diff.asset";
 var WORKTREE_JOB_KINDS = [
   WORKTREE_INSPECT_JOB_KIND,
   WORKTREE_OPERATION_JOB_KIND,
@@ -1513,7 +1515,9 @@ var WORKTREE_JOB_KINDS = [
   WORKTREE_BRANCH_JOB_KIND,
   WORKTREE_MOVE_PUSH_JOB_KIND,
   WORKTREE_MOVE_CHECKOUT_JOB_KIND,
-  WORKTREE_DELETE_JOB_KIND
+  WORKTREE_DELETE_JOB_KIND,
+  WORKTREE_DIFF_JOB_KIND,
+  WORKTREE_DIFF_ASSET_JOB_KIND
 ];
 var DEFAULT_JIRA_BRANCH_REGEX = String.raw`\b([A-Z][A-Z0-9_]*-\d+)\b`;
 var WORKTREE_OPERATIONS = [
@@ -1534,6 +1538,13 @@ function validGitBranchName(value) {
   }
   return value.split("/").every((part) => part && !part.startsWith(".") && !part.endsWith(".lock"));
 }
+var WORKTREE_DIFF_SCOPES = [
+  "STAGED",
+  "UNSTAGED",
+  "UNTRACKED",
+  "COMMIT",
+  "BRANCH"
+];
 function objectValue4(value, name) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(`${name} must be an object`);
@@ -1550,6 +1561,13 @@ function nullableString3(value, name) {
   if (value === null || value === void 0) return null;
   return stringValue4(value, name);
 }
+function safeRelativePath(value, name) {
+  const path = stringValue4(value, name).replaceAll("\\", "/");
+  if (path.startsWith("/") || /^[A-Za-z]:\//.test(path) || path.split("/").includes("..") || path.includes("\0")) {
+    throw new Error(`${name} must stay within the worktree`);
+  }
+  return path;
+}
 function worktreeBranchJobPayload(value) {
   const payload = objectValue4(value, "worktree branch payload");
   const allowed = /* @__PURE__ */ new Set([
@@ -1858,6 +1876,73 @@ function worktreeJobPayload(value) {
     ...editorVariant === void 0 ? {} : { editorVariant }
   };
 }
+function worktreeDiffPayload(value) {
+  const payload = objectValue4(value, "worktree diff payload");
+  const allowed = /* @__PURE__ */ new Set([
+    "codebaseId",
+    "folder",
+    "gitDirectory",
+    "expectedOrigin",
+    "baseBranch",
+    "scope",
+    "path",
+    "previousPath",
+    "commitSha",
+    "uploadId",
+    "side"
+  ]);
+  const unexpected = Object.keys(payload).find((key) => !allowed.has(key));
+  if (unexpected) {
+    throw new Error(`Unexpected worktree diff payload field: ${unexpected}`);
+  }
+  if (!WORKTREE_DIFF_SCOPES.includes(payload.scope)) {
+    throw new Error("worktree diff payload.scope is invalid");
+  }
+  if (payload.side !== null && payload.side !== void 0 && payload.side !== "BEFORE" && payload.side !== "AFTER") {
+    throw new Error("worktree diff payload.side is invalid");
+  }
+  const path = payload.path === null || payload.path === void 0 ? null : safeRelativePath(payload.path, "worktree diff payload.path");
+  const previousPath = payload.previousPath === null || payload.previousPath === void 0 ? null : safeRelativePath(
+    payload.previousPath,
+    "worktree diff payload.previousPath"
+  );
+  const scope = payload.scope;
+  const commitSha = nullableString3(
+    payload.commitSha,
+    "worktree diff payload.commitSha"
+  );
+  if (scope === "COMMIT" && !commitSha) {
+    throw new Error("Commit diffs require a commit SHA");
+  }
+  return {
+    codebaseId: stringValue4(
+      payload.codebaseId,
+      "worktree diff payload.codebaseId"
+    ),
+    folder: stringValue4(payload.folder, "worktree diff payload.folder"),
+    gitDirectory: stringValue4(
+      payload.gitDirectory,
+      "worktree diff payload.gitDirectory"
+    ),
+    expectedOrigin: stringValue4(
+      payload.expectedOrigin,
+      "worktree diff payload.expectedOrigin"
+    ),
+    baseBranch: stringValue4(
+      payload.baseBranch,
+      "worktree diff payload.baseBranch"
+    ),
+    scope,
+    path,
+    previousPath,
+    commitSha,
+    uploadId: nullableString3(
+      payload.uploadId,
+      "worktree diff payload.uploadId"
+    ),
+    side: payload.side ?? null
+  };
+}
 function worktreeWatchJobPayload(value) {
   const payload = objectValue4(value, "worktree watch payload");
   const allowed = /* @__PURE__ */ new Set([
@@ -2201,6 +2286,9 @@ var IOS_BUILD_DELETE_JOB_KIND = "ios.build.delete";
 var IOS_ARTIFACT_DOWNLOAD_JOB_KIND = "ios.artifact.download";
 var IOS_DEPLOY_JOB_KIND = "ios.build.deploy";
 var IOS_EXPORT_JOB_KIND = "ios.archive.export";
+var IOS_TEST_RESULTS_JOB_KIND = "ios.test-results.parse";
+var IOS_COVERAGE_REPORT_JOB_KIND = "ios.coverage.generate";
+var IOS_SIGNING_INSPECT_JOB_KIND = "ios.signing.inspect";
 var IOS_BUILD_JOB_KINDS = [
   IOS_SOURCE_DISCOVER_JOB_KIND,
   IOS_SOURCE_PARSE_JOB_KIND,
@@ -2210,7 +2298,10 @@ var IOS_BUILD_JOB_KINDS = [
   IOS_BUILD_DELETE_JOB_KIND,
   IOS_ARTIFACT_DOWNLOAD_JOB_KIND,
   IOS_DEPLOY_JOB_KIND,
-  IOS_EXPORT_JOB_KIND
+  IOS_EXPORT_JOB_KIND,
+  IOS_TEST_RESULTS_JOB_KIND,
+  IOS_COVERAGE_REPORT_JOB_KIND,
+  IOS_SIGNING_INSPECT_JOB_KIND
 ];
 var BUILD_ACTIONS = [
   "BUILD",
@@ -2259,6 +2350,7 @@ var DEFAULT_BUILD_ADVANCED_SETTINGS = {
   allowProvisioningDeviceRegistration: false,
   testPlan: null,
   codeCoverage: false,
+  parseTestResults: true,
   parallelTesting: null,
   parallelTestingWorkers: null,
   onlyTesting: [],
@@ -2268,6 +2360,7 @@ var DEFAULT_BUILD_ADVANCED_SETTINGS = {
   priorTestProductsPath: null,
   priorXctestrunPath: null
 };
+var BUILD_REPORT_KINDS = ["TEST_RESULTS", "CODE_COVERAGE"];
 function objectValue6(value, name) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(`${name} must be an object`);
@@ -2293,7 +2386,7 @@ function enumValue3(value, values, name) {
   }
   return value;
 }
-function safeRelativePath(value, name) {
+function safeRelativePath2(value, name) {
   const path = stringValue6(value, name);
   if (path.startsWith("/") || /^[A-Za-z]:[\\/]/.test(path) || path.split(/[\\/]/).includes("..") || path.includes("\0")) {
     throw new Error(`${name} must stay within the worktree`);
@@ -2318,13 +2411,14 @@ function worktreeIdentity(value) {
       value.expectedOrigin,
       "build payload.expectedOrigin"
     ),
-    headSha: nullableString4(value.headSha, "build payload.headSha")
+    headSha: nullableString4(value.headSha, "build payload.headSha"),
+    baseBranch: nullableString4(value.baseBranch, "build payload.baseBranch")
   };
 }
 function parseBuildSource(value) {
   const source = objectValue6(value, "build source");
   const kind = enumValue3(source.kind, BUILD_SOURCE_KINDS, "build source.kind");
-  const relativePath = safeRelativePath(
+  const relativePath = safeRelativePath2(
     source.relativePath,
     "build source.relativePath"
   );
@@ -2443,6 +2537,10 @@ function parseBuildAdvancedSettings(value) {
       input.codeCoverage,
       "advanced settings.codeCoverage"
     ),
+    parseTestResults: booleanValue2(
+      input.parseTestResults,
+      "advanced settings.parseTestResults"
+    ),
     parallelTesting: parallel,
     parallelTestingWorkers: workers ?? null,
     onlyTesting: stringArray2(
@@ -2580,7 +2678,27 @@ function parseBuildJobPayload(value) {
     action,
     destination,
     advancedSettings,
-    scripts
+    scripts,
+    worktreeCoverage: input.worktreeCoverage === void 0 ? false : booleanValue2(
+      input.worktreeCoverage,
+      "build job payload.worktreeCoverage"
+    )
+  };
+}
+function parseBuildReportPayload(value) {
+  const input = objectValue6(value, "build report payload");
+  return {
+    ...parseBuildDeletePayload(input),
+    reportKind: enumValue3(
+      input.reportKind,
+      BUILD_REPORT_KINDS,
+      "build report payload.reportKind"
+    ),
+    source: enumValue3(
+      input.source,
+      ["MANUAL", "WORKTREE"],
+      "build report payload.source"
+    )
   };
 }
 function parseBuildDeletePayload(value) {
@@ -2607,7 +2725,7 @@ function parseBuildArtifactDownloadPayload(value) {
   const identity = parseBuildDeletePayload(input);
   return {
     ...identity,
-    artifactRelativePath: safeRelativePath(
+    artifactRelativePath: safeRelativePath2(
       input.artifactRelativePath,
       "build artifact download payload.artifactRelativePath"
     ),
@@ -2649,7 +2767,7 @@ function parseBuildDeploymentPayload(value) {
       input.artifactDirectory,
       "build deployment payload.artifactDirectory"
     ),
-    artifactRelativePath: safeRelativePath(
+    artifactRelativePath: safeRelativePath2(
       input.artifactRelativePath,
       "build deployment payload.artifactRelativePath"
     ),
@@ -2717,13 +2835,36 @@ function parseBuildExportPayload(value) {
       input.artifactDirectory,
       "build export payload.artifactDirectory"
     ),
-    archiveRelativePath: safeRelativePath(
+    archiveRelativePath: safeRelativePath2(
       input.archiveRelativePath,
       "build export payload.archiveRelativePath"
     ),
     settings: parseBuildExportSettings(input.settings)
   };
 }
+function provisioningProfileType(profile) {
+  if (profile.getTaskAllow) return "DEVELOPMENT";
+  if (profile.provisionsAllDevices) return "ENTERPRISE";
+  return profile.hasProvisionedDevices ? "AD_HOC" : "APP_STORE";
+}
+function parseBuildSigningInspectPayload(value) {
+  const input = objectValue6(value, "build signing payload");
+  return {
+    buildId: stringValue6(input.buildId, "build signing payload.buildId"),
+    codebaseId: stringValue6(
+      input.codebaseId,
+      "build signing payload.codebaseId"
+    ),
+    artifactDirectory: stringValue6(
+      input.artifactDirectory,
+      "build signing payload.artifactDirectory"
+    ),
+    archiveRelativePath: safeRelativePath2(
+      input.archiveRelativePath,
+      "build signing payload.archiveRelativePath"
+    )
+  };
+}
 
 // src/inventory.ts
 var AGENT_VERSION = "0.1.0";
@@ -2864,68 +3005,163 @@ function runCloudflared(payload, timeoutMs, signal, onLog) {
   });
 }
 
-// src/handlers/ccusage.ts
-import { Buffer as Buffer2 } from "node:buffer";
-var MAX_CCUSAGE_STDOUT_BYTES = 16 * 1024 * 1024;
-function validateCcusagePayload(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-    throw new Error("ccusage.report payload must be an object");
+// src/handlers/signing.ts
+import { createHash as createHash2 } from "node:crypto";
+import { readdir, stat as stat2 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { basename, join as join2, relative, sep } from "node:path";
+
+// ../agent-contract/src/plist.ts
+function xmlEscape(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+function plistValue(value) {
+  if (typeof value === "boolean") return value ? "<true/>" : "<false/>";
+  if (typeof value === "string") return `<string>${xmlEscape(value)}</string>`;
+  if (typeof value === "number" && Number.isInteger(value)) {
+    return `<integer>${value}</integer>`;
   }
-  const keys = Object.keys(payload);
-  if (keys.length > 0) {
-    throw new Error(`Unexpected ccusage.report payload field: ${keys[0]}`);
+  if (Array.isArray(value)) {
+    return `<array>${value.map((entry) => plistValue(entry)).join("")}</array>`;
   }
-  return {};
+  if (value && typeof value === "object") {
+    return `<dict>${Object.entries(value).map(([key, entry]) => `<key>${xmlEscape(key)}</key>${plistValue(entry)}`).join("")}</dict>`;
+  }
+  throw new Error("Unsupported plist value");
 }
-async function runCcusage(payload, timeoutMs, signal, onLog) {
-  validateCcusagePayload(payload);
-  const stdout = [];
-  let stdoutBytes = 0;
-  let exceededLimit = false;
-  const result = await runProcess({
-    command: "ccusage",
-    args: ["--json"],
-    timeoutMs,
-    signal,
-    onLog: async (log) => {
-      if (log.stream !== "STDOUT") {
-        await onLog(log);
-        return;
+function plistDocument(value) {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">${plistValue(value)}</plist>
+`;
+}
+var ENTITIES = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'"
+};
+function decodeText(value) {
+  return value.replace(
+    /&(#x?[0-9a-fA-F]+|[a-z]+);/g,
+    (match, entity) => {
+      if (entity.startsWith("#x") || entity.startsWith("#X")) {
+        return String.fromCodePoint(Number.parseInt(entity.slice(2), 16));
       }
-      const lineBytes = Buffer2.byteLength(log.message, "utf8") + 1;
-      if (stdoutBytes + lineBytes > MAX_CCUSAGE_STDOUT_BYTES) {
-        exceededLimit = true;
-        return;
+      if (entity.startsWith("#")) {
+        return String.fromCodePoint(Number.parseInt(entity.slice(1), 10));
       }
-      stdoutBytes += lineBytes;
-      stdout.push(log.message);
+      return ENTITIES[entity] ?? match;
+    }
+  );
+}
+function nextTag(xml, from) {
+  let index = from;
+  for (; ; ) {
+    const start = xml.indexOf("<", index);
+    if (start < 0) return null;
+    if (xml.startsWith("<!--", start)) {
+      const close2 = xml.indexOf("-->", start);
+      if (close2 < 0) return null;
+      index = close2 + 3;
+      continue;
+    }
+    if (xml.startsWith("<?", start) || xml.startsWith("<!", start)) {
+      const close2 = xml.indexOf(">", start);
+      if (close2 < 0) return null;
+      index = close2 + 1;
+      continue;
+    }
+    const close = xml.indexOf(">", start);
+    if (close < 0) return null;
+    const raw = xml.slice(start + 1, close);
+    const closing = raw.startsWith("/");
+    const selfClosing = raw.endsWith("/");
+    const name = raw.slice(closing ? 1 : 0, selfClosing ? raw.length - 1 : raw.length).trim().split(/\s/)[0];
+    return { name, closing, selfClosing, end: close + 1 };
+  }
+}
+function textUntilClose(xml, from, name) {
+  const close = xml.indexOf(`</${name}`, from);
+  if (close < 0) throw new Error(`Unterminated <${name}> in plist`);
+  const end = xml.indexOf(">", close);
+  return [decodeText(xml.slice(from, close)), end + 1];
+}
+var MAX_DEPTH = 64;
+function parseValue(xml, from, depth) {
+  if (depth > MAX_DEPTH) throw new Error("plist nesting is too deep");
+  const tag = nextTag(xml, from);
+  if (!tag || tag.closing) throw new Error("Expected a plist value");
+  if (tag.selfClosing) {
+    switch (tag.name) {
+      case "true":
+        return [true, tag.end];
+      case "false":
+        return [false, tag.end];
+      case "dict":
+        return [{}, tag.end];
+      case "array":
+        return [[], tag.end];
+      default:
+        return ["", tag.end];
     }
-  });
-  if (result.exitCode !== 0 || result.cancelled || result.timedOut || result.signal !== null) {
-    return result;
-  }
-  if (exceededLimit) {
-    throw new Error(
-      `ccusage JSON exceeded the ${MAX_CCUSAGE_STDOUT_BYTES} byte limit`
-    );
   }
-  let parsed;
-  try {
-    parsed = JSON.parse(stdout.join("\n"));
-  } catch {
-    throw new Error("ccusage returned malformed JSON");
+  switch (tag.name) {
+    case "dict": {
+      const result = {};
+      let cursor = tag.end;
+      for (; ; ) {
+        const next = nextTag(xml, cursor);
+        if (!next) throw new Error("Unterminated <dict> in plist");
+        if (next.closing && next.name === "dict") return [result, next.end];
+        if (next.name !== "key") throw new Error("Expected <key> in <dict>");
+        const [key, afterKey] = textUntilClose(xml, next.end, "key");
+        const [value, afterValue] = parseValue(xml, afterKey, depth + 1);
+        result[key] = value;
+        cursor = afterValue;
+      }
+    }
+    case "array": {
+      const result = [];
+      let cursor = tag.end;
+      for (; ; ) {
+        const next = nextTag(xml, cursor);
+        if (!next) throw new Error("Unterminated <array> in plist");
+        if (next.closing && next.name === "array") return [result, next.end];
+        const [value, afterValue] = parseValue(xml, cursor, depth + 1);
+        result.push(value);
+        cursor = afterValue;
+      }
+    }
+    case "integer":
+    case "real": {
+      const [text2, end] = textUntilClose(xml, tag.end, tag.name);
+      return [Number(text2.trim()), end];
+    }
+    // Dates and data are returned verbatim: callers need the timestamp text and
+    // never the certificate bytes, so decoding them would only cost memory.
+    case "string":
+    case "date":
+    case "data": {
+      const [text2, end] = textUntilClose(xml, tag.end, tag.name);
+      return [tag.name === "string" ? text2 : text2.trim(), end];
+    }
+    default: {
+      const [, end] = textUntilClose(xml, tag.end, tag.name);
+      return [null, end];
+    }
   }
-  return { ...result, report: parseCcusageReport(parsed) };
 }
-
-// src/handlers/build-data.ts
-import { lstat, opendir, readdir, realpath, rm } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { basename, dirname as dirname2, isAbsolute, join as join2, resolve } from "node:path";
+function parsePlist(xml) {
+  const start = xml.indexOf("<plist");
+  const from = start < 0 ? 0 : xml.indexOf(">", start) + 1;
+  return parseValue(xml, from, 0)[0];
+}
 
 // src/capture-command.ts
 import { spawn as spawn2 } from "node:child_process";
-var MAX_OUTPUT_BYTES = 1024 * 1024;
+var MAX_OUTPUT_BYTES = 2 * 1024 * 1024;
 function captureCommand(options) {
   return new Promise((resolve6, reject) => {
     let stdout = "";
@@ -2935,15 +3171,19 @@ function captureCommand(options) {
     let settled = false;
     const child = spawn2(options.command, options.args, {
       shell: false,
-      stdio: ["ignore", "pipe", "pipe"],
+      stdio: [
+        "ignore",
+        options.stdoutFileDescriptor === void 0 ? "pipe" : options.stdoutFileDescriptor,
+        "pipe"
+      ],
       env: options.env ?? process.env,
       cwd: options.cwd
     });
     const append = (current, chunk) => `${current}${String(chunk)}`.slice(0, MAX_OUTPUT_BYTES);
-    child.stdout.on("data", (chunk) => {
+    child.stdout?.on("data", (chunk) => {
       stdout = append(stdout, chunk);
     });
-    child.stderr.on("data", (chunk) => {
+    child.stderr?.on("data", (chunk) => {
       stderr = append(stderr, chunk);
     });
     const terminate = () => {
@@ -2987,7 +3227,332 @@ function captureCommand(options) {
   });
 }
 
+// src/handlers/signing.ts
+var PROFILE_DIRECTORIES = [
+  join2(
+    homedir2(),
+    "Library",
+    "Developer",
+    "Xcode",
+    "UserData",
+    "Provisioning Profiles"
+  ),
+  join2(homedir2(), "Library", "MobileDevice", "Provisioning Profiles")
+];
+var PROFILE_EXTENSIONS = [".mobileprovision", ".provisionprofile"];
+function text(value) {
+  return typeof value === "string" && value.trim() ? value : null;
+}
+function stringList(value) {
+  return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+}
+async function decodeProfile(path, timeoutMs, signal) {
+  try {
+    const result = await captureCommand({
+      command: "/usr/bin/security",
+      args: ["cms", "-D", "-i", path],
+      timeoutMs: Math.min(timeoutMs, 1e4),
+      signal
+    });
+    if (result.exitCode !== 0 || !result.stdout.trim()) return null;
+    const parsed = parsePlist(result.stdout);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function toProfile(uuid, raw, now) {
+  const name = text(raw.Name);
+  if (!name) return null;
+  const entitlements = raw.Entitlements && typeof raw.Entitlements === "object" ? raw.Entitlements : {};
+  const applicationIdentifier = text(entitlements["application-identifier"]);
+  const teamId = stringList(raw.TeamIdentifier)[0] ?? text(entitlements["com.apple.developer.team-identifier"]);
+  const bundleId = applicationIdentifier ? applicationIdentifier.replace(/^[A-Z0-9]+\./, "") : "*";
+  const expiresAt = text(raw.ExpirationDate);
+  const expiry = expiresAt ? Date.parse(expiresAt) : Number.NaN;
+  return {
+    uuid,
+    name,
+    teamId: teamId ?? null,
+    teamName: text(raw.TeamName),
+    bundleId,
+    type: provisioningProfileType({
+      getTaskAllow: entitlements["get-task-allow"] === true,
+      hasProvisionedDevices: stringList(raw.ProvisionedDevices).length > 0,
+      provisionsAllDevices: raw.ProvisionsAllDevices === true
+    }),
+    platforms: stringList(raw.Platform),
+    expiresAt,
+    expired: Number.isFinite(expiry) ? expiry < now : false,
+    xcodeManaged: raw.IsXcodeManaged === true,
+    certificateSha1s: certificateFingerprints(raw.DeveloperCertificates)
+  };
+}
+function certificateFingerprints(value) {
+  return stringList(value).flatMap((encoded) => {
+    try {
+      const der = Buffer.from(encoded.replace(/\s+/g, ""), "base64");
+      if (!der.length) return [];
+      return [createHash2("sha1").update(der).digest("hex").toUpperCase()];
+    } catch {
+      return [];
+    }
+  });
+}
+async function readProfiles(timeoutMs, signal) {
+  const profiles = /* @__PURE__ */ new Map();
+  const now = Date.now();
+  for (const directory of PROFILE_DIRECTORIES) {
+    let entries;
+    try {
+      entries = await readdir(directory);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!PROFILE_EXTENSIONS.some((suffix) => entry.endsWith(suffix)))
+        continue;
+      signal.throwIfAborted();
+      const raw = await decodeProfile(
+        join2(directory, entry),
+        timeoutMs,
+        signal
+      );
+      if (!raw) continue;
+      const uuid = text(raw.UUID) ?? basename(entry).replace(/\.[^.]+$/, "");
+      const profile = toProfile(uuid, raw, now);
+      if (profile && !profiles.has(profile.uuid)) {
+        profiles.set(profile.uuid, profile);
+      }
+    }
+  }
+  return dedupe([...profiles.values()]).sort(
+    (left, right) => left.name.localeCompare(right.name)
+  );
+}
+function dedupe(profiles) {
+  const best = /* @__PURE__ */ new Map();
+  for (const profile of profiles) {
+    const key = [
+      profile.name,
+      profile.type,
+      profile.bundleId,
+      profile.teamId ?? "",
+      [...profile.platforms].sort().join(",")
+    ].join("\0");
+    const existing = best.get(key);
+    if (!existing || (profile.expiresAt ?? "") > (existing.expiresAt ?? "") || // Stable tie-break so repeated inspections return the same profile.
+    profile.expiresAt === existing.expiresAt && profile.uuid < existing.uuid) {
+      best.set(key, profile);
+    }
+  }
+  return [...best.values()];
+}
+var IDENTITY_PATTERN = /^\s*\d+\)\s+([0-9A-F]{40})\s+"(.+)"\s*$/i;
+async function readIdentities(timeoutMs, signal) {
+  try {
+    const result = await captureCommand({
+      command: "/usr/bin/security",
+      args: ["find-identity", "-v", "-p", "codesigning"],
+      timeoutMs: Math.min(timeoutMs, 1e4),
+      signal
+    });
+    if (result.exitCode !== 0) return [];
+    const identities = /* @__PURE__ */ new Map();
+    for (const line of result.stdout.split("\n")) {
+      const match = IDENTITY_PATTERN.exec(line);
+      if (!match) continue;
+      const [, sha1, name] = match;
+      const team = /\(([A-Z0-9]{10})\)\s*$/.exec(name);
+      identities.set(sha1, { sha1, name, teamId: team?.[1] ?? null });
+    }
+    return [...identities.values()];
+  } catch {
+    return [];
+  }
+}
+async function readArchiveBundles(archivePath, timeoutMs, signal) {
+  const products = join2(archivePath, "Products");
+  const bundles = [];
+  const queue = [products];
+  while (queue.length) {
+    signal.throwIfAborted();
+    const current = queue.shift();
+    let entries;
+    try {
+      entries = await readdir(current, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (entry.isSymbolicLink() || !entry.isDirectory()) continue;
+      const path = join2(current, entry.name);
+      const signable = /\.(app|appex)$/.test(entry.name);
+      if (!signable) {
+        if (!/\.[A-Za-z0-9]+$/.test(entry.name)) queue.push(path);
+        continue;
+      }
+      const bundleId = await bundleIdentifier(path, timeoutMs, signal);
+      if (bundleId) {
+        bundles.push({
+          bundleId,
+          name: basename(entry.name).replace(/\.(app|appex)$/, ""),
+          relativePath: relative(archivePath, path).split(sep).join("/"),
+          ...await embeddedProfile(path, timeoutMs, signal)
+        });
+      }
+      queue.push(path);
+    }
+  }
+  return bundles.sort(
+    (left, right) => left.relativePath.localeCompare(right.relativePath)
+  );
+}
+async function bundleIdentifier(bundlePath, timeoutMs, signal) {
+  try {
+    const result = await captureCommand({
+      command: "/usr/bin/plutil",
+      args: [
+        "-extract",
+        "CFBundleIdentifier",
+        "raw",
+        "-o",
+        "-",
+        join2(bundlePath, "Info.plist")
+      ],
+      timeoutMs: Math.min(timeoutMs, 5e3),
+      signal
+    });
+    const value = result.stdout.trim();
+    return result.exitCode === 0 && value ? value : null;
+  } catch {
+    return null;
+  }
+}
+async function embeddedProfile(bundlePath, timeoutMs, signal) {
+  for (const name of [
+    "embedded.mobileprovision",
+    "embedded.provisionprofile"
+  ]) {
+    const path = join2(bundlePath, name);
+    try {
+      await stat2(path);
+    } catch {
+      continue;
+    }
+    const raw = await decodeProfile(path, timeoutMs, signal);
+    if (raw) {
+      return {
+        embeddedProfileUuid: text(raw.UUID),
+        embeddedProfileName: text(raw.Name)
+      };
+    }
+  }
+  return { embeddedProfileUuid: null, embeddedProfileName: null };
+}
+function teamsFrom(profiles, identities) {
+  const teams = /* @__PURE__ */ new Map();
+  for (const profile of profiles) {
+    if (!profile.teamId) continue;
+    const existing = teams.get(profile.teamId);
+    if (!existing && profile.teamName)
+      teams.set(profile.teamId, profile.teamName);
+    else if (!existing) teams.set(profile.teamId, profile.teamId);
+  }
+  for (const identity of identities) {
+    if (!identity.teamId || teams.has(identity.teamId)) continue;
+    const name = /^[^:]+:\s*(.+?)\s*\([A-Z0-9]{10}\)\s*$/.exec(identity.name);
+    teams.set(identity.teamId, name?.[1] ?? identity.teamId);
+  }
+  return [...teams.entries()].map(([id, name]) => ({ id, name })).sort((left, right) => left.name.localeCompare(right.name));
+}
+async function inspectSigningAssets(archivePath, timeoutMs, signal) {
+  const [profiles, identities, bundles] = await Promise.all([
+    readProfiles(timeoutMs, signal),
+    readIdentities(timeoutMs, signal),
+    readArchiveBundles(archivePath, timeoutMs, signal)
+  ]);
+  return {
+    teams: teamsFrom(profiles, identities),
+    identities,
+    profiles,
+    bundles
+  };
+}
+var inspectIosSigning = async (payload, timeoutMs, signal) => {
+  const input = parseBuildSigningInspectPayload(payload);
+  const archivePath = join2(input.artifactDirectory, input.archiveRelativePath);
+  const inspection = await inspectSigningAssets(archivePath, timeoutMs, signal);
+  return {
+    exitCode: 0,
+    signal: null,
+    timedOut: false,
+    cancelled: false,
+    ...inspection
+  };
+};
+
+// src/handlers/ccusage.ts
+import { Buffer as Buffer2 } from "node:buffer";
+var MAX_CCUSAGE_STDOUT_BYTES = 16 * 1024 * 1024;
+function validateCcusagePayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new Error("ccusage.report payload must be an object");
+  }
+  const keys = Object.keys(payload);
+  if (keys.length > 0) {
+    throw new Error(`Unexpected ccusage.report payload field: ${keys[0]}`);
+  }
+  return {};
+}
+async function runCcusage(payload, timeoutMs, signal, onLog) {
+  validateCcusagePayload(payload);
+  const stdout = [];
+  let stdoutBytes = 0;
+  let exceededLimit = false;
+  const result = await runProcess({
+    command: "ccusage",
+    args: ["--json"],
+    timeoutMs,
+    signal,
+    onLog: async (log) => {
+      if (log.stream !== "STDOUT") {
+        await onLog(log);
+        return;
+      }
+      const lineBytes = Buffer2.byteLength(log.message, "utf8") + 1;
+      if (stdoutBytes + lineBytes > MAX_CCUSAGE_STDOUT_BYTES) {
+        exceededLimit = true;
+        return;
+      }
+      stdoutBytes += lineBytes;
+      stdout.push(log.message);
+    }
+  });
+  if (result.exitCode !== 0 || result.cancelled || result.timedOut || result.signal !== null) {
+    return result;
+  }
+  if (exceededLimit) {
+    throw new Error(
+      `ccusage JSON exceeded the ${MAX_CCUSAGE_STDOUT_BYTES} byte limit`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout.join("\n"));
+  } catch {
+    throw new Error("ccusage returned malformed JSON");
+  }
+  return { ...result, report: parseCcusageReport(parsed) };
+}
+
 // src/handlers/build-data.ts
+import { lstat, opendir, readdir as readdir2, realpath, rm } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { basename as basename2, dirname as dirname2, isAbsolute, join as join3, resolve } from "node:path";
 var successfulProcess = {
   exitCode: 0,
   signal: null,
@@ -2997,14 +3562,14 @@ var successfulProcess = {
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function safeRelativePath2(value) {
+function safeRelativePath3(value) {
   if (!value || value.includes("\0") || isAbsolute(value)) return false;
   const normalized = value.replaceAll("\\", "/");
   return normalized !== "." && normalized.split("/").every((part) => part && part !== ".." && part !== ".");
 }
 async function configuredRoots(payload) {
   if (payload.mode === "DEFAULT") {
-    return [join2(homedir2(), "Library", "Developer", "Xcode", "DerivedData")];
+    return [join3(homedir3(), "Library", "Developer", "Xcode", "DerivedData")];
   }
   if (payload.mode === "ABSOLUTE") {
     if (!payload.path || !isAbsolute(payload.path)) {
@@ -3012,7 +3577,7 @@ async function configuredRoots(payload) {
     }
     return [resolve(payload.path)];
   }
-  if (!payload.path || !safeRelativePath2(payload.path)) {
+  if (!payload.path || !safeRelativePath3(payload.path)) {
     throw new Error("Relative Derived Data mode requires a safe relative path");
   }
   return payload.worktrees.map(
@@ -3053,7 +3618,7 @@ async function scanRoot(configuredRoot, timeoutMs, signal) {
   }
   let children;
   try {
-    children = await readdir(rootPath2, { withFileTypes: true });
+    children = await readdir2(rootPath2, { withFileTypes: true });
   } catch (error) {
     return {
       entries: [],
@@ -3064,9 +3629,9 @@ async function scanRoot(configuredRoot, timeoutMs, signal) {
   for (const child of children) {
     signal.throwIfAborted();
     if (!child.isDirectory()) continue;
-    const path = join2(rootPath2, child.name);
+    const path = join3(rootPath2, child.name);
     const projectPath = await workspacePath(
-      join2(path, "info.plist"),
+      join3(path, "info.plist"),
       timeoutMs,
       signal
     );
@@ -3108,7 +3673,7 @@ function assertDirectChild(rootPath2, path) {
   }
   const root = resolve(rootPath2);
   const target2 = resolve(path);
-  if (target2 === root || dirname2(target2) !== root || basename(target2) !== basename(path)) {
+  if (target2 === root || dirname2(target2) !== root || basename2(target2) !== basename2(path)) {
     throw new Error("Build Data target must be a direct child of its root");
   }
 }
@@ -3122,7 +3687,7 @@ async function allocatedBytes(path, signal) {
   try {
     for await (const entry of directory) {
       signal.throwIfAborted();
-      total += await allocatedBytes(join2(path, entry.name), signal);
+      total += await allocatedBytes(join3(path, entry.name), signal);
     }
   } finally {
     await directory.close().catch(() => void 0);
@@ -3190,9 +3755,9 @@ var deleteBuildData = async (rawPayload, _timeoutMs, signal) => {
 };
 
 // src/handlers/codebases.ts
-import { readdir as readdir2, realpath as realpath2, stat as stat2 } from "node:fs/promises";
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname3, join as join3, resolve as resolve2 } from "node:path";
+import { readdir as readdir3, realpath as realpath2, stat as stat3 } from "node:fs/promises";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname3, join as join4, resolve as resolve2 } from "node:path";
 var successfulProcess2 = {
   exitCode: 0,
   signal: null,
@@ -3269,7 +3834,7 @@ function baseSnapshot(folder) {
 }
 async function fetchedAt(commonDirectory) {
   try {
-    return (await stat2(join3(commonDirectory, "FETCH_HEAD"))).mtime.toISOString();
+    return (await stat3(join4(commonDirectory, "FETCH_HEAD"))).mtime.toISOString();
   } catch {
     return null;
   }
@@ -3280,7 +3845,7 @@ async function inspectCodebaseProcess(selectedFolder, timeoutMs, signal, expecte
   let selected;
   try {
     selected = await realpath2(fallbackFolder);
-    if (!(await stat2(selected)).isDirectory())
+    if (!(await stat3(selected)).isDirectory())
       throw new Error("Folder is not a directory");
   } catch (error) {
     return {
@@ -3448,23 +4013,23 @@ async function inspectCodebase(selectedFolder, timeoutMs, signal, expectedOrigin
 }
 var browseCodebaseDirectories = async (payload) => {
   const input = codebaseBrowsePayload(payload);
-  const homePath = await realpath2(homedir3());
+  const homePath = await realpath2(homedir4());
   const path = await realpath2(input.path ? resolve2(input.path) : homePath);
-  if (!(await stat2(path)).isDirectory())
+  if (!(await stat3(path)).isDirectory())
     throw new Error("Path is not a directory");
-  const candidates = await readdir2(path, { withFileTypes: true });
+  const candidates = await readdir3(path, { withFileTypes: true });
   const entries = [];
   for (const candidate of candidates) {
     if (candidate.isDirectory()) {
       entries.push({
         name: candidate.name,
-        path: join3(path, candidate.name),
+        path: join4(path, candidate.name),
         hidden: candidate.name.startsWith(".")
       });
     } else if (candidate.isSymbolicLink()) {
       try {
-        const target2 = join3(path, candidate.name);
-        if ((await stat2(target2)).isDirectory()) {
+        const target2 = join4(path, candidate.name);
+        if ((await stat3(target2)).isDirectory()) {
           entries.push({
             name: candidate.name,
             path: target2,
@@ -4034,14 +4599,14 @@ import {
   mkdir as mkdir2,
   readFile as readFile2,
   realpath as realpath3,
-  readdir as readdir3,
+  readdir as readdir4,
   rename as rename2,
   rm as rm2,
-  stat as stat3,
+  stat as stat4,
   writeFile as writeFile2
 } from "node:fs/promises";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join4, relative, resolve as resolve3, sep } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join5, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 import { promisify } from "node:util";
 var executeFile = promisify(execFile);
 var successfulProcess3 = {
@@ -4096,27 +4661,27 @@ var PROJECT_ROOTS = {
 };
 async function directoryExists(path) {
   try {
-    return (await stat3(path)).isDirectory();
+    return (await stat4(path)).isDirectory();
   } catch {
     return false;
   }
 }
 async function configuredTools(tools) {
-  const homePath = homedir4();
+  const homePath = homedir5();
   return Promise.all(
     AI_TOOLS.filter((tool) => tools.includes(tool)).map(async (tool) => ({
       tool,
-      configured: await directoryExists(join4(homePath, ...CONFIG_PATHS[tool])),
+      configured: await directoryExists(join5(homePath, ...CONFIG_PATHS[tool])),
       homePath
     }))
   );
 }
 function rootPath(location) {
-  const base = location.scope === "GLOBAL" ? homedir4() : location.folder;
+  const base = location.scope === "GLOBAL" ? homedir5() : location.folder;
   const parts = location.scope === "GLOBAL" ? GLOBAL_ROOTS[location.rootKind] : PROJECT_ROOTS[location.rootKind];
   const path = resolve3(base, ...parts);
   const normalizedBase = resolve3(base);
-  if (path !== normalizedBase && !path.startsWith(`${normalizedBase}${sep}`)) {
+  if (path !== normalizedBase && !path.startsWith(`${normalizedBase}${sep2}`)) {
     throw new Error("Skill root escaped its configured base directory");
   }
   return path;
@@ -4128,12 +4693,12 @@ async function listPackageFiles(skillDirectory) {
   const files = [];
   let totalBytes = 0;
   const visit = async (directory) => {
-    for (const entry of await readdir3(directory, { withFileTypes: true })) {
-      const path = join4(directory, entry.name);
+    for (const entry of await readdir4(directory, { withFileTypes: true })) {
+      const path = join5(directory, entry.name);
       const metadata = await lstat2(path);
       if (metadata.isSymbolicLink()) {
         throw new Error(
-          `Nested symbolic link is not supported: ${relative(skillDirectory, path)}`
+          `Nested symbolic link is not supported: ${relative2(skillDirectory, path)}`
         );
       }
       if (metadata.isDirectory()) {
@@ -4145,14 +4710,14 @@ async function listPackageFiles(skillDirectory) {
         throw new Error("Skill contains too many files");
       if (metadata.size > MAX_SKILL_FILE_BYTES) {
         throw new Error(
-          `${relative(skillDirectory, path)} exceeds the per-file limit`
+          `${relative2(skillDirectory, path)} exceeds the per-file limit`
         );
       }
       totalBytes += metadata.size;
       if (totalBytes > MAX_SKILL_PACKAGE_BYTES)
         throw new Error("Skill exceeds the package size limit");
       files.push({
-        path: relative(skillDirectory, path).split(sep).join("/"),
+        path: relative2(skillDirectory, path).split(sep2).join("/"),
         contentsBase64: (await readFile2(path)).toString("base64"),
         executable: (metadata.mode & 73) !== 0
       });
@@ -4175,7 +4740,7 @@ async function readPackage(directory) {
   const frontmatter = parseSkillMetadata(
     Buffer.from(definition.contentsBase64, "base64").toString("utf8")
   );
-  if (frontmatter.name !== directory.split(sep).at(-1)) {
+  if (frontmatter.name !== directory.split(sep2).at(-1)) {
     throw new Error("Skill name must match its directory name");
   }
   return {
@@ -4216,12 +4781,12 @@ async function scanRoot2(location, configured, targets, warnings) {
   if (!consumers.length) return [];
   const target2 = targetForFolder(targets, location.folder);
   const installations = [];
-  for (const entry of await readdir3(root, { withFileTypes: true })) {
+  for (const entry of await readdir4(root, { withFileTypes: true })) {
     if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
-    const directory = join4(root, entry.name);
+    const directory = join5(root, entry.name);
     try {
       const skillPackage = await readPackage(directory);
-      const relativeDirectory = location.folder ? relative(location.folder, directory).split(sep).join("/") : "";
+      const relativeDirectory = location.folder ? relative2(location.folder, directory).split(sep2).join("/") : "";
       installations.push({
         ...location,
         codebaseId: target2?.codebaseId ?? null,
@@ -4297,7 +4862,7 @@ var readSkills = async (payload) => {
     }
     packages.push({
       ...request,
-      package: await readPackage(join4(root, request.skillName))
+      package: await readPackage(join5(root, request.skillName))
     });
   }
   return { ...successfulProcess3, packages };
@@ -4332,7 +4897,7 @@ async function updateManagedExclude(folder, relativeSkillPath, present) {
       if (line.trim()) managed.add(line.trim());
     }
   }
-  const pattern = `/${relativeSkillPath.split(sep).join("/").replace(/^\/+/, "")}/`;
+  const pattern = `/${relativeSkillPath.split(sep2).join("/").replace(/^\/+/, "")}/`;
   if (present) managed.add(pattern);
   else managed.delete(pattern);
   const block = managed.size ? `${MANAGED_EXCLUDE_START}
@@ -4347,7 +4912,7 @@ ${MANAGED_EXCLUDE_END}` : "";
 }
 async function assertUntracked(location, skillDirectory) {
   if (location.scope !== "PROJECT") return;
-  const relativeDirectory = relative(location.folder, skillDirectory).split(sep).join("/");
+  const relativeDirectory = relative2(location.folder, skillDirectory).split(sep2).join("/");
   if (await trackedProjectPath(location.folder, relativeDirectory)) {
     throw new Error(
       `${relativeDirectory} is tracked by Git and cannot be managed automatically`
@@ -4359,16 +4924,16 @@ async function writePackage(location, skillPackage) {
     throw new Error("New skill copies may only be written to shared roots");
   }
   const root = rootPath(location);
-  const destination = join4(root, skillPackage.name);
+  const destination = join5(root, skillPackage.name);
   await assertUntracked(location, destination);
   await mkdir2(root, { recursive: true });
-  const temporary = join4(root, `.${skillPackage.name}.${randomUUID()}.tmp`);
-  const backup = join4(root, `.${skillPackage.name}.${randomUUID()}.bak`);
+  const temporary = join5(root, `.${skillPackage.name}.${randomUUID()}.tmp`);
+  const backup = join5(root, `.${skillPackage.name}.${randomUUID()}.bak`);
   await mkdir2(temporary, { recursive: true });
   try {
     for (const file of skillPackage.files) {
       const path = resolve3(temporary, ...file.path.split("/"));
-      if (!path.startsWith(`${temporary}${sep}`))
+      if (!path.startsWith(`${temporary}${sep2}`))
         throw new Error("Skill file escaped temporary directory");
       await mkdir2(dirname4(path), { recursive: true });
       await writeFile2(path, Buffer.from(file.contentsBase64, "base64"));
@@ -4401,7 +4966,7 @@ var applySkills = async (payload) => {
   for (const operation of operations) {
     const root = rootPath(operation);
     const skillName = operation.kind === "WRITE" ? operation.package.name : operation.skillName;
-    const destination = join4(root, skillName);
+    const destination = join5(root, skillName);
     await assertUntracked(operation, destination);
     if (operation.kind === "WRITE") {
       await writePackage(operation, operation.package);
@@ -4421,7 +4986,7 @@ var applySkills = async (payload) => {
     if (operation.scope === "PROJECT" && operation.manageGitExclude) {
       await updateManagedExclude(
         operation.folder,
-        relative(operation.folder, destination),
+        relative2(operation.folder, destination),
         operation.kind === "WRITE"
       );
     }
@@ -4430,15 +4995,17 @@ var applySkills = async (payload) => {
 };
 
 // src/handlers/worktrees.ts
-import { watch } from "node:fs";
-import { readFile as readFile3, realpath as realpath4, stat as stat4 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname5, join as join5, relative as relative3 } from "node:path";
+import { createWriteStream, watch } from "node:fs";
+import { mkdtemp, open, readFile as readFile3, realpath as realpath4, rm as rm3, stat as stat5 } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename as basename3, dirname as dirname5, join as join6, relative as relative4 } from "node:path";
+import { spawn as spawn4 } from "node:child_process";
 
 // src/git-code-state.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { createReadStream as createReadStream2 } from "node:fs";
 import { lstat as lstat3, readlink } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, relative as relative2, resolve as resolve4, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve4, sep as sep3 } from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 function gitEnvironment() {
   return {
@@ -4452,8 +5019,8 @@ function remainingTimeoutMs(deadline) {
 }
 function containedPath(folder, path) {
   const absolutePath = resolve4(folder, path);
-  const difference = relative2(folder, absolutePath);
-  if (!difference || difference === ".." || difference.startsWith(`..${sep2}`) || isAbsolute3(difference)) {
+  const difference = relative3(folder, absolutePath);
+  if (!difference || difference === ".." || difference.startsWith(`..${sep3}`) || isAbsolute3(difference)) {
     return null;
   }
   return absolutePath;
@@ -4562,7 +5129,7 @@ async function worktreeCodeStateHash(folder, timeoutMs, signal) {
     if (head.exitCode !== 0 || untracked.exitCode !== 0 || submodules.exitCode !== 0 || operation.signal.aborted) {
       return null;
     }
-    const hash = createHash2("sha256");
+    const hash = createHash3("sha256");
     hash.update("head\0");
     hash.update(head.stdout.trim());
     hash.update("\0diff\0");
@@ -4633,6 +5200,16 @@ var successfulProcess4 = {
   cancelled: false
 };
 var WATCH_DEBOUNCE_MS = 500;
+var MAX_DIFF_BYTES = 2 * 1024 * 1024;
+var IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".avif",
+  ".bmp"
+]);
 var activeWorktreeWatches = /* @__PURE__ */ new Map();
 function statusChangeState(value) {
   const entries = value.split("\0").filter(Boolean);
@@ -4831,7 +5408,7 @@ async function origin(folder, timeoutMs, signal) {
 }
 async function validateWorktree(input, timeoutMs, signal) {
   const folder = await realpath4(input.folder);
-  if (!(await stat4(folder)).isDirectory())
+  if (!(await stat5(folder)).isDirectory())
     throw new Error("Worktree is missing");
   const observedGitDirectory = await gitDirectory(folder, timeoutMs, signal);
   if (observedGitDirectory !== input.gitDirectory) {
@@ -4915,7 +5492,7 @@ async function inspectWorktreeItem(folderValue2, rootFolder, baseBranch, primary
     return {
       gitDirectory: gitDir,
       folder,
-      relativePath: relative3(rootFolder, folder) || ".",
+      relativePath: relative4(rootFolder, folder) || ".",
       primary,
       branch,
       headSha: headResult.exitCode === 0 ? headResult.stdout.trim() : null,
@@ -4942,7 +5519,7 @@ async function inspectWorktreeItem(folderValue2, rootFolder, baseBranch, primary
     return {
       gitDirectory: folderValue2,
       folder: folderValue2,
-      relativePath: relative3(rootFolder, folderValue2) || ".",
+      relativePath: relative4(rootFolder, folderValue2) || ".",
       primary,
       branch: null,
       headSha: null,
@@ -5058,12 +5635,12 @@ function parseNumstat(value) {
 }
 async function untrackedLines(folder, path) {
   try {
-    const file = await stat4(`${folder}/${path}`);
+    const file = await stat5(`${folder}/${path}`);
     if (!file.isFile() || file.size > 1024 * 1024) return null;
     const contents = await readFile3(`${folder}/${path}`);
     if (contents.includes(0)) return null;
-    const text = contents.toString("utf8");
-    return text ? text.split("\n").length - (text.endsWith("\n") ? 1 : 0) : 0;
+    const text2 = contents.toString("utf8");
+    return text2 ? text2.split("\n").length - (text2.endsWith("\n") ? 1 : 0) : 0;
   } catch {
     return null;
   }
@@ -5088,7 +5665,8 @@ async function inspectChanges(folder, timeoutMs, signal) {
     const value = values[index];
     const code = value.slice(0, 2);
     const path = value.slice(3);
-    if ((code[0] === "R" || code[0] === "C") && values[index + 1]) index += 1;
+    const previousPath = (code[0] === "R" || code[0] === "C") && values[index + 1] ? values[index + 1] : null;
+    if (previousPath) index += 1;
     const untracked = code === "??";
     const conflicted = ["DD", "AU", "UD", "UA", "DU", "AA", "UU"].includes(
       code
@@ -5100,6 +5678,8 @@ async function inspectChanges(folder, timeoutMs, signal) {
     const untrackedCount = untracked ? await untrackedLines(folder, path) : null;
     changes.push({
       path,
+      previousPath,
+      changeType: untracked ? "ADDED" : conflicted ? "CONFLICTED" : code,
       staged,
       unstaged,
       untracked,
@@ -5112,6 +5692,65 @@ async function inspectChanges(folder, timeoutMs, signal) {
   }
   return { changes: changes.slice(0, 500), truncated: changes.length > 500 };
 }
+function imagePath(path) {
+  const extension = path.slice(path.lastIndexOf(".")).toLocaleLowerCase();
+  return IMAGE_EXTENSIONS.has(extension);
+}
+function parseNameStatus(value) {
+  const entries = value.split("\0").filter(Boolean);
+  const files = [];
+  for (let index = 0; index < entries.length; ) {
+    const status2 = entries[index++] ?? "M";
+    const renamed = status2.startsWith("R") || status2.startsWith("C");
+    const first = entries[index++] ?? "";
+    const second = renamed ? entries[index++] ?? "" : null;
+    const path = second ?? first;
+    if (!path) continue;
+    files.push({
+      path,
+      previousPath: renamed ? first : null,
+      changeType: status2[0] ?? "M"
+    });
+  }
+  return files;
+}
+async function diffFiles(folder, range, timeoutMs, signal) {
+  const [status2, counts2] = await Promise.all([
+    git2(folder, ["diff", "--name-status", "-z", range], timeoutMs, signal),
+    git2(folder, ["diff", "--numstat", "-z", range], timeoutMs, signal)
+  ]);
+  requireSuccess2(status2, "Could not inspect changed files");
+  requireSuccess2(counts2, "Could not inspect changed line counts");
+  const numstat = parseNumstat(counts2.stdout);
+  return parseNameStatus(status2.stdout).map((file) => {
+    const [additions, deletions] = numstat.get(file.path) ?? [null, null];
+    return {
+      ...file,
+      additions,
+      deletions,
+      binary: additions === null && deletions === null,
+      image: imagePath(file.path)
+    };
+  });
+}
+async function inspectBranchChanges(folder, baseBranch, timeoutMs, signal) {
+  const mergeBase = requireSuccess2(
+    await git2(
+      folder,
+      ["merge-base", `refs/remotes/origin/${baseBranch}`, "HEAD"],
+      timeoutMs,
+      signal
+    ),
+    "Could not determine the base-branch merge base"
+  ).stdout.trim();
+  const files = await diffFiles(
+    folder,
+    `${mergeBase}..HEAD`,
+    timeoutMs,
+    signal
+  );
+  return { changes: files.slice(0, 500), truncated: files.length > 500 };
+}
 async function inspectCommits(folder, baseBranch, timeoutMs, signal) {
   const result = requireSuccess2(
     await git2(
@@ -5143,17 +5782,441 @@ async function inspectCommits(folder, baseBranch, timeoutMs, signal) {
   return { commits: commits.slice(0, 100), truncated: commits.length > 100 };
 }
 async function inspectWorktreeDetail(folder, baseBranch, timeoutMs, signal) {
-  const [commitResult, changeResult] = await Promise.all([
+  const [commitResult, changeResult, branchResult] = await Promise.all([
     inspectCommits(folder, baseBranch, timeoutMs, signal),
-    inspectChanges(folder, timeoutMs, signal)
+    inspectChanges(folder, timeoutMs, signal),
+    inspectBranchChanges(folder, baseBranch, timeoutMs, signal)
   ]);
   return {
     commits: commitResult.commits,
     changes: changeResult.changes,
+    branchChanges: branchResult.changes,
     commitsTruncated: commitResult.truncated,
-    changesTruncated: changeResult.truncated
+    changesTruncated: changeResult.truncated,
+    branchChangesTruncated: branchResult.truncated
+  };
+}
+async function baseMergeCommit(folder, baseBranch, timeoutMs, signal) {
+  return requireSuccess2(
+    await git2(
+      folder,
+      ["merge-base", `refs/remotes/origin/${baseBranch}`, "HEAD"],
+      timeoutMs,
+      signal
+    ),
+    "Could not determine the base-branch merge base"
+  ).stdout.trim();
+}
+async function validateDisplayedCommit(folder, baseBranch, commitSha, timeoutMs, signal) {
+  if (!/^[0-9a-f]{7,64}$/i.test(commitSha)) {
+    throw new Error("Commit SHA is invalid");
+  }
+  const base = await baseMergeCommit(folder, baseBranch, timeoutMs, signal);
+  const [afterBase, beforeHead] = await Promise.all([
+    git2(
+      folder,
+      ["merge-base", "--is-ancestor", base, commitSha],
+      timeoutMs,
+      signal
+    ),
+    git2(
+      folder,
+      ["merge-base", "--is-ancestor", commitSha, "HEAD"],
+      timeoutMs,
+      signal
+    )
+  ]);
+  if (afterBase.exitCode !== 0 || beforeHead.exitCode !== 0) {
+    throw new Error("Commit is outside the displayed branch history");
+  }
+}
+async function parentCommit(folder, commitSha, timeoutMs, signal) {
+  const result = await git2(
+    folder,
+    ["rev-parse", `${commitSha}^`],
+    timeoutMs,
+    signal
+  );
+  return result.exitCode === 0 ? result.stdout.trim() : null;
+}
+async function gitObjectExists(folder, specification, timeoutMs, signal) {
+  return (await git2(folder, ["cat-file", "-e", specification], timeoutMs, signal)).exitCode === 0;
+}
+async function comparisonSides(input, folder, timeoutMs, signal) {
+  if (!input.path) return { before: null, after: null };
+  const path = input.path;
+  const previousPath = input.previousPath ?? path;
+  const currentPath = join6(folder, path);
+  if (input.scope === "UNTRACKED") {
+    return { before: null, after: { kind: "FILE", path: currentPath } };
+  }
+  if (input.scope === "STAGED") {
+    return {
+      before: { kind: "GIT", specification: `HEAD:${previousPath}` },
+      after: { kind: "GIT", specification: `:${path}` }
+    };
+  }
+  if (input.scope === "UNSTAGED") {
+    return {
+      before: { kind: "GIT", specification: `:${path}` },
+      after: { kind: "FILE", path: currentPath }
+    };
+  }
+  if (input.scope === "COMMIT") {
+    const commitSha = input.commitSha;
+    await validateDisplayedCommit(
+      folder,
+      input.baseBranch,
+      commitSha,
+      timeoutMs,
+      signal
+    );
+    const parent = await parentCommit(folder, commitSha, timeoutMs, signal);
+    return {
+      before: parent ? { kind: "GIT", specification: `${parent}:${previousPath}` } : null,
+      after: { kind: "GIT", specification: `${commitSha}:${path}` }
+    };
+  }
+  const base = await baseMergeCommit(
+    folder,
+    input.baseBranch,
+    timeoutMs,
+    signal
+  );
+  return {
+    before: { kind: "GIT", specification: `${base}:${previousPath}` },
+    after: { kind: "GIT", specification: `HEAD:${path}` }
+  };
+}
+function requestedDiffPaths(input) {
+  if (!input.path) return [];
+  if (input.previousPath && ["STAGED", "COMMIT", "BRANCH"].includes(input.scope)) {
+    return [input.previousPath, input.path];
+  }
+  return [input.path];
+}
+async function readBoundedFile(path, limit) {
+  const file = await open(path, "r");
+  try {
+    const metadata = await file.stat();
+    if (!metadata.isFile()) throw new Error("Changed path is not a file");
+    if (metadata.size > limit) {
+      return { contents: Buffer.alloc(0), oversized: true };
+    }
+    const buffer = Buffer.allocUnsafe(limit + 1);
+    let length = 0;
+    while (length < buffer.length) {
+      const { bytesRead } = await file.read(
+        buffer,
+        length,
+        buffer.length - length,
+        length
+      );
+      if (bytesRead === 0) break;
+      length += bytesRead;
+    }
+    return {
+      contents: buffer.subarray(0, Math.min(length, limit)),
+      oversized: length > limit
+    };
+  } finally {
+    await file.close();
+  }
+}
+async function availableSide(side, folder, timeoutMs, signal) {
+  if (!side) return false;
+  if (side.kind === "GIT") {
+    return gitObjectExists(folder, side.specification, timeoutMs, signal);
+  }
+  try {
+    const resolved = await realpath4(side.path);
+    const difference = relative4(folder, resolved);
+    return difference !== ".." && !difference.startsWith("../") && (await stat5(resolved)).isFile();
+  } catch {
+    return false;
+  }
+}
+async function inspectRequestedDiff(input, folder, timeoutMs, signal) {
+  if (!input.path) {
+    if (input.scope === "COMMIT") {
+      await validateDisplayedCommit(
+        folder,
+        input.baseBranch,
+        input.commitSha,
+        timeoutMs,
+        signal
+      );
+      const parent = await parentCommit(
+        folder,
+        input.commitSha,
+        timeoutMs,
+        signal
+      );
+      const files = await diffFiles(
+        folder,
+        parent ? `${parent}..${input.commitSha}` : input.commitSha,
+        timeoutMs,
+        signal
+      );
+      return { files: files.slice(0, 500), truncated: files.length > 500 };
+    }
+    if (input.scope === "BRANCH") {
+      const result = await inspectBranchChanges(
+        folder,
+        input.baseBranch,
+        timeoutMs,
+        signal
+      );
+      return { files: result.changes, truncated: result.truncated };
+    }
+    throw new Error("A file path is required for this diff scope");
+  }
+  if (input.scope === "COMMIT") {
+    await validateDisplayedCommit(
+      folder,
+      input.baseBranch,
+      input.commitSha,
+      timeoutMs,
+      signal
+    );
+  }
+  await validateChangedPath(input, folder, timeoutMs, signal);
+  const args = ["diff", "--no-color", "--no-ext-diff", "--unified=3"];
+  let oversized = false;
+  if (input.scope === "STAGED") args.push("--cached");
+  if (input.scope === "COMMIT") {
+    const parent = await parentCommit(
+      folder,
+      input.commitSha,
+      timeoutMs,
+      signal
+    );
+    args.push(parent ?? `${input.commitSha}^`, input.commitSha);
+  } else if (input.scope === "BRANCH") {
+    args.push(
+      await baseMergeCommit(folder, input.baseBranch, timeoutMs, signal),
+      "HEAD"
+    );
+  }
+  args.push("--", ...requestedDiffPaths(input));
+  let patch;
+  if (input.scope === "UNTRACKED") {
+    const bounded = await readBoundedFile(
+      join6(folder, input.path),
+      MAX_DIFF_BYTES
+    );
+    const contents = bounded.contents;
+    if (bounded.oversized || contents.includes(0)) {
+      oversized = bounded.oversized;
+      patch = "";
+    } else {
+      patch = [
+        `diff --git a/${input.path} b/${input.path}`,
+        "new file mode 100644",
+        "--- /dev/null",
+        `+++ b/${input.path}`,
+        ...contents.toString("utf8").split("\n").map((line) => `+${line}`)
+      ].join("\n");
+    }
+  } else {
+    patch = requireSuccess2(
+      await git2(folder, args, timeoutMs, signal),
+      "Could not load the file diff"
+    ).stdout;
+  }
+  const sides = await comparisonSides(input, folder, timeoutMs, signal);
+  const [beforeAvailable, afterAvailable] = await Promise.all([
+    availableSide(sides.before, folder, timeoutMs, signal),
+    availableSide(sides.after, folder, timeoutMs, signal)
+  ]);
+  return {
+    files: [],
+    patch,
+    image: imagePath(input.path),
+    binary: !patch && !imagePath(input.path) && !oversized,
+    truncated: oversized || Buffer.byteLength(patch) >= MAX_DIFF_BYTES,
+    beforeAvailable,
+    afterAvailable
+  };
+}
+async function validateChangedPath(input, folder, timeoutMs, signal) {
+  if (!input.path) throw new Error("A changed file path is required");
+  let result;
+  if (input.scope === "UNTRACKED") {
+    result = await git2(
+      folder,
+      ["ls-files", "--others", "--exclude-standard", "-z", "--", input.path],
+      timeoutMs,
+      signal
+    );
+  } else {
+    const args = ["diff", "--name-status", "-z"];
+    if (input.scope === "STAGED") args.push("--cached");
+    if (input.scope === "COMMIT") {
+      await validateDisplayedCommit(
+        folder,
+        input.baseBranch,
+        input.commitSha,
+        timeoutMs,
+        signal
+      );
+      const parent = await parentCommit(
+        folder,
+        input.commitSha,
+        timeoutMs,
+        signal
+      );
+      args.push(parent ?? `${input.commitSha}^`, input.commitSha);
+    } else if (input.scope === "BRANCH") {
+      args.push(
+        await baseMergeCommit(folder, input.baseBranch, timeoutMs, signal),
+        "HEAD"
+      );
+    }
+    args.push("--", ...requestedDiffPaths(input));
+    result = await git2(folder, args, timeoutMs, signal);
+  }
+  requireSuccess2(result, "Could not validate the changed file");
+  const requested = input.scope === "UNTRACKED" ? result.stdout.split("\0").filter(Boolean).includes(input.path) : parseNameStatus(result.stdout).some(
+    (file) => file.path === input.path && (!input.previousPath || file.previousPath === input.previousPath)
+  );
+  if (!requested) {
+    throw new Error("The requested file is outside the displayed diff");
+  }
+}
+var inspectWorktreeDiff = async (payload, timeoutMs, signal) => {
+  const input = worktreeDiffPayload(payload);
+  const folder = await validateWorktree(input, timeoutMs, signal);
+  return {
+    ...successfulProcess4,
+    diff: await inspectRequestedDiff(input, folder, timeoutMs, signal)
   };
+};
+function imageContentType(path) {
+  const extension = path.slice(path.lastIndexOf(".")).toLocaleLowerCase();
+  return {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".avif": "image/avif",
+    ".bmp": "image/bmp"
+  }[extension] ?? "application/octet-stream";
+}
+async function writeGitObject(folder, specification, destination, timeoutMs, signal) {
+  await new Promise((resolvePromise, rejectPromise) => {
+    const child = spawn4(
+      "git",
+      ["-C", folder, "cat-file", "blob", specification],
+      { stdio: ["ignore", "pipe", "pipe"] }
+    );
+    const output = createWriteStream(destination, { mode: 384 });
+    let stderr = "";
+    let settled = false;
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      rejectPromise(error instanceof Error ? error : new Error(String(error)));
+    };
+    child.stderr.on("data", (chunk) => {
+      stderr = `${stderr}${String(chunk)}`.slice(0, 4e3);
+    });
+    child.stdout.pipe(output);
+    child.once("error", fail);
+    output.once("error", fail);
+    const terminate = () => child.kill("SIGTERM");
+    const timer = setTimeout(() => {
+      terminate();
+      fail(new Error("Image extraction timed out"));
+    }, timeoutMs);
+    timer.unref();
+    const abort = () => {
+      terminate();
+      fail(new Error("Image extraction was cancelled"));
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", abort);
+      if (settled) return;
+      if (code !== 0) {
+        fail(new Error(cleanError2(stderr || "Could not extract image")));
+        return;
+      }
+      output.end(() => {
+        if (settled) return;
+        settled = true;
+        resolvePromise();
+      });
+    });
+  });
 }
+var downloadWorktreeDiffAsset = async (payload, timeoutMs, signal, _onLog, context) => {
+  const input = worktreeDiffPayload(payload);
+  if (!input.path || !input.uploadId || !input.side) {
+    throw new Error("Diff image path, side, and upload ID are required");
+  }
+  if (!imagePath(input.path)) throw new Error("Diff asset is not an image");
+  if (!context?.uploadBuildArtifact) {
+    throw new Error("This agent cannot upload diff images");
+  }
+  const folder = await validateWorktree(input, timeoutMs, signal);
+  await validateChangedPath(input, folder, timeoutMs, signal);
+  const sides = await comparisonSides(input, folder, timeoutMs, signal);
+  const selected = input.side === "BEFORE" ? sides.before : sides.after;
+  if (!selected || !await availableSide(selected, folder, timeoutMs, signal)) {
+    throw new Error("The requested image side is unavailable");
+  }
+  let uploadPath;
+  let temporaryDirectory = null;
+  try {
+    if (selected.kind === "FILE") {
+      uploadPath = await realpath4(selected.path);
+      const difference = relative4(folder, uploadPath);
+      if (difference === ".." || difference.startsWith("../")) {
+        throw new Error("Diff image resolves outside the worktree");
+      }
+    } else {
+      const size = requireSuccess2(
+        await git2(
+          folder,
+          ["cat-file", "-s", selected.specification],
+          timeoutMs,
+          signal
+        ),
+        "Could not inspect diff image"
+      ).stdout.trim();
+      if (!/^\d+$/.test(size) || Number(size) > 20 * 1024 * 1024) {
+        throw new Error("Diff image exceeds the 20 MiB limit");
+      }
+      temporaryDirectory = await mkdtemp(join6(tmpdir(), "ade-diff-image-"));
+      uploadPath = join6(temporaryDirectory, basename3(input.path));
+      await writeGitObject(
+        folder,
+        selected.specification,
+        uploadPath,
+        timeoutMs,
+        signal
+      );
+    }
+    const information = await stat5(uploadPath);
+    if (!information.isFile() || information.size > 20 * 1024 * 1024) {
+      throw new Error("Diff image exceeds the 20 MiB limit");
+    }
+    await context.uploadBuildArtifact({
+      uploadId: input.uploadId,
+      path: uploadPath,
+      filename: basename3(input.path),
+      contentType: imageContentType(input.path)
+    });
+    return successfulProcess4;
+  } finally {
+    if (temporaryDirectory) {
+      await rm3(temporaryDirectory, { recursive: true, force: true });
+    }
+  }
+};
 var watchWorktree = async (payload, timeoutMs, signal, _onLog, context) => {
   const input = worktreeWatchJobPayload(payload);
   const current = activeWorktreeWatches.get(input.gitDirectory);
@@ -5288,7 +6351,7 @@ async function chooseNewBranch(folder, candidates, allowedCurrentBranch, timeout
 }
 async function validateBranchRoot(input, timeoutMs, signal) {
   const rootFolder = await realpath4(input.rootFolder);
-  if (!(await stat4(rootFolder)).isDirectory()) {
+  if (!(await stat5(rootFolder)).isDirectory()) {
     throw new Error("Base repository is missing");
   }
   if (await origin(rootFolder, timeoutMs, signal) !== input.expectedOrigin) {
@@ -5351,13 +6414,13 @@ var branchWorktree = async (payload, timeoutMs, signal) => {
     timeoutMs,
     signal
   ) : input.candidates[0];
-  const targetFolder = input.action === "CREATE" ? join5(
+  const targetFolder = input.action === "CREATE" ? join6(
     dirname5(rootFolder),
-    `${basename2(rootFolder)}-${branch.replaceAll("/", "-")}`
+    `${basename3(rootFolder)}-${branch.replaceAll("/", "-")}`
   ) : changeFolder;
   if (input.action === "CREATE") {
     try {
-      await stat4(targetFolder);
+      await stat5(targetFolder);
       throw new Error(`Worktree folder already exists: ${targetFolder}`);
     } catch (error) {
       if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
@@ -5591,12 +6654,12 @@ var checkoutMovedWorktree = async (payload, timeoutMs, signal) => {
         `Branch ${input.branch} is already checked out in ${occupiedFolder}`
       );
     }
-    targetFolder = join5(
+    targetFolder = join6(
       dirname5(rootFolder),
-      `${basename2(rootFolder)}-${input.branch.replaceAll("/", "-")}`
+      `${basename3(rootFolder)}-${input.branch.replaceAll("/", "-")}`
     );
     try {
-      await stat4(targetFolder);
+      await stat5(targetFolder);
       throw new Error(`Worktree folder already exists: ${targetFolder}`);
     } catch (error) {
       if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
@@ -5757,7 +6820,7 @@ var checkoutMovedWorktree = async (payload, timeoutMs, signal) => {
 var deleteWorktree = async (payload, timeoutMs, signal) => {
   const input = worktreeDeleteJobPayload(payload);
   const rootFolder = await realpath4(input.rootFolder);
-  if (!(await stat4(rootFolder)).isDirectory()) {
+  if (!(await stat5(rootFolder)).isDirectory()) {
     throw new Error("Base repository is missing");
   }
   if (await origin(rootFolder, timeoutMs, signal) !== input.expectedOrigin) {
@@ -5951,30 +7014,33 @@ var operateWorktree = async (payload, timeoutMs, signal) => {
 };
 
 // src/handlers/builds.ts
-import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
 import {
   cp,
   mkdir as mkdir3,
-  mkdtemp,
-  readdir as readdir4,
+  mkdtemp as mkdtemp2,
+  open as open2,
+  readdir as readdir5,
   readFile as readFile4,
   realpath as realpath5,
-  rm as rm3,
-  stat as stat5,
+  rename as rename3,
+  rm as rm4,
+  stat as stat6,
   writeFile as writeFile3
 } from "node:fs/promises";
-import { createWriteStream } from "node:fs";
-import { tmpdir } from "node:os";
+import { createReadStream as createReadStream3, createWriteStream as createWriteStream2 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { pipeline } from "node:stream/promises";
 import {
-  basename as basename3,
+  basename as basename4,
   dirname as dirname6,
   isAbsolute as isAbsolute4,
-  join as join6,
-  relative as relative4,
+  join as join7,
+  relative as relative5,
   resolve as resolve5,
-  sep as sep3
+  sep as sep4
 } from "node:path";
-import { spawn as spawn4 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 var successfulProcess5 = {
   exitCode: 0,
   signal: null,
@@ -6005,6 +7071,22 @@ function command2(executable, args, timeoutMs, signal, cwd, env = process.env) {
     env
   });
 }
+async function commandToFile(executable, args, timeoutMs, signal, cwd, env, destination) {
+  const output = await open2(destination, "wx", 384);
+  try {
+    return await captureCommand({
+      command: executable,
+      args,
+      timeoutMs,
+      signal,
+      cwd,
+      env,
+      stdoutFileDescriptor: output.fd
+    });
+  } finally {
+    await output.close();
+  }
+}
 function requireSuccess3(result, fallback) {
   if (result.cancelled) throw new Error("Operation was cancelled");
   if (result.timedOut) throw new Error("Operation timed out");
@@ -6015,7 +7097,7 @@ function requireSuccess3(result, fallback) {
 }
 async function validateWorktree2(input, timeoutMs, signal) {
   const folder = await realpath5(input.folder);
-  if (!(await stat5(folder)).isDirectory())
+  if (!(await stat6(folder)).isDirectory())
     throw new Error("Worktree is missing");
   const gitDirectory2 = requireSuccess3(
     await command2(
@@ -6049,8 +7131,8 @@ async function validateWorktree2(input, timeoutMs, signal) {
 }
 function containedPath2(root, relativePath) {
   const target2 = resolve5(root, relativePath);
-  const difference = relative4(root, target2);
-  if (difference === ".." || difference.startsWith(`..${sep3}`) || isAbsolute4(difference)) {
+  const difference = relative5(root, target2);
+  if (difference === ".." || difference.startsWith(`..${sep4}`) || isAbsolute4(difference)) {
     throw new Error("Path must stay within the worktree");
   }
   return target2;
@@ -6058,11 +7140,11 @@ function containedPath2(root, relativePath) {
 async function validateSource(root, source) {
   const target2 = containedPath2(root, source.relativePath);
   const resolved = await realpath5(target2);
-  const difference = relative4(root, resolved);
-  if (difference === ".." || difference.startsWith(`..${sep3}`) || isAbsolute4(difference)) {
+  const difference = relative5(root, resolved);
+  if (difference === ".." || difference.startsWith(`..${sep4}`) || isAbsolute4(difference)) {
     throw new Error("Build source resolves outside the worktree");
   }
-  const information = await stat5(resolved);
+  const information = await stat6(resolved);
   if (source.kind === "PACKAGE" && !information.isFile()) {
     throw new Error("Package.swift is missing");
   }
@@ -6076,10 +7158,10 @@ async function discoverSourcesInFolder(folder) {
   const queue = [folder];
   while (queue.length && sources.length < DISCOVERY_LIMIT) {
     const current = queue.shift();
-    for (const entry of await readdir4(current, { withFileTypes: true })) {
+    for (const entry of await readdir5(current, { withFileTypes: true })) {
       if (entry.isSymbolicLink()) continue;
-      const absolute = join6(current, entry.name);
-      const path = relative4(folder, absolute).split(sep3).join("/");
+      const absolute = join7(current, entry.name);
+      const path = relative5(folder, absolute).split(sep4).join("/");
       if (entry.isDirectory()) {
         if (entry.name.endsWith(".xcodeproj")) {
           sources.push({ kind: "PROJECT", relativePath: path });
@@ -6149,7 +7231,7 @@ function metadataFromList(value) {
   };
 }
 async function workspaceProjectPaths(workspacePath2, folder) {
-  const contentsPath = join6(workspacePath2, "contents.xcworkspacedata");
+  const contentsPath = join7(workspacePath2, "contents.xcworkspacedata");
   let contents;
   try {
     contents = await readFile4(contentsPath, "utf8");
@@ -6171,14 +7253,14 @@ async function workspaceProjectPaths(workspacePath2, folder) {
   const projects = [];
   for (const location of locations) {
     const candidate = resolve5(dirname6(workspacePath2), location);
-    const difference = relative4(folder, candidate);
-    if (difference === ".." || difference.startsWith(`..${sep3}`) || isAbsolute4(difference)) {
+    const difference = relative5(folder, candidate);
+    if (difference === ".." || difference.startsWith(`..${sep4}`) || isAbsolute4(difference)) {
       continue;
     }
     try {
       const resolved = await realpath5(candidate);
-      const resolvedDifference = relative4(folder, resolved);
-      if (resolvedDifference === ".." || resolvedDifference.startsWith(`..${sep3}`) || isAbsolute4(resolvedDifference) || !(await stat5(resolved)).isDirectory()) {
+      const resolvedDifference = relative5(folder, resolved);
+      if (resolvedDifference === ".." || resolvedDifference.startsWith(`..${sep4}`) || isAbsolute4(resolvedDifference) || !(await stat6(resolved)).isDirectory()) {
         continue;
       }
       projects.push(resolved);
@@ -6393,8 +7475,8 @@ function genericBuildDestinations(action) {
   ];
 }
 async function listPhysicalDevices(timeoutMs, signal) {
-  const directory = await mkdtemp(join6(tmpdir(), "ade-devices-"));
-  const output = join6(directory, "devices.json");
+  const directory = await mkdtemp2(join7(tmpdir2(), "ade-devices-"));
+  const output = join7(directory, "devices.json");
   try {
     const result = await command2(
       "xcrun",
@@ -6414,7 +7496,7 @@ async function listPhysicalDevices(timeoutMs, signal) {
     if (result.exitCode !== 0) return [];
     return physicalDestinations(JSON.parse(await readFile4(output, "utf8")));
   } finally {
-    await rm3(directory, { recursive: true, force: true });
+    await rm4(directory, { recursive: true, force: true });
   }
 }
 var inspectBuildDestinations = async (payload, timeoutMs, signal) => {
@@ -6505,7 +7587,7 @@ var BuildLogger = class {
   constructor(buildId, context, rawLogPath, env) {
     this.buildId = buildId;
     this.context = context;
-    this.stream = createWriteStream(rawLogPath, { flags: "a", mode: 384 });
+    this.stream = createWriteStream2(rawLogPath, { flags: "a", mode: 384 });
     this.redact = createRedactor(env);
   }
   buildId;
@@ -6595,12 +7677,12 @@ function runLoggedCommand(options) {
     let killTimer = null;
     let extraStream;
     if (options.additionalLogPath) {
-      extraStream = createWriteStream(options.additionalLogPath, {
+      extraStream = createWriteStream2(options.additionalLogPath, {
         flags: "a",
         mode: 384
       });
     }
-    const child = spawn4(options.command, options.args, {
+    const child = spawn5(options.command, options.args, {
       cwd: options.cwd,
       env: options.env,
       shell: false,
@@ -6792,7 +7874,7 @@ function actionArgument(action) {
   }[action];
 }
 function xcodeBuildArguments(input) {
-  const resultBundle = join6(input.artifactDirectory, "result.xcresult");
+  const resultBundle = join7(input.artifactDirectory, "result.xcresult");
   const sourcePath = containedPath2(input.folder, input.source.relativePath);
   const usesCapturedTestProducts = input.action === "TEST_WITHOUT_BUILDING";
   const args = [
@@ -6814,13 +7896,13 @@ function xcodeBuildArguments(input) {
   if (input.action === "ARCHIVE") {
     args.push(
       "-archivePath",
-      join6(input.artifactDirectory, "archive.xcarchive")
+      join7(input.artifactDirectory, "archive.xcarchive")
     );
   }
   if (input.action === "BUILD_FOR_TESTING") {
     args.push(
       "-testProductsPath",
-      join6(input.artifactDirectory, "test-products.xctestproducts")
+      join7(input.artifactDirectory, "test-products.xctestproducts")
     );
   }
   if (input.action === "TEST_WITHOUT_BUILDING" && input.advancedSettings.priorTestProductsPath) {
@@ -6883,15 +7965,15 @@ function classifyFailure(output) {
 }
 async function runHook(options) {
   const phaseDirectory = options.phase === "PRE_BUILD" ? "pre" : "post";
-  const directory = join6(
+  const directory = join7(
     options.input.artifactDirectory,
     "hooks",
     phaseDirectory
   );
   const prefix = `${String(options.script.position).padStart(3, "0")}-${options.script.id}`;
-  const file = join6(directory, `${prefix}.mjs`);
-  const runner = join6(directory, `${prefix}.runner.mjs`);
-  const log = join6(directory, `${prefix}.log`);
+  const file = join7(directory, `${prefix}.mjs`);
+  const runner = join7(directory, `${prefix}.runner.mjs`);
+  const log = join7(directory, `${prefix}.log`);
   const started = Date.now();
   try {
     await mkdir3(directory, { recursive: true, mode: 448 });
@@ -6906,7 +7988,7 @@ async function runHook(options) {
     await writeFile3(
       runner,
       `import { readFile } from "node:fs/promises";
-const hookModule = await import(${JSON.stringify(`./${basename3(file)}`)});
+const hookModule = await import(${JSON.stringify(`./${basename4(file)}`)});
 if (hookModule.default !== undefined && typeof hookModule.default !== "function") {
   throw new TypeError("The default build hook export must be a function");
 }
@@ -6943,7 +8025,7 @@ if (typeof hookModule.default === "function") {
       exitCode: result.exitCode,
       durationMs: Date.now() - started,
       causedBuildFailure: failed && options.script.failureBehavior === "FAIL_BUILD",
-      outputRelativePath: relative4(options.input.artifactDirectory, log),
+      outputRelativePath: relative5(options.input.artifactDirectory, log),
       error: failed ? cleanError3(result.output || "Build hook failed") : null
     };
   } catch (hookError) {
@@ -6956,49 +8038,466 @@ if (typeof hookModule.default === "function") {
       exitCode: null,
       durationMs: Date.now() - started,
       causedBuildFailure: !options.signal.aborted && options.script.failureBehavior === "FAIL_BUILD",
-      outputRelativePath: relative4(options.input.artifactDirectory, log),
+      outputRelativePath: relative5(options.input.artifactDirectory, log),
       error
     };
   }
 }
 async function pathExists(path) {
   try {
-    await stat5(path);
+    await stat6(path);
     return true;
   } catch {
     return false;
   }
 }
 async function pathSize(path) {
-  const information = await stat5(path);
+  const information = await stat6(path);
   if (information.isFile()) return information.size;
   if (!information.isDirectory()) return 0;
   let size = 0;
-  for (const entry of await readdir4(path, { withFileTypes: true })) {
+  for (const entry of await readdir5(path, { withFileTypes: true })) {
     if (entry.isSymbolicLink()) continue;
-    size += await pathSize(join6(path, entry.name));
+    size += await pathSize(join7(path, entry.name));
   }
   return size;
 }
 async function fileChecksum(path) {
   try {
-    const information = await stat5(path);
-    if (!information.isFile() || information.size > 256 * 1024 * 1024)
-      return null;
-    return createHash3("sha256").update(await readFile4(path)).digest("hex");
+    const information = await stat6(path);
+    if (!information.isFile()) return null;
+    const hash = createHash4("sha256");
+    await pipeline(createReadStream3(path), hash);
+    return hash.digest("hex");
+  } catch {
+    return null;
+  }
+}
+async function plistString(plistPath, keyPath, timeoutMs, signal) {
+  try {
+    const result = await command2(
+      "/usr/bin/plutil",
+      ["-extract", keyPath, "raw", "-o", "-", plistPath],
+      Math.min(timeoutMs, 5e3),
+      signal
+    );
+    const value = result.stdout.trim();
+    return result.exitCode === 0 && value ? value : null;
   } catch {
     return null;
   }
 }
+async function archiveApplicationProperties(archivePath, timeoutMs, signal) {
+  const plistPath = join7(archivePath, "Info.plist");
+  const read = (key) => plistString(plistPath, `ApplicationProperties.${key}`, timeoutMs, signal);
+  const [bundleIdentifier2, bundleShortVersion, bundleVersion, applicationPath] = await Promise.all([
+    read("CFBundleIdentifier"),
+    read("CFBundleShortVersionString"),
+    read("CFBundleVersion"),
+    read("ApplicationPath")
+  ]);
+  return {
+    bundleIdentifier: bundleIdentifier2,
+    bundleShortVersion,
+    bundleVersion,
+    applicationName: applicationPath ? basename4(applicationPath).replace(/\.app$/, "") : null
+  };
+}
 async function artifact(root, kind, path, metadata = {}) {
   return {
     kind,
-    relativePath: relative4(root, path).split(sep3).join("/"),
+    relativePath: relative5(root, path).split(sep4).join("/"),
     sizeBytes: await pathSize(path),
     checksum: await fileChecksum(path),
     metadata
   };
 }
+function jsonObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function testDetails(node) {
+  const own = typeof node.details === "string" && node.details.trim() ? [node.details.trim()] : typeof node.name === "string" && ["Failure Message", "Runtime Warning"].includes(String(node.nodeType)) ? [node.name] : [];
+  const children = Array.isArray(node.children) ? node.children : [];
+  return [
+    ...own,
+    ...children.flatMap((child) => {
+      const object = jsonObject(child);
+      return object ? testDetails(object) : [];
+    })
+  ];
+}
+function testSourceFile(node, suite) {
+  const explicit = [
+    node.filePath,
+    node.sourceFilePath,
+    node.fileName,
+    node.sourceFile
+  ].find((value) => typeof value === "string" && !!value);
+  if (explicit) {
+    return { file: basename4(explicit), filePath: explicit };
+  }
+  const identifier = typeof node.nodeIdentifier === "string" ? node.nodeIdentifier : "";
+  const identifierOwner = identifier.split("/")[0]?.trim();
+  return {
+    file: identifierOwner || suite,
+    filePath: null
+  };
+}
+function normalizeTestResults(value) {
+  const root = jsonObject(value);
+  if (!root || !Array.isArray(root.testNodes)) {
+    throw new Error("xcresulttool returned invalid test results JSON");
+  }
+  const tests = [];
+  const visit = (raw, context) => {
+    const node = jsonObject(raw);
+    if (!node) return;
+    const nodeType = typeof node.nodeType === "string" ? node.nodeType : "";
+    const name = typeof node.name === "string" ? node.name : "";
+    const next = {
+      plan: nodeType === "Test Plan" ? name : context.plan,
+      configuration: nodeType === "Test Plan Configuration" ? name : context.configuration,
+      bundle: /test bundle$/.test(nodeType) ? name : context.bundle,
+      suite: nodeType === "Test Suite" ? name : context.suite
+    };
+    if (nodeType === "Test Case") {
+      const result = typeof node.result === "string" ? node.result : "unknown";
+      const sourceFile = testSourceFile(node, next.suite);
+      tests.push({
+        identifier: typeof node.nodeIdentifier === "string" ? node.nodeIdentifier : name,
+        name,
+        ...next,
+        ...sourceFile,
+        result,
+        durationSeconds: typeof node.durationInSeconds === "number" ? node.durationInSeconds : null,
+        tags: Array.isArray(node.tags) ? node.tags.filter((tag) => typeof tag === "string") : [],
+        details: [...new Set(testDetails(node))]
+      });
+    }
+    if (Array.isArray(node.children)) {
+      for (const child of node.children) visit(child, next);
+    }
+  };
+  for (const node of root.testNodes) {
+    visit(node, {
+      plan: null,
+      configuration: null,
+      bundle: null,
+      suite: null
+    });
+  }
+  const count = (result) => tests.filter((test) => test.result === result).length;
+  return {
+    summary: {
+      total: tests.length,
+      passed: count("Passed"),
+      failed: count("Failed"),
+      skipped: count("Skipped"),
+      expectedFailures: count("Expected Failure"),
+      unknown: tests.filter(
+        (test) => !["Passed", "Failed", "Skipped", "Expected Failure"].includes(
+          String(test.result)
+        )
+      ).length,
+      durationSeconds: tests.reduce(
+        (total, test) => total + Number(test.durationSeconds ?? 0),
+        0
+      )
+    },
+    data: {
+      devices: Array.isArray(root.devices) ? root.devices : [],
+      configurations: Array.isArray(root.testPlanConfigurations) ? root.testPlanConfigurations : [],
+      tests
+    }
+  };
+}
+function normalizeCoverage(value) {
+  const root = jsonObject(value);
+  if (!root || !Array.isArray(root.targets)) {
+    throw new Error("xccov returned invalid coverage JSON");
+  }
+  const files = root.targets.flatMap((rawTarget) => {
+    const target2 = jsonObject(rawTarget);
+    if (!target2 || !Array.isArray(target2.files)) return [];
+    const targetName = typeof target2.name === "string" ? target2.name : "";
+    return target2.files.flatMap((rawFile) => {
+      const file = jsonObject(rawFile);
+      if (!file) return [];
+      return [
+        {
+          target: targetName,
+          name: typeof file.name === "string" ? file.name : "",
+          path: typeof file.path === "string" ? file.path : "",
+          coveredLines: typeof file.coveredLines === "number" ? file.coveredLines : 0,
+          executableLines: typeof file.executableLines === "number" ? file.executableLines : 0,
+          lineCoverage: typeof file.lineCoverage === "number" ? file.lineCoverage : 0
+        }
+      ];
+    });
+  });
+  return {
+    summary: {
+      coveredLines: typeof root.coveredLines === "number" ? root.coveredLines : 0,
+      executableLines: typeof root.executableLines === "number" ? root.executableLines : 0,
+      lineCoverage: typeof root.lineCoverage === "number" ? root.lineCoverage : 0,
+      targetCount: root.targets.length,
+      fileCount: files.length
+    },
+    data: { files }
+  };
+}
+async function writeJsonReport(input, kind, timeoutMs, signal) {
+  const resultBundle = join7(input.artifactDirectory, "result.xcresult");
+  const filename = kind === "TEST_RESULTS" ? "test-results.json" : "code-coverage.json";
+  const destination = join7(input.artifactDirectory, filename);
+  const temporary = `${destination}.tmp-${randomUUID2()}`;
+  try {
+    if (!await pathExists(resultBundle)) {
+      throw new Error("The build result bundle is unavailable");
+    }
+    const args = kind === "TEST_RESULTS" ? [
+      "xcresulttool",
+      "get",
+      "test-results",
+      "tests",
+      "--path",
+      "result.xcresult",
+      "--format",
+      "json"
+    ] : ["xccov", "view", "--report", "--json", "result.xcresult"];
+    requireSuccess3(
+      await commandToFile(
+        "xcrun",
+        args,
+        timeoutMs,
+        signal,
+        input.artifactDirectory,
+        xcodeEnvironment(),
+        temporary
+      ),
+      `Could not generate ${filename}`
+    );
+    const serialized = await readFile4(temporary, "utf8");
+    const parsed = JSON.parse(serialized);
+    const normalized = kind === "TEST_RESULTS" ? normalizeTestResults(parsed) : normalizeCoverage(parsed);
+    await rename3(temporary, destination);
+    return {
+      kind,
+      status: "READY",
+      artifact: await artifact(
+        input.artifactDirectory,
+        kind === "TEST_RESULTS" ? "TEST_RESULTS_JSON" : "CODE_COVERAGE_JSON",
+        destination
+      ),
+      ...normalized,
+      error: null
+    };
+  } catch (error) {
+    await rm4(temporary, { force: true });
+    return {
+      kind,
+      status: "FAILED",
+      artifact: null,
+      summary: {},
+      data: {},
+      error: cleanError3(error)
+    };
+  }
+}
+async function gitCommand(folder, args, timeoutMs, signal) {
+  return command2("git", ["-C", folder, ...args], timeoutMs, signal, void 0, {
+    ...process.env,
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_OPTIONAL_LOCKS: "0"
+  });
+}
+function changedLinesFromPatch(value) {
+  const result = /* @__PURE__ */ new Map();
+  let path = null;
+  for (const line of value.split("\n")) {
+    if (line.startsWith("+++ ")) {
+      const raw = line.slice(4);
+      path = raw === "/dev/null" ? null : raw.replace(/^b\//, "");
+      if (path && !result.has(path)) result.set(path, /* @__PURE__ */ new Set());
+      continue;
+    }
+    if (!path || !line.startsWith("@@")) continue;
+    const match = /\+(\d+)(?:,(\d+))?/.exec(line);
+    if (!match) continue;
+    const start = Number(match[1]);
+    const count = match[2] === void 0 ? 1 : Number(match[2]);
+    const lines = result.get(path);
+    for (let number = start; number < start + count; number += 1) {
+      lines.add(number);
+    }
+  }
+  return result;
+}
+function changeTypesFromStatus(value) {
+  const entries = value.split("\0").filter(Boolean);
+  const result = /* @__PURE__ */ new Map();
+  for (let index = 0; index < entries.length; ) {
+    const status2 = entries[index++] ?? "M";
+    const renamed = status2.startsWith("R") || status2.startsWith("C");
+    const first = entries[index++] ?? "";
+    const second = renamed ? entries[index++] ?? "" : null;
+    const path = second ?? first;
+    if (path) result.set(path, status2[0] ?? "M");
+  }
+  return result;
+}
+async function snapshotCoverageChanges(input, folder, timeoutMs, signal) {
+  if (!input.baseBranch) throw new Error("A base branch is required");
+  const base = requireSuccess3(
+    await gitCommand(
+      folder,
+      ["merge-base", `refs/remotes/origin/${input.baseBranch}`, "HEAD"],
+      timeoutMs,
+      signal
+    ),
+    "Could not determine the coverage merge base"
+  ).stdout.trim();
+  const [patch, status2, untracked] = await Promise.all([
+    gitCommand(
+      folder,
+      ["diff", "--no-color", "--unified=0", base, "--"],
+      timeoutMs,
+      signal
+    ),
+    gitCommand(
+      folder,
+      ["diff", "--name-status", "-z", base, "--"],
+      timeoutMs,
+      signal
+    ),
+    gitCommand(
+      folder,
+      ["ls-files", "--others", "--exclude-standard", "-z"],
+      timeoutMs,
+      signal
+    )
+  ]);
+  requireSuccess3(patch, "Could not inspect changed coverage lines");
+  requireSuccess3(status2, "Could not inspect coverage change types");
+  requireSuccess3(untracked, "Could not inspect untracked coverage files");
+  const lines = changedLinesFromPatch(patch.stdout);
+  const types = changeTypesFromStatus(status2.stdout);
+  for (const path of untracked.stdout.split("\0").filter(Boolean)) {
+    try {
+      const contents = await readFile4(join7(folder, path));
+      if (contents.includes(0)) continue;
+      const lineCount = contents.length ? contents.toString("utf8").split("\n").length - (contents.toString("utf8").endsWith("\n") ? 1 : 0) : 0;
+      lines.set(
+        path,
+        new Set(Array.from({ length: lineCount }, (_, index) => index + 1))
+      );
+      types.set(path, "A");
+    } catch {
+    }
+  }
+  return [.../* @__PURE__ */ new Set([...lines.keys(), ...types.keys()])].map((path) => ({
+    path,
+    changeType: types.get(path) ?? "M",
+    lines: [...lines.get(path) ?? []].sort((a, b) => a - b)
+  }));
+}
+async function addChangedCoverage(report, changes, input, folder, timeoutMs, signal) {
+  if (report.status !== "READY") return report;
+  const rawFiles = Array.isArray(report.data.files) ? report.data.files : [];
+  const coveragePaths = rawFiles.flatMap((raw) => {
+    const file = jsonObject(raw);
+    return file && typeof file.path === "string" ? [file.path] : [];
+  });
+  const changedFiles = [];
+  let changedCoveredLines = 0;
+  let changedExecutableLines = 0;
+  for (const change of changes) {
+    const coveragePath = coveragePaths.find(
+      (candidate) => relative5(folder, candidate).split(sep4).join("/") === change.path
+    );
+    let covered = 0;
+    let executable = 0;
+    if (coveragePath && change.lines.length) {
+      const temporary2 = join7(
+        input.artifactDirectory,
+        `.changed-coverage-${randomUUID2()}.json`
+      );
+      try {
+        const result = await commandToFile(
+          "xcrun",
+          [
+            "xccov",
+            "view",
+            "--archive",
+            "--file",
+            coveragePath,
+            "--json",
+            "result.xcresult"
+          ],
+          timeoutMs,
+          signal,
+          input.artifactDirectory,
+          xcodeEnvironment(),
+          temporary2
+        );
+        if (result.exitCode === 0 && !result.cancelled && !result.timedOut) {
+          const parsed = jsonObject(
+            JSON.parse(await readFile4(temporary2, "utf8"))
+          );
+          const lineData = parsed?.[coveragePath];
+          if (Array.isArray(lineData)) {
+            const changed = new Set(change.lines);
+            for (const rawLine of lineData) {
+              const line = jsonObject(rawLine);
+              if (line?.isExecutable === true && typeof line.line === "number" && changed.has(line.line)) {
+                executable += 1;
+                if (typeof line.executionCount === "number" && line.executionCount > 0) {
+                  covered += 1;
+                }
+              }
+            }
+          }
+        }
+      } finally {
+        await rm4(temporary2, { force: true });
+      }
+    }
+    changedCoveredLines += covered;
+    changedExecutableLines += executable;
+    changedFiles.push({
+      path: change.path,
+      changeType: change.changeType,
+      changedCoveredLines: covered,
+      changedExecutableLines: executable,
+      changedLineCoverage: executable ? covered / executable : null
+    });
+  }
+  const summary = {
+    ...report.summary,
+    changedCoveredLines,
+    changedExecutableLines,
+    changedLineCoverage: changedExecutableLines ? changedCoveredLines / changedExecutableLines : null
+  };
+  const data = { ...report.data, changedFiles };
+  const destination = join7(input.artifactDirectory, "worktree-coverage.json");
+  const temporary = `${destination}.tmp-${randomUUID2()}`;
+  await writeFile3(temporary, JSON.stringify({ summary, data }, null, 2), {
+    mode: 384
+  });
+  await rename3(temporary, destination);
+  return {
+    ...report,
+    summary,
+    data,
+    additionalArtifacts: [
+      await artifact(
+        input.artifactDirectory,
+        "WORKTREE_COVERAGE_JSON",
+        destination
+      )
+    ]
+  };
+}
 function parseBuildSettings(value) {
   const parsed = JSON.parse(value);
   if (!Array.isArray(parsed)) return [];
@@ -7028,13 +8527,13 @@ async function findFiles(root, predicate, limit = 20) {
     const current = queue.shift();
     let entries;
     try {
-      entries = await readdir4(current, { withFileTypes: true });
+      entries = await readdir5(current, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
       if (entry.isSymbolicLink()) continue;
-      const path = join6(current, entry.name);
+      const path = join7(current, entry.name);
       if (entry.isDirectory()) queue.push(path);
       else if (entry.isFile() && predicate(entry.name)) results.push(path);
       if (results.length >= limit) break;
@@ -7042,15 +8541,36 @@ async function findFiles(root, predicate, limit = 20) {
   }
   return results;
 }
-async function captureArtifacts(input, folder, signal) {
+async function captureArtifacts(input, folder, signal, includeProducts = true) {
   const artifacts = [];
-  const resultBundle = join6(input.artifactDirectory, "result.xcresult");
+  const resultBundle = join7(input.artifactDirectory, "result.xcresult");
   if (await pathExists(resultBundle)) {
+    const coverageProbe = await command2(
+      "xcrun",
+      [
+        "xccov",
+        "view",
+        "--report",
+        "--only-targets",
+        "--json",
+        "result.xcresult"
+      ],
+      3e4,
+      new AbortController().signal,
+      input.artifactDirectory,
+      xcodeEnvironment()
+    );
     artifacts.push(
-      await artifact(input.artifactDirectory, "RESULT_BUNDLE", resultBundle)
+      await artifact(input.artifactDirectory, "RESULT_BUNDLE", resultBundle, {
+        testResultsAvailable: ["TEST", "TEST_WITHOUT_BUILDING"].includes(
+          input.action
+        ),
+        coverageAvailable: coverageProbe.exitCode === 0
+      })
     );
   }
-  const archivePath = join6(input.artifactDirectory, "archive.xcarchive");
+  if (!includeProducts) return artifacts;
+  const archivePath = join7(input.artifactDirectory, "archive.xcarchive");
   if (await pathExists(archivePath)) {
     artifacts.push(
       await artifact(input.artifactDirectory, "ARCHIVE", archivePath)
@@ -7073,12 +8593,12 @@ async function captureArtifacts(input, folder, signal) {
   if (apps.length === 1) {
     const settings = apps[0].buildSettings;
     const productName = settings.FULL_PRODUCT_NAME ?? settings.WRAPPER_NAME;
-    const source = settings.TARGET_BUILD_DIR && productName ? join6(settings.TARGET_BUILD_DIR, productName) : null;
+    const source = settings.TARGET_BUILD_DIR && productName ? join7(settings.TARGET_BUILD_DIR, productName) : null;
     if (source && await pathExists(source)) {
-      const productDirectory = join6(input.artifactDirectory, "products");
-      const destination = join6(productDirectory, basename3(source));
+      const productDirectory = join7(input.artifactDirectory, "products");
+      const destination = join7(productDirectory, basename4(source));
       await mkdir3(productDirectory, { recursive: true, mode: 448 });
-      await rm3(destination, { recursive: true, force: true });
+      await rm4(destination, { recursive: true, force: true });
       await cp(source, destination, {
         recursive: true,
         preserveTimestamps: true
@@ -7093,7 +8613,7 @@ async function captureArtifacts(input, folder, signal) {
     }
   }
   if (input.action === "BUILD_FOR_TESTING") {
-    const testDirectory = join6(
+    const testDirectory = join7(
       input.artifactDirectory,
       "test-products.xctestproducts"
     );
@@ -7108,7 +8628,7 @@ async function captureArtifacts(input, folder, signal) {
       )) {
         artifacts.push(
           await artifact(input.artifactDirectory, "XCTESTRUN", file, {
-            testPlan: basename3(file, ".xctestrun")
+            testPlan: basename4(file, ".xctestrun")
           })
         );
       }
@@ -7128,14 +8648,14 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
     const testProductsPath = input.advancedSettings.priorTestProductsPath;
     const xctestrunPath = input.advancedSettings.priorXctestrunPath;
     if (testProductsPath) {
-      if (!testProductsPath.endsWith(".xctestproducts") || !await pathExists(testProductsPath) || !(await stat5(testProductsPath)).isDirectory()) {
+      if (!testProductsPath.endsWith(".xctestproducts") || !await pathExists(testProductsPath) || !(await stat6(testProductsPath)).isDirectory()) {
         throw new Error("The captured test-products artifact is unavailable");
       }
-    } else if (!xctestrunPath?.endsWith(".xctestrun") || !await pathExists(xctestrunPath) || !(await stat5(xctestrunPath)).isFile()) {
+    } else if (!xctestrunPath?.endsWith(".xctestrun") || !await pathExists(xctestrunPath) || !(await stat6(xctestrunPath)).isFile()) {
       throw new Error("The captured .xctestrun artifact is unavailable");
     }
   }
-  if (!isAbsolute4(input.artifactDirectory) || basename3(input.artifactDirectory) !== input.buildId) {
+  if (!isAbsolute4(input.artifactDirectory) || basename4(input.artifactDirectory) !== input.buildId) {
     throw new Error("Build artifact directory is invalid");
   }
   const sourceStateHash = await worktreeCodeStateHash(
@@ -7144,11 +8664,11 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
     signal
   );
   await mkdir3(input.artifactDirectory, { recursive: true, mode: 448 });
-  const rawLog = join6(input.artifactDirectory, "build.log");
+  const rawLog = join7(input.artifactDirectory, "build.log");
   const logger = new BuildLogger(input.buildId, context, rawLog, process.env);
   try {
     const scriptExecutions = [];
-    const contextPath = join6(input.artifactDirectory, "context.json");
+    const contextPath = join7(input.artifactDirectory, "context.json");
     const baseHookContext = {
       buildId: input.buildId,
       branch: input.branch ?? null,
@@ -7165,6 +8685,7 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
       configuration: input.configuration
     };
     let buildResult = null;
+    let coverageChanges = [];
     let errorCode = null;
     let error = null;
     let failBuild = false;
@@ -7222,6 +8743,18 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
         } catch (progressError) {
           logger.emit("RUNNING", "SYSTEM", cleanError3(progressError));
         }
+        if (input.worktreeCoverage) {
+          try {
+            coverageChanges = await snapshotCoverageChanges(
+              input,
+              folder,
+              Math.min(timeoutMs, 6e4),
+              signal
+            );
+          } catch (coverageError) {
+            logger.emit("COVERAGE", "STDERR", cleanError3(coverageError));
+          }
+        }
         const args2 = xcodeBuildArguments(input);
         buildResult = await runLoggedCommand({
           command: "xcrun",
@@ -7281,12 +8814,55 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
       }
     }
     let artifacts = [];
-    if (!failBuild && !signal.aborted && buildResult?.exitCode === 0) {
+    try {
+      artifacts = await captureArtifacts(
+        input,
+        folder,
+        new AbortController().signal,
+        !failBuild && !signal.aborted && buildResult?.exitCode === 0
+      );
+    } catch (artifactError) {
+      logger.emit("ARTIFACTS", "STDERR", cleanError3(artifactError));
+    }
+    const reports = [];
+    const testAction = ["TEST", "TEST_WITHOUT_BUILDING"].includes(input.action);
+    const canGenerateReports = () => !signal.aborted && buildResult?.cancelled !== true && buildResult?.timedOut !== true;
+    if (canGenerateReports() && testAction && input.advancedSettings.parseTestResults) {
+      const report = await writeJsonReport(
+        input,
+        "TEST_RESULTS",
+        Math.min(timeoutMs, 12e4),
+        signal
+      );
+      reports.push(report);
+      if (report.artifact) artifacts.push(report.artifact);
+      if (report.error) logger.emit("REPORTS", "STDERR", report.error);
+    }
+    if (canGenerateReports() && testAction && input.worktreeCoverage) {
+      let report = await writeJsonReport(
+        input,
+        "CODE_COVERAGE",
+        Math.min(timeoutMs, 12e4),
+        signal
+      );
       try {
-        artifacts = await captureArtifacts(input, folder, signal);
-      } catch (artifactError) {
-        logger.emit("ARTIFACTS", "STDERR", cleanError3(artifactError));
+        report = await addChangedCoverage(
+          report,
+          coverageChanges,
+          input,
+          folder,
+          Math.min(timeoutMs, 12e4),
+          signal
+        );
+      } catch (coverageError) {
+        logger.emit("COVERAGE", "STDERR", cleanError3(coverageError));
+      }
+      reports.push(report);
+      if (report.artifact) artifacts.push(report.artifact);
+      if (report.additionalArtifacts) {
+        artifacts.push(...report.additionalArtifacts);
       }
+      if (report.error) logger.emit("REPORTS", "STDERR", report.error);
     }
     await logger.close();
     if (await pathExists(rawLog)) {
@@ -7313,6 +8889,7 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
       error,
       commandSummary: commandSummary("xcrun", args),
       artifacts,
+      reports,
       scriptExecutions,
       sourceStateHash,
       finalStateHash,
@@ -7322,10 +8899,34 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
     await logger.close();
   }
 };
+var generateIosBuildReport = async (payload, timeoutMs, signal, onLog) => {
+  const input = parseBuildReportPayload(payload);
+  if (!isAbsolute4(input.artifactDirectory) || basename4(input.artifactDirectory) !== input.buildId) {
+    throw new Error("Build artifact directory is invalid");
+  }
+  if (signal.aborted) return { ...successfulProcess5, cancelled: true };
+  const report = await writeJsonReport(
+    input,
+    input.reportKind,
+    Math.min(timeoutMs, 18e4),
+    signal
+  );
+  await onLog({
+    sequence: 0,
+    stream: report.status === "READY" ? "SYSTEM" : "STDERR",
+    message: report.status === "READY" ? `Generated ${report.kind.toLocaleLowerCase()} report` : report.error || "Report generation failed",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  return {
+    ...successfulProcess5,
+    report,
+    artifacts: report.artifact ? [report.artifact] : []
+  };
+};
 var deleteIosBuild = async (payload, _timeoutMs, signal, onLog) => {
   const input = parseBuildDeletePayload(payload);
   if (signal.aborted) return { ...successfulProcess5, cancelled: true };
-  await rm3(input.artifactDirectory, { recursive: true, force: true });
+  await rm4(input.artifactDirectory, { recursive: true, force: true });
   await onLog({
     sequence: 0,
     stream: "SYSTEM",
@@ -7343,25 +8944,25 @@ var downloadIosBuildArtifact = async (payload, timeoutMs, signal, onLog, context
   const target2 = await realpath5(
     containedPath2(root, input.artifactRelativePath)
   );
-  const difference = relative4(root, target2);
-  if (!difference || difference === ".." || difference.startsWith(`..${sep3}`) || isAbsolute4(difference)) {
+  const difference = relative5(root, target2);
+  if (!difference || difference === ".." || difference.startsWith(`..${sep4}`) || isAbsolute4(difference)) {
     throw new Error("Build artifact resolves outside the build folder");
   }
-  const information = await stat5(target2);
+  const information = await stat6(target2);
   let uploadPath = target2;
-  let filename = basename3(target2);
+  let filename = basename4(target2);
   let contentType = "application/octet-stream";
   let temporaryArchive = null;
   try {
     if (information.isDirectory()) {
-      temporaryArchive = join6(
-        tmpdir(),
+      temporaryArchive = join7(
+        tmpdir2(),
         `ade-build-artifact-${randomUUID2()}.tar.gz`
       );
       requireSuccess3(
         await command2(
           "tar",
-          ["-czf", temporaryArchive, "-C", dirname6(target2), basename3(target2)],
+          ["-czf", temporaryArchive, "-C", dirname6(target2), basename4(target2)],
           timeoutMs,
           signal
         ),
@@ -7388,7 +8989,7 @@ var downloadIosBuildArtifact = async (payload, timeoutMs, signal, onLog, context
     return successfulProcess5;
   } finally {
     if (temporaryArchive) {
-      await rm3(temporaryArchive, { force: true });
+      await rm4(temporaryArchive, { force: true });
     }
   }
 };
@@ -7424,24 +9025,24 @@ var deployIosBuild = async (payload, timeoutMs, signal, _onLog, context) => {
   if (!await pathExists(appPath) || !appPath.endsWith(".app")) {
     throw new Error("Runnable app artifact is missing");
   }
-  const deploymentsDirectory = join6(input.artifactDirectory, "deployments");
+  const deploymentsDirectory = join7(input.artifactDirectory, "deployments");
   await mkdir3(deploymentsDirectory, { recursive: true, mode: 448 });
   const logger = new BuildLogger(
     input.buildId,
     context,
-    join6(deploymentsDirectory, "deployments.log"),
+    join7(deploymentsDirectory, "deployments.log"),
     process.env
   );
   try {
     const outcomes = [];
     for (const deployment of input.deployments) {
-      const directory = join6(
+      const directory = join7(
         input.artifactDirectory,
         "deployments",
         deployment.id
       );
       await mkdir3(directory, { recursive: true, mode: 448 });
-      const logPath = join6(directory, "deployment.log");
+      const logPath = join7(directory, "deployment.log");
       const started = Date.now();
       let failure = null;
       try {
@@ -7595,7 +9196,7 @@ var deployIosBuild = async (payload, timeoutMs, signal, _onLog, context) => {
         status: signal.aborted ? "CANCELLED" : failure ? "FAILED" : "SUCCEEDED",
         error: failure,
         durationMs: Date.now() - started,
-        outputRelativePath: relative4(input.artifactDirectory, logPath)
+        outputRelativePath: relative5(input.artifactDirectory, logPath)
       });
       if (signal.aborted) break;
     }
@@ -7611,17 +9212,6 @@ var deployIosBuild = async (payload, timeoutMs, signal, _onLog, context) => {
     await logger.close();
   }
 };
-function xml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
-}
-function plistValue(value) {
-  if (typeof value === "boolean") return value ? "<true/>" : "<false/>";
-  if (typeof value === "string") return `<string>${xml(value)}</string>`;
-  if (value && typeof value === "object" && !Array.isArray(value)) {
-    return `<dict>${Object.entries(value).map(([key, entry]) => `<key>${xml(key)}</key>${plistValue(entry)}`).join("")}</dict>`;
-  }
-  throw new Error("Unsupported export plist value");
-}
 function exportPlist(settings) {
   const method = {
     DEBUGGING: "debugging",
@@ -7643,10 +9233,7 @@ function exportPlist(settings) {
   if (Object.keys(settings.provisioningProfiles).length) {
     values.provisioningProfiles = settings.provisioningProfiles;
   }
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">${plistValue(values)}</plist>
-`;
+  return plistDocument(values);
 }
 var exportIosArchive = async (payload, timeoutMs, signal, _onLog, context) => {
   const input = parseBuildExportPayload(payload);
@@ -7662,14 +9249,14 @@ var exportIosArchive = async (payload, timeoutMs, signal, _onLog, context) => {
   if (!await pathExists(archivePath) || !archivePath.endsWith(".xcarchive")) {
     throw new Error("Archive artifact is missing");
   }
-  const exportDirectory = join6(
+  const exportDirectory = join7(
     input.artifactDirectory,
     "exports",
     input.exportId
   );
   await mkdir3(exportDirectory, { recursive: true, mode: 448 });
-  const plistPath = join6(exportDirectory, "ExportOptions.plist");
-  const logPath = join6(exportDirectory, "export.log");
+  const plistPath = join7(exportDirectory, "ExportOptions.plist");
+  const logPath = join7(exportDirectory, "export.log");
   await writeFile3(plistPath, exportPlist(input.settings), { mode: 384 });
   const logger = new BuildLogger(input.buildId, context, logPath, process.env);
   try {
@@ -7701,14 +9288,30 @@ var exportIosArchive = async (payload, timeoutMs, signal, _onLog, context) => {
       signal: result.signal,
       timedOut: result.timedOut,
       cancelled: result.cancelled,
-      outputRelativePath: relative4(input.artifactDirectory, exportDirectory),
+      outputRelativePath: relative5(input.artifactDirectory, exportDirectory),
       sizeBytes: result.exitCode === 0 ? await pathSize(exportDirectory) : null,
-      error: result.exitCode === 0 ? null : cleanError3(result.output)
+      error: result.exitCode === 0 ? null : cleanError3(result.output),
+      artifacts: result.exitCode === 0 ? await exportedArtifacts(input, exportDirectory, archivePath, signal) : []
     };
   } finally {
     await logger.close();
   }
 };
+async function exportedArtifacts(input, exportDirectory, archivePath, signal) {
+  const [ipaPath] = await findFiles(
+    exportDirectory,
+    (name) => name.endsWith(".ipa"),
+    5
+  );
+  if (!ipaPath) return [];
+  return [
+    await artifact(input.artifactDirectory, "IPA", ipaPath, {
+      exportId: input.exportId,
+      exportMethod: input.settings.method,
+      ...await archiveApplicationProperties(archivePath, 1e4, signal)
+    })
+  ];
+}
 
 // src/handlers/index.ts
 var handlers = {
@@ -7730,6 +9333,8 @@ var handlers = {
   [WORKTREE_DELETE_JOB_KIND]: deleteWorktree,
   [WORKTREE_OPERATION_JOB_KIND]: operateWorktree,
   [WORKTREE_WATCH_JOB_KIND]: watchWorktree,
+  [WORKTREE_DIFF_JOB_KIND]: inspectWorktreeDiff,
+  [WORKTREE_DIFF_ASSET_JOB_KIND]: downloadWorktreeDiffAsset,
   [SKILL_SCAN_JOB_KIND]: scanSkills,
   [SKILL_READ_JOB_KIND]: readSkills,
   [SKILL_APPLY_JOB_KIND]: applySkills,
@@ -7741,7 +9346,10 @@ var handlers = {
   [IOS_BUILD_DELETE_JOB_KIND]: deleteIosBuild,
   [IOS_ARTIFACT_DOWNLOAD_JOB_KIND]: downloadIosBuildArtifact,
   [IOS_DEPLOY_JOB_KIND]: deployIosBuild,
-  [IOS_EXPORT_JOB_KIND]: exportIosArchive
+  [IOS_EXPORT_JOB_KIND]: exportIosArchive,
+  [IOS_TEST_RESULTS_JOB_KIND]: generateIosBuildReport,
+  [IOS_COVERAGE_REPORT_JOB_KIND]: generateIosBuildReport,
+  [IOS_SIGNING_INSPECT_JOB_KIND]: inspectIosSigning
 };
 
 // src/repository-coordinator.ts