@aiden-ade/sandbox-agent 0.1.48 → 0.1.50

package/dist/index.cjs

@@ -4810,6 +4810,351 @@ var require_websocket_server = __commonJS({
   }
 });
 
+// src/index.ts
+var import_node_child_process8 = require("child_process");
+
+// src/cli-executable.ts
+var import_node_child_process = require("child_process");
+var import_node_fs = require("fs");
+var import_node_os = require("os");
+var import_node_path = require("path");
+var PROVIDER_CLI_COMMANDS = {
+  claude_cli: { provider: "claude_cli", command: "claude", envVars: ["ALAN_CLAUDE_PATH"] },
+  codex_app_server: {
+    provider: "codex_app_server",
+    command: "codex",
+    envVars: ["ALAN_CODEX_PATH"]
+  },
+  copilot_cli: { provider: "copilot_cli", command: "copilot", envVars: ["ALAN_COPILOT_PATH"] },
+  cursor_agent_cli: {
+    provider: "cursor_agent_cli",
+    command: "cursor-agent",
+    envVars: ["ALAN_CURSOR_AGENT_PATH"]
+  },
+  antigravity_cli: {
+    provider: "antigravity_cli",
+    command: "agy",
+    envVars: ["ALAN_ANTIGRAVITY_PATH"]
+  },
+  kimi_cli: { provider: "kimi_cli", command: "kimi-cli", envVars: ["ALAN_KIMI_PATH"] },
+  grok_cli: { provider: "grok_cli", command: "grok", envVars: ["ALAN_GROK_PATH"] },
+  opencode_cli: { provider: "opencode_cli", command: "opencode", envVars: ["ALAN_OPENCODE_PATH"] },
+  droid_cli: { provider: "droid_cli", command: "droid", envVars: ["ALAN_DROID_PATH"] },
+  supatest_cli: { provider: "supatest_cli", command: "supatest", envVars: ["ALAN_SUPATEST_PATH"] }
+};
+var DISCOVERABLE_PROVIDER_KINDS = Object.keys(PROVIDER_CLI_COMMANDS);
+var PROVIDER_ALIASES = {
+  agy: "antigravity_cli",
+  antigravity: "antigravity_cli",
+  antigravity_cli: "antigravity_cli",
+  codex: "codex_app_server",
+  gemini: "antigravity_cli",
+  gemini_cli: "antigravity_cli"
+};
+var BACKEND_CLI_COMMANDS = {
+  claude_cli: "claude",
+  codex: "codex",
+  codex_app_server: "codex",
+  copilot_cli: "copilot",
+  cursor_agent_cli: "cursor-agent",
+  agy: "agy",
+  antigravity: "agy",
+  antigravity_cli: "agy",
+  gemini_cli: "agy",
+  gemini: "agy",
+  kimi_cli: "kimi-cli",
+  grok_cli: "grok",
+  opencode_cli: "opencode",
+  droid_cli: "droid",
+  supatest_cli: "supatest"
+};
+var CLI_COMMAND_ALIASES = {
+  "kimi-cli": ["kimi"],
+  grok: ["grok-build"]
+};
+var resolvedCliCache = /* @__PURE__ */ new Map();
+var NEGATIVE_RESOLUTION_TTL_MS = 15e3;
+var negativeResolutionExpiry = /* @__PURE__ */ new Map();
+var cachedLoginShellEnv = null;
+function parseEnvOutput(output) {
+  const loginEnv = {};
+  for (const line of output.split("\n")) {
+    if (!line.trim()) continue;
+    const eqIdx = line.indexOf("=");
+    if (eqIdx <= 0) continue;
+    const key = line.slice(0, eqIdx);
+    if (/\s/.test(key)) continue;
+    loginEnv[key] = line.slice(eqIdx + 1);
+  }
+  if (!loginEnv.HOME) loginEnv.HOME = process.env.HOME ?? (0, import_node_os.homedir)();
+  if (!loginEnv.SHELL) loginEnv.SHELL = process.env.SHELL ?? "/bin/zsh";
+  return loginEnv;
+}
+function loadLoginShellEnvironment() {
+  if (cachedLoginShellEnv) return cachedLoginShellEnv;
+  if ((0, import_node_os.platform)() === "win32") {
+    cachedLoginShellEnv = process.env;
+    return cachedLoginShellEnv;
+  }
+  try {
+    const shell = (process.env.SHELL || "/bin/bash").replace(/'/g, "'\\''");
+    const envOutput = (0, import_node_child_process.execSync)(`'${shell}' -ilc 'env'`, {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 5e3
+    });
+    cachedLoginShellEnv = parseEnvOutput(envOutput);
+  } catch {
+    cachedLoginShellEnv = process.env;
+  }
+  return cachedLoginShellEnv;
+}
+function getDaemonCliEnvironment() {
+  const base = (0, import_node_os.platform)() === "win32" ? process.env : loadLoginShellEnvironment();
+  return augmentCliPath(base);
+}
+function cacheResolvedCli(command, resolvedPath) {
+  resolvedCliCache.set(command, resolvedPath);
+  if (resolvedPath === null) {
+    negativeResolutionExpiry.set(command, Date.now() + NEGATIVE_RESOLUTION_TTL_MS);
+  } else {
+    negativeResolutionExpiry.delete(command);
+  }
+}
+function getCachedResolvedCli(command) {
+  const cached = resolvedCliCache.get(command);
+  if (cached === null) {
+    const expiresAt = negativeResolutionExpiry.get(command);
+    if (expiresAt === void 0 || Date.now() >= expiresAt) {
+      resolvedCliCache.delete(command);
+      negativeResolutionExpiry.delete(command);
+      return void 0;
+    }
+  }
+  return cached;
+}
+function resolveViaWhere(command, env) {
+  if ((0, import_node_os.platform)() !== "win32") return null;
+  const whereExe = (0, import_node_path.join)(
+    env.SystemRoot ?? process.env.SystemRoot ?? "C:\\Windows",
+    "System32",
+    "where.exe"
+  );
+  if (!(0, import_node_fs.existsSync)(whereExe)) return null;
+  const result = (0, import_node_child_process.spawnSync)(whereExe, [command], {
+    encoding: "utf8",
+    env,
+    windowsHide: true,
+    timeout: 3e3
+  });
+  if (result.error || result.status !== 0) return null;
+  for (const line of result.stdout.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    if (isRunnableFile(trimmed)) return trimmed;
+  }
+  return null;
+}
+function runCliProbeAsync(executable, env, args = ["--version"], timeoutMs = 3e3, spawnOptions) {
+  return new Promise((resolve6) => {
+    const isWin = (0, import_node_os.platform)() === "win32";
+    let command = executable;
+    let commandArgs = args;
+    if (isWin && /\.(cmd|bat)$/i.test(executable)) {
+      command = env.ComSpec ?? process.env.ComSpec ?? "cmd.exe";
+      commandArgs = ["/d", "/s", "/c", executable, ...args];
+    }
+    const useShell = isWin && command === executable && !/[\\/]/.test(executable);
+    const closeStdin = spawnOptions?.closeStdin === true;
+    let child;
+    try {
+      child = (0, import_node_child_process.spawn)(command, commandArgs, {
+        env,
+        shell: useShell,
+        windowsHide: isWin ? true : void 0,
+        timeout: timeoutMs,
+        stdio: closeStdin ? ["pipe", "pipe", "pipe"] : void 0
+      });
+    } catch (error) {
+      resolve6({ status: null, stdout: "", stderr: "", error });
+      return;
+    }
+    if (closeStdin) {
+      child.stdin?.end();
+    }
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.setEncoding("utf8").on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr?.setEncoding("utf8").on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.once("error", (error) => resolve6({ status: null, stdout, stderr, error }));
+    child.once(
+      "close",
+      (status, signal) => resolve6({ status, stdout, stderr, signal: signal ?? null })
+    );
+  });
+}
+function runCliVersionProbeAsync(executable, env, args = ["--version"], timeoutMs = 3e3) {
+  return runCliProbeAsync(executable, env, args, timeoutMs);
+}
+function pathSeparator() {
+  return (0, import_node_os.platform)() === "win32" ? ";" : ":";
+}
+function splitPath(pathValue) {
+  if (!pathValue) return [];
+  return pathValue.split(pathSeparator()).filter(Boolean);
+}
+function isRunnableFile(path) {
+  if (!(0, import_node_fs.existsSync)(path)) return false;
+  if ((0, import_node_os.platform)() === "win32") return true;
+  try {
+    (0, import_node_fs.accessSync)(path, import_node_fs.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function windowsCommandCandidates(command, pathExt) {
+  const trimmed = command.trim();
+  if (!trimmed) return [];
+  const hasExtension = /\.[a-z0-9]+$/i.test(trimmed);
+  if (hasExtension) return [trimmed];
+  const extensions = pathExt.split(";").map((ext) => ext.trim()).filter(Boolean);
+  return [trimmed, ...extensions.map((ext) => `${trimmed}${ext}`)];
+}
+function augmentCliPath(env) {
+  const home = env.HOME || env.USERPROFILE || (0, import_node_os.homedir)();
+  const isWin = (0, import_node_os.platform)() === "win32";
+  const extraPaths = isWin ? [
+    (0, import_node_path.join)(home, "AppData", "Roaming", "npm"),
+    (0, import_node_path.join)(home, "AppData", "Local", "Programs", "Microsoft", "WindowsApps"),
+    (0, import_node_path.join)(home, ".local", "bin"),
+    "C:\\Program Files\\nodejs",
+    "C:\\Program Files\\Git\\cmd"
+  ] : [
+    (0, import_node_path.join)(home, ".local", "bin"),
+    (0, import_node_path.join)(home, ".local", "node", "bin"),
+    (0, import_node_path.join)(home, ".bun", "bin"),
+    (0, import_node_path.join)(home, ".cargo", "bin"),
+    "/opt/homebrew/bin",
+    "/usr/local/bin"
+  ];
+  const basePath = env.PATH ?? "";
+  const existing = new Set(splitPath(basePath));
+  const missing = extraPaths.filter((dir) => !existing.has(dir));
+  if (missing.length === 0) return env;
+  return {
+    ...env,
+    PATH: missing.length > 0 ? `${missing.join(pathSeparator())}${pathSeparator()}${basePath}` : basePath
+  };
+}
+function resolveCliExecutable(command, env = getDaemonCliEnvironment()) {
+  const trimmed = command.trim();
+  if (!trimmed) return null;
+  const cached = getCachedResolvedCli(trimmed);
+  if (cached === null) return null;
+  if (cached && isRunnableFile(cached)) return cached;
+  if ((trimmed.includes("/") || trimmed.includes("\\")) && isRunnableFile(trimmed)) {
+    cacheResolvedCli(trimmed, trimmed);
+    return trimmed;
+  }
+  const enriched = augmentCliPath(env);
+  const home = enriched.HOME || enriched.USERPROFILE || (0, import_node_os.homedir)();
+  const isWin = (0, import_node_os.platform)() === "win32";
+  const pathExt = enriched.PATHEXT ?? (isWin ? ".EXE;.CMD;.BAT;.COM" : "");
+  const commandNames = [trimmed, ...CLI_COMMAND_ALIASES[trimmed] ?? []];
+  const names = commandNames.flatMap(
+    (name) => isWin ? windowsCommandCandidates(name, pathExt) : [name]
+  );
+  const candidates = [];
+  for (const name of names) {
+    if (name.includes("/") || name.includes("\\")) {
+      candidates.push(name);
+      continue;
+    }
+    for (const dir of splitPath(enriched.PATH)) {
+      candidates.push((0, import_node_path.join)(dir, name));
+    }
+    candidates.push((0, import_node_path.join)(home, ".local", "bin", name), (0, import_node_path.join)(home, ".local", "node", "bin", name));
+    if (!isWin) {
+      candidates.push((0, import_node_path.join)("/opt/homebrew/bin", name), (0, import_node_path.join)("/usr/local/bin", name));
+    } else {
+      candidates.push((0, import_node_path.join)(home, "AppData", "Roaming", "npm", name));
+    }
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    if (seen.has(candidate)) continue;
+    seen.add(candidate);
+    if (isRunnableFile(candidate)) {
+      cacheResolvedCli(trimmed, candidate);
+      return candidate;
+    }
+  }
+  const viaWhere = resolveViaWhere(trimmed, enriched);
+  if (viaWhere) {
+    cacheResolvedCli(trimmed, viaWhere);
+    return viaWhere;
+  }
+  cacheResolvedCli(trimmed, null);
+  return null;
+}
+function normalizeDiscoverableProvider(provider) {
+  const alias = PROVIDER_ALIASES[provider];
+  if (alias) return alias;
+  if (provider in PROVIDER_CLI_COMMANDS) {
+    return provider;
+  }
+  return null;
+}
+function resolveProviderCliCommand(provider, env = getDaemonCliEnvironment()) {
+  const normalized = normalizeDiscoverableProvider(provider);
+  if (!normalized) return null;
+  const spec = PROVIDER_CLI_COMMANDS[normalized];
+  const override = spec.envVars.map((name) => process.env[name]?.trim() || env[name]?.trim()).find(Boolean);
+  if (override) {
+    const resolved2 = resolveCliExecutable(override, env) ?? (isRunnableFile(override) ? override : null);
+    if (resolved2) cacheResolvedCli(spec.command, resolved2);
+    return resolved2;
+  }
+  const resolved = resolveCliExecutable(spec.command, env);
+  if (resolved) cacheResolvedCli(spec.command, resolved);
+  return resolved;
+}
+function resolveBackendRuntimeCommand(backendKind, env = getDaemonCliEnvironment()) {
+  if (!backendKind) return void 0;
+  const command = BACKEND_CLI_COMMANDS[backendKind];
+  if (!command) return void 0;
+  const cached = getCachedResolvedCli(command);
+  if (cached === null) return void 0;
+  if (cached && isRunnableFile(cached)) return cached;
+  const spec = Object.values(PROVIDER_CLI_COMMANDS).find((entry) => entry.command === command);
+  const envOverride = spec ? spec.envVars.map((name) => env[name]?.trim()).find(Boolean) : void 0;
+  const resolved = resolveCliExecutable(envOverride?.trim() || command, env);
+  cacheResolvedCli(command, resolved);
+  return resolved ?? void 0;
+}
+function invalidateResolvedCli(command) {
+  const trimmed = command.trim();
+  if (trimmed) {
+    resolvedCliCache.delete(trimmed);
+    negativeResolutionExpiry.delete(trimmed);
+  }
+}
+function revalidateBackendRuntimeCommand(backendKind, env = getDaemonCliEnvironment()) {
+  if (!backendKind) return void 0;
+  const command = BACKEND_CLI_COMMANDS[backendKind];
+  if (!command) return void 0;
+  invalidateResolvedCli(command);
+  const spec = Object.values(PROVIDER_CLI_COMMANDS).find((entry) => entry.command === command);
+  const envOverride = spec ? spec.envVars.map((name) => env[name]?.trim()).find(Boolean) : void 0;
+  if (envOverride) invalidateResolvedCli(envOverride);
+  return resolveBackendRuntimeCommand(backendKind, env);
+}
+
 // src/cli-help.ts
 var HELP_TEXT = `Alan agent CLI
 
@@ -4859,12 +5204,12 @@ function resolveCommand(args, env) {
 }
 
 // src/daemon.ts
-var import_node_child_process5 = require("child_process");
+var import_node_child_process6 = require("child_process");
 var import_node_crypto3 = require("crypto");
-var import_node_fs12 = require("fs");
+var import_node_fs13 = require("fs");
 var import_node_http = __toESM(require("http"), 1);
-var import_node_os7 = require("os");
-var import_node_path10 = require("path");
+var import_node_os8 = require("os");
+var import_node_path11 = require("path");
 
 // ../agent-core/dist/index.js
 var import_fs = require("fs");
@@ -5020,69 +5365,67 @@ Every \`start_task_session\` message must include all four of these:
 var GENERAL_PROMPT = `You are Alan, the General Agent \u2014 a flexible general-purpose agent profile. When identifying yourself, say "I'm Alan, the General Agent."`;
 var SETUP_PROMPT = `## You are the Setup Agent
 
-You are the **Setup Agent** for this environment. When asked who you are, say
-"I'm the Setup Agent (an Alan agent profile) for this environment." Your job is
-to take a freshly cloned repository in a fresh cloud sandbox and get it fully
-installed, configured, and **actually running and verified** \u2014 end to end. You
-are not here to build features; you are here to make the environment work and
-make that reproducible.
+You are the **Setup Agent** for this cloud environment. When identifying yourself, say "I'm the Setup Agent (an Alan agent profile) for this environment."
+
+Your job is to take the repository in this fresh cloud sandbox from an unknown state to a **running, functionally verified, reproducible environment**. You are setting up the project, not building product features. Keep working until the application actually works.
+
+## Environment model
+
+- You are inside an ephemeral cloud sandbox. Its filesystem can be captured as a reusable snapshot for future sessions.
+- Do not assume you are on the user's laptop or that tools outside this sandbox exist.
+- Install and build inside the workspace. Keep all setup repeatable from a fresh clone.
+
+### Sandbox privileges
 
-## Where you are running
+- You are the non-root user \`alan\`; \`HOME=/home/alan\`, repos in \`/home/alan/workspace\`, which you fully own. Node/pnpm/CLIs are on \`PATH\`, and \`npm install -g\` needs no sudo.
+- **Installing system packages is allowed**, via sudo scoped to package managers: \`sudo apt-get\`, \`sudo apt\`, \`sudo dpkg\`, \`sudo add-apt-repository\`. Other sudo (\`su\`, \`sh\`, \`systemctl\`) is refused by design.
+- **Always \`sudo apt-get update\` first.** Package lists ship empty, so installing without it fails with "Unable to locate package" \u2014 which reads as "permission denied" but is not:
+  \`sudo apt-get update && sudo apt-get install -y --no-install-recommends <pkgs>\`
+- Never hand-compile system packages into \`$HOME\` to route around a permission you already have. Use apt; fall back to a user-local install only if the package truly is not in apt.
+- No Docker daemon or socket. Ports below 1024 bind fine without elevation.
+- Read the real error before blaming permissions: \`ELIFECYCLE\` is a generic pnpm epilogue, not a diagnosis. Find the \`ERR_\`/\`gyp ERR!\` line above it. A native build failure means a missing system package, not a missing privilege.
+- Persist the final ordered commands with \`set_environment_setup_commands\`. Each command is replayed in a fresh shell, so no command may depend on shell state from a previous command.
+- The snapshot policy is \`block_if_dirty\`: the working tree must be clean before capture.
 
-You are inside an **ephemeral cloud sandbox whose filesystem will be captured as
-a snapshot** and reused to boot future sessions instantly. This means:
-- Install and build into the workspace \u2014 the snapshot preserves it.
-- Keep tracked files clean: installs must land in git-ignored paths. Snapshot
-  capture is blocked if the git tree is dirty.
-- If you must change tracked files (setup scripts, config, docs), commit them on
-  the working branch and open a PR for those changes \u2014 do not leave the tree
-  dirty and do not commit secrets.
+## Required workflow
 
-## What "done" means
+1. **Explore** \u2014 read repository instructions, manifests, lockfiles, example env files, and service configuration. Detect the language, package manager, workspace layout, required services, and expected ports.
+2. **Set up** \u2014 install dependencies, select compatible runtimes, configure non-secret defaults, and build. Diagnose failures yourself before asking the user.
+3. **Run and verify** \u2014 start the real app or service. Prove it works using process stability, logs, HTTP probes, and \`agent-browser\` interaction when a UI exists. A process merely starting or dependencies merely installing is not success.
+4. **Persist** \u2014 call \`set_environment_setup_commands\` with only the ordered commands you actually verified from a fresh-shell model.
+5. **Prepare capture** \u2014 ensure every repository is clean. Verify that \`git status --porcelain --untracked-files=all\` is empty; generated untracked files count as dirty and must be removed or covered by an appropriate existing ignore rule. If setup requires tracked changes, create a focused branch, commit them, push it, and open a PR with \`github_pr_create\` explaining why the setup change is needed. When this setup session is attached to a task, link that PR with \`github_pr_link_task\`. Never commit secrets.
+6. **Human gate** \u2014 summarize the evidence and ask the user to approve the snapshot. The chat shows them a **Capture snapshot** button, so invite them to use it rather than dictating an exact phrase to type. Do not call \`capture_environment_snapshot\` before that approval arrives.
+7. **Capture and re-verify** \u2014 after approval, call \`capture_environment_snapshot\` with \`afterSnapshot: "resume"\`. Poll \`get_cloud_machine\` until the snapshot is ready, then confirm the sandbox remains usable and repeat the key runtime probe before declaring completion.
 
-1. Dependencies installed and the project builds.
-2. Setup commands persisted via \`set_environment_setup_commands\` so future
-   sessions reproduce this environment.
-3. The app is **running** and **verified functional** \u2014 dev server up, reachable
-   on the exposed port (curl), and rendering/working via agent-browser.
-4. Required environment variables are present (see below).
-5. After explicit human confirmation, the environment is captured via
-   \`capture_environment_snapshot\`.
+## Autonomy
 
-## Environment variables & secrets
+Prefer acting over asking. Read the repo, inspect logs, try the likely command, and recover from ordinary setup failures yourself. Ask only for information that cannot be derived or safely created: a required secret, paid credential, external account choice, or genuine product-intent fork. Ask one specific question at a time and continue independent work while waiting.
 
-You cannot set secret values yourself, and you must never ask the user to paste a
-secret value into the chat. When the repo needs env vars/secrets:
-- Identify exactly which vars are required (from .env.example, config, or boot
-  errors) and tell the user the names and what each is for.
-- Direct the user to add them in the secure env-vars UI. Adding/editing there is
-  **live-synced into this running sandbox immediately** (no restart needed): the
-  value is injected and the file lands at its configured destinationPath
-  (symlinked from /run/alan/env-files/\u2026).
-- After the user says they've added a var, **confirm it actually arrived** by
-  reading that destination path (never echo the secret value) and re-running the
-  boot/verification.
+Do not weaken a required functional check to make it pass. If the real process cannot start, the expected port cannot bind, or a browser-required UI cannot be exercised, diagnose and fix the cause. If the restriction is truly outside the sandbox, report the precise blocker instead of declaring setup complete from a mocked handler or unit-level substitute.
 
-## Human gate before snapshot
+## Environment variables and secrets
 
-Do not capture the snapshot autonomously. Once the environment is installed,
-running, and verified, summarize what you did and ask the user to confirm. Only
-after explicit confirmation call \`capture_environment_snapshot\`. Keep the sandbox
-alive while you wait.
+Never ask the user to paste a secret into chat, and never print secret values. When a required secret is missing:
 
-## When to ask vs act
+1. Name the exact variable and explain what it is used for.
+2. Direct the user to this cloud environment's Environment Variables / env-files UI.
+3. Explain that saved values sync into the running sandbox automatically with no restart required. Env files land at their configured \`destinationPath\` through \`/run/alan/env-files/\`.
+4. After the user saves it, verify only that the key arrived at the configured destination or environment\u2014never echo the value\u2014then continue.
 
-Act autonomously on install, build, config, starting the dev server, and
-verification. Ask the user only for: secret values (via the secure UI, never in
-chat) and final snapshot confirmation. If setup fails, prefer fixing it from live
-evidence (logs, boot errors, curl/agent-browser output) before asking.
+Derive and configure non-secret values yourself when the repository provides safe defaults.
 
-## Setup script changes \u2192 commit + PR
+## Evidence and completion
 
-If getting the environment reproducible requires editing tracked setup files or
-adding scripts, make the smallest coherent change, commit it on the working
-branch, and open a PR (github_pr_create) describing the setup adjustment. Keep
-installs in git-ignored paths so the snapshot tree stays clean.`;
+Do not rely on your own claim that setup worked. Before finishing, report:
+
+- the install/build/run commands that succeeded;
+- the runtime endpoint and functional checks performed;
+- whether any user-provided secret was required and whether its presence was verified safely;
+- the persisted setup commands;
+- the clean-tree or PR result;
+- the snapshot ID/state and the post-capture verification result.
+
+If any required item is missing, you are not done.`;
 var REVIEW_PROMPT = `## You are the Review Agent
 
 You are the **Review Agent** (an Alan agent profile) for pull request review sessions. When identifying yourself, say "I'm the Review Agent."
@@ -9791,8 +10134,152 @@ function createAlanProblem(input) {
   return alanProblemV1Schema.parse({ ...input, schemaVersion: 1 });
 }
 
-// ../shared/dist/agent/session-result.js
-var SESSION_RESUME_FAILED_MESSAGE = "Session resume failed. The previous session may have expired or is no longer available. Please start a new session.";
+// ../shared/dist/agent/session-result.js
+var SESSION_RESUME_FAILED_MESSAGE = "Session resume failed. The previous session may have expired or is no longer available. Please start a new session.";
+
+// ../shared/dist/agent/skill-repo-scope.js
+var SKILL_ROOT_MARKER_RE = /\/\.(?:claude|agents|codex)\/(?:skills|commands)(?:\/|$)/;
+function normalizePath(path) {
+  return path.replace(/\\/g, "/").replace(/\/+$/, "");
+}
+function deriveSkillRepoRoot(sourcePath) {
+  if (!sourcePath)
+    return void 0;
+  const normalized = normalizePath(sourcePath);
+  const marker = normalized.match(SKILL_ROOT_MARKER_RE);
+  if (!marker || marker.index === void 0)
+    return void 0;
+  const beforeRoot = normalized.slice(0, marker.index).replace(/\/+$/, "");
+  return beforeRoot || void 0;
+}
+function deriveSkillRepoLabel(sourcePath) {
+  const repoRoot = deriveSkillRepoRoot(sourcePath);
+  if (!repoRoot)
+    return void 0;
+  const label = repoRoot.split("/").filter(Boolean).pop();
+  if (!label || label === "~")
+    return void 0;
+  return label;
+}
+function isTeamSkillSource(source) {
+  return source === "team" || source === "project";
+}
+function skillIdentityKey(skill) {
+  const command = skill.command.trim();
+  if (isTeamSkillSource(skill.source)) {
+    const repoRoot = skill.repoRoot && normalizePath(skill.repoRoot) || deriveSkillRepoRoot(skill.sourcePath) || "unknown";
+    return `team:${repoRoot}:${command}`;
+  }
+  return `global:${command}`;
+}
+
+// ../shared/dist/agent/skill-discovery.js
+var SKILL_DIRECTORY_ROOTS = [".claude/skills", ".agents/skills", ".codex/skills"];
+var SKILL_PATH_RE = /(?:^|[/\\])\.(?:claude|agents|codex)[/\\]+skills[/\\]+([^/\\]+)[/\\]+SKILL\.md$/i;
+var LEGACY_COMMAND_PATH_RE = /(?:^|[/\\])\.claude[/\\]+commands[/\\]+([^/\\]+)\.md$/i;
+function normalizeSkillSourcePath(sourcePath) {
+  return sourcePath.replace(/\\/g, "/").replace(/\/{2,}/g, "/");
+}
+function unquoteScalar(value2) {
+  const trimmed = value2.trim();
+  if (trimmed.length < 2)
+    return trimmed;
+  const first = trimmed[0];
+  const last = trimmed[trimmed.length - 1];
+  if (first === '"' && last === '"' || first === "'" && last === "'") {
+    return trimmed.slice(1, -1).trim();
+  }
+  return trimmed;
+}
+function readScalarField(lines, names) {
+  const nameSet = new Set(names);
+  for (const line of lines) {
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1)
+      continue;
+    const key = line.slice(0, colonIdx).trim();
+    if (!nameSet.has(key))
+      continue;
+    const value2 = unquoteScalar(line.slice(colonIdx + 1));
+    if (value2)
+      return value2;
+  }
+  return "";
+}
+function parseSkillDescription(markdown) {
+  const normalized = markdown.replace(/\r\n/g, "\n").trim();
+  if (!normalized)
+    return "";
+  const frontmatterMatch = normalized.match(/^---\n([\s\S]*?)\n---(?:\n([\s\S]*))?$/);
+  if (frontmatterMatch) {
+    const description = readScalarField(frontmatterMatch[1].split("\n"), ["description", "desc"]);
+    if (description)
+      return description;
+    const body = frontmatterMatch[2]?.trim() ?? "";
+    const firstBodyLine = body.split("\n").find((line) => line.trim());
+    return firstBodyLine?.trim().slice(0, 200) ?? "";
+  }
+  const firstLine2 = normalized.split("\n").find((line) => line.trim());
+  if (!firstLine2)
+    return "";
+  const inlineDescription = readScalarField([firstLine2], ["description", "desc"]);
+  if (inlineDescription)
+    return inlineDescription;
+  return firstLine2.trim().slice(0, 200);
+}
+function extractSkillCommandFromPath(sourcePath) {
+  const normalized = normalizeSkillSourcePath(sourcePath);
+  const skillPathMatch = normalized.match(SKILL_PATH_RE);
+  if (skillPathMatch?.[1])
+    return skillPathMatch[1];
+  const legacyCommandMatch = normalized.match(LEGACY_COMMAND_PATH_RE);
+  if (legacyCommandMatch?.[1])
+    return legacyCommandMatch[1];
+  return null;
+}
+function normalizeSkillEntry(entry, defaultSource = "team") {
+  const sourcePath = normalizeSkillSourcePath(entry.sourcePath ?? entry.path ?? "");
+  const command = entry.command ?? entry.cmd ?? extractSkillCommandFromPath(sourcePath);
+  if (!command)
+    return null;
+  const description = entry.description ?? entry.desc ?? parseSkillDescription(entry.content ?? "");
+  const source = entry.source ?? entry.src ?? defaultSource;
+  const repoRoot = entry.repoRoot ?? (isTeamSkillSource(source) ? deriveSkillRepoRoot(sourcePath) : void 0);
+  const repoLabel = entry.repoLabel ?? (isTeamSkillSource(source) ? deriveSkillRepoLabel(sourcePath) : void 0);
+  return {
+    command,
+    description,
+    source,
+    sourcePath,
+    ...repoRoot ? { repoRoot } : {},
+    ...repoLabel ? { repoLabel } : {}
+  };
+}
+function skillPriority(source) {
+  switch (source) {
+    case "team":
+    case "project":
+      return 3;
+    case "global":
+      return 2;
+    case "alan":
+      return 1;
+  }
+}
+function dedupeSkillEntries(entries) {
+  const deduped = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const key = skillIdentityKey(entry);
+    const existing = deduped.get(key);
+    if (!existing || skillPriority(entry.source) > skillPriority(existing.source)) {
+      deduped.set(key, entry);
+    }
+  }
+  return Array.from(deduped.values());
+}
+function normalizeSkillEntries(entries, defaultSource = "team") {
+  return dedupeSkillEntries(entries.map((entry) => normalizeSkillEntry(entry, defaultSource)).filter((entry) => Boolean(entry)));
+}
 
 // ../shared/dist/agent/system-prompt.js
 var ALAN_IDENTITY_PROMPT = `You are Alan, the software factory agent. Alan ships software end to end \u2014 plan, write, review, test, deploy.
@@ -10155,13 +10642,78 @@ var GROK_CLI_MODELS = [
   { id: "grok-composer-2.5-fast", name: "Composer 2.5 Fast" }
 ];
 var COPILOT_CLI_MODELS = [
-  { id: "claude-sonnet-4.5", name: "Claude Sonnet 4.5" },
+  { id: "auto", name: "Auto" },
+  {
+    id: "gpt-5.6-sol",
+    name: "GPT-5.6 Sol",
+    capabilities: { contextWindows: [], effortLevels: GPT_5_6_ULTRA_EFFORT_LEVELS }
+  },
+  {
+    id: "gpt-5.6-terra",
+    name: "GPT-5.6 Terra",
+    capabilities: { contextWindows: [], effortLevels: GPT_5_6_ULTRA_EFFORT_LEVELS }
+  },
+  {
+    id: "gpt-5.6-luna",
+    name: "GPT-5.6 Luna",
+    capabilities: { contextWindows: [], effortLevels: GPT_5_6_EFFORT_LEVELS }
+  },
+  {
+    id: "gpt-5.5",
+    name: "GPT-5.5",
+    capabilities: { contextWindows: [], effortLevels: GPT_5_5_EFFORT_LEVELS }
+  },
+  {
+    id: "gpt-5.4",
+    name: "GPT-5.4",
+    capabilities: { contextWindows: [], effortLevels: GPT_5_4_EFFORT_LEVELS }
+  },
+  {
+    id: "gpt-5.3-codex",
+    name: "GPT-5.3 Codex",
+    capabilities: { contextWindows: [], effortLevels: CODEX_5X_EFFORT_LEVELS }
+  },
+  {
+    id: "gpt-5.4-mini",
+    name: "GPT-5.4 Mini",
+    capabilities: { contextWindows: [], effortLevels: GPT_5_4_EFFORT_LEVELS }
+  },
+  { id: "gpt-5-mini", name: "GPT-5 Mini" },
+  {
+    id: "claude-sonnet-5",
+    name: "Claude Sonnet 5",
+    capabilities: { contextWindows: ["200k", "1m"], effortLevels: CLAUDE_EFFORT_LEVELS }
+  },
   { id: "claude-sonnet-4.6", name: "Claude Sonnet 4.6" },
-  { id: "claude-haiku-4.5", name: "Claude Haiku 4.5" },
-  { id: "gpt-5.3-codex", name: "GPT-5.3 Codex" },
-  { id: "gpt-5.4", name: "GPT-5.4" },
-  { id: "gpt-5.4-mini", name: "GPT-5.4 Mini" },
-  { id: "auto", name: "Auto" }
+  { id: "claude-sonnet-4.5", name: "Claude Sonnet 4.5" },
+  {
+    id: "claude-haiku-4.5",
+    name: "Claude Haiku 4.5",
+    capabilities: { contextWindows: ["200k"], effortLevels: [] }
+  },
+  {
+    id: "claude-fable-5",
+    name: "Claude Fable 5",
+    capabilities: { contextWindows: ["1m"], effortLevels: CLAUDE_EFFORT_LEVELS }
+  },
+  {
+    id: "claude-opus-5",
+    name: "Claude Opus 5",
+    capabilities: { contextWindows: ["200k", "1m"], effortLevels: CLAUDE_EFFORT_LEVELS }
+  },
+  {
+    id: "claude-opus-4.8",
+    name: "Claude Opus 4.8",
+    capabilities: { contextWindows: ["200k", "1m"], effortLevels: CLAUDE_EFFORT_LEVELS }
+  },
+  { id: "claude-opus-4.8-fast", name: "Claude Opus 4.8 Fast" },
+  { id: "claude-opus-4.7", name: "Claude Opus 4.7" },
+  { id: "claude-opus-4.6", name: "Claude Opus 4.6" },
+  { id: "claude-opus-4.5", name: "Claude Opus 4.5" },
+  { id: "gemini-3.1-pro-preview", name: "Gemini 3.1 Pro Preview" },
+  { id: "gemini-3.6-flash", name: "Gemini 3.6 Flash" },
+  { id: "gemini-3.5-flash", name: "Gemini 3.5 Flash" },
+  { id: "kimi-k2.7-code", name: "Kimi K2.7 Code" }
 ];
 var OPENCODE_PAID_MODEL = {
   billing: "paid",
@@ -10826,7 +11378,7 @@ var EPIC_STATUS_OPTIONS = [
     value: "canceled",
     label: "Canceled",
     color: CATEGORICAL_COLORS.slateClosed,
-    group: "done"
+    group: "closed"
   }
 ];
 var DEFAULT_EPIC_STATUSES = EPIC_STATUS_OPTIONS.map((o) => ({
@@ -11580,7 +12132,12 @@ function normalizeCodexCliErrorMessage(message) {
   if (lower.includes("reconnecting") && lower.includes("request timed out")) {
     return "Codex connection to OpenAI timed out while waiting for the turn to continue. Retry the message; if it repeats, check network/API latency or reduce slow MCP/tool calls in the turn.";
   }
-  if (lower.includes("access token could not be refreshed") || lower.includes("refresh_token_invalidated") || lower.includes("refresh token has been invalidated")) {
+  if (lower.includes("access token could not be refreshed") || lower.includes("refresh_token_invalidated") || lower.includes("refresh token has been invalidated") || // OpenAI's ChatGPT backend rejects a stale bearer with this pair on both the
+  // HTTP and WSS paths, e.g. "Reconnecting... 2/5 (unexpected status 401
+  // Unauthorized: Provided authentication token is expired. ... auth error
+  // code: token_expired)". Left unmapped these render as a raw retry banner
+  // with a generic "check your API key" hint and no recovery path.
+  lower.includes("token_expired") || lower.includes("provided authentication token is expired")) {
     return "Codex CLI connection expired. Re-authenticate the Codex CLI on this computer (run `codex login`) or reconnect it in Cloud settings, then retry.";
   }
   return message;
@@ -11817,12 +12374,29 @@ function formatCliSpawnError(command, error) {
       `CLI command not found: ${command}. Install it or configure this provider with the full executable path.`
     );
   }
+  if (error.code === "ETXTBSY") {
+    return new Error(
+      `CLI "${command}" is still being written by an installer (ETXTBSY) and did not become runnable in time. Retry in a moment.`
+    );
+  }
   return error;
 }
-function waitForSpawnOutcome(child) {
+var SPAWN_RETRY_DELAYS_BY_CODE = {
+  ETXTBSY: [250, 750, 1500, 3e3, 5e3],
+  ENOENT: [250, 750]
+};
+var delay = (ms) => new Promise((resolve22) => setTimeout(resolve22, ms));
+var SPAWN_OUTCOME_TIMEOUT_MS = 2e3;
+function waitForSpawnOutcome(child, timeoutMs = SPAWN_OUTCOME_TIMEOUT_MS) {
   return new Promise((resolve22) => {
-    child.once("spawn", () => resolve22(null));
-    child.once("error", (error) => resolve22(error));
+    const timer = setTimeout(() => resolve22(null), timeoutMs);
+    timer.unref?.();
+    const settle = (value2) => {
+      clearTimeout(timer);
+      resolve22(value2);
+    };
+    child.once("spawn", () => settle(null));
+    child.once("error", (error) => settle(error));
   });
 }
 function createGenericCliBackend(options) {
@@ -11840,28 +12414,35 @@ function createGenericCliBackend(options) {
       const args = options.buildArgs?.(context, prompt) ?? options.args.map((arg) => arg === "{{prompt}}" ? prompt : arg);
       let command = options.command;
       let child = spawnCli(command, args, context);
-      if (context.revalidateCommand) {
-        const spawnError = await waitForSpawnOutcome(child);
-        if (spawnError) {
-          const fresh = spawnError.code === "ENOENT" ? context.revalidateCommand()?.trim() || null : null;
-          if (fresh && fresh !== command) {
-            console.warn(
-              `[${options.kind}] Spawn failed ENOENT for "${command}" \u2014 re-resolved to "${fresh}", retrying once`
-            );
-            command = fresh;
-            child = spawnCli(command, args, context);
-          } else {
-            throw formatCliSpawnError(command, spawnError);
-          }
-        }
-      }
       state.process = child;
       state.lastRawOutputAtMs = Date.now();
-      context.onProcessSpawned?.(child);
       context.registerLivenessProbe?.(() => ({
         providerAlive: child.exitCode === null,
         lastRawOutputAgoMs: typeof state.lastRawOutputAtMs === "number" ? Date.now() - state.lastRawOutputAtMs : null
       }));
+      for (let attempt = 0; ; attempt++) {
+        if (child.pid !== void 0) break;
+        const spawnError = await waitForSpawnOutcome(child);
+        if (!spawnError) break;
+        const delays = SPAWN_RETRY_DELAYS_BY_CODE[spawnError.code ?? ""] ?? [];
+        if (attempt >= delays.length) {
+          throw formatCliSpawnError(command, spawnError);
+        }
+        const waitMs = delays[attempt];
+        console.warn(
+          `[${options.kind}] Spawn of "${command}" failed ${spawnError.code} \u2014 a CLI installer is likely mid-flight; retrying in ${waitMs}ms (attempt ${attempt + 1}/${delays.length})`
+        );
+        await delay(waitMs);
+        const fresh = context.revalidateCommand?.()?.trim() || null;
+        if (fresh && fresh !== command) {
+          console.warn(`[${options.kind}] Re-resolved "${command}" to "${fresh}"`);
+          command = fresh;
+        }
+        child = spawnCli(command, args, context);
+      }
+      state.process = child;
+      state.lastRawOutputAtMs = Date.now();
+      context.onProcessSpawned?.(child);
       const safeArgs = args.map(
         (a, i) => i > 0 && args[i - 1] === "--system-prompt" ? `"<system-prompt ${a.length} chars>"` : a
       );
@@ -12705,7 +13286,11 @@ function buildAntigravityCliArgs(context, prompt, defaultArgs = [], capabilities
   const args = [];
   const selectedModel = context.config.selectedModel?.trim();
   const resumeId = context.config.runtimeSessionId?.trim() || context.config.providerSessionId?.trim();
-  if (selectedModel) args.push("--model", selectedModel);
+  if (selectedModel) {
+    args.push("--model", selectedModel);
+    const effort = context.config.selectedEffortLevel?.trim().toLowerCase();
+    if (effort && isEffortLevel(effort)) args.push("--effort", effort);
+  }
   if (resumeId) args.push("--conversation", resumeId);
   if (!shouldUseReadOnlyRuntimePermissions(context.config)) {
     args.push("--dangerously-skip-permissions");
@@ -12716,6 +13301,14 @@ function buildAntigravityCliArgs(context, prompt, defaultArgs = [], capabilities
   args.push("--print-timeout", "10m");
   return [...args, ...defaultArgs, "-p", prompt];
 }
+function buildAntigravityAugmentedPrompt(context, images) {
+  const isResume = Boolean(
+    context.config.runtimeSessionId?.trim() || context.config.providerSessionId?.trim()
+  );
+  const base = buildResumeAwarePrompt(context.config, context.promptText, { isResume });
+  const prompt = context.config.mode === "plan" ? buildPlanModePrefix(base) : base;
+  return appendImagePathReferences(prompt, images);
+}
 function createAntigravityCliBackend(command = "agy", defaultArgs = []) {
   return {
     kind: "antigravity_cli",
@@ -12737,7 +13330,7 @@ function createAntigravityCliBackend(command = "agy", defaultArgs = []) {
           command,
           args: [],
           buildArgs: (ctx, prompt) => buildAntigravityCliArgs(ctx, prompt, defaultArgs, capabilities),
-          augmentPrompt: (ctx) => buildPromptWithImagePathReferences(ctx, imageFiles),
+          augmentPrompt: (ctx) => buildAntigravityAugmentedPrompt(ctx, imageFiles),
           parseStructuredLine: parseAntigravityLine
         }).run(context);
       } finally {
@@ -14904,6 +15497,41 @@ var parseCopilotStructuredLine = createStructuredLineParser(
   "copilot_cli",
   handleCopilotStructuredEvent
 );
+function buildCopilotCliArgs(context, prompt, defaultArgs = []) {
+  const args = [
+    "--autopilot",
+    "--yolo",
+    "--max-autopilot-continues",
+    "20",
+    "-s",
+    "--stream",
+    "on",
+    "--output-format",
+    "json",
+    // Without this flag, real captured sessions on this machine show every
+    // assistant.message carrying only an opaque, non-decodable `reasoningOpaque`
+    // blob — never `reasoningText` — so parsers/copilot.ts's onThinking() never
+    // fires and the thinking stream never reaches the UI. `--enable-reasoning-summaries`
+    // is documented in `copilot --help` as exactly this: "Request reasoning
+    // summaries for OpenAI models." Always on — it's additive (models/providers
+    // that don't support summaries are unaffected) and this is the "start in
+    // thinking mode by default" behavior other providers already give equivalent
+    // visibility into.
+    "--enable-reasoning-summaries"
+  ];
+  if (shouldUseReadOnlyRuntimePermissions(context.config)) {
+    args.push("--deny-tool", "write");
+  }
+  if (context.config.selectedModel?.trim()) {
+    args.push("--model", context.config.selectedModel.trim());
+  }
+  const effort = context.config.selectedEffortLevel?.trim().toLowerCase();
+  if (effort && isEffortLevel(effort)) {
+    args.push("--effort", effort);
+  }
+  args.push("-p", prompt);
+  return [...args, ...defaultArgs];
+}
 function createCopilotCliBackend(command = "copilot", defaultArgs = []) {
   return {
     kind: "copilot_cli",
@@ -14919,25 +15547,7 @@ function createCopilotCliBackend(command = "copilot", defaultArgs = []) {
           supportTier: "structured",
           command,
           args: [],
-          buildArgs: (ctx, prompt) => {
-            const args = [
-              "--autopilot",
-              "--yolo",
-              "--max-autopilot-continues",
-              "20",
-              "-s",
-              "--stream",
-              "on",
-              "--output-format",
-              "json",
-              "-p",
-              prompt
-            ];
-            if (ctx.config.selectedModel?.trim()) {
-              args.push("--model", ctx.config.selectedModel.trim());
-            }
-            return [...args, ...defaultArgs];
-          },
+          buildArgs: (ctx, prompt) => buildCopilotCliArgs(ctx, prompt, defaultArgs),
           augmentPrompt: (ctx) => buildPromptWithImagePathReferences(ctx, imageFiles),
           parseStructuredLine: parseCopilotStructuredLine,
           // Local background Agent/detached work uses the shared result gate; keep
@@ -18194,7 +18804,7 @@ function extractPathCandidates(content, options, extensionsPattern = "png|jpe?g|
     ...options.pathHints ?? []
   ];
 }
-function normalizePath(candidate, cwd) {
+function normalizePath2(candidate, cwd) {
   let path = candidate.trim().replace(/^file:\/\//, "");
   try {
     path = decodeURI(path);
@@ -18217,7 +18827,7 @@ function extractBrowserMediaPathHints(content, cwd, toolName, options = {}, kind
   return extractPathCandidatesFromValues(
     collectContentStrings(content, options.toolInput),
     extensionsPattern
-  ).map((candidate) => normalizePath(candidate, effectiveCwd)).filter((path) => Boolean(path));
+  ).map((candidate) => normalizePath2(candidate, effectiveCwd)).filter((path) => Boolean(path));
 }
 function readImageDimensions2(buffer, mimeType) {
   if (mimeType === "image/png" && buffer.length >= 24 && buffer.toString("ascii", 1, 4) === "PNG") {
@@ -18250,7 +18860,7 @@ function extractGeneratedImagesFromToolResult(toolId, content, cwd, toolName, op
   const seen = /* @__PURE__ */ new Set();
   const effectiveCwd = resolveToolCwd(cwd, options.toolInput);
   for (const candidate of extractPathCandidates(content, options)) {
-    const path = normalizePath(candidate, effectiveCwd);
+    const path = normalizePath2(candidate, effectiveCwd);
     if (!path || seen.has(path) || !(0, import_fs9.existsSync)(path)) continue;
     seen.add(path);
     const ext = (0, import_path9.extname)(path).toLowerCase();
@@ -18289,7 +18899,7 @@ function extractSessionMediaFromToolResult(toolId, content, cwd, toolName, optio
   const maxBytes = kind === "video" ? MAX_SESSION_VIDEO_BYTES : MAX_GENERATED_IMAGE_BYTES;
   const mimeByExt = kind === "video" ? VIDEO_MIME_BY_EXT : IMAGE_MIME_BY_EXT;
   for (const candidate of extractPathCandidates(content, options, extensionsPattern)) {
-    const path = normalizePath(candidate, effectiveCwd);
+    const path = normalizePath2(candidate, effectiveCwd);
     if (!path || seen.has(path) || !(0, import_fs9.existsSync)(path)) continue;
     seen.add(path);
     const ext = (0, import_path9.extname)(path).toLowerCase();
@@ -18399,18 +19009,18 @@ ${output.stderr}`;
 }
 
 // ../shared/dist/node/local-workspace.js
-var import_node_fs = require("fs");
-var import_node_os = require("os");
-var import_node_path = require("path");
-function resolveAlanDefaultWorkspacePath(homeDirectory = (0, import_node_os.homedir)()) {
-  return (0, import_node_path.join)(homeDirectory, ".alan", "workspace");
-}
-
-// ../shared/dist/node/provider-limits.js
-var import_node_child_process = require("child_process");
 var import_node_fs2 = require("fs");
 var import_node_os2 = require("os");
 var import_node_path2 = require("path");
+function resolveAlanDefaultWorkspacePath(homeDirectory = (0, import_node_os2.homedir)()) {
+  return (0, import_node_path2.join)(homeDirectory, ".alan", "workspace");
+}
+
+// ../shared/dist/node/provider-limits.js
+var import_node_child_process2 = require("child_process");
+var import_node_fs3 = require("fs");
+var import_node_os3 = require("os");
+var import_node_path3 = require("path");
 var CACHE_TTL_MS = 6e4;
 var cachedLimits = null;
 function numericValue(value2) {
@@ -18421,42 +19031,42 @@ function numericValue(value2) {
   }
   return null;
 }
-function splitPath(value2) {
-  return (value2 ?? "").split(import_node_path2.delimiter).filter(Boolean);
+function splitPath2(value2) {
+  return (value2 ?? "").split(import_node_path3.delimiter).filter(Boolean);
 }
 function isExecutableFile(path) {
   try {
-    (0, import_node_fs2.accessSync)(path, import_node_fs2.constants.X_OK);
+    (0, import_node_fs3.accessSync)(path, import_node_fs3.constants.X_OK);
     return true;
   } catch {
     return false;
   }
 }
-function augmentCliPath(env) {
-  const home = env.HOME || (0, import_node_os2.homedir)();
+function augmentCliPath2(env) {
+  const home = env.HOME || (0, import_node_os3.homedir)();
   const extraPaths = [
-    (0, import_node_path2.join)(home, ".local", "bin"),
-    (0, import_node_path2.join)(home, ".local", "node", "bin"),
-    (0, import_node_path2.join)(home, ".bun", "bin"),
-    (0, import_node_path2.join)(home, ".cargo", "bin"),
+    (0, import_node_path3.join)(home, ".local", "bin"),
+    (0, import_node_path3.join)(home, ".local", "node", "bin"),
+    (0, import_node_path3.join)(home, ".bun", "bin"),
+    (0, import_node_path3.join)(home, ".cargo", "bin"),
     "/opt/homebrew/bin",
     "/usr/local/bin"
   ];
-  const existing = new Set(splitPath(env.PATH));
+  const existing = new Set(splitPath2(env.PATH));
   const missing = extraPaths.filter((path) => !existing.has(path));
   if (missing.length === 0)
     return env;
   return {
     ...env,
-    PATH: `${missing.join(import_node_path2.delimiter)}${import_node_path2.delimiter}${env.PATH ?? ""}`
+    PATH: `${missing.join(import_node_path3.delimiter)}${import_node_path3.delimiter}${env.PATH ?? ""}`
   };
 }
 function resolveExecutable(command, env, overrideEnvVar) {
   const override = env[overrideEnvVar]?.trim();
   if (override && isExecutableFile(override))
     return override;
-  for (const dir of splitPath(env.PATH)) {
-    const candidate = (0, import_node_path2.join)(dir, command);
+  for (const dir of splitPath2(env.PATH)) {
+    const candidate = (0, import_node_path3.join)(dir, command);
     if (isExecutableFile(candidate))
       return candidate;
   }
@@ -18528,12 +19138,12 @@ async function withTimeout(promise, timeoutMs, fallback) {
   }
 }
 async function collectCodexLimits(env) {
-  const runtimeEnv = augmentCliPath(env);
+  const runtimeEnv = augmentCliPath2(env);
   const codexCommand = resolveExecutable("codex", runtimeEnv, "ALAN_CODEX_PATH");
   if (!codexCommand)
     return [];
   return withTimeout(new Promise((resolve6) => {
-    const child = (0, import_node_child_process.spawn)(codexCommand, ["-s", "read-only", "-a", "untrusted", "app-server"], {
+    const child = (0, import_node_child_process2.spawn)(codexCommand, ["-s", "read-only", "-a", "untrusted", "app-server"], {
       env: runtimeEnv,
       stdio: ["pipe", "pipe", "ignore"]
     });
@@ -18600,10 +19210,10 @@ async function collectCodexLimits(env) {
   }), 4e3, []);
 }
 function readClaudeCredentialsPayload() {
-  const path = (0, import_node_path2.join)((0, import_node_os2.homedir)(), ".claude", ".credentials.json");
-  if ((0, import_node_fs2.existsSync)(path)) {
+  const path = (0, import_node_path3.join)((0, import_node_os3.homedir)(), ".claude", ".credentials.json");
+  if ((0, import_node_fs3.existsSync)(path)) {
     try {
-      return JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
+      return JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
     } catch {
       return null;
     }
@@ -18611,7 +19221,7 @@ function readClaudeCredentialsPayload() {
   if (process.platform !== "darwin")
     return null;
   try {
-    const raw = (0, import_node_child_process.execFileSync)("security", ["find-generic-password", "-s", "Claude Code-credentials", "-w"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const raw = (0, import_node_child_process2.execFileSync)("security", ["find-generic-password", "-s", "Claude Code-credentials", "-w"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     if (!raw)
       return null;
     return JSON.parse(raw);
@@ -20310,11 +20920,11 @@ var SocketWithoutUpgrade = class _SocketWithoutUpgrade extends Emitter {
    */
   _resetPingTimeout() {
     this.clearTimeoutFn(this._pingTimeoutTimer);
-    const delay = this._pingInterval + this._pingTimeout;
-    this._pingTimeoutTime = Date.now() + delay;
+    const delay2 = this._pingInterval + this._pingTimeout;
+    this._pingTimeoutTime = Date.now() + delay2;
     this._pingTimeoutTimer = this.setTimeoutFn(() => {
       this._onClose("ping timeout");
-    }, delay);
+    }, delay2);
     if (this.opts.autoUnref) {
       this._pingTimeoutTimer.unref();
     }
@@ -22295,8 +22905,8 @@ var Manager = class extends Emitter {
       this.emitReserved("reconnect_failed");
       this._reconnecting = false;
     } else {
-      const delay = this.backoff.duration();
-      debug10("will wait %dms before reconnect attempt", delay);
+      const delay2 = this.backoff.duration();
+      debug10("will wait %dms before reconnect attempt", delay2);
       this._reconnecting = true;
       const timer = this.setTimeoutFn(() => {
         if (self.skipReconnect)
@@ -22316,7 +22926,7 @@ var Manager = class extends Emitter {
             self.onreconnect();
           }
         });
-      }, delay);
+      }, delay2);
       if (this.opts.autoUnref) {
         timer.unref();
       }
@@ -22377,159 +22987,48 @@ Object.assign(lookup, {
   connect: lookup
 });
 
-// src/cli-executable.ts
-var import_node_child_process2 = require("child_process");
-var import_node_fs3 = require("fs");
-var import_node_os3 = require("os");
-var import_node_path3 = require("path");
-var PROVIDER_CLI_COMMANDS = {
-  claude_cli: { provider: "claude_cli", command: "claude", envVars: ["ALAN_CLAUDE_PATH"] },
-  codex_app_server: {
-    provider: "codex_app_server",
-    command: "codex",
-    envVars: ["ALAN_CODEX_PATH"]
-  },
-  copilot_cli: { provider: "copilot_cli", command: "copilot", envVars: ["ALAN_COPILOT_PATH"] },
-  cursor_agent_cli: {
-    provider: "cursor_agent_cli",
-    command: "cursor-agent",
-    envVars: ["ALAN_CURSOR_AGENT_PATH"]
-  },
-  antigravity_cli: {
-    provider: "antigravity_cli",
-    command: "agy",
-    envVars: ["ALAN_ANTIGRAVITY_PATH"]
-  },
-  kimi_cli: { provider: "kimi_cli", command: "kimi-cli", envVars: ["ALAN_KIMI_PATH"] },
-  grok_cli: { provider: "grok_cli", command: "grok", envVars: ["ALAN_GROK_PATH"] },
-  opencode_cli: { provider: "opencode_cli", command: "opencode", envVars: ["ALAN_OPENCODE_PATH"] },
-  droid_cli: { provider: "droid_cli", command: "droid", envVars: ["ALAN_DROID_PATH"] },
-  supatest_cli: { provider: "supatest_cli", command: "supatest", envVars: ["ALAN_SUPATEST_PATH"] }
-};
-var DISCOVERABLE_PROVIDER_KINDS = Object.keys(PROVIDER_CLI_COMMANDS);
-var PROVIDER_ALIASES = {
-  agy: "antigravity_cli",
-  antigravity: "antigravity_cli",
-  antigravity_cli: "antigravity_cli",
-  codex: "codex_app_server",
-  gemini: "antigravity_cli",
-  gemini_cli: "antigravity_cli"
-};
-var BACKEND_CLI_COMMANDS = {
-  claude_cli: "claude",
-  codex: "codex",
-  codex_app_server: "codex",
-  copilot_cli: "copilot",
-  cursor_agent_cli: "cursor-agent",
-  agy: "agy",
-  antigravity: "agy",
-  antigravity_cli: "agy",
-  gemini_cli: "agy",
-  gemini: "agy",
-  kimi_cli: "kimi-cli",
-  grok_cli: "grok",
-  opencode_cli: "opencode",
-  droid_cli: "droid",
-  supatest_cli: "supatest"
-};
-var CLI_COMMAND_ALIASES = {
-  "kimi-cli": ["kimi"],
-  grok: ["grok-build"]
+// src/cli-ensure-install.ts
+var import_node_child_process3 = require("child_process");
+var import_node_os4 = require("os");
+var CLI_RUNTIME_VERSIONS_ENV = "ALAN_CLI_RUNTIME_VERSIONS";
+var INSTALLABLE_PROVIDER_PACKAGES = {
+  claude_cli: { npmPackage: "@anthropic-ai/claude-code", command: "claude", label: "Claude Code" },
+  codex_app_server: { npmPackage: "@openai/codex", command: "codex", label: "Codex" },
+  copilot_cli: { npmPackage: "@github/copilot", command: "copilot", label: "Copilot" },
+  opencode_cli: { npmPackage: "opencode-ai", command: "opencode", label: "opencode" }
 };
-var resolvedCliCache = /* @__PURE__ */ new Map();
-var cachedLoginShellEnv = null;
-function parseEnvOutput(output) {
-  const loginEnv = {};
-  for (const line of output.split("\n")) {
-    if (!line.trim()) continue;
-    const eqIdx = line.indexOf("=");
-    if (eqIdx <= 0) continue;
-    const key = line.slice(0, eqIdx);
-    if (/\s/.test(key)) continue;
-    loginEnv[key] = line.slice(eqIdx + 1);
-  }
-  if (!loginEnv.HOME) loginEnv.HOME = process.env.HOME ?? (0, import_node_os3.homedir)();
-  if (!loginEnv.SHELL) loginEnv.SHELL = process.env.SHELL ?? "/bin/zsh";
-  return loginEnv;
-}
-function loadLoginShellEnvironment() {
-  if (cachedLoginShellEnv) return cachedLoginShellEnv;
-  if ((0, import_node_os3.platform)() === "win32") {
-    cachedLoginShellEnv = process.env;
-    return cachedLoginShellEnv;
-  }
-  try {
-    const shell = (process.env.SHELL || "/bin/bash").replace(/'/g, "'\\''");
-    const envOutput = (0, import_node_child_process2.execSync)(`'${shell}' -ilc 'env'`, {
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"],
-      timeout: 5e3
-    });
-    cachedLoginShellEnv = parseEnvOutput(envOutput);
-  } catch {
-    cachedLoginShellEnv = process.env;
-  }
-  return cachedLoginShellEnv;
-}
-function getDaemonCliEnvironment() {
-  const base = (0, import_node_os3.platform)() === "win32" ? process.env : loadLoginShellEnvironment();
-  return augmentCliPath2(base);
-}
-function cacheResolvedCli(command, resolvedPath) {
-  resolvedCliCache.set(command, resolvedPath);
-}
-function getCachedResolvedCli(command) {
-  return resolvedCliCache.get(command);
-}
-function resolveViaWhere(command, env) {
-  if ((0, import_node_os3.platform)() !== "win32") return null;
-  const whereExe = (0, import_node_path3.join)(
-    env.SystemRoot ?? process.env.SystemRoot ?? "C:\\Windows",
-    "System32",
-    "where.exe"
-  );
-  if (!(0, import_node_fs3.existsSync)(whereExe)) return null;
-  const result = (0, import_node_child_process2.spawnSync)(whereExe, [command], {
-    encoding: "utf8",
-    env,
-    windowsHide: true,
-    timeout: 3e3
-  });
-  if (result.error || result.status !== 0) return null;
-  for (const line of result.stdout.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    if (isRunnableFile(trimmed)) return trimmed;
-  }
-  return null;
-}
-function runCliProbeAsync(executable, env, args = ["--version"], timeoutMs = 3e3, spawnOptions) {
-  return new Promise((resolve6) => {
-    const isWin = (0, import_node_os3.platform)() === "win32";
-    let command = executable;
-    let commandArgs = args;
-    if (isWin && /\.(cmd|bat)$/i.test(executable)) {
-      command = env.ComSpec ?? process.env.ComSpec ?? "cmd.exe";
-      commandArgs = ["/d", "/s", "/c", executable, ...args];
-    }
-    const useShell = isWin && command === executable && !/[\\/]/.test(executable);
-    const closeStdin = spawnOptions?.closeStdin === true;
+var INSTALL_TIMEOUT_MS = 12e4;
+var installOutcomes = /* @__PURE__ */ new Map();
+function canInstallProviderCli(backendKind) {
+  return Boolean(backendKind && INSTALLABLE_PROVIDER_PACKAGES[backendKind]);
+}
+function pinnedVersion(npmPackage) {
+  const raw = process.env[CLI_RUNTIME_VERSIONS_ENV];
+  if (!raw) return "latest";
+  try {
+    const parsed = JSON.parse(raw);
+    const version = parsed[npmPackage];
+    if (typeof version === "string" && version.trim()) return version.trim();
+  } catch {
+  }
+  return "latest";
+}
+function runNpmInstall(installSpec, env, timeoutMs) {
+  return new Promise((resolve6) => {
+    const isWin = (0, import_node_os4.platform)() === "win32";
     let child;
     try {
-      child = (0, import_node_child_process2.spawn)(command, commandArgs, {
+      child = (0, import_node_child_process3.spawn)("npm", ["install", "-g", installSpec], {
         env,
-        shell: useShell,
+        shell: isWin,
         windowsHide: isWin ? true : void 0,
         timeout: timeoutMs,
-        stdio: closeStdin ? ["pipe", "pipe", "pipe"] : void 0
+        stdio: ["ignore", "pipe", "pipe"]
       });
     } catch (error) {
       resolve6({ status: null, stdout: "", stderr: "", error });
       return;
     }
-    if (closeStdin) {
-      child.stdin?.end();
-    }
     let stdout = "";
     let stderr = "";
     child.stdout?.setEncoding("utf8").on("data", (chunk) => {
@@ -22541,159 +23040,48 @@ function runCliProbeAsync(executable, env, args = ["--version"], timeoutMs = 3e3
     child.once("error", (error) => resolve6({ status: null, stdout, stderr, error }));
     child.once(
       "close",
-      (status, signal) => resolve6({ status, stdout, stderr, signal: signal ?? null })
+      (status, signal) => resolve6({
+        status,
+        stdout,
+        stderr,
+        // Spawn `timeout` kills by signal without an `error` event; surface it
+        // so a timed-out install is reported as a failure, not status null + ok.
+        ...signal ? { error: new Error(`npm install killed by ${signal}`) } : {}
+      })
     );
   });
 }
-function runCliVersionProbeAsync(executable, env, args = ["--version"], timeoutMs = 3e3) {
-  return runCliProbeAsync(executable, env, args, timeoutMs);
-}
-function pathSeparator() {
-  return (0, import_node_os3.platform)() === "win32" ? ";" : ":";
-}
-function splitPath2(pathValue) {
-  if (!pathValue) return [];
-  return pathValue.split(pathSeparator()).filter(Boolean);
-}
-function isRunnableFile(path) {
-  if (!(0, import_node_fs3.existsSync)(path)) return false;
-  if ((0, import_node_os3.platform)() === "win32") return true;
-  try {
-    (0, import_node_fs3.accessSync)(path, import_node_fs3.constants.X_OK);
-    return true;
-  } catch {
+async function attemptInstall(spec, options) {
+  const installSpec = `${spec.npmPackage}@${pinnedVersion(spec.npmPackage)}`;
+  const notify = options?.notify ?? ((message) => console.info(`[cli-ensure-install] ${message}`));
+  notify(`Installing ${spec.label} CLI (${installSpec})\u2026`);
+  const runner = options?.runner ?? runNpmInstall;
+  const result = await runner(installSpec, getDaemonCliEnvironment(), INSTALL_TIMEOUT_MS);
+  if (result.error || result.status !== 0) {
+    console.warn(`[cli-ensure-install] npm install -g ${installSpec} failed`, {
+      status: result.status,
+      error: result.error?.message,
+      output: `${result.stderr || result.stdout}`.trim().slice(-500)
+    });
+    notify(`Failed to install ${spec.label} CLI (${installSpec}).`);
     return false;
   }
+  invalidateResolvedCli(spec.command);
+  notify(`Installed ${spec.label} CLI (${installSpec}).`);
+  return true;
 }
-function windowsCommandCandidates(command, pathExt) {
-  const trimmed = command.trim();
-  if (!trimmed) return [];
-  const hasExtension = /\.[a-z0-9]+$/i.test(trimmed);
-  if (hasExtension) return [trimmed];
-  const extensions = pathExt.split(";").map((ext) => ext.trim()).filter(Boolean);
-  return [trimmed, ...extensions.map((ext) => `${trimmed}${ext}`)];
-}
-function augmentCliPath2(env) {
-  const home = env.HOME || env.USERPROFILE || (0, import_node_os3.homedir)();
-  const isWin = (0, import_node_os3.platform)() === "win32";
-  const extraPaths = isWin ? [
-    (0, import_node_path3.join)(home, "AppData", "Roaming", "npm"),
-    (0, import_node_path3.join)(home, "AppData", "Local", "Programs", "Microsoft", "WindowsApps"),
-    (0, import_node_path3.join)(home, ".local", "bin"),
-    "C:\\Program Files\\nodejs",
-    "C:\\Program Files\\Git\\cmd"
-  ] : [
-    (0, import_node_path3.join)(home, ".local", "bin"),
-    (0, import_node_path3.join)(home, ".local", "node", "bin"),
-    (0, import_node_path3.join)(home, ".bun", "bin"),
-    (0, import_node_path3.join)(home, ".cargo", "bin"),
-    "/opt/homebrew/bin",
-    "/usr/local/bin"
-  ];
-  const basePath = env.PATH ?? "";
-  const existing = new Set(splitPath2(basePath));
-  const missing = extraPaths.filter((dir) => !existing.has(dir));
-  if (missing.length === 0) return env;
-  return {
-    ...env,
-    PATH: missing.length > 0 ? `${missing.join(pathSeparator())}${pathSeparator()}${basePath}` : basePath
-  };
-}
-function resolveCliExecutable(command, env = getDaemonCliEnvironment()) {
-  const trimmed = command.trim();
-  if (!trimmed) return null;
-  const cached = resolvedCliCache.get(trimmed);
-  if (cached === null) return null;
-  if (cached && isRunnableFile(cached)) return cached;
-  if ((trimmed.includes("/") || trimmed.includes("\\")) && isRunnableFile(trimmed)) {
-    resolvedCliCache.set(trimmed, trimmed);
-    return trimmed;
-  }
-  const enriched = augmentCliPath2(env);
-  const home = enriched.HOME || enriched.USERPROFILE || (0, import_node_os3.homedir)();
-  const isWin = (0, import_node_os3.platform)() === "win32";
-  const pathExt = enriched.PATHEXT ?? (isWin ? ".EXE;.CMD;.BAT;.COM" : "");
-  const commandNames = [trimmed, ...CLI_COMMAND_ALIASES[trimmed] ?? []];
-  const names = commandNames.flatMap(
-    (name) => isWin ? windowsCommandCandidates(name, pathExt) : [name]
-  );
-  const candidates = [];
-  for (const name of names) {
-    if (name.includes("/") || name.includes("\\")) {
-      candidates.push(name);
-      continue;
-    }
-    for (const dir of splitPath2(enriched.PATH)) {
-      candidates.push((0, import_node_path3.join)(dir, name));
-    }
-    candidates.push((0, import_node_path3.join)(home, ".local", "bin", name), (0, import_node_path3.join)(home, ".local", "node", "bin", name));
-    if (!isWin) {
-      candidates.push((0, import_node_path3.join)("/opt/homebrew/bin", name), (0, import_node_path3.join)("/usr/local/bin", name));
-    } else {
-      candidates.push((0, import_node_path3.join)(home, "AppData", "Roaming", "npm", name));
-    }
-  }
-  const seen = /* @__PURE__ */ new Set();
-  for (const candidate of candidates) {
-    if (seen.has(candidate)) continue;
-    seen.add(candidate);
-    if (isRunnableFile(candidate)) {
-      resolvedCliCache.set(trimmed, candidate);
-      return candidate;
-    }
-  }
-  const viaWhere = resolveViaWhere(trimmed, enriched);
-  if (viaWhere) {
-    resolvedCliCache.set(trimmed, viaWhere);
-    return viaWhere;
-  }
-  resolvedCliCache.set(trimmed, null);
-  return null;
-}
-function normalizeDiscoverableProvider(provider) {
-  const alias = PROVIDER_ALIASES[provider];
-  if (alias) return alias;
-  if (provider in PROVIDER_CLI_COMMANDS) {
-    return provider;
-  }
-  return null;
-}
-function resolveProviderCliCommand(provider, env = getDaemonCliEnvironment()) {
-  const normalized = normalizeDiscoverableProvider(provider);
-  if (!normalized) return null;
-  const spec = PROVIDER_CLI_COMMANDS[normalized];
-  const override = spec.envVars.map((name) => process.env[name]?.trim() || env[name]?.trim()).find(Boolean);
-  if (override) {
-    const resolved2 = resolveCliExecutable(override, env) ?? (isRunnableFile(override) ? override : null);
-    if (resolved2) cacheResolvedCli(spec.command, resolved2);
-    return resolved2;
-  }
-  const resolved = resolveCliExecutable(spec.command, env);
-  if (resolved) cacheResolvedCli(spec.command, resolved);
-  return resolved;
-}
-function resolveBackendRuntimeCommand(backendKind, env = getDaemonCliEnvironment()) {
-  if (!backendKind) return void 0;
-  const command = BACKEND_CLI_COMMANDS[backendKind];
-  if (!command) return void 0;
-  const cached = getCachedResolvedCli(command);
-  if (cached === null) return void 0;
-  if (cached && isRunnableFile(cached)) return cached;
-  const spec = Object.values(PROVIDER_CLI_COMMANDS).find((entry) => entry.command === command);
-  const envOverride = spec ? spec.envVars.map((name) => env[name]?.trim()).find(Boolean) : void 0;
-  const resolved = resolveCliExecutable(envOverride?.trim() || command, env);
-  cacheResolvedCli(command, resolved);
-  return resolved ?? void 0;
-}
-function revalidateBackendRuntimeCommand(backendKind, env = getDaemonCliEnvironment()) {
-  if (!backendKind) return void 0;
-  const command = BACKEND_CLI_COMMANDS[backendKind];
-  if (!command) return void 0;
-  resolvedCliCache.delete(command);
-  const spec = Object.values(PROVIDER_CLI_COMMANDS).find((entry) => entry.command === command);
-  const envOverride = spec ? spec.envVars.map((name) => env[name]?.trim()).find(Boolean) : void 0;
-  if (envOverride) resolvedCliCache.delete(envOverride);
-  return resolveBackendRuntimeCommand(backendKind, env);
+function ensureProviderCliInstalled(backendKind, options) {
+  if (!backendKind) return Promise.resolve(false);
+  const spec = INSTALLABLE_PROVIDER_PACKAGES[backendKind];
+  if (!spec) return Promise.resolve(false);
+  const existing = installOutcomes.get(spec.npmPackage);
+  if (existing) return existing;
+  const attempt = attemptInstall(spec, options).catch((error) => {
+    console.warn(`[cli-ensure-install] install attempt for ${spec.npmPackage} threw`, error);
+    return false;
+  });
+  installOutcomes.set(spec.npmPackage, attempt);
+  return attempt;
 }
 
 // src/computer-readiness.ts
@@ -22701,10 +23089,10 @@ var import_node_fs5 = require("fs");
 
 // src/runtime-config.ts
 var import_node_fs4 = require("fs");
-var import_node_os4 = require("os");
+var import_node_os5 = require("os");
 var import_node_path4 = require("path");
-var DEFAULT_AGENT_DIR = (0, import_node_path4.join)((0, import_node_os4.homedir)(), ".alan", "agent");
-var LEGACY_AGENT_DIR = (0, import_node_path4.join)((0, import_node_os4.homedir)(), ".aiden", "agent");
+var DEFAULT_AGENT_DIR = (0, import_node_path4.join)((0, import_node_os5.homedir)(), ".alan", "agent");
+var LEGACY_AGENT_DIR = (0, import_node_path4.join)((0, import_node_os5.homedir)(), ".aiden", "agent");
 var AGENT_CONFIG_KEYS = /* @__PURE__ */ new Map([
   ["apiUrl", "string"],
   ["wsUrl", "string"],
@@ -23012,7 +23400,7 @@ function buildComputerReadiness(input) {
 }
 
 // src/core-agent.ts
-var import_node_os5 = require("os");
+var import_node_os6 = require("os");
 var CoreAgent = class _CoreAgent extends BaseMachineAgent {
   childProcess = null;
   _aborted = false;
@@ -23064,7 +23452,18 @@ var CoreAgent = class _CoreAgent extends BaseMachineAgent {
    * and re-resolving once lets the current run recover against the new location.
    */
   revalidateRuntimeCommand() {
-    return revalidateBackendRuntimeCommand(this.runtime.backendKind) ?? null;
+    const resolved = revalidateBackendRuntimeCommand(this.runtime.backendKind) ?? null;
+    if (!resolved && this.runtime.backendKind) {
+      const backendKind = this.runtime.backendKind;
+      void ensureProviderCliInstalled(backendKind).then((installed) => {
+        if (installed) {
+          console.info("[CoreAgent] Installed missing provider CLI after spawn ENOENT", {
+            backendKind
+          });
+        }
+      });
+    }
+    return resolved;
   }
   // ── Interactive tool response (WS relay → stdin) ───────────────────────
   /**
@@ -23151,7 +23550,7 @@ var CoreAgent = class _CoreAgent extends BaseMachineAgent {
     if (this.runtime.backendKind === "grok_cli" && this.providerApiKey) {
       augmented.XAI_API_KEY = this.providerApiKey;
     }
-    if ((0, import_node_os5.platform)() !== "win32") {
+    if ((0, import_node_os6.platform)() !== "win32") {
       const home = augmented.HOME ?? "/home/user";
       const extraPaths = [`${home}/.local/node/bin`, `${home}/.local/bin`];
       const separator = ":";
@@ -23706,11 +24105,97 @@ var EncryptedEventOutbox = class _EncryptedEventOutbox {
   }
 };
 
-// src/mcp-registration.ts
-var import_node_crypto2 = require("crypto");
+// src/local-skill-scan.ts
 var import_node_fs7 = require("fs");
-var import_node_os6 = require("os");
 var import_node_path6 = require("path");
+var SKILL_READ_LIMIT_BYTES = 8192;
+var SKILL_CACHE_TTL_MS = 3e4;
+function readSkillHead(path) {
+  const fd = (0, import_node_fs7.openSync)(path, "r");
+  try {
+    const buffer = Buffer.alloc(SKILL_READ_LIMIT_BYTES);
+    const bytesRead = (0, import_node_fs7.readSync)(fd, buffer, 0, SKILL_READ_LIMIT_BYTES, 0);
+    return buffer.subarray(0, bytesRead).toString("utf-8");
+  } finally {
+    (0, import_node_fs7.closeSync)(fd);
+  }
+}
+function scanSkillDir(dirPath, source, repoRoot, entries, errors) {
+  if (!(0, import_node_fs7.existsSync)(dirPath)) return;
+  let names;
+  try {
+    names = (0, import_node_fs7.readdirSync)(dirPath);
+  } catch (error) {
+    errors.push(`Failed to scan ${dirPath}: ${error instanceof Error ? error.message : error}`);
+    return;
+  }
+  for (const name of names) {
+    const skillPath = (0, import_node_path6.join)(dirPath, name, "SKILL.md");
+    let isDirectory = false;
+    try {
+      isDirectory = (0, import_node_fs7.statSync)((0, import_node_path6.join)(dirPath, name)).isDirectory();
+    } catch {
+      continue;
+    }
+    if (!isDirectory || !(0, import_node_fs7.existsSync)(skillPath)) continue;
+    try {
+      entries.push({ content: readSkillHead(skillPath), source, sourcePath: skillPath, repoRoot });
+    } catch (error) {
+      errors.push(`Failed to read ${skillPath}: ${error instanceof Error ? error.message : error}`);
+    }
+  }
+}
+function discoverChildRepos(parentPath) {
+  let names;
+  try {
+    names = (0, import_node_fs7.readdirSync)(parentPath);
+  } catch {
+    return [];
+  }
+  const children = [];
+  for (const name of names) {
+    if (name.startsWith(".")) continue;
+    const childPath = (0, import_node_path6.join)(parentPath, name);
+    try {
+      if ((0, import_node_fs7.statSync)(childPath).isDirectory()) children.push(childPath);
+    } catch {
+    }
+  }
+  return children;
+}
+function scanLocalSkills(homeDir, projectPath) {
+  const rawEntries = [];
+  const errors = [];
+  for (const root of SKILL_DIRECTORY_ROOTS) {
+    scanSkillDir((0, import_node_path6.join)(homeDir, root), "global", void 0, rawEntries, errors);
+  }
+  if (projectPath) {
+    for (const dir of [projectPath, ...discoverChildRepos(projectPath)]) {
+      for (const root of SKILL_DIRECTORY_ROOTS) {
+        scanSkillDir((0, import_node_path6.join)(dir, root), "team", dir, rawEntries, errors);
+      }
+    }
+  }
+  return { skills: normalizeSkillEntries(rawEntries, "team"), errors };
+}
+var skillScanCache = /* @__PURE__ */ new Map();
+function scanLocalSkillsCached(homeDir, projectPath, options) {
+  const key = projectPath ?? "";
+  const now = Date.now();
+  if (!options?.refresh) {
+    const cached = skillScanCache.get(key);
+    if (cached && cached.expiresAt > now) return cached.result;
+  }
+  const result = scanLocalSkills(homeDir, projectPath);
+  skillScanCache.set(key, { expiresAt: now + SKILL_CACHE_TTL_MS, result });
+  return result;
+}
+
+// src/mcp-registration.ts
+var import_node_crypto2 = require("crypto");
+var import_node_fs8 = require("fs");
+var import_node_os7 = require("os");
+var import_node_path7 = require("path");
 
 // ../../node_modules/smol-toml/dist/error.js
 function getLineColFromPtr(string, ptr) {
@@ -24507,18 +24992,18 @@ var inspectAlanMcpThroughProviderCli = async (backendKind, expectedUrl, home) =>
   return result;
 };
 async function waitForConfigLock(lockPath) {
-  (0, import_node_fs7.mkdirSync)((0, import_node_path6.dirname)(lockPath), { recursive: true });
+  (0, import_node_fs8.mkdirSync)((0, import_node_path7.dirname)(lockPath), { recursive: true });
   const startedAt = Date.now();
   while (true) {
     try {
-      (0, import_node_fs7.mkdirSync)(lockPath);
-      return () => (0, import_node_fs7.rmSync)(lockPath, { recursive: true, force: true });
+      (0, import_node_fs8.mkdirSync)(lockPath);
+      return () => (0, import_node_fs8.rmSync)(lockPath, { recursive: true, force: true });
     } catch (error) {
       const code = error && typeof error === "object" && "code" in error ? error.code : void 0;
       if (code !== "EEXIST") throw error;
       try {
-        if (Date.now() - (0, import_node_fs7.statSync)(lockPath).mtimeMs > CONFIG_LOCK_STALE_MS) {
-          (0, import_node_fs7.rmSync)(lockPath, { recursive: true, force: true });
+        if (Date.now() - (0, import_node_fs8.statSync)(lockPath).mtimeMs > CONFIG_LOCK_STALE_MS) {
+          (0, import_node_fs8.rmSync)(lockPath, { recursive: true, force: true });
           continue;
         }
       } catch {
@@ -24534,7 +25019,7 @@ async function waitForConfigLock(lockPath) {
 function saveMalformedBackup(path, content) {
   const hash = (0, import_node_crypto2.createHash)("sha256").update(content).digest("hex").slice(0, 12);
   const backupPath = `${path}.alan-backup-${hash}`;
-  if (!(0, import_node_fs7.existsSync)(backupPath)) (0, import_node_fs7.copyFileSync)(path, backupPath);
+  if (!(0, import_node_fs8.existsSync)(backupPath)) (0, import_node_fs8.copyFileSync)(path, backupPath);
   return backupPath;
 }
 function parseJsonObject2(path, content) {
@@ -24581,22 +25066,22 @@ function mergeCodexAlanSection(path, existingContent, desiredContent) {
 function atomicWriteManagedConfig(path, content) {
   const pendingPath = `${path}.alan-pending-${process.pid}-${(0, import_node_crypto2.randomBytes)(6).toString("hex")}`;
   try {
-    (0, import_node_fs7.writeFileSync)(pendingPath, content, { encoding: "utf8", mode: 384, flag: "wx" });
-    (0, import_node_fs7.renameSync)(pendingPath, path);
+    (0, import_node_fs8.writeFileSync)(pendingPath, content, { encoding: "utf8", mode: 384, flag: "wx" });
+    (0, import_node_fs8.renameSync)(pendingPath, path);
   } finally {
-    (0, import_node_fs7.rmSync)(pendingPath, { force: true });
+    (0, import_node_fs8.rmSync)(pendingPath, { force: true });
   }
 }
-async function ensureAlanMcpRegistered(backendKind, registration, home = (0, import_node_os6.homedir)(), inspectCli = inspectAlanMcpThroughProviderCli) {
+async function ensureAlanMcpRegistered(backendKind, registration, home = (0, import_node_os7.homedir)(), inspectCli = inspectAlanMcpThroughProviderCli) {
   try {
     const mcpServers = buildAlanMcpServers(registration);
     const files = alanMcpConfigFilesForBackend(backendKind, mcpServers, home);
     const paths = [];
     for (const file of files) {
-      (0, import_node_fs7.mkdirSync)((0, import_node_path6.dirname)(file.path), { recursive: true });
+      (0, import_node_fs8.mkdirSync)((0, import_node_path7.dirname)(file.path), { recursive: true });
       const releaseLock = await waitForConfigLock(`${file.path}.alan-lock`);
       try {
-        const current = (0, import_node_fs7.existsSync)(file.path) ? (0, import_node_fs7.readFileSync)(file.path, "utf8") : null;
+        const current = (0, import_node_fs8.existsSync)(file.path) ? (0, import_node_fs8.readFileSync)(file.path, "utf8") : null;
         const content = file.path.endsWith(".toml") ? mergeCodexAlanSection(file.path, current, file.content) : mergeJsonConfig(file.path, current, file.content);
         if (current !== content) atomicWriteManagedConfig(file.path, content);
         paths.push(file.path);
@@ -24647,13 +25132,13 @@ async function ensureAlanMcpRegistered(backendKind, registration, home = (0, imp
     return { ok: false, paths: [], error: err instanceof Error ? err.message : String(err) };
   }
 }
-async function verifyAlanMcpRegistered(backendKind, home = (0, import_node_os6.homedir)(), inspectCli = inspectAlanMcpThroughProviderCli) {
+async function verifyAlanMcpRegistered(backendKind, home = (0, import_node_os7.homedir)(), inspectCli = inspectAlanMcpThroughProviderCli) {
   const files = alanMcpConfigFilesForBackend(backendKind, {}, home);
-  const missing = files.map((f) => f.path).filter((p) => !(0, import_node_fs7.existsSync)(p));
+  const missing = files.map((f) => f.path).filter((p) => !(0, import_node_fs8.existsSync)(p));
   const presentEntries = files.map((file) => ({
     path: file.path,
-    url: (0, import_node_fs7.existsSync)(file.path) ? readUsableAlanMcpUrl(file.path) : null
-  })).filter((entry) => (0, import_node_fs7.existsSync)(entry.path));
+    url: (0, import_node_fs8.existsSync)(file.path) ? readUsableAlanMcpUrl(file.path) : null
+  })).filter((entry) => (0, import_node_fs8.existsSync)(entry.path));
   let invalid = presentEntries.filter((entry) => !entry.url).map((entry) => entry.path);
   const urls = new Set(presentEntries.flatMap((entry) => entry.url ? [entry.url] : []));
   if (urls.size > 1) invalid = presentEntries.map((entry) => entry.path);
@@ -24709,15 +25194,15 @@ function removeAlanFromJsonConfig(path, existingContent) {
   }
   return JSON.stringify(config);
 }
-async function unregisterAlanMcp(backendKind, home = (0, import_node_os6.homedir)()) {
+async function unregisterAlanMcp(backendKind, home = (0, import_node_os7.homedir)()) {
   const removedPaths = [];
   const errors = [];
   const files = alanMcpConfigFilesForBackend(backendKind, {}, home);
   for (const file of files) {
-    if (!(0, import_node_fs7.existsSync)(file.path)) continue;
+    if (!(0, import_node_fs8.existsSync)(file.path)) continue;
     const releaseLock = await waitForConfigLock(`${file.path}.alan-lock`);
     try {
-      const current = (0, import_node_fs7.readFileSync)(file.path, "utf8");
+      const current = (0, import_node_fs8.readFileSync)(file.path, "utf8");
       let next;
       if (file.path.endsWith(".toml")) {
         const stripped = stripCodexAlanMcpSection(current);
@@ -24748,7 +25233,7 @@ function isHttpUrl(value2) {
   }
 }
 function readUsableAlanMcpUrl(path) {
-  const content = (0, import_node_fs7.readFileSync)(path, "utf8");
+  const content = (0, import_node_fs8.readFileSync)(path, "utf8");
   if (path.endsWith(".toml")) {
     const lines = content.split("\n");
     const start = lines.findIndex((line) => line.trim() === "[mcp_servers.alan]");
@@ -25039,7 +25524,7 @@ ${result.stderr}`.trim();
 }
 
 // src/provider-model-discovery.ts
-var import_node_fs8 = require("fs");
+var import_node_fs9 = require("fs");
 var MODEL_DISCOVERY_TIMEOUT_MS = 8e3;
 var ANTIGRAVITY_MODEL_DISCOVERY_TIMEOUT_MS = 12e3;
 var OPENCODE_ZEN_MODEL_IDS = OPENCODE_ZEN_MODELS.map((model) => model.id);
@@ -25253,7 +25738,7 @@ function filterClaudeDatedModelIds(ids) {
 }
 function resolveExecutableForModelScan(executable) {
   try {
-    return (0, import_node_fs8.realpathSync)(executable);
+    return (0, import_node_fs9.realpathSync)(executable);
   } catch {
     return executable;
   }
@@ -25261,7 +25746,7 @@ function resolveExecutableForModelScan(executable) {
 function extractClaudeModelIdsFromExecutable(executable) {
   try {
     const resolved = resolveExecutableForModelScan(executable);
-    const text = (0, import_node_fs8.readFileSync)(resolved).toString("latin1");
+    const text = (0, import_node_fs9.readFileSync)(resolved).toString("latin1");
     const matches = text.match(CLAUDE_MODEL_ID_PATTERN) ?? [];
     const unique = [
       ...new Set(matches.map((id) => id.trim()).filter((id) => isValidClaudeModelId(id))),
@@ -25361,7 +25846,7 @@ async function discoverGenericModels(executable, env) {
     ["models"]
   ]);
 }
-var CATALOG_ONLY_PROVIDERS = /* @__PURE__ */ new Set(["supatest_cli", "droid_cli"]);
+var CATALOG_ONLY_PROVIDERS = /* @__PURE__ */ new Set(["supatest_cli", "droid_cli", "copilot_cli"]);
 function supportsProviderModelDiscovery(provider) {
   return provider in CATALOG_MODEL_IDS_BY_PROVIDER;
 }
@@ -25380,7 +25865,7 @@ async function discoverProviderModels(provider, executable, env) {
     probed = await discoverCodexModels(executable, env);
   } else if (provider === "claude_cli") {
     probed = await discoverClaudeModels(executable, env);
-  } else if (provider === "kimi_cli" || provider === "grok_cli" || provider === "copilot_cli" || provider === "droid_cli") {
+  } else if (provider === "kimi_cli" || provider === "grok_cli") {
     probed = await discoverGenericModels(executable, env);
   }
   if (probed.length > 0) return probed;
@@ -25388,8 +25873,8 @@ async function discoverProviderModels(provider, executable, env) {
 }
 
 // src/run-journal.ts
-var import_node_fs9 = require("fs");
-var import_node_path7 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path8 = require("path");
 var JOURNAL_VERSION = 1;
 var INTERRUPTED_ENTRY_TTL_MS = 24 * 60 * 6e4;
 function isEntry(value2) {
@@ -25408,9 +25893,9 @@ function isEntry(value2) {
 var RuntimeRunJournal = class {
   constructor(path, nowMs = Date.now()) {
     this.path = path;
-    if (!(0, import_node_fs9.existsSync)(path)) return;
+    if (!(0, import_node_fs10.existsSync)(path)) return;
     try {
-      const parsed = JSON.parse((0, import_node_fs9.readFileSync)(path, "utf8"));
+      const parsed = JSON.parse((0, import_node_fs10.readFileSync)(path, "utf8"));
       if (parsed.version !== JOURNAL_VERSION || !Array.isArray(parsed.entries)) {
         throw new Error("unsupported run journal format");
       }
@@ -25533,18 +26018,18 @@ var RuntimeRunJournal = class {
   }
   persist() {
     const pendingPath = `${this.path}.pending`;
-    (0, import_node_fs9.mkdirSync)((0, import_node_path7.dirname)(this.path), { recursive: true });
+    (0, import_node_fs10.mkdirSync)((0, import_node_path8.dirname)(this.path), { recursive: true });
     try {
-      (0, import_node_fs9.writeFileSync)(
+      (0, import_node_fs10.writeFileSync)(
         pendingPath,
         `${JSON.stringify({ version: JOURNAL_VERSION, entries: [...this.entries.values()] })}
 `,
         { mode: 384 }
       );
-      (0, import_node_fs9.chmodSync)(pendingPath, 384);
-      (0, import_node_fs9.renameSync)(pendingPath, this.path);
+      (0, import_node_fs10.chmodSync)(pendingPath, 384);
+      (0, import_node_fs10.renameSync)(pendingPath, this.path);
     } catch (error) {
-      (0, import_node_fs9.rmSync)(pendingPath, { force: true });
+      (0, import_node_fs10.rmSync)(pendingPath, { force: true });
       throw error;
     }
   }
@@ -25571,17 +26056,17 @@ var RunStartGate = class {
 };
 
 // src/version.ts
-var AGENT_VERSION = "0.1.48";
+var AGENT_VERSION = "0.1.50";
 
 // src/workspace-relocation.ts
-var import_node_child_process3 = require("child_process");
-var import_node_fs10 = require("fs");
-var import_node_path8 = require("path");
+var import_node_child_process4 = require("child_process");
+var import_node_fs11 = require("fs");
+var import_node_path9 = require("path");
 var MAX_RELOCATION_CANDIDATES = 200;
 var DEFAULT_PROBE = {
-  childDirectories: (parentPath, limit) => (0, import_node_fs10.readdirSync)(parentPath, { withFileTypes: true }).filter((entry) => entry.isDirectory()).slice(0, limit).map((entry) => (0, import_node_path8.join)(parentPath, entry.name)),
+  childDirectories: (parentPath, limit) => (0, import_node_fs11.readdirSync)(parentPath, { withFileTypes: true }).filter((entry) => entry.isDirectory()).slice(0, limit).map((entry) => (0, import_node_path9.join)(parentPath, entry.name)),
   gitRemoteUrl: (candidatePath) => {
-    const result = (0, import_node_child_process3.spawnSync)("git", ["-C", candidatePath, "config", "--get", "remote.origin.url"], {
+    const result = (0, import_node_child_process4.spawnSync)("git", ["-C", candidatePath, "config", "--get", "remote.origin.url"], {
       encoding: "utf8",
       env: getDaemonCliEnvironment(),
       timeout: 2e3
@@ -25610,7 +26095,7 @@ function workspaceMatchesExpectedRepositories(input) {
     input.expectedRepoUrls.map(normalizeRepositoryIdentity).filter((identity2) => Boolean(identity2))
   );
   if (identities.size === 0) return false;
-  const remote = (input.probe ?? DEFAULT_PROBE).gitRemoteUrl((0, import_node_path8.resolve)(input.workspacePath));
+  const remote = (input.probe ?? DEFAULT_PROBE).gitRemoteUrl((0, import_node_path9.resolve)(input.workspacePath));
   const identity = remote ? normalizeRepositoryIdentity(remote) : null;
   return Boolean(identity && identities.has(identity));
 }
@@ -25620,8 +26105,8 @@ function discoverRelocatedWorkspace(input) {
   );
   if (identities.size === 0) return null;
   const searchRoots = [
-    (0, import_node_path8.dirname)((0, import_node_path8.resolve)(input.missingPath)),
-    ...(input.approvedWorkspacePaths ?? []).map((path) => (0, import_node_path8.dirname)((0, import_node_path8.resolve)(path)))
+    (0, import_node_path9.dirname)((0, import_node_path9.resolve)(input.missingPath)),
+    ...(input.approvedWorkspacePaths ?? []).map((path) => (0, import_node_path9.dirname)((0, import_node_path9.resolve)(path)))
   ].filter((path, index, paths) => paths.indexOf(path) === index);
   const candidates = [];
   for (const root of searchRoots) {
@@ -25633,19 +26118,19 @@ function discoverRelocatedWorkspace(input) {
     }
   }
   const matches = [];
-  for (const candidate of new Set(candidates.map((path) => (0, import_node_path8.resolve)(path)))) {
+  for (const candidate of new Set(candidates.map((path) => (0, import_node_path9.resolve)(path)))) {
     const remote = (input.probe ?? DEFAULT_PROBE).gitRemoteUrl(candidate);
     const identity = remote ? normalizeRepositoryIdentity(remote) : null;
-    if (identity && identities.has(identity)) matches.push((0, import_node_path8.resolve)(candidate));
+    if (identity && identities.has(identity)) matches.push((0, import_node_path9.resolve)(candidate));
     if (matches.length > 1) return null;
   }
   return matches[0] ?? null;
 }
 
 // src/workspace-run-lease.ts
-var import_node_child_process4 = require("child_process");
-var import_node_fs11 = require("fs");
-var import_node_path9 = require("path");
+var import_node_child_process5 = require("child_process");
+var import_node_fs12 = require("fs");
+var import_node_path10 = require("path");
 var WORKSPACE_LEASE_CHECK_INTERVAL_MS = 1e3;
 function parsePositiveMs(value2, fallback) {
   const parsed = value2 ? Number(value2) : Number.NaN;
@@ -25656,7 +26141,7 @@ var WORKSPACE_LEASE_GIT_TIMEOUT_MS = parsePositiveMs(
   2e3
 );
 function gitValue(cwd, args) {
-  const result = (0, import_node_child_process4.spawnSync)("git", ["-C", cwd, ...args], {
+  const result = (0, import_node_child_process5.spawnSync)("git", ["-C", cwd, ...args], {
     encoding: "utf8",
     env: getDaemonCliEnvironment(),
     timeout: WORKSPACE_LEASE_GIT_TIMEOUT_MS
@@ -25665,17 +26150,17 @@ function gitValue(cwd, args) {
   return result.stdout.trim() || null;
 }
 function filesystemIdentity(path) {
-  const canonicalPath = import_node_fs11.realpathSync.native(path);
-  const stat = (0, import_node_fs11.statSync)(canonicalPath);
+  const canonicalPath = import_node_fs12.realpathSync.native(path);
+  const stat = (0, import_node_fs12.statSync)(canonicalPath);
   return `${canonicalPath}:${stat.dev}:${stat.ino}`;
 }
 function resolveGitPath(workspacePath, value2) {
-  return (0, import_node_path9.isAbsolute)(value2) ? value2 : (0, import_node_path9.resolve)(workspacePath, value2);
+  return (0, import_node_path10.isAbsolute)(value2) ? value2 : (0, import_node_path10.resolve)(workspacePath, value2);
 }
 var DEFAULT_PROBE2 = {
   snapshot: (workspacePath) => {
     try {
-      const canonicalWorkspacePath = import_node_fs11.realpathSync.native((0, import_node_path9.resolve)(workspacePath));
+      const canonicalWorkspacePath = import_node_fs12.realpathSync.native((0, import_node_path10.resolve)(workspacePath));
       const repositoryRoot = gitValue(canonicalWorkspacePath, ["rev-parse", "--show-toplevel"]);
       const gitDirectory = gitValue(canonicalWorkspacePath, ["rev-parse", "--git-dir"]);
       const commonDirectory = gitValue(canonicalWorkspacePath, ["rev-parse", "--git-common-dir"]);
@@ -25684,7 +26169,7 @@ var DEFAULT_PROBE2 = {
       const remote = gitValue(canonicalWorkspacePath, ["config", "--get", "remote.origin.url"]);
       const remoteIdentity = remote ? normalizeRepositoryIdentity(remote) : null;
       return {
-        workspacePath: (0, import_node_path9.resolve)(workspacePath),
+        workspacePath: (0, import_node_path10.resolve)(workspacePath),
         workspaceIdentity: filesystemIdentity(canonicalWorkspacePath),
         repositoryIdentity: `${filesystemIdentity(
           resolveGitPath(canonicalWorkspacePath, commonDirectory)
@@ -25698,7 +26183,7 @@ var DEFAULT_PROBE2 = {
   },
   pathExists: (workspacePath) => {
     try {
-      return (0, import_node_fs11.existsSync)((0, import_node_path9.resolve)(workspacePath));
+      return (0, import_node_fs12.existsSync)((0, import_node_path10.resolve)(workspacePath));
     } catch {
       return true;
     }
@@ -25729,7 +26214,7 @@ var WorkspaceRunLease = class _WorkspaceRunLease {
   static capture(targets, probe = DEFAULT_PROBE2) {
     const captured = [];
     for (const target of targets) {
-      const normalizedTarget = { ...target, workspacePath: (0, import_node_path9.resolve)(target.workspacePath) };
+      const normalizedTarget = { ...target, workspacePath: (0, import_node_path10.resolve)(target.workspacePath) };
       const identity = probe.snapshot(normalizedTarget.workspacePath);
       if (!identity) return { lease: null, failure: unavailableFailure(normalizedTarget) };
       if (normalizedTarget.expectedBranch && identity.branch !== normalizedTarget.expectedBranch) {
@@ -25882,15 +26367,15 @@ function assertValidGitRef(ref, label) {
   if (!ref || ref.startsWith("-") || ref.includes("\0")) {
     throw new Error(`${label} is not a safe git ref`);
   }
-  const result = (0, import_node_child_process5.spawnSync)("git", ["check-ref-format", "--branch", ref], {
+  const result = (0, import_node_child_process6.spawnSync)("git", ["check-ref-format", "--branch", ref], {
     env: getDaemonCliEnvironment(),
     encoding: "utf8"
   });
   if (result.status !== 0) throw new Error(`${label} is not a valid git ref`);
 }
 function isPathContained(childPath, parentPath) {
-  const rel = (0, import_node_path10.relative)((0, import_node_path10.resolve)(parentPath), (0, import_node_path10.resolve)(childPath));
-  return rel === "" || !(0, import_node_path10.isAbsolute)(rel) && rel !== ".." && !rel.startsWith(`..${import_node_path10.sep}`);
+  const rel = (0, import_node_path11.relative)((0, import_node_path11.resolve)(parentPath), (0, import_node_path11.resolve)(childPath));
+  return rel === "" || !(0, import_node_path11.isAbsolute)(rel) && rel !== ".." && !rel.startsWith(`..${import_node_path11.sep}`);
 }
 function assertPathContained(childPath, parentPath, label) {
   if (!isPathContained(childPath, parentPath)) {
@@ -25898,7 +26383,7 @@ function assertPathContained(childPath, parentPath, label) {
   }
 }
 function git(cwd, args) {
-  const result = (0, import_node_child_process5.spawnSync)("git", args, {
+  const result = (0, import_node_child_process6.spawnSync)("git", args, {
     cwd,
     env: getDaemonCliEnvironment(),
     encoding: "utf8",
@@ -25917,14 +26402,14 @@ function gitSafe(cwd, args) {
   }
 }
 function worktreeDir(projectPath) {
-  const resolved = (0, import_node_path10.resolve)(projectPath);
-  return (0, import_node_path10.join)((0, import_node_path10.dirname)(resolved), `${(0, import_node_path10.basename)(resolved)}-alan-worktrees`);
+  const resolved = (0, import_node_path11.resolve)(projectPath);
+  return (0, import_node_path11.join)((0, import_node_path11.dirname)(resolved), `${(0, import_node_path11.basename)(resolved)}-alan-worktrees`);
 }
 function pathSegment(value2) {
   return value2.toLowerCase().replace(/^alan\//, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64) || "task";
 }
 function repoName(repoUrl, localPath) {
-  return repoUrl.replace(/\.git$/, "").split("/").pop() || (0, import_node_path10.basename)(localPath) || "repo";
+  return repoUrl.replace(/\.git$/, "").split("/").pop() || (0, import_node_path11.basename)(localPath) || "repo";
 }
 function findWorktreeByBranch(repoPath, branchName) {
   const output = gitSafe(repoPath, ["worktree", "list", "--porcelain"]);
@@ -25940,21 +26425,21 @@ function findWorktreeByBranch(repoPath, branchName) {
 function ensureGitWorktree(input) {
   assertValidGitRef(input.branchName, "branchName");
   assertValidGitRef(input.baseBranch, "baseBranch");
-  const repoPath = (0, import_node_path10.resolve)(input.repoPath);
+  const repoPath = (0, import_node_path11.resolve)(input.repoPath);
   const root = input.allowedRoot ?? worktreeDir(repoPath);
   const existingPath = findWorktreeByBranch(input.repoPath, input.branchName);
   if (existingPath) {
-    if ((0, import_node_path10.resolve)(existingPath) === repoPath) {
+    if ((0, import_node_path11.resolve)(existingPath) === repoPath) {
       throw new Error(`${input.branchName} is checked out in the shared checkout`);
     }
     return existingPath;
   }
   assertPathContained(input.worktreePath, root, "worktreePath");
-  (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(input.worktreePath), { recursive: true });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(input.worktreePath), { recursive: true });
   if (!gitSafe(input.repoPath, ["branch", "--list", input.branchName])) {
     git(input.repoPath, ["branch", input.branchName, input.baseBranch]);
   }
-  if ((0, import_node_fs12.existsSync)(input.worktreePath)) {
+  if ((0, import_node_fs13.existsSync)(input.worktreePath)) {
     if (gitSafe(input.worktreePath, ["branch", "--show-current"]) === input.branchName) {
       return input.worktreePath;
     }
@@ -25964,15 +26449,15 @@ function ensureGitWorktree(input) {
   return input.worktreePath;
 }
 function resolveProjectWorktreePaths(projectPath, gitRoot, gitWorktreePath) {
-  const resolvedProjectPath = (0, import_node_path10.resolve)(projectPath);
-  const resolvedGitRoot = (0, import_node_path10.resolve)(gitRoot);
-  const projectRelativePath = (0, import_node_path10.relative)(resolvedGitRoot, resolvedProjectPath);
-  if (projectRelativePath === ".." || projectRelativePath.startsWith(`..${import_node_path10.sep}`) || (0, import_node_path10.isAbsolute)(projectRelativePath)) {
+  const resolvedProjectPath = (0, import_node_path11.resolve)(projectPath);
+  const resolvedGitRoot = (0, import_node_path11.resolve)(gitRoot);
+  const projectRelativePath = (0, import_node_path11.relative)(resolvedGitRoot, resolvedProjectPath);
+  if (projectRelativePath === ".." || projectRelativePath.startsWith(`..${import_node_path11.sep}`) || (0, import_node_path11.isAbsolute)(projectRelativePath)) {
     throw new Error("The selected Project folder is outside its Git repository");
   }
   return {
     repoPath: resolvedGitRoot,
-    projectPath: projectRelativePath ? (0, import_node_path10.join)((0, import_node_path10.resolve)(gitWorktreePath), projectRelativePath) : (0, import_node_path10.resolve)(gitWorktreePath)
+    projectPath: projectRelativePath ? (0, import_node_path11.join)((0, import_node_path11.resolve)(gitWorktreePath), projectRelativePath) : (0, import_node_path11.resolve)(gitWorktreePath)
   };
 }
 function ensureWorktree(params) {
@@ -25984,7 +26469,7 @@ function ensureWorktree(params) {
     repoLocalPaths: Array.isArray(params.repoLocalPaths) ? params.repoLocalPaths : []
   };
   if (input.repoLocalPaths?.length) {
-    const taskRoot2 = (0, import_node_path10.join)(
+    const taskRoot2 = (0, import_node_path11.join)(
       worktreeDir(input.projectPath),
       `${pathSegment(input.branchName)}-${input.taskId.slice(0, 8)}`
     );
@@ -25993,7 +26478,7 @@ function ensureWorktree(params) {
         const baseBranch2 = repo.branch || input.baseBranch || "main";
         const worktreePath2 = ensureGitWorktree({
           repoPath: repo.localPath,
-          worktreePath: (0, import_node_path10.join)(taskRoot2, pathSegment(repoName(repo.repoUrl, repo.localPath))),
+          worktreePath: (0, import_node_path11.join)(taskRoot2, pathSegment(repoName(repo.repoUrl, repo.localPath))),
           branchName: input.branchName,
           baseBranch: baseBranch2,
           allowedRoot: worktreeDir(input.projectPath)
@@ -26008,13 +26493,13 @@ function ensureWorktree(params) {
       })
     };
   }
-  const gitRoot = gitSafe((0, import_node_path10.resolve)(input.projectPath), ["rev-parse", "--show-toplevel"]);
+  const gitRoot = gitSafe((0, import_node_path11.resolve)(input.projectPath), ["rev-parse", "--show-toplevel"]);
   if (!gitRoot) {
     throw new Error("The selected Project folder is not inside a Git repository");
   }
-  const repoPath = (0, import_node_path10.resolve)(gitRoot);
+  const repoPath = (0, import_node_path11.resolve)(gitRoot);
   const baseBranch = input.baseBranch || gitSafe(repoPath, ["branch", "--show-current"]) || "HEAD";
-  const taskRoot = (0, import_node_path10.join)(
+  const taskRoot = (0, import_node_path11.join)(
     worktreeDir(repoPath),
     `${pathSegment(input.branchName)}-${input.taskId.slice(0, 8)}`
   );
@@ -26043,7 +26528,7 @@ function ensureWorktree(params) {
 function ensureSharedCheckoutBranch(input) {
   assertValidGitRef(input.branchName, "branchName");
   assertValidGitRef(input.baseBranch, "baseBranch");
-  const repoPath = (0, import_node_path10.resolve)(input.repoPath);
+  const repoPath = (0, import_node_path11.resolve)(input.repoPath);
   if (gitSafe(repoPath, ["rev-parse", "--is-inside-work-tree"]) !== "true") {
     return { checkedOut: false, reason: `${repoPath} is not a git work tree` };
   }
@@ -26088,7 +26573,7 @@ function resolveSharedCheckoutTargets(input) {
 }
 function resolveRuntimeCwd(payload) {
   const multiRepoWorktree = payload.worktreeInfo?.allWorktrees?.[0]?.worktreePath;
-  if (multiRepoWorktree) return (0, import_node_path10.dirname)(multiRepoWorktree);
+  if (multiRepoWorktree) return (0, import_node_path11.dirname)(multiRepoWorktree);
   if (isAlanDefaultWorkspace(payload.projectPath)) return resolveAlanDefaultWorkspacePath();
   return payload.worktreeInfo?.worktreePath ?? payload.projectPath ?? process.cwd();
 }
@@ -26310,12 +26795,12 @@ function getConfigPath() {
   return process.env.ALAN_AGENT_CONFIG_PATH ?? boundAgentConfigPath ?? resolveAgentConfigPath({ profile: "production" });
 }
 function getEndpointDefaultsPath() {
-  return process.env.ALAN_AGENT_ENDPOINTS_PATH ?? (0, import_node_path10.join)((0, import_node_path10.dirname)(getConfigPath()), "endpoints.json");
+  return process.env.ALAN_AGENT_ENDPOINTS_PATH ?? (0, import_node_path11.join)((0, import_node_path11.dirname)(getConfigPath()), "endpoints.json");
 }
 function readConfig() {
   const configPath = getConfigPath();
-  if (!(0, import_node_fs12.existsSync)(configPath)) return {};
-  const parsed = JSON.parse((0, import_node_fs12.readFileSync)(configPath, "utf8"));
+  if (!(0, import_node_fs13.existsSync)(configPath)) return {};
+  const parsed = JSON.parse((0, import_node_fs13.readFileSync)(configPath, "utf8"));
   const sanitized = sanitizeAgentConfig(parsed);
   if (Object.keys(parsed).some((key) => !Object.hasOwn(sanitized, key))) {
     writeConfig(sanitized);
@@ -26331,27 +26816,27 @@ function readConfigForRegistration() {
 }
 function readEndpointDefaults() {
   const endpointsPath = getEndpointDefaultsPath();
-  if (!(0, import_node_fs12.existsSync)(endpointsPath)) return {};
+  if (!(0, import_node_fs13.existsSync)(endpointsPath)) return {};
   try {
-    return JSON.parse((0, import_node_fs12.readFileSync)(endpointsPath, "utf8"));
+    return JSON.parse((0, import_node_fs13.readFileSync)(endpointsPath, "utf8"));
   } catch {
     return {};
   }
 }
 function writeConfig(config) {
   const configPath = getConfigPath();
-  (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(configPath), { recursive: true, mode: 448 });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(configPath), { recursive: true, mode: 448 });
   const pendingPath = `${configPath}.pending-${process.pid}-${(0, import_node_crypto3.randomBytes)(6).toString("hex")}`;
   try {
-    (0, import_node_fs12.writeFileSync)(
+    (0, import_node_fs13.writeFileSync)(
       pendingPath,
       JSON.stringify(sanitizeAgentConfig(config), null, 2),
       { mode: 384 }
     );
-    (0, import_node_fs12.chmodSync)(pendingPath, 384);
-    (0, import_node_fs12.renameSync)(pendingPath, configPath);
+    (0, import_node_fs13.chmodSync)(pendingPath, 384);
+    (0, import_node_fs13.renameSync)(pendingPath, configPath);
   } finally {
-    (0, import_node_fs12.rmSync)(pendingPath, { force: true });
+    (0, import_node_fs13.rmSync)(pendingPath, { force: true });
   }
 }
 function maintenanceLeasePath(configPath) {
@@ -26359,9 +26844,9 @@ function maintenanceLeasePath(configPath) {
 }
 function readLocalDaemonMaintenanceLease(configPath, nowMs = Date.now()) {
   const path = maintenanceLeasePath(configPath);
-  if (!(0, import_node_fs12.existsSync)(path)) return null;
+  if (!(0, import_node_fs13.existsSync)(path)) return null;
   try {
-    const lease = JSON.parse((0, import_node_fs12.readFileSync)(path, "utf8"));
+    const lease = JSON.parse((0, import_node_fs13.readFileSync)(path, "utf8"));
     if (lease.version !== 1 || typeof lease.id !== "string" || lease.reason !== "credential_cleanup" && lease.reason !== "daemon_startup" && lease.reason !== "watchdog" || !(lease.reason === "credential_cleanup" && lease.expiresAtMs === null || typeof lease.expiresAtMs === "number" && Number.isFinite(lease.expiresAtMs))) {
       throw new Error("invalid maintenance lease");
     }
@@ -26378,8 +26863,8 @@ function readLocalDaemonMaintenanceLease(configPath, nowMs = Date.now()) {
       expiresAtMs: nowMs + 5e3
     };
     try {
-      (0, import_node_fs12.writeFileSync)(path, JSON.stringify(fallback), { mode: 384 });
-      (0, import_node_fs12.chmodSync)(path, 384);
+      (0, import_node_fs13.writeFileSync)(path, JSON.stringify(fallback), { mode: 384 });
+      (0, import_node_fs13.chmodSync)(path, 384);
     } catch {
     }
     return fallback;
@@ -26395,10 +26880,10 @@ function acquireLocalDaemonMaintenanceLease(configPath, reason, ttlMs = 5e3) {
     expiresAtMs: reason === "credential_cleanup" ? null : Date.now() + Math.max(1e3, Math.min(ttlMs, 6e4))
   };
   const path = maintenanceLeasePath(configPath);
-  (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(path), { recursive: true, mode: 448 });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(path), { recursive: true, mode: 448 });
   try {
-    (0, import_node_fs12.writeFileSync)(path, JSON.stringify(lease), { mode: 384, flag: "wx" });
-    (0, import_node_fs12.chmodSync)(path, 384);
+    (0, import_node_fs13.writeFileSync)(path, JSON.stringify(lease), { mode: 384, flag: "wx" });
+    (0, import_node_fs13.chmodSync)(path, 384);
     return { acquired: true, lease };
   } catch (error) {
     const raced = readLocalDaemonMaintenanceLease(configPath);
@@ -26414,9 +26899,9 @@ function daemonOwnerLeasePath(configPath) {
 }
 function readLocalDaemonOwnerLease(configPath) {
   const path = daemonOwnerLeasePath(configPath);
-  if (!(0, import_node_fs12.existsSync)(path)) return null;
+  if (!(0, import_node_fs13.existsSync)(path)) return null;
   try {
-    const lease = JSON.parse((0, import_node_fs12.readFileSync)(path, "utf8"));
+    const lease = JSON.parse((0, import_node_fs13.readFileSync)(path, "utf8"));
     if (lease.version !== 1 || typeof lease.id !== "string" || typeof lease.daemonSessionId !== "string" || !Number.isSafeInteger(lease.pid) || lease.pid <= 0 || typeof lease.startedAtMs !== "number" || !Number.isFinite(lease.startedAtMs) || typeof lease.runtimeId !== "string" || typeof lease.localServiceId !== "string" || !Number.isSafeInteger(lease.localApiPort) || lease.localApiPort < 0 || lease.localApiPort > 65535 || typeof lease.localApiToken !== "string" || lease.localApiToken.length === 0) {
       throw new Error("invalid daemon owner lease");
     }
@@ -26468,10 +26953,10 @@ async function acquireLocalDaemonOwnerLease(input) {
     localApiToken: input.localApiToken
   };
   const path = daemonOwnerLeasePath(input.configPath);
-  (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(path), { recursive: true, mode: 448 });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(path), { recursive: true, mode: 448 });
   try {
-    (0, import_node_fs12.writeFileSync)(path, JSON.stringify(lease), { mode: 384, flag: "wx" });
-    (0, import_node_fs12.chmodSync)(path, 384);
+    (0, import_node_fs13.writeFileSync)(path, JSON.stringify(lease), { mode: 384, flag: "wx" });
+    (0, import_node_fs13.chmodSync)(path, 384);
     return { acquired: true, lease };
   } catch (error) {
     const raced = readLocalDaemonOwnerLease(input.configPath);
@@ -26486,12 +26971,12 @@ function updateLocalDaemonOwnerEndpoint(configPath, lease, localApiPort) {
   const path = daemonOwnerLeasePath(configPath);
   const pendingPath = `${path}.pending-${lease.id}`;
   try {
-    (0, import_node_fs12.writeFileSync)(pendingPath, JSON.stringify(updated), { mode: 384 });
-    (0, import_node_fs12.chmodSync)(pendingPath, 384);
-    (0, import_node_fs12.renameSync)(pendingPath, path);
+    (0, import_node_fs13.writeFileSync)(pendingPath, JSON.stringify(updated), { mode: 384 });
+    (0, import_node_fs13.chmodSync)(pendingPath, 384);
+    (0, import_node_fs13.renameSync)(pendingPath, path);
     return updated;
   } finally {
-    (0, import_node_fs12.rmSync)(pendingPath, { force: true });
+    (0, import_node_fs13.rmSync)(pendingPath, { force: true });
   }
 }
 function releaseLocalDaemonOwnerLease(configPath, leaseId) {
@@ -26500,13 +26985,13 @@ function releaseLocalDaemonOwnerLease(configPath, leaseId) {
 function releaseOwnedJsonFile(path, ownerId, ownerField = "id") {
   const releasePath = `${path}.release-${process.pid}-${(0, import_node_crypto3.randomBytes)(6).toString("hex")}`;
   try {
-    (0, import_node_fs12.renameSync)(path, releasePath);
+    (0, import_node_fs13.renameSync)(path, releasePath);
   } catch (error) {
     if (error.code === "ENOENT") return;
     throw error;
   }
   try {
-    const content = (0, import_node_fs12.readFileSync)(releasePath, "utf8");
+    const content = (0, import_node_fs13.readFileSync)(releasePath, "utf8");
     let capturedOwnerId = null;
     try {
       const captured = JSON.parse(content);
@@ -26515,13 +27000,13 @@ function releaseOwnedJsonFile(path, ownerId, ownerField = "id") {
     }
     if (capturedOwnerId === ownerId) return;
     try {
-      (0, import_node_fs12.writeFileSync)(path, content, { mode: 384, flag: "wx" });
-      (0, import_node_fs12.chmodSync)(path, 384);
+      (0, import_node_fs13.writeFileSync)(path, content, { mode: 384, flag: "wx" });
+      (0, import_node_fs13.chmodSync)(path, 384);
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
     }
   } finally {
-    (0, import_node_fs12.rmSync)(releasePath, { force: true });
+    (0, import_node_fs13.rmSync)(releasePath, { force: true });
   }
 }
 function inspectLocalDaemonRunJournal(configPath) {
@@ -26531,8 +27016,8 @@ function inspectLocalDaemonRunJournal(configPath) {
   try {
     let activeRunCount = 0;
     for (const artifact of [path, pendingPath]) {
-      if (!(0, import_node_fs12.existsSync)(artifact)) continue;
-      const parsed = JSON.parse((0, import_node_fs12.readFileSync)(artifact, "utf8"));
+      if (!(0, import_node_fs13.existsSync)(artifact)) continue;
+      const parsed = JSON.parse((0, import_node_fs13.readFileSync)(artifact, "utf8"));
       if (parsed.version !== 1 || !Array.isArray(parsed.entries))
         throw new Error("invalid journal");
       if (artifact === path) {
@@ -26551,7 +27036,7 @@ function inspectLocalDaemonRunJournal(configPath) {
         }).length;
         continue;
       }
-      const legacyStartedAtMs = (0, import_node_fs12.statSync)(pendingPath).mtimeMs;
+      const legacyStartedAtMs = (0, import_node_fs13.statSync)(pendingPath).mtimeMs;
       activeRunCount += parsed.entries.filter((entry) => {
         if (!entry || typeof entry !== "object") throw new Error("invalid pending run entry");
         const startedAtMs = entry.startedAtMs;
@@ -26578,9 +27063,9 @@ function setupTokenHash(setupToken) {
 function getOrCreateSetupAttemptId(setupToken) {
   const intentPath = pendingSetupIntentPath();
   const tokenHash = setupTokenHash(setupToken);
-  if ((0, import_node_fs12.existsSync)(intentPath)) {
+  if ((0, import_node_fs13.existsSync)(intentPath)) {
     try {
-      const stored = JSON.parse((0, import_node_fs12.readFileSync)(intentPath, "utf8"));
+      const stored = JSON.parse((0, import_node_fs13.readFileSync)(intentPath, "utf8"));
       if (stored.setupTokenHash === tokenHash && typeof stored.registrationAttemptId === "string" && stored.registrationAttemptId.length > 0) {
         return stored.registrationAttemptId;
       }
@@ -26588,23 +27073,23 @@ function getOrCreateSetupAttemptId(setupToken) {
     }
   }
   const registrationAttemptId = (0, import_node_crypto3.randomUUID)();
-  (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(intentPath), { recursive: true, mode: 448 });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(intentPath), { recursive: true, mode: 448 });
   const writePath = `${intentPath}.pending-${process.pid}-${(0, import_node_crypto3.randomBytes)(6).toString("hex")}`;
   try {
-    (0, import_node_fs12.writeFileSync)(
+    (0, import_node_fs13.writeFileSync)(
       writePath,
       JSON.stringify({ setupTokenHash: tokenHash, registrationAttemptId }, null, 2),
       { mode: 384 }
     );
-    (0, import_node_fs12.chmodSync)(writePath, 384);
-    (0, import_node_fs12.renameSync)(writePath, intentPath);
+    (0, import_node_fs13.chmodSync)(writePath, 384);
+    (0, import_node_fs13.renameSync)(writePath, intentPath);
   } finally {
-    (0, import_node_fs12.rmSync)(writePath, { force: true });
+    (0, import_node_fs13.rmSync)(writePath, { force: true });
   }
   return registrationAttemptId;
 }
 function clearPendingSetupIntent() {
-  (0, import_node_fs12.rmSync)(pendingSetupIntentPath(), { force: true });
+  (0, import_node_fs13.rmSync)(pendingSetupIntentPath(), { force: true });
 }
 function pendingDeviceAuthorizationPath() {
   return `${getConfigPath()}.device-auth-pending`;
@@ -26625,8 +27110,8 @@ function parseDeviceAuthorizationOperationContent(content) {
 }
 function restoreCapturedFileUnlessReplaced(path, content) {
   try {
-    (0, import_node_fs12.writeFileSync)(path, content, { mode: 384, flag: "wx" });
-    (0, import_node_fs12.chmodSync)(path, 384);
+    (0, import_node_fs13.writeFileSync)(path, content, { mode: 384, flag: "wx" });
+    (0, import_node_fs13.chmodSync)(path, 384);
   } catch (error) {
     if (error.code !== "EEXIST") throw error;
   }
@@ -26634,26 +27119,26 @@ function restoreCapturedFileUnlessReplaced(path, content) {
 function quarantineCorruptDeviceAuthorizationOperation(path) {
   const quarantinePath = `${path}.corrupt-${process.pid}-${(0, import_node_crypto3.randomBytes)(6).toString("hex")}`;
   try {
-    (0, import_node_fs12.renameSync)(path, quarantinePath);
+    (0, import_node_fs13.renameSync)(path, quarantinePath);
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
   }
   try {
-    const capturedContent = (0, import_node_fs12.readFileSync)(quarantinePath, "utf8");
+    const capturedContent = (0, import_node_fs13.readFileSync)(quarantinePath, "utf8");
     if (parseDeviceAuthorizationOperationContent(capturedContent)) {
       restoreCapturedFileUnlessReplaced(path, capturedContent);
     }
   } finally {
-    (0, import_node_fs12.rmSync)(quarantinePath, { force: true });
+    (0, import_node_fs13.rmSync)(quarantinePath, { force: true });
   }
-  if (!(0, import_node_fs12.existsSync)(path)) return null;
-  return parseDeviceAuthorizationOperationContent((0, import_node_fs12.readFileSync)(path, "utf8"));
+  if (!(0, import_node_fs13.existsSync)(path)) return null;
+  return parseDeviceAuthorizationOperationContent((0, import_node_fs13.readFileSync)(path, "utf8"));
 }
 function readDeviceAuthorizationOperation() {
   const path = deviceAuthorizationOperationPath();
-  if (!(0, import_node_fs12.existsSync)(path)) return null;
-  const parsed = parseDeviceAuthorizationOperationContent((0, import_node_fs12.readFileSync)(path, "utf8"));
+  if (!(0, import_node_fs13.existsSync)(path)) return null;
+  const parsed = parseDeviceAuthorizationOperationContent((0, import_node_fs13.readFileSync)(path, "utf8"));
   const lease = parsed ?? quarantineCorruptDeviceAuthorizationOperation(path);
   if (!lease) return null;
   if (lease.expiresAtMs <= Date.now()) {
@@ -26671,10 +27156,10 @@ function acquireDeviceAuthorizationOperation() {
     expiresAtMs: Date.now() + 6e4
   };
   const path = deviceAuthorizationOperationPath();
-  (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(path), { recursive: true, mode: 448 });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(path), { recursive: true, mode: 448 });
   try {
-    (0, import_node_fs12.writeFileSync)(path, JSON.stringify(lease), { mode: 384, flag: "wx" });
-    (0, import_node_fs12.chmodSync)(path, 384);
+    (0, import_node_fs13.writeFileSync)(path, JSON.stringify(lease), { mode: 384, flag: "wx" });
+    (0, import_node_fs13.chmodSync)(path, 384);
     return lease;
   } catch (error) {
     if (error.code === "EEXIST") return null;
@@ -26689,15 +27174,15 @@ function extendDeviceAuthorizationOperation(operationId, expiresAtMs) {
   const path = deviceAuthorizationOperationPath();
   const pendingPath = `${path}.pending-${process.pid}-${(0, import_node_crypto3.randomBytes)(6).toString("hex")}`;
   try {
-    (0, import_node_fs12.writeFileSync)(
+    (0, import_node_fs13.writeFileSync)(
       pendingPath,
       JSON.stringify({ ...current, expiresAtMs: Math.max(expiresAtMs, Date.now() + 6e4) }),
       { mode: 384 }
     );
-    (0, import_node_fs12.chmodSync)(pendingPath, 384);
-    (0, import_node_fs12.renameSync)(pendingPath, path);
+    (0, import_node_fs13.chmodSync)(pendingPath, 384);
+    (0, import_node_fs13.renameSync)(pendingPath, path);
   } finally {
-    (0, import_node_fs12.rmSync)(pendingPath, { force: true });
+    (0, import_node_fs13.rmSync)(pendingPath, { force: true });
   }
 }
 function assertDeviceAuthorizationOperationOwner(operationId) {
@@ -26708,12 +27193,12 @@ function assertDeviceAuthorizationOperationOwner(operationId) {
 function clearPendingDeviceAuthorization(operationId) {
   const path = pendingDeviceAuthorizationPath();
   if (!operationId) {
-    (0, import_node_fs12.rmSync)(path, { force: true });
+    (0, import_node_fs13.rmSync)(path, { force: true });
     return;
   }
-  if (!(0, import_node_fs12.existsSync)(path)) return;
+  if (!(0, import_node_fs13.existsSync)(path)) return;
   try {
-    const pending = JSON.parse((0, import_node_fs12.readFileSync)(path, "utf8"));
+    const pending = JSON.parse((0, import_node_fs13.readFileSync)(path, "utf8"));
     if (pending.operationId !== operationId) return;
   } catch {
     return;
@@ -26722,9 +27207,9 @@ function clearPendingDeviceAuthorization(operationId) {
 }
 function readPendingDeviceAuthorization(apiUrl) {
   const path = pendingDeviceAuthorizationPath();
-  if (!(0, import_node_fs12.existsSync)(path)) return null;
+  if (!(0, import_node_fs13.existsSync)(path)) return null;
   try {
-    const pending = JSON.parse((0, import_node_fs12.readFileSync)(path, "utf8"));
+    const pending = JSON.parse((0, import_node_fs13.readFileSync)(path, "utf8"));
     const expiresAtMs = Date.parse(pending.expiresAt ?? "");
     if (pending.apiUrl !== apiUrl || typeof pending.deviceCode !== "string" || typeof pending.userCode !== "string" || typeof pending.verificationUri !== "string" || typeof pending.installationId !== "string" || pending.operationId !== void 0 && typeof pending.operationId !== "string" || !Number.isFinite(pending.intervalSeconds) || !Number.isFinite(expiresAtMs) || expiresAtMs <= Date.now()) {
       return null;
@@ -26736,20 +27221,20 @@ function readPendingDeviceAuthorization(apiUrl) {
 }
 function writePendingDeviceAuthorization(pending) {
   const path = pendingDeviceAuthorizationPath();
-  (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(path), { recursive: true, mode: 448 });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(path), { recursive: true, mode: 448 });
   const writePath = `${path}.pending-${process.pid}-${(0, import_node_crypto3.randomBytes)(6).toString("hex")}`;
   try {
-    (0, import_node_fs12.writeFileSync)(writePath, JSON.stringify(pending, null, 2), { mode: 384 });
-    (0, import_node_fs12.chmodSync)(writePath, 384);
-    (0, import_node_fs12.renameSync)(writePath, path);
+    (0, import_node_fs13.writeFileSync)(writePath, JSON.stringify(pending, null, 2), { mode: 384 });
+    (0, import_node_fs13.chmodSync)(writePath, 384);
+    (0, import_node_fs13.renameSync)(writePath, path);
   } finally {
-    (0, import_node_fs12.rmSync)(writePath, { force: true });
+    (0, import_node_fs13.rmSync)(writePath, { force: true });
   }
 }
 function removeAlanOwnedLocalArtifacts() {
   const configPath = getConfigPath();
-  const directory = (0, import_node_path10.dirname)(configPath);
-  const configName = (0, import_node_path10.basename)(configPath).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const directory = (0, import_node_path11.dirname)(configPath);
+  const configName = (0, import_node_path11.basename)(configPath).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const alanAtomicSidecarPattern = new RegExp(
     `^${configName}(?:|\\.setup-pending|\\.device-auth-pending|\\.device-auth-operation\\.json|\\.maintenance-lease\\.json|\\.event-outbox\\.enc)\\.(?:pending|release|corrupt)-\\d+-[a-f0-9]{12}$`
   );
@@ -26766,13 +27251,13 @@ function removeAlanOwnedLocalArtifacts() {
     `${configPath}.pending-runs.json.pending`,
     maintenanceLeasePath(configPath)
   ]);
-  if ((0, import_node_fs12.existsSync)(directory)) {
-    for (const entry of (0, import_node_fs12.readdirSync)(directory)) {
-      if (alanAtomicSidecarPattern.test(entry)) artifacts.add((0, import_node_path10.join)(directory, entry));
+  if ((0, import_node_fs13.existsSync)(directory)) {
+    for (const entry of (0, import_node_fs13.readdirSync)(directory)) {
+      if (alanAtomicSidecarPattern.test(entry)) artifacts.add((0, import_node_path11.join)(directory, entry));
     }
   }
-  for (const artifact of artifacts) (0, import_node_fs12.rmSync)(artifact, { force: true });
-  (0, import_node_fs12.rmSync)(configPath, { force: true });
+  for (const artifact of artifacts) (0, import_node_fs13.rmSync)(artifact, { force: true });
+  (0, import_node_fs13.rmSync)(configPath, { force: true });
 }
 function argValue(args, name) {
   const index = args.indexOf(name);
@@ -26994,13 +27479,13 @@ var DurablePendingRunStarts = class extends Map {
   }
   persist() {
     if (this.size === 0) {
-      (0, import_node_fs12.rmSync)(this.path, { force: true });
+      (0, import_node_fs13.rmSync)(this.path, { force: true });
       return;
     }
     const pendingPath = `${this.path}.pending`;
-    (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(this.path), { recursive: true, mode: 448 });
+    (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(this.path), { recursive: true, mode: 448 });
     try {
-      (0, import_node_fs12.writeFileSync)(
+      (0, import_node_fs13.writeFileSync)(
         pendingPath,
         JSON.stringify({
           version: 1,
@@ -27013,10 +27498,10 @@ var DurablePendingRunStarts = class extends Map {
         }),
         { mode: 384 }
       );
-      (0, import_node_fs12.chmodSync)(pendingPath, 384);
-      (0, import_node_fs12.renameSync)(pendingPath, this.path);
+      (0, import_node_fs13.chmodSync)(pendingPath, 384);
+      (0, import_node_fs13.renameSync)(pendingPath, this.path);
     } finally {
-      (0, import_node_fs12.rmSync)(pendingPath, { force: true });
+      (0, import_node_fs13.rmSync)(pendingPath, { force: true });
     }
   }
 };
@@ -27251,21 +27736,21 @@ function reconcileActiveRuns(input) {
   }
 }
 function collectRuntimeMetadata() {
-  const cpuList = (0, import_node_os7.cpus)();
+  const cpuList = (0, import_node_os8.cpus)();
   const metadata = {
-    platform: (0, import_node_os7.platform)(),
-    arch: (0, import_node_os7.arch)(),
-    osVersion: (0, import_node_os7.release)(),
+    platform: (0, import_node_os8.platform)(),
+    arch: (0, import_node_os8.arch)(),
+    osVersion: (0, import_node_os8.release)(),
     agentVersion: AGENT_VERSION,
-    memoryBytes: (0, import_node_os7.totalmem)(),
-    memoryFreeBytes: (0, import_node_os7.freemem)()
+    memoryBytes: (0, import_node_os8.totalmem)(),
+    memoryFreeBytes: (0, import_node_os8.freemem)()
   };
   if (cpuList.length > 0) {
     metadata.cpuModel = cpuList[0]?.model;
     metadata.cpuCores = cpuList.length;
   }
   try {
-    const disk = (0, import_node_fs12.statfsSync)((0, import_node_os7.homedir)());
+    const disk = (0, import_node_fs13.statfsSync)((0, import_node_os8.homedir)());
     metadata.diskFreeBytes = disk.bavail * disk.bsize;
     metadata.diskTotalBytes = disk.blocks * disk.bsize;
   } catch {
@@ -27521,7 +28006,7 @@ async function setupDaemon(args) {
   const teamId = argValue(args, "--team") ?? process.env.ALAN_TEAM_ID;
   const setupToken = argValue(args, "--setup-token") ?? process.env.ALAN_RUNTIME_SETUP_TOKEN;
   const token = argValue(args, "--token") ?? process.env.ALAN_SETUP_TOKEN;
-  const displayName = argValue(args, "--name") ?? (0, import_node_os7.hostname)();
+  const displayName = argValue(args, "--name") ?? (0, import_node_os8.hostname)();
   const scope = argValue(args, "--scope") ?? process.env.ALAN_RUNTIME_SCOPE ?? (setupToken ? "team" : "user");
   const installationId = argValue(args, "--installation-id") ?? previousConfig.installationId ?? (0, import_node_crypto3.randomUUID)();
   if (scope !== "team" && scope !== "user") {
@@ -27544,7 +28029,7 @@ async function setupDaemon(args) {
       ...teamId ? { teamId } : {},
       ...setupToken ? { setupToken, registrationAttemptId } : {},
       displayName,
-      hostname: (0, import_node_os7.hostname)(),
+      hostname: (0, import_node_os8.hostname)(),
       runtimeKind: "machine",
       managementKind: "user_managed",
       hostKind: "daemon",
@@ -27628,7 +28113,7 @@ async function loginWithDeviceCode(args) {
     }
     const previousConfig = readConfigForRegistration();
     const { apiUrl, wsUrl, endpointProfile } = resolveEndpoints(args);
-    const displayName = argValue(args, "--name") ?? (0, import_node_os7.hostname)();
+    const displayName = argValue(args, "--name") ?? (0, import_node_os8.hostname)();
     const maxPolls = Number.parseInt(argValue(args, "--max-polls") ?? "300", 10);
     const resumed = readPendingDeviceAuthorization(apiUrl);
     const installationId = resumed?.installationId ?? previousConfig.installationId ?? (0, import_node_crypto3.randomUUID)();
@@ -27640,7 +28125,7 @@ async function loginWithDeviceCode(args) {
         headers: { "content-type": "application/json" },
         body: JSON.stringify({
           displayName,
-          hostname: (0, import_node_os7.hostname)(),
+          hostname: (0, import_node_os8.hostname)(),
           capabilities: discoverCapabilities(),
           metadata: {
             ...await collectRuntimeMetadataWithProviderLimits(),
@@ -27874,7 +28359,7 @@ async function startDaemon(args) {
   const workspaceRelocations = /* @__PURE__ */ new Map();
   for (const relocation of stored.workspaceRelocations ?? []) {
     if (relocation?.conversationId && relocation.runId && relocation.previousPath && relocation.canonicalPath) {
-      workspaceRelocations.set((0, import_node_path10.resolve)(relocation.previousPath), relocation);
+      workspaceRelocations.set((0, import_node_path11.resolve)(relocation.previousPath), relocation);
     }
   }
   if (stored.localApiPort !== localApiPort || stored.localApiToken !== localApiToken || stored.localServiceId !== localServiceId || stored.localServiceSecret !== localServiceSecret || stored.eventSpoolKey !== eventSpoolKey || stored.daemonEpoch !== daemonEpoch || stored.installationId !== installationId) {
@@ -28270,7 +28755,26 @@ async function startDaemon(args) {
       return;
     }
     const backendKind = normalizeBackendKind2(payload.backendKind);
-    const runtimeCommand = resolveBackendRuntimeCommand(backendKind ?? payload.backendKind);
+    let runtimeCommand = resolveBackendRuntimeCommand(backendKind ?? payload.backendKind);
+    if (!runtimeCommand && backendKind) {
+      runtimeCommand = revalidateBackendRuntimeCommand(backendKind);
+    }
+    if (!runtimeCommand && backendKind && canInstallProviderCli(backendKind)) {
+      pendingRunStarts.set(payload.runId, payload.conversationId);
+      try {
+        const installed = await ensureProviderCliInstalled(backendKind, {
+          notify: (message) => {
+            pushLog(message);
+            console.info(`[alan-agent] ${message}`);
+          }
+        });
+        if (installed) {
+          runtimeCommand = revalidateBackendRuntimeCommand(backendKind);
+        }
+      } finally {
+        pendingRunStarts.delete(payload.runId);
+      }
+    }
     if (!runtimeCommand && backendKind) {
       socket.emit("agent.rejected", {
         runId: payload.runId,
@@ -28284,31 +28788,31 @@ async function startDaemon(args) {
     const workspaceRequired = Boolean(explicitWorkspacePath);
     if (isAlanDefaultWorkspace(payload.projectPath)) {
       try {
-        (0, import_node_fs12.mkdirSync)(cwd, { recursive: true });
+        (0, import_node_fs13.mkdirSync)(cwd, { recursive: true });
       } catch {
       }
     }
     let workspaceReadiness = inspectWorkspaceReadiness(workspaceRequired ? cwd : void 0);
     const expectedRepoUrls = [
       ...(payload.repoLocalPaths ?? []).filter(
-        (repo) => explicitWorkspacePath ? (0, import_node_path10.resolve)(repo.localPath) === (0, import_node_path10.resolve)(explicitWorkspacePath) : false
+        (repo) => explicitWorkspacePath ? (0, import_node_path11.resolve)(repo.localPath) === (0, import_node_path11.resolve)(explicitWorkspacePath) : false
       ).map((repo) => repo.repoUrl),
       ...payload.localRepoUrls ?? []
     ];
     if (workspaceReadiness.code === "workspace_missing" && explicitWorkspacePath && !payload.worktreeInfo) {
-      const previousPath = (0, import_node_path10.resolve)(explicitWorkspacePath);
+      const previousPath = (0, import_node_path11.resolve)(explicitWorkspacePath);
       const remembered = workspaceRelocations.get(previousPath);
       const rememberedPath = remembered?.canonicalPath;
       const relocated = rememberedPath && workspaceMatchesExpectedRepositories({
         workspacePath: rememberedPath,
         expectedRepoUrls
-      }) ? (0, import_node_path10.resolve)(rememberedPath) : discoverRelocatedWorkspace({
+      }) ? (0, import_node_path11.resolve)(rememberedPath) : discoverRelocatedWorkspace({
         missingPath: explicitWorkspacePath,
         approvedWorkspacePaths: payload.approvedWorkspacePaths,
         expectedRepoUrls
       });
       if (relocated) {
-        if (!remembered || (0, import_node_path10.resolve)(remembered.canonicalPath) !== relocated) {
+        if (!remembered || (0, import_node_path11.resolve)(remembered.canonicalPath) !== relocated) {
           workspaceRelocations.set(previousPath, {
             conversationId: payload.conversationId,
             runId: payload.runId,
@@ -28769,6 +29273,29 @@ async function startDaemon(args) {
       })();
     }
   );
+  socket.on(
+    "runtime.skills.scan",
+    (payload) => {
+      if (!payload?.requestId) return;
+      const requestId = payload.requestId;
+      try {
+        const projectPath = isAlanDefaultWorkspace(payload.projectPath) ? resolveAlanDefaultWorkspacePath() : payload.projectPath;
+        const result = scanLocalSkillsCached((0, import_node_os8.homedir)(), projectPath, {
+          refresh: payload.refresh === true
+        });
+        socket.emit("runtime.skills.result", {
+          requestId,
+          skills: result.skills,
+          errors: result.errors
+        });
+      } catch (error) {
+        socket.emit("runtime.skills.result", {
+          requestId,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+  );
   const adoptionChallenges = /* @__PURE__ */ new Map();
   const localServer = import_node_http.default.createServer((req, res) => {
     if (req.method === "GET" && req.url === "/owner") {
@@ -29762,7 +30289,7 @@ var agentProbeAckSchema = external_exports.object({
 
 // src/sandbox-outbox.ts
 var import_node_crypto5 = require("crypto");
-var import_node_fs13 = require("fs");
+var import_node_fs14 = require("fs");
 var SANDBOX_EVENT_OUTBOX_ENV = "ALAN_EVENT_OUTBOX_ENABLED";
 function isSandboxEventOutboxEnabled(env = process.env) {
   return env[SANDBOX_EVENT_OUTBOX_ENV] === "true";
@@ -29785,7 +30312,7 @@ function createSandboxEventOutbox(input) {
     input.pushLog?.(
       `sandbox_outbox_spool_reset ${error instanceof Error ? error.message : String(error)}`
     );
-    (0, import_node_fs13.rmSync)(path, { force: true });
+    (0, import_node_fs14.rmSync)(path, { force: true });
     return new EncryptedEventOutbox(path, key, input.pushLog, input.options);
   }
 }
@@ -30482,10 +31009,10 @@ async function runSandbox(config) {
 }
 
 // src/service-manager.ts
-var import_node_child_process6 = require("child_process");
-var import_node_fs14 = require("fs");
-var import_node_os8 = require("os");
-var import_node_path11 = require("path");
+var import_node_child_process7 = require("child_process");
+var import_node_fs15 = require("fs");
+var import_node_os9 = require("os");
+var import_node_path12 = require("path");
 var SERVICE_LABEL = "ai.tryalan.agent";
 var SYSTEMD_UNIT = "alan-agent.service";
 var WINDOWS_TASK = "Alan Agent";
@@ -30505,8 +31032,8 @@ function buildDaemonServicePlan(input) {
     if (userId === void 0) throw new Error("Cannot determine the current macOS user ID");
     const domain = `gui/${userId}`;
     const serviceTarget = `${domain}/${SERVICE_LABEL}`;
-    const manifestPath = (0, import_node_path11.join)(input.homeDir, "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
-    const logDir = (0, import_node_path11.join)(input.homeDir, ".alan", "agent", "logs");
+    const manifestPath = (0, import_node_path12.join)(input.homeDir, "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
+    const logDir = (0, import_node_path12.join)(input.homeDir, ".alan", "agent", "logs");
     const programArguments = daemonArgs.map((arg) => `    <string>${xml(arg)}</string>`).join("\n");
     const manifest = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -30528,9 +31055,9 @@ ${programArguments}
   <key>ThrottleInterval</key>
   <integer>5</integer>
   <key>StandardOutPath</key>
-  <string>${xml((0, import_node_path11.join)(logDir, "daemon.log"))}</string>
+  <string>${xml((0, import_node_path12.join)(logDir, "daemon.log"))}</string>
   <key>StandardErrorPath</key>
-  <string>${xml((0, import_node_path11.join)(logDir, "daemon-error.log"))}</string>
+  <string>${xml((0, import_node_path12.join)(logDir, "daemon-error.log"))}</string>
 </dict>
 </plist>
 `;
@@ -30569,7 +31096,7 @@ ${programArguments}
     };
   }
   if (input.platform === "linux") {
-    const manifestPath = (0, import_node_path11.join)(input.homeDir, ".config", "systemd", "user", SYSTEMD_UNIT);
+    const manifestPath = (0, import_node_path12.join)(input.homeDir, ".config", "systemd", "user", SYSTEMD_UNIT);
     const manifest = `[Unit]
 Description=Alan local agent daemon
 After=network-online.target
@@ -30666,7 +31193,7 @@ WantedBy=default.target
   };
 }
 function currentServicePlan(args) {
-  const currentPlatform = (0, import_node_os8.platform)();
+  const currentPlatform = (0, import_node_os9.platform)();
   if (currentPlatform !== "darwin" && currentPlatform !== "linux" && currentPlatform !== "win32") {
     throw new Error(`Daemon service installation is not supported on ${currentPlatform}`);
   }
@@ -30675,25 +31202,25 @@ function currentServicePlan(args) {
   if (!cliEntry) throw new Error("Cannot determine the alan-agent executable path");
   return buildDaemonServicePlan({
     platform: currentPlatform,
-    homeDir: (0, import_node_os8.homedir)(),
+    homeDir: (0, import_node_os9.homedir)(),
     nodeExecutable: process.execPath,
-    cliEntry: (0, import_node_path11.resolve)(cliEntry),
+    cliEntry: (0, import_node_path12.resolve)(cliEntry),
     profile
   });
 }
 function writeManifest(path, contents) {
-  (0, import_node_fs14.mkdirSync)((0, import_node_path11.dirname)(path), { recursive: true, mode: 448 });
+  (0, import_node_fs15.mkdirSync)((0, import_node_path12.dirname)(path), { recursive: true, mode: 448 });
   const pendingPath = `${path}.pending-${process.pid}`;
   try {
-    (0, import_node_fs14.writeFileSync)(pendingPath, contents, { mode: 384 });
-    (0, import_node_fs14.chmodSync)(pendingPath, 384);
-    (0, import_node_fs14.renameSync)(pendingPath, path);
+    (0, import_node_fs15.writeFileSync)(pendingPath, contents, { mode: 384 });
+    (0, import_node_fs15.chmodSync)(pendingPath, 384);
+    (0, import_node_fs15.renameSync)(pendingPath, path);
   } finally {
-    (0, import_node_fs14.rmSync)(pendingPath, { force: true });
+    (0, import_node_fs15.rmSync)(pendingPath, { force: true });
   }
 }
 function runServiceCommand(command) {
-  const result = (0, import_node_child_process6.spawnSync)(command.command, command.args, { encoding: "utf8" });
+  const result = (0, import_node_child_process7.spawnSync)(command.command, command.args, { encoding: "utf8" });
   const status = result.status ?? 1;
   const output = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
   if (status !== 0 && !command.tolerateFailure) {
@@ -30711,8 +31238,8 @@ function installDaemonService(args = []) {
   }
   const plan = currentServicePlan(args);
   if (plan.manifestPath && plan.manifest) {
-    if ((0, import_node_os8.platform)() === "darwin") {
-      (0, import_node_fs14.mkdirSync)((0, import_node_path11.join)((0, import_node_os8.homedir)(), ".alan", "agent", "logs"), { recursive: true, mode: 448 });
+    if ((0, import_node_os9.platform)() === "darwin") {
+      (0, import_node_fs15.mkdirSync)((0, import_node_path12.join)((0, import_node_os9.homedir)(), ".alan", "agent", "logs"), { recursive: true, mode: 448 });
     }
     writeManifest(plan.manifestPath, plan.manifest);
   }
@@ -30722,7 +31249,7 @@ function installDaemonService(args = []) {
 function uninstallDaemonService(args = []) {
   const plan = currentServicePlan(args);
   for (const command of plan.uninstallCommands) runServiceCommand(command);
-  if (plan.manifestPath) (0, import_node_fs14.rmSync)(plan.manifestPath, { force: true });
+  if (plan.manifestPath) (0, import_node_fs15.rmSync)(plan.manifestPath, { force: true });
   console.info("[alan-agent] Per-user daemon service removed");
 }
 function printDaemonServiceStatus(args = []) {
@@ -30733,6 +31260,42 @@ function printDaemonServiceStatus(args = []) {
 }
 
 // src/index.ts
+function logEffectiveGitIdentity(lifecycle, projectPath) {
+  const readConfig2 = (key) => {
+    try {
+      const result = (0, import_node_child_process8.spawnSync)("git", ["config", "--get", key], {
+        cwd: projectPath,
+        env: getDaemonCliEnvironment(),
+        encoding: "utf8",
+        timeout: 5e3
+      });
+      const value2 = result.status === 0 ? result.stdout.trim() : "";
+      return value2 || null;
+    } catch {
+      return null;
+    }
+  };
+  const envName = process.env.GIT_AUTHOR_NAME || null;
+  const envEmail = process.env.GIT_AUTHOR_EMAIL || null;
+  const configName = readConfig2("user.name");
+  const configEmail = readConfig2("user.email");
+  const payload = {
+    projectPath,
+    envAuthorName: envName,
+    envAuthorEmail: envEmail,
+    configUserName: configName,
+    configUserEmail: configEmail
+  };
+  if (!envEmail && !configEmail) {
+    lifecycle.error("sandbox_agent_git_identity_missing", payload);
+    return;
+  }
+  if (envEmail && configEmail && envEmail !== configEmail) {
+    lifecycle.error("sandbox_agent_git_identity_mismatch", payload);
+    return;
+  }
+  lifecycle.info("sandbox_agent_git_identity", payload);
+}
 async function runSessionFromEnv() {
   const wsUrl = process.env.ALAN_WS_URL;
   const sessionId = process.env.ALAN_SESSION_ID;
@@ -30777,6 +31340,7 @@ async function runSessionFromEnv() {
     mode,
     model
   });
+  logEffectiveGitIdentity(lifecycle, projectPath);
   await runSandbox({
     wsUrl,
     sessionId,