@alan-ai-hq/agent-manager-darwin-arm64 0.1.142 → 0.1.144

package/alan-agent.cjs

@@ -21524,37 +21524,15 @@ Platform Documents are the default destination and source of truth for PM work.
 
 Do NOT call \`create_plan\`, \`create_document_artifact\`, or another artifact-creation tool unless the user explicitly asks for an **artifact**. If \`create_document\` is unavailable or fails, report that blocker; do not silently substitute an artifact.
 
-## Platform knowledge lookups
+## Evidence and source selection
 
-The Alan platform is where product truth lives: tasks, subtasks, decisions, events, sessions, artifacts, context, and Documents. For that platform knowledge, local files and shell commands are a **last resort**, not a starting point. Browser and computer use remain available for authorized UI inspection and QA.
+Follow the shared tool-choice guidance. Use platform Documents for team requirements, PRDs, specifications, and decisions: resolve named records with \`find_records\`, browse with \`list_documents\`, and read with \`get_document\`. Use task, session, and artifact tools for their respective records.
 
-**Before every platform knowledge lookup, ask: does the platform know this?** If a platform MCP tool could plausibly answer the question, you MUST call it before any \`Read\`, \`Glob\`, \`Grep\`, or \`Bash\`. Reaching for a local tool first is a mistake even when it would be faster or you already know the file path. Inspecting transient UI state is product QA, not a platform knowledge lookup.
+Use browser and computer tools to inspect live interfaces, and local read-only tools for repository documentation, source, logs, and version history when relevant. Prefer the source the user names. Words such as "notes" or "docs" alone do not forbid repository inspection; use the available context to identify the likely source.
 
-| What you want | Use this | Not this |
-|---|---|---|
-| Requirements, PRDs, specs, notes, any written knowledge | \`list_documents\`, \`find_records\`, \`get_document\` | reading \`docs/\`, \`notes/\`, \`README.md\` |
-| Scope, status, priority, or history of work | \`get_task\`, \`list_subtasks\`, \`list_tasks\` | \`git log\`, commit messages |
-| What was decided and why | \`list_task_decisions\`, \`list_task_events\` | code comments, in-repo ADRs |
-| What an agent did or is doing | \`list_sessions\`, \`get_session_context\` | \`git log\`, diffing the worktree |
-| Prior agent context | \`list_task_events\`, \`get_session_context\` | scratch files |
-| Outputs of completed work | \`list_artifacts\`, \`get_artifact\` | build output, generated files |
-| Where code lives or how it works | \`search_code_context\` first, then \`Read\` the cited files | \`Grep\`/\`Glob\` sweeps |
+When a platform search is empty or unavailable, continue with other relevant permitted sources and state any evidence gap. Do not treat repository evidence as proof of a missing platform record, and do not bypass denied platform actions. Ask one targeted question only when the ambiguity prevents useful progress.
 
-**If you do fall back to a local tool, say so out loud** \u2014 name the platform tool you tried and what it returned (nothing, unavailable, insufficient). A silent local read is a violation of this rule. If no platform tool was tried, you have not earned the local read.
-
-Code is the exception that proves the rule: understanding how something works legitimately ends in reading source. Even then, start with \`search_code_context\` and read only the files it cites.
-
-**Default for written knowledge: platform Documents.** Any request to find, check, consult, review, summarize, or answer from written knowledge resolves against platform Documents \u2014 use \`list_documents\` or \`find_records\` with \`kinds=["document"]\` to locate it, then \`get_document\` to read it. If a document ID is already known, call \`get_document\` directly.
-
-This applies no matter which word the user uses. Treat all of these as the same request: docs, documentation, documents, notes, PRD, spec, requirements, design doc, plan, proposal, RFC, wiki, runbook, onboarding, guidelines, "what did we decide", "what did we write down", "what do we have on X". The noun never changes where you look.
-
-**Local repository files are off-limits for knowledge lookup** unless the user unambiguously points you at the repository. Do not read \`README.md\`, \`AGENTS.md\`, \`notes/\`, \`docs/\`, or any other in-repo file as a fallback, as corroboration, because no platform document matched, or because the user's wording happens to match a directory name.
-
-A bare noun is never a pointer to the repository. "Check the notes" means platform Documents, not \`notes/\`. "Check the docs" means platform Documents, not \`docs/\`. Only these count as pointing at the repository:
-- an explicit location \u2014 "in the repo", "in the codebase", "local files", "on disk", "in the worktree"
-- a concrete path or filename \u2014 \`notes/foo.md\`, \`AGENTS.md\`, "the readme"
-
-When platform Documents do not cover the question, stop and say so, then offer to check the repository. Do not read local files first, and do not guess. Cite which document answered the question.
+For team code discovery, follow the shared \`search_code_context\` guidance, verify cited files locally, and use focused local searches when needed.
 
 ## Your primary tools
 
@@ -22066,18 +22044,23 @@ var init_system_prompt = __esm({
     init_agent_definitions();
     ALAN_CONTEXT_SEARCH_PROMPT = `## Memory (non-code context)
 
-The codebase records what the system does. It does not record why it is that way, what was ruled out, what an outside constraint forbids, or what someone was left owed. That record lives in \`search_context\` \u2014 this team's decisions, constraints, procedures, ownership, rejected approaches and unfinished work.
+Use \`search_context\` first for team-specific decisions, constraints, ownership, history, or unfinished work when the exact source is unknown. Skip it for source-code questions, general knowledge, fully specified mechanical work, or a known record ID.
 
-Before answering or acting on a question about a past decision, ownership, history, or unfinished work whose exact source is unknown, call \`search_context\` first.
+Apply relevant retrieved decisions and cite their source. Compare them with current evidence; retrieved context can be incomplete or stale. If search is empty or unavailable, continue with other relevant permitted sources and explain any remaining evidence gap.
 
-So when a turn depends on something the repository cannot tell you \u2014 a value chosen rather than tuned, an approach that may already have been tried, a boundary another team owns, work someone else left half-done \u2014 recover it before you answer or act. Reading the code, or the document someone named, does not settle it: those answer a different question, and one turn can need both.
+For questions about recent activity, inspect available evidence for the relevant time window. Use records for task history, browser tools for live interfaces, and source, logs, or version history for implementation changes. A reference to "recently" or "a few days ago" calls for evidence, not an answer from memory.`;
+    ALAN_PLATFORM_TOOL_ROUTING_PROMPT = `## Tool choice
 
-What comes back is the answer, not a step towards it. Carry its specifics into what you write or change \u2014 the value, the constraint, the reason, the person \u2014 and say plainly when the evidence contradicts what was asked for. Retrieving a decision and then producing work that ignores it is worse than never having searched, because it looks informed.
+Choose tools by the evidence or action the request needs, whether the agent runs locally or in the cloud:
+- Use Alan MCP for canonical Alan records (tasks, sessions, documents, artifacts, and their relationships), platform actions such as managing runs or machines, and actions through a provider identity connected to Alan.
+- Use computer use and browser tools for live websites and interfaces, including the authenticated Alan app, transient DOM and CSS state, and product QA in development or test environments. When the user asks you to inspect a website or interface, use the available browser or computer tools without asking for permission again for ordinary inspection.
+- Use local file, shell, and diagnostic tools for repository source, version history, processes, logs, and runtime behavior. MCP is not a prerequisite for browser inspection or local diagnostics. Follow the codebase-index guidance for team code discovery.
 
-Skip it when nothing team-specific is at stake: source-code questions, general knowledge, mechanical work fully specified in the request, or an exact ID already in hand.`;
-    ALAN_PLATFORM_TOOL_ROUTING_PROMPT = `## Alan platform and GitHub
+Use the available repository tools for GitHub work, including git and gh when useful. If a cloud GitHub request reports github_not_connected, call request_github_connection in the current conversation and end the turn. The chat will offer GitHub authorization and resume after the user connects. Continue other independent work when possible.
 
-Use Alan MCP tools for canonical Alan records and platform actions: tasks, sessions, documents, artifacts, runs, and machines. Use the available repository tools for GitHub work, including git and gh when useful. If a cloud GitHub request reports github_not_connected, call request_github_connection in the current conversation and end the turn. The chat will offer GitHub authorization and resume after the user connects. Continue other independent work when possible.`;
+An empty search result is not a permission denial. Continue gathering evidence from relevant permitted sources rather than refusing the request because one source cannot answer. Distinguish observed facts from inference and name remaining evidence gaps.
+
+If a needed tool is not exposed, use the host's tool-discovery mechanism once when available before claiming the capability is unavailable. If a canonical platform action remains unavailable or unauthorized, report it and stop that platform action only; continue independent debugging and testing. Do not use a shell CLI, browser, raw HTTP, or local files to bypass that action or its identity and authorization requirements. Do not bypass a workflow or role tool allowlist.`;
     ALAN_IDENTITY_PROMPT = `You are Alan, the software factory agent. Alan ships software end to end \u2014 plan, write, review, test, deploy.
 
 ## How Alan is structured
@@ -22101,7 +22084,7 @@ Team
 - Listen first. Don't jump to solutions. One question at a time, not a list.
 - Scan available context (task, subtasks, code, history) before asking questions you can answer yourself.
 - Challenge when off \u2014 never silently implement the wrong thing.
-- Human leads, you propose. Proactive on reversible actions. Consequential decisions \u2192 propose first, execute after confirmation.
+- Act on the user's request and make reasonable implementation and tool choices within its scope. Do not ask again for permission already granted. Ask only when essential information is missing or an action requires additional authority.
 - Own mistakes. Wrong ID, jumped too fast \u2014 say so and fix it.
 - Write for a human reader. Task, subtask and epic descriptions, documents, artifacts and comments are read by people in the app, not parsed by agents. Lead with the outcome in one sentence, then short sections with headings and bullet lists. Spell out internal shorthand, and keep commit hashes, IDs and migration numbers out of sentences \u2014 put them in a trailing "References" list when they matter.
 - Think visually, proactively \u2014 not only when asked. Mermaid over paragraphs for architecture, flows, state, and schema. The same applies to data: when you're about to present a comparison, trend, breakdown, or status across several items, reach for a \`\`\`chart fence instead of a paragraph of numbers or a markdown table, even if the user never said the word "chart."
@@ -22554,7 +22537,7 @@ function plan(command, args, options) {
 function captureOutput(command, args, options) {
   const launch = plan(command, args, options);
   if (launch === void 0) return Promise.resolve(NEVER_STARTED);
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     (0, import_child_process.execFile)(
       launch.file,
       [...launch.args],
@@ -22568,7 +22551,7 @@ function captureOutput(command, args, options) {
       },
       (error61, stdout, stderr) => {
         const code = error61 && typeof error61.code === "number" ? error61.code : error61 ? void 0 : 0;
-        resolve12({ stdout, stderr, exitCode: code });
+        resolve13({ stdout, stderr, exitCode: code });
       }
     );
   });
@@ -22618,10 +22601,10 @@ async function linuxStartTicks(pid) {
   }
 }
 function psStartTime(pid) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     (0, import_child_process2.execFile)("ps", ["-o", "lstart=", "-p", String(pid)], { timeout: 2e3 }, (error61, stdout) => {
       const text2 = stdout.trim();
-      resolve12(error61 || !text2 ? void 0 : text2);
+      resolve13(error61 || !text2 ? void 0 : text2);
     });
   });
 }
@@ -22650,12 +22633,12 @@ function parseProcessList(text2) {
 }
 function listProcesses(platform3 = process.platform) {
   if (platform3 === "win32") return Promise.resolve([]);
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     (0, import_child_process3.execFile)(
       "ps",
       ["-A", "-o", "pid=,ppid=,pgid=,lstart="],
       { timeout: 5e3, maxBuffer: 8 * 1024 * 1024 },
-      (error61, stdout) => resolve12(error61 ? [] : parseProcessList(stdout))
+      (error61, stdout) => resolve13(error61 ? [] : parseProcessList(stdout))
     );
   });
 }
@@ -22695,11 +22678,11 @@ async function taskkill(pid, options) {
     stdio: "ignore",
     windowsHide: true
   });
-  const exited = new Promise((resolve12) => {
-    killer.once("error", (error210) => resolve12(error210));
+  const exited = new Promise((resolve13) => {
+    killer.once("error", (error210) => resolve13(error210));
     killer.once(
       "exit",
-      (code, signal) => resolve12(code === 0 ? void 0 : new Error(`taskkill failed: exit ${code}, signal ${signal}`))
+      (code, signal) => resolve13(code === 0 ? void 0 : new Error(`taskkill failed: exit ${code}, signal ${signal}`))
     );
   });
   const timedOut = clock.sleep(options.timeoutMs ?? DEFAULT_TASKKILL_TIMEOUT_MS, timeout.signal).then(() => new Error("taskkill timed out")).catch(() => void 0);
@@ -22955,10 +22938,10 @@ function spawnCli(options) {
 function waitForSpawn(child, command) {
   if (isWindowsJob(child)) return waitForWindowsJob(child, command);
   if (child.pid !== void 0) return Promise.resolve();
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const onSpawn = () => {
       child.off("error", onError);
-      resolve12();
+      resolve13();
     };
     const onError = (error61) => {
       child.off("spawn", onSpawn);
@@ -23349,69 +23332,47 @@ var init_models = __esm({
         maxOutputTokens: 16384
       },
       {
-        id: "z-ai/glm-4.7-flash",
-        name: "GLM 4.7 Flash",
-        description: "Fast GLM coding via Alan",
+        id: "z-ai/glm-5.3",
+        name: "GLM 5.3",
+        description: "Z.ai's flagship for coding, agents and long-horizon work",
         enabled: true,
         isDefault: false,
         sortOrder: 30,
-        upstreamModelId: "z-ai/glm-4.7-flash",
-        contextWindow: 2e5,
-        maxOutputTokens: 8192
-      },
-      {
-        id: "z-ai/glm-4.7",
-        name: "GLM 4.7",
-        description: "GLM coding and multi-step agent work",
-        enabled: true,
-        isDefault: false,
-        sortOrder: 40,
-        upstreamModelId: "z-ai/glm-4.7",
-        contextWindow: 2e5,
+        upstreamModelId: "z-ai/glm-5.3",
+        contextWindow: 1048576,
         maxOutputTokens: 16384
       },
       {
-        id: "qwen/qwen3-coder-flash",
-        name: "Qwen3 Coder Flash",
-        description: "Fast Qwen coder via Alan",
+        id: "z-ai/glm-5.3-flash",
+        name: "GLM 5.3 Flash",
+        description: "Fast multimodal GLM via Alan",
         enabled: true,
         isDefault: false,
-        sortOrder: 50,
-        upstreamModelId: "qwen/qwen3-coder-flash",
-        contextWindow: 128e3,
-        maxOutputTokens: 8192
-      },
-      {
-        id: "qwen/qwen3-coder",
-        name: "Qwen3 Coder",
-        description: "Open-weight oriented coding",
-        enabled: true,
-        isDefault: false,
-        sortOrder: 60,
-        upstreamModelId: "qwen/qwen3-coder",
-        contextWindow: 128e3,
+        sortOrder: 40,
+        upstreamModelId: "z-ai/glm-5.3-flash",
+        contextWindow: 1048576,
         maxOutputTokens: 8192
       },
       {
-        id: "moonshotai/kimi-k2.6",
-        name: "Kimi K2.6",
-        description: "Fast Kimi for long-horizon coding",
+        id: "qwen/qwen3.8-27b",
+        name: "Qwen3.8 27B",
+        description: "Qwen3.8 open-weight coding and agentic work",
         enabled: true,
         isDefault: false,
-        sortOrder: 70,
-        upstreamModelId: "moonshotai/kimi-k2.6",
-        contextWindow: 262144,
+        sortOrder: 50,
+        upstreamModelId: "qwen/qwen3.8-27b",
+        contextWindow: 1e6,
         maxOutputTokens: 16384
       },
       {
-        id: "moonshotai/kimi-k2.7-code",
-        name: "Kimi K2.7 Code",
-        description: "Kimi coding specialist",
+        id: "moonshotai/kimi-k3",
+        name: "Kimi K3",
+        description: "Moonshot's 2.8T open-weight flagship",
         enabled: true,
         isDefault: false,
-        sortOrder: 80,
-        upstreamModelId: "moonshotai/kimi-k2.7-code",
-        contextWindow: 262144,
+        sortOrder: 60,
+        upstreamModelId: "moonshotai/kimi-k3",
+        contextWindow: 1048576,
         maxOutputTokens: 16384
       },
       {
@@ -23420,7 +23381,7 @@ var init_models = __esm({
         description: "Fast Nemotron via Alan",
         enabled: true,
         isDefault: false,
-        sortOrder: 90,
+        sortOrder: 70,
         upstreamModelId: "nvidia/nemotron-3-nano-30b-a3b",
         contextWindow: 262144,
         maxOutputTokens: 8192
@@ -23431,7 +23392,7 @@ var init_models = __esm({
         description: "Mid-tier Nemotron via Alan",
         enabled: true,
         isDefault: false,
-        sortOrder: 100,
+        sortOrder: 80,
         upstreamModelId: "nvidia/nemotron-3-super-120b-a12b",
         contextWindow: 262144,
         maxOutputTokens: 16384
@@ -23442,18 +23403,29 @@ var init_models = __esm({
         description: "Largest Nemotron via Alan",
         enabled: true,
         isDefault: false,
-        sortOrder: 110,
+        sortOrder: 90,
         upstreamModelId: "nvidia/nemotron-3-ultra-550b-a55b",
         contextWindow: 262144,
         maxOutputTokens: 16384
       },
+      {
+        id: "nvidia/nemotron-3.5-lightning",
+        name: "Nemotron 3.5 Lightning",
+        description: "Small, fast Nemotron for high-volume work",
+        enabled: true,
+        isDefault: false,
+        sortOrder: 100,
+        upstreamModelId: "nvidia/nemotron-3.5-lightning",
+        contextWindow: 262144,
+        maxOutputTokens: 8192
+      },
       {
         id: "meta/muse-spark-1.3-contributor",
         name: "Muse Spark 1.3 Contributor",
         description: "Cost-efficient Muse Spark (contributor tier)",
         enabled: true,
         isDefault: false,
-        sortOrder: 120,
+        sortOrder: 110,
         upstreamModelId: "meta/muse-spark-1.3-contributor",
         contextWindow: 1048576,
         maxOutputTokens: 16384
@@ -23464,7 +23436,7 @@ var init_models = __esm({
         description: "Meta Muse Spark multimodal agentic coding",
         enabled: true,
         isDefault: false,
-        sortOrder: 130,
+        sortOrder: 120,
         upstreamModelId: "meta/muse-spark-1.3",
         contextWindow: 1048576,
         maxOutputTokens: 16384
@@ -23475,7 +23447,7 @@ var init_models = __esm({
         description: "Prior Muse Spark contributor tier",
         enabled: true,
         isDefault: false,
-        sortOrder: 140,
+        sortOrder: 130,
         upstreamModelId: "meta/muse-spark-1.2-contributor",
         contextWindow: 1048576,
         maxOutputTokens: 16384
@@ -26388,8 +26360,8 @@ function createJsonRpcPeer(writer, handlers) {
     },
     request: (method, params = {}) => {
       const id = counter.next++;
-      return new Promise((resolve12, reject) => {
-        pending.set(id, { method, resolve: resolve12, reject });
+      return new Promise((resolve13, reject) => {
+        pending.set(id, { method, resolve: resolve13, reject });
         writer.write({ id, method, params }).catch((error61) => {
           pending.delete(id);
           reject(error61 instanceof Error ? error61 : new Error(String(error61)));
@@ -26502,7 +26474,7 @@ function createNdjsonWriter(stream) {
     get writable() {
       return stream.writable && !stream.destroyed && failure6.error === void 0;
     },
-    write: (value2) => new Promise((resolve12, reject) => {
+    write: (value2) => new Promise((resolve13, reject) => {
       if (failure6.error) {
         reject(failure6.error);
         return;
@@ -26514,7 +26486,7 @@ function createNdjsonWriter(stream) {
       stream.write(`${JSON.stringify(value2)}
 `, (error61) => {
         if (error61) reject(error61);
-        else resolve12();
+        else resolve13();
       });
     }),
     end: () => {
@@ -26530,11 +26502,11 @@ function hostProcess(child, tree, options, handlers) {
   const stderr = new LineSplitter((line) => handlers.onStderrLine(line));
   child.stderr.on("data", (chunk) => stderr.push(chunk));
   child.stderr.once("end", () => stderr.flush());
-  const processExit = new Promise((resolve12) => {
-    child.once("exit", (code, signal) => resolve12({ code, signal }));
+  const processExit = new Promise((resolve13) => {
+    child.once("exit", (code, signal) => resolve13({ code, signal }));
   });
-  const outputEnded = new Promise((resolve12) => {
-    child.stdout.once("close", () => resolve12());
+  const outputEnded = new Promise((resolve13) => {
+    child.stdout.once("close", () => resolve13());
   });
   const watch = async () => {
     const { clock, stdoutDrainMs, log, name } = options;
@@ -26823,13 +26795,13 @@ var init_chunk_VMGVHPBB = __esm({
         const turnId = input2.turnId;
         let finish = () => {
         };
-        const done = new Promise((resolve12) => {
+        const done = new Promise((resolve13) => {
           finish = (outcome2) => {
             if (this.#current?.id !== turnId) return;
             this.#current = void 0;
             if (this.#state === "busy") this.#state = "idle";
             this.#emit({ type: "turn_ended", turnId, outcome: outcome2 });
-            resolve12({ turnId, outcome: outcome2, providerSessionId: this.#sessionId });
+            resolve13({ turnId, outcome: outcome2, providerSessionId: this.#sessionId });
           };
         });
         const pending = {
@@ -27057,7 +27029,7 @@ var init_chunk_J2KTV5FP = __esm({
   }
 });
 
-// ../agent-core/dist/chunk-ITTV3UIM.js
+// ../agent-core/dist/chunk-VX6QVMKD.js
 function truncate(value2, limit) {
   const normalized2 = Array.from(value2, (character) => {
     const code = character.charCodeAt(0);
@@ -27146,7 +27118,7 @@ function currentUserSection(user, visibility) {
   if (user.name) lines2.push(`- **Name**: ${user.name}`);
   lines2.push(`- **Email**: ${user.email}`, `- **User ID**: ${user.id}`, "");
   lines2.push(
-    visibility === "team" ? "This session is shared with the team. When creating tasks or assigning work, create them on this team. The person above started the session." : visibility === "private" ? "This session is private to this person. When creating tasks or assigning work, default to assigning to this user unless explicitly instructed otherwise." : "This is the person who initiated this conversation. When creating tasks or assigning work, default to assigning to this user unless explicitly instructed otherwise."
+    visibility === "team" ? "This session is shared with the team. The person above sent the current request. When creating tasks or assigning work, create them on this team." : visibility === "private" ? "This session is private to this person. When creating tasks or assigning work, default to assigning to this user unless explicitly instructed otherwise." : "This is the person who initiated this conversation. When creating tasks or assigning work, default to assigning to this user unless explicitly instructed otherwise."
   );
   return lines2.join("\n");
 }
@@ -27418,8 +27390,8 @@ ${body}` : body;
   return spec.mode === "plan" ? planModePrefix(prefixed) : prefixed;
 }
 var MAX_PARSED_ATTACHMENTS, MAX_PARSED_ATTACHMENT_CHARS, MAX_METADATA_CHARS, UNAVAILABLE, READ_ONLY_MODES, AGENT_MODES;
-var init_chunk_ITTV3UIM = __esm({
-  "../agent-core/dist/chunk-ITTV3UIM.js"() {
+var init_chunk_VX6QVMKD = __esm({
+  "../agent-core/dist/chunk-VX6QVMKD.js"() {
     "use strict";
     init_agent2();
     MAX_PARSED_ATTACHMENTS = 3;
@@ -27535,6 +27507,7 @@ function buildClaudeArgs(input2) {
     ...capabilities.supportsThinkingDisplay ? ["--thinking-display", "summarized"] : [],
     // Without it the whole answer lands in one frame at turn end.
     ...capabilities.supportsPartialMessages ? ["--include-partial-messages"] : [],
+    ...capabilities.supportsPluginDir ? (input2.pluginDirs ?? []).flatMap((dir) => ["--plugin-dir", dir]) : [],
     ...option("--resume", input2.resumeId),
     "--chrome",
     ...input2.extraArgs ?? []
@@ -27547,18 +27520,21 @@ function createClaudeCapabilityProbe(probe = createFlagProbe()) {
         supportsApproveMcps,
         supportsThinkingDisplay,
         supportsPartialMessages,
-        supportsReplayUserMessages
+        supportsReplayUserMessages,
+        supportsPluginDir
       ] = await Promise.all([
         needsApproveMcps ? probe.supportsFlag(command, "--approve-mcps", env) : false,
         probe.supportsHiddenChoiceFlag(command, "--thinking-display", env),
         probe.supportsFlag(command, "--include-partial-messages", env),
-        probe.supportsFlag(command, "--replay-user-messages", env)
+        probe.supportsFlag(command, "--replay-user-messages", env),
+        probe.supportsFlag(command, "--plugin-dir", env)
       ]);
       return {
         supportsApproveMcps,
         supportsThinkingDisplay,
         supportsPartialMessages,
-        supportsReplayUserMessages
+        supportsReplayUserMessages,
+        supportsPluginDir
       };
     }
   };
@@ -28446,6 +28422,7 @@ function planClaudeSession(run2, context) {
     ...run2.selectedEffortLevel === void 0 ? {} : { effortLevel: run2.selectedEffortLevel },
     ...prompts.systemPrompt === void 0 ? {} : { systemPrompt: prompts.systemPrompt },
     ...prompts.systemPromptAppend === void 0 ? {} : { appendSystemPrompt: prompts.systemPromptAppend },
+    ...context.pluginDirs?.length ? { pluginDirs: context.pluginDirs } : {},
     ...context.managedMcp === void 0 ? {} : {
       mcp: {
         alanMcpUrl: context.managedMcp.url,
@@ -28694,7 +28671,7 @@ var init_claude = __esm({
     init_chunk_54ZRJOQP();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
-    init_chunk_ITTV3UIM();
+    init_chunk_VX6QVMKD();
     init_chunk_YXWJW7I5();
     init_effort();
     import_crypto6 = require("crypto");
@@ -29417,8 +29394,8 @@ var init_claude = __esm({
       }
       async #awaitTaskStop(requestId, taskId) {
         const timer = new AbortController();
-        const answered = new Promise((resolve12) => {
-          this.#taskStops.set(requestId, resolve12);
+        const answered = new Promise((resolve13) => {
+          this.#taskStops.set(requestId, resolve13);
         });
         const timeoutMs = this.#options.stopTaskTimeoutMs;
         const timedOut = this.#options.clock.sleep(timeoutMs, timer.signal).then(
@@ -29491,17 +29468,17 @@ var init_claude = __esm({
         };
         let markStarted = () => {
         };
-        const whenStarted = new Promise((resolve12) => {
-          markStarted = resolve12;
+        const whenStarted = new Promise((resolve13) => {
+          markStarted = resolve13;
         });
-        const done = new Promise((resolve12) => {
+        const done = new Promise((resolve13) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
             this.#lastTurn = turn;
             if (this.#state === "busy") this.#state = "idle";
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve12({ turnId: id, outcome: outcome2, providerSessionId: this.#providerSessionId });
+            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#providerSessionId });
           };
         });
         const active = {
@@ -29619,8 +29596,8 @@ var init_claude = __esm({
         void removeLaunchFiles(this.#launchFiles).catch((error61) => {
           this.#options.log.warn("claude.launch_files_cleanup_failed", { error: error61 });
         });
-        for (const resolve12 of this.#taskStops.values()) {
-          resolve12({ ok: false, reason: "runtime_unavailable", message: "Claude Code exited." });
+        for (const resolve13 of this.#taskStops.values()) {
+          resolve13({ ok: false, reason: "runtime_unavailable", message: "Claude Code exited." });
         }
         const active = this.#current;
         if (active) {
@@ -31482,7 +31459,7 @@ var init_codex = __esm({
     init_chunk_54ZRJOQP();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
-    init_chunk_ITTV3UIM();
+    init_chunk_VX6QVMKD();
     init_chunk_YXWJW7I5();
     import_fs6 = require("fs");
     import_path6 = require("path");
@@ -32101,10 +32078,10 @@ var init_codex = __esm({
         };
         let identify = () => {
         };
-        const identified = new Promise((resolve12) => {
-          identify = resolve12;
+        const identified = new Promise((resolve13) => {
+          identify = resolve13;
         });
-        const done = new Promise((resolve12) => {
+        const done = new Promise((resolve13) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
@@ -32112,7 +32089,7 @@ var init_codex = __esm({
             if (this.#state === "busy") this.#state = "idle";
             this.#host.scanDescendants(true);
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve12({ turnId: id, outcome: outcome2, providerSessionId: this.#threadId });
+            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#threadId });
           };
         });
         const active = {
@@ -32625,6 +32602,11 @@ function alanCodeConfigContent(existing, input2) {
   return JSON.stringify({
     $schema: "https://opencode.ai/config.json",
     ...config2,
+    // OpenCode writes a whole working-tree diff into every user message summary and re-persists
+    // the message on each update, so a large diff lands in the shared store many times over:
+    // 3.4 GB of a dev machine's engine database was these patches, against 82 sessions. Alan
+    // does not use the engine's undo/revert, so the tracking stays off.
+    snapshot: false,
     model: `${ALAN_CODE_ENGINE_PROVIDER_ID}/${input2.modelId}`,
     enabled_providers: [ALAN_CODE_ENGINE_PROVIDER_ID],
     provider: {
@@ -32650,7 +32632,7 @@ function alanCodeConfigContent(existing, input2) {
   });
 }
 function readBody2(response) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const chunks = [];
     let size = 0;
     response.on("data", (chunk) => {
@@ -32658,7 +32640,7 @@ function readBody2(response) {
       if (size > MAX_CATALOG_BYTES) response.destroy(new Error("catalog too large"));
       else chunks.push(chunk);
     });
-    response.on("end", () => resolve12(Buffer.concat(chunks).toString("utf8")));
+    response.on("end", () => resolve13(Buffer.concat(chunks).toString("utf8")));
     response.on("error", reject);
   });
 }
@@ -32674,13 +32656,13 @@ function parseResponseBody(text2, status) {
 }
 function getJson(url3, headers, timeout, signal) {
   const request2 = url3.protocol === "https:" ? import_https.request : import_http9.request;
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const outgoing = request2(url3, { method: "GET", headers, timeout, signal }, (response) => {
       const status = response.statusCode ?? 0;
       readBody2(response).then((text2) => {
         const body = parseResponseBody(text2, status);
         if (status < 200 || status >= 300) reject(new CatalogResponseError(status, body));
-        else resolve12(body);
+        else resolve13(body);
       }).catch(reject);
     });
     outgoing.on("timeout", () => outgoing.destroy(new Error("catalog timed out")));
@@ -41556,8 +41538,8 @@ var require_streamx = __commonJS({
             return this;
           },
           next() {
-            return new Promise(function(resolve12, reject) {
-              promiseResolve = resolve12;
+            return new Promise(function(resolve13, reject) {
+              promiseResolve = resolve13;
               promiseReject = reject;
               const data = stream.read();
               if (data !== null) ondata(data);
@@ -41590,11 +41572,11 @@ var require_streamx = __commonJS({
         }
         function destroy(err) {
           stream.destroy(err);
-          return new Promise((resolve12, reject) => {
-            if (stream._duplexState & DESTROYED) return resolve12({ value: void 0, done: true });
+          return new Promise((resolve13, reject) => {
+            if (stream._duplexState & DESTROYED) return resolve13({ value: void 0, done: true });
             stream.once("close", function() {
               if (err) reject(err);
-              else resolve12({ value: void 0, done: true });
+              else resolve13({ value: void 0, done: true });
             });
           });
         }
@@ -41638,8 +41620,8 @@ var require_streamx = __commonJS({
         const writes = pending + (ws._duplexState & WRITE_WRITING ? 1 : 0);
         if (writes === 0) return Promise.resolve(true);
         if (state.drains === null) state.drains = [];
-        return new Promise((resolve12) => {
-          state.drains.push({ writes, resolve: resolve12 });
+        return new Promise((resolve13) => {
+          state.drains.push({ writes, resolve: resolve13 });
         });
       }
       write(data) {
@@ -41744,10 +41726,10 @@ var require_streamx = __commonJS({
       cb(null);
     }
     function pipelinePromise(...streams) {
-      return new Promise((resolve12, reject) => {
+      return new Promise((resolve13, reject) => {
         return pipeline(...streams, (err) => {
           if (err) return reject(err);
-          resolve12();
+          resolve13();
         });
       });
     }
@@ -42419,16 +42401,16 @@ var require_extract = __commonJS({
           entryCallback = null;
           cb(err);
         }
-        function onnext(resolve12, reject) {
+        function onnext(resolve13, reject) {
           if (error61) {
             return reject(error61);
           }
           if (entryStream) {
-            resolve12({ value: entryStream, done: false });
+            resolve13({ value: entryStream, done: false });
             entryStream = null;
             return;
           }
-          promiseResolve = resolve12;
+          promiseResolve = resolve13;
           promiseReject = reject;
           consumeCallback(null);
           if (extract2._finished && promiseResolve) {
@@ -42456,11 +42438,11 @@ var require_extract = __commonJS({
         function destroy(err) {
           extract2.destroy(err);
           consumeCallback(err);
-          return new Promise((resolve12, reject) => {
-            if (extract2.destroyed) return resolve12({ value: void 0, done: true });
+          return new Promise((resolve13, reject) => {
+            if (extract2.destroyed) return resolve13({ value: void 0, done: true });
             extract2.once("close", function() {
               if (err) reject(err);
-              else resolve12({ value: void 0, done: true });
+              else resolve13({ value: void 0, done: true });
             });
           });
         }
@@ -42842,7 +42824,7 @@ function within(root, path4) {
 }
 async function resolveReal(path4) {
   try {
-    return await (0, import_promises48.realpath)(path4);
+    return await (0, import_promises49.realpath)(path4);
   } catch {
     const parent = (0, import_path9.dirname)(path4);
     if (parent === path4) return path4;
@@ -42871,14 +42853,14 @@ function createWorkspaceFs(roots, writable) {
   return {
     read: async (params) => {
       const path4 = await confined(params);
-      const bytes = await (0, import_promises48.readFile)(path4);
+      const bytes = await (0, import_promises49.readFile)(path4);
       if (bytes.byteLength > MAX_READ_BYTES) throw new FsDenied(`${path4} is too large to read`);
       return { content: sliceLines(bytes.toString("utf8"), params) };
     },
     write: async (params) => {
       if (!writable) throw new FsDenied("This session is read-only");
       const path4 = await confined(params);
-      await (0, import_promises48.writeFile)(path4, asString(params.content));
+      await (0, import_promises49.writeFile)(path4, asString(params.content));
       return {};
     }
   };
@@ -43481,7 +43463,7 @@ async function acpTurnInput(run2, context) {
   const encoded = await Promise.all(
     images.map(async (image) => ({
       mimeType: image.mimeType,
-      data: (await (0, import_promises49.readFile)(image.path)).toString("base64")
+      data: (await (0, import_promises50.readFile)(image.path)).toString("base64")
     }))
   );
   return {
@@ -43490,7 +43472,7 @@ async function acpTurnInput(run2, context) {
     ...encoded.length ? { images: encoded, imagePaths: images.map((image) => image.path) } : {}
   };
 }
-var import_promises48, import_path9, import_crypto12, import_promises49, CURSOR_ASK_QUESTION, copilotAcpProfile, cursorAcpProfile, MODEL_REJECTED, MAX_READ_BYTES, FsDenied, ENV_REFERENCE, AcpBackgroundTasks, CURSOR_CREATE_PLAN, STATUSES2, READ_KINDS, ALLOW_KINDS, REJECT_KINDS, CANCELLED_PERMISSION, STOP_REASONS, CHUNKS, ECHOES, AcpTurn, STDERR_TAIL_LINES4, MAX_BETWEEN_UPDATES2, AcpSession, DEFAULTS3, CLIENT_INFO2, TASK_BACKGROUNDED, TASK_COMPLETED, SESSION_NOTIFICATION, KILLED_STATUSES, SUCCESS_STATUSES, SUBAGENT_ID, grokTaskDialect, grokAcpProfile, kimiAcpProfile, ACP_PROFILES, ACP_MODES;
+var import_promises49, import_path9, import_crypto12, import_promises50, CURSOR_ASK_QUESTION, copilotAcpProfile, cursorAcpProfile, MODEL_REJECTED, MAX_READ_BYTES, FsDenied, ENV_REFERENCE, AcpBackgroundTasks, CURSOR_CREATE_PLAN, STATUSES2, READ_KINDS, ALLOW_KINDS, REJECT_KINDS, CANCELLED_PERMISSION, STOP_REASONS, CHUNKS, ECHOES, AcpTurn, STDERR_TAIL_LINES4, MAX_BETWEEN_UPDATES2, AcpSession, DEFAULTS3, CLIENT_INFO2, TASK_BACKGROUNDED, TASK_COMPLETED, SESSION_NOTIFICATION, KILLED_STATUSES, SUCCESS_STATUSES, SUBAGENT_ID, grokTaskDialect, grokAcpProfile, kimiAcpProfile, ACP_PROFILES, ACP_MODES;
 var init_acp3 = __esm({
   "../agent-core/dist/providers/acp.js"() {
     "use strict";
@@ -43499,14 +43481,14 @@ var init_acp3 = __esm({
     init_chunk_54ZRJOQP();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
-    init_chunk_ITTV3UIM();
+    init_chunk_VX6QVMKD();
     init_chunk_YXWJW7I5();
-    import_promises48 = require("fs/promises");
+    import_promises49 = require("fs/promises");
     import_path9 = require("path");
     init_effort();
     init_acp();
     import_crypto12 = require("crypto");
-    import_promises49 = require("fs/promises");
+    import_promises50 = require("fs/promises");
     init_agent2();
     CURSOR_ASK_QUESTION = "cursor/ask_question";
     copilotAcpProfile = {
@@ -44022,7 +44004,7 @@ var init_acp3 = __esm({
         const turn = new AcpTurn(`acp-${this.#turns}-${id}`, this.#profile);
         let finish = () => {
         };
-        const done = new Promise((resolve12) => {
+        const done = new Promise((resolve13) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
@@ -44030,7 +44012,7 @@ var init_acp3 = __esm({
             if (this.#state === "busy") this.#state = "idle";
             this.#host.scanDescendants(true);
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve12({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
+            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
           };
         });
         const active = { id, turn, done, finish, cancelRequested: false };
@@ -44726,10 +44708,14 @@ function openCodeConfigContent(input2) {
       enabled: true
     };
   }
+  const skills = asRecord(config2.skills) ?? {};
+  const ownPaths = Array.isArray(skills.paths) ? skills.paths : [];
+  const skillPaths = input2.skillPaths ?? [];
   return JSON.stringify({
     ...config2,
     ...input2.readOnly ? {} : { permission: "allow" },
-    ...Object.keys(mcp).length ? { mcp } : {}
+    ...Object.keys(mcp).length ? { mcp } : {},
+    ...skillPaths.length ? { skills: { ...skills, paths: [...ownPaths, ...skillPaths] } } : {}
   });
 }
 function storedParts(message2) {
@@ -45024,7 +45010,7 @@ async function sameDirectory(left, right) {
 }
 async function canonicalDirectory(directory) {
   try {
-    return await (0, import_promises50.realpath)(directory);
+    return await (0, import_promises51.realpath)(directory);
   } catch {
     return (0, import_path10.resolve)(directory);
   }
@@ -45049,6 +45035,57 @@ async function openSession(session, client, spec, log) {
   const id = await client.createSession({ title: spec.title, permission: NON_INTERACTIVE_RULES });
   return { id, resumed: false };
 }
+function isOpenTimeout(error61) {
+  return error61 instanceof CoreFault && error61.code === "protocol_violation";
+}
+async function openOnce(spec, password, options) {
+  const attempt2 = { abandoned: false };
+  const { session, url: url3 } = await withDeadline3(
+    startServer(spec, password, options, attempt2),
+    options.clock,
+    options.openTimeoutMs,
+    "report a listening URL"
+  ).catch(async (error61) => {
+    attempt2.abandoned = true;
+    await attempt2.current?.suspend().catch(() => void 0);
+    throw error61;
+  });
+  try {
+    const client = new OpenCodeClient(url3, password, options.engine.label);
+    const opened = await withDeadline3(
+      openSession(session, client, spec, options.log),
+      options.clock,
+      options.openTimeoutMs,
+      "open a session"
+    );
+    session.attach(
+      opened.id,
+      spec.prompt,
+      expiredSignInNotices(spec.env, options.clock.now()),
+      opened.resumed
+    );
+  } catch (error61) {
+    await session.suspend().catch(() => void 0);
+    throw error61;
+  }
+  options.log.info("opencode.opened", {
+    pid: session.pid,
+    sessionId: session.providerSessionId,
+    resumeFailed: session.resumeFailed
+  });
+  return session;
+}
+async function openWithRetries(spec, password, options) {
+  for (let tries = 1; ; tries += 1) {
+    try {
+      return await openOnce(spec, password, options);
+    } catch (error61) {
+      if (!isOpenTimeout(error61) || tries >= options.openAttempts) throw error61;
+      options.log.warn("opencode.open_retry", { tries });
+      await options.clock.sleep(options.reconnectDelayMs);
+    }
+  }
+}
 function createOpenCodeDriver(options = {}) {
   const resolved = {
     clock: options.clock ?? systemClock2,
@@ -45058,6 +45095,7 @@ function createOpenCodeDriver(options = {}) {
     stdoutDrainMs: options.stdoutDrainMs ?? DEFAULTS4.stdoutDrainMs,
     descendantScanMs: options.descendantScanMs ?? DEFAULTS4.descendantScanMs,
     openTimeoutMs: options.openTimeoutMs ?? DEFAULTS4.openTimeoutMs,
+    openAttempts: options.openAttempts ?? DEFAULTS4.openAttempts,
     startAttempts: options.startAttempts ?? DEFAULTS4.startAttempts,
     reconnectAttempts: options.reconnectAttempts ?? DEFAULTS4.reconnectAttempts,
     reconnectDelayMs: options.reconnectDelayMs ?? DEFAULTS4.reconnectDelayMs,
@@ -45073,45 +45111,16 @@ function createOpenCodeDriver(options = {}) {
       };
       const spec = { ...planned, env: launchEnv(planned, authorization) };
       const password = options.password?.() ?? (0, import_crypto13.randomBytes)(24).toString("base64url");
-      const attempt2 = { abandoned: false };
-      const { session, url: url3 } = await withDeadline3(
-        startServer(spec, password, resolved, attempt2),
-        resolved.clock,
-        resolved.openTimeoutMs,
-        "report a listening URL"
-      ).catch(async (error61) => {
-        attempt2.abandoned = true;
-        await attempt2.current?.suspend().catch(() => void 0);
-        await removeAuthorization();
-        throw error61;
-      });
-      void session.exited.then(removeAuthorization).catch((error61) => {
-        resolved.log.warn("opencode.authorization_cleanup_failed", { error: error61 });
-      });
       try {
-        const client = new OpenCodeClient(url3, password, resolved.engine.label);
-        const opened = await withDeadline3(
-          openSession(session, client, spec, resolved.log),
-          resolved.clock,
-          resolved.openTimeoutMs,
-          "open a session"
-        );
-        session.attach(
-          opened.id,
-          spec.prompt,
-          expiredSignInNotices(spec.env, resolved.clock.now()),
-          opened.resumed
-        );
+        const session = await openWithRetries(spec, password, resolved);
+        void session.exited.then(removeAuthorization).catch((error61) => {
+          resolved.log.warn("opencode.authorization_cleanup_failed", { error: error61 });
+        });
+        return session;
       } catch (error61) {
-        await session.suspend().catch(() => void 0);
+        await removeAuthorization();
         throw error61;
       }
-      resolved.log.info("opencode.opened", {
-        pid: session.pid,
-        sessionId: session.providerSessionId,
-        resumeFailed: session.resumeFailed
-      });
-      return session;
     }
   };
 }
@@ -45144,6 +45153,7 @@ function planOpenCodeSession(run2, context) {
   const config2 = {
     existing: baseEnv[OPENCODE_CONFIG_ENV],
     readOnly,
+    ...context.skillPaths?.length ? { skillPaths: context.skillPaths } : {},
     mcp: {
       conversationId: run2.conversationId,
       externalServers: mcp.servers,
@@ -45196,7 +45206,7 @@ function openCodeTurnInput(run2, context) {
     ...images.length ? { imagePaths: images.map((image) => image.path) } : {}
   };
 }
-var import_http10, import_crypto13, import_promises50, import_path10, import_path11, import_url2, import_crypto14, IDLE_SOCKET_MS3, OpenCodeHttpError, OpenCodeClient, OPENCODE_CONFIG_ENV, OPENCODE_ENGINE, TEXT_PARTS, STEP_PARTS, STOPPED_BY_USER, OpenCodeSubagents, NAMED_KINDS, OPENCODE_ABORTED_ERROR, PROVIDER_EVENT_META, TASK_TOOL_NAME, TASK_RESULT_TAG, TASK_ERROR_TAG, PERMISSION_DENIED, FILE_OPERATIONS2, PartReader, NOTHING, NON_INTERACTIVE_PERMISSIONS, CONTENT_FILTER_FINISHES, OUTPUT_PARTS, OpenCodeTurn, LISTENING, OUTPUT_TAIL_LINES, IMAGE_TYPES, OpenCodeSession, OPENCODE_MIN_VERSION, OPENCODE_REQUIREMENT, OPENCODE_TESTED_LINE, OPENCODE_SUPPORTED_MAJOR, DEFAULTS4, STORE_LOCKED, NON_INTERACTIVE_RULES, TITLE_LENGTH, MAX_VARIANT_LENGTH;
+var import_http10, import_crypto13, import_promises51, import_path10, import_path11, import_url2, import_crypto14, IDLE_SOCKET_MS3, OpenCodeHttpError, OpenCodeClient, OPENCODE_CONFIG_ENV, OPENCODE_ENGINE, TEXT_PARTS, STEP_PARTS, STOPPED_BY_USER, OpenCodeSubagents, NAMED_KINDS, OPENCODE_ABORTED_ERROR, PROVIDER_EVENT_META, TASK_TOOL_NAME, TASK_RESULT_TAG, TASK_ERROR_TAG, PERMISSION_DENIED, FILE_OPERATIONS2, PartReader, NOTHING, NON_INTERACTIVE_PERMISSIONS, CONTENT_FILTER_FINISHES, OUTPUT_PARTS, OpenCodeTurn, LISTENING, OUTPUT_TAIL_LINES, IMAGE_TYPES, OpenCodeSession, OPENCODE_MIN_VERSION, OPENCODE_REQUIREMENT, OPENCODE_TESTED_LINE, OPENCODE_SUPPORTED_MAJOR, DEFAULTS4, STORE_LOCKED, NON_INTERACTIVE_RULES, TITLE_LENGTH, MAX_VARIANT_LENGTH;
 var init_opencode = __esm({
   "../agent-core/dist/providers/opencode.js"() {
     "use strict";
@@ -45205,12 +45215,12 @@ var init_opencode = __esm({
     init_chunk_54ZRJOQP();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
-    init_chunk_ITTV3UIM();
+    init_chunk_VX6QVMKD();
     init_chunk_YXWJW7I5();
     import_http10 = require("http");
     init_runtime_v2();
     import_crypto13 = require("crypto");
-    import_promises50 = require("fs/promises");
+    import_promises51 = require("fs/promises");
     import_path10 = require("path");
     init_agent2();
     import_path11 = require("path");
@@ -46296,6 +46306,7 @@ var init_opencode = __esm({
       stdoutDrainMs: 2e3,
       descendantScanMs: 5e3,
       openTimeoutMs: 6e4,
+      openAttempts: 2,
       startAttempts: 3,
       reconnectAttempts: 3,
       reconnectDelayMs: 500,
@@ -46374,6 +46385,7 @@ function createAlanCodeHolderDriver(options) {
           engineRoot,
           requestedModel: spec.model
         };
+        const skills = options.installedSkills?.() ?? null;
         const planned = planOpenCodeSession(spec, {
           command: engine.command,
           cwd: spec.projectPath ?? options.defaultCwd,
@@ -46383,7 +46395,8 @@ function createAlanCodeHolderDriver(options) {
           },
           providerEnv: inputs.providerEnv,
           ...managedMcp === void 0 ? {} : { managedMcp },
-          ...resumeId === void 0 ? {} : { resumeSessionId: resumeId }
+          ...resumeId === void 0 ? {} : { resumeSessionId: resumeId },
+          ...skills === null ? {} : { skillPaths: [skills.skillsDir] }
         });
         return {
           spec: { opencode: planned.spec, profile },
@@ -46434,14 +46447,18 @@ function createClaudeHolderDriver(options) {
     {
       harness: "claude_cli",
       displayName: "Claude CLI",
-      plan: (spec, inputs, resumeId, managedMcp) => planClaudeSession(spec, {
-        command: options.command ?? "claude",
-        cwd: spec.projectPath ?? options.defaultCwd,
-        cliEnv: options.cliEnvironment,
-        providerEnv: inputs.providerEnv,
-        ...managedMcp === void 0 ? {} : { managedMcp },
-        ...resumeId === void 0 ? {} : { resumeId }
-      }),
+      plan: (spec, inputs, resumeId, managedMcp) => {
+        const skills = options.installedSkills?.() ?? null;
+        return planClaudeSession(spec, {
+          command: options.command ?? "claude",
+          cwd: spec.projectPath ?? options.defaultCwd,
+          cliEnv: options.cliEnvironment,
+          providerEnv: inputs.providerEnv,
+          ...managedMcp === void 0 ? {} : { managedMcp },
+          ...resumeId === void 0 ? {} : { resumeId },
+          ...skills === null ? {} : { pluginDirs: [skills.pluginDir] }
+        });
+      },
       canResume: (planned, resumeId) => claudeSessionLogExists({
         sessionId: resumeId,
         cwd: planned.spec.cwd,
@@ -46478,7 +46495,7 @@ __export(codex_exports, {
   createCodexHolderDriver: () => createCodexHolderDriver
 });
 function sha2563(value2) {
-  return (0, import_node_crypto26.createHash)("sha256").update(value2).digest("hex");
+  return (0, import_node_crypto27.createHash)("sha256").update(value2).digest("hex");
 }
 function createCodexLogin(broker) {
   const state = {};
@@ -46553,11 +46570,11 @@ function createCodexHolderDriver(options) {
     }
   );
 }
-var import_node_crypto26;
+var import_node_crypto27;
 var init_codex2 = __esm({
   "src/holder/drivers/codex.ts"() {
     "use strict";
-    import_node_crypto26 = require("crypto");
+    import_node_crypto27 = require("crypto");
     init_dist();
     init_codex();
     init_persistent();
@@ -46664,8 +46681,8 @@ function createDroidPeer(writer, handlers) {
     },
     request: (method, params = {}) => {
       const id = `alan-${counter.next++}`;
-      return new Promise((resolve12, reject) => {
-        pending.set(id, { method, resolve: resolve12, reject });
+      return new Promise((resolve13, reject) => {
+        pending.set(id, { method, resolve: resolve13, reject });
         writer.write(envelope("request", { id, method, params })).catch((error61) => {
           pending.delete(id);
           reject(error61 instanceof Error ? error61 : new Error(String(error61)));
@@ -47000,12 +47017,12 @@ async function droidTurnInput(run2, context) {
   const encoded = await Promise.all(
     images.map(async (image) => ({
       mimeType: image.mimeType,
-      data: (await (0, import_promises51.readFile)(image.path)).toString("base64")
+      data: (await (0, import_promises52.readFile)(image.path)).toString("base64")
     }))
   );
   return { turnId: run2.runId, text: text2, ...encoded.length ? { images: encoded } : {} };
 }
-var import_crypto15, import_promises51, FACTORY_API_VERSION, FACTORY_PROTOCOL_VERSION, SUBAGENT_TOOLS, TASK_OUTPUT_TOOLS, TASK_STOP_TOOLS, SILENT2, DroidTurn, STDERR_TAIL_LINES5, UNSUPPORTED_REQUEST2, DroidSession, DEFAULTS5, DROID_REQUIREMENT, DROID_JSONRPC_ARGS;
+var import_crypto15, import_promises52, FACTORY_API_VERSION, FACTORY_PROTOCOL_VERSION, SUBAGENT_TOOLS, TASK_OUTPUT_TOOLS, TASK_STOP_TOOLS, SILENT2, DroidTurn, STDERR_TAIL_LINES5, UNSUPPORTED_REQUEST2, DroidSession, DEFAULTS5, DROID_REQUIREMENT, DROID_JSONRPC_ARGS;
 var init_droid = __esm({
   "../agent-core/dist/providers/droid.js"() {
     "use strict";
@@ -47014,11 +47031,11 @@ var init_droid = __esm({
     init_chunk_54ZRJOQP();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
-    init_chunk_ITTV3UIM();
+    init_chunk_VX6QVMKD();
     init_chunk_YXWJW7I5();
     init_runtime_v2();
     import_crypto15 = require("crypto");
-    import_promises51 = require("fs/promises");
+    import_promises52 = require("fs/promises");
     init_agent2();
     FACTORY_API_VERSION = "1.0.0";
     FACTORY_PROTOCOL_VERSION = "1.187.0";
@@ -47290,14 +47307,14 @@ var init_droid = __esm({
         const turn = new DroidTurn(sessionId, this.#memory);
         let finish = () => {
         };
-        const done = new Promise((resolve12) => {
+        const done = new Promise((resolve13) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
             if (this.#state === "busy") this.#state = "idle";
             this.#host.scanDescendants(true);
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve12({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
+            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
           };
         });
         const active = { id, turn, done, finish, cancelRequested: false };
@@ -47445,14 +47462,18 @@ function createOpenCodeHolderDriver(options) {
     {
       harness: "opencode_serve",
       displayName: "OpenCode server",
-      plan: (spec, inputs, resumeId, managedMcp) => planOpenCodeSession(spec, {
-        command: options.command ?? "opencode",
-        cwd: spec.projectPath ?? options.defaultCwd,
-        cliEnv: options.cliEnvironment,
-        providerEnv: inputs.providerEnv,
-        ...managedMcp === void 0 ? {} : { managedMcp },
-        ...resumeId === void 0 ? {} : { resumeSessionId: resumeId }
-      }),
+      plan: (spec, inputs, resumeId, managedMcp) => {
+        const skills = options.installedSkills?.() ?? null;
+        return planOpenCodeSession(spec, {
+          command: options.command ?? "opencode",
+          cwd: spec.projectPath ?? options.defaultCwd,
+          cliEnv: options.cliEnvironment,
+          providerEnv: inputs.providerEnv,
+          ...managedMcp === void 0 ? {} : { managedMcp },
+          ...resumeId === void 0 ? {} : { resumeSessionId: resumeId },
+          ...skills === null ? {} : { skillPaths: [skills.skillsDir] }
+        });
+      },
       canResume: () => true,
       open: async (spec) => {
         const session = await sessions.open(spec);
@@ -47489,7 +47510,7 @@ function settingsPath(env) {
 async function readSettings2(path4) {
   let raw;
   try {
-    raw = (await (0, import_promises52.readFile)(path4, "utf8")).trim();
+    raw = (await (0, import_promises53.readFile)(path4, "utf8")).trim();
   } catch {
     return {};
   }
@@ -47507,8 +47528,8 @@ async function selectAntigravityApiKeyMode(env) {
   const settings2 = await readSettings2(path4);
   if (settings2 === "malformed") return "malformed";
   if (settings2.modelProvider === "gemini") return "already_selected";
-  await (0, import_promises52.mkdir)((0, import_path12.dirname)(path4), { recursive: true });
-  await (0, import_promises52.writeFile)(path4, JSON.stringify({ ...settings2, modelProvider: "gemini" }), { mode: 384 });
+  await (0, import_promises53.mkdir)((0, import_path12.dirname)(path4), { recursive: true });
+  await (0, import_promises53.writeFile)(path4, JSON.stringify({ ...settings2, modelProvider: "gemini" }), { mode: 384 });
   return "selected";
 }
 function readAntigravityCapabilities(version2, help) {
@@ -48107,7 +48128,7 @@ function antigravityTurnInput(run2, context) {
   });
   return { turnId: run2.runId, text: appendImagePathReferences(text2, images) };
 }
-var import_promises52, import_path12, import_fs8, import_path13, import_path14, import_url3, import_crypto16, NO_ANTIGRAVITY_CAPABILITIES, INSTRUCTIONS_FILE, MAX_INSTRUCTION_CHARS, SHORTENED_NOTE, DIFF_BLOCK_START, DIFF_BLOCK_END, HUNK_HEADER, TRANSCRIPT_FILE, FULL_TRANSCRIPT_FILE, LOG_DIRS, TOOL_RESULT_TYPES, BrainTranscript, AntigravityTranscripts, ANTIGRAVITY_GRAMMAR_NAME, AntigravityGrammar, ignored, HANDLERS, SUCCESSFUL_STATUSES, SESSION_START_TYPES, RESULT_TYPES, SUBAGENT_START_TYPES, RESUME_FORKED, EXITED_WITHOUT_RESULT, AntigravityTurn, DEFAULTS6, AntigravitySession, WINDOWS_LINE_MARGIN;
+var import_promises53, import_path12, import_fs8, import_path13, import_path14, import_url3, import_crypto16, NO_ANTIGRAVITY_CAPABILITIES, INSTRUCTIONS_FILE, MAX_INSTRUCTION_CHARS, SHORTENED_NOTE, DIFF_BLOCK_START, DIFF_BLOCK_END, HUNK_HEADER, TRANSCRIPT_FILE, FULL_TRANSCRIPT_FILE, LOG_DIRS, TOOL_RESULT_TYPES, BrainTranscript, AntigravityTranscripts, ANTIGRAVITY_GRAMMAR_NAME, AntigravityGrammar, ignored, HANDLERS, SUCCESSFUL_STATUSES, SESSION_START_TYPES, RESULT_TYPES, SUBAGENT_START_TYPES, RESUME_FORKED, EXITED_WITHOUT_RESULT, AntigravityTurn, DEFAULTS6, AntigravitySession, WINDOWS_LINE_MARGIN;
 var init_antigravity = __esm({
   "../agent-core/dist/providers/antigravity.js"() {
     "use strict";
@@ -48116,9 +48137,9 @@ var init_antigravity = __esm({
     init_chunk_XC5676SG();
     init_chunk_54ZRJOQP();
     init_chunk_M6YHY2EZ();
-    init_chunk_ITTV3UIM();
+    init_chunk_VX6QVMKD();
     init_chunk_YXWJW7I5();
-    import_promises52 = require("fs/promises");
+    import_promises53 = require("fs/promises");
     import_path12 = require("path");
     init_type_guards();
     import_fs8 = require("fs");
@@ -48618,7 +48639,7 @@ function parseConfig(raw) {
 }
 async function writeCommandCodeProjectMcp(cwd, mcp) {
   const path4 = (0, import_path15.join)(cwd, ".mcp.json");
-  const original = await (0, import_promises53.readFile)(path4, "utf8").catch(() => null);
+  const original = await (0, import_promises54.readFile)(path4, "utf8").catch(() => null);
   const config2 = parseConfig(original);
   const next = {
     ...config2,
@@ -48635,12 +48656,12 @@ async function writeCommandCodeProjectMcp(cwd, mcp) {
       }
     }
   };
-  await (0, import_promises53.mkdir)(cwd, { recursive: true });
-  await (0, import_promises53.writeFile)(path4, `${JSON.stringify(next, null, 2)}
+  await (0, import_promises54.mkdir)(cwd, { recursive: true });
+  await (0, import_promises54.writeFile)(path4, `${JSON.stringify(next, null, 2)}
 `);
   return async () => {
-    if (original === null) await (0, import_promises53.rm)(path4, { force: true });
-    else await (0, import_promises53.writeFile)(path4, original);
+    if (original === null) await (0, import_promises54.rm)(path4, { force: true });
+    else await (0, import_promises54.writeFile)(path4, original);
   };
 }
 function commandCodeString(value2) {
@@ -48812,7 +48833,7 @@ function commandCodeTurnInput(run2, context) {
   });
   return { turnId: run2.runId, text: appendImagePathReferences(text2, images) };
 }
-var import_promises53, import_path15, import_crypto17, COMMAND_CODE_GRAMMAR_NAME, SILENT3, CommandCodeGrammar, SHELL_TOOL, STOP_TOOLS, REPORTED_STATUS, SHELL_STATUS, SWEEP_INTERVAL_MS, CommandCodeBackgroundTasks, EXITED_WITHOUT_RESULT2, CommandCodeTurn, COMMAND_CODE_MAX_TURNS, DEFAULTS7, CommandCodeSession;
+var import_promises54, import_path15, import_crypto17, COMMAND_CODE_GRAMMAR_NAME, SILENT3, CommandCodeGrammar, SHELL_TOOL, STOP_TOOLS, REPORTED_STATUS, SHELL_STATUS, SWEEP_INTERVAL_MS, CommandCodeBackgroundTasks, EXITED_WITHOUT_RESULT2, CommandCodeTurn, COMMAND_CODE_MAX_TURNS, DEFAULTS7, CommandCodeSession;
 var init_command_code = __esm({
   "../agent-core/dist/providers/command-code.js"() {
     "use strict";
@@ -48821,9 +48842,9 @@ var init_command_code = __esm({
     init_chunk_54ZRJOQP();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
-    init_chunk_ITTV3UIM();
+    init_chunk_VX6QVMKD();
     init_chunk_YXWJW7I5();
-    import_promises53 = require("fs/promises");
+    import_promises54 = require("fs/promises");
     import_path15 = require("path");
     init_agent2();
     init_runtime_v2();
@@ -54219,7 +54240,7 @@ var require_websocket_server = __commonJS({
 // package.json
 var package_default = {
   name: "@alan-ai-hq/agent-manager",
-  version: "0.1.142",
+  version: "0.1.144",
   private: true,
   type: "module",
   description: "Alan machine runtime (alan-agent): identity, link, reconciler, session holders, run log, uploader, local API",
@@ -54268,8 +54289,8 @@ var package_default = {
 };
 
 // src/cli/commands/compat.ts
-var import_node_crypto31 = require("crypto");
-var import_promises67 = require("fs/promises");
+var import_node_crypto32 = require("crypto");
+var import_promises68 = require("fs/promises");
 init_runtime_v2();
 init_zod();
 
@@ -54428,8 +54449,8 @@ async function writeJsonFileAtomic(path4, value2) {
 var LIFECYCLE_DRAIN_MS = 5e3;
 function createGate() {
   const opened = {};
-  const promise2 = new Promise((resolve12) => {
-    opened.resolve = resolve12;
+  const promise2 = new Promise((resolve13) => {
+    opened.resolve = resolve13;
   });
   return { promise: promise2, open: () => opened.resolve?.() };
 }
@@ -54656,7 +54677,7 @@ function transportFailure(request2, error61) {
   });
 }
 function readBody(incoming, url3, maxBytes) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const declared = Number(incoming.headers["content-length"] ?? "0");
     if (maxBytes !== void 0 && declared > maxBytes) {
       incoming.destroy();
@@ -54675,7 +54696,7 @@ function readBody(incoming, url3, maxBytes) {
       chunks.push(chunk);
     });
     incoming.on("error", reject);
-    incoming.on("end", () => resolve12(Buffer.concat(chunks)));
+    incoming.on("end", () => resolve13(Buffer.concat(chunks)));
   });
 }
 function isConnectionReset(error61) {
@@ -54683,7 +54704,7 @@ function isConnectionReset(error61) {
 }
 function exchange(request2, agents, attempt2 = 0) {
   const { signal, url: url3 } = request2;
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     if (signal.aborted) {
       reject(signal.reason);
       return;
@@ -54710,7 +54731,7 @@ function exchange(request2, agents, attempt2 = 0) {
       const stale = outgoing.reusedSocket && !responded && isConnectionReset(error61);
       if (stale && attempt2 < STALE_SOCKET_RETRIES && !signal.aborted) {
         settle();
-        resolve12(exchange(request2, agents, attempt2 + 1));
+        resolve13(exchange(request2, agents, attempt2 + 1));
         return;
       }
       fail(error61);
@@ -54723,7 +54744,7 @@ function exchange(request2, agents, attempt2 = 0) {
       readBody(incoming, url3, isRedirect(status) ? void 0 : request2.maxBodyBytes).then(
         (body) => {
           settle();
-          resolve12({ status, headers: incoming.headers, body });
+          resolve13({ status, headers: incoming.headers, body });
         },
         fail
       );
@@ -54968,8 +54989,8 @@ function isBodyless(method) {
   return method === "GET" || method === "HEAD";
 }
 function exchange2(send2, options, input2) {
-  return new Promise((resolve12, reject) => {
-    const outgoing = send2({ ...options, method: input2.method, signal: input2.signal }, resolve12);
+  return new Promise((resolve13, reject) => {
+    const outgoing = send2({ ...options, method: input2.method, signal: input2.signal }, resolve13);
     outgoing.on("error", reject);
     if (isBodyless(input2.method)) {
       input2.body.resume();
@@ -56438,7 +56459,7 @@ function createGitRunner(options) {
       }
       await killProcessTree(child.pid, { signal: "SIGKILL", child, platform: platform3 });
     };
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       let ending = null;
       const stop = (next) => {
         if (ending !== null) return;
@@ -56463,7 +56484,7 @@ function createGitRunner(options) {
         signal.removeEventListener("abort", onAbort);
         const final = ending ?? last;
         if (final.kind === "exited") {
-          resolve12({ exitCode: final.exitCode, stdout: stdout.text(), stderr: stderr.text() });
+          resolve13({ exitCode: final.exitCode, stdout: stdout.text(), stderr: stderr.text() });
         } else {
           reject(faultFor(final, command));
         }
@@ -57980,7 +58001,7 @@ function statusOf(error61) {
   }
   return 1;
 }
-var systemExec = (request2) => new Promise((resolve12) => {
+var systemExec = (request2) => new Promise((resolve13) => {
   const child = (0, import_node_child_process6.execFile)(
     request2.command,
     [...request2.args],
@@ -57991,7 +58012,7 @@ var systemExec = (request2) => new Promise((resolve12) => {
       windowsHide: true
     },
     (error61, stdout, stderr) => {
-      resolve12({ status: statusOf(error61), stdout, stderr });
+      resolve13({ status: statusOf(error61), stdout, stderr });
     }
   );
   child.stdin?.on("error", () => {
@@ -59181,11 +59202,11 @@ async function startGitCredentialServer(options) {
     });
   });
   removeStaleEndpoint(options.endpoint);
-  await new Promise((resolve12, reject) => {
+  await new Promise((resolve13, reject) => {
     server.once("error", reject);
     server.listen(options.endpoint, () => {
       server.off("error", reject);
-      resolve12();
+      resolve13();
     });
   });
   options.log.info("git.credential_server_listening", { endpoint: options.endpoint });
@@ -59193,7 +59214,7 @@ async function startGitCredentialServer(options) {
     endpoint: options.endpoint,
     [Symbol.asyncDispose]: async () => {
       closing.abort();
-      await new Promise((resolve12) => server.close(() => resolve12()));
+      await new Promise((resolve13) => server.close(() => resolve13()));
       removeStaleEndpoint(options.endpoint);
     }
   };
@@ -59267,13 +59288,13 @@ authorityKeyIdentifier = keyid
 `;
 }
 function openssl(args, cwd) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     (0, import_node_child_process9.execFile)(
       "openssl",
       [...args],
       { cwd, timeout: OPENSSL_TIMEOUT_MS },
       (error61, _stdout, stderr) => {
-        if (error61 === null) resolve12();
+        if (error61 === null) resolve13();
         else
           reject(new Error(`openssl ${args[0] ?? ""} failed: ${stderr.trim() || error61.message}`));
       }
@@ -59450,21 +59471,21 @@ function relayTo(forward, log) {
   };
 }
 function listen(server, target) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     server.once("error", reject);
     const done = () => {
       server.off("error", reject);
-      resolve12();
+      resolve13();
     };
     if (typeof target === "string") server.listen(target, done);
     else server.listen(target.port, target.host, done);
   });
 }
 function close(server, sockets = /* @__PURE__ */ new Set()) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     for (const socket of sockets) socket.destroy();
     server.closeAllConnections();
-    server.close(() => resolve12());
+    server.close(() => resolve13());
   });
 }
 function portOf(server) {
@@ -62247,7 +62268,7 @@ async function startNativeIngest(deps) {
   };
   const settleIdle = () => {
     if (workers.size > 0) return;
-    for (const resolve12 of idleWaiters) resolve12();
+    for (const resolve13 of idleWaiters) resolve13();
     idleWaiters.clear();
   };
   const retryDelay = (worker) => {
@@ -62490,7 +62511,7 @@ async function startNativeIngest(deps) {
     sweep: sweep2,
     whenIdle: () => {
       if (workers.size === 0) return Promise.resolve();
-      return new Promise((resolve12) => idleWaiters.add(resolve12));
+      return new Promise((resolve13) => idleWaiters.add(resolve13));
     },
     [Symbol.asyncDispose]: async () => {
       shutdown.abort();
@@ -62638,7 +62659,7 @@ function captureProbe(command, args, options) {
   const launch = directLaunch(command, args, options);
   if (launch === void 0) return Promise.resolve({ stdout: "", stderr: "", exitCode: void 0 });
   const env = platform3 === "win32" ? withWindowsHelper(canonicalWindowsEnvironment(options.env)) : options.env;
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     const limit = options.maxBufferBytes ?? DEFAULT_MAX_BYTES;
     const stdout = [];
     const stderr = [];
@@ -62673,7 +62694,7 @@ function captureProbe(command, args, options) {
       settled2 = true;
       deadlineController.abort();
       options.signal?.removeEventListener("abort", abort);
-      resolve12({
+      resolve13({
         stdout: Buffer.concat(stdout).toString("utf8"),
         stderr: Buffer.concat(stderr).toString("utf8"),
         exitCode
@@ -62805,7 +62826,7 @@ function cursorAccountLabel(output2) {
 function waitForAbort(signal) {
   if (signal.aborted) return Promise.resolve();
   return new Promise(
-    (resolve12) => signal.addEventListener("abort", () => resolve12(), { once: true })
+    (resolve13) => signal.addEventListener("abort", () => resolve13(), { once: true })
   );
 }
 function idlePrompt(signal) {
@@ -62883,14 +62904,14 @@ async function codexLabel(executable, env) {
     windowsVerbatimArguments: launch.windowsVerbatimArguments
   });
   const timeout = AbortSignal.timeout(ACCOUNT_TIMEOUT_MS);
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     let finished = false;
     let buffer = "";
     const finish = (label) => {
       if (finished) return;
       finished = true;
       child.kill();
-      resolve12(label);
+      resolve13(label);
     };
     const send2 = (value2) => {
       child.stdin.write(`${JSON.stringify(value2)}
@@ -63399,11 +63420,11 @@ async function resolveCliEnvironment(options) {
 }
 async function openCliEnvironment(options) {
   const decorate = options.decorate ?? ((env) => env);
-  const resolve12 = async () => {
+  const resolve13 = async () => {
     const resolved = await resolveCliEnvironmentDetailed(options);
     return { env: decorate(resolved.env), source: resolved.source };
   };
-  let state = await resolve12();
+  let state = await resolve13();
   let retryAt = options.clock.now() + DEGRADED_RETRY_MS;
   return {
     current: () => state.env,
@@ -63412,7 +63433,7 @@ async function openCliEnvironment(options) {
       if (state.source === "login_shell" || options.platform === "win32") return false;
       if (options.clock.now() < retryAt) return false;
       retryAt = options.clock.now() + DEGRADED_RETRY_MS;
-      const next = await resolve12();
+      const next = await resolve13();
       const changed = envValue(next.env, "PATH") !== envValue(state.env, "PATH");
       state = next;
       return changed;
@@ -63489,11 +63510,11 @@ async function installVersion2(backendKind, requested, options, signal) {
     }
     return exact;
   }
-  const resolve12 = options.resolveVersion;
-  if (resolve12 === void 0) throw new Error("Latest version lookup is unavailable");
+  const resolve13 = options.resolveVersion;
+  if (resolve13 === void 0) throw new Error("Latest version lookup is unavailable");
   const packageName = packageFor(backendKind).name;
   return checkedVersion(
-    await resolve12(backendKind === "opencode_serve" ? `${packageName}@1` : packageName, signal)
+    await resolve13(backendKind === "opencode_serve" ? `${packageName}@1` : packageName, signal)
   );
 }
 function selection(root, backendKind, version2) {
@@ -63942,10 +63963,10 @@ function createIgnoreMatcher(path4) {
   const expression = globToRegExp(pattern);
   return (candidate) => expression.test(candidate) || expression.test(`${candidate}/`);
 }
-function isIgnored(normalizedPath, basename10, isDirectory5, configured) {
-  if (isDirectory5 && ALWAYS_IGNORED_DIRECTORIES.has(basename10))
+function isIgnored(normalizedPath, basename11, isDirectory5, configured) {
+  if (isDirectory5 && ALWAYS_IGNORED_DIRECTORIES.has(basename11))
     return true;
-  if (!isDirectory5 && ALWAYS_IGNORED_FILES.has(basename10))
+  if (!isDirectory5 && ALWAYS_IGNORED_FILES.has(basename11))
     return true;
   return configured.some((matches) => matches(normalizedPath));
 }
@@ -64202,7 +64223,7 @@ var MAX_DIAGNOSTICS = 100;
 function createLocalSkillScanCache() {
   return { inspections: /* @__PURE__ */ new Map(), lastCompleteRevision: null };
 }
-async function scanSkillRoots(input2, cache2) {
+async function scanSkillRoots(input2, cache2, managedRoots = []) {
   const attemptId = (0, import_node_crypto19.randomUUID)();
   const ignoredPaths = input2.ignoredPaths ?? [];
   const resolvedRoots = resolveScanRoots(input2.roots, input2.enabledProviderKinds ?? []);
@@ -64210,7 +64231,8 @@ async function scanSkillRoots(input2, cache2) {
     input: input2,
     cache: cache2,
     visited: /* @__PURE__ */ new Set(),
-    declaredRoots: await canonicalDirectories(resolvedRoots.map((root) => root.directory))
+    declaredRoots: await canonicalDirectories(resolvedRoots.map((root) => root.directory)),
+    managedRoots: await canonicalDirectories(managedRoots)
   };
   const candidates2 = [];
   const diagnostics = [];
@@ -64316,6 +64338,7 @@ function invalid(resolvedRoot, name, error61) {
 async function scanRootAsPackage(pass, resolvedRoot) {
   if (!await exists3(import_node_path40.default.join(resolvedRoot.directory, "SKILL.md"))) return null;
   const canonical = await (0, import_promises38.realpath)(resolvedRoot.directory).catch(() => resolvedRoot.directory);
+  if (isManaged(pass, canonical)) return { candidates: [], diagnostics: [], incomplete: false };
   try {
     const inspected = await inspectCached(pass, canonical, null);
     return {
@@ -64379,6 +64402,7 @@ async function scanEntry(pass, resolvedRoot, canonicalRoot, name) {
     const message2 = `Could not resolve Skill ${name}`;
     return { kind: "diagnostic", diagnostic: { code: "SOURCE_UNREADABLE", message: message2, rootLabel } };
   }
+  if (isManaged(pass, canonical)) return null;
   const roots = pass.declaredRoots.length > 0 ? pass.declaredRoots : [canonicalRoot];
   if (!roots.some((root) => isWithinDirectory2(root, canonical))) {
     const message2 = `Skill ${name} resolves outside every declared Skill source`;
@@ -64405,12 +64429,12 @@ function resolveScanRoots(roots, enabledProviderKinds) {
   const resolved = [];
   for (const root of roots) {
     if (root.kind === "repository") {
-      for (const [index, relative5] of skillRepositorySourceDirectories(
+      for (const [index, relative6] of skillRepositorySourceDirectories(
         enabledProviderKinds
       ).entries()) {
         resolved.push({
           root,
-          directory: import_node_path40.default.join(root.path, relative5),
+          directory: import_node_path40.default.join(root.path, relative6),
           order: `1:${root.repositoryId}:${String(index).padStart(2, "0")}`
         });
       }
@@ -64461,12 +64485,12 @@ async function fingerprintPackage(root) {
     const entries = await (0, import_promises38.readdir)(directory, { withFileTypes: true });
     entries.sort((left, right) => Buffer.compare(Buffer.from(left.name), Buffer.from(right.name)));
     for (const entry of entries) {
-      const relative5 = relativeDirectory ? `${relativeDirectory}/${entry.name}` : entry.name;
+      const relative6 = relativeDirectory ? `${relativeDirectory}/${entry.name}` : entry.name;
       const absolute = import_node_path40.default.join(directory, entry.name);
       const metadata = await (0, import_promises38.lstat)(absolute);
       const kind = entryKind(entry);
-      hash2.update(relative5.normalize("NFC")).update(`\0${kind}\0${metadata.size}\0${metadata.mtimeMs}\0${metadata.mode & 511}\0`);
-      if (entry.isDirectory()) await visit2(absolute, relative5);
+      hash2.update(relative6.normalize("NFC")).update(`\0${kind}\0${metadata.size}\0${metadata.mtimeMs}\0${metadata.mode & 511}\0`);
+      if (entry.isDirectory()) await visit2(absolute, relative6);
     }
   };
   await visit2(root, "");
@@ -64483,9 +64507,12 @@ async function canonicalDirectories(directories) {
   );
   return [...new Set(canonical)];
 }
+function isManaged(pass, canonical) {
+  return pass.managedRoots.some((root) => isWithinDirectory2(root, canonical));
+}
 function isWithinDirectory2(parent, candidate) {
-  const relative5 = import_node_path40.default.relative(parent, candidate);
-  return relative5 !== ".." && !relative5.startsWith(`..${import_node_path40.default.sep}`) && !import_node_path40.default.isAbsolute(relative5);
+  const relative6 = import_node_path40.default.relative(parent, candidate);
+  return relative6 !== ".." && !relative6.startsWith(`..${import_node_path40.default.sep}`) && !import_node_path40.default.isAbsolute(relative6);
 }
 async function exists3(candidate) {
   try {
@@ -64689,7 +64716,7 @@ function optionalStringArray(value2, field3) {
   }
   return value2;
 }
-async function scanLocalSkills(home, context, cache2, mode = "incremental") {
+async function scanLocalSkills(home, context, cache2, mode = "incremental", managedRoots = []) {
   const resolved = await resolveLocalScanInput(home, context, mode);
   if (resolved.kind === "invalid_config") {
     return failedLocalSkillScan(
@@ -64698,7 +64725,7 @@ async function scanLocalSkills(home, context, cache2, mode = "incremental") {
       `Invalid Skill source configuration: ${resolved.diagnostic}`
     );
   }
-  return scanSkillRoots(resolved.input, cache2);
+  return scanSkillRoots(resolved.input, cache2, managedRoots);
 }
 
 // src/capabilities/skills/store.ts
@@ -64718,6 +64745,9 @@ function uuidV5(name, namespace) {
 function alanSkillId(slug) {
   return uuidV5(`alan:${slug}`, ALAN_SKILL_NAMESPACE);
 }
+function alanSkillVersionId(slug, contentHash) {
+  return uuidV5(`alan:${slug}:${contentHash}`, ALAN_SKILL_NAMESPACE);
+}
 
 // src/capabilities/skills/store.ts
 init_runtime_v2();
@@ -64727,9 +64757,12 @@ function skillsLayout(stateDir, home) {
   return {
     root,
     installedFile: (0, import_node_path42.join)(root, "installed.json"),
+    retiredFile: (0, import_node_path42.join)(root, "retired.json"),
     localFile: (0, import_node_path42.join)(root, "local.json"),
     versionsDir: (0, import_node_path42.join)(root, "versions"),
     tmpDir: (0, import_node_path42.join)(root, "tmp"),
+    pluginDir: (0, import_node_path42.join)(root, "alan-plugin"),
+    pluginSkillsDir: (0, import_node_path42.join)(root, "alan-plugin", "skills"),
     nativeDir: home === void 0 || home === "" ? null : (0, import_node_path42.join)(home, ".agents", "skills")
   };
 }
@@ -64797,18 +64830,20 @@ async function isIntact(layout, skill) {
     return false;
   }
 }
-async function resolveNativeBuiltIn(layout, invocation) {
+async function resolveNativeBuiltIn(layout, invocation, baked) {
   const slug = invocation.displayName;
   if (layout.nativeDir === null || invocation.skillId !== alanSkillId(slug)) return null;
   const directory = (0, import_node_path42.join)(layout.nativeDir, slug);
   try {
-    await inspectSkillPackage(directory, { expectedName: slug });
+    const inspected = await inspectSkillPackage(directory, { expectedName: slug });
+    if (baked === "exact" && alanSkillVersionId(slug, inspected.contentHash) !== invocation.versionId)
+      return null;
     return { packageDirectory: directory };
   } catch {
     return null;
   }
 }
-async function resolveSkillInvocations(layout, invocations) {
+async function resolveSkillInvocations(layout, invocations, baked = "any") {
   if (invocations.length === 0) return { kind: "resolved", skills: [] };
   const installed = await readInstalledSkills(layout);
   const local = invocations.some((invocation) => invocation.kind === "local_skill") ? await readLocalSkills(layout) : null;
@@ -64828,7 +64863,7 @@ async function resolveSkillInvocations(layout, invocations) {
       resolved.push({ packageDirectory: packageDirectory(layout, skill.versionId) });
       continue;
     }
-    const native = await resolveNativeBuiltIn(layout, invocation);
+    const native = await resolveNativeBuiltIn(layout, invocation, baked);
     if (native === null) missing.push(invocation.displayName);
     else resolved.push(native);
   }
@@ -64850,12 +64885,19 @@ async function availableSkillIndex(layout) {
         candidates2.push({ directory: (0, import_node_path42.join)(layout.nativeDir, entry.name) });
     }
   }
-  for (const candidate of candidates2.slice(0, 2e3)) {
-    const skill = await inspectIndexedSkill(candidate.directory, candidate.contentHash);
-    if (skill !== null && !found.has(skill.name)) found.set(skill.name, skill);
+  const bounded = candidates2.slice(0, 2e3);
+  for (let start = 0; start < bounded.length; start += INDEX_CONCURRENCY) {
+    const batch = bounded.slice(start, start + INDEX_CONCURRENCY);
+    const inspected = await Promise.all(
+      batch.map((candidate) => inspectIndexedSkill(candidate.directory, candidate.contentHash))
+    );
+    for (const skill of inspected) {
+      if (skill !== null && !found.has(skill.name)) found.set(skill.name, skill);
+    }
   }
   return [...found.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
+var INDEX_CONCURRENCY = 8;
 async function inspectIndexedSkill(directory, contentHash) {
   try {
     const inspected = await inspectSkillPackage(directory, { expectedName: null });
@@ -65039,8 +65081,8 @@ async function collectStream(stream) {
   return import_node_buffer2.Buffer.concat(chunks);
 }
 function addArchiveEntry(archive, header, bytes) {
-  return new Promise((resolve12, reject) => {
-    archive.entry(header, bytes, (error61) => error61 ? reject(error61) : resolve12());
+  return new Promise((resolve13, reject) => {
+    archive.entry(header, bytes, (error61) => error61 ? reject(error61) : resolve13());
   });
 }
 async function decompressBounded(archiveBytes) {
@@ -65066,7 +65108,7 @@ async function extractTar(tarBytes, destination) {
   const extractor = (0, import_tar_stream.extract)();
   let fileCount = 0;
   let totalBytes = 0;
-  const completion = new Promise((resolve12, reject) => {
+  const completion = new Promise((resolve13, reject) => {
     extractor.on("entry", (header, stream, next) => {
       void extractEntry(header, stream, destination, {
         addFile(size) {
@@ -65081,7 +65123,7 @@ async function extractTar(tarBytes, destination) {
         }
       }).then(next, (error61) => extractor.destroy(error61 instanceof Error ? error61 : new Error(String(error61))));
     });
-    extractor.once("finish", resolve12);
+    extractor.once("finish", resolve13);
     extractor.once("error", reject);
   });
   import_node_stream.Readable.from(tarBytes).pipe(extractor);
@@ -65158,34 +65200,222 @@ async function publishLocalSkill(options) {
   };
 }
 
-// src/capabilities/skills/sync.ts
+// src/capabilities/skills/native-index.ts
 var import_node_crypto23 = require("crypto");
+var import_node_fs16 = require("fs");
 var import_promises44 = require("fs/promises");
 var import_node_path45 = require("path");
+var ALAN_SKILLS_PLUGIN_NAME = "alan";
+var PLUGIN_MANIFEST = `${JSON.stringify(
+  {
+    name: ALAN_SKILLS_PLUGIN_NAME,
+    description: "Skills Alan installed on this machine for you and your team."
+  },
+  null,
+  2
+)}
+`;
+async function entryKind2(path4) {
+  try {
+    return (await (0, import_promises44.lstat)(path4)).isSymbolicLink() ? "link" : "other";
+  } catch (error61) {
+    if (errnoCode(error61) === "ENOENT") return "missing";
+    throw error61;
+  }
+}
+async function linkTarget(path4) {
+  return (0, import_promises44.readlink)(path4).catch(() => null);
+}
+async function removeLink(path4) {
+  try {
+    await (0, import_promises44.unlink)(path4);
+  } catch (error61) {
+    const code = errnoCode(error61);
+    if (code === "ENOENT") return;
+    if (code !== "EPERM" && code !== "EISDIR") throw error61;
+    await (0, import_promises44.rmdir)(path4);
+  }
+}
+async function placeLink(plan2, platform3) {
+  if (await linkTarget(plan2.path) === plan2.target) return false;
+  const staged = (0, import_node_path45.join)((0, import_node_path45.dirname)(plan2.path), `.${(0, import_node_path45.basename)(plan2.path)}.${(0, import_node_crypto23.randomUUID)()}.tmp`);
+  await (0, import_promises44.symlink)(plan2.target, staged, platform3 === "win32" ? "junction" : "dir");
+  try {
+    if (platform3 === "win32") await removeLink(plan2.path);
+    await (0, import_promises44.rename)(staged, plan2.path);
+  } catch (error61) {
+    await removeLink(staged).catch(() => void 0);
+    throw error61;
+  }
+  return true;
+}
+function versionTarget(layout, versionId, platform3) {
+  const absolute = (0, import_node_path45.join)(layout.versionsDir, versionId);
+  return platform3 === "win32" ? absolute : (0, import_node_path45.relative)(layout.pluginSkillsDir, absolute);
+}
+async function writeManifest(layout) {
+  const manifest = (0, import_node_path45.join)(layout.pluginDir, ".claude-plugin", "plugin.json");
+  if (await (0, import_promises44.readFile)(manifest, "utf8").catch(() => null) === PLUGIN_MANIFEST) return;
+  await (0, import_promises44.mkdir)((0, import_node_path45.dirname)(manifest), { recursive: true, mode: 448 });
+  const staged = `${manifest}.${(0, import_node_crypto23.randomUUID)()}.tmp`;
+  await (0, import_promises44.writeFile)(staged, PLUGIN_MANIFEST, { mode: 384 });
+  await (0, import_promises44.rename)(staged, manifest);
+}
+async function reconcilePluginSkills(layout, installed, platform3) {
+  await (0, import_promises44.mkdir)(layout.pluginSkillsDir, { recursive: true, mode: 448 });
+  const wanted = new Map(installed.map((skill) => [skill.slug, skill]));
+  let linked = 0;
+  for (const skill of installed) {
+    const plan2 = {
+      path: (0, import_node_path45.join)(layout.pluginSkillsDir, skill.slug),
+      target: versionTarget(layout, skill.versionId, platform3)
+    };
+    if (await entryKind2(plan2.path) === "other") {
+      await (0, import_promises44.rm)(plan2.path, { recursive: true, force: true });
+    }
+    if (await placeLink(plan2, platform3)) linked += 1;
+  }
+  let unlinked = 0;
+  for (const name of await (0, import_promises44.readdir)(layout.pluginSkillsDir)) {
+    if (wanted.has(name)) continue;
+    const path4 = (0, import_node_path45.join)(layout.pluginSkillsDir, name);
+    if (await entryKind2(path4) === "link") await removeLink(path4);
+    else await (0, import_promises44.rm)(path4, { recursive: true, force: true });
+    unlinked += 1;
+  }
+  return { linked, unlinked };
+}
+async function isOwnCodexLink(layout, path4) {
+  const target = await linkTarget(path4);
+  if (target === null) return false;
+  const absolute = (0, import_node_path45.isAbsolute)(target) ? target : (0, import_node_path45.resolve)((0, import_node_path45.dirname)(path4), target);
+  return isWithinDirectory2(layout.pluginSkillsDir, absolute);
+}
+async function isForeignPackage(layout, path4) {
+  const resolved = await (0, import_promises44.realpath)(path4).catch(() => null);
+  if (resolved === null) return false;
+  const root = await (0, import_promises44.realpath)(layout.root).catch(() => layout.root);
+  return !isWithinDirectory2(root, resolved);
+}
+async function codexSlot(layout, path4, slug) {
+  const baked = layout.nativeDir !== null && await isForeignPackage(layout, (0, import_node_path45.join)(layout.nativeDir, slug));
+  const kind = await entryKind2(path4);
+  if (kind === "other") return "taken";
+  const ours = kind === "link" && await isOwnCodexLink(layout, path4);
+  if (kind === "link" && !ours) return "taken";
+  if (baked) {
+    if (ours) await removeLink(path4);
+    return "taken";
+  }
+  return ours ? "ours" : "free";
+}
+async function unlinkStaleCodexEntries(layout, codexSkillsDir, wanted) {
+  let unlinked = 0;
+  for (const name of await (0, import_promises44.readdir)(codexSkillsDir)) {
+    const path4 = (0, import_node_path45.join)(codexSkillsDir, name);
+    if (wanted.has(name) && !name.endsWith(".tmp")) continue;
+    if (await entryKind2(path4) !== "link" || !await isOwnCodexLink(layout, path4)) continue;
+    await removeLink(path4);
+    unlinked += 1;
+  }
+  return unlinked;
+}
+async function reconcileCodexSkills(layout, installed, codexSkillsDir, platform3) {
+  await (0, import_promises44.mkdir)(codexSkillsDir, { recursive: true, mode: 448 });
+  const report2 = { linked: 0, unlinked: 0, skipped: [] };
+  for (const skill of installed) {
+    const path4 = (0, import_node_path45.join)(codexSkillsDir, skill.slug);
+    if (await codexSlot(layout, path4, skill.slug) === "taken") {
+      report2.skipped.push(skill.slug);
+      continue;
+    }
+    const target = (0, import_node_path45.join)(layout.pluginSkillsDir, skill.slug);
+    if (await placeLink({ path: path4, target }, platform3)) report2.linked += 1;
+  }
+  const wanted = new Set(installed.map((skill) => skill.slug));
+  report2.unlinked = await unlinkStaleCodexEntries(layout, codexSkillsDir, wanted);
+  return report2;
+}
+async function reconcileNativeIndex(layout, installed, options) {
+  await writeManifest(layout);
+  const plugin = await reconcilePluginSkills(layout, installed, options.platform);
+  if (options.codexSkillsDir === null) return { ...plugin, skipped: [] };
+  const codex = await reconcileCodexSkills(
+    layout,
+    installed,
+    options.codexSkillsDir,
+    options.platform
+  );
+  return {
+    linked: plugin.linked + codex.linked,
+    unlinked: plugin.unlinked + codex.unlinked,
+    skipped: codex.skipped
+  };
+}
+function installedSkillFolders(layout) {
+  return (0, import_node_fs16.existsSync)((0, import_node_path45.join)(layout.pluginDir, ".claude-plugin", "plugin.json")) ? { pluginDir: layout.pluginDir, skillsDir: layout.pluginSkillsDir } : null;
+}
+
+// src/capabilities/skills/sync.ts
+var import_node_crypto24 = require("crypto");
+var import_promises45 = require("fs/promises");
+var import_node_path46 = require("path");
+init_zod();
 var SKILL_PREPARE_WAIT_MS = 15e3;
-async function install(layout, source, skill, download, signal) {
+var RETIRED_VERSION_RETENTION_MS = 24 * 60 * 60 * 1e3;
+async function makeFilesReadOnly(directory, platform3) {
+  if (platform3 === "win32") return;
+  for (const entry of await (0, import_promises45.readdir)(directory, { withFileTypes: true })) {
+    const path4 = (0, import_node_path46.join)(directory, entry.name);
+    if (entry.isDirectory()) await makeFilesReadOnly(path4, platform3);
+    else if (entry.isFile()) {
+      const executable = ((await (0, import_promises45.lstat)(path4)).mode & 64) !== 0;
+      await (0, import_promises45.chmod)(path4, executable ? 365 : 292);
+    }
+  }
+}
+async function install(env, skill, download, signal) {
+  const { layout, source, platform: platform3 } = env;
   const bytes = await source.download(download.url, signal);
-  await (0, import_promises44.mkdir)(layout.tmpDir, { recursive: true, mode: 448 });
-  const staging = (0, import_node_path45.join)(layout.tmpDir, (0, import_node_crypto23.randomUUID)());
+  await (0, import_promises45.mkdir)(layout.tmpDir, { recursive: true, mode: 448 });
+  const staging = (0, import_node_path46.join)(layout.tmpDir, (0, import_node_crypto24.randomUUID)());
   await extractSkillBundle(Buffer.from(bytes), staging, {
     expectedArchiveHash: download.archiveHash,
     expectedContentHash: skill.contentHash
   });
   const target = packageDirectory(layout, skill.versionId);
-  await (0, import_promises44.mkdir)(layout.versionsDir, { recursive: true, mode: 448 });
-  await (0, import_promises44.rm)(target, { recursive: true, force: true });
-  await (0, import_promises44.rename)(staging, target);
-}
-async function sweep(layout, keep) {
+  await (0, import_promises45.mkdir)(layout.versionsDir, { recursive: true, mode: 448 });
+  await (0, import_promises45.rm)(target, { recursive: true, force: true });
+  await (0, import_promises45.rename)(staging, target);
+  await makeFilesReadOnly(target, platform3);
+}
+var retiredFileSchema = external_exports.record(external_exports.string(), external_exports.number());
+async function sweep(env, keep) {
+  const { layout } = env;
   const kept = new Set(keep.map((skill) => skill.versionId));
-  const stale = (await (0, import_promises44.readdir)(layout.versionsDir).catch(() => [])).filter(
-    (name) => !kept.has(name)
-  );
-  await Promise.all(
-    stale.map((name) => (0, import_promises44.rm)((0, import_node_path45.join)(layout.versionsDir, name), { recursive: true, force: true }))
+  const read = await readJsonFile(layout.retiredFile, retiredFileSchema).catch(() => null);
+  const retired = read?.kind === "ok" ? read.value : {};
+  const now = env.now();
+  const stillRetired = {};
+  const expired = [];
+  for (const name of await (0, import_promises45.readdir)(layout.versionsDir).catch(() => [])) {
+    if (kept.has(name)) continue;
+    const since = retired[name] ?? now;
+    if (now - since >= RETIRED_VERSION_RETENTION_MS) expired.push(name);
+    else stillRetired[name] = since;
+  }
+  const results = await Promise.allSettled(
+    expired.map((name) => (0, import_promises45.rm)((0, import_node_path46.join)(layout.versionsDir, name), { recursive: true, force: true }))
   );
-  await (0, import_promises44.rm)(layout.tmpDir, { recursive: true, force: true });
-  return stale.length;
+  results.forEach((result, index) => {
+    const name = expired[index];
+    if (result.status === "rejected" && name !== void 0) stillRetired[name] = now;
+  });
+  if (JSON.stringify(stillRetired) !== JSON.stringify(retired)) {
+    await writeJsonFileAtomic(layout.retiredFile, stillRetired);
+  }
+  await (0, import_promises45.rm)(layout.tmpDir, { recursive: true, force: true });
+  return results.filter((result) => result.status === "fulfilled").length;
 }
 async function intactSkills(layout) {
   const installed = await readInstalledSkills(layout);
@@ -65211,18 +65441,24 @@ function installedRecorder(layout, present2, onRecorded) {
     present2.map((skill) => [skill.skillId, skill])
   );
   let chain = Promise.resolve();
+  let queued = null;
   return {
     record: (skill) => {
       ready.set(skill.skillId, skill);
-      const snapshot2 = [...ready.values()];
-      const write = chain.then(() => writeInstalledSkills(layout, snapshot2)).then(onRecorded);
+      if (queued !== null) return queued;
+      const write = chain.then(() => {
+        queued = null;
+        return writeInstalledSkills(layout, [...ready.values()]);
+      }).then(onRecorded);
+      queued = write;
       chain = write.catch(() => void 0);
       return write;
     },
     settled: () => chain
   };
 }
-async function applyDesired(layout, source, log, present2, response, onRecorded, signal) {
+async function applyDesired(env, present2, response, onRecorded, signal) {
+  const { layout, log } = env;
   const held = new Map(present2.map((skill) => [skill.skillId, skill]));
   const downloads = new Map(
     response.downloads.map((download) => [download.skillId, download])
@@ -65236,21 +65472,34 @@ async function applyDesired(layout, source, log, present2, response, onRecorded,
       return kept ? "kept" : "failed";
     }
     try {
-      await install(layout, source, skill, download, signal);
-      await recorder.record(skill);
-      return "downloaded";
+      await install(env, skill, download, signal);
     } catch (error61) {
       log.warn("skills.install_failed", { skillId: skill.skillId, slug: skill.slug, error: error61 });
       return "failed";
     }
+    await recorder.record(skill).catch((error61) => {
+      log.warn("skills.record_failed", { skillId: skill.skillId, error: error61 });
+    });
+    return "downloaded";
   };
   const outcomes = await mapBounded(response.skills, INSTALL_CONCURRENCY, installOne);
-  const installed = response.skills.filter((_, index) => outcomes[index] !== "failed");
+  const installed = response.skills.flatMap((skill, index) => {
+    if (outcomes[index] !== "failed") return [skill];
+    const kept = held.get(skill.skillId);
+    return kept === void 0 ? [] : [kept];
+  });
   const failed = response.skills.filter((_, index) => outcomes[index] === "failed").map((skill) => skill.slug);
   const downloaded = outcomes.filter((outcome2) => outcome2 === "downloaded").length;
   await recorder.settled();
+  if (signal.aborted) return { installed: installed.length, downloaded, removed: 0, failed };
   await writeInstalledSkills(layout, installed);
-  const removed = await sweep(layout, installed);
+  await reconcileNativeIndex(layout, installed, {
+    codexSkillsDir: env.codexSkillsDir,
+    platform: env.platform
+  }).catch((error61) => {
+    log.warn("skills.native_index_failed", { error: error61 });
+  });
+  const removed = await sweep(env, installed);
   return { installed: installed.length, downloaded, removed, failed };
 }
 var MAX_EXCHANGES = 4;
@@ -65269,7 +65518,9 @@ async function scanLocal(layout, local) {
   local.scans += 1;
   const sequence = local.scans;
   const context = local.context;
-  const scan = await scanLocalSkills(local.options.home, context, local.cache);
+  const scan = await scanLocalSkills(local.options.home, context, local.cache, "incremental", [
+    layout.root
+  ]);
   const scanned = { scan, context, key: reportKey(scan, context) };
   if (local.latest !== null && local.latest.sequence > sequence) return scanned;
   local.latest = { ...scanned, sequence };
@@ -65339,14 +65590,15 @@ async function settleLocal(layout, source, log, local, exchange3, response, sign
   const uploads = await uploadRequested(layout, source, log, local, response.uploads ?? [], signal);
   return serverLost || uploads > 0;
 }
-async function syncOnce(layout, source, log, local, onRecorded, signal) {
+async function syncOnce(env, local, onRecorded, signal) {
+  const { layout, source, log } = env;
   let report2 = { installed: 0, downloaded: 0, removed: 0, failed: [] };
   if (local !== null) await loadContext(layout, local);
   for (let exchange3 = 0; exchange3 < MAX_EXCHANGES; exchange3 += 1) {
     const present2 = await intactSkills(layout);
     const pending = local === null ? null : localExchange(local);
     const response = await source.sync(syncRequest(present2, pending), signal);
-    report2 = await applyDesired(layout, source, log, present2, response, onRecorded, signal);
+    report2 = await applyDesired(env, present2, response, onRecorded, signal);
     if (local === null || pending === null) return report2;
     const again = await settleLocal(layout, source, log, local, pending, response, signal);
     if (!again) return report2;
@@ -65354,14 +65606,22 @@ async function syncOnce(layout, source, log, local, onRecorded, signal) {
   return report2;
 }
 function aborted2(signal) {
-  return new Promise((resolve12) => {
-    if (signal.aborted) resolve12(null);
-    else signal.addEventListener("abort", () => resolve12(null), { once: true });
+  return new Promise((resolve13) => {
+    if (signal.aborted) resolve13(null);
+    else signal.addEventListener("abort", () => resolve13(null), { once: true });
   });
 }
 function openMachineSkills(options) {
   const layout = skillsLayout(options.stateDir, options.local?.home);
   const { source, log } = options;
+  const env = {
+    layout,
+    source,
+    log,
+    codexSkillsDir: options.codexSkillsDir ?? null,
+    platform: options.platform ?? process.platform,
+    now: options.now ?? Date.now
+  };
   const local = options.local === void 0 ? null : {
     options: options.local,
     cache: createLocalSkillScanCache(),
@@ -65396,7 +65656,7 @@ function openMachineSkills(options) {
     return task;
   };
   const run2 = () => {
-    const running = syncOnce(layout, source, log, local, recorded, lifetime.signal).then((report2) => {
+    const running = syncOnce(env, local, recorded, lifetime.signal).then((report2) => {
       log.info("skills.synced", { ...report2 });
       return report2;
     }).catch((error61) => {
@@ -65427,29 +65687,29 @@ function openMachineSkills(options) {
     const running = flight.running;
     if (running !== void 0) {
       await running;
-      if ((await resolveSkillInvocations(layout, named)).kind === "resolved") return;
+      if ((await resolveSkillInvocations(layout, named, "exact")).kind === "resolved") return;
     }
     await exchange3();
   };
   const rescanUntilResolved = async (named) => {
     for (let pass = 0; pass < 2; pass += 1) {
       await rescan();
-      if ((await resolveSkillInvocations(layout, named)).kind === "resolved") return;
+      if ((await resolveSkillInvocations(layout, named, "exact")).kind === "resolved") return;
     }
   };
-  const recordedUntilResolved = (named, until) => new Promise((resolve12) => {
+  const recordedUntilResolved = (named, until) => new Promise((resolve13) => {
     const done = () => {
       recordWatchers.delete(check3);
       until.removeEventListener("abort", done);
-      resolve12();
+      resolve13();
     };
     const check3 = () => {
-      void resolveSkillInvocations(layout, named).then((resolution) => {
+      void resolveSkillInvocations(layout, named, "exact").then((resolution) => {
         if (resolution.kind === "resolved") done();
       });
     };
     if (until.aborted) {
-      resolve12();
+      resolve13();
       return;
     }
     recordWatchers.add(check3);
@@ -65461,7 +65721,7 @@ function openMachineSkills(options) {
     rescan,
     prepare: async (invocations, signal) => {
       const named = invocations ?? [];
-      if ((await resolveSkillInvocations(layout, named)).kind === "resolved") return;
+      if ((await resolveSkillInvocations(layout, named, "exact")).kind === "resolved") return;
       const picksLocal = named.some((invocation) => invocation.kind === "local_skill");
       const settled2 = new AbortController();
       const until = AbortSignal.any([signal, AbortSignal.timeout(waitMs), settled2.signal]);
@@ -65478,15 +65738,15 @@ function openMachineSkills(options) {
 }
 
 // src/capabilities/workspace/index.ts
-var import_node_path48 = require("path");
+var import_node_path49 = require("path");
 init_runtime_v2();
 
 // src/capabilities/workspace/approved-paths.ts
-var import_promises45 = require("fs/promises");
+var import_promises46 = require("fs/promises");
 init_zod();
 
 // src/capabilities/workspace/paths.ts
-var import_node_path46 = require("path");
+var import_node_path47 = require("path");
 function stripWin32Namespace(path4) {
   if (/^\\\\\?\\UNC\\/i.test(path4)) return `\\\\${path4.slice(8)}`;
   if (path4.startsWith("\\\\?\\")) return path4.slice(4);
@@ -65494,15 +65754,15 @@ function stripWin32Namespace(path4) {
 }
 function comparablePath(path4, platform3) {
   if (platform3 === "win32") {
-    const normalized3 = import_node_path46.win32.normalize(stripWin32Namespace(path4).replaceAll("/", "\\"));
+    const normalized3 = import_node_path47.win32.normalize(stripWin32Namespace(path4).replaceAll("/", "\\"));
     const trimmed4 = normalized3.length > 3 || !/^[a-z]:\\$/i.test(normalized3) ? normalized3.replace(/\\+$/, "") : normalized3;
     return trimmed4.toLowerCase();
   }
-  const normalized2 = import_node_path46.posix.normalize(path4);
+  const normalized2 = import_node_path47.posix.normalize(path4);
   return normalized2.length > 1 ? normalized2.replace(/\/+$/, "") : normalized2;
 }
 function isAbsoluteFor(path4, platform3) {
-  return platform3 === "win32" ? import_node_path46.win32.isAbsolute(path4) : import_node_path46.posix.isAbsolute(path4);
+  return platform3 === "win32" ? import_node_path47.win32.isAbsolute(path4) : import_node_path47.posix.isAbsolute(path4);
 }
 function isWithin(root, candidate, platform3) {
   const separator = platform3 === "win32" ? "\\" : "/";
@@ -65520,7 +65780,7 @@ var storeSchema = external_exports.object({
 });
 async function realpathOrNull(path4) {
   try {
-    return await (0, import_promises45.realpath)(path4);
+    return await (0, import_promises46.realpath)(path4);
   } catch (error61) {
     const code = errnoCode(error61);
     if (code === "ENOENT" || code === "ENOTDIR" || code === "EACCES" || code === "EPERM") {
@@ -65579,9 +65839,9 @@ async function openApprovedPaths(options) {
 }
 
 // src/capabilities/workspace/locks.ts
-var import_node_crypto24 = require("crypto");
-var import_promises46 = require("fs/promises");
-var import_node_path47 = require("path");
+var import_node_crypto25 = require("crypto");
+var import_promises47 = require("fs/promises");
+var import_node_path48 = require("path");
 init_zod();
 var LOCK_FORMAT = 1;
 var EXCLUSIVE_FILE = "exclusive.json";
@@ -65596,12 +65856,12 @@ var ownerSchema = external_exports.object({
   since: external_exports.number().int().nonnegative()
 });
 function repositoryLockKey(commonDir, platform3) {
-  return (0, import_node_crypto24.createHash)("sha256").update(comparablePath(commonDir, platform3)).digest("hex").slice(0, 32);
+  return (0, import_node_crypto25.createHash)("sha256").update(comparablePath(commonDir, platform3)).digest("hex").slice(0, 32);
 }
 async function readOwner2(path4) {
   let text2;
   try {
-    text2 = await (0, import_promises46.readFile)(path4, "utf8");
+    text2 = await (0, import_promises47.readFile)(path4, "utf8");
   } catch (error61) {
     if (errnoCode(error61) === "ENOENT") return { kind: "missing" };
     return { kind: "unreadable" };
@@ -65622,7 +65882,7 @@ async function removeIfSame(path4, expected) {
     if (current.kind !== "owner" || current.owner.since !== expected.since) return;
     if (current.owner.pid !== expected.pid || current.owner.holder !== expected.holder) return;
   }
-  await (0, import_promises46.unlink)(path4).catch((error61) => {
+  await (0, import_promises47.unlink)(path4).catch((error61) => {
     if (errnoCode(error61) !== "ENOENT") throw error61;
   });
 }
@@ -65647,7 +65907,7 @@ function openRepositoryLocks(options) {
       await removeIfSame(path4, read.owner);
       return null;
     }
-    const age = await (0, import_promises46.stat)(path4).then(
+    const age = await (0, import_promises47.stat)(path4).then(
       (info) => clock.now() - info.mtimeMs,
       () => 0
     );
@@ -65661,13 +65921,13 @@ function openRepositoryLocks(options) {
   });
   const folder = async (commonDir) => {
     const key = repositoryLockKey(commonDir, platform3);
-    const dir = (0, import_node_path47.join)(options.dir, key);
-    await (0, import_promises46.mkdir)(dir, { recursive: true, mode: 448 });
+    const dir = (0, import_node_path48.join)(options.dir, key);
+    await (0, import_promises47.mkdir)(dir, { recursive: true, mode: 448 });
     return { key, dir };
   };
   const createExclusive = async (path4, owner) => {
     try {
-      const handle = await (0, import_promises46.open)(path4, "wx", 384);
+      const handle = await (0, import_promises47.open)(path4, "wx", 384);
       try {
         await handle.writeFile(JSON.stringify(owner));
       } finally {
@@ -65680,10 +65940,10 @@ function openRepositoryLocks(options) {
     }
   };
   const liveRun = async (dir) => {
-    const entries = await (0, import_promises46.readdir)(dir);
+    const entries = await (0, import_promises47.readdir)(dir);
     for (const entry of entries) {
       if (!entry.startsWith(RUN_FILE_PREFIX)) continue;
-      const holder = await heldBy((0, import_node_path47.join)(dir, entry));
+      const holder = await heldBy((0, import_node_path48.join)(dir, entry));
       if (holder !== null) return holder;
     }
     return null;
@@ -65691,7 +65951,7 @@ function openRepositoryLocks(options) {
   return {
     tryExclusive: async (commonDir, operationId) => {
       const { key, dir } = await folder(commonDir);
-      const path4 = (0, import_node_path47.join)(dir, EXCLUSIVE_FILE);
+      const path4 = (0, import_node_path48.join)(dir, EXCLUSIVE_FILE);
       const owner = await self(operationId);
       if (!await createExclusive(path4, owner)) {
         const holder = await heldBy(path4);
@@ -65709,11 +65969,11 @@ function openRepositoryLocks(options) {
     },
     tryShared: async (commonDir, runId) => {
       const { key, dir } = await folder(commonDir);
-      const file2 = `${RUN_FILE_PREFIX}${(0, import_node_crypto24.createHash)("sha256").update(runId).digest("hex").slice(0, 32)}.json`;
-      const path4 = (0, import_node_path47.join)(dir, file2);
+      const file2 = `${RUN_FILE_PREFIX}${(0, import_node_crypto25.createHash)("sha256").update(runId).digest("hex").slice(0, 32)}.json`;
+      const path4 = (0, import_node_path48.join)(dir, file2);
       const owner = await self(runId);
       await writeJsonFileAtomic(path4, owner);
-      const operation = await heldBy((0, import_node_path47.join)(dir, EXCLUSIVE_FILE));
+      const operation = await heldBy((0, import_node_path48.join)(dir, EXCLUSIVE_FILE));
       if (operation !== null) {
         await removeIfSame(path4, owner);
         return { kind: "busy", holder: operation };
@@ -65813,18 +66073,18 @@ async function openWorkspaces(options) {
   const budgetMs = options.budgetMs ?? WORKSPACE_QUERY_BUDGET_MS;
   const lifetime = new AbortController();
   const approved = await openApprovedPaths({
-    file: (0, import_node_path48.join)(options.stateDir, "workspaces.json"),
+    file: (0, import_node_path49.join)(options.stateDir, "workspaces.json"),
     log: options.log,
     platform: platform3
   });
   const locks = openRepositoryLocks({
-    dir: (0, import_node_path48.join)(options.stateDir, "locks"),
+    dir: (0, import_node_path49.join)(options.stateDir, "locks"),
     clock: options.clock,
     platform: platform3
   });
   const git = createGit({
     env: options.env,
-    tmpDir: (0, import_node_path48.join)(options.stateDir, "tmp", "git"),
+    tmpDir: (0, import_node_path49.join)(options.stateDir, "tmp", "git"),
     platform: platform3,
     ...options.gitPath === void 0 ? {} : { gitPath: options.gitPath },
     ...options.localTimeoutMs === void 0 ? {} : { localTimeoutMs: options.localTimeoutMs },
@@ -65945,11 +66205,11 @@ async function openWorkspaces(options) {
 
 // src/cli/config.ts
 var import_node_os11 = require("os");
-var import_node_path66 = require("path");
+var import_node_path67 = require("path");
 init_zod();
 
 // src/client/contract.ts
-var import_node_path49 = require("path");
+var import_node_path50 = require("path");
 init_runtime_v2();
 init_zod();
 var LOCAL_API_PROTOCOL = 1;
@@ -66122,7 +66382,7 @@ var nativeHookSignalSchema = external_exports.strictObject({
   provider: external_exports.enum(nativeIngestionProviders),
   event: external_exports.enum(nativeIngestionHookEvents),
   externalSessionId: external_exports.string().trim().min(1).max(200),
-  transcriptPath: external_exports.string().min(1).max(4096).refine(import_node_path49.isAbsolute, "transcriptPath must be absolute"),
+  transcriptPath: external_exports.string().min(1).max(4096).refine(import_node_path50.isAbsolute, "transcriptPath must be absolute"),
   cwd: external_exports.string().max(4096).nullable(),
   providerTurnId: external_exports.string().max(200).nullable(),
   assistantFingerprint: assistantFingerprintSchema.nullable(),
@@ -66158,19 +66418,19 @@ var localApiErrorSchema = external_exports.object({
 });
 
 // src/client/locate.ts
-var import_node_path50 = require("path");
+var import_node_path51 = require("path");
 var RUNTIME_PROFILES = ["production", "staging", "development", "local"];
 function defaultStateDir({ profile, platform: platform3, home, env }) {
   if (platform3 === "win32") {
-    return (0, import_node_path50.join)(env.LOCALAPPDATA ?? (0, import_node_path50.join)(home, "AppData", "Local"), "Alan", profile);
+    return (0, import_node_path51.join)(env.LOCALAPPDATA ?? (0, import_node_path51.join)(home, "AppData", "Local"), "Alan", profile);
   }
-  return (0, import_node_path50.join)(env.XDG_STATE_HOME ?? (0, import_node_path50.join)(home, ".local", "state"), "alan", profile);
+  return (0, import_node_path51.join)(env.XDG_STATE_HOME ?? (0, import_node_path51.join)(home, ".local", "state"), "alan", profile);
 }
 function defaultInstallDir({ platform: platform3, home, env }) {
   if (platform3 === "win32") {
-    return (0, import_node_path50.join)(env.LOCALAPPDATA ?? (0, import_node_path50.join)(home, "AppData", "Local"), "Alan", "runtime");
+    return (0, import_node_path51.join)(env.LOCALAPPDATA ?? (0, import_node_path51.join)(home, "AppData", "Local"), "Alan", "runtime");
   }
-  return (0, import_node_path50.join)(env.XDG_DATA_HOME ?? (0, import_node_path50.join)(home, ".local", "share"), "alan", "runtime");
+  return (0, import_node_path51.join)(env.XDG_DATA_HOME ?? (0, import_node_path51.join)(home, ".local", "share"), "alan", "runtime");
 }
 
 // src/client/machine-features-contract.ts
@@ -66229,7 +66489,7 @@ var mcpConfigResultSchema = external_exports.object({
 });
 
 // src/client/runtime-client.ts
-var import_promises47 = require("fs/promises");
+var import_promises48 = require("fs/promises");
 init_acp();
 init_runtime_v2();
 
@@ -66290,7 +66550,7 @@ var DEFAULT_BACKOFF = { initialMs: 250, maxMs: 3e4 };
 async function readDiscovery(path4) {
   let text2;
   try {
-    text2 = await (0, import_promises47.readFile)(path4, "utf8");
+    text2 = await (0, import_promises48.readFile)(path4, "utf8");
   } catch (error61) {
     throw new RuntimeClientError("unavailable", "The runtime is not running", { cause: error61 });
   }
@@ -66363,8 +66623,8 @@ function nextOffsetOf(response) {
 async function pause(ms, signal) {
   const either = AbortSignal.any([signal, AbortSignal.timeout(ms)]);
   if (either.aborted) return;
-  await new Promise((resolve12) => {
-    either.addEventListener("abort", () => resolve12(), { once: true });
+  await new Promise((resolve13) => {
+    either.addEventListener("abort", () => resolve13(), { once: true });
   });
 }
 function jittered(backoff, failures) {
@@ -66672,14 +66932,14 @@ async function sendNativeHookSignal(discoveryPath, hookSignal, signal) {
 }
 
 // src/sessions/index.ts
-var import_node_crypto30 = require("crypto");
-var import_promises65 = require("fs/promises");
+var import_node_crypto31 = require("crypto");
+var import_promises66 = require("fs/promises");
 var import_node_os10 = require("os");
-var import_node_path65 = require("path");
+var import_node_path66 = require("path");
 init_runtime_v2();
 
 // src/holder/control-client.ts
-var import_node_crypto25 = require("crypto");
+var import_node_crypto26 = require("crypto");
 var import_node_net2 = require("net");
 init_runtime_v2();
 
@@ -66726,8 +66986,8 @@ function isReply(message2) {
 async function connectHolder(endpoint, token, onEvent) {
   const socket = (0, import_node_net2.connect)(endpoint);
   const pending = /* @__PURE__ */ new Map();
-  const closed = new Promise((resolve12) => socket.once("close", () => resolve12()));
-  const ready = new Promise((resolve12, reject) => {
+  const closed = new Promise((resolve13) => socket.once("close", () => resolve13()));
+  const ready = new Promise((resolve13, reject) => {
     socket.once("error", reject);
     socket.once(
       "close",
@@ -66735,7 +66995,7 @@ async function connectHolder(endpoint, token, onEvent) {
     );
     readMessages(socket, holderMessageSchema, {
       onMessage: (message2) => {
-        if (message2.type === "ready") resolve12(message2.pid);
+        if (message2.type === "ready") resolve13(message2.pid);
         else if (isReply(message2)) {
           const id = message2.id;
           if (id === null) return;
@@ -66749,14 +67009,14 @@ async function connectHolder(endpoint, token, onEvent) {
   });
   const pid = await ready;
   const request2 = (body) => {
-    const id = (0, import_node_crypto25.randomUUID)();
-    return new Promise((resolve12, reject) => {
+    const id = (0, import_node_crypto26.randomUUID)();
+    return new Promise((resolve13, reject) => {
       const timer = AbortSignal.timeout(REQUEST_TIMEOUT_MS7);
       timer.addEventListener("abort", () => {
         pending.delete(id);
         reject(new RuntimeFault("io_failed", "Holder did not answer"));
       });
-      pending.set(id, resolve12);
+      pending.set(id, resolve13);
       writeMessage(socket, { ...body, id });
     });
   };
@@ -66899,7 +67159,7 @@ function createProviderDrivers(options) {
 }
 
 // src/holder/engine-records.ts
-var import_node_path51 = require("path");
+var import_node_path52 = require("path");
 init_zod();
 var ENGINES_FILE = "engines.json";
 var STOP_GRACE_MS = 2e3;
@@ -66911,7 +67171,7 @@ var engineRecordSchema = external_exports.object({
 });
 var engineRecordsSchema = external_exports.object({ engines: external_exports.array(engineRecordSchema) });
 function engineRecordsPath(sessionDir) {
-  return (0, import_node_path51.join)(sessionDir, ENGINES_FILE);
+  return (0, import_node_path52.join)(sessionDir, ENGINES_FILE);
 }
 function recordSpawnedEngines(path4, clock, log) {
   const live = /* @__PURE__ */ new Map();
@@ -66971,12 +67231,12 @@ async function reapLeftoverEngines(path4, options) {
 }
 
 // src/holder/launch-command.ts
-var import_node_fs16 = require("fs");
-var import_node_path52 = require("path");
+var import_node_fs17 = require("fs");
+var import_node_path53 = require("path");
 var HOLDER_BUNDLE = "alan-holder.cjs";
-function holderArguments(runtimeArgs, nodeFlags, exists6 = import_node_fs16.existsSync) {
+function holderArguments(runtimeArgs, nodeFlags, exists6 = import_node_fs17.existsSync) {
   const bundle = runtimeArgs.at(-1);
-  const lean = bundle === void 0 ? void 0 : (0, import_node_path52.join)((0, import_node_path52.dirname)(bundle), HOLDER_BUNDLE);
+  const lean = bundle === void 0 ? void 0 : (0, import_node_path53.join)((0, import_node_path53.dirname)(bundle), HOLDER_BUNDLE);
   const script = lean !== void 0 && exists6(lean) ? [...runtimeArgs.slice(0, -1), lean] : runtimeArgs;
   return [...nodeFlags, ...script, "hold"];
 }
@@ -67011,17 +67271,17 @@ function createConversationMcpAuthorization(options) {
 }
 
 // src/holder/mcp-helper-access.ts
-var import_promises54 = require("fs/promises");
+var import_promises55 = require("fs/promises");
 function createHelperMcpAccess(options) {
   return {
     [Symbol.asyncDispose]: async () => {
-      await (0, import_promises54.rm)(options.credentialPath, { force: true });
+      await (0, import_promises55.rm)(options.credentialPath, { force: true });
     },
     url: options.managedMcp.url,
     authorization: async (signal) => {
       const authorization = await options.managedMcp.authorization(signal);
       if (authorization === void 0 || signal.aborted) {
-        await (0, import_promises54.rm)(options.credentialPath, { force: true });
+        await (0, import_promises55.rm)(options.credentialPath, { force: true });
         return void 0;
       }
       const credential = {
@@ -67036,8 +67296,8 @@ function createHelperMcpAccess(options) {
 }
 
 // src/holder/run-inputs.ts
-var import_promises55 = require("fs/promises");
-var import_node_path53 = require("path");
+var import_promises56 = require("fs/promises");
+var import_node_path54 = require("path");
 var NO_RUN_INPUTS = {
   attachments: [],
   providerEnv: {},
@@ -67050,18 +67310,18 @@ function safeFilename(filename) {
   return safe || "attachment";
 }
 async function prepareRunInputs(spec, { source, tmpDir, signal, skills = [] }) {
-  const dir = (0, import_node_path53.join)(tmpDir, "runs", spec.runId);
+  const dir = (0, import_node_path54.join)(tmpDir, "runs", spec.runId);
   const cleanup = async () => {
-    await (0, import_promises55.rm)(dir, { recursive: true, force: true });
+    await (0, import_promises56.rm)(dir, { recursive: true, force: true });
   };
   try {
     const credential = await source.fetchProviderCredential(spec.runId, signal);
     const attachments = [];
-    if (spec.attachments?.length) await (0, import_promises55.mkdir)(dir, { recursive: true, mode: 448 });
+    if (spec.attachments?.length) await (0, import_promises56.mkdir)(dir, { recursive: true, mode: 448 });
     for (const [index, attachment] of (spec.attachments ?? []).entries()) {
       const bytes = await source.downloadAttachment(spec.runId, attachment.id, signal);
-      const path4 = (0, import_node_path53.join)(dir, `${index}-${safeFilename(attachment.filename)}`);
-      await (0, import_promises55.writeFile)(path4, bytes, { mode: 384 });
+      const path4 = (0, import_node_path54.join)(dir, `${index}-${safeFilename(attachment.filename)}`);
+      await (0, import_promises56.writeFile)(path4, bytes, { mode: 384 });
       attachments.push({
         id: attachment.id,
         kind: attachment.kind,
@@ -67088,30 +67348,30 @@ async function prepareRunInputs(spec, { source, tmpDir, signal, skills = [] }) {
 }
 
 // src/holder/serve.ts
-var import_node_crypto29 = require("crypto");
-var import_node_fs21 = require("fs");
+var import_node_crypto30 = require("crypto");
+var import_node_fs22 = require("fs");
 var import_node_net3 = require("net");
-var import_node_path64 = require("path");
+var import_node_path65 = require("path");
 init_runtime_v2();
 
 // src/holder/admission.ts
-var import_node_fs18 = require("fs");
-var import_promises59 = require("fs/promises");
+var import_node_fs19 = require("fs");
+var import_promises60 = require("fs/promises");
 var import_node_os9 = require("os");
-var import_node_path58 = require("path");
+var import_node_path59 = require("path");
 init_constants();
 
 // ../shared/dist/node/local-workspace.js
-var import_node_fs17 = require("fs");
+var import_node_fs18 = require("fs");
 var import_node_os8 = require("os");
-var import_node_path54 = require("path");
+var import_node_path55 = require("path");
 function resolveAlanDefaultWorkspacePath(homeDirectory = (0, import_node_os8.homedir)()) {
-  return (0, import_node_path54.join)(homeDirectory, ".alan", "workspace");
+  return (0, import_node_path55.join)(homeDirectory, ".alan", "workspace");
 }
 
 // src/holder/admission-relocation.ts
-var import_promises56 = require("fs/promises");
-var import_node_path55 = require("path");
+var import_promises57 = require("fs/promises");
+var import_node_path56 = require("path");
 var MAX_RELOCATION_CANDIDATES = 200;
 var RELOCATION_BUDGET_MS = 2e4;
 function repositoryIdentity(url3) {
@@ -67146,8 +67406,8 @@ async function originIdentity(git, path4, signal) {
 }
 async function childDirectories(parent, limit) {
   try {
-    const entries = await (0, import_promises56.readdir)(parent, { withFileTypes: true });
-    return entries.filter((entry) => entry.isDirectory()).slice(0, limit).map((entry) => (0, import_node_path55.join)(parent, entry.name));
+    const entries = await (0, import_promises57.readdir)(parent, { withFileTypes: true });
+    return entries.filter((entry) => entry.isDirectory()).slice(0, limit).map((entry) => (0, import_node_path56.join)(parent, entry.name));
   } catch {
     return [];
   }
@@ -67155,7 +67415,7 @@ async function childDirectories(parent, limit) {
 async function candidateFolders(search) {
   const roots = /* @__PURE__ */ new Map();
   for (const path4 of [search.missingPath, ...search.approvedWorkspacePaths]) {
-    const parent = (0, import_node_path55.dirname)((0, import_node_path55.resolve)(path4));
+    const parent = (0, import_node_path56.dirname)((0, import_node_path56.resolve)(path4));
     roots.set(comparablePath(parent, search.platform), parent);
   }
   const candidates2 = /* @__PURE__ */ new Map();
@@ -67182,9 +67442,9 @@ async function discoverRelocatedWorkspace(search) {
 }
 
 // src/holder/checkout-refresh.ts
-var import_node_crypto27 = require("crypto");
-var import_promises57 = require("fs/promises");
-var import_node_path56 = require("path");
+var import_node_crypto28 = require("crypto");
+var import_promises58 = require("fs/promises");
+var import_node_path57 = require("path");
 function short(sha) {
   return sha.slice(0, 12);
 }
@@ -67196,8 +67456,8 @@ function staleLine(path4, snapshot2, tip) {
 }
 async function claimOnce(dir, name) {
   try {
-    await (0, import_promises57.mkdir)(dir, { recursive: true, mode: 448 });
-    await (await (0, import_promises57.open)((0, import_node_path56.join)(dir, name), "wx")).close();
+    await (0, import_promises58.mkdir)(dir, { recursive: true, mode: 448 });
+    await (await (0, import_promises58.open)((0, import_node_path57.join)(dir, name), "wx")).close();
     return true;
   } catch {
     return false;
@@ -67228,8 +67488,8 @@ async function fastForward(freshness, operationId, deps, signal) {
 }
 async function atFirstLease(freshness, spec, deps, signal) {
   const first = await claimOnce(
-    (0, import_node_path56.join)(deps.dir, "leased"),
-    (0, import_node_crypto27.createHash)("sha256").update(freshness.path).digest("hex")
+    (0, import_node_path57.join)(deps.dir, "leased"),
+    (0, import_node_crypto28.createHash)("sha256").update(freshness.path).digest("hex")
   );
   switch (freshness.state) {
     case "current":
@@ -67259,7 +67519,7 @@ async function checkoutsOf(spec, leaseTargets) {
 function createCheckoutRefresh(deps) {
   return async (spec, leaseTargets, signal) => {
     if (spec.providerSessionId !== void 0) return void 0;
-    if (!await claimOnce((0, import_node_path56.join)(deps.dir, "conversations"), spec.conversationId)) return void 0;
+    if (!await claimOnce((0, import_node_path57.join)(deps.dir, "conversations"), spec.conversationId)) return void 0;
     const lines2 = [];
     for (const target of await checkoutsOf(spec, leaseTargets)) {
       const freshness = await readCheckoutFreshness(deps.dir, target);
@@ -67280,8 +67540,8 @@ function createCheckoutRefresh(deps) {
 }
 
 // src/holder/lease.ts
-var import_promises58 = require("fs/promises");
-var import_node_path57 = require("path");
+var import_promises59 = require("fs/promises");
+var import_node_path58 = require("path");
 var LEASE_CHECK_EVERY_MS = 5e3;
 var MAX_TRANSIENT_FAILURES = 3;
 var BACKOFF_BASE_MS = 1e3;
@@ -67295,8 +67555,8 @@ function identityFailure(code, workspacePath) {
   return { code, problemCode: "app.workspace.missing", message: MESSAGES[code], workspacePath };
 }
 async function fileIdentity(path4) {
-  const canonical = await (0, import_promises58.realpath)(path4);
-  const info = await (0, import_promises58.stat)(canonical, { bigint: true });
+  const canonical = await (0, import_promises59.realpath)(path4);
+  const info = await (0, import_promises59.stat)(canonical, { bigint: true });
   return `${canonical}:${info.dev}:${info.ino}`;
 }
 async function snapshot(git, path4, signal) {
@@ -67315,7 +67575,7 @@ async function snapshot(git, path4, signal) {
       workspace: await fileIdentity(path4),
       repository: await fileIdentity(commonDir),
       worktree: await fileIdentity(gitDir),
-      commonDir: await (0, import_promises58.realpath)(commonDir)
+      commonDir: await (0, import_promises59.realpath)(commonDir)
     };
   } catch {
     return null;
@@ -67328,7 +67588,7 @@ async function gitValue(git, path4, args, signal) {
 }
 async function pathExists(path4) {
   try {
-    await (0, import_promises58.stat)(path4);
+    await (0, import_promises59.stat)(path4);
     return true;
   } catch (error61) {
     return errnoCode(error61) !== "ENOENT" && errnoCode(error61) !== "ENOTDIR";
@@ -67337,19 +67597,19 @@ async function pathExists(path4) {
 async function hasGitMarker(path4) {
   let directory;
   try {
-    directory = await (0, import_promises58.realpath)(path4);
+    directory = await (0, import_promises59.realpath)(path4);
   } catch {
     return true;
   }
   for (; ; ) {
     try {
-      await (0, import_promises58.stat)((0, import_node_path57.join)(directory, ".git"));
+      await (0, import_promises59.stat)((0, import_node_path58.join)(directory, ".git"));
       return true;
     } catch (error61) {
       const code = errnoCode(error61);
       if (code !== "ENOENT" && code !== "ENOTDIR") return true;
     }
-    const parent = (0, import_node_path57.dirname)(directory);
+    const parent = (0, import_node_path58.dirname)(directory);
     if (parent === directory) return false;
     directory = parent;
   }
@@ -67513,7 +67773,7 @@ function volumeRoot(path4) {
 }
 async function exists4(path4) {
   try {
-    await (0, import_promises59.stat)(path4);
+    await (0, import_promises60.stat)(path4);
     return true;
   } catch {
     return false;
@@ -67521,10 +67781,10 @@ async function exists4(path4) {
 }
 async function inspectReadiness(path4) {
   try {
-    if (!(await (0, import_promises59.stat)(path4)).isDirectory()) {
+    if (!(await (0, import_promises60.stat)(path4)).isDirectory()) {
       return { ready: false, missing: true, message: MESSAGES2.missing };
     }
-    await (0, import_promises59.access)(path4, import_node_fs18.constants.R_OK | import_node_fs18.constants.W_OK | import_node_fs18.constants.X_OK);
+    await (0, import_promises60.access)(path4, import_node_fs19.constants.R_OK | import_node_fs19.constants.W_OK | import_node_fs19.constants.X_OK);
     return { ready: true };
   } catch (error61) {
     const code = errnoCode(error61) ?? "";
@@ -67602,8 +67862,8 @@ async function admitDefaultWorkspace(spec, context, skills) {
   const { env } = context;
   const path4 = resolveAlanDefaultWorkspacePath(env.HOME || env.USERPROFILE || (0, import_node_os9.homedir)());
   try {
-    await (0, import_promises59.mkdir)(path4, { recursive: true, mode: 448 });
-    await (0, import_promises59.access)(path4, import_node_fs18.constants.R_OK | import_node_fs18.constants.W_OK | import_node_fs18.constants.X_OK);
+    await (0, import_promises60.mkdir)(path4, { recursive: true, mode: 448 });
+    await (0, import_promises60.access)(path4, import_node_fs19.constants.R_OK | import_node_fs19.constants.W_OK | import_node_fs19.constants.X_OK);
     return {
       kind: "admitted",
       spec: { ...spec, projectPath: path4 },
@@ -67679,7 +67939,7 @@ var PROBE_TIMEOUT_MS2 = 5e3;
 function createHolderWorkspace(machine, clock, log) {
   const platform3 = machine.platform ?? process.platform;
   const git = createGitRunner({ env: machine.env, platform: platform3, localTimeoutMs: PROBE_TIMEOUT_MS2 });
-  const locks = openRepositoryLocks({ dir: (0, import_node_path58.join)(machine.stateDir, "locks"), clock, platform: platform3 });
+  const locks = openRepositoryLocks({ dir: (0, import_node_path59.join)(machine.stateDir, "locks"), clock, platform: platform3 });
   return {
     admission: {
       env: machine.env,
@@ -67691,7 +67951,7 @@ function createHolderWorkspace(machine, clock, log) {
       ),
       approvedRoots: async () => {
         const approved = await openApprovedPaths({
-          file: (0, import_node_path58.join)(machine.stateDir, "workspaces.json"),
+          file: (0, import_node_path59.join)(machine.stateDir, "workspaces.json"),
           log,
           platform: platform3
         });
@@ -67704,7 +67964,7 @@ function createHolderWorkspace(machine, clock, log) {
         git,
         locks,
         log,
-        dir: (0, import_node_path58.join)(machine.stateDir, "checkout-freshness")
+        dir: (0, import_node_path59.join)(machine.stateDir, "checkout-freshness")
       })
     } : {}
   };
@@ -67732,7 +67992,7 @@ async function respondToTurn(runningRunId, gate, driver, request2) {
 }
 
 // src/holder/session-facts.ts
-var import_promises60 = require("fs/promises");
+var import_promises61 = require("fs/promises");
 var CLI_RSS_CACHE_MS = 1e4;
 var LOGIN_PROBLEM_PREFIX = "cli.auth.";
 function isLoginFailure(result) {
@@ -67758,8 +68018,8 @@ function createSessionFacts(options) {
     const path4 = await resolveCommandOnPath(command, env, platform3);
     if (path4 === null) return null;
     try {
-      const real = await (0, import_promises60.realpath)(path4);
-      const info = await (0, import_promises60.stat)(real);
+      const real = await (0, import_promises61.realpath)(path4);
+      const info = await (0, import_promises61.stat)(real);
       return { command, key: `${real}:${info.ino}:${info.size}:${info.mtimeMs}` };
     } catch {
       return null;
@@ -67846,12 +68106,12 @@ function createSessionFacts(options) {
 init_acp2();
 
 // src/run-log/archive.ts
-var import_promises61 = require("fs/promises");
-var import_node_path59 = require("path");
+var import_promises62 = require("fs/promises");
+var import_node_path60 = require("path");
 init_runtime_v2();
 async function openRunArchive(runsDir) {
-  const path4 = (0, import_node_path59.join)((0, import_node_path59.dirname)(runsDir), "archived-runs.txt");
-  const text2 = await (0, import_promises61.readFile)(path4, "utf8").catch((error61) => {
+  const path4 = (0, import_node_path60.join)((0, import_node_path60.dirname)(runsDir), "archived-runs.txt");
+  const text2 = await (0, import_promises62.readFile)(path4, "utf8").catch((error61) => {
     if (errnoCode(error61) === "ENOENT") return "";
     throw error61;
   });
@@ -67865,7 +68125,7 @@ async function openRunArchive(runsDir) {
     add: async (runIds) => {
       const added = runIds.filter((runId) => !archived.has(runId));
       if (added.length === 0) return;
-      await (0, import_promises61.appendFile)(path4, `
+      await (0, import_promises62.appendFile)(path4, `
 ${added.join("\n")}
 `, { mode: 384 });
       for (const runId of added) archived.add(runId);
@@ -67874,13 +68134,13 @@ ${added.join("\n")}
 }
 
 // src/run-log/complete.ts
-var import_node_crypto28 = require("crypto");
-var import_node_fs19 = require("fs");
-var import_node_path61 = require("path");
+var import_node_crypto29 = require("crypto");
+var import_node_fs20 = require("fs");
+var import_node_path62 = require("path");
 
 // src/run-log/directory.ts
-var import_promises62 = require("fs/promises");
-var import_node_path60 = require("path");
+var import_promises63 = require("fs/promises");
+var import_node_path61 = require("path");
 init_runtime_v2();
 init_zod();
 var runMetaSchema = external_exports.object({
@@ -67906,17 +68166,17 @@ async function readRunMeta(path4) {
   return read.kind === "ok" ? read.value : null;
 }
 function runDirectory(runsDir, runId) {
-  const dir = (0, import_node_path60.join)(runsDir, runId);
+  const dir = (0, import_node_path61.join)(runsDir, runId);
   return {
     dir,
-    log: (0, import_node_path60.join)(dir, "log.jsonl"),
-    upload: (0, import_node_path60.join)(dir, "upload.json"),
-    meta: (0, import_node_path60.join)(dir, "run.json")
+    log: (0, import_node_path61.join)(dir, "log.jsonl"),
+    upload: (0, import_node_path61.join)(dir, "upload.json"),
+    meta: (0, import_node_path61.join)(dir, "run.json")
   };
 }
 async function isRunClaimed(runsDir, runId) {
   try {
-    return (await (0, import_promises62.stat)(runDirectory(runsDir, runId).log)).size > 0;
+    return (await (0, import_promises63.stat)(runDirectory(runsDir, runId).log)).size > 0;
   } catch (error61) {
     if (errnoCode(error61) === "ENOENT") return false;
     throw error61;
@@ -67925,24 +68185,24 @@ async function isRunClaimed(runsDir, runId) {
 
 // src/run-log/complete.ts
 function writeLogFile(path4, dir, text2) {
-  const temp = (0, import_node_path61.join)(dir, `.log.${(0, import_node_crypto28.randomUUID)()}.tmp`);
-  const fd = (0, import_node_fs19.openSync)(temp, "wx", 384);
+  const temp = (0, import_node_path62.join)(dir, `.log.${(0, import_node_crypto29.randomUUID)()}.tmp`);
+  const fd = (0, import_node_fs20.openSync)(temp, "wx", 384);
   try {
-    (0, import_node_fs19.writeSync)(fd, text2);
-    (0, import_node_fs19.fsyncSync)(fd);
+    (0, import_node_fs20.writeSync)(fd, text2);
+    (0, import_node_fs20.fsyncSync)(fd);
   } finally {
-    (0, import_node_fs19.closeSync)(fd);
+    (0, import_node_fs20.closeSync)(fd);
   }
   try {
-    (0, import_node_fs19.renameSync)(temp, path4);
+    (0, import_node_fs20.renameSync)(temp, path4);
   } finally {
-    (0, import_node_fs19.rmSync)(temp, { force: true });
+    (0, import_node_fs20.rmSync)(temp, { force: true });
   }
 }
 async function writeCompleteRunLog(runsDir, meta3, records) {
   const paths = runDirectory(runsDir, meta3.runId);
   if (!await isRunClaimed(runsDir, meta3.runId)) {
-    (0, import_node_fs19.mkdirSync)(paths.dir, { recursive: true, mode: 448 });
+    (0, import_node_fs20.mkdirSync)(paths.dir, { recursive: true, mode: 448 });
     const text2 = records.map((record2, index) => {
       const line = { seq: index + 1, at: record2.at, update: record2.update };
       return `${JSON.stringify(line)}
@@ -67954,8 +68214,8 @@ async function writeCompleteRunLog(runsDir, meta3, records) {
 }
 
 // src/run-log/conversation-index.ts
-var import_promises63 = require("fs/promises");
-var import_node_path62 = require("path");
+var import_promises64 = require("fs/promises");
+var import_node_path63 = require("path");
 init_runtime_v2();
 init_zod();
 var ORDINALS_PER_SHARD = 1e3;
@@ -67972,13 +68232,13 @@ var coverageSchema = external_exports.object({
   nextExpectedOrdinal: external_exports.number().int().positive()
 });
 function conversationsDirectory(runsDir) {
-  return (0, import_node_path62.join)((0, import_node_path62.dirname)(runsDir), "conversations");
+  return (0, import_node_path63.join)((0, import_node_path63.dirname)(runsDir), "conversations");
 }
 function indexDirectory(runsDir, conversationId) {
-  return (0, import_node_path62.join)(conversationsDirectory(runsDir), conversationId, "turn-index");
+  return (0, import_node_path63.join)(conversationsDirectory(runsDir), conversationId, "turn-index");
 }
 function shardPath(runsDir, conversationId, ordinal) {
-  return (0, import_node_path62.join)(
+  return (0, import_node_path63.join)(
     indexDirectory(runsDir, conversationId),
     `${Math.floor(ordinal / ORDINALS_PER_SHARD)}.jsonl`
   );
@@ -67987,10 +68247,10 @@ async function indexConversationRun(runsDir, conversationId, ordinal, assistantO
   const nextOrdinal = assistantOrdinal + 1;
   if (nextOrdinal <= ordinal) throw new Error("Assistant order must follow the prompt");
   const path4 = shardPath(runsDir, conversationId, ordinal);
-  await (0, import_promises63.mkdir)((0, import_node_path62.dirname)(path4), { recursive: true, mode: 448 });
-  await (0, import_promises63.appendFile)(path4, `${JSON.stringify({ ordinal, nextOrdinal, runId })}
+  await (0, import_promises64.mkdir)((0, import_node_path63.dirname)(path4), { recursive: true, mode: 448 });
+  await (0, import_promises64.appendFile)(path4, `${JSON.stringify({ ordinal, nextOrdinal, runId })}
 `, { mode: 384 });
-  const coveragePath = (0, import_node_path62.join)((0, import_node_path62.dirname)((0, import_node_path62.dirname)(path4)), "coverage.json");
+  const coveragePath = (0, import_node_path63.join)((0, import_node_path63.dirname)((0, import_node_path63.dirname)(path4)), "coverage.json");
   const coverage = await readJsonFile(coveragePath, coverageSchema);
   const current = coverage.kind === "ok" ? coverage.value : null;
   const next = nextCoverage(current, ordinal, nextOrdinal);
@@ -68005,13 +68265,13 @@ function nextCoverage(current, ordinal, nextOrdinal) {
   return null;
 }
 async function readConversationIndexCoverage(runsDir, conversationId) {
-  const path4 = (0, import_node_path62.join)((0, import_node_path62.dirname)(indexDirectory(runsDir, conversationId)), "coverage.json");
+  const path4 = (0, import_node_path63.join)((0, import_node_path63.dirname)(indexDirectory(runsDir, conversationId)), "coverage.json");
   const result = await readJsonFile(path4, coverageSchema);
   return result.kind === "ok" ? result.value : null;
 }
 async function readConversationRunIndex(runsDir, conversationId, before, limit) {
   const directory = indexDirectory(runsDir, conversationId);
-  const names = await (0, import_promises63.readdir)(directory).catch((error61) => {
+  const names = await (0, import_promises64.readdir)(directory).catch((error61) => {
     if (error61.code === "ENOENT") return [];
     throw error61;
   });
@@ -68020,7 +68280,7 @@ async function readConversationRunIndex(runsDir, conversationId, before, limit)
   ).sort((left, right) => right - left);
   const selected = [];
   for (const shard of shards) {
-    const text2 = await (0, import_promises63.readFile)((0, import_node_path62.join)(directory, `${shard}.jsonl`), "utf8");
+    const text2 = await (0, import_promises64.readFile)((0, import_node_path63.join)(directory, `${shard}.jsonl`), "utf8");
     const records = text2.split("\n").flatMap((line) => {
       if (!line) return [];
       const parsed = indexRecordSchema.parse(JSON.parse(line));
@@ -68045,7 +68305,7 @@ async function readIndexableRun(runsDir, name) {
   return { conversationId: meta3.conversationId, ordinal, assistantOrdinal, runId: runId.data };
 }
 async function readIndexableRuns(runsDir) {
-  const names = await (0, import_promises63.readdir)(runsDir).catch(() => []);
+  const names = await (0, import_promises64.readdir)(runsDir).catch(() => []);
   const byConversation = /* @__PURE__ */ new Map();
   let next = 0;
   const worker = async () => {
@@ -68075,21 +68335,21 @@ async function writeConversationIndex(directory, runs) {
     else lines2.push(line);
     coverage = nextCoverage(coverage, run2.ordinal, nextOrdinal) ?? coverage;
   }
-  await (0, import_promises63.mkdir)((0, import_node_path62.join)(directory, "turn-index"), { recursive: true, mode: 448 });
+  await (0, import_promises64.mkdir)((0, import_node_path63.join)(directory, "turn-index"), { recursive: true, mode: 448 });
   for (const [shard, lines2] of shards) {
-    await (0, import_promises63.writeFile)((0, import_node_path62.join)(directory, "turn-index", `${shard}.jsonl`), `${lines2.join("\n")}
+    await (0, import_promises64.writeFile)((0, import_node_path63.join)(directory, "turn-index", `${shard}.jsonl`), `${lines2.join("\n")}
 `, {
       mode: 384
     });
   }
-  await (0, import_promises63.writeFile)((0, import_node_path62.join)(directory, "coverage.json"), `${JSON.stringify(coverage)}
+  await (0, import_promises64.writeFile)((0, import_node_path63.join)(directory, "coverage.json"), `${JSON.stringify(coverage)}
 `, {
     mode: 384
   });
 }
 async function rebuildConversationIndexes(runsDir) {
   const root = conversationsDirectory(runsDir);
-  const exists6 = await (0, import_promises63.stat)(root).then(
+  const exists6 = await (0, import_promises64.stat)(root).then(
     () => true,
     (error61) => {
       if (errnoCode(error61) === "ENOENT") return false;
@@ -68098,18 +68358,18 @@ async function rebuildConversationIndexes(runsDir) {
   );
   if (exists6) return 0;
   const building = `${root}.rebuilding`;
-  await (0, import_promises63.rm)(building, { recursive: true, force: true });
-  await (0, import_promises63.mkdir)(building, { recursive: true, mode: 448 });
+  await (0, import_promises64.rm)(building, { recursive: true, force: true });
+  await (0, import_promises64.mkdir)(building, { recursive: true, mode: 448 });
   const byConversation = await readIndexableRuns(runsDir);
   for (const [conversationId, runs] of byConversation) {
-    await writeConversationIndex((0, import_node_path62.join)(building, conversationId), runs);
+    await writeConversationIndex((0, import_node_path63.join)(building, conversationId), runs);
   }
-  await (0, import_promises63.rename)(building, root);
+  await (0, import_promises64.rename)(building, root);
   return byConversation.size;
 }
 
 // src/run-log/reader.ts
-var import_promises64 = require("fs/promises");
+var import_promises65 = require("fs/promises");
 init_runtime_v2();
 
 // src/run-log/tail.ts
@@ -68132,7 +68392,7 @@ function firstRecordLength(bytes) {
   return bytes.indexOf(RUN_LOG_RECORD_SEPARATOR) + 1;
 }
 async function openRunLogReader(path4) {
-  const handle = await (0, import_promises64.open)(path4, "r");
+  const handle = await (0, import_promises65.open)(path4, "r");
   const readAt = async (position, length) => {
     const buffer = Buffer.alloc(length);
     const { bytesRead } = await handle.read(buffer, 0, length, position);
@@ -68166,7 +68426,7 @@ async function openRunLogReader(path4) {
   };
 }
 async function readLastRecord(path4) {
-  const handle = await (0, import_promises64.open)(path4, "r").catch(() => null);
+  const handle = await (0, import_promises65.open)(path4, "r").catch(() => null);
   if (handle === null) return null;
   try {
     const { size } = await handle.stat();
@@ -68199,13 +68459,13 @@ function runEnded(input2) {
 var decoder = new TextDecoder();
 
 // src/run-log/writer.ts
-var import_node_fs20 = require("fs");
-var import_node_path63 = require("path");
+var import_node_fs21 = require("fs");
+var import_node_path64 = require("path");
 init_runtime_v2();
 function lastSeq(fd, size) {
   for (const length of tailWindows(size)) {
     const buffer = Buffer.alloc(length);
-    (0, import_node_fs20.readSync)(fd, buffer, 0, length, size - length);
+    (0, import_node_fs21.readSync)(fd, buffer, 0, length, size - length);
     const last = lastLine(buffer.toString("utf8").trimEnd(), length === size);
     if (last === void 0) continue;
     if (last.length === 0) return 0;
@@ -68216,13 +68476,13 @@ function lastSeq(fd, size) {
   throw new RuntimeFault("record_too_large", "Run log tail record is larger than any record");
 }
 function openRunLog(path4, clock) {
-  (0, import_node_fs20.mkdirSync)((0, import_node_path63.dirname)(path4), { recursive: true, mode: 448 });
-  const fd = (0, import_node_fs20.openSync)(path4, "a+", 384);
-  let size = (0, import_node_fs20.fstatSync)(fd).size;
+  (0, import_node_fs21.mkdirSync)((0, import_node_path64.dirname)(path4), { recursive: true, mode: 448 });
+  const fd = (0, import_node_fs21.openSync)(path4, "a+", 384);
+  let size = (0, import_node_fs21.fstatSync)(fd).size;
   let seq = lastSeq(fd, size);
   let dirty = false;
   const sync = () => {
-    (0, import_node_fs20.fsyncSync)(fd);
+    (0, import_node_fs21.fsyncSync)(fd);
     dirty = false;
   };
   return {
@@ -68236,7 +68496,7 @@ function openRunLog(path4, clock) {
       };
       const line = Buffer.from(`${JSON.stringify(record2)}
 `, "utf8");
-      (0, import_node_fs20.writeSync)(fd, line);
+      (0, import_node_fs21.writeSync)(fd, line);
       size += line.length;
       dirty = true;
       if (isRunLifecycleKind(update.sessionUpdate)) sync();
@@ -68248,7 +68508,7 @@ function openRunLog(path4, clock) {
     },
     [Symbol.dispose]: () => {
       if (dirty) sync();
-      (0, import_node_fs20.closeSync)(fd);
+      (0, import_node_fs21.closeSync)(fd);
     }
   };
 }
@@ -68533,12 +68793,12 @@ var TASK_UNSUPPORTED = {
   message: "This agent cannot stop one background task."
 };
 function sha2564(value2) {
-  return (0, import_node_crypto29.createHash)("sha256").update(value2).digest("hex");
+  return (0, import_node_crypto30.createHash)("sha256").update(value2).digest("hex");
 }
 function tokenMatches(expected, presented) {
   const a = Buffer.from(sha2564(expected), "hex");
   const b = Buffer.from(sha2564(presented), "hex");
-  return (0, import_node_crypto29.timingSafeEqual)(a, b);
+  return (0, import_node_crypto30.timingSafeEqual)(a, b);
 }
 async function runHolder({
   launch,
@@ -68552,7 +68812,7 @@ async function runHolder({
   try {
     const identity = await readProcessIdentity(process.pid);
     if (identity === null) throw new RuntimeFault("internal", "Cannot read own process identity");
-    const _engines = __using(_stack, recordSpawnedEngines(engineRecordsPath((0, import_node_path64.dirname)(launch.statusPath)), clock, log));
+    const _engines = __using(_stack, recordSpawnedEngines(engineRecordsPath((0, import_node_path65.dirname)(launch.statusPath)), clock, log));
     const holder = {
       state: "idle",
       runId: null,
@@ -68748,17 +69008,17 @@ async function runHolder({
       client.on("error", () => holder.clients.delete(client));
     });
     removeStaleEndpoint(launch.endpoint);
-    await new Promise((resolve12, reject) => {
+    await new Promise((resolve13, reject) => {
       server.once("error", reject);
-      server.listen(launch.endpoint, () => resolve12());
+      server.listen(launch.endpoint, () => resolve13());
     });
     await writeStatus();
     log.info("holder.ready", { conversationId: launch.conversationId, pid: identity.pid });
-    await new Promise((resolve12) => exit.signal.addEventListener("abort", () => resolve12()));
+    await new Promise((resolve13) => exit.signal.addEventListener("abort", () => resolve13()));
     await driver.suspend?.().catch((error61) => log.warn("holder.driver_suspend_failed", { error: error61 }));
     for (const client of holder.clients) client.end();
-    await new Promise((resolve12) => server.close(() => resolve12()));
-    (0, import_node_fs21.rmSync)(launch.statusPath, { force: true });
+    await new Promise((resolve13) => server.close(() => resolve13()));
+    (0, import_node_fs22.rmSync)(launch.statusPath, { force: true });
     log.info("holder.suspended", { conversationId: launch.conversationId });
   } catch (_) {
     var _error = _, _hasError = true;
@@ -68846,7 +69106,7 @@ var DEFAULT_MAX_ACTIVE_RUNS = 32;
 var HOLDER_BUSY = "busy";
 async function listIds(dir, schema) {
   const ids = [];
-  for (const name of await (0, import_promises65.readdir)(dir).catch(() => [])) {
+  for (const name of await (0, import_promises66.readdir)(dir).catch(() => [])) {
     const parsed = schema.safeParse(name);
     if (parsed.success) ids.push(parsed.data);
   }
@@ -68860,14 +69120,14 @@ function holderIdentity(status) {
   return command === void 0 ? { pid, startedAt } : { pid, startedAt, command };
 }
 function sessionFiles(paths, conversationId) {
-  const dir = (0, import_node_path65.join)(paths.sessions, conversationId);
-  return { dir, launch: (0, import_node_path65.join)(dir, "launch.json"), status: (0, import_node_path65.join)(dir, "holder.json") };
+  const dir = (0, import_node_path66.join)(paths.sessions, conversationId);
+  return { dir, launch: (0, import_node_path66.join)(dir, "launch.json"), status: (0, import_node_path66.join)(dir, "holder.json") };
 }
 async function removeHolderFiles(files) {
   for (const path4 of [files.launch, files.status, engineRecordsPath(files.dir)]) {
-    await (0, import_promises65.rm)(path4, { force: true });
+    await (0, import_promises66.rm)(path4, { force: true });
   }
-  await (0, import_promises65.rmdir)(files.dir).catch((error61) => {
+  await (0, import_promises66.rmdir)(files.dir).catch((error61) => {
     if (!["ENOENT", "ENOTEMPTY", "EEXIST"].includes(errnoCode(error61) ?? "")) throw error61;
   });
 }
@@ -69030,8 +69290,8 @@ async function openSessions(deps) {
       protocol: HOLDER_PROTOCOL,
       conversationId,
       machineId: deps.machineId,
-      endpoint: ipcEndpoint(paths.sockets, (0, import_node_crypto30.randomUUID)().slice(0, 8)),
-      token: (0, import_node_crypto30.randomBytes)(32).toString("hex"),
+      endpoint: ipcEndpoint(paths.sockets, (0, import_node_crypto31.randomUUID)().slice(0, 8)),
+      token: (0, import_node_crypto31.randomBytes)(32).toString("hex"),
       runsDir: paths.runs,
       statusPath: files.status
     };
@@ -69057,7 +69317,7 @@ async function openSessions(deps) {
     const meta3 = await readRunMeta(dir.meta);
     const last = await readLastRecord(dir.log);
     if (meta3 === null || last === null) return null;
-    const logged = await (0, import_promises65.stat)(dir.log).catch((error61) => {
+    const logged = await (0, import_promises66.stat)(dir.log).catch((error61) => {
       if (errnoCode(error61) === "ENOENT") return null;
       throw error61;
     });
@@ -69282,7 +69542,8 @@ var envSchema = external_exports.object({
   ALAN_RUNTIME_GIT_GATEWAY_URL: external_exports.url().optional(),
   ALAN_RUNTIME_WORKSPACE_ROOT: external_exports.string().min(1).optional(),
   XDG_CONFIG_HOME: external_exports.string().min(1).optional(),
-  GH_CONFIG_DIR: external_exports.string().min(1).optional()
+  GH_CONFIG_DIR: external_exports.string().min(1).optional(),
+  CODEX_HOME: external_exports.string().trim().min(1).optional()
 });
 var DEFAULT_API_URLS = {
   production: "https://api.tryalan.ai",
@@ -69335,7 +69596,8 @@ function loadRuntimeConfig(env = process.env, totalMemoryBytes = (0, import_node
     ALAN_RUNTIME_GIT_GATEWAY_URL,
     ALAN_RUNTIME_WORKSPACE_ROOT,
     XDG_CONFIG_HOME,
-    GH_CONFIG_DIR
+    GH_CONFIG_DIR,
+    CODEX_HOME
   } = parsed.data;
   const home = (0, import_node_os11.homedir)();
   const suspendDefaults = defaultSuspendPolicy(totalMemoryBytes);
@@ -69367,7 +69629,8 @@ function loadRuntimeConfig(env = process.env, totalMemoryBytes = (0, import_node
     providerProbes: ALAN_RUNTIME_PROVIDER_PROBES === "on",
     providerToolchain: ALAN_RUNTIME_PROVIDER_NODE !== void 0 && ALAN_RUNTIME_PROVIDER_NPM_CLI !== void 0 ? { node: ALAN_RUNTIME_PROVIDER_NODE, npmCli: ALAN_RUNTIME_PROVIDER_NPM_CLI } : null,
     home,
-    configHome: XDG_CONFIG_HOME ?? (0, import_node_path66.join)(home, ".config"),
+    configHome: XDG_CONFIG_HOME ?? (0, import_node_path67.join)(home, ".config"),
+    codexHome: resolveCodexHome(CODEX_HOME, home),
     ...githubProxyConfig({ ALAN_RUNTIME_GITHUB_PROXY, XDG_CONFIG_HOME, GH_CONFIG_DIR }, home),
     gitGatewayUrl: ALAN_RUNTIME_GIT_GATEWAY_URL ?? null,
     workspaceRoot: ALAN_RUNTIME_WORKSPACE_ROOT ?? null,
@@ -69375,11 +69638,14 @@ function loadRuntimeConfig(env = process.env, totalMemoryBytes = (0, import_node
     adoptsLegacyInstall: ALAN_RUNTIME_STATE_DIR === void 0
   };
 }
+function resolveCodexHome(configuredHome, home) {
+  return configuredHome ?? (0, import_node_path67.join)(home, ".codex");
+}
 function githubProxyConfig(env, home) {
-  const configHome = env.XDG_CONFIG_HOME ?? (0, import_node_path66.join)(home, ".config");
+  const configHome = env.XDG_CONFIG_HOME ?? (0, import_node_path67.join)(home, ".config");
   return {
     githubProxy: env.ALAN_RUNTIME_GITHUB_PROXY === "on",
-    ghConfigDir: env.GH_CONFIG_DIR ?? (0, import_node_path66.join)(configHome, "gh")
+    ghConfigDir: env.GH_CONFIG_DIR ?? (0, import_node_path67.join)(configHome, "gh")
   };
 }
 function serviceEnvironment2(env, profile) {
@@ -69437,9 +69703,9 @@ function takeEnrollmentCodeFromEnv(env = process.env) {
 }
 
 // src/cli/context.ts
-var import_promises66 = require("fs/promises");
+var import_promises67 = require("fs/promises");
 var import_node_os12 = require("os");
-var import_node_path67 = require("path");
+var import_node_path68 = require("path");
 var DESKTOP_BUNDLE_IDS = {
   production: ["com.alan-ai.desktop"],
   staging: ["com.alan-ai.desktop.staging"],
@@ -69479,7 +69745,7 @@ function serviceSpec({ config: config2, paths, self }) {
     profile: config2.profile,
     program: serviceCommand(config2.host, self, launcher),
     environment: config2.serviceEnvironment,
-    logPath: (0, import_node_path67.join)(paths.logs, "service.log"),
+    logPath: (0, import_node_path68.join)(paths.logs, "service.log"),
     associatedBundleIds: DESKTOP_BUNDLE_IDS[config2.profile]
   };
 }
@@ -69487,7 +69753,7 @@ async function installedServiceSpec(ctx) {
   const spec = serviceSpec(ctx);
   if (ctx.config.host === "app") return spec;
   const layout = installLayout(ctx.config.installDir, ctx.config.profile);
-  const installed = await (0, import_promises66.access)(layout.launcher).then(
+  const installed = await (0, import_promises67.access)(layout.launcher).then(
     () => true,
     () => false
   );
@@ -69615,7 +69881,7 @@ var manifestRevisionSchema = external_exports.object({ revision: external_export
 async function manifestRevision(path4) {
   let raw;
   try {
-    raw = JSON.parse(await (0, import_promises67.readFile)(path4, "utf8"));
+    raw = JSON.parse(await (0, import_promises68.readFile)(path4, "utf8"));
   } catch (error61) {
     throw new RuntimeFault("invalid_file", `Cannot read the skill manifest at ${path4}`, {
       cause: error61
@@ -69633,7 +69899,7 @@ async function runSkills(argv) {
     case "scan":
       writeJson({
         status: "failed",
-        attemptId: (0, import_node_crypto31.randomUUID)(),
+        attemptId: (0, import_node_crypto32.randomUUID)(),
         retainedInventoryRevision: null,
         diagnostics: [
           { code: "RUNTIME_SKILL_SCAN_UNSUPPORTED", message: SKILLS_SYNCED_BY_RUNTIME }
@@ -69649,7 +69915,7 @@ async function runSkills(argv) {
         );
       }
       writeJson({
-        attemptId: (0, import_node_crypto31.randomUUID)(),
+        attemptId: (0, import_node_crypto32.randomUUID)(),
         desiredRevision: await manifestRevision(manifest),
         skills: []
       });
@@ -69669,8 +69935,8 @@ async function runSkills(argv) {
 }
 
 // src/cli/commands/doctor.ts
-var import_promises70 = require("fs/promises");
-var import_node_path71 = require("path");
+var import_promises71 = require("fs/promises");
+var import_node_path72 = require("path");
 init_runtime_v2();
 
 // src/identity/credential.ts
@@ -69847,24 +70113,24 @@ async function authorizeDevice(input2) {
 }
 
 // src/identity/enroll.ts
-var import_promises68 = require("fs/promises");
+var import_promises69 = require("fs/promises");
 init_runtime_v2();
 
 // src/identity/installation.ts
-var import_node_crypto32 = require("crypto");
-var import_node_path68 = require("path");
+var import_node_crypto33 = require("crypto");
+var import_node_path69 = require("path");
 init_zod();
 var installationFileSchema = external_exports.object({
   installationId: external_exports.uuid()
 });
 function installationPath(paths) {
-  return (0, import_node_path68.join)(paths.stateDir, "installation.json");
+  return (0, import_node_path69.join)(paths.stateDir, "installation.json");
 }
 async function ensureInstallationId(paths) {
   const path4 = installationPath(paths);
   const existing = await readJsonFile(path4, installationFileSchema);
   if (existing.kind === "ok") return existing.value.installationId;
-  const created = { installationId: (0, import_node_crypto32.randomUUID)() };
+  const created = { installationId: (0, import_node_crypto33.randomUUID)() };
   await writeJsonFileAtomic(path4, created);
   return created.installationId;
 }
@@ -69951,13 +70217,13 @@ async function enrollFromGrantFile(input2) {
     clock: input2.clock,
     access: input2.access
   });
-  await (0, import_promises68.rm)(input2.grantPath, { force: true });
+  await (0, import_promises69.rm)(input2.grantPath, { force: true });
   return machine;
 }
 
 // src/identity/migrate-v1.ts
-var import_promises69 = require("fs/promises");
-var import_node_path69 = require("path");
+var import_promises70 = require("fs/promises");
+var import_node_path70 = require("path");
 init_runtime_v2();
 init_zod();
 var EXIT_POLL_MS = 200;
@@ -69978,11 +70244,11 @@ var ownerLeaseSchema = external_exports.looseObject({ pid: external_exports.numb
 function legacyConfigPath(home, profile) {
   switch (profile) {
     case "production":
-      return (0, import_node_path69.join)(home, ".alan", "agent", "config.json");
+      return (0, import_node_path70.join)(home, ".alan", "agent", "config.json");
     case "staging":
-      return (0, import_node_path69.join)(home, ".alan-staging", "agent", "config.json");
+      return (0, import_node_path70.join)(home, ".alan-staging", "agent", "config.json");
     default:
-      return (0, import_node_path69.join)(home, ".alan-dev", "agent", "config.json");
+      return (0, import_node_path70.join)(home, ".alan-dev", "agent", "config.json");
   }
 }
 async function findLegacyInstall(home, profile) {
@@ -70007,8 +70273,8 @@ async function scrubLegacyInstall(install2) {
   const scrubbed = { ...install2.config, migratedToRuntimeV2: true };
   for (const key of SCRUBBED_KEYS) delete scrubbed[key];
   await writeJsonFileAtomic(`${install2.configPath}.migrated-v1`, scrubbed);
-  await (0, import_promises69.rm)(install2.configPath, { force: true });
-  await (0, import_promises69.rm)(install2.ownerLeasePath, { force: true });
+  await (0, import_promises70.rm)(install2.configPath, { force: true });
+  await (0, import_promises70.rm)(install2.ownerLeasePath, { force: true });
 }
 async function exchangeCredential(deps) {
   const { config: config2 } = deps.install;
@@ -70117,7 +70383,7 @@ async function loadIdentity(paths, options = {}) {
 }
 
 // src/cli/commands/status.ts
-var import_node_path70 = require("path");
+var import_node_path71 = require("path");
 async function serviceStatus(ctx) {
   try {
     return await createServiceManager(ctx.host, ctx.config.profile).status();
@@ -70144,7 +70410,7 @@ async function runtimeState(ctx) {
   const running = await readRunningRuntime(ctx.paths.lock);
   if (running === null) return { state: "offline", pid: null, localApi: null };
   const discovery = await readJsonFile(
-    (0, import_node_path70.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE),
+    (0, import_node_path71.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE),
     localApiDiscoverySchema
   );
   const localApi = discovery.kind === "ok" && discovery.value.pid === running.pid ? {
@@ -70365,7 +70631,7 @@ async function runtimeCheck(ctx, status) {
     return check2("runtime", "warn", "No runtime is running for this profile");
   }
   const client = createRuntimeClient({
-    discoveryPath: (0, import_node_path71.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE)
+    discoveryPath: (0, import_node_path72.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE)
   });
   try {
     const live = await client.status(AbortSignal.timeout(LOCAL_TIMEOUT_MS));
@@ -70392,7 +70658,7 @@ async function runtimeCheck(ctx, status) {
   }
 }
 async function probeHolder(dir, conversationId) {
-  const launch = await readJsonFile((0, import_node_path71.join)(dir, "launch.json"), holderLaunchSchema);
+  const launch = await readJsonFile((0, import_node_path72.join)(dir, "launch.json"), holderLaunchSchema);
   if (launch.kind !== "ok") return null;
   try {
     const reply2 = await withTimeout(
@@ -70417,8 +70683,8 @@ async function probeHolder(dir, conversationId) {
   }
 }
 async function holdersCheck(ctx) {
-  const names = await (0, import_promises70.readdir)(ctx.paths.sessions).catch(() => []);
-  const holders = (await Promise.all(names.map((name) => probeHolder((0, import_node_path71.join)(ctx.paths.sessions, name), name)))).filter((facts) => facts !== null);
+  const names = await (0, import_promises71.readdir)(ctx.paths.sessions).catch(() => []);
+  const holders = (await Promise.all(names.map((name) => probeHolder((0, import_node_path72.join)(ctx.paths.sessions, name), name)))).filter((facts) => facts !== null);
   const dead = holders.filter((holder) => !holder.alive).length;
   return check2(
     "holders",
@@ -70429,10 +70695,10 @@ async function holdersCheck(ctx) {
 }
 async function freeBytesAt(path4) {
   try {
-    const stats = await (0, import_promises70.statfs)(path4);
+    const stats = await (0, import_promises71.statfs)(path4);
     return { path: path4, freeBytes: stats.bavail * stats.bsize };
   } catch (error61) {
-    const parent = (0, import_node_path71.dirname)(path4);
+    const parent = (0, import_node_path72.dirname)(path4);
     if (parent === path4) throw error61;
     return freeBytesAt(parent);
   }
@@ -70450,9 +70716,9 @@ async function diskCheck(ctx) {
   }
 }
 var resolveFromLoginShell = (own2) => resolveCliEnvironment({ env: own2, platform: process.platform });
-async function cliDiscoveryCheck(resolve12) {
+async function cliDiscoveryCheck(resolve13) {
   const own2 = readCliEnvironment();
-  const env = await resolve12(own2);
+  const env = await resolve13(own2);
   const delimiter = process.platform === "win32" ? ";" : ":";
   const ownDirs = new Set((own2.PATH ?? "").split(delimiter));
   const added = (env.PATH ?? "").split(delimiter).filter((dir) => dir.length > 0 && !ownDirs.has(dir));
@@ -70568,7 +70834,7 @@ async function runDoctor(argv, context = cliContext) {
 }
 
 // src/cli/commands/git-credential.ts
-var import_promises71 = require("fs/promises");
+var import_promises72 = require("fs/promises");
 var import_node_net4 = require("net");
 var MAX_RESPONSE_BYTES = 64 * 1024;
 async function readAll(stream) {
@@ -70586,7 +70852,7 @@ function processIo() {
   };
 }
 function askGitCredentialSocket(endpoint, request2, signal) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const socket = (0, import_node_net4.createConnection)(endpoint);
     let buffered = "";
     const fail = (error61) => {
@@ -70613,7 +70879,7 @@ function askGitCredentialSocket(endpoint, request2, signal) {
       signal.removeEventListener("abort", onAbort);
       try {
         const line = buffered.split("\n", 1)[0] ?? "";
-        resolve12(gitCredentialSocketResponseSchema.parse(JSON.parse(line)));
+        resolve13(gitCredentialSocketResponseSchema.parse(JSON.parse(line)));
       } catch (error61) {
         reject(
           new RuntimeFault("io_failed", "the Alan runtime sent an invalid reply", { cause: error61 })
@@ -70678,7 +70944,7 @@ async function configure(argv) {
 }
 async function configureGitGateway(config2, gatewayUrl, signal) {
   const { launcher } = installLayout(config2.installDir, config2.profile);
-  const installed = await (0, import_promises71.access)(launcher).then(
+  const installed = await (0, import_promises72.access)(launcher).then(
     () => true,
     () => false
   );
@@ -70705,7 +70971,7 @@ async function runGitCredential(argv) {
 }
 
 // src/cli/commands/hold.ts
-var import_node_path72 = require("path");
+var import_node_path73 = require("path");
 init_agent2();
 init_runtime_v2();
 async function machineAccess(paths, log, conversationId, transport) {
@@ -70763,7 +71029,7 @@ async function runHold(argv) {
     const config2 = loadRuntimeConfig();
     const paths = runtimePaths(config2.stateDir);
     const log = __using(_stack, openFileLog(
-      (0, import_node_path72.join)(paths.logs, `holder-${launch.value.conversationId}.jsonl`),
+      (0, import_node_path73.join)(paths.logs, `holder-${launch.value.conversationId}.jsonl`),
       config2.logLevel,
       systemClock
     ));
@@ -70774,7 +71040,7 @@ async function runHold(argv) {
     );
     const transport = __using(_stack, createHttpTransport());
     const access7 = await machineAccess(paths, log, launch.value.conversationId, transport);
-    const credentialPath = (0, import_node_path72.join)(paths.tmp, "mcp", `${launch.value.conversationId}.json`);
+    const credentialPath = (0, import_node_path73.join)(paths.tmp, "mcp", `${launch.value.conversationId}.json`);
     const managedMcp = __using(_stack, access7.managedMcp === void 0 ? void 0 : createHelperMcpAccess({
       managedMcp: access7.managedMcp,
       conversationId: launch.value.conversationId,
@@ -70793,7 +71059,8 @@ async function runHold(argv) {
         timings: config2.sessionTimings,
         log,
         ...managedMcp === void 0 ? {} : { managedMcp },
-        codexCredentials: access7.codexCredentials
+        codexCredentials: access7.codexCredentials,
+        installedSkills: () => installedSkillFolders(skillsLayout(paths.stateDir))
       }),
       clock: systemClock,
       log,
@@ -70814,7 +71081,7 @@ async function runHold(argv) {
 }
 
 // src/cli/commands/hook.ts
-var import_node_path73 = require("path");
+var import_node_path74 = require("path");
 var RUNTIME_ANSWER_MS = 2e3;
 var DEBUG_VARIABLE = "ALAN_HOOK_DEBUG";
 function flag(argv, name) {
@@ -70846,7 +71113,7 @@ async function forwardHook(argv, io) {
     return "transcript outside provider root";
   }
   const verdict = await io.send(
-    (0, import_node_path73.join)(io.stateDir, LOCAL_API_DISCOVERY_FILE),
+    (0, import_node_path74.join)(io.stateDir, LOCAL_API_DISCOVERY_FILE),
     hookSignal,
     AbortSignal.timeout(RUNTIME_ANSWER_MS)
   );
@@ -70882,7 +71149,7 @@ async function runHook(argv, overrides = {}) {
 }
 
 // src/cli/commands/ingestion-hooks.ts
-var import_promises72 = require("fs/promises");
+var import_promises73 = require("fs/promises");
 var CODEX_TRUST_NOTE = "Codex runs new hooks only after you review them: open /hooks in Codex.";
 function isAction(value2) {
   return value2 === "enable" || value2 === "disable" || value2 === "status";
@@ -70905,7 +71172,7 @@ function errorMessage2(error61) {
   return error61 instanceof Error ? error61.message : String(error61);
 }
 async function exists5(path4) {
-  return (0, import_promises72.access)(path4).then(
+  return (0, import_promises73.access)(path4).then(
     () => true,
     () => false
   );
@@ -71008,10 +71275,10 @@ async function runIntegrationsCommand(argv) {
 }
 
 // src/cli/commands/legacy.ts
-var import_node_path75 = require("path");
+var import_node_path76 = require("path");
 
 // src/cli/commands/setup.ts
-var import_node_path74 = require("path");
+var import_node_path75 = require("path");
 init_zod();
 
 // src/cli/legacy.ts
@@ -71093,7 +71360,7 @@ async function grantFileCredential(argv, grantPath, ctx, deps) {
   return enrollFromGrantFile({
     paths: ctx.paths,
     storeKind: credentialStoreFlag(argv) ?? ctx.config.credentialStore,
-    grantPath: (0, import_node_path74.resolve)(grantPath),
+    grantPath: (0, import_node_path75.resolve)(grantPath),
     clock: deps.clock,
     access: ctx.access
   });
@@ -71169,7 +71436,7 @@ async function runSetup(argv, signal) {
   var _stack = [];
   try {
     const ctx = cliContext();
-    const log = __using(_stack, openFileLog((0, import_node_path74.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
+    const log = __using(_stack, openFileLog((0, import_node_path75.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
     const result = await setupMachine(argv, ctx, {
       enrollment: (apiUrl) => createEnrollmentClient({ apiUrl }),
       isProcessAlive,
@@ -71252,7 +71519,7 @@ async function runToken(argv, signal) {
       );
     }
     const ctx = cliContext();
-    const log = __using(_stack, openFileLog((0, import_node_path75.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
+    const log = __using(_stack, openFileLog((0, import_node_path76.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
     const result = await rotateMachineCredential(ctx, { clock: systemClock, log, signal });
     process.stdout.write(`${rotationMessage(result)}
 `);
@@ -71264,8 +71531,8 @@ async function runToken(argv, signal) {
 }
 
 // src/cli/commands/logout.ts
-var import_promises73 = require("fs/promises");
-var import_node_path76 = require("path");
+var import_promises74 = require("fs/promises");
+var import_node_path77 = require("path");
 init_runtime_v2();
 var RUNTIME_EXIT_WAIT_MS = 35e3;
 var TURN_END_WAIT_MS = 3e4;
@@ -71324,9 +71591,9 @@ async function stopHolder(launch, deps, outcome2) {
 }
 async function stopHeldRuns(ctx, deps, outcome2 = "aborted") {
   const stopped = [];
-  for (const name of await (0, import_promises73.readdir)(ctx.paths.sessions).catch(() => [])) {
+  for (const name of await (0, import_promises74.readdir)(ctx.paths.sessions).catch(() => [])) {
     const launch = await readJsonFile(
-      (0, import_node_path76.join)(ctx.paths.sessions, name, "launch.json"),
+      (0, import_node_path77.join)(ctx.paths.sessions, name, "launch.json"),
       holderLaunchSchema
     );
     if (launch.kind !== "ok") continue;
@@ -71363,13 +71630,13 @@ async function forgetMachineLocally(ctx) {
   const machine = await readMachineFile(ctx.paths);
   if (machine === null) return;
   await credentialStoreFor(ctx.paths, machine.credentialStore, ctx.access).clear();
-  await (0, import_promises73.rm)(ctx.paths.machine, { force: true });
+  await (0, import_promises74.rm)(ctx.paths.machine, { force: true });
 }
 async function runLogout(argv, signal) {
   var _stack = [];
   try {
     const ctx = cliContext();
-    const log = __using(_stack, openFileLog((0, import_node_path76.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
+    const log = __using(_stack, openFileLog((0, import_node_path77.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
     const result = await logoutMachine(argv, ctx, {
       api: (apiUrl, accessToken) => createApiClient({ apiUrl, accessToken }),
       stopHeldRuns,
@@ -71386,8 +71653,8 @@ async function runLogout(argv, signal) {
 }
 
 // src/cli/commands/run.ts
-var import_node_fs23 = require("fs");
-var import_node_path80 = require("path");
+var import_node_fs24 = require("fs");
+var import_node_path81 = require("path");
 
 // src/local-api/app-attachments.ts
 function createAppAttachments(clock) {
@@ -71427,7 +71694,7 @@ function createRunAppends() {
     const pending = waiters.get(runId);
     if (pending === void 0) return;
     waiters.delete(runId);
-    for (const resolve12 of pending) resolve12();
+    for (const resolve13 of pending) resolve13();
   };
   return {
     notify: wake,
@@ -71445,13 +71712,13 @@ function createRunAppends() {
     },
     nextAppend: (runId, signal) => {
       if (signal.aborted) return Promise.resolve();
-      return new Promise((resolve12) => {
+      return new Promise((resolve13) => {
         const done = () => {
           signal.removeEventListener("abort", done);
           const pending2 = waiters.get(runId);
           pending2?.delete(done);
           if (pending2?.size === 0) waiters.delete(runId);
-          resolve12();
+          resolve13();
         };
         const pending = waiters.get(runId) ?? /* @__PURE__ */ new Set();
         pending.add(done);
@@ -71463,18 +71730,18 @@ function createRunAppends() {
 }
 
 // src/local-api/server.ts
-var import_node_crypto34 = require("crypto");
-var import_promises74 = require("fs/promises");
+var import_node_crypto35 = require("crypto");
+var import_promises75 = require("fs/promises");
 var import_node_http4 = require("http");
-var import_node_path77 = require("path");
+var import_node_path78 = require("path");
 
 // src/local-api/guard.ts
-var import_node_crypto33 = require("crypto");
+var import_node_crypto34 = require("crypto");
 var ALLOWED = { kind: "allowed" };
 function tokenMatches2(expected, header) {
   if (header === void 0 || !header.startsWith("Bearer ")) return false;
   const presented = Buffer.from(header.slice("Bearer ".length));
-  return presented.length === expected.length && (0, import_node_crypto33.timingSafeEqual)(presented, expected);
+  return presented.length === expected.length && (0, import_node_crypto34.timingSafeEqual)(presented, expected);
 }
 function isBrowserReachable(req, allowedHosts) {
   if (req.headers.origin !== void 0 || req.headers.referer !== void 0) return true;
@@ -71543,11 +71810,11 @@ id: ${event.id}
 ${data}
 `);
   if (accepted || res.destroyed) return;
-  await new Promise((resolve12) => {
+  await new Promise((resolve13) => {
     const done = () => {
       res.off("drain", done);
       res.off("close", done);
-      resolve12();
+      resolve13();
     };
     res.once("drain", done);
     res.once("close", done);
@@ -71775,9 +72042,9 @@ async function readChangedTurn(deps, conversationId, runId, slot) {
 }
 async function nextChangedRuns(bell, signal) {
   if (bell.pending.size === 0) {
-    await new Promise((resolve12) => {
-      bell.wake = resolve12;
-      if (signal.aborted || bell.pending.size > 0) resolve12();
+    await new Promise((resolve13) => {
+      bell.wake = resolve13;
+      if (signal.aborted || bell.pending.size > 0) resolve13();
     });
     bell.wake = void 0;
   }
@@ -71941,7 +72208,7 @@ var machineFeatureRoutes = [
 ];
 
 // src/local-api/run-log-routes.ts
-var import_node_fs22 = require("fs");
+var import_node_fs23 = require("fs");
 init_runtime_v2();
 var RUN_ENDED = "_alan/run.ended";
 var decoder2 = new TextDecoder();
@@ -71958,7 +72225,7 @@ async function openWhenWritten(deps, runId, res, signal) {
   const path4 = runDirectory(deps.runsDir, runId).log;
   while (!signal.aborted) {
     const appended = deps.appends.nextAppend(runId, signal);
-    if ((0, import_node_fs22.existsSync)(path4) || !await deps.isHeld(runId, signal)) return openReader(res, path4);
+    if ((0, import_node_fs23.existsSync)(path4) || !await deps.isHeld(runId, signal)) return openReader(res, path4);
     await appended;
   }
   return null;
@@ -72094,9 +72361,9 @@ var streamStatus = async ({ feed, appAttachments }, { res, signal }) => {
       latest = event;
       writing = writing.then(flush);
     }));
-    await new Promise((resolve12) => {
-      if (signal.aborted) resolve12();
-      signal.addEventListener("abort", () => resolve12(), { once: true });
+    await new Promise((resolve13) => {
+      if (signal.aborted) resolve13();
+      signal.addEventListener("abort", () => resolve13(), { once: true });
     });
     await writing;
   } catch (_) {
@@ -72419,11 +72686,11 @@ function localRequestSignal(path4, closed) {
   ]);
 }
 async function listenOnLoopback(server) {
-  await new Promise((resolve12, reject) => {
+  await new Promise((resolve13, reject) => {
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       server.off("error", reject);
-      resolve12();
+      resolve13();
     });
   }).catch((error61) => {
     throw new RuntimeFault("io_failed", "The local API could not listen on loopback", {
@@ -72438,7 +72705,7 @@ async function listenOnLoopback(server) {
 }
 async function closeServer(server) {
   server.closeAllConnections();
-  await new Promise((resolve12) => server.close(() => resolve12()));
+  await new Promise((resolve13) => server.close(() => resolve13()));
 }
 async function serveLocalApi(deps) {
   const limits = { ...DEFAULT_LIMITS, ...deps.limits };
@@ -72462,7 +72729,7 @@ async function serveLocalApi(deps) {
   server.keepAliveTimeout = KEEP_ALIVE_TIMEOUT_MS;
   server.maxConnections = HARD_MAX_CONNECTIONS;
   const port = await listenOnLoopback(server);
-  const token = (0, import_node_crypto34.randomBytes)(32).toString("base64url");
+  const token = (0, import_node_crypto35.randomBytes)(32).toString("base64url");
   const guard = createRequestGuard({ token, port, rateLimit: limits.rateLimit, clock });
   const appAttachments = createAppAttachments(clock);
   const routeDeps = {
@@ -72509,7 +72776,7 @@ async function serveLocalApi(deps) {
     startedAtMs,
     runtimeVersion: deps.runtimeVersion
   };
-  const discoveryPath = (0, import_node_path77.join)(deps.stateDir, LOCAL_API_DISCOVERY_FILE);
+  const discoveryPath = (0, import_node_path78.join)(deps.stateDir, LOCAL_API_DISCOVERY_FILE);
   await writeJsonFileAtomic(discoveryPath, discovery);
   const followers = startMaintenance({
     everyMs: limits.refreshEveryMs,
@@ -72543,7 +72810,7 @@ async function serveLocalApi(deps) {
       await watchedStatus[Symbol.asyncDispose]();
       const current = await readJsonFile(discoveryPath, localApiDiscoverySchema);
       if (current.kind === "ok" && current.value.token === token) {
-        await (0, import_promises74.rm)(discoveryPath, { force: true });
+        await (0, import_promises75.rm)(discoveryPath, { force: true });
       }
       await closeServer(server);
       log.info("local_api.closed", {});
@@ -72628,7 +72895,7 @@ function machineFeatureActions(deps) {
 }
 
 // src/cli/commands/machine-plane.ts
-var import_node_path79 = require("path");
+var import_node_path80 = require("path");
 
 // src/link/index.ts
 init_runtime_v2();
@@ -75195,9 +75462,9 @@ var Socket2 = class extends Emitter {
    * @return a Promise that will be fulfilled when the server acknowledges the event
    */
   emitWithAck(ev, ...args) {
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       const fn = (arg1, arg2) => {
-        return arg1 ? reject(arg1) : resolve12(arg2);
+        return arg1 ? reject(arg1) : resolve13(arg2);
       };
       fn.withError = true;
       args.push(fn);
@@ -76296,7 +76563,7 @@ function refusalFailure(refusal2) {
 }
 
 // src/link/probe.ts
-var import_promises75 = require("dns/promises");
+var import_promises76 = require("dns/promises");
 var import_node_net5 = require("net");
 var import_node_tls2 = require("tls");
 var PROBE_TIMEOUT_MS4 = 5e3;
@@ -76316,9 +76583,9 @@ async function connectOnce(url3, clock) {
   const timer = new AbortController();
   try {
     return await Promise.race([
-      new Promise((resolve12) => {
-        socket.once(ready, () => resolve12(null));
-        socket.once("error", (error61) => resolve12(classifyTransportFailure(error61)));
+      new Promise((resolve13) => {
+        socket.once(ready, () => resolve13(null));
+        socket.once("error", (error61) => resolve13(classifyTransportFailure(error61)));
       }),
       clock.sleep(PROBE_TIMEOUT_MS4, timer.signal).then(
         () => "connection_timeout",
@@ -76332,7 +76599,7 @@ async function connectOnce(url3, clock) {
 }
 async function probeEndpoint(url3, clock) {
   try {
-    await (0, import_promises75.lookup)(url3.hostname);
+    await (0, import_promises76.lookup)(url3.hostname);
   } catch (error61) {
     const reason = classifyTransportFailure(error61);
     return reason === "other" ? "dns" : reason;
@@ -76642,9 +76909,9 @@ function planReconcile(desired, held) {
 }
 
 // src/reconciler/desired-sync.ts
-var import_node_crypto35 = require("crypto");
+var import_node_crypto36 = require("crypto");
 function fingerprintOf(desired) {
-  return (0, import_node_crypto35.createHash)("sha256").update(JSON.stringify(desired)).digest("hex");
+  return (0, import_node_crypto36.createHash)("sha256").update(JSON.stringify(desired)).digest("hex");
 }
 var FAILED_READ_RETRY_MS = 3e4;
 function createDesiredSync(deps) {
@@ -76781,7 +77048,7 @@ function createReconciler(host, lifecycle, log, signal) {
 }
 
 // src/uploader/index.ts
-var import_promises76 = require("fs/promises");
+var import_promises77 = require("fs/promises");
 init_runtime_v2();
 init_zod();
 var RETRY_DELAYS_MS = [250, 500, 1e3, 2e3, 5e3, 1e4, 3e4];
@@ -76929,7 +77196,7 @@ function startUploader({ api, runsDir, clock, log, archive }) {
   };
   const unsealedRunIds = async () => {
     const runIds = [];
-    for (const name of await (0, import_promises76.readdir)(runsDir).catch(() => [])) {
+    for (const name of await (0, import_promises77.readdir)(runsDir).catch(() => [])) {
       const runId = runIdSchema.safeParse(name);
       if (runId.success && !sealed.has(runId.data) && !archive?.has(runId.data))
         runIds.push(runId.data);
@@ -76944,13 +77211,13 @@ function startUploader({ api, runsDir, clock, log, archive }) {
     const dir = runDirectory(runsDir, runId);
     const progress = await readJsonFile(dir.upload, uploadProgressSchema);
     if (progress.kind !== "ok" || !progress.value.sealed) return false;
-    const sealedAt = (await (0, import_promises76.stat)(dir.upload)).mtimeMs;
+    const sealedAt = (await (0, import_promises77.stat)(dir.upload)).mtimeMs;
     if (clock.now() - sealedAt < options.sealedForMs) return false;
     return (await readLastRecord(dir.log))?.update.sessionUpdate === "_alan/run.ended";
   };
   const archivable = async (options) => {
     const found = [];
-    for (const name of await (0, import_promises76.readdir)(runsDir).catch(() => [])) {
+    for (const name of await (0, import_promises77.readdir)(runsDir).catch(() => [])) {
       const runId = runIdSchema.safeParse(name);
       if (!runId.success || archive?.has(runId.data)) continue;
       try {
@@ -77151,12 +77418,12 @@ async function startMachineNativeIngest(deps) {
 }
 
 // src/cli/commands/run-updates.ts
-var import_node_path78 = require("path");
+var import_node_path79 = require("path");
 init_runtime_v2();
 var UPDATE_CHECK_EVERY_MS = 6 * 60 * 60 * 1e3;
 var DEFERRED_RETRY_MS = 5 * 60 * 1e3;
 function isInstalledBundle(layout, bundlePath) {
-  return (0, import_node_path78.resolve)((0, import_node_path78.dirname)((0, import_node_path78.dirname)(bundlePath))) === (0, import_node_path78.resolve)(layout.versions);
+  return (0, import_node_path79.resolve)((0, import_node_path79.dirname)((0, import_node_path79.dirname)(bundlePath))) === (0, import_node_path79.resolve)(layout.versions);
 }
 async function settleUpgradeOnStart({
   layout,
@@ -77263,7 +77530,7 @@ function startRuntimeUpdates(options) {
       layout,
       release: npmRelease,
       tarball: await options.downloader.download(npmRelease.dist.tarball, signal),
-      tmpDir: (0, import_node_path78.join)(layout.root, ".downloads")
+      tmpDir: (0, import_node_path79.join)(layout.root, ".downloads")
     });
     await lifecycle.exclusive("upgrade", async () => {
       await recordPendingUpgrade(layout, currentVersion2, version2, clock.now());
@@ -77494,7 +77761,7 @@ async function startMachinePlane(deps) {
                 [ALAN_MANAGED_SESSION_ENV]: "1"
               },
               cwd: paths.stateDir,
-              outputPath: (0, import_node_path79.join)(paths.logs, "holders.log")
+              outputPath: (0, import_node_path80.join)(paths.logs, "holders.log")
             },
             deps.holderIsolation
           );
@@ -77530,6 +77797,8 @@ async function startMachinePlane(deps) {
           transport
         }),
         local: { home: config2.home, machineId: identity.machineId },
+        // Only a cloud sandbox's runtime has a git gateway; a person's own ~/.codex is theirs.
+        ...config2.gitGatewayUrl === null ? {} : { codexSkillsDir: (0, import_node_path80.join)(config2.codexHome, "skills") },
         log
       })
     );
@@ -77727,7 +77996,7 @@ async function startMachinePlane(deps) {
             git: createGitRunner({ env: cliEnvironment }),
             clock,
             log,
-            dir: (0, import_node_path79.join)(paths.stateDir, "checkout-freshness")
+            dir: (0, import_node_path80.join)(paths.stateDir, "checkout-freshness")
           },
           stopped.signal
         );
@@ -77989,11 +78258,11 @@ function createMachineSlot(deps) {
 
 // src/cli/commands/run-exit.ts
 function firstAborted(signals) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     for (const reason of ["stop", "restart"]) {
       const signal = signals[reason];
-      if (signal.aborted) resolve12(reason);
-      signal.addEventListener("abort", () => resolve12(reason), { once: true });
+      if (signal.aborted) resolve13(reason);
+      signal.addEventListener("abort", () => resolve13(reason), { once: true });
     }
   });
 }
@@ -78021,15 +78290,15 @@ function lockWaitMs(argv) {
 }
 async function openManagedProviders(config2, paths) {
   const providerEnv = readCliEnvironment();
-  const bundledNpm = (0, import_node_path80.join)((0, import_node_path80.dirname)(process.execPath), "npm", "bin", "npm-cli.js");
-  const providerToolchain = config2.providerToolchain ?? (process.platform === "win32" && (0, import_node_fs23.existsSync)(bundledNpm) ? { node: process.execPath, npmCli: bundledNpm } : null);
+  const bundledNpm = (0, import_node_path81.join)((0, import_node_path81.dirname)(process.execPath), "npm", "bin", "npm-cli.js");
+  const providerToolchain = config2.providerToolchain ?? (process.platform === "win32" && (0, import_node_fs24.existsSync)(bundledNpm) ? { node: process.execPath, npmCli: bundledNpm } : null);
   const npmPath = providerToolchain?.node ?? await resolveCommandOnPath("npm", providerEnv, process.platform);
   const npmOptions = npmPath === null || process.platform === "win32" && providerToolchain === null ? null : {
     command: npmPath,
     ...providerToolchain === null ? {} : { argsBeforeNpm: [providerToolchain.npmCli] },
     env: providerEnv
   };
-  const providerNodeDir = providerToolchain?.node === void 0 ? void 0 : (0, import_node_path80.dirname)(providerToolchain.node);
+  const providerNodeDir = providerToolchain?.node === void 0 ? void 0 : (0, import_node_path81.dirname)(providerToolchain.node);
   const probeEnv = providerNodeDir === void 0 ? providerEnv : {
     ...providerEnv,
     PATH: `${providerNodeDir}${pathDelimiter(process.platform)}${envValue(providerEnv, "PATH")}`
@@ -78039,7 +78308,7 @@ async function openManagedProviders(config2, paths) {
     throw new Error("Provider installer is unavailable on this computer");
   };
   const managed = createManagedProviderClis({
-    root: (0, import_node_path80.join)(paths.stateDir, "provider-clis"),
+    root: (0, import_node_path81.join)(paths.stateDir, "provider-clis"),
     resolveVersion: npmOptions === null ? unavailable : createNpmVersionResolver(npmOptions),
     installPackage: npmOptions === null ? unavailable : createNpmPackageInstaller(npmOptions),
     probe: (executable, backendKind) => probeManagedProvider(executable, backendKind, canonicalProbeEnv)
@@ -78071,7 +78340,7 @@ async function runService(argv, stop, restart = new AbortController().signal) {
       waitMs: lockWaitMs(argv),
       signal: stop
     }));
-    const log = __using(_stack, openFileLog((0, import_node_path80.join)(paths.logs, "runtime.jsonl"), config2.logLevel, clock));
+    const log = __using(_stack, openFileLog((0, import_node_path81.join)(paths.logs, "runtime.jsonl"), config2.logLevel, clock));
     const lifecycle = createLifecycleQueue({ clock, log });
     const install2 = installLayout(config2.installDir, config2.profile);
     const bundlePath = process.argv[1] ?? "";
@@ -78105,7 +78374,7 @@ async function runService(argv, stop, restart = new AbortController().signal) {
         openCliEnvironment({
           env: readCliEnvironment(),
           platform: process.platform,
-          lastKnownGoodFile: (0, import_node_path80.join)(paths.stateDir, "login-path.json"),
+          lastKnownGoodFile: (0, import_node_path81.join)(paths.stateDir, "login-path.json"),
           clock,
           decorate: (env) => withPackagedAlanCodeEngine(env, bundlePath, process.platform)
         })
@@ -78282,17 +78551,17 @@ async function runServiceCommand(argv, ctx = cliContext()) {
 }
 
 // src/cli/commands/upgrade.ts
-var import_promises77 = require("fs/promises");
-var import_node_path81 = require("path");
+var import_promises78 = require("fs/promises");
+var import_node_path82 = require("path");
 function isNotNewer(version2, installed) {
   return installed !== null && isReleaseVersion(version2) && isReleaseVersion(installed) && compareVersions(version2, installed) <= 0;
 }
 async function installFromSource(source) {
   const { layout, from, ifNewer } = source;
-  const isTarball = (await (0, import_promises77.stat)(from)).isFile();
-  const downloads = (0, import_node_path81.join)(layout.root, ".downloads");
-  if (isTarball) await (0, import_promises77.mkdir)(downloads, { recursive: true, mode: 448 });
-  const scratch = isTarball ? await (0, import_promises77.mkdtemp)((0, import_node_path81.join)(downloads, "upgrade-")) : null;
+  const isTarball = (await (0, import_promises78.stat)(from)).isFile();
+  const downloads = (0, import_node_path82.join)(layout.root, ".downloads");
+  if (isTarball) await (0, import_promises78.mkdir)(downloads, { recursive: true, mode: 448 });
+  const scratch = isTarball ? await (0, import_promises78.mkdtemp)((0, import_node_path82.join)(downloads, "upgrade-")) : null;
   try {
     const sourceDir = scratch === null ? from : await extractPackageTarball(from, scratch);
     const version2 = await readPackageVersion(sourceDir);
@@ -78300,7 +78569,7 @@ async function installFromSource(source) {
     if (ifNewer && isNotNewer(version2, installed)) return { kind: "skipped", version: version2, installed };
     return { kind: "installed", ...await installVersion(layout, sourceDir) };
   } finally {
-    if (scratch !== null) await (0, import_promises77.rm)(scratch, { recursive: true, force: true });
+    if (scratch !== null) await (0, import_promises78.rm)(scratch, { recursive: true, force: true });
   }
 }
 async function runUpgrade(argv) {
@@ -78312,7 +78581,7 @@ async function runUpgrade(argv) {
   const layout = installLayout(config2.installDir, config2.profile);
   const outcome2 = await installFromSource({
     layout,
-    from: (0, import_node_path81.resolve)(from),
+    from: (0, import_node_path82.resolve)(from),
     ifNewer: hasFlag(argv, "--if-newer")
   });
   if (outcome2.kind === "skipped") {