@alan-ai-hq/agent-manager-darwin-arm64 0.1.145 → 0.1.147

package/alan-agent.cjs

@@ -12529,7 +12529,7 @@ function compileValidator(schema, parser) {
 function compile(schema, options) {
   try {
     const parser = compileFn(schema);
-    const clone2 = clone(schema);
+    const clone3 = clone(schema);
     const liveRun = schema._zod.run;
     const originalRun = liveRun.__originalRun ?? liveRun;
     const wrapped = (payload, ctx) => {
@@ -12549,12 +12549,12 @@ function compile(schema, options) {
       return originalRun(payload, ctx);
     };
     wrapped.__originalRun = originalRun;
-    clone2._zod.bag.fallbackRun = originalRun;
-    clone2._zod.bag.validator = compileValidator(schema, parser);
-    clone2._zod.run = wrapped;
+    clone3._zod.bag.fallbackRun = originalRun;
+    clone3._zod.bag.validator = compileValidator(schema, parser);
+    clone3._zod.run = wrapped;
     if (!liveRun.__originalRun)
-      installCompiledUserMethods(clone2, schema, parser);
-    return clone2;
+      installCompiledUserMethods(clone3, schema, parser);
+    return clone3;
   } catch (err) {
     if (options?.strict)
       throw err;
@@ -20312,7 +20312,7 @@ var init_workspace = __esm({
 });
 
 // ../shared/dist/runtime-v2/desired-state.js
-var repoLocalPathSchema, runSpecSchema, desiredRunSchema, desiredStateSchema;
+var repoLocalPathSchema, requestedCheckoutSchema, runSpecSchema, desiredRunSchema, desiredStateSchema;
 var init_desired_state = __esm({
   "../shared/dist/runtime-v2/desired-state.js"() {
     "use strict";
@@ -20327,6 +20327,11 @@ var init_desired_state = __esm({
       localPath: external_exports.string().min(1),
       branch: external_exports.string().min(1).optional()
     });
+    requestedCheckoutSchema = external_exports.object({
+      path: machinePathSchema,
+      repoUrl: gitRemoteUrlSchema,
+      branch: gitBranchSchema
+    });
     runSpecSchema = external_exports.object({
       runId: runIdSchema,
       conversationId: conversationIdSchema,
@@ -20345,6 +20350,8 @@ var init_desired_state = __esm({
       workspacePathPinned: external_exports.boolean().optional(),
       approvedWorkspacePaths: external_exports.array(external_exports.string().min(1)).optional(),
       repoLocalPaths: external_exports.array(repoLocalPathSchema).optional(),
+      /** Applied once, at the conversation's first turn on a cloud sandbox; never moves local work. */
+      requestedCheckouts: external_exports.array(requestedCheckoutSchema).max(64).optional(),
       workflowId: external_exports.guid().optional(),
       workflowExecutionId: external_exports.guid().optional(),
       agentId: external_exports.string().min(1).optional(),
@@ -20510,7 +20517,9 @@ var init_machine_identity = __esm({
     runCodexCredentialSchema = external_exports.object({
       accessToken: external_exports.string().min(1),
       chatgptAccountId: external_exports.string().min(1),
-      chatgptPlanType: external_exports.string().nullable()
+      chatgptPlanType: external_exports.string().nullable(),
+      credentialId: external_exports.uuid().optional(),
+      providerUserId: external_exports.string().min(1).optional()
     });
     runCodexCredentialRefreshRequestSchema = external_exports.object({
       /** sha256 hex of the access token Codex was refused with; a newer stored token is returned instead of rotating. */
@@ -20519,7 +20528,7 @@ var init_machine_identity = __esm({
     runProviderCredentialSchema = external_exports.object({
       /** Environment variables for the agent CLI, e.g. ANTHROPIC_API_KEY; empty when the CLI's own login is used. */
       env: external_exports.record(external_exports.string(), external_exports.string()),
-      /** The team's Codex login for a cloud sandbox; absent where the CLI's own login is used. */
+      /** The bound Codex login for a cloud sandbox; absent where the CLI's own login is used. */
       codex: runCodexCredentialSchema.optional()
     });
   }
@@ -20970,6 +20979,73 @@ var init_problem = __esm({
   }
 });
 
+// ../shared/dist/cli-usage.js
+var usagePercentSchema, usageTimestampSchema, usageAmountSchema, usageObservationShape, cliUsageWindowPatchSchema, cliUsageWindowSchema, cliUsageSpendPatchSchema, cliUsageSpendSchema, cliUsageCreditsPatchSchema, cliUsageCreditsSchema, cliUsageBucketSchema, cliUsageSnapshotSchema;
+var init_cli_usage = __esm({
+  "../shared/dist/cli-usage.js"() {
+    "use strict";
+    init_zod();
+    usagePercentSchema = external_exports.number().min(0).max(100);
+    usageTimestampSchema = external_exports.iso.datetime();
+    usageAmountSchema = external_exports.string().min(1);
+    usageObservationShape = {
+      observedAt: usageTimestampSchema,
+      receivedAt: usageTimestampSchema,
+      sourceId: external_exports.string().min(1),
+      sequence: external_exports.number().int().nonnegative()
+    };
+    cliUsageWindowPatchSchema = external_exports.object({
+      usedPercent: usagePercentSchema.nullable().optional(),
+      windowMinutes: external_exports.number().positive().nullable().optional(),
+      resetsAt: usageTimestampSchema.nullable().optional()
+    });
+    cliUsageWindowSchema = external_exports.object({
+      usedPercent: usagePercentSchema.optional(),
+      windowMinutes: external_exports.number().positive().optional(),
+      resetsAt: usageTimestampSchema.optional(),
+      ...usageObservationShape
+    });
+    cliUsageSpendPatchSchema = external_exports.object({
+      reached: external_exports.boolean(),
+      limit: usageAmountSchema.nullable().optional(),
+      used: usageAmountSchema.nullable().optional(),
+      remaining: usageAmountSchema.nullable().optional(),
+      usedPercent: usagePercentSchema.nullable().optional(),
+      resetsAt: usageTimestampSchema.nullable().optional()
+    });
+    cliUsageSpendSchema = external_exports.object({
+      reached: external_exports.boolean(),
+      limit: usageAmountSchema.optional(),
+      used: usageAmountSchema.optional(),
+      remaining: usageAmountSchema.optional(),
+      usedPercent: usagePercentSchema.optional(),
+      resetsAt: usageTimestampSchema.optional(),
+      ...usageObservationShape
+    });
+    cliUsageCreditsPatchSchema = external_exports.object({
+      hasCredits: external_exports.boolean(),
+      unlimited: external_exports.boolean(),
+      balance: usageAmountSchema.nullable().optional()
+    });
+    cliUsageCreditsSchema = external_exports.object({
+      hasCredits: external_exports.boolean(),
+      unlimited: external_exports.boolean(),
+      balance: usageAmountSchema.optional(),
+      ...usageObservationShape
+    });
+    cliUsageBucketSchema = external_exports.object({
+      primary: cliUsageWindowSchema.optional(),
+      secondary: cliUsageWindowSchema.optional(),
+      spend: cliUsageSpendSchema.optional(),
+      credits: cliUsageCreditsSchema.optional(),
+      planType: external_exports.string().min(1).nullable().optional()
+    });
+    cliUsageSnapshotSchema = external_exports.object({
+      buckets: external_exports.record(external_exports.string().min(1), cliUsageBucketSchema)
+    });
+  }
+});
+
 // ../shared/dist/runtime-v2/run-log.js
 function isRunLifecycleKind(sessionUpdate) {
   return RUN_LIFECYCLE_KINDS.has(sessionUpdate);
@@ -20977,12 +21053,13 @@ function isRunLifecycleKind(sessionUpdate) {
 function alignedLength(bytes) {
   return bytes.lastIndexOf(RUN_LOG_RECORD_SEPARATOR) + 1;
 }
-var RUN_LOG_PROTOCOL, RUN_LOG_PROTOCOL_HEADER, RUN_LOG_RECORD_SEPARATOR, runAcceptedUpdateSchema, runStartedUpdateSchema, runWorkspaceRelocatedUpdateSchema, runOutcomeSchema, runRejectionCodeSchema, runEndedUpdateSchema, runLifecycleUpdateSchema, RUN_LIFECYCLE_KINDS, runLogRecordSchema;
+var RUN_LOG_PROTOCOL, RUN_LOG_PROTOCOL_HEADER, RUN_LOG_RECORD_SEPARATOR, runAcceptedUpdateSchema, runStartedUpdateSchema, runCodexRateLimitsUpdateSchema, runWorkspaceRelocatedUpdateSchema, runOutcomeSchema, runRejectionCodeSchema, runEndedUpdateSchema, runLifecycleUpdateSchema, RUN_LIFECYCLE_KINDS, runLogRecordSchema;
 var init_run_log = __esm({
   "../shared/dist/runtime-v2/run-log.js"() {
     "use strict";
     init_zod();
     init_problem();
+    init_cli_usage();
     init_ids();
     RUN_LOG_PROTOCOL = 2;
     RUN_LOG_PROTOCOL_HEADER = "x-alan-log-protocol";
@@ -20997,6 +21074,18 @@ var init_run_log = __esm({
       providerSessionId: external_exports.string().min(1).optional(),
       pid: external_exports.number().int().positive().optional()
     });
+    runCodexRateLimitsUpdateSchema = external_exports.object({
+      sessionUpdate: external_exports.literal("_alan/codex.rate_limits"),
+      limitId: external_exports.string().min(1),
+      primary: cliUsageWindowPatchSchema.nullable().optional(),
+      secondary: cliUsageWindowPatchSchema.nullable().optional(),
+      spend: cliUsageSpendPatchSchema.nullable().optional(),
+      credits: cliUsageCreditsPatchSchema.nullable().optional(),
+      planType: external_exports.string().min(1).nullable().optional(),
+      observedAt: external_exports.iso.datetime(),
+      sourceId: external_exports.string().min(1),
+      sequence: external_exports.number().int().nonnegative()
+    });
     runWorkspaceRelocatedUpdateSchema = external_exports.object({
       sessionUpdate: external_exports.literal("_alan/run.workspace_relocated"),
       previousPath: external_exports.string().min(1).max(4096),
@@ -21059,7 +21148,7 @@ var init_holder_protocol = __esm({
     init_ids();
     init_link();
     init_run_log();
-    HOLDER_PROTOCOL = 1;
+    HOLDER_PROTOCOL = 2;
     holderAbortOutcomeSchema = external_exports.enum(["aborted", "interrupted"]);
     holderRequestSchema = external_exports.discriminatedUnion("type", [
       external_exports.object({ type: external_exports.literal("auth"), token: external_exports.string().min(1) }),
@@ -22537,7 +22626,7 @@ function plan(command, args, options) {
 function captureOutput(command, args, options) {
   const launch = plan(command, args, options);
   if (launch === void 0) return Promise.resolve(NEVER_STARTED);
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     (0, import_child_process.execFile)(
       launch.file,
       [...launch.args],
@@ -22551,7 +22640,7 @@ function captureOutput(command, args, options) {
       },
       (error61, stdout, stderr) => {
         const code = error61 && typeof error61.code === "number" ? error61.code : error61 ? void 0 : 0;
-        resolve13({ stdout, stderr, exitCode: code });
+        resolve14({ stdout, stderr, exitCode: code });
       }
     );
   });
@@ -22601,10 +22690,10 @@ async function linuxStartTicks(pid) {
   }
 }
 function psStartTime(pid) {
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     (0, import_child_process2.execFile)("ps", ["-o", "lstart=", "-p", String(pid)], { timeout: 2e3 }, (error61, stdout) => {
       const text3 = stdout.trim();
-      resolve13(error61 || !text3 ? void 0 : text3);
+      resolve14(error61 || !text3 ? void 0 : text3);
     });
   });
 }
@@ -22633,12 +22722,12 @@ function parseProcessList(text3) {
 }
 function listProcesses(platform3 = process.platform) {
   if (platform3 === "win32") return Promise.resolve([]);
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     (0, import_child_process3.execFile)(
       "ps",
       ["-A", "-o", "pid=,ppid=,pgid=,lstart="],
       { timeout: 5e3, maxBuffer: 8 * 1024 * 1024 },
-      (error61, stdout) => resolve13(error61 ? [] : parseProcessList(stdout))
+      (error61, stdout) => resolve14(error61 ? [] : parseProcessList(stdout))
     );
   });
 }
@@ -22678,11 +22767,11 @@ async function taskkill(pid, options) {
     stdio: "ignore",
     windowsHide: true
   });
-  const exited = new Promise((resolve13) => {
-    killer.once("error", (error210) => resolve13(error210));
+  const exited = new Promise((resolve14) => {
+    killer.once("error", (error210) => resolve14(error210));
     killer.once(
       "exit",
-      (code, signal) => resolve13(code === 0 ? void 0 : new Error(`taskkill failed: exit ${code}, signal ${signal}`))
+      (code, signal) => resolve14(code === 0 ? void 0 : new Error(`taskkill failed: exit ${code}, signal ${signal}`))
     );
   });
   const timedOut = clock.sleep(options.timeoutMs ?? DEFAULT_TASKKILL_TIMEOUT_MS, timeout.signal).then(() => new Error("taskkill timed out")).catch(() => void 0);
@@ -22938,10 +23027,10 @@ function spawnCli(options) {
 function waitForSpawn(child, command) {
   if (isWindowsJob(child)) return waitForWindowsJob(child, command);
   if (child.pid !== void 0) return Promise.resolve();
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const onSpawn = () => {
       child.off("error", onError);
-      resolve13();
+      resolve14();
     };
     const onError = (error61) => {
       child.off("spawn", onSpawn);
@@ -25885,7 +25974,18 @@ var init_chunk_SBT5W7L4 = __esm({
   }
 });
 
-// ../agent-core/dist/chunk-54ZRJOQP.js
+// ../agent-core/dist/chunk-HBIPWAUI.js
+function readCapReset(text3) {
+  const epoch = EPOCH_RESET.exec(text3);
+  if (epoch) return { resetsAt: new Date(Number(epoch[1]) * 1e3).toISOString() };
+  const codex = CODEX_RESET.exec(text3);
+  if (codex) {
+    const milliseconds = Date.parse(codex[1].replace(/(\d)(?:st|nd|rd|th)\b/gi, "$1"));
+    if (Number.isFinite(milliseconds)) return { resetsAt: new Date(milliseconds).toISOString() };
+  }
+  const worded = WORDED_RESET.exec(text3);
+  return worded ? { resetHint: worded[1].trim() } : {};
+}
 function specForErrorKind(errorKind) {
   const spec = ERROR_SPECS[errorKind];
   return { message: spec.message, errorKind, recoveryClass: spec.recoveryClass };
@@ -25946,15 +26046,6 @@ function normalizeCodexCliErrorMessage(message2) {
   }
   return message2;
 }
-function readCapReset(text3) {
-  const epoch = EPOCH_RESET.exec(text3);
-  if (epoch) {
-    const seconds = Number(epoch[1]);
-    return { resetsAt: new Date(seconds * 1e3).toISOString() };
-  }
-  const worded = WORDED_RESET.exec(text3);
-  return worded ? { resetHint: worded[1].trim() } : {};
-}
 function lineMatching(text3, pattern) {
   return text3.split("\n").map((line) => line.trim()).find((line) => pattern.test(line));
 }
@@ -25966,10 +26057,11 @@ function withCapReset(classified, text3) {
   if (classified.errorKind !== "usage_limit") return classified;
   const reset = readCapReset(text3);
   if (reset.resetsAt) {
+    const own22 = lineMatching(text3, /\btry again at\b/i);
     return {
       ...classified,
       ...reset,
-      message: `Provider usage limit reached. It resets at ${reset.resetsAt}; switch model or wait, then retry.`
+      message: own22 ?? `Provider usage limit reached. It resets at ${reset.resetsAt}; switch model or wait, then retry.`
     };
   }
   const own2 = lineMatching(text3, /usage limit/i);
@@ -26088,13 +26180,16 @@ function createCliProblem(observed, options) {
     ...classified.resetsAt ? { resetsAt: classified.resetsAt } : {}
   });
 }
-var import_crypto2, ERROR_SPECS, AGENT_ERROR_KINDS, AGENT_SIGN_IN_BY_HARNESS, STATUS_PREFIX, TEXT_RULES, CODEX_TIMEOUT_MESSAGE, CODEX_EXPIRED_MESSAGE, EPOCH_RESET, WORDED_RESET, COMMAND_NOT_FOUND, CODE_RULES, TEXT_REFINES, STATUS_LEAD, CLI_PROBLEM_CODE_BY_ERROR_KIND, KEY_REJECTION_KINDS;
-var init_chunk_54ZRJOQP = __esm({
-  "../agent-core/dist/chunk-54ZRJOQP.js"() {
+var import_crypto2, EPOCH_RESET, WORDED_RESET, CODEX_RESET, ERROR_SPECS, AGENT_ERROR_KINDS, AGENT_SIGN_IN_BY_HARNESS, STATUS_PREFIX, TEXT_RULES, CODEX_TIMEOUT_MESSAGE, CODEX_EXPIRED_MESSAGE, COMMAND_NOT_FOUND, CODE_RULES, TEXT_REFINES, STATUS_LEAD, CLI_PROBLEM_CODE_BY_ERROR_KIND, KEY_REJECTION_KINDS;
+var init_chunk_HBIPWAUI = __esm({
+  "../agent-core/dist/chunk-HBIPWAUI.js"() {
     "use strict";
     init_chunk_YXWJW7I5();
     import_crypto2 = require("crypto");
     init_agent2();
+    EPOCH_RESET = /\|\s*(\d{10})\b/;
+    WORDED_RESET = /\bresets?\s+(?:at\s+)?([^.\n]{1,60}?)\s*(?:$|[.\n])/i;
+    CODEX_RESET = /\btry again at\s+([A-Za-z]{3,9}\s+\d{1,2}(?:st|nd|rd|th)?,?\s+\d{4}\s+\d{1,2}:\d{2}\s*[AP]M(?:\s+(?:UTC|GMT)(?:[+-]\d{1,2}(?::?\d{2})?)?)?)/i;
     ERROR_SPECS = {
       model_mismatch: {
         message: "The selected model isn't available, or you don't have access to it. Pick a different model, then send your message again.",
@@ -26248,7 +26343,7 @@ var init_chunk_54ZRJOQP = __esm({
       // #44604), or a trailing assistant message (opencode #19517).
       {
         kind: "history_rejected",
-        pattern: /\btext content blocks must be non-empty\b|\bcontent field in the message object\b|\bids were found without `?tool_result`? blocks\b|\bunexpected `?tool_use_id`?|\btool use concurrency issues\b|\bno tool output found for\b|\bdoes not support assistant message prefill\b/
+        pattern: /\btext content blocks must be non-empty\b|\bcontent field in the message object\b|\bids were found without `?tool_result`? blocks\b|\bunexpected `?tool_use_id`?|\btool use concurrency issues\b|\bno tool output found for\b|\bdoes not support assistant message prefill\b|\binvalid_encrypted_content\b|organization_id did not match the target organization/
       },
       // Claude: "No conversation found with session ID"; Codex: "no rollout found for thread id";
       // Copilot: "No session, task, or name matched"; Kimi/Cursor ACP: `Session "<id>" not found`.
@@ -26297,8 +26392,6 @@ var init_chunk_54ZRJOQP = __esm({
     ];
     CODEX_TIMEOUT_MESSAGE = "Codex connection to OpenAI timed out while waiting for the turn to continue. Retry the message; if it repeats, check network/API latency or reduce slow MCP/tool calls in the turn.";
     CODEX_EXPIRED_MESSAGE = "Codex CLI connection expired. Re-authenticate the Codex CLI on this computer (run `codex login`) or reconnect it in Cloud settings, then retry.";
-    EPOCH_RESET = /\|\s*(\d{10})\b/;
-    WORDED_RESET = /\bresets?\s+(?:at\s+)?([^.\n]{1,60}?)\s*(?:$|[.\n])/i;
     COMMAND_NOT_FOUND = /\bcommand not found\b|\bno such file or directory\b/i;
     CODE_RULES = [
       { pattern: /model_not_found|model_not_available/, kind: "model_mismatch" },
@@ -26353,7 +26446,7 @@ var init_chunk_54ZRJOQP = __esm({
   }
 });
 
-// ../agent-core/dist/chunk-72NSEYHK.js
+// ../agent-core/dist/chunk-4G77APXN.js
 function detectImageMimeType(buffer) {
   if (buffer.length >= 8 && buffer.subarray(0, 8).equals(PNG_SIGNATURE)) return "image/png";
   if (buffer.length >= 3 && buffer[0] === 255 && buffer[1] === 216 && buffer[2] === 255) {
@@ -26535,8 +26628,8 @@ function createJsonRpcPeer(writer, handlers) {
     },
     request: (method, params = {}) => {
       const id = counter.next++;
-      return new Promise((resolve13, reject) => {
-        pending.set(id, { method, resolve: resolve13, reject });
+      return new Promise((resolve14, reject) => {
+        pending.set(id, { method, resolve: resolve14, reject });
         writer.write({ id, method, params }).catch((error61) => {
           pending.delete(id);
           reject(error61 instanceof Error ? error61 : new Error(String(error61)));
@@ -26649,7 +26742,7 @@ function createNdjsonWriter(stream) {
     get writable() {
       return stream.writable && !stream.destroyed && failure6.error === void 0;
     },
-    write: (value2) => new Promise((resolve13, reject) => {
+    write: (value2) => new Promise((resolve14, reject) => {
       if (failure6.error) {
         reject(failure6.error);
         return;
@@ -26661,7 +26754,7 @@ function createNdjsonWriter(stream) {
       stream.write(`${JSON.stringify(value2)}
 `, (error61) => {
         if (error61) reject(error61);
-        else resolve13();
+        else resolve14();
       });
     }),
     end: () => {
@@ -26677,11 +26770,11 @@ function hostProcess(child, tree, options, handlers) {
   const stderr = new LineSplitter((line) => handlers.onStderrLine(line));
   child.stderr.on("data", (chunk) => stderr.push(chunk));
   child.stderr.once("end", () => stderr.flush());
-  const processExit = new Promise((resolve13) => {
-    child.once("exit", (code, signal) => resolve13({ code, signal }));
+  const processExit = new Promise((resolve14) => {
+    child.once("exit", (code, signal) => resolve14({ code, signal }));
   });
-  const outputEnded = new Promise((resolve13) => {
-    child.stdout.once("close", () => resolve13());
+  const outputEnded = new Promise((resolve14) => {
+    child.stdout.once("close", () => resolve14());
   });
   const watch = async () => {
     const { clock, stdoutDrainMs, log, name } = options;
@@ -26737,11 +26830,11 @@ function silentStartError(name, timeoutMs) {
   };
 }
 var import_crypto3, import_fs4, import_path3, PNG_SIGNATURE, IMAGE_MIME_BY_EXT, VIDEO_MIME_BY_EXT, IMAGE_EXTENSIONS, VIDEO_EXTENSIONS, MAX_IMAGE_BYTES, MAX_VIDEO_BYTES, AGENT_BROWSER_MENTION, LocalMediaReader, SessionOpenRefusal, JsonRpcError, ACP_PROTOCOL_VERSION, ACP_ERROR, STDERR_TAIL_LINES, RESULT_EXIT_GRACE_MS, PerTurnSession;
-var init_chunk_72NSEYHK = __esm({
-  "../agent-core/dist/chunk-72NSEYHK.js"() {
+var init_chunk_4G77APXN = __esm({
+  "../agent-core/dist/chunk-4G77APXN.js"() {
     "use strict";
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_M6YHY2EZ();
     init_chunk_YXWJW7I5();
     import_crypto3 = require("crypto");
@@ -26971,13 +27064,13 @@ var init_chunk_72NSEYHK = __esm({
         const turnId = input2.turnId;
         let finish = () => {
         };
-        const done = new Promise((resolve13) => {
+        const done = new Promise((resolve14) => {
           finish = (outcome2) => {
             if (this.#current?.id !== turnId) return;
             this.#current = void 0;
             if (this.#state === "busy") this.#state = "idle";
             this.#emit({ type: "turn_ended", turnId, outcome: outcome2 });
-            resolve13({ turnId, outcome: outcome2, providerSessionId: this.#sessionId });
+            resolve14({ turnId, outcome: outcome2, providerSessionId: this.#sessionId });
           };
         });
         const pending = {
@@ -28842,9 +28935,9 @@ var init_claude = __esm({
   "../agent-core/dist/providers/claude.js"() {
     "use strict";
     init_chunk_SBT5W7L4();
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
     init_chunk_FPGAN4XO();
@@ -29570,8 +29663,8 @@ var init_claude = __esm({
       }
       async #awaitTaskStop(requestId, taskId) {
         const timer = new AbortController();
-        const answered = new Promise((resolve13) => {
-          this.#taskStops.set(requestId, resolve13);
+        const answered = new Promise((resolve14) => {
+          this.#taskStops.set(requestId, resolve14);
         });
         const timeoutMs = this.#options.stopTaskTimeoutMs;
         const timedOut = this.#options.clock.sleep(timeoutMs, timer.signal).then(
@@ -29644,17 +29737,17 @@ var init_claude = __esm({
         };
         let markStarted = () => {
         };
-        const whenStarted = new Promise((resolve13) => {
-          markStarted = resolve13;
+        const whenStarted = new Promise((resolve14) => {
+          markStarted = resolve14;
         });
-        const done = new Promise((resolve13) => {
+        const done = new Promise((resolve14) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
             this.#lastTurn = turn;
             if (this.#state === "busy") this.#state = "idle";
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#providerSessionId });
+            resolve14({ turnId: id, outcome: outcome2, providerSessionId: this.#providerSessionId });
           };
         });
         const active = {
@@ -29772,8 +29865,8 @@ var init_claude = __esm({
         void removeLaunchFiles(this.#launchFiles).catch((error61) => {
           this.#options.log.warn("claude.launch_files_cleanup_failed", { error: error61 });
         });
-        for (const resolve13 of this.#taskStops.values()) {
-          resolve13({ ok: false, reason: "runtime_unavailable", message: "Claude Code exited." });
+        for (const resolve14 of this.#taskStops.values()) {
+          resolve14({ ok: false, reason: "runtime_unavailable", message: "Claude Code exited." });
         }
         const active = this.#current;
         if (active) {
@@ -30169,6 +30262,67 @@ function imageKey(update) {
   const image = asRecord(update.image);
   return asString(image?.sourceHash) || asString(image?.id) || void 0;
 }
+function windowPatch(value2) {
+  if (value2 === null) return null;
+  const record2 = asRecord(value2);
+  if (!record2) return void 0;
+  const patch = {};
+  const usedPercent = asFiniteNumber(record2.usedPercent);
+  if (usedPercent !== void 0 && usedPercent >= 0 && usedPercent <= 100) {
+    patch.usedPercent = usedPercent;
+  } else if (record2.usedPercent === null) {
+    patch.usedPercent = null;
+  }
+  const duration3 = asFiniteNumber(record2.windowDurationMins);
+  if (duration3 !== void 0 && duration3 > 0) patch.windowMinutes = duration3;
+  else if (record2.windowDurationMins === null) patch.windowMinutes = null;
+  const seconds = asFiniteNumber(record2.resetsAt);
+  if (seconds !== void 0 && seconds >= 0) {
+    const reset = new Date(seconds * 1e3);
+    if (Number.isFinite(reset.getTime())) patch.resetsAt = reset.toISOString();
+  } else if (record2.resetsAt === null) {
+    patch.resetsAt = null;
+  }
+  return patch;
+}
+function amount(value2) {
+  const text3 = asString(value2).trim();
+  return text3.length > 0 ? text3 : void 0;
+}
+function spendPatch(limit, reached) {
+  const record2 = asRecord(limit);
+  const reachedFlag = reached === true;
+  if (!record2)
+    return limit === null && !reachedFlag ? null : reachedFlag ? { reached: true } : void 0;
+  const patch = { reached: reachedFlag };
+  const limitAmount = amount(record2.limit);
+  const usedAmount = amount(record2.used);
+  if (limitAmount) patch.limit = limitAmount;
+  if (usedAmount) patch.used = usedAmount;
+  const remainingPercent = asFiniteNumber(record2.remainingPercent);
+  if (remainingPercent !== void 0) {
+    patch.usedPercent = Math.min(100, Math.max(0, 100 - remainingPercent));
+  }
+  const seconds = asFiniteNumber(record2.resetsAt);
+  if (seconds !== void 0 && seconds >= 0) {
+    const reset = new Date(seconds * 1e3);
+    if (Number.isFinite(reset.getTime())) patch.resetsAt = reset.toISOString();
+  }
+  return patch;
+}
+function creditsPatch(value2) {
+  if (value2 === null) return null;
+  const record2 = asRecord(value2);
+  if (!record2 || typeof record2.hasCredits !== "boolean" || typeof record2.unlimited !== "boolean") {
+    return void 0;
+  }
+  const balance = amount(record2.balance);
+  return {
+    hasCredits: record2.hasCredits,
+    unlimited: record2.unlimited,
+    ...balance ? { balance } : {}
+  };
+}
 function isApprovalRequest(method) {
   return COMMAND_OR_FILE.has(method) || LEGACY.has(method);
 }
@@ -30580,7 +30734,10 @@ function classifyCodexError(error61) {
   const message2 = asString(error61?.message);
   const known = typeof info === "string" ? INFO_KINDS.get(info) : void 0;
   const own2 = normalizeCodexCliErrorMessage(message2.trim());
-  if (known) return own2 ? { ...specForErrorKind(known), message: own2 } : specForErrorKind(known);
+  if (known) {
+    const classified = own2 ? { ...specForErrorKind(known), message: own2 } : specForErrorKind(known);
+    return known === "usage_limit" ? { ...classified, ...readCapReset(message2) } : classified;
+  }
   const status = httpStatusOf(info);
   return classifyProviderError(message2, status === void 0 ? {} : { status });
 }
@@ -30664,7 +30821,7 @@ async function handshake(session, spec, log) {
   }
   await session.rpc.notify("initialized");
 }
-async function preflight(session, spec) {
+async function preflight(session, spec, log) {
   if (spec.externalAuth) {
     const tokens2 = await spec.externalAuth.current();
     await session.rpc.request("account/login/start", {
@@ -30682,6 +30839,13 @@ async function preflight(session, spec) {
       specForErrorKind("not_logged_in")
     );
   }
+  if (spec.externalAuth) {
+    try {
+      session.observeRateLimits(await session.rpc.request("account/rateLimits/read", {}));
+    } catch {
+      log.warn("codex.rate_limits_unavailable", {});
+    }
+  }
 }
 function threadOf(result) {
   const thread = asRecord(asRecord(result)?.thread);
@@ -30743,7 +30907,7 @@ function createCodexDriver(options = {}) {
       try {
         const opening = (async () => {
           await handshake(session, spec, resolved.log);
-          await preflight(session, spec);
+          await preflight(session, spec, resolved.log);
           return openThread(session, spec, resolved.log);
         })();
         const thread = await withDeadline(
@@ -30894,7 +31058,7 @@ function createCodexExecDriver(options = {}) {
   };
 }
 function envDigest2(env) {
-  const hash2 = (0, import_crypto9.createHash)("sha256");
+  const hash2 = (0, import_crypto10.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -31556,7 +31720,7 @@ function readCodexRolloutTurns(chunk, baseOffset, skipped) {
   return readTranscriptTurns(codexRolloutFile, chunk, baseOffset, skipped);
 }
 function envDigest22(env) {
-  const hash2 = (0, import_crypto10.createHash)("sha256");
+  const hash2 = (0, import_crypto11.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -31625,14 +31789,14 @@ function codexTurnInput(run2, context) {
     ...images.length ? { imagePaths: images.map((image) => image.path) } : {}
   };
 }
-var import_fs6, import_path6, import_crypto8, import_crypto9, import_crypto10, TokenRefresher, MCP_STARTUP_TIMEOUT_SEC, FIELD_TYPES, YES_NO, ACCEPT_DECLINE, MAX_INLINE_GENERATED_IMAGE_BYTES, PNG_SIGNATURE2, JPEG_NON_FRAME_MARKERS, IMAGE_GEN_CALL, PROMPT_LITERAL, RELOCATE_EVERY_MS, CodexImageGenerationFold, CodexRolloutImages, USER_INPUT_METHOD, PERMISSIONS_METHOD, ELICITATION_METHOD, COMMAND_OR_FILE, LEGACY, DECISIONS, COORDINATION_TOOLS, SETTLED_AGENT, STATUS, CHANGE_OPERATIONS, SILENT_ON_START, IGNORED_ITEMS, PLAN_STATUS, WORKER_LIFECYCLE, INFO_KINDS, SILENT, CodexTurn, STDERR_TAIL_LINES3, MAX_BETWEEN_UPDATES, UNSUPPORTED_REQUEST, DECLINED_ELICITATION, IMAGE_CATCH_UP_MS, IMAGE_POLL_MS, CodexSession, CODEX_MIN_VERSION, CODEX_REQUIREMENT, CODEX_TESTED_LINE, DEFAULTS2, CLIENT_INFO, STATUS2, EXITED_WITHOUT_RESPONSE, CodexExecTurn, DEFAULTS22, CodexExecSession, INJECTED_USER_PREFIXES, SHELL_TOOL_NAMES, ANNOUNCING_ITEM_TYPES, OUTPUT_MARKER, OPEN_PAGE_ACTIONS, FIND_IN_PAGE_ACTIONS, FILE_OPERATIONS, UNDERSTOOD_ITEM_TYPES, PRELUDE_TYPES2, PRELUDE_EVENTS, codexRolloutFile;
+var import_fs6, import_path6, import_crypto8, import_crypto9, import_crypto10, import_crypto11, TokenRefresher, MCP_STARTUP_TIMEOUT_SEC, FIELD_TYPES, YES_NO, ACCEPT_DECLINE, MAX_INLINE_GENERATED_IMAGE_BYTES, PNG_SIGNATURE2, JPEG_NON_FRAME_MARKERS, IMAGE_GEN_CALL, PROMPT_LITERAL, RELOCATE_EVERY_MS, CodexImageGenerationFold, CodexRolloutImages, CodexRateLimits, USER_INPUT_METHOD, PERMISSIONS_METHOD, ELICITATION_METHOD, COMMAND_OR_FILE, LEGACY, DECISIONS, COORDINATION_TOOLS, SETTLED_AGENT, STATUS, CHANGE_OPERATIONS, SILENT_ON_START, IGNORED_ITEMS, PLAN_STATUS, WORKER_LIFECYCLE, INFO_KINDS, SILENT, CodexTurn, STDERR_TAIL_LINES3, MAX_BETWEEN_UPDATES, UNSUPPORTED_REQUEST, DECLINED_ELICITATION, IMAGE_CATCH_UP_MS, IMAGE_POLL_MS, CodexSession, CODEX_MIN_VERSION, CODEX_REQUIREMENT, CODEX_TESTED_LINE, DEFAULTS2, CLIENT_INFO, STATUS2, EXITED_WITHOUT_RESPONSE, CodexExecTurn, DEFAULTS22, CodexExecSession, INJECTED_USER_PREFIXES, SHELL_TOOL_NAMES, ANNOUNCING_ITEM_TYPES, OUTPUT_MARKER, OPEN_PAGE_ACTIONS, FIND_IN_PAGE_ACTIONS, FILE_OPERATIONS, UNDERSTOOD_ITEM_TYPES, PRELUDE_TYPES2, PRELUDE_EVENTS, codexRolloutFile;
 var init_codex = __esm({
   "../agent-core/dist/providers/codex.js"() {
     "use strict";
     init_chunk_SBT5W7L4();
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
     init_chunk_FPGAN4XO();
@@ -31641,10 +31805,12 @@ var init_codex = __esm({
     import_path6 = require("path");
     init_effort();
     import_crypto8 = require("crypto");
-    init_agent2();
     import_crypto9 = require("crypto");
+    init_runtime_v2();
     init_agent2();
     import_crypto10 = require("crypto");
+    init_agent2();
+    import_crypto11 = require("crypto");
     init_effort();
     TokenRefresher = class {
       #auth;
@@ -31828,6 +31994,50 @@ var init_codex = __esm({
         return this.#cursor;
       }
     };
+    CodexRateLimits = class {
+      #clock;
+      #sourceId;
+      #sequence = 0;
+      constructor(clock, sourceId = (0, import_crypto9.randomUUID)()) {
+        this.#clock = clock;
+        this.#sourceId = sourceId;
+      }
+      read(value2) {
+        const response = asRecord(value2);
+        const buckets = asRecord(response?.rateLimitsByLimitId);
+        if (buckets) {
+          return Object.entries(buckets).flatMap(
+            ([limitId, snapshot2]) => this.#update(snapshot2, limitId)
+          );
+        }
+        return this.#update(response?.rateLimits);
+      }
+      notification(params) {
+        return this.#update(params.rateLimits);
+      }
+      #update(value2, bucketId) {
+        const snapshot2 = asRecord(value2);
+        if (!snapshot2) return [];
+        const primary = windowPatch(snapshot2.primary);
+        const secondary = windowPatch(snapshot2.secondary);
+        const spend = spendPatch(snapshot2.individualLimit, snapshot2.spendControlReached);
+        const credits = creditsPatch(snapshot2.credits);
+        const planType = snapshot2.planType === null ? null : asString(snapshot2.planType) || void 0;
+        const parsed = runCodexRateLimitsUpdateSchema.safeParse({
+          sessionUpdate: "_alan/codex.rate_limits",
+          limitId: bucketId ?? (asString(snapshot2.limitId) || "codex"),
+          ...primary === void 0 ? {} : { primary },
+          ...secondary === void 0 ? {} : { secondary },
+          ...spend === void 0 ? {} : { spend },
+          ...credits === void 0 ? {} : { credits },
+          ...planType === void 0 ? {} : { planType },
+          observedAt: new Date(this.#clock.now()).toISOString(),
+          sourceId: this.#sourceId,
+          sequence: this.#sequence++
+        });
+        return parsed.success ? [parsed.data] : [];
+      }
+    };
     USER_INPUT_METHOD = "item/tool/requestUserInput";
     PERMISSIONS_METHOD = "item/permissions/requestApproval";
     ELICITATION_METHOD = "mcpServer/elicitation/request";
@@ -31897,7 +32107,6 @@ var init_codex = __esm({
       "thread/closed",
       "hook/started",
       "hook/completed",
-      "account/rateLimits/updated",
       "account/updated",
       "account/login/completed",
       "remoteControl/status/changed",
@@ -32092,6 +32301,7 @@ var init_codex = __esm({
       #listeners = createListeners();
       #options;
       #memory;
+      #rateLimits;
       #stderr = [];
       #approvals = /* @__PURE__ */ new Map();
       /** Session-level updates (thread start warnings, MCP startup) that open the next turn's log. */
@@ -32108,6 +32318,7 @@ var init_codex = __esm({
       constructor(child, tree, memory, options) {
         this.#options = options;
         this.#memory = memory;
+        this.#rateLimits = new CodexRateLimits(options.clock);
         this.#lastTurn = new CodexTurn(memory, options.clock);
         this.#host = hostProcess(
           child,
@@ -32142,6 +32353,9 @@ var init_codex = __esm({
       configure(config2) {
         this.#config = config2;
       }
+      observeRateLimits(response) {
+        this.#recordRateLimits(this.#rateLimits.read(response));
+      }
       attachThread(threadId, rolloutPath) {
         if (threadId === this.#threadId) return;
         this.#threadId = threadId;
@@ -32254,10 +32468,10 @@ var init_codex = __esm({
         };
         let identify = () => {
         };
-        const identified = new Promise((resolve13) => {
-          identify = resolve13;
+        const identified = new Promise((resolve14) => {
+          identify = resolve14;
         });
-        const done = new Promise((resolve13) => {
+        const done = new Promise((resolve14) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
@@ -32265,7 +32479,7 @@ var init_codex = __esm({
             if (this.#state === "busy") this.#state = "idle";
             this.#host.scanDescendants(true);
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#threadId });
+            resolve14({ turnId: id, outcome: outcome2, providerSessionId: this.#threadId });
           };
         });
         const active = {
@@ -32308,6 +32522,10 @@ var init_codex = __esm({
         return known === void 0 || known === turnId ? active : void 0;
       }
       #onNotification(notification) {
+        if (notification.method === "account/rateLimits/updated") {
+          this.#recordRateLimits(this.#rateLimits.notification(notification.params));
+          return;
+        }
         if (notification.method === "serverRequest/resolved") this.#dropResolved(notification);
         const active = this.#ownerOf(notification);
         const reader = active?.turn ?? this.#lastTurn;
@@ -32334,6 +32552,14 @@ var init_codex = __esm({
           void this.#stopTurn(active);
         }
       }
+      #recordRateLimits(updates) {
+        const active = this.#current;
+        if (active) this.#emitUpdates(active, updates);
+        else {
+          this.#between.push(...updates);
+          this.#between.splice(0, Math.max(0, this.#between.length - MAX_BETWEEN_UPDATES));
+        }
+      }
       #emitUpdates(active, updates) {
         for (const update of updates) this.#emit({ type: "update", turnId: active.id, update });
       }
@@ -32808,7 +33034,7 @@ function alanCodeConfigContent(existing, input2) {
   });
 }
 function readBody2(response) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const chunks = [];
     let size = 0;
     response.on("data", (chunk) => {
@@ -32816,7 +33042,7 @@ function readBody2(response) {
       if (size > MAX_CATALOG_BYTES) response.destroy(new Error("catalog too large"));
       else chunks.push(chunk);
     });
-    response.on("end", () => resolve13(Buffer.concat(chunks).toString("utf8")));
+    response.on("end", () => resolve14(Buffer.concat(chunks).toString("utf8")));
     response.on("error", reject);
   });
 }
@@ -32832,13 +33058,13 @@ function parseResponseBody(text3, status) {
 }
 function getJson(url3, headers, timeout, signal) {
   const request2 = url3.protocol === "https:" ? import_https.request : import_http9.request;
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const outgoing = request2(url3, { method: "GET", headers, timeout, signal }, (response) => {
       const status = response.statusCode ?? 0;
       readBody2(response).then((text3) => {
         const body = parseResponseBody(text3, status);
         if (status < 200 || status >= 300) reject(new CatalogResponseError(status, body));
-        else resolve13(body);
+        else resolve14(body);
       }).catch(reject);
     });
     outgoing.on("timeout", () => outgoing.destroy(new Error("catalog timed out")));
@@ -33052,9 +33278,9 @@ function alanCodeEngineEnv(input2) {
   };
 }
 async function writePlugin(directory, apiOrigin) {
-  const origin = (0, import_crypto11.createHash)("sha256").update(apiOrigin).digest("hex").slice(0, 12);
+  const origin = (0, import_crypto12.createHash)("sha256").update(apiOrigin).digest("hex").slice(0, 12);
   const target = (0, import_path8.join)(directory, `engine-plugin-v${ALAN_CODE_ENGINE_PLUGIN_VERSION}-${origin}.mjs`);
-  const temporary = `${target}.${(0, import_crypto11.randomUUID)()}.tmp`;
+  const temporary = `${target}.${(0, import_crypto12.randomUUID)()}.tmp`;
   await (0, import_promises34.mkdir)(directory, { recursive: true, mode: 448 });
   await (0, import_promises34.writeFile)(temporary, alanCodeEnginePluginSource(apiOrigin), { mode: 384 });
   await (0, import_promises34.rename)(temporary, target);
@@ -33086,7 +33312,7 @@ function alanCodeSystemPrompt(alanSystemPrompt) {
 
 ${instructions}` : ALAN_CODE_TOOL_NAMING_PROMPT;
 }
-var import_http9, import_https, import_fs7, import_path7, import_crypto11, import_promises34, import_path8, import_url, ALAN_CODE_BASELINE_PROMPT, ALAN_CODE_ENGINE_PROVIDER_ID, DEFAULT_CONTEXT_WINDOW, DEFAULT_MAX_OUTPUT_TOKENS, ALAN_CODE_API_KEY_ENV, ALAN_CODE_CONVERSATION_ID_ENV, ALAN_CODE_PROXY_PATH, ALAN_CODE_WEBSEARCH_PATH, ALAN_CODE_CATALOG_PATH, CATALOG_TIMEOUT_MS, MAX_CATALOG_BYTES, ACTIVATION_WAIT_MS, ACTIVATION_POLL_MS, CatalogResponseError, ALAN_CODE_ENGINE_PATH_ENV, ALAN_CODE_ENGINE_COMMAND, ALAN_CODE_ENGINE_NAME, WINDOWS_RUNNABLE_EXTENSION, ALAN_CODE_ENGINE_PLUGIN_VERSION, ALAN_CODE_TOOL_NAMING_PROMPT;
+var import_http9, import_https, import_fs7, import_path7, import_crypto12, import_promises34, import_path8, import_url, ALAN_CODE_BASELINE_PROMPT, ALAN_CODE_ENGINE_PROVIDER_ID, DEFAULT_CONTEXT_WINDOW, DEFAULT_MAX_OUTPUT_TOKENS, ALAN_CODE_API_KEY_ENV, ALAN_CODE_CONVERSATION_ID_ENV, ALAN_CODE_PROXY_PATH, ALAN_CODE_WEBSEARCH_PATH, ALAN_CODE_CATALOG_PATH, CATALOG_TIMEOUT_MS, MAX_CATALOG_BYTES, ACTIVATION_WAIT_MS, ACTIVATION_POLL_MS, CatalogResponseError, ALAN_CODE_ENGINE_PATH_ENV, ALAN_CODE_ENGINE_COMMAND, ALAN_CODE_ENGINE_NAME, WINDOWS_RUNNABLE_EXTENSION, ALAN_CODE_ENGINE_PLUGIN_VERSION, ALAN_CODE_TOOL_NAMING_PROMPT;
 var init_alan_code = __esm({
   "../agent-core/dist/providers/alan-code.js"() {
     "use strict";
@@ -33099,7 +33325,7 @@ var init_alan_code = __esm({
     import_fs7 = require("fs");
     import_path7 = require("path");
     init_runtime_v2();
-    import_crypto11 = require("crypto");
+    import_crypto12 = require("crypto");
     import_promises34 = require("fs/promises");
     import_path8 = require("path");
     import_url = require("url");
@@ -41714,8 +41940,8 @@ var require_streamx = __commonJS({
             return this;
           },
           next() {
-            return new Promise(function(resolve13, reject) {
-              promiseResolve = resolve13;
+            return new Promise(function(resolve14, reject) {
+              promiseResolve = resolve14;
               promiseReject = reject;
               const data = stream.read();
               if (data !== null) ondata(data);
@@ -41748,11 +41974,11 @@ var require_streamx = __commonJS({
         }
         function destroy(err) {
           stream.destroy(err);
-          return new Promise((resolve13, reject) => {
-            if (stream._duplexState & DESTROYED) return resolve13({ value: void 0, done: true });
+          return new Promise((resolve14, reject) => {
+            if (stream._duplexState & DESTROYED) return resolve14({ value: void 0, done: true });
             stream.once("close", function() {
               if (err) reject(err);
-              else resolve13({ value: void 0, done: true });
+              else resolve14({ value: void 0, done: true });
             });
           });
         }
@@ -41796,8 +42022,8 @@ var require_streamx = __commonJS({
         const writes = pending + (ws._duplexState & WRITE_WRITING ? 1 : 0);
         if (writes === 0) return Promise.resolve(true);
         if (state.drains === null) state.drains = [];
-        return new Promise((resolve13) => {
-          state.drains.push({ writes, resolve: resolve13 });
+        return new Promise((resolve14) => {
+          state.drains.push({ writes, resolve: resolve14 });
         });
       }
       write(data) {
@@ -41902,10 +42128,10 @@ var require_streamx = __commonJS({
       cb(null);
     }
     function pipelinePromise(...streams) {
-      return new Promise((resolve13, reject) => {
+      return new Promise((resolve14, reject) => {
         return pipeline(...streams, (err) => {
           if (err) return reject(err);
-          resolve13();
+          resolve14();
         });
       });
     }
@@ -42577,16 +42803,16 @@ var require_extract = __commonJS({
           entryCallback = null;
           cb(err);
         }
-        function onnext(resolve13, reject) {
+        function onnext(resolve14, reject) {
           if (error61) {
             return reject(error61);
           }
           if (entryStream) {
-            resolve13({ value: entryStream, done: false });
+            resolve14({ value: entryStream, done: false });
             entryStream = null;
             return;
           }
-          promiseResolve = resolve13;
+          promiseResolve = resolve14;
           promiseReject = reject;
           consumeCallback(null);
           if (extract2._finished && promiseResolve) {
@@ -42614,11 +42840,11 @@ var require_extract = __commonJS({
         function destroy(err) {
           extract2.destroy(err);
           consumeCallback(err);
-          return new Promise((resolve13, reject) => {
-            if (extract2.destroyed) return resolve13({ value: void 0, done: true });
+          return new Promise((resolve14, reject) => {
+            if (extract2.destroyed) return resolve14({ value: void 0, done: true });
             extract2.once("close", function() {
               if (err) reject(err);
-              else resolve13({ value: void 0, done: true });
+              else resolve14({ value: void 0, done: true });
             });
           });
         }
@@ -42905,9 +43131,9 @@ var require_tar_stream = __commonJS({
 var init_dist = __esm({
   "../agent-core/dist/index.js"() {
     "use strict";
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_M6YHY2EZ();
     init_chunk_YXWJW7I5();
   }
@@ -43581,7 +43807,7 @@ function isAcpBackendKind(value2) {
   return Object.hasOwn(ACP_PROFILES, value2);
 }
 function envDigest3(env) {
-  const hash2 = (0, import_crypto12.createHash)("sha256");
+  const hash2 = (0, import_crypto13.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -43648,13 +43874,13 @@ async function acpTurnInput(run2, context) {
     ...encoded.length ? { images: encoded, imagePaths: images.map((image) => image.path) } : {}
   };
 }
-var import_promises49, import_path9, import_crypto12, import_promises50, CURSOR_ASK_QUESTION, copilotAcpProfile, cursorAcpProfile, MODEL_REJECTED, MAX_READ_BYTES, FsDenied, ENV_REFERENCE, AcpBackgroundTasks, CURSOR_CREATE_PLAN, STATUSES2, READ_KINDS, ALLOW_KINDS, REJECT_KINDS, CANCELLED_PERMISSION, STOP_REASONS, CHUNKS, ECHOES, AcpTurn, STDERR_TAIL_LINES4, MAX_BETWEEN_UPDATES2, AcpSession, DEFAULTS3, CLIENT_INFO2, TASK_BACKGROUNDED, TASK_COMPLETED, SESSION_NOTIFICATION, KILLED_STATUSES, SUCCESS_STATUSES, SUBAGENT_ID, grokTaskDialect, grokAcpProfile, kimiAcpProfile, ACP_PROFILES, ACP_MODES;
+var import_promises49, import_path9, import_crypto13, import_promises50, CURSOR_ASK_QUESTION, copilotAcpProfile, cursorAcpProfile, MODEL_REJECTED, MAX_READ_BYTES, FsDenied, ENV_REFERENCE, AcpBackgroundTasks, CURSOR_CREATE_PLAN, STATUSES2, READ_KINDS, ALLOW_KINDS, REJECT_KINDS, CANCELLED_PERMISSION, STOP_REASONS, CHUNKS, ECHOES, AcpTurn, STDERR_TAIL_LINES4, MAX_BETWEEN_UPDATES2, AcpSession, DEFAULTS3, CLIENT_INFO2, TASK_BACKGROUNDED, TASK_COMPLETED, SESSION_NOTIFICATION, KILLED_STATUSES, SUCCESS_STATUSES, SUBAGENT_ID, grokTaskDialect, grokAcpProfile, kimiAcpProfile, ACP_PROFILES, ACP_MODES;
 var init_acp3 = __esm({
   "../agent-core/dist/providers/acp.js"() {
     "use strict";
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
     init_chunk_FPGAN4XO();
@@ -43663,7 +43889,7 @@ var init_acp3 = __esm({
     import_path9 = require("path");
     init_effort();
     init_acp();
-    import_crypto12 = require("crypto");
+    import_crypto13 = require("crypto");
     import_promises50 = require("fs/promises");
     init_agent2();
     CURSOR_ASK_QUESTION = "cursor/ask_question";
@@ -44180,7 +44406,7 @@ var init_acp3 = __esm({
         const turn = new AcpTurn(`acp-${this.#turns}-${id}`, this.#profile);
         let finish = () => {
         };
-        const done = new Promise((resolve13) => {
+        const done = new Promise((resolve14) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
@@ -44188,7 +44414,7 @@ var init_acp3 = __esm({
             if (this.#state === "busy") this.#state = "idle";
             this.#host.scanDescendants(true);
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
+            resolve14({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
           };
         });
         const active = { id, turn, done, finish, cancelRequested: false };
@@ -44469,7 +44695,7 @@ var init_acp3 = __esm({
 var init_classify = __esm({
   "../agent-core/dist/classify.js"() {
     "use strict";
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_YXWJW7I5();
   }
 });
@@ -44679,7 +44905,10 @@ function createPersistentDriver(provider4, options) {
     return "delivered";
   };
   const openFailed = (error61, spec, sink, signal, inputs) => {
-    if (error61 instanceof SessionOpenRefusal && error61.reason === "unsupported_version" && options.fallback) {
+    if (error61 instanceof SessionOpenRefusal && error61.reason === "unsupported_version" && inputs.codex !== void 0) {
+      return { outcome: "failed", message: error61.message };
+    }
+    if (error61 instanceof SessionOpenRefusal && error61.reason === "unsupported_version" && options.fallback && inputs.codex === void 0) {
       log.warn("holder.persistent_unsupported", {
         harness: provider4.harness,
         message: error61.message
@@ -44696,7 +44925,7 @@ function createPersistentDriver(provider4, options) {
   };
   return {
     runTurn: async (spec, sink, signal, inputs) => {
-      if (live.fallbackOnly && options.fallback)
+      if (live.fallbackOnly && options.fallback && inputs.codex === void 0)
         return options.fallback.runTurn(spec, sink, signal, inputs);
       if (signal.aborted) return { outcome: "aborted" };
       const managedMcp = await managedMcpAccess(signal);
@@ -45286,7 +45515,7 @@ function createOpenCodeDriver(options = {}) {
         await authorization?.remove();
       };
       const spec = { ...planned, env: launchEnv(planned, authorization) };
-      const password = options.password?.() ?? (0, import_crypto13.randomBytes)(24).toString("base64url");
+      const password = options.password?.() ?? (0, import_crypto14.randomBytes)(24).toString("base64url");
       try {
         const session = await openWithRetries(spec, password, resolved);
         void session.exited.then(removeAuthorization).catch((error61) => {
@@ -45301,7 +45530,7 @@ function createOpenCodeDriver(options = {}) {
   };
 }
 function envDigest4(env) {
-  const hash2 = (0, import_crypto14.createHash)("sha256");
+  const hash2 = (0, import_crypto15.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -45382,20 +45611,20 @@ function openCodeTurnInput(run2, context) {
     ...images.length ? { imagePaths: images.map((image) => image.path) } : {}
   };
 }
-var import_http10, import_crypto13, import_promises51, import_path10, import_path11, import_url2, import_crypto14, IDLE_SOCKET_MS3, OpenCodeHttpError, OpenCodeClient, OPENCODE_CONFIG_ENV, OPENCODE_ENGINE, TEXT_PARTS, STEP_PARTS, STOPPED_BY_USER, OpenCodeSubagents, NAMED_KINDS, OPENCODE_ABORTED_ERROR, PROVIDER_EVENT_META, TASK_TOOL_NAME, TASK_RESULT_TAG, TASK_ERROR_TAG, PERMISSION_DENIED, FILE_OPERATIONS2, PartReader, NOTHING, NON_INTERACTIVE_PERMISSIONS, CONTENT_FILTER_FINISHES, OUTPUT_PARTS, OpenCodeTurn, LISTENING, OUTPUT_TAIL_LINES, IMAGE_TYPES, OpenCodeSession, OPENCODE_MIN_VERSION, OPENCODE_REQUIREMENT, OPENCODE_TESTED_LINE, OPENCODE_SUPPORTED_MAJOR, DEFAULTS4, STORE_LOCKED, NON_INTERACTIVE_RULES, TITLE_LENGTH, MAX_VARIANT_LENGTH;
+var import_http10, import_crypto14, import_promises51, import_path10, import_path11, import_url2, import_crypto15, IDLE_SOCKET_MS3, OpenCodeHttpError, OpenCodeClient, OPENCODE_CONFIG_ENV, OPENCODE_ENGINE, TEXT_PARTS, STEP_PARTS, STOPPED_BY_USER, OpenCodeSubagents, NAMED_KINDS, OPENCODE_ABORTED_ERROR, PROVIDER_EVENT_META, TASK_TOOL_NAME, TASK_RESULT_TAG, TASK_ERROR_TAG, PERMISSION_DENIED, FILE_OPERATIONS2, PartReader, NOTHING, NON_INTERACTIVE_PERMISSIONS, CONTENT_FILTER_FINISHES, OUTPUT_PARTS, OpenCodeTurn, LISTENING, OUTPUT_TAIL_LINES, IMAGE_TYPES, OpenCodeSession, OPENCODE_MIN_VERSION, OPENCODE_REQUIREMENT, OPENCODE_TESTED_LINE, OPENCODE_SUPPORTED_MAJOR, DEFAULTS4, STORE_LOCKED, NON_INTERACTIVE_RULES, TITLE_LENGTH, MAX_VARIANT_LENGTH;
 var init_opencode = __esm({
   "../agent-core/dist/providers/opencode.js"() {
     "use strict";
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
     init_chunk_FPGAN4XO();
     init_chunk_YXWJW7I5();
     import_http10 = require("http");
     init_runtime_v2();
-    import_crypto13 = require("crypto");
+    import_crypto14 = require("crypto");
     import_promises51 = require("fs/promises");
     import_path10 = require("path");
     init_agent2();
@@ -45403,7 +45632,7 @@ var init_opencode = __esm({
     import_url2 = require("url");
     init_acp();
     init_acp();
-    import_crypto14 = require("crypto");
+    import_crypto15 = require("crypto");
     init_agent2();
     IDLE_SOCKET_MS3 = 4e3;
     OpenCodeHttpError = class extends Error {
@@ -46699,11 +46928,11 @@ function createCodexLogin(broker) {
     }
   };
 }
-function withLogin(planned, externalAuth, accountId) {
+function withLogin(planned, externalAuth, credentialKey) {
   return {
     ...planned,
     spec: { ...planned.spec, externalAuth },
-    key: JSON.stringify([planned.key, accountId])
+    key: JSON.stringify([planned.key, credentialKey])
   };
 }
 function createCodexHolderDriver(options) {
@@ -46725,7 +46954,11 @@ function createCodexHolderDriver(options) {
         });
         if (inputs.codex === void 0) return planned;
         login.forTurn(spec.runId, inputs.codex);
-        return withLogin(planned, login.externalAuth, inputs.codex.chatgptAccountId);
+        return withLogin(
+          planned,
+          login.externalAuth,
+          inputs.codex.credentialId ?? inputs.codex.chatgptAccountId
+        );
       },
       canResume: () => true,
       open: async (spec) => {
@@ -46857,8 +47090,8 @@ function createDroidPeer(writer, handlers) {
     },
     request: (method, params = {}) => {
       const id = `alan-${counter.next++}`;
-      return new Promise((resolve13, reject) => {
-        pending.set(id, { method, resolve: resolve13, reject });
+      return new Promise((resolve14, reject) => {
+        pending.set(id, { method, resolve: resolve14, reject });
         writer.write(envelope("request", { id, method, params })).catch((error61) => {
           pending.delete(id);
           reject(error61 instanceof Error ? error61 : new Error(String(error61)));
@@ -47138,7 +47371,7 @@ function createDroidDriver(options = {}) {
   };
 }
 function envDigest5(env) {
-  const hash2 = (0, import_crypto15.createHash)("sha256");
+  const hash2 = (0, import_crypto16.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -47198,19 +47431,19 @@ async function droidTurnInput(run2, context) {
   );
   return { turnId: run2.runId, text: text3, ...encoded.length ? { images: encoded } : {} };
 }
-var import_crypto15, import_promises52, FACTORY_API_VERSION, FACTORY_PROTOCOL_VERSION, SUBAGENT_TOOLS, TASK_OUTPUT_TOOLS, TASK_STOP_TOOLS, SILENT2, DroidTurn, STDERR_TAIL_LINES5, UNSUPPORTED_REQUEST2, DroidSession, DEFAULTS5, DROID_REQUIREMENT, DROID_JSONRPC_ARGS;
+var import_crypto16, import_promises52, FACTORY_API_VERSION, FACTORY_PROTOCOL_VERSION, SUBAGENT_TOOLS, TASK_OUTPUT_TOOLS, TASK_STOP_TOOLS, SILENT2, DroidTurn, STDERR_TAIL_LINES5, UNSUPPORTED_REQUEST2, DroidSession, DEFAULTS5, DROID_REQUIREMENT, DROID_JSONRPC_ARGS;
 var init_droid = __esm({
   "../agent-core/dist/providers/droid.js"() {
     "use strict";
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
     init_chunk_FPGAN4XO();
     init_chunk_YXWJW7I5();
     init_runtime_v2();
-    import_crypto15 = require("crypto");
+    import_crypto16 = require("crypto");
     import_promises52 = require("fs/promises");
     init_agent2();
     FACTORY_API_VERSION = "1.0.0";
@@ -47483,14 +47716,14 @@ var init_droid = __esm({
         const turn = new DroidTurn(sessionId, this.#memory);
         let finish = () => {
         };
-        const done = new Promise((resolve13) => {
+        const done = new Promise((resolve14) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
             if (this.#state === "busy") this.#state = "idle";
             this.#host.scanDescendants(true);
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
+            resolve14({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
           };
         });
         const active = { id, turn, done, finish, cancelRequested: false };
@@ -48258,7 +48491,7 @@ ${output2.stderr}`).join("\n")
   };
 }
 function envDigest6(env) {
-  const hash2 = (0, import_crypto16.createHash)("sha256");
+  const hash2 = (0, import_crypto17.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -48304,14 +48537,14 @@ function antigravityTurnInput(run2, context) {
   });
   return { turnId: run2.runId, text: appendImagePathReferences(text3, images) };
 }
-var import_promises53, import_path12, import_fs8, import_path13, import_path14, import_url3, import_crypto16, NO_ANTIGRAVITY_CAPABILITIES, INSTRUCTIONS_FILE, MAX_INSTRUCTION_CHARS, SHORTENED_NOTE, DIFF_BLOCK_START, DIFF_BLOCK_END, HUNK_HEADER, TRANSCRIPT_FILE, FULL_TRANSCRIPT_FILE, LOG_DIRS, TOOL_RESULT_TYPES, BrainTranscript, AntigravityTranscripts, ANTIGRAVITY_GRAMMAR_NAME, AntigravityGrammar, ignored, HANDLERS, SUCCESSFUL_STATUSES, SESSION_START_TYPES, RESULT_TYPES, SUBAGENT_START_TYPES, RESUME_FORKED, EXITED_WITHOUT_RESULT, AntigravityTurn, DEFAULTS6, AntigravitySession, WINDOWS_LINE_MARGIN;
+var import_promises53, import_path12, import_fs8, import_path13, import_path14, import_url3, import_crypto17, NO_ANTIGRAVITY_CAPABILITIES, INSTRUCTIONS_FILE, MAX_INSTRUCTION_CHARS, SHORTENED_NOTE, DIFF_BLOCK_START, DIFF_BLOCK_END, HUNK_HEADER, TRANSCRIPT_FILE, FULL_TRANSCRIPT_FILE, LOG_DIRS, TOOL_RESULT_TYPES, BrainTranscript, AntigravityTranscripts, ANTIGRAVITY_GRAMMAR_NAME, AntigravityGrammar, ignored, HANDLERS, SUCCESSFUL_STATUSES, SESSION_START_TYPES, RESULT_TYPES, SUBAGENT_START_TYPES, RESUME_FORKED, EXITED_WITHOUT_RESULT, AntigravityTurn, DEFAULTS6, AntigravitySession, WINDOWS_LINE_MARGIN;
 var init_antigravity = __esm({
   "../agent-core/dist/providers/antigravity.js"() {
     "use strict";
     init_chunk_SBT5W7L4();
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_M6YHY2EZ();
     init_chunk_FPGAN4XO();
     init_chunk_YXWJW7I5();
@@ -48323,7 +48556,7 @@ var init_antigravity = __esm({
     init_effort();
     import_path14 = require("path");
     import_url3 = require("url");
-    import_crypto16 = require("crypto");
+    import_crypto17 = require("crypto");
     init_agent2();
     NO_ANTIGRAVITY_CAPABILITIES = {
       structuredPrint: false,
@@ -48957,7 +49190,7 @@ function createCommandCodeDriver(options = {}) {
   };
 }
 function envDigest7(env) {
-  const hash2 = (0, import_crypto17.createHash)("sha256");
+  const hash2 = (0, import_crypto18.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -49009,13 +49242,13 @@ function commandCodeTurnInput(run2, context) {
   });
   return { turnId: run2.runId, text: appendImagePathReferences(text3, images) };
 }
-var import_promises54, import_path15, import_crypto17, COMMAND_CODE_GRAMMAR_NAME, SILENT3, CommandCodeGrammar, SHELL_TOOL, STOP_TOOLS, REPORTED_STATUS, SHELL_STATUS, SWEEP_INTERVAL_MS, CommandCodeBackgroundTasks, EXITED_WITHOUT_RESULT2, CommandCodeTurn, COMMAND_CODE_MAX_TURNS, DEFAULTS7, CommandCodeSession;
+var import_promises54, import_path15, import_crypto18, COMMAND_CODE_GRAMMAR_NAME, SILENT3, CommandCodeGrammar, SHELL_TOOL, STOP_TOOLS, REPORTED_STATUS, SHELL_STATUS, SWEEP_INTERVAL_MS, CommandCodeBackgroundTasks, EXITED_WITHOUT_RESULT2, CommandCodeTurn, COMMAND_CODE_MAX_TURNS, DEFAULTS7, CommandCodeSession;
 var init_command_code = __esm({
   "../agent-core/dist/providers/command-code.js"() {
     "use strict";
-    init_chunk_72NSEYHK();
+    init_chunk_4G77APXN();
     init_chunk_XC5676SG();
-    init_chunk_54ZRJOQP();
+    init_chunk_HBIPWAUI();
     init_chunk_J2KTV5FP();
     init_chunk_M6YHY2EZ();
     init_chunk_FPGAN4XO();
@@ -49025,7 +49258,7 @@ var init_command_code = __esm({
     init_agent2();
     init_runtime_v2();
     init_acp();
-    import_crypto17 = require("crypto");
+    import_crypto18 = require("crypto");
     init_agent2();
     COMMAND_CODE_GRAMMAR_NAME = "command_code_cli";
     SILENT3 = /* @__PURE__ */ new Set([
@@ -54416,7 +54649,7 @@ var require_websocket_server = __commonJS({
 // package.json
 var package_default = {
   name: "@alan-ai-hq/agent-manager",
-  version: "0.1.145",
+  version: "0.1.147",
   private: true,
   type: "module",
   description: "Alan machine runtime (alan-agent): identity, link, reconciler, session holders, run log, uploader, local API",
@@ -54466,7 +54699,7 @@ var package_default = {
 
 // src/cli/commands/compat.ts
 var import_node_crypto32 = require("crypto");
-var import_promises68 = require("fs/promises");
+var import_promises69 = require("fs/promises");
 init_runtime_v2();
 init_zod();
 
@@ -54625,8 +54858,8 @@ async function writeJsonFileAtomic(path4, value2) {
 var LIFECYCLE_DRAIN_MS = 5e3;
 function createGate() {
   const opened = {};
-  const promise2 = new Promise((resolve13) => {
-    opened.resolve = resolve13;
+  const promise2 = new Promise((resolve14) => {
+    opened.resolve = resolve14;
   });
   return { promise: promise2, open: () => opened.resolve?.() };
 }
@@ -54853,7 +55086,7 @@ function transportFailure(request2, error61) {
   });
 }
 function readBody(incoming, url3, maxBytes) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const declared = Number(incoming.headers["content-length"] ?? "0");
     if (maxBytes !== void 0 && declared > maxBytes) {
       incoming.destroy();
@@ -54872,7 +55105,7 @@ function readBody(incoming, url3, maxBytes) {
       chunks.push(chunk);
     });
     incoming.on("error", reject);
-    incoming.on("end", () => resolve13(Buffer.concat(chunks)));
+    incoming.on("end", () => resolve14(Buffer.concat(chunks)));
   });
 }
 function isConnectionReset(error61) {
@@ -54880,7 +55113,7 @@ function isConnectionReset(error61) {
 }
 function exchange(request2, agents, attempt2 = 0) {
   const { signal, url: url3 } = request2;
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     if (signal.aborted) {
       reject(signal.reason);
       return;
@@ -54907,7 +55140,7 @@ function exchange(request2, agents, attempt2 = 0) {
       const stale = outgoing.reusedSocket && !responded && isConnectionReset(error61);
       if (stale && attempt2 < STALE_SOCKET_RETRIES && !signal.aborted) {
         settle();
-        resolve13(exchange(request2, agents, attempt2 + 1));
+        resolve14(exchange(request2, agents, attempt2 + 1));
         return;
       }
       fail(error61);
@@ -54920,7 +55153,7 @@ function exchange(request2, agents, attempt2 = 0) {
       readBody(incoming, url3, isRedirect(status) ? void 0 : request2.maxBodyBytes).then(
         (body) => {
           settle();
-          resolve13({ status, headers: incoming.headers, body });
+          resolve14({ status, headers: incoming.headers, body });
         },
         fail
       );
@@ -55165,8 +55398,8 @@ function isBodyless(method) {
   return method === "GET" || method === "HEAD";
 }
 function exchange2(send2, options, input2) {
-  return new Promise((resolve13, reject) => {
-    const outgoing = send2({ ...options, method: input2.method, signal: input2.signal }, resolve13);
+  return new Promise((resolve14, reject) => {
+    const outgoing = send2({ ...options, method: input2.method, signal: input2.signal }, resolve14);
     outgoing.on("error", reject);
     if (isBodyless(input2.method)) {
       input2.body.resume();
@@ -55234,7 +55467,18 @@ function createGitHubProxyForwarder(options) {
 
 // src/api-client/holder-client.ts
 init_runtime_v2();
+init_zod();
 var REQUEST_TIMEOUT_MS3 = 3e4;
+var credentialRefusalSchema = external_exports.object({ message: external_exports.string().trim().min(1) });
+function credentialFailureMessage(response, fallback) {
+  if (response.status !== 409) return fallback;
+  try {
+    const parsed = credentialRefusalSchema.safeParse(jsonBody(response));
+    return parsed.success ? parsed.data.message : fallback;
+  } catch {
+    return fallback;
+  }
+}
 function createHolderApiClient({
   apiUrl,
   accessToken,
@@ -55267,7 +55511,10 @@ function createHolderApiClient({
       if (!isOk(response)) {
         throw new RuntimeFault(
           "io_failed",
-          `Provider credential request failed: ${response.status}`
+          credentialFailureMessage(
+            response,
+            `Provider credential request failed: ${response.status}`
+          )
         );
       }
       return runProviderCredentialSchema.parse(jsonBody(response));
@@ -55275,7 +55522,10 @@ function createHolderApiClient({
     refreshCodexCredential: async (runId, body, signal) => {
       const response = await request2("POST", runCodexCredentialRefreshPath(runId), signal, body);
       if (!isOk(response)) {
-        throw new RuntimeFault("io_failed", `Codex sign-in refresh failed: ${response.status}`);
+        throw new RuntimeFault(
+          "io_failed",
+          credentialFailureMessage(response, `Codex sign-in refresh failed: ${response.status}`)
+        );
       }
       return runCodexCredentialSchema.parse(jsonBody(response));
     },
@@ -56635,7 +56885,7 @@ function createGitRunner(options) {
       }
       await killProcessTree(child.pid, { signal: "SIGKILL", child, platform: platform3 });
     };
-    return new Promise((resolve13, reject) => {
+    return new Promise((resolve14, reject) => {
       let ending = null;
       const stop = (next) => {
         if (ending !== null) return;
@@ -56660,7 +56910,7 @@ function createGitRunner(options) {
         signal.removeEventListener("abort", onAbort);
         const final = ending ?? last;
         if (final.kind === "exited") {
-          resolve13({ exitCode: final.exitCode, stdout: stdout.text(), stderr: stderr.text() });
+          resolve14({ exitCode: final.exitCode, stdout: stdout.text(), stderr: stderr.text() });
         } else {
           reject(faultFor(final, command));
         }
@@ -56873,6 +57123,9 @@ async function checkSnapshotCheckouts(root, deps, signal) {
     })
   );
 }
+async function recordCheckoutKept(dir, path4, reason) {
+  await writeJsonFileAtomic(freshnessFile(dir, path4), { state: "kept", path: path4, reason });
+}
 async function readCheckoutFreshness(dir, path4) {
   for (let current = path4; ; current = (0, import_node_path7.dirname)(current)) {
     const read = await readJsonFile(freshnessFile(dir, current), freshnessSchema);
@@ -58177,7 +58430,7 @@ function statusOf(error61) {
   }
   return 1;
 }
-var systemExec = (request2) => new Promise((resolve13) => {
+var systemExec = (request2) => new Promise((resolve14) => {
   const child = (0, import_node_child_process6.execFile)(
     request2.command,
     [...request2.args],
@@ -58188,7 +58441,7 @@ var systemExec = (request2) => new Promise((resolve13) => {
       windowsHide: true
     },
     (error61, stdout, stderr) => {
-      resolve13({ status: statusOf(error61), stdout, stderr });
+      resolve14({ status: statusOf(error61), stdout, stderr });
     }
   );
   child.stdin?.on("error", () => {
@@ -59378,11 +59631,11 @@ async function startGitCredentialServer(options) {
     });
   });
   removeStaleEndpoint(options.endpoint);
-  await new Promise((resolve13, reject) => {
+  await new Promise((resolve14, reject) => {
     server.once("error", reject);
     server.listen(options.endpoint, () => {
       server.off("error", reject);
-      resolve13();
+      resolve14();
     });
   });
   options.log.info("git.credential_server_listening", { endpoint: options.endpoint });
@@ -59390,7 +59643,7 @@ async function startGitCredentialServer(options) {
     endpoint: options.endpoint,
     [Symbol.asyncDispose]: async () => {
       closing.abort();
-      await new Promise((resolve13) => server.close(() => resolve13()));
+      await new Promise((resolve14) => server.close(() => resolve14()));
       removeStaleEndpoint(options.endpoint);
     }
   };
@@ -59464,13 +59717,13 @@ authorityKeyIdentifier = keyid
 `;
 }
 function openssl(args, cwd) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     (0, import_node_child_process9.execFile)(
       "openssl",
       [...args],
       { cwd, timeout: OPENSSL_TIMEOUT_MS },
       (error61, _stdout, stderr) => {
-        if (error61 === null) resolve13();
+        if (error61 === null) resolve14();
         else
           reject(new Error(`openssl ${args[0] ?? ""} failed: ${stderr.trim() || error61.message}`));
       }
@@ -59647,21 +59900,21 @@ function relayTo(forward, log) {
   };
 }
 function listen(server, target) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     server.once("error", reject);
     const done = () => {
       server.off("error", reject);
-      resolve13();
+      resolve14();
     };
     if (typeof target === "string") server.listen(target, done);
     else server.listen(target.port, target.host, done);
   });
 }
 function close(server, sockets = /* @__PURE__ */ new Set()) {
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     for (const socket of sockets) socket.destroy();
     server.closeAllConnections();
-    server.close(() => resolve13());
+    server.close(() => resolve14());
   });
 }
 function portOf(server) {
@@ -62444,7 +62697,7 @@ async function startNativeIngest(deps) {
   };
   const settleIdle = () => {
     if (workers.size > 0) return;
-    for (const resolve13 of idleWaiters) resolve13();
+    for (const resolve14 of idleWaiters) resolve14();
     idleWaiters.clear();
   };
   const retryDelay = (worker) => {
@@ -62687,7 +62940,7 @@ async function startNativeIngest(deps) {
     sweep: sweep2,
     whenIdle: () => {
       if (workers.size === 0) return Promise.resolve();
-      return new Promise((resolve13) => idleWaiters.add(resolve13));
+      return new Promise((resolve14) => idleWaiters.add(resolve14));
     },
     [Symbol.asyncDispose]: async () => {
       shutdown.abort();
@@ -62835,7 +63088,7 @@ function captureProbe(command, args, options) {
   const launch = directLaunch(command, args, options);
   if (launch === void 0) return Promise.resolve({ stdout: "", stderr: "", exitCode: void 0 });
   const env = platform3 === "win32" ? withWindowsHelper(canonicalWindowsEnvironment(options.env)) : options.env;
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     const limit = options.maxBufferBytes ?? DEFAULT_MAX_BYTES;
     const stdout = [];
     const stderr = [];
@@ -62870,7 +63123,7 @@ function captureProbe(command, args, options) {
       settled2 = true;
       deadlineController.abort();
       options.signal?.removeEventListener("abort", abort);
-      resolve13({
+      resolve14({
         stdout: Buffer.concat(stdout).toString("utf8"),
         stderr: Buffer.concat(stderr).toString("utf8"),
         exitCode
@@ -63002,7 +63255,7 @@ function cursorAccountLabel(output2) {
 function waitForAbort(signal) {
   if (signal.aborted) return Promise.resolve();
   return new Promise(
-    (resolve13) => signal.addEventListener("abort", () => resolve13(), { once: true })
+    (resolve14) => signal.addEventListener("abort", () => resolve14(), { once: true })
   );
 }
 function idlePrompt(signal) {
@@ -63080,14 +63333,14 @@ async function codexLabel(executable, env) {
     windowsVerbatimArguments: launch.windowsVerbatimArguments
   });
   const timeout = AbortSignal.timeout(ACCOUNT_TIMEOUT_MS);
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     let finished = false;
     let buffer = "";
     const finish = (label) => {
       if (finished) return;
       finished = true;
       child.kill();
-      resolve13(label);
+      resolve14(label);
     };
     const send2 = (value2) => {
       child.stdin.write(`${JSON.stringify(value2)}
@@ -63596,11 +63849,11 @@ async function resolveCliEnvironment(options) {
 }
 async function openCliEnvironment(options) {
   const decorate = options.decorate ?? ((env) => env);
-  const resolve13 = async () => {
+  const resolve14 = async () => {
     const resolved = await resolveCliEnvironmentDetailed(options);
     return { env: decorate(resolved.env), source: resolved.source };
   };
-  let state = await resolve13();
+  let state = await resolve14();
   let retryAt = options.clock.now() + DEGRADED_RETRY_MS;
   return {
     current: () => state.env,
@@ -63609,7 +63862,7 @@ async function openCliEnvironment(options) {
       if (state.source === "login_shell" || options.platform === "win32") return false;
       if (options.clock.now() < retryAt) return false;
       retryAt = options.clock.now() + DEGRADED_RETRY_MS;
-      const next = await resolve13();
+      const next = await resolve14();
       const changed = envValue(next.env, "PATH") !== envValue(state.env, "PATH");
       state = next;
       return changed;
@@ -63686,11 +63939,11 @@ async function installVersion2(backendKind, requested, options, signal) {
     }
     return exact;
   }
-  const resolve13 = options.resolveVersion;
-  if (resolve13 === void 0) throw new Error("Latest version lookup is unavailable");
+  const resolve14 = options.resolveVersion;
+  if (resolve14 === void 0) throw new Error("Latest version lookup is unavailable");
   const packageName = packageFor(backendKind).name;
   return checkedVersion(
-    await resolve13(backendKind === "opencode_serve" ? `${packageName}@1` : packageName, signal)
+    await resolve14(backendKind === "opencode_serve" ? `${packageName}@1` : packageName, signal)
   );
 }
 function selection(root, backendKind, version2) {
@@ -65257,8 +65510,8 @@ async function collectStream(stream) {
   return import_node_buffer2.Buffer.concat(chunks);
 }
 function addArchiveEntry(archive, header, bytes) {
-  return new Promise((resolve13, reject) => {
-    archive.entry(header, bytes, (error61) => error61 ? reject(error61) : resolve13());
+  return new Promise((resolve14, reject) => {
+    archive.entry(header, bytes, (error61) => error61 ? reject(error61) : resolve14());
   });
 }
 async function decompressBounded(archiveBytes) {
@@ -65284,7 +65537,7 @@ async function extractTar(tarBytes, destination) {
   const extractor = (0, import_tar_stream.extract)();
   let fileCount = 0;
   let totalBytes = 0;
-  const completion = new Promise((resolve13, reject) => {
+  const completion = new Promise((resolve14, reject) => {
     extractor.on("entry", (header, stream, next) => {
       void extractEntry(header, stream, destination, {
         addFile(size) {
@@ -65299,7 +65552,7 @@ async function extractTar(tarBytes, destination) {
         }
       }).then(next, (error61) => extractor.destroy(error61 instanceof Error ? error61 : new Error(String(error61))));
     });
-    extractor.once("finish", resolve13);
+    extractor.once("finish", resolve14);
     extractor.once("error", reject);
   });
   import_node_stream.Readable.from(tarBytes).pipe(extractor);
@@ -65782,9 +66035,9 @@ async function syncOnce(env, local, onRecorded, signal) {
   return report2;
 }
 function aborted2(signal) {
-  return new Promise((resolve13) => {
-    if (signal.aborted) resolve13(null);
-    else signal.addEventListener("abort", () => resolve13(null), { once: true });
+  return new Promise((resolve14) => {
+    if (signal.aborted) resolve14(null);
+    else signal.addEventListener("abort", () => resolve14(null), { once: true });
   });
 }
 function openMachineSkills(options) {
@@ -65873,11 +66126,11 @@ function openMachineSkills(options) {
       if ((await resolveSkillInvocations(layout, named, "exact")).kind === "resolved") return;
     }
   };
-  const recordedUntilResolved = (named, until) => new Promise((resolve13) => {
+  const recordedUntilResolved = (named, until) => new Promise((resolve14) => {
     const done = () => {
       recordWatchers.delete(check3);
       until.removeEventListener("abort", done);
-      resolve13();
+      resolve14();
     };
     const check3 = () => {
       void resolveSkillInvocations(layout, named, "exact").then((resolution) => {
@@ -65885,7 +66138,7 @@ function openMachineSkills(options) {
       });
     };
     if (until.aborted) {
-      resolve13();
+      resolve14();
       return;
     }
     recordWatchers.add(check3);
@@ -66381,7 +66634,7 @@ async function openWorkspaces(options) {
 
 // src/cli/config.ts
 var import_node_os11 = require("os");
-var import_node_path67 = require("path");
+var import_node_path69 = require("path");
 init_zod();
 
 // src/client/contract.ts
@@ -66799,8 +67052,8 @@ function nextOffsetOf(response) {
 async function pause(ms, signal) {
   const either = AbortSignal.any([signal, AbortSignal.timeout(ms)]);
   if (either.aborted) return;
-  await new Promise((resolve13) => {
-    either.addEventListener("abort", () => resolve13(), { once: true });
+  await new Promise((resolve14) => {
+    either.addEventListener("abort", () => resolve14(), { once: true });
   });
 }
 function jittered(backoff, failures) {
@@ -67109,9 +67362,9 @@ async function sendNativeHookSignal(discoveryPath, hookSignal, signal) {
 
 // src/sessions/index.ts
 var import_node_crypto31 = require("crypto");
-var import_promises66 = require("fs/promises");
+var import_promises67 = require("fs/promises");
 var import_node_os10 = require("os");
-var import_node_path66 = require("path");
+var import_node_path68 = require("path");
 init_runtime_v2();
 
 // src/holder/control-client.ts
@@ -67162,8 +67415,8 @@ function isReply(message2) {
 async function connectHolder(endpoint, token, onEvent) {
   const socket = (0, import_node_net2.connect)(endpoint);
   const pending = /* @__PURE__ */ new Map();
-  const closed = new Promise((resolve13) => socket.once("close", () => resolve13()));
-  const ready = new Promise((resolve13, reject) => {
+  const closed = new Promise((resolve14) => socket.once("close", () => resolve14()));
+  const ready = new Promise((resolve14, reject) => {
     socket.once("error", reject);
     socket.once(
       "close",
@@ -67171,7 +67424,7 @@ async function connectHolder(endpoint, token, onEvent) {
     );
     readMessages(socket, holderMessageSchema, {
       onMessage: (message2) => {
-        if (message2.type === "ready") resolve13(message2.pid);
+        if (message2.type === "ready") resolve14(message2.pid);
         else if (isReply(message2)) {
           const id = message2.id;
           if (id === null) return;
@@ -67186,13 +67439,13 @@ async function connectHolder(endpoint, token, onEvent) {
   const pid = await ready;
   const request2 = (body) => {
     const id = (0, import_node_crypto26.randomUUID)();
-    return new Promise((resolve13, reject) => {
+    return new Promise((resolve14, reject) => {
       const timer = AbortSignal.timeout(REQUEST_TIMEOUT_MS7);
       timer.addEventListener("abort", () => {
         pending.delete(id);
         reject(new RuntimeFault("io_failed", "Holder did not answer"));
       });
-      pending.set(id, resolve13);
+      pending.set(id, resolve14);
       writeMessage(socket, { ...body, id });
     });
   };
@@ -67529,14 +67782,14 @@ async function prepareRunInputs(spec, { source, tmpDir, signal, skills = [] }) {
 var import_node_crypto30 = require("crypto");
 var import_node_fs22 = require("fs");
 var import_node_net3 = require("net");
-var import_node_path65 = require("path");
+var import_node_path67 = require("path");
 init_runtime_v2();
 
 // src/holder/admission.ts
 var import_node_fs19 = require("fs");
-var import_promises60 = require("fs/promises");
+var import_promises61 = require("fs/promises");
 var import_node_os9 = require("os");
-var import_node_path59 = require("path");
+var import_node_path61 = require("path");
 init_constants();
 
 // ../shared/dist/node/local-workspace.js
@@ -67620,18 +67873,12 @@ async function discoverRelocatedWorkspace(search) {
 }
 
 // src/holder/checkout-refresh.ts
+var import_node_path59 = require("path");
+
+// src/holder/claim-once.ts
 var import_node_crypto28 = require("crypto");
 var import_promises58 = require("fs/promises");
 var import_node_path57 = require("path");
-function short(sha) {
-  return sha.slice(0, 12);
-}
-function staleLine(path4, snapshot2, tip) {
-  const checkout = snapshot2 === void 0 ? "is the environment snapshot's checkout" : `is the environment snapshot's checkout of ${snapshot2.branch} (commit ${short(snapshot2.head)})`;
-  const base = snapshot2 === void 0 ? "its upstream" : `origin/${snapshot2.base}`;
-  const remote = tip === void 0 ? "may be ahead" : `is ahead at ${short(tip)}`;
-  return `Note: ${path4} ${checkout}; ${base} ${remote}. Run \`git pull --ff-only\` there before relying on its files.`;
-}
 async function claimOnce(dir, name) {
   try {
     await (0, import_promises58.mkdir)(dir, { recursive: true, mode: 448 });
@@ -67641,6 +67888,199 @@ async function claimOnce(dir, name) {
     return false;
   }
 }
+function claimFirstLease(freshnessDir, path4) {
+  return claimOnce((0, import_node_path57.join)(freshnessDir, "leased"), (0, import_node_crypto28.createHash)("sha256").update(path4).digest("hex"));
+}
+
+// src/holder/requested-checkout.ts
+var import_promises59 = require("fs/promises");
+var import_node_path58 = require("path");
+var REMOTE2 = "origin";
+var REASON_MAX_CHARS = 200;
+function firstLine3(text3) {
+  return (text3.trim().split("\n")[0] ?? "").slice(0, REASON_MAX_CHARS);
+}
+function reasonOf(output2, command) {
+  return firstLine3(output2.stderr) || `git ${command} exited ${output2.exitCode}`;
+}
+function noted(checkout, situation, reason, action) {
+  return {
+    kind: "noted",
+    line: `Note: ${checkout.path} ${situation}: ${reason}. ${action} before relying on its files.`
+  };
+}
+function notSwitched(checkout, current, reason) {
+  const on2 = current ?? "a detached HEAD";
+  return noted(
+    checkout,
+    `is on ${on2}, not ${checkout.branch}, the branch picked for this chat`,
+    reason,
+    `Switch it to ${checkout.branch}`
+  );
+}
+async function clone2(checkout, deps, signal) {
+  const parent = (0, import_node_path58.dirname)(checkout.path);
+  await (0, import_promises59.mkdir)(parent, { recursive: true });
+  await assertValidBranch(deps.git, parent, checkout.branch, signal);
+  const output2 = await deps.git.run(
+    {
+      cwd: parent,
+      args: [
+        "clone",
+        "--quiet",
+        "--no-tags",
+        "--depth=1",
+        "--branch",
+        checkout.branch,
+        "--",
+        checkout.repoUrl,
+        checkout.path
+      ],
+      network: true
+    },
+    signal
+  );
+  if (output2.exitCode === 0) return { kind: "moved", how: "cloned" };
+  return noted(
+    checkout,
+    `is missing, and cloning it on ${checkout.branch}, the branch picked for this chat, failed`,
+    reasonOf(output2, "clone"),
+    `Clone ${checkout.repoUrl} there`
+  );
+}
+var SWITCHED = { kind: "moved", how: "switched" };
+function coversBranch(fetchConfig, branch) {
+  return fetchConfig.split("\n").some(
+    (refspec) => refspec === `+refs/heads/*:refs/remotes/${REMOTE2}/*` || refspec === `+refs/heads/${branch}:refs/remotes/${REMOTE2}/${branch}`
+  );
+}
+async function fetchBranch(checkout, git, shallow, current) {
+  const { branch } = checkout;
+  const tracking = `refs/remotes/${REMOTE2}/${branch}`;
+  const fetchConfig = await git(["config", "--get-all", `remote.${REMOTE2}.fetch`], {
+    readOnly: true
+  });
+  if (!coversBranch(fetchConfig.stdout, branch)) {
+    const added = await git(["remote", "set-branches", "--add", REMOTE2, branch]);
+    if (added.exitCode !== 0) return notSwitched(checkout, current, reasonOf(added, "remote"));
+  }
+  const depth = shallow ? ["--depth=1"] : [];
+  const fetched = await git(
+    ["fetch", "--no-tags", "--quiet", ...depth, REMOTE2, `refs/heads/${branch}:${tracking}`],
+    { network: true }
+  );
+  if (fetched.exitCode !== 0) return notSwitched(checkout, current, reasonOf(fetched, "fetch"));
+  const tip = await git(["rev-parse", "--verify", tracking], { readOnly: true });
+  if (tip.exitCode !== 0) return notSwitched(checkout, current, reasonOf(tip, "rev-parse"));
+  return { kind: "fetched", tip: tip.stdout.trim() };
+}
+async function moveOnto(checkout, git, tip, current) {
+  const { branch } = checkout;
+  const local = await git(["rev-parse", "--verify", "-q", `refs/heads/${branch}`], {
+    readOnly: true
+  });
+  if (local.exitCode !== 0) {
+    const created = await git([
+      "switch",
+      "--quiet",
+      "-c",
+      branch,
+      "--track",
+      `${REMOTE2}/${branch}`
+    ]);
+    return created.exitCode === 0 ? SWITCHED : notSwitched(checkout, current, reasonOf(created, "switch"));
+  }
+  const localHead = local.stdout.trim();
+  const ancestor = localHead === tip || (await git(["merge-base", "--is-ancestor", localHead, tip], { readOnly: true })).exitCode === 0;
+  if (!ancestor) {
+    return notSwitched(
+      checkout,
+      current,
+      `its local ${branch} has diverged from ${REMOTE2}/${branch}`
+    );
+  }
+  const switched = await git(["switch", "--quiet", branch]);
+  if (switched.exitCode !== 0) return notSwitched(checkout, current, reasonOf(switched, "switch"));
+  if (localHead === tip) return SWITCHED;
+  const merged = await git(["merge", "--quiet", "--ff-only", tip]);
+  return merged.exitCode === 0 ? SWITCHED : noted(
+    checkout,
+    `is on ${branch} but behind ${REMOTE2}/${branch}`,
+    reasonOf(merged, "merge"),
+    "Run `git pull --ff-only` there"
+  );
+}
+async function switchTo(checkout, current, operationId, deps, signal) {
+  var _stack = [];
+  try {
+    const cwd = checkout.path;
+    const git = (args, invocation = {}) => deps.git.run({ cwd, args, ...invocation }, signal);
+    await assertValidBranch(deps.git, cwd, checkout.branch, signal);
+    const refs = await git(
+      ["rev-parse", "--path-format=absolute", "--git-common-dir", "--is-shallow-repository"],
+      { readOnly: true }
+    );
+    if (refs.exitCode !== 0) return notSwitched(checkout, current, reasonOf(refs, "rev-parse"));
+    const [commonDir = "", shallow] = refs.stdout.trim().split("\n");
+    const attempt2 = await deps.locks.tryExclusive(commonDir, operationId);
+    if (attempt2.kind === "busy") {
+      return notSwitched(checkout, current, "another git operation holds the checkout");
+    }
+    const _lock = __using(_stack, attempt2.lock, true);
+    const now = await readCheckoutStatus(deps.git, cwd, signal);
+    if (now === null || now.dirty) {
+      return notSwitched(checkout, now?.branch ?? current, "it has uncommitted changes");
+    }
+    const fetched = await fetchBranch(checkout, git, shallow === "true", now.branch);
+    if (fetched.kind !== "fetched") return fetched;
+    const outcome2 = await moveOnto(checkout, git, fetched.tip, now.branch);
+    const after = await readCheckoutStatus(deps.git, cwd, signal);
+    if (after?.branch === checkout.branch) {
+      await recordCheckoutKept(deps.dir, cwd, "requested_branch");
+    }
+    return outcome2;
+  } catch (_) {
+    var _error = _, _hasError = true;
+  } finally {
+    var _promise2 = __callDispose(_stack, _error, _hasError);
+    _promise2 && await _promise2;
+  }
+}
+async function applyRequestedCheckout(checkout, spec, deps, signal) {
+  try {
+    if (!await isCheckout(checkout.path)) return await clone2(checkout, deps, signal);
+    const status = await readCheckoutStatus(deps.git, checkout.path, signal);
+    if (status === null) return notSwitched(checkout, null, "git status failed");
+    if (status.branch === checkout.branch) return { kind: "on_branch" };
+    if (status.dirty) return notSwitched(checkout, status.branch, "it has uncommitted changes");
+    if (!await claimFirstLease(deps.dir, checkout.path)) {
+      return notSwitched(
+        checkout,
+        status.branch,
+        "an earlier conversation on this machine already uses it"
+      );
+    }
+    return await switchTo(checkout, status.branch, `checkout-${spec.runId}`, deps, signal);
+  } catch (error61) {
+    return noted(
+      checkout,
+      `could not be put on ${checkout.branch}, the branch picked for this chat`,
+      firstLine3(error61 instanceof Error ? error61.message : String(error61)) || "unknown error",
+      "Check it"
+    );
+  }
+}
+
+// src/holder/checkout-refresh.ts
+function short(sha) {
+  return sha.slice(0, 12);
+}
+function staleLine(path4, snapshot2, tip) {
+  const checkout = snapshot2 === void 0 ? "is the environment snapshot's checkout" : `is the environment snapshot's checkout of ${snapshot2.branch} (commit ${short(snapshot2.head)})`;
+  const base = snapshot2 === void 0 ? "its upstream" : `origin/${snapshot2.base}`;
+  const remote = tip === void 0 ? "may be ahead" : `is ahead at ${short(tip)}`;
+  return `Note: ${path4} ${checkout}; ${base} ${remote}. Run \`git pull --ff-only\` there before relying on its files.`;
+}
 async function fastForward(freshness, operationId, deps, signal) {
   var _stack = [];
   try {
@@ -67665,10 +68105,7 @@ async function fastForward(freshness, operationId, deps, signal) {
   }
 }
 async function atFirstLease(freshness, spec, deps, signal) {
-  const first = await claimOnce(
-    (0, import_node_path57.join)(deps.dir, "leased"),
-    (0, import_node_crypto28.createHash)("sha256").update(freshness.path).digest("hex")
-  );
+  const first = await claimFirstLease(deps.dir, freshness.path);
   switch (freshness.state) {
     case "current":
     case "kept":
@@ -67694,32 +68131,73 @@ async function checkoutsOf(spec, leaseTargets) {
   if (leaseTargets.length > 0 || spec.projectPath === void 0) return [...leaseTargets];
   return checkoutsUnder(spec.projectPath);
 }
-function createCheckoutRefresh(deps) {
-  return async (spec, leaseTargets, signal) => {
-    if (spec.providerSessionId !== void 0) return void 0;
-    if (!await claimOnce((0, import_node_path57.join)(deps.dir, "conversations"), spec.conversationId)) return void 0;
-    const lines2 = [];
-    for (const target of await checkoutsOf(spec, leaseTargets)) {
-      const freshness = await readCheckoutFreshness(deps.dir, target);
-      if (freshness === null) continue;
-      const outcome2 = await atFirstLease(freshness, spec, deps, signal).catch(
-        () => "noted"
-      );
-      if (outcome2 === "noted") lines2.push(lineFor(freshness));
-      deps.log.info("workspace.refresh", {
+function requestedCheckoutsOf(spec, log) {
+  const roots = spec.approvedWorkspacePaths ?? [];
+  return (spec.requestedCheckouts ?? []).filter((checkout) => {
+    const approved = roots.some((root) => isWithin(root, checkout.path, process.platform));
+    if (!approved) {
+      log.warn("workspace.requested_checkout_outside_workspace", {
         runId: spec.runId,
-        path: freshness.path,
-        state: freshness.state,
-        outcome: outcome2
+        path: checkout.path
       });
     }
+    return approved;
+  });
+}
+async function applyRequestedCheckouts(spec, deps, signal) {
+  const settled2 = /* @__PURE__ */ new Set();
+  const lines2 = [];
+  for (const checkout of requestedCheckoutsOf(spec, deps.log)) {
+    const outcome2 = await applyRequestedCheckout(checkout, spec, deps, signal);
+    deps.log.info("workspace.requested_checkout", {
+      runId: spec.runId,
+      path: checkout.path,
+      branch: checkout.branch,
+      outcome: outcome2.kind,
+      ...outcome2.kind === "moved" ? { how: outcome2.how } : {}
+    });
+    if (outcome2.kind === "on_branch") continue;
+    settled2.add((0, import_node_path59.resolve)(checkout.path));
+    if (outcome2.kind === "noted") lines2.push(outcome2.line);
+  }
+  return { settled: settled2, lines: lines2 };
+}
+async function refreshSnapshotCheckouts(spec, targets, settled2, deps, signal) {
+  const lines2 = [];
+  for (const target of targets) {
+    if (settled2.has((0, import_node_path59.resolve)(target))) continue;
+    const freshness = await readCheckoutFreshness(deps.dir, target);
+    if (freshness === null) continue;
+    const outcome2 = await atFirstLease(freshness, spec, deps, signal).catch(
+      () => "noted"
+    );
+    if (outcome2 === "noted") lines2.push(lineFor(freshness));
+    deps.log.info("workspace.refresh", {
+      runId: spec.runId,
+      path: freshness.path,
+      state: freshness.state,
+      outcome: outcome2
+    });
+  }
+  return lines2;
+}
+function createCheckoutRefresh(deps) {
+  return async (spec, leaseTargets, signal) => {
+    if (spec.providerSessionId !== void 0) return void 0;
+    if (!await claimOnce((0, import_node_path59.join)(deps.dir, "conversations"), spec.conversationId)) return void 0;
+    const requested = await applyRequestedCheckouts(spec, deps, signal);
+    const targets = await checkoutsOf(spec, leaseTargets);
+    const lines2 = [
+      ...requested.lines,
+      ...await refreshSnapshotCheckouts(spec, targets, requested.settled, deps, signal)
+    ];
     return lines2.length === 0 ? void 0 : lines2.join("\n");
   };
 }
 
 // src/holder/lease.ts
-var import_promises59 = require("fs/promises");
-var import_node_path58 = require("path");
+var import_promises60 = require("fs/promises");
+var import_node_path60 = require("path");
 var LEASE_CHECK_EVERY_MS = 5e3;
 var MAX_TRANSIENT_FAILURES = 3;
 var BACKOFF_BASE_MS = 1e3;
@@ -67733,8 +68211,8 @@ function identityFailure(code, workspacePath) {
   return { code, problemCode: "app.workspace.missing", message: MESSAGES[code], workspacePath };
 }
 async function fileIdentity(path4) {
-  const canonical = await (0, import_promises59.realpath)(path4);
-  const info = await (0, import_promises59.stat)(canonical, { bigint: true });
+  const canonical = await (0, import_promises60.realpath)(path4);
+  const info = await (0, import_promises60.stat)(canonical, { bigint: true });
   return `${canonical}:${info.dev}:${info.ino}`;
 }
 async function snapshot(git, path4, signal) {
@@ -67753,7 +68231,7 @@ async function snapshot(git, path4, signal) {
       workspace: await fileIdentity(path4),
       repository: await fileIdentity(commonDir),
       worktree: await fileIdentity(gitDir),
-      commonDir: await (0, import_promises59.realpath)(commonDir)
+      commonDir: await (0, import_promises60.realpath)(commonDir)
     };
   } catch {
     return null;
@@ -67766,7 +68244,7 @@ async function gitValue(git, path4, args, signal) {
 }
 async function pathExists(path4) {
   try {
-    await (0, import_promises59.stat)(path4);
+    await (0, import_promises60.stat)(path4);
     return true;
   } catch (error61) {
     return errnoCode(error61) !== "ENOENT" && errnoCode(error61) !== "ENOTDIR";
@@ -67775,19 +68253,19 @@ async function pathExists(path4) {
 async function hasGitMarker(path4) {
   let directory;
   try {
-    directory = await (0, import_promises59.realpath)(path4);
+    directory = await (0, import_promises60.realpath)(path4);
   } catch {
     return true;
   }
   for (; ; ) {
     try {
-      await (0, import_promises59.stat)((0, import_node_path58.join)(directory, ".git"));
+      await (0, import_promises60.stat)((0, import_node_path60.join)(directory, ".git"));
       return true;
     } catch (error61) {
       const code = errnoCode(error61);
       if (code !== "ENOENT" && code !== "ENOTDIR") return true;
     }
-    const parent = (0, import_node_path58.dirname)(directory);
+    const parent = (0, import_node_path60.dirname)(directory);
     if (parent === directory) return false;
     directory = parent;
   }
@@ -67951,7 +68429,7 @@ function volumeRoot(path4) {
 }
 async function exists4(path4) {
   try {
-    await (0, import_promises60.stat)(path4);
+    await (0, import_promises61.stat)(path4);
     return true;
   } catch {
     return false;
@@ -67959,10 +68437,10 @@ async function exists4(path4) {
 }
 async function inspectReadiness(path4) {
   try {
-    if (!(await (0, import_promises60.stat)(path4)).isDirectory()) {
+    if (!(await (0, import_promises61.stat)(path4)).isDirectory()) {
       return { ready: false, missing: true, message: MESSAGES2.missing };
     }
-    await (0, import_promises60.access)(path4, import_node_fs19.constants.R_OK | import_node_fs19.constants.W_OK | import_node_fs19.constants.X_OK);
+    await (0, import_promises61.access)(path4, import_node_fs19.constants.R_OK | import_node_fs19.constants.W_OK | import_node_fs19.constants.X_OK);
     return { ready: true };
   } catch (error61) {
     const code = errnoCode(error61) ?? "";
@@ -68040,8 +68518,8 @@ async function admitDefaultWorkspace(spec, context, skills) {
   const { env } = context;
   const path4 = resolveAlanDefaultWorkspacePath(env.HOME || env.USERPROFILE || (0, import_node_os9.homedir)());
   try {
-    await (0, import_promises60.mkdir)(path4, { recursive: true, mode: 448 });
-    await (0, import_promises60.access)(path4, import_node_fs19.constants.R_OK | import_node_fs19.constants.W_OK | import_node_fs19.constants.X_OK);
+    await (0, import_promises61.mkdir)(path4, { recursive: true, mode: 448 });
+    await (0, import_promises61.access)(path4, import_node_fs19.constants.R_OK | import_node_fs19.constants.W_OK | import_node_fs19.constants.X_OK);
     return {
       kind: "admitted",
       spec: { ...spec, projectPath: path4 },
@@ -68114,10 +68592,12 @@ async function admitRun(spec, context, signal) {
   };
 }
 var PROBE_TIMEOUT_MS2 = 5e3;
+var CHECKOUT_LOCAL_TIMEOUT_MS = 6e4;
+var CHECKOUT_NETWORK_TIMEOUT_MS = 12e4;
 function createHolderWorkspace(machine, clock, log) {
   const platform3 = machine.platform ?? process.platform;
   const git = createGitRunner({ env: machine.env, platform: platform3, localTimeoutMs: PROBE_TIMEOUT_MS2 });
-  const locks = openRepositoryLocks({ dir: (0, import_node_path59.join)(machine.stateDir, "locks"), clock, platform: platform3 });
+  const locks = openRepositoryLocks({ dir: (0, import_node_path61.join)(machine.stateDir, "locks"), clock, platform: platform3 });
   return {
     admission: {
       env: machine.env,
@@ -68129,7 +68609,7 @@ function createHolderWorkspace(machine, clock, log) {
       ),
       approvedRoots: async () => {
         const approved = await openApprovedPaths({
-          file: (0, import_node_path59.join)(machine.stateDir, "workspaces.json"),
+          file: (0, import_node_path61.join)(machine.stateDir, "workspaces.json"),
           log,
           platform: platform3
         });
@@ -68139,10 +68619,15 @@ function createHolderWorkspace(machine, clock, log) {
     lease: { git, locks, clock, log, platform: platform3 },
     ...machine.refreshesFirstCheckout === true ? {
       refreshFirstCheckout: createCheckoutRefresh({
-        git,
+        git: createGitRunner({
+          env: machine.env,
+          platform: platform3,
+          localTimeoutMs: CHECKOUT_LOCAL_TIMEOUT_MS,
+          networkTimeoutMs: CHECKOUT_NETWORK_TIMEOUT_MS
+        }),
         locks,
         log,
-        dir: (0, import_node_path59.join)(machine.stateDir, "checkout-freshness")
+        dir: (0, import_node_path61.join)(machine.stateDir, "checkout-freshness")
       })
     } : {}
   };
@@ -68170,7 +68655,7 @@ async function respondToTurn(runningRunId, gate, driver, request2) {
 }
 
 // src/holder/session-facts.ts
-var import_promises61 = require("fs/promises");
+var import_promises62 = require("fs/promises");
 var CLI_RSS_CACHE_MS = 1e4;
 var LOGIN_PROBLEM_PREFIX = "cli.auth.";
 function isLoginFailure(result) {
@@ -68196,8 +68681,8 @@ function createSessionFacts(options) {
     const path4 = await resolveCommandOnPath(command, env, platform3);
     if (path4 === null) return null;
     try {
-      const real = await (0, import_promises61.realpath)(path4);
-      const info = await (0, import_promises61.stat)(real);
+      const real = await (0, import_promises62.realpath)(path4);
+      const info = await (0, import_promises62.stat)(real);
       return { command, key: `${real}:${info.ino}:${info.size}:${info.mtimeMs}` };
     } catch {
       return null;
@@ -68284,12 +68769,12 @@ function createSessionFacts(options) {
 init_acp2();
 
 // src/run-log/archive.ts
-var import_promises62 = require("fs/promises");
-var import_node_path60 = require("path");
+var import_promises63 = require("fs/promises");
+var import_node_path62 = require("path");
 init_runtime_v2();
 async function openRunArchive(runsDir) {
-  const path4 = (0, import_node_path60.join)((0, import_node_path60.dirname)(runsDir), "archived-runs.txt");
-  const text3 = await (0, import_promises62.readFile)(path4, "utf8").catch((error61) => {
+  const path4 = (0, import_node_path62.join)((0, import_node_path62.dirname)(runsDir), "archived-runs.txt");
+  const text3 = await (0, import_promises63.readFile)(path4, "utf8").catch((error61) => {
     if (errnoCode(error61) === "ENOENT") return "";
     throw error61;
   });
@@ -68303,7 +68788,7 @@ async function openRunArchive(runsDir) {
     add: async (runIds) => {
       const added = runIds.filter((runId) => !archived.has(runId));
       if (added.length === 0) return;
-      await (0, import_promises62.appendFile)(path4, `
+      await (0, import_promises63.appendFile)(path4, `
 ${added.join("\n")}
 `, { mode: 384 });
       for (const runId of added) archived.add(runId);
@@ -68314,11 +68799,11 @@ ${added.join("\n")}
 // src/run-log/complete.ts
 var import_node_crypto29 = require("crypto");
 var import_node_fs20 = require("fs");
-var import_node_path62 = require("path");
+var import_node_path64 = require("path");
 
 // src/run-log/directory.ts
-var import_promises63 = require("fs/promises");
-var import_node_path61 = require("path");
+var import_promises64 = require("fs/promises");
+var import_node_path63 = require("path");
 init_runtime_v2();
 init_zod();
 var runMetaSchema = external_exports.object({
@@ -68344,17 +68829,17 @@ async function readRunMeta(path4) {
   return read.kind === "ok" ? read.value : null;
 }
 function runDirectory(runsDir, runId) {
-  const dir = (0, import_node_path61.join)(runsDir, runId);
+  const dir = (0, import_node_path63.join)(runsDir, runId);
   return {
     dir,
-    log: (0, import_node_path61.join)(dir, "log.jsonl"),
-    upload: (0, import_node_path61.join)(dir, "upload.json"),
-    meta: (0, import_node_path61.join)(dir, "run.json")
+    log: (0, import_node_path63.join)(dir, "log.jsonl"),
+    upload: (0, import_node_path63.join)(dir, "upload.json"),
+    meta: (0, import_node_path63.join)(dir, "run.json")
   };
 }
 async function isRunClaimed(runsDir, runId) {
   try {
-    return (await (0, import_promises63.stat)(runDirectory(runsDir, runId).log)).size > 0;
+    return (await (0, import_promises64.stat)(runDirectory(runsDir, runId).log)).size > 0;
   } catch (error61) {
     if (errnoCode(error61) === "ENOENT") return false;
     throw error61;
@@ -68363,7 +68848,7 @@ async function isRunClaimed(runsDir, runId) {
 
 // src/run-log/complete.ts
 function writeLogFile(path4, dir, text3) {
-  const temp = (0, import_node_path62.join)(dir, `.log.${(0, import_node_crypto29.randomUUID)()}.tmp`);
+  const temp = (0, import_node_path64.join)(dir, `.log.${(0, import_node_crypto29.randomUUID)()}.tmp`);
   const fd = (0, import_node_fs20.openSync)(temp, "wx", 384);
   try {
     (0, import_node_fs20.writeSync)(fd, text3);
@@ -68392,8 +68877,8 @@ async function writeCompleteRunLog(runsDir, meta3, records) {
 }
 
 // src/run-log/conversation-index.ts
-var import_promises64 = require("fs/promises");
-var import_node_path63 = require("path");
+var import_promises65 = require("fs/promises");
+var import_node_path65 = require("path");
 init_runtime_v2();
 init_zod();
 var ORDINALS_PER_SHARD = 1e3;
@@ -68410,13 +68895,13 @@ var coverageSchema = external_exports.object({
   nextExpectedOrdinal: external_exports.number().int().positive()
 });
 function conversationsDirectory(runsDir) {
-  return (0, import_node_path63.join)((0, import_node_path63.dirname)(runsDir), "conversations");
+  return (0, import_node_path65.join)((0, import_node_path65.dirname)(runsDir), "conversations");
 }
 function indexDirectory(runsDir, conversationId) {
-  return (0, import_node_path63.join)(conversationsDirectory(runsDir), conversationId, "turn-index");
+  return (0, import_node_path65.join)(conversationsDirectory(runsDir), conversationId, "turn-index");
 }
 function shardPath(runsDir, conversationId, ordinal) {
-  return (0, import_node_path63.join)(
+  return (0, import_node_path65.join)(
     indexDirectory(runsDir, conversationId),
     `${Math.floor(ordinal / ORDINALS_PER_SHARD)}.jsonl`
   );
@@ -68425,10 +68910,10 @@ async function indexConversationRun(runsDir, conversationId, ordinal, assistantO
   const nextOrdinal = assistantOrdinal + 1;
   if (nextOrdinal <= ordinal) throw new Error("Assistant order must follow the prompt");
   const path4 = shardPath(runsDir, conversationId, ordinal);
-  await (0, import_promises64.mkdir)((0, import_node_path63.dirname)(path4), { recursive: true, mode: 448 });
-  await (0, import_promises64.appendFile)(path4, `${JSON.stringify({ ordinal, nextOrdinal, runId })}
+  await (0, import_promises65.mkdir)((0, import_node_path65.dirname)(path4), { recursive: true, mode: 448 });
+  await (0, import_promises65.appendFile)(path4, `${JSON.stringify({ ordinal, nextOrdinal, runId })}
 `, { mode: 384 });
-  const coveragePath = (0, import_node_path63.join)((0, import_node_path63.dirname)((0, import_node_path63.dirname)(path4)), "coverage.json");
+  const coveragePath = (0, import_node_path65.join)((0, import_node_path65.dirname)((0, import_node_path65.dirname)(path4)), "coverage.json");
   const coverage = await readJsonFile(coveragePath, coverageSchema);
   const current = coverage.kind === "ok" ? coverage.value : null;
   const next = nextCoverage(current, ordinal, nextOrdinal);
@@ -68443,13 +68928,13 @@ function nextCoverage(current, ordinal, nextOrdinal) {
   return null;
 }
 async function readConversationIndexCoverage(runsDir, conversationId) {
-  const path4 = (0, import_node_path63.join)((0, import_node_path63.dirname)(indexDirectory(runsDir, conversationId)), "coverage.json");
+  const path4 = (0, import_node_path65.join)((0, import_node_path65.dirname)(indexDirectory(runsDir, conversationId)), "coverage.json");
   const result = await readJsonFile(path4, coverageSchema);
   return result.kind === "ok" ? result.value : null;
 }
 async function readConversationRunIndex(runsDir, conversationId, before, limit) {
   const directory = indexDirectory(runsDir, conversationId);
-  const names = await (0, import_promises64.readdir)(directory).catch((error61) => {
+  const names = await (0, import_promises65.readdir)(directory).catch((error61) => {
     if (error61.code === "ENOENT") return [];
     throw error61;
   });
@@ -68458,7 +68943,7 @@ async function readConversationRunIndex(runsDir, conversationId, before, limit)
   ).sort((left, right) => right - left);
   const selected = [];
   for (const shard of shards) {
-    const text3 = await (0, import_promises64.readFile)((0, import_node_path63.join)(directory, `${shard}.jsonl`), "utf8");
+    const text3 = await (0, import_promises65.readFile)((0, import_node_path65.join)(directory, `${shard}.jsonl`), "utf8");
     const records = text3.split("\n").flatMap((line) => {
       if (!line) return [];
       const parsed = indexRecordSchema.parse(JSON.parse(line));
@@ -68483,7 +68968,7 @@ async function readIndexableRun(runsDir, name) {
   return { conversationId: meta3.conversationId, ordinal, assistantOrdinal, runId: runId.data };
 }
 async function readIndexableRuns(runsDir) {
-  const names = await (0, import_promises64.readdir)(runsDir).catch(() => []);
+  const names = await (0, import_promises65.readdir)(runsDir).catch(() => []);
   const byConversation = /* @__PURE__ */ new Map();
   let next = 0;
   const worker = async () => {
@@ -68513,21 +68998,21 @@ async function writeConversationIndex(directory, runs) {
     else lines2.push(line);
     coverage = nextCoverage(coverage, run2.ordinal, nextOrdinal) ?? coverage;
   }
-  await (0, import_promises64.mkdir)((0, import_node_path63.join)(directory, "turn-index"), { recursive: true, mode: 448 });
+  await (0, import_promises65.mkdir)((0, import_node_path65.join)(directory, "turn-index"), { recursive: true, mode: 448 });
   for (const [shard, lines2] of shards) {
-    await (0, import_promises64.writeFile)((0, import_node_path63.join)(directory, "turn-index", `${shard}.jsonl`), `${lines2.join("\n")}
+    await (0, import_promises65.writeFile)((0, import_node_path65.join)(directory, "turn-index", `${shard}.jsonl`), `${lines2.join("\n")}
 `, {
       mode: 384
     });
   }
-  await (0, import_promises64.writeFile)((0, import_node_path63.join)(directory, "coverage.json"), `${JSON.stringify(coverage)}
+  await (0, import_promises65.writeFile)((0, import_node_path65.join)(directory, "coverage.json"), `${JSON.stringify(coverage)}
 `, {
     mode: 384
   });
 }
 async function rebuildConversationIndexes(runsDir) {
   const root = conversationsDirectory(runsDir);
-  const exists6 = await (0, import_promises64.stat)(root).then(
+  const exists6 = await (0, import_promises65.stat)(root).then(
     () => true,
     (error61) => {
       if (errnoCode(error61) === "ENOENT") return false;
@@ -68536,18 +69021,18 @@ async function rebuildConversationIndexes(runsDir) {
   );
   if (exists6) return 0;
   const building = `${root}.rebuilding`;
-  await (0, import_promises64.rm)(building, { recursive: true, force: true });
-  await (0, import_promises64.mkdir)(building, { recursive: true, mode: 448 });
+  await (0, import_promises65.rm)(building, { recursive: true, force: true });
+  await (0, import_promises65.mkdir)(building, { recursive: true, mode: 448 });
   const byConversation = await readIndexableRuns(runsDir);
   for (const [conversationId, runs] of byConversation) {
-    await writeConversationIndex((0, import_node_path63.join)(building, conversationId), runs);
+    await writeConversationIndex((0, import_node_path65.join)(building, conversationId), runs);
   }
-  await (0, import_promises64.rename)(building, root);
+  await (0, import_promises65.rename)(building, root);
   return byConversation.size;
 }
 
 // src/run-log/reader.ts
-var import_promises65 = require("fs/promises");
+var import_promises66 = require("fs/promises");
 init_runtime_v2();
 
 // src/run-log/tail.ts
@@ -68570,7 +69055,7 @@ function firstRecordLength(bytes) {
   return bytes.indexOf(RUN_LOG_RECORD_SEPARATOR) + 1;
 }
 async function openRunLogReader(path4) {
-  const handle = await (0, import_promises65.open)(path4, "r");
+  const handle = await (0, import_promises66.open)(path4, "r");
   const readAt = async (position, length) => {
     const buffer = Buffer.alloc(length);
     const { bytesRead } = await handle.read(buffer, 0, length, position);
@@ -68604,7 +69089,7 @@ async function openRunLogReader(path4) {
   };
 }
 async function readLastRecord(path4) {
-  const handle = await (0, import_promises65.open)(path4, "r").catch(() => null);
+  const handle = await (0, import_promises66.open)(path4, "r").catch(() => null);
   if (handle === null) return null;
   try {
     const { size } = await handle.stat();
@@ -68638,7 +69123,7 @@ var decoder = new TextDecoder();
 
 // src/run-log/writer.ts
 var import_node_fs21 = require("fs");
-var import_node_path64 = require("path");
+var import_node_path66 = require("path");
 init_runtime_v2();
 function lastSeq(fd, size) {
   for (const length of tailWindows(size)) {
@@ -68654,7 +69139,7 @@ function lastSeq(fd, size) {
   throw new RuntimeFault("record_too_large", "Run log tail record is larger than any record");
 }
 function openRunLog(path4, clock) {
-  (0, import_node_fs21.mkdirSync)((0, import_node_path64.dirname)(path4), { recursive: true, mode: 448 });
+  (0, import_node_fs21.mkdirSync)((0, import_node_path66.dirname)(path4), { recursive: true, mode: 448 });
   const fd = (0, import_node_fs21.openSync)(path4, "a+", 384);
   let size = (0, import_node_fs21.fstatSync)(fd).size;
   let seq = lastSeq(fd, size);
@@ -68990,7 +69475,7 @@ async function runHolder({
   try {
     const identity = await readProcessIdentity(process.pid);
     if (identity === null) throw new RuntimeFault("internal", "Cannot read own process identity");
-    const _engines = __using(_stack, recordSpawnedEngines(engineRecordsPath((0, import_node_path65.dirname)(launch.statusPath)), clock, log));
+    const _engines = __using(_stack, recordSpawnedEngines(engineRecordsPath((0, import_node_path67.dirname)(launch.statusPath)), clock, log));
     const holder = {
       state: "idle",
       runId: null,
@@ -69186,16 +69671,16 @@ async function runHolder({
       client.on("error", () => holder.clients.delete(client));
     });
     removeStaleEndpoint(launch.endpoint);
-    await new Promise((resolve13, reject) => {
+    await new Promise((resolve14, reject) => {
       server.once("error", reject);
-      server.listen(launch.endpoint, () => resolve13());
+      server.listen(launch.endpoint, () => resolve14());
     });
     await writeStatus();
     log.info("holder.ready", { conversationId: launch.conversationId, pid: identity.pid });
-    await new Promise((resolve13) => exit.signal.addEventListener("abort", () => resolve13()));
+    await new Promise((resolve14) => exit.signal.addEventListener("abort", () => resolve14()));
     await driver.suspend?.().catch((error61) => log.warn("holder.driver_suspend_failed", { error: error61 }));
     for (const client of holder.clients) client.end();
-    await new Promise((resolve13) => server.close(() => resolve13()));
+    await new Promise((resolve14) => server.close(() => resolve14()));
     (0, import_node_fs22.rmSync)(launch.statusPath, { force: true });
     log.info("holder.suspended", { conversationId: launch.conversationId });
   } catch (_) {
@@ -69284,7 +69769,7 @@ var DEFAULT_MAX_ACTIVE_RUNS = 32;
 var HOLDER_BUSY = "busy";
 async function listIds(dir, schema) {
   const ids = [];
-  for (const name of await (0, import_promises66.readdir)(dir).catch(() => [])) {
+  for (const name of await (0, import_promises67.readdir)(dir).catch(() => [])) {
     const parsed = schema.safeParse(name);
     if (parsed.success) ids.push(parsed.data);
   }
@@ -69298,14 +69783,14 @@ function holderIdentity(status) {
   return command === void 0 ? { pid, startedAt } : { pid, startedAt, command };
 }
 function sessionFiles(paths, conversationId) {
-  const dir = (0, import_node_path66.join)(paths.sessions, conversationId);
-  return { dir, launch: (0, import_node_path66.join)(dir, "launch.json"), status: (0, import_node_path66.join)(dir, "holder.json") };
+  const dir = (0, import_node_path68.join)(paths.sessions, conversationId);
+  return { dir, launch: (0, import_node_path68.join)(dir, "launch.json"), status: (0, import_node_path68.join)(dir, "holder.json") };
 }
 async function removeHolderFiles(files) {
   for (const path4 of [files.launch, files.status, engineRecordsPath(files.dir)]) {
-    await (0, import_promises66.rm)(path4, { force: true });
+    await (0, import_promises67.rm)(path4, { force: true });
   }
-  await (0, import_promises66.rmdir)(files.dir).catch((error61) => {
+  await (0, import_promises67.rmdir)(files.dir).catch((error61) => {
     if (!["ENOENT", "ENOTEMPTY", "EEXIST"].includes(errnoCode(error61) ?? "")) throw error61;
   });
 }
@@ -69495,7 +69980,7 @@ async function openSessions(deps) {
     const meta3 = await readRunMeta(dir.meta);
     const last = await readLastRecord(dir.log);
     if (meta3 === null || last === null) return null;
-    const logged = await (0, import_promises66.stat)(dir.log).catch((error61) => {
+    const logged = await (0, import_promises67.stat)(dir.log).catch((error61) => {
       if (errnoCode(error61) === "ENOENT") return null;
       throw error61;
     });
@@ -69807,7 +70292,7 @@ function loadRuntimeConfig(env = process.env, totalMemoryBytes = (0, import_node
     providerProbes: ALAN_RUNTIME_PROVIDER_PROBES === "on",
     providerToolchain: ALAN_RUNTIME_PROVIDER_NODE !== void 0 && ALAN_RUNTIME_PROVIDER_NPM_CLI !== void 0 ? { node: ALAN_RUNTIME_PROVIDER_NODE, npmCli: ALAN_RUNTIME_PROVIDER_NPM_CLI } : null,
     home,
-    configHome: XDG_CONFIG_HOME ?? (0, import_node_path67.join)(home, ".config"),
+    configHome: XDG_CONFIG_HOME ?? (0, import_node_path69.join)(home, ".config"),
     codexHome: resolveCodexHome(CODEX_HOME, home),
     ...githubProxyConfig({ ALAN_RUNTIME_GITHUB_PROXY, XDG_CONFIG_HOME, GH_CONFIG_DIR }, home),
     gitGatewayUrl: ALAN_RUNTIME_GIT_GATEWAY_URL ?? null,
@@ -69817,13 +70302,13 @@ function loadRuntimeConfig(env = process.env, totalMemoryBytes = (0, import_node
   };
 }
 function resolveCodexHome(configuredHome, home) {
-  return configuredHome ?? (0, import_node_path67.join)(home, ".codex");
+  return configuredHome ?? (0, import_node_path69.join)(home, ".codex");
 }
 function githubProxyConfig(env, home) {
-  const configHome = env.XDG_CONFIG_HOME ?? (0, import_node_path67.join)(home, ".config");
+  const configHome = env.XDG_CONFIG_HOME ?? (0, import_node_path69.join)(home, ".config");
   return {
     githubProxy: env.ALAN_RUNTIME_GITHUB_PROXY === "on",
-    ghConfigDir: env.GH_CONFIG_DIR ?? (0, import_node_path67.join)(configHome, "gh")
+    ghConfigDir: env.GH_CONFIG_DIR ?? (0, import_node_path69.join)(configHome, "gh")
   };
 }
 function serviceEnvironment2(env, profile) {
@@ -69881,9 +70366,9 @@ function takeEnrollmentCodeFromEnv(env = process.env) {
 }
 
 // src/cli/context.ts
-var import_promises67 = require("fs/promises");
+var import_promises68 = require("fs/promises");
 var import_node_os12 = require("os");
-var import_node_path68 = require("path");
+var import_node_path70 = require("path");
 var DESKTOP_BUNDLE_IDS = {
   production: ["com.alan-ai.desktop"],
   staging: ["com.alan-ai.desktop.staging"],
@@ -69923,7 +70408,7 @@ function serviceSpec({ config: config2, paths, self }) {
     profile: config2.profile,
     program: serviceCommand(config2.host, self, launcher),
     environment: config2.serviceEnvironment,
-    logPath: (0, import_node_path68.join)(paths.logs, "service.log"),
+    logPath: (0, import_node_path70.join)(paths.logs, "service.log"),
     associatedBundleIds: DESKTOP_BUNDLE_IDS[config2.profile]
   };
 }
@@ -69931,7 +70416,7 @@ async function installedServiceSpec(ctx) {
   const spec = serviceSpec(ctx);
   if (ctx.config.host === "app") return spec;
   const layout = installLayout(ctx.config.installDir, ctx.config.profile);
-  const installed = await (0, import_promises67.access)(layout.launcher).then(
+  const installed = await (0, import_promises68.access)(layout.launcher).then(
     () => true,
     () => false
   );
@@ -70059,7 +70544,7 @@ var manifestRevisionSchema = external_exports.object({ revision: external_export
 async function manifestRevision(path4) {
   let raw;
   try {
-    raw = JSON.parse(await (0, import_promises68.readFile)(path4, "utf8"));
+    raw = JSON.parse(await (0, import_promises69.readFile)(path4, "utf8"));
   } catch (error61) {
     throw new RuntimeFault("invalid_file", `Cannot read the skill manifest at ${path4}`, {
       cause: error61
@@ -70113,8 +70598,8 @@ async function runSkills(argv) {
 }
 
 // src/cli/commands/doctor.ts
-var import_promises71 = require("fs/promises");
-var import_node_path72 = require("path");
+var import_promises72 = require("fs/promises");
+var import_node_path74 = require("path");
 init_runtime_v2();
 
 // src/identity/credential.ts
@@ -70291,18 +70776,18 @@ async function authorizeDevice(input2) {
 }
 
 // src/identity/enroll.ts
-var import_promises69 = require("fs/promises");
+var import_promises70 = require("fs/promises");
 init_runtime_v2();
 
 // src/identity/installation.ts
 var import_node_crypto33 = require("crypto");
-var import_node_path69 = require("path");
+var import_node_path71 = require("path");
 init_zod();
 var installationFileSchema = external_exports.object({
   installationId: external_exports.uuid()
 });
 function installationPath(paths) {
-  return (0, import_node_path69.join)(paths.stateDir, "installation.json");
+  return (0, import_node_path71.join)(paths.stateDir, "installation.json");
 }
 async function ensureInstallationId(paths) {
   const path4 = installationPath(paths);
@@ -70395,13 +70880,13 @@ async function enrollFromGrantFile(input2) {
     clock: input2.clock,
     access: input2.access
   });
-  await (0, import_promises69.rm)(input2.grantPath, { force: true });
+  await (0, import_promises70.rm)(input2.grantPath, { force: true });
   return machine;
 }
 
 // src/identity/migrate-v1.ts
-var import_promises70 = require("fs/promises");
-var import_node_path70 = require("path");
+var import_promises71 = require("fs/promises");
+var import_node_path72 = require("path");
 init_runtime_v2();
 init_zod();
 var EXIT_POLL_MS = 200;
@@ -70422,11 +70907,11 @@ var ownerLeaseSchema = external_exports.looseObject({ pid: external_exports.numb
 function legacyConfigPath(home, profile) {
   switch (profile) {
     case "production":
-      return (0, import_node_path70.join)(home, ".alan", "agent", "config.json");
+      return (0, import_node_path72.join)(home, ".alan", "agent", "config.json");
     case "staging":
-      return (0, import_node_path70.join)(home, ".alan-staging", "agent", "config.json");
+      return (0, import_node_path72.join)(home, ".alan-staging", "agent", "config.json");
     default:
-      return (0, import_node_path70.join)(home, ".alan-dev", "agent", "config.json");
+      return (0, import_node_path72.join)(home, ".alan-dev", "agent", "config.json");
   }
 }
 async function findLegacyInstall(home, profile) {
@@ -70451,8 +70936,8 @@ async function scrubLegacyInstall(install2) {
   const scrubbed = { ...install2.config, migratedToRuntimeV2: true };
   for (const key of SCRUBBED_KEYS) delete scrubbed[key];
   await writeJsonFileAtomic(`${install2.configPath}.migrated-v1`, scrubbed);
-  await (0, import_promises70.rm)(install2.configPath, { force: true });
-  await (0, import_promises70.rm)(install2.ownerLeasePath, { force: true });
+  await (0, import_promises71.rm)(install2.configPath, { force: true });
+  await (0, import_promises71.rm)(install2.ownerLeasePath, { force: true });
 }
 async function exchangeCredential(deps) {
   const { config: config2 } = deps.install;
@@ -70561,7 +71046,7 @@ async function loadIdentity(paths, options = {}) {
 }
 
 // src/cli/commands/status.ts
-var import_node_path71 = require("path");
+var import_node_path73 = require("path");
 async function serviceStatus(ctx) {
   try {
     return await createServiceManager(ctx.host, ctx.config.profile).status();
@@ -70588,7 +71073,7 @@ async function runtimeState(ctx) {
   const running = await readRunningRuntime(ctx.paths.lock);
   if (running === null) return { state: "offline", pid: null, localApi: null };
   const discovery = await readJsonFile(
-    (0, import_node_path71.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE),
+    (0, import_node_path73.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE),
     localApiDiscoverySchema
   );
   const localApi = discovery.kind === "ok" && discovery.value.pid === running.pid ? {
@@ -70809,7 +71294,7 @@ async function runtimeCheck(ctx, status) {
     return check2("runtime", "warn", "No runtime is running for this profile");
   }
   const client = createRuntimeClient({
-    discoveryPath: (0, import_node_path72.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE)
+    discoveryPath: (0, import_node_path74.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE)
   });
   try {
     const live = await client.status(AbortSignal.timeout(LOCAL_TIMEOUT_MS));
@@ -70836,7 +71321,7 @@ async function runtimeCheck(ctx, status) {
   }
 }
 async function probeHolder(dir, conversationId) {
-  const launch = await readJsonFile((0, import_node_path72.join)(dir, "launch.json"), holderLaunchSchema);
+  const launch = await readJsonFile((0, import_node_path74.join)(dir, "launch.json"), holderLaunchSchema);
   if (launch.kind !== "ok") return null;
   try {
     const reply2 = await withTimeout(
@@ -70861,8 +71346,8 @@ async function probeHolder(dir, conversationId) {
   }
 }
 async function holdersCheck(ctx) {
-  const names = await (0, import_promises71.readdir)(ctx.paths.sessions).catch(() => []);
-  const holders = (await Promise.all(names.map((name) => probeHolder((0, import_node_path72.join)(ctx.paths.sessions, name), name)))).filter((facts) => facts !== null);
+  const names = await (0, import_promises72.readdir)(ctx.paths.sessions).catch(() => []);
+  const holders = (await Promise.all(names.map((name) => probeHolder((0, import_node_path74.join)(ctx.paths.sessions, name), name)))).filter((facts) => facts !== null);
   const dead = holders.filter((holder) => !holder.alive).length;
   return check2(
     "holders",
@@ -70873,10 +71358,10 @@ async function holdersCheck(ctx) {
 }
 async function freeBytesAt(path4) {
   try {
-    const stats = await (0, import_promises71.statfs)(path4);
+    const stats = await (0, import_promises72.statfs)(path4);
     return { path: path4, freeBytes: stats.bavail * stats.bsize };
   } catch (error61) {
-    const parent = (0, import_node_path72.dirname)(path4);
+    const parent = (0, import_node_path74.dirname)(path4);
     if (parent === path4) throw error61;
     return freeBytesAt(parent);
   }
@@ -70894,9 +71379,9 @@ async function diskCheck(ctx) {
   }
 }
 var resolveFromLoginShell = (own2) => resolveCliEnvironment({ env: own2, platform: process.platform });
-async function cliDiscoveryCheck(resolve13) {
+async function cliDiscoveryCheck(resolve14) {
   const own2 = readCliEnvironment();
-  const env = await resolve13(own2);
+  const env = await resolve14(own2);
   const delimiter = process.platform === "win32" ? ";" : ":";
   const ownDirs = new Set((own2.PATH ?? "").split(delimiter));
   const added = (env.PATH ?? "").split(delimiter).filter((dir) => dir.length > 0 && !ownDirs.has(dir));
@@ -71012,7 +71497,7 @@ async function runDoctor(argv, context = cliContext) {
 }
 
 // src/cli/commands/git-credential.ts
-var import_promises72 = require("fs/promises");
+var import_promises73 = require("fs/promises");
 var import_node_net4 = require("net");
 var MAX_RESPONSE_BYTES = 64 * 1024;
 async function readAll(stream) {
@@ -71030,7 +71515,7 @@ function processIo() {
   };
 }
 function askGitCredentialSocket(endpoint, request2, signal) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const socket = (0, import_node_net4.createConnection)(endpoint);
     let buffered = "";
     const fail = (error61) => {
@@ -71057,7 +71542,7 @@ function askGitCredentialSocket(endpoint, request2, signal) {
       signal.removeEventListener("abort", onAbort);
       try {
         const line = buffered.split("\n", 1)[0] ?? "";
-        resolve13(gitCredentialSocketResponseSchema.parse(JSON.parse(line)));
+        resolve14(gitCredentialSocketResponseSchema.parse(JSON.parse(line)));
       } catch (error61) {
         reject(
           new RuntimeFault("io_failed", "the Alan runtime sent an invalid reply", { cause: error61 })
@@ -71122,7 +71607,7 @@ async function configure(argv) {
 }
 async function configureGitGateway(config2, gatewayUrl, signal) {
   const { launcher } = installLayout(config2.installDir, config2.profile);
-  const installed = await (0, import_promises72.access)(launcher).then(
+  const installed = await (0, import_promises73.access)(launcher).then(
     () => true,
     () => false
   );
@@ -71149,7 +71634,7 @@ async function runGitCredential(argv) {
 }
 
 // src/cli/commands/hold.ts
-var import_node_path73 = require("path");
+var import_node_path75 = require("path");
 init_agent2();
 init_runtime_v2();
 async function machineAccess(paths, log, conversationId, transport) {
@@ -71207,7 +71692,7 @@ async function runHold(argv) {
     const config2 = loadRuntimeConfig();
     const paths = runtimePaths(config2.stateDir);
     const log = __using(_stack, openFileLog(
-      (0, import_node_path73.join)(paths.logs, `holder-${launch.value.conversationId}.jsonl`),
+      (0, import_node_path75.join)(paths.logs, `holder-${launch.value.conversationId}.jsonl`),
       config2.logLevel,
       systemClock
     ));
@@ -71218,7 +71703,7 @@ async function runHold(argv) {
     );
     const transport = __using(_stack, createHttpTransport());
     const access7 = await machineAccess(paths, log, launch.value.conversationId, transport);
-    const credentialPath = (0, import_node_path73.join)(paths.tmp, "mcp", `${launch.value.conversationId}.json`);
+    const credentialPath = (0, import_node_path75.join)(paths.tmp, "mcp", `${launch.value.conversationId}.json`);
     const managedMcp = __using(_stack, access7.managedMcp === void 0 ? void 0 : createHelperMcpAccess({
       managedMcp: access7.managedMcp,
       conversationId: launch.value.conversationId,
@@ -71259,7 +71744,7 @@ async function runHold(argv) {
 }
 
 // src/cli/commands/hook.ts
-var import_node_path74 = require("path");
+var import_node_path76 = require("path");
 var RUNTIME_ANSWER_MS = 2e3;
 var DEBUG_VARIABLE = "ALAN_HOOK_DEBUG";
 function flag(argv, name) {
@@ -71291,7 +71776,7 @@ async function forwardHook(argv, io) {
     return "transcript outside provider root";
   }
   const verdict = await io.send(
-    (0, import_node_path74.join)(io.stateDir, LOCAL_API_DISCOVERY_FILE),
+    (0, import_node_path76.join)(io.stateDir, LOCAL_API_DISCOVERY_FILE),
     hookSignal,
     AbortSignal.timeout(RUNTIME_ANSWER_MS)
   );
@@ -71327,7 +71812,7 @@ async function runHook(argv, overrides = {}) {
 }
 
 // src/cli/commands/ingestion-hooks.ts
-var import_promises73 = require("fs/promises");
+var import_promises74 = require("fs/promises");
 var CODEX_TRUST_NOTE = "Codex runs new hooks only after you review them: open /hooks in Codex.";
 function isAction(value2) {
   return value2 === "enable" || value2 === "disable" || value2 === "status";
@@ -71350,7 +71835,7 @@ function errorMessage2(error61) {
   return error61 instanceof Error ? error61.message : String(error61);
 }
 async function exists5(path4) {
-  return (0, import_promises73.access)(path4).then(
+  return (0, import_promises74.access)(path4).then(
     () => true,
     () => false
   );
@@ -71453,10 +71938,10 @@ async function runIntegrationsCommand(argv) {
 }
 
 // src/cli/commands/legacy.ts
-var import_node_path76 = require("path");
+var import_node_path78 = require("path");
 
 // src/cli/commands/setup.ts
-var import_node_path75 = require("path");
+var import_node_path77 = require("path");
 init_zod();
 
 // src/cli/legacy.ts
@@ -71538,7 +72023,7 @@ async function grantFileCredential(argv, grantPath, ctx, deps) {
   return enrollFromGrantFile({
     paths: ctx.paths,
     storeKind: credentialStoreFlag(argv) ?? ctx.config.credentialStore,
-    grantPath: (0, import_node_path75.resolve)(grantPath),
+    grantPath: (0, import_node_path77.resolve)(grantPath),
     clock: deps.clock,
     access: ctx.access
   });
@@ -71614,7 +72099,7 @@ async function runSetup(argv, signal) {
   var _stack = [];
   try {
     const ctx = cliContext();
-    const log = __using(_stack, openFileLog((0, import_node_path75.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
+    const log = __using(_stack, openFileLog((0, import_node_path77.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
     const result = await setupMachine(argv, ctx, {
       enrollment: (apiUrl) => createEnrollmentClient({ apiUrl }),
       isProcessAlive,
@@ -71697,7 +72182,7 @@ async function runToken(argv, signal) {
       );
     }
     const ctx = cliContext();
-    const log = __using(_stack, openFileLog((0, import_node_path76.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
+    const log = __using(_stack, openFileLog((0, import_node_path78.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
     const result = await rotateMachineCredential(ctx, { clock: systemClock, log, signal });
     process.stdout.write(`${rotationMessage(result)}
 `);
@@ -71709,8 +72194,8 @@ async function runToken(argv, signal) {
 }
 
 // src/cli/commands/logout.ts
-var import_promises74 = require("fs/promises");
-var import_node_path77 = require("path");
+var import_promises75 = require("fs/promises");
+var import_node_path79 = require("path");
 init_runtime_v2();
 var RUNTIME_EXIT_WAIT_MS = 35e3;
 var TURN_END_WAIT_MS = 3e4;
@@ -71769,9 +72254,9 @@ async function stopHolder(launch, deps, outcome2) {
 }
 async function stopHeldRuns(ctx, deps, outcome2 = "aborted") {
   const stopped = [];
-  for (const name of await (0, import_promises74.readdir)(ctx.paths.sessions).catch(() => [])) {
+  for (const name of await (0, import_promises75.readdir)(ctx.paths.sessions).catch(() => [])) {
     const launch = await readJsonFile(
-      (0, import_node_path77.join)(ctx.paths.sessions, name, "launch.json"),
+      (0, import_node_path79.join)(ctx.paths.sessions, name, "launch.json"),
       holderLaunchSchema
     );
     if (launch.kind !== "ok") continue;
@@ -71808,13 +72293,13 @@ async function forgetMachineLocally(ctx) {
   const machine = await readMachineFile(ctx.paths);
   if (machine === null) return;
   await credentialStoreFor(ctx.paths, machine.credentialStore, ctx.access).clear();
-  await (0, import_promises74.rm)(ctx.paths.machine, { force: true });
+  await (0, import_promises75.rm)(ctx.paths.machine, { force: true });
 }
 async function runLogout(argv, signal) {
   var _stack = [];
   try {
     const ctx = cliContext();
-    const log = __using(_stack, openFileLog((0, import_node_path77.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
+    const log = __using(_stack, openFileLog((0, import_node_path79.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
     const result = await logoutMachine(argv, ctx, {
       api: (apiUrl, accessToken) => createApiClient({ apiUrl, accessToken }),
       stopHeldRuns,
@@ -71832,7 +72317,7 @@ async function runLogout(argv, signal) {
 
 // src/cli/commands/run.ts
 var import_node_fs24 = require("fs");
-var import_node_path81 = require("path");
+var import_node_path83 = require("path");
 
 // src/local-api/app-attachments.ts
 function createAppAttachments(clock) {
@@ -71872,7 +72357,7 @@ function createRunAppends() {
     const pending = waiters.get(runId);
     if (pending === void 0) return;
     waiters.delete(runId);
-    for (const resolve13 of pending) resolve13();
+    for (const resolve14 of pending) resolve14();
   };
   return {
     notify: wake,
@@ -71890,13 +72375,13 @@ function createRunAppends() {
     },
     nextAppend: (runId, signal) => {
       if (signal.aborted) return Promise.resolve();
-      return new Promise((resolve13) => {
+      return new Promise((resolve14) => {
         const done = () => {
           signal.removeEventListener("abort", done);
           const pending2 = waiters.get(runId);
           pending2?.delete(done);
           if (pending2?.size === 0) waiters.delete(runId);
-          resolve13();
+          resolve14();
         };
         const pending = waiters.get(runId) ?? /* @__PURE__ */ new Set();
         pending.add(done);
@@ -71909,9 +72394,9 @@ function createRunAppends() {
 
 // src/local-api/server.ts
 var import_node_crypto35 = require("crypto");
-var import_promises75 = require("fs/promises");
+var import_promises76 = require("fs/promises");
 var import_node_http4 = require("http");
-var import_node_path78 = require("path");
+var import_node_path80 = require("path");
 
 // src/local-api/guard.ts
 var import_node_crypto34 = require("crypto");
@@ -71988,11 +72473,11 @@ id: ${event.id}
 ${data}
 `);
   if (accepted || res.destroyed) return;
-  await new Promise((resolve13) => {
+  await new Promise((resolve14) => {
     const done = () => {
       res.off("drain", done);
       res.off("close", done);
-      resolve13();
+      resolve14();
     };
     res.once("drain", done);
     res.once("close", done);
@@ -72220,9 +72705,9 @@ async function readChangedTurn(deps, conversationId, runId, slot) {
 }
 async function nextChangedRuns(bell, signal) {
   if (bell.pending.size === 0) {
-    await new Promise((resolve13) => {
-      bell.wake = resolve13;
-      if (signal.aborted || bell.pending.size > 0) resolve13();
+    await new Promise((resolve14) => {
+      bell.wake = resolve14;
+      if (signal.aborted || bell.pending.size > 0) resolve14();
     });
     bell.wake = void 0;
   }
@@ -72539,9 +73024,9 @@ var streamStatus = async ({ feed, appAttachments }, { res, signal }) => {
       latest = event;
       writing = writing.then(flush);
     }));
-    await new Promise((resolve13) => {
-      if (signal.aborted) resolve13();
-      signal.addEventListener("abort", () => resolve13(), { once: true });
+    await new Promise((resolve14) => {
+      if (signal.aborted) resolve14();
+      signal.addEventListener("abort", () => resolve14(), { once: true });
     });
     await writing;
   } catch (_) {
@@ -72864,11 +73349,11 @@ function localRequestSignal(path4, closed) {
   ]);
 }
 async function listenOnLoopback(server) {
-  await new Promise((resolve13, reject) => {
+  await new Promise((resolve14, reject) => {
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       server.off("error", reject);
-      resolve13();
+      resolve14();
     });
   }).catch((error61) => {
     throw new RuntimeFault("io_failed", "The local API could not listen on loopback", {
@@ -72883,7 +73368,7 @@ async function listenOnLoopback(server) {
 }
 async function closeServer(server) {
   server.closeAllConnections();
-  await new Promise((resolve13) => server.close(() => resolve13()));
+  await new Promise((resolve14) => server.close(() => resolve14()));
 }
 async function serveLocalApi(deps) {
   const limits = { ...DEFAULT_LIMITS, ...deps.limits };
@@ -72954,7 +73439,7 @@ async function serveLocalApi(deps) {
     startedAtMs,
     runtimeVersion: deps.runtimeVersion
   };
-  const discoveryPath = (0, import_node_path78.join)(deps.stateDir, LOCAL_API_DISCOVERY_FILE);
+  const discoveryPath = (0, import_node_path80.join)(deps.stateDir, LOCAL_API_DISCOVERY_FILE);
   await writeJsonFileAtomic(discoveryPath, discovery);
   const followers = startMaintenance({
     everyMs: limits.refreshEveryMs,
@@ -72988,7 +73473,7 @@ async function serveLocalApi(deps) {
       await watchedStatus[Symbol.asyncDispose]();
       const current = await readJsonFile(discoveryPath, localApiDiscoverySchema);
       if (current.kind === "ok" && current.value.token === token) {
-        await (0, import_promises75.rm)(discoveryPath, { force: true });
+        await (0, import_promises76.rm)(discoveryPath, { force: true });
       }
       await closeServer(server);
       log.info("local_api.closed", {});
@@ -73073,7 +73558,7 @@ function machineFeatureActions(deps) {
 }
 
 // src/cli/commands/machine-plane.ts
-var import_node_path80 = require("path");
+var import_node_path82 = require("path");
 
 // src/link/index.ts
 init_runtime_v2();
@@ -75640,9 +76125,9 @@ var Socket2 = class extends Emitter {
    * @return a Promise that will be fulfilled when the server acknowledges the event
    */
   emitWithAck(ev, ...args) {
-    return new Promise((resolve13, reject) => {
+    return new Promise((resolve14, reject) => {
       const fn = (arg1, arg2) => {
-        return arg1 ? reject(arg1) : resolve13(arg2);
+        return arg1 ? reject(arg1) : resolve14(arg2);
       };
       fn.withError = true;
       args.push(fn);
@@ -76741,7 +77226,7 @@ function refusalFailure(refusal2) {
 }
 
 // src/link/probe.ts
-var import_promises76 = require("dns/promises");
+var import_promises77 = require("dns/promises");
 var import_node_net5 = require("net");
 var import_node_tls2 = require("tls");
 var PROBE_TIMEOUT_MS4 = 5e3;
@@ -76761,9 +77246,9 @@ async function connectOnce(url3, clock) {
   const timer = new AbortController();
   try {
     return await Promise.race([
-      new Promise((resolve13) => {
-        socket.once(ready, () => resolve13(null));
-        socket.once("error", (error61) => resolve13(classifyTransportFailure(error61)));
+      new Promise((resolve14) => {
+        socket.once(ready, () => resolve14(null));
+        socket.once("error", (error61) => resolve14(classifyTransportFailure(error61)));
       }),
       clock.sleep(PROBE_TIMEOUT_MS4, timer.signal).then(
         () => "connection_timeout",
@@ -76777,7 +77262,7 @@ async function connectOnce(url3, clock) {
 }
 async function probeEndpoint(url3, clock) {
   try {
-    await (0, import_promises76.lookup)(url3.hostname);
+    await (0, import_promises77.lookup)(url3.hostname);
   } catch (error61) {
     const reason = classifyTransportFailure(error61);
     return reason === "other" ? "dns" : reason;
@@ -77226,7 +77711,7 @@ function createReconciler(host, lifecycle, log, signal) {
 }
 
 // src/uploader/index.ts
-var import_promises77 = require("fs/promises");
+var import_promises78 = require("fs/promises");
 init_runtime_v2();
 init_zod();
 var RETRY_DELAYS_MS = [250, 500, 1e3, 2e3, 5e3, 1e4, 3e4];
@@ -77374,7 +77859,7 @@ function startUploader({ api, runsDir, clock, log, archive }) {
   };
   const unsealedRunIds = async () => {
     const runIds = [];
-    for (const name of await (0, import_promises77.readdir)(runsDir).catch(() => [])) {
+    for (const name of await (0, import_promises78.readdir)(runsDir).catch(() => [])) {
       const runId = runIdSchema.safeParse(name);
       if (runId.success && !sealed.has(runId.data) && !archive?.has(runId.data))
         runIds.push(runId.data);
@@ -77389,13 +77874,13 @@ function startUploader({ api, runsDir, clock, log, archive }) {
     const dir = runDirectory(runsDir, runId);
     const progress = await readJsonFile(dir.upload, uploadProgressSchema);
     if (progress.kind !== "ok" || !progress.value.sealed) return false;
-    const sealedAt = (await (0, import_promises77.stat)(dir.upload)).mtimeMs;
+    const sealedAt = (await (0, import_promises78.stat)(dir.upload)).mtimeMs;
     if (clock.now() - sealedAt < options.sealedForMs) return false;
     return (await readLastRecord(dir.log))?.update.sessionUpdate === "_alan/run.ended";
   };
   const archivable = async (options) => {
     const found = [];
-    for (const name of await (0, import_promises77.readdir)(runsDir).catch(() => [])) {
+    for (const name of await (0, import_promises78.readdir)(runsDir).catch(() => [])) {
       const runId = runIdSchema.safeParse(name);
       if (!runId.success || archive?.has(runId.data)) continue;
       try {
@@ -77596,12 +78081,12 @@ async function startMachineNativeIngest(deps) {
 }
 
 // src/cli/commands/run-updates.ts
-var import_node_path79 = require("path");
+var import_node_path81 = require("path");
 init_runtime_v2();
 var UPDATE_CHECK_EVERY_MS = 6 * 60 * 60 * 1e3;
 var DEFERRED_RETRY_MS = 5 * 60 * 1e3;
 function isInstalledBundle(layout, bundlePath) {
-  return (0, import_node_path79.resolve)((0, import_node_path79.dirname)((0, import_node_path79.dirname)(bundlePath))) === (0, import_node_path79.resolve)(layout.versions);
+  return (0, import_node_path81.resolve)((0, import_node_path81.dirname)((0, import_node_path81.dirname)(bundlePath))) === (0, import_node_path81.resolve)(layout.versions);
 }
 async function settleUpgradeOnStart({
   layout,
@@ -77708,7 +78193,7 @@ function startRuntimeUpdates(options) {
       layout,
       release: npmRelease,
       tarball: await options.downloader.download(npmRelease.dist.tarball, signal),
-      tmpDir: (0, import_node_path79.join)(layout.root, ".downloads")
+      tmpDir: (0, import_node_path81.join)(layout.root, ".downloads")
     });
     await lifecycle.exclusive("upgrade", async () => {
       await recordPendingUpgrade(layout, currentVersion2, version2, clock.now());
@@ -77939,7 +78424,7 @@ async function startMachinePlane(deps) {
                 [ALAN_MANAGED_SESSION_ENV]: "1"
               },
               cwd: paths.stateDir,
-              outputPath: (0, import_node_path80.join)(paths.logs, "holders.log")
+              outputPath: (0, import_node_path82.join)(paths.logs, "holders.log")
             },
             deps.holderIsolation
           );
@@ -77976,7 +78461,7 @@ async function startMachinePlane(deps) {
         }),
         local: { home: config2.home, machineId: identity.machineId },
         // Only a cloud sandbox's runtime has a git gateway; a person's own ~/.codex is theirs.
-        ...config2.gitGatewayUrl === null ? {} : { codexSkillsDir: (0, import_node_path80.join)(config2.codexHome, "skills") },
+        ...config2.gitGatewayUrl === null ? {} : { codexSkillsDir: (0, import_node_path82.join)(config2.codexHome, "skills") },
         log
       })
     );
@@ -78174,7 +78659,7 @@ async function startMachinePlane(deps) {
             git: createGitRunner({ env: cliEnvironment }),
             clock,
             log,
-            dir: (0, import_node_path80.join)(paths.stateDir, "checkout-freshness")
+            dir: (0, import_node_path82.join)(paths.stateDir, "checkout-freshness")
           },
           stopped.signal
         );
@@ -78436,11 +78921,11 @@ function createMachineSlot(deps) {
 
 // src/cli/commands/run-exit.ts
 function firstAborted(signals) {
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     for (const reason of ["stop", "restart"]) {
       const signal = signals[reason];
-      if (signal.aborted) resolve13(reason);
-      signal.addEventListener("abort", () => resolve13(reason), { once: true });
+      if (signal.aborted) resolve14(reason);
+      signal.addEventListener("abort", () => resolve14(reason), { once: true });
     }
   });
 }
@@ -78468,7 +78953,7 @@ function lockWaitMs(argv) {
 }
 async function openManagedProviders(config2, paths) {
   const providerEnv = readCliEnvironment();
-  const bundledNpm = (0, import_node_path81.join)((0, import_node_path81.dirname)(process.execPath), "npm", "bin", "npm-cli.js");
+  const bundledNpm = (0, import_node_path83.join)((0, import_node_path83.dirname)(process.execPath), "npm", "bin", "npm-cli.js");
   const providerToolchain = config2.providerToolchain ?? (process.platform === "win32" && (0, import_node_fs24.existsSync)(bundledNpm) ? { node: process.execPath, npmCli: bundledNpm } : null);
   const npmPath = providerToolchain?.node ?? await resolveCommandOnPath("npm", providerEnv, process.platform);
   const npmOptions = npmPath === null || process.platform === "win32" && providerToolchain === null ? null : {
@@ -78476,7 +78961,7 @@ async function openManagedProviders(config2, paths) {
     ...providerToolchain === null ? {} : { argsBeforeNpm: [providerToolchain.npmCli] },
     env: providerEnv
   };
-  const providerNodeDir = providerToolchain?.node === void 0 ? void 0 : (0, import_node_path81.dirname)(providerToolchain.node);
+  const providerNodeDir = providerToolchain?.node === void 0 ? void 0 : (0, import_node_path83.dirname)(providerToolchain.node);
   const probeEnv = providerNodeDir === void 0 ? providerEnv : {
     ...providerEnv,
     PATH: `${providerNodeDir}${pathDelimiter(process.platform)}${envValue(providerEnv, "PATH")}`
@@ -78486,7 +78971,7 @@ async function openManagedProviders(config2, paths) {
     throw new Error("Provider installer is unavailable on this computer");
   };
   const managed = createManagedProviderClis({
-    root: (0, import_node_path81.join)(paths.stateDir, "provider-clis"),
+    root: (0, import_node_path83.join)(paths.stateDir, "provider-clis"),
     resolveVersion: npmOptions === null ? unavailable : createNpmVersionResolver(npmOptions),
     installPackage: npmOptions === null ? unavailable : createNpmPackageInstaller(npmOptions),
     probe: (executable, backendKind) => probeManagedProvider(executable, backendKind, canonicalProbeEnv)
@@ -78518,7 +79003,7 @@ async function runService(argv, stop, restart = new AbortController().signal) {
       waitMs: lockWaitMs(argv),
       signal: stop
     }));
-    const log = __using(_stack, openFileLog((0, import_node_path81.join)(paths.logs, "runtime.jsonl"), config2.logLevel, clock));
+    const log = __using(_stack, openFileLog((0, import_node_path83.join)(paths.logs, "runtime.jsonl"), config2.logLevel, clock));
     const lifecycle = createLifecycleQueue({ clock, log });
     const install2 = installLayout(config2.installDir, config2.profile);
     const bundlePath = process.argv[1] ?? "";
@@ -78552,7 +79037,7 @@ async function runService(argv, stop, restart = new AbortController().signal) {
         openCliEnvironment({
           env: readCliEnvironment(),
           platform: process.platform,
-          lastKnownGoodFile: (0, import_node_path81.join)(paths.stateDir, "login-path.json"),
+          lastKnownGoodFile: (0, import_node_path83.join)(paths.stateDir, "login-path.json"),
           clock,
           decorate: (env) => withPackagedAlanCodeEngine(env, bundlePath, process.platform)
         })
@@ -78729,17 +79214,17 @@ async function runServiceCommand(argv, ctx = cliContext()) {
 }
 
 // src/cli/commands/upgrade.ts
-var import_promises78 = require("fs/promises");
-var import_node_path82 = require("path");
+var import_promises79 = require("fs/promises");
+var import_node_path84 = require("path");
 function isNotNewer(version2, installed) {
   return installed !== null && isReleaseVersion(version2) && isReleaseVersion(installed) && compareVersions(version2, installed) <= 0;
 }
 async function installFromSource(source) {
   const { layout, from, ifNewer } = source;
-  const isTarball = (await (0, import_promises78.stat)(from)).isFile();
-  const downloads = (0, import_node_path82.join)(layout.root, ".downloads");
-  if (isTarball) await (0, import_promises78.mkdir)(downloads, { recursive: true, mode: 448 });
-  const scratch = isTarball ? await (0, import_promises78.mkdtemp)((0, import_node_path82.join)(downloads, "upgrade-")) : null;
+  const isTarball = (await (0, import_promises79.stat)(from)).isFile();
+  const downloads = (0, import_node_path84.join)(layout.root, ".downloads");
+  if (isTarball) await (0, import_promises79.mkdir)(downloads, { recursive: true, mode: 448 });
+  const scratch = isTarball ? await (0, import_promises79.mkdtemp)((0, import_node_path84.join)(downloads, "upgrade-")) : null;
   try {
     const sourceDir = scratch === null ? from : await extractPackageTarball(from, scratch);
     const version2 = await readPackageVersion(sourceDir);
@@ -78747,7 +79232,7 @@ async function installFromSource(source) {
     if (ifNewer && isNotNewer(version2, installed)) return { kind: "skipped", version: version2, installed };
     return { kind: "installed", ...await installVersion(layout, sourceDir) };
   } finally {
-    if (scratch !== null) await (0, import_promises78.rm)(scratch, { recursive: true, force: true });
+    if (scratch !== null) await (0, import_promises79.rm)(scratch, { recursive: true, force: true });
   }
 }
 async function runUpgrade(argv) {
@@ -78759,7 +79244,7 @@ async function runUpgrade(argv) {
   const layout = installLayout(config2.installDir, config2.profile);
   const outcome2 = await installFromSource({
     layout,
-    from: (0, import_node_path82.resolve)(from),
+    from: (0, import_node_path84.resolve)(from),
     ifNewer: hasFlag(argv, "--if-newer")
   });
   if (outcome2.kind === "skipped") {