@alan-ai-hq/agent-manager-darwin-arm64 0.1.146 → 0.1.147

package/alan-agent.cjs

@@ -12529,7 +12529,7 @@ function compileValidator(schema, parser) {
 function compile(schema, options) {
   try {
     const parser = compileFn(schema);
-    const clone2 = clone(schema);
+    const clone3 = clone(schema);
     const liveRun = schema._zod.run;
     const originalRun = liveRun.__originalRun ?? liveRun;
     const wrapped = (payload, ctx) => {
@@ -12549,12 +12549,12 @@ function compile(schema, options) {
       return originalRun(payload, ctx);
     };
     wrapped.__originalRun = originalRun;
-    clone2._zod.bag.fallbackRun = originalRun;
-    clone2._zod.bag.validator = compileValidator(schema, parser);
-    clone2._zod.run = wrapped;
+    clone3._zod.bag.fallbackRun = originalRun;
+    clone3._zod.bag.validator = compileValidator(schema, parser);
+    clone3._zod.run = wrapped;
     if (!liveRun.__originalRun)
-      installCompiledUserMethods(clone2, schema, parser);
-    return clone2;
+      installCompiledUserMethods(clone3, schema, parser);
+    return clone3;
   } catch (err) {
     if (options?.strict)
       throw err;
@@ -20312,7 +20312,7 @@ var init_workspace = __esm({
 });
 
 // ../shared/dist/runtime-v2/desired-state.js
-var repoLocalPathSchema, runSpecSchema, desiredRunSchema, desiredStateSchema;
+var repoLocalPathSchema, requestedCheckoutSchema, runSpecSchema, desiredRunSchema, desiredStateSchema;
 var init_desired_state = __esm({
   "../shared/dist/runtime-v2/desired-state.js"() {
     "use strict";
@@ -20327,6 +20327,11 @@ var init_desired_state = __esm({
       localPath: external_exports.string().min(1),
       branch: external_exports.string().min(1).optional()
     });
+    requestedCheckoutSchema = external_exports.object({
+      path: machinePathSchema,
+      repoUrl: gitRemoteUrlSchema,
+      branch: gitBranchSchema
+    });
     runSpecSchema = external_exports.object({
       runId: runIdSchema,
       conversationId: conversationIdSchema,
@@ -20345,6 +20350,8 @@ var init_desired_state = __esm({
       workspacePathPinned: external_exports.boolean().optional(),
       approvedWorkspacePaths: external_exports.array(external_exports.string().min(1)).optional(),
       repoLocalPaths: external_exports.array(repoLocalPathSchema).optional(),
+      /** Applied once, at the conversation's first turn on a cloud sandbox; never moves local work. */
+      requestedCheckouts: external_exports.array(requestedCheckoutSchema).max(64).optional(),
       workflowId: external_exports.guid().optional(),
       workflowExecutionId: external_exports.guid().optional(),
       agentId: external_exports.string().min(1).optional(),
@@ -20973,13 +20980,20 @@ var init_problem = __esm({
 });
 
 // ../shared/dist/cli-usage.js
-var usagePercentSchema, usageTimestampSchema, cliUsageWindowPatchSchema, cliUsageWindowSchema, cliUsageBucketSchema, cliUsageSnapshotSchema;
+var usagePercentSchema, usageTimestampSchema, usageAmountSchema, usageObservationShape, cliUsageWindowPatchSchema, cliUsageWindowSchema, cliUsageSpendPatchSchema, cliUsageSpendSchema, cliUsageCreditsPatchSchema, cliUsageCreditsSchema, cliUsageBucketSchema, cliUsageSnapshotSchema;
 var init_cli_usage = __esm({
   "../shared/dist/cli-usage.js"() {
     "use strict";
     init_zod();
     usagePercentSchema = external_exports.number().min(0).max(100);
     usageTimestampSchema = external_exports.iso.datetime();
+    usageAmountSchema = external_exports.string().min(1);
+    usageObservationShape = {
+      observedAt: usageTimestampSchema,
+      receivedAt: usageTimestampSchema,
+      sourceId: external_exports.string().min(1),
+      sequence: external_exports.number().int().nonnegative()
+    };
     cliUsageWindowPatchSchema = external_exports.object({
       usedPercent: usagePercentSchema.nullable().optional(),
       windowMinutes: external_exports.number().positive().nullable().optional(),
@@ -20989,14 +21003,41 @@ var init_cli_usage = __esm({
       usedPercent: usagePercentSchema.optional(),
       windowMinutes: external_exports.number().positive().optional(),
       resetsAt: usageTimestampSchema.optional(),
-      observedAt: usageTimestampSchema,
-      receivedAt: usageTimestampSchema,
-      sourceId: external_exports.string().min(1),
-      sequence: external_exports.number().int().nonnegative()
+      ...usageObservationShape
+    });
+    cliUsageSpendPatchSchema = external_exports.object({
+      reached: external_exports.boolean(),
+      limit: usageAmountSchema.nullable().optional(),
+      used: usageAmountSchema.nullable().optional(),
+      remaining: usageAmountSchema.nullable().optional(),
+      usedPercent: usagePercentSchema.nullable().optional(),
+      resetsAt: usageTimestampSchema.nullable().optional()
+    });
+    cliUsageSpendSchema = external_exports.object({
+      reached: external_exports.boolean(),
+      limit: usageAmountSchema.optional(),
+      used: usageAmountSchema.optional(),
+      remaining: usageAmountSchema.optional(),
+      usedPercent: usagePercentSchema.optional(),
+      resetsAt: usageTimestampSchema.optional(),
+      ...usageObservationShape
+    });
+    cliUsageCreditsPatchSchema = external_exports.object({
+      hasCredits: external_exports.boolean(),
+      unlimited: external_exports.boolean(),
+      balance: usageAmountSchema.nullable().optional()
+    });
+    cliUsageCreditsSchema = external_exports.object({
+      hasCredits: external_exports.boolean(),
+      unlimited: external_exports.boolean(),
+      balance: usageAmountSchema.optional(),
+      ...usageObservationShape
     });
     cliUsageBucketSchema = external_exports.object({
       primary: cliUsageWindowSchema.optional(),
       secondary: cliUsageWindowSchema.optional(),
+      spend: cliUsageSpendSchema.optional(),
+      credits: cliUsageCreditsSchema.optional(),
       planType: external_exports.string().min(1).nullable().optional()
     });
     cliUsageSnapshotSchema = external_exports.object({
@@ -21038,6 +21079,8 @@ var init_run_log = __esm({
       limitId: external_exports.string().min(1),
       primary: cliUsageWindowPatchSchema.nullable().optional(),
       secondary: cliUsageWindowPatchSchema.nullable().optional(),
+      spend: cliUsageSpendPatchSchema.nullable().optional(),
+      credits: cliUsageCreditsPatchSchema.nullable().optional(),
       planType: external_exports.string().min(1).nullable().optional(),
       observedAt: external_exports.iso.datetime(),
       sourceId: external_exports.string().min(1),
@@ -22583,7 +22626,7 @@ function plan(command, args, options) {
 function captureOutput(command, args, options) {
   const launch = plan(command, args, options);
   if (launch === void 0) return Promise.resolve(NEVER_STARTED);
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     (0, import_child_process.execFile)(
       launch.file,
       [...launch.args],
@@ -22597,7 +22640,7 @@ function captureOutput(command, args, options) {
       },
       (error61, stdout, stderr) => {
         const code = error61 && typeof error61.code === "number" ? error61.code : error61 ? void 0 : 0;
-        resolve13({ stdout, stderr, exitCode: code });
+        resolve14({ stdout, stderr, exitCode: code });
       }
     );
   });
@@ -22647,10 +22690,10 @@ async function linuxStartTicks(pid) {
   }
 }
 function psStartTime(pid) {
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     (0, import_child_process2.execFile)("ps", ["-o", "lstart=", "-p", String(pid)], { timeout: 2e3 }, (error61, stdout) => {
       const text3 = stdout.trim();
-      resolve13(error61 || !text3 ? void 0 : text3);
+      resolve14(error61 || !text3 ? void 0 : text3);
     });
   });
 }
@@ -22679,12 +22722,12 @@ function parseProcessList(text3) {
 }
 function listProcesses(platform3 = process.platform) {
   if (platform3 === "win32") return Promise.resolve([]);
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     (0, import_child_process3.execFile)(
       "ps",
       ["-A", "-o", "pid=,ppid=,pgid=,lstart="],
       { timeout: 5e3, maxBuffer: 8 * 1024 * 1024 },
-      (error61, stdout) => resolve13(error61 ? [] : parseProcessList(stdout))
+      (error61, stdout) => resolve14(error61 ? [] : parseProcessList(stdout))
     );
   });
 }
@@ -22724,11 +22767,11 @@ async function taskkill(pid, options) {
     stdio: "ignore",
     windowsHide: true
   });
-  const exited = new Promise((resolve13) => {
-    killer.once("error", (error210) => resolve13(error210));
+  const exited = new Promise((resolve14) => {
+    killer.once("error", (error210) => resolve14(error210));
     killer.once(
       "exit",
-      (code, signal) => resolve13(code === 0 ? void 0 : new Error(`taskkill failed: exit ${code}, signal ${signal}`))
+      (code, signal) => resolve14(code === 0 ? void 0 : new Error(`taskkill failed: exit ${code}, signal ${signal}`))
     );
   });
   const timedOut = clock.sleep(options.timeoutMs ?? DEFAULT_TASKKILL_TIMEOUT_MS, timeout.signal).then(() => new Error("taskkill timed out")).catch(() => void 0);
@@ -22984,10 +23027,10 @@ function spawnCli(options) {
 function waitForSpawn(child, command) {
   if (isWindowsJob(child)) return waitForWindowsJob(child, command);
   if (child.pid !== void 0) return Promise.resolve();
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const onSpawn = () => {
       child.off("error", onError);
-      resolve13();
+      resolve14();
     };
     const onError = (error61) => {
       child.off("spawn", onSpawn);
@@ -26585,8 +26628,8 @@ function createJsonRpcPeer(writer, handlers) {
     },
     request: (method, params = {}) => {
       const id = counter.next++;
-      return new Promise((resolve13, reject) => {
-        pending.set(id, { method, resolve: resolve13, reject });
+      return new Promise((resolve14, reject) => {
+        pending.set(id, { method, resolve: resolve14, reject });
         writer.write({ id, method, params }).catch((error61) => {
           pending.delete(id);
           reject(error61 instanceof Error ? error61 : new Error(String(error61)));
@@ -26699,7 +26742,7 @@ function createNdjsonWriter(stream) {
     get writable() {
       return stream.writable && !stream.destroyed && failure6.error === void 0;
     },
-    write: (value2) => new Promise((resolve13, reject) => {
+    write: (value2) => new Promise((resolve14, reject) => {
       if (failure6.error) {
         reject(failure6.error);
         return;
@@ -26711,7 +26754,7 @@ function createNdjsonWriter(stream) {
       stream.write(`${JSON.stringify(value2)}
 `, (error61) => {
         if (error61) reject(error61);
-        else resolve13();
+        else resolve14();
       });
     }),
     end: () => {
@@ -26727,11 +26770,11 @@ function hostProcess(child, tree, options, handlers) {
   const stderr = new LineSplitter((line) => handlers.onStderrLine(line));
   child.stderr.on("data", (chunk) => stderr.push(chunk));
   child.stderr.once("end", () => stderr.flush());
-  const processExit = new Promise((resolve13) => {
-    child.once("exit", (code, signal) => resolve13({ code, signal }));
+  const processExit = new Promise((resolve14) => {
+    child.once("exit", (code, signal) => resolve14({ code, signal }));
   });
-  const outputEnded = new Promise((resolve13) => {
-    child.stdout.once("close", () => resolve13());
+  const outputEnded = new Promise((resolve14) => {
+    child.stdout.once("close", () => resolve14());
   });
   const watch = async () => {
     const { clock, stdoutDrainMs, log, name } = options;
@@ -27021,13 +27064,13 @@ var init_chunk_4G77APXN = __esm({
         const turnId = input2.turnId;
         let finish = () => {
         };
-        const done = new Promise((resolve13) => {
+        const done = new Promise((resolve14) => {
           finish = (outcome2) => {
             if (this.#current?.id !== turnId) return;
             this.#current = void 0;
             if (this.#state === "busy") this.#state = "idle";
             this.#emit({ type: "turn_ended", turnId, outcome: outcome2 });
-            resolve13({ turnId, outcome: outcome2, providerSessionId: this.#sessionId });
+            resolve14({ turnId, outcome: outcome2, providerSessionId: this.#sessionId });
           };
         });
         const pending = {
@@ -29620,8 +29663,8 @@ var init_claude = __esm({
       }
       async #awaitTaskStop(requestId, taskId) {
         const timer = new AbortController();
-        const answered = new Promise((resolve13) => {
-          this.#taskStops.set(requestId, resolve13);
+        const answered = new Promise((resolve14) => {
+          this.#taskStops.set(requestId, resolve14);
         });
         const timeoutMs = this.#options.stopTaskTimeoutMs;
         const timedOut = this.#options.clock.sleep(timeoutMs, timer.signal).then(
@@ -29694,17 +29737,17 @@ var init_claude = __esm({
         };
         let markStarted = () => {
         };
-        const whenStarted = new Promise((resolve13) => {
-          markStarted = resolve13;
+        const whenStarted = new Promise((resolve14) => {
+          markStarted = resolve14;
         });
-        const done = new Promise((resolve13) => {
+        const done = new Promise((resolve14) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
             this.#lastTurn = turn;
             if (this.#state === "busy") this.#state = "idle";
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#providerSessionId });
+            resolve14({ turnId: id, outcome: outcome2, providerSessionId: this.#providerSessionId });
           };
         });
         const active = {
@@ -29822,8 +29865,8 @@ var init_claude = __esm({
         void removeLaunchFiles(this.#launchFiles).catch((error61) => {
           this.#options.log.warn("claude.launch_files_cleanup_failed", { error: error61 });
         });
-        for (const resolve13 of this.#taskStops.values()) {
-          resolve13({ ok: false, reason: "runtime_unavailable", message: "Claude Code exited." });
+        for (const resolve14 of this.#taskStops.values()) {
+          resolve14({ ok: false, reason: "runtime_unavailable", message: "Claude Code exited." });
         }
         const active = this.#current;
         if (active) {
@@ -30242,6 +30285,44 @@ function windowPatch(value2) {
   }
   return patch;
 }
+function amount(value2) {
+  const text3 = asString(value2).trim();
+  return text3.length > 0 ? text3 : void 0;
+}
+function spendPatch(limit, reached) {
+  const record2 = asRecord(limit);
+  const reachedFlag = reached === true;
+  if (!record2)
+    return limit === null && !reachedFlag ? null : reachedFlag ? { reached: true } : void 0;
+  const patch = { reached: reachedFlag };
+  const limitAmount = amount(record2.limit);
+  const usedAmount = amount(record2.used);
+  if (limitAmount) patch.limit = limitAmount;
+  if (usedAmount) patch.used = usedAmount;
+  const remainingPercent = asFiniteNumber(record2.remainingPercent);
+  if (remainingPercent !== void 0) {
+    patch.usedPercent = Math.min(100, Math.max(0, 100 - remainingPercent));
+  }
+  const seconds = asFiniteNumber(record2.resetsAt);
+  if (seconds !== void 0 && seconds >= 0) {
+    const reset = new Date(seconds * 1e3);
+    if (Number.isFinite(reset.getTime())) patch.resetsAt = reset.toISOString();
+  }
+  return patch;
+}
+function creditsPatch(value2) {
+  if (value2 === null) return null;
+  const record2 = asRecord(value2);
+  if (!record2 || typeof record2.hasCredits !== "boolean" || typeof record2.unlimited !== "boolean") {
+    return void 0;
+  }
+  const balance = amount(record2.balance);
+  return {
+    hasCredits: record2.hasCredits,
+    unlimited: record2.unlimited,
+    ...balance ? { balance } : {}
+  };
+}
 function isApprovalRequest(method) {
   return COMMAND_OR_FILE.has(method) || LEGACY.has(method);
 }
@@ -31939,12 +32020,16 @@ var init_codex = __esm({
         if (!snapshot2) return [];
         const primary = windowPatch(snapshot2.primary);
         const secondary = windowPatch(snapshot2.secondary);
+        const spend = spendPatch(snapshot2.individualLimit, snapshot2.spendControlReached);
+        const credits = creditsPatch(snapshot2.credits);
         const planType = snapshot2.planType === null ? null : asString(snapshot2.planType) || void 0;
         const parsed = runCodexRateLimitsUpdateSchema.safeParse({
           sessionUpdate: "_alan/codex.rate_limits",
           limitId: bucketId ?? (asString(snapshot2.limitId) || "codex"),
           ...primary === void 0 ? {} : { primary },
           ...secondary === void 0 ? {} : { secondary },
+          ...spend === void 0 ? {} : { spend },
+          ...credits === void 0 ? {} : { credits },
           ...planType === void 0 ? {} : { planType },
           observedAt: new Date(this.#clock.now()).toISOString(),
           sourceId: this.#sourceId,
@@ -32383,10 +32468,10 @@ var init_codex = __esm({
         };
         let identify = () => {
         };
-        const identified = new Promise((resolve13) => {
-          identify = resolve13;
+        const identified = new Promise((resolve14) => {
+          identify = resolve14;
         });
-        const done = new Promise((resolve13) => {
+        const done = new Promise((resolve14) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
@@ -32394,7 +32479,7 @@ var init_codex = __esm({
             if (this.#state === "busy") this.#state = "idle";
             this.#host.scanDescendants(true);
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#threadId });
+            resolve14({ turnId: id, outcome: outcome2, providerSessionId: this.#threadId });
           };
         });
         const active = {
@@ -32949,7 +33034,7 @@ function alanCodeConfigContent(existing, input2) {
   });
 }
 function readBody2(response) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const chunks = [];
     let size = 0;
     response.on("data", (chunk) => {
@@ -32957,7 +33042,7 @@ function readBody2(response) {
       if (size > MAX_CATALOG_BYTES) response.destroy(new Error("catalog too large"));
       else chunks.push(chunk);
     });
-    response.on("end", () => resolve13(Buffer.concat(chunks).toString("utf8")));
+    response.on("end", () => resolve14(Buffer.concat(chunks).toString("utf8")));
     response.on("error", reject);
   });
 }
@@ -32973,13 +33058,13 @@ function parseResponseBody(text3, status) {
 }
 function getJson(url3, headers, timeout, signal) {
   const request2 = url3.protocol === "https:" ? import_https.request : import_http9.request;
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const outgoing = request2(url3, { method: "GET", headers, timeout, signal }, (response) => {
       const status = response.statusCode ?? 0;
       readBody2(response).then((text3) => {
         const body = parseResponseBody(text3, status);
         if (status < 200 || status >= 300) reject(new CatalogResponseError(status, body));
-        else resolve13(body);
+        else resolve14(body);
       }).catch(reject);
     });
     outgoing.on("timeout", () => outgoing.destroy(new Error("catalog timed out")));
@@ -41855,8 +41940,8 @@ var require_streamx = __commonJS({
             return this;
           },
           next() {
-            return new Promise(function(resolve13, reject) {
-              promiseResolve = resolve13;
+            return new Promise(function(resolve14, reject) {
+              promiseResolve = resolve14;
               promiseReject = reject;
               const data = stream.read();
               if (data !== null) ondata(data);
@@ -41889,11 +41974,11 @@ var require_streamx = __commonJS({
         }
         function destroy(err) {
           stream.destroy(err);
-          return new Promise((resolve13, reject) => {
-            if (stream._duplexState & DESTROYED) return resolve13({ value: void 0, done: true });
+          return new Promise((resolve14, reject) => {
+            if (stream._duplexState & DESTROYED) return resolve14({ value: void 0, done: true });
             stream.once("close", function() {
               if (err) reject(err);
-              else resolve13({ value: void 0, done: true });
+              else resolve14({ value: void 0, done: true });
             });
           });
         }
@@ -41937,8 +42022,8 @@ var require_streamx = __commonJS({
         const writes = pending + (ws._duplexState & WRITE_WRITING ? 1 : 0);
         if (writes === 0) return Promise.resolve(true);
         if (state.drains === null) state.drains = [];
-        return new Promise((resolve13) => {
-          state.drains.push({ writes, resolve: resolve13 });
+        return new Promise((resolve14) => {
+          state.drains.push({ writes, resolve: resolve14 });
         });
       }
       write(data) {
@@ -42043,10 +42128,10 @@ var require_streamx = __commonJS({
       cb(null);
     }
     function pipelinePromise(...streams) {
-      return new Promise((resolve13, reject) => {
+      return new Promise((resolve14, reject) => {
         return pipeline(...streams, (err) => {
           if (err) return reject(err);
-          resolve13();
+          resolve14();
         });
       });
     }
@@ -42718,16 +42803,16 @@ var require_extract = __commonJS({
           entryCallback = null;
           cb(err);
         }
-        function onnext(resolve13, reject) {
+        function onnext(resolve14, reject) {
           if (error61) {
             return reject(error61);
           }
           if (entryStream) {
-            resolve13({ value: entryStream, done: false });
+            resolve14({ value: entryStream, done: false });
             entryStream = null;
             return;
           }
-          promiseResolve = resolve13;
+          promiseResolve = resolve14;
           promiseReject = reject;
           consumeCallback(null);
           if (extract2._finished && promiseResolve) {
@@ -42755,11 +42840,11 @@ var require_extract = __commonJS({
         function destroy(err) {
           extract2.destroy(err);
           consumeCallback(err);
-          return new Promise((resolve13, reject) => {
-            if (extract2.destroyed) return resolve13({ value: void 0, done: true });
+          return new Promise((resolve14, reject) => {
+            if (extract2.destroyed) return resolve14({ value: void 0, done: true });
             extract2.once("close", function() {
               if (err) reject(err);
-              else resolve13({ value: void 0, done: true });
+              else resolve14({ value: void 0, done: true });
             });
           });
         }
@@ -44321,7 +44406,7 @@ var init_acp3 = __esm({
         const turn = new AcpTurn(`acp-${this.#turns}-${id}`, this.#profile);
         let finish = () => {
         };
-        const done = new Promise((resolve13) => {
+        const done = new Promise((resolve14) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
@@ -44329,7 +44414,7 @@ var init_acp3 = __esm({
             if (this.#state === "busy") this.#state = "idle";
             this.#host.scanDescendants(true);
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
+            resolve14({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
           };
         });
         const active = { id, turn, done, finish, cancelRequested: false };
@@ -47005,8 +47090,8 @@ function createDroidPeer(writer, handlers) {
     },
     request: (method, params = {}) => {
       const id = `alan-${counter.next++}`;
-      return new Promise((resolve13, reject) => {
-        pending.set(id, { method, resolve: resolve13, reject });
+      return new Promise((resolve14, reject) => {
+        pending.set(id, { method, resolve: resolve14, reject });
         writer.write(envelope("request", { id, method, params })).catch((error61) => {
           pending.delete(id);
           reject(error61 instanceof Error ? error61 : new Error(String(error61)));
@@ -47631,14 +47716,14 @@ var init_droid = __esm({
         const turn = new DroidTurn(sessionId, this.#memory);
         let finish = () => {
         };
-        const done = new Promise((resolve13) => {
+        const done = new Promise((resolve14) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
             if (this.#state === "busy") this.#state = "idle";
             this.#host.scanDescendants(true);
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
+            resolve14({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
           };
         });
         const active = { id, turn, done, finish, cancelRequested: false };
@@ -54564,7 +54649,7 @@ var require_websocket_server = __commonJS({
 // package.json
 var package_default = {
   name: "@alan-ai-hq/agent-manager",
-  version: "0.1.146",
+  version: "0.1.147",
   private: true,
   type: "module",
   description: "Alan machine runtime (alan-agent): identity, link, reconciler, session holders, run log, uploader, local API",
@@ -54614,7 +54699,7 @@ var package_default = {
 
 // src/cli/commands/compat.ts
 var import_node_crypto32 = require("crypto");
-var import_promises68 = require("fs/promises");
+var import_promises69 = require("fs/promises");
 init_runtime_v2();
 init_zod();
 
@@ -54773,8 +54858,8 @@ async function writeJsonFileAtomic(path4, value2) {
 var LIFECYCLE_DRAIN_MS = 5e3;
 function createGate() {
   const opened = {};
-  const promise2 = new Promise((resolve13) => {
-    opened.resolve = resolve13;
+  const promise2 = new Promise((resolve14) => {
+    opened.resolve = resolve14;
   });
   return { promise: promise2, open: () => opened.resolve?.() };
 }
@@ -55001,7 +55086,7 @@ function transportFailure(request2, error61) {
   });
 }
 function readBody(incoming, url3, maxBytes) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const declared = Number(incoming.headers["content-length"] ?? "0");
     if (maxBytes !== void 0 && declared > maxBytes) {
       incoming.destroy();
@@ -55020,7 +55105,7 @@ function readBody(incoming, url3, maxBytes) {
       chunks.push(chunk);
     });
     incoming.on("error", reject);
-    incoming.on("end", () => resolve13(Buffer.concat(chunks)));
+    incoming.on("end", () => resolve14(Buffer.concat(chunks)));
   });
 }
 function isConnectionReset(error61) {
@@ -55028,7 +55113,7 @@ function isConnectionReset(error61) {
 }
 function exchange(request2, agents, attempt2 = 0) {
   const { signal, url: url3 } = request2;
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     if (signal.aborted) {
       reject(signal.reason);
       return;
@@ -55055,7 +55140,7 @@ function exchange(request2, agents, attempt2 = 0) {
       const stale = outgoing.reusedSocket && !responded && isConnectionReset(error61);
       if (stale && attempt2 < STALE_SOCKET_RETRIES && !signal.aborted) {
         settle();
-        resolve13(exchange(request2, agents, attempt2 + 1));
+        resolve14(exchange(request2, agents, attempt2 + 1));
         return;
       }
       fail(error61);
@@ -55068,7 +55153,7 @@ function exchange(request2, agents, attempt2 = 0) {
       readBody(incoming, url3, isRedirect(status) ? void 0 : request2.maxBodyBytes).then(
         (body) => {
           settle();
-          resolve13({ status, headers: incoming.headers, body });
+          resolve14({ status, headers: incoming.headers, body });
         },
         fail
       );
@@ -55313,8 +55398,8 @@ function isBodyless(method) {
   return method === "GET" || method === "HEAD";
 }
 function exchange2(send2, options, input2) {
-  return new Promise((resolve13, reject) => {
-    const outgoing = send2({ ...options, method: input2.method, signal: input2.signal }, resolve13);
+  return new Promise((resolve14, reject) => {
+    const outgoing = send2({ ...options, method: input2.method, signal: input2.signal }, resolve14);
     outgoing.on("error", reject);
     if (isBodyless(input2.method)) {
       input2.body.resume();
@@ -56800,7 +56885,7 @@ function createGitRunner(options) {
       }
       await killProcessTree(child.pid, { signal: "SIGKILL", child, platform: platform3 });
     };
-    return new Promise((resolve13, reject) => {
+    return new Promise((resolve14, reject) => {
       let ending = null;
       const stop = (next) => {
         if (ending !== null) return;
@@ -56825,7 +56910,7 @@ function createGitRunner(options) {
         signal.removeEventListener("abort", onAbort);
         const final = ending ?? last;
         if (final.kind === "exited") {
-          resolve13({ exitCode: final.exitCode, stdout: stdout.text(), stderr: stderr.text() });
+          resolve14({ exitCode: final.exitCode, stdout: stdout.text(), stderr: stderr.text() });
         } else {
           reject(faultFor(final, command));
         }
@@ -57038,6 +57123,9 @@ async function checkSnapshotCheckouts(root, deps, signal) {
     })
   );
 }
+async function recordCheckoutKept(dir, path4, reason) {
+  await writeJsonFileAtomic(freshnessFile(dir, path4), { state: "kept", path: path4, reason });
+}
 async function readCheckoutFreshness(dir, path4) {
   for (let current = path4; ; current = (0, import_node_path7.dirname)(current)) {
     const read = await readJsonFile(freshnessFile(dir, current), freshnessSchema);
@@ -58342,7 +58430,7 @@ function statusOf(error61) {
   }
   return 1;
 }
-var systemExec = (request2) => new Promise((resolve13) => {
+var systemExec = (request2) => new Promise((resolve14) => {
   const child = (0, import_node_child_process6.execFile)(
     request2.command,
     [...request2.args],
@@ -58353,7 +58441,7 @@ var systemExec = (request2) => new Promise((resolve13) => {
       windowsHide: true
     },
     (error61, stdout, stderr) => {
-      resolve13({ status: statusOf(error61), stdout, stderr });
+      resolve14({ status: statusOf(error61), stdout, stderr });
     }
   );
   child.stdin?.on("error", () => {
@@ -59543,11 +59631,11 @@ async function startGitCredentialServer(options) {
     });
   });
   removeStaleEndpoint(options.endpoint);
-  await new Promise((resolve13, reject) => {
+  await new Promise((resolve14, reject) => {
     server.once("error", reject);
     server.listen(options.endpoint, () => {
       server.off("error", reject);
-      resolve13();
+      resolve14();
     });
   });
   options.log.info("git.credential_server_listening", { endpoint: options.endpoint });
@@ -59555,7 +59643,7 @@ async function startGitCredentialServer(options) {
     endpoint: options.endpoint,
     [Symbol.asyncDispose]: async () => {
       closing.abort();
-      await new Promise((resolve13) => server.close(() => resolve13()));
+      await new Promise((resolve14) => server.close(() => resolve14()));
       removeStaleEndpoint(options.endpoint);
     }
   };
@@ -59629,13 +59717,13 @@ authorityKeyIdentifier = keyid
 `;
 }
 function openssl(args, cwd) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     (0, import_node_child_process9.execFile)(
       "openssl",
       [...args],
       { cwd, timeout: OPENSSL_TIMEOUT_MS },
       (error61, _stdout, stderr) => {
-        if (error61 === null) resolve13();
+        if (error61 === null) resolve14();
         else
           reject(new Error(`openssl ${args[0] ?? ""} failed: ${stderr.trim() || error61.message}`));
       }
@@ -59812,21 +59900,21 @@ function relayTo(forward, log) {
   };
 }
 function listen(server, target) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     server.once("error", reject);
     const done = () => {
       server.off("error", reject);
-      resolve13();
+      resolve14();
     };
     if (typeof target === "string") server.listen(target, done);
     else server.listen(target.port, target.host, done);
   });
 }
 function close(server, sockets = /* @__PURE__ */ new Set()) {
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     for (const socket of sockets) socket.destroy();
     server.closeAllConnections();
-    server.close(() => resolve13());
+    server.close(() => resolve14());
   });
 }
 function portOf(server) {
@@ -62609,7 +62697,7 @@ async function startNativeIngest(deps) {
   };
   const settleIdle = () => {
     if (workers.size > 0) return;
-    for (const resolve13 of idleWaiters) resolve13();
+    for (const resolve14 of idleWaiters) resolve14();
     idleWaiters.clear();
   };
   const retryDelay = (worker) => {
@@ -62852,7 +62940,7 @@ async function startNativeIngest(deps) {
     sweep: sweep2,
     whenIdle: () => {
       if (workers.size === 0) return Promise.resolve();
-      return new Promise((resolve13) => idleWaiters.add(resolve13));
+      return new Promise((resolve14) => idleWaiters.add(resolve14));
     },
     [Symbol.asyncDispose]: async () => {
       shutdown.abort();
@@ -63000,7 +63088,7 @@ function captureProbe(command, args, options) {
   const launch = directLaunch(command, args, options);
   if (launch === void 0) return Promise.resolve({ stdout: "", stderr: "", exitCode: void 0 });
   const env = platform3 === "win32" ? withWindowsHelper(canonicalWindowsEnvironment(options.env)) : options.env;
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     const limit = options.maxBufferBytes ?? DEFAULT_MAX_BYTES;
     const stdout = [];
     const stderr = [];
@@ -63035,7 +63123,7 @@ function captureProbe(command, args, options) {
       settled2 = true;
       deadlineController.abort();
       options.signal?.removeEventListener("abort", abort);
-      resolve13({
+      resolve14({
         stdout: Buffer.concat(stdout).toString("utf8"),
         stderr: Buffer.concat(stderr).toString("utf8"),
         exitCode
@@ -63167,7 +63255,7 @@ function cursorAccountLabel(output2) {
 function waitForAbort(signal) {
   if (signal.aborted) return Promise.resolve();
   return new Promise(
-    (resolve13) => signal.addEventListener("abort", () => resolve13(), { once: true })
+    (resolve14) => signal.addEventListener("abort", () => resolve14(), { once: true })
   );
 }
 function idlePrompt(signal) {
@@ -63245,14 +63333,14 @@ async function codexLabel(executable, env) {
     windowsVerbatimArguments: launch.windowsVerbatimArguments
   });
   const timeout = AbortSignal.timeout(ACCOUNT_TIMEOUT_MS);
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     let finished = false;
     let buffer = "";
     const finish = (label) => {
       if (finished) return;
       finished = true;
       child.kill();
-      resolve13(label);
+      resolve14(label);
     };
     const send2 = (value2) => {
       child.stdin.write(`${JSON.stringify(value2)}
@@ -63761,11 +63849,11 @@ async function resolveCliEnvironment(options) {
 }
 async function openCliEnvironment(options) {
   const decorate = options.decorate ?? ((env) => env);
-  const resolve13 = async () => {
+  const resolve14 = async () => {
     const resolved = await resolveCliEnvironmentDetailed(options);
     return { env: decorate(resolved.env), source: resolved.source };
   };
-  let state = await resolve13();
+  let state = await resolve14();
   let retryAt = options.clock.now() + DEGRADED_RETRY_MS;
   return {
     current: () => state.env,
@@ -63774,7 +63862,7 @@ async function openCliEnvironment(options) {
       if (state.source === "login_shell" || options.platform === "win32") return false;
       if (options.clock.now() < retryAt) return false;
       retryAt = options.clock.now() + DEGRADED_RETRY_MS;
-      const next = await resolve13();
+      const next = await resolve14();
       const changed = envValue(next.env, "PATH") !== envValue(state.env, "PATH");
       state = next;
       return changed;
@@ -63851,11 +63939,11 @@ async function installVersion2(backendKind, requested, options, signal) {
     }
     return exact;
   }
-  const resolve13 = options.resolveVersion;
-  if (resolve13 === void 0) throw new Error("Latest version lookup is unavailable");
+  const resolve14 = options.resolveVersion;
+  if (resolve14 === void 0) throw new Error("Latest version lookup is unavailable");
   const packageName = packageFor(backendKind).name;
   return checkedVersion(
-    await resolve13(backendKind === "opencode_serve" ? `${packageName}@1` : packageName, signal)
+    await resolve14(backendKind === "opencode_serve" ? `${packageName}@1` : packageName, signal)
   );
 }
 function selection(root, backendKind, version2) {
@@ -65422,8 +65510,8 @@ async function collectStream(stream) {
   return import_node_buffer2.Buffer.concat(chunks);
 }
 function addArchiveEntry(archive, header, bytes) {
-  return new Promise((resolve13, reject) => {
-    archive.entry(header, bytes, (error61) => error61 ? reject(error61) : resolve13());
+  return new Promise((resolve14, reject) => {
+    archive.entry(header, bytes, (error61) => error61 ? reject(error61) : resolve14());
   });
 }
 async function decompressBounded(archiveBytes) {
@@ -65449,7 +65537,7 @@ async function extractTar(tarBytes, destination) {
   const extractor = (0, import_tar_stream.extract)();
   let fileCount = 0;
   let totalBytes = 0;
-  const completion = new Promise((resolve13, reject) => {
+  const completion = new Promise((resolve14, reject) => {
     extractor.on("entry", (header, stream, next) => {
       void extractEntry(header, stream, destination, {
         addFile(size) {
@@ -65464,7 +65552,7 @@ async function extractTar(tarBytes, destination) {
         }
       }).then(next, (error61) => extractor.destroy(error61 instanceof Error ? error61 : new Error(String(error61))));
     });
-    extractor.once("finish", resolve13);
+    extractor.once("finish", resolve14);
     extractor.once("error", reject);
   });
   import_node_stream.Readable.from(tarBytes).pipe(extractor);
@@ -65947,9 +66035,9 @@ async function syncOnce(env, local, onRecorded, signal) {
   return report2;
 }
 function aborted2(signal) {
-  return new Promise((resolve13) => {
-    if (signal.aborted) resolve13(null);
-    else signal.addEventListener("abort", () => resolve13(null), { once: true });
+  return new Promise((resolve14) => {
+    if (signal.aborted) resolve14(null);
+    else signal.addEventListener("abort", () => resolve14(null), { once: true });
   });
 }
 function openMachineSkills(options) {
@@ -66038,11 +66126,11 @@ function openMachineSkills(options) {
       if ((await resolveSkillInvocations(layout, named, "exact")).kind === "resolved") return;
     }
   };
-  const recordedUntilResolved = (named, until) => new Promise((resolve13) => {
+  const recordedUntilResolved = (named, until) => new Promise((resolve14) => {
     const done = () => {
       recordWatchers.delete(check3);
       until.removeEventListener("abort", done);
-      resolve13();
+      resolve14();
     };
     const check3 = () => {
       void resolveSkillInvocations(layout, named, "exact").then((resolution) => {
@@ -66050,7 +66138,7 @@ function openMachineSkills(options) {
       });
     };
     if (until.aborted) {
-      resolve13();
+      resolve14();
       return;
     }
     recordWatchers.add(check3);
@@ -66546,7 +66634,7 @@ async function openWorkspaces(options) {
 
 // src/cli/config.ts
 var import_node_os11 = require("os");
-var import_node_path67 = require("path");
+var import_node_path69 = require("path");
 init_zod();
 
 // src/client/contract.ts
@@ -66964,8 +67052,8 @@ function nextOffsetOf(response) {
 async function pause(ms, signal) {
   const either = AbortSignal.any([signal, AbortSignal.timeout(ms)]);
   if (either.aborted) return;
-  await new Promise((resolve13) => {
-    either.addEventListener("abort", () => resolve13(), { once: true });
+  await new Promise((resolve14) => {
+    either.addEventListener("abort", () => resolve14(), { once: true });
   });
 }
 function jittered(backoff, failures) {
@@ -67274,9 +67362,9 @@ async function sendNativeHookSignal(discoveryPath, hookSignal, signal) {
 
 // src/sessions/index.ts
 var import_node_crypto31 = require("crypto");
-var import_promises66 = require("fs/promises");
+var import_promises67 = require("fs/promises");
 var import_node_os10 = require("os");
-var import_node_path66 = require("path");
+var import_node_path68 = require("path");
 init_runtime_v2();
 
 // src/holder/control-client.ts
@@ -67327,8 +67415,8 @@ function isReply(message2) {
 async function connectHolder(endpoint, token, onEvent) {
   const socket = (0, import_node_net2.connect)(endpoint);
   const pending = /* @__PURE__ */ new Map();
-  const closed = new Promise((resolve13) => socket.once("close", () => resolve13()));
-  const ready = new Promise((resolve13, reject) => {
+  const closed = new Promise((resolve14) => socket.once("close", () => resolve14()));
+  const ready = new Promise((resolve14, reject) => {
     socket.once("error", reject);
     socket.once(
       "close",
@@ -67336,7 +67424,7 @@ async function connectHolder(endpoint, token, onEvent) {
     );
     readMessages(socket, holderMessageSchema, {
       onMessage: (message2) => {
-        if (message2.type === "ready") resolve13(message2.pid);
+        if (message2.type === "ready") resolve14(message2.pid);
         else if (isReply(message2)) {
           const id = message2.id;
           if (id === null) return;
@@ -67351,13 +67439,13 @@ async function connectHolder(endpoint, token, onEvent) {
   const pid = await ready;
   const request2 = (body) => {
     const id = (0, import_node_crypto26.randomUUID)();
-    return new Promise((resolve13, reject) => {
+    return new Promise((resolve14, reject) => {
       const timer = AbortSignal.timeout(REQUEST_TIMEOUT_MS7);
       timer.addEventListener("abort", () => {
         pending.delete(id);
         reject(new RuntimeFault("io_failed", "Holder did not answer"));
       });
-      pending.set(id, resolve13);
+      pending.set(id, resolve14);
       writeMessage(socket, { ...body, id });
     });
   };
@@ -67694,14 +67782,14 @@ async function prepareRunInputs(spec, { source, tmpDir, signal, skills = [] }) {
 var import_node_crypto30 = require("crypto");
 var import_node_fs22 = require("fs");
 var import_node_net3 = require("net");
-var import_node_path65 = require("path");
+var import_node_path67 = require("path");
 init_runtime_v2();
 
 // src/holder/admission.ts
 var import_node_fs19 = require("fs");
-var import_promises60 = require("fs/promises");
+var import_promises61 = require("fs/promises");
 var import_node_os9 = require("os");
-var import_node_path59 = require("path");
+var import_node_path61 = require("path");
 init_constants();
 
 // ../shared/dist/node/local-workspace.js
@@ -67785,18 +67873,12 @@ async function discoverRelocatedWorkspace(search) {
 }
 
 // src/holder/checkout-refresh.ts
+var import_node_path59 = require("path");
+
+// src/holder/claim-once.ts
 var import_node_crypto28 = require("crypto");
 var import_promises58 = require("fs/promises");
 var import_node_path57 = require("path");
-function short(sha) {
-  return sha.slice(0, 12);
-}
-function staleLine(path4, snapshot2, tip) {
-  const checkout = snapshot2 === void 0 ? "is the environment snapshot's checkout" : `is the environment snapshot's checkout of ${snapshot2.branch} (commit ${short(snapshot2.head)})`;
-  const base = snapshot2 === void 0 ? "its upstream" : `origin/${snapshot2.base}`;
-  const remote = tip === void 0 ? "may be ahead" : `is ahead at ${short(tip)}`;
-  return `Note: ${path4} ${checkout}; ${base} ${remote}. Run \`git pull --ff-only\` there before relying on its files.`;
-}
 async function claimOnce(dir, name) {
   try {
     await (0, import_promises58.mkdir)(dir, { recursive: true, mode: 448 });
@@ -67806,6 +67888,199 @@ async function claimOnce(dir, name) {
     return false;
   }
 }
+function claimFirstLease(freshnessDir, path4) {
+  return claimOnce((0, import_node_path57.join)(freshnessDir, "leased"), (0, import_node_crypto28.createHash)("sha256").update(path4).digest("hex"));
+}
+
+// src/holder/requested-checkout.ts
+var import_promises59 = require("fs/promises");
+var import_node_path58 = require("path");
+var REMOTE2 = "origin";
+var REASON_MAX_CHARS = 200;
+function firstLine3(text3) {
+  return (text3.trim().split("\n")[0] ?? "").slice(0, REASON_MAX_CHARS);
+}
+function reasonOf(output2, command) {
+  return firstLine3(output2.stderr) || `git ${command} exited ${output2.exitCode}`;
+}
+function noted(checkout, situation, reason, action) {
+  return {
+    kind: "noted",
+    line: `Note: ${checkout.path} ${situation}: ${reason}. ${action} before relying on its files.`
+  };
+}
+function notSwitched(checkout, current, reason) {
+  const on2 = current ?? "a detached HEAD";
+  return noted(
+    checkout,
+    `is on ${on2}, not ${checkout.branch}, the branch picked for this chat`,
+    reason,
+    `Switch it to ${checkout.branch}`
+  );
+}
+async function clone2(checkout, deps, signal) {
+  const parent = (0, import_node_path58.dirname)(checkout.path);
+  await (0, import_promises59.mkdir)(parent, { recursive: true });
+  await assertValidBranch(deps.git, parent, checkout.branch, signal);
+  const output2 = await deps.git.run(
+    {
+      cwd: parent,
+      args: [
+        "clone",
+        "--quiet",
+        "--no-tags",
+        "--depth=1",
+        "--branch",
+        checkout.branch,
+        "--",
+        checkout.repoUrl,
+        checkout.path
+      ],
+      network: true
+    },
+    signal
+  );
+  if (output2.exitCode === 0) return { kind: "moved", how: "cloned" };
+  return noted(
+    checkout,
+    `is missing, and cloning it on ${checkout.branch}, the branch picked for this chat, failed`,
+    reasonOf(output2, "clone"),
+    `Clone ${checkout.repoUrl} there`
+  );
+}
+var SWITCHED = { kind: "moved", how: "switched" };
+function coversBranch(fetchConfig, branch) {
+  return fetchConfig.split("\n").some(
+    (refspec) => refspec === `+refs/heads/*:refs/remotes/${REMOTE2}/*` || refspec === `+refs/heads/${branch}:refs/remotes/${REMOTE2}/${branch}`
+  );
+}
+async function fetchBranch(checkout, git, shallow, current) {
+  const { branch } = checkout;
+  const tracking = `refs/remotes/${REMOTE2}/${branch}`;
+  const fetchConfig = await git(["config", "--get-all", `remote.${REMOTE2}.fetch`], {
+    readOnly: true
+  });
+  if (!coversBranch(fetchConfig.stdout, branch)) {
+    const added = await git(["remote", "set-branches", "--add", REMOTE2, branch]);
+    if (added.exitCode !== 0) return notSwitched(checkout, current, reasonOf(added, "remote"));
+  }
+  const depth = shallow ? ["--depth=1"] : [];
+  const fetched = await git(
+    ["fetch", "--no-tags", "--quiet", ...depth, REMOTE2, `refs/heads/${branch}:${tracking}`],
+    { network: true }
+  );
+  if (fetched.exitCode !== 0) return notSwitched(checkout, current, reasonOf(fetched, "fetch"));
+  const tip = await git(["rev-parse", "--verify", tracking], { readOnly: true });
+  if (tip.exitCode !== 0) return notSwitched(checkout, current, reasonOf(tip, "rev-parse"));
+  return { kind: "fetched", tip: tip.stdout.trim() };
+}
+async function moveOnto(checkout, git, tip, current) {
+  const { branch } = checkout;
+  const local = await git(["rev-parse", "--verify", "-q", `refs/heads/${branch}`], {
+    readOnly: true
+  });
+  if (local.exitCode !== 0) {
+    const created = await git([
+      "switch",
+      "--quiet",
+      "-c",
+      branch,
+      "--track",
+      `${REMOTE2}/${branch}`
+    ]);
+    return created.exitCode === 0 ? SWITCHED : notSwitched(checkout, current, reasonOf(created, "switch"));
+  }
+  const localHead = local.stdout.trim();
+  const ancestor = localHead === tip || (await git(["merge-base", "--is-ancestor", localHead, tip], { readOnly: true })).exitCode === 0;
+  if (!ancestor) {
+    return notSwitched(
+      checkout,
+      current,
+      `its local ${branch} has diverged from ${REMOTE2}/${branch}`
+    );
+  }
+  const switched = await git(["switch", "--quiet", branch]);
+  if (switched.exitCode !== 0) return notSwitched(checkout, current, reasonOf(switched, "switch"));
+  if (localHead === tip) return SWITCHED;
+  const merged = await git(["merge", "--quiet", "--ff-only", tip]);
+  return merged.exitCode === 0 ? SWITCHED : noted(
+    checkout,
+    `is on ${branch} but behind ${REMOTE2}/${branch}`,
+    reasonOf(merged, "merge"),
+    "Run `git pull --ff-only` there"
+  );
+}
+async function switchTo(checkout, current, operationId, deps, signal) {
+  var _stack = [];
+  try {
+    const cwd = checkout.path;
+    const git = (args, invocation = {}) => deps.git.run({ cwd, args, ...invocation }, signal);
+    await assertValidBranch(deps.git, cwd, checkout.branch, signal);
+    const refs = await git(
+      ["rev-parse", "--path-format=absolute", "--git-common-dir", "--is-shallow-repository"],
+      { readOnly: true }
+    );
+    if (refs.exitCode !== 0) return notSwitched(checkout, current, reasonOf(refs, "rev-parse"));
+    const [commonDir = "", shallow] = refs.stdout.trim().split("\n");
+    const attempt2 = await deps.locks.tryExclusive(commonDir, operationId);
+    if (attempt2.kind === "busy") {
+      return notSwitched(checkout, current, "another git operation holds the checkout");
+    }
+    const _lock = __using(_stack, attempt2.lock, true);
+    const now = await readCheckoutStatus(deps.git, cwd, signal);
+    if (now === null || now.dirty) {
+      return notSwitched(checkout, now?.branch ?? current, "it has uncommitted changes");
+    }
+    const fetched = await fetchBranch(checkout, git, shallow === "true", now.branch);
+    if (fetched.kind !== "fetched") return fetched;
+    const outcome2 = await moveOnto(checkout, git, fetched.tip, now.branch);
+    const after = await readCheckoutStatus(deps.git, cwd, signal);
+    if (after?.branch === checkout.branch) {
+      await recordCheckoutKept(deps.dir, cwd, "requested_branch");
+    }
+    return outcome2;
+  } catch (_) {
+    var _error = _, _hasError = true;
+  } finally {
+    var _promise2 = __callDispose(_stack, _error, _hasError);
+    _promise2 && await _promise2;
+  }
+}
+async function applyRequestedCheckout(checkout, spec, deps, signal) {
+  try {
+    if (!await isCheckout(checkout.path)) return await clone2(checkout, deps, signal);
+    const status = await readCheckoutStatus(deps.git, checkout.path, signal);
+    if (status === null) return notSwitched(checkout, null, "git status failed");
+    if (status.branch === checkout.branch) return { kind: "on_branch" };
+    if (status.dirty) return notSwitched(checkout, status.branch, "it has uncommitted changes");
+    if (!await claimFirstLease(deps.dir, checkout.path)) {
+      return notSwitched(
+        checkout,
+        status.branch,
+        "an earlier conversation on this machine already uses it"
+      );
+    }
+    return await switchTo(checkout, status.branch, `checkout-${spec.runId}`, deps, signal);
+  } catch (error61) {
+    return noted(
+      checkout,
+      `could not be put on ${checkout.branch}, the branch picked for this chat`,
+      firstLine3(error61 instanceof Error ? error61.message : String(error61)) || "unknown error",
+      "Check it"
+    );
+  }
+}
+
+// src/holder/checkout-refresh.ts
+function short(sha) {
+  return sha.slice(0, 12);
+}
+function staleLine(path4, snapshot2, tip) {
+  const checkout = snapshot2 === void 0 ? "is the environment snapshot's checkout" : `is the environment snapshot's checkout of ${snapshot2.branch} (commit ${short(snapshot2.head)})`;
+  const base = snapshot2 === void 0 ? "its upstream" : `origin/${snapshot2.base}`;
+  const remote = tip === void 0 ? "may be ahead" : `is ahead at ${short(tip)}`;
+  return `Note: ${path4} ${checkout}; ${base} ${remote}. Run \`git pull --ff-only\` there before relying on its files.`;
+}
 async function fastForward(freshness, operationId, deps, signal) {
   var _stack = [];
   try {
@@ -67830,10 +68105,7 @@ async function fastForward(freshness, operationId, deps, signal) {
   }
 }
 async function atFirstLease(freshness, spec, deps, signal) {
-  const first = await claimOnce(
-    (0, import_node_path57.join)(deps.dir, "leased"),
-    (0, import_node_crypto28.createHash)("sha256").update(freshness.path).digest("hex")
-  );
+  const first = await claimFirstLease(deps.dir, freshness.path);
   switch (freshness.state) {
     case "current":
     case "kept":
@@ -67859,32 +68131,73 @@ async function checkoutsOf(spec, leaseTargets) {
   if (leaseTargets.length > 0 || spec.projectPath === void 0) return [...leaseTargets];
   return checkoutsUnder(spec.projectPath);
 }
-function createCheckoutRefresh(deps) {
-  return async (spec, leaseTargets, signal) => {
-    if (spec.providerSessionId !== void 0) return void 0;
-    if (!await claimOnce((0, import_node_path57.join)(deps.dir, "conversations"), spec.conversationId)) return void 0;
-    const lines2 = [];
-    for (const target of await checkoutsOf(spec, leaseTargets)) {
-      const freshness = await readCheckoutFreshness(deps.dir, target);
-      if (freshness === null) continue;
-      const outcome2 = await atFirstLease(freshness, spec, deps, signal).catch(
-        () => "noted"
-      );
-      if (outcome2 === "noted") lines2.push(lineFor(freshness));
-      deps.log.info("workspace.refresh", {
+function requestedCheckoutsOf(spec, log) {
+  const roots = spec.approvedWorkspacePaths ?? [];
+  return (spec.requestedCheckouts ?? []).filter((checkout) => {
+    const approved = roots.some((root) => isWithin(root, checkout.path, process.platform));
+    if (!approved) {
+      log.warn("workspace.requested_checkout_outside_workspace", {
         runId: spec.runId,
-        path: freshness.path,
-        state: freshness.state,
-        outcome: outcome2
+        path: checkout.path
       });
     }
+    return approved;
+  });
+}
+async function applyRequestedCheckouts(spec, deps, signal) {
+  const settled2 = /* @__PURE__ */ new Set();
+  const lines2 = [];
+  for (const checkout of requestedCheckoutsOf(spec, deps.log)) {
+    const outcome2 = await applyRequestedCheckout(checkout, spec, deps, signal);
+    deps.log.info("workspace.requested_checkout", {
+      runId: spec.runId,
+      path: checkout.path,
+      branch: checkout.branch,
+      outcome: outcome2.kind,
+      ...outcome2.kind === "moved" ? { how: outcome2.how } : {}
+    });
+    if (outcome2.kind === "on_branch") continue;
+    settled2.add((0, import_node_path59.resolve)(checkout.path));
+    if (outcome2.kind === "noted") lines2.push(outcome2.line);
+  }
+  return { settled: settled2, lines: lines2 };
+}
+async function refreshSnapshotCheckouts(spec, targets, settled2, deps, signal) {
+  const lines2 = [];
+  for (const target of targets) {
+    if (settled2.has((0, import_node_path59.resolve)(target))) continue;
+    const freshness = await readCheckoutFreshness(deps.dir, target);
+    if (freshness === null) continue;
+    const outcome2 = await atFirstLease(freshness, spec, deps, signal).catch(
+      () => "noted"
+    );
+    if (outcome2 === "noted") lines2.push(lineFor(freshness));
+    deps.log.info("workspace.refresh", {
+      runId: spec.runId,
+      path: freshness.path,
+      state: freshness.state,
+      outcome: outcome2
+    });
+  }
+  return lines2;
+}
+function createCheckoutRefresh(deps) {
+  return async (spec, leaseTargets, signal) => {
+    if (spec.providerSessionId !== void 0) return void 0;
+    if (!await claimOnce((0, import_node_path59.join)(deps.dir, "conversations"), spec.conversationId)) return void 0;
+    const requested = await applyRequestedCheckouts(spec, deps, signal);
+    const targets = await checkoutsOf(spec, leaseTargets);
+    const lines2 = [
+      ...requested.lines,
+      ...await refreshSnapshotCheckouts(spec, targets, requested.settled, deps, signal)
+    ];
     return lines2.length === 0 ? void 0 : lines2.join("\n");
   };
 }
 
 // src/holder/lease.ts
-var import_promises59 = require("fs/promises");
-var import_node_path58 = require("path");
+var import_promises60 = require("fs/promises");
+var import_node_path60 = require("path");
 var LEASE_CHECK_EVERY_MS = 5e3;
 var MAX_TRANSIENT_FAILURES = 3;
 var BACKOFF_BASE_MS = 1e3;
@@ -67898,8 +68211,8 @@ function identityFailure(code, workspacePath) {
   return { code, problemCode: "app.workspace.missing", message: MESSAGES[code], workspacePath };
 }
 async function fileIdentity(path4) {
-  const canonical = await (0, import_promises59.realpath)(path4);
-  const info = await (0, import_promises59.stat)(canonical, { bigint: true });
+  const canonical = await (0, import_promises60.realpath)(path4);
+  const info = await (0, import_promises60.stat)(canonical, { bigint: true });
   return `${canonical}:${info.dev}:${info.ino}`;
 }
 async function snapshot(git, path4, signal) {
@@ -67918,7 +68231,7 @@ async function snapshot(git, path4, signal) {
       workspace: await fileIdentity(path4),
       repository: await fileIdentity(commonDir),
       worktree: await fileIdentity(gitDir),
-      commonDir: await (0, import_promises59.realpath)(commonDir)
+      commonDir: await (0, import_promises60.realpath)(commonDir)
     };
   } catch {
     return null;
@@ -67931,7 +68244,7 @@ async function gitValue(git, path4, args, signal) {
 }
 async function pathExists(path4) {
   try {
-    await (0, import_promises59.stat)(path4);
+    await (0, import_promises60.stat)(path4);
     return true;
   } catch (error61) {
     return errnoCode(error61) !== "ENOENT" && errnoCode(error61) !== "ENOTDIR";
@@ -67940,19 +68253,19 @@ async function pathExists(path4) {
 async function hasGitMarker(path4) {
   let directory;
   try {
-    directory = await (0, import_promises59.realpath)(path4);
+    directory = await (0, import_promises60.realpath)(path4);
   } catch {
     return true;
   }
   for (; ; ) {
     try {
-      await (0, import_promises59.stat)((0, import_node_path58.join)(directory, ".git"));
+      await (0, import_promises60.stat)((0, import_node_path60.join)(directory, ".git"));
       return true;
     } catch (error61) {
       const code = errnoCode(error61);
       if (code !== "ENOENT" && code !== "ENOTDIR") return true;
     }
-    const parent = (0, import_node_path58.dirname)(directory);
+    const parent = (0, import_node_path60.dirname)(directory);
     if (parent === directory) return false;
     directory = parent;
   }
@@ -68116,7 +68429,7 @@ function volumeRoot(path4) {
 }
 async function exists4(path4) {
   try {
-    await (0, import_promises60.stat)(path4);
+    await (0, import_promises61.stat)(path4);
     return true;
   } catch {
     return false;
@@ -68124,10 +68437,10 @@ async function exists4(path4) {
 }
 async function inspectReadiness(path4) {
   try {
-    if (!(await (0, import_promises60.stat)(path4)).isDirectory()) {
+    if (!(await (0, import_promises61.stat)(path4)).isDirectory()) {
       return { ready: false, missing: true, message: MESSAGES2.missing };
     }
-    await (0, import_promises60.access)(path4, import_node_fs19.constants.R_OK | import_node_fs19.constants.W_OK | import_node_fs19.constants.X_OK);
+    await (0, import_promises61.access)(path4, import_node_fs19.constants.R_OK | import_node_fs19.constants.W_OK | import_node_fs19.constants.X_OK);
     return { ready: true };
   } catch (error61) {
     const code = errnoCode(error61) ?? "";
@@ -68205,8 +68518,8 @@ async function admitDefaultWorkspace(spec, context, skills) {
   const { env } = context;
   const path4 = resolveAlanDefaultWorkspacePath(env.HOME || env.USERPROFILE || (0, import_node_os9.homedir)());
   try {
-    await (0, import_promises60.mkdir)(path4, { recursive: true, mode: 448 });
-    await (0, import_promises60.access)(path4, import_node_fs19.constants.R_OK | import_node_fs19.constants.W_OK | import_node_fs19.constants.X_OK);
+    await (0, import_promises61.mkdir)(path4, { recursive: true, mode: 448 });
+    await (0, import_promises61.access)(path4, import_node_fs19.constants.R_OK | import_node_fs19.constants.W_OK | import_node_fs19.constants.X_OK);
     return {
       kind: "admitted",
       spec: { ...spec, projectPath: path4 },
@@ -68279,10 +68592,12 @@ async function admitRun(spec, context, signal) {
   };
 }
 var PROBE_TIMEOUT_MS2 = 5e3;
+var CHECKOUT_LOCAL_TIMEOUT_MS = 6e4;
+var CHECKOUT_NETWORK_TIMEOUT_MS = 12e4;
 function createHolderWorkspace(machine, clock, log) {
   const platform3 = machine.platform ?? process.platform;
   const git = createGitRunner({ env: machine.env, platform: platform3, localTimeoutMs: PROBE_TIMEOUT_MS2 });
-  const locks = openRepositoryLocks({ dir: (0, import_node_path59.join)(machine.stateDir, "locks"), clock, platform: platform3 });
+  const locks = openRepositoryLocks({ dir: (0, import_node_path61.join)(machine.stateDir, "locks"), clock, platform: platform3 });
   return {
     admission: {
       env: machine.env,
@@ -68294,7 +68609,7 @@ function createHolderWorkspace(machine, clock, log) {
       ),
       approvedRoots: async () => {
         const approved = await openApprovedPaths({
-          file: (0, import_node_path59.join)(machine.stateDir, "workspaces.json"),
+          file: (0, import_node_path61.join)(machine.stateDir, "workspaces.json"),
           log,
           platform: platform3
         });
@@ -68304,10 +68619,15 @@ function createHolderWorkspace(machine, clock, log) {
     lease: { git, locks, clock, log, platform: platform3 },
     ...machine.refreshesFirstCheckout === true ? {
       refreshFirstCheckout: createCheckoutRefresh({
-        git,
+        git: createGitRunner({
+          env: machine.env,
+          platform: platform3,
+          localTimeoutMs: CHECKOUT_LOCAL_TIMEOUT_MS,
+          networkTimeoutMs: CHECKOUT_NETWORK_TIMEOUT_MS
+        }),
         locks,
         log,
-        dir: (0, import_node_path59.join)(machine.stateDir, "checkout-freshness")
+        dir: (0, import_node_path61.join)(machine.stateDir, "checkout-freshness")
       })
     } : {}
   };
@@ -68335,7 +68655,7 @@ async function respondToTurn(runningRunId, gate, driver, request2) {
 }
 
 // src/holder/session-facts.ts
-var import_promises61 = require("fs/promises");
+var import_promises62 = require("fs/promises");
 var CLI_RSS_CACHE_MS = 1e4;
 var LOGIN_PROBLEM_PREFIX = "cli.auth.";
 function isLoginFailure(result) {
@@ -68361,8 +68681,8 @@ function createSessionFacts(options) {
     const path4 = await resolveCommandOnPath(command, env, platform3);
     if (path4 === null) return null;
     try {
-      const real = await (0, import_promises61.realpath)(path4);
-      const info = await (0, import_promises61.stat)(real);
+      const real = await (0, import_promises62.realpath)(path4);
+      const info = await (0, import_promises62.stat)(real);
       return { command, key: `${real}:${info.ino}:${info.size}:${info.mtimeMs}` };
     } catch {
       return null;
@@ -68449,12 +68769,12 @@ function createSessionFacts(options) {
 init_acp2();
 
 // src/run-log/archive.ts
-var import_promises62 = require("fs/promises");
-var import_node_path60 = require("path");
+var import_promises63 = require("fs/promises");
+var import_node_path62 = require("path");
 init_runtime_v2();
 async function openRunArchive(runsDir) {
-  const path4 = (0, import_node_path60.join)((0, import_node_path60.dirname)(runsDir), "archived-runs.txt");
-  const text3 = await (0, import_promises62.readFile)(path4, "utf8").catch((error61) => {
+  const path4 = (0, import_node_path62.join)((0, import_node_path62.dirname)(runsDir), "archived-runs.txt");
+  const text3 = await (0, import_promises63.readFile)(path4, "utf8").catch((error61) => {
     if (errnoCode(error61) === "ENOENT") return "";
     throw error61;
   });
@@ -68468,7 +68788,7 @@ async function openRunArchive(runsDir) {
     add: async (runIds) => {
       const added = runIds.filter((runId) => !archived.has(runId));
       if (added.length === 0) return;
-      await (0, import_promises62.appendFile)(path4, `
+      await (0, import_promises63.appendFile)(path4, `
 ${added.join("\n")}
 `, { mode: 384 });
       for (const runId of added) archived.add(runId);
@@ -68479,11 +68799,11 @@ ${added.join("\n")}
 // src/run-log/complete.ts
 var import_node_crypto29 = require("crypto");
 var import_node_fs20 = require("fs");
-var import_node_path62 = require("path");
+var import_node_path64 = require("path");
 
 // src/run-log/directory.ts
-var import_promises63 = require("fs/promises");
-var import_node_path61 = require("path");
+var import_promises64 = require("fs/promises");
+var import_node_path63 = require("path");
 init_runtime_v2();
 init_zod();
 var runMetaSchema = external_exports.object({
@@ -68509,17 +68829,17 @@ async function readRunMeta(path4) {
   return read.kind === "ok" ? read.value : null;
 }
 function runDirectory(runsDir, runId) {
-  const dir = (0, import_node_path61.join)(runsDir, runId);
+  const dir = (0, import_node_path63.join)(runsDir, runId);
   return {
     dir,
-    log: (0, import_node_path61.join)(dir, "log.jsonl"),
-    upload: (0, import_node_path61.join)(dir, "upload.json"),
-    meta: (0, import_node_path61.join)(dir, "run.json")
+    log: (0, import_node_path63.join)(dir, "log.jsonl"),
+    upload: (0, import_node_path63.join)(dir, "upload.json"),
+    meta: (0, import_node_path63.join)(dir, "run.json")
   };
 }
 async function isRunClaimed(runsDir, runId) {
   try {
-    return (await (0, import_promises63.stat)(runDirectory(runsDir, runId).log)).size > 0;
+    return (await (0, import_promises64.stat)(runDirectory(runsDir, runId).log)).size > 0;
   } catch (error61) {
     if (errnoCode(error61) === "ENOENT") return false;
     throw error61;
@@ -68528,7 +68848,7 @@ async function isRunClaimed(runsDir, runId) {
 
 // src/run-log/complete.ts
 function writeLogFile(path4, dir, text3) {
-  const temp = (0, import_node_path62.join)(dir, `.log.${(0, import_node_crypto29.randomUUID)()}.tmp`);
+  const temp = (0, import_node_path64.join)(dir, `.log.${(0, import_node_crypto29.randomUUID)()}.tmp`);
   const fd = (0, import_node_fs20.openSync)(temp, "wx", 384);
   try {
     (0, import_node_fs20.writeSync)(fd, text3);
@@ -68557,8 +68877,8 @@ async function writeCompleteRunLog(runsDir, meta3, records) {
 }
 
 // src/run-log/conversation-index.ts
-var import_promises64 = require("fs/promises");
-var import_node_path63 = require("path");
+var import_promises65 = require("fs/promises");
+var import_node_path65 = require("path");
 init_runtime_v2();
 init_zod();
 var ORDINALS_PER_SHARD = 1e3;
@@ -68575,13 +68895,13 @@ var coverageSchema = external_exports.object({
   nextExpectedOrdinal: external_exports.number().int().positive()
 });
 function conversationsDirectory(runsDir) {
-  return (0, import_node_path63.join)((0, import_node_path63.dirname)(runsDir), "conversations");
+  return (0, import_node_path65.join)((0, import_node_path65.dirname)(runsDir), "conversations");
 }
 function indexDirectory(runsDir, conversationId) {
-  return (0, import_node_path63.join)(conversationsDirectory(runsDir), conversationId, "turn-index");
+  return (0, import_node_path65.join)(conversationsDirectory(runsDir), conversationId, "turn-index");
 }
 function shardPath(runsDir, conversationId, ordinal) {
-  return (0, import_node_path63.join)(
+  return (0, import_node_path65.join)(
     indexDirectory(runsDir, conversationId),
     `${Math.floor(ordinal / ORDINALS_PER_SHARD)}.jsonl`
   );
@@ -68590,10 +68910,10 @@ async function indexConversationRun(runsDir, conversationId, ordinal, assistantO
   const nextOrdinal = assistantOrdinal + 1;
   if (nextOrdinal <= ordinal) throw new Error("Assistant order must follow the prompt");
   const path4 = shardPath(runsDir, conversationId, ordinal);
-  await (0, import_promises64.mkdir)((0, import_node_path63.dirname)(path4), { recursive: true, mode: 448 });
-  await (0, import_promises64.appendFile)(path4, `${JSON.stringify({ ordinal, nextOrdinal, runId })}
+  await (0, import_promises65.mkdir)((0, import_node_path65.dirname)(path4), { recursive: true, mode: 448 });
+  await (0, import_promises65.appendFile)(path4, `${JSON.stringify({ ordinal, nextOrdinal, runId })}
 `, { mode: 384 });
-  const coveragePath = (0, import_node_path63.join)((0, import_node_path63.dirname)((0, import_node_path63.dirname)(path4)), "coverage.json");
+  const coveragePath = (0, import_node_path65.join)((0, import_node_path65.dirname)((0, import_node_path65.dirname)(path4)), "coverage.json");
   const coverage = await readJsonFile(coveragePath, coverageSchema);
   const current = coverage.kind === "ok" ? coverage.value : null;
   const next = nextCoverage(current, ordinal, nextOrdinal);
@@ -68608,13 +68928,13 @@ function nextCoverage(current, ordinal, nextOrdinal) {
   return null;
 }
 async function readConversationIndexCoverage(runsDir, conversationId) {
-  const path4 = (0, import_node_path63.join)((0, import_node_path63.dirname)(indexDirectory(runsDir, conversationId)), "coverage.json");
+  const path4 = (0, import_node_path65.join)((0, import_node_path65.dirname)(indexDirectory(runsDir, conversationId)), "coverage.json");
   const result = await readJsonFile(path4, coverageSchema);
   return result.kind === "ok" ? result.value : null;
 }
 async function readConversationRunIndex(runsDir, conversationId, before, limit) {
   const directory = indexDirectory(runsDir, conversationId);
-  const names = await (0, import_promises64.readdir)(directory).catch((error61) => {
+  const names = await (0, import_promises65.readdir)(directory).catch((error61) => {
     if (error61.code === "ENOENT") return [];
     throw error61;
   });
@@ -68623,7 +68943,7 @@ async function readConversationRunIndex(runsDir, conversationId, before, limit)
   ).sort((left, right) => right - left);
   const selected = [];
   for (const shard of shards) {
-    const text3 = await (0, import_promises64.readFile)((0, import_node_path63.join)(directory, `${shard}.jsonl`), "utf8");
+    const text3 = await (0, import_promises65.readFile)((0, import_node_path65.join)(directory, `${shard}.jsonl`), "utf8");
     const records = text3.split("\n").flatMap((line) => {
       if (!line) return [];
       const parsed = indexRecordSchema.parse(JSON.parse(line));
@@ -68648,7 +68968,7 @@ async function readIndexableRun(runsDir, name) {
   return { conversationId: meta3.conversationId, ordinal, assistantOrdinal, runId: runId.data };
 }
 async function readIndexableRuns(runsDir) {
-  const names = await (0, import_promises64.readdir)(runsDir).catch(() => []);
+  const names = await (0, import_promises65.readdir)(runsDir).catch(() => []);
   const byConversation = /* @__PURE__ */ new Map();
   let next = 0;
   const worker = async () => {
@@ -68678,21 +68998,21 @@ async function writeConversationIndex(directory, runs) {
     else lines2.push(line);
     coverage = nextCoverage(coverage, run2.ordinal, nextOrdinal) ?? coverage;
   }
-  await (0, import_promises64.mkdir)((0, import_node_path63.join)(directory, "turn-index"), { recursive: true, mode: 448 });
+  await (0, import_promises65.mkdir)((0, import_node_path65.join)(directory, "turn-index"), { recursive: true, mode: 448 });
   for (const [shard, lines2] of shards) {
-    await (0, import_promises64.writeFile)((0, import_node_path63.join)(directory, "turn-index", `${shard}.jsonl`), `${lines2.join("\n")}
+    await (0, import_promises65.writeFile)((0, import_node_path65.join)(directory, "turn-index", `${shard}.jsonl`), `${lines2.join("\n")}
 `, {
       mode: 384
     });
   }
-  await (0, import_promises64.writeFile)((0, import_node_path63.join)(directory, "coverage.json"), `${JSON.stringify(coverage)}
+  await (0, import_promises65.writeFile)((0, import_node_path65.join)(directory, "coverage.json"), `${JSON.stringify(coverage)}
 `, {
     mode: 384
   });
 }
 async function rebuildConversationIndexes(runsDir) {
   const root = conversationsDirectory(runsDir);
-  const exists6 = await (0, import_promises64.stat)(root).then(
+  const exists6 = await (0, import_promises65.stat)(root).then(
     () => true,
     (error61) => {
       if (errnoCode(error61) === "ENOENT") return false;
@@ -68701,18 +69021,18 @@ async function rebuildConversationIndexes(runsDir) {
   );
   if (exists6) return 0;
   const building = `${root}.rebuilding`;
-  await (0, import_promises64.rm)(building, { recursive: true, force: true });
-  await (0, import_promises64.mkdir)(building, { recursive: true, mode: 448 });
+  await (0, import_promises65.rm)(building, { recursive: true, force: true });
+  await (0, import_promises65.mkdir)(building, { recursive: true, mode: 448 });
   const byConversation = await readIndexableRuns(runsDir);
   for (const [conversationId, runs] of byConversation) {
-    await writeConversationIndex((0, import_node_path63.join)(building, conversationId), runs);
+    await writeConversationIndex((0, import_node_path65.join)(building, conversationId), runs);
   }
-  await (0, import_promises64.rename)(building, root);
+  await (0, import_promises65.rename)(building, root);
   return byConversation.size;
 }
 
 // src/run-log/reader.ts
-var import_promises65 = require("fs/promises");
+var import_promises66 = require("fs/promises");
 init_runtime_v2();
 
 // src/run-log/tail.ts
@@ -68735,7 +69055,7 @@ function firstRecordLength(bytes) {
   return bytes.indexOf(RUN_LOG_RECORD_SEPARATOR) + 1;
 }
 async function openRunLogReader(path4) {
-  const handle = await (0, import_promises65.open)(path4, "r");
+  const handle = await (0, import_promises66.open)(path4, "r");
   const readAt = async (position, length) => {
     const buffer = Buffer.alloc(length);
     const { bytesRead } = await handle.read(buffer, 0, length, position);
@@ -68769,7 +69089,7 @@ async function openRunLogReader(path4) {
   };
 }
 async function readLastRecord(path4) {
-  const handle = await (0, import_promises65.open)(path4, "r").catch(() => null);
+  const handle = await (0, import_promises66.open)(path4, "r").catch(() => null);
   if (handle === null) return null;
   try {
     const { size } = await handle.stat();
@@ -68803,7 +69123,7 @@ var decoder = new TextDecoder();
 
 // src/run-log/writer.ts
 var import_node_fs21 = require("fs");
-var import_node_path64 = require("path");
+var import_node_path66 = require("path");
 init_runtime_v2();
 function lastSeq(fd, size) {
   for (const length of tailWindows(size)) {
@@ -68819,7 +69139,7 @@ function lastSeq(fd, size) {
   throw new RuntimeFault("record_too_large", "Run log tail record is larger than any record");
 }
 function openRunLog(path4, clock) {
-  (0, import_node_fs21.mkdirSync)((0, import_node_path64.dirname)(path4), { recursive: true, mode: 448 });
+  (0, import_node_fs21.mkdirSync)((0, import_node_path66.dirname)(path4), { recursive: true, mode: 448 });
   const fd = (0, import_node_fs21.openSync)(path4, "a+", 384);
   let size = (0, import_node_fs21.fstatSync)(fd).size;
   let seq = lastSeq(fd, size);
@@ -69155,7 +69475,7 @@ async function runHolder({
   try {
     const identity = await readProcessIdentity(process.pid);
     if (identity === null) throw new RuntimeFault("internal", "Cannot read own process identity");
-    const _engines = __using(_stack, recordSpawnedEngines(engineRecordsPath((0, import_node_path65.dirname)(launch.statusPath)), clock, log));
+    const _engines = __using(_stack, recordSpawnedEngines(engineRecordsPath((0, import_node_path67.dirname)(launch.statusPath)), clock, log));
     const holder = {
       state: "idle",
       runId: null,
@@ -69351,16 +69671,16 @@ async function runHolder({
       client.on("error", () => holder.clients.delete(client));
     });
     removeStaleEndpoint(launch.endpoint);
-    await new Promise((resolve13, reject) => {
+    await new Promise((resolve14, reject) => {
       server.once("error", reject);
-      server.listen(launch.endpoint, () => resolve13());
+      server.listen(launch.endpoint, () => resolve14());
     });
     await writeStatus();
     log.info("holder.ready", { conversationId: launch.conversationId, pid: identity.pid });
-    await new Promise((resolve13) => exit.signal.addEventListener("abort", () => resolve13()));
+    await new Promise((resolve14) => exit.signal.addEventListener("abort", () => resolve14()));
     await driver.suspend?.().catch((error61) => log.warn("holder.driver_suspend_failed", { error: error61 }));
     for (const client of holder.clients) client.end();
-    await new Promise((resolve13) => server.close(() => resolve13()));
+    await new Promise((resolve14) => server.close(() => resolve14()));
     (0, import_node_fs22.rmSync)(launch.statusPath, { force: true });
     log.info("holder.suspended", { conversationId: launch.conversationId });
   } catch (_) {
@@ -69449,7 +69769,7 @@ var DEFAULT_MAX_ACTIVE_RUNS = 32;
 var HOLDER_BUSY = "busy";
 async function listIds(dir, schema) {
   const ids = [];
-  for (const name of await (0, import_promises66.readdir)(dir).catch(() => [])) {
+  for (const name of await (0, import_promises67.readdir)(dir).catch(() => [])) {
     const parsed = schema.safeParse(name);
     if (parsed.success) ids.push(parsed.data);
   }
@@ -69463,14 +69783,14 @@ function holderIdentity(status) {
   return command === void 0 ? { pid, startedAt } : { pid, startedAt, command };
 }
 function sessionFiles(paths, conversationId) {
-  const dir = (0, import_node_path66.join)(paths.sessions, conversationId);
-  return { dir, launch: (0, import_node_path66.join)(dir, "launch.json"), status: (0, import_node_path66.join)(dir, "holder.json") };
+  const dir = (0, import_node_path68.join)(paths.sessions, conversationId);
+  return { dir, launch: (0, import_node_path68.join)(dir, "launch.json"), status: (0, import_node_path68.join)(dir, "holder.json") };
 }
 async function removeHolderFiles(files) {
   for (const path4 of [files.launch, files.status, engineRecordsPath(files.dir)]) {
-    await (0, import_promises66.rm)(path4, { force: true });
+    await (0, import_promises67.rm)(path4, { force: true });
   }
-  await (0, import_promises66.rmdir)(files.dir).catch((error61) => {
+  await (0, import_promises67.rmdir)(files.dir).catch((error61) => {
     if (!["ENOENT", "ENOTEMPTY", "EEXIST"].includes(errnoCode(error61) ?? "")) throw error61;
   });
 }
@@ -69660,7 +69980,7 @@ async function openSessions(deps) {
     const meta3 = await readRunMeta(dir.meta);
     const last = await readLastRecord(dir.log);
     if (meta3 === null || last === null) return null;
-    const logged = await (0, import_promises66.stat)(dir.log).catch((error61) => {
+    const logged = await (0, import_promises67.stat)(dir.log).catch((error61) => {
       if (errnoCode(error61) === "ENOENT") return null;
       throw error61;
     });
@@ -69972,7 +70292,7 @@ function loadRuntimeConfig(env = process.env, totalMemoryBytes = (0, import_node
     providerProbes: ALAN_RUNTIME_PROVIDER_PROBES === "on",
     providerToolchain: ALAN_RUNTIME_PROVIDER_NODE !== void 0 && ALAN_RUNTIME_PROVIDER_NPM_CLI !== void 0 ? { node: ALAN_RUNTIME_PROVIDER_NODE, npmCli: ALAN_RUNTIME_PROVIDER_NPM_CLI } : null,
     home,
-    configHome: XDG_CONFIG_HOME ?? (0, import_node_path67.join)(home, ".config"),
+    configHome: XDG_CONFIG_HOME ?? (0, import_node_path69.join)(home, ".config"),
     codexHome: resolveCodexHome(CODEX_HOME, home),
     ...githubProxyConfig({ ALAN_RUNTIME_GITHUB_PROXY, XDG_CONFIG_HOME, GH_CONFIG_DIR }, home),
     gitGatewayUrl: ALAN_RUNTIME_GIT_GATEWAY_URL ?? null,
@@ -69982,13 +70302,13 @@ function loadRuntimeConfig(env = process.env, totalMemoryBytes = (0, import_node
   };
 }
 function resolveCodexHome(configuredHome, home) {
-  return configuredHome ?? (0, import_node_path67.join)(home, ".codex");
+  return configuredHome ?? (0, import_node_path69.join)(home, ".codex");
 }
 function githubProxyConfig(env, home) {
-  const configHome = env.XDG_CONFIG_HOME ?? (0, import_node_path67.join)(home, ".config");
+  const configHome = env.XDG_CONFIG_HOME ?? (0, import_node_path69.join)(home, ".config");
   return {
     githubProxy: env.ALAN_RUNTIME_GITHUB_PROXY === "on",
-    ghConfigDir: env.GH_CONFIG_DIR ?? (0, import_node_path67.join)(configHome, "gh")
+    ghConfigDir: env.GH_CONFIG_DIR ?? (0, import_node_path69.join)(configHome, "gh")
   };
 }
 function serviceEnvironment2(env, profile) {
@@ -70046,9 +70366,9 @@ function takeEnrollmentCodeFromEnv(env = process.env) {
 }
 
 // src/cli/context.ts
-var import_promises67 = require("fs/promises");
+var import_promises68 = require("fs/promises");
 var import_node_os12 = require("os");
-var import_node_path68 = require("path");
+var import_node_path70 = require("path");
 var DESKTOP_BUNDLE_IDS = {
   production: ["com.alan-ai.desktop"],
   staging: ["com.alan-ai.desktop.staging"],
@@ -70088,7 +70408,7 @@ function serviceSpec({ config: config2, paths, self }) {
     profile: config2.profile,
     program: serviceCommand(config2.host, self, launcher),
     environment: config2.serviceEnvironment,
-    logPath: (0, import_node_path68.join)(paths.logs, "service.log"),
+    logPath: (0, import_node_path70.join)(paths.logs, "service.log"),
     associatedBundleIds: DESKTOP_BUNDLE_IDS[config2.profile]
   };
 }
@@ -70096,7 +70416,7 @@ async function installedServiceSpec(ctx) {
   const spec = serviceSpec(ctx);
   if (ctx.config.host === "app") return spec;
   const layout = installLayout(ctx.config.installDir, ctx.config.profile);
-  const installed = await (0, import_promises67.access)(layout.launcher).then(
+  const installed = await (0, import_promises68.access)(layout.launcher).then(
     () => true,
     () => false
   );
@@ -70224,7 +70544,7 @@ var manifestRevisionSchema = external_exports.object({ revision: external_export
 async function manifestRevision(path4) {
   let raw;
   try {
-    raw = JSON.parse(await (0, import_promises68.readFile)(path4, "utf8"));
+    raw = JSON.parse(await (0, import_promises69.readFile)(path4, "utf8"));
   } catch (error61) {
     throw new RuntimeFault("invalid_file", `Cannot read the skill manifest at ${path4}`, {
       cause: error61
@@ -70278,8 +70598,8 @@ async function runSkills(argv) {
 }
 
 // src/cli/commands/doctor.ts
-var import_promises71 = require("fs/promises");
-var import_node_path72 = require("path");
+var import_promises72 = require("fs/promises");
+var import_node_path74 = require("path");
 init_runtime_v2();
 
 // src/identity/credential.ts
@@ -70456,18 +70776,18 @@ async function authorizeDevice(input2) {
 }
 
 // src/identity/enroll.ts
-var import_promises69 = require("fs/promises");
+var import_promises70 = require("fs/promises");
 init_runtime_v2();
 
 // src/identity/installation.ts
 var import_node_crypto33 = require("crypto");
-var import_node_path69 = require("path");
+var import_node_path71 = require("path");
 init_zod();
 var installationFileSchema = external_exports.object({
   installationId: external_exports.uuid()
 });
 function installationPath(paths) {
-  return (0, import_node_path69.join)(paths.stateDir, "installation.json");
+  return (0, import_node_path71.join)(paths.stateDir, "installation.json");
 }
 async function ensureInstallationId(paths) {
   const path4 = installationPath(paths);
@@ -70560,13 +70880,13 @@ async function enrollFromGrantFile(input2) {
     clock: input2.clock,
     access: input2.access
   });
-  await (0, import_promises69.rm)(input2.grantPath, { force: true });
+  await (0, import_promises70.rm)(input2.grantPath, { force: true });
   return machine;
 }
 
 // src/identity/migrate-v1.ts
-var import_promises70 = require("fs/promises");
-var import_node_path70 = require("path");
+var import_promises71 = require("fs/promises");
+var import_node_path72 = require("path");
 init_runtime_v2();
 init_zod();
 var EXIT_POLL_MS = 200;
@@ -70587,11 +70907,11 @@ var ownerLeaseSchema = external_exports.looseObject({ pid: external_exports.numb
 function legacyConfigPath(home, profile) {
   switch (profile) {
     case "production":
-      return (0, import_node_path70.join)(home, ".alan", "agent", "config.json");
+      return (0, import_node_path72.join)(home, ".alan", "agent", "config.json");
     case "staging":
-      return (0, import_node_path70.join)(home, ".alan-staging", "agent", "config.json");
+      return (0, import_node_path72.join)(home, ".alan-staging", "agent", "config.json");
     default:
-      return (0, import_node_path70.join)(home, ".alan-dev", "agent", "config.json");
+      return (0, import_node_path72.join)(home, ".alan-dev", "agent", "config.json");
   }
 }
 async function findLegacyInstall(home, profile) {
@@ -70616,8 +70936,8 @@ async function scrubLegacyInstall(install2) {
   const scrubbed = { ...install2.config, migratedToRuntimeV2: true };
   for (const key of SCRUBBED_KEYS) delete scrubbed[key];
   await writeJsonFileAtomic(`${install2.configPath}.migrated-v1`, scrubbed);
-  await (0, import_promises70.rm)(install2.configPath, { force: true });
-  await (0, import_promises70.rm)(install2.ownerLeasePath, { force: true });
+  await (0, import_promises71.rm)(install2.configPath, { force: true });
+  await (0, import_promises71.rm)(install2.ownerLeasePath, { force: true });
 }
 async function exchangeCredential(deps) {
   const { config: config2 } = deps.install;
@@ -70726,7 +71046,7 @@ async function loadIdentity(paths, options = {}) {
 }
 
 // src/cli/commands/status.ts
-var import_node_path71 = require("path");
+var import_node_path73 = require("path");
 async function serviceStatus(ctx) {
   try {
     return await createServiceManager(ctx.host, ctx.config.profile).status();
@@ -70753,7 +71073,7 @@ async function runtimeState(ctx) {
   const running = await readRunningRuntime(ctx.paths.lock);
   if (running === null) return { state: "offline", pid: null, localApi: null };
   const discovery = await readJsonFile(
-    (0, import_node_path71.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE),
+    (0, import_node_path73.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE),
     localApiDiscoverySchema
   );
   const localApi = discovery.kind === "ok" && discovery.value.pid === running.pid ? {
@@ -70974,7 +71294,7 @@ async function runtimeCheck(ctx, status) {
     return check2("runtime", "warn", "No runtime is running for this profile");
   }
   const client = createRuntimeClient({
-    discoveryPath: (0, import_node_path72.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE)
+    discoveryPath: (0, import_node_path74.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE)
   });
   try {
     const live = await client.status(AbortSignal.timeout(LOCAL_TIMEOUT_MS));
@@ -71001,7 +71321,7 @@ async function runtimeCheck(ctx, status) {
   }
 }
 async function probeHolder(dir, conversationId) {
-  const launch = await readJsonFile((0, import_node_path72.join)(dir, "launch.json"), holderLaunchSchema);
+  const launch = await readJsonFile((0, import_node_path74.join)(dir, "launch.json"), holderLaunchSchema);
   if (launch.kind !== "ok") return null;
   try {
     const reply2 = await withTimeout(
@@ -71026,8 +71346,8 @@ async function probeHolder(dir, conversationId) {
   }
 }
 async function holdersCheck(ctx) {
-  const names = await (0, import_promises71.readdir)(ctx.paths.sessions).catch(() => []);
-  const holders = (await Promise.all(names.map((name) => probeHolder((0, import_node_path72.join)(ctx.paths.sessions, name), name)))).filter((facts) => facts !== null);
+  const names = await (0, import_promises72.readdir)(ctx.paths.sessions).catch(() => []);
+  const holders = (await Promise.all(names.map((name) => probeHolder((0, import_node_path74.join)(ctx.paths.sessions, name), name)))).filter((facts) => facts !== null);
   const dead = holders.filter((holder) => !holder.alive).length;
   return check2(
     "holders",
@@ -71038,10 +71358,10 @@ async function holdersCheck(ctx) {
 }
 async function freeBytesAt(path4) {
   try {
-    const stats = await (0, import_promises71.statfs)(path4);
+    const stats = await (0, import_promises72.statfs)(path4);
     return { path: path4, freeBytes: stats.bavail * stats.bsize };
   } catch (error61) {
-    const parent = (0, import_node_path72.dirname)(path4);
+    const parent = (0, import_node_path74.dirname)(path4);
     if (parent === path4) throw error61;
     return freeBytesAt(parent);
   }
@@ -71059,9 +71379,9 @@ async function diskCheck(ctx) {
   }
 }
 var resolveFromLoginShell = (own2) => resolveCliEnvironment({ env: own2, platform: process.platform });
-async function cliDiscoveryCheck(resolve13) {
+async function cliDiscoveryCheck(resolve14) {
   const own2 = readCliEnvironment();
-  const env = await resolve13(own2);
+  const env = await resolve14(own2);
   const delimiter = process.platform === "win32" ? ";" : ":";
   const ownDirs = new Set((own2.PATH ?? "").split(delimiter));
   const added = (env.PATH ?? "").split(delimiter).filter((dir) => dir.length > 0 && !ownDirs.has(dir));
@@ -71177,7 +71497,7 @@ async function runDoctor(argv, context = cliContext) {
 }
 
 // src/cli/commands/git-credential.ts
-var import_promises72 = require("fs/promises");
+var import_promises73 = require("fs/promises");
 var import_node_net4 = require("net");
 var MAX_RESPONSE_BYTES = 64 * 1024;
 async function readAll(stream) {
@@ -71195,7 +71515,7 @@ function processIo() {
   };
 }
 function askGitCredentialSocket(endpoint, request2, signal) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const socket = (0, import_node_net4.createConnection)(endpoint);
     let buffered = "";
     const fail = (error61) => {
@@ -71222,7 +71542,7 @@ function askGitCredentialSocket(endpoint, request2, signal) {
       signal.removeEventListener("abort", onAbort);
       try {
         const line = buffered.split("\n", 1)[0] ?? "";
-        resolve13(gitCredentialSocketResponseSchema.parse(JSON.parse(line)));
+        resolve14(gitCredentialSocketResponseSchema.parse(JSON.parse(line)));
       } catch (error61) {
         reject(
           new RuntimeFault("io_failed", "the Alan runtime sent an invalid reply", { cause: error61 })
@@ -71287,7 +71607,7 @@ async function configure(argv) {
 }
 async function configureGitGateway(config2, gatewayUrl, signal) {
   const { launcher } = installLayout(config2.installDir, config2.profile);
-  const installed = await (0, import_promises72.access)(launcher).then(
+  const installed = await (0, import_promises73.access)(launcher).then(
     () => true,
     () => false
   );
@@ -71314,7 +71634,7 @@ async function runGitCredential(argv) {
 }
 
 // src/cli/commands/hold.ts
-var import_node_path73 = require("path");
+var import_node_path75 = require("path");
 init_agent2();
 init_runtime_v2();
 async function machineAccess(paths, log, conversationId, transport) {
@@ -71372,7 +71692,7 @@ async function runHold(argv) {
     const config2 = loadRuntimeConfig();
     const paths = runtimePaths(config2.stateDir);
     const log = __using(_stack, openFileLog(
-      (0, import_node_path73.join)(paths.logs, `holder-${launch.value.conversationId}.jsonl`),
+      (0, import_node_path75.join)(paths.logs, `holder-${launch.value.conversationId}.jsonl`),
       config2.logLevel,
       systemClock
     ));
@@ -71383,7 +71703,7 @@ async function runHold(argv) {
     );
     const transport = __using(_stack, createHttpTransport());
     const access7 = await machineAccess(paths, log, launch.value.conversationId, transport);
-    const credentialPath = (0, import_node_path73.join)(paths.tmp, "mcp", `${launch.value.conversationId}.json`);
+    const credentialPath = (0, import_node_path75.join)(paths.tmp, "mcp", `${launch.value.conversationId}.json`);
     const managedMcp = __using(_stack, access7.managedMcp === void 0 ? void 0 : createHelperMcpAccess({
       managedMcp: access7.managedMcp,
       conversationId: launch.value.conversationId,
@@ -71424,7 +71744,7 @@ async function runHold(argv) {
 }
 
 // src/cli/commands/hook.ts
-var import_node_path74 = require("path");
+var import_node_path76 = require("path");
 var RUNTIME_ANSWER_MS = 2e3;
 var DEBUG_VARIABLE = "ALAN_HOOK_DEBUG";
 function flag(argv, name) {
@@ -71456,7 +71776,7 @@ async function forwardHook(argv, io) {
     return "transcript outside provider root";
   }
   const verdict = await io.send(
-    (0, import_node_path74.join)(io.stateDir, LOCAL_API_DISCOVERY_FILE),
+    (0, import_node_path76.join)(io.stateDir, LOCAL_API_DISCOVERY_FILE),
     hookSignal,
     AbortSignal.timeout(RUNTIME_ANSWER_MS)
   );
@@ -71492,7 +71812,7 @@ async function runHook(argv, overrides = {}) {
 }
 
 // src/cli/commands/ingestion-hooks.ts
-var import_promises73 = require("fs/promises");
+var import_promises74 = require("fs/promises");
 var CODEX_TRUST_NOTE = "Codex runs new hooks only after you review them: open /hooks in Codex.";
 function isAction(value2) {
   return value2 === "enable" || value2 === "disable" || value2 === "status";
@@ -71515,7 +71835,7 @@ function errorMessage2(error61) {
   return error61 instanceof Error ? error61.message : String(error61);
 }
 async function exists5(path4) {
-  return (0, import_promises73.access)(path4).then(
+  return (0, import_promises74.access)(path4).then(
     () => true,
     () => false
   );
@@ -71618,10 +71938,10 @@ async function runIntegrationsCommand(argv) {
 }
 
 // src/cli/commands/legacy.ts
-var import_node_path76 = require("path");
+var import_node_path78 = require("path");
 
 // src/cli/commands/setup.ts
-var import_node_path75 = require("path");
+var import_node_path77 = require("path");
 init_zod();
 
 // src/cli/legacy.ts
@@ -71703,7 +72023,7 @@ async function grantFileCredential(argv, grantPath, ctx, deps) {
   return enrollFromGrantFile({
     paths: ctx.paths,
     storeKind: credentialStoreFlag(argv) ?? ctx.config.credentialStore,
-    grantPath: (0, import_node_path75.resolve)(grantPath),
+    grantPath: (0, import_node_path77.resolve)(grantPath),
     clock: deps.clock,
     access: ctx.access
   });
@@ -71779,7 +72099,7 @@ async function runSetup(argv, signal) {
   var _stack = [];
   try {
     const ctx = cliContext();
-    const log = __using(_stack, openFileLog((0, import_node_path75.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
+    const log = __using(_stack, openFileLog((0, import_node_path77.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
     const result = await setupMachine(argv, ctx, {
       enrollment: (apiUrl) => createEnrollmentClient({ apiUrl }),
       isProcessAlive,
@@ -71862,7 +72182,7 @@ async function runToken(argv, signal) {
       );
     }
     const ctx = cliContext();
-    const log = __using(_stack, openFileLog((0, import_node_path76.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
+    const log = __using(_stack, openFileLog((0, import_node_path78.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
     const result = await rotateMachineCredential(ctx, { clock: systemClock, log, signal });
     process.stdout.write(`${rotationMessage(result)}
 `);
@@ -71874,8 +72194,8 @@ async function runToken(argv, signal) {
 }
 
 // src/cli/commands/logout.ts
-var import_promises74 = require("fs/promises");
-var import_node_path77 = require("path");
+var import_promises75 = require("fs/promises");
+var import_node_path79 = require("path");
 init_runtime_v2();
 var RUNTIME_EXIT_WAIT_MS = 35e3;
 var TURN_END_WAIT_MS = 3e4;
@@ -71934,9 +72254,9 @@ async function stopHolder(launch, deps, outcome2) {
 }
 async function stopHeldRuns(ctx, deps, outcome2 = "aborted") {
   const stopped = [];
-  for (const name of await (0, import_promises74.readdir)(ctx.paths.sessions).catch(() => [])) {
+  for (const name of await (0, import_promises75.readdir)(ctx.paths.sessions).catch(() => [])) {
     const launch = await readJsonFile(
-      (0, import_node_path77.join)(ctx.paths.sessions, name, "launch.json"),
+      (0, import_node_path79.join)(ctx.paths.sessions, name, "launch.json"),
       holderLaunchSchema
     );
     if (launch.kind !== "ok") continue;
@@ -71973,13 +72293,13 @@ async function forgetMachineLocally(ctx) {
   const machine = await readMachineFile(ctx.paths);
   if (machine === null) return;
   await credentialStoreFor(ctx.paths, machine.credentialStore, ctx.access).clear();
-  await (0, import_promises74.rm)(ctx.paths.machine, { force: true });
+  await (0, import_promises75.rm)(ctx.paths.machine, { force: true });
 }
 async function runLogout(argv, signal) {
   var _stack = [];
   try {
     const ctx = cliContext();
-    const log = __using(_stack, openFileLog((0, import_node_path77.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
+    const log = __using(_stack, openFileLog((0, import_node_path79.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
     const result = await logoutMachine(argv, ctx, {
       api: (apiUrl, accessToken) => createApiClient({ apiUrl, accessToken }),
       stopHeldRuns,
@@ -71997,7 +72317,7 @@ async function runLogout(argv, signal) {
 
 // src/cli/commands/run.ts
 var import_node_fs24 = require("fs");
-var import_node_path81 = require("path");
+var import_node_path83 = require("path");
 
 // src/local-api/app-attachments.ts
 function createAppAttachments(clock) {
@@ -72037,7 +72357,7 @@ function createRunAppends() {
     const pending = waiters.get(runId);
     if (pending === void 0) return;
     waiters.delete(runId);
-    for (const resolve13 of pending) resolve13();
+    for (const resolve14 of pending) resolve14();
   };
   return {
     notify: wake,
@@ -72055,13 +72375,13 @@ function createRunAppends() {
     },
     nextAppend: (runId, signal) => {
       if (signal.aborted) return Promise.resolve();
-      return new Promise((resolve13) => {
+      return new Promise((resolve14) => {
         const done = () => {
           signal.removeEventListener("abort", done);
           const pending2 = waiters.get(runId);
           pending2?.delete(done);
           if (pending2?.size === 0) waiters.delete(runId);
-          resolve13();
+          resolve14();
         };
         const pending = waiters.get(runId) ?? /* @__PURE__ */ new Set();
         pending.add(done);
@@ -72074,9 +72394,9 @@ function createRunAppends() {
 
 // src/local-api/server.ts
 var import_node_crypto35 = require("crypto");
-var import_promises75 = require("fs/promises");
+var import_promises76 = require("fs/promises");
 var import_node_http4 = require("http");
-var import_node_path78 = require("path");
+var import_node_path80 = require("path");
 
 // src/local-api/guard.ts
 var import_node_crypto34 = require("crypto");
@@ -72153,11 +72473,11 @@ id: ${event.id}
 ${data}
 `);
   if (accepted || res.destroyed) return;
-  await new Promise((resolve13) => {
+  await new Promise((resolve14) => {
     const done = () => {
       res.off("drain", done);
       res.off("close", done);
-      resolve13();
+      resolve14();
     };
     res.once("drain", done);
     res.once("close", done);
@@ -72385,9 +72705,9 @@ async function readChangedTurn(deps, conversationId, runId, slot) {
 }
 async function nextChangedRuns(bell, signal) {
   if (bell.pending.size === 0) {
-    await new Promise((resolve13) => {
-      bell.wake = resolve13;
-      if (signal.aborted || bell.pending.size > 0) resolve13();
+    await new Promise((resolve14) => {
+      bell.wake = resolve14;
+      if (signal.aborted || bell.pending.size > 0) resolve14();
     });
     bell.wake = void 0;
   }
@@ -72704,9 +73024,9 @@ var streamStatus = async ({ feed, appAttachments }, { res, signal }) => {
       latest = event;
       writing = writing.then(flush);
     }));
-    await new Promise((resolve13) => {
-      if (signal.aborted) resolve13();
-      signal.addEventListener("abort", () => resolve13(), { once: true });
+    await new Promise((resolve14) => {
+      if (signal.aborted) resolve14();
+      signal.addEventListener("abort", () => resolve14(), { once: true });
     });
     await writing;
   } catch (_) {
@@ -73029,11 +73349,11 @@ function localRequestSignal(path4, closed) {
   ]);
 }
 async function listenOnLoopback(server) {
-  await new Promise((resolve13, reject) => {
+  await new Promise((resolve14, reject) => {
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       server.off("error", reject);
-      resolve13();
+      resolve14();
     });
   }).catch((error61) => {
     throw new RuntimeFault("io_failed", "The local API could not listen on loopback", {
@@ -73048,7 +73368,7 @@ async function listenOnLoopback(server) {
 }
 async function closeServer(server) {
   server.closeAllConnections();
-  await new Promise((resolve13) => server.close(() => resolve13()));
+  await new Promise((resolve14) => server.close(() => resolve14()));
 }
 async function serveLocalApi(deps) {
   const limits = { ...DEFAULT_LIMITS, ...deps.limits };
@@ -73119,7 +73439,7 @@ async function serveLocalApi(deps) {
     startedAtMs,
     runtimeVersion: deps.runtimeVersion
   };
-  const discoveryPath = (0, import_node_path78.join)(deps.stateDir, LOCAL_API_DISCOVERY_FILE);
+  const discoveryPath = (0, import_node_path80.join)(deps.stateDir, LOCAL_API_DISCOVERY_FILE);
   await writeJsonFileAtomic(discoveryPath, discovery);
   const followers = startMaintenance({
     everyMs: limits.refreshEveryMs,
@@ -73153,7 +73473,7 @@ async function serveLocalApi(deps) {
       await watchedStatus[Symbol.asyncDispose]();
       const current = await readJsonFile(discoveryPath, localApiDiscoverySchema);
       if (current.kind === "ok" && current.value.token === token) {
-        await (0, import_promises75.rm)(discoveryPath, { force: true });
+        await (0, import_promises76.rm)(discoveryPath, { force: true });
       }
       await closeServer(server);
       log.info("local_api.closed", {});
@@ -73238,7 +73558,7 @@ function machineFeatureActions(deps) {
 }
 
 // src/cli/commands/machine-plane.ts
-var import_node_path80 = require("path");
+var import_node_path82 = require("path");
 
 // src/link/index.ts
 init_runtime_v2();
@@ -75805,9 +76125,9 @@ var Socket2 = class extends Emitter {
    * @return a Promise that will be fulfilled when the server acknowledges the event
    */
   emitWithAck(ev, ...args) {
-    return new Promise((resolve13, reject) => {
+    return new Promise((resolve14, reject) => {
       const fn = (arg1, arg2) => {
-        return arg1 ? reject(arg1) : resolve13(arg2);
+        return arg1 ? reject(arg1) : resolve14(arg2);
       };
       fn.withError = true;
       args.push(fn);
@@ -76906,7 +77226,7 @@ function refusalFailure(refusal2) {
 }
 
 // src/link/probe.ts
-var import_promises76 = require("dns/promises");
+var import_promises77 = require("dns/promises");
 var import_node_net5 = require("net");
 var import_node_tls2 = require("tls");
 var PROBE_TIMEOUT_MS4 = 5e3;
@@ -76926,9 +77246,9 @@ async function connectOnce(url3, clock) {
   const timer = new AbortController();
   try {
     return await Promise.race([
-      new Promise((resolve13) => {
-        socket.once(ready, () => resolve13(null));
-        socket.once("error", (error61) => resolve13(classifyTransportFailure(error61)));
+      new Promise((resolve14) => {
+        socket.once(ready, () => resolve14(null));
+        socket.once("error", (error61) => resolve14(classifyTransportFailure(error61)));
       }),
       clock.sleep(PROBE_TIMEOUT_MS4, timer.signal).then(
         () => "connection_timeout",
@@ -76942,7 +77262,7 @@ async function connectOnce(url3, clock) {
 }
 async function probeEndpoint(url3, clock) {
   try {
-    await (0, import_promises76.lookup)(url3.hostname);
+    await (0, import_promises77.lookup)(url3.hostname);
   } catch (error61) {
     const reason = classifyTransportFailure(error61);
     return reason === "other" ? "dns" : reason;
@@ -77391,7 +77711,7 @@ function createReconciler(host, lifecycle, log, signal) {
 }
 
 // src/uploader/index.ts
-var import_promises77 = require("fs/promises");
+var import_promises78 = require("fs/promises");
 init_runtime_v2();
 init_zod();
 var RETRY_DELAYS_MS = [250, 500, 1e3, 2e3, 5e3, 1e4, 3e4];
@@ -77539,7 +77859,7 @@ function startUploader({ api, runsDir, clock, log, archive }) {
   };
   const unsealedRunIds = async () => {
     const runIds = [];
-    for (const name of await (0, import_promises77.readdir)(runsDir).catch(() => [])) {
+    for (const name of await (0, import_promises78.readdir)(runsDir).catch(() => [])) {
       const runId = runIdSchema.safeParse(name);
       if (runId.success && !sealed.has(runId.data) && !archive?.has(runId.data))
         runIds.push(runId.data);
@@ -77554,13 +77874,13 @@ function startUploader({ api, runsDir, clock, log, archive }) {
     const dir = runDirectory(runsDir, runId);
     const progress = await readJsonFile(dir.upload, uploadProgressSchema);
     if (progress.kind !== "ok" || !progress.value.sealed) return false;
-    const sealedAt = (await (0, import_promises77.stat)(dir.upload)).mtimeMs;
+    const sealedAt = (await (0, import_promises78.stat)(dir.upload)).mtimeMs;
     if (clock.now() - sealedAt < options.sealedForMs) return false;
     return (await readLastRecord(dir.log))?.update.sessionUpdate === "_alan/run.ended";
   };
   const archivable = async (options) => {
     const found = [];
-    for (const name of await (0, import_promises77.readdir)(runsDir).catch(() => [])) {
+    for (const name of await (0, import_promises78.readdir)(runsDir).catch(() => [])) {
       const runId = runIdSchema.safeParse(name);
       if (!runId.success || archive?.has(runId.data)) continue;
       try {
@@ -77761,12 +78081,12 @@ async function startMachineNativeIngest(deps) {
 }
 
 // src/cli/commands/run-updates.ts
-var import_node_path79 = require("path");
+var import_node_path81 = require("path");
 init_runtime_v2();
 var UPDATE_CHECK_EVERY_MS = 6 * 60 * 60 * 1e3;
 var DEFERRED_RETRY_MS = 5 * 60 * 1e3;
 function isInstalledBundle(layout, bundlePath) {
-  return (0, import_node_path79.resolve)((0, import_node_path79.dirname)((0, import_node_path79.dirname)(bundlePath))) === (0, import_node_path79.resolve)(layout.versions);
+  return (0, import_node_path81.resolve)((0, import_node_path81.dirname)((0, import_node_path81.dirname)(bundlePath))) === (0, import_node_path81.resolve)(layout.versions);
 }
 async function settleUpgradeOnStart({
   layout,
@@ -77873,7 +78193,7 @@ function startRuntimeUpdates(options) {
       layout,
       release: npmRelease,
       tarball: await options.downloader.download(npmRelease.dist.tarball, signal),
-      tmpDir: (0, import_node_path79.join)(layout.root, ".downloads")
+      tmpDir: (0, import_node_path81.join)(layout.root, ".downloads")
     });
     await lifecycle.exclusive("upgrade", async () => {
       await recordPendingUpgrade(layout, currentVersion2, version2, clock.now());
@@ -78104,7 +78424,7 @@ async function startMachinePlane(deps) {
                 [ALAN_MANAGED_SESSION_ENV]: "1"
               },
               cwd: paths.stateDir,
-              outputPath: (0, import_node_path80.join)(paths.logs, "holders.log")
+              outputPath: (0, import_node_path82.join)(paths.logs, "holders.log")
             },
             deps.holderIsolation
           );
@@ -78141,7 +78461,7 @@ async function startMachinePlane(deps) {
         }),
         local: { home: config2.home, machineId: identity.machineId },
         // Only a cloud sandbox's runtime has a git gateway; a person's own ~/.codex is theirs.
-        ...config2.gitGatewayUrl === null ? {} : { codexSkillsDir: (0, import_node_path80.join)(config2.codexHome, "skills") },
+        ...config2.gitGatewayUrl === null ? {} : { codexSkillsDir: (0, import_node_path82.join)(config2.codexHome, "skills") },
         log
       })
     );
@@ -78339,7 +78659,7 @@ async function startMachinePlane(deps) {
             git: createGitRunner({ env: cliEnvironment }),
             clock,
             log,
-            dir: (0, import_node_path80.join)(paths.stateDir, "checkout-freshness")
+            dir: (0, import_node_path82.join)(paths.stateDir, "checkout-freshness")
           },
           stopped.signal
         );
@@ -78601,11 +78921,11 @@ function createMachineSlot(deps) {
 
 // src/cli/commands/run-exit.ts
 function firstAborted(signals) {
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     for (const reason of ["stop", "restart"]) {
       const signal = signals[reason];
-      if (signal.aborted) resolve13(reason);
-      signal.addEventListener("abort", () => resolve13(reason), { once: true });
+      if (signal.aborted) resolve14(reason);
+      signal.addEventListener("abort", () => resolve14(reason), { once: true });
     }
   });
 }
@@ -78633,7 +78953,7 @@ function lockWaitMs(argv) {
 }
 async function openManagedProviders(config2, paths) {
   const providerEnv = readCliEnvironment();
-  const bundledNpm = (0, import_node_path81.join)((0, import_node_path81.dirname)(process.execPath), "npm", "bin", "npm-cli.js");
+  const bundledNpm = (0, import_node_path83.join)((0, import_node_path83.dirname)(process.execPath), "npm", "bin", "npm-cli.js");
   const providerToolchain = config2.providerToolchain ?? (process.platform === "win32" && (0, import_node_fs24.existsSync)(bundledNpm) ? { node: process.execPath, npmCli: bundledNpm } : null);
   const npmPath = providerToolchain?.node ?? await resolveCommandOnPath("npm", providerEnv, process.platform);
   const npmOptions = npmPath === null || process.platform === "win32" && providerToolchain === null ? null : {
@@ -78641,7 +78961,7 @@ async function openManagedProviders(config2, paths) {
     ...providerToolchain === null ? {} : { argsBeforeNpm: [providerToolchain.npmCli] },
     env: providerEnv
   };
-  const providerNodeDir = providerToolchain?.node === void 0 ? void 0 : (0, import_node_path81.dirname)(providerToolchain.node);
+  const providerNodeDir = providerToolchain?.node === void 0 ? void 0 : (0, import_node_path83.dirname)(providerToolchain.node);
   const probeEnv = providerNodeDir === void 0 ? providerEnv : {
     ...providerEnv,
     PATH: `${providerNodeDir}${pathDelimiter(process.platform)}${envValue(providerEnv, "PATH")}`
@@ -78651,7 +78971,7 @@ async function openManagedProviders(config2, paths) {
     throw new Error("Provider installer is unavailable on this computer");
   };
   const managed = createManagedProviderClis({
-    root: (0, import_node_path81.join)(paths.stateDir, "provider-clis"),
+    root: (0, import_node_path83.join)(paths.stateDir, "provider-clis"),
     resolveVersion: npmOptions === null ? unavailable : createNpmVersionResolver(npmOptions),
     installPackage: npmOptions === null ? unavailable : createNpmPackageInstaller(npmOptions),
     probe: (executable, backendKind) => probeManagedProvider(executable, backendKind, canonicalProbeEnv)
@@ -78683,7 +79003,7 @@ async function runService(argv, stop, restart = new AbortController().signal) {
       waitMs: lockWaitMs(argv),
       signal: stop
     }));
-    const log = __using(_stack, openFileLog((0, import_node_path81.join)(paths.logs, "runtime.jsonl"), config2.logLevel, clock));
+    const log = __using(_stack, openFileLog((0, import_node_path83.join)(paths.logs, "runtime.jsonl"), config2.logLevel, clock));
     const lifecycle = createLifecycleQueue({ clock, log });
     const install2 = installLayout(config2.installDir, config2.profile);
     const bundlePath = process.argv[1] ?? "";
@@ -78717,7 +79037,7 @@ async function runService(argv, stop, restart = new AbortController().signal) {
         openCliEnvironment({
           env: readCliEnvironment(),
           platform: process.platform,
-          lastKnownGoodFile: (0, import_node_path81.join)(paths.stateDir, "login-path.json"),
+          lastKnownGoodFile: (0, import_node_path83.join)(paths.stateDir, "login-path.json"),
           clock,
           decorate: (env) => withPackagedAlanCodeEngine(env, bundlePath, process.platform)
         })
@@ -78894,17 +79214,17 @@ async function runServiceCommand(argv, ctx = cliContext()) {
 }
 
 // src/cli/commands/upgrade.ts
-var import_promises78 = require("fs/promises");
-var import_node_path82 = require("path");
+var import_promises79 = require("fs/promises");
+var import_node_path84 = require("path");
 function isNotNewer(version2, installed) {
   return installed !== null && isReleaseVersion(version2) && isReleaseVersion(installed) && compareVersions(version2, installed) <= 0;
 }
 async function installFromSource(source) {
   const { layout, from, ifNewer } = source;
-  const isTarball = (await (0, import_promises78.stat)(from)).isFile();
-  const downloads = (0, import_node_path82.join)(layout.root, ".downloads");
-  if (isTarball) await (0, import_promises78.mkdir)(downloads, { recursive: true, mode: 448 });
-  const scratch = isTarball ? await (0, import_promises78.mkdtemp)((0, import_node_path82.join)(downloads, "upgrade-")) : null;
+  const isTarball = (await (0, import_promises79.stat)(from)).isFile();
+  const downloads = (0, import_node_path84.join)(layout.root, ".downloads");
+  if (isTarball) await (0, import_promises79.mkdir)(downloads, { recursive: true, mode: 448 });
+  const scratch = isTarball ? await (0, import_promises79.mkdtemp)((0, import_node_path84.join)(downloads, "upgrade-")) : null;
   try {
     const sourceDir = scratch === null ? from : await extractPackageTarball(from, scratch);
     const version2 = await readPackageVersion(sourceDir);
@@ -78912,7 +79232,7 @@ async function installFromSource(source) {
     if (ifNewer && isNotNewer(version2, installed)) return { kind: "skipped", version: version2, installed };
     return { kind: "installed", ...await installVersion(layout, sourceDir) };
   } finally {
-    if (scratch !== null) await (0, import_promises78.rm)(scratch, { recursive: true, force: true });
+    if (scratch !== null) await (0, import_promises79.rm)(scratch, { recursive: true, force: true });
   }
 }
 async function runUpgrade(argv) {
@@ -78924,7 +79244,7 @@ async function runUpgrade(argv) {
   const layout = installLayout(config2.installDir, config2.profile);
   const outcome2 = await installFromSource({
     layout,
-    from: (0, import_node_path82.resolve)(from),
+    from: (0, import_node_path84.resolve)(from),
     ifNewer: hasFlag(argv, "--if-newer")
   });
   if (outcome2.kind === "skipped") {