@alan-ai-hq/agent-manager-darwin-arm64 0.1.151 → 0.1.153

package/alan-agent.cjs

@@ -19801,6 +19801,10 @@ var init_agent_context = __esm({
       installCommand: external_exports.string().max(8192).nullable(),
       startCommand: external_exports.string().max(8192).nullable(),
       imageBuildId: external_exports.guid().nullable(),
+      /** The repository whose `.alan/` the image build reads; a branch build swaps only its branch. */
+      primaryRepository: machinePathSchema.optional(),
+      /** Where install steps and the start command run: the repository, or the workspace with several. */
+      setupDirectory: machinePathSchema.optional(),
       /** The newest build when it is not the one sessions boot from. */
       pendingBuild: agentContextBuildSchema.optional(),
       /** Saved variable names; values never leave the API. */
@@ -20371,7 +20375,7 @@ var init_run_context = __esm({
 });
 
 // ../shared/dist/runtime-v2/desired-state.js
-var repoLocalPathSchema, requestedCheckoutSchema, runSpecSchema, desiredRunSchema, desiredStateSchema;
+var repoLocalPathSchema, requestedCheckoutSchema, runSpecSchema, desiredRunSchema, pendingUploadSchema, desiredStateSchema;
 var init_desired_state = __esm({
   "../shared/dist/runtime-v2/desired-state.js"() {
     "use strict";
@@ -20441,10 +20445,17 @@ var init_desired_state = __esm({
       spec: runSpecSchema,
       abortRequested: external_exports.boolean()
     });
+    pendingUploadSchema = external_exports.object({
+      runId: runIdSchema,
+      conversationId: conversationIdSchema,
+      admittedOffset: external_exports.number().int().nonnegative()
+    });
     desiredStateSchema = external_exports.object({
       runs: external_exports.array(desiredRunSchema),
       /** The machine's saved workspaces; replaces the previous server list on every read. */
-      approvedWorkspacePaths: external_exports.array(machinePathSchema).max(2e3).optional()
+      approvedWorkspacePaths: external_exports.array(machinePathSchema).max(2e3).optional(),
+      /** Absent from an older server: the runtime then uploads only on its own doorbell. */
+      pendingUploads: external_exports.array(pendingUploadSchema).optional()
     });
   }
 });
@@ -22720,7 +22731,7 @@ function plan(command, args, options) {
 function captureOutput(command, args, options) {
   const launch = plan(command, args, options);
   if (launch === void 0) return Promise.resolve(NEVER_STARTED);
-  return new Promise((resolve14) => {
+  return new Promise((resolve13) => {
     (0, import_child_process.execFile)(
       launch.file,
       [...launch.args],
@@ -22734,7 +22745,7 @@ function captureOutput(command, args, options) {
       },
       (error61, stdout, stderr) => {
         const code = error61 && typeof error61.code === "number" ? error61.code : error61 ? void 0 : 0;
-        resolve14({ stdout, stderr, exitCode: code });
+        resolve13({ stdout, stderr, exitCode: code });
       }
     );
   });
@@ -22776,18 +22787,18 @@ function decode3(bytes, start, end) {
 }
 async function linuxStartTicks(pid) {
   try {
-    const stat23 = await (0, import_promises9.readFile)(`/proc/${pid}/stat`, "utf8");
-    const fields = stat23.slice(stat23.lastIndexOf(")") + 2).split(" ");
+    const stat22 = await (0, import_promises9.readFile)(`/proc/${pid}/stat`, "utf8");
+    const fields = stat22.slice(stat22.lastIndexOf(")") + 2).split(" ");
     return fields[19];
   } catch {
     return void 0;
   }
 }
 function psStartTime(pid) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve13) => {
     (0, import_child_process2.execFile)("ps", ["-o", "lstart=", "-p", String(pid)], { timeout: 2e3 }, (error61, stdout) => {
       const text3 = stdout.trim();
-      resolve14(error61 || !text3 ? void 0 : text3);
+      resolve13(error61 || !text3 ? void 0 : text3);
     });
   });
 }
@@ -22816,12 +22827,12 @@ function parseProcessList(text3) {
 }
 function listProcesses(platform3 = process.platform) {
   if (platform3 === "win32") return Promise.resolve([]);
-  return new Promise((resolve14) => {
+  return new Promise((resolve13) => {
     (0, import_child_process3.execFile)(
       "ps",
       ["-A", "-o", "pid=,ppid=,pgid=,lstart="],
       { timeout: 5e3, maxBuffer: 8 * 1024 * 1024 },
-      (error61, stdout) => resolve14(error61 ? [] : parseProcessList(stdout))
+      (error61, stdout) => resolve13(error61 ? [] : parseProcessList(stdout))
     );
   });
 }
@@ -22861,11 +22872,11 @@ async function taskkill(pid, options) {
     stdio: "ignore",
     windowsHide: true
   });
-  const exited = new Promise((resolve14) => {
-    killer.once("error", (error210) => resolve14(error210));
+  const exited = new Promise((resolve13) => {
+    killer.once("error", (error210) => resolve13(error210));
     killer.once(
       "exit",
-      (code, signal) => resolve14(code === 0 ? void 0 : new Error(`taskkill failed: exit ${code}, signal ${signal}`))
+      (code, signal) => resolve13(code === 0 ? void 0 : new Error(`taskkill failed: exit ${code}, signal ${signal}`))
     );
   });
   const timedOut = clock.sleep(options.timeoutMs ?? DEFAULT_TASKKILL_TIMEOUT_MS, timeout.signal).then(() => new Error("taskkill timed out")).catch(() => void 0);
@@ -22908,9 +22919,9 @@ function signalGroup(pgid, signal, onError) {
     if (!isAlreadyDead(error61)) onError?.("group", error61);
   }
 }
-function liveEscapedGroups(snapshot2, rootPid, remembered) {
-  const leaders = new Map(snapshot2.map((entry) => [entry.pid, entry.startedAt]));
-  const groups = new Set(escapedGroups(snapshot2, rootPid).map((group) => group.pgid));
+function liveEscapedGroups(snapshot, rootPid, remembered) {
+  const leaders = new Map(snapshot.map((entry) => [entry.pid, entry.startedAt]));
+  const groups = new Set(escapedGroups(snapshot, rootPid).map((group) => group.pgid));
   for (const [pgid, startedAt] of remembered) {
     if (leaders.get(pgid) === startedAt) groups.add(pgid);
   }
@@ -23121,10 +23132,10 @@ function spawnCli(options) {
 function waitForSpawn(child, command) {
   if (isWindowsJob(child)) return waitForWindowsJob(child, command);
   if (child.pid !== void 0) return Promise.resolve();
-  return new Promise((resolve14, reject) => {
+  return new Promise((resolve13, reject) => {
     const onSpawn = () => {
       child.off("error", onError);
-      resolve14();
+      resolve13();
     };
     const onError = (error61) => {
       child.off("spawn", onSpawn);
@@ -24903,6 +24914,7 @@ function settleOpenToolCalls(state) {
     if (outlivesTheTurn(entry))
       continue;
     entry.status = "cancelled";
+    entry.lastUpdateIndex = state.updateCount;
   }
 }
 function applyTool(state, index, update) {
@@ -25614,15 +25626,6 @@ var init_transcript_fold = __esm({
   }
 });
 
-// ../shared/dist/agent/acp/transcript-live.js
-var TRANSCRIPT_LIVE_BATCH_BYTES;
-var init_transcript_live = __esm({
-  "../shared/dist/agent/acp/transcript-live.js"() {
-    "use strict";
-    TRANSCRIPT_LIVE_BATCH_BYTES = 32 * 1024;
-  }
-});
-
 // ../shared/dist/agent/acp/index.js
 var init_acp = __esm({
   "../shared/dist/agent/acp/index.js"() {
@@ -25643,7 +25646,6 @@ var init_acp = __esm({
     init_transcript_fold();
     init_transcript_http();
     init_transcript_ingestion();
-    init_transcript_live();
     init_types2();
   }
 });
@@ -26780,8 +26782,8 @@ function readMediaFiles(candidates2, cwd, mimeByExt, maxBytes) {
     seen.add(path4);
     const mimeType = mimeByExt[(0, import_path3.extname)(path4).toLowerCase()];
     if (!mimeType) continue;
-    const stat23 = (0, import_fs4.statSync)(path4);
-    if (!stat23.isFile() || stat23.size <= 0 || stat23.size > maxBytes) continue;
+    const stat22 = (0, import_fs4.statSync)(path4);
+    if (!stat22.isFile() || stat22.size <= 0 || stat22.size > maxBytes) continue;
     files.push({ path: path4, mimeType, buffer: (0, import_fs4.readFileSync)(path4) });
   }
   return files;
@@ -26856,8 +26858,8 @@ function createJsonRpcPeer(writer, handlers) {
     },
     request: (method, params = {}) => {
       const id = counter.next++;
-      return new Promise((resolve14, reject) => {
-        pending.set(id, { method, resolve: resolve14, reject });
+      return new Promise((resolve13, reject) => {
+        pending.set(id, { method, resolve: resolve13, reject });
         writer.write({ id, method, params }).catch((error61) => {
           pending.delete(id);
           reject(error61 instanceof Error ? error61 : new Error(String(error61)));
@@ -26970,7 +26972,7 @@ function createNdjsonWriter(stream) {
     get writable() {
       return stream.writable && !stream.destroyed && failure6.error === void 0;
     },
-    write: (value2) => new Promise((resolve14, reject) => {
+    write: (value2) => new Promise((resolve13, reject) => {
       if (failure6.error) {
         reject(failure6.error);
         return;
@@ -26982,7 +26984,7 @@ function createNdjsonWriter(stream) {
       stream.write(`${JSON.stringify(value2)}
 `, (error61) => {
         if (error61) reject(error61);
-        else resolve14();
+        else resolve13();
       });
     }),
     end: () => {
@@ -26998,7 +27000,7 @@ function hostProcess(child, tree, options, handlers) {
     lastScan: Number.NEGATIVE_INFINITY,
     lastOutputAt: void 0
   };
-  const terminate = () => tree.terminate({ graceMs: options.terminateGraceMs });
+  const terminate2 = () => tree.terminate({ graceMs: options.terminateGraceMs });
   const heard = () => {
     flags.lastOutputAt = options.clock.monotonic();
   };
@@ -27014,11 +27016,11 @@ function hostProcess(child, tree, options, handlers) {
   });
   child.stderr.on("data", (chunk) => stderr.push(chunk));
   child.stderr.once("end", () => stderr.flush());
-  const processExit = new Promise((resolve14) => {
-    child.once("exit", (code, signal) => resolve14({ code, signal }));
+  const processExit = new Promise((resolve13) => {
+    child.once("exit", (code, signal) => resolve13({ code, signal }));
   });
-  const outputEnded = new Promise((resolve14) => {
-    child.stdout.once("close", () => resolve14());
+  const outputEnded = new Promise((resolve13) => {
+    child.stdout.once("close", () => resolve13());
   });
   const watch = async () => {
     const { clock, stdoutDrainMs, log, name } = options;
@@ -27029,14 +27031,14 @@ function hostProcess(child, tree, options, handlers) {
     if (first === "eof" && !await settlesWithin(processExit, clock, stdoutDrainMs)) {
       flags.outputClosedEarly = !flags.closing;
       log.warn(`${name}.stdout_closed_while_running`, { pid: child.pid });
-      await terminate();
+      await terminate2();
     }
     if (first === "exit" && !await settlesWithin(outputEnded, clock, stdoutDrainMs)) {
       log.warn(`${name}.stdout_held_after_exit`, { pid: child.pid });
-      await terminate();
+      await terminate2();
     }
     const exit = await processExit;
-    await terminate();
+    await terminate2();
     child.stdout.destroy();
     child.stderr.destroy();
     child.stdin.destroy();
@@ -27049,7 +27051,7 @@ function hostProcess(child, tree, options, handlers) {
     },
     writer,
     exited: watch(),
-    terminate,
+    terminate: terminate2,
     scanDescendants: (force) => {
       const now = options.clock.monotonic();
       if (!force && now - flags.lastScan < options.descendantScanMs) return;
@@ -27315,13 +27317,13 @@ var init_chunk_A2TG6ROT = __esm({
         const turnId = input2.turnId;
         let finish = () => {
         };
-        const done = new Promise((resolve14) => {
+        const done = new Promise((resolve13) => {
           finish = (outcome2) => {
             if (this.#current?.id !== turnId) return;
             this.#current = void 0;
             if (this.#state === "busy") this.#state = "idle";
             this.#emit({ type: "turn_ended", turnId, outcome: outcome2 });
-            resolve14({ turnId, outcome: outcome2, providerSessionId: this.#sessionId });
+            resolve13({ turnId, outcome: outcome2, providerSessionId: this.#sessionId });
           };
         });
         const pending = {
@@ -27550,7 +27552,7 @@ var init_chunk_J2KTV5FP = __esm({
   }
 });
 
-// ../agent-core/dist/chunk-GI3ZGXTY.js
+// ../agent-core/dist/chunk-GW6CC6A3.js
 function repositories(input2, context) {
   const problems = new Map(input2.problems.map((problem) => [problem.path, problem]));
   const listed = context?.repositories ?? [];
@@ -27611,7 +27613,12 @@ function environmentInstructions(environment, cwd) {
     );
   } else if (build?.status === "failed") {
     lines2.push(
-      `The latest image build (${build.id}) failed; sessions still boot from the previous image.`
+      environment.imageBuildId ? `The latest image build (${build.id}) failed; sessions still boot from the previous image.` : `The latest image build (${build.id}) failed; this environment has no image yet.`
+    );
+  }
+  if (environment.primaryRepository && environment.setupDirectory) {
+    lines2.push(
+      `Image builds read .alan/ from ${environment.primaryRepository}; install steps and the start command run from ${environment.setupDirectory}.`
     );
   }
   if (environment.variables.length > 0) {
@@ -27619,18 +27626,18 @@ function environmentInstructions(environment, cwd) {
   }
   return lines2;
 }
-function instructionsFor(snapshot2) {
-  const cwd = snapshot2.workspace.cwd ?? snapshot2.workspace.root ?? "the workspace";
+function instructionsFor(snapshot) {
+  const cwd = snapshot.workspace.cwd ?? snapshot.workspace.root ?? "the workspace";
   return [
-    ...snapshot2.session.trigger === "image_build" ? ["Alan sent this turn, not the user: it reports an image build result."] : [],
-    ...snapshot2.environment ? environmentInstructions(snapshot2.environment, cwd) : []
+    ...snapshot.session.trigger === "image_build" ? ["Alan sent this turn, not the user: it reports an image build result."] : [],
+    ...snapshot.environment ? environmentInstructions(snapshot.environment, cwd) : []
   ];
 }
-function startingInstructions(snapshot2) {
-  const cwd = snapshot2.workspace.cwd ?? snapshot2.workspace.root;
+function startingInstructions(snapshot) {
+  const cwd = snapshot.workspace.cwd ?? snapshot.workspace.root;
   return [
     ...cwd ? [`Work from ${cwd}.`] : [],
-    ...snapshot2.workspace.repositories.flatMap(repositoryInstructions)
+    ...snapshot.workspace.repositories.flatMap(repositoryInstructions)
   ];
 }
 function sessionKind(input2, context) {
@@ -27638,6 +27645,12 @@ function sessionKind(input2, context) {
   if (input2.spec.workflowExecutionId) return "workflow";
   return input2.spec.taskId ? "task" : "chat";
 }
+function setupPathsOf(environment) {
+  return {
+    ...environment.primaryRepository ? { primaryRepository: environment.primaryRepository } : {},
+    ...environment.setupDirectory ? { setupDirectory: environment.setupDirectory } : {}
+  };
+}
 function environmentOf(input2, context) {
   const environment = context?.environment;
   if (!environment) return void 0;
@@ -27648,22 +27661,23 @@ function environmentOf(input2, context) {
     installCommand: environment.installCommand,
     startCommand: environment.startCommand,
     imageBuildId: environment.imageBuildId,
+    ...setupPathsOf(environment),
     ...environment.pendingBuild ? { pendingBuild: environment.pendingBuild } : {},
     variables: environment.variables,
     ...start ? { start: start.state === "not_configured" ? start : { ...start, log: input2.startLogPath } } : {}
   };
 }
-function knownContext(snapshot2) {
-  const organizationId = snapshot2?.session.organizationId;
-  if (!snapshot2 || !organizationId) return void 0;
-  const environment = snapshot2.environment;
+function knownContext(snapshot) {
+  const organizationId = snapshot?.session.organizationId;
+  if (!snapshot || !organizationId) return void 0;
+  const environment = snapshot.environment;
   return {
-    kind: snapshot2.session.kind,
+    kind: snapshot.session.kind,
     trigger: "user",
     organizationId,
-    ...snapshot2.task ? { taskWorkingBranch: snapshot2.task.workingBranch } : {},
-    ...snapshot2.pullRequest ? { pullRequest: snapshot2.pullRequest } : {},
-    repositories: snapshot2.workspace.repositories.flatMap(
+    ...snapshot.task ? { taskWorkingBranch: snapshot.task.workingBranch } : {},
+    ...snapshot.pullRequest ? { pullRequest: snapshot.pullRequest } : {},
+    repositories: snapshot.workspace.repositories.flatMap(
       ({ path: path4, name, url: url3, branch, branchSource, base }) => name && url3 && branch && branchSource && base ? [{ path: path4, name, url: url3, branch, branchSource, base }] : []
     ),
     ...environment ? {
@@ -27673,6 +27687,7 @@ function knownContext(snapshot2) {
         installCommand: environment.installCommand,
         startCommand: environment.startCommand,
         imageBuildId: environment.imageBuildId,
+        ...setupPathsOf(environment),
         ...environment.pendingBuild ? { pendingBuild: environment.pendingBuild } : {},
         variables: environment.variables
       }
@@ -27710,7 +27725,7 @@ function isScalar(value2) {
 }
 function scalar(value2) {
   if (typeof value2 !== "string") return String(value2);
-  return PLAIN_SCALAR.test(value2) ? value2 : JSON.stringify(value2);
+  return PLAIN_SCALAR.test(value2) ? value2 : JSON.stringify(value2).replaceAll("<", "\\u003c");
 }
 function snakeCase(key) {
   return key.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
@@ -27790,15 +27805,15 @@ function updateBody(previous, next) {
   if (Object.keys(facts).length === 0) return void 0;
   return next.session.trigger === "user" ? facts : { session: { trigger: next.session.trigger }, ...facts };
 }
-function renderAgentContext(snapshot2, previous) {
+function renderAgentContext(snapshot, previous) {
   const full = block("alan_agent_context", {
-    ...snapshot2,
-    ...snapshot2.environment ? { environment: withCommandPreviews(snapshot2.environment) } : {},
-    instructions: [...startingInstructions(snapshot2), ...snapshot2.instructions]
+    ...snapshot,
+    ...snapshot.environment ? { environment: withCommandPreviews(snapshot.environment) } : {},
+    instructions: [...startingInstructions(snapshot), ...snapshot.instructions]
   });
-  const update = previous ? updateBody(previous, snapshot2) : void 0;
+  const update = previous ? updateBody(previous, snapshot) : void 0;
   return {
-    snapshot: snapshot2,
+    snapshot,
     full,
     ...update ? { update: block("alan_agent_context_update", update) } : {}
   };
@@ -28164,8 +28179,8 @@ ${body}` : body;
   return spec.mode === "plan" ? planModePrefix(prefixed) : prefixed;
 }
 var startCommandStateSchema, repositorySnapshotSchema, environmentSnapshotSchema, agentContextSnapshotSchema, BRANCH_REASONS, PLAIN_SCALAR, COMMAND_PREVIEW_CHARS, MAX_PARSED_ATTACHMENTS, MAX_PARSED_ATTACHMENT_CHARS, MAX_METADATA_CHARS, UNAVAILABLE, READ_ONLY_MODES, AGENT_MODES;
-var init_chunk_GI3ZGXTY = __esm({
-  "../agent-core/dist/chunk-GI3ZGXTY.js"() {
+var init_chunk_GW6CC6A3 = __esm({
+  "../agent-core/dist/chunk-GW6CC6A3.js"() {
     "use strict";
     init_runtime_v2();
     init_zod();
@@ -28194,6 +28209,8 @@ var init_chunk_GI3ZGXTY = __esm({
       installCommand: external_exports.string().nullable(),
       startCommand: external_exports.string().nullable(),
       imageBuildId: external_exports.string().nullable(),
+      primaryRepository: external_exports.string().optional(),
+      setupDirectory: external_exports.string().optional(),
       pendingBuild: agentContextBuildSchema.optional(),
       variables: external_exports.array(external_exports.string()),
       start: external_exports.intersection(startCommandStateSchema, external_exports.object({ log: external_exports.string().optional() })).optional()
@@ -29218,18 +29235,24 @@ function realCwd(cwd) {
     return cwd;
   }
 }
+function projectDirs(projectsRoot) {
+  try {
+    return (0, import_fs5.readdirSync)(projectsRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch {
+    return [];
+  }
+}
 function claudeSessionLogExists(query) {
   if (!query.sessionId || !query.cwd) return false;
-  for (const cwd of /* @__PURE__ */ new Set([query.cwd, realCwd(query.cwd)])) {
-    const log = (0, import_path5.join)(
-      query.claudeHome,
-      "projects",
-      encodeProjectDir(cwd),
-      `${query.sessionId}.jsonl`
-    );
-    if ((0, import_fs5.existsSync)(log)) return true;
-  }
-  return false;
+  const projectsRoot = (0, import_path5.join)(query.claudeHome, "projects");
+  const fileName = `${query.sessionId}.jsonl`;
+  const here = new Set([query.cwd, realCwd(query.cwd)].map(encodeProjectDir));
+  for (const dir of here) {
+    if ((0, import_fs5.existsSync)((0, import_path5.join)(projectsRoot, dir, fileName))) return true;
+  }
+  return projectDirs(projectsRoot).some(
+    (dir) => !here.has(dir) && (0, import_fs5.existsSync)((0, import_path5.join)(projectsRoot, dir, fileName))
+  );
 }
 function envDigest(env) {
   const hash2 = (0, import_crypto7.createHash)("sha256");
@@ -29505,7 +29528,7 @@ var init_claude = __esm({
     init_chunk_ZCTKXKYY();
     init_chunk_J2KTV5FP();
     init_chunk_XE7BX6YP();
-    init_chunk_GI3ZGXTY();
+    init_chunk_GW6CC6A3();
     init_chunk_YXWJW7I5();
     init_effort();
     import_crypto6 = require("crypto");
@@ -30231,8 +30254,8 @@ var init_claude = __esm({
       }
       async #awaitTaskStop(requestId, taskId) {
         const timer = new AbortController();
-        const answered = new Promise((resolve14) => {
-          this.#taskStops.set(requestId, resolve14);
+        const answered = new Promise((resolve13) => {
+          this.#taskStops.set(requestId, resolve13);
         });
         const timeoutMs = this.#options.stopTaskTimeoutMs;
         const timedOut = this.#options.clock.sleep(timeoutMs, timer.signal).then(
@@ -30305,17 +30328,17 @@ var init_claude = __esm({
         };
         let markStarted = () => {
         };
-        const whenStarted = new Promise((resolve14) => {
-          markStarted = resolve14;
+        const whenStarted = new Promise((resolve13) => {
+          markStarted = resolve13;
         });
-        const done = new Promise((resolve14) => {
+        const done = new Promise((resolve13) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
             this.#lastTurn = turn;
             if (this.#state === "busy") this.#state = "idle";
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve14({ turnId: id, outcome: outcome2, providerSessionId: this.#providerSessionId });
+            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#providerSessionId });
           };
         });
         const active = {
@@ -30433,8 +30456,8 @@ var init_claude = __esm({
         void removeLaunchFiles(this.#launchFiles).catch((error61) => {
           this.#options.log.warn("claude.launch_files_cleanup_failed", { error: error61 });
         });
-        for (const resolve14 of this.#taskStops.values()) {
-          resolve14({ ok: false, reason: "runtime_unavailable", message: "Claude Code exited." });
+        for (const resolve13 of this.#taskStops.values()) {
+          resolve13({ ok: false, reason: "runtime_unavailable", message: "Claude Code exited." });
         }
         const active = this.#current;
         if (active) {
@@ -32367,7 +32390,7 @@ var init_codex = __esm({
     init_chunk_ZCTKXKYY();
     init_chunk_J2KTV5FP();
     init_chunk_XE7BX6YP();
-    init_chunk_GI3ZGXTY();
+    init_chunk_GW6CC6A3();
     init_chunk_YXWJW7I5();
     import_fs6 = require("fs");
     import_path6 = require("path");
@@ -32575,7 +32598,7 @@ var init_codex = __esm({
         const buckets = asRecord(response?.rateLimitsByLimitId);
         if (buckets) {
           return Object.entries(buckets).flatMap(
-            ([limitId, snapshot2]) => this.#update(snapshot2, limitId)
+            ([limitId, snapshot]) => this.#update(snapshot, limitId)
           );
         }
         return this.#update(response?.rateLimits);
@@ -32584,16 +32607,16 @@ var init_codex = __esm({
         return this.#update(params.rateLimits);
       }
       #update(value2, bucketId) {
-        const snapshot2 = asRecord(value2);
-        if (!snapshot2) return [];
-        const primary = windowPatch(snapshot2.primary);
-        const secondary = windowPatch(snapshot2.secondary);
-        const spend = spendPatch(snapshot2.individualLimit, snapshot2.spendControlReached);
-        const credits = creditsPatch(snapshot2.credits);
-        const planType = snapshot2.planType === null ? null : asString(snapshot2.planType) || void 0;
+        const snapshot = asRecord(value2);
+        if (!snapshot) return [];
+        const primary = windowPatch(snapshot.primary);
+        const secondary = windowPatch(snapshot.secondary);
+        const spend = spendPatch(snapshot.individualLimit, snapshot.spendControlReached);
+        const credits = creditsPatch(snapshot.credits);
+        const planType = snapshot.planType === null ? null : asString(snapshot.planType) || void 0;
         const parsed = runCodexRateLimitsUpdateSchema.safeParse({
           sessionUpdate: "_alan/codex.rate_limits",
-          limitId: bucketId ?? (asString(snapshot2.limitId) || "codex"),
+          limitId: bucketId ?? (asString(snapshot.limitId) || "codex"),
           ...primary === void 0 ? {} : { primary },
           ...secondary === void 0 ? {} : { secondary },
           ...spend === void 0 ? {} : { spend },
@@ -33039,10 +33062,10 @@ var init_codex = __esm({
         };
         let identify = () => {
         };
-        const identified = new Promise((resolve14) => {
-          identify = resolve14;
+        const identified = new Promise((resolve13) => {
+          identify = resolve13;
         });
-        const done = new Promise((resolve14) => {
+        const done = new Promise((resolve13) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
@@ -33050,7 +33073,7 @@ var init_codex = __esm({
             if (this.#state === "busy") this.#state = "idle";
             this.#host.scanDescendants(true);
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve14({ turnId: id, outcome: outcome2, providerSessionId: this.#threadId });
+            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#threadId });
           };
         });
         const active = {
@@ -33606,7 +33629,7 @@ function alanCodeConfigContent(existing, input2) {
   });
 }
 function readBody2(response) {
-  return new Promise((resolve14, reject) => {
+  return new Promise((resolve13, reject) => {
     const chunks = [];
     let size = 0;
     response.on("data", (chunk) => {
@@ -33614,7 +33637,7 @@ function readBody2(response) {
       if (size > MAX_CATALOG_BYTES) response.destroy(new Error("catalog too large"));
       else chunks.push(chunk);
     });
-    response.on("end", () => resolve14(Buffer.concat(chunks).toString("utf8")));
+    response.on("end", () => resolve13(Buffer.concat(chunks).toString("utf8")));
     response.on("error", reject);
   });
 }
@@ -33630,13 +33653,13 @@ function parseResponseBody(text3, status) {
 }
 function getJson(url3, headers, timeout, signal) {
   const request2 = url3.protocol === "https:" ? import_https.request : import_http9.request;
-  return new Promise((resolve14, reject) => {
+  return new Promise((resolve13, reject) => {
     const outgoing = request2(url3, { method: "GET", headers, timeout, signal }, (response) => {
       const status = response.statusCode ?? 0;
       readBody2(response).then((text3) => {
         const body = parseResponseBody(text3, status);
         if (status < 200 || status >= 300) reject(new CatalogResponseError(status, body));
-        else resolve14(body);
+        else resolve13(body);
       }).catch(reject);
     });
     outgoing.on("timeout", () => outgoing.destroy(new Error("catalog timed out")));
@@ -42513,8 +42536,8 @@ var require_streamx = __commonJS({
             return this;
           },
           next() {
-            return new Promise(function(resolve14, reject) {
-              promiseResolve = resolve14;
+            return new Promise(function(resolve13, reject) {
+              promiseResolve = resolve13;
               promiseReject = reject;
               const data = stream.read();
               if (data !== null) ondata(data);
@@ -42547,11 +42570,11 @@ var require_streamx = __commonJS({
         }
         function destroy(err) {
           stream.destroy(err);
-          return new Promise((resolve14, reject) => {
-            if (stream._duplexState & DESTROYED) return resolve14({ value: void 0, done: true });
+          return new Promise((resolve13, reject) => {
+            if (stream._duplexState & DESTROYED) return resolve13({ value: void 0, done: true });
             stream.once("close", function() {
               if (err) reject(err);
-              else resolve14({ value: void 0, done: true });
+              else resolve13({ value: void 0, done: true });
             });
           });
         }
@@ -42595,8 +42618,8 @@ var require_streamx = __commonJS({
         const writes = pending + (ws._duplexState & WRITE_WRITING ? 1 : 0);
         if (writes === 0) return Promise.resolve(true);
         if (state.drains === null) state.drains = [];
-        return new Promise((resolve14) => {
-          state.drains.push({ writes, resolve: resolve14 });
+        return new Promise((resolve13) => {
+          state.drains.push({ writes, resolve: resolve13 });
         });
       }
       write(data) {
@@ -42701,10 +42724,10 @@ var require_streamx = __commonJS({
       cb(null);
     }
     function pipelinePromise(...streams) {
-      return new Promise((resolve14, reject) => {
+      return new Promise((resolve13, reject) => {
         return pipeline(...streams, (err) => {
           if (err) return reject(err);
-          resolve14();
+          resolve13();
         });
       });
     }
@@ -42827,9 +42850,9 @@ var require_streamx = __commonJS({
   }
 });
 
-// ../../node_modules/tar-stream/headers.js
+// ../shared/node_modules/tar-stream/headers.js
 var require_headers = __commonJS({
-  "../../node_modules/tar-stream/headers.js"(exports2) {
+  "../shared/node_modules/tar-stream/headers.js"(exports2) {
     "use strict";
     var b4a = require_b4a();
     var ZEROS = "0000000000000000000";
@@ -43090,9 +43113,9 @@ var require_headers = __commonJS({
   }
 });
 
-// ../../node_modules/tar-stream/extract.js
+// ../shared/node_modules/tar-stream/extract.js
 var require_extract = __commonJS({
-  "../../node_modules/tar-stream/extract.js"(exports2, module2) {
+  "../shared/node_modules/tar-stream/extract.js"(exports2, module2) {
     "use strict";
     var { Writable, Readable: Readable2, getStreamError } = require_streamx();
     var FIFO = require_fast_fifo();
@@ -43376,16 +43399,16 @@ var require_extract = __commonJS({
           entryCallback = null;
           cb(err);
         }
-        function onnext(resolve14, reject) {
+        function onnext(resolve13, reject) {
           if (error61) {
             return reject(error61);
           }
           if (entryStream) {
-            resolve14({ value: entryStream, done: false });
+            resolve13({ value: entryStream, done: false });
             entryStream = null;
             return;
           }
-          promiseResolve = resolve14;
+          promiseResolve = resolve13;
           promiseReject = reject;
           consumeCallback(null);
           if (extract2._finished && promiseResolve) {
@@ -43413,11 +43436,11 @@ var require_extract = __commonJS({
         function destroy(err) {
           extract2.destroy(err);
           consumeCallback(err);
-          return new Promise((resolve14, reject) => {
-            if (extract2.destroyed) return resolve14({ value: void 0, done: true });
+          return new Promise((resolve13, reject) => {
+            if (extract2.destroyed) return resolve13({ value: void 0, done: true });
             extract2.once("close", function() {
               if (err) reject(err);
-              else resolve14({ value: void 0, done: true });
+              else resolve13({ value: void 0, done: true });
             });
           });
         }
@@ -43435,9 +43458,9 @@ var require_extract = __commonJS({
   }
 });
 
-// ../../node_modules/tar-stream/constants.js
+// ../shared/node_modules/tar-stream/constants.js
 var require_constants = __commonJS({
-  "../../node_modules/tar-stream/constants.js"(exports2, module2) {
+  "../shared/node_modules/tar-stream/constants.js"(exports2, module2) {
     "use strict";
     var constants5 = {
       // just for envs without fs
@@ -43456,9 +43479,9 @@ var require_constants = __commonJS({
   }
 });
 
-// ../../node_modules/tar-stream/pack.js
+// ../shared/node_modules/tar-stream/pack.js
 var require_pack = __commonJS({
-  "../../node_modules/tar-stream/pack.js"(exports2, module2) {
+  "../shared/node_modules/tar-stream/pack.js"(exports2, module2) {
     "use strict";
     var { Readable: Readable2, Writable, getStreamError } = require_streamx();
     var b4a = require_b4a();
@@ -43691,9 +43714,9 @@ var require_pack = __commonJS({
   }
 });
 
-// ../../node_modules/tar-stream/index.js
+// ../shared/node_modules/tar-stream/index.js
 var require_tar_stream = __commonJS({
-  "../../node_modules/tar-stream/index.js"(exports2) {
+  "../shared/node_modules/tar-stream/index.js"(exports2) {
     "use strict";
     exports2.extract = require_extract();
     exports2.pack = require_pack();
@@ -44305,12 +44328,12 @@ function shellStart(update, sessionId) {
   ];
 }
 function shellEnd(update) {
-  const snapshot2 = asRecord(update.task_snapshot);
-  const taskId = optional2(snapshot2?.task_id);
-  if (!snapshot2 || !taskId) return [];
-  const killed = snapshot2.explicitly_killed === true;
-  const exitCode = snapshot2.exit_code;
-  const failed = typeof exitCode === "number" && exitCode !== 0 || optional2(snapshot2.signal) !== void 0;
+  const snapshot = asRecord(update.task_snapshot);
+  const taskId = optional2(snapshot?.task_id);
+  if (!snapshot || !taskId) return [];
+  const killed = snapshot.explicitly_killed === true;
+  const exitCode = snapshot.exit_code;
+  const failed = typeof exitCode === "number" && exitCode !== 0 || optional2(snapshot.signal) !== void 0;
   const ending = killed ? "stopped" : failed ? "failed" : "completed";
   return [{ type: "end", taskId, ending }];
 }
@@ -44456,7 +44479,7 @@ var init_acp3 = __esm({
     init_chunk_ZCTKXKYY();
     init_chunk_J2KTV5FP();
     init_chunk_XE7BX6YP();
-    init_chunk_GI3ZGXTY();
+    init_chunk_GW6CC6A3();
     init_chunk_YXWJW7I5();
     import_promises50 = require("fs/promises");
     import_path9 = require("path");
@@ -44982,7 +45005,7 @@ var init_acp3 = __esm({
         const turn = new AcpTurn(`acp-${this.#turns}-${id}`, this.#profile);
         let finish = () => {
         };
-        const done = new Promise((resolve14) => {
+        const done = new Promise((resolve13) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
@@ -44990,7 +45013,7 @@ var init_acp3 = __esm({
             if (this.#state === "busy") this.#state = "idle";
             this.#host.scanDescendants(true);
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve14({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
+            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
           };
         });
         const active = { id, turn, done, finish, cancelRequested: false };
@@ -45575,12 +45598,11 @@ function createPersistentDriver(provider4, options) {
     log.warn("holder.history_rejected", { harness: provider4.harness });
     await session.suspend();
   };
-  const respond = async (request2, mayWrite) => {
+  const respond = async (request2) => {
     const turn = live.turn;
     if (turn === void 0 || turn.runId !== request2.runId) return "unknown_run";
     const isWaiting = () => live.turn === turn && turn.waiting.has(request2.toolCallId);
     if (!isWaiting() || turn.session.respond === void 0) return "not_waiting";
-    if (!await mayWrite() || !isWaiting()) return "not_waiting";
     turn.waiting.delete(request2.toolCallId);
     try {
       await turn.session.respond(request2.toolCallId, request2.answer);
@@ -46322,7 +46344,7 @@ var init_opencode = __esm({
     init_chunk_ZCTKXKYY();
     init_chunk_J2KTV5FP();
     init_chunk_XE7BX6YP();
-    init_chunk_GI3ZGXTY();
+    init_chunk_GW6CC6A3();
     init_chunk_YXWJW7I5();
     import_http10 = require("http");
     init_runtime_v2();
@@ -47806,8 +47828,8 @@ function createDroidPeer(writer, handlers) {
     },
     request: (method, params = {}) => {
       const id = `alan-${counter.next++}`;
-      return new Promise((resolve14, reject) => {
-        pending.set(id, { method, resolve: resolve14, reject });
+      return new Promise((resolve13, reject) => {
+        pending.set(id, { method, resolve: resolve13, reject });
         writer.write(envelope("request", { id, method, params })).catch((error61) => {
           pending.delete(id);
           reject(error61 instanceof Error ? error61 : new Error(String(error61)));
@@ -48156,7 +48178,7 @@ var init_droid = __esm({
     init_chunk_ZCTKXKYY();
     init_chunk_J2KTV5FP();
     init_chunk_XE7BX6YP();
-    init_chunk_GI3ZGXTY();
+    init_chunk_GW6CC6A3();
     init_chunk_YXWJW7I5();
     init_runtime_v2();
     import_crypto16 = require("crypto");
@@ -48435,14 +48457,14 @@ var init_droid = __esm({
         const turn = new DroidTurn(sessionId, this.#memory);
         let finish = () => {
         };
-        const done = new Promise((resolve14) => {
+        const done = new Promise((resolve13) => {
           finish = (outcome2) => {
             if (this.#current?.id !== id) return;
             this.#current = void 0;
             if (this.#state === "busy") this.#state = "idle";
             this.#host.scanDescendants(true);
             this.#emit({ type: "turn_ended", turnId: id, outcome: outcome2 });
-            resolve14({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
+            resolve13({ turnId: id, outcome: outcome2, providerSessionId: this.#sessionId });
           };
         });
         const active = { id, turn, done, finish, cancelRequested: false };
@@ -49265,7 +49287,7 @@ var init_antigravity = __esm({
     init_chunk_XC5676SG();
     init_chunk_ZCTKXKYY();
     init_chunk_XE7BX6YP();
-    init_chunk_GI3ZGXTY();
+    init_chunk_GW6CC6A3();
     init_chunk_YXWJW7I5();
     import_promises54 = require("fs/promises");
     import_path12 = require("path");
@@ -49970,7 +49992,7 @@ var init_command_code = __esm({
     init_chunk_ZCTKXKYY();
     init_chunk_J2KTV5FP();
     init_chunk_XE7BX6YP();
-    init_chunk_GI3ZGXTY();
+    init_chunk_GW6CC6A3();
     init_chunk_YXWJW7I5();
     import_promises55 = require("fs/promises");
     import_path15 = require("path");
@@ -55368,7 +55390,7 @@ var require_websocket_server = __commonJS({
 // package.json
 var package_default = {
   name: "@alan-ai-hq/agent-manager",
-  version: "0.1.151",
+  version: "0.1.153",
   private: true,
   type: "module",
   description: "Alan machine runtime (alan-agent): identity, link, reconciler, session holders, run log, uploader, local API",
@@ -55418,7 +55440,7 @@ var package_default = {
 
 // src/cli/commands/compat.ts
 var import_node_crypto32 = require("crypto");
-var import_promises71 = require("fs/promises");
+var import_promises69 = require("fs/promises");
 init_runtime_v2();
 init_zod();
 
@@ -55577,8 +55599,8 @@ async function writeJsonFileAtomic(path4, value2) {
 var LIFECYCLE_DRAIN_MS = 5e3;
 function createGate() {
   const opened = {};
-  const promise2 = new Promise((resolve14) => {
-    opened.resolve = resolve14;
+  const promise2 = new Promise((resolve13) => {
+    opened.resolve = resolve13;
   });
   return { promise: promise2, open: () => opened.resolve?.() };
 }
@@ -55805,7 +55827,7 @@ function transportFailure(request2, error61) {
   });
 }
 function readBody(incoming, url3, maxBytes) {
-  return new Promise((resolve14, reject) => {
+  return new Promise((resolve13, reject) => {
     const declared = Number(incoming.headers["content-length"] ?? "0");
     if (maxBytes !== void 0 && declared > maxBytes) {
       incoming.destroy();
@@ -55824,7 +55846,7 @@ function readBody(incoming, url3, maxBytes) {
       chunks.push(chunk);
     });
     incoming.on("error", reject);
-    incoming.on("end", () => resolve14(Buffer.concat(chunks)));
+    incoming.on("end", () => resolve13(Buffer.concat(chunks)));
   });
 }
 function isConnectionReset(error61) {
@@ -55832,7 +55854,7 @@ function isConnectionReset(error61) {
 }
 function exchange(request2, agents, attempt2 = 0) {
   const { signal, url: url3 } = request2;
-  return new Promise((resolve14, reject) => {
+  return new Promise((resolve13, reject) => {
     if (signal.aborted) {
       reject(signal.reason);
       return;
@@ -55859,7 +55881,7 @@ function exchange(request2, agents, attempt2 = 0) {
       const stale = outgoing.reusedSocket && !responded && isConnectionReset(error61);
       if (stale && attempt2 < STALE_SOCKET_RETRIES && !signal.aborted) {
         settle();
-        resolve14(exchange(request2, agents, attempt2 + 1));
+        resolve13(exchange(request2, agents, attempt2 + 1));
         return;
       }
       fail(error61);
@@ -55872,7 +55894,7 @@ function exchange(request2, agents, attempt2 = 0) {
       readBody(incoming, url3, isRedirect(status) ? void 0 : request2.maxBodyBytes).then(
         (body) => {
           settle();
-          resolve14({ status, headers: incoming.headers, body });
+          resolve13({ status, headers: incoming.headers, body });
         },
         fail
       );
@@ -56117,8 +56139,8 @@ function isBodyless(method) {
   return method === "GET" || method === "HEAD";
 }
 function exchange2(send2, options, input2) {
-  return new Promise((resolve14, reject) => {
-    const outgoing = send2({ ...options, method: input2.method, signal: input2.signal }, resolve14);
+  return new Promise((resolve13, reject) => {
+    const outgoing = send2({ ...options, method: input2.method, signal: input2.signal }, resolve13);
     outgoing.on("error", reject);
     if (isBodyless(input2.method)) {
       input2.body.resume();
@@ -57595,7 +57617,7 @@ function createGitRunner(options) {
     const stderr = new OutputBuffer();
     const total = { bytes: 0 };
     const closed = new AbortController();
-    const terminate = async () => {
+    const terminate2 = async () => {
       await killProcessTree(child.pid, { signal: "SIGTERM", child, platform: platform3 });
       try {
         await systemClock.sleep(killGraceMs, closed.signal);
@@ -57604,12 +57626,12 @@ function createGitRunner(options) {
       }
       await killProcessTree(child.pid, { signal: "SIGKILL", child, platform: platform3 });
     };
-    return new Promise((resolve14, reject) => {
+    return new Promise((resolve13, reject) => {
       let ending = null;
       const stop = (next) => {
         if (ending !== null) return;
         ending = next;
-        if (next.kind !== "exited" && next.kind !== "spawn_failed") void terminate();
+        if (next.kind !== "exited" && next.kind !== "spawn_failed") void terminate2();
       };
       const onTimeout = () => stop({ kind: "timed_out" });
       const onAbort = () => stop({ kind: "aborted" });
@@ -57629,7 +57651,7 @@ function createGitRunner(options) {
         signal.removeEventListener("abort", onAbort);
         const final = ending ?? last;
         if (final.kind === "exited") {
-          resolve14({ exitCode: final.exitCode, stdout: stdout.text(), stderr: stderr.text() });
+          resolve13({ exitCode: final.exitCode, stdout: stdout.text(), stderr: stderr.text() });
         } else {
           reject(faultFor(final, command));
         }
@@ -57771,35 +57793,35 @@ async function checkOne(path4, deps, signal) {
   await write({ state: "checking", path: path4 });
   const read = await readSnapshot(deps.git, path4, signal);
   if (read.kind !== "snapshot") return write({ state: read.kind, path: path4, reason: read.reason });
-  const { snapshot: snapshot2 } = read;
+  const { snapshot } = read;
   const advertised = await deps.git.run(
     {
       cwd: path4,
-      args: ["ls-remote", "--exit-code", REMOTE, `refs/heads/${snapshot2.base}`],
+      args: ["ls-remote", "--exit-code", REMOTE, `refs/heads/${snapshot.base}`],
       network: true,
       readOnly: true
     },
     signal
   );
   if (advertised.exitCode !== 0) {
-    return write({ state: "failed", path: path4, snapshot: snapshot2, reason: gitError(advertised, "ls-remote") });
+    return write({ state: "failed", path: path4, snapshot, reason: gitError(advertised, "ls-remote") });
   }
   const tip = advertised.stdout.split(/\s+/)[0] ?? "";
-  if (tip === snapshot2.head) return write({ state: "current", path: path4, snapshot: snapshot2 });
-  if (tip === snapshot2.published) {
-    return write({ state: "behind", path: path4, snapshot: snapshot2, tip, fetched: true });
+  if (tip === snapshot.head) return write({ state: "current", path: path4, snapshot });
+  if (tip === snapshot.published) {
+    return write({ state: "behind", path: path4, snapshot, tip, fetched: true });
   }
-  await write({ state: "behind", path: path4, snapshot: snapshot2, tip, fetched: false });
-  const depth = snapshot2.shallow ? ["--depth=1"] : [];
+  await write({ state: "behind", path: path4, snapshot, tip, fetched: false });
+  const depth = snapshot.shallow ? ["--depth=1"] : [];
   const fetched = await deps.git.run(
     {
       cwd: path4,
-      args: ["fetch", "--no-tags", "--quiet", ...depth, REMOTE, snapshot2.base],
+      args: ["fetch", "--no-tags", "--quiet", ...depth, REMOTE, snapshot.base],
       network: true
     },
     signal
   );
-  return fetched.exitCode === 0 ? write({ state: "behind", path: path4, snapshot: snapshot2, tip, fetched: true }) : write({ state: "failed", path: path4, snapshot: snapshot2, reason: gitError(fetched, "fetch") });
+  return fetched.exitCode === 0 ? write({ state: "behind", path: path4, snapshot, tip, fetched: true }) : write({ state: "failed", path: path4, snapshot, reason: gitError(fetched, "fetch") });
 }
 async function isCheckout(path4) {
   return (0, import_promises11.stat)((0, import_node_path7.join)(path4, ".git")).then(
@@ -57853,6 +57875,20 @@ async function readCheckoutFreshness(dir, path4) {
   }
 }
 
+// ../shared/dist/git-hosts.js
+var EXACT_HOSTS = {
+  "github.com": "github",
+  "www.github.com": "github",
+  // Alan's GitLab credential is a gitlab.com OAuth token; no other GitLab host may receive it.
+  "gitlab.com": "gitlab",
+  "www.gitlab.com": "gitlab",
+  "bitbucket.org": "bitbucket",
+  "www.bitbucket.org": "bitbucket",
+  "dev.azure.com": "azure-devops",
+  "ssh.dev.azure.com": "azure-devops"
+};
+var GIT_GATEWAY_HTTPS_HOSTS = Object.keys(EXACT_HOSTS).filter((host) => !host.startsWith("ssh."));
+
 // src/capabilities/git/credential-config.ts
 init_runtime_v2();
 var PROACTIVE_AUTH_MIN_VERSION = [2, 46];
@@ -57894,14 +57930,16 @@ async function configureGitCredentialHelper(input2) {
   await git(["config", "--global", "--add", `credential.${scope}.helper`, ""]);
   await git(["config", "--global", "--add", `credential.${scope}.helper`, helper]);
   await git(["config", "--global", `credential.${scope}.useHttpPath`, "true"]);
-  await unset(`url.${scope}github.com/.insteadOf`);
-  await git([
-    "config",
-    "--global",
-    "--add",
-    `url.${scope}github.com/.insteadOf`,
-    "https://github.com/"
-  ]);
+  for (const host of GIT_GATEWAY_HTTPS_HOSTS) {
+    await unset(`url.${scope}${host}/.insteadOf`);
+    await git([
+      "config",
+      "--global",
+      "--add",
+      `url.${scope}${host}/.insteadOf`,
+      `https://${host}/`
+    ]);
+  }
   const version2 = parseGitVersion((await git(["version"])).stdout);
   const proactiveAuth = supportsProactiveAuth(version2);
   if (proactiveAuth) {
@@ -58167,9 +58205,9 @@ function isProcessAlive(pid) {
   }
 }
 async function linuxStartTime(pid) {
-  const stat23 = await (0, import_promises13.readFile)(`/proc/${pid}/stat`, "utf8").catch(() => null);
-  if (stat23 === null) return null;
-  const fields = stat23.slice(stat23.lastIndexOf(")") + 2).split(" ");
+  const stat22 = await (0, import_promises13.readFile)(`/proc/${pid}/stat`, "utf8").catch(() => null);
+  if (stat22 === null) return null;
+  const fields = stat22.slice(stat22.lastIndexOf(")") + 2).split(" ");
   return fields[19] ?? null;
 }
 async function linuxCommand(pid) {
@@ -58601,6 +58639,99 @@ function removeStaleEndpoint(endpoint) {
   if (!endpoint.startsWith("\\\\.\\pipe\\")) (0, import_node_fs6.rmSync)(endpoint, { force: true });
 }
 
+// src/platform/legacy-daemons.ts
+var LIST_TIMEOUT_MS = 15e3;
+var WINDOWS_PROCESS_QUERY = "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,CommandLine | ConvertTo-Json -Compress";
+var LEGACY_ENTRY = /(?:[\\/]agent-manager[\\/]dist[\\/]index\.cjs|[\\/]alan-agent[\\/]index\.cjs|[\\/]bin[\\/]alan-agent)["']?(?=\s)/i;
+var DAEMON_VERB = /\s["']?daemon["']?(?=\s|$)/;
+var PROFILE_FLAG = /\s--profile(?:=|\s+)["']?([\w-]+)/;
+var RUNTIME_V2 = /alan-agent\.cjs|alan-agent(?:-[\w-]+)?\.cmd/i;
+function parsePsOutput(stdout) {
+  const processes = [];
+  for (const line of stdout.split("\n")) {
+    const match = /^\s*(\d+)\s+(\d+)\s+(.+)$/.exec(line);
+    if (match?.[1] === void 0 || match[2] === void 0 || match[3] === void 0) continue;
+    processes.push({ pid: Number(match[1]), ppid: Number(match[2]), command: match[3].trim() });
+  }
+  return processes;
+}
+function isWindowsProcessRow(value2) {
+  return typeof value2 === "object" && value2 !== null;
+}
+function parseWindowsProcesses(stdout) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return [];
+  }
+  const rows = Array.isArray(parsed) ? parsed : [parsed];
+  const processes = [];
+  for (const row of rows) {
+    if (!isWindowsProcessRow(row)) continue;
+    const { ProcessId: pid, ParentProcessId: ppid, CommandLine: command } = row;
+    if (typeof pid !== "number" || typeof ppid !== "number" || typeof command !== "string") {
+      continue;
+    }
+    processes.push({ pid, ppid, command });
+  }
+  return processes;
+}
+async function listProcesses2(exec, platform3) {
+  if (platform3 === "win32") {
+    const result2 = await exec({
+      command: "powershell.exe",
+      args: ["-NoProfile", "-NonInteractive", "-Command", WINDOWS_PROCESS_QUERY],
+      timeoutMs: LIST_TIMEOUT_MS
+    });
+    return result2.status === 0 ? parseWindowsProcesses(result2.stdout) : [];
+  }
+  const result = await exec({
+    command: "ps",
+    args: ["-axww", "-o", "pid=,ppid=,command="],
+    timeoutMs: LIST_TIMEOUT_MS
+  });
+  return result.status === 0 ? parsePsOutput(result.stdout) : [];
+}
+function isLegacyDaemonCommand(command) {
+  if (RUNTIME_V2.test(command)) return false;
+  const entry = LEGACY_ENTRY.exec(command);
+  if (entry === null) return false;
+  return DAEMON_VERB.test(command.slice(entry.index + entry[0].length));
+}
+function legacyDaemonProfile(command) {
+  return PROFILE_FLAG.exec(command)?.[1] ?? "production";
+}
+function legacyProfileClass(profile) {
+  return profile === "production" || profile === "staging" ? profile : "development";
+}
+function hasRuntimeV2Descendant(pid, processes, seen = /* @__PURE__ */ new Set()) {
+  for (const child of processes) {
+    if (child.ppid !== pid || seen.has(child.pid)) continue;
+    seen.add(child.pid);
+    if (RUNTIME_V2.test(child.command) || hasRuntimeV2Descendant(child.pid, processes, seen)) {
+      return true;
+    }
+  }
+  return false;
+}
+function findLegacyDaemons(processes, options) {
+  const profile = legacyProfileClass(options.profile);
+  return processes.filter(
+    (entry) => !options.exclude.has(entry.pid) && isLegacyDaemonCommand(entry.command) && legacyProfileClass(legacyDaemonProfile(entry.command)) === profile && !hasRuntimeV2Descendant(entry.pid, processes)
+  );
+}
+function signalProcess(pid, signal) {
+  try {
+    process.kill(pid, signal);
+    return true;
+  } catch (error61) {
+    const code = errnoCode(error61);
+    if (code === "ESRCH" || code === "EPERM") return false;
+    throw error61;
+  }
+}
+
 // src/platform/node-flags.ts
 var SERVICE_NODE_FLAGS = [
   "--max-semi-space-size=1",
@@ -59149,7 +59280,7 @@ function statusOf(error61) {
   }
   return 1;
 }
-var systemExec = (request2) => new Promise((resolve14) => {
+var systemExec = (request2) => new Promise((resolve13) => {
   const child = (0, import_node_child_process6.execFile)(
     request2.command,
     [...request2.args],
@@ -59160,7 +59291,7 @@ var systemExec = (request2) => new Promise((resolve14) => {
       windowsHide: true
     },
     (error61, stdout, stderr) => {
-      resolve14({ status: statusOf(error61), stdout, stderr });
+      resolve13({ status: statusOf(error61), stdout, stderr });
     }
   );
   child.stdin?.on("error", () => {
@@ -60354,11 +60485,11 @@ async function startGitCredentialServer(options) {
     });
   });
   removeStaleEndpoint(options.endpoint);
-  await new Promise((resolve14, reject) => {
+  await new Promise((resolve13, reject) => {
     server.once("error", reject);
     server.listen(options.endpoint, () => {
       server.off("error", reject);
-      resolve14();
+      resolve13();
     });
   });
   options.log.info("git.credential_server_listening", { endpoint: options.endpoint });
@@ -60366,7 +60497,7 @@ async function startGitCredentialServer(options) {
     endpoint: options.endpoint,
     [Symbol.asyncDispose]: async () => {
       closing.abort();
-      await new Promise((resolve14) => server.close(() => resolve14()));
+      await new Promise((resolve13) => server.close(() => resolve13()));
       removeStaleEndpoint(options.endpoint);
     }
   };
@@ -60440,13 +60571,13 @@ authorityKeyIdentifier = keyid
 `;
 }
 function openssl(args, cwd) {
-  return new Promise((resolve14, reject) => {
+  return new Promise((resolve13, reject) => {
     (0, import_node_child_process9.execFile)(
       "openssl",
       [...args],
       { cwd, timeout: OPENSSL_TIMEOUT_MS },
       (error61, _stdout, stderr) => {
-        if (error61 === null) resolve14();
+        if (error61 === null) resolve13();
         else
           reject(new Error(`openssl ${args[0] ?? ""} failed: ${stderr.trim() || error61.message}`));
       }
@@ -60623,21 +60754,21 @@ function relayTo(forward, log) {
   };
 }
 function listen(server, target) {
-  return new Promise((resolve14, reject) => {
+  return new Promise((resolve13, reject) => {
     server.once("error", reject);
     const done = () => {
       server.off("error", reject);
-      resolve14();
+      resolve13();
     };
     if (typeof target === "string") server.listen(target, done);
     else server.listen(target.port, target.host, done);
   });
 }
 function close(server, sockets = /* @__PURE__ */ new Set()) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve13) => {
     for (const socket of sockets) socket.destroy();
     server.closeAllConnections();
-    server.close(() => resolve14());
+    server.close(() => resolve13());
   });
 }
 function portOf(server) {
@@ -62771,8 +62902,8 @@ async function openNativeSessionStore(stateDir, maxEntries = MAX_NATIVE_SESSION_
         sessions.delete(sessionKey(entry.provider, entry.externalSessionId));
       }
     }
-    const snapshot2 = { version: 1, sessions: [...sessions.values()] };
-    writing = writing.catch(() => void 0).then(() => writeJsonFileAtomic(path4, snapshot2));
+    const snapshot = { version: 1, sessions: [...sessions.values()] };
+    writing = writing.catch(() => void 0).then(() => writeJsonFileAtomic(path4, snapshot));
     return writing;
   };
   return {
@@ -63420,7 +63551,7 @@ async function startNativeIngest(deps) {
   };
   const settleIdle = () => {
     if (workers.size > 0) return;
-    for (const resolve14 of idleWaiters) resolve14();
+    for (const resolve13 of idleWaiters) resolve13();
     idleWaiters.clear();
   };
   const retryDelay = (worker) => {
@@ -63663,7 +63794,7 @@ async function startNativeIngest(deps) {
     sweep: sweep2,
     whenIdle: () => {
       if (workers.size === 0) return Promise.resolve();
-      return new Promise((resolve14) => idleWaiters.add(resolve14));
+      return new Promise((resolve13) => idleWaiters.add(resolve13));
     },
     [Symbol.asyncDispose]: async () => {
       shutdown.abort();
@@ -63811,7 +63942,7 @@ function captureProbe(command, args, options) {
   const launch = directLaunch(command, args, options);
   if (launch === void 0) return Promise.resolve({ stdout: "", stderr: "", exitCode: void 0 });
   const env = platform3 === "win32" ? withWindowsHelper(canonicalWindowsEnvironment(options.env)) : options.env;
-  return new Promise((resolve14) => {
+  return new Promise((resolve13) => {
     const limit = options.maxBufferBytes ?? DEFAULT_MAX_BYTES;
     const stdout = [];
     const stderr = [];
@@ -63829,7 +63960,7 @@ function captureProbe(command, args, options) {
       windowsVerbatimArguments: launch.windowsVerbatimArguments
     });
     child.stdin?.end();
-    const terminate = () => {
+    const terminate2 = () => {
       if (platform3 !== "win32" && child.pid !== void 0) {
         try {
           process.kill(-child.pid, "SIGKILL");
@@ -63846,7 +63977,7 @@ function captureProbe(command, args, options) {
       settled2 = true;
       deadlineController.abort();
       options.signal?.removeEventListener("abort", abort);
-      resolve14({
+      resolve13({
         stdout: Buffer.concat(stdout).toString("utf8"),
         stderr: Buffer.concat(stderr).toString("utf8"),
         exitCode
@@ -63854,7 +63985,7 @@ function captureProbe(command, args, options) {
     };
     void systemClock.sleep(options.timeoutMs ?? DEFAULT_TIMEOUT_MS2, deadlineController.signal).then(
       () => {
-        terminate();
+        terminate2();
         child.stdout.destroy();
         child.stderr.destroy();
         finish(void 0);
@@ -63862,7 +63993,7 @@ function captureProbe(command, args, options) {
       () => void 0
     );
     const abort = () => {
-      terminate();
+      terminate2();
       child.stdout.destroy();
       child.stderr.destroy();
       finish(void 0);
@@ -63873,7 +64004,7 @@ function captureProbe(command, args, options) {
       bytes += chunk.length;
       if (bytes > limit) {
         overflowed = true;
-        terminate();
+        terminate2();
         finish(void 0);
         return;
       }
@@ -63979,7 +64110,7 @@ function cursorAccountLabel(output2) {
 function waitForAbort(signal) {
   if (signal.aborted) return Promise.resolve();
   return new Promise(
-    (resolve14) => signal.addEventListener("abort", () => resolve14(), { once: true })
+    (resolve13) => signal.addEventListener("abort", () => resolve13(), { once: true })
   );
 }
 function idlePrompt(signal) {
@@ -64057,14 +64188,14 @@ async function codexLabel(executable, env) {
     windowsVerbatimArguments: launch.windowsVerbatimArguments
   });
   const timeout = AbortSignal.timeout(ACCOUNT_TIMEOUT_MS);
-  return new Promise((resolve14) => {
+  return new Promise((resolve13) => {
     let finished = false;
     let buffer = "";
     const finish = (label) => {
       if (finished) return;
       finished = true;
       child.kill();
-      resolve14(label);
+      resolve13(label);
     };
     const send2 = (value2) => {
       child.stdin.write(`${JSON.stringify(value2)}
@@ -64207,7 +64338,7 @@ function createProbeQueue(capture, env, limit) {
       active += 1;
       return Promise.resolve();
     }
-    return new Promise((resolve14) => waiting.push(resolve14));
+    return new Promise((resolve13) => waiting.push(resolve13));
   };
   const release2 = () => {
     const next = waiting.shift();
@@ -64647,11 +64778,11 @@ async function resolveCliEnvironment(options) {
 }
 async function openCliEnvironment(options) {
   const decorate = options.decorate ?? ((env) => env);
-  const resolve14 = async () => {
+  const resolve13 = async () => {
     const resolved = await resolveCliEnvironmentDetailed(options);
     return { env: decorate(resolved.env), source: resolved.source };
   };
-  let state = await resolve14();
+  let state = await resolve13();
   let retryAt = options.clock.now() + DEGRADED_RETRY_MS;
   return {
     current: () => state.env,
@@ -64660,7 +64791,7 @@ async function openCliEnvironment(options) {
       if (state.source === "login_shell" || options.platform === "win32") return false;
       if (options.clock.now() < retryAt) return false;
       retryAt = options.clock.now() + DEGRADED_RETRY_MS;
-      const next = await resolve14();
+      const next = await resolve13();
       const changed2 = envValue(next.env, "PATH") !== envValue(state.env, "PATH");
       state = next;
       return changed2;
@@ -64737,11 +64868,11 @@ async function installVersion2(backendKind, requested, options, signal) {
     }
     return exact;
   }
-  const resolve14 = options.resolveVersion;
-  if (resolve14 === void 0) throw new Error("Latest version lookup is unavailable");
+  const resolve13 = options.resolveVersion;
+  if (resolve13 === void 0) throw new Error("Latest version lookup is unavailable");
   const packageName = packageFor(backendKind).name;
   return checkedVersion(
-    await resolve14(backendKind === "opencode_serve" ? `${packageName}@1` : packageName, signal)
+    await resolve13(backendKind === "opencode_serve" ? `${packageName}@1` : packageName, signal)
   );
 }
 function selection(root, backendKind, version2) {
@@ -66308,8 +66439,8 @@ async function collectStream(stream) {
   return import_node_buffer2.Buffer.concat(chunks);
 }
 function addArchiveEntry(archive, header, bytes) {
-  return new Promise((resolve14, reject) => {
-    archive.entry(header, bytes, (error61) => error61 ? reject(error61) : resolve14());
+  return new Promise((resolve13, reject) => {
+    archive.entry(header, bytes, (error61) => error61 ? reject(error61) : resolve13());
   });
 }
 async function decompressBounded(archiveBytes) {
@@ -66335,7 +66466,7 @@ async function extractTar(tarBytes, destination) {
   const extractor = (0, import_tar_stream.extract)();
   let fileCount = 0;
   let totalBytes = 0;
-  const completion = new Promise((resolve14, reject) => {
+  const completion = new Promise((resolve13, reject) => {
     extractor.on("entry", (header, stream, next) => {
       void extractEntry(header, stream, destination, {
         addFile(size) {
@@ -66350,7 +66481,7 @@ async function extractTar(tarBytes, destination) {
         }
       }).then(next, (error61) => extractor.destroy(error61 instanceof Error ? error61 : new Error(String(error61))));
     });
-    extractor.once("finish", resolve14);
+    extractor.once("finish", resolve13);
     extractor.once("error", reject);
   });
   import_node_stream.Readable.from(tarBytes).pipe(extractor);
@@ -66833,9 +66964,9 @@ async function syncOnce(env, local, onRecorded, signal) {
   return report2;
 }
 function aborted2(signal) {
-  return new Promise((resolve14) => {
-    if (signal.aborted) resolve14(null);
-    else signal.addEventListener("abort", () => resolve14(null), { once: true });
+  return new Promise((resolve13) => {
+    if (signal.aborted) resolve13(null);
+    else signal.addEventListener("abort", () => resolve13(null), { once: true });
   });
 }
 function openMachineSkills(options) {
@@ -66924,11 +67055,11 @@ function openMachineSkills(options) {
       if ((await resolveSkillInvocations(layout, named, "exact")).kind === "resolved") return;
     }
   };
-  const recordedUntilResolved = (named, until) => new Promise((resolve14) => {
+  const recordedUntilResolved = (named, until) => new Promise((resolve13) => {
     const done = () => {
       recordWatchers.delete(check3);
       until.removeEventListener("abort", done);
-      resolve14();
+      resolve13();
     };
     const check3 = () => {
       void resolveSkillInvocations(layout, named, "exact").then((resolution) => {
@@ -66936,7 +67067,7 @@ function openMachineSkills(options) {
       });
     };
     if (until.aborted) {
-      resolve14();
+      resolve13();
       return;
     }
     recordWatchers.add(check3);
@@ -67432,7 +67563,7 @@ async function openWorkspaces(options) {
 
 // src/cli/config.ts
 var import_node_os11 = require("os");
-var import_node_path70 = require("path");
+var import_node_path68 = require("path");
 init_zod();
 
 // src/client/contract.ts
@@ -67850,8 +67981,8 @@ function nextOffsetOf(response) {
 async function pause(ms, signal) {
   const either = AbortSignal.any([signal, AbortSignal.timeout(ms)]);
   if (either.aborted) return;
-  await new Promise((resolve14) => {
-    either.addEventListener("abort", () => resolve14(), { once: true });
+  await new Promise((resolve13) => {
+    either.addEventListener("abort", () => resolve13(), { once: true });
   });
 }
 function jittered(backoff, failures) {
@@ -68160,9 +68291,9 @@ async function sendNativeHookSignal(discoveryPath, hookSignal, signal) {
 
 // src/sessions/index.ts
 var import_node_crypto31 = require("crypto");
-var import_promises69 = require("fs/promises");
+var import_promises67 = require("fs/promises");
 var import_node_os10 = require("os");
-var import_node_path69 = require("path");
+var import_node_path67 = require("path");
 init_runtime_v2();
 
 // src/holder/control-client.ts
@@ -68213,8 +68344,8 @@ function isReply(message2) {
 async function connectHolder(endpoint, token, onEvent) {
   const socket = (0, import_node_net2.connect)(endpoint);
   const pending = /* @__PURE__ */ new Map();
-  const closed = new Promise((resolve14) => socket.once("close", () => resolve14()));
-  const ready = new Promise((resolve14, reject) => {
+  const closed = new Promise((resolve13) => socket.once("close", () => resolve13()));
+  const ready = new Promise((resolve13, reject) => {
     socket.once("error", reject);
     socket.once(
       "close",
@@ -68222,7 +68353,7 @@ async function connectHolder(endpoint, token, onEvent) {
     );
     readMessages(socket, holderMessageSchema, {
       onMessage: (message2) => {
-        if (message2.type === "ready") resolve14(message2.pid);
+        if (message2.type === "ready") resolve13(message2.pid);
         else if (isReply(message2)) {
           const id = message2.id;
           if (id === null) return;
@@ -68237,13 +68368,13 @@ async function connectHolder(endpoint, token, onEvent) {
   const pid = await ready;
   const request2 = (body) => {
     const id = (0, import_node_crypto26.randomUUID)();
-    return new Promise((resolve14, reject) => {
+    return new Promise((resolve13, reject) => {
       const timer = AbortSignal.timeout(REQUEST_TIMEOUT_MS7);
       timer.addEventListener("abort", () => {
         pending.delete(id);
         reject(new RuntimeFault("io_failed", "Holder did not answer"));
       });
-      pending.set(id, resolve14);
+      pending.set(id, resolve13);
       writeMessage(socket, { ...body, id });
     });
   };
@@ -68274,9 +68405,9 @@ function selectDriver(persistent, fallback) {
     suspend: async () => {
       await Promise.all([...drivers].map((driver) => driver.suspend?.()));
     },
-    respond: async (request2, mayWrite) => {
+    respond: async (request2) => {
       for (const driver of drivers) {
-        const status = await driver.respond?.(request2, mayWrite);
+        const status = await driver.respond?.(request2);
         if (status !== void 0 && status !== "unknown_run") return status;
       }
       return "unknown_run";
@@ -68316,9 +68447,9 @@ function createLazyDriver(load) {
     suspend: async () => {
       if (loaded.driver !== void 0) await (await loaded.driver).suspend?.();
     },
-    respond: async (request2, mayWrite) => {
+    respond: async (request2) => {
       if (loaded.driver === void 0) return "unknown_run";
-      return await (await loaded.driver).respond?.(request2, mayWrite) ?? "unknown_run";
+      return await (await loaded.driver).respond?.(request2) ?? "unknown_run";
     },
     stopTask: async (taskId) => {
       if (loaded.driver === void 0) return TASK_NOT_FOUND;
@@ -68580,14 +68711,14 @@ async function prepareRunInputs(spec, { source, tmpDir, signal, skills = [] }) {
 var import_node_crypto30 = require("crypto");
 var import_node_fs22 = require("fs");
 var import_node_net3 = require("net");
-var import_node_path68 = require("path");
+var import_node_path66 = require("path");
 init_runtime_v2();
 
 // src/holder/admission.ts
 var import_node_fs19 = require("fs");
-var import_promises63 = require("fs/promises");
+var import_promises61 = require("fs/promises");
 var import_node_os9 = require("os");
-var import_node_path62 = require("path");
+var import_node_path60 = require("path");
 init_constants();
 
 // ../shared/dist/node/local-workspace.js
@@ -68598,88 +68729,16 @@ function resolveAlanDefaultWorkspacePath(homeDirectory = (0, import_node_os8.hom
   return (0, import_node_path55.join)(homeDirectory, ".alan", "workspace");
 }
 
-// src/holder/admission-relocation.ts
+// src/holder/agent-context.ts
 var import_promises58 = require("fs/promises");
 var import_node_path56 = require("path");
-var MAX_RELOCATION_CANDIDATES = 200;
-var RELOCATION_BUDGET_MS = 2e4;
-function repositoryIdentity(url3) {
-  const trimmed4 = url3.trim().replace(/\/+$/, "").replace(/\.git$/i, "");
-  if (trimmed4.length === 0) return null;
-  const scp = /^(?:[^@/]+@)?([^:/]+):(.+)$/.exec(trimmed4);
-  if (scp !== null && !trimmed4.includes("://")) {
-    return `${scp[1]}/${scp[2]}`.toLowerCase();
-  }
-  try {
-    const parsed = new URL(trimmed4);
-    return `${parsed.hostname}${parsed.pathname}`.replace(/\/+$/, "").toLowerCase();
-  } catch {
-    return null;
-  }
-}
-function repositoryIdentities(urls) {
-  return new Set(
-    urls.map(repositoryIdentity).filter((identity) => identity !== null)
-  );
-}
-async function originIdentity(git, path4, signal) {
-  try {
-    const output2 = await git.run(
-      { cwd: path4, args: ["config", "--get", "remote.origin.url"], readOnly: true },
-      signal
-    );
-    return output2.exitCode === 0 ? repositoryIdentity(output2.stdout) : null;
-  } catch {
-    return null;
-  }
-}
-async function childDirectories(parent, limit) {
-  try {
-    const entries = await (0, import_promises58.readdir)(parent, { withFileTypes: true });
-    return entries.filter((entry) => entry.isDirectory()).slice(0, limit).map((entry) => (0, import_node_path56.join)(parent, entry.name));
-  } catch {
-    return [];
-  }
-}
-async function candidateFolders(search) {
-  const roots = /* @__PURE__ */ new Map();
-  for (const path4 of [search.missingPath, ...search.approvedWorkspacePaths]) {
-    const parent = (0, import_node_path56.dirname)((0, import_node_path56.resolve)(path4));
-    roots.set(comparablePath(parent, search.platform), parent);
-  }
-  const candidates2 = /* @__PURE__ */ new Map();
-  for (const root of roots.values()) {
-    const remaining = MAX_RELOCATION_CANDIDATES - candidates2.size;
-    if (remaining <= 0) break;
-    for (const child of await childDirectories(root, remaining)) {
-      candidates2.set(comparablePath(child, search.platform), child);
-    }
-  }
-  return [...candidates2.values()];
-}
-async function discoverRelocatedWorkspace(search) {
-  if (search.expected.size === 0) return null;
-  const signal = AbortSignal.any([search.signal, AbortSignal.timeout(RELOCATION_BUDGET_MS)]);
-  const matches = [];
-  for (const candidate of await candidateFolders(search)) {
-    if (signal.aborted) return null;
-    const identity = await originIdentity(search.git, candidate, signal);
-    if (identity !== null && search.expected.has(identity)) matches.push(candidate);
-    if (matches.length > 1) return null;
-  }
-  return matches[0] ?? null;
-}
-
-// src/holder/agent-context.ts
-var import_promises59 = require("fs/promises");
-var import_node_path57 = require("path");
 
 // ../agent-core/dist/prompt.js
-init_chunk_GI3ZGXTY();
+init_chunk_GW6CC6A3();
 
 // src/holder/agent-context.ts
 async function readText4(path4) {
-  return (0, import_promises59.readFile)(path4, "utf8").then(
+  return (0, import_promises58.readFile)(path4, "utf8").then(
     (text3) => text3.trim(),
     () => null
   );
@@ -68694,15 +68753,15 @@ async function startCommandState(statusPath) {
   return code === 0 ? { state: "exited_ok" } : { state: "failed", exitCode: code };
 }
 function createAgentContext(deps) {
-  const statusPath = (0, import_node_path57.join)(deps.homeDir, ".alan", "start-commands.status");
-  const logPath = (0, import_node_path57.join)(deps.homeDir, ".alan", "start-commands.log");
+  const statusPath = (0, import_node_path56.join)(deps.homeDir, ".alan", "start-commands.status");
+  const logPath = (0, import_node_path56.join)(deps.homeDir, ".alan", "start-commands.log");
   return async (spec, problems) => {
-    const file2 = (0, import_node_path57.join)(deps.dir, `${spec.conversationId}.json`);
+    const file2 = (0, import_node_path56.join)(deps.dir, `${spec.conversationId}.json`);
     const saved = await readJsonFile(file2, agentContextSnapshotSchema);
     const known = saved.kind === "ok" ? saved.value : void 0;
     const hasEnvironment = (spec.agentContext ?? known)?.environment !== void 0;
     const start = hasEnvironment ? await startCommandState(statusPath) : void 0;
-    const snapshot2 = agentContextSnapshot({
+    const snapshot = agentContextSnapshot({
       spec,
       ...spec.approvedWorkspacePaths?.[0] ? { workspaceRoot: spec.approvedWorkspacePaths[0] } : {},
       problems,
@@ -68710,39 +68769,39 @@ function createAgentContext(deps) {
       startLogPath: logPath,
       ...known ? { known } : {}
     });
-    if (snapshot2 === null) return void 0;
-    const rendered = renderAgentContext(snapshot2, known);
+    if (snapshot === null) return void 0;
+    const rendered = renderAgentContext(snapshot, known);
     return {
       full: rendered.full,
       ...rendered.update ? { update: rendered.update } : {},
-      save: () => writeJsonFileAtomic(file2, snapshot2)
+      save: () => writeJsonFileAtomic(file2, snapshot)
     };
   };
 }
 
 // src/holder/checkout-refresh.ts
-var import_node_path60 = require("path");
+var import_node_path59 = require("path");
 
 // src/holder/claim-once.ts
 var import_node_crypto28 = require("crypto");
-var import_promises60 = require("fs/promises");
-var import_node_path58 = require("path");
+var import_promises59 = require("fs/promises");
+var import_node_path57 = require("path");
 async function claimOnce(dir, name) {
   try {
-    await (0, import_promises60.mkdir)(dir, { recursive: true, mode: 448 });
-    await (await (0, import_promises60.open)((0, import_node_path58.join)(dir, name), "wx")).close();
+    await (0, import_promises59.mkdir)(dir, { recursive: true, mode: 448 });
+    await (await (0, import_promises59.open)((0, import_node_path57.join)(dir, name), "wx")).close();
     return true;
   } catch {
     return false;
   }
 }
 function claimFirstLease(freshnessDir, path4) {
-  return claimOnce((0, import_node_path58.join)(freshnessDir, "leased"), (0, import_node_crypto28.createHash)("sha256").update(path4).digest("hex"));
+  return claimOnce((0, import_node_path57.join)(freshnessDir, "leased"), (0, import_node_crypto28.createHash)("sha256").update(path4).digest("hex"));
 }
 
 // src/holder/requested-checkout.ts
-var import_promises61 = require("fs/promises");
-var import_node_path59 = require("path");
+var import_promises60 = require("fs/promises");
+var import_node_path58 = require("path");
 var REMOTE2 = "origin";
 var REASON_MAX_CHARS = 200;
 function firstLine3(text3) {
@@ -68763,8 +68822,8 @@ function notSwitched(checkout, current, reason) {
   );
 }
 async function clone2(checkout, deps, signal) {
-  const parent = (0, import_node_path59.dirname)(checkout.path);
-  await (0, import_promises61.mkdir)(parent, { recursive: true });
+  const parent = (0, import_node_path58.dirname)(checkout.path);
+  await (0, import_promises60.mkdir)(parent, { recursive: true });
   await assertValidBranch(deps.git, parent, checkout.branch, signal);
   const output2 = await deps.git.run(
     {
@@ -68916,9 +68975,9 @@ async function applyRequestedCheckout(checkout, spec, deps, signal) {
 function short(sha) {
   return sha.slice(0, 12);
 }
-function staleCheckout(path4, snapshot2, tip) {
-  const checkout = snapshot2 === void 0 ? "is the environment snapshot's checkout" : `is the environment snapshot's checkout of ${snapshot2.branch} (commit ${short(snapshot2.head)})`;
-  const base = snapshot2 === void 0 ? "its upstream" : `origin/${snapshot2.base}`;
+function staleCheckout(path4, snapshot, tip) {
+  const checkout = snapshot === void 0 ? "is the environment snapshot's checkout" : `is the environment snapshot's checkout of ${snapshot.branch} (commit ${short(snapshot.head)})`;
+  const base = snapshot === void 0 ? "its upstream" : `origin/${snapshot.base}`;
   const remote = tip === void 0 ? "may be ahead" : `is ahead at ${short(tip)}`;
   return {
     path: path4,
@@ -68929,18 +68988,18 @@ function staleCheckout(path4, snapshot2, tip) {
 async function fastForward(freshness, operationId, deps, signal) {
   var _stack = [];
   try {
-    const { path: cwd, snapshot: snapshot2, tip } = freshness;
-    const attempt2 = await deps.locks.tryExclusive(snapshot2.commonDir, operationId);
+    const { path: cwd, snapshot, tip } = freshness;
+    const attempt2 = await deps.locks.tryExclusive(snapshot.commonDir, operationId);
     if (attempt2.kind === "busy") return false;
     const _lock = __using(_stack, attempt2.lock, true);
     const now = await readCheckoutStatus(deps.git, cwd, signal);
-    if (now === null || now.dirty || now.head !== snapshot2.head || now.branch !== snapshot2.branch) {
+    if (now === null || now.dirty || now.head !== snapshot.head || now.branch !== snapshot.branch) {
       return false;
     }
     const git = (args) => deps.git.run({ cwd, args }, signal);
     if ((await git(["switch", "--quiet", "--detach", tip])).exitCode !== 0) return false;
-    const moved = await git(["update-ref", `refs/heads/${snapshot2.branch}`, tip, snapshot2.head]);
-    const back = await git(["switch", "--quiet", snapshot2.branch]);
+    const moved = await git(["update-ref", `refs/heads/${snapshot.branch}`, tip, snapshot.head]);
+    const back = await git(["switch", "--quiet", snapshot.branch]);
     return moved.exitCode === 0 && back.exitCode === 0;
   } catch (_) {
     var _error = _, _hasError = true;
@@ -68972,9 +69031,8 @@ function problemFor(freshness) {
       return staleCheckout(freshness.path, void 0);
   }
 }
-async function checkoutsOf(spec, leaseTargets) {
-  if (leaseTargets.length > 0 || spec.projectPath === void 0) return [...leaseTargets];
-  return checkoutsUnder(spec.projectPath);
+async function checkoutsOf(spec) {
+  return spec.projectPath === void 0 ? [] : checkoutsUnder(spec.projectPath);
 }
 function requestedCheckoutsOf(spec, log) {
   const roots = spec.approvedWorkspacePaths ?? [];
@@ -69002,7 +69060,7 @@ async function applyRequestedCheckouts(spec, deps, signal) {
       ...outcome2.kind === "moved" ? { how: outcome2.how } : {}
     });
     if (outcome2.kind === "on_branch") continue;
-    settled2.add((0, import_node_path60.resolve)(checkout.path));
+    settled2.add((0, import_node_path59.resolve)(checkout.path));
     if (outcome2.kind === "noted") {
       problems.push({ path: checkout.path, problem: outcome2.problem, action: outcome2.action });
     }
@@ -69012,7 +69070,7 @@ async function applyRequestedCheckouts(spec, deps, signal) {
 async function refreshSnapshotCheckouts(spec, targets, settled2, deps, signal) {
   const problems = [];
   for (const target of targets) {
-    if (settled2.has((0, import_node_path60.resolve)(target))) continue;
+    if (settled2.has((0, import_node_path59.resolve)(target))) continue;
     const freshness = await readCheckoutFreshness(deps.dir, target);
     if (freshness === null) continue;
     const outcome2 = await atFirstLease(freshness, spec, deps, signal).catch(
@@ -69029,11 +69087,11 @@ async function refreshSnapshotCheckouts(spec, targets, settled2, deps, signal) {
   return problems;
 }
 function createCheckoutRefresh(deps) {
-  return async (spec, leaseTargets, signal) => {
+  return async (spec, signal) => {
     if (spec.providerSessionId !== void 0) return [];
-    if (!await claimOnce((0, import_node_path60.join)(deps.dir, "conversations"), spec.conversationId)) return [];
+    if (!await claimOnce((0, import_node_path59.join)(deps.dir, "conversations"), spec.conversationId)) return [];
     const requested = await applyRequestedCheckouts(spec, deps, signal);
-    const targets = await checkoutsOf(spec, leaseTargets);
+    const targets = await checkoutsOf(spec);
     return [
       ...requested.problems,
       ...await refreshSnapshotCheckouts(spec, targets, requested.settled, deps, signal)
@@ -69041,207 +69099,6 @@ function createCheckoutRefresh(deps) {
   };
 }
 
-// src/holder/lease.ts
-var import_promises62 = require("fs/promises");
-var import_node_path61 = require("path");
-var LEASE_CHECK_EVERY_MS = 5e3;
-var MAX_TRANSIENT_FAILURES = 3;
-var BACKOFF_BASE_MS = 1e3;
-var BACKOFF_MAX_MS = 15e3;
-var MESSAGES = {
-  workspace_lease_unavailable: "The workspace or Git checkout became unavailable while the run was active. Restore it and start a new run.",
-  workspace_lease_path_changed: "The selected workspace folder changed while the run was active. The run stopped before continuing; choose the correct folder and start a new run.",
-  workspace_lease_repository_changed: "The workspace now points to a different repository or worktree. The run stopped before continuing; restore the original checkout and start a new run."
-};
-function identityFailure(code, workspacePath) {
-  return { code, problemCode: "app.workspace.missing", message: MESSAGES[code], workspacePath };
-}
-async function fileIdentity(path4) {
-  const canonical = await (0, import_promises62.realpath)(path4);
-  const info = await (0, import_promises62.stat)(canonical, { bigint: true });
-  return `${canonical}:${info.dev}:${info.ino}`;
-}
-async function snapshot(git, path4, signal) {
-  try {
-    const output2 = await git.run(
-      {
-        cwd: path4,
-        args: ["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"],
-        readOnly: true
-      },
-      signal
-    );
-    const [gitDir, commonDir] = output2.stdout.trim().split("\n");
-    if (output2.exitCode !== 0 || !gitDir || !commonDir) return null;
-    return {
-      workspace: await fileIdentity(path4),
-      repository: await fileIdentity(commonDir),
-      worktree: await fileIdentity(gitDir),
-      commonDir: await (0, import_promises62.realpath)(commonDir)
-    };
-  } catch {
-    return null;
-  }
-}
-async function gitValue(git, path4, args, signal) {
-  const output2 = await git.run({ cwd: path4, args, readOnly: true }, signal).catch(() => null);
-  const value2 = output2?.exitCode === 0 ? output2.stdout.trim() : "";
-  return value2.length > 0 ? value2 : null;
-}
-async function pathExists(path4) {
-  try {
-    await (0, import_promises62.stat)(path4);
-    return true;
-  } catch (error61) {
-    return errnoCode(error61) !== "ENOENT" && errnoCode(error61) !== "ENOTDIR";
-  }
-}
-async function hasGitMarker(path4) {
-  let directory;
-  try {
-    directory = await (0, import_promises62.realpath)(path4);
-  } catch {
-    return true;
-  }
-  for (; ; ) {
-    try {
-      await (0, import_promises62.stat)((0, import_node_path61.join)(directory, ".git"));
-      return true;
-    } catch (error61) {
-      const code = errnoCode(error61);
-      if (code !== "ENOENT" && code !== "ENOTDIR") return true;
-    }
-    const parent = (0, import_node_path61.dirname)(directory);
-    if (parent === directory) return false;
-    directory = parent;
-  }
-}
-async function probeCheckout(git, path4, captured, signal) {
-  const current = await snapshot(git, path4, signal);
-  if (current === null) {
-    const failure6 = identityFailure("workspace_lease_unavailable", path4);
-    return await pathExists(path4) ? { kind: "transient", failure: failure6 } : { kind: "failed", failure: failure6 };
-  }
-  if (current.workspace !== captured.workspace) {
-    return { kind: "failed", failure: identityFailure("workspace_lease_path_changed", path4) };
-  }
-  if (current.repository !== captured.repository || current.worktree !== captured.worktree) {
-    return { kind: "failed", failure: identityFailure("workspace_lease_repository_changed", path4) };
-  }
-  return { kind: "ok" };
-}
-async function releaseAll(locks) {
-  for (const lock of locks) await lock[Symbol.asyncDispose]();
-}
-async function captureOne(git, path4, signal) {
-  const identity = await snapshot(git, path4, signal);
-  if (identity === null) return identityFailure("workspace_lease_unavailable", path4);
-  const branch = await gitValue(git, path4, ["symbolic-ref", "-q", "--short", "HEAD"], signal);
-  const head = await gitValue(git, path4, ["rev-parse", "-q", "--verify", "HEAD"], signal);
-  return { path: path4, identity, checkout: { path: path4, commonDir: identity.commonDir, branch, head } };
-}
-async function captureWorkspaceLease(runId, paths, deps, signal) {
-  const captured = [];
-  const locks = [];
-  const locked = /* @__PURE__ */ new Set();
-  for (const path4 of paths) {
-    const one = await captureOne(deps.git, path4, signal);
-    if (!("identity" in one)) {
-      await releaseAll(locks);
-      return { kind: "failed", failure: one };
-    }
-    const key = comparablePath(one.identity.commonDir, deps.platform);
-    if (!locked.has(key)) {
-      const attempt2 = await deps.locks.tryShared(one.identity.commonDir, runId);
-      if (attempt2.kind === "busy") {
-        await releaseAll(locks);
-        return {
-          kind: "failed",
-          failure: {
-            code: "workspace_busy",
-            problemCode: null,
-            message: "Alan is committing or pushing in this repository for a checkout switch. Try again when it finishes.",
-            workspacePath: path4
-          }
-        };
-      }
-      locked.add(key);
-      locks.push(attempt2.lock);
-    }
-    captured.push(one);
-  }
-  return { kind: "held", lease: holdLease(captured, locks, deps) };
-}
-function holdLease(captured, locks, deps) {
-  const lifetime = new AbortController();
-  const lost = new AbortController();
-  const state = { failure: null, inFlight: null, transientStreak: 0, nextCheckAt: 0 };
-  const probeOnce = async () => {
-    for (const { path: path4, identity } of captured) {
-      const probe = await probeCheckout(deps.git, path4, identity, lifetime.signal);
-      if (probe.kind !== "ok") return probe;
-    }
-    return { kind: "ok" };
-  };
-  const lose = (failure6) => {
-    if (state.failure !== null) return;
-    state.failure = failure6;
-    deps.log.warn("holder.workspace_lease_lost", {
-      code: failure6.code,
-      workspacePath: failure6.workspacePath
-    });
-    lost.abort(failure6);
-  };
-  const apply = (probe) => {
-    if (probe.kind === "ok") {
-      state.transientStreak = 0;
-      state.nextCheckAt = 0;
-    } else if (probe.kind === "failed") {
-      lose(probe.failure);
-    } else {
-      state.transientStreak += 1;
-      if (state.transientStreak >= MAX_TRANSIENT_FAILURES) lose(probe.failure);
-      else {
-        const backoff = BACKOFF_BASE_MS * 2 ** (state.transientStreak - 1);
-        state.nextCheckAt = deps.clock.monotonic() + Math.min(backoff, BACKOFF_MAX_MS);
-      }
-    }
-    return state.failure === null;
-  };
-  const check3 = () => {
-    if (state.failure !== null) return Promise.resolve(false);
-    state.inFlight ??= probeOnce().then((probe) => lifetime.signal.aborted ? state.failure === null : apply(probe)).finally(() => {
-      state.inFlight = null;
-    });
-    return state.inFlight;
-  };
-  const monitor = captured.length === 0 ? null : startMaintenance({
-    everyMs: deps.everyMs ?? LEASE_CHECK_EVERY_MS,
-    jobs: [
-      {
-        name: "holder.workspace_lease",
-        run: async () => {
-          if (state.failure !== null || deps.clock.monotonic() < state.nextCheckAt) return;
-          await check3();
-        }
-      }
-    ],
-    clock: deps.clock,
-    log: deps.log
-  });
-  return {
-    checkouts: captured.map((entry) => entry.checkout),
-    lost: lost.signal,
-    failure: () => state.failure,
-    verify: check3,
-    [Symbol.asyncDispose]: async () => {
-      lifetime.abort();
-      await monitor?.[Symbol.asyncDispose]();
-      await releaseAll(locks);
-    }
-  };
-}
-
 // src/holder/admission.ts
 var VOLUME_ERRORS = /* @__PURE__ */ new Set([
   "EIO",
@@ -69250,13 +69107,12 @@ var VOLUME_ERRORS = /* @__PURE__ */ new Set([
   "ENXIO",
   "ESTALE"
 ]);
-var MESSAGES2 = {
+var MESSAGES = {
   missing: "This project folder was moved or removed. Locate it before starting the run.",
   permission: "Alan needs permission to access this project folder.",
   volume: "The drive containing this project is unavailable. Connect it and try again.",
   pinnedMissing: "This run must use exactly this project folder, and it was moved or removed. Restore it or choose another folder.",
-  notApproved: "This folder is not one of the workspaces approved on this computer.",
-  mismatch: "This folder belongs to a different repository. Choose the correct project folder and try again."
+  notApproved: "This folder is not one of the workspaces approved on this computer."
 };
 function rejected(rejection2, message2) {
   return { kind: "rejected", rejection: rejection2, message: message2 };
@@ -69275,7 +69131,7 @@ function volumeRoot(path4) {
 }
 async function exists4(path4) {
   try {
-    await (0, import_promises63.stat)(path4);
+    await (0, import_promises61.stat)(path4);
     return true;
   } catch {
     return false;
@@ -69283,30 +69139,23 @@ async function exists4(path4) {
 }
 async function inspectReadiness(path4) {
   try {
-    if (!(await (0, import_promises63.stat)(path4)).isDirectory()) {
-      return { ready: false, missing: true, message: MESSAGES2.missing };
+    if (!(await (0, import_promises61.stat)(path4)).isDirectory()) {
+      return { ready: false, missing: true, message: MESSAGES.missing };
     }
-    await (0, import_promises63.access)(path4, import_node_fs19.constants.R_OK | import_node_fs19.constants.W_OK | import_node_fs19.constants.X_OK);
+    await (0, import_promises61.access)(path4, import_node_fs19.constants.R_OK | import_node_fs19.constants.W_OK | import_node_fs19.constants.X_OK);
     return { ready: true };
   } catch (error61) {
     const code = errnoCode(error61) ?? "";
     if (code === "EACCES" || code === "EPERM") {
-      return { ready: false, missing: false, message: MESSAGES2.permission };
+      return { ready: false, missing: false, message: MESSAGES.permission };
     }
     const root = volumeRoot(path4);
     if (VOLUME_ERRORS.has(code) || code === "ENOENT" && root !== null && !await exists4(root)) {
-      return { ready: false, missing: false, message: MESSAGES2.volume };
+      return { ready: false, missing: false, message: MESSAGES.volume };
     }
-    return { ready: false, missing: true, message: MESSAGES2.missing };
+    return { ready: false, missing: true, message: MESSAGES.missing };
   }
 }
-function expectedRepositoryUrls(spec, projectPath, platform3) {
-  const folder = comparablePath(projectPath, platform3);
-  return [
-    ...(spec.repoLocalPaths ?? []).filter((repo) => comparablePath(repo.localPath, platform3) === folder).map((repo) => repo.repoUrl),
-    ...spec.localRepoUrls ?? []
-  ];
-}
 function resolveSelectedSkills(spec, context) {
   const invocations = spec.skillInvocations ?? [];
   if (context.skills === void 0) {
@@ -69333,51 +69182,18 @@ async function checkProvider(spec, context) {
     `The ${provider4.name} CLI (\`${provider4.command}\`) is not installed on this computer, or it is not on the PATH Alan uses. Install it and try again.`
   );
 }
-async function locateWorkspace(spec, projectPath, expected, context, signal) {
-  const readiness2 = await inspectReadiness(projectPath);
-  if (readiness2.ready) return { cwd: projectPath, relocated: null };
-  if (!readiness2.missing) return rejected("workspace_unavailable", readiness2.message);
-  if (spec.workspacePathPinned === true) {
-    return rejected("workspace_pinned_missing", MESSAGES2.pinnedMissing);
-  }
-  const found = await discoverRelocatedWorkspace({
-    missingPath: projectPath,
-    approvedWorkspacePaths: spec.approvedWorkspacePaths ?? [],
-    expected,
-    git: context.git,
-    platform: context.platform,
-    signal
-  });
-  if (found === null) return rejected("workspace_unavailable", readiness2.message);
-  const moved = await inspectReadiness(found);
-  if (!moved.ready) return rejected("workspace_unavailable", moved.message);
-  return {
-    cwd: found,
-    relocated: {
-      sessionUpdate: "_alan/run.workspace_relocated",
-      previousPath: projectPath,
-      canonicalPath: found
-    }
-  };
-}
 async function admitDefaultWorkspace(spec, context, skills) {
   const { env } = context;
   const path4 = resolveAlanDefaultWorkspacePath(env.HOME || env.USERPROFILE || (0, import_node_os9.homedir)());
   try {
-    await (0, import_promises63.mkdir)(path4, { recursive: true, mode: 448 });
-    await (0, import_promises63.access)(path4, import_node_fs19.constants.R_OK | import_node_fs19.constants.W_OK | import_node_fs19.constants.X_OK);
-    return {
-      kind: "admitted",
-      spec: { ...spec, projectPath: path4 },
-      relocated: null,
-      leaseTargets: [],
-      skills
-    };
+    await (0, import_promises61.mkdir)(path4, { recursive: true, mode: 448 });
+    await (0, import_promises61.access)(path4, import_node_fs19.constants.R_OK | import_node_fs19.constants.W_OK | import_node_fs19.constants.X_OK);
+    return { kind: "admitted", spec: { ...spec, projectPath: path4 }, skills };
   } catch (error61) {
     const code = errnoCode(error61);
     return rejected(
       "workspace_unavailable",
-      code === "EACCES" || code === "EPERM" ? MESSAGES2.permission : MESSAGES2.missing
+      code === "EACCES" || code === "EPERM" ? MESSAGES.permission : MESSAGES.missing
     );
   }
 }
@@ -69391,7 +69207,7 @@ async function withInstalledCloudSkills(spec, context) {
     }
   };
 }
-async function admitRun(spec, context, signal) {
+async function admitRun(spec, context) {
   const provider4 = await checkProvider(spec, context);
   if (provider4 !== null) return provider4;
   const selected = await resolveSelectedSkills(spec, context);
@@ -69404,50 +69220,30 @@ async function admitRun(spec, context, signal) {
   const skills = selected.skills;
   spec = await withInstalledCloudSkills(spec, context);
   const projectPath = spec.projectPath;
-  if (projectPath === void 0) {
-    return { kind: "admitted", spec, relocated: null, leaseTargets: [], skills };
-  }
+  if (projectPath === void 0) return { kind: "admitted", spec, skills };
   if (isAlanDefaultWorkspace(projectPath)) return admitDefaultWorkspace(spec, context, skills);
-  const { platform: platform3 } = context;
-  const expected = repositoryIdentities(expectedRepositoryUrls(spec, projectPath, platform3));
-  const located = await locateWorkspace(spec, projectPath, expected, context, signal);
-  if ("kind" in located) return located;
-  const { cwd, relocated } = located;
+  const readiness2 = await inspectReadiness(projectPath);
+  if (!readiness2.ready) {
+    return readiness2.missing && spec.workspacePathPinned === true ? rejected("workspace_pinned_missing", MESSAGES.pinnedMissing) : rejected("workspace_unavailable", readiness2.message);
+  }
   const roots = [
     ...await context.approvedRoots(),
     projectPath,
     ...spec.approvedWorkspacePaths ?? [],
-    ...(spec.repoLocalPaths ?? []).map((repo) => repo.localPath),
-    ...relocated === null ? [] : [relocated.canonicalPath]
+    ...(spec.repoLocalPaths ?? []).map((repo) => repo.localPath)
   ];
-  if (!await isApprovedPath(cwd, roots, platform3)) {
-    return rejected("workspace_unavailable", MESSAGES2.notApproved);
+  if (!await isApprovedPath(projectPath, roots, context.platform)) {
+    return rejected("workspace_unavailable", MESSAGES.notApproved);
   }
-  if (expected.size > 0) {
-    const identity = await originIdentity(context.git, cwd, signal);
-    if (identity === null || !expected.has(identity)) {
-      return rejected("workspace_repository_mismatch", MESSAGES2.mismatch);
-    }
-  }
-  return {
-    kind: "admitted",
-    spec: relocated === null ? spec : { ...spec, projectPath: cwd },
-    relocated,
-    leaseTargets: await hasGitMarker(cwd) ? [cwd] : [],
-    skills
-  };
+  return { kind: "admitted", spec, skills };
 }
-var PROBE_TIMEOUT_MS2 = 5e3;
 var CHECKOUT_LOCAL_TIMEOUT_MS = 6e4;
 var CHECKOUT_NETWORK_TIMEOUT_MS = 12e4;
 function createHolderWorkspace(machine, clock, log) {
   const platform3 = machine.platform ?? process.platform;
-  const git = createGitRunner({ env: machine.env, platform: platform3, localTimeoutMs: PROBE_TIMEOUT_MS2 });
-  const locks = openRepositoryLocks({ dir: (0, import_node_path62.join)(machine.stateDir, "locks"), clock, platform: platform3 });
   return {
     admission: {
       env: machine.env,
-      git,
       platform: platform3,
       skills: skillsLayout(
         machine.stateDir,
@@ -69455,14 +69251,13 @@ function createHolderWorkspace(machine, clock, log) {
       ),
       approvedRoots: async () => {
         const approved = await openApprovedPaths({
-          file: (0, import_node_path62.join)(machine.stateDir, "workspaces.json"),
+          file: (0, import_node_path60.join)(machine.stateDir, "workspaces.json"),
           log,
           platform: platform3
         });
         return approved.roots();
       }
     },
-    lease: { git, locks, clock, log, platform: platform3 },
     ...machine.refreshesFirstCheckout === true ? {
       refreshFirstCheckout: createCheckoutRefresh({
         git: createGitRunner({
@@ -69471,12 +69266,12 @@ function createHolderWorkspace(machine, clock, log) {
           localTimeoutMs: CHECKOUT_LOCAL_TIMEOUT_MS,
           networkTimeoutMs: CHECKOUT_NETWORK_TIMEOUT_MS
         }),
-        locks,
+        locks: openRepositoryLocks({ dir: (0, import_node_path60.join)(machine.stateDir, "locks"), clock, platform: platform3 }),
         log,
-        dir: (0, import_node_path62.join)(machine.stateDir, "checkout-freshness")
+        dir: (0, import_node_path60.join)(machine.stateDir, "checkout-freshness")
       }),
       prepareAgentContext: createAgentContext({
-        dir: (0, import_node_path62.join)(machine.stateDir, "agent-context"),
+        dir: (0, import_node_path60.join)(machine.stateDir, "agent-context"),
         homeDir: machine.env.HOME || (0, import_node_os9.homedir)()
       })
     } : {}
@@ -69484,28 +69279,14 @@ function createHolderWorkspace(machine, clock, log) {
 }
 
 // src/holder/respond.ts
-function createAnswerGate() {
-  const state = { lease: null };
-  return {
-    allows: () => state.lease?.verify() ?? Promise.resolve(true),
-    guard: (lease) => {
-      state.lease = lease;
-      return {
-        [Symbol.dispose]: () => {
-          if (state.lease === lease) state.lease = null;
-        }
-      };
-    }
-  };
-}
-async function respondToTurn(runningRunId, gate, driver, request2) {
+async function respondToTurn(runningRunId, driver, request2) {
   if (runningRunId !== request2.runId) return "unknown_run";
   if (driver.respond === void 0) return "not_waiting";
-  return driver.respond(request2, () => gate.allows());
+  return driver.respond(request2);
 }
 
 // src/holder/session-facts.ts
-var import_promises64 = require("fs/promises");
+var import_promises62 = require("fs/promises");
 var CLI_RSS_CACHE_MS = 1e4;
 var LOGIN_PROBLEM_PREFIX = "cli.auth.";
 function isLoginFailure(result) {
@@ -69531,8 +69312,8 @@ function createSessionFacts(options) {
     const path4 = await resolveCommandOnPath(command, env, platform3);
     if (path4 === null) return null;
     try {
-      const real = await (0, import_promises64.realpath)(path4);
-      const info = await (0, import_promises64.stat)(real);
+      const real = await (0, import_promises62.realpath)(path4);
+      const info = await (0, import_promises62.stat)(real);
       return { command, key: `${real}:${info.ino}:${info.size}:${info.mtimeMs}` };
     } catch {
       return null;
@@ -69619,12 +69400,12 @@ function createSessionFacts(options) {
 init_acp2();
 
 // src/run-log/archive.ts
-var import_promises65 = require("fs/promises");
-var import_node_path63 = require("path");
+var import_promises63 = require("fs/promises");
+var import_node_path61 = require("path");
 init_runtime_v2();
 async function openRunArchive(runsDir) {
-  const path4 = (0, import_node_path63.join)((0, import_node_path63.dirname)(runsDir), "archived-runs.txt");
-  const text3 = await (0, import_promises65.readFile)(path4, "utf8").catch((error61) => {
+  const path4 = (0, import_node_path61.join)((0, import_node_path61.dirname)(runsDir), "archived-runs.txt");
+  const text3 = await (0, import_promises63.readFile)(path4, "utf8").catch((error61) => {
     if (errnoCode(error61) === "ENOENT") return "";
     throw error61;
   });
@@ -69638,7 +69419,7 @@ async function openRunArchive(runsDir) {
     add: async (runIds) => {
       const added = runIds.filter((runId) => !archived.has(runId));
       if (added.length === 0) return;
-      await (0, import_promises65.appendFile)(path4, `
+      await (0, import_promises63.appendFile)(path4, `
 ${added.join("\n")}
 `, { mode: 384 });
       for (const runId of added) archived.add(runId);
@@ -69649,11 +69430,11 @@ ${added.join("\n")}
 // src/run-log/complete.ts
 var import_node_crypto29 = require("crypto");
 var import_node_fs20 = require("fs");
-var import_node_path65 = require("path");
+var import_node_path63 = require("path");
 
 // src/run-log/directory.ts
-var import_promises66 = require("fs/promises");
-var import_node_path64 = require("path");
+var import_promises64 = require("fs/promises");
+var import_node_path62 = require("path");
 init_runtime_v2();
 init_zod();
 var runMetaSchema = external_exports.object({
@@ -69679,17 +69460,17 @@ async function readRunMeta(path4) {
   return read.kind === "ok" ? read.value : null;
 }
 function runDirectory(runsDir, runId) {
-  const dir = (0, import_node_path64.join)(runsDir, runId);
+  const dir = (0, import_node_path62.join)(runsDir, runId);
   return {
     dir,
-    log: (0, import_node_path64.join)(dir, "log.jsonl"),
-    upload: (0, import_node_path64.join)(dir, "upload.json"),
-    meta: (0, import_node_path64.join)(dir, "run.json")
+    log: (0, import_node_path62.join)(dir, "log.jsonl"),
+    upload: (0, import_node_path62.join)(dir, "upload.json"),
+    meta: (0, import_node_path62.join)(dir, "run.json")
   };
 }
 async function isRunClaimed(runsDir, runId) {
   try {
-    return (await (0, import_promises66.stat)(runDirectory(runsDir, runId).log)).size > 0;
+    return (await (0, import_promises64.stat)(runDirectory(runsDir, runId).log)).size > 0;
   } catch (error61) {
     if (errnoCode(error61) === "ENOENT") return false;
     throw error61;
@@ -69698,7 +69479,7 @@ async function isRunClaimed(runsDir, runId) {
 
 // src/run-log/complete.ts
 function writeLogFile(path4, dir, text3) {
-  const temp = (0, import_node_path65.join)(dir, `.log.${(0, import_node_crypto29.randomUUID)()}.tmp`);
+  const temp = (0, import_node_path63.join)(dir, `.log.${(0, import_node_crypto29.randomUUID)()}.tmp`);
   const fd = (0, import_node_fs20.openSync)(temp, "wx", 384);
   try {
     (0, import_node_fs20.writeSync)(fd, text3);
@@ -69727,8 +69508,8 @@ async function writeCompleteRunLog(runsDir, meta3, records) {
 }
 
 // src/run-log/conversation-index.ts
-var import_promises67 = require("fs/promises");
-var import_node_path66 = require("path");
+var import_promises65 = require("fs/promises");
+var import_node_path64 = require("path");
 init_runtime_v2();
 init_zod();
 var ORDINALS_PER_SHARD = 1e3;
@@ -69745,13 +69526,13 @@ var coverageSchema = external_exports.object({
   nextExpectedOrdinal: external_exports.number().int().positive()
 });
 function conversationsDirectory(runsDir) {
-  return (0, import_node_path66.join)((0, import_node_path66.dirname)(runsDir), "conversations");
+  return (0, import_node_path64.join)((0, import_node_path64.dirname)(runsDir), "conversations");
 }
 function indexDirectory(runsDir, conversationId) {
-  return (0, import_node_path66.join)(conversationsDirectory(runsDir), conversationId, "turn-index");
+  return (0, import_node_path64.join)(conversationsDirectory(runsDir), conversationId, "turn-index");
 }
 function shardPath(runsDir, conversationId, ordinal) {
-  return (0, import_node_path66.join)(
+  return (0, import_node_path64.join)(
     indexDirectory(runsDir, conversationId),
     `${Math.floor(ordinal / ORDINALS_PER_SHARD)}.jsonl`
   );
@@ -69760,10 +69541,10 @@ async function indexConversationRun(runsDir, conversationId, ordinal, assistantO
   const nextOrdinal = assistantOrdinal + 1;
   if (nextOrdinal <= ordinal) throw new Error("Assistant order must follow the prompt");
   const path4 = shardPath(runsDir, conversationId, ordinal);
-  await (0, import_promises67.mkdir)((0, import_node_path66.dirname)(path4), { recursive: true, mode: 448 });
-  await (0, import_promises67.appendFile)(path4, `${JSON.stringify({ ordinal, nextOrdinal, runId })}
+  await (0, import_promises65.mkdir)((0, import_node_path64.dirname)(path4), { recursive: true, mode: 448 });
+  await (0, import_promises65.appendFile)(path4, `${JSON.stringify({ ordinal, nextOrdinal, runId })}
 `, { mode: 384 });
-  const coveragePath = (0, import_node_path66.join)((0, import_node_path66.dirname)((0, import_node_path66.dirname)(path4)), "coverage.json");
+  const coveragePath = (0, import_node_path64.join)((0, import_node_path64.dirname)((0, import_node_path64.dirname)(path4)), "coverage.json");
   const coverage = await readJsonFile(coveragePath, coverageSchema);
   const current = coverage.kind === "ok" ? coverage.value : null;
   const next = nextCoverage(current, ordinal, nextOrdinal);
@@ -69778,13 +69559,13 @@ function nextCoverage(current, ordinal, nextOrdinal) {
   return null;
 }
 async function readConversationIndexCoverage(runsDir, conversationId) {
-  const path4 = (0, import_node_path66.join)((0, import_node_path66.dirname)(indexDirectory(runsDir, conversationId)), "coverage.json");
+  const path4 = (0, import_node_path64.join)((0, import_node_path64.dirname)(indexDirectory(runsDir, conversationId)), "coverage.json");
   const result = await readJsonFile(path4, coverageSchema);
   return result.kind === "ok" ? result.value : null;
 }
 async function readConversationRunIndex(runsDir, conversationId, before, limit) {
   const directory = indexDirectory(runsDir, conversationId);
-  const names = await (0, import_promises67.readdir)(directory).catch((error61) => {
+  const names = await (0, import_promises65.readdir)(directory).catch((error61) => {
     if (error61.code === "ENOENT") return [];
     throw error61;
   });
@@ -69793,7 +69574,7 @@ async function readConversationRunIndex(runsDir, conversationId, before, limit)
   ).sort((left, right) => right - left);
   const selected = [];
   for (const shard of shards) {
-    const text3 = await (0, import_promises67.readFile)((0, import_node_path66.join)(directory, `${shard}.jsonl`), "utf8");
+    const text3 = await (0, import_promises65.readFile)((0, import_node_path64.join)(directory, `${shard}.jsonl`), "utf8");
     const records = text3.split("\n").flatMap((line) => {
       if (!line) return [];
       const parsed = indexRecordSchema.parse(JSON.parse(line));
@@ -69818,7 +69599,7 @@ async function readIndexableRun(runsDir, name) {
   return { conversationId: meta3.conversationId, ordinal, assistantOrdinal, runId: runId.data };
 }
 async function readIndexableRuns(runsDir) {
-  const names = await (0, import_promises67.readdir)(runsDir).catch(() => []);
+  const names = await (0, import_promises65.readdir)(runsDir).catch(() => []);
   const byConversation = /* @__PURE__ */ new Map();
   let next = 0;
   const worker = async () => {
@@ -69848,21 +69629,21 @@ async function writeConversationIndex(directory, runs) {
     else lines2.push(line);
     coverage = nextCoverage(coverage, run2.ordinal, nextOrdinal) ?? coverage;
   }
-  await (0, import_promises67.mkdir)((0, import_node_path66.join)(directory, "turn-index"), { recursive: true, mode: 448 });
+  await (0, import_promises65.mkdir)((0, import_node_path64.join)(directory, "turn-index"), { recursive: true, mode: 448 });
   for (const [shard, lines2] of shards) {
-    await (0, import_promises67.writeFile)((0, import_node_path66.join)(directory, "turn-index", `${shard}.jsonl`), `${lines2.join("\n")}
+    await (0, import_promises65.writeFile)((0, import_node_path64.join)(directory, "turn-index", `${shard}.jsonl`), `${lines2.join("\n")}
 `, {
       mode: 384
     });
   }
-  await (0, import_promises67.writeFile)((0, import_node_path66.join)(directory, "coverage.json"), `${JSON.stringify(coverage)}
+  await (0, import_promises65.writeFile)((0, import_node_path64.join)(directory, "coverage.json"), `${JSON.stringify(coverage)}
 `, {
     mode: 384
   });
 }
 async function rebuildConversationIndexes(runsDir) {
   const root = conversationsDirectory(runsDir);
-  const exists6 = await (0, import_promises67.stat)(root).then(
+  const exists6 = await (0, import_promises65.stat)(root).then(
     () => true,
     (error61) => {
       if (errnoCode(error61) === "ENOENT") return false;
@@ -69871,18 +69652,18 @@ async function rebuildConversationIndexes(runsDir) {
   );
   if (exists6) return 0;
   const building = `${root}.rebuilding`;
-  await (0, import_promises67.rm)(building, { recursive: true, force: true });
-  await (0, import_promises67.mkdir)(building, { recursive: true, mode: 448 });
+  await (0, import_promises65.rm)(building, { recursive: true, force: true });
+  await (0, import_promises65.mkdir)(building, { recursive: true, mode: 448 });
   const byConversation = await readIndexableRuns(runsDir);
   for (const [conversationId, runs] of byConversation) {
-    await writeConversationIndex((0, import_node_path66.join)(building, conversationId), runs);
+    await writeConversationIndex((0, import_node_path64.join)(building, conversationId), runs);
   }
-  await (0, import_promises67.rename)(building, root);
+  await (0, import_promises65.rename)(building, root);
   return byConversation.size;
 }
 
 // src/run-log/reader.ts
-var import_promises68 = require("fs/promises");
+var import_promises66 = require("fs/promises");
 init_runtime_v2();
 
 // src/run-log/tail.ts
@@ -69905,7 +69686,7 @@ function firstRecordLength(bytes) {
   return bytes.indexOf(RUN_LOG_RECORD_SEPARATOR) + 1;
 }
 async function openRunLogReader(path4) {
-  const handle = await (0, import_promises68.open)(path4, "r");
+  const handle = await (0, import_promises66.open)(path4, "r");
   const readAt = async (position, length) => {
     const buffer = Buffer.alloc(length);
     const { bytesRead } = await handle.read(buffer, 0, length, position);
@@ -69939,7 +69720,7 @@ async function openRunLogReader(path4) {
   };
 }
 async function readLastRecord(path4) {
-  const handle = await (0, import_promises68.open)(path4, "r").catch(() => null);
+  const handle = await (0, import_promises66.open)(path4, "r").catch(() => null);
   if (handle === null) return null;
   try {
     const { size } = await handle.stat();
@@ -69973,7 +69754,7 @@ var decoder = new TextDecoder();
 
 // src/run-log/writer.ts
 var import_node_fs21 = require("fs");
-var import_node_path67 = require("path");
+var import_node_path65 = require("path");
 init_runtime_v2();
 function lastSeq(fd, size) {
   for (const length of tailWindows(size)) {
@@ -69989,7 +69770,7 @@ function lastSeq(fd, size) {
   throw new RuntimeFault("record_too_large", "Run log tail record is larger than any record");
 }
 function openRunLog(path4, clock) {
-  (0, import_node_fs21.mkdirSync)((0, import_node_path67.dirname)(path4), { recursive: true, mode: 448 });
+  (0, import_node_fs21.mkdirSync)((0, import_node_path65.dirname)(path4), { recursive: true, mode: 448 });
   const fd = (0, import_node_fs21.openSync)(path4, "a+", 384);
   let size = (0, import_node_fs21.fstatSync)(fd).size;
   let seq = lastSeq(fd, size);
@@ -70026,107 +69807,6 @@ function openRunLog(path4, clock) {
   };
 }
 
-// src/holder/lease-gate.ts
-init_acp();
-var READ_ONLY_TOOL_KINDS = /* @__PURE__ */ new Set([
-  "read",
-  "search",
-  "think",
-  "fetch",
-  "switch_mode"
-]);
-function gateWorkspaceWrites(sink, lease) {
-  const kinds = /* @__PURE__ */ new Map();
-  const state = { tail: Promise.resolve(), pending: 0, gate: null, blocked: 0 };
-  const writesFiles = (update) => {
-    if (!isUpdate(update, "tool_call_update")) return false;
-    if (typeof update.kind === "string") kinds.set(update.toolCallId, update.kind);
-    const kind = kinds.get(update.toolCallId);
-    return kind === void 0 || !READ_ONLY_TOOL_KINDS.has(kind);
-  };
-  const deliver = (event) => {
-    if (lease.failure() === null) {
-      sink.onEvent(event);
-      return;
-    }
-    if (event.update.sessionUpdate === "tool_call_update") state.blocked += 1;
-  };
-  const enqueue = (event, gate) => {
-    state.pending += 1;
-    state.tail = state.tail.then(async () => {
-      if (gate === null || await gate) deliver(event);
-      else if (event.update.sessionUpdate === "tool_call_update") state.blocked += 1;
-    }).finally(() => {
-      state.pending -= 1;
-      if (state.pending === 0) state.gate = null;
-    });
-  };
-  return {
-    onSpawned: (pid) => sink.onSpawned(pid),
-    onEvent: (event) => {
-      const write = writesFiles(event.update);
-      if (!write && state.pending === 0) {
-        deliver(event);
-        return;
-      }
-      if (write) state.gate ??= lease.verify();
-      enqueue(event, state.gate);
-    },
-    drain: async () => {
-      while (state.pending > 0) await state.tail;
-    },
-    blocked: () => state.blocked
-  };
-}
-
-// src/holder/lease-turn.ts
-function leaseNotice(failure6, blocked) {
-  const withheld = blocked === 0 ? "" : ` ${blocked} tool ${blocked === 1 ? "update was" : "updates were"} withheld.`;
-  return {
-    sessionUpdate: "notice",
-    severity: "error",
-    title: "The workspace changed while the agent was working",
-    description: `${failure6.message}${withheld}`,
-    _meta: {
-      "alan.dev/noticeKind": "workspace_lease_lost",
-      ...failure6.problemCode === null ? {} : { "alan.dev/problem": { domain: "application", code: failure6.problemCode } }
-    }
-  };
-}
-async function runLeased(spec, paths, turn, sink, signal, run2) {
-  var _stack = [];
-  try {
-    const capture = await captureWorkspaceLease(spec.runId, paths, turn.lease, signal);
-    if (capture.kind === "failed") {
-      turn.log.warn("holder.workspace_lease_refused", {
-        runId: spec.runId,
-        code: capture.failure.code
-      });
-      return { outcome: "failed", message: capture.failure.message };
-    }
-    const lease = __using(_stack, capture.lease, true);
-    const _answers = __using(_stack, turn.answerGate?.guard(lease));
-    turn.log.info("holder.workspace_leased", { runId: spec.runId, checkouts: lease.checkouts });
-    const gated = gateWorkspaceWrites(sink, lease);
-    const result = await run2(gated, AbortSignal.any([signal, lease.lost]));
-    await gated.drain();
-    const failure6 = lease.failure();
-    if (failure6 === null) return result;
-    sink.onEvent({ seq: 0, at: turn.clock.now(), update: leaseNotice(failure6, gated.blocked()) });
-    await turn.driver.suspend?.().catch((error61) => turn.log.warn("holder.driver_suspend_failed", { error: error61 }));
-    return {
-      outcome: "failed",
-      message: failure6.message,
-      ...result.providerSessionId === void 0 ? {} : { providerSessionId: result.providerSessionId }
-    };
-  } catch (_) {
-    var _error = _, _hasError = true;
-  } finally {
-    var _promise2 = __callDispose(_stack, _error, _hasError);
-    _promise2 && await _promise2;
-  }
-}
-
 // src/holder/record-fit.ts
 init_acp2();
 init_runtime_v2();
@@ -70164,11 +69844,11 @@ function fitForRunLog(update) {
 }
 
 // src/holder/turn.ts
-async function runWithInputs({ spec, leaseTargets, skills }, context, sink, signal) {
+async function runWithInputs({ spec, skills }, context, sink, signal) {
   var _stack = [];
   try {
     const workspace = context.workspace;
-    const sessionContext = (workspace?.refreshFirstCheckout?.(spec, leaseTargets, signal) ?? Promise.resolve([])).catch((error61) => {
+    const sessionContext = (workspace?.refreshFirstCheckout?.(spec, signal) ?? Promise.resolve([])).catch((error61) => {
       context.log.warn("workspace.refresh_failed", { runId: spec.runId, error: error61 });
       return [];
     }).then((problems) => workspace?.prepareAgentContext?.(spec, problems)).catch((error61) => {
@@ -70187,35 +69867,24 @@ async function runWithInputs({ spec, leaseTargets, skills }, context, sink, sign
     }
     const agentContext = await sessionContext;
     const prepared = __using(_stack, inputs, true);
-    const run2 = async (turnSink, turnSignal) => {
-      const result = await context.driver.runTurn(
-        spec,
-        turnSink,
-        turnSignal,
-        agentContext === void 0 ? prepared : {
-          ...prepared,
-          agentContext: {
-            full: agentContext.full,
-            ...agentContext.update ? { update: agentContext.update } : {}
-          }
-        }
-      );
-      if (agentContext !== void 0 && result.outcome !== "rejected") {
-        await agentContext.save().catch((error61) => {
-          context.log.warn("holder.agent_context_save_failed", { runId: spec.runId, error: error61 });
-        });
-      }
-      return result;
-    };
-    if (workspace === void 0) return await run2(sink, signal);
-    return await runLeased(
+    const result = await context.driver.runTurn(
       spec,
-      leaseTargets,
-      { ...context, lease: workspace.lease },
       sink,
       signal,
-      run2
+      agentContext === void 0 ? prepared : {
+        ...prepared,
+        agentContext: {
+          full: agentContext.full,
+          ...agentContext.update ? { update: agentContext.update } : {}
+        }
+      }
     );
+    if (agentContext !== void 0 && result.outcome !== "rejected") {
+      await agentContext.save().catch((error61) => {
+        context.log.warn("holder.agent_context_save_failed", { runId: spec.runId, error: error61 });
+      });
+    }
+    return result;
   } catch (_) {
     var _error = _, _hasError = true;
   } finally {
@@ -70223,7 +69892,7 @@ async function runWithInputs({ spec, leaseTargets, skills }, context, sink, sign
     _promise2 && await _promise2;
   }
 }
-async function admitAndRun(spec, context, append, sink, signal) {
+async function admitAndRun(spec, context, sink, signal) {
   if (context.workspace === void 0) {
     if (spec.skillInvocations?.length) {
       return {
@@ -70232,14 +69901,13 @@ async function admitAndRun(spec, context, append, sink, signal) {
         message: "Selected skills need this computer's skill sync, which this holder does not have."
       };
     }
-    return runWithInputs({ spec, leaseTargets: [], skills: [] }, context, sink, signal);
+    return runWithInputs({ spec, skills: [] }, context, sink, signal);
   }
-  const admission = await admitRun(spec, context.workspace.admission, signal);
+  const admission = await admitRun(spec, context.workspace.admission);
   if (admission.kind === "rejected") {
     context.log.info("holder.run_rejected", { runId: spec.runId, rejection: admission.rejection });
     return { outcome: "rejected", rejection: admission.rejection, message: admission.message };
   }
-  if (admission.relocated !== null) append(admission.relocated);
   return runWithInputs(admission, context, sink, signal);
 }
 async function claimRun(spec, context) {
@@ -70286,7 +69954,6 @@ async function runClaimedTurn(spec, claimed, context, signal) {
       result = await admitAndRun(
         spec,
         context,
-        append,
         {
           onSpawned: (pid) => append(runStarted({ pid })),
           // Base64 media in provider payloads and tool output never reaches the log (main 13590db369).
@@ -70349,12 +70016,11 @@ async function runHolder({
   try {
     const identity = await readProcessIdentity(process.pid);
     if (identity === null) throw new RuntimeFault("internal", "Cannot read own process identity");
-    const _engines = __using(_stack, recordSpawnedEngines(engineRecordsPath((0, import_node_path68.dirname)(launch.statusPath)), clock, log));
+    const _engines = __using(_stack, recordSpawnedEngines(engineRecordsPath((0, import_node_path66.dirname)(launch.statusPath)), clock, log));
     const holder = {
       state: "idle",
       runId: null,
       turn: null,
-      answerGate: createAnswerGate(),
       clients: /* @__PURE__ */ new Set()
     };
     const exit = new AbortController();
@@ -70412,8 +70078,7 @@ async function runHolder({
         log,
         onAppended: (runId, offset) => broadcast({ type: "appended", runId, offset }),
         ...inputs === void 0 ? {} : { inputs },
-        ...workspace === void 0 ? {} : { workspace },
-        answerGate: holder.answerGate
+        ...workspace === void 0 ? {} : { workspace }
       };
       claimRun(spec, context).then(
         (claimed) => {
@@ -70445,7 +70110,7 @@ async function runHolder({
       );
     };
     const respond = (request2, client) => {
-      respondToTurn(holder.runId, holder.answerGate, driver, request2).then((status) => {
+      respondToTurn(holder.runId, driver, request2).then((status) => {
         log.info("holder.responded", { runId: request2.runId, status });
         writeMessage(client, { type: "responded", id: request2.id, status });
       }).catch((error61) => {
@@ -70491,12 +70156,12 @@ async function runHolder({
           return;
         case "status":
           void facts.snapshot().then(
-            (snapshot2) => writeMessage(client, {
+            (snapshot) => writeMessage(client, {
               type: "status",
               id: request2.id,
               state: holder.state,
               runId: holder.runId,
-              facts: snapshot2
+              facts: snapshot
             })
           );
           return;
@@ -70545,16 +70210,16 @@ async function runHolder({
       client.on("error", () => holder.clients.delete(client));
     });
     removeStaleEndpoint(launch.endpoint);
-    await new Promise((resolve14, reject) => {
+    await new Promise((resolve13, reject) => {
       server.once("error", reject);
-      server.listen(launch.endpoint, () => resolve14());
+      server.listen(launch.endpoint, () => resolve13());
     });
     await writeStatus();
     log.info("holder.ready", { conversationId: launch.conversationId, pid: identity.pid });
-    await new Promise((resolve14) => exit.signal.addEventListener("abort", () => resolve14()));
+    await new Promise((resolve13) => exit.signal.addEventListener("abort", () => resolve13()));
     await driver.suspend?.().catch((error61) => log.warn("holder.driver_suspend_failed", { error: error61 }));
     for (const client of holder.clients) client.end();
-    await new Promise((resolve14) => server.close(() => resolve14()));
+    await new Promise((resolve13) => server.close(() => resolve13()));
     (0, import_node_fs22.rmSync)(launch.statusPath, { force: true });
     log.info("holder.suspended", { conversationId: launch.conversationId });
   } catch (_) {
@@ -70643,7 +70308,7 @@ var DEFAULT_MAX_ACTIVE_RUNS = 32;
 var HOLDER_BUSY = "busy";
 async function listIds(dir, schema) {
   const ids = [];
-  for (const name of await (0, import_promises69.readdir)(dir).catch(() => [])) {
+  for (const name of await (0, import_promises67.readdir)(dir).catch(() => [])) {
     const parsed = schema.safeParse(name);
     if (parsed.success) ids.push(parsed.data);
   }
@@ -70657,14 +70322,14 @@ function holderIdentity(status) {
   return command === void 0 ? { pid, startedAt } : { pid, startedAt, command };
 }
 function sessionFiles(paths, conversationId) {
-  const dir = (0, import_node_path69.join)(paths.sessions, conversationId);
-  return { dir, launch: (0, import_node_path69.join)(dir, "launch.json"), status: (0, import_node_path69.join)(dir, "holder.json") };
+  const dir = (0, import_node_path67.join)(paths.sessions, conversationId);
+  return { dir, launch: (0, import_node_path67.join)(dir, "launch.json"), status: (0, import_node_path67.join)(dir, "holder.json") };
 }
 async function removeHolderFiles(files) {
   for (const path4 of [files.launch, files.status, engineRecordsPath(files.dir)]) {
-    await (0, import_promises69.rm)(path4, { force: true });
+    await (0, import_promises67.rm)(path4, { force: true });
   }
-  await (0, import_promises69.rmdir)(files.dir).catch((error61) => {
+  await (0, import_promises67.rmdir)(files.dir).catch((error61) => {
     if (!["ENOENT", "ENOTEMPTY", "EEXIST"].includes(errnoCode(error61) ?? "")) throw error61;
   });
 }
@@ -70854,7 +70519,7 @@ async function openSessions(deps) {
     const meta3 = await readRunMeta(dir.meta);
     const last = await readLastRecord(dir.log);
     if (meta3 === null || last === null) return null;
-    const logged = await (0, import_promises69.stat)(dir.log).catch((error61) => {
+    const logged = await (0, import_promises67.stat)(dir.log).catch((error61) => {
       if (errnoCode(error61) === "ENOENT") return null;
       throw error61;
     });
@@ -71166,7 +70831,7 @@ function loadRuntimeConfig(env = process.env, totalMemoryBytes = (0, import_node
     providerProbes: ALAN_RUNTIME_PROVIDER_PROBES === "on",
     providerToolchain: ALAN_RUNTIME_PROVIDER_NODE !== void 0 && ALAN_RUNTIME_PROVIDER_NPM_CLI !== void 0 ? { node: ALAN_RUNTIME_PROVIDER_NODE, npmCli: ALAN_RUNTIME_PROVIDER_NPM_CLI } : null,
     home,
-    configHome: XDG_CONFIG_HOME ?? (0, import_node_path70.join)(home, ".config"),
+    configHome: XDG_CONFIG_HOME ?? (0, import_node_path68.join)(home, ".config"),
     codexHome: resolveCodexHome(CODEX_HOME, home),
     ...githubProxyConfig({ ALAN_RUNTIME_GITHUB_PROXY, XDG_CONFIG_HOME, GH_CONFIG_DIR }, home),
     gitGatewayUrl: ALAN_RUNTIME_GIT_GATEWAY_URL ?? null,
@@ -71176,13 +70841,13 @@ function loadRuntimeConfig(env = process.env, totalMemoryBytes = (0, import_node
   };
 }
 function resolveCodexHome(configuredHome, home) {
-  return configuredHome ?? (0, import_node_path70.join)(home, ".codex");
+  return configuredHome ?? (0, import_node_path68.join)(home, ".codex");
 }
 function githubProxyConfig(env, home) {
-  const configHome = env.XDG_CONFIG_HOME ?? (0, import_node_path70.join)(home, ".config");
+  const configHome = env.XDG_CONFIG_HOME ?? (0, import_node_path68.join)(home, ".config");
   return {
     githubProxy: env.ALAN_RUNTIME_GITHUB_PROXY === "on",
-    ghConfigDir: env.GH_CONFIG_DIR ?? (0, import_node_path70.join)(configHome, "gh")
+    ghConfigDir: env.GH_CONFIG_DIR ?? (0, import_node_path68.join)(configHome, "gh")
   };
 }
 function serviceEnvironment2(env, profile) {
@@ -71240,9 +70905,9 @@ function takeEnrollmentCodeFromEnv(env = process.env) {
 }
 
 // src/cli/context.ts
-var import_promises70 = require("fs/promises");
+var import_promises68 = require("fs/promises");
 var import_node_os12 = require("os");
-var import_node_path71 = require("path");
+var import_node_path69 = require("path");
 var DESKTOP_BUNDLE_IDS = {
   production: ["com.alan-ai.desktop"],
   staging: ["com.alan-ai.desktop.staging"],
@@ -71282,7 +70947,7 @@ function serviceSpec({ config: config2, paths, self }) {
     profile: config2.profile,
     program: serviceCommand(config2.host, self, launcher),
     environment: config2.serviceEnvironment,
-    logPath: (0, import_node_path71.join)(paths.logs, "service.log"),
+    logPath: (0, import_node_path69.join)(paths.logs, "service.log"),
     associatedBundleIds: DESKTOP_BUNDLE_IDS[config2.profile]
   };
 }
@@ -71290,7 +70955,7 @@ async function installedServiceSpec(ctx) {
   const spec = serviceSpec(ctx);
   if (ctx.config.host === "app") return spec;
   const layout = installLayout(ctx.config.installDir, ctx.config.profile);
-  const installed = await (0, import_promises70.access)(layout.launcher).then(
+  const installed = await (0, import_promises68.access)(layout.launcher).then(
     () => true,
     () => false
   );
@@ -71418,7 +71083,7 @@ var manifestRevisionSchema = external_exports.object({ revision: external_export
 async function manifestRevision(path4) {
   let raw;
   try {
-    raw = JSON.parse(await (0, import_promises71.readFile)(path4, "utf8"));
+    raw = JSON.parse(await (0, import_promises69.readFile)(path4, "utf8"));
   } catch (error61) {
     throw new RuntimeFault("invalid_file", `Cannot read the skill manifest at ${path4}`, {
       cause: error61
@@ -71472,8 +71137,8 @@ async function runSkills(argv) {
 }
 
 // src/cli/commands/doctor.ts
-var import_promises74 = require("fs/promises");
-var import_node_path75 = require("path");
+var import_promises72 = require("fs/promises");
+var import_node_path73 = require("path");
 init_runtime_v2();
 
 // src/identity/credential.ts
@@ -71482,7 +71147,7 @@ init_zod();
 
 // src/identity/installation.ts
 var import_node_crypto33 = require("crypto");
-var import_node_path72 = require("path");
+var import_node_path70 = require("path");
 init_runtime_v2();
 init_zod();
 var installationFileSchema = external_exports.object({
@@ -71490,7 +71155,7 @@ var installationFileSchema = external_exports.object({
   machineId: machineIdSchema.optional()
 });
 function installationPath(paths) {
-  return (0, import_node_path72.join)(paths.stateDir, "installation.json");
+  return (0, import_node_path70.join)(paths.stateDir, "installation.json");
 }
 async function readInstallation(paths) {
   const result = await readJsonFile(installationPath(paths), installationFileSchema);
@@ -71681,7 +71346,7 @@ async function authorizeDevice(input2) {
 }
 
 // src/identity/enroll.ts
-var import_promises72 = require("fs/promises");
+var import_promises70 = require("fs/promises");
 init_runtime_v2();
 async function enrollMachine(input2) {
   const machineId = input2.machineId ?? (await readMachineFile(input2.paths))?.machineId ?? (await readInstallation(input2.paths))?.machineId;
@@ -71764,17 +71429,19 @@ async function enrollFromGrantFile(input2) {
     clock: input2.clock,
     access: input2.access
   });
-  await (0, import_promises72.rm)(input2.grantPath, { force: true });
+  await (0, import_promises70.rm)(input2.grantPath, { force: true });
   return machine;
 }
 
 // src/identity/migrate-v1.ts
-var import_promises73 = require("fs/promises");
-var import_node_path73 = require("path");
+var import_promises71 = require("fs/promises");
+var import_node_path71 = require("path");
 init_runtime_v2();
 init_zod();
 var EXIT_POLL_MS = 200;
 var LEGACY_EXIT_WAIT_MS = 15e3;
+var TERMINATE_GRACE_MS = 5e3;
+var KILL_SETTLE_MS = 2e3;
 var SCRUBBED_KEYS = [
   "runtimeToken",
   "runtimeRenewalToken",
@@ -71791,37 +71458,70 @@ var ownerLeaseSchema = external_exports.looseObject({ pid: external_exports.numb
 function legacyConfigPath(home, profile) {
   switch (profile) {
     case "production":
-      return (0, import_node_path73.join)(home, ".alan", "agent", "config.json");
+      return (0, import_node_path71.join)(home, ".alan", "agent", "config.json");
     case "staging":
-      return (0, import_node_path73.join)(home, ".alan-staging", "agent", "config.json");
+      return (0, import_node_path71.join)(home, ".alan-staging", "agent", "config.json");
     default:
-      return (0, import_node_path73.join)(home, ".alan-dev", "agent", "config.json");
+      return (0, import_node_path71.join)(home, ".alan-dev", "agent", "config.json");
   }
 }
 async function findLegacyInstall(home, profile) {
   const configPath = legacyConfigPath(home, profile);
   const config2 = await readJsonFile(configPath, legacyConfigSchema);
   if (config2.kind !== "ok") return null;
-  return { configPath, ownerLeasePath: `${configPath}.daemon-owner.json`, config: config2.value };
+  return {
+    profile,
+    configPath,
+    ownerLeasePath: `${configPath}.daemon-owner.json`,
+    config: config2.value
+  };
 }
 async function readOwnerPid(path4) {
   const lease = await readJsonFile(path4, ownerLeaseSchema);
   return lease.kind === "ok" ? lease.value.pid : null;
 }
-async function waitForExit(pid, deps) {
-  const deadline = deps.clock.monotonic() + (deps.exitWaitMs ?? LEGACY_EXIT_WAIT_MS);
-  while (deps.isProcessAlive(pid)) {
+async function waitForExit(pids, waitMs, deps) {
+  const deadline = deps.clock.monotonic() + waitMs;
+  while (pids.some((pid) => deps.isProcessAlive(pid))) {
     if (deps.clock.monotonic() >= deadline) return false;
     await deps.clock.sleep(EXIT_POLL_MS, deps.signal);
   }
   return true;
 }
+function strayDaemons(processes, install2) {
+  const exclude = /* @__PURE__ */ new Set([process.pid, process.ppid]);
+  return findLegacyDaemons(processes, { profile: install2.profile, exclude }).map(
+    (entry) => entry.pid
+  );
+}
+async function terminate(pids, deps) {
+  deps.log.warn("legacy.stopping_v1", { pids });
+  for (const pid of pids) deps.signalProcess(pid, "SIGTERM");
+  if (await waitForExit(pids, TERMINATE_GRACE_MS, deps)) return null;
+  for (const pid of pids) {
+    if (deps.isProcessAlive(pid)) deps.signalProcess(pid, "SIGKILL");
+  }
+  await waitForExit(pids, KILL_SETTLE_MS, deps);
+  return pids.find((pid) => deps.isProcessAlive(pid)) ?? null;
+}
+async function stopLegacyDaemons(deps, leasePid) {
+  const leaseRunning = leasePid !== null && !await waitForExit([leasePid], deps.exitWaitMs ?? LEGACY_EXIT_WAIT_MS, deps);
+  const processes = await deps.listProcesses();
+  const targets = strayDaemons(processes, deps.install);
+  if (leaseRunning && !targets.includes(leasePid)) {
+    const listed = processes.find((entry) => entry.pid === leasePid);
+    if (listed === void 0) return deps.isProcessAlive(leasePid) ? leasePid : null;
+    if (isLegacyDaemonCommand(listed.command)) targets.push(leasePid);
+    else deps.log.info("legacy.lease_pid_reused", { pid: leasePid });
+  }
+  return targets.length === 0 ? null : terminate(targets, deps);
+}
 async function scrubLegacyInstall(install2) {
   const scrubbed = { ...install2.config, migratedToRuntimeV2: true };
   for (const key of SCRUBBED_KEYS) delete scrubbed[key];
   await writeJsonFileAtomic(`${install2.configPath}.migrated-v1`, scrubbed);
-  await (0, import_promises73.rm)(install2.configPath, { force: true });
-  await (0, import_promises73.rm)(install2.ownerLeasePath, { force: true });
+  await (0, import_promises71.rm)(install2.configPath, { force: true });
+  await (0, import_promises71.rm)(install2.ownerLeasePath, { force: true });
 }
 async function exchangeCredential(deps) {
   const { config: config2 } = deps.install;
@@ -71846,12 +71546,16 @@ async function migrateFromV1(deps) {
   const { install: install2, log } = deps;
   const pid = await readOwnerPid(install2.ownerLeasePath);
   if (deps.dryRun === true) {
+    const strays = strayDaemons(await deps.listProcesses(), install2).filter(
+      (stray) => stray !== pid
+    );
     return {
       kind: "planned",
       steps: [
         `check that ${install2.config.apiUrl} serves the v2 machine routes`,
         "remove the v1 service",
-        pid === null ? "no v1 daemon lease" : `wait for v1 pid ${pid} to exit`,
+        pid === null ? "no v1 daemon lease" : `wait for v1 pid ${pid} to exit, then stop it (SIGTERM, then SIGKILL)`,
+        strays.length === 0 ? "no other v1 daemon running" : `stop the other v1 daemons (pids ${strays.join(", ")}): SIGTERM, then SIGKILL`,
         deps.setup === void 0 ? `renew the v1 credential of machine ${install2.config.runtimeId}` : `register machine ${install2.config.runtimeId} with the setup token`,
         "write machine.json and the credential",
         `scrub ${install2.configPath}`
@@ -71864,9 +71568,10 @@ async function migrateFromV1(deps) {
   }
   const removal = await deps.removeService();
   log.info("legacy.service_removed", { found: removal.found });
-  if (pid !== null && !await waitForExit(pid, deps)) {
-    log.warn("legacy.v1_still_running", { pid });
-    return { kind: "v1_still_running", pid };
+  const running = await stopLegacyDaemons(deps, pid);
+  if (running !== null) {
+    log.warn("legacy.v1_still_running", { pid: running });
+    return { kind: "v1_still_running", pid: running };
   }
   const grant = await exchangeCredential(deps);
   if (typeof grant === "string") {
@@ -71930,7 +71635,7 @@ async function loadIdentity(paths, options = {}) {
 }
 
 // src/cli/commands/status.ts
-var import_node_path74 = require("path");
+var import_node_path72 = require("path");
 async function serviceStatus(ctx) {
   try {
     return await createServiceManager(ctx.host, ctx.config.profile).status();
@@ -71957,7 +71662,7 @@ async function runtimeState(ctx) {
   const running = await readRunningRuntime(ctx.paths.lock);
   if (running === null) return { state: "offline", pid: null, localApi: null };
   const discovery = await readJsonFile(
-    (0, import_node_path74.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE),
+    (0, import_node_path72.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE),
     localApiDiscoverySchema
   );
   const localApi = discovery.kind === "ok" && discovery.value.pid === running.pid ? {
@@ -72002,7 +71707,7 @@ async function runStatus(argv, ctx = cliContext()) {
 }
 
 // src/cli/commands/doctor.ts
-var PROBE_TIMEOUT_MS3 = 1e4;
+var PROBE_TIMEOUT_MS2 = 1e4;
 var LOCAL_TIMEOUT_MS = 3e3;
 var DISK_WARN_BYTES = 1024 ** 3;
 var DISK_FAIL_BYTES = 100 * 1024 ** 2;
@@ -72094,7 +71799,7 @@ async function credentialCheck(ctx) {
 async function serverCheck(facts) {
   const api = createApiClient({ apiUrl: facts.apiUrl, accessToken: () => facts.accessToken });
   try {
-    const desired = await api.fetchDesired(AbortSignal.timeout(PROBE_TIMEOUT_MS3));
+    const desired = await api.fetchDesired(AbortSignal.timeout(PROBE_TIMEOUT_MS2));
     return check2("server", "ok", `${facts.apiUrl} accepts this machine's credential`, {
       machineId: facts.machineId,
       desiredRuns: desired.runs.length
@@ -72120,7 +71825,7 @@ function isStale(machine, now) {
 async function machinesCheck(facts) {
   const api = createApiClient({ apiUrl: facts.apiUrl, accessToken: () => facts.accessToken });
   try {
-    const machines = await api.listSiblings(AbortSignal.timeout(PROBE_TIMEOUT_MS3));
+    const machines = await api.listSiblings(AbortSignal.timeout(PROBE_TIMEOUT_MS2));
     if (machines === null) {
       return check2("machines", "skipped", `${facts.apiUrl} does not list machines`);
     }
@@ -72150,7 +71855,7 @@ async function releaseCheck(ctx, facts) {
   const apiUrl = facts?.apiUrl ?? ctx.config.apiUrl;
   const api = createApiClient({ apiUrl, accessToken: () => facts?.accessToken ?? "" });
   try {
-    const release2 = await api.currentRelease(AbortSignal.timeout(PROBE_TIMEOUT_MS3));
+    const release2 = await api.currentRelease(AbortSignal.timeout(PROBE_TIMEOUT_MS2));
     const layout = installLayout(ctx.config.installDir, ctx.config.profile);
     const plan2 = planUpdate({
       current: package_default.version,
@@ -72178,7 +71883,7 @@ async function runtimeCheck(ctx, status) {
     return check2("runtime", "warn", "No runtime is running for this profile");
   }
   const client = createRuntimeClient({
-    discoveryPath: (0, import_node_path75.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE)
+    discoveryPath: (0, import_node_path73.join)(ctx.paths.stateDir, LOCAL_API_DISCOVERY_FILE)
   });
   try {
     const live = await client.status(AbortSignal.timeout(LOCAL_TIMEOUT_MS));
@@ -72205,7 +71910,7 @@ async function runtimeCheck(ctx, status) {
   }
 }
 async function probeHolder(dir, conversationId) {
-  const launch = await readJsonFile((0, import_node_path75.join)(dir, "launch.json"), holderLaunchSchema);
+  const launch = await readJsonFile((0, import_node_path73.join)(dir, "launch.json"), holderLaunchSchema);
   if (launch.kind !== "ok") return null;
   try {
     const reply2 = await withTimeout(
@@ -72230,8 +71935,8 @@ async function probeHolder(dir, conversationId) {
   }
 }
 async function holdersCheck(ctx) {
-  const names = await (0, import_promises74.readdir)(ctx.paths.sessions).catch(() => []);
-  const holders = (await Promise.all(names.map((name) => probeHolder((0, import_node_path75.join)(ctx.paths.sessions, name), name)))).filter((facts) => facts !== null);
+  const names = await (0, import_promises72.readdir)(ctx.paths.sessions).catch(() => []);
+  const holders = (await Promise.all(names.map((name) => probeHolder((0, import_node_path73.join)(ctx.paths.sessions, name), name)))).filter((facts) => facts !== null);
   const dead = holders.filter((holder) => !holder.alive).length;
   return check2(
     "holders",
@@ -72242,10 +71947,10 @@ async function holdersCheck(ctx) {
 }
 async function freeBytesAt(path4) {
   try {
-    const stats = await (0, import_promises74.statfs)(path4);
+    const stats = await (0, import_promises72.statfs)(path4);
     return { path: path4, freeBytes: stats.bavail * stats.bsize };
   } catch (error61) {
-    const parent = (0, import_node_path75.dirname)(path4);
+    const parent = (0, import_node_path73.dirname)(path4);
     if (parent === path4) throw error61;
     return freeBytesAt(parent);
   }
@@ -72263,9 +71968,9 @@ async function diskCheck(ctx) {
   }
 }
 var resolveFromLoginShell = (own2) => resolveCliEnvironment({ env: own2, platform: process.platform });
-async function cliDiscoveryCheck(resolve14) {
+async function cliDiscoveryCheck(resolve13) {
   const own2 = readCliEnvironment();
-  const env = await resolve14(own2);
+  const env = await resolve13(own2);
   const delimiter = process.platform === "win32" ? ";" : ":";
   const ownDirs = new Set((own2.PATH ?? "").split(delimiter));
   const added = (env.PATH ?? "").split(delimiter).filter((dir) => dir.length > 0 && !ownDirs.has(dir));
@@ -72381,7 +72086,7 @@ async function runDoctor(argv, context = cliContext) {
 }
 
 // src/cli/commands/git-credential.ts
-var import_promises75 = require("fs/promises");
+var import_promises73 = require("fs/promises");
 var import_node_net4 = require("net");
 var MAX_RESPONSE_BYTES = 64 * 1024;
 async function readAll(stream) {
@@ -72399,7 +72104,7 @@ function processIo() {
   };
 }
 function askGitCredentialSocket(endpoint, request2, signal) {
-  return new Promise((resolve14, reject) => {
+  return new Promise((resolve13, reject) => {
     const socket = (0, import_node_net4.createConnection)(endpoint);
     let buffered = "";
     const fail = (error61) => {
@@ -72426,7 +72131,7 @@ function askGitCredentialSocket(endpoint, request2, signal) {
       signal.removeEventListener("abort", onAbort);
       try {
         const line = buffered.split("\n", 1)[0] ?? "";
-        resolve14(gitCredentialSocketResponseSchema.parse(JSON.parse(line)));
+        resolve13(gitCredentialSocketResponseSchema.parse(JSON.parse(line)));
       } catch (error61) {
         reject(
           new RuntimeFault("io_failed", "the Alan runtime sent an invalid reply", { cause: error61 })
@@ -72491,7 +72196,7 @@ async function configure(argv) {
 }
 async function configureGitGateway(config2, gatewayUrl, signal) {
   const { launcher } = installLayout(config2.installDir, config2.profile);
-  const installed = await (0, import_promises75.access)(launcher).then(
+  const installed = await (0, import_promises73.access)(launcher).then(
     () => true,
     () => false
   );
@@ -72518,7 +72223,7 @@ async function runGitCredential(argv) {
 }
 
 // src/cli/commands/hold.ts
-var import_node_path76 = require("path");
+var import_node_path74 = require("path");
 init_agent2();
 init_runtime_v2();
 async function machineAccess(paths, log, conversationId, transport) {
@@ -72576,7 +72281,7 @@ async function runHold(argv) {
     const config2 = loadRuntimeConfig();
     const paths = runtimePaths(config2.stateDir);
     const log = __using(_stack, openFileLog(
-      (0, import_node_path76.join)(paths.logs, `holder-${launch.value.conversationId}.jsonl`),
+      (0, import_node_path74.join)(paths.logs, `holder-${launch.value.conversationId}.jsonl`),
       config2.logLevel,
       systemClock
     ));
@@ -72587,7 +72292,7 @@ async function runHold(argv) {
     );
     const transport = __using(_stack, createHttpTransport());
     const access7 = await machineAccess(paths, log, launch.value.conversationId, transport);
-    const credentialPath = (0, import_node_path76.join)(paths.tmp, "mcp", `${launch.value.conversationId}.json`);
+    const credentialPath = (0, import_node_path74.join)(paths.tmp, "mcp", `${launch.value.conversationId}.json`);
     const managedMcp = __using(_stack, access7.managedMcp === void 0 ? void 0 : createHelperMcpAccess({
       managedMcp: access7.managedMcp,
       conversationId: launch.value.conversationId,
@@ -72628,7 +72333,7 @@ async function runHold(argv) {
 }
 
 // src/cli/commands/hook.ts
-var import_node_path77 = require("path");
+var import_node_path75 = require("path");
 var RUNTIME_ANSWER_MS = 2e3;
 var DEBUG_VARIABLE = "ALAN_HOOK_DEBUG";
 function flag(argv, name) {
@@ -72660,7 +72365,7 @@ async function forwardHook(argv, io) {
     return "transcript outside provider root";
   }
   const verdict = await io.send(
-    (0, import_node_path77.join)(io.stateDir, LOCAL_API_DISCOVERY_FILE),
+    (0, import_node_path75.join)(io.stateDir, LOCAL_API_DISCOVERY_FILE),
     hookSignal,
     AbortSignal.timeout(RUNTIME_ANSWER_MS)
   );
@@ -72696,7 +72401,7 @@ async function runHook(argv, overrides = {}) {
 }
 
 // src/cli/commands/ingestion-hooks.ts
-var import_promises76 = require("fs/promises");
+var import_promises74 = require("fs/promises");
 var CODEX_TRUST_NOTE = "Codex runs new hooks only after you review them: open /hooks in Codex.";
 function isAction(value2) {
   return value2 === "enable" || value2 === "disable" || value2 === "status";
@@ -72719,7 +72424,7 @@ function errorMessage2(error61) {
   return error61 instanceof Error ? error61.message : String(error61);
 }
 async function exists5(path4) {
-  return (0, import_promises76.access)(path4).then(
+  return (0, import_promises74.access)(path4).then(
     () => true,
     () => false
   );
@@ -72822,10 +72527,10 @@ async function runIntegrationsCommand(argv) {
 }
 
 // src/cli/commands/legacy.ts
-var import_node_path79 = require("path");
+var import_node_path77 = require("path");
 
 // src/cli/commands/setup.ts
-var import_node_path78 = require("path");
+var import_node_path76 = require("path");
 init_zod();
 
 // src/cli/legacy.ts
@@ -72837,6 +72542,8 @@ async function adoptLegacyInstall(ctx, deps, adoption) {
     install: install2,
     removeService: () => removeLegacyService(ctx.host, ctx.config.profile),
     isProcessAlive: deps.isProcessAlive,
+    listProcesses: () => listProcesses2(ctx.host.exec, ctx.host.platform),
+    signalProcess,
     enrollment: deps.enrollment(install2.config.apiUrl),
     saveGrant: async (grant) => {
       await saveGrant({
@@ -72907,7 +72614,7 @@ async function grantFileCredential(argv, grantPath, ctx, deps) {
   return enrollFromGrantFile({
     paths: ctx.paths,
     storeKind: credentialStoreFlag(argv) ?? ctx.config.credentialStore,
-    grantPath: (0, import_node_path78.resolve)(grantPath),
+    grantPath: (0, import_node_path76.resolve)(grantPath),
     clock: deps.clock,
     access: ctx.access
   });
@@ -72983,7 +72690,7 @@ async function runSetup(argv, signal) {
   var _stack = [];
   try {
     const ctx = cliContext();
-    const log = __using(_stack, openFileLog((0, import_node_path78.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
+    const log = __using(_stack, openFileLog((0, import_node_path76.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
     const result = await setupMachine(argv, ctx, {
       enrollment: (apiUrl) => createEnrollmentClient({ apiUrl }),
       isProcessAlive,
@@ -73066,7 +72773,7 @@ async function runToken(argv, signal) {
       );
     }
     const ctx = cliContext();
-    const log = __using(_stack, openFileLog((0, import_node_path79.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
+    const log = __using(_stack, openFileLog((0, import_node_path77.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
     const result = await rotateMachineCredential(ctx, { clock: systemClock, log, signal });
     process.stdout.write(`${rotationMessage(result)}
 `);
@@ -73078,8 +72785,8 @@ async function runToken(argv, signal) {
 }
 
 // src/cli/commands/logout.ts
-var import_promises77 = require("fs/promises");
-var import_node_path80 = require("path");
+var import_promises75 = require("fs/promises");
+var import_node_path78 = require("path");
 init_runtime_v2();
 var RUNTIME_EXIT_WAIT_MS = 35e3;
 var TURN_END_WAIT_MS = 3e4;
@@ -73138,9 +72845,9 @@ async function stopHolder(launch, deps, outcome2) {
 }
 async function stopHeldRuns(ctx, deps, outcome2 = "aborted") {
   const stopped = [];
-  for (const name of await (0, import_promises77.readdir)(ctx.paths.sessions).catch(() => [])) {
+  for (const name of await (0, import_promises75.readdir)(ctx.paths.sessions).catch(() => [])) {
     const launch = await readJsonFile(
-      (0, import_node_path80.join)(ctx.paths.sessions, name, "launch.json"),
+      (0, import_node_path78.join)(ctx.paths.sessions, name, "launch.json"),
       holderLaunchSchema
     );
     if (launch.kind !== "ok") continue;
@@ -73177,13 +72884,13 @@ async function forgetMachineLocally(ctx) {
   const machine = await readMachineFile(ctx.paths);
   if (machine === null) return;
   await credentialStoreFor(ctx.paths, machine.credentialStore, ctx.access).clear();
-  await (0, import_promises77.rm)(ctx.paths.machine, { force: true });
+  await (0, import_promises75.rm)(ctx.paths.machine, { force: true });
 }
 async function runLogout(argv, signal) {
   var _stack = [];
   try {
     const ctx = cliContext();
-    const log = __using(_stack, openFileLog((0, import_node_path80.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
+    const log = __using(_stack, openFileLog((0, import_node_path78.join)(ctx.paths.logs, "cli.jsonl"), ctx.config.logLevel, systemClock));
     const result = await logoutMachine(argv, ctx, {
       api: (apiUrl, accessToken) => createApiClient({ apiUrl, accessToken }),
       stopHeldRuns,
@@ -73201,7 +72908,7 @@ async function runLogout(argv, signal) {
 
 // src/cli/commands/run.ts
 var import_node_fs24 = require("fs");
-var import_node_path84 = require("path");
+var import_node_path82 = require("path");
 
 // src/local-api/app-attachments.ts
 function createAppAttachments(clock) {
@@ -73241,7 +72948,7 @@ function createRunAppends() {
     const pending = waiters.get(runId);
     if (pending === void 0) return;
     waiters.delete(runId);
-    for (const resolve14 of pending) resolve14();
+    for (const resolve13 of pending) resolve13();
   };
   return {
     notify: wake,
@@ -73259,13 +72966,13 @@ function createRunAppends() {
     },
     nextAppend: (runId, signal) => {
       if (signal.aborted) return Promise.resolve();
-      return new Promise((resolve14) => {
+      return new Promise((resolve13) => {
         const done = () => {
           signal.removeEventListener("abort", done);
           const pending2 = waiters.get(runId);
           pending2?.delete(done);
           if (pending2?.size === 0) waiters.delete(runId);
-          resolve14();
+          resolve13();
         };
         const pending = waiters.get(runId) ?? /* @__PURE__ */ new Set();
         pending.add(done);
@@ -73278,9 +72985,9 @@ function createRunAppends() {
 
 // src/local-api/server.ts
 var import_node_crypto35 = require("crypto");
-var import_promises78 = require("fs/promises");
+var import_promises76 = require("fs/promises");
 var import_node_http4 = require("http");
-var import_node_path81 = require("path");
+var import_node_path79 = require("path");
 
 // src/local-api/guard.ts
 var import_node_crypto34 = require("crypto");
@@ -73357,11 +73064,11 @@ id: ${event.id}
 ${data}
 `);
   if (accepted || res.destroyed) return;
-  await new Promise((resolve14) => {
+  await new Promise((resolve13) => {
     const done = () => {
       res.off("drain", done);
       res.off("close", done);
-      resolve14();
+      resolve13();
     };
     res.once("drain", done);
     res.once("close", done);
@@ -73467,7 +73174,7 @@ async function openLocalTurnProjection(runsDir, runId, conversationId, ordinal)
   if (!reader) return null;
   let offset = toByteOffset(0);
   let ended = false;
-  let snapshot2;
+  let snapshot;
   let prepared;
   const merge2 = /* @__PURE__ */ new Map();
   const decoder3 = new TextDecoder();
@@ -73479,13 +73186,13 @@ async function openLocalTurnProjection(runsDir, runId, conversationId, ordinal)
       if (applyLogChunk(decoder3.decode(chunk.bytes), assistantMessageId, state)) ended = true;
       offset = chunk.to;
     }
-    if (offset === priorOffset && snapshot2) return snapshot2;
+    if (offset === priorOffset && snapshot) return snapshot;
     if (ended) state.state = "idle";
-    snapshot2 = mergeTranscriptMessages(
+    snapshot = mergeTranscriptMessages(
       [{ messageId: assistantMessageId, turnOrdinal: ordinal, role: "assistant", state }],
       merge2
     );
-    return snapshot2;
+    return snapshot;
   };
   return {
     runId,
@@ -73589,9 +73296,9 @@ async function readChangedTurn(deps, conversationId, runId, slot) {
 }
 async function nextChangedRuns(bell, signal) {
   if (bell.pending.size === 0) {
-    await new Promise((resolve14) => {
-      bell.wake = resolve14;
-      if (signal.aborted || bell.pending.size > 0) resolve14();
+    await new Promise((resolve13) => {
+      bell.wake = resolve13;
+      if (signal.aborted || bell.pending.size > 0) resolve13();
     });
     bell.wake = void 0;
   }
@@ -73891,12 +73598,12 @@ function activeRunIds(runs) {
 var streamStatus = async ({ feed, appAttachments }, { res, signal }) => {
   var _stack = [];
   try {
-    const snapshot2 = await feed.refresh(signal);
+    const snapshot = await feed.refresh(signal);
     const _attachment = __using(_stack, appAttachments.attach());
     startEventStream(res);
     const send2 = (name, event) => writeEvent(res, { name, id: String(event.seq), dataLines: [JSON.stringify(event)] });
     let latest = null;
-    let writing = send2("snapshot", snapshot2);
+    let writing = send2("snapshot", snapshot);
     const flush = async () => {
       while (latest !== null && !res.destroyed) {
         const next = latest;
@@ -73908,9 +73615,9 @@ var streamStatus = async ({ feed, appAttachments }, { res, signal }) => {
       latest = event;
       writing = writing.then(flush);
     }));
-    await new Promise((resolve14) => {
-      if (signal.aborted) resolve14();
-      signal.addEventListener("abort", () => resolve14(), { once: true });
+    await new Promise((resolve13) => {
+      if (signal.aborted) resolve13();
+      signal.addEventListener("abort", () => resolve13(), { once: true });
     });
     await writing;
   } catch (_) {
@@ -74233,11 +73940,11 @@ function localRequestSignal(path4, closed) {
   ]);
 }
 async function listenOnLoopback(server) {
-  await new Promise((resolve14, reject) => {
+  await new Promise((resolve13, reject) => {
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       server.off("error", reject);
-      resolve14();
+      resolve13();
     });
   }).catch((error61) => {
     throw new RuntimeFault("io_failed", "The local API could not listen on loopback", {
@@ -74252,7 +73959,7 @@ async function listenOnLoopback(server) {
 }
 async function closeServer(server) {
   server.closeAllConnections();
-  await new Promise((resolve14) => server.close(() => resolve14()));
+  await new Promise((resolve13) => server.close(() => resolve13()));
 }
 async function serveLocalApi(deps) {
   const limits = { ...DEFAULT_LIMITS, ...deps.limits };
@@ -74323,7 +74030,7 @@ async function serveLocalApi(deps) {
     startedAtMs,
     runtimeVersion: deps.runtimeVersion
   };
-  const discoveryPath = (0, import_node_path81.join)(deps.stateDir, LOCAL_API_DISCOVERY_FILE);
+  const discoveryPath = (0, import_node_path79.join)(deps.stateDir, LOCAL_API_DISCOVERY_FILE);
   await writeJsonFileAtomic(discoveryPath, discovery);
   const followers = startMaintenance({
     everyMs: limits.refreshEveryMs,
@@ -74357,7 +74064,7 @@ async function serveLocalApi(deps) {
       await watchedStatus[Symbol.asyncDispose]();
       const current = await readJsonFile(discoveryPath, localApiDiscoverySchema);
       if (current.kind === "ok" && current.value.token === token) {
-        await (0, import_promises78.rm)(discoveryPath, { force: true });
+        await (0, import_promises76.rm)(discoveryPath, { force: true });
       }
       await closeServer(server);
       log.info("local_api.closed", {});
@@ -74442,7 +74149,7 @@ function machineFeatureActions(deps) {
 }
 
 // src/cli/commands/machine-plane.ts
-var import_node_path83 = require("path");
+var import_node_path81 = require("path");
 
 // src/link/index.ts
 init_runtime_v2();
@@ -77009,9 +76716,9 @@ var Socket2 = class extends Emitter {
    * @return a Promise that will be fulfilled when the server acknowledges the event
    */
   emitWithAck(ev, ...args) {
-    return new Promise((resolve14, reject) => {
+    return new Promise((resolve13, reject) => {
       const fn = (arg1, arg2) => {
-        return arg1 ? reject(arg1) : resolve14(arg2);
+        return arg1 ? reject(arg1) : resolve13(arg2);
       };
       fn.withError = true;
       args.push(fn);
@@ -78110,10 +77817,10 @@ function refusalFailure(refusal2) {
 }
 
 // src/link/probe.ts
-var import_promises79 = require("dns/promises");
+var import_promises77 = require("dns/promises");
 var import_node_net5 = require("net");
 var import_node_tls2 = require("tls");
-var PROBE_TIMEOUT_MS4 = 5e3;
+var PROBE_TIMEOUT_MS3 = 5e3;
 function openSocket(url3) {
   const secure = url3.protocol === "https:" || url3.protocol === "wss:";
   const host = url3.hostname;
@@ -78130,11 +77837,11 @@ async function connectOnce(url3, clock) {
   const timer = new AbortController();
   try {
     return await Promise.race([
-      new Promise((resolve14) => {
-        socket.once(ready, () => resolve14(null));
-        socket.once("error", (error61) => resolve14(classifyTransportFailure(error61)));
+      new Promise((resolve13) => {
+        socket.once(ready, () => resolve13(null));
+        socket.once("error", (error61) => resolve13(classifyTransportFailure(error61)));
       }),
-      clock.sleep(PROBE_TIMEOUT_MS4, timer.signal).then(
+      clock.sleep(PROBE_TIMEOUT_MS3, timer.signal).then(
         () => "connection_timeout",
         () => null
       )
@@ -78146,7 +77853,7 @@ async function connectOnce(url3, clock) {
 }
 async function probeEndpoint(url3, clock) {
   try {
-    await (0, import_promises79.lookup)(url3.hostname);
+    await (0, import_promises77.lookup)(url3.hostname);
   } catch (error61) {
     const reason = classifyTransportFailure(error61);
     return reason === "other" ? "dns" : reason;
@@ -78433,13 +78140,13 @@ function connectLink(options) {
     socket.disconnect();
     socket.connect();
   };
-  const hearsServer = (timeoutMs) => new Promise((resolve14) => {
+  const hearsServer = (timeoutMs) => new Promise((resolve13) => {
     const waiting = new AbortController();
     const settle = (alive) => {
       waiting.abort();
       socket.io.off("ping", onPing);
       socket.off("disconnect", onDrop);
-      resolve14(alive);
+      resolve13(alive);
     };
     const onPing = () => settle(true);
     const onDrop = () => settle(false);
@@ -78637,12 +78344,13 @@ function createReconciler(host, lifecycle, log, signal) {
 }
 
 // src/uploader/index.ts
-var import_promises80 = require("fs/promises");
+var import_promises78 = require("fs/promises");
 init_runtime_v2();
 init_zod();
 var RETRY_DELAYS_MS = [250, 500, 1e3, 2e3, 5e3, 1e4, 3e4];
 var PARK_MS = 5 * 6e4;
 var UNAUTHORIZED = 401;
+var RETRY_JITTER = 0.2;
 var uploadProgressSchema = external_exports.object({
   admittedOffset: external_exports.number().int().nonnegative(),
   sealed: external_exports.boolean(),
@@ -78650,16 +78358,50 @@ var uploadProgressSchema = external_exports.object({
   parkedUntil: external_exports.number().int().nonnegative().optional()
 });
 function progressFromReceipt(receipt) {
-  return { admittedOffset: receipt?.admittedOffset ?? 0, sealed: receipt?.finalized ?? false };
+  return {
+    admittedOffset: receipt?.admittedOffset ?? 0,
+    sealed: receipt !== null && (receipt.finalized || receipt.finalOffset !== null)
+  };
 }
-function startUploader({ api, runsDir, clock, log, archive }) {
+function startUploader({
+  api,
+  runsDir,
+  clock,
+  log,
+  archive,
+  random = Math.random,
+  onUnauthorized
+}) {
   const controller = new AbortController();
   const active = /* @__PURE__ */ new Map();
   const again = /* @__PURE__ */ new Set();
   const sealed = /* @__PURE__ */ new Set();
+  const receiptBackoff = /* @__PURE__ */ new Map();
+  let pendingRuns = /* @__PURE__ */ new Map();
+  const retrying = /* @__PURE__ */ new Set();
+  let renewing = null;
+  const retryDelay = (failures) => {
+    const base = RETRY_DELAYS_MS[Math.min(failures, RETRY_DELAYS_MS.length - 1)] ?? 3e4;
+    return Math.round(base * (1 - RETRY_JITTER + 2 * RETRY_JITTER * random()));
+  };
+  const renewCredential = () => {
+    if (onUnauthorized === void 0) return Promise.resolve();
+    renewing ??= onUnauthorized().catch((error61) => log.warn("upload.renew_failed", { error: error61 })).finally(() => {
+      renewing = null;
+    });
+    return renewing;
+  };
+  const deferReceipt = (runId) => {
+    const failures = (receiptBackoff.get(runId)?.failures ?? 0) + 1;
+    receiptBackoff.set(runId, { failures, notBefore: clock.now() + retryDelay(failures) });
+  };
   const reject = async (runId, progressPath, progress, rejection2) => {
     log.error("upload.rejected", { runId, status: rejection2.status, message: rejection2.message });
-    if (rejection2.status === UNAUTHORIZED) return;
+    if (rejection2.status === UNAUTHORIZED) {
+      await renewCredential();
+      deferReceipt(runId);
+      return;
+    }
     const parkedUntil = clock.now() + PARK_MS;
     await writeJsonFileAtomic(progressPath, { ...progress, parkedUntil });
     log.warn("upload.parked", { runId, parkedUntil });
@@ -78667,22 +78409,31 @@ function startUploader({ api, runsDir, clock, log, archive }) {
   const progressOf = async (runId, target, path4) => {
     const stored = await readJsonFile(path4, uploadProgressSchema);
     if (stored.kind === "ok") return stored.value;
+    const listed = pendingRuns.get(runId);
+    if (listed !== void 0) {
+      const progress = { admittedOffset: listed.admittedOffset, sealed: false };
+      await writeJsonFileAtomic(path4, progress);
+      return progress;
+    }
     const receipt = await api.readReceipt(target, controller.signal);
     switch (receipt.kind) {
       case "read": {
+        receiptBackoff.delete(runId);
         log.debug("upload.resumed", {
           runId,
           admittedOffset: receipt.receipt?.admittedOffset ?? 0
         });
         const progress = progressFromReceipt(receipt.receipt);
-        if (progress.sealed) await writeJsonFileAtomic(path4, progress);
+        await writeJsonFileAtomic(path4, progress);
         return progress;
       }
       case "rejected":
         await reject(runId, path4, progressFromReceipt(null), receipt);
         return null;
-      case "retry":
+      case "retry": {
+        deferReceipt(runId);
         throw new RuntimeFault("io_failed", `Receipt request failed: ${receipt.status}`);
+      }
       default:
         return assertNever2(receipt);
     }
@@ -78708,7 +78459,9 @@ function startUploader({ api, runsDir, clock, log, archive }) {
       case "offset_conflict": {
         const receipt = await api.readReceipt(upload2.target, controller.signal);
         if (receipt.kind === "read") {
-          return { kind: "advanced", progress: progressFromReceipt(receipt.receipt) };
+          const next = progressFromReceipt(receipt.receipt);
+          await writeJsonFileAtomic(upload2.progressPath, next);
+          return { kind: "advanced", progress: next };
         }
         return receipt.kind === "retry" ? receipt : { kind: "rejected", rejection: receipt };
       }
@@ -78721,7 +78474,7 @@ function startUploader({ api, runsDir, clock, log, archive }) {
     }
   };
   const backOff = async (runId, status, failures) => {
-    const delay4 = RETRY_DELAYS_MS[Math.min(failures, RETRY_DELAYS_MS.length - 1)] ?? 3e4;
+    const delay4 = retryDelay(failures);
     log.warn("upload.retrying", { runId, status, delayMs: delay4 });
     await clock.sleep(delay4, controller.signal);
   };
@@ -78731,10 +78484,10 @@ function startUploader({ api, runsDir, clock, log, archive }) {
     let failures = 0;
     while (!controller.signal.aborted) {
       const step = await sendNext(runUpload, progress);
-      if (step.kind === "caught_up") return;
+      if (step.kind === "caught_up") return "settled";
       if (step.kind === "rejected") {
         await reject(runId, runUpload.progressPath, progress, step.rejection);
-        return;
+        return "retry_later";
       }
       if (step.kind === "retry") {
         await backOff(runId, step.status, failures);
@@ -78742,27 +78495,40 @@ function startUploader({ api, runsDir, clock, log, archive }) {
         continue;
       }
       failures = 0;
+      receiptBackoff.delete(runId);
       progress = step.progress;
       if (progress.sealed) {
         sealed.add(runId);
         log.info("upload.sealed", { runId, bytes: progress.admittedOffset });
-        return;
+        return "settled";
       }
     }
+    return "settled";
   };
   const upload = async (runId) => {
     var _stack = [];
     try {
       const dir = runDirectory(runsDir, runId);
       const meta3 = await readRunMeta(dir.meta);
-      if (meta3 === null) return;
+      if (meta3 === null) return "settled";
       const target = { conversationId: meta3.conversationId, runId };
+      const backoff = receiptBackoff.get(runId);
+      if (backoff !== void 0 && backoff.notBefore > clock.now()) return "retry_later";
       const progress = await progressOf(runId, target, dir.upload);
-      if (progress?.sealed) sealed.add(runId);
-      if (progress === null || progress.sealed) return;
-      if (progress.parkedUntil !== void 0 && progress.parkedUntil > clock.now()) return;
+      if (progress === null) return "retry_later";
+      if (progress.sealed) {
+        sealed.add(runId);
+        return "settled";
+      }
+      if (progress.parkedUntil !== void 0 && progress.parkedUntil > clock.now()) {
+        return "retry_later";
+      }
       const reader = __using(_stack, await openRunLogReader(dir.log), true);
-      await drain({ target, reader, logPath: dir.log, progressPath: dir.upload }, progress);
+      const attempt2 = await drain(
+        { target, reader, logPath: dir.log, progressPath: dir.upload },
+        progress
+      );
+      return attempt2;
     } catch (_) {
       var _error = _, _hasError = true;
     } finally {
@@ -78775,7 +78541,11 @@ function startUploader({ api, runsDir, clock, log, archive }) {
       again.add(runId);
       return;
     }
-    const task = upload(runId).catch((error61) => {
+    const task = upload(runId).then((attempt2) => {
+      if (attempt2 === "settled") retrying.delete(runId);
+      else retrying.add(runId);
+    }).catch((error61) => {
+      retrying.add(runId);
       if (!controller.signal.aborted) log.warn("upload.failed", { runId, error: error61 });
     }).finally(() => {
       active.delete(runId);
@@ -78783,30 +78553,38 @@ function startUploader({ api, runsDir, clock, log, archive }) {
     });
     active.set(runId, task);
   };
+  const isDone = (runId) => sealed.has(runId) || archive?.has(runId) === true;
   const unsealedRunIds = async () => {
     const runIds = [];
-    for (const name of await (0, import_promises80.readdir)(runsDir).catch(() => [])) {
+    for (const name of await (0, import_promises78.readdir)(runsDir).catch(() => [])) {
       const runId = runIdSchema.safeParse(name);
-      if (runId.success && !sealed.has(runId.data) && !archive?.has(runId.data))
-        runIds.push(runId.data);
+      if (runId.success && !isDone(runId.data)) runIds.push(runId.data);
     }
     return runIds;
   };
+  const hasProgress = async (runId) => await (0, import_promises78.stat)(runDirectory(runsDir, runId).upload).catch(() => null) !== null;
   const sweep2 = async () => {
-    for (const runId of await unsealedRunIds()) run2(runId);
+    for (const runId of await unsealedRunIds()) {
+      if (!await hasProgress(runId)) run2(runId);
+    }
+  };
+  const retryPending = () => {
+    for (const runId of /* @__PURE__ */ new Set([...pendingRuns.keys(), ...retrying])) {
+      if (!isDone(runId)) run2(runId);
+    }
   };
   const isArchivable = async (runId, options) => {
     if (options.keep.has(runId) || active.has(runId)) return false;
     const dir = runDirectory(runsDir, runId);
     const progress = await readJsonFile(dir.upload, uploadProgressSchema);
     if (progress.kind !== "ok" || !progress.value.sealed) return false;
-    const sealedAt = (await (0, import_promises80.stat)(dir.upload)).mtimeMs;
+    const sealedAt = (await (0, import_promises78.stat)(dir.upload)).mtimeMs;
     if (clock.now() - sealedAt < options.sealedForMs) return false;
     return (await readLastRecord(dir.log))?.update.sessionUpdate === "_alan/run.ended";
   };
   const archivable = async (options) => {
     const found = [];
-    for (const name of await (0, import_promises80.readdir)(runsDir).catch(() => [])) {
+    for (const name of await (0, import_promises78.readdir)(runsDir).catch(() => [])) {
       const runId = runIdSchema.safeParse(name);
       if (!runId.success || archive?.has(runId.data)) continue;
       try {
@@ -78820,9 +78598,15 @@ function startUploader({ api, runsDir, clock, log, archive }) {
   return {
     notify: run2,
     sweep: sweep2,
+    pending: (uploads) => {
+      pendingRuns = new Map(
+        uploads.map((upload2) => [upload2.runId, upload2])
+      );
+    },
+    retryPending,
     archivable,
     flush: async () => {
-      await sweep2();
+      for (const runId of await unsealedRunIds()) run2(runId);
       while (active.size > 0 && !controller.signal.aborted) {
         await Promise.allSettled([...active.values()]);
       }
@@ -79008,12 +78792,12 @@ async function startMachineNativeIngest(deps) {
 }
 
 // src/cli/commands/run-updates.ts
-var import_node_path82 = require("path");
+var import_node_path80 = require("path");
 init_runtime_v2();
 var UPDATE_CHECK_EVERY_MS = 6 * 60 * 60 * 1e3;
 var DEFERRED_RETRY_MS = 5 * 60 * 1e3;
 function isInstalledBundle(layout, bundlePath) {
-  return (0, import_node_path82.resolve)((0, import_node_path82.dirname)((0, import_node_path82.dirname)(bundlePath))) === (0, import_node_path82.resolve)(layout.versions);
+  return (0, import_node_path80.resolve)((0, import_node_path80.dirname)((0, import_node_path80.dirname)(bundlePath))) === (0, import_node_path80.resolve)(layout.versions);
 }
 async function settleUpgradeOnStart({
   layout,
@@ -79120,7 +78904,7 @@ function startRuntimeUpdates(options) {
       layout,
       release: npmRelease,
       tarball: await options.downloader.download(npmRelease.dist.tarball, signal),
-      tmpDir: (0, import_node_path82.join)(layout.root, ".downloads")
+      tmpDir: (0, import_node_path80.join)(layout.root, ".downloads")
     });
     await lifecycle.exclusive("upgrade", async () => {
       await recordPendingUpgrade(layout, currentVersion2, version2, clock.now());
@@ -79171,7 +78955,7 @@ var CAPABILITY_MAX_AGE_MS = 6e4;
 var RUN_ARCHIVE_EVERY_MS = 6 * 60 * 6e4;
 var SEALED_RUN_ARCHIVE_MS = 7 * 24 * 60 * 6e4;
 var DESIRED_RESYNC_TICK_MS = 5e3;
-var UPLOAD_SWEEP_EVERY_MS = 3e4;
+var UPLOAD_RETRY_EVERY_MS = 3e4;
 function setupFor(state) {
   if (state.kind !== "stopped") return "ready";
   switch (state.failure.reason) {
@@ -79212,6 +78996,13 @@ async function startMachinePlane(deps) {
       accessToken: identity.accessToken,
       transport
     });
+    const renewAfterRejection = async () => {
+      const renewal = await lifecycle.exclusive(
+        "renew",
+        () => identity.renewAfterRejection(stopped.signal)
+      );
+      if (renewal.kind === "revoked") deps.onRevoked();
+    };
     const sessionsOpened = Promise.withResolvers();
     const planeOpened = Promise.withResolvers();
     const boot = { sessionsMs: 0, openedMs: 0 };
@@ -79232,7 +79023,8 @@ async function startMachinePlane(deps) {
           void skills.sync();
           desiredSync.received({
             runs: ack.desired.runs,
-            ...ack.approvedWorkspacePaths === void 0 ? {} : { approvedWorkspacePaths: ack.approvedWorkspacePaths }
+            ...ack.approvedWorkspacePaths === void 0 ? {} : { approvedWorkspacePaths: ack.approvedWorkspacePaths },
+            ...ack.desired.pendingUploads === void 0 ? {} : { pendingUploads: ack.desired.pendingUploads }
           });
         },
         onPoke: (poke) => {
@@ -79252,13 +79044,7 @@ async function startMachinePlane(deps) {
           refreshDesired();
         },
         onConnectRefused: (error61) => updates.connectRefused(error61),
-        refreshCredential: async () => {
-          const renewal = await lifecycle.exclusive(
-            "renew",
-            () => identity.renewAfterRejection(stopped.signal)
-          );
-          if (renewal.kind === "revoked") deps.onRevoked();
-        },
+        refreshCredential: renewAfterRejection,
         onStateChange: deps.onStatusChange,
         answerWorkspaceQuery: (request2) => workspaces.answer(request2),
         respond: (request2) => sessions.respond(request2),
@@ -79312,7 +79098,16 @@ async function startMachinePlane(deps) {
       (error61) => log.warn("conversation_index.rebuild_failed", { error: error61 })
     );
     const archive = await openRunArchive(paths.runs);
-    const uploader = stack.use(startUploader({ api, runsDir: paths.runs, clock, log, archive }));
+    const uploader = stack.use(
+      startUploader({
+        api,
+        runsDir: paths.runs,
+        clock,
+        log,
+        archive,
+        onUnauthorized: renewAfterRejection
+      })
+    );
     const nativeIngest = stack.use(
       await startMachineNativeIngest({
         stateDir: paths.stateDir,
@@ -79353,7 +79148,7 @@ async function startMachinePlane(deps) {
                 [ALAN_MANAGED_SESSION_ENV]: "1"
               },
               cwd: paths.stateDir,
-              outputPath: (0, import_node_path83.join)(paths.logs, "holders.log")
+              outputPath: (0, import_node_path81.join)(paths.logs, "holders.log")
             },
             deps.holderIsolation
           );
@@ -79390,7 +79185,7 @@ async function startMachinePlane(deps) {
         }),
         local: { home: config2.home, machineId: identity.machineId },
         // Only a cloud sandbox's runtime has a git gateway; a person's own ~/.codex is theirs.
-        ...config2.gitGatewayUrl === null ? {} : { codexSkillsDir: (0, import_node_path83.join)(config2.codexHome, "skills") },
+        ...config2.gitGatewayUrl === null ? {} : { codexSkillsDir: (0, import_node_path81.join)(config2.codexHome, "skills") },
         log
       })
     );
@@ -79486,8 +79281,8 @@ async function startMachinePlane(deps) {
     );
     stack.use(
       startMaintenance({
-        everyMs: UPLOAD_SWEEP_EVERY_MS,
-        jobs: [{ name: "uploader.sweep", run: () => uploader.sweep() }],
+        everyMs: UPLOAD_RETRY_EVERY_MS,
+        jobs: [{ name: "uploader.retry_pending", run: () => uploader.retryPending() }],
         clock,
         log
       })
@@ -79592,7 +79387,7 @@ async function startMachinePlane(deps) {
             git: createGitRunner({ env: cliEnvironment }),
             clock,
             log,
-            dir: (0, import_node_path83.join)(paths.stateDir, "checkout-freshness")
+            dir: (0, import_node_path81.join)(paths.stateDir, "checkout-freshness")
           },
           stopped.signal
         );
@@ -79601,6 +79396,7 @@ async function startMachinePlane(deps) {
     const desiredSync = createDesiredSync({
       read: (etag, signal) => api.fetchDesiredIfChanged(etag, signal),
       apply: (desired) => {
+        uploader.pending(desired.pendingUploads ?? []);
         void workspaces.learn(desired.runs, desired.approvedWorkspacePaths);
         void reconciler.reconcile(desired.runs);
       },
@@ -79855,11 +79651,11 @@ function createMachineSlot(deps) {
 
 // src/cli/commands/run-exit.ts
 function firstAborted(signals) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve13) => {
     for (const reason of ["stop", "restart"]) {
       const signal = signals[reason];
-      if (signal.aborted) resolve14(reason);
-      signal.addEventListener("abort", () => resolve14(reason), { once: true });
+      if (signal.aborted) resolve13(reason);
+      signal.addEventListener("abort", () => resolve13(reason), { once: true });
     }
   });
 }
@@ -79887,7 +79683,7 @@ function lockWaitMs(argv) {
 }
 async function openManagedProviders(config2, paths) {
   const providerEnv = readCliEnvironment();
-  const bundledNpm = (0, import_node_path84.join)((0, import_node_path84.dirname)(process.execPath), "npm", "bin", "npm-cli.js");
+  const bundledNpm = (0, import_node_path82.join)((0, import_node_path82.dirname)(process.execPath), "npm", "bin", "npm-cli.js");
   const providerToolchain = config2.providerToolchain ?? (process.platform === "win32" && (0, import_node_fs24.existsSync)(bundledNpm) ? { node: process.execPath, npmCli: bundledNpm } : null);
   const npmPath = providerToolchain?.node ?? await resolveCommandOnPath("npm", providerEnv, process.platform);
   const npmOptions = npmPath === null || process.platform === "win32" && providerToolchain === null ? null : {
@@ -79895,7 +79691,7 @@ async function openManagedProviders(config2, paths) {
     ...providerToolchain === null ? {} : { argsBeforeNpm: [providerToolchain.npmCli] },
     env: providerEnv
   };
-  const providerNodeDir = providerToolchain?.node === void 0 ? void 0 : (0, import_node_path84.dirname)(providerToolchain.node);
+  const providerNodeDir = providerToolchain?.node === void 0 ? void 0 : (0, import_node_path82.dirname)(providerToolchain.node);
   const probeEnv = providerNodeDir === void 0 ? providerEnv : {
     ...providerEnv,
     PATH: `${providerNodeDir}${pathDelimiter(process.platform)}${envValue(providerEnv, "PATH")}`
@@ -79905,7 +79701,7 @@ async function openManagedProviders(config2, paths) {
     throw new Error("Provider installer is unavailable on this computer");
   };
   const managed = createManagedProviderClis({
-    root: (0, import_node_path84.join)(paths.stateDir, "provider-clis"),
+    root: (0, import_node_path82.join)(paths.stateDir, "provider-clis"),
     resolveVersion: npmOptions === null ? unavailable : createNpmVersionResolver(npmOptions),
     installPackage: npmOptions === null ? unavailable : createNpmPackageInstaller(npmOptions),
     probe: (executable, backendKind) => probeManagedProvider(executable, backendKind, canonicalProbeEnv)
@@ -79937,7 +79733,7 @@ async function runService(argv, stop, restart = new AbortController().signal) {
       waitMs: lockWaitMs(argv),
       signal: stop
     }));
-    const log = __using(_stack, openFileLog((0, import_node_path84.join)(paths.logs, "runtime.jsonl"), config2.logLevel, clock));
+    const log = __using(_stack, openFileLog((0, import_node_path82.join)(paths.logs, "runtime.jsonl"), config2.logLevel, clock));
     const lifecycle = createLifecycleQueue({ clock, log });
     const install2 = installLayout(config2.installDir, config2.profile);
     const bundlePath = process.argv[1] ?? "";
@@ -79971,7 +79767,7 @@ async function runService(argv, stop, restart = new AbortController().signal) {
         openCliEnvironment({
           env: readCliEnvironment(),
           platform: process.platform,
-          lastKnownGoodFile: (0, import_node_path84.join)(paths.stateDir, "login-path.json"),
+          lastKnownGoodFile: (0, import_node_path82.join)(paths.stateDir, "login-path.json"),
           clock,
           decorate: (env) => withPackagedAlanCodeEngine(env, bundlePath, process.platform)
         })
@@ -80148,17 +79944,17 @@ async function runServiceCommand(argv, ctx = cliContext()) {
 }
 
 // src/cli/commands/upgrade.ts
-var import_promises81 = require("fs/promises");
-var import_node_path85 = require("path");
+var import_promises79 = require("fs/promises");
+var import_node_path83 = require("path");
 function isNotNewer(version2, installed) {
   return installed !== null && isReleaseVersion(version2) && isReleaseVersion(installed) && compareVersions(version2, installed) <= 0;
 }
 async function installFromSource(source) {
   const { layout, from, ifNewer } = source;
-  const isTarball = (await (0, import_promises81.stat)(from)).isFile();
-  const downloads = (0, import_node_path85.join)(layout.root, ".downloads");
-  if (isTarball) await (0, import_promises81.mkdir)(downloads, { recursive: true, mode: 448 });
-  const scratch = isTarball ? await (0, import_promises81.mkdtemp)((0, import_node_path85.join)(downloads, "upgrade-")) : null;
+  const isTarball = (await (0, import_promises79.stat)(from)).isFile();
+  const downloads = (0, import_node_path83.join)(layout.root, ".downloads");
+  if (isTarball) await (0, import_promises79.mkdir)(downloads, { recursive: true, mode: 448 });
+  const scratch = isTarball ? await (0, import_promises79.mkdtemp)((0, import_node_path83.join)(downloads, "upgrade-")) : null;
   try {
     const sourceDir = scratch === null ? from : await extractPackageTarball(from, scratch);
     const version2 = await readPackageVersion(sourceDir);
@@ -80166,7 +79962,7 @@ async function installFromSource(source) {
     if (ifNewer && isNotNewer(version2, installed)) return { kind: "skipped", version: version2, installed };
     return { kind: "installed", ...await installVersion(layout, sourceDir) };
   } finally {
-    if (scratch !== null) await (0, import_promises81.rm)(scratch, { recursive: true, force: true });
+    if (scratch !== null) await (0, import_promises79.rm)(scratch, { recursive: true, force: true });
   }
 }
 async function runUpgrade(argv) {
@@ -80178,7 +79974,7 @@ async function runUpgrade(argv) {
   const layout = installLayout(config2.installDir, config2.profile);
   const outcome2 = await installFromSource({
     layout,
-    from: (0, import_node_path85.resolve)(from),
+    from: (0, import_node_path83.resolve)(from),
     ifNewer: hasFlag(argv, "--if-newer")
   });
   if (outcome2.kind === "skipped") {
@@ -80241,8 +80037,9 @@ the code matches, and approve. Setup waits (polling every 5 s, slower if Alan as
 continues once approved; the code expires after 10 minutes and works once.
 
 A previous Alan agent (v1, \`ai.tryalan.agent\`) is moved over first, once its API is
-confirmed to serve this runtime: its service is stopped and removed, setup waits until
-its process has exited, and only then renews its credential, so a v1 daemon can never
+confirmed to serve this runtime: its service is stopped and removed, setup waits up to
+15 s for its process to exit, then stops it and any other v1 daemon of the profile
+(SIGTERM, then SIGKILL), and only then renews its credential, so a v1 daemon can never
 trip the server's reuse detection. Its config.json is kept as config.json.migrated-v1
 with the tokens removed. Without --token, a v1 install is moved by renewing its
 credential, and a computer that is already set up just gets its service re-installed.