@alan-ai-hq/agent-manager-linux-x64 0.1.128 → 0.1.130

package/alan-agent.cjs

@@ -21358,11 +21358,8 @@ var init_workflow_tools_filter = __esm({
       "create_test_report",
       "create_plan",
       "create_document_artifact",
-      "upsert_prototype_version",
       "list_artifacts",
-      "get_artifact",
-      "list_prototypes",
-      "get_prototype"
+      "get_artifact"
     ];
     LEGACY_WORKFLOW_BUILTIN_TOOLS = {
       list_document_comments: "get_document",
@@ -22352,7 +22349,7 @@ var init_chunk_YXWJW7I5 = __esm({
   }
 });
 
-// ../agent-core/dist/chunk-VZIZDY3T.js
+// ../agent-core/dist/chunk-NDAB5G24.js
 function windowsEnvValue(env, name) {
   const wanted = name.toLowerCase();
   for (const [key, value2] of Object.entries(env)) {
@@ -22476,6 +22473,12 @@ function planSpawn({ command, args, env, platform: platform3, files }) {
   if (launch === void 0) {
     throw new CoreFault("spawn_failed", `Could not start ${command} (not found on PATH)`);
   }
+  if (launch.kind === "batch") {
+    throw new CoreFault(
+      "spawn_failed",
+      `${command} resolves to a batch file that cannot run as a managed Windows agent; install its native executable or supported npm shim`
+    );
+  }
   return { file: launch.file, args: launch.args, commandLine: windowsCommandLine(launch, env) };
 }
 function planDirectLaunch({
@@ -22807,45 +22810,90 @@ function createProcessTree(child, options = {}) {
     }
   };
 }
-function bridgeScript(ownerPid) {
-  return [
-    "$ErrorActionPreference = 'Stop'",
-    "$ProgressPreference = 'SilentlyContinue'",
-    `Add-Type -TypeDefinition @'
-${BRIDGE_SOURCE}
-'@`,
-    `exit [AlanProviderJob]::Run($env:${JOB_COMMAND_VARIABLE}, ${ownerPid})`
-  ].join("\n");
+function providerEnvironment(env) {
+  const unique2 = /* @__PURE__ */ new Map();
+  for (const [name, value2] of Object.entries(env)) {
+    if (/^ALAN_JOB_(FILE|COMMAND|STATUS)$/i.test(name) || /^ALAN_WINHELPER_PATH$/i.test(name))
+      continue;
+    unique2.set(name.toLowerCase(), [name, value2]);
+  }
+  return Object.fromEntries(unique2.values());
 }
-function windowsJobBridge(commandLine, options) {
-  const systemRoot = windowsEnvValue(options.env, "SystemRoot") ?? "C:\\Windows";
-  const script = bridgeScript(options.ownerPid ?? process.pid);
-  return {
-    file: import_path2.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
-    args: [
-      "-NoLogo",
-      "-NoProfile",
-      "-NonInteractive",
-      "-ExecutionPolicy",
-      "Bypass",
-      "-EncodedCommand",
-      Buffer.from(script, "utf16le").toString("base64")
-    ],
-    env: { ...options.env, [JOB_COMMAND_VARIABLE]: commandLine }
-  };
+function requireStartedProvider(response, command) {
+  if (response.startsWith("error:")) {
+    throw new CoreFault("spawn_failed", `Could not start ${command} (${response.slice(6)})`);
+  }
+  if (!/^\d+$/.test(response)) {
+    throw new CoreFault("spawn_failed", `Could not start ${command} (invalid helper response)`);
+  }
+}
+function isWindowsJob(child) {
+  return statuses.has(child);
+}
+function helperFile(env) {
+  const override = Object.entries(env).find(([name]) => /^ALAN_WINHELPER_PATH$/i.test(name))?.[1];
+  if (override) return override;
+  const entry = process.argv[1];
+  if (!entry) throw new CoreFault("spawn_failed", "Cannot locate the Windows agent helper");
+  return (0, import_path2.join)((0, import_path2.dirname)(entry), "alan-winhelper.exe");
 }
 function spawnInWindowsJob(plan2, options) {
   if (plan2.commandLine === null) {
     throw new CoreFault("internal", `No Windows command line was planned for ${plan2.file}`);
   }
-  const bridge = windowsJobBridge(plan2.commandLine, options);
-  return (0, import_child_process6.spawn)(bridge.file, [...bridge.args], {
+  const file2 = helperFile(options.env);
+  const directory = (0, import_fs2.mkdtempSync)((0, import_path2.join)((0, import_os.tmpdir)(), `alan-job-${(0, import_crypto.randomUUID)()}-`));
+  const path4 = (0, import_path2.join)(directory, "started");
+  const child = (0, import_child_process6.spawn)(file2, [String(process.pid)], {
     cwd: options.cwd,
-    env: { ...bridge.env },
+    env: {
+      ...providerEnvironment(options.env),
+      ALAN_JOB_FILE: plan2.file,
+      ALAN_JOB_COMMAND: plan2.commandLine,
+      ALAN_JOB_STATUS: path4
+    },
     stdio: ["pipe", "pipe", "pipe"],
     shell: false,
     windowsHide: true
   });
+  const status = { directory, path: path4 };
+  child.once("error", (error61) => {
+    status.error = error61;
+  });
+  statuses.set(child, status);
+  return child;
+}
+async function waitForWindowsJob(child, command) {
+  const status = statuses.get(child);
+  if (!status) throw new CoreFault("internal", "Missing Windows helper startup state");
+  const deadline = systemClock2.monotonic() + START_TIMEOUT_MS;
+  try {
+    while (systemClock2.monotonic() < deadline) {
+      const providerPid = await (0, import_promises10.readFile)(status.path, "utf8").catch(() => void 0);
+      if (providerPid !== void 0) {
+        requireStartedProvider(providerPid, command);
+        return;
+      }
+      if (status.error) {
+        throw new CoreFault(
+          "spawn_failed",
+          `Could not start ${command} (${status.error.message})`,
+          {
+            cause: status.error
+          }
+        );
+      }
+      if (child.exitCode !== null || child.signalCode !== null) {
+        throw new CoreFault("spawn_failed", `Could not start ${command} (Windows helper exited)`);
+      }
+      await systemClock2.sleep(25);
+    }
+    child.kill("SIGKILL");
+    throw new CoreFault("spawn_failed", `Could not start ${command} (Windows helper timed out)`);
+  } finally {
+    statuses.delete(child);
+    await (0, import_promises10.rm)(status.directory, { recursive: true, force: true });
+  }
 }
 function spawnCli(options) {
   const platform3 = options.platform ?? process.platform;
@@ -22860,6 +22908,7 @@ function spawnCli(options) {
   });
 }
 function waitForSpawn(child, command) {
+  if (isWindowsJob(child)) return waitForWindowsJob(child, command);
   if (child.pid !== void 0) return Promise.resolve();
   return new Promise((resolve10, reject) => {
     const onSpawn = () => {
@@ -22877,9 +22926,9 @@ function waitForSpawn(child, command) {
     child.once("error", onError);
   });
 }
-var import_child_process, import_fs, import_path, import_child_process2, import_promises9, import_child_process3, import_child_process4, import_child_process5, import_child_process6, import_path2, SHIM_MAX_BYTES, CMD_MAX_COMMAND_LINE, MAX_COMMAND_LINE, DEFAULT_PATHEXT, nodeWindowsFiles, NODE_SHIM_ENTRY, CMD_META, NEVER_STARTED, HIDDEN_FLAG_PROBE_VALUE, NEWLINE, CARRIAGE_RETURN, EMPTY, MAX_LINE_BYTES, LineSplitter, PS_LINE, POLL_MS, DEFAULT_GRACE_MS, DEFAULT_KILL_WAIT_MS, DEFAULT_TASKKILL_TIMEOUT_MS, JOB_COMMAND_VARIABLE, BRIDGE_SOURCE;
-var init_chunk_VZIZDY3T = __esm({
-  "../agent-core/dist/chunk-VZIZDY3T.js"() {
+var import_child_process, import_fs, import_path, import_child_process2, import_promises9, import_child_process3, import_child_process4, import_child_process5, import_child_process6, import_crypto, import_fs2, import_promises10, import_os, import_path2, SHIM_MAX_BYTES, CMD_MAX_COMMAND_LINE, MAX_COMMAND_LINE, DEFAULT_PATHEXT, nodeWindowsFiles, NODE_SHIM_ENTRY, CMD_META, NEVER_STARTED, HIDDEN_FLAG_PROBE_VALUE, NEWLINE, CARRIAGE_RETURN, EMPTY, MAX_LINE_BYTES, LineSplitter, PS_LINE, POLL_MS, DEFAULT_GRACE_MS, DEFAULT_KILL_WAIT_MS, DEFAULT_TASKKILL_TIMEOUT_MS, statuses, START_TIMEOUT_MS;
+var init_chunk_NDAB5G24 = __esm({
+  "../agent-core/dist/chunk-NDAB5G24.js"() {
     "use strict";
     init_chunk_YXWJW7I5();
     import_child_process = require("child_process");
@@ -22891,6 +22940,10 @@ var init_chunk_VZIZDY3T = __esm({
     import_child_process4 = require("child_process");
     import_child_process5 = require("child_process");
     import_child_process6 = require("child_process");
+    import_crypto = require("crypto");
+    import_fs2 = require("fs");
+    import_promises10 = require("fs/promises");
+    import_os = require("os");
     import_path2 = require("path");
     SHIM_MAX_BYTES = 64 * 1024;
     CMD_MAX_COMMAND_LINE = 8191;
@@ -22962,87 +23015,8 @@ var init_chunk_VZIZDY3T = __esm({
     DEFAULT_GRACE_MS = 3e3;
     DEFAULT_KILL_WAIT_MS = 2e3;
     DEFAULT_TASKKILL_TIMEOUT_MS = 5e3;
-    JOB_COMMAND_VARIABLE = "ALAN_PROVIDER_JOB_COMMAND";
-    BRIDGE_SOURCE = `
-using System;
-using System.Text;
-using System.Runtime.InteropServices;
-using System.ComponentModel;
-public static class AlanProviderJob {
-  [StructLayout(LayoutKind.Sequential)] struct IO { public ulong a,b,c,d,e,f; }
-  [StructLayout(LayoutKind.Sequential)] struct Limits {
-    public long perProcess, perJob; public uint flags;
-    public UIntPtr minWorkingSet, maxWorkingSet; public uint activeProcesses;
-    public UIntPtr affinity; public uint priority, scheduling;
-  }
-  [StructLayout(LayoutKind.Sequential)] struct ExtendedLimits {
-    public Limits basic; public IO io;
-    public UIntPtr processMemory, jobMemory, peakProcessMemory, peakJobMemory;
-  }
-  [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)] struct Startup {
-    public uint cb; public string reserved, desktop, title;
-    public uint x,y,xSize,ySize,xChars,yChars,fill,flags;
-    public ushort show,reservedSize; public IntPtr reserved2, stdin, stdout, stderr;
-  }
-  [StructLayout(LayoutKind.Sequential)] struct ProcessInfo {
-    public IntPtr process, thread; public uint pid, tid;
-  }
-  [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr CreateJobObject(IntPtr security, string name);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern bool SetInformationJobObject(IntPtr job, int kind, ref ExtendedLimits limits, uint size);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern bool AssignProcessToJobObject(IntPtr job, IntPtr process);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern bool TerminateJobObject(IntPtr job, uint code);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern bool TerminateProcess(IntPtr process, uint code);
-  [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool CreateProcess(string app, StringBuilder command, IntPtr ps, IntPtr ts, bool inherit, uint flags, IntPtr env, string cwd, ref Startup si, out ProcessInfo pi);
-  [DllImport("kernel32.dll")] static extern IntPtr GetStdHandle(int id);
-  [DllImport("kernel32.dll")] static extern IntPtr GetCurrentProcess();
-  [DllImport("kernel32.dll", SetLastError=true)] static extern bool DuplicateHandle(IntPtr sourceProcess, IntPtr source, IntPtr targetProcess, out IntPtr target, uint access, bool inherit, uint options);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern uint ResumeThread(IntPtr thread);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint access, bool inherit, int pid);
-  [DllImport("kernel32.dll", SetLastError=true)] static extern uint WaitForMultipleObjects(uint count, IntPtr[] handles, bool all, uint ms);
-  [DllImport("kernel32.dll")] static extern bool GetExitCodeProcess(IntPtr process, out uint code);
-  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
-  static void Check(bool ok) { if (!ok) throw new Win32Exception(Marshal.GetLastWin32Error()); }
-  static IntPtr CopyStd(int id) {
-    IntPtr result; var self = GetCurrentProcess();
-    Check(DuplicateHandle(self, GetStdHandle(id), self, out result, 0, true, 2));
-    return result;
-  }
-  public static int Run(string command, int ownerPid) {
-    Environment.SetEnvironmentVariable("${JOB_COMMAND_VARIABLE}", null);
-    IntPtr owner = OpenProcess(0x100000, false, ownerPid);
-    if (owner == IntPtr.Zero) throw new Win32Exception(Marshal.GetLastWin32Error());
-    IntPtr job = CreateJobObject(IntPtr.Zero, null);
-    if (job == IntPtr.Zero) { CloseHandle(owner); throw new Win32Exception(Marshal.GetLastWin32Error()); }
-    ProcessInfo pi = new ProcessInfo(); Startup si = new Startup();
-    try {
-      var limits = new ExtendedLimits(); limits.basic.flags = 0x2000;
-      Check(SetInformationJobObject(job, 9, ref limits, (uint)Marshal.SizeOf(limits)));
-      si.cb = (uint)Marshal.SizeOf(si); si.flags = 0x100;
-      si.stdin = CopyStd(-10); si.stdout = CopyStd(-11); si.stderr = CopyStd(-12);
-      Check(CreateProcess(null, new StringBuilder(command), IntPtr.Zero, IntPtr.Zero, true, 0x08000004, IntPtr.Zero, null, ref si, out pi));
-      if (!AssignProcessToJobObject(job, pi.process)) {
-        int error = Marshal.GetLastWin32Error(); TerminateProcess(pi.process, 1);
-        throw new Win32Exception(error);
-      }
-      if (ResumeThread(pi.thread) == 0xffffffff) throw new Win32Exception(Marshal.GetLastWin32Error());
-      uint wait = WaitForMultipleObjects(2, new IntPtr[] { pi.process, owner }, false, 0xffffffff);
-      if (wait == 1) return 1;
-      if (wait != 0) throw new Win32Exception(Marshal.GetLastWin32Error());
-      uint code; Check(GetExitCodeProcess(pi.process, out code));
-      Check(TerminateJobObject(job, code));
-      return unchecked((int)code);
-    } finally {
-      CloseHandle(job);
-      CloseHandle(owner);
-      if (pi.thread != IntPtr.Zero) CloseHandle(pi.thread);
-      if (pi.process != IntPtr.Zero) CloseHandle(pi.process);
-      if (si.stdin != IntPtr.Zero) CloseHandle(si.stdin);
-      if (si.stdout != IntPtr.Zero) CloseHandle(si.stdout);
-      if (si.stderr != IntPtr.Zero) CloseHandle(si.stderr);
-    }
-  }
-}
-`;
+    statuses = /* @__PURE__ */ new WeakMap();
+    START_TIMEOUT_MS = 1e4;
   }
 });
 
@@ -24329,13 +24303,13 @@ function readTranscriptTurns(transcript, chunk, baseOffset, skipped = []) {
   });
   return { turns, consumedBytes: consumedEnd - baseOffset };
 }
-var import_fs2, NEWLINE2, TranscriptCursor, TranscriptLineLookup, CONTENT_UPDATES;
+var import_fs3, NEWLINE2, TranscriptCursor, TranscriptLineLookup, CONTENT_UPDATES;
 var init_chunk_LR52JUGL = __esm({
   "../agent-core/dist/chunk-LR52JUGL.js"() {
     "use strict";
     init_chunk_OUQ7HMD3();
     init_chunk_YXWJW7I5();
-    import_fs2 = require("fs");
+    import_fs3 = require("fs");
     NEWLINE2 = 10;
     TranscriptCursor = class {
       #path;
@@ -24353,7 +24327,7 @@ var init_chunk_LR52JUGL = __esm({
         try {
           this.#offset = Math.max(
             this.#offset,
-            (0, import_fs2.statSync)(this.#path, { throwIfNoEntry: false })?.size ?? 0
+            (0, import_fs3.statSync)(this.#path, { throwIfNoEntry: false })?.size ?? 0
           );
         } catch {
         }
@@ -24375,15 +24349,15 @@ var init_chunk_LR52JUGL = __esm({
       /** Runs on the CLI's stdout path, so an unreadable file reads as no new lines. */
       #unread() {
         try {
-          const size = (0, import_fs2.statSync)(this.#path, { throwIfNoEntry: false })?.size ?? 0;
+          const size = (0, import_fs3.statSync)(this.#path, { throwIfNoEntry: false })?.size ?? 0;
           if (size <= this.#offset) return void 0;
           const buffer = Buffer.alloc(size - this.#offset);
-          const fd = (0, import_fs2.openSync)(this.#path, "r");
+          const fd = (0, import_fs3.openSync)(this.#path, "r");
           try {
-            const read = (0, import_fs2.readSync)(fd, buffer, 0, buffer.length, this.#offset);
+            const read = (0, import_fs3.readSync)(fd, buffer, 0, buffer.length, this.#offset);
             return buffer.subarray(0, read);
           } finally {
-            (0, import_fs2.closeSync)(fd);
+            (0, import_fs3.closeSync)(fd);
           }
         } catch {
           return void 0;
@@ -24581,7 +24555,7 @@ function createCliProblem(classified, options) {
   return createAlanProblem({
     domain: "agent_cli",
     code: problemCodeFor(classified, options),
-    id: options.id ?? (0, import_crypto.randomUUID)(),
+    id: options.id ?? (0, import_crypto2.randomUUID)(),
     title: terminal2 ? "Agent CLI run failed" : "Agent CLI problem observed",
     detail: classified.message,
     occurredAt: options.occurredAt,
@@ -24602,12 +24576,12 @@ function createCliProblem(classified, options) {
     ...classified.resetsAt ? { resetsAt: classified.resetsAt } : {}
   });
 }
-var import_crypto, ERROR_SPECS, AGENT_ERROR_KINDS, STATUS_PREFIX, TEXT_RULES, CODEX_TIMEOUT_MESSAGE, CODEX_EXPIRED_MESSAGE, EPOCH_RESET, WORDED_RESET, COMMAND_NOT_FOUND, CODE_RULES, TEXT_REFINES, CLI_PROBLEM_CODE_BY_ERROR_KIND, KEY_REJECTION_KINDS;
+var import_crypto2, ERROR_SPECS, AGENT_ERROR_KINDS, STATUS_PREFIX, TEXT_RULES, CODEX_TIMEOUT_MESSAGE, CODEX_EXPIRED_MESSAGE, EPOCH_RESET, WORDED_RESET, COMMAND_NOT_FOUND, CODE_RULES, TEXT_REFINES, CLI_PROBLEM_CODE_BY_ERROR_KIND, KEY_REJECTION_KINDS;
 var init_chunk_R32NAS3B = __esm({
   "../agent-core/dist/chunk-R32NAS3B.js"() {
     "use strict";
     init_chunk_YXWJW7I5();
-    import_crypto = require("crypto");
+    import_crypto2 = require("crypto");
     init_agent2();
     ERROR_SPECS = {
       model_mismatch: {
@@ -24842,7 +24816,7 @@ var init_chunk_R32NAS3B = __esm({
   }
 });
 
-// ../agent-core/dist/chunk-2KE6BVIX.js
+// ../agent-core/dist/chunk-BVWCFGFG.js
 function collectStrings(value2, out) {
   if (typeof value2 === "string") out.push(value2);
   else if (Array.isArray(value2)) for (const item of value2) collectStrings(item, out);
@@ -24930,13 +24904,13 @@ function readMediaFiles(candidates2, cwd, mimeByExt, maxBytes) {
   const files = [];
   for (const candidate of candidates2) {
     const path4 = normalizePath(candidate, cwd);
-    if (!path4 || seen.has(path4) || !(0, import_fs3.existsSync)(path4)) continue;
+    if (!path4 || seen.has(path4) || !(0, import_fs4.existsSync)(path4)) continue;
     seen.add(path4);
     const mimeType = mimeByExt[(0, import_path3.extname)(path4).toLowerCase()];
     if (!mimeType) continue;
-    const stat19 = (0, import_fs3.statSync)(path4);
+    const stat19 = (0, import_fs4.statSync)(path4);
     if (!stat19.isFile() || stat19.size <= 0 || stat19.size > maxBytes) continue;
-    files.push({ path: path4, mimeType, buffer: (0, import_fs3.readFileSync)(path4) });
+    files.push({ path: path4, mimeType, buffer: (0, import_fs4.readFileSync)(path4) });
   }
   return files;
 }
@@ -25211,16 +25185,16 @@ function silentStartError(name, timeoutMs) {
     message: `${name} printed nothing for ${seconds}s after it started and was stopped. Send your message again.`
   };
 }
-var import_crypto2, import_fs3, import_path3, IMAGE_MIME_BY_EXT, VIDEO_MIME_BY_EXT, IMAGE_EXTENSIONS, VIDEO_EXTENSIONS, MAX_IMAGE_BYTES, MAX_VIDEO_BYTES, AGENT_BROWSER_MENTION, LocalMediaReader, SessionOpenRefusal, JsonRpcError, ACP_PROTOCOL_VERSION, ACP_ERROR, STDERR_TAIL_LINES, RESULT_EXIT_GRACE_MS, PerTurnSession;
-var init_chunk_2KE6BVIX = __esm({
-  "../agent-core/dist/chunk-2KE6BVIX.js"() {
+var import_crypto3, import_fs4, import_path3, IMAGE_MIME_BY_EXT, VIDEO_MIME_BY_EXT, IMAGE_EXTENSIONS, VIDEO_EXTENSIONS, MAX_IMAGE_BYTES, MAX_VIDEO_BYTES, AGENT_BROWSER_MENTION, LocalMediaReader, SessionOpenRefusal, JsonRpcError, ACP_PROTOCOL_VERSION, ACP_ERROR, STDERR_TAIL_LINES, RESULT_EXIT_GRACE_MS, PerTurnSession;
+var init_chunk_BVWCFGFG = __esm({
+  "../agent-core/dist/chunk-BVWCFGFG.js"() {
     "use strict";
     init_chunk_OUQ7HMD3();
     init_chunk_R32NAS3B();
-    init_chunk_VZIZDY3T();
+    init_chunk_NDAB5G24();
     init_chunk_YXWJW7I5();
-    import_crypto2 = require("crypto");
-    import_fs3 = require("fs");
+    import_crypto3 = require("crypto");
+    import_fs4 = require("fs");
     import_path3 = require("path");
     init_agent2();
     init_acp();
@@ -25281,13 +25255,13 @@ var init_chunk_2KE6BVIX = __esm({
       }
       #payloadFields(file2, toolId) {
         return {
-          id: (0, import_crypto2.randomUUID)(),
+          id: (0, import_crypto3.randomUUID)(),
           filename: (0, import_path3.basename)(file2.path),
           mimeType: file2.mimeType,
           size: file2.buffer.length,
           data: file2.buffer.toString("base64"),
           sourcePath: file2.path,
-          sourceHash: (0, import_crypto2.createHash)("sha256").update(file2.buffer).digest("hex"),
+          sourceHash: (0, import_crypto3.createHash)("sha256").update(file2.buffer).digest("hex"),
           toolId,
           ts: this.#clock.now()
         };
@@ -25571,7 +25545,7 @@ function selectExternalMcpServers(spec) {
   return selected;
 }
 function headerEnvName(server, header) {
-  const fingerprint = (0, import_crypto3.createHash)("sha256").update(`${server}\0${header}`).digest("hex").slice(0, 12);
+  const fingerprint = (0, import_crypto4.createHash)("sha256").update(`${server}\0${header}`).digest("hex").slice(0, 12);
   return `ALAN_MCP_HEADER_${fingerprint.toUpperCase()}`;
 }
 function deliverRemote(name, server, env) {
@@ -25635,7 +25609,7 @@ function managedMcpHeaders(identity) {
 }
 function credentialDigest(authorization) {
   if (authorization === void 0) return void 0;
-  return (0, import_crypto4.createHash)("sha256").update(authorization).digest("hex").slice(0, 16);
+  return (0, import_crypto5.createHash)("sha256").update(authorization).digest("hex").slice(0, 16);
 }
 function canonicalizeManagedMcpServerName(serverName) {
   return RUN_SCOPED_SERVER.test(serverName) ? MANAGED_MCP_SERVER_NAME : serverName;
@@ -25647,30 +25621,30 @@ function canonicalizeManagedMcpToolName(toolName2) {
   return flattened ? `mcp__${MANAGED_MCP_SERVER_NAME}__${flattened[1]}` : toolName2;
 }
 async function writeSecretFile(name, contents) {
-  const dir = await (0, import_promises28.mkdtemp)((0, import_path4.join)((0, import_os.tmpdir)(), "alan-mcp-"));
+  const dir = await (0, import_promises29.mkdtemp)((0, import_path4.join)((0, import_os2.tmpdir)(), "alan-mcp-"));
   const path4 = (0, import_path4.join)(dir, name);
   const remove = async () => {
-    await (0, import_promises28.rm)(dir, { recursive: true, force: true });
+    await (0, import_promises29.rm)(dir, { recursive: true, force: true });
   };
   try {
-    await (0, import_promises28.writeFile)(path4, contents, { mode: 384, flag: "wx" });
+    await (0, import_promises29.writeFile)(path4, contents, { mode: 384, flag: "wx" });
   } catch (error61) {
     await remove();
     throw error61;
   }
   return { path: path4, remove, [Symbol.asyncDispose]: remove };
 }
-var import_crypto3, import_crypto4, import_promises28, import_os, import_path4, MANAGED_MCP_SERVER_NAME, RUN_SCOPED_SERVER, NAMESPACED_RUN_TOOL, FLATTENED_RUN_TOOL;
+var import_crypto4, import_crypto5, import_promises29, import_os2, import_path4, MANAGED_MCP_SERVER_NAME, RUN_SCOPED_SERVER, NAMESPACED_RUN_TOOL, FLATTENED_RUN_TOOL;
 var init_chunk_J2KTV5FP = __esm({
   "../agent-core/dist/chunk-J2KTV5FP.js"() {
     "use strict";
-    import_crypto3 = require("crypto");
-    init_agent2();
     import_crypto4 = require("crypto");
     init_agent2();
+    import_crypto5 = require("crypto");
+    init_agent2();
     init_runtime_v2();
-    import_promises28 = require("fs/promises");
-    import_os = require("os");
+    import_promises29 = require("fs/promises");
+    import_os2 = require("os");
     import_path4 = require("path");
     MANAGED_MCP_SERVER_NAME = "alan";
     RUN_SCOPED_SERVER = /^alan-run-[a-f0-9]{16}$/;
@@ -25679,7 +25653,7 @@ var init_chunk_J2KTV5FP = __esm({
   }
 });
 
-// ../agent-core/dist/chunk-NADPTUUJ.js
+// ../agent-core/dist/chunk-GXBS4QWA.js
 function truncate(value2, limit) {
   const normalized2 = Array.from(value2, (character) => {
     const code = character.charCodeAt(0);
@@ -25881,7 +25855,6 @@ function artifactIdsSection(owner) {
   const ids = artifactIds(owner);
   if (ids.length === 0) return void 0;
   const tools = ["create_plan", "create_document_artifact", "create_test_report"];
-  if (owner.taskId || owner.isWorkflowSession) tools.push("upsert_prototype_version");
   return [
     `When creating artifacts using MCP tools (${tools.join(", ")}), always pass these IDs:`,
     ...ids
@@ -25893,26 +25866,6 @@ function standaloneChatSection(owner) {
   }
   return "This is a standalone chat. For create_plan, create_document_artifact, and create_test_report, omit taskId and workflowId; conversationId is the artifact owner. Do not use create_document unless the user explicitly asks for a standalone team Document.";
 }
-function prototypeScope(owner) {
-  if (owner.workflowId) {
-    return {
-      ids: "teamId, workflowId, workflowExecutionId, conversationId",
-      lookup: "list_prototypes (with workflowId) or get_prototype"
-    };
-  }
-  return owner.taskId ? { ids: "teamId, taskId, conversationId", lookup: "list_prototypes or get_prototype" } : void 0;
-}
-function prototypeSection(owner) {
-  if (!owner.conversationId || !owner.teamId) return void 0;
-  const scope = prototypeScope(owner);
-  if (!scope) return void 0;
-  return [
-    "## Prototype Artifacts",
-    "When the user asks to create, build, modify, or iterate on a prototype, do not create local prototype files such as prototype/index.html.",
-    `Instead, generate a Vite React TypeScript source snapshot and call the Alan MCP tool upsert_prototype_version with ${scope.ids}, title, sourceSnapshot, and packageJson.`,
-    `For follow-up changes to the same prototype, call ${scope.lookup} if needed, then call upsert_prototype_version again with the existing prototypeId and parentVersionId.`
-  ].join("\n");
-}
 function contextSections(spec) {
   const owner = ownershipOf(spec);
   const context = spec.promptContext;
@@ -25921,8 +25874,7 @@ function contextSections(spec) {
     taskContextSection(context?.taskMeta),
     pullRequestSection(context?.prMeta),
     artifactIdsSection(owner),
-    standaloneChatSection(owner),
-    prototypeSection(owner)
+    standaloneChatSection(owner)
   ].filter((section) => section !== void 0);
 }
 function taskLifecycleSection(spec) {
@@ -26028,8 +25980,8 @@ ${body}` : body;
   return spec.mode === "plan" ? planModePrefix(prefixed) : prefixed;
 }
 var MAX_PARSED_ATTACHMENTS, MAX_PARSED_ATTACHMENT_CHARS, MAX_METADATA_CHARS, UNAVAILABLE, READ_ONLY_MODES, AGENT_MODES;
-var init_chunk_NADPTUUJ = __esm({
-  "../agent-core/dist/chunk-NADPTUUJ.js"() {
+var init_chunk_GXBS4QWA = __esm({
+  "../agent-core/dist/chunk-GXBS4QWA.js"() {
     "use strict";
     init_agent2();
     MAX_PARSED_ATTACHMENTS = 3;
@@ -26351,14 +26303,8 @@ function hookResponse(event) {
   if (outcome2 === "success" && exitCode === 0) return [];
   const name = asString(event.hook_name) || "hook";
   const detail = asString(event.stderr) || asString(event.output) || asString(event.stdout);
-  return [
-    noticeUpdate(
-      "warning",
-      "hook_failed",
-      `Hook ${name} failed${exitCode ? ` (exit ${exitCode})` : ""}${outcome2 ? `: ${outcome2}` : ""}.`,
-      detail || void 0
-    )
-  ];
+  const summary = `Hook ${name} failed${exitCode ? ` (exit ${exitCode})` : ""}${outcome2 ? `: ${outcome2}` : ""}.`;
+  return [logUpdate("claude_cli/hook", detail ? `${summary} ${detail}` : summary)];
 }
 function apiRetryNotice(event) {
   const attempt2 = asFiniteNumber(event.attempt) ?? 0;
@@ -27013,7 +26959,7 @@ function encodeProjectDir(cwd) {
 }
 function realCwd(cwd) {
   try {
-    return (0, import_fs4.realpathSync)(cwd);
+    return (0, import_fs5.realpathSync)(cwd);
   } catch {
     return cwd;
   }
@@ -27027,12 +26973,12 @@ function claudeSessionLogExists(query) {
       encodeProjectDir(cwd),
       `${query.sessionId}.jsonl`
     );
-    if ((0, import_fs4.existsSync)(log)) return true;
+    if ((0, import_fs5.existsSync)(log)) return true;
   }
   return false;
 }
 function envDigest(env) {
-  const hash2 = (0, import_crypto6.createHash)("sha256");
+  const hash2 = (0, import_crypto7.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -27095,7 +27041,7 @@ async function claudeTurnInput(run2, context) {
   const encoded = await Promise.all(
     images.map(async (image) => ({
       mimeType: image.mimeType,
-      data: (await (0, import_promises29.readFile)(image.path)).toString("base64")
+      data: (await (0, import_promises30.readFile)(image.path)).toString("base64")
     }))
   );
   return { turnId: run2.runId, text: text2, ...encoded.length ? { images: encoded } : {} };
@@ -27294,30 +27240,30 @@ function claudeTurnClosingUpdates(records, state) {
 function readClaudeTranscriptTurns(chunk, baseOffset, skipped) {
   return readTranscriptTurns(claudeTranscriptFile, chunk, baseOffset, skipped);
 }
-var import_crypto5, import_fs4, import_path5, import_crypto6, import_promises29, EDIT_TOOLS, ThoughtBlocks, UNDERSTOOD_SYSTEM_SUBTYPES, RATE_LIMIT_WARN_AT, CLAUDE_GRAMMAR_NAME, SUBAGENT_TOOL_NAMES, PLAN_ENTRY_STATUSES, controlResponseSchema, STOPPED_STATUSES, TaskRecords, TERMINAL_BACKGROUND_STATUSES, NON_TERMINAL_BACKGROUND_STATUSES, ASYNC_LAUNCH_ACK, BackgroundTasks, FAILED_STATUSES, STOPPED_BY_USER_TEXT, ClaudeTurn, STDERR_TAIL_LINES2, MAX_EARLY_LINES, UNSUPPORTED_STOP, OUTPUT_CLOSED_REASON, ClaudeSession, DEFAULTS, READ_ONLY_DISALLOWED_TOOLS, DEFAULT_MCP_TIMEOUT_MS, SYNTHETIC_MODEL, INTERRUPT_MARKER, NON_PROMPT_PREFIXES, PRELUDE_TYPES, claudeTranscriptFile;
+var import_crypto6, import_fs5, import_path5, import_crypto7, import_promises30, EDIT_TOOLS, ThoughtBlocks, UNDERSTOOD_SYSTEM_SUBTYPES, RATE_LIMIT_WARN_AT, CLAUDE_GRAMMAR_NAME, SUBAGENT_TOOL_NAMES, PLAN_ENTRY_STATUSES, controlResponseSchema, STOPPED_STATUSES, TaskRecords, TERMINAL_BACKGROUND_STATUSES, NON_TERMINAL_BACKGROUND_STATUSES, ASYNC_LAUNCH_ACK, BackgroundTasks, FAILED_STATUSES, STOPPED_BY_USER_TEXT, ClaudeTurn, STDERR_TAIL_LINES2, MAX_EARLY_LINES, UNSUPPORTED_STOP, OUTPUT_CLOSED_REASON, ClaudeSession, DEFAULTS, READ_ONLY_DISALLOWED_TOOLS, DEFAULT_MCP_TIMEOUT_MS, SYNTHETIC_MODEL, INTERRUPT_MARKER, NON_PROMPT_PREFIXES, PRELUDE_TYPES, claudeTranscriptFile;
 var init_claude = __esm({
   "../agent-core/dist/providers/claude.js"() {
     "use strict";
     init_chunk_LR52JUGL();
-    init_chunk_2KE6BVIX();
+    init_chunk_BVWCFGFG();
     init_chunk_OUQ7HMD3();
     init_chunk_R32NAS3B();
     init_chunk_J2KTV5FP();
-    init_chunk_VZIZDY3T();
-    init_chunk_NADPTUUJ();
+    init_chunk_NDAB5G24();
+    init_chunk_GXBS4QWA();
     init_chunk_YXWJW7I5();
     init_effort();
-    import_crypto5 = require("crypto");
+    import_crypto6 = require("crypto");
     init_constants();
     init_zod();
     init_acp();
     init_acp();
     init_constants();
     init_agent2();
-    import_fs4 = require("fs");
+    import_fs5 = require("fs");
     import_path5 = require("path");
-    import_crypto6 = require("crypto");
-    import_promises29 = require("fs/promises");
+    import_crypto7 = require("crypto");
+    import_promises30 = require("fs/promises");
     init_agent2();
     EDIT_TOOLS = /* @__PURE__ */ new Set([
       "Edit",
@@ -27959,7 +27905,7 @@ var init_claude = __esm({
           sessionId: this.#lastTurn.grammar.sessionId,
           taskRecords: this.#taskRecords
         });
-        const messageId = this.#replaysUserMessages ? (0, import_crypto5.randomUUID)() : void 0;
+        const messageId = this.#replaysUserMessages ? (0, import_crypto6.randomUUID)() : void 0;
         const active = this.#startTurn(input2.turnId, turn, messageId);
         this.#host.writer.write(claudeUserMessage(input2, messageId)).catch((error61) => {
           this.#options.log.warn("claude.stdin_write_failed", { turnId: input2.turnId, error: error61 });
@@ -28377,7 +28323,7 @@ function codexHomeOf(env) {
 }
 function namesNewestFirst(dir, isDir) {
   try {
-    return (0, import_fs5.readdirSync)(dir, { withFileTypes: true }).filter((entry) => isDir ? entry.isDirectory() : entry.isFile()).map((entry) => entry.name).sort().reverse();
+    return (0, import_fs6.readdirSync)(dir, { withFileTypes: true }).filter((entry) => isDir ? entry.isDirectory() : entry.isFile()).map((entry) => entry.name).sort().reverse();
   } catch {
     return [];
   }
@@ -28557,7 +28503,7 @@ function codexGeneratedImage(payload, ts) {
   const declared = asString(payload.mimeType) || asString(payload.mime_type);
   const mimeType = declared.startsWith("image/") ? declared : inferImageMimeType(buffer);
   if (!mimeType) return null;
-  const sourceHash = (0, import_crypto7.createHash)("sha256").update(buffer).digest("hex");
+  const sourceHash = (0, import_crypto8.createHash)("sha256").update(buffer).digest("hex");
   const toolId = asString(payload.call_id);
   const id = asString(payload.id) || toolId || sourceHash;
   const sourcePath = asString(payload.sourcePath);
@@ -29038,6 +28984,10 @@ function isAuthStatus(error61) {
   const status = httpStatusOf(info);
   return info === "unauthorized" || status === 401 || status === 403;
 }
+function cliLog(method, params) {
+  const text2 = [asString(params.message) || asString(params.summary), asString(params.details)].filter((part) => part.length > 0).join(" ");
+  return logUpdate(`codex/${method}`, text2);
+}
 function pendingAnswer(pending, answer) {
   switch (pending.kind) {
     case "approval":
@@ -29287,7 +29237,6 @@ function promptFor(spec, turn, resumeId) {
   return [system?.trim(), turn.text.trim()].filter(Boolean).join("\n\n");
 }
 function provider(spec, clock) {
-  const memory = { shownWarnings: /* @__PURE__ */ new Set() };
   return {
     name: "codex-exec",
     launch: async (turn, resumeId) => ({
@@ -29304,7 +29253,7 @@ function provider(spec, clock) {
       }),
       stdin: promptFor(spec, turn, resumeId)
     }),
-    reader: (_turn, resumeId) => new CodexExecTurn(memory, resumeId, { codexHome: codexHomeOf(spec.env), clock })
+    reader: (_turn, resumeId) => new CodexExecTurn(resumeId, { codexHome: codexHomeOf(spec.env), clock })
   };
 }
 function createCodexExecDriver(options = {}) {
@@ -29336,7 +29285,7 @@ function createCodexExecDriver(options = {}) {
   };
 }
 function envDigest2(env) {
-  const hash2 = (0, import_crypto8.createHash)("sha256");
+  const hash2 = (0, import_crypto9.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -29998,7 +29947,7 @@ function readCodexRolloutTurns(chunk, baseOffset, skipped) {
   return readTranscriptTurns(codexRolloutFile, chunk, baseOffset, skipped);
 }
 function envDigest22(env) {
-  const hash2 = (0, import_crypto9.createHash)("sha256");
+  const hash2 = (0, import_crypto10.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -30067,26 +30016,26 @@ function codexTurnInput(run2, context) {
     ...images.length ? { imagePaths: images.map((image) => image.path) } : {}
   };
 }
-var import_fs5, import_path6, import_crypto7, import_crypto8, import_crypto9, TokenRefresher, MCP_STARTUP_TIMEOUT_SEC, FIELD_TYPES, YES_NO, ACCEPT_DECLINE, MAX_INLINE_GENERATED_IMAGE_BYTES, PNG_SIGNATURE, JPEG_NON_FRAME_MARKERS, IMAGE_GEN_CALL, PROMPT_LITERAL, TURN_END_EVENTS, RELOCATE_EVERY_MS, CodexImageGenerationFold, CodexRolloutImages, USER_INPUT_METHOD, PERMISSIONS_METHOD, ELICITATION_METHOD, COMMAND_OR_FILE, LEGACY, DECISIONS, COORDINATION_TOOLS, SETTLED_AGENT, STATUS, CHANGE_OPERATIONS, SILENT_ON_START, IGNORED_ITEMS, PLAN_STATUS, WORKER_LIFECYCLE, INFO_KINDS, SILENT, CodexTurn, STDERR_TAIL_LINES3, MAX_BETWEEN_UPDATES, UNSUPPORTED_REQUEST, DECLINED_ELICITATION, IMAGE_CATCH_UP_MS, IMAGE_POLL_MS, CodexSession, CODEX_MIN_VERSION, CODEX_REQUIREMENT, CODEX_TESTED_LINE, DEFAULTS2, CLIENT_INFO, STATUS2, EXITED_WITHOUT_RESPONSE, CodexExecTurn, DEFAULTS22, CodexExecSession, INJECTED_USER_PREFIXES, SHELL_TOOL_NAMES, ANNOUNCING_ITEM_TYPES, OUTPUT_MARKER, OPEN_PAGE_ACTIONS, FIND_IN_PAGE_ACTIONS, FILE_OPERATIONS, UNDERSTOOD_ITEM_TYPES, PRELUDE_TYPES2, PRELUDE_EVENTS, codexRolloutFile;
+var import_fs6, import_path6, import_crypto8, import_crypto9, import_crypto10, TokenRefresher, MCP_STARTUP_TIMEOUT_SEC, FIELD_TYPES, YES_NO, ACCEPT_DECLINE, MAX_INLINE_GENERATED_IMAGE_BYTES, PNG_SIGNATURE, JPEG_NON_FRAME_MARKERS, IMAGE_GEN_CALL, PROMPT_LITERAL, TURN_END_EVENTS, RELOCATE_EVERY_MS, CodexImageGenerationFold, CodexRolloutImages, USER_INPUT_METHOD, PERMISSIONS_METHOD, ELICITATION_METHOD, COMMAND_OR_FILE, LEGACY, DECISIONS, COORDINATION_TOOLS, SETTLED_AGENT, STATUS, CHANGE_OPERATIONS, SILENT_ON_START, IGNORED_ITEMS, PLAN_STATUS, WORKER_LIFECYCLE, INFO_KINDS, SILENT, CodexTurn, STDERR_TAIL_LINES3, MAX_BETWEEN_UPDATES, UNSUPPORTED_REQUEST, DECLINED_ELICITATION, IMAGE_CATCH_UP_MS, IMAGE_POLL_MS, CodexSession, CODEX_MIN_VERSION, CODEX_REQUIREMENT, CODEX_TESTED_LINE, DEFAULTS2, CLIENT_INFO, STATUS2, EXITED_WITHOUT_RESPONSE, CodexExecTurn, DEFAULTS22, CodexExecSession, INJECTED_USER_PREFIXES, SHELL_TOOL_NAMES, ANNOUNCING_ITEM_TYPES, OUTPUT_MARKER, OPEN_PAGE_ACTIONS, FIND_IN_PAGE_ACTIONS, FILE_OPERATIONS, UNDERSTOOD_ITEM_TYPES, PRELUDE_TYPES2, PRELUDE_EVENTS, codexRolloutFile;
 var init_codex = __esm({
   "../agent-core/dist/providers/codex.js"() {
     "use strict";
     init_chunk_LR52JUGL();
-    init_chunk_2KE6BVIX();
+    init_chunk_BVWCFGFG();
     init_chunk_OUQ7HMD3();
     init_chunk_R32NAS3B();
     init_chunk_J2KTV5FP();
-    init_chunk_VZIZDY3T();
-    init_chunk_NADPTUUJ();
+    init_chunk_NDAB5G24();
+    init_chunk_GXBS4QWA();
     init_chunk_YXWJW7I5();
-    import_fs5 = require("fs");
+    import_fs6 = require("fs");
     import_path6 = require("path");
     init_effort();
-    import_crypto7 = require("crypto");
-    init_agent2();
     import_crypto8 = require("crypto");
     init_agent2();
     import_crypto9 = require("crypto");
+    init_agent2();
+    import_crypto10 = require("crypto");
     init_effort();
     TokenRefresher = class {
       #auth;
@@ -30401,11 +30350,12 @@ var init_codex = __esm({
             ];
           case "thread/tokenUsage/updated":
             return this.#usage(params);
+          // The CLI's own housekeeping (the user's config.toml, unstable features, hook timeouts):
+          // kept in the run log, never shown in the chat, where nothing can act on it.
           case "warning":
           case "configWarning":
-            return this.#warning(method, asString(params.message) || asString(params.summary));
           case "deprecationNotice":
-            return this.#deprecation(asString(params.summary), asString(params.details));
+            return [cliLog(method, params)];
           case "mcpServer/startupStatus/updated":
             return this.#mcpStatus(params);
           case "error":
@@ -30468,35 +30418,31 @@ var init_codex = __esm({
           )
         ];
       }
-      /** Codex repeats its config warnings on every thread and turn; each is shown once per session. */
-      #warning(method, message2) {
-        const key = `${method}\0${message2}`;
-        if (!message2 || this.#memory.shownWarnings.has(key)) return [];
+      /**
+       * Only Alan's own MCP server failing matters in the chat: its tools are gone for the session.
+       * The user's other servers (and their logins) belong to their Codex setup, not to Alan.
+       */
+      #mcpStatus(params) {
+        if (asString(params.status) !== "failed") return [];
+        const name = asString(params.name);
+        if (canonicalizeManagedMcpServerName(name) !== MANAGED_MCP_SERVER_NAME) {
+          const reason2 = asString(params.error) || asString(params.failureReason);
+          return [
+            logUpdate("codex/mcp", `MCP server ${name} failed to start${reason2 ? `: ${reason2}` : "."}`)
+          ];
+        }
+        const reason = asString(params.error) || asString(params.failureReason);
+        const key = `mcp_server_failed\0${reason}`;
+        if (this.#memory.shownWarnings.has(key)) return [];
         this.#memory.shownWarnings.add(key);
         return [
           noticeUpdate(
             "warning",
-            method === "configWarning" ? "config_warning" : "provider_warning",
-            message2
+            "mcp_server_failed",
+            `Alan tools are unavailable in this session${reason ? `: ${reason}` : "."}`
           )
         ];
       }
-      /** Codex telling the user a setting or feature is going away: once per session, never an error. */
-      #deprecation(summary, details) {
-        const key = `deprecationNotice\0${summary}`;
-        if (!summary || this.#memory.shownWarnings.has(key)) return [];
-        this.#memory.shownWarnings.add(key);
-        return [noticeUpdate("warning", "deprecation", summary, details || void 0)];
-      }
-      #mcpStatus(params) {
-        if (asString(params.status) !== "failed") return [];
-        const name = asString(params.name) || "unknown";
-        const reason = asString(params.error) || asString(params.failureReason);
-        return this.#warning(
-          "mcp_server_failed",
-          `MCP server ${name} failed to start${reason ? `: ${reason}` : "."}`
-        );
-      }
       #error(params) {
         const error61 = asRecord(params.error);
         if (params.willRetry === true) {
@@ -30974,14 +30920,12 @@ var init_codex = __esm({
       message: "The agent exited without producing a response. Send your message again to retry."
     };
     CodexExecTurn = class {
-      #memory;
       #threadId;
       #end;
       #lastError;
       #answered = false;
       #images;
-      constructor(memory, resumeId, rollout) {
-        this.#memory = memory;
+      constructor(resumeId, rollout) {
         this.#threadId = resumeId;
         if (!rollout) return;
         this.#images = new CodexRolloutImages(
@@ -31037,7 +30981,9 @@ var init_codex = __esm({
       #item(item, completed) {
         if (!item) return [];
         const type = asString(item.type);
-        if (type === "error") return completed ? this.#warning(asString(item.message)) : [];
+        if (type === "error") {
+          return completed ? [logUpdate("codex/warning", asString(item.message))] : [];
+        }
         if (type === "todo_list") {
           return Array.isArray(item.items) ? todoEntries(asString(item.id), item.items) : [];
         }
@@ -31046,12 +30992,6 @@ var init_codex = __esm({
         if (mapped) return itemUpdates(mapped, completed);
         return [{ sessionUpdate: "_alan/unhandled", kind: `item/${type || "(untyped)"}` }];
       }
-      /** Exec reports config warnings as `error` items on every turn; each is shown once. */
-      #warning(message2) {
-        if (!message2 || this.#memory.shownWarnings.has(message2)) return [];
-        this.#memory.shownWarnings.add(message2);
-        return [noticeUpdate("warning", "provider", message2)];
-      }
       #completed(usage) {
         this.#end = { status: "completed" };
         const number4 = (value2) => asFiniteNumber(value2) ?? 0;
@@ -31307,9 +31247,9 @@ function packagedAlanCodeEnginePath(bundle, platform3) {
 }
 function isRunnableFile(path4, platform3) {
   try {
-    if (!(0, import_fs6.statSync)(path4).isFile()) return false;
+    if (!(0, import_fs7.statSync)(path4).isFile()) return false;
     if (platform3 === "win32") return WINDOWS_RUNNABLE_EXTENSION.test(path4);
-    (0, import_fs6.accessSync)(path4, import_fs6.constants.X_OK);
+    (0, import_fs7.accessSync)(path4, import_fs7.constants.X_OK);
     return true;
   } catch {
     return false;
@@ -31478,18 +31418,18 @@ function alanCodeEngineEnv(input2) {
   };
 }
 async function writePlugin(directory, apiOrigin) {
-  const origin = (0, import_crypto10.createHash)("sha256").update(apiOrigin).digest("hex").slice(0, 12);
+  const origin = (0, import_crypto11.createHash)("sha256").update(apiOrigin).digest("hex").slice(0, 12);
   const target = (0, import_path8.join)(directory, `engine-plugin-v${ALAN_CODE_ENGINE_PLUGIN_VERSION}-${origin}.mjs`);
-  const temporary = `${target}.${(0, import_crypto10.randomUUID)()}.tmp`;
-  await (0, import_promises32.mkdir)(directory, { recursive: true, mode: 448 });
-  await (0, import_promises32.writeFile)(temporary, alanCodeEnginePluginSource(apiOrigin), { mode: 384 });
-  await (0, import_promises32.rename)(temporary, target);
+  const temporary = `${target}.${(0, import_crypto11.randomUUID)()}.tmp`;
+  await (0, import_promises33.mkdir)(directory, { recursive: true, mode: 448 });
+  await (0, import_promises33.writeFile)(temporary, alanCodeEnginePluginSource(apiOrigin), { mode: 384 });
+  await (0, import_promises33.rename)(temporary, target);
   return (0, import_url.pathToFileURL)(target).href;
 }
 async function prepareAlanCodeProfile(input2) {
   const directories = Object.values(alanCodeEngineDirectories(input2.engineRoot));
   await Promise.all(
-    directories.map((directory) => (0, import_promises32.mkdir)(directory, { recursive: true, mode: 448 }))
+    directories.map((directory) => (0, import_promises33.mkdir)(directory, { recursive: true, mode: 448 }))
   );
   const [pluginUrl, models] = await Promise.all([
     writePlugin((0, import_path8.join)(input2.engineRoot, "plugin"), input2.access.apiOrigin),
@@ -31512,7 +31452,7 @@ function alanCodeSystemPrompt(alanSystemPrompt) {
 
 ${instructions}` : ALAN_CODE_TOOL_NAMING_PROMPT;
 }
-var import_http9, import_https, import_fs6, import_path7, import_crypto10, import_promises32, import_path8, import_url, ALAN_CODE_BASELINE_PROMPT, ALAN_CODE_ENGINE_PROVIDER_ID, DEFAULT_CONTEXT_WINDOW, DEFAULT_MAX_OUTPUT_TOKENS, ALAN_CODE_API_KEY_ENV, ALAN_CODE_CONVERSATION_ID_ENV, ALAN_CODE_PROXY_PATH, ALAN_CODE_WEBSEARCH_PATH, ALAN_CODE_CATALOG_PATH, CATALOG_TIMEOUT_MS, MAX_CATALOG_BYTES, ALAN_CODE_ENGINE_PATH_ENV, ALAN_CODE_ENGINE_COMMAND, ALAN_CODE_ENGINE_NAME, WINDOWS_RUNNABLE_EXTENSION, ALAN_CODE_ENGINE_PLUGIN_VERSION, ALAN_CODE_TOOL_NAMING_PROMPT;
+var import_http9, import_https, import_fs7, import_path7, import_crypto11, import_promises33, import_path8, import_url, ALAN_CODE_BASELINE_PROMPT, ALAN_CODE_ENGINE_PROVIDER_ID, DEFAULT_CONTEXT_WINDOW, DEFAULT_MAX_OUTPUT_TOKENS, ALAN_CODE_API_KEY_ENV, ALAN_CODE_CONVERSATION_ID_ENV, ALAN_CODE_PROXY_PATH, ALAN_CODE_WEBSEARCH_PATH, ALAN_CODE_CATALOG_PATH, CATALOG_TIMEOUT_MS, MAX_CATALOG_BYTES, ALAN_CODE_ENGINE_PATH_ENV, ALAN_CODE_ENGINE_COMMAND, ALAN_CODE_ENGINE_NAME, WINDOWS_RUNNABLE_EXTENSION, ALAN_CODE_ENGINE_PLUGIN_VERSION, ALAN_CODE_TOOL_NAMING_PROMPT;
 var init_alan_code = __esm({
   "../agent-core/dist/providers/alan-code.js"() {
     "use strict";
@@ -31522,11 +31462,11 @@ var init_alan_code = __esm({
     init_runtime_v2();
     init_runtime_v2();
     init_models();
-    import_fs6 = require("fs");
+    import_fs7 = require("fs");
     import_path7 = require("path");
     init_runtime_v2();
-    import_crypto10 = require("crypto");
-    import_promises32 = require("fs/promises");
+    import_crypto11 = require("crypto");
+    import_promises33 = require("fs/promises");
     import_path8 = require("path");
     import_url = require("url");
     ALAN_CODE_BASELINE_PROMPT = "You are alan-code, an interactive CLI coding agent that helps users with software engineering tasks. Use the instructions below and the tools available to you to assist the user.\n\nIMPORTANT: You must NEVER generate or guess URLs for the user unless you are confident that the URLs are for helping the user with programming. You may use URLs provided by the user in their messages or local files.\n\nIf the user asks for help or wants to give feedback, inform them of the following:\n- `--harness-help` / harness help: learn how to run alan-code\n- For product feedback or bugs, report through the Alan / Supatest issue channels used by this repository\n\nWhen the user directly asks about alan-code capabilities (for example \"can alan-code\u2026\", \"does the harness have\u2026\") or asks in second person about your abilities, answer from the tools and instructions available in this session. If a docs/fetch tool is available and project docs URLs are known, use them; otherwise inspect local README / AGENTS.md rather than inventing product claims.\n\n# Personality\n\nYour default personality and tone is concise, direct, and friendly. You communicate efficiently, always keeping the user clearly informed about ongoing actions without unnecessary detail. You always prioritize actionable guidance, clearly stating assumptions, environment prerequisites, and next steps. Unless explicitly asked, you avoid excessively verbose explanations about your work.\n\n# Tone and style\n\nYou should be concise, direct, and to the point. When you run a non-trivial bash command, you should explain what the command does and why you are running it, so the user understands what you are doing (especially important for commands that change their system).\nRemember that your output will be displayed on a command line interface. Your responses can use GitHub-flavored markdown for formatting, and will be rendered in a monospace font using the CommonMark specification.\nOutput text to communicate with the user; all text you output outside of tool use is displayed to the user. Only use tools to complete tasks. Never use tools like Bash or code comments as means to communicate with the user during the session.\nIf you cannot or will not help the user with something, do not lecture about why. Offer helpful alternatives if possible; otherwise keep the response to 1-2 sentences.\nOnly use emojis if the user explicitly requests it. Avoid emojis in all communication unless asked.\nIMPORTANT: Minimize output tokens while staying helpful, correct, and accurate. Only address the specific query or task. Avoid tangential information unless it is critical to completing the request. If you can answer in 1-3 sentences or a short paragraph, do that.\nAnswer the user's question directly. One-word answers are best when they suffice. Avoid text before/after your response such as \"The answer is <answer>.\", \"Here is the content of the file\u2026\", \"Based on the information provided\u2026\", or \"Here is what I will do next\u2026\". Examples of appropriate verbosity:\n<example>\nuser: what is 2+2?\nassistant: 4\n</example>\n\n<example>\nuser: is 11 a prime number?\nassistant: Yes\n</example>\n\n<example>\nuser: what command should I run to list files in the current directory?\nassistant: ls\n</example>\n\n<example>\nuser: what command should I run to watch files in the current directory?\nassistant: [use tools to inspect the project, then answer]\nnpm run dev\n</example>\n\n<example>\nuser: what files are in the directory src/?\nassistant: [lists files and sees foo.c, bar.c, baz.c]\nuser: which file contains the implementation of foo?\nassistant: src/foo.c\n</example>\n\n<example>\nuser: write tests for new feature\nassistant: [searches for similar tests, reads relevant files concurrently, edits/writes tests]\n</example>\n\n# Responsiveness\n\n## Preamble messages\n\nBefore making tool calls, send a brief preamble to the user explaining what you're about to do. When sending preamble messages, follow these principles and examples:\n\n- **Logically group related actions**: if you're about to run several related commands, describe them together in one preamble rather than sending a separate note for each.\n- **Keep it concise**: be no more than 1-2 sentences, focused on immediate, tangible next steps. (8\u201312 words for quick updates).\n- **Build on prior context**: if this is not your first tool call, use the preamble message to connect the dots with what's been done so far and create a sense of momentum and clarity for the user to understand your next actions.\n- **Keep your tone light, friendly and curious**: add small touches of personality in preambles feel collaborative and engaging.\n- **Exception**: Avoid adding a preamble for every trivial read (e.g., `cat` a single file) unless it's part of a larger grouped action.\n\nExamples:\n\n- \"I've explored the repo; now checking the API route definitions.\"\n- \"Next, I'll patch the config and update the related tests.\"\n- \"I'm about to scaffold the CLI commands and helper functions.\"\n- \"Ok cool, so I've wrapped my head around the repo. Now digging into the API routes.\"\n- \"Config's looking tidy. Next up is patching helpers to keep things in sync.\"\n- \"Finished poking at the DB gateway. I will now chase down error handling.\"\n- \"Alright, build pipeline order is interesting. Checking how it reports failures.\"\n- \"Spotted a clever caching util; now hunting where it gets used.\"\n\n# Planning\n\nYou have access to a `todowrite` tool which tracks steps and progress and renders them to the user. Using the tool helps demonstrate that you've understood the task and convey how you're approaching it. Plans can help to make complex, ambiguous, or multi-phase work clearer and more collaborative for the user. A good plan should break the task into meaningful, logically ordered steps that are easy to verify as you go.\n\nNote that plans are not for padding out simple work with filler steps or stating the obvious. The content of your plan should not involve doing anything that you aren't capable of doing (i.e. don't try to test things that you can't test). Do not use plans for simple or single-step queries that you can just do or answer immediately.\n\nDo not repeat the full contents of the plan after a `todowrite` call \u2014 the harness already displays it. Instead, summarize the change made and highlight any important context or next step.\n\nBefore running a command, consider whether or not you have completed the previous step, and make sure to mark it as completed before moving on to the next step. It may be the case that you complete all steps in your plan after a single pass of implementation. If this is the case, you can simply mark all the planned steps as completed. Sometimes, you may need to change plans in the middle of a task: call `todowrite` with the updated plan and make sure to explain the rationale when doing so.\n\nUse a plan when:\n\n- The task is non-trivial and will require multiple actions over a long time horizon.\n- There are logical phases or dependencies where sequencing matters.\n- The work has ambiguity that benefits from outlining high-level goals.\n- You want intermediate checkpoints for feedback and validation.\n- When the user asked you to do more than one thing in a single prompt\n- The user has asked you to use the plan tool (aka \"TODOs\")\n- You generate additional steps while working, and plan to do them before yielding to the user\n\n## Examples\n\n**High-quality plans**\n\nExample 1:\n\n1. Add CLI entry with file args\n2. Parse Markdown via CommonMark library\n3. Apply semantic HTML template\n4. Handle code blocks, images, links\n5. Add error handling for invalid files\n\nExample 2:\n\n1. Define CSS variables for colors\n2. Add toggle with localStorage state\n3. Refactor components to use variables\n4. Verify all views for readability\n5. Add smooth theme-change transition\n\nExample 3:\n\n1. Set up Node.js + WebSocket server\n2. Add join/leave broadcast events\n3. Implement messaging with timestamps\n4. Add usernames + mention highlighting\n5. Persist messages in lightweight DB\n6. Add typing indicators + unread count\n\n**Low-quality plans**\n\nExample 1:\n\n1. Create CLI tool\n2. Add Markdown parser\n3. Convert to HTML\n\nExample 2:\n\n1. Add dark mode toggle\n2. Save preference\n3. Make styles look good\n\nExample 3:\n\n1. Create single-file HTML game\n2. Run quick sanity check\n3. Summarize usage instructions\n\nIf you need to write a plan, only write high quality plans, not low quality ones.\n\n## Plan mode and clarification (harness specifics)\n\n- For multi-step or risky work, enter plan mode (`/plan` or `--plan`) before editing. Explore read-only, then call `plan_write` with a decision-complete markdown plan (approach, rejected alternatives, verification, assumptions). Wait for user approval before implementing.\n- Prefer the durable plan file path over relying on chat memory after compaction.\n- When requirements are ambiguous, use the `question` tool with concrete options instead of guessing.\n- `todowrite` tracks execution steps (see its Tool Guidelines entry); it is not a substitute for a durable plan file.\n\n# Task execution\n\nYou are a coding agent. Please keep going until the query is completely resolved, before ending your turn and yielding back to the user. Only terminate your turn when you are sure that the problem is solved. Autonomously resolve the query to the best of your ability, using the tools available to you, before coming back to the user. Do NOT guess or make up an answer.\n\nYou MUST adhere to the following criteria when solving queries:\n\n- Working on the repo(s) in the current environment is allowed, even if they are proprietary.\n- Analyzing code for vulnerabilities is allowed.\n- Showing user code and tool call details is allowed.\n- Use the `edit` tool to modify existing files and the `write` tool to create new ones. This harness has no structured-patch tool \u2014 never try `apply_patch`, `applypatch`, or `apply-patch`.\n\nIf completing the user's task requires writing or modifying files, your code and final answer should follow these coding guidelines, though user instructions (i.e. AGENTS.md) may override these guidelines:\n\n- Fix the problem at the root cause rather than applying surface-level patches, when possible.\n- Avoid unneeded complexity in your solution.\n- Do not attempt to fix unrelated bugs or broken tests. It is not your responsibility to fix them. (You may mention them to the user in your final message though.)\n- Update documentation as necessary.\n- Keep changes consistent with the style of the existing codebase. Changes should be minimal and focused on the task.\n- Use `git log` and `git blame` to search the history of the codebase if additional context is required.\n- NEVER add copyright or license headers unless specifically requested.\n- Do not waste tokens by re-reading files after editing them. The tool call will fail if it didn't work. The same goes for making folders, deleting folders, etc.\n- Do not `git commit` your changes or create new git branches unless explicitly requested.\n- Do not add inline comments within code unless explicitly requested.\n- Do not use one-letter variable names unless explicitly requested.\n- NEVER output inline citations like \"\u3010F:README.md\u2020L5-L14\u3011\" in your outputs. The CLI is not able to render these so they will just be broken in the UI. Instead, if you output valid filepaths, users will be able to click on them to open the files in their editor.\n\n# Validating your work\n\nIf the codebase has tests or the ability to build or run, consider using them to verify that your work is complete.\n\nWhen testing, your philosophy should be to start as specific as possible to the code you changed so that you can catch issues efficiently, then make your way to broader tests as you build confidence. If there's no test for the code you changed, and if the adjacent patterns in the codebases show that there's a logical place for you to add a test, you may do so. However, do not add tests to codebases with no tests.\n\nSimilarly, once you're confident in correctness, you can suggest or use formatting commands to ensure that your code is well formatted. If there are issues you can iterate up to 3 times to get formatting right, but if you still can't manage it's better to save the user time and present them a correct solution where you call out the formatting in your final message. If the codebase does not have a formatter configured, do not add one.\n\nFor all of testing, running, building, and formatting, do not attempt to fix unrelated bugs. It is not your responsibility to fix them. (You may mention them to the user in your final message though.)\n\nBe mindful of whether to run validation commands proactively. In the absence of behavioral guidance:\n\n- When running in a non-interactive mode where edits are auto-approved (print/headless, or the `allow edits` permission mode), proactively run tests, lint and do whatever you need to ensure you've completed the task.\n- When working in interactive permission modes like `ask before edits` or `plan`, hold off on running tests or lint commands until the user is ready for you to finalize your output, because these commands take time to run and slow down iteration. Instead suggest what you want to do next, and let the user confirm first.\n- When working on test-related tasks, such as adding tests, fixing tests, or reproducing a bug to verify behavior, you may proactively run tests regardless of permission mode. Use your judgement to decide whether this is a test-related task.\n\n# Ambition vs. precision\n\nFor tasks that have no prior context (i.e. the user is starting something brand new), you should feel free to be ambitious and demonstrate creativity with your implementation.\n\nIf you're operating in an existing codebase, you should make sure you do exactly what the user asks with surgical precision. Treat the surrounding codebase with respect, and don't overstep (i.e. changing filenames or variables unnecessarily). You should balance being sufficiently ambitious and proactive when completing tasks of this nature.\n\nYou should use judicious initiative to decide on the right level of detail and complexity to deliver based on the user's needs. This means showing good judgment that you're capable of doing the right extras without gold-plating. This might be demonstrated by high-value, creative touches when scope of the task is vague; while being surgical and targeted when scope is tightly specified.\n\n# Sharing progress updates\n\nFor especially longer tasks that you work on (i.e. requiring many tool calls, or a plan with multiple steps), you should provide progress updates back to the user at reasonable intervals. These updates should be structured as a concise sentence or two (no more than 8-10 words long) recapping progress so far in plain language: this update demonstrates your understanding of what needs to be done, progress so far (i.e. files explores, subtasks complete), and where you're going next.\n\nBefore doing large chunks of work that may incur latency as experienced by the user (i.e. writing a new file), you should send a concise message to the user with an update indicating what you're about to do to ensure they know what you're spending time on. Don't start editing or writing large files before informing the user what you are doing and why.\n\nThe messages you send before tool calls should describe what is immediately about to be done next in very concise language. If there was previous work done, this preamble message should also include a note about the work done so far to bring the user along.\n\n# Presenting your work and final message\n\nYour final message should read naturally, like an update from a concise teammate. For casual conversation, brainstorming tasks, or quick questions from the user, respond in a friendly, conversational tone. You should ask questions, suggest ideas, and adapt to the user's style. If you've finished a large amount of work, when describing what you've done to the user, you should follow the final answer formatting guidelines to communicate substantive changes. You don't need to add structured formatting for one-word answers, greetings, or purely conversational exchanges.\n\nYou can skip heavy formatting for single, simple actions or confirmations. In these cases, respond in plain sentences with any relevant next step or quick option. Reserve multi-section structured responses for results that need grouping or explanation.\n\nThe user is working on the same computer as you, and has access to your work. As such there's no need to show the full contents of large files you have already written unless the user explicitly asks for them. Similarly, if you've created or modified files, there's no need to tell users to \"save the file\" or \"copy the code into a file\"\u2014just reference the file path.\n\nIf there's something that you think you could help with as a logical next step, concisely ask the user if they want you to do so. Good examples of this are running tests, committing changes, or building out the next logical component. If there's something that you couldn't do (even with approval) but that the user might want to do (such as verifying changes by running the app), include those instructions succinctly.\n\nBrevity is very important as a default. You should be very concise (i.e. no more than 10 lines), but can relax this requirement for tasks where additional detail and comprehensiveness is important for the user's understanding.\n\n## Final answer structure and style guidelines\n\nYou are producing plain text that will later be styled by the CLI. Follow these rules exactly. Formatting should make results easy to scan, but not feel mechanical. Use judgment to decide how much structure adds value.\n\n**Section Headers**\n\n- Use only when they improve clarity \u2014 they are not mandatory for every answer.\n- Choose descriptive names that fit the content\n- Keep headers short (1\u20133 words) and in `**Title Case**`. Always start headers with `**` and end with `**`\n- Leave no blank line before the first bullet under a header.\n- Section headers should only be used where they genuinely improve scanability; avoid fragmenting the answer.\n\n**Bullets**\n\n- Use `-` followed by a space for every bullet.\n- Merge related points when possible; avoid a bullet for every trivial detail.\n- Keep bullets to one line unless breaking for clarity is unavoidable.\n- Group into short lists (4\u20136 bullets) ordered by importance.\n- Use consistent keyword phrasing and formatting across sections.\n\n**Monospace**\n\n- Wrap all commands, file paths, env vars, and code identifiers in backticks (`` `...` ``).\n- Apply to inline examples and to bullet keywords if the keyword itself is a literal file/command.\n- Never mix monospace and bold markers; choose one based on whether it's a keyword (`**`) or inline code/path (`` ` ``).\n\n**File References**\n\nWhen referencing files in your response, make sure to include the relevant start line and always follow the below rules:\n\n- Use inline code to make file paths clickable.\n- Each reference should have a stand alone path. Even if it's the same file.\n- Accepted: absolute, workspace\u2011relative, a/ or b/ diff prefixes, or bare filename/suffix.\n- Line/column (1\u2011based, optional): :line[:column] or #Lline[Ccolumn] (column defaults to 1).\n- Do not use URIs like file://, vscode://, or https://.\n- Do not provide range of lines\n- Examples: src/app.ts, src/app.ts:42, b/server/index.js#L10, C:\\repo\\project\\main.rs:12:5\n\n**Structure**\n\n- Place related bullets together; don't mix unrelated concepts in the same section.\n- Order sections from general \u2192 specific \u2192 supporting info.\n- For subsections (e.g., \"Binaries\" under \"Rust Workspace\"), introduce with a bolded keyword bullet, then list items under it.\n- Match structure to complexity:\n  - Multi-part or detailed results \u2192 use clear headers and grouped bullets.\n  - Simple results \u2192 minimal headers, possibly just a short list or paragraph.\n\n**Tone**\n\n- Keep the voice collaborative and natural, like a coding partner handing off work.\n- Be concise and factual \u2014 no filler or conversational commentary and avoid unnecessary repetition\n- Use present tense and active voice (e.g., \"Runs tests\" not \"This will run tests\").\n- Keep descriptions self-contained; don't refer to \"above\" or \"below\".\n- Use parallel structure in lists for consistency.\n\n**Don't**\n\n- Don't use literal words \"bold\" or \"monospace\" in the content.\n- Don't nest bullets or create deep hierarchies.\n- Don't output ANSI escape codes directly \u2014 the CLI renderer applies them.\n- Don't cram unrelated keywords into a single bullet; split for clarity.\n- Don't let keyword lists run long \u2014 wrap or reformat for scanability.\n\nGenerally, ensure your final answers adapt their shape and depth to the request. For example, answers to code explanations should have a precise, structured explanation with code references that answer the question directly. For tasks with a simple implementation, lead with the outcome and supplement only with what's needed for clarity. Larger changes can be presented as a logical walkthrough of your approach, grouping related steps, explaining rationale where it adds value, and highlighting next actions to accelerate the user. Your answers should provide the right level of detail while being easily scannable.\n\nFor casual greetings, acknowledgements, or other one-off conversational messages that are not delivering substantive information or structured results, respond naturally without section headers or bullet formatting.\n\n# Professional objectivity\n\nPrioritize technical accuracy and truthfulness over validating the user's beliefs. Focus on facts and problem-solving. Be direct and objective without unnecessary praise or emotional validation. Disagree when needed. When uncertain, investigate before confirming the user's assumptions.\n\n# Proactiveness\n\nYou may be proactive, but only when the user asks you to do something. Strike a balance between:\n\n1. Doing the right thing when asked, including follow-up actions\n2. Not surprising the user with unrequested actions\n   For example, if the user asks how to approach something, answer first; do not immediately jump into edits.\n\n# Following conventions\n\nWhen changing files, first understand the file's conventions. Mimic code style, use existing libraries and utilities, and follow existing patterns.\n\n- NEVER assume a library is available, even if it is well known. Whenever you write code that uses a library or framework, first check that this codebase already uses it (neighboring files, package.json, cargo.toml, go.mod, etc.).\n- When creating a new component, first look at existing components for framework choice, naming, typing, and other conventions.\n- When editing code, first look at surrounding context (especially imports) to understand chosen frameworks/libraries, then make the change idiomatically.\n- Always follow security best practices. Never introduce code that exposes or logs secrets and keys. Never commit secrets or keys to the repository.\n\n# Doing tasks\n\nThe user will primarily request software engineering tasks: bugs, features, refactors, explanations, and more. Recommended steps:\n\n- Use available search/read tools extensively to understand the codebase and the query (in parallel when independent).\n- Implement the solution with the tools available to you.\n- Prefer editing existing files over creating new ones. Do not create documentation or markdown files unless asked.\n- Verify when possible with tests. NEVER assume a specific test framework or script \u2014 check README / AGENTS.md or search the repo.\n- Run lint and typecheck commands (for example npm run lint, npm run typecheck, ruff, pnpm lint) if they were provided to you \u2014 see Validating your work for when to run them proactively vs. when to hold off. If you cannot find the correct command, ask the user, and if they supply it, proactively suggest writing it to AGENTS.md so you know next time.\n\n- Tool results and user messages may include <system-reminder> tags. Those tags contain useful reminders. They are NOT part of the user's provided input or the tool result.\n\n# Tool usage policy\n\n- Prefer specialized file tools over shell for reading, editing, writing, listing, and searching when those tools are available. Use the `grep`, `glob`, and `list` tools instead of bash for search and listing \u2014 they are ripgrep-backed and return structured, length-capped results. Use shell for real system commands (git, package managers, builds, tests, process control).\n- When doing broad codebase exploration, prefer a task/subagent tool if one is available to reduce context usage; otherwise use the available search tools.\n- You can call multiple tools in one response. When multiple independent pieces of information are needed, batch tool calls for performance. When making multiple bash tool calls, send a single message with multiple tool calls so they can run in parallel (for example git status and git diff together).\n- Match edit old-text exactly, including whitespace.\n- If a tool call is denied by policy, adapt: use an allowed approach or ask the user. Do not retry the same blocked call in a loop.\n\n## Shell commands\n\nWhen using the shell, you must adhere to the following guidelines:\n\n- When searching for text or files, prefer using `rg` or `rg --files` respectively because `rg` is much faster than alternatives like `grep` and `find`. (If the `rg` command is not found, then use alternatives.) Reach for the shell only when the `grep`/`glob` tools cannot express the query \u2014 for example counting matches, or piping results into another command.\n- Search narrow first: use `rg -l` or `rg -c` to find which files match, then read only those files. Do not dump full match bodies across a repo into context.\n- Never pipe a large file into your context. Do not `cat` a big file; use the `read` tool with an offset/limit, or `sed -n 'START,ENDp'` for a specific range.\n- Do not use python scripts to attempt to output larger chunks of a file.\n\n## `todowrite`\n\nA tool named `todowrite` is available to you. You can use it to keep an up-to-date, step-by-step plan for the task.\n\nTo create a new plan, call `todowrite` with a short list of 1-sentence steps (no more than 5-7 words each) with a `status` for each step (`pending`, `in_progress`, `completed`, or `cancelled`). The call is a full replace \u2014 always send the complete list, not a delta.\n\nWhen steps have been completed, use `todowrite` to mark each finished step as `completed` and the next step you are working on as `in_progress`. There should always be exactly one `in_progress` step until everything is done. You can mark multiple items as complete in a single `todowrite` call.\n\nIf all steps are complete, ensure you call `todowrite` to mark all steps as `completed`.\n\nIMPORTANT: Before you begin work, think about what the code you're editing is supposed to do based on the filenames and directory structure.\n\n# AGENTS.md spec\n\n- Repos often contain AGENTS.md files. These files can appear anywhere within the repository.\n- These files are a way for humans to give you (the agent) instructions or tips for working within the container.\n- Some examples might be: coding conventions, info about how code is organized, or instructions for how to run or test code.\n- Instructions in AGENTS.md files:\n  - The scope of an AGENTS.md file is the entire directory tree rooted at the folder that contains it.\n  - For every file you touch in the final change, you must obey instructions in any AGENTS.md file whose scope includes that file.\n  - Instructions about code style, structure, naming, etc. apply only to code within the AGENTS.md file's scope, unless the file states otherwise.\n  - More-deeply-nested AGENTS.md files take precedence in the case of conflicting instructions.\n  - Direct system/developer/user instructions (as part of a prompt) take precedence over AGENTS.md instructions.\n- The contents of the AGENTS.md file at the root of the repo and the project directory are loaded into your context automatically and don't need to be re-read. AGENTS.md files in subdirectories are NOT loaded automatically: when working in a subdirectory, or a directory outside the CWD, check for any AGENTS.md files that may be applicable.\n\n# Permissions and safety\n\n- Never commit secrets or keys.\n- Never create a git commit unless the user explicitly asks.\n- Do not run destructive commands (mass delete, force-push, hard reset) unless the user clearly requested them.\n";
@@ -41321,10 +41261,10 @@ var require_tar_stream = __commonJS({
 var init_dist = __esm({
   "../agent-core/dist/index.js"() {
     "use strict";
-    init_chunk_2KE6BVIX();
+    init_chunk_BVWCFGFG();
     init_chunk_OUQ7HMD3();
     init_chunk_R32NAS3B();
-    init_chunk_VZIZDY3T();
+    init_chunk_NDAB5G24();
     init_chunk_YXWJW7I5();
   }
 });
@@ -41416,7 +41356,7 @@ function within(root, path4) {
 }
 async function resolveReal(path4) {
   try {
-    return await (0, import_promises45.realpath)(path4);
+    return await (0, import_promises46.realpath)(path4);
   } catch {
     const parent = (0, import_path9.dirname)(path4);
     if (parent === path4) return path4;
@@ -41445,14 +41385,14 @@ function createWorkspaceFs(roots, writable) {
   return {
     read: async (params) => {
       const path4 = await confined(params);
-      const bytes = await (0, import_promises45.readFile)(path4);
+      const bytes = await (0, import_promises46.readFile)(path4);
       if (bytes.byteLength > MAX_READ_BYTES) throw new FsDenied(`${path4} is too large to read`);
       return { content: sliceLines(bytes.toString("utf8"), params) };
     },
     write: async (params) => {
       if (!writable) throw new FsDenied("This session is read-only");
       const path4 = await confined(params);
-      await (0, import_promises45.writeFile)(path4, asString(params.content));
+      await (0, import_promises46.writeFile)(path4, asString(params.content));
       return {};
     }
   };
@@ -41997,7 +41937,7 @@ function isAcpBackendKind(value2) {
   return Object.hasOwn(ACP_PROFILES, value2);
 }
 function envDigest3(env) {
-  const hash2 = (0, import_crypto11.createHash)("sha256");
+  const hash2 = (0, import_crypto12.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -42055,7 +41995,7 @@ async function acpTurnInput(run2, context) {
   const encoded = await Promise.all(
     images.map(async (image) => ({
       mimeType: image.mimeType,
-      data: (await (0, import_promises46.readFile)(image.path)).toString("base64")
+      data: (await (0, import_promises47.readFile)(image.path)).toString("base64")
     }))
   );
   return {
@@ -42064,23 +42004,23 @@ async function acpTurnInput(run2, context) {
     ...encoded.length ? { images: encoded, imagePaths: images.map((image) => image.path) } : {}
   };
 }
-var import_promises45, import_path9, import_crypto11, import_promises46, CURSOR_ASK_QUESTION, copilotAcpProfile, cursorAcpProfile, MODEL_REJECTED, MAX_READ_BYTES, FsDenied, ENV_REFERENCE, AcpBackgroundTasks, CURSOR_CREATE_PLAN, STATUSES, READ_KINDS, ALLOW_KINDS, REJECT_KINDS, CANCELLED_PERMISSION, STOP_REASONS, CHUNKS, ECHOES, AcpTurn, STDERR_TAIL_LINES4, MAX_BETWEEN_UPDATES2, AcpSession, DEFAULTS3, CLIENT_INFO2, TASK_BACKGROUNDED, TASK_COMPLETED, SESSION_NOTIFICATION, KILLED_STATUSES, SUCCESS_STATUSES, SUBAGENT_ID, grokTaskDialect, grokAcpProfile, kimiAcpProfile, ACP_PROFILES, ACP_MODES;
+var import_promises46, import_path9, import_crypto12, import_promises47, CURSOR_ASK_QUESTION, copilotAcpProfile, cursorAcpProfile, MODEL_REJECTED, MAX_READ_BYTES, FsDenied, ENV_REFERENCE, AcpBackgroundTasks, CURSOR_CREATE_PLAN, STATUSES, READ_KINDS, ALLOW_KINDS, REJECT_KINDS, CANCELLED_PERMISSION, STOP_REASONS, CHUNKS, ECHOES, AcpTurn, STDERR_TAIL_LINES4, MAX_BETWEEN_UPDATES2, AcpSession, DEFAULTS3, CLIENT_INFO2, TASK_BACKGROUNDED, TASK_COMPLETED, SESSION_NOTIFICATION, KILLED_STATUSES, SUCCESS_STATUSES, SUBAGENT_ID, grokTaskDialect, grokAcpProfile, kimiAcpProfile, ACP_PROFILES, ACP_MODES;
 var init_acp3 = __esm({
   "../agent-core/dist/providers/acp.js"() {
     "use strict";
-    init_chunk_2KE6BVIX();
+    init_chunk_BVWCFGFG();
     init_chunk_OUQ7HMD3();
     init_chunk_R32NAS3B();
     init_chunk_J2KTV5FP();
-    init_chunk_VZIZDY3T();
-    init_chunk_NADPTUUJ();
+    init_chunk_NDAB5G24();
+    init_chunk_GXBS4QWA();
     init_chunk_YXWJW7I5();
-    import_promises45 = require("fs/promises");
+    import_promises46 = require("fs/promises");
     import_path9 = require("path");
     init_effort();
     init_acp();
-    import_crypto11 = require("crypto");
-    import_promises46 = require("fs/promises");
+    import_crypto12 = require("crypto");
+    import_promises47 = require("fs/promises");
     init_agent2();
     CURSOR_ASK_QUESTION = "cursor/ask_question";
     copilotAcpProfile = {
@@ -43604,7 +43544,7 @@ function createOpenCodeDriver(options = {}) {
         await authorization?.remove();
       };
       const spec = { ...planned, env: launchEnv(planned, authorization) };
-      const password = options.password?.() ?? (0, import_crypto12.randomBytes)(24).toString("base64url");
+      const password = options.password?.() ?? (0, import_crypto13.randomBytes)(24).toString("base64url");
       const attempt2 = { abandoned: false };
       const { session, url: url3 } = await withDeadline3(
         startServer(spec, password, resolved, attempt2),
@@ -43648,7 +43588,7 @@ function createOpenCodeDriver(options = {}) {
   };
 }
 function envDigest4(env) {
-  const hash2 = (0, import_crypto13.createHash)("sha256");
+  const hash2 = (0, import_crypto14.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -43728,25 +43668,25 @@ function openCodeTurnInput(run2, context) {
     ...images.length ? { imagePaths: images.map((image) => image.path) } : {}
   };
 }
-var import_http10, import_crypto12, import_path10, import_url2, import_crypto13, IDLE_SOCKET_MS3, OpenCodeHttpError, OpenCodeClient, OPENCODE_CONFIG_ENV, OPENCODE_ENGINE, TEXT_PARTS, STEP_PARTS, STOPPED_BY_USER, OpenCodeSubagents, NAMED_KINDS, OPENCODE_ABORTED_ERROR, PROVIDER_EVENT_META, TASK_TOOL_NAME, TASK_RESULT_TAG, TASK_ERROR_TAG, PERMISSION_DENIED, FILE_OPERATIONS2, PartReader, NOTHING, NON_INTERACTIVE_PERMISSIONS, CONTENT_FILTER_FINISHES, OUTPUT_PARTS, OpenCodeTurn, LISTENING, OUTPUT_TAIL_LINES, IMAGE_TYPES, OpenCodeSession, OPENCODE_MIN_VERSION, OPENCODE_REQUIREMENT, OPENCODE_TESTED_LINE, OPENCODE_SUPPORTED_MAJOR, DEFAULTS4, STORE_LOCKED, NON_INTERACTIVE_RULES, TITLE_LENGTH, MAX_VARIANT_LENGTH;
+var import_http10, import_crypto13, import_path10, import_url2, import_crypto14, IDLE_SOCKET_MS3, OpenCodeHttpError, OpenCodeClient, OPENCODE_CONFIG_ENV, OPENCODE_ENGINE, TEXT_PARTS, STEP_PARTS, STOPPED_BY_USER, OpenCodeSubagents, NAMED_KINDS, OPENCODE_ABORTED_ERROR, PROVIDER_EVENT_META, TASK_TOOL_NAME, TASK_RESULT_TAG, TASK_ERROR_TAG, PERMISSION_DENIED, FILE_OPERATIONS2, PartReader, NOTHING, NON_INTERACTIVE_PERMISSIONS, CONTENT_FILTER_FINISHES, OUTPUT_PARTS, OpenCodeTurn, LISTENING, OUTPUT_TAIL_LINES, IMAGE_TYPES, OpenCodeSession, OPENCODE_MIN_VERSION, OPENCODE_REQUIREMENT, OPENCODE_TESTED_LINE, OPENCODE_SUPPORTED_MAJOR, DEFAULTS4, STORE_LOCKED, NON_INTERACTIVE_RULES, TITLE_LENGTH, MAX_VARIANT_LENGTH;
 var init_opencode = __esm({
   "../agent-core/dist/providers/opencode.js"() {
     "use strict";
-    init_chunk_2KE6BVIX();
+    init_chunk_BVWCFGFG();
     init_chunk_OUQ7HMD3();
     init_chunk_R32NAS3B();
     init_chunk_J2KTV5FP();
-    init_chunk_VZIZDY3T();
-    init_chunk_NADPTUUJ();
+    init_chunk_NDAB5G24();
+    init_chunk_GXBS4QWA();
     init_chunk_YXWJW7I5();
     import_http10 = require("http");
     init_runtime_v2();
-    import_crypto12 = require("crypto");
+    import_crypto13 = require("crypto");
     init_agent2();
     import_path10 = require("path");
     import_url2 = require("url");
     init_acp();
-    import_crypto13 = require("crypto");
+    import_crypto14 = require("crypto");
     init_agent2();
     IDLE_SOCKET_MS3 = 4e3;
     OpenCodeHttpError = class extends Error {
@@ -45427,7 +45367,7 @@ function createDroidDriver(options = {}) {
   };
 }
 function envDigest5(env) {
-  const hash2 = (0, import_crypto14.createHash)("sha256");
+  const hash2 = (0, import_crypto15.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -45482,25 +45422,25 @@ async function droidTurnInput(run2, context) {
   const encoded = await Promise.all(
     images.map(async (image) => ({
       mimeType: image.mimeType,
-      data: (await (0, import_promises47.readFile)(image.path)).toString("base64")
+      data: (await (0, import_promises48.readFile)(image.path)).toString("base64")
     }))
   );
   return { turnId: run2.runId, text: text2, ...encoded.length ? { images: encoded } : {} };
 }
-var import_crypto14, import_promises47, FACTORY_API_VERSION, FACTORY_PROTOCOL_VERSION, SUBAGENT_TOOLS, TASK_OUTPUT_TOOLS, TASK_STOP_TOOLS, SILENT2, DroidTurn, STDERR_TAIL_LINES5, UNSUPPORTED_REQUEST2, DroidSession, DEFAULTS5, DROID_REQUIREMENT, DROID_JSONRPC_ARGS;
+var import_crypto15, import_promises48, FACTORY_API_VERSION, FACTORY_PROTOCOL_VERSION, SUBAGENT_TOOLS, TASK_OUTPUT_TOOLS, TASK_STOP_TOOLS, SILENT2, DroidTurn, STDERR_TAIL_LINES5, UNSUPPORTED_REQUEST2, DroidSession, DEFAULTS5, DROID_REQUIREMENT, DROID_JSONRPC_ARGS;
 var init_droid = __esm({
   "../agent-core/dist/providers/droid.js"() {
     "use strict";
-    init_chunk_2KE6BVIX();
+    init_chunk_BVWCFGFG();
     init_chunk_OUQ7HMD3();
     init_chunk_R32NAS3B();
     init_chunk_J2KTV5FP();
-    init_chunk_VZIZDY3T();
-    init_chunk_NADPTUUJ();
+    init_chunk_NDAB5G24();
+    init_chunk_GXBS4QWA();
     init_chunk_YXWJW7I5();
     init_runtime_v2();
-    import_crypto14 = require("crypto");
-    import_promises47 = require("fs/promises");
+    import_crypto15 = require("crypto");
+    import_promises48 = require("fs/promises");
     init_agent2();
     FACTORY_API_VERSION = "1.0.0";
     FACTORY_PROTOCOL_VERSION = "1.187.0";
@@ -46005,7 +45945,7 @@ function antigravityArgs(input2, capabilities, prompt) {
 }
 function workspaceRoot(cwd) {
   for (let current = (0, import_path11.resolve)(cwd); ; current = (0, import_path11.dirname)(current)) {
-    if ((0, import_fs7.existsSync)((0, import_path11.join)(current, ".git"))) return current;
+    if ((0, import_fs8.existsSync)((0, import_path11.join)(current, ".git"))) return current;
     if ((0, import_path11.dirname)(current) === current) return (0, import_path11.resolve)(cwd);
   }
 }
@@ -46015,7 +45955,7 @@ function instructionPaths(cwd) {
   for (let current = (0, import_path11.resolve)(cwd); ; current = (0, import_path11.dirname)(current)) {
     const path4 = (0, import_path11.join)(current, INSTRUCTIONS_FILE);
     try {
-      if ((0, import_fs7.existsSync)(path4) && (0, import_fs7.statSync)(path4).isFile()) paths.unshift(path4);
+      if ((0, import_fs8.existsSync)(path4) && (0, import_fs8.statSync)(path4).isFile()) paths.unshift(path4);
     } catch {
     }
     if (current === root || (0, import_path11.dirname)(current) === current) return paths;
@@ -46029,7 +45969,7 @@ function antigravityWorkspaceInstructions(cwd, maxChars = MAX_INSTRUCTION_CHARS)
     if (remaining <= 0) break;
     let content;
     try {
-      content = (0, import_fs7.readFileSync)(path4, "utf8").trim();
+      content = (0, import_fs8.readFileSync)(path4, "utf8").trim();
     } catch {
       continue;
     }
@@ -46510,7 +46450,7 @@ ${output2.stderr}`).join("\n")
   };
 }
 function envDigest6(env) {
-  const hash2 = (0, import_crypto15.createHash)("sha256");
+  const hash2 = (0, import_crypto16.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -46556,23 +46496,23 @@ function antigravityTurnInput(run2, context) {
   });
   return { turnId: run2.runId, text: appendImagePathReferences(text2, images) };
 }
-var import_fs7, import_path11, import_path12, import_url3, import_crypto15, NO_ANTIGRAVITY_CAPABILITIES, INSTRUCTIONS_FILE, MAX_INSTRUCTION_CHARS, SHORTENED_NOTE, DIFF_BLOCK_START, DIFF_BLOCK_END, HUNK_HEADER, TRANSCRIPT_FILE, FULL_TRANSCRIPT_FILE, LOG_DIRS, TOOL_RESULT_TYPES, BrainTranscript, AntigravityTranscripts, ANTIGRAVITY_GRAMMAR_NAME, AntigravityGrammar, ignored, HANDLERS, SUCCESSFUL_STATUSES, SESSION_START_TYPES, RESULT_TYPES, SUBAGENT_START_TYPES, RESUME_FORKED, AntigravityTurn, DEFAULTS6, AntigravitySession, WINDOWS_LINE_MARGIN;
+var import_fs8, import_path11, import_path12, import_url3, import_crypto16, NO_ANTIGRAVITY_CAPABILITIES, INSTRUCTIONS_FILE, MAX_INSTRUCTION_CHARS, SHORTENED_NOTE, DIFF_BLOCK_START, DIFF_BLOCK_END, HUNK_HEADER, TRANSCRIPT_FILE, FULL_TRANSCRIPT_FILE, LOG_DIRS, TOOL_RESULT_TYPES, BrainTranscript, AntigravityTranscripts, ANTIGRAVITY_GRAMMAR_NAME, AntigravityGrammar, ignored, HANDLERS, SUCCESSFUL_STATUSES, SESSION_START_TYPES, RESULT_TYPES, SUBAGENT_START_TYPES, RESUME_FORKED, AntigravityTurn, DEFAULTS6, AntigravitySession, WINDOWS_LINE_MARGIN;
 var init_antigravity = __esm({
   "../agent-core/dist/providers/antigravity.js"() {
     "use strict";
     init_chunk_LR52JUGL();
-    init_chunk_2KE6BVIX();
+    init_chunk_BVWCFGFG();
     init_chunk_OUQ7HMD3();
     init_chunk_R32NAS3B();
-    init_chunk_VZIZDY3T();
-    init_chunk_NADPTUUJ();
+    init_chunk_NDAB5G24();
+    init_chunk_GXBS4QWA();
     init_chunk_YXWJW7I5();
-    import_fs7 = require("fs");
+    import_fs8 = require("fs");
     import_path11 = require("path");
     init_effort();
     import_path12 = require("path");
     import_url3 = require("url");
-    import_crypto15 = require("crypto");
+    import_crypto16 = require("crypto");
     init_agent2();
     NO_ANTIGRAVITY_CAPABILITIES = {
       structuredPrint: false,
@@ -47058,7 +46998,7 @@ function parseConfig(raw) {
 }
 async function writeCommandCodeProjectMcp(cwd, mcp) {
   const path4 = (0, import_path13.join)(cwd, ".mcp.json");
-  const original = await (0, import_promises48.readFile)(path4, "utf8").catch(() => null);
+  const original = await (0, import_promises49.readFile)(path4, "utf8").catch(() => null);
   const config2 = parseConfig(original);
   const next = {
     ...config2,
@@ -47075,12 +47015,12 @@ async function writeCommandCodeProjectMcp(cwd, mcp) {
       }
     }
   };
-  await (0, import_promises48.mkdir)(cwd, { recursive: true });
-  await (0, import_promises48.writeFile)(path4, `${JSON.stringify(next, null, 2)}
+  await (0, import_promises49.mkdir)(cwd, { recursive: true });
+  await (0, import_promises49.writeFile)(path4, `${JSON.stringify(next, null, 2)}
 `);
   return async () => {
-    if (original === null) await (0, import_promises48.rm)(path4, { force: true });
-    else await (0, import_promises48.writeFile)(path4, original);
+    if (original === null) await (0, import_promises49.rm)(path4, { force: true });
+    else await (0, import_promises49.writeFile)(path4, original);
   };
 }
 function commandCodeString(value2) {
@@ -47189,7 +47129,7 @@ function createCommandCodeDriver(options = {}) {
   };
 }
 function envDigest7(env) {
-  const hash2 = (0, import_crypto16.createHash)("sha256");
+  const hash2 = (0, import_crypto17.createHash)("sha256");
   for (const key of Object.keys(env).sort()) hash2.update(`${key}\0${env[key]}\0`);
   return hash2.digest("hex");
 }
@@ -47241,22 +47181,22 @@ function commandCodeTurnInput(run2, context) {
   });
   return { turnId: run2.runId, text: appendImagePathReferences(text2, images) };
 }
-var import_promises48, import_path13, import_crypto16, COMMAND_CODE_GRAMMAR_NAME, SILENT3, CommandCodeGrammar, CommandCodeTurn, COMMAND_CODE_MAX_TURNS, DEFAULTS7, CommandCodeSession;
+var import_promises49, import_path13, import_crypto17, COMMAND_CODE_GRAMMAR_NAME, SILENT3, CommandCodeGrammar, CommandCodeTurn, COMMAND_CODE_MAX_TURNS, DEFAULTS7, CommandCodeSession;
 var init_command_code = __esm({
   "../agent-core/dist/providers/command-code.js"() {
     "use strict";
-    init_chunk_2KE6BVIX();
+    init_chunk_BVWCFGFG();
     init_chunk_OUQ7HMD3();
     init_chunk_R32NAS3B();
     init_chunk_J2KTV5FP();
-    init_chunk_VZIZDY3T();
-    init_chunk_NADPTUUJ();
+    init_chunk_NDAB5G24();
+    init_chunk_GXBS4QWA();
     init_chunk_YXWJW7I5();
-    import_promises48 = require("fs/promises");
+    import_promises49 = require("fs/promises");
     import_path13 = require("path");
     init_agent2();
     init_runtime_v2();
-    import_crypto16 = require("crypto");
+    import_crypto17 = require("crypto");
     init_agent2();
     COMMAND_CODE_GRAMMAR_NAME = "command_code_cli";
     SILENT3 = /* @__PURE__ */ new Set([
@@ -52445,7 +52385,7 @@ var require_websocket_server = __commonJS({
 // package.json
 var package_default = {
   name: "@alan-ai-hq/agent-manager",
-  version: "0.1.128",
+  version: "0.1.130",
   private: true,
   type: "module",
   description: "Alan machine runtime (alan-agent): identity, link, reconciler, session holders, run log, uploader, local API",
@@ -52492,7 +52432,7 @@ var package_default = {
 
 // src/cli/commands/compat.ts
 var import_node_crypto25 = require("crypto");
-var import_promises58 = require("fs/promises");
+var import_promises59 = require("fs/promises");
 init_runtime_v2();
 init_zod();
 
@@ -54507,7 +54447,7 @@ async function push(context, request2) {
 var import_node_child_process = require("child_process");
 
 // ../agent-core/dist/process.js
-init_chunk_VZIZDY3T();
+init_chunk_NDAB5G24();
 init_chunk_YXWJW7I5();
 
 // src/capabilities/git/run-git.ts
@@ -54793,7 +54733,7 @@ var import_node_net = require("net");
 
 // src/platform/credential-store/credential-store.ts
 var import_node_crypto4 = require("crypto");
-var import_promises10 = require("fs/promises");
+var import_promises11 = require("fs/promises");
 
 // src/platform/credential-store/parse.ts
 function parseStoredJson(text2, schema) {
@@ -54942,7 +54882,7 @@ function createFileCredentialStore(path4) {
     kind: "file",
     read: (schema) => readJsonFile(path4, schema),
     write: (value2) => writeJsonFileAtomic(path4, value2),
-    clear: () => (0, import_promises10.rm)(path4, { force: true })
+    clear: () => (0, import_promises11.rm)(path4, { force: true })
   };
 }
 var KEYCHAIN_SERVICE = "ai.tryalan.runtime";
@@ -55037,14 +54977,14 @@ function defaultCredentialStoreKind(platform3) {
 var import_node_child_process3 = require("child_process");
 var import_node_crypto5 = require("crypto");
 var import_node_fs3 = require("fs");
-var import_promises12 = require("fs/promises");
+var import_promises13 = require("fs/promises");
 var import_node_path7 = require("path");
 var import_node_util2 = require("util");
 init_zod();
 
 // src/platform/process-identity.ts
 var import_node_child_process2 = require("child_process");
-var import_promises11 = require("fs/promises");
+var import_promises12 = require("fs/promises");
 var import_node_util = require("util");
 var execFileAsync = (0, import_node_util.promisify)(import_node_child_process2.execFile);
 function isProcessAlive(pid) {
@@ -55056,13 +54996,13 @@ function isProcessAlive(pid) {
   }
 }
 async function linuxStartTime(pid) {
-  const stat19 = await (0, import_promises11.readFile)(`/proc/${pid}/stat`, "utf8").catch(() => null);
+  const stat19 = await (0, import_promises12.readFile)(`/proc/${pid}/stat`, "utf8").catch(() => null);
   if (stat19 === null) return null;
   const fields = stat19.slice(stat19.lastIndexOf(")") + 2).split(" ");
   return fields[19] ?? null;
 }
 async function linuxCommand(pid) {
-  const raw = await (0, import_promises11.readFile)(`/proc/${pid}/cmdline`, "utf8").catch(() => null);
+  const raw = await (0, import_promises12.readFile)(`/proc/${pid}/cmdline`, "utf8").catch(() => null);
   return raw === null ? null : normalizeCommand(raw.replaceAll("\0", " "));
 }
 async function darwinCommand(pid) {
@@ -55252,23 +55192,23 @@ async function reportedVersion(versionDir) {
   return stdout.trim();
 }
 async function switchLauncher(layout, version2) {
-  await (0, import_promises12.mkdir)(layout.bin, { recursive: true, mode: 448 });
+  await (0, import_promises13.mkdir)(layout.bin, { recursive: true, mode: 448 });
   const staged = (0, import_node_path7.join)(layout.bin, `.${(0, import_node_path7.basename)(layout.launcher)}.${(0, import_node_crypto5.randomUUID)()}`);
   if (process.platform === "win32") {
     (0, import_node_fs3.writeFileSync)(staged, `@"%~dp0..\\versions\\${version2}\\alan-agent.cmd" %*\r
 `);
   } else {
-    await (0, import_promises12.symlink)((0, import_node_path7.join)("..", "versions", version2, "alan-agent"), staged);
+    await (0, import_promises13.symlink)((0, import_node_path7.join)("..", "versions", version2, "alan-agent"), staged);
   }
-  await (0, import_promises12.rename)(staged, layout.launcher);
+  await (0, import_promises13.rename)(staged, layout.launcher);
 }
 async function launcherVersion(launcher) {
   try {
     if (process.platform === "win32") {
-      const match = /versions\\([^\\]+)\\/.exec(await (0, import_promises12.readFile)(launcher, "utf8"));
+      const match = /versions\\([^\\]+)\\/.exec(await (0, import_promises13.readFile)(launcher, "utf8"));
       return match?.[1] ?? null;
     }
-    return (0, import_node_path7.basename)((0, import_node_path7.dirname)(await (0, import_promises12.readlink)(launcher)));
+    return (0, import_node_path7.basename)((0, import_node_path7.dirname)(await (0, import_promises13.readlink)(launcher)));
   } catch (error61) {
     if (errnoCode(error61) === "ENOENT") return null;
     throw error61;
@@ -55279,7 +55219,7 @@ function currentVersion(layout) {
 }
 async function launcherVersions(layout) {
   const versions = [];
-  for (const name of await (0, import_promises12.readdir)(layout.bin).catch(() => [])) {
+  for (const name of await (0, import_promises13.readdir)(layout.bin).catch(() => [])) {
     if (!name.startsWith(LAUNCHER_STEM)) continue;
     const version2 = await launcherVersion((0, import_node_path7.join)(layout.bin, name)).catch(() => null);
     if (version2 !== null) versions.push(version2);
@@ -55311,7 +55251,7 @@ function assertUsableVersion(version2) {
   }
 }
 async function exists(path4) {
-  return (0, import_promises12.stat)(path4).then(
+  return (0, import_promises13.stat)(path4).then(
     () => true,
     () => false
   );
@@ -55322,7 +55262,7 @@ function isVersionInstalled(layout, version2) {
 async function stageVersion(layout, sourceDir, expectedVersion) {
   var _stack = [];
   try {
-    await (0, import_promises12.mkdir)(layout.versions, { recursive: true, mode: 448 });
+    await (0, import_promises13.mkdir)(layout.versions, { recursive: true, mode: 448 });
     const _lock = __using(_stack, takeInstallLock(layout.lock));
     const version2 = await readPackageVersion(sourceDir);
     if (expectedVersion !== void 0 && version2 !== expectedVersion) {
@@ -55335,17 +55275,17 @@ async function stageVersion(layout, sourceDir, expectedVersion) {
     const target = (0, import_node_path7.join)(layout.versions, version2);
     if (await exists(target)) return version2;
     const staging = (0, import_node_path7.join)(layout.versions, `.${version2}`);
-    await (0, import_promises12.rm)(staging, { recursive: true, force: true });
+    await (0, import_promises13.rm)(staging, { recursive: true, force: true });
     try {
-      await (0, import_promises12.cp)(sourceDir, staging, { recursive: true });
+      await (0, import_promises13.cp)(sourceDir, staging, { recursive: true });
       if (await reportedVersion(staging) !== version2) {
         throw new RuntimeFault("invalid_file", `Staged runtime ${version2} does not start`);
       }
     } catch (error61) {
-      await (0, import_promises12.rm)(staging, { recursive: true, force: true });
+      await (0, import_promises13.rm)(staging, { recursive: true, force: true });
       throw error61;
     }
-    await (0, import_promises12.rename)(staging, target);
+    await (0, import_promises13.rename)(staging, target);
     return version2;
   } catch (_) {
     var _error = _, _hasError = true;
@@ -55362,19 +55302,19 @@ async function installVersion(layout, sourceDir) {
 async function hasLiveMarker(versionDir) {
   const markers = (0, import_node_path7.join)(versionDir, ".running");
   let live = false;
-  for (const name of await (0, import_promises12.readdir)(markers).catch(() => [])) {
+  for (const name of await (0, import_promises13.readdir)(markers).catch(() => [])) {
     if (isProcessAlive(Number(name))) live = true;
-    else await (0, import_promises12.rm)((0, import_node_path7.join)(markers, name), { force: true });
+    else await (0, import_promises13.rm)((0, import_node_path7.join)(markers, name), { force: true });
   }
   return live;
 }
 async function collectOldVersions(layout) {
-  const entries = await (0, import_promises12.readdir)(layout.versions, { withFileTypes: true }).catch(() => []);
+  const entries = await (0, import_promises13.readdir)(layout.versions, { withFileTypes: true }).catch(() => []);
   const versions = await Promise.all(
     entries.filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map(async (entry) => ({
       name: entry.name,
       // The launcher, not the directory: `.running` markers touch the directory's mtime.
-      installedAtMs: (await (0, import_promises12.stat)(launcherIn((0, import_node_path7.join)(layout.versions, entry.name)))).mtimeMs
+      installedAtMs: (await (0, import_promises13.stat)(launcherIn((0, import_node_path7.join)(layout.versions, entry.name)))).mtimeMs
     }))
   );
   const keep = new Set(
@@ -55385,7 +55325,7 @@ async function collectOldVersions(layout) {
   for (const { name } of versions) {
     const dir = (0, import_node_path7.join)(layout.versions, name);
     if (keep.has(name) || await hasLiveMarker(dir)) continue;
-    await (0, import_promises12.rm)(dir, { recursive: true, force: true });
+    await (0, import_promises13.rm)(dir, { recursive: true, force: true });
     removed.push(name);
   }
   return removed;
@@ -55409,7 +55349,7 @@ function markVersionInUse(bundlePath) {
 
 // src/platform/instance-lock.ts
 var import_node_fs4 = require("fs");
-var import_promises13 = require("fs/promises");
+var import_promises14 = require("fs/promises");
 var import_node_path8 = require("path");
 init_zod();
 var LOCK_POLL_MS = 100;
@@ -55466,7 +55406,7 @@ async function attempt(path4, self, probe) {
   return tryCreate(path4, self) ? { kind: "acquired" } : attempt(path4, self, probe);
 }
 async function acquireInstanceLock(path4, { clock, waitMs, signal, probe = systemProcessProbe }) {
-  await (0, import_promises13.mkdir)((0, import_node_path8.dirname)(path4), { recursive: true, mode: 448 });
+  await (0, import_promises14.mkdir)((0, import_node_path8.dirname)(path4), { recursive: true, mode: 448 });
   const self = await readProcessIdentity(process.pid);
   if (self === null) throw new RuntimeFault("internal", "Cannot read this process's identity");
   const deadline = clock.monotonic() + waitMs;
@@ -55497,13 +55437,15 @@ var import_node_os = require("os");
 var import_node_path9 = require("path");
 var MAX_SOCKET_PATH_BYTES = 100;
 function windowsPipeName(socketsDir, id) {
-  const scope = (0, import_node_crypto6.createHash)("sha256").update(socketsDir.toLowerCase()).digest("hex").slice(0, 12);
-  return `\\\\.\\pipe\\alan-${scope}-${id}`;
+  return `\\\\.\\pipe\\alan-${socketsScope(socketsDir)}-${id}`;
+}
+function socketsScope(socketsDir) {
+  return (0, import_node_crypto6.createHash)("sha256").update(socketsDir.toLowerCase()).digest("hex").slice(0, 12);
 }
 function ipcEndpoint(socketsDir, id, platform3 = process.platform) {
   if (platform3 === "win32") return windowsPipeName(socketsDir, id);
   const preferred = (0, import_node_path9.join)(socketsDir, `${id}.sock`);
-  const dir = Buffer.byteLength(preferred) <= MAX_SOCKET_PATH_BYTES ? socketsDir : (0, import_node_path9.join)("/tmp", `alan-${(0, import_node_os.userInfo)().uid}`);
+  const dir = Buffer.byteLength(preferred) <= MAX_SOCKET_PATH_BYTES ? socketsDir : (0, import_node_path9.join)("/tmp", `alan-${(0, import_node_os.userInfo)().uid}-${socketsScope(socketsDir)}`);
   (0, import_node_fs5.mkdirSync)(dir, { recursive: true, mode: 448 });
   return (0, import_node_path9.join)(dir, `${id}.sock`);
 }
@@ -55620,13 +55562,13 @@ function runtimePaths(stateDir) {
 
 // src/platform/process-memory.ts
 var import_node_child_process4 = require("child_process");
-var import_promises14 = require("fs/promises");
+var import_promises15 = require("fs/promises");
 var import_node_util3 = require("util");
 var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process4.execFile);
 var PROBE_TIMEOUT_MS = 2e3;
 async function readProcessRss(pid) {
   if (process.platform === "linux") {
-    const status = await (0, import_promises14.readFile)(`/proc/${pid}/status`, "utf8").catch(() => null);
+    const status = await (0, import_promises15.readFile)(`/proc/${pid}/status`, "utf8").catch(() => null);
     const kilobytes = status === null ? void 0 : /^VmRSS:\s+(\d+)\s+kB$/m.exec(status)?.[1];
     return kilobytes === void 0 ? null : Number(kilobytes) * 1024;
   }
@@ -55658,7 +55600,7 @@ async function darwinPressure() {
 var PSI_WARN_SOME_AVG10 = 20;
 var PSI_CRITICAL_FULL_AVG10 = 10;
 async function linuxPressure() {
-  const psi = await (0, import_promises14.readFile)("/proc/pressure/memory", "utf8").catch(() => null);
+  const psi = await (0, import_promises15.readFile)("/proc/pressure/memory", "utf8").catch(() => null);
   if (psi === null) return "normal";
   const avg10 = (kind) => Number(new RegExp(`^${kind} avg10=([\\d.]+)`, "m").exec(psi)?.[1] ?? 0);
   if (avg10("full") >= PSI_CRITICAL_FULL_AVG10) return "critical";
@@ -55745,7 +55687,7 @@ function planUpdate(input2) {
 // src/platform/release-apply.ts
 var import_node_child_process5 = require("child_process");
 var import_node_crypto9 = require("crypto");
-var import_promises15 = require("fs/promises");
+var import_promises16 = require("fs/promises");
 var import_node_path11 = require("path");
 var import_node_util4 = require("util");
 init_zod();
@@ -55769,7 +55711,7 @@ function npmReleaseFrom(bytes, request2) {
   return resolved.release;
 }
 async function extractPackageTarball(tarballPath, destination) {
-  await (0, import_promises15.mkdir)(destination, { recursive: true, mode: 448 });
+  await (0, import_promises16.mkdir)(destination, { recursive: true, mode: 448 });
   await execFileAsync4("tar", ["-xzf", tarballPath, "-C", destination]);
   return (0, import_node_path11.join)(destination, "package");
 }
@@ -55782,14 +55724,14 @@ async function stageNpmTarball({
   const integrity = verifyNpmIntegrity(tarball, release2.dist);
   if (!integrity.ok) throw new RuntimeFault("invalid_file", integrity.reason);
   const scratch = (0, import_node_path11.join)(tmpDir, (0, import_node_crypto9.randomUUID)());
-  await (0, import_promises15.mkdir)(scratch, { recursive: true, mode: 448 });
+  await (0, import_promises16.mkdir)(scratch, { recursive: true, mode: 448 });
   try {
     const tarballPath = (0, import_node_path11.join)(scratch, "package.tgz");
-    await (0, import_promises15.writeFile)(tarballPath, tarball, { mode: 384 });
+    await (0, import_promises16.writeFile)(tarballPath, tarball, { mode: 384 });
     const packageDir = await extractPackageTarball(tarballPath, (0, import_node_path11.join)(scratch, "unpacked"));
     return await stageVersion(layout, packageDir, release2.version);
   } finally {
-    await (0, import_promises15.rm)(scratch, { recursive: true, force: true });
+    await (0, import_promises16.rm)(scratch, { recursive: true, force: true });
   }
 }
 var pendingUpgradeSchema = external_exports.object({
@@ -55814,7 +55756,7 @@ async function recordPendingUpgrade(layout, from, to, now) {
   await writeJsonFileAtomic(layout.pendingUpgrade, { from, to, startedAt: now, starts: 0 });
 }
 async function clearPendingUpgrade(layout) {
-  await (0, import_promises15.rm)(layout.pendingUpgrade, { force: true });
+  await (0, import_promises16.rm)(layout.pendingUpgrade, { force: true });
 }
 async function rollBackUpgrade(layout, pending, now) {
   const installed = await currentVersion(layout);
@@ -55846,7 +55788,7 @@ async function settlePendingUpgrade(layout, runningVersion, now) {
 }
 
 // src/platform/runtime-host.ts
-var import_promises16 = require("fs/promises");
+var import_promises17 = require("fs/promises");
 var RUNTIME_HOST_KINDS = ["app", "standalone"];
 var APP_HOST_ENVIRONMENT = {
   ELECTRON_RUN_AS_NODE: "1"
@@ -55884,7 +55826,7 @@ function serviceCommand(kind, proc, launcher) {
 }
 async function fileStamp(path4) {
   try {
-    const stats = await (0, import_promises16.stat)(path4);
+    const stats = await (0, import_promises17.stat)(path4);
     return `${stats.dev}:${stats.ino}:${stats.size}:${stats.mtimeMs}`;
   } catch {
     return null;
@@ -56078,11 +56020,11 @@ var systemExec = (request2) => new Promise((resolve10) => {
 });
 
 // src/platform/service/legacy.ts
-var import_promises18 = require("fs/promises");
+var import_promises19 = require("fs/promises");
 var import_node_path15 = require("path");
 
 // src/platform/service/windows-service.ts
-var import_promises17 = require("fs/promises");
+var import_promises18 = require("fs/promises");
 var import_node_path14 = require("path");
 
 // src/platform/service/runtime-process.ts
@@ -56290,7 +56232,7 @@ async function readUserSid(exec) {
 }
 async function readBytes(path4) {
   try {
-    return await (0, import_promises17.readFile)(path4);
+    return await (0, import_promises18.readFile)(path4);
   } catch (error61) {
     if (errnoCode(error61) === "ENOENT") return null;
     throw error61;
@@ -56298,8 +56240,8 @@ async function readBytes(path4) {
 }
 async function writeIfChanged(path4, contents) {
   if ((await readBytes(path4))?.equals(contents) === true) return false;
-  await (0, import_promises17.mkdir)((0, import_node_path14.dirname)(path4), { recursive: true });
-  await (0, import_promises17.writeFile)(path4, contents);
+  await (0, import_promises18.mkdir)((0, import_node_path14.dirname)(path4), { recursive: true });
+  await (0, import_promises18.writeFile)(path4, contents);
   return true;
 }
 async function run(exec, request2) {
@@ -56381,7 +56323,7 @@ function windowsManager(host, profile) {
     name: files.runValue,
     definitionPath: files.script,
     install: async (spec, { restart }) => {
-      await (0, import_promises17.mkdir)((0, import_node_path14.dirname)(spec.logPath), { recursive: true });
+      await (0, import_promises18.mkdir)((0, import_node_path14.dirname)(spec.logPath), { recursive: true });
       const script = renderWindowsSupervisorScript(spec, files);
       const xml2 = renderWindowsTaskXml({ spec, files, userSid: await userSid() });
       const scriptChanged = await writeIfChanged(
@@ -56422,7 +56364,7 @@ function windowsManager(host, profile) {
       const defined = await readBytes(files.script) !== null;
       await Promise.all(
         [files.script, files.taskXml, files.supervisorRecord].map(
-          (path4) => (0, import_promises17.rm)(path4, { force: true })
+          (path4) => (0, import_promises18.rm)(path4, { force: true })
         )
       );
       return {
@@ -56474,7 +56416,7 @@ function legacyServiceNames(profile) {
   };
 }
 async function exists2(path4) {
-  return (0, import_promises18.stat)(path4).then(
+  return (0, import_promises19.stat)(path4).then(
     () => true,
     () => false
   );
@@ -56485,7 +56427,7 @@ async function removeLaunchd(host, label) {
   const loaded = (await host.exec({ command: "launchctl", args: ["print", target] })).status === 0;
   if (loaded) await host.exec({ command: "launchctl", args: ["bootout", target] });
   const defined = await exists2(plist);
-  await (0, import_promises18.rm)(plist, { force: true });
+  await (0, import_promises19.rm)(plist, { force: true });
   return { found: loaded || defined };
 }
 async function removeSystemd(exec, configHome, unit) {
@@ -56494,7 +56436,7 @@ async function removeSystemd(exec, configHome, unit) {
   const active = (await exec({ command: "systemctl", args: ["--user", "is-active", "--quiet", unit] })).status === 0;
   if (!defined && !active) return { found: false };
   await exec({ command: "systemctl", args: ["--user", "disable", "--now", unit] });
-  await (0, import_promises18.rm)(unitPath, { force: true });
+  await (0, import_promises19.rm)(unitPath, { force: true });
   await exec({ command: "systemctl", args: ["--user", "daemon-reload"] });
   return { found: true };
 }
@@ -56521,15 +56463,15 @@ async function removeLegacyService(host, profile) {
 }
 
 // src/platform/service/service-manager.ts
-var import_promises21 = require("fs/promises");
+var import_promises22 = require("fs/promises");
 var import_node_path18 = require("path");
 
 // src/platform/service/service-files.ts
-var import_promises19 = require("fs/promises");
+var import_promises20 = require("fs/promises");
 var import_node_path16 = require("path");
 async function readText(path4) {
   try {
-    return await (0, import_promises19.readFile)(path4, "utf8");
+    return await (0, import_promises20.readFile)(path4, "utf8");
   } catch (error61) {
     if (errnoCode(error61) === "ENOENT") return null;
     throw error61;
@@ -56537,15 +56479,15 @@ async function readText(path4) {
 }
 async function writeDefinition(path4, contents, mode = 420) {
   if (await readText(path4) === contents) return false;
-  await (0, import_promises19.mkdir)((0, import_node_path16.dirname)(path4), { recursive: true });
+  await (0, import_promises20.mkdir)((0, import_node_path16.dirname)(path4), { recursive: true });
   const staged = `${path4}.${process.pid}.tmp`;
-  await (0, import_promises19.writeFile)(staged, contents, { mode });
-  await (0, import_promises19.rename)(staged, path4);
+  await (0, import_promises20.writeFile)(staged, contents, { mode });
+  await (0, import_promises20.rename)(staged, path4);
   return true;
 }
 async function removeDefinition(path4) {
   const existed = await readText(path4) !== null;
-  await (0, import_promises19.rm)(path4, { force: true });
+  await (0, import_promises20.rm)(path4, { force: true });
   return existed;
 }
 async function runChecked(exec, request2) {
@@ -56673,7 +56615,7 @@ function systemdManager(host, profile) {
 }
 
 // src/platform/service/xdg-autostart.ts
-var import_promises20 = require("fs/promises");
+var import_promises21 = require("fs/promises");
 var import_node_path17 = require("path");
 var AUTOSTART_PREFIX = "alan-runtime";
 var ALREADY_RUNNING_EXIT_STATUS2 = 73;
@@ -56789,7 +56731,7 @@ function xdgAutostartManager(host, profile) {
     name: files.name,
     definitionPath: files.entry,
     install: async (spec, { restart }) => {
-      await (0, import_promises20.mkdir)((0, import_node_path17.dirname)(spec.logPath), { recursive: true, mode: 448 });
+      await (0, import_promises21.mkdir)((0, import_node_path17.dirname)(spec.logPath), { recursive: true, mode: 448 });
       const scriptChanged = await writeDefinition(
         files.script,
         renderSupervisorScript(spec, files),
@@ -56816,7 +56758,7 @@ function xdgAutostartManager(host, profile) {
         removeDefinition(files.entry),
         removeDefinition(files.script)
       ]);
-      await (0, import_promises20.rm)(files.supervisorRecord, { force: true });
+      await (0, import_promises21.rm)(files.supervisorRecord, { force: true });
       return { manager: "xdg-autostart", name: files.name, removed: entry || script };
     },
     status: async () => {
@@ -56860,7 +56802,7 @@ function launchdManager(host, profile) {
     name: label,
     definitionPath: plist,
     install: async (spec, { restart }) => {
-      await (0, import_promises21.mkdir)((0, import_node_path18.dirname)(spec.logPath), { recursive: true, mode: 448 });
+      await (0, import_promises22.mkdir)((0, import_node_path18.dirname)(spec.logPath), { recursive: true, mode: 448 });
       const changed = await writeDefinition(plist, renderLaunchdPlist(spec));
       const loaded = await isLoaded();
       if (loaded && !changed) {
@@ -56920,7 +56862,7 @@ function linuxManager(host, profile) {
       if (manager === systemd) {
         if (await readText(autostart.definitionPath) !== null) await autostart.uninstall();
       } else {
-        await (0, import_promises21.rm)(staleUnitPath, { force: true });
+        await (0, import_promises22.rm)(staleUnitPath, { force: true });
       }
       return manager.install(spec, options);
     },
@@ -57394,7 +57336,7 @@ function createGit(options) {
 // src/capabilities/github-proxy/certificates.ts
 var import_node_child_process9 = require("child_process");
 var import_node_crypto11 = require("crypto");
-var import_promises22 = require("fs/promises");
+var import_promises23 = require("fs/promises");
 var import_node_path20 = require("path");
 var OPENSSL_TIMEOUT_MS = 1e4;
 var VALIDITY_DAYS = "30";
@@ -57432,13 +57374,13 @@ function openssl(args, cwd) {
 }
 async function createGitHubProxyCertificates(stateDir) {
   const work = (0, import_node_path20.join)(stateDir, "github-proxy");
-  await (0, import_promises22.rm)(work, { recursive: true, force: true });
-  await (0, import_promises22.mkdir)(work, { recursive: true, mode: 448 });
+  await (0, import_promises23.rm)(work, { recursive: true, force: true });
+  await (0, import_promises23.mkdir)(work, { recursive: true, mode: 448 });
   try {
-    await (0, import_promises22.writeFile)((0, import_node_path20.join)(work, "ca.cnf"), opensslConfig("Alan sandbox GitHub proxy CA"), {
+    await (0, import_promises23.writeFile)((0, import_node_path20.join)(work, "ca.cnf"), opensslConfig("Alan sandbox GitHub proxy CA"), {
       mode: 384
     });
-    await (0, import_promises22.writeFile)((0, import_node_path20.join)(work, "leaf.cnf"), opensslConfig("github.com"), { mode: 384 });
+    await (0, import_promises23.writeFile)((0, import_node_path20.join)(work, "leaf.cnf"), opensslConfig("github.com"), { mode: 384 });
     const curve = ["ecparam", "-name", "prime256v1", "-genkey", "-noout"];
     await openssl([...curve, "-out", "ca.key"], work);
     await openssl(
@@ -57462,19 +57404,19 @@ async function createGitHubProxyCertificates(stateDir) {
       work
     );
     const caPath = (0, import_node_path20.join)(stateDir, "github-ca.pem");
-    await (0, import_promises22.writeFile)(caPath, await (0, import_promises22.readFile)((0, import_node_path20.join)(work, "ca.pem")), { mode: 384 });
+    await (0, import_promises23.writeFile)(caPath, await (0, import_promises23.readFile)((0, import_node_path20.join)(work, "ca.pem")), { mode: 384 });
     return {
       caPath,
-      leafKeyPem: await (0, import_promises22.readFile)((0, import_node_path20.join)(work, "leaf.key"), "utf8"),
-      leafCertPem: await (0, import_promises22.readFile)((0, import_node_path20.join)(work, "leaf.pem"), "utf8")
+      leafKeyPem: await (0, import_promises23.readFile)((0, import_node_path20.join)(work, "leaf.key"), "utf8"),
+      leafCertPem: await (0, import_promises23.readFile)((0, import_node_path20.join)(work, "leaf.pem"), "utf8")
     };
   } finally {
-    await (0, import_promises22.rm)(work, { recursive: true, force: true });
+    await (0, import_promises23.rm)(work, { recursive: true, force: true });
   }
 }
 
 // src/capabilities/github-proxy/config.ts
-var import_promises23 = require("fs/promises");
+var import_promises24 = require("fs/promises");
 var import_node_path21 = require("path");
 init_runtime_v2();
 var GITHUB_URL = "https://github.com/";
@@ -57491,10 +57433,10 @@ function withGhConfigKey(yaml, key, value2) {
 `;
 }
 async function configureGh(ghConfigDir, socketPath) {
-  await (0, import_promises23.mkdir)(ghConfigDir, { recursive: true, mode: 448 });
+  await (0, import_promises24.mkdir)(ghConfigDir, { recursive: true, mode: 448 });
   const path4 = (0, import_node_path21.join)(ghConfigDir, "config.yml");
-  const current = await (0, import_promises23.readFile)(path4, "utf8").catch(() => "");
-  await (0, import_promises23.writeFile)(path4, withGhConfigKey(current, GH_SOCKET_KEY, socketPath), { mode: 384 });
+  const current = await (0, import_promises24.readFile)(path4, "utf8").catch(() => "");
+  await (0, import_promises24.writeFile)(path4, withGhConfigKey(current, GH_SOCKET_KEY, socketPath), { mode: 384 });
 }
 async function configureGit(input2, git) {
   const run2 = async (args, allowedExitCodes = [0]) => {
@@ -57524,7 +57466,7 @@ async function configureGitHubProxyClients(input2) {
 }
 
 // src/capabilities/github-proxy/server.ts
-var import_promises24 = require("fs/promises");
+var import_promises25 = require("fs/promises");
 var import_node_http3 = require("http");
 var import_node_tls = require("tls");
 init_runtime_v2();
@@ -57666,7 +57608,7 @@ async function startGitHubProxy(options) {
   });
   removeStaleEndpoint(options.socketPath);
   await listen(gh, options.socketPath);
-  await (0, import_promises24.chmod)(options.socketPath, 384);
+  await (0, import_promises25.chmod)(options.socketPath, 384);
   const git = options.certificates === null ? null : await startGitListener(options.certificates, relay);
   options.log.info("github_proxy.listening", {
     socketPath: options.socketPath,
@@ -57685,7 +57627,7 @@ async function startGitHubProxy(options) {
 
 // src/capabilities/mcp-config/mcp-config.ts
 var import_node_crypto12 = require("crypto");
-var import_promises25 = require("fs/promises");
+var import_promises26 = require("fs/promises");
 var import_node_path22 = require("path");
 
 // ../../node_modules/smol-toml/dist/error.js
@@ -58527,6 +58469,7 @@ var MCP_CLIS = [
     guardDir: "",
     configPath: ".claude.json",
     section: "mcpServers",
+    writesEntry: true,
     entry: (url3) => ({ type: "http", url: url3, headers: {} })
   },
   {
@@ -58535,6 +58478,9 @@ var MCP_CLIS = [
     guardDir: ".codex",
     configPath: ".codex/config.toml",
     section: "mcp_servers",
+    // ChatGPT.app's bundled Codex reads this file too and never completes MCP OAuth, so a
+    // credential-free entry only loops 401s; Alan runs pass their own per-thread config.
+    writesEntry: false,
     entry: (url3) => ({ url: url3 })
   },
   {
@@ -58543,6 +58489,7 @@ var MCP_CLIS = [
     guardDir: ".cursor",
     configPath: ".cursor/mcp.json",
     section: "mcpServers",
+    writesEntry: true,
     entry: (url3) => ({ type: "http", url: url3, headers: {} })
   },
   {
@@ -58551,6 +58498,7 @@ var MCP_CLIS = [
     guardDir: ".kimi",
     configPath: ".kimi/mcp.json",
     section: "mcpServers",
+    writesEntry: true,
     entry: (url3) => ({ url: url3, headers: {} })
   },
   {
@@ -58559,6 +58507,7 @@ var MCP_CLIS = [
     guardDir: ".commandcode",
     configPath: ".commandcode/mcp.json",
     section: "mcpServers",
+    writesEntry: true,
     entry: (url3) => ({ transport: "http", enabled: true, url: url3 })
   },
   {
@@ -58567,6 +58516,7 @@ var MCP_CLIS = [
     guardDir: ".config/opencode",
     configPath: ".config/opencode/opencode.json",
     section: "mcp",
+    writesEntry: true,
     entry: (url3) => ({ type: "remote", url: url3, headers: {} })
   },
   {
@@ -58575,6 +58525,7 @@ var MCP_CLIS = [
     guardDir: ".factory",
     configPath: ".factory/mcp.json",
     section: "mcpServers",
+    writesEntry: true,
     entry: (url3) => ({ type: "http", url: url3, disabled: false })
   },
   {
@@ -58583,6 +58534,7 @@ var MCP_CLIS = [
     guardDir: ".copilot",
     configPath: ".copilot/mcp-config.json",
     section: "mcpServers",
+    writesEntry: true,
     entry: (url3) => ({ type: "http", url: url3, tools: ["*"], headers: {} })
   },
   {
@@ -58591,6 +58543,7 @@ var MCP_CLIS = [
     guardDir: ".grok",
     configPath: ".grok/config.toml",
     section: "mcp_servers",
+    writesEntry: true,
     entry: (url3) => ({ url: url3 })
   }
 ];
@@ -58619,9 +58572,12 @@ function isAlanEntry(entry, endpoint) {
   if (url3.pathname.replace(/\/+$/, "") !== "/mcp") return false;
   return url3.origin === endpoint.origin || url3.hostname.endsWith(ALAN_HOST_SUFFIX);
 }
+function isCredentialFreeAlanEntry(entry, endpoint) {
+  return isAlanEntry(entry, endpoint) && isRecord2(entry) && Object.keys(entry).every((key) => URL_KEYS.includes(key));
+}
 async function isInstalled(cli, home) {
   try {
-    return (await (0, import_promises25.stat)((0, import_node_path22.join)(home, cli.guardDir))).isDirectory();
+    return (await (0, import_promises26.stat)((0, import_node_path22.join)(home, cli.guardDir))).isDirectory();
   } catch (error61) {
     if (errorCode2(error61) === "ENOENT") return false;
     throw error61;
@@ -58629,7 +58585,7 @@ async function isInstalled(cli, home) {
 }
 async function readText2(path4) {
   try {
-    return await (0, import_promises25.readFile)(path4, "utf8");
+    return await (0, import_promises26.readFile)(path4, "utf8");
   } catch (error61) {
     if (errorCode2(error61) === "ENOENT") return null;
     throw error61;
@@ -58656,10 +58612,10 @@ async function readConfig(cli, home) {
 async function writeConfig(path4, text2) {
   const temporary = `${path4}.alan-${(0, import_node_crypto12.randomUUID)()}.tmp`;
   try {
-    await (0, import_promises25.writeFile)(temporary, text2, { encoding: "utf8", mode: 384, flag: "wx" });
-    await (0, import_promises25.rename)(temporary, path4);
+    await (0, import_promises26.writeFile)(temporary, text2, { encoding: "utf8", mode: 384, flag: "wx" });
+    await (0, import_promises26.rename)(temporary, path4);
   } finally {
-    await (0, import_promises25.rm)(temporary, { force: true });
+    await (0, import_promises26.rm)(temporary, { force: true });
   }
 }
 async function editCli(cli, home, endpoint, edit) {
@@ -58687,6 +58643,13 @@ async function editInstalledClis(home, apiUrl, edit) {
 }
 function syncAlanMcp(options) {
   return editInstalledClis(options.home, options.apiUrl, (servers, endpoint, cli) => {
+    if (!cli.writesEntry) {
+      const stale = [ALAN_MCP_SERVER_NAME, ...options.legacyServerNames].filter(
+        (name) => isCredentialFreeAlanEntry(servers.get(name), endpoint)
+      );
+      for (const name of stale) servers.delete(name);
+      return stale.length > 0;
+    }
     const current = servers.get(ALAN_MCP_SERVER_NAME);
     if (current !== void 0 && !isAlanEntry(current, endpoint)) {
       throw new Error(`an entry that is not Alan's already uses the name ${ALAN_MCP_SERVER_NAME}`);
@@ -58730,7 +58693,7 @@ async function inspectAlanMcp(options) {
 }
 
 // src/capabilities/models/opencode-models.ts
-var import_promises26 = require("fs/promises");
+var import_promises27 = require("fs/promises");
 var import_node_path23 = require("path");
 init_runtime_v2();
 init_zod();
@@ -59046,7 +59009,7 @@ async function readOpenCodeCatalogueCache(env) {
   const home = env.HOME?.trim();
   const cacheHome = env.XDG_CACHE_HOME?.trim() || (home ? (0, import_node_path23.join)(home, ".cache") : "");
   if (cacheHome === "") return null;
-  const text2 = await (0, import_promises26.readFile)((0, import_node_path23.join)(cacheHome, ...CATALOGUE_CACHE_SEGMENTS), "utf8").catch(
+  const text2 = await (0, import_promises27.readFile)((0, import_node_path23.join)(cacheHome, ...CATALOGUE_CACHE_SEGMENTS), "utf8").catch(
     () => void 0
   );
   if (text2 === void 0) return null;
@@ -59165,7 +59128,7 @@ async function discoverModels(backendKind, executable, env, capture) {
 }
 
 // src/capabilities/models/opencode-entitlement.ts
-var import_promises27 = require("fs/promises");
+var import_promises28 = require("fs/promises");
 var import_node_os2 = require("os");
 var import_node_path24 = require("path");
 init_agent2();
@@ -59175,7 +59138,7 @@ async function readOpenCodeZenCredential(env) {
   const injected = env.OPENCODE_AUTH_CONTENT?.trim();
   if (injected) return readZenCredentialFromAuthDocument(injected);
   const dataHome = env.XDG_DATA_HOME?.trim() || (0, import_node_path24.join)(env.HOME?.trim() || (0, import_node_os2.homedir)(), ".local", "share");
-  const document2 = await (0, import_promises27.readFile)((0, import_node_path24.join)(dataHome, "opencode", "auth.json"), "utf8").catch(
+  const document2 = await (0, import_promises28.readFile)((0, import_node_path24.join)(dataHome, "opencode", "auth.json"), "utf8").catch(
     () => void 0
   );
   return readZenCredentialFromAuthDocument(document2);
@@ -59618,7 +59581,7 @@ function nextAlanBoundary(entry, inFlightFrom) {
 }
 
 // src/capabilities/native-ingest/pass.ts
-var import_promises31 = require("fs/promises");
+var import_promises32 = require("fs/promises");
 
 // src/capabilities/native-ingest/ports.ts
 var NativeRequestFailure = class extends Error {
@@ -59756,7 +59719,7 @@ function reconcileTranscriptIdentity(entry, transcriptPath, identity, size) {
 
 // src/capabilities/native-ingest/transcript-window.ts
 var import_node_crypto13 = require("crypto");
-var import_promises30 = require("fs/promises");
+var import_promises31 = require("fs/promises");
 init_acp2();
 init_claude();
 init_codex();
@@ -59811,7 +59774,7 @@ async function findRecordEnd(handle, from, size) {
   return null;
 }
 async function readTranscriptWindow(path4, offset, limits) {
-  const handle = await (0, import_promises30.open)(path4, "r");
+  const handle = await (0, import_promises31.open)(path4, "r");
   try {
     const stats = await handle.stat({ bigint: true });
     const size = Number(stats.size);
@@ -60264,7 +60227,7 @@ async function runPass(ctx, worker) {
     });
     if (signal.ending) ctx.log.info("native_ingest.closed", workerFields(worker));
   }
-  const current = await (0, import_promises31.stat)(worker.latest.transcriptPath).catch(() => void 0);
+  const current = await (0, import_promises32.stat)(worker.latest.transcriptPath).catch(() => void 0);
   return { grewDuringPass: current !== void 0 && current.size > state.lastSize };
 }
 
@@ -60621,7 +60584,7 @@ init_alan_code();
 
 // src/capabilities/providers/commands.ts
 var import_node_fs10 = require("fs");
-var import_promises33 = require("fs/promises");
+var import_promises34 = require("fs/promises");
 var import_node_path30 = require("path");
 var PROVIDER_COMMANDS = [
   // The engine, not a CLI of its own: `resolveProviderExecutable` finds the bundled one first.
@@ -60655,8 +60618,8 @@ function pathDelimiter(platform3) {
 }
 async function isRunnable(path4, platform3) {
   try {
-    if (!(await (0, import_promises33.stat)(path4)).isFile()) return false;
-    if (platform3 !== "win32") await (0, import_promises33.access)(path4, import_node_fs10.constants.X_OK);
+    if (!(await (0, import_promises34.stat)(path4)).isFile()) return false;
+    if (platform3 !== "win32") await (0, import_promises34.access)(path4, import_node_fs10.constants.X_OK);
     return true;
   } catch {
     return false;
@@ -61199,13 +61162,13 @@ async function openCliEnvironment(options) {
 }
 
 // src/capabilities/skills/local-preview.ts
-var import_promises38 = require("fs/promises");
+var import_promises39 = require("fs/promises");
 var import_node_path39 = __toESM(require("path"));
 
 // ../shared/dist/node/skill-package.js
 var import_node_buffer = require("buffer");
 var import_node_crypto15 = require("crypto");
-var import_promises34 = require("fs/promises");
+var import_promises35 = require("fs/promises");
 var import_node_path35 = require("path");
 var import_yaml = __toESM(require_dist(), 1);
 init_contracts();
@@ -61301,11 +61264,11 @@ async function readSkillPackageFile(packageRoot, path4, expectedSha256) {
   if (!normalizedPath || normalizedPath !== path4 || normalizedPath.includes("\\") || components.some((component) => !component || component === "." || component === "..")) {
     throw new SkillPackageError("INVALID_PATH", `Invalid Skill package path: ${path4}`, path4);
   }
-  const absolutePath = await (0, import_promises34.realpath)((0, import_node_path35.resolve)(root, ...components)).catch(() => null);
+  const absolutePath = await (0, import_promises35.realpath)((0, import_node_path35.resolve)(root, ...components)).catch(() => null);
   if (!absolutePath || normalizeRelativePath(root, absolutePath) !== normalizedPath) {
     throw new SkillPackageError("INVALID_PATH", `Skill package file was not found: ${path4}`, path4);
   }
-  const entryStat = await (0, import_promises34.lstat)(absolutePath);
+  const entryStat = await (0, import_promises35.lstat)(absolutePath);
   if (!entryStat.isFile()) {
     throw new SkillPackageError("SPECIAL_FILE_BLOCKED", `Only regular files are allowed in Skill packages: ${path4}`, path4);
   }
@@ -61322,11 +61285,11 @@ async function readSkillPackageFile(packageRoot, path4, expectedSha256) {
   return { file: read.manifest, bytes: read.bytes };
 }
 async function requirePackageRoot(packageRoot) {
-  const root = await (0, import_promises34.realpath)((0, import_node_path35.resolve)(packageRoot)).catch(() => null);
+  const root = await (0, import_promises35.realpath)((0, import_node_path35.resolve)(packageRoot)).catch(() => null);
   if (!root) {
     throw new SkillPackageError("INVALID_PACKAGE_ROOT", "Skill package directory does not exist");
   }
-  const rootStat = await (0, import_promises34.lstat)(root);
+  const rootStat = await (0, import_promises35.lstat)(root);
   if (!rootStat.isDirectory()) {
     throw new SkillPackageError("INVALID_PACKAGE_ROOT", "Skill package root must be a directory");
   }
@@ -61346,13 +61309,13 @@ async function walkPackage(root, ignoredPaths) {
   }
   return files;
   async function walkDirectory(directory) {
-    const entries = await (0, import_promises34.readdir)(directory, { withFileTypes: true });
+    const entries = await (0, import_promises35.readdir)(directory, { withFileTypes: true });
     for (const entry of entries) {
       const absolutePath = (0, import_node_path35.resolve)(directory, entry.name);
       const normalizedPath = normalizeRelativePath(root, absolutePath);
       if (isIgnored(normalizedPath, entry.name, entry.isDirectory(), ignored2))
         continue;
-      const entryStat = await (0, import_promises34.lstat)(absolutePath);
+      const entryStat = await (0, import_promises35.lstat)(absolutePath);
       if (entryStat.isSymbolicLink()) {
         throw new SkillPackageError("SYMLINK_BLOCKED", `Nested symbolic links are not allowed in Skill packages: ${normalizedPath}`, normalizedPath);
       }
@@ -61461,7 +61424,7 @@ function isSecretPath(path4) {
   return name.endsWith(".private-key.pem") || name.endsWith(".private-key.key");
 }
 async function readPackageFile(file2) {
-  const bytes = await (0, import_promises34.readFile)(file2.absolutePath);
+  const bytes = await (0, import_promises35.readFile)(file2.absolutePath);
   return {
     bytes,
     manifest: {
@@ -61632,13 +61595,13 @@ function uint642(value2) {
 
 // src/capabilities/skills/local-sources.ts
 var import_node_crypto17 = require("crypto");
-var import_promises36 = require("fs/promises");
+var import_promises37 = require("fs/promises");
 var import_node_path37 = __toESM(require("path"));
 init_type_guards();
 
 // src/capabilities/skills/local-scan.ts
 var import_node_crypto16 = require("crypto");
-var import_promises35 = require("fs/promises");
+var import_promises36 = require("fs/promises");
 var import_node_path36 = __toESM(require("path"));
 var MAX_CANDIDATES = 2e3;
 var MAX_DIAGNOSTICS = 100;
@@ -61758,7 +61721,7 @@ function invalid(resolvedRoot, name, error61) {
 }
 async function scanRootAsPackage(pass, resolvedRoot) {
   if (!await exists3(import_node_path36.default.join(resolvedRoot.directory, "SKILL.md"))) return null;
-  const canonical = await (0, import_promises35.realpath)(resolvedRoot.directory).catch(() => resolvedRoot.directory);
+  const canonical = await (0, import_promises36.realpath)(resolvedRoot.directory).catch(() => resolvedRoot.directory);
   try {
     const inspected = await inspectCached(pass, canonical, null);
     return {
@@ -61787,7 +61750,7 @@ async function scanRoot(pass, resolvedRoot) {
   if (asPackage !== null) return asPackage;
   let entries;
   try {
-    entries = await (0, import_promises35.readdir)(resolvedRoot.directory, { withFileTypes: true });
+    entries = await (0, import_promises36.readdir)(resolvedRoot.directory, { withFileTypes: true });
   } catch (error61) {
     const code = errnoCode(error61);
     if (code === "ENOENT" || code === "ENOTDIR") {
@@ -61805,7 +61768,7 @@ async function scanRoot(pass, resolvedRoot) {
       incomplete: true
     };
   }
-  const canonicalRoot = await (0, import_promises35.realpath)(resolvedRoot.directory).catch(() => resolvedRoot.directory);
+  const canonicalRoot = await (0, import_promises36.realpath)(resolvedRoot.directory).catch(() => resolvedRoot.directory);
   const scan = { candidates: [], diagnostics: [], incomplete: false };
   for (const entry of entries) {
     if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
@@ -61817,7 +61780,7 @@ async function scanRoot(pass, resolvedRoot) {
 }
 async function scanEntry(pass, resolvedRoot, canonicalRoot, name) {
   const rootLabel = resolvedRoot.root.label;
-  const canonical = await (0, import_promises35.realpath)(import_node_path36.default.join(resolvedRoot.directory, name)).catch(() => null);
+  const canonical = await (0, import_promises36.realpath)(import_node_path36.default.join(resolvedRoot.directory, name)).catch(() => null);
   if (canonical === null) {
     const message2 = `Could not resolve Skill ${name}`;
     return { kind: "diagnostic", diagnostic: { code: "SOURCE_UNREADABLE", message: message2, rootLabel } };
@@ -61901,12 +61864,12 @@ function deduplicateByContent(candidates2) {
 async function fingerprintPackage(root) {
   const hash2 = (0, import_node_crypto16.createHash)("sha256").update("alan-skill-stat-fingerprint-v1\0");
   const visit2 = async (directory, relativeDirectory) => {
-    const entries = await (0, import_promises35.readdir)(directory, { withFileTypes: true });
+    const entries = await (0, import_promises36.readdir)(directory, { withFileTypes: true });
     entries.sort((left, right) => Buffer.compare(Buffer.from(left.name), Buffer.from(right.name)));
     for (const entry of entries) {
       const relative5 = relativeDirectory ? `${relativeDirectory}/${entry.name}` : entry.name;
       const absolute = import_node_path36.default.join(directory, entry.name);
-      const metadata = await (0, import_promises35.lstat)(absolute);
+      const metadata = await (0, import_promises36.lstat)(absolute);
       const kind = entryKind(entry);
       hash2.update(relative5.normalize("NFC")).update(`\0${kind}\0${metadata.size}\0${metadata.mtimeMs}\0${metadata.mode & 511}\0`);
       if (entry.isDirectory()) await visit2(absolute, relative5);
@@ -61922,7 +61885,7 @@ function entryKind(entry) {
 }
 async function canonicalDirectories(directories) {
   const canonical = await Promise.all(
-    directories.map((directory) => (0, import_promises35.realpath)(directory).catch(() => directory))
+    directories.map((directory) => (0, import_promises36.realpath)(directory).catch(() => directory))
   );
   return [...new Set(canonical)];
 }
@@ -61932,7 +61895,7 @@ function isWithinDirectory2(parent, candidate) {
 }
 async function exists3(candidate) {
   try {
-    await (0, import_promises35.access)(candidate);
+    await (0, import_promises36.access)(candidate);
     return true;
   } catch {
     return false;
@@ -61940,7 +61903,7 @@ async function exists3(candidate) {
 }
 async function isDirectory3(candidate) {
   try {
-    return (await (0, import_promises35.lstat)(candidate)).isDirectory();
+    return (await (0, import_promises36.lstat)(candidate)).isDirectory();
   } catch {
     return false;
   }
@@ -62028,7 +61991,7 @@ async function resolveLocalScanInput(home, context, mode) {
 async function readSkillSourceConfig(home) {
   let content;
   try {
-    content = await (0, import_promises36.readFile)(skillSourceConfigPath(home), "utf8");
+    content = await (0, import_promises37.readFile)(skillSourceConfigPath(home), "utf8");
   } catch (error61) {
     if (errnoCode(error61) !== "ENOENT") {
       return { kind: "invalid_config", diagnostic: "~/.alan/config.toml could not be read" };
@@ -62145,7 +62108,7 @@ async function scanLocalSkills(home, context, cache2, mode = "incremental") {
 }
 
 // src/capabilities/skills/store.ts
-var import_promises37 = require("fs/promises");
+var import_promises38 = require("fs/promises");
 var import_node_path38 = require("path");
 init_runtime_v2();
 init_zod();
@@ -62193,7 +62156,7 @@ function writeLocalSkills(layout, file2) {
 async function isLocalSkillCurrent(entry, contentHash, ignoredPaths) {
   if (entry.contentHash !== contentHash) return false;
   try {
-    if (await (0, import_promises37.realpath)(entry.path) !== entry.path) return false;
+    if (await (0, import_promises38.realpath)(entry.path) !== entry.path) return false;
     const inspected = await inspectSkillPackage(entry.path, { expectedName: null, ignoredPaths });
     return inspected.contentHash === contentHash;
   } catch {
@@ -62208,7 +62171,7 @@ async function resolveLocalSkill(local, invocation) {
 }
 async function hasSkillFile(directory) {
   try {
-    return (await (0, import_promises37.stat)((0, import_node_path38.join)(directory, "SKILL.md"))).isFile();
+    return (await (0, import_promises38.stat)((0, import_node_path38.join)(directory, "SKILL.md"))).isFile();
   } catch {
     return false;
   }
@@ -62309,7 +62272,7 @@ async function readLocalSkillFile(layout, ref) {
 }
 async function isDirectory4(candidate) {
   try {
-    return (await (0, import_promises38.stat)(candidate)).isDirectory();
+    return (await (0, import_promises39.stat)(candidate)).isDirectory();
   } catch {
     return false;
   }
@@ -62322,21 +62285,21 @@ async function addSkillSource(home, input2) {
     return { state: "invalid", diagnostic: `${sourcePath} is not a folder` };
   }
   const configPath = skillSourceConfigPath(home);
-  await (0, import_promises38.mkdir)(import_node_path39.default.dirname(configPath), { recursive: true, mode: 448 });
-  await (0, import_promises38.writeFile)(configPath, DEFAULT_SKILL_CONFIG, { flag: "wx", mode: 384 }).catch(
+  await (0, import_promises39.mkdir)(import_node_path39.default.dirname(configPath), { recursive: true, mode: 448 });
+  await (0, import_promises39.writeFile)(configPath, DEFAULT_SKILL_CONFIG, { flag: "wx", mode: 384 }).catch(
     (error61) => {
       if (errnoCode(error61) !== "EEXIST") throw error61;
     }
   );
   const loaded = await readSkillSourceConfig(home);
   if (loaded.kind === "invalid_config") return { state: "invalid", diagnostic: loaded.diagnostic };
-  const canonical = await (0, import_promises38.realpath)(sourcePath).catch(() => sourcePath);
+  const canonical = await (0, import_promises39.realpath)(sourcePath).catch(() => sourcePath);
   for (const source of loaded.config.sources) {
-    if (await (0, import_promises38.realpath)(source.path).catch(() => source.path) === canonical) {
+    if (await (0, import_promises39.realpath)(source.path).catch(() => source.path) === canonical) {
       return { state: "already_present", label: source.label };
     }
   }
-  const current = await (0, import_promises38.readFile)(configPath, "utf8");
+  const current = await (0, import_promises39.readFile)(configPath, "utf8");
   const block = [
     "",
     "[[skills.sources]]",
@@ -62344,7 +62307,7 @@ async function addSkillSource(home, input2) {
     `label = ${JSON.stringify(label)}`,
     ""
   ].join("\n");
-  await (0, import_promises38.writeFile)(configPath, `${current.replace(/\n*$/, "\n")}${block}`, { mode: 384 });
+  await (0, import_promises39.writeFile)(configPath, `${current.replace(/\n*$/, "\n")}${block}`, { mode: 384 });
   const reloaded = await readSkillSourceConfig(home);
   if (reloaded.kind === "invalid_config") {
     return { state: "invalid", diagnostic: reloaded.diagnostic };
@@ -62353,12 +62316,12 @@ async function addSkillSource(home, input2) {
 }
 
 // src/capabilities/skills/local-upload.ts
-var import_promises40 = require("fs/promises");
+var import_promises41 = require("fs/promises");
 
 // ../shared/dist/node/skill-bundle.js
 var import_node_buffer2 = require("buffer");
 var import_node_crypto18 = require("crypto");
-var import_promises39 = require("fs/promises");
+var import_promises40 = require("fs/promises");
 var import_node_path40 = require("path");
 var import_node_stream = require("stream");
 var import_node_zlib = require("zlib");
@@ -62369,7 +62332,7 @@ async function createSkillBundle(packageRoot, options = {}) {
   const archive = (0, import_tar_stream.pack)();
   const tarPromise = collectStream(archive);
   for (const file2 of before.files) {
-    const bytes2 = await (0, import_promises39.readFile)((0, import_node_path40.join)(packageRoot, ...file2.path.split("/")));
+    const bytes2 = await (0, import_promises40.readFile)((0, import_node_path40.join)(packageRoot, ...file2.path.split("/")));
     await addArchiveEntry(archive, {
       name: file2.path,
       type: "file",
@@ -62401,7 +62364,7 @@ async function extractSkillBundle(archiveBytes, destination, expected) {
     throw new Error("Skill archive hash does not match the expected immutable Version");
   }
   const tarBytes = await decompressBounded(archiveBytes);
-  await (0, import_promises39.mkdir)(destination, { recursive: false, mode: 448 });
+  await (0, import_promises40.mkdir)(destination, { recursive: false, mode: 448 });
   try {
     await extractTar(tarBytes, destination);
     const inspected = await inspectSkillPackage(destination, { expectedName: null });
@@ -62409,7 +62372,7 @@ async function extractSkillBundle(archiveBytes, destination, expected) {
       throw new Error("Extracted Skill package hash does not match the expected immutable Version");
     }
   } catch (error61) {
-    await (0, import_promises39.rm)(destination, { recursive: true, force: true });
+    await (0, import_promises40.rm)(destination, { recursive: true, force: true });
     throw error61;
   }
 }
@@ -62485,8 +62448,8 @@ async function extractEntry(header, stream, destination, limits) {
     throw new Error(`Skill archive file size is invalid: ${path4}`);
   }
   const outputPath = (0, import_node_path40.join)(destination, ...path4.split("/"));
-  await (0, import_promises39.mkdir)((0, import_node_path40.dirname)(outputPath), { recursive: true, mode: 448 });
-  await (0, import_promises39.writeFile)(outputPath, bytes, { mode: (header.mode ?? 420) & 73 ? 493 : 420 });
+  await (0, import_promises40.mkdir)((0, import_node_path40.dirname)(outputPath), { recursive: true, mode: 448 });
+  await (0, import_promises40.writeFile)(outputPath, bytes, { mode: (header.mode ?? 420) & 73 ? 493 : 420 });
 }
 function requireSafeArchivePath(value2) {
   const normalized2 = value2.replaceAll("\\", "/").normalize("NFC");
@@ -62512,8 +62475,8 @@ async function publishLocalSkill(options) {
   if (Date.parse(request2.uploadGrant.expiresAt) <= (options.now ?? Date.now())) {
     throw new RuntimeFault("invalid_file", "Skill upload grant expired");
   }
-  const folder = await (0, import_promises40.lstat)(entry.path);
-  if (!folder.isDirectory() || await (0, import_promises40.realpath)(entry.path) !== entry.path) {
+  const folder = await (0, import_promises41.lstat)(entry.path);
+  if (!folder.isDirectory() || await (0, import_promises41.realpath)(entry.path) !== entry.path) {
     throw new RuntimeFault("invalid_file", "Skill folder moved since the last scan");
   }
   const bundle = await createSkillBundle(entry.path, {
@@ -62541,31 +62504,31 @@ async function publishLocalSkill(options) {
 
 // src/capabilities/skills/sync.ts
 var import_node_crypto19 = require("crypto");
-var import_promises41 = require("fs/promises");
+var import_promises42 = require("fs/promises");
 var import_node_path41 = require("path");
 var SKILL_PREPARE_WAIT_MS = 15e3;
 async function install(layout, source, skill, download, signal) {
   const bytes = await source.download(download.url, signal);
-  await (0, import_promises41.mkdir)(layout.tmpDir, { recursive: true, mode: 448 });
+  await (0, import_promises42.mkdir)(layout.tmpDir, { recursive: true, mode: 448 });
   const staging = (0, import_node_path41.join)(layout.tmpDir, (0, import_node_crypto19.randomUUID)());
   await extractSkillBundle(Buffer.from(bytes), staging, {
     expectedArchiveHash: download.archiveHash,
     expectedContentHash: skill.contentHash
   });
   const target = packageDirectory(layout, skill.versionId);
-  await (0, import_promises41.mkdir)(layout.versionsDir, { recursive: true, mode: 448 });
-  await (0, import_promises41.rm)(target, { recursive: true, force: true });
-  await (0, import_promises41.rename)(staging, target);
+  await (0, import_promises42.mkdir)(layout.versionsDir, { recursive: true, mode: 448 });
+  await (0, import_promises42.rm)(target, { recursive: true, force: true });
+  await (0, import_promises42.rename)(staging, target);
 }
 async function sweep(layout, keep) {
   const kept = new Set(keep.map((skill) => skill.versionId));
-  const stale = (await (0, import_promises41.readdir)(layout.versionsDir).catch(() => [])).filter(
+  const stale = (await (0, import_promises42.readdir)(layout.versionsDir).catch(() => [])).filter(
     (name) => !kept.has(name)
   );
   await Promise.all(
-    stale.map((name) => (0, import_promises41.rm)((0, import_node_path41.join)(layout.versionsDir, name), { recursive: true, force: true }))
+    stale.map((name) => (0, import_promises42.rm)((0, import_node_path41.join)(layout.versionsDir, name), { recursive: true, force: true }))
   );
-  await (0, import_promises41.rm)(layout.tmpDir, { recursive: true, force: true });
+  await (0, import_promises42.rm)(layout.tmpDir, { recursive: true, force: true });
   return stale.length;
 }
 async function intactSkills(layout) {
@@ -62800,7 +62763,7 @@ var import_node_path44 = require("path");
 init_runtime_v2();
 
 // src/capabilities/workspace/approved-paths.ts
-var import_promises42 = require("fs/promises");
+var import_promises43 = require("fs/promises");
 init_zod();
 
 // src/capabilities/workspace/paths.ts
@@ -62838,7 +62801,7 @@ var storeSchema = external_exports.object({
 });
 async function realpathOrNull(path4) {
   try {
-    return await (0, import_promises42.realpath)(path4);
+    return await (0, import_promises43.realpath)(path4);
   } catch (error61) {
     const code = errnoCode(error61);
     if (code === "ENOENT" || code === "ENOTDIR" || code === "EACCES" || code === "EPERM") {
@@ -62898,7 +62861,7 @@ async function openApprovedPaths(options) {
 
 // src/capabilities/workspace/locks.ts
 var import_node_crypto20 = require("crypto");
-var import_promises43 = require("fs/promises");
+var import_promises44 = require("fs/promises");
 var import_node_path43 = require("path");
 init_zod();
 var LOCK_FORMAT = 1;
@@ -62919,7 +62882,7 @@ function repositoryLockKey(commonDir, platform3) {
 async function readOwner2(path4) {
   let text2;
   try {
-    text2 = await (0, import_promises43.readFile)(path4, "utf8");
+    text2 = await (0, import_promises44.readFile)(path4, "utf8");
   } catch (error61) {
     if (errnoCode(error61) === "ENOENT") return { kind: "missing" };
     return { kind: "unreadable" };
@@ -62940,7 +62903,7 @@ async function removeIfSame(path4, expected) {
     if (current.kind !== "owner" || current.owner.since !== expected.since) return;
     if (current.owner.pid !== expected.pid || current.owner.holder !== expected.holder) return;
   }
-  await (0, import_promises43.unlink)(path4).catch((error61) => {
+  await (0, import_promises44.unlink)(path4).catch((error61) => {
     if (errnoCode(error61) !== "ENOENT") throw error61;
   });
 }
@@ -62965,7 +62928,7 @@ function openRepositoryLocks(options) {
       await removeIfSame(path4, read.owner);
       return null;
     }
-    const age = await (0, import_promises43.stat)(path4).then(
+    const age = await (0, import_promises44.stat)(path4).then(
       (info) => clock.now() - info.mtimeMs,
       () => 0
     );
@@ -62980,12 +62943,12 @@ function openRepositoryLocks(options) {
   const folder = async (commonDir) => {
     const key = repositoryLockKey(commonDir, platform3);
     const dir = (0, import_node_path43.join)(options.dir, key);
-    await (0, import_promises43.mkdir)(dir, { recursive: true, mode: 448 });
+    await (0, import_promises44.mkdir)(dir, { recursive: true, mode: 448 });
     return { key, dir };
   };
   const createExclusive = async (path4, owner) => {
     try {
-      const handle = await (0, import_promises43.open)(path4, "wx", 384);
+      const handle = await (0, import_promises44.open)(path4, "wx", 384);
       try {
         await handle.writeFile(JSON.stringify(owner));
       } finally {
@@ -62998,7 +62961,7 @@ function openRepositoryLocks(options) {
     }
   };
   const liveRun = async (dir) => {
-    const entries = await (0, import_promises43.readdir)(dir);
+    const entries = await (0, import_promises44.readdir)(dir);
     for (const entry of entries) {
       if (!entry.startsWith(RUN_FILE_PREFIX)) continue;
       const holder = await heldBy((0, import_node_path43.join)(dir, entry));
@@ -63284,6 +63247,7 @@ var LOCAL_API_ROUTES = {
   setup: "/v2/setup",
   logout: "/v2/logout",
   redial: "/v2/link/redial",
+  quit: "/v2/quit",
   prepareUpdate: "/v2/runtime/prepare-update",
   nativeHook: "/v2/native/hook",
   localSkillInspect: "/v2/skills/local/inspect",
@@ -63376,6 +63340,9 @@ var logoutResponseSchema = external_exports.object({
 var redialResponseSchema = external_exports.object({
   accepted: external_exports.literal(true)
 });
+var quitResponseSchema = external_exports.object({
+  stopping: external_exports.literal(true)
+});
 var MAX_PREPARE_UPDATE_WAIT_MS = 25e3;
 var prepareUpdateRequestSchema = external_exports.object({
   waitMs: external_exports.number().int().min(0).max(MAX_PREPARE_UPDATE_WAIT_MS)
@@ -63502,7 +63469,7 @@ var mcpConfigResultSchema = external_exports.object({
 });
 
 // src/client/runtime-client.ts
-var import_promises44 = require("fs/promises");
+var import_promises45 = require("fs/promises");
 init_runtime_v2();
 
 // src/client/sse.ts
@@ -63558,7 +63525,7 @@ var DEFAULT_BACKOFF = { initialMs: 250, maxMs: 3e4 };
 async function readDiscovery(path4) {
   let text2;
   try {
-    text2 = await (0, import_promises44.readFile)(path4, "utf8");
+    text2 = await (0, import_promises45.readFile)(path4, "utf8");
   } catch (error61) {
     throw new RuntimeClientError("unavailable", "The runtime is not running", { cause: error61 });
   }
@@ -63777,6 +63744,13 @@ function createRuntimeClient(options) {
       parseWith(logoutResponseSchema, await response.json(), "logout response");
       return { kind: "revoked" };
     },
+    quit: async (signal) => {
+      await json2(
+        { method: "POST", path: LOCAL_API_ROUTES.quit, body: {} },
+        quitResponseSchema,
+        signal
+      );
+    },
     redial: async (signal) => {
       await json2(
         { method: "POST", path: LOCAL_API_ROUTES.redial, body: {} },
@@ -63856,7 +63830,7 @@ async function sendNativeHookSignal(discoveryPath, hookSignal, signal) {
 
 // src/sessions/index.ts
 var import_node_crypto24 = require("crypto");
-var import_promises56 = require("fs/promises");
+var import_promises57 = require("fs/promises");
 var import_node_os10 = require("os");
 var import_node_path56 = require("path");
 init_runtime_v2();
@@ -64110,7 +64084,7 @@ function createConversationMcpAuthorization(options) {
 }
 
 // src/holder/run-inputs.ts
-var import_promises49 = require("fs/promises");
+var import_promises50 = require("fs/promises");
 var import_node_path48 = require("path");
 var NO_RUN_INPUTS = {
   attachments: [],
@@ -64126,16 +64100,16 @@ function safeFilename(filename) {
 async function prepareRunInputs(spec, { source, tmpDir, signal, skills = [] }) {
   const dir = (0, import_node_path48.join)(tmpDir, "runs", spec.runId);
   const cleanup = async () => {
-    await (0, import_promises49.rm)(dir, { recursive: true, force: true });
+    await (0, import_promises50.rm)(dir, { recursive: true, force: true });
   };
   try {
     const credential = await source.fetchProviderCredential(spec.runId, signal);
     const attachments = [];
-    if (spec.attachments?.length) await (0, import_promises49.mkdir)(dir, { recursive: true, mode: 448 });
+    if (spec.attachments?.length) await (0, import_promises50.mkdir)(dir, { recursive: true, mode: 448 });
     for (const [index, attachment] of (spec.attachments ?? []).entries()) {
       const bytes = await source.downloadAttachment(spec.runId, attachment.id, signal);
       const path4 = (0, import_node_path48.join)(dir, `${index}-${safeFilename(attachment.filename)}`);
-      await (0, import_promises49.writeFile)(path4, bytes, { mode: 384 });
+      await (0, import_promises50.writeFile)(path4, bytes, { mode: 384 });
       attachments.push({
         id: attachment.id,
         kind: attachment.kind,
@@ -64163,7 +64137,7 @@ init_runtime_v2();
 
 // src/holder/admission.ts
 var import_node_fs15 = require("fs");
-var import_promises52 = require("fs/promises");
+var import_promises53 = require("fs/promises");
 var import_node_os9 = require("os");
 var import_node_path52 = require("path");
 init_constants();
@@ -64177,7 +64151,7 @@ function resolveAlanDefaultWorkspacePath(homeDirectory = (0, import_node_os8.hom
 }
 
 // src/holder/admission-relocation.ts
-var import_promises50 = require("fs/promises");
+var import_promises51 = require("fs/promises");
 var import_node_path50 = require("path");
 var MAX_RELOCATION_CANDIDATES = 200;
 var RELOCATION_BUDGET_MS = 2e4;
@@ -64213,7 +64187,7 @@ async function originIdentity(git, path4, signal) {
 }
 async function childDirectories(parent, limit) {
   try {
-    const entries = await (0, import_promises50.readdir)(parent, { withFileTypes: true });
+    const entries = await (0, import_promises51.readdir)(parent, { withFileTypes: true });
     return entries.filter((entry) => entry.isDirectory()).slice(0, limit).map((entry) => (0, import_node_path50.join)(parent, entry.name));
   } catch {
     return [];
@@ -64249,7 +64223,7 @@ async function discoverRelocatedWorkspace(search) {
 }
 
 // src/holder/lease.ts
-var import_promises51 = require("fs/promises");
+var import_promises52 = require("fs/promises");
 var import_node_path51 = require("path");
 var LEASE_CHECK_EVERY_MS = 5e3;
 var MAX_TRANSIENT_FAILURES = 3;
@@ -64264,8 +64238,8 @@ function identityFailure(code, workspacePath) {
   return { code, problemCode: "app.workspace.missing", message: MESSAGES[code], workspacePath };
 }
 async function fileIdentity(path4) {
-  const canonical = await (0, import_promises51.realpath)(path4);
-  const info = await (0, import_promises51.stat)(canonical, { bigint: true });
+  const canonical = await (0, import_promises52.realpath)(path4);
+  const info = await (0, import_promises52.stat)(canonical, { bigint: true });
   return `${canonical}:${info.dev}:${info.ino}`;
 }
 async function snapshot(git, path4, signal) {
@@ -64284,7 +64258,7 @@ async function snapshot(git, path4, signal) {
       workspace: await fileIdentity(path4),
       repository: await fileIdentity(commonDir),
       worktree: await fileIdentity(gitDir),
-      commonDir: await (0, import_promises51.realpath)(commonDir)
+      commonDir: await (0, import_promises52.realpath)(commonDir)
     };
   } catch {
     return null;
@@ -64297,7 +64271,7 @@ async function gitValue(git, path4, args, signal) {
 }
 async function pathExists(path4) {
   try {
-    await (0, import_promises51.stat)(path4);
+    await (0, import_promises52.stat)(path4);
     return true;
   } catch (error61) {
     return errnoCode(error61) !== "ENOENT" && errnoCode(error61) !== "ENOTDIR";
@@ -64306,13 +64280,13 @@ async function pathExists(path4) {
 async function hasGitMarker(path4) {
   let directory;
   try {
-    directory = await (0, import_promises51.realpath)(path4);
+    directory = await (0, import_promises52.realpath)(path4);
   } catch {
     return true;
   }
   for (; ; ) {
     try {
-      await (0, import_promises51.stat)((0, import_node_path51.join)(directory, ".git"));
+      await (0, import_promises52.stat)((0, import_node_path51.join)(directory, ".git"));
       return true;
     } catch (error61) {
       const code = errnoCode(error61);
@@ -64482,7 +64456,7 @@ function volumeRoot(path4) {
 }
 async function exists4(path4) {
   try {
-    await (0, import_promises52.stat)(path4);
+    await (0, import_promises53.stat)(path4);
     return true;
   } catch {
     return false;
@@ -64490,10 +64464,10 @@ async function exists4(path4) {
 }
 async function inspectReadiness(path4) {
   try {
-    if (!(await (0, import_promises52.stat)(path4)).isDirectory()) {
+    if (!(await (0, import_promises53.stat)(path4)).isDirectory()) {
       return { ready: false, missing: true, message: MESSAGES2.missing };
     }
-    await (0, import_promises52.access)(path4, import_node_fs15.constants.R_OK | import_node_fs15.constants.W_OK | import_node_fs15.constants.X_OK);
+    await (0, import_promises53.access)(path4, import_node_fs15.constants.R_OK | import_node_fs15.constants.W_OK | import_node_fs15.constants.X_OK);
     return { ready: true };
   } catch (error61) {
     const code = errnoCode(error61) ?? "";
@@ -64571,8 +64545,8 @@ async function admitDefaultWorkspace(spec, context, skills) {
   const { env } = context;
   const path4 = resolveAlanDefaultWorkspacePath(env.HOME || env.USERPROFILE || (0, import_node_os9.homedir)());
   try {
-    await (0, import_promises52.mkdir)(path4, { recursive: true, mode: 448 });
-    await (0, import_promises52.access)(path4, import_node_fs15.constants.R_OK | import_node_fs15.constants.W_OK | import_node_fs15.constants.X_OK);
+    await (0, import_promises53.mkdir)(path4, { recursive: true, mode: 448 });
+    await (0, import_promises53.access)(path4, import_node_fs15.constants.R_OK | import_node_fs15.constants.W_OK | import_node_fs15.constants.X_OK);
     return {
       kind: "admitted",
       spec: { ...spec, projectPath: path4 },
@@ -64684,7 +64658,7 @@ async function respondToTurn(runningRunId, gate, driver, request2) {
 }
 
 // src/holder/session-facts.ts
-var import_promises53 = require("fs/promises");
+var import_promises54 = require("fs/promises");
 var CLI_RSS_CACHE_MS = 1e4;
 var LOGIN_PROBLEM_PREFIX = "cli.auth.";
 function isLoginFailure(result) {
@@ -64708,8 +64682,8 @@ function createSessionFacts(options) {
     const path4 = await resolveCommandOnPath(command, env, platform3);
     if (path4 === null) return null;
     try {
-      const real = await (0, import_promises53.realpath)(path4);
-      const info = await (0, import_promises53.stat)(real);
+      const real = await (0, import_promises54.realpath)(path4);
+      const info = await (0, import_promises54.stat)(real);
       return { command, key: `${real}:${info.ino}:${info.size}:${info.mtimeMs}` };
     } catch {
       return null;
@@ -64790,7 +64764,7 @@ var import_node_fs16 = require("fs");
 var import_node_path54 = require("path");
 
 // src/run-log/directory.ts
-var import_promises54 = require("fs/promises");
+var import_promises55 = require("fs/promises");
 var import_node_path53 = require("path");
 init_runtime_v2();
 init_zod();
@@ -64810,7 +64784,7 @@ function runDirectory(runsDir, runId) {
 }
 async function isRunClaimed(runsDir, runId) {
   try {
-    return (await (0, import_promises54.stat)(runDirectory(runsDir, runId).log)).size > 0;
+    return (await (0, import_promises55.stat)(runDirectory(runsDir, runId).log)).size > 0;
   } catch (error61) {
     if (errnoCode(error61) === "ENOENT") return false;
     throw error61;
@@ -64848,7 +64822,7 @@ async function writeCompleteRunLog(runsDir, meta3, records) {
 }
 
 // src/run-log/reader.ts
-var import_promises55 = require("fs/promises");
+var import_promises56 = require("fs/promises");
 init_runtime_v2();
 
 // src/run-log/tail.ts
@@ -64871,7 +64845,7 @@ function firstRecordLength(bytes) {
   return bytes.indexOf(RUN_LOG_RECORD_SEPARATOR) + 1;
 }
 async function openRunLogReader(path4) {
-  const handle = await (0, import_promises55.open)(path4, "r");
+  const handle = await (0, import_promises56.open)(path4, "r");
   const readAt = async (position, length) => {
     const buffer = Buffer.alloc(length);
     const { bytesRead } = await handle.read(buffer, 0, length, position);
@@ -64905,7 +64879,7 @@ async function openRunLogReader(path4) {
   };
 }
 async function readLastRecord(path4) {
-  const handle = await (0, import_promises55.open)(path4, "r").catch(() => null);
+  const handle = await (0, import_promises56.open)(path4, "r").catch(() => null);
   if (handle === null) return null;
   try {
     const { size } = await handle.stat();
@@ -65544,7 +65518,7 @@ var DEFAULT_MAX_ACTIVE_RUNS = 32;
 var HOLDER_BUSY = "busy";
 async function listIds(dir, schema) {
   const ids = [];
-  for (const name of await (0, import_promises56.readdir)(dir).catch(() => [])) {
+  for (const name of await (0, import_promises57.readdir)(dir).catch(() => [])) {
     const parsed = schema.safeParse(name);
     if (parsed.success) ids.push(parsed.data);
   }
@@ -65605,7 +65579,7 @@ async function openSessions(deps) {
       }
       await clock.sleep(HOLDER_READY_POLL_MS, AbortSignal.timeout(HOLDER_EXIT_GRACE_MS));
     }
-    await (0, import_promises56.rm)(files.dir, { recursive: true, force: true });
+    await (0, import_promises57.rm)(files.dir, { recursive: true, force: true });
     for (const [runId, owner] of launched) if (owner === conversationId) launched.delete(runId);
     for (const runId of await listIds(paths.runs, runIdSchema)) {
       const meta3 = await readRunMeta(runDirectory(paths.runs, runId).meta);
@@ -65654,7 +65628,7 @@ async function openSessions(deps) {
       if (!await waitForExit2(holder)) return false;
     }
     legacy.delete(conversationId);
-    await (0, import_promises56.rm)(sessionFiles(paths, conversationId).dir, { recursive: true, force: true });
+    await (0, import_promises57.rm)(sessionFiles(paths, conversationId).dir, { recursive: true, force: true });
     for (const runId of await unendedRunsOf(conversationId)) await markInterrupted(runId);
     log.info("sessions.legacy_holder_retired", { conversationId });
     return true;
@@ -65680,7 +65654,7 @@ async function openSessions(deps) {
       log.info("sessions.reattached", { conversationId });
       return;
     }
-    await (0, import_promises56.rm)(files.dir, { recursive: true, force: true });
+    await (0, import_promises57.rm)(files.dir, { recursive: true, force: true });
   };
   const busyRunIds = async () => {
     const busy = /* @__PURE__ */ new Set();
@@ -65734,7 +65708,7 @@ async function openSessions(deps) {
     const meta3 = await readRunMeta(dir.meta);
     const last = await readLastRecord(dir.log);
     if (meta3 === null || last === null) return null;
-    const logged = await (0, import_promises56.stat)(dir.log).catch((error61) => {
+    const logged = await (0, import_promises57.stat)(dir.log).catch((error61) => {
       if (errnoCode(error61) === "ENOENT") return null;
       throw error61;
     });
@@ -66086,7 +66060,7 @@ function readCliEnvironment(env = process.env) {
 }
 
 // src/cli/context.ts
-var import_promises57 = require("fs/promises");
+var import_promises58 = require("fs/promises");
 var import_node_os12 = require("os");
 var import_node_path58 = require("path");
 var DESKTOP_BUNDLE_IDS = {
@@ -66136,7 +66110,7 @@ async function installedServiceSpec(ctx) {
   const spec = serviceSpec(ctx);
   if (ctx.config.host === "app") return spec;
   const layout = installLayout(ctx.config.installDir, ctx.config.profile);
-  const installed = await (0, import_promises57.access)(layout.launcher).then(
+  const installed = await (0, import_promises58.access)(layout.launcher).then(
     () => true,
     () => false
   );
@@ -66263,7 +66237,7 @@ var manifestRevisionSchema = external_exports.object({ revision: external_export
 async function manifestRevision(path4) {
   let raw;
   try {
-    raw = JSON.parse(await (0, import_promises58.readFile)(path4, "utf8"));
+    raw = JSON.parse(await (0, import_promises59.readFile)(path4, "utf8"));
   } catch (error61) {
     throw new RuntimeFault("invalid_file", `Cannot read the skill manifest at ${path4}`, {
       cause: error61
@@ -66317,7 +66291,7 @@ async function runSkills(argv) {
 }
 
 // src/cli/commands/doctor.ts
-var import_promises61 = require("fs/promises");
+var import_promises62 = require("fs/promises");
 var import_node_path62 = require("path");
 init_runtime_v2();
 
@@ -66495,7 +66469,7 @@ async function authorizeDevice(input2) {
 }
 
 // src/identity/enroll.ts
-var import_promises59 = require("fs/promises");
+var import_promises60 = require("fs/promises");
 init_runtime_v2();
 
 // src/identity/installation.ts
@@ -66566,12 +66540,12 @@ async function enrollFromGrantFile(input2) {
     clock: input2.clock,
     access: input2.access
   });
-  await (0, import_promises59.rm)(input2.grantPath, { force: true });
+  await (0, import_promises60.rm)(input2.grantPath, { force: true });
   return machine;
 }
 
 // src/identity/migrate-v1.ts
-var import_promises60 = require("fs/promises");
+var import_promises61 = require("fs/promises");
 var import_node_path60 = require("path");
 init_runtime_v2();
 init_zod();
@@ -66622,8 +66596,8 @@ async function scrubLegacyInstall(install2) {
   const scrubbed = { ...install2.config, migratedToRuntimeV2: true };
   for (const key of SCRUBBED_KEYS) delete scrubbed[key];
   await writeJsonFileAtomic(`${install2.configPath}.migrated-v1`, scrubbed);
-  await (0, import_promises60.rm)(install2.configPath, { force: true });
-  await (0, import_promises60.rm)(install2.ownerLeasePath, { force: true });
+  await (0, import_promises61.rm)(install2.configPath, { force: true });
+  await (0, import_promises61.rm)(install2.ownerLeasePath, { force: true });
 }
 async function exchangeCredential(deps) {
   const { config: config2 } = deps.install;
@@ -67032,7 +67006,7 @@ async function probeHolder(dir, conversationId) {
   }
 }
 async function holdersCheck(ctx) {
-  const names = await (0, import_promises61.readdir)(ctx.paths.sessions).catch(() => []);
+  const names = await (0, import_promises62.readdir)(ctx.paths.sessions).catch(() => []);
   const holders = (await Promise.all(names.map((name) => probeHolder((0, import_node_path62.join)(ctx.paths.sessions, name), name)))).filter((facts) => facts !== null);
   const dead = holders.filter((holder) => !holder.alive).length;
   return check2(
@@ -67044,7 +67018,7 @@ async function holdersCheck(ctx) {
 }
 async function freeBytesAt(path4) {
   try {
-    const stats = await (0, import_promises61.statfs)(path4);
+    const stats = await (0, import_promises62.statfs)(path4);
     return { path: path4, freeBytes: stats.bavail * stats.bsize };
   } catch (error61) {
     const parent = (0, import_node_path62.dirname)(path4);
@@ -67183,7 +67157,7 @@ async function runDoctor(argv, context = cliContext) {
 }
 
 // src/cli/commands/git-credential.ts
-var import_promises62 = require("fs/promises");
+var import_promises63 = require("fs/promises");
 var import_node_net4 = require("net");
 var MAX_RESPONSE_BYTES = 64 * 1024;
 async function readAll(stream) {
@@ -67288,7 +67262,7 @@ async function configure(argv) {
   }
   const config2 = loadRuntimeConfig();
   const { launcher } = installLayout(config2.installDir, config2.profile);
-  const installed = await (0, import_promises62.access)(launcher).then(
+  const installed = await (0, import_promises63.access)(launcher).then(
     () => true,
     () => false
   );
@@ -67465,7 +67439,7 @@ async function runHook(argv, overrides = {}) {
 }
 
 // src/cli/commands/ingestion-hooks.ts
-var import_promises63 = require("fs/promises");
+var import_promises64 = require("fs/promises");
 var CODEX_TRUST_NOTE = "Codex runs new hooks only after you review them: open /hooks in Codex.";
 function isAction(value2) {
   return value2 === "enable" || value2 === "disable" || value2 === "status";
@@ -67488,7 +67462,7 @@ function errorMessage2(error61) {
   return error61 instanceof Error ? error61.message : String(error61);
 }
 async function exists5(path4) {
-  return (0, import_promises63.access)(path4).then(
+  return (0, import_promises64.access)(path4).then(
     () => true,
     () => false
   );
@@ -67847,7 +67821,7 @@ async function runToken(argv, signal) {
 }
 
 // src/cli/commands/logout.ts
-var import_promises64 = require("fs/promises");
+var import_promises65 = require("fs/promises");
 var import_node_path67 = require("path");
 init_runtime_v2();
 var RUNTIME_EXIT_WAIT_MS = 35e3;
@@ -67907,7 +67881,7 @@ async function stopHolder(launch, deps, outcome2) {
 }
 async function stopHeldRuns(ctx, deps, outcome2 = "aborted") {
   const stopped = [];
-  for (const name of await (0, import_promises64.readdir)(ctx.paths.sessions).catch(() => [])) {
+  for (const name of await (0, import_promises65.readdir)(ctx.paths.sessions).catch(() => [])) {
     const launch = await readJsonFile(
       (0, import_node_path67.join)(ctx.paths.sessions, name, "launch.json"),
       holderLaunchSchema
@@ -67946,7 +67920,7 @@ async function forgetMachineLocally(ctx) {
   const machine = await readMachineFile(ctx.paths);
   if (machine === null) return;
   await credentialStoreFor(ctx.paths, machine.credentialStore, ctx.access).clear();
-  await (0, import_promises64.rm)(ctx.paths.machine, { force: true });
+  await (0, import_promises65.rm)(ctx.paths.machine, { force: true });
 }
 async function runLogout(argv, signal) {
   var _stack = [];
@@ -67971,6 +67945,35 @@ async function runLogout(argv, signal) {
 // src/cli/commands/run.ts
 var import_node_path71 = require("path");
 
+// src/local-api/app-attachments.ts
+function createAppAttachments(clock) {
+  const state = {
+    open: 0,
+    quit: false,
+    lostSinceMs: null
+  };
+  return {
+    attach: () => {
+      state.open += 1;
+      state.lostSinceMs = null;
+      const stream = { closed: false };
+      return {
+        [Symbol.dispose]: () => {
+          if (stream.closed) return;
+          stream.closed = true;
+          state.open -= 1;
+          if (state.open === 0) state.lostSinceMs = clock.monotonic();
+        }
+      };
+    },
+    quit: () => {
+      state.quit = true;
+    },
+    quitRequested: () => state.quit,
+    lostSinceMs: () => state.open === 0 ? state.lostSinceMs : null
+  };
+}
+
 // src/local-api/run-appends.ts
 function createRunAppends() {
   const waiters = /* @__PURE__ */ new Map();
@@ -68006,7 +68009,7 @@ function createRunAppends() {
 
 // src/local-api/server.ts
 var import_node_crypto28 = require("crypto");
-var import_promises65 = require("fs/promises");
+var import_promises66 = require("fs/promises");
 var import_node_http4 = require("http");
 var import_node_path68 = require("path");
 
@@ -68326,10 +68329,11 @@ var emptyBodySchema = external_exports.object({});
 function activeRunIds(runs) {
   return runs.filter((run2) => run2.state !== "ended").map((run2) => run2.runId);
 }
-var streamStatus = async ({ feed }, { res, signal }) => {
+var streamStatus = async ({ feed, appAttachments }, { res, signal }) => {
   var _stack = [];
   try {
     const snapshot2 = await feed.refresh(signal);
+    const _attachment = __using(_stack, appAttachments.attach());
     startEventStream(res);
     const send2 = (name, event) => writeEvent(res, { name, id: String(event.seq), dataLines: [JSON.stringify(event)] });
     let latest = null;
@@ -68425,6 +68429,12 @@ var redial = async ({ actions }, request2) => {
   const result = { accepted: true };
   sendJson(request2.res, 202, result);
 };
+var quit = async ({ appAttachments }, request2) => {
+  if (await readBody3(request2, emptyBodySchema) === null) return;
+  appAttachments.quit();
+  const result = { stopping: true };
+  sendJson(request2.res, 202, result);
+};
 var nativeHook = async ({ actions }, request2) => {
   const body = await readBody3(request2, nativeHookSignalSchema);
   if (body === null) return;
@@ -68455,6 +68465,7 @@ var FIXED_ROUTES = new Map([
   [LOCAL_API_ROUTES.setup, { method: "POST", handle: setup }],
   [LOCAL_API_ROUTES.logout, { method: "POST", handle: logout }],
   [LOCAL_API_ROUTES.redial, { method: "POST", handle: redial }],
+  [LOCAL_API_ROUTES.quit, { method: "POST", handle: quit }],
   [LOCAL_API_ROUTES.prepareUpdate, { method: "POST", handle: prepareUpdate }],
   [LOCAL_API_ROUTES.nativeHook, { method: "POST", handle: nativeHook }],
   ...machineFeatureRoutes
@@ -68580,8 +68591,10 @@ async function serveLocalApi(deps) {
   const port = await listenOnLoopback(server);
   const token = (0, import_node_crypto28.randomBytes)(32).toString("base64url");
   const guard = createRequestGuard({ token, port, rateLimit: limits.rateLimit, clock });
+  const appAttachments = createAppAttachments(clock);
   const routeDeps = {
     feed,
+    appAttachments,
     actions: deps.actions,
     runsDir: deps.runsDir,
     appends: deps.appends,
@@ -68649,12 +68662,13 @@ async function serveLocalApi(deps) {
     refreshStatus: async () => {
       if (feed.subscriberCount() > 0) await feed.refresh(AbortSignal.timeout(ACTION_TIMEOUT_MS));
     },
+    appAttachments,
     [Symbol.asyncDispose]: async () => {
       await followers[Symbol.asyncDispose]();
       await watchedStatus[Symbol.asyncDispose]();
       const current = await readJsonFile(discoveryPath, localApiDiscoverySchema);
       if (current.kind === "ok" && current.value.token === token) {
-        await (0, import_promises65.rm)(discoveryPath, { force: true });
+        await (0, import_promises66.rm)(discoveryPath, { force: true });
       }
       await closeServer(server);
       log.info("local_api.closed", {});
@@ -68662,6 +68676,43 @@ async function serveLocalApi(deps) {
   };
 }
 
+// src/cli/commands/app-gone.ts
+var APP_GONE_CHECK_MS = 1e3;
+var APP_GONE_GRACE_MS = 1e4;
+function watchAppGone(options) {
+  const { appAttachments, clock, lifecycle, log } = options;
+  const graceMs = options.graceMs ?? APP_GONE_GRACE_MS;
+  const stop = new AbortController();
+  const goneFor = () => {
+    const lostSinceMs = appAttachments.lostSinceMs();
+    return lostSinceMs === null ? null : clock.monotonic() - lostSinceMs;
+  };
+  const check3 = async (signal) => {
+    if (stop.signal.aborted) return;
+    const quit2 = appAttachments.quitRequested();
+    const gone = goneFor();
+    if (!quit2 && (gone === null || gone < graceMs)) return;
+    const stopped = await lifecycle.exclusive("stop_app_gone", async () => {
+      if (!quit2 && goneFor() === null) return false;
+      await options.interruptAllRuns(signal);
+      return true;
+    });
+    if (!stopped) return;
+    log.info(quit2 ? "runtime.app_quit" : "runtime.app_gone_stop", { goneMs: gone });
+    stop.abort();
+  };
+  const maintenance = startMaintenance({
+    everyMs: options.everyMs ?? APP_GONE_CHECK_MS,
+    jobs: [{ name: "runtime.app_gone_check", run: check3 }],
+    clock,
+    log
+  });
+  return {
+    stopRequested: stop.signal,
+    [Symbol.asyncDispose]: () => maintenance[Symbol.asyncDispose]()
+  };
+}
+
 // src/cli/commands/machine-features.ts
 async function skillRead(read) {
   try {
@@ -72370,7 +72421,7 @@ function refusalFailure(refusal2) {
 }
 
 // src/link/probe.ts
-var import_promises66 = require("dns/promises");
+var import_promises67 = require("dns/promises");
 var import_node_net5 = require("net");
 var import_node_tls2 = require("tls");
 var PROBE_TIMEOUT_MS4 = 5e3;
@@ -72406,7 +72457,7 @@ async function connectOnce(url3, clock) {
 }
 async function probeEndpoint(url3, clock) {
   try {
-    await (0, import_promises66.lookup)(url3.hostname);
+    await (0, import_promises67.lookup)(url3.hostname);
   } catch (error61) {
     const reason = classifyTransportFailure(error61);
     return reason === "other" ? "dns" : reason;
@@ -72842,7 +72893,7 @@ function createReconciler(host, lifecycle, log, signal) {
 }
 
 // src/uploader/index.ts
-var import_promises67 = require("fs/promises");
+var import_promises68 = require("fs/promises");
 init_runtime_v2();
 init_zod();
 var RETRY_DELAYS_MS = [250, 500, 1e3, 2e3, 5e3, 1e4, 3e4];
@@ -72982,23 +73033,29 @@ function startUploader({ api, runsDir, clock, log }) {
     });
     active.set(runId, task);
   };
+  const sweep2 = async () => {
+    for (const name of await (0, import_promises68.readdir)(runsDir).catch(() => [])) {
+      const runId = runIdSchema.safeParse(name);
+      if (runId.success) run2(runId.data);
+    }
+  };
   const isPrunable = async (runId, options) => {
     if (options.keep.has(runId) || active.has(runId)) return false;
     const dir = runDirectory(runsDir, runId);
     const progress = await readJsonFile(dir.upload, uploadProgressSchema);
     if (progress.kind !== "ok" || !progress.value.sealed) return false;
-    const sealedAt = (await (0, import_promises67.stat)(dir.upload)).mtimeMs;
+    const sealedAt = (await (0, import_promises68.stat)(dir.upload)).mtimeMs;
     if (clock.now() - sealedAt < options.sealedForMs) return false;
     return (await readLastRecord(dir.log))?.update.sessionUpdate === "_alan/run.ended";
   };
   const prune = async (options) => {
     let removed = 0;
-    for (const name of await (0, import_promises67.readdir)(runsDir).catch(() => [])) {
+    for (const name of await (0, import_promises68.readdir)(runsDir).catch(() => [])) {
       const runId = runIdSchema.safeParse(name);
       if (!runId.success) continue;
       try {
         if (!await isPrunable(runId.data, options)) continue;
-        await (0, import_promises67.rm)(runDirectory(runsDir, runId.data).dir, { recursive: true, force: true });
+        await (0, import_promises68.rm)(runDirectory(runsDir, runId.data).dir, { recursive: true, force: true });
         removed += 1;
       } catch (error61) {
         log.warn("upload.prune_failed", { runId: runId.data, error: error61 });
@@ -73009,10 +73066,11 @@ function startUploader({ api, runsDir, clock, log }) {
   return {
     notify: run2,
     prune,
-    sweep: async () => {
-      for (const name of await (0, import_promises67.readdir)(runsDir).catch(() => [])) {
-        const runId = runIdSchema.safeParse(name);
-        if (runId.success) run2(runId.data);
+    sweep: sweep2,
+    flush: async () => {
+      await sweep2();
+      while (active.size > 0 && !controller.signal.aborted) {
+        await Promise.allSettled([...active.values()]);
       }
     },
     [Symbol.asyncDispose]: async () => {
@@ -73767,7 +73825,7 @@ async function startMachinePlane(deps) {
         const result = await workspaces.answer({ method: "workspace.status", path: path4 });
         return result.ok ? { ok: true } : { ok: false, message: result.error.message };
       },
-      flushUploads: () => uploader.sweep(),
+      flushUploads: () => uploader.flush(),
       nativeHook: (hookSignal) => nativeIngest.accept(hookSignal),
       rescanLocalSkills: () => skills.rescan(),
       apiUrl: identity.endpoints.apiUrl,
@@ -73783,6 +73841,10 @@ async function startMachinePlane(deps) {
 
 // src/cli/commands/machine-slot.ts
 var NOT_SET_UP_LINK = { state: "stopped" };
+var FINAL_UPLOAD_WAIT_MS = 2e4;
+function sameOrigin(requested, configured) {
+  return URL.canParse(requested) && new URL(requested).origin === new URL(configured).origin;
+}
 function faultMessage(error61) {
   return error61 instanceof Error ? error61.message : String(error61);
 }
@@ -73857,6 +73919,13 @@ function createMachineSlot(deps) {
         message: "This computer is already set up; log out first"
       };
     }
+    if (!sameOrigin(request2.apiUrl, ctx.config.apiUrl)) {
+      return {
+        kind: "refused",
+        code: "setup_failed",
+        message: `This computer's ${ctx.config.profile} runtime serves ${ctx.config.apiUrl}, not ${request2.apiUrl}`
+      };
+    }
     await close2();
     const setupCtx = cliContext({ ...ctx.config, apiUrl: request2.apiUrl });
     try {
@@ -73892,9 +73961,23 @@ function createMachineSlot(deps) {
       throw error61;
     }
   };
+  const interruptAllRuns = async (signal) => {
+    const plane = slot.plane;
+    if (plane === null) return;
+    const stopped = await stopHeldRuns(ctx, logoutDeps(signal), "interrupted");
+    const waited = new AbortController();
+    await Promise.race([
+      plane.flushUploads().catch((error61) => log.warn("runtime.flush_failed", { error: error61 })),
+      clock.sleep(FINAL_UPLOAD_WAIT_MS, AbortSignal.any([signal, waited.signal])).catch(() => {
+      })
+    ]);
+    waited.abort();
+    log.info("runtime.runs_interrupted", { stopped });
+  };
   return {
     open: open5,
     plane: () => slot.plane,
+    interruptAllRuns,
     facts: () => {
       const plane = slot.plane;
       if (plane === null) return { machineId: null, setup: "none", link: NOT_SET_UP_LINK };
@@ -74051,6 +74134,13 @@ async function runService(argv, stop, restart = new AbortController().signal) {
       clock,
       log
     }), true);
+    const appGone = __using(_stack, watchAppGone({
+      appAttachments: localApi.appAttachments,
+      lifecycle,
+      interruptAllRuns: (signal) => machine.interruptAllRuns(signal),
+      clock,
+      log
+    }), true);
     log.info("runtime.started", {
       machineId: machine.facts().machineId,
       setup: machine.facts().setup,
@@ -74059,7 +74149,7 @@ async function runService(argv, stop, restart = new AbortController().signal) {
     });
     return await awaitRuntimeExit(
       {
-        stop: AbortSignal.any([stop, stopForUpdate.signal]),
+        stop: AbortSignal.any([stop, stopForUpdate.signal, appGone.stopRequested]),
         restart: AbortSignal.any([
           restart,
           updateInstalled.signal,
@@ -74115,17 +74205,17 @@ async function runServiceCommand(argv, ctx = cliContext()) {
 }
 
 // src/cli/commands/upgrade.ts
-var import_promises68 = require("fs/promises");
+var import_promises69 = require("fs/promises");
 var import_node_path72 = require("path");
 function isNotNewer(version2, installed) {
   return installed !== null && isReleaseVersion(version2) && isReleaseVersion(installed) && compareVersions(version2, installed) <= 0;
 }
 async function installFromSource(source) {
   const { layout, from, ifNewer } = source;
-  const isTarball = (await (0, import_promises68.stat)(from)).isFile();
+  const isTarball = (await (0, import_promises69.stat)(from)).isFile();
   const downloads = (0, import_node_path72.join)(layout.root, ".downloads");
-  if (isTarball) await (0, import_promises68.mkdir)(downloads, { recursive: true, mode: 448 });
-  const scratch = isTarball ? await (0, import_promises68.mkdtemp)((0, import_node_path72.join)(downloads, "upgrade-")) : null;
+  if (isTarball) await (0, import_promises69.mkdir)(downloads, { recursive: true, mode: 448 });
+  const scratch = isTarball ? await (0, import_promises69.mkdtemp)((0, import_node_path72.join)(downloads, "upgrade-")) : null;
   try {
     const sourceDir = scratch === null ? from : await extractPackageTarball(from, scratch);
     const version2 = await readPackageVersion(sourceDir);
@@ -74133,7 +74223,7 @@ async function installFromSource(source) {
     if (ifNewer && isNotNewer(version2, installed)) return { kind: "skipped", version: version2, installed };
     return { kind: "installed", ...await installVersion(layout, sourceDir) };
   } finally {
-    if (scratch !== null) await (0, import_promises68.rm)(scratch, { recursive: true, force: true });
+    if (scratch !== null) await (0, import_promises69.rm)(scratch, { recursive: true, force: true });
   }
 }
 async function runUpgrade(argv) {