@algosuite/vo-mcp 0.2.0-beta.28 → 0.2.0-beta.30

package/dist/runner-cli.js

@@ -77,11 +77,11 @@ __export(credential_store_exports, {
   readStoredCredentialKeychainOnly: () => readStoredCredentialKeychainOnly,
   writeStoredCredential: () => writeStoredCredential
 });
-import { homedir } from "node:os";
+import { homedir as homedir2 } from "node:os";
 import { join, dirname } from "node:path";
 import {
-  existsSync,
-  mkdirSync,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
   readFileSync,
   writeFileSync,
   chmodSync,
@@ -90,7 +90,7 @@ import {
 function credentialPath(env2 = process.env) {
   const override = env2["VO_MCP_CREDENTIALS_PATH"]?.trim();
   if (override) return override;
-  return join(homedir(), ".config", "vo-mcp", "credentials.json");
+  return join(homedir2(), ".config", "vo-mcp", "credentials.json");
 }
 function keychainEnabled(env2, keychain) {
   const disabled = (env2["VO_MCP_DISABLE_KEYCHAIN"] ?? "").trim().toLowerCase();
@@ -119,7 +119,7 @@ function deserialize(raw) {
 function readFromFile(env2) {
   try {
     const p = credentialPath(env2);
-    if (!existsSync(p)) return null;
+    if (!existsSync2(p)) return null;
     return deserialize(readFileSync(p, "utf8"));
   } catch {
     return null;
@@ -146,7 +146,7 @@ function deleteFile(env2) {
 }
 function writeToFile(payload, env2) {
   const p = credentialPath(env2);
-  mkdirSync(dirname(p), { recursive: true });
+  mkdirSync2(dirname(p), { recursive: true });
   writeFileSync(p, `${JSON.stringify(payload, null, 2)}
 `, { mode: 384 });
   try {
@@ -505,7 +505,8 @@ async function runProcess(command, args = [], options = {}) {
   });
 }
 async function commandExists(command, options = {}) {
-  const checker = process.platform === "win32" ? "where" : "which";
+  const platform = options.platform || process.platform;
+  const checker = platform === "win32" ? "where" : "which";
   const result = await (options.runner || runProcess)(checker, [command], {
     timeoutMs: 1e4
   });
@@ -841,9 +842,141 @@ var init_pnpm_canonical_health = __esm({
   }
 });
 
+// src/runner/pnpm-command.mjs
+import fs2 from "node:fs";
+import path3 from "node:path";
+function isWindowsDriveOrUnc(value) {
+  return WINDOWS_DRIVE_OR_UNC_RE.test(String(value || ""));
+}
+function portableDirname(value) {
+  if (isWindowsDriveOrUnc(value)) return path3.win32.dirname(value);
+  if (path3.posix.isAbsolute(value)) return path3.posix.dirname(value);
+  return path3.dirname(value);
+}
+function portableJoin(root, ...segments) {
+  if (isWindowsDriveOrUnc(root)) return path3.win32.join(root, ...segments);
+  if (path3.posix.isAbsolute(root)) return path3.posix.join(root, ...segments);
+  return path3.join(root, ...segments);
+}
+function readPackageManager(root) {
+  const packagePath = path3.join(root, "package.json");
+  if (!fs2.existsSync(packagePath)) return "";
+  try {
+    return String(JSON.parse(fs2.readFileSync(packagePath, "utf8"))?.packageManager || "").trim();
+  } catch {
+    return "";
+  }
+}
+function validatedPnpmVersionToken(root) {
+  const raw = readPackageManager(root);
+  const match = /^pnpm@(.+)$/iu.exec(raw);
+  if (!match) return "";
+  const version = match[1].trim();
+  if (!version || /\s/u.test(version) || !SAFE_PNPM_VERSION_RE.test(version)) return "";
+  return version;
+}
+function pnpmSelector(root) {
+  const packageManager = readPackageManager(root);
+  const version = validatedPnpmVersionToken(root);
+  if (packageManager && !version) {
+    throw new Error(`[vo-mcp runner] invalid pnpm packageManager token in ${path3.join(root, "package.json")}`);
+  }
+  return version ? `pnpm@${version}` : "pnpm";
+}
+function whereResults(result) {
+  if (result?.status !== 0) return [];
+  return String(result.stdout || "").split(/\r?\n/u).map((line) => line.trim()).filter((line) => path3.win32.isAbsolute(line));
+}
+async function resolveWindowsNativeCommand(command, runner) {
+  const result = await runner("where", [command], { timeoutMs: 1e4 });
+  return whereResults(result).find((candidate) => WINDOWS_NATIVE_EXECUTABLE_RE.test(candidate)) || "";
+}
+function trustedCorepackCandidates(options) {
+  const env2 = options.env || process.env;
+  const execPath = options.execPath || process.execPath;
+  const roots = [portableDirname(execPath)];
+  for (const key of ["ProgramW6432", "ProgramFiles", "ProgramFiles(x86)"]) {
+    const programFiles = String(env2[key] || "").trim();
+    if (isWindowsDriveOrUnc(programFiles) || path3.posix.isAbsolute(programFiles)) {
+      roots.push(portableJoin(programFiles, "nodejs"));
+    }
+  }
+  return [...new Set(roots)].map((root) => portableJoin(root, "node_modules", "corepack", "dist", "corepack.js"));
+}
+function resolveTrustedCorepackJs(options) {
+  const existsSync7 = options.existsSync || fs2.existsSync;
+  return trustedCorepackCandidates(options).find((candidate) => existsSync7(candidate)) || "";
+}
+async function resolvePnpmInstallCommand(root, options = {}) {
+  const runner = options.runner || runProcess;
+  const platform = options.platform || process.platform;
+  const selector = pnpmSelector(root);
+  if (platform !== "win32") {
+    if (await commandExists("pnpm", { runner, platform })) {
+      return {
+        command: "pnpm",
+        args: [...DEFAULT_PNPM_INSTALL_ARGS],
+        displayCommand: ["pnpm", ...DEFAULT_PNPM_INSTALL_ARGS]
+      };
+    }
+    if (await commandExists("corepack", { runner, platform })) {
+      return {
+        command: "corepack",
+        args: [selector, ...DEFAULT_PNPM_INSTALL_ARGS],
+        displayCommand: ["corepack", selector, ...DEFAULT_PNPM_INSTALL_ARGS]
+      };
+    }
+    throw new Error("[vo-mcp runner] pnpm hydration requires `pnpm` or `corepack` on PATH.");
+  }
+  const pnpmExecutable = await resolveWindowsNativeCommand("pnpm", runner);
+  if (pnpmExecutable) {
+    return {
+      command: pnpmExecutable,
+      args: [...DEFAULT_PNPM_INSTALL_ARGS],
+      displayCommand: ["pnpm", ...DEFAULT_PNPM_INSTALL_ARGS]
+    };
+  }
+  const corepackExecutable = await resolveWindowsNativeCommand("corepack", runner);
+  if (corepackExecutable) {
+    return {
+      command: corepackExecutable,
+      args: [selector, ...DEFAULT_PNPM_INSTALL_ARGS],
+      displayCommand: ["corepack", selector, ...DEFAULT_PNPM_INSTALL_ARGS]
+    };
+  }
+  const corepackJs = resolveTrustedCorepackJs(options);
+  if (corepackJs) {
+    return {
+      command: options.execPath || process.execPath,
+      args: [corepackJs, selector, ...DEFAULT_PNPM_INSTALL_ARGS],
+      displayCommand: ["corepack", selector, ...DEFAULT_PNPM_INSTALL_ARGS]
+    };
+  }
+  throw new Error(
+    "[vo-mcp runner] pnpm hydration on Windows requires a native pnpm/corepack executable or a trusted Corepack installation."
+  );
+}
+var DEFAULT_PNPM_INSTALL_ARGS, SAFE_PNPM_VERSION_RE, WINDOWS_NATIVE_EXECUTABLE_RE, WINDOWS_DRIVE_OR_UNC_RE;
+var init_pnpm_command = __esm({
+  "src/runner/pnpm-command.mjs"() {
+    "use strict";
+    init_process_runner();
+    DEFAULT_PNPM_INSTALL_ARGS = Object.freeze([
+      "install",
+      "--frozen-lockfile",
+      "--prefer-offline",
+      "--ignore-scripts",
+      "--config.confirmModulesPurge=false"
+    ]);
+    SAFE_PNPM_VERSION_RE = /^[0-9A-Za-z._+-]+$/u;
+    WINDOWS_NATIVE_EXECUTABLE_RE = /\.(?:com|exe)$/iu;
+    WINDOWS_DRIVE_OR_UNC_RE = /^(?:[A-Za-z]:[\\/]|\\\\)/u;
+  }
+});
+
 // src/runner/pnpm-materialize.mjs
 import fsp4 from "node:fs/promises";
-import path3 from "node:path";
+import path4 from "node:path";
 function linkType() {
   return process.platform === "win32" ? "junction" : "dir";
 }
@@ -855,13 +988,13 @@ async function realpathOrThrow(target, fsApi) {
   }
 }
 function shouldMapToWorktree(resolvedTarget, canonicalRoot) {
-  const relative = path3.relative(canonicalRoot, resolvedTarget).replace(/\\/g, "/");
+  const relative = path4.relative(canonicalRoot, resolvedTarget).replace(/\\/g, "/");
   return Boolean(relative && !relative.startsWith("..") && !relative.split("/").includes("node_modules"));
 }
 async function resolveEntryTarget(sourceEntry, canonicalRoot, worktreeRoot, fsApi) {
   const resolved = await realpathOrThrow(sourceEntry, fsApi);
   if (!shouldMapToWorktree(resolved, canonicalRoot)) return resolved;
-  const mapped = path3.join(worktreeRoot, path3.relative(canonicalRoot, resolved));
+  const mapped = path4.join(worktreeRoot, path4.relative(canonicalRoot, resolved));
   if (!await fsApi.pathExists(mapped)) {
     throw new Error(`[vo-mcp runner] task-local workspace target is missing for dependency link: ${mapped}`);
   }
@@ -872,7 +1005,7 @@ async function ensureLinkedDirectory(source, target, fsApi) {
     if (await fsApi.realpath(target) === await fsApi.realpath(source)) return;
     throw new Error(`[vo-mcp runner] refusing to overwrite existing dependency path: ${target}`);
   }
-  await fsApi.mkdir(path3.dirname(target), { recursive: true });
+  await fsApi.mkdir(path4.dirname(target), { recursive: true });
   await fsApi.symlink(source, target, linkType());
   if (await fsApi.realpath(target) !== await fsApi.realpath(source)) {
     throw new Error(`[vo-mcp runner] dependency link validation failed for ${target}`);
@@ -886,8 +1019,8 @@ async function maybeYield2(state) {
 async function copyDirRecursive(sourceDir, targetDir, fsApi, yieldState) {
   await fsApi.mkdir(targetDir, { recursive: true });
   for (const entry of await fsApi.readdir(sourceDir, { withFileTypes: true })) {
-    const source = path3.join(sourceDir, entry.name);
-    const target = path3.join(targetDir, entry.name);
+    const source = path4.join(sourceDir, entry.name);
+    const target = path4.join(targetDir, entry.name);
     await maybeYield2(yieldState);
     if (entry.isDirectory()) {
       await copyDirRecursive(source, target, fsApi, yieldState);
@@ -899,17 +1032,17 @@ async function copyDirRecursive(sourceDir, targetDir, fsApi, yieldState) {
 async function materializeEntry(sourceEntry, targetEntry, canonicalRoot, worktreeRoot, options) {
   await options.beforeEntry?.(sourceEntry, targetEntry);
   const stat2 = await options.fsApi.lstat(sourceEntry);
-  if (stat2.isDirectory() && !stat2.isSymbolicLink() && path3.basename(sourceEntry) === ".bin") {
+  if (stat2.isDirectory() && !stat2.isSymbolicLink() && path4.basename(sourceEntry) === ".bin") {
     await copyDirRecursive(sourceEntry, targetEntry, options.fsApi, options.yieldState);
     return;
   }
-  if (stat2.isDirectory() && !stat2.isSymbolicLink() && path3.basename(sourceEntry).startsWith("@")) {
+  if (stat2.isDirectory() && !stat2.isSymbolicLink() && path4.basename(sourceEntry).startsWith("@")) {
     await options.fsApi.mkdir(targetEntry, { recursive: true });
     for (const nested of await options.fsApi.readdir(sourceEntry, { withFileTypes: true })) {
       await maybeYield2(options.yieldState);
       await materializeEntry(
-        path3.join(sourceEntry, nested.name),
-        path3.join(targetEntry, nested.name),
+        path4.join(sourceEntry, nested.name),
+        path4.join(targetEntry, nested.name),
         canonicalRoot,
         worktreeRoot,
         options
@@ -922,7 +1055,7 @@ async function materializeEntry(sourceEntry, targetEntry, canonicalRoot, worktre
     await ensureLinkedDirectory(resolvedTarget, targetEntry, options.fsApi);
     return;
   }
-  await options.fsApi.mkdir(path3.dirname(targetEntry), { recursive: true });
+  await options.fsApi.mkdir(path4.dirname(targetEntry), { recursive: true });
   await options.fsApi.copyFile(sourceEntry, targetEntry);
 }
 function createPnpmFsApi(pathExists6) {
@@ -946,8 +1079,8 @@ async function materializeNodeModulesForest(sourceNodeModules, targetNodeModules
   for (const entry of await options.fsApi.readdir(sourceNodeModules, { withFileTypes: true })) {
     await maybeYield2(options.yieldState);
     await materializeEntry(
-      path3.join(sourceNodeModules, entry.name),
-      path3.join(targetNodeModules, entry.name),
+      path4.join(sourceNodeModules, entry.name),
+      path4.join(targetNodeModules, entry.name),
       canonicalRoot,
       worktreeRoot,
       options
@@ -962,20 +1095,20 @@ var init_pnpm_materialize = __esm({
 
 // src/runner/pnpm-hydration.mjs
 import { createHash } from "node:crypto";
-import fs2 from "node:fs";
+import fs3 from "node:fs";
 import fsp5 from "node:fs/promises";
-import path4 from "node:path";
+import path5 from "node:path";
 function hashText(text) {
   return createHash("sha256").update(String(text)).digest("hex");
 }
 function statePath(root) {
-  return path4.join(root, ".agent-worktrees", "runner-pnpm-hydration.json");
+  return path5.join(root, ".agent-worktrees", "runner-pnpm-hydration.json");
 }
 function packageJson(root) {
-  const packagePath = path4.join(root, "package.json");
-  if (!fs2.existsSync(packagePath)) return null;
+  const packagePath = path5.join(root, "package.json");
+  if (!fs3.existsSync(packagePath)) return null;
   try {
-    return JSON.parse(fs2.readFileSync(packagePath, "utf8"));
+    return JSON.parse(fs3.readFileSync(packagePath, "utf8"));
   } catch {
     return null;
   }
@@ -989,23 +1122,23 @@ async function pathExists4(target) {
   }
 }
 function lockfileHash(root) {
-  const lockPath = path4.join(root, "pnpm-lock.yaml");
-  if (!fs2.existsSync(lockPath)) return "";
-  return hashText(fs2.readFileSync(lockPath, "utf8"));
+  const lockPath = path5.join(root, "pnpm-lock.yaml");
+  if (!fs3.existsSync(lockPath)) return "";
+  return hashText(fs3.readFileSync(lockPath, "utf8"));
 }
 function readHydrationState(root) {
   const file = statePath(root);
-  if (!fs2.existsSync(file)) return null;
+  if (!fs3.existsSync(file)) return null;
   try {
-    return JSON.parse(fs2.readFileSync(file, "utf8"));
+    return JSON.parse(fs3.readFileSync(file, "utf8"));
   } catch {
     return null;
   }
 }
 function writeHydrationState(root, state) {
   const file = statePath(root);
-  fs2.mkdirSync(path4.dirname(file), { recursive: true });
-  fs2.writeFileSync(file, `${JSON.stringify({
+  fs3.mkdirSync(path5.dirname(file), { recursive: true });
+  fs3.writeFileSync(file, `${JSON.stringify({
     ...state,
     stateVersion: 2,
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -1013,7 +1146,7 @@ function writeHydrationState(root, state) {
 `, "utf8");
 }
 function voDepsStatePath(root) {
-  return path4.join(root, "node_modules", ".vo-deps-state.json");
+  return path5.join(root, "node_modules", ".vo-deps-state.json");
 }
 async function ensureVoDepsState(root, expectedHash, fsApi = fsp5) {
   const marker = voDepsStatePath(root);
@@ -1023,7 +1156,7 @@ async function ensureVoDepsState(root, expectedHash, fsApi = fsp5) {
   } catch {
   }
   const temp = `${marker}.tmp-${process.pid}-${Date.now()}`;
-  await fsApi.mkdir(path4.dirname(marker), { recursive: true });
+  await fsApi.mkdir(path5.dirname(marker), { recursive: true });
   await fsApi.writeFile(temp, `${JSON.stringify({ lockfileHash: expectedHash, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
 `, "utf8");
   await fsApi.rename(temp, marker);
@@ -1043,14 +1176,6 @@ async function assertVoDepsState(root, expectedHash, fsApi = fsp5) {
   }
   throw new Error(`[vo-mcp runner] linked vo:deps state marker mismatch for ${root}`);
 }
-function validatedPnpmVersionToken(root) {
-  const raw = String(packageJson(root)?.packageManager || "").trim();
-  const match = /^pnpm@(.+)$/iu.exec(raw);
-  if (!match) return "";
-  const version = match[1].trim();
-  if (!version || /\s/u.test(version) || !SAFE_PNPM_VERSION_RE.test(version)) return "";
-  return version;
-}
 function workspacePatternsFromPackageJson(root) {
   const workspaces = packageJson(root)?.workspaces;
   if (Array.isArray(workspaces)) return workspaces.map(String);
@@ -1058,9 +1183,9 @@ function workspacePatternsFromPackageJson(root) {
   return [];
 }
 function workspacePatternsFromPnpmWorkspace(root) {
-  const workspacePath = path4.join(root, "pnpm-workspace.yaml");
-  if (!fs2.existsSync(workspacePath)) return [];
-  const lines = fs2.readFileSync(workspacePath, "utf8").split(/\r?\n/u);
+  const workspacePath = path5.join(root, "pnpm-workspace.yaml");
+  if (!fs3.existsSync(workspacePath)) return [];
+  const lines = fs3.readFileSync(workspacePath, "utf8").split(/\r?\n/u);
   const patterns = [];
   let inPackages = false;
   for (const rawLine of lines) {
@@ -1117,16 +1242,16 @@ function collectPackageDirs(root, options = {}) {
   while (stack.length > 0) {
     const current = stack.pop();
     if (!current) continue;
-    const relativeDir = path4.relative(root, current.dir).replace(/\\/g, "/");
-    if (relativeDir && fs2.existsSync(path4.join(current.dir, "package.json"))) {
+    const relativeDir = path5.relative(root, current.dir).replace(/\\/g, "/");
+    if (relativeDir && fs3.existsSync(path5.join(current.dir, "package.json"))) {
       found.push(relativeDir);
       if (found.length >= maxDirs) break;
     }
     if (current.depth >= maxDepth) continue;
-    for (const entry of fs2.readdirSync(current.dir, { withFileTypes: true })) {
+    for (const entry of fs3.readdirSync(current.dir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       if (IGNORED_SCAN_DIRS.has(entry.name)) continue;
-      stack.push({ dir: path4.join(current.dir, entry.name), depth: current.depth + 1 });
+      stack.push({ dir: path5.join(current.dir, entry.name), depth: current.depth + 1 });
     }
   }
   return found.sort();
@@ -1136,35 +1261,22 @@ function discoverWorkspacePackageDirs(root, options = {}) {
   if (patterns.length === 0) return [];
   return collectPackageDirs(root, options).filter((relativeDir) => patterns.some((pattern) => matchesWorkspacePattern(relativeDir, pattern)));
 }
-async function resolveInstallCommand(root, runner) {
-  if (await commandExists("pnpm", { runner })) {
-    return { command: "pnpm", args: [...DEFAULT_INSTALL_ARGS] };
-  }
-  if (await commandExists("corepack", { runner })) {
-    const version = validatedPnpmVersionToken(root);
-    if (String(packageJson(root)?.packageManager || "").trim() && !version) {
-      throw new Error(`[vo-mcp runner] invalid pnpm packageManager token in ${path4.join(root, "package.json")}`);
-    }
-    return { command: "corepack", args: [version ? `pnpm@${version}` : "pnpm", ...DEFAULT_INSTALL_ARGS] };
-  }
-  throw new Error("[vo-mcp runner] pnpm hydration requires `pnpm` or `corepack` on PATH.");
-}
 async function runInstall(root, options = {}) {
   const runner = options.runner || runProcess;
-  const tuple = await resolveInstallCommand(root, runner);
+  const tuple = await resolvePnpmInstallCommand(root, { ...options, runner });
   const result = await runner(tuple.command, tuple.args, {
     cwd: root,
     timeoutMs: options.timeoutMs ?? DEFAULT_INSTALL_TIMEOUT_MS
   });
   if (result.status !== 0) {
     throw new Error(
-      `[vo-mcp runner] pnpm hydration failed for ${root}: ${summarizeProcessFailure(result)} (command: ${[tuple.command, ...tuple.args].join(" ")})`
+      `[vo-mcp runner] pnpm hydration failed for ${root}: ${summarizeProcessFailure(result)} (command: ${tuple.displayCommand.join(" ")})`
     );
   }
 }
 async function hasReadyNodeModules(root) {
-  const nodeModules = path4.join(root, "node_modules");
-  return await pathExists4(path4.join(nodeModules, ".modules.yaml")) || await pathExists4(path4.join(nodeModules, ".pnpm"));
+  const nodeModules = path5.join(root, "node_modules");
+  return await pathExists4(path5.join(nodeModules, ".modules.yaml")) || await pathExists4(path5.join(nodeModules, ".pnpm"));
 }
 function hydrationFsApi(overrides = {}) {
   return { ...createPnpmFsApi(pathExists4), ...overrides };
@@ -1201,7 +1313,7 @@ async function ensurePnpmHydration(root, options = {}) {
     expectedHash: hash,
     requireMarker: false
   });
-  if (!health.healthy && await fsApi.pathExists(path4.join(root, "node_modules"))) {
+  if (!health.healthy && await fsApi.pathExists(path5.join(root, "node_modules"))) {
     quarantine = await quarantineCanonicalNodeModules(root, health.issues, {
       fsApi,
       logger: options.logger
@@ -1213,7 +1325,7 @@ async function ensurePnpmHydration(root, options = {}) {
   }
   const linkedWorkspaceDirs = [];
   for (const relativeDir of workspaceDirs) {
-    if (await pathExists4(path4.join(root, relativeDir, "node_modules"))) {
+    if (await pathExists4(path5.join(root, relativeDir, "node_modules"))) {
       linkedWorkspaceDirs.push(relativeDir);
     }
   }
@@ -1249,18 +1361,18 @@ async function linkHydratedNodeModules({ root, worktreeDir, hydration, options =
       yieldEvery: Math.max(1, options.yieldEvery ?? DEFAULT_YIELD_EVERY2)
     }
   };
-  recordOwnedNodeModulesRoot(dependencyOwnership, path4.join(worktreeDir, "node_modules"));
+  recordOwnedNodeModulesRoot(dependencyOwnership, path5.join(worktreeDir, "node_modules"));
   await materializeNodeModulesForest(
-    path4.join(root, "node_modules"),
-    path4.join(worktreeDir, "node_modules"),
+    path5.join(root, "node_modules"),
+    path5.join(worktreeDir, "node_modules"),
     root,
     worktreeDir,
     materializeOptions
   );
   for (const relativeDir of hydration.linkedWorkspaceDirs) {
-    const sourceNodeModules = path4.join(root, relativeDir, "node_modules");
-    const targetNodeModules = path4.join(worktreeDir, relativeDir, "node_modules");
-    if (!await fsApi.pathExists(path4.join(worktreeDir, relativeDir))) continue;
+    const sourceNodeModules = path5.join(root, relativeDir, "node_modules");
+    const targetNodeModules = path5.join(worktreeDir, relativeDir, "node_modules");
+    if (!await fsApi.pathExists(path5.join(worktreeDir, relativeDir))) continue;
     recordOwnedNodeModulesRoot(dependencyOwnership, targetNodeModules);
     await materializeNodeModulesForest(sourceNodeModules, targetNodeModules, root, worktreeDir, materializeOptions);
   }
@@ -1271,22 +1383,16 @@ async function linkHydratedNodeModules({ root, worktreeDir, hydration, options =
     workspaceCount: hydration.linkedWorkspaceDirs.length
   };
 }
-var DEFAULT_INSTALL_TIMEOUT_MS, DEFAULT_INSTALL_ARGS, DEFAULT_YIELD_EVERY2, IGNORED_SCAN_DIRS, SAFE_PNPM_VERSION_RE;
+var DEFAULT_INSTALL_TIMEOUT_MS, DEFAULT_YIELD_EVERY2, IGNORED_SCAN_DIRS;
 var init_pnpm_hydration = __esm({
   "src/runner/pnpm-hydration.mjs"() {
     "use strict";
     init_pnpm_canonical_health();
+    init_pnpm_command();
     init_pnpm_materialize();
     init_process_runner();
     init_pnpm_link_detach();
     DEFAULT_INSTALL_TIMEOUT_MS = 20 * 60 * 1e3;
-    DEFAULT_INSTALL_ARGS = Object.freeze([
-      "install",
-      "--frozen-lockfile",
-      "--prefer-offline",
-      "--ignore-scripts",
-      "--config.confirmModulesPurge=false"
-    ]);
     DEFAULT_YIELD_EVERY2 = 25;
     IGNORED_SCAN_DIRS = /* @__PURE__ */ new Set([
       ".agent-worktrees",
@@ -1299,34 +1405,33 @@ var init_pnpm_hydration = __esm({
       "dist",
       "node_modules"
     ]);
-    SAFE_PNPM_VERSION_RE = /^[0-9A-Za-z._+-]+$/u;
   }
 });
 
 // src/runner/worktree-paths.mjs
 import { createHash as createHash2 } from "node:crypto";
-import path5 from "node:path";
+import path6 from "node:path";
 function samePath(left, right) {
-  const a = path5.resolve(left);
-  const b = path5.resolve(right);
+  const a = path6.resolve(left);
+  const b = path6.resolve(right);
   return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
 }
 function worktreePoolForRoot(root, { clonesRootDir = process.env.VO_CODE_RUNNER_CLONES_ROOT || "" } = {}) {
-  const canonicalRoot = path5.resolve(root);
+  const canonicalRoot = path6.resolve(root);
   if (clonesRootDir) {
-    const clonePool = path5.resolve(clonesRootDir);
-    if (samePath(path5.dirname(canonicalRoot), clonePool)) {
-      return path5.join(clonePool, ".agent-worktrees", path5.basename(canonicalRoot));
+    const clonePool = path6.resolve(clonesRootDir);
+    if (samePath(path6.dirname(canonicalRoot), clonePool)) {
+      return path6.join(clonePool, ".agent-worktrees", path6.basename(canonicalRoot));
     }
   }
-  return path5.join(canonicalRoot, ".agent-worktrees");
+  return path6.join(canonicalRoot, ".agent-worktrees");
 }
 function worktreeDirForName(root, worktreeName, options = {}) {
   const leaf = createHash2("sha256").update(String(worktreeName)).digest("hex").slice(0, 16);
-  return path5.join(worktreePoolForRoot(root, options), leaf);
+  return path6.join(worktreePoolForRoot(root, options), leaf);
 }
 function recoveryLedgerPathForRoot(root, options = {}) {
-  return path5.join(worktreePoolForRoot(root, options), "recovery-ledger.jsonl");
+  return path6.join(worktreePoolForRoot(root, options), "recovery-ledger.jsonl");
 }
 var init_worktree_paths = __esm({
   "src/runner/worktree-paths.mjs"() {
@@ -1335,9 +1440,9 @@ var init_worktree_paths = __esm({
 });
 
 // src/runner/worktree-cleanup.mjs
-import fs3 from "node:fs";
+import fs4 from "node:fs";
 import fsp6 from "node:fs/promises";
-import path6 from "node:path";
+import path7 from "node:path";
 function stateFromEntry(entry) {
   return {
     root: entry.root,
@@ -1378,14 +1483,14 @@ function pruneSuccessfulStates(nowMs = Date.now()) {
 function assertTrackedCleanupPath(entry) {
   const poolRoot = worktreePoolForRoot(entry.root);
   const expected = worktreeDirForName(entry.root, entry.worktreeName);
-  const resolvedPool = path6.resolve(poolRoot);
-  const resolvedTarget = path6.resolve(entry.worktreeDir);
-  if (!resolvedTarget.startsWith(`${resolvedPool}${path6.sep}`)) {
+  const resolvedPool = path7.resolve(poolRoot);
+  const resolvedTarget = path7.resolve(entry.worktreeDir);
+  if (!resolvedTarget.startsWith(`${resolvedPool}${path7.sep}`)) {
     const error = new Error(`cleanup refused outside managed pool: ${entry.worktreeDir}`);
     error.cleanupFatal = true;
     throw error;
   }
-  if (resolvedTarget !== path6.resolve(expected)) {
+  if (resolvedTarget !== path7.resolve(expected)) {
     const error = new Error(`cleanup refused for unexpected tracked path: ${entry.worktreeDir}`);
     error.cleanupFatal = true;
     throw error;
@@ -1399,8 +1504,8 @@ async function worktreeStillRegistered2(root, worktreeDir, gitRunner) {
   if (result.status !== 0) {
     throw new Error(`git worktree list --porcelain failed during cleanup verification: ${summarizeProcessFailure(result)}`);
   }
-  const registered = String(result.stdout || "").split(/\r?\n/u).filter((line) => line.startsWith("worktree ")).map((line) => path6.resolve(line.slice("worktree ".length).trim()));
-  return registered.includes(path6.resolve(worktreeDir));
+  const registered = String(result.stdout || "").split(/\r?\n/u).filter((line) => line.startsWith("worktree ")).map((line) => path7.resolve(line.slice("worktree ".length).trim()));
+  return registered.includes(path7.resolve(worktreeDir));
 }
 function cleanupBackoff(attempt) {
   return 250 * attempt;
@@ -1419,7 +1524,7 @@ async function runCleanupCycle(entry, options) {
     await (options.assertDetachedDependencyLinks || assertDetachedDependencyLinks)(entry.dependencyOwnership);
   }
   const gitRunner = options.gitRunner || runProcess;
-  const pathExists6 = options.pathExists || ((target) => fs3.existsSync(target));
+  const pathExists6 = options.pathExists || ((target) => fs4.existsSync(target));
   const removeResult = await gitRunner("git", ["worktree", "remove", "--force", entry.worktreeDir], {
     cwd: entry.root,
     timeoutMs: 12e4
@@ -1510,7 +1615,7 @@ function scheduleTrackedCleanup(entry, options = {}) {
 }
 function pendingCleanupDirs() {
   return new Set(
-    [...CLEANUP_STATES.values()].filter((state) => state.status === "pending").map((state) => path6.resolve(state.worktreeDir))
+    [...CLEANUP_STATES.values()].filter((state) => state.status === "pending").map((state) => path7.resolve(state.worktreeDir))
   );
 }
 var CLEANUP_STATES, CLEANUP_PROMISES, SUCCESS_HISTORY_LIMIT, SUCCESS_HISTORY_TTL_MS, DEFAULT_CLEANUP_ATTEMPTS;
@@ -1529,15 +1634,15 @@ var init_worktree_cleanup = __esm({
 });
 
 // src/runner/task-root-prepare.mjs
-import fs4 from "node:fs";
+import fs5 from "node:fs";
 import fsp7 from "node:fs/promises";
-import path7 from "node:path";
+import path8 from "node:path";
 function prepLockDir(root) {
-  return path7.join(root, ".agent-worktrees", "runner-root-prep.lock");
+  return path8.join(root, ".agent-worktrees", "runner-root-prep.lock");
 }
 function readLockMeta(lockDir) {
   try {
-    return JSON.parse(fs4.readFileSync(path7.join(lockDir, "owner.json"), "utf8"));
+    return JSON.parse(fs5.readFileSync(path8.join(lockDir, "owner.json"), "utf8"));
   } catch {
     return null;
   }
@@ -1557,13 +1662,13 @@ async function acquirePrepLock(root, options = {}) {
   const staleMs = options.lockStaleMs ?? PREP_LOCK_STALE_MS;
   const sleep3 = options.sleep || sleepMs;
   const lockDir = prepLockDir(root);
-  const ownerPath = path7.join(lockDir, "owner.json");
+  const ownerPath = path8.join(lockDir, "owner.json");
   const deadline = nowMs() + waitMs;
-  fs4.mkdirSync(path7.dirname(lockDir), { recursive: true });
+  fs5.mkdirSync(path8.dirname(lockDir), { recursive: true });
   for (; ; ) {
     try {
-      fs4.mkdirSync(lockDir);
-      fs4.writeFileSync(ownerPath, `${JSON.stringify({
+      fs5.mkdirSync(lockDir);
+      fs5.writeFileSync(ownerPath, `${JSON.stringify({
         pid: process.pid,
         createdAt: new Date(nowMs()).toISOString(),
         root
@@ -1609,16 +1714,16 @@ async function gitText(root, args, options = {}) {
 }
 function canonicalRecoveryDir(root, options = {}) {
   const now = options.now || (() => /* @__PURE__ */ new Date());
-  return path7.join(
-    options.managedPool || path7.join(root, ".agent-worktrees"),
+  return path8.join(
+    options.managedPool || path8.join(root, ".agent-worktrees"),
     ".canonical-recovery",
     `preexisting-${now().toISOString().replace(/[:.]/gu, "-")}`
   );
 }
 function canonicalPath(root, relative) {
-  const resolvedRoot = path7.resolve(root);
-  const target = path7.resolve(root, relative);
-  const prefix = `${resolvedRoot}${path7.sep}`;
+  const resolvedRoot = path8.resolve(root);
+  const target = path8.resolve(root, relative);
+  const prefix = `${resolvedRoot}${path8.sep}`;
   if (!target.startsWith(prefix)) {
     throw new Error(`canonical recovery path escaped the runner clone: ${relative}`);
   }
@@ -1646,7 +1751,7 @@ async function recoverManagedCanonicalResidue(root, options = {}) {
   if (patchResult.status !== 0) {
     throw new Error(`could not preserve canonical tracked changes: ${summarizeProcessFailure(patchResult)}`);
   }
-  await fsp7.writeFile(path7.join(quarantineDir, "tracked.patch"), String(patchResult.stdout || ""), "utf8");
+  await fsp7.writeFile(path8.join(quarantineDir, "tracked.patch"), String(patchResult.stdout || ""), "utf8");
   const symlinks = [];
   for (const relative of paths.untracked) {
     const source = canonicalPath(root, relative);
@@ -1658,13 +1763,13 @@ async function recoverManagedCanonicalResidue(root, options = {}) {
     if (!stat2.isFile()) {
       throw new Error(`canonical recovery refuses unsupported untracked entry: ${relative}`);
     }
-    const target = canonicalPath(path7.join(quarantineDir, "untracked"), relative);
-    await fsp7.mkdir(path7.dirname(target), { recursive: true });
+    const target = canonicalPath(path8.join(quarantineDir, "untracked"), relative);
+    await fsp7.mkdir(path8.dirname(target), { recursive: true });
     await fsp7.copyFile(source, target);
   }
-  await fsp7.writeFile(path7.join(quarantineDir, "manifest.json"), `${JSON.stringify({
+  await fsp7.writeFile(path8.join(quarantineDir, "manifest.json"), `${JSON.stringify({
     recoveredAt: (/* @__PURE__ */ new Date()).toISOString(),
-    canonicalRoot: path7.resolve(root),
+    canonicalRoot: path8.resolve(root),
     canonicalHead: headSha,
     tracked: paths.tracked,
     untracked: paths.untracked,
@@ -1736,19 +1841,19 @@ async function registeredWorktreeDirs(root, options = {}) {
     throw new Error(`git worktree list --porcelain failed while checking managed residue: ${summarizeProcessFailure(listed)}`);
   }
   return new Set(
-    String(listed.stdout || "").split(/\r?\n/u).filter((line) => line.startsWith("worktree ")).map((line) => path7.resolve(line.slice("worktree ".length).trim()))
+    String(listed.stdout || "").split(/\r?\n/u).filter((line) => line.startsWith("worktree ")).map((line) => path8.resolve(line.slice("worktree ".length).trim()))
   );
 }
 async function reportLegacyResiduals(root, options = {}) {
-  const managedRoot = path7.join(root, ".agent-worktrees");
-  if (!fs4.existsSync(managedRoot)) return [];
+  const managedRoot = path8.join(root, ".agent-worktrees");
+  if (!fs5.existsSync(managedRoot)) return [];
   const registered = await registeredWorktreeDirs(root, options);
   const pending = pendingCleanupDirs();
   const found = [];
-  for (const entry of fs4.readdirSync(managedRoot, { withFileTypes: true })) {
+  for (const entry of fs5.readdirSync(managedRoot, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     if (shouldIgnoreManagedEntry(entry.name)) continue;
-    const absolute = path7.resolve(path7.join(managedRoot, entry.name));
+    const absolute = path8.resolve(path8.join(managedRoot, entry.name));
     if (registered.has(absolute)) continue;
     if (pending.has(absolute)) continue;
     found.push(absolute);
@@ -1781,6 +1886,7 @@ var init_task_root_prepare = __esm({
   "src/runner/task-root-prepare.mjs"() {
     "use strict";
     init_pnpm_hydration();
+    init_pnpm_command();
     init_process_runner();
     init_worktree_cleanup();
     PREP_LOCK_WAIT_MS = 20 * 60 * 1e3;
@@ -1816,7 +1922,7 @@ var init_worktree_github_auth = __esm({
 
 // src/runner/worktree-recovery-start.mjs
 import fsp8 from "node:fs/promises";
-import path8 from "node:path";
+import path9 from "node:path";
 async function recordWorktreeStarted(worktreeTarget, meta = {}) {
   if (!worktreeTarget?.worktreeName || !meta.taskId) return null;
   const entry = {
@@ -1831,7 +1937,7 @@ async function recordWorktreeStarted(worktreeTarget, meta = {}) {
     reason: "worktree allocated before execution"
   };
   const ledger = recoveryLedgerPathForRoot(worktreeTarget.root || process.cwd());
-  await fsp8.mkdir(path8.dirname(ledger), { recursive: true });
+  await fsp8.mkdir(path9.dirname(ledger), { recursive: true });
   await fsp8.appendFile(ledger, `${JSON.stringify(entry)}
 `, "utf8");
   return { entry, ledger };
@@ -1844,9 +1950,9 @@ var init_worktree_recovery_start = __esm({
 });
 
 // src/runner/worktree-helper.mjs
-import fs5 from "node:fs";
+import fs6 from "node:fs";
 import fsp9 from "node:fs/promises";
-import path9 from "node:path";
+import path10 from "node:path";
 function repoRoot() {
   return process.env.VO_CODE_RUNNER_REPO || process.cwd();
 }
@@ -1862,7 +1968,7 @@ function cloneDirForSlug(repoSlug, clonesRootDir) {
   const [owner, name] = String(repoSlug).split("/");
   if (owner === "." || owner === ".." || name === "." || name === "..") return null;
   if (owner.startsWith("-") || name.startsWith("-")) return null;
-  return path9.join(clonesRootDir, `${sanitize(owner, "owner")}__${sanitize(name, "repo")}`);
+  return path10.join(clonesRootDir, `${sanitize(owner, "owner")}__${sanitize(name, "repo")}`);
 }
 function cloneLockDir(dir) {
   return `${dir}.clone-lock`;
@@ -1877,7 +1983,7 @@ async function pathExists5(target) {
 }
 async function readLockMeta2(lockDir) {
   try {
-    return JSON.parse(await fsp9.readFile(path9.join(lockDir, "owner.json"), "utf8"));
+    return JSON.parse(await fsp9.readFile(path10.join(lockDir, "owner.json"), "utf8"));
   } catch {
     return null;
   }
@@ -1898,11 +2004,11 @@ async function acquireCloneLock(dir, options = {}) {
   const sleep3 = options.sleep || sleepMs;
   const lockDir = cloneLockDir(dir);
   const deadline = nowMs() + waitMs;
-  await fsp9.mkdir(path9.dirname(lockDir), { recursive: true });
+  await fsp9.mkdir(path10.dirname(lockDir), { recursive: true });
   for (; ; ) {
     try {
       await fsp9.mkdir(lockDir);
-      await fsp9.writeFile(path9.join(lockDir, "owner.json"), `${JSON.stringify({
+      await fsp9.writeFile(path10.join(lockDir, "owner.json"), `${JSON.stringify({
         pid: process.pid,
         createdAt: new Date(nowMs()).toISOString(),
         dir
@@ -1931,7 +2037,7 @@ async function acquireCloneLock(dir, options = {}) {
   }
 }
 async function isUsableGitClone(dir, runner = runProcess) {
-  if (!await pathExists5(path9.join(dir, ".git"))) return false;
+  if (!await pathExists5(path10.join(dir, ".git"))) return false;
   const result = await runner("git", ["-C", dir, "rev-parse", "HEAD"], { timeoutMs: 1e4 });
   return result.status === 0 && Boolean(String(result.stdout || "").trim());
 }
@@ -1952,7 +2058,7 @@ async function ensureUsableClone(repoSlug, dir, options = {}) {
     const maxAttempts = options.maxAttempts || 5;
     const raceWaitMs = options.raceWaitMs ?? 1e4;
     let lastError = null;
-    await fsp9.mkdir(path9.dirname(dir), { recursive: true });
+    await fsp9.mkdir(path10.dirname(dir), { recursive: true });
     for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
       if (await pathExists5(dir)) {
         if (await waitForUsableClone(dir, runner, sleep3, raceWaitMs)) return dir;
@@ -1964,7 +2070,7 @@ async function ensureUsableClone(repoSlug, dir, options = {}) {
         ["clone", "--no-tags", `https://github.com/${owner}/${name}.git`, tmpDir],
         { timeoutMs: 6e5, env: githubGitAuthEnv(options.githubToken) }
       );
-      if (clone.status !== 0 || !await pathExists5(path9.join(tmpDir, ".git"))) {
+      if (clone.status !== 0 || !await pathExists5(path10.join(tmpDir, ".git"))) {
         await fsp9.rm(tmpDir, { recursive: true, force: true });
         lastError = new Error(`[vo-mcp runner] clone failed for ${repoSlug}: ${describeGitFailure(clone)}`);
         continue;
@@ -1991,7 +2097,7 @@ async function ensureUsableClone(repoSlug, dir, options = {}) {
 }
 async function resolveTaskRoot(repoSlug, options = {}) {
   const root = clonesRoot();
-  if (root && !path9.isAbsolute(root)) {
+  if (root && !path10.isAbsolute(root)) {
     throw new Error(`[vo-mcp runner] VO_CODE_RUNNER_CLONES_ROOT must be an absolute path (got '${root}')`);
   }
   const dir = cloneDirForSlug(repoSlug, root);
@@ -2040,7 +2146,7 @@ async function createFixWorktree(kind, error = {}, options = {}) {
   const dependencyOwnership = createDependencyOwnershipTracker(worktreeDir);
   const prep = await prepare(root, {
     recoverDirtyCanonical: multiRepo,
-    managedPool: path9.dirname(worktreeDir)
+    managedPool: path10.dirname(worktreeDir)
   });
   await processRunner("git", ["config", "core.longpaths", "true"], { cwd: root, timeoutMs: 3e4 });
   const add = await addWorktree({ root, branchName, worktreeDir });
@@ -2106,8 +2212,8 @@ function preserveFailedWorktree(worktreeName, meta = {}) {
   };
   try {
     const ledger = recoveryLedgerPathForRoot(root);
-    fs5.mkdirSync(path9.dirname(ledger), { recursive: true });
-    fs5.appendFileSync(ledger, `${JSON.stringify(entry)}
+    fs6.mkdirSync(path10.dirname(ledger), { recursive: true });
+    fs6.appendFileSync(ledger, `${JSON.stringify(entry)}
 `, "utf8");
     console.error(`[vo-mcp runner] Preserved worktree ${worktreeName} (reason: ${entry.reason})`);
   } catch (error) {
@@ -2152,9 +2258,9 @@ function partitionRecoveryLedger(lines, { nowMs, ttlMs = PRESERVED_WORKTREE_TTL_
   return decisions;
 }
 function isManagedPreservedDir(dir, root = repoRoot()) {
-  const normalized = path9.resolve(String(dir || ""));
-  const pool = path9.resolve(worktreePoolForRoot(root));
-  return normalized.startsWith(pool + path9.sep);
+  const normalized = path10.resolve(String(dir || ""));
+  const pool = path10.resolve(worktreePoolForRoot(root));
+  return normalized.startsWith(pool + path10.sep);
 }
 function mergeAppendedSinceRead(originalRaw, currentRaw, keptLines) {
   const originalSet = new Set(String(originalRaw || "").split(/\r?\n/u).map((l) => l.trim()).filter(Boolean));
@@ -2173,15 +2279,15 @@ function writeLedgerAtomic(ledger, lines, logger) {
   const payload = lines.length ? `${lines.join("\n")}
 ` : "";
   const tmp = `${ledger}.tmp-${process.pid}-${Date.now()}`;
-  fs5.writeFileSync(tmp, payload, "utf8");
+  fs6.writeFileSync(tmp, payload, "utf8");
   for (let attempt = 1; ; attempt += 1) {
     try {
-      fs5.renameSync(tmp, ledger);
+      fs6.renameSync(tmp, ledger);
       return true;
     } catch (error) {
       if (attempt >= 3) {
         try {
-          fs5.rmSync(tmp, { force: true });
+          fs6.rmSync(tmp, { force: true });
         } catch {
         }
         logger(`[vo-mcp runner] GC could not compact recovery ledger: ${String(error?.message || error)}`);
@@ -2203,14 +2309,14 @@ async function sweepPreservedWorktrees({
   const ledger = recoveryLedgerPathForRoot(root);
   let raw;
   try {
-    raw = fs5.readFileSync(ledger, "utf8");
+    raw = fs6.readFileSync(ledger, "utf8");
   } catch {
     return { removed: 0, compacted: 0 };
   }
   const decisions = partitionRecoveryLedger(raw.split(/\r?\n/u), {
     nowMs,
     ttlMs,
-    dirExists: (dir) => fs5.existsSync(dir)
+    dirExists: (dir) => fs6.existsSync(dir)
   });
   let removed = 0;
   let compacted = 0;
@@ -2250,7 +2356,7 @@ async function sweepPreservedWorktrees({
   if (compacted > 0) {
     let currentRaw = raw;
     try {
-      currentRaw = fs5.readFileSync(ledger, "utf8");
+      currentRaw = fs6.readFileSync(ledger, "utf8");
     } catch {
     }
     writeLedgerAtomic(ledger, mergeAppendedSinceRead(raw, currentRaw, output), logger);
@@ -2508,11 +2614,11 @@ function createControlPlaneClient({
   const resolvedBaseUrl = baseUrl ?? env2.VO_CONTROL_PLANE_URL ?? "";
   if (!resolvedBaseUrl) throw new Error("VO_CONTROL_PLANE_URL is required for the code-runner daemon");
   const root = resolvedBaseUrl.replace(/\/+$/, "");
-  async function req(method, path19, body, { timeoutMs } = {}) {
+  async function req(method, path20, body, { timeoutMs } = {}) {
     const bearer = await resolveBearer(env2);
     const controller = timeoutMs ? new AbortController() : null;
     let timeoutId;
-    const request = Promise.resolve(fetchImpl(`${root}${path19}`, {
+    const request = Promise.resolve(fetchImpl(`${root}${path20}`, {
       method,
       headers: {
         "content-type": "application/json",
@@ -2525,7 +2631,7 @@ function createControlPlaneClient({
     const timeout = new Promise((_, reject) => {
       timeoutId = setTimeout(() => {
         controller.abort();
-        reject(new Error(`control-plane ${path19} timed out after ${timeoutMs}ms`));
+        reject(new Error(`control-plane ${path20} timed out after ${timeoutMs}ms`));
       }, timeoutMs);
     });
     try {
@@ -2534,7 +2640,7 @@ function createControlPlaneClient({
       clearTimeout(timeoutId);
     }
   }
-  const taskReq = (method, path19, body, options = {}) => req(method, path19, body, { timeoutMs: taskRequestTimeoutMs, ...options });
+  const taskReq = (method, path20, body, options = {}) => req(method, path20, body, { timeoutMs: taskRequestTimeoutMs, ...options });
   return {
     ...makeAutonomousDispatchAdmissionClient(
       req,
@@ -2657,8 +2763,8 @@ function createControlPlaneClient({
       return listAllPrOpenedTasks(taskReq);
     },
     async downloadTaskAttachment(taskId, attachmentId) {
-      const path19 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
-      const res = await taskReq("GET", path19);
+      const path20 = `/api/v1/code-task/${encodeURIComponent(taskId)}/attachment/${encodeURIComponent(attachmentId)}`;
+      const res = await taskReq("GET", path20);
       if (res.status === 401) cachedFirebaseToken = null;
       if (!res.ok) throw new Error(`attachment download failed: HTTP ${res.status}`);
       return Buffer.from(await res.arrayBuffer());
@@ -2852,8 +2958,8 @@ var init_control_plane_client = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/windows-claude-launch.mjs
-import { existsSync as existsSync2, realpathSync } from "node:fs";
-import { win32 as path10 } from "node:path";
+import { existsSync as existsSync3, realpathSync } from "node:fs";
+import { win32 as path11 } from "node:path";
 import { spawnSync } from "node:child_process";
 function pathValue(env2) {
   for (const key of ["Path", "PATH", "path"]) {
@@ -2874,38 +2980,38 @@ function envValue(env2, name) {
 function userClaudeCandidates(bin, env2) {
   if (!/^claude(?:\.(?:exe|cmd|ps1))?$/iu.test(bin)) return [];
   const userProfile = envValue(env2, "USERPROFILE");
-  const appData = envValue(env2, "APPDATA") || (userProfile ? path10.join(userProfile, "AppData", "Roaming") : "");
-  const localAppData = envValue(env2, "LOCALAPPDATA") || (userProfile ? path10.join(userProfile, "AppData", "Local") : "");
+  const appData = envValue(env2, "APPDATA") || (userProfile ? path11.join(userProfile, "AppData", "Roaming") : "");
+  const localAppData = envValue(env2, "LOCALAPPDATA") || (userProfile ? path11.join(userProfile, "AppData", "Local") : "");
   const candidates = [];
   if (appData) {
-    const npmBin = path10.join(appData, "npm");
+    const npmBin = path11.join(appData, "npm");
     candidates.push(
-      path10.join(npmBin, "claude.exe"),
-      path10.join(npmBin, "claude.cmd"),
-      path10.join(npmBin, "claude.ps1"),
-      path10.join(npmBin, "claude"),
-      path10.join(npmBin, ...NATIVE_CLAUDE_PARTS)
+      path11.join(npmBin, "claude.exe"),
+      path11.join(npmBin, "claude.cmd"),
+      path11.join(npmBin, "claude.ps1"),
+      path11.join(npmBin, "claude"),
+      path11.join(npmBin, ...NATIVE_CLAUDE_PARTS)
     );
   }
-  if (userProfile) candidates.push(path10.join(userProfile, ".local", "bin", "claude.exe"));
+  if (userProfile) candidates.push(path11.join(userProfile, ".local", "bin", "claude.exe"));
   if (localAppData) {
     candidates.push(
-      path10.join(localAppData, "Microsoft", "WinGet", "Links", "claude.exe"),
-      path10.join(localAppData, "Microsoft", "WindowsApps", "claude.exe")
+      path11.join(localAppData, "Microsoft", "WinGet", "Links", "claude.exe"),
+      path11.join(localAppData, "Microsoft", "WindowsApps", "claude.exe")
     );
   }
   return candidates;
 }
 function pathCandidates(bin, env2) {
-  if (path10.isAbsolute(bin) || /[\\/]/u.test(bin)) {
-    return [path10.resolve(bin)];
-  }
-  const extension = path10.extname(bin);
-  const fromPath = pathValue(env2).split(";").map(cleanPathSegment).filter(Boolean).flatMap((directory) => extension ? [path10.join(directory, bin)] : [
-    path10.join(directory, `${bin}.exe`),
-    path10.join(directory, `${bin}.cmd`),
-    path10.join(directory, `${bin}.ps1`),
-    path10.join(directory, bin)
+  if (path11.isAbsolute(bin) || /[\\/]/u.test(bin)) {
+    return [path11.resolve(bin)];
+  }
+  const extension = path11.extname(bin);
+  const fromPath = pathValue(env2).split(";").map(cleanPathSegment).filter(Boolean).flatMap((directory) => extension ? [path11.join(directory, bin)] : [
+    path11.join(directory, `${bin}.exe`),
+    path11.join(directory, `${bin}.cmd`),
+    path11.join(directory, `${bin}.ps1`),
+    path11.join(directory, bin)
   ]);
   const seen = /* @__PURE__ */ new Set();
   return [...fromPath, ...userClaudeCandidates(bin, env2)].filter((candidate) => {
@@ -2926,7 +3032,7 @@ function canonicalExistingPath(candidate, exists, canonicalize) {
 function resolveWindowsClaudeExecutable({
   bin = "claude",
   env: env2 = process.env,
-  exists = existsSync2,
+  exists = existsSync3,
   canonicalize = realpathSync
 } = {}) {
   const requested = String(bin || "").trim();
@@ -2936,8 +3042,8 @@ function resolveWindowsClaudeExecutable({
   for (const candidate of pathCandidates(requested, env2)) {
     const found = canonicalExistingPath(candidate, exists, canonicalize);
     if (!found) continue;
-    if (path10.extname(found).toLowerCase() === ".exe") return found;
-    const native = path10.join(path10.dirname(found), ...NATIVE_CLAUDE_PARTS);
+    if (path11.extname(found).toLowerCase() === ".exe") return found;
+    const native = path11.join(path11.dirname(found), ...NATIVE_CLAUDE_PARTS);
     const resolvedNative = canonicalExistingPath(native, exists, canonicalize);
     if (resolvedNative) return resolvedNative;
   }
@@ -3001,6 +3107,62 @@ var init_windows_claude_launch = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/claude-credential-choice.mjs
+function isTruthyFlag(v) {
+  const s = String(v ?? "").trim().toLowerCase();
+  return s === "1" || s === "true" || s === "yes" || s === "on";
+}
+function wantsLogin(env2) {
+  return isTruthyFlag(env2[CLAUDE_PREFER_LOGIN_ENV]) || isTruthyFlag(env2[PREFER_LOGIN_ENV]);
+}
+function wantsKey(env2) {
+  return isTruthyFlag(env2[CLAUDE_PREFER_KEY_ENV]) || isTruthyFlag(env2[PREFER_KEY_ENV]);
+}
+function classifyClaudeCredential(baseEnv = {}, { getKey, probeLogin } = {}) {
+  const preferKey = wantsKey(baseEnv);
+  if (!preferKey && wantsLogin(baseEnv)) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.PREFER_LOGIN, key: null };
+  }
+  if (baseEnv.ANTHROPIC_API_KEY) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.ENV_KEY, key: null };
+  }
+  const key = getKey();
+  if (!key) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.NO_KEY, key: null };
+  }
+  if (preferKey) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN_PREFER_KEY, key };
+  }
+  if (probeLogin() === true) {
+    return { source: CLAUDE_CREDENTIAL_SOURCE.SUBSCRIPTION_WINS, key: null };
+  }
+  return { source: CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN, key };
+}
+var PREFER_LOGIN_ENV, CLAUDE_PREFER_LOGIN_ENV, PREFER_KEY_ENV, CLAUDE_PREFER_KEY_ENV, CLAUDE_CREDENTIAL_SOURCE;
+var init_claude_credential_choice = __esm({
+  "../../scripts/virtual-office/code-runner/claude-credential-choice.mjs"() {
+    "use strict";
+    PREFER_LOGIN_ENV = "VO_RUNNER_PREFER_LOGIN";
+    CLAUDE_PREFER_LOGIN_ENV = "VO_RUNNER_CLAUDE_PREFER_LOGIN";
+    PREFER_KEY_ENV = "VO_RUNNER_PREFER_KEY";
+    CLAUDE_PREFER_KEY_ENV = "VO_RUNNER_CLAUDE_PREFER_KEY";
+    CLAUDE_CREDENTIAL_SOURCE = Object.freeze({
+      /** PREFER_LOGIN set (and not overridden): any API key is ignored. */
+      PREFER_LOGIN: "prefer_login",
+      /** An explicit ANTHROPIC_API_KEY in the environment — the manual override. */
+      ENV_KEY: "env_key",
+      /** No key anywhere; the spawn falls through to the login session. */
+      NO_KEY: "no_key",
+      /** A stored key, used because the operator explicitly opted out of tier 1. */
+      KEYCHAIN_PREFER_KEY: "keychain_prefer_key",
+      /** A stored key exists but a proven live subscription outranks it. */
+      SUBSCRIPTION_WINS: "subscription_wins",
+      /** A stored key, used because no live subscription was proven. */
+      KEYCHAIN: "keychain"
+    });
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/anthropic-key-store.mjs
 import { createRequire as createRequire2 } from "node:module";
 import { spawnSync as spawnSync2 } from "node:child_process";
@@ -3022,46 +3184,22 @@ function getAnthropicKey({ EntryCtor = defaultEntryCtor() } = {}) {
     return null;
   }
 }
-function isTruthyFlag(v) {
-  const s = String(v ?? "").trim().toLowerCase();
-  return s === "1" || s === "true" || s === "yes" || s === "on";
-}
-function wantsLogin(env2) {
-  return isTruthyFlag(env2[CLAUDE_PREFER_LOGIN_ENV]) || isTruthyFlag(env2[PREFER_LOGIN_ENV]);
-}
-function wantsKey(env2) {
-  return isTruthyFlag(env2[CLAUDE_PREFER_KEY_ENV]) || isTruthyFlag(env2[PREFER_KEY_ENV]);
-}
 function withAnthropicKey(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
-  const preferKey = wantsKey(baseEnv);
-  if (!preferKey && wantsLogin(baseEnv)) {
-    const next = { ...baseEnv };
+  const { source, key } = classifyClaudeCredential(baseEnv, { getKey, probeLogin });
+  const next = { ...baseEnv };
+  if (source === CLAUDE_CREDENTIAL_SOURCE.PREFER_LOGIN) {
     delete next.ANTHROPIC_API_KEY;
     return next;
   }
-  if (baseEnv.ANTHROPIC_API_KEY) return { ...baseEnv };
-  const key = getKey();
-  if (!key) return { ...baseEnv };
-  if (!preferKey && probeLogin() === true) return { ...baseEnv };
-  return { ...baseEnv, ANTHROPIC_API_KEY: key };
+  if (key !== null) next.ANTHROPIC_API_KEY = key;
+  return next;
 }
 function claudeCostBasis(env2 = process.env) {
   return String(env2.ANTHROPIC_API_KEY || "").trim() ? "vendor_billed" : "subscription_api_equivalent";
 }
 function describeAnthropicAuthSource(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
-  const preferKey = wantsKey(baseEnv);
-  if (!preferKey && wantsLogin(baseEnv)) {
-    return "claude auth login (VO_RUNNER_PREFER_LOGIN set \u2014 any API key ignored)";
-  }
-  if (baseEnv.ANTHROPIC_API_KEY) return "ANTHROPIC_API_KEY from environment";
-  if (!getKey()) return "claude auth login session (no API key set)";
-  if (preferKey) {
-    return "ANTHROPIC_API_KEY from OS keychain (VO_RUNNER_PREFER_KEY set \u2014 subscription ignored)";
-  }
-  if (probeLogin() === true) {
-    return "claude auth login session (subscription beats the stored keychain key)";
-  }
-  return "ANTHROPIC_API_KEY from OS keychain";
+  const { source } = classifyClaudeCredential(baseEnv, { getKey, probeLogin });
+  return AUTH_SOURCE_DESCRIPTION[source];
 }
 function augmentAuthError(summary) {
   const s = String(summary ?? "");
@@ -3083,19 +3221,25 @@ function probeClaudeLoginState({
     return null;
   }
 }
-var require2, KEY_SERVICE, KEY_ACCOUNT, _entryCtor, _loadTried, PREFER_LOGIN_ENV, CLAUDE_PREFER_LOGIN_ENV, PREFER_KEY_ENV, CLAUDE_PREFER_KEY_ENV, AUTH_ERROR_RE;
+var require2, KEY_SERVICE, KEY_ACCOUNT, _entryCtor, _loadTried, AUTH_SOURCE_DESCRIPTION, AUTH_ERROR_RE;
 var init_anthropic_key_store = __esm({
   "../../scripts/virtual-office/code-runner/anthropic-key-store.mjs"() {
     "use strict";
     init_windows_claude_launch();
+    init_claude_credential_choice();
+    init_claude_credential_choice();
     require2 = createRequire2(import.meta.url);
     KEY_SERVICE = "algosuite-vo";
     KEY_ACCOUNT = "anthropic-api-key";
     _loadTried = false;
-    PREFER_LOGIN_ENV = "VO_RUNNER_PREFER_LOGIN";
-    CLAUDE_PREFER_LOGIN_ENV = "VO_RUNNER_CLAUDE_PREFER_LOGIN";
-    PREFER_KEY_ENV = "VO_RUNNER_PREFER_KEY";
-    CLAUDE_PREFER_KEY_ENV = "VO_RUNNER_CLAUDE_PREFER_KEY";
+    AUTH_SOURCE_DESCRIPTION = Object.freeze({
+      [CLAUDE_CREDENTIAL_SOURCE.PREFER_LOGIN]: "claude auth login (VO_RUNNER_PREFER_LOGIN set \u2014 any API key ignored)",
+      [CLAUDE_CREDENTIAL_SOURCE.ENV_KEY]: "ANTHROPIC_API_KEY from environment",
+      [CLAUDE_CREDENTIAL_SOURCE.NO_KEY]: "claude auth login session (no API key set)",
+      [CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN_PREFER_KEY]: "ANTHROPIC_API_KEY from OS keychain (VO_RUNNER_PREFER_KEY set \u2014 subscription ignored)",
+      [CLAUDE_CREDENTIAL_SOURCE.SUBSCRIPTION_WINS]: "claude auth login session (subscription beats the stored keychain key)",
+      [CLAUDE_CREDENTIAL_SOURCE.KEYCHAIN]: "ANTHROPIC_API_KEY from OS keychain"
+    });
     AUTH_ERROR_RE = /\b401\b|invalid[^.]{0,24}(authentication|credential)|authentication_error|unauthorized|not[ _-]?authenticated/i;
   }
 });
@@ -3366,14 +3510,14 @@ var init_terminal_process_cleanup = __esm({
 
 // ../../scripts/virtual-office/code-runner/orphan-agent-reaper.mjs
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import os from "node:os";
-import path11 from "node:path";
+import path12 from "node:path";
 function registryRoot(tmp = os.tmpdir()) {
-  return path11.join(tmp, REGISTRY_ROOT_NAME);
+  return path12.join(tmp, REGISTRY_ROOT_NAME);
 }
 function instanceDir(root, instanceId) {
-  return path11.join(root, String(instanceId).replace(/[^A-Za-z0-9_-]/g, ""));
+  return path12.join(root, String(instanceId).replace(/[^A-Za-z0-9_-]/g, ""));
 }
 function registerDaemonInstance({
   root = registryRoot(),
@@ -3383,8 +3527,8 @@ function registerDaemonInstance({
 } = {}) {
   if (!instanceId) return null;
   const dir = instanceDir(root, instanceId);
-  mkdirSync2(dir, { recursive: true });
-  const file = path11.join(dir, DAEMON_RECORD);
+  mkdirSync3(dir, { recursive: true });
+  const file = path12.join(dir, DAEMON_RECORD);
   writeFileSync2(file, JSON.stringify({ daemonPid, daemonStartedAtMs, instanceId }), {
     encoding: "utf8",
     mode: 384
@@ -3401,9 +3545,9 @@ function recordAgentPid({
   if (!instanceId || !Number.isInteger(pid) || pid <= 0) return false;
   try {
     const dir = instanceDir(root, instanceId);
-    mkdirSync2(dir, { recursive: true });
+    mkdirSync3(dir, { recursive: true });
     writeFileSync2(
-      path11.join(dir, `${pid}.json`),
+      path12.join(dir, `${pid}.json`),
       JSON.stringify({ pid, agentId, startedAtMs, instanceId }),
       { encoding: "utf8", mode: 384 }
     );
@@ -3419,7 +3563,7 @@ function unrecordAgentPid({
 } = {}) {
   if (!instanceId || !Number.isInteger(pid)) return false;
   try {
-    rmSync2(path11.join(instanceDir(root, instanceId), `${pid}.json`), { force: true });
+    rmSync2(path12.join(instanceDir(root, instanceId), `${pid}.json`), { force: true });
     return true;
   } catch {
     return false;
@@ -3437,7 +3581,7 @@ function bootstrapOrphanReaper({ instanceId, log: log2 = () => {
 }
 function readRegistry({ root = registryRoot(), currentInstanceId } = {}) {
   const instances = [];
-  if (!existsSync3(root)) return instances;
+  if (!existsSync4(root)) return instances;
   let dirents;
   try {
     dirents = readdirSync(root, { withFileTypes: true });
@@ -3447,7 +3591,7 @@ function readRegistry({ root = registryRoot(), currentInstanceId } = {}) {
   for (const dirent of dirents) {
     if (!dirent.isDirectory()) continue;
     if (currentInstanceId && dirent.name === instanceDirName(currentInstanceId)) continue;
-    const dir = path11.join(root, dirent.name);
+    const dir = path12.join(root, dirent.name);
     let daemon = null;
     const agents = [];
     let files;
@@ -3459,7 +3603,7 @@ function readRegistry({ root = registryRoot(), currentInstanceId } = {}) {
     for (const name of files) {
       let parsed;
       try {
-        parsed = JSON.parse(readFileSync2(path11.join(dir, name), "utf8"));
+        parsed = JSON.parse(readFileSync2(path12.join(dir, name), "utf8"));
       } catch {
         continue;
       }
@@ -3507,7 +3651,7 @@ function windowsSystemRoot(env2 = process.env) {
   return env2.SystemRoot || env2.WINDIR || "C:\\Windows";
 }
 function windowsPowershellExe(env2 = process.env) {
-  return path11.join(windowsSystemRoot(env2), "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+  return path12.join(windowsSystemRoot(env2), "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
 }
 function listProcessCreationTimes({ platform = process.platform, spawn: spawn5 = spawnSync5, env: env2 = process.env, warn = console.warn } = {}) {
   const map = /* @__PURE__ */ new Map();
@@ -3552,7 +3696,7 @@ function parsePosixPsLine(line) {
 function killProcessTree(pid, { platform = process.platform, spawn: spawn5 = spawnSync5, env: env2 = process.env } = {}) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   if (platform === "win32") {
-    const taskkill = path11.join(windowsSystemRoot(env2), "System32", "taskkill.exe");
+    const taskkill = path12.join(windowsSystemRoot(env2), "System32", "taskkill.exe");
     const r = spawn5(taskkill, ["/PID", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore", timeout: 15e3 });
     return !r.error && r.status === 0;
   }
@@ -4341,15 +4485,15 @@ var init_flat_token_usage = __esm({
 
 // ../../scripts/virtual-office/code-runner/codex-runner.mjs
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync4 } from "node:fs";
-import { win32 } from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import { win32 as win322 } from "node:path";
 function isTruthyFlag2(value) {
   return ["1", "true", "yes", "on"].includes(String(value ?? "").trim().toLowerCase());
 }
 function resolveCodexBinary({
   env: env2 = process.env,
   platform = process.platform,
-  exists = existsSync4
+  exists = existsSync5
 } = {}) {
   if (platform !== "win32") return "codex";
   const appData = String(env2.APPDATA || "").trim();
@@ -4357,7 +4501,7 @@ function resolveCodexBinary({
   const localAppData = String(env2.LOCALAPPDATA || "").trim();
   const candidates = [];
   if (appData) {
-    candidates.push(win32.join(
+    candidates.push(win322.join(
       appData,
       "npm",
       "node_modules",
@@ -4373,11 +4517,11 @@ function resolveCodexBinary({
     ));
   }
   if (userProfile) {
-    candidates.push(win32.join(userProfile, ".local", "bin", "codex.exe"));
-    candidates.push(win32.join(userProfile, ".codex", "bin", "codex.exe"));
+    candidates.push(win322.join(userProfile, ".local", "bin", "codex.exe"));
+    candidates.push(win322.join(userProfile, ".codex", "bin", "codex.exe"));
   }
   if (localAppData) {
-    candidates.push(win32.join(localAppData, "Microsoft", "WindowsApps", "codex.exe"));
+    candidates.push(win322.join(localAppData, "Microsoft", "WindowsApps", "codex.exe"));
   }
   const absolute = candidates.find((candidate) => exists(candidate));
   if (absolute) return absolute;
@@ -5206,9 +5350,9 @@ var init_rate_limit_detector_core = __esm({
 
 // ../../scripts/virtual-office/code-runner/rate-limit-resume-state.mjs
 import fsp10 from "node:fs/promises";
-import path12 from "node:path";
+import path13 from "node:path";
 async function atomicWrite(file, content) {
-  await fsp10.mkdir(path12.dirname(file), { recursive: true });
+  await fsp10.mkdir(path13.dirname(file), { recursive: true });
   const temp = `${file}.tmp-${process.pid}-${Date.now()}`;
   const handle = await fsp10.open(temp, "wx");
   try {
@@ -5269,7 +5413,7 @@ function writeResumeAttempts(file, store) {
 }
 async function acquireLock(lockFile, { now = Date.now, sleep: sleep3 = delay } = {}) {
   const deadline = now() + LOCK_WAIT_MS;
-  await fsp10.mkdir(path12.dirname(lockFile), { recursive: true });
+  await fsp10.mkdir(path13.dirname(lockFile), { recursive: true });
   for (; ; ) {
     let handle;
     try {
@@ -5343,10 +5487,10 @@ var init_rate_limit_resume_state = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/rate-limit-resume.mjs
-import { homedir as homedir2 } from "node:os";
+import { homedir as homedir3 } from "node:os";
 import { join as join2 } from "node:path";
 function resumeQueuePath() {
-  return join2(homedir2(), ".claude", "resume-queue.jsonl");
+  return join2(homedir3(), ".claude", "resume-queue.jsonl");
 }
 function buildResumeEntry({ task = {}, resumeAfter = null, summary = "", at } = {}) {
   return {
@@ -5547,7 +5691,7 @@ var init_auto_merge = __esm({
 
 // ../../scripts/virtual-office/code-runner/pr-overlap-gate.mjs
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { fileURLToPath } from "node:url";
 function stripCredentials(env2 = process.env) {
   const safe = { ...env2 };
@@ -5558,7 +5702,7 @@ function resolveOverlapScript({
   worktreeDir,
   trustedPath = null,
   trustedPaths = TRUSTED_OVERLAP_CANDIDATES,
-  existsFn = existsSync5,
+  existsFn = existsSync6,
   joinFn = (dir) => `${dir}/scripts/ci/check-local-pr-overlap.mjs`
 } = {}) {
   const candidates = trustedPath ? [trustedPath] : trustedPaths;
@@ -5627,14 +5771,14 @@ function parsePorcelainZ(out) {
   for (let i = 0; i < tokens.length; i += 1) {
     const token2 = tokens[i];
     if (!token2) continue;
-    const path19 = token2.slice(3);
-    if (path19) files.push(path19);
+    const path20 = token2.slice(3);
+    if (path20) files.push(path20);
     if (token2[0] === "R" || token2[0] === "C") i += 1;
   }
   return files;
 }
-function isAgentScratch(path19) {
-  const normalized = String(path19 || "");
+function isAgentScratch(path20) {
+  const normalized = String(path20 || "");
   return SCRATCH_PATTERNS.some((pattern) => pattern.test(normalized));
 }
 var SCRATCH_PATTERNS;
@@ -6467,10 +6611,10 @@ var init_task_prompt = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/task-attachments.mjs
-import { createHash as createHash3, randomUUID } from "node:crypto";
+import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
 import { chmod, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import os2 from "node:os";
-import path13 from "node:path";
+import path14 from "node:path";
 function safeTaskToken(taskId) {
   return String(taskId || "task").replace(/[^0-9A-Za-z_-]/gu, "_").slice(0, 48) || "task";
 }
@@ -6480,25 +6624,25 @@ function sanitizeTaskAttachmentName(name, index = 0) {
   return `${String(index + 1).padStart(2, "0")}-${normalized}`;
 }
 function assertGeneratedDirectory(directory, tempRoot) {
-  const resolvedDirectory = path13.resolve(directory);
-  const resolvedRoot = path13.resolve(tempRoot);
-  if (path13.dirname(resolvedDirectory) !== resolvedRoot || !path13.basename(resolvedDirectory).startsWith(DIRECTORY_PREFIX)) {
+  const resolvedDirectory = path14.resolve(directory);
+  const resolvedRoot = path14.resolve(tempRoot);
+  if (path14.dirname(resolvedDirectory) !== resolvedRoot || !path14.basename(resolvedDirectory).startsWith(DIRECTORY_PREFIX)) {
     throw new Error("refusing to clean an unverified task-attachment directory");
   }
   return resolvedDirectory;
 }
 async function createAttachmentDirectory(taskId, tempRoot) {
-  const root = path13.resolve(tempRoot);
+  const root = path14.resolve(tempRoot);
   await mkdir(root, { recursive: true });
-  const directory = await mkdtemp(path13.join(root, `${DIRECTORY_PREFIX}${safeTaskToken(taskId)}-`));
-  const marker = JSON.stringify({ owner: MARKER_OWNER, token: randomUUID(), directory: path13.basename(directory), created_at: (/* @__PURE__ */ new Date()).toISOString() });
-  await writeFile(path13.join(directory, MARKER_FILE), marker, { encoding: "utf8", mode: 384 });
+  const directory = await mkdtemp(path14.join(root, `${DIRECTORY_PREFIX}${safeTaskToken(taskId)}-`));
+  const marker = JSON.stringify({ owner: MARKER_OWNER, token: randomUUID2(), directory: path14.basename(directory), created_at: (/* @__PURE__ */ new Date()).toISOString() });
+  await writeFile(path14.join(directory, MARKER_FILE), marker, { encoding: "utf8", mode: 384 });
   return { directory, marker, tempRoot: root };
 }
 async function cleanupGeneratedDirectory(state) {
   if (!state || state.cleaned) return;
   const directory = assertGeneratedDirectory(state.directory, state.tempRoot);
-  const marker = await readFile(path13.join(directory, MARKER_FILE), "utf8").catch(() => "");
+  const marker = await readFile(path14.join(directory, MARKER_FILE), "utf8").catch(() => "");
   if (marker !== state.marker) throw new Error("refusing to clean a task-attachment directory without its exact marker");
   await rm(directory, { recursive: true, force: true });
   state.cleaned = true;
@@ -6517,7 +6661,7 @@ async function sweepStaleTaskAttachmentDirectories({
   now = Date.now(),
   maxAgeMs = DEFAULT_STALE_AGE_MS
 } = {}) {
-  const root = path13.resolve(tempRoot);
+  const root = path14.resolve(tempRoot);
   if (!Number.isFinite(maxAgeMs) || maxAgeMs <= 0) throw new Error("stale attachment age must be positive");
   const entries = await readdir(root, { withFileTypes: true }).catch((error) => {
     if (error?.code === "ENOENT") return [];
@@ -6526,8 +6670,8 @@ async function sweepStaleTaskAttachmentDirectories({
   let removed = 0;
   for (const entry of entries) {
     if (!entry.isDirectory() || !entry.name.startsWith(DIRECTORY_PREFIX)) continue;
-    const directory = assertGeneratedDirectory(path13.join(root, entry.name), root);
-    const markerRaw = await readFile(path13.join(directory, MARKER_FILE), "utf8").catch(() => "");
+    const directory = assertGeneratedDirectory(path14.join(root, entry.name), root);
+    const markerRaw = await readFile(path14.join(directory, MARKER_FILE), "utf8").catch(() => "");
     const marker = parseOwnedMarker(markerRaw, entry.name);
     if (!marker) continue;
     const directoryStat = await stat(directory);
@@ -6570,10 +6714,10 @@ async function materializeTaskAttachments(client, task, { tempRoot = os2.tmpdir(
       const sha256 = createHash3("sha256").update(content).digest("hex");
       if (sha256 !== ref.sha256) throw new Error(`attachment ${ref.attachment_id} sha256 mismatch`);
       const name = sanitizeTaskAttachmentName(ref.name, index);
-      const filePath = path13.join(state.directory, name);
+      const filePath = path14.join(state.directory, name);
       await writeFile(filePath, content, { flag: "wx", mode: 384 });
       await chmod(filePath, 384);
-      files.push({ attachmentId: ref.attachment_id, name, mime: ref.mime, sizeBytes: ref.size_bytes, sha256, path: path13.resolve(filePath) });
+      files.push({ attachmentId: ref.attachment_id, name, mime: ref.mime, sizeBytes: ref.size_bytes, sha256, path: path14.resolve(filePath) });
     }
     return { directory: state.directory, files, manifestMarkdown: buildManifest(files), cleanup: () => cleanupGeneratedDirectory(state) };
   } catch (error) {
@@ -6595,7 +6739,7 @@ var init_task_attachments = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/session-spool-forwarder.mjs
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir4 } from "node:os";
 import { join as join4 } from "node:path";
 import { readdir as readdir2, readFile as readFile2, unlink, writeFile as writeFile2 } from "node:fs/promises";
 import { createHash as createHash4 } from "node:crypto";
@@ -6637,9 +6781,9 @@ async function readSpool(spoolDir = SPOOL_DIR) {
   }
   return out;
 }
-async function readCloudMap(path19) {
+async function readCloudMap(path20) {
   try {
-    return JSON.parse(await readFile2(path19, "utf8"));
+    return JSON.parse(await readFile2(path20, "utf8"));
   } catch {
     return {};
   }
@@ -6712,8 +6856,8 @@ var SPOOL_DIR, CLOUD_MAP_FILE, STALE_MS, ACTIVE_SILENCE_MS;
 var init_session_spool_forwarder = __esm({
   "../../scripts/virtual-office/code-runner/session-spool-forwarder.mjs"() {
     "use strict";
-    SPOOL_DIR = join4(homedir3(), ".vo", "session-spool");
-    CLOUD_MAP_FILE = join4(homedir3(), ".vo", "session-cloud-map.json");
+    SPOOL_DIR = join4(homedir4(), ".vo", "session-spool");
+    CLOUD_MAP_FILE = join4(homedir4(), ".vo", "session-cloud-map.json");
     STALE_MS = 60 * 60 * 1e3;
     ACTIVE_SILENCE_MS = 10 * 60 * 1e3;
   }
@@ -7396,7 +7540,7 @@ var init_local_model_remote_config = __esm({
 
 // ../../scripts/virtual-office/code-runner/account-usage/shared.mjs
 import crypto from "node:crypto";
-import fs6 from "node:fs";
+import fs7 from "node:fs";
 function accountKey(agent, rawId) {
   const id = typeof rawId === "string" ? rawId.trim() : "";
   if (!id) return null;
@@ -7443,6 +7587,13 @@ function makeUsageRow({
   }
   return row;
 }
+function readingAgeMs(row, nowMs = Date.now()) {
+  const at = row && typeof row.captured_at === "string" ? row.captured_at : null;
+  if (!at) return null;
+  const ms = new Date(at).getTime();
+  if (!Number.isFinite(ms)) return null;
+  return Math.max(0, nowMs - ms);
+}
 var clampPct, readJson, ACCOUNT_KEY_SALT;
 var init_shared = __esm({
   "../../scripts/virtual-office/code-runner/account-usage/shared.mjs"() {
@@ -7453,7 +7604,7 @@ var init_shared = __esm({
     };
     readJson = (p) => {
       try {
-        return JSON.parse(fs6.readFileSync(p, "utf8"));
+        return JSON.parse(fs7.readFileSync(p, "utf8"));
       } catch {
         return null;
       }
@@ -7463,14 +7614,23 @@ var init_shared = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/account-usage/claude.mjs
+import fs8 from "node:fs";
 import os3 from "node:os";
-import path14 from "node:path";
+import path15 from "node:path";
+function fileCaptureTime(filePath, explicit, statFn) {
+  if (typeof explicit === "string" && explicit) return explicit;
+  try {
+    return statFn(filePath).mtime.toISOString();
+  } catch {
+    return null;
+  }
+}
 function usageBaseUrl(env2 = process.env) {
   const raw = env2.ANTHROPIC_BASE_URL || "https://api.anthropic.com";
   return String(raw).replace(/\/+$/, "");
 }
 function readOAuthToken({ homeDir = os3.homedir(), read = readJson, now = Date.now() } = {}) {
-  const creds = read(path14.join(homeDir, ".claude", ".credentials.json"));
+  const creds = read(path15.join(homeDir, ".claude", ".credentials.json"));
   const oauth = creds && typeof creds === "object" ? creds.claudeAiOauth : null;
   if (!oauth || typeof oauth !== "object") return null;
   const token2 = typeof oauth.accessToken === "string" ? oauth.accessToken.trim() : "";
@@ -7480,7 +7640,7 @@ function readOAuthToken({ homeDir = os3.homedir(), read = readJson, now = Date.n
   return token2;
 }
 function readAccountId({ homeDir = os3.homedir(), read = readJson } = {}) {
-  const cfg = read(path14.join(homeDir, ".claude.json"));
+  const cfg = read(path15.join(homeDir, ".claude.json"));
   const account = cfg && typeof cfg === "object" ? cfg.oauthAccount : null;
   return account && typeof account.accountUuid === "string" ? account.accountUuid : null;
 }
@@ -7570,7 +7730,12 @@ async function readClaudeOAuthUsage({
     clearTimeout(timer);
   }
 }
-function readClaudeFileUsage({ homeDir = os3.homedir(), read: rawRead = readJson } = {}) {
+function readClaudeFileUsage({
+  homeDir = os3.homedir(),
+  read: rawRead = readJson,
+  statFn = fs8.statSync,
+  now = () => Date.now()
+} = {}) {
   const read = (p) => {
     try {
       return rawRead(p);
@@ -7579,31 +7744,39 @@ function readClaudeFileUsage({ homeDir = os3.homedir(), read: rawRead = readJson
     }
   };
   const accountId = readAccountId({ homeDir, read });
-  const status = read(path14.join(homeDir, ".claude", "claude-usage.json"));
+  const fresh = (row) => {
+    if (!row) return null;
+    const age = readingAgeMs(row, now());
+    if (age === null || age > MAX_FILE_AGE_MS) return null;
+    return row;
+  };
+  const statusPath = path15.join(homeDir, ".claude", "claude-usage.json");
+  const status = read(statusPath);
   if (status && (status.seven_day || status.five_hour)) {
-    const row = makeUsageRow({
+    const row = fresh(makeUsageRow({
       agent: "claude",
       source: "statusline",
-      capturedAt: typeof status.capturedAt === "string" ? status.capturedAt : null,
+      capturedAt: fileCaptureTime(statusPath, status.capturedAt, statFn),
       accountId,
       sevenDay: status.seven_day?.used_percentage,
       fiveHour: status.five_hour?.used_percentage,
       sevenDayResetsAt: status.seven_day?.resets_at ?? null,
       fiveHourResetsAt: status.five_hour?.resets_at ?? null
-    });
+    }));
     if (row) return row;
   }
-  const weekly = read(path14.join(homeDir, ".claude", "claude-weekly-usage.json"));
+  const weeklyPath = path15.join(homeDir, ".claude", "claude-weekly-usage.json");
+  const weekly = read(weeklyPath);
   if (weekly) {
-    const row = makeUsageRow({
+    const row = fresh(makeUsageRow({
       agent: "claude",
       source: "file",
-      capturedAt: typeof weekly.capturedAt === "string" ? weekly.capturedAt : null,
+      capturedAt: fileCaptureTime(weeklyPath, weekly.capturedAt, statFn),
       accountId,
       sevenDay: weekly.sevenDayPct,
       fiveHour: weekly.fiveHourPct,
       sevenDayResetsAt: weekly.sevenDayResetsAt ?? null
-    });
+    }));
     if (row) return row;
   }
   return null;
@@ -7616,11 +7789,12 @@ async function readClaudeUsage(opts = {}) {
   }
   return readClaudeFileUsage(opts);
 }
-var USAGE_PATH, OAUTH_BETA, DEFAULT_TIMEOUT_MS;
+var MAX_FILE_AGE_MS, USAGE_PATH, OAUTH_BETA, DEFAULT_TIMEOUT_MS;
 var init_claude = __esm({
   "../../scripts/virtual-office/code-runner/account-usage/claude.mjs"() {
     "use strict";
     init_shared();
+    MAX_FILE_AGE_MS = 6 * 60 * 60 * 1e3;
     USAGE_PATH = "/api/oauth/usage";
     OAUTH_BETA = "oauth-2025-04-20";
     DEFAULT_TIMEOUT_MS = 5e3;
@@ -8030,7 +8204,7 @@ var init_watcher_coordination = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/watcher-state.mjs
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 import { mkdir as mkdir2, open, readFile as readFile3, rename, unlink as unlink2 } from "node:fs/promises";
 import { dirname as dirname4 } from "node:path";
 async function readWatcherState(stateFile) {
@@ -8050,7 +8224,7 @@ async function readWatcherState(stateFile) {
 async function writeWatcherState(stateFile, state) {
   const directory = dirname4(stateFile);
   await mkdir2(directory, { recursive: true });
-  const temp = `${stateFile}.${process.pid}.${randomUUID2()}.tmp`;
+  const temp = `${stateFile}.${process.pid}.${randomUUID3()}.tmp`;
   let handle;
   try {
     handle = await open(temp, "wx");
@@ -8261,7 +8435,7 @@ var init_pr_watcher_github = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/enqueue-autonomous-code-task.mjs
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 async function enqueueAutonomousCodeTask(client, task, log2 = () => {
 }) {
   const requestedBudgetUsd = task?.max_budget_usd;
@@ -8275,7 +8449,7 @@ async function enqueueAutonomousCodeTask(client, task, log2 = () => {
   if (typeof client?.reserveAutonomousDispatchBudget !== "function" || typeof client?.releaseAutonomousDispatchBudget !== "function") {
     throw new Error("autonomous dispatch admission client unavailable");
   }
-  const reservationId = randomUUID3();
+  const reservationId = randomUUID4();
   const admission = await client.reserveAutonomousDispatchBudget({
     requestedBudgetUsd,
     reservationId,
@@ -8293,7 +8467,7 @@ var init_enqueue_autonomous_code_task = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/pr-watcher.mjs
-import { homedir as homedir4 } from "node:os";
+import { homedir as homedir5 } from "node:os";
 import { join as join6 } from "node:path";
 function parsePrCiStatus(view) {
   const state = (view && typeof view.state === "string" ? view.state : "UNKNOWN").toUpperCase();
@@ -8637,7 +8811,7 @@ var init_pr_watcher = __esm({
     init_watcher_state();
     init_superseded_pr_source();
     init_ci_fix_prompt();
-    DEFAULT_STATE_FILE = join6(homedir4(), ".vo", "dispatched-prs.json");
+    DEFAULT_STATE_FILE = join6(homedir5(), ".vo", "dispatched-prs.json");
     FAIL_CONCLUSIONS = /* @__PURE__ */ new Set([
       "FAILURE",
       "TIMED_OUT",
@@ -8867,9 +9041,9 @@ function buildControlHandler({ getStatus, requestStop, allowedOrigin }) {
       res.end();
       return;
     }
-    const path19 = String(req.url || "").split("?")[0];
+    const path20 = String(req.url || "").split("?")[0];
     res.setHeader("content-type", "application/json");
-    if (req.method === "GET" && path19 === "/status") {
+    if (req.method === "GET" && path20 === "/status") {
       let status;
       try {
         status = getStatus();
@@ -8880,7 +9054,7 @@ function buildControlHandler({ getStatus, requestStop, allowedOrigin }) {
       res.end(JSON.stringify({ ok: true, ...status }));
       return;
     }
-    if (req.method === "POST" && path19 === "/stop") {
+    if (req.method === "POST" && path20 === "/stop") {
       if (!isControlOriginAllowed(req.headers.origin, allowedOrigin) || !req.headers["x-vo-control"]) {
         res.statusCode = 403;
         res.end(JSON.stringify({ ok: false, error: "forbidden" }));
@@ -9043,8 +9217,8 @@ var init_effort_mode_config = __esm({
 });
 
 // ../../scripts/virtual-office/model-registry.mjs
-import fs7 from "node:fs";
-import path15 from "node:path";
+import fs9 from "node:fs";
+import path16 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function uniqueModels(models = []) {
   return [...new Set(models.map((model) => String(model || "").trim()).filter(Boolean))];
@@ -9156,9 +9330,9 @@ async function fetchGoogleModels(fetchImpl, env2 = process.env) {
   return (data?.models || []).map((model) => normalizeCatalogModel({ ...model, provider: "google", source: "google" })).filter(Boolean);
 }
 function readCache(cacheFile = DEFAULT_CACHE_FILE, nowMs = Date.now(), ttlMs = DEFAULT_TTL_MS3) {
-  if (!fs7.existsSync(cacheFile)) return null;
+  if (!fs9.existsSync(cacheFile)) return null;
   try {
-    const parsed = JSON.parse(fs7.readFileSync(cacheFile, "utf-8"));
+    const parsed = JSON.parse(fs9.readFileSync(cacheFile, "utf-8"));
     if (nowMs - Number(parsed.checkedAtMs || 0) > ttlMs) return null;
     if (!Array.isArray(parsed.models)) return null;
     return parsed;
@@ -9167,8 +9341,8 @@ function readCache(cacheFile = DEFAULT_CACHE_FILE, nowMs = Date.now(), ttlMs = D
   }
 }
 function writeCache(cacheFile = DEFAULT_CACHE_FILE, payload) {
-  fs7.mkdirSync(path15.dirname(cacheFile), { recursive: true });
-  fs7.writeFileSync(cacheFile, JSON.stringify(payload, null, 2));
+  fs9.mkdirSync(path16.dirname(cacheFile), { recursive: true });
+  fs9.writeFileSync(cacheFile, JSON.stringify(payload, null, 2));
 }
 async function fetchRegistryCatalog({
   fetchImpl = fetch,
@@ -9225,10 +9399,10 @@ var __dirname, ROOT, DEFAULT_CACHE_DIR, DEFAULT_CACHE_FILE, DEFAULT_TTL_MS3, ANT
 var init_model_registry = __esm({
   "../../scripts/virtual-office/model-registry.mjs"() {
     "use strict";
-    __dirname = path15.dirname(fileURLToPath4(import.meta.url));
-    ROOT = path15.resolve(__dirname, "..", "..");
-    DEFAULT_CACHE_DIR = path15.join(ROOT, ".virtual-office-cache", "model-registry");
-    DEFAULT_CACHE_FILE = path15.join(DEFAULT_CACHE_DIR, "catalog.json");
+    __dirname = path16.dirname(fileURLToPath4(import.meta.url));
+    ROOT = path16.resolve(__dirname, "..", "..");
+    DEFAULT_CACHE_DIR = path16.join(ROOT, ".virtual-office-cache", "model-registry");
+    DEFAULT_CACHE_FILE = path16.join(DEFAULT_CACHE_DIR, "catalog.json");
     DEFAULT_TTL_MS3 = 60 * 60 * 1e3;
     ANTHROPIC_API_VERSION = "2023-06-01";
     FAMILY_DEFINITIONS = {
@@ -9836,7 +10010,7 @@ var init_classify_task = __esm({
 
 // ../../scripts/virtual-office/code-runner/auto-router/effort-policy.mjs
 import { readFileSync as readFileSync4 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 import { join as join7 } from "node:path";
 function difficultyToRung(difficulty, thresholds) {
   const b = thresholds.rungBounds;
@@ -9862,9 +10036,9 @@ function operatorTierToRung(tier, difficulty, thresholds) {
   if (tier === "best" && difficulty >= thresholds.rungBounds.R5) return "R5";
   return base;
 }
-function readCodexModelsCache({ path: path19 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync4 } = {}) {
+function readCodexModelsCache({ path: path20 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync4 } = {}) {
   try {
-    const parsed = JSON.parse(read(path19, "utf8"));
+    const parsed = JSON.parse(read(path20, "utf8"));
     return Array.isArray(parsed?.models) ? parsed : null;
   } catch {
     return null;
@@ -9914,7 +10088,7 @@ var init_effort_policy = __esm({
     init_meta_model_catalog();
     RUNG_ORDER = ["R1", "R2", "R3", "R4", "R5"];
     rungIndex = (rung) => RUNG_ORDER.indexOf(rung);
-    DEFAULT_CODEX_MODELS_CACHE = join7(homedir5(), ".codex", "models_cache.json");
+    DEFAULT_CODEX_MODELS_CACHE = join7(homedir6(), ".codex", "models_cache.json");
   }
 });
 
@@ -10044,8 +10218,8 @@ var init_role_cost_shadow = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/auto-router/auto-router.mjs
-import { readFileSync as readFileSync5, appendFileSync, mkdirSync as mkdirSync3 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
+import { readFileSync as readFileSync5, appendFileSync, mkdirSync as mkdirSync4 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
 import { join as join8, dirname as dirname5 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function getAutoRouterMode(env2 = process.env) {
@@ -10121,15 +10295,15 @@ function formatDecisionReason(decision, maxLen = 480) {
   const s = `[${decision.routerVersion}] ${decision.taskClass} d=${decision.difficulty} c=${decision.confidence} \u2192 ${decision.rung}/${decision.tier}${decision.effort ? ` effort=${decision.effort}` : ""} turns=${decision.maxTurns} $${decision.maxBudgetUsd}${decision.flags.length ? ` [${decision.flags.join(",")}]` : ""} :: ${decision.reasons.join("; ")}`;
   return s.length > maxLen ? `${s.slice(0, maxLen - 1)}\u2026` : s;
 }
-function appendDecisionFallback(decision, { path: path19 = DECISION_FALLBACK_PATH, append = appendFileSync, mkdir: mkdir4 = mkdirSync3, task, thresholds, roleCostInputs } = {}) {
+function appendDecisionFallback(decision, { path: path20 = DECISION_FALLBACK_PATH, append = appendFileSync, mkdir: mkdir4 = mkdirSync4, task, thresholds, roleCostInputs } = {}) {
   try {
-    mkdir4(dirname5(path19), { recursive: true });
-    append(path19, `${JSON.stringify(decision)}
+    mkdir4(dirname5(path20), { recursive: true });
+    append(path20, `${JSON.stringify(decision)}
 `, "utf8");
     if (isRouterDecision(decision)) {
       try {
         const records = buildShadowRecords({ decision, task, thresholds: thresholds || loadThresholds(), roleCostInputs });
-        for (const record of records) append(path19, `${JSON.stringify(record)}
+        for (const record of records) append(path20, `${JSON.stringify(record)}
 `, "utf8");
       } catch {
       }
@@ -10147,7 +10321,7 @@ var init_auto_router = __esm({
     init_effort_policy();
     init_role_cost_shadow();
     ROUTER_VERSION = "0.1.0";
-    DECISION_FALLBACK_PATH = join8(homedir6(), ".claude", "vo-auto-router-decisions.jsonl");
+    DECISION_FALLBACK_PATH = join8(homedir7(), ".claude", "vo-auto-router-decisions.jsonl");
     MODES = /* @__PURE__ */ new Set(["off", "shadow", "on"]);
     cachedThresholds = null;
     isRouterDecision = (d) => Boolean(d && typeof d === "object" && typeof d.taskClass === "string" && typeof d.confidence === "number");
@@ -10440,6 +10614,93 @@ var init_task_helpers = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/swarm-admission.mjs
+function canLaunchSuccessorAgent(agent, platform = process.platform) {
+  const name = typeof agent === "string" ? agent.trim() : "";
+  if (!Object.prototype.hasOwnProperty.call(SUCCESSOR_LAUNCH_SHAPES, name)) return false;
+  if (platform === "win32" && !SUCCESSOR_LAUNCH_SHAPES[name]) return false;
+  return true;
+}
+function isSubscriptionExhausted(usage) {
+  if (!usage || typeof usage !== "object") return false;
+  const readings = [usage.seven_day_used_pct, usage.five_hour_used_pct, usage.monthly_used_pct];
+  return readings.some((v) => typeof v === "number" && Number.isFinite(v) && v >= SUBSCRIPTION_EXHAUSTED_PCT);
+}
+function clampSubagents(requested) {
+  if (!Number.isFinite(requested) || requested < 1) return 0;
+  return Math.min(Math.floor(requested), MAX_BOUND_SUBAGENTS);
+}
+function usageFor(accountUsage, agent) {
+  if (!Array.isArray(accountUsage)) return null;
+  return accountUsage.find((row) => row && row.agent === agent) ?? null;
+}
+function exhaustedAgents(availableAgents, accountUsage) {
+  if (!Array.isArray(availableAgents)) return [];
+  return availableAgents.filter((row) => row && row.installed === true && row.authenticated === true && row.auth_tier === AUTH_TIER_SUBSCRIPTION && isSubscriptionExhausted(usageFor(accountUsage, row.agent))).map((row) => row.agent);
+}
+function resolveRunnerSwarmBinding({
+  swarmId,
+  agent,
+  availableAgents,
+  accountUsage = [],
+  requestedSubagents = MAX_BOUND_SUBAGENTS,
+  nowIso,
+  platform = process.platform
+} = {}) {
+  const id = typeof swarmId === "string" ? swarmId.trim() : "";
+  const boundAgent = typeof agent === "string" ? agent.trim() : "";
+  if (id.length === 0 || boundAgent.length === 0) return null;
+  if (!canLaunchSuccessorAgent(boundAgent, platform)) return null;
+  const budget = clampSubagents(requestedSubagents);
+  if (budget === 0) return null;
+  const rows = Array.isArray(availableAgents) ? availableAgents : [];
+  const row = rows.find((r) => r && r.agent === boundAgent) ?? null;
+  if (!row || row.installed !== true || row.authenticated !== true) return null;
+  const tier = AUTH_TIER_TO_SWARM_TIER[row.auth_tier];
+  if (!tier) return null;
+  const exhausted = exhaustedAgents(rows, accountUsage);
+  const boundExhausted = tier === "tier1_subscription" && isSubscriptionExhausted(usageFor(accountUsage, boundAgent));
+  const effectiveBudget = boundExhausted ? Math.min(budget, EXHAUSTED_SUBAGENT_BUDGET) : budget;
+  const basis = `code-task dispatch admitted on '${boundAgent}' at auth tier '${row.auth_tier}' (runner-local capability probe)`;
+  return {
+    schema_version: 1,
+    swarm_id: id,
+    tier,
+    agent: boundAgent,
+    reason: boundExhausted ? `${basis}; that subscription window is >=${SUBSCRIPTION_EXHAUSTED_PCT}% spent, so the fan-out is bound at a REDUCED ceiling of ${effectiveBudget} instead of being left unbound and uncapped` : basis,
+    exhausted_agents: exhausted,
+    subagent_budget: effectiveBudget,
+    // Never a platform-billed fan-out in this lane — see the module header.
+    spend_cap_usd: null,
+    resolved_at: typeof nowIso === "string" && nowIso ? nowIso : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function mintSwarmTierBindingEnv(input) {
+  const binding = resolveRunnerSwarmBinding(input);
+  if (!binding) return {};
+  return { [SWARM_TIER_BINDING_ENV]: JSON.stringify(binding) };
+}
+var SWARM_TIER_BINDING_ENV, MAX_BOUND_SUBAGENTS, SUBSCRIPTION_EXHAUSTED_PCT, EXHAUSTED_SUBAGENT_BUDGET, SUCCESSOR_LAUNCH_SHAPES, AUTH_TIER_TO_SWARM_TIER;
+var init_swarm_admission = __esm({
+  "../../scripts/virtual-office/code-runner/swarm-admission.mjs"() {
+    "use strict";
+    init_agent_auth_tier();
+    SWARM_TIER_BINDING_ENV = "VO_SWARM_TIER_BINDING";
+    MAX_BOUND_SUBAGENTS = 20;
+    SUBSCRIPTION_EXHAUSTED_PCT = 95;
+    EXHAUSTED_SUBAGENT_BUDGET = 1;
+    SUCCESSOR_LAUNCH_SHAPES = Object.freeze({
+      claude: true,
+      codex: false
+    });
+    AUTH_TIER_TO_SWARM_TIER = Object.freeze({
+      [AUTH_TIER_SUBSCRIPTION]: "tier1_subscription",
+      [AUTH_TIER_LOCAL]: "tier1_local",
+      [AUTH_TIER_API_KEY]: "tier2_user_key"
+    });
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/agent-process-env.mjs
 function safeIdentityPart(value, fallback) {
   const normalized = String(value || "").trim().replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
@@ -10452,8 +10713,14 @@ function safeBaseEnv(env2 = {}) {
   }
   return result;
 }
-function buildAgentProcessEnv(env2, { agent = "agent", runnerId = "vo-runner", taskId = "task", githubReadToken = null } = {}) {
+function buildAgentProcessEnv(env2, { agent = "agent", runnerId = "vo-runner", taskId = "task", githubReadToken = null, swarmAdmission = null } = {}) {
   const base = safeBaseEnv(env2);
+  if (swarmAdmission) {
+    for (const key of Object.keys(base)) {
+      if (key.toUpperCase() === SWARM_TIER_BINDING_ENV) delete base[key];
+    }
+    Object.assign(base, mintSwarmTierBindingEnv({ ...swarmAdmission, agent, swarmId: taskId }));
+  }
   if (typeof githubReadToken === "string" && githubReadToken) {
     base.GH_TOKEN = githubReadToken;
     base.GITHUB_TOKEN = githubReadToken;
@@ -10471,6 +10738,7 @@ var SAFE_ENV_NAMES;
 var init_agent_process_env = __esm({
   "../../scripts/virtual-office/code-runner/agent-process-env.mjs"() {
     "use strict";
+    init_swarm_admission();
     SAFE_ENV_NAMES = /* @__PURE__ */ new Set([
       "AGENT_ID",
       "APPDATA",
@@ -10511,7 +10779,31 @@ var init_agent_process_env = __esm({
       // it. #9242 added VO_RUNNER_PREFER_KEY without this line, which left the
       // escape hatch inert — an operator who set it still got the subscription.
       "VO_RUNNER_PREFER_KEY",
-      "VO_RUNNER_CLAUDE_PREFER_KEY"
+      "VO_RUNNER_CLAUDE_PREFER_KEY",
+      // The swarm tier binding (SWARM_TIER_BINDING_ENV in
+      // packages/vo-mcp/src/swarm/tier-binding.ts). A fan-out resolves its billing
+      // tier ONCE at admission and exports the binding so every subagent inherits
+      // the same answer instead of re-resolving its own. This line is what lets it
+      // cross the process boundary at all: the daemon builds each child env with
+      // buildAgentProcessEnv(process.env) at
+      // scripts/virtual-office/code-runner-daemon.mjs:117 (sibling dir, not this
+      // one), so a name absent from this set is stripped and the binding binds
+      // NOTHING —
+      // exactly how #9242's VO_RUNNER_PREFER_KEY shipped inert until #9247.
+      //
+      // NOT a credential and NOT an authorization input: it names a tier, it never
+      // grants one, and it carries no key material (see the module's header rule).
+      "VO_SWARM_TIER_BINDING",
+      // Where the swarm SPAWN LEDGER lives (SWARM_LEDGER_DIR_ENV in
+      // packages/vo-mcp/src/swarm/spawn-ledger.ts). The ledger is the durable,
+      // host-shared counter that bounds the TOTAL spawns under one swarm_id; the
+      // binding above only bounds the depth of one chain. If a parent's override
+      // were stripped here, the child would ledger into a DIFFERENT directory,
+      // claim slot 0 again, and the shared ceiling would silently degrade back to a
+      // per-process quota — which is precisely the defect the ledger closes.
+      //
+      // A path, not a credential. Absent means the default ~/.vo/swarm-ledger.
+      "VO_SWARM_LEDGER_DIR"
     ]);
   }
 });
@@ -11002,9 +11294,9 @@ var init_inference_task_runner = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/isolation-audit.mjs
-import fs8 from "node:fs";
+import fs10 from "node:fs";
 import fsp11 from "node:fs/promises";
-import path16 from "node:path";
+import path17 from "node:path";
 async function defaultRun(command, args, cwd, options = {}) {
   return runProcess2(command, args, { cwd, timeout: 6e4, ...options });
 }
@@ -11017,7 +11309,7 @@ async function canonicalRootForWorktree(worktreeDir, run) {
     "--path-format=absolute",
     "--git-common-dir"
   ])).trim();
-  const root = path16.dirname(commonDir);
+  const root = path17.dirname(commonDir);
   return samePath2(root, worktreeDir) ? null : root;
 }
 async function snapshot(root, run) {
@@ -11059,21 +11351,21 @@ async function changedPaths(root, run) {
 }
 async function quarantineCanonicalWrites({ baseline, worktreeDir, taskId, run, now }) {
   const paths = await changedPaths(baseline.root, run);
-  const quarantineDir = path16.join(
-    path16.dirname(worktreeDir),
+  const quarantineDir = path17.join(
+    path17.dirname(worktreeDir),
     ".canonical-recovery",
     `${String(taskId || "unknown").replace(/[^a-z0-9-]/gi, "-")}-${now().toISOString().replace(/[:.]/g, "-")}`
   );
   await fsp11.mkdir(quarantineDir, { recursive: true });
   const patch = await git2(run, baseline.root, ["diff", "--binary", "HEAD"], { raw: true });
-  await fsp11.writeFile(path16.join(quarantineDir, "tracked.patch"), patch, "utf8");
+  await fsp11.writeFile(path17.join(quarantineDir, "tracked.patch"), patch, "utf8");
   for (const relative of paths.untracked) {
-    const source = path16.join(baseline.root, relative);
-    const target = path16.join(quarantineDir, "untracked", relative);
-    await fsp11.mkdir(path16.dirname(target), { recursive: true });
+    const source = path17.join(baseline.root, relative);
+    const target = path17.join(quarantineDir, "untracked", relative);
+    await fsp11.mkdir(path17.dirname(target), { recursive: true });
     await fsp11.copyFile(source, target);
   }
-  await fsp11.writeFile(path16.join(quarantineDir, "manifest.json"), `${JSON.stringify({
+  await fsp11.writeFile(path17.join(quarantineDir, "manifest.json"), `${JSON.stringify({
     taskId,
     canonicalRoot: baseline.root,
     canonicalHead: baseline.head,
@@ -11095,9 +11387,9 @@ async function restoreExactCanonicalPaths(baseline, evidence, run) {
     ]);
   }
   for (const relative of evidence.untracked) {
-    const target = path16.resolve(baseline.root, relative);
-    const prefix = `${path16.resolve(baseline.root)}${path16.sep}`;
-    if (!target.startsWith(prefix) || !fs8.existsSync(target)) continue;
+    const target = path17.resolve(baseline.root, relative);
+    const prefix = `${path17.resolve(baseline.root)}${path17.sep}`;
+    if (!target.startsWith(prefix) || !fs10.existsSync(target)) continue;
     await fsp11.rm(target, { force: true });
   }
 }
@@ -11133,7 +11425,7 @@ var init_isolation_audit = __esm({
     init_process_runner2();
     splitZ2 = (value) => String(value || "").split("\0").map((item) => item.trim()).filter(Boolean);
     samePath2 = (left, right) => {
-      const [a, b] = [left, right].map((value) => path16.resolve(value));
+      const [a, b] = [left, right].map((value) => path17.resolve(value));
       return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
     };
   }
@@ -11493,7 +11785,7 @@ var init_publication_outcome = __esm({
 
 // ../../scripts/virtual-office/code-runner/committed-scratch-cleanup.mjs
 import fsp12 from "node:fs/promises";
-import path17 from "node:path";
+import path18 from "node:path";
 function defaultRun2(command, args, cwd, options = {}) {
   return runProcess2(command, args, { cwd, ...options });
 }
@@ -11501,13 +11793,13 @@ async function resolveSafeScratchTarget(worktreeDir, file) {
   if (!isAgentScratch(file)) {
     throw new Error(`refusing to remove non-scratch publication path: ${file}`);
   }
-  const root = path17.resolve(worktreeDir);
-  const target = path17.resolve(root, file);
-  const relative = path17.relative(root, target);
-  if (!relative || relative.startsWith(`..${path17.sep}`) || path17.isAbsolute(relative)) {
+  const root = path18.resolve(worktreeDir);
+  const target = path18.resolve(root, file);
+  const relative = path18.relative(root, target);
+  if (!relative || relative.startsWith(`..${path18.sep}`) || path18.isAbsolute(relative)) {
     throw new Error(`refusing to remove publication scratch outside worktree: ${file}`);
   }
-  for (let cursor = target; cursor !== root; cursor = path17.dirname(cursor)) {
+  for (let cursor = target; cursor !== root; cursor = path18.dirname(cursor)) {
     try {
       if ((await fsp12.lstat(cursor)).isSymbolicLink()) {
         throw new Error(`refusing to follow symlink while removing publication scratch: ${file}`);
@@ -11627,9 +11919,9 @@ var init_publication_scope = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/recovery-ledger.mjs
-import fs9 from "node:fs";
+import fs11 from "node:fs";
 import fsp13 from "node:fs/promises";
-import path18 from "node:path";
+import path19 from "node:path";
 function recoveryTaskId(prompt) {
   const match = String(prompt || "").match(/VO_RECOVERY_FROM_CODE_TASK:\s*([0-9a-f-]{36})/i);
   return match ? match[1].toLowerCase() : null;
@@ -11643,10 +11935,10 @@ function cloneLeaf(repo) {
 function recoveryLedgerCandidates(repo, clonesRoot2) {
   const leaf = cloneLeaf(repo);
   if (!leaf || !clonesRoot2) return [];
-  const canonical = path18.join(clonesRoot2, leaf);
+  const canonical = path19.join(clonesRoot2, leaf);
   return [
-    path18.join(clonesRoot2, ".agent-worktrees", leaf, "recovery-ledger.jsonl"),
-    path18.join(canonical, ".agent-worktrees", "recovery-ledger.jsonl")
+    path19.join(clonesRoot2, ".agent-worktrees", leaf, "recovery-ledger.jsonl"),
+    path19.join(canonical, ".agent-worktrees", "recovery-ledger.jsonl")
   ];
 }
 async function readLedger(file, readFile5) {
@@ -11665,7 +11957,7 @@ async function readLedger(file, readFile5) {
 async function findPreservedRecovery(task, {
   clonesRoot: clonesRoot2 = process.env.VO_CODE_RUNNER_CLONES_ROOT || "",
   readFile: readFile5 = fsp13.readFile,
-  exists = fs9.existsSync
+  exists = fs11.existsSync
 } = {}) {
   const resumedFrom = /^[0-9a-f-]{36}$/iu.test(String(task.resumed_from || "")) ? String(task.resumed_from).toLowerCase() : null;
   const originalTaskId = recoveryTaskId(task.prompt) ?? resumedFrom;
@@ -11979,7 +12271,7 @@ var init_cancellation_probe = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/detached-economics-spool.mjs
-import { homedir as homedir7 } from "node:os";
+import { homedir as homedir8 } from "node:os";
 import { dirname as dirname6, join as join9 } from "node:path";
 import { mkdir as mkdir3, readFile as readFile4, rename as rename2, writeFile as writeFile3 } from "node:fs/promises";
 function withLock(operation) {
@@ -12044,13 +12336,13 @@ var DEFAULT_FILE, serialized;
 var init_detached_economics_spool = __esm({
   "../../scripts/virtual-office/code-runner/detached-economics-spool.mjs"() {
     "use strict";
-    DEFAULT_FILE = join9(homedir7(), ".vo", "detached-run-economics.json");
+    DEFAULT_FILE = join9(homedir8(), ".vo", "detached-run-economics.json");
     serialized = Promise.resolve();
   }
 });
 
 // ../../scripts/virtual-office/code-runner/killed-run-outcome.mjs
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 async function handleKilledRun({
   client,
   id,
@@ -12087,7 +12379,7 @@ async function handleKilledRun({
     };
   }
   if (reason === "claim_authority_changed") {
-    const occurrenceId = randomUUID4();
+    const occurrenceId = randomUUID5();
     const economics = {
       occurrence_id: occurrenceId,
       runner_id: runnerId,
@@ -12384,12 +12676,12 @@ var code_runner_daemon_exports = {};
 __export(code_runner_daemon_exports, {
   main: () => main
 });
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 function log(msg) {
   console.log(`[code-runner ${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}`);
 }
-async function processOneTask(client, task, cfg, runnerInstanceId) {
+async function processOneTask(client, task, cfg, runnerInstanceId, swarmAdmission = null) {
   const id = task.code_task_id;
   let worktreeName = "";
   let preserveReason = null;
@@ -12439,7 +12731,8 @@ async function processOneTask(client, task, cfg, runnerInstanceId) {
       model,
       effort: effectiveEffort,
       maxBudgetUsd: sel.agent === "claude" ? effectiveMaxBudgetUsd : void 0,
-      env: buildAgentProcessEnv(process.env, { agent: sel.agent, runnerId: cfg.runnerId, taskId: id, githubReadToken: agentGithubReadToken }),
+      env: buildAgentProcessEnv(process.env, { agent: sel.agent, runnerId: cfg.runnerId, taskId: id, githubReadToken: agentGithubReadToken, swarmAdmission }),
+      // swarmAdmission mints VO_SWARM_TIER_BINDING: ONE tier decision for this task's whole agent tree
       sandbox,
       onProgress: (text, checkpoint) => {
         const usage = checkpoint?.tokenUsage ? { token_usage: checkpoint.tokenUsage } : {};
@@ -12613,7 +12906,7 @@ Closes #${publicationTarget.supersedesPrNumber}` : "";
 async function main({ env: env2 = process.env, once: once2 = false } = {}) {
   const cfg = loadCodeRunnerConfig(env2, { log });
   await sweepStaleTaskAttachmentDirectories().catch((error) => log(`stale attachment cleanup failed: ${error.message}`));
-  const runnerInstanceId = randomUUID5();
+  const runnerInstanceId = randomUUID6();
   const client = createControlPlaneClient({
     env: env2,
     runnerId: cfg.runnerId,
@@ -12725,7 +13018,7 @@ async function main({ env: env2 = process.env, once: once2 = false } = {}) {
     }
     log(`claimed task ${task.code_task_id} (${task.repo})`);
     active += 1;
-    const runTask = task.kind === "inference" ? processInferenceTask(client, task, cfg, { safeProgress, runnerStagePatch, log }) : processOneTask(client, task, cfg, runnerInstanceId);
+    const runTask = task.kind === "inference" ? processInferenceTask(client, task, cfg, { safeProgress, runnerStagePatch, log }) : processOneTask(client, task, cfg, runnerInstanceId, { availableAgents: claimAgents.availableAgents, accountUsage: accountUsage.get() });
     const done = runTask.catch(async (error) => {
       log(`task ${task.code_task_id} unhandled runner error: ${error.message}`);
       if (task.kind === "inference") await deliverTerminalRun({
@@ -12942,6 +13235,98 @@ function pairedOperatorScope(readiness) {
   return readiness?.ok === true && readiness?.paired === true && typeof readiness.operatorId === "string" && readiness.operatorId.trim() ? readiness.operatorId.trim() : null;
 }
 
+// src/runner/root-config.mjs
+import { closeSync, existsSync, mkdirSync, openSync, unlinkSync } from "node:fs";
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+import { randomUUID } from "node:crypto";
+var APP_IDENTIFIER = "ai.algosuite.vo-runner";
+var CLONES_DIR = "clones";
+function pathsFor(platform) {
+  return platform === "win32" ? win32 : posix;
+}
+function absoluteOrNull(value, pathApi) {
+  const normalized = String(value || "").trim();
+  return normalized && pathApi.isAbsolute(normalized) ? pathApi.resolve(normalized) : null;
+}
+function defaultClonesRoot({
+  platform = process.platform,
+  env: env2 = process.env,
+  home = homedir()
+} = {}) {
+  const pathApi = pathsFor(platform);
+  if (platform === "win32") {
+    const appData = absoluteOrNull(env2.APPDATA, pathApi);
+    return appData ? pathApi.join(appData, APP_IDENTIFIER, CLONES_DIR) : null;
+  }
+  const absoluteHome = absoluteOrNull(home, pathApi);
+  if (!absoluteHome) return null;
+  if (platform === "darwin") {
+    return pathApi.join(absoluteHome, "Library", "Application Support", APP_IDENTIFIER, CLONES_DIR);
+  }
+  const xdg = absoluteOrNull(env2.XDG_CONFIG_HOME, pathApi);
+  return pathApi.join(xdg || pathApi.join(absoluteHome, ".config"), APP_IDENTIFIER, CLONES_DIR);
+}
+function findGitRoot(cwd, { platform, exists = existsSync }) {
+  const pathApi = pathsFor(platform);
+  let cursor = pathApi.resolve(cwd);
+  for (; ; ) {
+    if (exists(pathApi.join(cursor, ".git"))) return cursor;
+    const parent = pathApi.dirname(cursor);
+    if (parent === cursor) return null;
+    cursor = parent;
+  }
+}
+function resolveRunnerRootConfig({
+  env: env2 = process.env,
+  cwd = process.cwd(),
+  platform = process.platform,
+  home = homedir(),
+  exists = existsSync
+} = {}) {
+  const pathApi = pathsFor(platform);
+  const explicitRepoValue = String(env2.VO_CODE_RUNNER_REPO || "").trim();
+  const explicitClonesValue = String(env2.VO_CODE_RUNNER_CLONES_ROOT || "").trim();
+  if (explicitRepoValue && !pathApi.isAbsolute(explicitRepoValue)) {
+    throw new Error(`VO_CODE_RUNNER_REPO must be an absolute path (got '${explicitRepoValue}')`);
+  }
+  if (explicitClonesValue && !pathApi.isAbsolute(explicitClonesValue)) {
+    throw new Error(`VO_CODE_RUNNER_CLONES_ROOT must be an absolute path (got '${explicitClonesValue}')`);
+  }
+  const repoRoot2 = explicitRepoValue ? pathApi.resolve(explicitRepoValue) : findGitRoot(cwd, { platform, exists });
+  const clonesRoot2 = explicitClonesValue ? pathApi.resolve(explicitClonesValue) : repoRoot2 ? null : defaultClonesRoot({ platform, env: env2, home });
+  if (!repoRoot2 && !clonesRoot2) {
+    throw new Error(
+      "No safe runner root is available. Set VO_CODE_RUNNER_REPO or VO_CODE_RUNNER_CLONES_ROOT to an absolute path."
+    );
+  }
+  return { repoRoot: repoRoot2, clonesRoot: clonesRoot2 };
+}
+function runnerWorkingDirectory({ repoRoot: repoRoot2, clonesRoot: clonesRoot2 }) {
+  const root = repoRoot2 || clonesRoot2;
+  if (!root) throw new Error("Runner root configuration has no working directory");
+  return root;
+}
+function assertWritableRunnerDirectory(root) {
+  mkdirSync(root, { recursive: true });
+  const probe = pathsFor(process.platform).join(root, `.vo-runner-write-probe-${process.pid}-${randomUUID()}`);
+  let handle;
+  try {
+    handle = openSync(probe, "wx", 384);
+  } catch (error) {
+    throw new Error(
+      `Runner clones root is not writable: ${root} (${error instanceof Error ? error.message : String(error)})`,
+      { cause: error }
+    );
+  } finally {
+    if (handle !== void 0) closeSync(handle);
+    try {
+      unlinkSync(probe);
+    } catch {
+    }
+  }
+}
+
 // src/runner-cli.mjs
 var DEFAULT_CONTROL_PLANE_URL = "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
 function packageVersion() {
@@ -12956,11 +13341,45 @@ if (process.argv.includes("--version") || process.argv.includes("-v")) {
 `);
   process.exit(0);
 }
+var USAGE = `vo-mcp runner \u2014 bring-your-own agent runner daemon
+
+Usage:
+  vo-mcp runner              poll for tasks forever (default)
+  vo-mcp runner --once       claim + run one task, then exit
+  vo-mcp runner --status     print pairing/readiness JSON, then exit
+  vo-mcp runner --version    print the version, then exit
+  vo-mcp runner --help       print this help, then exit
+
+Env (all optional):
+  VO_CONTROL_PLANE_ADMIN_TOKEN  explicit bearer (wins over the stored credential)
+  VO_CONTROL_PLANE_URL          control-plane base URL (default: production)
+  VO_CODE_RUNNER_REPO           path to your repo clone (default: Git cwd)
+  VO_CODE_RUNNER_CLONES_ROOT    managed clone directory (default outside Git cwd)
+  VO_CODE_RUNNER_OPERATOR_IDS   operator id(s) this runner serves (your own)
+  VO_CODE_RUNNER_REPOS          owner/name repo(s) this runner builds
+
+Pair this computer first with \`vo-mcp login\`.
+`;
+if (process.argv.includes("--help") || process.argv.includes("-h")) {
+  process.stdout.write(USAGE);
+  process.exit(0);
+}
 var { readStoredCredential: readStoredCredential2 } = await Promise.resolve().then(() => (init_credential_store(), credential_store_exports));
 var storedCredential = readStoredCredential2();
 var explicitAdminToken = process.env.VO_CONTROL_PLANE_ADMIN_TOKEN?.trim();
 var token = explicitAdminToken || storedCredential?.vo_credential;
 var statusOnly = process.argv.includes("--status");
+function configureRunnerFilesystem() {
+  const config = resolveRunnerRootConfig();
+  if (config.repoRoot) process.env.VO_CODE_RUNNER_REPO = config.repoRoot;
+  else delete process.env.VO_CODE_RUNNER_REPO;
+  if (config.clonesRoot) {
+    assertWritableRunnerDirectory(config.clonesRoot);
+    process.env.VO_CODE_RUNNER_CLONES_ROOT = config.clonesRoot;
+  } else delete process.env.VO_CODE_RUNNER_CLONES_ROOT;
+  process.chdir(runnerWorkingDirectory(config));
+  return config;
+}
 if (statusOnly) {
   if (!storedCredential?.vo_credential) {
     process.stdout.write(`${JSON.stringify({
@@ -12969,6 +13388,7 @@ if (statusOnly) {
       operatorId: null,
       tenantId: null,
       githubReady: null,
+      filesystemReady: null,
       error: "credential_missing",
       message: "This computer is not paired. Pair it to your AlgoHQ account first."
     })}
@@ -12979,9 +13399,28 @@ if (statusOnly) {
     controlPlaneUrl: process.env.VO_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL,
     token: storedCredential.vo_credential
   });
-  process.stdout.write(`${JSON.stringify(readiness)}
+  if (!readiness.ok) {
+    process.stdout.write(`${JSON.stringify({ ...readiness, filesystemReady: null })}
 `);
-  process.exit(readiness.ok ? 0 : 1);
+    process.exit(1);
+  }
+  try {
+    configureRunnerFilesystem();
+    process.stdout.write(`${JSON.stringify({ ...readiness, filesystemReady: true })}
+`);
+    process.exit(0);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    process.stdout.write(`${JSON.stringify({
+      ...readiness,
+      ok: false,
+      filesystemReady: false,
+      error: "filesystem_not_ready",
+      message: `Filesystem readiness failed: ${detail}`
+    })}
+`);
+    process.exit(1);
+  }
 }
 if (!token) {
   console.error("[vo-mcp runner] No credential found. Run `vo-mcp login` first.");
@@ -13006,6 +13445,13 @@ if (!explicitAdminToken) {
     process.exit(1);
   }
 }
+var rootConfig;
+try {
+  rootConfig = configureRunnerFilesystem();
+} catch (error) {
+  console.error(`[vo-mcp runner] Filesystem readiness failed: ${error instanceof Error ? error.message : String(error)}`);
+  process.exit(1);
+}
 var env = {
   ...process.env,
   VO_CONTROL_PLANE_ADMIN_TOKEN: token,
@@ -13014,7 +13460,8 @@ var env = {
   // VO_CODE_RUNNER_VERSION, which a desktop host may set to its own shell
   // release even after runner-control updates this package in place.
   VO_CODE_RUNNER_DAEMON_VERSION: `vo-mcp/${packageVersion()}`,
-  VO_CODE_RUNNER_REPO: process.env.VO_CODE_RUNNER_REPO || process.cwd(),
+  ...rootConfig.repoRoot ? { VO_CODE_RUNNER_REPO: rootConfig.repoRoot } : {},
+  ...rootConfig.clonesRoot ? { VO_CODE_RUNNER_CLONES_ROOT: rootConfig.clonesRoot } : {},
   // Server-resolved identity replaces stale/hardcoded desktop scope. Besides
   // filtering heartbeat/claims, this keeps GitHub App auth required for the
   // entire task lifecycle (never ambient-gh fallback after a paired preflight).