@algosuite/vo-mcp 0.2.0-beta.45 → 0.2.0-beta.48

package/dist/runner-cli.js

@@ -187,6 +187,911 @@ var init_credential_store = __esm({
   }
 });
 
+// src/cloud/pairing.ts
+import { hostname, platform } from "node:os";
+function formatPairingCode(code) {
+  return code.length === 8 ? `${code.slice(0, 4)}-${code.slice(4)}` : code;
+}
+async function readJson(res) {
+  const body = await res.json().catch(() => ({}));
+  return body && typeof body === "object" ? body : {};
+}
+async function runPairing(deps = {}) {
+  const env2 = deps.env ?? process.env;
+  const log2 = deps.log ?? ((m) => console.error(m));
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleep3 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const store = deps.store ?? ((cred, iso) => writeStoredCredential(cred, iso, env2));
+  const controlPlaneUrl2 = env2["VO_CONTROL_PLANE_URL"]?.trim() || DEFAULT_CONTROL_PLANE_URL;
+  const dashboardUrl = env2["VO_DASHBOARD_URL"]?.trim() || DEFAULT_DASHBOARD_URL;
+  const deviceLabel = `${platform()} on ${hostname()}`.slice(0, 120);
+  const initRes = await fetchImpl(`${controlPlaneUrl2}/api/v1/pair/initiate`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ device_label: deviceLabel })
+  });
+  if (!initRes.ok) throw new Error(`Could not start pairing (server ${initRes.status}).`);
+  const init = await readJson(initRes);
+  const code = String(init["code"] ?? "");
+  const pollToken = String(init["poll_token"] ?? "");
+  if (!code || !pollToken) throw new Error("Pairing service returned an incomplete response.");
+  const intervalMs = (Number(init["poll_interval_seconds"]) || 5) * 1e3;
+  const expiresAtMs = new Date(String(init["expires_at"] ?? "")).getTime();
+  log2("");
+  log2("  To connect this runner, open this page in your browser:");
+  log2(`    ${dashboardUrl}/pair`);
+  log2("  and enter this code:");
+  log2("");
+  log2(`      ${formatPairingCode(code)}`);
+  log2("");
+  log2("  Your Anthropic key never leaves this computer. Waiting for you to authorize\u2026");
+  for (; ; ) {
+    if (Number.isFinite(expiresAtMs) && now().getTime() >= expiresAtMs) {
+      throw new Error("The pairing code expired before it was authorized. Run `vo-mcp pair` again.");
+    }
+    await sleep3(intervalMs);
+    const pollRes = await fetchImpl(`${controlPlaneUrl2}/api/v1/pair/poll`, {
+      method: "GET",
+      headers: { "x-vo-poll-token": pollToken }
+    });
+    if (pollRes.status === 404) {
+      throw new Error("The pairing expired. Run `vo-mcp pair` again.");
+    }
+    if (pollRes.status === 410) {
+      throw new Error("This code was already used. Run `vo-mcp pair` again.");
+    }
+    if (!pollRes.ok) {
+      continue;
+    }
+    const body = await readJson(pollRes);
+    if (body["status"] === "pending") continue;
+    if (body["status"] === "authorized" && typeof body["vo_credential"] === "string") {
+      const credentialPath2 = store(
+        {
+          vo_credential: body["vo_credential"],
+          ...typeof body["expires_at"] === "string" ? { vo_credential_expires_at: body["expires_at"] } : {}
+        },
+        now().toISOString()
+      );
+      return { credentialPath: credentialPath2, expires_at: String(body["expires_at"] ?? "") };
+    }
+    throw new Error("Unexpected response from the pairing service.");
+  }
+}
+var DEFAULT_CONTROL_PLANE_URL, DEFAULT_DASHBOARD_URL;
+var init_pairing = __esm({
+  "src/cloud/pairing.ts"() {
+    "use strict";
+    init_credential_store();
+    DEFAULT_CONTROL_PLANE_URL = "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
+    DEFAULT_DASHBOARD_URL = "https://algosuite.ai";
+  }
+});
+
+// src/config-backup.ts
+import { chmodSync as chmodSync2, copyFileSync, existsSync as existsSync3, readdirSync, readFileSync as readFileSync2, renameSync, statSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { basename, dirname as dirname2, join as join2 } from "node:path";
+function sweepStaleTempFiles(configPath) {
+  const dir = dirname2(configPath);
+  const name = basename(configPath);
+  if (!existsSync3(dir)) return 0;
+  let removed = 0;
+  for (const entry of readdirSync(dir)) {
+    if (!entry.startsWith(name) || !TEMP_SUFFIX_RE.test(entry.slice(name.length))) continue;
+    try {
+      unlinkSync2(join2(dir, entry));
+      removed += 1;
+    } catch {
+    }
+  }
+  return removed;
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function hasIdenticalBackup(configPath, content) {
+  const dir = dirname2(configPath);
+  const name = basename(configPath);
+  if (!existsSync3(dir)) return false;
+  const buffer = Buffer.isBuffer(content) ? content : Buffer.from(content, "utf8");
+  for (const entry of readdirSync(dir)) {
+    if (!entry.startsWith(name) || !BACKUP_SUFFIX_RE.test(entry.slice(name.length))) continue;
+    const candidate = join2(dir, entry);
+    try {
+      if (statSync(candidate).size !== buffer.length) continue;
+      if (readFileSync2(candidate).equals(buffer)) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function backupConfigOnce(configPath) {
+  if (!existsSync3(configPath)) return null;
+  const current = readFileSync2(configPath);
+  if (hasIdenticalBackup(configPath, current)) return null;
+  const backupPath = `${configPath}.backup-${Date.now()}`;
+  copyFileSync(configPath, backupPath);
+  return backupPath;
+}
+function writeFileAtomic(path22, content) {
+  sweepStaleTempFiles(path22);
+  const temp = `${path22}.vo-mcp-tmp-${process.pid}-${Date.now()}`;
+  try {
+    writeFileSync2(temp, content, { encoding: "utf8", mode: 384 });
+    if (existsSync3(path22)) {
+      try {
+        chmodSync2(temp, statSync(path22).mode & 511);
+      } catch {
+      }
+    }
+    let lastErr = null;
+    for (let attempt = 0; attempt < RENAME_RETRIES; attempt += 1) {
+      try {
+        renameSync(temp, path22);
+        return;
+      } catch (err) {
+        lastErr = err;
+        const code = err.code;
+        if (code !== "EPERM" && code !== "EBUSY" && code !== "EACCES") throw err;
+        sleepSync(RENAME_RETRY_MS);
+      }
+    }
+    writeFileSync2(path22, content, "utf8");
+    try {
+      unlinkSync2(temp);
+    } catch {
+    }
+    void lastErr;
+  } catch (err) {
+    try {
+      unlinkSync2(temp);
+    } catch {
+    }
+    throw err;
+  }
+}
+var BACKUP_SUFFIX_RE, TEMP_SUFFIX_RE, RENAME_RETRIES, RENAME_RETRY_MS;
+var init_config_backup = __esm({
+  "src/config-backup.ts"() {
+    "use strict";
+    BACKUP_SUFFIX_RE = /^\.backup-\d+$/u;
+    TEMP_SUFFIX_RE = /^\.vo-mcp-tmp-\d+-\d+$/u;
+    RENAME_RETRIES = 5;
+    RENAME_RETRY_MS = 50;
+  }
+});
+
+// src/mcp-launcher.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { homedir as homedir3, platform as osPlatform } from "node:os";
+import { isAbsolute, join as join3, normalize, resolve, sep, posix as pathPosix, win32 as pathWin32 } from "node:path";
+function defaultRunnerRuntimeRoot(env2 = process.env, { platform: platform4 = osPlatform(), home = homedir3() } = {}) {
+  const explicit = String(env2["VO_RUNNER_RUNTIME_ROOT"] || "").trim();
+  if (explicit) return isAbsolute(explicit) ? resolve(explicit) : null;
+  if (platform4 === "win32") {
+    const appData = String(env2["APPDATA"] || "").trim();
+    return appData && isAbsolute(appData) ? resolve(join3(appData, APP_IDENTIFIER2, RUNNER_RUNTIME_DIR)) : null;
+  }
+  if (!home) return null;
+  if (platform4 === "darwin") return resolve(join3(home, "Library", "Application Support", APP_IDENTIFIER2, RUNNER_RUNTIME_DIR));
+  const xdg = String(env2["XDG_CONFIG_HOME"] || "").trim();
+  return resolve(join3(xdg && isAbsolute(xdg) ? xdg : join3(home, ".config"), APP_IDENTIFIER2, RUNNER_RUNTIME_DIR));
+}
+function mcpLauncherPath(runtimeRoot) {
+  return join3(runtimeRoot, MCP_LAUNCHER_FILE);
+}
+function renderMcpLauncher() {
+  return `#!/usr/bin/env node
+// Written by \`vo-mcp install\` / the runner daemon (F24, 2026-08-16). Claude's and Codex's vo-mcp MCP
+// server entries point here so every MCP spawn runs the ACTIVE runner runtime slot \u2014 the fleet-approved
+// vo-mcp \u2014 instead of whatever copy \`install\` happened to run from. Resolution: this file's directory,
+// then an ABSOLUTE VO_RUNNER_RUNTIME_ROOT -> current.json (schema 1) active slot -> previous slot ->
+// ${MCP_FALLBACK_CLI_ENV} (a non-slot package cli.js) -> exit 2.
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+const SLOT_ID_RE = /^vo-mcp-[0-9A-Za-z._-]{1,96}$/u;
+const here = dirname(fileURLToPath(import.meta.url));
+const envRoot = String(process.env.VO_RUNNER_RUNTIME_ROOT || '').trim();
+const ROOTS = [here, ...(envRoot && isAbsolute(envRoot) && envRoot !== here ? [envRoot] : [])];
+const FALLBACK_CLI = process.env.${MCP_FALLBACK_CLI_ENV} || '';
+function slotCli(root, slotId) {
+  if (typeof slotId !== 'string' || !SLOT_ID_RE.test(slotId)) return null;
+  const cli = join(root, 'slots', slotId, 'node_modules', '@algosuite', 'vo-mcp', 'dist', 'cli.js');
+  return existsSync(cli) ? cli : null;
+}
+function rootCli(root) {
+  try {
+    const cur = JSON.parse(readFileSync(join(root, 'current.json'), 'utf8'));
+    if (!cur || cur.schema_version !== 1) return null;
+    return slotCli(root, cur.active && cur.active.slot_id) || slotCli(root, cur.previous && cur.previous.slot_id);
+  } catch { return null; }
+}
+// Floor: no usable pointer (quarantined by a bootstrap rollback, corrupt, or a
+// future schema) must not leave every agent without MCP \u2014 run the NEWEST slot
+// on disk that carries a cli.js, and say so on stderr.
+function newestSlotCli(root) {
+  try {
+    const dir = join(root, 'slots');
+    const found = readdirSync(dir).filter((id) => SLOT_ID_RE.test(id) && slotCli(root, id))
+      .map((id) => ({ id, mtime: statSync(join(dir, id)).mtimeMs }))
+      .sort((a, b) => b.mtime - a.mtime);
+    return found.length ? slotCli(root, found[0].id) : null;
+  } catch { return null; }
+}
+let target = null;
+for (const root of ROOTS) { target = rootCli(root); if (target) break; }
+if (!target) {
+  for (const root of ROOTS) { target = newestSlotCli(root); if (target) { process.stderr.write('[vo-mcp-launcher] no usable runtime pointer \u2014 using the newest slot on disk\\n'); break; } }
+}
+if (!target && FALLBACK_CLI && existsSync(FALLBACK_CLI)) target = FALLBACK_CLI;
+if (!target) { process.stderr.write('[vo-mcp-launcher] no runner runtime slot and no fallback cli\\n'); process.exit(2); }
+process.stderr.write(\`[vo-mcp-launcher] \${target}\\n\`);
+await import(pathToFileURL(target).href);
+`;
+}
+function writeMcpLauncher(runtimeRoot) {
+  mkdirSync3(runtimeRoot, { recursive: true });
+  const target = mcpLauncherPath(runtimeRoot);
+  const content = renderMcpLauncher();
+  if (!existsSync4(target) || readFileSync3(target, "utf8") !== content) writeFileSync3(target, content, "utf8");
+  return target;
+}
+function samePath(a, b, platform4 = osPlatform()) {
+  const pathModule = platform4 === "win32" ? pathWin32 : pathPosix;
+  const norm = (p) => {
+    const slashed = pathModule.normalize(p).replace(/\\/g, "/").replace(/\/+$/u, "");
+    return platform4 === "win32" || platform4 === "darwin" ? slashed.toLowerCase() : slashed;
+  };
+  return norm(a) === norm(b);
+}
+function isNotLauncherEntry(entry, launcherPath, platform4) {
+  const first = entry?.args && entry.args.length > 0 ? String(entry.args[0]) : "";
+  return !first || !samePath(first, launcherPath, platform4);
+}
+function isStaleVoMcpEntry(entry, launcherPath, fallbackCli, platform4) {
+  if (!entry || isNotLauncherEntry(entry, launcherPath, platform4)) return true;
+  const recorded = String(entry.env?.[MCP_FALLBACK_CLI_ENV] ?? "").trim();
+  if (!fallbackCli) return recorded !== "";
+  return !recorded || !samePath(recorded, fallbackCli, platform4);
+}
+function isSlotCli(cliPath, runtimeRoot = null) {
+  if (runtimeRoot) {
+    const prefix = normalize(join3(runtimeRoot, "slots")) + sep;
+    const candidate = normalize(cliPath);
+    const under = process.platform === "win32" ? candidate.toLowerCase().startsWith(prefix.toLowerCase()) : candidate.startsWith(prefix);
+    return under && /^vo-mcp-[0-9A-Za-z._-]{1,96}$/u.test(candidate.slice(prefix.length).split(/[\\/]/u)[0] ?? "");
+  }
+  return /[\\/]slots[\\/]vo-mcp-[0-9A-Za-z._-]{1,96}[\\/]/iu.test(cliPath);
+}
+function chooseFallbackCli(existing, cliPath, sticky, runtimeRoot = null) {
+  const current = String(existing ?? "").trim();
+  if (sticky && current && !isSlotCli(current, runtimeRoot) && existsSync4(current)) return current;
+  return isSlotCli(cliPath, runtimeRoot) ? null : cliPath;
+}
+var MCP_LAUNCHER_FILE, MCP_FALLBACK_CLI_ENV, APP_IDENTIFIER2, RUNNER_RUNTIME_DIR;
+var init_mcp_launcher = __esm({
+  "src/mcp-launcher.ts"() {
+    "use strict";
+    MCP_LAUNCHER_FILE = "vo-mcp-launcher.mjs";
+    MCP_FALLBACK_CLI_ENV = "VO_MCP_FALLBACK_CLI";
+    APP_IDENTIFIER2 = "ai.algosuite.vo-runner";
+    RUNNER_RUNTIME_DIR = "runner-runtime";
+  }
+});
+
+// src/codex-mcp-config.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
+import { dirname as dirname3, join as join4 } from "node:path";
+function resolveCodexConfigPath(home) {
+  return join4(home, ".codex", "config.toml");
+}
+function normalizeKey(value) {
+  const trimmed = value.trim();
+  if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'")) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+function tablePath(line) {
+  const match = /^\s*\[([^\r\n]+)\]\s*(?:#.*)?$/.exec(line);
+  const rawPath = match?.[1];
+  if (!rawPath || rawPath.includes("[") || rawPath.includes("]")) return null;
+  return rawPath.split(".").map(normalizeKey);
+}
+function tableSections(lines) {
+  const starts = [];
+  for (let index = 0; index < lines.length; index += 1) {
+    const path22 = tablePath(lines[index] ?? "");
+    if (path22) starts.push({ path: path22, start: index });
+  }
+  return starts.map((section, index) => ({
+    ...section,
+    end: starts[index + 1]?.start ?? lines.length
+  }));
+}
+function isManagedSection(section) {
+  return section.path[0] === "mcp_servers" && MANAGED_SERVER_NAMES.has(section.path[1] ?? "");
+}
+function assignmentKey(line) {
+  const match = /^\s*((?:[A-Za-z0-9_-]+)|(?:"[^"]+")|(?:'[^']+'))\s*=/.exec(line);
+  return match?.[1] ? normalizeKey(match[1]) : null;
+}
+function isStructurallySafeToml(raw) {
+  const lines = raw.split(/\r?\n/);
+  const beginIndexes = lines.flatMap((line, index) => line.trim() === MANAGED_BEGIN ? [index] : []);
+  const endIndexes = lines.flatMap((line, index) => line.trim() === MANAGED_END ? [index] : []);
+  if (beginIndexes.length !== endIndexes.length || beginIndexes.length > 1) return false;
+  if (beginIndexes[0] !== void 0 && (endIndexes[0] ?? -1) <= beginIndexes[0]) return false;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (/^\[\[?mcp_servers(?:\.|\s|$)/.test(trimmed) && tablePath(line) === null) return false;
+  }
+  return true;
+}
+function tomlString(value) {
+  return JSON.stringify(value);
+}
+function preservedSectionLines(lines, section, managedKeys) {
+  if (!section) return [];
+  return lines.slice(section.start + 1, section.end).filter((line) => {
+    if (line.trim() === MANAGED_BEGIN || line.trim() === MANAGED_END) return false;
+    const key = assignmentKey(line);
+    return key === null || !managedKeys.has(key);
+  }).filter((line, index, all) => line.trim() !== "" || index > 0 && index < all.length - 1);
+}
+function readCodexManagedEnv(configPath, key) {
+  if (!existsSync5(configPath)) return void 0;
+  const raw = readFileSync4(configPath, "utf8");
+  const lines = raw.split(/\r?\n/);
+  const sections = tableSections(lines);
+  const envSection = sections.find((section) => isManagedSection(section) && section.path[2] === "env");
+  if (!envSection) return void 0;
+  for (const line of lines.slice(envSection.start + 1, envSection.end)) {
+    if (assignmentKey(line) !== key) continue;
+    const match = /=\s*("(?:[^"\\]|\\.)*")\s*(?:#.*)?$/.exec(line);
+    if (!match?.[1]) return void 0;
+    try {
+      const value = JSON.parse(match[1]);
+      return typeof value === "string" ? value : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
+function renderCodexMcpConfig(raw, cliPath, controlPlaneUrl2, managedEnv = {}) {
+  if (!isStructurallySafeToml(raw)) {
+    throw new Error("Codex config is malformed; refusing to overwrite it");
+  }
+  const eol = raw.includes("\r\n") ? "\r\n" : "\n";
+  const lines = raw.split(/\r?\n/);
+  const sections = tableSections(lines);
+  const rootSections = sections.filter((section) => isManagedSection(section) && section.path.length === 2);
+  const preferredRoot = rootSections.find((section) => section.path[1] === "algohq") ?? rootSections[0];
+  const preferredName = preferredRoot?.path[1];
+  const envSection = sections.find((section) => isManagedSection(section) && section.path[1] === preferredName && section.path[2] === "env");
+  const rootExtras = preservedSectionLines(lines, preferredRoot, /* @__PURE__ */ new Set(["command", "args", "required"]));
+  const envExtras = preservedSectionLines(lines, envSection, /* @__PURE__ */ new Set(["VO_CONTROL_PLANE_URL", MCP_FALLBACK_CLI_ENV, ...Object.keys(managedEnv)]));
+  const removed = /* @__PURE__ */ new Set();
+  for (const [index, line] of lines.entries()) {
+    if (line.trim() === MANAGED_BEGIN || line.trim() === MANAGED_END) removed.add(index);
+  }
+  for (const section of sections.filter(isManagedSection)) {
+    for (let index = section.start; index < section.end; index += 1) removed.add(index);
+  }
+  const base = lines.filter((_line, index) => !removed.has(index)).join(eol).trimEnd();
+  const block = [
+    MANAGED_BEGIN,
+    "[mcp_servers.algohq]",
+    'command = "node"',
+    `args = [${tomlString(cliPath)}]`,
+    "required = true",
+    ...rootExtras,
+    "",
+    "[mcp_servers.algohq.env]",
+    `VO_CONTROL_PLANE_URL = ${tomlString(controlPlaneUrl2)}`,
+    ...Object.entries(managedEnv).map(([key, value]) => `${key} = ${tomlString(value)}`),
+    ...envExtras,
+    MANAGED_END
+  ].join(eol);
+  return `${base}${base ? `${eol}${eol}` : ""}${block}${eol}`;
+}
+function installCodexMcpConfigAt(configPath, cliPath, controlPlaneUrl2, log2, managedEnv = {}) {
+  const exists = existsSync5(configPath);
+  const readMtime = exists ? statSync2(configPath).mtimeMs : null;
+  const raw = exists ? readFileSync4(configPath, "utf8") : "";
+  let rendered;
+  try {
+    rendered = renderCodexMcpConfig(raw, cliPath, controlPlaneUrl2, managedEnv);
+  } catch (error) {
+    const backupPath2 = backupConfigOnce(configPath);
+    if (backupPath2) log2(`  Backed up malformed Codex config \u2192 ${backupPath2}`);
+    throw error;
+  }
+  if (rendered === raw) {
+    log2(`  Codex already current: ${configPath}`);
+    return;
+  }
+  if (readMtime !== null && (!existsSync5(configPath) || statSync2(configPath).mtimeMs !== readMtime)) {
+    log2(`  \u26A0 Codex config changed while updating \u2014 left untouched this time: ${configPath}`);
+    return;
+  }
+  const backupPath = backupConfigOnce(configPath);
+  if (backupPath) log2(`  Backed up Codex config \u2192 ${backupPath}`);
+  mkdirSync4(dirname3(configPath), { recursive: true });
+  writeFileAtomic(configPath, rendered);
+  log2(`\u2713 Wrote AlgoHQ MCP to Codex: ${configPath}`);
+}
+var MANAGED_BEGIN, MANAGED_END, MANAGED_SERVER_NAMES;
+var init_codex_mcp_config = __esm({
+  "src/codex-mcp-config.ts"() {
+    "use strict";
+    init_config_backup();
+    init_mcp_launcher();
+    MANAGED_BEGIN = "# BEGIN AlgoHQ MCP (managed by vo-mcp install)";
+    MANAGED_END = "# END AlgoHQ MCP (managed by vo-mcp install)";
+    MANAGED_SERVER_NAMES = /* @__PURE__ */ new Set(["algohq", "vo", "vo-mcp", "vo_mcp"]);
+  }
+});
+
+// src/autostart.ts
+import { homedir as homedir4, platform as platform2 } from "node:os";
+import { isAbsolute as isAbsolute2, join as join5 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, readFileSync as readFileSync5, unlinkSync as unlinkSync3, copyFileSync as copyFileSync2 } from "node:fs";
+function resolveRunnerCommand(override) {
+  return override ?? "vo-mcp runner";
+}
+function quotePosixShellArgument(value) {
+  if (value.includes("\0") || value.includes("\r") || value.includes("\n")) {
+    throw new Error("Runner command must not contain NUL, carriage return, or newline characters.");
+  }
+  return `'${value.replace(/'/gu, `'"'"'`)}'`;
+}
+function resolveLinuxConfigHome(home, env2) {
+  const configured = env2["XDG_CONFIG_HOME"]?.trim();
+  return configured && isAbsolute2(configured) ? configured : join5(home, ".config");
+}
+function launcherIsCurrent(path22, desiredContent, label, log2) {
+  if (!existsSync6(path22)) return false;
+  if (readFileSync5(path22, "utf8") === desiredContent) return true;
+  const backupPath = `${path22}.backup-${Date.now()}`;
+  copyFileSync2(path22, backupPath);
+  log2(`  Backed up existing ${label} to: ${backupPath}`);
+  return false;
+}
+function installWindowsAutostart(runnerCommand, log2, env2) {
+  const appData = env2["APPDATA"] ?? join5(homedir4(), "AppData", "Roaming");
+  const startupDir = join5(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Startup");
+  mkdirSync5(startupDir, { recursive: true });
+  const launcherPath = join5(startupDir, "vo-runner.vbs");
+  const legacyCmdPath = join5(startupDir, "vo-runner.cmd");
+  if (existsSync6(legacyCmdPath)) {
+    try {
+      unlinkSync3(legacyCmdPath);
+      log2(`  Removed legacy minimized .cmd launcher: ${legacyCmdPath}`);
+    } catch (error) {
+      log2(`\u26A0 Could not remove legacy launcher ${legacyCmdPath} (${error instanceof Error ? error.message : String(error)}); remove it manually to avoid a double start`);
+    }
+  }
+  const hiddenCommand = `cmd /c ${runnerCommand} >> "%USERPROFILE%\\.claude\\vo-runner.log" 2>&1`.replace(/"/g, '""');
+  const launcherContent = `' Auto-start launcher for vo-mcp runner
+' Created by vo-mcp autostart installer
+' Keepalive supervisor: restarts the runner if it exits (parity with launchd
+' KeepAlive on macOS and systemd Restart=on-failure on Linux).
+' To stop: create %USERPROFILE%\\.claude\\vo-runner.stop, or end wscript.exe.
+Dim sh, fso, stopFile, backoff, startedAt, ranMs
+Set sh = CreateObject("WScript.Shell")
+Set fso = CreateObject("Scripting.FileSystemObject")
+sh.CurrentDirectory = sh.ExpandEnvironmentStrings("%USERPROFILE%")
+sh.Environment("Process")("VO_CODE_RUNNER_CLONES_ROOT") = sh.ExpandEnvironmentStrings("%APPDATA%\\ai.algosuite.vo-runner\\clones")
+stopFile = sh.ExpandEnvironmentStrings("%USERPROFILE%\\.claude\\vo-runner.stop")
+backoff = ${WINDOWS_RESTART_BACKOFF_MS}
+Do
+  If fso.FileExists(stopFile) Then
+    fso.DeleteFile stopFile
+    WScript.Quit 0
+  End If
+  startedAt = Timer
+  sh.Run "${hiddenCommand}", 0, True
+  ranMs = (Timer - startedAt) * 1000
+  If ranMs < 0 Then ranMs = ${WINDOWS_HEALTHY_RUN_MS}
+  If ranMs >= ${WINDOWS_HEALTHY_RUN_MS} Then
+    backoff = ${WINDOWS_RESTART_BACKOFF_MS}
+  ElseIf backoff < ${WINDOWS_MAX_BACKOFF_MS} Then
+    backoff = backoff * 2
+  End If
+  WScript.Sleep backoff
+Loop
+`;
+  if (launcherIsCurrent(launcherPath, launcherContent, "launcher", log2)) {
+    log2(`\u2713 Auto-start is already configured (Windows Startup folder)`);
+    log2(`  Path: ${launcherPath}`);
+    return;
+  }
+  writeFileSync4(launcherPath, launcherContent, "utf8");
+  log2(`\u2713 Installed Windows auto-start launcher`);
+  log2(`  Path: ${launcherPath}`);
+  log2(`  The runner will start hidden at next login.`);
+}
+async function installMacAutostart(runnerCommand, log2, env2) {
+  const home = env2["HOME"]?.trim() || homedir4();
+  const launchAgentsDir = join5(home, "Library", "LaunchAgents");
+  mkdirSync5(launchAgentsDir, { recursive: true });
+  const plistPath = join5(launchAgentsDir, "ai.algosuite.vo-runner.plist");
+  const parts = runnerCommand.split(/\s+/);
+  const program = parts[0] ?? "vo-mcp";
+  const args = parts.length > 1 ? parts.slice(1) : ["runner"];
+  const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>ai.algosuite.vo-runner</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${program}</string>
+${args.map((a) => `    <string>${a}</string>`).join("\n")}
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>WorkingDirectory</key>
+  <string>${home}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>VO_CODE_RUNNER_CLONES_ROOT</key>
+    <string>${join5(home, "Library", "Application Support", "ai.algosuite.vo-runner", "clones")}</string>
+  </dict>
+  <key>StandardOutPath</key>
+  <string>${join5(home, ".claude", "vo-runner.log")}</string>
+  <key>StandardErrorPath</key>
+  <string>${join5(home, ".claude", "vo-runner-error.log")}</string>
+</dict>
+</plist>
+`;
+  if (launcherIsCurrent(plistPath, plistContent, "plist", log2)) {
+    log2(`\u2713 Auto-start is already configured (launchd)`);
+    log2(`  Path: ${plistPath}`);
+    return;
+  }
+  writeFileSync4(plistPath, plistContent, "utf8");
+  log2(`\u2713 Installed launchd plist`);
+  log2(`  Path: ${plistPath}`);
+  try {
+    const { execSync } = await import("node:child_process");
+    execSync(`launchctl load "${plistPath}"`, { stdio: "ignore" });
+    log2(`\u2713 Loaded plist with launchctl (runner will start at next login)`);
+    log2(`  Logs: ${join5(home, ".claude", "vo-runner.log")}`);
+  } catch {
+    log2(`\u26A0 Failed to load plist with launchctl (you may need to load it manually)`);
+    log2(`  Run: launchctl load "${plistPath}"`);
+  }
+}
+async function installLinuxAutostart(runnerCommand, log2, env2) {
+  const home = env2["HOME"]?.trim() || homedir4();
+  const configHome = resolveLinuxConfigHome(home, env2);
+  const unitDir = join5(configHome, "systemd", "user");
+  mkdirSync5(unitDir, { recursive: true });
+  const unitPath = join5(unitDir, "vo-runner.service");
+  const logFile = join5(home, ".claude", "vo-runner.log");
+  const errFile = join5(home, ".claude", "vo-runner-error.log");
+  const quotedRunnerCommand = quotePosixShellArgument(runnerCommand);
+  mkdirSync5(join5(home, ".claude"), { recursive: true });
+  const unit = `[Unit]
+Description=AlgoHQ Code Runner (vo-mcp)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=${home}
+Environment="VO_CODE_RUNNER_CLONES_ROOT=${join5(configHome, "ai.algosuite.vo-runner", "clones")}"
+ExecStart=/bin/sh -lc ${quotedRunnerCommand}
+Restart=on-failure
+RestartSec=10
+StandardOutput=append:${logFile}
+StandardError=append:${errFile}
+
+[Install]
+WantedBy=default.target
+`;
+  if (launcherIsCurrent(unitPath, unit, "unit", log2)) {
+    log2(`\u2713 Auto-start is already configured (systemd user unit)`);
+    log2(`  Path: ${unitPath}`);
+    return;
+  }
+  writeFileSync4(unitPath, unit, "utf8");
+  log2(`\u2713 Installed systemd user unit`);
+  log2(`  Path: ${unitPath}`);
+  if (process.env["VITEST"]) {
+    log2(`  (test mode: skipping systemctl enable)`);
+    return;
+  }
+  try {
+    const { execSync } = await import("node:child_process");
+    execSync("systemctl --user daemon-reload", { stdio: "ignore" });
+    execSync("systemctl --user enable --now vo-runner.service", { stdio: "ignore" });
+    log2(`\u2713 Enabled + started vo-runner.service (starts at login)`);
+    log2(`  Logs: ${logFile}`);
+  } catch {
+    log2(`\u26A0 Could not enable via systemctl (enable it manually):`);
+    log2(`  systemctl --user daemon-reload && systemctl --user enable --now vo-runner.service`);
+  }
+}
+async function installAutostart(opts = {}) {
+  const log2 = opts.log ?? ((m) => console.error(m));
+  const env2 = opts.env ?? process.env;
+  const runnerCommand = resolveRunnerCommand(opts.runnerCommand);
+  const plat = opts.platform ?? platform2();
+  if (plat === "win32") {
+    installWindowsAutostart(runnerCommand, log2, env2);
+  } else if (plat === "darwin") {
+    await installMacAutostart(runnerCommand, log2, env2);
+  } else if (plat === "linux") {
+    await installLinuxAutostart(runnerCommand, log2, env2);
+  } else {
+    log2(`\u2717 Auto-start is not supported on platform: ${plat}`);
+    log2(`  Supported platforms: win32 (Windows), darwin (macOS), linux (Linux)`);
+  }
+}
+var WINDOWS_RESTART_BACKOFF_MS, WINDOWS_HEALTHY_RUN_MS, WINDOWS_MAX_BACKOFF_MS;
+var init_autostart = __esm({
+  "src/autostart.ts"() {
+    "use strict";
+    WINDOWS_RESTART_BACKOFF_MS = 1e4;
+    WINDOWS_HEALTHY_RUN_MS = 6e4;
+    WINDOWS_MAX_BACKOFF_MS = 3e5;
+  }
+});
+
+// src/install.ts
+var install_exports = {};
+__export(install_exports, {
+  healMcpRegistration: () => healMcpRegistration,
+  install: () => install,
+  installOptionsFromArgs: () => installOptionsFromArgs
+});
+import { homedir as homedir5, platform as platform3 } from "node:os";
+import { join as join6, dirname as dirname4 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync6, mkdirSync as mkdirSync6, statSync as statSync3 } from "node:fs";
+import { fileURLToPath } from "node:url";
+function resolveCodeConfigPath(home) {
+  return join6(home, ".claude.json");
+}
+function resolveDesktopConfigPath(home, plat, appData) {
+  if (plat === "win32") {
+    return join6(appData ?? join6(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+  }
+  if (plat === "darwin") {
+    return join6(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+  }
+  return join6(home, ".config", "Claude", "claude_desktop_config.json");
+}
+function readClaudeConfig(path22) {
+  if (!existsSync7(path22)) return { kind: "absent", config: {}, mtimeMs: null };
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    const before = statSync3(path22).mtimeMs;
+    let raw;
+    try {
+      raw = readFileSync6(path22, "utf8");
+    } catch {
+      return { kind: "invalid", config: {}, mtimeMs: before };
+    }
+    if (!existsSync7(path22) || statSync3(path22).mtimeMs !== before) continue;
+    const text = raw.replace(/^\uFEFF/u, "");
+    if (!text.trim()) return { kind: "empty", config: {}, mtimeMs: before };
+    try {
+      const parsed = JSON.parse(text);
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? { kind: "ok", config: parsed, mtimeMs: before } : { kind: "invalid", config: {}, mtimeMs: before };
+    } catch {
+      return { kind: "invalid", config: {}, mtimeMs: before };
+    }
+  }
+  return { kind: "invalid", config: {}, mtimeMs: null };
+}
+function writeClaudeConfig(path22, config) {
+  mkdirSync6(dirname4(path22), { recursive: true });
+  writeFileAtomic(path22, `${JSON.stringify(config, null, 2)}
+`);
+}
+function carriedEntryKeys(entry) {
+  if (!entry) return {};
+  const { command: _c, args: _a, env: _e, type, url: _u, headers: _h, ...rest } = entry;
+  const stdio = type === void 0 || type === "stdio";
+  return { ...stdio ? rest : {}, ...type === "stdio" ? { type } : {} };
+}
+function preferredNodeCommand(existing) {
+  const current = String(existing ?? "").trim();
+  return current && /(^|[\\/])node(\.exe)?$/iu.test(current) ? current : "node";
+}
+function resolveVoMcpCliPath() {
+  return join6(dirname4(fileURLToPath(import.meta.url)), "cli.js");
+}
+function installMcpConfigAt(configPath, cliPath, controlPlaneUrl2, log2, label, launcher = { launcherPath: null, ...INSTALL_LAUNCHER }) {
+  if (launcher.onlyExisting && !existsSync7(configPath)) return;
+  const read = readClaudeConfig(configPath);
+  if (read.kind === "invalid" || read.kind === "empty" && launcher.onlyExisting) {
+    log2(`  \u26A0 ${label} config is ${read.kind === "empty" ? "empty" : "not valid JSON"} \u2014 left untouched: ${configPath}${read.kind === "empty" ? "" : " (fix or remove it, then re-run vo-mcp install)"}`);
+    return;
+  }
+  const existing = read.config;
+  const readMtime = read.mtimeMs;
+  const mcpServers = existing["mcpServers"] && typeof existing["mcpServers"] === "object" ? existing["mcpServers"] : {};
+  const managedEntry = mcpServers["vo-mcp"];
+  const voEntry = managedEntry ?? mcpServers["vo"];
+  const { launcherPath } = launcher;
+  const fallbackCli = chooseFallbackCli(voEntry?.env?.[MCP_FALLBACK_CLI_ENV], cliPath, launcher.sticky, launcherPath ? dirname4(launcherPath) : null);
+  const current = launcherPath ? !isStaleVoMcpEntry(voEntry, launcherPath, fallbackCli) : Boolean(voEntry?.args?.some((a) => a.includes(cliPath)));
+  if (current) {
+    log2(`  ${label} already current: ${configPath}`);
+    return;
+  }
+  const backupPath = backupConfigOnce(configPath);
+  if (backupPath) log2(`  Backed up ${label} config \u2192 ${backupPath}`);
+  const { [MCP_FALLBACK_CLI_ENV]: _previousFallback, ...preservedEnv } = voEntry?.env ?? {};
+  const merged = {
+    ...existing,
+    mcpServers: {
+      ...mcpServers,
+      "vo-mcp": {
+        ...carriedEntryKeys(managedEntry),
+        command: preferredNodeCommand(managedEntry?.command),
+        args: [launcherPath ?? cliPath],
+        env: {
+          VO_CONTROL_PLANE_URL: controlPlaneUrl2,
+          ...preservedEnv,
+          ...launcherPath && fallbackCli ? { [MCP_FALLBACK_CLI_ENV]: fallbackCli } : {}
+        }
+      }
+    }
+  };
+  if (readMtime !== null && (!existsSync7(configPath) || statSync3(configPath).mtimeMs !== readMtime)) {
+    log2(`  \u26A0 ${label} config changed while updating \u2014 left untouched this time: ${configPath}`);
+    return;
+  }
+  writeClaudeConfig(configPath, merged);
+  log2(`\u2713 Wrote vo-mcp to ${label}: ${configPath}`);
+}
+function installMcpConfig(log2, env2, mode = "install") {
+  const home = env2["HOME"]?.trim() || env2["USERPROFILE"]?.trim() || homedir5();
+  const appData = env2["APPDATA"]?.trim();
+  const plat = platform3();
+  const cliPath = resolveVoMcpCliPath();
+  const controlPlaneUrl2 = env2["VO_CONTROL_PLANE_URL"]?.trim() || DEFAULT_CONTROL_PLANE_URL2;
+  const launcherPath = writeMcpLauncherForEnv(env2, log2, { platform: plat, home });
+  const launcher = { launcherPath, ...mode === "heal" ? HEAL_LAUNCHER : INSTALL_LAUNCHER };
+  const leg = (label, run) => {
+    try {
+      run();
+    } catch (err) {
+      if (mode !== "heal") throw err;
+      log2(`  \u26A0 ${label}: could not update the MCP registration \u2014 ${err instanceof Error ? err.message : String(err)}`);
+    }
+  };
+  leg("Claude Code CLI", () => installMcpConfigAt(resolveCodeConfigPath(home), cliPath, controlPlaneUrl2, log2, "Claude Code CLI", launcher));
+  leg("Claude Desktop", () => installMcpConfigAt(resolveDesktopConfigPath(home, plat, appData), cliPath, controlPlaneUrl2, log2, "Claude Desktop", launcher));
+  const codexPath = resolveCodexConfigPath(home);
+  if (launcher.onlyExisting && !existsSync7(codexPath)) return;
+  leg("Codex", () => {
+    if (launcherPath) {
+      const fallbackCli = chooseFallbackCli(readCodexManagedEnv(codexPath, MCP_FALLBACK_CLI_ENV), cliPath, launcher.sticky, dirname4(launcherPath));
+      installCodexMcpConfigAt(codexPath, launcherPath, controlPlaneUrl2, log2, fallbackCli ? { [MCP_FALLBACK_CLI_ENV]: fallbackCli } : {});
+    } else {
+      installCodexMcpConfigAt(codexPath, cliPath, controlPlaneUrl2, log2);
+    }
+  });
+}
+function writeMcpLauncherForEnv(env2, log2, hint) {
+  try {
+    const root = defaultRunnerRuntimeRoot(env2, hint);
+    if (!root) return null;
+    return writeMcpLauncher(root);
+  } catch (err) {
+    log2(`  \u26A0 could not write the vo-mcp launcher (registering cli.js directly): ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+}
+function healMcpRegistration(log2 = () => {
+}, env2 = process.env) {
+  try {
+    installMcpConfig(log2, env2, "heal");
+  } catch (err) {
+    log2(`vo-mcp: MCP registration heal skipped: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+async function runPairFlow(log2, env2) {
+  log2("\n\u2501\u2501\u2501 Step 2: Link your AlgoHQ account (device code) \u2501\u2501\u2501");
+  log2("A short code appears below \u2014 open the URL it prints and enter the code.");
+  log2("Your raw token never persists; a scoped credential is stored in your OS keychain.\n");
+  try {
+    const result = await runPairing({ env: env2, log: log2 });
+    log2(`
+\u2713 Paired \u2014 scoped credential stored at: ${result.credentialPath}`);
+  } catch (err) {
+    log2(`
+\u26A0 Pairing didn't complete: ${err instanceof Error ? err.message : String(err)}`);
+    log2("  No problem \u2014 the rest will finish; pair anytime with: vo-mcp pair");
+  }
+}
+function printNextSteps(log2, autostartInstalled, configOnly) {
+  log2("\n\u2501\u2501\u2501 Installation complete! \u2501\u2501\u2501\n");
+  log2("What's configured:");
+  log2("  \u2713 Claude Desktop, Claude Code, and Codex will load AlgoHQ MCP on next restart");
+  if (configOnly) {
+    log2("  \u2713 Existing pairing and runner auto-start settings were left unchanged");
+  } else {
+    log2("  \u2713 Your scoped credential is stored (revocable via the dashboard)");
+  }
+  if (autostartInstalled) {
+    log2("  \u2713 Runner daemon will start automatically at login\n");
+  } else {
+    log2("\n");
+  }
+  log2("Next steps:");
+  log2("  1. Restart Claude Desktop / Claude Code / Codex (if running).");
+  if (configOnly) {
+    log2("  2. Restart the existing AlgoHQ runner service or runner terminal.");
+  } else if (autostartInstalled) {
+    log2("  2. Log out and back in (or start the runner manually now: vo-mcp runner)");
+  } else {
+    log2("  2. Start the agent runner in a terminal (keep it running):");
+    log2("       vo-mcp runner");
+    log2("     (To set up auto-start at login: vo-mcp runner --install-autostart)");
+  }
+  log2("  3. Visit AlgoHQ to dispatch your first agent:");
+  log2("       https://algosuite.ai/algohq\n");
+  log2("The runner watches for tasks you dispatch and spins up agents in fresh worktrees.");
+  log2("Agents only run while the runner is connected. Ctrl+C to stop it anytime.\n");
+}
+async function install(opts = {}) {
+  const log2 = opts.log ?? ((m) => console.error(m));
+  const env2 = opts.env ?? process.env;
+  log2("\u2501\u2501\u2501 vo-mcp installer \u2501\u2501\u2501");
+  log2("This will set up your machine to dispatch AlgoHQ agents from anywhere.\n");
+  log2("\u2501\u2501\u2501 Step 1: Configure Claude Desktop / Claude Code / Codex \u2501\u2501\u2501");
+  installMcpConfig(log2, env2);
+  if (!opts.skipLogin) {
+    await runPairFlow(log2, env2);
+  } else if (opts.configOnly) {
+    log2("\n(Config-only refresh \u2014 existing pairing left unchanged.)");
+  } else {
+    log2("\n(Pairing skipped \u2014 run `vo-mcp pair` when ready.)");
+  }
+  let autostartInstalled = false;
+  if (!opts.skipAutostart) {
+    const plat = platform3();
+    if (plat === "win32" || plat === "darwin" || plat === "linux") {
+      log2("\n\u2501\u2501\u2501 Step 3: Set up auto-start \u2501\u2501\u2501");
+      log2("Would you like the runner daemon to start automatically at login?");
+      log2("(You can skip this and set it up later with: vo-mcp runner --install-autostart)\n");
+      await installAutostart({ log: log2, env: env2 });
+      autostartInstalled = true;
+    }
+  }
+  printNextSteps(log2, autostartInstalled, opts.configOnly === true);
+}
+function installOptionsFromArgs(args) {
+  const configOnly = args.includes("--config-only");
+  return configOnly ? { configOnly: true, skipLogin: true, skipAutostart: true } : {};
+}
+var DEFAULT_CONTROL_PLANE_URL2, INSTALL_LAUNCHER, HEAL_LAUNCHER;
+var init_install = __esm({
+  "src/install.ts"() {
+    "use strict";
+    init_pairing();
+    init_codex_mcp_config();
+    init_mcp_launcher();
+    init_config_backup();
+    init_autostart();
+    DEFAULT_CONTROL_PLANE_URL2 = "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
+    INSTALL_LAUNCHER = { sticky: false, onlyExisting: false };
+    HEAL_LAUNCHER = { sticky: true, onlyExisting: true };
+  }
+});
+
 // src/runner/pnpm-link-detach.mjs
 import fsp from "node:fs/promises";
 import path from "node:path";
@@ -369,15 +1274,15 @@ var init_pnpm_link_detach = __esm({
 import { spawn } from "node:child_process";
 function sleepMs(ms) {
   if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function spawnUtility(command, args, timeoutMs) {
-  return await new Promise((resolve2) => {
+  return await new Promise((resolve3) => {
     let settled = false;
     const finish = (result) => {
       if (settled) return;
       settled = true;
-      resolve2(result);
+      resolve3(result);
     };
     const child = spawn(command, args, {
       stdio: "ignore",
@@ -431,7 +1336,7 @@ async function runProcess(command, args = [], options = {}) {
     stdio: ["ignore", "pipe", "pipe"],
     windowsHide: true
   };
-  return await new Promise((resolve2) => {
+  return await new Promise((resolve3) => {
     let settled = false;
     let stdout = "";
     let stderr = "";
@@ -449,7 +1354,7 @@ async function runProcess(command, args = [], options = {}) {
       if (settled) return;
       settled = true;
       clearTimers();
-      resolve2({ stdout, stderr, timedOut, ...result });
+      resolve3({ stdout, stderr, timedOut, ...result });
     };
     const beginForceKill = () => {
       if (settled || !child?.pid) return;
@@ -505,8 +1410,8 @@ async function runProcess(command, args = [], options = {}) {
   });
 }
 async function commandExists(command, options = {}) {
-  const platform = options.platform || process.platform;
-  const checker = platform === "win32" ? "where" : "which";
+  const platform4 = options.platform || process.platform;
+  const checker = platform4 === "win32" ? "where" : "which";
   const result = await (options.runner || runProcess)(checker, [command], {
     timeoutMs: 1e4
   });
@@ -904,22 +1809,22 @@ function trustedCorepackCandidates(options) {
   return [...new Set(roots)].map((root) => portableJoin(root, "node_modules", "corepack", "dist", "corepack.js"));
 }
 function resolveTrustedCorepackJs(options) {
-  const existsSync7 = options.existsSync || fs2.existsSync;
-  return trustedCorepackCandidates(options).find((candidate) => existsSync7(candidate)) || "";
+  const existsSync12 = options.existsSync || fs2.existsSync;
+  return trustedCorepackCandidates(options).find((candidate) => existsSync12(candidate)) || "";
 }
 async function resolvePnpmInstallCommand(root, options = {}) {
   const runner = options.runner || runProcess;
-  const platform = options.platform || process.platform;
+  const platform4 = options.platform || process.platform;
   const selector = pnpmSelector(root);
-  if (platform !== "win32") {
-    if (await commandExists("pnpm", { runner, platform })) {
+  if (platform4 !== "win32") {
+    if (await commandExists("pnpm", { runner, platform: platform4 })) {
       return {
         command: "pnpm",
         args: [...DEFAULT_PNPM_INSTALL_ARGS],
         displayCommand: ["pnpm", ...DEFAULT_PNPM_INSTALL_ARGS]
       };
     }
-    if (await commandExists("corepack", { runner, platform })) {
+    if (await commandExists("corepack", { runner, platform: platform4 })) {
       return {
         command: "corepack",
         args: [selector, ...DEFAULT_PNPM_INSTALL_ARGS],
@@ -1411,7 +2316,7 @@ var init_pnpm_hydration = __esm({
 // src/runner/worktree-paths.mjs
 import { createHash as createHash2 } from "node:crypto";
 import path6 from "node:path";
-function samePath(left, right) {
+function samePath2(left, right) {
   const a = path6.resolve(left);
   const b = path6.resolve(right);
   return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
@@ -1420,7 +2325,7 @@ function worktreePoolForRoot(root, { clonesRootDir = process.env.VO_CODE_RUNNER_
   const canonicalRoot = path6.resolve(root);
   if (clonesRootDir) {
     const clonePool = path6.resolve(clonesRootDir);
-    if (samePath(path6.dirname(canonicalRoot), clonePool)) {
+    if (samePath2(path6.dirname(canonicalRoot), clonePool)) {
       return path6.join(clonePool, ".agent-worktrees", path6.basename(canonicalRoot));
     }
   }
@@ -3012,7 +3917,7 @@ var init_control_plane_client = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/windows-claude-launch.mjs
-import { existsSync as existsSync3, realpathSync } from "node:fs";
+import { existsSync as existsSync8, realpathSync } from "node:fs";
 import { win32 as path11 } from "node:path";
 import { spawnSync } from "node:child_process";
 function pathValue(env2) {
@@ -3086,7 +3991,7 @@ function canonicalExistingPath(candidate, exists, canonicalize) {
 function resolveWindowsClaudeExecutable({
   bin = "claude",
   env: env2 = process.env,
-  exists = existsSync3,
+  exists = existsSync8,
   canonicalize = realpathSync
 } = {}) {
   const requested = String(bin || "").trim();
@@ -3264,10 +4169,10 @@ function augmentAuthError(summary) {
 function probeClaudeLoginState({
   spawn: spawn5 = spawnSync2,
   buildWindowsLaunch = buildWindowsClaudeLaunch,
-  platform = process.platform
+  platform: platform4 = process.platform
 } = {}) {
   try {
-    const launch = platform === "win32" ? buildWindowsLaunch({ bin: "claude", args: ["auth", "status"] }) : { bin: "claude", args: ["auth", "status"], spawnOptions: { windowsHide: true } };
+    const launch = platform4 === "win32" ? buildWindowsLaunch({ bin: "claude", args: ["auth", "status"] }) : { bin: "claude", args: ["auth", "status"], spawnOptions: { windowsHide: true } };
     const st = spawn5(launch.bin, launch.args, { ...launch.spawnOptions, timeout: 5e3, encoding: "utf8" });
     const parsed = JSON.parse(String(st.stdout || "").trim() || "{}");
     return typeof parsed.loggedIn === "boolean" ? parsed.loggedIn : null;
@@ -3554,11 +4459,11 @@ var init_claude_args = __esm({
 import { spawnSync as spawnSync4 } from "node:child_process";
 function terminateAgentProcessTree({
   child,
-  platform = process.platform,
+  platform: platform4 = process.platform,
   spawn: spawn5 = spawnSync4
 } = {}) {
   if (!child || !Number.isInteger(child.pid) || child.pid <= 0) return false;
-  if (platform === "win32") {
+  if (platform4 === "win32") {
     const result = spawn5("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
       windowsHide: true,
       stdio: "ignore",
@@ -3592,7 +4497,7 @@ var init_terminal_process_cleanup = __esm({
 
 // ../../scripts/virtual-office/code-runner/orphan-agent-reaper.mjs
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, readdirSync as readdirSync2, readFileSync as readFileSync7, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import os from "node:os";
 import path12 from "node:path";
 function registryRoot(tmp = os.tmpdir()) {
@@ -3609,9 +4514,9 @@ function registerDaemonInstance({
 } = {}) {
   if (!instanceId) return null;
   const dir = instanceDir(root, instanceId);
-  mkdirSync3(dir, { recursive: true });
+  mkdirSync7(dir, { recursive: true });
   const file = path12.join(dir, DAEMON_RECORD);
-  writeFileSync2(file, JSON.stringify({ daemonPid, daemonStartedAtMs, instanceId }), {
+  writeFileSync5(file, JSON.stringify({ daemonPid, daemonStartedAtMs, instanceId }), {
     encoding: "utf8",
     mode: 384
   });
@@ -3627,8 +4532,8 @@ function recordAgentPid({
   if (!instanceId || !Number.isInteger(pid) || pid <= 0) return false;
   try {
     const dir = instanceDir(root, instanceId);
-    mkdirSync3(dir, { recursive: true });
-    writeFileSync2(
+    mkdirSync7(dir, { recursive: true });
+    writeFileSync5(
       path12.join(dir, `${pid}.json`),
       JSON.stringify({ pid, agentId, startedAtMs, instanceId }),
       { encoding: "utf8", mode: 384 }
@@ -3663,10 +4568,10 @@ function bootstrapOrphanReaper({ instanceId, log: log2 = () => {
 }
 function readRegistry({ root = registryRoot(), currentInstanceId } = {}) {
   const instances = [];
-  if (!existsSync4(root)) return instances;
+  if (!existsSync9(root)) return instances;
   let dirents;
   try {
-    dirents = readdirSync(root, { withFileTypes: true });
+    dirents = readdirSync2(root, { withFileTypes: true });
   } catch {
     return instances;
   }
@@ -3678,14 +4583,14 @@ function readRegistry({ root = registryRoot(), currentInstanceId } = {}) {
     const agents = [];
     let files;
     try {
-      files = readdirSync(dir);
+      files = readdirSync2(dir);
     } catch {
       continue;
     }
     for (const name of files) {
       let parsed;
       try {
-        parsed = JSON.parse(readFileSync2(path12.join(dir, name), "utf8"));
+        parsed = JSON.parse(readFileSync7(path12.join(dir, name), "utf8"));
       } catch {
         continue;
       }
@@ -3735,9 +4640,9 @@ function windowsSystemRoot(env2 = process.env) {
 function windowsPowershellExe(env2 = process.env) {
   return path12.join(windowsSystemRoot(env2), "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
 }
-function listProcessCreationTimes({ platform = process.platform, spawn: spawn5 = spawnSync5, env: env2 = process.env, warn = console.warn } = {}) {
+function listProcessCreationTimes({ platform: platform4 = process.platform, spawn: spawn5 = spawnSync5, env: env2 = process.env, warn = console.warn } = {}) {
   const map = /* @__PURE__ */ new Map();
-  if (platform === "win32") {
+  if (platform4 === "win32") {
     const ps = "Get-CimInstance Win32_Process | ForEach-Object { '{0} {1}' -f $_.ProcessId, (([DateTimeOffset]$_.CreationDate.ToUniversalTime()).ToUnixTimeMilliseconds()) }";
     const result2 = spawn5(windowsPowershellExe(env2), ["-NoProfile", "-NonInteractive", "-Command", ps], {
       windowsHide: true,
@@ -3775,9 +4680,9 @@ function parsePosixPsLine(line) {
   if (!Number.isInteger(pid) || pid <= 0 || !Number.isFinite(when)) return null;
   return { pid, creationMs: when };
 }
-function killProcessTree(pid, { platform = process.platform, spawn: spawn5 = spawnSync5, env: env2 = process.env } = {}) {
+function killProcessTree(pid, { platform: platform4 = process.platform, spawn: spawn5 = spawnSync5, env: env2 = process.env } = {}) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
-  if (platform === "win32") {
+  if (platform4 === "win32") {
     const taskkill = path12.join(windowsSystemRoot(env2), "System32", "taskkill.exe");
     const r = spawn5(taskkill, ["/PID", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore", timeout: 15e3 });
     return !r.error && r.status === 0;
@@ -4223,7 +5128,7 @@ function runAgentTask({
   spawnImpl = spawn2,
   sandbox = null
 }) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const args = runner.buildArgs({ permissionMode, maxTurns, model, effort, maxBudgetUsd, researchHarness, prompt });
     const spawnEnv = typeof runner.applyAuthEnv === "function" ? runner.applyAuthEnv(env2) : env2;
     const costBasis = typeof runner.costBasis === "function" ? runner.costBasis(spawnEnv) : "unknown";
@@ -4294,7 +5199,7 @@ function runAgentTask({
       if (settled) return;
       settled = true;
       clearLifecycleHandles();
-      resolve2(value);
+      resolve3(value);
     };
     const recordResultEvent = (evt) => {
       const summary = !evt.isError && /^completed$/i.test(String(evt.summary || "").trim()) && lastProgress ? lastProgress : evt.summary;
@@ -4614,17 +5519,17 @@ var init_flat_token_usage = __esm({
 
 // ../../scripts/virtual-office/code-runner/codex-runner.mjs
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 import { win32 as win322 } from "node:path";
 function isTruthyFlag2(value) {
   return ["1", "true", "yes", "on"].includes(String(value ?? "").trim().toLowerCase());
 }
 function resolveCodexBinary({
   env: env2 = process.env,
-  platform = process.platform,
-  exists = existsSync5
+  platform: platform4 = process.platform,
+  exists = existsSync10
 } = {}) {
-  if (platform !== "win32") return "codex";
+  if (platform4 !== "win32") return "codex";
   const appData = String(env2.APPDATA || "").trim();
   const userProfile = String(env2.USERPROFILE || "").trim();
   const localAppData = String(env2.LOCALAPPDATA || "").trim();
@@ -5108,8 +6013,8 @@ var init_ollama_agent_core = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/ollama-native-transport.mjs
-import { fileURLToPath } from "node:url";
-import { dirname as dirname2, join as join2 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { dirname as dirname5, join as join7 } from "node:path";
 function resolveLocalNativeProfile(env2 = process.env) {
   const profile = String(env2.VO_CODE_RUNNER_LOCAL_PROFILE || "").trim().toLowerCase() || DEFAULT_LOCAL_NATIVE_PROFILE;
   if (!LOCAL_NATIVE_PROFILES.includes(profile)) {
@@ -5121,7 +6026,7 @@ function resolveLocalTransport(env2 = process.env) {
   return String(env2.VO_CODE_RUNNER_LOCAL_TRANSPORT || "").trim().toLowerCase() === "native" ? "native" : DEFAULT_LOCAL_TRANSPORT;
 }
 function ollamaAgentScriptPath() {
-  return join2(dirname2(fileURLToPath(import.meta.url)), "ollama-agent.mjs");
+  return join7(dirname5(fileURLToPath2(import.meta.url)), "ollama-agent.mjs");
 }
 function posIntOr(raw, fallback) {
   const n = Number(String(raw ?? "").trim());
@@ -5816,15 +6721,15 @@ var init_rate_limit_resume_state = __esm({
     LOCK_STALE_MS = 10 * 60 * 1e3;
     LOCK_INIT_GRACE_MS = 5e3;
     LOCK_WAIT_MS = 1e4;
-    delay = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+    delay = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
   }
 });
 
 // ../../scripts/virtual-office/code-runner/rate-limit-resume.mjs
-import { homedir as homedir3 } from "node:os";
-import { join as join3 } from "node:path";
+import { homedir as homedir6 } from "node:os";
+import { join as join8 } from "node:path";
 function resumeQueuePath() {
-  return join3(homedir3(), ".claude", "resume-queue.jsonl");
+  return join8(homedir6(), ".claude", "resume-queue.jsonl");
 }
 function buildResumeEntry({ task = {}, resumeAfter = null, summary = "", at } = {}) {
   return {
@@ -6040,8 +6945,8 @@ var init_auto_merge = __esm({
 
 // ../../scripts/virtual-office/code-runner/pr-overlap-gate.mjs
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync6 } from "node:fs";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { existsSync as existsSync11 } from "node:fs";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 function stripCredentials(env2 = process.env) {
   const safe = { ...env2 };
   for (const key of CREDENTIAL_ENV_KEYS) delete safe[key];
@@ -6051,7 +6956,7 @@ function resolveOverlapScript({
   worktreeDir,
   trustedPath = null,
   trustedPaths = TRUSTED_OVERLAP_CANDIDATES,
-  existsFn = existsSync6,
+  existsFn = existsSync11,
   joinFn = (dir) => `${dir}/scripts/ci/check-local-pr-overlap.mjs`
 } = {}) {
   const candidates = trustedPath ? [trustedPath] : trustedPaths;
@@ -6099,7 +7004,7 @@ var init_pr_overlap_gate = __esm({
     TRUSTED_OVERLAP_CANDIDATES = [
       new URL("../../ci/check-local-pr-overlap.mjs", import.meta.url),
       new URL("./ci/check-local-pr-overlap.js", import.meta.url)
-    ].map((candidate) => fileURLToPath2(candidate));
+    ].map((candidate) => fileURLToPath3(candidate));
     CREDENTIAL_ENV_KEYS = Object.freeze([
       "GH_TOKEN",
       "GITHUB_TOKEN",
@@ -6538,9 +7443,9 @@ function boundedTail(text) {
   return s.length <= COMPLETION_GATE_OUTPUT_CAP ? s : s.slice(s.length - COMPLETION_GATE_OUTPUT_CAP);
 }
 function workspaceFingerprint(worktreeDir, execFileImpl = execFile) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     execFileImpl("git", ["rev-parse", "HEAD^{tree}"], { cwd: worktreeDir }, (err, stdout) => {
-      resolve2(err ? null : String(stdout).trim() || null);
+      resolve3(err ? null : String(stdout).trim() || null);
     });
   });
 }
@@ -6559,10 +7464,10 @@ function writeState(worktreeDir, state) {
   }
 }
 function runGateCommand({ argv, worktreeDir, timeoutMs = COMPLETION_GATE_TIMEOUT_MS, execFileImpl = execFile }) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const command = ALLOWED_GATE_COMMANDS.get(argv?.[0]);
     if (command === void 0) {
-      return resolve2({
+      return resolve3({
         exitCode: 1,
         output: `completion_gate executable is not an allowed gate runner (${[...ALLOWED_GATE_COMMANDS.keys()].join(", ")})`,
         timedOut: false
@@ -6575,10 +7480,10 @@ function runGateCommand({ argv, worktreeDir, timeoutMs = COMPLETION_GATE_TIMEOUT
       (err, stdout, stderr) => {
         const output = boundedTail(`${stdout ?? ""}
 ${stderr ?? ""}`.trim());
-        if (!err) return resolve2({ exitCode: 0, output, timedOut: false });
+        if (!err) return resolve3({ exitCode: 0, output, timedOut: false });
         const timedOut = err.killed === true || err.signal === "SIGTERM";
         const exitCode = typeof err.code === "number" ? err.code : 1;
-        resolve2({ exitCode, output: output || boundedTail(err.message), timedOut });
+        resolve3({ exitCode, output: output || boundedTail(err.message), timedOut });
       }
     );
   });
@@ -6683,7 +7588,7 @@ function runProcess2(cmd, args, {
   forceSettleAfterMs = 1e3,
   spawnImpl = spawn3
 } = {}) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let settled = false;
     let timedOut = false;
     let stdout = "";
@@ -6733,7 +7638,7 @@ function runProcess2(cmd, args, {
         settle(reject, buildExitError(cmd, args, result));
         return;
       }
-      settle(resolve2, result.stdout);
+      settle(resolve3, result.stdout);
     });
     if (timeout > 0) {
       timeoutTimer = setTimeout(() => {
@@ -7011,6 +7916,7 @@ async function openCodeTaskPrAsync(worktreeDir, files, {
   if (!Array.isArray(files) || files.length === 0) throw new Error("openCodeTaskPrAsync: no files to commit");
   let branch;
   let truncated = false;
+  let newCommit = null;
   if (alreadyCommitted) {
     branch = await resolveOrCreateBranchAsync(worktreeDir, branchPrefix, runCommand);
   } else {
@@ -7023,6 +7929,7 @@ async function openCodeTaskPrAsync(worktreeDir, files, {
     });
     branch = committed.branch;
     truncated = committed.truncated;
+    newCommit = committed.committed;
   }
   const prBranch = String(targetBranch || branch).trim() || branch;
   const overlap = await runOverlapGate(worktreeDir, files.filter((file) => !isAgentScratch(file)), {
@@ -7077,6 +7984,7 @@ async function openCodeTaskPrAsync(worktreeDir, files, {
       prNumber: existing.number,
       branch: prBranch,
       truncated,
+      newCommit,
       resumed: true,
       markedReady,
       overlapDraft,
@@ -7115,7 +8023,7 @@ async function openCodeTaskPrAsync(worktreeDir, files, {
     runCommand,
     onCleanupWarning
   });
-  return { prUrl, prNumber, branch: prBranch, truncated, overlapDraft, overlapBlockedBy, ...autoMerge, ...superseded };
+  return { prUrl, prNumber, branch: prBranch, truncated, newCommit, overlapDraft, overlapBlockedBy, ...autoMerge, ...superseded };
 }
 var sleep;
 var init_publish_async = __esm({
@@ -7130,14 +8038,14 @@ var init_publish_async = __esm({
     init_pr_overlap_gate();
     init_existing_pr_publication();
     init_partial_pr_continuation();
-    sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+    sleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
   }
 });
 
 // ../../scripts/virtual-office/code-runner/skill-catalog.mjs
-import { readdirSync as readdirSync2, readFileSync as readFileSync3, statSync } from "node:fs";
-import { dirname as dirname3, join as join4 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync4 } from "node:fs";
+import { dirname as dirname6, join as join9 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 function parseFrontmatterNameDescription(raw) {
   const text = String(raw).replace(/\r\n/g, "\n");
   if (!text.startsWith("---\n")) return null;
@@ -7156,15 +8064,15 @@ function parseFrontmatterNameDescription(raw) {
   return name && description ? { name, description } : null;
 }
 function resolveDefaultRepoRoot() {
-  const starts = [dirname3(fileURLToPath3(import.meta.url)), process.cwd()];
+  const starts = [dirname6(fileURLToPath4(import.meta.url)), process.cwd()];
   for (const start of starts) {
     let dir = start;
     for (let i = 0; i < 8; i += 1) {
       try {
-        if (statSync(join4(dir, ".claude", "skills")).isDirectory()) return dir;
+        if (statSync4(join9(dir, ".claude", "skills")).isDirectory()) return dir;
       } catch {
       }
-      const parent = dirname3(dir);
+      const parent = dirname6(dir);
       if (parent === dir) break;
       dir = parent;
     }
@@ -7173,14 +8081,14 @@ function resolveDefaultRepoRoot() {
 }
 function loadSkillCatalog({ repoRoot: repoRoot2 = resolveDefaultRepoRoot() } = {}) {
   try {
-    const skillsDir = join4(repoRoot2, ".claude", "skills");
+    const skillsDir = join9(repoRoot2, ".claude", "skills");
     const catalog = [];
-    for (const entry of readdirSync2(skillsDir)) {
-      const dir = join4(skillsDir, entry);
+    for (const entry of readdirSync3(skillsDir)) {
+      const dir = join9(skillsDir, entry);
       try {
-        if (!statSync(dir).isDirectory()) continue;
+        if (!statSync4(dir).isDirectory()) continue;
         const parsed = parseFrontmatterNameDescription(
-          readFileSync3(join4(dir, "SKILL.md"), "utf8")
+          readFileSync8(join9(dir, "SKILL.md"), "utf8")
         );
         if (parsed) catalog.push(parsed);
       } catch {
@@ -7680,8 +8588,8 @@ var init_task_attachments = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/session-spool-forwarder.mjs
-import { homedir as homedir4 } from "node:os";
-import { join as join5 } from "node:path";
+import { homedir as homedir7 } from "node:os";
+import { join as join10 } from "node:path";
 import { readdir as readdir2, readFile as readFile2, unlink, writeFile as writeFile2 } from "node:fs/promises";
 import { createHash as createHash4 } from "node:crypto";
 function deriveUuid(seed) {
@@ -7713,9 +8621,9 @@ async function readSpool(spoolDir = SPOOL_DIR) {
   for (const f of files) {
     if (!f.endsWith(".json")) continue;
     try {
-      const record = JSON.parse(await readFile2(join5(spoolDir, f), "utf8"));
+      const record = JSON.parse(await readFile2(join10(spoolDir, f), "utf8"));
       if (record && typeof record.session_key === "string") {
-        out.push({ full: join5(spoolDir, f), record });
+        out.push({ full: join10(spoolDir, f), record });
       }
     } catch {
     }
@@ -7797,8 +8705,8 @@ var SPOOL_DIR, CLOUD_MAP_FILE, STALE_MS, ACTIVE_SILENCE_MS;
 var init_session_spool_forwarder = __esm({
   "../../scripts/virtual-office/code-runner/session-spool-forwarder.mjs"() {
     "use strict";
-    SPOOL_DIR = join5(homedir4(), ".vo", "session-spool");
-    CLOUD_MAP_FILE = join5(homedir4(), ".vo", "session-cloud-map.json");
+    SPOOL_DIR = join10(homedir7(), ".vo", "session-spool");
+    CLOUD_MAP_FILE = join10(homedir7(), ".vo", "session-cloud-map.json");
     STALE_MS = 60 * 60 * 1e3;
     ACTIVE_SILENCE_MS = 10 * 60 * 1e3;
   }
@@ -7869,7 +8777,7 @@ var init_rate_limit_resume_scheduler_core = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/rate-limit-resume-scheduler.mjs
-import { dirname as dirname4, join as join6, resolve } from "node:path";
+import { dirname as dirname7, join as join11, resolve as resolve2 } from "node:path";
 function defaultLog(message) {
   console.log(`[rate-limit-scheduler ${(/* @__PURE__ */ new Date()).toISOString()}] ${message}`);
 }
@@ -7951,7 +8859,7 @@ async function runLockedScheduler({
 async function runScheduler({
   env: env2 = process.env,
   queuePath = resumeQueuePath(),
-  attemptsPath = join6(dirname4(queuePath), "resume-attempts.json"),
+  attemptsPath = join11(dirname7(queuePath), "resume-attempts.json"),
   client,
   now,
   log: log2 = defaultLog
@@ -7980,9 +8888,9 @@ var init_rate_limit_resume_scheduler = __esm({
     ATTEMPTS_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
     isMainModule = (() => {
       try {
-        const argv1 = process.argv[1] ? resolve(process.argv[1]) : "";
+        const argv1 = process.argv[1] ? resolve2(process.argv[1]) : "";
         const here = new URL(import.meta.url).pathname.replace(/^\/([a-zA-Z]):\//u, "$1:/");
-        return resolve(here) === argv1;
+        return resolve2(here) === argv1;
       } catch {
         return false;
       }
@@ -8040,10 +8948,10 @@ function makeLoopTicks({
       state = { running: false, pending: null };
       heartbeatState.set(key, state);
     }
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       if (state.running) {
-        if (state.pending) state.pending.waiters.push(resolve2);
-        else state.pending = { payload, waiters: [resolve2] };
+        if (state.pending) state.pending.waiters.push(resolve3);
+        else state.pending = { payload, waiters: [resolve3] };
         state.pending.payload = payload;
         return;
       }
@@ -8071,7 +8979,7 @@ function makeLoopTicks({
           }
         });
       };
-      launch(payload, [resolve2]);
+      launch(payload, [resolve3]);
     });
   }
   return function tick() {
@@ -8248,7 +9156,7 @@ var init_runner_capacity = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/agent-auth-probe-process.mjs
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 async function probeAgentInChild(agent, timeoutMs) {
   const stdout = await runProcess2(process.execPath, [probeCli, agent], {
     timeout: timeoutMs,
@@ -8261,7 +9169,7 @@ var init_agent_auth_probe_process = __esm({
   "../../scripts/virtual-office/code-runner/agent-auth-probe-process.mjs"() {
     "use strict";
     init_process_runner2();
-    probeCli = fileURLToPath4(new URL("./agent-auth-probe-cli.mjs", import.meta.url));
+    probeCli = fileURLToPath5(new URL("./agent-auth-probe-cli.mjs", import.meta.url));
   }
 });
 
@@ -8280,7 +9188,7 @@ async function collectAgentAvailability({
     try {
       const r = await Promise.race([
         runnerFor ? Promise.resolve().then(() => runnerFor(agent).checkAuth()) : probeAgentInChild(agent, probeTimeoutMs),
-        new Promise((resolve2) => setTimeout(() => resolve2(null), probeTimeoutMs))
+        new Promise((resolve3) => setTimeout(() => resolve3(null), probeTimeoutMs))
       ]);
       if (!r) return degraded;
       const installed = Boolean(r?.installed);
@@ -8540,7 +9448,7 @@ function readingAgeMs(row, nowMs = Date.now()) {
   if (!Number.isFinite(ms)) return null;
   return Math.max(0, nowMs - ms);
 }
-var clampPct, readJson, ACCOUNT_KEY_SALT;
+var clampPct, readJson2, ACCOUNT_KEY_SALT;
 var init_shared = __esm({
   "../../scripts/virtual-office/code-runner/account-usage/shared.mjs"() {
     "use strict";
@@ -8548,7 +9456,7 @@ var init_shared = __esm({
       const n = typeof v === "number" ? v : typeof v === "string" && v.trim() !== "" ? Number(v) : NaN;
       return Number.isFinite(n) ? Math.min(100, Math.max(0, Math.round(n))) : null;
     };
-    readJson = (p) => {
+    readJson2 = (p) => {
       try {
         return JSON.parse(fs9.readFileSync(p, "utf8"));
       } catch {
@@ -8575,7 +9483,7 @@ function usageBaseUrl(env2 = process.env) {
   const raw = env2.ANTHROPIC_BASE_URL || "https://api.anthropic.com";
   return String(raw).replace(/\/+$/, "");
 }
-function readOAuthToken({ homeDir = os3.homedir(), read = readJson, now = Date.now() } = {}) {
+function readOAuthToken({ homeDir = os3.homedir(), read = readJson2, now = Date.now() } = {}) {
   const creds = read(path17.join(homeDir, ".claude", ".credentials.json"));
   const oauth = creds && typeof creds === "object" ? creds.claudeAiOauth : null;
   if (!oauth || typeof oauth !== "object") return null;
@@ -8585,7 +9493,7 @@ function readOAuthToken({ homeDir = os3.homedir(), read = readJson, now = Date.n
   if (Number.isFinite(expiresAt) && expiresAt > 0 && expiresAt <= now) return null;
   return token2;
 }
-function readAccountId({ homeDir = os3.homedir(), read = readJson } = {}) {
+function readAccountId({ homeDir = os3.homedir(), read = readJson2 } = {}) {
   const cfg = read(path17.join(homeDir, ".claude.json"));
   const account = cfg && typeof cfg === "object" ? cfg.oauthAccount : null;
   return account && typeof account.accountUuid === "string" ? account.accountUuid : null;
@@ -8638,7 +9546,7 @@ async function readClaudeOAuthUsage({
   env: env2 = process.env,
   timeoutMs = DEFAULT_TIMEOUT_MS,
   homeDir = os3.homedir(),
-  read = readJson,
+  read = readJson2,
   now = () => Date.now()
 } = {}) {
   const token2 = readOAuthToken({ homeDir, read, now: now() });
@@ -8678,7 +9586,7 @@ async function readClaudeOAuthUsage({
 }
 function readClaudeFileUsage({
   homeDir = os3.homedir(),
-  read: rawRead = readJson,
+  read: rawRead = readJson2,
   statFn = fs10.statSync,
   now = () => Date.now()
 } = {}) {
@@ -8779,10 +9687,10 @@ function readCodexUsage({
   resolveBinary = resolveCodexBinary,
   timeoutMs = 8e3,
   env: env2 = process.env,
-  platform = process.platform,
+  platform: platform4 = process.platform,
   now = () => Date.now()
 } = {}) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     let child;
     let settled = false;
     let stdout = "";
@@ -8794,11 +9702,11 @@ function readCodexUsage({
         child?.kill();
       } catch {
       }
-      resolve2(value);
+      resolve3(value);
     };
     const timer = setTimeout(() => finish(null), timeoutMs);
     try {
-      const binary = resolveBinary({ env: env2, platform });
+      const binary = resolveBinary({ env: env2, platform: platform4 });
       child = spawnImpl(binary, ["app-server", "--stdio"], {
         env: env2,
         windowsHide: true,
@@ -9111,6 +10019,12 @@ function ciFixOccurrenceKey({ repo, prNumber, headSha, repairAttempt }) {
 function coordinationRetryDue(entry, nowMs) {
   return !entry.nextRetryAt || nowMs >= entry.nextRetryAt;
 }
+function mergeEnqueueActive(entry, nowMs = Date.now()) {
+  if (!entry?.mergeEnqueued) return false;
+  const at = Number(entry.mergeEnqueuedAt || 0);
+  if (!at) return true;
+  return nowMs - at < MERGE_ENQUEUE_TTL_MS;
+}
 function isTerminalResumeRefusal(error) {
   return typeof error?.code === "string" && TERMINAL_RESUME_REFUSALS.includes(error.code);
 }
@@ -9151,12 +10065,13 @@ async function scheduleCoordinationRetry({
   }
   log2(`watch: pr #${prNumber} ${kind} coordination failed ${entry[errorsKey]}x; retry in ${Math.round(delay2 / 1e3)}s: ${boundedErrorMessage(error)}`);
 }
-var MAX_BACKOFF_MS, TERMINAL_RESUME_REFUSALS;
+var MAX_BACKOFF_MS, MERGE_ENQUEUE_TTL_MS, TERMINAL_RESUME_REFUSALS;
 var init_watcher_coordination = __esm({
   "../../scripts/virtual-office/code-runner/watcher-coordination.mjs"() {
     "use strict";
     init_error_message();
     MAX_BACKOFF_MS = 60 * 60 * 1e3;
+    MERGE_ENQUEUE_TTL_MS = 2 * 60 * 60 * 1e3;
     TERMINAL_RESUME_REFUSALS = Object.freeze([
       "automatic_continuation_budget_too_small",
       "automatic_continuation_budget_required",
@@ -9174,7 +10089,7 @@ var init_watcher_coordination = __esm({
 // ../../scripts/virtual-office/code-runner/watcher-state.mjs
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { mkdir as mkdir2, open, readFile as readFile3, rename, unlink as unlink2 } from "node:fs/promises";
-import { dirname as dirname5 } from "node:path";
+import { dirname as dirname8 } from "node:path";
 async function readWatcherState(stateFile) {
   let raw;
   try {
@@ -9190,7 +10105,7 @@ async function readWatcherState(stateFile) {
   return parsed;
 }
 async function writeWatcherState(stateFile, state) {
-  const directory = dirname5(stateFile);
+  const directory = dirname8(stateFile);
   await mkdir2(directory, { recursive: true });
   const temp = `${stateFile}.${process.pid}.${randomUUID3()}.tmp`;
   let handle;
@@ -9397,6 +10312,41 @@ function noteCiUnreadable(log2) {
   lastDiagnosticAt = now;
   log2("watch: CI status is UNREADABLE with the GitHub App read token (the installation has not granted checks:read/statuses:read \u2014 accept the App permission update on the installation). Auto-fix and merge stay dormant; untrack/resume keep working on state alone.");
 }
+function noteCiViaRest(log2) {
+  const now = Date.now();
+  if (now - lastRestDiagnosticAt < DIAGNOSTIC_INTERVAL_MS) return;
+  lastRestDiagnosticAt = now;
+  log2("watch: CI status read via REST check-runs/status (gh's GraphQL rollup needs actions:read for checkSuite.workflowRun, which the read scope does not carry)");
+}
+async function readCommitCiViaRest(repo, sha, { run, env: env2 }) {
+  const api = async (path22) => JSON.parse(await run("gh", ["api", path22], { timeout: 3e4, env: env2 }) || "{}");
+  const rollup = [];
+  let total = null;
+  for (let page = 1; page <= REST_MAX_PAGES && (total === null || rollup.length < total); page += 1) {
+    const body = await api(`repos/${repo}/commits/${sha}/check-runs?per_page=${REST_PAGE_SIZE}&page=${page}`);
+    if (!Number.isFinite(Number(body?.total_count))) throw new CiRollupIncompleteError("check-runs response carried no total_count");
+    total = Number(body.total_count);
+    const runs = Array.isArray(body?.check_runs) ? body.check_runs : [];
+    for (const r of runs) {
+      rollup.push({
+        __typename: "CheckRun",
+        name: String(r?.name || ""),
+        status: String(r?.status || ""),
+        conclusion: r?.conclusion == null ? null : String(r.conclusion),
+        ...r?.details_url ? { detailsUrl: String(r.details_url) } : {}
+      });
+    }
+    if (runs.length === 0) break;
+  }
+  if (total === null || rollup.length < total) {
+    throw new CiRollupIncompleteError(`read ${rollup.length} of ${total ?? "?"} check runs (page bound ${REST_MAX_PAGES}\xD7${REST_PAGE_SIZE})`);
+  }
+  const status = await api(`repos/${repo}/commits/${sha}/status?per_page=${REST_PAGE_SIZE}`);
+  for (const s of Array.isArray(status?.statuses) ? status.statuses : []) {
+    rollup.push({ __typename: "StatusContext", context: String(s?.context || ""), state: String(s?.state || "") });
+  }
+  return rollup;
+}
 async function ghViewPr(prNumber, repo, { githubToken, log: log2 = (m) => console.error(`[vo-runner] ${m}`), run = runProcess2 } = {}) {
   const env2 = githubToken ? { ...process.env, GH_TOKEN: githubToken } : process.env;
   const view = async (fields) => JSON.parse(await run("gh", [
@@ -9412,12 +10362,24 @@ async function ghViewPr(prNumber, repo, { githubToken, log: log2 = (m) => consol
     return await view(VIEW_FIELDS_WITH_CI);
   } catch (err) {
     if (!isCiUnreadableError(err)) throw err;
-    noteCiUnreadable(log2);
     const withoutCi = await view(VIEW_FIELDS_WITHOUT_CI);
+    if (typeof withoutCi.headRefOid === "string" && /^[0-9a-f]{40}$/i.test(withoutCi.headRefOid)) {
+      try {
+        const statusCheckRollup = await readCommitCiViaRest(repo, withoutCi.headRefOid, { run, env: env2 });
+        noteCiViaRest(log2);
+        return { ...withoutCi, statusCheckRollup, ciSource: "rest" };
+      } catch (restErr) {
+        const text = `${restErr?.message || ""}
+${restErr?.stderr || ""}`;
+        if (!(restErr instanceof CiRollupIncompleteError) && !/Resource not accessible by integration/i.test(text)) throw restErr;
+        if (restErr instanceof CiRollupIncompleteError) log2(`watch: CI rollup incomplete via REST (${restErr.message}) \u2014 reporting ci=unknown`);
+      }
+    }
+    noteCiUnreadable(log2);
     return { ...withoutCi, statusCheckRollup: null, ciUnreadable: true, ciUnreadableReason: CI_UNREADABLE_REASON };
   }
 }
-var VIEW_FIELDS_WITH_CI, VIEW_FIELDS_WITHOUT_CI, CI_UNREADABLE_REASON, DIAGNOSTIC_INTERVAL_MS, lastDiagnosticAt;
+var VIEW_FIELDS_WITH_CI, VIEW_FIELDS_WITHOUT_CI, CI_UNREADABLE_REASON, DIAGNOSTIC_INTERVAL_MS, lastDiagnosticAt, lastRestDiagnosticAt, REST_PAGE_SIZE, REST_MAX_PAGES, CiRollupIncompleteError;
 var init_pr_watcher_github = __esm({
   "../../scripts/virtual-office/code-runner/pr-watcher-github.mjs"() {
     "use strict";
@@ -9427,6 +10389,15 @@ var init_pr_watcher_github = __esm({
     CI_UNREADABLE_REASON = "app_token_missing_checks_read";
     DIAGNOSTIC_INTERVAL_MS = 30 * 60 * 1e3;
     lastDiagnosticAt = 0;
+    lastRestDiagnosticAt = 0;
+    REST_PAGE_SIZE = 100;
+    REST_MAX_PAGES = 5;
+    CiRollupIncompleteError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "CiRollupIncompleteError";
+      }
+    };
   }
 });
 
@@ -9463,8 +10434,8 @@ var init_enqueue_autonomous_code_task = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/pr-watcher.mjs
-import { homedir as homedir5 } from "node:os";
-import { join as join7 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+import { join as join12 } from "node:path";
 function parsePrCiStatus(view) {
   const state = (view && typeof view.state === "string" ? view.state : "UNKNOWN").toUpperCase();
   const rollup = view && Array.isArray(view.statusCheckRollup) ? view.statusCheckRollup : [];
@@ -9501,14 +10472,14 @@ function parsePrCiStatus(view) {
     mergeState: String(view?.mergeStateStatus || "").toUpperCase()
   };
 }
-function decideWatchAction(pr, fixAttempts, maxFixAttempts, entry = {}, maxResumeAttempts = 1, autoMergeEnabled = false) {
+function decideWatchAction(pr, fixAttempts, maxFixAttempts, entry = {}, maxResumeAttempts = 1, autoMergeEnabled = false, nowMs = Date.now()) {
   if (pr.state !== "OPEN") return "untrack";
   if (entry && entry.needsContinuation && entry.taskId) {
     if (pr.ci === "pending") return "wait";
     return (entry.resumeAttempts || 0) < maxResumeAttempts ? "resume" : "wait";
   }
   if (pr.ci === "failing" && entry.allowFixDispatch !== false && (fixAttempts || 0) < maxFixAttempts) return "fix";
-  if (autoMergeEnabled && pr.ci === "passing" && pr.mergeState === "CLEAN" && !pr.isDraft && !entry.mergeTerminal && !entry.mergeEnqueued && (entry.mergeAttempts || 0) < 3) return "merge";
+  if (autoMergeEnabled && pr.ci === "passing" && pr.mergeState === "CLEAN" && !pr.isDraft && !entry.mergeTerminal && !mergeEnqueueActive(entry, nowMs) && (entry.mergeAttempts || 0) < 3) return "merge";
   return "wait";
 }
 async function trackDispatchedPr({ prNumber, repo, branch, taskId, operatorId, tenantId, needsContinuation = false, continuationExhausted = false, repairChain, allowFixDispatch }, { stateFile = DEFAULT_STATE_FILE, now = () => Date.now() } = {}) {
@@ -9585,7 +10556,8 @@ async function runWatchCycleUnlocked({
       maxFixAttempts,
       entry,
       maxResumeAttempts,
-      autoMergeEnabled
+      autoMergeEnabled,
+      now()
     );
     const stableAction = proposedAction === "fix" && !confirmation.confirmed ? "wait" : proposedAction;
     const action = coordinationRetryDue(entry, now()) ? stableAction : "wait";
@@ -9636,6 +10608,7 @@ async function runWatchCycleUnlocked({
           log2(`watch: pr #${prNumber} passed CI + consensus and merged (${outcome.actionReceiptId || "receipt pending"})`);
         } else if (outcome.status === "queued" || outcome.status === "accepted") {
           entry.mergeEnqueued = true;
+          entry.mergeEnqueuedAt = now();
           entry.mergeActionReceiptId = outcome.actionReceiptId || null;
           queued += 1;
           log2(`watch: pr #${prNumber} passed CI + consensus and entered the merge queue (${outcome.actionReceiptId || "receipt pending"})`);
@@ -9808,7 +10781,7 @@ var init_pr_watcher = __esm({
     init_watcher_state();
     init_superseded_pr_source();
     init_ci_fix_prompt();
-    DEFAULT_STATE_FILE = join7(homedir5(), ".vo", "dispatched-prs.json");
+    DEFAULT_STATE_FILE = join12(homedir8(), ".vo", "dispatched-prs.json");
     FAIL_CONCLUSIONS = /* @__PURE__ */ new Set([
       "FAILURE",
       "TIMED_OUT",
@@ -10243,7 +11216,7 @@ import { randomUUID as randomUUID5 } from "node:crypto";
 import fs11 from "node:fs";
 import os4 from "node:os";
 import path18 from "node:path";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
 function userCacheRoot() {
   try {
     const home = os4.homedir();
@@ -10438,7 +11411,7 @@ var __dirname, DEFAULT_CACHE_DIR, DEFAULT_CACHE_FILE, DEFAULT_TTL_MS3, ANTHROPIC
 var init_model_registry = __esm({
   "../../scripts/virtual-office/model-registry.mjs"() {
     "use strict";
-    __dirname = path18.dirname(fileURLToPath5(import.meta.url));
+    __dirname = path18.dirname(fileURLToPath6(import.meta.url));
     DEFAULT_CACHE_DIR = path18.join(
       resolveCacheBaseDir(),
       ".virtual-office-cache",
@@ -11051,9 +12024,9 @@ var init_classify_task = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/auto-router/effort-policy.mjs
-import { readFileSync as readFileSync4 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { join as join8 } from "node:path";
+import { readFileSync as readFileSync9 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { join as join13 } from "node:path";
 function difficultyToRung(difficulty, thresholds) {
   const b = thresholds.rungBounds;
   if (difficulty >= b.R5) return "R5";
@@ -11078,7 +12051,7 @@ function operatorTierToRung(tier, difficulty, thresholds) {
   if (tier === "best" && difficulty >= thresholds.rungBounds.R5) return "R5";
   return base;
 }
-function readCodexModelsCache({ path: path22 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync4 } = {}) {
+function readCodexModelsCache({ path: path22 = DEFAULT_CODEX_MODELS_CACHE, read = readFileSync9 } = {}) {
   try {
     const parsed = JSON.parse(read(path22, "utf8"));
     return Array.isArray(parsed?.models) ? parsed : null;
@@ -11130,7 +12103,7 @@ var init_effort_policy = __esm({
     init_meta_model_catalog();
     RUNG_ORDER = ["R1", "R2", "R3", "R4", "R5"];
     rungIndex = (rung) => RUNG_ORDER.indexOf(rung);
-    DEFAULT_CODEX_MODELS_CACHE = join8(homedir6(), ".codex", "models_cache.json");
+    DEFAULT_CODEX_MODELS_CACHE = join13(homedir9(), ".codex", "models_cache.json");
   }
 });
 
@@ -11260,18 +12233,18 @@ var init_role_cost_shadow = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/auto-router/auto-router.mjs
-import { readFileSync as readFileSync5, appendFileSync, mkdirSync as mkdirSync4 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { join as join9, dirname as dirname6 } from "node:path";
-import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { readFileSync as readFileSync10, appendFileSync, mkdirSync as mkdirSync8 } from "node:fs";
+import { homedir as homedir10 } from "node:os";
+import { join as join14, dirname as dirname9 } from "node:path";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
 function getAutoRouterMode(env2 = process.env) {
   const raw = String(env2.VO_CODE_RUNNER_AUTO_ROUTER || "").trim().toLowerCase();
   return MODES.has(raw) ? raw : "off";
 }
 function loadThresholds() {
   if (!cachedThresholds) {
-    const here = dirname6(fileURLToPath6(import.meta.url));
-    cachedThresholds = JSON.parse(readFileSync5(join9(here, "thresholds.json"), "utf8"));
+    const here = dirname9(fileURLToPath7(import.meta.url));
+    cachedThresholds = JSON.parse(readFileSync10(join14(here, "thresholds.json"), "utf8"));
   }
   return cachedThresholds;
 }
@@ -11337,9 +12310,9 @@ function formatDecisionReason(decision, maxLen = 480) {
   const s = `[${decision.routerVersion}] ${decision.taskClass} d=${decision.difficulty} c=${decision.confidence} \u2192 ${decision.rung}/${decision.tier}${decision.effort ? ` effort=${decision.effort}` : ""} turns=${decision.maxTurns} $${decision.maxBudgetUsd}${decision.flags.length ? ` [${decision.flags.join(",")}]` : ""} :: ${decision.reasons.join("; ")}`;
   return s.length > maxLen ? `${s.slice(0, maxLen - 1)}\u2026` : s;
 }
-function appendDecisionFallback(decision, { path: path22 = DECISION_FALLBACK_PATH, append = appendFileSync, mkdir: mkdir4 = mkdirSync4, task, thresholds, roleCostInputs } = {}) {
+function appendDecisionFallback(decision, { path: path22 = DECISION_FALLBACK_PATH, append = appendFileSync, mkdir: mkdir4 = mkdirSync8, task, thresholds, roleCostInputs } = {}) {
   try {
-    mkdir4(dirname6(path22), { recursive: true });
+    mkdir4(dirname9(path22), { recursive: true });
     append(path22, `${JSON.stringify(decision)}
 `, "utf8");
     if (isRouterDecision(decision)) {
@@ -11363,7 +12336,7 @@ var init_auto_router = __esm({
     init_effort_policy();
     init_role_cost_shadow();
     ROUTER_VERSION = "0.1.0";
-    DECISION_FALLBACK_PATH = join9(homedir7(), ".claude", "vo-auto-router-decisions.jsonl");
+    DECISION_FALLBACK_PATH = join14(homedir10(), ".claude", "vo-auto-router-decisions.jsonl");
     MODES = /* @__PURE__ */ new Set(["off", "shadow", "on"]);
     cachedThresholds = null;
     isRouterDecision = (d) => Boolean(d && typeof d === "object" && typeof d.taskClass === "string" && typeof d.confidence === "number");
@@ -11665,10 +12638,10 @@ var init_task_helpers = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/swarm-admission.mjs
-function canLaunchSuccessorAgent(agent, platform = process.platform) {
+function canLaunchSuccessorAgent(agent, platform4 = process.platform) {
   const name = typeof agent === "string" ? agent.trim() : "";
   if (!Object.prototype.hasOwnProperty.call(SUCCESSOR_LAUNCH_SHAPES, name)) return false;
-  if (platform === "win32" && !SUCCESSOR_LAUNCH_SHAPES[name]) return false;
+  if (platform4 === "win32" && !SUCCESSOR_LAUNCH_SHAPES[name]) return false;
   return true;
 }
 function isSubscriptionExhausted(usage) {
@@ -11695,12 +12668,12 @@ function resolveRunnerSwarmBinding({
   accountUsage = [],
   requestedSubagents = MAX_BOUND_SUBAGENTS,
   nowIso,
-  platform = process.platform
+  platform: platform4 = process.platform
 } = {}) {
   const id = typeof swarmId === "string" ? swarmId.trim() : "";
   const boundAgent = typeof agent === "string" ? agent.trim() : "";
   if (id.length === 0 || boundAgent.length === 0) return null;
-  if (!canLaunchSuccessorAgent(boundAgent, platform)) return null;
+  if (!canLaunchSuccessorAgent(boundAgent, platform4)) return null;
   const budget = clampSubagents(requestedSubagents);
   if (budget === 0) return null;
   const rows = Array.isArray(availableAgents) ? availableAgents : [];
@@ -12360,7 +13333,7 @@ async function canonicalRootForWorktree(worktreeDir, run) {
     "--git-common-dir"
   ])).trim();
   const root = path19.dirname(commonDir);
-  return samePath2(root, worktreeDir) ? null : root;
+  return samePath3(root, worktreeDir) ? null : root;
 }
 async function snapshot(root, run) {
   const [head, status] = await Promise.all([
@@ -12468,13 +13441,13 @@ async function assertCanonicalIsolation(baseline, { worktreeDir, taskId, run = d
     `agent attempted ${evidence.tracked.length + evidence.untracked.length} canonical-clone write(s); writes were quarantined and the clone was restored exactly: ${evidence.quarantineDir}`
   );
 }
-var splitZ2, samePath2;
+var splitZ2, samePath3;
 var init_isolation_audit = __esm({
   "../../scripts/virtual-office/code-runner/isolation-audit.mjs"() {
     "use strict";
     init_process_runner2();
     splitZ2 = (value) => String(value || "").split("\0").map((item) => item.trim()).filter(Boolean);
-    samePath2 = (left, right) => {
+    samePath3 = (left, right) => {
       const [a, b] = [left, right].map((value) => path19.resolve(value));
       return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
     };
@@ -12630,7 +13603,7 @@ var init_outcome_commit = __esm({
     "use strict";
     init_cancelled_run_report();
     init_error_message();
-    wait = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+    wait = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
     OutcomeCommitConflictError = class extends Error {
       constructor(message) {
         super(message);
@@ -12672,7 +13645,7 @@ var init_terminal_delivery = __esm({
     "use strict";
     init_cancelled_run_report();
     init_error_message();
-    wait2 = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+    wait2 = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
   }
 });
 
@@ -12866,7 +13839,7 @@ async function finalizePublishedPr({
     log: log2,
     patch: {
       status: "pr_opened",
-      message: `opened ${pr.prUrl}${overlapNote}`,
+      message: `opened ${pr.prUrl}${overlapNote}${pr.newCommit === false ? " (no new commits \u2014 the branch already held every change)" : ""}`,
       pr_url: pr.prUrl,
       pr_number: pr.prNumber,
       pr_branch: pr.branch,
@@ -13096,7 +14069,9 @@ async function findPreservedRecovery(task, {
   clonesRoot: clonesRoot2 = process.env.VO_CODE_RUNNER_CLONES_ROOT || "",
   readFile: readFile5 = fsp13.readFile,
   exists = fs13.existsSync,
-  alreadyPublished = preservedHeadAlreadyOnBranch
+  alreadyPublished = preservedHeadAlreadyOnBranch,
+  log: log2 = () => {
+  }
 } = {}) {
   const resumedFrom = /^[0-9a-f-]{36}$/iu.test(String(task.resumed_from || "")) ? String(task.resumed_from).toLowerCase() : null;
   const originalTaskId = recoveryTaskId(task.prompt) ?? resumedFrom;
@@ -13107,7 +14082,10 @@ async function findPreservedRecovery(task, {
     const resolved = entries.some((entry) => RESOLVED_RECOVERY_TYPES.has(entry.type) && entry.taskId === originalTaskId);
     const preserved = [...entries].reverse().find((entry) => entry.taskId === originalTaskId && entry.worktreeDir);
     if (!resolved && preserved && exists(preserved.worktreeDir)) {
-      if (task.pr_branch && await alreadyPublished(preserved.worktreeDir, task.pr_branch)) return null;
+      if (task.pr_branch && await alreadyPublished(preserved.worktreeDir, task.pr_branch)) {
+        log2(`recovery: preserved worktree of ${originalTaskId} is already on ${task.pr_branch}; running the agent instead`);
+        return null;
+      }
       return { originalTaskId, ledgerPath, preserved };
     }
   }
@@ -13115,11 +14093,19 @@ async function findPreservedRecovery(task, {
 }
 async function preservedHeadAlreadyOnBranch(worktreeDir, prBranch, { runGit = defaultRunGit } = {}) {
   try {
+    const dirty = (await runGit(["status", "--porcelain"], worktreeDir)).trim();
+    if (dirty.length > 0) return false;
     const head = (await runGit(["rev-parse", "HEAD"], worktreeDir)).trim();
-    const remote = (await runGit(["ls-remote", "origin", `refs/heads/${prBranch}`], worktreeDir)).trim().split(/\s+/u)[0];
-    if (!/^[0-9a-f]{40}$/u.test(head) || !/^[0-9a-f]{40}$/u.test(remote || "")) return false;
-    if (head === remote) return true;
-    await runGit(["merge-base", "--is-ancestor", head, remote], worktreeDir);
+    if (!/^[0-9a-f]{40}$/u.test(head)) return false;
+    let tip = "";
+    try {
+      tip = (await runGit(["rev-parse", `refs/remotes/origin/${prBranch}`], worktreeDir)).trim();
+    } catch {
+      tip = (await runGit(["ls-remote", "origin", `refs/heads/${prBranch}`], worktreeDir)).trim().split(/\s+/u)[0] || "";
+    }
+    if (!/^[0-9a-f]{40}$/u.test(tip)) return false;
+    if (head === tip) return true;
+    await runGit(["merge-base", "--is-ancestor", head, tip], worktreeDir);
     return true;
   } catch {
     return false;
@@ -13127,8 +14113,8 @@ async function preservedHeadAlreadyOnBranch(worktreeDir, prBranch, { runGit = de
 }
 async function defaultRunGit(args, cwd) {
   const { execFile: execFile2 } = await import("node:child_process");
-  return new Promise((resolve2, reject) => {
-    execFile2("git", args, { cwd, encoding: "utf8", timeout: 6e4 }, (err, stdout) => err ? reject(err) : resolve2(stdout));
+  return new Promise((resolve3, reject) => {
+    execFile2("git", args, { cwd, encoding: "utf8", timeout: 6e4 }, (err, stdout) => err ? reject(err) : resolve3(stdout));
   });
 }
 async function recoverPreservedCodeTask({
@@ -13143,7 +14129,7 @@ async function recoverPreservedCodeTask({
   finalizePublished = finalizePublishedPr,
   track
 } = {}) {
-  const recovery = await find(task);
+  const recovery = await find(task, { log: log2 });
   if (!recovery) return null;
   const cwd = recovery.preserved.worktreeDir;
   const { files, alreadyCommitted } = await prepareScope(cwd);
@@ -13433,8 +14419,8 @@ var init_cancellation_probe = __esm({
 });
 
 // ../../scripts/virtual-office/code-runner/detached-economics-spool.mjs
-import { homedir as homedir8 } from "node:os";
-import { dirname as dirname7, join as join10 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { dirname as dirname10, join as join15 } from "node:path";
 import { mkdir as mkdir3, readFile as readFile4, rename as rename2, writeFile as writeFile3 } from "node:fs/promises";
 function withLock(operation) {
   const result = serialized.then(operation, operation);
@@ -13452,7 +14438,7 @@ async function readEntries(file) {
   }
 }
 async function writeEntries(file, entries) {
-  await mkdir3(dirname7(file), { recursive: true });
+  await mkdir3(dirname10(file), { recursive: true });
   const temp = `${file}.${process.pid}.tmp`;
   await writeFile3(temp, `${JSON.stringify(entries)}
 `, "utf8");
@@ -13498,7 +14484,7 @@ var DEFAULT_FILE, serialized;
 var init_detached_economics_spool = __esm({
   "../../scripts/virtual-office/code-runner/detached-economics-spool.mjs"() {
     "use strict";
-    DEFAULT_FILE = join10(homedir8(), ".vo", "detached-run-economics.json");
+    DEFAULT_FILE = join15(homedir11(), ".vo", "detached-run-economics.json");
     serialized = Promise.resolve();
   }
 });
@@ -13839,7 +14825,7 @@ __export(code_runner_daemon_exports, {
   main: () => main
 });
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
+import { fileURLToPath as fileURLToPath8 } from "node:url";
 function log(msg) {
   console.log(`[code-runner ${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}`);
 }
@@ -14267,7 +15253,7 @@ var init_code_runner_daemon = __esm({
     RATE_LIMIT_RESUME_ENABLED = process.env.VO_RATE_LIMIT_RESUME !== "0";
     sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
     safeProgress = makeSafeProgress(log);
-    invokedDirectly = process.argv[1] && fileURLToPath7(import.meta.url) === process.argv[1] && // Bundle-safe: self-start only when THIS file is the real entry (not inlined into vo-mcp's runner-cli.js ⇒ double-claim).
+    invokedDirectly = process.argv[1] && fileURLToPath8(import.meta.url) === process.argv[1] && // Bundle-safe: self-start only when THIS file is the real entry (not inlined into vo-mcp's runner-cli.js ⇒ double-claim).
     import.meta.url.endsWith("code-runner-daemon.mjs");
     if (invokedDirectly) {
       const once2 = process.argv.includes("--once");
@@ -14412,33 +15398,33 @@ import { posix, win32 } from "node:path";
 import { randomUUID } from "node:crypto";
 var APP_IDENTIFIER = "ai.algosuite.vo-runner";
 var CLONES_DIR = "clones";
-function pathsFor(platform) {
-  return platform === "win32" ? win32 : posix;
+function pathsFor(platform4) {
+  return platform4 === "win32" ? win32 : posix;
 }
 function absoluteOrNull(value, pathApi) {
   const normalized = String(value || "").trim();
   return normalized && pathApi.isAbsolute(normalized) ? pathApi.resolve(normalized) : null;
 }
 function defaultClonesRoot({
-  platform = process.platform,
+  platform: platform4 = process.platform,
   env: env2 = process.env,
   home = homedir()
 } = {}) {
-  const pathApi = pathsFor(platform);
-  if (platform === "win32") {
+  const pathApi = pathsFor(platform4);
+  if (platform4 === "win32") {
     const appData = absoluteOrNull(env2.APPDATA, pathApi);
     return appData ? pathApi.join(appData, APP_IDENTIFIER, CLONES_DIR) : null;
   }
   const absoluteHome = absoluteOrNull(home, pathApi);
   if (!absoluteHome) return null;
-  if (platform === "darwin") {
+  if (platform4 === "darwin") {
     return pathApi.join(absoluteHome, "Library", "Application Support", APP_IDENTIFIER, CLONES_DIR);
   }
   const xdg = absoluteOrNull(env2.XDG_CONFIG_HOME, pathApi);
   return pathApi.join(xdg || pathApi.join(absoluteHome, ".config"), APP_IDENTIFIER, CLONES_DIR);
 }
-function findGitRoot(cwd, { platform, exists = existsSync }) {
-  const pathApi = pathsFor(platform);
+function findGitRoot(cwd, { platform: platform4, exists = existsSync }) {
+  const pathApi = pathsFor(platform4);
   let cursor = pathApi.resolve(cwd);
   for (; ; ) {
     if (exists(pathApi.join(cursor, ".git"))) return cursor;
@@ -14450,11 +15436,11 @@ function findGitRoot(cwd, { platform, exists = existsSync }) {
 function resolveRunnerRootConfig({
   env: env2 = process.env,
   cwd = process.cwd(),
-  platform = process.platform,
+  platform: platform4 = process.platform,
   home = homedir(),
   exists = existsSync
 } = {}) {
-  const pathApi = pathsFor(platform);
+  const pathApi = pathsFor(platform4);
   const explicitRepoValue = String(env2.VO_CODE_RUNNER_REPO || "").trim();
   const explicitClonesValue = String(env2.VO_CODE_RUNNER_CLONES_ROOT || "").trim();
   if (explicitRepoValue && !pathApi.isAbsolute(explicitRepoValue)) {
@@ -14463,8 +15449,8 @@ function resolveRunnerRootConfig({
   if (explicitClonesValue && !pathApi.isAbsolute(explicitClonesValue)) {
     throw new Error(`VO_CODE_RUNNER_CLONES_ROOT must be an absolute path (got '${explicitClonesValue}')`);
   }
-  const repoRoot2 = explicitRepoValue ? pathApi.resolve(explicitRepoValue) : findGitRoot(cwd, { platform, exists });
-  const clonesRoot2 = explicitClonesValue ? pathApi.resolve(explicitClonesValue) : repoRoot2 ? null : defaultClonesRoot({ platform, env: env2, home });
+  const repoRoot2 = explicitRepoValue ? pathApi.resolve(explicitRepoValue) : findGitRoot(cwd, { platform: platform4, exists });
+  const clonesRoot2 = explicitClonesValue ? pathApi.resolve(explicitClonesValue) : repoRoot2 ? null : defaultClonesRoot({ platform: platform4, env: env2, home });
   if (!repoRoot2 && !clonesRoot2) {
     throw new Error(
       "No safe runner root is available. Set VO_CODE_RUNNER_REPO or VO_CODE_RUNNER_CLONES_ROOT to an absolute path."
@@ -14498,7 +15484,7 @@ function assertWritableRunnerDirectory(root) {
 }
 
 // src/runner-cli.mjs
-var DEFAULT_CONTROL_PLANE_URL = "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
+var DEFAULT_CONTROL_PLANE_URL3 = "https://vo-control-plane-bzjphrajaq-uc.a.run.app";
 function packageVersion() {
   try {
     return createRequire4(import.meta.url)("../package.json").version || "unknown";
@@ -14566,7 +15552,7 @@ if (statusOnly) {
     process.exit(1);
   }
   const readiness = await probeRunnerReadiness({
-    controlPlaneUrl: process.env.VO_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL,
+    controlPlaneUrl: process.env.VO_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL3,
     token: storedCredential.vo_credential
   });
   if (!readiness.ok) {
@@ -14597,7 +15583,7 @@ if (!token) {
   console.error("  (or set VO_CONTROL_PLANE_ADMIN_TOKEN to a control-plane bearer)");
   process.exit(1);
 }
-var controlPlaneUrl = process.env.VO_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL;
+var controlPlaneUrl = process.env.VO_CONTROL_PLANE_URL || DEFAULT_CONTROL_PLANE_URL3;
 var pairedOperatorId = null;
 if (!explicitAdminToken) {
   const readiness = await probeRunnerReadiness({
@@ -14622,6 +15608,14 @@ try {
   console.error(`[vo-mcp runner] Filesystem readiness failed: ${error instanceof Error ? error.message : String(error)}`);
   process.exit(1);
 }
+try {
+  const { healMcpRegistration: healMcpRegistration2 } = await Promise.resolve().then(() => (init_install(), install_exports));
+  healMcpRegistration2((message) => {
+    if (/^(✓|\s*⚠|\s*Backed up|vo-mcp: MCP registration heal)/u.test(message)) console.error(`[vo-mcp runner] ${message.trim()}`);
+  });
+} catch (error) {
+  console.error(`[vo-mcp runner] MCP registration heal skipped: ${error instanceof Error ? error.message : String(error)}`);
+}
 var env = {
   ...process.env,
   VO_CONTROL_PLANE_ADMIN_TOKEN: token,