@ametyst/cli 0.3.6 → 0.3.8

package/dist/index.js

@@ -23203,13 +23203,13 @@ var init_getCallError = __esm({
 
 // node_modules/.pnpm/viem@2.38.6_typescript@5.2.2_zod@4.3.6/node_modules/viem/_esm/utils/promise/withResolvers.js
 function withResolvers() {
-  let resolve = () => void 0;
+  let resolve3 = () => void 0;
   let reject = () => void 0;
   const promise = new Promise((resolve_, reject_) => {
-    resolve = resolve_;
+    resolve3 = resolve_;
     reject = reject_;
   });
-  return { promise, resolve, reject };
+  return { promise, resolve: resolve3, reject };
 }
 var init_withResolvers = __esm({
   "node_modules/.pnpm/viem@2.38.6_typescript@5.2.2_zod@4.3.6/node_modules/viem/_esm/utils/promise/withResolvers.js"() {
@@ -23230,8 +23230,8 @@ function createBatchScheduler({ fn, id, shouldSplitBatch, wait: wait2 = 0, sort
       if (sort && Array.isArray(data))
         data.sort(sort);
       for (let i = 0; i < scheduler.length; i++) {
-        const { resolve } = scheduler[i];
-        resolve?.([data[i], data]);
+        const { resolve: resolve3 } = scheduler[i];
+        resolve3?.([data[i], data]);
       }
     }).catch((err) => {
       for (let i = 0; i < scheduler.length; i++) {
@@ -23247,16 +23247,16 @@ function createBatchScheduler({ fn, id, shouldSplitBatch, wait: wait2 = 0, sort
   return {
     flush,
     async schedule(args) {
-      const { promise, resolve, reject } = withResolvers();
+      const { promise, resolve: resolve3, reject } = withResolvers();
       const split2 = shouldSplitBatch?.([...getBatchedArgs(), args]);
       if (split2)
         exec();
       const hasActiveScheduler = getScheduler().length > 0;
       if (hasActiveScheduler) {
-        setScheduler({ args, resolve, reject });
+        setScheduler({ args, resolve: resolve3, reject });
         return promise;
       }
-      setScheduler({ args, resolve, reject });
+      setScheduler({ args, resolve: resolve3, reject });
       setTimeout(exec, wait2);
       return promise;
     }
@@ -24831,7 +24831,7 @@ var init_calls = __esm({
 
 // node_modules/.pnpm/viem@2.38.6_typescript@5.2.2_zod@4.3.6/node_modules/viem/_esm/utils/promise/withRetry.js
 function withRetry(fn, { delay: delay_ = 100, retryCount = 2, shouldRetry: shouldRetry2 = () => true } = {}) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     const attemptRetry = async ({ count = 0 } = {}) => {
       const retry = async ({ error }) => {
         const delay = typeof delay_ === "function" ? delay_({ count, error }) : delay_;
@@ -24841,7 +24841,7 @@ function withRetry(fn, { delay: delay_ = 100, retryCount = 2, shouldRetry: shoul
       };
       try {
         const data = await fn();
-        resolve(data);
+        resolve3(data);
       } catch (err) {
         if (count < retryCount && await shouldRetry2({ count, error: err }))
           return retry({ error: err });
@@ -24963,7 +24963,7 @@ async function sendCalls(client, parameters) {
         });
         promises.push(promise);
         if (experimental_fallbackDelay > 0)
-          await new Promise((resolve) => setTimeout(resolve, experimental_fallbackDelay));
+          await new Promise((resolve3) => setTimeout(resolve3, experimental_fallbackDelay));
       }
       const results = await Promise.allSettled(promises);
       if (results.every((r) => r.status === "rejected"))
@@ -25098,9 +25098,9 @@ async function waitForCallsStatus(client, parameters) {
     throwOnFailure = false
   } = parameters;
   const observerId = stringify(["waitForCallsStatus", client.uid, id]);
-  const { promise, resolve, reject } = withResolvers();
+  const { promise, resolve: resolve3, reject } = withResolvers();
   let timer;
-  const unobserve = observe(observerId, { resolve, reject }, (emit2) => {
+  const unobserve = observe(observerId, { resolve: resolve3, reject }, (emit2) => {
     const unpoll = poll(async () => {
       const done = (fn) => {
         clearTimeout(timer);
@@ -25511,13 +25511,13 @@ async function isImageUri(uri) {
     }
     if (!Object.hasOwn(globalThis, "Image"))
       return false;
-    return new Promise((resolve) => {
+    return new Promise((resolve3) => {
       const img = new Image();
       img.onload = () => {
-        resolve(true);
+        resolve3(true);
       };
       img.onerror = () => {
-        resolve(false);
+        resolve3(false);
       };
       img.src = uri;
     });
@@ -27351,7 +27351,7 @@ var init_nonceManager = __esm({
 
 // node_modules/.pnpm/viem@2.38.6_typescript@5.2.2_zod@4.3.6/node_modules/viem/_esm/utils/promise/withTimeout.js
 function withTimeout(fn, { errorInstance = new Error("timed out"), timeout, signal }) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     ;
     (async () => {
       let timeoutId;
@@ -27366,7 +27366,7 @@ function withTimeout(fn, { errorInstance = new Error("timed out"), timeout, sign
             }
           }, timeout);
         }
-        resolve(await fn({ signal: controller?.signal || null }));
+        resolve3(await fn({ signal: controller?.signal || null }));
       } catch (err) {
         if (err?.name === "AbortError")
           reject(errorInstance);
@@ -29757,7 +29757,7 @@ var require_extension = __commonJS({
       if (dest[name] === void 0) dest[name] = [elem];
       else dest[name].push(elem);
     }
-    function parse3(header) {
+    function parse5(header) {
       const offers = /* @__PURE__ */ Object.create(null);
       let params = /* @__PURE__ */ Object.create(null);
       let mustUnescape = false;
@@ -29897,7 +29897,7 @@ var require_extension = __commonJS({
         }).join(", ");
       }).join(", ");
     }
-    module.exports = { format, parse: parse3 };
+    module.exports = { format, parse: parse5 };
   }
 });
 
@@ -29932,7 +29932,7 @@ var require_websocket = __commonJS({
     var {
       EventTarget: { addEventListener: addEventListener2, removeEventListener: removeEventListener2 }
     } = require_event_target();
-    var { format, parse: parse3 } = require_extension();
+    var { format, parse: parse5 } = require_extension();
     var { toBuffer: toBuffer2 } = require_buffer_util();
     var kAborted = /* @__PURE__ */ Symbol("kAborted");
     var protocolVersions = [8, 13];
@@ -30609,7 +30609,7 @@ var require_websocket = __commonJS({
           }
           let extensions;
           try {
-            extensions = parse3(secWebSocketExtensions);
+            extensions = parse5(secWebSocketExtensions);
           } catch (err) {
             const message = "Invalid Sec-WebSocket-Extensions header";
             abortHandshake(websocket, socket, message);
@@ -30903,7 +30903,7 @@ var require_subprotocol = __commonJS({
     "use strict";
     init_esm_shims();
     var { tokenChars } = require_validation();
-    function parse3(header) {
+    function parse5(header) {
       const protocols = /* @__PURE__ */ new Set();
       let start = -1;
       let end = -1;
@@ -30939,7 +30939,7 @@ var require_subprotocol = __commonJS({
       protocols.add(protocol4);
       return protocols;
     }
-    module.exports = { parse: parse3 };
+    module.exports = { parse: parse5 };
   }
 });
 
@@ -31447,10 +31447,10 @@ async function getWebSocketRpcClient(url2, options = {}) {
       socket.addEventListener("error", onError);
       socket.addEventListener("open", onOpen);
       if (socket.readyState === WebSocket4.CONNECTING) {
-        await new Promise((resolve, reject) => {
+        await new Promise((resolve3, reject) => {
           if (!socket)
             return;
-          socket.onopen = resolve;
+          socket.onopen = resolve3;
           socket.onerror = reject;
         });
       }
@@ -35738,13 +35738,13 @@ async function waitForTransactionReceipt(client, parameters) {
   let retrying = false;
   let _unobserve;
   let _unwatch;
-  const { promise, resolve, reject } = withResolvers();
+  const { promise, resolve: resolve3, reject } = withResolvers();
   const timer = timeout ? setTimeout(() => {
     _unwatch?.();
     _unobserve?.();
     reject(new WaitForTransactionReceiptTimeoutError({ hash: hash3 }));
   }, timeout) : void 0;
-  _unobserve = observe(observerId, { onReplaced, resolve, reject }, async (emit2) => {
+  _unobserve = observe(observerId, { onReplaced, resolve: resolve3, reject }, async (emit2) => {
     receipt = await getAction(client, getTransactionReceipt, "getTransactionReceipt")({ hash: hash3 }).catch(() => void 0);
     if (receipt && confirmations <= 1) {
       clearTimeout(timer);
@@ -38095,7 +38095,7 @@ function webSocket(url2, config = {}) {
       },
       async subscribe({ params, onData, onError }) {
         const rpcClient = await getWebSocketRpcClient(url_, wsRpcClientOpts);
-        const { result: subscriptionId } = await new Promise((resolve, reject) => rpcClient.request({
+        const { result: subscriptionId } = await new Promise((resolve3, reject) => rpcClient.request({
           body: {
             method: "eth_subscribe",
             params
@@ -38112,7 +38112,7 @@ function webSocket(url2, config = {}) {
               return;
             }
             if (typeof response.id === "number") {
-              resolve(response);
+              resolve3(response);
               return;
             }
             if (response.method !== "eth_subscription")
@@ -38123,12 +38123,12 @@ function webSocket(url2, config = {}) {
         return {
           subscriptionId,
           async unsubscribe() {
-            return new Promise((resolve) => rpcClient.request({
+            return new Promise((resolve3) => rpcClient.request({
               body: {
                 method: "eth_unsubscribe",
                 params: [subscriptionId]
               },
-              onResponse: resolve
+              onResponse: resolve3
             }));
           }
         };
@@ -66783,8 +66783,8 @@ function waitForUserOperationReceipt(client, parameters) {
     client.uid,
     hash3
   ]);
-  return new Promise((resolve, reject) => {
-    const unobserve = observe(observerId, { resolve, reject }, (emit2) => {
+  return new Promise((resolve3, reject) => {
+    const unobserve = observe(observerId, { resolve: resolve3, reject }, (emit2) => {
       const done = (fn) => {
         unpoll();
         fn();
@@ -67779,7 +67779,7 @@ var require_parse = __commonJS({
     "use strict";
     init_esm_shims();
     var SemVer = require_semver();
-    var parse3 = (version5, options, throwErrors = false) => {
+    var parse5 = (version5, options, throwErrors = false) => {
       if (version5 instanceof SemVer) {
         return version5;
       }
@@ -67792,7 +67792,7 @@ var require_parse = __commonJS({
         throw er;
       }
     };
-    module.exports = parse3;
+    module.exports = parse5;
   }
 });
 
@@ -67801,9 +67801,9 @@ var require_valid = __commonJS({
   "node_modules/.pnpm/semver@7.8.1/node_modules/semver/functions/valid.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var parse3 = require_parse();
+    var parse5 = require_parse();
     var valid = (version5, options) => {
-      const v = parse3(version5, options);
+      const v = parse5(version5, options);
       return v ? v.version : null;
     };
     module.exports = valid;
@@ -67815,9 +67815,9 @@ var require_clean = __commonJS({
   "node_modules/.pnpm/semver@7.8.1/node_modules/semver/functions/clean.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var parse3 = require_parse();
+    var parse5 = require_parse();
     var clean2 = (version5, options) => {
-      const s = parse3(version5.trim().replace(/^[=v]+/, ""), options);
+      const s = parse5(version5.trim().replace(/^[=v]+/, ""), options);
       return s ? s.version : null;
     };
     module.exports = clean2;
@@ -67854,10 +67854,10 @@ var require_diff = __commonJS({
   "node_modules/.pnpm/semver@7.8.1/node_modules/semver/functions/diff.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var parse3 = require_parse();
+    var parse5 = require_parse();
     var diff = (version1, version22) => {
-      const v1 = parse3(version1, null, true);
-      const v2 = parse3(version22, null, true);
+      const v1 = parse5(version1, null, true);
+      const v2 = parse5(version22, null, true);
       const comparison = v1.compare(v2);
       if (comparison === 0) {
         return null;
@@ -67932,9 +67932,9 @@ var require_prerelease = __commonJS({
   "node_modules/.pnpm/semver@7.8.1/node_modules/semver/functions/prerelease.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var parse3 = require_parse();
+    var parse5 = require_parse();
     var prerelease = (version5, options) => {
-      const parsed = parse3(version5, options);
+      const parsed = parse5(version5, options);
       return parsed && parsed.prerelease.length ? parsed.prerelease : null;
     };
     module.exports = prerelease;
@@ -68134,7 +68134,7 @@ var require_coerce = __commonJS({
     "use strict";
     init_esm_shims();
     var SemVer = require_semver();
-    var parse3 = require_parse();
+    var parse5 = require_parse();
     var { safeRe: re2, t } = require_re();
     var coerce = (version5, options) => {
       if (version5 instanceof SemVer) {
@@ -68169,7 +68169,7 @@ var require_coerce = __commonJS({
       const patch = match[4] || "0";
       const prerelease = options.includePrerelease && match[5] ? `-${match[5]}` : "";
       const build = options.includePrerelease && match[6] ? `+${match[6]}` : "";
-      return parse3(`${major}.${minor}.${patch}${prerelease}${build}`, options);
+      return parse5(`${major}.${minor}.${patch}${prerelease}${build}`, options);
     };
     module.exports = coerce;
   }
@@ -68180,11 +68180,11 @@ var require_truncate = __commonJS({
   "node_modules/.pnpm/semver@7.8.1/node_modules/semver/functions/truncate.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var parse3 = require_parse();
-    var constants3 = require_constants2();
+    var parse5 = require_parse();
+    var constants5 = require_constants2();
     var SemVer = require_semver();
     var truncate = (version5, truncation, options) => {
-      if (!constants3.RELEASE_TYPES.includes(truncation)) {
+      if (!constants5.RELEASE_TYPES.includes(truncation)) {
         return null;
       }
       const clonedVersion = cloneInputVersion(version5, options);
@@ -68192,7 +68192,7 @@ var require_truncate = __commonJS({
     };
     var cloneInputVersion = (version5, options) => {
       const versionStringToParse = version5 instanceof SemVer ? version5.version : version5;
-      return parse3(versionStringToParse, options);
+      return parse5(versionStringToParse, options);
     };
     var doTruncation = (version5, truncation) => {
       if (isPrerelease(truncation)) {
@@ -69244,10 +69244,10 @@ var require_semver2 = __commonJS({
     "use strict";
     init_esm_shims();
     var internalRe = require_re();
-    var constants3 = require_constants2();
+    var constants5 = require_constants2();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
-    var parse3 = require_parse();
+    var parse5 = require_parse();
     var valid = require_valid();
     var clean2 = require_clean();
     var inc = require_inc();
@@ -69286,7 +69286,7 @@ var require_semver2 = __commonJS({
     var simplifyRange = require_simplify();
     var subset = require_subset();
     module.exports = {
-      parse: parse3,
+      parse: parse5,
       valid,
       clean: clean2,
       inc,
@@ -69328,8 +69328,8 @@ var require_semver2 = __commonJS({
       re: internalRe.re,
       src: internalRe.src,
       tokens: internalRe.t,
-      SEMVER_SPEC_VERSION: constants3.SEMVER_SPEC_VERSION,
-      RELEASE_TYPES: constants3.RELEASE_TYPES,
+      SEMVER_SPEC_VERSION: constants5.SEMVER_SPEC_VERSION,
+      RELEASE_TYPES: constants5.RELEASE_TYPES,
       compareIdentifiers: identifiers.compareIdentifiers,
       rcompareIdentifiers: identifiers.rcompareIdentifiers
     };
@@ -77915,7 +77915,7 @@ function bufferToUTF8String(value2) {
 function browserSupportsWebAuthnAutofill() {
   const globalPublicKeyCredential = window.PublicKeyCredential;
   if (globalPublicKeyCredential.isConditionalMediationAvailable === void 0) {
-    return new Promise((resolve) => resolve(false));
+    return new Promise((resolve3) => resolve3(false));
   }
   return globalPublicKeyCredential.isConditionalMediationAvailable();
 }
@@ -78019,7 +78019,7 @@ async function startAuthentication(requestOptionsJSON, useBrowserAutofill = fals
 }
 function platformAuthenticatorIsAvailable() {
   if (!browserSupportsWebAuthn()) {
-    return new Promise((resolve) => resolve(false));
+    return new Promise((resolve3) => resolve3(false));
   }
   return PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
 }
@@ -78405,7 +78405,7 @@ function bufferToUTF8String2(value2) {
 function browserSupportsWebAuthnAutofill2() {
   const globalPublicKeyCredential = window.PublicKeyCredential;
   if (globalPublicKeyCredential.isConditionalMediationAvailable === void 0) {
-    return new Promise((resolve) => resolve(false));
+    return new Promise((resolve3) => resolve3(false));
   }
   return globalPublicKeyCredential.isConditionalMediationAvailable();
 }
@@ -78509,7 +78509,7 @@ async function startAuthentication2(requestOptionsJSON, useBrowserAutofill = fal
 }
 function platformAuthenticatorIsAvailable2() {
   if (!browserSupportsWebAuthn2()) {
-    return new Promise((resolve) => resolve(false));
+    return new Promise((resolve3) => resolve3(false));
   }
   return PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
 }
@@ -78896,18 +78896,18 @@ var init_initialization = __esm({
       async createBaseContracts() {
         const eoaAccount = await this.actions.createEoaAccount();
         const kernelClient = await this.actions.createKernelClientWithEoa(eoaAccount);
-        await new Promise((resolve) => setTimeout(resolve, 3e3));
+        await new Promise((resolve3) => setTimeout(resolve3, 3e3));
         const recoveryEscrowFactoryAddress = await this.actions.deployContractAndGetAddress(kernelClient, RecoveryEscrowFactoryAbi, RecoveryEscrowFactoryBytecode, []);
-        await new Promise((resolve) => setTimeout(resolve, 3e3));
+        await new Promise((resolve3) => setTimeout(resolve3, 3e3));
         const mockTokenAddress = await this.actions.deployContractAndGetAddress(kernelClient, MockTokenAbi, MockTokenBytecode, [
           "MockToken",
           "MTK",
           BigInt(1e6) * BigInt(10 ** 6),
           6
         ]);
-        await new Promise((resolve) => setTimeout(resolve, 3e3));
+        await new Promise((resolve3) => setTimeout(resolve3, 3e3));
         const paymentManagersRegistryAddress = await this.actions.deployContractAndGetAddress(kernelClient, PaymentManagersRegistryAbi, PaymentManagersRegistryBytecode, []);
-        await new Promise((resolve) => setTimeout(resolve, 3e3));
+        await new Promise((resolve3) => setTimeout(resolve3, 3e3));
         return {
           recoveryEscrowFactoryAddress,
           mockTokenAddress,
@@ -78918,9 +78918,9 @@ var init_initialization = __esm({
       async initializePolicies() {
         const eoaAccount = await this.actions.createEoaAccount();
         const kernelClient = await this.actions.createKernelClientWithEoa(eoaAccount);
-        await new Promise((resolve) => setTimeout(resolve, 3e3));
+        await new Promise((resolve3) => setTimeout(resolve3, 3e3));
         const timestampPolicyAddress = await this.actions.deployContractAndGetAddress(kernelClient, TimestampPolicyAbi, TimestampPolicyBytecode, []);
-        await new Promise((resolve) => setTimeout(resolve, 3e3));
+        await new Promise((resolve3) => setTimeout(resolve3, 3e3));
         return {
           timestampPolicyAddress
         };
@@ -78929,7 +78929,7 @@ var init_initialization = __esm({
         const newPrivateKey = generatePrivateKey();
         const eoaAccount = privateKeyToAccount(newPrivateKey);
         const kernelClient = await this.actions.createKernelClientWithEoa(eoaAccount);
-        await new Promise((resolve) => setTimeout(resolve, 3e3));
+        await new Promise((resolve3) => setTimeout(resolve3, 3e3));
         return { address: eoaAccount.address, privateKey: newPrivateKey, smartAccount: kernelClient.account.address };
       }
       async addMoneyToTestAccount(testAccount, mockTokenAddress) {
@@ -78961,13 +78961,13 @@ var init_initialization = __esm({
         const txReceipt = await publicClient.waitForTransactionReceipt({
           hash: userOpReceipt.receipt.transactionHash
         });
-        await new Promise((resolve) => setTimeout(resolve, 3e3));
+        await new Promise((resolve3) => setTimeout(resolve3, 3e3));
         return true;
       }
       async sendMoneyToTestAccount(testAccount, mockTokenAddress, amount, recipientAddress) {
         const eoaAccount = privateKeyToAccount(testAccount.privateKey);
         const kernelClient = await this.actions.createKernelClientWithEoa(eoaAccount);
-        await new Promise((resolve) => setTimeout(resolve, 5e3));
+        await new Promise((resolve3) => setTimeout(resolve3, 5e3));
         const publicClient = createPublicClient({
           chain: CHAINS.BASE_SEPOLIA,
           transport: http(this.bundlerPaymasterUrl)
@@ -78994,7 +78994,7 @@ var init_initialization = __esm({
         const txReceipt = await publicClient.waitForTransactionReceipt({
           hash: userOpReceipt.receipt.transactionHash
         });
-        await new Promise((resolve) => setTimeout(resolve, 3e3));
+        await new Promise((resolve3) => setTimeout(resolve3, 3e3));
         return true;
       }
       async createPolicyFreeSessionKey(kernelClient, kernelAccountAddress, paymentManagerAddress) {
@@ -79017,7 +79017,7 @@ var init_initialization = __esm({
           policies: [rootPolicy]
         });
         const configurePermissions = await this.permissions.configurePermissions(kernelClient, publicClient, sessionPermission, kernelAccountAddress, paymentManagerAddress);
-        await new Promise((resolve) => setTimeout(resolve, 5e3));
+        await new Promise((resolve3) => setTimeout(resolve3, 5e3));
         return { sessionKeyAddress: sessionKeySigner.account.address, sessionKeyPrivateKey: sessionPrivateKey };
       }
     };
@@ -79753,13 +79753,13 @@ var init_financial_accounts = __esm({
           await this.installExecutor(kernelClient, publicClient, kernelAccountAddress, paymentManagerAddress);
           console.error("[SIGNUP 8] installExecutor DONE");
           console.error("[SIGNUP 9] waiting 10s for nonce propagation...");
-          await new Promise((resolve) => setTimeout(resolve, 1e4));
+          await new Promise((resolve3) => setTimeout(resolve3, 1e4));
           onProgress?.("configure_permissions");
           console.error("[SIGNUP 10] calling permissions.configurePermissions (PASSKEY SIGN #2 expected)...");
           const configurePermissions = await this.permissions.configurePermissions(kernelClient, publicClient, sessionPermission, kernelAccountAddress, paymentManagerAddress);
           console.error("[SIGNUP 10b] configurePermissions DONE", configurePermissions);
           console.error("[SIGNUP 11] waiting 5s...");
-          await new Promise((resolve) => setTimeout(resolve, 5e3));
+          await new Promise((resolve3) => setTimeout(resolve3, 5e3));
         }
         const sessionKernelAccountConfig = {
           address: kernelAccountAddress,
@@ -81898,7 +81898,7 @@ var init_permissions = __esm({
         const permissionInstallReceipt = await publicClient.waitForTransactionReceipt({
           hash: permissionInstallUserOpReceipt.receipt.transactionHash
         });
-        await new Promise((resolve) => setTimeout(resolve, 5e3));
+        await new Promise((resolve3) => setTimeout(resolve3, 5e3));
         const grantAccessUserOpHash = await kernelClient.sendUserOperation({
           callData: delegateCall,
           callGasLimit: 2000000n
@@ -81957,7 +81957,7 @@ var init_permissions = __esm({
         let lastTxHash = batchUserOpReceipt.receipt.transactionHash;
         for (const input of installInputs) {
           if (grantDelayMs > 0) {
-            await new Promise((resolve) => setTimeout(resolve, grantDelayMs));
+            await new Promise((resolve3) => setTimeout(resolve3, grantDelayMs));
           }
           const grantAccessFunctionData = buildGrantAccessFunctionData(input.identifier);
           const delegateCall = await encodeCallData2([
@@ -82011,7 +82011,7 @@ var init_permissions = __esm({
         await publicClient.waitForTransactionReceipt({
           hash: revokeAccessUserOpReceipt.receipt.transactionHash
         });
-        await new Promise((resolve) => setTimeout(resolve, 5e3));
+        await new Promise((resolve3) => setTimeout(resolve3, 5e3));
         const deinitData = await permissionPlugin.getEnableData(kernelAccountAddress);
         const uninstallFunctionData = encodeFunctionData({
           abi: KernelV3_3AccountAbi,
@@ -82428,7 +82428,7 @@ var init_virtual_wallets_managers = __esm({
             policyValidUntil = built.policyValidUntil;
             spendingLimitWire = built.spendingLimitWire;
             const configurePermissions = await this.permissions.configurePermissions(kernelClient, publicClient, built.sessionPermission, kernelAccountAddress, paymentManagerAddress);
-            await new Promise((resolve) => setTimeout(resolve, 5e3));
+            await new Promise((resolve3) => setTimeout(resolve3, 5e3));
           }
         }
         const response = await this.buyerAPIs.walletApproval(jwtToken, {
@@ -82819,7 +82819,7 @@ var init_bundler_retry = __esm({
       factor: 2,
       maxMs: 8e3
     };
-    defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+    defaultSleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
   }
 });
 
@@ -86276,7 +86276,7 @@ var init_transactions = __esm({
       async waitBeforeDeferredPermitRetry(attempt) {
         const delayMs = _transactions.DEFERRED_PERMIT_RETRY_DELAYS_MS[attempt] ?? 0;
         if (delayMs > 0)
-          await new Promise((resolve) => setTimeout(resolve, delayMs));
+          await new Promise((resolve3) => setTimeout(resolve3, delayMs));
       }
       async cancelAuthorization(kernelClient, paymentManagerAddress, wrappedHash) {
         console.error("[spend] cancelAuthorization called with:", {
@@ -90107,11 +90107,11 @@ var require_codegen = __commonJS({
         const rhs = this.rhs === void 0 ? "" : ` = ${this.rhs}`;
         return `${varKind} ${this.name}${rhs};` + _n;
       }
-      optimizeNames(names, constants3) {
+      optimizeNames(names, constants5) {
         if (!names[this.name.str])
           return;
         if (this.rhs)
-          this.rhs = optimizeExpr(this.rhs, names, constants3);
+          this.rhs = optimizeExpr(this.rhs, names, constants5);
         return this;
       }
       get names() {
@@ -90128,10 +90128,10 @@ var require_codegen = __commonJS({
       render({ _n }) {
         return `${this.lhs} = ${this.rhs};` + _n;
       }
-      optimizeNames(names, constants3) {
+      optimizeNames(names, constants5) {
         if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects)
           return;
-        this.rhs = optimizeExpr(this.rhs, names, constants3);
+        this.rhs = optimizeExpr(this.rhs, names, constants5);
         return this;
       }
       get names() {
@@ -90192,8 +90192,8 @@ var require_codegen = __commonJS({
       optimizeNodes() {
         return `${this.code}` ? this : void 0;
       }
-      optimizeNames(names, constants3) {
-        this.code = optimizeExpr(this.code, names, constants3);
+      optimizeNames(names, constants5) {
+        this.code = optimizeExpr(this.code, names, constants5);
         return this;
       }
       get names() {
@@ -90222,12 +90222,12 @@ var require_codegen = __commonJS({
         }
         return nodes.length > 0 ? this : void 0;
       }
-      optimizeNames(names, constants3) {
+      optimizeNames(names, constants5) {
         const { nodes } = this;
         let i = nodes.length;
         while (i--) {
           const n = nodes[i];
-          if (n.optimizeNames(names, constants3))
+          if (n.optimizeNames(names, constants5))
             continue;
           subtractNames(names, n.names);
           nodes.splice(i, 1);
@@ -90280,12 +90280,12 @@ var require_codegen = __commonJS({
           return void 0;
         return this;
       }
-      optimizeNames(names, constants3) {
+      optimizeNames(names, constants5) {
         var _a;
-        this.else = (_a = this.else) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants3);
-        if (!(super.optimizeNames(names, constants3) || this.else))
+        this.else = (_a = this.else) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants5);
+        if (!(super.optimizeNames(names, constants5) || this.else))
           return;
-        this.condition = optimizeExpr(this.condition, names, constants3);
+        this.condition = optimizeExpr(this.condition, names, constants5);
         return this;
       }
       get names() {
@@ -90308,10 +90308,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.iteration})` + super.render(opts);
       }
-      optimizeNames(names, constants3) {
-        if (!super.optimizeNames(names, constants3))
+      optimizeNames(names, constants5) {
+        if (!super.optimizeNames(names, constants5))
           return;
-        this.iteration = optimizeExpr(this.iteration, names, constants3);
+        this.iteration = optimizeExpr(this.iteration, names, constants5);
         return this;
       }
       get names() {
@@ -90347,10 +90347,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
       }
-      optimizeNames(names, constants3) {
-        if (!super.optimizeNames(names, constants3))
+      optimizeNames(names, constants5) {
+        if (!super.optimizeNames(names, constants5))
           return;
-        this.iterable = optimizeExpr(this.iterable, names, constants3);
+        this.iterable = optimizeExpr(this.iterable, names, constants5);
         return this;
       }
       get names() {
@@ -90392,11 +90392,11 @@ var require_codegen = __commonJS({
         (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNodes();
         return this;
       }
-      optimizeNames(names, constants3) {
+      optimizeNames(names, constants5) {
         var _a, _b;
-        super.optimizeNames(names, constants3);
-        (_a = this.catch) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants3);
-        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants3);
+        super.optimizeNames(names, constants5);
+        (_a = this.catch) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants5);
+        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants5);
         return this;
       }
       get names() {
@@ -90697,7 +90697,7 @@ var require_codegen = __commonJS({
     function addExprNames(names, from14) {
       return from14 instanceof code_1._CodeOrName ? addNames(names, from14.names) : names;
     }
-    function optimizeExpr(expr, names, constants3) {
+    function optimizeExpr(expr, names, constants5) {
       if (expr instanceof code_1.Name)
         return replaceName(expr);
       if (!canOptimize(expr))
@@ -90712,14 +90712,14 @@ var require_codegen = __commonJS({
         return items;
       }, []));
       function replaceName(n) {
-        const c = constants3[n.str];
+        const c = constants5[n.str];
         if (c === void 0 || names[n.str] !== 1)
           return n;
         delete names[n.str];
         return c;
       }
       function canOptimize(e) {
-        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants3[c.str] !== void 0);
+        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants5[c.str] !== void 0);
       }
     }
     function subtractNames(names, from14) {
@@ -92699,7 +92699,7 @@ var require_compile = __commonJS({
       const schOrFunc = root2.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve.call(this, root2, ref);
+      let _sch = resolve3.call(this, root2, ref);
       if (_sch === void 0) {
         const schema = (_a = root2.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -92726,7 +92726,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve(root2, ref) {
+    function resolve3(root2, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -93356,21 +93356,21 @@ var require_fast_uri = __commonJS({
         normalizeString(uri, options);
       } else if (typeof uri === "object") {
         uri = /** @type {T} */
-        parse3(serialize(uri, options), options);
+        parse5(serialize(uri, options), options);
       }
       return uri;
     }
-    function resolve(baseURI, relativeURI, options) {
+    function resolve3(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
+      const resolved = resolveComponent(parse5(baseURI, schemelessOptions), parse5(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
     function resolveComponent(base2, relative, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
-        base2 = parse3(serialize(base2, options), options);
-        relative = parse3(serialize(relative, options), options);
+        base2 = parse5(serialize(base2, options), options);
+        relative = parse5(serialize(relative, options), options);
       }
       options = options || {};
       if (!options.tolerant && relative.scheme) {
@@ -93593,7 +93593,7 @@ var require_fast_uri = __commonJS({
       }
       return { parsed, malformedAuthorityOrPort };
     }
-    function parse3(uri, opts) {
+    function parse5(uri, opts) {
       return parseWithStatus(uri, opts).parsed;
     }
     function normalizeString(uri, opts) {
@@ -93618,11 +93618,11 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve,
+      resolve: resolve3,
       resolveComponent,
       equal,
       serialize,
-      parse: parse3
+      parse: parse5
     };
     module.exports = fastUri;
     module.exports.default = fastUri;
@@ -97837,8 +97837,8 @@ function paymentMiddleware(routes, server2, paywallConfig, paywall, syncFacilita
         let bufferedCalls = [];
         let settled = false;
         let endCalled;
-        const endPromise = new Promise((resolve) => {
-          endCalled = resolve;
+        const endPromise = new Promise((resolve3) => {
+          endCalled = resolve3;
         });
         res.writeHead = function(...args) {
           if (!settled) {
@@ -100907,7 +100907,7 @@ var require_ms = __commonJS({
       options = options || {};
       var type = typeof val;
       if (type === "string" && val.length > 0) {
-        return parse3(val);
+        return parse5(val);
       } else if (type === "number" && isFinite(val)) {
         return options.long ? fmtLong(val) : fmtShort(val);
       }
@@ -100915,7 +100915,7 @@ var require_ms = __commonJS({
         "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
       );
     };
-    function parse3(str2) {
+    function parse5(str2) {
       str2 = String(str2);
       if (str2.length > 100) {
         return;
@@ -104457,9 +104457,9 @@ var init_socket3 = __esm({
        * @return a Promise that will be fulfilled when the server acknowledges the event
        */
       emitWithAck(ev, ...args) {
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve3, reject) => {
           const fn = (arg1, arg2) => {
-            return arg1 ? reject(arg1) : resolve(arg2);
+            return arg1 ? reject(arg1) : resolve3(arg2);
           };
           fn.withError = true;
           args.push(fn);
@@ -105532,7 +105532,7 @@ var init_eventSubscriber = __esm({
         this.apiKey = apiKey;
       }
       async connect() {
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve3, reject) => {
           this.socket = lookup(`${this.apiUrl}/events`, {
             auth: { apiKey: this.apiKey },
             transports: ["websocket"],
@@ -105541,7 +105541,7 @@ var init_eventSubscriber = __esm({
           this.socket.on("connect", () => {
             this.isConnected = true;
             console.error("\u2705 Connected to Ametyst Events WebSocket");
-            resolve();
+            resolve3();
           });
           this.socket.on("connectionStatus", (status) => {
             console.error("\u{1F4E1} Blockchain connection status:", status);
@@ -106359,33 +106359,74 @@ var init_dist = __esm({
 });
 
 // src/config/paths.ts
-import { existsSync, mkdirSync } from "fs";
+import { accessSync, constants, existsSync, mkdirSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
+import { join, parse as parse3, resolve } from "path";
 function ensureDirectories() {
   if (!existsSync(AMETYST_DIR)) mkdirSync(AMETYST_DIR, { mode: 448 });
   if (!existsSync(WALLETS_DIR)) mkdirSync(WALLETS_DIR, { mode: 448 });
 }
-function loopsRoot() {
-  return join(process.cwd(), `.ametyst${ENV_SUFFIX}`, "loops");
+function isFilesystemRoot(dir) {
+  const abs = resolve(dir);
+  return parse3(abs).root === abs;
 }
-function loopDir(slug) {
+function whyUnusable(dir, deps) {
+  if (isFilesystemRoot(dir)) return "it is the filesystem root, not a project folder";
+  if (!deps.existsSync(dir)) return "it does not exist";
+  try {
+    deps.accessSync(dir, constants.W_OK);
+  } catch (err) {
+    const code = err?.code;
+    return `it is not writable${code ? ` (${code})` : ""}`;
+  }
+  return void 0;
+}
+function resolveRunRoot(explicitDir, deps = {}) {
+  const probes = { existsSync: deps.existsSync ?? existsSync, accessSync: deps.accessSync ?? accessSync };
+  const rejected = [];
+  const explicit = typeof explicitDir === "string" ? explicitDir.trim() : "";
+  if (explicit) {
+    const abs = resolve(explicit);
+    const why = whyUnusable(abs, probes);
+    if (!why) return { root: abs, reason: "explicit" };
+    rejected.push({ dir: abs, why });
+  }
+  let cwd;
+  try {
+    cwd = (deps.cwd ?? (() => process.cwd()))();
+  } catch (err) {
+    rejected.push({ dir: "<cwd>", why: `it cannot be read (${err instanceof Error ? err.message : String(err)})` });
+  }
+  if (cwd !== void 0) {
+    const why = whyUnusable(cwd, probes);
+    if (!why) return { root: cwd, reason: "cwd", ...rejected.length ? { rejected } : {} };
+    rejected.push({ dir: cwd, why });
+  }
+  const home = deps.homedir ? deps.homedir() : void 0;
+  const fallback2 = home === void 0 ? join(AMETYST_DIR, "runs") : join(home, `.ametyst${ENV_SUFFIX}`, "runs");
+  (deps.mkdirSync ?? mkdirSync)(fallback2, { recursive: true, mode: 448 });
+  return { root: fallback2, reason: "fallback", rejected };
+}
+function loopsRoot(runRoot) {
+  return join(runRoot ?? resolveRunRoot().root, `.ametyst${ENV_SUFFIX}`, "loops");
+}
+function loopDir(slug, runRoot) {
   const safe = String(slug).toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "");
   if (!safe) throw new Error(`invalid loop slug: ${JSON.stringify(slug)}`);
-  return join(loopsRoot(), safe);
+  return join(loopsRoot(runRoot), safe);
 }
-function loopFiresRoot(slug) {
-  return join(loopDir(slug), "fires");
+function loopFiresRoot(slug, runRoot) {
+  return join(loopDir(slug, runRoot), "fires");
 }
-function loopFireDir(slug, fireId) {
+function loopFireDir(slug, fireId, runRoot) {
   const safe = String(fireId).toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "");
   if (!safe) throw new Error(`invalid fire id: ${JSON.stringify(fireId)}`);
-  return join(loopFiresRoot(slug), safe);
+  return join(loopFiresRoot(slug, runRoot), safe);
 }
-function refusedConstraintsPath(slug, fireId) {
+function refusedConstraintsPath(slug, fireId, runRoot) {
   const safe = String(fireId).toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "");
   if (!safe) throw new Error(`invalid fire id: ${JSON.stringify(fireId)}`);
-  return join(loopDir(slug), ".state", `constraints-refused-${safe}.md`);
+  return join(loopDir(slug, runRoot), ".state", `constraints-refused-${safe}.md`);
 }
 function skillsRoot(target = "claude", global2 = false) {
   return join(global2 ? homedir() : process.cwd(), SKILLS_DIR_BY_TARGET[target], "skills");
@@ -107040,7 +107081,7 @@ var require_text = __commonJS({
   "node_modules/.pnpm/prompts@2.4.2/node_modules/prompts/dist/elements/text.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    function asyncGeneratorStep(gen2, resolve, reject, _next, _throw, key, arg) {
+    function asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, key, arg) {
       try {
         var info = gen2[key](arg);
         var value2 = info.value;
@@ -107049,7 +107090,7 @@ var require_text = __commonJS({
         return;
       }
       if (info.done) {
-        resolve(value2);
+        resolve3(value2);
       } else {
         Promise.resolve(value2).then(_next, _throw);
       }
@@ -107057,13 +107098,13 @@ var require_text = __commonJS({
     function _asyncToGenerator(fn) {
       return function() {
         var self2 = this, args = arguments;
-        return new Promise(function(resolve, reject) {
+        return new Promise(function(resolve3, reject) {
           var gen2 = fn.apply(self2, args);
           function _next(value2) {
-            asyncGeneratorStep(gen2, resolve, reject, _next, _throw, "next", value2);
+            asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, "next", value2);
           }
           function _throw(err) {
-            asyncGeneratorStep(gen2, resolve, reject, _next, _throw, "throw", err);
+            asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, "throw", err);
           }
           _next(void 0);
         });
@@ -107792,7 +107833,7 @@ var require_date = __commonJS({
   "node_modules/.pnpm/prompts@2.4.2/node_modules/prompts/dist/elements/date.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    function asyncGeneratorStep(gen2, resolve, reject, _next, _throw, key, arg) {
+    function asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, key, arg) {
       try {
         var info = gen2[key](arg);
         var value2 = info.value;
@@ -107801,7 +107842,7 @@ var require_date = __commonJS({
         return;
       }
       if (info.done) {
-        resolve(value2);
+        resolve3(value2);
       } else {
         Promise.resolve(value2).then(_next, _throw);
       }
@@ -107809,13 +107850,13 @@ var require_date = __commonJS({
     function _asyncToGenerator(fn) {
       return function() {
         var self2 = this, args = arguments;
-        return new Promise(function(resolve, reject) {
+        return new Promise(function(resolve3, reject) {
           var gen2 = fn.apply(self2, args);
           function _next(value2) {
-            asyncGeneratorStep(gen2, resolve, reject, _next, _throw, "next", value2);
+            asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, "next", value2);
           }
           function _throw(err) {
-            asyncGeneratorStep(gen2, resolve, reject, _next, _throw, "throw", err);
+            asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, "throw", err);
           }
           _next(void 0);
         });
@@ -108019,7 +108060,7 @@ var require_number = __commonJS({
   "node_modules/.pnpm/prompts@2.4.2/node_modules/prompts/dist/elements/number.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    function asyncGeneratorStep(gen2, resolve, reject, _next, _throw, key, arg) {
+    function asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, key, arg) {
       try {
         var info = gen2[key](arg);
         var value2 = info.value;
@@ -108028,7 +108069,7 @@ var require_number = __commonJS({
         return;
       }
       if (info.done) {
-        resolve(value2);
+        resolve3(value2);
       } else {
         Promise.resolve(value2).then(_next, _throw);
       }
@@ -108036,13 +108077,13 @@ var require_number = __commonJS({
     function _asyncToGenerator(fn) {
       return function() {
         var self2 = this, args = arguments;
-        return new Promise(function(resolve, reject) {
+        return new Promise(function(resolve3, reject) {
           var gen2 = fn.apply(self2, args);
           function _next(value2) {
-            asyncGeneratorStep(gen2, resolve, reject, _next, _throw, "next", value2);
+            asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, "next", value2);
           }
           function _throw(err) {
-            asyncGeneratorStep(gen2, resolve, reject, _next, _throw, "throw", err);
+            asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, "throw", err);
           }
           _next(void 0);
         });
@@ -108467,7 +108508,7 @@ var require_autocomplete = __commonJS({
   "node_modules/.pnpm/prompts@2.4.2/node_modules/prompts/dist/elements/autocomplete.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    function asyncGeneratorStep(gen2, resolve, reject, _next, _throw, key, arg) {
+    function asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, key, arg) {
       try {
         var info = gen2[key](arg);
         var value2 = info.value;
@@ -108476,7 +108517,7 @@ var require_autocomplete = __commonJS({
         return;
       }
       if (info.done) {
-        resolve(value2);
+        resolve3(value2);
       } else {
         Promise.resolve(value2).then(_next, _throw);
       }
@@ -108484,13 +108525,13 @@ var require_autocomplete = __commonJS({
     function _asyncToGenerator(fn) {
       return function() {
         var self2 = this, args = arguments;
-        return new Promise(function(resolve, reject) {
+        return new Promise(function(resolve3, reject) {
           var gen2 = fn.apply(self2, args);
           function _next(value2) {
-            asyncGeneratorStep(gen2, resolve, reject, _next, _throw, "next", value2);
+            asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, "next", value2);
           }
           function _throw(err) {
-            asyncGeneratorStep(gen2, resolve, reject, _next, _throw, "throw", err);
+            asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, "throw", err);
           }
           _next(void 0);
         });
@@ -109126,7 +109167,7 @@ var require_dist = __commonJS({
       for (var i = 0, arr22 = new Array(len); i < len; i++) arr22[i] = arr2[i];
       return arr22;
     }
-    function asyncGeneratorStep(gen2, resolve, reject, _next, _throw, key, arg) {
+    function asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, key, arg) {
       try {
         var info = gen2[key](arg);
         var value2 = info.value;
@@ -109135,7 +109176,7 @@ var require_dist = __commonJS({
         return;
       }
       if (info.done) {
-        resolve(value2);
+        resolve3(value2);
       } else {
         Promise.resolve(value2).then(_next, _throw);
       }
@@ -109143,13 +109184,13 @@ var require_dist = __commonJS({
     function _asyncToGenerator(fn) {
       return function() {
         var self2 = this, args = arguments;
-        return new Promise(function(resolve, reject) {
+        return new Promise(function(resolve3, reject) {
           var gen2 = fn.apply(self2, args);
           function _next(value2) {
-            asyncGeneratorStep(gen2, resolve, reject, _next, _throw, "next", value2);
+            asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, "next", value2);
           }
           function _throw(err) {
-            asyncGeneratorStep(gen2, resolve, reject, _next, _throw, "throw", err);
+            asyncGeneratorStep(gen2, resolve3, reject, _next, _throw, "throw", err);
           }
           _next(void 0);
         });
@@ -112026,6 +112067,7 @@ var init_core = __esm({
 var grant_keystore_exports = {};
 __export(grant_keystore_exports, {
   GRANT_ENTRY_FORMAT: () => GRANT_ENTRY_FORMAT,
+  MissingGrantKeyError: () => MissingGrantKeyError,
   buildGrantVault: () => buildGrantVault,
   createGrantKeyIssuer: () => createGrantKeyIssuer,
   deleteGrantEntry: () => deleteGrantEntry,
@@ -112033,6 +112075,8 @@ __export(grant_keystore_exports, {
   generateGrantKey: () => generateGrantKey,
   grantEntryPath: () => grantEntryPath,
   grantsDir: () => grantsDir,
+  hasGrantSigningKey: () => hasGrantSigningKey,
+  isMissingGrantKeyError: () => isMissingGrantKeyError,
   listGrantAddresses: () => listGrantAddresses,
   listGrantEntries: () => listGrantEntries,
   missingGrantKeyMessage: () => missingGrantKeyMessage,
@@ -112180,6 +112224,19 @@ function deleteGrantEntry(address, dir) {
 function missingGrantKeyMessage(address) {
   return `no local key for grant address ${address} \u2014 this machine cannot sign for that grant. Run requestAccess again to mint a fresh session key and have your admin approve it.`;
 }
+function isMissingGrantKeyError(err) {
+  return err instanceof MissingGrantKeyError;
+}
+function hasGrantSigningKey(params) {
+  let address;
+  try {
+    address = normalizeGrantAddress(params.address);
+  } catch {
+    return false;
+  }
+  if (readGrantEntry(address, params.dir)) return true;
+  return typeof params.vaultAddress === "string" && params.vaultAddress.toLowerCase() === address;
+}
 function resolveGrantSigningKey(params) {
   const address = normalizeGrantAddress(params.address);
   const entry = readGrantEntry(address, params.dir);
@@ -112190,7 +112247,7 @@ function resolveGrantSigningKey(params) {
   if (params.vaultJson && typeof vaultAddress === "string" && vaultAddress.toLowerCase() === address) {
     return readVaultPrivateKey(params.vaultJson, params.passphrase);
   }
-  throw new Error(missingGrantKeyMessage(address));
+  throw new MissingGrantKeyError(address);
 }
 function createGrantKeyIssuer(options) {
   return {
@@ -112214,7 +112271,7 @@ function createGrantKeyIssuer(options) {
     }
   };
 }
-var GRANT_ENTRY_FORMAT, ADDRESS_RE2;
+var GRANT_ENTRY_FORMAT, ADDRESS_RE2, MissingGrantKeyError;
 var init_grant_keystore = __esm({
   "src/wallet/grant-keystore.ts"() {
     "use strict";
@@ -112225,6 +112282,14 @@ var init_grant_keystore = __esm({
     init_plaintext_vault();
     GRANT_ENTRY_FORMAT = "grant-key-v1";
     ADDRESS_RE2 = /^0x[0-9a-fA-F]{40}$/;
+    MissingGrantKeyError = class extends Error {
+      grantAddress;
+      constructor(address) {
+        super(missingGrantKeyMessage(address));
+        this.name = "MissingGrantKeyError";
+        this.grantAddress = address;
+      }
+    };
   }
 });
 
@@ -112412,7 +112477,7 @@ var init_version5 = __esm({
   "src/version.ts"() {
     "use strict";
     init_esm_shims();
-    CLI_VERSION = true ? "0.3.6" : "0.0.0-dev";
+    CLI_VERSION = true ? "0.3.8" : "0.0.0-dev";
   }
 });
 
@@ -113753,8 +113818,8 @@ function sqliteWasmDriver(db, raw) {
     init: () => Promise.resolve(),
     acquireConnection: async () => {
       while (inUse) await inUse;
-      inUse = new Promise((resolve) => {
-        release = resolve;
+      inUse = new Promise((resolve3) => {
+        release = resolve3;
       });
       return connection;
     },
@@ -113768,10 +113833,10 @@ function sqliteWasmDriver(db, raw) {
       await conn.executeQuery(raw("rollback"));
     },
     releaseConnection: () => {
-      const resolve = release;
+      const resolve3 = release;
       inUse = void 0;
       release = void 0;
-      resolve?.();
+      resolve3?.();
       return Promise.resolve();
     },
     destroy: () => {
@@ -113886,8 +113951,8 @@ var init_engine_store = __esm({
     SCHEMA_VERSION = "1.0.0";
     SCHEMA_NAMESPACE = "ametyst_connections";
     IN_MEMORY_DB = ":memory:";
-    sleep = (ms) => new Promise((resolve) => {
-      setTimeout(resolve, ms);
+    sleep = (ms) => new Promise((resolve3) => {
+      setTimeout(resolve3, ms);
     });
     monotonicNowMs = () => performance.now();
     CAUSE_CHAIN_MAX_DEPTH = 8;
@@ -114178,8 +114243,8 @@ import { createServer as createServer4 } from "http";
 async function startOAuthCallbackListener(options = {}) {
   let settle = null;
   let fail2 = null;
-  const received = new Promise((resolve, reject) => {
-    settle = resolve;
+  const received = new Promise((resolve3, reject) => {
+    settle = resolve3;
     fail2 = reject;
   });
   const server2 = createServer4((req, res) => {
@@ -114200,12 +114265,12 @@ async function startOAuthCallbackListener(options = {}) {
     else if (!code) fail2?.(new Error("The provider's callback carried no authorization code."));
     else settle?.({ code, state });
   });
-  await new Promise((resolve) => server2.listen(0, "127.0.0.1", resolve));
+  await new Promise((resolve3) => server2.listen(0, "127.0.0.1", resolve3));
   const address = server2.address();
   const port = typeof address === "object" && address ? address.port : 0;
-  const close = () => new Promise((resolve) => {
+  const close = () => new Promise((resolve3) => {
     server2.closeAllConnections?.();
-    server2.close(() => resolve());
+    server2.close(() => resolve3());
   });
   return {
     redirectUri: `http://127.0.0.1:${port}${OAUTH_CALLBACK_PATH2}`,
@@ -114293,7 +114358,7 @@ init_credentials();
 // src/config/host-registry.ts
 init_esm_shims();
 init_resolve();
-import { accessSync, constants, existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync5 } from "fs";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir4 } from "os";
 import { delimiter, dirname as dirname4, isAbsolute, join as join4 } from "path";
 
@@ -114638,7 +114703,7 @@ function findBinary(name, env = process.env) {
     const candidate = join4(dir, name);
     try {
       if (!statSync(candidate).isFile()) continue;
-      accessSync(candidate, constants.X_OK);
+      accessSync2(candidate, constants2.X_OK);
       return candidate;
     } catch {
     }
@@ -115271,8 +115336,8 @@ async function readJson(url2, apiKey) {
 function withSourceTimeout(work) {
   return Promise.race([
     work,
-    new Promise((resolve) => {
-      setTimeout(() => resolve(null), SOURCE_TIMEOUT_MS).unref();
+    new Promise((resolve3) => {
+      setTimeout(() => resolve3(null), SOURCE_TIMEOUT_MS).unref();
     })
   ]);
 }
@@ -115738,6 +115803,56 @@ function findCurrentApprovedWallet(wallets, eoaAddress, pendingWalletId) {
   );
 }
 
+// src/mcp-server/signer-binding.ts
+init_esm_shims();
+var BINDING_DERIVED_KEYS = [
+  "virtualWalletKernelAccountClient",
+  "permissionPlugin",
+  "kernelDomain",
+  "policyPrecheckPassed"
+];
+function nonEmpty(value2) {
+  return typeof value2 === "string" && value2.trim() !== "" ? value2 : void 0;
+}
+function sameAddress(a, b) {
+  return String(a ?? "").toLowerCase() === String(b ?? "").toLowerCase();
+}
+function signerBindingMoved(state, row) {
+  const rowId = row?.id != null ? String(row.id) : void 0;
+  const rowAddress = nonEmpty(row?.address);
+  if (state.virtualWalletId && rowId && state.virtualWalletId !== rowId) return true;
+  if (state.signerAddress && rowAddress && !sameAddress(state.signerAddress, rowAddress)) return true;
+  return false;
+}
+function bindSignerToGrantRow(state, row) {
+  const changed = signerBindingMoved(state, row);
+  if (changed) {
+    for (const key of BINDING_DERIVED_KEYS) delete state[key];
+  }
+  const rowAddress = nonEmpty(row?.address);
+  if (rowAddress) state.signerAddress = rowAddress;
+  const rowWalletAddress = nonEmpty(row?.walletAddress) ?? nonEmpty(row?.kernelAccountAddress);
+  const rowPaymentManagerAddress = nonEmpty(row?.paymentManagerAddress);
+  const rowPolicyId = row?.policyAssociated != null ? String(row.policyAssociated) : void 0;
+  const rowId = row?.id != null ? String(row.id) : void 0;
+  if (changed) {
+    state.walletAddress = rowWalletAddress;
+    state.paymentManagerAddress = rowPaymentManagerAddress;
+    state.policyId = rowPolicyId;
+    state.policyOnchainPermissions = nonEmpty(row?.policyOnchainPermissions);
+  } else {
+    state.walletAddress = rowWalletAddress ?? state.walletAddress;
+    state.paymentManagerAddress = rowPaymentManagerAddress ?? state.paymentManagerAddress;
+    state.policyId = rowPolicyId ?? state.policyId;
+    state.policyOnchainPermissions = nonEmpty(row?.policyOnchainPermissions) ?? state.policyOnchainPermissions;
+  }
+  if (rowId) state.virtualWalletId = rowId;
+  if (row?.policyName != null) state.policyName = String(row.policyName);
+  if (row?.policyValidUntil != null) state.policyValidUntil = BigInt(row.policyValidUntil);
+  state.authorizationStatus = "approved";
+  return { changed, signerAddress: state.signerAddress };
+}
+
 // src/mcp-server/start-session.ts
 init_esm_shims();
 init_dist();
@@ -116049,11 +116164,11 @@ function clearWalletScopedCredentials(target) {
     delete target[key];
   }
 }
-function sameAddress(a, b) {
+function sameAddress2(a, b) {
   return String(a ?? "").toLowerCase() === String(b ?? "").toLowerCase();
 }
 function mergeStartSessionCredentials(target, patch, responseKey, options = {}) {
-  const walletChanged = patch.eoaAddress !== void 0 && !sameAddress(patch.eoaAddress, target.eoaAddress);
+  const walletChanged = patch.eoaAddress !== void 0 && !sameAddress2(patch.eoaAddress, target.eoaAddress);
   if (walletChanged || options.grantChanged) {
     clearWalletScopedCredentials(target);
   }
@@ -116102,7 +116217,7 @@ function esc(value2) {
   return value2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 function readBody(req) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     let data = "";
     let over = false;
     req.setEncoding("utf-8");
@@ -116112,14 +116227,14 @@ function readBody(req) {
       if (data.length > MAX_BODY_BYTES) {
         over = true;
         data = "";
-        resolve({ body: "", tooLarge: true });
+        resolve3({ body: "", tooLarge: true });
       }
     });
     req.on("end", () => {
-      if (!over) resolve({ body: data, tooLarge: false });
+      if (!over) resolve3({ body: data, tooLarge: false });
     });
     req.on("error", () => {
-      if (!over) resolve({ body: "", tooLarge: false });
+      if (!over) resolve3({ body: "", tooLarge: false });
     });
   });
 }
@@ -116257,18 +116372,18 @@ async function startUnlockListener(deps) {
       expiryTimer = void 0;
     }
     resolveDone(state);
-    return new Promise((resolve) => {
+    return new Promise((resolve3) => {
       try {
-        server2.close(() => resolve());
+        server2.close(() => resolve3());
         setTimeout(() => {
           try {
             server2.closeAllConnections?.();
           } catch {
           }
-          resolve();
+          resolve3();
         }, 50).unref?.();
       } catch {
-        resolve();
+        resolve3();
       }
     });
   };
@@ -116436,12 +116551,12 @@ async function startUnlockListener(deps) {
       }
     });
   });
-  const listened = await new Promise((resolve) => {
+  const listened = await new Promise((resolve3) => {
     let settled = false;
     const settle = (value2) => {
       if (settled) return;
       settled = true;
-      resolve(value2);
+      resolve3(value2);
     };
     try {
       server2.once("error", (err) => {
@@ -116943,9 +117058,9 @@ async function buildMerchantErrorHelp(opts) {
     let timer;
     const fetched = await Promise.race([
       opts.fetchInstructions(provider),
-      new Promise((resolve) => {
+      new Promise((resolve3) => {
         timer = setTimeout(
-          () => resolve({ status: "nok", error: `instructions fetch timed out after ${timeoutMs}ms` }),
+          () => resolve3({ status: "nok", error: `instructions fetch timed out after ${timeoutMs}ms` }),
           timeoutMs
         );
       })
@@ -117746,8 +117861,8 @@ var TASK_DEFINITION_FILES = [
   ["dashboardHtml", "dashboard.html", "dashboardHtml"],
   ["dashboardManifest", "dashboard.manifest.json", "dashboardManifest"]
 ];
-function materializeTask(task, runId) {
-  const dir = loopFireDir(task.slug, runId);
+function materializeTask(task, runId, runRoot) {
+  const dir = loopFireDir(task.slug, runId, runRoot);
   mkdirSync7(dir, { recursive: true, mode: 448 });
   const files = {};
   const skipped = [];
@@ -117907,18 +118022,18 @@ function startDashboardServer(args) {
       }
     }
   };
-  const bind = (port) => new Promise((resolve) => {
+  const bind = (port) => new Promise((resolve3) => {
     const server2 = make(handler);
     server2.once("error", (err) => {
       try {
         server2.close();
       } catch {
       }
-      resolve({ ok: false, err });
+      resolve3({ ok: false, err });
     });
     server2.listen(port, "127.0.0.1", () => {
       server2.unref();
-      resolve({
+      resolve3({
         ok: true,
         handle: {
           server: server2,
@@ -119350,12 +119465,12 @@ async function openBridgeConnection(socketPath, deps = {}) {
   } catch {
     return null;
   }
-  const opened = await new Promise((resolve) => {
+  const opened = await new Promise((resolve3) => {
     let settled = false;
     const done = (ok) => {
       if (settled) return;
       settled = true;
-      resolve(ok);
+      resolve3(ok);
     };
     socket.once("connect", () => done(true));
     socket.once("error", () => done(false));
@@ -119375,17 +119490,17 @@ async function openBridgeConnection(socketPath, deps = {}) {
     for (const frame of frames) {
       const res = parseBridgeResponse(frame);
       if (!res) continue;
-      const resolve = pending.get(res.id);
-      if (resolve) {
+      const resolve3 = pending.get(res.id);
+      if (resolve3) {
         pending.delete(res.id);
-        resolve(res);
+        resolve3(res);
       }
     }
   });
   const failAll = (error) => {
     closed = true;
-    for (const [id, resolve] of pending) {
-      resolve({ v: BRIDGE_PROTOCOL_VERSION, id, ok: false, error });
+    for (const [id, resolve3] of pending) {
+      resolve3({ v: BRIDGE_PROTOCOL_VERSION, id, ok: false, error });
     }
     pending.clear();
   };
@@ -119396,10 +119511,10 @@ async function openBridgeConnection(socketPath, deps = {}) {
     if (closed) {
       return Promise.resolve({ v: BRIDGE_PROTOCOL_VERSION, id, ok: false, error: "bridge_closed" });
     }
-    return new Promise((resolve) => {
+    return new Promise((resolve3) => {
       const timer = setTimeout(() => {
         pending.delete(id);
-        resolve({
+        resolve3({
           v: BRIDGE_PROTOCOL_VERSION,
           id,
           ok: false,
@@ -119410,7 +119525,7 @@ async function openBridgeConnection(socketPath, deps = {}) {
       if (typeof timer.unref === "function") timer.unref();
       pending.set(id, (res) => {
         clearTimeout(timer);
-        resolve(res);
+        resolve3(res);
       });
       socket.write(encodeFrame({ ...req, v: BRIDGE_PROTOCOL_VERSION, id, clientPid, nonce }));
     });
@@ -119614,7 +119729,7 @@ function createShimHandler(deps) {
 }
 var TOO_LARGE = /* @__PURE__ */ Symbol.for("ametyst.delegate.shim.too-large");
 function readBody2(req) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     let data = "";
     let over = false;
     req.setEncoding("utf-8");
@@ -119624,14 +119739,14 @@ function readBody2(req) {
       if (data.length > MAX_FRAME_BYTES) {
         over = true;
         data = "";
-        resolve(TOO_LARGE);
+        resolve3(TOO_LARGE);
       }
     });
     req.on("end", () => {
-      if (!over) resolve(data);
+      if (!over) resolve3(data);
     });
     req.on("error", () => {
-      if (!over) resolve(data);
+      if (!over) resolve3(data);
     });
   });
 }
@@ -119643,17 +119758,17 @@ async function startShim(deps) {
       res.end(JSON.stringify({ error: { message: "shim failure", type: "internal_error" } }));
     });
   });
-  await new Promise((resolve, reject) => {
+  await new Promise((resolve3, reject) => {
     server2.once("error", reject);
-    server2.listen(0, "127.0.0.1", () => resolve());
+    server2.listen(0, "127.0.0.1", () => resolve3());
   });
   const port = server2.address().port;
   return {
     port,
     baseURL: `http://127.0.0.1:${port}/v1`,
-    close: () => new Promise((resolve) => {
+    close: () => new Promise((resolve3) => {
       server2.closeAllConnections?.();
-      server2.close(() => resolve());
+      server2.close(() => resolve3());
     })
   };
 }
@@ -120304,25 +120419,26 @@ function killChild(child, signal, detached, kill = (pid, sig) => process.kill(pi
 function collectStream(child, which, onChunk) {
   const stream = child[which];
   if (!stream) return Promise.resolve("");
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     let data = "";
     stream.setEncoding("utf-8");
     stream.on("data", (chunk) => {
       data += chunk;
       onChunk(chunk);
     });
-    stream.on("end", () => resolve(data));
-    stream.on("error", () => resolve(data));
+    stream.on("end", () => resolve3(data));
+    stream.on("error", () => resolve3(data));
   });
 }
 function waitForExit(child) {
-  return new Promise((resolve) => {
-    child.on("close", (code) => resolve(code));
-    child.on("error", () => resolve(1));
+  return new Promise((resolve3) => {
+    child.on("close", (code) => resolve3(code));
+    child.on("error", () => resolve3(1));
   });
 }
 
 // src/delegate/jobs.ts
+init_paths();
 var DEFAULT_DELEGATE_TIMEOUT_MS = 30 * 6e4;
 var MAX_DELEGATE_TIMEOUT_MS = MAX_DELEGATE_DEADLINE_MS;
 function resolveDelegateTimeoutMs(env = process.env) {
@@ -120384,9 +120500,10 @@ function validateStartInput(input, deps = {}) {
       message: "delegate_start needs `model` \u2014 the model slug the openrouter passthrough should run, e.g. openai/gpt-5-mini."
     };
   }
-  const dir = typeof input.dir === "string" && input.dir.trim() ? input.dir.trim() : (deps.cwd ?? (() => process.cwd()))();
+  const explicitDir = typeof input.dir === "string" && input.dir.trim() ? input.dir.trim() : "";
+  const dir = explicitDir || resolveRunRoot(void 0, { ...deps.runRoot, ...deps.cwd ? { cwd: deps.cwd } : {} }).root;
   const isDirectory = deps.isDirectory;
-  if (isDirectory && !isDirectory(dir)) {
+  if (explicitDir && isDirectory && !isDirectory(dir)) {
     return {
       ok: false,
       error: "dir_not_found",
@@ -120855,23 +120972,23 @@ async function startDelegateBridge(deps) {
     socket.on("close", () => sockets.delete(socket));
   };
   const server2 = (deps.createServer ?? ((h) => createNetServer(h)))(onConnection);
-  const listening = await new Promise((resolve) => {
+  const listening = await new Promise((resolve3) => {
     server2.once("error", (err) => {
       log(`[delegate-bridge] listen failed: ${errText(err)}`);
-      resolve(false);
+      resolve3(false);
     });
     try {
-      server2.listen(socketPath, () => resolve(true));
+      server2.listen(socketPath, () => resolve3(true));
     } catch (err) {
       log(`[delegate-bridge] listen threw: ${errText(err)}`);
-      resolve(false);
+      resolve3(false);
     }
   });
   if (!listening) return null;
   const close = async () => {
     for (const s of sockets) s.destroy();
     sockets.clear();
-    await new Promise((resolve) => server2.close(() => resolve()));
+    await new Promise((resolve3) => server2.close(() => resolve3()));
     try {
       fs.rmSync(socketPath, { force: true });
     } catch {
@@ -121919,6 +122036,49 @@ function signingKeyForAddress(address, passphrase) {
     passphrase: passphrase ?? currentCredentials.passphrase
   });
 }
+async function refreshSignerBinding() {
+  if (!currentCredentials.apiKey) return { changed: false, address: currentCredentials.signerAddress };
+  let wallets;
+  try {
+    wallets = await fetchVirtualWalletsFromBackend(currentCredentials.apiKey, true);
+  } catch (err) {
+    console.error(
+      `\u26A0\uFE0F  [signer-binding] could not re-read the grants \u2014 signing with the cached binding (${currentCredentials.signerAddress ?? "none"}): ${err instanceof Error ? err.message : String(err)}`
+    );
+    wallets = walletsCache || [];
+  }
+  const row = currentCredentials.pendingWalletId ? findCurrentApprovedWallet(wallets, ownedSigningAddresses(), currentCredentials.pendingWalletId) : selectNewestApprovedWalletAmong(
+    wallets,
+    (Array.isArray(wallets) ? wallets : []).map((w) => w?.address)
+  );
+  if (!row) return { changed: false, address: currentCredentials.signerAddress };
+  const previousSigner = currentCredentials.signerAddress;
+  const { changed, signerAddress } = bindSignerToGrantRow(currentCredentials, row);
+  if (changed) {
+    console.error(
+      `\u{1F501} [signer-binding] the active grant moved \u2014 signer ${previousSigner ?? "none"} -> ${signerAddress ?? "none"} (virtual wallet ${currentCredentials.virtualWalletId}, policy ${currentCredentials.policyId ?? "unknown"}). Dropping the signer state derived from the old grant.`
+    );
+  }
+  return { changed, address: signerAddress };
+}
+async function resolveSignerForMaterialization(passphrase) {
+  await refreshSignerBinding();
+  const address = currentCredentials.signerAddress || currentCredentials.eoaAddress || "";
+  if (!address) {
+    throw new Error(
+      "no signer address for this session \u2014 no approved grant and no install wallet. Run requestAccess first."
+    );
+  }
+  return { address, privateKey: signingKeyForAddress(address, passphrase) };
+}
+function hasSigningKeyForAddress(address) {
+  if (!address) return false;
+  try {
+    return hasGrantSigningKey({ address, vaultAddress: currentCredentials.eoaAddress });
+  } catch {
+    return false;
+  }
+}
 var plaintextVaultMode = false;
 function refreshPlaintextVaultMode() {
   const vault = currentCredentials.walletKeystoreJson;
@@ -122763,7 +122923,7 @@ async function refreshGetAllowlistDescription() {
       }
     } catch (err) {
       console.warn("[mcp] fetchCapabilityIndex attempt 1 failed:", err);
-      await new Promise((resolve) => setTimeout(resolve, 2e3));
+      await new Promise((resolve3) => setTimeout(resolve3, 2e3));
       try {
         index2 = await fetchCapabilityIndex(currentCredentials.apiKey, true);
         if (index2 === null) {
@@ -122799,7 +122959,7 @@ async function refreshGetAllowlistDescription() {
         const msg = first.err instanceof Error ? first.err.message : String(first.err);
         if (msg.includes("Not connected")) {
         } else {
-          await new Promise((resolve) => setTimeout(resolve, 500));
+          await new Promise((resolve3) => setTimeout(resolve3, 500));
           const second = await tryNotify();
           if (!second.ok) {
             console.error("[capability-index] tools/list_changed failed twice", second.err);
@@ -122897,7 +123057,7 @@ async function refreshDynamicPrompts() {
       } else {
         const msg = first.err instanceof Error ? first.err.message : String(first.err);
         if (!msg.includes("Not connected")) {
-          await new Promise((resolve) => setTimeout(resolve, 500));
+          await new Promise((resolve3) => setTimeout(resolve3, 500));
           const second = await tryNotify();
           if (!second.ok) console.error("[dynamic-prompts] prompts/list_changed failed twice", second.err);
         }
@@ -122983,12 +123143,15 @@ async function initializeCredentials(walletKeystoreJson, eoaAddress, config) {
       const wallets = walletsCache || [];
       const approvedWallet = findCurrentApprovedWallet(
         wallets,
-        eoaAddress,
+        ownedSigningAddresses(),
         currentCredentials.pendingWalletId
       );
       if (approvedWallet) {
         console.error("\u2705 Found approved wallet from backend \u2014 authorization data stored");
         currentCredentials.authorizationStatus = "approved";
+        if (typeof approvedWallet.address === "string" && approvedWallet.address.trim() !== "") {
+          currentCredentials.signerAddress = approvedWallet.address;
+        }
         currentCredentials.virtualWalletStatus = approvedWallet.status;
         currentCredentials.walletAddress = approvedWallet.walletAddress || approvedWallet.kernelAccountAddress;
         currentCredentials.virtualWalletId = String(approvedWallet.id);
@@ -123035,10 +123198,9 @@ async function createKernelClientFromVault() {
     throw new Error("No passphrase or keystore available");
   }
   if (!cliConfig) throw new Error("CLI config not initialized");
-  let privateKey = signingKeyForAddress(
-    currentCredentials.signerAddress || currentCredentials.eoaAddress || ""
-  );
-  console.error(`${ts()} Wallet key loaded`);
+  const signer = await resolveSignerForMaterialization();
+  let privateKey = signer.privateKey;
+  console.error(`${ts()} Wallet key loaded \u2014 signing as ${signer.address}`);
   try {
     const { virtualWalletsManagers: virtualWalletsManagers2, financialAccounts: financialAccounts2 } = await getSDK();
     console.error(`${ts()} Fetching wallet data by API key...`);
@@ -123164,7 +123326,7 @@ var approvalWaitConfig = (() => {
   return {
     attempts,
     intervalMs,
-    delay: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+    delay: (ms) => new Promise((resolve3) => setTimeout(resolve3, ms))
   };
 })();
 async function tryResolvePendingApproval(probe) {
@@ -123799,7 +123961,7 @@ server.tool(
 server.tool(
   {
     name: "getWalletStatus",
-    description: "Get wallet status: auth, balance, policy, allowlist, WHICH GRANT AND KEY THIS SESSION SIGNS WITH, WHICH WORKSPACE this server is acting in, and the last 10 transactions (amount, merchant, timestamp, status). `signerAddress` is the address of the approved grant this session signs with \u2014 since every access request now mints its OWN ephemeral session key, it is NOT the same as `eoaAddress` (the install wallet) except for a grant approved before rotation; `activeVirtualWalletId` / `activePolicyId` name that grant's row. `workspace` is `{companyName, employeeName}` \u2014 the Ametyst workspace every task, memory document and payment from this server lands in; both fields are null when the profile could not be read, which means UNKNOWN, never 'no workspace'. A transaction `amount` is a EUR display string like `\u20AC0.0126`, or the em dash `\u2014` when the row carries no usable amount (none recorded, or a value that is not a base-units integer) \u2014 `\u2014` means UNKNOWN, never zero. The unformatted base-units value is on `amountRaw`, which is null for exactly those rows.",
+    description: "Get wallet status: auth, balance, policy, allowlist, WHICH GRANT AND KEY THIS SESSION SIGNS WITH, WHICH WORKSPACE this server is acting in, and the last 10 transactions (amount, merchant, timestamp, status). `signerAddress` is the address of the approved grant this session signs with \u2014 since every access request now mints its OWN ephemeral session key, it is NOT the same as `eoaAddress` (the install wallet) except for a grant approved before rotation; `activeVirtualWalletId` / `activePolicyId` name that grant's row, and `signerKeyPresent` says whether this machine still holds the private key for `signerAddress` \u2014 `false` means no spend can be signed until `requestAccess` mints a fresh session key and an admin approves it. `workspace` is `{companyName, employeeName}` \u2014 the Ametyst workspace every task, memory document and payment from this server lands in; both fields are null when the profile could not be read, which means UNKNOWN, never 'no workspace'. A transaction `amount` is a EUR display string like `\u20AC0.0126`, or the em dash `\u2014` when the row carries no usable amount (none recorded, or a value that is not a base-units integer) \u2014 `\u2014` means UNKNOWN, never zero. The unformatted base-units value is on `amountRaw`, which is null for exactly those rows.",
     inputs: []
   },
   async () => {
@@ -123834,6 +123996,9 @@ server.tool(
           const freshWallet = selectNewestApprovedWalletAmong(freshWallets, ownedSigningAddresses());
           const freshWalletIsActiveGrant = String(freshWallet?.id) === String(currentCredentials.virtualWalletId);
           if (freshWallet && freshWalletIsActiveGrant) {
+            if (typeof freshWallet.address === "string" && freshWallet.address.trim() !== "") {
+              currentCredentials.signerAddress = freshWallet.address;
+            }
             if (freshWallet.policyAssociated != null) {
               currentCredentials.policyId = String(freshWallet.policyAssociated);
             }
@@ -123860,6 +124025,16 @@ server.tool(
         // "which key signed this" readable from a payload instead of from a
         // nonce-key autopsy — the same lesson as `activeVirtualWalletId` below.
         signerAddress: currentCredentials.signerAddress || currentCredentials.eoaAddress || null,
+        // CAN THIS MACHINE ACTUALLY SIGN FOR THAT GRANT? A rotated grant is
+        // signable only from the per-grant keystore entry minted with it, and a
+        // machine that lost it (a re-install, a restored home, a grant approved
+        // on another laptop) is bound to a signer it cannot produce. Presence
+        // only — no decryption, so an encrypted vault with no cached passphrase
+        // still reports `true` here and bounces at spend time on the passphrase,
+        // which is a different and recoverable problem.
+        signerKeyPresent: hasSigningKeyForAddress(
+          currentCredentials.signerAddress || currentCredentials.eoaAddress
+        ),
         walletAddress: currentCredentials.walletAddress || null,
         kernelClientActive: !!currentCredentials.virtualWalletKernelAccountClient,
         // WHICH GRANT THIS SESSION SIGNS WITH. The 2026-09-01 incident — three
@@ -124357,7 +124532,9 @@ server.tool(
     toolName: "getTask",
     responseKey: "tasks",
     resolve: (sdk, apiKey, intent, category) => sdk.tasks.resolve(apiKey, intent, category),
-    sayToUser: "Present these matching tasks to the user, briefly explain them, and ask which one to run before proceeding. Run the one they pick with runTask.",
+    // Same wording as the slash-prompt directive (src/tasks/task-run-section.ts): after the pick,
+    // ASK HOW to run it — a run mode is a spend decision, so no surface picks one silently.
+    sayToUser: "Present these matching tasks to the user, briefly explain them, and ask which one to run before proceeding. Then, before running the one they pick, ASK HOW to run it and wait for an answer \u2014 always ask, never pick one silently: (1) one-time, in this chat, followed here; (2) one-time, headless in its own process via `ametyst task run <slug>`; (3) scheduled, recurring via `ametyst task schedule <slug> --every <dur>` (ask which cadence). Only then call runTask with the chosen mode (`in-chat` for 1, `headless` for 2) \u2014 for 3, hand the user the schedule command instead.",
     resolverFailedSayToUser: "Couldn't search tasks right now.",
     surfaceRawBodies: true,
     fetchManifest: (sdk, apiKey, slug) => readTaskManifest(sdk, apiKey, slug)
@@ -124481,7 +124658,13 @@ async function runTaskCore(params, flavor) {
       if (resolved.mode === "headless") return headless(resolved.source);
     }
     const memoryDocKey = defaultDocKey(normalizeMemoryManifest(entity?.stateDocs ?? null));
-    const materialized = flavor.materialize(entity, randomUUID4());
+    const runRoot = resolveRunRoot(typeof params.dir === "string" ? params.dir : void 0);
+    if (runRoot.reason === "fallback") {
+      console.error(
+        `(${entity.slug}: run folder anchored on the fallback ${runRoot.root} \u2014 ${(runRoot.rejected ?? []).map((r) => `${r.dir}: ${r.why}`).join("; ")})`
+      );
+    }
+    const materialized = flavor.materialize(entity, randomUUID4(), runRoot.root);
     const docBoot = await materializeMemoryDocs(sdk, apiKey, entity, materialized.dir);
     for (const note of docBoot.notes) console.error(`(${entity.slug} memory docs: ${note})`);
     const runFiles = { ...materialized.files, ...docBoot.files };
@@ -124494,6 +124677,10 @@ async function runTaskCore(params, flavor) {
       mode: "in-chat",
       ...modeSource ? { modeSource } : {},
       dir: materialized.dir,
+      // Which root the folder hangs off and why — `fallback` means "not under your project".
+      runRoot: runRoot.root,
+      runRootReason: runRoot.reason,
+      ...runRoot.rejected?.length ? { runRootRejected: runRoot.rejected } : {},
       ...dashboardUrl ? { dashboard: dashboardUrl } : {},
       blastRadius: est,
       files: runFiles,
@@ -124503,7 +124690,7 @@ async function runTaskCore(params, flavor) {
       // the slug because the run context carries no task identity — which is exactly why
       // the taskMemory* tools take an explicit `taskSlug`.
       memory: taskMemoryBlock(entity.slug, memoryDocKey),
-      directive: flavor.buildDirective({ dir: materialized.dir, slug: entity.slug, files: runFiles, docKey: memoryDocKey }),
+      directive: flavor.buildDirective({ dir: materialized.dir, slug: entity.slug, files: runFiles, docKey: memoryDocKey, runRoot }),
       ...shipBack ? { shipBack } : {}
     }) }, { type: "text", text: dashboardLine }] };
   } catch (error) {
@@ -124517,7 +124704,8 @@ server.tool(
     description: "Run a workspace TASK after the user has confirmed it (getTask already presented + stopped). A task is the unified card \u2014 what used to be a 'compound skill' or a 'loop' is one row now, and this ONE tool runs either. Two modes: `in-chat` (default) materializes the task's definition files locally and returns them plus a directive so YOU execute it inline in this session, paying for any step via the `spend` tool; `headless` returns the shell command to run it unattended in its own process. Only the NON-EMPTY definition files are materialized \u2014 a compound-shaped task (no VISION/CONSTRAINTS) gets just SKILL.md (+README.md) and NO constraints ship-back, instead of empty files that look checked but say nothing. DEFAULT RUN MODE: when you OMIT `mode` (or pass it empty), the task body's YAML frontmatter is consulted for a `defaultRunMode: headless|in-chat` key and that is used; an explicit `mode` wins over it. The ONLY accepted values are `in-chat` and `headless` \u2014 anything else (a typo like `in-chatt`) is REJECTED with `invalid_mode` and nothing runs: a value you passed is never quietly ignored, never coerced, and never falls back to the frontmatter, because that would answer an explicit `in-chat` with an unattended headless run. The response reports `modeSource` (explicit / frontmatter / default) so you can see which one decided.",
     inputs: [
       { name: "task", type: "string", required: true, description: "Slug or id of the task to run (as returned by getTask)." },
-      { name: "mode", type: "string", required: false, description: 'Exactly "in-chat" (you run it inline now) or "headless" (run unattended via `ametyst task run`) \u2014 any other value is rejected with `invalid_mode` rather than coerced or ignored. Omit it (or pass empty) to use the task body\'s `defaultRunMode` frontmatter, falling back to "in-chat". An explicit value wins over the frontmatter.' }
+      { name: "mode", type: "string", required: false, description: 'Exactly "in-chat" (you run it inline now) or "headless" (run unattended via `ametyst task run`) \u2014 any other value is rejected with `invalid_mode` rather than coerced or ignored. Omit it (or pass empty) to use the task body\'s `defaultRunMode` frontmatter, falling back to "in-chat". An explicit value wins over the frontmatter.' },
+      { name: "dir", type: "string", required: false, description: "Directory to materialize and run in; defaults to the current project folder, falling back to a writable per-user location when there is none. The response reports the chosen root as `runRoot` and why as `runRootReason` (explicit | cwd | fallback)." }
     ]
   },
   async (params) => runTaskCore(params, {
@@ -124532,12 +124720,13 @@ server.tool(
     headlessCommand: (ref) => `ametyst task run ${ref}`,
     headlessSayToUser: (ref) => `Run \`ametyst task run ${ref}\` in a terminal \u2014 it materializes the task, runs it unattended, and ships back improvements on a clean finish. (\`task run\` is the unattended runner for every task row, whatever the task was originally authored as.) Paid steps go through your on-chain policy.`,
     honorFrontmatterDefault: true,
-    materialize: (task, runId) => materializeTask(task, runId),
-    buildDirective: ({ dir, slug, files, docKey }) => {
+    materialize: (task, runId, runRoot) => materializeTask(task, runId, runRoot),
+    buildDirective: ({ dir, slug, files, docKey, runRoot }) => {
       const present = Object.entries(files).filter(([label2]) => label2 !== "status").map(([, filename]) => filename);
+      const whereNote = runRoot.reason === "fallback" ? `NOTE: this run's folder lives under the per-user fallback ${runRoot.root}, NOT under the current project, because the current folder was not writable (${(runRoot.rejected ?? []).map((r) => `${r.dir}: ${r.why}`).join("; ")}). Read the files from ${dir} exactly as given \u2014 do not go looking for them in the project. ` : "";
       const readDoc = typeof docKey === "string" ? `taskMemoryGet({ taskSlug: "${slug}", docKey: "${docKey}" }) for the "${docKey}" document (the first one this task declares), then ` : `this task declares NO memory document \u2014 do not read or create one; read `;
       const writeDoc = typeof docKey === "string" ? `, and rewrite the "${docKey}" document with taskMemoryAppend({ taskSlug: "${slug}", docKey: "${docKey}", content: "..." })` : ` \u2014 and NO document upsert, because this task declares none`;
-      return `Read the task files in ${dir} \u2014 the ONLY files materialized are: ${present.join(", ")} (plus STATUS.md, this run's own state). SKILL.md drives${files.vision ? "; VISION.md = done-condition" : ""}${files.constraints ? "; CONSTRAINTS.md = hard limits" : ""}. Any definition file NOT listed was empty on the task and was deliberately not written \u2014 do not go looking for it, and do not assume limits you cannot read. If the task has a QUEUE of work items it is EXTERNAL \u2014 NOT one of these files; SKILL.md tells you WHERE to read the queue from and WHERE to write the results. Execute the task here, in this session, until it is done (or, if it is a looping task, until VISION is met / the queue is drained). Pay for any step ONLY via the spend tool (the on-chain policy is the budget). Keep ${dir}/STATUS.md updated. CLEAN UP AFTER YOURSELF: on a CLEAN finish (done / queue drained, no brake), DELETE the ${dir} folder \u2014 it is this run's scratch space, not a record, and every run gets its own, so leaving them behind piles up orphans. On a dirty stop, leave ${dir} in place so the run can be resumed.
+      return `${whereNote}Read the task files in ${dir} \u2014 the ONLY files materialized are: ${present.join(", ")} (plus STATUS.md, this run's own state). SKILL.md drives${files.vision ? "; VISION.md = done-condition" : ""}${files.constraints ? "; CONSTRAINTS.md = hard limits" : ""}. Any definition file NOT listed was empty on the task and was deliberately not written \u2014 do not go looking for it, and do not assume limits you cannot read. If the task has a QUEUE of work items it is EXTERNAL \u2014 NOT one of these files; SKILL.md tells you WHERE to read the queue from and WHERE to write the results. Execute the task here, in this session, until it is done (or, if it is a looping task, until VISION is met / the queue is drained). Pay for any step ONLY via the spend tool (the on-chain policy is the budget). Keep ${dir}/STATUS.md updated. CLEAN UP AFTER YOURSELF: on a CLEAN finish (done / queue drained, no brake), DELETE the ${dir} folder \u2014 it is this run's scratch space, not a record, and every run gets its own, so leaving them behind piles up orphans. On a dirty stop, leave ${dir} in place so the run can be resumed.
 
 Your durable memory is available via the taskMemory* tools with taskSlug "${slug}" \u2014 and it, not ${dir}, is what survives this run. Nothing from it was injected into this run: READ WHAT YOU NEED FIRST with taskMemoryGet \u2014 ${readDoc}one list per record kind you need, taskMemoryGet({ taskSlug: "${slug}", records: true, kind: "<kind>" }) (latest version per key, archived=false by default); empty means this is the first run. WRITE A RUN RECORD BEFORE EXITING, on every path including a brake: taskMemoryAppend({ taskSlug: "${slug}", kind: "run", content: "<what you did, what you learned, what the next run should pick up>" })${writeDoc}.
 
@@ -125336,11 +125525,13 @@ server.tool(
         };
       }
       touchWalletActivity();
+      let missingSignerKey;
       if (!currentCredentials.virtualWalletKernelAccountClient && currentCredentials.authorizationStatus === "approved" && isWalletUnlocked()) {
         try {
           console.error("\u{1F504} [spend] Auto-creating kernel client...");
           await createKernelClientFromVault();
         } catch (kcErr) {
+          if (isMissingGrantKeyError(kcErr)) missingSignerKey = kcErr;
           console.error("\u274C [spend] Auto kernel client creation failed:", kcErr instanceof Error ? kcErr.message : String(kcErr));
         }
       }
@@ -125396,6 +125587,28 @@ server.tool(
       const apiKey = currentCredentials.apiKey;
       if (!kernelClient || !apiKey) {
         console.error("\u26A0\uFE0F [spend] Missing kernel client or API key in state");
+        if (missingSignerKey) {
+          logSpendTelemetryEarlyErr();
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({
+                  success: false,
+                  ...disclosePayment(),
+                  // PRE-PAYMENT
+                  error: "signer_key_missing",
+                  detail: missingSignerKey.message,
+                  guidance: {
+                    say_to_user: "This machine can't sign for your approved access any more \u2014 the session key it was issued to isn't here. I need to request access again so a fresh key can be approved.",
+                    next_action: "Call getAvailablePolicies(), let the user pick a policy, then call requestAccess with it. Once the admin approves the new request, retry this spend.",
+                    stop: true
+                  }
+                })
+              }
+            ]
+          };
+        }
         if (currentCredentials.authorizationStatus === "pending") {
           logSpendTelemetryEarlyErr();
           return {
@@ -126590,8 +126803,8 @@ import { join as join19 } from "path";
 // src/compounds/sync-skills.ts
 init_esm_shims();
 init_paths();
-import { existsSync as existsSync14, mkdirSync as mkdirSync9, readdirSync as readdirSync5, readFileSync as readFileSync14, rmSync, writeFileSync as writeFileSync10 } from "fs";
-import { join as join18 } from "path";
+import { accessSync as accessSync3, constants as constants3, existsSync as existsSync14, mkdirSync as mkdirSync9, readdirSync as readdirSync5, readFileSync as readFileSync14, rmSync, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname8, join as join18, parse as parse4, resolve as resolve2 } from "path";
 var MANAGED_MARKER = "<!-- ametyst-managed: sync-skills -->";
 var GITIGNORE_HEADER = "# ametyst-managed: sync-skills \u2014 pointer skills generated for this account; never commit them.";
 var GITIGNORE_HEADER_2 = "# Maintained by `ametyst serve` on every boot. Real skills without the managed marker are not listed.";
@@ -126671,9 +126884,46 @@ function maintainGitignore(root2) {
   writeFileSync10(file, buildGitignoreContent(managed));
   return "written";
 }
+function resolveSkillsScope(target, deps = {}) {
+  const exists = deps.existsSync ?? existsSync14;
+  const access = deps.accessSync ?? accessSync3;
+  let cwd;
+  try {
+    cwd = (deps.cwd ?? (() => process.cwd()))();
+  } catch (err) {
+    const why2 = `the current directory cannot be read (${err instanceof Error ? err.message : String(err)})`;
+    return { global: true, root: skillsRoot(target, true), fallback: { from: "<cwd>", why: why2 } };
+  }
+  const local = join18(cwd, SKILLS_DIR_BY_TARGET2[target], "skills");
+  const abs = resolve2(cwd);
+  let why;
+  if (parse4(abs).root === abs) {
+    why = "the current directory is the filesystem root, not a project folder";
+  } else if (!exists(abs)) {
+    why = `the current directory ${abs} does not exist`;
+  } else {
+    let probe = local;
+    while (!exists(probe)) {
+      const parent = dirname8(probe);
+      if (parent === probe) break;
+      probe = parent;
+    }
+    try {
+      access(probe, constants3.W_OK);
+    } catch (err) {
+      const code = err?.code;
+      why = `${probe} is not writable${code ? ` (${code})` : ""}`;
+    }
+  }
+  if (why === void 0) return { global: false, root: local };
+  return { global: true, root: skillsRoot(target, true), fallback: { from: local, why } };
+}
+var SKILLS_DIR_BY_TARGET2 = { claude: ".claude", codex: ".codex" };
 async function syncSkills(opts = {}) {
-  const global2 = opts.global ?? false;
   const target = opts.target ?? "claude";
+  const scope = opts.global ? { global: true, root: skillsRoot(target, true) } : resolveSkillsScope(target);
+  const global2 = scope.global;
+  const fallback2 = "fallback" in scope ? scope.fallback : void 0;
   const { sdk, apiKey } = await getCliSdk();
   const [compRes, loopRes] = await Promise.all([sdk.compoundedSkills.list(apiKey), sdk.loops.list(apiKey)]);
   if (compRes?.status !== "ok") throw new Error(`failed to list compounds: ${compRes?.error ?? "unknown error"}`);
@@ -126732,7 +126982,7 @@ async function syncSkills(opts = {}) {
     pruned++;
   }
   const gitignore = global2 ? "none" : maintainGitignore(root2);
-  return { root: root2, written, pruned, skipped, gitignore };
+  return { root: root2, written, pruned, skipped, gitignore, ...fallback2 ? { fallback: fallback2 } : {} };
 }
 
 // src/commands/autosync-skills.ts
@@ -126775,7 +127025,7 @@ async function autoSyncSkillsOnBoot(deps = {}) {
     try {
       const r = await sync(target);
       log(
-        `\u2705 skills autosync [${target}]: ${r.written} written, ${r.pruned} pruned` + (r.skipped.length ? `, ${r.skipped.length} skipped (unmanaged)` : "")
+        `\u2705 skills autosync [${target}]: ${r.written} written, ${r.pruned} pruned` + (r.skipped.length ? `, ${r.skipped.length} skipped (unmanaged)` : "") + ` \u2192 ${r.root}` + (r.fallback ? ` (fallback to the home root: ${r.fallback.why}; project-local ${r.fallback.from} was not used)` : "")
       );
     } catch (err) {
       log(
@@ -127439,8 +127689,8 @@ init_paths();
 import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync11 } from "fs";
 import { join as join20 } from "path";
 var MIRRORED_DEFINITION_FILES = ["SKILL.md", "VISION.md", "README.md"];
-function materialize(loop2, fireId, stateDocs = []) {
-  const dir = loopFireDir(loop2.slug, fireId);
+function materialize(loop2, fireId, stateDocs = [], runRoot) {
+  const dir = loopFireDir(loop2.slug, fireId, runRoot);
   mkdirSync10(dir, { recursive: true, mode: 448 });
   for (const doc of stateDocs) {
     writeFileSync11(join20(dir, doc.filename), doc.body, { mode: 384 });
@@ -127471,12 +127721,12 @@ queue: not started
 `,
     { mode: 384 }
   );
-  mirrorDefinitionFiles(loop2.slug, files);
+  mirrorDefinitionFiles(loop2.slug, files, runRoot);
   return dir;
 }
-function mirrorDefinitionFiles(slug, files) {
+function mirrorDefinitionFiles(slug, files, runRoot) {
   try {
-    const root2 = loopDir(slug);
+    const root2 = loopDir(slug, runRoot);
     mkdirSync10(root2, { recursive: true, mode: 448 });
     for (const name of [...MIRRORED_DEFINITION_FILES, "dashboard.html", "dashboard.manifest.json"]) {
       const body = files[name];
@@ -127582,7 +127832,7 @@ When you finish cleanly (VISION met / queue drained), write "status: done" and "
   return {
     cmd: "claude",
     args,
-    cwd: process.cwd(),
+    cwd: opts.cwd ?? process.cwd(),
     env: {
       ...deriveGitIdentityEnv(env, deps.readGitConfig ?? readGlobalGitConfig),
       // Loop memory is addressed by SLUG, and the fire context carries no loop
@@ -127761,7 +128011,7 @@ init_esm_shims();
 import { spawn as spawn2 } from "child_process";
 import { randomUUID as randomUUID5 } from "crypto";
 import { existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync15, rmSync as rmSync2, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname8, join as join24 } from "path";
+import { dirname as dirname9, join as join24 } from "path";
 
 // src/loops/claude-binary.ts
 init_esm_shims();
@@ -127869,10 +128119,10 @@ function resolveMaxConcurrentFires(opts = {}, env = process.env) {
 // src/loops/run.ts
 init_paths();
 var SHIPBACK_SIGNAL_TIMEOUT_MS = 8e3;
-function preserveRefusedConstraints(slug, fireId, body) {
+function preserveRefusedConstraints(slug, fireId, body, runRoot) {
   try {
-    const path2 = refusedConstraintsPath(slug, fireId);
-    mkdirSync11(dirname8(path2), { recursive: true, mode: 448 });
+    const path2 = refusedConstraintsPath(slug, fireId, runRoot);
+    mkdirSync11(dirname9(path2), { recursive: true, mode: 448 });
     writeFileSync12(path2, body, { mode: 384 });
     return { path: path2 };
   } catch (err) {
@@ -127896,7 +128146,12 @@ async function runLoop(loopId, opts = {}) {
   const got = await sdk.loops.get(apiKey, loopId);
   if (got.status !== "ok") throw new Error(`loop not found: ${got.error}`);
   const loop2 = got.loop;
-  const loopRoot = loopDir(loop2.slug);
+  const runRoot = resolveRunRoot();
+  if (runRoot.reason === "fallback") {
+    const why = runRoot.rejected?.map((r) => `${r.dir}: ${r.why}`).join("; ") ?? "no usable cwd";
+    console.log(`Loop ${loop2.slug}: running under ${runRoot.root} \u2014 the current folder cannot host a run (${why}).`);
+  }
+  const loopRoot = loopDir(loop2.slug, runRoot.root);
   const maxConcurrent = resolveMaxConcurrentFires(opts, process.env);
   const inFlight = liveFires(loopRoot);
   if (inFlight.length >= maxConcurrent) {
@@ -127939,11 +128194,13 @@ async function runLoop(loopId, opts = {}) {
       `Loop ${loop2.slug}: ${undeclared.length} memory doc(s) not in manifest (${undeclared.map((d) => `${d.key} \u2190 ${d.scope}`).join(", ")}) \u2014 materialized anyway, and shipped back to the namespace each came from. Declare them in the task's stateDocs manifest to make that explicit.`
     );
   }
-  const dir = materialize(loop2, sessionId2, stateDocBodies);
+  const dir = materialize(loop2, sessionId2, stateDocBodies, runRoot.root);
   console.log(`Loop ${loop2.slug}: fire ${sessionId2} \u2192 ${dir}`);
   const launch = buildLaunchArgs(
     dir,
-    { ...opts, sessionId: sessionId2, memoryManifest: normalizeMemoryManifest(loop2.stateDocs) },
+    // The child runs IN the resolved root: for a project cwd that is the cwd it always was; under
+    // the fallback it is the writable folder rather than the `/` launchd handed us.
+    { ...opts, sessionId: sessionId2, cwd: opts.cwd ?? runRoot.root, memoryManifest: normalizeMemoryManifest(loop2.stateDocs) },
     loop2.slug
   );
   const budget = resolveMaxBudgetUsd(opts);
@@ -128027,7 +128284,7 @@ blast_radius: steps=${est.steps} paid=${est.paidSteps} estEur=${est.estCostEur ?
         const fresh = reread.loop.constraintsMd ?? "";
         const merged = mergeConstraints(boot, materializedConstraints, fresh);
         if (merged.refusal) {
-          const kept = preserveRefusedConstraints(loop2.slug, sessionId2, materializedConstraints);
+          const kept = preserveRefusedConstraints(loop2.slug, sessionId2, materializedConstraints, runRoot.root);
           constraintsReport = { outcome: "refused", keptAt: kept.path ?? constraintsPath };
           console.error(
             `Loop ${loop2.slug}: ${merged.refusal} This fire's constraints were NOT discarded: its folder is KEPT at ${dir}` + (kept.path ? `, and the refused document is copied to ${kept.path}.` : ` \u2014 but the durable copy could NOT be written (${kept.error}), so that folder is the only place it survives.`)
@@ -128095,11 +128352,11 @@ blast_radius: steps=${est.steps} paid=${est.paidSteps} estEur=${est.estCostEur ?
   process.on("SIGINT", onSignal);
   process.on("SIGTERM", onSignal);
   let spawnError;
-  const exitCode = await new Promise((resolve) => {
-    child.on("exit", (code) => resolve(code ?? 1));
+  const exitCode = await new Promise((resolve3) => {
+    child.on("exit", (code) => resolve3(code ?? 1));
     child.on("error", (err) => {
       spawnError = err instanceof Error ? err.message : String(err);
-      resolve(1);
+      resolve3(1);
     });
   });
   if (child.pid) killTree(child.pid);
@@ -128161,9 +128418,9 @@ async function showLoop(loopId) {
 // src/loops/schedule.ts
 init_esm_shims();
 init_paths();
-import { writeFileSync as writeFileSync13, mkdirSync as mkdirSync12, rmSync as rmSync3, existsSync as existsSync17, readdirSync as readdirSync6, readFileSync as readFileSync16, accessSync as accessSync2, constants as constants2 } from "fs";
+import { writeFileSync as writeFileSync13, mkdirSync as mkdirSync12, rmSync as rmSync3, existsSync as existsSync17, readdirSync as readdirSync6, readFileSync as readFileSync16, accessSync as accessSync4, constants as constants4 } from "fs";
 import { execFileSync as execFileSync4 } from "child_process";
-import { join as join25, dirname as dirname9 } from "path";
+import { join as join25, dirname as dirname10 } from "path";
 import { homedir as homedir14 } from "os";
 var LOOP_KIND = {
   labelPrefix: "xyz.ametyst.loop.",
@@ -128294,7 +128551,7 @@ function validatedExtraEnv(extraEnv) {
 }
 function assertWritable(dir, what) {
   try {
-    accessSync2(dir, constants2.W_OK);
+    accessSync4(dir, constants4.W_OK);
   } catch {
     throw new Error(
       `refusing to schedule: the ${what} ${dir} is not writable, so the job would be registered but every fire would die before writing any trace. Schedule from a writable project directory.`
@@ -128387,7 +128644,15 @@ function schedule(kind, slug, opts = {}) {
   const lbl = label(kind, slug);
   const args = kind.buildRunCmd(slug, opts);
   const cadence = cadenceLabel(opts);
-  const cwd = opts.cwd ?? process.cwd();
+  const resolved = resolveRunRoot(void 0, {
+    cwd: () => opts.cwd ?? process.cwd(),
+    homedir: () => home
+  });
+  const cwd = resolved.root;
+  if (resolved.reason === "fallback") {
+    const why = (resolved.rejected ?? []).map((r) => `${r.dir}: ${r.why}`).join("; ");
+    console.warn(`\u26A0\uFE0F  the job will run in ${cwd} \u2014 the current folder cannot host a run (${why}).`);
+  }
   const procEnv = opts.env ?? process.env;
   const envPath = procEnv.PATH ?? "";
   const model = resolveScheduledModel(opts, home, procEnv);
@@ -128410,8 +128675,7 @@ function schedule(kind, slug, opts = {}) {
     })();
     const path2 = plistPath(kind, home, slug);
     const stateDir2 = kind.stateDir(slug, cwd);
-    assertWritable(cwd, "working directory");
-    mkdirSync12(dirname9(path2), { recursive: true });
+    mkdirSync12(dirname10(path2), { recursive: true });
     mkdirSync12(stateDir2, { recursive: true });
     assertWritable(stateDir2, "log directory");
     writeFileSync13(path2, plistXml(lbl, args, scheduleBlock, cwd, jobEnv, stateDir2), { mode: 384 });
@@ -128431,10 +128695,9 @@ launchctl said: ${unloaded.output.trim()}` : "")
 launchctl said: ${loaded.output.trim()}` : "")
       );
     }
-    return { label: lbl, cadence, workingDirectory: cwd, model: effectiveModel };
+    return { label: lbl, cadence, workingDirectory: cwd, workingDirectoryReason: resolved.reason, model: effectiveModel };
   }
   const stateDir = kind.stateDir(slug, cwd);
-  assertWritable(cwd, "working directory");
   mkdirSync12(stateDir, { recursive: true });
   assertWritable(stateDir, "log directory");
   const cronEnv = { PATH: envPath };
@@ -128448,7 +128711,7 @@ launchctl said: ${loaded.output.trim()}` : "")
   const kept = stripLabel(readCrontab(), lbl);
   kept.push(line);
   writeCrontab(kept.join("\n"));
-  return { label: lbl, cadence, workingDirectory: cwd, model: effectiveCronModel };
+  return { label: lbl, cadence, workingDirectory: cwd, workingDirectoryReason: resolved.reason, model: effectiveCronModel };
 }
 function unschedule(kind, slug, opts = {}) {
   const platform = opts.platform ?? process.platform;
@@ -128673,9 +128936,9 @@ async function runCompound(compoundId, opts = {}) {
   };
   process.on("SIGINT", onSignal);
   process.on("SIGTERM", onSignal);
-  const exitCode = await new Promise((resolve) => {
-    child.on("exit", (code) => resolve(code ?? 1));
-    child.on("error", () => resolve(1));
+  const exitCode = await new Promise((resolve3) => {
+    child.on("exit", (code) => resolve3(code ?? 1));
+    child.on("error", () => resolve3(1));
   });
   process.off("SIGINT", onSignal);
   process.off("SIGTERM", onSignal);
@@ -128984,7 +129247,7 @@ compoundCommand.command("sync-skills").description(
     for (const target of targets) {
       const r = await syncSkills({ global: opts.global, target });
       console.log(
-        `\u2705 sync-skills [${target}]: ${r.written} written, ${r.pruned} pruned${r.skipped.length ? `, ${r.skipped.length} skipped (unmanaged): ${r.skipped.join(", ")}` : ""} \u2192 ${r.root}`
+        `\u2705 sync-skills [${target}]: ${r.written} written, ${r.pruned} pruned${r.skipped.length ? `, ${r.skipped.length} skipped (unmanaged): ${r.skipped.join(", ")}` : ""} \u2192 ${r.root}${r.fallback ? ` (fallback to the home root: ${r.fallback.why}; project-local ${r.fallback.from} was not used)` : ""}`
       );
     }
   } catch (err) {