@atlasharness/atlascode 0.1.47 → 0.1.48

package/dist/cli.js

@@ -77967,7 +77967,7 @@ function createMcpConnectionManager() {
     connections.set(name, conn);
     return conn;
   }
-  async function connectStdio(name, config) {
+  async function connectStdio(name, config, opts) {
     const finalCommand = process.env.ATLAS_SHELL_PREFIX || config.command;
     const finalArgs = process.env.ATLAS_SHELL_PREFIX ? [[config.command, ...config.args ?? []].join(" ")] : config.args ?? [];
     const env = { ...process.env, ...config.env ?? {} };
@@ -78031,9 +78031,10 @@ function createMcpConnectionManager() {
       },
       clientInfo: { name: "atlascode", version: "0.0.1" }
     });
+    const budgetMs = opts?.connectionTimeoutMs ?? getConnectionTimeoutMs();
     let timeoutId;
     const timeoutPromise = new Promise((_, reject) => {
-      timeoutId = setTimeout(() => reject(new Error(`MCP server "${name}" connection timed out after ${getConnectionTimeoutMs()}ms`)), getConnectionTimeoutMs());
+      timeoutId = setTimeout(() => reject(new Error(`MCP server "${name}" connection timed out after ${budgetMs}ms`)), budgetMs);
     });
     initPromise.then(() => clearTimeout(timeoutId), () => clearTimeout(timeoutId));
     try {
@@ -78072,7 +78073,7 @@ function createMcpConnectionManager() {
       return fail(name, config, message);
     }
   }
-  async function connect(name, config) {
+  async function connect(name, config, opts) {
     const existing = connections.get(name);
     if (existing?.type === "connected")
       return existing;
@@ -78082,7 +78083,7 @@ function createMcpConnectionManager() {
       if (t === "sse" || t === "http" || t === "ws") {
         return fail(name, config, `${t}: ${FORWARD_SEAM_MESSAGE}`);
       }
-      return await connectStdio(name, config);
+      return await connectStdio(name, config, opts);
     } finally {
       pending.delete(name);
     }
@@ -85125,7 +85126,8 @@ var init_hooksWiring = __esm(() => {
 
 // src/cli/print.ts
 import { randomUUID as randomUUID21 } from "crypto";
-import { join as join37 } from "path";
+import { readFile as readFile12 } from "node:fs/promises";
+import { join as join37, resolve as resolve14 } from "path";
 function bridgeMcpToolClientLocal(client) {
   return {
     async callTool(toolName, args, _signal) {
@@ -85182,6 +85184,60 @@ function syncMcpClientRegistryLocal(manager) {
   }
   setMcpClientRegistry({ clients });
 }
+function isMcpConnectionNonBlocking() {
+  const v = (process.env.MCP_CONNECTION_NONBLOCKING ?? "").trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes" || v === "on";
+}
+async function parseMcpConfigItemsLocal(items) {
+  const out = {};
+  for (const item of items) {
+    const trimmed = item.trim();
+    if (!trimmed)
+      continue;
+    let object = null;
+    try {
+      object = JSON.parse(trimmed);
+    } catch {
+      try {
+        const raw = await readFile12(resolve14(trimmed), "utf8");
+        object = JSON.parse(raw);
+      } catch {
+        object = null;
+      }
+    }
+    const record = object?.mcpServers;
+    if (record && typeof record === "object") {
+      for (const [name, serverConfig] of Object.entries(record)) {
+        out[name] = serverConfig;
+      }
+    }
+  }
+  return out;
+}
+async function connectMcpStartup(args) {
+  const { manager, discoveryInput, mcpConfig, strictMcpConfig } = args;
+  const baseConfigs = await buildMcpServerConfigs(discoveryInput);
+  const dynamicConfigs = mcpConfig?.length ? await buildMcpServerConfigs({
+    settingsServers: await parseMcpConfigItemsLocal(mcpConfig),
+    projectMcpJsonPath: null
+  }) : {};
+  const dynamicNames = new Set(Object.keys(dynamicConfigs));
+  const allConfigs = strictMcpConfig ? dynamicConfigs : { ...baseConfigs, ...dynamicConfigs };
+  const connectAll = () => Promise.allSettled(Object.entries(allConfigs).map(([name, config]) => manager.connect(name, config, dynamicNames.has(name) ? { connectionTimeoutMs: 5000 } : undefined)));
+  const nonBlocking = isMcpConnectionNonBlocking();
+  if (nonBlocking) {
+    connectAll();
+    logForDebugging2(`[headless] mcp: non-blocking (MCP_CONNECTION_NONBLOCKING), ${String(Object.keys(allConfigs).length)} server(s) connecting in background`);
+  } else {
+    const mcpResults = await connectAll();
+    const mcpOk = mcpResults.filter((r) => r.status === "fulfilled").length;
+    logForDebugging2(mcpConnectLine(mcpOk, mcpResults.length - mcpOk));
+  }
+  const mcpConnections = await buildMcpEngineConnectionsLocal(manager);
+  const mcpTools = createMcpTools(mcpConnections);
+  syncMcpClientRegistryLocal(manager);
+  return { mcpConnections, mcpTools, nonBlocking };
+}
 function validateUuidLocal(value) {
   return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
 }
@@ -85332,13 +85388,12 @@ async function runHeadless(inputPrompt, options) {
     settingsServers: settings.settings.mcpServers,
     projectMcpJsonPath: join37(process.cwd(), ".mcp.json")
   };
-  const mcpConfigs = await buildMcpServerConfigs(discoveryInput);
-  const mcpResults = await Promise.allSettled(Object.entries(mcpConfigs).map(([name, config]) => mcpManager.connect(name, config)));
-  const mcpOk = mcpResults.filter((r) => r.status === "fulfilled").length;
-  logForDebugging2(mcpConnectLine(mcpOk, mcpResults.length - mcpOk));
-  const mcpConnections = await buildMcpEngineConnectionsLocal(mcpManager);
-  const mcpTools = createMcpTools(mcpConnections);
-  syncMcpClientRegistryLocal(mcpManager);
+  const { mcpTools } = await connectMcpStartup({
+    manager: mcpManager,
+    discoveryInput,
+    mcpConfig: options.mcpConfig,
+    strictMcpConfig: options.strictMcpConfig
+  });
   const hasPromptRoute = options.permissionPromptToolName === "stdio";
   const role = options.model ? modelToRole(options.model) : "premium";
   const roleModel = getRoleModel(role);
@@ -86627,7 +86682,7 @@ var init_autoMode2 = __esm(() => {
 
 // src/cli/parse.ts
 import { existsSync as existsSync8, readFileSync as readFileSync11, realpathSync as realpathSync6 } from "fs";
-import { dirname as dirname21, join as join40, resolve as resolve14 } from "path";
+import { dirname as dirname21, join as join40, resolve as resolve15 } from "path";
 function resolveCliVersion(startDir) {
   let dir;
   try {
@@ -86670,11 +86725,11 @@ function readPromptFileInline(inline, file, label) {
     process.exit(1);
   }
   try {
-    return readFileSync11(resolve14(file), "utf8");
+    return readFileSync11(resolve15(file), "utf8");
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT") {
-      process.stderr.write(`Error: ${label} file not found: ${resolve14(file)}
+      process.stderr.write(`Error: ${label} file not found: ${resolve15(file)}
 `);
     } else {
       process.stderr.write(`Error reading ${label} file: ${error.message}
@@ -86739,7 +86794,9 @@ function buildHeadlessOptions(options) {
     appendSystemPrompt: readPromptFileInline(options.appendSystemPrompt, options.appendSystemPromptFile, "Append system prompt"),
     fallbackModel: options.fallbackModel,
     thinkingConfig: buildHeadlessThinkingConfig(options.thinking, options.maxThinkingTokens),
-    effort: options.effort
+    effort: options.effort,
+    mcpConfig: options.mcpConfig,
+    strictMcpConfig: options.strictMcpConfig === true ? true : undefined
   };
 }
 async function mainActionSeam(prompt, options) {
@@ -98076,11 +98133,11 @@ var init_execFileNoThrow2 = __esm(() => {
 });
 
 // src/tui/utils/git/gitConfigParser.ts
-import { readFile as readFile14 } from "fs/promises";
+import { readFile as readFile15 } from "fs/promises";
 import { join as join46 } from "path";
 async function parseGitConfigValue2(gitDir, section, subsection, key) {
   try {
-    const config = await readFile14(join46(gitDir, "config"), "utf-8");
+    const config = await readFile15(join46(gitDir, "config"), "utf-8");
     return parseConfigString2(config, section, subsection, key);
   } catch {
     return null;
@@ -98246,13 +98303,13 @@ var init_gitConfigParser = () => {};
 
 // src/tui/utils/git/gitFilesystem.ts
 import { unwatchFile, watchFile } from "fs";
-import { readdir as readdir7, readFile as readFile15, stat as stat13 } from "fs/promises";
-import { join as join47, resolve as resolve15 } from "path";
+import { readdir as readdir7, readFile as readFile16, stat as stat13 } from "fs/promises";
+import { join as join47, resolve as resolve16 } from "path";
 function clearResolveGitDirCache() {
   resolveGitDirCache2.clear();
 }
 async function resolveGitDir2(startPath) {
-  const cwd = resolve15(startPath ?? getCwd());
+  const cwd = resolve16(startPath ?? getCwd());
   const cached = resolveGitDirCache2.get(cwd);
   if (cached !== undefined) {
     return cached;
@@ -98266,10 +98323,10 @@ async function resolveGitDir2(startPath) {
   try {
     const st = await stat13(gitPath);
     if (st.isFile()) {
-      const content = (await readFile15(gitPath, "utf-8")).trim();
+      const content = (await readFile16(gitPath, "utf-8")).trim();
       if (content.startsWith("gitdir:")) {
         const rawDir = content.slice("gitdir:".length).trim();
-        const resolved = resolve15(root, rawDir);
+        const resolved = resolve16(root, rawDir);
         resolveGitDirCache2.set(cwd, resolved);
         return resolved;
       }
@@ -98301,7 +98358,7 @@ function isValidGitSha2(s) {
 }
 async function readGitHead2(gitDir) {
   try {
-    const content = (await readFile15(join47(gitDir, "HEAD"), "utf-8")).trim();
+    const content = (await readFile16(join47(gitDir, "HEAD"), "utf-8")).trim();
     if (content.startsWith("ref:")) {
       const ref = content.slice("ref:".length).trim();
       if (ref.startsWith("refs/heads/")) {
@@ -98338,7 +98395,7 @@ async function resolveRef2(gitDir, ref) {
 }
 async function resolveRefInDir2(dir, ref) {
   try {
-    const content = (await readFile15(join47(dir, ref), "utf-8")).trim();
+    const content = (await readFile16(join47(dir, ref), "utf-8")).trim();
     if (content.startsWith("ref:")) {
       const target = content.slice("ref:".length).trim();
       if (!isSafeRefName2(target)) {
@@ -98352,7 +98409,7 @@ async function resolveRefInDir2(dir, ref) {
     return content;
   } catch {}
   try {
-    const packed = await readFile15(join47(dir, "packed-refs"), "utf-8");
+    const packed = await readFile16(join47(dir, "packed-refs"), "utf-8");
     for (const line of packed.split(`
 `)) {
       if (line.startsWith("#") || line.startsWith("^")) {
@@ -98372,15 +98429,15 @@ async function resolveRefInDir2(dir, ref) {
 }
 async function getCommonDir2(gitDir) {
   try {
-    const content = (await readFile15(join47(gitDir, "commondir"), "utf-8")).trim();
-    return resolve15(gitDir, content);
+    const content = (await readFile16(join47(gitDir, "commondir"), "utf-8")).trim();
+    return resolve16(gitDir, content);
   } catch {
     return null;
   }
 }
 async function readRawSymref2(gitDir, refPath, branchPrefix) {
   try {
-    const content = (await readFile15(join47(gitDir, refPath), "utf-8")).trim();
+    const content = (await readFile16(join47(gitDir, refPath), "utf-8")).trim();
     if (content.startsWith("ref:")) {
       const target = content.slice("ref:".length).trim();
       if (target.startsWith(branchPrefix)) {
@@ -98589,11 +98646,11 @@ async function getHeadForDir(cwd) {
 async function readWorktreeHeadSha2(worktreePath) {
   let gitDir;
   try {
-    const ptr = (await readFile15(join47(worktreePath, ".git"), "utf-8")).trim();
+    const ptr = (await readFile16(join47(worktreePath, ".git"), "utf-8")).trim();
     if (!ptr.startsWith("gitdir:")) {
       return null;
     }
-    gitDir = resolve15(worktreePath, ptr.slice("gitdir:".length).trim());
+    gitDir = resolve16(worktreePath, ptr.slice("gitdir:".length).trim());
   } catch {
     return null;
   }
@@ -99446,7 +99503,7 @@ var init_gitAvailability = __esm(() => {
 
 // src/tui/utils/git.ts
 import { readFileSync as readFileSync14, realpathSync as realpathSync7, statSync as statSync7 } from "fs";
-import { basename as basename9, dirname as dirname25, join as join49, resolve as resolve16, sep as sep7 } from "path";
+import { basename as basename9, dirname as dirname25, join as join49, resolve as resolve17, sep as sep7 } from "path";
 function createFindGitRoot() {
   function wrapper(startPath) {
     const result = findGitRootImpl2(startPath);
@@ -99582,7 +99639,7 @@ var init_git2 = __esm(() => {
     logForDiagnosticsNoPII("info", "find_git_root_started");
     if (typeof startPath !== "string")
       startPath = String(startPath || "/tmp");
-    let current = resolve16(startPath);
+    let current = resolve17(startPath);
     const root = current.substring(0, current.indexOf(sep7) + 1) || sep7;
     let statCount = 0;
     while (current !== root) {
@@ -99632,9 +99689,9 @@ var init_git2 = __esm(() => {
       if (!gitContent.startsWith("gitdir:")) {
         return gitRoot;
       }
-      const worktreeGitDir = resolve16(gitRoot, gitContent.slice("gitdir:".length).trim());
-      const commonDir = resolve16(worktreeGitDir, readFileSync14(join49(worktreeGitDir, "commondir"), "utf-8").trim());
-      if (resolve16(dirname25(worktreeGitDir)) !== join49(commonDir, "worktrees")) {
+      const worktreeGitDir = resolve17(gitRoot, gitContent.slice("gitdir:".length).trim());
+      const commonDir = resolve17(worktreeGitDir, readFileSync14(join49(worktreeGitDir, "commondir"), "utf-8").trim());
+      if (resolve17(dirname25(worktreeGitDir)) !== join49(commonDir, "worktrees")) {
         return gitRoot;
       }
       const backlink = realpathSync7(readFileSync14(join49(worktreeGitDir, "gitdir"), "utf-8").trim());
@@ -99666,7 +99723,7 @@ var init_git2 = __esm(() => {
 });
 
 // src/tui/utils/platform.ts
-import { readdir as readdir8, readFile as readFile16 } from "fs/promises";
+import { readdir as readdir8, readFile as readFile17 } from "fs/promises";
 import { release as osRelease } from "os";
 var SUPPORTED_PLATFORMS2, getPlatform3, getWslVersion, getLinuxDistroInfo;
 var init_platform3 = __esm(() => {
@@ -99728,7 +99785,7 @@ var init_platform3 = __esm(() => {
       linuxKernel: osRelease()
     };
     try {
-      const content = await readFile16("/etc/os-release", "utf8");
+      const content = await readFile17("/etc/os-release", "utf8");
       for (const line of content.split(`
 `)) {
         const match = line.match(/^(ID|VERSION_ID)=(.*)$/);
@@ -100176,7 +100233,7 @@ var init_sessionStoragePortable = __esm(() => {
 
 // src/tui/utils/path.ts
 import { homedir as homedir17 } from "os";
-import { dirname as dirname27, isAbsolute as isAbsolute11, join as join51, normalize as normalize3, relative as relative5, resolve as resolve18 } from "path";
+import { dirname as dirname27, isAbsolute as isAbsolute11, join as join51, normalize as normalize3, relative as relative5, resolve as resolve19 } from "path";
 function expandPath2(path, baseDir) {
   const actualBaseDir = baseDir ?? getCwd() ?? getFsImplementation2().cwd();
   if (typeof path !== "string") {
@@ -100209,7 +100266,7 @@ function expandPath2(path, baseDir) {
   if (isAbsolute11(processedPath)) {
     return normalize3(processedPath).normalize("NFC");
   }
-  return resolve18(actualBaseDir, processedPath).normalize("NFC");
+  return resolve19(actualBaseDir, processedPath).normalize("NFC");
 }
 function toRelativePath2(absolutePath) {
   const relativePath = relative5(getCwd(), absolutePath);
@@ -119178,7 +119235,7 @@ function stripBOM2(content) {
 var UTF8_BOM = "\uFEFF";
 
 // src/tui/utils/json.ts
-import { open as open6, readFile as readFile17, stat as stat15 } from "fs/promises";
+import { open as open6, readFile as readFile18, stat as stat15 } from "fs/promises";
 function parseJSONUncached(json, shouldLogError) {
   try {
     return { ok: true, value: JSON.parse(stripBOM2(json)) };
@@ -119280,7 +119337,7 @@ async function readJSONLFile(filePath) {
   try {
     const { size } = await stat15(filePath);
     if (size <= MAX_JSONL_READ_BYTES) {
-      return parseJSONL2(await readFile17(filePath));
+      return parseJSONL2(await readFile18(filePath));
     }
     const fd = __using(__stack, await open6(filePath, "r"), 1);
     const buf = Buffer.allocUnsafe(MAX_JSONL_READ_BYTES);
@@ -120942,7 +120999,7 @@ __export(exports_teamMemPaths, {
   isTeamMemPath: () => isTeamMemPath,
   isTeamMemoryEnabled: () => isTeamMemoryEnabled
 });
-import { dirname as dirname28, join as join55, resolve as resolve19, sep as sep10 } from "path";
+import { dirname as dirname28, join as join55, resolve as resolve20, sep as sep10 } from "path";
 function isTeamMemoryEnabled() {
   if (!isAutoMemoryEnabled2()) {
     return false;
@@ -120956,7 +121013,7 @@ function getTeamMemEntrypoint() {
   return join55(getAutoMemPath2(), "team", "MEMORY.md");
 }
 function isTeamMemPath(filePath) {
-  const resolvedPath = resolve19(filePath);
+  const resolvedPath = resolve20(filePath);
   const teamDir = getTeamMemPath();
   return resolvedPath.startsWith(teamDir);
 }
@@ -120972,7 +121029,7 @@ var init_teamMemPaths = __esm(() => {
 // src/tui/utils/config.ts
 import { randomBytes as randomBytes5 } from "crypto";
 import { unwatchFile as unwatchFile2, watchFile as watchFile2 } from "fs";
-import { basename as basename10, dirname as dirname29, join as join56, resolve as resolve20 } from "path";
+import { basename as basename10, dirname as dirname29, join as join56, resolve as resolve21 } from "path";
 function createDefaultGlobalConfig() {
   return {
     numStartups: 0,
@@ -121031,7 +121088,7 @@ function computeTrustDialogAccepted() {
     if (pathConfig?.hasTrustDialogAccepted) {
       return true;
     }
-    const parentPath = normalizePathForConfigKey(resolve20(currentPath, ".."));
+    const parentPath = normalizePathForConfigKey(resolve21(currentPath, ".."));
     if (parentPath === currentPath) {
       break;
     }
@@ -121656,7 +121713,7 @@ var init_config6 = __esm(() => {
     if (gitRoot) {
       return normalizePathForConfigKey(gitRoot);
     }
-    return normalizePathForConfigKey(resolve20(originalCwd));
+    return normalizePathForConfigKey(resolve21(originalCwd));
   });
 });
 
@@ -121904,7 +121961,7 @@ import {
   join as join57,
   normalize as normalize5,
   relative as relative6,
-  resolve as resolve21,
+  resolve as resolve22,
   sep as sep11
 } from "path";
 async function pathExists2(path) {
@@ -122064,7 +122121,7 @@ function writeFileSyncAndFlush_DEPRECATED2(filePath, content, options = { encodi
   let targetPath = filePath;
   try {
     const linkTarget = fs.readlinkSync(filePath);
-    targetPath = isAbsolute13(linkTarget) ? linkTarget : resolve21(dirname30(filePath), linkTarget);
+    targetPath = isAbsolute13(linkTarget) ? linkTarget : resolve22(dirname30(filePath), linkTarget);
     logForDebugging3(`Writing through symlink: ${filePath} -> ${targetPath}`);
   } catch {}
   const tempPath = `${targetPath}.tmp.${process.pid}.${Date.now()}`;
@@ -122198,7 +122255,7 @@ var init_file = __esm(() => {
 });
 
 // src/tui/utils/git/gitignore.ts
-import { appendFile as appendFile2, mkdir as mkdir14, readFile as readFile18, writeFile as writeFile10 } from "fs/promises";
+import { appendFile as appendFile2, mkdir as mkdir14, readFile as readFile19, writeFile as writeFile10 } from "fs/promises";
 import { homedir as homedir21 } from "os";
 import { dirname as dirname31, join as join58 } from "path";
 async function isPathGitignored2(filePath, cwd) {
@@ -122225,7 +122282,7 @@ async function addFileGlobRuleToGitignore(filename, cwd = getCwd()) {
     const configGitDir = dirname31(globalGitignorePath);
     await mkdir14(configGitDir, { recursive: true });
     try {
-      const content = await readFile18(globalGitignorePath, { encoding: "utf-8" });
+      const content = await readFile19(globalGitignorePath, { encoding: "utf-8" });
       if (content.includes(gitignoreEntry)) {
         return;
       }
@@ -123454,7 +123511,7 @@ var init_settingsCache2 = __esm(() => {
 });
 
 // src/tui/utils/settings/settings.ts
-import { dirname as dirname32, join as join60, resolve as resolve22 } from "path";
+import { dirname as dirname32, join as join60, resolve as resolve23 } from "path";
 function getManagedSettingsFilePath2() {
   return join60(getManagedFilePath(), "managed-settings.json");
 }
@@ -123542,15 +123599,15 @@ function parseSettingsFileUncached2(path) {
 function getSettingsRootPathForSource2(source) {
   switch (source) {
     case "userSettings":
-      return resolve22(getAtlasConfigHomeDir3());
+      return resolve23(getAtlasConfigHomeDir3());
     case "policySettings":
     case "projectSettings":
     case "localSettings": {
-      return resolve22(getOriginalCwd());
+      return resolve23(getOriginalCwd());
     }
     case "flagSettings": {
       const path = getFlagSettingsPath();
-      return path ? dirname32(resolve22(path)) : resolve22(getOriginalCwd());
+      return path ? dirname32(resolve23(path)) : resolve23(getOriginalCwd());
     }
   }
 }
@@ -123831,7 +123888,7 @@ function loadSettingsFromDisk2() {
       }
       const filePath = getSettingsFilePathForSource2(source);
       if (filePath) {
-        const resolvedPath = resolve22(filePath);
+        const resolvedPath = resolve23(filePath);
         if (!seenFiles.has(resolvedPath)) {
           seenFiles.add(resolvedPath);
           const { settings, errors } = parseSettingsFile2(filePath);
@@ -161992,14 +162049,14 @@ var init_MessageResponse = __esm(() => {
 
 // src/tui/commands/add-dir/validation.ts
 import { stat as stat17 } from "fs/promises";
-import { dirname as dirname36, resolve as resolve24 } from "path";
+import { dirname as dirname36, resolve as resolve25 } from "path";
 async function validateDirectoryForWorkspace(directoryPath, permissionContext) {
   if (!directoryPath) {
     return {
       resultType: "emptyPath"
     };
   }
-  const absolutePath = resolve24(expandPath2(directoryPath));
+  const absolutePath = resolve25(expandPath2(directoryPath));
   try {
     const stats = await stat17(absolutePath);
     if (!stats.isDirectory()) {
@@ -164454,9 +164511,9 @@ var init_pluginOnlyPolicy = __esm(() => {
 
 // src/tui/utils/markdownConfigLoader.ts
 import { statSync as statSync9 } from "fs";
-import { lstat as lstat4, readdir as readdir12, readFile as readFile19, realpath as realpath7, stat as stat22 } from "fs/promises";
+import { lstat as lstat4, readdir as readdir12, readFile as readFile20, realpath as realpath7, stat as stat22 } from "fs/promises";
 import { homedir as homedir23 } from "os";
-import { dirname as dirname40, join as join67, resolve as resolve27, sep as sep14 } from "path";
+import { dirname as dirname40, join as join67, resolve as resolve28, sep as sep14 } from "path";
 function extractDescriptionFromMarkdown2(content, defaultDescription = "Custom item") {
   const lines = content.split(`
 `);
@@ -164538,9 +164595,9 @@ function resolveStopBoundary2(cwd) {
   return cwdGitRoot;
 }
 function getProjectDirsUpToHome2(subdir, cwd) {
-  const home = resolve27(homedir23()).normalize("NFC");
+  const home = resolve28(homedir23()).normalize("NFC");
   const gitRoot = resolveStopBoundary2(cwd);
-  let current = resolve27(cwd);
+  let current = resolve28(cwd);
   const dirs = [];
   while (true) {
     if (normalizePathForComparison2(current) === normalizePathForComparison2(home)) {
@@ -164638,7 +164695,7 @@ async function loadMarkdownFiles2(dir) {
   }
   const results = await Promise.all(files.map(async (filePath) => {
     try {
-      const rawContent = await readFile19(filePath, { encoding: "utf-8" });
+      const rawContent = await readFile20(filePath, { encoding: "utf-8" });
       const { frontmatter, content } = parseFrontmatter2(rawContent, filePath);
       return {
         filePath,
@@ -167727,7 +167784,7 @@ var init_readOnlyCommandValidation2 = __esm(() => {
 
 // src/tui/utils/permissions/pathValidation.ts
 import { homedir as homedir24 } from "os";
-import { dirname as dirname41, isAbsolute as isAbsolute16, resolve as resolve28 } from "path";
+import { dirname as dirname41, isAbsolute as isAbsolute16, resolve as resolve29 } from "path";
 function expandTilde2(path) {
   if (path === "~" || path.startsWith("~/") || process.platform === "win32" && path.startsWith("~\\")) {
     return homedir24() + path.slice(1);
@@ -169029,7 +169086,7 @@ var init_agentColorManager = __esm(() => {
 });
 
 // src/tui/tools/AgentTool/agentMemorySnapshot.ts
-import { mkdir as mkdir16, readdir as readdir14, readFile as readFile20, unlink as unlink7, writeFile as writeFile11 } from "fs/promises";
+import { mkdir as mkdir16, readdir as readdir14, readFile as readFile21, unlink as unlink7, writeFile as writeFile11 } from "fs/promises";
 import { join as join72 } from "path";
 function getSnapshotDirForAgent(agentType) {
   return join72(getCwd(), getConfigDirName2(), SNAPSHOT_BASE, agentType);
@@ -169042,7 +169099,7 @@ function getSyncedJsonPath(agentType, scope) {
 }
 async function readJsonFile(path, schema) {
   try {
-    const content = await readFile20(path, { encoding: "utf-8" });
+    const content = await readFile21(path, { encoding: "utf-8" });
     const result = schema.safeParse(jsonParse2(content));
     return result.success ? result.data : null;
   } catch {
@@ -169058,7 +169115,7 @@ async function copySnapshotToLocal(agentType, scope) {
     for (const dirent of files) {
       if (!dirent.isFile() || dirent.name === SNAPSHOT_JSON)
         continue;
-      const content = await readFile20(join72(snapshotMemDir, dirent.name), {
+      const content = await readFile21(join72(snapshotMemDir, dirent.name), {
         encoding: "utf-8"
       });
       await writeFile11(join72(localMemDir, dirent.name), content);
@@ -177743,7 +177800,7 @@ import {
   copyFile as copyFile2,
   mkdir as mkdir17,
   readdir as readdir15,
-  readFile as readFile21,
+  readFile as readFile22,
   stat as stat24,
   symlink as symlink4,
   utimes as utimes2
@@ -177886,7 +177943,7 @@ async function getOrCreateWorktree2(repoRoot, slug, options) {
 async function copyWorktreeIncludeFiles(repoRoot, worktreePath) {
   let includeContent;
   try {
-    includeContent = await readFile21(join73(repoRoot, ".worktreeinclude"), "utf-8");
+    includeContent = await readFile22(join73(repoRoot, ".worktreeinclude"), "utf-8");
   } catch {
     return [];
   }
@@ -186956,7 +187013,7 @@ var init_validate2 = __esm(() => {
 
 // src/tui/keybindings/loadUserBindings.ts
 import { readFileSync as readFileSync18 } from "fs";
-import { readFile as readFile22, stat as stat26 } from "fs/promises";
+import { readFile as readFile23, stat as stat26 } from "fs/promises";
 import { dirname as dirname43, join as join75 } from "path";
 function isKeybindingCustomizationEnabled() {
   return getFeatureValue_CACHED_MAY_BE_STALE("atlas_keybinding_customization_release", false);
@@ -186989,7 +187046,7 @@ async function loadKeybindings() {
   }
   const userPath = getKeybindingsPath();
   try {
-    const content = await readFile22(userPath, "utf-8");
+    const content = await readFile23(userPath, "utf-8");
     const parsed = jsonParse2(content);
     let userBlocks;
     if (typeof parsed === "object" && parsed !== null && "bindings" in parsed) {
@@ -197541,7 +197598,7 @@ var init_IdeOnboardingDialog = __esm(() => {
 
 // src/tui/utils/ide.ts
 import { createConnection } from "net";
-import { basename as basename19, join as join84, sep as pathSeparator, resolve as resolve29 } from "path";
+import { basename as basename19, join as join84, sep as pathSeparator, resolve as resolve30 } from "path";
 function isProcessRunning3(pid) {
   try {
     process.kill(pid, 0);
@@ -197683,7 +197740,7 @@ async function getIdeLockfilesPaths() {
   if (windowsHome) {
     const converter = new WindowsToWSLConverter(process.env.WSL_DISTRO_NAME);
     const wslPath = converter.toLocalPath(windowsHome);
-    paths.push(resolve29(wslPath, getConfigDirName2(), "ide"));
+    paths.push(resolve30(wslPath, getConfigDirName2(), "ide"));
   }
   try {
     const usersDir = "/mnt/c/Users";
@@ -197825,14 +197882,14 @@ async function detectIDEs(includeInvalid) {
             if (!checkWSLDistroMatch(idePath, process.env.WSL_DISTRO_NAME)) {
               return false;
             }
-            const resolvedOriginal = resolve29(localPath).normalize("NFC");
+            const resolvedOriginal = resolve30(localPath).normalize("NFC");
             if (cwd === resolvedOriginal || cwd.startsWith(resolvedOriginal + pathSeparator)) {
               return true;
             }
             const converter = new WindowsToWSLConverter(process.env.WSL_DISTRO_NAME);
             localPath = converter.toLocalPath(idePath);
           }
-          const resolvedPath = resolve29(localPath).normalize("NFC");
+          const resolvedPath = resolve30(localPath).normalize("NFC");
           if (getPlatform3() === "windows") {
             const normalizedCwd = cwd.replace(/^[a-zA-Z]:/, (match) => match.toUpperCase());
             const normalizedResolvedPath = resolvedPath.replace(/^[a-zA-Z]:/, (match) => match.toUpperCase());
@@ -203461,7 +203518,7 @@ var init_ComputerUseApproval = __esm(() => {
 });
 
 // src/tui/utils/computerUse/computerUseLock.ts
-import { mkdir as mkdir21, readFile as readFile23, unlink as unlink9, writeFile as writeFile14 } from "fs/promises";
+import { mkdir as mkdir21, readFile as readFile24, unlink as unlink9, writeFile as writeFile14 } from "fs/promises";
 import { join as join87 } from "path";
 function isComputerUseLock(value) {
   if (typeof value !== "object" || value === null)
@@ -203473,7 +203530,7 @@ function getLockPath2() {
 }
 async function readLock2() {
   try {
-    const raw = await readFile23(getLockPath2(), "utf8");
+    const raw = await readFile24(getLockPath2(), "utf8");
     const parsed = jsonParse2(raw);
     return isComputerUseLock(parsed) ? parsed : undefined;
   } catch {
@@ -207570,7 +207627,7 @@ function createLinkedTransportPair() {
 }
 
 // src/tui/services/mcp/client.ts
-import { mkdir as mkdir22, readFile as readFile24, unlink as unlink10, writeFile as writeFile15 } from "fs/promises";
+import { mkdir as mkdir22, readFile as readFile25, unlink as unlink10, writeFile as writeFile15 } from "fs/promises";
 import { dirname as dirname45, join as join88 } from "path";
 function isMcpSessionExpiredError(error) {
   const httpStatus = "code" in error ? error.code : undefined;
@@ -207587,7 +207644,7 @@ function getMcpAuthCachePath() {
 }
 function getMcpAuthCache() {
   if (!authCachePromise) {
-    authCachePromise = readFile24(getMcpAuthCachePath(), "utf-8").then((data) => jsonParse2(data)).catch(() => ({}));
+    authCachePromise = readFile25(getMcpAuthCachePath(), "utf-8").then((data) => jsonParse2(data)).catch(() => ({}));
   }
   return authCachePromise;
 }
@@ -209632,13 +209689,13 @@ var init_LSPDiagnosticRegistry = __esm(() => {
 });
 
 // src/tui/utils/plugins/lspPluginIntegration.ts
-import { readFile as readFile25 } from "fs/promises";
-import { join as join89, relative as relative10, resolve as resolve30 } from "path";
+import { readFile as readFile26 } from "fs/promises";
+import { join as join89, relative as relative10, resolve as resolve31 } from "path";
 function validatePathWithinPlugin(pluginPath, relativePath) {
-  const resolvedPluginPath = resolve30(pluginPath);
-  const resolvedFilePath = resolve30(pluginPath, relativePath);
+  const resolvedPluginPath = resolve31(pluginPath);
+  const resolvedFilePath = resolve31(pluginPath, relativePath);
   const rel = relative10(resolvedPluginPath, resolvedFilePath);
-  if (rel.startsWith("..") || resolve30(rel) === rel) {
+  if (rel.startsWith("..") || resolve31(rel) === rel) {
     return null;
   }
   return resolvedFilePath;
@@ -209647,7 +209704,7 @@ async function loadPluginLspServers(plugin, errors = []) {
   const servers = {};
   const lspJsonPath = join89(plugin.path, ".lsp.json");
   try {
-    const content = await readFile25(lspJsonPath, "utf-8");
+    const content = await readFile26(lspJsonPath, "utf-8");
     const parsed = jsonParse2(content);
     const result = record(string2(), LspServerConfigSchema()).safeParse(parsed);
     if (result.success) {
@@ -209704,7 +209761,7 @@ async function loadLspServersFromManifest(declaration, pluginPath, pluginName, e
         continue;
       }
       try {
-        const content = await readFile25(validatedPath, "utf-8");
+        const content = await readFile26(validatedPath, "utf-8");
         const parsed = jsonParse2(content);
         const result = record(string2(), LspServerConfigSchema()).safeParse(parsed);
         if (result.success) {
@@ -214750,7 +214807,7 @@ import {
   copyFile as copyFile3,
   link as link2,
   mkdir as mkdir23,
-  readFile as readFile26,
+  readFile as readFile27,
   stat as stat29,
   unlink as unlink11
 } from "fs/promises";
@@ -215067,8 +215124,8 @@ async function checkOriginFileChanged(originalFile, backupFileName, originalStat
   return compareStatsAndContent(originalStats, backupStats, async () => {
     try {
       const [originalContent, backupContent] = await Promise.all([
-        readFile26(originalFile, "utf-8"),
-        readFile26(backupPath, "utf-8")
+        readFile27(originalFile, "utf-8"),
+        readFile27(backupPath, "utf-8")
       ]);
       return originalContent !== backupContent;
     } catch {
@@ -215329,7 +215386,7 @@ async function notifyVscodeSnapshotFilesUpdated(oldState, newState) {
 }
 async function readFileAsyncOrNull(path) {
   try {
-    return await readFile26(path, "utf-8");
+    return await readFile27(path, "utf-8");
   } catch {
     return null;
   }
@@ -215439,7 +215496,7 @@ var init_detectRepository = __esm(() => {
 });
 
 // src/tui/utils/gitDiff.ts
-import { access, readFile as readFile27 } from "fs/promises";
+import { access, readFile as readFile28 } from "fs/promises";
 import { dirname as dirname47, join as join91, relative as relative12, sep as sep17 } from "path";
 async function fetchGitDiff() {
   const isGit = await getIsGit();
@@ -215690,7 +215747,7 @@ async function generateSyntheticDiff(gitPath, absoluteFilePath) {
     if (!isFileWithinReadSizeLimit2(absoluteFilePath, MAX_DIFF_SIZE_BYTES)) {
       return null;
     }
-    const content = await readFile27(absoluteFilePath, "utf-8");
+    const content = await readFile28(absoluteFilePath, "utf-8");
     const lines = content.split(`
 `);
     if (lines.length > 0 && lines.at(-1) === "") {
@@ -251272,7 +251329,7 @@ var init_readEditContext = __esm(() => {
 });
 
 // src/tui/tools/FileWriteTool/UI.tsx
-import { isAbsolute as isAbsolute20, relative as relative14, resolve as resolve32 } from "path";
+import { isAbsolute as isAbsolute20, relative as relative14, resolve as resolve33 } from "path";
 function countLines(content) {
   const parts = content.split(EOL);
   return content.endsWith(EOL) ? parts.length - 1 : parts.length;
@@ -251596,7 +251653,7 @@ function WriteRejectionBody(t0) {
 }
 async function loadRejectionDiff(filePath, content) {
   try {
-    const fullFilePath = isAbsolute20(filePath) ? filePath : resolve32(getCwd(), filePath);
+    const fullFilePath = isAbsolute20(filePath) ? filePath : resolve33(getCwd(), filePath);
     const handle = await openForScan(fullFilePath);
     if (handle === null)
       return {
@@ -253665,7 +253722,7 @@ var init_teammate2 = __esm(() => {
 });
 
 // src/tui/utils/tasks.ts
-import { mkdir as mkdir24, readdir as readdir16, readFile as readFile28, unlink as unlink12, writeFile as writeFile16 } from "fs/promises";
+import { mkdir as mkdir24, readdir as readdir16, readFile as readFile29, unlink as unlink12, writeFile as writeFile16 } from "fs/promises";
 import { join as join94 } from "path";
 function setLeaderTeamName2(teamName) {
   if (leaderTeamName2 === teamName)
@@ -253690,7 +253747,7 @@ function getHighWaterMarkPath2(taskListId) {
 async function readHighWaterMark2(taskListId) {
   const path = getHighWaterMarkPath2(taskListId);
   try {
-    const content = (await readFile28(path, "utf-8")).trim();
+    const content = (await readFile29(path, "utf-8")).trim();
     const value = parseInt(content, 10);
     return isNaN(value) ? 0 : value;
   } catch {
@@ -253814,7 +253871,7 @@ async function createTask2(taskListId, taskData) {
 async function getTask2(taskListId, taskId) {
   const path = getTaskPath2(taskListId, taskId);
   try {
-    const content = await readFile28(path, "utf-8");
+    const content = await readFile29(path, "utf-8");
     const data = jsonParse2(content);
     const parsed = TaskSchema2().safeParse(data);
     if (!parsed.success) {
@@ -256411,7 +256468,7 @@ Output truncated (${sizeKB}KB total). Full output saved to: ${this.path}`;
 });
 
 // src/tui/utils/sessionEnvironment.ts
-import { mkdir as mkdir25, readdir as readdir17, readFile as readFile29, writeFile as writeFile17 } from "fs/promises";
+import { mkdir as mkdir25, readdir as readdir17, readFile as readFile30, writeFile as writeFile17 } from "fs/promises";
 import { join as join95 } from "path";
 async function getSessionEnvDirPath() {
   const sessionEnvDir = join95(getAtlasConfigHomeDir3(), "session-env", getSessionId());
@@ -256450,7 +256507,7 @@ async function getSessionEnvironmentScript() {
   const envFile = process.env.ATLAS_SESSION_ENV_FILE;
   if (envFile) {
     try {
-      const envScript = (await readFile29(envFile, "utf8")).trim();
+      const envScript = (await readFile30(envFile, "utf8")).trim();
       if (envScript) {
         scripts.push(envScript);
         logForDebugging3(`Session environment loaded from ATLAS_SESSION_ENV_FILE: ${envFile} (${envScript.length} chars)`);
@@ -256469,7 +256526,7 @@ async function getSessionEnvironmentScript() {
     for (const file of hookFiles) {
       const filePath = join95(sessionEnvDir, file);
       try {
-        const content = (await readFile29(filePath, "utf8")).trim();
+        const content = (await readFile30(filePath, "utf8")).trim();
         if (content) {
           scripts.push(content);
         }
@@ -257510,7 +257567,7 @@ var init_powershellProvider = __esm(() => {
 import { execFileSync as execFileSync4, spawn as spawn9 } from "child_process";
 import { constants as fsConstants5, readFileSync as readFileSync19, unlinkSync as unlinkSync3 } from "fs";
 import { mkdir as mkdir27, open as open12, realpath as realpath9 } from "fs/promises";
-import { isAbsolute as isAbsolute25, resolve as resolve33 } from "path";
+import { isAbsolute as isAbsolute25, resolve as resolve34 } from "path";
 import { join as posixJoin3 } from "path/posix";
 import { accessSync as accessSync2 } from "fs";
 function isExecutable2(shellPath) {
@@ -257699,7 +257756,7 @@ async function exec3(command, abortSignal, shellType, options) {
   }
 }
 function setCwd2(path, relativeTo) {
-  const resolved = isAbsolute25(path) ? path : resolve33(relativeTo || getFsImplementation2().cwd(), path);
+  const resolved = isAbsolute25(path) ? path : resolve34(relativeTo || getFsImplementation2().cwd(), path);
   let physicalPath;
   try {
     physicalPath = getFsImplementation2().realpathSync(resolved);
@@ -257754,7 +257811,7 @@ var init_Shell2 = __esm(() => {
 });
 
 // src/tui/tools/BashTool/utils.ts
-import { readFile as readFile30, stat as stat33 } from "fs/promises";
+import { readFile as readFile31, stat as stat33 } from "fs/promises";
 function stripEmptyLines2(content) {
   const lines = content.split(`
 `);
@@ -257806,7 +257863,7 @@ async function resizeShellImageOutput2(stdout, outputFilePath, outputFileSize) {
     const size = outputFileSize ?? (await stat33(outputFilePath)).size;
     if (size > MAX_IMAGE_FILE_SIZE2)
       return null;
-    source = await readFile30(outputFilePath, "utf8");
+    source = await readFile31(outputFilePath, "utf8");
   }
   const parsed = parseDataUri2(source);
   if (!parsed)
@@ -258300,7 +258357,7 @@ var init_UI8 = __esm(() => {
 });
 
 // src/tui/tools/NotebookEditTool/NotebookEditTool.ts
-import { extname as extname13, isAbsolute as isAbsolute26, resolve as resolve34 } from "path";
+import { extname as extname13, isAbsolute as isAbsolute26, resolve as resolve35 } from "path";
 var inputSchema12, outputSchema10, NotebookEditTool2;
 var init_NotebookEditTool = __esm(() => {
   init_shared();
@@ -258414,7 +258471,7 @@ var init_NotebookEditTool = __esm(() => {
     renderToolUseErrorMessage: renderToolUseErrorMessage5,
     renderToolResultMessage: renderToolResultMessage8,
     async validateInput({ notebook_path, cell_type, cell_id, edit_mode = "replace" }, toolUseContext) {
-      const fullPath = isAbsolute26(notebook_path) ? notebook_path : resolve34(getCwd(), notebook_path);
+      const fullPath = isAbsolute26(notebook_path) ? notebook_path : resolve35(getCwd(), notebook_path);
       if (fullPath.startsWith("\\\\") || fullPath.startsWith("//")) {
         return { result: true };
       }
@@ -258513,7 +258570,7 @@ var init_NotebookEditTool = __esm(() => {
       cell_type,
       edit_mode: originalEditMode
     }, { readFileState, updateFileHistoryState }, _, parentMessage) {
-      const fullPath = isAbsolute26(notebook_path) ? notebook_path : resolve34(getCwd(), notebook_path);
+      const fullPath = isAbsolute26(notebook_path) ? notebook_path : resolve35(getCwd(), notebook_path);
       if (fileHistoryEnabled()) {
         await fileHistoryTrackEdit(updateFileHistoryState, fullPath, parentMessage.uuid);
       }
@@ -260430,7 +260487,7 @@ var init_fileStateCache = __esm(() => {
 });
 
 // src/tui/utils/hooks/hooksSettings.ts
-import { resolve as resolve35 } from "path";
+import { resolve as resolve36 } from "path";
 function isHookEqual(a, b) {
   if (a.type !== b.type)
     return false;
@@ -260481,7 +260538,7 @@ function getAllHooks(appState) {
     for (const source of sources) {
       const filePath = getSettingsFilePathForSource2(source);
       if (filePath) {
-        const resolvedPath = resolve35(filePath);
+        const resolvedPath = resolve36(filePath);
         if (seenFiles.has(resolvedPath)) {
           continue;
         }
@@ -264607,7 +264664,7 @@ __export(exports_teammateMailbox, {
   sendShutdownRequestToMailbox: () => sendShutdownRequestToMailbox2,
   writeToMailbox: () => writeToMailbox2
 });
-import { mkdir as mkdir28, readFile as readFile31, writeFile as writeFile18 } from "fs/promises";
+import { mkdir as mkdir28, readFile as readFile32, writeFile as writeFile18 } from "fs/promises";
 import { join as join100 } from "path";
 function getInboxPath2(agentName, teamName) {
   const team = teamName || getTeamName2() || "default";
@@ -264629,7 +264686,7 @@ async function readMailbox2(agentName, teamName) {
   const inboxPath = getInboxPath2(agentName, teamName);
   logForDebugging3(`[TeammateMailbox] readMailbox: path=${inboxPath}`);
   try {
-    const content = await readFile31(inboxPath, "utf-8");
+    const content = await readFile32(inboxPath, "utf-8");
     const messages = jsonParse2(content);
     logForDebugging3(`[TeammateMailbox] readMailbox: read ${messages.length} message(s)`);
     return messages;
@@ -292919,7 +292976,7 @@ var init_listSessionsImpl = __esm(() => {
 });
 
 // src/tui/services/autoDream/consolidationLock.ts
-import { mkdir as mkdir30, readFile as readFile32, stat as stat35, unlink as unlink14, utimes as utimes3, writeFile as writeFile20 } from "fs/promises";
+import { mkdir as mkdir30, readFile as readFile33, stat as stat35, unlink as unlink14, utimes as utimes3, writeFile as writeFile20 } from "fs/promises";
 import { join as join103 } from "path";
 function lockPath() {
   return join103(getAutoMemPath2(), LOCK_FILE);
@@ -292937,7 +292994,7 @@ async function tryAcquireConsolidationLock() {
   let mtimeMs;
   let holderPid;
   try {
-    const [s, raw] = await Promise.all([stat35(path), readFile32(path, "utf8")]);
+    const [s, raw] = await Promise.all([stat35(path), readFile33(path, "utf8")]);
     mtimeMs = s.mtimeMs;
     const parsed = parseInt(raw.trim(), 10);
     holderPid = Number.isFinite(parsed) ? parsed : undefined;
@@ -292952,7 +293009,7 @@ async function tryAcquireConsolidationLock() {
   await writeFile20(path, String(process.pid));
   let verify;
   try {
-    verify = await readFile32(path, "utf8");
+    verify = await readFile33(path, "utf8");
   } catch {
     return null;
   }
@@ -298374,7 +298431,7 @@ __export(exports_voice2, {
   stopRecording: () => stopRecording
 });
 import { spawn as spawn10, spawnSync as spawnSync3 } from "child_process";
-import { readFile as readFile33 } from "fs/promises";
+import { readFile as readFile34 } from "fs/promises";
 function loadAudioNapi() {
   audioNapiPromise ??= (async () => {
     const t0 = Date.now();
@@ -298429,7 +298486,7 @@ function _resetArecordProbeForTesting() {
   arecordProbe = null;
 }
 function linuxHasAlsaCards() {
-  linuxAlsaCardsMemo ??= readFile33("/proc/asound/cards", "utf8").then((cards) => {
+  linuxAlsaCardsMemo ??= readFile34("/proc/asound/cards", "utf8").then((cards) => {
     const c = cards.trim();
     return c !== "" && !c.includes("no soundcards");
   }, () => false);
@@ -308451,7 +308508,7 @@ var init_registry3 = __esm(() => {
 
 // src/tui/utils/swarm/teamHelpers.ts
 import { mkdirSync as mkdirSync7, readFileSync as readFileSync21, writeFileSync as writeFileSync6 } from "fs";
-import { mkdir as mkdir32, readFile as readFile34, rm as rm3, writeFile as writeFile23 } from "fs/promises";
+import { mkdir as mkdir32, readFile as readFile35, rm as rm3, writeFile as writeFile23 } from "fs/promises";
 import { join as join105 } from "path";
 function sanitizeName3(name) {
   return name.replace(/[^a-zA-Z0-9]/g, "-").toLowerCase();
@@ -308475,7 +308532,7 @@ function readTeamFile2(teamName) {
 }
 async function readTeamFileAsync2(teamName) {
   try {
-    const content = await readFile34(getTeamFilePath2(teamName), "utf-8");
+    const content = await readFile35(getTeamFilePath2(teamName), "utf-8");
     return jsonParse2(content);
   } catch (e) {
     if (getErrnoCode2(e) === "ENOENT")
@@ -308625,7 +308682,7 @@ async function destroyWorktree2(worktreePath) {
   const gitFilePath = join105(worktreePath, ".git");
   let mainRepoPath = null;
   try {
-    const gitFileContent = (await readFile34(gitFilePath, "utf-8")).trim();
+    const gitFileContent = (await readFile35(gitFilePath, "utf-8")).trim();
     const match = gitFileContent.match(/^gitdir:\s*(.+)$/);
     if (match && match[1]) {
       const worktreeGitDir = match[1];
@@ -310871,7 +310928,7 @@ var exports_SpecParser = {};
 __export(exports_SpecParser, {
   SpecParser: () => SpecParser2
 });
-import { readFile as readFile35 } from "fs/promises";
+import { readFile as readFile36 } from "fs/promises";
 var inputSchema42, outputSchema34, SpecParser2;
 var init_SpecParser = __esm(() => {
   init_v4();
@@ -310914,7 +310971,7 @@ var init_SpecParser = __esm(() => {
       let raw = inp.spec_source;
       let parsedFromFile = false;
       try {
-        const fileContent = await readFile35(inp.spec_source, "utf-8");
+        const fileContent = await readFile36(inp.spec_source, "utf-8");
         raw = fileContent;
         parsedFromFile = true;
       } catch {}
@@ -314057,7 +314114,7 @@ var init_parser7 = __esm(() => {
 });
 
 // src/tui/tools/PowerShellTool/gitSafety.ts
-import { basename as basename29, posix as posix7, resolve as resolve36, sep as sep23 } from "path";
+import { basename as basename29, posix as posix7, resolve as resolve37, sep as sep23 } from "path";
 function resolveCwdReentry(normalized) {
   if (!normalized.startsWith("../"))
     return normalized;
@@ -314105,7 +314162,7 @@ function normalizeGitPathArg(arg) {
 }
 function resolveEscapingPathToCwdRelative(n) {
   const cwd = getCwd();
-  const abs = resolve36(cwd, n);
+  const abs = resolve37(cwd, n);
   const cwdWithSep = cwd.endsWith(sep23) ? cwd : cwd + sep23;
   const absLower = abs.toLowerCase();
   const cwdLower = cwd.toLowerCase();
@@ -315345,7 +315402,7 @@ var init_modeValidation3 = __esm(() => {
 
 // src/tui/tools/PowerShellTool/pathValidation.ts
 import { homedir as homedir29 } from "os";
-import { isAbsolute as isAbsolute27, resolve as resolve37 } from "path";
+import { isAbsolute as isAbsolute27, resolve as resolve38 } from "path";
 function matchesParam(paramLower, paramList) {
   for (const p of paramList) {
     if (p === paramLower || paramLower.length > 1 && p.startsWith(paramLower)) {
@@ -315453,7 +315510,7 @@ function checkDenyRuleForGuessedPath(strippedPath, cwd, toolPermissionContext, o
   if (!strippedPath || strippedPath.includes("\x00"))
     return null;
   const tildeExpanded = expandTilde3(strippedPath);
-  const abs = isAbsolute27(tildeExpanded) ? tildeExpanded : resolve37(cwd, tildeExpanded);
+  const abs = isAbsolute27(tildeExpanded) ? tildeExpanded : resolve38(cwd, tildeExpanded);
   const { resolvedPath } = safeResolvePath3(getFsImplementation2(), abs);
   const permissionType = operationType === "read" ? "read" : "edit";
   const denyRule = matchingRuleForInput2(resolvedPath, toolPermissionContext, permissionType, "deny");
@@ -315543,7 +315600,7 @@ function validatePath3(filePath, cwd, toolPermissionContext, operationType) {
       };
     }
     if (containsPathTraversal2(normalizedPath)) {
-      const absolutePath = isAbsolute27(normalizedPath) ? normalizedPath : resolve37(cwd, normalizedPath);
+      const absolutePath = isAbsolute27(normalizedPath) ? normalizedPath : resolve38(cwd, normalizedPath);
       const { resolvedPath, isCanonical } = safeResolvePath3(getFsImplementation2(), absolutePath);
       const result = isPathAllowed2(resolvedPath, toolPermissionContext, operationType, isCanonical ? [resolvedPath] : undefined);
       return {
@@ -315553,7 +315610,7 @@ function validatePath3(filePath, cwd, toolPermissionContext, operationType) {
       };
     }
     const basePath = getGlobBaseDirectory2(normalizedPath);
-    const absoluteBasePath = isAbsolute27(basePath) ? basePath : resolve37(cwd, basePath);
+    const absoluteBasePath = isAbsolute27(basePath) ? basePath : resolve38(cwd, basePath);
     const { resolvedPath } = safeResolvePath3(getFsImplementation2(), absoluteBasePath);
     const permissionType = operationType === "read" ? "read" : "edit";
     const denyRule = matchingRuleForInput2(resolvedPath, toolPermissionContext, permissionType, "deny");
@@ -315573,7 +315630,7 @@ function validatePath3(filePath, cwd, toolPermissionContext, operationType) {
       }
     };
   }
-  const absolutePath = isAbsolute27(normalizedPath) ? normalizedPath : resolve37(cwd, normalizedPath);
+  const absolutePath = isAbsolute27(normalizedPath) ? normalizedPath : resolve38(cwd, normalizedPath);
   const { resolvedPath, isCanonical } = safeResolvePath3(getFsImplementation2(), absolutePath);
   const result = isPathAllowed2(resolvedPath, toolPermissionContext, operationType, isCanonical ? [resolvedPath] : undefined);
   return {
@@ -317487,7 +317544,7 @@ var init_powershellSecurity = __esm(() => {
 });
 
 // src/tui/tools/PowerShellTool/powershellPermissions.ts
-import { resolve as resolve38 } from "path";
+import { resolve as resolve39 } from "path";
 async function extractCommandName(command) {
   const trimmed = command.trim();
   if (!trimmed) {
@@ -318100,7 +318157,7 @@ async function powershellToolHasPermission(input, context) {
     const canonical = resolveToCanonical(element.name);
     if (canonical === "set-location" && element.args.length > 0) {
       const target = element.args.find((a) => a.length === 0 || !PS_TOKENIZER_DASH_CHARS.has(a[0]));
-      if (target && resolve38(getCwd(), target) === getCwd()) {
+      if (target && resolve39(getCwd(), target) === getCwd()) {
         return false;
       }
     }
@@ -324633,7 +324690,7 @@ var init_toolSearch = __esm(() => {
 
 // src/tui/services/vcr.ts
 import { createHash as createHash8, randomUUID as randomUUID33 } from "crypto";
-import { mkdir as mkdir34, readFile as readFile36, writeFile as writeFile24 } from "fs/promises";
+import { mkdir as mkdir34, readFile as readFile37, writeFile as writeFile24 } from "fs/promises";
 import { dirname as dirname57, join as join109 } from "path";
 function shouldUseVCR() {
   if (false) {}
@@ -324649,7 +324706,7 @@ async function withFixture(input, fixtureName, f) {
   const hash = createHash8("sha1").update(jsonStringify5(input)).digest("hex").slice(0, 12);
   const filename = join109(process.env.ATLAS_TEST_FIXTURES_ROOT ?? getCwd(), `fixtures/${fixtureName}-${hash}.json`);
   try {
-    const cached = jsonParse2(await readFile36(filename, { encoding: "utf8" }));
+    const cached = jsonParse2(await readFile37(filename, { encoding: "utf8" }));
     return cached;
   } catch (e) {
     const code = getErrnoCode2(e);
@@ -324871,7 +324928,7 @@ var init_tokenEstimation = __esm(() => {
 
 // src/tui/utils/pdf.ts
 import { randomUUID as randomUUID34 } from "crypto";
-import { mkdir as mkdir35, readdir as readdir19, readFile as readFile37 } from "fs/promises";
+import { mkdir as mkdir35, readdir as readdir19, readFile as readFile38 } from "fs/promises";
 import { join as join110 } from "path";
 async function readPDF2(filePath) {
   try {
@@ -324893,7 +324950,7 @@ async function readPDF2(filePath) {
         }
       };
     }
-    const fileBuffer = await readFile37(filePath);
+    const fileBuffer = await readFile38(filePath);
     const header = fileBuffer.subarray(0, 5).toString("ascii");
     if (!header.startsWith("%PDF-")) {
       return {
@@ -325068,7 +325125,7 @@ var init_pdf2 = __esm(() => {
 
 // src/tui/utils/readFileInRange.ts
 import { createReadStream as createReadStream3, fstat as fstat2 } from "fs";
-import { stat as fsStat3, readFile as readFile38 } from "fs/promises";
+import { stat as fsStat3, readFile as readFile39 } from "fs/promises";
 async function readFileInRange2(filePath, offset = 0, maxLines, maxBytes, signal, options) {
   signal?.throwIfAborted();
   const truncateOnByteLimit = options?.truncateOnByteLimit ?? false;
@@ -325080,7 +325137,7 @@ async function readFileInRange2(filePath, offset = 0, maxLines, maxBytes, signal
     if (!truncateOnByteLimit && maxBytes !== undefined && stats.size > maxBytes) {
       throw new FileTooLargeError2(stats.size, maxBytes);
     }
-    const text = await readFile38(filePath, { encoding: "utf8", signal });
+    const text = await readFile39(filePath, { encoding: "utf8", signal });
     return readFileInRangeFast2(text, stats.mtimeMs, offset, maxLines, truncateOnByteLimit ? maxBytes : undefined);
   }
   return readFileInRangeStreaming2(filePath, offset, maxLines, maxBytes, truncateOnByteLimit, signal);
@@ -326494,7 +326551,7 @@ var init_findRelevantMemories = __esm(() => {
 
 // src/tui/utils/attachments.ts
 import { readdir as readdir21, stat as stat37 } from "fs/promises";
-import { dirname as dirname58, parse as parse12, relative as relative21, resolve as resolve39 } from "path";
+import { dirname as dirname58, parse as parse12, relative as relative21, resolve as resolve40 } from "path";
 import { randomUUID as randomUUID35 } from "crypto";
 async function getAttachments(input, toolUseContext, ideSelection, queuedCommands, messages, querySource, options) {
   if (isEnvTruthy2(process.env.ATLAS_DISABLE_ATTACHMENTS) || isEnvTruthy2(process.env.ATLAS_SIMPLE)) {
@@ -326915,7 +326972,7 @@ async function getSelectedLinesFromIDE(ideSelection, toolUseContext) {
   ];
 }
 function getDirectoriesToProcess(targetPath, originalCwd) {
-  const targetDir = dirname58(resolve39(targetPath));
+  const targetDir = dirname58(resolve40(targetPath));
   const nestedDirs = [];
   let currentDir = targetDir;
   while (currentDir !== originalCwd && currentDir !== parse12(currentDir).root) {
@@ -327214,7 +327271,7 @@ async function getDynamicSkillAttachments(toolUseContext) {
         const candidates = entries.filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => e.name);
         const checked = await Promise.all(candidates.map(async (name) => {
           try {
-            await stat37(resolve39(skillDir, name, "SKILL.md"));
+            await stat37(resolve40(skillDir, name, "SKILL.md"));
             return name;
           } catch {
             return null;
@@ -328628,7 +328685,7 @@ import {
   chmod as chmod4,
   lstat as lstat5,
   readdir as readdir22,
-  readFile as readFile39,
+  readFile as readFile40,
   rename as rename3,
   rm as rm5,
   stat as stat38,
@@ -328731,7 +328788,7 @@ async function collectFilesForZip(baseDir, relativePath, files, visited) {
       await collectFilesForZip(baseDir, relPath, files, visited);
     } else if (fileStat.isFile()) {
       try {
-        const content = await readFile39(fullPath);
+        const content = await readFile40(fullPath);
         files[relPath] = [
           new Uint8Array(content),
           { os: 3, attrs: (fileStat.mode & 65535) << 16 }
@@ -329265,11 +329322,11 @@ var init_marketplaceHelpers = __esm(() => {
 });
 
 // src/tui/utils/plugins/officialMarketplaceGcs.ts
-import { chmod as chmod5, mkdir as mkdir36, readFile as readFile40, rename as rename4, rm as rm7, writeFile as writeFile27 } from "fs/promises";
-import { dirname as dirname61, join as join116, resolve as resolve40, sep as sep24 } from "path";
+import { chmod as chmod5, mkdir as mkdir36, readFile as readFile41, rename as rename4, rm as rm7, writeFile as writeFile27 } from "fs/promises";
+import { dirname as dirname61, join as join116, resolve as resolve41, sep as sep24 } from "path";
 async function fetchOfficialMarketplaceFromGcs(installLocation, marketplacesCacheDir) {
-  const cacheDir = resolve40(marketplacesCacheDir);
-  const resolvedLoc = resolve40(installLocation);
+  const cacheDir = resolve41(marketplacesCacheDir);
+  const resolvedLoc = resolve41(installLocation);
   if (resolvedLoc !== cacheDir && !resolvedLoc.startsWith(cacheDir + sep24)) {
     logForDebugging3(`fetchOfficialMarketplaceFromGcs: refusing path outside cache dir: ${installLocation}`, { level: "error" });
     return null;
@@ -329290,7 +329347,7 @@ async function fetchOfficialMarketplaceFromGcs(installLocation, marketplacesCach
       throw new Error("latest pointer returned empty body");
     }
     const sentinelPath = join116(installLocation, ".gcs-sha");
-    const currentSha = await readFile40(sentinelPath, "utf8").then((s) => s.trim(), () => null);
+    const currentSha = await readFile41(sentinelPath, "utf8").then((s) => s.trim(), () => null);
     if (currentSha === sha) {
       outcome = "noop";
       return sha;
@@ -329403,7 +329460,7 @@ var init_ascendMarketplace = __esm(() => {
 });
 
 // src/tui/utils/plugins/orphanScanner.ts
-import { join as join117, resolve as resolve41, sep as sep25 } from "path";
+import { join as join117, resolve as resolve42, sep as sep25 } from "path";
 function normalizeRepoRef(ref) {
   let u = ref.trim();
   const ssh = u.match(/^git@([^:]+):(.+)$/);
@@ -329447,7 +329504,7 @@ async function readOrphanManifestName(dirPath) {
 }
 async function scanOrphanedMarketplaces() {
   const fs = getFsImplementation2();
-  const cacheDir = resolve41(getMarketplacesCacheDir());
+  const cacheDir = resolve42(getMarketplacesCacheDir());
   let entries;
   try {
     entries = await fs.readdir(cacheDir);
@@ -329455,8 +329512,8 @@ async function scanOrphanedMarketplaces() {
     return [];
   }
   const config = await loadKnownMarketplacesConfigSafe();
-  const registered = new Set(Object.values(config).map((e) => resolve41(e.installLocation)));
-  const seedDirs = getPluginSeedDirs().map((d) => resolve41(d));
+  const registered = new Set(Object.values(config).map((e) => resolve42(e.installLocation)));
+  const seedDirs = getPluginSeedDirs().map((d) => resolve42(d));
   const orphans = [];
   for (const entry of entries) {
     if (!entry.isDirectory())
@@ -329494,7 +329551,7 @@ var init_orphanScanner = __esm(() => {
 
 // src/tui/utils/plugins/marketplaceManager.ts
 import { writeFile as writeFile28 } from "fs/promises";
-import { basename as basename35, dirname as dirname62, isAbsolute as isAbsolute31, join as join118, resolve as resolve42, sep as sep26 } from "path";
+import { basename as basename35, dirname as dirname62, isAbsolute as isAbsolute31, join as join118, resolve as resolve43, sep as sep26 } from "path";
 function getKnownMarketplacesFile() {
   return join118(getPluginsDirectory(), "known_marketplaces.json");
 }
@@ -330280,14 +330337,14 @@ async function loadAndCacheMarketplace(source, onProgress) {
         break;
       }
       case "file": {
-        const absPath = resolve42(source.path);
+        const absPath = resolve43(source.path);
         marketplacePath = absPath;
         temporaryCachePath = dirname62(dirname62(absPath));
         cleanupNeeded = false;
         break;
       }
       case "directory": {
-        const absPath = resolve42(source.path);
+        const absPath = resolve43(source.path);
         marketplacePath = findManifestInDir(absPath, "marketplace.json");
         temporaryCachePath = absPath;
         cleanupNeeded = false;
@@ -330319,8 +330376,8 @@ async function loadAndCacheMarketplace(source, onProgress) {
       throw new Error(`Failed to parse marketplace file at ${marketplacePath}: ${errorMessage2(e)}`);
     }
     const finalCachePath = join118(cacheDir, marketplace.name);
-    const resolvedFinal = resolve42(finalCachePath);
-    const resolvedCacheDir = resolve42(cacheDir);
+    const resolvedFinal = resolve43(finalCachePath);
+    const resolvedCacheDir = resolve43(cacheDir);
     if (!resolvedFinal.startsWith(resolvedCacheDir + sep26)) {
       throw new Error(`Marketplace name '${marketplace.name}' resolves to a path outside the cache directory`);
     }
@@ -330369,7 +330426,7 @@ async function captureResolvedSha(source, cachePath) {
 async function addMarketplaceSource(source, onProgress) {
   let resolvedSource = source;
   if (isLocalMarketplaceSource(source) && !isAbsolute31(source.path)) {
-    resolvedSource = { ...source, path: resolve42(source.path) };
+    resolvedSource = { ...source, path: resolve43(source.path) };
   }
   if (!isSourceAllowedByPolicy(resolvedSource)) {
     if (isSourceInBlocklist(resolvedSource)) {
@@ -330418,9 +330475,9 @@ Tip: The shorthand "${resolvedSource.repo}" assumes github.com. ` + `For interna
       }
       logForDebugging3(`Marketplace '${marketplace.name}' exists with different source — overwriting`);
       if (!isLocalMarketplaceSource(oldEntry.source)) {
-        const cacheDir = resolve42(getMarketplacesCacheDir());
-        const resolvedOld = resolve42(oldEntry.installLocation);
-        const resolvedNew = resolve42(cachePath);
+        const cacheDir = resolve43(getMarketplacesCacheDir());
+        const resolvedOld = resolve43(oldEntry.installLocation);
+        const resolvedNew = resolve43(cachePath);
         if (resolvedOld === resolvedNew) {} else if (resolvedOld === cacheDir || resolvedOld.startsWith(cacheDir + sep26)) {
           const fs = getFsImplementation2();
           await fs.rm(oldEntry.installLocation, { recursive: true, force: true });
@@ -330442,7 +330499,7 @@ Tip: The shorthand "${resolvedSource.repo}" assumes github.com. ` + `For interna
 }
 async function adoptOrphanMarketplace(dirName, overrideName) {
   const fs = getFsImplementation2();
-  const cacheDir = resolve42(getMarketplacesCacheDir());
+  const cacheDir = resolve43(getMarketplacesCacheDir());
   const dirPath = join118(cacheDir, dirName);
   if (!fs.existsSync(dirPath) || !fs.statSync(dirPath).isDirectory()) {
     throw new Error(`No marketplace directory named '${dirName}' in ${cacheDir}. ` + `Run \`plugin marketplace list\` to see unregistered directories.`);
@@ -330472,7 +330529,7 @@ async function adoptOrphanMarketplace(dirName, overrideName) {
   await updateKnownMarketplacesConfig((existing) => {
     const prior = existing[name];
     if (prior) {
-      if (resolve42(prior.installLocation) === resolve42(dirPath)) {
+      if (resolve43(prior.installLocation) === resolve43(dirPath)) {
         return;
       }
       throw new Error(`Marketplace name '${name}' is already registered at ` + `${prior.installLocation}. Remove it first ` + `(\`plugin marketplace remove ${name}\`) or adopt under a different name.`);
@@ -330703,8 +330760,8 @@ async function refreshMarketplace(name, onProgress, options) {
       throw new Error(`Marketplace '${name}' is seed-managed (${seedDir}) and its content is ` + `controlled by the seed image. To update: ask your admin to update the seed.`);
     }
     if (!isLocalMarketplaceSource(source)) {
-      const cacheDir = resolve42(getMarketplacesCacheDir());
-      const resolvedLoc = resolve42(installLocation);
+      const cacheDir = resolve43(getMarketplacesCacheDir());
+      const resolvedLoc = resolve43(installLocation);
       if (resolvedLoc !== cacheDir && !resolvedLoc.startsWith(cacheDir + sep26)) {
         throw new Error(`Marketplace '${name}' has a corrupted installLocation ` + `(${installLocation}) — expected a path inside ${cacheDir}. ` + `This can happen after cross-platform path writes or manual edits ` + `to known_marketplaces.json. ` + `Run: claude plugin marketplace remove "${name}" and re-add it.`);
       }
@@ -331454,7 +331511,7 @@ var init_mtimeAwareMemoize = () => {};
 
 // src/tui/utils/plugins/installCounts.ts
 import { randomBytes as randomBytes15 } from "crypto";
-import { readFile as readFile41, rename as rename5, unlink as unlink16, writeFile as writeFile29 } from "fs/promises";
+import { readFile as readFile42, rename as rename5, unlink as unlink16, writeFile as writeFile29 } from "fs/promises";
 import { join as join120 } from "path";
 function normalizeStatsBase(raw) {
   if (!raw)
@@ -331495,7 +331552,7 @@ function getInstallCountsCachePath() {
 async function loadInstallCountsCache() {
   const cachePath = getInstallCountsCachePath();
   try {
-    const content = await readFile41(cachePath, { encoding: "utf-8" });
+    const content = await readFile42(cachePath, { encoding: "utf-8" });
     const parsed = jsonParse2(content);
     if (typeof parsed !== "object" || parsed === null || !("version" in parsed) || !("entries" in parsed)) {
       logForDebugging3("Install counts cache has invalid structure");
@@ -331708,14 +331765,14 @@ var init_pluginVersioning = __esm(() => {
 // src/tui/utils/plugins/pluginInstallationHelpers.ts
 import { randomBytes as randomBytes16 } from "crypto";
 import { rename as rename6, rm as rm8 } from "fs/promises";
-import { dirname as dirname64, join as join121, resolve as resolve43, sep as sep27 } from "path";
+import { dirname as dirname64, join as join121, resolve as resolve44, sep as sep27 } from "path";
 function getCurrentTimestamp() {
   return new Date().toISOString();
 }
 function validatePathWithinBase(basePath, relativePath) {
-  const resolvedPath = resolve43(basePath, relativePath);
-  const normalizedBase = resolve43(basePath) + sep27;
-  if (!resolvedPath.startsWith(normalizedBase) && resolvedPath !== resolve43(basePath)) {
+  const resolvedPath = resolve44(basePath, relativePath);
+  const normalizedBase = resolve44(basePath) + sep27;
+  if (!resolvedPath.startsWith(normalizedBase) && resolvedPath !== resolve44(basePath)) {
     throw new Error(`Path traversal detected: "${relativePath}" would escape the base directory`);
   }
   return resolvedPath;
@@ -331947,7 +332004,7 @@ var init_pluginInstallationHelpers = __esm(() => {
 import {
   copyFile as copyFile6,
   readdir as readdir24,
-  readFile as readFile42,
+  readFile as readFile43,
   readlink,
   realpath as realpath11,
   rename as rename7,
@@ -331956,7 +332013,7 @@ import {
   stat as stat40,
   symlink as symlink5
 } from "fs/promises";
-import { basename as basename36, dirname as dirname65, join as join122, relative as relative22, resolve as resolve44, sep as sep28 } from "path";
+import { basename as basename36, dirname as dirname65, join as join122, relative as relative22, resolve as resolve45, sep as sep28 } from "path";
 function getPluginCachePath() {
   return join122(getPluginsDirectory(), "cache");
 }
@@ -332347,7 +332404,7 @@ async function cachePlugin(source, options) {
   let manifest;
   if (await pathExists2(manifestPath)) {
     try {
-      const content = await readFile42(manifestPath, { encoding: "utf-8" });
+      const content = await readFile43(manifestPath, { encoding: "utf-8" });
       const parsed = jsonParse2(content);
       const result = PluginManifestSchema().safeParse(parsed);
       if (result.success) {
@@ -332371,7 +332428,7 @@ async function cachePlugin(source, options) {
     }
   } else if (await pathExists2(legacyManifestPath)) {
     try {
-      const content = await readFile42(legacyManifestPath, {
+      const content = await readFile43(legacyManifestPath, {
         encoding: "utf-8"
       });
       const parsed = jsonParse2(content);
@@ -332421,7 +332478,7 @@ async function loadPluginManifest(manifestPath, pluginName, source) {
     };
   }
   try {
-    const content = await readFile42(manifestPath, { encoding: "utf-8" });
+    const content = await readFile43(manifestPath, { encoding: "utf-8" });
     const parsedJson = jsonParse2(content);
     const result = PluginManifestSchema().safeParse(parsedJson);
     if (result.success) {
@@ -332447,7 +332504,7 @@ async function loadPluginHooks2(hooksConfigPath, pluginName) {
   if (!await pathExists2(hooksConfigPath)) {
     throw new Error(`Hooks file not found at ${hooksConfigPath} for plugin ${pluginName}. If the manifest declares hooks, the file must exist.`);
   }
-  const content = await readFile42(hooksConfigPath, { encoding: "utf-8" });
+  const content = await readFile43(hooksConfigPath, { encoding: "utf-8" });
   const rawHooksConfig = jsonParse2(content);
   const validatedPluginHooks = PluginHooksSchema().parse(rawHooksConfig);
   return validatedPluginHooks.hooks;
@@ -332750,7 +332807,7 @@ function parsePluginSettings(raw) {
 async function loadPluginSettings(pluginPath, manifest) {
   const settingsJsonPath = join122(pluginPath, "settings.json");
   try {
-    const content = await readFile42(settingsJsonPath, { encoding: "utf-8" });
+    const content = await readFile43(settingsJsonPath, { encoding: "utf-8" });
     const parsed = jsonParse2(content);
     if (isRecord(parsed)) {
       const filtered = parsePluginSettings(parsed);
@@ -333310,7 +333367,7 @@ async function loadSessionOnlyPlugins(sessionPluginPaths) {
   const errors = [];
   for (const [index, pluginPath] of sessionPluginPaths.entries()) {
     try {
-      const resolvedPath = resolve44(pluginPath);
+      const resolvedPath = resolve45(pluginPath);
       if (!await pathExists2(resolvedPath)) {
         logForDebugging3(`Plugin path does not exist: ${resolvedPath}, skipping`, { level: "warn" });
         errors.push({
@@ -337863,6 +337920,57 @@ Latest blocked action: ${classifierReason}`
     }
   };
 }
+async function checkRuleBasedPermissions(tool, input, context) {
+  const appState = context.getAppState();
+  const denyRule = getDenyRuleForTool2(appState.toolPermissionContext, tool);
+  if (denyRule) {
+    return {
+      behavior: "deny",
+      decisionReason: {
+        type: "rule",
+        rule: denyRule
+      },
+      message: `Permission to use ${tool.name} has been denied.`
+    };
+  }
+  const askRule = getAskRuleForTool2(appState.toolPermissionContext, tool);
+  if (askRule) {
+    const canSandboxAutoAllow = tool.name === BASH_TOOL_NAME2 && getSandboxManager().isSandboxingEnabled() && getSandboxManager().isAutoAllowBashIfSandboxedEnabled() && shouldUseSandbox2(input);
+    if (!canSandboxAutoAllow) {
+      return {
+        behavior: "ask",
+        decisionReason: {
+          type: "rule",
+          rule: askRule
+        },
+        message: createPermissionRequestMessage4(tool.name)
+      };
+    }
+  }
+  let toolPermissionResult = {
+    behavior: "passthrough",
+    message: createPermissionRequestMessage4(tool.name)
+  };
+  try {
+    const parsedInput = tool.inputSchema.parse(input);
+    toolPermissionResult = await tool.checkPermissions(parsedInput, context);
+  } catch (e) {
+    if (e instanceof AbortError2 || e instanceof APIUserAbortError3) {
+      throw e;
+    }
+    logError3(e);
+  }
+  if (toolPermissionResult?.behavior === "deny") {
+    return toolPermissionResult;
+  }
+  if (toolPermissionResult?.behavior === "ask" && toolPermissionResult.decisionReason?.type === "rule" && toolPermissionResult.decisionReason.rule.ruleBehavior === "ask") {
+    return toolPermissionResult;
+  }
+  if (toolPermissionResult?.behavior === "ask" && toolPermissionResult.decisionReason?.type === "safetyCheck") {
+    return toolPermissionResult;
+  }
+  return null;
+}
 async function hasPermissionsToUseToolInner(tool, input, context) {
   if (context.abortController.signal.aborted) {
     throw new AbortError2;
@@ -338313,7 +338421,7 @@ __export(exports_permissionSetup, {
   verifyAutoModeGateAccess: () => verifyAutoModeGateAccess
 });
 import { relative as relative23 } from "path";
-import { resolve as resolve45 } from "path";
+import { resolve as resolve46 } from "path";
 function isDangerousBashPermission(toolName, ruleContent) {
   if (toolName !== BASH_TOOL_NAME2) {
     return false;
@@ -338585,7 +338693,7 @@ function isSymlinkTo2({
   originalCwd
 }) {
   const { resolvedPath: resolvedProcessPwd, isSymlink: isProcessPwdSymlink } = safeResolvePath3(getFsImplementation2(), processPwd);
-  return isProcessPwdSymlink ? resolvedProcessPwd === resolve45(originalCwd) : false;
+  return isProcessPwdSymlink ? resolvedProcessPwd === resolve46(originalCwd) : false;
 }
 function initialPermissionModeFromCLI2({
   permissionModeCli,
@@ -339644,7 +339752,7 @@ __export(exports_terminalSetup, {
   shouldOfferTerminalSetup: () => shouldOfferTerminalSetup
 });
 import { randomBytes as randomBytes18 } from "crypto";
-import { copyFile as copyFile7, mkdir as mkdir37, readFile as readFile43, writeFile as writeFile30 } from "fs/promises";
+import { copyFile as copyFile7, mkdir as mkdir37, readFile as readFile44, writeFile as writeFile30 } from "fs/promises";
 import { homedir as homedir31, platform as platform3 } from "os";
 import { dirname as dirname66, join as join124 } from "path";
 import { pathToFileURL as pathToFileURL8 } from "url";
@@ -339790,7 +339898,7 @@ async function installBindingsForVSCodeTerminal(editor = "VSCode", theme) {
     let keybindings = [];
     let fileExists = false;
     try {
-      content = await readFile43(keybindingsPath, {
+      content = await readFile44(keybindingsPath, {
         encoding: "utf-8"
       });
       fileExists = true;
@@ -339937,7 +340045,7 @@ chars = "\\u001B\\r"`;
   let configExists = false;
   for (const path of configPaths) {
     try {
-      configContent = await readFile43(path, {
+      configContent = await readFile44(path, {
         encoding: "utf-8"
       });
       configPath = path;
@@ -339999,7 +340107,7 @@ async function installBindingsForZed(theme) {
     let keymapContent = "[]";
     let fileExists = false;
     try {
-      keymapContent = await readFile43(keymapPath, {
+      keymapContent = await readFile44(keymapPath, {
         encoding: "utf-8"
       });
       fileExists = true;
@@ -340071,7 +340179,7 @@ var init_terminalSetup = __esm(() => {
 
 // src/tui/utils/pasteStore.ts
 import { createHash as createHash10 } from "crypto";
-import { mkdir as mkdir38, readdir as readdir25, readFile as readFile44, stat as stat42, unlink as unlink17, writeFile as writeFile31 } from "fs/promises";
+import { mkdir as mkdir38, readdir as readdir25, readFile as readFile45, stat as stat42, unlink as unlink17, writeFile as writeFile31 } from "fs/promises";
 import { join as join125 } from "path";
 function getPasteStoreDir() {
   return join125(getAtlasConfigHomeDir3(), PASTE_STORE_DIR);
@@ -340096,7 +340204,7 @@ async function storePastedText(hash, content) {
 async function retrievePastedText(hash) {
   try {
     const pastePath = getPastePath(hash);
-    return await readFile44(pastePath, { encoding: "utf8" });
+    return await readFile45(pastePath, { encoding: "utf8" });
   } catch (error) {
     if (!isENOENT2(error)) {
       logForDebugging3(`Failed to retrieve paste ${hash}: ${error}`);
@@ -344165,7 +344273,7 @@ var init_btw2 = __esm(() => {
 });
 
 // src/tui/components/Feedback.tsx
-import { readFile as readFile45, stat as stat43 } from "fs/promises";
+import { readFile as readFile46, stat as stat43 } from "fs/promises";
 function redactSensitiveInfo(text) {
   let redacted = text;
   redacted = redacted.replace(/"(sk-ant[^\s"']{24,})"/g, '"[REDACTED_API_KEY]"');
@@ -344204,7 +344312,7 @@ async function loadRawTranscriptJsonl() {
       });
       return null;
     }
-    return await readFile45(transcriptPath, "utf-8");
+    return await readFile46(transcriptPath, "utf-8");
   } catch {
     return null;
   }
@@ -348134,7 +348242,7 @@ var init_localInstaller = __esm(() => {
 });
 
 // src/tui/utils/shellConfig.ts
-import { open as open14, readFile as readFile46, stat as stat44 } from "fs/promises";
+import { open as open14, readFile as readFile47, stat as stat44 } from "fs/promises";
 import { homedir as osHomedir } from "os";
 import { join as join132 } from "path";
 function getShellConfigPaths(options) {
@@ -348169,7 +348277,7 @@ function filterAtlasAliases(lines) {
 }
 async function readFileLines(filePath) {
   try {
-    const content = await readFile46(filePath, { encoding: "utf8" });
+    const content = await readFile47(filePath, { encoding: "utf8" });
     return content.split(`
 `);
   } catch (e) {
@@ -348512,7 +348620,7 @@ var init_autoUpdater = __esm(() => {
 });
 
 // src/tui/utils/nativeInstaller/packageManagers.ts
-import { readFile as readFile47 } from "fs/promises";
+import { readFile as readFile48 } from "fs/promises";
 function isDistroFamily(osRelease, families) {
   return families.includes(osRelease.id) || osRelease.idLike.some((like) => families.includes(like));
 }
@@ -348570,7 +348678,7 @@ var init_packageManagers = __esm(() => {
   init_platform3();
   getOsRelease = memoize_default(async () => {
     try {
-      const content = await readFile47("/etc/os-release", "utf8");
+      const content = await readFile48("/etc/os-release", "utf8");
       const idMatch = content.match(/^ID=["']?(\S+?)["']?\s*$/m);
       const idLikeMatch = content.match(/^ID_LIKE=["']?(.+?)["']?\s*$/m);
       return {
@@ -348691,7 +348799,7 @@ var init_packageManagers = __esm(() => {
 });
 
 // src/tui/utils/doctorDiagnostic.ts
-import { readFile as readFile48, realpath as realpath12 } from "fs/promises";
+import { readFile as readFile49, realpath as realpath12 } from "fs/promises";
 import { homedir as homedir33 } from "os";
 import { delimiter as delimiter2, join as join134, posix as posix8, win32 as win322 } from "path";
 function getNormalizedPaths() {
@@ -348847,7 +348955,7 @@ async function detectMultipleInstallations() {
 async function detectConfigurationIssues(type) {
   const warnings = [];
   try {
-    const raw = await readFile48(join134(getManagedFilePath(), "managed-settings.json"), "utf-8");
+    const raw = await readFile49(join134(getManagedFilePath(), "managed-settings.json"), "utf-8");
     const parsed = jsonParse2(raw);
     const field = parsed && typeof parsed === "object" ? parsed.strictPluginOnlyCustomization : undefined;
     if (field !== undefined && typeof field !== "boolean") {
@@ -349360,7 +349468,7 @@ import {
   writeFile as writeFile36
 } from "fs/promises";
 import { homedir as homedir34 } from "os";
-import { basename as basename42, delimiter as delimiter3, dirname as dirname69, join as join137, resolve as resolve46 } from "path";
+import { basename as basename42, delimiter as delimiter3, dirname as dirname69, join as join137, resolve as resolve47 } from "path";
 function getPlatform4() {
   const os = env5.platform;
   const arch = process.arch === "x64" ? "x64" : process.arch === "arm64" ? "arm64" : null;
@@ -349708,8 +349816,8 @@ async function updateSymlink(symlinkPath, targetPath) {
     if (symlinkExists) {
       try {
         const currentTarget = await readlink2(symlinkPath);
-        const resolvedCurrentTarget = resolve46(dirname69(symlinkPath), currentTarget);
-        const resolvedTargetPath = resolve46(targetPath);
+        const resolvedCurrentTarget = resolve47(dirname69(symlinkPath), currentTarget);
+        const resolvedTargetPath = resolve47(targetPath);
         if (resolvedCurrentTarget === resolvedTargetPath) {
           return false;
         }
@@ -349749,7 +349857,7 @@ async function checkInstall(force = false) {
   const dirs = getBaseDirectories();
   const messages = [];
   const localBinDir = dirname69(dirs.executable);
-  const resolvedLocalBinPath = resolve46(localBinDir);
+  const resolvedLocalBinPath = resolve47(localBinDir);
   const platform = getPlatform4();
   const isWindows = platform.startsWith("win32");
   try {
@@ -349772,7 +349880,7 @@ async function checkInstall(force = false) {
   } else {
     try {
       const target = await readlink2(dirs.executable);
-      const absoluteTarget = resolve46(dirname69(dirs.executable), target);
+      const absoluteTarget = resolve47(dirname69(dirs.executable), target);
       if (!await isPossibleClaudeBinary(absoluteTarget)) {
         messages.push({
           message: `AtlasCode symlink points to missing or invalid binary: ${target}`,
@@ -349800,7 +349908,7 @@ async function checkInstall(force = false) {
   }
   const isInCurrentPath = (process.env.PATH || "").split(delimiter3).some((entry) => {
     try {
-      const resolvedEntry = resolve46(entry);
+      const resolvedEntry = resolve47(entry);
       if (isWindows) {
         return resolvedEntry.toLowerCase() === resolvedLocalBinPath.toLowerCase();
       }
@@ -349879,7 +349987,7 @@ async function installLatestImpl(channelOrVersion, forceReinstall = false) {
 async function getVersionFromSymlink(symlinkPath) {
   try {
     const target = await readlink2(symlinkPath);
-    const absoluteTarget = resolve46(dirname69(symlinkPath), target);
+    const absoluteTarget = resolve47(dirname69(symlinkPath), target);
     if (await isPossibleClaudeBinary(absoluteTarget)) {
       return absoluteTarget;
     }
@@ -349895,7 +350003,7 @@ async function lockCurrentVersion() {
   if (!process.execPath.includes(dirs.versions)) {
     return;
   }
-  const versionPath = resolve46(process.execPath);
+  const versionPath = resolve47(process.execPath);
   try {
     const lockfilePath = getLockFilePathFromVersionPath(dirs, versionPath);
     await mkdir40(dirs.locks, { recursive: true });
@@ -350041,7 +350149,7 @@ async function cleanupOldVersions() {
       versionFiles.push({
         name: entry,
         path: entryPath,
-        resolvedPath: resolve46(entryPath),
+        resolvedPath: resolve47(entryPath),
         mtime: stats.mtime
       });
     } catch {}
@@ -350056,7 +350164,7 @@ async function cleanupOldVersions() {
     const currentBinaryPath = process.execPath;
     const protectedVersions = new Set;
     if (currentBinaryPath && currentBinaryPath.includes(dirs.versions)) {
-      protectedVersions.add(resolve46(currentBinaryPath));
+      protectedVersions.add(resolve47(currentBinaryPath));
     }
     const currentSymlinkVersion = await getVersionFromSymlink(dirs.executable);
     if (currentSymlinkVersion) {
@@ -356526,7 +356634,7 @@ var init_useTurnDiffs = __esm(() => {
 });
 
 // src/tui/components/diff/DiffDetailView.tsx
-import { resolve as resolve47 } from "path";
+import { resolve as resolve48 } from "path";
 function DiffDetailView(t0) {
   const $ = import_compiler_runtime130.c(53);
   const {
@@ -356559,7 +356667,7 @@ function DiffDetailView(t0) {
     let content;
     let t2;
     if ($[1] !== filePath) {
-      const fullPath = resolve47(getCwd(), filePath);
+      const fullPath = resolve48(getCwd(), filePath);
       content = readFileSafe2(fullPath);
       t2 = content?.split(`
 `)[0] ?? null;
@@ -369989,7 +370097,7 @@ var init_mcp7 = __esm(() => {
 });
 
 // src/tui/utils/releaseNotes.ts
-import { mkdir as mkdir44, readFile as readFile49, writeFile as writeFile39 } from "fs/promises";
+import { mkdir as mkdir44, readFile as readFile50, writeFile as writeFile39 } from "fs/promises";
 import { dirname as dirname71, join as join140 } from "path";
 function getChangelogCachePath() {
   return join140(getAtlasConfigHomeDir3(), "cache", "changelog.md");
@@ -370039,7 +370147,7 @@ async function getStoredChangelog() {
   }
   const cachePath = getChangelogCachePath();
   try {
-    const content = await readFile49(cachePath, "utf-8");
+    const content = await readFile50(cachePath, "utf-8");
     changelogMemoryCache = content;
     return content;
   } catch {
@@ -387995,7 +388103,7 @@ __export(exports_thinkback, {
   call: () => call34,
   playAnimation: () => playAnimation
 });
-import { readFile as readFile50 } from "fs/promises";
+import { readFile as readFile51 } from "fs/promises";
 import { join as join143 } from "path";
 function getMarketplaceName() {
   return OFFICIAL_MARKETPLACE_NAME;
@@ -388024,7 +388132,7 @@ async function playAnimation(skillDir) {
   const dataPath = join143(skillDir, "year_in_review.js");
   const playerPath = join143(skillDir, "player.js");
   try {
-    await readFile50(dataPath);
+    await readFile51(dataPath);
   } catch (e) {
     if (isENOENT2(e)) {
       return {
@@ -388039,7 +388147,7 @@ async function playAnimation(skillDir) {
     };
   }
   try {
-    await readFile50(playerPath);
+    await readFile51(playerPath);
   } catch (e) {
     if (isENOENT2(e)) {
       return {
@@ -393118,7 +393226,7 @@ __export(exports_branch, {
   getUniqueForkName: () => getUniqueForkName
 });
 import { randomUUID as randomUUID39 } from "crypto";
-import { mkdir as mkdir45, readFile as readFile51, writeFile as writeFile40 } from "fs/promises";
+import { mkdir as mkdir45, readFile as readFile52, writeFile as writeFile40 } from "fs/promises";
 function deriveFirstPrompt(firstUserMessage) {
   const content = firstUserMessage?.message?.content;
   if (!content)
@@ -393137,7 +393245,7 @@ async function createFork(customTitle, target) {
   await mkdir45(projectDir, { recursive: true, mode: 448 });
   let transcriptContent;
   try {
-    transcriptContent = await readFile51(currentTranscriptPath);
+    transcriptContent = await readFile52(currentTranscriptPath);
   } catch {
     throw new Error("No conversation to branch");
   }
@@ -399430,7 +399538,7 @@ var init_refresh = __esm(() => {
 
 // src/tui/utils/plugins/parseMarketplaceInput.ts
 import { homedir as homedir37 } from "os";
-import { resolve as resolve48 } from "path";
+import { resolve as resolve49 } from "path";
 function matchKnownGitHost(hostname) {
   const host = hostname.toLowerCase();
   for (const known of KNOWN_GIT_HOSTS) {
@@ -399482,7 +399590,7 @@ async function parseMarketplaceInput(input) {
   const isWindows = process.platform === "win32";
   const isWindowsPath = isWindows && (trimmed.startsWith(".\\") || trimmed.startsWith("..\\") || /^[a-zA-Z]:[/\\]/.test(trimmed));
   if (trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed.startsWith("/") || trimmed.startsWith("~") || isWindowsPath) {
-    const resolvedPath = resolve48(trimmed.startsWith("~") ? trimmed.replace(/^~/, homedir37()) : trimmed);
+    const resolvedPath = resolve49(trimmed.startsWith("~") ? trimmed.replace(/^~/, homedir37()) : trimmed);
     let stats;
     try {
       stats = await fs.stat(resolvedPath);
@@ -402447,7 +402555,7 @@ var init_DiscoverPlugins = __esm(() => {
 });
 
 // src/tui/utils/plugins/skillSearch.ts
-import { readdir as readdir27, readFile as readFile52, stat as stat46 } from "fs/promises";
+import { readdir as readdir27, readFile as readFile53, stat as stat46 } from "fs/promises";
 import { join as join146 } from "path";
 async function searchSkillsAcrossMarketplaces(query) {
   const config = await loadKnownMarketplacesConfig();
@@ -402493,7 +402601,7 @@ async function searchSkillsAcrossMarketplaces(query) {
           seen.add(skillFile);
           let content;
           try {
-            content = await readFile52(skillFile, { encoding: "utf-8" });
+            content = await readFile53(skillFile, { encoding: "utf-8" });
           } catch {
             continue;
           }
@@ -403987,7 +404095,7 @@ var init_ManageMarketplaces = __esm(() => {
 
 // src/tui/utils/plugins/pluginFlagging.ts
 import { randomBytes as randomBytes19 } from "crypto";
-import { readFile as readFile53, rename as rename10, unlink as unlink20, writeFile as writeFile41 } from "fs/promises";
+import { readFile as readFile54, rename as rename10, unlink as unlink20, writeFile as writeFile41 } from "fs/promises";
 import { join as join147 } from "path";
 function getFlaggedPluginsPath() {
   return join147(getPluginsDirectory(), FLAGGED_PLUGINS_FILENAME);
@@ -404014,7 +404122,7 @@ function parsePluginsData(content) {
 }
 async function readFromDisk() {
   try {
-    const content = await readFile53(getFlaggedPluginsPath(), {
+    const content = await readFile54(getFlaggedPluginsPath(), {
       encoding: "utf-8"
     });
     return parsePluginsData(content);
@@ -407329,7 +407437,7 @@ function parsePluginArgs(args) {
 }
 
 // src/tui/utils/plugins/validatePlugin.ts
-import { readdir as readdir29, readFile as readFile55, stat as stat48 } from "fs/promises";
+import { readdir as readdir29, readFile as readFile56, stat as stat48 } from "fs/promises";
 import * as path24 from "path";
 function detectManifestType(filePath) {
   const fileName = path24.basename(filePath);
@@ -407369,7 +407477,7 @@ async function validatePluginManifest(filePath) {
   const absolutePath = path24.resolve(filePath);
   let content;
   try {
-    content = await readFile55(absolutePath, { encoding: "utf-8" });
+    content = await readFile56(absolutePath, { encoding: "utf-8" });
   } catch (error) {
     const code = getErrnoCode2(error);
     let message;
@@ -407493,7 +407601,7 @@ async function validateMarketplaceManifest(filePath) {
   const absolutePath = path24.resolve(filePath);
   let content;
   try {
-    content = await readFile55(absolutePath, { encoding: "utf-8" });
+    content = await readFile56(absolutePath, { encoding: "utf-8" });
   } catch (error) {
     const code = getErrnoCode2(error);
     let message;
@@ -407579,7 +407687,7 @@ async function validateMarketplaceManifest(filePath) {
         const pluginJsonPath = findManifestInDir(path24.join(marketplaceRoot, entry.source), "plugin.json");
         let manifestVersion;
         try {
-          const raw = await readFile55(pluginJsonPath, { encoding: "utf-8" });
+          const raw = await readFile56(pluginJsonPath, { encoding: "utf-8" });
           const parsed = jsonParse2(raw);
           if (typeof parsed.version === "string") {
             manifestVersion = parsed.version;
@@ -407627,7 +407735,7 @@ async function validateMarketplaceManifest(filePath) {
         for (const skillFile of skillFiles) {
           let content;
           try {
-            content = await readFile55(skillFile, { encoding: "utf-8" });
+            content = await readFile56(skillFile, { encoding: "utf-8" });
           } catch (e) {
             if (isENOENT2(e))
               continue;
@@ -407754,7 +407862,7 @@ function validateComponentFile(filePath, content, fileType) {
 async function validateHooksJson(filePath) {
   let content;
   try {
-    content = await readFile55(filePath, { encoding: "utf-8" });
+    content = await readFile56(filePath, { encoding: "utf-8" });
   } catch (e) {
     const code = getErrnoCode2(e);
     if (code === "ENOENT") {
@@ -407847,7 +407955,7 @@ async function validatePluginContents(pluginDir) {
     for (const filePath of files) {
       let content;
       try {
-        content = await readFile55(filePath, { encoding: "utf-8" });
+        content = await readFile56(filePath, { encoding: "utf-8" });
       } catch (e) {
         if (isENOENT2(e))
           continue;
@@ -407916,7 +408024,7 @@ async function validateManifest(filePath) {
       return validateMarketplaceManifest(filePath);
     case "unknown": {
       try {
-        const content = await readFile55(absolutePath, { encoding: "utf-8" });
+        const content = await readFile56(absolutePath, { encoding: "utf-8" });
         const parsed = jsonParse2(content);
         if (Array.isArray(parsed.plugins)) {
           return validateMarketplaceManifest(filePath);
@@ -409508,7 +409616,7 @@ var init_rewind = __esm(() => {
 
 // src/tui/utils/heapDumpService.ts
 import { createWriteStream as createWriteStream3, writeFileSync as writeFileSync8 } from "fs";
-import { readdir as readdir30, readFile as readFile56, writeFile as writeFile42 } from "fs/promises";
+import { readdir as readdir30, readFile as readFile57, writeFile as writeFile42 } from "fs/promises";
 import { join as join150 } from "path";
 import { pipeline as pipeline2 } from "stream/promises";
 import {
@@ -409533,7 +409641,7 @@ async function captureMemoryDiagnostics(trigger, dumpNumber = 0) {
   } catch {}
   let smapsRollup;
   try {
-    smapsRollup = await readFile56("/proc/self/smaps_rollup", "utf8");
+    smapsRollup = await readFile57("/proc/self/smaps_rollup", "utf8");
   } catch {}
   const nativeMemory = usage.rss - usage.heapUsed;
   const bytesPerSecond = uptimeSeconds > 0 ? usage.rss / uptimeSeconds : 0;
@@ -411340,7 +411448,7 @@ var init_ExitFlow = __esm(() => {
 });
 
 // src/tui/utils/concurrentSessions.ts
-import { chmod as chmod8, mkdir as mkdir48, readdir as readdir31, readFile as readFile57, unlink as unlink21, writeFile as writeFile43 } from "fs/promises";
+import { chmod as chmod8, mkdir as mkdir48, readdir as readdir31, readFile as readFile58, unlink as unlink21, writeFile as writeFile43 } from "fs/promises";
 import { join as join152 } from "path";
 function getSessionsDir() {
   return join152(getAtlasConfigHomeDir3(), "sessions");
@@ -411396,7 +411504,7 @@ async function registerSession2() {
 async function updatePidFile(patch) {
   const pidFile = join152(getSessionsDir(), `${process.pid}.json`);
   try {
-    const data = jsonParse2(await readFile57(pidFile, "utf8"));
+    const data = jsonParse2(await readFile58(pidFile, "utf8"));
     await writeFile43(pidFile, jsonStringify5({ ...data, ...patch }));
   } catch (e) {
     logForDebugging3(`[concurrentSessions] updatePidFile failed: ${errorMessage2(e)}`);
@@ -416519,7 +416627,7 @@ __export(exports_insights, {
 import {
   mkdir as mkdir50,
   readdir as readdir32,
-  readFile as readFile58,
+  readFile as readFile59,
   unlink as unlink23,
   writeFile as writeFile45
 } from "fs/promises";
@@ -416880,7 +416988,7 @@ async function formatTranscriptWithSummarization(log) {
 async function loadCachedFacets(sessionId) {
   const facetPath = join158(getFacetsDir(), `${sessionId}.json`);
   try {
-    const content = await readFile58(facetPath, { encoding: "utf-8" });
+    const content = await readFile59(facetPath, { encoding: "utf-8" });
     const parsed = jsonParse2(content);
     if (!isValidSessionFacets(parsed)) {
       try {
@@ -416906,7 +417014,7 @@ async function saveFacets(facets) {
 async function loadCachedSessionMeta(sessionId) {
   const metaPath = join158(getSessionMetaDir(), `${sessionId}.json`);
   try {
-    const content = await readFile58(metaPath, { encoding: "utf-8" });
+    const content = await readFile59(metaPath, { encoding: "utf-8" });
     return jsonParse2(content);
   } catch {
     return null;
@@ -418953,7 +419061,7 @@ import {
   open as fsOpen3,
   mkdir as mkdir51,
   readdir as readdir33,
-  readFile as readFile59,
+  readFile as readFile60,
   stat as stat49,
   unlink as unlink24,
   writeFile as writeFile46
@@ -419009,7 +419117,7 @@ async function writeAgentMetadata(agentId, metadata) {
 async function readAgentMetadata(agentId) {
   const path = getAgentMetadataPath(agentId);
   try {
-    const raw = await readFile59(path, "utf-8");
+    const raw = await readFile60(path, "utf-8");
     return JSON.parse(raw);
   } catch (e) {
     if (isFsInaccessible2(e))
@@ -419334,7 +419442,7 @@ class Project2 {
           logForDebugging3(`Skipping tombstone removal: session file too large (${formatFileSize3(fileSize)})`, { level: "warn" });
           return;
         }
-        const content = await readFile59(this.sessionFile, { encoding: "utf-8" });
+        const content = await readFile60(this.sessionFile, { encoding: "utf-8" });
         const lines = content.split(`
 `).filter((line) => {
           if (!line.trim())
@@ -420588,7 +420696,7 @@ async function loadTranscriptFile2(filePath, opts) {
         }
       }
     }
-    buf ??= await readFile59(filePath);
+    buf ??= await readFile60(filePath);
     if (!opts?.keepAllLeaves && !hasPreservedSegment && !isEnvTruthy2(process.env.ATLAS_DISABLE_PRECOMPACT_SKIP) && buf.length > SKIP_PRECOMPACT_THRESHOLD2) {
       buf = walkChainBeforeParse2(buf);
     }
@@ -421512,7 +421620,7 @@ var init_sessionStorage = __esm(() => {
 // src/tui/utils/plans.ts
 import { randomUUID as randomUUID40 } from "crypto";
 import { copyFile as copyFile9, writeFile as writeFile47 } from "fs/promises";
-import { join as join160, resolve as resolve50, sep as sep34 } from "path";
+import { join as join160, resolve as resolve51, sep as sep34 } from "path";
 function getPlanSlug2(sessionId) {
   const id = sessionId ?? getSessionId();
   const cache = getPlanSlugCache();
@@ -421722,7 +421830,7 @@ var init_plans = __esm(() => {
     let plansPath;
     if (settingsDir) {
       const cwd = getCwd();
-      const resolved = resolve50(cwd, settingsDir);
+      const resolved = resolve51(cwd, settingsDir);
       if (!resolved.startsWith(cwd + sep34) && resolved !== cwd) {
         logError3(new Error(`plansDirectory must be within project root: ${settingsDir}`));
         plansPath = join160(getAtlasConfigHomeDir3(), "plans");
@@ -429594,7 +429702,7 @@ var init_compact4 = __esm(() => {
 });
 
 // src/tui/services/SessionMemory/prompts.ts
-import { readFile as readFile60 } from "fs/promises";
+import { readFile as readFile61 } from "fs/promises";
 import { join as join163 } from "path";
 function getDefaultUpdatePrompt() {
   return `IMPORTANT: This message and these instructions are NOT part of the actual user conversation. Do NOT include any references to "note-taking", "session notes extraction", or these update instructions in the notes content.
@@ -429638,7 +429746,7 @@ REMEMBER: Use the Edit tool in parallel and stop. Do not continue after the edit
 async function loadSessionMemoryTemplate() {
   const templatePath = join163(getAtlasConfigHomeDir3(), "session-memory", "config", "template.md");
   try {
-    return await readFile60(templatePath, { encoding: "utf-8" });
+    return await readFile61(templatePath, { encoding: "utf-8" });
   } catch (e) {
     const code = getErrnoCode2(e);
     if (code === "ENOENT") {
@@ -429651,7 +429759,7 @@ async function loadSessionMemoryTemplate() {
 async function loadSessionMemoryPrompt() {
   const promptPath = join163(getAtlasConfigHomeDir3(), "session-memory", "config", "prompt.md");
   try {
-    return await readFile60(promptPath, { encoding: "utf-8" });
+    return await readFile61(promptPath, { encoding: "utf-8" });
   } catch (e) {
     const code = getErrnoCode2(e);
     if (code === "ENOENT") {
@@ -431702,6 +431810,7 @@ var init_managedEnvConstants = __esm(() => {
     "MAX_THINKING_TOKENS",
     "MCP_TIMEOUT",
     "MCP_TOOL_TIMEOUT",
+    "MCP_CONNECTION_NONBLOCKING",
     "OTEL_EXPORTER_OTLP_HEADERS",
     "OTEL_EXPORTER_OTLP_LOGS_HEADERS",
     "OTEL_EXPORTER_OTLP_LOGS_PROTOCOL",
@@ -464756,7 +464865,7 @@ var init_coordinatorHandler = __esm(() => {
 });
 
 // src/tui/utils/permissions/sessionPermissionRules.ts
-import { mkdir as mkdir53, readFile as readFile61, rename as rename11, writeFile as writeFile48 } from "fs/promises";
+import { mkdir as mkdir53, readFile as readFile62, rename as rename11, writeFile as writeFile48 } from "fs/promises";
 import { dirname as dirname80, join as join170 } from "path";
 function sessionRulesPath(sessionId, projectDir) {
   return join170(projectDir, `${sessionId}${SESSION_RULES_FILE_SUFFIX}`);
@@ -464797,7 +464906,7 @@ function isSessionAddRules(u) {
 }
 async function readSessionPermissionRules(sessionId, projectDir) {
   try {
-    const raw = await readFile61(sessionRulesPath(sessionId, projectDir), "utf8");
+    const raw = await readFile62(sessionRulesPath(sessionId, projectDir), "utf8");
     return parseSessionRulesJson(raw);
   } catch (e) {
     logForDebugging3(`readSessionPermissionRules: no/corrupt sidecar for ${sessionId}: ${e}`);
@@ -465091,6 +465200,11 @@ function createPermissionContext(tool, input, toolUseContext, assistantMessage,
       });
     },
     async handleHookAllow(finalInput, permissionUpdates, permissionPromptStartTimeMs) {
+      const denyCheck = await checkRuleBasedPermissions(tool, finalInput, toolUseContext);
+      if (denyCheck && denyCheck.behavior === "deny") {
+        this.logDecision({ decision: "reject", source: { type: "hook" } }, { input: finalInput, permissionPromptStartTimeMs });
+        return this.buildDeny(denyCheck.message, denyCheck.decisionReason);
+      }
       const acceptedPermanentUpdates = await this.persistPermissions(permissionUpdates);
       this.logDecision({
         decision: "accept",
@@ -465133,6 +465247,7 @@ var init_PermissionContext = __esm(() => {
   init_debug();
   init_log5();
   init_sessionPermissionRules();
+  init_permissions6();
   init_hooks7();
   init_messages3();
   init_PermissionUpdate();
@@ -469199,11 +469314,11 @@ var init_builtinMarketplaceSnapshots = __esm(() => {
 // src/tui/utils/plugins/marketplaceSnapshotFallback.ts
 import {
   mkdir as mkdir54,
-  readFile as readFile62,
+  readFile as readFile63,
   rm as rm11,
   writeFile as writeFile49
 } from "fs/promises";
-import { join as join173, resolve as resolve53, sep as sep41 } from "path";
+import { join as join173, resolve as resolve54, sep as sep41 } from "path";
 function getBuiltinSnapshotRoot() {
   return join173(getMarketplacesCacheDir(), "builtin-snapshots");
 }
@@ -469215,7 +469330,7 @@ function isBuiltinSnapshotEntry(entry) {
     return false;
   if (entry.source.source !== "directory")
     return false;
-  const root = resolve53(getBuiltinSnapshotRoot()) + sep41;
+  const root = resolve54(getBuiltinSnapshotRoot()) + sep41;
   return entry.installLocation.startsWith(root);
 }
 async function installBuiltinSnapshotFallback(marketplaceName) {
@@ -469261,7 +469376,7 @@ async function materializeSnapshot(snapshotDir, manifest) {
   await mkdir54(join173(snapshotDir, manifestDirName), { recursive: true });
   const content = jsonStringify5(manifest, null, 2);
   await writeFile49(manifestPath, content, { encoding: "utf-8" });
-  const roundTrip = JSON.parse(await readFile62(manifestPath, "utf-8"));
+  const roundTrip = JSON.parse(await readFile63(manifestPath, "utf-8"));
   PluginMarketplaceSchema().parse(roundTrip);
 }
 var init_marketplaceSnapshotFallback = __esm(() => {
@@ -471736,7 +471851,7 @@ var init_usePluginAutoupdateNotification = __esm(() => {
 });
 
 // src/tui/utils/plugins/reconciler.ts
-import { isAbsolute as isAbsolute34, resolve as resolve54 } from "path";
+import { isAbsolute as isAbsolute34, resolve as resolve55 } from "path";
 function diffMarketplaces(declared, materialized, opts) {
   const missing = [];
   const sourceChanged = [];
@@ -471849,7 +471964,7 @@ function normalizeSource(source, projectRoot) {
     const canonicalRoot = findCanonicalGitRoot2(base);
     return {
       ...source,
-      path: resolve54(canonicalRoot ?? base, source.path)
+      path: resolve55(canonicalRoot ?? base, source.path)
     };
   }
   return source;
@@ -474841,7 +474956,7 @@ var init_cronJitterConfig2 = __esm(() => {
 });
 
 // src/tui/utils/cronTasksLock.ts
-import { mkdir as mkdir55, readFile as readFile63, unlink as unlink26, writeFile as writeFile50 } from "fs/promises";
+import { mkdir as mkdir55, readFile as readFile64, unlink as unlink26, writeFile as writeFile50 } from "fs/promises";
 import { dirname as dirname83, join as join176 } from "path";
 function getLockPath3(dir) {
   return join176(dir ?? getProjectRoot(), LOCK_FILE_REL2);
@@ -474849,7 +474964,7 @@ function getLockPath3(dir) {
 async function readLock3(dir) {
   let raw;
   try {
-    raw = await readFile63(getLockPath3(dir), "utf8");
+    raw = await readFile64(getLockPath3(dir), "utf8");
   } catch {
     return;
   }
@@ -486991,7 +487106,7 @@ var init_mcp8 = __esm(() => {
 });
 
 // src/tui/utils/atlasDesktop.ts
-import { readdir as readdir34, readFile as readFile64, stat as stat55 } from "fs/promises";
+import { readdir as readdir34, readFile as readFile65, stat as stat55 } from "fs/promises";
 import { homedir as homedir47 } from "os";
 import { join as join183 } from "path";
 async function getDesktopConfigPath() {
@@ -487039,7 +487154,7 @@ async function readDesktopMcpServers() {
     const configPath = await getDesktopConfigPath();
     let configContent;
     try {
-      configContent = await readFile64(configPath, { encoding: "utf8" });
+      configContent = await readFile65(configPath, { encoding: "utf8" });
     } catch (e) {
       const code = getErrnoCode2(e);
       if (code === "ENOENT") {
@@ -487474,12 +487589,12 @@ var init_auth6 = __esm(() => {
 });
 
 // src/tui/utils/plugins/marketplacePublish.ts
-import { cp, mkdir as mkdir56, readFile as readFile65, rm as rm12, writeFile as writeFile53 } from "fs/promises";
+import { cp, mkdir as mkdir56, readFile as readFile66, rm as rm12, writeFile as writeFile53 } from "fs/promises";
 import {
   dirname as dirname87,
   join as join184,
   relative as relative38,
-  resolve as resolve55,
+  resolve as resolve56,
   sep as sep43
 } from "path";
 function git(marketplaceDir, args, timeoutMs = 2 * 60 * 1000) {
@@ -487492,8 +487607,8 @@ function gitFailureMessage(res) {
   return (res.stderr || res.error || `exit code ${res.code}`).trim();
 }
 async function publishPluginToMarketplace(opts) {
-  const pluginDir = resolve55(opts.pluginDir);
-  const marketplaceDir = resolve55(opts.marketplaceDir);
+  const pluginDir = resolve56(opts.pluginDir);
+  const marketplaceDir = resolve56(opts.marketplaceDir);
   const notes = [];
   if (pluginDir === marketplaceDir || pluginDir.startsWith(marketplaceDir + sep43)) {
     throw new Error(`Cannot publish "${pluginDir}": the plugin directory must not live inside the target marketplace (${marketplaceDir})`);
@@ -487501,7 +487616,7 @@ async function publishPluginToMarketplace(opts) {
   const pluginManifestPath = findManifestInDir(pluginDir, "plugin.json");
   let pluginManifestRaw;
   try {
-    pluginManifestRaw = await readFile65(pluginManifestPath, {
+    pluginManifestRaw = await readFile66(pluginManifestPath, {
       encoding: "utf-8"
     });
   } catch {
@@ -487526,7 +487641,7 @@ async function publishPluginToMarketplace(opts) {
   const marketplaceManifestPath = findManifestInDir(marketplaceDir, "marketplace.json");
   let marketplaceRaw;
   try {
-    marketplaceRaw = await readFile65(marketplaceManifestPath, {
+    marketplaceRaw = await readFile66(marketplaceManifestPath, {
       encoding: "utf-8"
     });
   } catch {
@@ -487624,9 +487739,9 @@ var init_marketplacePublish = __esm(() => {
 import { userInfo as userInfo2 } from "os";
 import { existsSync as existsSync15 } from "fs";
 import { mkdir as mkdir57, writeFile as writeFile54 } from "fs/promises";
-import { dirname as dirname88, join as join185, resolve as resolve56 } from "path";
+import { dirname as dirname88, join as join185, resolve as resolve57 } from "path";
 async function scaffoldMarketplace(opts) {
-  const targetDir = resolve56(opts.targetDir);
+  const targetDir = resolve57(opts.targetDir);
   const name = opts.name.trim();
   const manifestDirName = getPluginManifestDirs()[0];
   const marketplaceManifestPath = join185(targetDir, manifestDirName, "marketplace.json");
@@ -487712,7 +487827,7 @@ var init_marketplaceScaffold = __esm(() => {
 });
 
 // src/tui/cli/handlers/plugins.ts
-import { basename as basename65, dirname as dirname89, resolve as resolve57 } from "path";
+import { basename as basename65, dirname as dirname89, resolve as resolve58 } from "path";
 function handleMarketplaceError(error, action) {
   logError3(error);
   cliError2(`${figures_default.cross} Failed to ${action}: ${errorMessage2(error)}`);
@@ -488064,7 +488179,7 @@ async function marketplaceUpdateHandler(name, options) {
 async function marketplaceScaffoldHandler(options) {
   if (options.cowork)
     setUseCoworkPlugins(true);
-  const targetDir = resolve57(options.target ?? process.cwd());
+  const targetDir = resolve58(options.target ?? process.cwd());
   try {
     const result = await scaffoldMarketplace({
       name: options.name,
@@ -488089,8 +488204,8 @@ async function marketplacePublishHandler(options) {
     setUseCoworkPlugins(true);
   try {
     const result = await publishPluginToMarketplace({
-      pluginDir: resolve57(options.plugin),
-      marketplaceDir: resolve57(options.marketplace),
+      pluginDir: resolve58(options.plugin),
+      marketplaceDir: resolve58(options.marketplace),
       version: options.version,
       push: options.push
     });
@@ -489306,7 +489421,7 @@ var init_update2 = __esm(() => {
 
 // src/tui/main.tsx
 import { readFileSync as readFileSync25 } from "fs";
-import { resolve as resolve58 } from "path";
+import { resolve as resolve59 } from "path";
 function logManagedSettings() {
   try {
     const policySettings = getSettingsForSource2("policySettings");
@@ -489873,12 +489988,12 @@ ${getTmuxInstallInstructions3()}
         process.exit(1);
       }
       try {
-        const filePath = resolve58(options.systemPromptFile);
+        const filePath = resolve59(options.systemPromptFile);
         systemPrompt = readFileSync25(filePath, "utf8");
       } catch (error) {
         const code = getErrnoCode2(error);
         if (code === "ENOENT") {
-          process.stderr.write(source_default.red(`Error: System prompt file not found: ${resolve58(options.systemPromptFile)}
+          process.stderr.write(source_default.red(`Error: System prompt file not found: ${resolve59(options.systemPromptFile)}
 `));
           process.exit(1);
         }
@@ -489895,12 +490010,12 @@ ${getTmuxInstallInstructions3()}
         process.exit(1);
       }
       try {
-        const filePath = resolve58(options.appendSystemPromptFile);
+        const filePath = resolve59(options.appendSystemPromptFile);
         appendSystemPrompt = readFileSync25(filePath, "utf8");
       } catch (error) {
         const code = getErrnoCode2(error);
         if (code === "ENOENT") {
-          process.stderr.write(source_default.red(`Error: Append system prompt file not found: ${resolve58(options.appendSystemPromptFile)}
+          process.stderr.write(source_default.red(`Error: Append system prompt file not found: ${resolve59(options.appendSystemPromptFile)}
 `));
           process.exit(1);
         }
@@ -489950,7 +490065,7 @@ ${addendum}` : addendum;
             errors = result.errors;
           }
         } else {
-          const configPath = resolve58(configItem);
+          const configPath = resolve59(configItem);
           const result = parseMcpConfigFromFilePath({
             filePath: configPath,
             expandVars: true,
@@ -491596,7 +491711,7 @@ function createInMemorySandboxDeps() {
 // src/atlascode/adapters/sessionMemoryPortAdapter.ts
 init_engine();
 init_shared();
-import { mkdir as mkdir12, readFile as readFile12, writeFile as writeFile8 } from "fs/promises";
+import { mkdir as mkdir12, readFile as readFile13, writeFile as writeFile8 } from "fs/promises";
 import { dirname as dirname22, join as join41 } from "path";
 function sessionMemoryPath() {
   const env = getSessionEnv();
@@ -491606,7 +491721,7 @@ function createSessionMemoryPort() {
   return {
     async load() {
       try {
-        return await readFile12(sessionMemoryPath(), "utf-8");
+        return await readFile13(sessionMemoryPath(), "utf-8");
       } catch (e) {
         if (isFsInaccessible(e))
           return null;
@@ -492225,7 +492340,7 @@ function getAscendExecutor() {
   return _instance;
 }
 // src/ascend/tools/SpecParser.ts
-import { readFile as readFile13 } from "node:fs/promises";
+import { readFile as readFile14 } from "node:fs/promises";
 
 // src/ascend/tools/constants.ts
 var SPEC_PARSER_TOOL_NAME = "AscendSpecParser";
@@ -492293,7 +492408,7 @@ var SpecParser = {
     let raw = inp.spec_source;
     let parsedFromFile = false;
     try {
-      const fileContent = await readFile13(inp.spec_source, "utf-8");
+      const fileContent = await readFile14(inp.spec_source, "utf-8");
       raw = fileContent;
       parsedFromFile = true;
     } catch {}