@botiverse/raft-daemon 0.72.8-play.20260713140653 → 0.72.8

package/dist/{chunk-QCVK2BPO.js → chunk-FNFNAY5B.js}

@@ -1,5 +1,5 @@
 // src/core.ts
-import path24 from "path";
+import path23 from "path";
 import os8 from "os";
 import { randomUUID as randomUUID9 } from "crypto";
 import { createRequire as createRequire3 } from "module";
@@ -4558,17 +4558,16 @@ var TRIAL_DURATION_DAYS = (TRIAL_END_DATE.getTime() - TRIAL_START_DATE.getTime()
 
 // src/agentProcessManager.ts
 import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync6, readdirSync as readdirSync4, statSync, writeFileSync as writeFileSync4 } from "fs";
-import { readdir as readdir3, stat as stat2, readFile, rm as rm2, lstat, realpath as realpath2, open } from "fs/promises";
+import { mkdir, writeFile, access, readdir as readdir2, stat as stat2, readFile, rm as rm2, lstat, realpath, open } from "fs/promises";
 import { createHash as createHash3, randomUUID as randomUUID6 } from "crypto";
-import path15 from "path";
+import path14 from "path";
 import { gzipSync } from "zlib";
 import os6 from "os";
 
 // src/proxy.ts
 import { HttpsProxyAgent } from "https-proxy-agent";
-import { Agent, ProxyAgent } from "undici";
+import { ProxyAgent } from "undici";
 var fetchDispatcherCache = /* @__PURE__ */ new Map();
-var isolatedFetchDispatcherCache = /* @__PURE__ */ new Map();
 function getFetchPreResponseTimeoutMs(env) {
   const parsed = Number.parseInt(env.SLOCK_DAEMON_FETCH_PRE_RESPONSE_TIMEOUT_MS || "", 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 3e4;
@@ -4633,60 +4632,32 @@ function resolveProxyUrl(targetUrl, env) {
   if (shouldBypassProxy(targetUrl, env)) return void 0;
   return proxyUrl;
 }
-function createProxyDispatcher(proxyUrl, timeoutMs) {
-  return new ProxyAgent({
-    uri: proxyUrl,
-    connect: { timeout: timeoutMs },
-    requestTls: { timeout: timeoutMs },
-    headersTimeout: timeoutMs
-  });
-}
-function closeDispatcherBestEffort(dispatcher) {
-  void Promise.resolve().then(() => dispatcher.close()).catch(() => dispatcher.destroy?.(new Error("evicted"))).catch(() => {
-  });
-}
 function buildFetchDispatcher(targetUrl, env) {
   const proxyUrl = resolveProxyUrl(targetUrl, env);
   if (!proxyUrl) return void 0;
   const cached = fetchDispatcherCache.get(proxyUrl);
   if (cached) return cached;
   const timeoutMs = getFetchPreResponseTimeoutMs(env);
-  const dispatcher = createProxyDispatcher(proxyUrl, timeoutMs);
-  fetchDispatcherCache.set(proxyUrl, dispatcher);
-  return dispatcher;
-}
-function getIsolatedDispatcherCacheKey(targetUrl, isolationKey, env) {
-  const proxyUrl = resolveProxyUrl(targetUrl, env);
-  const routeKey = proxyUrl ? `proxy:${proxyUrl}` : `direct:${new URL(targetUrl).origin}`;
-  return { cacheKey: `${isolationKey}\0${routeKey}`, proxyUrl };
-}
-function buildIsolatedFetchDispatcher(targetUrl, isolationKey, env) {
-  const { cacheKey, proxyUrl } = getIsolatedDispatcherCacheKey(targetUrl, isolationKey, env);
-  const cached = isolatedFetchDispatcherCache.get(cacheKey);
-  if (cached) return cached;
-  const timeoutMs = getFetchPreResponseTimeoutMs(env);
-  const dispatcher = proxyUrl ? createProxyDispatcher(proxyUrl, timeoutMs) : new Agent({
+  const dispatcher = new ProxyAgent({
+    uri: proxyUrl,
+    // All three are pre-response and body-agnostic (see getFetchPreResponseTimeoutMs):
+    // headersTimeout = headers-hang leg; requestTls.timeout = CONNECT-tunnel
+    // establish leg; connect.timeout = socket to the proxy itself (defensive).
     connect: { timeout: timeoutMs },
+    requestTls: { timeout: timeoutMs },
     headersTimeout: timeoutMs
   });
-  isolatedFetchDispatcherCache.set(cacheKey, dispatcher);
+  fetchDispatcherCache.set(proxyUrl, dispatcher);
   return dispatcher;
 }
-function evictIsolatedFetchDispatcher(targetUrl, isolationKey, env) {
-  const { cacheKey } = getIsolatedDispatcherCacheKey(targetUrl, isolationKey, env);
-  const cached = isolatedFetchDispatcherCache.get(cacheKey);
-  if (!cached) return false;
-  isolatedFetchDispatcherCache.delete(cacheKey);
-  closeDispatcherBestEffort(cached);
-  return true;
-}
 function evictFetchDispatcher(targetUrl, env) {
   const proxyUrl = resolveProxyUrl(targetUrl, env);
   if (!proxyUrl) return false;
   const cached = fetchDispatcherCache.get(proxyUrl);
   if (!cached) return false;
   fetchDispatcherCache.delete(proxyUrl);
-  closeDispatcherBestEffort(cached);
+  void Promise.resolve().then(() => cached.close()).catch(() => cached.destroy?.(new Error("evicted"))).catch(() => {
+  });
   return true;
 }
 
@@ -4695,17 +4666,11 @@ function withDaemonFetchProxy(input, init = {}, env = process.env) {
   const dispatcher = buildFetchDispatcher(input.toString(), env);
   return dispatcher ? { ...init, dispatcher } : init;
 }
-async function daemonFetch(input, init, env = process.env, options = {}) {
-  const targetUrl = input.toString();
-  const fetchInit = options.isolationKey ? { ...init, dispatcher: buildIsolatedFetchDispatcher(targetUrl, options.isolationKey, env) } : withDaemonFetchProxy(input, init, env);
+async function daemonFetch(input, init, env = process.env) {
   try {
-    return await fetch(input, fetchInit);
+    return await fetch(input, withDaemonFetchProxy(input, init, env));
   } catch (err) {
-    if (options.isolationKey) {
-      evictIsolatedFetchDispatcher(targetUrl, options.isolationKey, env);
-    } else {
-      evictFetchDispatcher(targetUrl, env);
-    }
+    evictFetchDispatcher(input.toString(), env);
     throw err;
   }
 }
@@ -4866,8 +4831,8 @@ async function executeResponseRequest(url, init, {
 }
 
 // src/directUploadCapability.ts
-function joinUrl(base, path25) {
-  return `${base.replace(/\/+$/, "")}${path25}`;
+function joinUrl(base, path24) {
+  return `${base.replace(/\/+$/, "")}${path24}`;
 }
 function jsonHeaders(apiKey) {
   return {
@@ -4997,37 +4962,6 @@ import { existsSync as existsSync2, mkdirSync, readdirSync, readFileSync, rmSync
 import { createRequire } from "module";
 import path2 from "path";
 
-// src/gitIdentity.ts
-function resolveAgentGitIdentity(agentName) {
-  const name = agentName.trim();
-  if (!name) {
-    throw new Error("Cannot provision git identity for an agent without a name");
-  }
-  return { name, email: `${name.toLowerCase()}@mail.build` };
-}
-function buildProvisionSignedGitEnv(agentName) {
-  const identity = resolveAgentGitIdentity(agentName);
-  return {
-    GIT_AUTHOR_NAME: identity.name,
-    GIT_AUTHOR_EMAIL: identity.email,
-    GIT_COMMITTER_NAME: identity.name,
-    GIT_COMMITTER_EMAIL: identity.email
-  };
-}
-function withProvisionSignedGitEnv(config) {
-  const identityEnv = buildProvisionSignedGitEnv(config.name);
-  return {
-    ...config,
-    envVars: { ...config.envVars ?? {}, ...identityEnv },
-    ...config.runtimeConfig ? {
-      runtimeConfig: {
-        ...config.runtimeConfig,
-        envVars: { ...config.runtimeConfig.envVars ?? {}, ...identityEnv }
-      }
-    } : {}
-  };
-}
-
 // src/drivers/raftCliGuide.ts
 var MESSAGE_HEREDOC_DELIMITER = "SLOCKMSG";
 function describeSlockInstallation(audience) {
@@ -5588,15 +5522,6 @@ function listLegacySlockStatePaths(slockHome = resolveSlockHome(), homeDir = os.
   return candidates.filter((candidate) => existsSync(candidate.path));
 }
 
-// src/authEnv.ts
-var DAEMON_API_KEY_ENV = "SLOCK_MACHINE_API_KEY";
-var SLOCK_AGENT_TOKEN_ENV = "SLOCK_AGENT_TOKEN";
-function scrubDaemonChildEnv(env) {
-  delete env[DAEMON_API_KEY_ENV];
-  delete env[SLOCK_AGENT_TOKEN_ENV];
-  return env;
-}
-
 // src/agentCredentialProxy.ts
 import { randomBytes } from "crypto";
 import http from "http";
@@ -6574,7 +6499,6 @@ var HOP_BY_HOP_REQUEST_HEADERS = /* @__PURE__ */ new Set([
 var LOCAL_HELD_CONTEXT_LIMIT = 3;
 var AGENT_CREDENTIAL_PROXY_HOST = "127.0.0.1";
 var AGENT_CREDENTIAL_PROXY_BIND_MAX_ATTEMPTS = 3;
-var AGENT_CREDENTIAL_PROXY_FETCH_ISOLATION_KEY = "agent-credential-proxy";
 function createProxyRequestHandler() {
   return (req, res) => {
     void handleProxyRequest(req, res);
@@ -6729,16 +6653,11 @@ async function handleProxyRequest(req, res) {
       headers.set("content-type", "application/json");
       headers.delete("content-length");
     }
-    const upstream = await daemonFetch(
-      target,
-      {
-        method,
-        headers,
-        body
-      },
-      process.env,
-      { isolationKey: AGENT_CREDENTIAL_PROXY_FETCH_ISOLATION_KEY }
-    );
+    const upstream = await daemonFetch(target, {
+      method,
+      headers,
+      body
+    });
     if (upstream.status >= 500) {
       const transportError = transportNormalizedErrorForHttpStatus(target, upstream.status, registration.launchId);
       logger.warn(
@@ -7221,9 +7140,7 @@ var LOOPBACK_NO_PROXY = "127.0.0.1,localhost";
 var CLI_TRANSPORT_TRACE_DIR_ENV = "SLOCK_CLI_TRANSPORT_TRACE_DIR";
 var safePathPart = (value) => value.replace(/[^a-zA-Z0-9_.-]/g, "_");
 var RAW_CREDENTIAL_ENV_DENYLIST = [
-  "SLOCK_AGENT_TOKEN",
-  "SLOCK_AGENT_CREDENTIAL_KEY",
-  "SLOCK_AGENT_CREDENTIAL_KEY_FILE"
+  "SLOCK_AGENT_CREDENTIAL_KEY"
 ];
 var WORKSPACE_CLI_TRANSPORT_FILENAMES = [
   "agent-token",
@@ -7564,7 +7481,6 @@ set "SLOCK_AGENT_ACTIVE_CAPABILITIES=${DEFAULT_ACTIVE_CAPABILITIES}"\r
   }
   const wrapperPath = platform === "win32" ? path2.join(slockDir, "slock.cmd") : posixWrapper;
   const launchRuntimeFields = runtimeConfigToLaunchFields(hydrateRuntimeConfig(ctx.config));
-  const provisionSignedGitEnv = ctx.config.name?.trim() ? buildProvisionSignedGitEnv(ctx.config.name) : {};
   const spawnEnv = {
     ...process.env,
     FORCE_COLOR: "0",
@@ -7572,7 +7488,6 @@ set "SLOCK_AGENT_ACTIVE_CAPABILITIES=${DEFAULT_ACTIVE_CAPABILITIES}"\r
     ...extraEnv,
     ...platform === "win32" ? windowsUtf8Env() : {},
     ...runtimeContextEnv(ctx.config),
-    ...provisionSignedGitEnv,
     [SLOCK_HOME_ENV]: slockHome,
     SLOCK_AGENT_ID: ctx.agentId,
     ...ctx.launchId ? { SLOCK_AGENT_LAUNCH_ID: ctx.launchId } : {},
@@ -7580,7 +7495,7 @@ set "SLOCK_AGENT_ACTIVE_CAPABILITIES=${DEFAULT_ACTIVE_CAPABILITIES}"\r
     SLOCK_SERVER_URL: ctx.config.serverUrl,
     PATH: `${slockDir}${path2.delimiter}${process.env.PATH ?? ""}`
   };
-  scrubDaemonChildEnv(spawnEnv);
+  delete spawnEnv.SLOCK_AGENT_TOKEN;
   for (const key of RAW_CREDENTIAL_ENV_DENYLIST) {
     delete spawnEnv[key];
   }
@@ -8188,7 +8103,7 @@ function requiresWindowsShell(command, platform = process.platform) {
 }
 function resolveCommandOnPath(command, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
+  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   const existsSyncFn = deps.existsSyncFn ?? existsSync3;
   if (platform === "win32") {
@@ -8214,7 +8129,7 @@ function firstExistingPath(candidates, deps = {}) {
   return null;
 }
 function readCommandVersion(command, args = [], deps = {}) {
-  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
+  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   try {
     const output = normalizeExecOutput(execFileSyncFn(command, [...args, "--version"], {
@@ -8688,7 +8603,7 @@ function codexNotificationDiagnosticEvent(message) {
       return null;
   }
   const sessionId = codexMessageThreadId(message);
-  const path25 = boundedString(params.path);
+  const path24 = boundedString(params.path);
   return {
     kind: "runtime_diagnostic",
     severity: "warning",
@@ -8696,7 +8611,7 @@ function codexNotificationDiagnosticEvent(message) {
     itemType: message.method,
     message: diagnosticMessage,
     ...details ? { details } : {},
-    ...path25 ? { path: path25 } : {},
+    ...path24 ? { path: path24 } : {},
     ...params.range !== void 0 ? { range: params.range } : {},
     payloadBytes: payloadBytes(params),
     ...sessionId ? { sessionId } : {}
@@ -10418,11 +10333,11 @@ function detectCursorModels(runCommand = runCursorModelsCommand) {
   return parseCursorModelsOutput(String(result.stdout || ""));
 }
 function buildCursorModelProbeEnv(deps = {}) {
-  return scrubDaemonChildEnv(withWindowsUserEnvironment({
+  return withWindowsUserEnvironment({
     ...deps.env ?? process.env,
     FORCE_COLOR: "0",
     NO_COLOR: "1"
-  }, deps));
+  }, deps);
 }
 function runCursorModelsCommand() {
   return spawnSync("cursor-agent", ["models"], {
@@ -10478,7 +10393,7 @@ function resolveGeminiSpawn(commandArgs, deps = {}) {
   }
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync3;
   const existsSyncFn = deps.existsSyncFn ?? existsSync5;
-  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
+  const env = deps.env ?? process.env;
   const winPath = path8.win32;
   let geminiEntry = null;
   try {
@@ -10615,15 +10530,12 @@ var GeminiDriver = class {
 // src/drivers/kimi.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { spawn as spawn7 } from "child_process";
-import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import os4 from "os";
 import path9 from "path";
 var KIMI_WIRE_PROTOCOL_VERSION = "1.3";
 var KIMI_SYSTEM_PROMPT_FILE = ".slock-kimi-system.md";
 var KIMI_AGENT_FILE = ".slock-kimi-agent.yaml";
-var KIMI_GENERATED_CONFIG_FILE = ".slock-kimi-config.toml";
-var SLOCK_KIMI_CONFIG_CONTENT_ENV = "SLOCK_KIMI_CONFIG_CONTENT";
-var SLOCK_KIMI_CONFIG_FILE_ENV = "SLOCK_KIMI_CONFIG_FILE";
 function parseToolArguments(raw) {
   if (typeof raw !== "string") return raw;
   try {
@@ -10632,73 +10544,6 @@ function parseToolArguments(raw) {
     return raw;
   }
 }
-function readKimiConfigSource(home = os4.homedir(), env = process.env) {
-  const inlineConfig = env[SLOCK_KIMI_CONFIG_CONTENT_ENV];
-  if (inlineConfig && inlineConfig.trim()) {
-    return {
-      raw: inlineConfig,
-      explicitPath: null,
-      sourcePath: SLOCK_KIMI_CONFIG_CONTENT_ENV
-    };
-  }
-  const explicitPath = env[SLOCK_KIMI_CONFIG_FILE_ENV];
-  const configPath = explicitPath && explicitPath.trim() ? explicitPath : path9.join(home, ".kimi", "config.toml");
-  try {
-    return {
-      raw: readFileSync3(configPath, "utf8"),
-      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
-      sourcePath: configPath
-    };
-  } catch {
-    return {
-      raw: null,
-      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
-      sourcePath: configPath
-    };
-  }
-}
-function buildKimiSpawnEnv(env = process.env) {
-  const spawnEnv = { ...env, FORCE_COLOR: "0", NO_COLOR: "1" };
-  delete spawnEnv[SLOCK_KIMI_CONFIG_CONTENT_ENV];
-  delete spawnEnv[SLOCK_KIMI_CONFIG_FILE_ENV];
-  return scrubDaemonChildEnv(spawnEnv);
-}
-function buildKimiEffectiveEnv(ctx, overrideEnv) {
-  return {
-    ...process.env,
-    ...ctx.config.envVars || {},
-    ...overrideEnv || {}
-  };
-}
-function buildKimiLaunchOptions(ctx, opts = {}) {
-  const env = buildKimiEffectiveEnv(ctx, opts.env);
-  const source = readKimiConfigSource(opts.home ?? os4.homedir(), env);
-  const args = [];
-  let configFilePath = null;
-  let configContent = null;
-  if (source.explicitPath) {
-    configFilePath = source.explicitPath;
-  } else if (source.raw !== null && source.sourcePath === SLOCK_KIMI_CONFIG_CONTENT_ENV) {
-    configFilePath = path9.join(ctx.workingDirectory, KIMI_GENERATED_CONFIG_FILE);
-    configContent = source.raw;
-    if (opts.writeGeneratedConfig !== false) {
-      writeFileSync3(configFilePath, source.raw, { encoding: "utf8", mode: 384 });
-      chmodSync(configFilePath, 384);
-    }
-  }
-  if (configFilePath) {
-    args.push("--config-file", configFilePath);
-  }
-  if (ctx.config.model && ctx.config.model !== "default") {
-    args.push("--model", ctx.config.model);
-  }
-  return {
-    args,
-    env: buildKimiSpawnEnv(env),
-    configFilePath,
-    configContent
-  };
-}
 function resolveKimiSpawn(commandArgs, deps = {}) {
   return {
     command: resolveCommandOnPath("kimi", deps) ?? "kimi",
@@ -10722,25 +10567,7 @@ var KimiDriver = class {
   };
   model = {
     detectedModelsVerifiedAs: "launchable",
-    toLaunchSpec: (modelId, ctx, opts) => {
-      if (!ctx) return { args: ["--model", modelId] };
-      const launchCtx = {
-        ...ctx,
-        config: {
-          ...ctx.config,
-          model: modelId
-        }
-      };
-      const launch = buildKimiLaunchOptions(launchCtx, {
-        home: opts?.home,
-        writeGeneratedConfig: false
-      });
-      return {
-        args: launch.args,
-        env: launch.env,
-        configFiles: launch.configFilePath ? [launch.configFilePath] : void 0
-      };
-    }
+    toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
   };
   supportsStdinNotification = true;
   busyDeliveryMode = "direct";
@@ -10764,23 +10591,21 @@ var KimiDriver = class {
       `  system_prompt_path: ./${KIMI_SYSTEM_PROMPT_FILE}`,
       ""
     ].join("\n"), "utf8");
-    const launch = buildKimiLaunchOptions(ctx);
     const args = [
       "--wire",
       "--yolo",
       "--agent-file",
       agentFilePath,
       "--session",
-      this.sessionId,
-      ...launch.args
+      this.sessionId
     ];
     const launchRuntimeFields = runtimeConfigToLaunchFields(hydrateRuntimeConfig(ctx.config));
     if (launchRuntimeFields.model && launchRuntimeFields.model !== "default") {
       args.push("--model", launchRuntimeFields.model);
     }
     const spawnEnv = (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
-    const spawnTarget = resolveKimiSpawn(args);
-    const proc = spawn7(spawnTarget.command, spawnTarget.args, {
+    const launch = resolveKimiSpawn(args);
+    const proc = spawn7(launch.command, launch.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -10788,7 +10613,7 @@ var KimiDriver = class {
       // and has an 8191-character command-line limit. Kimi's official
       // installer/uv entrypoint is an executable, so launch it directly and
       // keep prompts on stdin / files instead of routing through cmd.exe.
-      shell: spawnTarget.shell
+      shell: launch.shell
     });
     proc.stdin?.write(JSON.stringify({
       jsonrpc: "2.0",
@@ -10901,9 +10726,14 @@ var KimiDriver = class {
     return detectKimiModels();
   }
 };
-function detectKimiModels(home = os4.homedir(), opts = {}) {
-  const raw = readKimiConfigSource(home, opts.env).raw;
-  if (raw === null) return null;
+function detectKimiModels(home = os4.homedir()) {
+  const configPath = path9.join(home, ".kimi", "config.toml");
+  let raw;
+  try {
+    raw = readFileSync3(configPath, "utf8");
+  } catch {
+    return null;
+  }
   const models = [];
   const sectionRe = /^\s*\[models(?:\.([^\]]+)|"\.[^"]+"|\."[^"]+")\s*\]\s*$/gm;
   const lineRe = /^\s*\[models\.(.+?)\s*\]\s*$/gm;
@@ -10929,7 +10759,6 @@ import { mkdirSync as mkdirSync2, readFileSync as readFileSync4 } from "fs";
 import path10 from "path";
 import { createRequire as createRequire2 } from "module";
 import {
-  LocalKaos,
   createKimiHarness,
   resolveKimiHome
 } from "@botiverse/kimi-code-sdk";
@@ -11095,7 +10924,6 @@ So instead of \`raft message send ...\`, run \`${wrapperPath} message send ...\`
 }
 async function createKimiAgentSessionForContext(ctx, sessionId, deps = {}) {
   const createHarnessImpl = deps.createHarness ?? createKimiHarness;
-  const createKaosImpl = deps.createKaos ?? LocalKaos.create;
   const prepareTransportImpl = deps.prepareTransport ?? prepareCliTransport;
   const sessionDir = buildKimiSessionDir(ctx.workingDirectory);
   mkdirSync2(sessionDir, { recursive: true });
@@ -11114,10 +10942,8 @@ async function createKimiAgentSessionForContext(ctx, sessionId, deps = {}) {
   });
   const launchRuntimeFields = runtimeConfigToLaunchFields(hydrateRuntimeConfig(ctx.config));
   const roleAdditional = composeStandingRoleAdditional(ctx.standingPrompt, wrapperPath);
-  const kaos = (await createKaosImpl()).withEnv(buildProvisionSignedGitEnv(ctx.config.name));
   const sessionFields = {
     workDir: ctx.workingDirectory,
-    kaos,
     ...launchRuntimeFields.model && launchRuntimeFields.model !== "default" ? { model: launchRuntimeFields.model } : {},
     ...roleAdditional ? { roleAdditional } : {}
   };
@@ -11592,7 +11418,7 @@ function runOpenCodeModelsCommand(home, deps = {}) {
   const platform = deps.platform ?? process.platform;
   const spawnSyncFn = deps.spawnSyncFn ?? spawnSync2;
   const result = spawnSyncFn("opencode", ["models"], {
-    env: scrubDaemonChildEnv({ ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" }),
+    env: { ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" },
     encoding: "utf8",
     timeout: 5e3,
     shell: platform === "win32"
@@ -12952,27 +12778,8 @@ async function reapOrphanProcesses(pids, logger2, recordTrace) {
 }
 
 // src/workspaces.ts
-import { access, mkdir, readdir, rm, stat, writeFile } from "fs/promises";
+import { readdir, rm, stat } from "fs/promises";
 import path13 from "path";
-async function initializeAgentWorkspace(workspacePath, initialMemoryMd, seedFiles) {
-  await mkdir(workspacePath, { recursive: true });
-  const memoryMdPath = path13.join(workspacePath, "MEMORY.md");
-  try {
-    await access(memoryMdPath);
-  } catch {
-    await writeFile(memoryMdPath, initialMemoryMd);
-  }
-  await mkdir(path13.join(workspacePath, "notes"), { recursive: true });
-  for (const { relativePath, content } of seedFiles) {
-    const fullPath = path13.join(workspacePath, relativePath);
-    try {
-      await access(fullPath);
-    } catch {
-      await mkdir(path13.dirname(fullPath), { recursive: true });
-      await writeFile(fullPath, content);
-    }
-  }
-}
 function isValidWorkspaceDirectoryName(directoryName) {
   return !directoryName.includes("/") && !directoryName.includes("\\") && !directoryName.includes("..");
 }
@@ -13079,120 +12886,6 @@ async function deleteWorkspaceDirectory(dataDir, directoryName) {
   }
 }
 
-// src/workspaceGitIdentity.ts
-import { execFile } from "child_process";
-import { readdir as readdir2, realpath } from "fs/promises";
-import path14 from "path";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
-var DISCOVERY_SKIP_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
-var RepositoryOwnershipError = class extends Error {
-};
-async function runGit(repoPath, args) {
-  const { stdout } = await execFileAsync("git", ["-C", repoPath, ...args], {
-    encoding: "utf8"
-  });
-  return stdout.trim();
-}
-function isPathInside(rootPath, candidatePath) {
-  const relative = path14.relative(rootPath, candidatePath);
-  return relative === "" || !relative.startsWith(`..${path14.sep}`) && relative !== ".." && !path14.isAbsolute(relative);
-}
-async function inspectGitRepository(repoPath, ownedRootPath) {
-  try {
-    const [gitDirOutput, commonDirOutput] = await Promise.all([
-      runGit(repoPath, ["rev-parse", "--absolute-git-dir"]),
-      runGit(repoPath, ["rev-parse", "--git-common-dir"])
-    ]);
-    const [canonicalRepoPath, gitDir, commonDir] = await Promise.all([
-      realpath(repoPath),
-      realpath(gitDirOutput),
-      realpath(
-        path14.isAbsolute(commonDirOutput) ? commonDirOutput : path14.resolve(repoPath, commonDirOutput)
-      )
-    ]);
-    if (!isPathInside(ownedRootPath, canonicalRepoPath) || !isPathInside(ownedRootPath, gitDir) || !isPathInside(ownedRootPath, commonDir)) {
-      throw new RepositoryOwnershipError(
-        `Refusing to provision git identity outside the agent-owned workspace: ${repoPath}`
-      );
-    }
-    return { repoPath, linkedWorktree: gitDir !== commonDir };
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      throw new Error("git is required to provision repository identity", { cause: error });
-    }
-    if (error instanceof RepositoryOwnershipError) {
-      throw error;
-    }
-    return null;
-  }
-}
-async function discoverWorkspaceGitRepositories(workspacePath) {
-  const repositories = [];
-  const pending = [workspacePath];
-  while (pending.length > 0) {
-    const currentPath = pending.pop();
-    const entries = await readdir2(currentPath, { withFileTypes: true });
-    if (entries.some((entry) => entry.name === ".git")) {
-      repositories.push(currentPath);
-    }
-    for (const entry of entries) {
-      if (!entry.isDirectory() || DISCOVERY_SKIP_DIRECTORIES.has(entry.name)) {
-        continue;
-      }
-      pending.push(path14.join(currentPath, entry.name));
-    }
-  }
-  return repositories.sort();
-}
-async function reconcileWorkspaceGitIdentity(workspacePath, agentName) {
-  const identity = resolveAgentGitIdentity(agentName);
-  const ownedRootPath = await realpath(workspacePath);
-  const repositories = await discoverWorkspaceGitRepositories(workspacePath);
-  const result = {
-    discovered: repositories.length,
-    configuredStandalone: 0,
-    configuredLinkedWorktree: 0,
-    skippedInvalid: 0
-  };
-  const layouts = [];
-  for (const repoPath of repositories) {
-    const layout = await inspectGitRepository(repoPath, ownedRootPath);
-    if (!layout) {
-      result.skippedInvalid += 1;
-      continue;
-    }
-    layouts.push(layout);
-  }
-  for (const layout of layouts) {
-    const { repoPath } = layout;
-    if (layout.linkedWorktree) {
-      await runGit(repoPath, ["config", "--local", "extensions.worktreeConfig", "true"]);
-      await runGit(repoPath, ["config", "--worktree", "user.name", identity.name]);
-      await runGit(repoPath, ["config", "--worktree", "user.email", identity.email]);
-      result.configuredLinkedWorktree += 1;
-      continue;
-    }
-    await runGit(repoPath, ["config", "--local", "user.name", identity.name]);
-    await runGit(repoPath, ["config", "--local", "user.email", identity.email]);
-    result.configuredStandalone += 1;
-  }
-  return result;
-}
-async function provisionWorkspaceGitIdentity(workspacePath, agentId, agentName) {
-  const result = await reconcileWorkspaceGitIdentity(workspacePath, agentName);
-  if (result.discovered > 0) {
-    logger.info(
-      `[Agent ${agentId}] Git identity provisioned for ${result.configuredStandalone} standalone repositories and ${result.configuredLinkedWorktree} linked worktrees`
-    );
-  }
-  if (result.skippedInvalid > 0) {
-    logger.warn(
-      `[Agent ${agentId}] Skipped ${result.skippedInvalid} invalid git repository markers while provisioning identity`
-    );
-  }
-}
-
 // src/agentStartCoordinator.ts
 var AgentStartCoordinator = class {
   starting = /* @__PURE__ */ new Set();
@@ -14696,7 +14389,7 @@ function isWorkspaceNeverVisibleHiddenEntry(name) {
   return WORKSPACE_NEVER_VISIBLE_HIDDEN_NAMES.has(name) || name.startsWith(".slock-");
 }
 function workspacePathParts(relativePath) {
-  return relativePath.split(path15.sep).filter(Boolean);
+  return relativePath.split(path14.sep).filter(Boolean);
 }
 function isWorkspaceHiddenPath(relativePath) {
   return workspacePathParts(relativePath).some((part) => part.startsWith("."));
@@ -14823,29 +14516,29 @@ function allowedTranscriptRootsForRuntime(runtime, homeDir, workspaceDir) {
   const roots = [workspaceDir];
   switch (runtime) {
     case "claude":
-      roots.push(path15.join(homeDir, ".claude"));
+      roots.push(path14.join(homeDir, ".claude"));
       break;
     case "codex":
-      roots.push(homeDir, path15.join(homeDir, ".codex"));
+      roots.push(homeDir, path14.join(homeDir, ".codex"));
       break;
     case "kimi":
     case "kimi-sdk":
-      roots.push(path15.join(homeDir, ".kimi"));
+      roots.push(path14.join(homeDir, ".kimi"));
       break;
     case "pi":
-      roots.push(path15.join(homeDir, ".pi"), path15.join(homeDir, ".pi", "agent"));
+      roots.push(path14.join(homeDir, ".pi"), path14.join(homeDir, ".pi", "agent"));
       break;
   }
   return roots;
 }
 async function isPathWithinAllowedRoots(filePath, roots) {
-  const real = await realpath2(filePath).catch(() => null);
+  const real = await realpath(filePath).catch(() => null);
   if (!real) return false;
   for (const root of roots) {
-    const realRoot = await realpath2(root).catch(() => null);
+    const realRoot = await realpath(root).catch(() => null);
     if (!realRoot) continue;
-    const rel = path15.relative(realRoot, real);
-    if (!rel.startsWith("..") && !path15.isAbsolute(rel)) return true;
+    const rel = path14.relative(realRoot, real);
+    if (!rel.startsWith("..") && !path14.isAbsolute(rel)) return true;
   }
   return false;
 }
@@ -14892,12 +14585,12 @@ function findSessionJsonl(root, predicate) {
     for (const entry of entries) {
       if (++visited > maxEntries) return null;
       if (!entry.isFile() || !predicate(entry.name)) continue;
-      return path15.join(dir, entry.name);
+      return path14.join(dir, entry.name);
     }
     for (const entry of entries) {
       if (++visited > maxEntries) return null;
       if (!entry.isDirectory()) continue;
-      const found = visit(path15.join(dir, entry.name), depth - 1);
+      const found = visit(path14.join(dir, entry.name), depth - 1);
       if (found) return found;
     }
     return null;
@@ -14905,7 +14598,7 @@ function findSessionJsonl(root, predicate) {
   return visit(root, maxDepth);
 }
 function findKimiSdkSessionDir(sessionId, agentId, homeDir) {
-  const indexPath = path15.join(homeDir, ".kimi", "session_index.jsonl");
+  const indexPath = path14.join(homeDir, ".kimi", "session_index.jsonl");
   try {
     const index = readFileSync6(indexPath, "utf8");
     for (const line of index.split("\n")) {
@@ -14920,12 +14613,12 @@ function findKimiSdkSessionDir(sessionId, agentId, homeDir) {
     }
   } catch {
   }
-  const sessionsRoot = path15.join(homeDir, ".kimi", "sessions");
+  const sessionsRoot = path14.join(homeDir, ".kimi", "sessions");
   try {
     const prefix = agentId ? `wd_${agentId}_` : `wd_`;
     for (const entry of readdirSync4(sessionsRoot, { withFileTypes: true })) {
       if (!entry.isDirectory() || !entry.name.startsWith(prefix)) continue;
-      const candidate = path15.join(sessionsRoot, entry.name, `session_${sessionId}`);
+      const candidate = path14.join(sessionsRoot, entry.name, `session_${sessionId}`);
       if (existsSync8(candidate)) return candidate;
     }
   } catch {
@@ -14934,16 +14627,16 @@ function findKimiSdkSessionDir(sessionId, agentId, homeDir) {
 }
 function findPiSessionFile2(sessionId, workingDirectory, homeDir) {
   if (workingDirectory) {
-    const piSessionsDir = path15.join(workingDirectory, ".pi-sessions");
+    const piSessionsDir = path14.join(workingDirectory, ".pi-sessions");
     try {
-      const files = readdirSync4(piSessionsDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => ({ name: e.name, path: path15.join(piSessionsDir, e.name), stat: statSync(path15.join(piSessionsDir, e.name)) })).filter((f) => f.stat.isFile() && f.name.includes(sessionId)).sort((a, b) => b.stat.mtimeMs - a.stat.mtimeMs);
+      const files = readdirSync4(piSessionsDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".jsonl")).map((e) => ({ name: e.name, path: path14.join(piSessionsDir, e.name), stat: statSync(path14.join(piSessionsDir, e.name)) })).filter((f) => f.stat.isFile() && f.name.includes(sessionId)).sort((a, b) => b.stat.mtimeMs - a.stat.mtimeMs);
       if (files[0]) return files[0].path;
     } catch {
     }
   }
   const legacyRoots = [
-    path15.join(homeDir, ".pi", "agent"),
-    path15.join(homeDir, ".pi")
+    path14.join(homeDir, ".pi", "agent"),
+    path14.join(homeDir, ".pi")
   ];
   for (const root of legacyRoots) {
     const found = findSessionJsonl(root, (filename) => filename.endsWith(".jsonl") && filename.includes(sessionId));
@@ -14957,9 +14650,9 @@ function safeSessionFilename(value) {
 }
 function writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir, join, resolve) {
   try {
-    const dir = path15.join(fallbackDir, ".slock", "runtime-sessions");
+    const dir = path14.join(fallbackDir, ".slock", "runtime-sessions");
     mkdirSync4(dir, { recursive: true });
-    const filePath = path15.join(dir, `${runtime}-${safeSessionFilename(sessionId)}.jsonl`);
+    const filePath = path14.join(dir, `${runtime}-${safeSessionFilename(sessionId)}.jsonl`);
     const searchedPaths = resolve?.searchedPaths ?? [];
     writeFileSync4(filePath, JSON.stringify({
       type: "runtime_session_handoff",
@@ -15014,7 +14707,7 @@ function resolveRuntimeSessionRef(runtime, sessionId, homeDir = os6.homedir(), f
   const searchedPaths = [];
   if (runtime === "claude") {
     lookupMethod = "claude_jsonl";
-    const claudeRoot = path15.join(homeDir, ".claude", "projects");
+    const claudeRoot = path14.join(homeDir, ".claude", "projects");
     searchedPaths.push(claudeRoot);
     resolvedPath = findSessionJsonl(claudeRoot, (filename) => filename === `${sessionId}.jsonl`);
   } else if (runtime === "codex") {
@@ -16386,7 +16079,7 @@ var AgentProcessManager = class _AgentProcessManager {
     this.sendToServer = sendToServer;
     this.daemonApiKey = daemonApiKey;
     this.serverUrl = opts.serverUrl;
-    this.slockHome = opts.slockHome ? path15.resolve(opts.slockHome) : resolveSlockHome();
+    this.slockHome = opts.slockHome ? path14.resolve(opts.slockHome) : resolveSlockHome();
     this.dataDir = opts.dataDir || resolveSlockHomePath("agents", this.slockHome);
     this.runtimeSessionHomeDir = opts.runtimeSessionHomeDir || os6.homedir();
     this.driverResolver = opts.driverResolver || getDriver;
@@ -17701,13 +17394,30 @@ var AgentProcessManager = class _AgentProcessManager {
     let pendingStartRebind;
     const originalLaunchId = launchId || null;
     try {
-      const agentDataDir = path15.join(this.dataDir, agentId);
+      const agentDataDir = path14.join(this.dataDir, agentId);
+      await mkdir(agentDataDir, { recursive: true });
       const initialRuntimeConfig = withLocalRuntimeContext(config, agentId, agentDataDir);
-      await initializeAgentWorkspace(
-        agentDataDir,
-        buildInitialMemoryMd(initialRuntimeConfig),
-        getOnboardingSeedMode(config) === FIRST_CINDY_SEED_MODE ? buildOnboardingSeedFiles() : []
-      );
+      const memoryMdPath = path14.join(agentDataDir, "MEMORY.md");
+      try {
+        await access(memoryMdPath);
+      } catch {
+        const initialMemoryMd = buildInitialMemoryMd(initialRuntimeConfig);
+        await writeFile(memoryMdPath, initialMemoryMd);
+      }
+      const notesDir = path14.join(agentDataDir, "notes");
+      await mkdir(notesDir, { recursive: true });
+      if (getOnboardingSeedMode(config) === FIRST_CINDY_SEED_MODE) {
+        const seedFiles = buildOnboardingSeedFiles();
+        for (const { relativePath, content } of seedFiles) {
+          const fullPath = path14.join(agentDataDir, relativePath);
+          try {
+            await access(fullPath);
+          } catch {
+            await mkdir(path14.dirname(fullPath), { recursive: true });
+            await writeFile(fullPath, content);
+          }
+        }
+      }
       pendingStartRebind = this.lifecycleRecords.getPendingStartRebind(agentId);
       if (pendingStartRebind) {
         this.lifecycleRecords.deletePendingStartRebind(agentId);
@@ -17730,7 +17440,6 @@ var AgentProcessManager = class _AgentProcessManager {
           wakeMessageTransient = pendingStartRebind.wakeMessageTransient === true;
         }
       }
-      await provisionWorkspaceGitIdentity(agentDataDir, agentId, config.name);
       this.enterNoProcessResidency(
         "starting_process",
         this.noProcessResidencyIdentity(agentId, config, launchId, this.startLaunchSource(config, wakeMessage, resumePrompt)),
@@ -18480,26 +18189,36 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
   async buildSpawnConfig(agentId, config) {
     const baseConfig = config.serverUrl === this.serverUrl ? config : { ...config, serverUrl: this.serverUrl };
     const runnerConfig = await this.ensureManagedRunnerCredential(agentId, baseConfig);
-    let effectiveConfig = runnerConfig;
-    if (this.defaultAgentEnvVarsProvider) {
-      try {
-        const defaultEnvVars = await this.defaultAgentEnvVarsProvider({
-          runtime: runnerConfig.runtime,
-          model: runnerConfig.model,
-          envVars: runnerConfig.envVars
-        });
-        const mergedEnvVars = { ...defaultEnvVars ?? {}, ...runnerConfig.envVars ?? {} };
-        if (!this.sameEnvVars(mergedEnvVars, runnerConfig.envVars)) {
-          effectiveConfig = { ...runnerConfig, envVars: mergedEnvVars };
-        }
-      } catch (error) {
-        const reason = error instanceof Error ? error.message : String(error);
-        logger.warn(
-          `[Agent ${agentId}] Failed to resolve default runtime env vars \u2014 continuing without machine-level defaults (${reason})`
-        );
+    if (!this.defaultAgentEnvVarsProvider) {
+      return runnerConfig;
+    }
+    try {
+      const defaultEnvVars = await this.defaultAgentEnvVarsProvider({
+        runtime: runnerConfig.runtime,
+        model: runnerConfig.model,
+        envVars: runnerConfig.envVars
+      });
+      if (!defaultEnvVars || Object.keys(defaultEnvVars).length === 0) {
+        return runnerConfig;
+      }
+      const mergedEnvVars = {
+        ...defaultEnvVars,
+        ...runnerConfig.envVars ?? {}
+      };
+      if (this.sameEnvVars(mergedEnvVars, runnerConfig.envVars)) {
+        return runnerConfig;
       }
+      return {
+        ...runnerConfig,
+        envVars: mergedEnvVars
+      };
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      logger.warn(
+        `[Agent ${agentId}] Failed to resolve default runtime env vars \u2014 continuing without machine-level defaults (${reason})`
+      );
+      return runnerConfig;
     }
-    return withProvisionSignedGitEnv(effectiveConfig);
   }
   async requestManagedRunnerCredentialOnce(agentId, config) {
     const url = new URL(`/internal/computer/runners/${encodeURIComponent(agentId)}/credentials`, this.serverUrl);
@@ -19238,7 +18957,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     return true;
   }
   async resetWorkspace(agentId) {
-    const agentDataDir = path15.join(this.dataDir, agentId);
+    const agentDataDir = path14.join(this.dataDir, agentId);
     try {
       await rm2(agentDataDir, { recursive: true, force: true });
       logger.info(`[Agent ${agentId}] Workspace reset complete (${agentDataDir})`);
@@ -19320,7 +19039,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     return result;
   }
   buildRuntimeProfileReport(agentId, config, sessionId, launchId, observedRuntimeHomeDir, processInstanceId) {
-    const workspacePath = path15.join(this.dataDir, agentId);
+    const workspacePath = path14.join(this.dataDir, agentId);
     const runtimeHomeDir = observedRuntimeHomeDir || resolveRuntimeHomeDir(config, this.runtimeSessionHomeDir, workspacePath, { agentId, slockHome: this.slockHome });
     return {
       agentId,
@@ -19656,7 +19375,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
   }
   // Workspace file browsing
   async getFileTree(agentId, dirPath, includeHidden = false) {
-    const agentDir = path15.join(this.dataDir, agentId);
+    const agentDir = path14.join(this.dataDir, agentId);
     try {
       await stat2(agentDir);
     } catch {
@@ -19664,11 +19383,11 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     }
     let targetDir = agentDir;
     if (dirPath) {
-      const resolved = path15.resolve(agentDir, dirPath);
-      if (!resolved.startsWith(agentDir + path15.sep) && resolved !== agentDir) {
+      const resolved = path14.resolve(agentDir, dirPath);
+      if (!resolved.startsWith(agentDir + path14.sep) && resolved !== agentDir) {
         return [];
       }
-      const relativePath = path15.relative(agentDir, resolved);
+      const relativePath = path14.relative(agentDir, resolved);
       if (isWorkspaceNeverVisibleHiddenPath(relativePath)) {
         return [];
       }
@@ -19680,18 +19399,18 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     return this.listDirectoryChildren(targetDir, agentDir, includeHidden);
   }
   async readFile(agentId, filePath) {
-    const agentDir = path15.join(this.dataDir, agentId);
-    const resolved = path15.resolve(agentDir, filePath);
-    if (!resolved.startsWith(agentDir + path15.sep) && resolved !== agentDir) {
+    const agentDir = path14.join(this.dataDir, agentId);
+    const resolved = path14.resolve(agentDir, filePath);
+    if (!resolved.startsWith(agentDir + path14.sep) && resolved !== agentDir) {
       throw new Error("Access denied");
     }
-    const relativePath = path15.relative(agentDir, resolved);
+    const relativePath = path14.relative(agentDir, resolved);
     if (isWorkspaceNeverVisibleHiddenPath(relativePath) || isWorkspaceSecretFilePath(relativePath)) {
       throw new Error("Preview is disabled for sensitive workspace files");
     }
     const info = await stat2(resolved);
     if (info.isDirectory()) throw new Error("Cannot read a directory");
-    const ext = path15.extname(resolved).toLowerCase();
+    const ext = path14.extname(resolved).toLowerCase();
     if (WORKSPACE_TEXT_EXTENSIONS.has(ext) || ext === "") {
       if (info.size > WORKSPACE_TEXT_FILE_MAX_BYTES) throw new Error("File too large");
       const content = await readFile(resolved, "utf-8");
@@ -19742,7 +19461,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
       };
     }
     const runtime = config.runtime;
-    const workspaceDir = path15.join(this.dataDir, agentId);
+    const workspaceDir = path14.join(this.dataDir, agentId);
     const homeDir = agent?.runtime.currentRuntimeHomeDir || ensureRuntimeHomeDir(config, this.runtimeSessionHomeDir, workspaceDir, { agentId, slockHome: this.slockHome });
     if (!actualSessionId) {
       return {
@@ -19783,7 +19502,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     let redacted = false;
     if (ref.reachable && ref.path) {
       try {
-        const resolved = path15.resolve(ref.path);
+        const resolved = path14.resolve(ref.path);
         const allowedRoots = allowedTranscriptRootsForRuntime(runtime, homeDir, workspaceDir);
         if (!await isPathWithinAllowedRoots(resolved, allowedRoots)) {
           throw new Error("resolved session path is outside allowed runtime directories");
@@ -19794,7 +19513,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
           throw new Error("symbolic links are not allowed");
         }
         if (info.isDirectory()) {
-          targetPath = path15.join(resolved, "state.json");
+          targetPath = path14.join(resolved, "state.json");
         }
         if (!await isPathWithinAllowedRoots(targetPath, allowedRoots)) {
           throw new Error("resolved session state path is outside allowed runtime directories");
@@ -19906,17 +19625,17 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
     const idle = this.lifecycleRecords.getRestartSnapshot(agentId);
     const config = agent?.config ?? idle?.config ?? null;
     const runtime = runtimeHint || config?.runtime || "claude";
-    const workspaceDir = path15.join(this.dataDir, agentId);
+    const workspaceDir = path14.join(this.dataDir, agentId);
     const hostHome = os6.homedir();
     const home = agent?.runtime.currentRuntimeHomeDir || (config ? ensureRuntimeHomeDir(config, hostHome, workspaceDir, { agentId, slockHome: this.slockHome }) : runtime === "codex" ? resolveCodexHomeRootFromEnv(process.env, { defaultHomeDir: hostHome, cwd: workspaceDir }) : hostHome);
     const paths = _AgentProcessManager.SKILL_PATHS[runtime] || _AgentProcessManager.SKILL_PATHS.claude;
     const globalDirs = runtime === "codex" ? [
-      path15.join(home, "skills"),
-      path15.join(home, "skills", ".system"),
-      path15.join(home, ".agents", "skills"),
-      ...hasConfiguredCodexHome(config) ? [] : [path15.join(hostHome, ".agents", "skills")]
-    ] : paths.global.map((p) => path15.join(home, p));
-    const workspaceDirs = paths.workspace.map((p) => path15.join(workspaceDir, p));
+      path14.join(home, "skills"),
+      path14.join(home, "skills", ".system"),
+      path14.join(home, ".agents", "skills"),
+      ...hasConfiguredCodexHome(config) ? [] : [path14.join(hostHome, ".agents", "skills")]
+    ] : paths.global.map((p) => path14.join(home, p));
+    const workspaceDirs = paths.workspace.map((p) => path14.join(workspaceDir, p));
     const globalResults = await Promise.all(
       globalDirs.map((dir) => this.scanSkillsDir(dir))
     );
@@ -19943,14 +19662,14 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
   async scanSkillsDir(dir) {
     let entries;
     try {
-      entries = await readdir3(dir, { withFileTypes: true });
+      entries = await readdir2(dir, { withFileTypes: true });
     } catch {
       return [];
     }
     const skills = [];
     for (const entry of entries) {
       if (entry.isDirectory() || entry.isSymbolicLink()) {
-        const skillMd = path15.join(dir, entry.name, "SKILL.md");
+        const skillMd = path14.join(dir, entry.name, "SKILL.md");
         try {
           const content = await readFile(skillMd, "utf-8");
           const skill = this.parseSkillMd(entry.name, content);
@@ -19961,7 +19680,7 @@ Use \`raft message read\` to catch up on the channels listed above, then stop. R
       } else if (entry.name.endsWith(".md")) {
         const cmdName = entry.name.replace(/\.md$/, "");
         try {
-          const content = await readFile(path15.join(dir, entry.name), "utf-8");
+          const content = await readFile(path14.join(dir, entry.name), "utf-8");
           const skill = this.parseSkillMd(cmdName, content);
           skill.sourcePath = dir;
           skills.push(skill);
@@ -22029,7 +21748,7 @@ ${RESPONSE_TARGET_HINT}`);
   async listDirectoryChildren(dir, rootDir, includeHidden = false) {
     let entries;
     try {
-      entries = await readdir3(dir, { withFileTypes: true });
+      entries = await readdir2(dir, { withFileTypes: true });
     } catch {
       return [];
     }
@@ -22043,8 +21762,8 @@ ${RESPONSE_TARGET_HINT}`);
       const isHidden = entry.name.startsWith(".");
       if (entry.name === "node_modules") continue;
       if (isHidden && (!includeHidden || isWorkspaceNeverVisibleHiddenEntry(entry.name))) continue;
-      const fullPath = path15.join(dir, entry.name);
-      const relativePath = path15.relative(rootDir, fullPath);
+      const fullPath = path14.join(dir, entry.name);
+      const relativePath = path14.relative(rootDir, fullPath);
       let info;
       try {
         info = await stat2(fullPath);
@@ -22513,7 +22232,7 @@ var ReminderCache = class {
 import { createHash as createHash4, randomUUID as randomUUID7 } from "crypto";
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
 import os7 from "os";
-import path16 from "path";
+import path15 from "path";
 var INCOMPLETE_LOCK_STALE_MS = 3e4;
 var DaemonMachineLockConflictError = class extends Error {
   code = "DAEMON_MACHINE_LOCK_HELD";
@@ -22535,7 +22254,7 @@ function resolveDefaultMachineStateRoot() {
   return resolveSlockHomePath("machines");
 }
 function ownerPath(lockDir) {
-  return path16.join(lockDir, "owner.json");
+  return path15.join(lockDir, "owner.json");
 }
 function readOwner(lockDir) {
   try {
@@ -22565,8 +22284,8 @@ function acquireDaemonMachineLock(options) {
   const rootDir = options.rootDir ?? resolveDefaultMachineStateRoot();
   const fingerprint = apiKeyFingerprint(options.apiKey);
   const lockId = getDaemonMachineLockId(options.apiKey);
-  const machineDir = path16.join(rootDir, lockId);
-  const lockDir = path16.join(machineDir, "daemon.lock");
+  const machineDir = path15.join(rootDir, lockId);
+  const lockDir = path15.join(machineDir, "daemon.lock");
   const token = randomUUID7();
   mkdirSync5(machineDir, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt += 1) {
@@ -22627,7 +22346,7 @@ function acquireDaemonMachineLock(options) {
 
 // ../trace-client/src/localTraceSink.ts
 import { appendFileSync, mkdirSync as mkdirSync6, readdirSync as readdirSync5, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
-import path17 from "path";
+import path16 from "path";
 var DEFAULT_MAX_FILE_BYTES = 5 * 1024 * 1024;
 var DEFAULT_MAX_FILE_AGE_MS = 5 * 60 * 1e3;
 var DEFAULT_MAX_FILES = 8;
@@ -22672,7 +22391,7 @@ var LocalRotatingTraceSink = class {
   currentSize = 0;
   sequence = 0;
   constructor(options) {
-    this.traceDir = path17.join(options.machineDir, "traces");
+    this.traceDir = path16.join(options.machineDir, "traces");
     this.maxFileBytes = Math.max(1024, Math.floor(options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES));
     const baseAgeMs = Math.max(1e3, Math.floor(options.maxFileAgeMs ?? DEFAULT_MAX_FILE_AGE_MS));
     const ageJitterMs = Math.max(0, Math.floor(options.maxFileAgeJitterMs ?? 0));
@@ -22702,7 +22421,7 @@ var LocalRotatingTraceSink = class {
     const nowMs = this.nowMsProvider();
     const shouldRotateForAge = this.currentFileOpenedAtMs !== null && nowMs - this.currentFileOpenedAtMs >= this.maxFileAgeMs;
     if (!this.currentFile || this.currentSize + nextBytes > this.maxFileBytes || shouldRotateForAge) {
-      this.currentFile = path17.join(
+      this.currentFile = path16.join(
         this.traceDir,
         `daemon-trace-${safeTimestamp(nowMs)}-${process.pid}-${String(this.sequence++).padStart(4, "0")}.jsonl`
       );
@@ -22717,7 +22436,7 @@ var LocalRotatingTraceSink = class {
     const excess = files.length - this.maxFiles;
     if (excess <= 0) return;
     for (const file of files.slice(0, excess)) {
-      rmSync4(path17.join(this.traceDir, file), { force: true });
+      rmSync4(path16.join(this.traceDir, file), { force: true });
     }
   }
 };
@@ -22893,8 +22612,8 @@ function createTraceClient(options) {
 // src/traceBundleUpload.ts
 import { createHash as createHash6, randomUUID as randomUUID8 } from "crypto";
 import { gzipSync as gzipSync2 } from "zlib";
-import { mkdir as mkdir2, readFile as readFile2, readdir as readdir4, stat as stat3, writeFile as writeFile2 } from "fs/promises";
-import path18 from "path";
+import { mkdir as mkdir2, readFile as readFile2, readdir as readdir3, stat as stat3, writeFile as writeFile2 } from "fs/promises";
+import path17 from "path";
 var TRACE_UPLOAD_SCOPE = "daemon-trace-bundle:create";
 var DEFAULT_UPLOAD_INTERVAL_MS = 5 * 60 * 1e3;
 var DEFAULT_MIN_FILE_AGE_MS = 60 * 1e3;
@@ -22977,10 +22696,10 @@ var DaemonTraceBundleUploader = class {
     }, nextMs);
   }
   async findUploadCandidates() {
-    const traceDir = path18.join(this.options.machineDir, "traces");
+    const traceDir = path17.join(this.options.machineDir, "traces");
     let names;
     try {
-      names = await readdir4(traceDir);
+      names = await readdir3(traceDir);
     } catch {
       return [];
     }
@@ -22989,8 +22708,8 @@ var DaemonTraceBundleUploader = class {
     const currentFile = this.options.currentFileProvider?.();
     const candidates = [];
     for (const name of names.filter((entry) => entry.startsWith("daemon-trace-") && entry.endsWith(".jsonl")).sort()) {
-      const file = path18.join(traceDir, name);
-      if (currentFile && path18.resolve(file) === path18.resolve(currentFile)) continue;
+      const file = path17.join(traceDir, name);
+      if (currentFile && path17.resolve(file) === path17.resolve(currentFile)) continue;
       if (await this.isUploaded(file)) continue;
       try {
         const info = await stat3(file);
@@ -23068,8 +22787,8 @@ var DaemonTraceBundleUploader = class {
     }
   }
   uploadStatePath(file) {
-    const stateDir = path18.join(this.options.machineDir, "trace-uploads");
-    return path18.join(stateDir, `${path18.basename(file)}.uploaded.json`);
+    const stateDir = path17.join(this.options.machineDir, "trace-uploads");
+    return path17.join(stateDir, `${path17.basename(file)}.uploaded.json`);
   }
   async isUploaded(file) {
     try {
@@ -23081,9 +22800,9 @@ var DaemonTraceBundleUploader = class {
   }
   async markUploaded(file, metadata) {
     const stateFile = this.uploadStatePath(file);
-    await mkdir2(path18.dirname(stateFile), { recursive: true, mode: 448 });
+    await mkdir2(path17.dirname(stateFile), { recursive: true, mode: 448 });
     await writeFile2(stateFile, `${JSON.stringify({
-      file: path18.basename(file),
+      file: path17.basename(file),
       uploadedAt: (/* @__PURE__ */ new Date()).toISOString(),
       ...metadata
     }, null, 2)}
@@ -23102,7 +22821,7 @@ function readPositiveIntegerEnv2(name, fallback) {
 
 // src/computerMigrationGuard.ts
 import { existsSync as existsSync9, readdirSync as readdirSync6, readFileSync as readFileSync9 } from "fs";
-import path19 from "path";
+import path18 from "path";
 
 // src/legacySupervisor.ts
 import { execFileSync as execFileSync4 } from "child_process";
@@ -23289,7 +23008,7 @@ function daemonApiKeyFingerprint(apiKey) {
   return getDaemonMachineLockId(apiKey).slice("machine-".length);
 }
 function findAdoptedComputerForLegacyFingerprint(slockHome, legacyApiKeyFingerprint) {
-  const serversDir = path19.join(slockHome, "computer", "servers");
+  const serversDir = path18.join(slockHome, "computer", "servers");
   if (!existsSync9(serversDir)) return null;
   let serverDirs;
   try {
@@ -23298,7 +23017,7 @@ function findAdoptedComputerForLegacyFingerprint(slockHome, legacyApiKeyFingerpr
     return null;
   }
   for (const serverId of serverDirs) {
-    const attachmentPath = path19.join(serversDir, serverId, "runner.state.json");
+    const attachmentPath = path18.join(serversDir, serverId, "runner.state.json");
     let raw;
     try {
       raw = readFileSync9(attachmentPath, "utf8");
@@ -23849,7 +23568,7 @@ function onceDrain(res) {
 import { createHash as createHash9 } from "crypto";
 import { createReadStream as createReadStream2, createWriteStream } from "fs";
 import { lstat as lstat3, mkdir as mkdir3, readlink as readlink2, rm as rm3, symlink } from "fs/promises";
-import path21 from "path";
+import path20 from "path";
 import { Transform } from "stream";
 import { pipeline } from "stream/promises";
 import { createGunzip, createGzip } from "zlib";
@@ -23858,8 +23577,8 @@ import { extract, pack } from "tar-stream";
 // src/agentMigrationExport.ts
 import { createHash as createHash8 } from "crypto";
 import { createReadStream } from "fs";
-import { lstat as lstat2, readdir as readdir5, readFile as readFile3, readlink } from "fs/promises";
-import path20 from "path";
+import { lstat as lstat2, readdir as readdir4, readFile as readFile3, readlink } from "fs/promises";
+import path19 from "path";
 var AGENT_MIGRATION_BUNDLE_SCHEMA_VERSION = "agent-bundle/v1";
 var REGENERABLE_DIRECTORY_NAMES = [
   ".cache",
@@ -23883,8 +23602,8 @@ var SECRET_FILE_NAMES = /* @__PURE__ */ new Set([
 ]);
 var ENV_KEY_PATTERN = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
 async function buildAgentMigrationExportManifest(input) {
-  const slockHome = path20.resolve(input.slockHome);
-  const workspace = path20.resolve(input.workspacePath ?? path20.join(slockHome, "agents", input.agentId));
+  const slockHome = path19.resolve(input.slockHome);
+  const workspace = path19.resolve(input.workspacePath ?? path19.join(slockHome, "agents", input.agentId));
   const proposedIncludes = normalizeProposalPaths(input.cooperativeManifest?.include, workspace, "include");
   const proposedRegenerableExcludes = normalizeProposalPaths(input.cooperativeManifest?.exclude_regenerable, workspace, "exclude_regenerable");
   const cleanedProposal = normalizeProposalPaths(input.cooperativeManifest?.cleaned, workspace, "cleaned");
@@ -23945,10 +23664,10 @@ async function buildAgentMigrationExportManifest(input) {
   };
 }
 async function walkWorkspace(root, relativeDir, proposedRegenerableExcludes, state, opts) {
-  const absoluteDir = path20.join(root, relativeDir);
+  const absoluteDir = path19.join(root, relativeDir);
   let entries;
   try {
-    entries = await readdir5(absoluteDir, { withFileTypes: true });
+    entries = await readdir4(absoluteDir, { withFileTypes: true });
   } catch {
     state.unreachable.push({
       path: relativeDir || ".",
@@ -23959,7 +23678,7 @@ async function walkWorkspace(root, relativeDir, proposedRegenerableExcludes, sta
   }
   entries.sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of entries) {
-    const relativePath = toPosixPath(path20.join(relativeDir, entry.name));
+    const relativePath = toPosixPath(path19.join(relativeDir, entry.name));
     if (entry.isDirectory()) {
       if (!opts.forceIncludeRegenerable && isRegenerablePath(relativePath)) {
         if (state.explicitIncludePaths.has(relativePath)) {
@@ -23986,7 +23705,7 @@ async function walkWorkspace(root, relativeDir, proposedRegenerableExcludes, sta
 async function includeWorkspacePath(workspaceRelativePath, state, opts) {
   const normalizedRelativePath = normalizeRelativePath(workspaceRelativePath);
   if (state.seenWorkspacePaths.has(normalizedRelativePath)) return;
-  const sourcePath = path20.join(state.workspace, normalizedRelativePath);
+  const sourcePath = path19.join(state.workspace, normalizedRelativePath);
   let stat5;
   try {
     stat5 = await lstat2(sourcePath);
@@ -24003,7 +23722,7 @@ async function includeWorkspacePath(workspaceRelativePath, state, opts) {
       state.excludedRegenerable.push({
         path: normalizedRelativePath,
         reason: "cooperative_exclude_regenerable",
-        regenerableHint: `${path20.basename(normalizedRelativePath)} is treated as rebuildable/installable state and is not bundled by default`
+        regenerableHint: `${path19.basename(normalizedRelativePath)} is treated as rebuildable/installable state and is not bundled by default`
       });
       return;
     }
@@ -24050,8 +23769,8 @@ async function includeWorkspacePath(workspaceRelativePath, state, opts) {
 async function buildCrossTreeRefs(refs) {
   const result = [];
   for (const ref of refs) {
-    const sourcePath = path20.resolve(ref.path);
-    const bundlePath = `runtime/${safeBundleSegment(ref.runtime)}/${safeBundleSegment(ref.label)}/${safeBundleSegment(path20.basename(sourcePath) || "session")}`;
+    const sourcePath = path19.resolve(ref.path);
+    const bundlePath = `runtime/${safeBundleSegment(ref.runtime)}/${safeBundleSegment(ref.label)}/${safeBundleSegment(path19.basename(sourcePath) || "session")}`;
     const entry = {
       runtime: ref.runtime,
       label: ref.label,
@@ -24084,7 +23803,7 @@ async function sha256File(filePath) {
   return hash.digest("hex");
 }
 async function detectSecretShapes(sourcePath, relativePath) {
-  const basename = path20.basename(relativePath);
+  const basename = path19.basename(relativePath);
   const lowerBasename = basename.toLowerCase();
   const shapes = /* @__PURE__ */ new Set();
   if (SECRET_FILE_NAMES.has(lowerBasename) || lowerBasename.startsWith(".env.")) {
@@ -24117,9 +23836,9 @@ function normalizeProposalPaths(paths, workspace, source) {
   for (const value of paths) {
     const trimmed = value.trim();
     if (!trimmed) continue;
-    if (path20.isAbsolute(trimmed)) {
-      const relative = path20.relative(workspace, trimmed);
-      if (relative.startsWith("..") || path20.isAbsolute(relative)) {
+    if (path19.isAbsolute(trimmed)) {
+      const relative = path19.relative(workspace, trimmed);
+      if (relative.startsWith("..") || path19.isAbsolute(relative)) {
         refusals.push({
           path: trimmed,
           reason: "outside_workspace",
@@ -24151,8 +23870,8 @@ function normalizeProposalPaths(paths, workspace, source) {
   return { paths: [...new Set(result)], refusals };
 }
 function normalizeRelativePath(value) {
-  const normalized = path20.normalize(value).replace(/^[\\/]+/, "");
-  if (!normalized || normalized === "." || normalized.startsWith("..") || path20.isAbsolute(normalized)) {
+  const normalized = path19.normalize(value).replace(/^[\\/]+/, "");
+  if (!normalized || normalized === "." || normalized.startsWith("..") || path19.isAbsolute(normalized)) {
     throw new Error(`unsafe migration export path: ${value}`);
   }
   return toPosixPath(normalized);
@@ -24171,7 +23890,7 @@ function safeBundleSegment(value) {
   return value.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "unknown";
 }
 function toPosixPath(value) {
-  return value.split(path20.sep).join("/");
+  return value.split(path19.sep).join("/");
 }
 function sortBundleEntries(entries) {
   return [...entries].sort((a, b) => a.bundlePath.localeCompare(b.bundlePath));
@@ -24200,7 +23919,7 @@ var AgentMigrationObjectStoreBundleTooLargeError = class extends Error {
 };
 async function buildAgentMigrationObjectStoreBundle(input) {
   assertPositiveMaxBytes(input.maxBytes);
-  const workspacePath = path21.resolve(input.workspacePath);
+  const workspacePath = path20.resolve(input.workspacePath);
   const manifest = await buildAgentMigrationExportManifest({
     agentId: input.agentId,
     slockHome: input.slockHome,
@@ -24233,8 +23952,8 @@ async function buildAgentMigrationObjectStoreBundle(input) {
 }
 async function stageAgentMigrationObjectStoreBundle(input) {
   assertPositiveMaxBytes(input.maxBytes);
-  const stagingWorkspacePath = path21.join(
-    path21.resolve(input.slockHome),
+  const stagingWorkspacePath = path20.join(
+    path20.resolve(input.slockHome),
     "migrations",
     sanitizePathSegment(input.sessionId),
     "workspace"
@@ -24306,7 +24025,7 @@ async function writeArchive(tarPack, manifestBuffer, manifest, workspacePath) {
       throw new Error("MIGRATION_OBJECT_STORE_UNSUPPORTED_ENTRY");
     }
     const relativePath = normalizeWorkspaceRelativePath(entry.workspaceRelativePath);
-    const sourcePath = path21.resolve(entry.sourcePath);
+    const sourcePath = path20.resolve(entry.sourcePath);
     const archivePath = `${ARCHIVE_WORKSPACE_PREFIX}${relativePath}`;
     if (entry.kind === "symlink") {
       await writeBufferedEntry(tarPack, {
@@ -24356,8 +24075,8 @@ async function handleArchiveEntry(input) {
   const expected = input.getExpectedEntries().get(relativePath);
   if (!expected) throw new Error(`MIGRATION_OBJECT_STORE_ARCHIVE_ENTRY_UNEXPECTED:${relativePath}`);
   input.extractedEntries.add(relativePath);
-  const targetPath = path21.join(input.stagingWorkspacePath, relativePath);
-  await mkdir3(path21.dirname(targetPath), { recursive: true });
+  const targetPath = path20.join(input.stagingWorkspacePath, relativePath);
+  await mkdir3(path20.dirname(targetPath), { recursive: true });
   if (expected.kind === "symlink") {
     if (input.header.type !== "symlink" || input.header.linkname !== expected.linkTarget) {
       throw new Error(`MIGRATION_OBJECT_STORE_LINK_TARGET_MISMATCH:${relativePath}`);
@@ -24474,8 +24193,8 @@ function encodeAccountingPath(value) {
   return encoded;
 }
 function normalizeWorkspaceRelativePath(relativePath) {
-  const normalized = path21.posix.normalize(relativePath.replaceAll("\\", "/"));
-  if (normalized === "." || normalized.startsWith("../") || normalized === ".." || path21.isAbsolute(normalized)) {
+  const normalized = path20.posix.normalize(relativePath.replaceAll("\\", "/"));
+  if (normalized === "." || normalized.startsWith("../") || normalized === ".." || path20.isAbsolute(normalized)) {
     throw new Error("MIGRATION_OBJECT_STORE_UNSAFE_PATH");
   }
   return normalized;
@@ -24536,15 +24255,15 @@ function sanitizePathSegment(value) {
 import { createHash as createHash10 } from "crypto";
 import { createReadStream as createReadStream3 } from "fs";
 import { access as access2, cp, lstat as lstat4, mkdir as mkdir4, readlink as readlink3, rename, writeFile as writeFile3 } from "fs/promises";
-import path22 from "path";
+import path21 from "path";
 async function buildAgentMigrationAdoptPlan(input) {
-  const slockHome = path22.resolve(input.slockHome);
+  const slockHome = path21.resolve(input.slockHome);
   let manifest;
   if (input.sourceKind === "orphan_directory" && !input.manifest) {
     manifest = await buildAgentMigrationExportManifest({
       agentId: input.agentId,
       slockHome,
-      workspacePath: path22.resolve(input.orphanWorkspacePath),
+      workspacePath: path21.resolve(input.orphanWorkspacePath),
       mode: "forensic",
       now: input.now
     });
@@ -24557,11 +24276,11 @@ async function buildAgentMigrationAdoptPlan(input) {
     manifest,
     expectedAgentId: input.sourceKind === "orphan_directory" ? input.agentId : manifest.agentId
   });
-  const sourceWorkspacePath = path22.resolve(
+  const sourceWorkspacePath = path21.resolve(
     input.sourceKind === "staged_bundle" ? input.stagingWorkspacePath : input.orphanWorkspacePath
   );
-  const finalWorkspacePath = path22.resolve(input.finalWorkspacePath ?? path22.join(slockHome, "agents", manifest.agentId));
-  const reportPath = path22.resolve(input.reportPath ?? path22.join(
+  const finalWorkspacePath = path21.resolve(input.finalWorkspacePath ?? path21.join(slockHome, "agents", manifest.agentId));
+  const reportPath = path21.resolve(input.reportPath ?? path21.join(
     slockHome,
     "migrations",
     sanitizePathSegment2(input.generation.grantKey),
@@ -24686,7 +24405,7 @@ async function verifyManifestFileEntry(sourceWorkspacePath, entry) {
     throw new Error("MIGRATION_MANIFEST_ENTRY_NOT_WORKSPACE");
   }
   const relative = normalizeWorkspaceRelativePath2(entry.workspaceRelativePath);
-  const entryPath = path22.join(sourceWorkspacePath, relative);
+  const entryPath = path21.join(sourceWorkspacePath, relative);
   const info = await lstat4(entryPath).catch(() => null);
   if (!info) throw new Error("MIGRATION_MANIFEST_FILE_MISSING");
   if (entry.kind === "symlink") {
@@ -24705,14 +24424,14 @@ async function verifyManifestFileEntry(sourceWorkspacePath, entry) {
   }
 }
 function normalizeWorkspaceRelativePath2(relativePath) {
-  const normalized = path22.posix.normalize(relativePath.replaceAll("\\", "/"));
-  if (normalized === "." || normalized.startsWith("../") || normalized === ".." || path22.isAbsolute(normalized)) {
+  const normalized = path21.posix.normalize(relativePath.replaceAll("\\", "/"));
+  if (normalized === "." || normalized.startsWith("../") || normalized === ".." || path21.isAbsolute(normalized)) {
     throw new Error("MIGRATION_MANIFEST_UNSAFE_PATH");
   }
   return normalized;
 }
 async function assertFinalWorkspaceAvailable(sourceWorkspacePath, finalWorkspacePath) {
-  if (path22.resolve(sourceWorkspacePath) === path22.resolve(finalWorkspacePath)) return;
+  if (path21.resolve(sourceWorkspacePath) === path21.resolve(finalWorkspacePath)) return;
   try {
     await access2(finalWorkspacePath);
     throw new Error("MIGRATION_WORKSPACE_ALREADY_EXISTS");
@@ -24721,9 +24440,9 @@ async function assertFinalWorkspaceAvailable(sourceWorkspacePath, finalWorkspace
   }
 }
 async function placeWorkspace(sourceWorkspacePath, finalWorkspacePath) {
-  if (path22.resolve(sourceWorkspacePath) === path22.resolve(finalWorkspacePath)) return;
+  if (path21.resolve(sourceWorkspacePath) === path21.resolve(finalWorkspacePath)) return;
   const stagingPath = `${finalWorkspacePath}.migration-${process.pid}-${Date.now()}`;
-  await mkdir4(path22.dirname(finalWorkspacePath), { recursive: true });
+  await mkdir4(path21.dirname(finalWorkspacePath), { recursive: true });
   await cp(sourceWorkspacePath, stagingPath, {
     recursive: true,
     dereference: false,
@@ -24736,7 +24455,7 @@ async function placeWorkspace(sourceWorkspacePath, finalWorkspacePath) {
 async function writeArrivalReport(reportPath, report) {
   const payload = `${canonicalJson3(report)}
 `;
-  await mkdir4(path22.dirname(reportPath), { recursive: true });
+  await mkdir4(path21.dirname(reportPath), { recursive: true });
   await writeFile3(reportPath, payload, { mode: 384 });
   return sha256Buffer3(Buffer.from(payload, "utf8"));
 }
@@ -24767,8 +24486,8 @@ function sanitizePathSegment2(value) {
 }
 
 // src/secretFile.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "fs";
-import path23 from "path";
+import { chmodSync, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "fs";
+import path22 from "path";
 function readSecretFileSync(filePath) {
   return readFileSync10(filePath, "utf8").trim();
 }
@@ -25041,13 +24760,13 @@ function readDaemonVersion(moduleUrl = import.meta.url) {
   }
 }
 function resolveSlockCliPath(moduleUrl = import.meta.url) {
-  const thisDir = path24.dirname(fileURLToPath(moduleUrl));
-  const bundledDistPath = path24.resolve(thisDir, "cli", "index.js");
+  const thisDir = path23.dirname(fileURLToPath(moduleUrl));
+  const bundledDistPath = path23.resolve(thisDir, "cli", "index.js");
   try {
     accessSync(bundledDistPath);
     return bundledDistPath;
   } catch {
-    const workspaceDistPath = path24.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
+    const workspaceDistPath = path23.resolve(thisDir, "..", "..", "cli", "dist", "index.js");
     accessSync(workspaceDistPath);
     return workspaceDistPath;
   }
@@ -25061,7 +24780,7 @@ function resolveSlockCliPathOrEmpty(moduleUrl = import.meta.url) {
 }
 async function runBundledSlockCli(argv) {
   process.argv = [process.execPath, "slock", ...argv];
-  await import("./dist-FTGVGDYA.js");
+  await import("./dist-54TOXXOV.js");
 }
 function detectRuntimes(tracer = noopTracer) {
   const ids = [];
@@ -25289,7 +25008,7 @@ var DaemonCore = class {
   }
   resolveMachineStateRoot() {
     if (this.options.machineStateDir) return this.options.machineStateDir;
-    if (this.options.dataDir) return path24.join(path24.dirname(this.options.dataDir), "machines");
+    if (this.options.dataDir) return path23.join(path23.dirname(this.options.dataDir), "machines");
     return resolveDefaultMachineStateRoot();
   }
   shouldEnableLocalTrace() {
@@ -25317,7 +25036,7 @@ var DaemonCore = class {
       sinks: [this.localTraceSink]
     }));
     this.agentManager.setTracer(this.tracer);
-    this.agentManager.setCliTransportTraceDir(path24.join(machineDir, "traces"));
+    this.agentManager.setCliTransportTraceDir(path23.join(machineDir, "traces"));
   }
   installTraceBundleUploader(machineDir) {
     if (!this.shouldEnableLocalTrace()) return;
@@ -25641,11 +25360,11 @@ var DaemonCore = class {
     const built = await buildAgentMigrationObjectStoreBundle({
       agentId: lease.agentId,
       slockHome: this.slockHome,
-      workspacePath: path24.join(this.agentsDataDir, lease.agentId),
+      workspacePath: path23.join(this.agentsDataDir, lease.agentId),
       maxBytes: lease.maxBytes
     });
-    const spoolDirectory = await mkdtemp(path24.join(os8.tmpdir(), "raft-agent-migration-upload-"));
-    const spoolPath = path24.join(spoolDirectory, "bundle.tar.gz");
+    const spoolDirectory = await mkdtemp(path23.join(os8.tmpdir(), "raft-agent-migration-upload-"));
+    const spoolPath = path23.join(spoolDirectory, "bundle.tar.gz");
     let archiveBytes = 0;
     let uploadStatus = 0;
     try {
@@ -25708,7 +25427,7 @@ var DaemonCore = class {
       sourceKind: "staged_bundle",
       slockHome: this.slockHome,
       stagingWorkspacePath: staged.stagingWorkspacePath,
-      finalWorkspacePath: path24.join(this.agentsDataDir, lease.agentId),
+      finalWorkspacePath: path23.join(this.agentsDataDir, lease.agentId),
       manifest: staged.manifest,
       manifestSha256: staged.manifestSha256,
       generation: {