@buildautomaton/cli 0.1.14 → 0.1.16

package/dist/cli.js

@@ -972,10 +972,10 @@ var require_suggestSimilar = __commonJS({
 var require_command = __commonJS({
   "../../node_modules/.pnpm/commander@12.1.0/node_modules/commander/lib/command.js"(exports) {
     var EventEmitter2 = __require("node:events").EventEmitter;
-    var childProcess = __require("node:child_process");
-    var path32 = __require("node:path");
-    var fs25 = __require("node:fs");
-    var process2 = __require("node:process");
+    var childProcess2 = __require("node:child_process");
+    var path34 = __require("node:path");
+    var fs31 = __require("node:fs");
+    var process8 = __require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
     var { Help: Help2 } = require_help();
@@ -1021,10 +1021,10 @@ var require_command = __commonJS({
         this._showHelpAfterError = false;
         this._showSuggestionAfterError = true;
         this._outputConfiguration = {
-          writeOut: (str) => process2.stdout.write(str),
-          writeErr: (str) => process2.stderr.write(str),
-          getOutHelpWidth: () => process2.stdout.isTTY ? process2.stdout.columns : void 0,
-          getErrHelpWidth: () => process2.stderr.isTTY ? process2.stderr.columns : void 0,
+          writeOut: (str) => process8.stdout.write(str),
+          writeErr: (str) => process8.stderr.write(str),
+          getOutHelpWidth: () => process8.stdout.isTTY ? process8.stdout.columns : void 0,
+          getErrHelpWidth: () => process8.stderr.isTTY ? process8.stderr.columns : void 0,
           outputError: (str, write) => write(str)
         };
         this._hidden = false;
@@ -1403,7 +1403,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._exitCallback) {
           this._exitCallback(new CommanderError2(exitCode, code, message));
         }
-        process2.exit(exitCode);
+        process8.exit(exitCode);
       }
       /**
        * Register callback `fn` for the command.
@@ -1801,16 +1801,16 @@ Expecting one of '${allowedValues.join("', '")}'`);
         }
         parseOptions = parseOptions || {};
         if (argv === void 0 && parseOptions.from === void 0) {
-          if (process2.versions?.electron) {
+          if (process8.versions?.electron) {
             parseOptions.from = "electron";
           }
-          const execArgv = process2.execArgv ?? [];
+          const execArgv = process8.execArgv ?? [];
           if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
             parseOptions.from = "eval";
           }
         }
         if (argv === void 0) {
-          argv = process2.argv;
+          argv = process8.argv;
         }
         this.rawArgs = argv.slice();
         let userArgs;
@@ -1821,7 +1821,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
             userArgs = argv.slice(2);
             break;
           case "electron":
-            if (process2.defaultApp) {
+            if (process8.defaultApp) {
               this._scriptPath = argv[1];
               userArgs = argv.slice(2);
             } else {
@@ -1906,11 +1906,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path32.resolve(baseDir, baseName);
-          if (fs25.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path32.extname(baseName))) return void 0;
+          const localBin = path34.resolve(baseDir, baseName);
+          if (fs31.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path34.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs25.existsSync(`${localBin}${ext}`)
+            (ext) => fs31.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1922,21 +1922,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs25.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs31.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path32.resolve(
-            path32.dirname(resolvedScriptPath),
+          executableDir = path34.resolve(
+            path34.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path32.basename(
+            const legacyName = path34.basename(
               this._scriptPath,
-              path32.extname(this._scriptPath)
+              path34.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -1947,25 +1947,25 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path32.extname(executableFile));
+        launchWithNode = sourceExt.includes(path34.extname(executableFile));
         let proc;
-        if (process2.platform !== "win32") {
+        if (process8.platform !== "win32") {
           if (launchWithNode) {
             args.unshift(executableFile);
-            args = incrementNodeInspectorPort(process2.execArgv).concat(args);
-            proc = childProcess.spawn(process2.argv[0], args, { stdio: "inherit" });
+            args = incrementNodeInspectorPort(process8.execArgv).concat(args);
+            proc = childProcess2.spawn(process8.argv[0], args, { stdio: "inherit" });
           } else {
-            proc = childProcess.spawn(executableFile, args, { stdio: "inherit" });
+            proc = childProcess2.spawn(executableFile, args, { stdio: "inherit" });
           }
         } else {
           args.unshift(executableFile);
-          args = incrementNodeInspectorPort(process2.execArgv).concat(args);
-          proc = childProcess.spawn(process2.execPath, args, { stdio: "inherit" });
+          args = incrementNodeInspectorPort(process8.execArgv).concat(args);
+          proc = childProcess2.spawn(process8.execPath, args, { stdio: "inherit" });
         }
         if (!proc.killed) {
           const signals = ["SIGUSR1", "SIGUSR2", "SIGTERM", "SIGINT", "SIGHUP"];
           signals.forEach((signal) => {
-            process2.on(signal, () => {
+            process8.on(signal, () => {
               if (proc.killed === false && proc.exitCode === null) {
                 proc.kill(signal);
               }
@@ -1976,7 +1976,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         proc.on("close", (code) => {
           code = code ?? 1;
           if (!exitCallback) {
-            process2.exit(code);
+            process8.exit(code);
           } else {
             exitCallback(
               new CommanderError2(
@@ -1999,7 +1999,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
             throw new Error(`'${executableFile}' not executable`);
           }
           if (!exitCallback) {
-            process2.exit(1);
+            process8.exit(1);
           } else {
             const wrappedError = new CommanderError2(
               1,
@@ -2491,13 +2491,13 @@ Expecting one of '${allowedValues.join("', '")}'`);
        */
       _parseOptionsEnv() {
         this.options.forEach((option) => {
-          if (option.envVar && option.envVar in process2.env) {
+          if (option.envVar && option.envVar in process8.env) {
             const optionKey = option.attributeName();
             if (this.getOptionValue(optionKey) === void 0 || ["default", "config", "env"].includes(
               this.getOptionValueSource(optionKey)
             )) {
               if (option.required || option.optional) {
-                this.emit(`optionEnv:${option.name()}`, process2.env[option.envVar]);
+                this.emit(`optionEnv:${option.name()}`, process8.env[option.envVar]);
               } else {
                 this.emit(`optionEnv:${option.name()}`);
               }
@@ -2787,7 +2787,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path32.basename(filename, path32.extname(filename));
+        this._name = path34.basename(filename, path34.extname(filename));
         return this;
       }
       /**
@@ -2801,9 +2801,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path33) {
-        if (path33 === void 0) return this._executableDir;
-        this._executableDir = path33;
+      executableDir(path35) {
+        if (path35 === void 0) return this._executableDir;
+        this._executableDir = path35;
         return this;
       }
       /**
@@ -2926,7 +2926,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        */
       help(contextOptions) {
         this.outputHelp(contextOptions);
-        let exitCode = process2.exitCode || 0;
+        let exitCode = process8.exitCode || 0;
         if (exitCode === 0 && contextOptions && typeof contextOptions !== "function" && contextOptions.error) {
           exitCode = 1;
         }
@@ -5236,7 +5236,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes, createHash: createHash2 } = __require("crypto");
+    var { randomBytes: randomBytes3, createHash: createHash3 } = __require("crypto");
     var { Duplex, Readable: Readable2 } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -5766,7 +5766,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes(16).toString("base64");
+      const key = randomBytes3(16).toString("base64");
       const request = isSecure ? https2.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -5896,7 +5896,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -6175,7 +6175,7 @@ var require_stream = __commonJS({
       };
       duplex._final = function(callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open() {
+          ws.once("open", function open2() {
             duplex._final(callback);
           });
           return;
@@ -6196,7 +6196,7 @@ var require_stream = __commonJS({
       };
       duplex._write = function(chunk, encoding, callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open() {
+          ws.once("open", function open2() {
             duplex._write(chunk, encoding, callback);
           });
           return;
@@ -6263,7 +6263,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter2 = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash2 } = __require("crypto");
+    var { createHash: createHash3 } = __require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -6564,7 +6564,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -7129,7 +7129,7 @@ var require_has_flag = __commonJS({
 var require_supports_color = __commonJS({
   "../../node_modules/.pnpm/supports-color@7.2.0/node_modules/supports-color/index.js"(exports, module) {
     "use strict";
-    var os5 = __require("os");
+    var os6 = __require("os");
     var tty = __require("tty");
     var hasFlag = require_has_flag();
     var { env } = process;
@@ -7177,7 +7177,7 @@ var require_supports_color = __commonJS({
         return min;
       }
       if (process.platform === "win32") {
-        const osRelease = os5.release().split(".");
+        const osRelease = os6.release().split(".");
         if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
           return Number(osRelease[2]) >= 14931 ? 3 : 2;
         }
@@ -7423,15 +7423,15 @@ var require_src2 = __commonJS({
     var fs_1 = __require("fs");
     var debug_1 = __importDefault(require_src());
     var log2 = debug_1.default("@kwsites/file-exists");
-    function check2(path32, isFile, isDirectory) {
-      log2(`checking %s`, path32);
+    function check2(path34, isFile, isDirectory) {
+      log2(`checking %s`, path34);
       try {
-        const stat2 = fs_1.statSync(path32);
-        if (stat2.isFile() && isFile) {
+        const stat3 = fs_1.statSync(path34);
+        if (stat3.isFile() && isFile) {
           log2(`[OK] path represents a file`);
           return true;
         }
-        if (stat2.isDirectory() && isDirectory) {
+        if (stat3.isDirectory() && isDirectory) {
           log2(`[OK] path represents a directory`);
           return true;
         }
@@ -7446,8 +7446,8 @@ var require_src2 = __commonJS({
         throw e;
       }
     }
-    function exists2(path32, type = exports.READABLE) {
-      return check2(path32, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
+    function exists2(path34, type = exports.READABLE) {
+      return check2(path34, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
     }
     exports.exists = exists2;
     exports.FILE = 1;
@@ -7922,8 +7922,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path32, errorMaps, issueData } = params;
-      const fullPath = [...path32, ...issueData.path || []];
+      const { data, path: path34, errorMaps, issueData } = params;
+      const fullPath = [...path34, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -8231,11 +8231,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util2();
     ParseInputLazyPath = class {
-      constructor(parent, value, path32, key) {
+      constructor(parent, value, path34, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path32;
+        this._path = path34;
         this._key = key;
       }
       get path() {
@@ -11850,10 +11850,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path32) {
-  if (!path32)
+function getElementAtPath(obj, path34) {
+  if (!path34)
     return obj;
-  return path32.reduce((acc, key) => acc?.[key], obj);
+  return path34.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -12102,11 +12102,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path32, issues) {
+function prefixIssues(path34, issues) {
   return issues.map((iss) => {
     var _a2;
     (_a2 = iss).path ?? (_a2.path = []);
-    iss.path.unshift(path32);
+    iss.path.unshift(path34);
     return iss;
   });
 }
@@ -12295,7 +12295,7 @@ function treeifyError(error40, _mapper) {
     return issue2.message;
   };
   const result = { errors: [] };
-  const processError = (error41, path32 = []) => {
+  const processError = (error41, path34 = []) => {
     var _a2, _b;
     for (const issue2 of error41.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
@@ -12305,7 +12305,7 @@ function treeifyError(error40, _mapper) {
       } else if (issue2.code === "invalid_element") {
         processError({ issues: issue2.issues }, issue2.path);
       } else {
-        const fullpath = [...path32, ...issue2.path];
+        const fullpath = [...path34, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -12335,9 +12335,9 @@ function treeifyError(error40, _mapper) {
   processError(error40);
   return result;
 }
-function toDotPath(path32) {
+function toDotPath(path34) {
   const segs = [];
-  for (const seg of path32) {
+  for (const seg of path34) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -24800,8 +24800,8 @@ var init_acp = __esm({
         this.#requestHandler = requestHandler;
         this.#notificationHandler = notificationHandler;
         this.#stream = stream;
-        this.#closedPromise = new Promise((resolve16) => {
-          this.#abortController.signal.addEventListener("abort", () => resolve16());
+        this.#closedPromise = new Promise((resolve17) => {
+          this.#abortController.signal.addEventListener("abort", () => resolve17());
         });
         this.#receive();
       }
@@ -24950,8 +24950,8 @@ var init_acp = __esm({
       }
       async sendRequest(method, params) {
         const id = this.#nextRequestId++;
-        const responsePromise = new Promise((resolve16, reject) => {
-          this.#pendingResponses.set(id, { resolve: resolve16, reject });
+        const responsePromise = new Promise((resolve17, reject) => {
+          this.#pendingResponses.set(id, { resolve: resolve17, reject });
         });
         await this.#sendMessage({ jsonrpc: "2.0", id, method, params });
         return responsePromise;
@@ -25046,10 +25046,6 @@ var init_acp = __esm({
   }
 });
 
-// src/cli.ts
-import * as fs24 from "node:fs";
-import * as path31 from "node:path";
-
 // ../../node_modules/.pnpm/commander@12.1.0/node_modules/commander/esm.mjs
 var import_index = __toESM(require_commander(), 1);
 var {
@@ -25067,6 +25063,14 @@ var {
   Help
 } = import_index.default;
 
+// src/cli/defaults.ts
+var DEFAULT_API_URL = process.env.BUILDAUTOMATON_API_URL ?? "https://api.buildautomaton.com";
+var DEFAULT_FIREHOSE_URL = "https://buildautomaton-firehose.fly.dev";
+
+// src/cli/run-cli-action.ts
+import * as fs30 from "node:fs";
+import * as path33 from "node:path";
+
 // src/config.ts
 import fs from "node:fs";
 import path from "node:path";
@@ -25145,15 +25149,291 @@ function clearConfigForApi(apiUrl) {
   }
 }
 
-// src/files/cwd/bridge-workspace-directory.ts
+// src/e2e-certificates/certificates.ts
+import * as fs2 from "node:fs/promises";
 import * as path2 from "node:path";
+
+// ../e2ee/src/constants.ts
+var E2EE_ALG = "A1";
+var E2EE_KEY_BYTES = 32;
+var E2EE_NONCE_BYTES = 12;
+
+// ../e2ee/src/types.ts
+function isE2eeEnvelope(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const o = value;
+  return typeof o.k === "string" && typeof o.n === "string" && typeof o.c === "string";
+}
+function isE2eeKeyRecord(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const o = value;
+  return typeof o.id === "string" && o.id.length > 0 && typeof o.name === "string" && o.name.length > 0 && o.a === E2EE_ALG && typeof o.k === "string" && o.k.length > 0 && typeof o.createdAt === "string" && o.createdAt.length > 0;
+}
+
+// ../e2ee/src/encoding.ts
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 1) binary += String.fromCharCode(bytes[i]);
+  const b64 = btoa(binary);
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64UrlDecode(value) {
+  const b64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  const binary = atob(padded);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);
+  return out;
+}
+
+// ../e2ee/src/pem.ts
+var E2EE_PEM_LABEL = "BUILD AUTOMATON E2EE KEY";
+function pemHeaderValue(headers, name) {
+  return headers[name.toLowerCase()];
+}
+function encodePemBase64(bytes) {
+  const raw = base64UrlEncode(bytes).replace(/-/g, "+").replace(/_/g, "/");
+  const padded = raw + "=".repeat((4 - raw.length % 4) % 4);
+  return padded.replace(/.{1,64}/g, "$&\n").trimEnd();
+}
+function decodePemBase64(value) {
+  const compact = value.replace(/\s+/g, "");
+  const binary = atob(compact);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function parseE2eeKeyRecordPem(raw, fallbackName) {
+  const lines = raw.trim().split(/\r?\n/);
+  if (lines[0]?.trim() !== `-----BEGIN ${E2EE_PEM_LABEL}-----`) {
+    throw new Error("The E2EE key file is not a BuildAutomaton PEM key.");
+  }
+  const endIndex = lines.findIndex((line) => line.trim() === `-----END ${E2EE_PEM_LABEL}-----`);
+  if (endIndex < 0) throw new Error("The E2EE key PEM is missing its end marker.");
+  const headers = {};
+  const bodyLines = [];
+  let readingBody = false;
+  for (const line of lines.slice(1, endIndex)) {
+    const trimmed2 = line.trim();
+    if (!trimmed2) {
+      readingBody = true;
+      continue;
+    }
+    const headerMatch = /^([A-Za-z0-9-]+):\s*(.*)$/.exec(trimmed2);
+    if (!readingBody && headerMatch) {
+      headers[headerMatch[1].toLowerCase()] = headerMatch[2].trim();
+      continue;
+    }
+    readingBody = true;
+    bodyLines.push(trimmed2);
+  }
+  const keyBytes = decodePemBase64(bodyLines.join(""));
+  if (keyBytes.byteLength !== E2EE_KEY_BYTES) throw new Error("The E2EE key PEM does not contain a 256-bit key.");
+  const key = {
+    id: pemHeaderValue(headers, "Key-Id") ?? "",
+    name: pemHeaderValue(headers, "Name") ?? fallbackName,
+    a: pemHeaderValue(headers, "Algorithm") ?? E2EE_ALG,
+    k: base64UrlEncode(keyBytes),
+    createdAt: pemHeaderValue(headers, "Created-At") ?? (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (!isE2eeKeyRecord(key)) throw new Error("The E2EE key PEM has invalid metadata.");
+  return {
+    ...key,
+    name: key.name.trim() || fallbackName
+  };
+}
+function parseE2eeKeyRecord(raw, fallbackName) {
+  return parseE2eeKeyRecordPem(raw.trim(), fallbackName);
+}
+function serializeE2eeKeyRecord(key) {
+  return [
+    `-----BEGIN ${E2EE_PEM_LABEL}-----`,
+    `Key-Id: ${key.id}`,
+    `Name: ${key.name}`,
+    `Algorithm: ${key.a}`,
+    `Created-At: ${key.createdAt}`,
+    "",
+    encodePemBase64(base64UrlDecode(key.k)),
+    `-----END ${E2EE_PEM_LABEL}-----`,
+    ""
+  ].join("\n");
+}
+
+// src/lib/e2ee/cli-e2ee-key.ts
+import { createHash, randomBytes } from "node:crypto";
+function createE2eeKeyRecord(name) {
+  const raw = randomBytes(E2EE_KEY_BYTES);
+  const digest = createHash("sha256").update(raw).digest();
+  return {
+    id: base64UrlEncode(digest.subarray(0, 16)),
+    name: name.trim() || "BuildAutomaton E2EE key",
+    a: E2EE_ALG,
+    k: base64UrlEncode(raw),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
+// src/lib/e2ee/cli-e2ee-runtime.ts
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes2 } from "node:crypto";
+function nonceFromCounter(prefix, counter) {
+  const nonce = Buffer.alloc(E2EE_NONCE_BYTES);
+  prefix.copy(nonce, 0);
+  nonce.writeBigUInt64BE(counter, 4);
+  return nonce;
+}
+function createCliE2eeRuntime(key) {
+  const rawKey = Buffer.from(base64UrlDecode(key.k));
+  const prefix = randomBytes2(4);
+  let counter = 0n;
+  function nextNonce() {
+    counter += 1n;
+    return nonceFromCounter(prefix, counter);
+  }
+  function encryptObject(messageWithoutSensitiveFields, plaintext) {
+    const nonce = nextNonce();
+    const cipher = createCipheriv("aes-256-gcm", rawKey, nonce);
+    const ciphertext = Buffer.concat([cipher.update(JSON.stringify(plaintext), "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+      k: key.id,
+      n: base64UrlEncode(nonce),
+      c: base64UrlEncode(Buffer.concat([ciphertext, tag]))
+    };
+  }
+  return {
+    keyId: key.id,
+    handshake: { k: key.id, a: key.a },
+    encryptFields(message, fields) {
+      const plaintext = {};
+      const stripped = { ...message };
+      let hasPlaintext = false;
+      for (const field of fields) {
+        if (Object.prototype.hasOwnProperty.call(stripped, field) && stripped[field] !== void 0) {
+          plaintext[field] = stripped[field];
+          delete stripped[field];
+          hasPlaintext = true;
+        }
+      }
+      if (!hasPlaintext) return message;
+      stripped.ee = encryptObject(stripped, plaintext);
+      return stripped;
+    },
+    decryptMessage(message) {
+      const envelope = message.ee;
+      if (!isE2eeEnvelope(envelope)) return message;
+      if (envelope.k !== key.id) throw new Error(`E2EE key mismatch: ${envelope.k}`);
+      const sealed = Buffer.from(base64UrlDecode(envelope.c));
+      if (sealed.length < 16) throw new Error("Invalid E2EE payload.");
+      const ciphertext = sealed.subarray(0, sealed.length - 16);
+      const tag = sealed.subarray(sealed.length - 16);
+      const nonce = Buffer.from(base64UrlDecode(envelope.n));
+      const decipher = createDecipheriv("aes-256-gcm", rawKey, nonce);
+      decipher.setAuthTag(tag);
+      const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+      const parsed = JSON.parse(decrypted);
+      if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("E2EE payload did not decode to an object.");
+      }
+      const merged = { ...message, ...parsed };
+      delete merged.ee;
+      return merged;
+    }
+  };
+}
+
+// src/e2e-certificates/certificates.ts
+var E2E_CERTIFICATE_ALGORITHM = "A1";
+var CERTIFICATE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".pem", ".key", ".crt"]);
+function certificateFromKey({
+  raw,
+  name,
+  createdAt
+}) {
+  try {
+    const key = parseE2eeKeyRecord(raw, name);
+    return {
+      ...key,
+      name: key.name || name,
+      algorithm: E2E_CERTIFICATE_ALGORITHM,
+      pemBundle: serializeE2eeKeyRecord({ ...key, createdAt: key.createdAt || createdAt })
+    };
+  } catch {
+    return void 0;
+  }
+}
+function baseNameForCertificate(fileName) {
+  return path2.basename(fileName, path2.extname(fileName)) || "BuildAutomaton E2EE certificate";
+}
+async function readCertificateFiles(directory) {
+  let entries;
+  try {
+    entries = await fs2.readdir(directory, { withFileTypes: true });
+  } catch (err) {
+    const nodeErr = err;
+    if (nodeErr.code === "ENOENT") return [];
+    throw err;
+  }
+  const certificates = [];
+  for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+    if (!entry.isFile() || !CERTIFICATE_FILE_EXTENSIONS.has(path2.extname(entry.name).toLowerCase())) continue;
+    const filePath = path2.join(directory, entry.name);
+    const raw = await fs2.readFile(filePath, "utf8").catch(() => void 0);
+    if (!raw) continue;
+    const stat3 = await fs2.stat(filePath).catch(() => void 0);
+    const certificate = certificateFromKey({
+      raw,
+      name: baseNameForCertificate(entry.name),
+      createdAt: stat3?.mtime?.toISOString() ?? (/* @__PURE__ */ new Date()).toISOString()
+    });
+    if (certificate) {
+      certificates.push(certificate);
+    }
+  }
+  return certificates;
+}
+function createCertificate(directory) {
+  const baseName = path2.basename(directory) || "BuildAutomaton E2EE certificate";
+  const key = createE2eeKeyRecord(baseName);
+  return {
+    ...key,
+    algorithm: E2E_CERTIFICATE_ALGORITHM,
+    pemBundle: serializeE2eeKeyRecord(key)
+  };
+}
+async function loadOrCreateE2eCertificates(directory) {
+  const resolved = path2.resolve(directory);
+  await fs2.mkdir(resolved, { recursive: true, mode: 448 });
+  const existing = await readCertificateFiles(resolved);
+  if (existing.length > 0) {
+    return {
+      directory: resolved,
+      certificates: existing,
+      activeCertificate: existing[0],
+      generated: false
+    };
+  }
+  const certificate = createCertificate(resolved);
+  const fileName = `buildautomaton-e2ee-key-${certificate.id.slice(0, 12)}.pem`;
+  await fs2.writeFile(path2.join(resolved, fileName), certificate.pemBundle, {
+    mode: 384
+  });
+  return {
+    directory: resolved,
+    certificates: [certificate],
+    activeCertificate: certificate,
+    generated: true
+  };
+}
+
+// src/files/cwd/bridge-workspace-directory.ts
+import * as path3 from "node:path";
 var bridgeWorkspaceDirectory = null;
 function initBridgeWorkspaceDirectory() {
-  bridgeWorkspaceDirectory = path2.resolve(process.cwd());
+  bridgeWorkspaceDirectory = path3.resolve(process.cwd());
 }
 function getBridgeWorkspaceDirectory() {
   if (bridgeWorkspaceDirectory == null) {
-    bridgeWorkspaceDirectory = path2.resolve(process.cwd());
+    bridgeWorkspaceDirectory = path3.resolve(process.cwd());
   }
   return bridgeWorkspaceDirectory;
 }
@@ -25321,8 +25601,521 @@ function sendWsMessage(ws, payload) {
   }
 }
 
+// ../../node_modules/.pnpm/open@10.2.0/node_modules/open/index.js
+import process7 from "node:process";
+import { Buffer as Buffer2 } from "node:buffer";
+import path4 from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify as promisify5 } from "node:util";
+import childProcess from "node:child_process";
+import fs7, { constants as fsConstants2 } from "node:fs/promises";
+
+// ../../node_modules/.pnpm/wsl-utils@0.1.0/node_modules/wsl-utils/index.js
+import process3 from "node:process";
+import fs6, { constants as fsConstants } from "node:fs/promises";
+
+// ../../node_modules/.pnpm/is-wsl@3.1.1/node_modules/is-wsl/index.js
+import process2 from "node:process";
+import os2 from "node:os";
+import fs5 from "node:fs";
+
+// ../../node_modules/.pnpm/is-inside-container@1.0.0/node_modules/is-inside-container/index.js
+import fs4 from "node:fs";
+
+// ../../node_modules/.pnpm/is-docker@3.0.0/node_modules/is-docker/index.js
+import fs3 from "node:fs";
+var isDockerCached;
+function hasDockerEnv() {
+  try {
+    fs3.statSync("/.dockerenv");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function hasDockerCGroup() {
+  try {
+    return fs3.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
+  } catch {
+    return false;
+  }
+}
+function isDocker() {
+  if (isDockerCached === void 0) {
+    isDockerCached = hasDockerEnv() || hasDockerCGroup();
+  }
+  return isDockerCached;
+}
+
+// ../../node_modules/.pnpm/is-inside-container@1.0.0/node_modules/is-inside-container/index.js
+var cachedResult;
+var hasContainerEnv = () => {
+  try {
+    fs4.statSync("/run/.containerenv");
+    return true;
+  } catch {
+    return false;
+  }
+};
+function isInsideContainer() {
+  if (cachedResult === void 0) {
+    cachedResult = hasContainerEnv() || isDocker();
+  }
+  return cachedResult;
+}
+
+// ../../node_modules/.pnpm/is-wsl@3.1.1/node_modules/is-wsl/index.js
+var isWsl = () => {
+  if (process2.platform !== "linux") {
+    return false;
+  }
+  if (os2.release().toLowerCase().includes("microsoft")) {
+    if (isInsideContainer()) {
+      return false;
+    }
+    return true;
+  }
+  try {
+    if (fs5.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft")) {
+      return !isInsideContainer();
+    }
+  } catch {
+  }
+  if (fs5.existsSync("/proc/sys/fs/binfmt_misc/WSLInterop") || fs5.existsSync("/run/WSL")) {
+    return !isInsideContainer();
+  }
+  return false;
+};
+var is_wsl_default = process2.env.__IS_WSL_TEST__ ? isWsl : isWsl();
+
+// ../../node_modules/.pnpm/wsl-utils@0.1.0/node_modules/wsl-utils/index.js
+var wslDrivesMountPoint = /* @__PURE__ */ (() => {
+  const defaultMountPoint = "/mnt/";
+  let mountPoint;
+  return async function() {
+    if (mountPoint) {
+      return mountPoint;
+    }
+    const configFilePath2 = "/etc/wsl.conf";
+    let isConfigFileExists = false;
+    try {
+      await fs6.access(configFilePath2, fsConstants.F_OK);
+      isConfigFileExists = true;
+    } catch {
+    }
+    if (!isConfigFileExists) {
+      return defaultMountPoint;
+    }
+    const configContent = await fs6.readFile(configFilePath2, { encoding: "utf8" });
+    const configMountPoint = /(?<!#.*)root\s*=\s*(?<mountPoint>.*)/g.exec(configContent);
+    if (!configMountPoint) {
+      return defaultMountPoint;
+    }
+    mountPoint = configMountPoint.groups.mountPoint.trim();
+    mountPoint = mountPoint.endsWith("/") ? mountPoint : `${mountPoint}/`;
+    return mountPoint;
+  };
+})();
+var powerShellPathFromWsl = async () => {
+  const mountPoint = await wslDrivesMountPoint();
+  return `${mountPoint}c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe`;
+};
+var powerShellPath = async () => {
+  if (is_wsl_default) {
+    return powerShellPathFromWsl();
+  }
+  return `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;
+};
+
+// ../../node_modules/.pnpm/define-lazy-prop@3.0.0/node_modules/define-lazy-prop/index.js
+function defineLazyProperty(object2, propertyName, valueGetter) {
+  const define = (value) => Object.defineProperty(object2, propertyName, { value, enumerable: true, writable: true });
+  Object.defineProperty(object2, propertyName, {
+    configurable: true,
+    enumerable: true,
+    get() {
+      const result = valueGetter();
+      define(result);
+      return result;
+    },
+    set(value) {
+      define(value);
+    }
+  });
+  return object2;
+}
+
+// ../../node_modules/.pnpm/default-browser@5.5.0/node_modules/default-browser/index.js
+import { promisify as promisify4 } from "node:util";
+import process6 from "node:process";
+import { execFile as execFile4 } from "node:child_process";
+
+// ../../node_modules/.pnpm/default-browser-id@5.0.1/node_modules/default-browser-id/index.js
+import { promisify } from "node:util";
+import process4 from "node:process";
+import { execFile } from "node:child_process";
+var execFileAsync = promisify(execFile);
+async function defaultBrowserId() {
+  if (process4.platform !== "darwin") {
+    throw new Error("macOS only");
+  }
+  const { stdout } = await execFileAsync("defaults", ["read", "com.apple.LaunchServices/com.apple.launchservices.secure", "LSHandlers"]);
+  const match = /LSHandlerRoleAll = "(?!-)(?<id>[^"]+?)";\s+?LSHandlerURLScheme = (?:http|https);/.exec(stdout);
+  const browserId = match?.groups.id ?? "com.apple.Safari";
+  if (browserId === "com.apple.safari") {
+    return "com.apple.Safari";
+  }
+  return browserId;
+}
+
+// ../../node_modules/.pnpm/run-applescript@7.1.0/node_modules/run-applescript/index.js
+import process5 from "node:process";
+import { promisify as promisify2 } from "node:util";
+import { execFile as execFile2, execFileSync } from "node:child_process";
+var execFileAsync2 = promisify2(execFile2);
+async function runAppleScript(script, { humanReadableOutput = true, signal } = {}) {
+  if (process5.platform !== "darwin") {
+    throw new Error("macOS only");
+  }
+  const outputArguments = humanReadableOutput ? [] : ["-ss"];
+  const execOptions = {};
+  if (signal) {
+    execOptions.signal = signal;
+  }
+  const { stdout } = await execFileAsync2("osascript", ["-e", script, outputArguments], execOptions);
+  return stdout.trim();
+}
+
+// ../../node_modules/.pnpm/bundle-name@4.1.0/node_modules/bundle-name/index.js
+async function bundleName(bundleId) {
+  return runAppleScript(`tell application "Finder" to set app_path to application file id "${bundleId}" as string
+tell application "System Events" to get value of property list item "CFBundleName" of property list file (app_path & ":Contents:Info.plist")`);
+}
+
+// ../../node_modules/.pnpm/default-browser@5.5.0/node_modules/default-browser/windows.js
+import { promisify as promisify3 } from "node:util";
+import { execFile as execFile3 } from "node:child_process";
+var execFileAsync3 = promisify3(execFile3);
+var windowsBrowserProgIds = {
+  MSEdgeHTM: { name: "Edge", id: "com.microsoft.edge" },
+  // The missing `L` is correct.
+  MSEdgeBHTML: { name: "Edge Beta", id: "com.microsoft.edge.beta" },
+  MSEdgeDHTML: { name: "Edge Dev", id: "com.microsoft.edge.dev" },
+  AppXq0fevzme2pys62n3e0fbqa7peapykr8v: { name: "Edge", id: "com.microsoft.edge.old" },
+  ChromeHTML: { name: "Chrome", id: "com.google.chrome" },
+  ChromeBHTML: { name: "Chrome Beta", id: "com.google.chrome.beta" },
+  ChromeDHTML: { name: "Chrome Dev", id: "com.google.chrome.dev" },
+  ChromiumHTM: { name: "Chromium", id: "org.chromium.Chromium" },
+  BraveHTML: { name: "Brave", id: "com.brave.Browser" },
+  BraveBHTML: { name: "Brave Beta", id: "com.brave.Browser.beta" },
+  BraveDHTML: { name: "Brave Dev", id: "com.brave.Browser.dev" },
+  BraveSSHTM: { name: "Brave Nightly", id: "com.brave.Browser.nightly" },
+  FirefoxURL: { name: "Firefox", id: "org.mozilla.firefox" },
+  OperaStable: { name: "Opera", id: "com.operasoftware.Opera" },
+  VivaldiHTM: { name: "Vivaldi", id: "com.vivaldi.Vivaldi" },
+  "IE.HTTP": { name: "Internet Explorer", id: "com.microsoft.ie" }
+};
+var _windowsBrowserProgIdMap = new Map(Object.entries(windowsBrowserProgIds));
+var UnknownBrowserError = class extends Error {
+};
+async function defaultBrowser(_execFileAsync = execFileAsync3) {
+  const { stdout } = await _execFileAsync("reg", [
+    "QUERY",
+    " HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice",
+    "/v",
+    "ProgId"
+  ]);
+  const match = /ProgId\s*REG_SZ\s*(?<id>\S+)/.exec(stdout);
+  if (!match) {
+    throw new UnknownBrowserError(`Cannot find Windows browser in stdout: ${JSON.stringify(stdout)}`);
+  }
+  const { id } = match.groups;
+  const dotIndex = id.lastIndexOf(".");
+  const hyphenIndex = id.lastIndexOf("-");
+  const baseIdByDot = dotIndex === -1 ? void 0 : id.slice(0, dotIndex);
+  const baseIdByHyphen = hyphenIndex === -1 ? void 0 : id.slice(0, hyphenIndex);
+  return windowsBrowserProgIds[id] ?? windowsBrowserProgIds[baseIdByDot] ?? windowsBrowserProgIds[baseIdByHyphen] ?? { name: id, id };
+}
+
+// ../../node_modules/.pnpm/default-browser@5.5.0/node_modules/default-browser/index.js
+var execFileAsync4 = promisify4(execFile4);
+var titleize = (string4) => string4.toLowerCase().replaceAll(/(?:^|\s|-)\S/g, (x) => x.toUpperCase());
+async function defaultBrowser2() {
+  if (process6.platform === "darwin") {
+    const id = await defaultBrowserId();
+    const name = await bundleName(id);
+    return { name, id };
+  }
+  if (process6.platform === "linux") {
+    const { stdout } = await execFileAsync4("xdg-mime", ["query", "default", "x-scheme-handler/http"]);
+    const id = stdout.trim();
+    const name = titleize(id.replace(/.desktop$/, "").replace("-", " "));
+    return { name, id };
+  }
+  if (process6.platform === "win32") {
+    return defaultBrowser();
+  }
+  throw new Error("Only macOS, Linux, and Windows are supported");
+}
+
+// ../../node_modules/.pnpm/open@10.2.0/node_modules/open/index.js
+var execFile5 = promisify5(childProcess.execFile);
+var __dirname = path4.dirname(fileURLToPath(import.meta.url));
+var localXdgOpenPath = path4.join(__dirname, "xdg-open");
+var { platform, arch } = process7;
+async function getWindowsDefaultBrowserFromWsl() {
+  const powershellPath = await powerShellPath();
+  const rawCommand = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
+  const encodedCommand = Buffer2.from(rawCommand, "utf16le").toString("base64");
+  const { stdout } = await execFile5(
+    powershellPath,
+    [
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-EncodedCommand",
+      encodedCommand
+    ],
+    { encoding: "utf8" }
+  );
+  const progId = stdout.trim();
+  const browserMap = {
+    ChromeHTML: "com.google.chrome",
+    BraveHTML: "com.brave.Browser",
+    MSEdgeHTM: "com.microsoft.edge",
+    FirefoxURL: "org.mozilla.firefox"
+  };
+  return browserMap[progId] ? { id: browserMap[progId] } : {};
+}
+var pTryEach = async (array2, mapper) => {
+  let latestError;
+  for (const item of array2) {
+    try {
+      return await mapper(item);
+    } catch (error40) {
+      latestError = error40;
+    }
+  }
+  throw latestError;
+};
+var baseOpen = async (options) => {
+  options = {
+    wait: false,
+    background: false,
+    newInstance: false,
+    allowNonzeroExitCode: false,
+    ...options
+  };
+  if (Array.isArray(options.app)) {
+    return pTryEach(options.app, (singleApp) => baseOpen({
+      ...options,
+      app: singleApp
+    }));
+  }
+  let { name: app, arguments: appArguments = [] } = options.app ?? {};
+  appArguments = [...appArguments];
+  if (Array.isArray(app)) {
+    return pTryEach(app, (appName) => baseOpen({
+      ...options,
+      app: {
+        name: appName,
+        arguments: appArguments
+      }
+    }));
+  }
+  if (app === "browser" || app === "browserPrivate") {
+    const ids = {
+      "com.google.chrome": "chrome",
+      "google-chrome.desktop": "chrome",
+      "com.brave.Browser": "brave",
+      "org.mozilla.firefox": "firefox",
+      "firefox.desktop": "firefox",
+      "com.microsoft.msedge": "edge",
+      "com.microsoft.edge": "edge",
+      "com.microsoft.edgemac": "edge",
+      "microsoft-edge.desktop": "edge"
+    };
+    const flags = {
+      chrome: "--incognito",
+      brave: "--incognito",
+      firefox: "--private-window",
+      edge: "--inPrivate"
+    };
+    const browser = is_wsl_default ? await getWindowsDefaultBrowserFromWsl() : await defaultBrowser2();
+    if (browser.id in ids) {
+      const browserName = ids[browser.id];
+      if (app === "browserPrivate") {
+        appArguments.push(flags[browserName]);
+      }
+      return baseOpen({
+        ...options,
+        app: {
+          name: apps[browserName],
+          arguments: appArguments
+        }
+      });
+    }
+    throw new Error(`${browser.name} is not supported as a default browser`);
+  }
+  let command;
+  const cliArguments = [];
+  const childProcessOptions = {};
+  if (platform === "darwin") {
+    command = "open";
+    if (options.wait) {
+      cliArguments.push("--wait-apps");
+    }
+    if (options.background) {
+      cliArguments.push("--background");
+    }
+    if (options.newInstance) {
+      cliArguments.push("--new");
+    }
+    if (app) {
+      cliArguments.push("-a", app);
+    }
+  } else if (platform === "win32" || is_wsl_default && !isInsideContainer() && !app) {
+    command = await powerShellPath();
+    cliArguments.push(
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-EncodedCommand"
+    );
+    if (!is_wsl_default) {
+      childProcessOptions.windowsVerbatimArguments = true;
+    }
+    const encodedArguments = ["Start"];
+    if (options.wait) {
+      encodedArguments.push("-Wait");
+    }
+    if (app) {
+      encodedArguments.push(`"\`"${app}\`""`);
+      if (options.target) {
+        appArguments.push(options.target);
+      }
+    } else if (options.target) {
+      encodedArguments.push(`"${options.target}"`);
+    }
+    if (appArguments.length > 0) {
+      appArguments = appArguments.map((argument) => `"\`"${argument}\`""`);
+      encodedArguments.push("-ArgumentList", appArguments.join(","));
+    }
+    options.target = Buffer2.from(encodedArguments.join(" "), "utf16le").toString("base64");
+  } else {
+    if (app) {
+      command = app;
+    } else {
+      const isBundled = !__dirname || __dirname === "/";
+      let exeLocalXdgOpen = false;
+      try {
+        await fs7.access(localXdgOpenPath, fsConstants2.X_OK);
+        exeLocalXdgOpen = true;
+      } catch {
+      }
+      const useSystemXdgOpen = process7.versions.electron ?? (platform === "android" || isBundled || !exeLocalXdgOpen);
+      command = useSystemXdgOpen ? "xdg-open" : localXdgOpenPath;
+    }
+    if (appArguments.length > 0) {
+      cliArguments.push(...appArguments);
+    }
+    if (!options.wait) {
+      childProcessOptions.stdio = "ignore";
+      childProcessOptions.detached = true;
+    }
+  }
+  if (platform === "darwin" && appArguments.length > 0) {
+    cliArguments.push("--args", ...appArguments);
+  }
+  if (options.target) {
+    cliArguments.push(options.target);
+  }
+  const subprocess = childProcess.spawn(command, cliArguments, childProcessOptions);
+  if (options.wait) {
+    return new Promise((resolve17, reject) => {
+      subprocess.once("error", reject);
+      subprocess.once("close", (exitCode) => {
+        if (!options.allowNonzeroExitCode && exitCode > 0) {
+          reject(new Error(`Exited with code ${exitCode}`));
+          return;
+        }
+        resolve17(subprocess);
+      });
+    });
+  }
+  subprocess.unref();
+  return subprocess;
+};
+var open = (target, options) => {
+  if (typeof target !== "string") {
+    throw new TypeError("Expected a `target`");
+  }
+  return baseOpen({
+    ...options,
+    target
+  });
+};
+function detectArchBinary(binary) {
+  if (typeof binary === "string" || Array.isArray(binary)) {
+    return binary;
+  }
+  const { [arch]: archBinary } = binary;
+  if (!archBinary) {
+    throw new Error(`${arch} is not supported`);
+  }
+  return archBinary;
+}
+function detectPlatformBinary({ [platform]: platformBinary }, { wsl }) {
+  if (wsl && is_wsl_default) {
+    return detectArchBinary(wsl);
+  }
+  if (!platformBinary) {
+    throw new Error(`${platform} is not supported`);
+  }
+  return detectArchBinary(platformBinary);
+}
+var apps = {};
+defineLazyProperty(apps, "chrome", () => detectPlatformBinary({
+  darwin: "google chrome",
+  win32: "chrome",
+  linux: ["google-chrome", "google-chrome-stable", "chromium"]
+}, {
+  wsl: {
+    ia32: "/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe",
+    x64: ["/mnt/c/Program Files/Google/Chrome/Application/chrome.exe", "/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe"]
+  }
+}));
+defineLazyProperty(apps, "brave", () => detectPlatformBinary({
+  darwin: "brave browser",
+  win32: "brave",
+  linux: ["brave-browser", "brave"]
+}, {
+  wsl: {
+    ia32: "/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe",
+    x64: ["/mnt/c/Program Files/BraveSoftware/Brave-Browser/Application/brave.exe", "/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe"]
+  }
+}));
+defineLazyProperty(apps, "firefox", () => detectPlatformBinary({
+  darwin: "firefox",
+  win32: String.raw`C:\Program Files\Mozilla Firefox\firefox.exe`,
+  linux: "firefox"
+}, {
+  wsl: "/mnt/c/Program Files/Mozilla Firefox/firefox.exe"
+}));
+defineLazyProperty(apps, "edge", () => detectPlatformBinary({
+  darwin: "microsoft edge",
+  win32: "msedge",
+  linux: ["microsoft-edge", "microsoft-edge-dev"]
+}, {
+  wsl: "/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"
+}));
+defineLazyProperty(apps, "browser", () => "browser");
+defineLazyProperty(apps, "browserPrivate", () => "browserPrivate");
+var open_default = open;
+
 // src/auth/open-browser.ts
-import { execSync } from "node:child_process";
 function isLocalApiUrl(apiUrl) {
   try {
     const u = new URL(apiUrl);
@@ -25332,8 +26125,11 @@ function isLocalApiUrl(apiUrl) {
     return false;
   }
 }
-function openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn = log) {
-  const appUrl = apiUrl && isLocalApiUrl(apiUrl) ? process.env.BUILDAUTOMATON_APP_URL ?? "http://localhost:3000" : process.env.BUILDAUTOMATON_APP_URL ?? "https://app.buildautomaton.com";
+function appUrlForApiUrl(apiUrl) {
+  return apiUrl && isLocalApiUrl(apiUrl) ? process.env.BUILDAUTOMATON_APP_URL ?? "http://localhost:3000" : process.env.BUILDAUTOMATON_APP_URL ?? "https://app.buildautomaton.com";
+}
+async function openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn = log) {
+  const appUrl = appUrlForApiUrl(apiUrl);
   let connectCliUrl = `${appUrl.replace(/\/$/, "")}/bridges/connect?connectionId=${connectionId}`;
   if (initialWorkspaceId) {
     try {
@@ -25346,10 +26142,11 @@ function openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiU
     connectCliUrl += `&bridgeName=${encodeURIComponent(preferredBridgeName.trim())}`;
   }
   logFn("Opening browser to link this CLI\u2026");
-  logFn("If you\u2019re already signed in with one workspace, the CLI will connect automatically. Otherwise sign in and link to a workspace.");
+  logFn(
+    "If you\u2019re already signed in with one workspace, the CLI will connect automatically. Otherwise sign in and link to a workspace."
+  );
   try {
-    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-    execSync(`${cmd} "${connectCliUrl}"`, { stdio: "ignore" });
+    await open_default(connectCliUrl, { wait: false });
   } catch {
     logFn("Could not open browser. Open this URL manually:");
     logFn(connectCliUrl);
@@ -25540,8 +26337,8 @@ function runPendingAuth(options) {
   let hasOpenedBrowser = false;
   let resolved = false;
   let resolveAuth;
-  const authPromise = new Promise((resolve16) => {
-    resolveAuth = resolve16;
+  const authPromise = new Promise((resolve17) => {
+    resolveAuth = resolve17;
   });
   let reconnectAttempt = 0;
   const signInQuiet = createEmptyReconnectQuietSlot();
@@ -25604,7 +26401,7 @@ function runPendingAuth(options) {
         }
         if (!hasOpenedBrowser) {
           hasOpenedBrowser = true;
-          openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
+          void openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
         }
       },
       onClose: (code, reason) => {
@@ -25646,7 +26443,7 @@ function runPendingAuth(options) {
     browserFallback = null;
     if (!hasOpenedBrowser) {
       hasOpenedBrowser = true;
-      openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
+      void openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
     }
   }, BROWSER_OPEN_FALLBACK_MS);
   connect();
@@ -25663,7 +26460,7 @@ function runPendingAuth(options) {
 async function closeBridgeConnection(state, acpManager, devServerManager, log2) {
   const say = log2 ?? logImmediate;
   say("Cleaning up connections\u2026");
-  await new Promise((resolve16) => setImmediate(resolve16));
+  await new Promise((resolve17) => setImmediate(resolve17));
   state.closedByUser = true;
   clearReconnectQuietTimer(state.mainQuiet);
   clearReconnectQuietTimer(state.firehoseQuiet);
@@ -25733,27 +26530,27 @@ function localAgentErrorSuggestsAuth(agentType, errorText) {
 }
 
 // src/git/session-git-queue.ts
-import { execFile as execFile2 } from "node:child_process";
-import { readFile, stat } from "node:fs/promises";
-import { promisify as promisify2 } from "node:util";
-import * as path5 from "node:path";
+import { execFile as execFile7 } from "node:child_process";
+import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
+import { promisify as promisify7 } from "node:util";
+import * as path7 from "node:path";
 
 // src/git/pre-turn-snapshot.ts
-import * as fs3 from "node:fs";
-import * as path4 from "node:path";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
+import * as fs9 from "node:fs";
+import * as path6 from "node:path";
+import { execFile as execFile6 } from "node:child_process";
+import { promisify as promisify6 } from "node:util";
 
 // src/git/discover-repos.ts
-import * as fs2 from "node:fs";
-import * as path3 from "node:path";
+import * as fs8 from "node:fs";
+import * as path5 from "node:path";
 
 // ../../node_modules/.pnpm/simple-git@3.32.3/node_modules/simple-git/dist/esm/index.js
 var import_file_exists = __toESM(require_dist(), 1);
 var import_debug = __toESM(require_src(), 1);
 var import_promise_deferred = __toESM(require_dist2(), 1);
 var import_promise_deferred2 = __toESM(require_dist2(), 1);
-import { Buffer as Buffer2 } from "node:buffer";
+import { Buffer as Buffer22 } from "node:buffer";
 import { spawn } from "child_process";
 import { normalize } from "node:path";
 import { EventEmitter } from "node:events";
@@ -25785,8 +26582,8 @@ function pathspec(...paths) {
   cache.set(key, paths);
   return key;
 }
-function isPathSpec(path32) {
-  return path32 instanceof String && cache.has(path32);
+function isPathSpec(path34) {
+  return path34 instanceof String && cache.has(path34);
 }
 function toPaths(pathSpec) {
   return cache.get(pathSpec) || [];
@@ -25875,8 +26672,8 @@ function toLinesWithContent(input = "", trimmed2 = true, separator = "\n") {
 function forEachLineWithContent(input, callback) {
   return toLinesWithContent(input, true).map((line) => callback(line));
 }
-function folderExists(path32) {
-  return (0, import_file_exists.exists)(path32, import_file_exists.FOLDER);
+function folderExists(path34) {
+  return (0, import_file_exists.exists)(path34, import_file_exists.FOLDER);
 }
 function append(target, item) {
   if (Array.isArray(target)) {
@@ -25933,7 +26730,7 @@ function prefixedArray(input, prefix) {
   return output;
 }
 function bufferToString(input) {
-  return (Array.isArray(input) ? Buffer2.concat(input) : input).toString("utf-8");
+  return (Array.isArray(input) ? Buffer22.concat(input) : input).toString("utf-8");
 }
 function pick(source, properties) {
   const out = {};
@@ -26280,8 +27077,8 @@ function checkIsRepoRootTask() {
     commands,
     format: "utf-8",
     onError,
-    parser(path32) {
-      return /^\.(git)?$/.test(path32.trim());
+    parser(path34) {
+      return /^\.(git)?$/.test(path34.trim());
     }
   };
 }
@@ -26715,11 +27512,11 @@ function parseGrep(grep) {
   const paths = /* @__PURE__ */ new Set();
   const results = {};
   forEachLineWithContent(grep, (input) => {
-    const [path32, line, preview] = input.split(NULL);
-    paths.add(path32);
-    (results[path32] = results[path32] || []).push({
+    const [path34, line, preview] = input.split(NULL);
+    paths.add(path34);
+    (results[path34] = results[path34] || []).push({
       line: asNumber(line),
-      path: path32,
+      path: path34,
       preview
     });
   });
@@ -27484,14 +28281,14 @@ var init_hash_object = __esm2({
     init_task();
   }
 });
-function parseInit(bare, path32, text) {
+function parseInit(bare, path34, text) {
   const response = String(text).trim();
   let result;
   if (result = initResponseRegex.exec(response)) {
-    return new InitSummary(bare, path32, false, result[1]);
+    return new InitSummary(bare, path34, false, result[1]);
   }
   if (result = reInitResponseRegex.exec(response)) {
-    return new InitSummary(bare, path32, true, result[1]);
+    return new InitSummary(bare, path34, true, result[1]);
   }
   let gitDir = "";
   const tokens = response.split(" ");
@@ -27502,7 +28299,7 @@ function parseInit(bare, path32, text) {
       break;
     }
   }
-  return new InitSummary(bare, path32, /^re/i.test(response), gitDir);
+  return new InitSummary(bare, path34, /^re/i.test(response), gitDir);
 }
 var InitSummary;
 var initResponseRegex;
@@ -27511,9 +28308,9 @@ var init_InitSummary = __esm2({
   "src/lib/responses/InitSummary.ts"() {
     "use strict";
     InitSummary = class {
-      constructor(bare, path32, existing, gitDir) {
+      constructor(bare, path34, existing, gitDir) {
         this.bare = bare;
-        this.path = path32;
+        this.path = path34;
         this.existing = existing;
         this.gitDir = gitDir;
       }
@@ -27525,7 +28322,7 @@ var init_InitSummary = __esm2({
 function hasBareCommand(command) {
   return command.includes(bareCommand);
 }
-function initTask(bare = false, path32, customArgs) {
+function initTask(bare = false, path34, customArgs) {
   const commands = ["init", ...customArgs];
   if (bare && !hasBareCommand(commands)) {
     commands.splice(1, 0, bareCommand);
@@ -27534,7 +28331,7 @@ function initTask(bare = false, path32, customArgs) {
     commands,
     format: "utf-8",
     parser(text) {
-      return parseInit(commands.includes("--bare"), path32, text);
+      return parseInit(commands.includes("--bare"), path34, text);
     }
   };
 }
@@ -28350,12 +29147,12 @@ var init_FileStatusSummary = __esm2({
     "use strict";
     fromPathRegex = /^(.+)\0(.+)$/;
     FileStatusSummary = class {
-      constructor(path32, index, working_dir) {
-        this.path = path32;
+      constructor(path34, index, working_dir) {
+        this.path = path34;
         this.index = index;
         this.working_dir = working_dir;
         if (index === "R" || working_dir === "R") {
-          const detail = fromPathRegex.exec(path32) || [null, path32, path32];
+          const detail = fromPathRegex.exec(path34) || [null, path34, path34];
           this.from = detail[2] || "";
           this.path = detail[1] || "";
         }
@@ -28386,14 +29183,14 @@ function splitLine(result, lineStr) {
     default:
       return;
   }
-  function data(index, workingDir, path32) {
+  function data(index, workingDir, path34) {
     const raw = `${index}${workingDir}`;
     const handler = parsers6.get(raw);
     if (handler) {
-      handler(result, path32);
+      handler(result, path34);
     }
     if (raw !== "##" && raw !== "!!") {
-      result.files.push(new FileStatusSummary(path32, index, workingDir));
+      result.files.push(new FileStatusSummary(path34, index, workingDir));
     }
   }
 }
@@ -28702,9 +29499,9 @@ var init_simple_git_api = __esm2({
           next
         );
       }
-      hashObject(path32, write) {
+      hashObject(path34, write) {
         return this._runTask(
-          hashObjectTask(path32, write === true),
+          hashObjectTask(path34, write === true),
           trailingFunctionArgument(arguments)
         );
       }
@@ -29057,8 +29854,8 @@ var init_branch = __esm2({
   }
 });
 function toPath(input) {
-  const path32 = input.trim().replace(/^["']|["']$/g, "");
-  return path32 && normalize(path32);
+  const path34 = input.trim().replace(/^["']|["']$/g, "");
+  return path34 && normalize(path34);
 }
 var parseCheckIgnore;
 var init_CheckIgnore = __esm2({
@@ -29372,8 +30169,8 @@ __export2(sub_module_exports, {
   subModuleTask: () => subModuleTask,
   updateSubModuleTask: () => updateSubModuleTask
 });
-function addSubModuleTask(repo, path32) {
-  return subModuleTask(["add", repo, path32]);
+function addSubModuleTask(repo, path34) {
+  return subModuleTask(["add", repo, path34]);
 }
 function initSubModuleTask(customArgs) {
   return subModuleTask(["init", ...customArgs]);
@@ -29706,8 +30503,8 @@ var require_git = __commonJS2({
       }
       return this._runTask(straightThroughStringTask2(command, this._trimmed), next);
     };
-    Git2.prototype.submoduleAdd = function(repo, path32, then) {
-      return this._runTask(addSubModuleTask2(repo, path32), trailingFunctionArgument2(arguments));
+    Git2.prototype.submoduleAdd = function(repo, path34, then) {
+      return this._runTask(addSubModuleTask2(repo, path34), trailingFunctionArgument2(arguments));
     };
     Git2.prototype.submoduleUpdate = function(args, then) {
       return this._runTask(
@@ -30333,20 +31130,20 @@ async function isGitRepoDirectory(dirPath) {
 // src/git/discover-repos.ts
 async function discoverGitRepos(cwd = getBridgeWorkspaceDirectory()) {
   const result = [];
-  const cwdResolved = path3.resolve(cwd);
+  const cwdResolved = path5.resolve(cwd);
   if (await isGitRepoDirectory(cwdResolved)) {
     const remoteUrl = await getRemoteOriginUrl(cwdResolved);
     result.push({ absolutePath: cwdResolved, remoteUrl });
   }
   let entries;
   try {
-    entries = fs2.readdirSync(cwdResolved, { withFileTypes: true });
+    entries = fs8.readdirSync(cwdResolved, { withFileTypes: true });
   } catch {
     return result;
   }
   for (const ent of entries) {
     if (!ent.isDirectory()) continue;
-    const childPath = path3.join(cwdResolved, ent.name);
+    const childPath = path5.join(cwdResolved, ent.name);
     if (await isGitRepoDirectory(childPath)) {
       const remoteUrl = await getRemoteOriginUrl(childPath);
       result.push({ absolutePath: childPath, remoteUrl });
@@ -30355,22 +31152,22 @@ async function discoverGitRepos(cwd = getBridgeWorkspaceDirectory()) {
   return result;
 }
 async function discoverGitReposUnderRoot(rootAbs) {
-  const root = path3.resolve(rootAbs);
+  const root = path5.resolve(rootAbs);
   const roots = [];
   async function walk(dir) {
     if (await isGitRepoDirectory(dir)) {
-      roots.push(path3.resolve(dir));
+      roots.push(path5.resolve(dir));
       return;
     }
     let entries;
     try {
-      entries = fs2.readdirSync(dir, { withFileTypes: true });
+      entries = fs8.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const ent of entries) {
       if (!ent.isDirectory() || ent.name === ".git") continue;
-      await walk(path3.join(dir, ent.name));
+      await walk(path5.join(dir, ent.name));
     }
   }
   await walk(root);
@@ -30384,13 +31181,13 @@ async function discoverGitReposUnderRoot(rootAbs) {
 }
 
 // src/git/pre-turn-snapshot.ts
-var execFileAsync = promisify(execFile);
+var execFileAsync5 = promisify6(execFile6);
 function snapshotsDirForCwd(agentCwd) {
-  return path4.join(agentCwd, ".buildautomaton", "snapshots");
+  return path6.join(agentCwd, ".buildautomaton", "snapshots");
 }
 async function gitStashCreate(repoRoot, log2) {
   try {
-    const { stdout } = await execFileAsync("git", ["stash", "create"], {
+    const { stdout } = await execFileAsync5("git", ["stash", "create"], {
       cwd: repoRoot,
       maxBuffer: 10 * 1024 * 1024
     });
@@ -30404,7 +31201,7 @@ async function gitStashCreate(repoRoot, log2) {
 }
 async function gitRun(repoRoot, args, log2, label) {
   try {
-    await execFileAsync("git", args, { cwd: repoRoot, maxBuffer: 10 * 1024 * 1024 });
+    await execFileAsync5("git", args, { cwd: repoRoot, maxBuffer: 10 * 1024 * 1024 });
     return { ok: true };
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
@@ -30415,7 +31212,7 @@ async function gitRun(repoRoot, args, log2, label) {
 async function resolveSnapshotRepoRoots(options) {
   const { worktreePaths, fallbackCwd, log: log2 } = options;
   if (worktreePaths?.length) {
-    const uniq = [...new Set(worktreePaths.map((p) => path4.resolve(p)))];
+    const uniq = [...new Set(worktreePaths.map((p) => path6.resolve(p)))];
     return uniq;
   }
   try {
@@ -30438,7 +31235,7 @@ async function capturePreTurnSnapshot(options) {
   }
   const dir = snapshotsDirForCwd(agentCwd);
   try {
-    fs3.mkdirSync(dir, { recursive: true });
+    fs9.mkdirSync(dir, { recursive: true });
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
   }
@@ -30447,9 +31244,9 @@ async function capturePreTurnSnapshot(options) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     repos
   };
-  const filePath = path4.join(dir, `${runId}.json`);
+  const filePath = path6.join(dir, `${runId}.json`);
   try {
-    fs3.writeFileSync(filePath, JSON.stringify(payload, null, 2), "utf8");
+    fs9.writeFileSync(filePath, JSON.stringify(payload, null, 2), "utf8");
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
   }
@@ -30462,7 +31259,7 @@ async function capturePreTurnSnapshot(options) {
 async function applyPreTurnSnapshot(filePath, log2) {
   let data;
   try {
-    const raw = fs3.readFileSync(filePath, "utf8");
+    const raw = fs9.readFileSync(filePath, "utf8");
     data = JSON.parse(raw);
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
@@ -30485,17 +31282,17 @@ async function applyPreTurnSnapshot(filePath, log2) {
   return { ok: true };
 }
 function snapshotFilePath(agentCwd, runId) {
-  return path4.join(snapshotsDirForCwd(agentCwd), `${runId}.json`);
+  return path6.join(snapshotsDirForCwd(agentCwd), `${runId}.json`);
 }
 
 // src/git/session-git-queue.ts
-var execFileAsync2 = promisify2(execFile2);
+var execFileAsync6 = promisify7(execFile7);
 var MAX_FULL_FILE_TEXT_BYTES = 512 * 1024;
 async function readWorkspaceFileAsUtf8(absPath) {
   try {
-    const st = await stat(absPath);
+    const st = await stat2(absPath);
     if (!st.isFile() || st.size > MAX_FULL_FILE_TEXT_BYTES) return void 0;
-    return await readFile(absPath, "utf8");
+    return await readFile2(absPath, "utf8");
   } catch {
     return void 0;
   }
@@ -30505,7 +31302,7 @@ async function collectTurnGitDiffFromPreTurnSnapshot(options) {
   const filePath = snapshotFilePath(agentCwd, runId);
   let data;
   try {
-    const raw = await readFile(filePath, "utf8");
+    const raw = await readFile2(filePath, "utf8");
     data = JSON.parse(raw);
   } catch (e) {
     log2(
@@ -30522,7 +31319,7 @@ async function collectTurnGitDiffFromPreTurnSnapshot(options) {
     if (!repo.stashSha) continue;
     let namesRaw;
     try {
-      const { stdout } = await execFileAsync2("git", ["diff", "--name-only", repo.stashSha], {
+      const { stdout } = await execFileAsync6("git", ["diff", "--name-only", repo.stashSha], {
         cwd: repo.path,
         maxBuffer: 10 * 1024 * 1024
       });
@@ -30534,11 +31331,11 @@ async function collectTurnGitDiffFromPreTurnSnapshot(options) {
       continue;
     }
     const lines = namesRaw.split("\n").map((l) => l.trim()).filter(Boolean);
-    const slug = path5.basename(repo.path).replace(/[^\w.-]+/g, "_") || "repo";
+    const slug = path7.basename(repo.path).replace(/[^\w.-]+/g, "_") || "repo";
     for (const rel of lines) {
       if (rel.includes("..")) continue;
       try {
-        const { stdout: patchContent } = await execFileAsync2(
+        const { stdout: patchContent } = await execFileAsync6(
           "git",
           ["diff", "--no-color", repo.stashSha, "--", rel],
           {
@@ -30548,7 +31345,7 @@ async function collectTurnGitDiffFromPreTurnSnapshot(options) {
         );
         if (!patchContent.trim()) continue;
         const displayPath = multiRepo ? `${slug}/${rel}` : rel;
-        const absFile = path5.join(repo.path, rel);
+        const absFile = path7.join(repo.path, rel);
         const newText = await readWorkspaceFileAsUtf8(absFile);
         sendSessionUpdate({
           type: "session_file_change",
@@ -30610,7 +31407,9 @@ async function sendPromptToAgent(options) {
       ...augmentAuthFields(errStr)
     });
     if (!result.success) {
-      log2(`[Agent] ${result.error ?? "Error"}`);
+      log2(
+        `[Agent] Prompt did not run successfully on the agent (no successful start/completion): ${result.error ?? "Unknown error"}`
+      );
     }
   } catch (err) {
     const errMsg = err instanceof Error ? err.message : String(err);
@@ -30628,8 +31427,8 @@ async function sendPromptToAgent(options) {
 }
 
 // src/agents/acp/ensure-acp-client.ts
-import * as fs4 from "node:fs";
-import * as path9 from "node:path";
+import * as fs10 from "node:fs";
+import * as path11 from "node:path";
 
 // src/error-message.ts
 function errorMessage(err) {
@@ -30649,16 +31448,16 @@ __export(claude_code_acp_client_exports, {
   createClaudeCodeAcpClient: () => createClaudeCodeAcpClient,
   detectLocalAgentPresence: () => detectLocalAgentPresence
 });
-import { execFile as execFile4 } from "node:child_process";
-import { promisify as promisify4 } from "node:util";
+import { execFile as execFile9 } from "node:child_process";
+import { promisify as promisify9 } from "node:util";
 
 // src/agents/acp/clients/detect-command-on-path.ts
-import { execFile as execFile3 } from "node:child_process";
-import { promisify as promisify3 } from "node:util";
-var execFileAsync3 = promisify3(execFile3);
+import { execFile as execFile8 } from "node:child_process";
+import { promisify as promisify8 } from "node:util";
+var execFileAsync7 = promisify8(execFile8);
 async function isCommandOnPath(command, timeoutMs = 4e3) {
   try {
-    await execFileAsync3("which", [command], { timeout: timeoutMs });
+    await execFileAsync7("which", [command], { timeout: timeoutMs });
     return true;
   } catch {
     return false;
@@ -30718,21 +31517,21 @@ function editSnippetToUnifiedDiff(filePath, oldText, newText) {
 }
 
 // src/agents/acp/safe-fs-path.ts
-import * as path6 from "node:path";
+import * as path8 from "node:path";
 function resolveSafePathUnderCwd(cwd, filePath) {
   const trimmed2 = filePath.trim();
   if (!trimmed2) return null;
-  const normalizedCwd = path6.resolve(cwd);
-  const resolved = path6.isAbsolute(trimmed2) ? path6.normalize(trimmed2) : path6.resolve(normalizedCwd, trimmed2);
-  const rel = path6.relative(normalizedCwd, resolved);
-  if (rel.startsWith("..") || path6.isAbsolute(rel)) return null;
+  const normalizedCwd = path8.resolve(cwd);
+  const resolved = path8.isAbsolute(trimmed2) ? path8.normalize(trimmed2) : path8.resolve(normalizedCwd, trimmed2);
+  const rel = path8.relative(normalizedCwd, resolved);
+  if (rel.startsWith("..") || path8.isAbsolute(rel)) return null;
   return resolved;
 }
 function toDisplayPathRelativeToCwd(cwd, absolutePath) {
-  const normalizedCwd = path6.resolve(cwd);
-  const rel = path6.relative(normalizedCwd, path6.resolve(absolutePath));
-  if (!rel || rel === "") return path6.basename(absolutePath);
-  return rel.split(path6.sep).join("/");
+  const normalizedCwd = path8.resolve(cwd);
+  const rel = path8.relative(normalizedCwd, path8.resolve(absolutePath));
+  if (!rel || rel === "") return path8.basename(absolutePath);
+  return rel.split(path8.sep).join("/");
 }
 
 // src/agents/acp/clients/agent-stderr-capture.ts
@@ -30852,7 +31651,7 @@ async function createSdkStdioAcpClient(options) {
   child.once("close", (code, signal) => {
     onAgentSubprocessExit?.({ code, signal });
   });
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     let initSettled = false;
     const settleReject = (err) => {
       if (initSettled) return;
@@ -30866,7 +31665,7 @@ async function createSdkStdioAcpClient(options) {
     const settleResolve = (handle) => {
       if (initSettled) return;
       initSettled = true;
-      resolve16(handle);
+      resolve17(handle);
     };
     child.on("error", (err) => {
       settleReject(new Error(formatSpawnError(err, command[0])));
@@ -30902,8 +31701,8 @@ async function createSdkStdioAcpClient(options) {
               });
             } catch {
             }
-            return await new Promise((resolve17) => {
-              pendingPermissionResolvers.set(requestId, resolve17);
+            return await new Promise((resolve18) => {
+              pendingPermissionResolvers.set(requestId, resolve18);
             });
           },
           async readTextFile(params) {
@@ -31011,9 +31810,9 @@ async function createSdkStdioAcpClient(options) {
             }
           },
           async cancel() {
-            for (const [id, resolve17] of [...pendingPermissionResolvers.entries()]) {
+            for (const [id, resolve18] of [...pendingPermissionResolvers.entries()]) {
               pendingPermissionResolvers.delete(id);
-              resolve17({ outcome: { outcome: "cancelled" } });
+              resolve18({ outcome: { outcome: "cancelled" } });
             }
             try {
               await connection.cancel({ sessionId });
@@ -31029,10 +31828,10 @@ async function createSdkStdioAcpClient(options) {
             }
           },
           resolveRequest(requestId, result) {
-            const resolve17 = pendingPermissionResolvers.get(requestId);
-            if (!resolve17) return;
+            const resolve18 = pendingPermissionResolvers.get(requestId);
+            if (!resolve18) return;
             pendingPermissionResolvers.delete(requestId);
-            resolve17(result);
+            resolve18(result);
           },
           disconnect() {
             child.kill();
@@ -31053,12 +31852,12 @@ async function createSdkStdioAcpClient(options) {
 }
 
 // src/agents/acp/clients/claude-code-acp-client.ts
-var execFileAsync4 = promisify4(execFile4);
+var execFileAsync8 = promisify9(execFile9);
 var BACKEND_LOCAL_AGENT_TYPE = "claude-code";
 async function detectLocalAgentPresence() {
   if (await isCommandOnPath("claude")) return true;
   try {
-    await execFileAsync4("npx", ["--yes", "@anthropic-ai/claude-code", "--version"], { timeout: 25e3 });
+    await execFileAsync8("npx", ["--yes", "@anthropic-ai/claude-code", "--version"], { timeout: 25e3 });
     return true;
   } catch {
     return false;
@@ -31173,7 +31972,7 @@ async function createCursorAcpClient(options) {
     onRequest,
     onFileChange
   } = options;
-  const dbgFs = process.env.BUILDAMATON_DEBUG_ACP_FS === "1";
+  const dbgFs = process.env.BUILDAUTOMATON_DEBUG_ACP_FS === "1";
   const isWindows = process.platform === "win32";
   const child = spawn3(command[0], command.slice(1), {
     cwd,
@@ -31183,7 +31982,7 @@ async function createCursorAcpClient(options) {
   });
   const stderrCapture = createStderrCapture(child);
   child.stderr?.on("data", (chunk) => stderrCapture.append(chunk));
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     child.on("error", (err) => {
       child.kill();
       reject(new Error(formatSpawnError2(err, command[0])));
@@ -31370,7 +32169,7 @@ async function createCursorAcpClient(options) {
         const newResult = await send("session/new", { cwd, mcpServers: [] });
         const sessionId = newResult?.sessionId ?? "";
         if (!sessionId) throw new Error("Cursor ACP session/new did not return sessionId");
-        resolve16({
+        resolve17({
           sessionId,
           async sendPrompt(prompt, _options) {
             promptOutputBuffer = "";
@@ -31556,48 +32355,48 @@ function resolveAgentCommand(preferredAgentType) {
 }
 
 // src/agents/acp/session-file-change-path-kind.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 import { existsSync, statSync } from "node:fs";
 
 // src/git/get-git-repo-root-sync.ts
-import { execFileSync } from "node:child_process";
-import * as path7 from "node:path";
+import { execFileSync as execFileSync2 } from "node:child_process";
+import * as path9 from "node:path";
 function getGitRepoRootSync(startDir) {
   try {
-    const out = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-      cwd: path7.resolve(startDir),
+    const out = execFileSync2("git", ["rev-parse", "--show-toplevel"], {
+      cwd: path9.resolve(startDir),
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       maxBuffer: 1024 * 1024
     }).trim();
-    return out ? path7.resolve(out) : null;
+    return out ? path9.resolve(out) : null;
   } catch {
     return null;
   }
 }
 
 // src/agents/acp/workspace-files.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { readFileSync as readFileSync4 } from "node:fs";
-import * as path8 from "node:path";
+import * as path10 from "node:path";
 function resolveWorkspaceFilePath(cwd, rawPath) {
   const trimmed2 = rawPath.trim();
   if (!trimmed2) return null;
-  const normalizedCwd = path8.resolve(cwd);
+  const normalizedCwd = path10.resolve(cwd);
   let abs = resolveSafePathUnderCwd(cwd, trimmed2);
   if (!abs) {
-    const candidate = path8.isAbsolute(trimmed2) ? path8.normalize(trimmed2) : path8.normalize(path8.resolve(normalizedCwd, trimmed2));
+    const candidate = path10.isAbsolute(trimmed2) ? path10.normalize(trimmed2) : path10.normalize(path10.resolve(normalizedCwd, trimmed2));
     const gitRoot2 = getGitRepoRootSync(cwd);
     if (!gitRoot2) return null;
-    const rel = path8.relative(gitRoot2, candidate);
-    if (rel.startsWith("..") || path8.isAbsolute(rel)) return null;
+    const rel = path10.relative(gitRoot2, candidate);
+    if (rel.startsWith("..") || path10.isAbsolute(rel)) return null;
     abs = candidate;
   }
   const gitRoot = getGitRepoRootSync(cwd);
   if (gitRoot) {
-    const relFromRoot = path8.relative(gitRoot, abs);
-    if (!relFromRoot.startsWith("..") && !path8.isAbsolute(relFromRoot)) {
-      return { abs, display: relFromRoot.split(path8.sep).join("/") };
+    const relFromRoot = path10.relative(gitRoot, abs);
+    if (!relFromRoot.startsWith("..") && !path10.isAbsolute(relFromRoot)) {
+      return { abs, display: relFromRoot.split(path10.sep).join("/") };
     }
   }
   return { abs, display: toDisplayPathRelativeToCwd(cwd, abs) };
@@ -31606,9 +32405,9 @@ function readUtf8WorkspaceFile(cwd, displayPath) {
   if (!displayPath || displayPath.includes("..")) return "";
   const gitRoot = getGitRepoRootSync(cwd);
   if (gitRoot) {
-    const abs2 = path8.resolve(gitRoot, displayPath);
-    const rel = path8.relative(gitRoot, abs2);
-    if (!rel.startsWith("..") && !path8.isAbsolute(rel)) {
+    const abs2 = path10.resolve(gitRoot, displayPath);
+    const rel = path10.relative(gitRoot, abs2);
+    if (!rel.startsWith("..") && !path10.isAbsolute(rel)) {
       try {
         return readFileSync4(abs2, "utf8");
       } catch {
@@ -31627,9 +32426,9 @@ function tryWorkspaceDisplayToAbs(cwd, displayPath) {
   if (!displayPath || displayPath.includes("..")) return null;
   const gitRoot = getGitRepoRootSync(cwd);
   if (gitRoot) {
-    const abs = path8.resolve(gitRoot, displayPath);
-    const rel = path8.relative(gitRoot, abs);
-    if (!rel.startsWith("..") && !path8.isAbsolute(rel)) return abs;
+    const abs = path10.resolve(gitRoot, displayPath);
+    const rel = path10.relative(gitRoot, abs);
+    if (!rel.startsWith("..") && !path10.isAbsolute(rel)) return abs;
   }
   return resolveSafePathUnderCwd(cwd, displayPath);
 }
@@ -31638,7 +32437,7 @@ function readGitHeadBlob(cwd, displayPath) {
   const gitRoot = getGitRepoRootSync(cwd);
   const execCwd = gitRoot ?? cwd;
   try {
-    return execFileSync2("git", ["show", `HEAD:${displayPath}`], {
+    return execFileSync3("git", ["show", `HEAD:${displayPath}`], {
       cwd: execCwd,
       encoding: "utf8",
       maxBuffer: 50 * 1024 * 1024
@@ -31654,7 +32453,7 @@ function gitHeadPathObjectType(cwd, displayPath) {
   const gitRoot = getGitRepoRootSync(cwd);
   if (!gitRoot) return null;
   try {
-    return execFileSync3("git", ["cat-file", "-t", `HEAD:${displayPath}`], {
+    return execFileSync4("git", ["cat-file", "-t", `HEAD:${displayPath}`], {
       cwd: gitRoot,
       encoding: "utf8"
     }).trim();
@@ -31745,7 +32544,7 @@ function createBridgeOnRequest(opts) {
 }
 
 // src/agents/acp/hooks/extract-acp-file-diffs-from-update/paths-and-text.ts
-import { fileURLToPath } from "node:url";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 function readOptionalTextField(v) {
   if (v === null || v === void 0) return "";
   if (typeof v === "string") return v;
@@ -31755,7 +32554,7 @@ function normalizePathField(raw) {
   const t = raw.trim();
   if (t.startsWith("file://")) {
     try {
-      return fileURLToPath(t);
+      return fileURLToPath2(t);
     } catch {
       return t;
     }
@@ -32197,10 +32996,10 @@ function buildAcpSessionBridgeHooks(opts) {
 // src/agents/acp/ensure-acp-client.ts
 async function ensureAcpClient(options) {
   const { state, preferredAgentType, mode, cwd, routing, sendSessionUpdate, sendRequest, log: log2 } = options;
-  const targetCwd = path9.resolve(
+  const targetCwd = path11.resolve(
     cwd != null && String(cwd).trim() !== "" ? String(cwd).trim() : getBridgeWorkspaceDirectory()
   );
-  if (state.acpHandle && state.lastAcpCwd != null && path9.resolve(state.lastAcpCwd) !== path9.resolve(targetCwd)) {
+  if (state.acpHandle && state.lastAcpCwd != null && path11.resolve(state.lastAcpCwd) !== path11.resolve(targetCwd)) {
     try {
       state.acpHandle.disconnect();
     } catch {
@@ -32232,7 +33031,7 @@ async function ensureAcpClient(options) {
   if (!state.acpStartPromise) {
     let statOk = false;
     try {
-      const st = fs4.statSync(targetCwd);
+      const st = fs10.statSync(targetCwd);
       statOk = st.isDirectory();
       if (!statOk) {
         state.lastAcpStartError = `Agent cwd is not a directory: ${targetCwd}`;
@@ -32428,12 +33227,12 @@ async function createAcpManager(options) {
 }
 
 // src/worktrees/session-worktree-manager.ts
-import * as path15 from "node:path";
-import os3 from "node:os";
+import * as path17 from "node:path";
+import os4 from "node:os";
 
 // src/worktrees/prepare-new-session-worktrees.ts
-import * as fs6 from "node:fs";
-import * as path11 from "node:path";
+import * as fs12 from "node:fs";
+import * as path13 from "node:path";
 
 // src/git/worktree-add.ts
 async function gitWorktreeAddBranch(mainRepoPath, worktreePath, branch) {
@@ -32442,12 +33241,12 @@ async function gitWorktreeAddBranch(mainRepoPath, worktreePath, branch) {
 }
 
 // src/worktrees/worktree-layout-file.ts
-import * as fs5 from "node:fs";
-import * as path10 from "node:path";
-import os2 from "node:os";
+import * as fs11 from "node:fs";
+import * as path12 from "node:path";
+import os3 from "node:os";
 var LAYOUT_FILENAME = "worktree-launcher-layout.json";
 function defaultWorktreeLayoutPath() {
-  return path10.join(os2.homedir(), ".buildautomaton", LAYOUT_FILENAME);
+  return path12.join(os3.homedir(), ".buildautomaton", LAYOUT_FILENAME);
 }
 function normalizeLoadedLayout(raw) {
   if (raw && typeof raw === "object" && "launcherCwds" in raw) {
@@ -32459,8 +33258,8 @@ function normalizeLoadedLayout(raw) {
 function loadWorktreeLayout() {
   try {
     const p = defaultWorktreeLayoutPath();
-    if (!fs5.existsSync(p)) return { launcherCwds: [] };
-    const raw = JSON.parse(fs5.readFileSync(p, "utf8"));
+    if (!fs11.existsSync(p)) return { launcherCwds: [] };
+    const raw = JSON.parse(fs11.readFileSync(p, "utf8"));
     return normalizeLoadedLayout(raw);
   } catch {
     return { launcherCwds: [] };
@@ -32468,18 +33267,18 @@ function loadWorktreeLayout() {
 }
 function saveWorktreeLayout(layout) {
   try {
-    const dir = path10.dirname(defaultWorktreeLayoutPath());
-    fs5.mkdirSync(dir, { recursive: true });
-    fs5.writeFileSync(defaultWorktreeLayoutPath(), JSON.stringify(layout, null, 2), "utf8");
+    const dir = path12.dirname(defaultWorktreeLayoutPath());
+    fs11.mkdirSync(dir, { recursive: true });
+    fs11.writeFileSync(defaultWorktreeLayoutPath(), JSON.stringify(layout, null, 2), "utf8");
   } catch {
   }
 }
 function baseNameSafe(abs) {
-  return path10.basename(abs).replace(/[^a-zA-Z0-9._-]+/g, "-") || "cwd";
+  return path12.basename(abs).replace(/[^a-zA-Z0-9._-]+/g, "-") || "cwd";
 }
 function allocateDirNameForLauncherCwd(layout, launcherCwdAbs) {
-  const norm = path10.resolve(launcherCwdAbs);
-  const existing = layout.launcherCwds.find((e) => path10.resolve(e.absolutePath) === norm);
+  const norm = path12.resolve(launcherCwdAbs);
+  const existing = layout.launcherCwds.find((e) => path12.resolve(e.absolutePath) === norm);
   if (existing) return existing.dirName;
   const base = baseNameSafe(norm);
   const used = new Set(layout.launcherCwds.map((e) => e.dirName));
@@ -32497,9 +33296,9 @@ function allocateDirNameForLauncherCwd(layout, launcherCwdAbs) {
 // src/worktrees/prepare-new-session-worktrees.ts
 async function prepareNewSessionWorktrees(options) {
   const { rootAbs, launcherCwd, sessionId, layout, log: log2 } = options;
-  const launcherResolved = path11.resolve(launcherCwd);
+  const launcherResolved = path13.resolve(launcherCwd);
   const cwdKey = allocateDirNameForLauncherCwd(layout, launcherResolved);
-  const agentMirrorRoot = path11.join(rootAbs, cwdKey);
+  const agentMirrorRoot = path13.join(rootAbs, cwdKey);
   const repos = await discoverGitReposUnderRoot(launcherResolved);
   if (repos.length === 0) {
     log2("[worktrees] No Git repositories under launcher working directory; skipping worktree creation.");
@@ -32507,13 +33306,13 @@ async function prepareNewSessionWorktrees(options) {
   }
   const branch = `session-${sessionId}`;
   const worktreePaths = [];
-  fs6.mkdirSync(agentMirrorRoot, { recursive: true });
+  fs12.mkdirSync(agentMirrorRoot, { recursive: true });
   for (const repo of repos) {
-    let rel = path11.relative(launcherResolved, repo.absolutePath);
-    if (rel.startsWith("..") || path11.isAbsolute(rel)) continue;
+    let rel = path13.relative(launcherResolved, repo.absolutePath);
+    if (rel.startsWith("..") || path13.isAbsolute(rel)) continue;
     const relNorm = rel === "" ? "." : rel;
-    const wtPath = path11.join(agentMirrorRoot, relNorm, sessionId);
-    fs6.mkdirSync(path11.dirname(wtPath), { recursive: true });
+    const wtPath = path13.join(agentMirrorRoot, relNorm, sessionId);
+    fs12.mkdirSync(path13.dirname(wtPath), { recursive: true });
     try {
       await gitWorktreeAddBranch(repo.absolutePath, wtPath, branch);
       log2(`[worktrees] Added worktree ${wtPath} (branch ${branch}).`);
@@ -32550,23 +33349,23 @@ async function renameSessionWorktreeBranches(paths, newBranch, log2) {
 }
 
 // src/worktrees/remove-session-worktrees.ts
-import * as fs9 from "node:fs";
+import * as fs15 from "node:fs";
 
 // src/git/worktree-remove.ts
-import * as fs8 from "node:fs";
+import * as fs14 from "node:fs";
 
 // src/git/resolve-main-repo-from-git-file.ts
-import * as fs7 from "node:fs";
-import * as path12 from "node:path";
+import * as fs13 from "node:fs";
+import * as path14 from "node:path";
 function resolveMainRepoFromWorktreeGitFile(wt) {
-  const gitDirFile = path12.join(wt, ".git");
-  if (!fs7.existsSync(gitDirFile) || !fs7.statSync(gitDirFile).isFile()) return "";
-  const first2 = fs7.readFileSync(gitDirFile, "utf8").trim();
+  const gitDirFile = path14.join(wt, ".git");
+  if (!fs13.existsSync(gitDirFile) || !fs13.statSync(gitDirFile).isFile()) return "";
+  const first2 = fs13.readFileSync(gitDirFile, "utf8").trim();
   const m = first2.match(/^gitdir:\s*(.+)$/im);
   if (!m) return "";
-  const gitWorktreePath = path12.resolve(wt, m[1].trim());
-  const gitDir = path12.dirname(path12.dirname(gitWorktreePath));
-  return path12.dirname(gitDir);
+  const gitWorktreePath = path14.resolve(wt, m[1].trim());
+  const gitDir = path14.dirname(path14.dirname(gitWorktreePath));
+  return path14.dirname(gitDir);
 }
 
 // src/git/worktree-remove.ts
@@ -32575,7 +33374,7 @@ async function gitWorktreeRemoveForce(worktreePath) {
   if (mainRepo) {
     await simpleGit(mainRepo).raw(["worktree", "remove", "--force", worktreePath]);
   } else {
-    fs8.rmSync(worktreePath, { recursive: true, force: true });
+    fs14.rmSync(worktreePath, { recursive: true, force: true });
   }
 }
 
@@ -32588,7 +33387,7 @@ async function removeSessionWorktrees(paths, log2) {
     } catch (e) {
       log2(`[worktrees] Remove failed for ${wt}: ${e instanceof Error ? e.message : String(e)}`);
       try {
-        fs9.rmSync(wt, { recursive: true, force: true });
+        fs15.rmSync(wt, { recursive: true, force: true });
       } catch {
       }
     }
@@ -32808,7 +33607,7 @@ function formatRemoteDisplayLabel(remoteUrl) {
 }
 
 // src/git/working-directory/changes/get-working-tree-change-repo-details.ts
-import * as path14 from "node:path";
+import * as path16 from "node:path";
 
 // src/git/working-directory/changes/parse-git-status.ts
 function parseNameStatusLines(lines) {
@@ -32928,8 +33727,8 @@ async function listChangedFilesForCommit(repoGitCwd, repoRelPath, commitSha) {
 }
 
 // src/git/working-directory/changes/list-changed-files-for-repo.ts
-import * as fs11 from "node:fs";
-import * as path13 from "node:path";
+import * as fs17 from "node:fs";
+import * as path15 from "node:path";
 
 // src/git/working-directory/changes/count-lines.ts
 import { createReadStream } from "node:fs";
@@ -32953,7 +33752,7 @@ async function countTextFileLines(absFile) {
 }
 
 // src/git/working-directory/changes/hydrate-patch.ts
-import * as fs10 from "node:fs";
+import * as fs16 from "node:fs";
 var UNIFIED_HUNK_HEADER_RE = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
 var MAX_HYDRATE_LINES_PER_GAP = 8e3;
 var MAX_HYDRATE_LINES_PER_FILE = 8e4;
@@ -32968,7 +33767,7 @@ async function readGitBlobLines(repoCwd, pathInRepo) {
 }
 async function readWorktreeFileLines(abs) {
   try {
-    const raw = await fs10.promises.readFile(abs, "utf8");
+    const raw = await fs16.promises.readFile(abs, "utf8");
     return raw.split(/\r?\n/);
   } catch {
     return null;
@@ -33103,7 +33902,7 @@ async function listChangedFilesForRepo(repoGitCwd, repoRelPath) {
   const rows = [];
   for (const pathInRepo of paths) {
     const relLauncher = posixJoinDirFile(repoRelPath, pathInRepo.replace(/\\/g, "/"));
-    const abs = path13.join(repoGitCwd, pathInRepo);
+    const abs = path15.join(repoGitCwd, pathInRepo);
     const nums = numByPath.get(pathInRepo);
     let additions = nums?.additions ?? 0;
     let deletions = nums?.deletions ?? 0;
@@ -33116,7 +33915,7 @@ async function listChangedFilesForRepo(repoGitCwd, repoRelPath) {
         deletions = fromGit.deletions;
       } else {
         try {
-          const st = await fs11.promises.stat(abs);
+          const st = await fs17.promises.stat(abs);
           if (st.isFile()) additions = await countTextFileLines(abs);
           else additions = 0;
         } catch {
@@ -33142,7 +33941,7 @@ async function listChangedFilesForRepo(repoGitCwd, repoRelPath) {
     } else {
       pathInRepo = row.pathRelLauncher;
     }
-    const absFile = path13.join(repoGitCwd, pathInRepo);
+    const absFile = path15.join(repoGitCwd, pathInRepo);
     let patch = await unifiedDiffForFile(repoGitCwd, pathInRepo, row.change);
     if (patch) {
       patch = await hydrateUnifiedPatchWithFileContext(patch, absFile, repoGitCwd, pathInRepo, row.change);
@@ -33158,8 +33957,8 @@ function normRepoRel(p) {
   return x === "" ? "." : x;
 }
 async function getWorkingTreeChangeRepoDetails(options) {
-  const launcher = path14.resolve(getBridgeWorkspaceDirectory());
-  const mirror = options.agentMirrorRootAbs ? path14.resolve(options.agentMirrorRootAbs) : null;
+  const launcher = path16.resolve(getBridgeWorkspaceDirectory());
+  const mirror = options.agentMirrorRootAbs ? path16.resolve(options.agentMirrorRootAbs) : null;
   const out = [];
   const filter = options.repoFilterRelPath != null ? normRepoRel(options.repoFilterRelPath) : null;
   const basisInput = options.basis ?? { kind: "working" };
@@ -33171,7 +33970,7 @@ async function getWorkingTreeChangeRepoDetails(options) {
   }
   const basis = filter == null && basisInput.kind === "commit" ? { kind: "working" } : basisInput;
   for (const target of options.commitTargetAbsDirs) {
-    const t = path14.resolve(target);
+    const t = path16.resolve(target);
     if (!await isGitRepoDirectory(t)) continue;
     const g = simpleGit(t);
     let branch = "HEAD";
@@ -33184,7 +33983,7 @@ async function getWorkingTreeChangeRepoDetails(options) {
     const remoteDisplay = formatRemoteDisplayLabel(remoteUrl);
     let repoRelPath;
     if (mirror) {
-      const relNorm = path14.relative(mirror, path14.dirname(t));
+      const relNorm = path16.relative(mirror, path16.dirname(t));
       repoRelPath = relNorm === "" ? "." : relNorm.replace(/\\/g, "/");
     } else {
       let top = t;
@@ -33193,8 +33992,8 @@ async function getWorkingTreeChangeRepoDetails(options) {
       } catch {
         top = t;
       }
-      const rel = path14.relative(launcher, path14.resolve(top)).replace(/\\/g, "/") || ".";
-      repoRelPath = rel.startsWith("..") ? path14.basename(path14.resolve(top)) : rel;
+      const rel = path16.relative(launcher, path16.resolve(top)).replace(/\\/g, "/") || ".";
+      repoRelPath = rel.startsWith("..") ? path16.basename(path16.resolve(top)) : rel;
     }
     const norm = normRepoRel(repoRelPath === "" ? "." : repoRelPath);
     if (filter && norm !== filter) continue;
@@ -33286,7 +34085,7 @@ var SessionWorktreeManager = class {
     }
     if (!opts.isNewSession) {
       const agentCwd = this.sessionAgentCwd.get(sessionId);
-      if (agentCwd) return path15.resolve(agentCwd);
+      if (agentCwd) return path17.resolve(agentCwd);
       return void 0;
     }
     const prep = await prepareNewSessionWorktrees({
@@ -33299,7 +34098,7 @@ var SessionWorktreeManager = class {
     if (!prep) return void 0;
     this.sessionPaths.set(sessionId, prep.worktreePaths);
     this.sessionAgentCwd.set(sessionId, prep.agentCwd);
-    return path15.resolve(prep.agentCwd);
+    return path17.resolve(prep.agentCwd);
   }
   async renameSessionBranch(sessionId, newBranch) {
     const paths = this.sessionPaths.get(sessionId);
@@ -33320,7 +34119,7 @@ var SessionWorktreeManager = class {
   getAgentCwdForSession(sessionId) {
     if (!sessionId) return null;
     const c = this.sessionAgentCwd.get(sessionId);
-    return c ? path15.resolve(c) : null;
+    return c ? path17.resolve(c) : null;
   }
   async removeSessionWorktrees(sessionId) {
     const paths = this.sessionPaths.get(sessionId);
@@ -33368,30 +34167,30 @@ var SessionWorktreeManager = class {
   }
 };
 function defaultWorktreesRootAbs() {
-  return path15.join(os3.homedir(), ".buildautomaton", "worktrees");
+  return path17.join(os4.homedir(), ".buildautomaton", "worktrees");
 }
 
 // src/files/watch-file-index.ts
 import { watch } from "node:fs";
-import path22 from "node:path";
+import path24 from "node:path";
 
 // src/files/index/build-file-index.ts
-import path19 from "node:path";
+import path21 from "node:path";
 
 // src/runtime/yield-to-event-loop.ts
 function yieldToEventLoop() {
-  return new Promise((resolve16) => setImmediate(resolve16));
+  return new Promise((resolve17) => setImmediate(resolve17));
 }
 
 // src/files/index/walk-workspace-tree.ts
-import fs12 from "node:fs";
-import path17 from "node:path";
+import fs18 from "node:fs";
+import path19 from "node:path";
 
 // src/files/index/constants.ts
-import path16 from "node:path";
-import os4 from "node:os";
+import path18 from "node:path";
+import os5 from "node:os";
 var INDEX_WORK_YIELD_EVERY = 256;
-var INDEX_DIR = path16.join(os4.homedir(), ".buildautomaton");
+var INDEX_DIR = path18.join(os5.homedir(), ".buildautomaton");
 var INDEX_HASH_LEN = 16;
 var INDEX_VERSION = 2;
 var INDEX_LOG_PREFIX = "[file-index]";
@@ -33400,23 +34199,23 @@ var INDEX_LOG_PREFIX = "[file-index]";
 function walkWorkspaceTreeSync(dir, baseDir, out) {
   let names;
   try {
-    names = fs12.readdirSync(dir);
+    names = fs18.readdirSync(dir);
   } catch {
     return;
   }
   for (const name of names) {
     if (name.startsWith(".")) continue;
-    const full = path17.join(dir, name);
-    let stat2;
+    const full = path19.join(dir, name);
+    let stat3;
     try {
-      stat2 = fs12.statSync(full);
+      stat3 = fs18.statSync(full);
     } catch {
       continue;
     }
-    const relative5 = path17.relative(baseDir, full).replace(/\\/g, "/");
-    if (stat2.isDirectory()) {
+    const relative5 = path19.relative(baseDir, full).replace(/\\/g, "/");
+    if (stat3.isDirectory()) {
       walkWorkspaceTreeSync(full, baseDir, out);
-    } else if (stat2.isFile()) {
+    } else if (stat3.isFile()) {
       out.push(relative5);
     }
   }
@@ -33424,7 +34223,7 @@ function walkWorkspaceTreeSync(dir, baseDir, out) {
 async function walkWorkspaceTreeAsync(dir, baseDir, out, state) {
   let names;
   try {
-    names = await fs12.promises.readdir(dir);
+    names = await fs18.promises.readdir(dir);
   } catch {
     return;
   }
@@ -33434,17 +34233,17 @@ async function walkWorkspaceTreeAsync(dir, baseDir, out, state) {
       await yieldToEventLoop();
     }
     state.n++;
-    const full = path17.join(dir, name);
-    let stat2;
+    const full = path19.join(dir, name);
+    let stat3;
     try {
-      stat2 = await fs12.promises.stat(full);
+      stat3 = await fs18.promises.stat(full);
     } catch {
       continue;
     }
-    const relative5 = path17.relative(baseDir, full).replace(/\\/g, "/");
-    if (stat2.isDirectory()) {
+    const relative5 = path19.relative(baseDir, full).replace(/\\/g, "/");
+    if (stat3.isDirectory()) {
       await walkWorkspaceTreeAsync(full, baseDir, out, state);
-    } else if (stat2.isFile()) {
+    } else if (stat3.isFile()) {
       out.push(relative5);
     }
   }
@@ -33522,22 +34321,22 @@ async function buildTrigramMapForPathsAsync(paths) {
 }
 
 // src/files/index/write-index-file.ts
-import fs13 from "node:fs";
+import fs19 from "node:fs";
 
 // src/files/index/paths.ts
-import path18 from "node:path";
+import path20 from "node:path";
 import crypto2 from "node:crypto";
 function getIndexPathForCwd(resolvedCwd) {
   const hash = crypto2.createHash("sha256").update(resolvedCwd).digest("hex").slice(0, INDEX_HASH_LEN);
-  return path18.join(INDEX_DIR, `.file-index-${hash}.json`);
+  return path20.join(INDEX_DIR, `.file-index-${hash}.json`);
 }
 
 // src/files/index/write-index-file.ts
 function writeIndexFileSync(resolvedCwd, data) {
   const indexPath = getIndexPathForCwd(resolvedCwd);
   try {
-    if (!fs13.existsSync(INDEX_DIR)) fs13.mkdirSync(INDEX_DIR, { recursive: true });
-    fs13.writeFileSync(indexPath, JSON.stringify(data), "utf8");
+    if (!fs19.existsSync(INDEX_DIR)) fs19.mkdirSync(INDEX_DIR, { recursive: true });
+    fs19.writeFileSync(indexPath, JSON.stringify(data), "utf8");
   } catch (e) {
     console.error(`${INDEX_LOG_PREFIX} Failed to write index:`, e);
   }
@@ -33545,8 +34344,8 @@ function writeIndexFileSync(resolvedCwd, data) {
 async function writeIndexFileAsync(resolvedCwd, data) {
   const indexPath = getIndexPathForCwd(resolvedCwd);
   try {
-    await fs13.promises.mkdir(INDEX_DIR, { recursive: true });
-    await fs13.promises.writeFile(indexPath, JSON.stringify(data), "utf8");
+    await fs19.promises.mkdir(INDEX_DIR, { recursive: true });
+    await fs19.promises.writeFile(indexPath, JSON.stringify(data), "utf8");
   } catch (e) {
     console.error(`${INDEX_LOG_PREFIX} Failed to write index:`, e);
   }
@@ -33560,7 +34359,7 @@ function sortPaths(paths) {
   paths.sort((a, b) => a.localeCompare(b, void 0, { sensitivity: "base" }));
 }
 function buildFileIndex(cwd) {
-  const resolved = path19.resolve(cwd);
+  const resolved = path21.resolve(cwd);
   const paths = [];
   walkWorkspaceTreeSync(resolved, resolved, paths);
   sortPaths(paths);
@@ -33570,7 +34369,7 @@ function buildFileIndex(cwd) {
   return data;
 }
 async function buildFileIndexAsync(cwd) {
-  const resolved = path19.resolve(cwd);
+  const resolved = path21.resolve(cwd);
   const paths = [];
   await walkWorkspaceTreeAsync(resolved, resolved, paths, createWalkYieldState());
   await yieldToEventLoop();
@@ -33582,13 +34381,13 @@ async function buildFileIndexAsync(cwd) {
 }
 
 // src/files/index/load-file-index.ts
-import fs14 from "node:fs";
-import path20 from "node:path";
+import fs20 from "node:fs";
+import path22 from "node:path";
 function loadFileIndex(cwd) {
-  const resolved = path20.resolve(cwd);
+  const resolved = path22.resolve(cwd);
   const indexPath = getIndexPathForCwd(resolved);
   try {
-    const raw = fs14.readFileSync(indexPath, "utf8");
+    const raw = fs20.readFileSync(indexPath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed !== null && typeof parsed === "object" && Array.isArray(parsed.paths)) {
       const obj = parsed;
@@ -33607,9 +34406,9 @@ function loadFileIndex(cwd) {
 }
 
 // src/files/index/ensure-file-index.ts
-import path21 from "node:path";
+import path23 from "node:path";
 async function ensureFileIndexAsync(cwd) {
-  const resolved = path21.resolve(cwd);
+  const resolved = path23.resolve(cwd);
   const cached2 = loadFileIndex(resolved);
   if (cached2 !== null) return { data: cached2, fromCache: true };
   const data = await buildFileIndexAsync(resolved);
@@ -33692,7 +34491,7 @@ function createFsWatcher(resolved, schedule) {
   }
 }
 function startFileIndexWatcher(cwd = getBridgeWorkspaceDirectory()) {
-  const resolved = path22.resolve(cwd);
+  const resolved = path24.resolve(cwd);
   void buildFileIndexAsync(resolved).catch((e) => {
     console.error("[file-index] Initial index build failed:", e);
   });
@@ -33720,7 +34519,7 @@ function startFileIndexWatcher(cwd = getBridgeWorkspaceDirectory()) {
 }
 
 // src/dev-servers/manager/dev-server-manager.ts
-import { rm } from "node:fs/promises";
+import { rm as rm2 } from "node:fs/promises";
 
 // src/dev-servers/process/send-server-status.ts
 function sendDevServerStatus(getWs, serverId, status, options) {
@@ -33739,15 +34538,15 @@ function sendDevServerStatus(getWs, serverId, status, options) {
 
 // src/dev-servers/process/terminate-child-process.ts
 async function sigtermAndWaitForExit(proc, graceMs, log2, shortId) {
-  const exited = new Promise((resolve16) => {
-    proc.once("exit", () => resolve16());
+  const exited = new Promise((resolve17) => {
+    proc.once("exit", () => resolve17());
   });
   log2(`[dev-server] Sending SIGTERM to ${shortId} (pid=${proc.pid ?? "?"}).`);
   try {
     proc.kill("SIGTERM");
   } catch {
   }
-  await Promise.race([exited, new Promise((resolve16) => setTimeout(resolve16, graceMs))]);
+  await Promise.race([exited, new Promise((resolve17) => setTimeout(resolve17, graceMs))]);
 }
 function forceKillChild(proc, log2, shortId, graceMs) {
   log2(
@@ -33761,7 +34560,7 @@ function forceKillChild(proc, log2, shortId, graceMs) {
 }
 
 // src/dev-servers/process/wire-dev-server-child-process.ts
-import fs15 from "node:fs";
+import fs21 from "node:fs";
 
 // src/dev-servers/manager/forward-pipe.ts
 function forwardChildPipe(childReadable, terminal, onData) {
@@ -33797,7 +34596,7 @@ function wireDevServerChildProcess(d) {
         d.setPollInterval(void 0);
         return;
       }
-      fs15.readFile(d.mergedLogPath, (err, buf) => {
+      fs21.readFile(d.mergedLogPath, (err, buf) => {
         if (err || (d.getSpawnGeneration() ?? 0) !== d.scheduledGen) return;
         if (buf.length <= d.mergedReadPos.value) return;
         const chunk = Buffer.from(buf.subarray(d.mergedReadPos.value));
@@ -33835,7 +34634,7 @@ ${errTail}` : ""}`);
       d.sendStatus(code === 0 || code == null ? "stopped" : "error", detail, tails);
     };
     if (mergedPath) {
-      fs15.readFile(mergedPath, (err, buf) => {
+      fs21.readFile(mergedPath, (err, buf) => {
         if (!err && buf.length > d.mergedReadPos.value) {
           const chunk = Buffer.from(buf.subarray(d.mergedReadPos.value));
           if (chunk.length > 0) {
@@ -33937,13 +34736,13 @@ function parseDevServerDefs(servers) {
 }
 
 // src/dev-servers/manager/shell-spawn/utils.ts
-import fs16 from "node:fs";
+import fs22 from "node:fs";
 function isSpawnEbadf(e) {
   return typeof e === "object" && e !== null && "code" in e && e.code === "EBADF";
 }
 function rmDirQuiet(dir) {
   try {
-    fs16.rmSync(dir, { recursive: true, force: true });
+    fs22.rmSync(dir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -33951,7 +34750,7 @@ var cachedDevNullReadFd;
 function devNullReadFd() {
   if (cachedDevNullReadFd === void 0) {
     const devPath = process.platform === "win32" ? "nul" : "/dev/null";
-    cachedDevNullReadFd = fs16.openSync(devPath, "r");
+    cachedDevNullReadFd = fs22.openSync(devPath, "r");
   }
   return cachedDevNullReadFd;
 }
@@ -34025,15 +34824,15 @@ function trySpawnShellTruePiped(command, env, cwd, devNullFd, signal) {
 
 // src/dev-servers/manager/shell-spawn/try-spawn-merged-log-file.ts
 import { spawn as spawn6 } from "node:child_process";
-import fs17 from "node:fs";
+import fs23 from "node:fs";
 import { tmpdir } from "node:os";
-import path23 from "node:path";
+import path25 from "node:path";
 function trySpawnMergedLogFile(command, env, cwd, signal) {
-  const tmpRoot = fs17.mkdtempSync(path23.join(tmpdir(), "ba-devsrv-log-"));
-  const logPath = path23.join(tmpRoot, "combined.log");
+  const tmpRoot = fs23.mkdtempSync(path25.join(tmpdir(), "ba-devsrv-log-"));
+  const logPath = path25.join(tmpRoot, "combined.log");
   let logFd;
   try {
-    logFd = fs17.openSync(logPath, "a");
+    logFd = fs23.openSync(logPath, "a");
   } catch {
     rmDirQuiet(tmpRoot);
     return null;
@@ -34052,7 +34851,7 @@ function trySpawnMergedLogFile(command, env, cwd, signal) {
     } else {
       proc = spawn6("/bin/sh", ["-c", command], { env, cwd, stdio, ...signal ? { signal } : {} });
     }
-    fs17.closeSync(logFd);
+    fs23.closeSync(logFd);
     return {
       proc,
       pipedStdoutStderr: true,
@@ -34061,7 +34860,7 @@ function trySpawnMergedLogFile(command, env, cwd, signal) {
     };
   } catch (e) {
     try {
-      fs17.closeSync(logFd);
+      fs23.closeSync(logFd);
     } catch {
     }
     rmDirQuiet(tmpRoot);
@@ -34072,22 +34871,22 @@ function trySpawnMergedLogFile(command, env, cwd, signal) {
 
 // src/dev-servers/manager/shell-spawn/try-spawn-shell-script-log-redirect.ts
 import { spawn as spawn7 } from "node:child_process";
-import fs18 from "node:fs";
+import fs24 from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import path24 from "node:path";
+import path26 from "node:path";
 function shSingleQuote(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
 function trySpawnShellScriptLogRedirectUnix(command, env, cwd, signal) {
-  const tmpRoot = fs18.mkdtempSync(path24.join(tmpdir2(), "ba-devsrv-sh-"));
-  const logPath = path24.join(tmpRoot, "combined.log");
-  const innerPath = path24.join(tmpRoot, "_cmd.sh");
-  const runnerPath = path24.join(tmpRoot, "_run.sh");
+  const tmpRoot = fs24.mkdtempSync(path26.join(tmpdir2(), "ba-devsrv-sh-"));
+  const logPath = path26.join(tmpRoot, "combined.log");
+  const innerPath = path26.join(tmpRoot, "_cmd.sh");
+  const runnerPath = path26.join(tmpRoot, "_run.sh");
   try {
-    fs18.writeFileSync(innerPath, `#!/bin/sh
+    fs24.writeFileSync(innerPath, `#!/bin/sh
 ${command}
 `);
-    fs18.writeFileSync(
+    fs24.writeFileSync(
       runnerPath,
       `#!/bin/sh
 cd ${shSingleQuote(cwd)}
@@ -34113,13 +34912,13 @@ cd ${shSingleQuote(cwd)}
   }
 }
 function trySpawnShellScriptLogRedirectWin(command, env, cwd, signal) {
-  const tmpRoot = fs18.mkdtempSync(path24.join(tmpdir2(), "ba-devsrv-sh-"));
-  const logPath = path24.join(tmpRoot, "combined.log");
-  const runnerPath = path24.join(tmpRoot, "_run.bat");
+  const tmpRoot = fs24.mkdtempSync(path26.join(tmpdir2(), "ba-devsrv-sh-"));
+  const logPath = path26.join(tmpRoot, "combined.log");
+  const runnerPath = path26.join(tmpRoot, "_run.bat");
   const q = (p) => `"${p.replace(/"/g, '""')}"`;
   const com = process.env.ComSpec || "cmd.exe";
   try {
-    fs18.writeFileSync(
+    fs24.writeFileSync(
       runnerPath,
       `@ECHO OFF\r
 CD /D ${q(cwd)}\r
@@ -34229,8 +35028,90 @@ var StreamTail = class {
   }
 };
 
-// src/dev-servers/manager/dev-server-manager.ts
+// src/dev-servers/manager/dev-server-constants.ts
 var BRIDGE_SHUTDOWN_GRACE_MS = 8e3;
+
+// src/dev-servers/manager/dev-server-firehose-messages.ts
+function buildFirehoseSnapshotMessage(params) {
+  const payload = {
+    type: "log_snapshot",
+    serverId: params.serverId,
+    viewerId: params.viewerId,
+    stdoutTail: params.tails.stdout,
+    stderrTail: params.tails.stderr
+  };
+  return params.e2ee ? params.e2ee.encryptFields(payload, ["stdoutTail", "stderrTail"]) : payload;
+}
+function buildFirehoseLogChunkMessage(params) {
+  const payload = {
+    type: "log_chunk",
+    serverId: params.serverId,
+    stream: params.stream,
+    text: params.text
+  };
+  return params.e2ee ? params.e2ee.encryptFields(payload, ["text"]) : payload;
+}
+
+// src/dev-servers/manager/dev-server-firehose-sink.ts
+var DevServerFirehoseSink = class {
+  constructor(options) {
+    this.options = options;
+  }
+  logViewerRefCountByServerId = /* @__PURE__ */ new Map();
+  firehoseSend = null;
+  attach(send) {
+    this.firehoseSend = send;
+  }
+  detach() {
+    this.firehoseSend = null;
+    this.logViewerRefCountByServerId.clear();
+  }
+  openLogViewer(serverId, viewerId) {
+    const next = (this.logViewerRefCountByServerId.get(serverId) ?? 0) + 1;
+    this.logViewerRefCountByServerId.set(serverId, next);
+    this.sendSnapshot(serverId, viewerId);
+  }
+  closeLogViewer(serverId) {
+    const n = (this.logViewerRefCountByServerId.get(serverId) ?? 0) - 1;
+    if (n <= 0) this.logViewerRefCountByServerId.delete(serverId);
+    else this.logViewerRefCountByServerId.set(serverId, n);
+  }
+  pushLogChunk(serverId, stream, chunk) {
+    if ((this.logViewerRefCountByServerId.get(serverId) ?? 0) <= 0) return;
+    if (!this.options.isPipedCaptureEnabled(serverId)) return;
+    if (!this.firehoseSend) return;
+    const text = chunk.toString("utf8");
+    setImmediate(() => {
+      if (!this.firehoseSend) return;
+      this.firehoseSend(buildFirehoseLogChunkMessage({ serverId, stream, text, e2ee: this.options.e2ee }));
+    });
+  }
+  sendSnapshot(serverId, viewerId) {
+    const payload = buildFirehoseSnapshotMessage({
+      serverId,
+      viewerId,
+      tails: this.options.getTails(serverId),
+      e2ee: this.options.e2ee
+    });
+    setImmediate(() => {
+      const send = this.firehoseSend;
+      if (!send) return;
+      send(payload);
+    });
+  }
+};
+
+// src/dev-servers/manager/cleanup-merged-log-dir.ts
+import { rm } from "node:fs/promises";
+function cleanupMergedLogDirForServer(map2, serverId) {
+  const mergedDir = map2.get(serverId);
+  if (!mergedDir) return;
+  map2.delete(serverId);
+  void rm(mergedDir, { recursive: true, force: true }).catch(() => {
+  });
+}
+
+// src/dev-servers/manager/dev-server-manager.ts
 var emptyTails = () => ({ stdout: [], stderr: [] });
 var DevServerManager = class {
   defsById = /* @__PURE__ */ new Map();
@@ -34238,66 +35119,36 @@ var DevServerManager = class {
   streamTailsByServerId = /* @__PURE__ */ new Map();
   spawnGenerationByServerId = /* @__PURE__ */ new Map();
   pipedCaptureByServerId = /* @__PURE__ */ new Map();
-  logViewerRefCountByServerId = /* @__PURE__ */ new Map();
-  firehoseSend = null;
   mergedLogPollByServerId = /* @__PURE__ */ new Map();
   mergedLogCleanupDirByServerId = /* @__PURE__ */ new Map();
   abortControllersByServerId = /* @__PURE__ */ new Map();
   getWs;
   log;
   getBridgeCwd;
+  e2ee;
+  firehoseSink;
   constructor(options) {
     this.getWs = options.getWs;
     this.log = options.log;
     this.getBridgeCwd = options.getBridgeCwd ?? (() => process.cwd());
+    this.e2ee = options.e2ee;
+    this.firehoseSink = new DevServerFirehoseSink({
+      getTails: (serverId) => this.snapshotTails(serverId),
+      isPipedCaptureEnabled: (serverId) => this.pipedCaptureByServerId.get(serverId) === true,
+      e2ee: this.e2ee
+    });
   }
   attachFirehose(send) {
-    this.firehoseSend = send;
+    this.firehoseSink.attach(send);
   }
   detachFirehose() {
-    this.firehoseSend = null;
-    this.logViewerRefCountByServerId.clear();
+    this.firehoseSink.detach();
   }
   handleFirehoseLogViewerOpen(serverId, _viewerId) {
-    const next = (this.logViewerRefCountByServerId.get(serverId) ?? 0) + 1;
-    this.logViewerRefCountByServerId.set(serverId, next);
-    this.sendSnapshotToFirehose(serverId, _viewerId);
+    this.firehoseSink.openLogViewer(serverId, _viewerId);
   }
   handleFirehoseLogViewerClose(serverId, _viewerId) {
-    const n = (this.logViewerRefCountByServerId.get(serverId) ?? 0) - 1;
-    if (n <= 0) this.logViewerRefCountByServerId.delete(serverId);
-    else this.logViewerRefCountByServerId.set(serverId, n);
-  }
-  sendSnapshotToFirehose(serverId, viewerId) {
-    const tails = this.streamTailsByServerId.get(serverId);
-    const payload = {
-      type: "log_snapshot",
-      serverId,
-      viewerId,
-      stdoutTail: tails?.stdout.getTail() ?? [],
-      stderrTail: tails?.stderr.getTail() ?? []
-    };
-    setImmediate(() => {
-      const send = this.firehoseSend;
-      if (!send) return;
-      send(payload);
-    });
-  }
-  pushRemoteLogChunk(serverId, stream, chunk) {
-    if ((this.logViewerRefCountByServerId.get(serverId) ?? 0) <= 0) return;
-    if (!this.pipedCaptureByServerId.get(serverId)) return;
-    const send = this.firehoseSend;
-    if (!send) return;
-    const text = chunk.toString("utf8");
-    setImmediate(() => {
-      if (!this.firehoseSend) return;
-      this.firehoseSend({
-        type: "log_chunk",
-        serverId,
-        stream,
-        text
-      });
-    });
+    this.firehoseSink.closeLogViewer(serverId);
   }
   applyConfig(servers) {
     this.defsById.clear();
@@ -34350,12 +35201,7 @@ var DevServerManager = class {
     }
     this.clearTails(serverId);
     this.pipedCaptureByServerId.delete(serverId);
-    const mergedDir = this.mergedLogCleanupDirByServerId.get(serverId);
-    if (mergedDir) {
-      this.mergedLogCleanupDirByServerId.delete(serverId);
-      void rm(mergedDir, { recursive: true, force: true }).catch(() => {
-      });
-    }
+    cleanupMergedLogDirForServer(this.mergedLogCleanupDirByServerId, serverId);
     this.sendStatus(serverId, "stopped", void 0, tails);
   }
   start(serverId) {
@@ -34438,7 +35284,7 @@ var DevServerManager = class {
         log: this.log,
         stdoutTail,
         stderrTail,
-        pushRemoteLogChunk: (sid, stream, chunk) => this.pushRemoteLogChunk(sid, stream, chunk),
+        pushRemoteLogChunk: (sid, stream, chunk) => this.firehoseSink.pushLogChunk(sid, stream, chunk),
         sendStatus: (status, detail, tails) => this.sendStatus(serverId, status, detail, tails),
         setPollInterval: (iv) => {
           if (iv) this.mergedLogPollByServerId.set(serverId, iv);
@@ -34452,7 +35298,7 @@ var DevServerManager = class {
           this.mergedLogCleanupDirByServerId.delete(serverId);
         },
         rmMergedCleanupDir: (dir) => {
-          void rm(dir, { recursive: true, force: true }).catch(() => {
+          void rm2(dir, { recursive: true, force: true }).catch(() => {
           });
         },
         clearTailBuffers: () => this.clearTails(serverId)
@@ -34489,12 +35335,7 @@ var DevServerManager = class {
     this.processes.delete(serverId);
     this.clearPoll(serverId);
     this.pipedCaptureByServerId.delete(serverId);
-    const mergedDir = this.mergedLogCleanupDirByServerId.get(serverId);
-    if (mergedDir) {
-      this.mergedLogCleanupDirByServerId.delete(serverId);
-      void rm(mergedDir, { recursive: true, force: true }).catch(() => {
-      });
-    }
+    cleanupMergedLogDirForServer(this.mergedLogCleanupDirByServerId, serverId);
     const tails = this.snapshotTails(serverId);
     this.clearTails(serverId);
     this.sendStatus(serverId, "unknown", "Bridge closed before process exited", tails);
@@ -34588,7 +35429,7 @@ async function proxyToLocal(request) {
   };
   const maxAttempts = isIdempotentProxyMethod(request.method) ? LOCAL_PREVIEW_FETCH_RETRY_DELAYS_MS.length + 1 : 1;
   for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-    const once = await new Promise((resolve16) => {
+    const once = await new Promise((resolve17) => {
       const req = mod.request(opts, (res) => {
         const chunks = [];
         res.on("data", (c) => chunks.push(c));
@@ -34599,7 +35440,7 @@ async function proxyToLocal(request) {
             if (typeof v === "string") headers[k] = v;
             else if (Array.isArray(v) && v[0]) headers[k] = v[0];
           }
-          resolve16({
+          resolve17({
             id: request.id,
             statusCode: res.statusCode ?? 0,
             headers,
@@ -34608,7 +35449,7 @@ async function proxyToLocal(request) {
         });
       });
       req.on("error", (err) => {
-        resolve16({
+        resolve17({
           id: request.id,
           statusCode: 0,
           headers: {},
@@ -34969,30 +35810,30 @@ function createOnBridgeIdentified(opts) {
 }
 
 // src/skills/discover-local-agent-skills.ts
-import fs19 from "node:fs";
-import path25 from "node:path";
+import fs25 from "node:fs";
+import path27 from "node:path";
 var SKILL_DISCOVERY_ROOTS = [".agents/skills", ".claude/skills", ".cursor/skills", "skills"];
 function discoverLocalSkills(cwd) {
   const out = [];
   const seenKeys = /* @__PURE__ */ new Set();
   for (const rel of SKILL_DISCOVERY_ROOTS) {
-    const base = path25.join(cwd, rel);
-    if (!fs19.existsSync(base) || !fs19.statSync(base).isDirectory()) continue;
+    const base = path27.join(cwd, rel);
+    if (!fs25.existsSync(base) || !fs25.statSync(base).isDirectory()) continue;
     let entries = [];
     try {
-      entries = fs19.readdirSync(base);
+      entries = fs25.readdirSync(base);
     } catch {
       continue;
     }
     for (const name of entries) {
-      const dir = path25.join(base, name);
+      const dir = path27.join(base, name);
       try {
-        if (!fs19.statSync(dir).isDirectory()) continue;
+        if (!fs25.statSync(dir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const skillMd = path25.join(dir, "SKILL.md");
-      if (!fs19.existsSync(skillMd)) continue;
+      const skillMd = path27.join(dir, "SKILL.md");
+      if (!fs25.existsSync(skillMd)) continue;
       const key = `${rel}/${name}`;
       if (seenKeys.has(key)) continue;
       seenKeys.add(key);
@@ -35004,23 +35845,23 @@ function discoverLocalSkills(cwd) {
 function discoverSkillLayoutRoots(cwd) {
   const roots = [];
   for (const rel of SKILL_DISCOVERY_ROOTS) {
-    const base = path25.join(cwd, rel);
-    if (!fs19.existsSync(base) || !fs19.statSync(base).isDirectory()) continue;
+    const base = path27.join(cwd, rel);
+    if (!fs25.existsSync(base) || !fs25.statSync(base).isDirectory()) continue;
     let entries = [];
     try {
-      entries = fs19.readdirSync(base);
+      entries = fs25.readdirSync(base);
     } catch {
       continue;
     }
     const skills2 = [];
     for (const name of entries) {
-      const dir = path25.join(base, name);
+      const dir = path27.join(base, name);
       try {
-        if (!fs19.statSync(dir).isDirectory()) continue;
+        if (!fs25.statSync(dir).isDirectory()) continue;
       } catch {
         continue;
       }
-      if (!fs19.existsSync(path25.join(dir, "SKILL.md"))) continue;
+      if (!fs25.existsSync(path27.join(dir, "SKILL.md"))) continue;
       const relPath = `${rel}/${name}`.replace(/\\/g, "/");
       skills2.push({ name, relPath });
     }
@@ -35122,7 +35963,7 @@ function reportGitRepos(getWs, log2) {
 var handleAuthToken = (msg, { log: log2 }) => {
   if (typeof msg.token !== "string") return;
   log2("Received auth token. Save it for future runs:");
-  log2(`  export BUILDAMATON_AUTH_TOKEN="${msg.token}"`);
+  log2(`  export BUILDAUTOMATON_AUTH_TOKEN="${msg.token}"`);
 };
 
 // src/bridge/routing/handlers/bridge-identified.ts
@@ -35165,13 +36006,13 @@ var handleAgentConfigMessage = (msg, deps) => {
 };
 
 // src/agents/acp/from-bridge/handle-bridge-prompt.ts
-import * as path27 from "node:path";
-import { execFile as execFile5 } from "node:child_process";
-import { promisify as promisify5 } from "node:util";
+import * as path29 from "node:path";
+import { execFile as execFile10 } from "node:child_process";
+import { promisify as promisify10 } from "node:util";
 
 // src/git/bridge-queue-key.ts
-import * as path26 from "node:path";
-import { createHash } from "node:crypto";
+import * as path28 from "node:path";
+import { createHash as createHash2 } from "node:crypto";
 function normalizeCanonicalGitUrl(url2) {
   let s = url2.trim();
   if (!s) return s;
@@ -35195,14 +36036,14 @@ function normalizeCanonicalGitUrl(url2) {
 }
 function canonicalUrlToRepoIdSync(url2) {
   const normalized = normalizeCanonicalGitUrl(url2);
-  return createHash("sha256").update(normalized).digest("hex").slice(0, 32);
+  return createHash2("sha256").update(normalized).digest("hex").slice(0, 32);
 }
 function fallbackRepoIdFromPath(absPath) {
-  return createHash("sha256").update(path26.resolve(absPath)).digest("hex").slice(0, 32);
+  return createHash2("sha256").update(path28.resolve(absPath)).digest("hex").slice(0, 32);
 }
 async function resolveBridgeQueueBindFields(options) {
   const { effectiveCwd, worktreePaths, primaryRepoRoots, log: log2 } = options;
-  const cwdAbs = worktreePaths.length > 0 ? path26.resolve(worktreePaths[0]) : path26.resolve(effectiveCwd);
+  const cwdAbs = worktreePaths.length > 0 ? path28.resolve(worktreePaths[0]) : path28.resolve(effectiveCwd);
   if (!primaryRepoRoots.length) {
     log2("[Bridge service] Prompt queue bind skipped: no Git repository roots under the working directory.");
     return null;
@@ -35225,10 +36066,10 @@ async function resolveBridgeQueueBindFields(options) {
 }
 
 // src/agents/acp/from-bridge/handle-bridge-prompt.ts
-var execFileAsync5 = promisify5(execFile5);
+var execFileAsync9 = promisify10(execFile10);
 async function readGitBranch(cwd) {
   try {
-    const { stdout } = await execFileAsync5("git", ["branch", "--show-current"], { cwd, maxBuffer: 64 * 1024 });
+    const { stdout } = await execFileAsync9("git", ["branch", "--show-current"], { cwd, maxBuffer: 64 * 1024 });
     const b = stdout.trim();
     return b || null;
   } catch {
@@ -35239,22 +36080,40 @@ function handleBridgePrompt(msg, deps) {
   const { getWs, log: log2, acpManager, sessionWorktreeManager } = deps;
   const rawPrompt = msg.prompt;
   const promptText = typeof rawPrompt === "string" ? rawPrompt : rawPrompt != null ? String(rawPrompt) : "";
+  const sessionId = msg.sessionId;
+  const runId = typeof msg.runId === "string" ? msg.runId : void 0;
+  const promptId = typeof msg.id === "string" ? msg.id : void 0;
+  const sendBridgeMessage = (message, encryptedFields = []) => {
+    const s = getWs();
+    if (!s) return false;
+    const wire = deps.e2ee && encryptedFields.length > 0 ? deps.e2ee.encryptFields(message, encryptedFields) : message;
+    sendWsMessage(s, wire);
+    return true;
+  };
   if (!promptText.trim()) {
     log2(
       `[Bridge service] Prompt ignored: empty or missing prompt text (session ${typeof msg.sessionId === "string" ? msg.sessionId.slice(0, 8) : "\u2014"}\u2026, run ${typeof msg.runId === "string" ? msg.runId.slice(0, 8) : "\u2014"}\u2026).`
     );
+    sendBridgeMessage(
+      {
+        type: "prompt_result",
+        ...promptId ? { id: promptId } : {},
+        ...sessionId ? { sessionId } : {},
+        ...runId ? { runId } : {},
+        success: false,
+        error: "Empty or missing prompt text from the bridge; this turn was not sent to the agent."
+      },
+      ["error"]
+    );
     return;
   }
-  const sessionId = msg.sessionId;
   const isNewSession = msg.isNewSession === true;
   const sessionWorktreesEnabled = msg.sessionWorktreesEnabled === true;
   const agentType = typeof msg.agentType === "string" && msg.agentType.trim() ? msg.agentType.trim() : void 0;
-  const runId = typeof msg.runId === "string" ? msg.runId : void 0;
   const mode = typeof msg.mode === "string" && msg.mode.trim() ? msg.mode.trim() : void 0;
   acpManager.logPromptReceivedFromBridge({ agentType, mode });
   const sendResult2 = (result) => {
-    const s = getWs();
-    if (s) sendWsMessage(s, result);
+    sendBridgeMessage(result, result.type === "prompt_result" ? ["output", "error"] : []);
   };
   const sendSessionUpdate = (payload) => {
     const s = getWs();
@@ -35263,11 +36122,19 @@ function handleBridgePrompt(msg, deps) {
       return;
     }
     const p = payload;
-    sendWsMessage(s, payload);
+    const wire = p.type === "session_update" && deps.e2ee ? deps.e2ee.encryptFields(payload, ["payload"]) : p.type === "session_file_change" && deps.e2ee ? deps.e2ee.encryptFields(payload, [
+      "path",
+      "oldText",
+      "newText",
+      "patchContent",
+      "isDirectory",
+      "directoryRemoved"
+    ]) : payload;
+    sendWsMessage(s, wire);
   };
   async function preambleAndPrompt(resolvedCwd) {
     const s = getWs();
-    const effectiveCwd = path27.resolve(resolvedCwd ?? getBridgeWorkspaceDirectory());
+    const effectiveCwd = path29.resolve(resolvedCwd ?? getBridgeWorkspaceDirectory());
     const worktreePaths = sessionWorktreeManager.getWorktreePathsForSession(sessionId) ?? [];
     const repoRoots = await resolveSnapshotRepoRoots({
       worktreePaths,
@@ -35375,8 +36242,8 @@ var PREVIEW_API_BASE_PATH = "/__preview";
 var PREVIEW_SECRET_HEADER = "X-Preview-Secret";
 var DEFAULT_PORT = 3e3;
 var DEFAULT_COMMAND = "npm run preview";
-var PREVIEW_COMMAND_ENV = "BUILDAMATON_PREVIEW_COMMAND";
-var PREVIEW_PORT_ENV = "BUILDAMATON_PREVIEW_PORT";
+var PREVIEW_COMMAND_ENV = "BUILDAUTOMATON_PREVIEW_COMMAND";
+var PREVIEW_PORT_ENV = "BUILDAUTOMATON_PREVIEW_PORT";
 var previewProcess = null;
 var previewPort = DEFAULT_PORT;
 var previewSecret = "";
@@ -35390,8 +36257,8 @@ function randomSecret() {
   }
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
-async function requestPreviewApi(port, secret, method, path32, body) {
-  const url2 = `http://127.0.0.1:${port}${path32}`;
+async function requestPreviewApi(port, secret, method, path34, body) {
+  const url2 = `http://127.0.0.1:${port}${path34}`;
   const headers = {
     [PREVIEW_SECRET_HEADER]: secret,
     "Content-Type": "application/json"
@@ -35403,7 +36270,7 @@ async function requestPreviewApi(port, secret, method, path32, body) {
   });
   const data = await res.json().catch(() => ({}));
   if (!res.ok) {
-    throw new Error(data?.error ?? `Preview API ${method} ${path32}: ${res.status}`);
+    throw new Error(data?.error ?? `Preview API ${method} ${path34}: ${res.status}`);
   }
   return data;
 }
@@ -35429,7 +36296,7 @@ var OPERATIONS = [
 var previewSkill = {
   id: "preview",
   name: "Preview",
-  description: "Start and manage a local preview server that implements the BuildAutomaton Preview Server API. Configure the command with BUILDAMATON_PREVIEW_COMMAND (default: npm run preview). The server receives PORT and PREVIEW_SECRET and must expose /__preview/status and /__preview/stop.",
+  description: "Start and manage a local preview server that implements the BuildAutomaton Preview Server API. Configure the command with BUILDAUTOMATON_PREVIEW_COMMAND (default: npm run preview). The server receives PORT and PREVIEW_SECRET and must expose /__preview/status and /__preview/stop.",
   operations: OPERATIONS,
   async execute(operationId, params) {
     const command = getPreviewCommand();
@@ -35566,15 +36433,15 @@ var handleSkillCallMessage = (msg, { getWs, log: log2 }) => {
 };
 
 // src/files/list-dir.ts
-import fs20 from "node:fs";
-import path29 from "node:path";
+import fs26 from "node:fs";
+import path31 from "node:path";
 
 // src/files/ensure-under-cwd.ts
-import path28 from "node:path";
+import path30 from "node:path";
 function ensureUnderCwd(relativePath, cwd = getBridgeWorkspaceDirectory()) {
-  const normalized = path28.normalize(relativePath).replace(/^(\.\/)+/, "");
-  const resolved = path28.resolve(cwd, normalized);
-  if (!resolved.startsWith(cwd + path28.sep) && resolved !== cwd) {
+  const normalized = path30.normalize(relativePath).replace(/^(\.\/)+/, "");
+  const resolved = path30.resolve(cwd, normalized);
+  if (!resolved.startsWith(cwd + path30.sep) && resolved !== cwd) {
     return null;
   }
   return resolved;
@@ -35588,7 +36455,7 @@ async function listDirAsync(relativePath) {
     return { error: "Path is outside working directory" };
   }
   try {
-    const names = await fs20.promises.readdir(resolved, { withFileTypes: true });
+    const names = await fs26.promises.readdir(resolved, { withFileTypes: true });
     const visible = names.filter((d) => !d.name.startsWith("."));
     const entries = [];
     for (let i = 0; i < visible.length; i++) {
@@ -35596,12 +36463,12 @@ async function listDirAsync(relativePath) {
         await yieldToEventLoop();
       }
       const d = visible[i];
-      const entryPath = path29.join(relativePath || ".", d.name).replace(/\\/g, "/");
-      const fullPath = path29.join(resolved, d.name);
+      const entryPath = path31.join(relativePath || ".", d.name).replace(/\\/g, "/");
+      const fullPath = path31.join(resolved, d.name);
       let isDir = d.isDirectory();
       if (d.isSymbolicLink()) {
         try {
-          const targetStat = await fs20.promises.stat(fullPath);
+          const targetStat = await fs26.promises.stat(fullPath);
           isDir = targetStat.isDirectory();
         } catch {
           isDir = false;
@@ -35626,25 +36493,25 @@ async function listDirAsync(relativePath) {
 }
 
 // src/files/read-file.ts
-import fs21 from "node:fs";
+import fs27 from "node:fs";
 import { StringDecoder } from "node:string_decoder";
 function resolveFilePath(relativePath) {
   const resolved = ensureUnderCwd(relativePath, getBridgeWorkspaceDirectory());
   if (!resolved) return { error: "Path is outside working directory" };
   let real;
   try {
-    real = fs21.realpathSync(resolved);
+    real = fs27.realpathSync(resolved);
   } catch {
     real = resolved;
   }
-  const stat2 = fs21.statSync(real);
-  if (!stat2.isFile()) return { error: "Not a file" };
+  const stat3 = fs27.statSync(real);
+  if (!stat3.isFile()) return { error: "Not a file" };
   return real;
 }
 var LINE_CHUNK_SIZE = 64 * 1024;
 function readFileRange(filePath, startLine, endLine, lineOffsetIn, lineChunkSize = LINE_CHUNK_SIZE) {
-  const fileSize = fs21.statSync(filePath).size;
-  const fd = fs21.openSync(filePath, "r");
+  const fileSize = fs27.statSync(filePath).size;
+  const fd = fs27.openSync(filePath, "r");
   const bufSize = 64 * 1024;
   const buf = Buffer.alloc(bufSize);
   const decoder = new StringDecoder("utf8");
@@ -35657,7 +36524,7 @@ function readFileRange(filePath, startLine, endLine, lineOffsetIn, lineChunkSize
   let line0Accum = "";
   try {
     let bytesRead;
-    while (!done && (bytesRead = fs21.readSync(fd, buf, 0, bufSize, null)) > 0) {
+    while (!done && (bytesRead = fs27.readSync(fd, buf, 0, bufSize, null)) > 0) {
       const text = partial2 + decoder.write(buf.subarray(0, bytesRead));
       partial2 = "";
       let lineStart = 0;
@@ -35792,10 +36659,10 @@ function readFileRange(filePath, startLine, endLine, lineOffsetIn, lineChunkSize
     }
     return { content: resultLines.join("\n"), size: fileSize };
   } finally {
-    fs21.closeSync(fd);
+    fs27.closeSync(fd);
   }
 }
-function readFile2(relativePath, startLine, endLine, lineOffset, lineChunkSize = LINE_CHUNK_SIZE) {
+function readFile3(relativePath, startLine, endLine, lineOffset, lineChunkSize = LINE_CHUNK_SIZE) {
   try {
     const result = resolveFilePath(relativePath);
     if (typeof result === "object") return result;
@@ -35803,43 +36670,45 @@ function readFile2(relativePath, startLine, endLine, lineOffset, lineChunkSize =
     if (hasRange) {
       return readFileRange(result, startLine, endLine, lineOffset, lineChunkSize);
     }
-    const stat2 = fs21.statSync(result);
-    const raw = fs21.readFileSync(result, "utf8");
+    const stat3 = fs27.statSync(result);
+    const raw = fs27.readFileSync(result, "utf8");
     const lines = raw.split(/\r?\n/);
-    return { content: raw, totalLines: lines.length, size: stat2.size };
+    return { content: raw, totalLines: lines.length, size: stat3.size };
   } catch (err) {
     return { error: err instanceof Error ? err.message : String(err) };
   }
 }
 async function readFileAsync(relativePath, startLine, endLine, lineOffset, lineChunkSize = LINE_CHUNK_SIZE) {
   await yieldToEventLoop();
-  return readFile2(relativePath, startLine, endLine, lineOffset, lineChunkSize);
+  return readFile3(relativePath, startLine, endLine, lineOffset, lineChunkSize);
 }
 
 // src/files/handle-file-browser-search.ts
 var SEARCH_LIMIT = 100;
-function handleFileBrowserSearch(msg, socket) {
+function handleFileBrowserSearch(msg, socket, e2ee) {
   void (async () => {
     await yieldToEventLoop();
     const q = typeof msg.q === "string" ? msg.q : "";
     const cwd = getBridgeWorkspaceDirectory();
     const index = loadFileIndex(cwd);
     if (index === null) {
-      sendWsMessage(socket, {
+      const payload2 = {
         type: "file_browser_search_response",
         id: msg.id,
         paths: [],
         indexReady: false
-      });
+      };
+      sendWsMessage(socket, e2ee ? e2ee.encryptFields(payload2, ["paths"]) : payload2);
       return;
     }
     const results = await searchFileIndexAsync(index, q, SEARCH_LIMIT);
-    sendWsMessage(socket, {
+    const payload = {
       type: "file_browser_search_response",
       id: msg.id,
       paths: results,
       indexReady: true
-    });
+    };
+    sendWsMessage(socket, e2ee ? e2ee.encryptFields(payload, ["paths"]) : payload);
   })();
 }
 function triggerFileIndexBuild() {
@@ -35851,7 +36720,10 @@ function triggerFileIndexBuild() {
 }
 
 // src/files/handle-file-browser-request.ts
-function handleFileBrowserRequest(msg, socket) {
+function sendFileBrowserMessage(socket, e2ee, payload) {
+  sendWsMessage(socket, e2ee ? e2ee.encryptFields(payload, ["entries", "content", "totalLines", "size", "lineOffset"]) : payload);
+}
+function handleFileBrowserRequest(msg, socket, e2ee) {
   void (async () => {
     const reqPath = msg.path.replace(/^\/+/, "") || ".";
     const op = msg.op === "read" ? "read" : "list";
@@ -35860,7 +36732,7 @@ function handleFileBrowserRequest(msg, socket) {
       if ("error" in result) {
         sendWsMessage(socket, { type: "file_browser_response", id: msg.id, error: result.error });
       } else {
-        sendWsMessage(socket, { type: "file_browser_response", id: msg.id, entries: result.entries });
+        sendFileBrowserMessage(socket, e2ee, { type: "file_browser_response", id: msg.id, entries: result.entries });
         if (reqPath === "." || reqPath === "") {
           triggerFileIndexBuild();
         }
@@ -35882,27 +36754,28 @@ function handleFileBrowserRequest(msg, socket) {
           size: result.size
         };
         if (result.lineOffset != null) payload.lineOffset = result.lineOffset;
-        sendWsMessage(socket, payload);
+        sendFileBrowserMessage(socket, e2ee, payload);
       }
     }
   })();
 }
 
 // src/bridge/routing/handlers/file-browser-messages.ts
-function handleFileBrowserRequestMessage(msg, { getWs }) {
+function handleFileBrowserRequestMessage(msg, { getWs, e2ee }) {
   if (typeof msg.id !== "string" || typeof msg.path !== "string") return;
   const socket = getWs();
   if (!socket) return;
   handleFileBrowserRequest(
     msg,
-    socket
+    socket,
+    e2ee
   );
 }
-function handleFileBrowserSearchMessage(msg, { getWs }) {
+function handleFileBrowserSearchMessage(msg, { getWs, e2ee }) {
   if (typeof msg.id !== "string") return;
   const socket = getWs();
   if (!socket) return;
-  handleFileBrowserSearch(msg, socket);
+  handleFileBrowserSearch(msg, socket, e2ee);
 }
 
 // src/bridge/routing/handlers/skill-layout-request.ts
@@ -35914,8 +36787,8 @@ function handleSkillLayoutRequest(msg, deps) {
 }
 
 // src/skills/install-remote-skills.ts
-import fs22 from "node:fs";
-import path30 from "node:path";
+import fs28 from "node:fs";
+import path32 from "node:path";
 function installRemoteSkills(cwd, targetDir, items) {
   const installed2 = [];
   if (!Array.isArray(items)) {
@@ -35926,15 +36799,15 @@ function installRemoteSkills(cwd, targetDir, items) {
       if (typeof item.sourceId !== "string" || typeof item.skillName !== "string" || typeof item.versionHash !== "string" || !Array.isArray(item.files)) {
         continue;
       }
-      const skillDir = path30.join(cwd, targetDir, item.skillName);
+      const skillDir = path32.join(cwd, targetDir, item.skillName);
       for (const f of item.files) {
         if (typeof f.path !== "string" || !f.text && !f.base64) continue;
-        const dest = path30.join(skillDir, f.path);
-        fs22.mkdirSync(path30.dirname(dest), { recursive: true });
+        const dest = path32.join(skillDir, f.path);
+        fs28.mkdirSync(path32.dirname(dest), { recursive: true });
         if (f.text !== void 0) {
-          fs22.writeFileSync(dest, f.text, "utf8");
+          fs28.writeFileSync(dest, f.text, "utf8");
         } else if (f.base64) {
-          fs22.writeFileSync(dest, Buffer.from(f.base64, "base64"));
+          fs28.writeFileSync(dest, Buffer.from(f.base64, "base64"));
         }
       }
       installed2.push({
@@ -35972,9 +36845,10 @@ var handleRefreshLocalSkills = (_msg, deps) => {
 };
 
 // src/bridge/routing/handlers/session-git-request.ts
-function sendResult(ws, id, payload) {
+function sendResult(ws, id, payload, e2ee, encryptedFields = []) {
   if (!ws) return;
-  sendWsMessage(ws, { type: "session_git_result", id, ...payload });
+  const message = { type: "session_git_result", id, ...payload };
+  sendWsMessage(ws, e2ee && encryptedFields.length > 0 ? e2ee.encryptFields(message, encryptedFields) : message);
 }
 var handleSessionGitRequestMessage = (msg, deps) => {
   if (typeof msg.id !== "string") return;
@@ -35984,7 +36858,7 @@ var handleSessionGitRequestMessage = (msg, deps) => {
     return;
   void (async () => {
     const ws = deps.getWs();
-    const reply = (payload) => sendResult(ws, msg.id, payload);
+    const reply = (payload, encryptedFields = []) => sendResult(ws, msg.id, payload, deps.e2ee, encryptedFields);
     try {
       if (action === "status") {
         const r = await deps.sessionWorktreeManager.getSessionWorkingTreeStatus(sessionId);
@@ -36010,7 +36884,7 @@ var handleSessionGitRequestMessage = (msg, deps) => {
         reply({
           ok: true,
           repos
-        });
+        }, ["repos"]);
         return;
       }
       if (action === "push") {
@@ -36079,7 +36953,7 @@ var handleSessionDiscardedMessage = (msg, deps) => {
 };
 
 // src/bridge/routing/handlers/revert-turn-snapshot.ts
-import * as fs23 from "node:fs";
+import * as fs29 from "node:fs";
 var handleRevertTurnSnapshotMessage = (msg, deps) => {
   const id = typeof msg.id === "string" ? msg.id : "";
   const sessionId = typeof msg.sessionId === "string" ? msg.sessionId : "";
@@ -36091,7 +36965,7 @@ var handleRevertTurnSnapshotMessage = (msg, deps) => {
     if (!s) return;
     const agentBase = sessionWorktreeManager.getAgentCwdForSession(sessionId) ?? getBridgeWorkspaceDirectory();
     const file2 = snapshotFilePath(agentBase, turnId);
-    if (!fs23.existsSync(file2)) {
+    if (!fs29.existsSync(file2)) {
       sendWsMessage(s, {
         type: "revert_turn_snapshot_result",
         id,
@@ -36112,8 +36986,15 @@ var handleRevertTurnSnapshotMessage = (msg, deps) => {
 
 // src/bridge/routing/handlers/dev-server-control.ts
 var handleDevServerControl = (msg, deps) => {
-  const serverId = typeof msg.serverId === "string" ? msg.serverId : "";
-  const action = msg.action === "start" || msg.action === "stop" ? msg.action : null;
+  let wire = msg;
+  try {
+    wire = deps.e2ee ? deps.e2ee.decryptMessage(msg) : msg;
+  } catch (e) {
+    deps.log(`[E2EE] Could not decrypt dev server command: ${e instanceof Error ? e.message : String(e)}`);
+    return;
+  }
+  const serverId = typeof wire.serverId === "string" ? wire.serverId : "";
+  const action = wire.action === "start" || wire.action === "stop" ? wire.action : null;
   if (!serverId || !action) return;
   deps.devServerManager?.handleControl(serverId, action);
 };
@@ -36239,7 +37120,8 @@ function createMainBridgeWebSocketLifecycle(params) {
     messageDeps,
     tokens,
     persistTokens,
-    onAuthInvalid
+    onAuthInvalid,
+    e2ee
   } = params;
   let authRefreshInFlight = false;
   function handleOpen() {
@@ -36252,15 +37134,15 @@ function createMainBridgeWebSocketLifecycle(params) {
     }
     const socket = getWs();
     if (socket) {
-      sendWsMessage(socket, { type: "identify", role: "cli" });
+      sendWsMessage(socket, { type: "identify", role: "cli", ...e2ee ? { e: e2ee.handshake } : {} });
       reportGitRepos(getWs, logFn);
     }
     if (justAuthenticated && socket) {
       logFn(
         "Save these for future runs (access token may rotate; refresh token is stored in ~/.buildautomaton/config.json when you use browser auth):"
       );
-      logFn(`  export BUILDAMATON_AUTH_TOKEN="${tokens.accessToken}"`);
-      logFn(`  export BUILDAMATON_WORKSPACE_ID="${workspaceId}"`);
+      logFn(`  export BUILDAUTOMATON_AUTH_TOKEN="${tokens.accessToken}"`);
+      logFn(`  export BUILDAUTOMATON_WORKSPACE_ID="${workspaceId}"`);
     }
   }
   function handleClose(code, reason) {
@@ -36375,7 +37257,8 @@ async function createBridgeConnection(options) {
   function getWs() {
     return state.currentWs;
   }
-  const devServerManager = new DevServerManager({ getWs, log: logFn, getBridgeCwd: getBridgeWorkspaceDirectory });
+  const e2ee = options.e2eCertificate ? createCliE2eeRuntime(options.e2eCertificate) : void 0;
+  const devServerManager = new DevServerManager({ getWs, log: logFn, getBridgeCwd: getBridgeWorkspaceDirectory, e2ee });
   const onBridgeIdentified = createOnBridgeIdentified({
     sessionWorktreeManager,
     devServerManager,
@@ -36394,7 +37277,8 @@ async function createBridgeConnection(options) {
     onBridgeIdentified,
     sendLocalSkillsReport,
     reportAutoDetectedAgents,
-    devServerManager
+    devServerManager,
+    e2ee
   };
   const { connect } = createMainBridgeWebSocketLifecycle({
     state,
@@ -36406,7 +37290,8 @@ async function createBridgeConnection(options) {
     messageDeps,
     tokens,
     persistTokens,
-    onAuthInvalid
+    onAuthInvalid,
+    e2ee
   });
   connect();
   const stopFileIndexWatcher = startFileIndexWatcher(getBridgeWorkspaceDirectory());
@@ -36418,14 +37303,149 @@ async function createBridgeConnection(options) {
   };
 }
 
+// src/e2e-certificates/key-command.ts
+import * as readline3 from "node:readline";
+function installE2eCertificateKeyCommand({
+  log: log2,
+  onOpenCertificate,
+  onInterrupt
+}) {
+  if (!process.stdin.isTTY || typeof process.stdin.setRawMode !== "function") {
+    log2("[E2EE] Press c to import the E2EE key in a browser when running in an interactive terminal.");
+    return () => {
+    };
+  }
+  readline3.emitKeypressEvents(process.stdin);
+  process.stdin.setRawMode(true);
+  process.stdin.resume();
+  const onKeypress = (str, key) => {
+    if (key?.ctrl && key.name === "c") {
+      onInterrupt();
+      return;
+    }
+    if (!key?.ctrl && !key?.meta && (key?.name === "c" || str === "c")) {
+      onOpenCertificate();
+    }
+  };
+  process.stdin.on("keypress", onKeypress);
+  log2("[E2EE] Press c to import the active E2EE key into the browser.");
+  return () => {
+    process.stdin.off("keypress", onKeypress);
+    if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {
+      process.stdin.setRawMode(false);
+    }
+  };
+}
+
+// src/e2e-certificates/open-import-url.ts
+async function openE2eCertificateImportUrl({
+  apiUrl,
+  workspaceId,
+  certificate,
+  log: log2
+}) {
+  const appUrl = appUrlForApiUrl(apiUrl);
+  const payload = encodeURIComponent(certificate.pemBundle);
+  const url2 = `${appUrl.replace(/\/$/, "")}/w/${encodeURIComponent(workspaceId)}/settings/e2e-encryption?certificate=${payload}`;
+  log2(`[E2EE] Opening browser to import key "${certificate.name}" (${certificate.id})...`);
+  try {
+    await open_default(url2, { wait: false });
+  } catch {
+    log2("[E2EE] Could not open browser. Open this URL manually:");
+    log2(url2);
+  }
+}
+
+// src/run-bridge-connected.ts
+async function runConnectedBridge(options, restartWithoutAuth) {
+  const {
+    apiUrl,
+    workspaceId,
+    authToken,
+    refreshToken,
+    justAuthenticated,
+    worktreesRootAbs,
+    e2eCertificate
+  } = options;
+  const firehoseServerUrl = options.firehoseServerUrl ?? options.proxyServerUrl;
+  let cleanupKeyCommand;
+  const handle = await createBridgeConnection({
+    apiUrl,
+    workspaceId,
+    authToken,
+    refreshToken,
+    firehoseServerUrl,
+    justAuthenticated,
+    worktreesRootAbs,
+    e2eCertificate,
+    log,
+    persistTokens: (t) => {
+      writeConfigForApi(apiUrl, {
+        workspaceId,
+        token: t.token,
+        refreshToken: t.refreshToken
+      });
+    },
+    onAuthInvalid: () => {
+      cleanupKeyCommand?.();
+      log("[Bridge service] Access token invalid or revoked; re-authenticating\u2026");
+      clearConfigForApi(apiUrl);
+      void handle.close().then(() => {
+        void restartWithoutAuth({ apiUrl, firehoseServerUrl, worktreesRootAbs, e2eCertificate });
+      });
+    }
+  });
+  const onSignal = (kind) => {
+    cleanupKeyCommand?.();
+    logImmediate(
+      kind === "interrupt" ? "Keyboard interrupt (Ctrl+C) \u2014 stopping\u2026" : "Stop requested \u2014 shutting down\u2026"
+    );
+    setImmediate(() => {
+      void handle.close().then(() => {
+        process.exit(0);
+      });
+    });
+  };
+  const onSigInt = () => onSignal("interrupt");
+  const onSigTerm = () => onSignal("stop");
+  process.on("SIGINT", onSigInt);
+  process.on("SIGTERM", onSigTerm);
+  if (e2eCertificate) {
+    let openingCertificate = false;
+    cleanupKeyCommand = installE2eCertificateKeyCommand({
+      log,
+      onInterrupt: onSigInt,
+      onOpenCertificate: () => {
+        if (openingCertificate) return;
+        openingCertificate = true;
+        void openE2eCertificateImportUrl({
+          apiUrl,
+          workspaceId,
+          certificate: e2eCertificate,
+          log
+        }).finally(() => {
+          openingCertificate = false;
+        });
+      }
+    });
+  }
+}
+
 // src/run-bridge.ts
 async function runBridge(options) {
   installBridgeProcessResilience();
-  const { apiUrl, workspaceId, authToken, refreshToken, bridgeName, justAuthenticated, worktreesRootAbs } = options;
+  const {
+    apiUrl,
+    workspaceId,
+    authToken,
+    bridgeName,
+    worktreesRootAbs,
+    e2eCertificate
+  } = options;
   const firehoseServerUrl = options.firehoseServerUrl ?? options.proxyServerUrl;
   const hasAuth = workspaceId && authToken;
   if (!hasAuth) {
-    const handle2 = runPendingAuth({
+    const handle = runPendingAuth({
       apiUrl,
       initialWorkspaceId: workspaceId,
       preferredBridgeName: bridgeName,
@@ -36433,23 +37453,23 @@ async function runBridge(options) {
       onAuth: (_auth) => {
       }
     });
-    const onSignal2 = (kind) => {
+    const onSignal = (kind) => {
       logImmediate(
         kind === "interrupt" ? "Keyboard interrupt (Ctrl+C) \u2014 stopping\u2026" : "Stop requested \u2014 shutting down\u2026"
       );
       setImmediate(() => {
-        handle2.close();
+        handle.close();
         process.exit(0);
       });
     };
-    const onSigInt2 = () => onSignal2("interrupt");
-    const onSigTerm2 = () => onSignal2("stop");
-    process.on("SIGINT", onSigInt2);
-    process.on("SIGTERM", onSigTerm2);
-    const auth = await handle2.authPromise;
-    process.off("SIGINT", onSigInt2);
-    process.off("SIGTERM", onSigTerm2);
-    handle2.close();
+    const onSigInt = () => onSignal("interrupt");
+    const onSigTerm = () => onSignal("stop");
+    process.on("SIGINT", onSigInt);
+    process.on("SIGTERM", onSigTerm);
+    const auth = await handle.authPromise;
+    process.off("SIGINT", onSigInt);
+    process.off("SIGTERM", onSigTerm);
+    handle.close();
     if (!auth) return;
     writeConfigForApi(apiUrl, {
       workspaceId: auth.workspaceId,
@@ -36464,111 +37484,91 @@ async function runBridge(options) {
       firehoseServerUrl,
       bridgeName,
       justAuthenticated: true,
-      worktreesRootAbs
+      worktreesRootAbs,
+      e2eCertificate
     });
     return;
   }
-  const handle = await createBridgeConnection({
+  await runConnectedBridge(options, runBridge);
+}
+
+// src/cli/run-cli-action.ts
+async function runCliAction(program2, opts) {
+  const positionalUrl = program2.args?.[0];
+  const urlFromPositional = typeof positionalUrl === "string" && /^https?:\/\//i.test(positionalUrl) ? positionalUrl : void 0;
+  const apiUrlFromCli = opts.apiUrl ?? urlFromPositional;
+  const apiUrl = apiUrlFromCli ?? DEFAULT_API_URL;
+  let workspaceId = opts.workspaceId ?? "";
+  let authToken = opts.token;
+  const firehoseServerUrl = opts.firehoseUrl ?? opts.proxyUrl ?? process.env.BUILDAUTOMATON_FIREHOSE_URL ?? process.env.BUILDAUTOMATON_PROXY_URL ?? DEFAULT_FIREHOSE_URL;
+  if (opts.cwd && typeof opts.cwd === "string" && opts.cwd.trim()) {
+    const resolvedCwd = path33.resolve(process.cwd(), opts.cwd.trim());
+    try {
+      const st = fs30.statSync(resolvedCwd);
+      if (!st.isDirectory()) {
+        console.error(`--cwd is not a directory: ${resolvedCwd}`);
+        process.exit(1);
+      }
+    } catch {
+      console.error(`--cwd path does not exist or is not accessible: ${resolvedCwd}`);
+      process.exit(1);
+    }
+    process.chdir(resolvedCwd);
+  }
+  initBridgeWorkspaceDirectory();
+  let worktreesRootAbs;
+  if (opts.worktreesRoot && opts.worktreesRoot.trim()) {
+    worktreesRootAbs = path33.resolve(opts.worktreesRoot.trim());
+  }
+  const e2eCertificates = opts.e2eeCertificatesDir?.trim() ? await loadOrCreateE2eCertificates(opts.e2eeCertificatesDir.trim()) : void 0;
+  if (e2eCertificates) {
+    const action = e2eCertificates.generated ? "Generated" : "Loaded";
+    console.log(
+      `[E2EE] ${action} ${e2eCertificates.certificates.length} key${e2eCertificates.certificates.length === 1 ? "" : "s"} from ${e2eCertificates.directory}`
+    );
+    console.log(
+      `[E2EE] Active key: ${e2eCertificates.activeCertificate.name} (${e2eCertificates.activeCertificate.id})`
+    );
+  }
+  let refreshToken;
+  if ((!workspaceId || !authToken) && opts.config !== false) {
+    const saved = readConfigForApi(apiUrl);
+    if (saved?.workspaceId && saved?.token) {
+      if (!workspaceId) workspaceId = saved.workspaceId;
+      if (!authToken) authToken = saved.token;
+      refreshToken = saved.refreshToken;
+    }
+  }
+  await runBridge({
     apiUrl,
-    workspaceId,
+    workspaceId: workspaceId || void 0,
     authToken,
     refreshToken,
     firehoseServerUrl,
-    justAuthenticated,
+    bridgeName: opts.name?.trim() || void 0,
     worktreesRootAbs,
-    log,
-    persistTokens: (t) => {
-      writeConfigForApi(apiUrl, {
-        workspaceId,
-        token: t.token,
-        refreshToken: t.refreshToken
-      });
-    },
-    onAuthInvalid: () => {
-      log("[Bridge service] Access token invalid or revoked; re-authenticating\u2026");
-      clearConfigForApi(apiUrl);
-      void handle.close().then(() => {
-        void runBridge({ apiUrl, firehoseServerUrl, worktreesRootAbs });
-      });
-    }
+    e2eCertificate: e2eCertificates?.activeCertificate
   });
-  const onSignal = (kind) => {
-    logImmediate(
-      kind === "interrupt" ? "Keyboard interrupt (Ctrl+C) \u2014 stopping\u2026" : "Stop requested \u2014 shutting down\u2026"
-    );
-    setImmediate(() => {
-      void handle.close().then(() => {
-        process.exit(0);
-      });
-    });
-  };
-  const onSigInt = () => onSignal("interrupt");
-  const onSigTerm = () => onSignal("stop");
-  process.on("SIGINT", onSigInt);
-  process.on("SIGTERM", onSigTerm);
 }
 
 // src/cli.ts
-var DEFAULT_API_URL = process.env.BUILDAUTOMATON_API_URL ?? "https://api.buildautomaton.com";
-var DEFAULT_FIREHOSE_URL = "https://buildautomaton-firehose.fly.dev";
 async function main() {
   const program2 = new Command();
-  program2.name("buildautomaton").description("CLI for BuildAutomaton: ACP client, WebSocket bridge to backend, and skills (e.g. preview)").version("0.1.0").option("-u, --api-url <url>", "Backend API URL", process.env.BUILDAUTOMATON_API_URL ?? DEFAULT_API_URL).option("-w, --workspace-id <id>", "Workspace ID (or set BUILDAMATON_WORKSPACE_ID)", process.env.BUILDAMATON_WORKSPACE_ID).option("-t, --token <token>", "Auth token (or set BUILDAMATON_AUTH_TOKEN)", process.env.BUILDAMATON_AUTH_TOKEN).option(
+  program2.name("buildautomaton").description("CLI for BuildAutomaton: ACP client, WebSocket bridge to backend, and skills (e.g. preview)").version("0.1.0").option("-u, --api-url <url>", "Backend API URL", process.env.BUILDAUTOMATON_API_URL ?? DEFAULT_API_URL).option("-w, --workspace-id <id>", "Workspace ID (or set BUILDAUTOMATON_WORKSPACE_ID)", process.env.BUILDAUTOMATON_WORKSPACE_ID).option("-t, --token <token>", "Auth token (or set BUILDAUTOMATON_AUTH_TOKEN)", process.env.BUILDAUTOMATON_AUTH_TOKEN).option(
     "--firehose-url <url>",
-    "Firehose server URL (default: Fly app; or BUILDAMATON_FIREHOSE_URL / legacy BUILDAMATON_PROXY_URL)",
-    process.env.BUILDAMATON_FIREHOSE_URL ?? process.env.BUILDAMATON_PROXY_URL ?? DEFAULT_FIREHOSE_URL
+    "Firehose server URL (default: Fly app; or BUILDAUTOMATON_FIREHOSE_URL / legacy BUILDAUTOMATON_PROXY_URL)",
+    process.env.BUILDAUTOMATON_FIREHOSE_URL ?? process.env.BUILDAUTOMATON_PROXY_URL ?? DEFAULT_FIREHOSE_URL
   ).option("--proxy-url <url>", "Deprecated alias for --firehose-url", void 0).option(
     "--cwd <path>",
     "Working directory for the bridge (absolute or relative to the current directory); affects skills, git, file index, and agent cwd"
   ).option("-n, --name <name>", "Bridge name when creating via browser (alphanumeric and underscores only)").option(
     "--worktrees-root <path>",
     "Root directory for per-session git worktrees (default: ~/.buildautomaton/worktrees). Whether worktrees are used is controlled in the cloud for each bridge token."
-  ).option("--no-config", "Ignore saved config at ~/.buildautomaton/config.json").action(async (opts) => {
-    const positionalUrl = program2.args?.[0];
-    const urlFromPositional = typeof positionalUrl === "string" && /^https?:\/\//i.test(positionalUrl) ? positionalUrl : void 0;
-    const apiUrlFromCli = opts.apiUrl ?? urlFromPositional;
-    let apiUrl = apiUrlFromCli ?? DEFAULT_API_URL;
-    let workspaceId = opts.workspaceId ?? "";
-    let authToken = opts.token;
-    const firehoseServerUrl = opts.firehoseUrl ?? opts.proxyUrl ?? process.env.BUILDAMATON_FIREHOSE_URL ?? process.env.BUILDAMATON_PROXY_URL ?? DEFAULT_FIREHOSE_URL;
-    if (opts.cwd && typeof opts.cwd === "string" && opts.cwd.trim()) {
-      const resolvedCwd = path31.resolve(process.cwd(), opts.cwd.trim());
-      try {
-        const st = fs24.statSync(resolvedCwd);
-        if (!st.isDirectory()) {
-          console.error(`--cwd is not a directory: ${resolvedCwd}`);
-          process.exit(1);
-        }
-      } catch {
-        console.error(`--cwd path does not exist or is not accessible: ${resolvedCwd}`);
-        process.exit(1);
-      }
-      process.chdir(resolvedCwd);
-    }
-    initBridgeWorkspaceDirectory();
-    let worktreesRootAbs;
-    if (opts.worktreesRoot && opts.worktreesRoot.trim()) {
-      worktreesRootAbs = path31.resolve(opts.worktreesRoot.trim());
-    }
-    let refreshToken;
-    if ((!workspaceId || !authToken) && opts.config !== false) {
-      const saved = readConfigForApi(apiUrl);
-      if (saved?.workspaceId && saved?.token) {
-        if (!workspaceId) workspaceId = saved.workspaceId;
-        if (!authToken) authToken = saved.token;
-        refreshToken = saved.refreshToken;
-      }
-    }
-    await runBridge({
-      apiUrl,
-      workspaceId: workspaceId || void 0,
-      authToken,
-      refreshToken,
-      firehoseServerUrl,
-      bridgeName: opts.name?.trim() || void 0,
-      worktreesRootAbs
-    });
-  });
+  ).option(
+    "--e2ee-certificates-dir <path>",
+    "Directory to load or generate E2EE keys for sessions, files, and logs",
+    process.env.BUILDAUTOMATON_E2EE_CERTIFICATES_DIR
+  ).option("--no-config", "Ignore saved config at ~/.buildautomaton/config.json").action(async (opts) => runCliAction(program2, opts));
   await program2.parseAsync(process.argv);
 }
 main().catch((err) => {