@buildautomaton/cli 0.1.14 → 0.1.16

package/dist/index.js

@@ -2240,7 +2240,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes, createHash: createHash2 } = __require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash2 } = __require("crypto");
     var { Duplex, Readable: Readable2 } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -2770,7 +2770,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes(16).toString("base64");
+      const key = randomBytes2(16).toString("base64");
       const request = isSecure ? https2.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -3179,7 +3179,7 @@ var require_stream = __commonJS({
       };
       duplex._final = function(callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open() {
+          ws.once("open", function open2() {
             duplex._final(callback);
           });
           return;
@@ -3200,7 +3200,7 @@ var require_stream = __commonJS({
       };
       duplex._write = function(chunk, encoding, callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open() {
+          ws.once("open", function open2() {
             duplex._write(chunk, encoding, callback);
           });
           return;
@@ -4065,8 +4065,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path31, errorMaps, issueData } = params;
-      const fullPath = [...path31, ...issueData.path || []];
+      const { data, path: path32, errorMaps, issueData } = params;
+      const fullPath = [...path32, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -4374,11 +4374,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path31, key) {
+      constructor(parent, value, path32, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path31;
+        this._path = path32;
         this._key = key;
       }
       get path() {
@@ -7993,10 +7993,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path31) {
-  if (!path31)
+function getElementAtPath(obj, path32) {
+  if (!path32)
     return obj;
-  return path31.reduce((acc, key) => acc?.[key], obj);
+  return path32.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -8245,11 +8245,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path31, issues) {
+function prefixIssues(path32, issues) {
   return issues.map((iss) => {
     var _a2;
     (_a2 = iss).path ?? (_a2.path = []);
-    iss.path.unshift(path31);
+    iss.path.unshift(path32);
     return iss;
   });
 }
@@ -8438,7 +8438,7 @@ function treeifyError(error40, _mapper) {
     return issue2.message;
   };
   const result = { errors: [] };
-  const processError = (error41, path31 = []) => {
+  const processError = (error41, path32 = []) => {
     var _a2, _b;
     for (const issue2 of error41.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
@@ -8448,7 +8448,7 @@ function treeifyError(error40, _mapper) {
       } else if (issue2.code === "invalid_element") {
         processError({ issues: issue2.issues }, issue2.path);
       } else {
-        const fullpath = [...path31, ...issue2.path];
+        const fullpath = [...path32, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -8478,9 +8478,9 @@ function treeifyError(error40, _mapper) {
   processError(error40);
   return result;
 }
-function toDotPath(path31) {
+function toDotPath(path32) {
   const segs = [];
-  for (const seg of path31) {
+  for (const seg of path32) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -21669,7 +21669,7 @@ var require_has_flag = __commonJS({
 var require_supports_color = __commonJS({
   "../../node_modules/.pnpm/supports-color@7.2.0/node_modules/supports-color/index.js"(exports, module) {
     "use strict";
-    var os5 = __require("os");
+    var os6 = __require("os");
     var tty = __require("tty");
     var hasFlag = require_has_flag();
     var { env } = process;
@@ -21717,7 +21717,7 @@ var require_supports_color = __commonJS({
         return min;
       }
       if (process.platform === "win32") {
-        const osRelease = os5.release().split(".");
+        const osRelease = os6.release().split(".");
         if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
           return Number(osRelease[2]) >= 14931 ? 3 : 2;
         }
@@ -21963,10 +21963,10 @@ var require_src2 = __commonJS({
     var fs_1 = __require("fs");
     var debug_1 = __importDefault(require_src());
     var log2 = debug_1.default("@kwsites/file-exists");
-    function check2(path31, isFile, isDirectory) {
-      log2(`checking %s`, path31);
+    function check2(path32, isFile, isDirectory) {
+      log2(`checking %s`, path32);
       try {
-        const stat2 = fs_1.statSync(path31);
+        const stat2 = fs_1.statSync(path32);
         if (stat2.isFile() && isFile) {
           log2(`[OK] path represents a file`);
           return true;
@@ -21986,8 +21986,8 @@ var require_src2 = __commonJS({
         throw e;
       }
     }
-    function exists2(path31, type = exports.READABLE) {
-      return check2(path31, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
+    function exists2(path32, type = exports.READABLE) {
+      return check2(path32, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
     }
     exports.exists = exists2;
     exports.FILE = 1;
@@ -22787,8 +22787,8 @@ var PREVIEW_API_BASE_PATH = "/__preview";
 var PREVIEW_SECRET_HEADER = "X-Preview-Secret";
 var DEFAULT_PORT = 3e3;
 var DEFAULT_COMMAND = "npm run preview";
-var PREVIEW_COMMAND_ENV = "BUILDAMATON_PREVIEW_COMMAND";
-var PREVIEW_PORT_ENV = "BUILDAMATON_PREVIEW_PORT";
+var PREVIEW_COMMAND_ENV = "BUILDAUTOMATON_PREVIEW_COMMAND";
+var PREVIEW_PORT_ENV = "BUILDAUTOMATON_PREVIEW_PORT";
 var previewProcess = null;
 var previewPort = DEFAULT_PORT;
 var previewSecret = "";
@@ -22802,8 +22802,8 @@ function randomSecret() {
   }
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
-async function requestPreviewApi(port, secret, method, path31, body) {
-  const url2 = `http://127.0.0.1:${port}${path31}`;
+async function requestPreviewApi(port, secret, method, path32, body) {
+  const url2 = `http://127.0.0.1:${port}${path32}`;
   const headers = {
     [PREVIEW_SECRET_HEADER]: secret,
     "Content-Type": "application/json"
@@ -22815,7 +22815,7 @@ async function requestPreviewApi(port, secret, method, path31, body) {
   });
   const data = await res.json().catch(() => ({}));
   if (!res.ok) {
-    throw new Error(data?.error ?? `Preview API ${method} ${path31}: ${res.status}`);
+    throw new Error(data?.error ?? `Preview API ${method} ${path32}: ${res.status}`);
   }
   return data;
 }
@@ -22841,7 +22841,7 @@ var OPERATIONS = [
 var previewSkill = {
   id: "preview",
   name: "Preview",
-  description: "Start and manage a local preview server that implements the BuildAutomaton Preview Server API. Configure the command with BUILDAMATON_PREVIEW_COMMAND (default: npm run preview). The server receives PORT and PREVIEW_SECRET and must expose /__preview/status and /__preview/stop.",
+  description: "Start and manage a local preview server that implements the BuildAutomaton Preview Server API. Configure the command with BUILDAUTOMATON_PREVIEW_COMMAND (default: npm run preview). The server receives PORT and PREVIEW_SECRET and must expose /__preview/status and /__preview/stop.",
   operations: OPERATIONS,
   async execute(operationId, params) {
     const command = getPreviewCommand();
@@ -23040,8 +23040,521 @@ function installBridgeProcessResilience() {
   });
 }
 
+// ../../node_modules/.pnpm/open@10.2.0/node_modules/open/index.js
+import process7 from "node:process";
+import { Buffer as Buffer2 } from "node:buffer";
+import path4 from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify as promisify5 } from "node:util";
+import childProcess from "node:child_process";
+import fs6, { constants as fsConstants2 } from "node:fs/promises";
+
+// ../../node_modules/.pnpm/wsl-utils@0.1.0/node_modules/wsl-utils/index.js
+import process3 from "node:process";
+import fs5, { constants as fsConstants } from "node:fs/promises";
+
+// ../../node_modules/.pnpm/is-wsl@3.1.1/node_modules/is-wsl/index.js
+import process2 from "node:process";
+import os2 from "node:os";
+import fs4 from "node:fs";
+
+// ../../node_modules/.pnpm/is-inside-container@1.0.0/node_modules/is-inside-container/index.js
+import fs3 from "node:fs";
+
+// ../../node_modules/.pnpm/is-docker@3.0.0/node_modules/is-docker/index.js
+import fs2 from "node:fs";
+var isDockerCached;
+function hasDockerEnv() {
+  try {
+    fs2.statSync("/.dockerenv");
+    return true;
+  } catch {
+    return false;
+  }
+}
+function hasDockerCGroup() {
+  try {
+    return fs2.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
+  } catch {
+    return false;
+  }
+}
+function isDocker() {
+  if (isDockerCached === void 0) {
+    isDockerCached = hasDockerEnv() || hasDockerCGroup();
+  }
+  return isDockerCached;
+}
+
+// ../../node_modules/.pnpm/is-inside-container@1.0.0/node_modules/is-inside-container/index.js
+var cachedResult;
+var hasContainerEnv = () => {
+  try {
+    fs3.statSync("/run/.containerenv");
+    return true;
+  } catch {
+    return false;
+  }
+};
+function isInsideContainer() {
+  if (cachedResult === void 0) {
+    cachedResult = hasContainerEnv() || isDocker();
+  }
+  return cachedResult;
+}
+
+// ../../node_modules/.pnpm/is-wsl@3.1.1/node_modules/is-wsl/index.js
+var isWsl = () => {
+  if (process2.platform !== "linux") {
+    return false;
+  }
+  if (os2.release().toLowerCase().includes("microsoft")) {
+    if (isInsideContainer()) {
+      return false;
+    }
+    return true;
+  }
+  try {
+    if (fs4.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft")) {
+      return !isInsideContainer();
+    }
+  } catch {
+  }
+  if (fs4.existsSync("/proc/sys/fs/binfmt_misc/WSLInterop") || fs4.existsSync("/run/WSL")) {
+    return !isInsideContainer();
+  }
+  return false;
+};
+var is_wsl_default = process2.env.__IS_WSL_TEST__ ? isWsl : isWsl();
+
+// ../../node_modules/.pnpm/wsl-utils@0.1.0/node_modules/wsl-utils/index.js
+var wslDrivesMountPoint = /* @__PURE__ */ (() => {
+  const defaultMountPoint = "/mnt/";
+  let mountPoint;
+  return async function() {
+    if (mountPoint) {
+      return mountPoint;
+    }
+    const configFilePath2 = "/etc/wsl.conf";
+    let isConfigFileExists = false;
+    try {
+      await fs5.access(configFilePath2, fsConstants.F_OK);
+      isConfigFileExists = true;
+    } catch {
+    }
+    if (!isConfigFileExists) {
+      return defaultMountPoint;
+    }
+    const configContent = await fs5.readFile(configFilePath2, { encoding: "utf8" });
+    const configMountPoint = /(?<!#.*)root\s*=\s*(?<mountPoint>.*)/g.exec(configContent);
+    if (!configMountPoint) {
+      return defaultMountPoint;
+    }
+    mountPoint = configMountPoint.groups.mountPoint.trim();
+    mountPoint = mountPoint.endsWith("/") ? mountPoint : `${mountPoint}/`;
+    return mountPoint;
+  };
+})();
+var powerShellPathFromWsl = async () => {
+  const mountPoint = await wslDrivesMountPoint();
+  return `${mountPoint}c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe`;
+};
+var powerShellPath = async () => {
+  if (is_wsl_default) {
+    return powerShellPathFromWsl();
+  }
+  return `${process3.env.SYSTEMROOT || process3.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;
+};
+
+// ../../node_modules/.pnpm/define-lazy-prop@3.0.0/node_modules/define-lazy-prop/index.js
+function defineLazyProperty(object2, propertyName, valueGetter) {
+  const define = (value) => Object.defineProperty(object2, propertyName, { value, enumerable: true, writable: true });
+  Object.defineProperty(object2, propertyName, {
+    configurable: true,
+    enumerable: true,
+    get() {
+      const result = valueGetter();
+      define(result);
+      return result;
+    },
+    set(value) {
+      define(value);
+    }
+  });
+  return object2;
+}
+
+// ../../node_modules/.pnpm/default-browser@5.5.0/node_modules/default-browser/index.js
+import { promisify as promisify4 } from "node:util";
+import process6 from "node:process";
+import { execFile as execFile4 } from "node:child_process";
+
+// ../../node_modules/.pnpm/default-browser-id@5.0.1/node_modules/default-browser-id/index.js
+import { promisify } from "node:util";
+import process4 from "node:process";
+import { execFile } from "node:child_process";
+var execFileAsync = promisify(execFile);
+async function defaultBrowserId() {
+  if (process4.platform !== "darwin") {
+    throw new Error("macOS only");
+  }
+  const { stdout } = await execFileAsync("defaults", ["read", "com.apple.LaunchServices/com.apple.launchservices.secure", "LSHandlers"]);
+  const match = /LSHandlerRoleAll = "(?!-)(?<id>[^"]+?)";\s+?LSHandlerURLScheme = (?:http|https);/.exec(stdout);
+  const browserId = match?.groups.id ?? "com.apple.Safari";
+  if (browserId === "com.apple.safari") {
+    return "com.apple.Safari";
+  }
+  return browserId;
+}
+
+// ../../node_modules/.pnpm/run-applescript@7.1.0/node_modules/run-applescript/index.js
+import process5 from "node:process";
+import { promisify as promisify2 } from "node:util";
+import { execFile as execFile2, execFileSync } from "node:child_process";
+var execFileAsync2 = promisify2(execFile2);
+async function runAppleScript(script, { humanReadableOutput = true, signal } = {}) {
+  if (process5.platform !== "darwin") {
+    throw new Error("macOS only");
+  }
+  const outputArguments = humanReadableOutput ? [] : ["-ss"];
+  const execOptions = {};
+  if (signal) {
+    execOptions.signal = signal;
+  }
+  const { stdout } = await execFileAsync2("osascript", ["-e", script, outputArguments], execOptions);
+  return stdout.trim();
+}
+
+// ../../node_modules/.pnpm/bundle-name@4.1.0/node_modules/bundle-name/index.js
+async function bundleName(bundleId) {
+  return runAppleScript(`tell application "Finder" to set app_path to application file id "${bundleId}" as string
+tell application "System Events" to get value of property list item "CFBundleName" of property list file (app_path & ":Contents:Info.plist")`);
+}
+
+// ../../node_modules/.pnpm/default-browser@5.5.0/node_modules/default-browser/windows.js
+import { promisify as promisify3 } from "node:util";
+import { execFile as execFile3 } from "node:child_process";
+var execFileAsync3 = promisify3(execFile3);
+var windowsBrowserProgIds = {
+  MSEdgeHTM: { name: "Edge", id: "com.microsoft.edge" },
+  // The missing `L` is correct.
+  MSEdgeBHTML: { name: "Edge Beta", id: "com.microsoft.edge.beta" },
+  MSEdgeDHTML: { name: "Edge Dev", id: "com.microsoft.edge.dev" },
+  AppXq0fevzme2pys62n3e0fbqa7peapykr8v: { name: "Edge", id: "com.microsoft.edge.old" },
+  ChromeHTML: { name: "Chrome", id: "com.google.chrome" },
+  ChromeBHTML: { name: "Chrome Beta", id: "com.google.chrome.beta" },
+  ChromeDHTML: { name: "Chrome Dev", id: "com.google.chrome.dev" },
+  ChromiumHTM: { name: "Chromium", id: "org.chromium.Chromium" },
+  BraveHTML: { name: "Brave", id: "com.brave.Browser" },
+  BraveBHTML: { name: "Brave Beta", id: "com.brave.Browser.beta" },
+  BraveDHTML: { name: "Brave Dev", id: "com.brave.Browser.dev" },
+  BraveSSHTM: { name: "Brave Nightly", id: "com.brave.Browser.nightly" },
+  FirefoxURL: { name: "Firefox", id: "org.mozilla.firefox" },
+  OperaStable: { name: "Opera", id: "com.operasoftware.Opera" },
+  VivaldiHTM: { name: "Vivaldi", id: "com.vivaldi.Vivaldi" },
+  "IE.HTTP": { name: "Internet Explorer", id: "com.microsoft.ie" }
+};
+var _windowsBrowserProgIdMap = new Map(Object.entries(windowsBrowserProgIds));
+var UnknownBrowserError = class extends Error {
+};
+async function defaultBrowser(_execFileAsync = execFileAsync3) {
+  const { stdout } = await _execFileAsync("reg", [
+    "QUERY",
+    " HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice",
+    "/v",
+    "ProgId"
+  ]);
+  const match = /ProgId\s*REG_SZ\s*(?<id>\S+)/.exec(stdout);
+  if (!match) {
+    throw new UnknownBrowserError(`Cannot find Windows browser in stdout: ${JSON.stringify(stdout)}`);
+  }
+  const { id } = match.groups;
+  const dotIndex = id.lastIndexOf(".");
+  const hyphenIndex = id.lastIndexOf("-");
+  const baseIdByDot = dotIndex === -1 ? void 0 : id.slice(0, dotIndex);
+  const baseIdByHyphen = hyphenIndex === -1 ? void 0 : id.slice(0, hyphenIndex);
+  return windowsBrowserProgIds[id] ?? windowsBrowserProgIds[baseIdByDot] ?? windowsBrowserProgIds[baseIdByHyphen] ?? { name: id, id };
+}
+
+// ../../node_modules/.pnpm/default-browser@5.5.0/node_modules/default-browser/index.js
+var execFileAsync4 = promisify4(execFile4);
+var titleize = (string4) => string4.toLowerCase().replaceAll(/(?:^|\s|-)\S/g, (x) => x.toUpperCase());
+async function defaultBrowser2() {
+  if (process6.platform === "darwin") {
+    const id = await defaultBrowserId();
+    const name = await bundleName(id);
+    return { name, id };
+  }
+  if (process6.platform === "linux") {
+    const { stdout } = await execFileAsync4("xdg-mime", ["query", "default", "x-scheme-handler/http"]);
+    const id = stdout.trim();
+    const name = titleize(id.replace(/.desktop$/, "").replace("-", " "));
+    return { name, id };
+  }
+  if (process6.platform === "win32") {
+    return defaultBrowser();
+  }
+  throw new Error("Only macOS, Linux, and Windows are supported");
+}
+
+// ../../node_modules/.pnpm/open@10.2.0/node_modules/open/index.js
+var execFile5 = promisify5(childProcess.execFile);
+var __dirname = path4.dirname(fileURLToPath(import.meta.url));
+var localXdgOpenPath = path4.join(__dirname, "xdg-open");
+var { platform, arch } = process7;
+async function getWindowsDefaultBrowserFromWsl() {
+  const powershellPath = await powerShellPath();
+  const rawCommand = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
+  const encodedCommand = Buffer2.from(rawCommand, "utf16le").toString("base64");
+  const { stdout } = await execFile5(
+    powershellPath,
+    [
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-EncodedCommand",
+      encodedCommand
+    ],
+    { encoding: "utf8" }
+  );
+  const progId = stdout.trim();
+  const browserMap = {
+    ChromeHTML: "com.google.chrome",
+    BraveHTML: "com.brave.Browser",
+    MSEdgeHTM: "com.microsoft.edge",
+    FirefoxURL: "org.mozilla.firefox"
+  };
+  return browserMap[progId] ? { id: browserMap[progId] } : {};
+}
+var pTryEach = async (array2, mapper) => {
+  let latestError;
+  for (const item of array2) {
+    try {
+      return await mapper(item);
+    } catch (error40) {
+      latestError = error40;
+    }
+  }
+  throw latestError;
+};
+var baseOpen = async (options) => {
+  options = {
+    wait: false,
+    background: false,
+    newInstance: false,
+    allowNonzeroExitCode: false,
+    ...options
+  };
+  if (Array.isArray(options.app)) {
+    return pTryEach(options.app, (singleApp) => baseOpen({
+      ...options,
+      app: singleApp
+    }));
+  }
+  let { name: app, arguments: appArguments = [] } = options.app ?? {};
+  appArguments = [...appArguments];
+  if (Array.isArray(app)) {
+    return pTryEach(app, (appName) => baseOpen({
+      ...options,
+      app: {
+        name: appName,
+        arguments: appArguments
+      }
+    }));
+  }
+  if (app === "browser" || app === "browserPrivate") {
+    const ids = {
+      "com.google.chrome": "chrome",
+      "google-chrome.desktop": "chrome",
+      "com.brave.Browser": "brave",
+      "org.mozilla.firefox": "firefox",
+      "firefox.desktop": "firefox",
+      "com.microsoft.msedge": "edge",
+      "com.microsoft.edge": "edge",
+      "com.microsoft.edgemac": "edge",
+      "microsoft-edge.desktop": "edge"
+    };
+    const flags = {
+      chrome: "--incognito",
+      brave: "--incognito",
+      firefox: "--private-window",
+      edge: "--inPrivate"
+    };
+    const browser = is_wsl_default ? await getWindowsDefaultBrowserFromWsl() : await defaultBrowser2();
+    if (browser.id in ids) {
+      const browserName = ids[browser.id];
+      if (app === "browserPrivate") {
+        appArguments.push(flags[browserName]);
+      }
+      return baseOpen({
+        ...options,
+        app: {
+          name: apps[browserName],
+          arguments: appArguments
+        }
+      });
+    }
+    throw new Error(`${browser.name} is not supported as a default browser`);
+  }
+  let command;
+  const cliArguments = [];
+  const childProcessOptions = {};
+  if (platform === "darwin") {
+    command = "open";
+    if (options.wait) {
+      cliArguments.push("--wait-apps");
+    }
+    if (options.background) {
+      cliArguments.push("--background");
+    }
+    if (options.newInstance) {
+      cliArguments.push("--new");
+    }
+    if (app) {
+      cliArguments.push("-a", app);
+    }
+  } else if (platform === "win32" || is_wsl_default && !isInsideContainer() && !app) {
+    command = await powerShellPath();
+    cliArguments.push(
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-EncodedCommand"
+    );
+    if (!is_wsl_default) {
+      childProcessOptions.windowsVerbatimArguments = true;
+    }
+    const encodedArguments = ["Start"];
+    if (options.wait) {
+      encodedArguments.push("-Wait");
+    }
+    if (app) {
+      encodedArguments.push(`"\`"${app}\`""`);
+      if (options.target) {
+        appArguments.push(options.target);
+      }
+    } else if (options.target) {
+      encodedArguments.push(`"${options.target}"`);
+    }
+    if (appArguments.length > 0) {
+      appArguments = appArguments.map((argument) => `"\`"${argument}\`""`);
+      encodedArguments.push("-ArgumentList", appArguments.join(","));
+    }
+    options.target = Buffer2.from(encodedArguments.join(" "), "utf16le").toString("base64");
+  } else {
+    if (app) {
+      command = app;
+    } else {
+      const isBundled = !__dirname || __dirname === "/";
+      let exeLocalXdgOpen = false;
+      try {
+        await fs6.access(localXdgOpenPath, fsConstants2.X_OK);
+        exeLocalXdgOpen = true;
+      } catch {
+      }
+      const useSystemXdgOpen = process7.versions.electron ?? (platform === "android" || isBundled || !exeLocalXdgOpen);
+      command = useSystemXdgOpen ? "xdg-open" : localXdgOpenPath;
+    }
+    if (appArguments.length > 0) {
+      cliArguments.push(...appArguments);
+    }
+    if (!options.wait) {
+      childProcessOptions.stdio = "ignore";
+      childProcessOptions.detached = true;
+    }
+  }
+  if (platform === "darwin" && appArguments.length > 0) {
+    cliArguments.push("--args", ...appArguments);
+  }
+  if (options.target) {
+    cliArguments.push(options.target);
+  }
+  const subprocess = childProcess.spawn(command, cliArguments, childProcessOptions);
+  if (options.wait) {
+    return new Promise((resolve15, reject) => {
+      subprocess.once("error", reject);
+      subprocess.once("close", (exitCode) => {
+        if (!options.allowNonzeroExitCode && exitCode > 0) {
+          reject(new Error(`Exited with code ${exitCode}`));
+          return;
+        }
+        resolve15(subprocess);
+      });
+    });
+  }
+  subprocess.unref();
+  return subprocess;
+};
+var open = (target, options) => {
+  if (typeof target !== "string") {
+    throw new TypeError("Expected a `target`");
+  }
+  return baseOpen({
+    ...options,
+    target
+  });
+};
+function detectArchBinary(binary) {
+  if (typeof binary === "string" || Array.isArray(binary)) {
+    return binary;
+  }
+  const { [arch]: archBinary } = binary;
+  if (!archBinary) {
+    throw new Error(`${arch} is not supported`);
+  }
+  return archBinary;
+}
+function detectPlatformBinary({ [platform]: platformBinary }, { wsl }) {
+  if (wsl && is_wsl_default) {
+    return detectArchBinary(wsl);
+  }
+  if (!platformBinary) {
+    throw new Error(`${platform} is not supported`);
+  }
+  return detectArchBinary(platformBinary);
+}
+var apps = {};
+defineLazyProperty(apps, "chrome", () => detectPlatformBinary({
+  darwin: "google chrome",
+  win32: "chrome",
+  linux: ["google-chrome", "google-chrome-stable", "chromium"]
+}, {
+  wsl: {
+    ia32: "/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe",
+    x64: ["/mnt/c/Program Files/Google/Chrome/Application/chrome.exe", "/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe"]
+  }
+}));
+defineLazyProperty(apps, "brave", () => detectPlatformBinary({
+  darwin: "brave browser",
+  win32: "brave",
+  linux: ["brave-browser", "brave"]
+}, {
+  wsl: {
+    ia32: "/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe",
+    x64: ["/mnt/c/Program Files/BraveSoftware/Brave-Browser/Application/brave.exe", "/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe"]
+  }
+}));
+defineLazyProperty(apps, "firefox", () => detectPlatformBinary({
+  darwin: "firefox",
+  win32: String.raw`C:\Program Files\Mozilla Firefox\firefox.exe`,
+  linux: "firefox"
+}, {
+  wsl: "/mnt/c/Program Files/Mozilla Firefox/firefox.exe"
+}));
+defineLazyProperty(apps, "edge", () => detectPlatformBinary({
+  darwin: "microsoft edge",
+  win32: "msedge",
+  linux: ["microsoft-edge", "microsoft-edge-dev"]
+}, {
+  wsl: "/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"
+}));
+defineLazyProperty(apps, "browser", () => "browser");
+defineLazyProperty(apps, "browserPrivate", () => "browserPrivate");
+var open_default = open;
+
 // src/auth/open-browser.ts
-import { execSync } from "node:child_process";
 function isLocalApiUrl(apiUrl) {
   try {
     const u = new URL(apiUrl);
@@ -23051,8 +23564,11 @@ function isLocalApiUrl(apiUrl) {
     return false;
   }
 }
-function openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn = log) {
-  const appUrl = apiUrl && isLocalApiUrl(apiUrl) ? process.env.BUILDAUTOMATON_APP_URL ?? "http://localhost:3000" : process.env.BUILDAUTOMATON_APP_URL ?? "https://app.buildautomaton.com";
+function appUrlForApiUrl(apiUrl) {
+  return apiUrl && isLocalApiUrl(apiUrl) ? process.env.BUILDAUTOMATON_APP_URL ?? "http://localhost:3000" : process.env.BUILDAUTOMATON_APP_URL ?? "https://app.buildautomaton.com";
+}
+async function openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn = log) {
+  const appUrl = appUrlForApiUrl(apiUrl);
   let connectCliUrl = `${appUrl.replace(/\/$/, "")}/bridges/connect?connectionId=${connectionId}`;
   if (initialWorkspaceId) {
     try {
@@ -23065,10 +23581,11 @@ function openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiU
     connectCliUrl += `&bridgeName=${encodeURIComponent(preferredBridgeName.trim())}`;
   }
   logFn("Opening browser to link this CLI\u2026");
-  logFn("If you\u2019re already signed in with one workspace, the CLI will connect automatically. Otherwise sign in and link to a workspace.");
+  logFn(
+    "If you\u2019re already signed in with one workspace, the CLI will connect automatically. Otherwise sign in and link to a workspace."
+  );
   try {
-    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-    execSync(`${cmd} "${connectCliUrl}"`, { stdio: "ignore" });
+    await open_default(connectCliUrl, { wait: false });
   } catch {
     logFn("Could not open browser. Open this URL manually:");
     logFn(connectCliUrl);
@@ -23323,7 +23840,7 @@ function runPendingAuth(options) {
         }
         if (!hasOpenedBrowser) {
           hasOpenedBrowser = true;
-          openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
+          void openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
         }
       },
       onClose: (code, reason) => {
@@ -23365,7 +23882,7 @@ function runPendingAuth(options) {
     browserFallback = null;
     if (!hasOpenedBrowser) {
       hasOpenedBrowser = true;
-      openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
+      void openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn);
     }
   }, BROWSER_OPEN_FALLBACK_MS);
   connect();
@@ -23425,27 +23942,27 @@ async function closeBridgeConnection(state, acpManager, devServerManager, log2)
 }
 
 // src/git/session-git-queue.ts
-import { execFile as execFile2 } from "node:child_process";
+import { execFile as execFile7 } from "node:child_process";
 import { readFile, stat } from "node:fs/promises";
-import { promisify as promisify2 } from "node:util";
-import * as path6 from "node:path";
+import { promisify as promisify7 } from "node:util";
+import * as path7 from "node:path";
 
 // src/git/pre-turn-snapshot.ts
-import * as fs3 from "node:fs";
-import * as path5 from "node:path";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
+import * as fs8 from "node:fs";
+import * as path6 from "node:path";
+import { execFile as execFile6 } from "node:child_process";
+import { promisify as promisify6 } from "node:util";
 
 // src/git/discover-repos.ts
-import * as fs2 from "node:fs";
-import * as path4 from "node:path";
+import * as fs7 from "node:fs";
+import * as path5 from "node:path";
 
 // ../../node_modules/.pnpm/simple-git@3.32.3/node_modules/simple-git/dist/esm/index.js
 var import_file_exists = __toESM(require_dist(), 1);
 var import_debug = __toESM(require_src(), 1);
 var import_promise_deferred = __toESM(require_dist2(), 1);
 var import_promise_deferred2 = __toESM(require_dist2(), 1);
-import { Buffer as Buffer2 } from "node:buffer";
+import { Buffer as Buffer22 } from "node:buffer";
 import { spawn as spawn3 } from "child_process";
 import { normalize as normalize2 } from "node:path";
 import { EventEmitter } from "node:events";
@@ -23477,8 +23994,8 @@ function pathspec(...paths) {
   cache.set(key, paths);
   return key;
 }
-function isPathSpec(path31) {
-  return path31 instanceof String && cache.has(path31);
+function isPathSpec(path32) {
+  return path32 instanceof String && cache.has(path32);
 }
 function toPaths(pathSpec) {
   return cache.get(pathSpec) || [];
@@ -23567,8 +24084,8 @@ function toLinesWithContent(input = "", trimmed2 = true, separator = "\n") {
 function forEachLineWithContent(input, callback) {
   return toLinesWithContent(input, true).map((line) => callback(line));
 }
-function folderExists(path31) {
-  return (0, import_file_exists.exists)(path31, import_file_exists.FOLDER);
+function folderExists(path32) {
+  return (0, import_file_exists.exists)(path32, import_file_exists.FOLDER);
 }
 function append(target, item) {
   if (Array.isArray(target)) {
@@ -23625,7 +24142,7 @@ function prefixedArray(input, prefix) {
   return output;
 }
 function bufferToString(input) {
-  return (Array.isArray(input) ? Buffer2.concat(input) : input).toString("utf-8");
+  return (Array.isArray(input) ? Buffer22.concat(input) : input).toString("utf-8");
 }
 function pick2(source, properties) {
   const out = {};
@@ -23972,8 +24489,8 @@ function checkIsRepoRootTask() {
     commands,
     format: "utf-8",
     onError,
-    parser(path31) {
-      return /^\.(git)?$/.test(path31.trim());
+    parser(path32) {
+      return /^\.(git)?$/.test(path32.trim());
     }
   };
 }
@@ -24407,11 +24924,11 @@ function parseGrep(grep) {
   const paths = /* @__PURE__ */ new Set();
   const results = {};
   forEachLineWithContent(grep, (input) => {
-    const [path31, line, preview] = input.split(NULL);
-    paths.add(path31);
-    (results[path31] = results[path31] || []).push({
+    const [path32, line, preview] = input.split(NULL);
+    paths.add(path32);
+    (results[path32] = results[path32] || []).push({
       line: asNumber(line),
-      path: path31,
+      path: path32,
       preview
     });
   });
@@ -25176,14 +25693,14 @@ var init_hash_object = __esm2({
     init_task();
   }
 });
-function parseInit(bare, path31, text) {
+function parseInit(bare, path32, text) {
   const response = String(text).trim();
   let result;
   if (result = initResponseRegex.exec(response)) {
-    return new InitSummary(bare, path31, false, result[1]);
+    return new InitSummary(bare, path32, false, result[1]);
   }
   if (result = reInitResponseRegex.exec(response)) {
-    return new InitSummary(bare, path31, true, result[1]);
+    return new InitSummary(bare, path32, true, result[1]);
   }
   let gitDir = "";
   const tokens = response.split(" ");
@@ -25194,7 +25711,7 @@ function parseInit(bare, path31, text) {
       break;
     }
   }
-  return new InitSummary(bare, path31, /^re/i.test(response), gitDir);
+  return new InitSummary(bare, path32, /^re/i.test(response), gitDir);
 }
 var InitSummary;
 var initResponseRegex;
@@ -25203,9 +25720,9 @@ var init_InitSummary = __esm2({
   "src/lib/responses/InitSummary.ts"() {
     "use strict";
     InitSummary = class {
-      constructor(bare, path31, existing, gitDir) {
+      constructor(bare, path32, existing, gitDir) {
         this.bare = bare;
-        this.path = path31;
+        this.path = path32;
         this.existing = existing;
         this.gitDir = gitDir;
       }
@@ -25217,7 +25734,7 @@ var init_InitSummary = __esm2({
 function hasBareCommand(command) {
   return command.includes(bareCommand);
 }
-function initTask(bare = false, path31, customArgs) {
+function initTask(bare = false, path32, customArgs) {
   const commands = ["init", ...customArgs];
   if (bare && !hasBareCommand(commands)) {
     commands.splice(1, 0, bareCommand);
@@ -25226,7 +25743,7 @@ function initTask(bare = false, path31, customArgs) {
     commands,
     format: "utf-8",
     parser(text) {
-      return parseInit(commands.includes("--bare"), path31, text);
+      return parseInit(commands.includes("--bare"), path32, text);
     }
   };
 }
@@ -26042,12 +26559,12 @@ var init_FileStatusSummary = __esm2({
     "use strict";
     fromPathRegex = /^(.+)\0(.+)$/;
     FileStatusSummary = class {
-      constructor(path31, index, working_dir) {
-        this.path = path31;
+      constructor(path32, index, working_dir) {
+        this.path = path32;
         this.index = index;
         this.working_dir = working_dir;
         if (index === "R" || working_dir === "R") {
-          const detail = fromPathRegex.exec(path31) || [null, path31, path31];
+          const detail = fromPathRegex.exec(path32) || [null, path32, path32];
           this.from = detail[2] || "";
           this.path = detail[1] || "";
         }
@@ -26078,14 +26595,14 @@ function splitLine(result, lineStr) {
     default:
       return;
   }
-  function data(index, workingDir, path31) {
+  function data(index, workingDir, path32) {
     const raw = `${index}${workingDir}`;
     const handler = parsers6.get(raw);
     if (handler) {
-      handler(result, path31);
+      handler(result, path32);
     }
     if (raw !== "##" && raw !== "!!") {
-      result.files.push(new FileStatusSummary(path31, index, workingDir));
+      result.files.push(new FileStatusSummary(path32, index, workingDir));
     }
   }
 }
@@ -26394,9 +26911,9 @@ var init_simple_git_api = __esm2({
           next
         );
       }
-      hashObject(path31, write) {
+      hashObject(path32, write) {
         return this._runTask(
-          hashObjectTask(path31, write === true),
+          hashObjectTask(path32, write === true),
           trailingFunctionArgument(arguments)
         );
       }
@@ -26749,8 +27266,8 @@ var init_branch = __esm2({
   }
 });
 function toPath(input) {
-  const path31 = input.trim().replace(/^["']|["']$/g, "");
-  return path31 && normalize2(path31);
+  const path32 = input.trim().replace(/^["']|["']$/g, "");
+  return path32 && normalize2(path32);
 }
 var parseCheckIgnore;
 var init_CheckIgnore = __esm2({
@@ -27064,8 +27581,8 @@ __export2(sub_module_exports, {
   subModuleTask: () => subModuleTask,
   updateSubModuleTask: () => updateSubModuleTask
 });
-function addSubModuleTask(repo, path31) {
-  return subModuleTask(["add", repo, path31]);
+function addSubModuleTask(repo, path32) {
+  return subModuleTask(["add", repo, path32]);
 }
 function initSubModuleTask(customArgs) {
   return subModuleTask(["init", ...customArgs]);
@@ -27398,8 +27915,8 @@ var require_git = __commonJS2({
       }
       return this._runTask(straightThroughStringTask2(command, this._trimmed), next);
     };
-    Git2.prototype.submoduleAdd = function(repo, path31, then) {
-      return this._runTask(addSubModuleTask2(repo, path31), trailingFunctionArgument2(arguments));
+    Git2.prototype.submoduleAdd = function(repo, path32, then) {
+      return this._runTask(addSubModuleTask2(repo, path32), trailingFunctionArgument2(arguments));
     };
     Git2.prototype.submoduleUpdate = function(args, then) {
       return this._runTask(
@@ -28025,20 +28542,20 @@ async function isGitRepoDirectory(dirPath) {
 // src/git/discover-repos.ts
 async function discoverGitRepos(cwd = getBridgeWorkspaceDirectory()) {
   const result = [];
-  const cwdResolved = path4.resolve(cwd);
+  const cwdResolved = path5.resolve(cwd);
   if (await isGitRepoDirectory(cwdResolved)) {
     const remoteUrl = await getRemoteOriginUrl(cwdResolved);
     result.push({ absolutePath: cwdResolved, remoteUrl });
   }
   let entries;
   try {
-    entries = fs2.readdirSync(cwdResolved, { withFileTypes: true });
+    entries = fs7.readdirSync(cwdResolved, { withFileTypes: true });
   } catch {
     return result;
   }
   for (const ent of entries) {
     if (!ent.isDirectory()) continue;
-    const childPath = path4.join(cwdResolved, ent.name);
+    const childPath = path5.join(cwdResolved, ent.name);
     if (await isGitRepoDirectory(childPath)) {
       const remoteUrl = await getRemoteOriginUrl(childPath);
       result.push({ absolutePath: childPath, remoteUrl });
@@ -28047,22 +28564,22 @@ async function discoverGitRepos(cwd = getBridgeWorkspaceDirectory()) {
   return result;
 }
 async function discoverGitReposUnderRoot(rootAbs) {
-  const root = path4.resolve(rootAbs);
+  const root = path5.resolve(rootAbs);
   const roots = [];
   async function walk(dir) {
     if (await isGitRepoDirectory(dir)) {
-      roots.push(path4.resolve(dir));
+      roots.push(path5.resolve(dir));
       return;
     }
     let entries;
     try {
-      entries = fs2.readdirSync(dir, { withFileTypes: true });
+      entries = fs7.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const ent of entries) {
       if (!ent.isDirectory() || ent.name === ".git") continue;
-      await walk(path4.join(dir, ent.name));
+      await walk(path5.join(dir, ent.name));
     }
   }
   await walk(root);
@@ -28076,13 +28593,13 @@ async function discoverGitReposUnderRoot(rootAbs) {
 }
 
 // src/git/pre-turn-snapshot.ts
-var execFileAsync = promisify(execFile);
+var execFileAsync5 = promisify6(execFile6);
 function snapshotsDirForCwd(agentCwd) {
-  return path5.join(agentCwd, ".buildautomaton", "snapshots");
+  return path6.join(agentCwd, ".buildautomaton", "snapshots");
 }
 async function gitStashCreate(repoRoot, log2) {
   try {
-    const { stdout } = await execFileAsync("git", ["stash", "create"], {
+    const { stdout } = await execFileAsync5("git", ["stash", "create"], {
       cwd: repoRoot,
       maxBuffer: 10 * 1024 * 1024
     });
@@ -28096,7 +28613,7 @@ async function gitStashCreate(repoRoot, log2) {
 }
 async function gitRun(repoRoot, args, log2, label) {
   try {
-    await execFileAsync("git", args, { cwd: repoRoot, maxBuffer: 10 * 1024 * 1024 });
+    await execFileAsync5("git", args, { cwd: repoRoot, maxBuffer: 10 * 1024 * 1024 });
     return { ok: true };
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
@@ -28107,7 +28624,7 @@ async function gitRun(repoRoot, args, log2, label) {
 async function resolveSnapshotRepoRoots(options) {
   const { worktreePaths, fallbackCwd, log: log2 } = options;
   if (worktreePaths?.length) {
-    const uniq = [...new Set(worktreePaths.map((p) => path5.resolve(p)))];
+    const uniq = [...new Set(worktreePaths.map((p) => path6.resolve(p)))];
     return uniq;
   }
   try {
@@ -28130,7 +28647,7 @@ async function capturePreTurnSnapshot(options) {
   }
   const dir = snapshotsDirForCwd(agentCwd);
   try {
-    fs3.mkdirSync(dir, { recursive: true });
+    fs8.mkdirSync(dir, { recursive: true });
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
   }
@@ -28139,9 +28656,9 @@ async function capturePreTurnSnapshot(options) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     repos
   };
-  const filePath = path5.join(dir, `${runId}.json`);
+  const filePath = path6.join(dir, `${runId}.json`);
   try {
-    fs3.writeFileSync(filePath, JSON.stringify(payload, null, 2), "utf8");
+    fs8.writeFileSync(filePath, JSON.stringify(payload, null, 2), "utf8");
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
   }
@@ -28154,7 +28671,7 @@ async function capturePreTurnSnapshot(options) {
 async function applyPreTurnSnapshot(filePath, log2) {
   let data;
   try {
-    const raw = fs3.readFileSync(filePath, "utf8");
+    const raw = fs8.readFileSync(filePath, "utf8");
     data = JSON.parse(raw);
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
@@ -28177,11 +28694,11 @@ async function applyPreTurnSnapshot(filePath, log2) {
   return { ok: true };
 }
 function snapshotFilePath(agentCwd, runId) {
-  return path5.join(snapshotsDirForCwd(agentCwd), `${runId}.json`);
+  return path6.join(snapshotsDirForCwd(agentCwd), `${runId}.json`);
 }
 
 // src/git/session-git-queue.ts
-var execFileAsync2 = promisify2(execFile2);
+var execFileAsync6 = promisify7(execFile7);
 var MAX_FULL_FILE_TEXT_BYTES = 512 * 1024;
 async function readWorkspaceFileAsUtf8(absPath) {
   try {
@@ -28214,7 +28731,7 @@ async function collectTurnGitDiffFromPreTurnSnapshot(options) {
     if (!repo.stashSha) continue;
     let namesRaw;
     try {
-      const { stdout } = await execFileAsync2("git", ["diff", "--name-only", repo.stashSha], {
+      const { stdout } = await execFileAsync6("git", ["diff", "--name-only", repo.stashSha], {
         cwd: repo.path,
         maxBuffer: 10 * 1024 * 1024
       });
@@ -28226,11 +28743,11 @@ async function collectTurnGitDiffFromPreTurnSnapshot(options) {
       continue;
     }
     const lines = namesRaw.split("\n").map((l) => l.trim()).filter(Boolean);
-    const slug = path6.basename(repo.path).replace(/[^\w.-]+/g, "_") || "repo";
+    const slug = path7.basename(repo.path).replace(/[^\w.-]+/g, "_") || "repo";
     for (const rel of lines) {
       if (rel.includes("..")) continue;
       try {
-        const { stdout: patchContent } = await execFileAsync2(
+        const { stdout: patchContent } = await execFileAsync6(
           "git",
           ["diff", "--no-color", repo.stashSha, "--", rel],
           {
@@ -28240,7 +28757,7 @@ async function collectTurnGitDiffFromPreTurnSnapshot(options) {
         );
         if (!patchContent.trim()) continue;
         const displayPath = multiRepo ? `${slug}/${rel}` : rel;
-        const absFile = path6.join(repo.path, rel);
+        const absFile = path7.join(repo.path, rel);
         const newText = await readWorkspaceFileAsUtf8(absFile);
         sendSessionUpdate({
           type: "session_file_change",
@@ -28302,7 +28819,9 @@ async function sendPromptToAgent(options) {
       ...augmentAuthFields(errStr)
     });
     if (!result.success) {
-      log2(`[Agent] ${result.error ?? "Error"}`);
+      log2(
+        `[Agent] Prompt did not run successfully on the agent (no successful start/completion): ${result.error ?? "Unknown error"}`
+      );
     }
   } catch (err) {
     const errMsg = err instanceof Error ? err.message : String(err);
@@ -28320,8 +28839,8 @@ async function sendPromptToAgent(options) {
 }
 
 // src/agents/acp/ensure-acp-client.ts
-import * as fs4 from "node:fs";
-import * as path9 from "node:path";
+import * as fs9 from "node:fs";
+import * as path10 from "node:path";
 
 // src/error-message.ts
 function errorMessage(err) {
@@ -28341,16 +28860,16 @@ __export(claude_code_acp_client_exports, {
   createClaudeCodeAcpClient: () => createClaudeCodeAcpClient,
   detectLocalAgentPresence: () => detectLocalAgentPresence
 });
-import { execFile as execFile4 } from "node:child_process";
-import { promisify as promisify4 } from "node:util";
+import { execFile as execFile9 } from "node:child_process";
+import { promisify as promisify9 } from "node:util";
 
 // src/agents/acp/clients/detect-command-on-path.ts
-import { execFile as execFile3 } from "node:child_process";
-import { promisify as promisify3 } from "node:util";
-var execFileAsync3 = promisify3(execFile3);
+import { execFile as execFile8 } from "node:child_process";
+import { promisify as promisify8 } from "node:util";
+var execFileAsync7 = promisify8(execFile8);
 async function isCommandOnPath(command, timeoutMs = 4e3) {
   try {
-    await execFileAsync3("which", [command], { timeout: timeoutMs });
+    await execFileAsync7("which", [command], { timeout: timeoutMs });
     return true;
   } catch {
     return false;
@@ -28358,12 +28877,12 @@ async function isCommandOnPath(command, timeoutMs = 4e3) {
 }
 
 // src/agents/acp/clients/claude-code-acp-client.ts
-var execFileAsync4 = promisify4(execFile4);
+var execFileAsync8 = promisify9(execFile9);
 var BACKEND_LOCAL_AGENT_TYPE = "claude-code";
 async function detectLocalAgentPresence() {
   if (await isCommandOnPath("claude")) return true;
   try {
-    await execFileAsync4("npx", ["--yes", "@anthropic-ai/claude-code", "--version"], { timeout: 25e3 });
+    await execFileAsync8("npx", ["--yes", "@anthropic-ai/claude-code", "--version"], { timeout: 25e3 });
     return true;
   } catch {
     return false;
@@ -28478,7 +28997,7 @@ async function createCursorAcpClient(options) {
     onRequest,
     onFileChange
   } = options;
-  const dbgFs = process.env.BUILDAMATON_DEBUG_ACP_FS === "1";
+  const dbgFs = process.env.BUILDAUTOMATON_DEBUG_ACP_FS === "1";
   const isWindows = process.platform === "win32";
   const child = spawn4(command[0], command.slice(1), {
     cwd,
@@ -28861,48 +29380,48 @@ function resolveAgentCommand(preferredAgentType) {
 }
 
 // src/agents/acp/session-file-change-path-kind.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 import { existsSync, statSync } from "node:fs";
 
 // src/git/get-git-repo-root-sync.ts
-import { execFileSync } from "node:child_process";
-import * as path7 from "node:path";
+import { execFileSync as execFileSync2 } from "node:child_process";
+import * as path8 from "node:path";
 function getGitRepoRootSync(startDir) {
   try {
-    const out = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-      cwd: path7.resolve(startDir),
+    const out = execFileSync2("git", ["rev-parse", "--show-toplevel"], {
+      cwd: path8.resolve(startDir),
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       maxBuffer: 1024 * 1024
     }).trim();
-    return out ? path7.resolve(out) : null;
+    return out ? path8.resolve(out) : null;
   } catch {
     return null;
   }
 }
 
 // src/agents/acp/workspace-files.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { readFileSync as readFileSync4 } from "node:fs";
-import * as path8 from "node:path";
+import * as path9 from "node:path";
 function resolveWorkspaceFilePath(cwd, rawPath) {
   const trimmed2 = rawPath.trim();
   if (!trimmed2) return null;
-  const normalizedCwd = path8.resolve(cwd);
+  const normalizedCwd = path9.resolve(cwd);
   let abs = resolveSafePathUnderCwd(cwd, trimmed2);
   if (!abs) {
-    const candidate = path8.isAbsolute(trimmed2) ? path8.normalize(trimmed2) : path8.normalize(path8.resolve(normalizedCwd, trimmed2));
+    const candidate = path9.isAbsolute(trimmed2) ? path9.normalize(trimmed2) : path9.normalize(path9.resolve(normalizedCwd, trimmed2));
     const gitRoot2 = getGitRepoRootSync(cwd);
     if (!gitRoot2) return null;
-    const rel = path8.relative(gitRoot2, candidate);
-    if (rel.startsWith("..") || path8.isAbsolute(rel)) return null;
+    const rel = path9.relative(gitRoot2, candidate);
+    if (rel.startsWith("..") || path9.isAbsolute(rel)) return null;
     abs = candidate;
   }
   const gitRoot = getGitRepoRootSync(cwd);
   if (gitRoot) {
-    const relFromRoot = path8.relative(gitRoot, abs);
-    if (!relFromRoot.startsWith("..") && !path8.isAbsolute(relFromRoot)) {
-      return { abs, display: relFromRoot.split(path8.sep).join("/") };
+    const relFromRoot = path9.relative(gitRoot, abs);
+    if (!relFromRoot.startsWith("..") && !path9.isAbsolute(relFromRoot)) {
+      return { abs, display: relFromRoot.split(path9.sep).join("/") };
     }
   }
   return { abs, display: toDisplayPathRelativeToCwd(cwd, abs) };
@@ -28911,9 +29430,9 @@ function readUtf8WorkspaceFile(cwd, displayPath) {
   if (!displayPath || displayPath.includes("..")) return "";
   const gitRoot = getGitRepoRootSync(cwd);
   if (gitRoot) {
-    const abs2 = path8.resolve(gitRoot, displayPath);
-    const rel = path8.relative(gitRoot, abs2);
-    if (!rel.startsWith("..") && !path8.isAbsolute(rel)) {
+    const abs2 = path9.resolve(gitRoot, displayPath);
+    const rel = path9.relative(gitRoot, abs2);
+    if (!rel.startsWith("..") && !path9.isAbsolute(rel)) {
       try {
         return readFileSync4(abs2, "utf8");
       } catch {
@@ -28932,9 +29451,9 @@ function tryWorkspaceDisplayToAbs(cwd, displayPath) {
   if (!displayPath || displayPath.includes("..")) return null;
   const gitRoot = getGitRepoRootSync(cwd);
   if (gitRoot) {
-    const abs = path8.resolve(gitRoot, displayPath);
-    const rel = path8.relative(gitRoot, abs);
-    if (!rel.startsWith("..") && !path8.isAbsolute(rel)) return abs;
+    const abs = path9.resolve(gitRoot, displayPath);
+    const rel = path9.relative(gitRoot, abs);
+    if (!rel.startsWith("..") && !path9.isAbsolute(rel)) return abs;
   }
   return resolveSafePathUnderCwd(cwd, displayPath);
 }
@@ -28943,7 +29462,7 @@ function readGitHeadBlob(cwd, displayPath) {
   const gitRoot = getGitRepoRootSync(cwd);
   const execCwd = gitRoot ?? cwd;
   try {
-    return execFileSync2("git", ["show", `HEAD:${displayPath}`], {
+    return execFileSync3("git", ["show", `HEAD:${displayPath}`], {
       cwd: execCwd,
       encoding: "utf8",
       maxBuffer: 50 * 1024 * 1024
@@ -28959,7 +29478,7 @@ function gitHeadPathObjectType(cwd, displayPath) {
   const gitRoot = getGitRepoRootSync(cwd);
   if (!gitRoot) return null;
   try {
-    return execFileSync3("git", ["cat-file", "-t", `HEAD:${displayPath}`], {
+    return execFileSync4("git", ["cat-file", "-t", `HEAD:${displayPath}`], {
       cwd: gitRoot,
       encoding: "utf8"
     }).trim();
@@ -29050,7 +29569,7 @@ function createBridgeOnRequest(opts) {
 }
 
 // src/agents/acp/hooks/extract-acp-file-diffs-from-update/paths-and-text.ts
-import { fileURLToPath } from "node:url";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 function readOptionalTextField(v) {
   if (v === null || v === void 0) return "";
   if (typeof v === "string") return v;
@@ -29060,7 +29579,7 @@ function normalizePathField(raw) {
   const t = raw.trim();
   if (t.startsWith("file://")) {
     try {
-      return fileURLToPath(t);
+      return fileURLToPath2(t);
     } catch {
       return t;
     }
@@ -29502,10 +30021,10 @@ function buildAcpSessionBridgeHooks(opts) {
 // src/agents/acp/ensure-acp-client.ts
 async function ensureAcpClient(options) {
   const { state, preferredAgentType, mode, cwd, routing, sendSessionUpdate, sendRequest, log: log2 } = options;
-  const targetCwd = path9.resolve(
+  const targetCwd = path10.resolve(
     cwd != null && String(cwd).trim() !== "" ? String(cwd).trim() : getBridgeWorkspaceDirectory()
   );
-  if (state.acpHandle && state.lastAcpCwd != null && path9.resolve(state.lastAcpCwd) !== path9.resolve(targetCwd)) {
+  if (state.acpHandle && state.lastAcpCwd != null && path10.resolve(state.lastAcpCwd) !== path10.resolve(targetCwd)) {
     try {
       state.acpHandle.disconnect();
     } catch {
@@ -29537,7 +30056,7 @@ async function ensureAcpClient(options) {
   if (!state.acpStartPromise) {
     let statOk = false;
     try {
-      const st = fs4.statSync(targetCwd);
+      const st = fs9.statSync(targetCwd);
       statOk = st.isDirectory();
       if (!statOk) {
         state.lastAcpStartError = `Agent cwd is not a directory: ${targetCwd}`;
@@ -29733,12 +30252,12 @@ async function createAcpManager(options) {
 }
 
 // src/worktrees/session-worktree-manager.ts
-import * as path15 from "node:path";
-import os3 from "node:os";
+import * as path16 from "node:path";
+import os4 from "node:os";
 
 // src/worktrees/prepare-new-session-worktrees.ts
-import * as fs6 from "node:fs";
-import * as path11 from "node:path";
+import * as fs11 from "node:fs";
+import * as path12 from "node:path";
 
 // src/git/worktree-add.ts
 async function gitWorktreeAddBranch(mainRepoPath, worktreePath, branch) {
@@ -29747,12 +30266,12 @@ async function gitWorktreeAddBranch(mainRepoPath, worktreePath, branch) {
 }
 
 // src/worktrees/worktree-layout-file.ts
-import * as fs5 from "node:fs";
-import * as path10 from "node:path";
-import os2 from "node:os";
+import * as fs10 from "node:fs";
+import * as path11 from "node:path";
+import os3 from "node:os";
 var LAYOUT_FILENAME = "worktree-launcher-layout.json";
 function defaultWorktreeLayoutPath() {
-  return path10.join(os2.homedir(), ".buildautomaton", LAYOUT_FILENAME);
+  return path11.join(os3.homedir(), ".buildautomaton", LAYOUT_FILENAME);
 }
 function normalizeLoadedLayout(raw) {
   if (raw && typeof raw === "object" && "launcherCwds" in raw) {
@@ -29764,8 +30283,8 @@ function normalizeLoadedLayout(raw) {
 function loadWorktreeLayout() {
   try {
     const p = defaultWorktreeLayoutPath();
-    if (!fs5.existsSync(p)) return { launcherCwds: [] };
-    const raw = JSON.parse(fs5.readFileSync(p, "utf8"));
+    if (!fs10.existsSync(p)) return { launcherCwds: [] };
+    const raw = JSON.parse(fs10.readFileSync(p, "utf8"));
     return normalizeLoadedLayout(raw);
   } catch {
     return { launcherCwds: [] };
@@ -29773,18 +30292,18 @@ function loadWorktreeLayout() {
 }
 function saveWorktreeLayout(layout) {
   try {
-    const dir = path10.dirname(defaultWorktreeLayoutPath());
-    fs5.mkdirSync(dir, { recursive: true });
-    fs5.writeFileSync(defaultWorktreeLayoutPath(), JSON.stringify(layout, null, 2), "utf8");
+    const dir = path11.dirname(defaultWorktreeLayoutPath());
+    fs10.mkdirSync(dir, { recursive: true });
+    fs10.writeFileSync(defaultWorktreeLayoutPath(), JSON.stringify(layout, null, 2), "utf8");
   } catch {
   }
 }
 function baseNameSafe(abs) {
-  return path10.basename(abs).replace(/[^a-zA-Z0-9._-]+/g, "-") || "cwd";
+  return path11.basename(abs).replace(/[^a-zA-Z0-9._-]+/g, "-") || "cwd";
 }
 function allocateDirNameForLauncherCwd(layout, launcherCwdAbs) {
-  const norm = path10.resolve(launcherCwdAbs);
-  const existing = layout.launcherCwds.find((e) => path10.resolve(e.absolutePath) === norm);
+  const norm = path11.resolve(launcherCwdAbs);
+  const existing = layout.launcherCwds.find((e) => path11.resolve(e.absolutePath) === norm);
   if (existing) return existing.dirName;
   const base = baseNameSafe(norm);
   const used = new Set(layout.launcherCwds.map((e) => e.dirName));
@@ -29802,9 +30321,9 @@ function allocateDirNameForLauncherCwd(layout, launcherCwdAbs) {
 // src/worktrees/prepare-new-session-worktrees.ts
 async function prepareNewSessionWorktrees(options) {
   const { rootAbs, launcherCwd, sessionId, layout, log: log2 } = options;
-  const launcherResolved = path11.resolve(launcherCwd);
+  const launcherResolved = path12.resolve(launcherCwd);
   const cwdKey = allocateDirNameForLauncherCwd(layout, launcherResolved);
-  const agentMirrorRoot = path11.join(rootAbs, cwdKey);
+  const agentMirrorRoot = path12.join(rootAbs, cwdKey);
   const repos = await discoverGitReposUnderRoot(launcherResolved);
   if (repos.length === 0) {
     log2("[worktrees] No Git repositories under launcher working directory; skipping worktree creation.");
@@ -29812,13 +30331,13 @@ async function prepareNewSessionWorktrees(options) {
   }
   const branch = `session-${sessionId}`;
   const worktreePaths = [];
-  fs6.mkdirSync(agentMirrorRoot, { recursive: true });
+  fs11.mkdirSync(agentMirrorRoot, { recursive: true });
   for (const repo of repos) {
-    let rel = path11.relative(launcherResolved, repo.absolutePath);
-    if (rel.startsWith("..") || path11.isAbsolute(rel)) continue;
+    let rel = path12.relative(launcherResolved, repo.absolutePath);
+    if (rel.startsWith("..") || path12.isAbsolute(rel)) continue;
     const relNorm = rel === "" ? "." : rel;
-    const wtPath = path11.join(agentMirrorRoot, relNorm, sessionId);
-    fs6.mkdirSync(path11.dirname(wtPath), { recursive: true });
+    const wtPath = path12.join(agentMirrorRoot, relNorm, sessionId);
+    fs11.mkdirSync(path12.dirname(wtPath), { recursive: true });
     try {
       await gitWorktreeAddBranch(repo.absolutePath, wtPath, branch);
       log2(`[worktrees] Added worktree ${wtPath} (branch ${branch}).`);
@@ -29855,23 +30374,23 @@ async function renameSessionWorktreeBranches(paths, newBranch, log2) {
 }
 
 // src/worktrees/remove-session-worktrees.ts
-import * as fs9 from "node:fs";
+import * as fs14 from "node:fs";
 
 // src/git/worktree-remove.ts
-import * as fs8 from "node:fs";
+import * as fs13 from "node:fs";
 
 // src/git/resolve-main-repo-from-git-file.ts
-import * as fs7 from "node:fs";
-import * as path12 from "node:path";
+import * as fs12 from "node:fs";
+import * as path13 from "node:path";
 function resolveMainRepoFromWorktreeGitFile(wt) {
-  const gitDirFile = path12.join(wt, ".git");
-  if (!fs7.existsSync(gitDirFile) || !fs7.statSync(gitDirFile).isFile()) return "";
-  const first2 = fs7.readFileSync(gitDirFile, "utf8").trim();
+  const gitDirFile = path13.join(wt, ".git");
+  if (!fs12.existsSync(gitDirFile) || !fs12.statSync(gitDirFile).isFile()) return "";
+  const first2 = fs12.readFileSync(gitDirFile, "utf8").trim();
   const m = first2.match(/^gitdir:\s*(.+)$/im);
   if (!m) return "";
-  const gitWorktreePath = path12.resolve(wt, m[1].trim());
-  const gitDir = path12.dirname(path12.dirname(gitWorktreePath));
-  return path12.dirname(gitDir);
+  const gitWorktreePath = path13.resolve(wt, m[1].trim());
+  const gitDir = path13.dirname(path13.dirname(gitWorktreePath));
+  return path13.dirname(gitDir);
 }
 
 // src/git/worktree-remove.ts
@@ -29880,7 +30399,7 @@ async function gitWorktreeRemoveForce(worktreePath) {
   if (mainRepo) {
     await simpleGit(mainRepo).raw(["worktree", "remove", "--force", worktreePath]);
   } else {
-    fs8.rmSync(worktreePath, { recursive: true, force: true });
+    fs13.rmSync(worktreePath, { recursive: true, force: true });
   }
 }
 
@@ -29893,7 +30412,7 @@ async function removeSessionWorktrees(paths, log2) {
     } catch (e) {
       log2(`[worktrees] Remove failed for ${wt}: ${e instanceof Error ? e.message : String(e)}`);
       try {
-        fs9.rmSync(wt, { recursive: true, force: true });
+        fs14.rmSync(wt, { recursive: true, force: true });
       } catch {
       }
     }
@@ -30113,7 +30632,7 @@ function formatRemoteDisplayLabel(remoteUrl) {
 }
 
 // src/git/working-directory/changes/get-working-tree-change-repo-details.ts
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 
 // src/git/working-directory/changes/parse-git-status.ts
 function parseNameStatusLines(lines) {
@@ -30233,8 +30752,8 @@ async function listChangedFilesForCommit(repoGitCwd, repoRelPath, commitSha) {
 }
 
 // src/git/working-directory/changes/list-changed-files-for-repo.ts
-import * as fs11 from "node:fs";
-import * as path13 from "node:path";
+import * as fs16 from "node:fs";
+import * as path14 from "node:path";
 
 // src/git/working-directory/changes/count-lines.ts
 import { createReadStream } from "node:fs";
@@ -30258,7 +30777,7 @@ async function countTextFileLines(absFile) {
 }
 
 // src/git/working-directory/changes/hydrate-patch.ts
-import * as fs10 from "node:fs";
+import * as fs15 from "node:fs";
 var UNIFIED_HUNK_HEADER_RE = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
 var MAX_HYDRATE_LINES_PER_GAP = 8e3;
 var MAX_HYDRATE_LINES_PER_FILE = 8e4;
@@ -30273,7 +30792,7 @@ async function readGitBlobLines(repoCwd, pathInRepo) {
 }
 async function readWorktreeFileLines(abs) {
   try {
-    const raw = await fs10.promises.readFile(abs, "utf8");
+    const raw = await fs15.promises.readFile(abs, "utf8");
     return raw.split(/\r?\n/);
   } catch {
     return null;
@@ -30408,7 +30927,7 @@ async function listChangedFilesForRepo(repoGitCwd, repoRelPath) {
   const rows = [];
   for (const pathInRepo of paths) {
     const relLauncher = posixJoinDirFile(repoRelPath, pathInRepo.replace(/\\/g, "/"));
-    const abs = path13.join(repoGitCwd, pathInRepo);
+    const abs = path14.join(repoGitCwd, pathInRepo);
     const nums = numByPath.get(pathInRepo);
     let additions = nums?.additions ?? 0;
     let deletions = nums?.deletions ?? 0;
@@ -30421,7 +30940,7 @@ async function listChangedFilesForRepo(repoGitCwd, repoRelPath) {
         deletions = fromGit.deletions;
       } else {
         try {
-          const st = await fs11.promises.stat(abs);
+          const st = await fs16.promises.stat(abs);
           if (st.isFile()) additions = await countTextFileLines(abs);
           else additions = 0;
         } catch {
@@ -30447,7 +30966,7 @@ async function listChangedFilesForRepo(repoGitCwd, repoRelPath) {
     } else {
       pathInRepo = row.pathRelLauncher;
     }
-    const absFile = path13.join(repoGitCwd, pathInRepo);
+    const absFile = path14.join(repoGitCwd, pathInRepo);
     let patch = await unifiedDiffForFile(repoGitCwd, pathInRepo, row.change);
     if (patch) {
       patch = await hydrateUnifiedPatchWithFileContext(patch, absFile, repoGitCwd, pathInRepo, row.change);
@@ -30463,8 +30982,8 @@ function normRepoRel(p) {
   return x === "" ? "." : x;
 }
 async function getWorkingTreeChangeRepoDetails(options) {
-  const launcher = path14.resolve(getBridgeWorkspaceDirectory());
-  const mirror = options.agentMirrorRootAbs ? path14.resolve(options.agentMirrorRootAbs) : null;
+  const launcher = path15.resolve(getBridgeWorkspaceDirectory());
+  const mirror = options.agentMirrorRootAbs ? path15.resolve(options.agentMirrorRootAbs) : null;
   const out = [];
   const filter = options.repoFilterRelPath != null ? normRepoRel(options.repoFilterRelPath) : null;
   const basisInput = options.basis ?? { kind: "working" };
@@ -30476,7 +30995,7 @@ async function getWorkingTreeChangeRepoDetails(options) {
   }
   const basis = filter == null && basisInput.kind === "commit" ? { kind: "working" } : basisInput;
   for (const target of options.commitTargetAbsDirs) {
-    const t = path14.resolve(target);
+    const t = path15.resolve(target);
     if (!await isGitRepoDirectory(t)) continue;
     const g = simpleGit(t);
     let branch = "HEAD";
@@ -30489,7 +31008,7 @@ async function getWorkingTreeChangeRepoDetails(options) {
     const remoteDisplay = formatRemoteDisplayLabel(remoteUrl);
     let repoRelPath;
     if (mirror) {
-      const relNorm = path14.relative(mirror, path14.dirname(t));
+      const relNorm = path15.relative(mirror, path15.dirname(t));
       repoRelPath = relNorm === "" ? "." : relNorm.replace(/\\/g, "/");
     } else {
       let top = t;
@@ -30498,8 +31017,8 @@ async function getWorkingTreeChangeRepoDetails(options) {
       } catch {
         top = t;
       }
-      const rel = path14.relative(launcher, path14.resolve(top)).replace(/\\/g, "/") || ".";
-      repoRelPath = rel.startsWith("..") ? path14.basename(path14.resolve(top)) : rel;
+      const rel = path15.relative(launcher, path15.resolve(top)).replace(/\\/g, "/") || ".";
+      repoRelPath = rel.startsWith("..") ? path15.basename(path15.resolve(top)) : rel;
     }
     const norm = normRepoRel(repoRelPath === "" ? "." : repoRelPath);
     if (filter && norm !== filter) continue;
@@ -30591,7 +31110,7 @@ var SessionWorktreeManager = class {
     }
     if (!opts.isNewSession) {
       const agentCwd = this.sessionAgentCwd.get(sessionId);
-      if (agentCwd) return path15.resolve(agentCwd);
+      if (agentCwd) return path16.resolve(agentCwd);
       return void 0;
     }
     const prep = await prepareNewSessionWorktrees({
@@ -30604,7 +31123,7 @@ var SessionWorktreeManager = class {
     if (!prep) return void 0;
     this.sessionPaths.set(sessionId, prep.worktreePaths);
     this.sessionAgentCwd.set(sessionId, prep.agentCwd);
-    return path15.resolve(prep.agentCwd);
+    return path16.resolve(prep.agentCwd);
   }
   async renameSessionBranch(sessionId, newBranch) {
     const paths = this.sessionPaths.get(sessionId);
@@ -30625,7 +31144,7 @@ var SessionWorktreeManager = class {
   getAgentCwdForSession(sessionId) {
     if (!sessionId) return null;
     const c = this.sessionAgentCwd.get(sessionId);
-    return c ? path15.resolve(c) : null;
+    return c ? path16.resolve(c) : null;
   }
   async removeSessionWorktrees(sessionId) {
     const paths = this.sessionPaths.get(sessionId);
@@ -30673,15 +31192,15 @@ var SessionWorktreeManager = class {
   }
 };
 function defaultWorktreesRootAbs() {
-  return path15.join(os3.homedir(), ".buildautomaton", "worktrees");
+  return path16.join(os4.homedir(), ".buildautomaton", "worktrees");
 }
 
 // src/files/watch-file-index.ts
 import { watch } from "node:fs";
-import path22 from "node:path";
+import path23 from "node:path";
 
 // src/files/index/build-file-index.ts
-import path19 from "node:path";
+import path20 from "node:path";
 
 // src/runtime/yield-to-event-loop.ts
 function yieldToEventLoop() {
@@ -30689,14 +31208,14 @@ function yieldToEventLoop() {
 }
 
 // src/files/index/walk-workspace-tree.ts
-import fs12 from "node:fs";
-import path17 from "node:path";
+import fs17 from "node:fs";
+import path18 from "node:path";
 
 // src/files/index/constants.ts
-import path16 from "node:path";
-import os4 from "node:os";
+import path17 from "node:path";
+import os5 from "node:os";
 var INDEX_WORK_YIELD_EVERY = 256;
-var INDEX_DIR = path16.join(os4.homedir(), ".buildautomaton");
+var INDEX_DIR = path17.join(os5.homedir(), ".buildautomaton");
 var INDEX_HASH_LEN = 16;
 var INDEX_VERSION = 2;
 var INDEX_LOG_PREFIX = "[file-index]";
@@ -30705,20 +31224,20 @@ var INDEX_LOG_PREFIX = "[file-index]";
 function walkWorkspaceTreeSync(dir, baseDir, out) {
   let names;
   try {
-    names = fs12.readdirSync(dir);
+    names = fs17.readdirSync(dir);
   } catch {
     return;
   }
   for (const name of names) {
     if (name.startsWith(".")) continue;
-    const full = path17.join(dir, name);
+    const full = path18.join(dir, name);
     let stat2;
     try {
-      stat2 = fs12.statSync(full);
+      stat2 = fs17.statSync(full);
     } catch {
       continue;
     }
-    const relative5 = path17.relative(baseDir, full).replace(/\\/g, "/");
+    const relative5 = path18.relative(baseDir, full).replace(/\\/g, "/");
     if (stat2.isDirectory()) {
       walkWorkspaceTreeSync(full, baseDir, out);
     } else if (stat2.isFile()) {
@@ -30729,7 +31248,7 @@ function walkWorkspaceTreeSync(dir, baseDir, out) {
 async function walkWorkspaceTreeAsync(dir, baseDir, out, state) {
   let names;
   try {
-    names = await fs12.promises.readdir(dir);
+    names = await fs17.promises.readdir(dir);
   } catch {
     return;
   }
@@ -30739,14 +31258,14 @@ async function walkWorkspaceTreeAsync(dir, baseDir, out, state) {
       await yieldToEventLoop();
     }
     state.n++;
-    const full = path17.join(dir, name);
+    const full = path18.join(dir, name);
     let stat2;
     try {
-      stat2 = await fs12.promises.stat(full);
+      stat2 = await fs17.promises.stat(full);
     } catch {
       continue;
     }
-    const relative5 = path17.relative(baseDir, full).replace(/\\/g, "/");
+    const relative5 = path18.relative(baseDir, full).replace(/\\/g, "/");
     if (stat2.isDirectory()) {
       await walkWorkspaceTreeAsync(full, baseDir, out, state);
     } else if (stat2.isFile()) {
@@ -30827,22 +31346,22 @@ async function buildTrigramMapForPathsAsync(paths) {
 }
 
 // src/files/index/write-index-file.ts
-import fs13 from "node:fs";
+import fs18 from "node:fs";
 
 // src/files/index/paths.ts
-import path18 from "node:path";
+import path19 from "node:path";
 import crypto2 from "node:crypto";
 function getIndexPathForCwd(resolvedCwd) {
   const hash = crypto2.createHash("sha256").update(resolvedCwd).digest("hex").slice(0, INDEX_HASH_LEN);
-  return path18.join(INDEX_DIR, `.file-index-${hash}.json`);
+  return path19.join(INDEX_DIR, `.file-index-${hash}.json`);
 }
 
 // src/files/index/write-index-file.ts
 function writeIndexFileSync(resolvedCwd, data) {
   const indexPath = getIndexPathForCwd(resolvedCwd);
   try {
-    if (!fs13.existsSync(INDEX_DIR)) fs13.mkdirSync(INDEX_DIR, { recursive: true });
-    fs13.writeFileSync(indexPath, JSON.stringify(data), "utf8");
+    if (!fs18.existsSync(INDEX_DIR)) fs18.mkdirSync(INDEX_DIR, { recursive: true });
+    fs18.writeFileSync(indexPath, JSON.stringify(data), "utf8");
   } catch (e) {
     console.error(`${INDEX_LOG_PREFIX} Failed to write index:`, e);
   }
@@ -30850,8 +31369,8 @@ function writeIndexFileSync(resolvedCwd, data) {
 async function writeIndexFileAsync(resolvedCwd, data) {
   const indexPath = getIndexPathForCwd(resolvedCwd);
   try {
-    await fs13.promises.mkdir(INDEX_DIR, { recursive: true });
-    await fs13.promises.writeFile(indexPath, JSON.stringify(data), "utf8");
+    await fs18.promises.mkdir(INDEX_DIR, { recursive: true });
+    await fs18.promises.writeFile(indexPath, JSON.stringify(data), "utf8");
   } catch (e) {
     console.error(`${INDEX_LOG_PREFIX} Failed to write index:`, e);
   }
@@ -30865,7 +31384,7 @@ function sortPaths(paths) {
   paths.sort((a, b) => a.localeCompare(b, void 0, { sensitivity: "base" }));
 }
 function buildFileIndex(cwd) {
-  const resolved = path19.resolve(cwd);
+  const resolved = path20.resolve(cwd);
   const paths = [];
   walkWorkspaceTreeSync(resolved, resolved, paths);
   sortPaths(paths);
@@ -30875,7 +31394,7 @@ function buildFileIndex(cwd) {
   return data;
 }
 async function buildFileIndexAsync(cwd) {
-  const resolved = path19.resolve(cwd);
+  const resolved = path20.resolve(cwd);
   const paths = [];
   await walkWorkspaceTreeAsync(resolved, resolved, paths, createWalkYieldState());
   await yieldToEventLoop();
@@ -30887,13 +31406,13 @@ async function buildFileIndexAsync(cwd) {
 }
 
 // src/files/index/load-file-index.ts
-import fs14 from "node:fs";
-import path20 from "node:path";
+import fs19 from "node:fs";
+import path21 from "node:path";
 function loadFileIndex(cwd) {
-  const resolved = path20.resolve(cwd);
+  const resolved = path21.resolve(cwd);
   const indexPath = getIndexPathForCwd(resolved);
   try {
-    const raw = fs14.readFileSync(indexPath, "utf8");
+    const raw = fs19.readFileSync(indexPath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed !== null && typeof parsed === "object" && Array.isArray(parsed.paths)) {
       const obj = parsed;
@@ -30912,9 +31431,9 @@ function loadFileIndex(cwd) {
 }
 
 // src/files/index/ensure-file-index.ts
-import path21 from "node:path";
+import path22 from "node:path";
 async function ensureFileIndexAsync(cwd) {
-  const resolved = path21.resolve(cwd);
+  const resolved = path22.resolve(cwd);
   const cached2 = loadFileIndex(resolved);
   if (cached2 !== null) return { data: cached2, fromCache: true };
   const data = await buildFileIndexAsync(resolved);
@@ -30997,7 +31516,7 @@ function createFsWatcher(resolved, schedule) {
   }
 }
 function startFileIndexWatcher(cwd = getBridgeWorkspaceDirectory()) {
-  const resolved = path22.resolve(cwd);
+  const resolved = path23.resolve(cwd);
   void buildFileIndexAsync(resolved).catch((e) => {
     console.error("[file-index] Initial index build failed:", e);
   });
@@ -31025,7 +31544,7 @@ function startFileIndexWatcher(cwd = getBridgeWorkspaceDirectory()) {
 }
 
 // src/dev-servers/manager/dev-server-manager.ts
-import { rm } from "node:fs/promises";
+import { rm as rm2 } from "node:fs/promises";
 
 // src/dev-servers/process/send-server-status.ts
 function sendDevServerStatus(getWs, serverId, status, options) {
@@ -31066,7 +31585,7 @@ function forceKillChild(proc, log2, shortId, graceMs) {
 }
 
 // src/dev-servers/process/wire-dev-server-child-process.ts
-import fs15 from "node:fs";
+import fs20 from "node:fs";
 
 // src/dev-servers/manager/forward-pipe.ts
 function forwardChildPipe(childReadable, terminal, onData) {
@@ -31102,7 +31621,7 @@ function wireDevServerChildProcess(d) {
         d.setPollInterval(void 0);
         return;
       }
-      fs15.readFile(d.mergedLogPath, (err, buf) => {
+      fs20.readFile(d.mergedLogPath, (err, buf) => {
         if (err || (d.getSpawnGeneration() ?? 0) !== d.scheduledGen) return;
         if (buf.length <= d.mergedReadPos.value) return;
         const chunk = Buffer.from(buf.subarray(d.mergedReadPos.value));
@@ -31140,7 +31659,7 @@ ${errTail}` : ""}`);
       d.sendStatus(code === 0 || code == null ? "stopped" : "error", detail, tails);
     };
     if (mergedPath) {
-      fs15.readFile(mergedPath, (err, buf) => {
+      fs20.readFile(mergedPath, (err, buf) => {
         if (!err && buf.length > d.mergedReadPos.value) {
           const chunk = Buffer.from(buf.subarray(d.mergedReadPos.value));
           if (chunk.length > 0) {
@@ -31242,13 +31761,13 @@ function parseDevServerDefs(servers) {
 }
 
 // src/dev-servers/manager/shell-spawn/utils.ts
-import fs16 from "node:fs";
+import fs21 from "node:fs";
 function isSpawnEbadf(e) {
   return typeof e === "object" && e !== null && "code" in e && e.code === "EBADF";
 }
 function rmDirQuiet(dir) {
   try {
-    fs16.rmSync(dir, { recursive: true, force: true });
+    fs21.rmSync(dir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -31256,7 +31775,7 @@ var cachedDevNullReadFd;
 function devNullReadFd() {
   if (cachedDevNullReadFd === void 0) {
     const devPath = process.platform === "win32" ? "nul" : "/dev/null";
-    cachedDevNullReadFd = fs16.openSync(devPath, "r");
+    cachedDevNullReadFd = fs21.openSync(devPath, "r");
   }
   return cachedDevNullReadFd;
 }
@@ -31330,15 +31849,15 @@ function trySpawnShellTruePiped(command, env, cwd, devNullFd, signal) {
 
 // src/dev-servers/manager/shell-spawn/try-spawn-merged-log-file.ts
 import { spawn as spawn7 } from "node:child_process";
-import fs17 from "node:fs";
+import fs22 from "node:fs";
 import { tmpdir } from "node:os";
-import path23 from "node:path";
+import path24 from "node:path";
 function trySpawnMergedLogFile(command, env, cwd, signal) {
-  const tmpRoot = fs17.mkdtempSync(path23.join(tmpdir(), "ba-devsrv-log-"));
-  const logPath = path23.join(tmpRoot, "combined.log");
+  const tmpRoot = fs22.mkdtempSync(path24.join(tmpdir(), "ba-devsrv-log-"));
+  const logPath = path24.join(tmpRoot, "combined.log");
   let logFd;
   try {
-    logFd = fs17.openSync(logPath, "a");
+    logFd = fs22.openSync(logPath, "a");
   } catch {
     rmDirQuiet(tmpRoot);
     return null;
@@ -31357,7 +31876,7 @@ function trySpawnMergedLogFile(command, env, cwd, signal) {
     } else {
       proc = spawn7("/bin/sh", ["-c", command], { env, cwd, stdio, ...signal ? { signal } : {} });
     }
-    fs17.closeSync(logFd);
+    fs22.closeSync(logFd);
     return {
       proc,
       pipedStdoutStderr: true,
@@ -31366,7 +31885,7 @@ function trySpawnMergedLogFile(command, env, cwd, signal) {
     };
   } catch (e) {
     try {
-      fs17.closeSync(logFd);
+      fs22.closeSync(logFd);
     } catch {
     }
     rmDirQuiet(tmpRoot);
@@ -31377,22 +31896,22 @@ function trySpawnMergedLogFile(command, env, cwd, signal) {
 
 // src/dev-servers/manager/shell-spawn/try-spawn-shell-script-log-redirect.ts
 import { spawn as spawn8 } from "node:child_process";
-import fs18 from "node:fs";
+import fs23 from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import path24 from "node:path";
+import path25 from "node:path";
 function shSingleQuote(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
 function trySpawnShellScriptLogRedirectUnix(command, env, cwd, signal) {
-  const tmpRoot = fs18.mkdtempSync(path24.join(tmpdir2(), "ba-devsrv-sh-"));
-  const logPath = path24.join(tmpRoot, "combined.log");
-  const innerPath = path24.join(tmpRoot, "_cmd.sh");
-  const runnerPath = path24.join(tmpRoot, "_run.sh");
+  const tmpRoot = fs23.mkdtempSync(path25.join(tmpdir2(), "ba-devsrv-sh-"));
+  const logPath = path25.join(tmpRoot, "combined.log");
+  const innerPath = path25.join(tmpRoot, "_cmd.sh");
+  const runnerPath = path25.join(tmpRoot, "_run.sh");
   try {
-    fs18.writeFileSync(innerPath, `#!/bin/sh
+    fs23.writeFileSync(innerPath, `#!/bin/sh
 ${command}
 `);
-    fs18.writeFileSync(
+    fs23.writeFileSync(
       runnerPath,
       `#!/bin/sh
 cd ${shSingleQuote(cwd)}
@@ -31418,13 +31937,13 @@ cd ${shSingleQuote(cwd)}
   }
 }
 function trySpawnShellScriptLogRedirectWin(command, env, cwd, signal) {
-  const tmpRoot = fs18.mkdtempSync(path24.join(tmpdir2(), "ba-devsrv-sh-"));
-  const logPath = path24.join(tmpRoot, "combined.log");
-  const runnerPath = path24.join(tmpRoot, "_run.bat");
+  const tmpRoot = fs23.mkdtempSync(path25.join(tmpdir2(), "ba-devsrv-sh-"));
+  const logPath = path25.join(tmpRoot, "combined.log");
+  const runnerPath = path25.join(tmpRoot, "_run.bat");
   const q = (p) => `"${p.replace(/"/g, '""')}"`;
   const com = process.env.ComSpec || "cmd.exe";
   try {
-    fs18.writeFileSync(
+    fs23.writeFileSync(
       runnerPath,
       `@ECHO OFF\r
 CD /D ${q(cwd)}\r
@@ -31534,8 +32053,90 @@ var StreamTail = class {
   }
 };
 
-// src/dev-servers/manager/dev-server-manager.ts
+// src/dev-servers/manager/dev-server-constants.ts
 var BRIDGE_SHUTDOWN_GRACE_MS = 8e3;
+
+// src/dev-servers/manager/dev-server-firehose-messages.ts
+function buildFirehoseSnapshotMessage(params) {
+  const payload = {
+    type: "log_snapshot",
+    serverId: params.serverId,
+    viewerId: params.viewerId,
+    stdoutTail: params.tails.stdout,
+    stderrTail: params.tails.stderr
+  };
+  return params.e2ee ? params.e2ee.encryptFields(payload, ["stdoutTail", "stderrTail"]) : payload;
+}
+function buildFirehoseLogChunkMessage(params) {
+  const payload = {
+    type: "log_chunk",
+    serverId: params.serverId,
+    stream: params.stream,
+    text: params.text
+  };
+  return params.e2ee ? params.e2ee.encryptFields(payload, ["text"]) : payload;
+}
+
+// src/dev-servers/manager/dev-server-firehose-sink.ts
+var DevServerFirehoseSink = class {
+  constructor(options) {
+    this.options = options;
+  }
+  logViewerRefCountByServerId = /* @__PURE__ */ new Map();
+  firehoseSend = null;
+  attach(send) {
+    this.firehoseSend = send;
+  }
+  detach() {
+    this.firehoseSend = null;
+    this.logViewerRefCountByServerId.clear();
+  }
+  openLogViewer(serverId, viewerId) {
+    const next = (this.logViewerRefCountByServerId.get(serverId) ?? 0) + 1;
+    this.logViewerRefCountByServerId.set(serverId, next);
+    this.sendSnapshot(serverId, viewerId);
+  }
+  closeLogViewer(serverId) {
+    const n = (this.logViewerRefCountByServerId.get(serverId) ?? 0) - 1;
+    if (n <= 0) this.logViewerRefCountByServerId.delete(serverId);
+    else this.logViewerRefCountByServerId.set(serverId, n);
+  }
+  pushLogChunk(serverId, stream, chunk) {
+    if ((this.logViewerRefCountByServerId.get(serverId) ?? 0) <= 0) return;
+    if (!this.options.isPipedCaptureEnabled(serverId)) return;
+    if (!this.firehoseSend) return;
+    const text = chunk.toString("utf8");
+    setImmediate(() => {
+      if (!this.firehoseSend) return;
+      this.firehoseSend(buildFirehoseLogChunkMessage({ serverId, stream, text, e2ee: this.options.e2ee }));
+    });
+  }
+  sendSnapshot(serverId, viewerId) {
+    const payload = buildFirehoseSnapshotMessage({
+      serverId,
+      viewerId,
+      tails: this.options.getTails(serverId),
+      e2ee: this.options.e2ee
+    });
+    setImmediate(() => {
+      const send = this.firehoseSend;
+      if (!send) return;
+      send(payload);
+    });
+  }
+};
+
+// src/dev-servers/manager/cleanup-merged-log-dir.ts
+import { rm } from "node:fs/promises";
+function cleanupMergedLogDirForServer(map2, serverId) {
+  const mergedDir = map2.get(serverId);
+  if (!mergedDir) return;
+  map2.delete(serverId);
+  void rm(mergedDir, { recursive: true, force: true }).catch(() => {
+  });
+}
+
+// src/dev-servers/manager/dev-server-manager.ts
 var emptyTails = () => ({ stdout: [], stderr: [] });
 var DevServerManager = class {
   defsById = /* @__PURE__ */ new Map();
@@ -31543,66 +32144,36 @@ var DevServerManager = class {
   streamTailsByServerId = /* @__PURE__ */ new Map();
   spawnGenerationByServerId = /* @__PURE__ */ new Map();
   pipedCaptureByServerId = /* @__PURE__ */ new Map();
-  logViewerRefCountByServerId = /* @__PURE__ */ new Map();
-  firehoseSend = null;
   mergedLogPollByServerId = /* @__PURE__ */ new Map();
   mergedLogCleanupDirByServerId = /* @__PURE__ */ new Map();
   abortControllersByServerId = /* @__PURE__ */ new Map();
   getWs;
   log;
   getBridgeCwd;
+  e2ee;
+  firehoseSink;
   constructor(options) {
     this.getWs = options.getWs;
     this.log = options.log;
     this.getBridgeCwd = options.getBridgeCwd ?? (() => process.cwd());
+    this.e2ee = options.e2ee;
+    this.firehoseSink = new DevServerFirehoseSink({
+      getTails: (serverId) => this.snapshotTails(serverId),
+      isPipedCaptureEnabled: (serverId) => this.pipedCaptureByServerId.get(serverId) === true,
+      e2ee: this.e2ee
+    });
   }
   attachFirehose(send) {
-    this.firehoseSend = send;
+    this.firehoseSink.attach(send);
   }
   detachFirehose() {
-    this.firehoseSend = null;
-    this.logViewerRefCountByServerId.clear();
+    this.firehoseSink.detach();
   }
   handleFirehoseLogViewerOpen(serverId, _viewerId) {
-    const next = (this.logViewerRefCountByServerId.get(serverId) ?? 0) + 1;
-    this.logViewerRefCountByServerId.set(serverId, next);
-    this.sendSnapshotToFirehose(serverId, _viewerId);
+    this.firehoseSink.openLogViewer(serverId, _viewerId);
   }
   handleFirehoseLogViewerClose(serverId, _viewerId) {
-    const n = (this.logViewerRefCountByServerId.get(serverId) ?? 0) - 1;
-    if (n <= 0) this.logViewerRefCountByServerId.delete(serverId);
-    else this.logViewerRefCountByServerId.set(serverId, n);
-  }
-  sendSnapshotToFirehose(serverId, viewerId) {
-    const tails = this.streamTailsByServerId.get(serverId);
-    const payload = {
-      type: "log_snapshot",
-      serverId,
-      viewerId,
-      stdoutTail: tails?.stdout.getTail() ?? [],
-      stderrTail: tails?.stderr.getTail() ?? []
-    };
-    setImmediate(() => {
-      const send = this.firehoseSend;
-      if (!send) return;
-      send(payload);
-    });
-  }
-  pushRemoteLogChunk(serverId, stream, chunk) {
-    if ((this.logViewerRefCountByServerId.get(serverId) ?? 0) <= 0) return;
-    if (!this.pipedCaptureByServerId.get(serverId)) return;
-    const send = this.firehoseSend;
-    if (!send) return;
-    const text = chunk.toString("utf8");
-    setImmediate(() => {
-      if (!this.firehoseSend) return;
-      this.firehoseSend({
-        type: "log_chunk",
-        serverId,
-        stream,
-        text
-      });
-    });
+    this.firehoseSink.closeLogViewer(serverId);
   }
   applyConfig(servers) {
     this.defsById.clear();
@@ -31655,12 +32226,7 @@ var DevServerManager = class {
     }
     this.clearTails(serverId);
     this.pipedCaptureByServerId.delete(serverId);
-    const mergedDir = this.mergedLogCleanupDirByServerId.get(serverId);
-    if (mergedDir) {
-      this.mergedLogCleanupDirByServerId.delete(serverId);
-      void rm(mergedDir, { recursive: true, force: true }).catch(() => {
-      });
-    }
+    cleanupMergedLogDirForServer(this.mergedLogCleanupDirByServerId, serverId);
     this.sendStatus(serverId, "stopped", void 0, tails);
   }
   start(serverId) {
@@ -31743,7 +32309,7 @@ var DevServerManager = class {
         log: this.log,
         stdoutTail,
         stderrTail,
-        pushRemoteLogChunk: (sid, stream, chunk) => this.pushRemoteLogChunk(sid, stream, chunk),
+        pushRemoteLogChunk: (sid, stream, chunk) => this.firehoseSink.pushLogChunk(sid, stream, chunk),
         sendStatus: (status, detail, tails) => this.sendStatus(serverId, status, detail, tails),
         setPollInterval: (iv) => {
           if (iv) this.mergedLogPollByServerId.set(serverId, iv);
@@ -31757,7 +32323,7 @@ var DevServerManager = class {
           this.mergedLogCleanupDirByServerId.delete(serverId);
         },
         rmMergedCleanupDir: (dir) => {
-          void rm(dir, { recursive: true, force: true }).catch(() => {
+          void rm2(dir, { recursive: true, force: true }).catch(() => {
           });
         },
         clearTailBuffers: () => this.clearTails(serverId)
@@ -31794,12 +32360,7 @@ var DevServerManager = class {
     this.processes.delete(serverId);
     this.clearPoll(serverId);
     this.pipedCaptureByServerId.delete(serverId);
-    const mergedDir = this.mergedLogCleanupDirByServerId.get(serverId);
-    if (mergedDir) {
-      this.mergedLogCleanupDirByServerId.delete(serverId);
-      void rm(mergedDir, { recursive: true, force: true }).catch(() => {
-      });
-    }
+    cleanupMergedLogDirForServer(this.mergedLogCleanupDirByServerId, serverId);
     const tails = this.snapshotTails(serverId);
     this.clearTails(serverId);
     this.sendStatus(serverId, "unknown", "Bridge closed before process exited", tails);
@@ -32106,30 +32667,30 @@ function createOnBridgeIdentified(opts) {
 }
 
 // src/skills/discover-local-agent-skills.ts
-import fs19 from "node:fs";
-import path25 from "node:path";
+import fs24 from "node:fs";
+import path26 from "node:path";
 var SKILL_DISCOVERY_ROOTS = [".agents/skills", ".claude/skills", ".cursor/skills", "skills"];
 function discoverLocalSkills(cwd) {
   const out = [];
   const seenKeys = /* @__PURE__ */ new Set();
   for (const rel of SKILL_DISCOVERY_ROOTS) {
-    const base = path25.join(cwd, rel);
-    if (!fs19.existsSync(base) || !fs19.statSync(base).isDirectory()) continue;
+    const base = path26.join(cwd, rel);
+    if (!fs24.existsSync(base) || !fs24.statSync(base).isDirectory()) continue;
     let entries = [];
     try {
-      entries = fs19.readdirSync(base);
+      entries = fs24.readdirSync(base);
     } catch {
       continue;
     }
     for (const name of entries) {
-      const dir = path25.join(base, name);
+      const dir = path26.join(base, name);
       try {
-        if (!fs19.statSync(dir).isDirectory()) continue;
+        if (!fs24.statSync(dir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const skillMd = path25.join(dir, "SKILL.md");
-      if (!fs19.existsSync(skillMd)) continue;
+      const skillMd = path26.join(dir, "SKILL.md");
+      if (!fs24.existsSync(skillMd)) continue;
       const key = `${rel}/${name}`;
       if (seenKeys.has(key)) continue;
       seenKeys.add(key);
@@ -32141,23 +32702,23 @@ function discoverLocalSkills(cwd) {
 function discoverSkillLayoutRoots(cwd) {
   const roots = [];
   for (const rel of SKILL_DISCOVERY_ROOTS) {
-    const base = path25.join(cwd, rel);
-    if (!fs19.existsSync(base) || !fs19.statSync(base).isDirectory()) continue;
+    const base = path26.join(cwd, rel);
+    if (!fs24.existsSync(base) || !fs24.statSync(base).isDirectory()) continue;
     let entries = [];
     try {
-      entries = fs19.readdirSync(base);
+      entries = fs24.readdirSync(base);
     } catch {
       continue;
     }
     const skills2 = [];
     for (const name of entries) {
-      const dir = path25.join(base, name);
+      const dir = path26.join(base, name);
       try {
-        if (!fs19.statSync(dir).isDirectory()) continue;
+        if (!fs24.statSync(dir).isDirectory()) continue;
       } catch {
         continue;
       }
-      if (!fs19.existsSync(path25.join(dir, "SKILL.md"))) continue;
+      if (!fs24.existsSync(path26.join(dir, "SKILL.md"))) continue;
       const relPath = `${rel}/${name}`.replace(/\\/g, "/");
       skills2.push({ name, relPath });
     }
@@ -32259,7 +32820,7 @@ function reportGitRepos(getWs, log2) {
 var handleAuthToken = (msg, { log: log2 }) => {
   if (typeof msg.token !== "string") return;
   log2("Received auth token. Save it for future runs:");
-  log2(`  export BUILDAMATON_AUTH_TOKEN="${msg.token}"`);
+  log2(`  export BUILDAUTOMATON_AUTH_TOKEN="${msg.token}"`);
 };
 
 // src/bridge/routing/handlers/bridge-identified.ts
@@ -32302,12 +32863,12 @@ var handleAgentConfigMessage = (msg, deps) => {
 };
 
 // src/agents/acp/from-bridge/handle-bridge-prompt.ts
-import * as path27 from "node:path";
-import { execFile as execFile5 } from "node:child_process";
-import { promisify as promisify5 } from "node:util";
+import * as path28 from "node:path";
+import { execFile as execFile10 } from "node:child_process";
+import { promisify as promisify10 } from "node:util";
 
 // src/git/bridge-queue-key.ts
-import * as path26 from "node:path";
+import * as path27 from "node:path";
 import { createHash } from "node:crypto";
 function normalizeCanonicalGitUrl(url2) {
   let s = url2.trim();
@@ -32335,11 +32896,11 @@ function canonicalUrlToRepoIdSync(url2) {
   return createHash("sha256").update(normalized).digest("hex").slice(0, 32);
 }
 function fallbackRepoIdFromPath(absPath) {
-  return createHash("sha256").update(path26.resolve(absPath)).digest("hex").slice(0, 32);
+  return createHash("sha256").update(path27.resolve(absPath)).digest("hex").slice(0, 32);
 }
 async function resolveBridgeQueueBindFields(options) {
   const { effectiveCwd, worktreePaths, primaryRepoRoots, log: log2 } = options;
-  const cwdAbs = worktreePaths.length > 0 ? path26.resolve(worktreePaths[0]) : path26.resolve(effectiveCwd);
+  const cwdAbs = worktreePaths.length > 0 ? path27.resolve(worktreePaths[0]) : path27.resolve(effectiveCwd);
   if (!primaryRepoRoots.length) {
     log2("[Bridge service] Prompt queue bind skipped: no Git repository roots under the working directory.");
     return null;
@@ -32362,10 +32923,10 @@ async function resolveBridgeQueueBindFields(options) {
 }
 
 // src/agents/acp/from-bridge/handle-bridge-prompt.ts
-var execFileAsync5 = promisify5(execFile5);
+var execFileAsync9 = promisify10(execFile10);
 async function readGitBranch(cwd) {
   try {
-    const { stdout } = await execFileAsync5("git", ["branch", "--show-current"], { cwd, maxBuffer: 64 * 1024 });
+    const { stdout } = await execFileAsync9("git", ["branch", "--show-current"], { cwd, maxBuffer: 64 * 1024 });
     const b = stdout.trim();
     return b || null;
   } catch {
@@ -32376,22 +32937,40 @@ function handleBridgePrompt(msg, deps) {
   const { getWs, log: log2, acpManager, sessionWorktreeManager } = deps;
   const rawPrompt = msg.prompt;
   const promptText = typeof rawPrompt === "string" ? rawPrompt : rawPrompt != null ? String(rawPrompt) : "";
+  const sessionId = msg.sessionId;
+  const runId = typeof msg.runId === "string" ? msg.runId : void 0;
+  const promptId = typeof msg.id === "string" ? msg.id : void 0;
+  const sendBridgeMessage = (message, encryptedFields = []) => {
+    const s = getWs();
+    if (!s) return false;
+    const wire = deps.e2ee && encryptedFields.length > 0 ? deps.e2ee.encryptFields(message, encryptedFields) : message;
+    sendWsMessage(s, wire);
+    return true;
+  };
   if (!promptText.trim()) {
     log2(
       `[Bridge service] Prompt ignored: empty or missing prompt text (session ${typeof msg.sessionId === "string" ? msg.sessionId.slice(0, 8) : "\u2014"}\u2026, run ${typeof msg.runId === "string" ? msg.runId.slice(0, 8) : "\u2014"}\u2026).`
     );
+    sendBridgeMessage(
+      {
+        type: "prompt_result",
+        ...promptId ? { id: promptId } : {},
+        ...sessionId ? { sessionId } : {},
+        ...runId ? { runId } : {},
+        success: false,
+        error: "Empty or missing prompt text from the bridge; this turn was not sent to the agent."
+      },
+      ["error"]
+    );
     return;
   }
-  const sessionId = msg.sessionId;
   const isNewSession = msg.isNewSession === true;
   const sessionWorktreesEnabled = msg.sessionWorktreesEnabled === true;
   const agentType = typeof msg.agentType === "string" && msg.agentType.trim() ? msg.agentType.trim() : void 0;
-  const runId = typeof msg.runId === "string" ? msg.runId : void 0;
   const mode = typeof msg.mode === "string" && msg.mode.trim() ? msg.mode.trim() : void 0;
   acpManager.logPromptReceivedFromBridge({ agentType, mode });
   const sendResult2 = (result) => {
-    const s = getWs();
-    if (s) sendWsMessage(s, result);
+    sendBridgeMessage(result, result.type === "prompt_result" ? ["output", "error"] : []);
   };
   const sendSessionUpdate = (payload) => {
     const s = getWs();
@@ -32400,11 +32979,19 @@ function handleBridgePrompt(msg, deps) {
       return;
     }
     const p = payload;
-    sendWsMessage(s, payload);
+    const wire = p.type === "session_update" && deps.e2ee ? deps.e2ee.encryptFields(payload, ["payload"]) : p.type === "session_file_change" && deps.e2ee ? deps.e2ee.encryptFields(payload, [
+      "path",
+      "oldText",
+      "newText",
+      "patchContent",
+      "isDirectory",
+      "directoryRemoved"
+    ]) : payload;
+    sendWsMessage(s, wire);
   };
   async function preambleAndPrompt(resolvedCwd) {
     const s = getWs();
-    const effectiveCwd = path27.resolve(resolvedCwd ?? getBridgeWorkspaceDirectory());
+    const effectiveCwd = path28.resolve(resolvedCwd ?? getBridgeWorkspaceDirectory());
     const worktreePaths = sessionWorktreeManager.getWorktreePathsForSession(sessionId) ?? [];
     const repoRoots = await resolveSnapshotRepoRoots({
       worktreePaths,
@@ -32529,15 +33116,15 @@ var handleSkillCallMessage = (msg, { getWs, log: log2 }) => {
 };
 
 // src/files/list-dir.ts
-import fs20 from "node:fs";
-import path29 from "node:path";
+import fs25 from "node:fs";
+import path30 from "node:path";
 
 // src/files/ensure-under-cwd.ts
-import path28 from "node:path";
+import path29 from "node:path";
 function ensureUnderCwd(relativePath, cwd = getBridgeWorkspaceDirectory()) {
-  const normalized = path28.normalize(relativePath).replace(/^(\.\/)+/, "");
-  const resolved = path28.resolve(cwd, normalized);
-  if (!resolved.startsWith(cwd + path28.sep) && resolved !== cwd) {
+  const normalized = path29.normalize(relativePath).replace(/^(\.\/)+/, "");
+  const resolved = path29.resolve(cwd, normalized);
+  if (!resolved.startsWith(cwd + path29.sep) && resolved !== cwd) {
     return null;
   }
   return resolved;
@@ -32551,7 +33138,7 @@ async function listDirAsync(relativePath) {
     return { error: "Path is outside working directory" };
   }
   try {
-    const names = await fs20.promises.readdir(resolved, { withFileTypes: true });
+    const names = await fs25.promises.readdir(resolved, { withFileTypes: true });
     const visible = names.filter((d) => !d.name.startsWith("."));
     const entries = [];
     for (let i = 0; i < visible.length; i++) {
@@ -32559,12 +33146,12 @@ async function listDirAsync(relativePath) {
         await yieldToEventLoop();
       }
       const d = visible[i];
-      const entryPath = path29.join(relativePath || ".", d.name).replace(/\\/g, "/");
-      const fullPath = path29.join(resolved, d.name);
+      const entryPath = path30.join(relativePath || ".", d.name).replace(/\\/g, "/");
+      const fullPath = path30.join(resolved, d.name);
       let isDir = d.isDirectory();
       if (d.isSymbolicLink()) {
         try {
-          const targetStat = await fs20.promises.stat(fullPath);
+          const targetStat = await fs25.promises.stat(fullPath);
           isDir = targetStat.isDirectory();
         } catch {
           isDir = false;
@@ -32589,25 +33176,25 @@ async function listDirAsync(relativePath) {
 }
 
 // src/files/read-file.ts
-import fs21 from "node:fs";
+import fs26 from "node:fs";
 import { StringDecoder } from "node:string_decoder";
 function resolveFilePath(relativePath) {
   const resolved = ensureUnderCwd(relativePath, getBridgeWorkspaceDirectory());
   if (!resolved) return { error: "Path is outside working directory" };
   let real;
   try {
-    real = fs21.realpathSync(resolved);
+    real = fs26.realpathSync(resolved);
   } catch {
     real = resolved;
   }
-  const stat2 = fs21.statSync(real);
+  const stat2 = fs26.statSync(real);
   if (!stat2.isFile()) return { error: "Not a file" };
   return real;
 }
 var LINE_CHUNK_SIZE = 64 * 1024;
 function readFileRange(filePath, startLine, endLine, lineOffsetIn, lineChunkSize = LINE_CHUNK_SIZE) {
-  const fileSize = fs21.statSync(filePath).size;
-  const fd = fs21.openSync(filePath, "r");
+  const fileSize = fs26.statSync(filePath).size;
+  const fd = fs26.openSync(filePath, "r");
   const bufSize = 64 * 1024;
   const buf = Buffer.alloc(bufSize);
   const decoder = new StringDecoder("utf8");
@@ -32620,7 +33207,7 @@ function readFileRange(filePath, startLine, endLine, lineOffsetIn, lineChunkSize
   let line0Accum = "";
   try {
     let bytesRead;
-    while (!done && (bytesRead = fs21.readSync(fd, buf, 0, bufSize, null)) > 0) {
+    while (!done && (bytesRead = fs26.readSync(fd, buf, 0, bufSize, null)) > 0) {
       const text = partial2 + decoder.write(buf.subarray(0, bytesRead));
       partial2 = "";
       let lineStart = 0;
@@ -32755,7 +33342,7 @@ function readFileRange(filePath, startLine, endLine, lineOffsetIn, lineChunkSize
     }
     return { content: resultLines.join("\n"), size: fileSize };
   } finally {
-    fs21.closeSync(fd);
+    fs26.closeSync(fd);
   }
 }
 function readFile2(relativePath, startLine, endLine, lineOffset, lineChunkSize = LINE_CHUNK_SIZE) {
@@ -32766,8 +33353,8 @@ function readFile2(relativePath, startLine, endLine, lineOffset, lineChunkSize =
     if (hasRange) {
       return readFileRange(result, startLine, endLine, lineOffset, lineChunkSize);
     }
-    const stat2 = fs21.statSync(result);
-    const raw = fs21.readFileSync(result, "utf8");
+    const stat2 = fs26.statSync(result);
+    const raw = fs26.readFileSync(result, "utf8");
     const lines = raw.split(/\r?\n/);
     return { content: raw, totalLines: lines.length, size: stat2.size };
   } catch (err) {
@@ -32781,28 +33368,30 @@ async function readFileAsync(relativePath, startLine, endLine, lineOffset, lineC
 
 // src/files/handle-file-browser-search.ts
 var SEARCH_LIMIT = 100;
-function handleFileBrowserSearch(msg, socket) {
+function handleFileBrowserSearch(msg, socket, e2ee) {
   void (async () => {
     await yieldToEventLoop();
     const q = typeof msg.q === "string" ? msg.q : "";
     const cwd = getBridgeWorkspaceDirectory();
     const index = loadFileIndex(cwd);
     if (index === null) {
-      sendWsMessage(socket, {
+      const payload2 = {
         type: "file_browser_search_response",
         id: msg.id,
         paths: [],
         indexReady: false
-      });
+      };
+      sendWsMessage(socket, e2ee ? e2ee.encryptFields(payload2, ["paths"]) : payload2);
       return;
     }
     const results = await searchFileIndexAsync(index, q, SEARCH_LIMIT);
-    sendWsMessage(socket, {
+    const payload = {
       type: "file_browser_search_response",
       id: msg.id,
       paths: results,
       indexReady: true
-    });
+    };
+    sendWsMessage(socket, e2ee ? e2ee.encryptFields(payload, ["paths"]) : payload);
   })();
 }
 function triggerFileIndexBuild() {
@@ -32814,7 +33403,10 @@ function triggerFileIndexBuild() {
 }
 
 // src/files/handle-file-browser-request.ts
-function handleFileBrowserRequest(msg, socket) {
+function sendFileBrowserMessage(socket, e2ee, payload) {
+  sendWsMessage(socket, e2ee ? e2ee.encryptFields(payload, ["entries", "content", "totalLines", "size", "lineOffset"]) : payload);
+}
+function handleFileBrowserRequest(msg, socket, e2ee) {
   void (async () => {
     const reqPath = msg.path.replace(/^\/+/, "") || ".";
     const op = msg.op === "read" ? "read" : "list";
@@ -32823,7 +33415,7 @@ function handleFileBrowserRequest(msg, socket) {
       if ("error" in result) {
         sendWsMessage(socket, { type: "file_browser_response", id: msg.id, error: result.error });
       } else {
-        sendWsMessage(socket, { type: "file_browser_response", id: msg.id, entries: result.entries });
+        sendFileBrowserMessage(socket, e2ee, { type: "file_browser_response", id: msg.id, entries: result.entries });
         if (reqPath === "." || reqPath === "") {
           triggerFileIndexBuild();
         }
@@ -32845,27 +33437,28 @@ function handleFileBrowserRequest(msg, socket) {
           size: result.size
         };
         if (result.lineOffset != null) payload.lineOffset = result.lineOffset;
-        sendWsMessage(socket, payload);
+        sendFileBrowserMessage(socket, e2ee, payload);
       }
     }
   })();
 }
 
 // src/bridge/routing/handlers/file-browser-messages.ts
-function handleFileBrowserRequestMessage(msg, { getWs }) {
+function handleFileBrowserRequestMessage(msg, { getWs, e2ee }) {
   if (typeof msg.id !== "string" || typeof msg.path !== "string") return;
   const socket = getWs();
   if (!socket) return;
   handleFileBrowserRequest(
     msg,
-    socket
+    socket,
+    e2ee
   );
 }
-function handleFileBrowserSearchMessage(msg, { getWs }) {
+function handleFileBrowserSearchMessage(msg, { getWs, e2ee }) {
   if (typeof msg.id !== "string") return;
   const socket = getWs();
   if (!socket) return;
-  handleFileBrowserSearch(msg, socket);
+  handleFileBrowserSearch(msg, socket, e2ee);
 }
 
 // src/bridge/routing/handlers/skill-layout-request.ts
@@ -32877,8 +33470,8 @@ function handleSkillLayoutRequest(msg, deps) {
 }
 
 // src/skills/install-remote-skills.ts
-import fs22 from "node:fs";
-import path30 from "node:path";
+import fs27 from "node:fs";
+import path31 from "node:path";
 function installRemoteSkills(cwd, targetDir, items) {
   const installed2 = [];
   if (!Array.isArray(items)) {
@@ -32889,15 +33482,15 @@ function installRemoteSkills(cwd, targetDir, items) {
       if (typeof item.sourceId !== "string" || typeof item.skillName !== "string" || typeof item.versionHash !== "string" || !Array.isArray(item.files)) {
         continue;
       }
-      const skillDir = path30.join(cwd, targetDir, item.skillName);
+      const skillDir = path31.join(cwd, targetDir, item.skillName);
       for (const f of item.files) {
         if (typeof f.path !== "string" || !f.text && !f.base64) continue;
-        const dest = path30.join(skillDir, f.path);
-        fs22.mkdirSync(path30.dirname(dest), { recursive: true });
+        const dest = path31.join(skillDir, f.path);
+        fs27.mkdirSync(path31.dirname(dest), { recursive: true });
         if (f.text !== void 0) {
-          fs22.writeFileSync(dest, f.text, "utf8");
+          fs27.writeFileSync(dest, f.text, "utf8");
         } else if (f.base64) {
-          fs22.writeFileSync(dest, Buffer.from(f.base64, "base64"));
+          fs27.writeFileSync(dest, Buffer.from(f.base64, "base64"));
         }
       }
       installed2.push({
@@ -32935,9 +33528,10 @@ var handleRefreshLocalSkills = (_msg, deps) => {
 };
 
 // src/bridge/routing/handlers/session-git-request.ts
-function sendResult(ws, id, payload) {
+function sendResult(ws, id, payload, e2ee, encryptedFields = []) {
   if (!ws) return;
-  sendWsMessage(ws, { type: "session_git_result", id, ...payload });
+  const message = { type: "session_git_result", id, ...payload };
+  sendWsMessage(ws, e2ee && encryptedFields.length > 0 ? e2ee.encryptFields(message, encryptedFields) : message);
 }
 var handleSessionGitRequestMessage = (msg, deps) => {
   if (typeof msg.id !== "string") return;
@@ -32947,7 +33541,7 @@ var handleSessionGitRequestMessage = (msg, deps) => {
     return;
   void (async () => {
     const ws = deps.getWs();
-    const reply = (payload) => sendResult(ws, msg.id, payload);
+    const reply = (payload, encryptedFields = []) => sendResult(ws, msg.id, payload, deps.e2ee, encryptedFields);
     try {
       if (action === "status") {
         const r = await deps.sessionWorktreeManager.getSessionWorkingTreeStatus(sessionId);
@@ -32973,7 +33567,7 @@ var handleSessionGitRequestMessage = (msg, deps) => {
         reply({
           ok: true,
           repos
-        });
+        }, ["repos"]);
         return;
       }
       if (action === "push") {
@@ -33042,7 +33636,7 @@ var handleSessionDiscardedMessage = (msg, deps) => {
 };
 
 // src/bridge/routing/handlers/revert-turn-snapshot.ts
-import * as fs23 from "node:fs";
+import * as fs28 from "node:fs";
 var handleRevertTurnSnapshotMessage = (msg, deps) => {
   const id = typeof msg.id === "string" ? msg.id : "";
   const sessionId = typeof msg.sessionId === "string" ? msg.sessionId : "";
@@ -33054,7 +33648,7 @@ var handleRevertTurnSnapshotMessage = (msg, deps) => {
     if (!s) return;
     const agentBase = sessionWorktreeManager.getAgentCwdForSession(sessionId) ?? getBridgeWorkspaceDirectory();
     const file2 = snapshotFilePath(agentBase, turnId);
-    if (!fs23.existsSync(file2)) {
+    if (!fs28.existsSync(file2)) {
       sendWsMessage(s, {
         type: "revert_turn_snapshot_result",
         id,
@@ -33075,8 +33669,15 @@ var handleRevertTurnSnapshotMessage = (msg, deps) => {
 
 // src/bridge/routing/handlers/dev-server-control.ts
 var handleDevServerControl = (msg, deps) => {
-  const serverId = typeof msg.serverId === "string" ? msg.serverId : "";
-  const action = msg.action === "start" || msg.action === "stop" ? msg.action : null;
+  let wire = msg;
+  try {
+    wire = deps.e2ee ? deps.e2ee.decryptMessage(msg) : msg;
+  } catch (e) {
+    deps.log(`[E2EE] Could not decrypt dev server command: ${e instanceof Error ? e.message : String(e)}`);
+    return;
+  }
+  const serverId = typeof wire.serverId === "string" ? wire.serverId : "";
+  const action = wire.action === "start" || wire.action === "stop" ? wire.action : null;
   if (!serverId || !action) return;
   deps.devServerManager?.handleControl(serverId, action);
 };
@@ -33202,7 +33803,8 @@ function createMainBridgeWebSocketLifecycle(params) {
     messageDeps,
     tokens,
     persistTokens,
-    onAuthInvalid
+    onAuthInvalid,
+    e2ee
   } = params;
   let authRefreshInFlight = false;
   function handleOpen() {
@@ -33215,15 +33817,15 @@ function createMainBridgeWebSocketLifecycle(params) {
     }
     const socket = getWs();
     if (socket) {
-      sendWsMessage(socket, { type: "identify", role: "cli" });
+      sendWsMessage(socket, { type: "identify", role: "cli", ...e2ee ? { e: e2ee.handshake } : {} });
       reportGitRepos(getWs, logFn);
     }
     if (justAuthenticated && socket) {
       logFn(
         "Save these for future runs (access token may rotate; refresh token is stored in ~/.buildautomaton/config.json when you use browser auth):"
       );
-      logFn(`  export BUILDAMATON_AUTH_TOKEN="${tokens.accessToken}"`);
-      logFn(`  export BUILDAMATON_WORKSPACE_ID="${workspaceId}"`);
+      logFn(`  export BUILDAUTOMATON_AUTH_TOKEN="${tokens.accessToken}"`);
+      logFn(`  export BUILDAUTOMATON_WORKSPACE_ID="${workspaceId}"`);
     }
   }
   function handleClose(code, reason) {
@@ -33305,6 +33907,100 @@ function createMainBridgeWebSocketLifecycle(params) {
   return { connect };
 }
 
+// ../e2ee/src/constants.ts
+var E2EE_NONCE_BYTES = 12;
+
+// ../e2ee/src/types.ts
+function isE2eeEnvelope(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const o = value;
+  return typeof o.k === "string" && typeof o.n === "string" && typeof o.c === "string";
+}
+
+// ../e2ee/src/encoding.ts
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 1) binary += String.fromCharCode(bytes[i]);
+  const b64 = btoa(binary);
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64UrlDecode(value) {
+  const b64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  const binary = atob(padded);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);
+  return out;
+}
+
+// src/lib/e2ee/cli-e2ee-runtime.ts
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+function nonceFromCounter(prefix, counter) {
+  const nonce = Buffer.alloc(E2EE_NONCE_BYTES);
+  prefix.copy(nonce, 0);
+  nonce.writeBigUInt64BE(counter, 4);
+  return nonce;
+}
+function createCliE2eeRuntime(key) {
+  const rawKey = Buffer.from(base64UrlDecode(key.k));
+  const prefix = randomBytes(4);
+  let counter = 0n;
+  function nextNonce() {
+    counter += 1n;
+    return nonceFromCounter(prefix, counter);
+  }
+  function encryptObject(messageWithoutSensitiveFields, plaintext) {
+    const nonce = nextNonce();
+    const cipher = createCipheriv("aes-256-gcm", rawKey, nonce);
+    const ciphertext = Buffer.concat([cipher.update(JSON.stringify(plaintext), "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+      k: key.id,
+      n: base64UrlEncode(nonce),
+      c: base64UrlEncode(Buffer.concat([ciphertext, tag]))
+    };
+  }
+  return {
+    keyId: key.id,
+    handshake: { k: key.id, a: key.a },
+    encryptFields(message, fields) {
+      const plaintext = {};
+      const stripped = { ...message };
+      let hasPlaintext = false;
+      for (const field of fields) {
+        if (Object.prototype.hasOwnProperty.call(stripped, field) && stripped[field] !== void 0) {
+          plaintext[field] = stripped[field];
+          delete stripped[field];
+          hasPlaintext = true;
+        }
+      }
+      if (!hasPlaintext) return message;
+      stripped.ee = encryptObject(stripped, plaintext);
+      return stripped;
+    },
+    decryptMessage(message) {
+      const envelope = message.ee;
+      if (!isE2eeEnvelope(envelope)) return message;
+      if (envelope.k !== key.id) throw new Error(`E2EE key mismatch: ${envelope.k}`);
+      const sealed = Buffer.from(base64UrlDecode(envelope.c));
+      if (sealed.length < 16) throw new Error("Invalid E2EE payload.");
+      const ciphertext = sealed.subarray(0, sealed.length - 16);
+      const tag = sealed.subarray(sealed.length - 16);
+      const nonce = Buffer.from(base64UrlDecode(envelope.n));
+      const decipher = createDecipheriv("aes-256-gcm", rawKey, nonce);
+      decipher.setAuthTag(tag);
+      const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+      const parsed = JSON.parse(decrypted);
+      if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("E2EE payload did not decode to an object.");
+      }
+      const merged = { ...message, ...parsed };
+      delete merged.ee;
+      return merged;
+    }
+  };
+}
+
 // src/bridge/connection/create-bridge-connection.ts
 async function createBridgeConnection(options) {
   const { apiUrl, workspaceId, justAuthenticated, onAuthInvalid, persistTokens } = options;
@@ -33338,7 +34034,8 @@ async function createBridgeConnection(options) {
   function getWs() {
     return state.currentWs;
   }
-  const devServerManager = new DevServerManager({ getWs, log: logFn, getBridgeCwd: getBridgeWorkspaceDirectory });
+  const e2ee = options.e2eCertificate ? createCliE2eeRuntime(options.e2eCertificate) : void 0;
+  const devServerManager = new DevServerManager({ getWs, log: logFn, getBridgeCwd: getBridgeWorkspaceDirectory, e2ee });
   const onBridgeIdentified = createOnBridgeIdentified({
     sessionWorktreeManager,
     devServerManager,
@@ -33357,7 +34054,8 @@ async function createBridgeConnection(options) {
     onBridgeIdentified,
     sendLocalSkillsReport,
     reportAutoDetectedAgents,
-    devServerManager
+    devServerManager,
+    e2ee
   };
   const { connect } = createMainBridgeWebSocketLifecycle({
     state,
@@ -33369,7 +34067,8 @@ async function createBridgeConnection(options) {
     messageDeps,
     tokens,
     persistTokens,
-    onAuthInvalid
+    onAuthInvalid,
+    e2ee
   });
   connect();
   const stopFileIndexWatcher = startFileIndexWatcher(getBridgeWorkspaceDirectory());
@@ -33381,56 +34080,72 @@ async function createBridgeConnection(options) {
   };
 }
 
-// src/run-bridge.ts
-async function runBridge(options) {
-  installBridgeProcessResilience();
-  const { apiUrl, workspaceId, authToken, refreshToken, bridgeName, justAuthenticated, worktreesRootAbs } = options;
-  const firehoseServerUrl = options.firehoseServerUrl ?? options.proxyServerUrl;
-  const hasAuth = workspaceId && authToken;
-  if (!hasAuth) {
-    const handle2 = runPendingAuth({
-      apiUrl,
-      initialWorkspaceId: workspaceId,
-      preferredBridgeName: bridgeName,
-      log,
-      onAuth: (_auth) => {
-      }
-    });
-    const onSignal2 = (kind) => {
-      logImmediate(
-        kind === "interrupt" ? "Keyboard interrupt (Ctrl+C) \u2014 stopping\u2026" : "Stop requested \u2014 shutting down\u2026"
-      );
-      setImmediate(() => {
-        handle2.close();
-        process.exit(0);
-      });
+// src/e2e-certificates/key-command.ts
+import * as readline3 from "node:readline";
+function installE2eCertificateKeyCommand({
+  log: log2,
+  onOpenCertificate,
+  onInterrupt
+}) {
+  if (!process.stdin.isTTY || typeof process.stdin.setRawMode !== "function") {
+    log2("[E2EE] Press c to import the E2EE key in a browser when running in an interactive terminal.");
+    return () => {
     };
-    const onSigInt2 = () => onSignal2("interrupt");
-    const onSigTerm2 = () => onSignal2("stop");
-    process.on("SIGINT", onSigInt2);
-    process.on("SIGTERM", onSigTerm2);
-    const auth = await handle2.authPromise;
-    process.off("SIGINT", onSigInt2);
-    process.off("SIGTERM", onSigTerm2);
-    handle2.close();
-    if (!auth) return;
-    writeConfigForApi(apiUrl, {
-      workspaceId: auth.workspaceId,
-      token: auth.token,
-      refreshToken: auth.refreshToken
-    });
-    await runBridge({
-      apiUrl,
-      workspaceId: auth.workspaceId,
-      authToken: auth.token,
-      refreshToken: auth.refreshToken,
-      firehoseServerUrl,
-      bridgeName,
-      justAuthenticated: true,
-      worktreesRootAbs
-    });
-    return;
   }
+  readline3.emitKeypressEvents(process.stdin);
+  process.stdin.setRawMode(true);
+  process.stdin.resume();
+  const onKeypress = (str, key) => {
+    if (key?.ctrl && key.name === "c") {
+      onInterrupt();
+      return;
+    }
+    if (!key?.ctrl && !key?.meta && (key?.name === "c" || str === "c")) {
+      onOpenCertificate();
+    }
+  };
+  process.stdin.on("keypress", onKeypress);
+  log2("[E2EE] Press c to import the active E2EE key into the browser.");
+  return () => {
+    process.stdin.off("keypress", onKeypress);
+    if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {
+      process.stdin.setRawMode(false);
+    }
+  };
+}
+
+// src/e2e-certificates/open-import-url.ts
+async function openE2eCertificateImportUrl({
+  apiUrl,
+  workspaceId,
+  certificate,
+  log: log2
+}) {
+  const appUrl = appUrlForApiUrl(apiUrl);
+  const payload = encodeURIComponent(certificate.pemBundle);
+  const url2 = `${appUrl.replace(/\/$/, "")}/w/${encodeURIComponent(workspaceId)}/settings/e2e-encryption?certificate=${payload}`;
+  log2(`[E2EE] Opening browser to import key "${certificate.name}" (${certificate.id})...`);
+  try {
+    await open_default(url2, { wait: false });
+  } catch {
+    log2("[E2EE] Could not open browser. Open this URL manually:");
+    log2(url2);
+  }
+}
+
+// src/run-bridge-connected.ts
+async function runConnectedBridge(options, restartWithoutAuth) {
+  const {
+    apiUrl,
+    workspaceId,
+    authToken,
+    refreshToken,
+    justAuthenticated,
+    worktreesRootAbs,
+    e2eCertificate
+  } = options;
+  const firehoseServerUrl = options.firehoseServerUrl ?? options.proxyServerUrl;
+  let cleanupKeyCommand;
   const handle = await createBridgeConnection({
     apiUrl,
     workspaceId,
@@ -33439,6 +34154,7 @@ async function runBridge(options) {
     firehoseServerUrl,
     justAuthenticated,
     worktreesRootAbs,
+    e2eCertificate,
     log,
     persistTokens: (t) => {
       writeConfigForApi(apiUrl, {
@@ -33448,14 +34164,16 @@ async function runBridge(options) {
       });
     },
     onAuthInvalid: () => {
+      cleanupKeyCommand?.();
       log("[Bridge service] Access token invalid or revoked; re-authenticating\u2026");
       clearConfigForApi(apiUrl);
       void handle.close().then(() => {
-        void runBridge({ apiUrl, firehoseServerUrl, worktreesRootAbs });
+        void restartWithoutAuth({ apiUrl, firehoseServerUrl, worktreesRootAbs, e2eCertificate });
       });
     }
   });
   const onSignal = (kind) => {
+    cleanupKeyCommand?.();
     logImmediate(
       kind === "interrupt" ? "Keyboard interrupt (Ctrl+C) \u2014 stopping\u2026" : "Stop requested \u2014 shutting down\u2026"
     );
@@ -33469,6 +34187,86 @@ async function runBridge(options) {
   const onSigTerm = () => onSignal("stop");
   process.on("SIGINT", onSigInt);
   process.on("SIGTERM", onSigTerm);
+  if (e2eCertificate) {
+    let openingCertificate = false;
+    cleanupKeyCommand = installE2eCertificateKeyCommand({
+      log,
+      onInterrupt: onSigInt,
+      onOpenCertificate: () => {
+        if (openingCertificate) return;
+        openingCertificate = true;
+        void openE2eCertificateImportUrl({
+          apiUrl,
+          workspaceId,
+          certificate: e2eCertificate,
+          log
+        }).finally(() => {
+          openingCertificate = false;
+        });
+      }
+    });
+  }
+}
+
+// src/run-bridge.ts
+async function runBridge(options) {
+  installBridgeProcessResilience();
+  const {
+    apiUrl,
+    workspaceId,
+    authToken,
+    bridgeName,
+    worktreesRootAbs,
+    e2eCertificate
+  } = options;
+  const firehoseServerUrl = options.firehoseServerUrl ?? options.proxyServerUrl;
+  const hasAuth = workspaceId && authToken;
+  if (!hasAuth) {
+    const handle = runPendingAuth({
+      apiUrl,
+      initialWorkspaceId: workspaceId,
+      preferredBridgeName: bridgeName,
+      log,
+      onAuth: (_auth) => {
+      }
+    });
+    const onSignal = (kind) => {
+      logImmediate(
+        kind === "interrupt" ? "Keyboard interrupt (Ctrl+C) \u2014 stopping\u2026" : "Stop requested \u2014 shutting down\u2026"
+      );
+      setImmediate(() => {
+        handle.close();
+        process.exit(0);
+      });
+    };
+    const onSigInt = () => onSignal("interrupt");
+    const onSigTerm = () => onSignal("stop");
+    process.on("SIGINT", onSigInt);
+    process.on("SIGTERM", onSigTerm);
+    const auth = await handle.authPromise;
+    process.off("SIGINT", onSigInt);
+    process.off("SIGTERM", onSigTerm);
+    handle.close();
+    if (!auth) return;
+    writeConfigForApi(apiUrl, {
+      workspaceId: auth.workspaceId,
+      token: auth.token,
+      refreshToken: auth.refreshToken
+    });
+    await runBridge({
+      apiUrl,
+      workspaceId: auth.workspaceId,
+      authToken: auth.token,
+      refreshToken: auth.refreshToken,
+      firehoseServerUrl,
+      bridgeName,
+      justAuthenticated: true,
+      worktreesRootAbs,
+      e2eCertificate
+    });
+    return;
+  }
+  await runConnectedBridge(options, runBridge);
 }
 export {
   callSkill,