@buildautomaton/cli 0.1.15 → 0.1.16

package/dist/cli.js

@@ -973,8 +973,8 @@ var require_command = __commonJS({
   "../../node_modules/.pnpm/commander@12.1.0/node_modules/commander/lib/command.js"(exports) {
     var EventEmitter2 = __require("node:events").EventEmitter;
     var childProcess2 = __require("node:child_process");
-    var path33 = __require("node:path");
-    var fs30 = __require("node:fs");
+    var path34 = __require("node:path");
+    var fs31 = __require("node:fs");
     var process8 = __require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1906,11 +1906,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path33.resolve(baseDir, baseName);
-          if (fs30.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path33.extname(baseName))) return void 0;
+          const localBin = path34.resolve(baseDir, baseName);
+          if (fs31.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path34.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs30.existsSync(`${localBin}${ext}`)
+            (ext) => fs31.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1922,21 +1922,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs30.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs31.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path33.resolve(
-            path33.dirname(resolvedScriptPath),
+          executableDir = path34.resolve(
+            path34.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path33.basename(
+            const legacyName = path34.basename(
               this._scriptPath,
-              path33.extname(this._scriptPath)
+              path34.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -1947,7 +1947,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path33.extname(executableFile));
+        launchWithNode = sourceExt.includes(path34.extname(executableFile));
         let proc;
         if (process8.platform !== "win32") {
           if (launchWithNode) {
@@ -2787,7 +2787,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path33.basename(filename, path33.extname(filename));
+        this._name = path34.basename(filename, path34.extname(filename));
         return this;
       }
       /**
@@ -2801,9 +2801,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path34) {
-        if (path34 === void 0) return this._executableDir;
-        this._executableDir = path34;
+      executableDir(path35) {
+        if (path35 === void 0) return this._executableDir;
+        this._executableDir = path35;
         return this;
       }
       /**
@@ -5236,7 +5236,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes, createHash: createHash2 } = __require("crypto");
+    var { randomBytes: randomBytes3, createHash: createHash3 } = __require("crypto");
     var { Duplex, Readable: Readable2 } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -5766,7 +5766,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes(16).toString("base64");
+      const key = randomBytes3(16).toString("base64");
       const request = isSecure ? https2.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -5896,7 +5896,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -6263,7 +6263,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter2 = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash2 } = __require("crypto");
+    var { createHash: createHash3 } = __require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -6564,7 +6564,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -7423,15 +7423,15 @@ var require_src2 = __commonJS({
     var fs_1 = __require("fs");
     var debug_1 = __importDefault(require_src());
     var log2 = debug_1.default("@kwsites/file-exists");
-    function check2(path33, isFile, isDirectory) {
-      log2(`checking %s`, path33);
+    function check2(path34, isFile, isDirectory) {
+      log2(`checking %s`, path34);
       try {
-        const stat2 = fs_1.statSync(path33);
-        if (stat2.isFile() && isFile) {
+        const stat3 = fs_1.statSync(path34);
+        if (stat3.isFile() && isFile) {
           log2(`[OK] path represents a file`);
           return true;
         }
-        if (stat2.isDirectory() && isDirectory) {
+        if (stat3.isDirectory() && isDirectory) {
           log2(`[OK] path represents a directory`);
           return true;
         }
@@ -7446,8 +7446,8 @@ var require_src2 = __commonJS({
         throw e;
       }
     }
-    function exists2(path33, type = exports.READABLE) {
-      return check2(path33, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
+    function exists2(path34, type = exports.READABLE) {
+      return check2(path34, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
     }
     exports.exists = exists2;
     exports.FILE = 1;
@@ -7922,8 +7922,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path33, errorMaps, issueData } = params;
-      const fullPath = [...path33, ...issueData.path || []];
+      const { data, path: path34, errorMaps, issueData } = params;
+      const fullPath = [...path34, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -8231,11 +8231,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util2();
     ParseInputLazyPath = class {
-      constructor(parent, value, path33, key) {
+      constructor(parent, value, path34, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path33;
+        this._path = path34;
         this._key = key;
       }
       get path() {
@@ -11850,10 +11850,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path33) {
-  if (!path33)
+function getElementAtPath(obj, path34) {
+  if (!path34)
     return obj;
-  return path33.reduce((acc, key) => acc?.[key], obj);
+  return path34.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -12102,11 +12102,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path33, issues) {
+function prefixIssues(path34, issues) {
   return issues.map((iss) => {
     var _a2;
     (_a2 = iss).path ?? (_a2.path = []);
-    iss.path.unshift(path33);
+    iss.path.unshift(path34);
     return iss;
   });
 }
@@ -12295,7 +12295,7 @@ function treeifyError(error40, _mapper) {
     return issue2.message;
   };
   const result = { errors: [] };
-  const processError = (error41, path33 = []) => {
+  const processError = (error41, path34 = []) => {
     var _a2, _b;
     for (const issue2 of error41.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
@@ -12305,7 +12305,7 @@ function treeifyError(error40, _mapper) {
       } else if (issue2.code === "invalid_element") {
         processError({ issues: issue2.issues }, issue2.path);
       } else {
-        const fullpath = [...path33, ...issue2.path];
+        const fullpath = [...path34, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -12335,9 +12335,9 @@ function treeifyError(error40, _mapper) {
   processError(error40);
   return result;
 }
-function toDotPath(path33) {
+function toDotPath(path34) {
   const segs = [];
-  for (const seg of path33) {
+  for (const seg of path34) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -24800,8 +24800,8 @@ var init_acp = __esm({
         this.#requestHandler = requestHandler;
         this.#notificationHandler = notificationHandler;
         this.#stream = stream;
-        this.#closedPromise = new Promise((resolve16) => {
-          this.#abortController.signal.addEventListener("abort", () => resolve16());
+        this.#closedPromise = new Promise((resolve17) => {
+          this.#abortController.signal.addEventListener("abort", () => resolve17());
         });
         this.#receive();
       }
@@ -24950,8 +24950,8 @@ var init_acp = __esm({
       }
       async sendRequest(method, params) {
         const id = this.#nextRequestId++;
-        const responsePromise = new Promise((resolve16, reject) => {
-          this.#pendingResponses.set(id, { resolve: resolve16, reject });
+        const responsePromise = new Promise((resolve17, reject) => {
+          this.#pendingResponses.set(id, { resolve: resolve17, reject });
         });
         await this.#sendMessage({ jsonrpc: "2.0", id, method, params });
         return responsePromise;
@@ -25046,10 +25046,6 @@ var init_acp = __esm({
   }
 });
 
-// src/cli.ts
-import * as fs29 from "node:fs";
-import * as path32 from "node:path";
-
 // ../../node_modules/.pnpm/commander@12.1.0/node_modules/commander/esm.mjs
 var import_index = __toESM(require_commander(), 1);
 var {
@@ -25067,6 +25063,14 @@ var {
   Help
 } = import_index.default;
 
+// src/cli/defaults.ts
+var DEFAULT_API_URL = process.env.BUILDAUTOMATON_API_URL ?? "https://api.buildautomaton.com";
+var DEFAULT_FIREHOSE_URL = "https://buildautomaton-firehose.fly.dev";
+
+// src/cli/run-cli-action.ts
+import * as fs30 from "node:fs";
+import * as path33 from "node:path";
+
 // src/config.ts
 import fs from "node:fs";
 import path from "node:path";
@@ -25145,15 +25149,291 @@ function clearConfigForApi(apiUrl) {
   }
 }
 
-// src/files/cwd/bridge-workspace-directory.ts
+// src/e2e-certificates/certificates.ts
+import * as fs2 from "node:fs/promises";
 import * as path2 from "node:path";
+
+// ../e2ee/src/constants.ts
+var E2EE_ALG = "A1";
+var E2EE_KEY_BYTES = 32;
+var E2EE_NONCE_BYTES = 12;
+
+// ../e2ee/src/types.ts
+function isE2eeEnvelope(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const o = value;
+  return typeof o.k === "string" && typeof o.n === "string" && typeof o.c === "string";
+}
+function isE2eeKeyRecord(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const o = value;
+  return typeof o.id === "string" && o.id.length > 0 && typeof o.name === "string" && o.name.length > 0 && o.a === E2EE_ALG && typeof o.k === "string" && o.k.length > 0 && typeof o.createdAt === "string" && o.createdAt.length > 0;
+}
+
+// ../e2ee/src/encoding.ts
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 1) binary += String.fromCharCode(bytes[i]);
+  const b64 = btoa(binary);
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64UrlDecode(value) {
+  const b64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  const binary = atob(padded);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);
+  return out;
+}
+
+// ../e2ee/src/pem.ts
+var E2EE_PEM_LABEL = "BUILD AUTOMATON E2EE KEY";
+function pemHeaderValue(headers, name) {
+  return headers[name.toLowerCase()];
+}
+function encodePemBase64(bytes) {
+  const raw = base64UrlEncode(bytes).replace(/-/g, "+").replace(/_/g, "/");
+  const padded = raw + "=".repeat((4 - raw.length % 4) % 4);
+  return padded.replace(/.{1,64}/g, "$&\n").trimEnd();
+}
+function decodePemBase64(value) {
+  const compact = value.replace(/\s+/g, "");
+  const binary = atob(compact);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function parseE2eeKeyRecordPem(raw, fallbackName) {
+  const lines = raw.trim().split(/\r?\n/);
+  if (lines[0]?.trim() !== `-----BEGIN ${E2EE_PEM_LABEL}-----`) {
+    throw new Error("The E2EE key file is not a BuildAutomaton PEM key.");
+  }
+  const endIndex = lines.findIndex((line) => line.trim() === `-----END ${E2EE_PEM_LABEL}-----`);
+  if (endIndex < 0) throw new Error("The E2EE key PEM is missing its end marker.");
+  const headers = {};
+  const bodyLines = [];
+  let readingBody = false;
+  for (const line of lines.slice(1, endIndex)) {
+    const trimmed2 = line.trim();
+    if (!trimmed2) {
+      readingBody = true;
+      continue;
+    }
+    const headerMatch = /^([A-Za-z0-9-]+):\s*(.*)$/.exec(trimmed2);
+    if (!readingBody && headerMatch) {
+      headers[headerMatch[1].toLowerCase()] = headerMatch[2].trim();
+      continue;
+    }
+    readingBody = true;
+    bodyLines.push(trimmed2);
+  }
+  const keyBytes = decodePemBase64(bodyLines.join(""));
+  if (keyBytes.byteLength !== E2EE_KEY_BYTES) throw new Error("The E2EE key PEM does not contain a 256-bit key.");
+  const key = {
+    id: pemHeaderValue(headers, "Key-Id") ?? "",
+    name: pemHeaderValue(headers, "Name") ?? fallbackName,
+    a: pemHeaderValue(headers, "Algorithm") ?? E2EE_ALG,
+    k: base64UrlEncode(keyBytes),
+    createdAt: pemHeaderValue(headers, "Created-At") ?? (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (!isE2eeKeyRecord(key)) throw new Error("The E2EE key PEM has invalid metadata.");
+  return {
+    ...key,
+    name: key.name.trim() || fallbackName
+  };
+}
+function parseE2eeKeyRecord(raw, fallbackName) {
+  return parseE2eeKeyRecordPem(raw.trim(), fallbackName);
+}
+function serializeE2eeKeyRecord(key) {
+  return [
+    `-----BEGIN ${E2EE_PEM_LABEL}-----`,
+    `Key-Id: ${key.id}`,
+    `Name: ${key.name}`,
+    `Algorithm: ${key.a}`,
+    `Created-At: ${key.createdAt}`,
+    "",
+    encodePemBase64(base64UrlDecode(key.k)),
+    `-----END ${E2EE_PEM_LABEL}-----`,
+    ""
+  ].join("\n");
+}
+
+// src/lib/e2ee/cli-e2ee-key.ts
+import { createHash, randomBytes } from "node:crypto";
+function createE2eeKeyRecord(name) {
+  const raw = randomBytes(E2EE_KEY_BYTES);
+  const digest = createHash("sha256").update(raw).digest();
+  return {
+    id: base64UrlEncode(digest.subarray(0, 16)),
+    name: name.trim() || "BuildAutomaton E2EE key",
+    a: E2EE_ALG,
+    k: base64UrlEncode(raw),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
+// src/lib/e2ee/cli-e2ee-runtime.ts
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes2 } from "node:crypto";
+function nonceFromCounter(prefix, counter) {
+  const nonce = Buffer.alloc(E2EE_NONCE_BYTES);
+  prefix.copy(nonce, 0);
+  nonce.writeBigUInt64BE(counter, 4);
+  return nonce;
+}
+function createCliE2eeRuntime(key) {
+  const rawKey = Buffer.from(base64UrlDecode(key.k));
+  const prefix = randomBytes2(4);
+  let counter = 0n;
+  function nextNonce() {
+    counter += 1n;
+    return nonceFromCounter(prefix, counter);
+  }
+  function encryptObject(messageWithoutSensitiveFields, plaintext) {
+    const nonce = nextNonce();
+    const cipher = createCipheriv("aes-256-gcm", rawKey, nonce);
+    const ciphertext = Buffer.concat([cipher.update(JSON.stringify(plaintext), "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+      k: key.id,
+      n: base64UrlEncode(nonce),
+      c: base64UrlEncode(Buffer.concat([ciphertext, tag]))
+    };
+  }
+  return {
+    keyId: key.id,
+    handshake: { k: key.id, a: key.a },
+    encryptFields(message, fields) {
+      const plaintext = {};
+      const stripped = { ...message };
+      let hasPlaintext = false;
+      for (const field of fields) {
+        if (Object.prototype.hasOwnProperty.call(stripped, field) && stripped[field] !== void 0) {
+          plaintext[field] = stripped[field];
+          delete stripped[field];
+          hasPlaintext = true;
+        }
+      }
+      if (!hasPlaintext) return message;
+      stripped.ee = encryptObject(stripped, plaintext);
+      return stripped;
+    },
+    decryptMessage(message) {
+      const envelope = message.ee;
+      if (!isE2eeEnvelope(envelope)) return message;
+      if (envelope.k !== key.id) throw new Error(`E2EE key mismatch: ${envelope.k}`);
+      const sealed = Buffer.from(base64UrlDecode(envelope.c));
+      if (sealed.length < 16) throw new Error("Invalid E2EE payload.");
+      const ciphertext = sealed.subarray(0, sealed.length - 16);
+      const tag = sealed.subarray(sealed.length - 16);
+      const nonce = Buffer.from(base64UrlDecode(envelope.n));
+      const decipher = createDecipheriv("aes-256-gcm", rawKey, nonce);
+      decipher.setAuthTag(tag);
+      const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+      const parsed = JSON.parse(decrypted);
+      if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("E2EE payload did not decode to an object.");
+      }
+      const merged = { ...message, ...parsed };
+      delete merged.ee;
+      return merged;
+    }
+  };
+}
+
+// src/e2e-certificates/certificates.ts
+var E2E_CERTIFICATE_ALGORITHM = "A1";
+var CERTIFICATE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".pem", ".key", ".crt"]);
+function certificateFromKey({
+  raw,
+  name,
+  createdAt
+}) {
+  try {
+    const key = parseE2eeKeyRecord(raw, name);
+    return {
+      ...key,
+      name: key.name || name,
+      algorithm: E2E_CERTIFICATE_ALGORITHM,
+      pemBundle: serializeE2eeKeyRecord({ ...key, createdAt: key.createdAt || createdAt })
+    };
+  } catch {
+    return void 0;
+  }
+}
+function baseNameForCertificate(fileName) {
+  return path2.basename(fileName, path2.extname(fileName)) || "BuildAutomaton E2EE certificate";
+}
+async function readCertificateFiles(directory) {
+  let entries;
+  try {
+    entries = await fs2.readdir(directory, { withFileTypes: true });
+  } catch (err) {
+    const nodeErr = err;
+    if (nodeErr.code === "ENOENT") return [];
+    throw err;
+  }
+  const certificates = [];
+  for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+    if (!entry.isFile() || !CERTIFICATE_FILE_EXTENSIONS.has(path2.extname(entry.name).toLowerCase())) continue;
+    const filePath = path2.join(directory, entry.name);
+    const raw = await fs2.readFile(filePath, "utf8").catch(() => void 0);
+    if (!raw) continue;
+    const stat3 = await fs2.stat(filePath).catch(() => void 0);
+    const certificate = certificateFromKey({
+      raw,
+      name: baseNameForCertificate(entry.name),
+      createdAt: stat3?.mtime?.toISOString() ?? (/* @__PURE__ */ new Date()).toISOString()
+    });
+    if (certificate) {
+      certificates.push(certificate);
+    }
+  }
+  return certificates;
+}
+function createCertificate(directory) {
+  const baseName = path2.basename(directory) || "BuildAutomaton E2EE certificate";
+  const key = createE2eeKeyRecord(baseName);
+  return {
+    ...key,
+    algorithm: E2E_CERTIFICATE_ALGORITHM,
+    pemBundle: serializeE2eeKeyRecord(key)
+  };
+}
+async function loadOrCreateE2eCertificates(directory) {
+  const resolved = path2.resolve(directory);
+  await fs2.mkdir(resolved, { recursive: true, mode: 448 });
+  const existing = await readCertificateFiles(resolved);
+  if (existing.length > 0) {
+    return {
+      directory: resolved,
+      certificates: existing,
+      activeCertificate: existing[0],
+      generated: false
+    };
+  }
+  const certificate = createCertificate(resolved);
+  const fileName = `buildautomaton-e2ee-key-${certificate.id.slice(0, 12)}.pem`;
+  await fs2.writeFile(path2.join(resolved, fileName), certificate.pemBundle, {
+    mode: 384
+  });
+  return {
+    directory: resolved,
+    certificates: [certificate],
+    activeCertificate: certificate,
+    generated: true
+  };
+}
+
+// src/files/cwd/bridge-workspace-directory.ts
+import * as path3 from "node:path";
 var bridgeWorkspaceDirectory = null;
 function initBridgeWorkspaceDirectory() {
-  bridgeWorkspaceDirectory = path2.resolve(process.cwd());
+  bridgeWorkspaceDirectory = path3.resolve(process.cwd());
 }
 function getBridgeWorkspaceDirectory() {
   if (bridgeWorkspaceDirectory == null) {
-    bridgeWorkspaceDirectory = path2.resolve(process.cwd());
+    bridgeWorkspaceDirectory = path3.resolve(process.cwd());
   }
   return bridgeWorkspaceDirectory;
 }
@@ -25324,30 +25604,30 @@ function sendWsMessage(ws, payload) {
 // ../../node_modules/.pnpm/open@10.2.0/node_modules/open/index.js
 import process7 from "node:process";
 import { Buffer as Buffer2 } from "node:buffer";
-import path3 from "node:path";
+import path4 from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify as promisify5 } from "node:util";
 import childProcess from "node:child_process";
-import fs6, { constants as fsConstants2 } from "node:fs/promises";
+import fs7, { constants as fsConstants2 } from "node:fs/promises";
 
 // ../../node_modules/.pnpm/wsl-utils@0.1.0/node_modules/wsl-utils/index.js
 import process3 from "node:process";
-import fs5, { constants as fsConstants } from "node:fs/promises";
+import fs6, { constants as fsConstants } from "node:fs/promises";
 
 // ../../node_modules/.pnpm/is-wsl@3.1.1/node_modules/is-wsl/index.js
 import process2 from "node:process";
 import os2 from "node:os";
-import fs4 from "node:fs";
+import fs5 from "node:fs";
 
 // ../../node_modules/.pnpm/is-inside-container@1.0.0/node_modules/is-inside-container/index.js
-import fs3 from "node:fs";
+import fs4 from "node:fs";
 
 // ../../node_modules/.pnpm/is-docker@3.0.0/node_modules/is-docker/index.js
-import fs2 from "node:fs";
+import fs3 from "node:fs";
 var isDockerCached;
 function hasDockerEnv() {
   try {
-    fs2.statSync("/.dockerenv");
+    fs3.statSync("/.dockerenv");
     return true;
   } catch {
     return false;
@@ -25355,7 +25635,7 @@ function hasDockerEnv() {
 }
 function hasDockerCGroup() {
   try {
-    return fs2.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
+    return fs3.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
   } catch {
     return false;
   }
@@ -25371,7 +25651,7 @@ function isDocker() {
 var cachedResult;
 var hasContainerEnv = () => {
   try {
-    fs3.statSync("/run/.containerenv");
+    fs4.statSync("/run/.containerenv");
     return true;
   } catch {
     return false;
@@ -25396,12 +25676,12 @@ var isWsl = () => {
     return true;
   }
   try {
-    if (fs4.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft")) {
+    if (fs5.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft")) {
       return !isInsideContainer();
     }
   } catch {
   }
-  if (fs4.existsSync("/proc/sys/fs/binfmt_misc/WSLInterop") || fs4.existsSync("/run/WSL")) {
+  if (fs5.existsSync("/proc/sys/fs/binfmt_misc/WSLInterop") || fs5.existsSync("/run/WSL")) {
     return !isInsideContainer();
   }
   return false;
@@ -25419,14 +25699,14 @@ var wslDrivesMountPoint = /* @__PURE__ */ (() => {
     const configFilePath2 = "/etc/wsl.conf";
     let isConfigFileExists = false;
     try {
-      await fs5.access(configFilePath2, fsConstants.F_OK);
+      await fs6.access(configFilePath2, fsConstants.F_OK);
       isConfigFileExists = true;
     } catch {
     }
     if (!isConfigFileExists) {
       return defaultMountPoint;
     }
-    const configContent = await fs5.readFile(configFilePath2, { encoding: "utf8" });
+    const configContent = await fs6.readFile(configFilePath2, { encoding: "utf8" });
     const configMountPoint = /(?<!#.*)root\s*=\s*(?<mountPoint>.*)/g.exec(configContent);
     if (!configMountPoint) {
       return defaultMountPoint;
@@ -25580,8 +25860,8 @@ async function defaultBrowser2() {
 
 // ../../node_modules/.pnpm/open@10.2.0/node_modules/open/index.js
 var execFile5 = promisify5(childProcess.execFile);
-var __dirname = path3.dirname(fileURLToPath(import.meta.url));
-var localXdgOpenPath = path3.join(__dirname, "xdg-open");
+var __dirname = path4.dirname(fileURLToPath(import.meta.url));
+var localXdgOpenPath = path4.join(__dirname, "xdg-open");
 var { platform, arch } = process7;
 async function getWindowsDefaultBrowserFromWsl() {
   const powershellPath = await powerShellPath();
@@ -25731,7 +26011,7 @@ var baseOpen = async (options) => {
       const isBundled = !__dirname || __dirname === "/";
       let exeLocalXdgOpen = false;
       try {
-        await fs6.access(localXdgOpenPath, fsConstants2.X_OK);
+        await fs7.access(localXdgOpenPath, fsConstants2.X_OK);
         exeLocalXdgOpen = true;
       } catch {
       }
@@ -25754,14 +26034,14 @@ var baseOpen = async (options) => {
   }
   const subprocess = childProcess.spawn(command, cliArguments, childProcessOptions);
   if (options.wait) {
-    return new Promise((resolve16, reject) => {
+    return new Promise((resolve17, reject) => {
       subprocess.once("error", reject);
       subprocess.once("close", (exitCode) => {
         if (!options.allowNonzeroExitCode && exitCode > 0) {
           reject(new Error(`Exited with code ${exitCode}`));
           return;
         }
-        resolve16(subprocess);
+        resolve17(subprocess);
       });
     });
   }
@@ -25845,8 +26125,11 @@ function isLocalApiUrl(apiUrl) {
     return false;
   }
 }
+function appUrlForApiUrl(apiUrl) {
+  return apiUrl && isLocalApiUrl(apiUrl) ? process.env.BUILDAUTOMATON_APP_URL ?? "http://localhost:3000" : process.env.BUILDAUTOMATON_APP_URL ?? "https://app.buildautomaton.com";
+}
 async function openBrowser(connectionId, initialWorkspaceId, preferredBridgeName, apiUrl, logFn = log) {
-  const appUrl = apiUrl && isLocalApiUrl(apiUrl) ? process.env.BUILDAUTOMATON_APP_URL ?? "http://localhost:3000" : process.env.BUILDAUTOMATON_APP_URL ?? "https://app.buildautomaton.com";
+  const appUrl = appUrlForApiUrl(apiUrl);
   let connectCliUrl = `${appUrl.replace(/\/$/, "")}/bridges/connect?connectionId=${connectionId}`;
   if (initialWorkspaceId) {
     try {
@@ -26054,8 +26337,8 @@ function runPendingAuth(options) {
   let hasOpenedBrowser = false;
   let resolved = false;
   let resolveAuth;
-  const authPromise = new Promise((resolve16) => {
-    resolveAuth = resolve16;
+  const authPromise = new Promise((resolve17) => {
+    resolveAuth = resolve17;
   });
   let reconnectAttempt = 0;
   const signInQuiet = createEmptyReconnectQuietSlot();
@@ -26177,7 +26460,7 @@ function runPendingAuth(options) {
 async function closeBridgeConnection(state, acpManager, devServerManager, log2) {
   const say = log2 ?? logImmediate;
   say("Cleaning up connections\u2026");
-  await new Promise((resolve16) => setImmediate(resolve16));
+  await new Promise((resolve17) => setImmediate(resolve17));
   state.closedByUser = true;
   clearReconnectQuietTimer(state.mainQuiet);
   clearReconnectQuietTimer(state.firehoseQuiet);
@@ -26248,19 +26531,19 @@ function localAgentErrorSuggestsAuth(agentType, errorText) {
 
 // src/git/session-git-queue.ts
 import { execFile as execFile7 } from "node:child_process";
-import { readFile, stat } from "node:fs/promises";
+import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
 import { promisify as promisify7 } from "node:util";
-import * as path6 from "node:path";
+import * as path7 from "node:path";
 
 // src/git/pre-turn-snapshot.ts
-import * as fs8 from "node:fs";
-import * as path5 from "node:path";
+import * as fs9 from "node:fs";
+import * as path6 from "node:path";
 import { execFile as execFile6 } from "node:child_process";
 import { promisify as promisify6 } from "node:util";
 
 // src/git/discover-repos.ts
-import * as fs7 from "node:fs";
-import * as path4 from "node:path";
+import * as fs8 from "node:fs";
+import * as path5 from "node:path";
 
 // ../../node_modules/.pnpm/simple-git@3.32.3/node_modules/simple-git/dist/esm/index.js
 var import_file_exists = __toESM(require_dist(), 1);
@@ -26299,8 +26582,8 @@ function pathspec(...paths) {
   cache.set(key, paths);
   return key;
 }
-function isPathSpec(path33) {
-  return path33 instanceof String && cache.has(path33);
+function isPathSpec(path34) {
+  return path34 instanceof String && cache.has(path34);
 }
 function toPaths(pathSpec) {
   return cache.get(pathSpec) || [];
@@ -26389,8 +26672,8 @@ function toLinesWithContent(input = "", trimmed2 = true, separator = "\n") {
 function forEachLineWithContent(input, callback) {
   return toLinesWithContent(input, true).map((line) => callback(line));
 }
-function folderExists(path33) {
-  return (0, import_file_exists.exists)(path33, import_file_exists.FOLDER);
+function folderExists(path34) {
+  return (0, import_file_exists.exists)(path34, import_file_exists.FOLDER);
 }
 function append(target, item) {
   if (Array.isArray(target)) {
@@ -26794,8 +27077,8 @@ function checkIsRepoRootTask() {
     commands,
     format: "utf-8",
     onError,
-    parser(path33) {
-      return /^\.(git)?$/.test(path33.trim());
+    parser(path34) {
+      return /^\.(git)?$/.test(path34.trim());
     }
   };
 }
@@ -27229,11 +27512,11 @@ function parseGrep(grep) {
   const paths = /* @__PURE__ */ new Set();
   const results = {};
   forEachLineWithContent(grep, (input) => {
-    const [path33, line, preview] = input.split(NULL);
-    paths.add(path33);
-    (results[path33] = results[path33] || []).push({
+    const [path34, line, preview] = input.split(NULL);
+    paths.add(path34);
+    (results[path34] = results[path34] || []).push({
       line: asNumber(line),
-      path: path33,
+      path: path34,
       preview
     });
   });
@@ -27998,14 +28281,14 @@ var init_hash_object = __esm2({
     init_task();
   }
 });
-function parseInit(bare, path33, text) {
+function parseInit(bare, path34, text) {
   const response = String(text).trim();
   let result;
   if (result = initResponseRegex.exec(response)) {
-    return new InitSummary(bare, path33, false, result[1]);
+    return new InitSummary(bare, path34, false, result[1]);
   }
   if (result = reInitResponseRegex.exec(response)) {
-    return new InitSummary(bare, path33, true, result[1]);
+    return new InitSummary(bare, path34, true, result[1]);
   }
   let gitDir = "";
   const tokens = response.split(" ");
@@ -28016,7 +28299,7 @@ function parseInit(bare, path33, text) {
       break;
     }
   }
-  return new InitSummary(bare, path33, /^re/i.test(response), gitDir);
+  return new InitSummary(bare, path34, /^re/i.test(response), gitDir);
 }
 var InitSummary;
 var initResponseRegex;
@@ -28025,9 +28308,9 @@ var init_InitSummary = __esm2({
   "src/lib/responses/InitSummary.ts"() {
     "use strict";
     InitSummary = class {
-      constructor(bare, path33, existing, gitDir) {
+      constructor(bare, path34, existing, gitDir) {
         this.bare = bare;
-        this.path = path33;
+        this.path = path34;
         this.existing = existing;
         this.gitDir = gitDir;
       }
@@ -28039,7 +28322,7 @@ var init_InitSummary = __esm2({
 function hasBareCommand(command) {
   return command.includes(bareCommand);
 }
-function initTask(bare = false, path33, customArgs) {
+function initTask(bare = false, path34, customArgs) {
   const commands = ["init", ...customArgs];
   if (bare && !hasBareCommand(commands)) {
     commands.splice(1, 0, bareCommand);
@@ -28048,7 +28331,7 @@ function initTask(bare = false, path33, customArgs) {
     commands,
     format: "utf-8",
     parser(text) {
-      return parseInit(commands.includes("--bare"), path33, text);
+      return parseInit(commands.includes("--bare"), path34, text);
     }
   };
 }
@@ -28864,12 +29147,12 @@ var init_FileStatusSummary = __esm2({
     "use strict";
     fromPathRegex = /^(.+)\0(.+)$/;
     FileStatusSummary = class {
-      constructor(path33, index, working_dir) {
-        this.path = path33;
+      constructor(path34, index, working_dir) {
+        this.path = path34;
         this.index = index;
         this.working_dir = working_dir;
         if (index === "R" || working_dir === "R") {
-          const detail = fromPathRegex.exec(path33) || [null, path33, path33];
+          const detail = fromPathRegex.exec(path34) || [null, path34, path34];
           this.from = detail[2] || "";
           this.path = detail[1] || "";
         }
@@ -28900,14 +29183,14 @@ function splitLine(result, lineStr) {
     default:
       return;
   }
-  function data(index, workingDir, path33) {
+  function data(index, workingDir, path34) {
     const raw = `${index}${workingDir}`;
     const handler = parsers6.get(raw);
     if (handler) {
-      handler(result, path33);
+      handler(result, path34);
     }
     if (raw !== "##" && raw !== "!!") {
-      result.files.push(new FileStatusSummary(path33, index, workingDir));
+      result.files.push(new FileStatusSummary(path34, index, workingDir));
     }
   }
 }
@@ -29216,9 +29499,9 @@ var init_simple_git_api = __esm2({
           next
         );
       }
-      hashObject(path33, write) {
+      hashObject(path34, write) {
         return this._runTask(
-          hashObjectTask(path33, write === true),
+          hashObjectTask(path34, write === true),
           trailingFunctionArgument(arguments)
         );
       }
@@ -29571,8 +29854,8 @@ var init_branch = __esm2({
   }
 });
 function toPath(input) {
-  const path33 = input.trim().replace(/^["']|["']$/g, "");
-  return path33 && normalize(path33);
+  const path34 = input.trim().replace(/^["']|["']$/g, "");
+  return path34 && normalize(path34);
 }
 var parseCheckIgnore;
 var init_CheckIgnore = __esm2({
@@ -29886,8 +30169,8 @@ __export2(sub_module_exports, {
   subModuleTask: () => subModuleTask,
   updateSubModuleTask: () => updateSubModuleTask
 });
-function addSubModuleTask(repo, path33) {
-  return subModuleTask(["add", repo, path33]);
+function addSubModuleTask(repo, path34) {
+  return subModuleTask(["add", repo, path34]);
 }
 function initSubModuleTask(customArgs) {
   return subModuleTask(["init", ...customArgs]);
@@ -30220,8 +30503,8 @@ var require_git = __commonJS2({
       }
       return this._runTask(straightThroughStringTask2(command, this._trimmed), next);
     };
-    Git2.prototype.submoduleAdd = function(repo, path33, then) {
-      return this._runTask(addSubModuleTask2(repo, path33), trailingFunctionArgument2(arguments));
+    Git2.prototype.submoduleAdd = function(repo, path34, then) {
+      return this._runTask(addSubModuleTask2(repo, path34), trailingFunctionArgument2(arguments));
     };
     Git2.prototype.submoduleUpdate = function(args, then) {
       return this._runTask(
@@ -30847,20 +31130,20 @@ async function isGitRepoDirectory(dirPath) {
 // src/git/discover-repos.ts
 async function discoverGitRepos(cwd = getBridgeWorkspaceDirectory()) {
   const result = [];
-  const cwdResolved = path4.resolve(cwd);
+  const cwdResolved = path5.resolve(cwd);
   if (await isGitRepoDirectory(cwdResolved)) {
     const remoteUrl = await getRemoteOriginUrl(cwdResolved);
     result.push({ absolutePath: cwdResolved, remoteUrl });
   }
   let entries;
   try {
-    entries = fs7.readdirSync(cwdResolved, { withFileTypes: true });
+    entries = fs8.readdirSync(cwdResolved, { withFileTypes: true });
   } catch {
     return result;
   }
   for (const ent of entries) {
     if (!ent.isDirectory()) continue;
-    const childPath = path4.join(cwdResolved, ent.name);
+    const childPath = path5.join(cwdResolved, ent.name);
     if (await isGitRepoDirectory(childPath)) {
       const remoteUrl = await getRemoteOriginUrl(childPath);
       result.push({ absolutePath: childPath, remoteUrl });
@@ -30869,22 +31152,22 @@ async function discoverGitRepos(cwd = getBridgeWorkspaceDirectory()) {
   return result;
 }
 async function discoverGitReposUnderRoot(rootAbs) {
-  const root = path4.resolve(rootAbs);
+  const root = path5.resolve(rootAbs);
   const roots = [];
   async function walk(dir) {
     if (await isGitRepoDirectory(dir)) {
-      roots.push(path4.resolve(dir));
+      roots.push(path5.resolve(dir));
       return;
     }
     let entries;
     try {
-      entries = fs7.readdirSync(dir, { withFileTypes: true });
+      entries = fs8.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const ent of entries) {
       if (!ent.isDirectory() || ent.name === ".git") continue;
-      await walk(path4.join(dir, ent.name));
+      await walk(path5.join(dir, ent.name));
     }
   }
   await walk(root);
@@ -30900,7 +31183,7 @@ async function discoverGitReposUnderRoot(rootAbs) {
 // src/git/pre-turn-snapshot.ts
 var execFileAsync5 = promisify6(execFile6);
 function snapshotsDirForCwd(agentCwd) {
-  return path5.join(agentCwd, ".buildautomaton", "snapshots");
+  return path6.join(agentCwd, ".buildautomaton", "snapshots");
 }
 async function gitStashCreate(repoRoot, log2) {
   try {
@@ -30929,7 +31212,7 @@ async function gitRun(repoRoot, args, log2, label) {
 async function resolveSnapshotRepoRoots(options) {
   const { worktreePaths, fallbackCwd, log: log2 } = options;
   if (worktreePaths?.length) {
-    const uniq = [...new Set(worktreePaths.map((p) => path5.resolve(p)))];
+    const uniq = [...new Set(worktreePaths.map((p) => path6.resolve(p)))];
     return uniq;
   }
   try {
@@ -30952,7 +31235,7 @@ async function capturePreTurnSnapshot(options) {
   }
   const dir = snapshotsDirForCwd(agentCwd);
   try {
-    fs8.mkdirSync(dir, { recursive: true });
+    fs9.mkdirSync(dir, { recursive: true });
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
   }
@@ -30961,9 +31244,9 @@ async function capturePreTurnSnapshot(options) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     repos
   };
-  const filePath = path5.join(dir, `${runId}.json`);
+  const filePath = path6.join(dir, `${runId}.json`);
   try {
-    fs8.writeFileSync(filePath, JSON.stringify(payload, null, 2), "utf8");
+    fs9.writeFileSync(filePath, JSON.stringify(payload, null, 2), "utf8");
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
   }
@@ -30976,7 +31259,7 @@ async function capturePreTurnSnapshot(options) {
 async function applyPreTurnSnapshot(filePath, log2) {
   let data;
   try {
-    const raw = fs8.readFileSync(filePath, "utf8");
+    const raw = fs9.readFileSync(filePath, "utf8");
     data = JSON.parse(raw);
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
@@ -30999,7 +31282,7 @@ async function applyPreTurnSnapshot(filePath, log2) {
   return { ok: true };
 }
 function snapshotFilePath(agentCwd, runId) {
-  return path5.join(snapshotsDirForCwd(agentCwd), `${runId}.json`);
+  return path6.join(snapshotsDirForCwd(agentCwd), `${runId}.json`);
 }
 
 // src/git/session-git-queue.ts
@@ -31007,9 +31290,9 @@ var execFileAsync6 = promisify7(execFile7);
 var MAX_FULL_FILE_TEXT_BYTES = 512 * 1024;
 async function readWorkspaceFileAsUtf8(absPath) {
   try {
-    const st = await stat(absPath);
+    const st = await stat2(absPath);
     if (!st.isFile() || st.size > MAX_FULL_FILE_TEXT_BYTES) return void 0;
-    return await readFile(absPath, "utf8");
+    return await readFile2(absPath, "utf8");
   } catch {
     return void 0;
   }
@@ -31019,7 +31302,7 @@ async function collectTurnGitDiffFromPreTurnSnapshot(options) {
   const filePath = snapshotFilePath(agentCwd, runId);
   let data;
   try {
-    const raw = await readFile(filePath, "utf8");
+    const raw = await readFile2(filePath, "utf8");
     data = JSON.parse(raw);
   } catch (e) {
     log2(
@@ -31048,7 +31331,7 @@ async function collectTurnGitDiffFromPreTurnSnapshot(options) {
       continue;
     }
     const lines = namesRaw.split("\n").map((l) => l.trim()).filter(Boolean);
-    const slug = path6.basename(repo.path).replace(/[^\w.-]+/g, "_") || "repo";
+    const slug = path7.basename(repo.path).replace(/[^\w.-]+/g, "_") || "repo";
     for (const rel of lines) {
       if (rel.includes("..")) continue;
       try {
@@ -31062,7 +31345,7 @@ async function collectTurnGitDiffFromPreTurnSnapshot(options) {
         );
         if (!patchContent.trim()) continue;
         const displayPath = multiRepo ? `${slug}/${rel}` : rel;
-        const absFile = path6.join(repo.path, rel);
+        const absFile = path7.join(repo.path, rel);
         const newText = await readWorkspaceFileAsUtf8(absFile);
         sendSessionUpdate({
           type: "session_file_change",
@@ -31144,8 +31427,8 @@ async function sendPromptToAgent(options) {
 }
 
 // src/agents/acp/ensure-acp-client.ts
-import * as fs9 from "node:fs";
-import * as path10 from "node:path";
+import * as fs10 from "node:fs";
+import * as path11 from "node:path";
 
 // src/error-message.ts
 function errorMessage(err) {
@@ -31234,21 +31517,21 @@ function editSnippetToUnifiedDiff(filePath, oldText, newText) {
 }
 
 // src/agents/acp/safe-fs-path.ts
-import * as path7 from "node:path";
+import * as path8 from "node:path";
 function resolveSafePathUnderCwd(cwd, filePath) {
   const trimmed2 = filePath.trim();
   if (!trimmed2) return null;
-  const normalizedCwd = path7.resolve(cwd);
-  const resolved = path7.isAbsolute(trimmed2) ? path7.normalize(trimmed2) : path7.resolve(normalizedCwd, trimmed2);
-  const rel = path7.relative(normalizedCwd, resolved);
-  if (rel.startsWith("..") || path7.isAbsolute(rel)) return null;
+  const normalizedCwd = path8.resolve(cwd);
+  const resolved = path8.isAbsolute(trimmed2) ? path8.normalize(trimmed2) : path8.resolve(normalizedCwd, trimmed2);
+  const rel = path8.relative(normalizedCwd, resolved);
+  if (rel.startsWith("..") || path8.isAbsolute(rel)) return null;
   return resolved;
 }
 function toDisplayPathRelativeToCwd(cwd, absolutePath) {
-  const normalizedCwd = path7.resolve(cwd);
-  const rel = path7.relative(normalizedCwd, path7.resolve(absolutePath));
-  if (!rel || rel === "") return path7.basename(absolutePath);
-  return rel.split(path7.sep).join("/");
+  const normalizedCwd = path8.resolve(cwd);
+  const rel = path8.relative(normalizedCwd, path8.resolve(absolutePath));
+  if (!rel || rel === "") return path8.basename(absolutePath);
+  return rel.split(path8.sep).join("/");
 }
 
 // src/agents/acp/clients/agent-stderr-capture.ts
@@ -31368,7 +31651,7 @@ async function createSdkStdioAcpClient(options) {
   child.once("close", (code, signal) => {
     onAgentSubprocessExit?.({ code, signal });
   });
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     let initSettled = false;
     const settleReject = (err) => {
       if (initSettled) return;
@@ -31382,7 +31665,7 @@ async function createSdkStdioAcpClient(options) {
     const settleResolve = (handle) => {
       if (initSettled) return;
       initSettled = true;
-      resolve16(handle);
+      resolve17(handle);
     };
     child.on("error", (err) => {
       settleReject(new Error(formatSpawnError(err, command[0])));
@@ -31418,8 +31701,8 @@ async function createSdkStdioAcpClient(options) {
               });
             } catch {
             }
-            return await new Promise((resolve17) => {
-              pendingPermissionResolvers.set(requestId, resolve17);
+            return await new Promise((resolve18) => {
+              pendingPermissionResolvers.set(requestId, resolve18);
             });
           },
           async readTextFile(params) {
@@ -31527,9 +31810,9 @@ async function createSdkStdioAcpClient(options) {
             }
           },
           async cancel() {
-            for (const [id, resolve17] of [...pendingPermissionResolvers.entries()]) {
+            for (const [id, resolve18] of [...pendingPermissionResolvers.entries()]) {
               pendingPermissionResolvers.delete(id);
-              resolve17({ outcome: { outcome: "cancelled" } });
+              resolve18({ outcome: { outcome: "cancelled" } });
             }
             try {
               await connection.cancel({ sessionId });
@@ -31545,10 +31828,10 @@ async function createSdkStdioAcpClient(options) {
             }
           },
           resolveRequest(requestId, result) {
-            const resolve17 = pendingPermissionResolvers.get(requestId);
-            if (!resolve17) return;
+            const resolve18 = pendingPermissionResolvers.get(requestId);
+            if (!resolve18) return;
             pendingPermissionResolvers.delete(requestId);
-            resolve17(result);
+            resolve18(result);
           },
           disconnect() {
             child.kill();
@@ -31689,7 +31972,7 @@ async function createCursorAcpClient(options) {
     onRequest,
     onFileChange
   } = options;
-  const dbgFs = process.env.BUILDAMATON_DEBUG_ACP_FS === "1";
+  const dbgFs = process.env.BUILDAUTOMATON_DEBUG_ACP_FS === "1";
   const isWindows = process.platform === "win32";
   const child = spawn3(command[0], command.slice(1), {
     cwd,
@@ -31699,7 +31982,7 @@ async function createCursorAcpClient(options) {
   });
   const stderrCapture = createStderrCapture(child);
   child.stderr?.on("data", (chunk) => stderrCapture.append(chunk));
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     child.on("error", (err) => {
       child.kill();
       reject(new Error(formatSpawnError2(err, command[0])));
@@ -31886,7 +32169,7 @@ async function createCursorAcpClient(options) {
         const newResult = await send("session/new", { cwd, mcpServers: [] });
         const sessionId = newResult?.sessionId ?? "";
         if (!sessionId) throw new Error("Cursor ACP session/new did not return sessionId");
-        resolve16({
+        resolve17({
           sessionId,
           async sendPrompt(prompt, _options) {
             promptOutputBuffer = "";
@@ -32077,16 +32360,16 @@ import { existsSync, statSync } from "node:fs";
 
 // src/git/get-git-repo-root-sync.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import * as path8 from "node:path";
+import * as path9 from "node:path";
 function getGitRepoRootSync(startDir) {
   try {
     const out = execFileSync2("git", ["rev-parse", "--show-toplevel"], {
-      cwd: path8.resolve(startDir),
+      cwd: path9.resolve(startDir),
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       maxBuffer: 1024 * 1024
     }).trim();
-    return out ? path8.resolve(out) : null;
+    return out ? path9.resolve(out) : null;
   } catch {
     return null;
   }
@@ -32095,25 +32378,25 @@ function getGitRepoRootSync(startDir) {
 // src/agents/acp/workspace-files.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { readFileSync as readFileSync4 } from "node:fs";
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 function resolveWorkspaceFilePath(cwd, rawPath) {
   const trimmed2 = rawPath.trim();
   if (!trimmed2) return null;
-  const normalizedCwd = path9.resolve(cwd);
+  const normalizedCwd = path10.resolve(cwd);
   let abs = resolveSafePathUnderCwd(cwd, trimmed2);
   if (!abs) {
-    const candidate = path9.isAbsolute(trimmed2) ? path9.normalize(trimmed2) : path9.normalize(path9.resolve(normalizedCwd, trimmed2));
+    const candidate = path10.isAbsolute(trimmed2) ? path10.normalize(trimmed2) : path10.normalize(path10.resolve(normalizedCwd, trimmed2));
     const gitRoot2 = getGitRepoRootSync(cwd);
     if (!gitRoot2) return null;
-    const rel = path9.relative(gitRoot2, candidate);
-    if (rel.startsWith("..") || path9.isAbsolute(rel)) return null;
+    const rel = path10.relative(gitRoot2, candidate);
+    if (rel.startsWith("..") || path10.isAbsolute(rel)) return null;
     abs = candidate;
   }
   const gitRoot = getGitRepoRootSync(cwd);
   if (gitRoot) {
-    const relFromRoot = path9.relative(gitRoot, abs);
-    if (!relFromRoot.startsWith("..") && !path9.isAbsolute(relFromRoot)) {
-      return { abs, display: relFromRoot.split(path9.sep).join("/") };
+    const relFromRoot = path10.relative(gitRoot, abs);
+    if (!relFromRoot.startsWith("..") && !path10.isAbsolute(relFromRoot)) {
+      return { abs, display: relFromRoot.split(path10.sep).join("/") };
     }
   }
   return { abs, display: toDisplayPathRelativeToCwd(cwd, abs) };
@@ -32122,9 +32405,9 @@ function readUtf8WorkspaceFile(cwd, displayPath) {
   if (!displayPath || displayPath.includes("..")) return "";
   const gitRoot = getGitRepoRootSync(cwd);
   if (gitRoot) {
-    const abs2 = path9.resolve(gitRoot, displayPath);
-    const rel = path9.relative(gitRoot, abs2);
-    if (!rel.startsWith("..") && !path9.isAbsolute(rel)) {
+    const abs2 = path10.resolve(gitRoot, displayPath);
+    const rel = path10.relative(gitRoot, abs2);
+    if (!rel.startsWith("..") && !path10.isAbsolute(rel)) {
       try {
         return readFileSync4(abs2, "utf8");
       } catch {
@@ -32143,9 +32426,9 @@ function tryWorkspaceDisplayToAbs(cwd, displayPath) {
   if (!displayPath || displayPath.includes("..")) return null;
   const gitRoot = getGitRepoRootSync(cwd);
   if (gitRoot) {
-    const abs = path9.resolve(gitRoot, displayPath);
-    const rel = path9.relative(gitRoot, abs);
-    if (!rel.startsWith("..") && !path9.isAbsolute(rel)) return abs;
+    const abs = path10.resolve(gitRoot, displayPath);
+    const rel = path10.relative(gitRoot, abs);
+    if (!rel.startsWith("..") && !path10.isAbsolute(rel)) return abs;
   }
   return resolveSafePathUnderCwd(cwd, displayPath);
 }
@@ -32713,10 +32996,10 @@ function buildAcpSessionBridgeHooks(opts) {
 // src/agents/acp/ensure-acp-client.ts
 async function ensureAcpClient(options) {
   const { state, preferredAgentType, mode, cwd, routing, sendSessionUpdate, sendRequest, log: log2 } = options;
-  const targetCwd = path10.resolve(
+  const targetCwd = path11.resolve(
     cwd != null && String(cwd).trim() !== "" ? String(cwd).trim() : getBridgeWorkspaceDirectory()
   );
-  if (state.acpHandle && state.lastAcpCwd != null && path10.resolve(state.lastAcpCwd) !== path10.resolve(targetCwd)) {
+  if (state.acpHandle && state.lastAcpCwd != null && path11.resolve(state.lastAcpCwd) !== path11.resolve(targetCwd)) {
     try {
       state.acpHandle.disconnect();
     } catch {
@@ -32748,7 +33031,7 @@ async function ensureAcpClient(options) {
   if (!state.acpStartPromise) {
     let statOk = false;
     try {
-      const st = fs9.statSync(targetCwd);
+      const st = fs10.statSync(targetCwd);
       statOk = st.isDirectory();
       if (!statOk) {
         state.lastAcpStartError = `Agent cwd is not a directory: ${targetCwd}`;
@@ -32944,12 +33227,12 @@ async function createAcpManager(options) {
 }
 
 // src/worktrees/session-worktree-manager.ts
-import * as path16 from "node:path";
+import * as path17 from "node:path";
 import os4 from "node:os";
 
 // src/worktrees/prepare-new-session-worktrees.ts
-import * as fs11 from "node:fs";
-import * as path12 from "node:path";
+import * as fs12 from "node:fs";
+import * as path13 from "node:path";
 
 // src/git/worktree-add.ts
 async function gitWorktreeAddBranch(mainRepoPath, worktreePath, branch) {
@@ -32958,12 +33241,12 @@ async function gitWorktreeAddBranch(mainRepoPath, worktreePath, branch) {
 }
 
 // src/worktrees/worktree-layout-file.ts
-import * as fs10 from "node:fs";
-import * as path11 from "node:path";
+import * as fs11 from "node:fs";
+import * as path12 from "node:path";
 import os3 from "node:os";
 var LAYOUT_FILENAME = "worktree-launcher-layout.json";
 function defaultWorktreeLayoutPath() {
-  return path11.join(os3.homedir(), ".buildautomaton", LAYOUT_FILENAME);
+  return path12.join(os3.homedir(), ".buildautomaton", LAYOUT_FILENAME);
 }
 function normalizeLoadedLayout(raw) {
   if (raw && typeof raw === "object" && "launcherCwds" in raw) {
@@ -32975,8 +33258,8 @@ function normalizeLoadedLayout(raw) {
 function loadWorktreeLayout() {
   try {
     const p = defaultWorktreeLayoutPath();
-    if (!fs10.existsSync(p)) return { launcherCwds: [] };
-    const raw = JSON.parse(fs10.readFileSync(p, "utf8"));
+    if (!fs11.existsSync(p)) return { launcherCwds: [] };
+    const raw = JSON.parse(fs11.readFileSync(p, "utf8"));
     return normalizeLoadedLayout(raw);
   } catch {
     return { launcherCwds: [] };
@@ -32984,18 +33267,18 @@ function loadWorktreeLayout() {
 }
 function saveWorktreeLayout(layout) {
   try {
-    const dir = path11.dirname(defaultWorktreeLayoutPath());
-    fs10.mkdirSync(dir, { recursive: true });
-    fs10.writeFileSync(defaultWorktreeLayoutPath(), JSON.stringify(layout, null, 2), "utf8");
+    const dir = path12.dirname(defaultWorktreeLayoutPath());
+    fs11.mkdirSync(dir, { recursive: true });
+    fs11.writeFileSync(defaultWorktreeLayoutPath(), JSON.stringify(layout, null, 2), "utf8");
   } catch {
   }
 }
 function baseNameSafe(abs) {
-  return path11.basename(abs).replace(/[^a-zA-Z0-9._-]+/g, "-") || "cwd";
+  return path12.basename(abs).replace(/[^a-zA-Z0-9._-]+/g, "-") || "cwd";
 }
 function allocateDirNameForLauncherCwd(layout, launcherCwdAbs) {
-  const norm = path11.resolve(launcherCwdAbs);
-  const existing = layout.launcherCwds.find((e) => path11.resolve(e.absolutePath) === norm);
+  const norm = path12.resolve(launcherCwdAbs);
+  const existing = layout.launcherCwds.find((e) => path12.resolve(e.absolutePath) === norm);
   if (existing) return existing.dirName;
   const base = baseNameSafe(norm);
   const used = new Set(layout.launcherCwds.map((e) => e.dirName));
@@ -33013,9 +33296,9 @@ function allocateDirNameForLauncherCwd(layout, launcherCwdAbs) {
 // src/worktrees/prepare-new-session-worktrees.ts
 async function prepareNewSessionWorktrees(options) {
   const { rootAbs, launcherCwd, sessionId, layout, log: log2 } = options;
-  const launcherResolved = path12.resolve(launcherCwd);
+  const launcherResolved = path13.resolve(launcherCwd);
   const cwdKey = allocateDirNameForLauncherCwd(layout, launcherResolved);
-  const agentMirrorRoot = path12.join(rootAbs, cwdKey);
+  const agentMirrorRoot = path13.join(rootAbs, cwdKey);
   const repos = await discoverGitReposUnderRoot(launcherResolved);
   if (repos.length === 0) {
     log2("[worktrees] No Git repositories under launcher working directory; skipping worktree creation.");
@@ -33023,13 +33306,13 @@ async function prepareNewSessionWorktrees(options) {
   }
   const branch = `session-${sessionId}`;
   const worktreePaths = [];
-  fs11.mkdirSync(agentMirrorRoot, { recursive: true });
+  fs12.mkdirSync(agentMirrorRoot, { recursive: true });
   for (const repo of repos) {
-    let rel = path12.relative(launcherResolved, repo.absolutePath);
-    if (rel.startsWith("..") || path12.isAbsolute(rel)) continue;
+    let rel = path13.relative(launcherResolved, repo.absolutePath);
+    if (rel.startsWith("..") || path13.isAbsolute(rel)) continue;
     const relNorm = rel === "" ? "." : rel;
-    const wtPath = path12.join(agentMirrorRoot, relNorm, sessionId);
-    fs11.mkdirSync(path12.dirname(wtPath), { recursive: true });
+    const wtPath = path13.join(agentMirrorRoot, relNorm, sessionId);
+    fs12.mkdirSync(path13.dirname(wtPath), { recursive: true });
     try {
       await gitWorktreeAddBranch(repo.absolutePath, wtPath, branch);
       log2(`[worktrees] Added worktree ${wtPath} (branch ${branch}).`);
@@ -33066,23 +33349,23 @@ async function renameSessionWorktreeBranches(paths, newBranch, log2) {
 }
 
 // src/worktrees/remove-session-worktrees.ts
-import * as fs14 from "node:fs";
+import * as fs15 from "node:fs";
 
 // src/git/worktree-remove.ts
-import * as fs13 from "node:fs";
+import * as fs14 from "node:fs";
 
 // src/git/resolve-main-repo-from-git-file.ts
-import * as fs12 from "node:fs";
-import * as path13 from "node:path";
+import * as fs13 from "node:fs";
+import * as path14 from "node:path";
 function resolveMainRepoFromWorktreeGitFile(wt) {
-  const gitDirFile = path13.join(wt, ".git");
-  if (!fs12.existsSync(gitDirFile) || !fs12.statSync(gitDirFile).isFile()) return "";
-  const first2 = fs12.readFileSync(gitDirFile, "utf8").trim();
+  const gitDirFile = path14.join(wt, ".git");
+  if (!fs13.existsSync(gitDirFile) || !fs13.statSync(gitDirFile).isFile()) return "";
+  const first2 = fs13.readFileSync(gitDirFile, "utf8").trim();
   const m = first2.match(/^gitdir:\s*(.+)$/im);
   if (!m) return "";
-  const gitWorktreePath = path13.resolve(wt, m[1].trim());
-  const gitDir = path13.dirname(path13.dirname(gitWorktreePath));
-  return path13.dirname(gitDir);
+  const gitWorktreePath = path14.resolve(wt, m[1].trim());
+  const gitDir = path14.dirname(path14.dirname(gitWorktreePath));
+  return path14.dirname(gitDir);
 }
 
 // src/git/worktree-remove.ts
@@ -33091,7 +33374,7 @@ async function gitWorktreeRemoveForce(worktreePath) {
   if (mainRepo) {
     await simpleGit(mainRepo).raw(["worktree", "remove", "--force", worktreePath]);
   } else {
-    fs13.rmSync(worktreePath, { recursive: true, force: true });
+    fs14.rmSync(worktreePath, { recursive: true, force: true });
   }
 }
 
@@ -33104,7 +33387,7 @@ async function removeSessionWorktrees(paths, log2) {
     } catch (e) {
       log2(`[worktrees] Remove failed for ${wt}: ${e instanceof Error ? e.message : String(e)}`);
       try {
-        fs14.rmSync(wt, { recursive: true, force: true });
+        fs15.rmSync(wt, { recursive: true, force: true });
       } catch {
       }
     }
@@ -33324,7 +33607,7 @@ function formatRemoteDisplayLabel(remoteUrl) {
 }
 
 // src/git/working-directory/changes/get-working-tree-change-repo-details.ts
-import * as path15 from "node:path";
+import * as path16 from "node:path";
 
 // src/git/working-directory/changes/parse-git-status.ts
 function parseNameStatusLines(lines) {
@@ -33444,8 +33727,8 @@ async function listChangedFilesForCommit(repoGitCwd, repoRelPath, commitSha) {
 }
 
 // src/git/working-directory/changes/list-changed-files-for-repo.ts
-import * as fs16 from "node:fs";
-import * as path14 from "node:path";
+import * as fs17 from "node:fs";
+import * as path15 from "node:path";
 
 // src/git/working-directory/changes/count-lines.ts
 import { createReadStream } from "node:fs";
@@ -33469,7 +33752,7 @@ async function countTextFileLines(absFile) {
 }
 
 // src/git/working-directory/changes/hydrate-patch.ts
-import * as fs15 from "node:fs";
+import * as fs16 from "node:fs";
 var UNIFIED_HUNK_HEADER_RE = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
 var MAX_HYDRATE_LINES_PER_GAP = 8e3;
 var MAX_HYDRATE_LINES_PER_FILE = 8e4;
@@ -33484,7 +33767,7 @@ async function readGitBlobLines(repoCwd, pathInRepo) {
 }
 async function readWorktreeFileLines(abs) {
   try {
-    const raw = await fs15.promises.readFile(abs, "utf8");
+    const raw = await fs16.promises.readFile(abs, "utf8");
     return raw.split(/\r?\n/);
   } catch {
     return null;
@@ -33619,7 +33902,7 @@ async function listChangedFilesForRepo(repoGitCwd, repoRelPath) {
   const rows = [];
   for (const pathInRepo of paths) {
     const relLauncher = posixJoinDirFile(repoRelPath, pathInRepo.replace(/\\/g, "/"));
-    const abs = path14.join(repoGitCwd, pathInRepo);
+    const abs = path15.join(repoGitCwd, pathInRepo);
     const nums = numByPath.get(pathInRepo);
     let additions = nums?.additions ?? 0;
     let deletions = nums?.deletions ?? 0;
@@ -33632,7 +33915,7 @@ async function listChangedFilesForRepo(repoGitCwd, repoRelPath) {
         deletions = fromGit.deletions;
       } else {
         try {
-          const st = await fs16.promises.stat(abs);
+          const st = await fs17.promises.stat(abs);
           if (st.isFile()) additions = await countTextFileLines(abs);
           else additions = 0;
         } catch {
@@ -33658,7 +33941,7 @@ async function listChangedFilesForRepo(repoGitCwd, repoRelPath) {
     } else {
       pathInRepo = row.pathRelLauncher;
     }
-    const absFile = path14.join(repoGitCwd, pathInRepo);
+    const absFile = path15.join(repoGitCwd, pathInRepo);
     let patch = await unifiedDiffForFile(repoGitCwd, pathInRepo, row.change);
     if (patch) {
       patch = await hydrateUnifiedPatchWithFileContext(patch, absFile, repoGitCwd, pathInRepo, row.change);
@@ -33674,8 +33957,8 @@ function normRepoRel(p) {
   return x === "" ? "." : x;
 }
 async function getWorkingTreeChangeRepoDetails(options) {
-  const launcher = path15.resolve(getBridgeWorkspaceDirectory());
-  const mirror = options.agentMirrorRootAbs ? path15.resolve(options.agentMirrorRootAbs) : null;
+  const launcher = path16.resolve(getBridgeWorkspaceDirectory());
+  const mirror = options.agentMirrorRootAbs ? path16.resolve(options.agentMirrorRootAbs) : null;
   const out = [];
   const filter = options.repoFilterRelPath != null ? normRepoRel(options.repoFilterRelPath) : null;
   const basisInput = options.basis ?? { kind: "working" };
@@ -33687,7 +33970,7 @@ async function getWorkingTreeChangeRepoDetails(options) {
   }
   const basis = filter == null && basisInput.kind === "commit" ? { kind: "working" } : basisInput;
   for (const target of options.commitTargetAbsDirs) {
-    const t = path15.resolve(target);
+    const t = path16.resolve(target);
     if (!await isGitRepoDirectory(t)) continue;
     const g = simpleGit(t);
     let branch = "HEAD";
@@ -33700,7 +33983,7 @@ async function getWorkingTreeChangeRepoDetails(options) {
     const remoteDisplay = formatRemoteDisplayLabel(remoteUrl);
     let repoRelPath;
     if (mirror) {
-      const relNorm = path15.relative(mirror, path15.dirname(t));
+      const relNorm = path16.relative(mirror, path16.dirname(t));
       repoRelPath = relNorm === "" ? "." : relNorm.replace(/\\/g, "/");
     } else {
       let top = t;
@@ -33709,8 +33992,8 @@ async function getWorkingTreeChangeRepoDetails(options) {
       } catch {
         top = t;
       }
-      const rel = path15.relative(launcher, path15.resolve(top)).replace(/\\/g, "/") || ".";
-      repoRelPath = rel.startsWith("..") ? path15.basename(path15.resolve(top)) : rel;
+      const rel = path16.relative(launcher, path16.resolve(top)).replace(/\\/g, "/") || ".";
+      repoRelPath = rel.startsWith("..") ? path16.basename(path16.resolve(top)) : rel;
     }
     const norm = normRepoRel(repoRelPath === "" ? "." : repoRelPath);
     if (filter && norm !== filter) continue;
@@ -33802,7 +34085,7 @@ var SessionWorktreeManager = class {
     }
     if (!opts.isNewSession) {
       const agentCwd = this.sessionAgentCwd.get(sessionId);
-      if (agentCwd) return path16.resolve(agentCwd);
+      if (agentCwd) return path17.resolve(agentCwd);
       return void 0;
     }
     const prep = await prepareNewSessionWorktrees({
@@ -33815,7 +34098,7 @@ var SessionWorktreeManager = class {
     if (!prep) return void 0;
     this.sessionPaths.set(sessionId, prep.worktreePaths);
     this.sessionAgentCwd.set(sessionId, prep.agentCwd);
-    return path16.resolve(prep.agentCwd);
+    return path17.resolve(prep.agentCwd);
   }
   async renameSessionBranch(sessionId, newBranch) {
     const paths = this.sessionPaths.get(sessionId);
@@ -33836,7 +34119,7 @@ var SessionWorktreeManager = class {
   getAgentCwdForSession(sessionId) {
     if (!sessionId) return null;
     const c = this.sessionAgentCwd.get(sessionId);
-    return c ? path16.resolve(c) : null;
+    return c ? path17.resolve(c) : null;
   }
   async removeSessionWorktrees(sessionId) {
     const paths = this.sessionPaths.get(sessionId);
@@ -33884,30 +34167,30 @@ var SessionWorktreeManager = class {
   }
 };
 function defaultWorktreesRootAbs() {
-  return path16.join(os4.homedir(), ".buildautomaton", "worktrees");
+  return path17.join(os4.homedir(), ".buildautomaton", "worktrees");
 }
 
 // src/files/watch-file-index.ts
 import { watch } from "node:fs";
-import path23 from "node:path";
+import path24 from "node:path";
 
 // src/files/index/build-file-index.ts
-import path20 from "node:path";
+import path21 from "node:path";
 
 // src/runtime/yield-to-event-loop.ts
 function yieldToEventLoop() {
-  return new Promise((resolve16) => setImmediate(resolve16));
+  return new Promise((resolve17) => setImmediate(resolve17));
 }
 
 // src/files/index/walk-workspace-tree.ts
-import fs17 from "node:fs";
-import path18 from "node:path";
+import fs18 from "node:fs";
+import path19 from "node:path";
 
 // src/files/index/constants.ts
-import path17 from "node:path";
+import path18 from "node:path";
 import os5 from "node:os";
 var INDEX_WORK_YIELD_EVERY = 256;
-var INDEX_DIR = path17.join(os5.homedir(), ".buildautomaton");
+var INDEX_DIR = path18.join(os5.homedir(), ".buildautomaton");
 var INDEX_HASH_LEN = 16;
 var INDEX_VERSION = 2;
 var INDEX_LOG_PREFIX = "[file-index]";
@@ -33916,23 +34199,23 @@ var INDEX_LOG_PREFIX = "[file-index]";
 function walkWorkspaceTreeSync(dir, baseDir, out) {
   let names;
   try {
-    names = fs17.readdirSync(dir);
+    names = fs18.readdirSync(dir);
   } catch {
     return;
   }
   for (const name of names) {
     if (name.startsWith(".")) continue;
-    const full = path18.join(dir, name);
-    let stat2;
+    const full = path19.join(dir, name);
+    let stat3;
     try {
-      stat2 = fs17.statSync(full);
+      stat3 = fs18.statSync(full);
     } catch {
       continue;
     }
-    const relative5 = path18.relative(baseDir, full).replace(/\\/g, "/");
-    if (stat2.isDirectory()) {
+    const relative5 = path19.relative(baseDir, full).replace(/\\/g, "/");
+    if (stat3.isDirectory()) {
       walkWorkspaceTreeSync(full, baseDir, out);
-    } else if (stat2.isFile()) {
+    } else if (stat3.isFile()) {
       out.push(relative5);
     }
   }
@@ -33940,7 +34223,7 @@ function walkWorkspaceTreeSync(dir, baseDir, out) {
 async function walkWorkspaceTreeAsync(dir, baseDir, out, state) {
   let names;
   try {
-    names = await fs17.promises.readdir(dir);
+    names = await fs18.promises.readdir(dir);
   } catch {
     return;
   }
@@ -33950,17 +34233,17 @@ async function walkWorkspaceTreeAsync(dir, baseDir, out, state) {
       await yieldToEventLoop();
     }
     state.n++;
-    const full = path18.join(dir, name);
-    let stat2;
+    const full = path19.join(dir, name);
+    let stat3;
     try {
-      stat2 = await fs17.promises.stat(full);
+      stat3 = await fs18.promises.stat(full);
     } catch {
       continue;
     }
-    const relative5 = path18.relative(baseDir, full).replace(/\\/g, "/");
-    if (stat2.isDirectory()) {
+    const relative5 = path19.relative(baseDir, full).replace(/\\/g, "/");
+    if (stat3.isDirectory()) {
       await walkWorkspaceTreeAsync(full, baseDir, out, state);
-    } else if (stat2.isFile()) {
+    } else if (stat3.isFile()) {
       out.push(relative5);
     }
   }
@@ -34038,22 +34321,22 @@ async function buildTrigramMapForPathsAsync(paths) {
 }
 
 // src/files/index/write-index-file.ts
-import fs18 from "node:fs";
+import fs19 from "node:fs";
 
 // src/files/index/paths.ts
-import path19 from "node:path";
+import path20 from "node:path";
 import crypto2 from "node:crypto";
 function getIndexPathForCwd(resolvedCwd) {
   const hash = crypto2.createHash("sha256").update(resolvedCwd).digest("hex").slice(0, INDEX_HASH_LEN);
-  return path19.join(INDEX_DIR, `.file-index-${hash}.json`);
+  return path20.join(INDEX_DIR, `.file-index-${hash}.json`);
 }
 
 // src/files/index/write-index-file.ts
 function writeIndexFileSync(resolvedCwd, data) {
   const indexPath = getIndexPathForCwd(resolvedCwd);
   try {
-    if (!fs18.existsSync(INDEX_DIR)) fs18.mkdirSync(INDEX_DIR, { recursive: true });
-    fs18.writeFileSync(indexPath, JSON.stringify(data), "utf8");
+    if (!fs19.existsSync(INDEX_DIR)) fs19.mkdirSync(INDEX_DIR, { recursive: true });
+    fs19.writeFileSync(indexPath, JSON.stringify(data), "utf8");
   } catch (e) {
     console.error(`${INDEX_LOG_PREFIX} Failed to write index:`, e);
   }
@@ -34061,8 +34344,8 @@ function writeIndexFileSync(resolvedCwd, data) {
 async function writeIndexFileAsync(resolvedCwd, data) {
   const indexPath = getIndexPathForCwd(resolvedCwd);
   try {
-    await fs18.promises.mkdir(INDEX_DIR, { recursive: true });
-    await fs18.promises.writeFile(indexPath, JSON.stringify(data), "utf8");
+    await fs19.promises.mkdir(INDEX_DIR, { recursive: true });
+    await fs19.promises.writeFile(indexPath, JSON.stringify(data), "utf8");
   } catch (e) {
     console.error(`${INDEX_LOG_PREFIX} Failed to write index:`, e);
   }
@@ -34076,7 +34359,7 @@ function sortPaths(paths) {
   paths.sort((a, b) => a.localeCompare(b, void 0, { sensitivity: "base" }));
 }
 function buildFileIndex(cwd) {
-  const resolved = path20.resolve(cwd);
+  const resolved = path21.resolve(cwd);
   const paths = [];
   walkWorkspaceTreeSync(resolved, resolved, paths);
   sortPaths(paths);
@@ -34086,7 +34369,7 @@ function buildFileIndex(cwd) {
   return data;
 }
 async function buildFileIndexAsync(cwd) {
-  const resolved = path20.resolve(cwd);
+  const resolved = path21.resolve(cwd);
   const paths = [];
   await walkWorkspaceTreeAsync(resolved, resolved, paths, createWalkYieldState());
   await yieldToEventLoop();
@@ -34098,13 +34381,13 @@ async function buildFileIndexAsync(cwd) {
 }
 
 // src/files/index/load-file-index.ts
-import fs19 from "node:fs";
-import path21 from "node:path";
+import fs20 from "node:fs";
+import path22 from "node:path";
 function loadFileIndex(cwd) {
-  const resolved = path21.resolve(cwd);
+  const resolved = path22.resolve(cwd);
   const indexPath = getIndexPathForCwd(resolved);
   try {
-    const raw = fs19.readFileSync(indexPath, "utf8");
+    const raw = fs20.readFileSync(indexPath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed !== null && typeof parsed === "object" && Array.isArray(parsed.paths)) {
       const obj = parsed;
@@ -34123,9 +34406,9 @@ function loadFileIndex(cwd) {
 }
 
 // src/files/index/ensure-file-index.ts
-import path22 from "node:path";
+import path23 from "node:path";
 async function ensureFileIndexAsync(cwd) {
-  const resolved = path22.resolve(cwd);
+  const resolved = path23.resolve(cwd);
   const cached2 = loadFileIndex(resolved);
   if (cached2 !== null) return { data: cached2, fromCache: true };
   const data = await buildFileIndexAsync(resolved);
@@ -34208,7 +34491,7 @@ function createFsWatcher(resolved, schedule) {
   }
 }
 function startFileIndexWatcher(cwd = getBridgeWorkspaceDirectory()) {
-  const resolved = path23.resolve(cwd);
+  const resolved = path24.resolve(cwd);
   void buildFileIndexAsync(resolved).catch((e) => {
     console.error("[file-index] Initial index build failed:", e);
   });
@@ -34236,7 +34519,7 @@ function startFileIndexWatcher(cwd = getBridgeWorkspaceDirectory()) {
 }
 
 // src/dev-servers/manager/dev-server-manager.ts
-import { rm } from "node:fs/promises";
+import { rm as rm2 } from "node:fs/promises";
 
 // src/dev-servers/process/send-server-status.ts
 function sendDevServerStatus(getWs, serverId, status, options) {
@@ -34255,15 +34538,15 @@ function sendDevServerStatus(getWs, serverId, status, options) {
 
 // src/dev-servers/process/terminate-child-process.ts
 async function sigtermAndWaitForExit(proc, graceMs, log2, shortId) {
-  const exited = new Promise((resolve16) => {
-    proc.once("exit", () => resolve16());
+  const exited = new Promise((resolve17) => {
+    proc.once("exit", () => resolve17());
   });
   log2(`[dev-server] Sending SIGTERM to ${shortId} (pid=${proc.pid ?? "?"}).`);
   try {
     proc.kill("SIGTERM");
   } catch {
   }
-  await Promise.race([exited, new Promise((resolve16) => setTimeout(resolve16, graceMs))]);
+  await Promise.race([exited, new Promise((resolve17) => setTimeout(resolve17, graceMs))]);
 }
 function forceKillChild(proc, log2, shortId, graceMs) {
   log2(
@@ -34277,7 +34560,7 @@ function forceKillChild(proc, log2, shortId, graceMs) {
 }
 
 // src/dev-servers/process/wire-dev-server-child-process.ts
-import fs20 from "node:fs";
+import fs21 from "node:fs";
 
 // src/dev-servers/manager/forward-pipe.ts
 function forwardChildPipe(childReadable, terminal, onData) {
@@ -34313,7 +34596,7 @@ function wireDevServerChildProcess(d) {
         d.setPollInterval(void 0);
         return;
       }
-      fs20.readFile(d.mergedLogPath, (err, buf) => {
+      fs21.readFile(d.mergedLogPath, (err, buf) => {
         if (err || (d.getSpawnGeneration() ?? 0) !== d.scheduledGen) return;
         if (buf.length <= d.mergedReadPos.value) return;
         const chunk = Buffer.from(buf.subarray(d.mergedReadPos.value));
@@ -34351,7 +34634,7 @@ ${errTail}` : ""}`);
       d.sendStatus(code === 0 || code == null ? "stopped" : "error", detail, tails);
     };
     if (mergedPath) {
-      fs20.readFile(mergedPath, (err, buf) => {
+      fs21.readFile(mergedPath, (err, buf) => {
         if (!err && buf.length > d.mergedReadPos.value) {
           const chunk = Buffer.from(buf.subarray(d.mergedReadPos.value));
           if (chunk.length > 0) {
@@ -34453,13 +34736,13 @@ function parseDevServerDefs(servers) {
 }
 
 // src/dev-servers/manager/shell-spawn/utils.ts
-import fs21 from "node:fs";
+import fs22 from "node:fs";
 function isSpawnEbadf(e) {
   return typeof e === "object" && e !== null && "code" in e && e.code === "EBADF";
 }
 function rmDirQuiet(dir) {
   try {
-    fs21.rmSync(dir, { recursive: true, force: true });
+    fs22.rmSync(dir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -34467,7 +34750,7 @@ var cachedDevNullReadFd;
 function devNullReadFd() {
   if (cachedDevNullReadFd === void 0) {
     const devPath = process.platform === "win32" ? "nul" : "/dev/null";
-    cachedDevNullReadFd = fs21.openSync(devPath, "r");
+    cachedDevNullReadFd = fs22.openSync(devPath, "r");
   }
   return cachedDevNullReadFd;
 }
@@ -34541,15 +34824,15 @@ function trySpawnShellTruePiped(command, env, cwd, devNullFd, signal) {
 
 // src/dev-servers/manager/shell-spawn/try-spawn-merged-log-file.ts
 import { spawn as spawn6 } from "node:child_process";
-import fs22 from "node:fs";
+import fs23 from "node:fs";
 import { tmpdir } from "node:os";
-import path24 from "node:path";
+import path25 from "node:path";
 function trySpawnMergedLogFile(command, env, cwd, signal) {
-  const tmpRoot = fs22.mkdtempSync(path24.join(tmpdir(), "ba-devsrv-log-"));
-  const logPath = path24.join(tmpRoot, "combined.log");
+  const tmpRoot = fs23.mkdtempSync(path25.join(tmpdir(), "ba-devsrv-log-"));
+  const logPath = path25.join(tmpRoot, "combined.log");
   let logFd;
   try {
-    logFd = fs22.openSync(logPath, "a");
+    logFd = fs23.openSync(logPath, "a");
   } catch {
     rmDirQuiet(tmpRoot);
     return null;
@@ -34568,7 +34851,7 @@ function trySpawnMergedLogFile(command, env, cwd, signal) {
     } else {
       proc = spawn6("/bin/sh", ["-c", command], { env, cwd, stdio, ...signal ? { signal } : {} });
     }
-    fs22.closeSync(logFd);
+    fs23.closeSync(logFd);
     return {
       proc,
       pipedStdoutStderr: true,
@@ -34577,7 +34860,7 @@ function trySpawnMergedLogFile(command, env, cwd, signal) {
     };
   } catch (e) {
     try {
-      fs22.closeSync(logFd);
+      fs23.closeSync(logFd);
     } catch {
     }
     rmDirQuiet(tmpRoot);
@@ -34588,22 +34871,22 @@ function trySpawnMergedLogFile(command, env, cwd, signal) {
 
 // src/dev-servers/manager/shell-spawn/try-spawn-shell-script-log-redirect.ts
 import { spawn as spawn7 } from "node:child_process";
-import fs23 from "node:fs";
+import fs24 from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import path25 from "node:path";
+import path26 from "node:path";
 function shSingleQuote(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
 function trySpawnShellScriptLogRedirectUnix(command, env, cwd, signal) {
-  const tmpRoot = fs23.mkdtempSync(path25.join(tmpdir2(), "ba-devsrv-sh-"));
-  const logPath = path25.join(tmpRoot, "combined.log");
-  const innerPath = path25.join(tmpRoot, "_cmd.sh");
-  const runnerPath = path25.join(tmpRoot, "_run.sh");
+  const tmpRoot = fs24.mkdtempSync(path26.join(tmpdir2(), "ba-devsrv-sh-"));
+  const logPath = path26.join(tmpRoot, "combined.log");
+  const innerPath = path26.join(tmpRoot, "_cmd.sh");
+  const runnerPath = path26.join(tmpRoot, "_run.sh");
   try {
-    fs23.writeFileSync(innerPath, `#!/bin/sh
+    fs24.writeFileSync(innerPath, `#!/bin/sh
 ${command}
 `);
-    fs23.writeFileSync(
+    fs24.writeFileSync(
       runnerPath,
       `#!/bin/sh
 cd ${shSingleQuote(cwd)}
@@ -34629,13 +34912,13 @@ cd ${shSingleQuote(cwd)}
   }
 }
 function trySpawnShellScriptLogRedirectWin(command, env, cwd, signal) {
-  const tmpRoot = fs23.mkdtempSync(path25.join(tmpdir2(), "ba-devsrv-sh-"));
-  const logPath = path25.join(tmpRoot, "combined.log");
-  const runnerPath = path25.join(tmpRoot, "_run.bat");
+  const tmpRoot = fs24.mkdtempSync(path26.join(tmpdir2(), "ba-devsrv-sh-"));
+  const logPath = path26.join(tmpRoot, "combined.log");
+  const runnerPath = path26.join(tmpRoot, "_run.bat");
   const q = (p) => `"${p.replace(/"/g, '""')}"`;
   const com = process.env.ComSpec || "cmd.exe";
   try {
-    fs23.writeFileSync(
+    fs24.writeFileSync(
       runnerPath,
       `@ECHO OFF\r
 CD /D ${q(cwd)}\r
@@ -34745,8 +35028,90 @@ var StreamTail = class {
   }
 };
 
-// src/dev-servers/manager/dev-server-manager.ts
+// src/dev-servers/manager/dev-server-constants.ts
 var BRIDGE_SHUTDOWN_GRACE_MS = 8e3;
+
+// src/dev-servers/manager/dev-server-firehose-messages.ts
+function buildFirehoseSnapshotMessage(params) {
+  const payload = {
+    type: "log_snapshot",
+    serverId: params.serverId,
+    viewerId: params.viewerId,
+    stdoutTail: params.tails.stdout,
+    stderrTail: params.tails.stderr
+  };
+  return params.e2ee ? params.e2ee.encryptFields(payload, ["stdoutTail", "stderrTail"]) : payload;
+}
+function buildFirehoseLogChunkMessage(params) {
+  const payload = {
+    type: "log_chunk",
+    serverId: params.serverId,
+    stream: params.stream,
+    text: params.text
+  };
+  return params.e2ee ? params.e2ee.encryptFields(payload, ["text"]) : payload;
+}
+
+// src/dev-servers/manager/dev-server-firehose-sink.ts
+var DevServerFirehoseSink = class {
+  constructor(options) {
+    this.options = options;
+  }
+  logViewerRefCountByServerId = /* @__PURE__ */ new Map();
+  firehoseSend = null;
+  attach(send) {
+    this.firehoseSend = send;
+  }
+  detach() {
+    this.firehoseSend = null;
+    this.logViewerRefCountByServerId.clear();
+  }
+  openLogViewer(serverId, viewerId) {
+    const next = (this.logViewerRefCountByServerId.get(serverId) ?? 0) + 1;
+    this.logViewerRefCountByServerId.set(serverId, next);
+    this.sendSnapshot(serverId, viewerId);
+  }
+  closeLogViewer(serverId) {
+    const n = (this.logViewerRefCountByServerId.get(serverId) ?? 0) - 1;
+    if (n <= 0) this.logViewerRefCountByServerId.delete(serverId);
+    else this.logViewerRefCountByServerId.set(serverId, n);
+  }
+  pushLogChunk(serverId, stream, chunk) {
+    if ((this.logViewerRefCountByServerId.get(serverId) ?? 0) <= 0) return;
+    if (!this.options.isPipedCaptureEnabled(serverId)) return;
+    if (!this.firehoseSend) return;
+    const text = chunk.toString("utf8");
+    setImmediate(() => {
+      if (!this.firehoseSend) return;
+      this.firehoseSend(buildFirehoseLogChunkMessage({ serverId, stream, text, e2ee: this.options.e2ee }));
+    });
+  }
+  sendSnapshot(serverId, viewerId) {
+    const payload = buildFirehoseSnapshotMessage({
+      serverId,
+      viewerId,
+      tails: this.options.getTails(serverId),
+      e2ee: this.options.e2ee
+    });
+    setImmediate(() => {
+      const send = this.firehoseSend;
+      if (!send) return;
+      send(payload);
+    });
+  }
+};
+
+// src/dev-servers/manager/cleanup-merged-log-dir.ts
+import { rm } from "node:fs/promises";
+function cleanupMergedLogDirForServer(map2, serverId) {
+  const mergedDir = map2.get(serverId);
+  if (!mergedDir) return;
+  map2.delete(serverId);
+  void rm(mergedDir, { recursive: true, force: true }).catch(() => {
+  });
+}
+
+// src/dev-servers/manager/dev-server-manager.ts
 var emptyTails = () => ({ stdout: [], stderr: [] });
 var DevServerManager = class {
   defsById = /* @__PURE__ */ new Map();
@@ -34754,66 +35119,36 @@ var DevServerManager = class {
   streamTailsByServerId = /* @__PURE__ */ new Map();
   spawnGenerationByServerId = /* @__PURE__ */ new Map();
   pipedCaptureByServerId = /* @__PURE__ */ new Map();
-  logViewerRefCountByServerId = /* @__PURE__ */ new Map();
-  firehoseSend = null;
   mergedLogPollByServerId = /* @__PURE__ */ new Map();
   mergedLogCleanupDirByServerId = /* @__PURE__ */ new Map();
   abortControllersByServerId = /* @__PURE__ */ new Map();
   getWs;
   log;
   getBridgeCwd;
+  e2ee;
+  firehoseSink;
   constructor(options) {
     this.getWs = options.getWs;
     this.log = options.log;
     this.getBridgeCwd = options.getBridgeCwd ?? (() => process.cwd());
+    this.e2ee = options.e2ee;
+    this.firehoseSink = new DevServerFirehoseSink({
+      getTails: (serverId) => this.snapshotTails(serverId),
+      isPipedCaptureEnabled: (serverId) => this.pipedCaptureByServerId.get(serverId) === true,
+      e2ee: this.e2ee
+    });
   }
   attachFirehose(send) {
-    this.firehoseSend = send;
+    this.firehoseSink.attach(send);
   }
   detachFirehose() {
-    this.firehoseSend = null;
-    this.logViewerRefCountByServerId.clear();
+    this.firehoseSink.detach();
   }
   handleFirehoseLogViewerOpen(serverId, _viewerId) {
-    const next = (this.logViewerRefCountByServerId.get(serverId) ?? 0) + 1;
-    this.logViewerRefCountByServerId.set(serverId, next);
-    this.sendSnapshotToFirehose(serverId, _viewerId);
+    this.firehoseSink.openLogViewer(serverId, _viewerId);
   }
   handleFirehoseLogViewerClose(serverId, _viewerId) {
-    const n = (this.logViewerRefCountByServerId.get(serverId) ?? 0) - 1;
-    if (n <= 0) this.logViewerRefCountByServerId.delete(serverId);
-    else this.logViewerRefCountByServerId.set(serverId, n);
-  }
-  sendSnapshotToFirehose(serverId, viewerId) {
-    const tails = this.streamTailsByServerId.get(serverId);
-    const payload = {
-      type: "log_snapshot",
-      serverId,
-      viewerId,
-      stdoutTail: tails?.stdout.getTail() ?? [],
-      stderrTail: tails?.stderr.getTail() ?? []
-    };
-    setImmediate(() => {
-      const send = this.firehoseSend;
-      if (!send) return;
-      send(payload);
-    });
-  }
-  pushRemoteLogChunk(serverId, stream, chunk) {
-    if ((this.logViewerRefCountByServerId.get(serverId) ?? 0) <= 0) return;
-    if (!this.pipedCaptureByServerId.get(serverId)) return;
-    const send = this.firehoseSend;
-    if (!send) return;
-    const text = chunk.toString("utf8");
-    setImmediate(() => {
-      if (!this.firehoseSend) return;
-      this.firehoseSend({
-        type: "log_chunk",
-        serverId,
-        stream,
-        text
-      });
-    });
+    this.firehoseSink.closeLogViewer(serverId);
   }
   applyConfig(servers) {
     this.defsById.clear();
@@ -34866,12 +35201,7 @@ var DevServerManager = class {
     }
     this.clearTails(serverId);
     this.pipedCaptureByServerId.delete(serverId);
-    const mergedDir = this.mergedLogCleanupDirByServerId.get(serverId);
-    if (mergedDir) {
-      this.mergedLogCleanupDirByServerId.delete(serverId);
-      void rm(mergedDir, { recursive: true, force: true }).catch(() => {
-      });
-    }
+    cleanupMergedLogDirForServer(this.mergedLogCleanupDirByServerId, serverId);
     this.sendStatus(serverId, "stopped", void 0, tails);
   }
   start(serverId) {
@@ -34954,7 +35284,7 @@ var DevServerManager = class {
         log: this.log,
         stdoutTail,
         stderrTail,
-        pushRemoteLogChunk: (sid, stream, chunk) => this.pushRemoteLogChunk(sid, stream, chunk),
+        pushRemoteLogChunk: (sid, stream, chunk) => this.firehoseSink.pushLogChunk(sid, stream, chunk),
         sendStatus: (status, detail, tails) => this.sendStatus(serverId, status, detail, tails),
         setPollInterval: (iv) => {
           if (iv) this.mergedLogPollByServerId.set(serverId, iv);
@@ -34968,7 +35298,7 @@ var DevServerManager = class {
           this.mergedLogCleanupDirByServerId.delete(serverId);
         },
         rmMergedCleanupDir: (dir) => {
-          void rm(dir, { recursive: true, force: true }).catch(() => {
+          void rm2(dir, { recursive: true, force: true }).catch(() => {
           });
         },
         clearTailBuffers: () => this.clearTails(serverId)
@@ -35005,12 +35335,7 @@ var DevServerManager = class {
     this.processes.delete(serverId);
     this.clearPoll(serverId);
     this.pipedCaptureByServerId.delete(serverId);
-    const mergedDir = this.mergedLogCleanupDirByServerId.get(serverId);
-    if (mergedDir) {
-      this.mergedLogCleanupDirByServerId.delete(serverId);
-      void rm(mergedDir, { recursive: true, force: true }).catch(() => {
-      });
-    }
+    cleanupMergedLogDirForServer(this.mergedLogCleanupDirByServerId, serverId);
     const tails = this.snapshotTails(serverId);
     this.clearTails(serverId);
     this.sendStatus(serverId, "unknown", "Bridge closed before process exited", tails);
@@ -35104,7 +35429,7 @@ async function proxyToLocal(request) {
   };
   const maxAttempts = isIdempotentProxyMethod(request.method) ? LOCAL_PREVIEW_FETCH_RETRY_DELAYS_MS.length + 1 : 1;
   for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-    const once = await new Promise((resolve16) => {
+    const once = await new Promise((resolve17) => {
       const req = mod.request(opts, (res) => {
         const chunks = [];
         res.on("data", (c) => chunks.push(c));
@@ -35115,7 +35440,7 @@ async function proxyToLocal(request) {
             if (typeof v === "string") headers[k] = v;
             else if (Array.isArray(v) && v[0]) headers[k] = v[0];
           }
-          resolve16({
+          resolve17({
             id: request.id,
             statusCode: res.statusCode ?? 0,
             headers,
@@ -35124,7 +35449,7 @@ async function proxyToLocal(request) {
         });
       });
       req.on("error", (err) => {
-        resolve16({
+        resolve17({
           id: request.id,
           statusCode: 0,
           headers: {},
@@ -35485,30 +35810,30 @@ function createOnBridgeIdentified(opts) {
 }
 
 // src/skills/discover-local-agent-skills.ts
-import fs24 from "node:fs";
-import path26 from "node:path";
+import fs25 from "node:fs";
+import path27 from "node:path";
 var SKILL_DISCOVERY_ROOTS = [".agents/skills", ".claude/skills", ".cursor/skills", "skills"];
 function discoverLocalSkills(cwd) {
   const out = [];
   const seenKeys = /* @__PURE__ */ new Set();
   for (const rel of SKILL_DISCOVERY_ROOTS) {
-    const base = path26.join(cwd, rel);
-    if (!fs24.existsSync(base) || !fs24.statSync(base).isDirectory()) continue;
+    const base = path27.join(cwd, rel);
+    if (!fs25.existsSync(base) || !fs25.statSync(base).isDirectory()) continue;
     let entries = [];
     try {
-      entries = fs24.readdirSync(base);
+      entries = fs25.readdirSync(base);
     } catch {
       continue;
     }
     for (const name of entries) {
-      const dir = path26.join(base, name);
+      const dir = path27.join(base, name);
       try {
-        if (!fs24.statSync(dir).isDirectory()) continue;
+        if (!fs25.statSync(dir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const skillMd = path26.join(dir, "SKILL.md");
-      if (!fs24.existsSync(skillMd)) continue;
+      const skillMd = path27.join(dir, "SKILL.md");
+      if (!fs25.existsSync(skillMd)) continue;
       const key = `${rel}/${name}`;
       if (seenKeys.has(key)) continue;
       seenKeys.add(key);
@@ -35520,23 +35845,23 @@ function discoverLocalSkills(cwd) {
 function discoverSkillLayoutRoots(cwd) {
   const roots = [];
   for (const rel of SKILL_DISCOVERY_ROOTS) {
-    const base = path26.join(cwd, rel);
-    if (!fs24.existsSync(base) || !fs24.statSync(base).isDirectory()) continue;
+    const base = path27.join(cwd, rel);
+    if (!fs25.existsSync(base) || !fs25.statSync(base).isDirectory()) continue;
     let entries = [];
     try {
-      entries = fs24.readdirSync(base);
+      entries = fs25.readdirSync(base);
     } catch {
       continue;
     }
     const skills2 = [];
     for (const name of entries) {
-      const dir = path26.join(base, name);
+      const dir = path27.join(base, name);
       try {
-        if (!fs24.statSync(dir).isDirectory()) continue;
+        if (!fs25.statSync(dir).isDirectory()) continue;
       } catch {
         continue;
       }
-      if (!fs24.existsSync(path26.join(dir, "SKILL.md"))) continue;
+      if (!fs25.existsSync(path27.join(dir, "SKILL.md"))) continue;
       const relPath = `${rel}/${name}`.replace(/\\/g, "/");
       skills2.push({ name, relPath });
     }
@@ -35638,7 +35963,7 @@ function reportGitRepos(getWs, log2) {
 var handleAuthToken = (msg, { log: log2 }) => {
   if (typeof msg.token !== "string") return;
   log2("Received auth token. Save it for future runs:");
-  log2(`  export BUILDAMATON_AUTH_TOKEN="${msg.token}"`);
+  log2(`  export BUILDAUTOMATON_AUTH_TOKEN="${msg.token}"`);
 };
 
 // src/bridge/routing/handlers/bridge-identified.ts
@@ -35681,13 +36006,13 @@ var handleAgentConfigMessage = (msg, deps) => {
 };
 
 // src/agents/acp/from-bridge/handle-bridge-prompt.ts
-import * as path28 from "node:path";
+import * as path29 from "node:path";
 import { execFile as execFile10 } from "node:child_process";
 import { promisify as promisify10 } from "node:util";
 
 // src/git/bridge-queue-key.ts
-import * as path27 from "node:path";
-import { createHash } from "node:crypto";
+import * as path28 from "node:path";
+import { createHash as createHash2 } from "node:crypto";
 function normalizeCanonicalGitUrl(url2) {
   let s = url2.trim();
   if (!s) return s;
@@ -35711,14 +36036,14 @@ function normalizeCanonicalGitUrl(url2) {
 }
 function canonicalUrlToRepoIdSync(url2) {
   const normalized = normalizeCanonicalGitUrl(url2);
-  return createHash("sha256").update(normalized).digest("hex").slice(0, 32);
+  return createHash2("sha256").update(normalized).digest("hex").slice(0, 32);
 }
 function fallbackRepoIdFromPath(absPath) {
-  return createHash("sha256").update(path27.resolve(absPath)).digest("hex").slice(0, 32);
+  return createHash2("sha256").update(path28.resolve(absPath)).digest("hex").slice(0, 32);
 }
 async function resolveBridgeQueueBindFields(options) {
   const { effectiveCwd, worktreePaths, primaryRepoRoots, log: log2 } = options;
-  const cwdAbs = worktreePaths.length > 0 ? path27.resolve(worktreePaths[0]) : path27.resolve(effectiveCwd);
+  const cwdAbs = worktreePaths.length > 0 ? path28.resolve(worktreePaths[0]) : path28.resolve(effectiveCwd);
   if (!primaryRepoRoots.length) {
     log2("[Bridge service] Prompt queue bind skipped: no Git repository roots under the working directory.");
     return null;
@@ -35758,21 +36083,28 @@ function handleBridgePrompt(msg, deps) {
   const sessionId = msg.sessionId;
   const runId = typeof msg.runId === "string" ? msg.runId : void 0;
   const promptId = typeof msg.id === "string" ? msg.id : void 0;
+  const sendBridgeMessage = (message, encryptedFields = []) => {
+    const s = getWs();
+    if (!s) return false;
+    const wire = deps.e2ee && encryptedFields.length > 0 ? deps.e2ee.encryptFields(message, encryptedFields) : message;
+    sendWsMessage(s, wire);
+    return true;
+  };
   if (!promptText.trim()) {
     log2(
       `[Bridge service] Prompt ignored: empty or missing prompt text (session ${typeof msg.sessionId === "string" ? msg.sessionId.slice(0, 8) : "\u2014"}\u2026, run ${typeof msg.runId === "string" ? msg.runId.slice(0, 8) : "\u2014"}\u2026).`
     );
-    const s = getWs();
-    if (s) {
-      sendWsMessage(s, {
+    sendBridgeMessage(
+      {
         type: "prompt_result",
         ...promptId ? { id: promptId } : {},
         ...sessionId ? { sessionId } : {},
         ...runId ? { runId } : {},
         success: false,
         error: "Empty or missing prompt text from the bridge; this turn was not sent to the agent."
-      });
-    }
+      },
+      ["error"]
+    );
     return;
   }
   const isNewSession = msg.isNewSession === true;
@@ -35781,8 +36113,7 @@ function handleBridgePrompt(msg, deps) {
   const mode = typeof msg.mode === "string" && msg.mode.trim() ? msg.mode.trim() : void 0;
   acpManager.logPromptReceivedFromBridge({ agentType, mode });
   const sendResult2 = (result) => {
-    const s = getWs();
-    if (s) sendWsMessage(s, result);
+    sendBridgeMessage(result, result.type === "prompt_result" ? ["output", "error"] : []);
   };
   const sendSessionUpdate = (payload) => {
     const s = getWs();
@@ -35791,11 +36122,19 @@ function handleBridgePrompt(msg, deps) {
       return;
     }
     const p = payload;
-    sendWsMessage(s, payload);
+    const wire = p.type === "session_update" && deps.e2ee ? deps.e2ee.encryptFields(payload, ["payload"]) : p.type === "session_file_change" && deps.e2ee ? deps.e2ee.encryptFields(payload, [
+      "path",
+      "oldText",
+      "newText",
+      "patchContent",
+      "isDirectory",
+      "directoryRemoved"
+    ]) : payload;
+    sendWsMessage(s, wire);
   };
   async function preambleAndPrompt(resolvedCwd) {
     const s = getWs();
-    const effectiveCwd = path28.resolve(resolvedCwd ?? getBridgeWorkspaceDirectory());
+    const effectiveCwd = path29.resolve(resolvedCwd ?? getBridgeWorkspaceDirectory());
     const worktreePaths = sessionWorktreeManager.getWorktreePathsForSession(sessionId) ?? [];
     const repoRoots = await resolveSnapshotRepoRoots({
       worktreePaths,
@@ -35903,8 +36242,8 @@ var PREVIEW_API_BASE_PATH = "/__preview";
 var PREVIEW_SECRET_HEADER = "X-Preview-Secret";
 var DEFAULT_PORT = 3e3;
 var DEFAULT_COMMAND = "npm run preview";
-var PREVIEW_COMMAND_ENV = "BUILDAMATON_PREVIEW_COMMAND";
-var PREVIEW_PORT_ENV = "BUILDAMATON_PREVIEW_PORT";
+var PREVIEW_COMMAND_ENV = "BUILDAUTOMATON_PREVIEW_COMMAND";
+var PREVIEW_PORT_ENV = "BUILDAUTOMATON_PREVIEW_PORT";
 var previewProcess = null;
 var previewPort = DEFAULT_PORT;
 var previewSecret = "";
@@ -35918,8 +36257,8 @@ function randomSecret() {
   }
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
-async function requestPreviewApi(port, secret, method, path33, body) {
-  const url2 = `http://127.0.0.1:${port}${path33}`;
+async function requestPreviewApi(port, secret, method, path34, body) {
+  const url2 = `http://127.0.0.1:${port}${path34}`;
   const headers = {
     [PREVIEW_SECRET_HEADER]: secret,
     "Content-Type": "application/json"
@@ -35931,7 +36270,7 @@ async function requestPreviewApi(port, secret, method, path33, body) {
   });
   const data = await res.json().catch(() => ({}));
   if (!res.ok) {
-    throw new Error(data?.error ?? `Preview API ${method} ${path33}: ${res.status}`);
+    throw new Error(data?.error ?? `Preview API ${method} ${path34}: ${res.status}`);
   }
   return data;
 }
@@ -35957,7 +36296,7 @@ var OPERATIONS = [
 var previewSkill = {
   id: "preview",
   name: "Preview",
-  description: "Start and manage a local preview server that implements the BuildAutomaton Preview Server API. Configure the command with BUILDAMATON_PREVIEW_COMMAND (default: npm run preview). The server receives PORT and PREVIEW_SECRET and must expose /__preview/status and /__preview/stop.",
+  description: "Start and manage a local preview server that implements the BuildAutomaton Preview Server API. Configure the command with BUILDAUTOMATON_PREVIEW_COMMAND (default: npm run preview). The server receives PORT and PREVIEW_SECRET and must expose /__preview/status and /__preview/stop.",
   operations: OPERATIONS,
   async execute(operationId, params) {
     const command = getPreviewCommand();
@@ -36094,15 +36433,15 @@ var handleSkillCallMessage = (msg, { getWs, log: log2 }) => {
 };
 
 // src/files/list-dir.ts
-import fs25 from "node:fs";
-import path30 from "node:path";
+import fs26 from "node:fs";
+import path31 from "node:path";
 
 // src/files/ensure-under-cwd.ts
-import path29 from "node:path";
+import path30 from "node:path";
 function ensureUnderCwd(relativePath, cwd = getBridgeWorkspaceDirectory()) {
-  const normalized = path29.normalize(relativePath).replace(/^(\.\/)+/, "");
-  const resolved = path29.resolve(cwd, normalized);
-  if (!resolved.startsWith(cwd + path29.sep) && resolved !== cwd) {
+  const normalized = path30.normalize(relativePath).replace(/^(\.\/)+/, "");
+  const resolved = path30.resolve(cwd, normalized);
+  if (!resolved.startsWith(cwd + path30.sep) && resolved !== cwd) {
     return null;
   }
   return resolved;
@@ -36116,7 +36455,7 @@ async function listDirAsync(relativePath) {
     return { error: "Path is outside working directory" };
   }
   try {
-    const names = await fs25.promises.readdir(resolved, { withFileTypes: true });
+    const names = await fs26.promises.readdir(resolved, { withFileTypes: true });
     const visible = names.filter((d) => !d.name.startsWith("."));
     const entries = [];
     for (let i = 0; i < visible.length; i++) {
@@ -36124,12 +36463,12 @@ async function listDirAsync(relativePath) {
         await yieldToEventLoop();
       }
       const d = visible[i];
-      const entryPath = path30.join(relativePath || ".", d.name).replace(/\\/g, "/");
-      const fullPath = path30.join(resolved, d.name);
+      const entryPath = path31.join(relativePath || ".", d.name).replace(/\\/g, "/");
+      const fullPath = path31.join(resolved, d.name);
       let isDir = d.isDirectory();
       if (d.isSymbolicLink()) {
         try {
-          const targetStat = await fs25.promises.stat(fullPath);
+          const targetStat = await fs26.promises.stat(fullPath);
           isDir = targetStat.isDirectory();
         } catch {
           isDir = false;
@@ -36154,25 +36493,25 @@ async function listDirAsync(relativePath) {
 }
 
 // src/files/read-file.ts
-import fs26 from "node:fs";
+import fs27 from "node:fs";
 import { StringDecoder } from "node:string_decoder";
 function resolveFilePath(relativePath) {
   const resolved = ensureUnderCwd(relativePath, getBridgeWorkspaceDirectory());
   if (!resolved) return { error: "Path is outside working directory" };
   let real;
   try {
-    real = fs26.realpathSync(resolved);
+    real = fs27.realpathSync(resolved);
   } catch {
     real = resolved;
   }
-  const stat2 = fs26.statSync(real);
-  if (!stat2.isFile()) return { error: "Not a file" };
+  const stat3 = fs27.statSync(real);
+  if (!stat3.isFile()) return { error: "Not a file" };
   return real;
 }
 var LINE_CHUNK_SIZE = 64 * 1024;
 function readFileRange(filePath, startLine, endLine, lineOffsetIn, lineChunkSize = LINE_CHUNK_SIZE) {
-  const fileSize = fs26.statSync(filePath).size;
-  const fd = fs26.openSync(filePath, "r");
+  const fileSize = fs27.statSync(filePath).size;
+  const fd = fs27.openSync(filePath, "r");
   const bufSize = 64 * 1024;
   const buf = Buffer.alloc(bufSize);
   const decoder = new StringDecoder("utf8");
@@ -36185,7 +36524,7 @@ function readFileRange(filePath, startLine, endLine, lineOffsetIn, lineChunkSize
   let line0Accum = "";
   try {
     let bytesRead;
-    while (!done && (bytesRead = fs26.readSync(fd, buf, 0, bufSize, null)) > 0) {
+    while (!done && (bytesRead = fs27.readSync(fd, buf, 0, bufSize, null)) > 0) {
       const text = partial2 + decoder.write(buf.subarray(0, bytesRead));
       partial2 = "";
       let lineStart = 0;
@@ -36320,10 +36659,10 @@ function readFileRange(filePath, startLine, endLine, lineOffsetIn, lineChunkSize
     }
     return { content: resultLines.join("\n"), size: fileSize };
   } finally {
-    fs26.closeSync(fd);
+    fs27.closeSync(fd);
   }
 }
-function readFile2(relativePath, startLine, endLine, lineOffset, lineChunkSize = LINE_CHUNK_SIZE) {
+function readFile3(relativePath, startLine, endLine, lineOffset, lineChunkSize = LINE_CHUNK_SIZE) {
   try {
     const result = resolveFilePath(relativePath);
     if (typeof result === "object") return result;
@@ -36331,43 +36670,45 @@ function readFile2(relativePath, startLine, endLine, lineOffset, lineChunkSize =
     if (hasRange) {
       return readFileRange(result, startLine, endLine, lineOffset, lineChunkSize);
     }
-    const stat2 = fs26.statSync(result);
-    const raw = fs26.readFileSync(result, "utf8");
+    const stat3 = fs27.statSync(result);
+    const raw = fs27.readFileSync(result, "utf8");
     const lines = raw.split(/\r?\n/);
-    return { content: raw, totalLines: lines.length, size: stat2.size };
+    return { content: raw, totalLines: lines.length, size: stat3.size };
   } catch (err) {
     return { error: err instanceof Error ? err.message : String(err) };
   }
 }
 async function readFileAsync(relativePath, startLine, endLine, lineOffset, lineChunkSize = LINE_CHUNK_SIZE) {
   await yieldToEventLoop();
-  return readFile2(relativePath, startLine, endLine, lineOffset, lineChunkSize);
+  return readFile3(relativePath, startLine, endLine, lineOffset, lineChunkSize);
 }
 
 // src/files/handle-file-browser-search.ts
 var SEARCH_LIMIT = 100;
-function handleFileBrowserSearch(msg, socket) {
+function handleFileBrowserSearch(msg, socket, e2ee) {
   void (async () => {
     await yieldToEventLoop();
     const q = typeof msg.q === "string" ? msg.q : "";
     const cwd = getBridgeWorkspaceDirectory();
     const index = loadFileIndex(cwd);
     if (index === null) {
-      sendWsMessage(socket, {
+      const payload2 = {
         type: "file_browser_search_response",
         id: msg.id,
         paths: [],
         indexReady: false
-      });
+      };
+      sendWsMessage(socket, e2ee ? e2ee.encryptFields(payload2, ["paths"]) : payload2);
       return;
     }
     const results = await searchFileIndexAsync(index, q, SEARCH_LIMIT);
-    sendWsMessage(socket, {
+    const payload = {
       type: "file_browser_search_response",
       id: msg.id,
       paths: results,
       indexReady: true
-    });
+    };
+    sendWsMessage(socket, e2ee ? e2ee.encryptFields(payload, ["paths"]) : payload);
   })();
 }
 function triggerFileIndexBuild() {
@@ -36379,7 +36720,10 @@ function triggerFileIndexBuild() {
 }
 
 // src/files/handle-file-browser-request.ts
-function handleFileBrowserRequest(msg, socket) {
+function sendFileBrowserMessage(socket, e2ee, payload) {
+  sendWsMessage(socket, e2ee ? e2ee.encryptFields(payload, ["entries", "content", "totalLines", "size", "lineOffset"]) : payload);
+}
+function handleFileBrowserRequest(msg, socket, e2ee) {
   void (async () => {
     const reqPath = msg.path.replace(/^\/+/, "") || ".";
     const op = msg.op === "read" ? "read" : "list";
@@ -36388,7 +36732,7 @@ function handleFileBrowserRequest(msg, socket) {
       if ("error" in result) {
         sendWsMessage(socket, { type: "file_browser_response", id: msg.id, error: result.error });
       } else {
-        sendWsMessage(socket, { type: "file_browser_response", id: msg.id, entries: result.entries });
+        sendFileBrowserMessage(socket, e2ee, { type: "file_browser_response", id: msg.id, entries: result.entries });
         if (reqPath === "." || reqPath === "") {
           triggerFileIndexBuild();
         }
@@ -36410,27 +36754,28 @@ function handleFileBrowserRequest(msg, socket) {
           size: result.size
         };
         if (result.lineOffset != null) payload.lineOffset = result.lineOffset;
-        sendWsMessage(socket, payload);
+        sendFileBrowserMessage(socket, e2ee, payload);
       }
     }
   })();
 }
 
 // src/bridge/routing/handlers/file-browser-messages.ts
-function handleFileBrowserRequestMessage(msg, { getWs }) {
+function handleFileBrowserRequestMessage(msg, { getWs, e2ee }) {
   if (typeof msg.id !== "string" || typeof msg.path !== "string") return;
   const socket = getWs();
   if (!socket) return;
   handleFileBrowserRequest(
     msg,
-    socket
+    socket,
+    e2ee
   );
 }
-function handleFileBrowserSearchMessage(msg, { getWs }) {
+function handleFileBrowserSearchMessage(msg, { getWs, e2ee }) {
   if (typeof msg.id !== "string") return;
   const socket = getWs();
   if (!socket) return;
-  handleFileBrowserSearch(msg, socket);
+  handleFileBrowserSearch(msg, socket, e2ee);
 }
 
 // src/bridge/routing/handlers/skill-layout-request.ts
@@ -36442,8 +36787,8 @@ function handleSkillLayoutRequest(msg, deps) {
 }
 
 // src/skills/install-remote-skills.ts
-import fs27 from "node:fs";
-import path31 from "node:path";
+import fs28 from "node:fs";
+import path32 from "node:path";
 function installRemoteSkills(cwd, targetDir, items) {
   const installed2 = [];
   if (!Array.isArray(items)) {
@@ -36454,15 +36799,15 @@ function installRemoteSkills(cwd, targetDir, items) {
       if (typeof item.sourceId !== "string" || typeof item.skillName !== "string" || typeof item.versionHash !== "string" || !Array.isArray(item.files)) {
         continue;
       }
-      const skillDir = path31.join(cwd, targetDir, item.skillName);
+      const skillDir = path32.join(cwd, targetDir, item.skillName);
       for (const f of item.files) {
         if (typeof f.path !== "string" || !f.text && !f.base64) continue;
-        const dest = path31.join(skillDir, f.path);
-        fs27.mkdirSync(path31.dirname(dest), { recursive: true });
+        const dest = path32.join(skillDir, f.path);
+        fs28.mkdirSync(path32.dirname(dest), { recursive: true });
         if (f.text !== void 0) {
-          fs27.writeFileSync(dest, f.text, "utf8");
+          fs28.writeFileSync(dest, f.text, "utf8");
         } else if (f.base64) {
-          fs27.writeFileSync(dest, Buffer.from(f.base64, "base64"));
+          fs28.writeFileSync(dest, Buffer.from(f.base64, "base64"));
         }
       }
       installed2.push({
@@ -36500,9 +36845,10 @@ var handleRefreshLocalSkills = (_msg, deps) => {
 };
 
 // src/bridge/routing/handlers/session-git-request.ts
-function sendResult(ws, id, payload) {
+function sendResult(ws, id, payload, e2ee, encryptedFields = []) {
   if (!ws) return;
-  sendWsMessage(ws, { type: "session_git_result", id, ...payload });
+  const message = { type: "session_git_result", id, ...payload };
+  sendWsMessage(ws, e2ee && encryptedFields.length > 0 ? e2ee.encryptFields(message, encryptedFields) : message);
 }
 var handleSessionGitRequestMessage = (msg, deps) => {
   if (typeof msg.id !== "string") return;
@@ -36512,7 +36858,7 @@ var handleSessionGitRequestMessage = (msg, deps) => {
     return;
   void (async () => {
     const ws = deps.getWs();
-    const reply = (payload) => sendResult(ws, msg.id, payload);
+    const reply = (payload, encryptedFields = []) => sendResult(ws, msg.id, payload, deps.e2ee, encryptedFields);
     try {
       if (action === "status") {
         const r = await deps.sessionWorktreeManager.getSessionWorkingTreeStatus(sessionId);
@@ -36538,7 +36884,7 @@ var handleSessionGitRequestMessage = (msg, deps) => {
         reply({
           ok: true,
           repos
-        });
+        }, ["repos"]);
         return;
       }
       if (action === "push") {
@@ -36607,7 +36953,7 @@ var handleSessionDiscardedMessage = (msg, deps) => {
 };
 
 // src/bridge/routing/handlers/revert-turn-snapshot.ts
-import * as fs28 from "node:fs";
+import * as fs29 from "node:fs";
 var handleRevertTurnSnapshotMessage = (msg, deps) => {
   const id = typeof msg.id === "string" ? msg.id : "";
   const sessionId = typeof msg.sessionId === "string" ? msg.sessionId : "";
@@ -36619,7 +36965,7 @@ var handleRevertTurnSnapshotMessage = (msg, deps) => {
     if (!s) return;
     const agentBase = sessionWorktreeManager.getAgentCwdForSession(sessionId) ?? getBridgeWorkspaceDirectory();
     const file2 = snapshotFilePath(agentBase, turnId);
-    if (!fs28.existsSync(file2)) {
+    if (!fs29.existsSync(file2)) {
       sendWsMessage(s, {
         type: "revert_turn_snapshot_result",
         id,
@@ -36640,8 +36986,15 @@ var handleRevertTurnSnapshotMessage = (msg, deps) => {
 
 // src/bridge/routing/handlers/dev-server-control.ts
 var handleDevServerControl = (msg, deps) => {
-  const serverId = typeof msg.serverId === "string" ? msg.serverId : "";
-  const action = msg.action === "start" || msg.action === "stop" ? msg.action : null;
+  let wire = msg;
+  try {
+    wire = deps.e2ee ? deps.e2ee.decryptMessage(msg) : msg;
+  } catch (e) {
+    deps.log(`[E2EE] Could not decrypt dev server command: ${e instanceof Error ? e.message : String(e)}`);
+    return;
+  }
+  const serverId = typeof wire.serverId === "string" ? wire.serverId : "";
+  const action = wire.action === "start" || wire.action === "stop" ? wire.action : null;
   if (!serverId || !action) return;
   deps.devServerManager?.handleControl(serverId, action);
 };
@@ -36767,7 +37120,8 @@ function createMainBridgeWebSocketLifecycle(params) {
     messageDeps,
     tokens,
     persistTokens,
-    onAuthInvalid
+    onAuthInvalid,
+    e2ee
   } = params;
   let authRefreshInFlight = false;
   function handleOpen() {
@@ -36780,15 +37134,15 @@ function createMainBridgeWebSocketLifecycle(params) {
     }
     const socket = getWs();
     if (socket) {
-      sendWsMessage(socket, { type: "identify", role: "cli" });
+      sendWsMessage(socket, { type: "identify", role: "cli", ...e2ee ? { e: e2ee.handshake } : {} });
       reportGitRepos(getWs, logFn);
     }
     if (justAuthenticated && socket) {
       logFn(
         "Save these for future runs (access token may rotate; refresh token is stored in ~/.buildautomaton/config.json when you use browser auth):"
       );
-      logFn(`  export BUILDAMATON_AUTH_TOKEN="${tokens.accessToken}"`);
-      logFn(`  export BUILDAMATON_WORKSPACE_ID="${workspaceId}"`);
+      logFn(`  export BUILDAUTOMATON_AUTH_TOKEN="${tokens.accessToken}"`);
+      logFn(`  export BUILDAUTOMATON_WORKSPACE_ID="${workspaceId}"`);
     }
   }
   function handleClose(code, reason) {
@@ -36903,7 +37257,8 @@ async function createBridgeConnection(options) {
   function getWs() {
     return state.currentWs;
   }
-  const devServerManager = new DevServerManager({ getWs, log: logFn, getBridgeCwd: getBridgeWorkspaceDirectory });
+  const e2ee = options.e2eCertificate ? createCliE2eeRuntime(options.e2eCertificate) : void 0;
+  const devServerManager = new DevServerManager({ getWs, log: logFn, getBridgeCwd: getBridgeWorkspaceDirectory, e2ee });
   const onBridgeIdentified = createOnBridgeIdentified({
     sessionWorktreeManager,
     devServerManager,
@@ -36922,7 +37277,8 @@ async function createBridgeConnection(options) {
     onBridgeIdentified,
     sendLocalSkillsReport,
     reportAutoDetectedAgents,
-    devServerManager
+    devServerManager,
+    e2ee
   };
   const { connect } = createMainBridgeWebSocketLifecycle({
     state,
@@ -36934,7 +37290,8 @@ async function createBridgeConnection(options) {
     messageDeps,
     tokens,
     persistTokens,
-    onAuthInvalid
+    onAuthInvalid,
+    e2ee
   });
   connect();
   const stopFileIndexWatcher = startFileIndexWatcher(getBridgeWorkspaceDirectory());
@@ -36946,14 +37303,149 @@ async function createBridgeConnection(options) {
   };
 }
 
+// src/e2e-certificates/key-command.ts
+import * as readline3 from "node:readline";
+function installE2eCertificateKeyCommand({
+  log: log2,
+  onOpenCertificate,
+  onInterrupt
+}) {
+  if (!process.stdin.isTTY || typeof process.stdin.setRawMode !== "function") {
+    log2("[E2EE] Press c to import the E2EE key in a browser when running in an interactive terminal.");
+    return () => {
+    };
+  }
+  readline3.emitKeypressEvents(process.stdin);
+  process.stdin.setRawMode(true);
+  process.stdin.resume();
+  const onKeypress = (str, key) => {
+    if (key?.ctrl && key.name === "c") {
+      onInterrupt();
+      return;
+    }
+    if (!key?.ctrl && !key?.meta && (key?.name === "c" || str === "c")) {
+      onOpenCertificate();
+    }
+  };
+  process.stdin.on("keypress", onKeypress);
+  log2("[E2EE] Press c to import the active E2EE key into the browser.");
+  return () => {
+    process.stdin.off("keypress", onKeypress);
+    if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {
+      process.stdin.setRawMode(false);
+    }
+  };
+}
+
+// src/e2e-certificates/open-import-url.ts
+async function openE2eCertificateImportUrl({
+  apiUrl,
+  workspaceId,
+  certificate,
+  log: log2
+}) {
+  const appUrl = appUrlForApiUrl(apiUrl);
+  const payload = encodeURIComponent(certificate.pemBundle);
+  const url2 = `${appUrl.replace(/\/$/, "")}/w/${encodeURIComponent(workspaceId)}/settings/e2e-encryption?certificate=${payload}`;
+  log2(`[E2EE] Opening browser to import key "${certificate.name}" (${certificate.id})...`);
+  try {
+    await open_default(url2, { wait: false });
+  } catch {
+    log2("[E2EE] Could not open browser. Open this URL manually:");
+    log2(url2);
+  }
+}
+
+// src/run-bridge-connected.ts
+async function runConnectedBridge(options, restartWithoutAuth) {
+  const {
+    apiUrl,
+    workspaceId,
+    authToken,
+    refreshToken,
+    justAuthenticated,
+    worktreesRootAbs,
+    e2eCertificate
+  } = options;
+  const firehoseServerUrl = options.firehoseServerUrl ?? options.proxyServerUrl;
+  let cleanupKeyCommand;
+  const handle = await createBridgeConnection({
+    apiUrl,
+    workspaceId,
+    authToken,
+    refreshToken,
+    firehoseServerUrl,
+    justAuthenticated,
+    worktreesRootAbs,
+    e2eCertificate,
+    log,
+    persistTokens: (t) => {
+      writeConfigForApi(apiUrl, {
+        workspaceId,
+        token: t.token,
+        refreshToken: t.refreshToken
+      });
+    },
+    onAuthInvalid: () => {
+      cleanupKeyCommand?.();
+      log("[Bridge service] Access token invalid or revoked; re-authenticating\u2026");
+      clearConfigForApi(apiUrl);
+      void handle.close().then(() => {
+        void restartWithoutAuth({ apiUrl, firehoseServerUrl, worktreesRootAbs, e2eCertificate });
+      });
+    }
+  });
+  const onSignal = (kind) => {
+    cleanupKeyCommand?.();
+    logImmediate(
+      kind === "interrupt" ? "Keyboard interrupt (Ctrl+C) \u2014 stopping\u2026" : "Stop requested \u2014 shutting down\u2026"
+    );
+    setImmediate(() => {
+      void handle.close().then(() => {
+        process.exit(0);
+      });
+    });
+  };
+  const onSigInt = () => onSignal("interrupt");
+  const onSigTerm = () => onSignal("stop");
+  process.on("SIGINT", onSigInt);
+  process.on("SIGTERM", onSigTerm);
+  if (e2eCertificate) {
+    let openingCertificate = false;
+    cleanupKeyCommand = installE2eCertificateKeyCommand({
+      log,
+      onInterrupt: onSigInt,
+      onOpenCertificate: () => {
+        if (openingCertificate) return;
+        openingCertificate = true;
+        void openE2eCertificateImportUrl({
+          apiUrl,
+          workspaceId,
+          certificate: e2eCertificate,
+          log
+        }).finally(() => {
+          openingCertificate = false;
+        });
+      }
+    });
+  }
+}
+
 // src/run-bridge.ts
 async function runBridge(options) {
   installBridgeProcessResilience();
-  const { apiUrl, workspaceId, authToken, refreshToken, bridgeName, justAuthenticated, worktreesRootAbs } = options;
+  const {
+    apiUrl,
+    workspaceId,
+    authToken,
+    bridgeName,
+    worktreesRootAbs,
+    e2eCertificate
+  } = options;
   const firehoseServerUrl = options.firehoseServerUrl ?? options.proxyServerUrl;
   const hasAuth = workspaceId && authToken;
   if (!hasAuth) {
-    const handle2 = runPendingAuth({
+    const handle = runPendingAuth({
       apiUrl,
       initialWorkspaceId: workspaceId,
       preferredBridgeName: bridgeName,
@@ -36961,23 +37453,23 @@ async function runBridge(options) {
       onAuth: (_auth) => {
       }
     });
-    const onSignal2 = (kind) => {
+    const onSignal = (kind) => {
       logImmediate(
         kind === "interrupt" ? "Keyboard interrupt (Ctrl+C) \u2014 stopping\u2026" : "Stop requested \u2014 shutting down\u2026"
       );
       setImmediate(() => {
-        handle2.close();
+        handle.close();
         process.exit(0);
       });
     };
-    const onSigInt2 = () => onSignal2("interrupt");
-    const onSigTerm2 = () => onSignal2("stop");
-    process.on("SIGINT", onSigInt2);
-    process.on("SIGTERM", onSigTerm2);
-    const auth = await handle2.authPromise;
-    process.off("SIGINT", onSigInt2);
-    process.off("SIGTERM", onSigTerm2);
-    handle2.close();
+    const onSigInt = () => onSignal("interrupt");
+    const onSigTerm = () => onSignal("stop");
+    process.on("SIGINT", onSigInt);
+    process.on("SIGTERM", onSigTerm);
+    const auth = await handle.authPromise;
+    process.off("SIGINT", onSigInt);
+    process.off("SIGTERM", onSigTerm);
+    handle.close();
     if (!auth) return;
     writeConfigForApi(apiUrl, {
       workspaceId: auth.workspaceId,
@@ -36992,111 +37484,91 @@ async function runBridge(options) {
       firehoseServerUrl,
       bridgeName,
       justAuthenticated: true,
-      worktreesRootAbs
+      worktreesRootAbs,
+      e2eCertificate
     });
     return;
   }
-  const handle = await createBridgeConnection({
+  await runConnectedBridge(options, runBridge);
+}
+
+// src/cli/run-cli-action.ts
+async function runCliAction(program2, opts) {
+  const positionalUrl = program2.args?.[0];
+  const urlFromPositional = typeof positionalUrl === "string" && /^https?:\/\//i.test(positionalUrl) ? positionalUrl : void 0;
+  const apiUrlFromCli = opts.apiUrl ?? urlFromPositional;
+  const apiUrl = apiUrlFromCli ?? DEFAULT_API_URL;
+  let workspaceId = opts.workspaceId ?? "";
+  let authToken = opts.token;
+  const firehoseServerUrl = opts.firehoseUrl ?? opts.proxyUrl ?? process.env.BUILDAUTOMATON_FIREHOSE_URL ?? process.env.BUILDAUTOMATON_PROXY_URL ?? DEFAULT_FIREHOSE_URL;
+  if (opts.cwd && typeof opts.cwd === "string" && opts.cwd.trim()) {
+    const resolvedCwd = path33.resolve(process.cwd(), opts.cwd.trim());
+    try {
+      const st = fs30.statSync(resolvedCwd);
+      if (!st.isDirectory()) {
+        console.error(`--cwd is not a directory: ${resolvedCwd}`);
+        process.exit(1);
+      }
+    } catch {
+      console.error(`--cwd path does not exist or is not accessible: ${resolvedCwd}`);
+      process.exit(1);
+    }
+    process.chdir(resolvedCwd);
+  }
+  initBridgeWorkspaceDirectory();
+  let worktreesRootAbs;
+  if (opts.worktreesRoot && opts.worktreesRoot.trim()) {
+    worktreesRootAbs = path33.resolve(opts.worktreesRoot.trim());
+  }
+  const e2eCertificates = opts.e2eeCertificatesDir?.trim() ? await loadOrCreateE2eCertificates(opts.e2eeCertificatesDir.trim()) : void 0;
+  if (e2eCertificates) {
+    const action = e2eCertificates.generated ? "Generated" : "Loaded";
+    console.log(
+      `[E2EE] ${action} ${e2eCertificates.certificates.length} key${e2eCertificates.certificates.length === 1 ? "" : "s"} from ${e2eCertificates.directory}`
+    );
+    console.log(
+      `[E2EE] Active key: ${e2eCertificates.activeCertificate.name} (${e2eCertificates.activeCertificate.id})`
+    );
+  }
+  let refreshToken;
+  if ((!workspaceId || !authToken) && opts.config !== false) {
+    const saved = readConfigForApi(apiUrl);
+    if (saved?.workspaceId && saved?.token) {
+      if (!workspaceId) workspaceId = saved.workspaceId;
+      if (!authToken) authToken = saved.token;
+      refreshToken = saved.refreshToken;
+    }
+  }
+  await runBridge({
     apiUrl,
-    workspaceId,
+    workspaceId: workspaceId || void 0,
     authToken,
     refreshToken,
     firehoseServerUrl,
-    justAuthenticated,
+    bridgeName: opts.name?.trim() || void 0,
     worktreesRootAbs,
-    log,
-    persistTokens: (t) => {
-      writeConfigForApi(apiUrl, {
-        workspaceId,
-        token: t.token,
-        refreshToken: t.refreshToken
-      });
-    },
-    onAuthInvalid: () => {
-      log("[Bridge service] Access token invalid or revoked; re-authenticating\u2026");
-      clearConfigForApi(apiUrl);
-      void handle.close().then(() => {
-        void runBridge({ apiUrl, firehoseServerUrl, worktreesRootAbs });
-      });
-    }
+    e2eCertificate: e2eCertificates?.activeCertificate
   });
-  const onSignal = (kind) => {
-    logImmediate(
-      kind === "interrupt" ? "Keyboard interrupt (Ctrl+C) \u2014 stopping\u2026" : "Stop requested \u2014 shutting down\u2026"
-    );
-    setImmediate(() => {
-      void handle.close().then(() => {
-        process.exit(0);
-      });
-    });
-  };
-  const onSigInt = () => onSignal("interrupt");
-  const onSigTerm = () => onSignal("stop");
-  process.on("SIGINT", onSigInt);
-  process.on("SIGTERM", onSigTerm);
 }
 
 // src/cli.ts
-var DEFAULT_API_URL = process.env.BUILDAUTOMATON_API_URL ?? "https://api.buildautomaton.com";
-var DEFAULT_FIREHOSE_URL = "https://buildautomaton-firehose.fly.dev";
 async function main() {
   const program2 = new Command();
-  program2.name("buildautomaton").description("CLI for BuildAutomaton: ACP client, WebSocket bridge to backend, and skills (e.g. preview)").version("0.1.0").option("-u, --api-url <url>", "Backend API URL", process.env.BUILDAUTOMATON_API_URL ?? DEFAULT_API_URL).option("-w, --workspace-id <id>", "Workspace ID (or set BUILDAMATON_WORKSPACE_ID)", process.env.BUILDAMATON_WORKSPACE_ID).option("-t, --token <token>", "Auth token (or set BUILDAMATON_AUTH_TOKEN)", process.env.BUILDAMATON_AUTH_TOKEN).option(
+  program2.name("buildautomaton").description("CLI for BuildAutomaton: ACP client, WebSocket bridge to backend, and skills (e.g. preview)").version("0.1.0").option("-u, --api-url <url>", "Backend API URL", process.env.BUILDAUTOMATON_API_URL ?? DEFAULT_API_URL).option("-w, --workspace-id <id>", "Workspace ID (or set BUILDAUTOMATON_WORKSPACE_ID)", process.env.BUILDAUTOMATON_WORKSPACE_ID).option("-t, --token <token>", "Auth token (or set BUILDAUTOMATON_AUTH_TOKEN)", process.env.BUILDAUTOMATON_AUTH_TOKEN).option(
     "--firehose-url <url>",
-    "Firehose server URL (default: Fly app; or BUILDAMATON_FIREHOSE_URL / legacy BUILDAMATON_PROXY_URL)",
-    process.env.BUILDAMATON_FIREHOSE_URL ?? process.env.BUILDAMATON_PROXY_URL ?? DEFAULT_FIREHOSE_URL
+    "Firehose server URL (default: Fly app; or BUILDAUTOMATON_FIREHOSE_URL / legacy BUILDAUTOMATON_PROXY_URL)",
+    process.env.BUILDAUTOMATON_FIREHOSE_URL ?? process.env.BUILDAUTOMATON_PROXY_URL ?? DEFAULT_FIREHOSE_URL
   ).option("--proxy-url <url>", "Deprecated alias for --firehose-url", void 0).option(
     "--cwd <path>",
     "Working directory for the bridge (absolute or relative to the current directory); affects skills, git, file index, and agent cwd"
   ).option("-n, --name <name>", "Bridge name when creating via browser (alphanumeric and underscores only)").option(
     "--worktrees-root <path>",
     "Root directory for per-session git worktrees (default: ~/.buildautomaton/worktrees). Whether worktrees are used is controlled in the cloud for each bridge token."
-  ).option("--no-config", "Ignore saved config at ~/.buildautomaton/config.json").action(async (opts) => {
-    const positionalUrl = program2.args?.[0];
-    const urlFromPositional = typeof positionalUrl === "string" && /^https?:\/\//i.test(positionalUrl) ? positionalUrl : void 0;
-    const apiUrlFromCli = opts.apiUrl ?? urlFromPositional;
-    let apiUrl = apiUrlFromCli ?? DEFAULT_API_URL;
-    let workspaceId = opts.workspaceId ?? "";
-    let authToken = opts.token;
-    const firehoseServerUrl = opts.firehoseUrl ?? opts.proxyUrl ?? process.env.BUILDAMATON_FIREHOSE_URL ?? process.env.BUILDAMATON_PROXY_URL ?? DEFAULT_FIREHOSE_URL;
-    if (opts.cwd && typeof opts.cwd === "string" && opts.cwd.trim()) {
-      const resolvedCwd = path32.resolve(process.cwd(), opts.cwd.trim());
-      try {
-        const st = fs29.statSync(resolvedCwd);
-        if (!st.isDirectory()) {
-          console.error(`--cwd is not a directory: ${resolvedCwd}`);
-          process.exit(1);
-        }
-      } catch {
-        console.error(`--cwd path does not exist or is not accessible: ${resolvedCwd}`);
-        process.exit(1);
-      }
-      process.chdir(resolvedCwd);
-    }
-    initBridgeWorkspaceDirectory();
-    let worktreesRootAbs;
-    if (opts.worktreesRoot && opts.worktreesRoot.trim()) {
-      worktreesRootAbs = path32.resolve(opts.worktreesRoot.trim());
-    }
-    let refreshToken;
-    if ((!workspaceId || !authToken) && opts.config !== false) {
-      const saved = readConfigForApi(apiUrl);
-      if (saved?.workspaceId && saved?.token) {
-        if (!workspaceId) workspaceId = saved.workspaceId;
-        if (!authToken) authToken = saved.token;
-        refreshToken = saved.refreshToken;
-      }
-    }
-    await runBridge({
-      apiUrl,
-      workspaceId: workspaceId || void 0,
-      authToken,
-      refreshToken,
-      firehoseServerUrl,
-      bridgeName: opts.name?.trim() || void 0,
-      worktreesRootAbs
-    });
-  });
+  ).option(
+    "--e2ee-certificates-dir <path>",
+    "Directory to load or generate E2EE keys for sessions, files, and logs",
+    process.env.BUILDAUTOMATON_E2EE_CERTIFICATES_DIR
+  ).option("--no-config", "Ignore saved config at ~/.buildautomaton/config.json").action(async (opts) => runCliAction(program2, opts));
   await program2.parseAsync(process.argv);
 }
 main().catch((err) => {