@byok-sdk/client 0.1.0 → 0.1.1

package/dist/bin/byok-agent.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { execFile, spawn, spawnSync } from 'child_process';
 import { randomUUID, createHash, randomBytes, timingSafeEqual, createPrivateKey, generateKeyPairSync, sign, createHmac } from 'crypto';
-import { readFileSync, promises, linkSync, fstatSync, lstatSync, unlinkSync, constants, readSync, openSync, writeFileSync, fchmodSync, fsyncSync, closeSync, opendirSync, existsSync, realpathSync, mkdirSync, renameSync, chmodSync, statSync, readdirSync } from 'fs';
-import path20, { join, isAbsolute } from 'path';
+import { readFileSync, promises, linkSync, fstatSync, lstatSync, unlinkSync, constants, readSync, openSync, writeFileSync, fchmodSync, fsyncSync, closeSync, opendirSync, realpathSync, mkdirSync, existsSync, renameSync, chmodSync, statSync, readdirSync } from 'fs';
+import path19, { join, isAbsolute } from 'path';
 import os from 'os';
 import { TASK_STATES, partitionAgentEvents, TASK_TRANSITIONS, encodeEnvelope, createEnvelope, MAX_MESSAGES_PER_BATCH, RuntimeIdSchema, PROTOCOL_VERSION, decodeEnvelope, MessagesSendResponseSchema, parseMessage, UnknownMessageTypeError } from '@byok-sdk/protocol';
 import { promisify } from 'util';
@@ -72,7 +72,7 @@ function gitEnvironment(readOnly) {
   return env;
 }
 function stableGitWorkspaceOwnerId(storeDir, productId) {
-  const identity = `${path20.resolve(storeDir)}\\0${productId}`;
+  const identity = `${path19.resolve(storeDir)}\\0${productId}`;
   return `store-product:${createHash("sha256").update(identity).digest("hex")}`;
 }
 var GUIDANCE = [
@@ -84,11 +84,11 @@ var GUIDANCE = [
   "Leave incomplete work visible for recovery."
 ].join("\n");
 function canonical(value) {
-  return path20.resolve(value);
+  return path19.resolve(value);
 }
 function isContained(root, candidate) {
-  const relative = path20.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path20.sep}`) && !path20.isAbsolute(relative);
+  const relative = path19.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path19.sep}`) && !path19.isAbsolute(relative);
 }
 function bounded(value, max) {
   return Buffer.byteLength(value, "utf8") <= max ? value : value.slice(0, max);
@@ -193,7 +193,7 @@ var GitWorkspaceManager = class {
     await this.ensureOwnerMarker();
   }
   async ensureOwnerMarker() {
-    const markerPath = path20.join(this.workspaceRoot, OWNER_MARKER);
+    const markerPath = path19.join(this.workspaceRoot, OWNER_MARKER);
     let existing;
     try {
       existing = JSON.parse(await promises.readFile(markerPath, "utf8"));
@@ -352,7 +352,7 @@ ${instruction}`;
         if (error instanceof GitWorkspaceError || code !== "ENOENT" && code !== "ENOTDIR") {
           throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
         }
-        const parent = path20.dirname(current);
+        const parent = path19.dirname(current);
         if (parent === current) {
           throw new GitWorkspaceError("workspace-root-invalid", "workspace directory is invalid");
         }
@@ -410,7 +410,7 @@ async function atomicWriteFile(filePath, data, options = {}) {
       await target.close();
     }
     if (process.platform !== "win32") {
-      const directory = await promises.open(path20.dirname(filePath), "r");
+      const directory = await promises.open(path19.dirname(filePath), "r");
       try {
         await directory.sync();
       } finally {
@@ -571,7 +571,7 @@ function isProtected(record) {
 var GitWorkspaceStore = class {
   constructor(storeDir, options = {}) {
     this.storeDir = storeDir;
-    this.filePath = path20.join(storeDir, FILE_NAME);
+    this.filePath = path19.join(storeDir, FILE_NAME);
     this.maxRecords = Math.max(1, Math.floor(options.maxRecords ?? MAX_RECORDS));
   }
   storeDir;
@@ -701,39 +701,13 @@ var GitWorkspaceStore = class {
     await atomicWriteFile(this.filePath, JSON.stringify(ledger, null, 2), { mode: 384 });
   }
 };
-var PI_PACKAGE_NAME = "@earendil-works/pi-coding-agent";
-function readPackageJson(dir) {
-  const candidate = path20.join(dir, "package.json");
-  if (!existsSync(candidate)) return void 0;
-  try {
-    return JSON.parse(readFileSync(candidate, "utf8"));
-  } catch {
-    return void 0;
-  }
-}
+
+// src/adapters/pi/resolve-bin.ts
 function resolvePiBin() {
   const override = process.env.BYOK_PI_BIN;
   if (override) {
     return { command: override, source: "path" };
   }
-  try {
-    const mainEntryUrl = import.meta.resolve(PI_PACKAGE_NAME);
-    let dir = path20.dirname(fileURLToPath(mainEntryUrl));
-    for (let depth = 0; depth < 6; depth++) {
-      const pkg = readPackageJson(dir);
-      if (pkg?.name === PI_PACKAGE_NAME) {
-        const binRel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.pi;
-        if (binRel) {
-          return { command: path20.join(dir, binRel), source: "package" };
-        }
-        break;
-      }
-      const parent = path20.dirname(dir);
-      if (parent === dir) break;
-      dir = parent;
-    }
-  } catch {
-  }
   return { command: "pi", source: "path" };
 }
 
@@ -1286,7 +1260,7 @@ function resolveApprovalMcpBin() {
   if (override) {
     return { command: override, args: [], source: "env" };
   }
-  const distBin = path20.join(path20.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
+  const distBin = path19.join(path19.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
   return { command: process.execPath, args: [distBin], source: "dist" };
 }
 
@@ -1366,7 +1340,7 @@ var EXTENSION_CONTENT_TYPES = {
   ".yml": "application/yaml"
 };
 function guessContentType(filePath) {
-  const ext = path20.extname(filePath).toLowerCase();
+  const ext = path19.extname(filePath).toLowerCase();
   return EXTENSION_CONTENT_TYPES[ext] ?? "application/octet-stream";
 }
 function mapAssistant(msg, correlation) {
@@ -1438,11 +1412,11 @@ function tryBuildArtifactEvent(msg, workspaceDir) {
   const filePath = toolUseResult && typeof toolUseResult.filePath === "string" ? toolUseResult.filePath : void 0;
   if (!filePath) return void 0;
   const realWorkspaceDir = tryRealpath(workspaceDir) ?? workspaceDir;
-  const fileDir = path20.dirname(filePath);
+  const fileDir = path19.dirname(filePath);
   const realFileDir = tryRealpath(fileDir) ?? fileDir;
-  const realFilePath = path20.join(realFileDir, path20.basename(filePath));
-  const relative = path20.relative(realWorkspaceDir, realFilePath);
-  if (relative === "" || relative.startsWith("..") || path20.isAbsolute(relative)) {
+  const realFilePath = path19.join(realFileDir, path19.basename(filePath));
+  const relative = path19.relative(realWorkspaceDir, realFilePath);
+  if (relative === "" || relative.startsWith("..") || path19.isAbsolute(relative)) {
     return void 0;
   }
   return { type: "artifact", name: relative, contentType: guessContentType(filePath) };
@@ -1741,10 +1715,10 @@ var ClaudeAdapter = class {
         );
       }
       const approvalMcpBin = (this.options.resolveApprovalMcpBin ?? resolveApprovalMcpBin)();
-      approvalMcpConfigDir = await promises.mkdtemp(path20.join(os.tmpdir(), "byok-approval-mcp-"));
+      approvalMcpConfigDir = await promises.mkdtemp(path19.join(os.tmpdir(), "byok-approval-mcp-"));
       await promises.chmod(approvalMcpConfigDir, 448).catch(() => {
       });
-      const mcpConfigPath = path20.join(approvalMcpConfigDir, "mcp-config.json");
+      const mcpConfigPath = path19.join(approvalMcpConfigDir, "mcp-config.json");
       const mcpConfig = {
         mcpServers: {
           [APPROVAL_MCP_SERVER_NAME]: {
@@ -2091,8 +2065,8 @@ function extractArtifactEvents(changes, workspaceDir) {
     const absolutePath = typeof change.path === "string" ? change.path : void 0;
     const kind = typeof change.kind === "string" ? change.kind : void 0;
     if (!absolutePath || kind === "delete") continue;
-    const relative = path20.relative(workspaceDir, absolutePath);
-    if (relative.length === 0 || relative.startsWith("..") || path20.isAbsolute(relative)) continue;
+    const relative = path19.relative(workspaceDir, absolutePath);
+    if (relative.length === 0 || relative.startsWith("..") || path19.isAbsolute(relative)) continue;
     events.push({ type: "artifact", name: relative, contentType: guessContentType2(relative) });
   }
   return events;
@@ -2113,7 +2087,7 @@ var CONTENT_TYPE_BY_EXTENSION = {
   ".csv": "text/csv"
 };
 function guessContentType2(relativePath) {
-  return CONTENT_TYPE_BY_EXTENSION[path20.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
+  return CONTENT_TYPE_BY_EXTENSION[path19.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
 }
 function extractErrorMessage(rawError) {
   if (typeof rawError === "string") return rawError;
@@ -2719,12 +2693,12 @@ var DeviceStore = class _DeviceStore {
    */
   constructor(storeDir, secureDirOptions) {
     this.secureDirOptions = secureDirOptions;
-    this.filePath = path20.join(storeDir, "device.json");
+    this.filePath = path19.join(storeDir, "device.json");
   }
   secureDirOptions;
   filePath;
   static defaultDir(productId) {
-    return path20.join(os.homedir(), ".byok", productId);
+    return path19.join(os.homedir(), ".byok", productId);
   }
   /**
    * Resolve the one store pathname every daemon/CLI component must share.
@@ -2733,7 +2707,7 @@ var DeviceStore = class _DeviceStore {
    * cwd to pin a quarantine directory inode.
    */
   static resolveDir(productId, configured) {
-    return path20.resolve(configured ?? _DeviceStore.defaultDir(productId));
+    return path19.resolve(configured ?? _DeviceStore.defaultDir(productId));
   }
   async load() {
     const opened = await this.openBounded();
@@ -2774,7 +2748,7 @@ var DeviceStore = class _DeviceStore {
     }
   }
   async save(record) {
-    const storeDir = path20.dirname(this.filePath);
+    const storeDir = path19.dirname(this.filePath);
     await ensureSecureDir(storeDir, this.secureDirOptions);
     await atomicWriteFile(this.filePath, JSON.stringify(record, null, 2), { mode: 384 });
   }
@@ -3208,19 +3182,19 @@ function shortHash(input) {
   return createHash("sha256").update(input, "utf8").digest("hex").slice(0, 16);
 }
 function controlSocketPath(storeDir) {
-  const candidate = path20.join(storeDir, "control.sock");
+  const candidate = path19.join(storeDir, "control.sock");
   if (Buffer.byteLength(candidate, "utf8") <= UNIX_SOCKET_PATH_SOFT_LIMIT) return candidate;
-  return path20.join(os.tmpdir(), `byok-${shortHash(storeDir)}`, "sock");
+  return path19.join(os.tmpdir(), `byok-${shortHash(storeDir)}`, "sock");
 }
 function controlPipeName(productId, storeDir) {
-  const id = shortHash(`${productId}|${path20.resolve(storeDir)}`);
+  const id = shortHash(`${productId}|${path19.resolve(storeDir)}`);
   return `\\\\.\\pipe\\byok-${id}`;
 }
 function controlEndpointPath(productId, storeDir, platform = process.platform) {
   return platform === "win32" ? controlPipeName(productId, storeDir) : controlSocketPath(storeDir);
 }
 function controlTokenPath(storeDir) {
-  return path20.join(storeDir, "control.token");
+  return path19.join(storeDir, "control.token");
 }
 var SERVER_PROOF_LABEL = "byok-control-server|";
 var CLIENT_AUTH_LABEL = "byok-control-client|";
@@ -3377,7 +3351,7 @@ async function assertOwnedPrivateDir(dir) {
 }
 async function bindControlEndpoint(server, endpoint) {
   if (process.platform !== "win32") {
-    const endpointDir = path20.dirname(endpoint);
+    const endpointDir = path19.dirname(endpoint);
     await promises.mkdir(endpointDir, { recursive: true, mode: 448 });
     await promises.chmod(endpointDir, 448).catch(() => {
     });
@@ -4658,7 +4632,7 @@ function sameFileState2(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
 }
 async function openOperationalHealthFile(storeDir) {
-  const filePath = path20.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
+  const filePath = path19.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
   let namedBefore;
   try {
     namedBefore = await promises.lstat(filePath, { bigint: true });
@@ -4700,7 +4674,7 @@ var OperationalHealthTracker = class {
   #writeTail = Promise.resolve();
   #started = false;
   constructor(storeDir, options = {}) {
-    this.#filePath = path20.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
+    this.#filePath = path19.join(storeDir, OPERATIONAL_HEALTH_FILENAME);
     this.#windowMs = options.windowMs ?? 6e4;
     this.#failureThreshold = options.failureThreshold ?? 3;
     this.#maxFailures = options.maxFailures ?? 128;
@@ -4787,7 +4761,7 @@ var OperationalHealthTracker = class {
   async #load() {
     let opened;
     try {
-      opened = await openOperationalHealthFile(path20.dirname(this.#filePath));
+      opened = await openOperationalHealthFile(path19.dirname(this.#filePath));
     } catch (err) {
       throw new Error("operational health state could not be read");
     }
@@ -4823,7 +4797,7 @@ var OperationalHealthTracker = class {
     if (!this.#state) return;
     const body = JSON.stringify(this.#state, null, 2);
     this.#writeTail = this.#writeTail.then(async () => {
-      await ensureSecureDir(path20.dirname(this.#filePath));
+      await ensureSecureDir(path19.dirname(this.#filePath));
       await atomicWriteFile(this.#filePath, body, { mode: 384, fsync: true });
     });
     try {
@@ -5179,8 +5153,8 @@ async function acquireDaemonOwner(storeDir, role, clock = () => /* @__PURE__ */
     await mutex.close().catch(() => void 0);
     throw err;
   }
-  const ownerPath = path20.join(storeDir, DAEMON_OWNER_FILENAME);
-  const reclaimPath = path20.join(storeDir, RECLAIM_FILENAME);
+  const ownerPath = path19.join(storeDir, DAEMON_OWNER_FILENAME);
+  const reclaimPath = path19.join(storeDir, RECLAIM_FILENAME);
   const record = {
     version: 2,
     pid: process.pid,
@@ -5257,7 +5231,7 @@ var CursorStore = class {
   storeDir;
   fileFor(serverUrl, deviceId) {
     const key = createHash("sha256").update(`${serverUrl}::${deviceId}`).digest("hex").slice(0, 32);
-    return path20.join(this.storeDir, `cursor-${key}.json`);
+    return path19.join(this.storeDir, `cursor-${key}.json`);
   }
   async load(serverUrl, deviceId) {
     let raw;
@@ -5277,7 +5251,7 @@ var CursorStore = class {
   }
   async save(serverUrl, deviceId, cursor) {
     const file = this.fileFor(serverUrl, deviceId);
-    await promises.mkdir(path20.dirname(file), { recursive: true, mode: 448 });
+    await promises.mkdir(path19.dirname(file), { recursive: true, mode: 448 });
     await atomicWriteFile(file, JSON.stringify({ cursor }));
   }
   /** Remove any persisted cursor for (serverUrl, deviceId) — a no-op if none exists. Called from `pair()` (finding F5) so a device that's about to be replaced never leaves a cursor a future, unrelated device could somehow inherit. */
@@ -5573,7 +5547,7 @@ var SessionWorkspaceStore = class {
    */
   queue = Promise.resolve();
   constructor(storeDir) {
-    this.filePath = path20.join(storeDir, "session-workspaces.json");
+    this.filePath = path19.join(storeDir, "session-workspaces.json");
   }
   async get(sessionRef) {
     return this.enqueue(async () => {
@@ -5631,7 +5605,7 @@ var SessionWorkspaceStore = class {
     }
   }
   async save(all) {
-    const dir = path20.dirname(this.filePath);
+    const dir = path19.dirname(this.filePath);
     await promises.mkdir(dir, { recursive: true, mode: 448 });
     const tmpPath = `${this.filePath}.${process.pid}-${tmpSeq2++}.tmp`;
     try {
@@ -5736,9 +5710,9 @@ function isSqliteAvailable() {
   }
 }
 var SECURE_FILE_MODE = 384;
-function openJournalDatabase(path25, busyTimeoutMs, faults) {
+function openJournalDatabase(path24, busyTimeoutMs, faults) {
   const { DatabaseSync } = loadSqliteModule();
-  const db = new DatabaseSync(path25, { timeout: busyTimeoutMs });
+  const db = new DatabaseSync(path24, { timeout: busyTimeoutMs });
   try {
     faults?.onStep?.("after-open");
     db.exec("PRAGMA auto_vacuum = INCREMENTAL;");
@@ -5881,9 +5855,9 @@ var RECEIVED_STATE = "received";
 function byteLength(value) {
   return Buffer.byteLength(value, "utf8");
 }
-function fileBytes(path25) {
+function fileBytes(path24) {
   try {
-    return statSync(path25).size;
+    return statSync(path24).size;
   } catch {
     return 0;
   }
@@ -7134,8 +7108,8 @@ function estimateEventBytes(event) {
 }
 async function openArtifact(workspaceDir, name) {
   const realWorkspaceDir = await promises.realpath(workspaceDir).catch(() => workspaceDir);
-  const candidate = path20.resolve(realWorkspaceDir, name);
-  const prefix = realWorkspaceDir.endsWith(path20.sep) ? realWorkspaceDir : realWorkspaceDir + path20.sep;
+  const candidate = path19.resolve(realWorkspaceDir, name);
+  const prefix = realWorkspaceDir.endsWith(path19.sep) ? realWorkspaceDir : realWorkspaceDir + path19.sep;
   if (candidate !== realWorkspaceDir && !candidate.startsWith(prefix)) {
     return { ok: false, reason: `artifact name "${name}" resolves outside the task workspace \u2014 rejected` };
   }
@@ -7533,7 +7507,7 @@ var TaskRunner = class {
           const sameProtocolTask = ledger?.taskId === taskId;
           const interruptedOldTask = ledger?.phase === "interrupted" && sameProtocolTask;
           const activeDifferentTask = ledger !== void 0 && ledger.taskId !== taskId && (ledger.phase === "preparing" || ledger.phase === "active");
-          if (!known || known.workspaceKind !== "git" || !known.gitWorkspaceId || !ledger || ledger.workspaceId !== known.gitWorkspaceId || ledger.sessionRef !== payload.sessionRef || path20.resolve(ledger.workspaceDir) !== path20.resolve(known.workspaceDir) || interruptedOldTask || activeDifferentTask) {
+          if (!known || known.workspaceKind !== "git" || !known.gitWorkspaceId || !ledger || ledger.workspaceId !== known.gitWorkspaceId || ledger.sessionRef !== payload.sessionRef || path19.resolve(ledger.workspaceDir) !== path19.resolve(known.workspaceDir) || interruptedOldTask || activeDifferentTask) {
             this.decline(taskId, "session is incompatible with Git workspace mode", true);
             return;
           }
@@ -7548,7 +7522,7 @@ var TaskRunner = class {
             return;
           }
         } else {
-          workspaceDir = path20.join(this.deps.workspaceRoot, taskId);
+          workspaceDir = path19.join(this.deps.workspaceRoot, taskId);
         }
         try {
           gitLease = await gitManager.acquireLease(workspaceDir, payload.sessionRef);
@@ -7558,7 +7532,7 @@ var TaskRunner = class {
         }
       } else if (!this.deps.gitWorkspaceManager && !this.deps.gitWorkspaceStore) {
         known = payload.sessionRef ? await this.deps.sessionWorkspaces.get(payload.sessionRef) : void 0;
-        workspaceDir = known?.workspaceDir ?? path20.join(this.deps.workspaceRoot, taskId);
+        workspaceDir = known?.workspaceDir ?? path19.join(this.deps.workspaceRoot, taskId);
         plainWorkspaceNeedsResolve = true;
       } else {
         this.decline(taskId, "workspace mode is unavailable", true);
@@ -8430,7 +8404,7 @@ var TaskRunner = class {
   }
   /** `reuseDir`, when set (a known sessionRef's recorded workspace), is used verbatim instead of a fresh `workspaceRoot/<taskId>` directory — `mkdir recursive` is idempotent either way, so ensuring-exists is safe to do unconditionally. */
   async resolveWorkspaceDir(taskId, reuseDir) {
-    const dir = reuseDir ?? path20.join(this.deps.workspaceRoot, taskId);
+    const dir = reuseDir ?? path19.join(this.deps.workspaceRoot, taskId);
     await promises.mkdir(dir, { recursive: true });
     return dir;
   }
@@ -9286,8 +9260,8 @@ function generateLaunchdPlist(def) {
   const { label, program, logDir } = def;
   const args = [program.command, ...program.args];
   const cwd = program.cwd ?? os.homedir();
-  const outLog = path20.join(logDir, `${label}.out.log`);
-  const errLog = path20.join(logDir, `${label}.err.log`);
+  const outLog = path19.join(logDir, `${label}.out.log`);
+  const errLog = path19.join(logDir, `${label}.err.log`);
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -9328,7 +9302,7 @@ function createLaunchdLifecycle(def, deps = {}) {
     return process.getuid();
   });
   const label = sanitizeServiceName(def.name);
-  const plistPath = () => path20.join(homedir(), "Library", "LaunchAgents", `${label}.plist`);
+  const plistPath = () => path19.join(homedir(), "Library", "LaunchAgents", `${label}.plist`);
   const domainTarget = () => `gui/${getuid()}`;
   const serviceTarget = () => `${domainTarget()}/${label}`;
   async function fileExists(p) {
@@ -9341,7 +9315,7 @@ function createLaunchdLifecycle(def, deps = {}) {
   }
   async function writePlist(program) {
     const xml = generateLaunchdPlist({ label, program, logDir: def.logDir });
-    await fs19.mkdir(path20.dirname(plistPath()), { recursive: true });
+    await fs19.mkdir(path19.dirname(plistPath()), { recursive: true });
     await fs19.mkdir(def.logDir, { recursive: true });
     await fs19.writeFile(plistPath(), xml, "utf8");
   }
@@ -9415,8 +9389,8 @@ function generateSystemdUnit(def) {
   assertNoControlChars(displayName, "displayName");
   const cwd = program.cwd ?? os.homedir();
   assertNoControlChars(cwd, "program.cwd");
-  const outLog = path20.join(logDir, `${name}.out.log`);
-  const errLog = path20.join(logDir, `${name}.err.log`);
+  const outLog = path19.join(logDir, `${name}.out.log`);
+  const errLog = path19.join(logDir, `${name}.err.log`);
   assertNoControlChars(outLog, "logDir");
   assertNoControlChars(errLog, "logDir");
   const execStart = [program.command, ...program.args].map(quoteSystemdArg).join(" ");
@@ -9442,7 +9416,7 @@ function createSystemdLifecycle(def, deps = {}) {
   const homedir = deps.homedir ?? (() => os.homedir());
   const name = sanitizeServiceName(def.name);
   const unitName = `${name}.service`;
-  const unitPath = () => path20.join(homedir(), ".config", "systemd", "user", unitName);
+  const unitPath = () => path19.join(homedir(), ".config", "systemd", "user", unitName);
   async function fileExists(p) {
     try {
       await fs19.stat(p);
@@ -9453,7 +9427,7 @@ function createSystemdLifecycle(def, deps = {}) {
   }
   async function writeUnit(program) {
     const unit = generateSystemdUnit({ name, displayName: def.displayName ?? def.name, program, logDir: def.logDir });
-    await fs19.mkdir(path20.dirname(unitPath()), { recursive: true });
+    await fs19.mkdir(path19.dirname(unitPath()), { recursive: true });
     await fs19.mkdir(def.logDir, { recursive: true });
     await fs19.writeFile(unitPath(), unit, "utf8");
   }
@@ -9535,8 +9509,8 @@ function createWinswLifecycle(def, deps = {}) {
   const winswBin = windows.winswBin;
   const id = sanitizeServiceName(def.name);
   const installDir = windows.installDir ?? def.logDir;
-  const exePath = path20.join(installDir, `${id}.exe`);
-  const xmlPath = path20.join(installDir, `${id}.xml`);
+  const exePath = path19.join(installDir, `${id}.exe`);
+  const xmlPath = path19.join(installDir, `${id}.xml`);
   async function fileExists(p) {
     try {
       await fs19.stat(p);
@@ -10310,7 +10284,7 @@ function safeProtocol(serverUrl) {
   }
 }
 async function inspectDevice(storeDir) {
-  const filePath = path20.join(storeDir, "device.json");
+  const filePath = path19.join(storeDir, "device.json");
   let pathStat;
   try {
     pathStat = await promises.lstat(filePath);
@@ -10390,11 +10364,11 @@ async function copyOpenFileBounded(source, expected, destinationPath) {
   }
 }
 async function inspectJournal(storeDir) {
-  const journalPath = path20.join(storeDir, JOURNAL_DB_FILENAME);
+  const journalPath = path19.join(storeDir, JOURNAL_DB_FILENAME);
   try {
     const mainIdentity = await regularFileIdentity(journalPath);
     if (mainIdentity === void 0) return { status: "missing" };
-    const walIdentity = await regularFileIdentity(path20.join(storeDir, `${JOURNAL_DB_FILENAME}-wal`));
+    const walIdentity = await regularFileIdentity(path19.join(storeDir, `${JOURNAL_DB_FILENAME}-wal`));
     let sizeBytes = Number(mainIdentity.size);
     let walBytes = walIdentity === void 0 ? void 0 : Number(walIdentity.size);
     if (!isSqliteAvailable()) {
@@ -10402,7 +10376,7 @@ async function inspectJournal(storeDir) {
     }
     const componentNames = [JOURNAL_DB_FILENAME, `${JOURNAL_DB_FILENAME}-wal`, `${JOURNAL_DB_FILENAME}-shm`];
     const initial = /* @__PURE__ */ new Map();
-    for (const name of componentNames) initial.set(name, await regularFileIdentity(path20.join(storeDir, name)));
+    for (const name of componentNames) initial.set(name, await regularFileIdentity(path19.join(storeDir, name)));
     const snapshotMain = initial.get(JOURNAL_DB_FILENAME);
     if (!snapshotMain) return { status: "unavailable", reason: "journal changed during diagnostics snapshot" };
     sizeBytes = Number(snapshotMain.size);
@@ -10414,7 +10388,7 @@ async function inspectJournal(storeDir) {
         let handle;
         try {
           handle = await promises.open(
-            path20.join(storeDir, name),
+            path19.join(storeDir, name),
             constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0)
           );
         } catch (err) {
@@ -10443,28 +10417,28 @@ async function inspectJournal(storeDir) {
           reason: "journal exceeds the bounded diagnostics copy limit"
         };
       }
-      const tempDir = await promises.mkdtemp(path20.join(os.tmpdir(), "byok-journal-inspect-"));
+      const tempDir = await promises.mkdtemp(path19.join(os.tmpdir(), "byok-journal-inspect-"));
       const { DatabaseSync } = loadSqliteModule();
       let db;
       try {
         for (const name of componentNames) {
           const component = opened.get(name);
-          if (component && !await copyOpenFileBounded(component.handle, component.identity, path20.join(tempDir, name))) {
+          if (component && !await copyOpenFileBounded(component.handle, component.identity, path19.join(tempDir, name))) {
             return { status: "unavailable", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal changed during diagnostics snapshot" };
           }
         }
         for (const [name, component] of opened) {
-          if (!sameIdentity(component.identity, identityFromBigIntStat(await component.handle.stat({ bigint: true }))) || !sameIdentity(component.identity, await regularFileIdentity(path20.join(storeDir, name)))) {
+          if (!sameIdentity(component.identity, identityFromBigIntStat(await component.handle.stat({ bigint: true }))) || !sameIdentity(component.identity, await regularFileIdentity(path19.join(storeDir, name)))) {
             return { status: "unavailable", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal changed during diagnostics snapshot" };
           }
         }
         for (const name of componentNames) {
-          if (!opened.has(name) && await regularFileIdentity(path20.join(storeDir, name)) !== void 0) {
+          if (!opened.has(name) && await regularFileIdentity(path19.join(storeDir, name)) !== void 0) {
             return { status: "unavailable", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal changed during diagnostics snapshot" };
           }
         }
         const header = Buffer.alloc(16);
-        const copiedHandle = await promises.open(path20.join(tempDir, JOURNAL_DB_FILENAME), "r");
+        const copiedHandle = await promises.open(path19.join(tempDir, JOURNAL_DB_FILENAME), "r");
         try {
           const { bytesRead } = await copiedHandle.read(header, 0, header.length, 0);
           if (bytesRead !== 16 || header.toString("binary") !== "SQLite format 3\0") {
@@ -10473,7 +10447,7 @@ async function inspectJournal(storeDir) {
         } finally {
           await copiedHandle.close();
         }
-        db = new DatabaseSync(path20.join(tempDir, JOURNAL_DB_FILENAME), { readOnly: true });
+        db = new DatabaseSync(path19.join(tempDir, JOURNAL_DB_FILENAME), { readOnly: true });
         const result = db.prepare("PRAGMA quick_check(1)").get();
         if (result?.quick_check !== "ok") {
           return { status: "corrupt", sizeBytes, ...walBytes === void 0 ? {} : { walBytes }, reason: "journal quick_check failed" };
@@ -10508,7 +10482,7 @@ async function inspectWorkspace(workspaceRoot) {
   }
 }
 function readPinnedQuarantineFile(name, maxBytes, includeBytes, budget) {
-  if (path20.basename(name) !== name || name === "." || name === "..") {
+  if (path19.basename(name) !== name || name === "." || name === "..") {
     throw new Error("quarantine manifest contains an invalid evidence name");
   }
   const namedBefore = lstatSync(name, { bigint: true });
@@ -10612,10 +10586,10 @@ function inspectQuarantinePinned(dir, expectedDirectory) {
       if (isJournalQuarantineManifest(parsed)) {
         const manifestBase = manifestName.slice(0, -".manifest.json".length);
         const boundNames = parsed.files.map((file) => {
-          if (path20.dirname(path20.resolve(file)) !== path20.resolve(".")) {
+          if (path19.dirname(path19.resolve(file)) !== path19.resolve(".")) {
             throw new Error("journal quarantine manifest points outside quarantine");
           }
-          return path20.basename(file);
+          return path19.basename(file);
         });
         if (!boundNames.includes(manifestBase)) {
           throw new Error("journal quarantine manifest is not bound to its primary database evidence");
@@ -10655,7 +10629,7 @@ function inspectQuarantinePinned(dir, expectedDirectory) {
   }
 }
 async function inspectQuarantine(storeDir) {
-  const dir = path20.join(storeDir, JOURNAL_QUARANTINE_DIRNAME);
+  const dir = path19.join(storeDir, JOURNAL_QUARANTINE_DIRNAME);
   let directory;
   try {
     directory = await promises.lstat(dir, { bigint: true });
@@ -10726,7 +10700,7 @@ function checksFor(snapshot) {
   ];
 }
 async function collectDiagnostics(config, storeDir, options = {}) {
-  const resolvedStoreDir = path20.resolve(storeDir);
+  const resolvedStoreDir = path19.resolve(storeDir);
   const adapters = options.adapters ?? defaultRuntimeAdapters(config.runtimeAllowlist);
   const connectControl = options.connectControl ?? connectControlClient;
   const [device, probedRuntimes, health, journal, workspace, quarantine, controlConnection] = await Promise.all([
@@ -10901,7 +10875,7 @@ function publishQuarantineEvidencePinned(quarantineDir, expectedDirectory, sourc
     unlinkSync(sourcePath);
     sourceRemoved = true;
     if (process.platform !== "win32") {
-      const directoryFd = openSync(path20.dirname(sourcePath), constants.O_RDONLY);
+      const directoryFd = openSync(path19.dirname(sourcePath), constants.O_RDONLY);
       try {
         fsyncSync(directoryFd);
       } finally {
@@ -10940,10 +10914,10 @@ function publishQuarantineEvidencePinned(quarantineDir, expectedDirectory, sourc
   }
 }
 async function quarantineCorruptOperationalHealth(storeDir, options = {}) {
-  const resolvedStoreDir = path20.resolve(storeDir);
+  const resolvedStoreDir = path19.resolve(storeDir);
   const owner = await acquireDaemonOwner(resolvedStoreDir, "doctor", options.clock);
   try {
-    const sourcePath = path20.join(resolvedStoreDir, OPERATIONAL_HEALTH_FILENAME);
+    const sourcePath = path19.join(resolvedStoreDir, OPERATIONAL_HEALTH_FILENAME);
     let opened;
     try {
       opened = await openOperationalHealthFile(resolvedStoreDir);
@@ -10960,7 +10934,7 @@ async function quarantineCorruptOperationalHealth(storeDir, options = {}) {
       }
       const sourceStat = await source.stat({ bigint: true });
       if (!sourceStat.isFile()) throw new Error("operational health state is not a regular file; refusing quarantine");
-      const quarantineDir = path20.join(resolvedStoreDir, JOURNAL_QUARANTINE_DIRNAME);
+      const quarantineDir = path19.join(resolvedStoreDir, JOURNAL_QUARANTINE_DIRNAME);
       try {
         const existing = await promises.lstat(quarantineDir);
         if (!existing.isDirectory() || existing.isSymbolicLink()) {
@@ -11061,8 +11035,8 @@ function buildServiceDefinition(config, configPath, rest) {
   const name = argValue(rest, "--name") ?? config.productId;
   const agentBin = argValue(rest, "--agent-bin") ?? process.argv[1] ?? "byok-agent";
   const nodeBin = argValue(rest, "--node-bin") ?? process.execPath;
-  const absoluteConfigPath = path20.resolve(configPath);
-  const logDir = path20.join(resolveStoreDir(config), "service-logs");
+  const absoluteConfigPath = path19.resolve(configPath);
+  const logDir = path19.join(resolveStoreDir(config), "service-logs");
   const definition = {
     name,
     displayName: config.branding?.displayName ?? config.productName,
@@ -11116,7 +11090,7 @@ async function runServiceStatusCommand(config, configPath, rest, deps = {}) {
   log(`detail: ${status.detail.trim() || "(none)"}`);
 }
 function auditLogPath(storeDir) {
-  return path20.join(storeDir, "audit.jsonl");
+  return path19.join(storeDir, "audit.jsonl");
 }
 var AUDIT_LOG_MODE = 384;
 var AUDIT_STORE_DIR_MODE = 448;
@@ -11938,11 +11912,11 @@ async function createSupportBundle(config, storeDir, options = {}) {
   };
 }
 async function writeSupportBundle(outputPath, bundle, secureFileOptions = {}) {
-  const dir = path20.dirname(outputPath);
+  const dir = path19.dirname(outputPath);
   const parentStat = await promises.stat(dir);
   if (!parentStat.isDirectory()) throw new Error("support bundle output parent is not a directory");
-  const privateDir = path20.join(dir, `.${path20.basename(outputPath)}.${process.pid}.${randomUUID()}.private`);
-  const tempPath = path20.join(privateDir, "bundle.tmp");
+  const privateDir = path19.join(dir, `.${path19.basename(outputPath)}.${process.pid}.${randomUUID()}.private`);
+  const tempPath = path19.join(privateDir, "bundle.tmp");
   try {
     await promises.mkdir(privateDir, { mode: 448 });
     await ensureSecureDir(privateDir, secureFileOptions);
@@ -11972,7 +11946,7 @@ async function writeSupportBundle(outputPath, bundle, secureFileOptions = {}) {
 // src/bin/commands/support-bundle.ts
 async function runSupportBundleCommand(config, options) {
   if (!options.outputPath) throw new Error("support-bundle requires --output <path>");
-  const outputPath = path20.resolve(options.outputPath);
+  const outputPath = path19.resolve(options.outputPath);
   const bundle = await createSupportBundle(config, resolveStoreDir(config), options);
   await writeSupportBundle(outputPath, bundle);
   const log = options.log ?? ((line) => console.log(line));
@@ -12008,8 +11982,8 @@ async function runTasksFollowCommand(config, deps) {
     });
     return;
   }
-  const path25 = auditLogPath(storeDir);
-  await followAuditLog(path25, (event) => log(formatDaemonEventLine(event)), {
+  const path24 = auditLogPath(storeDir);
+  await followAuditLog(path24, (event) => log(formatDaemonEventLine(event)), {
     signal: deps.signal,
     pollIntervalMs: deps.pollIntervalMs,
     fromEnd: true