@centralu/host-linux-arm64 0.1.0-beta.20 → 0.1.0-beta.21

package/host/main.mjs

@@ -9373,7 +9373,7 @@ function dn(e) {
 function or(e) {
   return e.length > 0 && e.every(dn);
 }
-function rm3(e) {
+function rm4(e) {
   return Is(e).some((t) => t.endsWith(".jsonl"));
 }
 function Is(e) {
@@ -9523,7 +9523,7 @@ function tS(e, t) {
   if (U1e(t)) return q(e, M1e);
   if (D1e(t)) return q(e, I1e);
   if (N1e(t)) return q(e, L1e);
-  return rm3(t) ? q(e, sm) : void 0;
+  return rm4(t) ? q(e, sm) : void 0;
 }
 function z1e(e) {
   return j1e(`${e}.json`);
@@ -9532,7 +9532,7 @@ function j1e(e) {
   return Is(e).includes(F1e);
 }
 function nS(e) {
-  return Array.isArray(e) && e.some((t) => typeof t === "string" && rm3(t));
+  return Array.isArray(e) && e.some((t) => typeof t === "string" && rm4(t));
 }
 function H1e(e) {
   return e === "user" || e === "project" || e === "local";
@@ -11008,7 +11008,7 @@ function L3(e) {
 }
 function U3(e) {
   let t = N3(e);
-  if (rm3(t)) return;
+  if (rm4(t)) return;
   let n = vt(), r = [t], o = M3(e);
   while (o !== n && r.length <= h2e + 1) {
     let l = M3(o);
@@ -42960,12 +42960,12 @@ function refuse(message, io2 = realIo) {
 import { parseArgs } from "node:util";
 import { randomBytes as randomBytes6 } from "node:crypto";
 import { homedir as homedir14, hostname as hostname4 } from "node:os";
-import { dirname as dirname11, join as join32 } from "node:path";
+import { dirname as dirname11, join as join33 } from "node:path";
 import { mkdirSync as mkdirSync11, writeSync as writeSync4 } from "node:fs";
 
 // packages/protocol/src/brand.ts
 var APP_NAME = "Centralu";
-var APP_VERSION = "0.1.0-beta.20";
+var APP_VERSION = "0.1.0-beta.21";
 var APP_SLUG = "centralu";
 var CLIENT_INFO = { name: APP_SLUG, title: APP_NAME, version: APP_VERSION };
 var DATA_DIR = ".centralu";
@@ -58032,7 +58032,7 @@ var ApprovalDetail = external_exports.discriminatedUnion("kind", [
   }),
   /**
    * One project reaching another (#371) — raised by **the host** in the calling session, the first time a session of
-   * `from` asks to reach `to`. `access` says how: 'delegate' starts a session in `to` and gives it a task
+   * `from` asks to reach `to`. `access` says how: 'delegate' gives an existing session in `to` a task
    * (ask_project, part B); 'apps' attaches one of `to`'s apps to the caller (part A, with `app` naming it).
    *
    * Unlike `capability`, this one has all three answers: allow once (this call only), always (remembered for this
@@ -58046,14 +58046,16 @@ var ApprovalDetail = external_exports.discriminatedUnion("kind", [
       id: external_exports.string(),
       name: external_exports.string(),
       /**
-       * Whether the person trusts the target project (#382). `false` is said on the card: a session ask_project opens
-       * there follows that trust. Absent from a host that predates it, read as not saying.
+       * Whether the person trusts the target project (#382). `false` is said on the card: the existing target session
+       * follows that trust. Absent from a host that predates it, read as not saying.
        */
       trusted: external_exports.boolean().optional()
     }),
     /** One line for a person to read: what the caller wants done there (the task, cut short; or the app's use) */
     text: external_exports.string(),
-    app: external_exports.object({ appId: external_exports.string(), name: external_exports.string() }).optional()
+    app: external_exports.object({ appId: external_exports.string(), name: external_exports.string() }).optional(),
+    /** The existing session chosen for ask_project; absent from older hosts. */
+    session: external_exports.object({ id: external_exports.string(), name: external_exports.string() }).optional()
   }),
   /**
    * A session asks to start another agent in its own project (#561, start_agent) — raised by **the host** in the
@@ -58533,7 +58535,9 @@ var UiPreferences = external_exports.object({
    * preference, but this is the one record the person's settings already live in; the host reads
    * it when a session starts and on each call.
    */
-  sessionTools: external_exports.boolean()
+  sessionTools: external_exports.boolean(),
+  /** Running children per project: null uses preset defaults (auto unlimited, otherwise 4); 0 is unlimited. */
+  agentCeiling: external_exports.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).nullable().optional()
 });
 var UiPreferencesPatch = UiPreferences.partial();
 var DEFAULT_UI_PREFERENCES = {
@@ -59627,14 +59631,9 @@ var SessionInfo = external_exports.object({
    */
   parentSessionId: external_exports.string().nullable().default(null),
   /**
-   * The session that asked for this one through ask_project (#371 part B) — a session in another project. Null for
-   * every session a person or an app started.
-   *
-   * The delegated session is an ordinary session of its own project, so the person can watch it and step in; this
-   * line is what marks it "asked by" and links back to the caller. On the row (store v45), so the mark survives a
-   * restart, and the caller's next ask reuses the session it already asked. The caller may since have been deleted:
-   * the id then names a session that is no longer listed. Optional rather than defaulted so a frame or a fixture
-   * that predates it needs no change: absent and null read the same.
+   * The same-project session that started this agent (`start_agent`, #561). Person-created and app
+   * sessions have no owner. Old cross-project ask_project ownership is cleared on host startup
+   * (#614); cross-project tasks retain their asking session in conversation `from` instead.
    */
   askedBy: external_exports.string().nullable().optional(),
   ...machineField,
@@ -61760,12 +61759,12 @@ var KeeperAgentProcess = class _KeeperAgentProcess extends EventEmitter {
     await Promise.race([this.ready, new Promise((r) => setTimeout(r, DETACH_WAIT_MS))]);
     const out = this.out;
     if (!out) return;
-    await new Promise((resolve11) => {
-      if (out.readableEnded || out.destroyed) return resolve11();
-      const t = setTimeout(resolve11, DETACH_WAIT_MS);
+    await new Promise((resolve12) => {
+      if (out.readableEnded || out.destroyed) return resolve12();
+      const t = setTimeout(resolve12, DETACH_WAIT_MS);
       const done = () => {
         clearTimeout(t);
-        resolve11();
+        resolve12();
       };
       out.once("end", done);
       out.once("close", done);
@@ -61782,7 +61781,7 @@ import { createConnection } from "node:net";
 var CHILDREN_PROTOCOL = 1;
 var REQUEST_TIMEOUT_MS = 15e3;
 function readAnswer(sock, timeoutMs) {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     let buf = Buffer.alloc(0);
     const done = (err, v) => {
       clearTimeout(timer);
@@ -61790,7 +61789,7 @@ function readAnswer(sock, timeoutMs) {
       sock.off("error", onError);
       sock.off("close", onClose);
       if (err) reject(err);
-      else resolve11(v);
+      else resolve12(v);
     };
     const onData = (d2) => {
       buf = Buffer.concat([buf, d2]);
@@ -61819,7 +61818,7 @@ function readAnswer(sock, timeoutMs) {
   });
 }
 function connect(path2, first, timeoutMs) {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const sock = createConnection(path2);
     const onError = (e) => reject(e);
     sock.once("error", onError);
@@ -61833,7 +61832,7 @@ function connect(path2, first, timeoutMs) {
             sock.destroy();
             return reject(new Error(String(answer.error ?? "the keeper refused")));
           }
-          resolve11({ sock, answer });
+          resolve12({ sock, answer });
         },
         (e) => {
           sock.destroy();
@@ -61919,12 +61918,12 @@ var KeeperChildren = class _KeeperChildren extends EventEmitter2 {
   request(op, body = {}) {
     if (this.closed) return Promise.reject(new Error("the connection to the keeper was lost"));
     const rid = this.nextRid++;
-    return new Promise((resolve11, reject) => {
+    return new Promise((resolve12, reject) => {
       const timer = setTimeout(() => {
         if (this.pending.delete(rid)) reject(new Error(`the keeper did not answer ${op}`));
       }, REQUEST_TIMEOUT_MS);
       timer.unref();
-      this.pending.set(rid, { resolve: resolve11, reject, timer });
+      this.pending.set(rid, { resolve: resolve12, reject, timer });
       this.sock.write(`${JSON.stringify({ ...body, op, rid })}
 `);
     });
@@ -62105,12 +62104,12 @@ var KeeperPty = class _KeeperPty {
     await Promise.race([this.ready, new Promise((r) => setTimeout(r, 1e3))]);
     const sock = this.sock;
     if (!sock) return;
-    await new Promise((resolve11) => {
-      if (sock.readableEnded || sock.destroyed) return resolve11();
-      const t = setTimeout(resolve11, 1e3);
+    await new Promise((resolve12) => {
+      if (sock.readableEnded || sock.destroyed) return resolve12();
+      const t = setTimeout(resolve12, 1e3);
       const done = () => {
         clearTimeout(t);
-        resolve11();
+        resolve12();
       };
       sock.once("end", done);
       sock.once("close", done);
@@ -62473,7 +62472,7 @@ var Drain = class {
    */
   track(label, run) {
     if (this.refusing) return Promise.reject(new DrainCut(REFUSED_MESSAGE));
-    return new Promise((resolve11, reject) => {
+    return new Promise((resolve12, reject) => {
       let settled = false;
       const settle = () => {
         if (settled) return false;
@@ -62485,7 +62484,7 @@ var Drain = class {
       const entry = { label, cut: (e) => settle() && reject(e) };
       this.inflight.add(entry);
       Promise.resolve().then(run).then(
-        (v) => settle() && resolve11(v),
+        (v) => settle() && resolve12(v),
         (e) => settle() && reject(e)
       );
     });
@@ -62634,7 +62633,7 @@ var HostServer = class _HostServer {
     return this.allowedOrigins.has(origin);
   }
   listen() {
-    return new Promise((resolve11, reject) => {
+    return new Promise((resolve12, reject) => {
       const onError = (err) => {
         this.listenError = null;
         if (err.code === "EADDRINUSE") {
@@ -62651,7 +62650,7 @@ var HostServer = class _HostServer {
         this.listenError = null;
         this.http.removeListener("error", onError);
         const addr = this.http.address();
-        resolve11(typeof addr === "object" && addr ? addr.port : this.opts.port);
+        resolve12(typeof addr === "object" && addr ? addr.port : this.opts.port);
       });
     });
   }
@@ -63028,15 +63027,15 @@ function buildViewCsp(csp) {
   const frame = sanitizeDomains(csp?.frameDomains);
   const base2 = sanitizeDomains(csp?.baseUriDomains);
   const r = resource.kept.join(" ");
-  const join33 = (...parts) => parts.filter(Boolean).join(" ");
+  const join34 = (...parts) => parts.filter(Boolean).join(" ");
   const policy = [
     "default-src 'none'",
-    `script-src ${join33("'unsafe-inline'", r)}`,
-    `style-src ${join33("'unsafe-inline'", r)}`,
-    `img-src ${join33("data: blob:", r)}`,
-    `font-src ${join33("data:", r)}`,
-    `media-src ${join33("data: blob:", r)}`,
-    `worker-src ${join33("blob:", r)}`,
+    `script-src ${join34("'unsafe-inline'", r)}`,
+    `style-src ${join34("'unsafe-inline'", r)}`,
+    `img-src ${join34("data: blob:", r)}`,
+    `font-src ${join34("data:", r)}`,
+    `media-src ${join34("data: blob:", r)}`,
+    `worker-src ${join34("blob:", r)}`,
     `connect-src ${connect2.kept.length ? connect2.kept.join(" ") : "'none'"}`,
     `frame-src ${frame.kept.length ? frame.kept.join(" ") : "'none'"}`,
     "form-action 'none'",
@@ -68738,14 +68737,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep(ms3, signal) {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve11();
+      resolve12();
     }, ms3);
     const onAbort = () => {
       clearTimeout(timer);
@@ -69584,7 +69583,7 @@ var Protocol = class {
     const flowStartedAt = Date.now();
     let onAbort;
     let cleanupMessageId;
-    return new Promise((resolve11, reject) => {
+    return new Promise((resolve12, reject) => {
       const earlyReject = (error51) => {
         reject(error51);
       };
@@ -69653,7 +69652,7 @@ var Protocol = class {
         }
         if (decoded.kind === "invalid") return reject(decoded.error);
         if (decoded.kind === "input_required") {
-          if (options?.allowInputRequired === true) return resolve11(manualInputRequiredValue(decoded));
+          if (options?.allowInputRequired === true) return resolve12(manualInputRequiredValue(decoded));
           const flow = {
             codec: codec2,
             request,
@@ -69665,11 +69664,11 @@ var Protocol = class {
               params
             }, resultSchema, legOptions)
           };
-          return resolve11(this._resolveNonCompleteResult(decoded, flow));
+          return resolve12(this._resolveNonCompleteResult(decoded, flow));
         }
         const result = decoded.result;
         validateStandardSchema(resultSchema, result).then((parseResult) => {
-          if (parseResult.success) resolve11(parseResult.data);
+          if (parseResult.success) resolve12(parseResult.data);
           else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
         }, reject);
       });
@@ -72592,7 +72591,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports) => {
     ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
     const schOrFunc = root3.refs[ref];
     if (schOrFunc) return schOrFunc;
-    let _sch = resolve11.call(this, root3, ref);
+    let _sch = resolve12.call(this, root3, ref);
     if (_sch === void 0) {
       const schema = (_a4 = root3.localRefs) === null || _a4 === void 0 ? void 0 : _a4[ref];
       const { schemaId } = this.opts;
@@ -72618,7 +72617,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports) => {
   function sameSchemaEnv(s12, s22) {
     return s12.schema === s22.schema && s12.root === s22.root && s12.baseId === s22.baseId;
   }
-  function resolve11(root3, ref) {
+  function resolve12(root3, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string") ref = sch;
     return sch || this.schemas[ref] || resolveSchema.call(this, root3, ref);
@@ -73068,7 +73067,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     else if (typeof uri === "object") uri = parse7(serialize(uri, options), options);
     return uri;
   }
-  function resolve11(baseURI, relativeURI, options) {
+  function resolve12(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse7(baseURI, schemelessOptions), parse7(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
@@ -73242,7 +73241,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
   const fastUri = {
     SCHEMES,
     normalize: normalize2,
-    resolve: resolve11,
+    resolve: resolve12,
     resolveComponent,
     equal,
     serialize,
@@ -77857,14 +77856,14 @@ var ProbeWindow = class ProbeWindow2 {
   */
   async exchange(buildRequest, timeoutMs) {
     const id2 = `server-discover-probe-${++this._probeCounter}`;
-    return new Promise((resolve11) => {
+    return new Promise((resolve12) => {
       let settled = false;
       const settle = (reply) => {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
         if (this._pending?.id === id2) this._pending = void 0;
-        resolve11(reply);
+        resolve12(reply);
       };
       const timer = setTimeout(() => settle({ kind: "timeout" }), timeoutMs);
       this._pending = {
@@ -79070,13 +79069,13 @@ var Client = class extends Protocol {
     let onCallerAbort;
     let resolveOpening;
     let rejectOpening;
-    const opening = new Promise((resolve11, reject) => {
-      resolveOpening = resolve11;
+    const opening = new Promise((resolve12, reject) => {
+      resolveOpening = resolve12;
       rejectOpening = reject;
     });
     let resolveClosed;
-    const closed = new Promise((resolve11) => {
-      resolveClosed = resolve11;
+    const closed = new Promise((resolve12) => {
+      resolveClosed = resolve12;
     });
     const settle = (outcome) => {
       if (state === "closed") return;
@@ -79848,8 +79847,8 @@ var StreamTransport = class {
   }
   send(message) {
     if (this.closed) return Promise.reject(new Error("app connection closed"));
-    return new Promise((resolve11, reject) => {
-      this.writable.write(serializeMessage(message), (err) => err ? reject(err) : resolve11());
+    return new Promise((resolve12, reject) => {
+      this.writable.write(serializeMessage(message), (err) => err ? reject(err) : resolve12());
     });
   }
   /** Closes only our own state. Closing the pipes is the shutdown rule's job (AppProcess.stop). */
@@ -80061,12 +80060,12 @@ ${tail}` : head;
   }
   waitExit(ms3) {
     if (!this.alive) return Promise.resolve(true);
-    return new Promise((resolve11) => {
-      const t = setTimeout(() => resolve11(false), ms3);
+    return new Promise((resolve12) => {
+      const t = setTimeout(() => resolve12(false), ms3);
       t.unref();
       this.exitWaiters.push(() => {
         clearTimeout(t);
-        resolve11(true);
+        resolve12(true);
       });
     });
   }
@@ -83653,14 +83652,14 @@ function inputRequiredRoundsExceededMessage2(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep2(ms3, signal) {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError2 ? signal.reason : new SdkError2(SdkErrorCode2.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve11();
+      resolve12();
     }, ms3);
     const onAbort = () => {
       clearTimeout(timer);
@@ -84454,7 +84453,7 @@ var Protocol2 = class {
     const flowStartedAt = Date.now();
     let onAbort;
     let cleanupMessageId;
-    return new Promise((resolve11, reject) => {
+    return new Promise((resolve12, reject) => {
       const earlyReject = (error51) => {
         reject(error51);
       };
@@ -84523,7 +84522,7 @@ var Protocol2 = class {
         }
         if (decoded.kind === "invalid") return reject(decoded.error);
         if (decoded.kind === "input_required") {
-          if (options?.allowInputRequired === true) return resolve11(manualInputRequiredValue2(decoded));
+          if (options?.allowInputRequired === true) return resolve12(manualInputRequiredValue2(decoded));
           const flow = {
             codec: codec2,
             request,
@@ -84535,11 +84534,11 @@ var Protocol2 = class {
               params
             }, resultSchema, legOptions)
           };
-          return resolve11(this._resolveNonCompleteResult(decoded, flow));
+          return resolve12(this._resolveNonCompleteResult(decoded, flow));
         }
         const result = decoded.result;
         validateStandardSchema2(resultSchema, result).then((parseResult) => {
-          if (parseResult.success) resolve11(parseResult.data);
+          if (parseResult.success) resolve12(parseResult.data);
           else reject(new SdkError2(SdkErrorCode2.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
         }, reject);
       });
@@ -87451,7 +87450,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin2(((exports) => {
     ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
     const schOrFunc = root3.refs[ref];
     if (schOrFunc) return schOrFunc;
-    let _sch = resolve11.call(this, root3, ref);
+    let _sch = resolve12.call(this, root3, ref);
     if (_sch === void 0) {
       const schema = (_a4 = root3.localRefs) === null || _a4 === void 0 ? void 0 : _a4[ref];
       const { schemaId } = this.opts;
@@ -87477,7 +87476,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin2(((exports) => {
   function sameSchemaEnv(s12, s22) {
     return s12.schema === s22.schema && s12.root === s22.root && s12.baseId === s22.baseId;
   }
-  function resolve11(root3, ref) {
+  function resolve12(root3, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string") ref = sch;
     return sch || this.schemas[ref] || resolveSchema.call(this, root3, ref);
@@ -87927,7 +87926,7 @@ var require_fast_uri2 = /* @__PURE__ */ __commonJSMin2(((exports, module) => {
     else if (typeof uri === "object") uri = parse7(serialize(uri, options), options);
     return uri;
   }
-  function resolve11(baseURI, relativeURI, options) {
+  function resolve12(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse7(baseURI, schemelessOptions), parse7(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
@@ -88101,7 +88100,7 @@ var require_fast_uri2 = /* @__PURE__ */ __commonJSMin2(((exports, module) => {
   const fastUri = {
     SCHEMES,
     normalize: normalize2,
-    resolve: resolve11,
+    resolve: resolve12,
     resolveComponent,
     equal,
     serialize,
@@ -93534,7 +93533,7 @@ var StdioServerTransport = class {
   }
   send(message) {
     if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-    return new Promise((resolve11, reject) => {
+    return new Promise((resolve12, reject) => {
       const json2 = serializeMessage2(message);
       let settled = false;
       const onError = (error51) => {
@@ -93549,14 +93548,14 @@ var StdioServerTransport = class {
         settled = true;
         this._stdout.off("error", onError);
         this._stdout.off("drain", onDrain2);
-        resolve11();
+        resolve12();
       };
       this._stdout.once("error", onError);
       if (this._stdout.write(json2)) {
         if (settled) return;
         settled = true;
         this._stdout.off("error", onError);
-        resolve11();
+        resolve12();
       } else if (!settled) this._stdout.once("drain", onDrain2);
     });
   }
@@ -93610,14 +93609,14 @@ var StdioConnectionChannel = class {
   */
   async whenRequestsAnswered(timeoutMs) {
     if (this._closed || this._pendingRequests.size === 0) return true;
-    return await new Promise((resolve11) => {
+    return await new Promise((resolve12) => {
       const waiter = () => {
         clearTimeout(timer);
-        resolve11(true);
+        resolve12(true);
       };
       const timer = setTimeout(() => {
         this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-        resolve11(false);
+        resolve12(false);
       }, timeoutMs);
       this._drainWaiters.push(waiter);
     });
@@ -94530,7 +94529,7 @@ var BrokerDesk = class {
     try {
       answer = await Promise.race([
         asked.answer,
-        new Promise((resolve11) => call2.signal.aborted ? resolve11(null) : call2.signal.addEventListener("abort", () => resolve11(null), { once: true }))
+        new Promise((resolve12) => call2.signal.aborted ? resolve12(null) : call2.signal.addEventListener("abort", () => resolve12(null), { once: true }))
       ]);
     } finally {
       call2.signal.removeEventListener("abort", leave);
@@ -96454,6 +96453,11 @@ var ExternalApps = class {
     }
     return out;
   }
+  sessionBoundaryOpen = () => false;
+  /** Host-owned policy; a request cannot claim an auto preset in its arguments. */
+  setSessionBoundaryPolicy(policy) {
+    this.sessionBoundaryOpen = policy;
+  }
   /**
    * An app's tool list — if the app is down, **this is where it starts** (the first time it is
    * needed).
@@ -96462,9 +96466,9 @@ var ExternalApps = class {
    * read is the place it is enforced: this list becomes the source of truth both for what attaches to
    * a session (A-5) and for the tools a screen can call.
    */
-  async tools(ref, audience) {
+  async tools(ref, audience, sessionId) {
     const e = this.require(ref);
-    const all = await this.use(e, async () => e.life.tools ?? []);
+    const all = await this.use(e, async () => e.life.tools ?? [], !!sessionId && this.sessionBoundaryOpen(sessionId));
     return all.filter((t) => !audience || t.visibility.includes(audience)).map((t) => t.tool);
   }
   /**
@@ -96596,7 +96600,8 @@ var ExternalApps = class {
       return { runId, status, result, error: error51, durationMs };
     };
     if (!e.manifest) return done("rejected", null, `This app's manifest is invalid: ${e.error}`);
-    if (!e.scope.trusted) return done("rejected", null, "This app's project is not trusted, so Centralu does not call its apps");
+    const open5 = caller.kind === "session" && this.sessionBoundaryOpen(caller.sessionId);
+    if (!e.scope.trusted && !open5) return done("rejected", null, "This app's project is not trusted, so Centralu does not call its apps");
     const held3 = this.held(e);
     if (held3) return done("rejected", null, held3);
     if (e.life.gaveUp) return done("rejected", null, `This app stopped after failing ${this.timing.maxFailures} times in a row`);
@@ -96644,7 +96649,7 @@ var ExternalApps = class {
           abort.abort();
           for (const sig of upstream) sig.removeEventListener("abort", onUp);
         }
-      });
+      }, open5);
     } catch (err) {
       return done("error", null, err.message);
     }
@@ -97248,11 +97253,11 @@ var ExternalApps = class {
   }
   // ── Lifecycle ──────────────────────────────────────────────────────────────────────
   /** An app is never idle while in use — the idle timer is set again once it is done */
-  async use(e, fn2) {
+  async use(e, fn2, boundaryOpen = false) {
     e.life.inflight += 1;
     this.clearIdle(e);
     try {
-      return await fn2(await this.ensureRunning(e));
+      return await fn2(await this.ensureRunning(e, boundaryOpen));
     } finally {
       e.life.inflight -= 1;
       if (e.life.inflight === 0) for (const w of e.life.idleWaiters.splice(0)) w();
@@ -97266,14 +97271,14 @@ var ExternalApps = class {
    */
   drain(e, ms3) {
     if (e.life.inflight === 0) return Promise.resolve(true);
-    return new Promise((resolve11) => {
+    return new Promise((resolve12) => {
       const waiter = () => {
         clearTimeout(t);
-        resolve11(true);
+        resolve12(true);
       };
       const t = setTimeout(() => {
         e.life.idleWaiters = e.life.idleWaiters.filter((w) => w !== waiter);
-        resolve11(false);
+        resolve12(false);
       }, ms3);
       t.unref();
       e.life.idleWaiters.push(waiter);
@@ -97287,10 +97292,10 @@ var ExternalApps = class {
    * encountered restoring sessions (see the `resuming` comment in `manager.ts`). Everyone waits on the
    * same in-progress startup promise instead.
    */
-  ensureRunning(e) {
+  ensureRunning(e, boundaryOpen = false) {
     const L2 = e.life;
     if (!e.manifest) throw new AppUnavailableError(`The app cannot start \u2014 its manifest is invalid: ${e.error}`);
-    if (!e.scope.trusted) {
+    if (!e.scope.trusted && !boundaryOpen) {
       throw new AppUnavailableError("This app's project is not trusted, so the app does not start \u2014 trust the project and it will");
     }
     const held3 = this.held(e);
@@ -98092,12 +98097,12 @@ function readBook(raw) {
   return book;
 }
 function listenOn(port2, handler) {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const server2 = createServer2(handler);
     server2.once("error", reject);
     server2.listen(port2, "127.0.0.1", () => {
       server2.removeListener("error", reject);
-      resolve11(server2);
+      resolve12(server2);
     });
   });
 }
@@ -98165,8 +98170,155 @@ var OriginPorts = class {
   }
 };
 
+// packages/agent-host/src/dev-services/worktree-recovery.ts
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { existsSync as existsSync13 } from "node:fs";
+import { chmod, lstat as lstat3, mkdir as mkdir2, readFile, readdir as readdir2, realpath as realpath3, rm as rm2, stat as stat3, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join16, resolve as resolve2 } from "node:path";
+var WORKTREE_RECOVERY_MAX_BYTES = 256 * 1024 * 1024;
+var RECOVERY_TIMEOUT = 12e4;
+function worktreeRecoveryDir(sessionId) {
+  if (!isSessionId(sessionId)) throw new Error("Invalid session id for worktree recovery");
+  return join16(dataRoot(), "worktree-recovery", sessionId);
+}
+async function clearWorktreeRecovery(sessionId) {
+  await rm2(worktreeRecoveryDir(sessionId), { recursive: true, force: true });
+}
+async function saveWorktreeRecovery(sessionId, cwd, trunk, branch) {
+  const plans = [];
+  let bytes2 = 0;
+  const account = (size) => {
+    bytes2 += size;
+    if (bytes2 > WORKTREE_RECOVERY_MAX_BYTES) {
+      throw new Error(`Worktree recovery exceeds the 256 MiB input limit (tracked and non-ignored untracked files plus staged changes, including submodules). No files were staged or removed; save the work elsewhere before deleting.`);
+    }
+  };
+  const prepare = async (repo, path2) => {
+    const tip = (await runGit(repo, ["rev-parse", "--verify", "HEAD"])).trim();
+    const refs = ["HEAD"];
+    if (!path2 && branch) {
+      const ref = `refs/heads/${branch}`;
+      if (await runGit(repo, ["rev-parse", "--verify", ref]).then(() => true).catch(() => false)) refs.push(ref);
+    } else if (path2) {
+      refs.push(...(await runGit(repo, ["for-each-ref", "--format=%(refname)", "refs/heads/"])).trim().split("\n").filter(Boolean));
+    }
+    const baselineOid = !path2 ? await runGit(repo, ["rev-parse", "--verify", `${trunk}^{commit}`]).then((s) => s.trim()).catch(() => null) : null;
+    const exclude = path2 ? ["--not", "--remotes"] : baselineOid ? ["--not", baselineOid] : [];
+    const commits = Number((await runGit(repo, ["rev-list", "--count", ...refs, ...exclude])).trim());
+    plans.push({ repo, path: path2, tip, refs, commits });
+    const stagedNames = new Set((await runGit(repo, ["diff", "--cached", "--name-only", "-z", "--no-renames", tip], { timeout: RECOVERY_TIMEOUT })).split("\0"));
+    const modules = [];
+    const stagedObjects = [];
+    for (const row of (await runGit(repo, ["ls-files", "--stage", "-z"])).split("\0")) {
+      if (!row) continue;
+      const tab = row.indexOf("	");
+      const rel = row.slice(tab + 1);
+      if (row.startsWith("160000 ")) modules.push(rel);
+      else if (stagedNames.has(rel)) stagedObjects.push(row.split(" ")[1]);
+    }
+    if (stagedObjects.length) {
+      const sizes = await runGit(repo, ["cat-file", "--batch-check=%(objectsize)"], { input: stagedObjects.join("\n") + "\n" });
+      for (const size of sizes.trim().split("\n")) {
+        if (!/^\d+$/.test(size)) throw new Error("Could not measure staged recovery data");
+        account(Number(size));
+      }
+    }
+    const files = new Set((await runGit(repo, ["ls-files", "--cached", "--others", "--exclude-standard", "-z"])).split("\0").filter(Boolean));
+    for (const rel of files) {
+      const file2 = await lstat3(join16(repo, rel)).catch((e) => {
+        if (e.code !== "ENOENT") throw e;
+        return null;
+      });
+      if (file2?.isFile() || file2?.isSymbolicLink()) account(file2.size);
+      else if (file2?.isDirectory() && existsSync13(join16(repo, rel, ".git"))) modules.push(rel);
+    }
+    for (const rel of new Set(modules)) {
+      await assertExistingPath(repo, rel).catch((e) => {
+        if (existsSync13(join16(repo, rel))) throw e;
+      });
+      if (existsSync13(join16(repo, rel, ".git"))) await prepare(join16(repo, rel), path2 ? `${path2}/${rel}` : rel);
+    }
+  };
+  await prepare(cwd, "");
+  const snapshotId = randomUUID6();
+  const dir = join16(worktreeRecoveryDir(sessionId), snapshotId);
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  const snapshot2 = { snapshot: snapshotId, tip: plans[0].tip, changedFiles: 0, commits: 0, repositories: [] };
+  const patchFile = async (repo, tip, file2, env) => {
+    await runGit(repo, ["diff", "--cached", "--binary", "--full-index", "--no-renames", `--output=${file2}`, tip], { env, timeout: RECOVERY_TIMEOUT });
+    await chmod(file2, 384);
+    if ((await stat3(file2)).size > 0) return true;
+    await rm2(file2);
+    return false;
+  };
+  try {
+    for (const [n, plan] of plans.entries()) {
+      const { repo, path: path2, tip, refs, commits } = plan;
+      const entry = { path: path2, tip, refs, patch: false, staged: false, bundle: commits > 0 };
+      snapshot2.repositories.push(entry);
+      snapshot2.commits += commits;
+      if (entry.bundle) await runGit(repo, ["bundle", "create", join16(dir, `${n}.bundle`), ...refs], { timeout: RECOVERY_TIMEOUT });
+      entry.staged = await patchFile(repo, tip, join16(dir, `${n}.staged.patch`));
+      const stagedNames = await runGit(repo, ["diff", "--cached", "--name-only", "-z", "--no-renames", tip], { timeout: RECOVERY_TIMEOUT });
+      const env = { GIT_INDEX_FILE: join16(dir, `${n}.index`) };
+      try {
+        await runGit(repo, ["read-tree", tip], { env });
+        await runGit(repo, ["add", "-A", "--", "."], { env, timeout: RECOVERY_TIMEOUT });
+        const names = await runGit(repo, ["diff", "--cached", "--name-only", "-z", "--no-renames", tip], { env, timeout: RECOVERY_TIMEOUT });
+        snapshot2.changedFiles += new Set([...names.split("\0"), ...stagedNames.split("\0")].filter(Boolean)).size;
+        entry.patch = await patchFile(repo, tip, join16(dir, `${n}.patch`), env);
+      } finally {
+        await rm2(env.GIT_INDEX_FILE, { force: true });
+      }
+    }
+    await writeFile2(join16(dir, "snapshot.json"), JSON.stringify(snapshot2), { mode: 384 });
+    return { snapshot: snapshotId, tip: snapshot2.tip, changedFiles: snapshot2.changedFiles, commits: snapshot2.commits };
+  } catch (e) {
+    await rm2(dir, { recursive: true, force: true });
+    throw e;
+  }
+}
+async function worktreeRecoveryBytes(sessionId) {
+  const dir = worktreeRecoveryDir(sessionId);
+  if (!existsSync13(dir)) return 0;
+  const sizes = await Promise.all((await readdir2(dir, { recursive: true })).map(async (name) => {
+    const s = await stat3(join16(dir, name));
+    return s.isFile() ? s.size : 0;
+  }));
+  return sizes.reduce((a, b2) => a + b2, 0);
+}
+async function restoreWorktreeRecovery(sessionId, repo, path2, branch, recovery, trust) {
+  if (!isSessionId(recovery.snapshot)) throw new Error("Invalid recovery snapshot");
+  const dir = join16(worktreeRecoveryDir(sessionId), recovery.snapshot);
+  const snapshot2 = JSON.parse(await readFile(join16(dir, "snapshot.json"), "utf8"));
+  const root3 = snapshot2.repositories[0];
+  if (!existsSync13(path2)) {
+    if (await runGit(repo, ["show-ref", "--verify", `refs/heads/${branch}`]).then(() => true).catch(() => false)) {
+      branch = `recovered/${sessionId}`;
+    }
+    if (root3.bundle) await runGit(repo, ["fetch", join16(dir, "0.bundle"), ...root3.refs ?? ["HEAD"]], { allowRepoPrograms: trust.trusted === true });
+    await runGit(repo, ["worktree", "add", "-b", branch, path2, recovery.tip], { allowRepoPrograms: trust.trusted === true });
+    if (root3.patch || root3.staged) {
+      try {
+        if (root3.staged) await runGit(path2, ["apply", "--cached", "--binary", join16(dir, "0.staged.patch")]);
+        if (root3.patch) await runGit(path2, ["apply", "--binary", join16(dir, "0.patch")]);
+      } catch {
+        return { branch, notice: `Restored branch ${branch}. Patches could not all be applied. Recovery files remain at ${dir}; apply numbered .patch files manually with git apply and .staged.patch files with git apply --cached.` };
+      }
+    }
+  } else {
+    const common = async (cwd) => realpath3(resolve2(cwd, (await runGit(cwd, ["rev-parse", "--git-common-dir"])).trim()));
+    if (await common(path2) !== await common(repo)) throw new Error(`The worktree path belongs to another repository. Recovery files remain at ${dir}`);
+    branch = (await runGit(path2, ["symbolic-ref", "--quiet", "--short", "HEAD"])).trim();
+  }
+  return {
+    branch,
+    notice: `Restored branch ${branch}. Recovery files remain at ${dir}: ${recovery.changedFiles} uncommitted files, ${recovery.commits} commits absent from the trunk or submodule remotes. Numbered .patch files can be applied with git apply; .bundle files list their saved refs with git bundle list-heads and can be fetched with git fetch <bundle> <ref>:<branch>. snapshot.json names each repository and its refs. Submodule recovery is manual. These files are removed when this session is deleted for good.`
+  };
+}
+
 // packages/agent-host/src/sessions/manager.ts
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 
 // packages/agent-host/src/sessions/tool-cost.ts
 import { createHash as createHash8 } from "node:crypto";
@@ -98484,8 +98636,8 @@ var READER_TOOLS = [
 var DELEGATE_TOOLS = [
   {
     name: "ask_project",
-    description: "Has another Centralu project do a job in its own folder; returns its session's answer. For another project's apps, use find_apps.",
-    schema: external_exports.object({ project: external_exports.string(), task: external_exports.string().optional() })
+    description: "Asks another project's existing session; returns its answer. For another project's apps, use find_apps.",
+    schema: external_exports.object({ project: external_exports.string(), session: external_exports.string().optional(), task: external_exports.string().optional() })
   }
 ];
 var DELEGATE_BUDGET_CHARS = 400;
@@ -98609,7 +98761,7 @@ function askProjectText(r) {
   const where = `the session "${r.sessionName}" [${r.sessionId}] in ${r.project}`;
   if (r.state === "working") {
     return {
-      text: `${r.project} is still working on it in ${where}${r.notice ? ` \u2014 ${r.notice}` : ""}. To keep waiting, call ask_project again with project "${r.project}" and no task; the work goes on meanwhile.`
+      text: `${r.project} is still working on it in ${where}${r.notice ? ` \u2014 ${r.notice}` : ""}. To keep waiting, call ask_project again with project "${r.project}", session "${r.sessionId}" and no task; the work goes on meanwhile.`
     };
   }
   const lines = [`${r.project} answered (from ${where}), as JSON:`, trustedJsonText(r.answer || "(no final text)")];
@@ -98629,7 +98781,7 @@ function agentRunText(r) {
       return { text: `Stopped ${who}.` };
     case "deleted":
       return {
-        text: `Cleaned up ${who}: "${r.branch}" had landed on the trunk (${r.proof}), so its worktree and branch were removed and the session went to the trash. Tell the person in one line.`
+        text: (r.warning ? `Moved ${who} to the trash. Warning: ${r.warning} ` : `Cleaned up ${who}: its worktree and branch "${r.branch}" were removed and the session went to the trash. `) + (r.setAside.changedFiles || r.setAside.commits ? `${r.setAside.changedFiles} uncommitted files, ${r.setAside.commits} commits not on the trunk, kept in the trash. ` : "Nothing needed setting aside. ") + "Tell the person in one line."
       };
     case "at_rest":
       return {
@@ -98665,7 +98817,8 @@ async function runOrchestratorTool(tools, name, args, caller = { sessionId: null
     const project2 = typeof args.project === "string" ? args.project.trim() : "";
     if (!project2) return { text: "Give a project \u2014 the name of another Centralu project.", isError: true };
     const task = typeof args.task === "string" && args.task.trim() ? args.task : void 0;
-    return askProjectText(await tools.askProject({ project: project2, ...task ? { task } : {} }, signal));
+    const session2 = typeof args.session === "string" && args.session.trim() ? args.session.trim() : void 0;
+    return askProjectText(await tools.askProject({ project: project2, ...session2 ? { session: session2 } : {}, ...task ? { task } : {} }, signal));
   }
   if (name === "start_agent" || name === "agent_session") {
     if (caller.profile !== "reader") return { text: `Not a tool of this session: ${name}`, isError: true };
@@ -99077,7 +99230,7 @@ function shortHash(value) {
 
 // packages/agent-host/src/sessions/orchestrator-home.ts
 import { mkdirSync as mkdirSync7 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 var preamble = true;
 function setOrchestratorPreamble(on2) {
   preamble = on2;
@@ -99093,7 +99246,7 @@ function orchestratorRole() {
 ${ORCHESTRATOR_ROLE}` : ORCHESTRATOR_ROLE;
 }
 function orchestratorHome() {
-  const dir = join16(dataRoot(), "orchestrator");
+  const dir = join17(dataRoot(), "orchestrator");
   mkdirSync7(dir, { recursive: true });
   return dir;
 }
@@ -99641,7 +99794,7 @@ var SessionAppsHub = class {
    * keep answering "yes" even after trust is revoked.
    */
   refsFor(session2) {
-    const usable = this.rt.list().filter((a) => !UNUSABLE.has(a.status));
+    const usable = this.rt.list().filter((a) => !UNUSABLE.has(a.status) || a.status === "untrusted" && !!this.opts.boundaryOpen?.(session2.id));
     const hits = usable.filter((a) => givesApp(session2, a)).map((a) => ({ ref: { projectId: a.projectId, appId: a.appId }, server: appMcpServerName(a.appId) })).sort((x, y) => x.server.localeCompare(y.server));
     const taken = new Set(hits.map((h) => h.server));
     for (const x of this.opts.onDemand?.attached(session2.id) ?? []) {
@@ -99668,8 +99821,8 @@ var SessionAppsHub = class {
     const own = session2?.id ? this.opts.onDemand?.attached(session2.id).find((x) => sameRef(x.ref, ref)) : void 0;
     const onDemand = !!session2 && !!own && this.opts.onDemand.allowed(session2, app2);
     if (!session2 || !givesApp(session2, app2) && !onDemand) return { reachable: false, reason: "other-project" };
-    if (app2.status === "untrusted") return { reachable: false, reason: "untrusted" };
-    if (UNUSABLE.has(app2.status)) return { reachable: false, reason: "app-unusable", status: app2.status };
+    if (app2.status === "untrusted" && !this.opts.boundaryOpen?.(session2.id)) return { reachable: false, reason: "untrusted" };
+    if (UNUSABLE.has(app2.status) && !(app2.status === "untrusted" && this.opts.boundaryOpen?.(session2.id))) return { reachable: false, reason: "app-unusable", status: app2.status };
     const server2 = givesApp(session2, app2) ? appMcpServerName(app2.appId) : own.server;
     const attached = live?.appAttachment?.(server2) ?? "attached";
     if (attached === "restart") return { reachable: false, reason: "restart" };
@@ -99751,7 +99904,7 @@ var Attachment2 = class {
     let timer;
     try {
       const listed = await Promise.race([
-        this.hub.rt.tools(hit.ref, "model"),
+        this.hub.rt.tools(hit.ref, "model", this.session.id),
         new Promise((_, reject) => {
           timer = setTimeout(() => reject(new Error(`did not list its tools within ${Math.round(waitMs / 1e3)}s`)), waitMs);
         })
@@ -99796,7 +99949,7 @@ var Attachment2 = class {
     let timer;
     const first = await Promise.race([
       pending.then((o) => ({ o })),
-      new Promise((resolve11) => timer = setTimeout(() => resolve11(null), opts.waitMs))
+      new Promise((resolve12) => timer = setTimeout(() => resolve12(null), opts.waitMs))
     ]);
     clearTimeout(timer);
     if (first) return toResult(first.o);
@@ -99902,15 +100055,15 @@ The call has not stopped and carries on. Do not call it again: pass this id as r
     if (i !== -1) return Promise.resolve(this.noted.splice(i, 1)[0].callId);
     if (this.closed) return Promise.resolve(null);
     const waitMs = this.hub.opts.callJoinWaitMs ?? CALL_JOIN_WAIT_MS;
-    return new Promise((resolve11) => {
+    return new Promise((resolve12) => {
       const waiter = {
         server: server2,
         tool,
         args: key,
-        resolve: resolve11,
+        resolve: resolve12,
         timer: setTimeout(() => {
           this.waiters = this.waiters.filter((x) => x !== waiter);
-          resolve11(null);
+          resolve12(null);
         }, waitMs)
       };
       waiter.timer.unref?.();
@@ -100021,12 +100174,12 @@ var AppAccess = class {
   }
   allowed(session2, app2) {
     const from = session2.projectId;
-    if (from === null || !this.projectTrusted(from)) return false;
+    if (from === null || !this.projectTrusted(from) && !this.deps.boundaryOpen?.(session2.id)) return false;
     if (app2.projectId === null) return true;
     if (app2.projectId === from || app2.shared !== true) return false;
     const r = this.records(session2.id).find((x) => x.appId === app2.appId && x.projectId === app2.projectId);
     if (!r) return false;
-    return r.consent === "once" || !!this.deps.store.getProjectConsent(from, app2.projectId, "apps");
+    return !!this.deps.boundaryOpen?.(session2.id) || r.consent === "once" || !!this.deps.store.getProjectConsent(from, app2.projectId, "apps");
   }
   // ── The three tools ──
   find(sessionId, query) {
@@ -100049,7 +100202,7 @@ var AppAccess = class {
     const app2 = named.app;
     const target = { projectId: app2.projectId, appId: app2.appId };
     const has = already.find((h) => h.ref.appId === target.appId && h.ref.projectId === target.projectId);
-    if (has) return { ok: true, server: has.server, tools: await this.toolNames(target), when: "now", already: true };
+    if (has) return { ok: true, server: has.server, tools: await this.toolNames(target, sessionId), when: "now", already: true };
     if (!this.candidates(session2).some((a) => a.appId === app2.appId && a.projectId === app2.projectId)) {
       return { ok: false, error: this.whyNot(session2, app2) };
     }
@@ -100062,7 +100215,7 @@ var AppAccess = class {
         signal
       );
       if (!res.ok) return res;
-      consent = this.deps.store.getProjectConsent(session2.projectId, app2.projectId, "apps") ? "always" : "once";
+      consent = this.deps.boundaryOpen?.(sessionId) ? "auto" : this.deps.store.getProjectConsent(session2.projectId, app2.projectId, "apps") ? "always" : "once";
       const again = this.gate(sessionId);
       if (!again.ok) return again;
       if (!this.candidates(again.session).some((a) => a.appId === app2.appId && a.projectId === app2.projectId)) {
@@ -100074,7 +100227,7 @@ var AppAccess = class {
     const server2 = this.freeServer(app2.appId, taken);
     this.save(sessionId, [...kept, { projectId: app2.projectId, appId: app2.appId, server: server2, consent, at: Date.now() }]);
     const when = this.deps.attachedChanged(sessionId);
-    return { ok: true, server: server2, tools: await this.toolNames(target), when };
+    return { ok: true, server: server2, tools: await this.toolNames(target, sessionId), when };
   }
   detach(sessionId, ref) {
     const mine = this.records(sessionId);
@@ -100118,7 +100271,7 @@ var AppAccess = class {
     const session2 = this.deps.session(sessionId);
     if (!session2) return { ok: false, error: "This session cannot attach apps." };
     if (session2.projectId === null) return { ok: false, error: "Only a session in a project can attach apps from other projects." };
-    if (!this.projectTrusted(session2.projectId)) {
+    if (!this.projectTrusted(session2.projectId) && !this.deps.boundaryOpen?.(sessionId, "attach from an untrusted project")) {
       return { ok: false, error: "This session's project is not trusted, so it cannot attach apps \u2014 the person can trust it from the project menu." };
     }
     return { ok: true, session: session2 };
@@ -100126,7 +100279,7 @@ var AppAccess = class {
   /** What this session could attach now: shared apps of other trusted projects, and user-folder apps, minus what it has */
   candidates(session2) {
     const have = this.deps.hub.refsFor(session2);
-    return this.deps.hub.rt.list().filter((a) => !UNUSABLE2.has(a.status)).filter((a) => a.projectId === null || a.projectId !== session2.projectId && a.shared === true).filter((a) => !have.some((h) => h.ref.appId === a.appId && h.ref.projectId === a.projectId)).sort((x, y) => this.refOf(x).localeCompare(this.refOf(y)));
+    return this.deps.hub.rt.list().filter((a) => !UNUSABLE2.has(a.status) || a.status === "untrusted" && this.deps.boundaryOpen?.(session2.id)).filter((a) => a.projectId === null || a.projectId !== session2.projectId && a.shared === true).filter((a) => !have.some((h) => h.ref.appId === a.appId && h.ref.projectId === a.projectId)).sort((x, y) => this.refOf(x).localeCompare(this.refOf(y)));
   }
   whyNot(session2, app2) {
     if (app2.projectId !== null && app2.projectId === session2.projectId) return `${this.refOf(app2)} is this project's own app; it is attached already when the project is trusted.`;
@@ -100182,13 +100335,13 @@ var AppAccess = class {
     for (let n = 2; ; n++) if (!taken.includes(`${base2}-${n}`)) return `${base2}-${n}`;
   }
   /** The app's agent tools for the tool result — started here if never listed, within the hub's cap; empty on failure */
-  async toolNames(ref) {
+  async toolNames(ref, sessionId) {
     const known = this.deps.hub.rt.knownTools(ref, "model");
     if (known) return known.map((t) => t.name);
     let timer;
     try {
       const listed = await Promise.race([
-        this.deps.hub.rt.tools(ref, "model"),
+        this.deps.hub.rt.tools(ref, "model", sessionId),
         new Promise((_, reject) => timer = setTimeout(() => reject(new Error("timeout")), this.deps.toolListWaitMs ?? TOOL_LIST_WAIT_MS2))
       ]);
       return listed.map((t) => t.name);
@@ -100222,7 +100375,7 @@ function parse3(raw) {
     const v = JSON.parse(raw);
     if (!Array.isArray(v)) return [];
     return v.filter(
-      (x) => !!x && typeof x === "object" && (typeof x.projectId === "string" || x.projectId === null) && typeof x.appId === "string" && typeof x.server === "string" && x.server.startsWith(appMcpServerName("")) && (x.consent === "always" || x.consent === "once" || x.consent === "none")
+      (x) => !!x && typeof x === "object" && (typeof x.projectId === "string" || x.projectId === null) && typeof x.appId === "string" && typeof x.server === "string" && x.server.startsWith(appMcpServerName("")) && (x.consent === "always" || x.consent === "once" || x.consent === "none" || x.consent === "auto")
     );
   } catch {
     return [];
@@ -100250,7 +100403,7 @@ var AgentRunWait = class {
     this.sessionName = sessionName;
     this.onUsage = onUsage;
     this.readAnswer = readAnswer2;
-    this.done = new Promise((resolve11, reject) => this.settle = { resolve: resolve11, reject });
+    this.done = new Promise((resolve12, reject) => this.settle = { resolve: resolve12, reject });
     this.done.catch(() => {
     });
   }
@@ -100465,7 +100618,7 @@ function windowOf(list, id2, label, since, writes, nameOf) {
 
 // packages/agent-host/src/sessions/ask-project.ts
 import { realpathSync as realpathSync3, statSync as statSync8 } from "node:fs";
-import { isAbsolute as isAbsolute4, relative as relative4, resolve as resolve2, sep as sep4 } from "node:path";
+import { isAbsolute as isAbsolute4, relative as relative4, resolve as resolve3, sep as sep4 } from "node:path";
 var ASK_WAIT_MS = 24e4;
 var ANSWER_MAX_CHARS = 6e3;
 var ANSWER_HEAD_CHARS = 4500;
@@ -100534,7 +100687,7 @@ function readableGrants(paths, projectRoot) {
   return { granted, outside };
 }
 function underGrant(path2, grants, cwd) {
-  const abs = resolve2(cwd, path2);
+  const abs = resolve3(cwd, path2);
   const r = real(abs) ?? abs;
   for (const g5 of grants) {
     if (r === g5 || r.startsWith(g5.endsWith(sep4) ? g5 : g5 + sep4)) return true;
@@ -100835,32 +100988,32 @@ function orchestratorMemory(reader, sessionId) {
 
 // packages/agent-host/src/sessions/manager.ts
 import { homedir as homedir12 } from "node:os";
-import { basename as basename5, isAbsolute as isAbsolute9, join as join28, relative as relative8, resolve as resolve10, sep as sep11 } from "node:path";
-import { existsSync as existsSync18, rmSync as rmSync7, statSync as statSync12 } from "node:fs";
+import { basename as basename5, isAbsolute as isAbsolute9, join as join29, relative as relative8, resolve as resolve11, sep as sep11 } from "node:path";
+import { existsSync as existsSync19, rmSync as rmSync7, statSync as statSync12 } from "node:fs";
 import { exec as exec6 } from "node:child_process";
 
 // packages/agent-host/src/adapters/claude/index.ts
 init_sdk();
 import { homedir as homedir5 } from "node:os";
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 
 // packages/agent-host/src/adapters/input-receipts.ts
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 var InputReceipts = class {
   pending = /* @__PURE__ */ new Map();
   ended = /* @__PURE__ */ new Set();
   create(observer) {
-    const id2 = randomUUID7();
-    let resolve11;
+    const id2 = randomUUID8();
+    let resolve12;
     let reject;
     const done = new Promise((yes, no2) => {
-      resolve11 = yes;
+      resolve12 = yes;
       reject = no2;
     });
     done.catch(() => {
     });
     const receipt = { id: id2, done, cancelled: false, completed: false };
-    this.pending.set(id2, { receipt, resolve: resolve11, reject, observer });
+    this.pending.set(id2, { receipt, resolve: resolve12, reject, observer });
     return receipt;
   }
   get size() {
@@ -100971,7 +101124,7 @@ async function installedCliVersion(name, packageName, deps = realDeps2()) {
 // packages/agent-host/src/adapters/claude/exe-link.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { closeSync as closeSync6, copyFileSync as copyFileSync2, linkSync, mkdirSync as mkdirSync10, openSync as openSync6, readdirSync as readdirSync7, readFileSync as readFileSync10, readSync as readSync4, renameSync as renameSync10, rmSync as rmSync6, statSync as statSync11 } from "node:fs";
-import { basename as basename4, dirname as dirname8, join as join21 } from "node:path";
+import { basename as basename4, dirname as dirname8, join as join22 } from "node:path";
 var PLACEHOLDER_MAX_BYTES = 1e6;
 var ClaudePlaceholderError = class extends Error {
   name = "ClaudePlaceholderError";
@@ -101007,7 +101160,7 @@ function placeholderProblem(exe, size, fs2 = realExeFs) {
   }
   if (head.toString("latin1") === "MZ") return null;
   const pkg = dirname8(dirname8(exe));
-  const installer = basename4(dirname8(exe)).toLowerCase() === "bin" ? join21(pkg, "install.cjs") : null;
+  const installer = basename4(dirname8(exe)).toLowerCase() === "bin" ? join22(pkg, "install.cjs") : null;
   let canRerun = false;
   if (installer) {
     try {
@@ -101022,14 +101175,14 @@ function placeholderProblem(exe, size, fs2 = realExeFs) {
     canRerun ? `To fix it, close every Claude Code (Centralu's Claude sessions, terminals, editors) and run \`node "${installer}"\`, or reinstall with \`npm i -g @anthropic-ai/claude-code\` while no Claude Code is running.` : "To fix it, close every Claude Code (Centralu's Claude sessions, terminals, editors) and reinstall it with `npm i -g @anthropic-ai/claude-code`."
   ].join(" ");
 }
-function claudeKey(exe, stat6, fs2 = realExeFs) {
+function claudeKey(exe, stat7, fs2 = realExeFs) {
   let version2 = null;
   try {
-    const pkg = JSON.parse(fs2.read(join21(dirname8(dirname8(exe)), "package.json")));
+    const pkg = JSON.parse(fs2.read(join22(dirname8(dirname8(exe)), "package.json")));
     if (pkg.name === "@anthropic-ai/claude-code" && typeof pkg.version === "string" && pkg.version) version2 = pkg.version;
   } catch {
   }
-  const raw = version2 ? `${version2}-${stat6.size}` : `${stat6.size}-${Math.floor(stat6.mtimeMs)}`;
+  const raw = version2 ? `${version2}-${stat7.size}` : `${stat7.size}-${Math.floor(stat7.mtimeMs)}`;
   return raw.replace(/[^A-Za-z0-9._-]/g, "_");
 }
 function windowsStart(platform = process.platform) {
@@ -101051,7 +101204,7 @@ var ClaudeLinks = class {
     return windowsStart(this.opts.platform);
   }
   base() {
-    return join21(this.opts.root(), "tools", "claude");
+    return join22(this.opts.root(), "tools", "claude");
   }
   /**
    * What to start for the `claude.exe` found at `exe`. Off Windows, or for anything but an `.exe`
@@ -101062,26 +101215,26 @@ var ClaudeLinks = class {
   prepare(exe) {
     const direct = { path: exe, key: null };
     if (!this.enabled || !/\.exe$/i.test(exe)) return direct;
-    let stat6;
+    let stat7;
     try {
-      stat6 = this.fs.stat(exe);
+      stat7 = this.fs.stat(exe);
     } catch {
       return direct;
     }
-    const problem2 = placeholderProblem(exe, stat6.size, this.fs);
+    const problem2 = placeholderProblem(exe, stat7.size, this.fs);
     if (problem2) throw new ClaudePlaceholderError(problem2);
-    const key = claudeKey(exe, stat6, this.fs);
-    const dir = join21(this.base(), key);
-    const target = join21(dir, "claude.exe");
+    const key = claudeKey(exe, stat7, this.fs);
+    const dir = join22(this.base(), key);
+    const target = join22(dir, "claude.exe");
     const ready = () => {
       try {
-        return this.fs.stat(target).size === stat6.size;
+        return this.fs.stat(target).size === stat7.size;
       } catch {
         return false;
       }
     };
     if (ready()) return this.use(key, target);
-    const tmp = join21(dir, `claude-${randomBytes2(4).toString("hex")}.tmp`);
+    const tmp = join22(dir, `claude-${randomBytes2(4).toString("hex")}.tmp`);
     try {
       this.fs.mkdir(dir);
       try {
@@ -101141,7 +101294,7 @@ var ClaudeLinks = class {
     for (const name of names) {
       if (name === this.current || this.uses.has(name)) continue;
       try {
-        this.fs.removeDir(join21(this.base(), name));
+        this.fs.removeDir(join22(this.base(), name));
       } catch {
       }
     }
@@ -102595,7 +102748,14 @@ function alwaysAllowKey(detail, opts = {}) {
 }
 
 // packages/agent-host/src/adapters/claude/cross-session.ts
-function withoutCrossSessionMessaging(options) {
+function withoutCrossSessionMessaging(options, preset = "normal") {
+  if (preset === "auto")
+    return {
+      ...options,
+      settings: options.settings ?? {},
+      disallowedTools: options.disallowedTools ?? [],
+      env: { ...process.env, ...options.env }
+    };
   const env = {
     ...process.env,
     ...options.env,
@@ -102695,7 +102855,7 @@ var ClaudeSession = class {
     this.opts = opts;
     this.emit = emit;
     this.launch = launch2;
-    this.ended = new Promise((resolve11) => this.markEnded = resolve11);
+    this.ended = new Promise((resolve12) => this.markEnded = resolve12);
     this.stream = new ClaudeStreamNormalizer(sessionId, () => ({
       model: opts.model ?? null,
       effort: opts.effort ?? null,
@@ -102946,8 +103106,8 @@ var ClaudeSession = class {
             if (questions.length === 0) return { behavior: "allow", updatedInput: toolInput };
             const requestId2 = `q-${++self2.reqCounter}`;
             self2.emit({ type: "question_request", sessionId: self2.sessionId, requestId: requestId2, questions });
-            return new Promise((resolve11) => {
-              self2.questions.set(requestId2, { resolve: resolve11, input: toolInput });
+            return new Promise((resolve12) => {
+              self2.questions.set(requestId2, { resolve: resolve12, input: toolInput });
               self2.releaseOnCancel(requestId2, options?.signal);
             });
           }
@@ -102956,17 +103116,17 @@ var ClaudeSession = class {
           if (key && self2.alwaysAllow.allows(key)) return { behavior: "allow", updatedInput: toolInput };
           const requestId = `req-${++self2.reqCounter}`;
           self2.emit({ type: "approval_request", sessionId: self2.sessionId, requestId, detail });
-          return new Promise((resolve11) => {
-            self2.pending.set(requestId, { resolve: resolve11, input: toolInput });
+          return new Promise((resolve12) => {
+            self2.pending.set(requestId, { resolve: resolve12, input: toolInput });
             self2.releaseOnCancel(requestId, options?.signal);
           });
         }
-      })
+      }, preset)
     });
     ClaudeAdapter.liveQueries.add(q2);
     ClaudeAdapter.querySessions.set(q2, this.sessionId);
     this.releaseLostCalls(q2);
-    this.goalKnown = new Promise((resolve11) => this.settleGoalKnown = resolve11);
+    this.goalKnown = new Promise((resolve12) => this.settleGoalKnown = resolve12);
     q2.supportedCommands().then((list) => {
       if (this.goalCommand === void 0 && Array.isArray(list)) this.goalCommand = list.some((c) => c?.name === "goal");
     }).catch(() => {
@@ -103194,7 +103354,7 @@ var ClaudeSession = class {
   send(text2) {
     this.sendInput(text2);
   }
-  sendInput(text2, uuid3 = randomUUID8(), note) {
+  sendInput(text2, uuid3 = randomUUID9(), note) {
     const goal = isGoalCommand(text2);
     if (!this.sendGate && !(goal && this.goalCommand === void 0)) {
       this.deliver(text2, uuid3, !!note);
@@ -103655,7 +103815,7 @@ var ClaudeAdapter = class _ClaudeAdapter {
     sleep: true
   };
   launchSettingsFingerprint(settings) {
-    return JSON.stringify({ v: 1, cwd: settings.cwd, permission: settings.permissionPreset, trusted: !!settings.projectTrusted, noSettings: !!settings.noSettingFiles });
+    return JSON.stringify({ v: settings.permissionPreset === "auto" ? 2 : 1, cwd: settings.cwd, permission: settings.permissionPreset, trusted: !!settings.projectTrusted, noSettings: !!settings.noSettingFiles });
   }
   async detect() {
     const path2 = whichTool("claude");
@@ -103742,7 +103902,7 @@ var ClaudeAdapter = class _ClaudeAdapter {
     let timer;
     await Promise.race([
       Promise.allSettled([...this.launch.closing]),
-      new Promise((resolve11) => timer = setTimeout(resolve11, this.launch.exitGraceMs))
+      new Promise((resolve12) => timer = setTimeout(resolve12, this.launch.exitGraceMs))
     ]);
     clearTimeout(timer);
   }
@@ -103752,7 +103912,7 @@ var ClaudeAdapter = class _ClaudeAdapter {
 import { execFile as execFile5 } from "node:child_process";
 
 // packages/agent-host/src/adapters/codex/bridge-path.ts
-import { existsSync as existsSync14 } from "node:fs";
+import { existsSync as existsSync15 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function bridgePath() {
   const candidates = [
@@ -103761,23 +103921,23 @@ function bridgePath() {
     new URL("./codex-orchestrator-bridge.mjs", import.meta.url)
     // the bundled build-output layout
   ].map((u) => fileURLToPath3(u));
-  const found = candidates.find((p) => existsSync14(p));
+  const found = candidates.find((p) => existsSync15(p));
   if (!found) throw new Error(`orchestrator bridge not found: ${candidates.join(", ")}`);
   return found;
 }
 
 // packages/agent-host/src/adapters/codex/index.ts
-import { existsSync as existsSync16, realpathSync as realpathSync7 } from "node:fs";
+import { existsSync as existsSync17, realpathSync as realpathSync7 } from "node:fs";
 import { homedir as homedir10 } from "node:os";
-import { dirname as dirname9, join as join23, resolve as resolve8 } from "node:path";
+import { dirname as dirname9, join as join24, resolve as resolve9 } from "node:path";
 import { promisify as promisify5 } from "node:util";
 
 // packages/agent-host/src/adapters/codex/native.ts
-import { existsSync as existsSync15, readFileSync as readFileSync11, realpathSync as realpathSync6 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync11, realpathSync as realpathSync6 } from "node:fs";
 var realDeps3 = () => ({
   platform: HOST_PLATFORM,
   arch: process.arch,
-  exists: existsSync15,
+  exists: existsSync16,
   read: (p) => readFileSync11(p, "utf8"),
   realpath: (p) => realpathSync6(p),
   launch: (p) => launchFor(p),
@@ -103946,14 +104106,14 @@ var CodexClient = class {
     if (this.closed) return Promise.reject(new Error("codex app-server has already exited"));
     const id2 = `${this.idPrefix}${this.nextId++}`;
     this.write({ id: id2, method, params });
-    return new Promise((resolve11, reject) => {
+    return new Promise((resolve12, reject) => {
       const timer = setTimeout(() => {
         if (this.pending.delete(id2)) reject(new Error(`No response for ${method}`));
       }, timeoutMs);
       this.pending.set(id2, {
         resolve: (v) => {
           clearTimeout(timer);
-          resolve11(v);
+          resolve12(v);
         },
         reject: (e) => {
           clearTimeout(timer);
@@ -103977,12 +104137,12 @@ var CodexClient = class {
     if (this.closed) return;
     this.closed = true;
     this.proc.stdin.end();
-    const exited = await new Promise((resolve11) => {
-      if (this.proc.exitCode !== null || this.proc.signalCode != null || this.finished) return resolve11(true);
-      const t = setTimeout(() => resolve11(false), 2e3);
+    const exited = await new Promise((resolve12) => {
+      if (this.proc.exitCode !== null || this.proc.signalCode != null || this.finished) return resolve12(true);
+      const t = setTimeout(() => resolve12(false), 2e3);
       this.proc.once("exit", () => {
         clearTimeout(t);
-        resolve11(true);
+        resolve12(true);
       });
     });
     if (!exited) this.proc.kill("SIGKILL");
@@ -104004,18 +104164,18 @@ var CodexClient = class {
 
 // packages/agent-host/src/adapters/codex/rollout.ts
 import { createReadStream as createReadStream2 } from "node:fs";
-import { readdir as readdir4 } from "node:fs/promises";
+import { readdir as readdir5 } from "node:fs/promises";
 import { createInterface as createInterface2 } from "node:readline";
 import { homedir as homedir6 } from "node:os";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 var MIN_SUMMARY_CHARS = 200;
-async function findRolloutPath(threadId, sessionsDir = join22(homedir6(), ".codex", "sessions")) {
+async function findRolloutPath(threadId, sessionsDir = join23(homedir6(), ".codex", "sessions")) {
   try {
     const suffix = `-${threadId}.jsonl`;
-    const names = await readdir4(sessionsDir, { recursive: true });
+    const names = await readdir5(sessionsDir, { recursive: true });
     const hits = names.filter((n) => String(n).endsWith(suffix)).sort();
     const hit = hits[hits.length - 1];
-    return hit ? join22(sessionsDir, String(hit)) : null;
+    return hit ? join23(sessionsDir, String(hit)) : null;
   } catch {
     return null;
   }
@@ -104216,7 +104376,7 @@ function userInputText(content) {
 }
 
 // packages/agent-host/src/adapters/codex/images.ts
-import { readFile as readFile2, stat as stat4 } from "node:fs/promises";
+import { readFile as readFile3, stat as stat5 } from "node:fs/promises";
 var IMAGE_MIMES2 = {
   png: "image/png",
   jpg: "image/jpeg",
@@ -104232,9 +104392,9 @@ async function imageEventFromDisk(sessionId, path2, maxBytes = IMAGE_MAX_BYTES)
   const mime = IMAGE_MIMES2[ext2];
   if (!mime) return fail4(`Cannot display this format (.${ext2})`);
   try {
-    const s = await stat4(path2);
+    const s = await stat5(path2);
     if (s.size > maxBytes) return fail4(`Image is too large (${Math.round(s.size / 1048576)}MB)`);
-    const buf = await readFile2(path2);
+    const buf = await readFile3(path2);
     return { type: "message_image", sessionId, mime, data: buf.toString("base64"), path: path2 };
   } catch (err) {
     return fail4(`Failed to read image: ${err.message}`);
@@ -105218,16 +105378,16 @@ var CodexChildTracker = class {
 };
 
 // packages/agent-host/src/adapters/codex/sandbox.ts
-import { realpath as realpath5 } from "node:fs/promises";
-import { resolve as resolve7 } from "node:path";
+import { realpath as realpath6 } from "node:fs/promises";
+import { resolve as resolve8 } from "node:path";
 async function sandboxConfig(cwd, preset, readConfig) {
   const roots = [];
   try {
     const stdout = await runGit(cwd, ["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"], { timeout: 5e3 });
     const [gitDir, commonDir] = stdout.trim().split(/\r?\n/);
     if (gitDir && commonDir) {
-      const gitPath = await realpath5(resolve7(cwd, gitDir));
-      const commonPath = await realpath5(resolve7(cwd, commonDir));
+      const gitPath = await realpath6(resolve8(cwd, gitDir));
+      const commonPath = await realpath6(resolve8(cwd, commonDir));
       if (gitPath !== commonPath) roots.push(commonPath);
     }
   } catch {
@@ -105255,7 +105415,7 @@ function permissionOptionsFor2(preset) {
 function repoFilesConfig(opts) {
   if (opts.projectTrusted === true && !opts.noSettingFiles) return {};
   const keys = /* @__PURE__ */ new Set();
-  for (const start2 of [resolve8(opts.cwd), realPathOr(opts.cwd)]) {
+  for (const start2 of [resolve9(opts.cwd), realPathOr(opts.cwd)]) {
     for (let dir = start2; ; dir = dirname9(dir)) {
       keys.add(dir);
       if (dirname9(dir) === dir) break;
@@ -105270,7 +105430,7 @@ function realPathOr(path2) {
   try {
     return realpathSync7.native(path2);
   } catch {
-    return resolve8(path2);
+    return resolve9(path2);
   }
 }
 var APP_APPROVAL_MODE = {
@@ -106389,7 +106549,7 @@ function threadIdOf(res) {
 }
 function codexHome() {
   const custom2 = process.env.CODEX_HOME?.trim();
-  return custom2 ? custom2 : join23(homedir10(), ".codex");
+  return custom2 ? custom2 : join24(homedir10(), ".codex");
 }
 var CODEX_VERBOSITIES = ["low", "medium", "high"];
 var CodexAdapter = class {
@@ -106445,7 +106605,7 @@ var CodexAdapter = class {
       const launch2 = launchFor(path2 ?? "codex");
       const { stdout } = await exec4(launch2.command, [...launch2.args, "--version"], { timeout: 5e3 });
       const version2 = `${stdout.trim()} \xB7 ${path2 ?? "PATH"}`;
-      const loggedIn = existsSync16(join23(codexHome(), "auth.json"));
+      const loggedIn = existsSync17(join24(codexHome(), "auth.json"));
       return {
         tool: "codex",
         installed: true,
@@ -106579,7 +106739,7 @@ function registeredTool(adapters2, preferred) {
 
 // packages/agent-host/src/dev-services/store.ts
 import Database from "better-sqlite3";
-import { existsSync as existsSync17, readFileSync as readFileSync12 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync12 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function resolveSchemaPath() {
   const candidates = [
@@ -106588,7 +106748,7 @@ function resolveSchemaPath() {
     new URL("../../../protocol/src/schema/schema.sql", import.meta.url)
     // source tree
   ].map((u) => fileURLToPath4(u));
-  const found = candidates.find((p) => existsSync17(p));
+  const found = candidates.find((p) => existsSync18(p));
   if (!found) throw new Error(`schema.sql not found: ${candidates.join(", ")}`);
   return found;
 }
@@ -106866,7 +107026,7 @@ var Store = class _Store {
     const probe = Object.create(_Store.prototype);
     const steps = probe.migrationSteps();
     const known = steps[steps.length - 1].to;
-    if (dbPath2 === ":memory:" || !existsSync17(dbPath2)) return empty(known);
+    if (dbPath2 === ":memory:" || !existsSync18(dbPath2)) return empty(known);
     const db = new Database(dbPath2, { readonly: true, fileMustExist: true });
     try {
       probe.db = db;
@@ -108667,7 +108827,7 @@ var Store = class _Store {
       this.db.prepare(`DELETE FROM sessions WHERE id = ? AND deleted_at IS NOT NULL`).run(sessionId);
       return true;
     });
-    while (!step()) await new Promise((resolve11) => setImmediate(resolve11));
+    while (!step()) await new Promise((resolve12) => setImmediate(resolve12));
     return true;
   }
   /** One session's messages in seq order, one transaction per chunk, letting the event loop go between chunks (#179) */
@@ -108682,7 +108842,7 @@ var Store = class _Store {
       if (rows.length > 0) after = rows[rows.length - 1].seq;
       return rows.length < chunk;
     });
-    while (!step()) await new Promise((resolve11) => setImmediate(resolve11));
+    while (!step()) await new Promise((resolve12) => setImmediate(resolve12));
   }
   isTrashed(sessionId) {
     return !!this.db.prepare(`SELECT 1 FROM sessions WHERE id = ? AND deleted_at IS NOT NULL`).get(sessionId);
@@ -109349,7 +109509,8 @@ function parseTrashRecord(json2) {
     projectName: str8(r.projectName),
     projectPath: str8(r.projectPath),
     removeExternal: r.removeExternal === true,
-    removeWorktree: r.removeWorktree === true
+    removeWorktree: r.removeWorktree === true,
+    ...r.recovery && typeof r.recovery === "object" && typeof r.recovery.snapshot === "string" && typeof r.recovery.tip === "string" && typeof r.recovery.changedFiles === "number" && typeof r.recovery.commits === "number" ? { recovery: r.recovery } : {}
   };
 }
 var OUT_OF_TRASH = `session_id NOT IN (SELECT id FROM sessions WHERE deleted_at IS NOT NULL)`;
@@ -109374,7 +109535,7 @@ function indexedText(kind, payload) {
 
 // packages/agent-host/src/dev-services/git.ts
 import { execFile as execFile6 } from "node:child_process";
-import { isAbsolute as isAbsolute8, relative as relative7, resolve as resolve9, sep as sep9 } from "node:path";
+import { isAbsolute as isAbsolute8, relative as relative7, resolve as resolve10, sep as sep9 } from "node:path";
 import { promisify as promisify6 } from "node:util";
 var exec5 = promisify6(execFile6);
 var OK2 = { timeout: 1e4, maxBuffer: 32 * 1024 * 1024 };
@@ -109446,8 +109607,8 @@ function assertLexicalGitPath(cwd, path2) {
   if (!path2 || path2.includes("\0") || path2.startsWith(":")) {
     throw Object.assign(new Error("Invalid git path"), { code: "internal" });
   }
-  const root3 = resolve9(cwd);
-  const target = isAbsolute8(path2) ? resolve9(path2) : resolve9(root3, path2);
+  const root3 = resolve10(cwd);
+  const target = isAbsolute8(path2) ? resolve10(path2) : resolve10(root3, path2);
   const rel = relative7(root3, target);
   if (rel === "") throw Object.assign(new Error("Path is the project root, not a file in it"), { code: "internal" });
   if (rel !== ".." && !rel.startsWith(`..${sep9}`) && !isAbsolute8(rel)) return rel;
@@ -109566,14 +109727,14 @@ async function gitIgnoredEntries(cwd, limit = 50, trust = {}) {
   if (paths.length === 0) return [];
   const sizes = /* @__PURE__ */ new Map();
   try {
-    const out = await new Promise((resolve11, reject) => {
+    const out = await new Promise((resolve12, reject) => {
       execFile6(
         "du",
         ["-sk", ...paths.slice(0, limit)],
         { cwd, timeout: 5e3, maxBuffer: 1 << 20 },
         (err, stdout) => (
           // du exits non-zero if even one entry cannot be read — whatever it did print is used anyway
-          stdout ? resolve11(stdout) : reject(err)
+          stdout ? resolve12(stdout) : reject(err)
         )
       );
     });
@@ -109686,8 +109847,8 @@ async function gitValidBranchName(name) {
     return false;
   }
 }
-async function gitWorktreeRemove(repoCwd, path2, force = false) {
-  await git(repoCwd, ["worktree", "remove", ...force ? ["--force"] : [], path2]);
+async function gitWorktreeRemove(repoCwd, path2, force = false, withSubmodules = false) {
+  await git(repoCwd, ["worktree", "remove", ...force ? ["--force", ...withSubmodules ? ["--force"] : []] : [], path2]);
 }
 async function gitBranchDelete(repoCwd, branch, trust = {}) {
   await git(repoCwd, ["branch", "-D", branch], trust);
@@ -109703,13 +109864,13 @@ async function gitWorktreeDirty(path2, trust = {}) {
 }
 
 // packages/agent-host/src/dev-services/worktree-dependencies.ts
-import { lstat as lstat4, readFile as readFile3, readdir as readdir5 } from "node:fs/promises";
-import { join as join24 } from "node:path";
+import { lstat as lstat5, readFile as readFile4, readdir as readdir6 } from "node:fs/promises";
+import { join as join25 } from "node:path";
 var LOCKFILES = ["pnpm-lock.yaml", "package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "bun.lock", "bun.lockb"];
 async function prepareWorktreeDependencies(projectCwd, worktreeCwd) {
   let locked = false;
   for (const name of LOCKFILES) {
-    const target = await lstat4(join24(worktreeCwd, name)).catch((err) => {
+    const target = await lstat5(join25(worktreeCwd, name)).catch((err) => {
       if (err.code === "ENOENT") return null;
       throw err;
     });
@@ -109718,7 +109879,7 @@ async function prepareWorktreeDependencies(projectCwd, worktreeCwd) {
       resolveExisting(projectCwd, name),
       resolveExisting(worktreeCwd, name)
     ]);
-    const [before, after] = await Promise.all([readFile3(source), readFile3(destination)]);
+    const [before, after] = await Promise.all([readFile4(source), readFile4(destination)]);
     if (!before.equals(after)) return;
     locked = true;
   }
@@ -109727,22 +109888,22 @@ async function prepareWorktreeDependencies(projectCwd, worktreeCwd) {
   const folders = [""];
   while (folders.length) {
     const folder = folders.pop();
-    const entries = await readdir5(join24(worktreeCwd, folder), { withFileTypes: true });
+    const entries = await readdir6(join25(worktreeCwd, folder), { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory() && entry.name !== ".git" && entry.name !== "node_modules") {
-        folders.push(join24(folder, entry.name));
+        folders.push(join25(folder, entry.name));
       }
     }
     if (folder && !entries.some((e) => e.name === "package.json" && e.isFile())) continue;
     if (entries.some((e) => e.name === "node_modules")) continue;
-    const rel = join24(folder, "node_modules");
+    const rel = join25(folder, "node_modules");
     try {
       const src = await resolveExisting(projectCwd, rel);
-      if (!(await lstat4(src)).isDirectory()) continue;
-      const manifest = join24(folder, "package.json");
+      if (!(await lstat5(src)).isDirectory()) continue;
+      const manifest = join25(folder, "package.json");
       const [source, target] = await Promise.all([
-        resolveExisting(projectCwd, manifest).then((p) => readFile3(p)),
-        resolveExisting(worktreeCwd, manifest).then((p) => readFile3(p))
+        resolveExisting(projectCwd, manifest).then((p) => readFile4(p)),
+        resolveExisting(worktreeCwd, manifest).then((p) => readFile4(p))
       ]);
       if (!source.equals(target)) continue;
       const dst = await prepareCopyTarget(worktreeCwd, rel);
@@ -109764,8 +109925,8 @@ async function prepareWorktreeDependencies(projectCwd, worktreeCwd) {
 }
 
 // packages/agent-host/src/dev-services/file-search.ts
-import { readdir as readdir6 } from "node:fs/promises";
-import { join as join25 } from "node:path";
+import { readdir as readdir7 } from "node:fs/promises";
+import { join as join26 } from "node:path";
 var MAX_FILES2 = 2e4;
 var TTL_MS2 = 15e3;
 var WALK_DEPTH = 6;
@@ -109793,7 +109954,7 @@ async function walk(root3) {
     const { dir, rel, depth } = queue.shift();
     let entries;
     try {
-      entries = await readdir6(dir, { withFileTypes: true });
+      entries = await readdir7(dir, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -109801,7 +109962,7 @@ async function walk(root3) {
       if (e.name.startsWith(".") && e.name !== ".env") continue;
       if (e.isDirectory()) {
         if (SKIP.has(e.name) || depth >= WALK_DEPTH) continue;
-        queue.push({ dir: join25(dir, e.name), rel: wireJoin(rel, e.name), depth: depth + 1 });
+        queue.push({ dir: join26(dir, e.name), rel: wireJoin(rel, e.name), depth: depth + 1 });
       } else {
         out.push(wireJoin(rel, e.name).normalize("NFC"));
         if (out.length >= MAX_FILES2) break;
@@ -109866,14 +110027,14 @@ async function searchFiles(root3, query, limit = 20, trust = {}) {
 }
 
 // packages/agent-host/src/dev-services/attachments.ts
-import { mkdir as mkdir4, writeFile as writeFile2, rm as rm4 } from "node:fs/promises";
-import { extname as extname3, join as join26 } from "node:path";
-var root = () => join26(dataRoot(), "attachments");
+import { mkdir as mkdir5, writeFile as writeFile3, rm as rm5 } from "node:fs/promises";
+import { extname as extname3, join as join27 } from "node:path";
+var root = () => join27(dataRoot(), "attachments");
 function sessionDir(sessionId) {
   if (!isSessionId(sessionId)) {
     throw Object.assign(new Error(`Not a session id: ${sessionId}`), { code: "internal" });
   }
-  return join26(root(), sessionId);
+  return join27(root(), sessionId);
 }
 var EXT = {
   "image/png": ".png",
@@ -109883,43 +110044,43 @@ var EXT = {
 };
 async function saveAttachment(sessionId, name, mime, dataBase64) {
   const dir = sessionDir(sessionId);
-  await mkdir4(dir, { recursive: true });
+  await mkdir5(dir, { recursive: true });
   const ext2 = extname3(name) || EXT[mime] || "";
-  const file2 = join26(dir, `${Date.now()}-${Math.random().toString(36).slice(2, 8)}${ext2}`);
+  const file2 = join27(dir, `${Date.now()}-${Math.random().toString(36).slice(2, 8)}${ext2}`);
   const buf = Buffer.from(dataBase64, "base64");
-  await writeFile2(file2, buf);
+  await writeFile3(file2, buf);
   return { kind: mime.startsWith("image/") ? "image" : "file", path: file2, name, mime, bytes: buf.length };
 }
 async function clearAttachments(sessionId) {
-  await rm4(sessionDir(sessionId), { recursive: true, force: true });
+  await rm5(sessionDir(sessionId), { recursive: true, force: true });
 }
 async function attachmentBytes(sessionId) {
-  const { readdir: readdir9, lstat: lstat6 } = await import("node:fs/promises");
+  const { readdir: readdir10, lstat: lstat7 } = await import("node:fs/promises");
   const dir = sessionDir(sessionId);
-  const names = await readdir9(dir).catch(() => []);
+  const names = await readdir10(dir).catch(() => []);
   let total = 0;
   for (const name of names) {
-    const s = await lstat6(join26(dir, name)).catch(() => null);
+    const s = await lstat7(join27(dir, name)).catch(() => null);
     if (s?.isFile()) total += s.size;
   }
   return total;
 }
 var ATTACHMENTS_MAX_BYTES = 500 * 1048576;
 async function sweepAttachments(maxBytes = ATTACHMENTS_MAX_BYTES) {
-  const { readdir: readdir9, stat: stat6, rm: rmFile } = await import("node:fs/promises");
+  const { readdir: readdir10, stat: stat7, rm: rmFile } = await import("node:fs/promises");
   const files = [];
   let dirs;
   try {
-    dirs = await readdir9(root());
+    dirs = await readdir10(root());
   } catch {
     return 0;
   }
   for (const d2 of dirs) {
-    const dir = join26(root(), d2);
-    const names = await readdir9(dir).catch(() => []);
+    const dir = join27(root(), d2);
+    const names = await readdir10(dir).catch(() => []);
     for (const name of names) {
-      const p = join26(dir, name);
-      const s = await stat6(p).catch(() => null);
+      const p = join27(dir, name);
+      const s = await stat7(p).catch(() => null);
       if (s?.isFile()) files.push({ path: p, size: s.size, mtime: s.mtimeMs });
     }
   }
@@ -109939,7 +110100,7 @@ async function sweepAttachments(maxBytes = ATTACHMENTS_MAX_BYTES) {
 
 // packages/agent-host/src/dev-services/message-image.ts
 import { constants as constants7 } from "node:fs";
-import { open as open4, realpath as realpath6 } from "node:fs/promises";
+import { open as open4, realpath as realpath7 } from "node:fs/promises";
 import { homedir as homedir11 } from "node:os";
 import { posix as posix3, sep as sep10, win32 as win326 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
@@ -109996,7 +110157,7 @@ var mb2 = (n) => `${(n / 1e6).toFixed(1)} MB`;
 async function readMessageImage(abs, max = IMAGE_PREVIEW_MAX_BYTES) {
   let file2;
   try {
-    file2 = await realpath6(abs);
+    file2 = await realpath7(abs);
   } catch (e) {
     const code2 = e.code;
     if (code2 === "EACCES" || code2 === "EPERM") return refuse5("unreadable", `Centralu may not read ${abs}`);
@@ -110035,36 +110196,36 @@ async function readMessageImage(abs, max = IMAGE_PREVIEW_MAX_BYTES) {
 }
 
 // packages/agent-host/src/dev-services/handoff-notes.ts
-import { lstat as lstat5, mkdir as mkdir5, readdir as readdir7, rm as rm5, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join27 } from "node:path";
-var root2 = () => join27(dataRoot(), "handoff");
+import { lstat as lstat6, mkdir as mkdir6, readdir as readdir8, rm as rm6, writeFile as writeFile4 } from "node:fs/promises";
+import { join as join28 } from "node:path";
+var root2 = () => join28(dataRoot(), "handoff");
 function handoffNoteDir(projectId) {
   if (!isProjectId(projectId)) {
     throw Object.assign(new Error(`Not a project id: ${projectId}`), { code: "internal" });
   }
-  return join27(root2(), projectId);
+  return join28(root2(), projectId);
 }
 function handoffNotePath(projectId, sessionId) {
   if (!isSessionId(sessionId)) {
     throw Object.assign(new Error(`Not a session id: ${sessionId}`), { code: "internal" });
   }
-  return join27(handoffNoteDir(projectId), `${sessionId}.md`);
+  return join28(handoffNoteDir(projectId), `${sessionId}.md`);
 }
 async function handoffNoteBytes(projectId, sessionId) {
-  const s = await lstat5(handoffNotePath(projectId, sessionId)).catch(() => null);
+  const s = await lstat6(handoffNotePath(projectId, sessionId)).catch(() => null);
   return s?.isFile() ? s.size : 0;
 }
 async function writeHandoffNote(projectId, sessionId, text2) {
   const path2 = handoffNotePath(projectId, sessionId);
-  await mkdir5(handoffNoteDir(projectId), { recursive: true });
-  await rm5(path2, { force: true });
-  await writeFile3(path2, text2, "utf8");
+  await mkdir6(handoffNoteDir(projectId), { recursive: true });
+  await rm6(path2, { force: true });
+  await writeFile4(path2, text2, "utf8");
   return path2;
 }
 async function sweepHandoffNotes(owned, projectId) {
   let dirs;
   try {
-    dirs = projectId ? [projectId] : (await readdir7(root2(), { withFileTypes: true })).filter((d2) => d2.isDirectory()).map((d2) => d2.name);
+    dirs = projectId ? [projectId] : (await readdir8(root2(), { withFileTypes: true })).filter((d2) => d2.isDirectory()).map((d2) => d2.name);
   } catch {
     return;
   }
@@ -110075,12 +110236,12 @@ async function sweepHandoffNotes(owned, projectId) {
     } catch {
       continue;
     }
-    const entries = await readdir7(dir, { withFileTypes: true }).catch(() => []);
+    const entries = await readdir8(dir, { withFileTypes: true }).catch(() => []);
     for (const e of entries) {
       if (!e.isFile() || !e.name.endsWith(".md")) continue;
       const owner = e.name.slice(0, -".md".length);
       if (owned(owner)) continue;
-      await rm5(join27(dir, e.name), { force: true }).catch(() => {
+      await rm6(join28(dir, e.name), { force: true }).catch(() => {
       });
     }
   }
@@ -110154,7 +110315,7 @@ var HUB_SENDER = "_hub-orchestrator";
 var builderKey = (ref) => `${ref.projectId ?? "_user"}/${ref.appId}`;
 var APP_BUILDERS_KEY = "apps.builders";
 var SessionManager = class {
-  constructor(store2, adapters2, emit, endpoint, worktreeRoot = join28(homedir12(), DATA_DIR, "worktrees"), keeperOpts = {}) {
+  constructor(store2, adapters2, emit, endpoint, worktreeRoot = join29(homedir12(), DATA_DIR, "worktrees"), keeperOpts = {}) {
     this.store = store2;
     this.adapters = adapters2;
     this.emit = emit;
@@ -110167,10 +110328,17 @@ var SessionManager = class {
       rawEmit(withoutToolRecord(full));
     };
     const LIVE_ONLY = ["working", "waiting_approval"];
-    for (const s of store2.listSessions()) {
+    const storedSessions = store2.listSessions();
+    const storedProjects = new Map(storedSessions.map((s) => [s.id, s.projectId]));
+    for (const s of storedSessions) {
       const stale = LIVE_ONLY.includes(s.state) && !keeperOpts.keptSessions?.has(s.id);
       const fixed = stale ? { ...s, state: "idle", waitingSince: null } : s;
+      const ownerProject = fixed.askedBy ? storedProjects.get(fixed.askedBy) ?? store2.trashedSession(fixed.askedBy)?.record.projectId : void 0;
+      const first = fixed.askedBy && ownerProject === void 0 ? store2.loadMessagesFrom(fixed.id, 0, 1)[0]?.payload : void 0;
+      const oldAsk = fixed.askedBy && (ownerProject !== void 0 ? ownerProject !== fixed.projectId : first?.from?.sessionId === fixed.askedBy && first.text?.includes("through Centralu's ask_project"));
+      if (oldAsk) delete fixed.askedBy;
       this.meta.set(s.id, fixed);
+      if (oldAsk) store2.upsertSession(fixed);
       if (stale) {
         console.error(`[agent-host] stale state reset: ${s.id.slice(0, 8)} ${s.state} -> idle`);
         store2.upsertSession(fixed);
@@ -110311,6 +110479,8 @@ var SessionManager = class {
    * comment on `runAppAgent`).
    */
   agentRuns = /* @__PURE__ */ new Map();
+  /** Temporary readers of a person's turn; they never own work or pin the calling session awake. */
+  turnObservers = /* @__PURE__ */ new Map();
   /**
    * A card the host raises in a session's approval slot — requestId -> question: an app's capability question (M4
    * D-4), or one project reaching another (#371). It uses the same slot as the adapter's card (the session's
@@ -110319,8 +110489,8 @@ var SessionManager = class {
    */
   hostAsks = /* @__PURE__ */ new Map();
   /**
-   * ask_project's delegations still owed to their caller (#371 part B) — `<caller session>><target project>` -> the
-   * delegation. One per pair at a time: a second task while the first runs is refused, and a call with no task waits
+   * ask_project's delegations still owed to their caller (#371 part B) — `<caller session>><target project>><target session>` -> the
+   * delegation. One per chosen session at a time: a second task while the first runs is refused, and a call with no task waits
    * on this one. Removed once the caller has read the outcome; an outcome nobody comes back for goes with the caller.
    */
   delegations = /* @__PURE__ */ new Map();
@@ -110382,11 +110552,11 @@ var SessionManager = class {
     );
   }
   async addProject(path2) {
-    if (!existsSync18(path2) || !statSync12(path2).isDirectory()) {
+    if (!existsSync19(path2) || !statSync12(path2).isDirectory()) {
       throw Object.assign(new Error(`Directory not found: ${path2}`), { code: "internal" });
     }
     const existing = this.store.findProjectByPath(path2);
-    const id2 = existing?.id ?? randomUUID9();
+    const id2 = existing?.id ?? randomUUID10();
     this.store.addProject({ id: id2, path: path2, name: basename5(path2) });
     return this.projectInfo(id2, path2);
   }
@@ -110398,8 +110568,8 @@ var SessionManager = class {
   projectsHome = () => {
     throw Object.assign(new Error("This host has no default location for a new project \u2014 give a parent folder"), { code: "internal" });
   };
-  useProjectsHome(resolve11) {
-    this.projectsHome = resolve11;
+  useProjectsHome(resolve12) {
+    this.projectsHome = resolve12;
   }
   /**
    * The folder a new project would get, and whether a clone source is one this host clones (#515) — checked, nothing
@@ -110900,6 +111070,9 @@ var SessionManager = class {
    * null — the only place that can create a session with no project is `orchestrator()` below.
    */
   async createSession(params) {
+    if (params.askedBy && this.meta.get(params.askedBy)?.projectId !== params.projectId) {
+      throw new Error("A session cannot create a session in another project");
+    }
     if (!params.tool) {
       throw Object.assign(new Error("No agent adapter is available. Install and configure an agent CLI before creating a session."), { code: "tool_not_installed" });
     }
@@ -110914,7 +111087,7 @@ var SessionManager = class {
         );
       }
     }
-    const id2 = randomUUID9();
+    const id2 = randomUUID10();
     let worktree = null;
     if (params.worktree && params.projectId) {
       const summary = await gitSummary(params.cwd, this.gitTrust(params.projectId));
@@ -110927,7 +111100,7 @@ var SessionManager = class {
         );
       }
       const path2 = this.worktreePathFor(params.projectId, id2);
-      if (!this.projectTrusted(params.projectId)) {
+      if (!this.projectTrusted(params.projectId) && !(params.askedBy && this.autoBoundaryOpen(params.askedBy, "worktree in an untrusted project"))) {
         throw Object.assign(
           new Error("Worktree sessions need a trusted project: checking out runs the repository's hooks and filters. Trust the project first."),
           { code: "internal" }
@@ -111318,6 +111491,7 @@ var SessionManager = class {
     );
   }
   async doResumeSession(sessionId, adopt) {
+    if (this.worktreeCleanup.has(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     const m = this.meta.get(sessionId);
     if (!m) throw Object.assign(new Error(`Session not found: ${sessionId}`), { code: "session_not_found" });
     if (this.handles.has(sessionId)) return { session: m, resumed: true };
@@ -111506,6 +111680,7 @@ var SessionManager = class {
    * exactly as it was, and only what happens from here on piles up in the copy.
    */
   async forkConversation(sessionId) {
+    if (this.worktreeCleanup.has(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     const m = this.meta.get(sessionId);
     if (!m) throw Object.assign(new Error(`Session not found: ${sessionId}`), { code: "session_not_found" });
     const source = m.externalId ?? m.importedFrom;
@@ -111556,7 +111731,8 @@ var SessionManager = class {
    * delete knows that layout (the Claude SDK's `deleteSession`). Left in place it is also a second way back — the
    * tool, and **+ → Past conversations**, still have it.
    */
-  async trashSession(sessionId, removeWorktree = false, removeExternal = false) {
+  async trashSession(sessionId, removeWorktree = false, removeExternal = false, recovery) {
+    if (this.worktreeCleanup.has(sessionId) && !recovery) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     const m = this.meta.get(sessionId);
     if (!m) {
       this.emit({ type: "session_deleted", sessionId });
@@ -111572,6 +111748,7 @@ var SessionManager = class {
       agentRun.deleted = true;
       agentRun.fail(new Error("the person deleted the agent session before it answered"));
     }
+    for (const observer of this.turnObservers.get(sessionId) ?? []) observer.fail(new Error("the person deleted the session before it answered"));
     for (const [key, d2] of this.delegations) {
       if (d2.callerId !== sessionId) continue;
       this.delegations.delete(key);
@@ -111605,7 +111782,8 @@ var SessionManager = class {
       projectName: project2?.name ?? null,
       projectPath: project2?.path ?? null,
       removeExternal: removeExternal && !!externalId,
-      removeWorktree: removeWorktree && !!m.worktree
+      removeWorktree: removeWorktree && !!m.worktree,
+      ...recovery ? { recovery } : {}
     });
     this.appsHub?.sessionGone(sessionId);
     this.emit({ type: "session_deleted", sessionId });
@@ -111613,7 +111791,7 @@ var SessionManager = class {
   /** Only one trash operation per session at a time — a purge racing a restore would restore half of a deleted session */
   trashBusy = /* @__PURE__ */ new Set();
   async trashOp(sessionId, run) {
-    if (this.trashBusy.has(sessionId)) {
+    if (this.trashBusy.has(sessionId) || this.worktreeCleanup.has(sessionId)) {
       throw Object.assign(new Error("That session is already being restored or deleted"), { code: "internal" });
     }
     this.trashBusy.add(sessionId);
@@ -111630,7 +111808,7 @@ var SessionManager = class {
       this.store.listTrash().map(async (r) => {
         const { record: record2 } = r;
         const live = record2.projectId ? projects.get(record2.projectId) : void 0;
-        const files = await attachmentBytes(r.id).catch(() => 0) + (record2.projectId ? await handoffNoteBytes(record2.projectId, r.id).catch(() => 0) : 0);
+        const files = await attachmentBytes(r.id).catch(() => 0) + await worktreeRecoveryBytes(r.id).catch(() => 0) + (record2.projectId ? await handoffNoteBytes(record2.projectId, r.id).catch(() => 0) : 0);
         return {
           id: r.id,
           name: r.name,
@@ -111646,7 +111824,7 @@ var SessionManager = class {
           bytes: r.bytes + files,
           conversationFile: !r.hasConversationFile ? "none" : record2.removeExternal ? "remove" : "keep",
           // Only a worktree still on disk is listed — the merged-worktree cleanup removes the folder before the trash is emptied
-          worktree: r.worktree && existsSync18(r.worktree.path) ? { ...r.worktree, remove: record2.removeWorktree } : null
+          worktree: r.worktree && existsSync19(r.worktree.path) ? { ...r.worktree, remove: record2.removeWorktree } : null
         };
       })
     );
@@ -111684,7 +111862,7 @@ var SessionManager = class {
         const home = projects.find((p) => p.id === record2.projectId) ?? (record2.projectPath ? projects.find((p) => p.path === record2.projectPath) : void 0);
         if (home) {
           projectId = home.id;
-        } else if (record2.projectPath && existsSync18(record2.projectPath) && statSync12(record2.projectPath).isDirectory()) {
+        } else if (record2.projectPath && existsSync19(record2.projectPath) && statSync12(record2.projectPath).isDirectory()) {
           this.store.addProject({
             id: record2.projectId,
             path: record2.projectPath,
@@ -111703,14 +111881,21 @@ var SessionManager = class {
       } else if (t.session.kind === "orchestrator" && this.store.orchestratorId()) {
         throw Object.assign(new Error("Another orchestrator is in place \u2014 the app runs one at a time"), { code: "internal" });
       }
+      let recovered;
+      if (record2.recovery && t.session.worktree && projectId) {
+        const repo = this.store.listProjects().find((p) => p.id === projectId).path;
+        recovered = await restoreWorktreeRecovery(sessionId, repo, t.session.worktree.path, t.session.worktree.branch, record2.recovery, this.gitTrust(projectId));
+      }
       const back = await this.store.restoreSession(sessionId, projectId);
       if (!back) throw Object.assign(new Error(`Not in the trash: ${sessionId}`), { code: "session_not_found" });
       const LIVE_ONLY = ["working", "waiting_approval"];
       const fixed = LIVE_ONLY.includes(back.state) ? { ...back, state: "idle", waitingSince: null } : back;
-      if (fixed !== back) this.store.upsertSession(fixed);
+      if (recovered && fixed.worktree) fixed.worktree = { ...fixed.worktree, branch: recovered.branch };
+      if (fixed !== back || recovered) this.store.upsertSession(fixed);
       this.meta.set(sessionId, fixed);
       const session2 = { ...this.meta.get(sessionId), live: false };
       this.emit({ type: "session_created", sessionId, session: session2 });
+      if (recovered) this.onEvent({ type: "notice", sessionId, level: "info", from: "Centralu", label: "worktree recovery", text: recovered.notice });
       return { session: session2, project: registered };
     });
   }
@@ -111749,6 +111934,7 @@ var SessionManager = class {
         await gitWorktreeRemove(record2.projectPath, s.worktree.path, true).catch(() => {
         });
       }
+      await clearWorktreeRecovery(sessionId);
       await this.store.purgeSession(sessionId);
       await clearAttachments(sessionId).catch(() => {
       });
@@ -111821,6 +112007,7 @@ var SessionManager = class {
     return live && m && live.model !== m.model ? "model_change" : void 0;
   }
   async updateSettings(sessionId, s) {
+    if (this.worktreeCleanup.has(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     const m = this.meta.get(sessionId);
     if (!m) throw Object.assign(new Error(`Session not found: ${sessionId}`), { code: "session_not_found" });
     if (s.model !== void 0 && s.model !== m.model) this.cacheLedger.note(sessionId, "model_change");
@@ -111937,6 +112124,7 @@ var SessionManager = class {
     }
     const run = e.sessionId ? this.agentRuns.get(e.sessionId) : void 0;
     run?.onEvent(e);
+    if (e.sessionId) for (const observer of this.turnObservers.get(e.sessionId) ?? []) observer.onEvent(e);
     this.emit(seq != null ? { ...e, seq } : e);
     if (endedTurn && e.sessionId && !run?.tracksInputs) void this.reportBackIfAwaited(e.sessionId, e, run?.completedAnswer);
     if (e.type === "approval_resolved" && e.sessionId) this.raiseHostAsks(e.sessionId);
@@ -112318,6 +112506,7 @@ If you need more, you can read that session's recent conversation with read_sess
   async deliver(sessionId, text2, attachments, from, relayed, fromApp, fromAppVia = "inline", sendInput) {
     const restarting = this.deferredRestarts.get(sessionId);
     if (restarting) await restarting;
+    if (this.worktreeCleanup.has(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     const m = this.meta.get(sessionId);
     if (!m) throw Object.assign(new Error(`Session not found: ${sessionId}`), { code: "session_not_found" });
     if (!this.handles.has(sessionId)) {
@@ -112328,6 +112517,7 @@ If you need more, you can read that session's recent conversation with read_sess
         });
       }
     }
+    if (this.worktreeCleanup.has(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     const h = this.requireHandle(sessionId);
     this.closeStream(sessionId);
     const seq = this.store.nextSeq(sessionId);
@@ -112382,6 +112572,7 @@ ${attachments.map((a) => `@${a.path}`).join("\n")}` : text2;
    * untouched, and only the tool underneath it is swapped.
    */
   async switchTool(sessionId, tool) {
+    if (this.worktreeCleanup.has(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     const m = this.meta.get(sessionId);
     if (!m) throw Object.assign(new Error(`Session not found: ${sessionId}`), { code: "session_not_found" });
     if (m.tool === tool) return { ...m, live: this.handles.has(sessionId) };
@@ -112663,7 +112854,7 @@ ${attachments.map((a) => `@${a.path}`).join("\n")}` : text2;
   worktreePathFor(projectId, sessionId) {
     if (!isProjectId(projectId)) throw Object.assign(new Error(`Not a project id: ${projectId}`), { code: "internal" });
     if (!isSessionId(sessionId)) throw Object.assign(new Error(`Not a session id: ${sessionId}`), { code: "internal" });
-    return join28(this.worktreeRoot, projectId, sessionId);
+    return join29(this.worktreeRoot, projectId, sessionId);
   }
   /**
    * Sets up a new worktree's workspace (#69): copy configured files, reuse JS dependencies, run setup.
@@ -112846,7 +113037,7 @@ ${String(stderr).slice(0, 2e3)}`
     const base2 = this.cwdFor(m);
     const paths = /* @__PURE__ */ new Set();
     for (const p of e.paths) {
-      const rel = relative8(root3, resolve10(base2, p));
+      const rel = relative8(root3, resolve11(base2, p));
       if (!rel || rel === ".." || rel.startsWith(`..${sep11}`) || isAbsolute9(rel)) continue;
       paths.add(rel.replaceAll(sep11, "/"));
     }
@@ -113046,6 +113237,7 @@ ${String(stderr).slice(0, 2e3)}`
    * reports background work.
    */
   sessionIdle(sessionId) {
+    if (this.worktreeCleanup.has(sessionId)) return { idle: false, reason: "turn" };
     const m = this.meta.get(sessionId);
     if (!m) throw Object.assign(new Error(`Session not found: ${sessionId}`), { code: "session_not_found" });
     if (this.agentRuns.get(sessionId)?.waitingForInputs) return { idle: false, reason: "turn" };
@@ -113056,7 +113248,7 @@ ${String(stderr).slice(0, 2e3)}`
   }
   /**
    * The sessions whose running work this one waits on (#568, the sleep rule in sleep.ts): a child it started with
-   * `start_agent`, or a session ask_project opened for it, while the turn it gave them runs, and a session that owes
+   * `start_agent`, or a session handling its ask_project task, while the turn it gave them runs, and a session that owes
    * it a report (`reportBack`, `awaitingReport`). Their answer is about to come back to it.
    */
   waitsOn(sessionId) {
@@ -113099,9 +113291,10 @@ ${String(stderr).slice(0, 2e3)}`
     const handle = this.requireHandle(sessionId);
     const run = this.agentRuns.get(sessionId);
     if (run) run.stoppedByPerson = true;
+    for (const observer of this.turnObservers.get(sessionId) ?? []) observer.stoppedByPerson = true;
     handle.interrupt();
     for (const d2 of this.delegations.values()) {
-      if (d2.callerId === sessionId && (!d2.agent || (d2.waiters ?? 0) > 0)) d2.stop("the person stopped the session that asked");
+      if (d2.callerId === sessionId && (d2.waiters ?? 0) > 0) d2.stop("the person stopped the session that asked");
     }
   }
   /**
@@ -113110,6 +113303,7 @@ ${String(stderr).slice(0, 2e3)}`
    * process.
    */
   async restartSession(sessionId, cause2) {
+    if (this.worktreeCleanup.has(sessionId)) throw Object.assign(new Error("The session worktree is being removed"), { code: "internal" });
     if (cause2) {
       this.restartReasons.set(sessionId, cause2);
       if (cause2 === "launch_settings") console.error(`[sessions] restarting ${sessionId}: launch settings changed or previously unrecorded`);
@@ -113717,10 +113911,11 @@ ${String(stderr).slice(0, 2e3)}`
         kind: "project_access",
         access: access2,
         from: { id: from.id, name: from.name },
-        // Said on the card (#382): a session opened there follows its trust, so the person should know before allowing
+        // Said on the card (#382): the selected session there follows its trust, so the person should know before allowing
         to: { id: to.id, name: to.name, trusted: to.trusted },
         text: what.text,
-        ...what.app ? { app: what.app } : {}
+        ...what.app ? { app: what.app } : {},
+        ...what.session ? { session: what.session } : {}
       },
       signal
     );
@@ -113735,20 +113930,26 @@ ${String(stderr).slice(0, 2e3)}`
     }
     return { ok: false, error: `The question to the person was withdrawn before they answered, so ${to.name} was not reached.` };
   }
-  /**
-   * Raises a card of the host's own in a session's approval slot and waits for the person's answer (#371, #515):
-   * null when `signal` fires first, the card then taken down so none is left unanswerable.
-   */
+  /** The caller's own preset, read at the boundary, never its project's or parent's preset. */
+  autoBoundaryOpen(sessionId, boundary) {
+    if (this.meta.get(sessionId)?.permissionPreset !== "auto") return false;
+    if (boundary) console.error(`[permissions] auto session ${sessionId}: ${boundary} allowed`);
+    return true;
+  }
+  /** Auto allows and logs; other presets raise a host card, withdrawn if the signal fires. */
   askHost(sessionId, detail, signal) {
-    return new Promise((resolve11) => {
-      if (signal?.aborted) return resolve11(null);
-      const requestId = `${detail.kind === "project_access" ? "xp" : detail.kind === "agent_start" ? "ag" : detail.kind === "centralu_update" ? "up" : "mk"}-${randomUUID9()}`;
-      this.hostAsks.set(requestId, { requestId, sessionId, detail, shown: false, resolve: resolve11 });
+    if (signal?.aborted) return Promise.resolve(null);
+    const note = detail.kind === "project_access" && !detail.to.trusted ? " (target not trusted)" : "";
+    if (this.autoBoundaryOpen(sessionId, `${detail.kind}${note}`)) return Promise.resolve("allow");
+    return new Promise((resolve12) => {
+      if (signal?.aborted) return resolve12(null);
+      const requestId = `${detail.kind === "project_access" ? "xp" : detail.kind === "agent_start" ? "ag" : detail.kind === "centralu_update" ? "up" : "mk"}-${randomUUID10()}`;
+      this.hostAsks.set(requestId, { requestId, sessionId, detail, shown: false, resolve: resolve12 });
       signal?.addEventListener("abort", () => {
         if (!this.hostAsks.delete(requestId)) return;
         const m = this.meta.get(sessionId);
         if (m?.pendingApproval?.requestId === requestId) this.onEvent({ type: "approval_resolved", sessionId, requestId, decision: "deny" });
-        resolve11(null);
+        resolve12(null);
       }, { once: true });
       this.raiseHostAsks(sessionId);
     });
@@ -113780,25 +113981,24 @@ ${String(stderr).slice(0, 2e3)}`
    *      and a session that was itself asked by another project cannot ask a third: depth one, so two projects
    *      that consented to each other cannot bounce a task between them without a person.
    *   2. The person's consent for the pair (`ensureProjectAccess`, kind 'delegate').
-   *   3. A session in the target: the idle one this caller asked there before, else a new one with that project's
-   *      folder, instructions and default tool, under the `normal` preset — what a session the person opens there
-   *      gets, so its own approvals stand as cards in that session, where the person sees them. Marked `askedBy`.
+   *   3. An existing ordinary session in the target, named by name or id; no creation or ownership change.
+   *      Without a name exactly one is selected, otherwise its sessions are listed for the caller to choose.
    *   4. The task goes in a frame (`askFrame`) marked as sent by the caller, and the call waits for the turn, up to
    *      `ASK_WAIT_MS`. Past it the answer is "still working" and a call with no task waits again.
    *   5. The final answer comes back cut to size, and the paths it names inside the target project become readable
    *      to the caller (`readableGrants`).
    *
    * Stop on the caller, the call's own signal, or the person deleting either session ends the wait; the first two
-   * stop the delegated turn as well.
+   * stop an assigned idle target only while waiting; a task that joined the person's turn only ends the wait.
    */
   async askProject(callerId, opts, signal) {
     const caller = this.meta.get(callerId);
     if (!caller?.projectId) return { ok: false, error: "This session belongs to no project, so it cannot ask another one" };
-    if (caller.askedBy) {
+    if ((caller.askedBy || [...this.delegations.values()].some((d8) => d8.sessionId === callerId && !d8.agent && !d8.settled)) && !this.autoBoundaryOpen(callerId, "delegation depth")) {
       return { ok: false, error: "This session was itself started or asked by another session, so it cannot ask a project \u2014 say in your answer what is needed instead." };
     }
     const projects = this.store.listProjects();
-    if (projects.find((p) => p.id === caller.projectId)?.trusted !== true) {
+    if (projects.find((p) => p.id === caller.projectId)?.trusted !== true && !this.autoBoundaryOpen(callerId, "delegate from an untrusted project")) {
       return { ok: false, error: "This session's project is not trusted, so it cannot ask another project \u2014 the person can trust it from the project menu." };
     }
     const wanted = opts.project.trim();
@@ -113811,62 +114011,88 @@ ${String(stderr).slice(0, 2e3)}`
       };
     }
     if (target.id === caller.projectId) return { ok: false, error: `${target.name} is this session's own project \u2014 do the work here.` };
-    const key = `${callerId}>${target.id}`;
+    const candidates = [...this.meta.values()].filter(
+      (s) => s.projectId === target.id && s.kind === "worker" && !s.appId && !this.builderRefOf(s)
+    );
+    const list = () => candidates.map((s) => JSON.stringify({
+      id: s.id,
+      name: s.name,
+      state: s.state,
+      lastActive: lastActiveOf(this.store, s.id) ?? null
+    })).join("\n");
+    const wantedSession = opts.session?.trim();
+    const outstanding = [...this.delegations.entries()].filter(
+      ([, d8]) => d8.callerId === callerId && d8.target.id === target.id && !d8.agent
+    );
+    if (!opts.task && !wantedSession && outstanding.length === 1) {
+      const [key2, pending2] = outstanding[0];
+      return this.awaitDelegation(key2, pending2, signal);
+    }
+    const named = wantedSession ? candidates.filter((s) => s.name.toLowerCase() === wantedSession.toLowerCase()) : candidates;
+    const chosen = candidates.find((s) => s.id === wantedSession) ?? (named.length === 1 ? named[0] : void 0);
+    if (!chosen) {
+      return { ok: false, error: candidates.length ? `${wantedSession ? `No unique ordinary session named "${wantedSession}" in ${target.name}. ` : ""}Name a session with the session argument. Sessions (name, state, last active):
+${list()}` : `${target.name} has no ordinary session. The person has to open one there; this call cannot create one.` };
+    }
+    const key = `${callerId}>${target.id}>${chosen.id}`;
     const pending = this.delegations.get(key);
     if (pending && !opts.task) return this.awaitDelegation(key, pending, signal);
     if (pending && !pending.settled) {
-      return {
-        ok: false,
-        error: `${target.name} is still working on your last task in the session "${this.meta.get(pending.sessionId)?.name ?? pending.sessionId}". Call ask_project with project "${target.name}" and no task to wait for it.`
-      };
-    }
-    if (pending) this.delegations.delete(key);
-    if (!opts.task) return { ok: false, error: `Give a task: what ${target.name} should do.` };
-    const consent = await this.ensureProjectAccess(callerId, target.id, "delegate", { text: taskLine(opts.task) }, signal);
+      return { ok: false, error: `${target.name} is still working on your last task in the session "${chosen.name}". Call ask_project with project "${target.name}", session "${chosen.id}" and no task to wait for it.` };
+    }
+    if (!opts.task) return { ok: false, error: `Give a task: what ${target.name} / ${chosen.name} should do.` };
+    const available = () => {
+      const current = this.meta.get(chosen.id);
+      if (!current || current.projectId !== target.id || current.kind !== "worker" || current.appId || this.builderRefOf(current)) return "The chosen session is no longer available";
+      if (this.agentRuns.has(chosen.id) && !this.agentRuns.get(chosen.id).finished) return `"${current.name}" is busy (${current.state}) with another delegated task. Wait for it.`;
+      if (inTurn(current.state) && (!this.adapters.get(current.tool)?.capabilities.midTurnInput || !this.handles.get(current.id)?.sendTracked)) return `"${current.name}" is busy (${current.state}); its CLI cannot take a mid-turn note. Try again later.`;
+    };
+    const busy = available();
+    if (busy) return { ok: false, error: busy };
+    const consent = await this.ensureProjectAccess(callerId, target.id, "delegate", {
+      text: taskLine(opts.task),
+      session: { id: chosen.id, name: chosen.name }
+    }, signal);
     if (!consent.ok) return consent;
-    const reuse = [...this.meta.values()].filter((s) => s.askedBy === callerId && s.projectId === target.id && s.kind === "worker" && (s.state === "idle" || s.state === "waiting_input") && !this.agentRuns.has(s.id)).sort((a, b2) => b2.createdAt - a.createdAt)[0];
-    let delegatedId;
-    if (reuse) {
-      delegatedId = reuse.id;
-    } else {
-      const tool = this.firstTool(target.defaultTool);
-      if (!tool) return { ok: false, error: `Could not open a session in ${target.name}: no agent adapter is available. Install and configure an agent CLI first.` };
-      const adapter = this.adapters.get(tool);
-      const found = await adapter.detect();
-      if (!found.installed || !found.loggedIn) {
-        return { ok: false, error: `${target.name}'s agent (${adapter.descriptor.label}) cannot take the task: ${found.detail}` };
-      }
-      try {
-        const remembered = this.store.projectToolDefaults(target.id)[tool];
-        const info = await this.createSession({
-          projectId: target.id,
-          cwd: target.path,
-          tool,
-          ...remembered?.model ? { model: remembered.model } : {},
-          ...remembered?.effort ? { effort: remembered.effort } : {},
-          permissionPreset: "normal",
-          askedBy: callerId
-        });
-        delegatedId = info.id;
-      } catch (e) {
-        return { ok: false, error: `Could not open a session in ${target.name}: ${e.message}` };
-      }
-      const callerProject2 = projects.find((p) => p.id === caller.projectId)?.name ?? "another project";
-      this.rename(delegatedId, `Asked by ${callerProject2} \xB7 ${(/* @__PURE__ */ new Date()).toTimeString().slice(0, 5)}`);
-    }
-    const d2 = this.startDelegation(key, callerId, delegatedId, target);
+    const changed = available();
+    if (changed) return { ok: false, error: changed };
+    if (signal?.aborted) return { ok: false, error: "The call was cancelled before delivery" };
+    if (pending) this.delegations.delete(key);
+    const delegatedId = chosen.id;
+    const midTurn = inTurn(this.meta.get(delegatedId).state);
+    let releaseInput;
+    const d2 = this.startDelegation(key, callerId, delegatedId, target, false, midTurn);
     const callerProject = projects.find((p) => p.id === caller.projectId)?.name ?? "another project";
     try {
-      await this.deliver(delegatedId, askFrame(callerProject, opts.task), void 0, { sessionId: callerId, name: labelOf(this.store, caller) }, false);
+      const from = { sessionId: callerId, name: labelOf(this.store, caller) };
+      if (midTurn) {
+        const releaseHold = d2.wait.holdInput();
+        const release = () => {
+          releaseHold();
+          this.applyDeferredRestart(delegatedId);
+        };
+        releaseInput = release;
+        await this.deliver(delegatedId, askFrame(callerProject, opts.task), void 0, from, false, void 0, "inline", (h, input) => {
+          const fail4 = (e) => {
+            d2.wait.fail(e);
+            release();
+          };
+          void h.sendTracked(input, { complete: release, fail: fail4 }).then(release, fail4);
+        });
+      } else {
+        await this.deliver(delegatedId, askFrame(callerProject, opts.task), void 0, from, false);
+      }
     } catch (e) {
-      this.delegations.delete(key);
+      d2.wait.fail(e);
+      releaseInput?.();
+      if (this.delegations.get(key) === d2) this.delegations.delete(key);
       if (this.agentRuns.get(delegatedId) === d2.wait) this.agentRuns.delete(delegatedId);
       return { ok: false, error: `Could not hand the task to ${target.name}: ${e.message}` };
     }
     return this.awaitDelegation(key, d2, signal);
   }
   /** Registers the wait on the delegated session's turn (the same watcher an app's agent uses, `AgentRunWait`) */
-  startDelegation(key, callerId, sessionId, target, agent = false) {
+  startDelegation(key, callerId, sessionId, target, agent = false, joinedTurn = false) {
     let notice;
     let answerAfter = this.meta.get(sessionId)?.lastSeq ?? 0;
     const wait = new AgentRunWait((message) => notice = message, () => this.meta.get(sessionId)?.name ?? "the session", void 0, () => {
@@ -113874,7 +114100,13 @@ ${String(stderr).slice(0, 2e3)}`
       answerAfter = this.meta.get(sessionId)?.lastSeq ?? answerAfter;
       return answer;
     });
+    let cancelWait;
+    const waitCancelled = new Promise((resolve12) => {
+      cancelWait = resolve12;
+    });
     const d2 = {
+      joinedTurn,
+      waitCancelled,
       callerId,
       sessionId,
       target,
@@ -113887,8 +114119,12 @@ ${String(stderr).slice(0, 2e3)}`
         (r) => ({ ok: true, answer: r.answer }),
         (e) => ({ ok: false, error: e.message })
       ),
-      stop: (why) => {
+      stop: (why, targetStop = false) => {
         if (d2.settled) return;
+        if (joinedTurn && !targetStop) {
+          cancelWait({ ok: false, error: `${why}; the caller stopped waiting and the target session was left running` });
+          return;
+        }
         wait.fail(new Error(`${why}, so the delegated turn was stopped`));
         try {
           this.handles.get(sessionId)?.interrupt();
@@ -113899,31 +114135,79 @@ ${String(stderr).slice(0, 2e3)}`
     };
     void d2.outcome.then((r) => {
       if (this.agentRuns.get(sessionId) === wait) this.agentRuns.delete(sessionId);
-      if (agent) void this.reportBackIfAwaited(sessionId, r.ok ? { type: "turn_complete", sessionId } : { type: "error", sessionId, error: { code: "internal", message: r.error, retryable: false } }, r.ok ? r.answer : void 0);
+      if (agent || wait.tracksInputs) void this.reportBackIfAwaited(sessionId, r.ok ? { type: "turn_complete", sessionId } : { type: "error", sessionId, error: { code: "internal", message: r.error, retryable: false } }, r.ok ? r.answer : void 0);
     });
     this.agentRuns.set(sessionId, wait);
     this.delegations.set(key, d2);
     return d2;
   }
+  /** Read an existing turn without claiming it in delegations, agentRuns or the caller's sleep graph. */
+  observeTurn(child, subscribe) {
+    const active = this.agentRuns.get(child.id);
+    const shared = active && !active.finished ? active : void 0;
+    const wait = shared ?? new AgentRunWait(
+      () => {
+      },
+      () => child.name,
+      void 0,
+      () => finalAnswer(this.store.loadMessages(child.id, 50))
+    );
+    const project2 = this.store.listProjects().find((p) => p.id === child.projectId);
+    const target = { id: child.projectId ?? "", name: project2?.name ?? "", path: this.store.sessionCwd(child.id) ?? project2?.path ?? "" };
+    if (!shared && subscribe) {
+      const readers = this.turnObservers.get(child.id) ?? /* @__PURE__ */ new Set();
+      readers.add(wait);
+      this.turnObservers.set(child.id, readers);
+    }
+    return {
+      run: {
+        // This is the target's own turn, never work owned by its observer.
+        callerId: child.id,
+        sessionId: child.id,
+        target,
+        wait,
+        get settled() {
+          return wait.finished;
+        },
+        notice: () => void 0,
+        outcome: wait.done.then(
+          (r) => ({ ok: true, answer: r.answer }),
+          (e) => ({ ok: false, error: e.message })
+        ),
+        stop: (why) => {
+          if (wait.finished) return;
+          wait.fail(new Error(`${why}, so the turn was stopped`));
+          this.handles.get(child.id)?.interrupt();
+        }
+      },
+      release: () => {
+        if (shared) return;
+        const readers = this.turnObservers.get(child.id);
+        readers?.delete(wait);
+        if (readers?.size === 0) this.turnObservers.delete(child.id);
+      }
+    };
+  }
   /** Waits for a delegation up to the bound, and turns its outcome into what the caller reads */
   async awaitDelegation(key, d2, signal) {
     const sessionName = () => this.meta.get(d2.sessionId)?.name ?? d2.sessionId;
     let timer;
     let onAbort;
-    const bound = new Promise((resolve11) => timer = setTimeout(() => resolve11("bound"), ASK_WAIT_MS));
-    const aborted2 = new Promise((resolve11) => {
+    const bound = new Promise((resolve12) => timer = setTimeout(() => resolve12("bound"), ASK_WAIT_MS));
+    const aborted2 = new Promise((resolve12) => {
       if (!signal) return;
-      onAbort = () => resolve11("aborted");
+      onAbort = () => resolve12("aborted");
       if (signal.aborted) onAbort();
       else signal.addEventListener("abort", onAbort, { once: true });
     });
+    d2.waiters = (d2.waiters ?? 0) + 1;
     try {
-      const r = await Promise.race([d2.outcome, bound, aborted2]);
+      const r = await Promise.race([d2.outcome, ...d2.waitCancelled ? [d2.waitCancelled] : [], bound, aborted2]);
       if (r === "aborted") {
         d2.stop("the call that asked was cancelled");
-        await d2.outcome;
-        this.delegations.delete(key);
-        return { ok: false, error: `The call was cancelled, so ${d2.target.name}'s session "${sessionName()}" was stopped.` };
+        if (!d2.joinedTurn) await d2.outcome;
+        if (this.delegations.get(key) === d2) this.delegations.delete(key);
+        return { ok: false, error: d2.joinedTurn ? `The call was cancelled; ${d2.target.name}'s session "${sessionName()}" was left running.` : `The call was cancelled, so ${d2.target.name}'s session "${sessionName()}" was stopped.` };
       }
       if (r === "bound") {
         const notice = d2.notice();
@@ -113933,7 +114217,7 @@ ${String(stderr).slice(0, 2e3)}`
       if (!r.ok) {
         return {
           ok: false,
-          error: `${d2.target.name}'s session "${sessionName()}" [${d2.sessionId}] did not finish: ${r.error}. Tell the person, or ask again with a clearer task.`
+          error: d2.joinedTurn ? `The wait for ${d2.target.name}'s session "${sessionName()}" [${d2.sessionId}] ended: ${r.error}.` : `${d2.target.name}'s session "${sessionName()}" [${d2.sessionId}] did not finish: ${r.error}. Tell the person, or ask again with a clearer task.`
         };
       }
       const answer = r.answer ?? finalAnswer(this.store.loadMessages(d2.sessionId, 50));
@@ -113954,6 +114238,7 @@ ${String(stderr).slice(0, 2e3)}`
         outside
       };
     } finally {
+      d2.waiters = (d2.waiters ?? 1) - 1;
       clearTimeout(timer);
       if (onAbort) signal?.removeEventListener("abort", onAbort);
     }
@@ -113975,19 +114260,19 @@ ${String(stderr).slice(0, 2e3)}`
   async startAgent(callerId, opts, signal) {
     const caller = this.meta.get(callerId);
     if (!caller?.projectId) return { ok: false, error: "This session belongs to no project, so it cannot start agents." };
-    if (caller.askedBy) {
+    if ((caller.askedBy || [...this.delegations.values()].some((d8) => d8.sessionId === callerId && !d8.agent && !d8.settled)) && !this.autoBoundaryOpen(callerId, "delegation depth")) {
       return { ok: false, error: "This session was itself started or asked by another session, so it cannot start agents \u2014 say in your answer what is needed instead." };
     }
     const project2 = this.store.listProjects().find((p) => p.id === caller.projectId);
     if (!project2) return { ok: false, error: "This session's project is no longer registered." };
-    if (project2.trusted !== true) {
+    if (project2.trusted !== true && !this.autoBoundaryOpen(callerId, "start in an untrusted project")) {
       return { ok: false, error: "This session's project is not trusted, so it cannot start agents \u2014 the person can trust it from the project menu." };
     }
     const tool = opts.tool ?? this.firstTool(project2.defaultTool);
     if (!tool) return { ok: false, error: "No agent adapter is available. Install and configure an agent CLI before starting an agent." };
     const adapter = this.adapters.get(tool);
     if (!adapter) return { ok: false, error: `No agent named "${tool}" here. Installed tools: ${[...this.adapters.keys()].join(", ") || "none"}.` };
-    const full = this.agentCeilingError(project2.id);
+    const full = this.agentCeilingError(callerId, project2.id);
     if (full) return { ok: false, error: full };
     const remembered = this.store.projectToolDefaults(project2.id)[tool];
     const model = opts.model ?? remembered?.model ?? void 0;
@@ -114012,7 +114297,7 @@ ${String(stderr).slice(0, 2e3)}`
       signal
     );
     if (!consent.ok) return consent;
-    const fullNow = this.agentCeilingError(project2.id);
+    const fullNow = this.agentCeilingError(callerId, project2.id);
     if (fullNow) return { ok: false, error: fullNow };
     const cwd = worktree ? project2.path : this.store.sessionCwd(callerId) ?? caller.worktree?.path ?? project2.path;
     let child;
@@ -114050,95 +114335,115 @@ ${String(stderr).slice(0, 2e3)}`
     return result.ok && notice ? { ...result, notice: [result.notice, notice].filter(Boolean).join("; ") } : result;
   }
   /**
-   * agent_session (#561): the caller works with a session it started — and only those: one whose `askedBy` is the
-   * caller, in the caller's project.
+   * agent_session (#561): safe/normal work only with their own children; auto opens ownership within the project.
    *
    *   status  where it stands, without waiting (the answer, once the turn the caller gave it has ended)
    *   wait    waits on that turn up to the bound, as start_agent does
    *   send    gives it more, including during the caller's turn on adapters that accept mid-turn input; refused
    *           while it works on the person's own message or has a higher preset than the caller
    *   stop    stops the turn the caller gave it; a turn the person started there is theirs
-   *   delete  cleans up a child's merged, clean worktree (`cleanUpWorktreeChild`, #76's hard gate, part 3)
+   *   delete  sets aside local work in the trash, then removes an idle child's worktree and branch (#608)
    */
   async agentSession(callerId, opts, signal) {
+    if (opts.sessionId === callerId && opts.action !== "status") {
+      return { ok: false, error: "agent_session cannot wait on, stop, delete or send to its own calling session." };
+    }
     const caller = this.meta.get(callerId);
     const child = this.meta.get(opts.sessionId);
-    if (!caller?.projectId || !child || child.askedBy !== callerId || child.projectId !== caller.projectId) {
+    if (!caller?.projectId || !child || child.askedBy !== callerId && !this.autoBoundaryOpen(callerId, "session ownership") || child.projectId !== caller.projectId) {
       return { ok: false, error: `${opts.sessionId} is not a session this session started. agent_session works only on sessions start_agent started here.` };
     }
+    if (opts.sessionId === callerId) return this.agentAtRest(child);
     const key = `${callerId}>${child.id}`;
-    const d2 = this.delegations.get(key);
-    switch (opts.action) {
-      case "status":
-        if (d2 && !d2.settled) return this.agentWorking(d2, false);
-        return d2 ? this.awaitAgent(key, d2, signal) : this.agentAtRest(child);
-      case "wait":
-        return d2 ? this.awaitAgent(key, d2, signal) : this.agentAtRest(child);
-      case "stop": {
-        if (!d2 || d2.settled) return { ok: false, error: `Nothing you gave "${child.name}" is running.` };
-        if (this.awaitingReport.get(child.id) === callerId) this.awaitingReport.delete(child.id);
-        d2.stop("the session that started it stopped it");
-        await d2.outcome;
-        this.delegations.delete(key);
-        return { ok: true, state: "stopped", sessionId: child.id, sessionName: child.name, tool: child.tool };
-      }
-      case "delete": {
-        if (d2 && !d2.settled) return { ok: false, error: `"${child.name}" is still working on what you gave it \u2014 stop it or wait first.` };
-        const r = await this.cleanUpWorktreeChild(child);
-        if (!r.ok) return r;
-        if (d2) this.delegations.delete(key);
-        return { ok: true, state: "deleted", sessionId: child.id, sessionName: child.name, tool: child.tool, branch: r.branch, proof: r.proof };
-      }
-      case "send": {
-        if (!presetWithin(child.permissionPreset, caller.permissionPreset)) {
-          return {
-            ok: false,
-            error: `"${child.name}" now has more permissions (${child.permissionPreset}) than this session (${caller.permissionPreset}), so this session cannot give it work. Tell the person.`
-          };
+    let d2 = this.delegations.get(key);
+    let releaseObservation;
+    if (!d2 && this.autoBoundaryOpen(callerId)) {
+      const existing = [...this.delegations.values()].find((run) => run.sessionId === child.id && !run.settled);
+      if (existing) d2 = existing;
+      else if (opts.action !== "delete" && (child.state === "working" || child.state === "waiting_approval")) {
+        const observation = this.observeTurn(child, opts.action !== "status");
+        d2 = observation.run;
+        releaseObservation = observation.release;
+      }
+    }
+    const observing = !!d2 && d2.callerId !== callerId;
+    try {
+      switch (opts.action) {
+        case "status":
+          if (d2 && !d2.settled) return this.agentWorking(d2, false, observing);
+          return d2 ? await this.awaitAgent(key, d2, signal, observing) : this.agentAtRest(child);
+        case "wait":
+          return d2 ? await this.awaitAgent(key, d2, signal, observing) : this.agentAtRest(child);
+        case "stop": {
+          if (!d2 || d2.settled) return { ok: false, error: `Nothing you gave "${child.name}" is running.` };
+          if (!observing && this.awaitingReport.get(child.id) === callerId) this.awaitingReport.delete(child.id);
+          d2.stop("the session that started it stopped it", observing);
+          await d2.outcome;
+          if (!observing) this.delegations.delete(key);
+          return { ok: true, state: "stopped", sessionId: child.id, sessionName: child.name, tool: child.tool };
+        }
+        case "delete": {
+          if (d2 && !d2.settled) return { ok: false, error: `"${child.name}" is still working on what you gave it \u2014 stop it or wait first.` };
+          const r = await this.cleanUpWorktreeChild(child);
+          if (!r.ok) return r;
+          if (d2) this.delegations.delete(key);
+          return { ok: true, state: "deleted", sessionId: child.id, sessionName: child.name, tool: child.tool, branch: r.branch, setAside: r.setAside, ...r.warning ? { warning: r.warning } : {} };
         }
-        const from = { sessionId: callerId, name: labelOf(this.store, caller) };
-        if (d2 && !d2.settled) {
-          const text2 = agentNoteFrame(from.name, opts.text ?? "");
-          if (!this.adapters.get(child.tool)?.capabilities.midTurnInput || !this.handles.get(child.id)?.sendTracked) {
-            return { ok: false, error: `"${child.name}" cannot take messages while working. Wait for it (action "wait") or stop it first.` };
+        case "send": {
+          if (!presetWithin(child.permissionPreset, caller.permissionPreset)) {
+            return {
+              ok: false,
+              error: `"${child.name}" now has more permissions (${child.permissionPreset}) than this session (${caller.permissionPreset}), so this session cannot give it work. Tell the person.`
+            };
           }
-          const releaseHold = d2.wait.holdInput();
-          const release = () => {
-            releaseHold();
-            this.applyDeferredRestart(child.id);
-          };
+          const from = { sessionId: callerId, name: labelOf(this.store, caller) };
+          if (d2 && !d2.settled) {
+            const text2 = agentNoteFrame(from.name, opts.text ?? "");
+            if (!this.adapters.get(child.tool)?.capabilities.midTurnInput || !this.handles.get(child.id)?.sendTracked) {
+              return { ok: false, error: `"${child.name}" cannot take messages while working. Wait for it (action "wait") or stop it first.` };
+            }
+            const releaseHold = d2.wait.holdInput();
+            const release = () => {
+              releaseHold();
+              this.applyDeferredRestart(child.id);
+            };
+            try {
+              await this.deliver(child.id, text2, void 0, from, false, void 0, "inline", (h, input) => {
+                const fail4 = (e) => {
+                  d2.wait.fail(e);
+                  release();
+                };
+                void h.sendTracked(input, { complete: release, fail: fail4 }).then(release, fail4);
+              });
+            } catch (e) {
+              release();
+              return { ok: false, error: `Could not send it: ${e.message}` };
+            }
+            return this.agentWorking(d2, false, observing);
+          }
+          if (child.state === "working" || child.state === "waiting_approval" || this.agentRuns.has(child.id) && !this.agentRuns.get(child.id).finished) {
+            return { ok: false, error: `"${child.name}" is busy with something else (the person may be using it). Try again later.` };
+          }
+          if (d2) this.delegations.delete(key);
+          const full = this.agentCeilingError(callerId, child.projectId ?? "");
+          if (full) return { ok: false, error: full };
+          const project2 = this.store.listProjects().find((p) => p.id === child.projectId);
+          const cwd = this.store.sessionCwd(child.id) ?? child.worktree?.path ?? project2?.path ?? "";
+          const next = this.startDelegation(key, callerId, child.id, { id: child.projectId ?? "", name: project2?.name ?? "", path: cwd }, true);
           try {
-            await this.deliver(child.id, text2, void 0, from, false, void 0, "inline", (h, input) => {
-              const fail4 = (e) => {
-                d2.wait.fail(e);
-                release();
-              };
-              void h.sendTracked(input, { complete: release, fail: fail4 }).then(release, fail4);
-            });
+            await this.deliver(child.id, agentFrame(from.name, opts.text ?? ""), void 0, from, false);
           } catch (e) {
-            release();
+            this.delegations.delete(key);
+            if (this.agentRuns.get(child.id) === next.wait) this.agentRuns.delete(child.id);
             return { ok: false, error: `Could not send it: ${e.message}` };
           }
-          return this.agentWorking(d2, false);
-        }
-        if (child.state === "working" || child.state === "waiting_approval" || this.agentRuns.has(child.id) && !this.agentRuns.get(child.id).finished) {
-          return { ok: false, error: `"${child.name}" is busy with something else (the person may be using it). Try again later.` };
-        }
-        if (d2) this.delegations.delete(key);
-        const full = this.agentCeilingError(child.projectId ?? "");
-        if (full) return { ok: false, error: full };
-        const project2 = this.store.listProjects().find((p) => p.id === child.projectId);
-        const cwd = this.store.sessionCwd(child.id) ?? child.worktree?.path ?? project2?.path ?? "";
-        const next = this.startDelegation(key, callerId, child.id, { id: child.projectId ?? "", name: project2?.name ?? "", path: cwd }, true);
-        try {
-          await this.deliver(child.id, agentFrame(from.name, opts.text ?? ""), void 0, from, false);
-        } catch (e) {
-          this.delegations.delete(key);
-          if (this.agentRuns.get(child.id) === next.wait) this.agentRuns.delete(child.id);
-          return { ok: false, error: `Could not send it: ${e.message}` };
+          return this.awaitAgent(key, next, signal);
         }
-        return this.awaitAgent(key, next, signal);
+        default:
+          return { ok: false, error: "Unknown agent_session action." };
       }
+    } finally {
+      releaseObservation?.();
     }
   }
   /**
@@ -114151,65 +114456,67 @@ ${String(stderr).slice(0, 2e3)}`
     if (!summary.isRepo) return { error: "This project is not a git repository, so it has no worktrees. Start the agent without one." };
     const asked = opts.branch?.trim();
     if (asked) return await gitValidBranchName(asked) ? { branch: asked } : { error: `Not a valid branch name: ${asked}` };
-    return { branch: agentBranch(opts.task, randomUUID9()) };
+    return { branch: agentBranch(opts.task, randomUUID10()) };
   }
-  /**
-   * Cleans up a child's merged worktree (#76's hard gate, moved from the retired worktree manager's tool to
-   * agent_session delete, #561 part 3). It runs **only when losslessness is proven at this moment**: no uncommitted
-   * changes, and the branch's current tip has landed on the trunk (by ancestry, or by a merged pull request whose head
-   * is that tip). Not the cached merged badge: a commit could have landed since (TOCTOU). Every deletion outside that
-   * proof stays the person's, in the delete dialog. The session goes to the trash like any other (an agent never
-   * deletes one for good), the worktree and branch are removed, the tool's own conversation is kept, and the tip is
-   * logged for reflog recovery.
-   */
+  /** Prevent a send/resume from racing the snapshot and worktree removal. */
+  worktreeCleanup = /* @__PURE__ */ new Set();
+  /** #608: the parent decides; local work follows the session into the trash in every preset. */
   async cleanUpWorktreeChild(target) {
     if (!target.worktree?.base || !target.projectId) {
       return { ok: false, error: `"${target.name}" works in no worktree of its own, so there is nothing to clean up \u2014 the person deletes a session` };
     }
-    if (target.state === "working" || target.state === "waiting_approval" || this.agentRuns.has(target.id)) {
-      return { ok: false, error: `"${target.name}" is still working \u2014 clean it up once its turn ends` };
-    }
-    const cwd = this.cwdOf(target.projectId);
-    const { branch, path: path2, base: base2 } = target.worktree;
-    const wt2 = await gitWorktreeDirty(path2, this.gitTrust(target.projectId)).catch(() => ({ dirty: true, changedFiles: -1 }));
-    if (wt2.dirty) {
-      const n = wt2.changedFiles >= 0 ? `${wt2.changedFiles} ` : "";
-      return { ok: false, error: `There are ${n}uncommitted changes in "${target.name}" \u2014 have it commit (or discard) them, then delete again` };
+    if (target.state === "working" || target.state === "waiting_approval" || this.agentRuns.has(target.id) || sessionBusy({ ...target, live: this.handles.has(target.id) })) {
+      return { ok: false, error: `"${target.name}" is still working \u2014 stop it or wait first` };
     }
-    const trunk = this.trunkOf(target.projectId) ?? "HEAD";
-    let proof = null;
-    if (await gitBranchMerged(cwd, branch, base2, trunk).catch(() => false)) {
-      proof = "trunk ancestry";
-    } else if (this.ghAvailable) {
-      const pr = await this.prLookup(cwd, branch).catch(() => null);
-      if (pr === "unavailable") this.ghAvailable = false;
-      else if (pr && pr.state === "merged") {
-        const tip2 = await gitRevParse(cwd, `refs/heads/${branch}`);
-        if (pr.headOid && tip2 && tip2 === pr.headOid) proof = `PR #${pr.number}`;
-        else if (pr.headOid && tip2) {
-          return { ok: false, error: `PR #${pr.number} was merged, but "${branch}" has a new commit since \u2014 it is deleted only once that commit has landed on the trunk too` };
-        }
+    if (this.resuming.has(target.id) || this.deferredRestarts.has(target.id)) return { ok: false, error: `"${target.name}" is waking or restarting \u2014 wait for it first` };
+    if (this.worktreeCleanup.has(target.id)) return { ok: false, error: "This worktree is already being removed" };
+    this.worktreeCleanup.add(target.id);
+    const { branch, path: path2 } = target.worktree;
+    try {
+      const cwd = this.cwdOf(target.projectId);
+      const handle = this.handles.get(target.id);
+      if (handle) {
+        await handle.dispose();
+        this.handles.delete(target.id);
+        this.running.delete(target.id);
+      }
+      const trunk = await gitRevParse(cwd, this.trunkOf(target.projectId) ?? "HEAD");
+      const setAside = await saveWorktreeRecovery(target.id, path2, trunk ?? "missing-trunk", branch);
+      if (setAside.changedFiles || setAside.commits) {
+        this.onEvent({
+          type: "notice",
+          sessionId: target.id,
+          level: "info",
+          from: "Centralu",
+          label: "worktree recovery",
+          text: `Local work saved before worktree deletion: ${setAside.changedFiles} uncommitted files, ${setAside.commits} commits not on the trunk. Recovery patches and bundles are at ${worktreeRecoveryDir(target.id)}. Restore from Settings \u2192 Trash or recover these files manually before deleting this session for good.`
+        });
       }
+      await this.trashSession(target.id, false, false, setAside);
+      try {
+        await gitWorktreeRemove(cwd, path2, true, true);
+      } catch (e) {
+        return { ok: true, branch, setAside, warning: `The session is in the trash, but worktree ${path2} and branch ${branch} were left: ${e.message}. Recovery files are at ${worktreeRecoveryDir(target.id)}.` };
+      }
+      try {
+        await gitBranchDelete(cwd, branch, this.gitTrust(target.projectId));
+      } catch (e) {
+        return { ok: true, branch, setAside, warning: `The session is in the trash and its worktree was removed, but branch ${branch} was left: ${e.message}. Recovery files are at ${worktreeRecoveryDir(target.id)}.` };
+      }
+      return { ok: true, branch, setAside };
+    } catch (e) {
+      return { ok: false, error: `Could not finish removing "${branch}": ${e.message}. Any saved recovery files are at ${worktreeRecoveryDir(target.id)}.` };
+    } finally {
+      this.worktreeCleanup.delete(target.id);
     }
-    if (!proof) {
-      return {
-        ok: false,
-        error: `Could not prove that "${branch}" has landed on the trunk \u2014 it is deleted only once a merge (or a merged PR) is confirmed. Discarding it without proof is the person's job, in the delete dialog`
-      };
-    }
-    const tip = await gitRevParse(cwd, `refs/heads/${branch}`);
-    await this.trashSession(target.id);
-    await gitWorktreeRemove(cwd, path2, true).catch(() => {
-    });
-    await gitBranchDelete(cwd, branch, this.gitTrust(target.projectId)).catch(() => {
-    });
-    console.error(`[worktree] cleaned up ${branch} (tip ${tip?.slice(0, 8) ?? "?"}, proof: ${proof})`);
-    return { ok: true, branch, proof };
   }
-  /** Refuses a start when the project's children already running reach `AGENT_CEILING` (#561) */
-  agentCeilingError(projectId) {
+  /** A saved ceiling overrides the caller's preset default: auto unlimited, otherwise AGENT_CEILING. */
+  agentCeilingError(callerId, projectId) {
+    const configured = this.uiPreferences().agentCeiling;
+    const ceiling = configured ?? (this.autoBoundaryOpen(callerId) ? 0 : AGENT_CEILING);
+    if (ceiling === 0) return null;
     const running = [...this.delegations.values()].filter((d2) => d2.agent && !d2.settled && this.meta.get(d2.sessionId)?.projectId === projectId).length;
-    if (running < AGENT_CEILING) return null;
+    if (running < ceiling) return null;
     return `${running} agents started by this project's sessions are already working, the most at once. Wait for one (agent_session, action "wait") or stop one, then try again.`;
   }
   /**
@@ -114269,8 +114576,8 @@ ${String(stderr).slice(0, 2e3)}`
    * "Working": the caller is told when the turn ends (#561), through the report the orchestrator's reportBack uses, unless
    * a call is waiting on it by then (`awaitAgent` takes the marker down while it waits)
    */
-  agentWorking(d2, arm = true) {
-    if (arm) this.awaitingReport.set(d2.sessionId, d2.callerId);
+  agentWorking(d2, arm = true, observing = false) {
+    if (arm && !observing) this.awaitingReport.set(d2.sessionId, d2.callerId);
     const notice = d2.notice();
     return {
       ok: true,
@@ -114278,7 +114585,7 @@ ${String(stderr).slice(0, 2e3)}`
       sessionId: d2.sessionId,
       sessionName: this.meta.get(d2.sessionId)?.name ?? d2.sessionId,
       tool: this.meta.get(d2.sessionId)?.tool ?? "",
-      reported: this.awaitingReport.get(d2.sessionId) === d2.callerId,
+      reported: !observing && this.awaitingReport.get(d2.sessionId) === d2.callerId,
       ...notice ? { notice } : {}
     };
   }
@@ -114295,32 +114602,43 @@ ${String(stderr).slice(0, 2e3)}`
     };
   }
   /** Waits on a child's turn up to the bound (#561), like `awaitDelegation`, and reads its outcome for the caller */
-  async awaitAgent(key, d2, signal) {
-    if (this.awaitingReport.get(d2.sessionId) === d2.callerId) this.awaitingReport.delete(d2.sessionId);
+  async awaitAgent(key, d2, signal, observing = false) {
+    if (!observing && this.awaitingReport.get(d2.sessionId) === d2.callerId) this.awaitingReport.delete(d2.sessionId);
     const name = () => this.meta.get(d2.sessionId)?.name ?? d2.sessionId;
     let timer;
     let onAbort;
-    const bound = new Promise((resolve11) => timer = setTimeout(() => resolve11("bound"), ASK_WAIT_MS));
-    const aborted2 = new Promise((resolve11) => {
+    const bound = new Promise((resolve12) => timer = setTimeout(() => resolve12("bound"), ASK_WAIT_MS));
+    const aborted2 = new Promise((resolve12) => {
       if (!signal) return;
-      onAbort = () => resolve11("aborted");
+      onAbort = () => resolve12("aborted");
       if (signal.aborted) onAbort();
       else signal.addEventListener("abort", onAbort, { once: true });
     });
-    d2.waiters = (d2.waiters ?? 0) + 1;
+    if (!observing) d2.waiters = (d2.waiters ?? 0) + 1;
     try {
       const r = await Promise.race([d2.outcome, bound, aborted2]);
-      d2.waiters--;
+      if (!observing) d2.waiters = (d2.waiters ?? 1) - 1;
       if (r === "aborted") {
+        if (observing) return { ok: false, error: `The observation was cancelled; "${name()}" was left running.` };
         d2.stop("the call that started it was cancelled");
         await d2.outcome;
         this.delegations.delete(key);
         return { ok: false, error: `The call was cancelled, so "${name()}" was stopped.` };
       }
-      if (r === "bound") return this.agentWorking(d2);
-      if (this.delegations.get(key) === d2) this.delegations.delete(key);
+      if (r === "bound") return this.agentWorking(d2, !observing, observing);
+      if (!observing && this.delegations.get(key) === d2) this.delegations.delete(key);
       if (!r.ok) return { ok: false, error: `"${name()}" [${d2.sessionId}] did not finish: ${r.error}. Tell the person, or give it a clearer task.` };
       const answer = r.answer ?? finalAnswer(this.store.loadMessages(d2.sessionId, 50));
+      if (observing) return {
+        ok: true,
+        state: "done",
+        sessionId: d2.sessionId,
+        sessionName: name(),
+        tool: this.meta.get(d2.sessionId)?.tool ?? "",
+        answer: clipAnswer(answer, name()),
+        readable: [],
+        outside: []
+      };
       const { granted, outside } = readableGrants(pathsIn(answer), d2.target.path);
       if (granted.length) {
         const set3 = this.readGrants.get(d2.callerId) ?? /* @__PURE__ */ new Set();
@@ -114343,39 +114661,39 @@ ${String(stderr).slice(0, 2e3)}`
     }
   }
   askCapability(q2, signal) {
-    return new Promise((resolve11) => {
-      if (signal.aborted) return resolve11(null);
+    return new Promise((resolve12) => {
+      if (signal.aborted) return resolve12(null);
       const app2 = { appId: q2.app.appId, projectId: q2.app.projectId, name: q2.appName };
       if (q2.origin.kind === "session" && this.meta.has(q2.origin.sessionId)) {
-        const requestId = `cap-${randomUUID9()}`;
+        const requestId = `cap-${randomUUID10()}`;
         const ask = {
           requestId,
           sessionId: q2.origin.sessionId,
           detail: { kind: "capability", app: app2, capability: q2.capability, text: q2.text },
           shown: false,
-          resolve: (d2) => resolve11(d2 === "always" || d2 === "always_project" ? "allow" : d2)
+          resolve: (d2) => resolve12(d2 === "always" || d2 === "always_project" ? "allow" : d2)
         };
         this.hostAsks.set(requestId, ask);
         signal.addEventListener("abort", () => {
           if (!this.hostAsks.delete(requestId)) return;
           const m = this.meta.get(ask.sessionId);
           if (m?.pendingApproval?.requestId === requestId) this.onEvent({ type: "approval_resolved", sessionId: ask.sessionId, requestId, decision: "deny" });
-          resolve11(null);
+          resolve12(null);
         }, { once: true });
         this.raiseHostAsks(ask.sessionId);
         return;
       }
       const origin = q2.origin.kind === "view" ? q2.origin.app : q2.app;
-      const id2 = `q-${randomUUID9()}`;
+      const id2 = `q-${randomUUID10()}`;
       this.appQuestions.set(id2, {
         question: { id: id2, app: app2, capability: q2.capability, text: q2.text, origin: { appId: origin.appId, projectId: origin.projectId }, askedAt: q2.askedAt, expiresAt: q2.expiresAt },
-        resolve: resolve11
+        resolve: resolve12
       });
       this.emit({ type: "external_app_questions_changed" });
       signal.addEventListener("abort", () => {
         if (!this.appQuestions.delete(id2)) return;
         this.emit({ type: "external_app_questions_changed" });
-        resolve11(null);
+        resolve12(null);
       }, { once: true });
     });
   }
@@ -114684,6 +115002,7 @@ ${String(stderr).slice(0, 2e3)}`
     this.appsHub?.dispose();
     this.appsHub = new SessionAppsHub(rt2, {
       ...opts,
+      boundaryOpen: (id2) => this.autoBoundaryOpen(id2),
       onDemand: {
         attached: (id2) => this.appAccess?.attached(id2) ?? [],
         /*
@@ -114694,7 +115013,9 @@ ${String(stderr).slice(0, 2e3)}`
         allowed: (session2, app2) => this.toolProfileOf(session2.id) === "reader" && (this.appAccess?.allowed(session2, app2) ?? false)
       }
     });
+    rt2.setSessionBoundaryPolicy((id2) => this.autoBoundaryOpen(id2));
     this.appAccess = new AppAccess({
+      boundaryOpen: (id2, boundary) => this.autoBoundaryOpen(id2, boundary),
       hub: this.appsHub,
       store: this.store,
       session: (id2) => {
@@ -115048,14 +115369,14 @@ ${String(stderr).slice(0, 2e3)}`
   }
   async loadMessages(sessionId, limit, beforeSeq) {
     const rows = this.store.loadMessages(sessionId, limit, beforeSeq);
-    const { readFile: readFile5 } = await import("node:fs/promises");
+    const { readFile: readFile6 } = await import("node:fs/promises");
     return Promise.all(
       rows.map(async (r) => {
         if (r.kind === "image") {
           const p = r.payload;
           if (!p.path || p.note) return r;
           try {
-            const data = (await readFile5(p.path)).toString("base64");
+            const data = (await readFile6(p.path)).toString("base64");
             return { ...r, payload: { ...p, data } };
           } catch {
             return { ...r, payload: { ...p, note: "The image was cleared and no longer exists (total-size cap)" } };
@@ -115068,7 +115389,7 @@ ${String(stderr).slice(0, 2e3)}`
             p.attachments.map(async (a) => {
               if (a.kind !== "image") return a;
               try {
-                return { ...a, data: (await readFile5(a.path)).toString("base64") };
+                return { ...a, data: (await readFile6(a.path)).toString("base64") };
               } catch {
                 return a;
               }
@@ -115082,6 +115403,7 @@ ${String(stderr).slice(0, 2e3)}`
   }
   async disposeAll() {
     this.watchers.close();
+    for (const readers of this.turnObservers.values()) for (const observer of readers) observer.fail(new Error("Centralu is stopping"));
     this.appsHub?.rt.attachBrokerHost(null);
     for (const run of [...this.agentRuns.values()]) run.fail(new Error("Centralu is shutting down"));
     for (const ask of [...this.hostAsks.values()]) ask.resolve(null);
@@ -115112,6 +115434,7 @@ ${String(stderr).slice(0, 2e3)}`
     this.watchers.close();
     this.appsHub?.rt.attachBrokerHost(null);
     for (const run of [...this.agentRuns.values()]) run.fail(new Error("Centralu is restarting"));
+    for (const readers of this.turnObservers.values()) for (const observer of readers) observer.fail(new Error("Centralu is restarting"));
     for (const ask of [...this.hostAsks.values()]) ask.resolve(null);
     this.hostAsks.clear();
     for (const q2 of [...this.appQuestions.values()]) q2.resolve(null);
@@ -115143,8 +115466,8 @@ import { relative as relative9 } from "node:path";
 // packages/agent-host/src/themes.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 import { watch as watch2 } from "node:fs";
-import { mkdir as mkdir6, readdir as readdir8, readFile as readFile4, rename as rename4, stat as stat5, unlink as unlink2, writeFile as writeFile4 } from "node:fs/promises";
-import { basename as basename6, join as join29 } from "node:path";
+import { mkdir as mkdir7, readdir as readdir9, readFile as readFile5, rename as rename4, stat as stat6, unlink as unlink2, writeFile as writeFile5 } from "node:fs/promises";
+import { basename as basename6, join as join30 } from "node:path";
 var MAX_FILE_BYTES = 256 * 1024;
 var SETTLE_MS = 100;
 var ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,59}$/;
@@ -115159,7 +115482,7 @@ var ThemeFiles = class {
   timer = null;
   /** Makes the folder, writes the schema next to the themes, and starts watching */
   async start() {
-    await mkdir6(this.dir, { recursive: true });
+    await mkdir7(this.dir, { recursive: true });
     await this.writeSchema();
     try {
       this.watcher = watch2(this.dir, (_event, name) => {
@@ -115189,15 +115512,15 @@ var ThemeFiles = class {
    * a token updates it, and an unchanged one does not touch the folder (or wake the watcher).
    */
   async writeSchema() {
-    const path2 = join29(this.dir, THEME_SCHEMA_FILE);
+    const path2 = join30(this.dir, THEME_SCHEMA_FILE);
     const text2 = `${JSON.stringify(themeFileJsonSchema(), null, 2)}
 `;
-    const current = await readFile4(path2, "utf8").catch(() => null);
+    const current = await readFile5(path2, "utf8").catch(() => null);
     if (current !== text2) await this.atomicWrite(path2, text2);
   }
   /** Every `<id>.json` in the folder, read and checked. A file that cannot be read is listed with the reason. */
   async list() {
-    const names = await readdir8(this.dir).catch(() => []);
+    const names = await readdir9(this.dir).catch(() => []);
     const entries = [];
     const ids = names.filter((name) => name.endsWith(".json") && name !== THEME_SCHEMA_FILE).map((name) => name.slice(0, -".json".length)).filter((id2) => ID_PATTERN.test(id2)).sort();
     for (const id2 of ids) entries.push(await this.read(id2));
@@ -115206,11 +115529,11 @@ var ThemeFiles = class {
   async read(id2) {
     const path2 = this.pathOf(id2);
     try {
-      const info = await stat5(path2);
+      const info = await stat6(path2);
       if (info.size > MAX_FILE_BYTES) {
         return { id: id2, path: path2, name: id2, base: "dark", tokens: {}, problems: ["The file is too large to be a theme."], broken: true };
       }
-      return parseThemeFile(id2, path2, await readFile4(path2, "utf8"));
+      return parseThemeFile(id2, path2, await readFile5(path2, "utf8"));
     } catch (e) {
       return { id: id2, path: path2, name: id2, base: "dark", tokens: {}, problems: [`Could not read the file: ${e.message}`], broken: true };
     }
@@ -115218,16 +115541,16 @@ var ThemeFiles = class {
   /** Writes a theme. `id` null makes a new file named after the theme (`My theme` → `my-theme.json`). */
   async save(id2, content) {
     const target = id2 ?? await this.freeId(content.name);
-    await mkdir6(this.dir, { recursive: true });
+    await mkdir7(this.dir, { recursive: true });
     await this.atomicWrite(this.pathOf(target), formatThemeFile(content));
     return this.read(target);
   }
   /** Copies a file from elsewhere in, under a fresh id if its name is taken. Refuses what does not read as a theme. */
   async importFrom(source) {
-    const info = await stat5(source);
+    const info = await stat6(source);
     if (!info.isFile()) throw Object.assign(new Error("That is not a file."), { code: "invalid_params" });
     if (info.size > MAX_FILE_BYTES) throw Object.assign(new Error("The file is too large to be a theme."), { code: "invalid_params" });
-    const text2 = await readFile4(source, "utf8");
+    const text2 = await readFile5(source, "utf8");
     const parsed = parseThemeFile("import", source, text2);
     if (parsed.broken) throw Object.assign(new Error(parsed.problems[0] ?? "Not a theme file."), { code: "invalid_params" });
     const fromName = basename6(source).replace(/\.json$/i, "");
@@ -115238,13 +115561,13 @@ var ThemeFiles = class {
   /** The absolute path for an id, for the shell to trash or reveal. Refuses anything that is not an id. */
   pathOf(id2) {
     if (!ID_PATTERN.test(id2)) throw Object.assign(new Error(`Not a theme id: ${id2}`), { code: "invalid_params" });
-    return join29(this.dir, `${id2}.json`);
+    return join30(this.dir, `${id2}.json`);
   }
   async freeId(name) {
     const base2 = name.toLowerCase().normalize("NFKD").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "theme";
     for (let n = 1; n < 1e3; n++) {
       const id2 = n === 1 ? base2 : `${base2}-${n}`;
-      const taken = await stat5(this.pathOf(id2)).then(
+      const taken = await stat6(this.pathOf(id2)).then(
         () => true,
         () => false
       );
@@ -115256,7 +115579,7 @@ var ThemeFiles = class {
   async atomicWrite(path2, text2) {
     const tmp = `${path2}.${randomBytes4(6).toString("hex")}.tmp`;
     try {
-      await writeFile4(tmp, text2, "utf8");
+      await writeFile5(tmp, text2, "utf8");
       await rename4(tmp, path2);
     } catch (e) {
       await unlink2(tmp).catch(() => {
@@ -116277,7 +116600,7 @@ var sameCause = (a, b2) => a !== null && b2 !== null && JSON.stringify(a) === JS
 
 // packages/agent-host/src/dev-services/terminal.ts
 import { createRequire } from "node:module";
-import { existsSync as existsSync19 } from "node:fs";
+import { existsSync as existsSync20 } from "node:fs";
 import { win32 as win327 } from "node:path";
 var require2 = createRequire(import.meta.url);
 var SCROLLBACK_BYTES = 256 * 1024;
@@ -116509,9 +116832,9 @@ function commandShell(command, platform = process.platform, env = process.env) {
 }
 function shellPath() {
   const fromEnv = process.env.SHELL;
-  if (fromEnv && existsSync19(fromEnv)) return fromEnv;
+  if (fromEnv && existsSync20(fromEnv)) return fromEnv;
   for (const candidate of ["/bin/zsh", "/bin/bash", "/bin/sh"]) {
-    if (existsSync19(candidate)) return candidate;
+    if (existsSync20(candidate)) return candidate;
   }
   return process.platform === "win32" ? "powershell.exe" : "/bin/sh";
 }
@@ -116698,7 +117021,7 @@ var CommandRunner = class {
 
 // packages/agent-host/src/updates.ts
 import { execFile as execFile8 } from "node:child_process";
-import { existsSync as existsSync20 } from "node:fs";
+import { existsSync as existsSync21 } from "node:fs";
 var REGISTRY_URL = `https://registry.npmjs.org/${APP_SLUG}/latest`;
 var CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
 var SCHEDULED_TIMEOUT_MS = 3e3;
@@ -116708,7 +117031,7 @@ var NPM_RETRY_DELAY_MS = 3e4;
 var NPM_RETRY_WINDOW_MS = 10 * 60 * 1e3;
 function existingInstalledCopy() {
   const path2 = installedCopyPath();
-  return existsSync20(path2) ? path2 : null;
+  return existsSync21(path2) ? path2 : null;
 }
 async function fetchLatestFromRegistry(timeoutMs) {
   try {
@@ -116722,16 +117045,16 @@ async function fetchLatestFromRegistry(timeoutMs) {
     return { ok: false, reason: "Could not reach the registry \u2014 check the network" };
   }
 }
-function commandFor(file2, args, resolve11 = (f) => resolveCommand(f)) {
-  const launch2 = resolve11(file2);
+function commandFor(file2, args, resolve12 = (f) => resolveCommand(f)) {
+  const launch2 = resolve12(file2);
   return { file: launch2.command, args: [...launch2.args, ...args] };
 }
 function failureDetail(file2, stderr) {
   const lines = stderr.split(/\r?\n/).map((l) => l.trim()).filter((l) => l && !/complete log of this run/i.test(l));
   return (file2 === "npm" ? lines.at(-1) : lines[0]) ?? null;
 }
-function runCommand(file2, args, resolve11) {
-  const cmd = commandFor(file2, args, resolve11);
+function runCommand(file2, args, resolve12) {
+  const cmd = commandFor(file2, args, resolve12);
   return new Promise((done, reject) => {
     execFile8(cmd.file, cmd.args, { timeout: INSTALL_TIMEOUT_MS, windowsHide: true }, (err, _stdout, stderr) => {
       if (!err) return done();
@@ -116759,7 +117082,7 @@ var UpdateService = class {
       readAutoApply: deps.readAutoApply ?? (() => false),
       writeAutoApply: deps.writeAutoApply ?? (() => {
       }),
-      wait: deps.wait ?? ((ms3) => new Promise((resolve11) => setTimeout(resolve11, ms3)))
+      wait: deps.wait ?? ((ms3) => new Promise((resolve12) => setTimeout(resolve12, ms3)))
     };
     this.status = {
       /*
@@ -117305,7 +117628,7 @@ var SessionSleeper = class {
 // packages/agent-host/src/dev-services/instance-lock.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { readFileSync as readFileSync13, unlinkSync as unlinkSync3, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname10, join as join30 } from "node:path";
+import { dirname as dirname10, join as join31 } from "node:path";
 import Database2 from "better-sqlite3";
 var OWNERSHIP_FILE = "host-ownership.sqlite";
 var held = /* @__PURE__ */ new Set();
@@ -117339,7 +117662,7 @@ function parseHolder(raw) {
 function acquireInstanceLock(dbPath2, startOf = processStartTime) {
   if (dbPath2 === ":memory:") return { ok: true, release: () => {
   } };
-  const lockPath = join30(dirname10(dbPath2), "host.lock");
+  const lockPath = join31(dirname10(dbPath2), "host.lock");
   const readHolder = () => {
     try {
       return parseHolder(readFileSync13(lockPath, "utf8"));
@@ -117347,7 +117670,7 @@ function acquireInstanceLock(dbPath2, startOf = processStartTime) {
       return null;
     }
   };
-  const owner = takeOwnership(join30(dirname10(dbPath2), OWNERSHIP_FILE));
+  const owner = takeOwnership(join31(dirname10(dbPath2), OWNERSHIP_FILE));
   if (!owner) {
     const holder = readHolder();
     return { ok: false, heldByPid: holder && Number.isInteger(holder.pid) && holder.pid > 0 ? holder.pid : null, lockPath };
@@ -117668,9 +117991,9 @@ var ControlChannel = class {
   }
   next(op) {
     if (this.ended) return Promise.reject(new Error("the keeper closed the control channel"));
-    return new Promise((resolve11, reject) => {
+    return new Promise((resolve12, reject) => {
       const list = this.waiters.get(op) ?? [];
-      list.push({ resolve: resolve11, reject });
+      list.push({ resolve: resolve12, reject });
       this.waiters.set(op, list);
     });
   }
@@ -117775,7 +118098,7 @@ async function runDrain(bound, deps) {
 }
 
 // packages/agent-host/src/links/install.ts
-import { existsSync as existsSync21, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync14 } from "node:fs";
 import { hostname as hostname3 } from "node:os";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { gzipSync } from "node:zlib";
@@ -118099,7 +118422,7 @@ var SshTunnel = class {
     if (this.closing) throw new Error(`The link to ${this.opts.target} was closed`);
   }
   run(args, stdin) {
-    return new Promise((resolve11, reject) => {
+    return new Promise((resolve12, reject) => {
       const child = spawn5(this.opts.ssh ?? "ssh", args, { env: this.opts.env ?? process.env, stdio: [stdin === void 0 ? "ignore" : "pipe", "pipe", "pipe"] });
       if (stdin !== void 0) {
         child.stdin.on("error", () => {
@@ -118116,7 +118439,7 @@ var SshTunnel = class {
         this.asking.delete(child);
         reject(e);
       });
-      child.once("close", (code2) => resolve11({ code: code2, stdout, stderr }));
+      child.once("close", (code2) => resolve12({ code: code2, stdout, stderr }));
     });
   }
   config() {
@@ -118163,7 +118486,7 @@ var SshTunnel = class {
     this.child = child;
     let stderr = "";
     child.stderr.on("data", (d2) => stderr += String(d2));
-    return new Promise((resolve11, reject) => {
+    return new Promise((resolve12, reject) => {
       let settled = false;
       const deadline = Date.now() + (this.opts.forwardTimeoutMs ?? 2e4);
       const fail4 = (message) => {
@@ -118182,7 +118505,7 @@ var SshTunnel = class {
           if (await accepts(localPort)) {
             settled = true;
             this.opts.log?.(`[links] forward up: 127.0.0.1:${localPort} -> ${this.opts.target}:127.0.0.1:${remotePort}`);
-            return resolve11();
+            return resolve12();
           }
           if (Date.now() > deadline) {
             this.ended.add(child);
@@ -118200,12 +118523,12 @@ var SshTunnel = class {
     this.child = null;
     if (!child || child.exitCode !== null || child.signalCode !== null) return;
     this.ended.add(child);
-    await new Promise((resolve11) => {
-      child.once("exit", () => resolve11());
+    await new Promise((resolve12) => {
+      child.once("exit", () => resolve12());
       child.kill("SIGTERM");
       setTimeout(() => {
         child.kill("SIGKILL");
-        resolve11();
+        resolve12();
       }, 2e3).unref();
     });
   }
@@ -118215,29 +118538,29 @@ function lastLine(s) {
   return [...lines].reverse().find((l) => /error|denied|refused|timed out|not found|cannot|could not/i.test(l)) ?? lines.at(-1) ?? "";
 }
 function accepts(port2) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     const s = createConnection2({ host: "127.0.0.1", port: port2 });
     s.once("connect", () => {
       s.destroy();
-      resolve11(true);
+      resolve12(true);
     });
-    s.once("error", () => resolve11(false));
+    s.once("error", () => resolve12(false));
   });
 }
 function portFree(port2) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     const probe = createServer3();
-    probe.once("error", () => resolve11(false));
-    probe.listen(port2, "127.0.0.1", () => probe.close(() => resolve11(true)));
+    probe.once("error", () => resolve12(false));
+    probe.listen(port2, "127.0.0.1", () => probe.close(() => resolve12(true)));
   });
 }
 function freePort() {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const probe = createServer3();
     probe.once("error", reject);
     probe.listen(0, "127.0.0.1", () => {
       const { port: port2 } = probe.address();
-      probe.close(() => resolve11(port2));
+      probe.close(() => resolve12(port2));
     });
   });
 }
@@ -118453,7 +118776,7 @@ async function installRemote(o) {
 function bundled(name, source) {
   for (const url2 of [new URL(`./${name}`, import.meta.url), new URL(source, import.meta.url)]) {
     const file2 = fileURLToPath6(url2);
-    if (existsSync21(file2)) return readFileSync14(file2, "utf8");
+    if (existsSync22(file2)) return readFileSync14(file2, "utf8");
   }
   throw new Error(`${name} is missing from this host`);
 }
@@ -118556,7 +118879,7 @@ function probeTarget(target, opts = {}) {
     return Promise.reject(Object.assign(new Error("Not an ssh target: use a host alias from ~/.ssh/config, or user@host"), { code: "internal" }));
   }
   const args = [...opts.configFile ? ["-F", opts.configFile] : [], "-T", "-o", "BatchMode=yes", "-o", "ConnectTimeout=10", "--", t, probeCommand()];
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     let stdout = "";
     let stderr = "";
     let done = false;
@@ -118564,7 +118887,7 @@ function probeTarget(target, opts = {}) {
       if (done) return;
       done = true;
       clearTimeout(timer);
-      resolve11(parseProbe(t, run));
+      resolve12(parseProbe(t, run));
     };
     const child = spawn6(opts.ssh ?? "ssh", args, { env: opts.env ?? process.env, stdio: ["ignore", "pipe", "pipe"] });
     const timer = setTimeout(() => {
@@ -118582,7 +118905,7 @@ function probeTarget(target, opts = {}) {
 import { spawn as spawn7 } from "node:child_process";
 import { readdirSync as readdirSync8, readFileSync as readFileSync15, statSync as statSync13 } from "node:fs";
 import { homedir as homedir13 } from "node:os";
-import { isAbsolute as isAbsolute10, join as join31, normalize, parse as parse6, sep as sep12 } from "node:path";
+import { isAbsolute as isAbsolute10, join as join32, normalize, parse as parse6, sep as sep12 } from "node:path";
 var MAX_DEPTH2 = 16;
 function splitConfigLine(raw) {
   const m = /^\s*([^\s=#]+)\s*(?:=\s*)?([\s\S]*)$/.exec(raw);
@@ -118648,7 +118971,7 @@ function expandGlob(path2) {
     const next = [];
     for (const base2 of found) {
       if (!MAGIC.test(seg)) {
-        next.push(join31(base2, seg));
+        next.push(join32(base2, seg));
         continue;
       }
       let names;
@@ -118660,7 +118983,7 @@ function expandGlob(path2) {
       const re2 = segmentRe(seg);
       for (const name of names.sort()) {
         if (name.startsWith(".") && !seg.startsWith(".")) continue;
-        if (re2.test(name)) next.push(join31(base2, name));
+        if (re2.test(name)) next.push(join32(base2, name));
       }
     }
     found = next;
@@ -118715,11 +119038,11 @@ function readSshConfig(opts) {
         }
         for (const arg of split2.args) {
           let path2 = arg;
-          if (path2.startsWith("~/")) path2 = join31(opts.home, path2.slice(2));
+          if (path2.startsWith("~/")) path2 = join32(opts.home, path2.slice(2));
           else if (path2.startsWith("~")) {
             notes.push(`An Include of another user's folder (${where(file2, n + 1)}) was not read`);
             continue;
-          } else if (!isAbsolute10(path2)) path2 = join31(opts.home, ".ssh", path2);
+          } else if (!isAbsolute10(path2)) path2 = join32(opts.home, ".ssh", path2);
           for (const f of expandGlob(path2)) read(f, depth + 1);
         }
       }
@@ -118742,7 +119065,7 @@ function parseSshG(stdout) {
   return { hostName: first.get("hostname") || null, user: first.get("user") || null, port: Number.isInteger(port2) && port2 > 0 ? port2 : null };
 }
 function resolveAlias(alias, opts = {}) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     const args = [...opts.configFile ? ["-F", opts.configFile] : [], "-G", "--", alias];
     let stdout = "";
     let stderr = "";
@@ -118751,7 +119074,7 @@ function resolveAlias(alias, opts = {}) {
       if (done) return;
       done = true;
       clearTimeout(timer);
-      resolve11(r);
+      resolve12(r);
     };
     const none = (error51) => ({ hostName: null, user: null, port: null, error: error51 });
     const child = spawn7(opts.ssh ?? "ssh", args, { env: opts.env ?? process.env, stdio: ["ignore", "pipe", "pipe"] });
@@ -118769,18 +119092,18 @@ var MAX_HOSTS = 100;
 var RESOLVE_AT_ONCE = 8;
 async function listSshHosts(opts = {}) {
   const home = opts.home ?? homedir13();
-  const file2 = opts.configFile ?? join31(home, ".ssh", "config");
+  const file2 = opts.configFile ?? join32(home, ".ssh", "config");
   const read = readSshConfig({ file: file2, home });
   const notes = [...read.notes];
   const listed = read.hosts.slice(0, MAX_HOSTS);
   if (read.hosts.length > MAX_HOSTS) notes.push(`Only the first ${MAX_HOSTS} of ${read.hosts.length} hosts are listed; type any other below`);
-  const resolve11 = opts.resolve ?? ((alias) => resolveAlias(alias, opts));
+  const resolve12 = opts.resolve ?? ((alias) => resolveAlias(alias, opts));
   const resolved = new Array(listed.length);
   let next = 0;
   const worker = async () => {
     while (next < listed.length) {
       const i = next++;
-      resolved[i] = await resolve11(listed[i].alias);
+      resolved[i] = await resolve12(listed[i].alias);
     }
   };
   await Promise.all(Array.from({ length: Math.min(RESOLVE_AT_ONCE, listed.length) }, worker));
@@ -119269,11 +119592,11 @@ var RemoteClient = class {
     if (!this.ready || !this.ws) return Promise.reject(linkError("The machine is not reachable right now", true));
     const ws2 = this.ws;
     const id2 = String(this.nextId++);
-    return new Promise((resolve11, reject) => {
+    return new Promise((resolve12, reject) => {
       const timer = setTimeout(() => {
         if (this.pending.delete(id2)) reject(Object.assign(new Error(`The machine did not answer ${method} in time`), { code: "internal", retryable: true }));
       }, this.opts.callTimeoutMs ?? DEFAULT_CALL_TIMEOUT_MS);
-      this.pending.set(id2, { resolve: resolve11, reject, timer });
+      this.pending.set(id2, { resolve: resolve12, reject, timer });
       ws2.send(JSON.stringify({ kind: "rpc", id: id2, method, params }));
     });
   }
@@ -119636,14 +119959,14 @@ var LinkedMachine = class {
     if (this.client?.connected) return this.client.call("host.activity", {}).then(read, () => null);
     const e = this.endpoint;
     if (!e?.url || this.versions?.compatible === false || this.held) return Promise.resolve(null);
-    return new Promise((resolve11) => {
+    return new Promise((resolve12) => {
       let settled = false;
       const done = (v) => {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
         client.close();
-        resolve11(v);
+        resolve12(v);
       };
       const client = new RemoteClient(
         { ...this.deps.client, url: e.url, token: e.token, handshakeTimeoutMs: 5e3, callTimeoutMs: 5e3 },
@@ -119717,16 +120040,16 @@ var LinkedMachine = class {
         const started = await this.tunnel.startHost();
         this.hostStarted = { ...started, at: Date.now() };
       },
-      answers: (version2, ms3) => new Promise((resolve11) => {
+      answers: (version2, ms3) => new Promise((resolve12) => {
         const waiter = (v) => {
           if (v !== version2) return;
           clearTimeout(timer);
           this.helloWaiters.delete(waiter);
-          resolve11(true);
+          resolve12(true);
         };
         const timer = setTimeout(() => {
           this.helloWaiters.delete(waiter);
-          void hold().then(() => resolve11(false));
+          void hold().then(() => resolve12(false));
         }, this.deps.checkMs ?? ms3);
         this.helloWaiters.add(waiter);
         this.held = false;
@@ -120875,7 +121198,7 @@ function storeMirror(store2) {
 var start = new StartSequence();
 start.at("launch variables");
 var launch = takeLaunchEnv();
-var BUILD = true ? "c6afa2e" : "dev";
+var BUILD = true ? "5dca7b8" : "dev";
 var { values } = parseArgs({
   options: {
     port: { type: "string", default: "5175" },
@@ -120896,12 +121219,12 @@ start.at("data folder");
 var movedNote = null;
 function defaultDbPath() {
   const isDev = process.env.CC_DEV === "1";
-  const dir = join32(homedir14(), isDev ? DATA_DIR_DEV : DATA_DIR);
-  const legacy = join32(homedir14(), isDev ? DATA_DIR_LEGACY.dev : DATA_DIR_LEGACY.prod);
+  const dir = join33(homedir14(), isDev ? DATA_DIR_DEV : DATA_DIR);
+  const legacy = join33(homedir14(), isDev ? DATA_DIR_LEGACY.dev : DATA_DIR_LEGACY.prod);
   movedNote = migrateLegacyDataDir(legacy, dir) ? `[agent-host] data folder moved: ${legacy} -> ${dir}` : null;
   mkdirSync11(dir, { recursive: true });
   process.env.CC_DATA_DIR = dir;
-  return join32(dir, "store.db");
+  return join33(dir, "store.db");
 }
 var dbPath = values.memory ? ":memory:" : values.db ?? defaultDbPath();
 start.at("log");
@@ -120979,7 +121302,7 @@ var mgr = new SessionManager(
   },
   (sessionId) => bridgeAddress(launch.frontDoor, port, token, sessionId),
   // Worktrees are created next to the data folder — dev and the packaged app never touch each other's worktrees
-  join32(dirname11(dbPath), "worktrees"),
+  join33(dirname11(dbPath), "worktrees"),
   held2 ? { processes: held2.processes, keptSessions: held2.kept.sessionIds } : {}
 );
 mgr.useProjectsHome(() => projectsHome());
@@ -121013,7 +121336,7 @@ if (held2) {
 }
 var AUTO_UPDATE_CHECK_KEY = "updates.auto";
 var AUTO_APPLY_UPDATES_KEY = "updates.autoApply";
-var themes = new ThemeFiles(join32(dataRoot(), "themes"), () => events.push({ type: "themes_changed" }));
+var themes = new ThemeFiles(join33(dataRoot(), "themes"), () => events.push({ type: "themes_changed" }));
 await themes.start().catch((e) => console.error(`[themes] the themes folder is unavailable: ${e.message}`));
 var updates = new UpdateService((status) => events.push({ type: "update_status", status }), {
   // On by default when nothing has been saved yet. Since the check is read-only and every failure
@@ -121232,7 +121555,7 @@ var endings = wireEndings({
   heldChildren: held2 !== null,
   leave: (mode, handOver) => void shutdown.leave(mode, handOver),
   force: (why) => shutdown.force(why),
-  record: crashRecorder(join32(dirname11(dbPath), "host-errors.log"), (line) => console.error(line)),
+  record: crashRecorder(join33(dirname11(dbPath), "host-errors.log"), (line) => console.error(line)),
   stdin: process.stdin,
   watchParent: values["watch-parent"] === true,
   log: (line) => console.error(line)