@codexhost/cli-linux-arm64 0.9.1-test.2 → 0.9.1

package/app/host-runtime.mjs

@@ -4283,7 +4283,7 @@ async function runDelegationCli(input) {
 
 // packages/host-runtime/src/run-host-runtime.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
-import path20 from "node:path";
+import path21 from "node:path";
 import { homedir as homedir2 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
@@ -5978,10 +5978,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path25) {
-  if (!path25)
+function getElementAtPath(obj, path26) {
+  if (!path26)
     return obj;
-  return path25.reduce((acc, key) => acc?.[key], obj);
+  return path26.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -6390,11 +6390,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path25, issues) {
+function prefixIssues(path26, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path25);
+    iss.path.unshift(path26);
     return iss;
   });
 }
@@ -6541,16 +6541,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path25 = []) => {
+  const processError = (error52, path26 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path25, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path26, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
       } else {
-        const fullpath = [...path25, ...issue2.path];
+        const fullpath = [...path26, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -6577,17 +6577,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path25 = []) => {
+  const processError = (error52, path26 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path25, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path26, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path25, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
       } else {
-        const fullpath = [...path25, ...issue2.path];
+        const fullpath = [...path26, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -6619,8 +6619,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path25 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path25) {
+  const path26 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path26) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -19312,13 +19312,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path25 = ref.slice(1).split("/").filter(Boolean);
-  if (path25.length === 0) {
+  const path26 = ref.slice(1).split("/").filter(Boolean);
+  if (path26.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path25[0] === defsKey) {
-    const key = path25[1];
+  if (path26[0] === defsKey) {
+    const key = path26[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -20261,6 +20261,8 @@ var pluginPresentationShape = {
   id: harnessPluginIdSchema,
   name: external_exports.string().trim().min(1).max(128),
   version: external_exports.string().min(1).max(128),
+  /** The factory accepts a persisted local entrypoint through its construction context. */
+  launchCommand: external_exports.literal(true).optional(),
   links: external_exports.object({
     documentation: documentationUrlSchema.optional(),
     installation: documentationUrlSchema.optional()
@@ -20322,6 +20324,21 @@ function decodeHarnessPluginRoute(value2) {
   }
 }
 
+// packages/shared-contracts/dist/harness-launch-settings.js
+var HARNESS_LAUNCH_SETTINGS_GET_METHOD = "codexhost/harness/launch-settings/get";
+var HARNESS_LAUNCH_SETTINGS_SET_METHOD = "codexhost/harness/launch-settings/set";
+var harnessLaunchPathSchema = external_exports.string().trim().min(1).max(4096).refine((value2) => !/[\u0000\r\n]/u.test(value2), "Invalid entrypoint path");
+var harnessLaunchSettingsGetSchema = external_exports.object({
+  harnessId: harnessPluginIdSchema
+}).strict();
+var harnessLaunchSettingsSetSchema = harnessLaunchSettingsGetSchema.extend({
+  path: harnessLaunchPathSchema.nullable()
+});
+var harnessLaunchSettingsSchema = external_exports.object({
+  path: harnessLaunchPathSchema.nullable(),
+  restartRequired: external_exports.boolean()
+}).strict();
+
 // packages/shared-contracts/dist/codex-accounts.js
 var accountIdSchema = external_exports.string().min(1).max(256).regex(/^[A-Za-z0-9._~-]+$/u);
 var nonBlankTextSchema3 = external_exports.string().trim().min(1);
@@ -22299,16 +22316,16 @@ var Diff = class {
       }
     }
   }
-  addToPath(path25, added, removed, oldPosInc, options2) {
-    const last = path25.lastComponent;
+  addToPath(path26, added, removed, oldPosInc, options2) {
+    const last = path26.lastComponent;
     if (last && !options2.oneChangePerToken && last.added === added && last.removed === removed) {
       return {
-        oldPos: path25.oldPos + oldPosInc,
+        oldPos: path26.oldPos + oldPosInc,
         lastComponent: { count: last.count + 1, added, removed, previousComponent: last.previousComponent }
       };
     } else {
       return {
-        oldPos: path25.oldPos + oldPosInc,
+        oldPos: path26.oldPos + oldPosInc,
         lastComponent: { count: 1, added, removed, previousComponent: last }
       };
     }
@@ -23009,8 +23026,8 @@ function projectFileChangeKind(kind) {
   return { type: kind };
 }
 function projectFileChanges(changes) {
-  return changes.map(({ path: path25, kind, unifiedDiff }) => ({
-    path: path25,
+  return changes.map(({ path: path26, kind, unifiedDiff }) => ({
+    path: path26,
     kind: projectFileChangeKind(kind),
     diff: unifiedDiff
   }));
@@ -23948,13 +23965,13 @@ function decodeThreadForkRequest(request) {
   if (runtimeWorkspaceRoots !== void 0 && runtimeWorkspaceRoots !== null && (!Array.isArray(runtimeWorkspaceRoots) || runtimeWorkspaceRoots.some((root) => typeof root !== "string" || root.length === 0))) {
     throw new Error("thread/fork params.runtimeWorkspaceRoots must be text paths or null");
   }
-  const path25 = optionalText(params, "path", { allowEmpty: true });
+  const path26 = optionalText(params, "path", { allowEmpty: true });
   const ephemeral = optionalBoolean(params, "ephemeral");
   return {
     threadId: threadId2,
     ...lastTurnText ? { lastTurnId: hostTurnIdSchema.parse(lastTurnText) } : {},
     ...beforeTurnText ? { beforeTurnId: hostTurnIdSchema.parse(beforeTurnText) } : {},
-    ...path25 ? { path: path25 } : {},
+    ...path26 ? { path: path26 } : {},
     ...optionalField(params, "model"),
     ...optionalField(params, "modelProvider"),
     ...optionalField(params, "cwd"),
@@ -25130,9 +25147,9 @@ var HarnessAccountInspectionCache = class {
 };
 
 // packages/host-runtime/src/app-server-host.ts
-import { createHash as createHash6, randomUUID as randomUUID8 } from "node:crypto";
-import os2 from "node:os";
-import path11 from "node:path";
+import { createHash as createHash6, randomUUID as randomUUID9 } from "node:crypto";
+import os3 from "node:os";
+import path12 from "node:path";
 
 // packages/host-runtime/src/external-thread-fork.ts
 import nodePath from "node:path";
@@ -28278,6 +28295,7 @@ async function loadHarnessPlugins(options2) {
         id: manifest.id,
         name: manifest.name,
         version: manifest.version,
+        ...manifest.launchCommand && !options2.context.managedRemoteHost ? { launchCommand: true } : {},
         ...manifest.links ? { links: manifest.links } : {}
       });
       let adapter;
@@ -28288,9 +28306,10 @@ async function loadHarnessPlugins(options2) {
       } else {
         try {
           if (manifest.icon) descriptor.icon = await readPluginIcon(candidate.root, manifest.icon);
+          const launchCommand = descriptor.launchCommand ? await options2.launchCommandForPlugin?.(manifest.id) : void 0;
           adapter = await loadAdapter(
             candidate,
-            options2.context,
+            { ...options2.context, ...launchCommand ? { launchCommand } : {} },
             timeoutMs,
             diagnose,
             options2.warmup !== false,
@@ -28318,6 +28337,76 @@ async function loadHarnessPlugins(options2) {
   return registry2;
 }
 
+// packages/host-runtime/src/harness-launch-settings.ts
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { mkdir as mkdir4, readFile as readFile5, rename as rename3, rm as rm4, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
+import os2 from "node:os";
+import path11 from "node:path";
+var HarnessLaunchSettingsStore = class {
+  #directory;
+  #initial = /* @__PURE__ */ new Map();
+  constructor(environment) {
+    this.#directory = path11.join(
+      environment.CODEXHOST_DATA_DIR ? path11.resolve(environment.CODEXHOST_DATA_DIR) : path11.join(os2.homedir(), ".codexhost"),
+      "harness-launch-settings"
+    );
+  }
+  #file(id2) {
+    return path11.join(this.#directory, `${harnessPluginIdSchema.parse(id2)}.json`);
+  }
+  async #read(id2) {
+    try {
+      const value2 = harnessLaunchPathSchema.parse(
+        JSON.parse(await readFile5(this.#file(id2), "utf8"))
+      );
+      if (!path11.isAbsolute(value2)) throw new Error("Expected an absolute entrypoint path");
+      return value2;
+    } catch (error51) {
+      if (error51 && typeof error51 === "object" && "code" in error51 && error51.code === "ENOENT")
+        return null;
+      throw new Error("Could not read Harness launch settings");
+    }
+  }
+  /** Capture the value used to construct this Host's Adapter; changes require a restart. */
+  async initialCommand(id2) {
+    let initial = this.#initial.get(id2);
+    if (!initial) {
+      initial = this.#read(id2);
+      this.#initial.set(id2, initial);
+    }
+    return await initial ?? void 0;
+  }
+  async get(id2) {
+    const initial = await this.initialCommand(id2) ?? null;
+    const value2 = await this.#read(id2);
+    return { path: value2, restartRequired: value2 !== initial };
+  }
+  async set(id2, value2) {
+    const initial = await this.initialCommand(id2) ?? null;
+    const file2 = this.#file(id2);
+    if (value2 === null) {
+      await rm4(file2, { force: true });
+    } else {
+      value2 = harnessLaunchPathSchema.parse(value2);
+      if (!path11.isAbsolute(value2))
+        throw new Error("Use an absolute entrypoint path without arguments");
+      const metadata = await stat3(value2).catch(() => void 0);
+      if (!metadata?.isDirectory() && !metadata?.isFile())
+        throw new Error("The installation path must be an existing directory on this Host");
+      await mkdir4(this.#directory, { recursive: true, mode: 448 });
+      const temporary = `${file2}.${randomUUID6()}.tmp`;
+      try {
+        await writeFile3(temporary, `${JSON.stringify(value2)}
+`, { mode: 384, flag: "wx" });
+        await rename3(temporary, file2);
+      } finally {
+        await rm4(temporary, { force: true });
+      }
+    }
+    return { path: value2, restartRequired: value2 !== initial };
+  }
+};
+
 // packages/host-runtime/src/official-codex-model-ref.ts
 import { Buffer as Buffer2 } from "node:buffer";
 var OFFICIAL_CODEX_MODEL_REF_PREFIX = "codex-model-v1.";
@@ -28508,10 +28597,10 @@ var SingleNativeCodexAccount = class {
 };
 
 // packages/host-runtime/src/codex-runtime/official-runtime-owner.ts
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 
 // packages/host-runtime/src/official-request-broker.ts
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 var INTERNAL_REQUEST_PREFIX = "codexhost:official:";
 var MAX_RETIRED_IDS = 1024;
 function isRecord10(value2) {
@@ -28527,7 +28616,7 @@ var OfficialRequestBroker = class {
   constructor(input) {
     this.#send = input.send;
     this.#timeoutMs = input.timeoutMs ?? 3e4;
-    this.#nextId = input.nextId ?? (() => `${INTERNAL_REQUEST_PREFIX}${randomUUID6()}`);
+    this.#nextId = input.nextId ?? (() => `${INTERNAL_REQUEST_PREFIX}${randomUUID7()}`);
   }
   get pendingCount() {
     return this.#pending.size;
@@ -28881,7 +28970,7 @@ var OfficialRuntimeOwner = class {
   }
   #attach(role, output, onBackendStopped) {
     const client = {
-      id: randomUUID7(),
+      id: randomUUID8(),
       role,
       output,
       ...onBackendStopped ? { onBackendStopped } : {},
@@ -29039,7 +29128,7 @@ var OfficialRuntimeOwner = class {
     if (!object4(value2)) return client.output(event);
     if (typeof value2.id === "string" || typeof value2.id === "number") {
       if (typeof value2.method === "string") {
-        const id2 = `codexhost:server:${client.id}:${event.generation}:${randomUUID7()}`;
+        const id2 = `codexhost:server:${client.id}:${event.generation}:${randomUUID8()}`;
         client.serverRequests.set(id2, value2.id);
         const projected = { ...value2, id: id2 };
         return client.output({
@@ -29434,25 +29523,25 @@ function resolveExternalSessionTreeIds(records) {
   const resolve = (start) => {
     const cached2 = resolved.get(start.hostThreadId);
     if (cached2) return cached2;
-    const path25 = [];
+    const path26 = [];
     const visited = /* @__PURE__ */ new Set();
     let current = start;
     while (true) {
       const known = resolved.get(current.hostThreadId);
       if (known) {
-        for (const record3 of path25) resolved.set(record3.hostThreadId, known);
+        for (const record3 of path26) resolved.set(record3.hostThreadId, known);
         return known;
       }
       if (visited.has(current.hostThreadId)) {
         throw new Error("External Thread Fork tree contains a cycle");
       }
       visited.add(current.hostThreadId);
-      path25.push(current);
+      path26.push(current);
       const sourceId = current.subagent?.parentHostThreadId ?? current.forkSource?.hostThreadId;
       const source = sourceId ? byId.get(sourceId) : void 0;
       if (!source) {
         const root = current.hostThreadId;
-        for (const record3 of path25) resolved.set(record3.hostThreadId, root);
+        for (const record3 of path26) resolved.set(record3.hostThreadId, root);
         return root;
       }
       current = source;
@@ -29863,6 +29952,7 @@ var AppServerHost = class {
   #nativeAccountObserver;
   #externalAdapters;
   #pluginDescriptors = [];
+  #launchSettings;
   #accountInspections = new HarnessAccountInspectionCache();
   #externalRuntime;
   #externalSteering = new ExternalTurnSteering();
@@ -29904,7 +29994,10 @@ var AppServerHost = class {
     };
     this.#writer = new OrderedWriter(this.#options.desktopOutput);
     const environment = this.#options.environment ?? process.env;
-    const permanentHome = path11.resolve(environment.CODEX_HOME ?? path11.join(os2.homedir(), ".codex"));
+    this.#launchSettings = new HarnessLaunchSettingsStore(
+      this.#options.pluginContext?.environment ?? environment
+    );
+    const permanentHome = path12.resolve(environment.CODEX_HOME ?? path12.join(os3.homedir(), ".codex"));
     this.#ownsOfficialRuntimeScope = options2.officialRuntimeScope === void 0;
     this.#officialRuntimeScope = options2.officialRuntimeScope ?? new OfficialRuntimeScope({
       diagnosticOutput: this.#options.diagnosticOutput,
@@ -30051,6 +30144,7 @@ var AppServerHost = class {
     if (!this.#options.pluginRoots || this.#pluginLoadAbort.signal.aborted) return;
     const plugins = await loadHarnessPlugins({
       roots: this.#options.pluginRoots,
+      launchCommandForPlugin: (id2) => this.#launchSettings.initialCommand(id2),
       context: this.#options.pluginContext ?? {
         environment: this.#options.environment ?? process.env,
         platform: process.platform,
@@ -30323,6 +30417,41 @@ var AppServerHost = class {
       this.#dispatchDesktopRequest(() => this.#openHarnessWebUi(request));
       return;
     }
+    if (request.method === HARNESS_LAUNCH_SETTINGS_GET_METHOD || request.method === HARNESS_LAUNCH_SETTINGS_SET_METHOD) {
+      this.#dispatchDesktopRequest(async () => {
+        const schema = request.method === HARNESS_LAUNCH_SETTINGS_SET_METHOD ? harnessLaunchSettingsSetSchema : harnessLaunchSettingsGetSchema;
+        const params = schema.safeParse(request.params);
+        if (!params.success) {
+          await this.#writer.json(rpcError(request, -32602, "Invalid Harness launch settings"));
+          return;
+        }
+        await this.#waitForPlugins();
+        if (!this.#pluginDescriptors.some(
+          (plugin) => plugin.id === params.data.harnessId && plugin.launchCommand
+        )) {
+          await this.#writer.json(
+            rpcError(request, -32602, "Harness launch settings are unavailable")
+          );
+          return;
+        }
+        try {
+          const result = request.method === HARNESS_LAUNCH_SETTINGS_SET_METHOD ? await this.#launchSettings.set(
+            params.data.harnessId,
+            harnessLaunchSettingsSetSchema.parse(request.params).path
+          ) : await this.#launchSettings.get(params.data.harnessId);
+          await this.#writer.json(rpcEnvelope(request, { result: jsonValueSchema.parse(result) }));
+        } catch {
+          await this.#writer.json(
+            rpcError(
+              request,
+              -32602,
+              "Could not read or save launch settings. Use an existing absolute installation directory on this Host, without arguments, and check configuration permissions."
+            )
+          );
+        }
+      });
+      return;
+    }
     if (request.method === "codexhost/harness/plugins/list") {
       this.#dispatchDesktopRequest(async () => {
         if (!harnessPluginListParamsSchema.safeParse(request.params).success) {
@@ -31008,7 +31137,7 @@ var AppServerHost = class {
       throw error51;
     }
     this.#activeOfficialTurns.set(threadId2, turnId);
-    const delegationId = hostThreadIdSchema.parse(randomUUID8());
+    const delegationId = hostThreadIdSchema.parse(randomUUID9());
     try {
       const source = await this.#repository.find(input.parentThreadId);
       const pendingTerminal = this.#pendingOfficialTerminalStatuses.get(threadId2);
@@ -31172,7 +31301,7 @@ var AppServerHost = class {
   async #listDelegationThreads(input) {
     const [sortKey, sortDirection2] = input.sort.split("-");
     const request = {
-      id: `codexhost:delegation-list:${randomUUID8()}`,
+      id: `codexhost:delegation-list:${randomUUID9()}`,
       method: "thread/list",
       params: {
         cwd: input.cwd ? [input.cwd] : null,
@@ -31618,7 +31747,7 @@ var AppServerHost = class {
       );
       return;
     }
-    const turnId = requestedTurnId ?? hostTurnIdSchema.parse(randomUUID8());
+    const turnId = requestedTurnId ?? hostTurnIdSchema.parse(randomUUID9());
     const projection = {
       projector: new CodexTurnProjector({
         threadId: thread.id,
@@ -32485,7 +32614,7 @@ var AppServerHost = class {
     if (thread.running || thread.activeTurnId || this.#pendingExternalCommandRequests.has(thread.id)) {
       throw new ExternalSteerError(-32072, "External Thread already has an active Turn");
     }
-    const turnId = hostTurnIdSchema.parse(randomUUID8());
+    const turnId = hostTurnIdSchema.parse(randomUUID9());
     const startedAtMs = Date.now();
     const projection = {
       projector: new CodexTurnProjector({
@@ -33033,7 +33162,7 @@ var AppServerHost = class {
     try {
       result = projection.projector.projectQuestion(
         interaction,
-        hostItemIdSchema.parse(randomUUID8())
+        hostItemIdSchema.parse(randomUUID9())
       );
     } catch (error51) {
       this.#diagnose(error51);
@@ -33199,9 +33328,9 @@ var AppServerHost = class {
 };
 
 // packages/host-runtime/src/native-account-host.ts
-import { mkdir as mkdir6, realpath as realpath3 } from "node:fs/promises";
+import { mkdir as mkdir7, realpath as realpath3 } from "node:fs/promises";
 import { homedir } from "node:os";
-import path15 from "node:path";
+import path16 from "node:path";
 
 // packages/host-runtime/src/codex-runtime/owned-official-backends.ts
 import { createHash as createHash7, randomBytes } from "node:crypto";
@@ -33210,8 +33339,8 @@ import { Writable as Writable2 } from "node:stream";
 // packages/host-runtime/src/remote-app-server.ts
 import { createServer } from "node:http";
 import net from "node:net";
-import { chmod as chmod3, lstat as lstat6, mkdir as mkdir5, rm as rm5 } from "node:fs/promises";
-import path13 from "node:path";
+import { chmod as chmod3, lstat as lstat6, mkdir as mkdir6, rm as rm6 } from "node:fs/promises";
+import path14 from "node:path";
 import { PassThrough } from "node:stream";
 
 // node_modules/ws/wrapper.mjs
@@ -33226,10 +33355,10 @@ var import_websocket_server = __toESM(require_websocket_server(), 1);
 var wrapper_default = import_websocket.default;
 
 // packages/host-runtime/src/remote-socket-lock.ts
-import { randomUUID as randomUUID9 } from "node:crypto";
-import { chmod as chmod2, lstat as lstat5, mkdir as mkdir4, open as open5, readFile as readFile5, readdir as readdir4, rename as rename3, rm as rm4 } from "node:fs/promises";
+import { randomUUID as randomUUID10 } from "node:crypto";
+import { chmod as chmod2, lstat as lstat5, mkdir as mkdir5, open as open5, readFile as readFile6, readdir as readdir4, rename as rename4, rm as rm5 } from "node:fs/promises";
 import { uptime } from "node:os";
-import path12 from "node:path";
+import path13 from "node:path";
 import { setTimeout as delay4 } from "node:timers/promises";
 var LOCK_RETRY_COUNT = 200;
 var LOCK_RETRY_DELAY_MS = 25;
@@ -33292,7 +33421,7 @@ async function readLockEntrySnapshot(filePath) {
     throw error51;
   });
   if (metadata === null || !metadata.isFile()) return null;
-  const source = await readFile5(filePath, "utf8").catch((error51) => {
+  const source = await readFile6(filePath, "utf8").catch((error51) => {
     if (error51.code === "ENOENT") return null;
     throw error51;
   });
@@ -33303,7 +33432,7 @@ async function readLockEntrySnapshot(filePath) {
     source,
     identity: { dev: metadata.dev, ino: metadata.ino },
     mtimeMs: metadata.mtimeMs,
-    record: record3 && path12.basename(filePath) === lockEntryName(record3.ownerToken) ? record3 : null
+    record: record3 && path13.basename(filePath) === lockEntryName(record3.ownerToken) ? record3 : null
   };
 }
 function lockEntryIsAbandoned(snapshot) {
@@ -33315,7 +33444,7 @@ async function removeAbandonedLockEntry(snapshot) {
   if (current === null || current.source !== snapshot.source || !sameUnixFileIdentity(current.identity, snapshot.identity) || !lockEntryIsAbandoned(current)) {
     return false;
   }
-  await rm4(snapshot.filePath, { force: true });
+  await rm5(snapshot.filePath, { force: true });
   return true;
 }
 async function readLockEntryCatalog(lockDirectory) {
@@ -33324,7 +33453,7 @@ async function readLockEntryCatalog(lockDirectory) {
   let unsettled = false;
   for (const name of names) {
     if (!name.startsWith(LOCK_ENTRY_PREFIX) || !name.endsWith(LOCK_ENTRY_SUFFIX)) continue;
-    const snapshot = await readLockEntrySnapshot(path12.join(lockDirectory, name));
+    const snapshot = await readLockEntrySnapshot(path13.join(lockDirectory, name));
     if (snapshot === null) continue;
     if (lockEntryIsAbandoned(snapshot)) {
       if (!await removeAbandonedLockEntry(snapshot)) unsettled = true;
@@ -33339,7 +33468,7 @@ async function readLockEntryCatalog(lockDirectory) {
   return { entries, unsettled };
 }
 async function preparePrivateLockDirectory(lockDirectory) {
-  await mkdir4(lockDirectory, { mode: 448 }).catch((error51) => {
+  await mkdir5(lockDirectory, { mode: 448 }).catch((error51) => {
     if (error51.code !== "EEXIST") throw error51;
   });
   const metadata = await lstat5(lockDirectory);
@@ -33352,7 +33481,7 @@ async function preparePrivateLockDirectory(lockDirectory) {
   await chmod2(lockDirectory, 448);
 }
 async function writeLockRecordAtomic(lockDirectory, entryPath, record3) {
-  const temporary = path12.join(lockDirectory, `.tmp-${record3.ownerToken}-${randomUUID9()}`);
+  const temporary = path13.join(lockDirectory, `.tmp-${record3.ownerToken}-${randomUUID10()}`);
   const handle = await open5(temporary, "wx", 384);
   try {
     await handle.writeFile(`${JSON.stringify(record3)}
@@ -33362,15 +33491,15 @@ async function writeLockRecordAtomic(lockDirectory, entryPath, record3) {
     await handle.close();
   }
   try {
-    await rename3(temporary, entryPath);
+    await rename4(temporary, entryPath);
   } finally {
-    await rm4(temporary, { force: true });
+    await rm5(temporary, { force: true });
   }
 }
 async function removeOwnedLockEntry(entryPath, ownerToken) {
   const snapshot = await readLockEntrySnapshot(entryPath);
   if (snapshot?.record?.ownerToken !== ownerToken) return;
-  await rm4(entryPath, { force: true });
+  await rm5(entryPath, { force: true });
 }
 async function legacyLockState(legacyPath) {
   const metadata = await lstat5(legacyPath).catch((error51) => {
@@ -33379,7 +33508,7 @@ async function legacyLockState(legacyPath) {
   });
   if (metadata === null) return "absent";
   if (!metadata.isFile()) return "blocking";
-  const source = await readFile5(legacyPath, "utf8").catch((error51) => {
+  const source = await readFile6(legacyPath, "utf8").catch((error51) => {
     if (error51.code === "ENOENT") return null;
     throw error51;
   });
@@ -33416,7 +33545,7 @@ async function releaseLegacyCompatibilityGuard(legacyPath, guard) {
       throw error51;
     });
     if (metadata?.isFile() && sameUnixFileIdentity({ dev: metadata.dev, ino: metadata.ino }, guard.identity)) {
-      await rm4(legacyPath, { force: true });
+      await rm5(legacyPath, { force: true });
     }
   }
 }
@@ -33427,8 +33556,8 @@ async function withRemoteAppServerSocketInitializationLock(socketPath, action) {
   const legacyPath = `${socketPath}.initializing`;
   const lockDirectory = `${socketPath}.initializers`;
   await preparePrivateLockDirectory(lockDirectory);
-  const ownerToken = randomUUID9();
-  const entryPath = path12.join(lockDirectory, lockEntryName(ownerToken));
+  const ownerToken = randomUUID10();
+  const entryPath = path13.join(lockDirectory, lockEntryName(ownerToken));
   const baseRecord = {
     version: 2,
     ownerToken,
@@ -33602,14 +33731,14 @@ function remoteAppServerSocketPath(environment, listenUrl = "unix://") {
     throw new Error("Remote app-server listener must use a Unix URL");
   }
   const explicit = listenUrl.slice("unix://".length);
-  if (explicit.length > 0) return path13.posix.resolve(decodeURIComponent(explicit));
-  const codexHome = environment.CODEX_HOME ?? (environment.HOME ? path13.posix.join(environment.HOME, ".codex") : void 0);
+  if (explicit.length > 0) return path14.posix.resolve(decodeURIComponent(explicit));
+  const codexHome = environment.CODEX_HOME ?? (environment.HOME ? path14.posix.join(environment.HOME, ".codex") : void 0);
   if (!codexHome)
     throw new Error("CODEX_HOME or HOME is required for the remote app-server socket");
-  return path13.posix.join(codexHome, "app-server-control", "app-server-control.sock");
+  return path14.posix.join(codexHome, "app-server-control", "app-server-control.sock");
 }
 function officialListenerArgumentsForRemoteListener(arguments_2, socketPath) {
-  if (!path13.posix.isAbsolute(socketPath)) {
+  if (!path14.posix.isAbsolute(socketPath)) {
     throw new Error("Shared official app-server socket path must be absolute");
   }
   if (remoteUnixListenerUrl(arguments_2) === null) {
@@ -33717,10 +33846,10 @@ async function removeStaleSocket(socketPath) {
     });
   });
   if (active) throw new Error(`Remote app-server socket is already in use at ${socketPath}`);
-  await rm5(socketPath, { force: true });
+  await rm6(socketPath, { force: true });
 }
 async function prepareRemoteAppServerSocketDirectory(socketPath) {
-  const socketDirectory = path13.dirname(socketPath);
+  const socketDirectory = path14.dirname(socketPath);
   const existing = await lstat6(socketDirectory).catch((error51) => {
     if (error51.code === "ENOENT") return null;
     throw error51;
@@ -33734,7 +33863,7 @@ async function prepareRemoteAppServerSocketDirectory(socketPath) {
       );
     }
   }
-  await mkdir5(socketDirectory, { recursive: true, mode: 448 });
+  await mkdir6(socketDirectory, { recursive: true, mode: 448 });
   await chmod3(socketDirectory, 448);
 }
 function sendOutputFrames(socket, output) {
@@ -33907,7 +34036,7 @@ function createRemoteAppServerWebSocketListener(input) {
             if (ownedSocketIdentity) {
               const current = await unixSocketIdentity(input.socketPath);
               if (current && sameUnixFileIdentity2(current, ownedSocketIdentity)) {
-                await rm5(input.socketPath, { force: true });
+                await rm6(input.socketPath, { force: true });
               }
               ownedSocketIdentity = null;
             }
@@ -33925,20 +34054,20 @@ function createRemoteAppServerWebSocketListener(input) {
 
 // packages/host-runtime/src/remote-official-app-server.ts
 import { spawn as spawn3 } from "node:child_process";
-import { randomUUID as randomUUID10 } from "node:crypto";
-import { lstat as lstat7, rm as rm6 } from "node:fs/promises";
-import path14 from "node:path";
+import { randomUUID as randomUUID11 } from "node:crypto";
+import { lstat as lstat7, rm as rm7 } from "node:fs/promises";
+import path15 from "node:path";
 var DEFAULT_CLOSE_TIMEOUT_MS = 2e3;
 var DEFAULT_LISTEN_TIMEOUT_MS = 1e4;
-function remoteOfficialAppServerSocketPath(desktopControlSocketPath, token = randomUUID10()) {
-  if (!path14.posix.isAbsolute(desktopControlSocketPath)) {
+function remoteOfficialAppServerSocketPath(desktopControlSocketPath, token = randomUUID11()) {
+  if (!path15.posix.isAbsolute(desktopControlSocketPath)) {
     throw new Error("Desktop control socket path must be absolute");
   }
   if (!/^[A-Za-z0-9-]+$/u.test(token) || !/[A-Za-z0-9]/u.test(token)) {
     throw new Error("Shared official app-server socket token is invalid");
   }
   const compactToken = token.replaceAll("-", "").slice(0, 15);
-  return path14.posix.join(path14.posix.dirname(desktopControlSocketPath), `.c-${compactToken}.sock`);
+  return path15.posix.join(path15.posix.dirname(desktopControlSocketPath), `.c-${compactToken}.sock`);
 }
 function errorMessage4(error51) {
   return error51 instanceof Error ? error51.message : String(error51);
@@ -34010,7 +34139,7 @@ function createRemoteOfficialAppServerListener(input) {
     if (ownedSocketIdentity === null) return;
     const current = await socketIdentity(input.socketPath).catch(() => null);
     if (current && sameUnixFileIdentity3(current, ownedSocketIdentity)) {
-      await rm6(input.socketPath, { force: true });
+      await rm7(input.socketPath, { force: true });
     }
     ownedSocketIdentity = null;
   };
@@ -34424,21 +34553,21 @@ function createOwnedUnixBackend(input) {
 
 // packages/host-runtime/src/native-account-host.ts
 async function canonicalCodexHome(home) {
-  const absolute = path15.resolve(home);
+  const absolute = path16.resolve(home);
   try {
     return await realpath3(absolute);
   } catch (error51) {
     if (!(error51 instanceof Error && "code" in error51 && error51.code === "ENOENT")) throw error51;
-    const parent = path15.dirname(absolute);
+    const parent = path16.dirname(absolute);
     if (parent === absolute) throw error51;
-    return path15.join(await canonicalCodexHome(parent), path15.basename(absolute));
+    return path16.join(await canonicalCodexHome(parent), path16.basename(absolute));
   }
 }
 async function prepareLocalCodex(input) {
   const home = await canonicalCodexHome(
-    input.environment.CODEX_HOME ?? path15.join(homedir(), ".codex")
+    input.environment.CODEX_HOME ?? path16.join(homedir(), ".codex")
   );
-  await mkdir6(home, { recursive: true });
+  await mkdir7(home, { recursive: true });
   const scope = new OfficialRuntimeScope({
     permanentHome: home,
     diagnosticOutput: input.diagnosticOutput,
@@ -34602,18 +34731,18 @@ var DelegationControlRegistry = class {
 };
 
 // packages/host-runtime/src/installed-harness-plugins.ts
-import os3 from "node:os";
-import path17 from "node:path";
+import os4 from "node:os";
+import path18 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // packages/host-runtime/src/launcher-url-opener.ts
 import { spawn as spawn4 } from "node:child_process";
-import path16 from "node:path";
+import path17 from "node:path";
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
 var OPEN_TIMEOUT_MS = 1e4;
 function createLauncherUrlOpener(environment, spawnLauncher = (command, arguments_2, options2) => spawn4(command, arguments_2, options2)) {
   const launcher = environment.CODEXHOST_LAUNCHER_EXECUTABLE;
-  if (!launcher || !path16.isAbsolute(launcher)) return void 0;
+  if (!launcher || !path17.isAbsolute(launcher)) return void 0;
   const launcherEnvironment = Object.fromEntries(
     Object.entries(environment).filter(([name]) => {
       const normalized = name.toUpperCase();
@@ -34671,9 +34800,9 @@ function installedHarnessPluginOptions(environment, managedRemoteHost = false, h
   const opener = managedRemoteHost ? void 0 : createLauncherUrlOpener(environment);
   return {
     pluginRoots: [
-      path17.join(path17.dirname(fileURLToPath(hostRuntimeUrl)), "plugins"),
-      environment[HARNESS_PLUGIN_DIRECTORY_ENV] ?? path17.join(
-        environment.CODEXHOST_DATA_DIR ? path17.resolve(environment.CODEXHOST_DATA_DIR) : path17.join(os3.homedir(), ".codexhost"),
+      path18.join(path18.dirname(fileURLToPath(hostRuntimeUrl)), "plugins"),
+      environment[HARNESS_PLUGIN_DIRECTORY_ENV] ?? path18.join(
+        environment.CODEXHOST_DATA_DIR ? path18.resolve(environment.CODEXHOST_DATA_DIR) : path18.join(os4.homedir(), ".codexhost"),
         "plugins"
       )
     ],
@@ -34798,12 +34927,12 @@ async function startDelegationControlServer(input) {
 }
 
 // packages/host-runtime/src/delegation-skill.ts
-import { createHash as createHash8, randomUUID as randomUUID11 } from "node:crypto";
-import { mkdir as mkdir7, open as open6, readFile as readFile6, rename as rename4, rm as rm7, stat as stat3 } from "node:fs/promises";
-import os4 from "node:os";
-import path18 from "node:path";
+import { createHash as createHash8, randomUUID as randomUUID12 } from "node:crypto";
+import { mkdir as mkdir8, open as open6, readFile as readFile7, rename as rename5, rm as rm8, stat as stat4 } from "node:fs/promises";
+import os5 from "node:os";
+import path19 from "node:path";
 var SKILL_VERSION = 7;
-var SKILL_RELATIVE_PATH = path18.join("skills", "codexhost-delegation", "SKILL.md");
+var SKILL_RELATIVE_PATH = path19.join("skills", "codexhost-delegation", "SKILL.md");
 var PREVIOUS_MANAGED_DIGESTS = [
   "9d2f491850fb0b4084a31ba9b5e4a550b5e833747af322090d8ed0ff80b88c30",
   "2bb0aebb9b06febbc6c0c0bcdb0b32506c7cdbf8dc3b734cc6b2a86621270e4e",
@@ -34868,15 +34997,15 @@ function managedVersion(value2) {
 }
 async function readOptional(filePath) {
   try {
-    return await readFile6(filePath, "utf8");
+    return await readFile7(filePath, "utf8");
   } catch (error51) {
     if (error51.code === "ENOENT") return null;
     throw error51;
   }
 }
 async function atomicWrite(filePath, content) {
-  await mkdir7(path18.dirname(filePath), { recursive: true, mode: 448 });
-  const temporaryPath = path18.join(path18.dirname(filePath), `.SKILL.md.${randomUUID11()}.tmp`);
+  await mkdir8(path19.dirname(filePath), { recursive: true, mode: 448 });
+  const temporaryPath = path19.join(path19.dirname(filePath), `.SKILL.md.${randomUUID12()}.tmp`);
   const handle = await open6(temporaryPath, "wx", 384);
   try {
     await handle.writeFile(content, "utf8");
@@ -34885,16 +35014,16 @@ async function atomicWrite(filePath, content) {
     await handle.close();
   }
   try {
-    await rename4(temporaryPath, filePath);
+    await rename5(temporaryPath, filePath);
   } finally {
-    await rm7(temporaryPath, { force: true });
+    await rm8(temporaryPath, { force: true });
   }
 }
 async function installDelegationSkills(input = {}) {
-  const home = input.homeDirectory ?? os4.homedir();
+  const home = input.homeDirectory ?? os5.homedir();
   const destinations = [
-    path18.join(home, ".agents", SKILL_RELATIVE_PATH),
-    path18.join(home, ".claude", SKILL_RELATIVE_PATH)
+    path19.join(home, ".agents", SKILL_RELATIVE_PATH),
+    path19.join(home, ".claude", SKILL_RELATIVE_PATH)
   ];
   const knownDigests = /* @__PURE__ */ new Set([
     CURRENT_DIGEST,
@@ -34939,8 +35068,8 @@ async function installDelegationSkills(input = {}) {
   }
   for (const result of results) {
     if (result.status === "conflict") continue;
-    const source = await readFile6(result.path, "utf8");
-    const metadata = await stat3(result.path);
+    const source = await readFile7(result.path, "utf8");
+    const metadata = await stat4(result.path);
     if (!metadata.isFile() || source !== CODEXHOST_DELEGATION_SKILL) {
       throw new Error(`Delegation Skill verification failed: ${result.path}`);
     }
@@ -34950,7 +35079,7 @@ async function installDelegationSkills(input = {}) {
     throw new Error("Delegation Skill copies are inconsistent");
   }
   if (results.every((result) => result.status !== "conflict")) {
-    const copies = await Promise.all(results.map((result) => readFile6(result.path, "utf8")));
+    const copies = await Promise.all(results.map((result) => readFile7(result.path, "utf8")));
     if (copies.some((copy) => copy !== copies[0])) {
       throw new Error("Delegation Skill copies are inconsistent");
     }
@@ -34959,9 +35088,9 @@ async function installDelegationSkills(input = {}) {
 }
 
 // packages/host-runtime/src/remote-control-app-server.ts
-import { randomUUID as randomUUID12 } from "node:crypto";
-import { mkdir as mkdir8, open as open7, rename as rename5, rm as rm8 } from "node:fs/promises";
-import path19 from "node:path";
+import { randomUUID as randomUUID13 } from "node:crypto";
+import { mkdir as mkdir9, open as open7, rename as rename6, rm as rm9 } from "node:fs/promises";
+import path20 from "node:path";
 var REMOTE_CONTROL_BRIDGE_PIPE_ENV = "CODEXHOST_REMOTE_CONTROL_BRIDGE_PIPE";
 var REMOTE_CONTROL_BRIDGE_NODE_ENV = "CODEXHOST_REMOTE_CONTROL_BRIDGE_NODE_PATH";
 var REMOTE_CONTROL_BRIDGE_RUNTIME_ENV = "CODEXHOST_REMOTE_CONTROL_BRIDGE_RUNTIME_PATH";
@@ -34972,30 +35101,30 @@ var BRIDGE_READY_METHOD = "codexhost/remote-control-bridge/ready";
 function absoluteEnvironmentPath2(environment, name, fallback, platform = process.platform) {
   const value2 = environment[name] ?? fallback;
   if (!value2) return null;
-  if (path19.isAbsolute(value2)) return path19.normalize(value2);
-  return platform === "win32" && path19.win32.isAbsolute(value2) ? path19.win32.normalize(value2) : null;
+  if (path20.isAbsolute(value2)) return path20.normalize(value2);
+  return platform === "win32" && path20.win32.isAbsolute(value2) ? path20.win32.normalize(value2) : null;
 }
 function nodeCompatibleWindowsPath(value2) {
   if (value2.startsWith("\\\\?\\UNC\\")) return `\\\\${value2.slice(8)}`;
   if (value2.startsWith("\\\\?\\")) return value2.slice(4);
   return value2;
 }
-function remoteControlBridgePipePath(processId = process.pid, instanceId = randomUUID12()) {
+function remoteControlBridgePipePath(processId = process.pid, instanceId = randomUUID13()) {
   const safeInstance = instanceId.replaceAll(/[^a-zA-Z0-9-]/gu, "");
   if (!safeInstance) throw new Error("Remote Control bridge instance ID is invalid");
   return `\\\\.\\pipe\\codexhost-remote-control-${processId}-${safeInstance}`;
 }
 function remoteControlBridgeDescriptorPath(environment) {
   const root = environment.LOCALAPPDATA;
-  if (!root || !path19.isAbsolute(root)) return null;
-  return path19.join(path19.normalize(root), "codexhost", REMOTE_CONTROL_BRIDGE_DESCRIPTOR_FILE);
+  if (!root || !path20.isAbsolute(root)) return null;
+  return path20.join(path20.normalize(root), "codexhost", REMOTE_CONTROL_BRIDGE_DESCRIPTOR_FILE);
 }
 async function publishRemoteControlAppServerDescriptor(plan) {
-  const directory = path19.dirname(plan.descriptorPath);
-  await mkdir8(directory, { recursive: true, mode: 448 });
-  const temporaryPath = path19.join(
+  const directory = path20.dirname(plan.descriptorPath);
+  await mkdir9(directory, { recursive: true, mode: 448 });
+  const temporaryPath = path20.join(
     directory,
-    `.${REMOTE_CONTROL_BRIDGE_DESCRIPTOR_FILE}.${plan.descriptor.ownerPid}.${randomUUID12()}.tmp`
+    `.${REMOTE_CONTROL_BRIDGE_DESCRIPTOR_FILE}.${plan.descriptor.ownerPid}.${randomUUID13()}.tmp`
   );
   const handle = await open7(temporaryPath, "wx", 384);
   try {
@@ -35006,9 +35135,9 @@ async function publishRemoteControlAppServerDescriptor(plan) {
     await handle.close();
   }
   try {
-    await rename5(temporaryPath, plan.descriptorPath);
+    await rename6(temporaryPath, plan.descriptorPath);
   } finally {
-    await rm8(temporaryPath, { force: true });
+    await rm9(temporaryPath, { force: true });
   }
 }
 function createRemoteControlAppServerPlan(input) {
@@ -35294,9 +35423,9 @@ function hasLauncherManagedUpdateRuntime(environment, hostRuntimePath) {
   if (!environment[UPDATE_RUNTIME_ENV.launcherPid]) return false;
   const npmPackageRoot = environment[UPDATE_RUNTIME_ENV.npmPackageRoot];
   if (!npmPackageRoot || !hostRuntimePath) return true;
-  if (!path20.isAbsolute(npmPackageRoot) || !path20.isAbsolute(hostRuntimePath)) return false;
-  const runtimePackageRoot = path20.dirname(path20.dirname(path20.normalize(hostRuntimePath)));
-  return path20.relative(path20.normalize(npmPackageRoot), runtimePackageRoot) === "";
+  if (!path21.isAbsolute(npmPackageRoot) || !path21.isAbsolute(hostRuntimePath)) return false;
+  const runtimePackageRoot = path21.dirname(path21.dirname(path21.normalize(hostRuntimePath)));
+  return path21.relative(path21.normalize(npmPackageRoot), runtimePackageRoot) === "";
 }
 function requiredRuntimeConfiguration(environment) {
   const stockCodexPath = environment[STOCK_CODEX_PATH_ENV];
@@ -35442,8 +35571,8 @@ async function runHostRuntime(input) {
       const socketPath = remoteAppServerSocketPath(delegationEnvironment, listenUrl);
       const officialPlan = createRemoteOfficialAppServerPlan(input.arguments, socketPath);
       const officialRuntimeScope = new OfficialRuntimeScope({
-        permanentHome: path20.resolve(
-          delegationEnvironment.CODEX_HOME ?? path20.join(homedir2(), ".codex")
+        permanentHome: path21.resolve(
+          delegationEnvironment.CODEX_HOME ?? path21.join(homedir2(), ".codex")
         ),
         diagnosticOutput: process.stderr,
         createBackend: () => createOwnedUnixBackend({
@@ -35524,22 +35653,22 @@ async function runHostRuntime(input) {
 }
 
 // packages/host-runtime/src/remote-host-install.ts
-import { createHash as createHash9, randomUUID as randomUUID13 } from "node:crypto";
+import { createHash as createHash9, randomUUID as randomUUID14 } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import {
   access,
   chmod as chmod4,
   copyFile as copyFile3,
   lstat as lstat8,
-  mkdir as mkdir9,
-  readFile as readFile7,
-  rename as rename6,
-  rm as rm9,
+  mkdir as mkdir10,
+  readFile as readFile8,
+  rename as rename7,
+  rm as rm10,
   rmdir,
-  stat as stat4,
-  writeFile as writeFile3
+  stat as stat5,
+  writeFile as writeFile4
 } from "node:fs/promises";
-import path21 from "node:path";
+import path22 from "node:path";
 var MANIFEST_FORMAT = 1;
 var WRAPPER_MARKER = "# codexhost remote SSH wrapper v1";
 var PROFILE_START = "# >>> codexhost remote SSH >>>";
@@ -35550,25 +35679,25 @@ function resolvePaths(options2) {
   if (!configuredHome) {
     throw new Error("A non-root HOME is required for remote Host installation");
   }
-  const home = path21.resolve(configuredHome);
-  if (!home || home === path21.parse(home).root) {
+  const home = path22.resolve(configuredHome);
+  if (!home || home === path22.parse(home).root) {
     throw new Error("A non-root HOME is required for remote Host installation");
   }
-  const installRoot = path21.resolve(options2.installRoot ?? path21.join(home, ".codexhost", "remote"));
-  const profilePath = path21.resolve(
-    options2.profilePath ?? path21.join(
+  const installRoot = path22.resolve(options2.installRoot ?? path22.join(home, ".codexhost", "remote"));
+  const profilePath = path22.resolve(
+    options2.profilePath ?? path22.join(
       home,
-      path21.basename(environment.SHELL ?? "") === "zsh" ? ".zshenv" : path21.basename(environment.SHELL ?? "") === "bash" ? ".bashrc" : ".profile"
+      path22.basename(environment.SHELL ?? "") === "zsh" ? ".zshenv" : path22.basename(environment.SHELL ?? "") === "bash" ? ".bashrc" : ".profile"
     )
   );
-  const binDirectory = path21.join(installRoot, "bin");
+  const binDirectory = path22.join(installRoot, "bin");
   return {
     home,
     installRoot,
     binDirectory,
-    wrapperPath: path21.join(binDirectory, "codex"),
-    manifestPath: path21.join(installRoot, "manifest.json"),
-    dataDirectory: path21.join(installRoot, "data"),
+    wrapperPath: path22.join(binDirectory, "codex"),
+    manifestPath: path22.join(installRoot, "manifest.json"),
+    dataDirectory: path22.join(installRoot, "data"),
     profilePath
   };
 }
@@ -35577,19 +35706,19 @@ function shellQuote(value2) {
 }
 async function existingText(filePath) {
   try {
-    return await readFile7(filePath, "utf8");
+    return await readFile8(filePath, "utf8");
   } catch (error51) {
     if (error51.code === "ENOENT") return null;
     throw error51;
   }
 }
 async function fileSha256(filePath) {
-  return createHash9("sha256").update(await readFile7(filePath)).digest("hex");
+  return createHash9("sha256").update(await readFile8(filePath)).digest("hex");
 }
 async function executable(filePath, label) {
-  const absolute = path21.resolve(filePath);
+  const absolute = path22.resolve(filePath);
   try {
-    if (!(await stat4(absolute)).isFile()) throw new Error("not a regular file");
+    if (!(await stat5(absolute)).isFile()) throw new Error("not a regular file");
     await access(absolute, fsConstants.X_OK);
   } catch {
     throw new Error(`${label} is not an executable file: ${absolute}`);
@@ -35597,9 +35726,9 @@ async function executable(filePath, label) {
   return absolute;
 }
 async function existingFile(filePath, label) {
-  const absolute = path21.resolve(filePath);
+  const absolute = path22.resolve(filePath);
   try {
-    const metadata = await stat4(absolute);
+    const metadata = await stat5(absolute);
     if (!metadata.isFile()) throw new Error("not a regular file");
   } catch {
     throw new Error(`${label} is not a regular file: ${absolute}`);
@@ -35607,9 +35736,9 @@ async function existingFile(filePath, label) {
   return absolute;
 }
 async function discoverExecutable(name, environment) {
-  for (const directory of (environment.PATH ?? "").split(path21.delimiter)) {
+  for (const directory of (environment.PATH ?? "").split(path22.delimiter)) {
     if (!directory) continue;
-    const candidate = path21.resolve(directory, name);
+    const candidate = path22.resolve(directory, name);
     try {
       await access(candidate, fsConstants.X_OK);
       return candidate;
@@ -35620,47 +35749,47 @@ async function discoverExecutable(name, environment) {
   return null;
 }
 async function writeAtomic(filePath, contents, mode) {
-  await mkdir9(path21.dirname(filePath), { recursive: true, mode: 448 });
-  const temporary = path21.join(
-    path21.dirname(filePath),
-    `.${path21.basename(filePath)}.${process.pid}.${randomUUID13()}.tmp`
+  await mkdir10(path22.dirname(filePath), { recursive: true, mode: 448 });
+  const temporary = path22.join(
+    path22.dirname(filePath),
+    `.${path22.basename(filePath)}.${process.pid}.${randomUUID14()}.tmp`
   );
   try {
     if (typeof contents === "string") {
-      await writeFile3(temporary, contents, { encoding: "utf8", flag: "wx", mode });
+      await writeFile4(temporary, contents, { encoding: "utf8", flag: "wx", mode });
     } else {
-      await writeFile3(temporary, contents, { flag: "wx", mode });
+      await writeFile4(temporary, contents, { flag: "wx", mode });
     }
     await chmod4(temporary, mode);
     try {
-      await rename6(temporary, filePath);
+      await rename7(temporary, filePath);
     } catch (error51) {
       if (process.platform !== "win32") throw error51;
-      await rm9(filePath, { force: true });
-      await rename6(temporary, filePath);
+      await rm10(filePath, { force: true });
+      await rename7(temporary, filePath);
     }
   } finally {
-    await rm9(temporary, { force: true });
+    await rm10(temporary, { force: true });
   }
 }
 async function writeAtomicExecutable(filePath, sourcePath) {
-  await mkdir9(path21.dirname(filePath), { recursive: true, mode: 448 });
-  const temporary = path21.join(
-    path21.dirname(filePath),
-    `.${path21.basename(filePath)}.${process.pid}.${randomUUID13()}.tmp`
+  await mkdir10(path22.dirname(filePath), { recursive: true, mode: 448 });
+  const temporary = path22.join(
+    path22.dirname(filePath),
+    `.${path22.basename(filePath)}.${process.pid}.${randomUUID14()}.tmp`
   );
   try {
     await copyFile3(sourcePath, temporary);
     await chmod4(temporary, 448);
     try {
-      await rename6(temporary, filePath);
+      await rename7(temporary, filePath);
     } catch (error51) {
       if (process.platform !== "win32") throw error51;
-      await rm9(filePath, { force: true });
-      await rename6(temporary, filePath);
+      await rm10(filePath, { force: true });
+      await rename7(temporary, filePath);
     }
   } finally {
-    await rm9(temporary, { force: true });
+    await rm10(temporary, { force: true });
   }
 }
 function managedBlockRange(contents) {
@@ -35688,8 +35817,8 @@ function removeManagedProfileBlock(contents) {
 function installManagedProfileBlock(contents, manifest) {
   const base = removeManagedProfileBlock(contents);
   const environment = [
-    `export CODEX_INSTALL_DIR=${shellQuote(path21.dirname(manifest.wrapperPath))}`,
-    `export PATH=${shellQuote(path21.dirname(manifest.wrapperPath))}:${shellQuote(path21.dirname(manifest.nodePath))}:${shellQuote(path21.dirname(manifest.stockCodexPath))}:"\${PATH:-/usr/local/bin:/usr/bin:/bin}"`,
+    `export CODEX_INSTALL_DIR=${shellQuote(path22.dirname(manifest.wrapperPath))}`,
+    `export PATH=${shellQuote(path22.dirname(manifest.wrapperPath))}:${shellQuote(path22.dirname(manifest.nodePath))}:${shellQuote(path22.dirname(manifest.stockCodexPath))}:"\${PATH:-/usr/local/bin:/usr/bin:/bin}"`,
     `export CODEXHOST_STOCK_CODEX_PATH=${shellQuote(manifest.stockCodexPath)}`,
     `export CODEXHOST_HOST_NODE_PATH=${shellQuote(manifest.nodePath)}`,
     `export CODEXHOST_HOST_RUNTIME_PATH=${shellQuote(manifest.hostRuntimePath)}`,
@@ -35706,7 +35835,7 @@ function installManagedProfileBlock(contents, manifest) {
     PROFILE_END,
     ""
   ].join("\n");
-  if (path21.basename(manifest.profilePath) === ".bashrc") return `${block}${base}`;
+  if (path22.basename(manifest.profilePath) === ".bashrc") return `${block}${base}`;
   const separator = base.length > 0 && !base.endsWith("\n") ? "\n" : "";
   return `${base}${separator}${block}`;
 }
@@ -35718,7 +35847,7 @@ async function managedEntrypointState(manifest) {
   if (metadata === null) return "missing";
   if (!metadata.isFile()) return "modified";
   if (process.platform !== "win32" && (metadata.mode & 73) === 0) return "modified";
-  const entrypoint = await readFile7(manifest.wrapperPath);
+  const entrypoint = await readFile8(manifest.wrapperPath);
   if (entrypoint.subarray(0, 256).toString("utf8").startsWith(`#!/usr/bin/env sh
 ${WRAPPER_MARKER}
 `)) {
@@ -35727,7 +35856,7 @@ ${WRAPPER_MARKER}
   if (manifest.entrypointSha256 !== void 0) {
     return createHash9("sha256").update(entrypoint).digest("hex") === manifest.entrypointSha256 ? "native" : "modified";
   }
-  const shim = await readFile7(manifest.shimPath).catch((error51) => {
+  const shim = await readFile8(manifest.shimPath).catch((error51) => {
     if (error51.code === "ENOENT") return null;
     throw error51;
   });
@@ -35771,9 +35900,9 @@ async function readManifest(filePath) {
   ];
   const optionalPaths = ["claudeCommand", "profileBackupPath"];
   if (manifest.format !== MANIFEST_FORMAT || Object.keys(manifest).some((key) => !allowed.has(key)) || requiredPaths.some(
-    (key) => typeof manifest[key] !== "string" || !path21.isAbsolute(manifest[key])
+    (key) => typeof manifest[key] !== "string" || !path22.isAbsolute(manifest[key])
   ) || optionalPaths.some(
-    (key) => manifest[key] !== void 0 && (typeof manifest[key] !== "string" || !path21.isAbsolute(manifest[key]))
+    (key) => manifest[key] !== void 0 && (typeof manifest[key] !== "string" || !path22.isAbsolute(manifest[key]))
   ) || manifest.entrypointSha256 !== void 0 && (typeof manifest.entrypointSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(manifest.entrypointSha256))) {
     throw new Error("Remote Host manifest has an unsupported format");
   }
@@ -35782,7 +35911,7 @@ async function readManifest(filePath) {
 async function backupProfile(profilePath, contents, action) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replaceAll(/[-:.TZ]/gu, "");
   const backupPath = `${profilePath}.codexhost-${action}-${timestamp}.bak`;
-  const metadata = await stat4(profilePath).catch(() => null);
+  const metadata = await stat5(profilePath).catch(() => null);
   await writeAtomic(backupPath, contents, metadata?.mode ?? 384);
   return backupPath;
 }
@@ -35795,8 +35924,8 @@ async function installRemoteHost(options2) {
   const paths = resolvePaths(options2);
   const previousManifest = await readManifest(paths.manifestPath);
   const previousManifestFile = previousManifest ? {
-    contents: await readFile7(paths.manifestPath),
-    mode: (await stat4(paths.manifestPath)).mode & 511
+    contents: await readFile8(paths.manifestPath),
+    mode: (await stat5(paths.manifestPath)).mode & 511
   } : null;
   const existingEntrypoint = await lstat8(paths.wrapperPath).catch(
     (error51) => {
@@ -35820,7 +35949,7 @@ async function installRemoteHost(options2) {
   }
   const profilePath = previousManifest?.profilePath ?? paths.profilePath;
   const previousEntrypoint = existingEntrypoint?.isFile() ? {
-    contents: await readFile7(paths.wrapperPath),
+    contents: await readFile8(paths.wrapperPath),
     mode: existingEntrypoint.mode & 511
   } : null;
   const discoveredStock = options2.stockCodexPath ?? previousManifest?.stockCodexPath ?? await discoverExecutable("codex", environment);
@@ -35855,14 +35984,14 @@ async function installRemoteHost(options2) {
   const existingProfile = existingProfileSource ?? "";
   const nextProfile = installManagedProfileBlock(existingProfile, manifest);
   const profileChanged = nextProfile !== existingProfile;
-  const profileMetadata = await stat4(profilePath).catch(() => null);
+  const profileMetadata = await stat5(profilePath).catch(() => null);
   try {
     if (profileChanged) {
       const profileBackupPath = await backupProfile(profilePath, existingProfile, "install");
       manifest = { ...manifest, profileBackupPath };
       await writeAtomic(profilePath, nextProfile, profileMetadata?.mode ?? 384);
     }
-    await mkdir9(paths.dataDirectory, { recursive: true, mode: 448 });
+    await mkdir10(paths.dataDirectory, { recursive: true, mode: 448 });
     await chmod4(paths.dataDirectory, 448);
     await writeAtomicExecutable(paths.wrapperPath, manifest.shimPath);
     manifest = { ...manifest, entrypointSha256: await fileSha256(paths.wrapperPath) };
@@ -35875,7 +36004,7 @@ async function installRemoteHost(options2) {
       if (previousEntrypoint) {
         await writeAtomic(paths.wrapperPath, previousEntrypoint.contents, previousEntrypoint.mode);
       } else {
-        await rm9(paths.wrapperPath, { force: true });
+        await rm10(paths.wrapperPath, { force: true });
       }
     } catch (rollbackError) {
       rollbackErrors.push(rollbackError);
@@ -35883,7 +36012,7 @@ async function installRemoteHost(options2) {
     if (profileChanged) {
       try {
         if (existingProfileSource === null) {
-          await rm9(profilePath, { force: true });
+          await rm10(profilePath, { force: true });
         } else {
           await writeAtomic(profilePath, existingProfile, profileMetadata?.mode ?? 384);
         }
@@ -35899,7 +36028,7 @@ async function installRemoteHost(options2) {
           previousManifestFile.mode
         );
       } else {
-        await rm9(paths.manifestPath, { force: true });
+        await rm10(paths.manifestPath, { force: true });
       }
     } catch (rollbackError) {
       rollbackErrors.push(rollbackError);
@@ -35946,7 +36075,7 @@ async function inspectRemoteHostInstallation(options2) {
   if (!profileMatches && profileIssue === null)
     profileIssue = "shell profile does not configure the managed native entrypoint";
   if (profileIssue !== null) issues.push(profileIssue);
-  const dataDirectory = await stat4(manifest.dataDirectory).catch(() => null);
+  const dataDirectory = await stat5(manifest.dataDirectory).catch(() => null);
   if (!dataDirectory?.isDirectory()) issues.push("remote Host data directory is unavailable");
   for (const [label, filePath, requiresExecutable] of [
     ["stock Codex", manifest.stockCodexPath, true],
@@ -35956,7 +36085,7 @@ async function inspectRemoteHostInstallation(options2) {
   ]) {
     try {
       if (requiresExecutable) await executable(filePath, label);
-      else if (!(await stat4(filePath)).isFile()) throw new Error("not a regular file");
+      else if (!(await stat5(filePath)).isFile()) throw new Error("not a regular file");
     } catch {
       issues.push(`${label} is unavailable`);
     }
@@ -35985,11 +36114,11 @@ async function uninstallRemoteHost(options2) {
   const nextProfile = removeManagedProfileBlock(profile);
   if (nextProfile !== profile) {
     await backupProfile(manifest.profilePath, profile, "uninstall");
-    const metadata = await stat4(manifest.profilePath).catch(() => null);
+    const metadata = await stat5(manifest.profilePath).catch(() => null);
     await writeAtomic(manifest.profilePath, nextProfile, metadata?.mode ?? 384);
   }
-  await rm9(manifest.wrapperPath, { force: true });
-  await rm9(paths.manifestPath, { force: true });
+  await rm10(manifest.wrapperPath, { force: true });
+  await rm10(paths.manifestPath, { force: true });
   await rmdir(paths.binDirectory).catch((error51) => {
     if (error51.code !== "ENOENT" && error51.code !== "ENOTEMPTY") throw error51;
   });
@@ -36000,9 +36129,9 @@ async function uninstallRemoteHost(options2) {
 
 // packages/host-runtime/src/remote-host-lifecycle.ts
 import { spawn as spawn5 } from "node:child_process";
-import { stat as stat5 } from "node:fs/promises";
+import { stat as stat6 } from "node:fs/promises";
 import net3 from "node:net";
-import path22 from "node:path";
+import path23 from "node:path";
 import { Duplex } from "node:stream";
 var CODEXHOST_STATUS_METHOD = "codexhost/update/status";
 var DIRECT_PROBE_TIMEOUT_MS = 5e3;
@@ -36021,12 +36150,12 @@ function classifyRemoteHostProbeResponse(response, socketPath) {
 }
 var lifecycleDependencyOverrides = {};
 function socketPathFor(environment) {
-  const codexHome = environment.CODEX_HOME ?? (environment.HOME ? path22.join(environment.HOME, ".codex") : void 0);
+  const codexHome = environment.CODEX_HOME ?? (environment.HOME ? path23.join(environment.HOME, ".codex") : void 0);
   if (!codexHome) throw new Error("CODEX_HOME or HOME is required for remote Host lifecycle");
-  return path22.join(codexHome, "app-server-control", "app-server-control.sock");
+  return path23.join(codexHome, "app-server-control", "app-server-control.sock");
 }
 async function defaultSocketExists(socketPath) {
-  const metadata = await stat5(socketPath).catch((error51) => {
+  const metadata = await stat6(socketPath).catch((error51) => {
     if (error51.code === "ENOENT") return null;
     throw error51;
   });
@@ -36150,7 +36279,7 @@ function installedManifest(status) {
 function managedEnvironment(manifest, environment) {
   return {
     ...environment,
-    CODEX_INSTALL_DIR: path22.dirname(manifest.wrapperPath),
+    CODEX_INSTALL_DIR: path23.dirname(manifest.wrapperPath),
     CODEXHOST_STOCK_CODEX_PATH: manifest.stockCodexPath,
     CODEXHOST_HOST_NODE_PATH: manifest.nodePath,
     CODEXHOST_HOST_RUNTIME_PATH: manifest.hostRuntimePath,
@@ -36158,7 +36287,7 @@ function managedEnvironment(manifest, environment) {
     CODEXHOST_DEFAULT_AGENT: "codex",
     CODEXHOST_REMOTE_SSH_MANAGED: "1",
     ...manifest.claudeCommand ? { CODEXHOST_CLAUDE_COMMAND: manifest.claudeCommand } : {},
-    PATH: `${path22.dirname(manifest.wrapperPath)}${path22.delimiter}${path22.dirname(manifest.stockCodexPath)}${path22.delimiter}${environment.PATH ?? "/usr/bin:/bin"}`
+    PATH: `${path23.dirname(manifest.wrapperPath)}${path23.delimiter}${path23.dirname(manifest.stockCodexPath)}${path23.delimiter}${environment.PATH ?? "/usr/bin:/bin"}`
   };
 }
 async function defaultRunTerminator(manifest, socketPath, role, environment) {
@@ -36496,26 +36625,26 @@ function consumeBrokerFrames(socket, onFrame, onError) {
 }
 
 // packages/harness-broker/dist/paths.js
-import os5 from "node:os";
-import path23 from "node:path";
+import os6 from "node:os";
+import path24 from "node:path";
 var HARNESS_BROKER_DESCRIPTOR_ENV = "CODEXHOST_CLAUDE_BROKER_DESCRIPTOR";
 var HARNESS_BROKER_DESCRIPTOR_FILE = "claude-code-broker-v1.json";
 var HARNESS_BROKER_SOCKET_FILE = "claude-code-broker-v1.sock";
 function defaultHarnessBrokerDirectory(environment = process.env) {
-  const home = environment.HOME || os5.homedir();
-  return path23.join(home, ".codexhost", "harness-broker");
+  const home = environment.HOME || os6.homedir();
+  return path24.join(home, ".codexhost", "harness-broker");
 }
 function defaultHarnessBrokerDescriptorPath(environment = process.env, harnessId = "claude-code") {
   harnessPluginIdSchema.parse(harnessId);
   if (harnessId !== "claude-code")
-    return path23.join(defaultHarnessBrokerDirectory(environment), `${harnessId}-broker-v1.json`);
-  return environment[HARNESS_BROKER_DESCRIPTOR_ENV] ?? path23.join(defaultHarnessBrokerDirectory(environment), HARNESS_BROKER_DESCRIPTOR_FILE);
+    return path24.join(defaultHarnessBrokerDirectory(environment), `${harnessId}-broker-v1.json`);
+  return environment[HARNESS_BROKER_DESCRIPTOR_ENV] ?? path24.join(defaultHarnessBrokerDirectory(environment), HARNESS_BROKER_DESCRIPTOR_FILE);
 }
 function defaultHarnessBrokerSocketPath(environment = process.env, harnessId = "claude-code") {
   harnessPluginIdSchema.parse(harnessId);
   if (harnessId !== "claude-code")
-    return path23.join(defaultHarnessBrokerDirectory(environment), `${harnessId}-broker-v1.sock`);
-  return path23.join(defaultHarnessBrokerDirectory(environment), HARNESS_BROKER_SOCKET_FILE);
+    return path24.join(defaultHarnessBrokerDirectory(environment), `${harnessId}-broker-v1.sock`);
+  return path24.join(defaultHarnessBrokerDirectory(environment), HARNESS_BROKER_SOCKET_FILE);
 }
 
 // packages/harness-broker/dist/validation.js
@@ -36728,10 +36857,10 @@ var harnessOutputSchema = external_exports.custom((value2) => {
 });
 
 // packages/harness-broker/dist/server.js
-import { randomBytes as randomBytes3, randomUUID as randomUUID14 } from "node:crypto";
-import { chmod as chmod5, lstat as lstat9, mkdir as mkdir10, open as open8, readFile as readFile8, rename as rename7, rm as rm10 } from "node:fs/promises";
+import { randomBytes as randomBytes3, randomUUID as randomUUID15 } from "node:crypto";
+import { chmod as chmod5, lstat as lstat9, mkdir as mkdir11, open as open8, readFile as readFile9, rename as rename8, rm as rm11 } from "node:fs/promises";
 import net4, {} from "node:net";
-import path24 from "node:path";
+import path25 from "node:path";
 function harnessError(message, retryable = true) {
   return { code: "unavailable", message, retryable, stage: "harnessBroker" };
 }
@@ -36742,7 +36871,7 @@ function nativeWriterKey(nativeSessionId) {
   return nativeSessionId;
 }
 async function privateDirectory(directory) {
-  await mkdir10(directory, { recursive: true, mode: 448 });
+  await mkdir11(directory, { recursive: true, mode: 448 });
   if (process.platform === "win32")
     return;
   const metadata = await lstat9(directory);
@@ -36777,7 +36906,7 @@ async function assertNoLiveDescriptor(descriptorPath) {
         throw new Error("Harness broker descriptor is not owner-only");
       }
     }
-    const descriptor = harnessBrokerDescriptorSchema.parse(JSON.parse(await readFile8(descriptorPath, "utf8")));
+    const descriptor = harnessBrokerDescriptorSchema.parse(JSON.parse(await readFile9(descriptorPath, "utf8")));
     if (processIsAlive2(descriptor.ownerPid)) {
       throw new Error("Harness broker descriptor already has a live owner");
     }
@@ -36787,7 +36916,7 @@ async function assertNoLiveDescriptor(descriptorPath) {
   }
 }
 async function publishDescriptor(descriptorPath, descriptor) {
-  const temporary = `${descriptorPath}.${process.pid}.${randomUUID14()}.tmp`;
+  const temporary = `${descriptorPath}.${process.pid}.${randomUUID15()}.tmp`;
   const handle = await open8(temporary, "wx", 384);
   try {
     await handle.writeFile(`${JSON.stringify(descriptor)}
@@ -36796,7 +36925,7 @@ async function publishDescriptor(descriptorPath, descriptor) {
   } finally {
     await handle.close();
   }
-  await rename7(temporary, descriptorPath);
+  await rename8(temporary, descriptorPath);
   if (process.platform !== "win32")
     await chmod5(descriptorPath, 384);
 }
@@ -36846,7 +36975,7 @@ async function prepareUnixSocketPath(socketPath) {
     if (await socketAcceptsConnections(socketPath)) {
       throw new Error("Harness broker socket is already active");
     }
-    await rm10(socketPath);
+    await rm11(socketPath);
   } catch (error51) {
     if (error51.code !== "ENOENT")
       throw error51;
@@ -36854,17 +36983,17 @@ async function prepareUnixSocketPath(socketPath) {
 }
 async function startHarnessBrokerServer(input) {
   harnessPluginIdSchema.parse(input.adapter.harnessId);
-  if (process.platform !== "win32" && path24.dirname(input.descriptorPath) !== path24.dirname(input.socketPath)) {
+  if (process.platform !== "win32" && path25.dirname(input.descriptorPath) !== path25.dirname(input.socketPath)) {
     throw new Error("Harness broker descriptor and socket must share one private directory");
   }
   if (process.platform === "darwin" && Buffer.byteLength(input.socketPath) > 103) {
     throw new Error("Harness broker Unix socket path is too long for macOS");
   }
-  await privateDirectory(path24.dirname(input.descriptorPath));
+  await privateDirectory(path25.dirname(input.descriptorPath));
   await assertNoLiveDescriptor(input.descriptorPath);
   if (process.platform !== "win32")
     await prepareUnixSocketPath(input.socketPath);
-  const generation = input.generation ?? randomUUID14();
+  const generation = input.generation ?? randomUUID15();
   const token = input.token ?? randomBytes3(32).toString("hex");
   const descriptor = {
     schemaVersion: 1,
@@ -36882,7 +37011,7 @@ async function startHarnessBrokerServer(input) {
   let closed = false;
   const server = net4.createServer((socket) => {
     const state = {
-      id: randomUUID14(),
+      id: randomUUID15(),
       socket,
       authenticated: false,
       inputSequence: 0,
@@ -37097,7 +37226,7 @@ async function startHarnessBrokerServer(input) {
             }
           };
         }
-        const openReservation = randomUUID14();
+        const openReservation = randomUUID15();
         if (sourceKey)
           nativeWriters.set(sourceKey, openReservation);
         const provisionalReservation = openInput.kind === "create" ? openReservation : void 0;
@@ -37377,7 +37506,7 @@ async function startHarnessBrokerServer(input) {
           }
           state.authenticated = true;
           state.inputSequence = 1;
-          await send({ kind: "response", id: randomUUID14(), ok: true, value: { ready: true } });
+          await send({ kind: "response", id: randomUUID15(), ok: true, value: { ready: true } });
           return;
         }
         const parsed = harnessBrokerRequestSchema.safeParse(raw);
@@ -37425,7 +37554,7 @@ async function startHarnessBrokerServer(input) {
   } catch (error51) {
     await new Promise((resolve) => server.close(() => resolve()));
     if (process.platform !== "win32")
-      await rm10(input.socketPath, { force: true });
+      await rm11(input.socketPath, { force: true });
     throw error51;
   }
   return {
@@ -37443,8 +37572,8 @@ async function startHarnessBrokerServer(input) {
       await input.adapter.close().catch(() => void 0);
       await new Promise((resolve) => server.close(() => resolve()));
       if (process.platform !== "win32")
-        await rm10(input.socketPath, { force: true });
-      await rm10(input.descriptorPath, { force: true });
+        await rm11(input.socketPath, { force: true });
+      await rm11(input.descriptorPath, { force: true });
     }
   };
 }