@codions/portta 0.0.0-develop.159.sha-0da77d5 → 0.0.0-develop.166.sha-d31f10f

package/dist/host.js

@@ -33142,7 +33142,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve21.call(this, root, ref);
+      let _sch = resolve22.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -33169,7 +33169,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve21(root, ref) {
+    function resolve22(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -33994,7 +33994,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve21(baseURI, relativeURI, options) {
+    function resolve22(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const {
         parsed: baseParsed,
@@ -34027,49 +34027,49 @@ var require_fast_uri = __commonJS({
       schemelessOptions.skipEscape = true;
       return serialize2(resolved2, schemelessOptions);
     }
-    function resolveComponent(base, relative5, options, skipNormalization) {
+    function resolveComponent(base, relative6, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse4(serialize2(base, options), options);
-        relative5 = parse4(serialize2(relative5, options), options);
+        relative6 = parse4(serialize2(relative6, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative5.scheme) {
-        target.scheme = relative5.scheme;
-        target.userinfo = relative5.userinfo;
-        target.host = relative5.host;
-        target.port = relative5.port;
-        target.path = removeDotSegments(relative5.path || "");
-        target.query = relative5.query;
+      if (!options.tolerant && relative6.scheme) {
+        target.scheme = relative6.scheme;
+        target.userinfo = relative6.userinfo;
+        target.host = relative6.host;
+        target.port = relative6.port;
+        target.path = removeDotSegments(relative6.path || "");
+        target.query = relative6.query;
       } else {
-        if (relative5.userinfo !== void 0 || relative5.host !== void 0 || relative5.port !== void 0) {
-          target.userinfo = relative5.userinfo;
-          target.host = relative5.host;
-          target.port = relative5.port;
-          target.path = removeDotSegments(relative5.path || "");
-          target.query = relative5.query;
+        if (relative6.userinfo !== void 0 || relative6.host !== void 0 || relative6.port !== void 0) {
+          target.userinfo = relative6.userinfo;
+          target.host = relative6.host;
+          target.port = relative6.port;
+          target.path = removeDotSegments(relative6.path || "");
+          target.query = relative6.query;
         } else {
-          if (!relative5.path) {
+          if (!relative6.path) {
             target.path = base.path;
-            if (relative5.query !== void 0) {
-              target.query = relative5.query;
+            if (relative6.query !== void 0) {
+              target.query = relative6.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative5.path[0] === "/") {
-              target.path = removeDotSegments(relative5.path);
+            if (relative6.path[0] === "/") {
+              target.path = removeDotSegments(relative6.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative5.path;
+                target.path = "/" + relative6.path;
               } else if (!base.path) {
-                target.path = relative5.path;
+                target.path = relative6.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative5.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative6.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative5.query;
+            target.query = relative6.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -34077,7 +34077,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative5.fragment;
+      target.fragment = relative6.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -34356,7 +34356,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize: normalize2,
-      resolve: resolve21,
+      resolve: resolve22,
       resolveComponent,
       equal,
       serialize: serialize2,
@@ -41506,10 +41506,9 @@ function expandTemplate(template, env2) {
 
 // ../host/src/modules/taskflow/adapters/devcontainer-environment.ts
 import { createHash as createHash3 } from "node:crypto";
-import { readFileSync as readFileSync3 } from "node:fs";
-import { access, readdir, readFile } from "node:fs/promises";
+import { access as access2, readdir, readFile as readFile2 } from "node:fs/promises";
 import { createRequire } from "node:module";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join4, posix, relative, resolve as resolve2, sep } from "node:path";
+import { dirname as dirname4, join as join5, relative as relative2, resolve as resolve3 } from "node:path";
 
 // ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -44775,16 +44774,16 @@ function hostToolInvocation(tool, options) {
   return /[\s'"\\]/.test(resolved2) ? `'${resolved2.replaceAll("'", "'\\''")}'` : resolved2;
 }
 function resolveWorkerBins(env2 = process.env) {
-  const resolve21 = (name, override) => {
+  const resolve22 = (name, override) => {
     const explicit = override?.trim();
     if (explicit) return resolveHostTool(explicit, { env: env2 }) ?? explicit;
     return resolveHostTool(name, { env: env2 }) ?? void 0;
   };
   return {
-    codexBin: resolve21("codex", env2.CODEX_BIN),
-    opencodeBin: resolve21("opencode", env2.OPENCODE_BIN),
-    pathToClaudeCodeExecutable: resolve21("claude"),
-    piBin: resolve21("pi", env2.PI_BIN)
+    codexBin: resolve22("codex", env2.CODEX_BIN),
+    opencodeBin: resolve22("opencode", env2.OPENCODE_BIN),
+    pathToClaudeCodeExecutable: resolve22("claude"),
+    piBin: resolve22("pi", env2.PI_BIN)
   };
 }
 
@@ -44822,10 +44821,10 @@ function webStream(stream) {
   };
 }
 function writeToStdin(stream, input2) {
-  return new Promise((resolve21, reject2) => {
+  return new Promise((resolve22, reject2) => {
     stream.write(input2, (error61) => {
       if (error61) reject2(error61);
-      else resolve21();
+      else resolve22();
     });
   });
 }
@@ -44847,8 +44846,8 @@ var NodeProcessRunner = class {
     let settled = false;
     let resolveExit = () => {
     };
-    const exited = new Promise((resolve21) => {
-      resolveExit = resolve21;
+    const exited = new Promise((resolve22) => {
+      resolveExit = resolve22;
     });
     const finish = (code, signal, closeOutputs = false) => {
       if (settled) return;
@@ -44926,6 +44925,177 @@ async function runCaptured(runner, spec) {
   return { stdout, stderr, exit };
 }
 
+// ../host/src/modules/taskflow/adapters/worktree-git-mount.ts
+import { access, readFile, realpath, rename, unlink, writeFile as writeFile2 } from "node:fs/promises";
+import { basename as basename2, isAbsolute as isAbsolute2, join as join4, posix, relative, resolve as resolve2, sep } from "node:path";
+var PREFLIGHT = "Dev Container preflight";
+var BACK_LINK = "gitdir";
+function repairCommand(workspacePath) {
+  return `git -C ${workspacePath} worktree repair --relative-paths`;
+}
+function toPosix(value) {
+  return sep === "/" ? value : value.replaceAll(sep, "/");
+}
+async function exists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readRaw(path) {
+  try {
+    return await readFile(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function writeAtomic(path, content) {
+  const temporary = `${path}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    await writeFile2(temporary, content, "utf8");
+    await rename(temporary, path);
+  } catch (error61) {
+    await unlink(temporary).catch(() => {
+    });
+    throw error61;
+  }
+}
+async function gitDirs(runner, cwd) {
+  const result = await runCaptured(runner, {
+    command: "git",
+    args: ["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"],
+    cwd
+  });
+  if (result.exit.code !== 0) return null;
+  const [gitDir, commonDir] = result.stdout.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+  return gitDir && commonDir ? { gitDir, commonDir } : null;
+}
+function linkTarget(content) {
+  const value = content.trim();
+  if (!value.startsWith("gitdir:")) return null;
+  const target = value.slice("gitdir:".length).trim();
+  return target.length > 0 ? target : null;
+}
+async function worktreeLink(workspacePath) {
+  const content = await readRaw(join4(workspacePath, ".git"));
+  return content === null ? null : linkTarget(content);
+}
+async function porttaOwned(runner, workspacePath, gitDir) {
+  if (await exists(gitRuntimePaths(gitDir).meta)) return true;
+  const result = await runCaptured(runner, {
+    command: "git",
+    args: ["config", "--get", RUNTIME_IDENTITY.gitBaseConfigKey],
+    cwd: workspacePath
+  });
+  return result.exit.code === 0 && result.stdout.trim().length > 0;
+}
+async function planRelativeRelink(workspacePath, dirs) {
+  const forwardPath = join4(workspacePath, ".git");
+  const backPath = join4(dirs.gitDir, BACK_LINK);
+  if (join4(dirs.commonDir, "worktrees", basename2(dirs.gitDir)) !== dirs.gitDir)
+    return {
+      ok: false,
+      reason: `its Git dir ${dirs.gitDir} is not <common dir>/worktrees/<id> under ${dirs.commonDir}`
+    };
+  const forward = await readRaw(forwardPath);
+  if (forward === null) return { ok: false, reason: `${forwardPath} could not be read` };
+  const target = linkTarget(forward);
+  if (target === null) return { ok: false, reason: `${forwardPath} does not record a gitdir link` };
+  if (resolve2(workspacePath, target) !== dirs.gitDir)
+    return { ok: false, reason: `${forwardPath} points at ${resolve2(workspacePath, target)}, not at ${dirs.gitDir}` };
+  const back = await readRaw(backPath);
+  if (back === null) return { ok: false, reason: `${backPath} could not be read` };
+  if (resolve2(dirs.gitDir, back.trim()) !== forwardPath)
+    return { ok: false, reason: `${backPath} points at ${resolve2(dirs.gitDir, back.trim())}, not at ${forwardPath}` };
+  return {
+    ok: true,
+    writes: [
+      { path: forwardPath, previous: forward, next: `gitdir: ${toPosix(relative(workspacePath, dirs.gitDir))}
+` },
+      { path: backPath, previous: back, next: `${toPosix(relative(dirs.gitDir, forwardPath))}
+` }
+    ]
+  };
+}
+async function relinkRelative(runner, workspacePath, dirs) {
+  const plan = await planRelativeRelink(workspacePath, dirs);
+  if (!plan.ok) return plan.reason;
+  const written = [];
+  const restore = async () => {
+    for (const write2 of written) await writeAtomic(write2.path, write2.previous).catch(() => {
+    });
+  };
+  for (const write2 of plan.writes) {
+    try {
+      await writeAtomic(write2.path, write2.next);
+      written.push(write2);
+    } catch (error61) {
+      await restore();
+      return `${write2.path} could not be rewritten: ${error61 instanceof Error ? error61.message : String(error61)}`;
+    }
+  }
+  const after = await gitDirs(runner, workspacePath);
+  if (!after || after.gitDir !== dirs.gitDir || after.commonDir !== dirs.commonDir) {
+    await restore();
+    return "the rewritten links did not resolve back to the same repository, so they were reverted";
+  }
+  return null;
+}
+async function worktreeGitMountArgs(input2) {
+  const { runner } = input2;
+  const workspacePath = await realpath(input2.workspacePath).catch(() => input2.workspacePath);
+  const dirs = await gitDirs(runner, workspacePath);
+  if (!dirs || dirs.gitDir === dirs.commonDir) return [];
+  const where = input2.configRef ? `${workspacePath} (${input2.configRef})` : workspacePath;
+  if (input2.workspaceMount) {
+    throw new Error(
+      `${PREFLIGHT}: ${where} is a linked Git worktree and the configuration sets a custom workspaceMount. The Dev Containers CLI then ignores --mount-git-worktree-common-dir (devcontainers/cli#1243), so the Git common dir cannot be mounted and Git would not work inside the container. Remove workspaceMount from the Dev Container configuration, or open this configuration from the main checkout.`
+    );
+  }
+  let link = await worktreeLink(workspacePath);
+  const backLink = await readRaw(join4(dirs.gitDir, BACK_LINK));
+  if (link !== null && isAbsolute2(link) || backLink !== null && isAbsolute2(backLink.trim())) {
+    if (!await porttaOwned(runner, workspacePath, dirs.gitDir)) {
+      throw new Error(
+        `${PREFLIGHT}: the Git worktree at ${where} is linked with an absolute gitdir, which does not exist inside a container. Portta did not create this worktree and will not rewrite its links. Migrate it explicitly with: ${repairCommand(workspacePath)}`
+      );
+    }
+    const failure = await relinkRelative(runner, workspacePath, dirs);
+    if (failure !== null) {
+      throw new Error(
+        `${PREFLIGHT}: the Git worktree at ${where} is linked with an absolute gitdir and could not be migrated to relative links: ${failure}. Run: ${repairCommand(workspacePath)}`
+      );
+    }
+    link = await worktreeLink(workspacePath);
+  }
+  if (link === null || isAbsolute2(link)) {
+    throw new Error(
+      `${PREFLIGHT}: the Git worktree at ${where} has no relative gitdir link, so the Git common dir cannot be mounted into the container. Run: ${repairCommand(workspacePath)}`
+    );
+  }
+  const containerWorkspacePath = input2.containerWorkspacePath;
+  if (!containerWorkspacePath) {
+    throw new Error(
+      `${PREFLIGHT}: the container workspace folder for ${where} is unknown, so the Git common dir of this linked worktree cannot be mounted into the container.`
+    );
+  }
+  const up = toPosix(relative(dirs.gitDir, dirs.commonDir));
+  if (up.length === 0 || up.split("/").some((segment) => segment !== "..")) {
+    throw new Error(
+      `${PREFLIGHT}: the Git common dir ${dirs.commonDir} does not contain the worktree Git dir ${dirs.gitDir}, so it cannot be mapped into the container for ${where}.`
+    );
+  }
+  const containerGitDir = posix.resolve(containerWorkspacePath, toPosix(link));
+  const containerCommonDir = posix.resolve(containerGitDir, up);
+  return [
+    "--mount-git-worktree-common-dir",
+    "--mount",
+    `type=bind,source=${dirs.commonDir},target=${containerCommonDir}`
+  ];
+}
+
 // ../host/src/modules/taskflow/adapters/devcontainer-environment.ts
 var cliOutputSchema = external_exports.object({
   containerId: external_exports.string(),
@@ -44947,47 +45117,26 @@ function hash2(value) {
 function quoteShell(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
-function relativeWorktreeGitDir(workspacePath) {
+async function exists2(path) {
   try {
-    const value = readFileSync3(join4(workspacePath, ".git"), "utf8").trim();
-    const gitDir = value.startsWith("gitdir: ") ? value.slice("gitdir: ".length).trim() : "";
-    return gitDir.length > 0 && !isAbsolute2(gitDir) ? gitDir : null;
-  } catch {
-    return null;
-  }
-}
-function commonGitDir(path, separator) {
-  const marker = `${separator}worktrees${separator}`;
-  const index = path.lastIndexOf(marker);
-  return index > 0 ? path.slice(0, index) : null;
-}
-function worktreeGitMount(workspacePath, containerWorkspacePath) {
-  const gitDir = relativeWorktreeGitDir(workspacePath);
-  if (!gitDir || !containerWorkspacePath) return null;
-  const source = commonGitDir(resolve2(workspacePath, gitDir), sep);
-  const target = commonGitDir(posix.resolve(containerWorkspacePath, gitDir.replaceAll(sep, "/")), "/");
-  return source && target ? `type=bind,source=${source},target=${target}` : null;
-}
-async function exists(path) {
-  try {
-    await access(path);
+    await access2(path);
     return true;
   } catch {
     return false;
   }
 }
 async function findDevcontainerConfigs(workspacePath) {
-  const rootConfig = join4(workspacePath, ".devcontainer.json");
-  const directory = join4(workspacePath, ".devcontainer");
+  const rootConfig = join5(workspacePath, ".devcontainer.json");
+  const directory = join5(workspacePath, ".devcontainer");
   const configs = [];
-  if (await exists(rootConfig)) configs.push(rootConfig);
-  if (await exists(join4(directory, "devcontainer.json"))) configs.push(join4(directory, "devcontainer.json"));
-  if (await exists(directory)) {
+  if (await exists2(rootConfig)) configs.push(rootConfig);
+  if (await exists2(join5(directory, "devcontainer.json"))) configs.push(join5(directory, "devcontainer.json"));
+  if (await exists2(directory)) {
     const entries = await readdir(directory, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const candidate = join4(directory, entry.name, "devcontainer.json");
-      if (await exists(candidate)) configs.push(candidate);
+      const candidate = join5(directory, entry.name, "devcontainer.json");
+      if (await exists2(candidate)) configs.push(candidate);
     }
   }
   return [...new Set(configs)].sort();
@@ -45082,7 +45231,7 @@ async function resolveComposeConfiguration(runner, config2, merged) {
   if (files.length === 0) return { hashMaterial: "", risks: [] };
   const args = [
     "compose",
-    ...files.flatMap((file2) => ["-f", resolve2(dirname4(config2), file2)]),
+    ...files.flatMap((file2) => ["-f", resolve3(dirname4(config2), file2)]),
     "config",
     "--format",
     "json"
@@ -45106,6 +45255,7 @@ var DevContainerProvider = class {
   cli;
   cliPrefix;
   workspaceFolders = /* @__PURE__ */ new Map();
+  workspaceMounts = /* @__PURE__ */ new Map();
   runner;
   constructor(runner = new NodeProcessRunner(), cli) {
     this.runner = runner;
@@ -45116,7 +45266,7 @@ var DevContainerProvider = class {
     }
     const packagePath = createRequire(import.meta.url).resolve("@devcontainers/cli/package.json");
     this.cli = process.execPath;
-    this.cliPrefix = [join4(dirname4(packagePath), "devcontainer.js")];
+    this.cliPrefix = [join5(dirname4(packagePath), "devcontainer.js")];
   }
   args(args) {
     return [...this.cliPrefix, ...args];
@@ -45138,7 +45288,7 @@ var DevContainerProvider = class {
     return {
       provider: this.id,
       available: version2.supported,
-      configRefs: configs.map((config2) => relative(context.workspacePath, config2)),
+      configRefs: configs.map((config2) => relative2(context.workspacePath, config2)),
       ...version2.version ? { version: version2.version } : {},
       diagnostics: version2.diagnostic ? [version2.diagnostic] : []
     };
@@ -45146,7 +45296,7 @@ var DevContainerProvider = class {
   async configFor(context) {
     const configs = await findDevcontainerConfigs(context.workspacePath);
     if (context.configRef) {
-      const selected2 = resolve2(context.workspacePath, context.configRef);
+      const selected2 = resolve3(context.workspacePath, context.configRef);
       if (!configs.includes(selected2)) throw new Error(`Dev Container config was not found: ${context.configRef}`);
       return selected2;
     }
@@ -45176,16 +45326,19 @@ var DevContainerProvider = class {
     });
     if (result.exit.code !== 0) throw new Error(`devcontainer read-configuration failed: ${result.stderr.trim()}`);
     const raw2 = readOutputSchema.parse(JSON.parse(result.stdout));
-    const rawConfig = await readFile(config2, "utf8");
+    const rawConfig = await readFile2(config2, "utf8");
     const merged = record2(raw2.mergedConfiguration ?? raw2.configuration);
     if (typeof merged.workspaceFolder === "string") this.workspaceFolders.set(config2, merged.workspaceFolder);
+    if (typeof merged.workspaceMount === "string" && merged.workspaceMount.trim().length > 0)
+      this.workspaceMounts.set(config2, merged.workspaceMount);
+    else this.workspaceMounts.delete(config2);
     const compose2 = await resolveComposeConfiguration(this.runner, config2, merged);
-    const lockfile = join4(dirname4(config2), "devcontainer-lock.json");
-    const lockfileExists = await exists(lockfile);
-    const lockfileContents = lockfileExists ? await readFile(lockfile, "utf8") : "";
+    const lockfile = join5(dirname4(config2), "devcontainer-lock.json");
+    const lockfileExists = await exists2(lockfile);
+    const lockfileContents = lockfileExists ? await readFile2(lockfile, "utf8") : "";
     return {
       provider: this.id,
-      configRef: relative(context.workspacePath, config2),
+      configRef: relative2(context.workspacePath, config2),
       configHash: hash2(`${rawConfig}\0${result.stdout}\0${compose2.hashMaterial}\0${lockfileContents}`),
       workspace: { hostPath: context.workspacePath },
       capabilities: {
@@ -45203,10 +45356,16 @@ var DevContainerProvider = class {
   }
   async up(environment, scope, removeExisting) {
     if (!environment.configRef) throw new Error("Dev Container environment requires configRef");
-    const config2 = resolve2(environment.workspace.hostPath, environment.configRef);
+    const config2 = resolve3(environment.workspace.hostPath, environment.configRef);
     const id = environmentIdFor(scope, "devcontainer", environment.configRef);
     const composeName = `tf_${id.slice(4)}`;
-    const gitMount = worktreeGitMount(environment.workspace.hostPath, this.workspaceFolders.get(config2));
+    const gitArgs = await worktreeGitMountArgs({
+      runner: this.runner,
+      workspacePath: environment.workspace.hostPath,
+      containerWorkspacePath: this.workspaceFolders.get(config2),
+      workspaceMount: this.workspaceMounts.get(config2),
+      configRef: environment.configRef
+    });
     const result = await runCaptured(this.runner, {
       command: this.cli,
       args: this.args([
@@ -45219,8 +45378,7 @@ var DevContainerProvider = class {
         `taskflow.environment.id=${id}`,
         "--include-configuration",
         "--include-merged-configuration",
-        ...relativeWorktreeGitDir(environment.workspace.hostPath) ? ["--mount-git-worktree-common-dir"] : [],
-        ...gitMount ? ["--mount", gitMount] : [],
+        ...gitArgs,
         ...removeExisting ? ["--remove-existing-container"] : []
       ]),
       cwd: dirname4(config2),
@@ -45414,14 +45572,14 @@ exec ${argv.join(" ")} "$cwd" ${quoteShell(executable)} "$@"
     const configuredFiles = configuration.dockerComposeFile;
     const files = Array.isArray(configuredFiles) ? configuredFiles.filter((value) => typeof value === "string") : typeof configuredFiles === "string" ? [configuredFiles] : [];
     if (project && typeof configRef === "string" && files.length > 0) {
-      const configDirectory = dirname4(resolve2(handle.workspace.hostPath, configRef));
+      const configDirectory = dirname4(resolve3(handle.workspace.hostPath, configRef));
       return {
         command: "docker",
         args: [
           "compose",
           "--project-name",
           project,
-          ...files.flatMap((file2) => ["-f", resolve2(configDirectory, file2)]),
+          ...files.flatMap((file2) => ["-f", resolve3(configDirectory, file2)]),
           "logs",
           "--follow",
           "--tail",
@@ -45440,10 +45598,10 @@ exec ${argv.join(" ")} "$cwd" ${quoteShell(executable)} "$@"
 
 // ../host/src/modules/taskflow/adapters/dockerfile-environment.ts
 import { createHash as createHash4 } from "node:crypto";
-import { existsSync, readFileSync as readFileSync4 } from "node:fs";
-import { resolve as resolve3 } from "node:path";
+import { existsSync, readFileSync as readFileSync3 } from "node:fs";
+import { resolve as resolve4 } from "node:path";
 function dockerfileFor(context) {
-  const dockerfile = resolve3(context.workspacePath, context.configRef ?? "Dockerfile");
+  const dockerfile = resolve4(context.workspacePath, context.configRef ?? "Dockerfile");
   if (!existsSync(dockerfile)) throw new Error(`Dockerfile does not exist: ${context.configRef ?? "Dockerfile"}`);
   return dockerfile;
 }
@@ -45470,7 +45628,7 @@ var DockerfileEnvironmentProvider = class {
       command: "docker",
       args: ["version", "--format", "{{.Client.Version}}"]
     });
-    const dockerfile = resolve3(context.workspacePath, "Dockerfile");
+    const dockerfile = resolve4(context.workspacePath, "Dockerfile");
     return {
       provider: this.id,
       available: version2.exit.code === 0 && existsSync(dockerfile),
@@ -45481,7 +45639,7 @@ var DockerfileEnvironmentProvider = class {
   }
   async resolve(context) {
     const dockerfile = dockerfileFor(context);
-    const source = readFileSync4(dockerfile, "utf8");
+    const source = readFileSync3(dockerfile, "utf8");
     return {
       provider: this.id,
       configRef: dockerfile,
@@ -45765,8 +45923,8 @@ function sanitizeProjectPrefix(raw2) {
   return raw2.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-");
 }
 function deriveProjectPrefix(projectDir, takenPrefixes) {
-  const basename11 = projectDir.replace(/\/+$/, "").split("/").pop() ?? APP_SLUG;
-  const base = sanitizeProjectPrefix(basename11) || APP_SLUG;
+  const basename12 = projectDir.replace(/\/+$/, "").split("/").pop() ?? APP_SLUG;
+  const base = sanitizeProjectPrefix(basename12) || APP_SLUG;
   const taken = /* @__PURE__ */ new Set([...takenPrefixes, ...RESERVED_PROJECT_PREFIXES]);
   if (!taken.has(base)) return base;
   for (let n = 2; n < 1e3; n++) {
@@ -46312,6 +46470,9 @@ var AvailableBranchSchema = external_exports.object({
 var AvailableBranchesQuerySchema = external_exports.object({
   includeRemote: BooleanLikeSchema.optional()
 });
+var RemoveWorktreeQuerySchema = external_exports.object({
+  force: BooleanLikeSchema.optional()
+});
 var NumberLikePathParamSchema = external_exports.union([
   external_exports.number().int().nonnegative(),
   external_exports.string().regex(/^\d+$/).transform((value) => Number(value))
@@ -47245,6 +47406,7 @@ var apiContract = defineRoutes({
     summary: "Remove a worktree",
     path: apiPaths.removeWorktree,
     pathParams: WorktreeNameParamsSchema,
+    query: RemoveWorktreeQuerySchema,
     responses: {
       200: OkResponseSchema,
       ...commonErrorResponses
@@ -47841,7 +48003,7 @@ exec ${JSON.stringify(executable)} "$@"
 };
 
 // ../host/src/modules/taskflow/adapters/projects-registry.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname6 } from "node:path";
 function defaultRegistryFile() {
   return globalPaths().projectsRegistry;
@@ -47850,7 +48012,7 @@ function createProjectsRegistry(file2 = defaultRegistryFile()) {
   function read() {
     let raw2;
     try {
-      raw2 = readFileSync5(file2, "utf8");
+      raw2 = readFileSync4(file2, "utf8");
     } catch {
       return [];
     }
@@ -48271,15 +48433,15 @@ import { spawnSync as spawnSync3 } from "node:child_process";
 
 // ../host/src/modules/taskflow/adapters/session-gateway.ts
 import { createHash as createHash5 } from "node:crypto";
-import { basename as basename2, resolve as resolve4 } from "node:path";
+import { basename as basename3, resolve as resolve5 } from "node:path";
 function sanitizeNameSegment(value, maxLength = 24) {
   const sanitized = value.toLowerCase().replace(/[^a-z0-9_.-]+/g, "-").replace(/-{2,}/g, "-").replace(/^[.-]+|[.-]+$/g, "");
   const trimmed = sanitized.slice(0, maxLength);
   return trimmed || "x";
 }
 function buildProjectSessionName(projectRoot2) {
-  const resolved2 = resolve4(projectRoot2);
-  const base = sanitizeNameSegment(basename2(resolved2), 18);
+  const resolved2 = resolve5(projectRoot2);
+  const base = sanitizeNameSegment(basename3(resolved2), 18);
   const hash4 = createHash5("sha1").update(resolved2).digest("hex").slice(0, 8);
   return `${RUNTIME_IDENTITY.tmuxPrefix}-${base}-${hash4}`;
 }
@@ -48546,19 +48708,19 @@ var TmuxGateway = class {
 
 // ../host/src/modules/taskflow/assets.ts
 import { existsSync as existsSync2 } from "node:fs";
-import { join as join5, resolve as resolve5 } from "node:path";
+import { join as join6, resolve as resolve6 } from "node:path";
 function taskflowAssets(env2 = process.env, directory = import.meta.dirname) {
-  const bundled = join5(directory, "assets");
-  if (existsSync2(join5(bundled, "workflows"))) {
+  const bundled = join6(directory, "assets");
+  if (existsSync2(join6(bundled, "workflows"))) {
     return {
-      workflowBuiltinsDir: env2[ENV_NAMES.workflowBuiltinsDir] || join5(bundled, "workflows"),
-      workflowSkill: join5(bundled, "skills", "portta-workflows", "SKILL.md")
+      workflowBuiltinsDir: env2[ENV_NAMES.workflowBuiltinsDir] || join6(bundled, "workflows"),
+      workflowSkill: join6(bundled, "skills", "portta-workflows", "SKILL.md")
     };
   }
-  const repository = resolve5(directory, "../../../../..");
+  const repository = resolve6(directory, "../../../../..");
   return {
-    workflowBuiltinsDir: env2[ENV_NAMES.workflowBuiltinsDir] || join5(repository, "packages", "host", "workflows"),
-    workflowSkill: join5(repository, "skills", "portta-workflows", "SKILL.md")
+    workflowBuiltinsDir: env2[ENV_NAMES.workflowBuiltinsDir] || join6(repository, "packages", "host", "workflows"),
+    workflowSkill: join6(repository, "skills", "portta-workflows", "SKILL.md")
   };
 }
 
@@ -48766,19 +48928,19 @@ import { homedir as homedir2 } from "node:os";
 // ../host/src/modules/taskflow/adapters/git.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { readdirSync, realpathSync, rmSync, statSync as statSync3 } from "node:fs";
-import { basename as basename3, dirname as dirname7, join as join6, resolve as resolve6 } from "node:path";
+import { basename as basename4, dirname as dirname7, join as join7, resolve as resolve7 } from "node:path";
 function canonicalizeFsPath(input2) {
-  const resolved2 = resolve6(input2);
+  const resolved2 = resolve7(input2);
   try {
     return realpathSync(resolved2);
   } catch {
     const missing = [];
     let current = resolved2;
     while (current !== dirname7(current)) {
-      missing.unshift(basename3(current));
+      missing.unshift(basename4(current));
       current = dirname7(current);
       try {
-        return join6(realpathSync(current), ...missing);
+        return join7(realpathSync(current), ...missing);
       } catch {
       }
     }
@@ -48862,7 +49024,7 @@ function currentCheckoutRef(cwd) {
 }
 function resolveRepoRoot(dir) {
   const direct = tryRunGit(["rev-parse", "--show-toplevel"], dir);
-  if (direct.ok) return resolve6(dir, direct.stdout);
+  if (direct.ok) return resolve7(dir, direct.stdout);
   let entries;
   try {
     entries = readdirSync(dir);
@@ -48870,24 +49032,24 @@ function resolveRepoRoot(dir) {
     return null;
   }
   for (const entry of entries) {
-    const child = join6(dir, entry);
+    const child = join7(dir, entry);
     try {
       if (!statSync3(child).isDirectory()) continue;
     } catch {
       continue;
     }
     const childResult = tryRunGit(["rev-parse", "--show-toplevel"], child);
-    if (childResult.ok) return resolve6(child, childResult.stdout);
+    if (childResult.ok) return resolve7(child, childResult.stdout);
   }
   return null;
 }
 function resolveWorktreeRoot(cwd) {
   const output2 = runGit(["rev-parse", "--show-toplevel"], cwd);
-  return resolve6(cwd, output2);
+  return resolve7(cwd, output2);
 }
 function resolveWorktreeGitDir(cwd) {
   const output2 = runGit(["rev-parse", "--git-dir"], cwd);
-  return resolve6(cwd, output2);
+  return resolve7(cwd, output2);
 }
 function parseGitWorktreePorcelain(output2) {
   const entries = [];
@@ -49084,6 +49246,21 @@ var NodeGitGateway = class {
     const result = tryRunGit(["diff", "HEAD", "--no-color"], cwd);
     return result.ok ? result.stdout : "";
   }
+  /**
+   * Commits reachable from HEAD and from nothing else that would survive this
+   * worktree: not on an origin branch, not on the project's main branch. It
+   * answers "would deleting this branch lose work", which `aheadCount` cannot:
+   * with no upstream and no remote at all, every commit counts as ahead.
+   */
+  countUnsavedCommits(cwd, baseBranch) {
+    const count = (args) => {
+      const result = tryRunGit(args, cwd);
+      return result.ok ? parseInt(result.stdout, 10) || 0 : null;
+    };
+    const excludingBase = baseBranch ? count(["rev-list", "--count", "HEAD", "--not", "--remotes=origin", baseBranch]) : null;
+    if (excludingBase !== null) return excludingBase;
+    return count(["rev-list", "--count", "HEAD", "--not", "--remotes=origin"]) ?? 0;
+  }
   listUnpushedCommits(cwd) {
     let result = tryRunGit(["log", "--oneline", "@{upstream}..HEAD"], cwd);
     if (!result.ok) {
@@ -49434,7 +49611,7 @@ function resolveSocketPath(env2) {
   return session ? `${home2}/.config/herdr/sessions/${session}/herdr.sock` : `${home2}/.config/herdr/herdr.sock`;
 }
 async function request(socketPath, method, params) {
-  return await new Promise((resolve21, reject2) => {
+  return await new Promise((resolve22, reject2) => {
     let buffer = "";
     let settled = false;
     const settle = (fn) => {
@@ -49458,7 +49635,7 @@ async function request(socketPath, method, params) {
       const line = buffer.slice(0, newline);
       clearTimeout(timer);
       try {
-        settle(() => resolve21(parseHerdrResponse(JSON.parse(line))));
+        settle(() => resolve22(parseHerdrResponse(JSON.parse(line))));
       } catch {
         settle(() => reject2(new HerdrRequestError(method, "invalid_response", line.slice(0, 200))));
       }
@@ -49758,8 +49935,8 @@ var HerdrGateway = class {
 };
 
 // ../host/src/modules/taskflow/adapters/hooks.ts
-import { access as access2 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { access as access3 } from "node:fs/promises";
+import { join as join8 } from "node:path";
 function buildErrorMessage(name, exitCode, stdout, stderr) {
   const output2 = stderr.trim() || stdout.trim();
   if (output2) {
@@ -49804,7 +49981,7 @@ var NodeLifecycleHookRunner = class {
   }
   async hasEnvrc(cwd) {
     try {
-      await access2(join7(cwd, ".envrc"));
+      await access3(join8(cwd, ".envrc"));
       return true;
     } catch {
       return false;
@@ -49839,7 +50016,7 @@ var NodePortProbe = class {
     this.hostnames = hostnames;
   }
   isListening(port) {
-    return new Promise((resolve21) => {
+    return new Promise((resolve22) => {
       let settled = false;
       let pending = this.hostnames.length;
       const settle = (result) => {
@@ -49847,20 +50024,20 @@ var NodePortProbe = class {
         if (result) {
           settled = true;
           clearTimeout(timer);
-          resolve21(true);
+          resolve22(true);
           return;
         }
         pending--;
         if (pending === 0) {
           settled = true;
           clearTimeout(timer);
-          resolve21(false);
+          resolve22(false);
         }
       };
       const timer = setTimeout(() => {
         if (!settled) {
           settled = true;
-          resolve21(false);
+          resolve22(false);
         }
       }, this.timeoutMs);
       for (const hostname3 of this.hostnames) {
@@ -49882,7 +50059,7 @@ var NodePortProbe = class {
 
 // ../host/src/modules/taskflow/adapters/session-discovery.ts
 import { open as open2, readdir as readdir3, stat as stat3 } from "node:fs/promises";
-import { basename as basename5, join as join9 } from "node:path";
+import { basename as basename6, join as join10 } from "node:path";
 import { setTimeout as sleep3 } from "node:timers/promises";
 
 // ../host/src/modules/taskflow/lib/type-guards.ts
@@ -49894,8 +50071,8 @@ function isStringArray2(raw2) {
 }
 
 // ../host/src/modules/taskflow/adapters/claude-cli.ts
-import { readdir as readdir2, readFile as readFile2, stat as stat2 } from "node:fs/promises";
-import { basename as basename4, join as join8 } from "node:path";
+import { readdir as readdir2, readFile as readFile3, stat as stat2 } from "node:fs/promises";
+import { basename as basename5, join as join9 } from "node:path";
 function isRecord4(raw2) {
   return typeof raw2 === "object" && raw2 !== null && !Array.isArray(raw2);
 }
@@ -50079,19 +50256,19 @@ function readClaudeProjectsRoot() {
   if (!home2) {
     throw new Error("HOME is required to resolve Claude sessions");
   }
-  return join8(home2, ".claude", "projects");
+  return join9(home2, ".claude", "projects");
 }
 async function listJsonlFiles(dir) {
   try {
     const entries = await readdir2(dir, { withFileTypes: true });
-    return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => join8(dir, entry.name));
+    return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => join9(dir, entry.name));
   } catch {
     return [];
   }
 }
 async function findClaudeSessionPath(sessionId, cwd) {
   const projectsRoot = readClaudeProjectsRoot();
-  const primaryPath = join8(projectsRoot, encodeClaudeProjectDir(cwd), `${sessionId}.jsonl`);
+  const primaryPath = join9(projectsRoot, encodeClaudeProjectDir(cwd), `${sessionId}.jsonl`);
   try {
     await stat2(primaryPath);
     return primaryPath;
@@ -50100,7 +50277,7 @@ async function findClaudeSessionPath(sessionId, cwd) {
   const projectDirs = await readdir2(projectsRoot, { withFileTypes: true }).catch(() => []);
   for (const entry of projectDirs) {
     if (!entry.isDirectory()) continue;
-    const candidate = join8(projectsRoot, entry.name, `${sessionId}.jsonl`);
+    const candidate = join9(projectsRoot, entry.name, `${sessionId}.jsonl`);
     try {
       await stat2(candidate);
       return candidate;
@@ -50224,7 +50401,7 @@ var ClaudeCliClient = class {
   }
   async listSessions(cwd) {
     const projectsRoot = readClaudeProjectsRoot();
-    const primaryDir = join8(projectsRoot, encodeClaudeProjectDir(cwd));
+    const primaryDir = join9(projectsRoot, encodeClaudeProjectDir(cwd));
     const primaryFiles = await listJsonlFiles(primaryDir);
     if (primaryFiles.length > 0) {
       return await this.summarizeSessionFiles(primaryFiles, cwd);
@@ -50233,7 +50410,7 @@ var ClaudeCliClient = class {
     const matchedFiles = [];
     for (const entry of projectDirs) {
       if (!entry.isDirectory()) continue;
-      const files = await listJsonlFiles(join8(projectsRoot, entry.name));
+      const files = await listJsonlFiles(join9(projectsRoot, entry.name));
       for (const filePath of files) {
         const session = await this.readSessionFile(filePath);
         if (session?.cwd === cwd) {
@@ -50281,8 +50458,8 @@ var ClaudeCliClient = class {
     let sessionIdResolve = null;
     let sessionIdReject = null;
     let interrupted = false;
-    const sessionId = new Promise((resolve21, reject2) => {
-      sessionIdResolve = resolve21;
+    const sessionId = new Promise((resolve22, reject2) => {
+      sessionIdResolve = resolve22;
       sessionIdReject = reject2;
     });
     const resolveSessionId = (value) => {
@@ -50353,7 +50530,7 @@ var ClaudeCliClient = class {
         const info = await stat2(filePath).catch(() => null);
         if (!info) return null;
         return {
-          sessionId: basename4(filePath, ".jsonl"),
+          sessionId: basename5(filePath, ".jsonl"),
           cwd,
           path: filePath,
           lastSeenAt: info.mtime.toISOString()
@@ -50364,10 +50541,10 @@ var ClaudeCliClient = class {
   }
   async readSessionFile(filePath) {
     try {
-      const text = await readFile2(filePath, "utf8");
+      const text = await readFile3(filePath, "utf8");
       return buildClaudeSessionFromText({
         path: filePath,
-        sessionId: basename4(filePath, ".jsonl"),
+        sessionId: basename5(filePath, ".jsonl"),
         text
       });
     } catch {
@@ -50430,12 +50607,12 @@ function newestFirst(sessions2) {
   return sessions2.sort((left, right) => right.mtimeMs - left.mtimeMs).map((entry) => entry.sessionId);
 }
 async function listClaudeSessionIds(cwd) {
-  const dir = join9(home(), ".claude", "projects", encodeClaudeProjectDir(cwd));
+  const dir = join10(home(), ".claude", "projects", encodeClaudeProjectDir(cwd));
   const names = await readdir3(dir).catch(() => []);
   const stamped = await Promise.all(
     names.filter((name) => name.endsWith(".jsonl")).map(async (name) => {
-      const info = await stat3(join9(dir, name)).catch(() => null);
-      return info ? { sessionId: basename5(name, ".jsonl"), mtimeMs: info.mtimeMs } : null;
+      const info = await stat3(join10(dir, name)).catch(() => null);
+      return info ? { sessionId: basename6(name, ".jsonl"), mtimeMs: info.mtimeMs } : null;
     })
   );
   return newestFirst(stamped.filter((entry) => entry !== null));
@@ -50470,15 +50647,15 @@ async function readCodexSessionCwdId(path) {
   }
 }
 async function listCodexSessionIds(cwd) {
-  const root = join9(home(), ".codex", "sessions");
+  const root = join10(home(), ".codex", "sessions");
   const relPaths = await readdir3(root, { recursive: true }).catch(() => []);
   const rollouts = relPaths.filter((rel) => {
-    const name = basename5(rel);
+    const name = basename6(rel);
     return name.startsWith("rollout-") && name.endsWith(".jsonl");
   });
   const stamped = await Promise.all(
     rollouts.map(async (rel) => {
-      const path = join9(root, rel);
+      const path = join10(root, rel);
       const meta3 = await readCodexSessionCwdId(path);
       if (!meta3 || meta3.cwd !== cwd) return null;
       const info = await stat3(path).catch(() => null);
@@ -50488,11 +50665,11 @@ async function listCodexSessionIds(cwd) {
   return newestFirst(stamped.filter((entry) => entry !== null));
 }
 async function findCodexSessionPath(sessionId, cwd) {
-  const root = join9(home(), ".codex", "sessions");
+  const root = join10(home(), ".codex", "sessions");
   const relPaths = await readdir3(root, { recursive: true }).catch(() => []);
   for (const rel of relPaths) {
-    if (!basename5(rel).endsWith(`${sessionId}.jsonl`)) continue;
-    const path = join9(root, rel);
+    if (!basename6(rel).endsWith(`${sessionId}.jsonl`)) continue;
+    const path = join10(root, rel);
     const meta3 = await readCodexSessionCwdId(path);
     if (meta3?.id === sessionId && meta3.cwd === cwd) return path;
   }
@@ -50573,8 +50750,8 @@ async function captureNewSessionId(discovery, agent, cwd, before, options = {})
 }
 
 // ../host/src/modules/taskflow/adapters/fs.ts
-import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join11 } from "node:path";
 var SAFE_ENV_VALUE_RE = /^[A-Za-z0-9_./:@%+=,-]+$/;
 var DOTENV_LINE_RE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)/;
 function stringifyAllocatedPorts(ports) {
@@ -50605,7 +50782,7 @@ function parseDotenv(content) {
 }
 async function loadDotenvLocal(worktreePath) {
   try {
-    const content = await readFile3(join10(worktreePath, ".env.local"), "utf8");
+    const content = await readFile4(join11(worktreePath, ".env.local"), "utf8");
     return parseDotenv(content);
   } catch {
     return {};
@@ -50636,7 +50813,7 @@ async function ensureWorktreeStorageDirs(gitDir) {
 async function readWorktreeMeta(gitDir) {
   const { metaPath } = getWorktreeStoragePaths(gitDir);
   try {
-    const raw2 = JSON.parse(await readFile3(metaPath, "utf8"));
+    const raw2 = JSON.parse(await readFile4(metaPath, "utf8"));
     return normalizeWorktreeMeta(raw2);
   } catch {
     return null;
@@ -50644,7 +50821,7 @@ async function readWorktreeMeta(gitDir) {
 }
 async function writeWorktreeMeta(gitDir, meta3) {
   const { metaPath } = await ensureWorktreeStorageDirs(gitDir);
-  await writeFile2(metaPath, `${JSON.stringify(meta3, null, 2)}
+  await writeFile3(metaPath, `${JSON.stringify(meta3, null, 2)}
 `);
 }
 function isArchivedWorktreeEntry(raw2) {
@@ -50662,7 +50839,7 @@ function isWorktreeArchiveState(raw2) {
 async function readWorktreeArchiveState(gitDir) {
   const archivePath = getProjectArchiveStatePath(gitDir);
   try {
-    const raw2 = JSON.parse(await readFile3(archivePath, "utf8"));
+    const raw2 = JSON.parse(await readFile4(archivePath, "utf8"));
     return isWorktreeArchiveState(raw2) ? {
       schemaVersion: raw2.schemaVersion,
       entries: raw2.entries.map((entry) => ({ ...entry }))
@@ -50674,13 +50851,13 @@ async function readWorktreeArchiveState(gitDir) {
 async function writeWorktreeArchiveState(gitDir, state) {
   const archivePath = getProjectArchiveStatePath(gitDir);
   await ensureWorktreeStorageDirs(gitDir);
-  await writeFile2(archivePath, `${JSON.stringify(state, null, 2)}
+  await writeFile3(archivePath, `${JSON.stringify(state, null, 2)}
 `);
 }
 async function writeOpenSessionsState(gitDir, state) {
   const statePath = getProjectOpenSessionsStatePath(gitDir);
   await ensureWorktreeStorageDirs(gitDir);
-  await writeFile2(statePath, `${JSON.stringify(state, null, 2)}
+  await writeFile3(statePath, `${JSON.stringify(state, null, 2)}
 `);
 }
 function buildRuntimeEnvMap(meta3, extraEnv = {}, dotenvValues = {}) {
@@ -50711,11 +50888,11 @@ function renderEnvFile(env2) {
 }
 async function writeRuntimeEnv(gitDir, env2) {
   const { runtimeEnvPath } = await ensureWorktreeStorageDirs(gitDir);
-  await writeFile2(runtimeEnvPath, renderEnvFile(env2));
+  await writeFile3(runtimeEnvPath, renderEnvFile(env2));
 }
 async function writeControlEnv(gitDir, env2) {
   const { controlEnvPath } = await ensureWorktreeStorageDirs(gitDir);
-  await writeFile2(controlEnvPath, renderEnvFile(env2));
+  await writeFile3(controlEnvPath, renderEnvFile(env2));
 }
 function isRecord5(raw2) {
   return typeof raw2 === "object" && raw2 !== null && !Array.isArray(raw2);
@@ -50800,7 +50977,7 @@ function isPrEntry(raw2) {
 async function readWorktreePrs(gitDir) {
   const { prsPath } = getWorktreeStoragePaths(gitDir);
   try {
-    const raw2 = JSON.parse(await readFile3(prsPath, "utf8"));
+    const raw2 = JSON.parse(await readFile4(prsPath, "utf8"));
     if (!Array.isArray(raw2) || !raw2.every((entry) => isPrEntry(entry))) return [];
     return raw2.map((entry) => ({ ...entry, isDraft: entry.isDraft ?? false }));
   } catch {
@@ -50809,12 +50986,12 @@ async function readWorktreePrs(gitDir) {
 }
 async function writeWorktreePrs(gitDir, prs) {
   const { prsPath } = await ensureWorktreeStorageDirs(gitDir);
-  await writeFile2(prsPath, `${JSON.stringify(prs, null, 2)}
+  await writeFile3(prsPath, `${JSON.stringify(prs, null, 2)}
 `);
 }
 
 // ../host/src/modules/taskflow/services/archive-service.ts
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 function createArchiveState(entries) {
   return {
     schemaVersion: WORKTREE_ARCHIVE_STATE_VERSION,
@@ -50822,7 +50999,7 @@ function createArchiveState(entries) {
   };
 }
 function normalizeArchivePath(path) {
-  return resolve7(path);
+  return resolve8(path);
 }
 function buildArchivedWorktreePathSet(state) {
   return new Set(state.entries.map((entry) => normalizeArchivePath(entry.path)));
@@ -50896,8 +51073,8 @@ var ArchiveStateService = class {
     const previous = this.mutationQueue;
     let release = () => {
     };
-    this.mutationQueue = new Promise((resolve21) => {
-      release = resolve21;
+    this.mutationQueue = new Promise((resolve22) => {
+      release = resolve22;
     });
     await previous.catch(() => {
     });
@@ -51075,8 +51252,8 @@ var AutoNameService = class {
 
 // ../host/src/modules/taskflow/services/lifecycle-service.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname10, relative as relative2, resolve as resolve10 } from "node:path";
+import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile5 } from "node:fs/promises";
+import { dirname as dirname10, relative as relative3, resolve as resolve11 } from "node:path";
 
 // ../host/src/modules/taskflow/adapters/agent-capabilities.ts
 var CAPABILITY_TIMEOUT_MS = 15e3;
@@ -51121,8 +51298,8 @@ ${stderr}`;
 };
 
 // ../host/src/modules/taskflow/adapters/agent-runtime.ts
-import { chmod, mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname8, join as join11, resolve as resolve8 } from "node:path";
+import { chmod, mkdir as mkdir3, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
+import { dirname as dirname8, join as join12, resolve as resolve9 } from "node:path";
 var GENERATED_AGENT_FILES_EXCLUDES = [".claude/settings.local.json", ".codex/hooks.json"];
 function shellQuote(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
@@ -51132,7 +51309,7 @@ function isRecord6(value) {
 }
 async function readJsonRecord(path) {
   try {
-    const parsed = JSON.parse(await readFile4(path, "utf8"));
+    const parsed = JSON.parse(await readFile5(path, "utf8"));
     return isRecord6(parsed) ? parsed : {};
   } catch {
     return {};
@@ -51548,7 +51725,7 @@ async function mergeClaudeSettings(settingsPath, hookSettings) {
   const existingHooks = existing.hooks;
   const mergedHooks = existingHooks && typeof existingHooks === "object" && !Array.isArray(existingHooks) ? { ...existingHooks, ...hookSettings } : hookSettings;
   const merged = { ...existing, hooks: mergedHooks };
-  await writeFile3(settingsPath, `${JSON.stringify(merged, null, 2)}
+  await writeFile4(settingsPath, `${JSON.stringify(merged, null, 2)}
 `);
 }
 function commandStartsWithAgentCtl(command, agentCtlPath) {
@@ -51571,24 +51748,24 @@ async function mergeCodexHooksFile(hooksPath, hookSettings, agentCtlPath) {
     const preservedGroups = Array.isArray(eventGroups) ? eventGroups.filter((group) => !isTaskflowHookGroup(group, agentCtlPath)) : [];
     mergedHooks[eventName] = [...preservedGroups, ...groups];
   }
-  await writeFile3(hooksPath, `${JSON.stringify({ ...existing, hooks: mergedHooks }, null, 2)}
+  await writeFile4(hooksPath, `${JSON.stringify({ ...existing, hooks: mergedHooks }, null, 2)}
 `);
 }
 async function resolveGitCommonDir(gitDir) {
   try {
-    const commonDir = (await readFile4(join11(gitDir, "commondir"), "utf8")).trim();
+    const commonDir = (await readFile5(join12(gitDir, "commondir"), "utf8")).trim();
     if (!commonDir) return gitDir;
-    return commonDir.startsWith("/") ? commonDir : resolve8(gitDir, commonDir);
+    return commonDir.startsWith("/") ? commonDir : resolve9(gitDir, commonDir);
   } catch {
     return gitDir;
   }
 }
 async function ensureGeneratedAgentFilesIgnored(gitDir) {
   const commonDir = await resolveGitCommonDir(gitDir);
-  const excludePath = join11(commonDir, "info", "exclude");
+  const excludePath = join12(commonDir, "info", "exclude");
   let existing = "";
   try {
-    existing = await readFile4(excludePath, "utf8");
+    existing = await readFile5(excludePath, "utf8");
   } catch {
     existing = "";
   }
@@ -51597,19 +51774,19 @@ async function ensureGeneratedAgentFilesIgnored(gitDir) {
   if (missing.length === 0) return;
   await mkdir3(dirname8(excludePath), { recursive: true });
   const separator = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-  await writeFile3(excludePath, `${existing}${separator}${missing.join("\n")}
+  await writeFile4(excludePath, `${existing}${separator}${missing.join("\n")}
 `);
 }
 async function ensureAgentRuntimeArtifacts(input2) {
   const storagePaths = getWorktreeStoragePaths(input2.gitDir);
   const artifacts = {
-    agentCtlPath: join11(storagePaths.taskflowDir, RUNTIME_IDENTITY.agentControlBinary),
-    claudeSettingsPath: join11(input2.worktreePath, ".claude", "settings.local.json"),
-    codexHooksPath: join11(input2.worktreePath, ".codex", "hooks.json")
+    agentCtlPath: join12(storagePaths.taskflowDir, RUNTIME_IDENTITY.agentControlBinary),
+    claudeSettingsPath: join12(input2.worktreePath, ".claude", "settings.local.json"),
+    codexHooksPath: join12(input2.worktreePath, ".codex", "hooks.json")
   };
   await mkdir3(dirname8(artifacts.claudeSettingsPath), { recursive: true });
   await mkdir3(dirname8(artifacts.codexHooksPath), { recursive: true });
-  await writeFile3(artifacts.agentCtlPath, buildAgentCtlScript());
+  await writeFile4(artifacts.agentCtlPath, buildAgentCtlScript());
   await chmod(artifacts.agentCtlPath, 493);
   const hookSettings = buildClaudeHookSettings(artifacts);
   const hooks = hookSettings.hooks;
@@ -51734,7 +51911,7 @@ function listAgentDetails(config2) {
 }
 
 // ../host/src/modules/taskflow/services/agent-service.ts
-import { dirname as dirname9, join as join12 } from "node:path";
+import { dirname as dirname9, join as join13 } from "node:path";
 var DOCKER_PATH_FALLBACK = "/root/.local/bin:/usr/local/bin:/root/.bun/bin:/root/.cargo/bin";
 var CUSTOM_AGENT_TEMPLATE_VARS = {
   PROMPT: ENV_NAMES.agentPrompt,
@@ -51755,7 +51932,7 @@ function buildDockerRuntimeBootstrap(runtimeEnvPath) {
 }
 function buildCodexNotifyFlag(runtimeEnvPath) {
   if (!runtimeEnvPath) return "";
-  const agentCtlPath = join12(dirname9(runtimeEnvPath), RUNTIME_IDENTITY.agentControlBinary);
+  const agentCtlPath = join13(dirname9(runtimeEnvPath), RUNTIME_IDENTITY.agentControlBinary);
   return ` -c ${quoteShell3(`notify=${JSON.stringify([agentCtlPath, "codex-notify"])}`)}`;
 }
 function buildBuiltInAgentInvocation(input2) {
@@ -51881,7 +52058,7 @@ function buildDockerAgentPaneCommand(input2) {
 }
 
 // ../host/src/modules/taskflow/services/session-service.ts
-import { resolve as resolve9 } from "node:path";
+import { resolve as resolve10 } from "node:path";
 function quoteShell4(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
@@ -51895,7 +52072,7 @@ function buildCommandPaneStartupCommand(template, ctx) {
   if (!template.workingDir) {
     return template.command;
   }
-  const workingDir = resolve9(resolvePaneCwd(template, ctx), template.workingDir);
+  const workingDir = resolve10(resolvePaneCwd(template, ctx), template.workingDir);
   return `cd -- ${quoteShell4(workingDir)} && ${template.command}`;
 }
 function resolvePaneStartupCommand(template, ctx) {
@@ -52196,7 +52373,7 @@ function trimTrailingSlashes(value) {
   return value.replace(/\/+$/, "");
 }
 function isPathWithin(parent, child) {
-  const path = relative2(parent, child);
+  const path = relative3(parent, child);
   return path !== "" && !path.startsWith("..") && !path.includes(`..${process.platform === "win32" ? "\\" : "/"}`);
 }
 function normalizeWorktreeLabel(label) {
@@ -52664,9 +52841,23 @@ var LifecycleService = class {
       throw this.wrapOperationError(error61);
     }
   }
-  async removeWorktree(branch) {
+  /**
+   * Removing a worktree deletes its branch with `--force`, so anything living
+   * only there is gone. Uncommitted changes and unpushed commits therefore
+   * refuse the removal unless the caller says to discard them.
+   */
+  async removeWorktree(branch, options = {}) {
     try {
       const resolved2 = await this.resolveExistingWorktree(branch);
+      if (!options.force) {
+        const unsaved = this.describeUnsavedWork(resolved2.entry);
+        if (unsaved) {
+          throw new LifecycleError(
+            `Worktree has ${unsaved}: ${branch}. Commit or push them, or remove with --force to discard them.`,
+            409
+          );
+        }
+      }
       await this.removeResolvedWorktree(resolved2);
     } catch (error61) {
       throw this.wrapOperationError(error61);
@@ -52677,15 +52868,21 @@ var LifecycleService = class {
       const resolvedWorktrees = await this.resolveAllWorktrees();
       const sessionName = buildProjectSessionName(this.deps.projectRoot);
       const removedBranches = [];
+      const keptBranches = [];
       for (const resolved2 of resolvedWorktrees) {
         const branch = resolved2.entry.branch ?? resolved2.entry.path;
         if (await this.deps.sessions.hasWindow(sessionName, buildWorktreeWindowName(branch))) {
           continue;
         }
+        const unsaved = this.describeUnsavedWork(resolved2.entry);
+        if (unsaved) {
+          keptBranches.push({ branch, reason: unsaved });
+          continue;
+        }
         await this.removeResolvedWorktree(resolved2);
         removedBranches.push(branch);
       }
-      return { removedBranches };
+      return { removedBranches, keptBranches };
     } catch (error61) {
       throw this.wrapOperationError(error61);
     }
@@ -52871,7 +53068,7 @@ var LifecycleService = class {
     return allocateServicePorts(metas, this.deps.config.services);
   }
   resolveWorktreePath(branch) {
-    return resolve10(this.deps.projectRoot, this.deps.config.workspace.worktreeRoot, branch);
+    return resolve11(this.deps.projectRoot, this.deps.config.workspace.worktreeRoot, branch);
   }
   /**
    * A worktree root below the repository is intentionally kept out of the
@@ -52880,36 +53077,36 @@ var LifecycleService = class {
    * tracked project files or leaking the choice to other contributors.
    */
   async excludeInternalWorktreeRoot(worktreePath) {
-    const projectRoot2 = resolve10(this.deps.projectRoot);
-    const worktreeRoot = resolve10(projectRoot2, this.deps.config.workspace.worktreeRoot);
+    const projectRoot2 = resolve11(this.deps.projectRoot);
+    const worktreeRoot = resolve11(projectRoot2, this.deps.config.workspace.worktreeRoot);
     if (!isPathWithin(projectRoot2, worktreeRoot) || !isPathWithin(worktreeRoot, worktreePath)) return;
-    const relativeRoot = relative2(projectRoot2, worktreeRoot).split("\\").join("/");
+    const relativeRoot = relative3(projectRoot2, worktreeRoot).split("\\").join("/");
     const rule = `/${relativeRoot}/`;
     const gitDir = this.deps.git.resolveWorktreeGitDir(projectRoot2);
-    const excludePath = resolve10(gitDir, "info", "exclude");
+    const excludePath = resolve11(gitDir, "info", "exclude");
     await mkdir4(dirname10(excludePath), { recursive: true });
     let existing = "";
     try {
-      existing = await readFile5(excludePath, "utf8");
+      existing = await readFile6(excludePath, "utf8");
     } catch {
     }
     if (existing.split(/\r?\n/).some((line) => line.trim() === rule)) return;
-    await writeFile4(excludePath, `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${rule}
+    await writeFile5(excludePath, `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${rule}
 `);
   }
   listLocalBranches() {
-    return this.deps.git.listLocalBranches(resolve10(this.deps.projectRoot));
+    return this.deps.git.listLocalBranches(resolve11(this.deps.projectRoot));
   }
   listRemoteBranches() {
-    return this.deps.git.listRemoteBranches(resolve10(this.deps.projectRoot));
+    return this.deps.git.listRemoteBranches(resolve11(this.deps.projectRoot));
   }
   listCheckedOutBranches() {
     return new Set(
-      this.deps.git.listWorktrees(resolve10(this.deps.projectRoot)).filter((entry) => !entry.bare && entry.branch !== null).map((entry) => entry.branch)
+      this.deps.git.listWorktrees(resolve11(this.deps.projectRoot)).filter((entry) => !entry.bare && entry.branch !== null).map((entry) => entry.branch)
     );
   }
   listProjectWorktrees() {
-    const projectRoot2 = resolve10(this.deps.projectRoot);
+    const projectRoot2 = resolve11(this.deps.projectRoot);
     return this.deps.git.listLiveWorktrees(projectRoot2).filter((entry) => !entry.bare && !sameFsPath(entry.path, projectRoot2));
   }
   async readManagedMetas() {
@@ -53182,6 +53379,14 @@ ${oneshotPrompt}` : oneshotPrompt ?? baseSystemPrompt;
     }
     return cleanupErrors.length > 0 ? cleanupErrors.join("; ") : null;
   }
+  /** What this worktree holds that exists nowhere else, or null when it is safe to delete. */
+  describeUnsavedWork(entry) {
+    const status = this.deps.git.readWorktreeStatus(entry.path);
+    if (status.dirty) return "uncommitted changes";
+    const commits = this.deps.git.countUnsavedCommits(entry.path, this.deps.config.workspace.mainBranch);
+    if (commits > 0) return `${commits} commit${commits === 1 ? "" : "s"} that are only here`;
+    return null;
+  }
   ensureNoUncommittedChanges(entry) {
     const status = this.deps.git.readWorktreeStatus(entry.path);
     if (status.dirty) {
@@ -53278,7 +53483,7 @@ ${oneshotPrompt}` : oneshotPrompt ?? baseSystemPrompt;
     const cleanupErrors = [];
     for (const branch of [...branches].reverse()) {
       try {
-        await this.removeWorktree(branch);
+        await this.removeWorktree(branch, { force: true });
       } catch (error61) {
         cleanupErrors.push(`rollback failed for ${branch}: ${toErrorMessage2(error61)}`);
       }
@@ -53705,7 +53910,7 @@ var ProjectRuntime = class {
 };
 
 // ../host/src/modules/taskflow/services/reconciliation-service.ts
-import { basename as basename6, resolve as resolve11 } from "node:path";
+import { basename as basename7, resolve as resolve12 } from "node:path";
 
 // ../host/src/modules/taskflow/lib/async.ts
 async function mapWithConcurrency(items, limit, fn) {
@@ -53751,7 +53956,7 @@ function startSerializedInterval(run, intervalMs, deps = {}) {
 
 // ../host/src/modules/taskflow/services/reconciliation-service.ts
 function makeUnmanagedWorktreeId(path) {
-  return `unmanaged:${resolve11(path)}`;
+  return `unmanaged:${resolve12(path)}`;
 }
 function isValidPort2(port) {
   return port !== null && Number.isInteger(port) && port >= 1 && port <= 65535;
@@ -53786,7 +53991,7 @@ function findWindow(windows, sessionName, branch) {
   return windows.find((window) => window.sessionName === sessionName && window.windowName === windowName) ?? null;
 }
 function resolveBranch(entry, metaBranch) {
-  const fallback = basename6(entry.path);
+  const fallback = basename7(entry.path);
   return entry.branch ?? metaBranch ?? (fallback.length > 0 ? fallback : "unknown");
 }
 var ReconciliationService = class {
@@ -53809,7 +54014,7 @@ var ReconciliationService = class {
     if (!options.force && this.now() - this.lastReconciledAt < this.freshnessMs) {
       return;
     }
-    const normalizedRepoRoot = resolve11(repoRoot);
+    const normalizedRepoRoot = resolve12(repoRoot);
     const reconcilePromise = this.runReconcile(normalizedRepoRoot).then(() => {
       this.lastReconciledAt = this.now();
     });
@@ -56862,7 +57067,7 @@ function environmentRoutes(deps) {
 }
 
 // ../host/src/modules/taskflow/server/routes/github.ts
-import { resolve as resolve12 } from "node:path";
+import { resolve as resolve13 } from "node:path";
 
 // ../host/src/modules/taskflow/services/auto-pull-service.ts
 function pullMainBranch(deps) {
@@ -57323,7 +57528,7 @@ function githubRoutes(deps) {
       const linkedRepo = config2.integrations.github.linkedRepos.find((lr) => lr.alias === repo);
       if (!linkedRepo) return errorResponse(`Unknown linked repo: ${repo}`, 404);
       if (!linkedRepo.dir) return errorResponse(`Linked repo "${repo}" has no dir configured`, 400);
-      const resolvedDir = resolve12(projectDir, linkedRepo.dir);
+      const resolvedDir = resolve13(projectDir, linkedRepo.dir);
       const repoRoot = git2.resolveRepoRoot(resolvedDir);
       if (!repoRoot) return errorResponse(`Linked repo "${repo}" dir is not a git repository: ${resolvedDir}`, 400);
       projectRoot2 = repoRoot;
@@ -57369,7 +57574,7 @@ function hasHeader(headers, name) {
   return getHeader(headers, name) !== void 0;
 }
 function putViaNodeHttps(url2, headers, body) {
-  return new Promise((resolve21, reject2) => {
+  return new Promise((resolve22, reject2) => {
     const parsed = new URL(url2);
     const req = httpsRequest(
       {
@@ -57386,7 +57591,7 @@ function putViaNodeHttps(url2, headers, body) {
         const chunks = [];
         res.on("data", (chunk) => chunks.push(chunk));
         res.on("end", () => {
-          resolve21({
+          resolve22({
             status: res.statusCode ?? 0,
             body: Buffer.concat(chunks).toString("utf8")
           });
@@ -58126,7 +58331,7 @@ function projectsRoutes(deps) {
 
 // ../host/src/modules/taskflow/server/routes/runs.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { resolve as resolve13 } from "node:path";
+import { resolve as resolve14 } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 var CONFLICT_REASONS = [
   "branch_conflict",
@@ -58263,7 +58468,7 @@ async function apiCreateProjectRun(project, body) {
       permissionMode: body.permissionMode ?? "interactive",
       mcpServers: body.mcpServers ?? [],
       projectRoot: projectDir,
-      workspaceRoot: resolve13(projectDir, config2.workspace.worktreeRoot),
+      workspaceRoot: resolve14(projectDir, config2.workspace.worktreeRoot),
       baseBranch: config2.workspace.mainBranch,
       baseCommit: git2.currentBranch(projectDir),
       agent: config2.workspace.defaultAgent,
@@ -58299,7 +58504,7 @@ async function apiCreateProjectRun(project, body) {
     snapshot: snapshot.snapshot,
     dataRoot: project.runs.dataRoot,
     projectRoot: projectDir,
-    workspaceRoot: resolve13(projectDir, config2.workspace.worktreeRoot),
+    workspaceRoot: resolve14(projectDir, config2.workspace.worktreeRoot),
     baseBranch: config2.workspace.mainBranch,
     baseCommit: git2.currentBranch(projectDir),
     profile,
@@ -58423,9 +58628,9 @@ function runRoutes(deps) {
 
 // ../host/src/modules/taskflow/server/routes/worktrees.ts
 import { mkdirSync as mkdirSync4 } from "node:fs";
-import { writeFile as writeFile5 } from "node:fs/promises";
+import { writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join as join13, resolve as resolve14 } from "node:path";
+import { join as join14, resolve as resolve15 } from "node:path";
 
 // ../host/src/modules/taskflow/services/conversation-export-service.ts
 var TaskflowConversationAttachmentMessageSchema = AgentsUiConversationMessageSchema.extend({
@@ -58969,14 +59174,14 @@ ${resolvedPrompt}` : conversationContext;
     201
   );
 }
-async function apiDeleteWorktree(project, name) {
+async function apiDeleteWorktree(project, name, force) {
   return project.withRemovingBranch(name, async () => {
     log.info(`[worktree:rm] name=${name}`);
     const worktree = project.runtime.projectRuntime.getWorktreeByBranch(name);
     const environmentId = worktree ? environmentIdForWorkspace(project.environments.projectEnvironments(), worktree.worktreeId) : null;
     const environment = environmentId ? project.environments.environmentForProject(environmentId) : null;
     if (environment) await project.environments.destroyEnvironmentRecord(environment);
-    await project.runtime.lifecycleService.removeWorktree(name);
+    await project.runtime.lifecycleService.removeWorktree(name, { force });
     log.debug(`[worktree:rm] done name=${name}`);
     return jsonResponse({ ok: true });
   });
@@ -59130,7 +59335,7 @@ async function apiUploadFiles(project, name, req) {
   }
   const entries = formData.getAll("files");
   if (entries.length === 0) return errorResponse("No files provided", 400);
-  const uploadDir = join13(tmpdir(), RUNTIME_IDENTITY.tempUploadDir, sanitizeFilename(name));
+  const uploadDir = join14(tmpdir(), RUNTIME_IDENTITY.tempUploadDir, sanitizeFilename(name));
   mkdirSync4(uploadDir, { recursive: true });
   const results = [];
   for (const entry of entries) {
@@ -59142,11 +59347,11 @@ async function apiUploadFiles(project, name, req) {
       return errorResponse(`File too large: ${entry.name} (max 10MB)`, 400);
     }
     const safeName = `${Date.now()}_${sanitizeFilename(entry.name)}`;
-    const destPath = join13(uploadDir, safeName);
-    if (!resolve14(destPath).startsWith(`${uploadDir}/`)) {
+    const destPath = join14(uploadDir, safeName);
+    if (!resolve15(destPath).startsWith(`${uploadDir}/`)) {
       return errorResponse("Invalid filename", 400);
     }
-    await writeFile5(destPath, new Uint8Array(await entry.arrayBuffer()));
+    await writeFile6(destPath, new Uint8Array(await entry.arrayBuffer()));
     results.push({ path: destPath });
   }
   log.info(`[upload] branch=${name} files=${results.length}`);
@@ -59163,9 +59368,9 @@ function worktreeRoutes(deps) {
   const app = projectRouter();
   projectRoute(app, deps, "fetchWorktrees", "Worktrees", (project) => apiGetWorktrees(project));
   projectRoute(app, deps, "createWorktree", "Worktrees", (project, { body }) => apiCreateWorktree(project, body));
-  projectRoute(app, deps, "removeWorktree", "Worktrees", (project, { params }) => {
+  projectRoute(app, deps, "removeWorktree", "Worktrees", (project, { params, query: query2 }) => {
     const name = worktreeName(params.name);
-    return name instanceof Response ? name : apiDeleteWorktree(project, name);
+    return name instanceof Response ? name : apiDeleteWorktree(project, name, query2.force === true);
   });
   projectRoute(app, deps, "openWorktree", "Worktrees", (project, { params, body }) => {
     const name = worktreeName(params.name);
@@ -59320,7 +59525,7 @@ function createHostProjects(deps) {
 import { spawn as spawn6 } from "node:child_process";
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { existsSync as existsSync6 } from "node:fs";
-import { dirname as dirname15, join as join28, resolve as resolve20 } from "node:path";
+import { dirname as dirname15, join as join29, resolve as resolve21 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // ../host/src/modules/taskflow/adapters/codex-app-server.ts
@@ -59767,8 +59972,8 @@ var CodexAppServerClient = class {
     }
     const id = this.nextId;
     this.nextId += 1;
-    const result = await new Promise((resolve21, reject2) => {
-      this.pending.set(id, { resolve: resolve21, reject: reject2 });
+    const result = await new Promise((resolve22, reject2) => {
+      this.pending.set(id, { resolve: resolve22, reject: reject2 });
       try {
         this.send({
           id,
@@ -60431,7 +60636,7 @@ function createRunStore(path = defaultRunStorePath()) {
     },
     reserveWorkspace(input2) {
       const strategy = input2.strategy ?? "isolated_worktree";
-      const access3 = input2.access ?? "exclusive_write";
+      const access4 = input2.access ?? "exclusive_write";
       const current = selectRun.get(input2.runId);
       if (!current) return { ok: false, reason: "not_found" };
       const run = toRunRecord(current);
@@ -60446,7 +60651,7 @@ function createRunStore(path = defaultRunStorePath()) {
         reserveWorkspace.run({
           ...input2,
           strategy,
-          access: access3,
+          access: access4,
           canonicalWorkspacePath: strategy === "isolated_worktree" ? input2.canonicalWorkspacePath : null,
           branch: strategy === "isolated_worktree" ? input2.branch : null,
           checkoutCanonicalPath: strategy === "isolated_worktree" ? null : input2.canonicalWorkspacePath,
@@ -60747,16 +60952,16 @@ var DEFAULTS = {
 };
 
 // ../host/src/modules/taskflow/workflows/runtime/journal.ts
-import { appendFileSync, existsSync as existsSync3, mkdirSync as mkdirSync6, readdirSync as readdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname12, join as join14 } from "node:path";
+import { appendFileSync, existsSync as existsSync3, mkdirSync as mkdirSync6, readdirSync as readdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname12, join as join15 } from "node:path";
 function dataRoot(roots = {}) {
   return roots.dataRoot ?? globalPaths().root;
 }
 function runDir(runId, roots = {}) {
-  return join14(dataRoot(roots), "runs", runId);
+  return join15(dataRoot(roots), "runs", runId);
 }
 function journalPath(runId, roots = {}) {
-  return join14(runDir(runId, roots), "journal.jsonl");
+  return join15(runDir(runId, roots), "journal.jsonl");
 }
 function ensureRunDir(runId, roots = {}) {
   const dir = runDir(runId, roots);
@@ -60764,9 +60969,9 @@ function ensureRunDir(runId, roots = {}) {
   return dir;
 }
 function listRunIds(roots = {}) {
-  const dir = join14(dataRoot(roots), "runs");
+  const dir = join15(dataRoot(roots), "runs");
   if (!existsSync3(dir)) return [];
-  return readdirSync2(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && existsSync3(join14(dir, e.name, "journal.jsonl"))).map((e) => e.name).sort().reverse();
+  return readdirSync2(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && existsSync3(join15(dir, e.name, "journal.jsonl"))).map((e) => e.name).sort().reverse();
 }
 var JournalNotFoundError = class extends Error {
   runId;
@@ -60803,7 +61008,7 @@ var Journal = class {
     const path = journalPath(runId, roots);
     const out = { results: /* @__PURE__ */ new Map(), indexByKey: /* @__PURE__ */ new Map() };
     if (!existsSync3(path)) return out;
-    const text = readFileSync6(path, "utf8");
+    const text = readFileSync5(path, "utf8");
     for (const line of text.split("\n")) {
       const trimmed = line.trim();
       if (!trimmed) continue;
@@ -60846,7 +61051,7 @@ function canonicalArgs(value) {
 }
 function writeResult(runId, value, roots = {}) {
   const dir = ensureRunDir(runId, roots);
-  writeFileSync3(join14(dir, "result.json"), JSON.stringify(value, null, 2), "utf8");
+  writeFileSync3(join15(dir, "result.json"), JSON.stringify(value, null, 2), "utf8");
 }
 
 // ../host/src/modules/taskflow/workflows/runtime/keys.ts
@@ -61179,7 +61384,7 @@ async function runInSandbox(opts) {
 }
 function raceLifecycle(work, signal, execTimeoutMs) {
   if (!signal && !execTimeoutMs) return work;
-  return new Promise((resolve21, reject2) => {
+  return new Promise((resolve22, reject2) => {
     let settled = false;
     let timer;
     const cleanup = () => {
@@ -61210,7 +61415,7 @@ function raceLifecycle(work, signal, execTimeoutMs) {
       timer.unref?.();
     }
     work.then(
-      (v) => finish(() => resolve21(v)),
+      (v) => finish(() => resolve22(v)),
       (e) => finish(() => reject2(e))
     );
   });
@@ -61218,13 +61423,13 @@ function raceLifecycle(work, signal, execTimeoutMs) {
 
 // ../host/src/modules/taskflow/workflows/runtime/run.ts
 import { createHash as createHash8, randomBytes as randomBytes2 } from "node:crypto";
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join21, resolve as resolve16 } from "node:path";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join22, resolve as resolve17 } from "node:path";
 
 // ../host/src/modules/taskflow/workflows/worker/claude.ts
 import { readlinkSync, realpathSync as realpathSync2 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { basename as basename7, dirname as dirname13, isAbsolute as isAbsolute3, join as join15, relative as relative3, resolve as resolve15 } from "node:path";
+import { basename as basename8, dirname as dirname13, isAbsolute as isAbsolute3, join as join16, relative as relative4, resolve as resolve16 } from "node:path";
 
 // ../host/src/modules/taskflow/workflows/worker/index.ts
 var AgentError = class extends Error {
@@ -61616,10 +61821,10 @@ function checkTool(sandbox, cwd, toolName2, input2) {
   return void 0;
 }
 function withinCwd(cwd, candidate) {
-  const base = realpathUpward(resolve15(cwd));
-  const target = realpathUpward(isAbsolute3(candidate) ? resolve15(candidate) : resolve15(resolve15(cwd), candidate));
+  const base = realpathUpward(resolve16(cwd));
+  const target = realpathUpward(isAbsolute3(candidate) ? resolve16(candidate) : resolve16(resolve16(cwd), candidate));
   if (target === base) return true;
-  const rel = relative3(base, target);
+  const rel = relative4(base, target);
   return rel !== "" && !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function realpathUpward(p) {
@@ -61628,18 +61833,18 @@ function realpathUpward(p) {
   for (let hops = 0; hops < 40; hops++) {
     try {
       const real = realpathSync2(existing);
-      return suffix ? join15(real, suffix) : real;
+      return suffix ? join16(real, suffix) : real;
     } catch {
     }
     try {
       const link = readlinkSync(existing);
-      existing = isAbsolute3(link) ? resolve15(link) : resolve15(dirname13(existing), link);
+      existing = isAbsolute3(link) ? resolve16(link) : resolve16(dirname13(existing), link);
       continue;
     } catch {
     }
     const parent = dirname13(existing);
     if (parent === existing) return p;
-    suffix = suffix ? join15(basename7(existing), suffix) : basename7(existing);
+    suffix = suffix ? join16(basename8(existing), suffix) : basename8(existing);
     existing = parent;
   }
   return p;
@@ -61749,7 +61954,7 @@ function unquote(s) {
 }
 function expandHome(p) {
   if (p === "~") return homedir3();
-  if (p.startsWith("~/")) return join15(homedir3(), p.slice(2));
+  if (p.startsWith("~/")) return join16(homedir3(), p.slice(2));
   return p;
 }
 function usageFromResult(last) {
@@ -61770,8 +61975,8 @@ function numOr(v) {
 }
 
 // ../host/src/modules/taskflow/workflows/worker/codex.ts
-import { copyFile, writeFile as writeFile6 } from "node:fs/promises";
-import { basename as basename8, join as join16 } from "node:path";
+import { copyFile, writeFile as writeFile7 } from "node:fs/promises";
+import { basename as basename9, join as join17 } from "node:path";
 
 // ../host/src/modules/taskflow/workflows/worker/codex-protocol.ts
 function isObject2(value) {
@@ -62024,13 +62229,13 @@ var JsonRpcStdioClient = class {
    * error member, and rejects with a timeout if no response arrives in time.
    */
   request(method, params) {
-    return new Promise((resolve21, reject2) => {
+    return new Promise((resolve22, reject2) => {
       if (this.dead || !this.child) {
         reject2(new StdioTransportError("not_writable", "child is not running"));
         return;
       }
       const id = this.allocId();
-      const entry = { resolve: resolve21, reject: reject2 };
+      const entry = { resolve: resolve22, reject: reject2 };
       this.pending.set(id, entry);
       if (this.requestTimeoutMs > 0) {
         entry.timer = setTimeout(() => {
@@ -62243,12 +62448,12 @@ var CodexWorker = class {
   runTurn(ctx, sandbox, cwd, turnParams, forwardProgress, seedUsage) {
     const { threadId } = turnParams;
     let onAbort;
-    const p = new Promise((resolve21, reject2) => {
+    const p = new Promise((resolve22, reject2) => {
       const state = {
         threadId,
         deltaText: "",
         usage: seedUsage ?? emptyUsage(),
-        resolve: resolve21,
+        resolve: resolve22,
         reject: reject2,
         settled: false,
         ctx,
@@ -62519,14 +62724,14 @@ var CodexWorker = class {
   handleImageGeneration(state, item) {
     if (state.sandbox === "read-only") return;
     const rawId = typeof item.id === "string" && item.id.length > 0 ? item.id : "image";
-    const id = basename8(rawId) || "image";
+    const id = basename9(rawId) || "image";
     const savedPath = typeof item.savedPath === "string" ? item.savedPath : void 0;
     const b64 = typeof item.result === "string" ? item.result : void 0;
-    const dest = join16(state.cwd, `${id}.png`);
+    const dest = join17(state.cwd, `${id}.png`);
     const write2 = (async () => {
       try {
         if (savedPath) await copyFile(savedPath, dest);
-        else if (b64) await writeFile6(dest, Buffer.from(b64, "base64"));
+        else if (b64) await writeFile7(dest, Buffer.from(b64, "base64"));
         else return;
         if (state.forwardProgress)
           state.ctx.onProgress({ kind: "tool-result", id, name: "image_generation", output: `saved image \u2192 ${dest}` });
@@ -62832,7 +63037,7 @@ var DEFAULT_STALL_TIMEOUT_MS = 30 * 6e4;
 var DEFAULT_KILL_GRACE_MS = 5e3;
 var DEFAULT_STDERR_LIMIT2 = 16 * 1024;
 function runJsonlSubprocess(o) {
-  return new Promise((resolve21, reject2) => {
+  return new Promise((resolve22, reject2) => {
     if (o.signal.aborted) {
       reject2(new AgentInterrupted());
       return;
@@ -62944,7 +63149,7 @@ function runJsonlSubprocess(o) {
         stdoutBuf = "";
         deliver(rest);
       }
-      settle(() => resolve21({ code, signal: signal ?? null, stderrTail: stderrBuf.trim() }));
+      settle(() => resolve22({ code, signal: signal ?? null, stderrTail: stderrBuf.trim() }));
     });
     o.signal.addEventListener("abort", onAbort, { once: true });
     touch();
@@ -63290,7 +63495,7 @@ function numOf(v) {
 // ../host/src/modules/taskflow/workflows/worker/pi.ts
 import { mkdtempSync, rmSync as rmSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 var PROVIDER3 = "pi";
 var PI_MIN_VERSION = "0.79.1";
 var EFFORT_TO_THINKING = {
@@ -63405,7 +63610,7 @@ var PiWorker = class {
     return this.versionCheck;
   }
   async checkVersion() {
-    const scratch = mkdtempSync(join17(tmpdir2(), `${APP_SLUG}-pi-version-`));
+    const scratch = mkdtempSync(join18(tmpdir2(), `${APP_SLUG}-pi-version-`));
     let out;
     try {
       out = await captureStdout({
@@ -63638,7 +63843,7 @@ var DefaultWorkerFactory = class {
 };
 
 // ../host/src/modules/taskflow/workflows/runtime/event-sink.ts
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 
 // ../host/src/modules/taskflow/workflows/runtime/jsonl-writer.ts
 import { createWriteStream, mkdirSync as mkdirSync7 } from "node:fs";
@@ -63674,12 +63879,12 @@ var JsonlWriter = class {
     }
   }
   close() {
-    return new Promise((resolve21) => {
+    return new Promise((resolve22) => {
       if (this.dead) {
-        resolve21();
+        resolve22();
         return;
       }
-      this.stream.end(() => resolve21());
+      this.stream.end(() => resolve22());
     });
   }
 };
@@ -63694,7 +63899,7 @@ var FileEventSink = class {
   listeners;
   clock;
   constructor(runId, opts = {}) {
-    this.writer = new JsonlWriter(join18(runDir(runId, opts.roots), "events.jsonl"), { flags: "a" });
+    this.writer = new JsonlWriter(join19(runDir(runId, opts.roots), "events.jsonl"), { flags: "a" });
     this.listeners = opts.listeners ?? [];
     this.clock = opts.clock ?? (() => globalThis.Date.now());
   }
@@ -63758,7 +63963,7 @@ var Semaphore = class {
       this.active++;
       return this.makeRelease();
     }
-    await new Promise((resolve21) => this.queue.push(resolve21));
+    await new Promise((resolve22) => this.queue.push(resolve22));
     return this.makeRelease();
   }
   makeRelease() {
@@ -63785,15 +63990,15 @@ var Semaphore = class {
 };
 
 // ../host/src/modules/taskflow/workflows/runtime/transcript.ts
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 function agentsDir(runId, roots = {}) {
-  return join19(runDir(runId, roots), "agents");
+  return join20(runDir(runId, roots), "agents");
 }
 function agentTranscriptPath(runId, index, roots = {}) {
-  return join19(agentsDir(runId, roots), `${index}.jsonl`);
+  return join20(agentsDir(runId, roots), `${index}.jsonl`);
 }
 function agentTranscriptPathByName(runId, name, roots = {}) {
-  return join19(agentsDir(runId, roots), `${sanitizeName(name)}.jsonl`);
+  return join20(agentsDir(runId, roots), `${sanitizeName(name)}.jsonl`);
 }
 var TEXT_FLUSH_MS = 120;
 var TEXT_FLUSH_BYTES = 2048;
@@ -63875,7 +64080,7 @@ function sanitizeName(name) {
 // ../host/src/modules/taskflow/workflows/runtime/worktree.ts
 import { execFile } from "node:child_process";
 import { existsSync as existsSync4, rmSync as rmSync3 } from "node:fs";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 import { promisify } from "node:util";
 var exec = promisify(execFile);
 var BASE_CONFIG_KEY = RUNTIME_IDENTITY.gitBaseConfigKey;
@@ -63893,10 +64098,10 @@ async function findGitRoot(cwd) {
 async function createWorktree(args) {
   const name = `${args.runId}-${args.index}`;
   const branch = args.branch ?? `aw/${name}`;
-  const path = join20(projectPaths(args.gitRoot).worktrees, name);
+  const path = join21(projectPaths(args.gitRoot).worktrees, name);
   const base = await git(args.gitRoot, ["rev-parse", "HEAD"]);
   await pruneStaleWorktree(args.gitRoot, path);
-  await git(args.gitRoot, ["worktree", "add", "--detach", path, base]);
+  await git(args.gitRoot, ["worktree", "add", "--relative-paths", "--detach", path, base]);
   await git(path, ["checkout", "-B", branch]);
   try {
     await git(path, ["config", BASE_CONFIG_KEY, base]);
@@ -64616,8 +64821,8 @@ function fmtDur(ms) {
 // ../host/src/modules/taskflow/workflows/runtime/run.ts
 var HEARTBEAT_MS = 5e3;
 async function runWorkflow(opts) {
-  const filePath = resolve16(opts.file);
-  const source = readFileSync7(filePath, "utf8");
+  const filePath = resolve17(opts.file);
+  const source = readFileSync6(filePath, "utf8");
   const fileHash = sha2562(source);
   const findings = determinismLint(source);
   if (findings.length > 0) {
@@ -64674,7 +64879,7 @@ async function runWorkflow(opts) {
   if (opts.signal?.aborted) ac.abort();
   else opts.signal?.addEventListener("abort", onSig, { once: true });
   events.emit({ type: "run", status: "started", runId, workflowFile: filePath });
-  const heartbeatFile = join21(runDir(runId, opts.roots), ".heartbeat");
+  const heartbeatFile = join22(runDir(runId, opts.roots), ".heartbeat");
   const beat = () => {
     try {
       writeFileSync4(heartbeatFile, String(Date.now()));
@@ -64753,7 +64958,7 @@ function resolveDefaults(meta3, opts) {
     effort: o.effort,
     sandbox,
     approval: DEFAULTS.approval,
-    cwd: resolve16(configuredCwd ?? process.cwd()),
+    cwd: resolve17(configuredCwd ?? process.cwd()),
     concurrency,
     maxAgents: DEFAULTS.maxAgents,
     maxFanout: DEFAULTS.maxFanout,
@@ -65020,7 +65225,7 @@ var AgentSupervisorClient = class {
     throw new Error("Taskflow runtime supervisor did not become available");
   }
   send(request2) {
-    return new Promise((resolve21, reject2) => {
+    return new Promise((resolve22, reject2) => {
       const socket = createConnection2(this.deps.socketPath);
       let data = "";
       socket.setEncoding("utf8");
@@ -65041,7 +65246,7 @@ var AgentSupervisorClient = class {
         }
         try {
           const response = responseResult(JSON.parse(line));
-          resolve21(response.result);
+          resolve22(response.result);
         } catch (error61) {
           reject2(error61);
         }
@@ -65664,8 +65869,8 @@ var EnvironmentDiagnosticsService = class {
       return check2("github", "GitHub", "error", true, "GitHub CLI is not authenticated", "Run gh auth login");
     }
     for (const linked of this.deps.config.integrations.github.linkedRepos) {
-      const access3 = await this.runCommand(gh, ["repo", "view", linked.repo, "--json", "nameWithOwner"]);
-      if (!access3.ok) {
+      const access4 = await this.runCommand(gh, ["repo", "view", linked.repo, "--json", "nameWithOwner"]);
+      if (!access4.ok) {
         return check2(
           "github",
           "GitHub",
@@ -65762,7 +65967,7 @@ var EnvironmentDiagnosticsService = class {
 // ../host/src/modules/taskflow/services/environment-worker-factory.ts
 import { chmodSync as chmodSync2, mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join22, posix as posix2, relative as relative4 } from "node:path";
+import { join as join23, posix as posix2, relative as relative5 } from "node:path";
 var executableByProvider = {
   codex: "codex",
   "claude-code": "claude",
@@ -65789,7 +65994,7 @@ var MappedWorkspaceWorker = class {
   }
 };
 function mapAgentSpecToEnvironment(spec, hostWorkspace, containerWorkspace) {
-  const suffix = relative4(hostWorkspace, spec.cwd);
+  const suffix = relative5(hostWorkspace, spec.cwd);
   if (suffix.startsWith("..")) {
     throw new Error(`Execution workspace is outside the environment mount: ${spec.cwd}`);
   }
@@ -65810,10 +66015,10 @@ var EnvironmentWorkerFactory = class {
     this.handle = handle;
     const containerWorkspace = handle.workspace.containerPath;
     if (!containerWorkspace) throw new Error(`Environment has no container workspace: ${handle.id}`);
-    this.directory = mkdtempSync2(join22(tmpdir3(), "taskflow-environment-workers-"));
+    this.directory = mkdtempSync2(join23(tmpdir3(), "taskflow-environment-workers-"));
     const paths = Object.fromEntries(
       Object.entries(executableByProvider).map(([provider, executable]) => {
-        const path = join22(this.directory, provider);
+        const path = join23(this.directory, provider);
         writeFileSync5(path, transport.executableShim(handle, executable), { encoding: "utf8", mode: 448 });
         chmodSync2(path, 448);
         return [provider, path];
@@ -65845,8 +66050,8 @@ var RoutingEnvironmentWorker = class {
   id;
   resolve;
   factoryFor;
-  constructor(id, resolve21, factoryFor) {
-    this.resolve = resolve21;
+  constructor(id, resolve22, factoryFor) {
+    this.resolve = resolve22;
     this.factoryFor = factoryFor;
     this.id = id;
   }
@@ -65863,8 +66068,8 @@ var RoutingEnvironmentWorkerFactory = class {
   workers = /* @__PURE__ */ new Map();
   resolve;
   onShutdown;
-  constructor(resolve21, onShutdown) {
-    this.resolve = resolve21;
+  constructor(resolve22, onShutdown) {
+    this.resolve = resolve22;
     this.onShutdown = onShutdown;
   }
   get(id) {
@@ -65890,11 +66095,11 @@ var RoutingEnvironmentWorkerFactory = class {
 };
 
 // ../host/src/modules/taskflow/services/execution-transcript-service.ts
-import { readFile as readFile7 } from "node:fs/promises";
-import { basename as basename9, dirname as dirname14, isAbsolute as isAbsolute4, normalize } from "node:path";
+import { readFile as readFile8 } from "node:fs/promises";
+import { basename as basename10, dirname as dirname14, isAbsolute as isAbsolute4, normalize } from "node:path";
 
 // ../host/src/modules/taskflow/services/codex-session-log-service.ts
-import { readFile as readFile6 } from "node:fs/promises";
+import { readFile as readFile7 } from "node:fs/promises";
 var TOOL_OUTPUT_TRUNCATE_LIMIT = 12e3;
 function readString3(raw2) {
   return typeof raw2 === "string" && raw2.length > 0 ? raw2 : null;
@@ -66155,7 +66360,7 @@ function parseCodexSessionMessages(text) {
 async function readCodexSessionMessages(thread) {
   if (!thread.path) return [];
   try {
-    return parseCodexSessionMessages(await readFile6(thread.path, "utf8"));
+    return parseCodexSessionMessages(await readFile7(thread.path, "utf8"));
   } catch {
     return [];
   }
@@ -66171,7 +66376,7 @@ function transcriptPath(value, engineRunId) {
   const path = normalize(candidate);
   const agents = dirname14(path);
   const run = dirname14(agents);
-  if (basename9(agents) !== "agents" || basename9(run) !== engineRunId || basename9(dirname14(run)) !== "runs" || !basename9(path).endsWith(".jsonl"))
+  if (basename10(agents) !== "agents" || basename10(run) !== engineRunId || basename10(dirname14(run)) !== "runs" || !basename10(path).endsWith(".jsonl"))
     return null;
   return path;
 }
@@ -66225,7 +66430,7 @@ var ExecutionTranscriptService = class {
     if (path === null) return { ok: false, reason: "unavailable" };
     let bytes;
     try {
-      bytes = await readFile7(path);
+      bytes = await readFile8(path);
     } catch (error61) {
       if (error61.code !== "ENOENT") return { ok: false, reason: "unavailable" };
       return { ok: true, response: { executionId, entries: [], nextCursor: 0 } };
@@ -66259,7 +66464,7 @@ var ExecutionTranscriptService = class {
     if (!path) return { ok: false, reason: "unavailable" };
     let text;
     try {
-      text = await readFile7(path, "utf8");
+      text = await readFile8(path, "utf8");
     } catch {
       return { ok: false, reason: "unavailable" };
     }
@@ -66845,12 +67050,12 @@ var RunPresentationService = class {
 };
 
 // ../host/src/modules/taskflow/services/run-service.ts
-import { readFile as readFile8 } from "node:fs/promises";
-import { join as join24 } from "node:path";
+import { readFile as readFile9 } from "node:fs/promises";
+import { join as join25 } from "node:path";
 
 // ../host/src/modules/taskflow/services/workspace-facade.ts
-import { join as join23 } from "node:path";
-function workspaceBindingFor(runId, projectRoot2, workspaceRoot, baseBranch, baseCommit, workspace, access3) {
+import { join as join24 } from "node:path";
+function workspaceBindingFor(runId, projectRoot2, workspaceRoot, baseBranch, baseCommit, workspace, access4) {
   const segment = runId.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "run";
   if (workspace.strategy !== "isolated_worktree") {
     const branch = workspace.strategy === "current_branch" ? "" : workspace.branch?.trim() || `${APP_SLUG}/run-${segment}`;
@@ -66862,11 +67067,11 @@ function workspaceBindingFor(runId, projectRoot2, workspaceRoot, baseBranch, bas
       baseBranch: workspace.strategy === "new_branch" ? workspace.baseBranch?.trim() || baseBranch : baseBranch,
       baseCommit,
       strategy: workspace.strategy,
-      access: access3
+      access: access4
     };
   }
   const name = `${APP_SLUG}-run-${segment}`;
-  const path = join23(workspaceRoot, name);
+  const path = join24(workspaceRoot, name);
   return {
     workspaceId: `workspace_${runId}`,
     path,
@@ -66875,7 +67080,7 @@ function workspaceBindingFor(runId, projectRoot2, workspaceRoot, baseBranch, bas
     baseBranch: workspace.baseBranch?.trim() || baseBranch,
     baseCommit,
     strategy: workspace.strategy,
-    access: access3
+    access: access4
   };
 }
 function slugSegment(value, fallback) {
@@ -66884,7 +67089,7 @@ function slugSegment(value, fallback) {
 function forkBindingFor(run, workspaceRoot, slug2) {
   const runSegment = slugSegment(run.id, "run");
   const forkSegment = slugSegment(slug2, "fork");
-  const path = join23(workspaceRoot, `${APP_SLUG}-run-${runSegment}-fork-${forkSegment}`);
+  const path = join24(workspaceRoot, `${APP_SLUG}-run-${runSegment}-fork-${forkSegment}`);
   return {
     workspaceId: `workspace_lease_${run.id}_${forkSegment}`,
     path,
@@ -66936,7 +67141,7 @@ var WorkspaceFacade = class {
     if (run === null) return { ok: false, reason: "not_found" };
     if (run.workspacePolicy === "none") return { ok: true, run, workspace: null, replayed: true };
     const workspace = input2.workspace ?? { strategy: "isolated_worktree" };
-    const access3 = input2.access ?? "exclusive_write";
+    const access4 = input2.access ?? "exclusive_write";
     const currentBranch = this.deps.git.currentBranch(input2.projectRoot);
     if (workspace.strategy === "current_branch" && currentBranch.length === 0)
       return { ok: false, reason: "detached_head" };
@@ -66952,7 +67157,7 @@ var WorkspaceFacade = class {
       effectiveBase,
       baseCommit,
       workspace,
-      access3
+      access4
     );
     if (workspace.strategy === "current_branch") binding.branch = currentBranch;
     if (workspace.strategy !== "isolated_worktree") {
@@ -66960,7 +67165,7 @@ var WorkspaceFacade = class {
         runId: input2.runId,
         projectId: run.projectId,
         canonicalPath: binding.canonicalPath,
-        access: access3,
+        access: access4,
         createdAt: this.now().toISOString()
       });
       if (!claim2.ok) return { ok: false, reason: "checkout_busy" };
@@ -67827,7 +68032,7 @@ var RunService = class {
         root,
         terminal.cursor,
         terminal.type === "completed" ? "completed" : active.cancelling ? "cancelled" : "failed",
-        terminal.type === "completed" ? { resultPath: join24(root.dataRoot, "runs", engineRunId, "result.json") } : null
+        terminal.type === "completed" ? { resultPath: join25(root.dataRoot, "runs", engineRunId, "result.json") } : null
       );
     const completedAt = this.now().toISOString();
     if (terminal.type === "completed") {
@@ -67939,7 +68144,7 @@ var RunService = class {
   async completedResult(engineRunId, dataRoot2) {
     try {
       const result = JsonValueSchema.safeParse(
-        JSON.parse(await readFile8(join24(dataRoot2, "runs", engineRunId, "result.json"), "utf8"))
+        JSON.parse(await readFile9(join25(dataRoot2, "runs", engineRunId, "result.json"), "utf8"))
       );
       return result.success ? result.data : null;
     } catch {
@@ -67986,12 +68191,12 @@ var RunService = class {
 };
 
 // ../host/src/modules/taskflow/services/session-restore-service.ts
-import { basename as basename10, resolve as resolve17 } from "node:path";
+import { basename as basename11, resolve as resolve18 } from "node:path";
 function entryBranch(entry) {
-  return entry.branch ?? basename10(entry.path);
+  return entry.branch ?? basename11(entry.path);
 }
 function computeOpenBranches(input2) {
-  const resolvedProjectDir = resolve17(input2.projectDir);
+  const resolvedProjectDir = resolve18(input2.projectDir);
   const openWindowNames = new Set(
     input2.windows.filter((window) => window.sessionName === input2.sessionName).map((window) => window.windowName)
   );
@@ -68006,7 +68211,7 @@ function buildOpenSessionsState(branches, savedAt) {
 }
 var DEFAULT_SESSION_SNAPSHOT_INTERVAL_MS = 3e4;
 async function saveOpenSessionsSnapshot(deps) {
-  const projectRoot2 = resolve17(deps.projectRoot);
+  const projectRoot2 = resolve18(deps.projectRoot);
   const sessionName = buildProjectSessionName(projectRoot2);
   let windows = [];
   try {
@@ -68313,8 +68518,8 @@ var TaskflowDirectSessionService = class {
 
 // ../host/src/modules/taskflow/services/workflow-catalog-service.ts
 import { createHash as createHash9 } from "node:crypto";
-import { readdir as readdir4, readFile as readFile9, stat as stat4 } from "node:fs/promises";
-import { join as join25, resolve as resolve18 } from "node:path";
+import { readdir as readdir4, readFile as readFile10, stat as stat4 } from "node:fs/promises";
+import { join as join26, resolve as resolve19 } from "node:path";
 var MAX_WORKFLOW_BYTES = 524288;
 function hash3(value) {
   return `sha256:${createHash9("sha256").update(value).digest("hex")}`;
@@ -68358,9 +68563,9 @@ function duplicateDiagnostic(name, origin) {
 }
 function rootsFor(config2) {
   return [
-    { origin: "project", directory: projectPaths(resolve18(config2.projectRoot)).workflows, priority: 0 },
-    { origin: "global", directory: join25(resolve18(config2.taskflowHome), PATH_NAMES.workflows), priority: 1 },
-    { origin: "builtin", directory: resolve18(config2.builtinRoot), priority: 2 }
+    { origin: "project", directory: projectPaths(resolve19(config2.projectRoot)).workflows, priority: 0 },
+    { origin: "global", directory: join26(resolve19(config2.taskflowHome), PATH_NAMES.workflows), priority: 1 },
+    { origin: "builtin", directory: resolve19(config2.builtinRoot), priority: 2 }
   ];
 }
 var WorkflowCatalogService = class {
@@ -68465,7 +68670,7 @@ var WorkflowCatalogService = class {
       return { candidates, diagnostics, invalidEntries };
     }
     for (const name of names) {
-      const path = join25(root.directory, name);
+      const path = join26(root.directory, name);
       try {
         if ((await stat4(path)).size > MAX_WORKFLOW_BYTES) {
           const diagnostic = {
@@ -68478,14 +68683,14 @@ var WorkflowCatalogService = class {
           invalidEntries.push({ status: "invalid", origin: root.origin, path, diagnostic });
           continue;
         }
-        const source = await readFile9(path, "utf8");
+        const source = await readFile10(path, "utf8");
         const parsed = parseWorkflow(source);
         const definition = {
-          id: `${root.origin}:${hash3(resolve18(path))}`,
+          id: `${root.origin}:${hash3(resolve19(path))}`,
           name: parsed.meta.name,
           description: parsed.meta.description,
           origin: root.origin,
-          path: resolve18(path),
+          path: resolve19(path),
           contentHash: hash3(source),
           source,
           metadata: metadataFor(parsed.meta, this.keyVersion),
@@ -68508,7 +68713,7 @@ var WorkflowCatalogService = class {
 };
 
 // ../host/src/modules/taskflow/services/workflow-event-bridge.ts
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 function record4(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
   const output2 = {};
@@ -68598,7 +68803,7 @@ function executionFor(run, existing, details, context) {
       key: details.key,
       index: details.index,
       phaseIndex: details.phaseIndex,
-      transcriptPath: context ? join26(context.dataRoot, "runs", context.engineRunId, "agents", `${details.index}.jsonl`) : null
+      transcriptPath: context ? join27(context.dataRoot, "runs", context.engineRunId, "agents", `${details.index}.jsonl`) : null
     },
     workspaceId: run.workspaceId,
     input: existing?.input ?? null,
@@ -68658,8 +68863,8 @@ var WorkflowEventBridge = class {
 };
 
 // ../host/src/modules/taskflow/services/workflow-runner.ts
-import { mkdir as mkdir5, writeFile as writeFile7 } from "node:fs/promises";
-import { join as join27 } from "node:path";
+import { mkdir as mkdir5, writeFile as writeFile8 } from "node:fs/promises";
+import { join as join28 } from "node:path";
 function envelope(spec, message) {
   return {
     ...message,
@@ -68693,10 +68898,10 @@ var NodeWorkflowRunner = class {
     const pid = process.pid;
     let heartbeat;
     const done = (async () => {
-      const runDirectory = join27(spec.spec.dataRoot, "runs", spec.engineRunId);
+      const runDirectory = join28(spec.spec.dataRoot, "runs", spec.engineRunId);
       await mkdir5(runDirectory, { recursive: true });
-      const snapshotPath = join27(runDirectory, "workflow.js");
-      await writeFile7(snapshotPath, spec.spec.source, "utf8");
+      const snapshotPath = join28(runDirectory, "workflow.js");
+      await writeFile8(snapshotPath, spec.spec.source, "utf8");
       emit(envelope(spec, { type: "started", pid }));
       heartbeat = setInterval(() => {
         emit(envelope(spec, { type: "heartbeat", cursor }));
@@ -69368,16 +69573,16 @@ var WorktreeConversationService = class {
 
 // ../host/src/modules/taskflow/adapters/docker-compose-environment.ts
 import { createHash as createHash10 } from "node:crypto";
-import { existsSync as existsSync5, readFileSync as readFileSync8 } from "node:fs";
-import { resolve as resolve19 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync7 } from "node:fs";
+import { resolve as resolve20 } from "node:path";
 var COMPOSE_FILENAMES = ["compose.yaml", "compose.yml", "docker-compose.yaml", "docker-compose.yml"];
 function composeFile(workspacePath, configured) {
   if (configured) {
-    const candidate = resolve19(workspacePath, configured);
+    const candidate = resolve20(workspacePath, configured);
     if (existsSync5(candidate)) return candidate;
     throw new Error(`Docker Compose file does not exist: ${configured}`);
   }
-  const found = COMPOSE_FILENAMES.map((file2) => resolve19(workspacePath, file2)).find(existsSync5);
+  const found = COMPOSE_FILENAMES.map((file2) => resolve20(workspacePath, file2)).find(existsSync5);
   if (!found) throw new Error("No Docker Compose file was found");
   return found;
 }
@@ -69398,7 +69603,7 @@ var DockerComposeEnvironmentProvider = class {
   }
   async probe(context) {
     const version2 = await runCaptured(this.runner, { command: "docker", args: ["compose", "version", "--short"] });
-    const configs = COMPOSE_FILENAMES.map((file2) => resolve19(context.workspacePath, file2)).filter(existsSync5);
+    const configs = COMPOSE_FILENAMES.map((file2) => resolve20(context.workspacePath, file2)).filter(existsSync5);
     return {
       provider: this.id,
       available: version2.exit.code === 0 && configs.length > 0,
@@ -69409,7 +69614,7 @@ var DockerComposeEnvironmentProvider = class {
   }
   async resolve(context) {
     const file2 = composeFile(context.workspacePath, context.configRef);
-    const source = readFileSync8(file2, "utf8");
+    const source = readFileSync7(file2, "utf8");
     return {
       provider: this.id,
       configRef: file2,
@@ -70021,11 +70226,11 @@ var LocalDatagramForwardProvider = class {
       void this.pipeResponse(command.stdout, socket, remote);
       void command.exited.finally(() => commands.delete(command));
     });
-    await new Promise((resolve21, reject2) => {
+    await new Promise((resolve22, reject2) => {
       socket.once("error", reject2);
       socket.bind(0, "127.0.0.1", () => {
         socket.off("error", reject2);
-        resolve21();
+        resolve22();
       });
     });
     const address = socket.address();
@@ -70049,8 +70254,8 @@ var LocalDatagramForwardProvider = class {
     if (!active) return;
     this.active.delete(endpointId);
     await Promise.all(Array.from(active.commands, (command) => command.kill()));
-    await new Promise((resolve21) => {
-      active.socket.close(() => resolve21());
+    await new Promise((resolve22) => {
+      active.socket.close(() => resolve22());
     });
   }
   async close() {
@@ -70127,11 +70332,11 @@ var LocalForwardProvider = class {
         }
       });
     });
-    await new Promise((resolve21, reject2) => {
+    await new Promise((resolve22, reject2) => {
       server.once("error", reject2);
       server.listen(0, "127.0.0.1", () => {
         server.off("error", reject2);
-        resolve21();
+        resolve22();
       });
     });
     const address = server.address();
@@ -70157,8 +70362,8 @@ var LocalForwardProvider = class {
     if (!active) return;
     this.active.delete(endpointId);
     for (const socket of active.sockets) socket.destroy();
-    await new Promise((resolve21) => {
-      active.server.close(() => resolve21());
+    await new Promise((resolve22) => {
+      active.server.close(() => resolve22());
     });
   }
   async close() {
@@ -70775,13 +70980,13 @@ function createProjectApp(runtime, instancePrefix, host) {
   const workflowEvents = new WorkflowEventBridge({ store: runStore, publisher: runEventPublisher });
   const workspaces = new WorkspaceFacade({ store: runStore, git: git2 });
   const workflowDataRoot = globalPaths().root;
-  const supervisorSocket = join28(workflowDataRoot, "runtime", "supervisor.sock");
+  const supervisorSocket = join29(workflowDataRoot, "runtime", "supervisor.sock");
   const supervisor = new AgentSupervisorClient({
     socketPath: supervisorSocket,
     startDaemon: () => {
       const directory = dirname15(fileURLToPath(import.meta.url));
-      const builtEntry = join28(directory, "supervisor.js");
-      const sourceEntry = join28(directory, "supervisor.ts");
+      const builtEntry = join29(directory, "supervisor.js");
+      const sourceEntry = join29(directory, "supervisor.ts");
       const child = existsSync6(builtEntry) ? spawn6(process.execPath, [builtEntry], { detached: true, stdio: "ignore" }) : spawn6(process.execPath, ["--import", "tsx", sourceEntry], { detached: true, stdio: "ignore" });
       child.unref();
     }
@@ -71067,7 +71272,7 @@ function createProjectApp(runtime, instancePrefix, host) {
       startupEnvs: config2.startupEnvs,
       linkedRepos: config2.integrations.github.linkedRepos.map((lr) => ({
         alias: lr.alias,
-        ...lr.dir ? { dir: resolve20(PROJECT_DIR, lr.dir) } : {}
+        ...lr.dir ? { dir: resolve21(PROJECT_DIR, lr.dir) } : {}
       })),
       linearAutoCreateWorktrees: linearAutoCreateEnabled,
       autoRemoveOnMerge: autoRemoveOnMergeEnabled,
@@ -71153,13 +71358,13 @@ function createProjectApp(runtime, instancePrefix, host) {
     }
   }
   async function getWorktreeGitDirs() {
-    const gitDirs = /* @__PURE__ */ new Map();
-    const projectRoot2 = resolve20(PROJECT_DIR);
+    const gitDirs2 = /* @__PURE__ */ new Map();
+    const projectRoot2 = resolve21(PROJECT_DIR);
     for (const entry of git2.listLiveWorktrees(projectRoot2)) {
       if (entry.bare || sameFsPath(entry.path, projectRoot2) || !entry.branch) continue;
-      gitDirs.set(entry.branch, git2.resolveWorktreeGitDir(entry.path));
+      gitDirs2.set(entry.branch, git2.resolveWorktreeGitDir(entry.path));
     }
-    return gitDirs;
+    return gitDirs2;
   }
   async function readProjectSnapshot() {
     const linearApiKey = process.env.LINEAR_API_KEY;
@@ -72223,7 +72428,7 @@ function createDaemonTaskflowHost(context) {
       port: hostListen(env2).port,
       workflowBuiltinsDir: taskflowAssets(env2).workflowBuiltinsDir,
       version: env2.PORTTA_VERSION || "0.0.0-local",
-      buildDate: true ? "2026-09-17T17:01:02Z" : (/* @__PURE__ */ new Date()).toISOString(),
+      buildDate: true ? "2026-09-18T00:00:48Z" : (/* @__PURE__ */ new Date()).toISOString(),
       environmentStore: createEnvironmentStore(paths.database),
       hostEnvironmentProvider: new HostEnvironmentProvider(),
       devContainerProvider: new DevContainerProvider(),
@@ -72702,7 +72907,7 @@ var readBodyDirect = (request2) => {
     request2[bodyBufferKey] = buffered;
     return Promise.resolve(buffered);
   }
-  const promise2 = new Promise((resolve21, reject2) => {
+  const promise2 = new Promise((resolve22, reject2) => {
     const chunks = [];
     let settled = false;
     const finish = (callback) => {
@@ -72720,7 +72925,7 @@ var readBodyDirect = (request2) => {
         else if (recovered === void 0) reject2(error61 ?? normalizeAbortError(request2, incoming));
         else {
           request2[bodyBufferKey] = recovered;
-          resolve21(recovered);
+          resolve22(recovered);
         }
       });
       return true;
@@ -72732,7 +72937,7 @@ var readBodyDirect = (request2) => {
       finish(() => {
         const buffer = chunks.length === 1 ? chunks[0] : Buffer.concat(chunks);
         request2[bodyBufferKey] = buffer;
-        resolve21(buffer);
+        resolve22(buffer);
       });
     };
     const onError = (error61) => {
@@ -73257,7 +73462,7 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
         });
         if (!chunk) {
           if (i === 1) {
-            await new Promise((resolve21) => setTimeout(resolve21));
+            await new Promise((resolve22) => setTimeout(resolve22));
             maxReadCount = 3;
             continue;
           }
@@ -73554,8 +73759,8 @@ var SESSION_ABANDON_AFTER_SECONDS = 6 * 60 * 60;
 var INSTRUCTION_MAX_BYTES = 64 * 1024;
 
 // ../core/src/database-config.ts
-import { join as join29 } from "node:path";
-var DATABASE_RELATIVE_PATH = join29("state", "panel", "portta.db");
+import { join as join30 } from "node:path";
+var DATABASE_RELATIVE_PATH = join30("state", "panel", "portta.db");
 
 // ../../node_modules/ws/wrapper.mjs
 var import_stream = __toESM(require_stream(), 1);
@@ -73611,7 +73816,7 @@ function ghPath() {
 }
 function runGh2(args, options = {}) {
   const binary = ghPath();
-  return new Promise((resolve21, reject2) => {
+  return new Promise((resolve22, reject2) => {
     const child = execFile2(
       binary,
       args,
@@ -73624,7 +73829,7 @@ function runGh2(args, options = {}) {
         env: { ...process.env, GH_PAGER: "cat", NO_COLOR: "1", GH_PROMPT_DISABLED: "1" }
       },
       (error61, stdout, stderr) => {
-        if (!error61) return resolve21(stdout);
+        if (!error61) return resolve22(stdout);
         if (error61.killed) {
           return reject2(new ForgeError("timeout", `gh ${args[0]} ${args[1] ?? ""} took longer than ${TIMEOUT_MS / 1e3}s`));
         }
@@ -74087,11 +74292,11 @@ async function startHost(options) {
   const sockets = new import_websocket_server.default({ noServer: true });
   const server = createServer2(getRequestListener(app.fetch));
   server.on("upgrade", createHostUpgrade(options, sockets));
-  await new Promise((resolve21, reject2) => {
+  await new Promise((resolve22, reject2) => {
     server.once("error", reject2);
     server.listen(options.port, options.host, () => {
       server.off("error", reject2);
-      resolve21();
+      resolve22();
     });
   });
   const address = server.address();
@@ -74102,8 +74307,8 @@ async function startHost(options) {
     close: async () => {
       for (const socket of sockets.clients) socket.close(1001, "the host daemon is shutting down");
       sockets.close();
-      await new Promise((resolve21) => {
-        server.close(() => resolve21());
+      await new Promise((resolve22) => {
+        server.close(() => resolve22());
         server.closeAllConnections();
       });
       for (const module of options.modules) await module.close?.();