@codions/portta 0.0.0-develop.169.sha-64ee68c → 0.0.0-develop.172.sha-10ce987

package/dist/cli.js

@@ -19820,17 +19820,12 @@ function fitLabel(label3, limit = MAX_LABEL) {
   const keep = limit - digest2.length - 1;
   return `${label3.slice(0, keep).replace(/-+$/, "")}-${digest2}`;
 }
-function hostLabel(parts2, style = "project-service") {
+function hostLabel(parts2) {
   const project2 = slug(parts2.project);
   const service2 = slug(parts2.service);
   const context = parts2.context ? slug(parts2.context) : "";
-  if (style === "project-service") {
-    const base2 = service2 ? `${project2}-${service2}` : project2;
-    return fitLabel(context ? `${base2}${COMPONENT_SEPARATOR}${context}` : base2);
-  }
-  const components = [service2, project2];
-  if (context) components.push(context);
-  return fitLabel(components.filter(Boolean).join(COMPONENT_SEPARATOR));
+  const base2 = service2 ? `${project2}-${service2}` : project2;
+  return fitLabel(context ? `${base2}${COMPONENT_SEPARATOR}${context}` : base2);
 }
 var MAX_LABEL, COMPONENT_SEPARATOR;
 var init_hostname = __esm({
@@ -20014,10 +20009,6 @@ function composeFiles(config3) {
   if (config3.tunnelEnabled) files.push("docker/compose/features/cloudflare-tunnel.yaml");
   return files;
 }
-function composeFilesForRoot(config3, root2) {
-  void root2;
-  return composeFiles(config3);
-}
 var AUTH_BUILD_FILE, AUTH_DEV_FILE, TASKFLOW_FILE, PANEL_HOST_FILE, TRUTHY, GATEWAY_PROFILES, PANEL_ACCESS_MODES, PANEL_ACCESS_WITHOUT_AUTH, PANEL_AUTH_MODES;
 var init_config = __esm({
   "../core/src/config.ts"() {
@@ -20354,7 +20345,6 @@ var BRIDGE_IMAGE, KIND_RULES;
 var init_discovery = __esm({
   "../core/src/discovery.ts"() {
     "use strict";
-    init_namespace();
     BRIDGE_IMAGE = "alpine/socat:1.8.1.3";
     KIND_RULES = [
       { match: /postgres|postgis|timescale/, kind: "postgres", port: 5432 },
@@ -20373,7 +20363,6 @@ var init_discovery = __esm({
 });
 
 // ../core/src/endpoints.ts
-var PROVIDERS, PROVIDERS_BY_ID;
 var init_endpoints = __esm({
   "../core/src/endpoints.ts"() {
     "use strict";
@@ -20381,19 +20370,6 @@ var init_endpoints = __esm({
     init_discovery();
     init_domain();
     init_hostname();
-    PROVIDERS = [
-      { id: "internal", scope: "internal", requires: null, optional: false },
-      { id: "local", scope: "local", requires: "localhost", optional: false },
-      { id: "lan", scope: "lan", requires: "lan", optional: true },
-      { id: "tailscale", scope: "private", requires: "tailscale", optional: true },
-      { id: "tailscale-serve", scope: "private", requires: "tailscale-https", optional: true },
-      { id: "public-ip", scope: "public", requires: "public-ipv4", optional: true },
-      { id: "auto-domain", scope: "public", requires: "auto-domain", optional: true },
-      { id: "custom-domain", scope: "public", requires: "custom-domain", optional: true },
-      { id: "cloudflare-tunnel", scope: "public", requires: "cloudflare-tunnel", optional: true },
-      { id: "bridge", scope: "local", requires: null, optional: true }
-    ];
-    PROVIDERS_BY_ID = new Map(PROVIDERS.map((spec) => [spec.id, spec]));
   }
 });
 
@@ -20575,15 +20551,6 @@ var init_env = __esm({
   }
 });
 
-// ../core/src/host.ts
-var MIB;
-var init_host = __esm({
-  "../core/src/host.ts"() {
-    "use strict";
-    MIB = 1024 * 1024;
-  }
-});
-
 // ../core/src/host-security.ts
 function permissionProblem(output2) {
   return /permission denied|operation not permitted|must be root|need to be root|requires root|not authorized/i.test(output2) ? "could not be checked: this user does not have permission" : null;
@@ -21311,6 +21278,113 @@ var init_password = __esm({
   }
 });
 
+// ../core/src/project-config.ts
+function hostShape(value3) {
+  if (/:\/\//.test(value3)) return "looks like a URL";
+  if (value3.startsWith("//")) return "looks like a URL";
+  if (value3.startsWith("/")) return "is an absolute path";
+  if (/^[a-z]:[\\/]/i.test(value3)) return "is an absolute path";
+  if (value3.startsWith("~")) return "is a home-relative path, which differs per machine";
+  if (/^\d{1,5}:\d{1,5}$/.test(value3)) return "looks like a published host port";
+  return null;
+}
+function defaultProjectConfig() {
+  return {
+    version: 1,
+    name: null,
+    mainBranch: null,
+    worktrees: {
+      root: PROJECT_CONFIG_DEFAULTS.worktreeRoot,
+      branchPattern: PROJECT_CONFIG_DEFAULTS.branchPattern
+    },
+    stack: [],
+    instructions: []
+  };
+}
+function parseProjectConfig(document) {
+  if (document === null || document === void 0) {
+    return { ok: false, issues: [{ path: "", message: `${PROJECT_CONFIG_FILE} is empty` }] };
+  }
+  const parsed = Schema.safeParse(document);
+  if (!parsed.success) {
+    return {
+      ok: false,
+      issues: parsed.error.issues.map((issue2) => ({
+        path: issue2.path.join("."),
+        message: issue2.message
+      }))
+    };
+  }
+  const value3 = parsed.data;
+  const defaults = defaultProjectConfig();
+  return {
+    ok: true,
+    config: {
+      version: 1,
+      name: value3.name ?? null,
+      mainBranch: value3.mainBranch ?? null,
+      worktrees: {
+        root: value3.worktrees?.root ?? defaults.worktrees.root,
+        branchPattern: value3.worktrees?.branchPattern ?? defaults.worktrees.branchPattern
+      },
+      stack: value3.stack ?? [],
+      instructions: value3.instructions ?? []
+    }
+  };
+}
+var PROJECT_CONFIG_FILE, PROJECT_CONFIG_PATH, PROJECT_CONFIG_DEFAULTS, BRANCH_PATTERN_PLACEHOLDERS, portable, repoRelativePath, branchPattern, Schema;
+var init_project_config = __esm({
+  "../core/src/project-config.ts"() {
+    "use strict";
+    init_zod();
+    PROJECT_CONFIG_FILE = "project.yaml";
+    PROJECT_CONFIG_PATH = `.portta/${PROJECT_CONFIG_FILE}`;
+    PROJECT_CONFIG_DEFAULTS = {
+      worktreeRoot: ".portta/worktrees",
+      branchPattern: "{type}/{slug}"
+    };
+    BRANCH_PATTERN_PLACEHOLDERS = ["type", "slug"];
+    portable = (label3) => external_exports.string().trim().min(1).superRefine((value3, ctx) => {
+      const shape = hostShape(value3);
+      if (shape) {
+        ctx.addIssue({
+          code: "custom",
+          message: `${label3} ${shape}; that belongs to the host, not to the project (ADR 0052)`
+        });
+      }
+    });
+    repoRelativePath = (label3) => portable(label3).superRefine((value3, ctx) => {
+      const normalized = value3.replaceAll("\\", "/");
+      if (normalized.split("/").includes("..")) {
+        ctx.addIssue({ code: "custom", message: `${label3} escapes the repository with '..'` });
+      }
+    });
+    branchPattern = portable("the branch pattern").superRefine((value3, ctx) => {
+      const used = [...value3.matchAll(/\{([^}]*)\}/g)].map((match2) => match2[1] ?? "");
+      const allowed = new Set(BRANCH_PATTERN_PLACEHOLDERS);
+      for (const placeholder of used) {
+        if (!allowed.has(placeholder)) {
+          ctx.addIssue({
+            code: "custom",
+            message: `unknown placeholder {${placeholder}}; the branch pattern accepts ${BRANCH_PATTERN_PLACEHOLDERS.map((name) => `{${name}}`).join(" and ")}`
+          });
+        }
+      }
+    });
+    Schema = external_exports.strictObject({
+      version: external_exports.literal(1),
+      name: portable("the project name").optional(),
+      mainBranch: portable("the main branch").optional(),
+      worktrees: external_exports.strictObject({
+        root: repoRelativePath("the worktree root").optional(),
+        branchPattern: branchPattern.optional()
+      }).optional(),
+      stack: external_exports.array(external_exports.string().trim().min(1).regex(/^[a-z0-9][a-z0-9.+-]*$/i, "a stack entry is a plain identifier such as node or mysql")).optional(),
+      instructions: external_exports.array(repoRelativePath("an instruction path")).optional()
+    });
+  }
+});
+
 // ../core/src/project-order.ts
 function parseDependsOn(label3) {
   if (!label3 || label3.trim() === "") return [];
@@ -22317,7 +22391,6 @@ var init_src = __esm({
     init_endpoints();
     init_env();
     init_hostname();
-    init_host();
     init_host_security();
     init_images();
     init_metrics();
@@ -22326,6 +22399,7 @@ var init_src = __esm({
     init_namespace();
     init_paths();
     init_password();
+    init_project_config();
     init_project_order();
     init_projects_home();
     init_protections();
@@ -22393,7 +22467,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@codions/portta",
-      version: "0.0.0-develop.169.sha-64ee68c",
+      version: "0.0.0-develop.172.sha-10ce987",
       description: "Machine-first CLI for a shared Docker development gateway",
       license: "MIT",
       type: "module",
@@ -22412,10 +22486,7 @@ var init_package = __esm({
         typecheck: "tsc -p tsconfig.json --noEmit",
         test: "vitest run",
         prepack: "npm run build",
-        prepublishOnly: "npm run typecheck && npm test",
-        preversion: "node scripts/git-version.mjs check",
-        version: "node scripts/git-version.mjs sync",
-        postversion: "node scripts/git-version.mjs verify"
+        prepublishOnly: "npm run typecheck && npm test"
       },
       engines: {
         node: ">=24"
@@ -22467,7 +22538,7 @@ var init_version = __esm({
     "use strict";
     init_package();
     CLI_VERSION = package_default.version;
-    CLI_BUILD_DATE = true ? "2026-09-18T00:48:59Z" : void 0;
+    CLI_BUILD_DATE = true ? "2026-09-18T02:24:34Z" : void 0;
   }
 });
 
@@ -22483,12 +22554,13 @@ function versionForRoot(root2) {
   if (existsSync4(generated)) return readFileSync4(generated, "utf8").trim();
   const manifest = join5(root2, "packages", "cli", "package.json");
   if (existsSync4(manifest)) return LOCAL_DEV_VERSION;
-  throw new PreconditionError(`missing generated VERSION in ${root2}`, "reinstall the portta npm package");
+  throw new PreconditionError(`missing generated VERSION in ${root2}`, "reinstall the @codions/portta npm package");
 }
 function wellKnownRoots() {
   const home2 = process.env["HOME"];
   return [
     process.env["PORTTA_HOME"],
+    home2 ? join5(home2, "portta") : void 0,
     "/opt/portta",
     home2 ? join5(home2, ".portta") : void 0,
     "/var/lib/portta"
@@ -22528,7 +22600,7 @@ function gatewayContext(options = {}) {
   const config3 = loadGatewayConfig(env);
   env["PORTTA_DOMAIN"] = config3.domain;
   env["PORTTA_BIND_ADDRESS"] = config3.bindAddress;
-  const files = composeFilesForRoot(config3, root2);
+  const files = composeFiles(config3);
   for (const fileName of files) {
     if (!existsSync4(join5(root2, fileName))) throw new PreconditionError(`missing compose file: ${fileName}`);
   }
@@ -34233,6 +34305,138 @@ var init_execa = __esm({
   }
 });
 
+// src/process.ts
+import { spawn as spawn2 } from "node:child_process";
+import { closeSync as closeSync2, openSync as openSync2 } from "node:fs";
+function setProcessReporter(options) {
+  reporting = options;
+}
+function effectiveStdio(requested) {
+  if (requested === "inherit") return "inherit";
+  if (reporting.quiet) return "pipe";
+  if (reporting.verbose) return "stream";
+  return requested;
+}
+function outputTargets(mode) {
+  if (mode !== "stream") return { stdio: mode };
+  return {
+    stdin: "pipe",
+    stdout: reporting.json ? "pipe" : ["pipe", "inherit"],
+    stderr: ["pipe", "inherit"]
+  };
+}
+function elapsed(sinceMs) {
+  const seconds = Math.round((Date.now() - sinceMs) / 1e3);
+  if (seconds < 60) return `${seconds}s`;
+  return `${Math.floor(seconds / 60)}m${String(seconds % 60).padStart(2, "0")}s`;
+}
+function describeCommand(file2, args, limit = 88) {
+  const words = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const argument = args[index] ?? "";
+    if (argument === "-f" || argument === "--file") {
+      index += 1;
+      continue;
+    }
+    words.push(argument);
+  }
+  const line4 = [file2, ...words].join(" ");
+  return line4.length <= limit ? line4 : `${line4.slice(0, limit - 1)}\u2026`;
+}
+function startHeartbeat(file2, args) {
+  if (reporting.quiet) return () => {
+  };
+  const started = Date.now();
+  const label3 = describeCommand(file2, args);
+  let hinted = false;
+  const announce = () => {
+    process.stderr.write(`wait     still running: ${label3} (${elapsed(started)})
+`);
+    if (!hinted && Date.now() - started >= HEARTBEAT_HINT_MS) {
+      hinted = true;
+      process.stderr.write("  -> a first build of the panel image takes several minutes; Ctrl-C is safe, and --verbose shows its output\n");
+    }
+  };
+  let repeat;
+  const first = setTimeout(() => {
+    announce();
+    repeat = setInterval(announce, HEARTBEAT_EVERY_MS);
+    repeat.unref?.();
+  }, HEARTBEAT_FIRST_MS);
+  first.unref?.();
+  return () => {
+    clearTimeout(first);
+    if (repeat) clearInterval(repeat);
+  };
+}
+async function runProcess(file2, args = [], options = {}) {
+  const mode = effectiveStdio(options.stdio ?? "pipe");
+  const execaOptions = {
+    cwd: options.cwd,
+    env: options.env,
+    input: options.input,
+    reject: options.reject ?? true,
+    shell: false,
+    timeout: options.timeout,
+    ...outputTargets(mode)
+  };
+  const stopHeartbeat = mode === "pipe" ? startHeartbeat(file2, args) : () => {
+  };
+  try {
+    const result = await execa(file2, [...args], execaOptions);
+    const notStarted = result.failed && result.exitCode === void 0 && !result.signal && !result.timedOut;
+    return {
+      stdout: typeof result.stdout === "string" ? result.stdout : "",
+      stderr: typeof result.stderr === "string" ? result.stderr : "",
+      exitCode: result.exitCode ?? (result.failed ? 1 : 0),
+      failed: result.failed,
+      ...notStarted && "originalMessage" in result ? { error: String(result.originalMessage) } : {}
+    };
+  } finally {
+    stopHeartbeat();
+  }
+}
+async function runForeground(file2, args, options = {}) {
+  const child = execa(file2, [...args], { cwd: options.cwd, env: options.env, stdio: "inherit", reject: false, shell: false });
+  const forwarded = ["SIGINT", "SIGTERM", "SIGHUP"].map((signal) => [signal, () => {
+    child.kill(signal);
+  }]);
+  for (const [signal, forward] of forwarded) process.on(signal, forward);
+  try {
+    const result = await child;
+    return result.exitCode ?? (result.signal ? 1 : 0);
+  } finally {
+    for (const [signal, forward] of forwarded) process.off(signal, forward);
+  }
+}
+function spawnDetached(file2, args, options = {}) {
+  const log3 = options.logFile ? openSync2(options.logFile, "a", 384) : null;
+  try {
+    const child = spawn2(file2, [...args], {
+      cwd: options.cwd,
+      env: options.env,
+      shell: false,
+      detached: true,
+      stdio: log3 === null ? "ignore" : ["ignore", log3, log3]
+    });
+    child.unref();
+    return child.pid;
+  } finally {
+    if (log3 !== null) closeSync2(log3);
+  }
+}
+var reporting, HEARTBEAT_FIRST_MS, HEARTBEAT_EVERY_MS, HEARTBEAT_HINT_MS;
+var init_process = __esm({
+  "src/process.ts"() {
+    "use strict";
+    init_execa();
+    reporting = {};
+    HEARTBEAT_FIRST_MS = 1e4;
+    HEARTBEAT_EVERY_MS = 3e4;
+    HEARTBEAT_HINT_MS = 18e4;
+  }
+});
+
 // ../../node_modules/hono/dist/compose.js
 var compose;
 var init_compose = __esm({
@@ -36704,7 +36908,7 @@ var init_user_shell_env = __esm({
 // ../host/src/modules/taskflow/lib/host-tools.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { accessSync as accessSync2, constants as constants5, statSync as statSync3 } from "node:fs";
-import { delimiter as delimiter2, dirname as dirname5, isAbsolute, join as join8 } from "node:path";
+import { delimiter as delimiter2, dirname as dirname5, isAbsolute, join as join9 } from "node:path";
 function defaultIsExecutableFile(candidate) {
   try {
     accessSync2(candidate, constants5.X_OK);
@@ -36718,20 +36922,20 @@ function firstExecutable(candidates, isExecutable) {
 }
 function pathCandidates(tool, pathEnv) {
   if (!pathEnv) return [];
-  return pathEnv.split(delimiter2).filter(Boolean).map((entry) => join8(entry, tool));
+  return pathEnv.split(delimiter2).filter(Boolean).map((entry) => join9(entry, tool));
 }
 function wellKnownBinDirectories(input2) {
   const directories = [];
   const home2 = input2.env.HOME?.trim();
   if (home2) {
     directories.push(
-      join8(home2, ".local", "bin"),
-      join8(home2, ".cargo", "bin"),
-      join8(home2, ".bun", "bin"),
-      join8(home2, ".volta", "bin"),
-      join8(home2, ".asdf", "shims"),
-      join8(home2, ".local", "share", "mise", "shims"),
-      join8(home2, ".npm-global", "bin")
+      join9(home2, ".local", "bin"),
+      join9(home2, ".cargo", "bin"),
+      join9(home2, ".bun", "bin"),
+      join9(home2, ".volta", "bin"),
+      join9(home2, ".asdf", "shims"),
+      join9(home2, ".local", "share", "mise", "shims"),
+      join9(home2, ".npm-global", "bin")
     );
   }
   directories.push(dirname5(input2.execPath));
@@ -36742,7 +36946,7 @@ function wellKnownBinDirectories(input2) {
 }
 function wellKnownToolPaths(tool, env) {
   const home2 = env.HOME?.trim();
-  if (tool === "claude" && home2) return [join8(home2, ".claude", "local", "claude")];
+  if (tool === "claude" && home2) return [join9(home2, ".claude", "local", "claude")];
   return [];
 }
 function loginWhichCommand(tool) {
@@ -36789,7 +36993,7 @@ function resolveNpmGlobalBin(input2) {
       env: input2.env,
       execPath: input2.execPath,
       platform: input2.platform
-    }).map((directory) => join8(directory, "npm")),
+    }).map((directory) => join9(directory, "npm")),
     input2.isExecutable
   );
   if (!npm) return null;
@@ -36801,7 +37005,7 @@ function resolveNpmGlobalBin(input2) {
   });
   if (result.error || result.status !== 0) return null;
   const prefix = (result.stdout ?? "").trim().split(/\r?\n/u)[0]?.trim();
-  return prefix ? join8(prefix, "bin") : null;
+  return prefix ? join9(prefix, "bin") : null;
 }
 function createHostToolResolver(options = {}) {
   const env = options.env ?? process.env;
@@ -36830,7 +37034,7 @@ function createHostToolResolver(options = {}) {
       npmGlobalBin = resolveNpmGlobalBin({ env, execPath: execPath2, isExecutable, platform: platform4 });
     }
     const wellKnown = wellKnownBinDirectories({ env, execPath: execPath2, npmGlobalBin, platform: platform4 }).map(
-      (directory) => join8(directory, name)
+      (directory) => join9(directory, name)
     );
     const wellKnownHit = firstExecutable(wellKnown, isExecutable);
     if (wellKnownHit) return wellKnownHit;
@@ -36943,7 +37147,7 @@ function agentTemplatePlaceholder(variable) {
 function hostPortFromEnv(env) {
   return parseInt(env[ENV_NAMES.hostPort] || env.PORT || String(APP_DEFAULTS.port), 10);
 }
-var APP_NAME, APP_SLUG, CLI_NAME, GLOBAL_CONFIG_DIR, HOST_STATE_DIR, PROJECT_CONFIG_DIR, PATH_NAMES, PROJECT_CONFIG_PATH, PROJECT_LOCAL_CONFIG_PATH, APP_DEFAULTS, ENV_NAMES, RUNTIME_IDENTITY, SERVICE_IDENTITY, LINEAR_IDENTITY;
+var APP_NAME, APP_SLUG, CLI_NAME, GLOBAL_CONFIG_DIR, HOST_STATE_DIR, PROJECT_CONFIG_DIR, PATH_NAMES, PROJECT_CONFIG_PATH2, PROJECT_LOCAL_CONFIG_PATH, APP_DEFAULTS, ENV_NAMES, RUNTIME_IDENTITY, SERVICE_IDENTITY, LINEAR_IDENTITY;
 var init_config2 = __esm({
   "../core/src/taskflow/config.ts"() {
     "use strict";
@@ -36972,7 +37176,7 @@ var init_config2 = __esm({
       archiveState: "archive.json",
       openSessionsState: "open-sessions.json"
     };
-    PROJECT_CONFIG_PATH = `${PROJECT_CONFIG_DIR}/${PATH_NAMES.projectConfig}`;
+    PROJECT_CONFIG_PATH2 = `${PROJECT_CONFIG_DIR}/${PATH_NAMES.projectConfig}`;
     PROJECT_LOCAL_CONFIG_PATH = `${PROJECT_CONFIG_DIR}/${PATH_NAMES.projectLocalConfig}`;
     APP_DEFAULTS = {
       port: 5111,
@@ -37020,7 +37224,6 @@ var init_config2 = __esm({
       tmuxBufferPrefix: `${APP_SLUG}-prompt`,
       dockerContainerPrefix: APP_SLUG,
       tempUploadDir: `${APP_SLUG}-uploads`,
-      dockerImage: "portta-sandbox",
       gitBaseConfigKey: `${APP_SLUG}.base`
     };
     SERVICE_IDENTITY = {
@@ -44388,48 +44591,48 @@ var init_main2 = __esm({
 
 // ../core/src/taskflow/paths.ts
 import { homedir as homedir2 } from "node:os";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 function globalConfigDir(options = {}) {
   const env = options.env ?? process.env;
   const override = env[ENV_NAMES.home]?.trim();
-  return override || join9(options.home ?? env.HOME ?? homedir2(), GLOBAL_CONFIG_DIR);
+  return override || join10(options.home ?? env.HOME ?? homedir2(), GLOBAL_CONFIG_DIR);
 }
 function globalPaths(options = {}) {
   const home2 = globalConfigDir(options);
   const env = options.env ?? process.env;
-  const root2 = env[ENV_NAMES.hostStateDir]?.trim() || join9(home2, HOST_STATE_DIR);
+  const root2 = env[ENV_NAMES.hostStateDir]?.trim() || join10(home2, HOST_STATE_DIR);
   return {
     root: root2,
-    env: join9(home2, PATH_NAMES.env),
-    controlToken: join9(root2, PATH_NAMES.controlToken),
-    projectsRegistry: join9(root2, PATH_NAMES.projectsRegistry),
-    database: join9(root2, PATH_NAMES.database),
-    runs: join9(root2, PATH_NAMES.runs),
-    workflows: join9(root2, PATH_NAMES.workflows)
+    env: join10(home2, PATH_NAMES.env),
+    controlToken: join10(root2, PATH_NAMES.controlToken),
+    projectsRegistry: join10(root2, PATH_NAMES.projectsRegistry),
+    database: join10(root2, PATH_NAMES.database),
+    runs: join10(root2, PATH_NAMES.runs),
+    workflows: join10(root2, PATH_NAMES.workflows)
   };
 }
 function projectPaths(projectRoot2) {
-  const root2 = join9(projectRoot2, PROJECT_CONFIG_DIR);
+  const root2 = join10(projectRoot2, PROJECT_CONFIG_DIR);
   return {
     root: root2,
-    config: join9(root2, PATH_NAMES.projectConfig),
-    localConfig: join9(root2, PATH_NAMES.projectLocalConfig),
-    configExample: join9(root2, PATH_NAMES.projectConfigExample),
-    workflows: join9(root2, PATH_NAMES.workflows),
-    worktrees: join9(root2, PATH_NAMES.worktrees)
+    config: join10(root2, PATH_NAMES.projectConfig),
+    localConfig: join10(root2, PATH_NAMES.projectLocalConfig),
+    configExample: join10(root2, PATH_NAMES.projectConfigExample),
+    workflows: join10(root2, PATH_NAMES.workflows),
+    worktrees: join10(root2, PATH_NAMES.worktrees)
   };
 }
 function gitRuntimePaths(gitDir) {
-  const root2 = join9(gitDir, PATH_NAMES.gitRuntime);
+  const root2 = join10(gitDir, PATH_NAMES.gitRuntime);
   return {
     root: root2,
-    meta: join9(root2, PATH_NAMES.worktreeMeta),
-    runtimeEnv: join9(root2, PATH_NAMES.runtimeEnv),
-    controlEnv: join9(root2, PATH_NAMES.controlEnv),
-    pullRequests: join9(root2, PATH_NAMES.pullRequests),
-    archiveState: join9(root2, PATH_NAMES.archiveState),
-    openSessionsState: join9(root2, PATH_NAMES.openSessionsState),
-    agentControl: join9(root2, RUNTIME_IDENTITY.agentControlBinary)
+    meta: join10(root2, PATH_NAMES.worktreeMeta),
+    runtimeEnv: join10(root2, PATH_NAMES.runtimeEnv),
+    controlEnv: join10(root2, PATH_NAMES.controlEnv),
+    pullRequests: join10(root2, PATH_NAMES.pullRequests),
+    archiveState: join10(root2, PATH_NAMES.archiveState),
+    openSessionsState: join10(root2, PATH_NAMES.openSessionsState),
+    agentControl: join10(root2, RUNTIME_IDENTITY.agentControlBinary)
   };
 }
 var init_paths2 = __esm({
@@ -44441,29 +44644,29 @@ var init_paths2 = __esm({
 
 // ../host/src/token.ts
 import { randomBytes as randomBytes6 } from "node:crypto";
-import { chmodSync as chmodSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync9, statSync as statSync4, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname6, join as join10 } from "node:path";
+import { chmodSync as chmodSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync9, statSync as statSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname6, join as join11 } from "node:path";
 function hostStateDir(root2) {
-  return join10(root2, HOST_STATE_DIR2);
+  return join11(root2, HOST_STATE_DIR2);
 }
 function resolveHostStateDir(root2, env) {
   return env["PORTTA_HOST_STATE_DIR"]?.trim() || hostStateDir(root2);
 }
 function hostTokenFile(stateDir) {
-  return join10(stateDir, "token");
+  return join11(stateDir, "token");
 }
 function newToken() {
   return randomBytes6(32).toString("base64url");
 }
 function readOrCreateToken(file2) {
-  mkdirSync5(dirname6(file2), { recursive: true, mode: 448 });
+  mkdirSync6(dirname6(file2), { recursive: true, mode: 448 });
   try {
     writeFileSync6(file2, `${newToken()}
 `, { flag: "wx", mode: 384 });
   } catch (error61) {
     if (error61.code !== "EEXIST") throw error61;
   }
-  if ((statSync4(file2).mode & 63) !== 0) chmodSync5(file2, 384);
+  if ((statSync4(file2).mode & 63) !== 0) chmodSync6(file2, 384);
   const token = readFileSync9(file2, "utf8").trim();
   if (token === "") throw new Error(`${file2} is empty; remove it and start the host daemon again`);
   return token;
@@ -44472,7 +44675,7 @@ var HOST_STATE_DIR2;
 var init_token = __esm({
   "../host/src/token.ts"() {
     "use strict";
-    HOST_STATE_DIR2 = join10("state", "host");
+    HOST_STATE_DIR2 = join11("state", "host");
   }
 });
 
@@ -47734,7 +47937,7 @@ var require_Schema = __commonJS({
     var string4 = require_string();
     var tags = require_tags();
     var sortMapEntriesByKey = (a3, b) => a3.key < b.key ? -1 : a3.key > b.key ? 1 : 0;
-    var Schema = class _Schema {
+    var Schema2 = class _Schema {
       constructor({ compat, customTags, merge: merge2, resolveKnownTags, schema, sortMapEntries, toStringDefaults }) {
         this.compat = Array.isArray(compat) ? tags.getTags(compat, "compat") : compat ? tags.getTags(null, compat) : null;
         this.name = typeof schema === "string" && schema || "core";
@@ -47752,7 +47955,7 @@ var require_Schema = __commonJS({
         return copy;
       }
     };
-    exports.Schema = Schema;
+    exports.Schema = Schema2;
   }
 });
 
@@ -47845,7 +48048,7 @@ var require_Document = __commonJS({
     var identity3 = require_identity();
     var Pair = require_Pair();
     var toJS = require_toJS();
-    var Schema = require_Schema();
+    var Schema2 = require_Schema();
     var stringifyDocument = require_stringifyDocument();
     var anchors = require_anchors();
     var applyReviver = require_applyReviver();
@@ -48096,7 +48299,7 @@ var require_Document = __commonJS({
         if (options.schema instanceof Object)
           this.schema = options.schema;
         else if (opt)
-          this.schema = new Schema.Schema(Object.assign(opt, options));
+          this.schema = new Schema2.Schema(Object.assign(opt, options));
         else
           throw new Error(`With a null YAML version, the { schema: Schema } option is required`);
       }
@@ -51760,7 +51963,7 @@ var require_dist = __commonJS({
     "use strict";
     var composer = require_composer();
     var Document = require_Document();
-    var Schema = require_Schema();
+    var Schema2 = require_Schema();
     var errors = require_errors();
     var Alias = require_Alias();
     var identity3 = require_identity();
@@ -51776,7 +51979,7 @@ var require_dist = __commonJS({
     var visit2 = require_visit();
     exports.Composer = composer.Composer;
     exports.Document = Document.Document;
-    exports.Schema = Schema.Schema;
+    exports.Schema = Schema2.Schema;
     exports.YAMLError = errors.YAMLError;
     exports.YAMLParseError = errors.YAMLParseError;
     exports.YAMLWarning = errors.YAMLWarning;
@@ -51816,7 +52019,6 @@ function parseWorktreeRoot(raw2, fallback) {
   if (isRecord2(raw2.worktrees) && typeof raw2.worktrees.root === "string" && raw2.worktrees.root.trim()) {
     return raw2.worktrees.root.trim();
   }
-  if (typeof raw2.worktreeRoot === "string" && raw2.worktreeRoot.trim()) return raw2.worktreeRoot.trim();
   return fallback;
 }
 function parseExposure(raw2) {
@@ -51928,18 +52130,15 @@ function parseProfile(raw2, fallbackRuntime) {
     ...typeof raw2.environment.cwd === "string" && raw2.environment.cwd.trim() ? { cwd: raw2.environment.cwd.trim() } : {},
     ...typeof raw2.environment.stopCommand === "string" && raw2.environment.stopCommand.trim() ? { stopCommand: raw2.environment.stopCommand.trim() } : {}
   } : void 0;
-  const legacyRuntimePane = environment && (environment.provider === "host" || environment.provider === "auto") && !environment.command ? panes.find((pane) => pane.id === "app" && pane.kind === "command" && Boolean(pane.command)) : void 0;
-  const effectiveEnvironment = legacyRuntimePane ? { ...environment, command: legacyRuntimePane.command } : environment;
-  const effectivePanes = legacyRuntimePane ? panes.filter((pane) => pane !== legacyRuntimePane) : panes;
   return {
     runtime: runtime2,
     envPassthrough,
     ...raw2.yolo === true ? { yolo: true } : {},
-    panes: effectivePanes,
+    panes,
     ...typeof raw2.systemPrompt === "string" && raw2.systemPrompt.length > 0 ? { systemPrompt: raw2.systemPrompt } : {},
     ...image ? { image } : {},
     ...mounts ? { mounts } : {},
-    ...effectiveEnvironment && Object.keys(effectiveEnvironment).length > 0 ? { environment: effectiveEnvironment } : {}
+    ...environment && Object.keys(environment).length > 0 ? { environment } : {}
   };
 }
 function parseProfiles(raw2, includeDefaultProfile) {
@@ -52061,7 +52260,7 @@ function parseConfigDocument(text) {
   const parsed = (0, import_yaml.parse)(text);
   return isRecord2(parsed) ? parsed : {};
 }
-function parseProjectConfig(parsed) {
+function parseProjectConfig2(parsed) {
   const worktreeRoot = parseWorktreeRoot(parsed.workspace, DEFAULT_CONFIG.workspace.worktreeRoot);
   return {
     name: typeof parsed.name === "string" && parsed.name.trim() ? parsed.name.trim() : DEFAULT_CONFIG.name,
@@ -52091,7 +52290,7 @@ function parseProjectConfig(parsed) {
   };
 }
 function defaultConfig() {
-  return parseProjectConfig({});
+  return parseProjectConfig2({});
 }
 function parseTeamKeyList(raw2) {
   if (!Array.isArray(raw2)) return void 0;
@@ -52102,12 +52301,6 @@ function parseLinearIntegration(parsed) {
   const defaults = DEFAULT_CONFIG.integrations.linear;
   const linear = isRecord2(parsed.integrations) && isRecord2(parsed.integrations.linear) ? parsed.integrations.linear : null;
   if (!linear) return { ...defaults };
-  if (typeof linear.teamId === "string" && !warnedLegacyLinearTeamId) {
-    warnedLegacyLinearTeamId = true;
-    log.warn(
-      "[config] integrations.linear.teamId is no longer used \u2014 the ticket team is now picked at creation time in the dashboard"
-    );
-  }
   const watchTeams = parseTeamKeyList(linear.watchTeams);
   return {
     enabled: typeof linear.enabled === "boolean" ? linear.enabled : defaults.enabled,
@@ -52226,7 +52419,7 @@ function loadConfig(dir, options = {}) {
   let projectConfig;
   try {
     const text = readConfigFile(root2).trim();
-    projectConfig = text ? parseProjectConfig(parseConfigDocument(text)) : defaultConfig();
+    projectConfig = text ? parseProjectConfig2(parseConfigDocument(text)) : defaultConfig();
   } catch {
     projectConfig = defaultConfig();
   }
@@ -52328,14 +52521,13 @@ async function removeLocalCustomAgent(dir, agentId2) {
 function expandTemplate(template, env) {
   return template.replace(/\$\{(\w+)\}/g, (_, key) => env[key] ?? "");
 }
-var import_yaml, DEFAULT_PANES, DEFAULT_PROFILE, DEFAULT_CONFIG, warnedLegacyLinearTeamId;
+var import_yaml, DEFAULT_PANES, DEFAULT_PROFILE, DEFAULT_CONFIG;
 var init_config5 = __esm({
   "../host/src/modules/taskflow/adapters/config.ts"() {
     "use strict";
     init_config2();
     init_paths2();
     import_yaml = __toESM(require_dist(), 1);
-    init_log2();
     DEFAULT_PANES = [
       { id: "agent", kind: "agent", focus: true },
       { id: "runtime", kind: "runtime", split: "right", sizePct: 30, cwd: "worktree" }
@@ -52369,7 +52561,6 @@ var init_config5 = __esm({
       autoName: null,
       oneshot: { systemPrompt: DEFAULT_ONESHOT_SYSTEM_PROMPT() }
     };
-    warnedLegacyLinearTeamId = false;
   }
 });
 
@@ -52630,7 +52821,7 @@ var init_process_runner = __esm({
 
 // ../host/src/modules/taskflow/adapters/worktree-git-mount.ts
 import { access, readFile, realpath, rename, unlink, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename3, isAbsolute as isAbsolute2, join as join11, posix as posix3, relative, resolve as resolve3, sep } from "node:path";
+import { basename as basename3, isAbsolute as isAbsolute2, join as join12, posix as posix3, relative, resolve as resolve3, sep } from "node:path";
 function repairCommand(workspacePath) {
   return `git -C ${workspacePath} worktree repair --relative-paths`;
 }
@@ -52680,7 +52871,7 @@ function linkTarget(content) {
   return target.length > 0 ? target : null;
 }
 async function worktreeLink(workspacePath) {
-  const content = await readRaw(join11(workspacePath, ".git"));
+  const content = await readRaw(join12(workspacePath, ".git"));
   return content === null ? null : linkTarget(content);
 }
 async function porttaOwned(runner, workspacePath, gitDir) {
@@ -52693,9 +52884,9 @@ async function porttaOwned(runner, workspacePath, gitDir) {
   return result.exit.code === 0 && result.stdout.trim().length > 0;
 }
 async function planRelativeRelink(workspacePath, dirs) {
-  const forwardPath = join11(workspacePath, ".git");
-  const backPath = join11(dirs.gitDir, BACK_LINK);
-  if (join11(dirs.commonDir, "worktrees", basename3(dirs.gitDir)) !== dirs.gitDir)
+  const forwardPath = join12(workspacePath, ".git");
+  const backPath = join12(dirs.gitDir, BACK_LINK);
+  if (join12(dirs.commonDir, "worktrees", basename3(dirs.gitDir)) !== dirs.gitDir)
     return {
       ok: false,
       reason: `its Git dir ${dirs.gitDir} is not <common dir>/worktrees/<id> under ${dirs.commonDir}`
@@ -52756,7 +52947,7 @@ async function worktreeGitMountArgs(input2) {
     );
   }
   let link = await worktreeLink(workspacePath);
-  const backLink = await readRaw(join11(dirs.gitDir, BACK_LINK));
+  const backLink = await readRaw(join12(dirs.gitDir, BACK_LINK));
   if (link !== null && isAbsolute2(link) || backLink !== null && isAbsolute2(backLink.trim())) {
     if (!await porttaOwned(runner, workspacePath, dirs.gitDir)) {
       throw new Error(
@@ -52812,7 +53003,7 @@ var init_worktree_git_mount = __esm({
 import { createHash as createHash5 } from "node:crypto";
 import { access as access2, readdir, readFile as readFile2 } from "node:fs/promises";
 import { createRequire } from "node:module";
-import { dirname as dirname8, join as join12, relative as relative2, resolve as resolve4 } from "node:path";
+import { dirname as dirname8, join as join13, relative as relative2, resolve as resolve4 } from "node:path";
 function hash2(value3) {
   return createHash5("sha256").update(value3).digest("hex");
 }
@@ -52828,16 +53019,16 @@ async function exists2(path7) {
   }
 }
 async function findDevcontainerConfigs(workspacePath) {
-  const rootConfig = join12(workspacePath, ".devcontainer.json");
-  const directory = join12(workspacePath, ".devcontainer");
+  const rootConfig = join13(workspacePath, ".devcontainer.json");
+  const directory = join13(workspacePath, ".devcontainer");
   const configs = [];
   if (await exists2(rootConfig)) configs.push(rootConfig);
-  if (await exists2(join12(directory, "devcontainer.json"))) configs.push(join12(directory, "devcontainer.json"));
+  if (await exists2(join13(directory, "devcontainer.json"))) configs.push(join13(directory, "devcontainer.json"));
   if (await exists2(directory)) {
     const entries = await readdir(directory, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const candidate = join12(directory, entry.name, "devcontainer.json");
+      const candidate = join13(directory, entry.name, "devcontainer.json");
       if (await exists2(candidate)) configs.push(candidate);
     }
   }
@@ -52991,7 +53182,7 @@ var init_devcontainer_environment = __esm({
         }
         const packagePath = createRequire(import.meta.url).resolve("@devcontainers/cli/package.json");
         this.cli = process.execPath;
-        this.cliPrefix = [join12(dirname8(packagePath), "devcontainer.js")];
+        this.cliPrefix = [join13(dirname8(packagePath), "devcontainer.js")];
       }
       args(args) {
         return [...this.cliPrefix, ...args];
@@ -53058,7 +53249,7 @@ var init_devcontainer_environment = __esm({
           this.workspaceMounts.set(config3, merged.workspaceMount);
         else this.workspaceMounts.delete(config3);
         const compose4 = await resolveComposeConfiguration(this.runner, config3, merged);
-        const lockfile = join12(dirname8(config3), "devcontainer-lock.json");
+        const lockfile = join13(dirname8(config3), "devcontainer-lock.json");
         const lockfileExists = await exists2(lockfile);
         const lockfileContents = lockfileExists ? await readFile2(lockfile, "utf8") : "";
         return {
@@ -53325,11 +53516,11 @@ exec ${argv.join(" ")} "$cwd" ${quoteShell(executable2)} "$@"
 
 // ../host/src/modules/taskflow/adapters/dockerfile-environment.ts
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
 import { resolve as resolve5 } from "node:path";
 function dockerfileFor(context) {
   const dockerfile = resolve5(context.workspacePath, context.configRef ?? "Dockerfile");
-  if (!existsSync7(dockerfile)) throw new Error(`Dockerfile does not exist: ${context.configRef ?? "Dockerfile"}`);
+  if (!existsSync8(dockerfile)) throw new Error(`Dockerfile does not exist: ${context.configRef ?? "Dockerfile"}`);
   return dockerfile;
 }
 function imageTag(id) {
@@ -53364,10 +53555,10 @@ var init_dockerfile_environment = __esm({
         const dockerfile = resolve5(context.workspacePath, "Dockerfile");
         return {
           provider: this.id,
-          available: version3.exit.code === 0 && existsSync7(dockerfile),
-          configRefs: existsSync7(dockerfile) ? [dockerfile] : [],
+          available: version3.exit.code === 0 && existsSync8(dockerfile),
+          configRefs: existsSync8(dockerfile) ? [dockerfile] : [],
           ...version3.exit.code === 0 ? { version: version3.stdout.trim() } : {},
-          diagnostics: version3.exit.code === 0 ? existsSync7(dockerfile) ? [] : ["No Dockerfile was found"] : [version3.stderr.trim() || "Docker is unavailable"]
+          diagnostics: version3.exit.code === 0 ? existsSync8(dockerfile) ? [] : ["No Dockerfile was found"] : [version3.stderr.trim() || "Docker is unavailable"]
         };
       }
       async resolve(context) {
@@ -53591,13 +53782,13 @@ var init_sqlite = __esm({
 });
 
 // ../host/src/modules/taskflow/adapters/environment-store.ts
-import { mkdirSync as mkdirSync6 } from "node:fs";
+import { mkdirSync as mkdirSync7 } from "node:fs";
 import { dirname as dirname9 } from "node:path";
 function parseEnvironmentRecord(value3) {
   return environmentRecordSchema.parse(value3);
 }
 function createEnvironmentStore(path7) {
-  mkdirSync6(dirname9(path7), { recursive: true });
+  mkdirSync7(dirname9(path7), { recursive: true });
   const database = openDatabase(path7);
   database.pragma("journal_mode = WAL");
   database.exec(`
@@ -53836,7 +54027,7 @@ exec ${JSON.stringify(executable2)} "$@"
 });
 
 // ../host/src/modules/taskflow/adapters/projects-registry.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync12, renameSync as renameSync3, writeFileSync as writeFileSync7 } from "node:fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync12, renameSync as renameSync3, writeFileSync as writeFileSync7 } from "node:fs";
 import { dirname as dirname10 } from "node:path";
 function defaultRegistryFile() {
   return globalPaths().projectsRegistry;
@@ -53860,7 +54051,7 @@ function createProjectsRegistry(file2 = defaultRegistryFile()) {
     return parsed.filter(isProjectEntry);
   }
   function write4(entries) {
-    mkdirSync7(dirname10(file2), { recursive: true });
+    mkdirSync8(dirname10(file2), { recursive: true });
     const tmpPath = `${file2}.${process.pid}.${Date.now()}.tmp`;
     writeFileSync7(tmpPath, `${JSON.stringify(entries, null, 2)}
 `);
@@ -54574,20 +54765,20 @@ var init_tmux = __esm({
 });
 
 // ../host/src/modules/taskflow/assets.ts
-import { existsSync as existsSync8 } from "node:fs";
-import { join as join13, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync9 } from "node:fs";
+import { join as join14, resolve as resolve7 } from "node:path";
 function taskflowAssets(env = process.env, directory = import.meta.dirname) {
-  const bundled = join13(directory, "assets");
-  if (existsSync8(join13(bundled, "workflows"))) {
+  const bundled = join14(directory, "assets");
+  if (existsSync9(join14(bundled, "workflows"))) {
     return {
-      workflowBuiltinsDir: env[ENV_NAMES.workflowBuiltinsDir] || join13(bundled, "workflows"),
-      workflowSkill: join13(bundled, "skills", "portta-workflows", "SKILL.md")
+      workflowBuiltinsDir: env[ENV_NAMES.workflowBuiltinsDir] || join14(bundled, "workflows"),
+      workflowSkill: join14(bundled, "skills", "portta-workflows", "SKILL.md")
     };
   }
   const repository = resolve7(directory, "../../../../..");
   return {
-    workflowBuiltinsDir: env[ENV_NAMES.workflowBuiltinsDir] || join13(repository, "packages", "host", "workflows"),
-    workflowSkill: join13(repository, "skills", "portta-workflows", "SKILL.md")
+    workflowBuiltinsDir: env[ENV_NAMES.workflowBuiltinsDir] || join14(repository, "packages", "host", "workflows"),
+    workflowSkill: join14(repository, "skills", "portta-workflows", "SKILL.md")
   };
 }
 var init_assets = __esm({
@@ -54806,7 +54997,7 @@ var init_environment_service_discovery = __esm({
 // ../host/src/modules/taskflow/adapters/git.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
 import { readdirSync as readdirSync2, realpathSync as realpathSync2, rmSync, statSync as statSync5 } from "node:fs";
-import { basename as basename5, dirname as dirname11, join as join14, resolve as resolve8 } from "node:path";
+import { basename as basename5, dirname as dirname11, join as join15, resolve as resolve8 } from "node:path";
 function canonicalizeFsPath(input2) {
   const resolved2 = resolve8(input2);
   try {
@@ -54818,7 +55009,7 @@ function canonicalizeFsPath(input2) {
       missing.unshift(basename5(current));
       current = dirname11(current);
       try {
-        return join14(realpathSync2(current), ...missing);
+        return join15(realpathSync2(current), ...missing);
       } catch {
       }
     }
@@ -54910,7 +55101,7 @@ function resolveRepoRoot(dir) {
     return null;
   }
   for (const entry of entries) {
-    const child = join14(dir, entry);
+    const child = join15(dir, entry);
     try {
       if (!statSync5(child).isDirectory()) continue;
     } catch {
@@ -55844,7 +56035,7 @@ var init_herdr = __esm({
 
 // ../host/src/modules/taskflow/adapters/hooks.ts
 import { access as access3 } from "node:fs/promises";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 function buildErrorMessage(name, exitCode, stdout2, stderr2) {
   const output2 = stderr2.trim() || stdout2.trim();
   if (output2) {
@@ -55895,7 +56086,7 @@ var init_hooks = __esm({
       }
       async hasEnvrc(cwd) {
         try {
-          await access3(join15(cwd, ".envrc"));
+          await access3(join16(cwd, ".envrc"));
           return true;
         } catch {
           return false;
@@ -55994,7 +56185,7 @@ var init_type_guards = __esm({
 
 // ../host/src/modules/taskflow/adapters/claude-cli.ts
 import { readdir as readdir2, readFile as readFile3, stat as stat2 } from "node:fs/promises";
-import { basename as basename6, join as join16 } from "node:path";
+import { basename as basename6, join as join17 } from "node:path";
 function isRecord5(raw2) {
   return typeof raw2 === "object" && raw2 !== null && !Array.isArray(raw2);
 }
@@ -56177,19 +56368,19 @@ function readClaudeProjectsRoot() {
   if (!home2) {
     throw new Error("HOME is required to resolve Claude sessions");
   }
-  return join16(home2, ".claude", "projects");
+  return join17(home2, ".claude", "projects");
 }
 async function listJsonlFiles(dir) {
   try {
     const entries = await readdir2(dir, { withFileTypes: true });
-    return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => join16(dir, entry.name));
+    return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".jsonl")).map((entry) => join17(dir, entry.name));
   } catch {
     return [];
   }
 }
 async function findClaudeSessionPath(sessionId, cwd) {
   const projectsRoot = readClaudeProjectsRoot();
-  const primaryPath = join16(projectsRoot, encodeClaudeProjectDir(cwd), `${sessionId}.jsonl`);
+  const primaryPath = join17(projectsRoot, encodeClaudeProjectDir(cwd), `${sessionId}.jsonl`);
   try {
     await stat2(primaryPath);
     return primaryPath;
@@ -56198,7 +56389,7 @@ async function findClaudeSessionPath(sessionId, cwd) {
   const projectDirs2 = await readdir2(projectsRoot, { withFileTypes: true }).catch(() => []);
   for (const entry of projectDirs2) {
     if (!entry.isDirectory()) continue;
-    const candidate = join16(projectsRoot, entry.name, `${sessionId}.jsonl`);
+    const candidate = join17(projectsRoot, entry.name, `${sessionId}.jsonl`);
     try {
       await stat2(candidate);
       return candidate;
@@ -56341,7 +56532,7 @@ var init_claude_cli = __esm({
       }
       async listSessions(cwd) {
         const projectsRoot = readClaudeProjectsRoot();
-        const primaryDir = join16(projectsRoot, encodeClaudeProjectDir(cwd));
+        const primaryDir = join17(projectsRoot, encodeClaudeProjectDir(cwd));
         const primaryFiles = await listJsonlFiles(primaryDir);
         if (primaryFiles.length > 0) {
           return await this.summarizeSessionFiles(primaryFiles, cwd);
@@ -56350,7 +56541,7 @@ var init_claude_cli = __esm({
         const matchedFiles = [];
         for (const entry of projectDirs2) {
           if (!entry.isDirectory()) continue;
-          const files = await listJsonlFiles(join16(projectsRoot, entry.name));
+          const files = await listJsonlFiles(join17(projectsRoot, entry.name));
           for (const filePath of files) {
             const session = await this.readSessionFile(filePath);
             if (session?.cwd === cwd) {
@@ -56529,7 +56720,7 @@ var init_claude_cli = __esm({
 
 // ../host/src/modules/taskflow/adapters/session-discovery.ts
 import { open as open2, readdir as readdir3, stat as stat3 } from "node:fs/promises";
-import { basename as basename7, join as join17 } from "node:path";
+import { basename as basename7, join as join18 } from "node:path";
 import { setTimeout as sleep3 } from "node:timers/promises";
 function home() {
   const value3 = process.env.HOME;
@@ -56540,11 +56731,11 @@ function newestFirst(sessions3) {
   return sessions3.sort((left, right) => right.mtimeMs - left.mtimeMs).map((entry) => entry.sessionId);
 }
 async function listClaudeSessionIds(cwd) {
-  const dir = join17(home(), ".claude", "projects", encodeClaudeProjectDir(cwd));
+  const dir = join18(home(), ".claude", "projects", encodeClaudeProjectDir(cwd));
   const names = await readdir3(dir).catch(() => []);
   const stamped = await Promise.all(
     names.filter((name) => name.endsWith(".jsonl")).map(async (name) => {
-      const info = await stat3(join17(dir, name)).catch(() => null);
+      const info = await stat3(join18(dir, name)).catch(() => null);
       return info ? { sessionId: basename7(name, ".jsonl"), mtimeMs: info.mtimeMs } : null;
     })
   );
@@ -56580,7 +56771,7 @@ async function readCodexSessionCwdId(path7) {
   }
 }
 async function listCodexSessionIds(cwd) {
-  const root2 = join17(home(), ".codex", "sessions");
+  const root2 = join18(home(), ".codex", "sessions");
   const relPaths = await readdir3(root2, { recursive: true }).catch(() => []);
   const rollouts = relPaths.filter((rel) => {
     const name = basename7(rel);
@@ -56588,7 +56779,7 @@ async function listCodexSessionIds(cwd) {
   });
   const stamped = await Promise.all(
     rollouts.map(async (rel) => {
-      const path7 = join17(root2, rel);
+      const path7 = join18(root2, rel);
       const meta3 = await readCodexSessionCwdId(path7);
       if (!meta3 || meta3.cwd !== cwd) return null;
       const info = await stat3(path7).catch(() => null);
@@ -56598,11 +56789,11 @@ async function listCodexSessionIds(cwd) {
   return newestFirst(stamped.filter((entry) => entry !== null));
 }
 async function findCodexSessionPath(sessionId, cwd) {
-  const root2 = join17(home(), ".codex", "sessions");
+  const root2 = join18(home(), ".codex", "sessions");
   const relPaths = await readdir3(root2, { recursive: true }).catch(() => []);
   for (const rel of relPaths) {
     if (!basename7(rel).endsWith(`${sessionId}.jsonl`)) continue;
-    const path7 = join17(root2, rel);
+    const path7 = join18(root2, rel);
     const meta3 = await readCodexSessionCwdId(path7);
     if (meta3?.id === sessionId && meta3.cwd === cwd) return path7;
   }
@@ -56692,7 +56883,7 @@ var init_session_discovery = __esm({
 
 // ../host/src/modules/taskflow/adapters/fs.ts
 import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 function stringifyAllocatedPorts(ports) {
   const entries = Object.entries(ports).map(([key, value3]) => [key, String(value3)]);
   return Object.fromEntries(entries);
@@ -56721,7 +56912,7 @@ function parseDotenv(content) {
 }
 async function loadDotenvLocal(worktreePath) {
   try {
-    const content = await readFile4(join18(worktreePath, ".env.local"), "utf8");
+    const content = await readFile4(join19(worktreePath, ".env.local"), "utf8");
     return parseDotenv(content);
   } catch {
     return {};
@@ -56862,25 +57053,21 @@ function isRecord6(raw2) {
 function normalizeConversationMeta(raw2) {
   if (!raw2) return raw2;
   if (raw2.provider === "codexAppServer") {
-    const conversationId2 = raw2.conversationId || raw2.threadId;
-    const threadId = raw2.threadId || raw2.conversationId;
-    if (!conversationId2 || !threadId) return void 0;
+    if (!raw2.conversationId || !raw2.threadId) return void 0;
     const normalized2 = {
       provider: "codexAppServer",
-      conversationId: conversationId2,
-      threadId,
+      conversationId: raw2.conversationId,
+      threadId: raw2.threadId,
       cwd: raw2.cwd,
       lastSeenAt: raw2.lastSeenAt
     };
     return normalized2;
   }
-  const conversationId = raw2.conversationId || raw2.sessionId;
-  const sessionId = raw2.sessionId || raw2.conversationId;
-  if (!conversationId || !sessionId) return void 0;
+  if (!raw2.conversationId || !raw2.sessionId) return void 0;
   const normalized = {
     provider: "claudeCode",
-    conversationId,
-    sessionId,
+    conversationId: raw2.conversationId,
+    sessionId: raw2.sessionId,
     cwd: raw2.cwd,
     lastSeenAt: raw2.lastSeenAt
   };
@@ -57310,7 +57497,7 @@ ${stderr2}`;
 
 // ../host/src/modules/taskflow/adapters/agent-runtime.ts
 import { chmod, mkdir as mkdir3, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname12, join as join19, resolve as resolve10 } from "node:path";
+import { dirname as dirname12, join as join20, resolve as resolve10 } from "node:path";
 function shellQuote(value3) {
   return `'${value3.replaceAll("'", "'\\''")}'`;
 }
@@ -57763,7 +57950,7 @@ async function mergeCodexHooksFile(hooksPath, hookSettings, agentCtlPath) {
 }
 async function resolveGitCommonDir(gitDir) {
   try {
-    const commonDir = (await readFile5(join19(gitDir, "commondir"), "utf8")).trim();
+    const commonDir = (await readFile5(join20(gitDir, "commondir"), "utf8")).trim();
     if (!commonDir) return gitDir;
     return commonDir.startsWith("/") ? commonDir : resolve10(gitDir, commonDir);
   } catch {
@@ -57772,7 +57959,7 @@ async function resolveGitCommonDir(gitDir) {
 }
 async function ensureGeneratedAgentFilesIgnored(gitDir) {
   const commonDir = await resolveGitCommonDir(gitDir);
-  const excludePath = join19(commonDir, "info", "exclude");
+  const excludePath = join20(commonDir, "info", "exclude");
   let existing = "";
   try {
     existing = await readFile5(excludePath, "utf8");
@@ -57790,9 +57977,9 @@ async function ensureGeneratedAgentFilesIgnored(gitDir) {
 async function ensureAgentRuntimeArtifacts(input2) {
   const storagePaths = getWorktreeStoragePaths(input2.gitDir);
   const artifacts = {
-    agentCtlPath: join19(storagePaths.taskflowDir, RUNTIME_IDENTITY.agentControlBinary),
-    claudeSettingsPath: join19(input2.worktreePath, ".claude", "settings.local.json"),
-    codexHooksPath: join19(input2.worktreePath, ".codex", "hooks.json")
+    agentCtlPath: join20(storagePaths.taskflowDir, RUNTIME_IDENTITY.agentControlBinary),
+    claudeSettingsPath: join20(input2.worktreePath, ".claude", "settings.local.json"),
+    codexHooksPath: join20(input2.worktreePath, ".codex", "hooks.json")
   };
   await mkdir3(dirname12(artifacts.claudeSettingsPath), { recursive: true });
   await mkdir3(dirname12(artifacts.codexHooksPath), { recursive: true });
@@ -57936,7 +58123,7 @@ var init_agent_registry = __esm({
 });
 
 // ../host/src/modules/taskflow/services/agent-service.ts
-import { dirname as dirname13, join as join20 } from "node:path";
+import { dirname as dirname13, join as join21 } from "node:path";
 function quoteShell3(value3) {
   return `'${value3.replaceAll("'", "'\\''")}'`;
 }
@@ -57948,7 +58135,7 @@ function buildDockerRuntimeBootstrap(runtimeEnvPath) {
 }
 function buildCodexNotifyFlag(runtimeEnvPath) {
   if (!runtimeEnvPath) return "";
-  const agentCtlPath = join20(dirname13(runtimeEnvPath), RUNTIME_IDENTITY.agentControlBinary);
+  const agentCtlPath = join21(dirname13(runtimeEnvPath), RUNTIME_IDENTITY.agentControlBinary);
   return ` -c ${quoteShell3(`notify=${JSON.stringify([agentCtlPath, "codex-notify"])}`)}`;
 }
 function buildBuiltInAgentInvocation(input2) {
@@ -59413,10 +59600,7 @@ ${oneshotPrompt}` : oneshotPrompt ?? baseSystemPrompt;
           return panes.length > 0 ? panes : [{ id: "runtime", kind: "runtime", cwd: "worktree" }];
         }
         if (panes.some((pane) => pane.kind === "runtime")) return panes;
-        const legacyShell = panes.findIndex((pane) => pane.id === "shell" && pane.kind === "shell");
-        const runtimePane = { id: "runtime", kind: "runtime", split: "right", sizePct: 30, cwd: "worktree" };
-        if (legacyShell >= 0) panes.splice(legacyShell, 1, runtimePane);
-        else panes.push(runtimePane);
+        panes.push({ id: "runtime", kind: "runtime", split: "right", sizePct: 30, cwd: "worktree" });
         return panes;
       }
       requireDockerProfile(profile) {
@@ -60368,7 +60552,6 @@ var DEFAULT_TERMINAL_TTL_MS, ProjectInitTracker;
 var init_project_init_service = __esm({
   "../host/src/modules/taskflow/services/project-init-service.ts"() {
     "use strict";
-    init_log2();
     DEFAULT_TERMINAL_TTL_MS = 6e4;
     ProjectInitTracker = class {
       inits = /* @__PURE__ */ new Map();
@@ -68981,10 +69164,10 @@ var init_native_terminal_service = __esm({
 });
 
 // ../host/src/modules/taskflow/server/routes/worktrees.ts
-import { mkdirSync as mkdirSync8 } from "node:fs";
+import { mkdirSync as mkdirSync9 } from "node:fs";
 import { writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join as join21, resolve as resolve16 } from "node:path";
+import { join as join22, resolve as resolve16 } from "node:path";
 async function apiGetNativeTerminalLaunch(project2, branch) {
   touchDashboardActivity();
   project2.ensureBranchNotBusy(branch);
@@ -69318,8 +69501,8 @@ async function apiUploadFiles(project2, name, req) {
   }
   const entries = formData.getAll("files");
   if (entries.length === 0) return errorResponse("No files provided", 400);
-  const uploadDir = join21(tmpdir(), RUNTIME_IDENTITY.tempUploadDir, sanitizeFilename(name));
-  mkdirSync8(uploadDir, { recursive: true });
+  const uploadDir = join22(tmpdir(), RUNTIME_IDENTITY.tempUploadDir, sanitizeFilename(name));
+  mkdirSync9(uploadDir, { recursive: true });
   const results = [];
   for (const entry of entries) {
     if (!(entry instanceof File)) continue;
@@ -69330,7 +69513,7 @@ async function apiUploadFiles(project2, name, req) {
       return errorResponse(`File too large: ${entry.name} (max 10MB)`, 400);
     }
     const safeName = `${Date.now()}_${sanitizeFilename(entry.name)}`;
-    const destPath = join21(uploadDir, safeName);
+    const destPath = join22(uploadDir, safeName);
     if (!resolve16(destPath).startsWith(`${uploadDir}/`)) {
       return errorResponse("Invalid filename", 400);
     }
@@ -70066,7 +70249,7 @@ var init_codex_app_server = __esm({
 });
 
 // ../host/src/modules/taskflow/adapters/run-store.ts
-import { mkdirSync as mkdirSync9 } from "node:fs";
+import { mkdirSync as mkdirSync10 } from "node:fs";
 import { dirname as dirname15 } from "node:path";
 function defaultRunStorePath() {
   return globalPaths().database;
@@ -70227,7 +70410,7 @@ function isConstraint(error61, target) {
   return error61 instanceof Error && error61.message.includes(target);
 }
 function createRunStore(path7 = defaultRunStorePath()) {
-  mkdirSync9(dirname15(path7), { recursive: true });
+  mkdirSync10(dirname15(path7), { recursive: true });
   const database = openDatabase(path7);
   database.pragma("foreign_keys = ON");
   database.pragma("journal_mode = WAL");
@@ -70647,10 +70830,15 @@ var init_run_store = __esm({
       input_json TEXT NOT NULL,
       status TEXT NOT NULL CHECK(status IN ('queued', 'provisioning', 'running', 'waiting_input', 'completed', 'failed', 'cancelled', 'interrupted')),
       workspace_policy TEXT NOT NULL CHECK(workspace_policy IN ('none', 'run')),
+      workspace_strategy TEXT CHECK(workspace_strategy IN ('isolated_worktree', 'new_branch', 'current_branch')),
+      workspace_access TEXT CHECK(workspace_access IN ('shared_read', 'exclusive_write')),
       workflow_snapshot_id TEXT,
       workspace_id TEXT,
       worktree_path TEXT,
       canonical_workspace_path TEXT,
+      checkout_canonical_path TEXT,
+      checkout_branch TEXT,
+      environment_id TEXT,
       branch TEXT,
       base_branch TEXT,
       base_commit TEXT,
@@ -70678,6 +70866,7 @@ var init_run_store = __esm({
       path TEXT NOT NULL,
       content_hash TEXT NOT NULL,
       engine_version TEXT NOT NULL,
+      key_version TEXT NOT NULL DEFAULT 'v1',
       source TEXT NOT NULL,
       metadata_json TEXT NOT NULL,
       created_at TEXT NOT NULL
@@ -70702,6 +70891,7 @@ var init_run_store = __esm({
       error TEXT,
       session_id TEXT,
       capabilities_json TEXT,
+      checkpoint_json TEXT,
       started_at TEXT,
       completed_at TEXT,
       UNIQUE(run_id, node_key, attempt)
@@ -70713,10 +70903,7 @@ var init_run_store = __esm({
       source TEXT NOT NULL,
       updated_at TEXT NOT NULL
     );
-  `,
-      "ALTER TABLE executions ADD COLUMN checkpoint_json TEXT;",
-      "ALTER TABLE workflow_snapshots ADD COLUMN key_version TEXT NOT NULL DEFAULT 'v1';",
-      `
+
     CREATE TABLE IF NOT EXISTS run_events (
       id TEXT PRIMARY KEY,
       run_id TEXT NOT NULL REFERENCES runs(id),
@@ -70729,8 +70916,7 @@ var init_run_store = __esm({
       payload_json TEXT NOT NULL,
       UNIQUE(run_id, sequence)
     );
-  `,
-      `
+
     CREATE TABLE IF NOT EXISTS workspace_leases (
       id TEXT PRIMARY KEY,
       run_id TEXT NOT NULL REFERENCES runs(id),
@@ -70748,12 +70934,7 @@ var init_run_store = __esm({
       updated_at TEXT NOT NULL,
       released_at TEXT
     );
-  `,
-      "ALTER TABLE runs ADD COLUMN workspace_strategy TEXT CHECK(workspace_strategy IN ('isolated_worktree', 'new_branch', 'current_branch'));",
-      "ALTER TABLE runs ADD COLUMN workspace_access TEXT CHECK(workspace_access IN ('shared_read', 'exclusive_write'));",
-      "ALTER TABLE runs ADD COLUMN checkout_canonical_path TEXT;",
-      "ALTER TABLE runs ADD COLUMN checkout_branch TEXT;",
-      `
+
     CREATE TABLE IF NOT EXISTS checkout_claims (
       run_id TEXT PRIMARY KEY REFERENCES runs(id),
       project_id TEXT NOT NULL,
@@ -70762,8 +70943,7 @@ var init_run_store = __esm({
       created_at TEXT NOT NULL
     );
     CREATE INDEX IF NOT EXISTS checkout_claims_path_idx ON checkout_claims(project_id, canonical_path);
-  `,
-      "ALTER TABLE runs ADD COLUMN environment_id TEXT;"
+  `
     ];
   }
 });
@@ -71016,26 +71196,26 @@ var init_types2 = __esm({
 });
 
 // ../host/src/modules/taskflow/workflows/runtime/journal.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync10, readdirSync as readdirSync3, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname16, join as join22 } from "node:path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync11, readdirSync as readdirSync3, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname16, join as join23 } from "node:path";
 function dataRoot(roots = {}) {
   return roots.dataRoot ?? globalPaths().root;
 }
 function runDir(runId, roots = {}) {
-  return join22(dataRoot(roots), "runs", runId);
+  return join23(dataRoot(roots), "runs", runId);
 }
 function journalPath(runId, roots = {}) {
-  return join22(runDir(runId, roots), "journal.jsonl");
+  return join23(runDir(runId, roots), "journal.jsonl");
 }
 function ensureRunDir(runId, roots = {}) {
   const dir = runDir(runId, roots);
-  mkdirSync10(dir, { recursive: true });
+  mkdirSync11(dir, { recursive: true });
   return dir;
 }
 function listRunIds(roots = {}) {
-  const dir = join22(dataRoot(roots), "runs");
-  if (!existsSync9(dir)) return [];
-  return readdirSync3(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && existsSync9(join22(dir, e.name, "journal.jsonl"))).map((e) => e.name).sort().reverse();
+  const dir = join23(dataRoot(roots), "runs");
+  if (!existsSync10(dir)) return [];
+  return readdirSync3(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && existsSync10(join23(dir, e.name, "journal.jsonl"))).map((e) => e.name).sort().reverse();
 }
 function checkResumePreconditions(meta3, current) {
   if (!meta3) return;
@@ -71061,7 +71241,7 @@ function canonicalArgs(value3) {
 }
 function writeResult(runId, value3, roots = {}) {
   const dir = ensureRunDir(runId, roots);
-  writeFileSync8(join22(dir, "result.json"), JSON.stringify(value3, null, 2), "utf8");
+  writeFileSync8(join23(dir, "result.json"), JSON.stringify(value3, null, 2), "utf8");
 }
 var JournalNotFoundError, ResumePreconditionError, Journal;
 var init_journal = __esm({
@@ -71089,7 +71269,7 @@ var init_journal = __esm({
       path;
       constructor(runId, roots = {}) {
         this.path = journalPath(runId, roots);
-        mkdirSync10(dirname16(this.path), { recursive: true });
+        mkdirSync11(dirname16(this.path), { recursive: true });
       }
       append(entry) {
         appendFileSync2(this.path, `${JSON.stringify(entry)}
@@ -71097,12 +71277,12 @@ var init_journal = __esm({
       }
       /** True if a journal file exists for this run id (vs. a typo'd / absent run). */
       static exists(runId, roots = {}) {
-        return existsSync9(journalPath(runId, roots));
+        return existsSync10(journalPath(runId, roots));
       }
       static load(runId, roots = {}) {
         const path7 = journalPath(runId, roots);
         const out = { results: /* @__PURE__ */ new Map(), indexByKey: /* @__PURE__ */ new Map() };
-        if (!existsSync9(path7)) return out;
+        if (!existsSync10(path7)) return out;
         const text = readFileSync13(path7, "utf8");
         for (const line4 of text.split("\n")) {
           const trimmed = line4.trim();
@@ -71505,9 +71685,9 @@ var init_sandbox = __esm({
 });
 
 // ../host/src/modules/taskflow/workflows/runtime/registry.ts
-import { existsSync as existsSync10, readdirSync as readdirSync4, readFileSync as readFileSync14, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync11, readdirSync as readdirSync4, readFileSync as readFileSync14, statSync as statSync6 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname17, join as join23, resolve as resolve17 } from "node:path";
+import { dirname as dirname17, join as join24, resolve as resolve17 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function builtinDir() {
   const here = dirname17(fileURLToPath4(import.meta.url));
@@ -71516,10 +71696,10 @@ function builtinDir() {
     ["..", "..", "builtins"],
     ["..", "..", "..", "..", "..", "workflows"]
   ]) {
-    const candidate = join23(here, ...rel);
-    if (existsSync10(candidate)) return candidate;
+    const candidate = join24(here, ...rel);
+    if (existsSync11(candidate)) return candidate;
   }
-  return join23(here, "..", "builtins");
+  return join24(here, "..", "builtins");
 }
 function projectDirs(cwd) {
   const dirs = [];
@@ -71527,8 +71707,8 @@ function projectDirs(cwd) {
   let dir = resolve17(cwd);
   for (; ; ) {
     const workflows = projectPaths(dir).workflows;
-    if (existsSync10(workflows)) dirs.push(workflows);
-    if (existsSync10(join23(dir, ".git"))) break;
+    if (existsSync11(workflows)) dirs.push(workflows);
+    if (existsSync11(join24(dir, ".git"))) break;
     const parent = dirname17(dir);
     if (dir === home2 || parent === dir) break;
     dir = parent;
@@ -71542,7 +71722,7 @@ function workflowDirs(cwd, roots) {
         tier: "project",
         dir: resolve17(dir)
       })),
-      { tier: "user", dir: roots.globalDir ?? join23(dataRoot({ dataRoot: roots.dataRoot }), "workflows") },
+      { tier: "user", dir: roots.globalDir ?? join24(dataRoot({ dataRoot: roots.dataRoot }), "workflows") },
       { tier: "builtin", dir: roots.builtinDir ?? builtinDir() }
     ];
   }
@@ -71562,7 +71742,7 @@ function scanDir(tier, dir) {
   const entries = [];
   for (const file2 of names) {
     if (!file2.endsWith(".js")) continue;
-    const filePath = join23(dir, file2);
+    const filePath = join24(dir, file2);
     try {
       if (statSync6(filePath).size > MAX_WORKFLOW_BYTES) continue;
       const { meta: meta3 } = parseWorkflow(readFileSync14(filePath, "utf8"));
@@ -78622,7 +78802,7 @@ var init_schema = __esm({
 // ../host/src/modules/taskflow/workflows/worker/claude.ts
 import { readlinkSync, realpathSync as realpathSync3 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { basename as basename9, dirname as dirname18, isAbsolute as isAbsolute3, join as join24, relative as relative4, resolve as resolve18 } from "node:path";
+import { basename as basename9, dirname as dirname18, isAbsolute as isAbsolute3, join as join25, relative as relative4, resolve as resolve18 } from "node:path";
 function toClaudeEffort(effort) {
   return effort === "none" || effort === "minimal" ? "low" : effort;
 }
@@ -78661,7 +78841,7 @@ function realpathUpward(p) {
   for (let hops = 0; hops < 40; hops++) {
     try {
       const real = realpathSync3(existing);
-      return suffix ? join24(real, suffix) : real;
+      return suffix ? join25(real, suffix) : real;
     } catch {
     }
     try {
@@ -78672,7 +78852,7 @@ function realpathUpward(p) {
     }
     const parent = dirname18(existing);
     if (parent === existing) return p;
-    suffix = suffix ? join24(basename9(existing), suffix) : basename9(existing);
+    suffix = suffix ? join25(basename9(existing), suffix) : basename9(existing);
     existing = parent;
   }
   return p;
@@ -78766,7 +78946,7 @@ function unquote(s) {
 }
 function expandHome(p) {
   if (p === "~") return homedir5();
-  if (p.startsWith("~/")) return join24(homedir5(), p.slice(2));
+  if (p.startsWith("~/")) return join25(homedir5(), p.slice(2));
   return p;
 }
 function usageFromResult(last) {
@@ -79398,7 +79578,7 @@ ${tail}` : message;
 
 // ../host/src/modules/taskflow/workflows/worker/codex.ts
 import { copyFile, writeFile as writeFile7 } from "node:fs/promises";
-import { basename as basename10, join as join25 } from "node:path";
+import { basename as basename10, join as join26 } from "node:path";
 function textInput(text) {
   return [{ type: "text", text, text_elements: [] }];
 }
@@ -79814,7 +79994,7 @@ var init_codex = __esm({
         const id = basename10(rawId) || "image";
         const savedPath = typeof item.savedPath === "string" ? item.savedPath : void 0;
         const b64 = typeof item.result === "string" ? item.result : void 0;
-        const dest = join25(state3.cwd, `${id}.png`);
+        const dest = join26(state3.cwd, `${id}.png`);
         const write4 = (async () => {
           try {
             if (savedPath) await copyFile(savedPath, dest);
@@ -80605,7 +80785,7 @@ __export(pi_exports, {
 });
 import { mkdtempSync, rmSync as rmSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 function extractionPrompt2(spec, workingText) {
   return `Earlier you produced this answer:
 
@@ -80769,7 +80949,7 @@ var init_pi = __esm({
         return this.versionCheck;
       }
       async checkVersion() {
-        const scratch = mkdtempSync(join26(tmpdir2(), `${APP_SLUG}-pi-version-`));
+        const scratch = mkdtempSync(join27(tmpdir2(), `${APP_SLUG}-pi-version-`));
         let out;
         try {
           out = await captureStdout({
@@ -80976,7 +81156,7 @@ var init_factory = __esm({
 });
 
 // ../host/src/modules/taskflow/workflows/runtime/jsonl-writer.ts
-import { createWriteStream as createWriteStream2, mkdirSync as mkdirSync11 } from "node:fs";
+import { createWriteStream as createWriteStream2, mkdirSync as mkdirSync12 } from "node:fs";
 function dirOf(filePath) {
   const i3 = Math.max(filePath.lastIndexOf("/"), filePath.lastIndexOf("\\"));
   return i3 <= 0 ? "." : filePath.slice(0, i3);
@@ -80989,7 +81169,7 @@ var init_jsonl_writer = __esm({
       stream;
       dead = false;
       constructor(filePath, opts = {}) {
-        mkdirSync11(dirOf(filePath), { recursive: true });
+        mkdirSync12(dirOf(filePath), { recursive: true });
         this.stream = createWriteStream2(filePath, { flags: opts.flags ?? "a" });
         this.stream.on("error", (err2) => {
           this.dead = true;
@@ -81030,7 +81210,7 @@ var init_jsonl_writer = __esm({
 });
 
 // ../host/src/modules/taskflow/workflows/runtime/event-sink.ts
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 var FileEventSink;
 var init_event_sink = __esm({
   "../host/src/modules/taskflow/workflows/runtime/event-sink.ts"() {
@@ -81042,7 +81222,7 @@ var init_event_sink = __esm({
       listeners;
       clock;
       constructor(runId, opts = {}) {
-        this.writer = new JsonlWriter(join27(runDir(runId, opts.roots), "events.jsonl"), { flags: "a" });
+        this.writer = new JsonlWriter(join28(runDir(runId, opts.roots), "events.jsonl"), { flags: "a" });
         this.listeners = opts.listeners ?? [];
         this.clock = opts.clock ?? (() => globalThis.Date.now());
       }
@@ -81144,15 +81324,15 @@ var init_semaphore = __esm({
 });
 
 // ../host/src/modules/taskflow/workflows/runtime/transcript.ts
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 function agentsDir(runId, roots = {}) {
-  return join28(runDir(runId, roots), "agents");
+  return join29(runDir(runId, roots), "agents");
 }
 function agentTranscriptPath(runId, index, roots = {}) {
-  return join28(agentsDir(runId, roots), `${index}.jsonl`);
+  return join29(agentsDir(runId, roots), `${index}.jsonl`);
 }
 function agentTranscriptPathByName(runId, name, roots = {}) {
-  return join28(agentsDir(runId, roots), `${sanitizeName(name)}.jsonl`);
+  return join29(agentsDir(runId, roots), `${sanitizeName(name)}.jsonl`);
 }
 function truncate2(s, max) {
   if (s.length <= max) return s;
@@ -81241,8 +81421,8 @@ var init_transcript = __esm({
 
 // ../host/src/modules/taskflow/workflows/runtime/worktree.ts
 import { execFile } from "node:child_process";
-import { existsSync as existsSync11, rmSync as rmSync3 } from "node:fs";
-import { join as join29 } from "node:path";
+import { existsSync as existsSync12, rmSync as rmSync3 } from "node:fs";
+import { join as join30 } from "node:path";
 import { promisify as promisify3 } from "node:util";
 async function git3(cwd, args) {
   const { stdout: stdout2 } = await exec("git", args, { cwd, maxBuffer: 64 * 1024 * 1024 });
@@ -81258,7 +81438,7 @@ async function findGitRoot(cwd) {
 async function createWorktree(args) {
   const name = `${args.runId}-${args.index}`;
   const branch = args.branch ?? `aw/${name}`;
-  const path7 = join29(projectPaths(args.gitRoot).worktrees, name);
+  const path7 = join30(projectPaths(args.gitRoot).worktrees, name);
   const base2 = await git3(args.gitRoot, ["rev-parse", "HEAD"]);
   await pruneStaleWorktree(args.gitRoot, path7);
   await git3(args.gitRoot, ["worktree", "add", "--relative-paths", "--detach", path7, base2]);
@@ -81280,7 +81460,7 @@ async function pruneStaleWorktree(gitRoot2, path7) {
   });
   await git3(gitRoot2, ["worktree", "prune"]).catch(() => {
   });
-  if (existsSync11(path7)) {
+  if (existsSync12(path7)) {
     try {
       rmSync3(path7, { recursive: true, force: true });
     } catch {
@@ -82013,7 +82193,7 @@ ${e.status === "completed" ? "\u2713" : "\u2717"} ${e.status}${e.error ? `: ${e.
 // ../host/src/modules/taskflow/workflows/runtime/run.ts
 import { createHash as createHash10, randomBytes as randomBytes7 } from "node:crypto";
 import { readFileSync as readFileSync15, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join30, resolve as resolve19 } from "node:path";
+import { join as join31, resolve as resolve19 } from "node:path";
 async function runWorkflow(opts) {
   const filePath = resolve19(opts.file);
   const source = readFileSync15(filePath, "utf8");
@@ -82073,7 +82253,7 @@ async function runWorkflow(opts) {
   if (opts.signal?.aborted) ac.abort();
   else opts.signal?.addEventListener("abort", onSig, { once: true });
   events.emit({ type: "run", status: "started", runId, workflowFile: filePath });
-  const heartbeatFile = join30(runDir(runId, opts.roots), ".heartbeat");
+  const heartbeatFile = join31(runDir(runId, opts.roots), ".heartbeat");
   const beat = () => {
     try {
       writeFileSync9(heartbeatFile, String(Date.now()));
@@ -83274,9 +83454,9 @@ var init_environment_diagnostics_service = __esm({
 });
 
 // ../host/src/modules/taskflow/services/environment-worker-factory.ts
-import { chmodSync as chmodSync6, mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
+import { chmodSync as chmodSync7, mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join31, posix as posix4, relative as relative5 } from "node:path";
+import { join as join32, posix as posix4, relative as relative5 } from "node:path";
 function mapAgentSpecToEnvironment(spec, hostWorkspace, containerWorkspace) {
   const suffix = relative5(hostWorkspace, spec.cwd);
   if (suffix.startsWith("..")) {
@@ -83329,12 +83509,12 @@ var init_environment_worker_factory = __esm({
         this.handle = handle2;
         const containerWorkspace = handle2.workspace.containerPath;
         if (!containerWorkspace) throw new Error(`Environment has no container workspace: ${handle2.id}`);
-        this.directory = mkdtempSync2(join31(tmpdir3(), "taskflow-environment-workers-"));
+        this.directory = mkdtempSync2(join32(tmpdir3(), "taskflow-environment-workers-"));
         const paths3 = Object.fromEntries(
           Object.entries(executableByProvider).map(([provider, executable2]) => {
-            const path7 = join31(this.directory, provider);
+            const path7 = join32(this.directory, provider);
             writeFileSync10(path7, transport.executableShim(handle2, executable2), { encoding: "utf8", mode: 448 });
-            chmodSync6(path7, 448);
+            chmodSync7(path7, 448);
             return [provider, path7];
           })
         );
@@ -84406,7 +84586,7 @@ var init_run_presentation_service = __esm({
 });
 
 // ../host/src/modules/taskflow/services/workspace-facade.ts
-import { join as join32 } from "node:path";
+import { join as join33 } from "node:path";
 function workspaceBindingFor(runId, projectRoot2, workspaceRoot, baseBranch, baseCommit, workspace2, access5) {
   const segment3 = runId.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "run";
   if (workspace2.strategy !== "isolated_worktree") {
@@ -84423,7 +84603,7 @@ function workspaceBindingFor(runId, projectRoot2, workspaceRoot, baseBranch, bas
     };
   }
   const name = `${APP_SLUG}-run-${segment3}`;
-  const path7 = join32(workspaceRoot, name);
+  const path7 = join33(workspaceRoot, name);
   return {
     workspaceId: `workspace_${runId}`,
     path: path7,
@@ -84441,7 +84621,7 @@ function slugSegment(value3, fallback) {
 function forkBindingFor(run2, workspaceRoot, slug2) {
   const runSegment = slugSegment(run2.id, "run");
   const forkSegment = slugSegment(slug2, "fork");
-  const path7 = join32(workspaceRoot, `${APP_SLUG}-run-${runSegment}-fork-${forkSegment}`);
+  const path7 = join33(workspaceRoot, `${APP_SLUG}-run-${runSegment}-fork-${forkSegment}`);
   return {
     workspaceId: `workspace_lease_${run2.id}_${forkSegment}`,
     path: path7,
@@ -84743,7 +84923,7 @@ var init_workspace_facade = __esm({
 
 // ../host/src/modules/taskflow/services/run-service.ts
 import { readFile as readFile9 } from "node:fs/promises";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 function provisioningReason(reason) {
   return reason === "branch_conflict" || reason === "workspace_path_conflict" || reason === "checkout_busy" || reason === "dirty_workspace" || reason === "detached_head" ? reason : "workspace_provision_failed";
 }
@@ -85402,7 +85582,7 @@ var init_run_service = __esm({
             root2,
             terminal.cursor,
             terminal.type === "completed" ? "completed" : active.cancelling ? "cancelled" : "failed",
-            terminal.type === "completed" ? { resultPath: join33(root2.dataRoot, "runs", engineRunId, "result.json") } : null
+            terminal.type === "completed" ? { resultPath: join34(root2.dataRoot, "runs", engineRunId, "result.json") } : null
           );
         const completedAt = this.now().toISOString();
         if (terminal.type === "completed") {
@@ -85514,7 +85694,7 @@ var init_run_service = __esm({
       async completedResult(engineRunId, dataRoot2) {
         try {
           const result = JsonValueSchema.safeParse(
-            JSON.parse(await readFile9(join33(dataRoot2, "runs", engineRunId, "result.json"), "utf8"))
+            JSON.parse(await readFile9(join34(dataRoot2, "runs", engineRunId, "result.json"), "utf8"))
           );
           return result.success ? result.data : null;
         } catch {
@@ -85919,7 +86099,7 @@ var init_taskflow_direct_session_service = __esm({
 // ../host/src/modules/taskflow/services/workflow-catalog-service.ts
 import { createHash as createHash11 } from "node:crypto";
 import { readdir as readdir4, readFile as readFile10, stat as stat4 } from "node:fs/promises";
-import { join as join34, resolve as resolve21 } from "node:path";
+import { join as join35, resolve as resolve21 } from "node:path";
 function hash3(value3) {
   return `sha256:${createHash11("sha256").update(value3).digest("hex")}`;
 }
@@ -85963,7 +86143,7 @@ function duplicateDiagnostic(name, origin) {
 function rootsFor(config3) {
   return [
     { origin: "project", directory: projectPaths(resolve21(config3.projectRoot)).workflows, priority: 0 },
-    { origin: "global", directory: join34(resolve21(config3.taskflowHome), PATH_NAMES.workflows), priority: 1 },
+    { origin: "global", directory: join35(resolve21(config3.taskflowHome), PATH_NAMES.workflows), priority: 1 },
     { origin: "builtin", directory: resolve21(config3.builtinRoot), priority: 2 }
   ];
 }
@@ -86077,7 +86257,7 @@ var init_workflow_catalog_service = __esm({
           return { candidates, diagnostics, invalidEntries };
         }
         for (const name of names) {
-          const path7 = join34(root2.directory, name);
+          const path7 = join35(root2.directory, name);
           try {
             if ((await stat4(path7)).size > MAX_WORKFLOW_BYTES2) {
               const diagnostic = {
@@ -86122,7 +86302,7 @@ var init_workflow_catalog_service = __esm({
 });
 
 // ../host/src/modules/taskflow/services/workflow-event-bridge.ts
-import { join as join35 } from "node:path";
+import { join as join36 } from "node:path";
 function record5(value3) {
   if (typeof value3 !== "object" || value3 === null || Array.isArray(value3)) return null;
   const output2 = {};
@@ -86212,7 +86392,7 @@ function executionFor(run2, existing, details, context) {
       key: details.key,
       index: details.index,
       phaseIndex: details.phaseIndex,
-      transcriptPath: context ? join35(context.dataRoot, "runs", context.engineRunId, "agents", `${details.index}.jsonl`) : null
+      transcriptPath: context ? join36(context.dataRoot, "runs", context.engineRunId, "agents", `${details.index}.jsonl`) : null
     },
     workspaceId: run2.workspaceId,
     input: existing?.input ?? null,
@@ -86280,7 +86460,7 @@ var init_workflow_event_bridge = __esm({
 
 // ../host/src/modules/taskflow/services/workflow-runner.ts
 import { mkdir as mkdir5, writeFile as writeFile8 } from "node:fs/promises";
-import { join as join36 } from "node:path";
+import { join as join37 } from "node:path";
 function envelope(spec, message) {
   return {
     ...message,
@@ -86320,9 +86500,9 @@ var init_workflow_runner = __esm({
         const pid = process.pid;
         let heartbeat;
         const done = (async () => {
-          const runDirectory = join36(spec.spec.dataRoot, "runs", spec.engineRunId);
+          const runDirectory = join37(spec.spec.dataRoot, "runs", spec.engineRunId);
           await mkdir5(runDirectory, { recursive: true });
-          const snapshotPath = join36(runDirectory, "workflow.js");
+          const snapshotPath = join37(runDirectory, "workflow.js");
           await writeFile8(snapshotPath, spec.spec.source, "utf8");
           emit(envelope(spec, { type: "started", pid }));
           heartbeat = setInterval(() => {
@@ -87009,15 +87189,15 @@ var init_worktree_conversation_service = __esm({
 
 // ../host/src/modules/taskflow/adapters/docker-compose-environment.ts
 import { createHash as createHash12 } from "node:crypto";
-import { existsSync as existsSync12, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync16 } from "node:fs";
 import { resolve as resolve22 } from "node:path";
 function composeFile(workspacePath, configured) {
   if (configured) {
     const candidate = resolve22(workspacePath, configured);
-    if (existsSync12(candidate)) return candidate;
+    if (existsSync13(candidate)) return candidate;
     throw new Error(`Docker Compose file does not exist: ${configured}`);
   }
-  const found = COMPOSE_FILENAMES.map((file2) => resolve22(workspacePath, file2)).find(existsSync12);
+  const found = COMPOSE_FILENAMES.map((file2) => resolve22(workspacePath, file2)).find(existsSync13);
   if (!found) throw new Error("No Docker Compose file was found");
   return found;
 }
@@ -87046,7 +87226,7 @@ var init_docker_compose_environment = __esm({
       }
       async probe(context) {
         const version3 = await runCaptured(this.runner, { command: "docker", args: ["compose", "version", "--short"] });
-        const configs = COMPOSE_FILENAMES.map((file2) => resolve22(context.workspacePath, file2)).filter(existsSync12);
+        const configs = COMPOSE_FILENAMES.map((file2) => resolve22(context.workspacePath, file2)).filter(existsSync13);
         return {
           provider: this.id,
           available: version3.exit.code === 0 && configs.length > 0,
@@ -88393,8 +88573,8 @@ var init_project_environments = __esm({
 // ../host/src/modules/taskflow/server/project-app.ts
 import { spawn as spawn8 } from "node:child_process";
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { existsSync as existsSync13 } from "node:fs";
-import { dirname as dirname20, join as join37, resolve as resolve23 } from "node:path";
+import { existsSync as existsSync14 } from "node:fs";
+import { dirname as dirname20, join as join38, resolve as resolve23 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function workflowAgentRuntimeConfig(value3) {
   if (typeof value3 !== "object" || value3 === null || Array.isArray(value3)) {
@@ -88425,7 +88605,7 @@ function createProjectApp(runtime2, instancePrefix, host2) {
   const reconciliationService = runtime2.reconciliationService;
   const codexAppServerClient = new CodexAppServerClient({
     clientName: RUNTIME_IDENTITY.codexClientName,
-    clientVersion: "0.0.0"
+    clientVersion: PORTTA_FLOW_VERSION
   });
   const claudeCliClient = new ClaudeCliClient();
   const worktreeConversationService = new WorktreeConversationService({
@@ -88478,14 +88658,14 @@ function createProjectApp(runtime2, instancePrefix, host2) {
   const workflowEvents = new WorkflowEventBridge({ store: runStore, publisher: runEventPublisher });
   const workspaces = new WorkspaceFacade({ store: runStore, git: git4 });
   const workflowDataRoot = globalPaths().root;
-  const supervisorSocket = join37(workflowDataRoot, "runtime", "supervisor.sock");
+  const supervisorSocket = join38(workflowDataRoot, "runtime", "supervisor.sock");
   const supervisor = new AgentSupervisorClient({
     socketPath: supervisorSocket,
     startDaemon: () => {
       const directory = dirname20(fileURLToPath5(import.meta.url));
-      const builtEntry = join37(directory, "supervisor.js");
-      const sourceEntry = join37(directory, "supervisor.ts");
-      const child = existsSync13(builtEntry) ? spawn8(process.execPath, [builtEntry], { detached: true, stdio: "ignore" }) : spawn8(process.execPath, ["--import", "tsx", sourceEntry], { detached: true, stdio: "ignore" });
+      const builtEntry = join38(directory, "supervisor.js");
+      const sourceEntry = join38(directory, "supervisor.ts");
+      const child = existsSync14(builtEntry) ? spawn8(process.execPath, [builtEntry], { detached: true, stdio: "ignore" }) : spawn8(process.execPath, ["--import", "tsx", sourceEntry], { detached: true, stdio: "ignore" });
       child.unref();
     }
   });
@@ -89928,7 +90108,7 @@ var init_upgrade = __esm({
 });
 
 // ../host/src/modules/taskflow/server/host.ts
-import { existsSync as existsSync14 } from "node:fs";
+import { existsSync as existsSync15 } from "node:fs";
 function createTaskflowHost(options) {
   const apps = /* @__PURE__ */ new Map();
   const manager = new ProjectManager({
@@ -89958,8 +90138,8 @@ function createTaskflowHost(options) {
     manager,
     apps,
     allowlist: options.projectAllowlist,
-    // Tracks leftover on-add setup records for API compatibility. Registration
-    // no longer scaffolds or launches an agent; `taskflow init` remains the authoring path.
+    // Backs the project-setup status listing. Registration itself does not
+    // scaffold or launch an agent; `taskflow init` is the authoring path.
     initTracker: new ProjectInitTracker(),
     closeSockets: (prefix) => sockets.closeProject(prefix)
   });
@@ -89972,7 +90152,7 @@ function createTaskflowHost(options) {
       if (!isGitRepo(cwd)) return;
       const repoRoot = canonicalizeFsPath(projectRoot(cwd));
       const paths3 = projectPaths(repoRoot);
-      if (!existsSync14(paths3.config) && !existsSync14(paths3.localConfig)) return;
+      if (!existsSync15(paths3.config) && !existsSync15(paths3.localConfig)) return;
       try {
         manager.addEphemeral(repoRoot);
       } catch (err2) {
@@ -89987,7 +90167,7 @@ function createTaskflowHost(options) {
     }
   };
 }
-var init_host2 = __esm({
+var init_host = __esm({
   "../host/src/modules/taskflow/server/host.ts"() {
     "use strict";
     init_paths2();
@@ -90043,7 +90223,7 @@ function createDaemonTaskflowHost(context) {
       port: hostListen(env).port,
       workflowBuiltinsDir: taskflowAssets(env).workflowBuiltinsDir,
       version: env.PORTTA_VERSION || "0.0.0-local",
-      buildDate: true ? "2026-09-18T00:48:59Z" : (/* @__PURE__ */ new Date()).toISOString(),
+      buildDate: true ? "2026-09-18T02:24:34Z" : (/* @__PURE__ */ new Date()).toISOString(),
       environmentStore: createEnvironmentStore(paths3.database),
       hostEnvironmentProvider: new HostEnvironmentProvider(),
       devContainerProvider: new DevContainerProvider(),
@@ -90114,9 +90294,8 @@ var init_taskflow4 = __esm({
     init_user_shell_env();
     init_environment_service_discovery();
     init_project_allowlist();
-    init_host2();
+    init_host();
     init_host_projects();
-    init_runtime();
     TASKFLOW_SOCKET_MOUNT_PATH = `/ws/modules/${taskflowModule.id}`;
     taskflowHostModule = createTaskflowHostModule();
   }
@@ -90990,7 +91169,7 @@ var require_util2 = __commonJS({
     function getFilesInPath(source) {
       const lstatSync = fs.lstatSync;
       const readdirSync11 = fs.readdirSync;
-      const join70 = path7.join;
+      const join71 = path7.join;
       function isDirectory2(source2) {
         return lstatSync(source2).isDirectory();
       }
@@ -90999,12 +91178,12 @@ var require_util2 = __commonJS({
       }
       function getDirectories(source2) {
         return readdirSync11(source2).map((name) => {
-          return join70(source2, name);
+          return join71(source2, name);
         }).filter(isDirectory2);
       }
       function getFiles(source2) {
         return readdirSync11(source2).map((name) => {
-          return join70(source2, name);
+          return join71(source2, name);
         }).filter(isFile);
       }
       function getFilesRecursively(source2) {
@@ -100639,7 +100818,7 @@ var require_network = __commonJS({
     var exec3 = __require("child_process").exec;
     var execSync = __require("child_process").execSync;
     var execFileSync2 = __require("child_process").execFileSync;
-    var readFileSync38 = __require("fs").readFileSync;
+    var readFileSync37 = __require("fs").readFileSync;
     var fs = __require("fs");
     var util2 = require_util2();
     var _platform = process.platform;
@@ -101127,7 +101306,7 @@ var require_network = __commonJS({
         return result;
       }
       try {
-        const content = readFileSync38(file2, { encoding: "utf8" });
+        const content = readFileSync37(file2, { encoding: "utf8" });
         const lines = content.split("\n").filter((l) => /iface|source/.test(l));
         lines.forEach((line4) => {
           const parts2 = line4.replace(/\s+/g, " ").trim().split(" ");
@@ -101294,7 +101473,7 @@ var require_network = __commonJS({
         return false;
       }
     }
-    function networkInterfaces2(callback, rescan, defaultString) {
+    function networkInterfaces(callback, rescan, defaultString) {
       if (typeof callback === "string") {
         defaultString = callback;
         rescan = true;
@@ -101709,7 +101888,7 @@ var require_network = __commonJS({
         });
       });
     }
-    exports.networkInterfaces = networkInterfaces2;
+    exports.networkInterfaces = networkInterfaces;
     function calcNetworkSpeed(iface, rx_bytes, tx_bytes, operstate, rx_dropped, rx_errors, tx_dropped, tx_errors) {
       const result = {
         iface,
@@ -101782,7 +101961,7 @@ var require_network = __commonJS({
           const workload = [];
           if (ifacesArray.length && ifacesArray[0].trim() === "*") {
             ifacesArray = [];
-            networkInterfaces2(false).then((allIFaces) => {
+            networkInterfaces(false).then((allIFaces) => {
               for (let iface of allIFaces) {
                 ifacesArray.push(iface.iface);
               }
@@ -101948,7 +102127,7 @@ var require_network = __commonJS({
                   const psections = stdout2.toString().split(/\n\s*\n/);
                   perfData = parseLinesWindowsPerfData(psections);
                 }
-                networkInterfaces2(false).then((interfaces) => {
+                networkInterfaces(false).then((interfaces) => {
                   rx_bytes = 0;
                   tx_bytes = 0;
                   perfData.forEach((detail2) => {
@@ -103405,7 +103584,7 @@ var require_processes = __commonJS({
                       }
                       exec3(cmd, { maxBuffer: 1024 * 102400 }, function(error61, stdout3) {
                         let curr_processes = stdout3.toString().split("\n");
-                        let all = parseProcStat2(curr_processes.shift());
+                        let all = parseProcStat(curr_processes.shift());
                         let list_new = {};
                         let resultProcess = {};
                         curr_processes.forEach((element) => {
@@ -103583,7 +103762,7 @@ var require_processes = __commonJS({
       });
     }
     exports.services = services;
-    function parseProcStat2(line4) {
+    function parseProcStat(line4) {
       const parts2 = line4.replace(/ +/g, " ").split(" ");
       const user = parts2.length >= 2 ? parseInt(parts2[1]) : 0;
       const nice = parts2.length >= 3 ? parseInt(parts2[2]) : 0;
@@ -103923,7 +104102,7 @@ var require_processes = __commonJS({
                       });
                       exec3(cmd, { maxBuffer: 1024 * 102400 }, (error62, stdout3) => {
                         let curr_processes = stdout3.toString().split("\n");
-                        let all = parseProcStat2(curr_processes.shift());
+                        let all = parseProcStat(curr_processes.shift());
                         let list_new = {};
                         let resultProcess = {};
                         curr_processes.forEach((element) => {
@@ -104378,7 +104557,7 @@ var require_processes = __commonJS({
                     }
                     exec3(cmd, { maxBuffer: 1024 * 102400 }, (error61, stdout3) => {
                       let curr_processes = stdout3.toString().split("\n");
-                      let all = parseProcStat2(curr_processes.shift());
+                      let all = parseProcStat(curr_processes.shift());
                       let list_new = {};
                       let resultProcess = {};
                       curr_processes.forEach((element) => {
@@ -108452,7 +108631,7 @@ var require_lib = __commonJS({
 });
 
 // src/commands/flow/daemon.ts
-import { existsSync as existsSync25, readFileSync as readFileSync24 } from "node:fs";
+import { existsSync as existsSync25, readFileSync as readFileSync23 } from "node:fs";
 function flowStateDir(env = process.env) {
   const configured = env[ENV_NAMES.hostStateDir]?.trim();
   if (configured) return configured;
@@ -108470,7 +108649,7 @@ function daemonToken(env = process.env) {
   const file2 = hostTokenFile(flowStateDir(env));
   if (existsSync25(file2)) {
     try {
-      const token = readFileSync24(file2, "utf8").trim();
+      const token = readFileSync23(file2, "utf8").trim();
       if (token) return token;
     } catch {
     }
@@ -108573,8 +108752,8 @@ var init_server_port = __esm({
 
 // ../host/src/modules/taskflow/lib/shell.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync26, readFileSync as readFileSync25 } from "node:fs";
-import { basename as basename16, join as join48 } from "node:path";
+import { existsSync as existsSync26, readFileSync as readFileSync24 } from "node:fs";
+import { basename as basename16, join as join49 } from "node:path";
 function run(cmd, args, opts) {
   const resolved2 = resolveHostTool(cmd) ?? cmd;
   const result = spawnSync8(resolved2, args, {
@@ -108594,10 +108773,10 @@ function getGitRoot() {
   return result.stdout.toString().trim();
 }
 function detectProjectName(gitRoot2) {
-  const pkgPath = join48(gitRoot2, "package.json");
+  const pkgPath = join49(gitRoot2, "package.json");
   if (existsSync26(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync25(pkgPath, "utf-8"));
+      const pkg = JSON.parse(readFileSync24(pkgPath, "utf-8"));
       if (pkg.name) return pkg.name;
     } catch {
     }
@@ -108752,36 +108931,6 @@ var init_project_env2 = __esm({
   }
 });
 
-// src/commands/flow/process.ts
-async function runProcess3(file2, args = [], options = {}) {
-  const execaOptions = {
-    cwd: options.cwd,
-    env: options.env,
-    input: options.input,
-    reject: options.reject ?? true,
-    shell: false,
-    timeout: options.timeout,
-    stdio: options.input !== void 0 ? ["pipe", options.stdio ?? "pipe", options.stdio ?? "pipe"] : options.stdio
-  };
-  const result = await execa(file2, [...args], execaOptions);
-  const notStarted = result.failed && result.exitCode === void 0 && !result.signal && !result.timedOut;
-  return {
-    stdout: typeof result.stdout === "string" ? result.stdout : "",
-    stderr: typeof result.stderr === "string" ? result.stderr : "",
-    exitCode: result.exitCode ?? (result.failed ? 1 : 0),
-    failed: result.failed,
-    ...notStarted && "originalMessage" in result ? { error: String(result.originalMessage) } : {}
-  };
-}
-var PROCESS_POLICY2;
-var init_process = __esm({
-  "src/commands/flow/process.ts"() {
-    "use strict";
-    init_execa();
-    PROCESS_POLICY2 = Object.freeze({ shell: false, argumentArraysOnly: true });
-  }
-});
-
 // src/commands/flow/completions.ts
 var completions_exports = {};
 __export(completions_exports, {
@@ -108814,7 +108963,7 @@ function completionTree(command) {
   };
 }
 async function defaultRunGit(args) {
-  const result = await runProcess3("git", args, { reject: false });
+  const result = await runProcess("git", args, { reject: false });
   return { exitCode: result.exitCode, stdout: result.stdout.trim() };
 }
 async function listWorktreeBranches(deps = { runGit: defaultRunGit }) {
@@ -110103,9 +110252,9 @@ ${f}
 });
 
 // ../host/src/modules/taskflow/services/init-authoring.ts
-import { existsSync as existsSync28, readFileSync as readFileSync26, rmSync as rmSync8 } from "node:fs";
+import { existsSync as existsSync28, readFileSync as readFileSync25, rmSync as rmSync8 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join49 } from "node:path";
+import { join as join50 } from "node:path";
 function isRecord8(value3) {
   return typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
 }
@@ -110113,9 +110262,9 @@ function readString4(value3) {
   return typeof value3 === "string" && value3.trim().length > 0 ? value3 : null;
 }
 function detectPackageManager(gitRoot2) {
-  if (existsSync28(join49(gitRoot2, "bun.lock")) || existsSync28(join49(gitRoot2, "bun.lockb"))) return "bun";
-  if (existsSync28(join49(gitRoot2, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync28(join49(gitRoot2, "yarn.lock"))) return "yarn";
+  if (existsSync28(join50(gitRoot2, "bun.lock")) || existsSync28(join50(gitRoot2, "bun.lockb"))) return "bun";
+  if (existsSync28(join50(gitRoot2, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync28(join50(gitRoot2, "yarn.lock"))) return "yarn";
   return "npm";
 }
 function detectMainBranch(gitRoot2) {
@@ -110152,25 +110301,25 @@ function detectInitProjectContext(gitRoot2, defaultAgent) {
 }
 function detectInitEnvironment(gitRoot2, requested = "auto") {
   const devcontainerConfigs = [".devcontainer.json", ".devcontainer/devcontainer.json"].filter(
-    (path7) => existsSync28(join49(gitRoot2, path7))
+    (path7) => existsSync28(join50(gitRoot2, path7))
   );
   const composeFiles2 = ["compose.yaml", "compose.yml", "docker-compose.yaml", "docker-compose.yml"].filter(
-    (path7) => existsSync28(join49(gitRoot2, path7))
+    (path7) => existsSync28(join50(gitRoot2, path7))
   );
-  const selectedRuntime = requested !== "auto" ? requested : devcontainerConfigs.length === 1 ? "devcontainer" : composeFiles2.length > 0 ? "compose" : existsSync28(join49(gitRoot2, "Dockerfile")) ? "dockerfile" : "host";
+  const selectedRuntime = requested !== "auto" ? requested : devcontainerConfigs.length === 1 ? "devcontainer" : composeFiles2.length > 0 ? "compose" : existsSync28(join50(gitRoot2, "Dockerfile")) ? "dockerfile" : "host";
   return {
     devcontainerConfigs,
     composeFiles: composeFiles2,
-    dockerfile: existsSync28(join49(gitRoot2, "Dockerfile")),
-    packageJson: existsSync28(join49(gitRoot2, "package.json")),
+    dockerfile: existsSync28(join50(gitRoot2, "Dockerfile")),
+    packageJson: existsSync28(join50(gitRoot2, "package.json")),
     selectedRuntime
   };
 }
 function buildInitPromptSpec(context) {
   const systemPrompt = [
     `You are bootstrapping a local repository for ${APP_NAME}.`,
-    `A starter \`${PROJECT_CONFIG_PATH}\` already exists at the repo root.`,
-    `Inspect the repository in the current working directory and edit that existing \`${PROJECT_CONFIG_PATH}\` in place.`,
+    `A starter \`${PROJECT_CONFIG_PATH2}\` already exists at the repo root.`,
+    `Inspect the repository in the current working directory and edit that existing \`${PROJECT_CONFIG_PATH2}\` in place.`,
     "Do not modify any other file.",
     "Do not ask the user questions. Infer the config from the repository contents.",
     "Be efficient: inspect only the files needed to determine the project name, main branch, service layout, dev commands, and ports.",
@@ -110183,7 +110332,7 @@ function buildInitPromptSpec(context) {
     "workspace.mainBranch: infer from git",
     `workspace.worktrees.root: keep ${APP_DEFAULTS.worktreeRoot} unless there is clear evidence of an existing alternative`,
     "Do not copy detected Compose services or ports into config unless the user needs an explicit override.",
-    "Preserve the commented services example: it is for Taskflow-managed host or legacy Docker processes, not discovered Dev Container or Compose services.",
+    "Preserve the commented services example: it is for Taskflow-managed host or Docker profile processes, not discovered Dev Container or Compose services.",
     "profiles.default.environment.provider: auto unless the user chose a runtime override. If no Dev Container, Compose, or Dockerfile exists, set it to host.",
     "For a host project, put its one managed development command in profiles.default.environment.command; never add a third app command pane for it.",
     "Only declare services when a host command has a proven port and supports the injected port environment variable. When the port is uncertain, keep the command but omit services.",
@@ -110195,11 +110344,11 @@ function buildInitPromptSpec(context) {
     "Only include optional sections like auto_name, lifecycleHooks, sandbox/docker config, mounts, or systemPrompt if the repository gives clear evidence they are needed.",
     "Prefer editing the existing keys over replacing the file with a completely different shape.",
     "Preserve the existing template structure and comments unless a specific change requires updating them.",
-    `Before finishing, verify that \`${PROJECT_CONFIG_PATH}\` exists and contains the final YAML.`
+    `Before finishing, verify that \`${PROJECT_CONFIG_PATH2}\` exists and contains the final YAML.`
   ].join("\n");
   return {
     systemPrompt,
-    userPrompt: `Adapt the existing starter \`${PROJECT_CONFIG_PATH}\` for this repository.`
+    userPrompt: `Adapt the existing starter \`${PROJECT_CONFIG_PATH2}\` for this repository.`
   };
 }
 function buildInitAgentCommand(agent, prompt, outputPrefix = `${APP_SLUG}-init`) {
@@ -110228,7 +110377,7 @@ function buildInitAgentCommand(agent, prompt, outputPrefix = `${APP_SLUG}-init`)
       ]
     };
   }
-  const summaryPath = join49(tmpdir4(), `${outputPrefix}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.txt`);
+  const summaryPath = join50(tmpdir4(), `${outputPrefix}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.txt`);
   return {
     agent,
     cmd: "codex",
@@ -110484,7 +110633,7 @@ function finalizeAgentRun(spec, exitCode, stdoutResult, stderr2) {
   let summary = stdoutResult.assistantText.trim();
   if (spec.summaryPath && existsSync28(spec.summaryPath)) {
     try {
-      summary = readFileSync26(spec.summaryPath, "utf8").trim() || summary;
+      summary = readFileSync25(spec.summaryPath, "utf8").trim() || summary;
     } finally {
       rmSync8(spec.summaryPath, { force: true });
     }
@@ -110519,7 +110668,7 @@ workspace:
   #   intervalSeconds: 300
 
 # Taskflow discovers Dev Container, Compose, and Dockerfile services from the resolved runtime.
-# Declare services here only for a process started by a host or legacy Docker pane
+# Declare services here only for a process started by a host or Docker profile pane
 # that accepts an injected port environment variable. Do not duplicate discovered services.
 services:
   # Example app service with a predictable port per worktree.
@@ -110545,8 +110694,8 @@ exposure:
 # Profiles define runtime, permissions, and tmux pane layout.
 profiles:
   default:
-    # Legacy panes run on the host; the environment provider controls the
-    # development runtime and is automatically resolved from Dev Container, Compose, or Dockerfile.
+    # Panes run on the host; the environment provider controls the development
+    # runtime and is automatically resolved from Dev Container, Compose, or Dockerfile.
     runtime: host
     environment:
       provider: ${environmentProvider}
@@ -110751,13 +110900,13 @@ var init_init_deps = __esm({
         tool: "claude",
         args: ["--version"],
         required: false,
-        hint: `Install the Claude Code CLI to let Claude scaffold ${PROJECT_CONFIG_PATH}`
+        hint: `Install the Claude Code CLI to let Claude scaffold ${PROJECT_CONFIG_PATH2}`
       },
       {
         tool: "codex",
         args: ["--version"],
         required: false,
-        hint: `Install the Codex CLI to let Codex scaffold ${PROJECT_CONFIG_PATH}`
+        hint: `Install the Codex CLI to let Codex scaffold ${PROJECT_CONFIG_PATH2}`
       },
       { tool: "docker", args: ["--version"], required: false, hint: "https://docs.docker.com/get-started/get-docker/" }
     ];
@@ -110962,7 +111111,7 @@ async function runInit(options) {
   let selectedAnalyze = resolveInitAnalysis(options, selectedRuntime);
   const configExists = existsSync29(taskflowYaml);
   if (configExists) {
-    log2.info(`${PROJECT_CONFIG_PATH} already exists`);
+    log2.info(`${PROJECT_CONFIG_PATH2} already exists`);
   } else if (needsInteractiveAnalysisFallback(options, selectedRuntime)) {
     selectedAnalyze = await selectFallbackAgent();
   }
@@ -110983,7 +111132,7 @@ async function runInit(options) {
           environmentProvider: detection.selectedRuntime
         })
       );
-      log2.success(`${PROJECT_CONFIG_PATH} created from deterministic detection`);
+      log2.success(`${PROJECT_CONFIG_PATH2} created from deterministic detection`);
     } else {
       const available2 = isInitAgentSelectable(
         depStatuses.find((status) => status.tool === selectedAnalyze) ?? { found: false }
@@ -111006,11 +111155,11 @@ async function runInit(options) {
       const prompt = buildInitPromptSpec({ ...context, defaultAgent: selectedAnalyze });
       const command = buildInitAgentCommand(selectedAnalyze, prompt);
       const streamPrinter = createAgentStreamPrinter(label3);
-      log2.step(`Running ${label3} to adapt ${PROJECT_CONFIG_PATH}...`);
+      log2.step(`Running ${label3} to adapt ${PROJECT_CONFIG_PATH2}...`);
       const result = await runInitAgentCommand(command, gitRoot2, { onEvent: streamPrinter.onEvent });
       streamPrinter.finish();
       if (!existsSync29(taskflowYaml)) {
-        log2.error(`${label3} removed ${PROJECT_CONFIG_PATH}`);
+        log2.error(`${label3} removed ${PROJECT_CONFIG_PATH2}`);
         const details = [
           result.summary ? `Summary:
 ${result.summary}` : "",
@@ -111027,12 +111176,12 @@ ${result.stderr.trim()}` : ""
       const finalYaml = await readFile12(taskflowYaml, "utf8");
       const changedTemplate = configExists || finalYaml !== starterTemplate;
       if (result.exitCode === 0 && changedTemplate) {
-        log2.success(`${label3} adapted ${PROJECT_CONFIG_PATH}`);
+        log2.success(`${label3} adapted ${PROJECT_CONFIG_PATH2}`);
       } else if (result.exitCode === 0) {
         log2.warning(`${label3} left the starter template unchanged`);
-        log2.warning(`${label3} did not change the starter template. Review ${PROJECT_CONFIG_PATH} manually.`);
+        log2.warning(`${label3} did not change the starter template. Review ${PROJECT_CONFIG_PATH2} manually.`);
       } else if (changedTemplate) {
-        log2.warning(`${label3} updated ${PROJECT_CONFIG_PATH}`);
+        log2.warning(`${label3} updated ${PROJECT_CONFIG_PATH2}`);
         log2.warning(`${label3} exited with code ${result.exitCode}. Review the generated file before using it.`);
       } else {
         log2.warning(`${label3} left the starter template in place`);
@@ -111055,7 +111204,7 @@ ${result.stderr.trim()}` : ""
   );
   outro("You're all set! Next steps:");
   console.log();
-  console.log(`  1. Review ${PROJECT_CONFIG_PATH} and adjust runtime and exposure overrides if needed`);
+  console.log(`  1. Review ${PROJECT_CONFIG_PATH2} and adjust runtime and exposure overrides if needed`);
   console.log("  2. Keep the host daemon running: portta host serve --detach  (or portta host service install)");
   console.log(`  3. Enable tab completion: eval "$(${flowInvocation()} completion zsh)"  (or bash)`);
   console.log();
@@ -111913,7 +112062,7 @@ import { setTimeout as delay4 } from "node:timers/promises";
 function projectSetupPhaseLabel(phase) {
   switch (phase) {
     case "creating_config":
-      return `Creating ${PROJECT_CONFIG_PATH}`;
+      return `Creating ${PROJECT_CONFIG_PATH2}`;
     case "analyzing":
       return "Analyzing project structure";
     case "ready":
@@ -112240,7 +112389,7 @@ async function defaultConfirmPrune(worktreeCount) {
 }
 async function attachToHerdr() {
   if (process.env.HERDR_PANE_ID || process.env.HERDR_ENV) return;
-  const result = await runProcess3("herdr", [], { stdio: "inherit", reject: false });
+  const result = await runProcess("herdr", [], { stdio: "inherit", reject: false });
   if (result.exitCode !== 0) {
     console.error("Warning: failed to attach to herdr");
   }
@@ -112263,12 +112412,12 @@ async function defaultSwitchToSessionWindow(projectDir, _branch, multiplexer) {
   }
   const sessionName = buildProjectSessionName(resolve30(projectDir));
   if (process.env.TMUX) {
-    const result = await runProcess3("tmux", ["switch-client", "-t", sessionName], { reject: false });
+    const result = await runProcess("tmux", ["switch-client", "-t", sessionName], { reject: false });
     if (result.exitCode !== 0) {
       console.error(`Warning: failed to switch tmux client to ${sessionName}`);
     }
   } else {
-    const result = await runProcess3("tmux", ["attach-session", "-t", sessionName], { stdio: "inherit", reject: false });
+    const result = await runProcess("tmux", ["attach-session", "-t", sessionName], { stdio: "inherit", reject: false });
     if (result.exitCode !== 0) {
       console.error(`Warning: failed to attach to tmux session ${sessionName}`);
     }
@@ -112736,7 +112885,7 @@ function environmentBaseUrlFromControlUrl(value3) {
   }
 }
 async function runInherited(invocation2) {
-  const result = await runProcess3(invocation2.command, invocation2.args, {
+  const result = await runProcess(invocation2.command, invocation2.args, {
     cwd: invocation2.cwd,
     stdio: "inherit",
     reject: false
@@ -112747,7 +112896,7 @@ async function runInherited(invocation2) {
 async function writeClipboard(value3) {
   const command = process.platform === "darwin" ? "pbcopy" : process.platform === "win32" ? "clip" : "xclip";
   const args = process.platform === "linux" ? ["-selection", "clipboard"] : [];
-  return (await runProcess3(command, args, { input: value3, reject: false })).exitCode === 0;
+  return (await runProcess(command, args, { input: value3, reject: false })).exitCode === 0;
 }
 async function runEnvironmentCommand(request2, port, projectDir, stdout2 = console.log, stderr2 = console.error, dependencies = defaultEnvironmentCommandDependencies) {
   try {
@@ -112809,7 +112958,7 @@ async function runEnvironmentCommand(request2, port, projectDir, stdout2 = conso
       } else {
         const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
         const openerArgs = process.platform === "win32" ? ["/c", "start", "", endpoint.url] : [endpoint.url];
-        if ((await runProcess3(opener, openerArgs, { reject: false })).exitCode !== 0) {
+        if ((await runProcess(opener, openerArgs, { reject: false })).exitCode !== 0) {
           throw new Error("Browser open command failed");
         }
       }
@@ -113074,10 +113223,10 @@ var init_tail = __esm({
 import { createReadStream as createReadStream2, existsSync as existsSync30 } from "node:fs";
 import { readdir as readdir5, readFile as readFile13, realpath as realpath2, stat as stat6, watch } from "node:fs/promises";
 import { createServer as createServer2 } from "node:http";
-import { basename as basename19, dirname as dirname27, extname, join as join50, normalize as normalize3, sep as sep2 } from "node:path";
+import { basename as basename19, dirname as dirname27, extname, join as join51, normalize as normalize3, sep as sep2 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 function runsDir() {
-  return join50(dataRoot(), "runs");
+  return join51(dataRoot(), "runs");
 }
 function parseEvents(text) {
   const out = [];
@@ -113093,7 +113242,7 @@ function parseEvents(text) {
 }
 async function readEvents(runId) {
   try {
-    const text = await readFile13(join50(runsDir(), runId, "events.jsonl"), "utf8");
+    const text = await readFile13(join51(runsDir(), runId, "events.jsonl"), "utf8");
     return parseEvents(text);
   } catch {
     return [];
@@ -113195,7 +113344,7 @@ function applyDeadman(status, startedAt, lastBeat) {
 }
 async function heartbeatMtime(runId) {
   try {
-    return (await stat6(join50(runsDir(), runId, ".heartbeat"))).mtimeMs;
+    return (await stat6(join51(runsDir(), runId, ".heartbeat"))).mtimeMs;
   } catch {
     return 0;
   }
@@ -113226,7 +113375,7 @@ async function listRuns() {
     seen.add(runId);
     let eventsStat;
     try {
-      eventsStat = await stat6(join50(runsDir(), runId, "events.jsonl"));
+      eventsStat = await stat6(join51(runsDir(), runId, "events.jsonl"));
     } catch {
       eventsStat = void 0;
     }
@@ -113242,7 +113391,7 @@ async function listRuns() {
       if (events.length === 0) {
         let mtime = 0;
         try {
-          mtime = (await stat6(join50(runsDir(), runId))).mtimeMs;
+          mtime = (await stat6(join51(runsDir(), runId))).mtimeMs;
         } catch {
         }
         summaries.push({ summary: { runId, status: "unknown", agents: 0 }, mtime });
@@ -113269,7 +113418,7 @@ async function listRuns() {
 }
 function serveStatic(res, fileName) {
   const safe2 = normalize3(fileName).replace(/^(\.\.(?:[/\\]|$))+/, "");
-  const full = join50(WEB_DIR, safe2);
+  const full = join51(WEB_DIR, safe2);
   if (!full.startsWith(WEB_DIR + sep2) && full !== WEB_DIR) {
     sendText(res, 403, "forbidden");
     return;
@@ -113418,10 +113567,10 @@ function sleepUnlessClosed(ms, isClosed) {
   });
 }
 function streamRun(req, res, runId) {
-  return tailJsonl(req, res, join50(runsDir(), runId, "events.jsonl"));
+  return tailJsonl(req, res, join51(runsDir(), runId, "events.jsonl"));
 }
 function streamAgent(req, res, runId, index) {
-  return tailJsonl(req, res, join50(runsDir(), runId, "agents", `${index}.jsonl`));
+  return tailJsonl(req, res, join51(runsDir(), runId, "agents", `${index}.jsonl`));
 }
 function parseChunks(text) {
   const out = [];
@@ -113437,7 +113586,7 @@ function parseChunks(text) {
 }
 async function readAgentChunks(runId, index) {
   try {
-    const text = await readFile13(join50(runsDir(), runId, "agents", `${index}.jsonl`), "utf8");
+    const text = await readFile13(join51(runsDir(), runId, "agents", `${index}.jsonl`), "utf8");
     return parseChunks(text);
   } catch {
     return null;
@@ -113501,7 +113650,7 @@ async function handle(req, res) {
     const events = await readEvents(runId);
     if (events.length === 0) {
       try {
-        await stat6(join50(runsDir(), runId));
+        await stat6(join51(runsDir(), runId));
       } catch {
         sendJson(res, 404, { error: "run not found", runId });
         return;
@@ -113578,8 +113727,8 @@ var init_serve = __esm({
     init_journal();
     init_tail();
     __dirname = dirname27(fileURLToPath6(import.meta.url));
-    WEB_CANDIDATES = [join50(__dirname, "web"), join50(__dirname, "..", "..", "viewer", "dist")];
-    WEB_DIR = WEB_CANDIDATES.find((path7) => existsSync30(path7)) ?? join50(__dirname, "web");
+    WEB_CANDIDATES = [join51(__dirname, "web"), join51(__dirname, "..", "..", "viewer", "dist")];
+    WEB_DIR = WEB_CANDIDATES.find((path7) => existsSync30(path7)) ?? join51(__dirname, "web");
     sseClients = 0;
     STALE_MS = 2e4;
     summaryCache = /* @__PURE__ */ new Map();
@@ -113613,15 +113762,15 @@ import { spawn as spawn9 } from "node:child_process";
 import {
   copyFileSync as copyFileSync3,
   existsSync as existsSync31,
-  mkdirSync as mkdirSync17,
+  mkdirSync as mkdirSync18,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync27,
+  readFileSync as readFileSync26,
   realpathSync as realpathSync6,
   rmSync as rmSync9,
   statSync as statSync10
 } from "node:fs";
 import { get as httpGet } from "node:http";
-import { dirname as dirname28, join as join51, resolve as resolve31, sep as sep3 } from "node:path";
+import { dirname as dirname28, join as join52, resolve as resolve31, sep as sep3 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 function parseArgs(argv) {
   const flags = { _: [] };
@@ -113725,8 +113874,6 @@ async function main(argv = process.argv.slice(2), options = {}) {
       return cmdValidate(flags, options.registryRoots);
     case "doctor":
       return cmdDoctor();
-    case "install-skill":
-      return cmdInstallSkillRetired();
     case "guide":
       return cmdGuide(options.skillPath);
     case void 0:
@@ -113756,7 +113903,7 @@ async function cmdServe(flags) {
     }
   });
   process.stderr.write(
-    `viewer: ${url2}  (reading ${join51(dataRoot(), "runs")})
+    `viewer: ${url2}  (reading ${join52(dataRoot(), "runs")})
 ${idleShutdown ? "idle-shutdown on; " : ""}ctrl-c to stop
 `
   );
@@ -113816,7 +113963,7 @@ function openBrowser(url2) {
   }
 }
 async function cmdRuns(flags) {
-  const dir = join51(dataRoot(), "runs");
+  const dir = join52(dataRoot(), "runs");
   if (!existsSync31(dir)) {
     console.log("(no runs yet)");
     return;
@@ -113824,12 +113971,12 @@ async function cmdRuns(flags) {
   const ids = readdirSync5(dir).filter((d) => d.startsWith("wf_"));
   if (flags.prune === true) {
     const keep = intFlag(flags, "keep") ?? 50;
-    const byAge = ids.map((id) => ({ id, at: statSync10(join51(dir, id)).mtimeMs })).sort((a3, b) => b.at - a3.at);
+    const byAge = ids.map((id) => ({ id, at: statSync10(join52(dir, id)).mtimeMs })).sort((a3, b) => b.at - a3.at);
     const remove = byAge.slice(keep);
     let bytes = 0;
     for (const r2 of remove) {
-      bytes += dirSize(join51(dir, r2.id));
-      rmSync9(join51(dir, r2.id), { recursive: true, force: true });
+      bytes += dirSize(join52(dir, r2.id));
+      rmSync9(join52(dir, r2.id), { recursive: true, force: true });
     }
     console.log(
       `pruned ${remove.length} run(s) (${(bytes / 1e6).toFixed(1)} MB); kept ${Math.min(keep, byAge.length)} newest`
@@ -113840,8 +113987,8 @@ async function cmdRuns(flags) {
     const stale2 = ids.filter((id) => isStaleRun(dir, id));
     let bytes = 0;
     for (const id of stale2) {
-      bytes += dirSize(join51(dir, id));
-      rmSync9(join51(dir, id), { recursive: true, force: true });
+      bytes += dirSize(join52(dir, id));
+      rmSync9(join52(dir, id), { recursive: true, force: true });
     }
     console.log(`pruned ${stale2.length} stale run(s) (${(bytes / 1e6).toFixed(1)} MB)`);
     return;
@@ -113850,7 +113997,7 @@ async function cmdRuns(flags) {
     const loaded = Journal.load(id);
     const name = loaded.meta?.workflowFile?.split("/").pop() ?? "";
     const agents = loaded.results.size;
-    const resultPath = join51(dir, id, "result.json");
+    const resultPath = join52(dir, id, "result.json");
     const done = existsSync31(resultPath);
     const status = done ? "completed" : isStaleRun(dir, id) ? "stale" : "?";
     return { id, name, agents, status, at: loaded.meta?.createdAt ?? 0 };
@@ -113859,10 +114006,10 @@ async function cmdRuns(flags) {
   for (const r2 of rows) console.log(`${r2.id}  ${r2.status.padEnd(10)} ${String(r2.agents).padStart(3)} agents  ${r2.name}`);
 }
 function isStaleRun(runsBase, id) {
-  const rd = join51(runsBase, id);
+  const rd = join52(runsBase, id);
   let lastRunStatus;
   try {
-    const lines = readFileSync27(join51(rd, "events.jsonl"), "utf8").trim().split("\n");
+    const lines = readFileSync26(join52(rd, "events.jsonl"), "utf8").trim().split("\n");
     for (let i3 = lines.length - 1; i3 >= 0; i3--) {
       const m = lines[i3]?.match(/"type":"run","status":"([a-z]+)"/);
       if (m) {
@@ -113876,7 +114023,7 @@ function isStaleRun(runsBase, id) {
   if (lastRunStatus !== "started") return false;
   let beat = 0;
   try {
-    beat = statSync10(join51(rd, ".heartbeat")).mtimeMs;
+    beat = statSync10(join52(rd, ".heartbeat")).mtimeMs;
   } catch {
   }
   return Date.now() - beat > 2e4;
@@ -113884,7 +114031,7 @@ function isStaleRun(runsBase, id) {
 function dirSize(dir) {
   let total = 0;
   for (const e of readdirSync5(dir, { withFileTypes: true })) {
-    const p = join51(dir, e.name);
+    const p = join52(dir, e.name);
     total += e.isDirectory() ? dirSize(p) : statSync10(p).size;
   }
   return total;
@@ -113900,7 +114047,7 @@ async function cmdRun(flags, registryRoots) {
   }
   const resolvedFile = resolveFileOrName(file2, registryRoots);
   const overrides = {};
-  const provider = enumFlag(flags, "provider", PROVIDERS2);
+  const provider = enumFlag(flags, "provider", PROVIDERS);
   if (provider) overrides.provider = provider;
   const model = str(flags.model);
   if (model) overrides.model = model;
@@ -113929,7 +114076,7 @@ async function cmdRun(flags, registryRoots) {
   if (argsFile) {
     let raw2;
     try {
-      raw2 = readFileSync27(resolve31(argsFile), "utf8");
+      raw2 = readFileSync26(resolve31(argsFile), "utf8");
     } catch {
       throw new UsageError2(`--args-file not found: ${argsFile}`);
     }
@@ -113993,7 +114140,7 @@ async function cmdValidate(flags, registryRoots) {
     process.exitCode = 1;
     return;
   }
-  const source = readFileSync27(resolveFileOrName(file2, registryRoots), "utf8");
+  const source = readFileSync26(resolveFileOrName(file2, registryRoots), "utf8");
   const { meta: meta3 } = parseWorkflow(source);
   console.log(`ok: "${meta3.name}" \u2014 ${meta3.description}`);
   if (meta3.phases) console.log(`phases: ${meta3.phases.map((p) => p.title).join(" \u2192 ")}`);
@@ -114031,20 +114178,20 @@ async function cmdSave(flags) {
   }
   const absFile = resolve31(file2);
   if (!existsSync31(absFile)) throw new UsageError2(`file not found: ${file2}`);
-  const { meta: meta3 } = parseWorkflow(readFileSync27(absFile, "utf8"));
+  const { meta: meta3 } = parseWorkflow(readFileSync26(absFile, "utf8"));
   const name = meta3.name;
   if (name.includes("/") || name.includes("\\") || name.includes("..") || name.startsWith(".") || name.includes("\0")) {
     throw new UsageError2(`meta.name is not a safe filename: "${name}"`);
   }
   const useProject = flags.project === true;
   const destDir = useProject ? projectPaths(process.cwd()).workflows : globalPaths().workflows;
-  const dest = join51(destDir, `${name}.workflow.js`);
+  const dest = join52(destDir, `${name}.workflow.js`);
   if (existsSync31(dest) && flags.force !== true) {
     throw new UsageError2(
       `${useProject ? "project" : "user"} workflow "${name}" already exists at ${dest} \u2014 use --force to overwrite`
     );
   }
-  mkdirSync17(destDir, { recursive: true });
+  mkdirSync18(destDir, { recursive: true });
   copyFileSync3(absFile, dest);
   console.log(`saved "${name}" \u2192 ${dest}`);
 }
@@ -114075,7 +114222,7 @@ async function cmdDoctor() {
   const codexBin = process.env.CODEX_BIN ?? "codex";
   const opencodeBin = process.env.OPENCODE_BIN ?? "opencode";
   const piBin = process.env.PI_BIN ?? "pi";
-  const piScratch = mkdtempSync4(join51(tmpdir6(), `${APP_SLUG}-doctor-pi-`));
+  const piScratch = mkdtempSync4(join52(tmpdir6(), `${APP_SLUG}-doctor-pi-`));
   let piOut;
   try {
     piOut = check4(piBin, ["--version"], { env: { ...process.env, PI_CODING_AGENT_DIR: piScratch }, cwd: tmpdir6() });
@@ -114093,31 +114240,20 @@ async function cmdDoctor() {
   console.log(`  data dir     : ${dataRoot()}`);
 }
 function readSkill(skillPath) {
-  if (skillPath) return readFileSync27(skillPath, "utf8");
+  if (skillPath) return readFileSync26(skillPath, "utf8");
   const here = dirname28(fileURLToPath7(import.meta.url));
   const candidates = [
-    join51(here, "..", "skills", "portta-workflows", "SKILL.md"),
-    join51(here, "..", "..", "..", "skills", "portta-workflows", "SKILL.md"),
-    join51(here, "..", "..", "..", "..", "..", "..", "skills", "portta-workflows", "SKILL.md")
+    join52(here, "..", "skills", "portta-workflows", "SKILL.md"),
+    join52(here, "..", "..", "..", "skills", "portta-workflows", "SKILL.md"),
+    join52(here, "..", "..", "..", "..", "..", "..", "skills", "portta-workflows", "SKILL.md")
   ];
   const src = candidates.find((candidate) => existsSync31(candidate));
   if (!src) throw new Error(`skill source not found at ${candidates.join(" or ")}`);
-  return readFileSync27(src, "utf8");
+  return readFileSync26(src, "utf8");
 }
 async function cmdGuide(skillPath) {
   process.stdout.write(readSkill(skillPath).replace(/^---\n[\s\S]*?\n---\n+/, ""));
 }
-function cmdInstallSkillRetired() {
-  console.error(
-    `${CLI_NAME} workflows install-skill has been retired. Install the skill with the Skills CLI instead:
-
-  npx skills add codions-labs/portta --skill portta-workflows -g
-
-It supports Claude Code, Codex, OpenCode, Cursor, Zed and others, symlinks by default,
-and \`npx skills update\` keeps every agent current. See https://www.skills.sh.`
-  );
-  process.exitCode = 1;
-}
 function printHelp() {
   console.log(`${APP_NAME} workflows \u2014 run JS workflow files that orchestrate coding agents
 
@@ -114178,7 +114314,7 @@ function invokedDirectly() {
     return false;
   }
 }
-var UsageError2, BOOLEAN_FLAGS, PROVIDERS2, SANDBOXES, EFFORTS;
+var UsageError2, BOOLEAN_FLAGS, PROVIDERS, SANDBOXES, EFFORTS;
 var init_cli = __esm({
   "../host/src/modules/taskflow/workflows/cli.ts"() {
     "use strict";
@@ -114213,7 +114349,7 @@ var init_cli = __esm({
       "project",
       "force"
     ]);
-    PROVIDERS2 = PROVIDER_IDS;
+    PROVIDERS = PROVIDER_IDS;
     SANDBOXES = ["read-only", "workspace-write", "danger-full-access"];
     EFFORTS = ["none", "minimal", "low", "medium", "high", "xhigh", "max"];
     if (invokedDirectly()) {
@@ -116305,7 +116441,7 @@ var RemovalPreview = named(
   "RemovalPreview"
 );
 var LiveEventKind = named(
-  external_exports.enum(["container", "network", "bridge", "health", "project", "config", "hello", "task", "session", "activity", "repository"]),
+  external_exports.enum(["container", "network", "bridge", "health", "project", "config", "hello", "session", "activity", "repository"]),
   "LiveEventKind"
 );
 var LiveEvent = named(
@@ -117341,131 +117477,7 @@ var {
 
 // src/cli.ts
 init_errors3();
-
-// src/process.ts
-init_execa();
-import { spawn as spawn2 } from "node:child_process";
-import { closeSync as closeSync2, openSync as openSync2 } from "node:fs";
-var reporting = {};
-function setProcessReporter(options) {
-  reporting = options;
-}
-function effectiveStdio(requested) {
-  if (requested === "inherit") return "inherit";
-  if (reporting.quiet) return "pipe";
-  if (reporting.verbose) return "stream";
-  return requested;
-}
-function outputTargets(mode) {
-  if (mode !== "stream") return { stdio: mode };
-  return {
-    stdin: "pipe",
-    stdout: reporting.json ? "pipe" : ["pipe", "inherit"],
-    stderr: ["pipe", "inherit"]
-  };
-}
-var HEARTBEAT_FIRST_MS = 1e4;
-var HEARTBEAT_EVERY_MS = 3e4;
-var HEARTBEAT_HINT_MS = 18e4;
-function elapsed(sinceMs) {
-  const seconds = Math.round((Date.now() - sinceMs) / 1e3);
-  if (seconds < 60) return `${seconds}s`;
-  return `${Math.floor(seconds / 60)}m${String(seconds % 60).padStart(2, "0")}s`;
-}
-function describeCommand(file2, args, limit = 88) {
-  const words = [];
-  for (let index = 0; index < args.length; index += 1) {
-    const argument = args[index] ?? "";
-    if (argument === "-f" || argument === "--file") {
-      index += 1;
-      continue;
-    }
-    words.push(argument);
-  }
-  const line4 = [file2, ...words].join(" ");
-  return line4.length <= limit ? line4 : `${line4.slice(0, limit - 1)}\u2026`;
-}
-function startHeartbeat(file2, args) {
-  if (reporting.quiet) return () => {
-  };
-  const started = Date.now();
-  const label3 = describeCommand(file2, args);
-  let hinted = false;
-  const announce = () => {
-    process.stderr.write(`wait     still running: ${label3} (${elapsed(started)})
-`);
-    if (!hinted && Date.now() - started >= HEARTBEAT_HINT_MS) {
-      hinted = true;
-      process.stderr.write("  -> a first build of the panel image takes several minutes; Ctrl-C is safe, and --verbose shows its output\n");
-    }
-  };
-  let repeat;
-  const first = setTimeout(() => {
-    announce();
-    repeat = setInterval(announce, HEARTBEAT_EVERY_MS);
-    repeat.unref?.();
-  }, HEARTBEAT_FIRST_MS);
-  first.unref?.();
-  return () => {
-    clearTimeout(first);
-    if (repeat) clearInterval(repeat);
-  };
-}
-async function runProcess(file2, args = [], options = {}) {
-  const mode = effectiveStdio(options.stdio ?? "pipe");
-  const execaOptions = {
-    cwd: options.cwd,
-    env: options.env,
-    input: options.input,
-    reject: options.reject ?? true,
-    shell: false,
-    timeout: options.timeout,
-    ...outputTargets(mode)
-  };
-  const stopHeartbeat = mode === "pipe" ? startHeartbeat(file2, args) : () => {
-  };
-  try {
-    const result = await execa(file2, [...args], execaOptions);
-    return {
-      stdout: typeof result.stdout === "string" ? result.stdout : "",
-      stderr: typeof result.stderr === "string" ? result.stderr : "",
-      exitCode: result.exitCode ?? (result.failed ? 1 : 0),
-      failed: result.failed
-    };
-  } finally {
-    stopHeartbeat();
-  }
-}
-var PROCESS_POLICY = Object.freeze({ shell: false, argumentArraysOnly: true });
-async function runForeground(file2, args, options = {}) {
-  const child = execa(file2, [...args], { cwd: options.cwd, env: options.env, stdio: "inherit", reject: false, shell: false });
-  const forwarded = ["SIGINT", "SIGTERM", "SIGHUP"].map((signal) => [signal, () => {
-    child.kill(signal);
-  }]);
-  for (const [signal, forward] of forwarded) process.on(signal, forward);
-  try {
-    const result = await child;
-    return result.exitCode ?? (result.signal ? 1 : 0);
-  } finally {
-    for (const [signal, forward] of forwarded) process.off(signal, forward);
-  }
-}
-function spawnDetached(file2, args, options = {}) {
-  const log3 = options.logFile ? openSync2(options.logFile, "a", 384) : null;
-  try {
-    const child = spawn2(file2, [...args], {
-      cwd: options.cwd,
-      env: options.env,
-      shell: false,
-      detached: true,
-      stdio: log3 === null ? "ignore" : ["ignore", log3, log3]
-    });
-    child.unref();
-    return child.pid;
-  } finally {
-    if (log3 !== null) closeSync2(log3);
-  }
-}
+init_process();
 
 // src/commands/access.ts
 init_src();
@@ -117493,6 +117505,7 @@ init_context();
 // src/docker.ts
 init_zod();
 init_errors3();
+init_process();
 var Identifier = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
 function identifier(value3, kind = "Docker identifier") {
   if (!Identifier.test(value3)) throw new UsageError(`invalid ${kind}: ${value3}`);
@@ -117510,12 +117523,10 @@ var InspectSchema = external_exports.object({
     Ports: external_exports.record(external_exports.string(), external_exports.array(external_exports.object({ HostIp: external_exports.string().optional(), HostPort: external_exports.string().optional() })).nullable()).nullable().optional()
   }).passthrough()
 }).passthrough();
-async function dockerAvailable() {
-  const result = await runProcess("docker", ["info"], { reject: false });
-  return result.exitCode === 0;
-}
 async function requireDocker() {
-  if (!await dockerAvailable()) throw new PreconditionError("cannot talk to the Docker daemon", "start Docker or check DOCKER_HOST");
+  const result = await runProcess("docker", ["info"], { reject: false });
+  if (result.error) throw new PreconditionError("the docker CLI is not installed", "install Docker Engine 24 or newer; Portta never installs Docker or invokes a system package manager");
+  if (result.exitCode !== 0) throw new PreconditionError("cannot talk to the Docker daemon", "start Docker or check DOCKER_HOST");
 }
 async function dockerOperatingSystem() {
   const result = await runProcess("docker", ["info", "--format", "{{.OperatingSystem}}"], { reject: false, timeout: 8e3 });
@@ -117585,6 +117596,7 @@ async function isManagedContainer(id) {
 
 // src/commands/access.ts
 init_errors3();
+init_process();
 function globals(command) {
   return command.optsWithGlobals();
 }
@@ -117764,21 +117776,50 @@ async function serviceUnpublish(alias, options, command) {
 }
 
 // src/commands/clients.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync22, mkdirSync as mkdirSync14, rmSync as rmSync5, statSync as statSync9 } from "node:fs";
-import { basename as basename13, dirname as dirname22, join as join45 } from "node:path";
+import { copyFileSync as copyFileSync2, existsSync as existsSync22, mkdirSync as mkdirSync15, rmSync as rmSync5, statSync as statSync9 } from "node:fs";
+import { basename as basename13, dirname as dirname22, join as join46 } from "node:path";
 
 // src/commands/web.ts
 init_src();
 init_src();
 init_context();
-import { chmodSync as chmodSync8, mkdirSync as mkdirSync13 } from "node:fs";
-import { join as join44 } from "node:path";
+import { mkdirSync as mkdirSync14 } from "node:fs";
+import { join as join45 } from "node:path";
 init_errors3();
+init_process();
+
+// src/installation-directories.ts
+import { chmodSync as chmodSync4, existsSync as existsSync5, mkdirSync as mkdirSync4 } from "node:fs";
+import { join as join6 } from "node:path";
+var INSTALLATION_DIRECTORIES = [
+  { path: "config/traefik/dynamic", mode: 493 },
+  { path: "config/tls", mode: 493 },
+  { path: "state/auth", mode: 448 },
+  { path: "state/ssh", mode: 448 },
+  { path: "state/runner", mode: 448 },
+  { path: "state/cloudflared", mode: 448 },
+  { path: "state/traefik/acme", mode: 448 },
+  { path: "state/access", mode: 493 },
+  { path: "state/tailscale", mode: 493 },
+  { path: "state/git", mode: 493 },
+  { path: "state/metrics", mode: 493 },
+  { path: "state/environment", mode: 493 },
+  { path: "state/logs", mode: 493 }
+];
+function ensureInstallationDirectories(root2) {
+  for (const { path: path7, mode } of INSTALLATION_DIRECTORIES) {
+    const full = join6(root2, path7);
+    const created = !existsSync5(full);
+    mkdirSync4(full, { recursive: true });
+    if (created || mode === 448) chmodSync4(full, mode);
+  }
+}
 
 // src/local-release.ts
 init_src();
 init_errors3();
-import { join as join6 } from "node:path";
+init_process();
+import { join as join7 } from "node:path";
 async function requireLocalRelease(context) {
   if (context.env["PORTTA_LOCAL_RELEASE"] !== "true") return;
   const missing = [];
@@ -117792,7 +117833,7 @@ async function requireLocalRelease(context) {
 }
 function selectLocalRelease(context) {
   const image = porttaImages(context.version).runtime;
-  patchEnvFile(join6(context.root, ".env"), {
+  patchEnvFile(join7(context.root, ".env"), {
     PORTTA_AUTH_IMAGE: image,
     PORTTA_WEB_IMAGE: image,
     PORTTA_WEB_BUILD: "false",
@@ -117803,13 +117844,15 @@ function selectLocalRelease(context) {
 // src/commands/repos.ts
 init_src();
 import { createHash as createHash2 } from "node:crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync6, mkdirSync as mkdirSync4, readdirSync, readFileSync as readFileSync8, realpathSync, statSync as statSync2, unlinkSync as unlinkSync4, writeFileSync as writeFileSync5 } from "node:fs";
-import { basename, join as join7 } from "node:path";
+import { chmodSync as chmodSync5, existsSync as existsSync7, mkdirSync as mkdirSync5, readdirSync, readFileSync as readFileSync8, realpathSync, statSync as statSync2, unlinkSync as unlinkSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { basename, join as join8 } from "node:path";
 init_context();
 init_errors3();
+init_process();
 
 // src/commands/git.ts
-import { existsSync as existsSync5 } from "node:fs";
+init_process();
+import { existsSync as existsSync6 } from "node:fs";
 async function git(cwd, args) {
   const result = await runProcess("git", ["-C", cwd, ...args], { reject: false });
   return result.exitCode === 0 ? result.stdout.trim() : null;
@@ -117860,7 +117903,7 @@ function normalizePulls(raw2) {
 async function collectGitProject(project2, path7, declaredRemote = "", withPrs = false, cachedForge) {
   const collectedAt = Math.floor(Date.now() / 1e3);
   const base2 = { project: project2, workingDir: path7, collectedAt };
-  if (!await git(path7, ["rev-parse", "--is-inside-work-tree"])) return { ...base2, git: null, reason: existsSync5(path7) ? "not a git repository" : "directory not readable from the host" };
+  if (!await git(path7, ["rev-parse", "--is-inside-work-tree"])) return { ...base2, git: null, reason: existsSync6(path7) ? "not a git repository" : "directory not readable from the host" };
   const branchName = await git(path7, ["rev-parse", "--abbrev-ref", "HEAD"]);
   const detached = branchName === "HEAD";
   const sha = await git(path7, ["rev-parse", "HEAD"]) ?? "";
@@ -117982,7 +118025,7 @@ async function findCandidates(options, env, registered = []) {
   }
   if (!options.environment && !options.path) {
     for (const path7 of registered) {
-      if (!existsSync6(path7)) continue;
+      if (!existsSync7(path7)) continue;
       const root2 = await gitRootOf(path7);
       if (root2) add(root2);
     }
@@ -117996,7 +118039,7 @@ async function findCandidates(options, env, registered = []) {
       home2 = null;
     }
   }
-  if (home2 && !options.environment && !options.path && existsSync6(home2)) {
+  if (home2 && !options.environment && !options.path && existsSync7(home2)) {
     let entries = [];
     try {
       entries = readdirSync(home2);
@@ -118005,9 +118048,9 @@ async function findCandidates(options, env, registered = []) {
     }
     for (const entry of entries) {
       if (!firstLevelCandidateName(entry)) continue;
-      const path7 = join7(home2, entry);
+      const path7 = join8(home2, entry);
       if (!isDirectory(path7)) continue;
-      if (existsSync6(join7(path7, ".git"))) {
+      if (existsSync7(join8(path7, ".git"))) {
         const root2 = await gitRootOf(path7);
         if (root2) add(root2);
         continue;
@@ -118020,8 +118063,8 @@ async function findCandidates(options, env, registered = []) {
       }
       for (const child of children) {
         if (!firstLevelCandidateName(child)) continue;
-        const childPath = join7(path7, child);
-        if (!isDirectory(childPath) || !existsSync6(join7(childPath, ".git"))) continue;
+        const childPath = join8(path7, child);
+        if (!isDirectory(childPath) || !existsSync7(join8(childPath, ".git"))) continue;
         const root2 = await gitRootOf(childPath);
         if (root2) add(root2);
       }
@@ -118042,8 +118085,8 @@ function sha256(content) {
 async function collectInstructions(root2) {
   const paths3 = [...INSTRUCTION_FILES];
   for (const { directory, extension } of INSTRUCTION_DIRECTORIES) {
-    const dir = join7(root2, directory);
-    if (!existsSync6(dir)) continue;
+    const dir = join8(root2, directory);
+    if (!existsSync7(dir)) continue;
     try {
       for (const entry of readdirSync(dir).sort()) {
         if (entry.endsWith(extension)) paths3.push(`${directory}/${entry}`);
@@ -118054,8 +118097,8 @@ async function collectInstructions(root2) {
   const files = [];
   for (const relative6 of paths3) {
     if (!isInstructionPath(relative6)) continue;
-    const absolute = join7(root2, relative6);
-    if (!existsSync6(absolute)) continue;
+    const absolute = join8(root2, relative6);
+    if (!existsSync7(absolute)) continue;
     let size;
     let modifiedAt;
     try {
@@ -118104,7 +118147,7 @@ async function collectRepository(candidate, options, cachedForge) {
 function writeSecret(path7, value3) {
   writeFileSync5(path7, `${JSON.stringify(value3, null, 2)}
 `, { mode: 384 });
-  chmodSync4(path7, 384);
+  chmodSync5(path7, 384);
 }
 function readJson(path7) {
   try {
@@ -118116,18 +118159,18 @@ function readJson(path7) {
 async function scanRepositories(options = {}, profile, output2 = new Output({ quiet: true })) {
   if (options.forgeTtl !== void 0 && !/^\d+$/.test(options.forgeTtl)) throw new UsageError("--forge-ttl must be a number of seconds");
   const context = gatewayContext({ profile });
-  const directory = join7(context.root, "state/git");
-  mkdirSync4(directory, { recursive: true, mode: 448 });
+  const directory = join8(context.root, "state/git");
+  mkdirSync5(directory, { recursive: true, mode: 448 });
   const partial2 = Boolean(options.environment || options.path);
   const registered = partial2 ? [] : await registeredRepositoryPaths(context, (line4) => output2.detail(line4));
   const { candidates, home: home2 } = await findCandidates(options, context.env, registered);
   if (candidates.size > 0) {
-    output2.progress(`scanning ${candidates.size} ${candidates.size === 1 ? "repository" : "repositories"}${home2 && existsSync6(home2) ? ` under ${home2}` : ""}`);
+    output2.progress(`scanning ${candidates.size} ${candidates.size === 1 ? "repository" : "repositories"}${home2 && existsSync7(home2) ? ` under ${home2}` : ""}`);
   }
   const forgeTtl = Number(options.forgeTtl ?? 300);
   const now = Math.floor(Date.now() / 1e3);
   const homeReal = home2 ? safeRealpath(home2) : null;
-  const previous = partial2 ? readJson(join7(directory, SCAN_INDEX_FILE)) : null;
+  const previous = partial2 ? readJson(join8(directory, SCAN_INDEX_FILE)) : null;
   const entries = /* @__PURE__ */ new Map();
   const environments = {};
   if (previous && previous.version === SCAN_VERSION) {
@@ -118137,9 +118180,9 @@ async function scanRepositories(options = {}, profile, output2 = new Output({ qu
   const repositories = [];
   for (const candidate of candidates.values()) {
     const key = repositoryKey(candidate.root);
-    const target = join7(directory, `${key}.json`);
+    const target = join8(directory, `${key}.json`);
     let cachedForge;
-    if (options.withPrs && forgeTtl > 0 && existsSync6(target)) {
+    if (options.withPrs && forgeTtl > 0 && existsSync7(target)) {
       const forge = readJson(target)?.["forge"];
       if (forge && now - Number(forge["collectedAt"] ?? 0) < forgeTtl) cachedForge = forge;
     }
@@ -118168,7 +118211,7 @@ async function scanRepositories(options = {}, profile, output2 = new Output({ qu
     repositories: [...entries.values()].sort((a3, b) => a3.name.localeCompare(b.name)),
     environments
   };
-  writeSecret(join7(directory, SCAN_INDEX_FILE), index);
+  writeSecret(join8(directory, SCAN_INDEX_FILE), index);
   return { index, repositories };
 }
 async function reposScan(options, command) {
@@ -118178,8 +118221,8 @@ async function reposScan(options, command) {
   else output2.progress(`scanned ${result.repositories.length} repositor${result.repositories.length === 1 ? "y" : "ies"}`);
 }
 function readScanIndex(root2) {
-  const path7 = join7(root2, "state/git", SCAN_INDEX_FILE);
-  if (!existsSync6(path7)) return null;
+  const path7 = join8(root2, "state/git", SCAN_INDEX_FILE);
+  if (!existsSync7(path7)) return null;
   const value3 = readJson(path7);
   if (value3 === null) throw new CliError(`${path7} is not readable JSON`, void 0, "run `portta repos scan` to rewrite it");
   return value3["version"] === SCAN_VERSION ? value3 : null;
@@ -118190,7 +118233,7 @@ async function reposStatus(command) {
   const output2 = new Output(globals2(command));
   const now = Math.floor(Date.now() / 1e3);
   const repositories = (index?.repositories ?? []).map((entry) => {
-    const scan = readJson(join7(context.root, "state/git", `${entry.key}.json`));
+    const scan = readJson(join8(context.root, "state/git", `${entry.key}.json`));
     const gitInfo = scan?.["git"] ?? null;
     return {
       ...entry,
@@ -118214,12 +118257,12 @@ async function reposStatus(command) {
 }
 async function reposClear(command) {
   const context = gatewayContext({ profile: globals2(command).profile });
-  const directory = join7(context.root, "state/git");
-  if (!existsSync6(directory)) return;
+  const directory = join8(context.root, "state/git");
+  if (!existsSync7(directory)) return;
   let count2 = 0;
   for (const file2 of readdirSync(directory)) {
     if (file2.endsWith(".json")) {
-      unlinkSync4(join7(directory, file2));
+      unlinkSync4(join8(directory, file2));
       count2++;
     }
   }
@@ -118237,9 +118280,11 @@ async function refreshRepositories(profile, output2) {
 init_src();
 init_src2();
 init_context();
+init_version();
 init_errors3();
+init_process();
 import { existsSync as existsSync21 } from "node:fs";
-import { join as join43 } from "node:path";
+import { join as join44 } from "node:path";
 
 // src/metrics/collect.ts
 init_src();
@@ -118248,46 +118293,46 @@ import { loadavg } from "node:os";
 
 // src/metrics/store.ts
 init_src();
-import { chmodSync as chmodSync7, existsSync as existsSync15, mkdirSync as mkdirSync12, readFileSync as readFileSync17, renameSync as renameSync4, statSync as statSync7, writeFileSync as writeFileSync11 } from "node:fs";
+import { chmodSync as chmodSync8, existsSync as existsSync16, mkdirSync as mkdirSync13, readFileSync as readFileSync17, renameSync as renameSync4, statSync as statSync7, writeFileSync as writeFileSync11 } from "node:fs";
 import { dirname as dirname21 } from "node:path";
 import { randomUUID as randomUUID8 } from "node:crypto";
 
 // src/metrics/paths.ts
-import { join as join38 } from "node:path";
+import { join as join39 } from "node:path";
 function metricsDir(root2) {
-  return join38(root2, "state/metrics");
+  return join39(root2, "state/metrics");
 }
 function currentFile(root2) {
-  return join38(metricsDir(root2), "current.json");
+  return join39(metricsDir(root2), "current.json");
 }
 function historyFile(root2) {
-  return join38(metricsDir(root2), "history.jsonl");
+  return join39(metricsDir(root2), "history.jsonl");
 }
 function instanceFile(root2) {
-  return join38(metricsDir(root2), "instance.json");
+  return join39(metricsDir(root2), "instance.json");
 }
 function pidFile(root2) {
-  return join38(metricsDir(root2), "collector.pid");
+  return join39(metricsDir(root2), "collector.pid");
 }
 function logFile(root2) {
-  return join38(root2, "state/logs/host-metrics.log");
+  return join39(root2, "state/logs/host-metrics.log");
 }
 function environmentReportFile(root2) {
-  return join38(root2, "state/environment/report.json");
+  return join39(root2, "state/environment/report.json");
 }
 
 // src/metrics/store.ts
 var LOG_LIMIT_BYTES = 256 * 1024;
 function writeAtomic2(path7, text) {
-  mkdirSync12(dirname21(path7), { recursive: true });
+  mkdirSync13(dirname21(path7), { recursive: true });
   const temporary = `${path7}.${process.pid}.tmp`;
   writeFileSync11(temporary, text, { mode: 384 });
   renameSync4(temporary, path7);
-  chmodSync7(path7, 384);
+  chmodSync8(path7, 384);
 }
 function loadInstance(root2, hostname4) {
   const path7 = instanceFile(root2);
-  if (existsSync15(path7)) {
+  if (existsSync16(path7)) {
     try {
       const parsed = JSON.parse(readFileSync17(path7, "utf8"));
       if (typeof parsed.id === "string" && parsed.id !== "") {
@@ -118317,14 +118362,14 @@ function writeCurrent(root2, snapshot) {
 }
 function appendHistory(root2, snapshot) {
   const path7 = historyFile(root2);
-  mkdirSync12(dirname21(path7), { recursive: true });
-  const existing = existsSync15(path7) ? readFileSync17(path7, "utf8") : "";
+  mkdirSync13(dirname21(path7), { recursive: true });
+  const existing = existsSync16(path7) ? readFileSync17(path7, "utf8") : "";
   const merged = mergeHistoryLines(existing, historyPointFrom(snapshot), snapshot.collectedAt);
   writeAtomic2(path7, merged);
 }
 function readCurrent(root2) {
   const path7 = currentFile(root2);
-  if (!existsSync15(path7)) return null;
+  if (!existsSync16(path7)) return null;
   try {
     return JSON.parse(readFileSync17(path7, "utf8"));
   } catch {
@@ -118333,8 +118378,8 @@ function readCurrent(root2) {
 }
 function appendLog(root2, line4) {
   const path7 = logFile(root2);
-  mkdirSync12(dirname21(path7), { recursive: true });
-  if (existsSync15(path7) && statSync7(path7).size > LOG_LIMIT_BYTES) {
+  mkdirSync13(dirname21(path7), { recursive: true });
+  if (existsSync16(path7) && statSync7(path7).size > LOG_LIMIT_BYTES) {
     renameSync4(path7, `${path7}.old`);
   }
   writeFileSync11(path7, `${(/* @__PURE__ */ new Date()).toISOString()} ${line4}
@@ -118437,17 +118482,18 @@ async function collectSnapshot(root2, now = Date.now()) {
 
 // src/metrics/lifecycle.ts
 init_src();
-import { existsSync as existsSync20, readFileSync as readFileSync21, unlinkSync as unlinkSync5 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync20, unlinkSync as unlinkSync5 } from "node:fs";
+init_process();
 
 // src/environment/index.ts
 init_src();
 import { homedir as homedir8 } from "node:os";
 
 // src/host.ts
-init_src();
-import { homedir as homedir7, loadavg as loadavg2, networkInterfaces, uptime } from "node:os";
-import { accessSync as accessSync3, constants as constants7, existsSync as existsSync16, globSync, readFileSync as readFileSync18, statfsSync, statSync as statSync8 } from "node:fs";
-import { join as join39 } from "node:path";
+init_process();
+import { homedir as homedir7 } from "node:os";
+import { accessSync as accessSync3, constants as constants7, globSync, statSync as statSync8 } from "node:fs";
+import { join as join40 } from "node:path";
 function isTailscaleRange(address) {
   const [a3, b] = address.split(".").map(Number);
   return a3 === 100 && b !== void 0 && b >= 64 && b <= 127;
@@ -118476,19 +118522,19 @@ async function locate(tool) {
   if (!onPath.failed && direct) return direct;
   const home2 = homedir7();
   for (const candidate of [
-    join39(home2, ".local/bin", tool),
-    join39(home2, ".bun/bin", tool),
-    join39(home2, ".cargo/bin", tool),
-    join39(home2, ".deno/bin", tool),
-    join39("/usr/local/bin", tool),
-    join39("/opt/homebrew/bin", tool),
-    join39(home2, ".volta/bin", tool)
+    join40(home2, ".local/bin", tool),
+    join40(home2, ".bun/bin", tool),
+    join40(home2, ".cargo/bin", tool),
+    join40(home2, ".deno/bin", tool),
+    join40("/usr/local/bin", tool),
+    join40("/opt/homebrew/bin", tool),
+    join40(home2, ".volta/bin", tool)
   ]) {
     if (executable(candidate)) return candidate;
   }
   for (const pattern of [
-    join39(home2, ".nvm/versions/node/*/bin", tool),
-    join39(home2, ".local/share/fnm/node-versions/*/installation/bin", tool)
+    join40(home2, ".nvm/versions/node/*/bin", tool),
+    join40(home2, ".local/share/fnm/node-versions/*/installation/bin", tool)
   ]) {
     for (const match2 of globSync(pattern)) if (executable(match2)) return match2;
   }
@@ -118502,6 +118548,9 @@ function fileMode(path7) {
   }
 }
 
+// src/environment/index.ts
+init_process();
+
 // src/environment/agents.ts
 init_src();
 
@@ -118704,7 +118753,7 @@ ${daemon.stdout}`);
 // src/environment/ssh.ts
 init_src();
 import { existsSync as existsSync17 } from "node:fs";
-import { join as join40 } from "node:path";
+import { join as join41 } from "node:path";
 var SSH_ID = "tools.ssh";
 var TMUX_ID = "tools.tmux";
 var sshProbe = {
@@ -118720,7 +118769,7 @@ var sshProbe = {
         fix: "install an OpenSSH client for remote and repository workflows"
       })];
     }
-    const directory = join40(context.homeDir, ".ssh");
+    const directory = join41(context.homeDir, ".ssh");
     const mode = context.fileMode(directory);
     const agent = context.environment["SSH_AUTH_SOCK"] ? await context.run("ssh-add", ["-l"], { reject: false, timeout: PROBE_TIMEOUT_MS2 }) : null;
     const details = [
@@ -118803,12 +118852,12 @@ function writeEnvironmentReport(root2, report) {
 // src/environment/security/index.ts
 init_src();
 import { platform as platform2 } from "node:os";
-import { existsSync as existsSync19, readFileSync as readFileSync20 } from "node:fs";
-import { join as join41 } from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync19 } from "node:fs";
+import { join as join42 } from "node:path";
 
 // src/environment/security/probes.ts
 init_src();
-import { existsSync as existsSync18, readFileSync as readFileSync19 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync18 } from "node:fs";
 function emptySshd(state3, reason) {
   return { state: state3, reason, source: null, port: null, permitRootLogin: null, passwordAuthentication: null, pubkeyAuthentication: null, usePam: null };
 }
@@ -118826,7 +118875,7 @@ ${result.stdout}`);
   for (const path7 of ["/etc/ssh/sshd_config", "/private/etc/ssh/sshd_config"]) {
     if (!existsSync18(path7)) continue;
     try {
-      const parsed = parseSshdConfig(readFileSync19(path7, "utf8"), "file");
+      const parsed = parseSshdConfig(readFileSync18(path7, "utf8"), "file");
       return parsed.state === "present" ? parsed : emptySshd("unknown", "the SSH configuration file could not be interpreted");
     } catch {
       return emptySshd("unknown", "could not be checked: this user cannot read the SSH configuration");
@@ -118877,7 +118926,7 @@ ${jail.stderr}`);
 // src/environment/security/index.ts
 function hostSecurityContext(root2, profileOverride) {
   const snapshot = readCurrent(root2);
-  const file2 = existsSync19(join41(root2, ".env")) ? parseEnv(readFileSync20(join41(root2, ".env"), "utf8")) : /* @__PURE__ */ new Map();
+  const file2 = existsSync19(join42(root2, ".env")) ? parseEnv(readFileSync19(join42(root2, ".env"), "utf8")) : /* @__PURE__ */ new Map();
   const environment = mergeEnvironment(file2, process.env);
   const profile = profileOverride ?? environment["PORTTA_PROFILE"] ?? "local";
   return {
@@ -118897,7 +118946,7 @@ async function collectHostSecurityFacts(context, securityContext) {
 }
 async function collectHostSecurityChecks(root2, probeContext = defaultProbeContext(), securityContext = hostSecurityContext(root2)) {
   const checks = securityVerdicts(await collectHostSecurityFacts(probeContext, securityContext), securityContext);
-  const sshDirectory = join41(root2, "state/ssh");
+  const sshDirectory = join42(root2, "state/ssh");
   const mode = probeContext.fileMode(sshDirectory);
   checks.push({
     ...check2(
@@ -118925,9 +118974,9 @@ async function collectHostSecurityReport(root2, probeContext = defaultProbeConte
 }
 
 // src/environment/security/store.ts
-import { join as join42 } from "node:path";
+import { join as join43 } from "node:path";
 function securityReportFile(root2) {
-  return join42(root2, "state/environment/security.json");
+  return join43(root2, "state/environment/security.json");
 }
 function writeHostSecurityReport(root2, report) {
   const path7 = securityReportFile(root2);
@@ -118940,7 +118989,7 @@ function writeHostSecurityReport(root2, report) {
 function readCollectorPid(root2) {
   const path7 = pidFile(root2);
   if (!existsSync20(path7)) return null;
-  const parsed = Number(readFileSync21(path7, "utf8").trim());
+  const parsed = Number(readFileSync20(path7, "utf8").trim());
   return Number.isInteger(parsed) && parsed > 0 ? parsed : null;
 }
 function pidAlive(pid) {
@@ -118953,7 +119002,7 @@ function pidAlive(pid) {
 }
 function commandLine(pid) {
   try {
-    return readFileSync21(`/proc/${pid}/cmdline`, "utf8").replace(/\0/g, " ");
+    return readFileSync20(`/proc/${pid}/cmdline`, "utf8").replace(/\0/g, " ");
   } catch {
     return "";
   }
@@ -119168,10 +119217,10 @@ function ensureHostToken(context) {
   return file2;
 }
 function hostDaemonEntry(directory = import.meta.dirname) {
-  return join43(directory, "host.js");
+  return join44(directory, "host.js");
 }
 function hostDaemonLog(stateDir) {
-  return join43(stateDir, "daemon.log");
+  return join44(stateDir, "daemon.log");
 }
 async function hostAnswers(listen) {
   const host2 = listen.host === "0.0.0.0" || listen.host === "::" ? "127.0.0.1" : listen.host;
@@ -119186,7 +119235,9 @@ async function hostServe(command) {
   const options = globals3(command);
   const context = gatewayContext({ profile: options.profile });
   const entry = hostDaemonEntry();
-  if (!existsSync21(entry)) throw new PreconditionError(`the host daemon is not built: ${entry}`, "npm run build --workspace=@codions/portta");
+  if (!existsSync21(entry)) {
+    throw new PreconditionError(`the host daemon is not built: ${entry}`, CLI_VERSION === LOCAL_DEV_VERSION ? "npm run build --workspace=@codions/portta" : `the copy under ${join44(context.root, "bin")} serves the applier only; run this with the CLI from npm: npm install -g @codions/portta`);
+  }
   const stateDir = resolveHostStateDir(context.root, context.env);
   const listen = hostListen(context.env);
   const output2 = new Output(options);
@@ -119213,16 +119264,16 @@ function globals4(command) {
   return command.optsWithGlobals();
 }
 function setValues(root2, values) {
-  const path7 = join44(root2, ".env");
+  const path7 = join45(root2, ".env");
   patchEnvFile(path7, values);
 }
 function syncForwardAuth(root2) {
-  const storePath = join44(root2, "state/auth/protections.json");
+  const storePath = join45(root2, "state/auth/protections.json");
   const store = readProtectionStore(storePath);
   writeProtectionStore(storePath, store);
-  const dynamic = join44(root2, "config/traefik/dynamic");
-  mkdirSync13(dynamic, { recursive: true });
-  writeEnvFile(join44(dynamic, "portta-auth.yaml"), renderAuthDynamic(store));
+  const dynamic = join45(root2, "config/traefik/dynamic");
+  mkdirSync14(dynamic, { recursive: true });
+  writeEnvFile(join45(dynamic, "portta-auth.yaml"), renderAuthDynamic(store));
 }
 var PANEL_OVERRIDES = { PORTTA_WEB: "true" };
 async function webCompose(command, args, extraEnv = {}, stdio = "inherit") {
@@ -119230,7 +119281,7 @@ async function webCompose(command, args, extraEnv = {}, stdio = "inherit") {
   return runProcess("docker", ["compose", ...composeArguments(context), ...args], { cwd: context.root, env: { ...context.env, ...extraEnv }, stdio });
 }
 function prepareWebUp(options, command) {
-  prepareEnvFile(join44(gatewayContext({ profile: globals4(command).profile }).root, ".env"));
+  prepareEnvFile(join45(gatewayContext({ profile: globals4(command).profile }).root, ".env"));
   if (options.localRelease) selectLocalRelease(gatewayContext({ profile: globals4(command).profile }));
   const initial = gatewayContext({ profile: globals4(command).profile });
   const expose = options.expose ?? initial.config.webExpose;
@@ -119282,16 +119333,7 @@ function prepareWebUp(options, command) {
     options.port ? String(Number(options.port)) : String(initial.config.webPort)
   );
   setValues(initial.root, values);
-  mkdirSync13(join44(initial.root, "state/git"), { recursive: true });
-  mkdirSync13(join44(initial.root, "state/github"), { recursive: true });
-  mkdirSync13(join44(initial.root, "state/metrics"), { recursive: true });
-  mkdirSync13(join44(initial.root, "state/environment"), { recursive: true });
-  mkdirSync13(join44(initial.root, "state/logs"), { recursive: true });
-  mkdirSync13(join44(initial.root, "state/auth"), { recursive: true, mode: 448 });
-  chmodSync8(join44(initial.root, "state/auth"), 448);
-  mkdirSync13(join44(initial.root, "state/ssh"), { recursive: true, mode: 448 });
-  chmodSync8(join44(initial.root, "state/ssh"), 448);
-  mkdirSync13(join44(initial.root, "config/traefik/dynamic"), { recursive: true });
+  ensureInstallationDirectories(initial.root);
   syncForwardAuth(initial.root);
   const context = gatewayContext({ profile: globals4(command).profile, overrides: values });
   const output2 = new Output(globals4(command));
@@ -119307,7 +119349,7 @@ async function webUp(options, command) {
   ensureHostToken(context);
   output2.progress("pulling alpine/socat:1.8.1.3");
   await runProcess("docker", ["pull", "alpine/socat:1.8.1.3"], { reject: false, stdio: "stream" });
-  mkdirSync13(join44(context.root, "state", "panel"), { recursive: true });
+  mkdirSync14(join45(context.root, "state", "panel"), { recursive: true });
   const services = ["portta-auth", "web", "web-socket-proxy"];
   const buildArgs = context.config.webDev || context.config.webBuild ? ["--build"] : [];
   output2.progress(buildArgs.length > 0 ? `starting ${services.join(", ")}, building the panel image` : `starting ${services.join(", ")}`);
@@ -119505,6 +119547,7 @@ async function webOpen(command) {
 // src/commands/clients.ts
 init_context();
 init_errors3();
+init_process();
 init_src();
 function globals5(command) {
   return command.optsWithGlobals();
@@ -119514,7 +119557,7 @@ async function ensureToolbox(command) {
   const image = porttaImages(context.version).toolbox;
   const present = await runProcess("docker", ["image", "inspect", image], { reject: false });
   if (present.exitCode === 0) return image;
-  await runProcess("docker", ["build", "-q", "--build-arg", `PORTTA_VERSION=${context.version}`, "-t", image, join45(context.root, "docker", "images", "toolbox")], { stdio: "inherit" });
+  await runProcess("docker", ["build", "-q", "--build-arg", `PORTTA_VERSION=${context.version}`, "-t", image, join46(context.root, "docker", "images", "toolbox")], { stdio: "inherit" });
   return image;
 }
 async function containerEnvironment(id) {
@@ -119645,7 +119688,7 @@ async function dbRestore(file2, command) {
     );
   }
   await confirm(`replace ${path7} with ${file2}? The current panel data is discarded.`, globals5(command).yes === true);
-  mkdirSync14(dirname22(path7), { recursive: true });
+  mkdirSync15(dirname22(path7), { recursive: true });
   for (const candidate of databaseFiles(path7)) rmSync5(candidate, { force: true });
   copyFileSync2(file2, path7);
   new Output(globals5(command)).progress(`panel database restored from ${file2}`);
@@ -119653,12 +119696,14 @@ async function dbRestore(file2, command) {
 
 // src/commands/projects.ts
 init_src();
+var import_yaml2 = __toESM(require_dist(), 1);
 init_zod();
-import { existsSync as existsSync23, mkdirSync as mkdirSync15, readFileSync as readFileSync22, realpathSync as realpathSync4, renameSync as renameSync5, rmSync as rmSync6, writeFileSync as writeFileSync12 } from "node:fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync16, readFileSync as readFileSync21, realpathSync as realpathSync4, renameSync as renameSync5, rmSync as rmSync6, writeFileSync as writeFileSync12 } from "node:fs";
 import { createHash as createHash15 } from "node:crypto";
-import { basename as basename14, dirname as dirname23, join as join46, resolve as resolve24 } from "node:path";
+import { basename as basename14, dirname as dirname23, join as join47, resolve as resolve24 } from "node:path";
 init_context();
 init_errors3();
+init_process();
 function globals6(command) {
   return command.optsWithGlobals();
 }
@@ -119769,7 +119814,7 @@ function labelsOf(service2) {
   return Object.fromEntries(Object.entries(service2.labels ?? {}).map(([key, value3]) => [key, String(value3)]));
 }
 function composeCandidates(path7) {
-  return ["compose.yaml", "compose.yml", "docker-compose.yaml", "docker-compose.yml"].map((file2) => join46(path7, file2)).filter(existsSync23);
+  return ["compose.yaml", "compose.yml", "docker-compose.yaml", "docker-compose.yml"].map((file2) => join47(path7, file2)).filter(existsSync23);
 }
 async function hostContainers() {
   try {
@@ -119787,12 +119832,27 @@ function safeRealpath2(path7) {
 }
 function declaredComposeName(file2) {
   try {
-    const match2 = /^name:[ \t]*["']?([^"'\s#]+)/m.exec(readFileSync22(file2, "utf8"));
+    const match2 = /^name:[ \t]*["']?([^"'\s#]+)/m.exec(readFileSync21(file2, "utf8"));
     return match2?.[1] ?? null;
   } catch {
     return null;
   }
 }
+function readProjectConfig(root2) {
+  const path7 = join47(root2, PROJECT_CONFIG_PATH);
+  if (!existsSync23(path7)) {
+    return { source: "defaults", path: PROJECT_CONFIG_PATH, config: defaultProjectConfig(), issues: [] };
+  }
+  let document;
+  try {
+    document = (0, import_yaml2.parse)(readFileSync21(path7, "utf8"));
+  } catch (error61) {
+    const message = error61 instanceof Error ? error61.message : String(error61);
+    return { source: "file", path: PROJECT_CONFIG_PATH, config: null, issues: [{ path: "", message }] };
+  }
+  const parsed = parseProjectConfig(document);
+  return parsed.ok ? { source: "file", path: PROJECT_CONFIG_PATH, config: parsed.config, issues: [] } : { source: "file", path: PROJECT_CONFIG_PATH, config: null, issues: parsed.issues };
+}
 async function analyze(pathValue, options = {}, containers) {
   const base2 = resolve24(pathValue);
   let composeFile2;
@@ -119808,8 +119868,8 @@ async function analyze(pathValue, options = {}, containers) {
   let result = await runProcess("docker", ["compose", "-f", composeFile2, "config", "--format", "json"], { cwd: path7, reject: false });
   if (result.exitCode !== 0) result = await runProcess("docker", ["compose", "-f", composeFile2, "config", "--format", "json", "--no-interpolate"], { cwd: path7 });
   const model = ComposeSchema.parse(JSON.parse(result.stdout));
-  const overlay2 = ["compose.portta.yaml", "compose.portta.yml"].map((file2) => join46(".portta", file2)).find((file2) => existsSync23(join46(path7, file2))) ?? ["compose.portta.yaml", "compose.portta.yml"].find((file2) => existsSync23(join46(path7, file2))) ?? null;
-  const projectFromEnv = existsSync23(join46(path7, ".env")) ? parseEnv(readFileSync22(join46(path7, ".env"), "utf8")).get("COMPOSE_PROJECT_NAME") : void 0;
+  const overlay2 = ["compose.portta.yaml", "compose.portta.yml"].map((file2) => join47(".portta", file2)).find((file2) => existsSync23(join47(path7, file2))) ?? ["compose.portta.yaml", "compose.portta.yml"].find((file2) => existsSync23(join47(path7, file2))) ?? null;
+  const projectFromEnv = existsSync23(join47(path7, ".env")) ? parseEnv(readFileSync21(join47(path7, ".env"), "utf8")).get("COMPOSE_PROJECT_NAME") : void 0;
   const declaredName = declaredComposeName(composeFile2);
   const project2 = projectFromEnv || composeNamespace(declaredName ?? model.name ?? basename14(path7));
   const services = Object.entries(model.services).map(([name, service2]) => ({
@@ -119843,6 +119903,7 @@ async function analyze(pathValue, options = {}, containers) {
     path: path7,
     compose_file: basename14(composeFile2),
     gateway_overlay: overlay2,
+    project_config: readProjectConfig(path7),
     project: { name: project2, source: projectFromEnv ? ".env" : declaredName ? "compose name:" : "directory name (implicit)" },
     domain: gatewayContext({ required: false }).config.domain,
     services,
@@ -119874,6 +119935,19 @@ async function analyzeCommand(path7, options, command) {
     output2.line(`  project namespace      ${report.project.name} (${report.project.source})`);
     const identities = [...new Set(report.services.flatMap((service2) => Object.entries(service2.labels).filter(([key]) => key.startsWith("portta.project") || key.startsWith("portta.repo") || key.startsWith("portta.git.root")).map(([key, value3]) => `${key}=${value3}`)))];
     output2.line(`  declared identity      ${identities.length ? identities.join(" ") : "none (inferred from the Compose labels)"}`);
+    const declared = report.project_config;
+    if (declared.issues.length) {
+      output2.line(`  project.yaml           invalid, so its defaults are not applied:`);
+      for (const issue2 of declared.issues) output2.line(`    ${issue2.path ? `${issue2.path}: ` : ""}${issue2.message}`);
+    } else if (declared.config) {
+      const summary = [
+        declared.config.name ? `name ${declared.config.name}` : null,
+        declared.config.mainBranch ? `main branch ${declared.config.mainBranch}` : null,
+        `worktrees ${declared.config.worktrees.root}`,
+        `branches ${declared.config.worktrees.branchPattern}`
+      ].filter((part) => part !== null);
+      output2.line(`  project.yaml           ${declared.source === "file" ? summary.join(", ") : `absent, so defaults apply: ${summary.join(", ")}`}`);
+    }
     output2.line("\nServices");
     for (const service2 of report.services) output2.line(`  ${service2.name}	${service2.image ?? "<built>"}	${service2.kind}	${service2.published_ports.map((port) => `${port.host}:${port.container}`).join(",") || "-"}`);
     output2.line("\nFindings");
@@ -119972,7 +120046,7 @@ async function initCommand(pathValue, options, command) {
   }));
   const content = renderOverlay(report.project.name, overlayServices, context.config.network, options.project);
   const runtimeId = createHash15("sha256").update(safeRealpath2(report.path)).digest("hex").slice(0, 16);
-  const destination = options.output ? resolve24(report.path, options.output) : join46(context.root, "runtime", "compose", runtimeId, "compose.portta.yaml");
+  const destination = options.output ? resolve24(report.path, options.output) : join47(context.root, "runtime", "compose", runtimeId, "compose.portta.yaml");
   const output2 = new Output(globals6(command));
   if (options.dryRun) {
     output2.data(content);
@@ -119980,12 +120054,12 @@ async function initCommand(pathValue, options, command) {
   }
   if (existsSync23(destination) && !options.force) throw new RefusedError(`${destination} already exists`, "pass --force to replace it while keeping a backup");
   await confirm(`write ${destination}?`, globals6(command).yes === true);
-  mkdirSync15(dirname23(destination), { recursive: true, mode: 493 });
+  mkdirSync16(dirname23(destination), { recursive: true, mode: 493 });
   if (existsSync23(destination)) renameSync5(destination, `${destination}.bak.${Date.now()}`);
   const temporary = `${destination}.${process.pid}.tmp`;
   writeFileSync12(temporary, content, { mode: 420 });
   try {
-    const validated = await runProcess("docker", ["compose", "-f", join46(report.path, report.compose_file), "-f", temporary, "config", "--format", "json"], { cwd: report.path, reject: false });
+    const validated = await runProcess("docker", ["compose", "-f", join47(report.path, report.compose_file), "-f", temporary, "config", "--format", "json"], { cwd: report.path, reject: false });
     if (validated.exitCode !== 0) throw new RefusedError("generated runtime overlay is not valid Compose", validated.stderr.trim() || validated.stdout.trim());
     ComposeSchema.parse(JSON.parse(validated.stdout));
     renameSync5(temporary, destination);
@@ -120063,8 +120137,9 @@ init_zod();
 init_context();
 init_errors3();
 import { createHash as createHash16 } from "node:crypto";
-import { existsSync as existsSync24, mkdirSync as mkdirSync16, readFileSync as readFileSync23, renameSync as renameSync6, rmSync as rmSync7, writeFileSync as writeFileSync13 } from "node:fs";
-import { basename as basename15, delimiter as delimiter3, isAbsolute as isAbsolute5, join as join47, resolve as resolve25 } from "node:path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync17, readFileSync as readFileSync22, renameSync as renameSync6, rmSync as rmSync7, writeFileSync as writeFileSync13 } from "node:fs";
+import { basename as basename15, delimiter as delimiter3, isAbsolute as isAbsolute5, join as join48, resolve as resolve25 } from "node:path";
+init_process();
 var Manifest = external_exports.object({
   schemaVersion: external_exports.literal(1),
   driver: external_exports.literal("compose").default("compose"),
@@ -120097,25 +120172,25 @@ function idFor(workspace2) {
   return createHash16("sha256").update(workspace2).digest("hex").slice(0, 16);
 }
 function digest(path7) {
-  return createHash16("sha256").update(readFileSync23(path7)).digest("hex");
+  return createHash16("sha256").update(readFileSync22(path7)).digest("hex");
 }
 function digestIfPresent(path7) {
   return existsSync24(path7) ? digest(path7) : null;
 }
 function runtimeDirectory(root2, id) {
-  return join47(root2, "runtime", "compose", id);
+  return join48(root2, "runtime", "compose", id);
 }
 function planPath(root2, id) {
-  return join47(runtimeDirectory(root2, id), "plan.json");
+  return join48(runtimeDirectory(root2, id), "plan.json");
 }
 function manifestPath(root2, id) {
-  return join47(runtimeDirectory(root2, id), "runtime.json");
+  return join48(runtimeDirectory(root2, id), "runtime.json");
 }
 function composeCandidates2(workspace2) {
-  return ["compose.yaml", "compose.yml", "docker-compose.yaml", "docker-compose.yml"].map((file2) => join47(workspace2, file2)).filter(existsSync24);
+  return ["compose.yaml", "compose.yml", "docker-compose.yaml", "docker-compose.yml"].map((file2) => join48(workspace2, file2)).filter(existsSync24);
 }
 function hasComposeRuntime(workspace2 = process.cwd()) {
-  return composeCandidates2(resolve25(workspace2)).length > 0 && !existsSync24(join47(resolve25(workspace2), "VERSION"));
+  return composeCandidates2(resolve25(workspace2)).length > 0 && !existsSync24(join48(resolve25(workspace2), "VERSION"));
 }
 function networks(value3) {
   return Array.isArray(value3) ? value3 : Object.keys(value3 ?? {});
@@ -120174,22 +120249,22 @@ networks:
 `;
 }
 function manifestPaths(workspace2, root2, id) {
-  return { local: join47(workspace2, ".portta", "runtime.json"), stored: manifestPath(root2, id) };
+  return { local: join48(workspace2, ".portta", "runtime.json"), stored: manifestPath(root2, id) };
 }
 function loadManifest(workspace2, root2, id) {
   const { local, stored } = manifestPaths(workspace2, root2, id);
   const file2 = existsSync24(local) ? local : existsSync24(stored) ? stored : null;
-  return file2 ? Manifest.parse(JSON.parse(readFileSync23(file2, "utf8"))) : Manifest.parse({ schemaVersion: 1 });
+  return file2 ? Manifest.parse(JSON.parse(readFileSync22(file2, "utf8"))) : Manifest.parse({ schemaVersion: 1 });
 }
 function inputFiles(workspace2, manifest) {
   if (manifest.compose.files?.length) return manifest.compose.files.map((file2) => resolve25(workspace2, file2));
-  const envFile = join47(workspace2, ".env");
-  const env = envFile && existsSync24(envFile) ? parseEnv(readFileSync23(envFile, "utf8")) : /* @__PURE__ */ new Map();
+  const envFile = join48(workspace2, ".env");
+  const env = envFile && existsSync24(envFile) ? parseEnv(readFileSync22(envFile, "utf8")) : /* @__PURE__ */ new Map();
   const configured = process.env.COMPOSE_FILE ?? env.get("COMPOSE_FILE");
   if (configured) return configured.split(delimiter3).map((file2) => isAbsolute5(file2) ? file2 : resolve25(workspace2, file2));
   const base2 = composeCandidates2(workspace2)[0];
   if (!base2) throw new UsageError(`no Compose file found in ${workspace2}`);
-  const override = ["compose.override.yaml", "compose.override.yml"].map((file2) => join47(workspace2, file2)).find(existsSync24);
+  const override = ["compose.override.yaml", "compose.override.yml"].map((file2) => join48(workspace2, file2)).find(existsSync24);
   return override ? [base2, override] : [base2];
 }
 function versionAtLeast2(value3, minimum = [2, 24, 4]) {
@@ -120220,7 +120295,7 @@ async function stale(plan) {
 function readPlan(root2, workspace2) {
   const path7 = planPath(root2, idFor(workspace2));
   if (!existsSync24(path7)) throw new UsageError("no Runtime Plan exists for this workspace", "run `portta prepare` first");
-  return JSON.parse(readFileSync23(path7, "utf8"));
+  return JSON.parse(readFileSync22(path7, "utf8"));
 }
 function manifestWithOptions(manifest, options) {
   return Manifest.parse({
@@ -120289,14 +120364,14 @@ async function prepareComposeRuntime(options, command) {
   const unsupported = findings.filter((finding2) => finding2.code === "network_mode");
   const outcome = unsupported.length ? "not_supported" : manifest.compose.mode === "manual" ? "manual" : pending.length ? "not_supported" : "isolated";
   const directory = runtimeDirectory(context.root, id);
-  const generatedOverlay = join47(directory, "compose.portta.yaml");
+  const generatedOverlay = join48(directory, "compose.portta.yaml");
   const manifests = manifestPaths(workspace2, context.root, id);
-  const envFile = join47(workspace2, ".env");
+  const envFile = join48(workspace2, ".env");
   const plan = { version: 1, driver: "compose", id, workspace: workspace2, createdAt: (/* @__PURE__ */ new Date()).toISOString(), inputs: [...files, ...existsSync24(envFile) ? [envFile] : []].map((file2) => ({ path: file2, digest: digest(file2) })), capabilities: { composeVersion }, manifest: { local: { path: manifests.local, digest: digestIfPresent(manifests.local) }, stored: { path: manifests.stored, digest: digestIfPresent(manifests.stored) } }, compose: { projectName, projectDirectory: workspace2, files, profiles: manifest.compose.profiles, mode: manifest.compose.mode, generatedOverlay }, outcome, compatibility: manifest.compatibility, pending, services, findings };
   const content = manifest.compose.mode === "manual" ? "# Manual Compose integration; Portta adds no runtime mutations.\nservices: {}\n" : overlay(plan, context.config.network);
   if (!options.dryRun) {
     if (outcome === "not_supported") throw new RefusedError("environment is not ready for isolated Compose runtime", [...unsupported, ...pending].map((finding2) => finding2.detail).join("; "));
-    mkdirSync16(directory, { recursive: true, mode: 448 });
+    mkdirSync17(directory, { recursive: true, mode: 448 });
     const temporary = `${generatedOverlay}.${process.pid}.tmp`;
     writeFileSync13(temporary, content, { mode: 384 });
     const final = await runProcess("docker", [...composeArgs(plan, temporary), "config", "--format", "json"], { cwd: workspace2, reject: false });
@@ -120336,7 +120411,7 @@ async function initComposeRuntime(options, command) {
   const files = inputFiles(workspace2, Manifest.parse({ schemaVersion: 1 }));
   const manifest = { schemaVersion: 1, driver: "compose", compose: { files: files.map((file2) => file2.startsWith(`${workspace2}/`) ? file2.slice(workspace2.length + 1) : file2), profiles: [], mode: options.manual ? "manual" : "auto" }, services, compatibility: { removeContainerNames: options.removeContainerName ?? [], allowSharedNetworks: options.allowSharedNetworks ?? false, allowSharedVolumes: options.allowSharedVolumes ?? false } };
   const directory = runtimeDirectory(context.root, id);
-  mkdirSync16(directory, { recursive: true, mode: 448 });
+  mkdirSync17(directory, { recursive: true, mode: 448 });
   writeFileSync13(manifestPath(context.root, id), `${JSON.stringify(manifest, null, 2)}
 `, { mode: 384 });
   return prepareComposeRuntime({ path: workspace2, project: options.project }, command);
@@ -120367,23 +120442,25 @@ async function runtimeAction(action, options, command) {
 init_src();
 init_src();
 init_context();
-import { chmodSync as chmodSync9, existsSync as existsSync38, mkdirSync as mkdirSync18, readFileSync as readFileSync30, readdirSync as readdirSync8, rmSync as rmSync10 } from "node:fs";
-import { join as join58 } from "node:path";
+import { chmodSync as chmodSync9, existsSync as existsSync38, mkdirSync as mkdirSync19, readFileSync as readFileSync29, readdirSync as readdirSync8, rmSync as rmSync10 } from "node:fs";
+import { join as join59 } from "node:path";
 init_errors3();
+init_process();
 init_version();
 
 // src/doctor.ts
 init_src();
 init_context();
 import { existsSync as existsSync33 } from "node:fs";
-import { join as join53 } from "node:path";
+import { join as join54 } from "node:path";
+init_process();
 
 // src/modules/index.ts
 init_src();
 init_modules();
 init_context();
-import { existsSync as existsSync32, readFileSync as readFileSync28 } from "node:fs";
-import { join as join52 } from "node:path";
+import { existsSync as existsSync32, readFileSync as readFileSync27 } from "node:fs";
+import { join as join53 } from "node:path";
 
 // src/modules/taskflow.ts
 init_modules();
@@ -120399,8 +120476,7 @@ var WORKFLOW_ENGINE_ACTIONS = [
   ["validate", "Validate a workflow file or registered workflow"],
   ["save", "Save a workflow file into the registry"],
   ["doctor", "Check the standalone workflow engine"],
-  ["guide", "Print the workflow authoring guide"],
-  ["install-skill", "Retired \u2014 install with: npx skills add codions-labs/portta --skill portta-workflows -g"]
+  ["guide", "Print the workflow authoring guide"]
 ];
 var USAGE_HINT = "(run with --help for usage)";
 function parsePort2(value3) {
@@ -120416,7 +120492,7 @@ function helpAfter(command, text) {
 ${text(commandInvocation(context.command))}`);
 }
 function runOptions(command) {
-  return command.addOption(new Option("--input <text>", "Run input text").conflicts("inputJson")).option("--input-json <json>", "Run input as a JSON object").option("--profile <name>", `Profile from ${PROJECT_CONFIG_PATH}`).addOption(
+  return command.addOption(new Option("--input <text>", "Run input text").conflicts("inputJson")).option("--input-json <json>", "Run input as a JSON object").option("--profile <name>", `Profile from ${PROJECT_CONFIG_PATH2}`).addOption(
     new Option("--workspace <strategy>", "Execution workspace (default: workflow policy or worktree)").choices([
       "worktree",
       "branch",
@@ -120486,12 +120562,12 @@ ${environment.map(([name = "", text]) => `  ${name.padEnd(width)}  ${text}`).joi
 Analysis:   --analyze=auto uses the default agent only when runtime detection falls back to host.
             --analyze=claude | --analyze=codex always run that agent.`
   );
-  leaf(flow, "add [branch]", "Create a worktree using the dashboard lifecycle").option("--existing", "Use an existing local or remote branch instead of creating a new one").option("--base <branch>", "Base branch for a new worktree (defaults to config)").option("--profile <name>", `Worktree profile from ${PROJECT_CONFIG_PATH}`).option("--agent <id>", "Agent id to launch (repeatable)", collect).option("--prompt <text>", "Initial agent prompt").option("--env <KEY=VALUE>", "Runtime env override (repeatable)", collect).option("--interface <mode>", "Session UI: terminal or web-chat").option("-d, --detach", "Create worktree without switching to it").option(
+  leaf(flow, "add [branch]", "Create a worktree using the dashboard lifecycle").option("--existing", "Use an existing local or remote branch instead of creating a new one").option("--base <branch>", "Base branch for a new worktree (defaults to config)").option("--profile <name>", `Worktree profile from ${PROJECT_CONFIG_PATH2}`).option("--agent <id>", "Agent id to launch (repeatable)", collect).option("--prompt <text>", "Initial agent prompt").option("--env <KEY=VALUE>", "Runtime env override (repeatable)", collect).option("--interface <mode>", "Session UI: terminal or web-chat").option("-d, --detach", "Create worktree without switching to it").option(
     "--from-linear <issue-id>",
     `Bootstrap from a Linear issue, plus any saved ${APP_NAME} session or linked PR`
   ).option("--branch <name>", "Override the branch when --from-linear resolves to one");
   helpAfter(
-    leaf(flow, "oneshot [branch]", "Run a worktree start-to-finish, streaming logs to stdout").option("--resume <branch>", "Resume an existing local worktree instead of creating one").option("--prompt <text>", "Initial agent prompt (required; follow-up nudge when --resume)").option("--agent <id>", "Agent id to launch").option("--base <branch>", "Base branch for a new worktree (defaults to config)").option("--profile <name>", `Worktree profile from ${PROJECT_CONFIG_PATH}`).option("--env <KEY=VALUE>", "Runtime env override (repeatable)", collect).option("--keep-open", "Don't auto-close the worktree session when the agent finishes").option(
+    leaf(flow, "oneshot [branch]", "Run a worktree start-to-finish, streaming logs to stdout").option("--resume <branch>", "Resume an existing local worktree instead of creating one").option("--prompt <text>", "Initial agent prompt (required; follow-up nudge when --resume)").option("--agent <id>", "Agent id to launch").option("--base <branch>", "Base branch for a new worktree (defaults to config)").option("--profile <name>", `Worktree profile from ${PROJECT_CONFIG_PATH2}`).option("--env <KEY=VALUE>", "Runtime env override (repeatable)", collect).option("--keep-open", "Don't auto-close the worktree session when the agent finishes").option(
       "--linear <id|team>",
       "Tie this oneshot to Linear: ENG-123 loads the issue and posts back; ENG creates an issue when done"
     ).option("--branch <name>", "Override the branch when --linear resolves to one"),
@@ -120524,7 +120600,7 @@ running, resume with \`${invocation2} --resume <branch> --prompt <text>\`).`
       "--profile <name>",
       "Profile name (alternative to positional arg)"
     ),
-    () => `Switches the worktree to another profile from ${PROJECT_CONFIG_PATH}. An open
+    () => `Switches the worktree to another profile from ${PROJECT_CONFIG_PATH2}. An open
 worktree is restarted with the new pane layout and commands; a closed
 one picks the new profile up on its next open.`
   );
@@ -120836,10 +120912,10 @@ var taskflowCliModule = {
 // src/modules/index.ts
 var CLI_MODULES = [taskflowCliModule];
 function moduleEnvironment(root2 = findGatewayRoot()) {
-  const file2 = root2 ? join52(root2, ".env") : null;
+  const file2 = root2 ? join53(root2, ".env") : null;
   if (!file2 || !existsSync32(file2)) return { ...process.env };
   try {
-    return mergeEnvironment(parseEnv(readFileSync28(file2, "utf8")), process.env);
+    return mergeEnvironment(parseEnv(readFileSync27(file2, "utf8")), process.env);
   } catch {
     return { ...process.env };
   }
@@ -120893,7 +120969,7 @@ async function runDoctor(context) {
   const env = context.env;
   const config3 = context.config;
   const root2 = context.root;
-  const stateDir = env["PORTTA_STATE_DIR"] || join53(root2, "state");
+  const stateDir = env["PORTTA_STATE_DIR"] || join54(root2, "state");
   const add = (...entries) => {
     for (const entry of entries) if (entry) checks.push(entry);
   };
@@ -120905,7 +120981,7 @@ async function runDoctor(context) {
     `unknown profile '${env["PORTTA_PROFILE"]}'`,
     "set PORTTA_PROFILE to one of: local remote-private remote-public"
   ));
-  const envPath = join53(root2, ".env");
+  const envPath = join54(root2, ".env");
   if (existsSync33(envPath)) {
     add(check2("config.env", "pass", ".env", "present"));
     add(envPermissionVerdict(fileMode(envPath)));
@@ -121047,10 +121123,10 @@ async function runDoctor(context) {
           `portta up ${config3.profile}`
         ));
       }
-      add(existsSync33(join53(stateDir, "tailscale")) ? check2("tailscale.state.dir", "pass", "tailscale state", "persisted under state/tailscale") : check2("tailscale.state.dir", "warn", "tailscale state", "state directory missing", "portta bootstrap"));
+      add(existsSync33(join54(stateDir, "tailscale")) ? check2("tailscale.state.dir", "pass", "tailscale state", "persisted under state/tailscale") : check2("tailscale.state.dir", "warn", "tailscale state", "state directory missing", "portta bootstrap"));
     }
     const hasKey = Boolean(env["TS_AUTHKEY"]);
-    add(!hasKey && !existsSync33(join53(stateDir, "tailscale/tailscaled.state")) ? check2(
+    add(!hasKey && !existsSync33(join54(stateDir, "tailscale/tailscaled.state")) ? check2(
       "tailscale.authkey",
       "fail",
       "tailscale auth",
@@ -121080,7 +121156,7 @@ async function runDoctor(context) {
     "portta bootstrap   (generates it without printing it)"
   ));
   const auth2 = gatewayContainer(containers, "auth");
-  const authStore = join53(root2, "state/auth/protections.json");
+  const authStore = join54(root2, "state/auth/protections.json");
   add(authStoreVerdict(existsSync33(authStore), fileMode(authStore), Boolean(auth2)));
   add(componentVerdict("auth.service", "authentication service", Boolean(auth2), auth2?.state ?? null, auth2?.health ?? null, "portta logs portta-auth"));
   const gh = await locate("gh");
@@ -121230,7 +121306,7 @@ async function runDoctor(context) {
           "set CF_DNS_API_TOKEN, or use ACME_CHALLENGE=http for per-hostname certificates"
         ));
       }
-      const store = join53(stateDir, "traefik/acme/acme.json");
+      const store = join54(stateDir, "traefik/acme/acme.json");
       if (existsSync33(store)) {
         const mode = fileMode(store);
         add(mode === "600" ? check2("tls.acme.perms", "pass", "ACME store permissions", mode) : check2(
@@ -121432,8 +121508,9 @@ async function resolveIpv4(hostname4) {
 
 // src/commands/apply.ts
 init_src();
+init_process();
 import { existsSync as existsSync34 } from "node:fs";
-import { join as join54 } from "node:path";
+import { join as join55 } from "node:path";
 async function label(name) {
   const result = await runProcess(
     "docker",
@@ -121472,9 +121549,9 @@ async function ensureApplier(context) {
     if (await label("portta.apply.spec") === spec) return { action: "kept" };
     if (!await removeApplier()) return { action: "failed", reason: "the running applier could not be replaced" };
   }
-  const context_dir = join54(context.root, "docker", "images", "apply");
+  const context_dir = join55(context.root, "docker", "images", "apply");
   const image = porttaImages(context.version).apply;
-  if (!existsSync34(join54(context_dir, "Dockerfile"))) {
+  if (!existsSync34(join55(context_dir, "Dockerfile"))) {
     return { action: "failed", reason: `no applier image source at ${context_dir}` };
   }
   const present = await runProcess("docker", ["image", "inspect", image], { reject: false });
@@ -121488,8 +121565,9 @@ async function ensureApplier(context) {
 
 // src/commands/runner.ts
 init_src();
+init_process();
 import { existsSync as existsSync35 } from "node:fs";
-import { join as join55 } from "node:path";
+import { join as join56 } from "node:path";
 async function label2(name) {
   const result = await runProcess(
     "docker",
@@ -121528,9 +121606,9 @@ async function ensureRunner(context) {
     if (await label2("portta.runner.spec") === spec) return { action: "kept" };
     if (!await removeRunner()) return { action: "failed", reason: "the running runner could not be replaced" };
   }
-  const context_dir = join55(context.root, "docker", "images", "apply");
+  const context_dir = join56(context.root, "docker", "images", "apply");
   const image = porttaImages(context.version).apply;
-  if (!existsSync35(join55(context_dir, "Dockerfile"))) {
+  if (!existsSync35(join56(context_dir, "Dockerfile"))) {
     return { action: "failed", reason: `no runner image source at ${context_dir}` };
   }
   const present = await runProcess("docker", ["image", "inspect", image], { reject: false });
@@ -121543,20 +121621,22 @@ async function ensureRunner(context) {
 }
 
 // src/checkout-cli.ts
+init_process();
 import { existsSync as existsSync36, readdirSync as readdirSync6, statSync as statSync11 } from "node:fs";
-import { join as join56 } from "node:path";
+import { join as join57 } from "node:path";
 var CHECKOUT_CLI_SOURCES = [
   "packages/cli/src",
   "packages/cli/scripts",
   "packages/cli/package.json",
   "packages/core/src",
-  "packages/contracts/src"
+  "packages/contracts/src",
+  "packages/host/src"
 ];
 function checkoutCliDist(root2) {
-  return join56(root2, "packages/cli/dist/cli.js");
+  return join57(root2, "packages/cli/dist/cli.js");
 }
 function isCheckout(root2) {
-  return existsSync36(join56(root2, "packages/cli/src/cli.ts")) && existsSync36(join56(root2, "package.json"));
+  return existsSync36(join57(root2, "packages/cli/src/cli.ts")) && existsSync36(join57(root2, "package.json"));
 }
 function newestSourceMtime(path7) {
   if (!existsSync36(path7)) return 0;
@@ -121564,7 +121644,7 @@ function newestSourceMtime(path7) {
   if (info.isFile()) return /\.(ts|mjs|json)$/.test(path7) ? info.mtimeMs : 0;
   let newest = 0;
   for (const entry of readdirSync6(path7, { withFileTypes: true })) {
-    newest = Math.max(newest, newestSourceMtime(join56(path7, entry.name)));
+    newest = Math.max(newest, newestSourceMtime(join57(path7, entry.name)));
   }
   return newest;
 }
@@ -121573,7 +121653,7 @@ function checkoutCliNeedsBuild(root2) {
   const dist = checkoutCliDist(root2);
   if (!existsSync36(dist)) return true;
   const distTime = statSync11(dist).mtimeMs;
-  return CHECKOUT_CLI_SOURCES.some((tree) => newestSourceMtime(join56(root2, tree)) > distTime);
+  return CHECKOUT_CLI_SOURCES.some((tree) => newestSourceMtime(join57(root2, tree)) > distTime);
 }
 async function ensureCheckoutCli(root2, output2) {
   if (!checkoutCliNeedsBuild(root2)) return false;
@@ -121594,8 +121674,9 @@ async function reexecBuiltCli(root2) {
 init_src();
 init_context();
 init_errors3();
-import { existsSync as existsSync37, readdirSync as readdirSync7, readFileSync as readFileSync29 } from "node:fs";
-import { basename as basename20, join as join57 } from "node:path";
+import { existsSync as existsSync37, readdirSync as readdirSync7, readFileSync as readFileSync28 } from "node:fs";
+import { basename as basename20, join as join58 } from "node:path";
+init_process();
 var PORTTA_DIRECTORY = ".portta";
 var OVERLAY_FILE = "compose.portta.yaml";
 var COMPOSE_FILE = "compose.yaml";
@@ -121605,17 +121686,17 @@ var DEMO_DIRECTORY_PREFIX = "portta-demo-";
 var MANIFEST_FILE = "portta.example.json";
 function demoDirectories(home2) {
   if (!existsSync37(home2)) return [];
-  return readdirSync7(home2, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name.startsWith(DEMO_DIRECTORY_PREFIX)).map((entry) => join57(home2, entry.name)).sort();
+  return readdirSync7(home2, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name.startsWith(DEMO_DIRECTORY_PREFIX)).map((entry) => join58(home2, entry.name)).sort();
 }
 function findDemoStacks(home2) {
   return demoDirectories(home2).map((stackDir) => {
-    if (!existsSync37(join57(stackDir, COMPOSE_FILE))) return null;
-    const localOverlay = join57(PORTTA_DIRECTORY, OVERLAY_FILE);
-    const overlay2 = existsSync37(join57(stackDir, localOverlay)) || existsSync37(join57(stackDir, OVERLAY_FILE));
+    if (!existsSync37(join58(stackDir, COMPOSE_FILE))) return null;
+    const localOverlay = join58(PORTTA_DIRECTORY, OVERLAY_FILE);
+    const overlay2 = existsSync37(join58(stackDir, localOverlay)) || existsSync37(join58(stackDir, OVERLAY_FILE));
     return {
       name: basename20(stackDir),
       dir: stackDir,
-      files: overlay2 ? [COMPOSE_FILE, existsSync37(join57(stackDir, localOverlay)) ? localOverlay : OVERLAY_FILE] : [COMPOSE_FILE],
+      files: overlay2 ? [COMPOSE_FILE, existsSync37(join58(stackDir, localOverlay)) ? localOverlay : OVERLAY_FILE] : [COMPOSE_FILE],
       overlay: overlay2
     };
   }).filter((stack) => stack !== null).sort((left, right) => left.name.localeCompare(right.name));
@@ -121626,10 +121707,10 @@ function demoComposeArgs(stack, action) {
   return ["compose", ...files, "down", "-v"];
 }
 function readDemoProject(stackDir) {
-  const path7 = join57(stackDir, PORTTA_DIRECTORY, MANIFEST_FILE);
+  const path7 = join58(stackDir, PORTTA_DIRECTORY, MANIFEST_FILE);
   if (!existsSync37(path7)) return null;
   try {
-    const manifest = JSON.parse(readFileSync29(path7, "utf8"));
+    const manifest = JSON.parse(readFileSync28(path7, "utf8"));
     const project2 = manifest.project;
     if (typeof project2?.["slug"] !== "string" || typeof project2["name"] !== "string") return null;
     const repositories = (Array.isArray(manifest.repositories) ? manifest.repositories : []).filter((repository) => typeof repository?.["name"] === "string" && typeof repository["relativePath"] === "string").map((repository) => ({
@@ -121794,7 +121875,7 @@ function checkoutLocalEnv() {
   };
 }
 function persistEnv(root2, values) {
-  const path7 = join58(root2, ".env");
+  const path7 = join59(root2, ".env");
   patchEnvFile(path7, values);
 }
 function buildsLocally(command) {
@@ -121810,10 +121891,10 @@ async function compose2(command, args, stdio = "inherit", extra = {}) {
   return runProcess("docker", ["compose", ...composeArguments(context), ...args], { cwd: context.root, env: context.env, stdio, reject: extra.reject });
 }
 function ensureAuthState(root2) {
-  const authDirectory = join58(root2, "state/auth");
-  mkdirSync18(authDirectory, { recursive: true, mode: 448 });
+  const authDirectory = join59(root2, "state/auth");
+  mkdirSync19(authDirectory, { recursive: true, mode: 448 });
   chmodSync9(authDirectory, 448);
-  const path7 = join58(root2, ".env");
+  const path7 = join59(root2, ".env");
   prepareEnvFile(path7);
   syncForwardAuth(root2);
 }
@@ -121865,7 +121946,7 @@ async function versionCommand(command) {
   output2.line(`  panel    ${panel.detail}`);
   if (!compatible) {
     output2.warning(`this CLI is ${cli} and the installation is ${gateway}`);
-    output2.hint("update the installation by re-running the installer, or install the matching CLI: npm i -g portta@" + gateway);
+    output2.hint(`update the installation with portta setup, or install the matching CLI: npm install -g @codions/portta@${gateway}`);
   }
 }
 async function bootstrapCommand(options, command) {
@@ -121876,9 +121957,8 @@ async function bootstrapCommand(options, command) {
   await requireDocker();
   const composeVersion = await runProcess("docker", ["compose", "version", "--short"], { reject: false });
   if (composeVersion.exitCode !== 0) throw new CliError("Docker Compose v2 is required", EXIT.precondition);
-  prepareEnvFile(join58(context.root, ".env"));
-  for (const directory of ["state", "state/auth", "state/ssh", "state/git", "state/github", "state/metrics", "state/environment", "state/logs", "config/tls", "config/traefik/dynamic"]) mkdirSync18(join58(context.root, directory), { recursive: true });
-  chmodSync9(join58(context.root, "state/ssh"), 448);
+  prepareEnvFile(join59(context.root, ".env"));
+  ensureInstallationDirectories(context.root);
   ensureAuthState(context.root);
   const network2 = await ensureNetwork(context.config.network);
   output2.progress(`${network2.padEnd(8)} shared network ${context.config.network}`);
@@ -121887,7 +121967,7 @@ async function bootstrapCommand(options, command) {
 }
 async function upCommand(profile, options, command) {
   if (profile) command.setOptionValueWithSource("profile", profile, "cli");
-  prepareEnvFile(join58(gatewayContext({ profile: profile ?? globals8(command).profile }).root, ".env"));
+  prepareEnvFile(join59(gatewayContext({ profile: profile ?? globals8(command).profile }).root, ".env"));
   if (options.localRelease) selectLocalRelease(gatewayContext({ profile: profile ?? globals8(command).profile }));
   const context = gatewayContext({ profile: profile ?? globals8(command).profile });
   if (options.localRelease) context.env["PORTTA_LOCAL_RELEASE"] = "true";
@@ -121951,7 +122031,7 @@ async function devCommand(profile, options, command) {
     return;
   }
   if (options.demo) requireDemoStacks(command);
-  const needsBootstrap = !existsSync38(join58(existing.root, ".env"));
+  const needsBootstrap = !existsSync38(join59(existing.root, ".env"));
   output2.progress(`dev runs: ${[
     ...options.reset ? ["wipe Portta-managed containers and volumes"] : [],
     ...needsBootstrap ? ["prepare the checkout"] : [],
@@ -121989,10 +122069,10 @@ var REGENERABLE_STATE_DIRS = ["state/git", "state/metrics", "state/environment"]
 function clearRegenerableState(root2) {
   const cleared = [];
   for (const relative6 of REGENERABLE_STATE_DIRS) {
-    const directory = join58(root2, relative6);
+    const directory = join59(root2, relative6);
     if (!existsSync38(directory)) continue;
     for (const entry of readdirSync8(directory, { withFileTypes: true })) {
-      rmSync10(join58(directory, entry.name), { recursive: true, force: true });
+      rmSync10(join59(directory, entry.name), { recursive: true, force: true });
     }
     cleared.push(relative6);
   }
@@ -122071,7 +122151,7 @@ async function logsCommand(service2, options, command) {
   } else await compose2(command, ["logs", ...options.follow === false ? [] : ["--follow"], "--tail", options.tail ?? "200", ...service2 ? [service2] : []]);
 }
 async function updateCommand(command) {
-  prepareEnvFile(join58(gatewayContext({ profile: globals8(command).profile }).root, ".env"));
+  prepareEnvFile(join59(gatewayContext({ profile: globals8(command).profile }).root, ".env"));
   await compose2(command, ["config", "--quiet"]);
   await compose2(command, ["pull", "--ignore-buildable"]);
   await confirm("recreate gateway components with the pulled images?", globals8(command).yes === true);
@@ -122133,7 +122213,7 @@ async function doctorCommand(command) {
     ...entry.fix ? { fix: entry.fix } : {}
   }));
   for (const file2 of context.composeFiles) {
-    checks.push({ id: `compose:${file2}`, status: existsSync38(join58(context.root, file2)) ? "pass" : "fail", message: `${file2} exists` });
+    checks.push({ id: `compose:${file2}`, status: existsSync38(join59(context.root, file2)) ? "pass" : "fail", message: `${file2} exists` });
   }
   const aliases = readAliases(context.root);
   if (aliases.length > 0) {
@@ -122151,10 +122231,10 @@ async function doctorCommand(command) {
   if (failed.length) throw new CliError(`${failed.length} doctor check(s) failed`);
 }
 function readAliases(root2) {
-  const path7 = join58(root2, "config/traefik/dynamic/portta-aliases.yaml");
+  const path7 = join59(root2, "config/traefik/dynamic/portta-aliases.yaml");
   if (!existsSync38(path7)) return [];
   try {
-    return parseAliases(readFileSync30(path7, "utf8"));
+    return parseAliases(readFileSync29(path7, "utf8"));
   } catch {
     return [];
   }
@@ -122183,9 +122263,10 @@ async function urlsCommand(options, command) {
 // src/commands/network.ts
 init_src();
 import { lookup } from "node:dns/promises";
-import { join as join59 } from "node:path";
+import { join as join60 } from "node:path";
 init_context();
 init_errors3();
+init_process();
 function globals9(command) {
   return command.optsWithGlobals();
 }
@@ -122221,7 +122302,7 @@ async function publicStatus(command) {
 }
 async function writeSetting(key, value3, command) {
   const context = gatewayContext({ profile: globals9(command).profile });
-  const path7 = join59(context.root, ".env");
+  const path7 = join60(context.root, ".env");
   patchEnvFile(path7, { [key]: value3 });
 }
 async function publicEnable(command) {
@@ -122307,18 +122388,19 @@ async function dnsSetup(options, command) {
 
 // src/commands/host-service.ts
 init_config2();
-import { chmodSync as chmodSync10, existsSync as existsSync39, mkdirSync as mkdirSync19, readFileSync as readFileSync31, realpathSync as realpathSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync14 } from "node:fs";
+import { chmodSync as chmodSync10, existsSync as existsSync39, mkdirSync as mkdirSync20, readFileSync as readFileSync30, realpathSync as realpathSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync14 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { dirname as dirname29, join as join60 } from "node:path";
+import { dirname as dirname29, join as join61 } from "node:path";
 init_context();
 init_errors3();
+init_process();
 var AUTO_PICKUP_ENV_VARS = ["LINEAR_API_KEY"];
 var RESERVED_ENV_KEYS = /* @__PURE__ */ new Set(["PATH", "PORTTA_ROOT"]);
 function logFile2() {
-  return join60(homedir9(), "Library", "Logs", SERVICE_IDENTITY.logFile);
+  return join61(homedir9(), "Library", "Logs", SERVICE_IDENTITY.logFile);
 }
 function serviceFilePath(platform4, home2 = homedir9()) {
-  return platform4 === "linux" ? join60(home2, ".config", "systemd", "user", `${SERVICE_IDENTITY.name}.service`) : join60(home2, "Library", "LaunchAgents", `${SERVICE_IDENTITY.launchdLabel}.plist`);
+  return platform4 === "linux" ? join61(home2, ".config", "systemd", "user", `${SERVICE_IDENTITY.name}.service`) : join61(home2, "Library", "LaunchAgents", `${SERVICE_IDENTITY.launchdLabel}.plist`);
 }
 function escapePlistText(value3) {
   return value3.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -122388,7 +122470,7 @@ var LAUNCHD_ENV_ENTRY_RE = /<key>([^<]+)<\/key>\s*<string>([^<]*)<\/string>/g;
 function readEnvVarsFromUnit(filePath, platform4) {
   let text;
   try {
-    text = readFileSync31(filePath, "utf8");
+    text = readFileSync30(filePath, "utf8");
   } catch {
     return {};
   }
@@ -122519,7 +122601,7 @@ async function hostService(action, command) {
 ${notes.join("\n")}`);
     await confirm(`${installed ? "Reinstall" : "Install"} the ${SERVICE_IDENTITY.name} service?`, Boolean(options.yes));
     if (installed) await runAll(serviceCommands("uninstall", platform4, filePath), output2, true);
-    mkdirSync19(dirname29(filePath), { recursive: true });
+    mkdirSync20(dirname29(filePath), { recursive: true });
     writeFileSync14(filePath, content);
     if (Object.keys(envVars).length > 0) chmodSync10(filePath, 384);
     await runAll(serviceCommands("install", platform4, filePath), output2);
@@ -122560,7 +122642,8 @@ init_src();
 init_src();
 init_context();
 init_errors3();
-import { join as join61 } from "node:path";
+import { join as join62 } from "node:path";
+init_process();
 function globals10(command) {
   return command.optsWithGlobals();
 }
@@ -122602,7 +122685,7 @@ function setting(name) {
   return found;
 }
 function write2(root2, values) {
-  const path7 = join61(root2, ".env");
+  const path7 = join62(root2, ".env");
   patchEnvFile(path7, values);
 }
 async function configList(command) {
@@ -122812,18 +122895,19 @@ async function configSet(name, value3, options, command) {
 }
 function configPrepare(command) {
   const context = gatewayContext({ profile: globals10(command).profile });
-  prepareEnvFile(join61(context.root, ".env"));
+  prepareEnvFile(join62(context.root, ".env"));
   new Output(globals10(command)).progress("configuration prepared from .env.example; existing values preserved");
 }
 
 // src/commands/setup.ts
 init_src();
 init_context();
-import { chmodSync as chmodSync11, copyFileSync as copyFileSync4, cpSync, existsSync as existsSync40, mkdirSync as mkdirSync20, readdirSync as readdirSync9, realpathSync as realpathSync8, rmSync as rmSync11 } from "node:fs";
+import { chmodSync as chmodSync11, copyFileSync as copyFileSync4, cpSync, existsSync as existsSync40, mkdirSync as mkdirSync21, readdirSync as readdirSync9, realpathSync as realpathSync8, rmSync as rmSync11 } from "node:fs";
 import { homedir as homedir10 } from "node:os";
-import { dirname as dirname30, join as join62, resolve as resolve32 } from "node:path";
+import { dirname as dirname30, join as join63, resolve as resolve32 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 init_errors3();
+init_process();
 function globals11(command) {
   return command.optsWithGlobals();
 }
@@ -122837,14 +122921,14 @@ async function available(file2, args) {
 function packagedRuntime() {
   const explicit = process.env["PORTTA_RUNTIME_ROOT"];
   if (explicit) return resolve32(explicit);
-  const candidates = [join62(import.meta.dirname, "runtime"), join62(import.meta.dirname, "..", "runtime")];
-  const found = candidates.find((candidate) => existsSync40(join62(candidate, "VERSION")));
-  if (!found) throw new PreconditionError("the Portta package does not contain its runtime assets", "reinstall the `portta` npm package");
+  const candidates = [join63(import.meta.dirname, "runtime"), join63(import.meta.dirname, "..", "runtime")];
+  const found = candidates.find((candidate) => existsSync40(join63(candidate, "VERSION")));
+  if (!found) throw new PreconditionError("the Portta package does not contain its runtime assets", "reinstall the `@codions/portta` npm package");
   return found;
 }
 function installRuntime(source, target) {
-  mkdirSync20(target, { recursive: true });
-  const cache2 = join62(target, "runtime");
+  mkdirSync21(target, { recursive: true });
+  const cache2 = join63(target, "runtime");
   const sameCache = existsSync40(cache2) && realpathSync8(source) === realpathSync8(cache2);
   if (!sameCache) {
     rmSync11(cache2, { recursive: true, force: true });
@@ -122852,32 +122936,32 @@ function installRuntime(source, target) {
   }
   for (const entry of readdirSync9(source)) {
     if (entry === "config") continue;
-    const destination = join62(target, entry);
+    const destination = join63(target, entry);
     rmSync11(destination, { recursive: true, force: true });
-    cpSync(join62(source, entry), destination, { recursive: true, force: true });
+    cpSync(join63(source, entry), destination, { recursive: true, force: true });
   }
-  const defaults = join62(source, "config", "traefik", "dynamic");
-  const dynamic = join62(target, "config", "traefik", "dynamic");
-  mkdirSync20(dynamic, { recursive: true });
+  const defaults = join63(source, "config", "traefik", "dynamic");
+  const dynamic = join63(target, "config", "traefik", "dynamic");
+  mkdirSync21(dynamic, { recursive: true });
   for (const entry of readdirSync9(defaults)) {
-    const destination = join62(dynamic, entry);
-    if (!existsSync40(destination)) copyFileSync4(join62(defaults, entry), destination);
+    const destination = join63(dynamic, entry);
+    if (!existsSync40(destination)) copyFileSync4(join63(defaults, entry), destination);
   }
-  const bin = join62(target, "bin");
-  mkdirSync20(bin, { recursive: true });
+  const bin = join63(target, "bin");
+  mkdirSync21(bin, { recursive: true });
   const executable2 = fileURLToPath8(import.meta.url);
-  const installed = join62(bin, "portta");
+  const installed = join63(bin, "portta");
   if (resolve32(executable2) !== resolve32(installed)) copyFileSync4(executable2, installed);
   chmodSync11(installed, 493);
-  const docs2 = join62(import.meta.dirname, "documentation.json");
-  if (existsSync40(docs2)) copyFileSync4(docs2, join62(bin, "documentation.json"));
+  const docs2 = join63(import.meta.dirname, "documentation.json");
+  if (existsSync40(docs2)) copyFileSync4(docs2, join63(bin, "documentation.json"));
 }
 async function setupCommand(options, command) {
   const global3 = globals11(command);
   const output2 = new Output(global3);
   if (process.platform === "win32") throw new PreconditionError("setup requires a POSIX host");
   const currentRoot = findGatewayRoot();
-  const target = resolve32(options.dir ?? currentRoot ?? join62(homedir10(), "portta"));
+  const target = resolve32(options.dir ?? currentRoot ?? join63(homedir10(), "portta"));
   const profile = options.profile ?? global3.profile ?? "local";
   const runtime2 = packagedRuntime();
   const steps = [];
@@ -122886,8 +122970,9 @@ async function setupCommand(options, command) {
     if (!output2.json) output2.progress(`${status.padEnd(8)} ${detail2}`);
   };
   const nodeVersion = process.versions.node;
-  if (major(nodeVersion) < 24) throw new PreconditionError(`Node ${nodeVersion} is too old`, "Node 24 or newer is required for the full CLI");
+  if (major(nodeVersion) < 24) throw new PreconditionError(`Node ${nodeVersion} is too old`, "Node 24 or newer is required");
   record6("node", "ok", `Node ${nodeVersion}`);
+  await requireDocker();
   const docker = await available("docker", ["version", "--format", "{{.Server.Version}}"]);
   if (!docker.ok || major(docker.value) < 24) throw new PreconditionError("Docker Engine 24 or newer is required", "setup never installs Docker or invokes a system package manager");
   const compose4 = await available("docker", ["compose", "version", "--short"]);
@@ -122895,25 +122980,24 @@ async function setupCommand(options, command) {
   record6("docker", "ok", `Docker ${docker.value}, Compose ${compose4.value}`);
   if (options.dryRun) {
     record6("runtime", "planned", `install packaged runtime in ${target}`);
-    record6("environment", "planned", `create .env only if absent in ${target}`);
+    record6("environment", "planned", `prepare .env from .env.example in ${target}, keeping set values`);
     record6("network", "planned", "ensure the shared gateway network");
     record6("gateway", "planned", `pull pinned images and start profile ${profile}`);
     if (output2.json) output2.data({ dryRun: true, target, steps });
     return;
   }
   await confirm(`set up Portta in ${target}?`, global3.yes === true);
-  if (existsSync40(target) && readdirSync9(target).length > 0 && !existsSync40(join62(target, "docker", "compose", "compose.yaml"))) {
+  if (existsSync40(target) && readdirSync9(target).length > 0 && !existsSync40(join63(target, "docker", "compose", "compose.yaml"))) {
     throw new RefusedError(`${target} exists and is not a Portta installation`, "choose an empty --dir; setup never overwrites an unrelated directory");
   }
-  mkdirSync20(dirname30(target), { recursive: true });
-  const updating = existsSync40(join62(target, "VERSION"));
+  mkdirSync21(dirname30(target), { recursive: true });
+  const updating = existsSync40(join63(target, "VERSION"));
   installRuntime(runtime2, target);
   record6("runtime", updating ? "updated" : "created", `${target}`);
-  const envFile = join62(target, ".env");
+  const envFile = join63(target, ".env");
   prepareEnvFile(envFile);
   record6("environment", "updated", "environment prepared from .env.example");
-  for (const directory of ["state", "state/auth", "state/ssh", "state/runner", "state/access", "state/cloudflared", "state/git", "state/metrics", "state/environment", "state/logs", "config/tls", "config/traefik/dynamic"]) mkdirSync20(join62(target, directory), { recursive: true });
-  for (const directory of ["state/auth", "state/ssh", "state/runner", "state/cloudflared"]) chmodSync11(join62(target, directory), 448);
+  ensureInstallationDirectories(target);
   record6("directories", "ok", "gateway state directories");
   const context = gatewayContext({ root: target, profile });
   const network2 = await ensureNetwork(context.config.network);
@@ -122928,13 +123012,21 @@ async function setupCommand(options, command) {
   const running = await runProcess("docker", ["compose", ...composeArguments(context), "ps", "--status", "running", "--quiet"], { cwd: target, env: context.env });
   if (!running.stdout.trim()) throw new PreconditionError("gateway started but no component remained running", `run portta doctor inside ${target}`);
   record6("doctor", "ok", "gateway components are running");
-  if (output2.json) output2.data({ dryRun: false, target, steps });
+  if (output2.json) {
+    output2.data({ dryRun: false, target, steps });
+    return;
+  }
+  output2.progress("");
+  output2.progress(`Portta is installed in ${target}.`);
+  if (resolve32(target) !== resolve32(join63(homedir10(), "portta"))) output2.progress(`Run portta from anywhere with PORTTA_HOME=${target} exported, or from inside that directory.`);
+  output2.progress(`The panel is off by default: portta web up starts it on http://127.0.0.1:${context.config.webPort}`);
+  output2.progress("portta doctor checks the installation.");
 }
 
 // src/commands/auth.ts
 init_context();
 init_errors3();
-import { readFileSync as readFileSync32 } from "node:fs";
+import { readFileSync as readFileSync31 } from "node:fs";
 function globals12(command) {
   return command.optsWithGlobals();
 }
@@ -122949,7 +123041,7 @@ function panelUrlFor2(command) {
 }
 async function authBootstrap(options, command) {
   if (!options.name || !options.email) throw new UsageError("--name and --email are required");
-  const password = options.passwordStdin ? readFileSync32(0, "utf8").trim() : "";
+  const password = options.passwordStdin ? readFileSync31(0, "utf8").trim() : "";
   if (!password) throw new UsageError("the password is read from stdin", 'printf %s "$PASSWORD" | portta auth bootstrap --name \u2026 --email \u2026 --password-stdin');
   if (password.length < 10) throw new UsageError("the password must be at least 10 characters");
   const { client, output: output2 } = clientFor(command, { actor: void 0, actorKind: "human" });
@@ -122982,7 +123074,7 @@ async function authLogin(options, command) {
 }
 async function readSecret() {
   if (!process.stdin.isTTY) {
-    const piped = readFileSync32(0, "utf8").trim();
+    const piped = readFileSync31(0, "utf8").trim();
     if (piped) return piped;
     throw new UsageError("no token on stdin", "pass --token, or run this in a terminal");
   }
@@ -123121,23 +123213,23 @@ init_src();
 init_context();
 init_errors3();
 import { randomBytes as randomBytes8 } from "node:crypto";
-import { chmodSync as chmodSync12, mkdirSync as mkdirSync21, readFileSync as readFileSync33 } from "node:fs";
-import { dirname as dirname31, join as join63 } from "node:path";
+import { chmodSync as chmodSync12, mkdirSync as mkdirSync22, readFileSync as readFileSync32 } from "node:fs";
+import { dirname as dirname31, join as join64 } from "node:path";
 function globals13(command) {
   return command.optsWithGlobals();
 }
 function paths(command) {
   const root2 = gatewayContext({ profile: globals13(command).profile }).root;
   return {
-    store: join63(root2, "state/auth/protections.json"),
-    dynamic: join63(root2, "config/traefik/dynamic/portta-auth.yaml")
+    store: join64(root2, "state/auth/protections.json"),
+    dynamic: join64(root2, "config/traefik/dynamic/portta-auth.yaml")
   };
 }
 function save(command, store) {
   const target = paths(command);
-  mkdirSync21(dirname31(target.store), { recursive: true, mode: 448 });
+  mkdirSync22(dirname31(target.store), { recursive: true, mode: 448 });
   chmodSync12(dirname31(target.store), 448);
-  mkdirSync21(dirname31(target.dynamic), { recursive: true });
+  mkdirSync22(dirname31(target.dynamic), { recursive: true });
   writeProtectionStore(target.store, store);
   writeEnvFile(target.dynamic, renderAuthDynamic(store));
 }
@@ -123153,7 +123245,7 @@ async function protectHost(hostInput, options, command) {
   const entryPoint = options.entrypoint ?? (gatewayContext({ profile: globals13(command).profile }).config.tlsEnabled ? "websecure" : "web");
   if (!/^[A-Za-z0-9_-]+$/.test(entryPoint)) throw new UsageError(`invalid entrypoint: ${entryPoint}`);
   const generated = options.passwordStdin !== true;
-  const password = generated ? randomBytes8(20).toString("base64url").slice(0, 20).match(/.{1,5}/g).join("-") : readFileSync33(0, "utf8").trim();
+  const password = generated ? randomBytes8(20).toString("base64url").slice(0, 20).match(/.{1,5}/g).join("-") : readFileSync32(0, "utf8").trim();
   if (!password) throw new UsageError("no password on stdin");
   const target = paths(command);
   const existing = readProtectionStore(target.store);
@@ -123206,11 +123298,12 @@ async function protectStatus(hostInput, command) {
 init_src();
 init_errors3();
 init_context();
-import { readFileSync as readFileSync34 } from "node:fs";
+import { readFileSync as readFileSync33 } from "node:fs";
 import { randomBytes as randomBytes9 } from "node:crypto";
+init_process();
 function passwordFrom(options) {
   if (options.passwordStdin) {
-    const password2 = readFileSync34(0, "utf8").trim();
+    const password2 = readFileSync33(0, "utf8").trim();
     if (!password2) throw new UsageError("no password on stdin");
     if (password2.length < 10) throw new UsageError("the password must be at least 10 characters");
     return { password: password2, generated: false };
@@ -123338,13 +123431,13 @@ init_zod();
 init_context();
 init_errors3();
 import { existsSync as existsSync41 } from "node:fs";
-import { join as join64 } from "node:path";
+import { join as join65 } from "node:path";
 var Share2 = external_exports.object({ id: external_exports.string(), mode: external_exports.enum(["public", "protected"]), host: external_exports.string(), entryPoint: external_exports.string(), container: external_exports.string(), port: external_exports.number(), expiresAt: external_exports.number(), user: external_exports.string().nullable().optional() }).passthrough();
 function globals14(command) {
   return command.optsWithGlobals();
 }
 function path6(command) {
-  return join64(gatewayContext({ profile: globals14(command).profile }).root, "config/traefik/dynamic/portta-shares.yaml");
+  return join65(gatewayContext({ profile: globals14(command).profile }).root, "config/traefik/dynamic/portta-shares.yaml");
 }
 function root(command) {
   return gatewayContext({ profile: globals14(command).profile }).root;
@@ -123360,11 +123453,11 @@ function write3(command, shares) {
 }
 function removeScopes(command, scopes) {
   const gateway = root(command);
-  const storePath = join64(gateway, "state/auth/protections.json");
+  const storePath = join65(gateway, "state/auth/protections.json");
   const store = readProtectionStore(storePath);
   const next = { ...store, protections: store.protections.filter((protection) => !scopes.has(protection.scope)) };
   writeProtectionStore(storePath, next);
-  writeEnvFile(join64(gateway, "config/traefik/dynamic/portta-auth.yaml"), renderAuthDynamic(next));
+  writeEnvFile(join65(gateway, "config/traefik/dynamic/portta-auth.yaml"), renderAuthDynamic(next));
 }
 async function shareList(command) {
   const shares = read(command);
@@ -123395,14 +123488,16 @@ async function shareGc(command) {
 // src/commands/tls.ts
 init_src();
 init_context();
-import { chmodSync as chmodSync13, existsSync as existsSync42, mkdirSync as mkdirSync22, writeFileSync as writeFileSync15 } from "node:fs";
+import { chmodSync as chmodSync13, existsSync as existsSync42, mkdirSync as mkdirSync23, writeFileSync as writeFileSync15 } from "node:fs";
 import { platform as platform3 } from "node:os";
-import { join as join65 } from "node:path";
+import { join as join66 } from "node:path";
 init_errors3();
+init_process();
 
 // src/toolbox.ts
 init_errors3();
 init_src();
+init_process();
 init_context();
 async function toolboxExists(image) {
   return !(await runProcess("docker", ["image", "inspect", image], { reject: false })).failed;
@@ -123432,14 +123527,14 @@ function globals15(command) {
   return command.optsWithGlobals();
 }
 function tlsPaths(root2) {
-  const directory = join65(root2, "config/tls");
+  const directory = join66(root2, "config/tls");
   return {
     directory,
-    caKey: join65(directory, "portta-ca.key"),
-    caCertificate: join65(directory, "portta-ca.crt"),
-    leafKey: join65(directory, "wildcard.key"),
-    leafCertificate: join65(directory, "wildcard.crt"),
-    dynamic: join65(root2, "config/traefik/dynamic/local-tls.yaml")
+    caKey: join66(directory, "portta-ca.key"),
+    caCertificate: join66(directory, "portta-ca.crt"),
+    leafKey: join66(directory, "wildcard.key"),
+    leafCertificate: join66(directory, "wildcard.crt"),
+    dynamic: join66(root2, "config/traefik/dynamic/local-tls.yaml")
   };
 }
 function localTlsDynamic() {
@@ -123516,7 +123611,7 @@ async function tlsInit(command) {
   await requireDocker();
   const paths3 = tlsPaths(context.root);
   const domain2 = context.config.domain;
-  mkdirSync22(paths3.directory, { recursive: true });
+  mkdirSync23(paths3.directory, { recursive: true });
   chmodSync13(paths3.directory, 448);
   if (existsSync42(paths3.caKey)) {
     output2.progress("reusing the existing local CA");
@@ -123547,7 +123642,7 @@ async function tlsInit(command) {
   }
   output2.progress(`issued ${paths3.leafCertificate} for *.${domain2}`);
   writeFileSync15(paths3.dynamic, localTlsDynamic());
-  const envPath = join65(context.root, ".env");
+  const envPath = join66(context.root, ".env");
   patchEnvFile(envPath, { TLS_ENABLED: "true", TLS_MODE: "local" });
   output2.progress("TLS enabled in .env");
   output2.line("");
@@ -123596,22 +123691,23 @@ async function tlsUntrust(command) {
   output2.line(`To delete the key material as well: rm -rf ${paths2(context.root)}`);
 }
 function paths2(root2) {
-  return join65(root2, "config/tls");
+  return join66(root2, "config/tls");
 }
 
 // src/commands/maintenance.ts
 init_src();
 init_context();
 init_errors3();
-import { chmodSync as chmodSync14, copyFileSync as copyFileSync5, cpSync as cpSync2, existsSync as existsSync43, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync3, readFileSync as readFileSync35, rmSync as rmSync12, statSync as statSync12, writeFileSync as writeFileSync16 } from "node:fs";
+import { chmodSync as chmodSync14, copyFileSync as copyFileSync5, cpSync as cpSync2, existsSync as existsSync43, mkdirSync as mkdirSync24, mkdtempSync as mkdtempSync3, readFileSync as readFileSync34, rmSync as rmSync12, statSync as statSync12, writeFileSync as writeFileSync16 } from "node:fs";
 import { hostname as hostname3, tmpdir as tmpdir5 } from "node:os";
-import { dirname as dirname32, join as join66 } from "node:path";
+import { dirname as dirname32, join as join67 } from "node:path";
+init_process();
 function globals16(command) {
   return command.optsWithGlobals();
 }
 var BACKUP_VERSION = 1;
 function backupPaths(root2) {
-  return [".env", "VERSION", "config", "state"].filter((path7) => existsSync43(join66(root2, path7)));
+  return [".env", "VERSION", "config", "state"].filter((path7) => existsSync43(join67(root2, path7)));
 }
 function renderManifest(manifest) {
   return `${JSON.stringify(manifest)}
@@ -123646,11 +123742,11 @@ async function backupCommand(options, command) {
   const output2 = new Output(global3);
   const context = gatewayContext({ profile: global3.profile });
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
-  const target = options.output ?? join66(context.root, `portta-backup-${stamp}.tar.gz`);
-  const staging = mkdtempSync3(join66(tmpdir5(), "portta-backup-"));
+  const target = options.output ?? join67(context.root, `portta-backup-${stamp}.tar.gz`);
+  const staging = mkdtempSync3(join67(tmpdir5(), "portta-backup-"));
   chmodSync14(staging, 448);
   try {
-    writeFileSync16(join66(staging, "portta-backup.json"), renderManifest({
+    writeFileSync16(join67(staging, "portta-backup.json"), renderManifest({
       version: BACKUP_VERSION,
       portta: context.version,
       created: (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d+Z$/, "Z"),
@@ -123658,12 +123754,12 @@ async function backupCommand(options, command) {
     }));
     const paths3 = backupPaths(context.root);
     for (const path7 of paths3) {
-      mkdirSync23(join66(staging, "tree", dirname32(path7)), { recursive: true });
-      cpSync2(join66(context.root, path7), join66(staging, "tree", path7), { recursive: true });
+      mkdirSync24(join67(staging, "tree", dirname32(path7)), { recursive: true });
+      cpSync2(join67(context.root, path7), join67(staging, "tree", path7), { recursive: true });
     }
     let database = false;
     if (options.database !== false) {
-      database = await dumpDatabase(context, join66(staging, "panel.db"));
+      database = await dumpDatabase(context, join67(staging, "panel.db"));
       if (!database) {
         output2.warning("the panel database was not included");
         output2.hint("it exists once the panel has started, and copying it needs sqlite3 on this host; --no-database silences this");
@@ -123708,14 +123804,14 @@ async function restoreCommand(archive, options, command) {
   const context = gatewayContext({ profile: global3.profile });
   if (!archive) throw new UsageError("which backup?", "portta restore <file>");
   if (!existsSync43(archive)) throw new UsageError(`no such file: ${archive}`);
-  const staging = mkdtempSync3(join66(tmpdir5(), "portta-restore-"));
+  const staging = mkdtempSync3(join67(tmpdir5(), "portta-restore-"));
   chmodSync14(staging, 448);
   try {
     const extracted = await runProcess("tar", ["-xzf", archive, "-C", staging], { reject: false });
     if (extracted.failed) throw new UsageError("that file is not a Portta backup");
-    const manifestPath2 = join66(staging, "portta-backup.json");
+    const manifestPath2 = join67(staging, "portta-backup.json");
     if (!existsSync43(manifestPath2)) throw new UsageError("that archive has no Portta manifest");
-    const manifest = parseManifest(readFileSync35(manifestPath2, "utf8"));
+    const manifest = parseManifest(readFileSync34(manifestPath2, "utf8"));
     if (!manifest) throw new UsageError("that archive has an unreadable Portta manifest");
     output2.progress(`restoring a backup taken from Portta ${manifest.portta}`);
     if (!options.force && await containerRunning(`${context.env["PORTTA_PROJECT_NAME"] || "portta"}-traefik-1`)) {
@@ -123725,23 +123821,23 @@ async function restoreCommand(archive, options, command) {
       );
     }
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
-    const safety = join66(context.root, "state", `restore-${stamp}`);
-    mkdirSync23(safety, { recursive: true });
+    const safety = join67(context.root, "state", `restore-${stamp}`);
+    mkdirSync24(safety, { recursive: true });
     for (const path7 of [".env", "config"]) {
-      if (existsSync43(join66(context.root, path7))) {
-        cpSync2(join66(context.root, path7), join66(safety, path7), { recursive: true });
+      if (existsSync43(join67(context.root, path7))) {
+        cpSync2(join67(context.root, path7), join67(safety, path7), { recursive: true });
       }
     }
     output2.progress(`kept what was there under ${safety}`);
-    const tree = join66(staging, "tree");
+    const tree = join67(staging, "tree");
     if (existsSync43(tree)) {
       for (const path7 of backupPaths(tree)) {
-        cpSync2(join66(tree, path7), join66(context.root, path7), { recursive: true, force: true });
+        cpSync2(join67(tree, path7), join67(context.root, path7), { recursive: true, force: true });
       }
       output2.progress("configuration and state restored");
     }
-    if (existsSync43(join66(context.root, ".env"))) chmodSync14(join66(context.root, ".env"), 384);
-    const dump = join66(staging, "panel.db");
+    if (existsSync43(join67(context.root, ".env"))) chmodSync14(join67(context.root, ".env"), 384);
+    const dump = join67(staging, "panel.db");
     if (existsSync43(dump)) {
       const panelUp = await containerRunning(`${context.env["PORTTA_PROJECT_NAME"] || "portta"}-web-1`);
       const target = databaseFileFor(context.root);
@@ -123749,7 +123845,7 @@ async function restoreCommand(archive, options, command) {
         output2.warning("the panel is running, so its database was not replaced");
         output2.hint(`portta web down   then: portta restore ${archive} --force`);
       } else {
-        mkdirSync23(dirname32(target), { recursive: true });
+        mkdirSync24(dirname32(target), { recursive: true });
         for (const file2 of databaseFiles(target)) rmSync12(file2, { force: true });
         copyFileSync5(dump, target);
         chmodSync14(target, 384);
@@ -123763,21 +123859,6 @@ async function restoreCommand(archive, options, command) {
     rmSync12(staging, { recursive: true, force: true });
   }
 }
-var REPAIR_DIRECTORIES = [
-  { path: "config/traefik/dynamic", mode: 493 },
-  { path: "config/tls", mode: 493 },
-  { path: "state/traefik/acme", mode: 448 },
-  { path: "state/tailscale", mode: 493 },
-  { path: "state/access", mode: 493 },
-  { path: "state/git", mode: 493 },
-  { path: "state/github", mode: 493 },
-  { path: "state/ssh", mode: 448 },
-  { path: "state/metrics", mode: 493 },
-  { path: "state/environment", mode: 493 },
-  { path: "state/logs", mode: 493 },
-  { path: "state/runner", mode: 448 },
-  { path: "state/cloudflared", mode: 448 }
-];
 var REPAIR_MODES = [
   { path: ".env", mode: 384 },
   { path: "state/traefik/acme", mode: 448 },
@@ -123785,7 +123866,8 @@ var REPAIR_MODES = [
   { path: "state/cloudflared", mode: 448 },
   { path: "state/cloudflared/credentials.json", mode: 384 },
   { path: "state/runner", mode: 448 },
-  { path: "state/ssh", mode: 448 }
+  { path: "state/ssh", mode: 448 },
+  { path: "state/auth", mode: 448 }
 ];
 async function repairCommand2(options, command) {
   const global3 = globals16(command);
@@ -123794,20 +123876,20 @@ async function repairCommand2(options, command) {
   const dry = options.dryRun ?? false;
   const changes = [];
   output2.progress("Repair");
-  for (const { path: path7, mode } of REPAIR_DIRECTORIES) {
-    const full = join66(context.root, path7);
+  for (const { path: path7, mode } of INSTALLATION_DIRECTORIES) {
+    const full = join67(context.root, path7);
     if (existsSync43(full)) continue;
     changes.push(`create ${path7}`);
     if (dry) {
       output2.line(`   would create ${path7}`);
       continue;
     }
-    mkdirSync23(full, { recursive: true });
+    mkdirSync24(full, { recursive: true });
     chmodSync14(full, mode);
     output2.progress(`created ${path7}`);
   }
   for (const { path: path7, mode } of REPAIR_MODES) {
-    const full = join66(context.root, path7);
+    const full = join67(context.root, path7);
     if (!existsSync43(full)) continue;
     const have = fileMode(full);
     const want = mode.toString(8);
@@ -128790,7 +128872,8 @@ async function activityCommand(options, command) {
 // src/commands/build.ts
 init_src();
 init_context();
-import { join as join67 } from "node:path";
+import { join as join68 } from "node:path";
+init_process();
 function globals18(command) {
   return command.optsWithGlobals();
 }
@@ -128803,11 +128886,11 @@ function localReleaseBuilds(root2, version3) {
     },
     {
       image: images.apply,
-      args: ["build", "--build-arg", `PORTTA_VERSION=${version3}`, "-t", images.apply, join67(root2, "docker", "images", "apply")]
+      args: ["build", "--build-arg", `PORTTA_VERSION=${version3}`, "-t", images.apply, join68(root2, "docker", "images", "apply")]
     },
     {
       image: images.toolbox,
-      args: ["build", "--build-arg", `PORTTA_VERSION=${version3}`, "-t", images.toolbox, join67(root2, "docker", "images", "toolbox")]
+      args: ["build", "--build-arg", `PORTTA_VERSION=${version3}`, "-t", images.toolbox, join68(root2, "docker", "images", "toolbox")]
     }
   ];
 }
@@ -128827,12 +128910,13 @@ async function buildCommand(command) {
 
 // src/commands/remote.ts
 init_src();
-import { existsSync as existsSync44, mkdirSync as mkdirSync24, readFileSync as readFileSync36, readdirSync as readdirSync10, rmSync as rmSync13, writeFileSync as writeFileSync17 } from "node:fs";
-import { basename as basename21, join as join68 } from "node:path";
+import { existsSync as existsSync44, mkdirSync as mkdirSync25, readFileSync as readFileSync35, readdirSync as readdirSync10, rmSync as rmSync13, writeFileSync as writeFileSync17 } from "node:fs";
+import { basename as basename21, join as join69 } from "node:path";
 import { createServer as createServer3 } from "node:net";
 import { randomBytes as randomBytes10 } from "node:crypto";
 init_context();
 init_errors3();
+init_process();
 function globals19(command) {
   return command.optsWithGlobals();
 }
@@ -129005,7 +129089,7 @@ async function remoteBootstrap(target, options, command) {
   output2.progress("    ./bin/portta network status     confirm what is exposed");
 }
 function tunnelStateDir(root2) {
-  return join68(root2, "state/access/tunnels");
+  return join69(root2, "state/access/tunnels");
 }
 function parseTunnelRecord(id, text) {
   try {
@@ -129036,9 +129120,9 @@ function readTunnels(root2) {
   if (!existsSync44(directory)) return [];
   const records = [];
   for (const name of readdirSync10(directory).filter((entry) => entry.endsWith(".json"))) {
-    const path7 = join68(directory, name);
+    const path7 = join69(directory, name);
     try {
-      const record6 = parseTunnelRecord(basename21(name, ".json"), readFileSync36(path7, "utf8"));
+      const record6 = parseTunnelRecord(basename21(name, ".json"), readFileSync35(path7, "utf8"));
       if (record6) records.push(record6);
     } catch {
     }
@@ -129090,7 +129174,7 @@ async function remoteAccessOpen(target, options, command) {
   const localPort = options.localPort ? Number(options.localPort) : await freeLocalPort();
   output2.progress("Opening the tunnel");
   const directoryPath = tunnelStateDir(context.root);
-  mkdirSync24(directoryPath, { recursive: true });
+  mkdirSync25(directoryPath, { recursive: true });
   const id = randomBytes10(3).toString("hex");
   const pid = spawnDetached("ssh", sshArguments(target, context.env, [
     "-o",
@@ -129107,7 +129191,7 @@ async function remoteAccessOpen(target, options, command) {
     throw new PreconditionError("the SSH tunnel exited immediately", `check that ${target} is reachable and that ${localPort} is free locally`);
   }
   const record6 = { id, pid, target, project: options.project, service: options.service, remotePort, localPort, started: Math.floor(Date.now() / 1e3) };
-  writeFileSync17(join68(directoryPath, `${id}.json`), renderTunnelRecord(record6));
+  writeFileSync17(join69(directoryPath, `${id}.json`), renderTunnelRecord(record6));
   if (output2.json) {
     output2.data({ ...record6, address: `127.0.0.1:${localPort}` });
     return;
@@ -129160,7 +129244,7 @@ async function remoteAccessClose(id, options, command) {
       } catch {
       }
     }
-    rmSync13(join68(directory, `${record6.id}.json`), { force: true });
+    rmSync13(join69(directory, `${record6.id}.json`), { force: true });
     output2.progress(`the bridge on ${record6.target} is still open; close it there if you are done:`);
     output2.hint(`portta remote exec ${record6.target} -- 'cd portta && ./bin/portta access close --project ${record6.project}'`);
   }
@@ -129172,15 +129256,16 @@ init_src();
 init_src();
 init_context();
 init_errors3();
-import { chmodSync as chmodSync15, closeSync as closeSync3, existsSync as existsSync45, mkdirSync as mkdirSync25, openSync as openSync3, readFileSync as readFileSync37, rmSync as rmSync14, writeFileSync as writeFileSync18 } from "node:fs";
+import { chmodSync as chmodSync15, closeSync as closeSync3, existsSync as existsSync45, mkdirSync as mkdirSync26, openSync as openSync3, readFileSync as readFileSync36, rmSync as rmSync14, writeFileSync as writeFileSync18 } from "node:fs";
 import { ReadStream } from "node:tty";
-import { join as join69 } from "node:path";
+import { join as join70 } from "node:path";
+init_process();
 function globals20(command) {
   return command.optsWithGlobals();
 }
 function tunnelPaths(root2) {
-  const directory = join69(root2, "state/cloudflared");
-  return { directory, config: join69(directory, "config.yml"), credentials: join69(directory, "credentials.json") };
+  const directory = join70(root2, "state/cloudflared");
+  return { directory, config: join70(directory, "config.yml"), credentials: join70(directory, "credentials.json") };
 }
 function tunnelContainer(env) {
   return `${env["PORTTA_PROJECT_NAME"] || "portta"}-cloudflared-1`;
@@ -129315,13 +129400,13 @@ async function tunnelSetup(options, command) {
   let token;
   if (options.tokenFile) {
     if (!existsSync45(options.tokenFile)) throw new UsageError(`no such file: ${options.tokenFile}`);
-    token = readFileSync37(options.tokenFile, "utf8").replace(/\s+/g, "");
+    token = readFileSync36(options.tokenFile, "utf8").replace(/\s+/g, "");
   } else {
     token = await promptForToken();
   }
   if (!token) throw new UsageError("no token was given");
   const paths3 = tunnelPaths(context.root);
-  mkdirSync25(paths3.directory, { recursive: true });
+  mkdirSync26(paths3.directory, { recursive: true });
   chmodSync15(paths3.directory, 448);
   let credentials;
   try {
@@ -129337,7 +129422,7 @@ async function tunnelSetup(options, command) {
   const origin = options.origin || defaultOrigin(context);
   const config3 = { id: credentials.TunnelID, zone: options.zone, origin, credentialsFile: "/etc/cloudflared/credentials.json", includeApex: options.apex ?? false };
   writeFileSync18(paths3.config, renderTunnelConfig(config3));
-  const envPath = join69(context.root, ".env");
+  const envPath = join70(context.root, ".env");
   patchEnvFile(envPath, { CLOUDFLARE_TUNNEL_ZONE: options.zone, CLOUDFLARE_TUNNEL_ID: credentials.TunnelID });
   if (output2.json) {
     output2.data({ zone: options.zone, tunnel: credentials.TunnelID, origin, routes: describeTunnel(config3), dns: { type: "CNAME", name: `*.${options.zone}`, target: tunnelDnsTarget(credentials.TunnelID), proxied: true } });
@@ -129366,7 +129451,7 @@ async function tunnelEnable(command) {
   if (!tunnelConfigured(context.root)) {
     throw new PreconditionError("the connector is not configured", "portta tunnel setup --zone <domain>");
   }
-  const envPath = join69(context.root, ".env");
+  const envPath = join70(context.root, ".env");
   patchEnvFile(envPath, { CLOUDFLARE_TUNNEL_ENABLED: "true" });
   output2.progress("Cloudflare Tunnel enabled");
   output2.progress("starting the connector");
@@ -129389,7 +129474,7 @@ async function tunnelDisable(options, command) {
     ["compose", ...composeArguments(running), "rm", "-sf", "cloudflared"],
     { cwd: running.root, env: running.env, reject: false }
   );
-  const envPath = join69(running.root, ".env");
+  const envPath = join70(running.root, ".env");
   const values = { CLOUDFLARE_TUNNEL_ENABLED: "false" };
   if (options.forget) {
     const paths3 = tunnelPaths(running.root);