@dotobokuri/fleet-console 1.5.5 → 1.6.0

package/dist/cli-bin.mjs

@@ -4,14 +4,14 @@ import * as fs5 from 'fs';
 import fs5__default, { readFileSync, existsSync, mkdtempSync, writeFileSync, mkdirSync, rmSync, chmodSync, renameSync, readdirSync, constants, openSync, closeSync, lstatSync, unlinkSync, realpathSync, statSync, symlinkSync, fstatSync } from 'fs';
 import * as path93 from 'path';
 import path93__default, { join, resolve, relative, dirname } from 'path';
-import process4 from 'process';
+import process5 from 'process';
 import { fileURLToPath, pathToFileURL } from 'url';
 import * as os22 from 'os';
 import os22__default from 'os';
 import { EventEmitter } from 'events';
 import { stat, mkdir, readFile, readdir, appendFile, writeFile, rename, access, rm } from 'fs/promises';
 import { Writable, Readable } from 'stream';
-import crypto3, { createHash, randomUUID, timingSafeEqual } from 'crypto';
+import crypto5, { createHash, randomUUID, timingSafeEqual } from 'crypto';
 import http from 'http';
 import { createRequire } from 'module';
 import net2 from 'net';
@@ -969,10 +969,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path30) {
-  if (!path30)
+function getElementAtPath(obj, path34) {
+  if (!path34)
     return obj;
-  return path30.reduce((acc, key) => acc?.[key], obj);
+  return path34.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1381,11 +1381,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path30, issues) {
+function prefixIssues(path34, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path30);
+    iss.path.unshift(path34);
     return iss;
   });
 }
@@ -1532,16 +1532,16 @@ function flattenError(error51, mapper = (issue3) => issue3.message) {
 }
 function formatError(error51, mapper = (issue3) => issue3.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path30 = []) => {
+  const processError = (error52, path34 = []) => {
     for (const issue3 of error52.issues) {
       if (issue3.code === "invalid_union" && issue3.errors.length) {
-        issue3.errors.map((issues) => processError({ issues }, [...path30, ...issue3.path]));
+        issue3.errors.map((issues) => processError({ issues }, [...path34, ...issue3.path]));
       } else if (issue3.code === "invalid_key") {
-        processError({ issues: issue3.issues }, [...path30, ...issue3.path]);
+        processError({ issues: issue3.issues }, [...path34, ...issue3.path]);
       } else if (issue3.code === "invalid_element") {
-        processError({ issues: issue3.issues }, [...path30, ...issue3.path]);
+        processError({ issues: issue3.issues }, [...path34, ...issue3.path]);
       } else {
-        const fullpath = [...path30, ...issue3.path];
+        const fullpath = [...path34, ...issue3.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue3));
         } else {
@@ -1568,17 +1568,17 @@ function formatError(error51, mapper = (issue3) => issue3.message) {
 }
 function treeifyError(error51, mapper = (issue3) => issue3.message) {
   const result = { errors: [] };
-  const processError = (error52, path30 = []) => {
+  const processError = (error52, path34 = []) => {
     var _a3, _b;
     for (const issue3 of error52.issues) {
       if (issue3.code === "invalid_union" && issue3.errors.length) {
-        issue3.errors.map((issues) => processError({ issues }, [...path30, ...issue3.path]));
+        issue3.errors.map((issues) => processError({ issues }, [...path34, ...issue3.path]));
       } else if (issue3.code === "invalid_key") {
-        processError({ issues: issue3.issues }, [...path30, ...issue3.path]);
+        processError({ issues: issue3.issues }, [...path34, ...issue3.path]);
       } else if (issue3.code === "invalid_element") {
-        processError({ issues: issue3.issues }, [...path30, ...issue3.path]);
+        processError({ issues: issue3.issues }, [...path34, ...issue3.path]);
       } else {
-        const fullpath = [...path30, ...issue3.path];
+        const fullpath = [...path34, ...issue3.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue3));
           continue;
@@ -1610,8 +1610,8 @@ function treeifyError(error51, mapper = (issue3) => issue3.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path30 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path30) {
+  const path34 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path34) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -14275,13 +14275,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path30 = ref.slice(1).split("/").filter(Boolean);
-  if (path30.length === 0) {
+  const path34 = ref.slice(1).split("/").filter(Boolean);
+  if (path34.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path30[0] === defsKey) {
-    const key = path30[1];
+  if (path34[0] === defsKey) {
+    const key = path34[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -17913,7 +17913,7 @@ function inferBinName(packageName) {
 // ../../packages/core-unified-agent/models.json
 var models_default = {
   version: 1,
-  updatedAt: "2026-06-13T00:00:00Z",
+  updatedAt: "2026-06-16T00:00:00Z",
   providers: {
     claude: {
       name: "Claude Code with Anthropic",
@@ -17923,7 +17923,9 @@ var models_default = {
         { modelId: "sonnet", name: "Claude Sonnet", effort: { supported: true, levels: ["low", "medium", "high", "xhigh", "max"], default: "medium" } },
         { modelId: "opus", name: "Claude Opus", effort: { supported: true, levels: ["low", "medium", "high", "xhigh", "max"], default: "xhigh" } },
         { modelId: "opus[1m]", name: "Claude Opus [1M]", effort: { supported: true, levels: ["low", "medium", "high", "xhigh", "max"], default: "xhigh" } },
-        { modelId: "claude-opus-4-6[1m]", name: "Claude Opus 4.6 [1M]", effort: { supported: true, levels: ["low", "medium", "high", "xhigh", "max"], default: "high" } }
+        { modelId: "claude-opus-4-6[1m]", name: "Claude Opus 4.6 [1M]", effort: { supported: true, levels: ["low", "medium", "high", "xhigh", "max"], default: "high" } },
+        { modelId: "claude-opus-4-7[1m]", name: "Claude Opus 4.7 [1M]", effort: { supported: true, levels: ["low", "medium", "high", "xhigh", "max"], default: "high" } },
+        { modelId: "claude-opus-4-8[1m]", name: "Claude Opus 4.8 [1M]", effort: { supported: true, levels: ["low", "medium", "high", "xhigh", "max"], default: "high" } }
       ]
     },
     "claude-zai": {
@@ -21074,7 +21076,7 @@ function specToMcpTool(spec) {
 }
 function installExecutorToolCallRouter(runtime, sessionToken, ctx) {
   runtime.server.setOnToolCallArrived(sessionToken, (toolName, args) => {
-    const toolCallId = crypto3.randomUUID();
+    const toolCallId = crypto5.randomUUID();
     void runtime.registry.invoke(toolName, args, { cwd: ctx.cwd, sessionLabel: ctx.sessionLabel, toolCallId, signal: ctx.signal }).then((result) => runtime.server.resolveNextToolCall(sessionToken, toolCallId, result)).catch((err) => {
       runtime.server.resolveNextToolCall(sessionToken, toolCallId, {
         content: [{ type: "text", text: err instanceof Error ? err.message : String(err) }],
@@ -21465,7 +21467,7 @@ function createInProcessMcpServer(deps = {}) {
       if (activeStopPromise) await activeStopPromise;
       if (activeServer && activeServerUrl) return activeServerUrl;
       if (activeStartPromise) return activeStartPromise;
-      activeOpaquePath = `/${crypto3.randomUUID()}`;
+      activeOpaquePath = `/${crypto5.randomUUID()}`;
       activeStartPromise = new Promise((resolve, reject) => {
         const srv = http.createServer(handleRequest);
         srv.timeout = MCP_SERVER_TIMEOUT_MS;
@@ -21722,7 +21724,7 @@ function createExecutorMcpSession(deps, toolTimeoutSeconds, request) {
     throw new Error("Executor session cwd is required");
   }
   assertNonEmptyExecutorTools(request.serverName, request.specs);
-  const token = crypto3.randomUUID();
+  const token = crypto5.randomUUID();
   registerExecutorSessionTools(runtime.runtime, token, [...request.specs]);
   installExecutorToolCallRouter(runtime.runtime, token, {
     cwd,
@@ -21768,7 +21770,7 @@ function issueSessionToken(deps, sessionTokensByLabel, request) {
     for (const { name, runtime } of deps.runtimes) {
       const tools = runtime.registry.getAllAgentTools();
       assertNonEmptyExecutorTools(name, tools);
-      const token = crypto3.randomUUID();
+      const token = crypto5.randomUUID();
       registerExecutorSessionTools(runtime, token, tools);
       installExecutorToolCallRouter(runtime, token, { cwd, sessionLabel: label, signal: request.signal });
       tokens.push({ name, token });
@@ -23134,7 +23136,8 @@ function sleepSync(ms) {
 var DEFAULT_TEMP_FILE_MIN_AGE_MS = 6e4;
 function createDurableJsonStore(deps) {
   const now = deps.now ?? (() => Date.now());
-  const mode = SECURE_FILE_MODE ;
+  const sensitivity = deps.sensitivity;
+  const mode = sensitivity === "sensitive" ? SECURE_FILE_MODE : 420;
   const minAgeMs = deps.tempCleanupMinAgeMs ?? DEFAULT_TEMP_FILE_MIN_AGE_MS;
   const dir = path93.dirname(deps.filePath);
   return {
@@ -23162,10 +23165,10 @@ function createDurableJsonStore(deps) {
   };
   function withLock(operation) {
     if (!deps.lockDir) {
-      ensureSafeDirectoryIfSensitive(dir);
+      ensureSafeDirectoryIfSensitive(dir, sensitivity);
       return operation();
     }
-    ensureSafeDirectoryIfSensitive(dir);
+    ensureSafeDirectoryIfSensitive(dir, sensitivity);
     return withDirectoryLock(
       {
         lockDir: deps.lockDir,
@@ -23207,8 +23210,10 @@ function readJsonFile(filePath, sanitize) {
   }
 }
 function ensureSafeDirectoryIfSensitive(dir, sensitivity) {
-  {
+  if (sensitivity === "sensitive") {
     ensureSafeDirectory(dir);
+  } else {
+    fs5.mkdirSync(dir, { recursive: true });
   }
 }
 
@@ -31414,7 +31419,7 @@ var LOCK_FILE_MODE = 384;
 function createConsoleLock(deps = {}) {
   const fsImpl = deps.fs ?? fs5__default;
   const now = deps.now ?? Date.now;
-  const randomToken = deps.randomToken ?? (() => crypto3.randomBytes(32).toString("base64url"));
+  const randomToken = deps.randomToken ?? (() => crypto5.randomBytes(32).toString("base64url"));
   const hostname5 = deps.hostname ?? (() => "127.0.0.1");
   function ensureLockDir(dir) {
     fsImpl.mkdirSync(dir, { recursive: true, mode: LOCK_DIR_MODE });
@@ -31509,6 +31514,389 @@ function createConsoleLock(deps = {}) {
   }
   return { ensureLockDir, readLock, writeLock, removeLock, assertLockModes, assertTrustedLock };
 }
+var FLEET_DATA_DIR_NAME = ".fleet";
+function getFleetDataDir() {
+  return path93.join(os22.homedir(), FLEET_DATA_DIR_NAME);
+}
+function readAuthStoreFile(filePath) {
+  let fd;
+  try {
+    fd = fs5.openSync(filePath, fs5.constants.O_RDONLY | NOFOLLOW_FLAG);
+    if (!fs5.fstatSync(fd).isFile()) {
+      return {};
+    }
+    return JSON.parse(fs5.readFileSync(fd, "utf-8"));
+  } catch {
+    return {};
+  } finally {
+    if (fd !== void 0) {
+      try {
+        fs5.closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
+var DEFAULT_AUTH_PATH = path93.join(getFleetDataDir(), "auth.json");
+var AUTH_LOCK_OWNER_FILE_NAME = "owner.json";
+var AUTH_LOCK_TIMEOUT_MS = 5e3;
+function createAuthService(deps = {}) {
+  const authPath = deps.authPath ?? DEFAULT_AUTH_PATH;
+  const lockDir = `${authPath}.lock`;
+  return {
+    // [HIGH #1] TOCTOU 수정: existsSync/read/check/delete/write 전체를 락 블록 안으로 이동
+    async deleteApiKey(providerId) {
+      let deleted = false;
+      withAuthLock(authPath, lockDir, () => {
+        if (!fs5.existsSync(authPath)) return;
+        const data = readAuthStoreFile(authPath);
+        if (!Object.prototype.hasOwnProperty.call(data, providerId)) return;
+        delete data[providerId];
+        writeAuthData(authPath, data);
+        deleted = true;
+      });
+      return deleted;
+    },
+    // [HIGH #2] 읽기 경로: fd 기반 O_RDONLY|O_NOFOLLOW+fstatSync isFile
+    async getApiKey(providerId) {
+      let fd;
+      try {
+        if (!fs5.existsSync(authPath)) {
+          return void 0;
+        }
+        fd = fs5.openSync(authPath, fs5.constants.O_RDONLY | NOFOLLOW_FLAG);
+        if (!fs5.fstatSync(fd).isFile()) {
+          return void 0;
+        }
+        const data = JSON.parse(fs5.readFileSync(fd, "utf-8"));
+        return typeof data[providerId]?.key === "string" ? data[providerId].key : void 0;
+      } catch {
+        return void 0;
+      } finally {
+        if (fd !== void 0) {
+          try {
+            fs5.closeSync(fd);
+          } catch {
+          }
+        }
+      }
+    },
+    // [HIGH #2] 읽기 경로: fd 기반 O_RDONLY|O_NOFOLLOW 통일
+    async listProviderIds() {
+      if (!fs5.existsSync(authPath)) {
+        return [];
+      }
+      try {
+        return Object.keys(readAuthStoreFile(authPath)).sort();
+      } catch {
+        return [];
+      }
+    },
+    async setApiKey(providerId, key) {
+      const dir = path93.dirname(authPath);
+      ensureSafeDirectory(dir);
+      withAuthLock(authPath, lockDir, () => {
+        const data = fs5.existsSync(authPath) ? readAuthStoreFile(authPath) : {};
+        data[providerId] = {
+          ...data[providerId] ?? {},
+          key
+        };
+        writeAuthData(authPath, data);
+      });
+    }
+  };
+}
+function withAuthLock(authPath, lockDir, operation) {
+  return withDirectoryLock(
+    {
+      lockDir,
+      ownerFileName: AUTH_LOCK_OWNER_FILE_NAME,
+      timeoutMs: AUTH_LOCK_TIMEOUT_MS
+    },
+    operation
+  );
+}
+function writeAuthData(authPath, data) {
+  writeAtomicSync(authPath, `${JSON.stringify(data, null, 2)}
+`, {
+    mode: SECURE_FILE_MODE,
+    fsync: true
+  });
+}
+function formatMissingAuthKeyMessage(input) {
+  const cliHint = input.cli ? `cli '${input.cli}'` : "selected CLI";
+  return `Auth token not found for ${cliHint} (providerId: '${input.providerId}'). Run \`fleet auth login\` to register one.`;
+}
+function formatAuthValidationFailureMessage(input) {
+  const detail = input.detail ? ` Detail: ${input.detail}` : "";
+  if (input.status === "unauthorized") {
+    return `Auth token was rejected (providerId: '${input.providerId}'). Check the token and try again.${detail}`;
+  }
+  if (input.status === "forbidden") {
+    return `Auth token is not allowed for this provider (providerId: '${input.providerId}'). Check the token permissions.${detail}`;
+  }
+  if (input.status === "timeout") {
+    return `Auth token validation timed out (providerId: '${input.providerId}'). Check the connection and try again.${detail}`;
+  }
+  if (input.status === "network") {
+    return `Auth token validation failed due to a network error (providerId: '${input.providerId}'). Check the connection and try again.${detail}`;
+  }
+  if (input.status === "server") {
+    return `Auth token validation failed because the provider returned an error (providerId: '${input.providerId}'). Try again later.${detail}`;
+  }
+  return `Auth token validation failed (providerId: '${input.providerId}'). Check the token and try again.${detail}`;
+}
+var LEGACY_AUTH_PATH = path93.join(getFleetDataDir(), "agent", "auth.json");
+var CURRENT_AUTH_PATH = path93.join(getFleetDataDir(), "auth.json");
+function mergeAuthStoresNoOverwrite(legacy, current) {
+  const data = { ...current };
+  const migratedProviderIds = [];
+  const skippedProviderIds = [];
+  for (const [providerId, entry] of Object.entries(legacy)) {
+    if (Object.prototype.hasOwnProperty.call(data, providerId)) {
+      skippedProviderIds.push(providerId);
+      continue;
+    }
+    data[providerId] = entry;
+    migratedProviderIds.push(providerId);
+  }
+  return {
+    data,
+    migratedProviderIds,
+    skippedProviderIds
+  };
+}
+async function migrateLegacyAuthStore(options = {}) {
+  const legacyPath = options.legacyPath ?? LEGACY_AUTH_PATH;
+  const currentPath = options.currentPath ?? CURRENT_AUTH_PATH;
+  if (!fs5.existsSync(legacyPath)) {
+    return createMigrationResult({
+      legacyPath,
+      currentPath,
+      status: "legacy-missing",
+      migratedProviderIds: [],
+      skippedProviderIds: [],
+      shouldPrintNotice: false
+    });
+  }
+  const legacy = readAuthStoreFile(legacyPath);
+  const current = fs5.existsSync(currentPath) ? readAuthStoreFile(currentPath) : {};
+  const merged = mergeAuthStoresNoOverwrite(legacy, current);
+  if (merged.migratedProviderIds.length > 0) {
+    const dir = path93.dirname(currentPath);
+    ensureSafeDirectory(dir);
+    writeAtomicSync(currentPath, `${JSON.stringify(merged.data, null, 2)}
+`, {
+      mode: SECURE_FILE_MODE,
+      fsync: true
+    });
+  }
+  return createMigrationResult({
+    legacyPath,
+    currentPath,
+    status: merged.migratedProviderIds.length > 0 ? "migrated" : "unchanged",
+    migratedProviderIds: merged.migratedProviderIds,
+    skippedProviderIds: merged.skippedProviderIds,
+    shouldPrintNotice: options.notify !== false && merged.migratedProviderIds.length > 0
+  });
+}
+function createMigrationResult(input) {
+  return {
+    legacyPath: input.legacyPath,
+    currentPath: input.currentPath,
+    migratedCount: input.migratedProviderIds.length,
+    skippedCount: input.skippedProviderIds.length,
+    migratedProviderIds: input.migratedProviderIds,
+    skippedProviderIds: input.skippedProviderIds,
+    shouldPrintNotice: input.shouldPrintNotice,
+    status: input.status
+  };
+}
+var DEFAULT_AUTH_VALIDATION_TIMEOUT_MS = 5e3;
+async function validateAnthropicCompatibleApiKey(request) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => {
+    controller.abort();
+  }, request.timeoutMs ?? DEFAULT_AUTH_VALIDATION_TIMEOUT_MS);
+  try {
+    const response = await fetch(buildMessagesUrl(request.baseUrl), {
+      method: "POST",
+      headers: {
+        "anthropic-version": "2023-06-01",
+        "content-type": "application/json",
+        "x-api-key": request.apiKey
+      },
+      body: JSON.stringify({
+        model: "claude-3-5-haiku-20241022",
+        max_tokens: 1,
+        messages: [
+          {
+            role: "user",
+            content: "ping"
+          }
+        ]
+      }),
+      signal: controller.signal
+    });
+    if (response.ok) {
+      return { providerId: request.providerId, status: "success" };
+    }
+    if (response.status === 401) {
+      return { providerId: request.providerId, status: "unauthorized" };
+    }
+    if (response.status === 403) {
+      return { providerId: request.providerId, status: "forbidden" };
+    }
+    if (response.status >= 500) {
+      return {
+        providerId: request.providerId,
+        status: "server",
+        detail: `HTTP ${response.status}`
+      };
+    }
+    return {
+      providerId: request.providerId,
+      status: "unknown",
+      detail: `HTTP ${response.status}`
+    };
+  } catch (error51) {
+    if (isAbortError(error51)) {
+      return { providerId: request.providerId, status: "timeout" };
+    }
+    return {
+      providerId: request.providerId,
+      status: "network",
+      detail: error51 instanceof Error ? error51.message : String(error51)
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function isAuthValidationSuccess(result) {
+  return result.status === "success";
+}
+function createAuthValidationError(result) {
+  return new Error(formatAuthValidationFailureMessage(result));
+}
+function buildMessagesUrl(baseUrl) {
+  return `${baseUrl.replace(/\/+$/, "")}/v1/messages`;
+}
+function isAbortError(error51) {
+  return error51 instanceof DOMException && error51.name === "AbortError";
+}
+var CLAUDE_ZAI_PROVIDER_ID = "Claude Code with Z.AI GLM";
+var CLAUDE_KIMI_PROVIDER_ID = "Claude Code with Moonshot Kimi";
+var AUTH_PROVIDER_DEFINITIONS = {
+  "claude-zai": {
+    providerId: CLAUDE_ZAI_PROVIDER_ID,
+    baseUrl: CLI_BACKENDS["claude-zai"].defaultEnv.ANTHROPIC_BASE_URL,
+    env: CLI_BACKENDS["claude-zai"].defaultEnv
+  },
+  "claude-kimi": {
+    providerId: CLAUDE_KIMI_PROVIDER_ID,
+    baseUrl: CLI_BACKENDS["claude-kimi"].defaultEnv.ANTHROPIC_BASE_URL,
+    env: CLI_BACKENDS["claude-kimi"].defaultEnv
+  }
+};
+async function resolveAuthEnv(cli, deps) {
+  const provider = AUTH_PROVIDER_DEFINITIONS[cli];
+  if (!provider) return {};
+  await migrateLegacyAuthStore();
+  const auth = deps?.authService ?? createAuthService({ authPath: DEFAULT_AUTH_PATH });
+  const token = await auth.getApiKey(provider.providerId);
+  if (!token) {
+    throw new Error(formatMissingAuthKeyMessage({ cli, providerId: provider.providerId }));
+  }
+  const validation = await validateAnthropicCompatibleApiKey({
+    providerId: provider.providerId,
+    apiKey: token,
+    baseUrl: provider.baseUrl
+  });
+  if (!isAuthValidationSuccess(validation)) {
+    const failure = {
+      providerId: validation.providerId,
+      status: validation.status,
+      detail: validation.detail
+    };
+    throw createAuthValidationError(failure);
+  }
+  return { ...provider.env, ANTHROPIC_AUTH_TOKEN: token };
+}
+var GLOBAL_OPTIONS_VERSION = 1;
+var GLOBAL_OPTIONS_FILE_NAME = "settings.json";
+var LOCK_DIR_NAME = "settings.json.lock";
+var LOCK_OWNER_FILE_NAME = "owner";
+var TEMP_FILE_PREFIX = `.tmp-${GLOBAL_OPTIONS_FILE_NAME}-`;
+function createGlobalOptionsStore(deps = {}) {
+  const dataDir = deps.dataDir ?? getFleetDataDir();
+  const optionsPath = path93.join(dataDir, GLOBAL_OPTIONS_FILE_NAME);
+  const lockDir = path93.join(dataDir, LOCK_DIR_NAME);
+  const store2 = createDurableJsonStore({
+    filePath: optionsPath,
+    lockDir,
+    lockOwnerFileName: LOCK_OWNER_FILE_NAME,
+    sanitize: (value) => sanitizeGlobalOptionsData(value).data,
+    sensitivity: "sensitive",
+    timeoutMs: deps.timeoutMs,
+    staleLockMs: deps.staleLockMs,
+    tempCleanupPrefix: TEMP_FILE_PREFIX,
+    now: deps.now
+  });
+  return {
+    path: optionsPath,
+    load: () => store2.load(),
+    save: (data) => store2.save(sanitizeGlobalOptionsData(data).data),
+    update: (mutate) => store2.update((current) => sanitizeGlobalOptionsData(mutate(current)).data)
+  };
+}
+function createEmptyGlobalOptionsData() {
+  return {
+    version: GLOBAL_OPTIONS_VERSION
+  };
+}
+function sanitizeGlobalOptionsData(value) {
+  if (!isRecord3(value)) {
+    return { data: createEmptyGlobalOptionsData(), changed: true };
+  }
+  if (value.version !== GLOBAL_OPTIONS_VERSION) {
+    return { data: createEmptyGlobalOptionsData(), changed: true };
+  }
+  const data = {
+    version: GLOBAL_OPTIONS_VERSION,
+    ...typeof value.replaceSystemPrompt === "boolean" ? { replaceSystemPrompt: value.replaceSystemPrompt } : {},
+    ...typeof value.enableMetaphor === "boolean" ? { enableMetaphor: value.enableMetaphor } : {}
+  };
+  const allowedKeys = /* @__PURE__ */ new Set(["version", "replaceSystemPrompt", "enableMetaphor"]);
+  const changed = Object.keys(value).some((key) => !allowedKeys.has(key)) || "replaceSystemPrompt" in value && typeof value.replaceSystemPrompt !== "boolean" || "enableMetaphor" in value && typeof value.enableMetaphor !== "boolean";
+  return { data, changed };
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function createGlobalOptionsService(deps = {}) {
+  const store2 = deps.store ?? createGlobalOptionsStore({ dataDir: deps.dataDir });
+  return {
+    load: () => store2.load(),
+    save: (data) => {
+      store2.save(data);
+      return store2.load();
+    },
+    update: (mutate) => updateGlobalOptions(store2, mutate)
+  };
+}
+function updateGlobalOptions(store2, mutate) {
+  return store2.update(mutate);
+}
+
+// ../../packages/fleet-infra/dist/index.js
+function createInfraServices(deps = {}) {
+  const globalOptionsService = createGlobalOptionsService();
+  const authService = createAuthService({ authPath: deps.authPath ?? DEFAULT_AUTH_PATH });
+  return {
+    authService,
+    globalOptionsService
+  };
+}
 function readFleetConsoleRelease() {
   const requireFromHere = createRequire(import.meta.url);
   const packageJsonPath = requireFromHere.resolve("../package.json");
@@ -31522,17 +31910,34 @@ function readFleetConsoleRelease() {
 }
 
 // src/paths.ts
-var LOCK_DIR_NAME = "fleet-console";
+var LOCK_DIR_NAME2 = "fleet-console";
+var CONSOLE_RUNTIME_DIR_NAME = "console";
 var LOCK_FILE_NAME = "console.lock";
+var CONSOLE_DATA_DIR_NAME = "console";
+var CONSOLE_STATE_FILE_NAME = "state.json";
+var CONSOLE_CAPTURES_DIR_NAME = "captures";
 function createConsolePaths(deps = {}) {
   const env = deps.env ?? process.env;
   const base = env.FLEET_CONSOLE_DIR ?? defaultConsoleBaseDir(deps);
   return { dir: base, lockFile: path93__default.join(base, LOCK_FILE_NAME) };
 }
+function createConsoleDataPaths(deps = {}) {
+  const dir = path93__default.join(deps.fleetDataDir ?? getFleetDataDir(), CONSOLE_DATA_DIR_NAME);
+  return {
+    dir,
+    stateFile: path93__default.join(dir, CONSOLE_STATE_FILE_NAME),
+    capturesDir: path93__default.join(dir, CONSOLE_CAPTURES_DIR_NAME)
+  };
+}
 function defaultConsoleBaseDir(deps) {
+  let release;
+  const channel = deps.channel ?? (release = readFleetConsoleRelease()).channel;
+  if (channel === "local") {
+    const packageRoot = deps.packageRoot ?? (release ??= readFleetConsoleRelease()).packageRoot;
+    return path93__default.join(path93__default.resolve(packageRoot, "..", ".."), ".fleet", CONSOLE_RUNTIME_DIR_NAME);
+  }
   const uid = deps.uid ?? (typeof process.getuid === "function" ? process.getuid() : 0);
-  const channel = deps.channel ?? readFleetConsoleRelease().channel;
-  return path93__default.join(os22__default.tmpdir(), `${LOCK_DIR_NAME}-${uid}-${channel}`);
+  return path93__default.join(os22__default.tmpdir(), `${LOCK_DIR_NAME2}-${uid}-${channel}`);
 }
 var FLEET_PROTOCOL_GATE_PROMPT = String.raw`# Protocol Gate
 
@@ -31925,6 +32330,8 @@ function createClaudeFamilyCliDefinition(options) {
           lineTerminator: "\r",
           multilineStrategy: "paste-mode"
         },
+        // Claude Code 계열은 세션 이름 변경 슬래시 명령 `/rename`을 지원한다.
+        renameCommand: "/rename",
         terminalName: "xterm-256color"
       };
     }
@@ -31948,7 +32355,7 @@ var codexCli = {
   async createProfile(options) {
     const { bin, prefixArgs } = resolveBinary("codex", "CODEX_BIN", options.env);
     return {
-      args: [...prefixArgs, "--no-alt-screen", ...buildModelArgs2(options.model)],
+      args: [...prefixArgs, ...buildResumeArgs(options.resumeSessionId), "--no-alt-screen", ...buildModelArgs2(options.model)],
       bin,
       binPrefixArgs: prefixArgs,
       cwd: options.cwd,
@@ -31960,10 +32367,15 @@ var codexCli = {
         lineTerminator: "\r",
         multilineStrategy: "paste-mode"
       },
+      // Codex CLI도 세션 이름 변경 슬래시 명령 `/rename`을 지원한다.
+      renameCommand: "/rename",
       terminalName: "xterm-256color"
     };
   }
 };
+function buildResumeArgs(resumeSessionId) {
+  return resumeSessionId === void 0 ? [] : ["resume", resumeSessionId];
+}
 function buildModelArgs2(model) {
   return model === void 0 ? [] : ["--model", model];
 }
@@ -31980,7 +32392,8 @@ async function resolveAgentCliProfile(env, cwd, options = {}) {
     authService: options.authService,
     cwd,
     env,
-    model: options.model
+    model: options.model,
+    resumeSessionId: options.resumeSessionId
   });
 }
 function resolveAgentCliId(env, options = {}) {
@@ -32024,6 +32437,20 @@ var AGENT_CLI_INJECTION_CAPABILITIES = {
 function getAgentCliInjectionCapability(cliId) {
   return AGENT_CLI_INJECTION_CAPABILITIES[cliId];
 }
+function createSessionCaptureHookExec(deps) {
+  const args = deps.tsxLoader ? [
+    "--import",
+    pathToFileURL(deps.tsxLoader).href,
+    deps.entryPath,
+    "hook",
+    "capture-session",
+    deps.provider
+  ] : [deps.entryPath, "hook", "capture-session", deps.provider];
+  return {
+    command: deps.execPath ?? process5.execPath,
+    args
+  };
+}
 function buildHostCarrierModelDefaults2(config2) {
   const cliType = resolveAgentCliType2(config2.id, config2.defaultCliType);
   const cliDefaults = buildCarrierModelDefaults(config2, cliType);
@@ -32053,6 +32480,7 @@ function buildClaudeNativeSubagentPlan2(registry3) {
 function buildClaudeNativeArgs(context) {
   const systemPromptArg = context.replaceSystemPrompt ? "--system-prompt-file" : "--append-system-prompt-file";
   return [
+    ...buildResumeArgs2(context.resumeSessionId),
     systemPromptArg,
     requireSystemPromptFile(context),
     ...context.pluginRoots.flatMap((pluginRoot) => [
@@ -32063,6 +32491,9 @@ function buildClaudeNativeArgs(context) {
     "--dangerously-skip-permissions"
   ];
 }
+function buildResumeArgs2(resumeSessionId) {
+  return resumeSessionId === void 0 ? [] : ["--resume", resumeSessionId];
+}
 function buildClaudeMcpConfig(servers) {
   return JSON.stringify({
     mcpServers: Object.fromEntries(
@@ -32120,20 +32551,32 @@ function escapeTomlMultilineString(value) {
   });
   return result;
 }
+function buildPosixShellCommand(values) {
+  return values.map(posixShellQuote).join(" ");
+}
+function posixShellQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
 var CODEX_TOOL_TIMEOUT_SEC = 1800;
 function buildCodexNativeArgs(context) {
   const profileName = requireCodexProfileName(context);
   const args = [
+    ...buildResumeArgs3(context.resumeSessionId),
     "--enable",
     "plugins",
     "--enable",
     "child_agents_md",
+    "--enable",
+    "hooks",
     "--profile",
     profileName,
     "-c",
     'approval_policy="never"',
     "-c",
-    'sandbox_mode="danger-full-access"'
+    'sandbox_mode="danger-full-access"',
+    // hook 신뢰 프롬프트("Hooks need review")를 fleet 관리 세션에서 건너뛴다. bypass_hook_trust는
+    // config 키가 아니라 전용 CLI 플래그이므로 -c override가 아닌 플래그로 전달해야 한다.
+    "--dangerously-bypass-hook-trust"
   ];
   for (const server of context.mcpServers) {
     const prefix = `mcp_servers.${server.name}`;
@@ -32149,6 +32592,9 @@ function buildCodexNativeArgs(context) {
   }
   return args;
 }
+function buildResumeArgs3(resumeSessionId) {
+  return resumeSessionId === void 0 ? [] : ["resume", resumeSessionId];
+}
 function requireCodexProfileName(context) {
   if (context.codexProfileName) return context.codexProfileName;
   throw new Error("Codex profile name is required for native injection");
@@ -32359,20 +32805,32 @@ function claudeHooks(options) {
   if (!hookExec) {
     throw new Error("Fleet Claude session hook command is required");
   }
+  const captureSessionHookExec = options.captureSessionHookExec;
   return {
     hooks: {
       SessionStart: [{
-        hooks: [{
-          // exec 형식: command는 직접 spawn되는 실행 파일, args는 셸 토크나이징 없이 그대로 전달된다.
-          // Windows cmd/powershell의 따옴표 규칙과 무관하게 동작하며 공백 포함 경로도 안전하다.
-          args: [...hookExec.args],
-          command: hookExec.command,
-          type: "command"
+        hooks: [claudeCommandHook(hookExec)]
+      }],
+      ...captureSessionHookExec ? {
+        UserPromptSubmit: [{
+          hooks: [claudeCommandHook(captureSessionHookExec)]
         }]
-      }]
+      } : {}
     }
   };
 }
+function claudeCommandHook(hookExec) {
+  if (!hookExec) {
+    throw new Error("Fleet Claude session hook command is required");
+  }
+  return {
+    // exec 형식: command는 직접 spawn되는 실행 파일, args는 셸 토크나이징 없이 그대로 전달된다.
+    // Windows cmd/powershell의 따옴표 규칙과 무관하게 동작하며 공백 포함 경로도 안전하다.
+    args: [...hookExec.args],
+    command: hookExec.command,
+    type: "command"
+  };
+}
 function claudeAgentFile(subagent) {
   const frontmatter = [
     "---",
@@ -32882,7 +33340,7 @@ function homeMarketplaceTarget(fleetRoot) {
 }
 function projectMarketplaceTarget(cwd) {
   const projectFleetRoot = resolveProjectFleetRoot(cwd);
-  const hash2 = crypto3.createHash("sha256").update(path93__default.resolve(cwd, ".fleet")).digest("hex").slice(0, 12);
+  const hash2 = crypto5.createHash("sha256").update(path93__default.resolve(cwd, ".fleet")).digest("hex").slice(0, 12);
   return {
     flat: true,
     name: `${FLEET_PROJECT_MARKETPLACE_NAME_PREFIX}-${hash2}`,
@@ -32908,7 +33366,6 @@ function renderPluginRoot(pluginRoot, bundle, options, fleetRoot) {
   const stagedPluginRoot = path93__default.join(stageParent, path93__default.basename(pluginRoot));
   try {
     ensurePrivateDir(stagedPluginRoot, stagedPluginRoot);
-    writePrivateJson(path93__default.join(stagedPluginRoot, ".codex-plugin", "plugin.json"), codexManifest(bundle), stagedPluginRoot);
     writePrivateJson(path93__default.join(stagedPluginRoot, ".claude-plugin", "plugin.json"), claudeManifest(bundle), stagedPluginRoot);
     switch (bundle.source) {
       case "asset":
@@ -32923,6 +33380,7 @@ function renderPluginRoot(pluginRoot, bundle, options, fleetRoot) {
         renderGlobalPluginRoot(stagedPluginRoot, fleetRoot);
         break;
     }
+    writePrivateJson(path93__default.join(stagedPluginRoot, ".codex-plugin", "plugin.json"), codexManifest(bundle, stagedPluginRoot), stagedPluginRoot);
     removePrivatePath(pluginRoot, parentRoot);
     renameSync(stagedPluginRoot, pluginRoot);
   } finally {
@@ -32951,7 +33409,7 @@ function pruneMarketplaceRoot(target) {
   }
 }
 function buildContentHash(target) {
-  const hash2 = crypto3.createHash("sha256");
+  const hash2 = crypto5.createHash("sha256");
   for (const filePath of listRenderableFiles(target)) {
     const relativePath2 = path93__default.relative(target.root, filePath);
     hash2.update(relativePath2);
@@ -33054,14 +33512,36 @@ function marketplacePluginPath(target, bundle) {
   if (target.flat) return `./${FLAT_PLUGIN_DIR_NAME}`;
   return `./${PLUGIN_BUNDLES_DIR_NAME}/${bundle.directoryName}`;
 }
-function codexManifest(bundle) {
+function codexManifest(bundle, pluginRoot) {
   return {
     name: bundle.name,
-    version: "0.0.0",
+    version: codexManifestVersion(bundle, pluginRoot),
     description: bundle.description,
     skills: "./skills/"
   };
 }
+function codexManifestVersion(bundle, pluginRoot) {
+  const hash2 = crypto5.createHash("sha256");
+  hash2.update(bundle.name);
+  hash2.update("\0");
+  hash2.update(bundle.description);
+  hash2.update("\0");
+  for (const filePath of listCodexEffectivePluginFiles(pluginRoot)) {
+    const relativePath2 = path93__default.relative(pluginRoot, filePath);
+    hash2.update(relativePath2);
+    hash2.update("\0");
+    hash2.update(readFileSync(filePath));
+    hash2.update("\0");
+  }
+  return `0.0.0+${hash2.digest("hex").slice(0, 12)}`;
+}
+function listCodexEffectivePluginFiles(pluginRoot) {
+  const skillsPath = path93__default.join(pluginRoot, "skills");
+  if (!existsSync(skillsPath)) return [];
+  const files = [];
+  collectRenderableFiles(pluginRoot, skillsPath, files, /* @__PURE__ */ new Set());
+  return files.sort();
+}
 function claudeManifest(bundle) {
   return {
     name: bundle.name,
@@ -33081,7 +33561,7 @@ async function injectAgentCliProfile(profile, options) {
   const injectTone = options.enableMetaphor ?? false;
   const endpoint = await options.dedicatedMcpSession.getEndpoint();
   const startupDefinitions = buildStartupNativeDefinitions(profile.id, options.carrierRuntime);
-  const tokenLabel = options.mcpSessionLabel ?? `agent:${profile.id}:${crypto3.randomUUID()}`;
+  const tokenLabel = options.mcpSessionLabel ?? `agent:${profile.id}:${crypto5.randomUUID()}`;
   const tokens = await options.dedicatedMcpSession.issueSessionToken({ cwd: profile.cwd, label: tokenLabel });
   const mcpServers = buildAgentCliMcpServerConfigs(endpoint.servers, tokens);
   const doctrine = options.buildSystemPrompt(injectTone);
@@ -33095,11 +33575,12 @@ async function injectAgentCliProfile(profile, options) {
       cwd: profile.cwd,
       dataDir: options.dataDir,
       rootDir: options.pluginRootDir,
+      captureSessionHookExec: options.captureSessionHookExec,
       hookExec: startupDefinitions.host === "claude" ? requireHookExec(options.hookExec) : void 0,
       withMarketplaceLock: options.withMarketplaceLock
     });
     const codexPluginKeys = plugin.codexRegistrations.map((registration) => `${registration.pluginName}@${registration.marketplaceName}`);
-    const codexProfile = profile.id === "codex" ? writeCodexFleetProfile(profile.env, doctrine, codexPluginKeys, (cleanup2) => tempCleanups.push(cleanup2)) : void 0;
+    const codexProfile = profile.id === "codex" ? writeCodexFleetProfile(profile.env, doctrine, codexPluginKeys, options.captureSessionHookExec, (cleanup2) => tempCleanups.push(cleanup2)) : void 0;
     const launchWarnings = [];
     for (const registration of plugin.codexRegistrations) {
       const registrationWarning = await ensureCodexPluginRegistered(registration, {
@@ -33126,13 +33607,14 @@ async function injectAgentCliProfile(profile, options) {
       pluginRoot: plugin.pluginRoot,
       pluginRoots: plugin.pluginRoots,
       codexProfileName: codexProfile?.profileName,
-      replaceSystemPrompt: options.replaceSystemPrompt ?? true,
+      replaceSystemPrompt: options.replaceSystemPrompt ?? false,
+      resumeSessionId: options.resumeSessionId,
       systemPromptFile
     };
     const injectedArgs = buildAgentCliArgs(capability.builderId, context);
     return {
       ...profile,
-      args: [...profile.args, ...injectedArgs],
+      args: mergeAgentCliArgs(profile, capability.builderId, context, injectedArgs),
       cleanup,
       launchWarnings: [...profile.launchWarnings ?? [], ...launchWarnings]
     };
@@ -33174,11 +33656,11 @@ function writeSystemPromptFile(cliId, systemPrompt, onCleanup) {
   chmodBestEffort2(filePath, SYSTEM_PROMPT_FILE_MODE);
   return filePath;
 }
-function writeCodexFleetProfile(env, doctrine, pluginKeys, onCleanup) {
+function writeCodexFleetProfile(env, doctrine, pluginKeys, captureSessionHookExec, onCleanup) {
   const codexHome = env.CODEX_HOME ?? path93__default.join(env.HOME ?? os22__default.homedir(), ".codex");
   mkdirSync(codexHome, { recursive: true });
   pruneStaleCodexFleetProfiles(codexHome);
-  const profileName = `fleet-${crypto3.randomUUID()}`;
+  const profileName = `fleet-${crypto5.randomUUID()}`;
   const profilePath = path93__default.join(codexHome, `${profileName}.config.toml`);
   onCleanup(() => rmBestEffort(profilePath));
   writeFileNoFollow2(profilePath, [
@@ -33193,11 +33675,21 @@ function writeCodexFleetProfile(env, doctrine, pluginKeys, onCleanup) {
       `[plugins."${escapeTomlBasicString2(pluginKey)}"]`,
       "enabled = true",
       ""
-    ])
+    ]),
+    ...codexCaptureHookConfig(captureSessionHookExec)
   ].join("\n"));
   chmodBestEffort2(profilePath, SYSTEM_PROMPT_FILE_MODE);
   return { profileName, profilePath };
 }
+function codexCaptureHookConfig(captureSessionHookExec) {
+  if (captureSessionHookExec === void 0) return [];
+  const command2 = buildPosixShellCommand([captureSessionHookExec.command, ...captureSessionHookExec.args]);
+  return [
+    "[hooks]",
+    `UserPromptSubmit = [{ hooks = [{ type = "command", command = "${escapeTomlBasicString2(command2)}" }] }]`,
+    ""
+  ];
+}
 function writeFileNoFollow2(filePath, content) {
   const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW;
   const fd = openSync(filePath, flags, SYSTEM_PROMPT_FILE_MODE);
@@ -33270,6 +33762,24 @@ function buildAgentCliArgs(builderId, context) {
       return buildCodexNativeArgs(context);
   }
 }
+function mergeAgentCliArgs(profile, builderId, context, injectedArgs) {
+  if (builderId !== "codex-native" || context.resumeSessionId === void 0) {
+    return [...profile.args, ...injectedArgs];
+  }
+  const resumeSessionId = context.resumeSessionId;
+  const prefixLength = profile.binPrefixArgs?.length ?? 0;
+  const codexResumeArgs = ["resume", resumeSessionId];
+  const injectedTail = injectedArgs.slice(codexResumeArgs.length);
+  return [
+    ...profile.args.slice(0, prefixLength),
+    ...codexResumeArgs,
+    ...profile.args.slice(prefixLength).filter((arg, index, args) => !isCodexResumeArgAt(args, index, resumeSessionId)),
+    ...injectedTail
+  ];
+}
+function isCodexResumeArgAt(args, index, resumeSessionId) {
+  return args[index] === "resume" && args[index + 1] === resumeSessionId || args[index] === resumeSessionId && args[index - 1] === "resume";
+}
 function createOnceCleanup(cleanup) {
   let cleaned = false;
   return () => {
@@ -33453,389 +33963,6 @@ function applyMessagePolicy(text, policy) {
     submit: policy.lineTerminator
   };
 }
-var FLEET_DATA_DIR_NAME = ".fleet";
-function getFleetDataDir() {
-  return path93.join(os22.homedir(), FLEET_DATA_DIR_NAME);
-}
-function readAuthStoreFile(filePath) {
-  let fd;
-  try {
-    fd = fs5.openSync(filePath, fs5.constants.O_RDONLY | NOFOLLOW_FLAG);
-    if (!fs5.fstatSync(fd).isFile()) {
-      return {};
-    }
-    return JSON.parse(fs5.readFileSync(fd, "utf-8"));
-  } catch {
-    return {};
-  } finally {
-    if (fd !== void 0) {
-      try {
-        fs5.closeSync(fd);
-      } catch {
-      }
-    }
-  }
-}
-var DEFAULT_AUTH_PATH = path93.join(getFleetDataDir(), "auth.json");
-var AUTH_LOCK_OWNER_FILE_NAME = "owner.json";
-var AUTH_LOCK_TIMEOUT_MS = 5e3;
-function createAuthService(deps = {}) {
-  const authPath = deps.authPath ?? DEFAULT_AUTH_PATH;
-  const lockDir = `${authPath}.lock`;
-  return {
-    // [HIGH #1] TOCTOU 수정: existsSync/read/check/delete/write 전체를 락 블록 안으로 이동
-    async deleteApiKey(providerId) {
-      let deleted = false;
-      withAuthLock(authPath, lockDir, () => {
-        if (!fs5.existsSync(authPath)) return;
-        const data = readAuthStoreFile(authPath);
-        if (!Object.prototype.hasOwnProperty.call(data, providerId)) return;
-        delete data[providerId];
-        writeAuthData(authPath, data);
-        deleted = true;
-      });
-      return deleted;
-    },
-    // [HIGH #2] 읽기 경로: fd 기반 O_RDONLY|O_NOFOLLOW+fstatSync isFile
-    async getApiKey(providerId) {
-      let fd;
-      try {
-        if (!fs5.existsSync(authPath)) {
-          return void 0;
-        }
-        fd = fs5.openSync(authPath, fs5.constants.O_RDONLY | NOFOLLOW_FLAG);
-        if (!fs5.fstatSync(fd).isFile()) {
-          return void 0;
-        }
-        const data = JSON.parse(fs5.readFileSync(fd, "utf-8"));
-        return typeof data[providerId]?.key === "string" ? data[providerId].key : void 0;
-      } catch {
-        return void 0;
-      } finally {
-        if (fd !== void 0) {
-          try {
-            fs5.closeSync(fd);
-          } catch {
-          }
-        }
-      }
-    },
-    // [HIGH #2] 읽기 경로: fd 기반 O_RDONLY|O_NOFOLLOW 통일
-    async listProviderIds() {
-      if (!fs5.existsSync(authPath)) {
-        return [];
-      }
-      try {
-        return Object.keys(readAuthStoreFile(authPath)).sort();
-      } catch {
-        return [];
-      }
-    },
-    async setApiKey(providerId, key) {
-      const dir = path93.dirname(authPath);
-      ensureSafeDirectory(dir);
-      withAuthLock(authPath, lockDir, () => {
-        const data = fs5.existsSync(authPath) ? readAuthStoreFile(authPath) : {};
-        data[providerId] = {
-          ...data[providerId] ?? {},
-          key
-        };
-        writeAuthData(authPath, data);
-      });
-    }
-  };
-}
-function withAuthLock(authPath, lockDir, operation) {
-  return withDirectoryLock(
-    {
-      lockDir,
-      ownerFileName: AUTH_LOCK_OWNER_FILE_NAME,
-      timeoutMs: AUTH_LOCK_TIMEOUT_MS
-    },
-    operation
-  );
-}
-function writeAuthData(authPath, data) {
-  writeAtomicSync(authPath, `${JSON.stringify(data, null, 2)}
-`, {
-    mode: SECURE_FILE_MODE,
-    fsync: true
-  });
-}
-function formatMissingAuthKeyMessage(input) {
-  const cliHint = input.cli ? `cli '${input.cli}'` : "selected CLI";
-  return `Auth token not found for ${cliHint} (providerId: '${input.providerId}'). Run \`fleet auth login\` to register one.`;
-}
-function formatAuthValidationFailureMessage(input) {
-  const detail = input.detail ? ` Detail: ${input.detail}` : "";
-  if (input.status === "unauthorized") {
-    return `Auth token was rejected (providerId: '${input.providerId}'). Check the token and try again.${detail}`;
-  }
-  if (input.status === "forbidden") {
-    return `Auth token is not allowed for this provider (providerId: '${input.providerId}'). Check the token permissions.${detail}`;
-  }
-  if (input.status === "timeout") {
-    return `Auth token validation timed out (providerId: '${input.providerId}'). Check the connection and try again.${detail}`;
-  }
-  if (input.status === "network") {
-    return `Auth token validation failed due to a network error (providerId: '${input.providerId}'). Check the connection and try again.${detail}`;
-  }
-  if (input.status === "server") {
-    return `Auth token validation failed because the provider returned an error (providerId: '${input.providerId}'). Try again later.${detail}`;
-  }
-  return `Auth token validation failed (providerId: '${input.providerId}'). Check the token and try again.${detail}`;
-}
-var LEGACY_AUTH_PATH = path93.join(getFleetDataDir(), "agent", "auth.json");
-var CURRENT_AUTH_PATH = path93.join(getFleetDataDir(), "auth.json");
-function mergeAuthStoresNoOverwrite(legacy, current) {
-  const data = { ...current };
-  const migratedProviderIds = [];
-  const skippedProviderIds = [];
-  for (const [providerId, entry] of Object.entries(legacy)) {
-    if (Object.prototype.hasOwnProperty.call(data, providerId)) {
-      skippedProviderIds.push(providerId);
-      continue;
-    }
-    data[providerId] = entry;
-    migratedProviderIds.push(providerId);
-  }
-  return {
-    data,
-    migratedProviderIds,
-    skippedProviderIds
-  };
-}
-async function migrateLegacyAuthStore(options = {}) {
-  const legacyPath = options.legacyPath ?? LEGACY_AUTH_PATH;
-  const currentPath = options.currentPath ?? CURRENT_AUTH_PATH;
-  if (!fs5.existsSync(legacyPath)) {
-    return createMigrationResult({
-      legacyPath,
-      currentPath,
-      status: "legacy-missing",
-      migratedProviderIds: [],
-      skippedProviderIds: [],
-      shouldPrintNotice: false
-    });
-  }
-  const legacy = readAuthStoreFile(legacyPath);
-  const current = fs5.existsSync(currentPath) ? readAuthStoreFile(currentPath) : {};
-  const merged = mergeAuthStoresNoOverwrite(legacy, current);
-  if (merged.migratedProviderIds.length > 0) {
-    const dir = path93.dirname(currentPath);
-    ensureSafeDirectory(dir);
-    writeAtomicSync(currentPath, `${JSON.stringify(merged.data, null, 2)}
-`, {
-      mode: SECURE_FILE_MODE,
-      fsync: true
-    });
-  }
-  return createMigrationResult({
-    legacyPath,
-    currentPath,
-    status: merged.migratedProviderIds.length > 0 ? "migrated" : "unchanged",
-    migratedProviderIds: merged.migratedProviderIds,
-    skippedProviderIds: merged.skippedProviderIds,
-    shouldPrintNotice: options.notify !== false && merged.migratedProviderIds.length > 0
-  });
-}
-function createMigrationResult(input) {
-  return {
-    legacyPath: input.legacyPath,
-    currentPath: input.currentPath,
-    migratedCount: input.migratedProviderIds.length,
-    skippedCount: input.skippedProviderIds.length,
-    migratedProviderIds: input.migratedProviderIds,
-    skippedProviderIds: input.skippedProviderIds,
-    shouldPrintNotice: input.shouldPrintNotice,
-    status: input.status
-  };
-}
-var DEFAULT_AUTH_VALIDATION_TIMEOUT_MS = 5e3;
-async function validateAnthropicCompatibleApiKey(request) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => {
-    controller.abort();
-  }, request.timeoutMs ?? DEFAULT_AUTH_VALIDATION_TIMEOUT_MS);
-  try {
-    const response = await fetch(buildMessagesUrl(request.baseUrl), {
-      method: "POST",
-      headers: {
-        "anthropic-version": "2023-06-01",
-        "content-type": "application/json",
-        "x-api-key": request.apiKey
-      },
-      body: JSON.stringify({
-        model: "claude-3-5-haiku-20241022",
-        max_tokens: 1,
-        messages: [
-          {
-            role: "user",
-            content: "ping"
-          }
-        ]
-      }),
-      signal: controller.signal
-    });
-    if (response.ok) {
-      return { providerId: request.providerId, status: "success" };
-    }
-    if (response.status === 401) {
-      return { providerId: request.providerId, status: "unauthorized" };
-    }
-    if (response.status === 403) {
-      return { providerId: request.providerId, status: "forbidden" };
-    }
-    if (response.status >= 500) {
-      return {
-        providerId: request.providerId,
-        status: "server",
-        detail: `HTTP ${response.status}`
-      };
-    }
-    return {
-      providerId: request.providerId,
-      status: "unknown",
-      detail: `HTTP ${response.status}`
-    };
-  } catch (error51) {
-    if (isAbortError(error51)) {
-      return { providerId: request.providerId, status: "timeout" };
-    }
-    return {
-      providerId: request.providerId,
-      status: "network",
-      detail: error51 instanceof Error ? error51.message : String(error51)
-    };
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-function isAuthValidationSuccess(result) {
-  return result.status === "success";
-}
-function createAuthValidationError(result) {
-  return new Error(formatAuthValidationFailureMessage(result));
-}
-function buildMessagesUrl(baseUrl) {
-  return `${baseUrl.replace(/\/+$/, "")}/v1/messages`;
-}
-function isAbortError(error51) {
-  return error51 instanceof DOMException && error51.name === "AbortError";
-}
-var CLAUDE_ZAI_PROVIDER_ID = "Claude Code with Z.AI GLM";
-var CLAUDE_KIMI_PROVIDER_ID = "Claude Code with Moonshot Kimi";
-var AUTH_PROVIDER_DEFINITIONS = {
-  "claude-zai": {
-    providerId: CLAUDE_ZAI_PROVIDER_ID,
-    baseUrl: CLI_BACKENDS["claude-zai"].defaultEnv.ANTHROPIC_BASE_URL,
-    env: CLI_BACKENDS["claude-zai"].defaultEnv
-  },
-  "claude-kimi": {
-    providerId: CLAUDE_KIMI_PROVIDER_ID,
-    baseUrl: CLI_BACKENDS["claude-kimi"].defaultEnv.ANTHROPIC_BASE_URL,
-    env: CLI_BACKENDS["claude-kimi"].defaultEnv
-  }
-};
-async function resolveAuthEnv(cli, deps) {
-  const provider = AUTH_PROVIDER_DEFINITIONS[cli];
-  if (!provider) return {};
-  await migrateLegacyAuthStore();
-  const auth = deps?.authService ?? createAuthService({ authPath: DEFAULT_AUTH_PATH });
-  const token = await auth.getApiKey(provider.providerId);
-  if (!token) {
-    throw new Error(formatMissingAuthKeyMessage({ cli, providerId: provider.providerId }));
-  }
-  const validation = await validateAnthropicCompatibleApiKey({
-    providerId: provider.providerId,
-    apiKey: token,
-    baseUrl: provider.baseUrl
-  });
-  if (!isAuthValidationSuccess(validation)) {
-    const failure = {
-      providerId: validation.providerId,
-      status: validation.status,
-      detail: validation.detail
-    };
-    throw createAuthValidationError(failure);
-  }
-  return { ...provider.env, ANTHROPIC_AUTH_TOKEN: token };
-}
-var GLOBAL_OPTIONS_VERSION = 1;
-var GLOBAL_OPTIONS_FILE_NAME = "settings.json";
-var LOCK_DIR_NAME2 = "settings.json.lock";
-var LOCK_OWNER_FILE_NAME = "owner";
-var TEMP_FILE_PREFIX = `.tmp-${GLOBAL_OPTIONS_FILE_NAME}-`;
-function createGlobalOptionsStore(deps = {}) {
-  const dataDir = deps.dataDir ?? getFleetDataDir();
-  const optionsPath = path93.join(dataDir, GLOBAL_OPTIONS_FILE_NAME);
-  const lockDir = path93.join(dataDir, LOCK_DIR_NAME2);
-  const store2 = createDurableJsonStore({
-    filePath: optionsPath,
-    lockDir,
-    lockOwnerFileName: LOCK_OWNER_FILE_NAME,
-    sanitize: (value) => sanitizeGlobalOptionsData(value).data,
-    sensitivity: "sensitive",
-    timeoutMs: deps.timeoutMs,
-    staleLockMs: deps.staleLockMs,
-    tempCleanupPrefix: TEMP_FILE_PREFIX,
-    now: deps.now
-  });
-  return {
-    path: optionsPath,
-    load: () => store2.load(),
-    save: (data) => store2.save(sanitizeGlobalOptionsData(data).data),
-    update: (mutate) => store2.update((current) => sanitizeGlobalOptionsData(mutate(current)).data)
-  };
-}
-function createEmptyGlobalOptionsData() {
-  return {
-    version: GLOBAL_OPTIONS_VERSION
-  };
-}
-function sanitizeGlobalOptionsData(value) {
-  if (!isRecord3(value)) {
-    return { data: createEmptyGlobalOptionsData(), changed: true };
-  }
-  if (value.version !== GLOBAL_OPTIONS_VERSION) {
-    return { data: createEmptyGlobalOptionsData(), changed: true };
-  }
-  const data = {
-    version: GLOBAL_OPTIONS_VERSION,
-    ...typeof value.replaceSystemPrompt === "boolean" ? { replaceSystemPrompt: value.replaceSystemPrompt } : {},
-    ...typeof value.enableMetaphor === "boolean" ? { enableMetaphor: value.enableMetaphor } : {}
-  };
-  const allowedKeys = /* @__PURE__ */ new Set(["version", "replaceSystemPrompt", "enableMetaphor"]);
-  const changed = Object.keys(value).some((key) => !allowedKeys.has(key)) || "replaceSystemPrompt" in value && typeof value.replaceSystemPrompt !== "boolean" || "enableMetaphor" in value && typeof value.enableMetaphor !== "boolean";
-  return { data, changed };
-}
-function isRecord3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function createGlobalOptionsService(deps = {}) {
-  const store2 = deps.store ?? createGlobalOptionsStore({ dataDir: deps.dataDir });
-  return {
-    load: () => store2.load(),
-    save: (data) => {
-      store2.save(data);
-      return store2.load();
-    },
-    update: (mutate) => updateGlobalOptions(store2, mutate)
-  };
-}
-function updateGlobalOptions(store2, mutate) {
-  return store2.update(mutate);
-}
-
-// ../../packages/fleet-infra/dist/index.js
-function createInfraServices(deps = {}) {
-  const globalOptionsService = createGlobalOptionsService();
-  const authService = createAuthService({ authPath: deps.authPath ?? DEFAULT_AUTH_PATH });
-  return {
-    authService,
-    globalOptionsService
-  };
-}
 var FLEET_WIKI_ENTRY_BEGIN = "<<<FLEET_WIKI_ENTRY_BEGIN";
 var FLEET_WIKI_ENTRY_END = "<<<FLEET_WIKI_ENTRY_END>>>";
 var FLEET_WIKI_RAW_SOURCE_BEGIN = "<<<FLEET_WIKI_RAW_SOURCE_BEGIN";
@@ -34862,7 +34989,7 @@ function stripLeadingFrontmatter(body) {
   return stripped ? next : body;
 }
 function computeContentHash(content) {
-  return crypto3.createHash("sha256").update(content, "utf8").digest("hex").slice(0, 8);
+  return crypto5.createHash("sha256").update(content, "utf8").digest("hex").slice(0, 8);
 }
 function assertWithinRawDir(absolutePath, paths) {
   const relative = path93__default.relative(paths.rawDir, absolutePath);
@@ -35075,7 +35202,7 @@ async function writeAtomic(filePath, content, paths) {
   await ensureMemoryRoot(paths);
   const tempPath = path93__default.join(
     path93__default.dirname(filePath),
-    `.tmp-${process.pid}-${Date.now()}-${crypto3.randomUUID()}-${os22__default.hostname()}`
+    `.tmp-${process.pid}-${Date.now()}-${crypto5.randomUUID()}-${os22__default.hostname()}`
   );
   await writeFile(tempPath, content, "utf8");
   await rename(tempPath, filePath);
@@ -37612,7 +37739,7 @@ function parseOptionalIsoDate(value) {
   return Number.isFinite(timestamp) ? timestamp : null;
 }
 function hashBodyForComparison(body) {
-  return crypto3.createHash("sha256").update(body.replace(/\s+/g, " ").trim(), "utf8").digest("hex").slice(0, 8);
+  return crypto5.createHash("sha256").update(body.replace(/\s+/g, " ").trim(), "utf8").digest("hex").slice(0, 8);
 }
 function hasConflictingStatuses(entries) {
   const statuses = new Set(entries.map((entry) => entry.status).filter((status) => status !== "unknown"));
@@ -39795,6 +39922,420 @@ function buildWikiToolSpec(config2, usage) {
   };
 }
 
+// src/carrier-settings-routes.ts
+var SUBAGENT_CLI_TYPES = /* @__PURE__ */ new Set(["claude", "claude-zai", "claude-kimi"]);
+var TASKFORCE_MIN_BACKENDS = 2;
+function createCarrierSettingsRouter(deps) {
+  const controller = createStatusOverlayController(deps.registry);
+  return async function handleCarrierSettingsRoute(context) {
+    const { req, res, pathname } = context;
+    if (pathname === "/carrier-settings/state") {
+      if (req.method !== "GET") {
+        deps.writeJson(res, 405, { error: "Method not allowed" });
+        return true;
+      }
+      deps.writeJson(res, 200, buildCarrierSettingsState(deps.registry));
+      return true;
+    }
+    if (pathname === "/carrier-settings/options") {
+      if (req.method !== "GET") {
+        deps.writeJson(res, 405, { error: "Method not allowed" });
+        return true;
+      }
+      deps.writeJson(res, 200, buildCarrierSettingsOptions());
+      return true;
+    }
+    const mutation = parseCarrierMutation(pathname);
+    if (!mutation) return false;
+    await handleCarrierMutation(req, res, deps, controller, mutation);
+    return true;
+  };
+}
+function buildCarrierSettingsState(registry3) {
+  const defaultsByCarrier = buildDefaultsByCarrier(registry3);
+  const snapshot = readCarriersSnapshot(defaultsByCarrier);
+  return {
+    generation: snapshot.generation,
+    carriers: getRegisteredOrder(registry3).map((carrierId) => {
+      const config2 = requireCarrierConfig(registry3, carrierId);
+      const resolved = snapshot.carriers[carrierId] ?? fallbackResolvedState(config2);
+      return toCarrierSettingsCarrier(registry3, config2, resolved);
+    })
+  };
+}
+function buildCarrierSettingsOptions() {
+  return {
+    cliTypes: getCliTypes().map(toCliOption),
+    taskForceConstraints: { minBackends: TASKFORCE_MIN_BACKENDS }
+  };
+}
+async function handleCarrierMutation(req, res, deps, controller, mutation) {
+  const method = req.method ?? "GET";
+  const expectedMethod = mutation.kind === "display-name" ? "PATCH" : mutation.kind === "taskforce-backend" || mutation.kind === "taskforce-all" ? method : "PUT";
+  if (!isExpectedCarrierMethod(mutation, method, expectedMethod)) {
+    deps.writeJson(res, 405, { error: "Method not allowed" });
+    return;
+  }
+  if (!deps.isAuthorized(req)) {
+    deps.writeJson(res, 401, { error: "unauthorized" });
+    return;
+  }
+  if (!isJsonRequest(req)) {
+    deps.writeJson(res, 415, { error: "unsupported_media_type" });
+    return;
+  }
+  if (!getRegisteredCarrierConfig(deps.registry, mutation.carrierId)) {
+    deps.writeJson(res, 404, { error: "carrier_not_found" });
+    return;
+  }
+  if (mutation.kind === "taskforce-backend" && !isCliType(mutation.cliType)) {
+    deps.writeJson(res, 400, { error: "invalid_cli_type" });
+    return;
+  }
+  try {
+    if (mutation.kind === "cli") {
+      const body2 = await readRequiredJsonBody(req, res, deps);
+      if (!body2.ok) return;
+      await mutateCarrierCli(res, deps, controller, mutation.carrierId, body2.body);
+      return;
+    }
+    if (mutation.kind === "model") {
+      const body2 = await readRequiredJsonBody(req, res, deps);
+      if (!body2.ok) return;
+      await mutateCarrierModel(res, deps, mutation.carrierId, body2.body);
+      return;
+    }
+    if (mutation.kind === "display-name") {
+      const body2 = await readRequiredJsonBody(req, res, deps);
+      if (!body2.ok) return;
+      mutateDisplayName(res, deps, mutation.carrierId, body2.body);
+      return;
+    }
+    if (mutation.kind === "agent-mode") {
+      const body2 = await readRequiredJsonBody(req, res, deps);
+      if (!body2.ok) return;
+      mutateAgentMode(res, deps, mutation.carrierId, body2.body);
+      return;
+    }
+    if (mutation.kind === "taskforce-backend") {
+      if (method === "DELETE") {
+        const body3 = await readRequiredJsonBody(req, res, deps);
+        if (!body3.ok) return;
+        resetTaskForceModelSelection(mutation.carrierId, mutation.cliType);
+        refreshTaskForceConfiguredCarriers(deps.registry);
+        writeMutationState(res, deps);
+        return;
+      }
+      const body2 = await readRequiredJsonBody(req, res, deps);
+      if (!body2.ok) return;
+      mutateTaskForceBackend(res, deps, mutation.carrierId, mutation.cliType, body2.body);
+      return;
+    }
+    const body = await readRequiredJsonBody(req, res, deps);
+    if (!body.ok) return;
+    resetCarrierTaskForceConfig(mutation.carrierId);
+    refreshTaskForceConfiguredCarriers(deps.registry);
+    writeMutationState(res, deps);
+  } catch (error51) {
+    deps.writeJson(res, 400, { error: error51 instanceof Error ? error51.message : "invalid_request" });
+  }
+}
+async function mutateCarrierCli(res, deps, controller, carrierId, body) {
+  const cliType = readCliType(body.cliType);
+  if (!cliType) {
+    deps.writeJson(res, 400, { error: "invalid_cli_type" });
+    return;
+  }
+  await controller.changeCliType(carrierId, cliType);
+  if (!SUBAGENT_CLI_TYPES.has(cliType)) {
+    const resolved = readCarriersSnapshot(buildDefaultsByCarrier(deps.registry)).carriers[carrierId];
+    if (resolved?.agentMode === "subagent") {
+      const config2 = requireCarrierConfig(deps.registry, carrierId);
+      updateCarrierAgentModeAtomically(carrierId, "cli", config2.defaultAgentMode ?? "cli");
+    }
+  }
+  writeMutationState(res, deps);
+}
+async function mutateCarrierModel(res, deps, carrierId, body) {
+  const config2 = requireCarrierConfig(deps.registry, carrierId);
+  const cliType = resolveAgentCliType2(carrierId, config2.defaultCliType);
+  const selection = readSelection(cliType, body);
+  if (!selection) {
+    deps.writeJson(res, 400, { error: "invalid_model_selection" });
+    return;
+  }
+  await updateAgentCliSelection(carrierId, cliType, selection);
+  notifyStatusUpdate(deps.registry);
+  writeMutationState(res, deps);
+}
+function mutateDisplayName(res, deps, carrierId, body) {
+  const displayName = normalizeCarrierDisplayNameInput(body.displayName);
+  if (displayName === null) {
+    deps.writeJson(res, 400, { error: "invalid_display_name" });
+    return;
+  }
+  updateCarrierDisplayName(carrierId, displayName, getCarrierSourceDisplayName(deps.registry, carrierId));
+  notifyStatusUpdate(deps.registry);
+  writeMutationState(res, deps);
+}
+function mutateAgentMode(res, deps, carrierId, body) {
+  const config2 = requireCarrierConfig(deps.registry, carrierId);
+  const agentMode = body.agentMode;
+  if (agentMode !== "cli" && agentMode !== "subagent") {
+    deps.writeJson(res, 400, { error: "invalid_agent_mode" });
+    return;
+  }
+  const cliType = resolveAgentCliType2(carrierId, config2.defaultCliType);
+  if (agentMode === "subagent" && !SUBAGENT_CLI_TYPES.has(cliType)) {
+    deps.writeJson(res, 400, { error: "subagent_unsupported" });
+    return;
+  }
+  updateCarrierAgentModeAtomically(carrierId, agentMode, config2.defaultAgentMode ?? "cli");
+  if (agentMode === "subagent") refreshTaskForceConfiguredCarriers(deps.registry);
+  notifyStatusUpdate(deps.registry);
+  writeMutationState(res, deps);
+}
+function mutateTaskForceBackend(res, deps, carrierId, cliType, body) {
+  const selection = readSelection(cliType, body);
+  if (!selection) {
+    deps.writeJson(res, 400, { error: "invalid_model_selection" });
+    return;
+  }
+  updateTaskForceBackendAtomically(carrierId, cliType, selection);
+  refreshTaskForceConfiguredCarriers(deps.registry);
+  notifyStatusUpdate(deps.registry);
+  writeMutationState(res, deps);
+}
+function writeMutationState(res, deps) {
+  const response = { state: buildCarrierSettingsState(deps.registry) };
+  deps.writeJson(res, 200, response);
+}
+async function readRequiredJsonBody(req, res, deps) {
+  const body = await deps.readJsonBody(req);
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    deps.writeJson(res, 400, { error: "invalid_json" });
+    return { ok: false };
+  }
+  return { ok: true, body };
+}
+function buildDefaultsByCarrier(registry3) {
+  return Object.fromEntries(
+    getRegisteredOrder(registry3).map((carrierId) => {
+      const config2 = requireCarrierConfig(registry3, carrierId);
+      return [carrierId, {
+        cliType: config2.defaultCliType,
+        ...config2.defaultAgentMode ? { defaultAgentMode: config2.defaultAgentMode } : {},
+        ...buildCarrierModelDefaults(config2, config2.defaultCliType)
+      }];
+    })
+  );
+}
+function toCarrierSettingsCarrier(registry3, config2, resolved) {
+  const cliType = resolved.agentCliType ?? config2.defaultCliType;
+  const selection = resolved.agentCli[cliType] ?? readDefaultSelection(cliType);
+  const taskForceBackends = toTaskForceBackends(resolved.taskforce);
+  return {
+    carrierId: config2.id,
+    displayName: resolved.displayName ?? getCarrierSourceDisplayName(registry3, config2.id),
+    sourceDisplayName: getCarrierSourceDisplayName(registry3, config2.id),
+    role: config2.carrierMetadata?.title ?? config2.displayName,
+    roleDescription: config2.carrierMetadata?.summary ?? "",
+    ...config2.carrierMetadata?.category ? { category: config2.carrierMetadata.category } : {},
+    slot: config2.slot,
+    cliType,
+    defaultCliType: config2.defaultCliType,
+    model: selection.model,
+    ...selection.effort ? { effort: selection.effort } : {},
+    agentMode: resolved.agentMode,
+    subagentMode: resolved.agentMode === "subagent",
+    taskForceBackendCount: taskForceBackends.length,
+    taskforce: { backends: taskForceBackends }
+  };
+}
+function toTaskForceBackends(taskforce) {
+  return TASKFORCE_CLI_TYPES.map((cliType) => {
+    const selection = taskforce[cliType];
+    if (!selection) return null;
+    return {
+      cliType,
+      model: selection.model,
+      ...selection.effort ? { effort: selection.effort } : {}
+    };
+  }).filter((backend) => backend !== null);
+}
+function toCliOption(cliType) {
+  const provider = getProviderModels(cliType);
+  return {
+    id: cliType,
+    displayName: CLI_DISPLAY_NAMES[cliType] ?? provider.name,
+    supportsSubagent: SUBAGENT_CLI_TYPES.has(cliType),
+    models: provider.models.map((model) => {
+      const effort = getEffort(cliType, model.modelId);
+      return {
+        modelId: model.modelId,
+        name: model.name,
+        ...effort.supported ? { effort: { levels: effort.levels, default: effort.default } } : {}
+      };
+    }),
+    defaultModel: provider.defaultModel ?? provider.models[0]?.modelId
+  };
+}
+function createStatusOverlayController(registry3) {
+  return new StatusOverlayController({
+    getEntries: () => [],
+    getRegisteredOrder: () => getRegisteredOrder(registry3),
+    getCarrierConfig: (carrierId) => getRegisteredCarrierConfig(registry3, carrierId),
+    getResolvedCliType: (carrierId) => {
+      const config2 = getRegisteredCarrierConfig(registry3, carrierId);
+      return config2 ? resolveAgentCliType2(carrierId, config2.defaultCliType) : void 0;
+    },
+    getCurrentModelSelection: (carrierId) => {
+      return readCurrentModelSelection(registry3, carrierId);
+    },
+    getAvailableModels: (cliType) => {
+      const provider = getProviderModels(cliType);
+      return {
+        defaultModel: provider.defaultModel,
+        models: provider.models.map((model) => ({
+          modelId: model.modelId,
+          name: model.name,
+          effort: getEffort(cliType, model.modelId)
+        }))
+      };
+    },
+    getEffort: (cliType, modelId) => getEffort(cliType, modelId),
+    getAgentCliSelection: (carrierId, cliType) => getAgentCliSelection(carrierId, cliType),
+    saveAgentCliSelection,
+    updateCarrierCliType: (carrierId, cliType) => updateCarrierCliType(registry3, carrierId),
+    applyAgentCliTypeSelectionUpdate,
+    refreshAgentPanel: () => void 0,
+    syncModelConfig: () => void 0,
+    notifyStatusUpdate: () => notifyStatusUpdate(registry3)
+  });
+}
+function updateCarrierAgentModeAtomically(carrierId, agentMode, defaultAgentMode) {
+  if (agentMode === "cli") {
+    setCarrierAgentMode(carrierId, false, defaultAgentMode);
+    return;
+  }
+  updateCarriers((states) => {
+    const carriers = { ...states.carriers ?? {} };
+    const current = carriers[carrierId] ?? {};
+    const next = { ...current };
+    next.agentMode = "subagent";
+    delete next.taskforce;
+    carriers[carrierId] = next;
+    states.carriers = carriers;
+  });
+}
+function updateTaskForceBackendAtomically(carrierId, cliType, selection) {
+  updateCarriers((states) => {
+    const carriers = { ...states.carriers ?? {} };
+    const current = carriers[carrierId] ?? {};
+    carriers[carrierId] = {
+      ...current,
+      agentMode: "cli",
+      taskforce: {
+        ...current.taskforce ?? {},
+        [cliType]: selection
+      }
+    };
+    states.carriers = carriers;
+  });
+}
+function refreshTaskForceConfiguredCarriers(registry3) {
+  setTaskForceConfiguredCarriers(registry3, getConfiguredTaskForceCarrierIds(getRegisteredOrder(registry3)));
+  notifyStatusUpdate(registry3);
+}
+function readSelection(cliType, body) {
+  if (typeof body.model !== "string") return null;
+  const provider = getProviderModels(cliType);
+  if (!provider.models.some((model) => model.modelId === body.model)) return null;
+  const effort = getEffort(cliType, body.model);
+  if (!effort.supported) {
+    return body.effort === void 0 ? { model: body.model } : null;
+  }
+  if (typeof body.effort !== "string" || !effort.levels.includes(body.effort)) return null;
+  return { model: body.model, effort: body.effort };
+}
+function readDefaultSelection(cliType) {
+  const provider = getProviderModels(cliType);
+  const model = provider.defaultModel;
+  const effort = getEffort(cliType, model);
+  return {
+    model,
+    ...effort.supported ? { effort: effort.default } : {}
+  };
+}
+function readCurrentModelSelection(registry3, carrierId) {
+  const config2 = getRegisteredCarrierConfig(registry3, carrierId);
+  if (!config2) return void 0;
+  const defaults = {
+    [carrierId]: {
+      cliType: config2.defaultCliType,
+      ...config2.defaultAgentMode ? { defaultAgentMode: config2.defaultAgentMode } : {},
+      ...buildCarrierModelDefaults(config2, config2.defaultCliType)
+    }
+  };
+  const resolved = readCarriersSnapshot(defaults).carriers[carrierId] ?? fallbackResolvedState(config2);
+  const cliType = resolved.agentCliType ?? config2.defaultCliType;
+  return resolved.agentCli[cliType] ?? readDefaultSelection(cliType);
+}
+function fallbackResolvedState(config2) {
+  return {
+    agentMode: config2.defaultAgentMode ?? "cli",
+    agentCliType: config2.defaultCliType,
+    agentCli: { [config2.defaultCliType]: readDefaultSelection(config2.defaultCliType) },
+    taskforce: {}
+  };
+}
+function parseCarrierMutation(pathname) {
+  const parts = pathname.split("/").filter(Boolean);
+  if (parts[0] !== "carrier-settings" || parts[1] !== "carriers" || !parts[2]) return null;
+  const carrierId = safeDecodeURIComponent(parts[2]);
+  if (!carrierId) return null;
+  if (parts.length === 4 && parts[3] === "cli") return { kind: "cli", carrierId };
+  if (parts.length === 4 && parts[3] === "model") return { kind: "model", carrierId };
+  if (parts.length === 4 && parts[3] === "display-name") return { kind: "display-name", carrierId };
+  if (parts.length === 4 && parts[3] === "agent-mode") return { kind: "agent-mode", carrierId };
+  if (parts.length === 4 && parts[3] === "taskforce") return { kind: "taskforce-all", carrierId };
+  if (parts.length === 5 && parts[3] === "taskforce") {
+    const cliType = safeDecodeURIComponent(parts[4] ?? "");
+    return cliType ? { kind: "taskforce-backend", carrierId, cliType } : null;
+  }
+  return null;
+}
+function safeDecodeURIComponent(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return null;
+  }
+}
+function isExpectedCarrierMethod(mutation, method, expectedMethod) {
+  if (mutation.kind === "taskforce-backend") return method === "PUT" || method === "DELETE";
+  if (mutation.kind === "taskforce-all") return method === "DELETE";
+  return method === expectedMethod;
+}
+function isJsonRequest(req) {
+  const contentType = req.headers["content-type"];
+  return typeof contentType === "string" && contentType.toLowerCase().split(";")[0]?.trim() === "application/json";
+}
+function readCliType(value) {
+  return typeof value === "string" && isCliType(value) ? value : null;
+}
+function isCliType(value) {
+  return Object.prototype.hasOwnProperty.call(CLI_BACKENDS, value);
+}
+function getCliTypes() {
+  return Object.keys(CLI_BACKENDS);
+}
+function requireCarrierConfig(registry3, carrierId) {
+  const config2 = getRegisteredCarrierConfig(registry3, carrierId);
+  if (!config2) throw new Error(`Carrier not found: ${carrierId}`);
+  return config2;
+}
+
 // src/codex/security-headers.ts
 var CONTENT_SECURITY_POLICY = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'none'";
 var SECURITY_HEADERS = {
@@ -39822,7 +40363,7 @@ function safeEqual(left, right) {
   return timingSafeEqual(leftBytes, rightBytes);
 }
 function workspaceHash(canonicalCwd) {
-  return crypto3.createHash("sha256").update(canonicalCwd).digest("hex").slice(0, 12);
+  return crypto5.createHash("sha256").update(canonicalCwd).digest("hex").slice(0, 12);
 }
 async function canonicalizeTheaterPath(cwd) {
   return canonicalizeTheaterPathSync(cwd);
@@ -40702,7 +41243,7 @@ function createCodexGateway(deps) {
       return true;
     }
     if (selected.kind === "no-workspace") {
-      if (isJsonRequest(request)) {
+      if (isJsonRequest2(request)) {
         sendJson2(response, 404, { error: "no_workspace_registered" });
         return true;
       }
@@ -40814,7 +41355,7 @@ function legacyWorkspacePath(url2) {
   }
   return null;
 }
-function isJsonRequest(request) {
+function isJsonRequest2(request) {
   const accept = Array.isArray(request.headers.accept) ? request.headers.accept.join(",") : request.headers.accept ?? "";
   const requestedWith = Array.isArray(request.headers["x-requested-with"]) ? request.headers["x-requested-with"].join(",") : request.headers["x-requested-with"] ?? "";
   return accept.includes("application/json") || requestedWith.toLowerCase() === "xmlhttprequest";
@@ -40889,6 +41430,155 @@ function readRawHeaderValues(rawHeaders, name) {
 function stripIpv6Brackets2(host) {
   return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
 }
+var STATE_VERSION = 1;
+var STATE_LOCK_DIR_NAME = "state.lock";
+var STATE_LOCK_OWNER_FILE_NAME = "owner.json";
+var STATE_TEMP_PREFIX = ".state.";
+function createConsoleDurableStateStore(deps = {}) {
+  const paths = deps.paths ?? createConsoleDataPaths();
+  const createStore = deps.createStore ?? createDurableJsonStore;
+  return createStore({
+    filePath: paths.stateFile,
+    lockDir: path93__default.join(paths.dir, STATE_LOCK_DIR_NAME),
+    lockOwnerFileName: STATE_LOCK_OWNER_FILE_NAME,
+    now: deps.now,
+    sanitize: sanitizeDurableConsoleState,
+    sensitivity: "sensitive",
+    tempCleanupPrefix: STATE_TEMP_PREFIX
+  });
+}
+function sanitizeDurableConsoleState(value) {
+  if (!isRecord4(value) || value.version !== STATE_VERSION) return emptyDurableConsoleState();
+  return {
+    version: STATE_VERSION,
+    theaters: readTheaterRegistrations(value.theaters),
+    operations: readDurableOperations(value.operations)
+  };
+}
+function emptyDurableConsoleState() {
+  return { version: STATE_VERSION, theaters: [], operations: [] };
+}
+function readProviderSessionCapture(fleetSessionId, deps = {}) {
+  if (!isSafeCaptureId(fleetSessionId)) return null;
+  const capturesDir = deps.capturesDir ?? createConsoleDataPaths().capturesDir;
+  const filePath = path93__default.join(capturesDir, `${fleetSessionId}.json`);
+  try {
+    const parsed = JSON.parse(fs5__default.readFileSync(filePath, "utf8"));
+    return sanitizeProviderSession(parsed);
+  } catch {
+    return null;
+  }
+}
+function mergeProviderSessionCaptures(state, deps = {}) {
+  let changed = false;
+  const operations = state.operations.map((operation) => {
+    if (operation.providerSession) return operation;
+    const providerSession = readProviderSessionCapture(operation.sessionId, deps);
+    if (!providerSession) return operation;
+    changed = true;
+    return { ...operation, providerSession };
+  });
+  return changed ? { ...state, operations } : state;
+}
+function unlinkProviderSessionCapture(fleetSessionId, deps = {}) {
+  if (!isSafeCaptureId(fleetSessionId)) return false;
+  const capturesDir = deps.capturesDir ?? createConsoleDataPaths().capturesDir;
+  try {
+    fs5__default.unlinkSync(path93__default.join(capturesDir, `${fleetSessionId}.json`));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function cleanupProviderSessionCaptures(state, deps = {}) {
+  for (const operation of state.operations) {
+    if (operation.providerSession) unlinkProviderSessionCapture(operation.sessionId, deps);
+  }
+}
+function readTheaterRegistrations(value) {
+  if (!Array.isArray(value)) return [];
+  const registrations = [];
+  for (const item of value) {
+    const registration = sanitizeTheaterRegistration(item);
+    if (registration) registrations.push(registration);
+  }
+  return registrations;
+}
+function readDurableOperations(value) {
+  if (!Array.isArray(value)) return [];
+  const operations = [];
+  for (const item of value) {
+    const operation = sanitizeDurableOperation(item);
+    if (operation) operations.push(operation);
+  }
+  return operations;
+}
+function sanitizeTheaterRegistration(value) {
+  if (!isRecord4(value)) return null;
+  const id = readNonEmptyString(value.id);
+  const theaterPath = readNonEmptyString(value.path);
+  const realpath = readNonEmptyString(value.realpath);
+  const label = readNonEmptyString(value.label);
+  const registeredAt = readNonEmptyString(value.registeredAt);
+  const lastOpenedAt = readNonEmptyString(value.lastOpenedAt);
+  if (!id || !theaterPath || !realpath || !label || !registeredAt || !lastOpenedAt) return null;
+  return { id, path: theaterPath, realpath, label, registeredAt, lastOpenedAt };
+}
+function sanitizeDurableOperation(value) {
+  if (!isRecord4(value)) return null;
+  const sessionId = readNonEmptyString(value.sessionId);
+  const theaterId = readNonEmptyString(value.theaterId);
+  const cwd = readNonEmptyString(value.cwd);
+  const cwdLabel = readNonEmptyString(value.cwdLabel);
+  const sequence = readPositiveInteger(value.sequence);
+  const createdAt = readFiniteNumber(value.createdAt);
+  if (!sessionId || !theaterId || !cwd || !cwdLabel || sequence === null || createdAt === null) return null;
+  const providerSession = sanitizeProviderSession(value.providerSession);
+  return {
+    sessionId,
+    theaterId,
+    cwd,
+    cwdLabel,
+    sequence,
+    ...readOptionalString(value.label) ? { label: readOptionalString(value.label) } : {},
+    ...readOptionalString(value.cliId) ? { cliId: readOptionalString(value.cliId) } : {},
+    ...readOptionalString(value.cliLabel) ? { cliLabel: readOptionalString(value.cliLabel) } : {},
+    createdAt,
+    ...providerSession ? { providerSession } : {}
+  };
+}
+function sanitizeProviderSession(value) {
+  if (!isRecord4(value)) return null;
+  const provider = value.provider === "claude" || value.provider === "codex" ? value.provider : null;
+  const sessionId = readNonEmptyString(value.sessionId);
+  const capturedAt = readNonEmptyString(value.capturedAt);
+  if (!provider || !sessionId || !capturedAt) return null;
+  return {
+    provider,
+    sessionId,
+    ...readOptionalString(value.transcriptPath) ? { transcriptPath: readOptionalString(value.transcriptPath) } : {},
+    ...readOptionalString(value.source) ? { source: readOptionalString(value.source) } : {},
+    capturedAt
+  };
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSafeCaptureId(value) {
+  return value.length > 0 && path93__default.basename(value) === value && !value.includes(path93__default.sep) && !value.includes(path93__default.posix.sep);
+}
+function readNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function readOptionalString(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function readPositiveInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : null;
+}
+function readFiniteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
 
 // src/observability-routes.ts
 function writeObserverEvents(req, res, workspace, store2) {
@@ -41099,15 +41789,71 @@ function createConsoleObservabilityStore(deps = {}) {
     terminalSessionsById.set(state.sessionId, state);
     return toTerminalSessionInfo(state);
   }
+  function injectDormantOperation(operation) {
+    const currentSequence = terminalSequenceByTheater.get(operation.theaterId) ?? 0;
+    terminalSequenceByTheater.set(operation.theaterId, Math.max(currentSequence, operation.sequence));
+    const state = {
+      sessionId: operation.sessionId,
+      cwd: operation.cwd,
+      canonicalCwd: canonicalizeTheaterPathSync(operation.cwd),
+      cwdLabel: operation.cwdLabel,
+      sequence: operation.sequence,
+      label: operation.label,
+      cliId: operation.cliId,
+      cliLabel: operation.cliLabel,
+      createdAt: operation.createdAt,
+      theaterId: operation.theaterId,
+      terminalSessionId: operation.sessionId,
+      status: "dormant",
+      providerSession: operation.providerSession
+    };
+    terminalSessionsById.set(state.sessionId, state);
+    return toTerminalSessionInfo(state);
+  }
   function listTerminalSessions() {
     return Array.from(terminalSessionsById.values()).map(toTerminalSessionInfo).sort((a, b) => b.createdAt - a.createdAt);
   }
+  function listDurableOperations() {
+    return Array.from(terminalSessionsById.values()).map((session) => ({
+      sessionId: session.sessionId,
+      theaterId: session.theaterId,
+      cwd: session.cwd,
+      cwdLabel: session.cwdLabel,
+      sequence: session.sequence,
+      ...session.label ? { label: session.label } : {},
+      ...session.cliId ? { cliId: session.cliId } : {},
+      ...session.cliLabel ? { cliLabel: session.cliLabel } : {},
+      createdAt: session.createdAt,
+      ...session.providerSession ? { providerSession: session.providerSession } : {}
+    }));
+  }
+  function getDurableOperation(sessionId) {
+    return listDurableOperations().find((operation) => operation.sessionId === sessionId) ?? null;
+  }
+  function updateTerminalSessionProviderSession(sessionId, providerSession) {
+    const session = terminalSessionsById.get(sessionId);
+    if (!session) return null;
+    session.providerSession = providerSession;
+    return toTerminalSessionInfo(session);
+  }
   function updateTerminalSessionStatus(sessionId, status) {
     const session = terminalSessionsById.get(sessionId);
     if (!session) return null;
     session.status = status;
     return toTerminalSessionInfo(session);
   }
+  function transitionTerminalSessionToDormant(sessionId, providerSession) {
+    const session = terminalSessionsById.get(sessionId);
+    if (!session) return null;
+    const workspace = workspacesByCliRunId.get(sessionId);
+    if (workspace?.terminalSessionId === sessionId) {
+      removeWorkspaceIndexes(workspace);
+      workspacesByCliRunId.delete(sessionId);
+    }
+    session.status = "dormant";
+    session.providerSession = providerSession;
+    return toTerminalSessionInfo(session);
+  }
   function renameTerminalSession(sessionId, rawLabel) {
     const session = terminalSessionsById.get(sessionId);
     if (!session) return null;
@@ -41147,18 +41893,23 @@ function createConsoleObservabilityStore(deps = {}) {
     clear,
     getLaunchCwd,
     getTruncation,
+    getDurableOperation,
     getWorkspace,
     listEvents,
     listJobs,
+    listDurableOperations,
     listTerminalSessions,
     listWorkspaces,
     appendTerminalRuntimeEvent,
     createPendingTerminalSession,
+    injectDormantOperation,
     notifySessionUpdated,
     renameTerminalSession,
     subscribe,
     subscribeAll,
+    updateTerminalSessionProviderSession,
     updateTerminalSessionStatus,
+    transitionTerminalSessionToDormant,
     removeTerminalSession,
     registerTerminalRuntimeSession,
     workspaceCount: () => listWorkspaces().length
@@ -41230,7 +41981,8 @@ function toTerminalSessionInfo(state) {
     theaterId: state.theaterId,
     registrationId: state.registrationId,
     cliRunId: state.cliRunId,
-    tenantId: state.cliRunId
+    tenantId: state.cliRunId,
+    resumeAvailable: state.providerSession !== void 0
   };
 }
 function pruneTenantJobs(state) {
@@ -41444,7 +42196,7 @@ function resolveConsolePath(pathname) {
 var GRANT_ID_BYTES = 24;
 var DEFAULT_GRANT_TTL_MS = 6e4;
 function createFolderGrantStore(deps = {}) {
-  const randomId = deps.randomId ?? (() => crypto3.randomBytes(GRANT_ID_BYTES).toString("base64url"));
+  const randomId = deps.randomId ?? (() => crypto5.randomBytes(GRANT_ID_BYTES).toString("base64url"));
   const statSync5 = deps.statSync ?? fs5__default.statSync;
   const ttlMs = deps.ttlMs ?? DEFAULT_GRANT_TTL_MS;
   const now = deps.now ?? Date.now;
@@ -41659,6 +42411,31 @@ function buildConsoleHookCommand(entry) {
   }
   throw new Error(`Unsupported Fleet Console session hook entry extension: ${extension}`);
 }
+function buildConsoleCaptureHookCommand(entry, cliId) {
+  const extension = path93__default.extname(entry.entryPath);
+  if (JAVASCRIPT_ENTRY_EXTENSIONS.has(extension)) {
+    return createSessionCaptureHookExec({
+      entryPath: entry.entryPath,
+      execPath: entry.execPath,
+      provider: toCaptureProvider(cliId)
+    });
+  }
+  if (TYPESCRIPT_ENTRY_EXTENSIONS.has(extension)) {
+    if (!entry.tsxLoaderPath) {
+      throw new Error("Fleet Console capture session hook requires a tsx loader path");
+    }
+    return createSessionCaptureHookExec({
+      entryPath: entry.entryPath,
+      execPath: entry.execPath,
+      provider: toCaptureProvider(cliId),
+      tsxLoader: entry.tsxLoaderPath
+    });
+  }
+  throw new Error(`Unsupported Fleet Console session hook entry extension: ${extension}`);
+}
+function toCaptureProvider(cliId) {
+  return cliId === "codex" ? "codex" : "claude";
+}
 function runCodexCommand(command2) {
   const result = spawnSync(command2.bin, command2.args, {
     cwd: command2.cwd,
@@ -41684,12 +42461,12 @@ var CONSOLE_ENTRY_PATH = fileURLToPath(import.meta.url);
 var HOOK_ENTRY_EXTENSIONS = /* @__PURE__ */ new Set([".cjs", ".cts", ".js", ".mjs", ".mts", ".ts", ".tsx"]);
 var require2 = createRequire(import.meta.url);
 function createDefaultTerminalLaunchResolver(deps = {}) {
-  const baseCwd = deps.cwd ?? process4.cwd();
-  const env = deps.env ?? process4.env;
-  const execPath = deps.execPath ?? process4.execPath;
+  const baseCwd = deps.cwd ?? process5.cwd();
+  const env = deps.env ?? process5.env;
+  const execPath = deps.execPath ?? process5.execPath;
   const homedir3 = deps.homedir ?? DEFAULT_TERMINAL_CWD_FALLBACK;
-  const platform = deps.platform ?? process4.platform;
-  const entryPath = resolveHookEntryPath(deps.entryPath ?? process4.argv[1]);
+  const platform = deps.platform ?? process5.platform;
+  const entryPath = resolveHookEntryPath(deps.entryPath ?? process5.argv[1]);
   const tsxLoaderPath = deps.tsxLoaderPath ?? resolveOptionalPackage("tsx");
   const dataDir = deps.dataDir ?? getFleetDataDir();
   const infraServices = deps.infraServices ?? createInfraServices();
@@ -41729,6 +42506,7 @@ function createDefaultTerminalLaunchResolver(deps = {}) {
       onRuntimeSessionStart: deps.onRuntimeSessionStart,
       resolveProfile,
       cliId: context?.cliId,
+      resumeSessionId: context?.resumeSessionId,
       sessionId
     });
   };
@@ -41749,7 +42527,7 @@ function hasHookEntryExtension(entryPath) {
 }
 function startTerminalShell(launch, size) {
   const { spawn: spawnPty } = require2("node-pty");
-  const useConptyDll = resolveUseConptyDll(process4.platform, process4.env);
+  const useConptyDll = resolveUseConptyDll(process5.platform, process5.env);
   return spawnPty(launch.bin, [...launch.args], {
     cols: size.cols,
     rows: size.rows,
@@ -41774,7 +42552,8 @@ async function createAgentCliLaunchSpec(options) {
     const profile = await options.resolveProfile(options.env, options.cwd, {
       authEnvResolver: options.authEnvResolver,
       authService: options.infraServices.authService,
-      cliId: options.cliId
+      cliId: options.cliId,
+      resumeSessionId: options.resumeSessionId
     });
     const injectedProfile = await options.injectProfile(profile, {
       buildSystemPrompt: (injectTone) => createSystemPromptBuilder({ carrierRuntime: agentRuntime.carrierRuntime }).build(injectTone),
@@ -41783,9 +42562,11 @@ async function createAgentCliLaunchSpec(options) {
       dataDir: options.dataDir,
       dedicatedMcpSession: agentRuntime.dedicatedMcpSession,
       enableMetaphor: false,
+      captureSessionHookExec: buildConsoleCaptureHookCommand(options.hookEntry, profile.id),
       hookExec: buildConsoleHookCommand(options.hookEntry),
       onCleanup: (cleanup) => cleanupStack.push(cleanup),
-      replaceSystemPrompt: true,
+      replaceSystemPrompt: false,
+      resumeSessionId: options.resumeSessionId,
       withMarketplaceLock: withConsoleMarketplaceLock,
       mcpSessionLabel: options.sessionId
     });
@@ -41819,6 +42600,7 @@ function toLaunchSpec(profile, cleanup) {
     cwd: profile.cwd,
     env: { ...profile.env },
     messagePolicy: profile.messagePolicy,
+    renameCommand: profile.renameCommand,
     terminalName: profile.terminalName
   };
 }
@@ -41912,6 +42694,9 @@ function createTerminalSessionManager(deps) {
   function getSessionMessagePolicy(sessionId) {
     return sessions.get(sessionId)?.messagePolicy;
   }
+  function getSessionRenameCommand(sessionId) {
+    return sessions.get(sessionId)?.renameCommand;
+  }
   function writeToSession(sessionId, data) {
     const session = sessions.get(sessionId);
     if (!session || typeof session.pty.write !== "function") return false;
@@ -41949,7 +42734,7 @@ function createTerminalSessionManager(deps) {
     }
   }
   async function launchSession(context) {
-    const launch = await deps.launch(context.cwd, { sessionId: context.sessionId, kind: context.kind, cliId: context.cliId });
+    const launch = await deps.launch(context.cwd, { sessionId: context.sessionId, kind: context.kind, cliId: context.cliId, resumeSessionId: context.resumeSessionId });
     let pty;
     try {
       pty = startShell(launch, { cols: DEFAULT_COLS, rows: DEFAULT_ROWS });
@@ -41964,6 +42749,7 @@ function createTerminalSessionManager(deps) {
       scrollback: [],
       cleanup: launch.cleanup,
       messagePolicy: launch.messagePolicy,
+      renameCommand: launch.renameCommand,
       activeSocket: null,
       cols: DEFAULT_COLS,
       rows: DEFAULT_ROWS
@@ -42028,7 +42814,7 @@ function createTerminalSessionManager(deps) {
       await runLaunchCleanup(session.cleanup);
     }
   }
-  return { canAttach, createSession, attach, getSessionMessagePolicy, terminate, stop, writeToSession };
+  return { canAttach, createSession, attach, getSessionMessagePolicy, getSessionRenameCommand, terminate, stop, writeToSession };
 }
 async function runLaunchCleanup(cleanup) {
   try {
@@ -42058,7 +42844,7 @@ var DEFAULT_TICKET_TTL_MS = 1e4;
 function createTerminalTicketRegistry(deps = {}) {
   const ttlMs = deps.ttlMs ?? DEFAULT_TICKET_TTL_MS;
   const now = deps.now ?? Date.now;
-  const randomTicket = deps.randomTicket ?? (() => crypto3.randomBytes(32).toString("base64url"));
+  const randomTicket = deps.randomTicket ?? (() => crypto5.randomBytes(32).toString("base64url"));
   const tickets = /* @__PURE__ */ new Map();
   function issue3(context) {
     prune();
@@ -42246,6 +43032,26 @@ var TheaterRegistry = class {
     this.#mruId = id;
     return item;
   }
+  load(items) {
+    this.restore(items);
+  }
+  restore(items) {
+    const restored = /* @__PURE__ */ new Map();
+    let mruId = null;
+    for (const item of items) {
+      const existing = restored.get(item.id);
+      if (existing && existing.realpath !== item.realpath) {
+        throw new Error("theater_id_collision");
+      }
+      restored.set(item.id, item);
+      if (!mruId || item.lastOpenedAt.localeCompare(restored.get(mruId)?.lastOpenedAt ?? "") > 0) {
+        mruId = item.id;
+      }
+    }
+    this.#items.clear();
+    for (const [id, item] of restored) this.#items.set(id, item);
+    this.#mruId = mruId;
+  }
   get(id) {
     return this.#items.get(id) ?? null;
   }
@@ -42255,6 +43061,11 @@ var TheaterRegistry = class {
   list() {
     return [...this.#items.values()].sort((left, right) => right.lastOpenedAt.localeCompare(left.lastOpenedAt));
   }
+  remove(id) {
+    const removed = this.#items.delete(id);
+    if (this.#mruId === id) this.#mruId = this.list()[0]?.id ?? null;
+    return removed;
+  }
 };
 
 // src/update-check.ts
@@ -42331,6 +43142,9 @@ function createConsoleServer(deps = {}) {
   const folderGrants = createFolderGrantStore();
   const infraServices = createInfraServices();
   const dataDir = deps.dataDir ?? getFleetDataDir();
+  initStore(dataDir);
+  const durablePaths = createConsoleDataPaths({ fleetDataDir: dataDir });
+  const durableStateStore = createConsoleDurableStateStore({ paths: durablePaths });
   const authEnvResolver = (cli) => resolveAuthEnv(cli, { authService: infraServices.authService });
   const ownsAgentRuntime = deps.agentRuntime === void 0;
   const agentRuntime = deps.agentRuntime ?? createFleetAgentRuntimeLifecycle({
@@ -42369,10 +43183,18 @@ function createConsoleServer(deps = {}) {
     }),
     startShell: deps.terminalStartShell,
     maxSessions: deps.maxTerminalSessions,
-    // PTY가 종료되면 콘솔 세션 목록에서도 제거해 잔존/재실행을 막는다.
     onSessionExit: (sessionId) => {
       pendingRuntimeSessions.delete(sessionId);
-      observability.removeTerminalSession(sessionId);
+      const operation = observability.getDurableOperation(sessionId);
+      const providerSession = operation?.providerSession ?? readProviderSessionCapture(sessionId, { capturesDir: durablePaths.capturesDir });
+      if (providerSession) {
+        observability.updateTerminalSessionProviderSession(sessionId, providerSession);
+        const dormant = observability.transitionTerminalSessionToDormant(sessionId, providerSession);
+        if (dormant) observability.notifySessionUpdated(dormant);
+      } else {
+        observability.removeTerminalSession(sessionId);
+      }
+      persistDurableState();
     }
   });
   const unsubscribeCarrierReminderRouter = createCarrierResultReminderRouter({
@@ -42404,6 +43226,12 @@ function createConsoleServer(deps = {}) {
   let activeEndpoint = null;
   let agentRuntimeStopped = false;
   let consoleResourcesDisposed = false;
+  const carrierSettingsRouter = createCarrierSettingsRouter({
+    registry: carrierRegistry,
+    isAuthorized: isTerminalAuthorized,
+    readJsonBody,
+    writeJson
+  });
   function handleRequest(req, res) {
     const pathname = getPathname(req);
     if (pathname === "/console/codex" || pathname.startsWith("/console/codex/")) {
@@ -42431,6 +43259,11 @@ function createConsoleServer(deps = {}) {
       runAsyncHandler(handleTerminalSessions(req, res), res);
       return;
     }
+    const terminalSessionResumeMatch = pathname.match(/^\/terminal\/sessions\/([^/]+)\/resume$/);
+    if (terminalSessionResumeMatch) {
+      runAsyncHandler(handleTerminalSessionResume(req, res, decodeURIComponent(terminalSessionResumeMatch[1] ?? "")), res);
+      return;
+    }
     const terminalSessionItemMatch = pathname.match(/^\/terminal\/sessions\/([^/]+)$/);
     if (terminalSessionItemMatch) {
       runAsyncHandler(handleTerminalSessionItem(req, res, decodeURIComponent(terminalSessionItemMatch[1] ?? "")), res);
@@ -42440,6 +43273,11 @@ function createConsoleServer(deps = {}) {
       runAsyncHandler(handleObserverTheaters(req, res), res);
       return;
     }
+    const theaterItemMatch = pathname.match(/^\/observer\/theaters\/([^/]+)$/);
+    if (theaterItemMatch) {
+      runAsyncHandler(handleObserverTheaterItem(req, res, decodeURIComponent(theaterItemMatch[1] ?? "")), res);
+      return;
+    }
     const theaterSessionMatch = pathname.match(/^\/observer\/theaters\/([^/]+)\/sessions$/);
     if (theaterSessionMatch) {
       runAsyncHandler(handleObserverTheaterSessions(req, res, decodeURIComponent(theaterSessionMatch[1] ?? "")), res);
@@ -42453,6 +43291,10 @@ function createConsoleServer(deps = {}) {
       handleObserverCarriers(req, res);
       return;
     }
+    if (pathname === "/carrier-settings" || pathname.startsWith("/carrier-settings/")) {
+      runAsyncBooleanHandler(carrierSettingsRouter({ req, res, pathname }), res);
+      return;
+    }
     if (pathname === "/observer/tenants") {
       handleObserverWorkspaces(req, res);
       return;
@@ -42571,6 +43413,17 @@ function createConsoleServer(deps = {}) {
     }
     await createTerminalSessionForCwd(cwd, res, cliId);
   }
+  function injectRenameCommand(sessionId, label) {
+    if (!label) return;
+    const renameCommand = terminalSessions.getSessionRenameCommand(sessionId);
+    if (!renameCommand) return;
+    const safeLabel = sanitizeCarrierResultReminder(label.replace(/[\r\n\t]+/g, " ")).trim();
+    if (safeLabel.length === 0) return;
+    const policy = terminalSessions.getSessionMessagePolicy(sessionId) ?? {};
+    for (const chunk of formatCarrierResultReminderMessage(policy, `${renameCommand} ${safeLabel}`)) {
+      terminalSessions.writeToSession(sessionId, chunk);
+    }
+  }
   async function handleTerminalSessionItem(req, res, sessionId) {
     if (req.method !== "DELETE" && req.method !== "PATCH") {
       writeJson(res, 405, { error: "Method not allowed" });
@@ -42592,13 +43445,62 @@ function createConsoleServer(deps = {}) {
         return;
       }
       observability.notifySessionUpdated(updated);
+      injectRenameCommand(sessionId, updated.label);
+      persistDurableState();
       writeJson(res, 200, updated);
       return;
     }
-    terminalSessions.terminate(sessionId);
-    observability.removeTerminalSession(sessionId);
+    forgetTerminalSession(sessionId);
     writeJson(res, 200, { ok: true });
   }
+  async function handleTerminalSessionResume(req, res, sessionId) {
+    if (req.method !== "POST") {
+      writeJson(res, 405, { error: "Method not allowed" });
+      return;
+    }
+    if (!isTerminalAuthorized(req)) {
+      writeJson(res, 401, { error: "unauthorized" });
+      return;
+    }
+    const dormantSession = observability.listTerminalSessions().find((session) => session.sessionId === sessionId && session.status === "dormant");
+    const operation = dormantSession ? observability.getDurableOperation(sessionId) : null;
+    if (!operation) {
+      writeJson(res, 404, { error: "session_not_found" });
+      return;
+    }
+    const cliId = readDurableAgentCliId(operation);
+    if (!cliId) {
+      writeJson(res, 409, { error: "resume_unavailable" });
+      return;
+    }
+    const providerSession = operation.providerSession ?? readProviderSessionCapture(sessionId, { capturesDir: durablePaths.capturesDir });
+    if (!providerSession) {
+      writeJson(res, 409, { error: "resume_unavailable" });
+      return;
+    }
+    observability.updateTerminalSessionProviderSession(sessionId, providerSession);
+    const starting = observability.updateTerminalSessionStatus(sessionId, "starting");
+    if (starting) observability.notifySessionUpdated(starting);
+    try {
+      await terminalSessions.createSession({ sessionId, cwd: operation.cwd, cliId, resumeSessionId: providerSession.sessionId });
+      const runtimeSession = pendingRuntimeSessions.get(sessionId);
+      pendingRuntimeSessions.delete(sessionId);
+      const resumed = runtimeSession ? observability.registerTerminalRuntimeSession(runtimeSession) ?? starting : observability.updateTerminalSessionStatus(sessionId, "terminal-only") ?? starting;
+      if (!resumed) {
+        writeJson(res, 404, { error: "session_not_found" });
+        return;
+      }
+      observability.notifySessionUpdated(resumed);
+      persistDurableState();
+      writeJson(res, 200, resumed);
+    } catch {
+      pendingRuntimeSessions.delete(sessionId);
+      const reverted = observability.updateTerminalSessionStatus(sessionId, "dormant");
+      if (reverted) observability.notifySessionUpdated(reverted);
+      persistDurableState();
+      writeJson(res, 503, { error: "terminal_unavailable" });
+    }
+  }
   async function handleObserverTheaters(req, res) {
     if (req.method === "GET") {
       writeJson(res, 200, { theaters: listTheaterInfos(), agentClis: getAgentCliMetadata() });
@@ -42631,8 +43533,28 @@ function createConsoleServer(deps = {}) {
         console.warn(`[fleet-console] Codex workspace registration skipped for Theater ${theater.id}: ${error51 instanceof Error ? error51.message : String(error51)}`);
       }
     }
+    persistDurableState();
     writeJson(res, 200, toTheaterInfo(theater, hasWiki));
   }
+  async function handleObserverTheaterItem(req, res, theaterId) {
+    if (req.method !== "DELETE") {
+      writeJson(res, 405, { error: "Method not allowed" });
+      return;
+    }
+    if (!isTerminalAuthorized(req)) {
+      writeJson(res, 401, { error: "unauthorized" });
+      return;
+    }
+    const operations = observability.listDurableOperations().filter((operation) => operation.theaterId === theaterId);
+    const removed = theaters.remove(theaterId);
+    if (!removed) {
+      writeJson(res, 404, { error: "theater_not_found" });
+      return;
+    }
+    for (const operation of operations) forgetTerminalSession(operation.sessionId, { persist: false });
+    persistDurableState();
+    writeJson(res, 200, { ok: true });
+  }
   async function handleObserverTheaterSessions(req, res, theaterId) {
     if (req.method !== "POST") {
       writeJson(res, 405, { error: "Method not allowed" });
@@ -42653,7 +43575,7 @@ function createConsoleServer(deps = {}) {
     await createTerminalSessionForCwd(theater.path, res, cliId);
   }
   async function createTerminalSessionForCwd(cwd, res, cliId) {
-    const sessionId = crypto3.randomUUID();
+    const sessionId = crypto5.randomUUID();
     const session = observability.createPendingTerminalSession({ sessionId, cwd, cliId });
     try {
       await terminalSessions.createSession({ sessionId, cwd, cliId });
@@ -42661,6 +43583,7 @@ function createConsoleServer(deps = {}) {
       pendingRuntimeSessions.delete(sessionId);
       const created = runtimeSession ? observability.registerTerminalRuntimeSession(runtimeSession) ?? session : observability.updateTerminalSessionStatus(sessionId, "terminal-only") ?? session;
       observability.notifySessionUpdated(created);
+      persistDurableState();
       writeJson(res, 200, created);
     } catch (error51) {
       pendingRuntimeSessions.delete(sessionId);
@@ -42734,6 +43657,13 @@ function createConsoleServer(deps = {}) {
   function listTheaterInfos() {
     return theaters.list().map((theater) => toTheaterInfo(theater, codex.getWorkspace(theater.id) !== null));
   }
+  function forgetTerminalSession(sessionId, options = {}) {
+    terminalSessions.terminate(sessionId);
+    pendingRuntimeSessions.delete(sessionId);
+    observability.removeTerminalSession(sessionId);
+    unlinkProviderSessionCapture(sessionId, { capturesDir: durablePaths.capturesDir });
+    if (options.persist !== false) persistDurableState();
+  }
   function toTheaterInfo(theater, hasWiki) {
     return {
       id: theater.id,
@@ -42796,12 +43726,69 @@ function createConsoleServer(deps = {}) {
     terminalUpgrade.close();
     currentLock?.release();
   }
+  function rehydrateDurableState() {
+    let state;
+    try {
+      state = durableStateStore.load();
+      theaters.restore(state.theaters);
+    } catch (error51) {
+      console.warn(`[fleet-console] Durable state restore skipped: ${error51 instanceof Error ? error51.message : String(error51)}`);
+      state = emptyDurableConsoleState();
+      theaters.restore([]);
+    }
+    const merged = mergeProviderSessionCaptures(state, { capturesDir: durablePaths.capturesDir });
+    syncProviderSessionsToObservability(merged);
+    const restorable = {
+      ...merged,
+      operations: merged.operations.filter((operation) => operation.providerSession)
+    };
+    if (merged !== state || restorable.operations.length !== merged.operations.length) {
+      try {
+        durableStateStore.save(restorable);
+        cleanupProviderSessionCaptures(restorable, { capturesDir: durablePaths.capturesDir });
+      } catch (error51) {
+        console.warn(`[fleet-console] Durable state capture merge was not persisted: ${error51 instanceof Error ? error51.message : String(error51)}`);
+      }
+    } else {
+      cleanupProviderSessionCaptures(restorable, { capturesDir: durablePaths.capturesDir });
+    }
+    for (const operation of restorable.operations) {
+      if (theaters.get(operation.theaterId)) observability.injectDormantOperation(operation);
+    }
+  }
+  function persistDurableState() {
+    try {
+      const state = mergeProviderSessionCaptures({
+        version: 1,
+        theaters: theaters.list(),
+        operations: observability.listDurableOperations()
+      }, { capturesDir: durablePaths.capturesDir });
+      syncProviderSessionsToObservability(state);
+      const operationsWithProviderSession = state.operations.filter((operation) => operation.providerSession);
+      durableStateStore.save({
+        version: state.version,
+        theaters: state.theaters,
+        // 대화 없는 빈 Operation 드롭은 rehydrate에서 capture 머지 뒤에만 수행한다.
+        // create 시점의 메타데이터를 먼저 남겨야 이후 도착한 capture 파일이 재시작 때 병합될 수 있다.
+        operations: state.operations
+      });
+      cleanupProviderSessionCaptures({ ...state, operations: operationsWithProviderSession }, { capturesDir: durablePaths.capturesDir });
+    } catch (error51) {
+      console.warn(`[fleet-console] Durable state save failed: ${error51 instanceof Error ? error51.message : String(error51)}`);
+    }
+  }
+  function syncProviderSessionsToObservability(state) {
+    for (const operation of state.operations) {
+      if (operation.providerSession) observability.updateTerminalSessionProviderSession(operation.sessionId, operation.providerSession);
+    }
+  }
   return {
     host,
     port,
     async start(lockPaths) {
       if (server && lockHandle) return lockHandle.payload.endpoint;
       try {
+        rehydrateDurableState();
         await new Promise((resolve, reject) => {
           const srv = createHttpServer(handleRequest, terminalUpgrade);
           srv.once("error", reject);
@@ -42884,6 +43871,14 @@ function resolveCarrierEventOrigin(event, jobOriginById) {
 function queueOriginCleanup(jobId, jobOriginById) {
   queueMicrotask(() => jobOriginById.delete(jobId));
 }
+function readDurableAgentCliId(operation) {
+  if (!operation.cliId) return null;
+  try {
+    return parseAgentCliId(operation.cliId) ?? null;
+  } catch {
+    return null;
+  }
+}
 function createHttpServer(handler, terminalUpgrade) {
   const srv = http.createServer(handler);
   srv.timeout = SERVER_TIMEOUT_MS;
@@ -43001,6 +43996,78 @@ function isAllowedTerminalOrigin(req, expectedPort) {
   if (origin === void 0) return true;
   return origin === `http://127.0.0.1:${expectedPort}`;
 }
+var CAPTURE_TEMP_PREFIX = ".capture.";
+async function runCaptureSessionHook(provider, env = process5.env) {
+  return captureSession({
+    diagnostics: process5.stderr,
+    env,
+    input: await readStdin(),
+    provider
+  });
+}
+function captureSession(options) {
+  try {
+    return captureSessionStrict(options);
+  } catch (error51) {
+    options.diagnostics?.write(`[fleet-console] capture-session skipped: ${error51 instanceof Error ? error51.message : String(error51)}
+`);
+    return null;
+  }
+}
+function captureSessionStrict(options) {
+  const provider = parseProvider(options.provider);
+  const fleetSessionId = readFleetSessionId(options.env ?? process5.env);
+  const input = parseHookInput(options.input ?? "");
+  const providerSession = toProviderSession(provider, input, options.now ?? (() => /* @__PURE__ */ new Date()));
+  const capturesDir = (options.paths ?? createConsoleDataPaths()).capturesDir;
+  const finalPath = path93__default.join(capturesDir, `${fleetSessionId}.json`);
+  const tempPath = path93__default.join(capturesDir, `${CAPTURE_TEMP_PREFIX}${fleetSessionId}.${process5.pid}.${Date.now()}.tmp`);
+  fs5__default.mkdirSync(capturesDir, { recursive: true, mode: 448 });
+  fs5__default.writeFileSync(tempPath, `${JSON.stringify(providerSession, null, 2)}
+`, { mode: 384 });
+  fs5__default.renameSync(tempPath, finalPath);
+  return { path: finalPath, providerSession };
+}
+function parseProvider(value) {
+  if (value === "claude" || value === "codex") return value;
+  throw new Error("invalid_provider");
+}
+function readFleetSessionId(env) {
+  const value = env.FLEET_CONSOLE_SESSION_ID;
+  if (!value) throw new Error("missing_fleet_session_id");
+  if (path93__default.basename(value) !== value || value.includes(path93__default.sep) || value.includes(path93__default.posix.sep)) {
+    throw new Error("invalid_fleet_session_id");
+  }
+  return value;
+}
+function parseHookInput(input) {
+  try {
+    const parsed = JSON.parse(input);
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) return parsed;
+  } catch {
+  }
+  throw new Error("invalid_hook_input");
+}
+function toProviderSession(provider, input, now) {
+  if (typeof input.session_id !== "string" || input.session_id.length === 0) throw new Error("missing_provider_session_id");
+  return {
+    provider,
+    sessionId: input.session_id,
+    ...typeof input.transcript_path === "string" && input.transcript_path.length > 0 ? { transcriptPath: input.transcript_path } : {},
+    ...typeof input.source === "string" && input.source.length > 0 ? { source: input.source } : {},
+    capturedAt: now().toISOString()
+  };
+}
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    process5.stdin.on("data", (chunk) => {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    });
+    process5.stdin.on("error", reject);
+    process5.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+  });
+}
 function createConsoleStalePolicy(deps = {}) {
   const fsImpl = deps.fs ?? fs5__default;
   function isBuildStale(lock, buildFile) {
@@ -43018,7 +44085,7 @@ function createConsoleStalePolicy(deps = {}) {
 var FIXED_HOST = "127.0.0.1";
 var HELP_BANNER_INDENT = "  ";
 var DEFAULT_HELP_RELEASE = "local";
-var CONSOLE_HOOK_COMMANDS = /* @__PURE__ */ new Set(["subagents-context"]);
+var CONSOLE_HOOK_COMMANDS = /* @__PURE__ */ new Set(["capture-session", "subagents-context"]);
 function parseConsoleCliMode(argv) {
   if (argv.length === 0) return "start";
   const [first, ...rest] = argv;
@@ -43045,10 +44112,12 @@ Run 'fleet console --help' for usage.`);
 }
 function parseConsoleHookCommand(argv) {
   const [commandName, ...rest] = argv;
-  if (!commandName || !CONSOLE_HOOK_COMMANDS.has(commandName) || rest.length > 0) {
+  if (!commandName || !CONSOLE_HOOK_COMMANDS.has(commandName)) {
     throw new Error("Unknown fleet-console hook command");
   }
-  return "subagents-context";
+  if (commandName === "subagents-context" && rest.length === 0) return { command: "subagents-context" };
+  if (commandName === "capture-session" && rest.length === 1 && rest[0]) return { command: "capture-session", provider: rest[0] };
+  throw new Error("Unknown fleet-console hook command");
 }
 function buildConsoleHelpText(options = {}) {
   const colorEnabled = resolveColorEnabled(options);
@@ -43110,8 +44179,8 @@ function buildWikiHelpText(options = {}) {
   return colorEnabled ? text : stripAnsi(text);
 }
 function createConsoleDaemonLifecycle(deps = {}) {
-  const env = deps.env ?? process4.env;
-  const execPath = deps.execPath ?? process4.execPath;
+  const env = deps.env ?? process5.env;
+  const execPath = deps.execPath ?? process5.execPath;
   const serverModulePath = deps.serverModulePath ?? resolveDefaultServerModulePath();
   const spawnDetached = deps.spawnDetached ?? ((bin, args, options) => {
     spawn(bin, [...args], options).unref();
@@ -43125,10 +44194,10 @@ function createConsoleDaemonLifecycle(deps = {}) {
     const server = createConsoleServer();
     await server.start(paths);
     await new Promise((resolve) => {
-      process4.once("SIGTERM", () => {
+      process5.once("SIGTERM", () => {
         void server.stop().finally(resolve);
       });
-      process4.once("SIGINT", () => {
+      process5.once("SIGINT", () => {
         void server.stop().finally(resolve);
       });
     });
@@ -43142,14 +44211,14 @@ function createConsoleDaemonLifecycle(deps = {}) {
     const payload = readTrustedLock();
     if (!payload) return;
     try {
-      process4.kill(payload.pid, "SIGTERM");
+      process5.kill(payload.pid, "SIGTERM");
     } catch (err) {
       if (err.code !== "ESRCH") throw err;
     }
     await sleep(200);
     try {
-      process4.kill(payload.pid, 0);
-      process4.kill(payload.pid, "SIGKILL");
+      process5.kill(payload.pid, 0);
+      process5.kill(payload.pid, "SIGKILL");
     } catch (err) {
       if (err.code !== "ESRCH") throw err;
     }
@@ -43256,49 +44325,51 @@ async function runConsoleRestart(deps = {}) {
   return openFleetConsole({ lifecycle, openBrowser: deps.openBrowser });
 }
 async function main() {
-  if (process4.argv[2] === "serve") {
+  if (process5.argv[2] === "serve") {
     await createConsoleDaemonLifecycle().runServer();
     return;
   }
-  if (process4.argv[2] === "hook") {
-    parseConsoleHookCommand(process4.argv.slice(3));
-    {
-      process4.stdout.write(`${runSubagentsContextHook(process4.env)}
+  if (process5.argv[2] === "hook") {
+    const hookCommand = parseConsoleHookCommand(process5.argv.slice(3));
+    if (hookCommand.command === "subagents-context") {
+      process5.stdout.write(`${runSubagentsContextHook(process5.env)}
 `);
       return;
     }
+    await runCaptureSessionHook(hookCommand.provider, process5.env);
+    return;
   }
-  if (process4.argv[2] === "codex") {
-    await mainWiki(process4.argv.slice(3));
+  if (process5.argv[2] === "codex") {
+    await mainWiki(process5.argv.slice(3));
     return;
   }
-  const mode = parseConsoleCliMode(process4.argv.slice(2));
+  const mode = parseConsoleCliMode(process5.argv.slice(2));
   if (mode === "help") {
-    process4.stdout.write(`${buildConsoleHelpText({ env: process4.env, isTTY: process4.stdout.isTTY })}
+    process5.stdout.write(`${buildConsoleHelpText({ env: process5.env, isTTY: process5.stdout.isTTY })}
 `);
     return;
   }
   if (mode === "status") {
-    process4.stdout.write(`${await runConsoleStatus()}
+    process5.stdout.write(`${await runConsoleStatus()}
 `);
     return;
   }
   if (mode === "stop") {
-    process4.stdout.write(`${await runConsoleStop()}
+    process5.stdout.write(`${await runConsoleStop()}
 `);
     return;
   }
   if (mode === "restart") {
     await runConsoleRestart();
-    process4.stdout.write("Fleet Console restarted.\n");
+    process5.stdout.write("Fleet Console restarted.\n");
     return;
   }
   await openFleetConsole();
-  process4.stdout.write("Fleet Console opened.\n");
+  process5.stdout.write("Fleet Console opened.\n");
 }
-async function mainWiki(argv = process4.argv.slice(2)) {
+async function mainWiki(argv = process5.argv.slice(2)) {
   if (argv.includes("--help") || argv.includes("-h")) {
-    process4.stdout.write(`${buildWikiHelpText({ env: process4.env, isTTY: process4.stdout.isTTY })}
+    process5.stdout.write(`${buildWikiHelpText({ env: process5.env, isTTY: process5.stdout.isTTY })}
 `);
     return;
   }
@@ -43310,19 +44381,19 @@ async function mainWiki(argv = process4.argv.slice(2)) {
   if (unsupported.length > 0) {
     throw new Error(`Unknown fleet wiki option: ${unsupported[0]}`);
   }
-  await openFleetWikiWorkspace({ cwd: process4.cwd() });
+  await openFleetWikiWorkspace({ cwd: process5.cwd() });
 }
 function resolveDefaultServerModulePath() {
   const builtPath = new URL("../dist/cli.mjs", import.meta.url).pathname;
   if (fs5__default.existsSync(builtPath)) return builtPath;
   return fileURLToPath(import.meta.url);
 }
-var isDirectRun = process4.argv[1] && path93__default.resolve(process4.argv[1]) === fileURLToPath(import.meta.url);
+var isDirectRun = process5.argv[1] && path93__default.resolve(process5.argv[1]) === fileURLToPath(import.meta.url);
 if (isDirectRun) {
   await main().catch((error51) => {
-    process4.stderr.write(`${error51 instanceof Error ? error51.message : String(error51)}
+    process5.stderr.write(`${error51 instanceof Error ? error51.message : String(error51)}
 `);
-    process4.exitCode = 1;
+    process5.exitCode = 1;
   });
 }