@dotobokuri/fleet-console 1.71.0 → 1.72.0

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import * as fs9 from 'node:fs';
-import fs9__default, { realpathSync, accessSync, constants as constants$1, existsSync, lstatSync } from 'node:fs';
+import * as fs10 from 'node:fs';
+import fs10__default, { realpathSync, accessSync, constants as constants$1, existsSync, lstatSync } from 'node:fs';
 import * as path18 from 'node:path';
 import path18__default, { join, resolve, relative, sep } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
@@ -14,7 +14,8 @@ import http from 'node:http';
 import https from 'node:https';
 import { mkdtemp, rm, mkdir, readdir, readFile, stat, appendFile, writeFile, rename, realpath, lstat } from 'node:fs/promises';
 import fontList from 'font-list';
-import net2 from 'node:net';
+import net3 from 'node:net';
+import tls from 'node:tls';
 import { execFile } from 'child_process';
 import { constants } from 'fs';
 import 'fs/promises';
@@ -24,7 +25,6 @@ import { deflateRawSync } from 'zlib';
 import { EventEmitter } from 'node:events';
 import { query } from '@anthropic-ai/claude-agent-sdk';
 import selfsigned from 'selfsigned';
-import tls from 'node:tls';
 
 var __defProp = Object.defineProperty;
 var __export = (target, all) => {
@@ -238,6 +238,18 @@ function createConsoleHealthClient(deps = {}) {
   }
   return { probe };
 }
+function createConsoleStalePolicy(deps = {}) {
+  const fsImpl = deps.fs ?? fs10__default;
+  function isBuildStale(lock, buildFile) {
+    try {
+      return lock.startedAt < fsImpl.statSync(buildFile).mtimeMs;
+    } catch (err) {
+      if (err.code === "ENOENT") return false;
+      throw err;
+    }
+  }
+  return { isBuildStale };
+}
 
 // cli/styles/tokens.ts
 var ANSI_RESET = "\x1B[0m";
@@ -301,7 +313,7 @@ function readFleetCliRelease() {
 var LOCK_DIR_MODE = 448;
 var LOCK_FILE_MODE = 384;
 function createConsoleLock(deps = {}) {
-  const fsImpl = deps.fs ?? fs9__default;
+  const fsImpl = deps.fs ?? fs10__default;
   const now = deps.now ?? Date.now;
   const randomToken = deps.randomToken ?? (() => crypto5.randomBytes(32).toString("base64url"));
   const hostname5 = deps.hostname ?? (() => "127.0.0.1");
@@ -333,7 +345,7 @@ function createConsoleLock(deps = {}) {
       version: input.version,
       ...input.owner ? { owner: input.owner } : {}
     };
-    const fd = fsImpl.openSync(input.lockFile, fs9__default.constants.O_CREAT | fs9__default.constants.O_EXCL | fs9__default.constants.O_WRONLY, LOCK_FILE_MODE);
+    const fd = fsImpl.openSync(input.lockFile, fs10__default.constants.O_CREAT | fs10__default.constants.O_EXCL | fs10__default.constants.O_WRONLY, LOCK_FILE_MODE);
     try {
       fsImpl.writeFileSync(fd, `${JSON.stringify(payload, null, 2)}
 `, "utf8");
@@ -409,10 +421,10 @@ function getFleetDataDir(env = process.env) {
 }
 var SECURE_DIR_MODE = 448;
 var SECURE_FILE_MODE = 384;
-var NOFOLLOW_FLAG = fs9.constants.O_NOFOLLOW ?? 0;
+var NOFOLLOW_FLAG = fs10.constants.O_NOFOLLOW ?? 0;
 function safeLstat(targetPath) {
   try {
-    return fs9.lstatSync(targetPath);
+    return fs10.lstatSync(targetPath);
   } catch (error51) {
     if (error51.code === "ENOENT") {
       return null;
@@ -426,15 +438,15 @@ function ensureSafeDirectory(dirPath) {
     if (!stat4.isDirectory() || stat4.isSymbolicLink()) {
       throw new Error(`Unsafe Fleet directory: ${dirPath}`);
     }
-    fs9.chmodSync(dirPath, SECURE_DIR_MODE);
+    fs10.chmodSync(dirPath, SECURE_DIR_MODE);
     return;
   }
-  fs9.mkdirSync(dirPath, { recursive: true, mode: SECURE_DIR_MODE });
+  fs10.mkdirSync(dirPath, { recursive: true, mode: SECURE_DIR_MODE });
   const created = safeLstat(dirPath);
   if (!created?.isDirectory() || created.isSymbolicLink()) {
     throw new Error(`Unsafe Fleet directory: ${dirPath}`);
   }
-  fs9.chmodSync(dirPath, SECURE_DIR_MODE);
+  fs10.chmodSync(dirPath, SECURE_DIR_MODE);
 }
 function assertWithinRoot(root, candidatePath) {
   const resolvedRoot = path18.resolve(root);
@@ -460,17 +472,17 @@ function writeAtomicSync(filePath, content, options = {}) {
     const tempPath = buildTempPath(filePath);
     let tempCreated = false;
     try {
-      fs9.writeFileSync(tempPath, content, { encoding: "utf-8", flag: "wx", mode });
+      fs10.writeFileSync(tempPath, content, { encoding: "utf-8", flag: "wx", mode });
       tempCreated = true;
       if (doFsync) {
-        const fd = fs9.openSync(tempPath, "r");
+        const fd = fs10.openSync(tempPath, "r");
         try {
           fsyncSyncBestEffort(fd);
         } finally {
-          fs9.closeSync(fd);
+          fs10.closeSync(fd);
         }
       }
-      fs9.renameSync(tempPath, filePath);
+      fs10.renameSync(tempPath, filePath);
       return;
     } catch (error51) {
       const code = error51.code;
@@ -480,7 +492,7 @@ function writeAtomicSync(filePath, content, options = {}) {
       }
       if (tempCreated) {
         try {
-          fs9.unlinkSync(tempPath);
+          fs10.unlinkSync(tempPath);
         } catch {
         }
       }
@@ -492,7 +504,7 @@ function writeAtomicSync(filePath, content, options = {}) {
 function cleanupTempFiles(dir, prefix, minAgeMs, now) {
   let entries;
   try {
-    entries = fs9.readdirSync(dir);
+    entries = fs10.readdirSync(dir);
   } catch {
     return;
   }
@@ -502,9 +514,9 @@ function cleanupTempFiles(dir, prefix, minAgeMs, now) {
     }
     const tempPath = path18.join(dir, entry);
     try {
-      const stat4 = fs9.lstatSync(tempPath);
+      const stat4 = fs10.lstatSync(tempPath);
       if (stat4?.isFile() && !stat4.isSymbolicLink() && now - stat4.mtimeMs >= minAgeMs) {
-        fs9.unlinkSync(tempPath);
+        fs10.unlinkSync(tempPath);
       }
     } catch {
     }
@@ -516,7 +528,7 @@ function isIgnoredFsyncError(error51) {
 }
 function fsyncSyncBestEffort(fd) {
   try {
-    fs9.fsyncSync(fd);
+    fs10.fsyncSync(fd);
   } catch (error51) {
     if (!isIgnoredFsyncError(error51)) {
       throw error51;
@@ -536,7 +548,7 @@ function withDirectoryLock(deps, operation) {
   const startedAt = now();
   while (true) {
     try {
-      fs9.mkdirSync(deps.lockDir, { mode: 448 });
+      fs10.mkdirSync(deps.lockDir, { mode: 448 });
       writeLockOwner(deps.lockDir, ownerFileName, now());
       try {
         return operation();
@@ -556,7 +568,7 @@ function withDirectoryLock(deps, operation) {
 }
 function releaseLock(lockDir) {
   try {
-    fs9.rmSync(lockDir, { recursive: true, force: true });
+    fs10.rmSync(lockDir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -566,14 +578,14 @@ function recoverStaleLock(lockDir, ownerFileName, now, staleLockMs) {
     if (!isRecoverableSnapshot(initialSnapshot, now, staleLockMs)) return;
     const quarantineDir = buildQuarantinePath(lockDir);
     try {
-      fs9.renameSync(lockDir, quarantineDir);
+      fs10.renameSync(lockDir, quarantineDir);
     } catch {
       return;
     }
     try {
       const quarantinedSnapshot = readLockSnapshot(quarantineDir, ownerFileName);
       if (sameLockSnapshot(initialSnapshot, quarantinedSnapshot) && isRecoverableSnapshot(quarantinedSnapshot, now, staleLockMs)) {
-        fs9.rmSync(quarantineDir, { recursive: true, force: true });
+        fs10.rmSync(quarantineDir, { recursive: true, force: true });
       } else {
         restoreQuarantinedLock(quarantineDir, lockDir);
       }
@@ -587,7 +599,7 @@ function recoverStaleLock(lockDir, ownerFileName, now, staleLockMs) {
   }
 }
 function readLockSnapshot(lockDir, ownerFileName) {
-  const stat4 = fs9.lstatSync(lockDir);
+  const stat4 = fs10.lstatSync(lockDir);
   if (stat4.isSymbolicLink()) {
     return { owner: null, mtimeMs: 0 };
   }
@@ -608,7 +620,7 @@ function writeLockOwner(lockDir, ownerFileName, startedAt) {
   };
   const ownerPath = path18.join(lockDir, ownerFileName);
   try {
-    fs9.writeFileSync(ownerPath, JSON.stringify(owner), { encoding: "utf-8", mode: 384 });
+    fs10.writeFileSync(ownerPath, JSON.stringify(owner), { encoding: "utf-8", mode: 384 });
   } catch (error51) {
     releaseLock(lockDir);
     throw error51;
@@ -617,7 +629,7 @@ function writeLockOwner(lockDir, ownerFileName, startedAt) {
 function readLockOwner(lockDir, ownerFileName) {
   const ownerPath = path18.join(lockDir, ownerFileName);
   try {
-    return sanitizeLockOwner(JSON.parse(fs9.readFileSync(ownerPath, "utf-8")));
+    return sanitizeLockOwner(JSON.parse(fs10.readFileSync(ownerPath, "utf-8")));
   } catch (error51) {
     const code = error51.code;
     if (code === "ENOENT") return null;
@@ -639,7 +651,7 @@ function sameLockSnapshot(a, b) {
 }
 function restoreQuarantinedLock(quarantineDir, lockDir) {
   try {
-    fs9.renameSync(quarantineDir, lockDir);
+    fs10.renameSync(quarantineDir, lockDir);
   } catch {
   }
 }
@@ -679,17 +691,17 @@ var AUTH_LOCK_TIMEOUT_MS = 5e3;
 function readAuthStoreFile(filePath) {
   let fd;
   try {
-    fd = fs9.openSync(filePath, fs9.constants.O_RDONLY | NOFOLLOW_FLAG);
-    if (!fs9.fstatSync(fd).isFile()) {
+    fd = fs10.openSync(filePath, fs10.constants.O_RDONLY | NOFOLLOW_FLAG);
+    if (!fs10.fstatSync(fd).isFile()) {
       return {};
     }
-    return JSON.parse(fs9.readFileSync(fd, "utf-8"));
+    return JSON.parse(fs10.readFileSync(fd, "utf-8"));
   } catch {
     return {};
   } finally {
     if (fd !== void 0) {
       try {
-        fs9.closeSync(fd);
+        fs10.closeSync(fd);
       } catch {
       }
     }
@@ -703,7 +715,7 @@ function createAuthService(deps = {}) {
     async deleteApiKey(providerId) {
       let deleted = false;
       withAuthLock(authPath, lockDir, () => {
-        if (!fs9.existsSync(authPath)) return;
+        if (!fs10.existsSync(authPath)) return;
         const data = readAuthStoreFile(authPath);
         if (!Object.prototype.hasOwnProperty.call(data, providerId)) return;
         delete data[providerId];
@@ -716,21 +728,21 @@ function createAuthService(deps = {}) {
     async getApiKey(providerId) {
       let fd;
       try {
-        if (!fs9.existsSync(authPath)) {
+        if (!fs10.existsSync(authPath)) {
           return void 0;
         }
-        fd = fs9.openSync(authPath, fs9.constants.O_RDONLY | NOFOLLOW_FLAG);
-        if (!fs9.fstatSync(fd).isFile()) {
+        fd = fs10.openSync(authPath, fs10.constants.O_RDONLY | NOFOLLOW_FLAG);
+        if (!fs10.fstatSync(fd).isFile()) {
           return void 0;
         }
-        const data = JSON.parse(fs9.readFileSync(fd, "utf-8"));
+        const data = JSON.parse(fs10.readFileSync(fd, "utf-8"));
         return typeof data[providerId]?.key === "string" ? data[providerId].key : void 0;
       } catch {
         return void 0;
       } finally {
         if (fd !== void 0) {
           try {
-            fs9.closeSync(fd);
+            fs10.closeSync(fd);
           } catch {
           }
         }
@@ -738,7 +750,7 @@ function createAuthService(deps = {}) {
     },
     // [HIGH #2] 읽기 경로: fd 기반 O_RDONLY|O_NOFOLLOW 통일
     async listProviderIds() {
-      if (!fs9.existsSync(authPath)) {
+      if (!fs10.existsSync(authPath)) {
         return [];
       }
       try {
@@ -751,7 +763,7 @@ function createAuthService(deps = {}) {
       const dir = path18.dirname(authPath);
       ensureSafeDirectory(dir);
       withAuthLock(authPath, lockDir, () => {
-        const data = fs9.existsSync(authPath) ? readAuthStoreFile(authPath) : {};
+        const data = fs10.existsSync(authPath) ? readAuthStoreFile(authPath) : {};
         data[providerId] = {
           ...data[providerId] ?? {},
           key
@@ -834,21 +846,21 @@ function createDurableJsonStore(deps) {
 function readJsonFile(filePath, sanitize) {
   let fd;
   try {
-    const stat4 = fs9.lstatSync(filePath);
+    const stat4 = fs10.lstatSync(filePath);
     if (!stat4 || !stat4.isFile() || stat4.isSymbolicLink()) {
       return sanitize(void 0);
     }
-    fd = fs9.openSync(filePath, fs9.constants.O_RDONLY | NOFOLLOW_FLAG);
-    if (!fs9.fstatSync(fd).isFile()) {
+    fd = fs10.openSync(filePath, fs10.constants.O_RDONLY | NOFOLLOW_FLAG);
+    if (!fs10.fstatSync(fd).isFile()) {
       return sanitize(void 0);
     }
-    return sanitize(JSON.parse(fs9.readFileSync(fd, "utf-8")));
+    return sanitize(JSON.parse(fs10.readFileSync(fd, "utf-8")));
   } catch {
     return sanitize(void 0);
   } finally {
     if (fd !== void 0) {
       try {
-        fs9.closeSync(fd);
+        fs10.closeSync(fd);
       } catch {
       }
     }
@@ -858,7 +870,7 @@ function ensureSafeDirectoryIfSensitive(dir, sensitivity) {
   if (sensitivity === "sensitive") {
     ensureSafeDirectory(dir);
   } else {
-    fs9.mkdirSync(dir, { recursive: true });
+    fs10.mkdirSync(dir, { recursive: true });
   }
 }
 
@@ -998,7 +1010,7 @@ function canonicalizeWorkspaceCwd(cwd) {
   if (!cwd.trim()) {
     throw new Error("Workspace cwd is required");
   }
-  return fs9.realpathSync.native(path18.resolve(cwd));
+  return fs10.realpathSync.native(path18.resolve(cwd));
 }
 function assertWorkspaceDirectoryName(name) {
   if (!name || !WORKSPACE_NAME_PATTERN.test(name)) {
@@ -1013,7 +1025,7 @@ function readWorkspaceIdentity(identityPath) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs9.readFileSync(identityPath, "utf8"));
+    parsed = JSON.parse(fs10.readFileSync(identityPath, "utf8"));
   } catch (error51) {
     throw new Error(`Invalid workspace identity file: ${identityPath}`, { cause: error51 });
   }
@@ -1100,11 +1112,11 @@ function isDesktopDevelopmentEnvironment2(env = process.env) {
 }
 function validateDesktopResourceRoot(root, expectedPackageRoot = resolveDesktopProtocolPackageRoot()) {
   if (!path18__default.isAbsolute(root)) throw new Error("desktop_resource_root_not_absolute");
-  const resolvedRoot = fs9__default.realpathSync(root);
-  const expectedRoot = fs9__default.realpathSync(expectedPackageRoot);
+  const resolvedRoot = fs10__default.realpathSync(root);
+  const expectedRoot = fs10__default.realpathSync(expectedPackageRoot);
   if (resolvedRoot !== expectedRoot) throw new Error("desktop_resource_root_invalid");
   const markerPath = path18__default.join(resolvedRoot, DESKTOP_RESOURCE_ROOT_MARKER);
-  const marker = fs9__default.readFileSync(markerPath, "utf8");
+  const marker = fs10__default.readFileSync(markerPath, "utf8");
   if (!isDesktopResourceRootMarkerValid(marker)) throw new Error("desktop_resource_root_marker_invalid");
   return resolvedRoot;
 }
@@ -1112,11 +1124,11 @@ function validateDesktopDevelopmentResourceRoot(root) {
   if (!path18__default.isAbsolute(root)) throw new Error("desktop_resource_root_not_absolute");
   let resolvedRoot;
   try {
-    resolvedRoot = fs9__default.realpathSync(root);
+    resolvedRoot = fs10__default.realpathSync(root);
   } catch {
     throw new Error("desktop_development_resource_root_invalid");
   }
-  const expectedRoot = fs9__default.realpathSync(resolveDesktopProtocolPackageRoot());
+  const expectedRoot = fs10__default.realpathSync(resolveDesktopProtocolPackageRoot());
   if (resolvedRoot !== expectedRoot) throw new Error("desktop_development_resource_root_invalid");
   return resolvedRoot;
 }
@@ -11738,7 +11750,7 @@ function resolveLocked(workspace, hooks) {
     const stagingState = inspectTree(staging2);
     if (stagingState === "content") {
       removeEmptyDirectories(destination);
-      fs9.renameSync(staging2, destination);
+      fs10.renameSync(staging2, destination);
       syncDirectory(workspace.path);
     } else if (stagingState !== "missing") throw new Error("Unsafe Fleet Wiki migration staging state");
     return createMemoryPaths(destination);
@@ -11760,14 +11772,14 @@ function resolveLocked(workspace, hooks) {
 `);
   syncDirectory(workspace.path);
   removeEmptyDirectories(destination);
-  fs9.renameSync(staging, destination);
+  fs10.renameSync(staging, destination);
   syncDirectory(workspace.path);
   return createMemoryPaths(destination);
 }
 function inspectTree(target, regularRootIsContent = false, treeRoot = target) {
   let stat4;
   try {
-    stat4 = fs9.lstatSync(target);
+    stat4 = fs10.lstatSync(target);
   } catch (error51) {
     if (error51.code === "ENOENT") return "missing";
     throw error51;
@@ -11776,7 +11788,7 @@ function inspectTree(target, regularRootIsContent = false, treeRoot = target) {
   if (nodeKind === "unsafe") return "unsafe";
   if (nodeKind === "file") return regularRootIsContent ? "content" : "unsafe";
   let content = false;
-  for (const entry of fs9.readdirSync(target, { withFileTypes: true })) {
+  for (const entry of fs10.readdirSync(target, { withFileTypes: true })) {
     const entryPath = path18__default.join(target, entry.name);
     if (entry.isSymbolicLink()) {
       if (readSafeFileSymlink(treeRoot, entryPath) === null) return "unsafe";
@@ -11796,7 +11808,7 @@ function inspectTree(target, regularRootIsContent = false, treeRoot = target) {
 function readMarker(markerPath) {
   let stat4;
   try {
-    stat4 = fs9.lstatSync(markerPath);
+    stat4 = fs10.lstatSync(markerPath);
   } catch (error51) {
     if (error51.code === "ENOENT") return null;
     throw error51;
@@ -11804,7 +11816,7 @@ function readMarker(markerPath) {
   if (!stat4.isFile() || stat4.isSymbolicLink()) throw new Error("Unsafe Fleet Wiki migration marker");
   let value;
   try {
-    value = JSON.parse(fs9.readFileSync(markerPath, "utf8"));
+    value = JSON.parse(fs10.readFileSync(markerPath, "utf8"));
   } catch {
     throw new Error("Invalid Fleet Wiki migration marker");
   }
@@ -11814,29 +11826,29 @@ function readMarker(markerPath) {
   return record4;
 }
 function copyTree(source, destination, hooks, sourceRoot = source) {
-  fs9.mkdirSync(destination, { recursive: true });
-  for (const entry of fs9.readdirSync(source, { withFileTypes: true })) {
+  fs10.mkdirSync(destination, { recursive: true });
+  for (const entry of fs10.readdirSync(source, { withFileTypes: true })) {
     const from = path18__default.join(source, entry.name);
     const to = path18__default.join(destination, entry.name);
-    const stat4 = fs9.lstatSync(from);
+    const stat4 = fs10.lstatSync(from);
     if (stat4.isSymbolicLink()) {
       const target = readSafeFileSymlink(sourceRoot, from);
       if (target === null) throw new Error("Unsafe Fleet Wiki legacy source state");
-      fs9.symlinkSync(target, to, "file");
+      fs10.symlinkSync(target, to, "file");
       continue;
     }
     const nodeKind = classifyWikiWorkspaceNodeForTest(stat4);
     if (nodeKind === "unsafe") throw new Error("Unsafe Fleet Wiki legacy source state");
     if (nodeKind === "directory") copyTree(from, to, hooks, sourceRoot);
     else {
-      fs9.copyFileSync(from, to);
+      fs10.copyFileSync(from, to);
       syncFile(to);
     }
   }
   syncDirectory(destination);
 }
 function readSafeFileSymlink(treeRoot, linkPath) {
-  const target = fs9.readlinkSync(linkPath);
+  const target = fs10.readlinkSync(linkPath);
   if (path18__default.posix.isAbsolute(target) || path18__default.win32.isAbsolute(target)) return null;
   const lexicalRoot = path18__default.resolve(treeRoot);
   const lexicalTarget = path18__default.resolve(path18__default.dirname(linkPath), target);
@@ -11845,9 +11857,9 @@ function readSafeFileSymlink(treeRoot, linkPath) {
   let canonicalTarget;
   let targetStat;
   try {
-    canonicalRoot = fs9.realpathSync(treeRoot);
-    canonicalTarget = fs9.realpathSync(linkPath);
-    targetStat = fs9.statSync(linkPath);
+    canonicalRoot = fs10.realpathSync(treeRoot);
+    canonicalTarget = fs10.realpathSync(linkPath);
+    targetStat = fs10.statSync(linkPath);
   } catch (error51) {
     if (error51.code === "ENOENT") return null;
     throw error51;
@@ -11869,19 +11881,19 @@ function removeEmptyDirectories(target) {
   const state = inspectTree(target, true);
   if (state === "missing") return;
   if (state === "unsafe") throw new Error("Unsafe Fleet Wiki destination state");
-  if (state === "empty") fs9.rmSync(target, { recursive: true, force: false });
+  if (state === "empty") fs10.rmSync(target, { recursive: true, force: false });
 }
 function removePriorStaging(workspacePath, stagingEntries) {
-  for (const name of stagingEntries) fs9.rmSync(path18__default.join(workspacePath, name), { recursive: true, force: false });
+  for (const name of stagingEntries) fs10.rmSync(path18__default.join(workspacePath, name), { recursive: true, force: false });
 }
 function inspectReservedControlState(workspacePath) {
   const stagingEntries = [];
-  for (const entry of fs9.readdirSync(workspacePath, { withFileTypes: true })) {
+  for (const entry of fs10.readdirSync(workspacePath, { withFileTypes: true })) {
     if (entry.name.startsWith(`${MARKER_NAME}.`)) {
       const residuePath = path18__default.join(workspacePath, entry.name);
-      const residue = fs9.lstatSync(residuePath);
+      const residue = fs10.lstatSync(residuePath);
       if (MARKER_TEMP_REGEXP.test(entry.name) && residue.isFile() && !residue.isSymbolicLink()) {
-        fs9.unlinkSync(residuePath);
+        fs10.unlinkSync(residuePath);
         continue;
       }
       throw new Error("Unsafe Fleet Wiki migration marker control state");
@@ -11895,33 +11907,33 @@ function inspectReservedControlState(workspacePath) {
 }
 function writeAtomic2(target, contents) {
   const temporary = `${target}.${randomUUID()}.tmp`;
-  fs9.writeFileSync(temporary, contents, { mode: 384 });
+  fs10.writeFileSync(temporary, contents, { mode: 384 });
   syncFile(temporary);
-  fs9.renameSync(temporary, target);
+  fs10.renameSync(temporary, target);
 }
 function fsyncBestEffort(fd) {
   try {
-    fs9.fsyncSync(fd);
+    fs10.fsyncSync(fd);
   } catch (error51) {
     const code = error51.code;
     if (typeof code !== "string" || !IGNORED_FSYNC_ERROR_CODES2.has(code)) throw error51;
   }
 }
 function syncFile(target) {
-  const fd = fs9.openSync(target, "r");
+  const fd = fs10.openSync(target, "r");
   try {
     fsyncBestEffort(fd);
   } finally {
-    fs9.closeSync(fd);
+    fs10.closeSync(fd);
   }
 }
 function syncDirectory(target) {
   if (!shouldSyncDirectoryForTest(process.platform)) return;
-  const fd = fs9.openSync(target, "r");
+  const fd = fs10.openSync(target, "r");
   try {
     fsyncBestEffort(fd);
   } finally {
-    fs9.closeSync(fd);
+    fs10.closeSync(fd);
   }
 }
 function shouldSyncDirectoryForTest(platform) {
@@ -12352,7 +12364,7 @@ function createConsoleSettingsStore(deps = {}) {
   const paths = deps.paths ?? createConsoleDataPaths();
   const createStore = deps.createStore ?? createDurableJsonStore;
   const randomInt = deps.randomInt ?? crypto5.randomInt;
-  const readFile7 = deps.readFile ?? ((file2) => fs9__default.readFileSync(file2, "utf8"));
+  const readFile7 = deps.readFile ?? ((file2) => fs10__default.readFileSync(file2, "utf8"));
   const base = createStore({
     filePath: paths.settingsFile,
     lockDir: path18__default.join(paths.dir, SETTINGS_LOCK_DIR_NAME),
@@ -13557,7 +13569,7 @@ function formatCookie(name, value, secure, maxAgeSeconds) {
 var REMOTE_DIR = "remote";
 var FILE_MODE = 384;
 function createRemoteStorage(consoleDir, deps = {}) {
-  const fileSystem = deps.fileSystem ?? fs9__default;
+  const fileSystem = deps.fileSystem ?? fs10__default;
   const ensureDirectory = deps.ensureDirectory ?? ensureSafeDirectory;
   const directory = path18__default.join(consoleDir, REMOTE_DIR);
   return {
@@ -13587,7 +13599,7 @@ function hashPairingSecret(secret) {
 }
 function createPairedDeviceStore(consoleDir, deps = {}) {
   const storage = createRemoteStorage(consoleDir, deps);
-  const readFile7 = deps.readFile ?? ((file2) => fs9__default.readFileSync(file2, "utf8"));
+  const readFile7 = deps.readFile ?? ((file2) => fs10__default.readFileSync(file2, "utf8"));
   const now = deps.now ?? Date.now;
   const randomId = deps.randomId ?? (() => crypto5.randomBytes(8).toString("hex"));
   const randomSecret = deps.randomSecret ?? (() => crypto5.randomBytes(32).toString("base64url"));
@@ -13675,6 +13687,168 @@ function isStoredDevice(value) {
   const entry = value;
   return typeof entry.id === "string" && entry.id.length > 0 && typeof entry.secretHash === "string" && /^[0-9a-f]{64}$/u.test(entry.secretHash) && (entry.audience === "local" || entry.audience === "remote") && (entry.access === "full" || entry.access === "monitoring") && (entry.device === null || typeof entry.device === "string") && typeof entry.pairedAt === "number" && Number.isFinite(entry.pairedAt) && typeof entry.lastSeenAt === "number" && Number.isFinite(entry.lastSeenAt);
 }
+
+// access-protocol/index.ts
+var ACCESS_LINK_SCHEME = "fleet:";
+var ACCESS_LINK_HOST = "join";
+var ACCESS_LINK_PREFIX = "fleet://join?code=";
+var ACCESS_LINK_VERSION = 1;
+var ACCESS_JOIN_PATH = "/api/v1/join";
+var MAX_ACCESS_LABEL_LENGTH = 48;
+var MAX_ACCESS_LINK_LENGTH = 4096;
+var ACCESS_TOKEN = /^[A-Za-z0-9_-]{16,512}$/u;
+var CERTIFICATE_FINGERPRINT = /^[0-9A-F]{64}$/u;
+var PAYLOAD_KEYS = ["v", "endpoint", "token", "fingerprint", "label"];
+var BASE64_URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var BASE64_URL_DECODE = createBase64UrlDecodeTable();
+function encodeAccessLink(payload) {
+  const envelope = {
+    v: ACCESS_LINK_VERSION,
+    endpoint: payload.endpoint,
+    token: payload.token,
+    fingerprint: normalizeFingerprint(payload.fingerprint),
+    label: sanitizeAccessLabel(payload.label)
+  };
+  return `${ACCESS_LINK_PREFIX}${toBase64Url(new TextEncoder().encode(JSON.stringify(envelope)))}`;
+}
+function parseAccessLink(input) {
+  if (typeof input !== "string") throw invalidLink();
+  const candidate = input.trim();
+  if (candidate.length === 0 || candidate.length > MAX_ACCESS_LINK_LENGTH) throw invalidLink();
+  if (containsDisallowedLinkWhitespace(candidate)) throw invalidLink();
+  let url2;
+  try {
+    url2 = new URL(candidate);
+  } catch {
+    throw invalidLink();
+  }
+  if (url2.protocol !== ACCESS_LINK_SCHEME || url2.username || url2.password || url2.hash) throw invalidLink();
+  if (url2.hostname !== ACCESS_LINK_HOST || url2.port !== "" || url2.pathname !== "") throw invalidLink();
+  const keys = [...url2.searchParams.keys()];
+  if (keys.length !== 1 || keys[0] !== "code") throw invalidLink();
+  return readPayload(decodePayload(url2.searchParams.get("code") ?? ""));
+}
+function decodePayload(code) {
+  if (!/^[A-Za-z0-9_-]+$/u.test(code)) throw invalidLink();
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(fromBase64Url(code));
+  } catch {
+    throw invalidLink();
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw invalidLink();
+  }
+}
+function readPayload(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalidLink();
+  const entry = value;
+  const keys = Object.keys(entry);
+  if (keys.length !== PAYLOAD_KEYS.length || !PAYLOAD_KEYS.every((key) => keys.includes(key))) throw invalidLink();
+  if (entry.v !== ACCESS_LINK_VERSION) throw invalidLink();
+  if (typeof entry.endpoint !== "string" || typeof entry.token !== "string" || typeof entry.fingerprint !== "string" || typeof entry.label !== "string") throw invalidLink();
+  const endpoint = readEndpoint(entry.endpoint);
+  const token = entry.token;
+  const fingerprint = normalizeFingerprint(entry.fingerprint);
+  if (!ACCESS_TOKEN.test(token) || !CERTIFICATE_FINGERPRINT.test(fingerprint)) throw invalidLink();
+  const label = sanitizeAccessLabel(entry.label);
+  if (label.length === 0) throw invalidLink();
+  return {
+    origin: endpoint.origin,
+    hostname: pinHostname(endpoint.hostname),
+    port: endpoint.port,
+    label,
+    consoleUrl: new URL("/console/", endpoint.origin).toString(),
+    joinUrl: new URL(ACCESS_JOIN_PATH, endpoint.origin).toString(),
+    token,
+    fingerprint
+  };
+}
+function readEndpoint(value) {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    throw invalidLink();
+  }
+  if (url2.protocol !== "https:" || url2.username || url2.password || url2.search || url2.hash) throw invalidLink();
+  if (url2.pathname !== "/" && url2.pathname !== "") throw invalidLink();
+  if (url2.hostname.length === 0) throw invalidLink();
+  const port = url2.port === "" ? 443 : Number(url2.port);
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw invalidLink();
+  return { origin: url2.origin, hostname: url2.hostname, port };
+}
+function pinHostname(hostname5) {
+  const unwrapped = hostname5.startsWith("[") && hostname5.endsWith("]") ? hostname5.slice(1, -1) : hostname5;
+  return unwrapped.toLowerCase();
+}
+function normalizeFingerprint(value) {
+  return value.replace(/[^0-9a-fA-F]/gu, "").toUpperCase();
+}
+function sanitizeAccessLabel(value) {
+  return Array.from(value).filter((character) => !isDisallowedAccessLabelCharacter(character.codePointAt(0))).join("").replace(/\s+/gu, " ").trim().slice(0, MAX_ACCESS_LABEL_LENGTH);
+}
+function containsDisallowedLinkWhitespace(value) {
+  for (const character of value) {
+    const codePoint = character.codePointAt(0);
+    if (codePoint <= 31 || codePoint === 127 || isWhitespaceCharacter(character)) return true;
+  }
+  return false;
+}
+function isWhitespaceCharacter(character) {
+  return character.trim().length === 0;
+}
+function isDisallowedAccessLabelCharacter(codePoint) {
+  return codePoint <= 31 || codePoint >= 127 && codePoint <= 159 || codePoint >= 8203 && codePoint <= 8207 || codePoint === 8232 || codePoint === 8233 || codePoint >= 8234 && codePoint <= 8238 || codePoint >= 8294 && codePoint <= 8297;
+}
+function toBase64Url(bytes) {
+  let encoded = "";
+  for (let index = 0; index < bytes.length; index += 3) {
+    const first = bytes[index];
+    const second = bytes[index + 1];
+    const third = bytes[index + 2];
+    encoded += BASE64_URL_ALPHABET[first >> 2];
+    encoded += BASE64_URL_ALPHABET[(first & 3) << 4 | (second ?? 0) >> 4];
+    if (second !== void 0) encoded += BASE64_URL_ALPHABET[(second & 15) << 2 | (third ?? 0) >> 6];
+    if (third !== void 0) encoded += BASE64_URL_ALPHABET[third & 63];
+  }
+  return encoded;
+}
+function fromBase64Url(value) {
+  if (value.length % 4 === 1) throw invalidLink();
+  const bytes = new Uint8Array(Math.floor(value.length * 6 / 8));
+  let buffer = 0;
+  let bits = 0;
+  let offset = 0;
+  for (const character of value) {
+    const decoded = BASE64_URL_DECODE[character.charCodeAt(0)] ?? -1;
+    if (decoded < 0) throw invalidLink();
+    buffer = buffer << 6 | decoded;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      bytes[offset] = buffer >> bits & 255;
+      offset += 1;
+    }
+  }
+  if (bits > 0 && (buffer & (1 << bits) - 1) !== 0) throw invalidLink();
+  return bytes;
+}
+function createBase64UrlDecodeTable() {
+  const table = new Int16Array(128);
+  table.fill(-1);
+  for (let index = 0; index < BASE64_URL_ALPHABET.length; index += 1) {
+    table[BASE64_URL_ALPHABET.charCodeAt(index)] = index;
+  }
+  return table;
+}
+function invalidLink() {
+  return new Error("pairing_target_invalid");
+}
+
+// core/host/remote-discovery.ts
 function listRemoteInterfaces(interfaces = os4__default.networkInterfaces()) {
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
@@ -13698,6 +13872,32 @@ function labelFor(interfaceName) {
 function sanitizeName(value) {
   return value.replace(/[^A-Za-z0-9._-]/gu, "").slice(0, 24) || "interface";
 }
+var REMOTE_PROBE_TIMEOUT_MS = 6e3;
+function probeRemoteIdentity(hostname5, port, expected, timeoutMs = REMOTE_PROBE_TIMEOUT_MS) {
+  return new Promise((resolve3) => {
+    const settle = (result) => {
+      socket.destroy();
+      resolve3(result);
+    };
+    const socket = tls.connect({
+      host: hostname5,
+      port,
+      rejectUnauthorized: false,
+      // IP 리터럴에는 SNI를 붙이지 않는다 — 규격상 SNI는 이름에만 쓴다.
+      ...net3.isIP(hostname5) === 0 ? { servername: hostname5 } : {}
+    }, () => {
+      const certificate = socket.getPeerX509Certificate();
+      if (!certificate) {
+        settle({ state: "unreachable" });
+        return;
+      }
+      const presented = normalizeFingerprint(certificate.fingerprint256);
+      settle(presented === normalizeFingerprint(expected) ? { state: "match" } : { state: "mismatch", presented });
+    });
+    socket.setTimeout(timeoutMs, () => settle({ state: "unreachable" }));
+    socket.on("error", () => settle({ state: "unreachable" }));
+  });
+}
 
 // core/host/codex/workspace-routes.ts
 function createCodexWorkspaceRouter(deps) {
@@ -14422,7 +14622,7 @@ function isOriginAllowed(origin, allowedOrigins, serverPort) {
   if (Number(parsed.port) !== serverPort) return false;
   const normalizedHost = normalizeOriginHostname(parsed.hostname);
   if (!normalizedHost) return false;
-  return allowedOrigins.has(`${parsed.protocol}//${net2.isIP(normalizedHost) === 6 ? `[${normalizedHost}]` : normalizedHost}:${serverPort}`);
+  return allowedOrigins.has(`${parsed.protocol}//${net3.isIP(normalizedHost) === 6 ? `[${normalizedHost}]` : normalizedHost}:${serverPort}`);
 }
 function sendJson(response, statusCode, body2) {
   response.writeHead(statusCode, withSecurityHeaders(JSON_HEADERS));
@@ -14444,7 +14644,7 @@ function normalizeOriginHostname(hostname5) {
   const unbracketed = stripIpv6Brackets(hostname5).toLowerCase();
   if (unbracketed.includes("%")) return null;
   if (unbracketed.startsWith("::ffff:")) return null;
-  if (net2.isIP(unbracketed) === 6) {
+  if (net3.isIP(unbracketed) === 6) {
     try {
       return stripIpv6Brackets(new URL(`http://[${unbracketed}]:1`).hostname).toLowerCase();
     } catch {
@@ -33602,6 +33802,11 @@ function hasClaudeOneMillionMarker(modelId) {
 function stripClaudeOneMillionMarker(modelId) {
   return modelId.replace(/\[1m\]$/i, "");
 }
+var CLAUDE_CLIENT_IDENTITY_SENTENCES = [
+  "You are Claude Code, Anthropic's official CLI for Claude.",
+  "You are a Claude agent, built on Anthropic's Claude Agent SDK."
+];
+Math.max(...CLAUDE_CLIENT_IDENTITY_SENTENCES.map((sentence) => sentence.length)) + 16;
 var benchmarks_default = {
   version: 2,
   sources: {
@@ -33819,8 +34024,48 @@ var benchmarks_default = {
 };
 var models_default = {
   version: 1,
-  updatedAt: "2026-08-21T00:00:00Z",
+  updatedAt: "2026-08-22T00:00:00Z",
   providers: {
+    antigravity: {
+      name: "Antigravity",
+      defaultModel: "gemini-3.7-flash",
+      source: "live POST https://daily-cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels read with the credential the Antigravity CLI (agy 1.1.18) owns, 2026-08-22; the same read reported defaultAgentModelId gemini-3.7-flash-high and a deprecatedModelIds entry mapping gemini-3.1-pro-high to gemini-pro-agent, and a live streamGenerateContent probe on that date confirmed gemini-3.1-pro-high is refused with INVALID_ARGUMENT while gemini-pro-agent answers. Effort spelling was measured per model on one fixed prompt: gemini-3.7-flash-tiered honours generationConfig.thinkingConfig.thinkingLevel (343 / 407 / 434 reasoning tokens at low / medium / high) so its ladder is a request field, while Gemini 3.1 Pro encodes the rung in the wire id. thinkingLevel accepts low, medium, and high only: minimal and max are both refused. Claude and GPT-OSS models are served by the same subscription but are deliberately not exposed here",
+      models: [
+        {
+          modelId: "gemini-3.7-flash",
+          name: "Gemini-3.7-Flash",
+          capabilityClass: "light",
+          providerModelId: "gemini-3.7-flash-tiered",
+          contextWindow: 1048576,
+          effort: {
+            supported: true,
+            levels: [
+              "low",
+              "medium",
+              "high"
+            ]
+          }
+        },
+        {
+          modelId: "gemini-3.1-pro",
+          name: "Gemini-3.1-Pro",
+          capabilityClass: "flagship",
+          providerModelId: "gemini-3.1-pro-low",
+          contextWindow: 1048576,
+          effort: {
+            supported: true,
+            levels: [
+              "low",
+              "high"
+            ],
+            upstreamModelIds: {
+              low: "gemini-3.1-pro-low",
+              high: "gemini-pro-agent"
+            }
+          }
+        }
+      ]
+    },
     codex: {
       name: "Codex",
       defaultModel: "gpt-5.6-sol",
@@ -34230,7 +34475,7 @@ var models_default = {
         {
           modelId: "composer-2.5",
           name: "Composer-2.5",
-          capabilityClass: "flagship",
+          capabilityClass: "standard",
           quotaScope: "auto",
           contextWindow: 2e5,
           benchmarkKey: "composer-2.5"
@@ -34238,9 +34483,11 @@ var models_default = {
         {
           modelId: "composer-2.5-fast",
           name: "Composer-2.5-Fast",
-          capabilityClass: "light",
+          capabilityClass: "standard",
+          variantOf: "composer-2.5",
           quotaScope: "auto",
-          contextWindow: 2e5
+          contextWindow: 2e5,
+          benchmarkKey: "composer-2.5"
         },
         {
           modelId: "grok-4.5",
@@ -34262,7 +34509,8 @@ var models_default = {
         {
           modelId: "grok-4.5-fast",
           name: "Grok-4.5-Fast",
-          capabilityClass: "light",
+          capabilityClass: "flagship",
+          variantOf: "grok-4.5",
           quotaScope: "auto",
           contextWindow: 256e3,
           effort: {
@@ -34273,7 +34521,8 @@ var models_default = {
               "high"
             ],
             upstreamModelIdTemplate: "cursor-grok-4.5-{effort}-fast"
-          }
+          },
+          benchmarkKey: "grok-4.5"
         },
         {
           modelId: "grok-4.6",
@@ -34296,7 +34545,8 @@ var models_default = {
         {
           modelId: "grok-4.6-fast",
           name: "Grok-4.6-Fast",
-          capabilityClass: "light",
+          capabilityClass: "flagship",
+          variantOf: "grok-4.6",
           quotaScope: "auto",
           contextWindow: 256e3,
           effort: {
@@ -34308,7 +34558,8 @@ var models_default = {
               "xhigh"
             ],
             upstreamModelIdTemplate: "cursor-grok-4.6-{effort}-fast"
-          }
+          },
+          benchmarkKey: "grok-4.6"
         },
         {
           modelId: "claude-opus-5",
@@ -34693,7 +34944,7 @@ var models_default = {
         {
           modelId: "grok-composer-2.5-fast",
           name: "Grok-Composer-2.5-Fast",
-          capabilityClass: "light",
+          capabilityClass: "standard",
           wire: "responses",
           contextWindow: 2e5
         }
@@ -34810,7 +35061,7 @@ var models_default = {
     }
   }
 };
-var GATEWAY_PROVIDERS = ["codex", "xai", "cursor", "opencode", "kimi"];
+var GATEWAY_PROVIDERS = ["codex", "xai", "cursor", "opencode", "antigravity", "kimi"];
 var GATEWAY_MODEL_WIRES = ["anthropic", "responses", "chat-completions"];
 var GATEWAY_REASONING_EFFORTS = [
   "low",
@@ -34888,6 +35139,14 @@ var GatewayModelEntrySchema = external_exports.object({
   benchmarkKey: external_exports.string().min(1).optional(),
   description: external_exports.string().min(1).optional(),
   providerModelId: external_exports.string().min(1).optional(),
+  /**
+   * The catalog entry this one is a serving variant of, when the provider gives
+   * the variant its own wire id and `providerModelId` is therefore unavailable
+   * as the lineage link. Pure provenance: it names a sibling `modelId` in the
+   * same provider and never reaches a request, so the variant keeps sending its
+   * own upstream id while inheriting the base's class and benchmark evidence.
+   */
+  variantOf: external_exports.string().min(1).optional(),
   serviceTier: external_exports.literal("priority").optional(),
   cursorMaxMode: external_exports.literal(true).optional(),
   quotaScope: external_exports.enum(GATEWAY_QUOTA_SCOPES).optional(),
@@ -34910,7 +35169,8 @@ var GatewayModelsRegistrySchema = external_exports.object({
     cursor: GatewayProviderSchema,
     kimi: GatewayProviderSchema,
     opencode: GatewayProviderSchema,
-    xai: GatewayProviderSchema
+    xai: GatewayProviderSchema,
+    antigravity: GatewayProviderSchema
   }).strict(),
   pricing: GatewayPricingRegistrySchema
 }).strict();
@@ -34936,7 +35196,6 @@ var registry2 = (() => {
   return parsed;
 })();
 var GATEWAY_MODELS_UPDATED_AT = registry2.updatedAt;
-registry2.pricing.observedAt;
 Object.freeze(
   Object.fromEntries(
     Object.entries(registry2.pricing.models).map(([modelId, pricing]) => [
@@ -35125,8 +35384,24 @@ function validateRegistry(value) {
       if (!isRoutingAlias && !model.capabilityClass) {
         throw new Error(`Gateway model is missing a capability class: ${provider}/${model.modelId}`);
       }
-      if (!isRoutingAlias && model.providerModelId) {
-        const base = definition.models.find((candidate) => candidate.modelId === model.providerModelId);
+      const catalogEntry = (modelId) => modelId === void 0 ? void 0 : definition.models.find((candidate) => candidate.modelId === modelId);
+      const providerLinkedBase = isRoutingAlias ? void 0 : catalogEntry(model.providerModelId);
+      if (model.variantOf && providerLinkedBase && model.providerModelId !== model.variantOf) {
+        throw new Error(`Gateway service-tier sibling names two different bases: ${provider}/${model.modelId}`);
+      }
+      if (model.variantOf === model.modelId) {
+        throw new Error(`Gateway service-tier sibling names itself as its base: ${provider}/${model.modelId}`);
+      }
+      const baseModelId = isRoutingAlias ? void 0 : model.variantOf ?? model.providerModelId;
+      if (baseModelId) {
+        const base = catalogEntry(baseModelId);
+        if (model.variantOf && !base) {
+          throw new Error(`Gateway service-tier sibling names an unknown base: ${provider}/${model.modelId} -> ${model.variantOf}`);
+        }
+        const baseLink = base && base.modelId !== base.providerModelId ? base.variantOf ?? base.providerModelId : base?.variantOf;
+        if (base && catalogEntry(baseLink)) {
+          throw new Error(`Gateway service-tier sibling names another sibling as its base: ${provider}/${model.modelId}`);
+        }
         if (base && base.capabilityClass !== model.capabilityClass) {
           throw new Error(`Gateway service-tier sibling class differs from its base: ${provider}/${model.modelId}`);
         }
@@ -35167,8 +35442,8 @@ function validateRegistry(value) {
           }
         }
         if (exactModelIds) {
-          if (provider !== "cursor") {
-            throw new Error(`Gateway effort model id overrides are only supported by Cursor: ${provider}/${model.modelId}`);
+          if (provider !== "cursor" && provider !== "antigravity") {
+            throw new Error(`Gateway effort model id overrides are only supported by Cursor and Antigravity: ${provider}/${model.modelId}`);
           }
           for (const effort of Object.keys(exactModelIds)) {
             if (!model.effort.levels.includes(effort)) {
@@ -35269,6 +35544,18 @@ process.platform === "win32" ? constants.O_RDONLY : constants.O_RDONLY | constan
   platform: process.platform,
   homedir: os8.homedir,
   env: process.env});
+var HOUR_MS = 36e5;
+var WEEK_MS = 7 * 24 * HOUR_MS;
+var SESSION_MS = 5 * HOUR_MS;
+var BUCKETS = Object.freeze({
+  "gemini-5h": { id: "session", label: "Gemini", durationMs: SESSION_MS, reported: true },
+  "gemini-weekly": { id: "weekly", label: "Gemini", durationMs: WEEK_MS, reported: true },
+  "3p-5h": { id: "session", label: "Claude & GPT", durationMs: SESSION_MS, reported: false },
+  "3p-weekly": { id: "weekly", label: "Claude & GPT", durationMs: WEEK_MS, reported: false }
+});
+Object.freeze(
+  Object.keys(BUCKETS).filter((bucketId) => BUCKETS[bucketId]?.reported === true)
+);
 var CURSOR_GREP_RECEIPT_PREFIX = "FLEET_CURSOR_GREP_V2:";
 var CURSOR_GREP_RECEIPT_SCRIPT = String.raw`
 const {spawn}=require("node:child_process");
@@ -37154,7 +37441,7 @@ async function canonicalizeTheaterPath(cwd) {
 function canonicalizeTheaterPathSync(cwd) {
   const resolved = path18__default.resolve(cwd);
   try {
-    return fs9__default.realpathSync.native(resolved);
+    return fs10__default.realpathSync.native(resolved);
   } catch {
     return resolved;
   }
@@ -37174,8 +37461,8 @@ var DIRECTORY_ENTRY_CAP = 500;
 var WINDOWS_DRIVE_LETTERS = "ABCDEFGHIJKLMNOPQRSTUVWXYZ".split("");
 async function listTheaterFolders(requestedPath, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const stat4 = deps.stat ?? fs9__default.promises.stat;
-  const opendir = deps.opendir ?? fs9__default.promises.opendir;
+  const stat4 = deps.stat ?? fs10__default.promises.stat;
+  const opendir = deps.opendir ?? fs10__default.promises.opendir;
   const targetPath = normalizeListPath(requestedPath, platform, deps);
   const roots = await listRoots(platform, stat4);
   const targetStat = await statDirectory(targetPath, stat4);
@@ -37286,7 +37573,7 @@ var GRANT_ID_BYTES = 24;
 var DEFAULT_GRANT_TTL_MS2 = 6e4;
 function createFolderGrantStore(deps = {}) {
   const randomId = deps.randomId ?? (() => crypto5.randomBytes(GRANT_ID_BYTES).toString("base64url"));
-  const statSync2 = deps.statSync ?? fs9__default.statSync;
+  const statSync2 = deps.statSync ?? fs10__default.statSync;
   const ttlMs = deps.ttlMs ?? DEFAULT_GRANT_TTL_MS2;
   const now = deps.now ?? Date.now;
   const grants = /* @__PURE__ */ new Map();
@@ -37312,7 +37599,7 @@ function createFolderGrantStore(deps = {}) {
   }
   return { issue: issue3, consume };
 }
-function validateAbsoluteDirectory(cwd, statSync2 = fs9__default.statSync) {
+function validateAbsoluteDirectory(cwd, statSync2 = fs10__default.statSync) {
   if (typeof cwd !== "string" || cwd.length === 0 || cwd.includes("\0")) throw new Error("invalid_folder");
   if (isWindowsAmbiguousGrantPath(cwd) || !path18__default.isAbsolute(cwd)) throw new Error("invalid_folder");
   const normalized = path18__default.resolve(cwd);
@@ -37696,13 +37983,13 @@ function isJsonRequest(request) {
   return accept.includes("application/json") || requestedWith.toLowerCase() === "xmlhttprequest";
 }
 function formatHostForUrl(host) {
-  return net2.isIP(host) === 6 ? `[${host}]` : host;
+  return net3.isIP(host) === 6 ? `[${host}]` : host;
 }
 function canonicalizeAllowedHost(host) {
   const unbracketed = stripIpv6Brackets2(host).toLowerCase();
   if (unbracketed.includes("%")) return null;
   if (isIpv4MappedAddress(unbracketed)) return null;
-  if (net2.isIP(unbracketed) === 6) {
+  if (net3.isIP(unbracketed) === 6) {
     try {
       return stripIpv6Brackets2(new URL(`http://[${unbracketed}]:1`).hostname).toLowerCase();
     } catch {
@@ -37716,7 +38003,7 @@ function enumerateWildcardAccessHosts(interfaces) {
   for (const entries of Object.values(interfaces)) {
     for (const entry of entries ?? []) {
       if (entry.internal) continue;
-      if (net2.isIP(entry.address) === 0) continue;
+      if (net3.isIP(entry.address) === 0) continue;
       hosts.push(entry.address);
     }
   }
@@ -37750,7 +38037,7 @@ function parseHostHeader(value) {
   const host = canonicalizeAllowedHost(parts[0] ?? "");
   const port = Number(parts[1] ?? "");
   if (!host || !Number.isInteger(port)) return null;
-  if (net2.isIP(host) === 6) return null;
+  if (net3.isIP(host) === 6) return null;
   return { host, port };
 }
 function readRawHeaderValues(rawHeaders, name) {
@@ -38308,8 +38595,8 @@ function migrateAgentCliIds(state) {
 function backupDurableStateBeforeAgentCliIdMigration(stateFilePath) {
   const backupPath = `${stateFilePath}${BACKUP_FILE_SUFFIX}`;
   try {
-    if (!fs9__default.existsSync(stateFilePath) || fs9__default.existsSync(backupPath)) return;
-    fs9__default.copyFileSync(stateFilePath, backupPath);
+    if (!fs10__default.existsSync(stateFilePath) || fs10__default.existsSync(backupPath)) return;
+    fs10__default.copyFileSync(stateFilePath, backupPath);
   } catch (error51) {
     console.warn(`[fleet-console] Agent CLI id migration backup skipped: ${error51 instanceof Error ? error51.message : String(error51)}`);
   }
@@ -38356,11 +38643,11 @@ function migrateLegacyCaptures(deps) {
 function migrateLegacyCapturesStrict(deps) {
   if (!path18__default.isAbsolute(deps.consoleDataDir)) return;
   const capturesDir = path18__default.join(deps.consoleDataDir, LEGACY_CAPTURES_DIR_NAME);
-  if (!fs9__default.existsSync(capturesDir)) return;
+  if (!fs10__default.existsSync(capturesDir)) return;
   let migrated = false;
   let retained = false;
   try {
-    const entries = fs9__default.readdirSync(capturesDir);
+    const entries = fs10__default.readdirSync(capturesDir);
     for (const entry of entries) {
       if (!entry.endsWith(".json")) continue;
       const operationId = entry.slice(0, -".json".length);
@@ -38389,7 +38676,7 @@ function migrateLegacyCapturesStrict(deps) {
   }
   if ((!migrated || saved) && !retained) {
     try {
-      fs9__default.rmSync(capturesDir, { recursive: true, force: true });
+      fs10__default.rmSync(capturesDir, { recursive: true, force: true });
     } catch (error51) {
       console.warn(`[fleet-console] Legacy captures directory removal failed: ${error51 instanceof Error ? error51.message : String(error51)}`);
     }
@@ -38400,7 +38687,7 @@ function processCaptureFile(deps, capturesDir, operationId, entry) {
   if (operation) {
     if (hasProviderSession(operation.payload)) return { migrated: false, retained: false };
     const filePath = path18__default.join(capturesDir, entry);
-    const parsed = JSON.parse(fs9__default.readFileSync(filePath, "utf8"));
+    const parsed = JSON.parse(fs10__default.readFileSync(filePath, "utf8"));
     const providerSession = sanitizeProviderSession(parsed);
     if (!providerSession) return { migrated: false, retained: false };
     deps.operations.patch(operationId, {
@@ -38438,7 +38725,7 @@ var ENDPOINT_FILE = "listener.json";
 var STORE_VERSION2 = 2;
 function createRemoteEndpointStore(consoleDir, deps = {}) {
   const storage = createRemoteStorage(consoleDir, deps);
-  const readFile7 = deps.readFile ?? ((file2) => fs9__default.readFileSync(file2, "utf8"));
+  const readFile7 = deps.readFile ?? ((file2) => fs10__default.readFileSync(file2, "utf8"));
   let endpoint = read();
   function read() {
     try {
@@ -38478,168 +38765,6 @@ function sameEndpoint(left, right) {
 function isBindablePort2(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= 65535;
 }
-
-// access-protocol/index.ts
-var ACCESS_LINK_SCHEME = "fleet:";
-var ACCESS_LINK_HOST = "join";
-var ACCESS_LINK_PREFIX = "fleet://join?code=";
-var ACCESS_LINK_VERSION = 1;
-var ACCESS_JOIN_PATH = "/api/v1/join";
-var MAX_ACCESS_LABEL_LENGTH = 48;
-var MAX_ACCESS_LINK_LENGTH = 4096;
-var ACCESS_TOKEN = /^[A-Za-z0-9_-]{16,512}$/u;
-var CERTIFICATE_FINGERPRINT = /^[0-9A-F]{64}$/u;
-var PAYLOAD_KEYS = ["v", "endpoint", "token", "fingerprint", "label"];
-var BASE64_URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-var BASE64_URL_DECODE = createBase64UrlDecodeTable();
-function encodeAccessLink(payload) {
-  const envelope = {
-    v: ACCESS_LINK_VERSION,
-    endpoint: payload.endpoint,
-    token: payload.token,
-    fingerprint: normalizeFingerprint(payload.fingerprint),
-    label: sanitizeAccessLabel(payload.label)
-  };
-  return `${ACCESS_LINK_PREFIX}${toBase64Url(new TextEncoder().encode(JSON.stringify(envelope)))}`;
-}
-function parseAccessLink(input) {
-  if (typeof input !== "string") throw invalidLink();
-  const candidate = input.trim();
-  if (candidate.length === 0 || candidate.length > MAX_ACCESS_LINK_LENGTH) throw invalidLink();
-  if (containsDisallowedLinkWhitespace(candidate)) throw invalidLink();
-  let url2;
-  try {
-    url2 = new URL(candidate);
-  } catch {
-    throw invalidLink();
-  }
-  if (url2.protocol !== ACCESS_LINK_SCHEME || url2.username || url2.password || url2.hash) throw invalidLink();
-  if (url2.hostname !== ACCESS_LINK_HOST || url2.port !== "" || url2.pathname !== "") throw invalidLink();
-  const keys = [...url2.searchParams.keys()];
-  if (keys.length !== 1 || keys[0] !== "code") throw invalidLink();
-  return readPayload(decodePayload(url2.searchParams.get("code") ?? ""));
-}
-function decodePayload(code) {
-  if (!/^[A-Za-z0-9_-]+$/u.test(code)) throw invalidLink();
-  let text;
-  try {
-    text = new TextDecoder("utf-8", { fatal: true }).decode(fromBase64Url(code));
-  } catch {
-    throw invalidLink();
-  }
-  try {
-    return JSON.parse(text);
-  } catch {
-    throw invalidLink();
-  }
-}
-function readPayload(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalidLink();
-  const entry = value;
-  const keys = Object.keys(entry);
-  if (keys.length !== PAYLOAD_KEYS.length || !PAYLOAD_KEYS.every((key) => keys.includes(key))) throw invalidLink();
-  if (entry.v !== ACCESS_LINK_VERSION) throw invalidLink();
-  if (typeof entry.endpoint !== "string" || typeof entry.token !== "string" || typeof entry.fingerprint !== "string" || typeof entry.label !== "string") throw invalidLink();
-  const endpoint = readEndpoint(entry.endpoint);
-  const token = entry.token;
-  const fingerprint = normalizeFingerprint(entry.fingerprint);
-  if (!ACCESS_TOKEN.test(token) || !CERTIFICATE_FINGERPRINT.test(fingerprint)) throw invalidLink();
-  const label = sanitizeAccessLabel(entry.label);
-  if (label.length === 0) throw invalidLink();
-  return {
-    origin: endpoint.origin,
-    hostname: pinHostname(endpoint.hostname),
-    port: endpoint.port,
-    label,
-    consoleUrl: new URL("/console/", endpoint.origin).toString(),
-    joinUrl: new URL(ACCESS_JOIN_PATH, endpoint.origin).toString(),
-    token,
-    fingerprint
-  };
-}
-function readEndpoint(value) {
-  let url2;
-  try {
-    url2 = new URL(value);
-  } catch {
-    throw invalidLink();
-  }
-  if (url2.protocol !== "https:" || url2.username || url2.password || url2.search || url2.hash) throw invalidLink();
-  if (url2.pathname !== "/" && url2.pathname !== "") throw invalidLink();
-  if (url2.hostname.length === 0) throw invalidLink();
-  const port = url2.port === "" ? 443 : Number(url2.port);
-  if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw invalidLink();
-  return { origin: url2.origin, hostname: url2.hostname, port };
-}
-function pinHostname(hostname5) {
-  const unwrapped = hostname5.startsWith("[") && hostname5.endsWith("]") ? hostname5.slice(1, -1) : hostname5;
-  return unwrapped.toLowerCase();
-}
-function normalizeFingerprint(value) {
-  return value.replace(/[^0-9a-fA-F]/gu, "").toUpperCase();
-}
-function sanitizeAccessLabel(value) {
-  return Array.from(value).filter((character) => !isDisallowedAccessLabelCharacter(character.codePointAt(0))).join("").replace(/\s+/gu, " ").trim().slice(0, MAX_ACCESS_LABEL_LENGTH);
-}
-function containsDisallowedLinkWhitespace(value) {
-  for (const character of value) {
-    const codePoint = character.codePointAt(0);
-    if (codePoint <= 31 || codePoint === 127 || isWhitespaceCharacter(character)) return true;
-  }
-  return false;
-}
-function isWhitespaceCharacter(character) {
-  return character.trim().length === 0;
-}
-function isDisallowedAccessLabelCharacter(codePoint) {
-  return codePoint <= 31 || codePoint >= 127 && codePoint <= 159 || codePoint >= 8203 && codePoint <= 8207 || codePoint === 8232 || codePoint === 8233 || codePoint >= 8234 && codePoint <= 8238 || codePoint >= 8294 && codePoint <= 8297;
-}
-function toBase64Url(bytes) {
-  let encoded = "";
-  for (let index = 0; index < bytes.length; index += 3) {
-    const first = bytes[index];
-    const second = bytes[index + 1];
-    const third = bytes[index + 2];
-    encoded += BASE64_URL_ALPHABET[first >> 2];
-    encoded += BASE64_URL_ALPHABET[(first & 3) << 4 | (second ?? 0) >> 4];
-    if (second !== void 0) encoded += BASE64_URL_ALPHABET[(second & 15) << 2 | (third ?? 0) >> 6];
-    if (third !== void 0) encoded += BASE64_URL_ALPHABET[third & 63];
-  }
-  return encoded;
-}
-function fromBase64Url(value) {
-  if (value.length % 4 === 1) throw invalidLink();
-  const bytes = new Uint8Array(Math.floor(value.length * 6 / 8));
-  let buffer = 0;
-  let bits = 0;
-  let offset = 0;
-  for (const character of value) {
-    const decoded = BASE64_URL_DECODE[character.charCodeAt(0)] ?? -1;
-    if (decoded < 0) throw invalidLink();
-    buffer = buffer << 6 | decoded;
-    bits += 6;
-    if (bits >= 8) {
-      bits -= 8;
-      bytes[offset] = buffer >> bits & 255;
-      offset += 1;
-    }
-  }
-  if (bits > 0 && (buffer & (1 << bits) - 1) !== 0) throw invalidLink();
-  return bytes;
-}
-function createBase64UrlDecodeTable() {
-  const table = new Int16Array(128);
-  table.fill(-1);
-  for (let index = 0; index < BASE64_URL_ALPHABET.length; index += 1) {
-    table[BASE64_URL_ALPHABET.charCodeAt(index)] = index;
-  }
-  return table;
-}
-function invalidLink() {
-  return new Error("pairing_target_invalid");
-}
-
-// core/host/remote-identity.ts
 var CERTIFICATE_FILE = "identity-cert.pem";
 var KEY_FILE = "identity-key.pem";
 var META_FILE = "identity.json";
@@ -38647,7 +38772,7 @@ var VALIDITY_DAYS = 825;
 var RENEW_BEFORE_MS = 30 * 24 * 60 * 60 * 1e3;
 function createRemoteIdentityStore(consoleDir, deps = {}) {
   const storage = createRemoteStorage(consoleDir, deps);
-  const readFile7 = deps.readFile ?? ((file2) => fs9__default.readFileSync(file2, "utf8"));
+  const readFile7 = deps.readFile ?? ((file2) => fs10__default.readFileSync(file2, "utf8"));
   const generate = deps.generate ?? generateSelfSignedCertificate;
   const now = deps.now ?? Date.now;
   function read() {
@@ -38717,7 +38842,7 @@ var MAX_HOSTS = 64;
 var HANDOFF_TTL_MS = 5 * 60 * 1e3;
 function createRemoteHostStore(consoleDir, deps = {}) {
   const storage = createRemoteStorage(consoleDir, deps);
-  const readFile7 = deps.readFile ?? ((file2) => fs9__default.readFileSync(file2, "utf8"));
+  const readFile7 = deps.readFile ?? ((file2) => fs10__default.readFileSync(file2, "utf8"));
   const now = deps.now ?? Date.now;
   const randomId = deps.randomId ?? (() => crypto5.randomUUID());
   const pending = /* @__PURE__ */ new Map();
@@ -38868,32 +38993,6 @@ function normalizeRemoteJoinSource(address) {
   const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/iu.exec(address);
   return mapped === null ? address : mapped[1];
 }
-var REMOTE_PROBE_TIMEOUT_MS = 6e3;
-function probeRemoteIdentity(hostname5, port, expected, timeoutMs = REMOTE_PROBE_TIMEOUT_MS) {
-  return new Promise((resolve3) => {
-    const settle = (result) => {
-      socket.destroy();
-      resolve3(result);
-    };
-    const socket = tls.connect({
-      host: hostname5,
-      port,
-      rejectUnauthorized: false,
-      // IP 리터럴에는 SNI를 붙이지 않는다 — 규격상 SNI는 이름에만 쓴다.
-      ...net2.isIP(hostname5) === 0 ? { servername: hostname5 } : {}
-    }, () => {
-      const certificate = socket.getPeerX509Certificate();
-      if (!certificate) {
-        settle({ state: "unreachable" });
-        return;
-      }
-      const presented = normalizeFingerprint(certificate.fingerprint256);
-      settle(presented === normalizeFingerprint(expected) ? { state: "match" } : { state: "mismatch", presented });
-    });
-    socket.setTimeout(timeoutMs, () => settle({ state: "unreachable" }));
-    socket.on("error", () => settle({ state: "unreachable" }));
-  });
-}
 var WSL_ROOT = "\\\\wsl.localhost";
 var WSL_TMP = "tmp";
 var LOCK_FILE = "console.lock";
@@ -38906,7 +39005,7 @@ function isUsableDistroName(name) {
 var WSL_LIST_TIMEOUT_MS = 3e3;
 var REACHABLE_TIMEOUT_MS = 700;
 async function listLocalConsoles(deps = {}) {
-  const fileSystem = deps.fileSystem ?? fs9__default;
+  const fileSystem = deps.fileSystem ?? fs10__default;
   const isAlive = deps.isAlive ?? processIsAlive;
   const entries = [];
   const seen = /* @__PURE__ */ new Set();
@@ -39016,7 +39115,7 @@ function portAnswers(origin) {
       resolve3(false);
       return;
     }
-    const socket = net2.connect({ host: url2.hostname, port: Number(url2.port) }, () => {
+    const socket = net3.connect({ host: url2.hostname, port: Number(url2.port) }, () => {
       socket.destroy();
       resolve3(true);
     });
@@ -39073,14 +39172,14 @@ function parseFleetPluginManifest(value) {
   };
 }
 function discoverPluginRoot(root, builtInDistRoot, external) {
-  if (!fs9__default.existsSync(root)) return [];
-  const entries = fs9__default.readdirSync(root, { withFileTypes: true });
+  if (!fs10__default.existsSync(root)) return [];
+  const entries = fs10__default.readdirSync(root, { withFileTypes: true });
   const plugins = [];
   for (const entry of entries) {
     if (!entry.isDirectory() || entry.name === "shared") continue;
     const pluginRoot = path18__default.join(root, entry.name);
     const manifestPath = path18__default.join(pluginRoot, "plugin.json");
-    if (!fs9__default.existsSync(manifestPath)) continue;
+    if (!fs10__default.existsSync(manifestPath)) continue;
     const manifest = readManifest(manifestPath);
     if (!manifest) continue;
     const clientEntry = resolveOptionalManifestEntry(pluginRoot, manifest.client, "client");
@@ -39092,14 +39191,14 @@ function discoverPluginRoot(root, builtInDistRoot, external) {
   return plugins;
 }
 function discoverDistPluginRoot(root) {
-  if (!fs9__default.existsSync(root)) return [];
-  const entries = fs9__default.readdirSync(root, { withFileTypes: true });
+  if (!fs10__default.existsSync(root)) return [];
+  const entries = fs10__default.readdirSync(root, { withFileTypes: true });
   const plugins = [];
   for (const entry of entries) {
     if (!entry.isDirectory() || entry.name === "shared") continue;
     const pluginRoot = path18__default.join(root, entry.name);
     const manifestPath = path18__default.join(pluginRoot, "plugin.json");
-    const manifest = fs9__default.existsSync(manifestPath) ? readManifest(manifestPath) : readDistPluginManifest(entry.name);
+    const manifest = fs10__default.existsSync(manifestPath) ? readManifest(manifestPath) : readDistPluginManifest(entry.name);
     if (!manifest) continue;
     const clientEntry = resolveOptionalManifestEntry(pluginRoot, manifest.client, "client");
     if (clientEntry === false) continue;
@@ -39111,7 +39210,7 @@ function discoverDistPluginRoot(root) {
 }
 function readManifest(manifestPath) {
   try {
-    const manifest = parseFleetPluginManifest(JSON.parse(fs9__default.readFileSync(manifestPath, "utf8")));
+    const manifest = parseFleetPluginManifest(JSON.parse(fs10__default.readFileSync(manifestPath, "utf8")));
     if (!manifest) console.warn(`[fleet-console] Plugin manifest skipped: invalid manifest at ${manifestPath}`);
     return manifest;
   } catch (error51) {
@@ -39126,10 +39225,10 @@ function resolveRoutesEntry(pluginRoot, manifest, builtInDistRoot) {
     if (manifestRoute2) return manifestRoute2;
   }
   const manifestRoute = path18__default.join(pluginRoot, "routes.ts");
-  if (fs9__default.existsSync(manifestRoute)) return manifestRoute;
+  if (fs10__default.existsSync(manifestRoute)) return manifestRoute;
   if (!builtInDistRoot) return null;
   const builtRoute = path18__default.join(builtInDistRoot, manifest.id, "routes.mjs");
-  return fs9__default.existsSync(builtRoute) ? builtRoute : null;
+  return fs10__default.existsSync(builtRoute) ? builtRoute : null;
 }
 function resolveDistRoutesEntry(pluginRoot, manifest) {
   const routesEntry = resolveOptionalManifestEntry(pluginRoot, manifest.routes ?? "routes.mjs", "routes");
@@ -39143,9 +39242,9 @@ function resolveOptionalManifestEntry(pluginRoot, entryPath, label) {
     return false;
   }
   const candidate = path18__default.resolve(pluginRoot, entryPath);
-  if (!fs9__default.existsSync(candidate)) return null;
-  const rootRealpath = fs9__default.realpathSync.native(pluginRoot);
-  const entryRealpath = fs9__default.realpathSync.native(candidate);
+  if (!fs10__default.existsSync(candidate)) return null;
+  const rootRealpath = fs10__default.realpathSync.native(pluginRoot);
+  const entryRealpath = fs10__default.realpathSync.native(candidate);
   if (!isSubpath(rootRealpath, entryRealpath)) {
     console.warn(`[fleet-console] Plugin ${label} entry skipped: path escapes plugin root ${entryPath}`);
     return false;
@@ -40073,7 +40172,7 @@ function tryServeStaticConsole(req, res, pathname, consoleRoot, getActiveTheme)
     return true;
   }
   try {
-    const data = fs9__default.readFileSync(absolutePath);
+    const data = fs10__default.readFileSync(absolutePath);
     const contentType = MIME_TYPES[path18__default.extname(absolutePath)] ?? "application/octet-stream";
     res.writeHead(200, withSecurityHeaders2({ "Content-Type": contentType }));
     if (req.method === "HEAD") {
@@ -40094,7 +40193,7 @@ function tryServeStaticConsole(req, res, pathname, consoleRoot, getActiveTheme)
 }
 function serveFallbackIndex(req, res, consoleRoot, getActiveTheme) {
   try {
-    const data = fs9__default.readFileSync(path18__default.join(consoleRoot, "index.html"));
+    const data = fs10__default.readFileSync(path18__default.join(consoleRoot, "index.html"));
     res.writeHead(200, withSecurityHeaders2({ "Content-Type": MIME_TYPES[".html"] }));
     if (req.method === "HEAD") {
       res.end();
@@ -40141,7 +40240,7 @@ function consoleUpdateProgressPath(dataDir) {
   return path18__default.join(dataDir, CONSOLE_UPDATE_PROGRESS_FILE);
 }
 function readConsoleUpdateProgress(dataDir, deps = {}) {
-  const readFile7 = deps.readFile ?? ((filePath) => fs9__default.readFileSync(filePath, "utf8"));
+  const readFile7 = deps.readFile ?? ((filePath) => fs10__default.readFileSync(filePath, "utf8"));
   const now = deps.now ?? Date.now;
   let raw;
   try {
@@ -40201,10 +40300,10 @@ function isConsoleUpdatePhase(value) {
 }
 function writeConsoleUpdateProgress(dataDir, record4, deps = {}) {
   const makeDir = deps.makeDir ?? ((dirPath, options) => {
-    fs9__default.mkdirSync(dirPath, options);
+    fs10__default.mkdirSync(dirPath, options);
   });
   const writeFile5 = deps.writeFile ?? ((filePath, content, options) => {
-    fs9__default.writeFileSync(filePath, content, { mode: options.mode });
+    fs10__default.writeFileSync(filePath, content, { mode: options.mode });
   });
   makeDir(dataDir, { recursive: true, mode: 448 });
   writeFile5(consoleUpdateProgressPath(dataDir), JSON.stringify(record4, null, 2), { mode: PROGRESS_FILE_MODE });
@@ -40222,7 +40321,7 @@ function createConsoleUpdateApplyService(deps = {}) {
   const childEnv = env.FLEET_CONSOLE_NO_SYSTEM_CA === "1" ? env : withNodeSystemCa(env);
   const execPath = deps.execPath ?? process4.execPath;
   const makeDir = deps.makeDir ?? ((dirPath, options) => {
-    fs9__default.mkdirSync(dirPath, options);
+    fs10__default.mkdirSync(dirPath, options);
   });
   const now = deps.now ?? Date.now;
   const processPid = deps.processPid ?? process4.pid;
@@ -40231,7 +40330,7 @@ function createConsoleUpdateApplyService(deps = {}) {
   const spawnWorker = deps.spawnWorker ?? defaultSpawnWorker;
   const tmpDir = deps.tmpDir ?? os4__default.tmpdir();
   const writeFile5 = deps.writeFile ?? ((filePath, content, options) => {
-    fs9__default.writeFileSync(filePath, content, { mode: options.mode });
+    fs10__default.writeFileSync(filePath, content, { mode: options.mode });
   });
   async function start(request) {
     if (isManagedRuntimePackageRoot(request.currentPackageRoot)) throw new Error("managed_runtime_update_requires_relaunch");
@@ -40654,7 +40753,7 @@ function readEndpointPort(endpoint) {
 function isManagedRuntimePackageRoot(packageRoot) {
   if (path18__default.basename(packageRoot) !== "latest" || path18__default.basename(path18__default.dirname(packageRoot)) !== "console") return false;
   try {
-    return isDesktopResourceRootMarkerValid(fs9__default.readFileSync(path18__default.join(packageRoot, DESKTOP_RESOURCE_ROOT_MARKER), "utf8"));
+    return isDesktopResourceRootMarkerValid(fs10__default.readFileSync(path18__default.join(packageRoot, DESKTOP_RESOURCE_ROOT_MARKER), "utf8"));
   } catch {
     return false;
   }
@@ -40705,7 +40804,7 @@ function defaultSpawnWorker(execPath, args, options) {
 }
 function resolveDefaultServerModulePath() {
   const builtPath = fileURLToPath(new URL("../dist/cli.mjs", import.meta.url));
-  if (fs9__default.existsSync(builtPath)) return builtPath;
+  if (fs10__default.existsSync(builtPath)) return builtPath;
   const sourcePath = fileURLToPath(import.meta.url);
   if (sourcePath.endsWith(".ts")) {
     return sourcePath.replace(/update-apply\.ts$/, "cli.ts");
@@ -41151,8 +41250,8 @@ function createConsoleServer(deps = {}) {
     unregisterTheaterWorkspaces: (theaterId) => codex.unregisterTheaterWorkspaces(theaterId),
     validateTheaterRestore: async (theater) => {
       try {
-        const restoredRealpath = await fs9__default.promises.realpath(theater.path);
-        const stat4 = await fs9__default.promises.stat(restoredRealpath);
+        const restoredRealpath = await fs10__default.promises.realpath(theater.path);
+        const stat4 = await fs10__default.promises.stat(restoredRealpath);
         if (!stat4.isDirectory() || restoredRealpath !== theater.realpath || workspaceHash(restoredRealpath) !== theater.id) {
           throw new Error("restore_conflict");
         }
@@ -42942,7 +43041,7 @@ function resolveBuiltInPluginDiscoveryRoots(packageRoot) {
   const packageRootRepo = path18__default.resolve(packageRoot, "..", "..");
   const sourceRoot = path18__default.join(packageRootRepo, "runtime", "fleet-plugins");
   return {
-    ...fs9__default.existsSync(sourceRoot) ? { builtInSourceRoot: sourceRoot } : {},
+    ...fs10__default.existsSync(sourceRoot) ? { builtInSourceRoot: sourceRoot } : {},
     builtInDistRoot: path18__default.join(packageRoot, "dist", "fleet-plugins")
   };
 }
@@ -43141,7 +43240,7 @@ function isAllowedTerminalOrigin(req, expectedOrigin) {
 async function readPluginStorageJson(dataDir, pluginId, key) {
   const file2 = resolvePluginStorageFile(dataDir, pluginId, key);
   try {
-    return JSON.parse(await fs9__default.promises.readFile(file2, "utf8"));
+    return JSON.parse(await fs10__default.promises.readFile(file2, "utf8"));
   } catch (error51) {
     if (isNodeError(error51) && error51.code === "ENOENT") return null;
     throw error51;
@@ -43149,8 +43248,8 @@ async function readPluginStorageJson(dataDir, pluginId, key) {
 }
 async function writePluginStorageJson(dataDir, pluginId, key, value) {
   const file2 = resolvePluginStorageFile(dataDir, pluginId, key);
-  await fs9__default.promises.mkdir(path18__default.dirname(file2), { recursive: true });
-  await fs9__default.promises.writeFile(file2, JSON.stringify(value), "utf8");
+  await fs10__default.promises.mkdir(path18__default.dirname(file2), { recursive: true });
+  await fs10__default.promises.writeFile(file2, JSON.stringify(value), "utf8");
 }
 function resolvePluginStorageFile(dataDir, pluginId, key) {
   if (!/^[a-z0-9][a-z0-9._-]*$/i.test(pluginId) || !/^[a-z0-9][a-z0-9._-]*$/i.test(key)) {
@@ -43161,18 +43260,6 @@ function resolvePluginStorageFile(dataDir, pluginId, key) {
 function isNodeError(error51) {
   return error51 instanceof Error && "code" in error51;
 }
-function createConsoleStalePolicy(deps = {}) {
-  const fsImpl = deps.fs ?? fs9__default;
-  function isBuildStale(lock, buildFile) {
-    try {
-      return lock.startedAt < fsImpl.statSync(buildFile).mtimeMs;
-    } catch (err) {
-      if (err.code === "ENOENT") return false;
-      throw err;
-    }
-  }
-  return { isBuildStale };
-}
 
 // core/host/console-lifecycle.ts
 var FIXED_HOST = "127.0.0.1";
@@ -43467,7 +43554,7 @@ ${await runConsoleStatus()}
 }
 function resolveDefaultServerModulePath2() {
   const builtPath = new URL("../dist/cli.mjs", import.meta.url).pathname;
-  if (fs9__default.existsSync(builtPath)) return builtPath;
+  if (fs10__default.existsSync(builtPath)) return builtPath;
   return fileURLToPath(import.meta.url);
 }
 function readHookSessionId(env) {
@@ -43526,7 +43613,7 @@ function readStdinBestEffort() {
 function isCliDirectRun(argv1, moduleUrl = import.meta.url) {
   if (!argv1) return false;
   try {
-    return fs9__default.realpathSync(path18__default.resolve(argv1)) === fs9__default.realpathSync(fileURLToPath(moduleUrl));
+    return fs10__default.realpathSync(path18__default.resolve(argv1)) === fs10__default.realpathSync(fileURLToPath(moduleUrl));
   } catch {
     return false;
   }