@drisp/cli 0.5.22 → 0.5.24

package/dist/{chunk-HXW5N4GE.js → chunk-QBMYQJFX.js}

@@ -17,13 +17,14 @@ import {
   TransportUnreachableError,
   createUdsClientTransport,
   generateChannelRequestId,
+  openVersionedDb,
   readDashboardClientConfig,
   refreshDashboardAccessToken,
   resolveGatewayPaths,
   traceGatewayFrame,
   trackGatewayTransportReconnect,
   writeGatewayTrace
-} from "./chunk-BTY7MYYT.js";
+} from "./chunk-YU2WMPRC.js";
 import {
   compileWorkflowPlan,
   createWorkflowRunner,
@@ -34,7 +35,7 @@ import {
   resolveWorkflow,
   resolveWorkflowInstall,
   resolveWorkflowPlugins
-} from "./chunk-DSWRVUOO.js";
+} from "./chunk-7UUPLAP4.js";
 
 // src/infra/daemon/stateDir.ts
 import fs from "fs";
@@ -3374,7 +3375,7 @@ function createAssistantMessageAccumulator() {
   };
 }
 
-// src/harnesses/claude/process/useProcess.ts
+// src/harnesses/claude/session/turnConfig.ts
 function mergeIsolation(base, pluginMcpConfig, perCommand) {
   if (!pluginMcpConfig && !perCommand) return base;
   return {
@@ -3383,6 +3384,17 @@ function mergeIsolation(base, pluginMcpConfig, perCommand) {
     ...pluginMcpConfig ? { mcpConfig: pluginMcpConfig } : {}
   };
 }
+function resolveClaudeSessionId(continuation) {
+  if (!continuation || continuation.mode === "fresh") {
+    return void 0;
+  }
+  if (continuation.mode === "resume") {
+    return continuation.handle;
+  }
+  throw new Error("Claude harness does not support reuse-current continuation");
+}
+
+// src/harnesses/claude/process/useProcess.ts
 var MAX_OUTPUT = 1e3;
 var KILL_TIMEOUT_MS = 3e3;
 var NULL_TOKENS = {
@@ -3433,17 +3445,6 @@ function tokenUsageEquals(a, b) {
   return a.input === b.input && a.output === b.output && a.cacheRead === b.cacheRead && a.cacheWrite === b.cacheWrite && a.total === b.total && a.contextSize === b.contextSize && a.contextWindowSize === b.contextWindowSize;
 }
 var JQ_ASSISTANT_TEXT_FILTER = 'select(.type == "message" and .role == "assistant") | .content[] | select(.type == "text") | .text';
-function resolveClaudeSessionId(continuation) {
-  if (!continuation || continuation.mode === "fresh") {
-    return void 0;
-  }
-  if (continuation.mode === "resume") {
-    return continuation.handle;
-  }
-  throw new Error(
-    "Claude process hook does not support reuse-current continuation"
-  );
-}
 function useClaudeProcess(projectDir, instanceId, isolation, pluginMcpConfig, verbose, workflow, options) {
   const processRef = useRef(null);
   const abortRef = useRef(new AbortController());
@@ -3728,25 +3729,6 @@ function useClaudeProcess(projectDir, instanceId, isolation, pluginMcpConfig, ve
 }
 
 // src/harnesses/claude/session/controller.ts
-function mergeIsolation2(base, pluginMcpConfig, overrides) {
-  if (!pluginMcpConfig && !overrides) return base;
-  return {
-    ...resolveIsolationConfig(base),
-    ...overrides ?? {},
-    ...pluginMcpConfig ? { mcpConfig: pluginMcpConfig } : {}
-  };
-}
-function resolveClaudeSessionId2(continuation) {
-  if (!continuation || continuation.mode === "fresh") {
-    return void 0;
-  }
-  if (continuation.mode === "resume") {
-    return continuation.handle;
-  }
-  throw new Error(
-    "Claude session controller does not support reuse-current continuation"
-  );
-}
 function createClaudeSessionController(input) {
   const spawnProcess = input.spawnProcess ?? spawnClaude;
   const processConfig = input.processConfig;
@@ -3791,8 +3773,8 @@ function createClaudeSessionController(input) {
             prompt,
             projectDir: input.projectDir,
             instanceId: input.instanceId,
-            sessionId: resolveClaudeSessionId2(continuation),
-            isolation: mergeIsolation2(
+            sessionId: resolveClaudeSessionId(continuation),
+            isolation: mergeIsolation(
               processConfig,
               input.pluginMcpConfig,
               configOverride
@@ -6751,6 +6733,74 @@ function buildCodexPromptOptions(input) {
   };
 }
 
+// src/harnesses/codex/session/turnRunner.ts
+function createCodexTurnEventCollector() {
+  let message = "";
+  let tokenDelta = { ...NULL_TOKENS2 };
+  let turnStatus;
+  let turnErrorMessage;
+  return {
+    handle(event) {
+      const data = typeof event.data === "object" ? event.data : {};
+      if (event.kind === "message.delta") {
+        const delta = typeof data["delta"] === "string" ? data["delta"] : "";
+        message += delta;
+      }
+      if (event.kind === "usage.update") {
+        tokenDelta = readTokenUsage(data["delta"]);
+      }
+      if (event.kind === "turn.complete") {
+        turnStatus = typeof data["status"] === "string" ? data["status"] : turnStatus;
+      }
+      if (event.kind === "unknown" && event.hookName === "error") {
+        const payload = typeof data["payload"] === "object" && data["payload"] !== null ? data["payload"] : null;
+        const errorValue = typeof payload?.["error"] === "object" && payload["error"] !== null ? payload["error"] : null;
+        if (typeof errorValue?.["message"] === "string") {
+          turnErrorMessage = errorValue["message"];
+        }
+      }
+    },
+    result() {
+      if (turnStatus === "failed") {
+        return {
+          exitCode: 1,
+          error: new Error(turnErrorMessage ?? "Codex turn failed"),
+          tokens: tokenDelta,
+          streamMessage: message || null
+        };
+      }
+      return {
+        exitCode: 0,
+        error: null,
+        tokens: tokenDelta,
+        streamMessage: message || null
+      };
+    },
+    errorResult(error) {
+      return {
+        exitCode: null,
+        error,
+        tokens: tokenDelta,
+        streamMessage: message || null
+      };
+    }
+  };
+}
+async function runCodexTurn(runtime, prompt, optionsInput, hooks) {
+  const collector = createCodexTurnEventCollector();
+  const unsubscribe = runtime.onEvent(collector.handle);
+  try {
+    await runtime.sendPrompt(prompt, buildCodexPromptOptions(optionsInput));
+    return collector.result();
+  } catch (error) {
+    const normalized = error instanceof Error ? error : new Error(String(error));
+    hooks?.onError?.(normalized);
+    return collector.errorResult(normalized);
+  } finally {
+    unsubscribe();
+  }
+}
+
 // src/harnesses/codex/session/controller.ts
 function createCodexSessionController(input) {
   const runtime = input.runtime;
@@ -6770,73 +6820,19 @@ function createCodexSessionController(input) {
           streamMessage: null
         };
       }
-      let message = "";
-      let tokenDelta = { ...NULL_TOKENS2 };
-      let turnStatus;
-      let turnErrorMessage;
-      const unsubscribe = runtime.onEvent((event) => {
-        const data = typeof event.data === "object" ? event.data : {};
-        if (event.kind === "message.delta") {
-          const delta = typeof data["delta"] === "string" ? data["delta"] : "";
-          message += delta;
-        }
-        if (event.kind === "usage.update") {
-          tokenDelta = readTokenUsage(data["delta"]);
-        }
-        if (event.kind === "turn.complete") {
-          turnStatus = typeof data["status"] === "string" ? data["status"] : turnStatus;
-        }
-        if (event.kind === "unknown" && event.hookName === "error") {
-          const payload = typeof data["payload"] === "object" && data["payload"] !== null ? data["payload"] : null;
-          const errorValue = typeof payload?.["error"] === "object" && payload["error"] !== null ? payload["error"] : null;
-          if (typeof errorValue?.["message"] === "string") {
-            turnErrorMessage = errorValue["message"];
-          }
-        }
+      const turnPromise = runCodexTurn(runtime, prompt, {
+        processConfig,
+        continuation,
+        configOverride,
+        workflowPlan: input.workflowPlan,
+        pluginMcpConfig: input.pluginMcpConfig,
+        ephemeral: input.ephemeral
       });
-      const turnPromise = (async () => {
-        try {
-          await runtime.sendPrompt(
-            prompt,
-            buildCodexPromptOptions({
-              processConfig,
-              continuation,
-              configOverride,
-              workflowPlan: input.workflowPlan,
-              pluginMcpConfig: input.pluginMcpConfig,
-              ephemeral: input.ephemeral
-            })
-          );
-          if (turnStatus === "failed") {
-            return {
-              exitCode: 1,
-              error: new Error(turnErrorMessage ?? "Codex turn failed"),
-              tokens: tokenDelta,
-              streamMessage: message || null
-            };
-          }
-          return {
-            exitCode: 0,
-            error: null,
-            tokens: tokenDelta,
-            streamMessage: message || null
-          };
-        } catch (error) {
-          return {
-            exitCode: null,
-            error: error instanceof Error ? error : new Error(String(error)),
-            tokens: tokenDelta,
-            streamMessage: message || null
-          };
-        } finally {
-          activeTurnPromise = null;
-        }
-      })();
       activeTurnPromise = turnPromise;
       try {
         return await turnPromise;
       } finally {
-        unsubscribe();
+        activeTurnPromise = null;
       }
     },
     interrupt() {
@@ -6893,81 +6889,38 @@ function useCodexSessionController(runtime, processConfig, workflowPlan, ephemer
         };
       }
       setIsRunning(true);
-      let streamedMessage = "";
-      let turnTokens = { ...NULL_TOKENS2 };
-      let turnStatus;
-      let turnErrorMessage;
-      const unsubscribe = codexRuntime.onEvent((event) => {
-        const data = typeof event.data === "object" ? event.data : {};
-        if (event.kind === "message.delta") {
-          const delta = typeof data["delta"] === "string" ? data["delta"] : "";
-          streamedMessage += delta;
-        }
-        if (event.kind === "usage.update") {
-          turnTokens = readTokenUsage(data["delta"]);
-        }
-        if (event.kind === "turn.complete") {
-          turnStatus = typeof data["status"] === "string" ? data["status"] : turnStatus;
-        }
-        if (event.kind === "unknown" && event.hookName === "error") {
-          const payload = typeof data["payload"] === "object" && data["payload"] !== null ? data["payload"] : null;
-          const errorValue = typeof payload?.["error"] === "object" && payload["error"] !== null ? payload["error"] : null;
-          if (typeof errorValue?.["message"] === "string") {
-            turnErrorMessage = errorValue["message"];
-          }
-        }
-      });
-      const turnPromise = (async () => {
-        try {
-          await codexRuntime.sendPrompt(
-            prompt,
-            buildCodexPromptOptions({
-              processConfig,
-              continuation,
-              configOverride: _configOverride,
-              workflowPlan,
-              pluginMcpConfig,
-              ephemeral
-            })
-          );
-          if (turnStatus === "failed") {
-            return {
-              exitCode: 1,
-              error: new Error(turnErrorMessage ?? "Codex turn failed"),
-              tokens: turnTokens,
-              streamMessage: streamedMessage || null
-            };
-          }
-          return {
-            exitCode: 0,
-            error: null,
-            tokens: turnTokens,
-            streamMessage: streamedMessage || null
-          };
-        } catch (error) {
-          if (!abortRef.current.signal.aborted) {
-            onLifecycleEventRef.current?.({
-              type: "spawn_error",
-              message: error instanceof Error ? error.message : "Unknown Codex error",
-              failureCode: "spawn_error"
-            });
-          }
-          return {
-            exitCode: null,
-            error: error instanceof Error ? error : new Error("Unknown Codex error"),
-            tokens: turnTokens,
-            streamMessage: streamedMessage || null
-          };
-        } finally {
-          activeTurnPromiseRef.current = null;
-          unsubscribe();
-          if (!abortRef.current.signal.aborted) {
-            setIsRunning(false);
+      const turnPromise = runCodexTurn(
+        codexRuntime,
+        prompt,
+        {
+          processConfig,
+          continuation,
+          configOverride: _configOverride,
+          workflowPlan,
+          pluginMcpConfig,
+          ephemeral
+        },
+        {
+          onError: (error) => {
+            if (!abortRef.current.signal.aborted) {
+              onLifecycleEventRef.current?.({
+                type: "spawn_error",
+                message: error.message,
+                failureCode: "spawn_error"
+              });
+            }
           }
         }
-      })();
+      );
       activeTurnPromiseRef.current = turnPromise;
-      return await turnPromise;
+      try {
+        return await turnPromise;
+      } finally {
+        activeTurnPromiseRef.current = null;
+        if (!abortRef.current.signal.aborted) {
+          setIsRunning(false);
+        }
+      }
     },
     [codexRuntime, processConfig, workflowPlan, pluginMcpConfig, ephemeral]
   );
@@ -7491,7 +7444,7 @@ var EXEC_EXIT_CODE = {
 
 // src/app/exec/runner.ts
 import crypto2 from "crypto";
-import path18 from "path";
+import path17 from "path";
 
 // src/core/feed/entities.ts
 var ActorRegistry = class {
@@ -8336,28 +8289,11 @@ function createAgentMessageStream(eventBuilder, transcriptReader) {
   };
 }
 
-// src/core/feed/internals/rootPlanTracker.ts
-function createRootPlanTracker() {
-  let items = [];
-  return {
-    set(next) {
-      items = next;
-    },
-    current() {
-      return items;
-    },
-    differs(next) {
-      if (next.length !== items.length) return true;
-      for (let i = 0; i < next.length; i++) {
-        if (next[i]?.content !== items[i]?.content) return true;
-        if (next[i]?.status !== items[i]?.status) return true;
-      }
-      return false;
-    }
-  };
+// src/core/feed/internals/taskStateTracker.ts
+function extractTodoItems(toolInput) {
+  const input = toolInput;
+  return Array.isArray(input?.todos) ? input.todos : [];
 }
-
-// src/core/feed/internals/taskLifecycleTracker.ts
 function coerceTaskStatus(status) {
   switch (status) {
     case "pending":
@@ -8369,57 +8305,6 @@ function coerceTaskStatus(status) {
       return null;
   }
 }
-function createTaskLifecycleTracker() {
-  let items = [];
-  return {
-    current() {
-      return items;
-    },
-    upsertCreated({ taskId, subject, description, activeForm }) {
-      const task = {
-        taskId,
-        content: subject,
-        status: "pending",
-        activeForm: activeForm ?? description
-      };
-      const existingIndex = items.findIndex((item) => item.taskId === taskId);
-      if (existingIndex === -1) {
-        items = [...items, task];
-        return;
-      }
-      items = items.map(
-        (item, index) => index === existingIndex ? {
-          ...item,
-          taskId,
-          content: subject,
-          activeForm: task.activeForm ?? item.activeForm
-        } : item
-      );
-    },
-    markCompleted({ taskId, subject }) {
-      const existingIndex = items.findIndex((item) => item.taskId === taskId);
-      if (existingIndex === -1) {
-        if (!subject) return;
-        items = [...items, { taskId, content: subject, status: "completed" }];
-        return;
-      }
-      items = items.map(
-        (item, index) => index === existingIndex ? { ...item, status: "completed" } : item
-      );
-    },
-    updateStatus({ taskId, status }) {
-      items = items.map(
-        (item) => item.taskId === taskId ? { ...item, status } : item
-      );
-    }
-  };
-}
-
-// src/core/feed/internals/taskStateTracker.ts
-function extractTodoItems(toolInput) {
-  const input = toolInput;
-  return Array.isArray(input?.todos) ? input.todos : [];
-}
 function mapPlanStepStatus(status) {
   switch (status) {
     case "inProgress":
@@ -8432,18 +8317,69 @@ function mapPlanStepStatus(status) {
   }
 }
 function createTaskStateTracker() {
-  const rootPlan = createRootPlanTracker();
-  const taskLifecycle = createTaskLifecycleTracker();
+  let rootPlanItems = [];
+  let taskItems = [];
+  function rootPlanDiffers(next) {
+    if (next.length !== rootPlanItems.length) return true;
+    for (let i = 0; i < next.length; i++) {
+      if (next[i]?.content !== rootPlanItems[i]?.content) return true;
+      if (next[i]?.status !== rootPlanItems[i]?.status) return true;
+    }
+    return false;
+  }
+  function upsertCreatedTask(input) {
+    const { taskId, subject, description, activeForm } = input;
+    const task = {
+      taskId,
+      content: subject,
+      status: "pending",
+      activeForm: activeForm ?? description
+    };
+    const existingIndex = taskItems.findIndex((item) => item.taskId === taskId);
+    if (existingIndex === -1) {
+      taskItems = [...taskItems, task];
+      return;
+    }
+    taskItems = taskItems.map(
+      (item, index) => index === existingIndex ? {
+        ...item,
+        taskId,
+        content: subject,
+        activeForm: task.activeForm ?? item.activeForm
+      } : item
+    );
+  }
+  function markTaskCompleted(input) {
+    const { taskId, subject } = input;
+    const existingIndex = taskItems.findIndex((item) => item.taskId === taskId);
+    if (existingIndex === -1) {
+      if (!subject) return;
+      taskItems = [
+        ...taskItems,
+        { taskId, content: subject, status: "completed" }
+      ];
+      return;
+    }
+    taskItems = taskItems.map(
+      (item, index) => index === existingIndex ? { ...item, status: "completed" } : item
+    );
+  }
+  function updateTaskStatus(input) {
+    const { taskId, status } = input;
+    taskItems = taskItems.map(
+      (item) => item.taskId === taskId ? { ...item, status } : item
+    );
+  }
   function applyToolPre(input) {
     const { toolName, toolInput, actorId } = input;
     if (toolName === "TodoWrite" && actorId === "agent:root") {
-      rootPlan.set(extractTodoItems(toolInput));
+      rootPlanItems = extractTodoItems(toolInput);
     }
     if (toolName === "TaskUpdate") {
       const taskId = readString(toolInput["taskId"], toolInput["task_id"]);
       const status = coerceTaskStatus(toolInput["status"]);
       if (taskId && status) {
-        taskLifecycle.updateStatus({ taskId, status });
+        updateTaskStatus({ taskId, status });
       }
     }
   }
@@ -8455,7 +8391,7 @@ function createTaskStateTracker() {
       const taskId = readString(task["id"], task["task_id"]);
       const subject = readString(task["subject"], toolInput["subject"]);
       if (taskId && subject) {
-        taskLifecycle.upsertCreated({
+        upsertCreatedTask({
           taskId,
           subject,
           description: readString(toolInput["description"]),
@@ -8475,7 +8411,7 @@ function createTaskStateTracker() {
         readObject(response["statusChange"])["to"] ?? toolInput["status"]
       );
       if (taskId && status) {
-        taskLifecycle.updateStatus({ taskId, status });
+        updateTaskStatus({ taskId, status });
       }
     }
   }
@@ -8484,19 +8420,19 @@ function createTaskStateTracker() {
     const subject = readString(data["task_subject"]);
     const description = readString(data["task_description"]);
     if (taskId && subject) {
-      taskLifecycle.upsertCreated({ taskId, subject, description });
+      upsertCreatedTask({ taskId, subject, description });
     }
   }
   function applyTaskCompletedEvent(data) {
     const taskId = readString(data["task_id"]);
     const subject = readString(data["task_subject"]);
     if (taskId) {
-      taskLifecycle.markCompleted({ taskId, subject });
+      markTaskCompleted({ taskId, subject });
     }
   }
   return {
     current() {
-      return [...rootPlan.current(), ...taskLifecycle.current()];
+      return [...rootPlanItems, ...taskItems];
     },
     applyToolPre,
     applyToolPost,
@@ -8506,8 +8442,8 @@ function createTaskStateTracker() {
         content: typeof step.step === "string" ? step.step : "",
         status: mapPlanStepStatus(step.status)
       }));
-      if (!rootPlan.differs(next)) return false;
-      rootPlan.set(next);
+      if (!rootPlanDiffers(next)) return false;
+      rootPlanItems = next;
       return true;
     },
     applyTaskCreatedEvent,
@@ -8538,48 +8474,6 @@ function createTaskStateTracker() {
   };
 }
 
-// src/core/feed/internals/subagentTracker.ts
-function createSubagentTracker() {
-  const stack = [];
-  const descriptions = /* @__PURE__ */ new Map();
-  let pendingDescription;
-  return {
-    pushActor(actorId) {
-      stack.push(actorId);
-    },
-    popActor(actorId) {
-      const idx = stack.lastIndexOf(actorId);
-      if (idx !== -1) stack.splice(idx, 1);
-    },
-    peek() {
-      return stack.length > 0 ? stack[stack.length - 1] : void 0;
-    },
-    clear() {
-      stack.length = 0;
-    },
-    currentScope() {
-      return stack.length > 0 ? "subagent" : "root";
-    },
-    recordPendingDescription(description) {
-      pendingDescription = description;
-    },
-    clearPendingDescription() {
-      pendingDescription = void 0;
-    },
-    consumePendingDescription() {
-      const value = pendingDescription;
-      pendingDescription = void 0;
-      return value;
-    },
-    setDescription(agentId, description) {
-      descriptions.set(agentId, description);
-    },
-    description(agentId) {
-      return descriptions.get(agentId);
-    }
-  };
-}
-
 // src/core/feed/todo.ts
 function isSubagentTool(toolName) {
   return toolName === "Task" || toolName === "Agent";
@@ -8588,44 +8482,48 @@ function isSubagentTool(toolName) {
 // src/core/feed/internals/subagentLifecycle.ts
 function createSubagentLifecycle(args) {
   const { actors, runLifecycle } = args;
-  const tracker = createSubagentTracker();
+  const stack = [];
+  const descriptions = /* @__PURE__ */ new Map();
+  let pendingDescription;
   const actorIdFor = (agentId) => `subagent:${agentId}`;
   return {
     observeToolInput(toolName, toolInput) {
       if (!isSubagentTool(toolName)) return;
-      if (typeof toolInput["description"] === "string") {
-        tracker.recordPendingDescription(toolInput["description"]);
-      } else {
-        tracker.clearPendingDescription();
-      }
+      pendingDescription = typeof toolInput["description"] === "string" ? toolInput["description"] : void 0;
     },
     startSubagent({ agentId, agentType, fallbackDescription }) {
-      const description = tracker.consumePendingDescription() ?? fallbackDescription;
+      const consumed = pendingDescription;
+      pendingDescription = void 0;
+      const description = consumed ?? fallbackDescription;
       if (agentId) {
         actors.ensureSubagent(agentId, agentType ?? "unknown");
         const currentRun = runLifecycle.getCurrentRun();
         if (currentRun) currentRun.actors.subagent_ids.push(agentId);
-        tracker.pushActor(actorIdFor(agentId));
-        if (description) tracker.setDescription(agentId, description);
+        stack.push(actorIdFor(agentId));
+        if (description) descriptions.set(agentId, description);
       }
       return { actorId: "agent:root", description: description ?? void 0 };
     },
     stopSubagent(agentId) {
-      if (agentId) tracker.popActor(actorIdFor(agentId));
+      if (agentId) {
+        const actorId = actorIdFor(agentId);
+        const idx = stack.lastIndexOf(actorId);
+        if (idx !== -1) stack.splice(idx, 1);
+      }
       return {
         actorId: actorIdFor(agentId ?? "unknown"),
-        description: tracker.description(agentId ?? "")
+        description: descriptions.get(agentId ?? "")
       };
     },
     currentActor() {
-      return tracker.peek() ?? "agent:root";
+      return stack.at(-1) ?? "agent:root";
     },
     currentScope() {
-      return tracker.currentScope();
+      return stack.length > 0 ? "subagent" : "root";
     },
     actorIdFor,
     clear() {
-      tracker.clear();
+      stack.length = 0;
     }
   };
 }
@@ -9978,193 +9876,18 @@ function createFeedMapper(bootstrap) {
   };
 }
 
-// src/core/controller/rules.ts
-function ruleMatches(ruleToolName, toolName) {
-  if (ruleToolName === "*") return true;
-  if (ruleToolName === toolName) return true;
-  if (ruleToolName.endsWith("__*")) {
-    const prefix = ruleToolName.slice(0, -1);
-    return toolName.startsWith(prefix);
-  }
-  return false;
-}
-function matchRule(rules, toolName) {
-  const denyMatch = rules.find(
-    (r) => r.action === "deny" && ruleMatches(r.toolName, toolName)
-  );
-  if (denyMatch) return denyMatch;
-  return rules.find(
-    (r) => r.action === "approve" && ruleMatches(r.toolName, toolName)
-  );
-}
-
-// src/core/controller/permission.ts
-var SESSION_APPROVAL_REQUEST_HOOKS = /* @__PURE__ */ new Set([
-  "item/commandExecution/requestApproval",
-  "item/fileChange/requestApproval",
-  "item/permissions/requestApproval"
-]);
-function isScopedPermissionsRequest(hookName) {
-  return hookName === "item/permissions/requestApproval";
-}
-function supportsSessionApproval(hookName) {
-  return hookName !== void 0 && SESSION_APPROVAL_REQUEST_HOOKS.has(hookName);
-}
-function extractPermissionSnapshot(event) {
-  const data = event.data;
-  const toolNameFromData = typeof data["tool_name"] === "string" ? data["tool_name"] : void 0;
-  const toolInputFromData = typeof data["tool_input"] === "object" && data["tool_input"] !== null ? data["tool_input"] : void 0;
-  const toolUseIdFromData = typeof data["tool_use_id"] === "string" ? data["tool_use_id"] : void 0;
-  return {
-    request_id: event.id,
-    ts: event.timestamp,
-    kind: event.kind,
-    hookName: event.hookName,
-    tool_name: event.toolName ?? toolNameFromData ?? "Unknown",
-    tool_input: toolInputFromData ?? {},
-    tool_use_id: event.toolUseId ?? toolUseIdFromData,
-    suggestions: data.permission_suggestions
-  };
-}
-
-// src/core/controller/runtimeController.ts
-function handleEvent(event, cb) {
-  const eventKind2 = event.kind;
-  const isScoped = isScopedPermissionsRequest(event.hookName);
-  const eventData = event.data;
-  const toolName = event.toolName ?? (typeof eventData["tool_name"] === "string" ? eventData["tool_name"] : void 0);
-  if (eventKind2 === "permission.request" && toolName === "user_input") {
-    cb.enqueueQuestion(event.id);
-    cb.relayQuestion?.(event);
-    return { handled: true };
-  }
-  if (eventKind2 === "permission.request" && toolName) {
-    const rule = matchRule(cb.getRules(), toolName);
-    if (rule?.action === "deny") {
-      return {
-        handled: true,
-        decision: {
-          type: "json",
-          source: "rule",
-          intent: {
-            kind: "permission_deny",
-            reason: `Blocked by rule: ${rule.addedBy}`
-          }
-        }
-      };
-    }
-    if (rule?.action === "approve") {
-      return {
-        handled: true,
-        decision: {
-          type: "json",
-          source: "rule",
-          intent: { kind: "permission_allow" },
-          // Scoped Codex permission grants are session-scoped under
-          // auto rules so the same capability isn't re-prompted.
-          ...isScoped ? { data: { scope: "session" } } : {}
-        }
-      };
-    }
-    cb.enqueuePermission(event);
-    cb.relayPermission?.(event);
-    return { handled: true };
-  }
-  if (eventKind2 === "tool.pre" && toolName === "AskUserQuestion") {
-    cb.enqueueQuestion(event.id);
-    cb.relayQuestion?.(event);
-    return { handled: true };
-  }
-  if (eventKind2 === "tool.pre" && toolName) {
-    const rule = matchRule(cb.getRules(), toolName);
-    if (rule?.action === "deny") {
-      return {
-        handled: true,
-        decision: {
-          type: "json",
-          source: "rule",
-          intent: {
-            kind: "pre_tool_deny",
-            reason: `Blocked by rule: ${rule.addedBy}`
-          }
-        }
-      };
-    }
-    return {
-      handled: true,
-      decision: {
-        type: "json",
-        source: "rule",
-        intent: { kind: "pre_tool_allow" }
-      }
-    };
-  }
-  return { handled: false };
-}
-
-// src/core/feed/ingest.ts
-function ingestRuntimeEvent(event, ctx) {
-  const controllerResult = handleEvent(event, ctx.controllerCallbacks);
-  const feedEvents = ctx.mapper.mapEvent(event);
-  if (ctx.store) {
-    persistOrDegrade(
-      ctx.store,
-      () => ctx.store.recordEvent(event, feedEvents),
-      "recordEvent failed",
-      ctx.onPersistFailure
-    );
-  }
-  return {
-    feedEvents,
-    decision: controllerResult.handled && controllerResult.decision ? controllerResult.decision : null
-  };
-}
-function ingestRuntimeDecision(eventId, decision, ctx) {
-  const feedEvent = ctx.mapper.mapDecision(eventId, decision);
-  if (feedEvent && ctx.store) {
-    persistOrDegrade(
-      ctx.store,
-      () => ctx.store.recordFeedEvents([feedEvent]),
-      "recordFeedEvents failed",
-      ctx.onPersistFailure
-    );
-  }
-  return feedEvent;
-}
-function persistOrDegrade(store, action, label, onFailure) {
-  try {
-    action();
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    const message = `${label}: ${reason}`;
-    store.markDegraded(message);
-    onFailure?.(message);
-  }
-}
-
-// src/infra/sessions/store.ts
-import fs17 from "fs";
-import path14 from "path";
-import Database from "better-sqlite3";
-
-// src/infra/sessions/schema.ts
-var SCHEMA_VERSION = 6;
-function initSchema(db) {
-  db.exec("PRAGMA journal_mode = WAL");
-  db.exec("PRAGMA foreign_keys = ON");
-  db.exec(`
-		CREATE TABLE IF NOT EXISTS schema_version (
-			version INTEGER NOT NULL
-		);
-
-		CREATE TABLE IF NOT EXISTS session (
-			id TEXT PRIMARY KEY,
-			project_dir TEXT NOT NULL,
-			created_at INTEGER NOT NULL,
-			updated_at INTEGER NOT NULL,
-			label TEXT,
-			event_count INTEGER DEFAULT 0
-		);
+// src/infra/sessions/schema.ts
+var SCHEMA_VERSION = 6;
+var applySessionSchema = (db, fromVersion) => {
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS session (
+			id TEXT PRIMARY KEY,
+			project_dir TEXT NOT NULL,
+			created_at INTEGER NOT NULL,
+			updated_at INTEGER NOT NULL,
+			label TEXT,
+			event_count INTEGER DEFAULT 0
+		);
 
 		CREATE TABLE IF NOT EXISTS runtime_events (
 			id TEXT PRIMARY KEY,
@@ -10216,45 +9939,6 @@ function initSchema(db) {
 			FOREIGN KEY (session_id) REFERENCES session(id)
 		);
 
-		-- Channel I/O ledger: every inbound chat normalized by an adapter and every
-		-- outbound chat dispatched back to a provider gets one row. Idempotency
-		-- key prevents double-delivery on retry/restart; session_id ties chat to a
-		-- particular Athena interactive runtime when known.
-		CREATE TABLE IF NOT EXISTS channel_messages (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			channel_id TEXT NOT NULL,
-			account_id TEXT NOT NULL,
-			peer_id TEXT,
-			room_id TEXT,
-			thread_id TEXT,
-			provider_message_id TEXT NOT NULL,
-			direction TEXT NOT NULL CHECK(direction IN ('in','out')),
-			session_id TEXT REFERENCES adapter_sessions(session_id),
-			agent_id TEXT,
-			idempotency_key TEXT,
-			feed_event_id TEXT,
-			created_at INTEGER NOT NULL
-		);
-
-		-- Audit log for cloud function invocations brokered by the gateway. One
-		-- row per invocation across all callers (agent tool, /run channel cmd,
-		-- hook helper). Idempotency cache is in-memory + write-through here.
-		CREATE TABLE IF NOT EXISTS gateway_function_invocations (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			name TEXT NOT NULL,
-			caller_kind TEXT NOT NULL CHECK(caller_kind IN ('agent','channel','hook')),
-			session_id TEXT REFERENCES adapter_sessions(session_id),
-			agent_id TEXT,
-			idempotency_key TEXT,
-			request_hash TEXT NOT NULL,
-			status TEXT NOT NULL CHECK(status IN ('pending','ok','error','timeout')),
-			http_status INTEGER,
-			duration_ms INTEGER,
-			error TEXT,
-			started_at INTEGER NOT NULL,
-			completed_at INTEGER
-		);
-
 		-- Durable retry queue for outbound channel sends. Drained by the gateway
 		-- daemon on startup and after transient send failures.
 		CREATE TABLE IF NOT EXISTS channel_outbox (
@@ -10274,127 +9958,78 @@ function initSchema(db) {
 		CREATE UNIQUE INDEX IF NOT EXISTS idx_feed_seq ON feed_events(seq);
 		CREATE INDEX IF NOT EXISTS idx_runtime_seq ON runtime_events(seq);
 		CREATE INDEX IF NOT EXISTS idx_workflow_runs_session ON workflow_runs(session_id);
-		CREATE UNIQUE INDEX IF NOT EXISTS idx_channel_messages_idem
-			ON channel_messages(channel_id, account_id, idempotency_key)
-			WHERE idempotency_key IS NOT NULL;
-		CREATE INDEX IF NOT EXISTS idx_channel_messages_session_key
-			ON channel_messages(channel_id, account_id, peer_id, room_id, thread_id, created_at);
-		CREATE UNIQUE INDEX IF NOT EXISTS idx_fn_idem
-			ON gateway_function_invocations(name, idempotency_key)
-			WHERE idempotency_key IS NOT NULL;
 		CREATE INDEX IF NOT EXISTS idx_outbox_due ON channel_outbox(next_attempt_at);
 	`);
-  const existing = db.prepare("SELECT version FROM schema_version").get();
-  if (existing && existing.version > SCHEMA_VERSION) {
+  if (fromVersion === void 0) return;
+  if (fromVersion >= SCHEMA_VERSION) return;
+  if (fromVersion < 2) {
     throw new Error(
-      `Database has newer schema version ${existing.version} (expected <= ${SCHEMA_VERSION}). Update athena-cli to open this session.`
+      `Session database is at schema version ${fromVersion} which predates the first release. Delete the session database and start fresh.`
     );
   }
-  if (!existing) {
-    db.prepare("INSERT INTO schema_version (version) VALUES (?)").run(
-      SCHEMA_VERSION
-    );
-  } else if (existing.version < SCHEMA_VERSION) {
-    if (existing.version < 2) {
-      throw new Error(
-        `Session database is at schema version ${existing.version} which predates the first release. Delete the session database and start fresh.`
-      );
-    }
-    if (existing.version === 2) {
-      db.exec(`
-				ALTER TABLE adapter_sessions ADD COLUMN tokens_input INTEGER;
-				ALTER TABLE adapter_sessions ADD COLUMN tokens_output INTEGER;
-				ALTER TABLE adapter_sessions ADD COLUMN tokens_cache_read INTEGER;
-				ALTER TABLE adapter_sessions ADD COLUMN tokens_cache_write INTEGER;
-				ALTER TABLE adapter_sessions ADD COLUMN tokens_context_size INTEGER;
-				ALTER TABLE adapter_sessions ADD COLUMN tokens_context_window_size INTEGER;
-				UPDATE schema_version SET version = 4;
-			`);
-    }
-    if (existing.version === 3) {
-      db.exec(`
-				ALTER TABLE adapter_sessions ADD COLUMN tokens_context_window_size INTEGER;
-				UPDATE schema_version SET version = 4;
-			`);
-    }
-    const currentVersion = db.prepare("SELECT version FROM schema_version").get().version;
-    if (currentVersion === 4) {
-      db.exec(`
-				CREATE TABLE IF NOT EXISTS workflow_runs (
-					id TEXT PRIMARY KEY,
-					session_id TEXT NOT NULL,
-					workflow_name TEXT,
-					started_at INTEGER NOT NULL,
-					ended_at INTEGER,
-					iteration INTEGER NOT NULL DEFAULT 0,
-					max_iterations INTEGER NOT NULL DEFAULT 1,
-					status TEXT NOT NULL DEFAULT 'running',
-					stop_reason TEXT,
-					tracker_path TEXT,
-					FOREIGN KEY (session_id) REFERENCES session(id)
-				);
-				CREATE INDEX IF NOT EXISTS idx_workflow_runs_session ON workflow_runs(session_id);
-				ALTER TABLE adapter_sessions ADD COLUMN run_id TEXT REFERENCES workflow_runs(id);
-				UPDATE schema_version SET version = 5;
-			`);
-    }
-    const versionAfterV5 = db.prepare("SELECT version FROM schema_version").get().version;
-    if (versionAfterV5 === 5) {
-      db.exec(`
-				CREATE TABLE IF NOT EXISTS channel_messages (
-					id INTEGER PRIMARY KEY AUTOINCREMENT,
-					channel_id TEXT NOT NULL,
-					account_id TEXT NOT NULL,
-					peer_id TEXT,
-					room_id TEXT,
-					thread_id TEXT,
-					provider_message_id TEXT NOT NULL,
-					direction TEXT NOT NULL CHECK(direction IN ('in','out')),
-					session_id TEXT REFERENCES adapter_sessions(session_id),
-					agent_id TEXT,
-					idempotency_key TEXT,
-					feed_event_id TEXT,
-					created_at INTEGER NOT NULL
-				);
-				CREATE TABLE IF NOT EXISTS gateway_function_invocations (
-					id INTEGER PRIMARY KEY AUTOINCREMENT,
-					name TEXT NOT NULL,
-					caller_kind TEXT NOT NULL CHECK(caller_kind IN ('agent','channel','hook')),
-					session_id TEXT REFERENCES adapter_sessions(session_id),
-					agent_id TEXT,
-					idempotency_key TEXT,
-					request_hash TEXT NOT NULL,
-					status TEXT NOT NULL CHECK(status IN ('pending','ok','error','timeout')),
-					http_status INTEGER,
-					duration_ms INTEGER,
-					error TEXT,
-					started_at INTEGER NOT NULL,
-					completed_at INTEGER
-				);
-				CREATE TABLE IF NOT EXISTS channel_outbox (
-					id INTEGER PRIMARY KEY AUTOINCREMENT,
-					channel_id TEXT NOT NULL,
-					account_id TEXT NOT NULL,
-					payload_json TEXT NOT NULL,
-					attempt INTEGER NOT NULL DEFAULT 0,
-					next_attempt_at INTEGER NOT NULL,
-					last_error TEXT,
-					created_at INTEGER NOT NULL
-				);
-				CREATE UNIQUE INDEX IF NOT EXISTS idx_channel_messages_idem
-					ON channel_messages(channel_id, account_id, idempotency_key)
-					WHERE idempotency_key IS NOT NULL;
-				CREATE INDEX IF NOT EXISTS idx_channel_messages_session_key
-					ON channel_messages(channel_id, account_id, peer_id, room_id, thread_id, created_at);
-				CREATE UNIQUE INDEX IF NOT EXISTS idx_fn_idem
-					ON gateway_function_invocations(name, idempotency_key)
-					WHERE idempotency_key IS NOT NULL;
-				CREATE INDEX IF NOT EXISTS idx_outbox_due ON channel_outbox(next_attempt_at);
-				UPDATE schema_version SET version = 6;
-			`);
-    }
+  if (fromVersion === 2) {
+    db.exec(`
+			ALTER TABLE adapter_sessions ADD COLUMN tokens_input INTEGER;
+			ALTER TABLE adapter_sessions ADD COLUMN tokens_output INTEGER;
+			ALTER TABLE adapter_sessions ADD COLUMN tokens_cache_read INTEGER;
+			ALTER TABLE adapter_sessions ADD COLUMN tokens_cache_write INTEGER;
+			ALTER TABLE adapter_sessions ADD COLUMN tokens_context_size INTEGER;
+			ALTER TABLE adapter_sessions ADD COLUMN tokens_context_window_size INTEGER;
+			UPDATE schema_version SET version = 4;
+		`);
+  }
+  if (fromVersion === 3) {
+    db.exec(`
+			ALTER TABLE adapter_sessions ADD COLUMN tokens_context_window_size INTEGER;
+			UPDATE schema_version SET version = 4;
+		`);
+  }
+  const currentVersion = db.prepare("SELECT version FROM schema_version").get().version;
+  if (currentVersion === 4) {
+    db.exec(`
+			CREATE TABLE IF NOT EXISTS workflow_runs (
+				id TEXT PRIMARY KEY,
+				session_id TEXT NOT NULL,
+				workflow_name TEXT,
+				started_at INTEGER NOT NULL,
+				ended_at INTEGER,
+				iteration INTEGER NOT NULL DEFAULT 0,
+				max_iterations INTEGER NOT NULL DEFAULT 1,
+				status TEXT NOT NULL DEFAULT 'running',
+				stop_reason TEXT,
+				tracker_path TEXT,
+				FOREIGN KEY (session_id) REFERENCES session(id)
+			);
+			CREATE INDEX IF NOT EXISTS idx_workflow_runs_session ON workflow_runs(session_id);
+			ALTER TABLE adapter_sessions ADD COLUMN run_id TEXT REFERENCES workflow_runs(id);
+			UPDATE schema_version SET version = 5;
+		`);
+  }
+  const versionAfterV5 = db.prepare("SELECT version FROM schema_version").get().version;
+  if (versionAfterV5 === 5) {
+    db.exec(`
+			CREATE TABLE IF NOT EXISTS channel_outbox (
+				id INTEGER PRIMARY KEY AUTOINCREMENT,
+				channel_id TEXT NOT NULL,
+				account_id TEXT NOT NULL,
+				payload_json TEXT NOT NULL,
+				attempt INTEGER NOT NULL DEFAULT 0,
+				next_attempt_at INTEGER NOT NULL,
+				last_error TEXT,
+				created_at INTEGER NOT NULL
+			);
+			CREATE INDEX IF NOT EXISTS idx_outbox_due ON channel_outbox(next_attempt_at);
+			UPDATE schema_version SET version = 6;
+		`);
   }
-}
+};
+var SESSION_SCHEMA = {
+  version: SCHEMA_VERSION,
+  migrate: applySessionSchema,
+  onNewerVersion: (found, expected) => new Error(
+    `Database has newer schema version ${found} (expected <= ${expected}). Update athena-cli to open this session.`
+  )
+};
 
 // src/infra/sessions/types.ts
 function rowToAthenaSession(row, adapterSessionIds, firstPrompt) {
@@ -10412,11 +10047,11 @@ function rowToAthenaSession(row, adapterSessionIds, firstPrompt) {
 
 // src/infra/sessions/store.ts
 function createSessionStore(opts) {
-  if (opts.dbPath !== ":memory:") {
-    fs17.mkdirSync(path14.dirname(opts.dbPath), { recursive: true });
-  }
-  const db = new Database(opts.dbPath);
-  initSchema(db);
+  const db = openVersionedDb(opts.dbPath, {
+    ...SESSION_SCHEMA,
+    foreignKeys: true,
+    ensureDir: true
+  });
   if (opts.dbPath !== ":memory:") {
     db.pragma("locking_mode = EXCLUSIVE");
     db.exec("BEGIN IMMEDIATE; COMMIT");
@@ -10687,9 +10322,6 @@ function createSessionStore(opts) {
   };
 }
 
-// src/infra/sessions/hookAudit.ts
-import Database2 from "better-sqlite3";
-
 // src/core/feed/filter.ts
 var TASK_TOOL_NAMES = /* @__PURE__ */ new Set([
   "TodoWrite",
@@ -11365,8 +10997,8 @@ var PRIMARY_INPUT_EXTRACTORS = {
     return compactText(colonIdx >= 0 ? name.slice(colonIdx + 1) : name, 80);
   },
   NotebookEdit: (input) => {
-    const path22 = String(input.notebook_path ?? "");
-    return path22 ? shortenPath(path22) : "";
+    const path21 = String(input.notebook_path ?? "");
+    return path21 ? shortenPath(path21) : "";
   },
   AskUserQuestion: (input) => {
     const questions = input.questions;
@@ -12637,16 +12269,16 @@ function extractDomain(url) {
   }
 }
 function filePathSegments(input) {
-  const path22 = prop2(input, "file_path") ?? prop2(input, "notebook_path") ?? "";
-  if (typeof path22 !== "string" || !path22) return [];
-  const { prefix, filename } = shortenPathStructured(path22);
+  const path21 = prop2(input, "file_path") ?? prop2(input, "notebook_path") ?? "";
+  if (typeof path21 !== "string" || !path21) return [];
+  const { prefix, filename } = shortenPathStructured(path21);
   if (prefix && filename) {
     return [
       { text: prefix, role: "target" },
       { text: filename, role: "filename" }
     ];
   }
-  return [{ text: filename || path22, role: "filename" }];
+  return [{ text: filename || path21, role: "filename" }];
 }
 function grepSegments(input) {
   const pattern = String(prop2(input, "pattern") ?? "");
@@ -13779,57 +13411,93 @@ ${details}` : entry.summary;
   }
 };
 
+// src/infra/sessions/sessionDbReader.ts
+import Database from "better-sqlite3";
+function openSessionDbReadonly(dbPath, options = {}) {
+  const db = new Database(dbPath, {
+    readonly: true,
+    ...options.fileMustExist ? { fileMustExist: true } : {}
+  });
+  return {
+    schemaVersion() {
+      const row = db.prepare("SELECT version FROM schema_version").get();
+      return row?.version;
+    },
+    sessionRow() {
+      return db.prepare("SELECT * FROM session LIMIT 1").get();
+    },
+    adapterSessionIds() {
+      const rows = db.prepare("SELECT session_id FROM adapter_sessions ORDER BY started_at").all();
+      return rows.map((r) => r.session_id);
+    },
+    firstUserPrompt() {
+      const row = db.prepare(
+        `SELECT json_extract(payload, '$.data.prompt') as prompt FROM runtime_events WHERE hook_name = 'UserPromptSubmit' ORDER BY seq ASC LIMIT 1`
+      ).get();
+      return row?.prompt ?? void 0;
+    },
+    runtimeHookCounts() {
+      const rows = db.prepare(
+        "SELECT hook_name, COUNT(*) AS count FROM runtime_events GROUP BY hook_name"
+      ).all();
+      const counts = {};
+      for (const row of rows) counts[row.hook_name] = row.count;
+      return counts;
+    },
+    feedEvents() {
+      const rows = db.prepare("SELECT data FROM feed_events ORDER BY seq").all();
+      return rows.map((r) => JSON.parse(r.data));
+    },
+    close() {
+      db.close();
+    }
+  };
+}
+
 // src/infra/sessions/registry.ts
-import fs18 from "fs";
+import fs17 from "fs";
 import os11 from "os";
-import path15 from "path";
-import Database3 from "better-sqlite3";
+import path14 from "path";
 function sessionsDir() {
-  return path15.join(os11.homedir(), ".config", "athena", "sessions");
+  return path14.join(os11.homedir(), ".config", "athena", "sessions");
 }
 function sessionDbPath(sessionId) {
-  return path15.join(sessionsDir(), sessionId, "session.db");
+  return path14.join(sessionsDir(), sessionId, "session.db");
 }
 function readSessionFromDb(dbPath) {
-  if (!fs18.existsSync(dbPath)) return null;
-  let db;
+  if (!fs17.existsSync(dbPath)) return null;
+  let reader;
   try {
-    db = new Database3(dbPath, { readonly: true });
-    const versionRow = db.prepare("SELECT version FROM schema_version").get();
-    if (versionRow && versionRow.version > SCHEMA_VERSION) {
+    reader = openSessionDbReadonly(dbPath);
+    const version = reader.schemaVersion();
+    if (version !== void 0 && version > SCHEMA_VERSION) {
       return null;
     }
-    const row = db.prepare("SELECT * FROM session LIMIT 1").get();
+    const row = reader.sessionRow();
     if (!row) return null;
-    const adapters = db.prepare("SELECT session_id FROM adapter_sessions ORDER BY started_at").all();
+    const adapterSessionIds = reader.adapterSessionIds();
     let firstPrompt;
     if (!row.label && (row.event_count ?? 0) > 0) {
-      const promptRow = db.prepare(
-        `SELECT json_extract(payload, '$.data.prompt') as prompt FROM runtime_events WHERE hook_name = 'UserPromptSubmit' ORDER BY seq ASC LIMIT 1`
-      ).get();
-      if (promptRow?.prompt) {
-        firstPrompt = promptRow.prompt;
+      const prompt = reader.firstUserPrompt();
+      if (prompt) {
+        firstPrompt = prompt;
       }
     }
-    return rowToAthenaSession(
-      row,
-      adapters.map((a) => a.session_id),
-      firstPrompt
-    );
+    return rowToAthenaSession(row, adapterSessionIds, firstPrompt);
   } catch {
     return null;
   } finally {
-    db?.close();
+    reader?.close();
   }
 }
 function listSessions(projectDir) {
   const dir = sessionsDir();
-  if (!fs18.existsSync(dir)) return [];
-  const entries = fs18.readdirSync(dir, { withFileTypes: true });
+  if (!fs17.existsSync(dir)) return [];
+  const entries = fs17.readdirSync(dir, { withFileTypes: true });
   const sessions = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const dbPath = path15.join(dir, entry.name, "session.db");
+    const dbPath = path14.join(dir, entry.name, "session.db");
     const session = readSessionFromDb(dbPath);
     if (session && (session.eventCount ?? 0) > 0) {
       if (!projectDir || session.projectDir === projectDir) {
@@ -14276,9 +13944,9 @@ function defaultLoadToken(tokenPath) {
 }
 
 // src/infra/config/gatewayClient.ts
-import fs19 from "fs";
+import fs18 from "fs";
 import os12 from "os";
-import path16 from "path";
+import path15 from "path";
 
 // src/shared/gateway-protocol/endpoint.ts
 function parseRuntimeEndpoint(value) {
@@ -14334,16 +14002,16 @@ function isRecord2(value) {
 // src/infra/config/gatewayClient.ts
 function resolveGatewayClientConfigPath(env = process.env) {
   const home = env["HOME"] ?? os12.homedir();
-  return path16.join(home, ".config", "athena", "gateway.json");
+  return path15.join(home, ".config", "athena", "gateway.json");
 }
 function readGatewayClientConfig(env = process.env) {
   const configPath = resolveGatewayClientConfigPath(env);
-  if (!fs19.existsSync(configPath)) {
+  if (!fs18.existsSync(configPath)) {
     return { mode: "local" };
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs19.readFileSync(configPath, "utf-8"));
+    parsed = JSON.parse(fs18.readFileSync(configPath, "utf-8"));
   } catch (err) {
     throw new Error(
       `gateway client config ${configPath} is invalid JSON: ${err instanceof Error ? err.message : String(err)}`
@@ -14360,16 +14028,16 @@ function readGatewayClientConfig(env = process.env) {
 function writeGatewayClientConfig(config, env = process.env) {
   const parsed = parseRuntimeEndpoint(config);
   const configPath = resolveGatewayClientConfigPath(env);
-  const dir = path16.dirname(configPath);
-  fs19.mkdirSync(dir, { recursive: true, mode: 448 });
-  fs19.writeFileSync(configPath, JSON.stringify(parsed, null, 2) + "\n", {
+  const dir = path15.dirname(configPath);
+  fs18.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs18.writeFileSync(configPath, JSON.stringify(parsed, null, 2) + "\n", {
     encoding: "utf-8",
     mode: 384
   });
   if (process.platform !== "win32") {
     try {
-      fs19.chmodSync(dir, 448);
-      fs19.chmodSync(configPath, 384);
+      fs18.chmodSync(dir, 448);
+      fs18.chmodSync(configPath, 384);
     } catch {
     }
   }
@@ -14797,14 +14465,11 @@ function sleepOrAbort(ms, signal) {
 }
 
 // src/app/dashboard/dashboardFeedPublisher.ts
-import Database4 from "better-sqlite3";
 function dashboardFeedOutboxPath() {
   return `${ensureDaemonStateDir().dir}/dashboard-feed-outbox.db`;
 }
 function initOutboxSchema(db) {
   db.exec(`
-		PRAGMA journal_mode = WAL;
-
 		CREATE TABLE IF NOT EXISTS dashboard_feed_outbox (
 			delivery_seq INTEGER PRIMARY KEY AUTOINCREMENT,
 			instance_id TEXT NOT NULL,
@@ -14838,8 +14503,9 @@ function makeEnvelope(input) {
   };
 }
 function createDashboardFeedOutbox(options = {}) {
-  const db = new Database4(options.dbPath ?? dashboardFeedOutboxPath());
-  initOutboxSchema(db);
+  const db = openVersionedDb(options.dbPath ?? dashboardFeedOutboxPath(), {
+    migrate: initOutboxSchema
+  });
   const insert = db.prepare(`
 		INSERT OR IGNORE INTO dashboard_feed_outbox (
 			instance_id,
@@ -15038,6 +14704,257 @@ function createPairedFeedPublisher(options = {}) {
   };
 }
 
+// src/core/controller/rules.ts
+function ruleMatches(ruleToolName, toolName) {
+  if (ruleToolName === "*") return true;
+  if (ruleToolName === toolName) return true;
+  if (ruleToolName.endsWith("__*")) {
+    const prefix = ruleToolName.slice(0, -1);
+    return toolName.startsWith(prefix);
+  }
+  return false;
+}
+function matchRule(rules, toolName) {
+  const denyMatch = rules.find(
+    (r) => r.action === "deny" && ruleMatches(r.toolName, toolName)
+  );
+  if (denyMatch) return denyMatch;
+  return rules.find(
+    (r) => r.action === "approve" && ruleMatches(r.toolName, toolName)
+  );
+}
+
+// src/core/controller/permission.ts
+var SESSION_APPROVAL_REQUEST_HOOKS = /* @__PURE__ */ new Set([
+  "item/commandExecution/requestApproval",
+  "item/fileChange/requestApproval",
+  "item/permissions/requestApproval"
+]);
+function isScopedPermissionsRequest(hookName) {
+  return hookName === "item/permissions/requestApproval";
+}
+function supportsSessionApproval(hookName) {
+  return hookName !== void 0 && SESSION_APPROVAL_REQUEST_HOOKS.has(hookName);
+}
+function extractPermissionSnapshot(event) {
+  const data = event.data;
+  const toolNameFromData = typeof data["tool_name"] === "string" ? data["tool_name"] : void 0;
+  const toolInputFromData = typeof data["tool_input"] === "object" && data["tool_input"] !== null ? data["tool_input"] : void 0;
+  const toolUseIdFromData = typeof data["tool_use_id"] === "string" ? data["tool_use_id"] : void 0;
+  return {
+    request_id: event.id,
+    ts: event.timestamp,
+    kind: event.kind,
+    hookName: event.hookName,
+    tool_name: event.toolName ?? toolNameFromData ?? "Unknown",
+    tool_input: toolInputFromData ?? {},
+    tool_use_id: event.toolUseId ?? toolUseIdFromData,
+    suggestions: data.permission_suggestions
+  };
+}
+
+// src/core/controller/runtimeController.ts
+function handleEvent(event, cb) {
+  const eventKind2 = event.kind;
+  const isScoped = isScopedPermissionsRequest(event.hookName);
+  const eventData = event.data;
+  const toolName = event.toolName ?? (typeof eventData["tool_name"] === "string" ? eventData["tool_name"] : void 0);
+  if (eventKind2 === "permission.request" && toolName === "user_input") {
+    cb.enqueueQuestion(event.id);
+    cb.relayQuestion?.(event);
+    return { handled: true };
+  }
+  if (eventKind2 === "permission.request" && toolName) {
+    const rule = matchRule(cb.getRules(), toolName);
+    if (rule?.action === "deny") {
+      return {
+        handled: true,
+        decision: {
+          type: "json",
+          source: "rule",
+          intent: {
+            kind: "permission_deny",
+            reason: `Blocked by rule: ${rule.addedBy}`
+          }
+        }
+      };
+    }
+    if (rule?.action === "approve") {
+      return {
+        handled: true,
+        decision: {
+          type: "json",
+          source: "rule",
+          intent: { kind: "permission_allow" },
+          // Scoped Codex permission grants are session-scoped under
+          // auto rules so the same capability isn't re-prompted.
+          ...isScoped ? { data: { scope: "session" } } : {}
+        }
+      };
+    }
+    cb.enqueuePermission(event);
+    cb.relayPermission?.(event);
+    return { handled: true };
+  }
+  if (eventKind2 === "tool.pre" && toolName === "AskUserQuestion") {
+    cb.enqueueQuestion(event.id);
+    cb.relayQuestion?.(event);
+    return { handled: true };
+  }
+  if (eventKind2 === "tool.pre" && toolName) {
+    const rule = matchRule(cb.getRules(), toolName);
+    if (rule?.action === "deny") {
+      return {
+        handled: true,
+        decision: {
+          type: "json",
+          source: "rule",
+          intent: {
+            kind: "pre_tool_deny",
+            reason: `Blocked by rule: ${rule.addedBy}`
+          }
+        }
+      };
+    }
+    return {
+      handled: true,
+      decision: {
+        type: "json",
+        source: "rule",
+        intent: { kind: "pre_tool_allow" }
+      }
+    };
+  }
+  return { handled: false };
+}
+
+// src/core/feed/ingest.ts
+function ingestRuntimeEvent(event, ctx) {
+  const controllerResult = handleEvent(event, ctx.controllerCallbacks);
+  const feedEvents = ctx.mapper.mapEvent(event);
+  if (ctx.store) {
+    persistOrDegrade(
+      ctx.store,
+      () => ctx.store.recordEvent(event, feedEvents),
+      "recordEvent failed",
+      ctx.onPersistFailure
+    );
+  }
+  return {
+    feedEvents,
+    decision: controllerResult.handled && controllerResult.decision ? controllerResult.decision : null
+  };
+}
+function ingestRuntimeDecision(eventId, decision, ctx) {
+  const feedEvent = ctx.mapper.mapDecision(eventId, decision);
+  if (feedEvent && ctx.store) {
+    persistOrDegrade(
+      ctx.store,
+      () => ctx.store.recordFeedEvents([feedEvent]),
+      "recordFeedEvents failed",
+      ctx.onPersistFailure
+    );
+  }
+  return feedEvent;
+}
+function persistOrDegrade(store, action, label, onFailure) {
+  try {
+    action();
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    const message = `${label}: ${reason}`;
+    store.markDegraded(message);
+    onFailure?.(message);
+  }
+}
+
+// src/app/runtime/runtimeEventLoop.ts
+var DASHBOARD_DECISION_POLL_LIMIT = 25;
+var DASHBOARD_DECISION_POLL_INTERVAL_MS = 1e3;
+function resolveIngest(source) {
+  return typeof source === "function" ? source() : source;
+}
+function attachRuntimeEventLoop(options) {
+  const { runtime } = options;
+  const runEvent = (event) => {
+    options.onEventReceived?.(event);
+    if (options.skipEvent?.(event)) return;
+    const { feedEvents, decision } = ingestRuntimeEvent(
+      event,
+      resolveIngest(options.ingest)
+    );
+    if (decision) {
+      runtime.sendDecision(event.id, decision);
+    }
+    options.emitEventFeed(feedEvents, event);
+  };
+  const runDecision = (eventId, decision) => {
+    options.onDecisionReceived?.(eventId, decision);
+    if (options.skipDecision?.(eventId, decision)) return;
+    options.beforeDecisionIngest?.(eventId, decision);
+    const feedEvent = ingestRuntimeDecision(
+      eventId,
+      decision,
+      resolveIngest(options.ingest)
+    );
+    options.emitDecisionFeed(feedEvent, eventId, decision);
+  };
+  const unsubscribeEvent = runtime.onEvent((event) => {
+    if (options.wrapEvent) {
+      options.wrapEvent(event, () => runEvent(event));
+    } else {
+      runEvent(event);
+    }
+  });
+  const unsubscribeDecision = runtime.onDecision((eventId, decision) => {
+    if (options.wrapDecision) {
+      options.wrapDecision(
+        eventId,
+        decision,
+        () => runDecision(eventId, decision)
+      );
+    } else {
+      runDecision(eventId, decision);
+    }
+  });
+  return {
+    stop() {
+      unsubscribeEvent();
+      unsubscribeDecision();
+    }
+  };
+}
+function startDashboardDecisionDrain(options) {
+  const { runtime, inbox, athenaSessionId } = options;
+  const drainOnce = () => {
+    const rows = inbox.pendingForSession({
+      athenaSessionId,
+      limit: DASHBOARD_DECISION_POLL_LIMIT
+    });
+    for (const row of rows) {
+      try {
+        runtime.sendDecision(row.requestId, row.decision);
+        inbox.markConsumed({ id: row.id });
+      } catch (error) {
+        if (!options.onError) throw error;
+        options.onError(error);
+      }
+    }
+  };
+  drainOnce();
+  const timer = setInterval(
+    drainOnce,
+    options.pollIntervalMs ?? DASHBOARD_DECISION_POLL_INTERVAL_MS
+  );
+  options.configureTimer?.(timer);
+  return {
+    drainOnce,
+    stop() {
+      clearInterval(timer);
+    }
+  };
+}
+
 // src/app/exec/finalMessage.ts
 function findLastMappedAgentMessage(feedEvents) {
   for (let i = feedEvents.length - 1; i >= 0; i--) {
@@ -15088,8 +15005,8 @@ function exitCodeFromFailure(failure) {
 }
 
 // src/app/exec/output.ts
-import fs20 from "fs/promises";
-import path17 from "path";
+import fs19 from "fs/promises";
+import path16 from "path";
 
 // src/app/exec/jsonl.ts
 function createExecJsonlEvent(type, data, ts = Date.now()) {
@@ -15128,9 +15045,9 @@ function createExecOutputWriter(options) {
       writeLine(options.stdout, message);
     },
     async writeLastMessage(filePath, message) {
-      const absPath = path17.resolve(filePath);
-      await fs20.mkdir(path17.dirname(absPath), { recursive: true });
-      await fs20.writeFile(absPath, message, "utf-8");
+      const absPath = path16.resolve(filePath);
+      await fs19.mkdir(path16.dirname(absPath), { recursive: true });
+      await fs19.writeFile(absPath, message, "utf-8");
     }
   };
 }
@@ -15209,7 +15126,7 @@ async function runExec(options) {
     store = sessionStoreFactory({
       sessionId: athenaSessionId,
       projectDir: options.projectDir,
-      dbPath: options.ephemeral ? ":memory:" : path18.join(sessionsDir(), athenaSessionId, "session.db")
+      dbPath: options.ephemeral ? ":memory:" : path17.join(sessionsDir(), athenaSessionId, "session.db")
     });
   } catch (error) {
     const message = `Failed to initialize session store: ${error instanceof Error ? error.message : String(error)}`;
@@ -15300,23 +15217,6 @@ async function runExec(options) {
     ...options.signal ? { signal: options.signal } : {}
   };
   const dashboardDecisionInbox = options.dashboardDecisionInbox;
-  const applyPendingDashboardDecisions = () => {
-    if (!dashboardDecisionInbox) return;
-    const rows = dashboardDecisionInbox.pendingForSession({
-      athenaSessionId,
-      limit: 25
-    });
-    for (const row of rows) {
-      try {
-        runtime.sendDecision(row.requestId, row.decision);
-        dashboardDecisionInbox.markConsumed({ id: row.id });
-      } catch (error) {
-        output.warn(
-          `dashboard decision failed: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-  };
   const linkedAdapterSessions = /* @__PURE__ */ new Set();
   function publishFeedEvents(feedEvents) {
     if (feedEvents.length === 0) return;
@@ -15377,60 +15277,57 @@ async function runExec(options) {
       });
     }
   };
-  const unsubscribeEvent = runtime.onEvent((runtimeEvent) => {
-    adapterSessionId = runtimeEvent.sessionId;
-    if (runtimeEvent.sessionId && activeRunId && !linkedAdapterSessions.has(runtimeEvent.sessionId)) {
-      linkedAdapterSessions.add(runtimeEvent.sessionId);
-      safePersist(
-        store,
-        () => store.linkAdapterSession(runtimeEvent.sessionId, activeRunId),
-        (message) => output.warn(message),
-        "linkAdapterSession failed"
-      );
-    }
-    output.emitJsonEvent("runtime.event", {
-      id: runtimeEvent.id,
-      kind: runtimeEvent.kind,
-      hookName: runtimeEvent.hookName,
-      sessionId: runtimeEvent.sessionId,
-      toolName: runtimeEvent.toolName ?? null,
-      data: runtimeEvent.data
-    });
-    if (latch.hasFailure()) return;
-    const { feedEvents, decision } = ingestRuntimeEvent(runtimeEvent, {
+  const runtimeEventLoop = attachRuntimeEventLoop({
+    runtime,
+    ingest: {
       mapper,
       store,
       controllerCallbacks,
       onPersistFailure: (message) => output.warn(message)
-    });
-    if (decision) {
-      runtime.sendDecision(runtimeEvent.id, decision);
-    }
-    for (const event of feedEvents) {
-      if (event.kind === "agent.message") {
-        mappedFinalMessage = event.data.message;
+    },
+    onEventReceived: (runtimeEvent) => {
+      adapterSessionId = runtimeEvent.sessionId;
+      if (runtimeEvent.sessionId && activeRunId && !linkedAdapterSessions.has(runtimeEvent.sessionId)) {
+        linkedAdapterSessions.add(runtimeEvent.sessionId);
+        safePersist(
+          store,
+          () => store.linkAdapterSession(runtimeEvent.sessionId, activeRunId),
+          (message) => output.warn(message),
+          "linkAdapterSession failed"
+        );
       }
-    }
-    publishFeedEvents(feedEvents);
-  });
-  const unsubscribeDecision = runtime.onDecision(
-    (eventId, decision) => {
+      output.emitJsonEvent("runtime.event", {
+        id: runtimeEvent.id,
+        kind: runtimeEvent.kind,
+        hookName: runtimeEvent.hookName,
+        sessionId: runtimeEvent.sessionId,
+        toolName: runtimeEvent.toolName ?? null,
+        data: runtimeEvent.data
+      });
+    },
+    skipEvent: () => latch.hasFailure(),
+    emitEventFeed: (feedEvents) => {
+      for (const event of feedEvents) {
+        if (event.kind === "agent.message") {
+          mappedFinalMessage = event.data.message;
+        }
+      }
+      publishFeedEvents(feedEvents);
+    },
+    onDecisionReceived: (eventId, decision) => {
       output.emitJsonEvent("runtime.decision", {
         eventId,
         decision
       });
-      const feedEvent = ingestRuntimeDecision(eventId, decision, {
-        mapper,
-        store,
-        onPersistFailure: (message) => output.warn(message)
-      });
+    },
+    emitDecisionFeed: (feedEvent) => {
       if (feedEvent) {
         publishFeedEvents([feedEvent]);
       }
     }
-  );
+  });
   let timeoutTimer;
-  let dashboardDecisionTimer;
+  let dashboardDecisionDrain;
   if (typeof options.timeoutMs === "number" && options.timeoutMs > 0) {
     timeoutTimer = setTimeout(() => {
       latch.register({
@@ -15451,12 +15348,16 @@ async function runExec(options) {
       status: runtime.getStatus()
     });
     if (dashboardDecisionInbox) {
-      applyPendingDashboardDecisions();
-      dashboardDecisionTimer = setInterval(
-        applyPendingDashboardDecisions,
-        options.dashboardDecisionPollIntervalMs ?? 1e3
-      );
-      dashboardDecisionTimer.unref();
+      dashboardDecisionDrain = startDashboardDecisionDrain({
+        runtime,
+        inbox: dashboardDecisionInbox,
+        athenaSessionId,
+        ...options.dashboardDecisionPollIntervalMs !== void 0 ? { pollIntervalMs: options.dashboardDecisionPollIntervalMs } : {},
+        onError: (error) => output.warn(
+          `dashboard decision failed: ${error instanceof Error ? error.message : String(error)}`
+        ),
+        configureTimer: (timer) => timer.unref()
+      });
     }
     const workflow = options.workflow;
     output.emitJsonEvent("run.started", {
@@ -15543,14 +15444,11 @@ async function runExec(options) {
     if (timeoutTimer) {
       clearTimeout(timeoutTimer);
     }
-    if (dashboardDecisionTimer) {
-      clearInterval(dashboardDecisionTimer);
-    }
+    dashboardDecisionDrain?.stop();
     await writeLastMessageBeforeTerminalCompletion();
     await runBeforeTerminalCompletion();
     await sessionController.kill();
-    unsubscribeEvent();
-    unsubscribeDecision();
+    runtimeEventLoop.stop();
     if (runtimeStarted) {
       runtime.stop();
     }
@@ -16169,8 +16067,8 @@ async function createRemoteRunEventPublisher({
 // src/app/dashboard/artifactCapture.ts
 import { execFile } from "child_process";
 import crypto3 from "crypto";
-import fs21 from "fs/promises";
-import path19 from "path";
+import fs20 from "fs/promises";
+import path18 from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 function parseArtifactUploadSpec(value) {
@@ -16353,21 +16251,21 @@ async function collectArtifactPayloads(input) {
   return payloads;
 }
 async function readWorkspaceFile(projectDir, rel) {
-  const absolute = path19.resolve(projectDir, rel);
-  const workspaceRoot = await fs21.realpath(projectDir);
+  const absolute = path18.resolve(projectDir, rel);
+  const workspaceRoot = await fs20.realpath(projectDir);
   let stat;
   try {
-    stat = await fs21.lstat(absolute);
+    stat = await fs20.lstat(absolute);
   } catch {
     return null;
   }
   if (!stat.isFile() || stat.isSymbolicLink()) return null;
-  const real = await fs21.realpath(absolute);
-  const relativeToRoot = path19.relative(workspaceRoot, real);
-  if (relativeToRoot === ".." || relativeToRoot.startsWith(`..${path19.sep}`) || path19.isAbsolute(relativeToRoot)) {
+  const real = await fs20.realpath(absolute);
+  const relativeToRoot = path18.relative(workspaceRoot, real);
+  if (relativeToRoot === ".." || relativeToRoot.startsWith(`..${path18.sep}`) || path18.isAbsolute(relativeToRoot)) {
     return null;
   }
-  return fs21.readFile(absolute);
+  return fs20.readFile(absolute);
 }
 async function gitDiffForAllowedPaths(input) {
   const paths = splitNul(await git(input.projectDir, input.nameArgs)).filter(
@@ -16458,13 +16356,13 @@ var DEFAULT_HARD_DENY = [
   ".ssh/**"
 ];
 function isAllowedRelativePath(rel, hardDeny) {
-  if (path19.isAbsolute(rel) || rel.includes("\0")) return false;
-  const normalized = path19.posix.normalize(rel.replaceAll(path19.sep, "/"));
+  if (path18.isAbsolute(rel) || rel.includes("\0")) return false;
+  const normalized = path18.posix.normalize(rel.replaceAll(path18.sep, "/"));
   if (normalized === ".." || normalized.startsWith("../")) return false;
   return !hardDeny.some((pattern) => matchesDenyPattern(normalized, pattern));
 }
 function matchesDenyPattern(rel, pattern) {
-  const normalized = pattern.replaceAll(path19.sep, "/");
+  const normalized = pattern.replaceAll(path18.sep, "/");
   if (normalized.includes("*") || normalized.includes("?")) {
     return globToRegExp(normalized).test(rel);
   }
@@ -16861,18 +16759,18 @@ async function executeRemoteAssignment({
 
 // src/infra/config/attachmentMirror.ts
 import crypto4 from "crypto";
-import fs22 from "fs";
+import fs21 from "fs";
 import os13 from "os";
-import path20 from "path";
+import path19 from "path";
 function attachmentMirrorPath(env = process.env) {
   const home = env["HOME"] ?? os13.homedir();
-  return path20.join(home, ".config", "athena", "attachments.json");
+  return path19.join(home, ".config", "athena", "attachments.json");
 }
 function readAttachmentMirror(env = process.env) {
   const file = attachmentMirrorPath(env);
   let raw;
   try {
-    raw = fs22.readFileSync(file, "utf-8");
+    raw = fs21.readFileSync(file, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -16896,29 +16794,29 @@ function readAttachmentMirror(env = process.env) {
 function writeAttachmentMirror(mirror, env = process.env) {
   const validated = parseAttachmentMirror(mirror);
   const file = attachmentMirrorPath(env);
-  const dir = path20.dirname(file);
-  fs22.mkdirSync(dir, { recursive: true, mode: 448 });
+  const dir = path19.dirname(file);
+  fs21.mkdirSync(dir, { recursive: true, mode: 448 });
   const tmp = `${file}.${process.pid}.${crypto4.randomBytes(4).toString("hex")}.tmp`;
-  const fd = fs22.openSync(tmp, "w", 384);
+  const fd = fs21.openSync(tmp, "w", 384);
   try {
-    fs22.writeSync(fd, JSON.stringify(validated, null, 2) + "\n");
-    fs22.fsyncSync(fd);
+    fs21.writeSync(fd, JSON.stringify(validated, null, 2) + "\n");
+    fs21.fsyncSync(fd);
   } finally {
-    fs22.closeSync(fd);
+    fs21.closeSync(fd);
   }
   try {
-    fs22.renameSync(tmp, file);
+    fs21.renameSync(tmp, file);
   } catch (err) {
     try {
-      fs22.unlinkSync(tmp);
+      fs21.unlinkSync(tmp);
     } catch {
     }
     throw err;
   }
   if (process.platform !== "win32") {
     try {
-      fs22.chmodSync(dir, 448);
-      fs22.chmodSync(file, 384);
+      fs21.chmodSync(dir, 448);
+      fs21.chmodSync(file, 384);
     } catch {
     }
   }
@@ -16926,7 +16824,7 @@ function writeAttachmentMirror(mirror, env = process.env) {
 function removeAttachmentMirror(env = process.env) {
   const file = attachmentMirrorPath(env);
   try {
-    fs22.unlinkSync(file);
+    fs21.unlinkSync(file);
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -17054,7 +16952,6 @@ function createAttachmentReconciler(options) {
 }
 
 // src/app/dashboard/dashboardDecisionInbox.ts
-import Database5 from "better-sqlite3";
 function dashboardDecisionInboxPath() {
   return `${ensureDaemonStateDir().dir}/dashboard-decision-inbox.db`;
 }
@@ -17099,8 +16996,6 @@ function migrateLegacyUniqueConstraint(db) {
 }
 function initInboxSchema(db) {
   db.exec(`
-		PRAGMA journal_mode = WAL;
-
 		CREATE TABLE IF NOT EXISTS dashboard_decision_inbox (
 			id INTEGER PRIMARY KEY AUTOINCREMENT,
 			athena_session_id TEXT NOT NULL,
@@ -17122,8 +17017,9 @@ function initInboxSchema(db) {
 	`);
 }
 function createDashboardDecisionInbox(options = {}) {
-  const db = new Database5(options.dbPath ?? dashboardDecisionInboxPath());
-  initInboxSchema(db);
+  const db = openVersionedDb(options.dbPath ?? dashboardDecisionInboxPath(), {
+    migrate: initInboxSchema
+  });
   const upsertUnconsumed = db.prepare(`
 		INSERT INTO dashboard_decision_inbox (
 			athena_session_id,
@@ -17332,9 +17228,9 @@ function createDashboardPairedExecution(options) {
 }
 
 // src/app/dashboard/remoteWorkspaceResolver.ts
-import fs23 from "fs";
+import fs22 from "fs";
 import os14 from "os";
-import path21 from "path";
+import path20 from "path";
 function resolveRemoteWorkspace(assignment, options = {}) {
   const { spec, runId, runnerId } = assignment;
   if (spec.projectDir) {
@@ -17343,14 +17239,14 @@ function resolveRemoteWorkspace(assignment, options = {}) {
   const sessionId = spec.athenaSessionId ?? spec.sessionId;
   const deploymentSlug = deploymentSlugFromUrl(options.dashboardUrl);
   const stateDir = daemonStatePaths(options.env).dir;
-  const projectDir = sessionId ? path21.join(
+  const projectDir = sessionId ? path20.join(
     stateDir,
     "remote-workspaces",
     deploymentSlug,
     sanitizePathSegment(runnerId),
     "sessions",
     sanitizePathSegment(sessionId)
-  ) : path21.join(
+  ) : path20.join(
     stateDir,
     "remote-workspaces",
     deploymentSlug,
@@ -17359,10 +17255,10 @@ function resolveRemoteWorkspace(assignment, options = {}) {
     sanitizePathSegment(runId)
   );
   try {
-    fs23.mkdirSync(projectDir, { recursive: true, mode: 448 });
+    fs22.mkdirSync(projectDir, { recursive: true, mode: 448 });
     if (process.platform !== "win32") {
       try {
-        fs23.chmodSync(projectDir, 448);
+        fs22.chmodSync(projectDir, 448);
       } catch {
       }
     }
@@ -17378,8 +17274,8 @@ function resolveRemoteWorkspace(assignment, options = {}) {
   return validateProjectDir(projectDir, options.env);
 }
 function validateProjectDir(projectDir, env = process.env) {
-  const resolved = path21.resolve(projectDir);
-  if (!path21.isAbsolute(projectDir)) {
+  const resolved = path20.resolve(projectDir);
+  if (!path20.isAbsolute(projectDir)) {
     return {
       kind: "rejected",
       rejection: {
@@ -17388,7 +17284,7 @@ function validateProjectDir(projectDir, env = process.env) {
       }
     };
   }
-  const home = path21.resolve(env["HOME"] ?? os14.homedir());
+  const home = path20.resolve(env["HOME"] ?? os14.homedir());
   if (resolved === home) {
     return {
       kind: "rejected",
@@ -17400,7 +17296,7 @@ function validateProjectDir(projectDir, env = process.env) {
   }
   let stat;
   try {
-    stat = fs23.statSync(resolved);
+    stat = fs22.statSync(resolved);
   } catch {
     return {
       kind: "rejected",
@@ -17845,18 +17741,18 @@ async function runDashboardRuntimeDaemon(options = {}) {
 }
 
 // src/infra/daemon/pidLock.ts
-import fs24 from "fs";
+import fs23 from "fs";
 function acquirePidLock(pidPath) {
   const ownPid = process.pid;
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      const fd = fs24.openSync(pidPath, "wx", 384);
+      const fd = fs23.openSync(pidPath, "wx", 384);
       try {
-        fs24.writeSync(fd, `${ownPid}
+        fs23.writeSync(fd, `${ownPid}
 `);
-        fs24.fsyncSync(fd);
+        fs23.fsyncSync(fd);
       } finally {
-        fs24.closeSync(fd);
+        fs23.closeSync(fd);
       }
       return makeHandle(pidPath, ownPid);
     } catch (err) {
@@ -17870,7 +17766,7 @@ function acquirePidLock(pidPath) {
     }
     if (existing.state === "stale") {
       try {
-        fs24.unlinkSync(pidPath);
+        fs23.unlinkSync(pidPath);
       } catch (err) {
         if (err.code !== "ENOENT") throw err;
       }
@@ -17884,7 +17780,7 @@ function acquirePidLock(pidPath) {
 function readPidLock(pidPath) {
   let raw;
   try {
-    raw = fs24.readFileSync(pidPath, "utf-8");
+    raw = fs23.readFileSync(pidPath, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { state: "absent" };
@@ -17908,9 +17804,9 @@ function makeHandle(pidPath, pid) {
       if (released) return;
       released = true;
       try {
-        const raw = fs24.readFileSync(pidPath, "utf-8").trim();
+        const raw = fs23.readFileSync(pidPath, "utf-8").trim();
         if (raw === String(pid)) {
-          fs24.unlinkSync(pidPath);
+          fs23.unlinkSync(pidPath);
         }
       } catch (err) {
         if (err.code !== "ENOENT") {
@@ -17936,7 +17832,7 @@ function isProcessAlive(pid) {
 }
 
 // src/infra/daemon/udsIpc.ts
-import fs25 from "fs";
+import fs24 from "fs";
 import net2 from "net";
 
 // src/infra/daemon/udsFrameCodec.ts
@@ -17981,7 +17877,7 @@ async function startUdsServer(socketPath, handler, log) {
   });
   if (process.platform !== "win32") {
     try {
-      fs25.chmodSync(socketPath, 384);
+      fs24.chmodSync(socketPath, 384);
     } catch {
     }
   }
@@ -17991,7 +17887,7 @@ async function startUdsServer(socketPath, handler, log) {
         server.close(() => resolve());
       });
       try {
-        fs25.unlinkSync(socketPath);
+        fs24.unlinkSync(socketPath);
       } catch (err) {
         if (err.code !== "ENOENT") {
         }
@@ -18109,7 +18005,7 @@ async function sendUdsRequest(socketPath, request, options = {}) {
 async function unlinkStaleSocket(socketPath) {
   let stat;
   try {
-    stat = fs25.statSync(socketPath);
+    stat = fs24.statSync(socketPath);
   } catch (err) {
     if (err.code === "ENOENT") return;
     throw err;
@@ -18136,7 +18032,7 @@ async function unlinkStaleSocket(socketPath) {
       `uds path ${socketPath} is in use by another process; aborting`
     );
   }
-  fs25.unlinkSync(socketPath);
+  fs24.unlinkSync(socketPath);
 }
 
 export {
@@ -18154,8 +18050,8 @@ export {
   mergeFeedItems,
   buildPostByToolUseId,
   createFeedMapper,
-  ingestRuntimeEvent,
-  ingestRuntimeDecision,
+  attachRuntimeEventLoop,
+  startDashboardDecisionDrain,
   generateId,
   daemonStatePaths,
   ensureDaemonStateDir,
@@ -18237,4 +18133,4 @@ export {
   startUdsServer,
   sendUdsRequest
 };
-//# sourceMappingURL=chunk-HXW5N4GE.js.map
+//# sourceMappingURL=chunk-QBMYQJFX.js.map