@factiii/runner 0.0.1 → 0.2.1

package/dist/cli.js

@@ -963,8 +963,8 @@ var require_command = __commonJS({
   "node_modules/commander/lib/command.js"(exports2) {
     var EventEmitter = require("node:events").EventEmitter;
     var childProcess = require("node:child_process");
-    var path6 = require("node:path");
-    var fs4 = require("node:fs");
+    var path7 = require("node:path");
+    var fs6 = require("node:fs");
     var process2 = require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1896,11 +1896,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path6.resolve(baseDir, baseName);
-          if (fs4.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path6.extname(baseName))) return void 0;
+          const localBin = path7.resolve(baseDir, baseName);
+          if (fs6.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path7.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs4.existsSync(`${localBin}${ext}`)
+            (ext) => fs6.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1912,21 +1912,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs4.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs6.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path6.resolve(
-            path6.dirname(resolvedScriptPath),
+          executableDir = path7.resolve(
+            path7.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path6.basename(
+            const legacyName = path7.basename(
               this._scriptPath,
-              path6.extname(this._scriptPath)
+              path7.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -1937,7 +1937,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path6.extname(executableFile));
+        launchWithNode = sourceExt.includes(path7.extname(executableFile));
         let proc;
         if (process2.platform !== "win32") {
           if (launchWithNode) {
@@ -2777,7 +2777,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path6.basename(filename, path6.extname(filename));
+        this._name = path7.basename(filename, path7.extname(filename));
         return this;
       }
       /**
@@ -2791,9 +2791,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path7) {
-        if (path7 === void 0) return this._executableDir;
-        this._executableDir = path7;
+      executableDir(path8) {
+        if (path8 === void 0) return this._executableDir;
+        this._executableDir = path8;
         return this;
       }
       /**
@@ -3026,9 +3026,9 @@ var require_commander = __commonJS({
 // ../../node_modules/xmlhttprequest-ssl/lib/XMLHttpRequest.js
 var require_XMLHttpRequest = __commonJS({
   "../../node_modules/xmlhttprequest-ssl/lib/XMLHttpRequest.js"(exports2, module2) {
-    var fs4 = require("fs");
+    var fs6 = require("fs");
     var Url = require("url");
-    var spawn2 = require("child_process").spawn;
+    var spawn3 = require("child_process").spawn;
     module2.exports = XMLHttpRequest3;
     XMLHttpRequest3.XMLHttpRequest = XMLHttpRequest3;
     function XMLHttpRequest3(opts) {
@@ -3184,7 +3184,7 @@ var require_XMLHttpRequest = __commonJS({
             throw new Error("XMLHttpRequest: Only GET method is supported");
           }
           if (settings.async) {
-            fs4.readFile(unescape(url2.pathname), function(error, data2) {
+            fs6.readFile(unescape(url2.pathname), function(error, data2) {
               if (error) {
                 self.handleError(error, error.errno || -1);
               } else {
@@ -3196,7 +3196,7 @@ var require_XMLHttpRequest = __commonJS({
             });
           } else {
             try {
-              this.response = fs4.readFileSync(unescape(url2.pathname));
+              this.response = fs6.readFileSync(unescape(url2.pathname));
               this.responseText = this.response.toString("utf8");
               this.status = 200;
               setState(self.DONE);
@@ -3322,15 +3322,15 @@ var require_XMLHttpRequest = __commonJS({
         } else {
           var contentFile = ".node-xmlhttprequest-content-" + process.pid;
           var syncFile = ".node-xmlhttprequest-sync-" + process.pid;
-          fs4.writeFileSync(syncFile, "", "utf8");
+          fs6.writeFileSync(syncFile, "", "utf8");
           var execString = "var http = require('http'), https = require('https'), fs = require('fs');var doRequest = http" + (ssl ? "s" : "") + ".request;var options = " + JSON.stringify(options) + ";var responseText = '';var responseData = Buffer.alloc(0);var req = doRequest(options, function(response) {response.on('data', function(chunk) {  var data = Buffer.from(chunk);  responseText += data.toString('utf8');  responseData = Buffer.concat([responseData, data]);});response.on('end', function() {fs.writeFileSync('" + contentFile + "', JSON.stringify({err: null, data: {statusCode: response.statusCode, headers: response.headers, text: responseText, data: responseData.toString('base64')}}), 'utf8');fs.unlinkSync('" + syncFile + "');});response.on('error', function(error) {fs.writeFileSync('" + contentFile + "', 'NODE-XMLHTTPREQUEST-ERROR:' + JSON.stringify(error), 'utf8');fs.unlinkSync('" + syncFile + "');});}).on('error', function(error) {fs.writeFileSync('" + contentFile + "', 'NODE-XMLHTTPREQUEST-ERROR:' + JSON.stringify(error), 'utf8');fs.unlinkSync('" + syncFile + "');});" + (data ? "req.write('" + JSON.stringify(data).slice(1, -1).replace(/'/g, "\\'") + "');" : "") + "req.end();";
-          var syncProc = spawn2(process.argv[0], ["-e", execString]);
+          var syncProc = spawn3(process.argv[0], ["-e", execString]);
           var statusText;
-          while (fs4.existsSync(syncFile)) {
+          while (fs6.existsSync(syncFile)) {
           }
-          self.responseText = fs4.readFileSync(contentFile, "utf8");
+          self.responseText = fs6.readFileSync(contentFile, "utf8");
           syncProc.stdin.end();
-          fs4.unlinkSync(contentFile);
+          fs6.unlinkSync(contentFile);
           if (self.responseText.match(/^NODE-XMLHTTPREQUEST-ERROR:/)) {
             var errorObj = JSON.parse(self.responseText.replace(/^NODE-XMLHTTPREQUEST-ERROR:/, ""));
             self.handleError(errorObj, 503);
@@ -3984,7 +3984,7 @@ var require_has_flag = __commonJS({
 var require_supports_color = __commonJS({
   "../../node_modules/debug/node_modules/supports-color/index.js"(exports2, module2) {
     "use strict";
-    var os3 = require("os");
+    var os4 = require("os");
     var hasFlag = require_has_flag();
     var env = process.env;
     var forceColor;
@@ -4022,7 +4022,7 @@ var require_supports_color = __commonJS({
       }
       const min = forceColor ? 1 : 0;
       if (process.platform === "win32") {
-        const osRelease = os3.release().split(".");
+        const osRelease = os4.release().split(".");
         if (Number(process.versions.node.split(".")[0]) >= 8 && Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
           return Number(osRelease[2]) >= 14931 ? 3 : 2;
         }
@@ -4260,15 +4260,16 @@ var require_src = __commonJS({
   }
 });
 
-// ../../node_modules/engine.io-client/node_modules/ws/lib/constants.js
+// ../../node_modules/ws/lib/constants.js
 var require_constants = __commonJS({
-  "../../node_modules/engine.io-client/node_modules/ws/lib/constants.js"(exports2, module2) {
+  "../../node_modules/ws/lib/constants.js"(exports2, module2) {
     "use strict";
     var BINARY_TYPES = ["nodebuffer", "arraybuffer", "fragments"];
     var hasBlob = typeof Blob !== "undefined";
     if (hasBlob) BINARY_TYPES.push("blob");
     module2.exports = {
       BINARY_TYPES,
+      CLOSE_TIMEOUT: 3e4,
       EMPTY_BUFFER: Buffer.alloc(0),
       GUID: "258EAFA5-E914-47DA-95CA-C5AB0DC85B11",
       hasBlob,
@@ -4282,9 +4283,9 @@ var require_constants = __commonJS({
   }
 });
 
-// ../../node_modules/engine.io-client/node_modules/ws/lib/buffer-util.js
+// ../../node_modules/ws/lib/buffer-util.js
 var require_buffer_util = __commonJS({
-  "../../node_modules/engine.io-client/node_modules/ws/lib/buffer-util.js"(exports2, module2) {
+  "../../node_modules/ws/lib/buffer-util.js"(exports2, module2) {
     "use strict";
     var { EMPTY_BUFFER } = require_constants();
     var FastBuffer = Buffer[Symbol.species];
@@ -4357,9 +4358,9 @@ var require_buffer_util = __commonJS({
   }
 });
 
-// ../../node_modules/engine.io-client/node_modules/ws/lib/limiter.js
+// ../../node_modules/ws/lib/limiter.js
 var require_limiter = __commonJS({
-  "../../node_modules/engine.io-client/node_modules/ws/lib/limiter.js"(exports2, module2) {
+  "../../node_modules/ws/lib/limiter.js"(exports2, module2) {
     "use strict";
     var kDone = Symbol("kDone");
     var kRun = Symbol("kRun");
@@ -4407,9 +4408,9 @@ var require_limiter = __commonJS({
   }
 });
 
-// ../../node_modules/engine.io-client/node_modules/ws/lib/permessage-deflate.js
+// ../../node_modules/ws/lib/permessage-deflate.js
 var require_permessage_deflate = __commonJS({
-  "../../node_modules/engine.io-client/node_modules/ws/lib/permessage-deflate.js"(exports2, module2) {
+  "../../node_modules/ws/lib/permessage-deflate.js"(exports2, module2) {
     "use strict";
     var zlib = require("zlib");
     var bufferUtil = require_buffer_util();
@@ -4423,7 +4424,7 @@ var require_permessage_deflate = __commonJS({
     var kBuffers = Symbol("buffers");
     var kError = Symbol("error");
     var zlibLimiter;
-    var PerMessageDeflate = class {
+    var PerMessageDeflate2 = class {
       /**
        * Creates a PerMessageDeflate instance.
        *
@@ -4434,6 +4435,9 @@ var require_permessage_deflate = __commonJS({
        *     acknowledge disabling of client context takeover
        * @param {Number} [options.concurrencyLimit=10] The number of concurrent
        *     calls to zlib
+       * @param {Boolean} [options.isServer=false] Create the instance in either
+       *     server or client mode
+       * @param {Number} [options.maxPayload=0] The maximum allowed message length
        * @param {(Boolean|Number)} [options.serverMaxWindowBits] Request/confirm the
        *     use of a custom server window size
        * @param {Boolean} [options.serverNoContextTakeover=false] Request/accept
@@ -4444,15 +4448,12 @@ var require_permessage_deflate = __commonJS({
        *     deflate
        * @param {Object} [options.zlibInflateOptions] Options to pass to zlib on
        *     inflate
-       * @param {Boolean} [isServer=false] Create the instance in either server or
-       *     client mode
-       * @param {Number} [maxPayload=0] The maximum allowed message length
        */
-      constructor(options, isServer, maxPayload) {
-        this._maxPayload = maxPayload | 0;
+      constructor(options) {
         this._options = options || {};
         this._threshold = this._options.threshold !== void 0 ? this._options.threshold : 1024;
-        this._isServer = !!isServer;
+        this._maxPayload = this._options.maxPayload | 0;
+        this._isServer = !!this._options.isServer;
         this._deflate = null;
         this._inflate = null;
         this.params = null;
@@ -4761,7 +4762,7 @@ var require_permessage_deflate = __commonJS({
         });
       }
     };
-    module2.exports = PerMessageDeflate;
+    module2.exports = PerMessageDeflate2;
     function deflateOnData(chunk) {
       this[kBuffers].push(chunk);
       this[kTotalLength] += chunk.length;
@@ -4790,9 +4791,9 @@ var require_permessage_deflate = __commonJS({
   }
 });
 
-// ../../node_modules/engine.io-client/node_modules/ws/lib/validation.js
+// ../../node_modules/ws/lib/validation.js
 var require_validation = __commonJS({
-  "../../node_modules/engine.io-client/node_modules/ws/lib/validation.js"(exports2, module2) {
+  "../../node_modules/ws/lib/validation.js"(exports2, module2) {
     "use strict";
     var { isUtf8 } = require("buffer");
     var { hasBlob } = require_constants();
@@ -4991,12 +4992,12 @@ var require_validation = __commonJS({
   }
 });
 
-// ../../node_modules/engine.io-client/node_modules/ws/lib/receiver.js
+// ../../node_modules/ws/lib/receiver.js
 var require_receiver = __commonJS({
-  "../../node_modules/engine.io-client/node_modules/ws/lib/receiver.js"(exports2, module2) {
+  "../../node_modules/ws/lib/receiver.js"(exports2, module2) {
     "use strict";
     var { Writable } = require("stream");
-    var PerMessageDeflate = require_permessage_deflate();
+    var PerMessageDeflate2 = require_permessage_deflate();
     var {
       BINARY_TYPES,
       EMPTY_BUFFER,
@@ -5026,6 +5027,10 @@ var require_receiver = __commonJS({
        *     extensions
        * @param {Boolean} [options.isServer=false] Specifies whether to operate in
        *     client or server mode
+       * @param {Number} [options.maxBufferedChunks=0] The maximum number of
+       *     buffered data chunks
+       * @param {Number} [options.maxFragments=0] The maximum number of message
+       *     fragments
        * @param {Number} [options.maxPayload=0] The maximum allowed message length
        * @param {Boolean} [options.skipUTF8Validation=false] Specifies whether or
        *     not to skip UTF-8 validation for text and close messages
@@ -5036,6 +5041,8 @@ var require_receiver = __commonJS({
         this._binaryType = options.binaryType || BINARY_TYPES[0];
         this._extensions = options.extensions || {};
         this._isServer = !!options.isServer;
+        this._maxBufferedChunks = options.maxBufferedChunks | 0;
+        this._maxFragments = options.maxFragments | 0;
         this._maxPayload = options.maxPayload | 0;
         this._skipUTF8Validation = !!options.skipUTF8Validation;
         this[kWebSocket] = void 0;
@@ -5065,6 +5072,18 @@ var require_receiver = __commonJS({
        */
       _write(chunk, encoding, cb) {
         if (this._opcode === 8 && this._state == GET_INFO) return cb();
+        if (this._maxBufferedChunks > 0 && this._buffers.length >= this._maxBufferedChunks) {
+          cb(
+            this.createError(
+              RangeError,
+              "Too many buffered chunks",
+              false,
+              1008,
+              "WS_ERR_TOO_MANY_BUFFERED_PARTS"
+            )
+          );
+          return;
+        }
         this._bufferedBytes += chunk.length;
         this._buffers.push(chunk);
         this.startLoop(cb);
@@ -5163,7 +5182,7 @@ var require_receiver = __commonJS({
           return;
         }
         const compressed = (buf[0] & 64) === 64;
-        if (compressed && !this._extensions[PerMessageDeflate.extensionName]) {
+        if (compressed && !this._extensions[PerMessageDeflate2.extensionName]) {
           const error = this.createError(
             RangeError,
             "RSV1 must be clear",
@@ -5394,6 +5413,17 @@ var require_receiver = __commonJS({
           return;
         }
         if (data.length) {
+          if (this._maxFragments > 0 && this._fragments.length >= this._maxFragments) {
+            const error = this.createError(
+              RangeError,
+              "Too many message fragments",
+              false,
+              1008,
+              "WS_ERR_TOO_MANY_BUFFERED_PARTS"
+            );
+            cb(error);
+            return;
+          }
           this._messageLength = this._totalPayloadLength;
           this._fragments.push(data);
         }
@@ -5407,7 +5437,7 @@ var require_receiver = __commonJS({
        * @private
        */
       decompress(data, cb) {
-        const perMessageDeflate = this._extensions[PerMessageDeflate.extensionName];
+        const perMessageDeflate = this._extensions[PerMessageDeflate2.extensionName];
         perMessageDeflate.decompress(data, this._fin, (err, buf) => {
           if (err) return cb(err);
           if (buf.length) {
@@ -5423,6 +5453,17 @@ var require_receiver = __commonJS({
               cb(error);
               return;
             }
+            if (this._maxFragments > 0 && this._fragments.length >= this._maxFragments) {
+              const error = this.createError(
+                RangeError,
+                "Too many message fragments",
+                false,
+                1008,
+                "WS_ERR_TOO_MANY_BUFFERED_PARTS"
+              );
+              cb(error);
+              return;
+            }
             this._fragments.push(buf);
           }
           this.dataMessage(cb);
@@ -5583,13 +5624,16 @@ var require_receiver = __commonJS({
   }
 });
 
-// ../../node_modules/engine.io-client/node_modules/ws/lib/sender.js
+// ../../node_modules/ws/lib/sender.js
 var require_sender = __commonJS({
-  "../../node_modules/engine.io-client/node_modules/ws/lib/sender.js"(exports2, module2) {
+  "../../node_modules/ws/lib/sender.js"(exports2, module2) {
     "use strict";
     var { Duplex } = require("stream");
     var { randomFillSync } = require("crypto");
-    var PerMessageDeflate = require_permessage_deflate();
+    var {
+      types: { isUint8Array }
+    } = require("util");
+    var PerMessageDeflate2 = require_permessage_deflate();
     var { EMPTY_BUFFER, kWebSocket, NOOP } = require_constants();
     var { isBlob, isValidStatusCode } = require_validation();
     var { mask: applyMask, toBuffer: toBuffer2 } = require_buffer_util();
@@ -5742,8 +5786,10 @@ var require_sender = __commonJS({
           buf.writeUInt16BE(code, 0);
           if (typeof data === "string") {
             buf.write(data, 2);
-          } else {
+          } else if (isUint8Array(data)) {
             buf.set(data, 2);
+          } else {
+            throw new TypeError("Second argument must be a string or a Uint8Array");
           }
         }
         const options = {
@@ -5873,7 +5919,7 @@ var require_sender = __commonJS({
        * @public
        */
       send(data, options, cb) {
-        const perMessageDeflate = this._extensions[PerMessageDeflate.extensionName];
+        const perMessageDeflate = this._extensions[PerMessageDeflate2.extensionName];
         let opcode = options.binary ? 2 : 1;
         let rsv1 = options.compress;
         let byteLength2;
@@ -5997,7 +6043,7 @@ var require_sender = __commonJS({
           this.sendFrame(_Sender.frame(data, options), cb);
           return;
         }
-        const perMessageDeflate = this._extensions[PerMessageDeflate.extensionName];
+        const perMessageDeflate = this._extensions[PerMessageDeflate2.extensionName];
         this._bufferedBytes += options[kByteLength];
         this._state = DEFLATING;
         perMessageDeflate.compress(data, options.fin, (_, buf) => {
@@ -6071,9 +6117,9 @@ var require_sender = __commonJS({
   }
 });
 
-// ../../node_modules/engine.io-client/node_modules/ws/lib/event-target.js
+// ../../node_modules/ws/lib/event-target.js
 var require_event_target = __commonJS({
-  "../../node_modules/engine.io-client/node_modules/ws/lib/event-target.js"(exports2, module2) {
+  "../../node_modules/ws/lib/event-target.js"(exports2, module2) {
     "use strict";
     var { kForOnEventAttribute, kListener } = require_constants();
     var kCode = Symbol("kCode");
@@ -6300,9 +6346,9 @@ var require_event_target = __commonJS({
   }
 });
 
-// ../../node_modules/engine.io-client/node_modules/ws/lib/extension.js
+// ../../node_modules/ws/lib/extension.js
 var require_extension = __commonJS({
-  "../../node_modules/engine.io-client/node_modules/ws/lib/extension.js"(exports2, module2) {
+  "../../node_modules/ws/lib/extension.js"(exports2, module2) {
     "use strict";
     var { tokenChars } = require_validation();
     function push(dest, name, elem) {
@@ -6435,11 +6481,11 @@ var require_extension = __commonJS({
       return offers;
     }
     function format(extensions) {
-      return Object.keys(extensions).map((extension) => {
-        let configurations = extensions[extension];
+      return Object.keys(extensions).map((extension2) => {
+        let configurations = extensions[extension2];
         if (!Array.isArray(configurations)) configurations = [configurations];
         return configurations.map((params) => {
-          return [extension].concat(
+          return [extension2].concat(
             Object.keys(params).map((k) => {
               let values = params[k];
               if (!Array.isArray(values)) values = [values];
@@ -6453,9 +6499,9 @@ var require_extension = __commonJS({
   }
 });
 
-// ../../node_modules/engine.io-client/node_modules/ws/lib/websocket.js
+// ../../node_modules/ws/lib/websocket.js
 var require_websocket = __commonJS({
-  "../../node_modules/engine.io-client/node_modules/ws/lib/websocket.js"(exports2, module2) {
+  "../../node_modules/ws/lib/websocket.js"(exports2, module2) {
     "use strict";
     var EventEmitter = require("events");
     var https = require("https");
@@ -6465,12 +6511,13 @@ var require_websocket = __commonJS({
     var { randomBytes, createHash } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
-    var PerMessageDeflate = require_permessage_deflate();
+    var PerMessageDeflate2 = require_permessage_deflate();
     var Receiver2 = require_receiver();
     var Sender2 = require_sender();
     var { isBlob } = require_validation();
     var {
       BINARY_TYPES,
+      CLOSE_TIMEOUT,
       EMPTY_BUFFER,
       GUID,
       kForOnEventAttribute,
@@ -6484,7 +6531,6 @@ var require_websocket = __commonJS({
     } = require_event_target();
     var { format, parse: parse3 } = require_extension();
     var { toBuffer: toBuffer2 } = require_buffer_util();
-    var closeTimeout = 30 * 1e3;
     var kAborted = Symbol("kAborted");
     var protocolVersions = [8, 13];
     var readyStates = ["CONNECTING", "OPEN", "CLOSING", "CLOSED"];
@@ -6530,6 +6576,7 @@ var require_websocket = __commonJS({
           initAsClient(this, address, protocols, options);
         } else {
           this._autoPong = options.autoPong;
+          this._closeTimeout = options.closeTimeout;
           this._isServer = true;
         }
       }
@@ -6623,6 +6670,10 @@ var require_websocket = __commonJS({
        *     multiple times in the same tick
        * @param {Function} [options.generateMask] The function used to generate the
        *     masking key
+       * @param {Number} [options.maxBufferedChunks=0] The maximum number of
+       *     buffered data chunks
+       * @param {Number} [options.maxFragments=0] The maximum number of message
+       *     fragments
        * @param {Number} [options.maxPayload=0] The maximum allowed message size
        * @param {Boolean} [options.skipUTF8Validation=false] Specifies whether or
        *     not to skip UTF-8 validation for text and close messages
@@ -6634,6 +6685,8 @@ var require_websocket = __commonJS({
           binaryType: this.binaryType,
           extensions: this._extensions,
           isServer: this._isServer,
+          maxBufferedChunks: options.maxBufferedChunks,
+          maxFragments: options.maxFragments,
           maxPayload: options.maxPayload,
           skipUTF8Validation: options.skipUTF8Validation
         });
@@ -6672,8 +6725,8 @@ var require_websocket = __commonJS({
           this.emit("close", this._closeCode, this._closeMessage);
           return;
         }
-        if (this._extensions[PerMessageDeflate.extensionName]) {
-          this._extensions[PerMessageDeflate.extensionName].cleanup();
+        if (this._extensions[PerMessageDeflate2.extensionName]) {
+          this._extensions[PerMessageDeflate2.extensionName].cleanup();
         }
         this._receiver.removeAllListeners();
         this._readyState = _WebSocket.CLOSED;
@@ -6835,7 +6888,7 @@ var require_websocket = __commonJS({
           fin: true,
           ...options
         };
-        if (!this._extensions[PerMessageDeflate.extensionName]) {
+        if (!this._extensions[PerMessageDeflate2.extensionName]) {
           opts.compress = false;
         }
         this._sender.send(data || EMPTY_BUFFER, opts, cb);
@@ -6931,7 +6984,10 @@ var require_websocket = __commonJS({
       const opts = {
         allowSynchronousEvents: true,
         autoPong: true,
+        closeTimeout: CLOSE_TIMEOUT,
         protocolVersion: protocolVersions[1],
+        maxBufferedChunks: 1024 * 1024,
+        maxFragments: 128 * 1024,
         maxPayload: 100 * 1024 * 1024,
         skipUTF8Validation: false,
         perMessageDeflate: true,
@@ -6948,6 +7004,7 @@ var require_websocket = __commonJS({
         port: void 0
       };
       websocket._autoPong = opts.autoPong;
+      websocket._closeTimeout = opts.closeTimeout;
       if (!protocolVersions.includes(opts.protocolVersion)) {
         throw new RangeError(
           `Unsupported protocol version: ${opts.protocolVersion} (supported versions: ${protocolVersions.join(", ")})`
@@ -6959,7 +7016,7 @@ var require_websocket = __commonJS({
       } else {
         try {
           parsedUrl = new URL2(address);
-        } catch (e) {
+        } catch {
           throw new SyntaxError(`Invalid URL: ${address}`);
         }
       }
@@ -7007,13 +7064,13 @@ var require_websocket = __commonJS({
       opts.path = parsedUrl.pathname + parsedUrl.search;
       opts.timeout = opts.handshakeTimeout;
       if (opts.perMessageDeflate) {
-        perMessageDeflate = new PerMessageDeflate(
-          opts.perMessageDeflate !== true ? opts.perMessageDeflate : {},
-          false,
-          opts.maxPayload
-        );
+        perMessageDeflate = new PerMessageDeflate2({
+          ...opts.perMessageDeflate,
+          isServer: false,
+          maxPayload: opts.maxPayload
+        });
         opts.headers["Sec-WebSocket-Extensions"] = format({
-          [PerMessageDeflate.extensionName]: perMessageDeflate.offer()
+          [PerMessageDeflate2.extensionName]: perMessageDeflate.offer()
         });
       }
       if (protocols.length) {
@@ -7156,23 +7213,25 @@ var require_websocket = __commonJS({
             return;
           }
           const extensionNames = Object.keys(extensions);
-          if (extensionNames.length !== 1 || extensionNames[0] !== PerMessageDeflate.extensionName) {
+          if (extensionNames.length !== 1 || extensionNames[0] !== PerMessageDeflate2.extensionName) {
             const message = "Server indicated an extension that was not requested";
             abortHandshake(websocket, socket, message);
             return;
           }
           try {
-            perMessageDeflate.accept(extensions[PerMessageDeflate.extensionName]);
+            perMessageDeflate.accept(extensions[PerMessageDeflate2.extensionName]);
           } catch (err) {
             const message = "Invalid Sec-WebSocket-Extensions header";
             abortHandshake(websocket, socket, message);
             return;
           }
-          websocket._extensions[PerMessageDeflate.extensionName] = perMessageDeflate;
+          websocket._extensions[PerMessageDeflate2.extensionName] = perMessageDeflate;
         }
         websocket.setSocket(socket, head, {
           allowSynchronousEvents: opts.allowSynchronousEvents,
           generateMask: opts.generateMask,
+          maxBufferedChunks: opts.maxBufferedChunks,
+          maxFragments: opts.maxFragments,
           maxPayload: opts.maxPayload,
           skipUTF8Validation: opts.skipUTF8Validation
         });
@@ -7290,7 +7349,7 @@ var require_websocket = __commonJS({
     function setCloseTimer(websocket) {
       websocket._closeTimer = setTimeout(
         websocket._socket.destroy.bind(websocket._socket),
-        closeTimeout
+        websocket._closeTimeout
       );
     }
     function socketOnClose() {
@@ -7299,8 +7358,8 @@ var require_websocket = __commonJS({
       this.removeListener("data", socketOnData);
       this.removeListener("end", socketOnEnd);
       websocket._readyState = WebSocket2.CLOSING;
-      let chunk;
-      if (!this._readableState.endEmitted && !websocket._closeFrameReceived && !websocket._receiver._writableState.errorEmitted && (chunk = websocket._socket.read()) !== null) {
+      if (!this._readableState.endEmitted && !websocket._closeFrameReceived && !websocket._receiver._writableState.errorEmitted && this._readableState.length !== 0) {
+        const chunk = this.read(this._readableState.length);
         websocket._receiver.write(chunk);
       }
       websocket._receiver.end();
@@ -7336,9 +7395,9 @@ var require_websocket = __commonJS({
   }
 });
 
-// ../../node_modules/engine.io-client/node_modules/ws/lib/stream.js
+// ../../node_modules/ws/lib/stream.js
 var require_stream = __commonJS({
-  "../../node_modules/engine.io-client/node_modules/ws/lib/stream.js"(exports2, module2) {
+  "../../node_modules/ws/lib/stream.js"(exports2, module2) {
     "use strict";
     var WebSocket2 = require_websocket();
     var { Duplex } = require("stream");
@@ -7434,9 +7493,9 @@ var require_stream = __commonJS({
   }
 });
 
-// ../../node_modules/engine.io-client/node_modules/ws/lib/subprotocol.js
+// ../../node_modules/ws/lib/subprotocol.js
 var require_subprotocol = __commonJS({
-  "../../node_modules/engine.io-client/node_modules/ws/lib/subprotocol.js"(exports2, module2) {
+  "../../node_modules/ws/lib/subprotocol.js"(exports2, module2) {
     "use strict";
     var { tokenChars } = require_validation();
     function parse3(header) {
@@ -7479,19 +7538,19 @@ var require_subprotocol = __commonJS({
   }
 });
 
-// ../../node_modules/engine.io-client/node_modules/ws/lib/websocket-server.js
+// ../../node_modules/ws/lib/websocket-server.js
 var require_websocket_server = __commonJS({
-  "../../node_modules/engine.io-client/node_modules/ws/lib/websocket-server.js"(exports2, module2) {
+  "../../node_modules/ws/lib/websocket-server.js"(exports2, module2) {
     "use strict";
     var EventEmitter = require("events");
     var http = require("http");
     var { Duplex } = require("stream");
     var { createHash } = require("crypto");
-    var extension = require_extension();
-    var PerMessageDeflate = require_permessage_deflate();
-    var subprotocol = require_subprotocol();
+    var extension2 = require_extension();
+    var PerMessageDeflate2 = require_permessage_deflate();
+    var subprotocol2 = require_subprotocol();
     var WebSocket2 = require_websocket();
-    var { GUID, kWebSocket } = require_constants();
+    var { CLOSE_TIMEOUT, GUID, kWebSocket } = require_constants();
     var keyRegex = /^[+/0-9A-Za-z]{22}==$/;
     var RUNNING = 0;
     var CLOSING = 1;
@@ -7510,8 +7569,15 @@ var require_websocket_server = __commonJS({
        *     pending connections
        * @param {Boolean} [options.clientTracking=true] Specifies whether or not to
        *     track clients
+       * @param {Number} [options.closeTimeout=30000] Duration in milliseconds to
+       *     wait for the closing handshake to finish after `websocket.close()` is
+       *     called
        * @param {Function} [options.handleProtocols] A hook to handle protocols
        * @param {String} [options.host] The hostname where to bind the server
+       * @param {Number} [options.maxBufferedChunks=1048576] The maximum number of
+       *     buffered data chunks
+       * @param {Number} [options.maxFragments=131072] The maximum number of message
+       *     fragments
        * @param {Number} [options.maxPayload=104857600] The maximum allowed message
        *     size
        * @param {Boolean} [options.noServer=false] Enable no server mode
@@ -7533,11 +7599,14 @@ var require_websocket_server = __commonJS({
         options = {
           allowSynchronousEvents: true,
           autoPong: true,
+          maxBufferedChunks: 1024 * 1024,
+          maxFragments: 128 * 1024,
           maxPayload: 100 * 1024 * 1024,
           skipUTF8Validation: false,
           perMessageDeflate: false,
           handleProtocols: null,
           clientTracking: true,
+          closeTimeout: CLOSE_TIMEOUT,
           verifyClient: null,
           noServer: false,
           backlog: null,
@@ -7708,7 +7777,7 @@ var require_websocket_server = __commonJS({
         let protocols = /* @__PURE__ */ new Set();
         if (secWebSocketProtocol !== void 0) {
           try {
-            protocols = subprotocol.parse(secWebSocketProtocol);
+            protocols = subprotocol2.parse(secWebSocketProtocol);
           } catch (err) {
             const message = "Invalid Sec-WebSocket-Protocol header";
             abortHandshakeOrEmitwsClientError(this, req, socket, 400, message);
@@ -7718,16 +7787,16 @@ var require_websocket_server = __commonJS({
         const secWebSocketExtensions = req.headers["sec-websocket-extensions"];
         const extensions = {};
         if (this.options.perMessageDeflate && secWebSocketExtensions !== void 0) {
-          const perMessageDeflate = new PerMessageDeflate(
-            this.options.perMessageDeflate,
-            true,
-            this.options.maxPayload
-          );
+          const perMessageDeflate = new PerMessageDeflate2({
+            ...this.options.perMessageDeflate,
+            isServer: true,
+            maxPayload: this.options.maxPayload
+          });
           try {
-            const offers = extension.parse(secWebSocketExtensions);
-            if (offers[PerMessageDeflate.extensionName]) {
-              perMessageDeflate.accept(offers[PerMessageDeflate.extensionName]);
-              extensions[PerMessageDeflate.extensionName] = perMessageDeflate;
+            const offers = extension2.parse(secWebSocketExtensions);
+            if (offers[PerMessageDeflate2.extensionName]) {
+              perMessageDeflate.accept(offers[PerMessageDeflate2.extensionName]);
+              extensions[PerMessageDeflate2.extensionName] = perMessageDeflate;
             }
           } catch (err) {
             const message = "Invalid or unacceptable Sec-WebSocket-Extensions header";
@@ -7798,10 +7867,10 @@ var require_websocket_server = __commonJS({
             ws._protocol = protocol4;
           }
         }
-        if (extensions[PerMessageDeflate.extensionName]) {
-          const params = extensions[PerMessageDeflate.extensionName].params;
-          const value2 = extension.format({
-            [PerMessageDeflate.extensionName]: [params]
+        if (extensions[PerMessageDeflate2.extensionName]) {
+          const params = extensions[PerMessageDeflate2.extensionName].params;
+          const value2 = extension2.format({
+            [PerMessageDeflate2.extensionName]: [params]
           });
           headers.push(`Sec-WebSocket-Extensions: ${value2}`);
           ws._extensions = extensions;
@@ -7811,6 +7880,8 @@ var require_websocket_server = __commonJS({
         socket.removeListener("error", socketOnError);
         ws.setSocket(socket, head, {
           allowSynchronousEvents: this.options.allowSynchronousEvents,
+          maxBufferedChunks: this.options.maxBufferedChunks,
+          maxFragments: this.options.maxFragments,
           maxPayload: this.options.maxPayload,
           skipUTF8Validation: this.options.skipUTF8Validation
         });
@@ -7868,6 +7939,9 @@ var require_websocket_server = __commonJS({
   }
 });
 
+// src/cli.ts
+var import_node_dns = __toESM(require("node:dns"));
+
 // node_modules/commander/esm.mjs
 var import_index = __toESM(require_commander(), 1);
 var {
@@ -7963,10 +8037,10 @@ function configExists() {
   return import_fs.default.existsSync(CONFIG_FILE);
 }
 
-// ../../shared/all/helpers/card-ai/claude.ts
+// ../../shared/all/helpers/board-agent-core/claude.ts
 var import_child_process2 = require("child_process");
 
-// ../../shared/all/helpers/card-ai/claude-stream.ts
+// ../../shared/all/helpers/board-agent-core/claude-stream.ts
 function truncate(s, max) {
   return s.length > max ? s.slice(0, max) + "..." : s;
 }
@@ -8194,6 +8268,12 @@ function pipeClaudeStream(proc, callbacks) {
     for (const line of lines) {
       const trimmed = line.trim();
       if (!trimmed) continue;
+      if (trimmed[0] !== "{" && trimmed[0] !== "[") {
+        state.isError = true;
+        state.fullText = state.fullText ? `${state.fullText}
+${trimmed}` : trimmed;
+        continue;
+      }
       try {
         const raw = JSON.parse(trimmed);
         if (processStreamEvent(raw, state, callbacks)) continue;
@@ -8221,7 +8301,7 @@ function pipeClaudeStream(proc, callbacks) {
   };
 }
 
-// ../../shared/all/helpers/card-ai/prompts.json
+// ../../shared/all/helpers/board-agent-core/prompts.json
 var prompts_default = {
   system: [
     "You are a coding agent working inside a Docker container on a task from a project management board.",
@@ -8231,7 +8311,7 @@ var prompts_default = {
     "2. **Implement** \u2014 Execute the plan. You gain Edit, Write, and Bash tools. Make the code changes.",
     "3. **Review** \u2014 Validate your changes, fix issues, generate reproduction steps for the developer.",
     "",
-    "An optional **Preview** phase may occur between Implement and Review where you set up a live dev environment.",
+    "After Review, the developer may request an optional **Preview** where you set up a live dev environment on demand.",
     "",
     "## Task Tracking",
     "Use the TodoWrite tool to track your progress. Create todos at the start of each phase with your planned steps,",
@@ -8394,7 +8474,7 @@ var prompts_default = {
   commitMessage: 'Generate a single-line conventional commit message (e.g. "feat: ...", "fix: ...", "refactor: ...") for these changes. Output ONLY the commit message, nothing else.'
 };
 
-// ../../shared/all/helpers/card-ai/claude.ts
+// ../../shared/all/helpers/board-agent-core/claude.ts
 function spawnClaude(opts) {
   const args = [
     "exec",
@@ -8494,11 +8574,18 @@ ${diff.slice(0, 8e3)}`);
   });
 }
 
-// ../../shared/all/helpers/card-ai/docker.ts
+// ../../shared/all/helpers/board-agent-core/docker.ts
 var import_child_process3 = require("child_process");
+var import_crypto = __toESM(require("crypto"));
+var import_promises = __toESM(require("fs/promises"));
 var import_net = __toESM(require("net"));
 var import_util = require("util");
 var execFileAsync = (0, import_util.promisify)(import_child_process3.execFile);
+var DOCKERFILE_LABEL = "factiii.dockerfile-sha";
+async function hashDockerfile(dockerfilePath) {
+  const buf = await import_promises.default.readFile(dockerfilePath);
+  return import_crypto.default.createHash("sha256").update(buf).digest("hex");
+}
 async function getFreePort() {
   return new Promise((resolve, reject) => {
     const srv = import_net.default.createServer();
@@ -8524,28 +8611,105 @@ async function assertDockerRunning() {
     );
   }
 }
-async function ensureDockerImage(dockerfilePath) {
+var BUILD_TIMEOUT_MS = 9e5;
+async function ensureDockerImage(dockerfilePath, onLog) {
   await assertDockerRunning();
+  const wantedHash = await hashDockerfile(dockerfilePath);
   try {
-    await execFileAsync("docker", ["image", "inspect", "factiii-claude"], {});
-    return;
+    const { stdout } = await execFileAsync(
+      "docker",
+      [
+        "image",
+        "inspect",
+        "factiii-claude",
+        "--format",
+        `{{ index .Config.Labels "${DOCKERFILE_LABEL}" }}`
+      ],
+      {}
+    );
+    if (stdout.trim() === wantedHash) return;
   } catch {
   }
-  await execFileAsync(
-    "docker",
-    ["build", "-t", "factiii-claude", "-f", dockerfilePath, "."],
-    { timeout: 3e5 }
-  );
+  await buildImageStreaming(dockerfilePath, wantedHash, onLog);
+  await resetNixVolume();
 }
-async function ensureCacheVolume() {
+async function resetNixVolume() {
   try {
-    await execFileAsync(
+    const { stdout } = await execFileAsync("docker", [
+      "ps",
+      "-aq",
+      "--filter",
+      "volume=factiii-nix"
+    ]);
+    const ids = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+    if (ids.length) await execFileAsync("docker", ["rm", "-f", ...ids]);
+    await execFileAsync("docker", ["volume", "rm", "factiii-nix"]);
+  } catch {
+  }
+}
+function buildImageStreaming(dockerfilePath, wantedHash, onLog) {
+  return new Promise((resolve, reject) => {
+    const child = (0, import_child_process3.spawn)(
       "docker",
-      ["volume", "inspect", "factiii-card-cache"],
-      {}
+      [
+        "build",
+        "--progress=plain",
+        "-t",
+        "factiii-claude",
+        "-f",
+        dockerfilePath,
+        "--label",
+        `${DOCKERFILE_LABEL}=${wantedHash}`,
+        "."
+      ],
+      { env: { ...process.env, DOCKER_BUILDKIT: "1" } }
     );
-  } catch {
-    await execFileAsync("docker", ["volume", "create", "factiii-card-cache"]);
+    let timer;
+    const arm = () => {
+      clearTimeout(timer);
+      timer = setTimeout(() => {
+        child.kill("SIGKILL");
+        reject(
+          new Error(
+            "Building container image timed out. Check Docker and your connection, then Try Again."
+          )
+        );
+      }, BUILD_TIMEOUT_MS);
+    };
+    arm();
+    const makeLineEmitter = () => {
+      let buffer = "";
+      return (buf) => {
+        arm();
+        buffer += buf.toString();
+        const parts2 = buffer.split("\n");
+        buffer = parts2.pop() ?? "";
+        for (const line of parts2) {
+          const trimmed = line.trimEnd();
+          if (trimmed) onLog?.(trimmed);
+        }
+      };
+    };
+    child.stdout.on("data", makeLineEmitter());
+    child.stderr.on("data", makeLineEmitter());
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolve();
+      else reject(new Error(`docker build failed (exit code ${code}).`));
+    });
+  });
+}
+async function ensureCacheVolume() {
+  for (const name of ["factiii-card-cache", "factiii-nix"]) {
+    try {
+      await execFileAsync("docker", ["volume", "inspect", name], {});
+    } catch {
+      await execFileAsync("docker", ["volume", "create", name]);
+    }
   }
 }
 async function killContainer(containerName) {
@@ -8554,7 +8718,7 @@ async function killContainer(containerName) {
   } catch {
   }
 }
-async function spawnContainer(containerName, claudeToken) {
+async function spawnContainer(containerName, claudeToken, opts) {
   const NUM_PORTS = 6;
   const ports = [];
   const seen = /* @__PURE__ */ new Set();
@@ -8575,10 +8739,22 @@ async function spawnContainer(containerName, claudeToken) {
     containerName,
     "--user",
     "claude",
+    // SYS_PTRACE: gdb/strace/valgrind (Docker seccomp gates ptrace on it).
+    // NET_RAW: raw-socket tools (tcpdump/nmap/ping). Scoped to the container.
+    "--cap-add",
+    "SYS_PTRACE",
+    "--cap-add",
+    "NET_RAW",
+    // FUSE for rclone mount on OneDrive spaces (gated - GitHub stays unprivileged).
+    ...opts?.fuse ? ["--cap-add", "SYS_ADMIN", "--device", "/dev/fuse"] : [],
     "-e",
     "HOME=/home/claude",
+    ...claudeToken ? ["-e", `CLAUDE_CODE_OAUTH_TOKEN=${claudeToken}`] : [],
+    // Redirect the otherwise-`~/.claude.json` config file into the .claude
+    // dir, which is symlinked to /cache/claude. Keeps all claude state
+    // inside one path the CLI already understands.
     "-e",
-    `CLAUDE_CODE_OAUTH_TOKEN=${claudeToken}`,
+    "CLAUDE_CONFIG_DIR=/home/claude/.claude",
     "-e",
     "NODE_OPTIONS=--max-old-space-size=4096",
     "-e",
@@ -8597,6 +8773,8 @@ async function spawnContainer(containerName, claudeToken) {
     `FACTIII_PORTS=${ports.join(",")}`,
     "-v",
     "factiii-card-cache:/cache",
+    "-v",
+    "factiii-nix:/nix",
     ...portArgs,
     "factiii-claude",
     "tail",
@@ -8613,6 +8791,37 @@ async function execInContainer(containerName, cmd) {
   );
   return stdout;
 }
+function streamExecInContainer(containerName, cmd, onLine) {
+  const child = (0, import_child_process3.spawn)("docker", [
+    "exec",
+    "--user",
+    "claude",
+    containerName,
+    "sh",
+    "-c",
+    cmd
+  ]);
+  let buffer = "";
+  child.stdout.on("data", (buf) => {
+    buffer += buf.toString();
+    const parts2 = buffer.split("\n");
+    buffer = parts2.pop() ?? "";
+    for (const line of parts2) {
+      const trimmed = line.trimEnd();
+      if (trimmed) onLine(trimmed);
+    }
+  });
+  child.on("error", () => {
+  });
+  let stopped = false;
+  return {
+    stop: () => {
+      if (stopped) return;
+      stopped = true;
+      child.kill("SIGKILL");
+    }
+  };
+}
 async function execInContainerAsRoot(containerName, cmd) {
   const { stdout } = await execFileAsync(
     "docker",
@@ -8624,15 +8833,19 @@ async function execInContainerAsRoot(containerName, cmd) {
 async function setupContainerCache(containerName) {
   await execInContainer(
     containerName,
-    "mkdir -p /cache/repos /cache/claude /cache/pnpm-store /cache/pnpm-vstore /cache/pip-cache /cache/npm-cache /cache/apk /cache/xdg-cache"
+    "mkdir -p /cache/repos /cache/claude /cache/pnpm-store /cache/pnpm-vstore /cache/pip-cache /cache/npm-cache /cache/apt /cache/xdg-cache"
   );
   await execInContainer(
     containerName,
     "ln -sfn /cache/claude /home/claude/.claude"
   );
+  await execInContainer(
+    containerName,
+    "printf 'set -g mouse on\\nset -g history-limit 50000\\nset -g set-clipboard on\\nset -ga terminal-features ,*:clipboard\\nbind -T copy-mode MouseDragEnd1Pane send -X copy-selection-and-cancel\\nbind -T copy-mode-vi MouseDragEnd1Pane send -X copy-selection-and-cancel\\n' > /home/claude/.tmux.conf"
+  );
   await execInContainerAsRoot(
     containerName,
-    "ln -sfn /cache/apk /etc/apk/cache"
+    "rm -rf /var/cache/apt/archives && ln -sfn /cache/apt /var/cache/apt/archives && mkdir -p /cache/apt/partial"
   );
 }
 async function isContainerRunning(containerName) {
@@ -8661,136 +8874,10 @@ async function getContainerPort(containerName, containerPort) {
   }
 }
 
-// ../../shared/all/helpers/card-ai/frpc.ts
+// ../../shared/all/helpers/board-agent-core/git.ts
 var import_child_process4 = require("child_process");
-var import_fs2 = require("fs");
-var import_path2 = __toESM(require("path"));
 var import_util2 = require("util");
-
-// ../../shared/all/helpers/card-ai/scripts.ts
-var FRPC_EXPOSE_SCRIPT = `#!/bin/sh
-set -e
-set -a; . /etc/environment.factiii 2>/dev/null || true; set +a
-PORT="$1"
-NAME="$2"
-if [ -z "$PORT" ] || [ -z "$NAME" ]; then
-  echo "usage: factiii-expose <port> <name>" >&2
-  echo "  e.g. factiii-expose 3000 app" >&2
-  exit 1
-fi
-case "$NAME" in *[!a-zA-Z0-9-]*|"") echo "name must be [a-zA-Z0-9-]" >&2; exit 1 ;; esac
-PROXY="\${FACTIII_TASK_ID}-\${NAME}"
-DOMAIN="\${PROXY}.\${FACTIII_FRP_DOMAIN}"
-TOML="/tmp/frpc-\${NAME}.toml"
-cat > "$TOML" <<EOF
-serverAddr = "\${FACTIII_FRP_SERVER}"
-serverPort = \${FACTIII_FRP_PORT}
-transport.protocol = "kcp"
-
-[metadatas]
-factiii_token = "\${FACTIII_FRP_TOKEN}"
-
-[[proxies]]
-name = "\${PROXY}"
-type = "http"
-localPort = \${PORT}
-subdomain = "\${PROXY}"
-EOF
-setsid frpc -c "$TOML" >/tmp/frpc-\${NAME}.log 2>&1 < /dev/null &
-echo $! > /tmp/frpc-\${NAME}.pid
-echo "http://\${DOMAIN}"
-`;
-var FRPC_UNEXPOSE_SCRIPT = `#!/bin/sh
-NAME="$1"
-if [ -z "$NAME" ]; then
-  echo "usage: factiii-unexpose <name>" >&2
-  exit 1
-fi
-PID_FILE="/tmp/frpc-\${NAME}.pid"
-if [ -f "$PID_FILE" ]; then
-  kill "$(cat "$PID_FILE")" 2>/dev/null || true
-  rm -f "$PID_FILE" "/tmp/frpc-\${NAME}.toml" "/tmp/frpc-\${NAME}.log"
-  echo "stopped \${NAME}"
-else
-  echo "no tunnel named \${NAME}" >&2
-  exit 1
-fi
-`;
-
-// ../../shared/all/helpers/card-ai/frpc.ts
 var execFileAsync2 = (0, import_util2.promisify)(import_child_process4.execFile);
-var FRP_SERVER_ADDR = "dev.factiii.com";
-var FRP_SERVER_PORT = 7443;
-var FRP_DOMAIN_SUFFIX = "dev.factiii.com";
-async function writeFileAsRoot(containerName, path6, contents) {
-  const b64 = Buffer.from(contents, "utf-8").toString("base64");
-  await execInContainerAsRoot(
-    containerName,
-    `echo '${b64}' | base64 -d > '${path6}'`
-  );
-}
-async function installFrpcBinary(containerName) {
-  const arch = (await execInContainer(containerName, "uname -m")).trim();
-  const map = {
-    x86_64: "frpc-linux-amd64",
-    aarch64: "frpc-linux-arm64"
-  };
-  const binaryName = map[arch];
-  if (!binaryName) {
-    throw new Error(`Unsupported container arch for frpc: ${arch}`);
-  }
-  const src = import_path2.default.join(__dirname, "..", "vendor", binaryName);
-  if (!(0, import_fs2.existsSync)(src)) {
-    throw new Error(
-      `Vendored frpc missing (${src}). Run apps/runner/scripts/fetch-frpc.sh.`
-    );
-  }
-  await execFileAsync2("docker", [
-    "cp",
-    src,
-    `${containerName}:/usr/local/bin/frpc`
-  ]);
-  await execInContainerAsRoot(containerName, "chmod +x /usr/local/bin/frpc");
-}
-async function installFrpcHarness(params) {
-  const { containerName, taskId, runnerToken } = params;
-  await installFrpcBinary(containerName);
-  const envLines = [
-    `FACTIII_FRP_SERVER=${FRP_SERVER_ADDR}`,
-    `FACTIII_FRP_PORT=${FRP_SERVER_PORT}`,
-    `FACTIII_FRP_TOKEN=${runnerToken}`,
-    `FACTIII_FRP_DOMAIN=${FRP_DOMAIN_SUFFIX}`,
-    `FACTIII_TASK_ID=${taskId}`
-  ];
-  await writeFileAsRoot(
-    containerName,
-    "/usr/local/bin/factiii-expose",
-    FRPC_EXPOSE_SCRIPT
-  );
-  await writeFileAsRoot(
-    containerName,
-    "/usr/local/bin/factiii-unexpose",
-    FRPC_UNEXPOSE_SCRIPT
-  );
-  await execInContainerAsRoot(
-    containerName,
-    "chmod +x /usr/local/bin/factiii-expose /usr/local/bin/factiii-unexpose"
-  );
-  await writeFileAsRoot(
-    containerName,
-    "/etc/environment.factiii",
-    envLines.join("\n") + "\n"
-  );
-  await execInContainerAsRoot(
-    containerName,
-    `grep -q 'environment.factiii' /home/claude/.profile 2>/dev/null || echo 'set -a; . /etc/environment.factiii; set +a' >> /home/claude/.profile && chown claude:claude /home/claude/.profile`
-  );
-}
-
-// ../../shared/all/helpers/card-ai/git.ts
-var import_child_process5 = require("child_process");
-var import_util3 = require("util");
-var execFileAsync3 = (0, import_util3.promisify)(import_child_process5.execFile);
 function buildCloneUrl(repoUrl, githubToken) {
   const url2 = new URL(repoUrl);
   url2.username = githubToken;
@@ -8804,7 +8891,7 @@ function repoCacheKey(repoUrl) {
   return repoUrl.replace(/^https?:\/\//, "").replace(/\/\/.*@/, "").replace(/\.git$/, "").replace(/[^a-zA-Z0-9._-]/g, "_");
 }
 async function gitInContainer(containerName, ...args) {
-  const { stdout } = await execFileAsync3(
+  const { stdout } = await execFileAsync2(
     "docker",
     [
       "exec",
@@ -8851,7 +8938,7 @@ async function cloneRepo(containerName, cloneUrl, branch, cacheKey) {
     await gitInContainer(containerName, "clean", "-fd");
     return { fromCache: true };
   }
-  await execFileAsync3(
+  await execFileAsync2(
     "docker",
     [
       "exec",
@@ -8894,6 +8981,7 @@ async function setGitIdentity(containerName, name, email) {
     );
 }
 async function extractDiff(containerName) {
+  await gitInContainer(containerName, "add", "--intent-to-add", ".");
   const diff = await gitInContainer(containerName, "diff", "HEAD");
   const changedFilesRaw = (await gitInContainer(containerName, "diff", "HEAD", "--name-only")).trim();
   return {
@@ -8915,6 +9003,13 @@ async function listRemoteBranches(containerName) {
     return [];
   }
 }
+var NoChangesError = class extends Error {
+  constructor(message = "No changes to commit.") {
+    super(message);
+    this.code = "NO_CHANGES";
+    this.name = "NoChangesError";
+  }
+};
 async function commitAndPush(containerName, branchName, commitMessage, gitConfig) {
   if (gitConfig?.gitName)
     await gitInContainer(
@@ -8930,8 +9025,8 @@ async function commitAndPush(containerName, branchName, commitMessage, gitConfig
       "user.email",
       gitConfig.gitEmail
     );
-  const diff = (await gitInContainer(containerName, "diff", "HEAD")).trim();
-  if (!diff) return;
+  const status = (await gitInContainer(containerName, "status", "--porcelain")).trim();
+  if (!status) throw new NoChangesError();
   let branchExists = false;
   try {
     await gitInContainer(
@@ -8946,7 +9041,7 @@ async function commitAndPush(containerName, branchName, commitMessage, gitConfig
   } catch {
   }
   if (branchExists) {
-    await gitInContainer(containerName, "stash");
+    await gitInContainer(containerName, "stash", "--include-untracked");
     await gitInContainer(containerName, "fetch", "origin", branchName);
     await gitInContainer(
       containerName,
@@ -8962,128 +9057,273 @@ async function commitAndPush(containerName, branchName, commitMessage, gitConfig
   await gitInContainer(containerName, "add", "-A");
   await gitInContainer(containerName, "commit", "-m", commitMessage);
   await gitInContainer(containerName, "push", "origin", branchName);
+  await gitInContainer(containerName, "fetch", "origin", branchName);
+  const remoteSha = (await gitInContainer(containerName, "rev-parse", `origin/${branchName}`)).trim();
+  const localSha = (await gitInContainer(containerName, "rev-parse", "HEAD")).trim();
+  if (remoteSha !== localSha) {
+    throw new Error(
+      `Push verification failed: local HEAD ${localSha.slice(0, 8)} does not match origin/${branchName} ${remoteSha.slice(0, 8)}`
+    );
+  }
+  return { pushedSha: localSha, remoteSha, branch: branchName };
 }
 
-// ../../shared/all/helpers/card-ai/session.ts
-function toSummary(session) {
+// ../../shared/all/helpers/board-agent-core/onedrive-auth.ts
+var DEVICECODE_URL = "https://login.microsoftonline.com/consumers/oauth2/v2.0/devicecode";
+var TOKEN_URL = "https://login.microsoftonline.com/consumers/oauth2/v2.0/token";
+var GRAPH_BASE = "https://graph.microsoft.com/v1.0";
+var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+var ONEDRIVE_SCOPES = "offline_access Files.ReadWrite.AppFolder User.Read";
+async function startDeviceCode(clientId) {
+  const res = await fetch(DEVICECODE_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: clientId, scope: ONEDRIVE_SCOPES })
+  });
+  if (!res.ok) {
+    throw new Error(`OneDrive device-code start failed: ${await res.text()}`);
+  }
+  const data = await res.json();
   return {
-    taskId: session.taskId,
-    postId: session.postId,
-    phase: session.phase,
-    step: session.step,
-    diff: session.diff,
-    changedFiles: session.changedFiles,
-    commitMessage: session.commitMessage,
-    previewUrl: session.previewUrl,
-    reproSteps: session.reproSteps,
-    pendingQuestion: session.pendingQuestion,
-    error: session.error,
-    startedAt: session.startedAt,
-    targetBranch: session.targetBranch,
-    taskTitle: session.taskTitle,
-    todos: session.todos
+    deviceCode: data.device_code,
+    userCode: data.user_code,
+    verificationUri: data.verification_uri,
+    expiresIn: data.expires_in,
+    interval: data.interval
   };
 }
-function createEventSink(send, spaceSlug, notify) {
-  const PHASE_LABELS = {
-    research: "Research started",
-    "awaiting-input": "Input required",
-    implement: "Implementation started",
-    preview: "Preview ready",
-    review: "Review started",
-    complete: "Task complete",
-    error: "Task failed"
-  };
-  const channel = (event) => `board-agent:${spaceSlug}:${event}`;
+async function refreshAccessToken(clientId, refreshToken) {
+  const res = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: clientId,
+      refresh_token: refreshToken,
+      scope: ONEDRIVE_SCOPES
+    })
+  });
+  if (!res.ok) {
+    throw new Error(`OneDrive token refresh failed: ${await res.text()}`);
+  }
+  const tok = await res.json();
   return {
-    emitSessionUpdate(session) {
-      send(channel("session-update"), toSummary(session));
-      const label = PHASE_LABELS[session.phase];
-      if (label && notify) {
-        notify(
-          `Board AI \u2014 ${label}`,
-          `${session.taskTitle || "Card"} (step ${session.step}/3)`,
-          session.phase !== "complete" && session.phase !== "error" && session.phase !== "awaiting-input"
-        );
-      }
-    },
-    emitSessionRemoved(postId) {
-      send(channel("session-update"), {
-        postId,
-        phase: null,
-        step: 1,
-        taskId: "",
-        diff: "",
-        changedFiles: [],
-        commitMessage: "",
-        previewUrl: "",
-        reproSteps: "",
-        pendingQuestion: "",
-        error: "",
-        startedAt: 0,
-        targetBranch: "",
-        taskTitle: "",
-        todos: []
-      });
-    },
-    emitLog(session, entry) {
-      send(channel(`log:${session.postId}`), entry);
-    },
-    addLog(session, type, content) {
-      const entry = { time: Date.now(), type, content };
-      session.logs.push(entry);
-      this.emitLog(session, entry);
-    },
-    appendTextLog(session, text) {
-      const last = session.logs[session.logs.length - 1];
-      if (last && last.type === "text") {
-        last.content += text;
-        this.emitLog(session, {
-          time: last.time,
-          type: "text-append",
-          content: text
-        });
-      } else {
-        const entry = {
-          time: Date.now(),
-          type: "text",
-          content: text
-        };
-        session.logs.push(entry);
-        this.emitLog(session, entry);
-      }
-    },
-    emitSetupStatus(message) {
-      send(channel("setup-status"), message);
+    accessToken: tok.access_token,
+    // Microsoft rotates the refresh token on each refresh; fall back to the old
+    // one if a new one wasn't returned.
+    refreshToken: tok.refresh_token || refreshToken,
+    expiry: new Date(Date.now() + tok.expires_in * 1e3).toISOString()
+  };
+}
+async function pollDeviceCode(clientId, deviceCode) {
+  const res = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: DEVICE_CODE_GRANT,
+      client_id: clientId,
+      device_code: deviceCode
+    })
+  });
+  if (res.ok) {
+    const tok = await res.json();
+    if (!tok.refresh_token) {
+      return { status: "error", message: "No refresh token returned." };
     }
+    const appFolder = await getAppFolder(tok.access_token);
+    return {
+      status: "complete",
+      refreshToken: tok.refresh_token,
+      appFolder
+    };
+  }
+  const err = await res.json().catch(() => ({}));
+  switch (err.error) {
+    case "authorization_pending":
+      return { status: "pending" };
+    case "slow_down":
+      return { status: "slow_down" };
+    case "expired_token":
+    case "code_expired":
+      return { status: "expired" };
+    case "authorization_declined":
+    case "access_denied":
+      return { status: "declined" };
+    default:
+      return {
+        status: "error",
+        message: err.error_description || err.error || "Device-code poll failed"
+      };
+  }
+}
+async function getAppFolder(accessToken) {
+  const res = await fetch(
+    `${GRAPH_BASE}/me/drive/special/approot?$select=id,parentReference`,
+    { headers: { Authorization: `Bearer ${accessToken}` } }
+  );
+  if (!res.ok) {
+    throw new Error(
+      `Failed to resolve OneDrive app folder: ${res.status} - ${await res.text()}`
+    );
+  }
+  const data = await res.json();
+  if (!data.id || !data.parentReference?.driveId) {
+    throw new Error("OneDrive app folder response was incomplete.");
+  }
+  return {
+    rootFolderId: data.id,
+    driveId: data.parentReference.driveId,
+    driveType: data.parentReference.driveType || "personal"
   };
 }
 
-// ../../shared/all/helpers/card-ai/engine.ts
-function buildPrompt(lines, vars = {}) {
-  let text = lines.join("\n");
-  for (const [key, value2] of Object.entries(vars)) {
-    text = text.replaceAll(`{{${key}}}`, value2);
+// ../../shared/all/helpers/board-agent-core/onedrive.ts
+var WORKSPACE = "/home/claude/workspace";
+var RCLONE_CONF = "/home/claude/.config/rclone/rclone.conf";
+var REMOTE = "onedrive";
+var SYNC_LOG = "/tmp/rclone-onedrive.log";
+function onedriveRemotePath(spaceSlug) {
+  const safe = spaceSlug.replace(/[^a-zA-Z0-9._-]/g, "-");
+  return `${REMOTE}:${safe}`;
+}
+async function writeRcloneMountConfig(containerName, conn) {
+  const fresh = await refreshAccessToken(conn.clientId, conn.refreshToken);
+  const tokenJson = JSON.stringify({
+    access_token: fresh.accessToken,
+    refresh_token: fresh.refreshToken,
+    token_type: "Bearer",
+    expiry: fresh.expiry
+  });
+  const conf = [
+    `[${REMOTE}]`,
+    "type = onedrive",
+    `client_id = ${conn.clientId}`,
+    `drive_id = ${conn.driveId}`,
+    `drive_type = ${conn.driveType}`,
+    `root_folder_id = ${conn.rootFolderId}`,
+    // App is consumer-only, so rclone must refresh against /consumers (not the
+    // default /common, which rejects it with AADSTS9002346).
+    "auth_url = https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize",
+    "token_url = https://login.microsoftonline.com/consumers/oauth2/v2.0/token",
+    `token = ${tokenJson}`,
+    ""
+  ].join("\n");
+  const b64 = Buffer.from(conf, "utf-8").toString("base64");
+  await execInContainer(
+    containerName,
+    `mkdir -p /home/claude/.config/rclone && printf %s '${b64}' | base64 -d > ${RCLONE_CONF} && chmod 600 ${RCLONE_CONF}`
+  );
+  return fresh.refreshToken;
+}
+async function mountWorkspace(containerName, remotePath) {
+  await execInContainer(
+    containerName,
+    `mkdir -p ${WORKSPACE} && rclone mkdir '${remotePath}'`
+  );
+  const out = await execInContainer(
+    containerName,
+    `nohup rclone mount '${remotePath}' ${WORKSPACE} --vfs-cache-mode full --vfs-write-back 1s --dir-cache-time 30s -v --rc --rc-addr ${RC_ADDR} --rc-no-auth >> ${SYNC_LOG} 2>&1 & for i in $(seq 1 40); do mountpoint -q ${WORKSPACE} && break; sleep 0.25; done; mountpoint -q ${WORKSPACE} && echo mounted || (tail -n 20 ${SYNC_LOG} 2>/dev/null; echo mount-failed)`
+  );
+  if (!out.trim().endsWith("mounted")) {
+    throw new Error(`OneDrive mount failed:
+${out.trim()}`);
   }
-  return text;
 }
-function sanitizeTaskId(taskId) {
-  const sanitized = String(taskId).replace(/[^a-zA-Z0-9_.-]/g, "");
-  if (!sanitized) throw new Error("Invalid taskId");
-  return sanitized;
+var syncWatchers = /* @__PURE__ */ new Map();
+var RC_ADDR = "127.0.0.1:5572";
+async function onedriveQueueNow(containerName) {
+  const out = await execInContainer(
+    containerName,
+    `rclone rc --url http://${RC_ADDR}/ vfs/queue 2>/dev/null || echo '{}'`
+  );
+  try {
+    const parsed = JSON.parse(out);
+    return (parsed.queue ?? []).map((i) => i.name).filter((n) => !!n);
+  } catch {
+    return [];
+  }
+}
+function startOneDriveSyncWatcher(containerName, onPending) {
+  stopOneDriveSyncWatcher(containerName);
+  let chain = Promise.resolve();
+  const refresh = () => {
+    chain = chain.then(async () => {
+      const watcher = syncWatchers.get(containerName);
+      if (!watcher) return;
+      const files = await onedriveQueueNow(containerName);
+      if (watcher.files.join("\n") !== files.join("\n")) {
+        watcher.files = files;
+        onPending(files.length, files);
+      }
+    });
+  };
+  const handle = streamExecInContainer(
+    containerName,
+    `tail -n0 -F ${SYNC_LOG} 2>/dev/null | grep --line-buffered -E 'vfs cache: (upload|starting|failed|cancel|queuing)'`,
+    refresh
+  );
+  syncWatchers.set(containerName, { handle, files: [] });
+}
+function stopOneDriveSyncWatcher(containerName) {
+  const watcher = syncWatchers.get(containerName);
+  if (watcher) {
+    watcher.handle.stop();
+    syncWatchers.delete(containerName);
+  }
 }
-var BoardAgentEngine = class _BoardAgentEngine {
+function onedrivePendingUploads(containerName) {
+  return syncWatchers.get(containerName)?.files.length ?? 0;
+}
+function onedriveUploadingFiles(containerName) {
+  return syncWatchers.get(containerName)?.files ?? [];
+}
+async function unmountWorkspace(containerName) {
+  await execInContainer(
+    containerName,
+    `fusermount -u ${WORKSPACE} 2>/dev/null || fusermount3 -u ${WORKSPACE} 2>/dev/null || rclone unmount ${WORKSPACE} 2>/dev/null || true`
+  );
+}
+async function readbackRefreshToken(containerName) {
+  let conf = "";
+  try {
+    conf = await execInContainer(
+      containerName,
+      `cat ${RCLONE_CONF} 2>/dev/null || true`
+    );
+  } catch {
+    return null;
+  }
+  const match = conf.match(/token\s*=\s*(\{.*\})/);
+  if (!match) return null;
+  try {
+    const parsed = JSON.parse(match[1]);
+    return parsed.refresh_token ?? null;
+  } catch {
+    return null;
+  }
+}
+
+// ../../shared/all/helpers/board-agent-core/container.ts
+function withTimeout(work, ms, label) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(
+      () => reject(
+        new Error(
+          `${label} timed out. Check Docker and your connection, then Try Again.`
+        )
+      ),
+      ms
+    );
+  });
+  return Promise.race([work.finally(() => clearTimeout(timer)), timeout]);
+}
+var ContainerCore = class {
   constructor(options) {
-    // Utility container state
+    // Utility container state.
     this.containerName = null;
     this.lastConfigKey = "";
     this.setupPromise = null;
-    // Board AI session id + active process
-    this.boardSessionId = null;
-    this.boardProcess = null;
-    // Board AI state
-    this.sessions = /* @__PURE__ */ new Map();
-    this.cardProcesses = /* @__PURE__ */ new Map();
     this.spaceSlug = options.spaceSlug;
     this.emitter = options.emitter;
     this.configProvider = options.configProvider;
@@ -9092,6 +9332,49 @@ var BoardAgentEngine = class _BoardAgentEngine {
     const raw = (options.instanceId || "shared").toLowerCase();
     this.instancePrefix = raw.replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "") || "shared";
   }
+  readConfig() {
+    return this.configProvider.readConfig(this.spaceSlug);
+  }
+  isReady() {
+    return this.containerName !== null;
+  }
+  // ── Storage backend ──
+  isOneDrive(config) {
+    return config.storageBackend === "onedrive";
+  }
+  /** Per-space OneDrive remote path inside the app folder. */
+  remotePath() {
+    return onedriveRemotePath(this.spaceSlug);
+  }
+  isOneDriveConnected() {
+    return this.configProvider.readOneDriveConnection(this.spaceSlug) !== null;
+  }
+  /** The stored OneDrive credential, or fail with a connect hint. */
+  getOneDriveConnection() {
+    const conn = this.configProvider.readOneDriveConnection(this.spaceSlug);
+    if (!conn) {
+      throw new Error(
+        "OneDrive is not connected. Connect it in Board AI settings."
+      );
+    }
+    return conn;
+  }
+  saveOneDriveConnection(connection) {
+    this.configProvider.writeOneDriveConnection(this.spaceSlug, connection);
+  }
+  clearOneDriveConnection() {
+    this.configProvider.writeOneDriveConnection(this.spaceSlug, null);
+  }
+  /** Persist a rotated refresh token onto the existing connection. */
+  updateOneDriveRefreshToken(refreshToken) {
+    const conn = this.configProvider.readOneDriveConnection(this.spaceSlug);
+    if (conn) {
+      this.configProvider.writeOneDriveConnection(this.spaceSlug, {
+        ...conn,
+        refreshToken
+      });
+    }
+  }
   // ── Config ──
   getConfig() {
     const config = this.configProvider.readConfig(this.spaceSlug);
@@ -9103,7 +9386,11 @@ var BoardAgentEngine = class _BoardAgentEngine {
       hasToken: Boolean(config.claudeToken),
       hasGithubToken: Boolean(config.githubToken),
       tokenHint: config.claudeToken ? `\xB7\xB7\xB7\xB7${config.claudeToken.slice(-4)}` : "",
-      githubTokenHint: config.githubToken ? `\xB7\xB7\xB7\xB7${config.githubToken.slice(-4)}` : ""
+      githubTokenHint: config.githubToken ? `\xB7\xB7\xB7\xB7${config.githubToken.slice(-4)}` : "",
+      storageBackend: config.storageBackend ?? "github",
+      onedrive: {
+        connected: this.isOneDriveConnected()
+      }
     };
   }
   setConfig(partial) {
@@ -9114,7 +9401,8 @@ var BoardAgentEngine = class _BoardAgentEngine {
       gitName: partial.gitName ?? existing.gitName,
       gitEmail: partial.gitEmail ?? existing.gitEmail,
       claudeToken: partial.claudeToken?.replace(/\s/g, "") || existing.claudeToken,
-      githubToken: partial.githubToken?.replace(/\s/g, "") || existing.githubToken
+      githubToken: partial.githubToken?.replace(/\s/g, "") || existing.githubToken,
+      storageBackend: partial.storageBackend ?? existing.storageBackend
     };
     this.configProvider.writeConfig(this.spaceSlug, updated);
     return { success: true };
@@ -9129,10 +9417,19 @@ var BoardAgentEngine = class _BoardAgentEngine {
   async ensureContainer(onStatus) {
     const config = this.configProvider.readConfig(this.spaceSlug);
     if (!config.claudeToken) throw new Error("No Claude token configured.");
-    if (!config.githubToken) throw new Error("No GitHub token configured.");
-    if (!config.repoUrl) throw new Error("No repository URL configured.");
-    const configKey = `${config.repoUrl}|${config.claudeToken}|${config.githubToken}`;
-    const cacheKey = repoCacheKey(config.repoUrl);
+    const onedrive = this.isOneDrive(config);
+    if (onedrive) {
+      if (!this.isOneDriveConnected()) {
+        throw new Error(
+          "OneDrive is not connected. Connect it in Board AI settings, then retry."
+        );
+      }
+    } else {
+      if (!config.githubToken) throw new Error("No GitHub token configured.");
+      if (!config.repoUrl) throw new Error("No repository URL configured.");
+    }
+    const configKey = onedrive ? `onedrive|${this.spaceSlug}|${config.claudeToken}` : `${config.repoUrl}|${config.claudeToken}|${config.githubToken}`;
+    const cacheKey = onedrive ? `onedrive-${this.spaceSlug}`.replace(/[^a-zA-Z0-9._-]/g, "_") : repoCacheKey(config.repoUrl);
     const name = `factiii-${this.instancePrefix}-util-${this.spaceSlug}-${cacheKey}`;
     if (this.containerName && this.lastConfigKey !== configKey) {
       await killContainer(this.containerName);
@@ -9154,16 +9451,40 @@ var BoardAgentEngine = class _BoardAgentEngine {
         this.emitter.emitSetupStatus(msg);
       };
       try {
-        status("Building Docker image...");
-        await ensureDockerImage(this.dockerfilePath);
+        status("Step 1/4 \xB7 Checking Docker\u2026");
+        await withTimeout(assertDockerRunning(), 15e3, "Checking Docker");
+        status("Step 2/4 \xB7 Building container image\u2026");
+        await ensureDockerImage(this.dockerfilePath, (line) => status(line));
         await ensureCacheVolume();
         await killContainer(name);
-        status("Starting container...");
-        await spawnContainer(name, config.claudeToken);
-        status("Cloning repository...");
-        const cloneUrl = buildCloneUrl(config.repoUrl, config.githubToken);
-        await cloneRepo(name, cloneUrl, config.mainBranch || "main", cacheKey);
-        await setGitIdentity(name, config.gitName, config.gitEmail);
+        status("Step 3/4 \xB7 Starting container\u2026");
+        await withTimeout(
+          spawnContainer(name, config.claudeToken),
+          9e4,
+          "Starting container"
+        );
+        if (onedrive) {
+          status("Step 4/4 \xB7 Verifying OneDrive\u2026");
+          const rotated = await writeRcloneMountConfig(
+            name,
+            this.getOneDriveConnection()
+          );
+          this.updateOneDriveRefreshToken(rotated);
+          await withTimeout(
+            execInContainer(name, `rclone lsd 'onedrive:'`),
+            6e4,
+            "Verifying OneDrive"
+          );
+        } else {
+          status("Step 4/4 \xB7 Cloning repository\u2026");
+          const cloneUrl = buildCloneUrl(config.repoUrl, config.githubToken);
+          await withTimeout(
+            cloneRepo(name, cloneUrl, config.mainBranch || "main", cacheKey),
+            18e4,
+            "Cloning repository"
+          );
+          await setGitIdentity(name, config.gitName, config.gitEmail);
+        }
         status("");
         this.containerName = name;
         this.lastConfigKey = configKey;
@@ -9175,200 +9496,1534 @@ var BoardAgentEngine = class _BoardAgentEngine {
     })();
     return this.setupPromise;
   }
-  // ── Board AI ──
-  async ask(params, sendLog) {
+  setupStatus() {
+    if (this.containerName) return { phase: "ready" };
+    if (this.setupPromise) return { phase: "running" };
+    return { phase: "idle" };
+  }
+  async ensureSetup() {
+    await this.ensureContainer();
+    return { ready: true };
+  }
+  async cardRemoteBranches() {
+    const config = this.configProvider.readConfig(this.spaceSlug);
+    if (this.isOneDrive(config)) return [];
+    if (!config.githubToken || !config.repoUrl) return [];
     if (!this.isReady()) {
       throw new Error(
         'Environment not initialized. Open Board AI Settings and click "Initialize Environment".'
       );
     }
-    const containerName = this.containerName;
-    let prompt2;
-    if (this.boardSessionId) {
-      prompt2 = params.question;
-    } else {
-      const parts2 = ["Here is the board data:", "", params.boardContext || ""];
-      parts2.push("", params.question);
-      prompt2 = parts2.join("\n");
-    }
-    const systemPrompt = [params.componentSchema, buildPrompt(prompts_default.boardAI)].filter(Boolean).join("\n\n");
-    const { proc, result } = spawnClaude({
-      containerName,
-      prompt: prompt2,
-      allowedTools: "Read,Grep,Glob,Agent",
-      model: "claude-opus-4-6",
-      includePartialMessages: true,
-      appendSystemPrompt: systemPrompt,
-      resumeSessionId: this.boardSessionId || void 0,
-      callbacks: {
-        onLog: (entry) => sendLog(entry)
-      }
-    });
-    this.boardProcess = proc;
-    try {
-      const { text, sessionId } = await result;
-      if (sessionId) this.boardSessionId = sessionId;
-      return text;
-    } finally {
-      this.boardProcess = null;
-    }
-  }
-  resetBoardSession() {
-    if (this.boardProcess) {
-      try {
-        this.boardProcess.kill("SIGTERM");
-      } catch {
-      }
-      this.boardProcess = null;
-    }
-    this.boardSessionId = null;
+    return listRemoteBranches(this.containerName);
   }
-  // ── Board AI: Claude runner ──
-  async runClaudeInContainer(session, prompt2, tools, resumeSessionId, options) {
-    const { proc, result } = spawnClaude({
-      containerName: session.containerName,
-      prompt: prompt2,
-      allowedTools: tools,
-      disallowedTools: options?.disallowedTools,
-      permissionMode: options?.permissionMode,
-      appendSystemPrompt: buildPrompt(prompts_default.system),
-      effort: session.effort,
-      model: "opus",
-      resumeSessionId,
-      callbacks: {
-        onLog: (entry) => {
-          if (entry.type === "text-append") {
-            this.emitter.appendTextLog(session, entry.content);
-          } else {
-            this.emitter.addLog(session, entry.type, entry.content);
-          }
-        },
-        onTodos: (todos) => {
-          session.todos = todos;
-          this.emitter.emitSessionUpdate(session);
-        }
-      }
-    });
-    this.cardProcesses.set(session.postId, proc);
-    try {
-      return await result;
-    } finally {
-      this.cardProcesses.delete(session.postId);
+  destroy() {
+    if (this.containerName) {
+      void killContainer(this.containerName);
+      this.containerName = null;
+      this.setupPromise = null;
     }
   }
-  static {
-    // ── Board AI: Research with Q&A ──
-    this.QUESTION_MARKER = "AWAITING_INPUT";
-  }
-  async runResearch(session, prompt2, resumeSessionId) {
-    if (!this.sessions.has(session.postId)) return;
-    const { text, sessionId } = await this.runClaudeInContainer(
+};
+
+// ../../shared/all/helpers/board-agent-core/runtimes.ts
+async function installRuntimes(emitter, session, attrs) {
+  const clean = attrs.map((a) => a.trim()).filter((a) => a && /^[a-zA-Z0-9._-]+$/.test(a));
+  if (!clean.length) return;
+  emitter.addLog(
+    session,
+    "system",
+    `Installing ${clean.join(", ")} via Nix...`
+  );
+  try {
+    const refs = clean.map((a) => `nixpkgs#${a}`).join(" ");
+    const wrapped = `nix profile install ${refs} 2>&1; echo "__FACTIII_NIX_EXIT__:$?"`;
+    const out = await execInContainer(session.containerName, wrapped);
+    const marker = out.lastIndexOf("__FACTIII_NIX_EXIT__:");
+    const body = (marker >= 0 ? out.slice(0, marker) : out).trimEnd();
+    const code = marker >= 0 ? parseInt(out.slice(marker).split(":")[1], 10) || 0 : 0;
+    if (body) emitter.addLog(session, "text", body);
+    emitter.addLog(
       session,
-      prompt2,
-      "Read,Grep,Glob,Agent,TodoWrite",
-      resumeSessionId,
-      { permissionMode: "plan", disallowedTools: "AskUserQuestion" }
+      code === 0 ? "system" : "error",
+      code === 0 ? "Environment ready." : `Install exited with code ${code}. Continuing \u2014 install by hand from the terminal if needed.`
     );
-    session.claudeSessionId = sessionId;
-    if (!this.sessions.has(session.postId)) return;
-    const markerIdx = text.lastIndexOf(_BoardAgentEngine.QUESTION_MARKER);
-    if (markerIdx === -1) return;
-    session.phase = "awaiting-input";
-    session.pendingQuestion = text.slice(markerIdx + _BoardAgentEngine.QUESTION_MARKER.length).trim();
-    this.emitter.emitSessionUpdate(session);
-    this.emitter.addLog(
+  } catch (err) {
+    emitter.addLog(
       session,
-      "system",
-      "Claude has a question \u2014 waiting for your input."
+      "error",
+      `Install failed: ${err instanceof Error ? err.message : String(err)}`
     );
-    const answer = await new Promise((resolve) => {
-      session.answerResolver = resolve;
-    });
-    if (!this.sessions.has(session.postId)) return;
-    session.phase = "research";
-    session.pendingQuestion = "";
-    session.answerResolver = null;
-    this.emitter.emitSessionUpdate(session);
-    this.emitter.addLog(session, "system", "Resuming research...");
-    return this.runResearch(session, answer, sessionId);
   }
-  // ── Board AI: Pipeline ──
-  async runPipeline(session, prompt2, enablePreview, baseBranch) {
-    if (!this.isReady()) {
-      throw new Error(
-        'Environment not initialized. Open Board AI Settings and click "Initialize Environment".'
+}
+
+// ../../shared/all/helpers/board-agent-core/session.ts
+function toSummary(session) {
+  return {
+    taskId: session.taskId,
+    postId: session.postId,
+    phase: session.phase,
+    mode: session.mode,
+    step: session.step,
+    diff: session.diff,
+    changedFiles: session.changedFiles,
+    commitMessage: session.commitMessage,
+    previewUrl: session.previewUrl,
+    previewRunning: session.previewRunning,
+    reproSteps: session.reproSteps,
+    pendingQuestion: session.pendingQuestion,
+    error: session.error,
+    startedAt: session.startedAt,
+    targetBranch: session.targetBranch,
+    taskTitle: session.taskTitle,
+    todos: session.todos
+  };
+}
+function createEventSink(send, spaceSlug, notify) {
+  const PHASE_LABELS = {
+    research: "Research started",
+    "awaiting-input": "Input required",
+    implement: "Implementation started",
+    review: "Review started",
+    complete: "Task complete",
+    error: "Task failed"
+  };
+  const channel = (event) => `board-agent:${spaceSlug}:${event}`;
+  return {
+    emitSessionUpdate(session) {
+      send(channel("session-update"), toSummary(session));
+      const label = PHASE_LABELS[session.phase];
+      if (label && notify) {
+        notify(
+          `Board AI - ${label}`,
+          `${session.taskTitle || "Card"} (step ${session.step}/3)`,
+          session.phase !== "complete" && session.phase !== "error" && session.phase !== "awaiting-input"
+        );
+      }
+    },
+    emitSessionRemoved(postId) {
+      send(channel("session-update"), {
+        postId,
+        phase: null,
+        mode: "claude",
+        step: 1,
+        taskId: "",
+        diff: "",
+        changedFiles: [],
+        commitMessage: "",
+        previewUrl: "",
+        previewRunning: false,
+        reproSteps: "",
+        pendingQuestion: "",
+        error: "",
+        startedAt: 0,
+        targetBranch: "",
+        taskTitle: "",
+        todos: []
+      });
+    },
+    emitLog(session, entry) {
+      send(channel(`log:${session.postId}`), entry);
+    },
+    addLog(session, type, content) {
+      const entry = { time: Date.now(), type, content };
+      session.logs.push(entry);
+      this.emitLog(session, entry);
+    },
+    appendTextLog(session, text) {
+      const last = session.logs[session.logs.length - 1];
+      if (last && last.type === "text") {
+        last.content += text;
+        this.emitLog(session, {
+          time: last.time,
+          type: "text-append",
+          content: text
+        });
+      } else {
+        const entry = {
+          time: Date.now(),
+          type: "text",
+          content: text
+        };
+        session.logs.push(entry);
+        this.emitLog(session, entry);
+      }
+    },
+    emitSetupStatus(message) {
+      send(channel("setup-status"), message);
+    },
+    emitOneDriveAuth(payload) {
+      send(channel("onedrive-auth"), payload);
+    },
+    emitOneDriveSync(payload) {
+      send(channel("onedrive-sync"), payload);
+    }
+  };
+}
+
+// ../../shared/all/helpers/card-ai/frpc.ts
+var import_child_process5 = require("child_process");
+var import_fs2 = require("fs");
+var import_path2 = __toESM(require("path"));
+var import_util3 = require("util");
+
+// ../../shared/all/helpers/card-ai/scripts.ts
+var FRPC_EXPOSE_SCRIPT = `#!/bin/sh
+set -e
+set -a; . /etc/environment.factiii 2>/dev/null || true; set +a
+PORT="$1"
+NAME="$2"
+if [ -z "$PORT" ] || [ -z "$NAME" ]; then
+  echo "usage: factiii-expose <port> <name>" >&2
+  echo "  e.g. factiii-expose 3000 app" >&2
+  exit 1
+fi
+case "$NAME" in *[!a-zA-Z0-9-]*|"") echo "name must be [a-zA-Z0-9-]" >&2; exit 1 ;; esac
+PROXY="\${FACTIII_TASK_ID}-\${NAME}"
+DOMAIN="\${PROXY}.\${FACTIII_FRP_DOMAIN}"
+TOML="/tmp/frpc-\${NAME}.toml"
+cat > "$TOML" <<EOF
+serverAddr = "\${FACTIII_FRP_SERVER}"
+serverPort = \${FACTIII_FRP_PORT}
+transport.protocol = "tcp"
+
+[metadatas]
+factiii_token = "\${FACTIII_FRP_TOKEN}"
+
+[[proxies]]
+name = "\${PROXY}"
+type = "http"
+localPort = \${PORT}
+subdomain = "\${PROXY}"
+EOF
+setsid frpc -c "$TOML" >/tmp/frpc-\${NAME}.log 2>&1 < /dev/null &
+echo $! > /tmp/frpc-\${NAME}.pid
+echo "http://\${DOMAIN}"
+`;
+var FRPC_UNEXPOSE_SCRIPT = `#!/bin/sh
+NAME="$1"
+if [ -z "$NAME" ]; then
+  echo "usage: factiii-unexpose <name>" >&2
+  exit 1
+fi
+PID_FILE="/tmp/frpc-\${NAME}.pid"
+if [ -f "$PID_FILE" ]; then
+  kill "$(cat "$PID_FILE")" 2>/dev/null || true
+  rm -f "$PID_FILE" "/tmp/frpc-\${NAME}.toml" "/tmp/frpc-\${NAME}.log"
+  echo "stopped \${NAME}"
+else
+  echo "no tunnel named \${NAME}" >&2
+  exit 1
+fi
+`;
+
+// ../../shared/all/helpers/card-ai/frpc.ts
+var execFileAsync3 = (0, import_util3.promisify)(import_child_process5.execFile);
+var FRP_SERVER_ADDR = "dev.factiii.com";
+var FRP_SERVER_PORT = 7443;
+var FRP_DOMAIN_SUFFIX = "dev.factiii.com";
+async function writeFileAsRoot(containerName, path7, contents) {
+  const b64 = Buffer.from(contents, "utf-8").toString("base64");
+  await execInContainerAsRoot(
+    containerName,
+    `echo '${b64}' | base64 -d > '${path7}'`
+  );
+}
+async function installFrpcBinary(containerName) {
+  const arch = (await execInContainer(containerName, "uname -m")).trim();
+  const map = {
+    x86_64: "frpc-linux-amd64",
+    aarch64: "frpc-linux-arm64"
+  };
+  const binaryName = map[arch];
+  if (!binaryName) {
+    throw new Error(`Unsupported container arch for frpc: ${arch}`);
+  }
+  const src = import_path2.default.join(__dirname, "..", "vendor", binaryName);
+  if (!(0, import_fs2.existsSync)(src)) {
+    throw new Error(
+      `Vendored frpc missing (${src}). Run apps/runner/scripts/fetch-frpc.sh.`
+    );
+  }
+  await execFileAsync3("docker", [
+    "cp",
+    src,
+    `${containerName}:/usr/local/bin/frpc`
+  ]);
+  await execInContainerAsRoot(containerName, "chmod +x /usr/local/bin/frpc");
+}
+async function installFrpcHarness(params) {
+  const { containerName, taskId, runnerToken } = params;
+  await installFrpcBinary(containerName);
+  const envLines = [
+    `FACTIII_FRP_SERVER=${FRP_SERVER_ADDR}`,
+    `FACTIII_FRP_PORT=${FRP_SERVER_PORT}`,
+    `FACTIII_FRP_TOKEN=${runnerToken}`,
+    `FACTIII_FRP_DOMAIN=${FRP_DOMAIN_SUFFIX}`,
+    `FACTIII_TASK_ID=${taskId}`
+  ];
+  await writeFileAsRoot(
+    containerName,
+    "/usr/local/bin/factiii-expose",
+    FRPC_EXPOSE_SCRIPT
+  );
+  await writeFileAsRoot(
+    containerName,
+    "/usr/local/bin/factiii-unexpose",
+    FRPC_UNEXPOSE_SCRIPT
+  );
+  await execInContainerAsRoot(
+    containerName,
+    "chmod +x /usr/local/bin/factiii-expose /usr/local/bin/factiii-unexpose"
+  );
+  await writeFileAsRoot(
+    containerName,
+    "/etc/environment.factiii",
+    envLines.join("\n") + "\n"
+  );
+  await execInContainerAsRoot(
+    containerName,
+    `grep -q 'environment.factiii' /home/claude/.profile 2>/dev/null || echo 'set -a; . /etc/environment.factiii; set +a' >> /home/claude/.profile && chown claude:claude /home/claude/.profile`
+  );
+}
+
+// ../../shared/all/helpers/card-ai/claude-mode.ts
+function buildPrompt(lines, vars = {}) {
+  let text = lines.join("\n");
+  for (const [key, value2] of Object.entries(vars)) {
+    text = text.replaceAll(`{{${key}}}`, value2);
+  }
+  return text;
+}
+var ONEDRIVE_PROMPT_SWAPS = [
+  [
+    "- Full clone with complete git history available.",
+    "- Your file changes are saved automatically when the task finishes."
+  ],
+  [
+    "1. Review the diff of your changes (git diff HEAD)",
+    "1. Review the changes you made"
+  ]
+];
+function gitFree(text) {
+  let out = text;
+  for (const [from, to] of ONEDRIVE_PROMPT_SWAPS) out = out.replace(from, to);
+  return out;
+}
+var ClaudeModeEngine = class _ClaudeModeEngine {
+  constructor(core, emitter) {
+    this.core = core;
+    this.emitter = emitter;
+    this.sessions = /* @__PURE__ */ new Map();
+    this.board = { sessionId: null, process: null, messages: [] };
+  }
+  static {
+    this.QUESTION_MARKER = "AWAITING_INPUT";
+  }
+  static {
+    this.FULL_TOOLS = "Read,Grep,Glob,Agent,Edit,Write,Bash,TodoWrite";
+  }
+  // ── Board AI ("Ask AI") ──
+  async ask(params, sendLog) {
+    if (!this.core.isReady()) {
+      throw new Error(
+        'Environment not initialized. Open Board AI Settings and click "Initialize Environment".'
+      );
+    }
+    const containerName = this.core.containerName;
+    await execInContainer(containerName, "mkdir -p /home/claude/workspace");
+    this.board.messages.push({ role: "user", content: params.question });
+    let prompt2;
+    if (this.board.sessionId) {
+      prompt2 = params.question;
+    } else {
+      const parts2 = ["Here is the board data:", "", params.boardContext || ""];
+      parts2.push("", params.question);
+      prompt2 = parts2.join("\n");
+    }
+    const systemPrompt = [params.componentSchema, buildPrompt(prompts_default.boardAI)].filter(Boolean).join("\n\n");
+    const { proc, result } = spawnClaude({
+      containerName,
+      prompt: prompt2,
+      allowedTools: "Read,Grep,Glob,Agent",
+      model: "claude-opus-4-6",
+      includePartialMessages: true,
+      appendSystemPrompt: systemPrompt,
+      resumeSessionId: this.board.sessionId || void 0,
+      callbacks: {
+        onLog: (entry) => sendLog(entry)
+      }
+    });
+    this.board.process = proc;
+    try {
+      const { text, sessionId } = await result;
+      if (sessionId) this.board.sessionId = sessionId;
+      this.board.messages.push({ role: "assistant", content: text });
+      return text;
+    } finally {
+      this.board.process = null;
+    }
+  }
+  /** The persisted Ask AI conversation, for the client to hydrate on open. */
+  boardSession() {
+    return { messages: this.board.messages.slice() };
+  }
+  resetBoardSession() {
+    if (this.board.process) {
+      try {
+        this.board.process.kill("SIGTERM");
+      } catch {
+      }
+    }
+    this.board = { sessionId: null, process: null, messages: [] };
+  }
+  // ── Claude runner ──
+  /** Strip git mentions from an agent prompt on OneDrive spaces; pass-through otherwise. */
+  agentPrompt(text) {
+    return this.core.isOneDrive(this.core.readConfig()) ? gitFree(text) : text;
+  }
+  async runClaudeInContainer(session, prompt2, tools, resumeSessionId, options) {
+    const { proc, result } = spawnClaude({
+      containerName: session.containerName,
+      prompt: prompt2,
+      allowedTools: tools,
+      disallowedTools: options?.disallowedTools,
+      permissionMode: options?.permissionMode,
+      appendSystemPrompt: this.agentPrompt(buildPrompt(prompts_default.system)),
+      effort: session.effort,
+      model: "opus",
+      resumeSessionId,
+      callbacks: {
+        onLog: (entry) => {
+          if (entry.type === "text-append") {
+            this.emitter.appendTextLog(session, entry.content);
+          } else {
+            this.emitter.addLog(session, entry.type, entry.content);
+          }
+        },
+        onTodos: (todos) => {
+          session.todos = todos;
+          this.emitter.emitSessionUpdate(session);
+        }
+      }
+    });
+    session.proc = proc;
+    try {
+      return await result;
+    } finally {
+      session.proc = null;
+    }
+  }
+  // ── Research with Q&A ──
+  async runResearch(session, prompt2, resumeSessionId) {
+    if (!this.sessions.has(session.postId)) return;
+    const { text, sessionId } = await this.runClaudeInContainer(
+      session,
+      prompt2,
+      "Read,Grep,Glob,Agent,TodoWrite",
+      resumeSessionId,
+      { permissionMode: "plan", disallowedTools: "AskUserQuestion" }
+    );
+    session.claudeSessionId = sessionId;
+    if (!this.sessions.has(session.postId)) return;
+    const markerIdx = text.lastIndexOf(_ClaudeModeEngine.QUESTION_MARKER);
+    if (markerIdx === -1) return;
+    session.phase = "awaiting-input";
+    session.pendingQuestion = text.slice(markerIdx + _ClaudeModeEngine.QUESTION_MARKER.length).trim();
+    this.emitter.emitSessionUpdate(session);
+    this.emitter.addLog(
+      session,
+      "system",
+      "Claude has a question - waiting for your input."
+    );
+    const answer = await new Promise((resolve) => {
+      session.answerResolver = resolve;
+    });
+    if (!this.sessions.has(session.postId)) return;
+    session.phase = "research";
+    session.pendingQuestion = "";
+    session.answerResolver = null;
+    this.emitter.emitSessionUpdate(session);
+    this.emitter.addLog(session, "system", "Resuming research...");
+    return this.runResearch(session, answer, sessionId);
+  }
+  // ── Pipeline ──
+  async runPipeline(session, prompt2, baseBranch, runtimes) {
+    if (!this.core.isReady()) {
+      throw new Error(
+        'Environment not initialized. Open Board AI Settings and click "Initialize Environment".'
+      );
+    }
+    const config = this.core.readConfig();
+    this.emitter.addLog(session, "system", "Starting container...");
+    const onedrive = this.core.isOneDrive(config);
+    await killContainer(session.containerName);
+    await spawnContainer(session.containerName, config.claudeToken, {
+      fuse: onedrive
+    });
+    if (onedrive) {
+      const rotated = await writeRcloneMountConfig(
+        session.containerName,
+        this.core.getOneDriveConnection()
+      );
+      this.core.updateOneDriveRefreshToken(rotated);
+      await mountWorkspace(session.containerName, this.core.remotePath());
+      startOneDriveSyncWatcher(
+        session.containerName,
+        (pending, files) => this.emitter.emitOneDriveSync({
+          postId: session.postId,
+          pending,
+          files
+        })
+      );
+      this.emitter.addLog(session, "system", "OneDrive folder mounted.");
+    } else {
+      const cloneUrl = buildCloneUrl(config.repoUrl, config.githubToken);
+      const branch = baseBranch || config.mainBranch || "main";
+      const cacheKey = repoCacheKey(config.repoUrl);
+      const { fromCache } = await cloneRepo(
+        session.containerName,
+        cloneUrl,
+        branch,
+        cacheKey
+      );
+      this.emitter.addLog(
+        session,
+        "system",
+        fromCache ? "Repository updated from cache." : "Repository cloned."
+      );
+      await setGitIdentity(
+        session.containerName,
+        config.gitName,
+        config.gitEmail
+      );
+    }
+    await installRuntimes(this.emitter, session, runtimes);
+    this.emitter.addLog(session, "system", "Container ready.");
+    session.phase = "research";
+    session.step = 1;
+    this.emitter.emitSessionUpdate(session);
+    this.emitter.addLog(session, "system", "\u2500\u2500 Step 1: Research \u2500\u2500");
+    await this.runResearch(
+      session,
+      buildPrompt(prompts_default.research, { task: prompt2 })
+    );
+    if (!this.sessions.has(session.postId)) return;
+    await this.runImplementation(
+      session,
+      buildPrompt(prompts_default.implement),
+      "\u2500\u2500 Step"
+    );
+  }
+  async runImplementation(session, implementPrompt, logPrefix) {
+    const tools = _ClaudeModeEngine.FULL_TOOLS;
+    session.phase = "implement";
+    session.step = 2;
+    this.emitter.emitSessionUpdate(session);
+    this.emitter.addLog(session, "system", `${logPrefix} 2: Implement \u2500\u2500`);
+    const implResult = await this.runClaudeInContainer(
+      session,
+      implementPrompt,
+      tools,
+      session.claudeSessionId
+    );
+    session.claudeSessionId = implResult.sessionId || session.claudeSessionId;
+    if (!this.sessions.has(session.postId)) return;
+    session.phase = "review";
+    session.step = 3;
+    this.emitter.emitSessionUpdate(session);
+    this.emitter.addLog(session, "system", `${logPrefix} 3: Review \u2500\u2500`);
+    const reviewResult = await this.runClaudeInContainer(
+      session,
+      this.agentPrompt(buildPrompt(prompts_default.review)),
+      tools,
+      session.claudeSessionId
+    );
+    session.claudeSessionId = reviewResult.sessionId || session.claudeSessionId;
+    if (!this.sessions.has(session.postId)) return;
+    session.reproSteps = reviewResult.text.trim();
+    await this.extractAndComplete(session);
+  }
+  // On-demand dev-server preview: reuses the live container + Claude session,
+  // maps the port (or a public frpc tunnel), stores the URL. Stays in `complete`.
+  async runPreview(session) {
+    const tools = _ClaudeModeEngine.FULL_TOOLS;
+    session.previewRunning = true;
+    this.emitter.addLog(session, "system", "Setting up live preview...");
+    this.emitter.emitSessionUpdate(session);
+    const portsEnv = (await execInContainer(session.containerName, "echo -n $FACTIII_PORTS")).trim();
+    const publicPreviewEnabled = !!this.core.runnerToken;
+    if (publicPreviewEnabled && this.core.runnerToken) {
+      await installFrpcHarness({
+        containerName: session.containerName,
+        taskId: session.taskId,
+        runnerToken: this.core.runnerToken
+      });
+    }
+    const previewResult = await this.runClaudeInContainer(
+      session,
+      buildPrompt(prompts_default.preview, {
+        ports: portsEnv,
+        publicPreviewBlock: publicPreviewEnabled ? prompts_default.previewPublic.join("\n") : ""
+      }),
+      tools,
+      session.claudeSessionId
+    );
+    session.claudeSessionId = previewResult.sessionId || session.claudeSessionId;
+    if (!this.sessions.has(session.postId)) return;
+    const portMatch = previewResult.text.match(/PREVIEW_PORT:\s*(\d+)/);
+    const previewPort = portMatch ? portMatch[1] : "3000";
+    const urlMatch = previewResult.text.match(/PREVIEW_URL:\s*(\S+)/);
+    if (publicPreviewEnabled && urlMatch) {
+      session.previewUrl = urlMatch[1];
+      this.emitter.addLog(
+        session,
+        "system",
+        `Public preview available at ${session.previewUrl}`
+      );
+    } else {
+      const previewUrl = await getContainerPort(
+        session.containerName,
+        previewPort
+      );
+      if (previewUrl) {
+        session.previewUrl = previewUrl;
+        this.emitter.addLog(
+          session,
+          "system",
+          `Preview available at ${session.previewUrl}`
+        );
+      } else {
+        this.emitter.addLog(
+          session,
+          "system",
+          "Could not map preview port. Server may not be running."
+        );
+      }
+    }
+    this.emitter.emitSessionUpdate(session);
+  }
+  async extractAndComplete(session) {
+    const config = this.core.readConfig();
+    if (this.core.isOneDrive(config)) {
+      session.diff = "";
+      session.changedFiles = [];
+      session.commitMessage = "";
+      session.phase = "complete";
+      this.emitter.emitSessionUpdate(session);
+      return;
+    }
+    this.emitter.addLog(session, "system", "Extracting changes...");
+    const { diff, changedFiles } = await extractDiff(session.containerName);
+    session.diff = diff;
+    session.changedFiles = changedFiles;
+    if (changedFiles.length > 0) {
+      this.emitter.addLog(
+        session,
+        "system",
+        `${changedFiles.length} file${changedFiles.length !== 1 ? "s" : ""} changed.`
+      );
+      this.emitter.addLog(session, "system", "Generating commit message...");
+      session.commitMessage = await generateCommitMessage(
+        session.containerName,
+        diff
+      );
+    } else {
+      this.emitter.addLog(session, "system", "No files changed.");
+    }
+    session.phase = "complete";
+    this.emitter.emitSessionUpdate(session);
+  }
+  // ── Lifecycle / ModeEngine ──
+  start(base, args) {
+    const session = {
+      ...base,
+      claudeSessionId: "",
+      answerResolver: null,
+      proc: null
+    };
+    this.sessions.set(session.postId, session);
+    this.emitter.emitSessionUpdate(session);
+    const onError = (err) => {
+      if (!this.sessions.has(session.postId)) return;
+      session.phase = "error";
+      session.error = err instanceof Error ? err.message : String(err);
+      this.emitter.addLog(session, "error", session.error);
+      this.emitter.emitSessionUpdate(session);
+    };
+    this.runPipeline(
+      session,
+      args.prompt,
+      args.baseBranch,
+      args.runtimes
+    ).catch(onError);
+  }
+  // Triggered from the review (complete) phase; returns the live preview URL.
+  async cardStartPreview({
+    postId: rawPostId
+  }) {
+    const postId = String(rawPostId);
+    const session = this.sessions.get(postId);
+    if (!session) throw new Error("No active session for this card.");
+    if (session.phase !== "complete")
+      throw new Error("Preview is only available once changes are ready.");
+    if (!session.claudeSessionId)
+      throw new Error("No Claude session to resume for preview.");
+    if (session.previewRunning || session.proc)
+      return { previewUrl: session.previewUrl };
+    try {
+      await this.runPreview(session);
+    } finally {
+      session.previewRunning = false;
+      if (this.sessions.has(postId)) this.emitter.emitSessionUpdate(session);
+    }
+    return { previewUrl: session.previewUrl };
+  }
+  cardAnswerQuestion({
+    postId: rawPostId,
+    answer
+  }) {
+    const postId = String(rawPostId);
+    const session = this.sessions.get(postId);
+    if (!session || session.phase !== "awaiting-input" || !session.answerResolver)
+      return;
+    session.answerResolver(answer);
+  }
+  cardFeedback({
+    postId: rawPostId,
+    feedback
+  }) {
+    const postId = String(rawPostId);
+    const session = this.sessions.get(postId);
+    if (!session || session.phase !== "complete") return;
+    if (!session.claudeSessionId) return;
+    session.diff = "";
+    session.changedFiles = [];
+    session.commitMessage = "";
+    session.reproSteps = "";
+    const prompt2 = `The user reviewed your changes and has the following feedback:
+
+${feedback}
+
+${buildPrompt(prompts_default.implement)}`;
+    this.runImplementation(session, prompt2, "\u2500\u2500 Follow-up").catch((err) => {
+      if (!this.sessions.has(postId)) return;
+      session.phase = "error";
+      session.error = err instanceof Error ? err.message : String(err);
+      this.emitter.addLog(session, "error", session.error);
+      this.emitter.emitSessionUpdate(session);
+    });
+  }
+  listSummaries() {
+    const result = {};
+    for (const [postId, session] of this.sessions) {
+      result[postId] = toSummary(session);
+    }
+    return result;
+  }
+  get(postId) {
+    return this.sessions.get(postId);
+  }
+  sessionWithLogs(postId) {
+    const session = this.sessions.get(postId);
+    if (!session) return null;
+    return { ...toSummary(session), logs: session.logs };
+  }
+  has(postId) {
+    return this.sessions.has(postId);
+  }
+  isRunning(postId) {
+    const s = this.sessions.get(postId);
+    return !!s && (s.phase === "starting" || s.phase === "research" || s.phase === "implement");
+  }
+  remove(postId) {
+    this.sessions.delete(postId);
+  }
+  async kill(postId) {
+    let session = this.sessions.get(postId);
+    if (!session) {
+      for (const [, s] of this.sessions) {
+        if (s.taskId === postId) {
+          session = s;
+          break;
+        }
+      }
+    }
+    if (!session) return;
+    if (session.answerResolver) {
+      session.answerResolver("");
+      session.answerResolver = null;
+    }
+    if (session.proc) {
+      try {
+        session.proc.kill("SIGTERM");
+      } catch {
+      }
+      session.proc = null;
+    }
+    await killContainer(session.containerName);
+    const removedPostId = session.postId;
+    this.sessions.delete(removedPostId);
+    this.emitter.emitSessionRemoved(removedPostId);
+  }
+  destroy() {
+    this.resetBoardSession();
+    for (const [, session] of this.sessions) {
+      if (session.proc) {
+        try {
+          session.proc.kill("SIGTERM");
+        } catch {
+        }
+      }
+      void killContainer(session.containerName);
+    }
+    this.sessions.clear();
+  }
+};
+
+// ../../shared/all/helpers/terminal-ai/terminal-mode.ts
+var BARE_REPO_ROOT = "/home/claude/workspace";
+function posixNormalize(p) {
+  const parts2 = p.split("/").filter(Boolean);
+  const stack = [];
+  for (const part of parts2) {
+    if (part === ".") continue;
+    if (part === "..") {
+      if (stack.length) stack.pop();
+      continue;
+    }
+    stack.push(part);
+  }
+  return "/" + stack.join("/");
+}
+function posixDirname(p) {
+  const i = p.lastIndexOf("/");
+  if (i <= 0) return "/";
+  return p.slice(0, i);
+}
+function shEscape(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+var TerminalModeEngine = class {
+  constructor(core, emitter) {
+    this.core = core;
+    this.emitter = emitter;
+    this.sessions = /* @__PURE__ */ new Map();
+  }
+  // ── Lifecycle / ModeEngine ──
+  start(base, args) {
+    const session = {
+      ...base,
+      openedFiles: [],
+      buffers: {},
+      exposed: []
+    };
+    this.sessions.set(session.postId, session);
+    this.emitter.emitSessionUpdate(session);
+    const onError = (err) => {
+      if (!this.sessions.has(session.postId)) return;
+      session.phase = "error";
+      session.error = err instanceof Error ? err.message : String(err);
+      this.emitter.addLog(session, "error", session.error);
+      this.emitter.emitSessionUpdate(session);
+    };
+    this.runBareSession(session, args.baseBranch, args.runtimes ?? []).catch(
+      onError
+    );
+  }
+  listSummaries() {
+    const result = {};
+    for (const [postId, session] of this.sessions) {
+      result[postId] = toSummary(session);
+    }
+    return result;
+  }
+  get(postId) {
+    return this.sessions.get(postId);
+  }
+  sessionWithLogs(postId) {
+    const session = this.sessions.get(postId);
+    if (!session) return null;
+    return { ...toSummary(session), logs: session.logs };
+  }
+  has(postId) {
+    return this.sessions.has(postId);
+  }
+  isRunning(postId) {
+    const s = this.sessions.get(postId);
+    return !!s && (s.phase === "starting" || s.phase === "bare-active");
+  }
+  remove(postId) {
+    this.sessions.delete(postId);
+  }
+  async kill(postId) {
+    let session = this.sessions.get(postId);
+    if (!session) {
+      for (const [, s] of this.sessions) {
+        if (s.taskId === postId) {
+          session = s;
+          break;
+        }
+      }
+    }
+    if (!session) return;
+    await killContainer(session.containerName);
+    const removedPostId = session.postId;
+    this.sessions.delete(removedPostId);
+    this.emitter.emitSessionRemoved(removedPostId);
+  }
+  destroy() {
+    for (const [, session] of this.sessions) {
+      void killContainer(session.containerName);
+    }
+    this.sessions.clear();
+  }
+  /** Active container for a card, or null when none / terminated. */
+  getCardContainerName(postId) {
+    const session = this.sessions.get(String(postId));
+    if (!session) return null;
+    if (session.phase === "error" || session.phase === "done") return null;
+    return session.containerName;
+  }
+  // ── container + Claude CLI, user drives ──
+  async runBareSession(session, baseBranch, runtimes) {
+    if (!this.core.isReady()) {
+      throw new Error(
+        'Environment not initialized. Open Board AI Settings and click "Initialize Environment".'
+      );
+    }
+    const config = this.core.readConfig();
+    this.emitter.addLog(session, "system", "Starting container...");
+    const onedrive = this.core.isOneDrive(config);
+    await killContainer(session.containerName);
+    await spawnContainer(session.containerName, void 0, { fuse: onedrive });
+    if (onedrive) {
+      const rotated = await writeRcloneMountConfig(
+        session.containerName,
+        this.core.getOneDriveConnection()
       );
+      this.core.updateOneDriveRefreshToken(rotated);
+      await mountWorkspace(session.containerName, this.core.remotePath());
+      startOneDriveSyncWatcher(
+        session.containerName,
+        (pending, files) => this.emitter.emitOneDriveSync({
+          postId: session.postId,
+          pending,
+          files
+        })
+      );
+      this.emitter.addLog(session, "system", "OneDrive folder mounted.");
+    } else {
+      const cloneUrl = buildCloneUrl(config.repoUrl, config.githubToken);
+      const branch = baseBranch || config.mainBranch || "main";
+      const cacheKey = repoCacheKey(config.repoUrl);
+      const { fromCache } = await cloneRepo(
+        session.containerName,
+        cloneUrl,
+        branch,
+        cacheKey
+      );
+      this.emitter.addLog(
+        session,
+        "system",
+        fromCache ? "Repository updated from cache." : "Repository cloned."
+      );
+      await setGitIdentity(
+        session.containerName,
+        config.gitName,
+        config.gitEmail
+      );
+    }
+    if (this.core.runnerToken) {
+      try {
+        await installFrpcHarness({
+          containerName: session.containerName,
+          taskId: session.taskId,
+          runnerToken: this.core.runnerToken
+        });
+      } catch (err) {
+        this.emitter.addLog(
+          session,
+          "system",
+          `Port forwarding unavailable: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+    await installRuntimes(this.emitter, session, runtimes);
+    session.phase = "bare-active";
+    this.emitter.emitSessionUpdate(session);
+    this.emitter.addLog(
+      session,
+      "system",
+      "Container ready. Drive it from the terminal."
+    );
+  }
+  // ── file ops ──
+  getBareContainer(postId) {
+    const session = this.sessions.get(String(postId));
+    if (!session) throw new Error("No active session for this card.");
+    if (session.mode !== "bare") {
+      throw new Error("File ops are only available in Bare mode.");
+    }
+    if (session.phase !== "bare-active" && session.phase !== "bare-review") {
+      throw new Error("Container is not ready.");
+    }
+    return session.containerName;
+  }
+  /**
+   * Resolve a repo-relative path to an absolute container path, rejecting
+   * anything that escapes the repo root.
+   */
+  resolveBarePath(rel) {
+    const normalized = posixNormalize("/" + (rel || "").replace(/^\/+/, ""));
+    const abs = `${BARE_REPO_ROOT}${normalized === "/" ? "" : normalized}`;
+    if (abs !== BARE_REPO_ROOT && !abs.startsWith(BARE_REPO_ROOT + "/")) {
+      throw new Error("Path escapes repo root.");
+    }
+    return abs;
+  }
+  async bareFsList({
+    postId,
+    path: path7
+  }) {
+    const container = this.getBareContainer(postId);
+    const abs = this.resolveBarePath(path7);
+    const relRoot = abs.slice(BARE_REPO_ROOT.length) || "/";
+    const out = await execInContainer(
+      container,
+      `cd ${shEscape(abs)} && for f in .* *; do
+        case "$f" in
+          "."|".."|".git"|"*") continue ;;
+        esac
+        [ -e "$f" ] || continue
+        if [ -d "$f" ]; then echo "d/$f"; else echo "f/$f"; fi
+      done | LC_ALL=C sort`
+    );
+    const entries = [];
+    for (const line of out.split("\n")) {
+      if (!line) continue;
+      const sep = line.indexOf("/");
+      if (sep < 0) continue;
+      const ty = line.slice(0, sep);
+      const name = line.slice(sep + 1);
+      const type = ty === "d" ? "dir" : "file";
+      entries.push({
+        name,
+        path: relRoot === "/" ? `/${name}` : `${relRoot}/${name}`,
+        type
+      });
+    }
+    entries.sort((a, b) => {
+      if (a.type !== b.type) return a.type === "dir" ? -1 : 1;
+      return a.name.localeCompare(b.name);
+    });
+    return entries;
+  }
+  async bareFsSearch({
+    postId
+  }) {
+    const container = this.getBareContainer(postId);
+    const root = BARE_REPO_ROOT;
+    const out = await execInContainer(
+      container,
+      `cd ${shEscape(root)} && (git ls-files --cached --others --exclude-standard 2>/dev/null || find . -type f -not -path './.git/*' | sed 's|^\\./||') | head -n 5000`
+    );
+    const files = [];
+    for (const line of out.split("\n")) {
+      const p = line.trim();
+      if (p) files.push("/" + p);
+    }
+    return files;
+  }
+  async bareFsRead({
+    postId,
+    path: path7
+  }) {
+    const container = this.getBareContainer(postId);
+    const abs = this.resolveBarePath(path7);
+    const b64 = (await execInContainer(container, `base64 -w 0 ${shEscape(abs)}`)).trim();
+    return { content: b64, encoding: "base64" };
+  }
+  async bareFsWrite({
+    postId,
+    path: path7,
+    content,
+    encoding
+  }) {
+    const container = this.getBareContainer(postId);
+    const abs = this.resolveBarePath(path7);
+    const b64 = encoding === "base64" ? content : Buffer.from(content, "utf-8").toString("base64");
+    if (!/^[A-Za-z0-9+/=\n\r]*$/.test(b64)) {
+      throw new Error("Invalid base64 payload.");
+    }
+    await execInContainer(
+      container,
+      `mkdir -p ${shEscape(posixDirname(abs))} && printf %s ${shEscape(b64)} | base64 -d > ${shEscape(abs)}`
+    );
+    const session = this.sessions.get(String(postId));
+    if (session) delete session.buffers[path7];
+  }
+  bareEditorState({
+    postId: rawPostId
+  }) {
+    const postId = String(rawPostId);
+    const session = this.sessions.get(postId);
+    if (!session || session.mode !== "bare") {
+      return { openedFiles: [], buffers: {} };
+    }
+    return {
+      openedFiles: session.openedFiles.slice(),
+      buffers: { ...session.buffers }
+    };
+  }
+  bareOpenFile({
+    postId: rawPostId,
+    path: path7
+  }) {
+    const session = this.sessions.get(String(rawPostId));
+    if (!session || session.mode !== "bare") return;
+    if (!session.openedFiles.includes(path7)) {
+      session.openedFiles.push(path7);
+    }
+  }
+  bareCloseFile({
+    postId: rawPostId,
+    path: path7
+  }) {
+    const session = this.sessions.get(String(rawPostId));
+    if (!session || session.mode !== "bare") return;
+    session.openedFiles = session.openedFiles.filter((p) => p !== path7);
+    delete session.buffers[path7];
+  }
+  bareBufferSet({
+    postId: rawPostId,
+    path: path7,
+    content
+  }) {
+    const session = this.sessions.get(String(rawPostId));
+    if (!session || session.mode !== "bare") return;
+    session.buffers[path7] = content;
+  }
+  async bareFsDelete({
+    postId,
+    path: path7
+  }) {
+    const container = this.getBareContainer(postId);
+    const abs = this.resolveBarePath(path7);
+    if (abs === BARE_REPO_ROOT) {
+      throw new Error("Refusing to delete the repo root.");
+    }
+    await execInContainer(container, `rm -rf ${shEscape(abs)}`);
+  }
+  async bareFsMkdir({
+    postId,
+    path: path7
+  }) {
+    const container = this.getBareContainer(postId);
+    const abs = this.resolveBarePath(path7);
+    await execInContainer(container, `mkdir -p ${shEscape(abs)}`);
+  }
+  async bareReview({
+    postId: rawPostId
+  }) {
+    const postId = String(rawPostId);
+    const session = this.sessions.get(postId);
+    if (!session) throw new Error("No active session for this card.");
+    if (session.mode !== "bare") {
+      throw new Error("bareReview is only valid in Bare mode.");
+    }
+    if (session.phase !== "bare-active" && session.phase !== "bare-review") {
+      throw new Error("Container is not ready.");
+    }
+    const config = this.core.readConfig();
+    if (this.core.isOneDrive(config)) {
+      session.diff = "";
+      session.changedFiles = [];
+      session.commitMessage = "";
+      session.phase = "bare-review";
+      this.emitter.emitSessionUpdate(session);
+      return { diff: "", changedFiles: [], commitMessage: "" };
+    }
+    this.emitter.addLog(session, "system", "Extracting changes...");
+    const { diff, changedFiles } = await extractDiff(session.containerName);
+    session.diff = diff;
+    session.changedFiles = changedFiles;
+    if (changedFiles.length > 0) {
+      this.emitter.addLog(
+        session,
+        "system",
+        `${changedFiles.length} file${changedFiles.length !== 1 ? "s" : ""} changed.`
+      );
+      this.emitter.addLog(session, "system", "Generating commit message...");
+      try {
+        session.commitMessage = await generateCommitMessage(
+          session.containerName,
+          diff
+        );
+      } catch {
+        session.commitMessage = "WIP: changes from bare session";
+      }
+    } else {
+      session.commitMessage = "";
+      this.emitter.addLog(session, "system", "No files changed.");
+    }
+    session.phase = "bare-review";
+    this.emitter.emitSessionUpdate(session);
+    return {
+      diff: session.diff,
+      changedFiles: session.changedFiles,
+      commitMessage: session.commitMessage
+    };
+  }
+  async bareGitStatus({
+    postId: rawPostId
+  }) {
+    const postId = String(rawPostId);
+    const session = this.sessions.get(postId);
+    if (!session) throw new Error("No active session for this card.");
+    if (session.mode !== "bare") {
+      throw new Error("bareGitStatus is only valid in Bare mode.");
+    }
+    if (session.phase !== "bare-active" && session.phase !== "bare-review") {
+      throw new Error("Container is not ready.");
+    }
+    if (this.core.isOneDrive(this.core.readConfig())) {
+      return { diff: "", changedFiles: [] };
+    }
+    return await extractDiff(session.containerName);
+  }
+  async bareListTerminals({
+    postId: rawPostId
+  }) {
+    const postId = String(rawPostId);
+    const session = this.sessions.get(postId);
+    if (!session) return [];
+    if (session.mode !== "bare") return [];
+    if (session.phase !== "bare-active" && session.phase !== "bare-review") {
+      return [];
+    }
+    const sanitizedPostId = postId.replace(/[^a-zA-Z0-9._-]/g, "_");
+    const prefix = `terminal-${sanitizedPostId}-`;
+    try {
+      const stdout = await execInContainer(
+        session.containerName,
+        `tmux list-panes -a -F '#{session_name}|#{pane_current_command}' 2>/dev/null || true`
+      );
+      const byId = /* @__PURE__ */ new Map();
+      for (const raw of stdout.split("\n")) {
+        const line = raw.trim();
+        if (!line.startsWith(prefix)) continue;
+        const rest = line.slice(prefix.length);
+        const sep = rest.indexOf("|");
+        if (sep === -1) continue;
+        const id = rest.slice(0, sep);
+        const cmd = rest.slice(sep + 1).trim() || "bash";
+        if (!byId.has(id)) byId.set(id, cmd);
+      }
+      return Array.from(byId, ([id, name]) => ({ id, name })).sort(
+        (a, b) => (parseInt(a.id, 10) || 0) - (parseInt(b.id, 10) || 0)
+      );
+    } catch {
+      return [];
+    }
+  }
+  // ── port forwarding (factiii-expose / factiii-unexpose) ──
+  async bareExpose({
+    postId,
+    port,
+    name
+  }) {
+    const container = this.getBareContainer(postId);
+    const session = this.sessions.get(String(postId));
+    const safeName = name.trim();
+    if (!/^[a-zA-Z0-9-]+$/.test(safeName)) {
+      throw new Error("Name must be letters, numbers, or dashes.");
+    }
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+      throw new Error("Port must be between 1 and 65535.");
+    }
+    const out = (await execInContainer(
+      container,
+      `factiii-expose ${port} ${shEscape(safeName)} 2>&1`
+    )).trim();
+    const url2 = out.split("\n").filter(Boolean).pop() || "";
+    if (!/^https?:\/\//.test(url2)) {
+      throw new Error(out || "Failed to expose port.");
+    }
+    const entry = { name: safeName, port, url: url2 };
+    session.exposed = session.exposed.filter((e) => e.name !== safeName);
+    session.exposed.push(entry);
+    return entry;
+  }
+  async bareUnexpose({
+    postId,
+    name
+  }) {
+    const container = this.getBareContainer(postId);
+    const session = this.sessions.get(String(postId));
+    const safeName = name.trim();
+    if (!/^[a-zA-Z0-9-]+$/.test(safeName)) {
+      throw new Error("Invalid tunnel name.");
     }
-    const config = this.configProvider.readConfig(this.spaceSlug);
-    this.emitter.addLog(session, "system", "Starting container...");
-    const cloneUrl = buildCloneUrl(config.repoUrl, config.githubToken);
-    const branch = baseBranch || config.mainBranch || "main";
-    const cacheKey = repoCacheKey(config.repoUrl);
-    await killContainer(session.containerName);
-    await spawnContainer(session.containerName, config.claudeToken);
-    const { fromCache } = await cloneRepo(
-      session.containerName,
-      cloneUrl,
-      branch,
-      cacheKey
-    );
-    this.emitter.addLog(
-      session,
-      "system",
-      fromCache ? "Repository updated from cache." : "Repository cloned."
-    );
-    await setGitIdentity(
-      session.containerName,
-      config.gitName,
-      config.gitEmail
+    await execInContainer(
+      container,
+      `factiii-unexpose ${shEscape(safeName)} 2>&1 || true`
     );
-    this.emitter.addLog(session, "system", "Container ready.");
-    session.phase = "research";
-    session.step = 1;
-    this.emitter.emitSessionUpdate(session);
-    this.emitter.addLog(session, "system", "\u2500\u2500 Step 1: Research \u2500\u2500");
-    await this.runResearch(
-      session,
-      buildPrompt(prompts_default.research, { task: prompt2 })
+    session.exposed = session.exposed.filter((e) => e.name !== safeName);
+  }
+  bareListExposed({
+    postId
+  }) {
+    const session = this.sessions.get(String(postId));
+    if (!session || session.mode !== "bare") return [];
+    return session.exposed.slice();
+  }
+};
+
+// ../../shared/all/helpers/board-agent-core/engine.ts
+function sanitizeTaskId(taskId) {
+  const sanitized = String(taskId).replace(/[^a-zA-Z0-9_.-]/g, "");
+  if (!sanitized) throw new Error("Invalid taskId");
+  return sanitized;
+}
+var BoardAgentEngine = class {
+  constructor(options) {
+    this.core = new ContainerCore(options);
+    this.emitter = options.emitter;
+    this.claude = new ClaudeModeEngine(this.core, this.emitter);
+    this.terminal = new TerminalModeEngine(this.core, this.emitter);
+  }
+  /** The mode engine that currently owns this postId, if any. */
+  owner(postId) {
+    if (this.claude.has(postId)) return this.claude;
+    if (this.terminal.has(postId)) return this.terminal;
+    return null;
+  }
+  // ── Config / setup (→ core) ──
+  getConfig() {
+    return this.core.getConfig();
+  }
+  setConfig(partial) {
+    return this.core.setConfig(partial);
+  }
+  clearToken(key) {
+    return this.core.clearToken(key);
+  }
+  setupStatus() {
+    return this.core.setupStatus();
+  }
+  ensureSetup() {
+    return this.core.ensureSetup();
+  }
+  cardRemoteBranches() {
+    return this.core.cardRemoteBranches();
+  }
+  // Start the host-run device-code flow and return the code to show the user.
+  // The host polls Microsoft and pushes one `onedrive-auth` event when done.
+  async onedriveStartDeviceCode(p) {
+    const start = await startDeviceCode(p.clientId);
+    console.log(
+      `[onedrive] device-code started: userCode=${start.userCode} expiresIn=${start.expiresIn}s interval=${start.interval}s`
     );
-    if (!this.sessions.has(session.postId)) return;
-    await this.runImplementation(
-      session,
-      buildPrompt(prompts_default.implement),
-      "\u2500\u2500 Step",
-      enablePreview
+    void this.pollDeviceCodeUntilDone(
+      p.clientId,
+      start.deviceCode,
+      start.interval,
+      start.expiresIn
     );
+    return {
+      userCode: start.userCode,
+      verificationUri: start.verificationUri,
+      expiresIn: start.expiresIn
+    };
   }
-  // ── Board AI: Handlers ──
-  async cardExecute({
-    postId: rawPostId,
-    prompt: prompt2,
-    enablePreview,
-    baseBranch,
-    targetBranch,
-    taskTitle,
-    effort
-  }) {
+  async pollDeviceCodeUntilDone(clientId, deviceCode, interval, expiresIn) {
+    const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+    const deadline = Date.now() + expiresIn * 1e3;
+    let wait = Math.max(interval, 5);
+    while (Date.now() < deadline) {
+      await sleep(wait * 1e3);
+      let res;
+      try {
+        res = await pollDeviceCode(clientId, deviceCode);
+      } catch (err) {
+        console.log(`[onedrive] poll threw (will retry): ${String(err)}`);
+        continue;
+      }
+      console.log(`[onedrive] poll status=${res.status}`);
+      if (res.status === "pending") continue;
+      if (res.status === "slow_down") {
+        wait += 5;
+        continue;
+      }
+      if (res.status === "complete") {
+        try {
+          this.core.saveOneDriveConnection({
+            refreshToken: res.refreshToken,
+            clientId,
+            ...res.appFolder
+          });
+          console.log("[onedrive] connection saved locally");
+        } catch (err) {
+          console.log(
+            `[onedrive] saveOneDriveConnection failed: ${String(err)}`
+          );
+          this.emitter.emitOneDriveAuth({
+            status: "error",
+            message: "Failed to store the OneDrive connection on the host."
+          });
+          return;
+        }
+        this.emitter.emitOneDriveAuth({ status: "complete" });
+        return;
+      }
+      this.emitter.emitOneDriveAuth({
+        status: res.status,
+        message: res.status === "error" ? res.message : void 0
+      });
+      return;
+    }
+    console.log("[onedrive] device code reached deadline without completion");
+    this.emitter.emitOneDriveAuth({ status: "expired" });
+  }
+  onedriveDisconnect() {
+    this.core.clearOneDriveConnection();
+    return { success: true };
+  }
+  // Unmount the workspace (flushing writes) and persist the rotated refresh
+  // token. No-op for non-OneDrive spaces or when nothing is mounted.
+  async onedriveTeardown(p) {
+    const postId = String(p.postId);
+    const session = this.owner(postId)?.get(postId);
+    if (!session) return { success: true };
+    stopOneDriveSyncWatcher(session.containerName);
+    if (!this.core.isOneDrive(this.core.readConfig())) {
+      return { success: true };
+    }
+    try {
+      await unmountWorkspace(session.containerName);
+    } catch {
+    }
+    const refreshToken = await readbackRefreshToken(
+      session.containerName
+    ).catch(() => null);
+    if (refreshToken) this.core.updateOneDriveRefreshToken(refreshToken);
+    return { success: true };
+  }
+  // Pending upload count to seed the UI (0 = synced); live updates come via the
+  // onedrive-sync push. Synced for non-OneDrive spaces or idle sessions.
+  onedriveStatus(p) {
+    const postId = String(p.postId);
+    const session = this.owner(postId)?.get(postId);
+    if (!session || !this.core.isOneDrive(this.core.readConfig())) {
+      return { syncing: false, pending: 0, files: [] };
+    }
+    const pending = onedrivePendingUploads(session.containerName);
+    const files = onedriveUploadingFiles(session.containerName);
+    return { syncing: pending > 0, pending, files };
+  }
+  // ── Ask AI + claude-only controls (→ claude) ──
+  ask(params, sendLog) {
+    return this.claude.ask(params, sendLog);
+  }
+  resetBoardSession() {
+    this.claude.resetBoardSession();
+  }
+  boardSession() {
+    return this.claude.boardSession();
+  }
+  cardStartPreview(payload) {
+    return this.claude.cardStartPreview(payload);
+  }
+  cardAnswerQuestion(payload) {
+    this.claude.cardAnswerQuestion(payload);
+  }
+  cardFeedback(payload) {
+    this.claude.cardFeedback(payload);
+  }
+  // ── Terminal ops (→ terminal) ──
+  bareFsList(p) {
+    return this.terminal.bareFsList(p);
+  }
+  bareFsSearch(p) {
+    return this.terminal.bareFsSearch(p);
+  }
+  bareFsRead(p) {
+    return this.terminal.bareFsRead(p);
+  }
+  bareFsWrite(p) {
+    return this.terminal.bareFsWrite(p);
+  }
+  bareFsDelete(p) {
+    return this.terminal.bareFsDelete(p);
+  }
+  bareFsMkdir(p) {
+    return this.terminal.bareFsMkdir(p);
+  }
+  bareReview(p) {
+    return this.terminal.bareReview(p);
+  }
+  bareGitStatus(p) {
+    return this.terminal.bareGitStatus(p);
+  }
+  bareListTerminals(p) {
+    return this.terminal.bareListTerminals(p);
+  }
+  bareEditorState(p) {
+    return this.terminal.bareEditorState(p);
+  }
+  bareOpenFile(p) {
+    this.terminal.bareOpenFile(p);
+  }
+  bareCloseFile(p) {
+    this.terminal.bareCloseFile(p);
+  }
+  bareBufferSet(p) {
+    this.terminal.bareBufferSet(p);
+  }
+  bareExpose(p) {
+    return this.terminal.bareExpose(p);
+  }
+  bareUnexpose(p) {
+    return this.terminal.bareUnexpose(p);
+  }
+  bareListExposed(p) {
+    return this.terminal.bareListExposed(p);
+  }
+  // ── Cross-mode coordinators ──
+  async cardExecute(payload) {
+    const {
+      postId: rawPostId,
+      prompt: prompt2,
+      baseBranch,
+      targetBranch,
+      taskTitle,
+      effort,
+      mode,
+      runtimes
+    } = payload;
     const postId = String(rawPostId);
-    const existing = this.sessions.get(postId);
-    if (existing && (existing.phase === "starting" || existing.phase === "research" || existing.phase === "implement")) {
+    if (this.claude.isRunning(postId) || this.terminal.isRunning(postId)) {
       throw new Error("A session is already running for this card.");
     }
-    if (existing) {
-      await killContainer(existing.containerName);
-      this.sessions.delete(postId);
+    const stale = this.owner(postId);
+    if (stale) {
+      const s = stale.get(postId);
+      await killContainer(s.containerName);
+      stale.remove(postId);
     }
     const taskId = sanitizeTaskId(`${postId}-${Date.now()}`);
-    const session = {
+    const base = {
       taskId,
       postId,
       phase: "starting",
+      mode,
       step: 1,
       logs: [],
       diff: "",
       changedFiles: [],
       commitMessage: "",
       previewUrl: "",
+      previewRunning: false,
       reproSteps: "",
       pendingQuestion: "",
       error: "",
@@ -9377,196 +11032,47 @@ var BoardAgentEngine = class _BoardAgentEngine {
       targetBranch: targetBranch || "",
       effort: effort || "high",
       todos: [],
-      containerName: `factiii-${this.instancePrefix}-card-${taskId}`,
-      claudeSessionId: "",
-      answerResolver: null,
-      previewResolver: null
+      containerName: `factiii-${this.core.instancePrefix}-card-${taskId}`
     };
-    this.sessions.set(postId, session);
-    this.emitter.emitSessionUpdate(session);
-    this.runPipeline(
-      session,
-      prompt2,
-      enablePreview ?? false,
-      baseBranch ?? ""
-    ).catch((err) => {
-      if (!this.sessions.has(postId)) return;
-      session.phase = "error";
-      session.error = err instanceof Error ? err.message : String(err);
-      this.emitter.addLog(session, "error", session.error);
-      this.emitter.emitSessionUpdate(session);
-    });
-    return { taskId, postId };
-  }
-  static {
-    this.FULL_TOOLS = "Read,Grep,Glob,Agent,Edit,Write,Bash,TodoWrite";
-  }
-  async runImplementation(session, implementPrompt, logPrefix, enablePreview = false) {
-    const tools = _BoardAgentEngine.FULL_TOOLS;
-    session.phase = "implement";
-    session.step = 2;
-    this.emitter.emitSessionUpdate(session);
-    this.emitter.addLog(session, "system", `${logPrefix} 2: Implement \u2500\u2500`);
-    const implResult = await this.runClaudeInContainer(
-      session,
-      implementPrompt,
-      tools,
-      session.claudeSessionId
-    );
-    session.claudeSessionId = implResult.sessionId || session.claudeSessionId;
-    if (!this.sessions.has(session.postId)) return;
-    if (enablePreview) {
-      session.phase = "preview";
-      session.step = 3;
-      this.emitter.emitSessionUpdate(session);
-      this.emitter.addLog(session, "system", `${logPrefix} 3: Preview \u2500\u2500`);
-      const portsEnv = (await execInContainer(session.containerName, "echo -n $FACTIII_PORTS")).trim();
-      const publicPreviewEnabled = !!this.runnerToken;
-      if (publicPreviewEnabled && this.runnerToken) {
-        await installFrpcHarness({
-          containerName: session.containerName,
-          taskId: session.taskId,
-          runnerToken: this.runnerToken
-        });
-      }
-      const previewResult = await this.runClaudeInContainer(
-        session,
-        buildPrompt(prompts_default.preview, {
-          ports: portsEnv,
-          publicPreviewBlock: publicPreviewEnabled ? prompts_default.previewPublic.join("\n") : ""
-        }),
-        tools,
-        session.claudeSessionId
-      );
-      session.claudeSessionId = previewResult.sessionId || session.claudeSessionId;
-      if (!this.sessions.has(session.postId)) return;
-      const portMatch = previewResult.text.match(/PREVIEW_PORT:\s*(\d+)/);
-      const previewPort = portMatch ? portMatch[1] : "3000";
-      const urlMatch = previewResult.text.match(/PREVIEW_URL:\s*(\S+)/);
-      if (publicPreviewEnabled && urlMatch) {
-        session.previewUrl = urlMatch[1];
-        this.emitter.addLog(
-          session,
-          "system",
-          `Public preview available at ${session.previewUrl}`
-        );
-      } else {
-        const previewUrl = await getContainerPort(
-          session.containerName,
-          previewPort
-        );
-        if (previewUrl) {
-          session.previewUrl = previewUrl;
-          this.emitter.addLog(
-            session,
-            "system",
-            `Preview available at ${session.previewUrl}`
-          );
-        } else {
-          this.emitter.addLog(
-            session,
-            "system",
-            "Could not map preview port. Server may not be running."
-          );
-        }
-      }
-      this.emitter.emitSessionUpdate(session);
-      await new Promise((resolve) => {
-        session.previewResolver = resolve;
+    if (mode === "bare") {
+      this.terminal.start(base, {
+        baseBranch: baseBranch ?? "",
+        runtimes: runtimes ?? []
       });
-      session.previewResolver = null;
-      if (!this.sessions.has(session.postId)) return;
-    }
-    session.phase = "review";
-    session.step = 3;
-    this.emitter.emitSessionUpdate(session);
-    this.emitter.addLog(session, "system", `${logPrefix} 3: Review \u2500\u2500`);
-    const reviewResult = await this.runClaudeInContainer(
-      session,
-      buildPrompt(prompts_default.review),
-      tools,
-      session.claudeSessionId
-    );
-    session.claudeSessionId = reviewResult.sessionId || session.claudeSessionId;
-    if (!this.sessions.has(session.postId)) return;
-    session.reproSteps = reviewResult.text.trim();
-    await this.extractAndComplete(session);
-  }
-  async extractAndComplete(session) {
-    this.emitter.addLog(session, "system", "Extracting changes...");
-    const { diff, changedFiles } = await extractDiff(session.containerName);
-    session.diff = diff;
-    session.changedFiles = changedFiles;
-    if (changedFiles.length > 0) {
-      this.emitter.addLog(
-        session,
-        "system",
-        `${changedFiles.length} file${changedFiles.length !== 1 ? "s" : ""} changed.`
-      );
-      this.emitter.addLog(session, "system", "Generating commit message...");
-      session.commitMessage = await generateCommitMessage(
-        session.containerName,
-        diff
-      );
     } else {
-      this.emitter.addLog(session, "system", "No files changed.");
+      this.claude.start(base, {
+        prompt: prompt2,
+        baseBranch: baseBranch ?? "",
+        runtimes: runtimes ?? []
+      });
     }
-    session.phase = "complete";
-    this.emitter.emitSessionUpdate(session);
+    return { taskId, postId };
   }
-  cardFinishPreview({ postId: rawPostId }) {
-    const postId = String(rawPostId);
-    const session = this.sessions.get(postId);
-    if (!session) throw new Error("No active session for this card.");
-    if (session.phase !== "preview")
-      throw new Error("Session is not in preview phase.");
-    if (!session.previewResolver) return;
-    this.emitter.addLog(session, "system", "Finishing preview...");
-    session.previewResolver();
+  /**
+   * Look up the active container for a card. Used by the terminal bridge to
+   * map postId to the docker container it should attach a shell to.
+   */
+  getCardContainerName(postId) {
+    const session = this.claude.get(String(postId)) ?? this.terminal.get(String(postId));
+    if (!session) return null;
+    if (session.phase === "error" || session.phase === "done") return null;
+    return session.containerName;
   }
   cardSessions() {
-    const result = {};
-    for (const [postId, session] of this.sessions) {
-      result[postId] = toSummary(session);
-    }
-    return result;
+    return { ...this.terminal.listSummaries(), ...this.claude.listSummaries() };
   }
-  cardSession({
-    postId
-  }) {
-    const session = this.sessions.get(String(postId));
-    if (!session) return null;
-    return { ...toSummary(session), logs: session.logs };
+  cardSession({ postId }) {
+    return this.claude.sessionWithLogs(String(postId)) ?? this.terminal.sessionWithLogs(String(postId));
   }
   async cardDismiss({ postId }) {
-    const session = this.sessions.get(String(postId));
-    if (!session) return;
+    const owner = this.owner(String(postId));
+    if (!owner) return;
+    const session = owner.get(String(postId));
+    await this.onedriveTeardown({ postId: String(postId) });
     await killContainer(session.containerName);
-    this.sessions.delete(String(postId));
+    owner.remove(String(postId));
     this.emitter.emitSessionRemoved(String(postId));
   }
-  setupStatus() {
-    if (this.containerName) return { phase: "ready" };
-    if (this.setupPromise) return { phase: "running" };
-    return { phase: "idle" };
-  }
-  async ensureSetup() {
-    await this.ensureContainer();
-    return { ready: true };
-  }
-  isReady() {
-    return this.containerName !== null;
-  }
-  async cardRemoteBranches() {
-    const config = this.configProvider.readConfig(this.spaceSlug);
-    if (!config.githubToken || !config.repoUrl) return [];
-    if (!this.isReady()) {
-      throw new Error(
-        'Environment not initialized. Open Board AI Settings and click "Initialize Environment".'
-      );
-    }
-    return listRemoteBranches(this.containerName);
-  }
   async cardFinalize({
     postId: rawPostId,
     apply,
@@ -9574,128 +11080,79 @@ var BoardAgentEngine = class _BoardAgentEngine {
     commitMessage
   }) {
     const postId = String(rawPostId);
-    const session = this.sessions.get(postId);
-    if (!session) throw new Error("No active session for this card.");
+    const owner = this.owner(postId);
+    if (!owner) throw new Error("No active session for this card.");
+    const session = owner.get(postId);
+    const config = this.core.readConfig();
+    if (this.core.isOneDrive(config)) {
+      if (apply) {
+        session.phase = "done";
+        this.emitter.addLog(session, "system", "Changes are live on OneDrive.");
+        this.emitter.emitSessionUpdate(session);
+        return { applied: true, branchName: "" };
+      }
+      await this.onedriveTeardown({ postId });
+      await killContainer(session.containerName);
+      owner.remove(postId);
+      this.emitter.emitSessionRemoved(postId);
+      return { applied: false, branchName: "" };
+    }
     if (apply && branchName) {
-      const config = this.configProvider.readConfig(this.spaceSlug);
-      await commitAndPush(
-        session.containerName,
-        branchName,
-        commitMessage || `Board AI: ${branchName}`,
-        {
-          gitName: config.gitName,
-          gitEmail: config.gitEmail
+      let pushResult;
+      try {
+        pushResult = await commitAndPush(
+          session.containerName,
+          branchName,
+          commitMessage || `Board AI: ${branchName}`,
+          {
+            gitName: config.gitName,
+            gitEmail: config.gitEmail
+          }
+        );
+      } catch (err) {
+        if (err instanceof NoChangesError) {
+          this.emitter.addLog(
+            session,
+            "system",
+            "No changes to push - container kept alive for inspection."
+          );
+        } else {
+          this.emitter.addLog(
+            session,
+            "error",
+            `Push failed: ${err instanceof Error ? err.message : String(err)}`
+          );
         }
-      );
-    }
-    await killContainer(session.containerName);
-    if (apply) {
+        this.emitter.emitSessionUpdate(session);
+        throw err;
+      }
       session.phase = "done";
       this.emitter.addLog(
         session,
         "system",
-        `Changes committed to ${branchName}`
+        `Pushed ${pushResult.pushedSha.slice(0, 8)} to origin/${pushResult.branch}`
       );
       this.emitter.emitSessionUpdate(session);
-      setTimeout(() => {
-        if (this.sessions.get(postId)?.phase === "done") {
-          this.sessions.delete(postId);
-          this.emitter.emitSessionRemoved(postId);
-        }
-      }, 1e4);
-    } else {
-      this.sessions.delete(postId);
-      this.emitter.emitSessionRemoved(postId);
+      return { applied: true, branchName: pushResult.branch };
     }
+    await killContainer(session.containerName);
+    owner.remove(postId);
+    this.emitter.emitSessionRemoved(postId);
     return { applied: apply, branchName: branchName || "" };
   }
-  cardAnswerQuestion({
-    postId: rawPostId,
-    answer
-  }) {
-    const postId = String(rawPostId);
-    const session = this.sessions.get(postId);
-    if (!session || session.phase !== "awaiting-input" || !session.answerResolver)
-      return;
-    session.answerResolver(answer);
-  }
-  cardFeedback({
-    postId: rawPostId,
-    feedback
-  }) {
-    const postId = String(rawPostId);
-    const session = this.sessions.get(postId);
-    if (!session || session.phase !== "complete") return;
-    if (!session.claudeSessionId) return;
-    session.diff = "";
-    session.changedFiles = [];
-    session.commitMessage = "";
-    session.reproSteps = "";
-    const prompt2 = `The user reviewed your changes and has the following feedback:
-
-${feedback}
-
-${buildPrompt(prompts_default.implement)}`;
-    this.runImplementation(session, prompt2, "\u2500\u2500 Follow-up").catch((err) => {
-      if (!this.sessions.has(postId)) return;
-      session.phase = "error";
-      session.error = err instanceof Error ? err.message : String(err);
-      this.emitter.addLog(session, "error", session.error);
-      this.emitter.emitSessionUpdate(session);
-    });
-  }
   async cardKill({ postId: rawPostId }) {
     const postId = String(rawPostId);
-    let session = this.sessions.get(postId);
-    if (!session) {
-      for (const [, s] of this.sessions) {
-        if (s.taskId === rawPostId) {
-          session = s;
-          break;
-        }
-      }
-    }
-    if (!session) return;
-    if (session.answerResolver) {
-      session.answerResolver("");
-      session.answerResolver = null;
-    }
-    if (session.previewResolver) {
-      session.previewResolver();
-      session.previewResolver = null;
-    }
-    const proc = this.cardProcesses.get(session.postId);
-    if (proc) {
-      try {
-        proc.kill("SIGTERM");
-      } catch {
-      }
-      this.cardProcesses.delete(session.postId);
-    }
-    await killContainer(session.containerName);
-    const removedPostId = session.postId;
-    this.sessions.delete(removedPostId);
-    this.emitter.emitSessionRemoved(removedPostId);
+    await this.onedriveTeardown({ postId });
+    if (this.claude.has(postId)) return this.claude.kill(postId);
+    if (this.terminal.has(postId)) return this.terminal.kill(postId);
+    await this.claude.kill(postId);
+    await this.terminal.kill(postId);
   }
   // ── Lifecycle ──
   destroy() {
-    this.resetBoardSession();
-    for (const [, proc] of this.cardProcesses) {
-      try {
-        proc.kill("SIGTERM");
-      } catch {
-      }
-    }
-    this.cardProcesses.clear();
-    for (const [, session] of this.sessions) {
-      void killContainer(session.containerName);
-    }
-    this.sessions.clear();
-    if (this.containerName) {
-      void killContainer(this.containerName);
-      this.containerName = null;
-      this.setupPromise = null;
-    }
+    this.claude.destroy();
+    this.terminal.destroy();
+    this.core.destroy();
   }
   /**
    * Route a single action/payload pair to the right engine method.
@@ -9725,13 +11182,16 @@ ${buildPrompt(prompts_default.implement)}`;
       case "resetBoardSession":
         this.resetBoardSession();
         return void 0;
+      case "boardSession":
+        return this.boardSession();
       case "cardExecute":
         return await this.cardExecute(
           payload
         );
-      case "cardFinishPreview":
-        this.cardFinishPreview(payload);
-        return void 0;
+      case "cardStartPreview":
+        return await this.cardStartPreview(
+          payload
+        );
       case "cardSessions":
         return this.cardSessions();
       case "cardSession":
@@ -9747,6 +11207,20 @@ ${buildPrompt(prompts_default.implement)}`;
         return await this.ensureSetup();
       case "cardRemoteBranches":
         return await this.cardRemoteBranches();
+      case "onedriveStartDeviceCode":
+        return await this.onedriveStartDeviceCode(
+          payload
+        );
+      case "onedriveDisconnect":
+        return this.onedriveDisconnect();
+      case "onedriveTeardown":
+        return await this.onedriveTeardown(
+          payload
+        );
+      case "onedriveStatus":
+        return this.onedriveStatus(
+          payload
+        );
       case "cardFinalize":
         return await this.cardFinalize(
           payload
@@ -9760,6 +11234,77 @@ ${buildPrompt(prompts_default.implement)}`;
       case "cardKill":
         await this.cardKill(payload);
         return void 0;
+      case "bareFsList":
+        return await this.bareFsList(
+          payload
+        );
+      case "bareFsSearch":
+        return await this.bareFsSearch(
+          payload
+        );
+      case "bareFsRead":
+        return await this.bareFsRead(
+          payload
+        );
+      case "bareFsWrite":
+        await this.bareFsWrite(
+          payload
+        );
+        return void 0;
+      case "bareFsDelete":
+        await this.bareFsDelete(
+          payload
+        );
+        return void 0;
+      case "bareFsMkdir":
+        await this.bareFsMkdir(
+          payload
+        );
+        return void 0;
+      case "bareReview":
+        return await this.bareReview(
+          payload
+        );
+      case "bareGitStatus":
+        return await this.bareGitStatus(
+          payload
+        );
+      case "bareListTerminals":
+        return await this.bareListTerminals(
+          payload
+        );
+      case "bareEditorState":
+        return this.bareEditorState(
+          payload
+        );
+      case "bareOpenFile":
+        this.bareOpenFile(
+          payload
+        );
+        return void 0;
+      case "bareCloseFile":
+        this.bareCloseFile(
+          payload
+        );
+        return void 0;
+      case "bareBufferSet":
+        this.bareBufferSet(
+          payload
+        );
+        return void 0;
+      case "bareExpose":
+        return await this.bareExpose(
+          payload
+        );
+      case "bareUnexpose":
+        await this.bareUnexpose(
+          payload
+        );
+        return void 0;
+      case "bareListExposed":
+        return this.bareListExposed(
+          payload
+        );
       default:
         throw new Error(`Unknown board-agent action: ${String(action)}`);
     }
@@ -9816,7 +11361,7 @@ function makeChunkReassembler() {
 
 // src/daemon.ts
 var import_node_datachannel = require("node-datachannel");
-var import_path4 = __toESM(require("path"));
+var import_path5 = __toESM(require("path"));
 
 // ../../node_modules/engine.io-client/build/esm-debug/transports/polling-xhr.node.js
 var XMLHttpRequestModule = __toESM(require_XMLHttpRequest(), 1);
@@ -10530,8 +12075,8 @@ var BaseXHR = class extends Polling {
   /**
    * Sends data.
    *
-   * @param {String} data to send.
-   * @param {Function} called upon flush.
+   * @param {String} data - data to send.
+   * @param {Function} fn - called upon flush.
    * @private
    */
   doWrite(data, fn) {
@@ -10749,10 +12294,13 @@ var XHR = class extends BaseXHR {
   }
 };
 
-// ../../node_modules/engine.io-client/node_modules/ws/wrapper.mjs
+// ../../node_modules/ws/wrapper.mjs
 var import_stream = __toESM(require_stream(), 1);
+var import_extension = __toESM(require_extension(), 1);
+var import_permessage_deflate = __toESM(require_permessage_deflate(), 1);
 var import_receiver = __toESM(require_receiver(), 1);
 var import_sender = __toESM(require_sender(), 1);
+var import_subprotocol = __toESM(require_subprotocol(), 1);
 var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
 
@@ -10993,12 +12541,12 @@ function parse2(str) {
   uri.queryKey = queryKey(uri, uri["query"]);
   return uri;
 }
-function pathNames(obj, path6) {
-  const regx = /\/{2,9}/g, names = path6.replace(regx, "/").split("/");
-  if (path6.slice(0, 1) == "/" || path6.length === 0) {
+function pathNames(obj, path7) {
+  const regx = /\/{2,9}/g, names = path7.replace(regx, "/").split("/");
+  if (path7.slice(0, 1) == "/" || path7.length === 0) {
     names.splice(0, 1);
   }
-  if (path6.slice(-1) == "/") {
+  if (path7.slice(-1) == "/") {
     names.splice(names.length - 1, 1);
   }
   return names;
@@ -11353,7 +12901,7 @@ var SocketWithoutUpgrade = class _SocketWithoutUpgrade extends import_component_
   /**
    * Sends a packet.
    *
-   * @param {String} type: packet type.
+   * @param {String} type - packet type.
    * @param {String} data.
    * @param {Object} options.
    * @param {Function} fn - callback function.
@@ -11602,11 +13150,12 @@ var SocketWithUpgrade = class extends SocketWithoutUpgrade {
 };
 var Socket = class extends SocketWithUpgrade {
   constructor(uri, opts = {}) {
-    const o = typeof uri === "object" ? uri : opts;
+    const isOptionsOnly = typeof uri === "object";
+    const o = isOptionsOnly ? { ...uri } : { ...opts };
     if (!o.transports || o.transports && typeof o.transports[0] === "string") {
       o.transports = (o.transports || ["polling", "websocket", "webtransport"]).map((transportName) => transports[transportName]).filter((t) => !!t);
     }
-    super(uri, o);
+    super(isOptionsOnly ? o : uri, o);
   }
 };
 
@@ -11616,7 +13165,7 @@ var protocol2 = Socket.protocol;
 // ../../node_modules/socket.io-client/build/esm-debug/url.js
 var import_debug7 = __toESM(require_src(), 1);
 var debug7 = (0, import_debug7.default)("socket.io-client:url");
-function url(uri, path6 = "", loc) {
+function url(uri, path7 = "", loc) {
   let obj = uri;
   loc = loc || typeof location !== "undefined" && location;
   if (null == uri)
@@ -11650,7 +13199,7 @@ function url(uri, path6 = "", loc) {
   obj.path = obj.path || "/";
   const ipv6 = obj.host.indexOf(":") !== -1;
   const host = ipv6 ? "[" + obj.host + "]" : obj.host;
-  obj.id = obj.protocol + "://" + host + ":" + obj.port + path6;
+  obj.id = obj.protocol + "://" + host + ":" + obj.port + path7;
   obj.href = obj.protocol + "://" + host + (loc && loc.port === obj.port ? "" : ":" + obj.port);
   return obj;
 }
@@ -13284,8 +14833,8 @@ function lookup(uri, opts) {
   const parsed = url(uri, opts.path || "/socket.io");
   const source = parsed.source;
   const id = parsed.id;
-  const path6 = parsed.path;
-  const sameNamespace = cache[id] && path6 in cache[id]["nsps"];
+  const path7 = parsed.path;
+  const sameNamespace = cache[id] && path7 in cache[id]["nsps"];
   const newConnection = opts.forceNew || opts["force new connection"] || false === opts.multiplex || sameNamespace;
   let io;
   if (newConnection) {
@@ -13310,44 +14859,296 @@ Object.assign(lookup, {
   connect: lookup
 });
 
-// src/agent-adapter.ts
+// ../../shared/all/helpers/terminal-ai/terminal.ts
+var import_child_process6 = require("child_process");
+var import_dockerode = __toESM(require("dockerode"));
 var import_fs3 = __toESM(require("fs"));
 var import_os2 = __toESM(require("os"));
 var import_path3 = __toESM(require("path"));
-var CONFIG_DIR2 = import_path3.default.join(import_os2.default.homedir(), ".factiii-runner");
+function resolveDocker() {
+  if (process.env.DOCKER_HOST) return new import_dockerode.default();
+  try {
+    const out = (0, import_child_process6.execFileSync)(
+      "docker",
+      ["context", "inspect", "--format", "{{.Endpoints.docker.Host}}"],
+      { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }
+    ).trim();
+    if (out.startsWith("unix://")) {
+      const p = out.slice("unix://".length);
+      if (import_fs3.default.existsSync(p)) return new import_dockerode.default({ socketPath: p });
+    } else if (out) {
+      process.env.DOCKER_HOST = out;
+      return new import_dockerode.default();
+    }
+  } catch {
+  }
+  const candidates = [
+    "/var/run/docker.sock",
+    import_path3.default.join(import_os2.default.homedir(), ".docker/run/docker.sock"),
+    import_path3.default.join(import_os2.default.homedir(), ".docker/desktop/docker.sock"),
+    import_path3.default.join(import_os2.default.homedir(), ".orbstack/run/docker.sock"),
+    import_path3.default.join(import_os2.default.homedir(), ".colima/default/docker.sock"),
+    import_path3.default.join(import_os2.default.homedir(), ".rd/docker.sock")
+  ];
+  for (const p of candidates) {
+    try {
+      import_fs3.default.statSync(p);
+      return new import_dockerode.default({ socketPath: p });
+    } catch {
+    }
+  }
+  return new import_dockerode.default();
+}
+var docker = resolveDocker();
+var TERMINAL_INIT_SCRIPT = [
+  `export PS1='\\[\\e[1;32m\\]user@bare\\[\\e[0m\\]:\\w\\$ '`,
+  `exec bash --norc -i`
+].join("; ");
+function tmuxName(terminalKey) {
+  const safe = terminalKey.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80);
+  return `terminal-${safe}`;
+}
+var TerminalManager = class {
+  constructor(send, getCardContainerName) {
+    this.send = send;
+    this.getCardContainerName = getCardContainerName;
+    this.sessions = /* @__PURE__ */ new Map();
+  }
+  handle(msg) {
+    switch (msg.op) {
+      case "open":
+        void this.open(msg);
+        return;
+      case "stdin":
+        this.stdin(msg.sessionId, msg.data);
+        return;
+      case "resize":
+        void this.resize(msg.sessionId, msg.cols, msg.rows);
+        return;
+      case "close":
+        this.close(msg.sessionId);
+        return;
+      case "kill":
+        void this.killTmuxSession(msg.postId, msg.terminalKey);
+        return;
+    }
+  }
+  async open(msg) {
+    if (this.sessions.has(msg.sessionId)) {
+      this.emit({
+        type: "terminal",
+        op: "error",
+        sessionId: msg.sessionId,
+        message: "Session already open."
+      });
+      return;
+    }
+    const containerName = this.getCardContainerName(msg.postId);
+    if (!containerName) {
+      this.emit({
+        type: "terminal",
+        op: "error",
+        sessionId: msg.sessionId,
+        message: `No active card session for postId=${msg.postId}.`
+      });
+      return;
+    }
+    const tmuxSession = tmuxName(msg.terminalKey);
+    try {
+      const exec = await docker.getContainer(containerName).exec({
+        Cmd: [
+          "tmux",
+          // -u forces UTF-8 regardless of the locale. Slim base images often
+          // ship without a UTF-8 locale, so tmux's auto-detect falls through to
+          // ASCII line-draw chars (the "qqqq" mess in place of ─).
+          "-u",
+          "new-session",
+          "-A",
+          "-s",
+          tmuxSession,
+          "--",
+          "bash",
+          "-c",
+          TERMINAL_INIT_SCRIPT
+        ],
+        AttachStdin: true,
+        AttachStdout: true,
+        AttachStderr: true,
+        Tty: true,
+        // Drop the user into the cloned repo so claude/git/etc. just work.
+        WorkingDir: "/home/claude/workspace",
+        Env: ["TERM=xterm-256color"],
+        // The client follows up with a resize op carrying real dimensions.
+        ConsoleSize: [msg.rows, msg.cols]
+      });
+      const stream = await exec.start({
+        hijack: true,
+        stdin: true,
+        Tty: true
+      });
+      this.sessions.set(msg.sessionId, { exec, stream, containerName });
+      stream.on("data", (chunk) => {
+        this.emit({
+          type: "terminal",
+          op: "stdout",
+          sessionId: msg.sessionId,
+          data: chunk.toString("base64")
+        });
+      });
+      stream.on("error", (err) => {
+        this.cleanup(msg.sessionId);
+        this.emit({
+          type: "terminal",
+          op: "error",
+          sessionId: msg.sessionId,
+          message: err.message
+        });
+      });
+      stream.on("end", () => {
+        void this.finalize(msg.sessionId, exec);
+      });
+      stream.on("close", () => {
+        void this.finalize(msg.sessionId, exec);
+      });
+      this.emit({
+        type: "terminal",
+        op: "opened",
+        sessionId: msg.sessionId,
+        containerName
+      });
+    } catch (err) {
+      this.emit({
+        type: "terminal",
+        op: "error",
+        sessionId: msg.sessionId,
+        message: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  stdin(sessionId, b64) {
+    const session = this.sessions.get(sessionId);
+    if (!session) return;
+    try {
+      session.stream.write(Buffer.from(b64, "base64"));
+    } catch {
+    }
+  }
+  async resize(sessionId, cols, rows) {
+    const session = this.sessions.get(sessionId);
+    if (!session) return;
+    try {
+      await session.exec.resize({ h: rows, w: cols });
+    } catch {
+    }
+  }
+  close(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) return;
+    try {
+      session.stream.end();
+    } catch {
+    }
+  }
+  /** Tear down the tmux session for a tab. Used when the user explicitly
+   *  removes a tab (the X button), not on transient detach. */
+  async killTmuxSession(postId, terminalKey) {
+    const containerName = this.getCardContainerName(postId);
+    if (!containerName) return;
+    const session = tmuxName(terminalKey);
+    try {
+      const exec = await docker.getContainer(containerName).exec({
+        Cmd: ["tmux", "kill-session", "-t", session],
+        AttachStdout: false,
+        AttachStderr: false,
+        Tty: false
+      });
+      await exec.start({});
+    } catch {
+    }
+  }
+  destroyAll() {
+    for (const sessionId of [...this.sessions.keys()]) {
+      this.close(sessionId);
+    }
+  }
+  // Called only once even if both 'end' and 'close' fire.
+  async finalize(sessionId, exec) {
+    if (!this.sessions.has(sessionId)) return;
+    this.cleanup(sessionId);
+    let code = null;
+    try {
+      const info = await exec.inspect();
+      code = typeof info.ExitCode === "number" ? info.ExitCode : null;
+    } catch {
+    }
+    this.emit({ type: "terminal", op: "exit", sessionId, code });
+  }
+  cleanup(sessionId) {
+    this.sessions.delete(sessionId);
+  }
+  emit(msg) {
+    const wire = JSON.stringify(msg);
+    for (const frame of chunkWire(wire)) this.send(frame);
+  }
+};
+
+// src/agent-adapter.ts
+var import_fs4 = __toESM(require("fs"));
+var import_os3 = __toESM(require("os"));
+var import_path4 = __toESM(require("path"));
+var CONFIG_DIR2 = import_path4.default.join(import_os3.default.homedir(), ".factiii-runner");
+function safeSlug(spaceSlug) {
+  return spaceSlug.replace(/[^a-zA-Z0-9_.-]/g, "_");
+}
 function configPath(spaceSlug) {
-  const safe = spaceSlug.replace(/[^a-zA-Z0-9_.-]/g, "_");
-  return import_path3.default.join(CONFIG_DIR2, `space-${safe}.json`);
+  return import_path4.default.join(CONFIG_DIR2, `space-${safeSlug(spaceSlug)}.json`);
+}
+function connectionPath(spaceSlug) {
+  return import_path4.default.join(CONFIG_DIR2, `space-${safeSlug(spaceSlug)}.onedrive.json`);
+}
+function writeJson(filePath, value2) {
+  import_fs4.default.mkdirSync(CONFIG_DIR2, { recursive: true });
+  import_fs4.default.writeFileSync(filePath, JSON.stringify(value2, null, 2));
+  import_fs4.default.chmodSync(filePath, 384);
 }
 var localConfigProvider = {
   readConfig(spaceSlug) {
+    let config = {};
     try {
-      const raw = import_fs3.default.readFileSync(configPath(spaceSlug), "utf-8");
-      const config = JSON.parse(raw);
-      return {
-        repoUrl: config.repoUrl || "",
-        mainBranch: config.mainBranch || "main",
-        gitName: config.gitName || "",
-        gitEmail: config.gitEmail || "",
-        claudeToken: config.claudeToken || "",
-        githubToken: config.githubToken || ""
-      };
+      config = JSON.parse(
+        import_fs4.default.readFileSync(configPath(spaceSlug), "utf-8")
+      );
     } catch {
-      return {
-        repoUrl: "",
-        mainBranch: "main",
-        gitName: "",
-        gitEmail: "",
-        claudeToken: "",
-        githubToken: ""
-      };
     }
+    return {
+      repoUrl: config.repoUrl || "",
+      mainBranch: config.mainBranch || "main",
+      gitName: config.gitName || "",
+      gitEmail: config.gitEmail || "",
+      claudeToken: config.claudeToken || "",
+      githubToken: config.githubToken || "",
+      storageBackend: config.storageBackend || "github"
+    };
   },
   writeConfig(spaceSlug, config) {
-    import_fs3.default.mkdirSync(CONFIG_DIR2, { recursive: true });
-    const filePath = configPath(spaceSlug);
-    import_fs3.default.writeFileSync(filePath, JSON.stringify(config, null, 2));
-    import_fs3.default.chmodSync(filePath, 384);
+    writeJson(configPath(spaceSlug), config);
+  },
+  readOneDriveConnection(spaceSlug) {
+    try {
+      return JSON.parse(
+        import_fs4.default.readFileSync(connectionPath(spaceSlug), "utf-8")
+      );
+    } catch {
+      return null;
+    }
+  },
+  writeOneDriveConnection(spaceSlug, connection) {
+    const filePath = connectionPath(spaceSlug);
+    if (!connection) {
+      import_fs4.default.rmSync(filePath, { force: true });
+      return;
+    }
+    writeJson(filePath, connection);
   }
 };
 
@@ -13362,6 +15163,14 @@ async function startDaemon(config) {
   });
   const engines = /* @__PURE__ */ new Map();
   const openChannels = /* @__PURE__ */ new Set();
+  const terminalByChannel = /* @__PURE__ */ new WeakMap();
+  const findCardContainer = (postId) => {
+    for (const engine of engines.values()) {
+      const name = engine.getCardContainerName(postId);
+      if (name) return name;
+    }
+    return null;
+  };
   const broadcastToAll = (msg) => {
     const frames = chunkWire(msg);
     for (const dc of openChannels) {
@@ -13469,12 +15278,45 @@ async function startDaemon(config) {
             }
           }
         };
+        const sendRawToChannel = (frame) => {
+          try {
+            dc.sendMessage(frame);
+          } catch {
+          }
+        };
+        terminalByChannel.set(
+          dc,
+          new TerminalManager(sendRawToChannel, findCardContainer)
+        );
+        dc.onOpen(() => {
+          for (const [spaceSlug, engine] of engines.entries()) {
+            const sessions = engine.cardSessions();
+            for (const summary of Object.values(sessions)) {
+              const msg = JSON.stringify({
+                type: "event",
+                spaceSlug,
+                event: `board-agent:${spaceSlug}:session-update`,
+                payload: summary
+              });
+              sendToChannel(msg);
+            }
+          }
+        });
         dc.onMessage((raw) => {
           const rawStr = typeof raw === "string" ? raw : raw.toString("utf-8");
           const msgStr = reassembler.feed(rawStr);
           if (msgStr === null) return;
           try {
             const parsed = JSON.parse(msgStr);
+            if (parsed.type === "terminal") {
+              const mgr = terminalByChannel.get(dc);
+              if (mgr) {
+                mgr.handle(
+                  parsed
+                );
+              }
+              return;
+            }
             if (parsed.type === "broadcast" && parsed.spaceSlug && parsed.event) {
               const eventMsg = JSON.stringify({
                 type: "event",
@@ -13506,6 +15348,11 @@ async function startDaemon(config) {
         dc.onClosed(() => {
           console.log(`Data channel closed with ${data.fromSocketId}`);
           openChannels.delete(dc);
+          const mgr = terminalByChannel.get(dc);
+          if (mgr) {
+            mgr.destroyAll();
+            terminalByChannel.delete(dc);
+          }
           detachIceHandler();
         });
       });
@@ -13578,16 +15425,18 @@ async function handleDataChannelMessage(raw, sendToChannel, broadcastToAll, getE
   }
 }
 function getDockerfilePath() {
-  return import_path4.default.join(__dirname, "..", "Dockerfile.claude");
+  return import_path5.default.join(__dirname, "..", "Dockerfile.claude");
 }
 
 // src/setup.ts
-var import_child_process6 = require("child_process");
-var import_fs4 = __toESM(require("fs"));
-var import_path5 = __toESM(require("path"));
+var import_child_process7 = require("child_process");
+var import_crypto2 = __toESM(require("crypto"));
+var import_fs5 = __toESM(require("fs"));
+var import_path6 = __toESM(require("path"));
+var DOCKERFILE_LABEL2 = "factiii.dockerfile-sha";
 function run(bin, args, opts) {
   try {
-    return (0, import_child_process6.execFileSync)(bin, args, {
+    return (0, import_child_process7.execFileSync)(bin, args, {
       encoding: "utf-8",
       stdio: opts?.silent ? "pipe" : "inherit",
       // Avoids a cmd.exe window flash on Windows during silent checks.
@@ -13600,7 +15449,7 @@ function run(bin, args, opts) {
 function check(cmd) {
   const lookup2 = process.platform === "win32" ? "where" : "which";
   try {
-    (0, import_child_process6.execFileSync)(lookup2, [cmd], { stdio: "pipe", windowsHide: true });
+    (0, import_child_process7.execFileSync)(lookup2, [cmd], { stdio: "pipe", windowsHide: true });
     return true;
   } catch {
     return false;
@@ -13630,21 +15479,32 @@ async function setup(serverUrl) {
     );
     process.exit(1);
   }
-  const imageExists = run(
+  const wantedHash = import_crypto2.default.createHash("sha256").update(import_fs5.default.readFileSync(dockerfilePath)).digest("hex");
+  const existingHash = run(
     "docker",
-    ["image", "inspect", "factiii-claude"],
+    [
+      "image",
+      "inspect",
+      "factiii-claude",
+      "--format",
+      `{{ index .Config.Labels "${DOCKERFILE_LABEL2}" }}`
+    ],
     { silent: true }
-  );
-  if (imageExists) {
-    console.log("  Image already exists.");
+  ).trim();
+  if (existingHash === wantedHash) {
+    console.log("  Image is up to date.");
   } else {
-    console.log(`  Building from ${dockerfilePath}...`);
+    console.log(
+      existingHash ? `  Dockerfile changed since last build, rebuilding from ${dockerfilePath}...` : `  Building from ${dockerfilePath}...`
+    );
     run("docker", [
       "build",
       "-t",
       "factiii-claude",
       "-f",
       dockerfilePath,
+      "--label",
+      `${DOCKERFILE_LABEL2}=${wantedHash}`,
       "."
     ]);
     console.log("  Image built.");
@@ -13658,13 +15518,14 @@ async function setup(serverUrl) {
   console.log("Start the runner with: factiii-runner start\n");
 }
 function findDockerfile() {
-  const p = import_path5.default.join(__dirname, "..", "Dockerfile.claude");
-  return import_fs4.default.existsSync(p) ? p : null;
+  const p = import_path6.default.join(__dirname, "..", "Dockerfile.claude");
+  return import_fs5.default.existsSync(p) ? p : null;
 }
 
 // src/cli.ts
+import_node_dns.default.setDefaultResultOrder("ipv4first");
 var program2 = new Command();
-program2.name("factiii-runner").description("Factiii Runner \u2014 run Board AI agents on remote servers").version("0.0.1");
+program2.name("factiii-runner").description("Factiii Runner - run Board AI agents on remote servers").version("0.0.1");
 program2.command("setup").description("Verify Docker, build the Claude image, and pair this runner").option("-s, --server <url>", "API server URL", "https://api.factiii.com").action(async (opts) => {
   try {
     await setup(opts.server);