@factiii/runner 0.10.2 → 0.11.0

package/dist/cli.js

@@ -963,8 +963,8 @@ var require_command = __commonJS({
   "node_modules/commander/lib/command.js"(exports2) {
     var EventEmitter = require("node:events").EventEmitter;
     var childProcess = require("node:child_process");
-    var path18 = require("node:path");
-    var fs14 = require("node:fs");
+    var path20 = require("node:path");
+    var fs15 = require("node:fs");
     var process2 = require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1896,11 +1896,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path18.resolve(baseDir, baseName);
-          if (fs14.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path18.extname(baseName))) return void 0;
+          const localBin = path20.resolve(baseDir, baseName);
+          if (fs15.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path20.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs14.existsSync(`${localBin}${ext}`)
+            (ext) => fs15.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1912,21 +1912,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs14.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs15.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path18.resolve(
-            path18.dirname(resolvedScriptPath),
+          executableDir = path20.resolve(
+            path20.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path18.basename(
+            const legacyName = path20.basename(
               this._scriptPath,
-              path18.extname(this._scriptPath)
+              path20.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -1937,7 +1937,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path18.extname(executableFile));
+        launchWithNode = sourceExt.includes(path20.extname(executableFile));
         let proc;
         if (process2.platform !== "win32") {
           if (launchWithNode) {
@@ -2777,7 +2777,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path18.basename(filename, path18.extname(filename));
+        this._name = path20.basename(filename, path20.extname(filename));
         return this;
       }
       /**
@@ -2791,9 +2791,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path19) {
-        if (path19 === void 0) return this._executableDir;
-        this._executableDir = path19;
+      executableDir(path21) {
+        if (path21 === void 0) return this._executableDir;
+        this._executableDir = path21;
         return this;
       }
       /**
@@ -3026,7 +3026,7 @@ var require_commander = __commonJS({
 // ../../node_modules/xmlhttprequest-ssl/lib/XMLHttpRequest.js
 var require_XMLHttpRequest = __commonJS({
   "../../node_modules/xmlhttprequest-ssl/lib/XMLHttpRequest.js"(exports2, module2) {
-    var fs14 = require("fs");
+    var fs15 = require("fs");
     var Url = require("url");
     var spawn5 = require("child_process").spawn;
     module2.exports = XMLHttpRequest3;
@@ -3184,7 +3184,7 @@ var require_XMLHttpRequest = __commonJS({
             throw new Error("XMLHttpRequest: Only GET method is supported");
           }
           if (settings.async) {
-            fs14.readFile(unescape(url2.pathname), function(error, data2) {
+            fs15.readFile(unescape(url2.pathname), function(error, data2) {
               if (error) {
                 self.handleError(error, error.errno || -1);
               } else {
@@ -3196,7 +3196,7 @@ var require_XMLHttpRequest = __commonJS({
             });
           } else {
             try {
-              this.response = fs14.readFileSync(unescape(url2.pathname));
+              this.response = fs15.readFileSync(unescape(url2.pathname));
               this.responseText = this.response.toString("utf8");
               this.status = 200;
               setState(self.DONE);
@@ -3322,15 +3322,15 @@ var require_XMLHttpRequest = __commonJS({
         } else {
           var contentFile = ".node-xmlhttprequest-content-" + process.pid;
           var syncFile = ".node-xmlhttprequest-sync-" + process.pid;
-          fs14.writeFileSync(syncFile, "", "utf8");
+          fs15.writeFileSync(syncFile, "", "utf8");
           var execString = "var http = require('http'), https = require('https'), fs = require('fs');var doRequest = http" + (ssl ? "s" : "") + ".request;var options = " + JSON.stringify(options) + ";var responseText = '';var responseData = Buffer.alloc(0);var req = doRequest(options, function(response) {response.on('data', function(chunk) {  var data = Buffer.from(chunk);  responseText += data.toString('utf8');  responseData = Buffer.concat([responseData, data]);});response.on('end', function() {fs.writeFileSync('" + contentFile + "', JSON.stringify({err: null, data: {statusCode: response.statusCode, headers: response.headers, text: responseText, data: responseData.toString('base64')}}), 'utf8');fs.unlinkSync('" + syncFile + "');});response.on('error', function(error) {fs.writeFileSync('" + contentFile + "', 'NODE-XMLHTTPREQUEST-ERROR:' + JSON.stringify(error), 'utf8');fs.unlinkSync('" + syncFile + "');});}).on('error', function(error) {fs.writeFileSync('" + contentFile + "', 'NODE-XMLHTTPREQUEST-ERROR:' + JSON.stringify(error), 'utf8');fs.unlinkSync('" + syncFile + "');});" + (data ? "req.write('" + JSON.stringify(data).slice(1, -1).replace(/'/g, "\\'") + "');" : "") + "req.end();";
           var syncProc = spawn5(process.argv[0], ["-e", execString]);
           var statusText;
-          while (fs14.existsSync(syncFile)) {
+          while (fs15.existsSync(syncFile)) {
           }
-          self.responseText = fs14.readFileSync(contentFile, "utf8");
+          self.responseText = fs15.readFileSync(contentFile, "utf8");
           syncProc.stdin.end();
-          fs14.unlinkSync(contentFile);
+          fs15.unlinkSync(contentFile);
           if (self.responseText.match(/^NODE-XMLHTTPREQUEST-ERROR:/)) {
             var errorObj = JSON.parse(self.responseText.replace(/^NODE-XMLHTTPREQUEST-ERROR:/, ""));
             self.handleError(errorObj, 503);
@@ -6497,7 +6497,7 @@ var require_websocket = __commonJS({
     var EventEmitter = require("events");
     var https = require("https");
     var http = require("http");
-    var net2 = require("net");
+    var net3 = require("net");
     var tls = require("tls");
     var { randomBytes, createHash: createHash2 } = require("crypto");
     var { Duplex, Readable } = require("stream");
@@ -7241,12 +7241,12 @@ var require_websocket = __commonJS({
     }
     function netConnect(options) {
       options.path = options.socketPath;
-      return net2.connect(options);
+      return net3.connect(options);
     }
     function tlsConnect(options) {
       options.path = void 0;
       if (!options.servername && options.servername !== "") {
-        options.servername = net2.isIP(options.host) ? "" : options.host;
+        options.servername = net3.isIP(options.host) ? "" : options.host;
       }
       return tls.connect(options);
     }
@@ -8428,8 +8428,8 @@ function getErrorMap() {
 
 // ../../node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path18, errorMaps, issueData } = params;
-  const fullPath = [...path18, ...issueData.path || []];
+  const { data, path: path20, errorMaps, issueData } = params;
+  const fullPath = [...path20, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -8545,11 +8545,11 @@ var errorUtil;
 
 // ../../node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value2, path18, key) {
+  constructor(parent, value2, path20, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value2;
-    this._path = path18;
+    this._path = path20;
     this._key = key;
   }
   get path() {
@@ -12197,9 +12197,9 @@ function processLine(trimmed, state, cb) {
   if (e.type === "result" /* Result */) {
     if (e.is_error) {
       state.isError = true;
-      const errorText = e.result || "Claude encountered an error";
-      state.fullText = errorText;
-      cb.onLog?.({ type: "error", content: errorText });
+      const errorText2 = e.result || "Claude encountered an error";
+      state.fullText = errorText2;
+      cb.onLog?.({ type: "error", content: errorText2 });
       return;
     }
     if (e.result && !state.fullText) {
@@ -12647,7 +12647,8 @@ var prompts_default = {
     "- $WORKSPACE - the repo checkout (the working directory), reset to the default branch at run start",
     "- $BACKUPS_DIR - durable backups; every backup (db dumps etc) is written here and nowhere else",
     "- $BUILDS_DIR - build artifacts; each build writes into $BUILDS_DIR/<commit-hash>/",
-    "Reference paths ONLY via these variables or relative to the working directory. NEVER hardcode absolute machine paths (like /Users/...) anywhere in the skill - it must run unchanged on any runner. Secrets live in an encrypted store you never touch: their values reach commands only via runner-side injection of the keys declared in required-variables.json.",
+    "Reference paths ONLY via these variables or relative to the working directory. NEVER hardcode absolute machine paths (like /Users/...) anywhere in the skill - it must run unchanged on any runner.",
+    "Secrets live in an encrypted store you never touch, and `factiii-secrets` is how a command gets them - it is on the PATH of every run. Load the `factiii-secrets` skill installed on this machine (it is not part of this repo) for exactly how it behaves, and write the skill's commands in that shape.",
     "",
     "## Produce exactly three files",
     "1. .agents/skills/deploy/SKILL.md - the runbook, written for a competent operator. It MUST start with YAML frontmatter (--- name: deploy / description: one line saying this is the repository's release runbook and when to run it ---) so agent CLIs discover it as a skill, followed by: named steps in ship order, the exact commands, what success looks like per step, and explicit stop-and-ask points wherever human judgment or confirmation belongs (e.g. 'confirm before the production cutover'). Plain language; no secret values or key material anywhere in the file - reference secrets ONLY as $KEY env names.",
@@ -12658,7 +12659,7 @@ var prompts_default = {
     "- Write ONLY those three files under .agents/skills/deploy/.",
     "- Do NOT git commit or git push; the harness pushes for review.",
     "- Cloud CLIs on this machine (aws, vercel, wrangler, gh...) may already be signed in. You may use them READ-ONLY to verify what exists (project names, repo names, regions) so the skill is accurate - but NEVER create, modify, deploy, or delete anything, and never echo a credential or token value.",
-    "- The harness injects required variables per-command at execution time (the owner authorizes each secret-bearing command individually). Write the skill accordingly: commands simply reference the variables; NEVER include steps that check whether variables are set in the environment, and never instruct anyone to export them or put them in a .env/shell/CI config.",
+    '- Secret-bearing commands: any command needing a variable declared in required-variables.json MUST be written in the skill as `factiii-secrets run -- <command>`, with the variables referenced unexpanded and quoted (e.g. "$DATABASE_URL"). The owner authorizes each one at run time and the runner injects the values. Wrap only the commands that need a secret. NEVER include steps that check whether variables are set in the environment, and never instruct anyone to export them or put them in a .env/shell/CI config.',
     "- No secret values in any file, ever."
   ],
   deployCreateRevise: [
@@ -12666,18 +12667,18 @@ var prompts_default = {
     "",
     "{{FEEDBACK}}",
     "",
-    "Apply them by editing .agents/skills/deploy/SKILL.md, .agents/skills/deploy/required-variables.json, and/or .agents/skills/deploy/check-environment.sh in your working directory - the same contract as before: only those three files, keys declared exactly when used, no secret values anywhere, no git commit/push, and paths referenced ONLY via $WORKSPACE / $BACKUPS_DIR / $BUILDS_DIR or relative to the working directory (never absolute machine paths). Keep everything the owner did NOT ask to change untouched."
+    "Apply them by editing .agents/skills/deploy/SKILL.md, .agents/skills/deploy/required-variables.json, and/or .agents/skills/deploy/check-environment.sh in your working directory - the same contract as before: only those three files, keys declared exactly when used, every secret-bearing command still written as `factiii-secrets run -- <command>`, no secret values anywhere, no git commit/push, and paths referenced ONLY via $WORKSPACE / $BACKUPS_DIR / $BUILDS_DIR or relative to the working directory (never absolute machine paths). Keep everything the owner did NOT ask to change untouched."
   ],
   deployRun: [
     "## Deploy run protocol",
     "You are executing this repository's deploy skill NOW, on the owner's machine, for real. Invoke it and follow it exactly - the skill is the program; do not improvise steps it doesn't contain or change any step's intent.",
     "",
-    "## The secrets model (read this before anything else)",
-    "Every variable declared in required-variables.json is UNSET in your shell BY DESIGN, and will stay unset for the whole run. That is the security model working, not a problem: the owner already stored the values encrypted on this machine, and the runner injects them into commands you request through the NEED_SECRETS gate below. So:",
-    "- NEVER check whether these variables are set (no `env`, `printenv`, `test -n`, echo checks). Their absence tells you nothing.",
-    "- NEVER report them as missing, ask the owner to configure them, or abort the run because your shell lacks them. Aborting for unset declared variables is ALWAYS wrong - the gate is how every one of them gets used.",
-    "- If the skill has a step that verifies variables are set, SKIP it - it predates this protocol.",
-    '- To run a command that needs any declared variable, print as the LAST line of your message exactly: NEED_SECRETS: <the complete command>  - then END your turn. Write the variables unexpanded in that command (e.g. "$DATABASE_URL"). The owner inspects and authorizes it with their password; the runner executes it with every declared variable injected, and your next message contains its redacted output. One command per request.',
+    "## Secrets (read this before anything else)",
+    "Every variable declared in required-variables.json is UNSET in your shell BY DESIGN, and will stay unset for the whole run. The values are stored encrypted on this machine, and `factiii-secrets` is how a command gets them - it is on your PATH, and the `factiii-secrets` skill describes it in full.",
+    "- To run a command that needs any declared variable, prefix it: `factiii-secrets run -- <command>`. The owner authorizes it with their password, the runner runs it with every declared value injected, and you get the output back with the values redacted. It exits with the command's own code, so `&&`, `||` and `set -e` behave normally. Exit 77 means the owner declined - adapt or stop, and never retry the same command.",
+    '- Quote the variables (`"$DATABASE_URL"`): they expand on the runner\'s side, not in your shell.',
+    "- NEVER check whether these variables are set (no `env`, `printenv`, `test -n`, echo checks), never report them as missing, and never abort because your shell lacks them. Their absence tells you nothing. If the skill has a step that verifies variables are set, SKIP it - it predates this protocol.",
+    "- Wrap ONLY the commands that actually need a secret. Everything else runs unwrapped and needs no authorization.",
     "",
     "- Track the release with your todo/plan tool: one todo per step in ship order, updated as you go. This is the owner's live timeline.",
     "- HUMAN GATES: wherever the skill says to stop and ask (and before anything irreversible the skill flags), print as the LAST line: AWAITING_INPUT: <the question>  - then END your turn. The owner's answer arrives as your next message.",
@@ -12908,7 +12909,7 @@ ${diff.slice(0, 8e3)}`,
 }
 
 // ../../shared/all/helpers/board-agent-core/engine.ts
-var import_path10 = require("path");
+var import_path12 = require("path");
 
 // ../../shared/all/domains/electron.ts
 var SETUP_LOG_PREFIX = "
log ";
@@ -13017,7 +13018,7 @@ async function ensurePrimaryClone(target, cloneUrl, branch) {
   await target.sh(`mkdir -p ${target.paths.worktrees}`);
 }
 async function addWorktree(target, workName, baseBranch, kind) {
-  const path18 = worktreeFor(target.paths, workName);
+  const path20 = worktreeFor(target.paths, workName);
   const branch = workBranch(workName, kind);
   await gitInDir(
     target,
@@ -13027,7 +13028,7 @@ async function addWorktree(target, workName, baseBranch, kind) {
     baseBranch
   ).catch(() => {
   });
-  await removeWorktree(target, path18).catch(() => {
+  await removeWorktree(target, path20).catch(() => {
   });
   await gitInDir(
     target,
@@ -13036,30 +13037,30 @@ async function addWorktree(target, workName, baseBranch, kind) {
     "add",
     "-B",
     branch,
-    path18,
+    path20,
     `origin/${baseBranch}`
   );
-  return { path: path18, branch };
+  return { path: path20, branch };
 }
-async function removeWorktree(target, path18) {
+async function removeWorktree(target, path20) {
   await gitInDir(
     target,
     target.paths.repo,
     "worktree",
     "remove",
     "--force",
-    path18
+    path20
   );
 }
-async function removeWorktreeAndBranch(target, path18) {
+async function removeWorktreeAndBranch(target, path20) {
   const branch = await gitInDir(
     target,
-    path18,
+    path20,
     "rev-parse",
     "--abbrev-ref",
     "HEAD"
   ).then((out) => out.trim()).catch(() => "");
-  await removeWorktree(target, path18);
+  await removeWorktree(target, path20);
   if (branch && branch !== "HEAD") {
     await gitInDir(target, target.paths.repo, "branch", "-D", branch).catch(
       () => {
@@ -13073,8 +13074,8 @@ async function pruneWorktrees(target) {
     }
   );
 }
-function isWorktreePath(target, path18) {
-  return path18.startsWith(`${target.paths.worktrees}/`);
+function isWorktreePath(target, path20) {
+  return path20.startsWith(`${target.paths.worktrees}/`);
 }
 async function setGitIdentity(target, name, email, workdir = target.paths.workspace) {
   if (name) await gitInDir(target, workdir, "config", "user.name", name);
@@ -13100,13 +13101,13 @@ function parseStatus(raw) {
     const y = line[1];
     const rest = line.slice(3);
     const arrow = rest.indexOf(" -> ");
-    const path18 = arrow === -1 ? rest : rest.slice(arrow + 4);
+    const path20 = arrow === -1 ? rest : rest.slice(arrow + 4);
     if (x === "?" || y === "?") {
-      unstaged.push({ path: path18, code: "A" });
+      unstaged.push({ path: path20, code: "A" });
       continue;
     }
-    if (x !== " ") staged.push({ path: path18, code: x });
-    if (y !== " ") unstaged.push({ path: path18, code: y });
+    if (x !== " ") staged.push({ path: path20, code: x });
+    if (y !== " ") unstaged.push({ path: path20, code: y });
   }
   return { staged, unstaged };
 }
@@ -13848,13 +13849,13 @@ function createEventSink(send, spaceSlug, notify) {
 
 // ../../shared/all/helpers/card-ai/frpc.ts
 var import_fs2 = require("fs");
-var import_promises4 = __toESM(require("fs/promises"));
-var import_path6 = __toESM(require("path"));
+var import_promises5 = __toESM(require("fs/promises"));
+var import_path7 = __toESM(require("path"));
 
 // ../../shared/all/helpers/board-agent-core/host-skills.ts
-var import_promises3 = __toESM(require("fs/promises"));
+var import_promises4 = __toESM(require("fs/promises"));
 var import_os2 = __toESM(require("os"));
-var import_path5 = __toESM(require("path"));
+var import_path6 = __toESM(require("path"));
 
 // ../../shared/all/domains/posts.ts
 var postDataSort = /* @__PURE__ */ ((postDataSort2) => {
@@ -14364,9 +14365,134 @@ var skillScopeSchema = external_exports.enum(["global", "repo"]);
 
 // ../../shared/all/helpers/board-agent-core/host-deploy.ts
 var import_child_process3 = require("child_process");
+var import_promises3 = __toESM(require("fs/promises"));
+var import_path5 = __toESM(require("path"));
+var import_util5 = require("util");
+
+// ../../shared/all/helpers/board-agent-core/secrets-bridge.ts
 var import_promises2 = __toESM(require("fs/promises"));
+var import_net2 = __toESM(require("net"));
 var import_path4 = __toESM(require("path"));
-var import_util5 = require("util");
+function secretsSocketPath(spaceDir) {
+  return import_path4.default.join(hostSpacePaths(spaceDir).state, "secrets.sock");
+}
+function redactor(values) {
+  const significant = values.filter((v) => v.length >= 4);
+  return (text) => {
+    let out = text;
+    for (const value2 of significant) {
+      out = out.split(value2).join("[REDACTED]");
+    }
+    return out;
+  };
+}
+function replier(conn) {
+  return (message) => {
+    if (conn.destroyed) return;
+    conn.write(`${JSON.stringify(message)}
+`);
+  };
+}
+async function handleRun(request, handlers, reply) {
+  const command = typeof request.command === "string" ? request.command.trim() : "";
+  if (!command) {
+    reply({ type: "error", message: "No command was sent." });
+    return;
+  }
+  const cwd = typeof request.cwd === "string" ? request.cwd : "";
+  const result = await handlers.run({
+    command,
+    cwd,
+    status: (text) => reply({ type: "status", text })
+  });
+  if ("denied" in result) {
+    reply({ type: "denied" });
+    return;
+  }
+  if (result.output) reply({ type: "output", chunk: result.output });
+  reply({ type: "exit", code: result.code });
+}
+async function startSecretsBridge(opts) {
+  const socketPath = secretsSocketPath(opts.spaceDir);
+  await import_promises2.default.mkdir(import_path4.default.dirname(socketPath), { recursive: true });
+  await import_promises2.default.rm(socketPath, { force: true });
+  const { handlers } = opts;
+  let queue = Promise.resolve();
+  let queueDepth = 0;
+  const live = /* @__PURE__ */ new Set();
+  const server = import_net2.default.createServer((conn) => {
+    live.add(conn);
+    conn.on("close", () => live.delete(conn));
+    const reply = replier(conn);
+    let buffer = "";
+    let handled = false;
+    conn.on("error", () => {
+    });
+    conn.on("data", (chunk) => {
+      if (handled) return;
+      buffer += chunk.toString("utf-8");
+      const newline = buffer.indexOf("\n");
+      if (newline === -1) return;
+      handled = true;
+      let request;
+      try {
+        request = JSON.parse(buffer.slice(0, newline));
+      } catch {
+        reply({ type: "error", message: "Malformed request." });
+        conn.end();
+        return;
+      }
+      if (request.op === "list") {
+        void handlers.list().then((keys) => reply({ type: "keys", keys })).catch(
+          (err) => reply({ type: "error", message: errorText(err) })
+        ).finally(() => conn.end());
+        return;
+      }
+      if (request.op !== "run") {
+        reply({ type: "error", message: "Unknown operation." });
+        conn.end();
+        return;
+      }
+      if (queueDepth > 0) {
+        reply({
+          type: "status",
+          text: "queued behind another command awaiting authorization"
+        });
+      }
+      queueDepth += 1;
+      queue = queue.then(() => {
+        if (conn.destroyed) return void 0;
+        return handleRun(request, handlers, reply);
+      }).catch(
+        (err) => reply({ type: "error", message: errorText(err) })
+      ).finally(() => {
+        queueDepth -= 1;
+        conn.end();
+      });
+    });
+  });
+  await new Promise((resolve2, reject) => {
+    server.once("error", reject);
+    server.listen(socketPath, () => {
+      server.removeListener("error", reject);
+      resolve2();
+    });
+  });
+  await import_promises2.default.chmod(socketPath, 384).catch(() => void 0);
+  return {
+    close: async () => {
+      for (const conn of live) conn.destroy();
+      live.clear();
+      await new Promise((resolve2) => server.close(() => resolve2()));
+      await import_promises2.default.rm(socketPath, { force: true });
+    }
+  };
+}
+function errorText(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// ../../shared/all/helpers/board-agent-core/host-deploy.ts
 var execFileAsync2 = (0, import_util5.promisify)(import_child_process3.execFile);
 var SKILL_DIR = ".agents/skills/deploy";
 var SKILL_PATH = `${SKILL_DIR}/SKILL.md`;
@@ -14375,14 +14501,14 @@ var CHECKER_PATH = `${SKILL_DIR}/check-environment.sh`;
 var CLAUDE_SKILLS_DIR = ".claude/skills";
 var CLAUDE_LINK = `${CLAUDE_SKILLS_DIR}/deploy`;
 async function ensureClaudeSkillLink(workspace) {
-  const linkPath = import_path4.default.join(workspace, CLAUDE_LINK);
+  const linkPath = import_path5.default.join(workspace, CLAUDE_LINK);
   try {
-    await import_promises2.default.lstat(linkPath);
+    await import_promises3.default.lstat(linkPath);
     return;
   } catch {
   }
-  await import_promises2.default.mkdir(import_path4.default.join(workspace, CLAUDE_SKILLS_DIR), { recursive: true });
-  await import_promises2.default.symlink("../../.agents/skills/deploy", linkPath, "dir");
+  await import_promises3.default.mkdir(import_path5.default.join(workspace, CLAUDE_SKILLS_DIR), { recursive: true });
+  await import_promises3.default.symlink("../../.agents/skills/deploy", linkPath, "dir");
 }
 var GIT_NO_HELPER = ["-c", "credential.helper="];
 var GIT_ENV = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
@@ -14427,7 +14553,7 @@ async function gitCatFileBatch(cwd, shas) {
   return out;
 }
 async function ensureWorkspaceClone(opts) {
-  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
   const branch = (opts.mainBranch || "main").replace(/[^\w./-]/g, "");
   const url2 = buildCloneUrl(opts.repoUrl, opts.githubToken);
   let cloned = false;
@@ -14435,14 +14561,14 @@ async function ensureWorkspaceClone(opts) {
     await hostGit(workspace, "rev-parse", "--git-dir");
     await hostGit(workspace, "remote", "set-url", "origin", url2);
   } catch {
-    const leftovers = await import_promises2.default.readdir(workspace).catch(() => []);
+    const leftovers = await import_promises3.default.readdir(workspace).catch(() => []);
     if (leftovers.includes(".git")) {
       throw new Error(
         `${workspace} holds a git repository that cannot be read. Remove it and retry.`
       );
     }
     for (const name of leftovers) {
-      await import_promises2.default.rm(import_path4.default.join(workspace, name), { recursive: true, force: true });
+      await import_promises3.default.rm(import_path5.default.join(workspace, name), { recursive: true, force: true });
     }
     await execFileAsync2(
       "git",
@@ -14526,6 +14652,10 @@ function spaceEnv(spaceDir) {
     WORKSPACE: paths.workspace,
     BACKUPS_DIR: paths.backups,
     BUILDS_DIR: paths.builds,
+    // Where `factiii-secrets` finds the runner. It can also walk up for the
+    // socket, but only from inside the space tree - a step that cd'd into a
+    // build dir elsewhere would not find it.
+    FACTIII_SECRETS_SOCK: secretsSocketPath(spaceDir),
     // No keychain credential helper and no interactive git prompts anywhere
     // in the deploy surface (agent sessions + authorized commands): auth
     // comes from the secrets store or the tokened URL, never the keychain.
@@ -14536,15 +14666,15 @@ function spaceEnv(spaceDir) {
   };
 }
 async function readContract(workspace) {
-  const skill = await import_promises2.default.readFile(import_path4.default.join(workspace, SKILL_PATH), "utf-8").catch(() => {
+  const skill = await import_promises3.default.readFile(import_path5.default.join(workspace, SKILL_PATH), "utf-8").catch(() => {
     throw new Error("The creator wrote no SKILL.md.");
   });
-  const checker = await import_promises2.default.readFile(import_path4.default.join(workspace, CHECKER_PATH), "utf-8").catch(() => {
+  const checker = await import_promises3.default.readFile(import_path5.default.join(workspace, CHECKER_PATH), "utf-8").catch(() => {
     throw new Error("The creator wrote no check-environment.sh.");
   });
   try {
     const raw = JSON.parse(
-      await import_promises2.default.readFile(import_path4.default.join(workspace, VARIABLES_PATH), "utf-8")
+      await import_promises3.default.readFile(import_path5.default.join(workspace, VARIABLES_PATH), "utf-8")
     );
     return {
       skill,
@@ -14561,7 +14691,7 @@ async function generateDeploySkill(opts) {
     throw new Error("Describe your deployment process first.");
   }
   const status = await checkDeployStatus(opts);
-  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
   sendLog({
     type: "system",
     content: `Resetting workspace to origin/${status.branch}...`
@@ -14586,13 +14716,12 @@ async function generateDeploySkill(opts) {
       prompt: buildPrompt(prompts_default.deployCreate, {
         INSTRUCTIONS: instructions
       }),
-      allowedTools: "Read,Grep,Glob,Bash,Edit,Write,WebSearch,WebFetch",
+      allowedTools: "Read,Grep,Glob,Bash,Edit,Write,WebSearch,WebFetch,Skill",
       // auto: the per-action classifier blocks escalations/unrecognized-infra
       // actions - a host session with no human reviewing each command should
       // not run bypassPermissions. (Codex maps this to a workspace-write
       // sandbox; see agent.ts.)
       permissionMode: "auto",
-      model: "claude-opus-4-6",
       includePartialMessages: true,
       env: spaceEnv(opts.spaceDir),
       callbacks: { onLog: (entry) => sendLog(entry) }
@@ -14605,7 +14734,7 @@ async function generateDeploySkill(opts) {
 async function reviseDeploySkill(opts) {
   const { feedback, sendLog } = opts;
   if (!feedback.trim()) throw new Error("Corrections are empty.");
-  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
   sendLog({ type: "system", content: "Applying your corrections..." });
   const { result } = await spawnAgent(
     opts.provider,
@@ -14615,9 +14744,8 @@ async function reviseDeploySkill(opts) {
       prompt: buildPrompt(prompts_default.deployCreateRevise, {
         FEEDBACK: feedback
       }),
-      allowedTools: "Read,Grep,Glob,Bash,Edit,Write,WebSearch,WebFetch",
+      allowedTools: "Read,Grep,Glob,Bash,Edit,Write,WebSearch,WebFetch,Skill",
       permissionMode: "auto",
-      model: "claude-opus-4-6",
       includePartialMessages: true,
       resumeSessionId: opts.resumeSessionId || void 0,
       env: spaceEnv(opts.spaceDir),
@@ -14634,7 +14762,7 @@ async function loadSkillDraft(opts) {
     throw new Error("Not a deploy-skill branch.");
   }
   await checkDeployStatus(opts);
-  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
   await hostGit(
     workspace,
     "fetch",
@@ -14646,7 +14774,7 @@ async function loadSkillDraft(opts) {
   return readContract(workspace);
 }
 async function approveDeploySkill(opts) {
-  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
   await readContract(workspace);
   await ensureClaudeSkillLink(workspace);
   if (opts.gitName)
@@ -14689,19 +14817,19 @@ async function runEnvironmentCheck(opts) {
       "No environment checker on the default branch. Generate the deploy skill first."
     );
   }
-  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
   const script = await hostGit(
     workspace,
     "cat-file",
     "-p",
     `origin/${status.branch}:${CHECKER_PATH}`
   );
-  const tmp = import_path4.default.join(opts.spaceDir, `.env-check.${process.pid}.sh`);
-  await import_promises2.default.writeFile(tmp, script, { mode: 448 });
+  const tmp = import_path5.default.join(opts.spaceDir, `.env-check.${process.pid}.sh`);
+  await import_promises3.default.writeFile(tmp, script, { mode: 448 });
   let ok = true;
   let output = "";
   try {
-    const scriptArg = tmp.split(import_path4.default.sep).join("/");
+    const scriptArg = tmp.split(import_path5.default.sep).join("/");
     const res = await execLogin(`bash ${JSON.stringify(scriptArg)}`, {
       cwd: workspace,
       env: { ...process.env, ...spaceEnv(opts.spaceDir) },
@@ -14710,7 +14838,7 @@ async function runEnvironmentCheck(opts) {
     output = res.output;
     if (res.code !== 0) ok = false;
   } finally {
-    await import_promises2.default.rm(tmp, { force: true });
+    await import_promises3.default.rm(tmp, { force: true });
   }
   const checks = [];
   for (const line of output.split("\n")) {
@@ -14732,7 +14860,7 @@ async function fixEnvironment(opts) {
   const before = await runEnvironmentCheck(opts);
   if (before.ok) return before;
   const status = await checkDeployStatus(opts);
-  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
   const script = await hostGit(
     workspace,
     "cat-file",
@@ -14757,7 +14885,6 @@ async function fixEnvironment(opts) {
       // auto: installs are in-scope of the owner's explicit "fix environment"
       // request; the classifier still blocks anything beyond it.
       permissionMode: "auto",
-      model: "claude-opus-4-6",
       includePartialMessages: true,
       env: spaceEnv(opts.spaceDir),
       callbacks: { onLog: (entry) => sendLog(entry) }
@@ -14768,7 +14895,7 @@ async function fixEnvironment(opts) {
   return runEnvironmentCheck(opts);
 }
 async function discardDeploySkill(opts) {
-  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
   await hostGit(workspace, "checkout", "--", ".").catch(() => null);
   await hostGit(workspace, "clean", "-fd");
   return { success: true };
@@ -14887,7 +15014,7 @@ var AGENTS_ROOT = ".agents/skills";
 var CLAUDE_ROOT = ".claude/skills";
 var CLI_ROOTS = [CLAUDE_ROOT, ".codex/skills"];
 function globalAgentsRoot() {
-  return import_path5.default.join(import_os2.default.homedir(), ".agents", "skills");
+  return import_path6.default.join(import_os2.default.homedir(), ".agents", "skills");
 }
 var AGENTS_LINK_TARGET = "../.agents/skills";
 var BRANCH_PREFIX = "skill/";
@@ -14897,11 +15024,11 @@ function summarize(raw, base) {
   return { ...base, description: frontmatter.description, errors };
 }
 async function rootLinkState(root) {
-  const linkPath = import_path5.default.join(import_os2.default.homedir(), ...root.split("/"));
-  const stat = await import_promises3.default.lstat(linkPath).catch(() => null);
-  if (!stat) return "missing";
-  if (!stat.isSymbolicLink()) return "blocked";
-  const target = await import_promises3.default.readlink(linkPath).catch(() => "");
+  const linkPath = import_path6.default.join(import_os2.default.homedir(), ...root.split("/"));
+  const stat2 = await import_promises4.default.lstat(linkPath).catch(() => null);
+  if (!stat2) return "missing";
+  if (!stat2.isSymbolicLink()) return "blocked";
+  const target = await import_promises4.default.readlink(linkPath).catch(() => "");
   return target.replace(/\/+$/, "") === AGENTS_LINK_TARGET ? "linked" : "missing";
 }
 async function globalLinkState() {
@@ -14911,12 +15038,12 @@ async function globalLinkState() {
 }
 async function listGlobal() {
   const root = globalAgentsRoot();
-  const entries = await import_promises3.default.readdir(root, { withFileTypes: true }).catch(() => []);
+  const entries = await import_promises4.default.readdir(root, { withFileTypes: true }).catch(() => []);
   const out = [];
   for (const entry of entries) {
     if (entry.isFile()) continue;
-    const dir = import_path5.default.join(root, entry.name);
-    const raw = await import_promises3.default.readFile(import_path5.default.join(dir, "SKILL.md"), "utf-8").catch(() => "");
+    const dir = import_path6.default.join(root, entry.name);
+    const raw = await import_promises4.default.readFile(import_path6.default.join(dir, "SKILL.md"), "utf-8").catch(() => "");
     if (!raw) continue;
     out.push(
       summarize(raw, {
@@ -15085,7 +15212,7 @@ async function ensureSkillsWorktree(spaceDir, branch) {
   } catch {
     await hostGit(repo, "worktree", "prune").catch(() => {
     });
-    await import_promises3.default.rm(worktree, { recursive: true, force: true });
+    await import_promises4.default.rm(worktree, { recursive: true, force: true });
     await hostGit(
       repo,
       "worktree",
@@ -15168,11 +15295,11 @@ async function bundleFilesOnDisk(dir) {
   const out = [];
   const walk = async (current, prefix, depth) => {
     if (depth > 3 || out.length >= 200) return;
-    const entries = await import_promises3.default.readdir(current, { withFileTypes: true }).catch(() => []);
+    const entries = await import_promises4.default.readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
-        await walk(import_path5.default.join(current, entry.name), rel, depth + 1);
+        await walk(import_path6.default.join(current, entry.name), rel, depth + 1);
       } else if (rel !== "SKILL.md") {
         out.push(rel);
       }
@@ -15184,7 +15311,7 @@ async function bundleFilesOnDisk(dir) {
 async function readSkillImpl(opts) {
   if (opts.scope === "global") {
     const dir = resolveSkillDir(globalAgentsRoot(), opts.name);
-    const content2 = await import_promises3.default.readFile(import_path5.default.join(dir, "SKILL.md"), "utf-8");
+    const content2 = await import_promises4.default.readFile(import_path6.default.join(dir, "SKILL.md"), "utf-8");
     const { frontmatter: frontmatter2, errors: errors2 } = parseSkill(content2);
     return {
       name: opts.name,
@@ -15219,55 +15346,55 @@ async function readSkillImpl(opts) {
   };
 }
 async function moveIntoAgents(from, to) {
-  if (await import_promises3.default.access(to).then(
+  if (await import_promises4.default.access(to).then(
     () => true,
     () => false
   )) {
     throw new Error(
-      `${import_path5.default.basename(to)} exists in both roots. Remove one copy, then migrate.`
+      `${import_path6.default.basename(to)} exists in both roots. Remove one copy, then migrate.`
     );
   }
-  await import_promises3.default.mkdir(import_path5.default.dirname(to), { recursive: true });
+  await import_promises4.default.mkdir(import_path6.default.dirname(to), { recursive: true });
   try {
-    await import_promises3.default.rename(from, to);
+    await import_promises4.default.rename(from, to);
   } catch {
-    await import_promises3.default.cp(from, to, { recursive: true });
-    await import_promises3.default.rm(from, { recursive: true, force: true });
+    await import_promises4.default.cp(from, to, { recursive: true });
+    await import_promises4.default.rm(from, { recursive: true, force: true });
   }
 }
 async function migrateGlobal() {
   const moved = [];
   for (const root of CLI_ROOTS) {
-    const dir = import_path5.default.join(import_os2.default.homedir(), ...root.split("/"));
-    const stat = await import_promises3.default.lstat(dir).catch(() => null);
-    if (!stat || stat.isSymbolicLink()) continue;
-    const entries = await import_promises3.default.readdir(dir, { withFileTypes: true }).catch(() => []);
+    const dir = import_path6.default.join(import_os2.default.homedir(), ...root.split("/"));
+    const stat2 = await import_promises4.default.lstat(dir).catch(() => null);
+    if (!stat2 || stat2.isSymbolicLink()) continue;
+    const entries = await import_promises4.default.readdir(dir, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       if (entry.isFile() || entry.isSymbolicLink()) continue;
-      const src = import_path5.default.join(dir, entry.name);
-      if (!await import_promises3.default.access(import_path5.default.join(src, "SKILL.md")).then(
+      const src = import_path6.default.join(dir, entry.name);
+      if (!await import_promises4.default.access(import_path6.default.join(src, "SKILL.md")).then(
         () => true,
         () => false
       )) {
         continue;
       }
-      await moveIntoAgents(src, import_path5.default.join(globalAgentsRoot(), entry.name));
+      await moveIntoAgents(src, import_path6.default.join(globalAgentsRoot(), entry.name));
       moved.push(entry.name);
     }
-    await import_promises3.default.rmdir(dir).catch(() => {
+    await import_promises4.default.rmdir(dir).catch(() => {
     });
   }
   for (const root of CLI_ROOTS) {
-    const linkPath = import_path5.default.join(import_os2.default.homedir(), ...root.split("/"));
-    const after = await import_promises3.default.lstat(linkPath).catch(() => null);
-    if (after?.isSymbolicLink()) await import_promises3.default.rm(linkPath, { force: true });
+    const linkPath = import_path6.default.join(import_os2.default.homedir(), ...root.split("/"));
+    const after = await import_promises4.default.lstat(linkPath).catch(() => null);
+    if (after?.isSymbolicLink()) await import_promises4.default.rm(linkPath, { force: true });
     else if (after) {
       throw new Error(
         `~/${root} still has files that are not skills. Empty it, then migrate.`
       );
     }
-    await import_promises3.default.mkdir(import_path5.default.dirname(linkPath), { recursive: true });
-    await import_promises3.default.symlink(AGENTS_LINK_TARGET, linkPath, "dir");
+    await import_promises4.default.mkdir(import_path6.default.dirname(linkPath), { recursive: true });
+    await import_promises4.default.symlink(AGENTS_LINK_TARGET, linkPath, "dir");
   }
   return moved;
 }
@@ -15301,13 +15428,13 @@ async function migrateSkillsImpl(opts) {
         `${name} exists in both ${AGENTS_ROOT} and ${stray}. Remove one copy, then migrate.`
       );
     }
-    await import_promises3.default.mkdir(import_path5.default.join(workspace, AGENTS_ROOT), { recursive: true });
+    await import_promises4.default.mkdir(import_path6.default.join(workspace, AGENTS_ROOT), { recursive: true });
     await hostGit(workspace, "mv", stray, dest);
     moved.push(name);
   }
-  const linkPath = import_path5.default.join(workspace, CLAUDE_ROOT);
-  await import_promises3.default.rm(linkPath, { recursive: true, force: true });
-  await import_promises3.default.symlink(AGENTS_LINK_TARGET, linkPath, "dir");
+  const linkPath = import_path6.default.join(workspace, CLAUDE_ROOT);
+  await import_promises4.default.rm(linkPath, { recursive: true, force: true });
+  await import_promises4.default.symlink(AGENTS_LINK_TARGET, linkPath, "dir");
   await hostGit(workspace, "add", "-A");
   const dirty = await hostGit(workspace, "status", "--porcelain");
   if (!dirty.trim()) return { branch: "", moved: [] };
@@ -15333,16 +15460,16 @@ function assertWritable(name, content) {
 }
 async function writeSkillFile(opts) {
   const dir = resolveSkillDir(opts.root, opts.name);
-  const file = import_path5.default.join(dir, "SKILL.md");
+  const file = import_path6.default.join(dir, "SKILL.md");
   if (opts.keepExisting) {
-    const exists = await import_promises3.default.access(file).then(
+    const exists = await import_promises4.default.access(file).then(
       () => true,
       () => false
     );
     if (exists) return;
   }
-  await import_promises3.default.mkdir(dir, { recursive: true });
-  await import_promises3.default.writeFile(file, opts.content, "utf-8");
+  await import_promises4.default.mkdir(dir, { recursive: true });
+  await import_promises4.default.writeFile(file, opts.content, "utf-8");
 }
 async function writeGlobalSkill(opts) {
   assertWritable(opts.name, opts.content);
@@ -15357,14 +15484,14 @@ async function installBundledSkill(opts) {
     content: opts.content,
     keepExisting: true
   });
-  await write(import_path5.default.join(home, ...AGENTS_ROOT.split("/")));
+  await write(import_path6.default.join(home, ...AGENTS_ROOT.split("/")));
   for (const root of CLI_ROOTS) {
-    const linkPath = import_path5.default.join(home, ...root.split("/"));
-    const stat = await import_promises3.default.lstat(linkPath).catch(() => null);
-    if (stat?.isSymbolicLink()) continue;
-    if (!stat) {
-      await import_promises3.default.mkdir(import_path5.default.dirname(linkPath), { recursive: true });
-      await import_promises3.default.symlink(AGENTS_LINK_TARGET, linkPath, "dir").catch(() => void 0);
+    const linkPath = import_path6.default.join(home, ...root.split("/"));
+    const stat2 = await import_promises4.default.lstat(linkPath).catch(() => null);
+    if (stat2?.isSymbolicLink()) continue;
+    if (!stat2) {
+      await import_promises4.default.mkdir(import_path6.default.dirname(linkPath), { recursive: true });
+      await import_promises4.default.symlink(AGENTS_LINK_TARGET, linkPath, "dir").catch(() => void 0);
       continue;
     }
     await write(linkPath);
@@ -15372,7 +15499,7 @@ async function installBundledSkill(opts) {
 }
 async function deleteGlobalSkill(opts) {
   const dir = resolveSkillDir(globalAgentsRoot(), opts.name);
-  await import_promises3.default.rm(dir, { recursive: true, force: true });
+  await import_promises4.default.rm(dir, { recursive: true, force: true });
 }
 async function proposeRepoSkillImpl(opts) {
   assertWritable(opts.name, opts.content);
@@ -15410,9 +15537,9 @@ async function proposeRepoSkillImpl(opts) {
   if (opts.gitEmail) {
     await hostGit(workspace, "config", "user.email", opts.gitEmail);
   }
-  await import_promises3.default.mkdir(import_path5.default.join(workspace, dir), { recursive: true });
-  await import_promises3.default.writeFile(
-    import_path5.default.join(workspace, dir, "SKILL.md"),
+  await import_promises4.default.mkdir(import_path6.default.join(workspace, dir), { recursive: true });
+  await import_promises4.default.writeFile(
+    import_path6.default.join(workspace, dir, "SKILL.md"),
     opts.content,
     "utf-8"
   );
@@ -15519,18 +15646,18 @@ function vendoredBinaryName() {
 async function installFrpcBinary(target) {
   const p = frpcPaths(target);
   const binaryName = vendoredBinaryName();
-  const src = import_path6.default.join(__dirname, "..", "vendor", binaryName);
+  const src = import_path7.default.join(__dirname, "..", "vendor", binaryName);
   if (!(0, import_fs2.existsSync)(src)) {
     throw new Error(
       `Vendored frpc missing (${src}). Run apps/runner/scripts/fetch-frpc.sh.`
     );
   }
-  const staged = await import_promises4.default.stat(p.binary).catch(() => null);
-  const source = await import_promises4.default.stat(src);
+  const staged = await import_promises5.default.stat(p.binary).catch(() => null);
+  const source = await import_promises5.default.stat(src);
   if (staged?.size === source.size) return;
-  await import_promises4.default.mkdir(p.binDir, { recursive: true });
-  await import_promises4.default.copyFile(src, p.binary);
-  await import_promises4.default.chmod(p.binary, 493);
+  await import_promises5.default.mkdir(p.binDir, { recursive: true });
+  await import_promises5.default.copyFile(src, p.binary);
+  await import_promises5.default.chmod(p.binary, 493);
 }
 var EXPOSE_SKILL_NAME = "share-a-port";
 var FENCE = "```";
@@ -15920,18 +16047,18 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
     await this.core.ensureSpaceWorkspace();
     await assertAgentSignedIn(session.provider, this.core.target());
     if (hasGit) {
-      const { path: path18 } = await addWorktree(
+      const { path: path20 } = await addWorktree(
         this.core.target(),
         session.taskId,
         baseBranch || config.mainBranch || "main",
         "card"
       );
-      session.workspacePath = path18;
+      session.workspacePath = path20;
       await setGitIdentity(
         this.core.target(),
         config.gitName,
         config.gitEmail,
-        path18
+        path20
       );
       this.emitter.addLog(session, "system", "Worktree ready.");
     } else {
@@ -16153,18 +16280,18 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
     this.emitter.addLog(session, "system", "Preparing environment...");
     await this.core.ensureSpaceWorkspace();
     await assertAgentSignedIn(session.provider, this.core.target());
-    const { path: path18 } = await addWorktree(
+    const { path: path20 } = await addWorktree(
       this.core.target(),
       session.taskId,
       config.mainBranch || "main",
       "card"
     );
-    session.workspacePath = path18;
+    session.workspacePath = path20;
     await setGitIdentity(
       this.core.target(),
       config.gitName,
       config.gitEmail,
-      path18
+      path20
     );
     await this.putCard(session);
     const patchDir = `${this.core.target().paths.root}/patches/${session.taskId}`;
@@ -16711,12 +16838,12 @@ var FLUSH_MS = 120;
 var SELF_WRITE_MS = 2e3;
 var dynamicImport = new Function("s", "return import(s)");
 var importFs = new Function("s", "return import(s)");
-async function resolveReal(path18) {
+async function resolveReal(path20) {
   try {
     const { realpath } = await importFs("fs/promises");
-    return await realpath(path18);
+    return await realpath(path20);
   } catch {
-    return path18;
+    return path20;
   }
 }
 var loadSubscribe = null;
@@ -16830,19 +16957,19 @@ var WorkspaceWatcher = class {
   }
   record(kind, relPath) {
     if (this.closed) return;
-    const path18 = "/" + relPath;
-    const expiry = this.selfWrites.get(path18);
+    const path20 = "/" + relPath;
+    const expiry = this.selfWrites.get(path20);
     if (expiry !== void 0) {
       if (expiry > Date.now()) return;
-      this.selfWrites.delete(path18);
+      this.selfWrites.delete(path20);
     }
     const { added, changed, removed } = this.pending;
-    added.delete(path18);
-    changed.delete(path18);
-    removed.delete(path18);
-    if (kind === "added") added.add(path18);
-    else if (kind === "changed") changed.add(path18);
-    else removed.add(path18);
+    added.delete(path20);
+    changed.delete(path20);
+    removed.delete(path20);
+    if (kind === "added") added.add(path20);
+    else if (kind === "changed") changed.add(path20);
+    else removed.add(path20);
     if (added.size + changed.size + removed.size > MAX_BATCH) {
       this.pending = { ...emptyPending(), resync: true };
     }
@@ -16861,8 +16988,8 @@ var WorkspaceWatcher = class {
     this.pending = emptyPending();
     if (!resync && !added.size && !changed.size && !removed.size) return;
     const now = Date.now();
-    for (const [path18, expiry] of this.selfWrites) {
-      if (expiry <= now) this.selfWrites.delete(path18);
+    for (const [path20, expiry] of this.selfWrites) {
+      if (expiry <= now) this.selfWrites.delete(path20);
     }
     this.emit({
       added: resync ? [] : [...added],
@@ -17066,8 +17193,8 @@ var TerminalModeEngine = class {
   /** Suppress the change event our own write is about to produce, so a save
    *  never comes back to the editor as an outside edit. Normalized to the form
    *  the watcher emits, since callers spell the path either way. */
-  expectWrite(postId, path18) {
-    this.watchers.get(postId)?.expectWrite(posixNormalize(path18));
+  expectWrite(postId, path20) {
+    this.watchers.get(postId)?.expectWrite(posixNormalize(path20));
   }
   // ── Lifecycle / ModeEngine ──
   start(base, args) {
@@ -17264,18 +17391,18 @@ var TerminalModeEngine = class {
         this.reservedNames.values()
       );
       this.reservedNames.set(session.postId, workName);
-      const { path: path18 } = await addWorktree(
+      const { path: path20 } = await addWorktree(
         this.core.target(),
         workName,
         branch,
         "terminal"
       );
-      session.workspacePath = path18;
+      session.workspacePath = path20;
       await setGitIdentity(
         this.core.target(),
         config.gitName,
         config.gitEmail,
-        path18
+        path20
       );
       this.emitter.addLog(session, "system", "Worktree ready.");
     } else {
@@ -17337,11 +17464,11 @@ var TerminalModeEngine = class {
   }
   async bareFsList({
     postId,
-    path: path18
+    path: path20
   }) {
     const target = this.getBareTarget(postId);
     const root = this.getBareRoot(postId);
-    const abs = this.resolveBarePath(path18, root);
+    const abs = this.resolveBarePath(path20, root);
     const relRoot = abs.slice(root.length) || "/";
     const out = await target.run([
       "sh",
@@ -17391,30 +17518,30 @@ var TerminalModeEngine = class {
   }
   async bareFsRead({
     postId,
-    path: path18
+    path: path20
   }) {
     const target = this.getBareTarget(postId);
-    const abs = this.resolveBarePath(path18, this.getBareRoot(postId));
+    const abs = this.resolveBarePath(path20, this.getBareRoot(postId));
     const b64 = (await target.sh(`base64 < ${shEscape(abs)} | tr -d '
 '`)).trim();
     return { content: b64, encoding: "base64" };
   }
   async bareFsWrite({
     postId,
-    path: path18,
+    path: path20,
     content,
     encoding
   }) {
     const target = this.getBareTarget(postId);
-    const abs = this.resolveBarePath(path18, this.getBareRoot(postId));
+    const abs = this.resolveBarePath(path20, this.getBareRoot(postId));
     const b64 = encoding === "base64" ? content : Buffer.from(content, "utf-8").toString("base64");
     if (!/^[A-Za-z0-9+/=\n\r]*$/.test(b64)) {
       throw new Error("Invalid base64 payload.");
     }
-    this.expectWrite(String(postId), path18);
+    this.expectWrite(String(postId), path20);
     await writeBase64File(target, abs, b64);
     const session = this.sessions.get(String(postId));
-    if (session) delete session.buffers[path18];
+    if (session) delete session.buffers[path20];
   }
   /** Append one chunk of a dropped image to the per-space drops dir
    *  (`paths.root`, OUTSIDE the card worktree so it never touches the repo).
@@ -17464,39 +17591,39 @@ var TerminalModeEngine = class {
   }
   bareOpenFile({
     postId: rawPostId,
-    path: path18
+    path: path20
   }) {
     const session = this.sessions.get(String(rawPostId));
     if (!session || session.mode !== "bare") return;
-    if (!session.openedFiles.includes(path18)) {
-      session.openedFiles.push(path18);
+    if (!session.openedFiles.includes(path20)) {
+      session.openedFiles.push(path20);
     }
   }
   bareCloseFile({
     postId: rawPostId,
-    path: path18
+    path: path20
   }) {
     const session = this.sessions.get(String(rawPostId));
     if (!session || session.mode !== "bare") return;
-    session.openedFiles = session.openedFiles.filter((p) => p !== path18);
-    delete session.buffers[path18];
+    session.openedFiles = session.openedFiles.filter((p) => p !== path20);
+    delete session.buffers[path20];
   }
   bareBufferSet({
     postId: rawPostId,
-    path: path18,
+    path: path20,
     content
   }) {
     const session = this.sessions.get(String(rawPostId));
     if (!session || session.mode !== "bare") return;
-    session.buffers[path18] = content;
+    session.buffers[path20] = content;
   }
   async bareFsDelete({
     postId,
-    path: path18
+    path: path20
   }) {
     const target = this.getBareTarget(postId);
     const root = this.getBareRoot(postId);
-    const abs = this.resolveBarePath(path18, root);
+    const abs = this.resolveBarePath(path20, root);
     if (abs === root) {
       throw new Error("Refusing to delete the repo root.");
     }
@@ -17504,10 +17631,10 @@ var TerminalModeEngine = class {
   }
   async bareFsMkdir({
     postId,
-    path: path18
+    path: path20
   }) {
     const target = this.getBareTarget(postId);
-    const abs = this.resolveBarePath(path18, this.getBareRoot(postId));
+    const abs = this.resolveBarePath(path20, this.getBareRoot(postId));
     await target.sh(`mkdir -p ${shEscape(abs)}`);
   }
   async bareReview({
@@ -18189,8 +18316,8 @@ async function pollGithubDeviceCode(clientId, deviceCode) {
       };
   }
 }
-async function githubApi(token, path18) {
-  const res = await fetch(`${API_BASE}${path18}`, {
+async function githubApi(token, path20) {
+  const res = await fetch(`${API_BASE}${path20}`, {
     headers: {
       Authorization: `Bearer ${token}`,
       Accept: "application/vnd.github+json",
@@ -18199,7 +18326,7 @@ async function githubApi(token, path18) {
   });
   if (!res.ok) {
     throw new Error(
-      `GitHub ${path18} failed (${res.status}): ${await res.text()}`
+      `GitHub ${path20} failed (${res.status}): ${await res.text()}`
     );
   }
   return await res.json();
@@ -18244,13 +18371,13 @@ async function listGithubBranches(token, fullName) {
 }
 
 // ../../shared/all/helpers/board-agent-core/host-run.ts
-var import_path8 = __toESM(require("path"));
+var import_path9 = __toESM(require("path"));
 
 // ../../shared/all/helpers/board-agent-core/host-secrets.ts
 var import_child_process4 = require("child_process");
 var import_crypto2 = __toESM(require("crypto"));
-var import_promises5 = __toESM(require("fs/promises"));
-var import_path7 = __toESM(require("path"));
+var import_promises6 = __toESM(require("fs/promises"));
+var import_path8 = __toESM(require("path"));
 var import_util6 = require("util");
 var execFileAsync3 = (0, import_util6.promisify)(import_child_process4.execFile);
 var IDENTITY_FILE = "age-identity.enc";
@@ -18283,7 +18410,7 @@ function deriveKey(password, salt) {
 }
 async function secretsInitialized(configDir) {
   try {
-    await import_promises5.default.access(import_path7.default.join(configDir, IDENTITY_FILE));
+    await import_promises6.default.access(import_path8.default.join(configDir, IDENTITY_FILE));
     return true;
   } catch {
     return false;
@@ -18322,10 +18449,10 @@ async function initSecrets(configDir, password) {
     tag: cipher.getAuthTag().toString("base64"),
     data: data.toString("base64")
   };
-  await import_promises5.default.writeFile(import_path7.default.join(configDir, IDENTITY_FILE), JSON.stringify(box), {
+  await import_promises6.default.writeFile(import_path8.default.join(configDir, IDENTITY_FILE), JSON.stringify(box), {
     mode: 384
   });
-  await import_promises5.default.writeFile(import_path7.default.join(configDir, RECIPIENT_FILE), `${recipient}
+  await import_promises6.default.writeFile(import_path8.default.join(configDir, RECIPIENT_FILE), `${recipient}
 `, {
     mode: 384
   });
@@ -18348,17 +18475,17 @@ function decryptIdentity(box, password) {
   }
 }
 function envPath(spaceDir) {
-  return import_path7.default.join(spaceDir, "secrets", ENV_FILE);
+  return import_path8.default.join(spaceDir, "secrets", ENV_FILE);
 }
 async function identityFor(configDir, password) {
   const box = JSON.parse(
-    await import_promises5.default.readFile(import_path7.default.join(configDir, IDENTITY_FILE), "utf-8")
+    await import_promises6.default.readFile(import_path8.default.join(configDir, IDENTITY_FILE), "utf-8")
   );
   return decryptIdentity(box, password);
 }
 async function readEnv(spaceDir, identity) {
   try {
-    await import_promises5.default.access(envPath(spaceDir));
+    await import_promises6.default.access(envPath(spaceDir));
   } catch {
     return {};
   }
@@ -18387,14 +18514,14 @@ async function readEnv(spaceDir, identity) {
   return values;
 }
 async function writeEnv(configDir, spaceDir, identity, values) {
-  const recipient = (await import_promises5.default.readFile(import_path7.default.join(configDir, RECIPIENT_FILE), "utf-8")).trim();
+  const recipient = (await import_promises6.default.readFile(import_path8.default.join(configDir, RECIPIENT_FILE), "utf-8")).trim();
   const plain = `${Object.entries(values).map(([k, v]) => `${k}=${v}`).join("\n")}
 `;
   const tmp = envPath(spaceDir).replace(
     /\.enc\.env$/,
     `.${process.pid}.tmp.env`
   );
-  await import_promises5.default.writeFile(tmp, plain, { mode: 384 });
+  await import_promises6.default.writeFile(tmp, plain, { mode: 384 });
   try {
     const { stdout } = await execFileAsync3(
       "sops",
@@ -18413,9 +18540,9 @@ async function writeEnv(configDir, spaceDir, identity, values) {
         maxBuffer: 4 * 1024 * 1024
       }
     );
-    await import_promises5.default.writeFile(envPath(spaceDir), stdout, { mode: 384 });
+    await import_promises6.default.writeFile(envPath(spaceDir), stdout, { mode: 384 });
   } finally {
-    await import_promises5.default.rm(tmp, { force: true });
+    await import_promises6.default.rm(tmp, { force: true });
   }
 }
 async function listSecretKeys(configDir, spaceDir, password) {
@@ -18453,16 +18580,6 @@ var FAILED_MARKER = "DEPLOY_FAILED:";
 var MAX_MARKERLESS_TURNS = 3;
 var COMMAND_TIMEOUT_MS = 45 * 6e4;
 var tail = (s, max = 8e3) => s.length > max ? s.slice(-max) : s;
-function redactor(values) {
-  const significant = values.filter((v) => v.length >= 4);
-  return (text) => {
-    let out = text;
-    for (const value2 of significant) {
-      out = out.split(value2).join("[REDACTED]");
-    }
-    return out;
-  };
-}
 function tailMarker(text) {
   const zone = text.slice(-2e3);
   let best = null;
@@ -18479,10 +18596,52 @@ function tailMarker(text) {
   const value2 = zone.slice(best.at + best.marker.length).trim();
   return value2 ? { marker: best.marker, value: value2 } : null;
 }
+function containedCwd(cwd, spaceDir) {
+  if (!cwd) return null;
+  const resolved = import_path9.default.resolve(cwd);
+  const root = import_path9.default.resolve(spaceDir);
+  return resolved === root || resolved.startsWith(root + import_path9.default.sep) ? resolved : null;
+}
+async function authorizeAndRun(opts) {
+  const { command, hooks } = opts;
+  opts.status?.("waiting for the owner to authorize this command");
+  let secrets = null;
+  let authError = "";
+  while (!secrets) {
+    const auth = await hooks.requestAuth(command, authError);
+    if ("denied" in auth) return { denied: true };
+    try {
+      secrets = await secretsForInjection(
+        opts.configDir,
+        opts.spaceDir,
+        auth.password
+      );
+    } catch (err) {
+      authError = err instanceof Error ? err.message : String(err);
+      opts.status?.(`authorization failed: ${authError}`);
+    }
+  }
+  const redact = redactor(Object.values(secrets));
+  opts.status?.("authorized, running");
+  hooks.sendLog({
+    type: "system",
+    content: "Authorized. Running the command with secrets injected..."
+  });
+  const res = await execLogin(command, {
+    cwd: opts.cwd,
+    env: { ...process.env, ...spaceEnv(opts.spaceDir), ...secrets },
+    timeout: COMMAND_TIMEOUT_MS,
+    maxBuffer: 32 * 1024 * 1024
+  });
+  const output = redact(res.output);
+  hooks.sendLog({ type: "tool", content: `$ ${command}
+${tail(output)}` });
+  return { code: res.code, output };
+}
 async function startDeployRun(opts) {
   const { hooks } = opts;
-  const workspace = import_path8.default.join(opts.spaceDir, "workspace");
-  const configDir = import_path8.default.dirname(opts.spaceDir);
+  const workspace = import_path9.default.join(opts.spaceDir, "workspace");
+  const configDir = import_path9.default.dirname(opts.spaceDir);
   const status = await checkDeployStatus(opts);
   if (!status.hasSkill || !status.hasVariables || !status.hasChecker) {
     throw new Error(
@@ -18503,7 +18662,7 @@ async function startDeployRun(opts) {
   await hostGit(workspace, "clean", "-fd");
   await ensureClaudeSkillLink(workspace);
   const contract = prompts_default.deployRun.join("\n");
-  const reminder = "Reminder: every declared deploy variable is intentionally unset in your shell. Never check for them or abort over them - route any command that needs one through NEED_SECRETS and the runner injects the values.";
+  const reminder = "Reminder: every declared deploy variable is intentionally unset in your shell. Never check for them or abort over them - prefix any command that needs one with `factiii-secrets run --` and the runner injects the values.";
   let prompt2 = opts.provider === "codex" ? `Use the "deploy" skill: load it and execute it step by step.
 
 ${reminder}` : `/deploy
@@ -18512,109 +18671,105 @@ ${reminder}`;
   let sessionId = "";
   let markerless = 0;
   let todos = [];
-  for (; ; ) {
-    if (hooks.isCancelled()) throw new Error("Cancelled by user.");
-    const { proc, result } = await spawnAgent(
-      opts.provider,
-      hostTarget(opts.spaceDir),
-      {
-        cwd: workspace,
-        prompt: prompt2,
-        allowedTools: "Bash,Read,Grep,Glob,TodoWrite,WebSearch,WebFetch",
-        // The run's guardrails are structural (merge-gated skill, per-command
-        // authorization, runner-side injection); the auto classifier fights
-        // legitimate infrastructure commands, so the session itself runs open.
-        permissionMode: "bypassPermissions",
-        model: "claude-opus-4-6",
-        includePartialMessages: true,
-        resumeSessionId: sessionId || void 0,
-        appendSystemPrompt: sessionId ? void 0 : contract,
-        env: spaceEnv(opts.spaceDir),
-        callbacks: {
-          initialTodos: todos,
-          onLog: (entry) => hooks.sendLog(entry),
-          onTodos: (updated) => {
-            todos = updated;
-            hooks.onTodos(updated);
+  const bridge = await startSecretsBridge({
+    spaceDir: opts.spaceDir,
+    handlers: {
+      run: ({ command, cwd, status: report }) => authorizeAndRun({
+        configDir,
+        spaceDir: opts.spaceDir,
+        // A skill legitimately cds into subdirectories, so the CLI's own cwd
+        // is the right place to run - but only while it is still inside the
+        // space. Anywhere else is a confused caller, not a step, and the
+        // workspace is the safe reading of what it meant.
+        cwd: containedCwd(cwd, opts.spaceDir) ?? workspace,
+        command,
+        hooks,
+        status: report
+      }),
+      // Names only. The contract on the default branch already declares them
+      // in public, so this reveals nothing the repo does not.
+      list: () => Promise.resolve(status.variables.map((v) => v.key))
+    }
+  });
+  try {
+    for (; ; ) {
+      if (hooks.isCancelled()) throw new Error("Cancelled by user.");
+      const { proc, result } = await spawnAgent(
+        opts.provider,
+        hostTarget(opts.spaceDir),
+        {
+          cwd: workspace,
+          prompt: prompt2,
+          allowedTools: "Bash,Read,Grep,Glob,TodoWrite,WebSearch,WebFetch,Skill",
+          // The run's guardrails are structural (merge-gated skill, per-command
+          // authorization, runner-side injection); the auto classifier fights
+          // legitimate infrastructure commands, so the session itself runs open.
+          permissionMode: "bypassPermissions",
+          includePartialMessages: true,
+          resumeSessionId: sessionId || void 0,
+          appendSystemPrompt: sessionId ? void 0 : contract,
+          env: spaceEnv(opts.spaceDir),
+          callbacks: {
+            initialTodos: todos,
+            onLog: (entry) => hooks.sendLog(entry),
+            onTodos: (updated) => {
+              todos = updated;
+              hooks.onTodos(updated);
+            }
           }
         }
-      }
-    );
-    hooks.registerProc(proc);
-    const { text, sessionId: sid } = await result;
-    hooks.registerProc(null);
-    sessionId = sid || sessionId;
-    if (hooks.isCancelled()) throw new Error("Cancelled by user.");
-    const found = tailMarker(text);
-    if (found?.marker === SECRETS_MARKER) {
-      const command = found.value.split("\n")[0].trim();
-      let secrets = null;
-      let denied = false;
-      let authError = "";
-      while (!secrets && !denied) {
-        const auth = await hooks.requestAuth(command, authError);
-        if ("denied" in auth) {
-          denied = true;
-          break;
-        }
-        try {
-          secrets = await secretsForInjection(
-            configDir,
-            opts.spaceDir,
-            auth.password
-          );
-        } catch (err) {
-          authError = err instanceof Error ? err.message : String(err);
+      );
+      hooks.registerProc(proc);
+      const { text, sessionId: sid } = await result;
+      hooks.registerProc(null);
+      sessionId = sid || sessionId;
+      if (hooks.isCancelled()) throw new Error("Cancelled by user.");
+      const found = tailMarker(text);
+      if (found?.marker === SECRETS_MARKER) {
+        const command = found.value.split("\n")[0].trim();
+        const res = await authorizeAndRun({
+          configDir,
+          spaceDir: opts.spaceDir,
+          cwd: workspace,
+          command,
+          hooks
+        });
+        if ("denied" in res) {
+          prompt2 = "The owner declined to run that command. Adapt or stop and summarize where the release stands.";
+          continue;
         }
+        markerless = 0;
+        const clean = tail(res.output);
+        prompt2 = `The authorized command finished (exit ${res.code}). Redacted output:
+
+${clean}`;
+        continue;
       }
-      if (denied || !secrets) {
-        prompt2 = "The owner declined to run that command. Adapt or stop and summarize where the release stands.";
+      if (found?.marker === HUMAN_MARKER) {
+        markerless = 0;
+        prompt2 = await hooks.requestHuman(found.value);
         continue;
       }
-      const redact = redactor(Object.values(secrets));
+      if (found?.marker === COMPLETE_MARKER) {
+        return { shipped: true, summary: found.value };
+      }
+      if (found?.marker === FAILED_MARKER) {
+        return { shipped: false, summary: found.value };
+      }
+      markerless += 1;
+      if (markerless >= MAX_MARKERLESS_TURNS) {
+        throw new Error(
+          "The run ended without declaring completion (no DEPLOY_COMPLETE after repeated turns)."
+        );
+      }
       hooks.sendLog({
         type: "system",
-        content: `Authorized. Running the command with secrets injected...`
-      });
-      const res = await execLogin(command, {
-        cwd: workspace,
-        env: { ...process.env, ...spaceEnv(opts.spaceDir), ...secrets },
-        timeout: COMMAND_TIMEOUT_MS,
-        maxBuffer: 32 * 1024 * 1024
+        content: "Turn ended without a protocol marker - resuming the run..."
       });
-      const output = res.output;
-      const exitNote = `exit ${res.code}`;
-      markerless = 0;
-      const clean = redact(tail(output));
-      hooks.sendLog({ type: "tool", content: `$ ${command}
-${clean}` });
-      prompt2 = `The authorized command finished (${exitNote}). Redacted output:
-
-${clean}`;
-      continue;
-    }
-    if (found?.marker === HUMAN_MARKER) {
-      markerless = 0;
-      prompt2 = await hooks.requestHuman(found.value);
-      continue;
-    }
-    if (found?.marker === COMPLETE_MARKER) {
-      return { shipped: true, summary: found.value };
+      prompt2 = "Your turn ended with no protocol marker. If the release fully shipped, end your message with DEPLOY_COMPLETE: followed by your run report; if you are stopping without shipping, end with DEPLOY_FAILED: followed by the report. Otherwise CONTINUE executing the skill from where you left off. If you had background tasks running, they were killed when your turn ended - rerun them, and reap every background task before ending a turn.";
     }
-    if (found?.marker === FAILED_MARKER) {
-      return { shipped: false, summary: found.value };
-    }
-    markerless += 1;
-    if (markerless >= MAX_MARKERLESS_TURNS) {
-      throw new Error(
-        "The run ended without declaring completion (no DEPLOY_COMPLETE after repeated turns)."
-      );
-    }
-    hooks.sendLog({
-      type: "system",
-      content: "Turn ended without a protocol marker - resuming the run..."
-    });
-    prompt2 = "Your turn ended with no protocol marker. If the release fully shipped, end your message with DEPLOY_COMPLETE: followed by your run report; if you are stopping without shipping, end with DEPLOY_FAILED: followed by the report. Otherwise CONTINUE executing the skill from where you left off. If you had background tasks running, they were killed when your turn ended - rerun them, and reap every background task before ending a turn.";
+  } finally {
+    await bridge.close().catch(() => void 0);
   }
 }
 
@@ -18706,44 +18861,110 @@ async function getDriveRoot(accessToken) {
   };
 }
 
+// ../../shared/all/helpers/board-agent-core/space-core.ts
+var import_promises8 = require("fs/promises");
+var import_path11 = __toESM(require("path"));
+
 // ../../shared/all/helpers/board-agent-core/plugin.ts
+var import_crypto3 = __toESM(require("crypto"));
 var import_fs3 = require("fs");
-var import_promises6 = require("fs/promises");
+var import_promises7 = require("fs/promises");
 var import_os3 = __toESM(require("os"));
-var import_path9 = __toESM(require("path"));
-var PLUGIN_ID = "factiii@factiii-runner";
+var import_path10 = __toESM(require("path"));
+var MARKETPLACE_NAME = "factiii-runner";
+var PLUGIN_ID = `factiii@${MARKETPLACE_NAME}`;
+var SECRETS_BIN = "factiii-secrets";
 function candidates() {
   return [
-    import_path9.default.join(__dirname, "..", "plugin"),
-    import_path9.default.join(__dirname, "..", "..", "..", "..", "apps", "runner", "plugin"),
-    import_path9.default.join(process.cwd(), "apps", "runner", "plugin")
+    import_path10.default.join(__dirname, "..", "plugin"),
+    import_path10.default.join(__dirname, "..", "..", "..", "..", "apps", "runner", "plugin"),
+    import_path10.default.join(process.cwd(), "apps", "runner", "plugin")
   ];
 }
 function pluginRoot() {
   for (const dir of candidates()) {
-    if ((0, import_fs3.existsSync)(import_path9.default.join(dir, ".claude-plugin", "marketplace.json"))) {
+    if ((0, import_fs3.existsSync)(import_path10.default.join(dir, ".claude-plugin", "marketplace.json"))) {
       return dir;
     }
   }
   return null;
 }
 function renderedPluginRoot() {
-  return import_path9.default.join(import_os3.default.homedir(), ".factiii-runner", "plugin");
+  return import_path10.default.join(import_os3.default.homedir(), ".factiii-runner", "plugin");
+}
+async function runnerVersion(source) {
+  const pkg = import_path10.default.join(source, "..", "package.json");
+  const raw = await (0, import_promises7.readFile)(pkg, "utf8").catch(() => null);
+  if (!raw) return FALLBACK_VERSION;
+  try {
+    const { version } = JSON.parse(raw);
+    return version || FALLBACK_VERSION;
+  } catch {
+    return FALLBACK_VERSION;
+  }
+}
+var FALLBACK_VERSION = "0.0.0-unknown";
+async function treeFiles(dir) {
+  const entries = await (0, import_promises7.readdir)(dir, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    const full = import_path10.default.join(dir, entry.name);
+    if (entry.isDirectory()) files.push(...await treeFiles(full));
+    else if (entry.isFile()) files.push(full);
+  }
+  return files.sort();
 }
-async function renderPlugin(boardMcpUrl) {
+async function fingerprint(source, url2, version = "") {
+  const hash = import_crypto3.default.createHash("sha256").update(url2).update(version);
+  for (const file of await treeFiles(source)) {
+    hash.update(import_path10.default.relative(source, file));
+    hash.update(await (0, import_promises7.readFile)(file));
+  }
+  return hash.digest("hex");
+}
+function stampPath(dest) {
+  return `${dest}.stamp`;
+}
+var inFlight = /* @__PURE__ */ new Map();
+function renderPlugin(boardMcpUrl) {
+  const running = inFlight.get(boardMcpUrl);
+  if (running) return running;
+  const started = renderPluginImpl(boardMcpUrl).finally(
+    () => inFlight.delete(boardMcpUrl)
+  );
+  inFlight.set(boardMcpUrl, started);
+  return started;
+}
+async function renderPluginImpl(boardMcpUrl) {
   const source = pluginRoot();
   if (!source) return null;
   const dest = renderedPluginRoot();
-  const manifest = import_path9.default.join(dest, "factiii", ".mcp.json");
-  const want = `${JSON.stringify(boardMcpConfig(boardMcpUrl), null, 2)}
-`;
-  const have = await (0, import_promises6.readFile)(manifest, "utf8").catch(() => null);
+  const version = await runnerVersion(source);
+  const want = await fingerprint(source, boardMcpUrl, version);
+  const have = await (0, import_promises7.readFile)(stampPath(dest), "utf8").catch(() => null);
   if (have === want) return dest;
-  await (0, import_promises6.mkdir)(import_path9.default.dirname(dest), { recursive: true });
-  await (0, import_promises6.cp)(source, dest, { recursive: true, force: true });
-  await (0, import_promises6.writeFile)(manifest, want);
+  await (0, import_promises7.mkdir)(import_path10.default.dirname(dest), { recursive: true });
+  await (0, import_promises7.cp)(source, dest, { recursive: true, force: true });
+  await (0, import_promises7.writeFile)(
+    import_path10.default.join(dest, "factiii", ".mcp.json"),
+    `${JSON.stringify(boardMcpConfig(boardMcpUrl), null, 2)}
+`
+  );
+  await stampVersion(dest, version);
+  await (0, import_promises7.writeFile)(stampPath(dest), want);
   return dest;
 }
+async function stampVersion(dest, version) {
+  const manifest = import_path10.default.join(dest, "factiii", ".claude-plugin", "plugin.json");
+  const raw = await (0, import_promises7.readFile)(manifest, "utf8").catch(() => null);
+  if (!raw) return;
+  const parsed = JSON.parse(raw);
+  await (0, import_promises7.writeFile)(
+    manifest,
+    `${JSON.stringify({ ...parsed, version }, null, 2)}
+`
+  );
+}
 function boardMcpConfig(url2) {
   return {
     mcpServers: {
@@ -18987,6 +19208,8 @@ var SpaceCore = class {
     this.execTarget ??= hostTarget(this.spaceDir(), () => {
       const env = {};
       for (const lane of this.mcpLanes()) env[lane.tokenEnv] = lane.mcp.token;
+      const board = this.boardMcp();
+      if (board) env[BOARD_MCP_TOKEN_ENV] = board.token;
       return env;
     });
     return this.execTarget;
@@ -19167,6 +19390,7 @@ var SpaceCore = class {
           this.provisionGitLane(status),
           this.provisionMcpLane(),
           this.provisionPluginLane(),
+          this.provisionBinLane(),
           // Covers a host signed in outside the one-click button, which would
           // otherwise meet the wizard the first time it opens a terminal.
           markOnboardingComplete(target).catch(() => {
@@ -19227,6 +19451,13 @@ var SpaceCore = class {
     const cmd = [
       `claude plugin marketplace add ${q} >/dev/null 2>&1 || true`,
       `claude plugin install ${PLUGIN_ID} --scope user >/dev/null 2>&1 || true`,
+      // Both CLIs install by COPYING the plugin into a cache keyed by its
+      // version, and that copy is what loads. claude's `install` refuses once
+      // something is installed ("already installed"), so without these two an
+      // upgrade renders new files into a directory nothing reads again. Codex
+      // needs no equivalent: its `add` re-installs from a local marketplace.
+      `claude plugin marketplace update ${MARKETPLACE_NAME} >/dev/null 2>&1 || true`,
+      `claude plugin update ${PLUGIN_ID} >/dev/null 2>&1 || true`,
       `codex plugin marketplace add ${q} >/dev/null 2>&1 || true`,
       `codex plugin add ${PLUGIN_ID} >/dev/null 2>&1 || true`
     ].join("; ");
@@ -19235,6 +19466,35 @@ var SpaceCore = class {
     } catch {
     }
   }
+  /** Stage the plugin's `factiii-secrets` onto the agent's PATH.
+   *
+   *  A skill can only teach a command that exists. `paths.bin` is already the
+   *  PATH prefix `agentEnv()` hands every spawn (it is how `factiii-expose`
+   *  resolves), but nothing put anything there for a deploy run - so the
+   *  skill would name a command the shell could not find.
+   *
+   *  Copied rather than symlinked: an `npm i -g @factiii/runner` upgrade
+   *  replaces the package directory, and a link into the old one dangles.
+   *  Re-copied whenever the sizes differ, which is what carries an upgrade
+   *  through without re-copying on every ensure. */
+  async provisionBinLane() {
+    const source = pluginRoot();
+    if (!source) return;
+    const { bin } = this.target().paths;
+    const from = import_path11.default.join(source, "factiii", "bin", SECRETS_BIN);
+    const to = import_path11.default.join(bin, SECRETS_BIN);
+    try {
+      const [src, staged] = await Promise.all([
+        (0, import_promises8.stat)(from),
+        (0, import_promises8.stat)(to).catch(() => null)
+      ]);
+      if (staged?.size === src.size) return;
+      await (0, import_promises8.mkdir)(bin, { recursive: true });
+      await (0, import_promises8.copyFile)(from, to);
+      await (0, import_promises8.chmod)(to, 493);
+    } catch {
+    }
+  }
   // Register this space's MCPs with both CLIs, user-scoped, and clear the ones
   // it cannot currently offer. Registering regardless left every space holding
   // an entry it never uses, which the CLI then fails to handshake with on every
@@ -19335,6 +19595,10 @@ var BoardAgentEngine = class _BoardAgentEngine {
     // In-flight creator session, memory-only (the repo is the source of truth
     // once merged). Survives modal reopen via deployCreatorState.
     this.skillCreatorSessionId = null;
+    // Which CLI produced that session. A resume id belongs to ONE provider, so
+    // switching the picker between drafting and revising has to start fresh
+    // rather than hand a claude session id to codex.
+    this.skillCreatorProvider = null;
     // Set when the draft was resumed from a pushed deploy-skill branch:
     // approve commits onto that branch instead of cutting a new one.
     this.skillDraftBranch = null;
@@ -19355,6 +19619,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
     // ── Deploy run (host executor; see host-run.ts + .specs/deploy.md) ──
     // Memory-only: reopened clients reattach, a restart loses the run and says so.
     this.runState = {
+      provider: "claude",
       phase: "idle",
       todos: [],
       logs: [],
@@ -19498,6 +19763,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
     });
     const draft = await loadSkillDraft({ ...opts, branch: payload.branch });
     this.skillCreatorSessionId = null;
+    this.skillCreatorProvider = null;
     this.skillDraftBranch = payload.branch;
     this.creatorState = { phase: "review", logs: [], draft, error: "" };
     return draft;
@@ -19543,8 +19809,8 @@ var BoardAgentEngine = class _BoardAgentEngine {
       throw err;
     }
   }
-  deployFixEnvironment(sendLog) {
-    const opts = this.deployCreatorOpts(sendLog);
+  deployFixEnvironment(sendLog, provider) {
+    const opts = this.deployCreatorOpts(sendLog, provider);
     return this.runEnvPass(
       "fixing",
       () => fixEnvironment({
@@ -19608,13 +19874,14 @@ var BoardAgentEngine = class _BoardAgentEngine {
         return this.activity.clear("deploy-run");
     }
   }
-  deployRunStart(sendLog) {
+  deployRunStart(sendLog, provider) {
     if (this.runState.phase === "running" || this.runState.phase === "awaiting-input" || this.runState.phase === "awaiting-auth") {
       throw new Error("A deploy run is already in progress.");
     }
-    const opts = this.deployCreatorOpts(sendLog);
+    const opts = this.deployCreatorOpts(sendLog, provider);
     this.runCancelled = false;
     this.runState = {
+      provider: opts.provider,
       phase: "running",
       todos: [],
       logs: [],
@@ -19735,6 +20002,9 @@ var BoardAgentEngine = class _BoardAgentEngine {
       throw new Error("A deploy run is still in progress.");
     }
     this.runState = {
+      // Unread while idle - the next run sets its own. Carried rather than
+      // reset so nothing has to invent a provider that means nothing yet.
+      provider: this.runState.provider,
       phase: "idle",
       todos: [],
       logs: [],
@@ -19833,7 +20103,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
       throw err;
     }
   }
-  deployCreatorOpts(sendLog) {
+  deployCreatorOpts(sendLog, provider) {
     const config = this.core.readConfig();
     if (!config.repoUrl || !config.githubToken) {
       throw new Error("Set the repository URL and GitHub token first.");
@@ -19843,36 +20113,51 @@ var BoardAgentEngine = class _BoardAgentEngine {
       repoUrl: config.repoUrl,
       mainBranch: config.mainBranch,
       githubToken: config.githubToken,
-      provider: this.core.agentProvider(),
+      // resolveProvider coerces anything unknown to claude, so it can only be
+      // asked about a value that is actually there.
+      provider: provider ? resolveProvider(provider) : this.core.agentProvider(),
       sendLog
     };
   }
   deployCreateSkill(payload, sendLog) {
     this.skillDraftBranch = null;
     return this.runCreatorPass(async () => {
+      const opts = this.deployCreatorOpts(
+        this.creatorLogger(sendLog),
+        payload.provider
+      );
       const { sessionId, ...draft } = await generateDeploySkill({
-        ...this.deployCreatorOpts(this.creatorLogger(sendLog)),
+        ...opts,
         instructions: payload.instructions
       });
       this.skillCreatorSessionId = sessionId || null;
+      this.skillCreatorProvider = opts.provider;
       return draft;
     });
   }
   deployReviseSkill(payload, sendLog) {
     return this.runCreatorPass(async () => {
+      const opts = this.deployCreatorOpts(
+        this.creatorLogger(sendLog),
+        payload.provider
+      );
+      const resumable = this.skillCreatorProvider === opts.provider;
       const { sessionId, ...draft } = await reviseDeploySkill({
-        ...this.deployCreatorOpts(this.creatorLogger(sendLog)),
+        ...opts,
         feedback: payload.feedback,
-        resumeSessionId: this.skillCreatorSessionId ?? void 0
+        // A different CLI than drafted this: its session id means nothing to
+        // the new one, so the revision starts from the files on disk.
+        resumeSessionId: resumable ? this.skillCreatorSessionId ?? void 0 : void 0
       });
       this.skillCreatorSessionId = sessionId || this.skillCreatorSessionId;
+      this.skillCreatorProvider = opts.provider;
       return draft;
     });
   }
   // ── Runner secrets store (secrets.sh contract; see host-secrets.ts) ──
   secretsDirs() {
     const spaceDir = this.core.spaceDir();
-    return { configDir: (0, import_path10.dirname)(spaceDir), spaceDir };
+    return { configDir: (0, import_path12.dirname)(spaceDir), spaceDir };
   }
   async deploySecretsStatus() {
     return {
@@ -19906,6 +20191,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
     const config = this.core.readConfig();
     const onBranch = this.skillDraftBranch ?? void 0;
     this.skillCreatorSessionId = null;
+    this.skillCreatorProvider = null;
     this.skillDraftBranch = null;
     this.creatorState = { phase: "idle", logs: [], draft: null, error: "" };
     this.activity.clear("deploy-skill");
@@ -19918,6 +20204,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
   }
   deployDiscardSkill() {
     this.skillCreatorSessionId = null;
+    this.skillCreatorProvider = null;
     this.skillDraftBranch = null;
     this.creatorState = { phase: "idle", logs: [], draft: null, error: "" };
     this.activity.clear("deploy-skill");
@@ -20722,14 +21009,16 @@ ${c.content.trim() || "(no description)"}`
       case "deployFixEnvironment":
         return await this.deployFixEnvironment(
           askLogSender ?? (() => {
-          })
+          }),
+          payload?.provider
         );
       case "deployEnvState":
         return this.deployEnvState();
       case "deployRunStart":
         return this.deployRunStart(
           askLogSender ?? (() => {
-          })
+          }),
+          payload?.provider
         );
       case "deployRunState":
         return this.deployRunState();
@@ -20929,11 +21218,11 @@ ${c.content.trim() || "(no description)"}`
 
 // ../../shared/all/helpers/board-agent-core/index-service.ts
 var import_child_process5 = require("child_process");
-var import_crypto3 = require("crypto");
+var import_crypto4 = require("crypto");
 var import_fs4 = require("fs");
-var import_promises7 = __toESM(require("fs/promises"));
-var import_net2 = require("net");
-var import_path11 = require("path");
+var import_promises9 = __toESM(require("fs/promises"));
+var import_net3 = require("net");
+var import_path13 = require("path");
 var import_util7 = require("util");
 var execFileAsync4 = (0, import_util7.promisify)(import_child_process5.execFile);
 var IndexService = class {
@@ -20947,7 +21236,7 @@ var IndexService = class {
   /** Per-space bearer for MCP + file, derived from the control token (the
    *  service computes the same). */
   bearerToken(spaceSlug) {
-    return (0, import_crypto3.createHmac)("sha256", this.opts.controlToken).update(`mcp:${spaceSlug}`).digest("hex");
+    return (0, import_crypto4.createHmac)("sha256", this.opts.controlToken).update(`mcp:${spaceSlug}`).digest("hex");
   }
   /** MCP bridge for a space. Null until the service is up (which it kicks
    *  off), so a bad :0 URL is never baked in; provisionMcpLane re-runs. */
@@ -20992,7 +21281,7 @@ var IndexService = class {
     const log = await this.openLog();
     this.proc = (0, import_child_process5.spawn)(
       process.execPath,
-      [(0, import_path11.join)(this.opts.indexDir, "index.js")],
+      [(0, import_path13.join)(this.opts.indexDir, "index.js")],
       {
         cwd: this.opts.indexDir,
         env: {
@@ -21020,8 +21309,8 @@ var IndexService = class {
    *  opened (a missing log must never stop the service from starting). */
   async openLog() {
     try {
-      await import_promises7.default.mkdir(this.opts.dataDir, { recursive: true });
-      return (0, import_fs4.openSync)((0, import_path11.join)(this.opts.dataDir, "index.log"), "a");
+      await import_promises9.default.mkdir(this.opts.dataDir, { recursive: true });
+      return (0, import_fs4.openSync)((0, import_path13.join)(this.opts.dataDir, "index.log"), "a");
     } catch {
       return null;
     }
@@ -21030,10 +21319,10 @@ var IndexService = class {
    *  platform needing node-gyp fails here rather than at query time. */
   async installDeps() {
     const dir = this.opts.indexDir;
-    if ((0, import_fs4.existsSync)((0, import_path11.join)(dir, "node_modules"))) return;
-    await import_promises7.default.copyFile(
-      (0, import_path11.join)(dir, "image-package.json"),
-      (0, import_path11.join)(dir, "package.json")
+    if ((0, import_fs4.existsSync)((0, import_path13.join)(dir, "node_modules"))) return;
+    await import_promises9.default.copyFile(
+      (0, import_path13.join)(dir, "image-package.json"),
+      (0, import_path13.join)(dir, "package.json")
     );
     await execFileAsync4(
       "npm",
@@ -21045,15 +21334,15 @@ var IndexService = class {
    *  CLIs' persistent MCP config, so a fresh port each start would leave every
    *  registration pointing at a dead one. */
   async stablePort() {
-    const file = (0, import_path11.join)(this.opts.dataDir, ".port");
-    const saved = Number(await import_promises7.default.readFile(file, "utf-8").catch(() => ""));
+    const file = (0, import_path13.join)(this.opts.dataDir, ".port");
+    const saved = Number(await import_promises9.default.readFile(file, "utf-8").catch(() => ""));
     if (Number.isInteger(saved) && saved > 0 && await isFree(saved)) {
       return saved;
     }
     const port = await freePort();
-    await import_promises7.default.mkdir(this.opts.dataDir, { recursive: true }).catch(() => {
+    await import_promises9.default.mkdir(this.opts.dataDir, { recursive: true }).catch(() => {
     });
-    await import_promises7.default.writeFile(file, String(port), "utf-8").catch(() => {
+    await import_promises9.default.writeFile(file, String(port), "utf-8").catch(() => {
     });
     return port;
   }
@@ -21147,14 +21436,14 @@ var IndexService = class {
 };
 function isFree(port) {
   return new Promise((resolve2) => {
-    const srv = (0, import_net2.createServer)();
+    const srv = (0, import_net3.createServer)();
     srv.once("error", () => resolve2(false));
     srv.listen(port, "127.0.0.1", () => srv.close(() => resolve2(true)));
   });
 }
 function freePort() {
   return new Promise((resolve2, reject) => {
-    const srv = (0, import_net2.createServer)();
+    const srv = (0, import_net3.createServer)();
     srv.on("error", reject);
     srv.listen(0, "127.0.0.1", () => {
       const addr = srv.address();
@@ -21222,22 +21511,22 @@ async function pairWithBrowser(serverUrl) {
 // src/config.ts
 var import_fs8 = __toESM(require("fs"));
 var import_os6 = __toESM(require("os"));
-var import_path16 = __toESM(require("path"));
+var import_path18 = __toESM(require("path"));
 
 // src/secureFile.ts
-var import_crypto6 = __toESM(require("crypto"));
+var import_crypto7 = __toESM(require("crypto"));
 var import_fs7 = __toESM(require("fs"));
-var import_path15 = __toESM(require("path"));
+var import_path17 = __toESM(require("path"));
 
 // src/keychain.ts
 var import_child_process7 = require("child_process");
-var import_crypto4 = __toESM(require("crypto"));
+var import_crypto5 = __toESM(require("crypto"));
 var import_fs5 = __toESM(require("fs"));
 var import_os4 = __toESM(require("os"));
-var import_path12 = __toESM(require("path"));
+var import_path14 = __toESM(require("path"));
 var SERVICE = "factiii-runner";
 var ACCOUNT = "config-encryption-key";
-var DPAPI_KEY_FILE = import_path12.default.join(
+var DPAPI_KEY_FILE = import_path14.default.join(
   import_os4.default.homedir(),
   ".factiii-runner",
   "config-key.dpapi"
@@ -21343,7 +21632,7 @@ function winWrite(key) {
     "-Command",
     `ConvertTo-SecureString -String '${key.toString("base64")}' -AsPlainText -Force | ConvertFrom-SecureString`
   ]);
-  import_fs5.default.mkdirSync(import_path12.default.dirname(DPAPI_KEY_FILE), { recursive: true });
+  import_fs5.default.mkdirSync(import_path14.default.dirname(DPAPI_KEY_FILE), { recursive: true });
   import_fs5.default.writeFileSync(DPAPI_KEY_FILE, `${out.trim()}
 `, { mode: 384 });
 }
@@ -21483,7 +21772,7 @@ function resolve() {
       cached = { key: null, status: diagnose() };
       return cached;
     }
-    const fresh = import_crypto4.default.randomBytes(32);
+    const fresh = import_crypto5.default.randomBytes(32);
     writeKey(fresh);
     const verify = readKey();
     if (verify.state !== "found" || !verify.key.equals(fresh)) {
@@ -21505,23 +21794,23 @@ function keychainStatus() {
 }
 
 // src/secureStore.ts
-var import_crypto5 = __toESM(require("crypto"));
+var import_crypto6 = __toESM(require("crypto"));
 var import_fs6 = __toESM(require("fs"));
-var import_path14 = __toESM(require("path"));
+var import_path16 = __toESM(require("path"));
 
 // src/paths.ts
 var import_os5 = __toESM(require("os"));
-var import_path13 = __toESM(require("path"));
-var CONFIG_DIR = import_path13.default.join(import_os5.default.homedir(), ".factiii-runner");
+var import_path15 = __toESM(require("path"));
+var CONFIG_DIR = import_path15.default.join(import_os5.default.homedir(), ".factiii-runner");
 function safeSlug(spaceSlug) {
   return spaceSlug.replace(/[^a-zA-Z0-9_.-]/g, "_");
 }
 function spaceDirPath(spaceSlug) {
-  return import_path13.default.join(CONFIG_DIR, safeSlug(spaceSlug));
+  return import_path15.default.join(CONFIG_DIR, safeSlug(spaceSlug));
 }
 
 // src/secureStore.ts
-var VAULT_KEY_FILE = import_path14.default.join(CONFIG_DIR, "vault-key.json");
+var VAULT_KEY_FILE = import_path16.default.join(CONFIG_DIR, "vault-key.json");
 var SCRYPT_N2 = 1 << 15;
 var MIN_PASSWORD_LENGTH = 8;
 var SecureStoreError = class extends Error {
@@ -21548,7 +21837,7 @@ function requireKeychainKey() {
   );
 }
 function passwordKey(password, salt) {
-  return import_crypto5.default.scryptSync(password, salt, 32, {
+  return import_crypto6.default.scryptSync(password, salt, 32, {
     N: SCRYPT_N2,
     maxmem: 64 * 1024 * 1024
   });
@@ -21556,7 +21845,7 @@ function passwordKey(password, salt) {
 function wrapKey(machineKey, pwKey) {
   const ikm = pwKey ? Buffer.concat([machineKey, pwKey]) : machineKey;
   return Buffer.from(
-    import_crypto5.default.hkdfSync(
+    import_crypto6.default.hkdfSync(
       "sha256",
       ikm,
       Buffer.alloc(0),
@@ -21566,8 +21855,8 @@ function wrapKey(machineKey, pwKey) {
   );
 }
 function seal(plaintext, key) {
-  const iv = import_crypto5.default.randomBytes(12);
-  const cipher = import_crypto5.default.createCipheriv("aes-256-gcm", key, iv);
+  const iv = import_crypto6.default.randomBytes(12);
+  const cipher = import_crypto6.default.createCipheriv("aes-256-gcm", key, iv);
   const data = Buffer.concat([cipher.update(plaintext), cipher.final()]);
   return {
     iv: iv.toString("base64"),
@@ -21577,7 +21866,7 @@ function seal(plaintext, key) {
 }
 function unseal(box, key) {
   try {
-    const decipher = import_crypto5.default.createDecipheriv(
+    const decipher = import_crypto6.default.createDecipheriv(
       "aes-256-gcm",
       key,
       Buffer.from(box.iv, "base64")
@@ -21610,7 +21899,7 @@ function writeVaultFile(file) {
 }
 var unlockedDek = null;
 function createVault(machineKey) {
-  const dek = import_crypto5.default.randomBytes(32);
+  const dek = import_crypto6.default.randomBytes(32);
   writeVaultFile({
     v: 1,
     passwordEnabled: false,
@@ -21705,7 +21994,7 @@ function enablePassword(password) {
     );
   }
   const dek = dataKey();
-  const salt = import_crypto5.default.randomBytes(16);
+  const salt = import_crypto6.default.randomBytes(16);
   writeVaultFile({
     v: 1,
     passwordEnabled: true,
@@ -21733,7 +22022,7 @@ function changePassword(current, next) {
       "The current password is not correct."
     );
   }
-  const salt = import_crypto5.default.randomBytes(16);
+  const salt = import_crypto6.default.randomBytes(16);
   writeVaultFile({
     v: 1,
     passwordEnabled: true,
@@ -21810,8 +22099,8 @@ function storeStatus() {
 // src/secureFile.ts
 var MAGIC = "FACTIII1";
 function encrypt(plain, key, version) {
-  const iv = import_crypto6.default.randomBytes(12);
-  const cipher = import_crypto6.default.createCipheriv("aes-256-gcm", key, iv);
+  const iv = import_crypto7.default.randomBytes(12);
+  const cipher = import_crypto7.default.createCipheriv("aes-256-gcm", key, iv);
   const data = Buffer.concat([cipher.update(plain), cipher.final()]);
   const envelope = {
     v: version,
@@ -21822,7 +22111,7 @@ function encrypt(plain, key, version) {
   return `${MAGIC}${JSON.stringify(envelope)}`;
 }
 function decrypt(envelope, key) {
-  const decipher = import_crypto6.default.createDecipheriv(
+  const decipher = import_crypto7.default.createDecipheriv(
     "aes-256-gcm",
     key,
     Buffer.from(envelope.iv, "base64")
@@ -21843,7 +22132,7 @@ function parseEnvelope(raw) {
   }
 }
 function atomicWrite(filePath, body) {
-  import_fs7.default.mkdirSync(import_path15.default.dirname(filePath), { recursive: true });
+  import_fs7.default.mkdirSync(import_path17.default.dirname(filePath), { recursive: true });
   const tmp = `${filePath}.${process.pid}.tmp`;
   import_fs7.default.writeFileSync(tmp, body, { mode: 384 });
   import_fs7.default.renameSync(tmp, filePath);
@@ -21958,8 +22247,8 @@ function writeBootJson(filePath, value2) {
 }
 
 // src/config.ts
-var CONFIG_DIR2 = import_path16.default.join(import_os6.default.homedir(), ".factiii-runner");
-var CONFIG_FILE = import_path16.default.join(CONFIG_DIR2, "config.json");
+var CONFIG_DIR2 = import_path18.default.join(import_os6.default.homedir(), ".factiii-runner");
+var CONFIG_FILE = import_path18.default.join(CONFIG_DIR2, "config.json");
 function readRunnerConfig() {
   return readBootJson(CONFIG_FILE);
 }
@@ -22128,10 +22417,10 @@ function makeChunkReassembler() {
 }
 
 // src/daemon.ts
-var import_crypto7 = require("crypto");
+var import_crypto8 = require("crypto");
 var import_fs10 = __toESM(require("fs"));
 var import_node_datachannel = require("node-datachannel");
-var import_path18 = __toESM(require("path"));
+var import_path20 = __toESM(require("path"));
 
 // ../../node_modules/engine.io-client/build/esm-debug/transports/polling-xhr.node.js
 var XMLHttpRequestModule = __toESM(require_XMLHttpRequest(), 1);
@@ -23311,12 +23600,12 @@ function parse2(str) {
   uri.queryKey = queryKey(uri, uri["query"]);
   return uri;
 }
-function pathNames(obj, path18) {
-  const regx = /\/{2,9}/g, names = path18.replace(regx, "/").split("/");
-  if (path18.slice(0, 1) == "/" || path18.length === 0) {
+function pathNames(obj, path20) {
+  const regx = /\/{2,9}/g, names = path20.replace(regx, "/").split("/");
+  if (path20.slice(0, 1) == "/" || path20.length === 0) {
     names.splice(0, 1);
   }
-  if (path18.slice(-1) == "/") {
+  if (path20.slice(-1) == "/") {
     names.splice(names.length - 1, 1);
   }
   return names;
@@ -23935,7 +24224,7 @@ var protocol2 = Socket.protocol;
 // ../../node_modules/socket.io-client/build/esm-debug/url.js
 var import_debug7 = __toESM(require_src(), 1);
 var debug7 = (0, import_debug7.default)("socket.io-client:url");
-function url(uri, path18 = "", loc) {
+function url(uri, path20 = "", loc) {
   let obj = uri;
   loc = loc || typeof location !== "undefined" && location;
   if (null == uri)
@@ -23969,7 +24258,7 @@ function url(uri, path18 = "", loc) {
   obj.path = obj.path || "/";
   const ipv6 = obj.host.indexOf(":") !== -1;
   const host = ipv6 ? "[" + obj.host + "]" : obj.host;
-  obj.id = obj.protocol + "://" + host + ":" + obj.port + path18;
+  obj.id = obj.protocol + "://" + host + ":" + obj.port + path20;
   obj.href = obj.protocol + "://" + host + (loc && loc.port === obj.port ? "" : ":" + obj.port);
   return obj;
 }
@@ -25603,8 +25892,8 @@ function lookup(uri, opts) {
   const parsed = url(uri, opts.path || "/socket.io");
   const source = parsed.source;
   const id = parsed.id;
-  const path18 = parsed.path;
-  const sameNamespace = cache[id] && path18 in cache[id]["nsps"];
+  const path20 = parsed.path;
+  const sameNamespace = cache[id] && path20 in cache[id]["nsps"];
   const newConnection = opts.forceNew || opts["force new connection"] || false === opts.multiplex || sameNamespace;
   let io;
   if (newConnection) {
@@ -25646,8 +25935,8 @@ function cardContextPath(target, postId) {
   const safe = postId.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80) || "card";
   return `${target.paths.root}/.cards/${safe}.md`;
 }
-function cardContextPrompt(path18) {
-  return `Read ${path18} - it is the Factiii card this session was opened from. Use it as the context and start working on it.`;
+function cardContextPrompt(path20) {
+  return `Read ${path20} - it is the Factiii card this session was opened from. Use it as the context and start working on it.`;
 }
 var CLAUDE_PERMISSION_MODE = `--permission-mode auto`;
 var RESUME_SEED = "You are now in an interactive terminal, not the board UI. Respond in plain text and use your normal tools; do not use openui-lang or component schemas anymore.";
@@ -25812,10 +26101,10 @@ var TerminalManager = class {
 
 // src/agent-adapter.ts
 var import_fs9 = __toESM(require("fs"));
-var import_path17 = __toESM(require("path"));
-var RUNNER_CONFIG_PATH = import_path17.default.join(CONFIG_DIR, "runner-config.json");
+var import_path19 = __toESM(require("path"));
+var RUNNER_CONFIG_PATH = import_path19.default.join(CONFIG_DIR, "runner-config.json");
 function connectionPath(spaceSlug) {
-  return import_path17.default.join(CONFIG_DIR, `space-${safeSlug(spaceSlug)}.onedrive.json`);
+  return import_path19.default.join(CONFIG_DIR, `space-${safeSlug(spaceSlug)}.onedrive.json`);
 }
 function writeJson(filePath, value2) {
   writeSecureJson(filePath, value2);
@@ -25849,7 +26138,7 @@ function migrateLegacyConfigs() {
   for (const name of legacy) {
     const slug = name.slice("space-".length, -".json".length);
     const parsed = readSecureJson(
-      import_path17.default.join(CONFIG_DIR, name)
+      import_path19.default.join(CONFIG_DIR, name)
     );
     if (!parsed) continue;
     if (!file.defaultSlug) {
@@ -25874,7 +26163,7 @@ function encryptStrayPlaintextConfigs() {
     return;
   }
   for (const name of names) {
-    const filePath = import_path17.default.join(CONFIG_DIR, name);
+    const filePath = import_path19.default.join(CONFIG_DIR, name);
     try {
       const raw = import_fs9.default.readFileSync(filePath, "utf-8");
       if (!raw.startsWith("{")) continue;
@@ -26003,7 +26292,7 @@ var localConfigProvider = {
       "claude",
       "codex"
     ]) {
-      import_fs9.default.mkdirSync(import_path17.default.join(dir, sub), { recursive: true });
+      import_fs9.default.mkdirSync(import_path19.default.join(dir, sub), { recursive: true });
     }
     return dir;
   }
@@ -26177,15 +26466,15 @@ async function startDaemon(config) {
     }
   );
   const indexCandidates = [
-    import_path18.default.join(__dirname, "..", "index"),
-    import_path18.default.join(__dirname, "..", "..", "index", "image")
+    import_path20.default.join(__dirname, "..", "index"),
+    import_path20.default.join(__dirname, "..", "..", "index", "image")
   ];
   const indexDir = indexCandidates.find((p) => import_fs10.default.existsSync(p)) ?? indexCandidates[0];
   const odIndex = new IndexService({
-    controlToken: (0, import_crypto7.createHash)("sha256").update(config.authToken).digest("hex"),
+    controlToken: (0, import_crypto8.createHash)("sha256").update(config.authToken).digest("hex"),
     embedUrl: () => config.serverUrl,
     indexDir,
-    dataDir: import_path18.default.join(CONFIG_DIR, "index-data")
+    dataDir: import_path20.default.join(CONFIG_DIR, "index-data")
   });
   void odIndex.ensureRunning().catch((err) => {
     console.error(