@factiii/runner 0.11.1 → 0.11.3

package/dist/cli.js

@@ -963,7 +963,7 @@ var require_command = __commonJS({
   "node_modules/commander/lib/command.js"(exports2) {
     var EventEmitter = require("node:events").EventEmitter;
     var childProcess = require("node:child_process");
-    var path20 = require("node:path");
+    var path21 = require("node:path");
     var fs15 = require("node:fs");
     var process2 = require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
@@ -1896,9 +1896,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path20.resolve(baseDir, baseName);
+          const localBin = path21.resolve(baseDir, baseName);
           if (fs15.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path20.extname(baseName))) return void 0;
+          if (sourceExt.includes(path21.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
             (ext) => fs15.existsSync(`${localBin}${ext}`)
           );
@@ -1916,17 +1916,17 @@ Expecting one of '${allowedValues.join("', '")}'`);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path20.resolve(
-            path20.dirname(resolvedScriptPath),
+          executableDir = path21.resolve(
+            path21.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path20.basename(
+            const legacyName = path21.basename(
               this._scriptPath,
-              path20.extname(this._scriptPath)
+              path21.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -1937,7 +1937,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path20.extname(executableFile));
+        launchWithNode = sourceExt.includes(path21.extname(executableFile));
         let proc;
         if (process2.platform !== "win32") {
           if (launchWithNode) {
@@ -2777,7 +2777,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path20.basename(filename, path20.extname(filename));
+        this._name = path21.basename(filename, path21.extname(filename));
         return this;
       }
       /**
@@ -2791,9 +2791,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path21) {
-        if (path21 === void 0) return this._executableDir;
-        this._executableDir = path21;
+      executableDir(path22) {
+        if (path22 === void 0) return this._executableDir;
+        this._executableDir = path22;
         return this;
       }
       /**
@@ -8428,8 +8428,8 @@ function getErrorMap() {
 
 // ../../node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path20, errorMaps, issueData } = params;
-  const fullPath = [...path20, ...issueData.path || []];
+  const { data, path: path21, errorMaps, issueData } = params;
+  const fullPath = [...path21, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -8545,11 +8545,11 @@ var errorUtil;
 
 // ../../node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value2, path20, key) {
+  constructor(parent, value2, path21, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value2;
-    this._path = path20;
+    this._path = path21;
     this._key = key;
   }
   get path() {
@@ -12659,7 +12659,7 @@ var prompts_default = {
     "- Write ONLY those three files under .agents/skills/deploy/.",
     "- Do NOT git commit or git push; the harness pushes for review.",
     "- Cloud CLIs on this machine (aws, vercel, wrangler, gh...) may already be signed in. You may use them READ-ONLY to verify what exists (project names, repo names, regions) so the skill is accurate - but NEVER create, modify, deploy, or delete anything, and never echo a credential or token value.",
-    '- Secret-bearing commands: any command needing a variable declared in required-variables.json MUST be written in the skill as `factiii-secrets run -- <command>`, with the variables referenced unexpanded and quoted (e.g. "$DATABASE_URL"). The owner authorizes each one at run time and the runner injects the values. Wrap only the commands that need a secret. NEVER include steps that check whether variables are set in the environment, and never instruct anyone to export them or put them in a .env/shell/CI config.',
+    '- Secret-bearing commands: any command needing a variable declared in required-variables.json MUST be written in the skill as `factiii-secrets run --key NAME [--key NAME]... -- <command>`, naming exactly the keys THAT command reads (a wrapper script\'s keys are what the script reads, not what its command line shows), with the variables referenced unexpanded and quoted (e.g. "$DATABASE_URL"). Only the named keys are injected: a step asks for its own keys, never for every key the skill declares. The owner authorizes each one at run time and the runner injects the values. Wrap only the commands that need a secret. NEVER include steps that check whether variables are set in the environment, and never instruct anyone to export them or put them in a .env/shell/CI config.',
     "- No secret values in any file, ever."
   ],
   deployCreateRevise: [
@@ -12667,7 +12667,7 @@ var prompts_default = {
     "",
     "{{FEEDBACK}}",
     "",
-    "Apply them by editing .agents/skills/deploy/SKILL.md, .agents/skills/deploy/required-variables.json, and/or .agents/skills/deploy/check-environment.sh in your working directory - the same contract as before: only those three files, keys declared exactly when used, every secret-bearing command still written as `factiii-secrets run -- <command>`, no secret values anywhere, no git commit/push, and paths referenced ONLY via $WORKSPACE / $BACKUPS_DIR / $BUILDS_DIR or relative to the working directory (never absolute machine paths). Keep everything the owner did NOT ask to change untouched."
+    "Apply them by editing .agents/skills/deploy/SKILL.md, .agents/skills/deploy/required-variables.json, and/or .agents/skills/deploy/check-environment.sh in your working directory - the same contract as before: only those three files, keys declared exactly when used, every secret-bearing command still written as `factiii-secrets run --key NAME ... -- <command>` naming exactly the keys that command reads, no secret values anywhere, no git commit/push, and paths referenced ONLY via $WORKSPACE / $BACKUPS_DIR / $BUILDS_DIR or relative to the working directory (never absolute machine paths). Keep everything the owner did NOT ask to change untouched."
   ],
   deployRun: [
     "## Deploy run protocol",
@@ -12675,9 +12675,10 @@ var prompts_default = {
     "",
     "## Secrets (read this before anything else)",
     "Every variable declared in required-variables.json is UNSET in your shell BY DESIGN, and will stay unset for the whole run. The values are stored encrypted on this machine, and `factiii-secrets` is how a command gets them - it is on your PATH, and the `factiii-secrets` skill describes it in full.",
-    "- To run a command that needs any declared variable, prefix it: `factiii-secrets run -- <command>`. The owner authorizes it with their password, the runner runs it with every declared value injected, and you get the output back with the values redacted. It exits with the command's own code, so `&&`, `||` and `set -e` behave normally. Exit 77 means the owner declined - adapt or stop, and never retry the same command.",
+    "- To run a command that needs any declared variable, prefix it and NAME the keys that command reads: `factiii-secrets run --key NAME [--key NAME]... -- <command>`. The owner authorizes it with their password, the runner runs it with ONLY the keys you named injected, and you get the output back with the values redacted. A command that names no key gets no secrets, so always name them. Repeat --key per name (or comma-separate them), always BEFORE the `--`. It exits with the command's own code, so `&&`, `||` and `set -e` behave normally. Exit 77 means the owner declined - adapt or stop, and never retry the same command.",
     '- Quote the variables (`"$DATABASE_URL"`): they expand on the runner\'s side, not in your shell.',
     "- NEVER check whether these variables are set (no `env`, `printenv`, `test -n`, echo checks), never report them as missing, and never abort because your shell lacks them. Their absence tells you nothing. If the skill has a step that verifies variables are set, SKIP it - it predates this protocol.",
+    "- Name what the command actually reads. For a wrapper script, that is what the SCRIPT reads, not what appears on its command line. If you are unsure of a name, run `factiii-secrets list` - it prints the key names and whether each is set, never a value. A name that is not in the store expands empty, and the runner tells you which one it was.",
     "- Wrap ONLY the commands that actually need a secret. Everything else runs unwrapped and needs no authorization.",
     "",
     "- Track the release with your todo/plan tool: one todo per step in ship order, updated as you go. This is the owner's live timeline.",
@@ -12909,7 +12910,7 @@ ${diff.slice(0, 8e3)}`,
 }
 
 // ../../shared/all/helpers/board-agent-core/engine.ts
-var import_path12 = require("path");
+var import_path13 = require("path");
 
 // ../../shared/all/domains/electron.ts
 var SETUP_LOG_PREFIX = "
log ";
@@ -13018,7 +13019,7 @@ async function ensurePrimaryClone(target, cloneUrl, branch) {
   await target.sh(`mkdir -p ${target.paths.worktrees}`);
 }
 async function addWorktree(target, workName, baseBranch, kind) {
-  const path20 = worktreeFor(target.paths, workName);
+  const path21 = worktreeFor(target.paths, workName);
   const branch = workBranch(workName, kind);
   await gitInDir(
     target,
@@ -13028,7 +13029,7 @@ async function addWorktree(target, workName, baseBranch, kind) {
     baseBranch
   ).catch(() => {
   });
-  await removeWorktree(target, path20).catch(() => {
+  await removeWorktree(target, path21).catch(() => {
   });
   await gitInDir(
     target,
@@ -13037,30 +13038,30 @@ async function addWorktree(target, workName, baseBranch, kind) {
     "add",
     "-B",
     branch,
-    path20,
+    path21,
     `origin/${baseBranch}`
   );
-  return { path: path20, branch };
+  return { path: path21, branch };
 }
-async function removeWorktree(target, path20) {
+async function removeWorktree(target, path21) {
   await gitInDir(
     target,
     target.paths.repo,
     "worktree",
     "remove",
     "--force",
-    path20
+    path21
   );
 }
-async function removeWorktreeAndBranch(target, path20) {
+async function removeWorktreeAndBranch(target, path21) {
   const branch = await gitInDir(
     target,
-    path20,
+    path21,
     "rev-parse",
     "--abbrev-ref",
     "HEAD"
   ).then((out) => out.trim()).catch(() => "");
-  await removeWorktree(target, path20);
+  await removeWorktree(target, path21);
   if (branch && branch !== "HEAD") {
     await gitInDir(target, target.paths.repo, "branch", "-D", branch).catch(
       () => {
@@ -13074,8 +13075,8 @@ async function pruneWorktrees(target) {
     }
   );
 }
-function isWorktreePath(target, path20) {
-  return path20.startsWith(`${target.paths.worktrees}/`);
+function isWorktreePath(target, path21) {
+  return path21.startsWith(`${target.paths.worktrees}/`);
 }
 async function setGitIdentity(target, name, email, workdir = target.paths.workspace) {
   if (name) await gitInDir(target, workdir, "config", "user.name", name);
@@ -13101,13 +13102,13 @@ function parseStatus(raw) {
     const y = line[1];
     const rest = line.slice(3);
     const arrow = rest.indexOf(" -> ");
-    const path20 = arrow === -1 ? rest : rest.slice(arrow + 4);
+    const path21 = arrow === -1 ? rest : rest.slice(arrow + 4);
     if (x === "?" || y === "?") {
-      unstaged.push({ path: path20, code: "A" });
+      unstaged.push({ path: path21, code: "A" });
       continue;
     }
-    if (x !== " ") staged.push({ path: path20, code: x });
-    if (y !== " ") unstaged.push({ path: path20, code: y });
+    if (x !== " ") staged.push({ path: path21, code: x });
+    if (y !== " ") unstaged.push({ path: path21, code: y });
   }
   return { staged, unstaged };
 }
@@ -13853,6 +13854,9 @@ function createEventSink(send, spaceSlug, notify) {
     emitDeployEnv(payload) {
       send(channel("deploy-env"), payload);
     },
+    emitSecretsAuth(payload) {
+      send(channel("secrets-auth"), payload);
+    },
     emitBareFsChange(postId, change) {
       send(channel(`bare-fs:${postId}`), change);
     },
@@ -14388,6 +14392,7 @@ var import_util5 = require("util");
 var import_promises2 = __toESM(require("fs/promises"));
 var import_net2 = __toESM(require("net"));
 var import_path4 = __toESM(require("path"));
+var SECRET_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function secretsSocketPath(spaceDir) {
   return import_path4.default.join(hostSpacePaths(spaceDir).state, "secrets.sock");
 }
@@ -14415,9 +14420,23 @@ async function handleRun(request, handlers, reply) {
     return;
   }
   const cwd = typeof request.cwd === "string" ? request.cwd : "";
+  const requested = Array.isArray(request.keys) ? request.keys : [];
+  const keys = [];
+  for (const entry of requested) {
+    if (typeof entry !== "string" || !SECRET_KEY_PATTERN.test(entry)) {
+      reply({
+        type: "error",
+        message: `"${String(entry)}" is not a key name.`
+      });
+      return;
+    }
+    if (!keys.includes(entry)) keys.push(entry);
+  }
   const result = await handlers.run({
     command,
     cwd,
+    keys,
+    token: typeof request.token === "string" ? request.token : "",
     status: (text) => reply({ type: "status", text })
   });
   if ("denied" in result) {
@@ -14458,7 +14477,9 @@ async function startSecretsBridge(opts) {
         return;
       }
       if (request.op === "list") {
-        void handlers.list().then((keys) => reply({ type: "keys", keys })).catch(
+        void handlers.list().then(
+          (entries) => reply({ type: "keys", keys: entries.map((e) => e.key), entries })
+        ).catch(
           (err) => reply({ type: "error", message: errorText(err) })
         ).finally(() => conn.end());
         return;
@@ -15094,9 +15115,9 @@ function summarize(raw, base) {
 }
 async function rootLinkState(root) {
   const linkPath = import_path6.default.join(import_os2.default.homedir(), ...root.split("/"));
-  const stat2 = await import_promises4.default.lstat(linkPath).catch(() => null);
-  if (!stat2) return "missing";
-  if (!stat2.isSymbolicLink()) return "blocked";
+  const stat = await import_promises4.default.lstat(linkPath).catch(() => null);
+  if (!stat) return "missing";
+  if (!stat.isSymbolicLink()) return "blocked";
   const target = await import_promises4.default.readlink(linkPath).catch(() => "");
   return target.replace(/\/+$/, "") === AGENTS_LINK_TARGET ? "linked" : "missing";
 }
@@ -15435,8 +15456,8 @@ async function migrateGlobal() {
   const moved = [];
   for (const root of CLI_ROOTS) {
     const dir = import_path6.default.join(import_os2.default.homedir(), ...root.split("/"));
-    const stat2 = await import_promises4.default.lstat(dir).catch(() => null);
-    if (!stat2 || stat2.isSymbolicLink()) continue;
+    const stat = await import_promises4.default.lstat(dir).catch(() => null);
+    if (!stat || stat.isSymbolicLink()) continue;
     const entries = await import_promises4.default.readdir(dir, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       if (entry.isFile() || entry.isSymbolicLink()) continue;
@@ -15556,9 +15577,9 @@ async function installBundledSkill(opts) {
   await write(import_path6.default.join(home, ...AGENTS_ROOT.split("/")));
   for (const root of CLI_ROOTS) {
     const linkPath = import_path6.default.join(home, ...root.split("/"));
-    const stat2 = await import_promises4.default.lstat(linkPath).catch(() => null);
-    if (stat2?.isSymbolicLink()) continue;
-    if (!stat2) {
+    const stat = await import_promises4.default.lstat(linkPath).catch(() => null);
+    if (stat?.isSymbolicLink()) continue;
+    if (!stat) {
       await import_promises4.default.mkdir(import_path6.default.dirname(linkPath), { recursive: true });
       await import_promises4.default.symlink(AGENTS_LINK_TARGET, linkPath, "dir").catch(() => void 0);
       continue;
@@ -16116,18 +16137,18 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
     await this.core.ensureSpaceWorkspace();
     await assertAgentSignedIn(session.provider, this.core.target());
     if (hasGit) {
-      const { path: path20 } = await addWorktree(
+      const { path: path21 } = await addWorktree(
         this.core.target(),
         session.taskId,
         baseBranch || config.mainBranch || "main",
         "card"
       );
-      session.workspacePath = path20;
+      session.workspacePath = path21;
       await setGitIdentity(
         this.core.target(),
         config.gitName,
         config.gitEmail,
-        path20
+        path21
       );
       this.emitter.addLog(session, "system", "Worktree ready.");
     } else {
@@ -16349,18 +16370,18 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
     this.emitter.addLog(session, "system", "Preparing environment...");
     await this.core.ensureSpaceWorkspace();
     await assertAgentSignedIn(session.provider, this.core.target());
-    const { path: path20 } = await addWorktree(
+    const { path: path21 } = await addWorktree(
       this.core.target(),
       session.taskId,
       config.mainBranch || "main",
       "card"
     );
-    session.workspacePath = path20;
+    session.workspacePath = path21;
     await setGitIdentity(
       this.core.target(),
       config.gitName,
       config.gitEmail,
-      path20
+      path21
     );
     await this.putCard(session);
     const patchDir = `${this.core.target().paths.root}/patches/${session.taskId}`;
@@ -16907,12 +16928,12 @@ var FLUSH_MS = 120;
 var SELF_WRITE_MS = 2e3;
 var dynamicImport = new Function("s", "return import(s)");
 var importFs = new Function("s", "return import(s)");
-async function resolveReal(path20) {
+async function resolveReal(path21) {
   try {
     const { realpath } = await importFs("fs/promises");
-    return await realpath(path20);
+    return await realpath(path21);
   } catch {
-    return path20;
+    return path21;
   }
 }
 var loadSubscribe = null;
@@ -17026,19 +17047,19 @@ var WorkspaceWatcher = class {
   }
   record(kind, relPath) {
     if (this.closed) return;
-    const path20 = "/" + relPath;
-    const expiry = this.selfWrites.get(path20);
+    const path21 = "/" + relPath;
+    const expiry = this.selfWrites.get(path21);
     if (expiry !== void 0) {
       if (expiry > Date.now()) return;
-      this.selfWrites.delete(path20);
+      this.selfWrites.delete(path21);
     }
     const { added, changed, removed } = this.pending;
-    added.delete(path20);
-    changed.delete(path20);
-    removed.delete(path20);
-    if (kind === "added") added.add(path20);
-    else if (kind === "changed") changed.add(path20);
-    else removed.add(path20);
+    added.delete(path21);
+    changed.delete(path21);
+    removed.delete(path21);
+    if (kind === "added") added.add(path21);
+    else if (kind === "changed") changed.add(path21);
+    else removed.add(path21);
     if (added.size + changed.size + removed.size > MAX_BATCH) {
       this.pending = { ...emptyPending(), resync: true };
     }
@@ -17057,8 +17078,8 @@ var WorkspaceWatcher = class {
     this.pending = emptyPending();
     if (!resync && !added.size && !changed.size && !removed.size) return;
     const now = Date.now();
-    for (const [path20, expiry] of this.selfWrites) {
-      if (expiry <= now) this.selfWrites.delete(path20);
+    for (const [path21, expiry] of this.selfWrites) {
+      if (expiry <= now) this.selfWrites.delete(path21);
     }
     this.emit({
       added: resync ? [] : [...added],
@@ -17262,8 +17283,8 @@ var TerminalModeEngine = class {
   /** Suppress the change event our own write is about to produce, so a save
    *  never comes back to the editor as an outside edit. Normalized to the form
    *  the watcher emits, since callers spell the path either way. */
-  expectWrite(postId, path20) {
-    this.watchers.get(postId)?.expectWrite(posixNormalize(path20));
+  expectWrite(postId, path21) {
+    this.watchers.get(postId)?.expectWrite(posixNormalize(path21));
   }
   // ── Lifecycle / ModeEngine ──
   start(base, args) {
@@ -17460,18 +17481,18 @@ var TerminalModeEngine = class {
         this.reservedNames.values()
       );
       this.reservedNames.set(session.postId, workName);
-      const { path: path20 } = await addWorktree(
+      const { path: path21 } = await addWorktree(
         this.core.target(),
         workName,
         branch,
         "terminal"
       );
-      session.workspacePath = path20;
+      session.workspacePath = path21;
       await setGitIdentity(
         this.core.target(),
         config.gitName,
         config.gitEmail,
-        path20
+        path21
       );
       this.emitter.addLog(session, "system", "Worktree ready.");
     } else {
@@ -17533,11 +17554,11 @@ var TerminalModeEngine = class {
   }
   async bareFsList({
     postId,
-    path: path20
+    path: path21
   }) {
     const target = this.getBareTarget(postId);
     const root = this.getBareRoot(postId);
-    const abs = this.resolveBarePath(path20, root);
+    const abs = this.resolveBarePath(path21, root);
     const relRoot = abs.slice(root.length) || "/";
     const out = await target.run([
       "sh",
@@ -17587,30 +17608,30 @@ var TerminalModeEngine = class {
   }
   async bareFsRead({
     postId,
-    path: path20
+    path: path21
   }) {
     const target = this.getBareTarget(postId);
-    const abs = this.resolveBarePath(path20, this.getBareRoot(postId));
+    const abs = this.resolveBarePath(path21, this.getBareRoot(postId));
     const b64 = (await target.sh(`base64 < ${shEscape(abs)} | tr -d '
 '`)).trim();
     return { content: b64, encoding: "base64" };
   }
   async bareFsWrite({
     postId,
-    path: path20,
+    path: path21,
     content,
     encoding
   }) {
     const target = this.getBareTarget(postId);
-    const abs = this.resolveBarePath(path20, this.getBareRoot(postId));
+    const abs = this.resolveBarePath(path21, this.getBareRoot(postId));
     const b64 = encoding === "base64" ? content : Buffer.from(content, "utf-8").toString("base64");
     if (!/^[A-Za-z0-9+/=\n\r]*$/.test(b64)) {
       throw new Error("Invalid base64 payload.");
     }
-    this.expectWrite(String(postId), path20);
+    this.expectWrite(String(postId), path21);
     await writeBase64File(target, abs, b64);
     const session = this.sessions.get(String(postId));
-    if (session) delete session.buffers[path20];
+    if (session) delete session.buffers[path21];
   }
   /** Append one chunk of a dropped image to the per-space drops dir
    *  (`paths.root`, OUTSIDE the card worktree so it never touches the repo).
@@ -17660,39 +17681,39 @@ var TerminalModeEngine = class {
   }
   bareOpenFile({
     postId: rawPostId,
-    path: path20
+    path: path21
   }) {
     const session = this.sessions.get(String(rawPostId));
     if (!session || session.mode !== "bare") return;
-    if (!session.openedFiles.includes(path20)) {
-      session.openedFiles.push(path20);
+    if (!session.openedFiles.includes(path21)) {
+      session.openedFiles.push(path21);
     }
   }
   bareCloseFile({
     postId: rawPostId,
-    path: path20
+    path: path21
   }) {
     const session = this.sessions.get(String(rawPostId));
     if (!session || session.mode !== "bare") return;
-    session.openedFiles = session.openedFiles.filter((p) => p !== path20);
-    delete session.buffers[path20];
+    session.openedFiles = session.openedFiles.filter((p) => p !== path21);
+    delete session.buffers[path21];
   }
   bareBufferSet({
     postId: rawPostId,
-    path: path20,
+    path: path21,
     content
   }) {
     const session = this.sessions.get(String(rawPostId));
     if (!session || session.mode !== "bare") return;
-    session.buffers[path20] = content;
+    session.buffers[path21] = content;
   }
   async bareFsDelete({
     postId,
-    path: path20
+    path: path21
   }) {
     const target = this.getBareTarget(postId);
     const root = this.getBareRoot(postId);
-    const abs = this.resolveBarePath(path20, root);
+    const abs = this.resolveBarePath(path21, root);
     if (abs === root) {
       throw new Error("Refusing to delete the repo root.");
     }
@@ -17700,10 +17721,10 @@ var TerminalModeEngine = class {
   }
   async bareFsMkdir({
     postId,
-    path: path20
+    path: path21
   }) {
     const target = this.getBareTarget(postId);
-    const abs = this.resolveBarePath(path20, this.getBareRoot(postId));
+    const abs = this.resolveBarePath(path21, this.getBareRoot(postId));
     await target.sh(`mkdir -p ${shEscape(abs)}`);
   }
   async bareReview({
@@ -18150,13 +18171,13 @@ var ClaudeLoginFlow = class {
   async onClose() {
     if (this.settled) return;
     const errLine = this.output.slice(Math.max(this.submitMark, 0)).match(/(?:Login failed|OAuth error):[^\r\n]+/)?.[0];
-    const tail2 = errLine ? `${errLine.trim()} Try signing in again.` : this.output.trim().slice(-300);
+    const tail3 = errLine ? `${errLine.trim()} Try signing in again.` : this.output.trim().slice(-300);
     if (this.urlRejecter) {
-      this.fail(tail2 || "Claude sign-in ended unexpectedly.");
+      this.fail(tail3 || "Claude sign-in ended unexpectedly.");
       return;
     }
     this.settled = true;
-    await this.verifyAndComplete(tail2);
+    await this.verifyAndComplete(tail3);
   }
   fail(message) {
     if (this.settled) return;
@@ -18286,13 +18307,13 @@ var CodexLoginFlow = class {
   }
   async onClose() {
     if (this.settled) return;
-    const tail2 = this.output.trim().slice(-300);
+    const tail3 = this.output.trim().slice(-300);
     if (this.startRejecter) {
-      this.fail(tail2 || "Codex sign-in ended unexpectedly.");
+      this.fail(tail3 || "Codex sign-in ended unexpectedly.");
       return;
     }
     this.settled = true;
-    await this.verifyAndComplete(tail2);
+    await this.verifyAndComplete(tail3);
   }
   fail(message) {
     if (this.settled) return;
@@ -18385,8 +18406,8 @@ async function pollGithubDeviceCode(clientId, deviceCode) {
       };
   }
 }
-async function githubApi(token, path20) {
-  const res = await fetch(`${API_BASE}${path20}`, {
+async function githubApi(token, path21) {
+  const res = await fetch(`${API_BASE}${path21}`, {
     headers: {
       Authorization: `Bearer ${token}`,
       Accept: "application/vnd.github+json",
@@ -18395,7 +18416,7 @@ async function githubApi(token, path20) {
   });
   if (!res.ok) {
     throw new Error(
-      `GitHub ${path20} failed (${res.status}): ${await res.text()}`
+      `GitHub ${path21} failed (${res.status}): ${await res.text()}`
     );
   }
   return await res.json();
@@ -18440,11 +18461,103 @@ async function listGithubBranches(token, fullName) {
 }
 
 // ../../shared/all/helpers/board-agent-core/host-run.ts
+var import_path10 = __toESM(require("path"));
+
+// ../../shared/all/helpers/board-agent-core/secrets-gate.ts
+var import_crypto2 = __toESM(require("crypto"));
+var DEPLOY_ORIGIN = "Deploy run";
+var UNATTRIBUTED = "This runner did not start the session that asked, so the request was refused. `factiii-secrets` only works inside a session the runner spawned.";
+var SecretsGate = class {
+  constructor() {
+    /** token -> origin label. Lives as long as the session that holds it. */
+    this.tokens = /* @__PURE__ */ new Map();
+    this.waiting = null;
+    /** Notified on appearance, replacement AND clearing, so a modal that opened
+     *  on one request closes when it is answered elsewhere. More than one,
+     *  because the space publishes the change and the deploy run separately
+     *  projects its own requests onto the release timeline. */
+    this.listeners = /* @__PURE__ */ new Set();
+  }
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  onChange() {
+    for (const listener of this.listeners) listener();
+  }
+  // ── Who is asking ──
+  /** Mint a token for one session, labelled with what the owner should see on
+   *  the prompt - the label is most of the decision, so name the session. */
+  issueToken(origin) {
+    const token = import_crypto2.default.randomBytes(24).toString("hex");
+    this.tokens.set(token, origin);
+    return token;
+  }
+  /** Drop a session's token when it ends, so a leaked one stops working. */
+  revokeToken(token) {
+    this.tokens.delete(token);
+  }
+  /** The origin for a token, or null when this runner never issued it. */
+  originFor(token) {
+    return this.tokens.get(token) ?? null;
+  }
+  // ── The pending request ──
+  pending() {
+    return this.waiting?.request ?? null;
+  }
+  /** Open the gate for one command and block until the owner answers. A second
+   *  request denies the older one rather than dropping it: that caller is
+   *  blocked on the promise and would otherwise hang forever. */
+  request(opts) {
+    this.waiting?.resolve({ denied: true });
+    return new Promise((resolve2) => {
+      this.waiting = {
+        request: {
+          id: import_crypto2.default.randomUUID(),
+          command: opts.command,
+          keys: opts.keys,
+          origin: opts.origin,
+          error: opts.error ?? "",
+          requestedAt: Date.now()
+        },
+        resolve: resolve2
+      };
+      this.onChange();
+    });
+  }
+  /** Answer the pending request. `id` must match what the client was shown: a
+   *  wrong-password re-prompt replaces the request, and an answer aimed at the
+   *  previous one must not resolve its successor with a stale password. */
+  answer(id, result) {
+    const waiting = this.waiting;
+    if (!waiting || waiting.request.id !== id) return { success: false };
+    this.waiting = null;
+    waiting.resolve(result);
+    this.onChange();
+    return { success: true };
+  }
+  /** Deny whatever is waiting, without needing to know its id. The run was
+   *  cancelled, or the space is going down: nothing may stay blocked. */
+  cancel() {
+    const waiting = this.waiting;
+    if (!waiting) return;
+    this.waiting = null;
+    waiting.resolve({ denied: true });
+    this.onChange();
+  }
+  destroy() {
+    this.cancel();
+    this.tokens.clear();
+    this.listeners.clear();
+  }
+};
+
+// ../../shared/all/helpers/board-agent-core/secrets-run.ts
 var import_path9 = __toESM(require("path"));
 
 // ../../shared/all/helpers/board-agent-core/host-secrets.ts
 var import_child_process4 = require("child_process");
-var import_crypto2 = __toESM(require("crypto"));
+var import_crypto3 = __toESM(require("crypto"));
 var import_promises6 = __toESM(require("fs/promises"));
 var import_path8 = __toESM(require("path"));
 var import_util6 = require("util");
@@ -18472,7 +18585,7 @@ async function assertBinaries() {
   }
 }
 function deriveKey(password, salt) {
-  return import_crypto2.default.scryptSync(password, salt, 32, {
+  return import_crypto3.default.scryptSync(password, salt, 32, {
     N: SCRYPT_N,
     maxmem: 64 * 1024 * 1024
   });
@@ -18501,9 +18614,9 @@ async function initSecrets(configDir, password) {
   if (!identity || !recipient) {
     throw new Error("age-keygen returned no usable keypair.");
   }
-  const salt = import_crypto2.default.randomBytes(16);
-  const iv = import_crypto2.default.randomBytes(12);
-  const cipher = import_crypto2.default.createCipheriv(
+  const salt = import_crypto3.default.randomBytes(16);
+  const iv = import_crypto3.default.randomBytes(12);
+  const cipher = import_crypto3.default.createCipheriv(
     "aes-256-gcm",
     deriveKey(password, salt),
     iv
@@ -18528,7 +18641,7 @@ async function initSecrets(configDir, password) {
   return { success: true };
 }
 function decryptIdentity(box, password) {
-  const decipher = import_crypto2.default.createDecipheriv(
+  const decipher = import_crypto3.default.createDecipheriv(
     "aes-256-gcm",
     deriveKey(password, Buffer.from(box.salt, "base64")),
     Buffer.from(box.iv, "base64")
@@ -18614,6 +18727,18 @@ async function writeEnv(configDir, spaceDir, identity, values) {
     await import_promises6.default.rm(tmp, { force: true });
   }
 }
+async function storedSecretKeys(spaceDir) {
+  const raw = await import_promises6.default.readFile(envPath(spaceDir), "utf-8").catch(() => "");
+  const keys = [];
+  for (const line of raw.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq <= 0 || line.startsWith("#")) continue;
+    const key = line.slice(0, eq);
+    if (key.startsWith("sops_")) continue;
+    keys.push(key);
+  }
+  return keys;
+}
 async function listSecretKeys(configDir, spaceDir, password) {
   const identity = await identityFor(configDir, password);
   return Object.keys(await readEnv(spaceDir, identity));
@@ -18641,31 +18766,10 @@ async function secretsForInjection(configDir, spaceDir, password) {
   return readEnv(spaceDir, identity);
 }
 
-// ../../shared/all/helpers/board-agent-core/host-run.ts
-var HUMAN_MARKER = "AWAITING_INPUT:";
-var SECRETS_MARKER = "NEED_SECRETS:";
-var COMPLETE_MARKER = "DEPLOY_COMPLETE:";
-var FAILED_MARKER = "DEPLOY_FAILED:";
-var MAX_MARKERLESS_TURNS = 3;
+// ../../shared/all/helpers/board-agent-core/secrets-run.ts
 var COMMAND_IDLE_TIMEOUT_MS = 45 * 6e4;
 var COMMAND_TIMEOUT_MS = 6 * 60 * 6e4;
 var tail = (s, max = 8e3) => s.length > max ? s.slice(-max) : s;
-function tailMarker(text) {
-  const zone = text.slice(-2e3);
-  let best = null;
-  for (const marker of [
-    SECRETS_MARKER,
-    HUMAN_MARKER,
-    COMPLETE_MARKER,
-    FAILED_MARKER
-  ]) {
-    const at = zone.lastIndexOf(marker);
-    if (at !== -1 && (!best || at > best.at)) best = { marker, at };
-  }
-  if (!best) return null;
-  const value2 = zone.slice(best.at + best.marker.length).trim();
-  return value2 ? { marker: best.marker, value: value2 } : null;
-}
 function containedCwd(cwd, spaceDir) {
   if (!cwd) return null;
   const resolved = import_path9.default.resolve(cwd);
@@ -18673,46 +18777,90 @@ function containedCwd(cwd, spaceDir) {
   return resolved === root || resolved.startsWith(root + import_path9.default.sep) ? resolved : null;
 }
 async function authorizeAndRun(opts) {
-  const { command, hooks } = opts;
-  opts.status?.("waiting for the owner to authorize this command");
-  let secrets = null;
-  let authError = "";
-  while (!secrets) {
-    const auth = await hooks.requestAuth(command, authError);
+  const { command, gate } = opts;
+  const scope = opts.keys ?? opts.declared;
+  opts.status?.(
+    scope.length ? `waiting for the owner to authorize this command (${scope.join(", ")})` : "waiting for the owner to authorize this command (no secrets requested)"
+  );
+  let store = null;
+  let error = "";
+  while (!store) {
+    const auth = await gate.request({
+      command,
+      keys: scope,
+      origin: opts.origin,
+      error
+    });
     if ("denied" in auth) return { denied: true };
     try {
-      secrets = await secretsForInjection(
+      store = await secretsForInjection(
         opts.configDir,
         opts.spaceDir,
         auth.password
       );
     } catch (err) {
-      authError = err instanceof Error ? err.message : String(err);
-      opts.status?.(`authorization failed: ${authError}`);
+      error = err instanceof Error ? err.message : String(err);
+      opts.status?.(`authorization failed: ${error}`);
     }
   }
-  const redact = redactor(Object.values(secrets));
+  const injected = {};
+  const missing = [];
+  for (const key of scope) {
+    if (key in store) injected[key] = store[key];
+    else missing.push(key);
+  }
+  if (missing.length && opts.keys) {
+    const note = `${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not in the store, so the command sees ${missing.length === 1 ? "it" : "them"} empty.`;
+    opts.status?.(note);
+    opts.sendLog?.({ type: "system", content: note });
+  }
+  const redact = redactor(Object.values(store));
+  const names = Object.keys(injected);
   opts.status?.("authorized, running");
-  hooks.sendLog({
+  opts.sendLog?.({
     type: "system",
-    content: "Authorized. Running the command with secrets injected..."
+    content: `Authorized. Running the command with ${names.length ? `${names.join(", ")} injected` : "no secrets injected"}...`
   });
   const res = await execLogin(command, {
     cwd: opts.cwd,
-    env: { ...process.env, ...spaceEnv(opts.spaceDir), ...secrets },
+    env: { ...process.env, ...spaceEnv(opts.spaceDir), ...injected },
     timeout: COMMAND_TIMEOUT_MS,
     idleTimeout: COMMAND_IDLE_TIMEOUT_MS,
     maxBuffer: 32 * 1024 * 1024
   });
   const output = redact(res.output);
-  hooks.sendLog({ type: "tool", content: `$ ${command}
+  opts.sendLog?.({ type: "tool", content: `$ ${command}
 ${tail(output)}` });
   return { code: res.code, output };
 }
+
+// ../../shared/all/helpers/board-agent-core/host-run.ts
+var HUMAN_MARKER = "AWAITING_INPUT:";
+var SECRETS_MARKER = "NEED_SECRETS:";
+var COMPLETE_MARKER = "DEPLOY_COMPLETE:";
+var FAILED_MARKER = "DEPLOY_FAILED:";
+var MAX_MARKERLESS_TURNS = 3;
+var tail2 = (s, max = 8e3) => s.length > max ? s.slice(-max) : s;
+function tailMarker(text) {
+  const zone = text.slice(-2e3);
+  let best = null;
+  for (const marker of [
+    SECRETS_MARKER,
+    HUMAN_MARKER,
+    COMPLETE_MARKER,
+    FAILED_MARKER
+  ]) {
+    const at = zone.lastIndexOf(marker);
+    if (at !== -1 && (!best || at > best.at)) best = { marker, at };
+  }
+  if (!best) return null;
+  const value2 = zone.slice(best.at + best.marker.length).trim();
+  return value2 ? { marker: best.marker, value: value2 } : null;
+}
 async function startDeployRun(opts) {
   const { hooks } = opts;
-  const workspace = import_path9.default.join(opts.spaceDir, "workspace");
-  const configDir = import_path9.default.dirname(opts.spaceDir);
+  const workspace = import_path10.default.join(opts.spaceDir, "workspace");
+  const configDir = import_path10.default.dirname(opts.spaceDir);
   const status = await checkDeployStatus(opts);
   if (!status.hasSkill || !status.hasVariables || !status.hasChecker) {
     throw new Error(
@@ -18747,26 +18895,8 @@ async function startDeployRun(opts) {
   let sessionId = "";
   let markerless = 0;
   let todos = [];
-  const bridge = await startSecretsBridge({
-    spaceDir: opts.spaceDir,
-    handlers: {
-      run: ({ command, cwd, status: report }) => authorizeAndRun({
-        configDir,
-        spaceDir: opts.spaceDir,
-        // A skill legitimately cds into subdirectories, so the CLI's own cwd
-        // is the right place to run - but only while it is still inside the
-        // space. Anywhere else is a confused caller, not a step, and the
-        // workspace is the safe reading of what it meant.
-        cwd: containedCwd(cwd, opts.spaceDir) ?? workspace,
-        command,
-        hooks,
-        status: report
-      }),
-      // Names only. The contract on the default branch already declares them
-      // in public, so this reveals nothing the repo does not.
-      list: () => Promise.resolve(status.variables.map((v) => v.key))
-    }
-  });
+  const declared = status.variables.map((v) => v.key);
+  const deployToken = opts.gate.issueToken(DEPLOY_ORIGIN);
   try {
     for (; ; ) {
       if (hooks.isCancelled()) throw new Error("Cancelled by user.");
@@ -18784,7 +18914,10 @@ async function startDeployRun(opts) {
           includePartialMessages: true,
           resumeSessionId: sessionId || void 0,
           appendSystemPrompt: sessionId ? void 0 : contract,
-          env: spaceEnv(opts.spaceDir),
+          env: {
+            ...spaceEnv(opts.spaceDir),
+            FACTIII_SECRETS_TOKEN: deployToken
+          },
           callbacks: {
             initialTodos: todos,
             onLog: (entry) => hooks.sendLog(entry),
@@ -18808,14 +18941,22 @@ async function startDeployRun(opts) {
           spaceDir: opts.spaceDir,
           cwd: workspace,
           command,
-          hooks
+          // The marker carries a command and nothing else, so a skill speaking
+          // it cannot name its keys. null takes the declared contract - still
+          // a narrowing from the whole store, and the most this protocol can
+          // say. New skills name their keys and get less.
+          keys: null,
+          declared,
+          origin: DEPLOY_ORIGIN,
+          gate: opts.gate,
+          sendLog: hooks.sendLog
         });
         if ("denied" in res) {
           prompt2 = "The owner declined to run that command. Adapt or stop and summarize where the release stands.";
           continue;
         }
         markerless = 0;
-        const clean = tail(res.output);
+        const clean = tail2(res.output);
         prompt2 = `The authorized command finished (exit ${res.code}). Redacted output:
 
 ${clean}`;
@@ -18845,7 +18986,7 @@ ${clean}`;
       prompt2 = "Your turn ended with no protocol marker. If the release fully shipped, end your message with DEPLOY_COMPLETE: followed by your run report; if you are stopping without shipping, end with DEPLOY_FAILED: followed by the report. Otherwise CONTINUE executing the skill from where you left off. If you had background tasks running, they were killed when your turn ended - rerun them, and reap every background task before ending a turn.";
     }
   } finally {
-    await bridge.close().catch(() => void 0);
+    opts.gate.revokeToken(deployToken);
   }
 }
 
@@ -18939,37 +19080,37 @@ async function getDriveRoot(accessToken) {
 
 // ../../shared/all/helpers/board-agent-core/space-core.ts
 var import_promises8 = require("fs/promises");
-var import_path11 = __toESM(require("path"));
+var import_path12 = __toESM(require("path"));
 
 // ../../shared/all/helpers/board-agent-core/plugin.ts
-var import_crypto3 = __toESM(require("crypto"));
+var import_crypto4 = __toESM(require("crypto"));
 var import_fs3 = require("fs");
 var import_promises7 = require("fs/promises");
 var import_os3 = __toESM(require("os"));
-var import_path10 = __toESM(require("path"));
+var import_path11 = __toESM(require("path"));
 var MARKETPLACE_NAME = "factiii-runner";
 var PLUGIN_ID = `factiii@${MARKETPLACE_NAME}`;
 var SECRETS_BIN = "factiii-secrets";
 function candidates() {
   return [
-    import_path10.default.join(__dirname, "..", "plugin"),
-    import_path10.default.join(__dirname, "..", "..", "..", "..", "apps", "runner", "plugin"),
-    import_path10.default.join(process.cwd(), "apps", "runner", "plugin")
+    import_path11.default.join(__dirname, "..", "plugin"),
+    import_path11.default.join(__dirname, "..", "..", "..", "..", "apps", "runner", "plugin"),
+    import_path11.default.join(process.cwd(), "apps", "runner", "plugin")
   ];
 }
 function pluginRoot() {
   for (const dir of candidates()) {
-    if ((0, import_fs3.existsSync)(import_path10.default.join(dir, ".claude-plugin", "marketplace.json"))) {
+    if ((0, import_fs3.existsSync)(import_path11.default.join(dir, ".claude-plugin", "marketplace.json"))) {
       return dir;
     }
   }
   return null;
 }
 function renderedPluginRoot() {
-  return import_path10.default.join(import_os3.default.homedir(), ".factiii-runner", "plugin");
+  return import_path11.default.join(import_os3.default.homedir(), ".factiii-runner", "plugin");
 }
 async function runnerVersion(source) {
-  const pkg = import_path10.default.join(source, "..", "package.json");
+  const pkg = import_path11.default.join(source, "..", "package.json");
   const raw = await (0, import_promises7.readFile)(pkg, "utf8").catch(() => null);
   if (!raw) return FALLBACK_VERSION;
   try {
@@ -18984,16 +19125,16 @@ async function treeFiles(dir) {
   const entries = await (0, import_promises7.readdir)(dir, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const full = import_path10.default.join(dir, entry.name);
+    const full = import_path11.default.join(dir, entry.name);
     if (entry.isDirectory()) files.push(...await treeFiles(full));
     else if (entry.isFile()) files.push(full);
   }
   return files.sort();
 }
 async function fingerprint(source, url2, version = "") {
-  const hash = import_crypto3.default.createHash("sha256").update(url2).update(version);
+  const hash = import_crypto4.default.createHash("sha256").update(url2).update(version);
   for (const file of await treeFiles(source)) {
-    hash.update(import_path10.default.relative(source, file));
+    hash.update(import_path11.default.relative(source, file));
     hash.update(await (0, import_promises7.readFile)(file));
   }
   return hash.digest("hex");
@@ -19019,10 +19160,10 @@ async function renderPluginImpl(boardMcpUrl) {
   const want = await fingerprint(source, boardMcpUrl, version);
   const have = await (0, import_promises7.readFile)(stampPath(dest), "utf8").catch(() => null);
   if (have === want) return dest;
-  await (0, import_promises7.mkdir)(import_path10.default.dirname(dest), { recursive: true });
+  await (0, import_promises7.mkdir)(import_path11.default.dirname(dest), { recursive: true });
   await (0, import_promises7.cp)(source, dest, { recursive: true, force: true });
   await (0, import_promises7.writeFile)(
-    import_path10.default.join(dest, "factiii", ".mcp.json"),
+    import_path11.default.join(dest, "factiii", ".mcp.json"),
     `${JSON.stringify(boardMcpConfig(boardMcpUrl), null, 2)}
 `
   );
@@ -19031,7 +19172,7 @@ async function renderPluginImpl(boardMcpUrl) {
   return dest;
 }
 async function stampVersion(dest, version) {
-  const manifest = import_path10.default.join(dest, "factiii", ".claude-plugin", "plugin.json");
+  const manifest = import_path11.default.join(dest, "factiii", ".claude-plugin", "plugin.json");
   const raw = await (0, import_promises7.readFile)(manifest, "utf8").catch(() => null);
   if (!raw) return;
   const parsed = JSON.parse(raw);
@@ -19257,6 +19398,17 @@ var SpaceCore = class {
     // Positive-only cache per provider: true sticks until sign-out, false is
     // re-probed (an in-terminal login can flip it).
     this.loggedIn = {};
+    /** The space's authorization gate, and the registry of which sessions may
+     *  ask at all (see secrets-gate.ts). Here rather than on the engine because
+     *  every session type has a SpaceCore and needs a token minted for it. */
+    this.gate = new SecretsGate();
+    /** The live deploy run's log sink, so a command it authorizes still lands on
+     *  the release timeline now that the bridge is not the run's own. Set by the
+     *  engine for the length of a run. */
+    this.deployLog = null;
+    this.secretsBridge = null;
+    this.bridgeStarting = null;
+    this.spaceSecretsToken = "";
     // ── Persistent per-space workspace: clone, worktrees, redis state ──
     // Just a directory, so a restart needs no reattach.
     this.execTarget = null;
@@ -19271,10 +19423,101 @@ var SpaceCore = class {
     this.mcp = options.mcp;
     this.requestSudo = options.requestSudo;
     this.activity = new ActivityTracker(this.emitter);
+    this.gate.subscribe(() => {
+      const pending = this.gate.pending();
+      if (pending) {
+        this.activity.set(
+          "secrets-auth",
+          "awaiting-input",
+          "Needs your store password",
+          `${pending.origin}: ${pending.command}`
+        );
+      } else {
+        this.activity.clear("secrets-auth");
+      }
+      this.emitter.emitSecretsAuth({ pending: pending !== null });
+    });
   }
   setLoggedIn(provider, value2) {
     this.loggedIn[provider] = value2;
   }
+  /** Serve `factiii-secrets` for this space, once. Lazy rather than
+   *  constructor-time: the socket lives under `state`, which does not exist
+   *  until the workspace is provisioned. Provisioning and reattach both call
+   *  it, so the socket is up before anything can reach for it. */
+  async ensureSecretsBridge() {
+    if (this.secretsBridge) return;
+    this.bridgeStarting ??= this.startSecretsBridgeOnce().finally(() => {
+      this.bridgeStarting = null;
+    });
+    return this.bridgeStarting;
+  }
+  async startSecretsBridgeOnce() {
+    const spaceDir = this.spaceDir();
+    this.secretsBridge = await startSecretsBridge({
+      spaceDir,
+      handlers: {
+        run: async ({ command, cwd, keys, token, status }) => {
+          const origin = token ? this.gate.originFor(token) : null;
+          if (!origin) {
+            status(UNATTRIBUTED);
+            return { code: 3, output: "" };
+          }
+          return authorizeAndRun({
+            configDir: import_path12.default.dirname(spaceDir),
+            spaceDir,
+            // A step legitimately cds into subdirectories, so the caller's own
+            // cwd is right - but only inside the space. Anywhere else is a
+            // confused caller, and the workspace is the safe reading.
+            cwd: containedCwd(cwd, spaceDir) ?? this.target().paths.workspace,
+            command,
+            keys,
+            // Only the legacy marker needs a declared fallback, and that never
+            // arrives here - a bridge caller always names its own keys.
+            declared: [],
+            origin,
+            gate: this.gate,
+            // A deploy-origin command belongs on the release timeline; every
+            // other origin has no log of its own and reads the CLI's stderr.
+            sendLog: this.deployLog ?? void 0
+          });
+        },
+        list: () => this.secretsKeyInfo()
+      }
+    });
+  }
+  /** Key NAMES and status, no password. The contract declares its keys in
+   *  public on the default branch, and sops leaves names in cleartext, so this
+   *  reveals nothing the repo and the file do not already say. */
+  async secretsKeyInfo() {
+    const stored = new Set(await storedSecretKeys(this.spaceDir()));
+    const config = this.readConfig();
+    const declared = new Set(
+      config.repoUrl && config.githubToken ? await checkDeployStatus({
+        spaceDir: this.spaceDir(),
+        repoUrl: config.repoUrl,
+        mainBranch: config.mainBranch,
+        githubToken: config.githubToken
+      }).then((status) => status.variables.map((v) => v.key)).catch(() => []) : []
+    );
+    return [.../* @__PURE__ */ new Set([...declared, ...stored])].sort().map((key) => ({
+      key,
+      stored: stored.has(key),
+      declared: declared.has(key)
+    }));
+  }
+  /**
+   * The token every session this space spawns carries, so `factiii-secrets`
+   * inside one is attributable and everything else is refused.
+   *
+   * One per space, not per session: `extraEnv` is the only place every spawn
+   * passes through and it cannot tell which session it is building for. A run
+   * that DOES know itself - the deploy run - mints its own and overrides this.
+   */
+  secretsToken() {
+    this.spaceSecretsToken ||= this.gate.issueToken("A session on this board");
+    return this.spaceSecretsToken;
+  }
   readConfig() {
     return this.configProvider.readConfig(this.spaceSlug);
   }
@@ -19286,6 +19529,7 @@ var SpaceCore = class {
       for (const lane of this.mcpLanes()) env[lane.tokenEnv] = lane.mcp.token;
       const board = this.boardMcp();
       if (board) env[BOARD_MCP_TOKEN_ENV] = board.token;
+      env.FACTIII_SECRETS_TOKEN = this.secretsToken();
       return env;
     });
     return this.execTarget;
@@ -19461,6 +19705,7 @@ var SpaceCore = class {
           `mkdir -p ${paths.root} ${paths.worktrees} ${paths.state} ${paths.backups} ${paths.builds} ${paths.bin}`
         );
         await allocateSpacePorts(this.spaceDir());
+        await this.ensureSecretsBridge().catch(() => void 0);
         await ensureRedis(target);
         await Promise.all([
           this.provisionGitLane(status),
@@ -19557,14 +19802,14 @@ var SpaceCore = class {
     const source = pluginRoot();
     if (!source) return;
     const { bin } = this.target().paths;
-    const from = import_path11.default.join(source, "factiii", "bin", SECRETS_BIN);
-    const to = import_path11.default.join(bin, SECRETS_BIN);
+    const from = import_path12.default.join(source, "factiii", "bin", SECRETS_BIN);
+    const to = import_path12.default.join(bin, SECRETS_BIN);
     try {
       const [src, staged] = await Promise.all([
-        (0, import_promises8.stat)(from),
-        (0, import_promises8.stat)(to).catch(() => null)
+        (0, import_promises8.readFile)(from),
+        (0, import_promises8.readFile)(to).catch(() => null)
       ]);
-      if (staged?.size === src.size) return;
+      if (staged?.equals(src)) return;
       await (0, import_promises8.mkdir)(bin, { recursive: true });
       await (0, import_promises8.copyFile)(from, to);
       await (0, import_promises8.chmod)(to, 493);
@@ -19623,10 +19868,12 @@ var SpaceCore = class {
     } catch {
       return false;
     }
+    await this.ensureSecretsBridge().catch(() => void 0);
     await ensureRedis(target).catch(() => {
     });
     await pruneWorktrees(target).catch(() => {
     });
+    await Promise.all([this.provisionPluginLane(), this.provisionBinLane()]);
     await this.provisionMcpLane();
     this.ready = true;
     return true;
@@ -19651,6 +19898,9 @@ var SpaceCore = class {
   destroy() {
     this.ready = false;
     this.setupPromise = null;
+    this.gate.destroy();
+    void this.secretsBridge?.close();
+    this.secretsBridge = null;
     this.activity.destroy();
   }
 };
@@ -19701,6 +19951,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
       logs: [],
       question: "",
       pendingCommand: "",
+      pendingKeys: [],
       error: "",
       summary: "",
       startedAt: 0,
@@ -19722,6 +19973,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
     this.emitter = options.emitter;
     this.claude = new ClaudeModeEngine(this.core, this.emitter);
     this.terminal = new TerminalModeEngine(this.core, this.emitter);
+    this.gate.subscribe(() => this.projectGateOntoRun());
   }
   /** Everything the runner does for this space that isn't a card session, so
    *  the Running jobs panel can report the whole machine. Owned by the core,
@@ -19729,6 +19981,39 @@ var BoardAgentEngine = class _BoardAgentEngine {
   get activity() {
     return this.core.activity;
   }
+  /** The space's gate (space-core.ts). Reached through here because most of
+   *  what uses it - the bridge, the deploy run - lives on the engine. */
+  get gate() {
+    return this.core.gate;
+  }
+  /** Mirror the gate onto the deploy run's phase, for clients older than the
+   *  global modal - they know a password is needed only from `awaiting-auth`. */
+  projectGateOntoRun() {
+    const pending = this.gate.pending();
+    const runLive = this.runState.phase === "running" || this.runState.phase === "awaiting-auth";
+    if (runLive && pending?.origin === DEPLOY_ORIGIN) {
+      this.setRun({
+        phase: "awaiting-auth",
+        pendingCommand: pending.command,
+        pendingKeys: pending.keys,
+        error: pending.error
+      });
+    } else if (this.runState.phase === "awaiting-auth") {
+      this.setRun({ phase: "running", pendingCommand: "", pendingKeys: [] });
+    }
+  }
+  // ── Secrets authorization (see secrets-gate.ts + .specs/deploy.md) ──
+  /** What the global authorization modal renders. Null when nothing is
+   *  waiting, which is also how an answered prompt tells clients to close. */
+  secretsAuthState() {
+    return { pending: this.gate.pending() };
+  }
+  secretsAuthAnswer(payload) {
+    return this.gate.answer(
+      payload.id,
+      payload.password === void 0 ? { denied: true } : { password: payload.password }
+    );
+  }
   /** How this host protects stored credentials. Read-only: the daemon answers
    *  unlock and password changes itself (SECURE_ACTIONS in daemon.ts). */
   secureStatus() {
@@ -19939,7 +20224,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
    *  sit on `awaiting-input` for hours, which is exactly the state worth
    *  seeing without opening the modal. */
   syncRunActivity() {
-    const { phase, question, pendingCommand, error } = this.runState;
+    const { phase, question, pendingCommand, pendingKeys, error } = this.runState;
     switch (phase) {
       case "running":
         return this.activity.set("deploy-run", "working", "Deploying");
@@ -19955,7 +20240,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
           "deploy-run",
           "awaiting-input",
           "Deploy needs authorization",
-          pendingCommand
+          pendingKeys.length ? `${pendingCommand} (${pendingKeys.join(", ")})` : pendingCommand
         );
       case "failed":
         return this.activity.set("deploy-run", "error", "Deploy failed", error);
@@ -19977,6 +20262,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
       logs: [],
       question: "",
       pendingCommand: "",
+      pendingKeys: [],
       error: "",
       summary: "",
       startedAt: Date.now(),
@@ -20001,6 +20287,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
       }
       sendLog(entry);
     };
+    this.core.deployLog = bufferLog;
     void startDeployRun({
       spaceDir: opts.spaceDir,
       repoUrl: opts.repoUrl,
@@ -20008,6 +20295,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
       githubToken: opts.githubToken,
       provider: opts.provider,
       releaseBranch,
+      gate: this.gate,
       hooks: {
         sendLog: bufferLog,
         onTodos: (todos) => this.setRun({ todos }),
@@ -20015,19 +20303,13 @@ var BoardAgentEngine = class _BoardAgentEngine {
           this.runResolvers.human = resolve2;
           this.setRun({ phase: "awaiting-input", question });
         }),
-        requestAuth: (command, errorNote) => new Promise((resolve2) => {
-          this.runResolvers.auth = resolve2;
-          this.setRun({
-            phase: "awaiting-auth",
-            pendingCommand: command,
-            error: errorNote ?? ""
-          });
-        }),
         isCancelled: () => this.runCancelled,
         registerProc: (proc) => {
           this.runProc = proc;
         }
       }
+    }).finally(() => {
+      this.core.deployLog = null;
     }).then(({ shipped, summary }) => {
       if (shipped) {
         this.setRun({ phase: "success", summary, finishedAt: Date.now() });
@@ -20060,31 +20342,28 @@ var BoardAgentEngine = class _BoardAgentEngine {
   }
   // The password arrives RUNNER-DIRECT here and only feeds decryption; it
   // never enters the agent session (see .specs/deploy.md).
+  //
+  // Both predate the global modal, when a deploy run was the only thing that
+  // could ask, and are kept so a client too old to send `secretsAuthAnswer`
+  // still works.
   deployRunAuthorize(payload) {
-    const resolve2 = this.runResolvers.auth;
-    if (!resolve2 || this.runState.phase !== "awaiting-auth") {
-      throw new Error("No command is awaiting authorization.");
-    }
-    this.runResolvers.auth = void 0;
-    this.setRun({ phase: "running", pendingCommand: "", error: "" });
-    resolve2({ password: payload.password });
-    return { success: true };
+    return this.answerPendingAuth({ password: payload.password });
   }
   deployRunDeny() {
-    const resolve2 = this.runResolvers.auth;
-    if (!resolve2 || this.runState.phase !== "awaiting-auth") {
-      throw new Error("No command is awaiting authorization.");
+    return this.answerPendingAuth({ denied: true });
+  }
+  answerPendingAuth(result) {
+    const pending = this.gate.pending();
+    if (pending?.origin !== DEPLOY_ORIGIN) {
+      throw new Error("No deploy command is awaiting authorization.");
     }
-    this.runResolvers.auth = void 0;
-    this.setRun({ phase: "running", pendingCommand: "" });
-    resolve2({ denied: true });
-    return { success: true };
+    return this.gate.answer(pending.id, result);
   }
   deployRunCancel() {
     this.runCancelled = true;
     if (this.runProc) killTree(this.runProc, "SIGTERM");
     this.runResolvers.human?.("cancel");
-    this.runResolvers.auth?.({ denied: true });
+    if (this.gate.pending()?.origin === DEPLOY_ORIGIN) this.gate.cancel();
     this.runResolvers = {};
     return { success: true };
   }
@@ -20101,6 +20380,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
       logs: [],
       question: "",
       pendingCommand: "",
+      pendingKeys: [],
       error: "",
       summary: "",
       startedAt: 0,
@@ -20248,7 +20528,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
   // ── Runner secrets store (secrets.sh contract; see host-secrets.ts) ──
   secretsDirs() {
     const spaceDir = this.core.spaceDir();
-    return { configDir: (0, import_path12.dirname)(spaceDir), spaceDir };
+    return { configDir: (0, import_path13.dirname)(spaceDir), spaceDir };
   }
   async deploySecretsStatus() {
     return {
@@ -21132,6 +21412,12 @@ ${c.content.trim() || "(no description)"}`
         return this.deployRunDismiss();
       case "deployApproveSkill":
         return await this.deployApproveSkill();
+      case "secretsAuthState":
+        return this.secretsAuthState();
+      case "secretsAuthAnswer":
+        return this.secretsAuthAnswer(
+          payload
+        );
       case "deploySecretsStatus":
         return await this.deploySecretsStatus();
       case "deploySecretsInit":
@@ -21312,11 +21598,11 @@ ${c.content.trim() || "(no description)"}`
 
 // ../../shared/all/helpers/board-agent-core/index-service.ts
 var import_child_process5 = require("child_process");
-var import_crypto4 = require("crypto");
+var import_crypto5 = require("crypto");
 var import_fs4 = require("fs");
 var import_promises9 = __toESM(require("fs/promises"));
 var import_net3 = require("net");
-var import_path13 = require("path");
+var import_path14 = require("path");
 var import_util7 = require("util");
 var execFileAsync4 = (0, import_util7.promisify)(import_child_process5.execFile);
 var IndexService = class {
@@ -21330,7 +21616,7 @@ var IndexService = class {
   /** Per-space bearer for MCP + file, derived from the control token (the
    *  service computes the same). */
   bearerToken(spaceSlug) {
-    return (0, import_crypto4.createHmac)("sha256", this.opts.controlToken).update(`mcp:${spaceSlug}`).digest("hex");
+    return (0, import_crypto5.createHmac)("sha256", this.opts.controlToken).update(`mcp:${spaceSlug}`).digest("hex");
   }
   /** MCP bridge for a space. Null until the service is up (which it kicks
    *  off), so a bad :0 URL is never baked in; provisionMcpLane re-runs. */
@@ -21375,7 +21661,7 @@ var IndexService = class {
     const log = await this.openLog();
     this.proc = (0, import_child_process5.spawn)(
       process.execPath,
-      [(0, import_path13.join)(this.opts.indexDir, "index.js")],
+      [(0, import_path14.join)(this.opts.indexDir, "index.js")],
       {
         cwd: this.opts.indexDir,
         env: {
@@ -21404,7 +21690,7 @@ var IndexService = class {
   async openLog() {
     try {
       await import_promises9.default.mkdir(this.opts.dataDir, { recursive: true });
-      return (0, import_fs4.openSync)((0, import_path13.join)(this.opts.dataDir, "index.log"), "a");
+      return (0, import_fs4.openSync)((0, import_path14.join)(this.opts.dataDir, "index.log"), "a");
     } catch {
       return null;
     }
@@ -21413,10 +21699,10 @@ var IndexService = class {
    *  platform needing node-gyp fails here rather than at query time. */
   async installDeps() {
     const dir = this.opts.indexDir;
-    if ((0, import_fs4.existsSync)((0, import_path13.join)(dir, "node_modules"))) return;
+    if ((0, import_fs4.existsSync)((0, import_path14.join)(dir, "node_modules"))) return;
     await import_promises9.default.copyFile(
-      (0, import_path13.join)(dir, "image-package.json"),
-      (0, import_path13.join)(dir, "package.json")
+      (0, import_path14.join)(dir, "image-package.json"),
+      (0, import_path14.join)(dir, "package.json")
     );
     await execFileAsync4(
       "npm",
@@ -21428,7 +21714,7 @@ var IndexService = class {
    *  CLIs' persistent MCP config, so a fresh port each start would leave every
    *  registration pointing at a dead one. */
   async stablePort() {
-    const file = (0, import_path13.join)(this.opts.dataDir, ".port");
+    const file = (0, import_path14.join)(this.opts.dataDir, ".port");
     const saved = Number(await import_promises9.default.readFile(file, "utf-8").catch(() => ""));
     if (Number.isInteger(saved) && saved > 0 && await isFree(saved)) {
       return saved;
@@ -21605,22 +21891,22 @@ async function pairWithBrowser(serverUrl) {
 // src/config.ts
 var import_fs8 = __toESM(require("fs"));
 var import_os6 = __toESM(require("os"));
-var import_path18 = __toESM(require("path"));
+var import_path19 = __toESM(require("path"));
 
 // src/secureFile.ts
-var import_crypto7 = __toESM(require("crypto"));
+var import_crypto8 = __toESM(require("crypto"));
 var import_fs7 = __toESM(require("fs"));
-var import_path17 = __toESM(require("path"));
+var import_path18 = __toESM(require("path"));
 
 // src/keychain.ts
 var import_child_process7 = require("child_process");
-var import_crypto5 = __toESM(require("crypto"));
+var import_crypto6 = __toESM(require("crypto"));
 var import_fs5 = __toESM(require("fs"));
 var import_os4 = __toESM(require("os"));
-var import_path14 = __toESM(require("path"));
+var import_path15 = __toESM(require("path"));
 var SERVICE = "factiii-runner";
 var ACCOUNT = "config-encryption-key";
-var DPAPI_KEY_FILE = import_path14.default.join(
+var DPAPI_KEY_FILE = import_path15.default.join(
   import_os4.default.homedir(),
   ".factiii-runner",
   "config-key.dpapi"
@@ -21726,7 +22012,7 @@ function winWrite(key) {
     "-Command",
     `ConvertTo-SecureString -String '${key.toString("base64")}' -AsPlainText -Force | ConvertFrom-SecureString`
   ]);
-  import_fs5.default.mkdirSync(import_path14.default.dirname(DPAPI_KEY_FILE), { recursive: true });
+  import_fs5.default.mkdirSync(import_path15.default.dirname(DPAPI_KEY_FILE), { recursive: true });
   import_fs5.default.writeFileSync(DPAPI_KEY_FILE, `${out.trim()}
 `, { mode: 384 });
 }
@@ -21866,7 +22152,7 @@ function resolve() {
       cached = { key: null, status: diagnose() };
       return cached;
     }
-    const fresh = import_crypto5.default.randomBytes(32);
+    const fresh = import_crypto6.default.randomBytes(32);
     writeKey(fresh);
     const verify = readKey();
     if (verify.state !== "found" || !verify.key.equals(fresh)) {
@@ -21888,23 +22174,23 @@ function keychainStatus() {
 }
 
 // src/secureStore.ts
-var import_crypto6 = __toESM(require("crypto"));
+var import_crypto7 = __toESM(require("crypto"));
 var import_fs6 = __toESM(require("fs"));
-var import_path16 = __toESM(require("path"));
+var import_path17 = __toESM(require("path"));
 
 // src/paths.ts
 var import_os5 = __toESM(require("os"));
-var import_path15 = __toESM(require("path"));
-var CONFIG_DIR = import_path15.default.join(import_os5.default.homedir(), ".factiii-runner");
+var import_path16 = __toESM(require("path"));
+var CONFIG_DIR = import_path16.default.join(import_os5.default.homedir(), ".factiii-runner");
 function safeSlug(spaceSlug) {
   return spaceSlug.replace(/[^a-zA-Z0-9_.-]/g, "_");
 }
 function spaceDirPath(spaceSlug) {
-  return import_path15.default.join(CONFIG_DIR, safeSlug(spaceSlug));
+  return import_path16.default.join(CONFIG_DIR, safeSlug(spaceSlug));
 }
 
 // src/secureStore.ts
-var VAULT_KEY_FILE = import_path16.default.join(CONFIG_DIR, "vault-key.json");
+var VAULT_KEY_FILE = import_path17.default.join(CONFIG_DIR, "vault-key.json");
 var SCRYPT_N2 = 1 << 15;
 var MIN_PASSWORD_LENGTH = 8;
 var SecureStoreError = class extends Error {
@@ -21931,7 +22217,7 @@ function requireKeychainKey() {
   );
 }
 function passwordKey(password, salt) {
-  return import_crypto6.default.scryptSync(password, salt, 32, {
+  return import_crypto7.default.scryptSync(password, salt, 32, {
     N: SCRYPT_N2,
     maxmem: 64 * 1024 * 1024
   });
@@ -21939,7 +22225,7 @@ function passwordKey(password, salt) {
 function wrapKey(machineKey, pwKey) {
   const ikm = pwKey ? Buffer.concat([machineKey, pwKey]) : machineKey;
   return Buffer.from(
-    import_crypto6.default.hkdfSync(
+    import_crypto7.default.hkdfSync(
       "sha256",
       ikm,
       Buffer.alloc(0),
@@ -21949,8 +22235,8 @@ function wrapKey(machineKey, pwKey) {
   );
 }
 function seal(plaintext, key) {
-  const iv = import_crypto6.default.randomBytes(12);
-  const cipher = import_crypto6.default.createCipheriv("aes-256-gcm", key, iv);
+  const iv = import_crypto7.default.randomBytes(12);
+  const cipher = import_crypto7.default.createCipheriv("aes-256-gcm", key, iv);
   const data = Buffer.concat([cipher.update(plaintext), cipher.final()]);
   return {
     iv: iv.toString("base64"),
@@ -21960,7 +22246,7 @@ function seal(plaintext, key) {
 }
 function unseal(box, key) {
   try {
-    const decipher = import_crypto6.default.createDecipheriv(
+    const decipher = import_crypto7.default.createDecipheriv(
       "aes-256-gcm",
       key,
       Buffer.from(box.iv, "base64")
@@ -21993,7 +22279,7 @@ function writeVaultFile(file) {
 }
 var unlockedDek = null;
 function createVault(machineKey) {
-  const dek = import_crypto6.default.randomBytes(32);
+  const dek = import_crypto7.default.randomBytes(32);
   writeVaultFile({
     v: 1,
     passwordEnabled: false,
@@ -22088,7 +22374,7 @@ function enablePassword(password) {
     );
   }
   const dek = dataKey();
-  const salt = import_crypto6.default.randomBytes(16);
+  const salt = import_crypto7.default.randomBytes(16);
   writeVaultFile({
     v: 1,
     passwordEnabled: true,
@@ -22116,7 +22402,7 @@ function changePassword(current, next) {
       "The current password is not correct."
     );
   }
-  const salt = import_crypto6.default.randomBytes(16);
+  const salt = import_crypto7.default.randomBytes(16);
   writeVaultFile({
     v: 1,
     passwordEnabled: true,
@@ -22193,8 +22479,8 @@ function storeStatus() {
 // src/secureFile.ts
 var MAGIC = "FACTIII1";
 function encrypt(plain, key, version) {
-  const iv = import_crypto7.default.randomBytes(12);
-  const cipher = import_crypto7.default.createCipheriv("aes-256-gcm", key, iv);
+  const iv = import_crypto8.default.randomBytes(12);
+  const cipher = import_crypto8.default.createCipheriv("aes-256-gcm", key, iv);
   const data = Buffer.concat([cipher.update(plain), cipher.final()]);
   const envelope = {
     v: version,
@@ -22205,7 +22491,7 @@ function encrypt(plain, key, version) {
   return `${MAGIC}${JSON.stringify(envelope)}`;
 }
 function decrypt(envelope, key) {
-  const decipher = import_crypto7.default.createDecipheriv(
+  const decipher = import_crypto8.default.createDecipheriv(
     "aes-256-gcm",
     key,
     Buffer.from(envelope.iv, "base64")
@@ -22226,7 +22512,7 @@ function parseEnvelope(raw) {
   }
 }
 function atomicWrite(filePath, body) {
-  import_fs7.default.mkdirSync(import_path17.default.dirname(filePath), { recursive: true });
+  import_fs7.default.mkdirSync(import_path18.default.dirname(filePath), { recursive: true });
   const tmp = `${filePath}.${process.pid}.tmp`;
   import_fs7.default.writeFileSync(tmp, body, { mode: 384 });
   import_fs7.default.renameSync(tmp, filePath);
@@ -22341,8 +22627,8 @@ function writeBootJson(filePath, value2) {
 }
 
 // src/config.ts
-var CONFIG_DIR2 = import_path18.default.join(import_os6.default.homedir(), ".factiii-runner");
-var CONFIG_FILE = import_path18.default.join(CONFIG_DIR2, "config.json");
+var CONFIG_DIR2 = import_path19.default.join(import_os6.default.homedir(), ".factiii-runner");
+var CONFIG_FILE = import_path19.default.join(CONFIG_DIR2, "config.json");
 function readRunnerConfig() {
   return readBootJson(CONFIG_FILE);
 }
@@ -22511,10 +22797,10 @@ function makeChunkReassembler() {
 }
 
 // src/daemon.ts
-var import_crypto8 = require("crypto");
+var import_crypto9 = require("crypto");
 var import_fs10 = __toESM(require("fs"));
 var import_node_datachannel = require("node-datachannel");
-var import_path20 = __toESM(require("path"));
+var import_path21 = __toESM(require("path"));
 
 // ../../node_modules/engine.io-client/build/esm-debug/transports/polling-xhr.node.js
 var XMLHttpRequestModule = __toESM(require_XMLHttpRequest(), 1);
@@ -23694,12 +23980,12 @@ function parse2(str) {
   uri.queryKey = queryKey(uri, uri["query"]);
   return uri;
 }
-function pathNames(obj, path20) {
-  const regx = /\/{2,9}/g, names = path20.replace(regx, "/").split("/");
-  if (path20.slice(0, 1) == "/" || path20.length === 0) {
+function pathNames(obj, path21) {
+  const regx = /\/{2,9}/g, names = path21.replace(regx, "/").split("/");
+  if (path21.slice(0, 1) == "/" || path21.length === 0) {
     names.splice(0, 1);
   }
-  if (path20.slice(-1) == "/") {
+  if (path21.slice(-1) == "/") {
     names.splice(names.length - 1, 1);
   }
   return names;
@@ -24318,7 +24604,7 @@ var protocol2 = Socket.protocol;
 // ../../node_modules/socket.io-client/build/esm-debug/url.js
 var import_debug7 = __toESM(require_src(), 1);
 var debug7 = (0, import_debug7.default)("socket.io-client:url");
-function url(uri, path20 = "", loc) {
+function url(uri, path21 = "", loc) {
   let obj = uri;
   loc = loc || typeof location !== "undefined" && location;
   if (null == uri)
@@ -24352,7 +24638,7 @@ function url(uri, path20 = "", loc) {
   obj.path = obj.path || "/";
   const ipv6 = obj.host.indexOf(":") !== -1;
   const host = ipv6 ? "[" + obj.host + "]" : obj.host;
-  obj.id = obj.protocol + "://" + host + ":" + obj.port + path20;
+  obj.id = obj.protocol + "://" + host + ":" + obj.port + path21;
   obj.href = obj.protocol + "://" + host + (loc && loc.port === obj.port ? "" : ":" + obj.port);
   return obj;
 }
@@ -25986,8 +26272,8 @@ function lookup(uri, opts) {
   const parsed = url(uri, opts.path || "/socket.io");
   const source = parsed.source;
   const id = parsed.id;
-  const path20 = parsed.path;
-  const sameNamespace = cache[id] && path20 in cache[id]["nsps"];
+  const path21 = parsed.path;
+  const sameNamespace = cache[id] && path21 in cache[id]["nsps"];
   const newConnection = opts.forceNew || opts["force new connection"] || false === opts.multiplex || sameNamespace;
   let io;
   if (newConnection) {
@@ -26029,8 +26315,8 @@ function cardContextPath(target, postId) {
   const safe = postId.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80) || "card";
   return `${target.paths.root}/.cards/${safe}.md`;
 }
-function cardContextPrompt(path20) {
-  return `Read ${path20} - it is the Factiii card this session was opened from. Use it as the context and start working on it.`;
+function cardContextPrompt(path21) {
+  return `Read ${path21} - it is the Factiii card this session was opened from. Use it as the context and start working on it.`;
 }
 var CLAUDE_PERMISSION_MODE = `--permission-mode auto`;
 var RESUME_SEED = "You are now in an interactive terminal, not the board UI. Respond in plain text and use your normal tools; do not use openui-lang or component schemas anymore.";
@@ -26195,10 +26481,10 @@ var TerminalManager = class {
 
 // src/agent-adapter.ts
 var import_fs9 = __toESM(require("fs"));
-var import_path19 = __toESM(require("path"));
-var RUNNER_CONFIG_PATH = import_path19.default.join(CONFIG_DIR, "runner-config.json");
+var import_path20 = __toESM(require("path"));
+var RUNNER_CONFIG_PATH = import_path20.default.join(CONFIG_DIR, "runner-config.json");
 function connectionPath(spaceSlug) {
-  return import_path19.default.join(CONFIG_DIR, `space-${safeSlug(spaceSlug)}.onedrive.json`);
+  return import_path20.default.join(CONFIG_DIR, `space-${safeSlug(spaceSlug)}.onedrive.json`);
 }
 function writeJson(filePath, value2) {
   writeSecureJson(filePath, value2);
@@ -26232,7 +26518,7 @@ function migrateLegacyConfigs() {
   for (const name of legacy) {
     const slug = name.slice("space-".length, -".json".length);
     const parsed = readSecureJson(
-      import_path19.default.join(CONFIG_DIR, name)
+      import_path20.default.join(CONFIG_DIR, name)
     );
     if (!parsed) continue;
     if (!file.defaultSlug) {
@@ -26257,7 +26543,7 @@ function encryptStrayPlaintextConfigs() {
     return;
   }
   for (const name of names) {
-    const filePath = import_path19.default.join(CONFIG_DIR, name);
+    const filePath = import_path20.default.join(CONFIG_DIR, name);
     try {
       const raw = import_fs9.default.readFileSync(filePath, "utf-8");
       if (!raw.startsWith("{")) continue;
@@ -26386,7 +26672,7 @@ var localConfigProvider = {
       "claude",
       "codex"
     ]) {
-      import_fs9.default.mkdirSync(import_path19.default.join(dir, sub), { recursive: true });
+      import_fs9.default.mkdirSync(import_path20.default.join(dir, sub), { recursive: true });
     }
     return dir;
   }
@@ -26560,15 +26846,15 @@ async function startDaemon(config) {
     }
   );
   const indexCandidates = [
-    import_path20.default.join(__dirname, "..", "index"),
-    import_path20.default.join(__dirname, "..", "..", "index", "image")
+    import_path21.default.join(__dirname, "..", "index"),
+    import_path21.default.join(__dirname, "..", "..", "index", "image")
   ];
   const indexDir = indexCandidates.find((p) => import_fs10.default.existsSync(p)) ?? indexCandidates[0];
   const odIndex = new IndexService({
-    controlToken: (0, import_crypto8.createHash)("sha256").update(config.authToken).digest("hex"),
+    controlToken: (0, import_crypto9.createHash)("sha256").update(config.authToken).digest("hex"),
     embedUrl: () => config.serverUrl,
     indexDir,
-    dataDir: import_path20.default.join(CONFIG_DIR, "index-data")
+    dataDir: import_path21.default.join(CONFIG_DIR, "index-data")
   });
   void odIndex.ensureRunning().catch((err) => {
     console.error(
@@ -27182,11 +27468,27 @@ ${err.fix}`);
   console.error("");
   process.exit(1);
 }
+var MAX_SUPPORTED_NODE_MAJOR = 24;
+function assertSupportedNode() {
+  const major = Number(process.versions.node.split(".")[0]);
+  if (Number.isNaN(major) || major <= MAX_SUPPORTED_NODE_MAJOR) return;
+  console.error(
+    `
+factiii-runner needs Node 20\u2013${MAX_SUPPORTED_NODE_MAJOR} (pinned 24.11.1); you are on Node ${process.versions.node}.
+The bundled OneDrive index compiles better-sqlite3 from source, and that build fails on Node 25+.
+
+Switch with nvm:  nvm install 24.11.1 && nvm use 24.11.1
+then relaunch:    factiii-runner start
+`
+  );
+  process.exit(1);
+}
 import_node_dns.default.setDefaultResultOrder("ipv4first");
 var program2 = new Command();
 program2.name("factiii-runner").description("Factiii Runner - run Board AI agents on remote servers").version(currentVersion());
 program2.command("setup").description("Verify the host toolchain and pair this runner").option("-s, --server <url>", "API server URL", "https://api.factiii.com").action(async (opts) => {
   try {
+    assertSupportedNode();
     await setup(opts.server);
   } catch (err) {
     console.error(
@@ -27215,6 +27517,7 @@ program2.command("connect").description("Pair this runner with a Factiii account
   }
 });
 program2.command("start").description("Start the runner daemon").action(async () => {
+  assertSupportedNode();
   if (!configExists()) {
     console.error('No config found. Run "factiii-runner setup" first.');
     process.exit(1);
@@ -27260,6 +27563,9 @@ program2.command("status").description("Show current runner configuration").acti
   console.log(`Token:   \xB7\xB7\xB7\xB7${config.authToken.slice(-4)}`);
 });
 program2.command("doctor").description("Show where each host tool resolves, for a failed environment").action(async () => {
+  const nodeMajor = Number(process.versions.node.split(".")[0]);
+  const nodeNote = nodeMajor > MAX_SUPPORTED_NODE_MAJOR ? "  (UNSUPPORTED \u2014 use 24.11.1)" : "";
+  console.log(`${"node".padEnd(14)} ${process.execPath} v${process.versions.node}${nodeNote}`);
   const report = await reportToolchain(hostTarget(CONFIG_DIR));
   for (const tool of report.tools) {
     console.log(`${tool.bin.padEnd(14)} ${tool.location || "NOT FOUND"}`);