@factiii/runner 0.9.7 → 0.10.0

package/dist/cli.js

@@ -963,8 +963,8 @@ var require_command = __commonJS({
   "node_modules/commander/lib/command.js"(exports2) {
     var EventEmitter = require("node:events").EventEmitter;
     var childProcess = require("node:child_process");
-    var path16 = require("node:path");
-    var fs13 = require("node:fs");
+    var path17 = require("node:path");
+    var fs14 = require("node:fs");
     var process2 = require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1896,11 +1896,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path16.resolve(baseDir, baseName);
-          if (fs13.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path16.extname(baseName))) return void 0;
+          const localBin = path17.resolve(baseDir, baseName);
+          if (fs14.existsSync(localBin)) return localBin;
+          if (sourceExt.includes(path17.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext) => fs13.existsSync(`${localBin}${ext}`)
+            (ext) => fs14.existsSync(`${localBin}${ext}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1912,21 +1912,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs13.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs14.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path16.resolve(
-            path16.dirname(resolvedScriptPath),
+          executableDir = path17.resolve(
+            path17.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path16.basename(
+            const legacyName = path17.basename(
               this._scriptPath,
-              path16.extname(this._scriptPath)
+              path17.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -1937,7 +1937,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path16.extname(executableFile));
+        launchWithNode = sourceExt.includes(path17.extname(executableFile));
         let proc;
         if (process2.platform !== "win32") {
           if (launchWithNode) {
@@ -2777,7 +2777,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path16.basename(filename, path16.extname(filename));
+        this._name = path17.basename(filename, path17.extname(filename));
         return this;
       }
       /**
@@ -2791,9 +2791,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path17) {
-        if (path17 === void 0) return this._executableDir;
-        this._executableDir = path17;
+      executableDir(path18) {
+        if (path18 === void 0) return this._executableDir;
+        this._executableDir = path18;
         return this;
       }
       /**
@@ -3026,9 +3026,9 @@ var require_commander = __commonJS({
 // ../../node_modules/xmlhttprequest-ssl/lib/XMLHttpRequest.js
 var require_XMLHttpRequest = __commonJS({
   "../../node_modules/xmlhttprequest-ssl/lib/XMLHttpRequest.js"(exports2, module2) {
-    var fs13 = require("fs");
+    var fs14 = require("fs");
     var Url = require("url");
-    var spawn4 = require("child_process").spawn;
+    var spawn5 = require("child_process").spawn;
     module2.exports = XMLHttpRequest3;
     XMLHttpRequest3.XMLHttpRequest = XMLHttpRequest3;
     function XMLHttpRequest3(opts) {
@@ -3184,7 +3184,7 @@ var require_XMLHttpRequest = __commonJS({
             throw new Error("XMLHttpRequest: Only GET method is supported");
           }
           if (settings.async) {
-            fs13.readFile(unescape(url2.pathname), function(error, data2) {
+            fs14.readFile(unescape(url2.pathname), function(error, data2) {
               if (error) {
                 self.handleError(error, error.errno || -1);
               } else {
@@ -3196,7 +3196,7 @@ var require_XMLHttpRequest = __commonJS({
             });
           } else {
             try {
-              this.response = fs13.readFileSync(unescape(url2.pathname));
+              this.response = fs14.readFileSync(unescape(url2.pathname));
               this.responseText = this.response.toString("utf8");
               this.status = 200;
               setState(self.DONE);
@@ -3322,15 +3322,15 @@ var require_XMLHttpRequest = __commonJS({
         } else {
           var contentFile = ".node-xmlhttprequest-content-" + process.pid;
           var syncFile = ".node-xmlhttprequest-sync-" + process.pid;
-          fs13.writeFileSync(syncFile, "", "utf8");
+          fs14.writeFileSync(syncFile, "", "utf8");
           var execString = "var http = require('http'), https = require('https'), fs = require('fs');var doRequest = http" + (ssl ? "s" : "") + ".request;var options = " + JSON.stringify(options) + ";var responseText = '';var responseData = Buffer.alloc(0);var req = doRequest(options, function(response) {response.on('data', function(chunk) {  var data = Buffer.from(chunk);  responseText += data.toString('utf8');  responseData = Buffer.concat([responseData, data]);});response.on('end', function() {fs.writeFileSync('" + contentFile + "', JSON.stringify({err: null, data: {statusCode: response.statusCode, headers: response.headers, text: responseText, data: responseData.toString('base64')}}), 'utf8');fs.unlinkSync('" + syncFile + "');});response.on('error', function(error) {fs.writeFileSync('" + contentFile + "', 'NODE-XMLHTTPREQUEST-ERROR:' + JSON.stringify(error), 'utf8');fs.unlinkSync('" + syncFile + "');});}).on('error', function(error) {fs.writeFileSync('" + contentFile + "', 'NODE-XMLHTTPREQUEST-ERROR:' + JSON.stringify(error), 'utf8');fs.unlinkSync('" + syncFile + "');});" + (data ? "req.write('" + JSON.stringify(data).slice(1, -1).replace(/'/g, "\\'") + "');" : "") + "req.end();";
-          var syncProc = spawn4(process.argv[0], ["-e", execString]);
+          var syncProc = spawn5(process.argv[0], ["-e", execString]);
           var statusText;
-          while (fs13.existsSync(syncFile)) {
+          while (fs14.existsSync(syncFile)) {
           }
-          self.responseText = fs13.readFileSync(contentFile, "utf8");
+          self.responseText = fs14.readFileSync(contentFile, "utf8");
           syncProc.stdin.end();
-          fs13.unlinkSync(contentFile);
+          fs14.unlinkSync(contentFile);
           if (self.responseText.match(/^NODE-XMLHTTPREQUEST-ERROR:/)) {
             var errorObj = JSON.parse(self.responseText.replace(/^NODE-XMLHTTPREQUEST-ERROR:/, ""));
             self.handleError(errorObj, 503);
@@ -3984,7 +3984,7 @@ var require_has_flag = __commonJS({
 var require_supports_color = __commonJS({
   "../../node_modules/debug/node_modules/supports-color/index.js"(exports2, module2) {
     "use strict";
-    var os5 = require("os");
+    var os6 = require("os");
     var hasFlag = require_has_flag();
     var env = process.env;
     var forceColor;
@@ -4022,7 +4022,7 @@ var require_supports_color = __commonJS({
       }
       const min = forceColor ? 1 : 0;
       if (process.platform === "win32") {
-        const osRelease = os5.release().split(".");
+        const osRelease = os6.release().split(".");
         if (Number(process.versions.node.split(".")[0]) >= 8 && Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
           return Number(osRelease[2]) >= 14931 ? 3 : 2;
         }
@@ -8428,8 +8428,8 @@ function getErrorMap() {
 
 // ../../node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path16, errorMaps, issueData } = params;
-  const fullPath = [...path16, ...issueData.path || []];
+  const { data, path: path17, errorMaps, issueData } = params;
+  const fullPath = [...path17, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -8545,11 +8545,11 @@ var errorUtil;
 
 // ../../node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value2, path16, key) {
+  constructor(parent, value2, path17, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value2;
-    this._path = path16;
+    this._path = path17;
     this._key = key;
   }
   get path() {
@@ -12908,7 +12908,7 @@ ${diff.slice(0, 8e3)}`,
 }
 
 // ../../shared/all/helpers/board-agent-core/engine.ts
-var import_path8 = require("path");
+var import_path9 = require("path");
 
 // ../../shared/all/domains/electron.ts
 var SETUP_LOG_PREFIX = "
log ";
@@ -12922,6 +12922,7 @@ function hostSpacePaths(spaceDir) {
     repo: import_path.default.join(spaceDir, "repo"),
     worktrees: import_path.default.join(spaceDir, "worktrees"),
     workspace: import_path.default.join(spaceDir, "workspace"),
+    skills: import_path.default.join(spaceDir, "skills"),
     state: import_path.default.join(spaceDir, "state"),
     backups: import_path.default.join(spaceDir, "backups"),
     builds: import_path.default.join(spaceDir, "builds"),
@@ -12951,9 +12952,23 @@ function buildCloneUrl(repoUrl, githubToken) {
 async function gitInDir(target, workdir, ...args) {
   return target.run(["git", "-C", workdir, ...args]);
 }
-var WORK_BRANCH_PREFIX = "factiii/card-";
-function cardWorkBranch(workName) {
-  return `${WORK_BRANCH_PREFIX}${workName.replace(/[^a-zA-Z0-9._-]/g, "-")}`;
+var WORK_BRANCH_PREFIXES = {
+  card: "card/",
+  terminal: "terminal/"
+};
+var LEGACY_WORK_BRANCH_PREFIX = "factiii/card-";
+var ALL_WORK_BRANCH_PREFIXES = [
+  ...Object.values(WORK_BRANCH_PREFIXES),
+  LEGACY_WORK_BRANCH_PREFIX
+].sort((a, b) => b.length - a.length);
+function workBranch(workName, kind) {
+  return `${WORK_BRANCH_PREFIXES[kind]}${workName.replace(/[^a-zA-Z0-9._-]/g, "-")}`;
+}
+function workNameFromBranch(branch) {
+  for (const prefix of ALL_WORK_BRANCH_PREFIXES) {
+    if (branch.startsWith(prefix)) return branch.slice(prefix.length);
+  }
+  return null;
 }
 async function listWorkNames(target) {
   const dirs = await target.sh(`ls -1 ${target.paths.worktrees} 2>/dev/null || true`).catch(() => "");
@@ -12966,10 +12981,8 @@ async function listWorkNames(target) {
   ).catch(() => "");
   const names = new Set(dirs.split("\n").map((line) => line.trim()));
   for (const line of branches.split("\n")) {
-    const name = line.trim();
-    if (name.startsWith(WORK_BRANCH_PREFIX)) {
-      names.add(name.slice(WORK_BRANCH_PREFIX.length));
-    }
+    const workName = workNameFromBranch(line.trim());
+    if (workName) names.add(workName);
   }
   names.delete("");
   return [...names];
@@ -13003,10 +13016,18 @@ async function ensurePrimaryClone(target, cloneUrl, branch) {
   });
   await target.sh(`mkdir -p ${target.paths.worktrees}`);
 }
-async function addWorktree(target, workName, baseBranch) {
-  const path16 = worktreeFor(target.paths, workName);
-  const branch = cardWorkBranch(workName);
-  await removeWorktree(target, path16).catch(() => {
+async function addWorktree(target, workName, baseBranch, kind) {
+  const path17 = worktreeFor(target.paths, workName);
+  const branch = workBranch(workName, kind);
+  await gitInDir(
+    target,
+    target.paths.repo,
+    "fetch",
+    "origin",
+    baseBranch
+  ).catch(() => {
+  });
+  await removeWorktree(target, path17).catch(() => {
   });
   await gitInDir(
     target,
@@ -13015,29 +13036,45 @@ async function addWorktree(target, workName, baseBranch) {
     "add",
     "-B",
     branch,
-    path16,
+    path17,
     `origin/${baseBranch}`
   );
-  return { path: path16, branch };
+  return { path: path17, branch };
 }
-async function removeWorktree(target, path16) {
+async function removeWorktree(target, path17) {
   await gitInDir(
     target,
     target.paths.repo,
     "worktree",
     "remove",
     "--force",
-    path16
+    path17
   );
 }
+async function removeWorktreeAndBranch(target, path17) {
+  const branch = await gitInDir(
+    target,
+    path17,
+    "rev-parse",
+    "--abbrev-ref",
+    "HEAD"
+  ).then((out) => out.trim()).catch(() => "");
+  await removeWorktree(target, path17);
+  if (branch && branch !== "HEAD") {
+    await gitInDir(target, target.paths.repo, "branch", "-D", branch).catch(
+      () => {
+      }
+    );
+  }
+}
 async function pruneWorktrees(target) {
   await gitInDir(target, target.paths.repo, "worktree", "prune").catch(
     () => {
     }
   );
 }
-function isWorktreePath(target, path16) {
-  return path16.startsWith(`${target.paths.worktrees}/`);
+function isWorktreePath(target, path17) {
+  return path17.startsWith(`${target.paths.worktrees}/`);
 }
 async function setGitIdentity(target, name, email, workdir = target.paths.workspace) {
   if (name) await gitInDir(target, workdir, "config", "user.name", name);
@@ -13052,6 +13089,147 @@ async function extractDiff(target, workdir = target.paths.workspace) {
     changedFiles: changedFilesRaw ? changedFilesRaw.split("\n") : []
   };
 }
+var LOG_FORMAT = "%H%x1f%h%x1f%an%x1f%aI%x1f%ar%x1f%s";
+var LOG_FIELD_SEP = "";
+function parseStatus(raw) {
+  const staged = [];
+  const unstaged = [];
+  for (const line of raw.split("\n")) {
+    if (line.length < 4) continue;
+    const x = line[0];
+    const y = line[1];
+    const rest = line.slice(3);
+    const arrow = rest.indexOf(" -> ");
+    const path17 = arrow === -1 ? rest : rest.slice(arrow + 4);
+    if (x === "?" || y === "?") {
+      unstaged.push({ path: path17, code: "A" });
+      continue;
+    }
+    if (x !== " ") staged.push({ path: path17, code: x });
+    if (y !== " ") unstaged.push({ path: path17, code: y });
+  }
+  return { staged, unstaged };
+}
+function parseLog(raw, localShas) {
+  const commits = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    const [sha, shortSha, author, date, relative, ...subject] = line.split(LOG_FIELD_SEP);
+    if (!sha || !shortSha) continue;
+    commits.push({
+      sha,
+      shortSha,
+      author: author ?? "",
+      date: date ?? "",
+      relative: relative ?? "",
+      // A subject holding the separator would split into extra fields; joining
+      // the tail back puts it together again.
+      subject: subject.join(LOG_FIELD_SEP) || "(no commit message)",
+      local: localShas.has(sha)
+    });
+  }
+  return commits;
+}
+async function readGitPanel(target, workdir, logLimit = 40) {
+  const git = (...args) => gitInDir(target, workdir, ...args).catch(() => "");
+  await git("add", "--intent-to-add", ".");
+  const { staged, unstaged } = parseStatus(
+    await git(
+      "--no-optional-locks",
+      "-c",
+      "core.quotePath=false",
+      "status",
+      "--porcelain=v1",
+      "--untracked-files=all"
+    )
+  );
+  const stagedDiff = await git("diff", "--cached", "--no-color");
+  const unstagedDiff = await git("diff", "--no-color");
+  const diff = await git("diff", "HEAD", "--no-color");
+  const localShas = new Set(
+    (await git(
+      "rev-list",
+      "-n",
+      String(logLimit),
+      "HEAD",
+      "--not",
+      "--remotes"
+    )).split("\n").map((sha) => sha.trim()).filter(Boolean)
+  );
+  const commits = parseLog(
+    await git("log", "-n", String(logLimit), `--format=${LOG_FORMAT}`),
+    localShas
+  );
+  const branch = (await git("rev-parse", "--abbrev-ref", "HEAD")).trim();
+  return {
+    branch,
+    staged: { files: staged, diff: stagedDiff },
+    unstaged: { files: unstaged, diff: unstagedDiff },
+    commits,
+    diff,
+    // The union of both sides, which is what `git diff HEAD --name-only`
+    // reports - one call cheaper.
+    changedFiles: [
+      ...new Set([...staged, ...unstaged].map((file) => file.path))
+    ]
+  };
+}
+function toRepoRelative(paths) {
+  const clean = [];
+  for (const raw of paths) {
+    const rel = raw.trim().replace(/^\/+/, "");
+    if (!rel || rel === ".") continue;
+    if (rel.split("/").includes("..")) continue;
+    clean.push(rel);
+  }
+  return clean;
+}
+function stageTargets(paths) {
+  if (paths.length === 0) return ["."];
+  const rel = toRepoRelative(paths);
+  if (rel.length === 0) throw new Error("No path in that request was usable.");
+  return rel;
+}
+async function stagePaths(target, workdir, paths) {
+  await gitInDir(target, workdir, "add", "--", ...stageTargets(paths));
+}
+async function unstagePaths(target, workdir, paths) {
+  const targets = stageTargets(paths);
+  try {
+    await gitInDir(target, workdir, "restore", "--staged", "--", ...targets);
+  } catch {
+    await gitInDir(
+      target,
+      workdir,
+      "rm",
+      "--cached",
+      "-r",
+      "--quiet",
+      "--",
+      ...targets
+    );
+  }
+}
+async function readCommitDiff(target, workdir, sha) {
+  if (!/^[0-9a-f]{4,40}$/i.test(sha)) {
+    throw new Error(`Not a commit id: ${sha}`);
+  }
+  const show = (...args) => gitInDir(
+    target,
+    workdir,
+    "show",
+    "--first-parent",
+    "-m",
+    ...args,
+    sha
+  ).catch(() => "");
+  const diff = await show("--no-color", "--format=", "--patch");
+  const names = (await show("--format=", "--name-only")).trim();
+  return {
+    diff,
+    changedFiles: names ? names.split("\n").filter(Boolean) : []
+  };
+}
 async function listRemoteBranches(target, workdir = target.paths.workspace) {
   try {
     const stdout = await gitInDir(
@@ -13218,7 +13396,8 @@ async function putSessionCard(s, target, prompt2 = "") {
 }
 async function teardownSession(s, target) {
   if (isWorktreeSession(s, target)) {
-    await removeWorktree(target, s.workspacePath).catch(() => {
+    const drop = s.mode === "bare" ? removeWorktreeAndBranch : removeWorktree;
+    await drop(target, s.workspacePath).catch(() => {
     });
   }
   await deleteCard(target, s.postId).catch(() => {
@@ -13665,116 +13844,1789 @@ function createEventSink(send, spaceSlug, notify) {
 
 // ../../shared/all/helpers/card-ai/frpc.ts
 var import_fs2 = require("fs");
-var import_promises2 = __toESM(require("fs/promises"));
-var import_path4 = __toESM(require("path"));
+var import_promises4 = __toESM(require("fs/promises"));
+var import_path6 = __toESM(require("path"));
 
-// ../../shared/all/helpers/card-ai/scripts.ts
-function frpcExposeScript(p) {
-  return `#!/bin/sh
-set -e
-set -a; . '${p.envFile}' 2>/dev/null || true; set +a
-mkdir -p '${p.runDir}'
-PORT="$1"
-NAME="$2"
-if [ -z "$PORT" ] || [ -z "$NAME" ]; then
-  echo "usage: factiii-expose <port> <name>" >&2
-  echo "  e.g. factiii-expose 3000 app" >&2
-  exit 1
-fi
-case "$NAME" in *[!a-zA-Z0-9-]*|"") echo "name must be [a-zA-Z0-9-]" >&2; exit 1 ;; esac
-PROXY="\${FACTIII_TASK_ID}-\${NAME}"
-DOMAIN="\${PROXY}.\${FACTIII_FRP_DOMAIN}"
-TOML="${p.runDir}/\${NAME}.toml"
-cat > "$TOML" <<EOF
-serverAddr = "\${FACTIII_FRP_SERVER}"
-serverPort = \${FACTIII_FRP_PORT}
-transport.protocol = "tcp"
+// ../../shared/all/helpers/board-agent-core/host-skills.ts
+var import_promises3 = __toESM(require("fs/promises"));
+var import_os2 = __toESM(require("os"));
+var import_path5 = __toESM(require("path"));
 
-[metadatas]
-factiii_token = "\${FACTIII_FRP_TOKEN}"
+// ../../shared/all/domains/posts.ts
+var postDataSort = /* @__PURE__ */ ((postDataSort2) => {
+  postDataSort2["DAILY"] = "DAILY";
+  postDataSort2["WEEKLY"] = "WEEKLY";
+  postDataSort2["MONTHLY"] = "MONTHLY";
+  return postDataSort2;
+})(postDataSort || {});
 
-[[proxies]]
-name = "\${PROXY}"
-type = "http"
-localPort = \${PORT}
-subdomain = "\${PROXY}"
-EOF
-# nohup, not setsid: setsid does not exist on macOS.
-nohup frpc -c "$TOML" > "${p.runDir}/\${NAME}.log" 2>&1 < /dev/null &
-echo $! > "${p.runDir}/\${NAME}.pid"
-echo "http://\${DOMAIN}"
-`;
-}
-function frpcUnexposeScript(p) {
-  return `#!/bin/sh
-NAME="$1"
-if [ -z "$NAME" ]; then
-  echo "usage: factiii-unexpose <name>" >&2
-  exit 1
-fi
-PID_FILE="${p.runDir}/\${NAME}.pid"
-if [ -f "$PID_FILE" ]; then
-  kill "$(cat "$PID_FILE")" 2>/dev/null || true
-  rm -f "$PID_FILE" "${p.runDir}/\${NAME}.toml" "${p.runDir}/\${NAME}.log"
-  echo "stopped \${NAME}"
-else
-  echo "no tunnel named \${NAME}" >&2
-  exit 1
-fi
-`;
-}
+// ../../shared/all/domains/user.ts
+var USER_TAG_VALUES = [
+  "HUMAN",
+  "BOT",
+  "GOVERNMENT",
+  "ACADEMIA",
+  "BUSINESS",
+  "NEW",
+  "WAITLIST",
+  "VERIFIED"
+];
+var detailsCookieSchema = external_exports.object({
+  userId: external_exports.number(),
+  updatedAt: external_exports.string(),
+  username: external_exports.string(),
+  name: external_exports.string().nullable(),
+  email: external_exports.string().nullable(),
+  tag: external_exports.enum(USER_TAG_VALUES),
+  avatarKey: external_exports.string().nullable(),
+  robohash: external_exports.string().nullable(),
+  hasPassword: external_exports.boolean(),
+  // Defaulted so a client cookie minted before these fields existed still parses
+  // (the server re-issues it with real values on the next refresh) instead of
+  // failing the whole payload and flashing the user as logged out.
+  hasPasskey: external_exports.boolean().default(false),
+  twoFaEnabled: external_exports.boolean(),
+  oauthProviders: external_exports.array(external_exports.enum(["GOOGLE", "APPLE"])).default([]),
+  // Defaulted, not just nullable: a required-but-missing key is what breaks old
+  // clients, so this stays parseable once the server stops sending it.
+  oauthProvider: external_exports.enum(["GOOGLE", "APPLE"]).nullable().default(null),
+  emailVerificationStatus: external_exports.enum(["UNVERIFIED", "PENDING", "VERIFIED"]),
+  isPrivate: external_exports.boolean(),
+  isIncognito: external_exports.boolean(),
+  onboardingPath: external_exports.string().nullable(),
+  bio: external_exports.string().nullable(),
+  bannerKey: external_exports.string().nullable(),
+  tronsBalance: external_exports.number(),
+  verificationRequestedAt: external_exports.string().nullable(),
+  deletionScheduledAt: external_exports.string().nullable()
+});
+var UserType = /* @__PURE__ */ ((UserType2) => {
+  UserType2["PRIVATE"] = "PRIVATE";
+  UserType2["INCOGNITO"] = "INCOGNITO";
+  UserType2["PREMIUM"] = "PREMIUM";
+  UserType2["PAID"] = "PAID";
+  UserType2["INVITE"] = "INVITE";
+  return UserType2;
+})(UserType || {});
 
-// ../../shared/all/helpers/card-ai/frpc.ts
-var FRP_SERVER_ADDR = "dev.factiii.com";
-var FRP_SERVER_PORT = 7443;
-var FRP_DOMAIN_SUFFIX = "dev.factiii.com";
-function frpcPaths(target) {
-  const { root, bin } = target.paths;
+// ../../shared/all/uploadTypes.ts
+var _EXT_TO_CONTENT_TYPE = {
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  png: "image/png",
+  gif: "image/gif",
+  webp: "image/webp",
+  svg: "image/svg+xml",
+  heic: "image/heic",
+  heif: "image/heif",
+  mp4: "video/mp4",
+  mov: "video/quicktime",
+  mpeg: "video/mpeg",
+  pdf: "application/pdf",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation"
+};
+var EXT_TO_CONTENT_TYPE = _EXT_TO_CONTENT_TYPE;
+var ALLOWED_CONTENT_TYPES = [
+  ...new Set(Object.values(EXT_TO_CONTENT_TYPE))
+];
+var ALLOWED_CONTENT_TYPES_TUPLE = ALLOWED_CONTENT_TYPES;
+var CONTENT_TYPE_TO_EXT = Object.fromEntries(
+  Object.entries(EXT_TO_CONTENT_TYPE).map(([ext, mime]) => [mime, ext])
+);
+var DROPZONE_ACCEPT = Object.entries(
+  EXT_TO_CONTENT_TYPE
+).reduce((acc, [ext, mime]) => {
+  (acc[mime] ??= []).push(`.${ext}`);
+  return acc;
+}, {});
+var FILE_INPUT_ACCEPT = ALLOWED_CONTENT_TYPES.join(",");
+
+// ../../shared/all/validators.ts
+var usernameValidationRegex = /^[a-zA-Z0-9_]+$/;
+var signupSchema = external_exports.object({
+  username: external_exports.string().min(1).regex(usernameValidationRegex, {
+    message: "Username can only contain letters, numbers, and underscores"
+  }),
+  email: external_exports.string().email(),
+  password: external_exports.string().min(8, { message: "Password must contain at least 8 characters" }),
+  types: external_exports.array(external_exports.nativeEnum(UserType)),
+  referrerUserId: external_exports.number().optional(),
+  instanceId: external_exports.number()
+});
+var usernameSchema = external_exports.string().min(1).regex(usernameValidationRegex, {
+  message: "Username can only contain letters, numbers, and underscores"
+});
+var baseRegisterSchema = external_exports.object({
+  username: usernameSchema,
+  types: external_exports.array(external_exports.nativeEnum(UserType)).default([]),
+  referrerUserId: external_exports.number().optional(),
+  instanceId: external_exports.number(),
+  platform: external_exports.enum(["web", "mobile"]).optional()
+});
+var passwordRegisterSchema = baseRegisterSchema.extend({
+  password: external_exports.string().min(8, { message: "Password must contain at least 8 characters" }),
+  recaptchaToken: external_exports.string().optional()
+});
+var createSourceSchema = external_exports.object({
+  name: external_exports.string().min(1),
+  description: external_exports.string().optional(),
+  requirements: external_exports.array(
+    external_exports.enum([
+      "GOVERNMENT_SOURCE" /* GOVERNMENT_SOURCE */,
+      "ENTERPRISE_SOURCE" /* ENTERPRISE_SOURCE */,
+      "ANONYMOUS_SOURCE" /* ANONYMOUS_SOURCE */,
+      "HUMAN_SOURCE" /* HUMAN_SOURCE */
+    ])
+  )
+});
+var contactFormSchema = external_exports.object({
+  name: external_exports.string().min(1).max(100),
+  email: external_exports.string().max(254).optional(),
+  phone: external_exports.string().max(20).optional(),
+  message: external_exports.string().min(1).max(2e3),
+  age: external_exports.string().optional()
+}).refine((data) => !!data.email || !!data.phone, {
+  message: "Either email or phone is required"
+});
+var donationSchema = external_exports.object({
+  amount: external_exports.number().int().min(100).max(1e6),
+  // Amount in cents (integer)
+  email: external_exports.string().email()
+});
+var getUploadUrlsSchema = external_exports.object({
+  contentType: external_exports.enum(ALLOWED_CONTENT_TYPES_TUPLE),
+  name: external_exports.string().optional(),
+  width: external_exports.number().int().positive().max(25e3).optional(),
+  height: external_exports.number().int().positive().max(25e3).optional(),
+  isPrivate: external_exports.boolean().optional().default(false),
+  // Chat attachments pass the conversation instead of an isPrivate flag: the
+  // server resolves privacy from the channel's space so the client can't
+  // decide to make a PRIVATE space's files public. See uploads.getUploadUrls.
+  conversationId: external_exports.string().uuid().optional(),
+  isFactiii: external_exports.boolean().default(false),
+  factiiiId: external_exports.number().int().positive().optional(),
+  rawSha256: external_exports.string().regex(/^[a-f0-9]{64}$/i, "rawSha256 must be 64 hex chars")
+}).refine(
+  (d) => d.width === void 0 && d.height === void 0 || d.width !== void 0 && d.height !== void 0,
+  { message: "width and height must be provided together" }
+).refine((d) => !d.isFactiii || d.factiiiId !== void 0, {
+  message: "factiiiId is required when isFactiii is true"
+});
+var finalizeUploadSchema = external_exports.object({
+  uploadId: external_exports.string(),
+  isFactiii: external_exports.boolean(),
+  raw: external_exports.object({
+    // Bare-uuid keys; variant kind is the DB-level discriminator, no S3 prefix.
+    key: external_exports.string().min(1),
+    size: external_exports.number().int().positive(),
+    sha256: external_exports.string().regex(/^[a-f0-9]{64}$/i),
+    width: external_exports.number().int().positive().optional(),
+    height: external_exports.number().int().positive().optional()
+  }),
+  view: external_exports.object({
+    key: external_exports.string().min(1),
+    size: external_exports.number().int().positive(),
+    sha256: external_exports.string().regex(/^[a-f0-9]{64}$/i),
+    width: external_exports.number().int().positive(),
+    height: external_exports.number().int().positive()
+  }).nullable()
+  // null for non-image uploads
+});
+var variantKindSchema = external_exports.enum([
+  "RAW",
+  "VIEW",
+  "PREMIUM_HD",
+  "PREMIUM_RAW",
+  "THUMBNAIL"
+]);
+var adminUploadsGetVariantUrlSchema = external_exports.object({
+  uploadId: external_exports.string(),
+  kind: variantKindSchema,
+  expiresIn: external_exports.number().int().positive().max(3600).default(300)
+});
+var getUploadSchema = external_exports.object({
+  id: external_exports.string()
+});
+var priceSchema = external_exports.number().int().min(0, "Price must be a positive integer in cents");
+var checkPurchaseSchema = external_exports.object({
+  productId: external_exports.string(),
+  type: external_exports.enum(["STRIPE", "GOOGLE", "APPLE"]),
+  receivedPrice: external_exports.number().int().min(0, "Received price must be a positive integer in cents"),
+  currency: external_exports.string().length(3).default("USD")
+});
+var creditPurchaseSchema = external_exports.object({
+  orderId: external_exports.string(),
+  transactionDate: external_exports.number(),
+  receivedPrice: external_exports.number().int().min(0, "Received price must be a positive integer in cents"),
+  type: external_exports.enum(["STRIPE", "GOOGLE", "APPLE"]),
+  secret: external_exports.string(),
+  // Required for APPLE/GOOGLE IAP — used for server-side receipt verification
+  purchaseToken: external_exports.string().optional()
+});
+var dsarFormSchema = external_exports.object({
+  name: external_exports.string().trim().min(1, "Please enter your name.").max(100, "Please keep your name under 100 characters."),
+  email: external_exports.string().trim().min(1, "Please enter your email address.").email("Please enter a valid email address."),
+  selectedAs: external_exports.enum(["person", "agent"]),
+  requestUnder: external_exports.enum(["GDPR", "CCPA", "OTHER"]),
+  selectedTo: external_exports.enum(["knowledge", "delete", "optOut", "optIn", "other"]),
+  details: external_exports.string().trim().min(1, "Please provide details about your request.").max(5e3, "Please keep details under 5000 characters."),
+  confirmAccuracy: external_exports.boolean().refine((value2) => value2, "Please confirm your information is accurate."),
+  confirmConsequences: external_exports.boolean().refine(
+    (value2) => value2,
+    "Please acknowledge the deletion/restriction consequences."
+  ),
+  confirmVerification: external_exports.boolean().refine((value2) => value2, "Please acknowledge the email verification step.")
+});
+var mapLinkSchema = external_exports.object({
+  startPosition: external_exports.object({
+    postId: external_exports.string().optional(),
+    latitude: external_exports.number().min(-90).max(90, { message: "Latitude must be between -90 and 90" }),
+    longitude: external_exports.number().min(-180).max(180, { message: "Longitude must be between -180 and 180" })
+  }),
+  pins: external_exports.array(
+    external_exports.object({
+      postId: external_exports.string().uuid({ message: "Pin ID must be a valid UUID" }),
+      latitude: external_exports.number().min(-90).max(90, { message: "Pin latitude must be between -90 and 90" }),
+      longitude: external_exports.number().min(-180).max(180, { message: "Pin longitude must be between -180 and 180" })
+    })
+  ).optional().default([])
+});
+var mapLinkPostIds = mapLinkSchema.transform((data) => {
   return {
-    binDir: bin,
-    binary: `${bin}/frpc`,
-    expose: `${bin}/factiii-expose`,
-    unexpose: `${bin}/factiii-unexpose`,
-    envFile: `${root}/.factiii-frp-env`,
-    runDir: `${root}/.frpc`
+    startPosition: {
+      postId: data.startPosition.postId,
+      latitude: data.startPosition.latitude,
+      longitude: data.startPosition.longitude
+    },
+    pins: data.pins.map((pin) => ({
+      postId: pin.postId,
+      latitude: pin.latitude,
+      longitude: pin.longitude
+    }))
+  };
+});
+var mapLinkHref = mapLinkSchema.transform((data) => {
+  const latParam = `latitude=${encodeURIComponent(data.startPosition.latitude)}`;
+  const lonParam = `longitude=${encodeURIComponent(
+    data.startPosition.longitude
+  )}`;
+  const pinsParam = data.pins.length > 0 ? `pins=${encodeURIComponent(JSON.stringify(data.pins))}` : "";
+  return {
+    startPosition: {
+      postId: data.startPosition.postId,
+      latitude: data.startPosition.latitude,
+      longitude: data.startPosition.longitude
+    },
+    href: `${data.startPosition.postId ? `postId=${data.startPosition.postId}&` : ""}${latParam}&${lonParam}${pinsParam ? `&${pinsParam}` : ""}`
   };
+});
+var wikipediaUrlSchema = external_exports.string().refine(
+  (url2) => {
+    try {
+      const parsedUrl = new URL(url2);
+      return parsedUrl.hostname.endsWith(".wikipedia.org") && parsedUrl.protocol === "https:" && parsedUrl.pathname.startsWith("/wiki/") && parsedUrl.pathname.length > 6;
+    } catch {
+      return false;
+    }
+  },
+  {
+    message: "Invalid Wikipedia URL. Must be a valid HTTPS URL from wikipedia.org with /wiki/ path and article title"
+  }
+);
+var localPreferenceSchema = external_exports.object({
+  postFilterType: external_exports.enum(["trending", "new", "popular"]),
+  postSortBy: external_exports.nativeEnum(postDataSort),
+  filterBot: external_exports.boolean(),
+  filterNew: external_exports.boolean(),
+  showBoards: external_exports.boolean(),
+  displayMode: external_exports.enum(["data", "posts", "sortByFactiii", "mediaSearch"]),
+  postModeType: external_exports.enum(["home", "explore"]),
+  muteVideo: external_exports.boolean(),
+  theme: external_exports.enum(["dark", "light"]),
+  selectedFactiiis: external_exports.array(external_exports.number()),
+  dataFilter: external_exports.string(),
+  mediaSearch: external_exports.string()
+});
+var localPreferenceUrlParamsSchema = external_exports.object({
+  postFilterType: external_exports.enum(["trending", "new", "popular"]).optional(),
+  postSortBy: external_exports.nativeEnum(postDataSort).optional(),
+  filterBot: external_exports.preprocess((val) => val === "true", external_exports.boolean()).optional(),
+  showBoards: external_exports.preprocess((val) => val === "true", external_exports.boolean()).optional(),
+  displayMode: external_exports.enum(["data", "posts", "sortByFactiii", "mediaSearch"]).optional(),
+  postModeType: external_exports.enum(["home", "explore"]).optional(),
+  selectedFactiiis: external_exports.preprocess((val) => {
+    if (!val || typeof val !== "string") return [];
+    return val.split(",").map(Number).filter((id) => !isNaN(id));
+  }, external_exports.array(external_exports.number())).optional()
+});
+var productSchema = external_exports.object({
+  id: external_exports.number(),
+  title: external_exports.string(),
+  description: external_exports.string().nullable(),
+  price: external_exports.number(),
+  createdAt: external_exports.date(),
+  active: external_exports.boolean(),
+  originalInventory: external_exports.number().optional().nullable().transform((val) => val === void 0 ? null : val),
+  inventory: external_exports.number(),
+  discount: external_exports.number(),
+  type: external_exports.enum(["TRON", "MONTHLY_SUBSCRIPTION", "FOUNDERS_TOKEN", "DONATION"]),
+  appStoreProductId: external_exports.string().nullable(),
+  playStoreProductId: external_exports.string().nullable(),
+  stripePriceId: external_exports.string().nullable(),
+  spaceSlug: external_exports.string(),
+  images: external_exports.array(external_exports.string()),
+  // Trons granted to the buyer on purchase + premium days granted. Only meaningful
+  // for TRON and FOUNDERS_TOKEN; other product types ignore these. Optional so the
+  // admin form can omit them when editing subscription/donation rows.
+  tronQuantity: external_exports.number().int().min(0).optional(),
+  tronPremiumDays: external_exports.number().int().min(0).optional()
+});
+var adminTransferSpaceOwnershipSchema = external_exports.object({
+  spaceId: external_exports.number(),
+  newOwnerUserId: external_exports.number()
+});
+var baseSchema = {
+  cursor: external_exports.union([external_exports.string(), external_exports.number()]).optional(),
+  type: external_exports.enum(["new", "trending", "popular", "board"]).optional(),
+  filterBots: external_exports.boolean().optional(),
+  // Omitted = show; hiding new accounts is opt-in via the quick filter.
+  filterNewAccounts: external_exports.boolean().optional(),
+  showBoards: external_exports.boolean().optional(),
+  factiiiIds: external_exports.number().array().optional(),
+  strictFactiiiIds: external_exports.number().array().optional(),
+  //used for getting posts by relatedfactiiicountgroup
+  dataFilter: external_exports.string().optional(),
+  start: external_exports.date().optional(),
+  end: external_exports.date().optional()
+};
+var postFeedInputSchema = external_exports.discriminatedUnion("source", [
+  external_exports.object({
+    source: external_exports.literal("home"),
+    ...baseSchema
+  }),
+  external_exports.object({
+    source: external_exports.literal("explore"),
+    ...baseSchema
+  }),
+  external_exports.object({
+    source: external_exports.literal("user"),
+    username: external_exports.string(),
+    ...baseSchema
+  }),
+  external_exports.object({
+    source: external_exports.literal("space"),
+    spaceSlug: external_exports.string(),
+    spaceRenderType: external_exports.enum(["USER_FACING", "SPACE_FACING", "BOTH"]).optional(),
+    ...baseSchema
+  }),
+  external_exports.object({
+    source: external_exports.literal("saved"),
+    ...baseSchema
+  }),
+  external_exports.object({
+    source: external_exports.literal("factiiis"),
+    ...baseSchema
+  }),
+  // Every anonymous post, author masked. Backs /user/Anonymous%20User, which is
+  // where anonymous posts' author links point.
+  external_exports.object({
+    source: external_exports.literal("anonymous"),
+    ...baseSchema
+  }),
+  external_exports.object({
+    source: external_exports.literal("search"),
+    query: external_exports.string().optional(),
+    spaceRenderType: external_exports.enum(["USER_FACING", "SPACE_FACING", "BOTH"]).optional(),
+    userIds: external_exports.number().array().optional(),
+    spaceIds: external_exports.number().array().optional(),
+    ...baseSchema
+  })
+]);
+var donateTronsSchema = external_exports.object({
+  amount: external_exports.number().int().positive()
+});
+var communityPoolModeSchema = external_exports.enum(["OFF", "WHITELIST", "OPEN"]);
+var communityPoolConfigSchema = external_exports.object({
+  mode: communityPoolModeSchema,
+  userCapPer4h: external_exports.number().int().min(0),
+  poolCapPer4h: external_exports.number().int().min(0)
+});
+var crossPostPlatformEnum = external_exports.enum([
+  "TIKTOK",
+  "YOUTUBE",
+  "INSTAGRAM",
+  "FACEBOOK",
+  "TWITTER",
+  "LINKEDIN",
+  "REDDIT"
+]);
+var crossPostSchema = external_exports.object({
+  postId: external_exports.number().int().positive(),
+  platforms: external_exports.array(crossPostPlatformEnum).min(1)
+});
+var tiktokPostOptionsSchema = external_exports.object({
+  postId: external_exports.number().int().positive(),
+  privacyLevel: external_exports.enum([
+    "PUBLIC_TO_EVERYONE",
+    "MUTUAL_FOLLOW_FRIENDS",
+    "FOLLOWER_OF_CREATOR",
+    "SELF_ONLY"
+  ]),
+  disableComment: external_exports.boolean().default(false),
+  disableDuet: external_exports.boolean().default(false),
+  disableStitch: external_exports.boolean().default(false),
+  videoCoverTimestampMs: external_exports.number().int().min(0).optional(),
+  isAiGenerated: external_exports.boolean().default(false)
+});
+var crossPostSubmitSchema = external_exports.object({
+  postId: external_exports.string(),
+  platforms: external_exports.array(crossPostPlatformEnum).min(1).max(5)
+});
+var apiCostUpdateSchema = external_exports.object({
+  platform: crossPostPlatformEnum,
+  readCostTrons: external_exports.number().int().min(0),
+  pushCostTrons: external_exports.number().int().min(0),
+  costSource: external_exports.enum(["manual", "api"]),
+  notes: external_exports.string().max(500).optional()
+});
+var startSessionSchema = external_exports.object({
+  isDaily: external_exports.boolean().default(false)
+});
+var submitAnswerSchema = external_exports.object({
+  sessionId: external_exports.number().int(),
+  postId: external_exports.number().int(),
+  answeredFact: external_exports.boolean(),
+  timeMs: external_exports.number().int().min(0).max(15e3)
+});
+var endSessionSchema = external_exports.object({
+  sessionId: external_exports.number().int()
+});
+var getLeaderboardSchema = external_exports.object({
+  period: external_exports.enum(["daily", "weekly", "allTime"]),
+  limit: external_exports.number().int().min(1).max(50).default(50)
+});
+var getSessionResultSchema = external_exports.object({
+  sessionId: external_exports.number().int()
+});
+var forgeElementName = external_exports.string().trim().min(1).max(24);
+var forgeCombineSchema = external_exports.object({
+  a: forgeElementName,
+  b: forgeElementName
+});
+var forgeLeaderboardSchema = external_exports.object({
+  limit: external_exports.number().int().min(1).max(50).default(25)
+});
+var arcadeGameSlug = external_exports.enum([
+  "circle",
+  "password",
+  "forge",
+  "spend",
+  "dilemmas",
+  "clicker",
+  "deep",
+  "robot",
+  "space"
+]);
+var recordGameStatSchema = external_exports.object({
+  game: arcadeGameSlug,
+  /** Canonical sortable score for that game; direction is decided client-side. */
+  best: external_exports.number().finite(),
+  /** Per-game extras, kept small — this lands in a JSON column. */
+  detail: external_exports.record(external_exports.string(), external_exports.union([external_exports.string(), external_exports.number()])).optional()
+});
+var dilemmaVoteSchema = external_exports.object({
+  dilemmaId: external_exports.number().int().min(1).max(200),
+  pulled: external_exports.boolean()
+});
+var SKILL_NAME_REGEX = /^[a-zA-Z0-9._-]+$/;
+var skillNameSchema = external_exports.string().min(1).max(64).regex(SKILL_NAME_REGEX, {
+  message: "Use only letters, numbers, dots, dashes and underscores"
+});
+var skillFrontmatterSchema = external_exports.object({
+  name: skillNameSchema,
+  description: external_exports.string().min(1, { message: "Description is required" }),
+  // Both CLIs accept a comma-separated string or a YAML list; normalised to
+  // a list on parse and written back as a list.
+  "allowed-tools": external_exports.array(external_exports.string()).optional(),
+  model: external_exports.string().optional(),
+  license: external_exports.string().optional(),
+  metadata: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  "disable-model-invocation": external_exports.literal(false).optional()
+}).strict();
+var skillAgentSchema = external_exports.enum(["claude", "codex"]);
+var skillScopeSchema = external_exports.enum(["global", "repo"]);
+
+// ../../shared/all/helpers/board-agent-core/host-deploy.ts
+var import_child_process3 = require("child_process");
+var import_promises2 = __toESM(require("fs/promises"));
+var import_path4 = __toESM(require("path"));
+var import_util5 = require("util");
+var execFileAsync2 = (0, import_util5.promisify)(import_child_process3.execFile);
+var SKILL_DIR = ".agents/skills/deploy";
+var SKILL_PATH = `${SKILL_DIR}/SKILL.md`;
+var VARIABLES_PATH = `${SKILL_DIR}/required-variables.json`;
+var CHECKER_PATH = `${SKILL_DIR}/check-environment.sh`;
+var CLAUDE_SKILLS_DIR = ".claude/skills";
+var CLAUDE_LINK = `${CLAUDE_SKILLS_DIR}/deploy`;
+async function ensureClaudeSkillLink(workspace) {
+  const linkPath = import_path4.default.join(workspace, CLAUDE_LINK);
+  try {
+    await import_promises2.default.lstat(linkPath);
+    return;
+  } catch {
+  }
+  await import_promises2.default.mkdir(import_path4.default.join(workspace, CLAUDE_SKILLS_DIR), { recursive: true });
+  await import_promises2.default.symlink("../../.agents/skills/deploy", linkPath, "dir");
 }
-function vendoredBinaryName() {
-  const cpu = process.arch === "x64" ? "amd64" : process.arch;
-  return `frpc-${process.platform}-${cpu}`;
+var GIT_NO_HELPER = ["-c", "credential.helper="];
+var GIT_ENV = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+async function hostGit(cwd, ...args) {
+  const { stdout } = await execFileAsync2("git", [...GIT_NO_HELPER, ...args], {
+    cwd,
+    env: GIT_ENV,
+    maxBuffer: 16 * 1024 * 1024
+  });
+  return stdout;
 }
-async function installFrpcBinary(target) {
-  const p = frpcPaths(target);
-  const binaryName = vendoredBinaryName();
-  const src = import_path4.default.join(__dirname, "..", "vendor", binaryName);
-  if (!(0, import_fs2.existsSync)(src)) {
-    throw new Error(
-      `Vendored frpc missing (${src}). Run apps/runner/scripts/fetch-frpc.sh.`
+async function gitCatFileBatch(cwd, shas) {
+  const out = /* @__PURE__ */ new Map();
+  const wanted = [...new Set(shas.filter(Boolean))];
+  if (!wanted.length) return out;
+  const child = (0, import_child_process3.spawn)("git", [...GIT_NO_HELPER, "cat-file", "--batch"], {
+    cwd,
+    env: GIT_ENV
+  });
+  const chunks = [];
+  child.stdout.on("data", (c) => chunks.push(c));
+  const done = new Promise((resolve2) => {
+    child.on("close", () => resolve2());
+    child.on("error", () => resolve2());
+  });
+  child.stdin.end(`${wanted.join("\n")}
+`);
+  await done;
+  let buf = Buffer.concat(chunks);
+  while (buf.length) {
+    const nl = buf.indexOf(10);
+    if (nl === -1) break;
+    const header = buf.subarray(0, nl).toString("utf-8");
+    buf = buf.subarray(nl + 1);
+    const [sha, type, sizeText] = header.split(" ");
+    if (type === void 0 || sizeText === void 0) continue;
+    const size = Number(sizeText);
+    if (!Number.isFinite(size)) break;
+    out.set(sha, buf.subarray(0, size).toString("utf-8"));
+    buf = buf.subarray(size + 1);
+  }
+  return out;
+}
+async function ensureWorkspaceClone(opts) {
+  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  const branch = (opts.mainBranch || "main").replace(/[^\w./-]/g, "");
+  const url2 = buildCloneUrl(opts.repoUrl, opts.githubToken);
+  let cloned = false;
+  try {
+    await hostGit(workspace, "rev-parse", "--git-dir");
+    await hostGit(workspace, "remote", "set-url", "origin", url2);
+  } catch {
+    const leftovers = await import_promises2.default.readdir(workspace).catch(() => []);
+    if (leftovers.includes(".git")) {
+      throw new Error(
+        `${workspace} holds a git repository that cannot be read. Remove it and retry.`
+      );
+    }
+    for (const name of leftovers) {
+      await import_promises2.default.rm(import_path4.default.join(workspace, name), { recursive: true, force: true });
+    }
+    await execFileAsync2(
+      "git",
+      [...GIT_NO_HELPER, "clone", "--branch", branch, url2, workspace],
+      { env: GIT_ENV }
     );
+    cloned = true;
   }
-  const staged = await import_promises2.default.stat(p.binary).catch(() => null);
-  const source = await import_promises2.default.stat(src);
-  if (staged?.size === source.size) return;
-  await import_promises2.default.mkdir(p.binDir, { recursive: true });
-  await import_promises2.default.copyFile(src, p.binary);
-  await import_promises2.default.chmod(p.binary, 493);
+  if (!cloned) await hostGit(workspace, "fetch", "origin", branch);
+  return { workspace, branch };
 }
-async function installFrpcHarness(params) {
-  const { target, taskId, runnerToken } = params;
-  const p = frpcPaths(target);
-  await installFrpcBinary(target);
-  const envLines = [
-    `FACTIII_FRP_SERVER=${FRP_SERVER_ADDR}`,
-    `FACTIII_FRP_PORT=${FRP_SERVER_PORT}`,
-    `FACTIII_FRP_TOKEN=${runnerToken}`,
-    `FACTIII_FRP_DOMAIN=${FRP_DOMAIN_SUFFIX}`,
-    `FACTIII_TASK_ID=${taskId}`
+async function checkDeployStatus(opts) {
+  const { workspace, branch } = await ensureWorkspaceClone(opts);
+  const has = async (refPath) => {
+    try {
+      await hostGit(workspace, "cat-file", "-e", refPath);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const hasAll = async (ref) => await has(`${ref}:${SKILL_PATH}`) && await has(`${ref}:${VARIABLES_PATH}`) && await has(`${ref}:${CHECKER_PATH}`);
+  let pendingBranch = "";
+  if (!await hasAll(`origin/${branch}`)) {
+    try {
+      await hostGit(
+        workspace,
+        "fetch",
+        "origin",
+        "+refs/heads/deploy-skill*:refs/remotes/origin/deploy-skill*"
+      );
+      const refs = await hostGit(
+        workspace,
+        "for-each-ref",
+        "--sort=-committerdate",
+        "--format=%(refname:short)",
+        "refs/remotes/origin/deploy-skill*"
+      );
+      for (const ref of refs.split("\n").filter(Boolean)) {
+        if (await hasAll(ref)) {
+          pendingBranch = ref.replace(/^origin\//, "");
+          break;
+        }
+      }
+    } catch {
+    }
+  }
+  const hasVariables = await has(`origin/${branch}:${VARIABLES_PATH}`);
+  let variables = [];
+  if (hasVariables) {
+    try {
+      const raw = await hostGit(
+        workspace,
+        "cat-file",
+        "-p",
+        `origin/${branch}:${VARIABLES_PATH}`
+      );
+      variables = external_exports.array(requiredVariableSchema).parse(JSON.parse(raw));
+    } catch {
+    }
+  }
+  return {
+    hasSkill: await has(`origin/${branch}:${SKILL_PATH}`),
+    hasVariables,
+    hasChecker: await has(`origin/${branch}:${CHECKER_PATH}`),
+    branch,
+    pendingBranch,
+    variables
+  };
+}
+var requiredVariableSchema = external_exports.object({
+  key: external_exports.string().min(1),
+  title: external_exports.string().catch(""),
+  description: external_exports.string().catch(""),
+  category: external_exports.string().catch("general"),
+  sensitive: external_exports.boolean().catch(true)
+});
+function spaceEnv(spaceDir) {
+  const paths = hostSpacePaths(spaceDir);
+  return {
+    WORKSPACE: paths.workspace,
+    BACKUPS_DIR: paths.backups,
+    BUILDS_DIR: paths.builds,
+    // No keychain credential helper and no interactive git prompts anywhere
+    // in the deploy surface (agent sessions + authorized commands): auth
+    // comes from the secrets store or the tokened URL, never the keychain.
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_CONFIG_COUNT: "1",
+    GIT_CONFIG_KEY_0: "credential.helper",
+    GIT_CONFIG_VALUE_0: ""
+  };
+}
+async function readContract(workspace) {
+  const skill = await import_promises2.default.readFile(import_path4.default.join(workspace, SKILL_PATH), "utf-8").catch(() => {
+    throw new Error("The creator wrote no SKILL.md.");
+  });
+  const checker = await import_promises2.default.readFile(import_path4.default.join(workspace, CHECKER_PATH), "utf-8").catch(() => {
+    throw new Error("The creator wrote no check-environment.sh.");
+  });
+  try {
+    const raw = JSON.parse(
+      await import_promises2.default.readFile(import_path4.default.join(workspace, VARIABLES_PATH), "utf-8")
+    );
+    return {
+      skill,
+      checker,
+      variables: external_exports.array(requiredVariableSchema).parse(raw)
+    };
+  } catch {
+    throw new Error("The creator wrote no valid required-variables.json.");
+  }
+}
+async function generateDeploySkill(opts) {
+  const { instructions, sendLog } = opts;
+  if (!instructions.trim()) {
+    throw new Error("Describe your deployment process first.");
+  }
+  const status = await checkDeployStatus(opts);
+  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  sendLog({
+    type: "system",
+    content: `Resetting workspace to origin/${status.branch}...`
+  });
+  await hostGit(
+    workspace,
+    "checkout",
+    "-B",
+    status.branch,
+    `origin/${status.branch}`
+  );
+  await hostGit(workspace, "clean", "-fd");
+  sendLog({
+    type: "system",
+    content: "Analyzing the repo and writing the deploy skill..."
+  });
+  const { result } = await spawnAgent(
+    opts.provider,
+    hostTarget(opts.spaceDir),
+    {
+      cwd: workspace,
+      prompt: buildPrompt(prompts_default.deployCreate, {
+        INSTRUCTIONS: instructions
+      }),
+      allowedTools: "Read,Grep,Glob,Bash,Edit,Write,WebSearch,WebFetch",
+      // auto: the per-action classifier blocks escalations/unrecognized-infra
+      // actions - a host session with no human reviewing each command should
+      // not run bypassPermissions. (Codex maps this to a workspace-write
+      // sandbox; see agent.ts.)
+      permissionMode: "auto",
+      model: "claude-opus-4-6",
+      includePartialMessages: true,
+      env: spaceEnv(opts.spaceDir),
+      callbacks: { onLog: (entry) => sendLog(entry) }
+    }
+  );
+  const { sessionId } = await result;
+  const draft = await readContract(workspace);
+  return { ...draft, sessionId };
+}
+async function reviseDeploySkill(opts) {
+  const { feedback, sendLog } = opts;
+  if (!feedback.trim()) throw new Error("Corrections are empty.");
+  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  sendLog({ type: "system", content: "Applying your corrections..." });
+  const { result } = await spawnAgent(
+    opts.provider,
+    hostTarget(opts.spaceDir),
+    {
+      cwd: workspace,
+      prompt: buildPrompt(prompts_default.deployCreateRevise, {
+        FEEDBACK: feedback
+      }),
+      allowedTools: "Read,Grep,Glob,Bash,Edit,Write,WebSearch,WebFetch",
+      permissionMode: "auto",
+      model: "claude-opus-4-6",
+      includePartialMessages: true,
+      resumeSessionId: opts.resumeSessionId || void 0,
+      env: spaceEnv(opts.spaceDir),
+      callbacks: { onLog: (entry) => sendLog(entry) }
+    }
+  );
+  const { sessionId } = await result;
+  const draft = await readContract(workspace);
+  return { ...draft, sessionId: sessionId || opts.resumeSessionId || "" };
+}
+async function loadSkillDraft(opts) {
+  const branch = opts.branch.replace(/[^\w./-]/g, "");
+  if (!branch.startsWith("deploy-skill")) {
+    throw new Error("Not a deploy-skill branch.");
+  }
+  await checkDeployStatus(opts);
+  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  await hostGit(
+    workspace,
+    "fetch",
+    "origin",
+    `+refs/heads/${branch}:refs/remotes/origin/${branch}`
+  );
+  await hostGit(workspace, "checkout", "-B", branch, `origin/${branch}`);
+  await hostGit(workspace, "clean", "-fd");
+  return readContract(workspace);
+}
+async function approveDeploySkill(opts) {
+  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  await readContract(workspace);
+  await ensureClaudeSkillLink(workspace);
+  if (opts.gitName)
+    await hostGit(workspace, "config", "user.name", opts.gitName);
+  if (opts.gitEmail)
+    await hostGit(workspace, "config", "user.email", opts.gitEmail);
+  if (opts.onBranch) {
+    const dirty = await hostGit(workspace, "status", "--porcelain");
+    if (dirty.trim()) {
+      await hostGit(workspace, "add", "-A");
+      await hostGit(workspace, "commit", "-m", "Revise deploy skill");
+      await hostGit(workspace, "push", "origin", opts.onBranch);
+    }
+    return { branch: opts.onBranch };
+  }
+  let target = "deploy-skill";
+  try {
+    await hostGit(
+      workspace,
+      "ls-remote",
+      "--exit-code",
+      "--heads",
+      "origin",
+      target
+    );
+    const stamp = (/* @__PURE__ */ new Date()).toISOString().slice(0, 16).replace(/[-:]/g, "").replace("T", "-");
+    target = `${target}-${stamp}`;
+  } catch {
+  }
+  await hostGit(workspace, "checkout", "-B", target);
+  await hostGit(workspace, "add", "-A");
+  await hostGit(workspace, "commit", "-m", "Add deploy skill");
+  await hostGit(workspace, "push", "origin", target);
+  return { branch: target };
+}
+async function runEnvironmentCheck(opts) {
+  const status = await checkDeployStatus(opts);
+  if (!status.hasChecker) {
+    throw new Error(
+      "No environment checker on the default branch. Generate the deploy skill first."
+    );
+  }
+  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  const script = await hostGit(
+    workspace,
+    "cat-file",
+    "-p",
+    `origin/${status.branch}:${CHECKER_PATH}`
+  );
+  const tmp = import_path4.default.join(opts.spaceDir, `.env-check.${process.pid}.sh`);
+  await import_promises2.default.writeFile(tmp, script, { mode: 448 });
+  let ok = true;
+  let output = "";
+  try {
+    const scriptArg = tmp.split(import_path4.default.sep).join("/");
+    const res = await execLogin(`bash ${JSON.stringify(scriptArg)}`, {
+      cwd: workspace,
+      env: { ...process.env, ...spaceEnv(opts.spaceDir) },
+      timeout: 12e4
+    });
+    output = res.output;
+    if (res.code !== 0) ok = false;
+  } finally {
+    await import_promises2.default.rm(tmp, { force: true });
+  }
+  const checks = [];
+  for (const line of output.split("\n")) {
+    const match = /^(OK|FAIL):\s*(.+)$/.exec(line.trim());
+    if (!match) continue;
+    const [, verdict, rest] = match;
+    const dash = rest.indexOf(" - ");
+    checks.push({
+      ok: verdict === "OK",
+      label: dash > 0 ? rest.slice(0, dash) : rest,
+      detail: dash > 0 ? rest.slice(dash + 3) : ""
+    });
+    if (verdict === "FAIL") ok = false;
+  }
+  return { ok, checks, output: output.trim().slice(-4e3) };
+}
+async function fixEnvironment(opts) {
+  const { sendLog } = opts;
+  const before = await runEnvironmentCheck(opts);
+  if (before.ok) return before;
+  const status = await checkDeployStatus(opts);
+  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  const script = await hostGit(
+    workspace,
+    "cat-file",
+    "-p",
+    `origin/${status.branch}:${CHECKER_PATH}`
+  );
+  const failed = before.checks.filter((c) => !c.ok).map((c) => `- ${c.label}${c.detail ? ` (${c.detail})` : ""}`).join("\n");
+  sendLog({
+    type: "system",
+    content: "Setting this machine up to pass the environment check..."
+  });
+  const { result } = await spawnAgent(
+    opts.provider,
+    hostTarget(opts.spaceDir),
+    {
+      cwd: workspace,
+      prompt: buildPrompt(prompts_default.deployEnvFix, {
+        CHECKS: failed || before.output.slice(-2e3),
+        SCRIPT: script
+      }),
+      allowedTools: "Bash,Read,Grep,Glob,WebSearch,WebFetch",
+      // auto: installs are in-scope of the owner's explicit "fix environment"
+      // request; the classifier still blocks anything beyond it.
+      permissionMode: "auto",
+      model: "claude-opus-4-6",
+      includePartialMessages: true,
+      env: spaceEnv(opts.spaceDir),
+      callbacks: { onLog: (entry) => sendLog(entry) }
+    }
+  );
+  await result;
+  sendLog({ type: "system", content: "Re-running the environment check..." });
+  return runEnvironmentCheck(opts);
+}
+async function discardDeploySkill(opts) {
+  const workspace = import_path4.default.join(opts.spaceDir, "workspace");
+  await hostGit(workspace, "checkout", "--", ".").catch(() => null);
+  await hostGit(workspace, "clean", "-fd");
+  return { success: true };
+}
+
+// ../../shared/all/helpers/board-agent-core/skill-format.ts
+var EMPTY_FRONTMATTER = { name: "", description: "" };
+function splitKey(line) {
+  const at = line.indexOf(":");
+  if (at < 1) return null;
+  return { key: line.slice(0, at).trim(), value: line.slice(at + 1).trim() };
+}
+function stripQuotes(value2) {
+  const quoted = value2.startsWith('"') && value2.endsWith('"') || value2.startsWith("'") && value2.endsWith("'");
+  return quoted && value2.length > 1 ? value2.slice(1, -1) : value2;
+}
+function parseSkill(raw) {
+  const text = raw.replace(/^/, "");
+  if (!text.startsWith("---")) {
+    return {
+      frontmatter: EMPTY_FRONTMATTER,
+      body: text,
+      errors: ["Must start with YAML frontmatter (---)."]
+    };
+  }
+  const lines = text.split("\n");
+  const end = lines.findIndex((line, i) => i > 0 && line.trim() === "---");
+  if (end === -1) {
+    return {
+      frontmatter: EMPTY_FRONTMATTER,
+      body: text,
+      errors: ["Frontmatter is never closed (missing the second ---)."]
+    };
+  }
+  const errors = [];
+  const fields = {};
+  let pendingKey = "";
+  let list = [];
+  let map = {};
+  const flush = () => {
+    if (pendingKey) {
+      if (list.length) fields[pendingKey] = list;
+      else if (Object.keys(map).length) fields[pendingKey] = map;
+    }
+    pendingKey = "";
+    list = [];
+    map = {};
+  };
+  for (const line of lines.slice(1, end)) {
+    if (!line.trim() || line.trim().startsWith("#")) continue;
+    const indented = /^\s/.test(line);
+    if (indented && pendingKey) {
+      if (line.trim().startsWith("- ")) {
+        list.push(stripQuotes(line.trim().slice(2).trim()));
+      } else {
+        const nested = splitKey(line);
+        if (nested) map[nested.key] = stripQuotes(nested.value);
+        else errors.push(`Cannot read indented line: ${line.trim()}`);
+      }
+      continue;
+    }
+    if (indented) {
+      errors.push(`Cannot read indented line: ${line.trim()}`);
+      continue;
+    }
+    flush();
+    const pair = splitKey(line);
+    if (!pair) {
+      errors.push(`Cannot read line: ${line.trim()}`);
+      continue;
+    }
+    if (pair.value === "") {
+      pendingKey = pair.key;
+      continue;
+    }
+    fields[pair.key] = stripQuotes(pair.value);
+  }
+  flush();
+  const tools = fields["allowed-tools"];
+  if (typeof tools === "string") {
+    fields["allowed-tools"] = tools.split(",").map((tool) => tool.trim()).filter(Boolean);
+  }
+  if (fields["disable-model-invocation"] === "true") {
+    errors.push("disable-model-invocation must be false.");
+    delete fields["disable-model-invocation"];
+  }
+  if (fields["disable-model-invocation"] === "false") {
+    fields["disable-model-invocation"] = false;
+  }
+  const body = lines.slice(end + 1).join("\n").replace(/^\n/, "");
+  const parsed = skillFrontmatterSchema.safeParse(fields);
+  if (!parsed.success) {
+    for (const issue of parsed.error.issues) {
+      errors.push(`${issue.path.join(".") || "frontmatter"}: ${issue.message}`);
+    }
+    return {
+      frontmatter: {
+        name: typeof fields.name === "string" ? fields.name : "",
+        description: typeof fields.description === "string" ? fields.description : ""
+      },
+      body,
+      errors
+    };
+  }
+  return { frontmatter: parsed.data, body, errors };
+}
+function resolveSkillDir(root, name) {
+  if (!SKILL_NAME_REGEX.test(name) || name === "." || name === "..") {
+    throw new Error(`Invalid skill name: ${name}`);
+  }
+  return `${root.replace(/[/\\]+$/, "")}/${name}`;
+}
+
+// ../../shared/all/helpers/board-agent-core/host-skills.ts
+var AGENTS_ROOT = ".agents/skills";
+var CLAUDE_ROOT = ".claude/skills";
+var CLI_ROOTS = [CLAUDE_ROOT, ".codex/skills"];
+function globalAgentsRoot() {
+  return import_path5.default.join(import_os2.default.homedir(), ".agents", "skills");
+}
+var AGENTS_LINK_TARGET = "../.agents/skills";
+var BRANCH_PREFIX = "skill/";
+var SYMLINK_MODE = "120000";
+function summarize(raw, base) {
+  const { frontmatter, errors } = parseSkill(raw);
+  return { ...base, description: frontmatter.description, errors };
+}
+async function rootLinkState(root) {
+  const linkPath = import_path5.default.join(import_os2.default.homedir(), ...root.split("/"));
+  const stat = await import_promises3.default.lstat(linkPath).catch(() => null);
+  if (!stat) return "missing";
+  if (!stat.isSymbolicLink()) return "blocked";
+  const target = await import_promises3.default.readlink(linkPath).catch(() => "");
+  return target.replace(/\/+$/, "") === AGENTS_LINK_TARGET ? "linked" : "missing";
+}
+async function globalLinkState() {
+  const states = await Promise.all(CLI_ROOTS.map(rootLinkState));
+  if (states.includes("blocked")) return "blocked";
+  return states.includes("missing") ? "missing" : "linked";
+}
+async function listGlobal() {
+  const root = globalAgentsRoot();
+  const entries = await import_promises3.default.readdir(root, { withFileTypes: true }).catch(() => []);
+  const out = [];
+  for (const entry of entries) {
+    if (entry.isFile()) continue;
+    const dir = import_path5.default.join(root, entry.name);
+    const raw = await import_promises3.default.readFile(import_path5.default.join(dir, "SKILL.md"), "utf-8").catch(() => "");
+    if (!raw) continue;
+    out.push(
+      summarize(raw, {
+        name: entry.name,
+        scope: "global",
+        dir,
+        status: "live",
+        pendingBranch: ""
+      })
+    );
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+function strayRepoSkills(liveBlobs) {
+  return [...liveBlobs.keys()].filter((key) => CLI_ROOTS.some((root) => key.startsWith(`${root}/`))).sort();
+}
+async function treeAt(repo, ref) {
+  const raw = await hostGit(
+    repo,
+    "ls-tree",
+    "-r",
+    ref,
+    "--",
+    AGENTS_ROOT,
+    ...CLI_ROOTS
+  ).catch(() => "");
+  return raw.split("\n").filter(Boolean).map((line) => {
+    const [meta, filePath] = line.split("	");
+    const [mode, , sha] = meta.split(/\s+/);
+    return { mode, sha, filePath };
+  }).filter((entry) => Boolean(entry.filePath));
+}
+function skillBlobs(entries) {
+  const blobs = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const match = /^(.+\/skills)\/([^/]+)\/SKILL\.md$/.exec(entry.filePath);
+    if (match) blobs.set(`${match[1]}/${match[2]}`, entry.sha);
+  }
+  return blobs;
+}
+async function skillLinks(repo, entries) {
+  const links = /* @__PURE__ */ new Map();
+  const linkEntries = entries.filter(
+    (entry) => entry.mode === SYMLINK_MODE && /^.+\/skills(\/[^/]+)?$/.test(entry.filePath)
+  );
+  const targets = await gitCatFileBatch(
+    repo,
+    linkEntries.map((entry) => entry.sha)
+  );
+  for (const entry of linkEntries) {
+    const target = targets.get(entry.sha)?.trim();
+    if (target) links.set(entry.filePath, target);
+  }
+  return links;
+}
+function resolveRepoSkills(liveBlobs, pending) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const key of liveBlobs.keys()) {
+    if (key.startsWith(`${AGENTS_ROOT}/`)) keys.add(key);
+  }
+  for (const entry of pending) {
+    for (const key of entry.blobs.keys()) {
+      if (key.startsWith(`${AGENTS_ROOT}/`)) keys.add(key);
+    }
+  }
+  const out = [];
+  for (const key of [...keys].sort()) {
+    const name = key.slice(AGENTS_ROOT.length + 1);
+    const live = liveBlobs.get(key) || "";
+    const onBranch = pending.find((entry) => {
+      const sha = entry.blobs.get(key);
+      return Boolean(sha) && sha !== live;
+    });
+    const status = live ? onBranch ? "pending-edit" : "live" : "pending-new";
+    out.push({
+      name,
+      dir: key,
+      status,
+      pendingBranch: status === "live" ? "" : onBranch?.branch || "",
+      sha: live || onBranch?.blobs.get(key) || ""
+    });
+  }
+  return out;
+}
+async function repoSkills(ctx) {
+  const skills = resolveRepoSkills(ctx.liveBlobs, ctx.pending);
+  const cache2 = /* @__PURE__ */ new Map();
+  const missing = skills.map((skill) => skill.sha).filter((sha) => sha && !cache2.has(sha));
+  for (const [sha, text] of await gitCatFileBatch(ctx.repo, missing)) {
+    cache2.set(sha, text);
+  }
+  return skills.map(
+    (skill) => summarize(cache2.get(skill.sha) ?? "", {
+      name: skill.name,
+      scope: "repo",
+      dir: skill.dir,
+      status: skill.status,
+      pendingBranch: skill.pendingBranch
+    })
+  );
+}
+async function pendingBranches(repo, mainBranch) {
+  const refs = await hostGit(
+    repo,
+    "for-each-ref",
+    "--sort=-committerdate",
+    "--format=%(refname:short)",
+    `refs/remotes/origin/${BRANCH_PREFIX}*`
+  ).catch(() => "");
+  const branches = await Promise.all(
+    refs.split("\n").filter(Boolean).map(async (ref) => {
+      const merged = await hostGit(
+        repo,
+        "merge-base",
+        "--is-ancestor",
+        ref,
+        `origin/${mainBranch}`
+      ).then(
+        () => true,
+        () => false
+      );
+      if (merged) return null;
+      return {
+        branch: ref.replace(/^origin\//, ""),
+        blobs: skillBlobs(await treeAt(repo, ref))
+      };
+    })
+  );
+  return branches.filter((entry) => entry !== null);
+}
+function requireRepo(opts) {
+  if (!opts.repoUrl || !opts.githubToken) {
+    throw new Error("Set the repository URL and GitHub token first.");
+  }
+  return {
+    spaceDir: opts.spaceDir,
+    repoUrl: opts.repoUrl,
+    mainBranch: opts.mainBranch,
+    githubToken: opts.githubToken
+  };
+}
+async function ensureSkillsRepo(opts) {
+  const { spaceDir, repoUrl, mainBranch, githubToken } = requireRepo(opts);
+  const paths = hostSpacePaths(spaceDir);
+  const branch = (mainBranch || "main").replace(/[^\w./-]/g, "");
+  const url2 = buildCloneUrl(repoUrl, githubToken);
+  try {
+    await hostGit(paths.repo, "rev-parse", "--git-dir");
+    await hostGit(paths.repo, "remote", "set-url", "origin", url2);
+  } catch {
+    await hostGit(paths.root, "clone", "--branch", branch, url2, paths.repo);
+  }
+  await hostGit(
+    paths.repo,
+    "fetch",
+    "origin",
+    branch,
+    `+refs/heads/${BRANCH_PREFIX}*:refs/remotes/origin/${BRANCH_PREFIX}*`
+  );
+  return { repo: paths.repo, branch };
+}
+async function ensureSkillsWorktree(spaceDir, branch) {
+  const { repo, skills: worktree } = hostSpacePaths(spaceDir);
+  try {
+    await hostGit(worktree, "rev-parse", "--git-dir");
+  } catch {
+    await hostGit(repo, "worktree", "prune").catch(() => {
+    });
+    await import_promises3.default.rm(worktree, { recursive: true, force: true });
+    await hostGit(
+      repo,
+      "worktree",
+      "add",
+      "--detach",
+      worktree,
+      `origin/${branch}`
+    );
+  }
+  return worktree;
+}
+async function repoContext(opts) {
+  const { repo, branch } = await ensureSkillsRepo(opts);
+  const liveTree = await treeAt(repo, `origin/${branch}`);
+  const [links, pending] = await Promise.all([
+    skillLinks(repo, liveTree),
+    pendingBranches(repo, branch)
+  ]);
+  return {
+    repo,
+    branch,
+    liveTree,
+    liveBlobs: skillBlobs(liveTree),
+    links,
+    pending
+  };
+}
+function findRepoSkill(ctx, name) {
+  return resolveRepoSkills(ctx.liveBlobs, ctx.pending).find(
+    (skill) => skill.name === name
+  ) ?? null;
+}
+var workspaceQueues = /* @__PURE__ */ new Map();
+function withWorkspace(spaceDir, run2) {
+  const next = (workspaceQueues.get(spaceDir) ?? Promise.resolve()).then(
+    run2,
+    run2
+  );
+  workspaceQueues.set(
+    spaceDir,
+    next.catch(() => {
+    })
+  );
+  return next;
+}
+function repoLinkState(ctx) {
+  const target = ctx.links.get(CLAUDE_ROOT);
+  if (target) return target === AGENTS_LINK_TARGET ? "linked" : "missing";
+  return [...ctx.liveBlobs.keys()].some(
+    (key) => key.startsWith(`${CLAUDE_ROOT}/`)
+  ) ? "blocked" : "missing";
+}
+async function listSkillsImpl(opts) {
+  const [global2, globalLink] = await Promise.all([
+    listGlobal(),
+    globalLinkState()
+  ]);
+  if (!opts.repoUrl || !opts.githubToken) {
+    return {
+      global: global2,
+      repo: [],
+      globalLink,
+      repoLink: "linked",
+      repoBranch: "",
+      repoAvailable: false
+    };
+  }
+  const ctx = await repoContext(opts);
+  const repo = await repoSkills(ctx);
+  return {
+    global: global2,
+    repo,
+    globalLink,
+    repoLink: repoLinkState(ctx),
+    repoBranch: ctx.branch,
+    repoAvailable: true
+  };
+}
+async function bundleFilesOnDisk(dir) {
+  const out = [];
+  const walk = async (current, prefix, depth) => {
+    if (depth > 3 || out.length >= 200) return;
+    const entries = await import_promises3.default.readdir(current, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+      const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        await walk(import_path5.default.join(current, entry.name), rel, depth + 1);
+      } else if (rel !== "SKILL.md") {
+        out.push(rel);
+      }
+    }
+  };
+  await walk(dir, "", 0);
+  return out.sort();
+}
+async function readSkillImpl(opts) {
+  if (opts.scope === "global") {
+    const dir = resolveSkillDir(globalAgentsRoot(), opts.name);
+    const content2 = await import_promises3.default.readFile(import_path5.default.join(dir, "SKILL.md"), "utf-8");
+    const { frontmatter: frontmatter2, errors: errors2 } = parseSkill(content2);
+    return {
+      name: opts.name,
+      scope: "global",
+      content: content2,
+      frontmatter: frontmatter2,
+      errors: errors2,
+      bundleFiles: await bundleFilesOnDisk(dir),
+      status: "live",
+      pendingBranch: ""
+    };
+  }
+  const ctx = await repoContext(opts);
+  const skill = findRepoSkill(ctx, opts.name);
+  if (!skill) throw new Error(`No repo skill named ${opts.name}.`);
+  const draft = skill.pendingBranch ? ctx.pending.find((entry) => entry.branch === skill.pendingBranch)?.blobs.get(skill.dir) : "";
+  const content = await hostGit(ctx.repo, "cat-file", "-p", draft || skill.sha);
+  const { frontmatter, errors } = parseSkill(content);
+  const tree = draft ? await treeAt(ctx.repo, `origin/${skill.pendingBranch}`) : ctx.liveTree;
+  const bundleFiles = tree.filter(
+    (entry) => entry.filePath.startsWith(`${skill.dir}/`) && entry.filePath !== `${skill.dir}/SKILL.md`
+  ).map((entry) => entry.filePath.slice(skill.dir.length + 1)).sort();
+  return {
+    name: skill.name,
+    scope: "repo",
+    content,
+    frontmatter,
+    errors,
+    bundleFiles,
+    status: skill.status,
+    pendingBranch: skill.pendingBranch
+  };
+}
+async function moveIntoAgents(from, to) {
+  if (await import_promises3.default.access(to).then(
+    () => true,
+    () => false
+  )) {
+    throw new Error(
+      `${import_path5.default.basename(to)} exists in both roots. Remove one copy, then migrate.`
+    );
+  }
+  await import_promises3.default.mkdir(import_path5.default.dirname(to), { recursive: true });
+  try {
+    await import_promises3.default.rename(from, to);
+  } catch {
+    await import_promises3.default.cp(from, to, { recursive: true });
+    await import_promises3.default.rm(from, { recursive: true, force: true });
+  }
+}
+async function migrateGlobal() {
+  const moved = [];
+  for (const root of CLI_ROOTS) {
+    const dir = import_path5.default.join(import_os2.default.homedir(), ...root.split("/"));
+    const stat = await import_promises3.default.lstat(dir).catch(() => null);
+    if (!stat || stat.isSymbolicLink()) continue;
+    const entries = await import_promises3.default.readdir(dir, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+      if (entry.isFile() || entry.isSymbolicLink()) continue;
+      const src = import_path5.default.join(dir, entry.name);
+      if (!await import_promises3.default.access(import_path5.default.join(src, "SKILL.md")).then(
+        () => true,
+        () => false
+      )) {
+        continue;
+      }
+      await moveIntoAgents(src, import_path5.default.join(globalAgentsRoot(), entry.name));
+      moved.push(entry.name);
+    }
+    await import_promises3.default.rmdir(dir).catch(() => {
+    });
+  }
+  for (const root of CLI_ROOTS) {
+    const linkPath = import_path5.default.join(import_os2.default.homedir(), ...root.split("/"));
+    const after = await import_promises3.default.lstat(linkPath).catch(() => null);
+    if (after?.isSymbolicLink()) await import_promises3.default.rm(linkPath, { force: true });
+    else if (after) {
+      throw new Error(
+        `~/${root} still has files that are not skills. Empty it, then migrate.`
+      );
+    }
+    await import_promises3.default.mkdir(import_path5.default.dirname(linkPath), { recursive: true });
+    await import_promises3.default.symlink(AGENTS_LINK_TARGET, linkPath, "dir");
+  }
+  return moved;
+}
+async function migrateSkillsImpl(opts) {
+  if (opts.scope === "global") {
+    return { branch: "", moved: await migrateGlobal() };
+  }
+  const ctx = await repoContext(opts);
+  const strays = strayRepoSkills(ctx.liveBlobs);
+  const linked = ctx.links.get(CLAUDE_ROOT);
+  if (!strays.length && linked === AGENTS_LINK_TARGET) {
+    return { branch: "", moved: [] };
+  }
+  const { branch } = ctx;
+  const workspace = await ensureSkillsWorktree(opts.spaceDir, branch);
+  const target = `${BRANCH_PREFIX}migrate`;
+  await hostGit(workspace, "checkout", "-B", target, `origin/${branch}`);
+  await hostGit(workspace, "clean", "-fd");
+  if (opts.gitName) {
+    await hostGit(workspace, "config", "user.name", opts.gitName);
+  }
+  if (opts.gitEmail) {
+    await hostGit(workspace, "config", "user.email", opts.gitEmail);
+  }
+  const moved = [];
+  for (const stray of strays) {
+    const name = stray.slice(stray.lastIndexOf("/") + 1);
+    const dest = `${AGENTS_ROOT}/${name}`;
+    if (ctx.liveBlobs.has(dest)) {
+      throw new Error(
+        `${name} exists in both ${AGENTS_ROOT} and ${stray}. Remove one copy, then migrate.`
+      );
+    }
+    await import_promises3.default.mkdir(import_path5.default.join(workspace, AGENTS_ROOT), { recursive: true });
+    await hostGit(workspace, "mv", stray, dest);
+    moved.push(name);
+  }
+  const linkPath = import_path5.default.join(workspace, CLAUDE_ROOT);
+  await import_promises3.default.rm(linkPath, { recursive: true, force: true });
+  await import_promises3.default.symlink(AGENTS_LINK_TARGET, linkPath, "dir");
+  await hostGit(workspace, "add", "-A");
+  const dirty = await hostGit(workspace, "status", "--porcelain");
+  if (!dirty.trim()) return { branch: "", moved: [] };
+  await hostGit(
+    workspace,
+    "commit",
+    "-m",
+    `Migrate ${moved.length} skill(s) to ${AGENTS_ROOT} and link ${CLAUDE_ROOT}`
+  );
+  await hostGit(workspace, "push", "origin", target);
+  return { branch: target, moved };
+}
+function assertWritable(name, content) {
+  const parsed = parseSkill(content);
+  if (parsed.errors.length) {
+    throw new Error(`Fix the skill first: ${parsed.errors.join(" ")}`);
+  }
+  if (parsed.frontmatter.name !== name) {
+    throw new Error(
+      `Frontmatter name (${parsed.frontmatter.name}) must match the skill directory (${name}).`
+    );
+  }
+}
+async function writeSkillFile(opts) {
+  const dir = resolveSkillDir(opts.root, opts.name);
+  const file = import_path5.default.join(dir, "SKILL.md");
+  if (opts.keepExisting) {
+    const exists = await import_promises3.default.access(file).then(
+      () => true,
+      () => false
+    );
+    if (exists) return;
+  }
+  await import_promises3.default.mkdir(dir, { recursive: true });
+  await import_promises3.default.writeFile(file, opts.content, "utf-8");
+}
+async function writeGlobalSkill(opts) {
+  assertWritable(opts.name, opts.content);
+  await writeSkillFile({ root: globalAgentsRoot(), ...opts });
+}
+async function installBundledSkill(opts) {
+  assertWritable(opts.name, opts.content);
+  const home = opts.home ?? import_os2.default.homedir();
+  const write = (root) => writeSkillFile({
+    root,
+    name: opts.name,
+    content: opts.content,
+    keepExisting: true
+  });
+  await write(import_path5.default.join(home, ...AGENTS_ROOT.split("/")));
+  for (const root of CLI_ROOTS) {
+    const linkPath = import_path5.default.join(home, ...root.split("/"));
+    const stat = await import_promises3.default.lstat(linkPath).catch(() => null);
+    if (stat?.isSymbolicLink()) continue;
+    if (!stat) {
+      await import_promises3.default.mkdir(import_path5.default.dirname(linkPath), { recursive: true });
+      await import_promises3.default.symlink(AGENTS_LINK_TARGET, linkPath, "dir").catch(() => void 0);
+      continue;
+    }
+    await write(linkPath);
+  }
+}
+async function deleteGlobalSkill(opts) {
+  const dir = resolveSkillDir(globalAgentsRoot(), opts.name);
+  await import_promises3.default.rm(dir, { recursive: true, force: true });
+}
+async function proposeRepoSkillImpl(opts) {
+  assertWritable(opts.name, opts.content);
+  if (!SKILL_NAME_REGEX.test(opts.name)) {
+    throw new Error(`Invalid skill name: ${opts.name}`);
+  }
+  const ctx = await repoContext(opts);
+  const known = findRepoSkill(ctx, opts.name);
+  const dir = known?.dir || `${AGENTS_ROOT}/${opts.name}`;
+  const { branch } = ctx;
+  const workspace = await ensureSkillsWorktree(opts.spaceDir, branch);
+  const target = `${BRANCH_PREFIX}${opts.name}`;
+  const existing = await hostGit(
+    workspace,
+    "ls-remote",
+    "--heads",
+    "origin",
+    target
+  ).catch(() => "");
+  if (existing.trim()) {
+    await hostGit(
+      workspace,
+      "fetch",
+      "origin",
+      `+refs/heads/${target}:refs/remotes/origin/${target}`
+    );
+    await hostGit(workspace, "checkout", "-B", target, `origin/${target}`);
+  } else {
+    await hostGit(workspace, "checkout", "-B", target, `origin/${branch}`);
+  }
+  await hostGit(workspace, "clean", "-fd");
+  if (opts.gitName) {
+    await hostGit(workspace, "config", "user.name", opts.gitName);
+  }
+  if (opts.gitEmail) {
+    await hostGit(workspace, "config", "user.email", opts.gitEmail);
+  }
+  await import_promises3.default.mkdir(import_path5.default.join(workspace, dir), { recursive: true });
+  await import_promises3.default.writeFile(
+    import_path5.default.join(workspace, dir, "SKILL.md"),
+    opts.content,
+    "utf-8"
+  );
+  const dirty = await hostGit(workspace, "status", "--porcelain");
+  if (!dirty.trim()) return { branch: target };
+  await hostGit(workspace, "add", "-A");
+  await hostGit(
+    workspace,
+    "commit",
+    "-m",
+    `${known ? "Update" : "Add"} skill: ${opts.name}`
+  );
+  await hostGit(workspace, "push", "origin", target);
+  return { branch: target };
+}
+function listSkills(opts) {
+  return withWorkspace(opts.spaceDir, () => listSkillsImpl(opts));
+}
+function readSkill(opts) {
+  return withWorkspace(opts.spaceDir, () => readSkillImpl(opts));
+}
+function migrateSkills(opts) {
+  return withWorkspace(opts.spaceDir, () => migrateSkillsImpl(opts));
+}
+function proposeRepoSkill(opts) {
+  return withWorkspace(opts.spaceDir, () => proposeRepoSkillImpl(opts));
+}
+
+// ../../shared/all/helpers/card-ai/scripts.ts
+function frpcExposeScript(p) {
+  return `#!/bin/sh
+set -e
+set -a; . '${p.envFile}' 2>/dev/null || true; set +a
+mkdir -p '${p.runDir}'
+PORT="$1"
+NAME="$2"
+if [ -z "$PORT" ] || [ -z "$NAME" ]; then
+  echo "usage: factiii-expose <port> <name>" >&2
+  echo "  e.g. factiii-expose 3000 app" >&2
+  exit 1
+fi
+case "$NAME" in *[!a-zA-Z0-9-]*|"") echo "name must be [a-zA-Z0-9-]" >&2; exit 1 ;; esac
+PROXY="\${FACTIII_TASK_ID}-\${NAME}"
+DOMAIN="\${PROXY}.\${FACTIII_FRP_DOMAIN}"
+TOML="${p.runDir}/\${NAME}.toml"
+cat > "$TOML" <<EOF
+serverAddr = "\${FACTIII_FRP_SERVER}"
+serverPort = \${FACTIII_FRP_PORT}
+transport.protocol = "tcp"
+
+[metadatas]
+factiii_token = "\${FACTIII_FRP_TOKEN}"
+
+[[proxies]]
+name = "\${PROXY}"
+type = "http"
+localPort = \${PORT}
+subdomain = "\${PROXY}"
+EOF
+# nohup, not setsid: setsid does not exist on macOS.
+nohup frpc -c "$TOML" > "${p.runDir}/\${NAME}.log" 2>&1 < /dev/null &
+echo $! > "${p.runDir}/\${NAME}.pid"
+echo "http://\${DOMAIN}"
+`;
+}
+function frpcUnexposeScript(p) {
+  return `#!/bin/sh
+NAME="$1"
+if [ -z "$NAME" ]; then
+  echo "usage: factiii-unexpose <name>" >&2
+  exit 1
+fi
+PID_FILE="${p.runDir}/\${NAME}.pid"
+if [ -f "$PID_FILE" ]; then
+  kill "$(cat "$PID_FILE")" 2>/dev/null || true
+  rm -f "$PID_FILE" "${p.runDir}/\${NAME}.toml" "${p.runDir}/\${NAME}.log"
+  echo "stopped \${NAME}"
+else
+  echo "no tunnel named \${NAME}" >&2
+  exit 1
+fi
+`;
+}
+
+// ../../shared/all/helpers/card-ai/frpc.ts
+var FRP_SERVER_ADDR = "dev.factiii.com";
+var FRP_SERVER_PORT = 7443;
+var FRP_DOMAIN_SUFFIX = "dev.factiii.com";
+function frpcPaths(target) {
+  const { root, bin } = target.paths;
+  return {
+    binDir: bin,
+    binary: `${bin}/frpc`,
+    expose: `${bin}/factiii-expose`,
+    unexpose: `${bin}/factiii-unexpose`,
+    envFile: `${root}/.factiii-frp-env`,
+    runDir: `${root}/.frpc`
+  };
+}
+function vendoredBinaryName() {
+  const cpu = process.arch === "x64" ? "amd64" : process.arch;
+  return `frpc-${process.platform}-${cpu}`;
+}
+async function installFrpcBinary(target) {
+  const p = frpcPaths(target);
+  const binaryName = vendoredBinaryName();
+  const src = import_path6.default.join(__dirname, "..", "vendor", binaryName);
+  if (!(0, import_fs2.existsSync)(src)) {
+    throw new Error(
+      `Vendored frpc missing (${src}). Run apps/runner/scripts/fetch-frpc.sh.`
+    );
+  }
+  const staged = await import_promises4.default.stat(p.binary).catch(() => null);
+  const source = await import_promises4.default.stat(src);
+  if (staged?.size === source.size) return;
+  await import_promises4.default.mkdir(p.binDir, { recursive: true });
+  await import_promises4.default.copyFile(src, p.binary);
+  await import_promises4.default.chmod(p.binary, 493);
+}
+var EXPOSE_SKILL_NAME = "share-a-port";
+var FENCE = "```";
+var EXPOSE_SKILL_MD = [
+  "---",
+  `name: ${EXPOSE_SKILL_NAME}`,
+  "description: Give a port running in this workspace a public HTTPS URL, with factiii-expose. TRIGGER when the user asks to share, expose, preview or publish a local server, wants a link to something running on localhost, or needs an external service to reach a local port.",
+  "---",
+  "",
+  `# ${EXPOSE_SKILL_NAME}`,
+  "",
+  "This workspace can put a local port on the public internet. Both commands are",
+  "already on your PATH; nothing needs installing.",
+  "",
+  "## Share a port",
+  "",
+  FENCE + "bash",
+  "factiii-expose <port> <name>   # e.g. factiii-expose 3000 app",
+  FENCE,
+  "",
+  "It prints the public URL and returns straight away - the tunnel runs in the",
+  "background and lives until the session ends or you stop it.",
+  "",
+  "- `<name>` may hold letters, numbers and dashes only.",
+  "- Re-running it with the same name replaces that tunnel rather than opening a",
+  "  second one, so it is safe to repeat.",
+  "- Start the server FIRST. A URL for a port nothing is listening on answers",
+  "  with an error, which reads to the user like a broken tunnel.",
+  "",
+  "## Stop sharing",
+  "",
+  FENCE + "bash",
+  "factiii-unexpose <name>",
+  FENCE,
+  "",
+  "## Before you share",
+  "",
+  "The URL is public and unauthenticated: anyone holding the link reaches",
+  "whatever that port serves. Do not expose a service that fronts real",
+  "credentials, customer data, or a database. If you are unsure whether the user",
+  "wants something reachable from outside, ask first.",
+  "",
+  "Always tell the user the URL you got back. They can also see every live",
+  "tunnel, and stop any of them, in the card's Task Manager panel.",
+  ""
+].join("\n");
+async function installFrpcHarness(params) {
+  const { target, taskId, runnerToken } = params;
+  const p = frpcPaths(target);
+  await installFrpcBinary(target);
+  const envLines = [
+    `FACTIII_FRP_SERVER=${FRP_SERVER_ADDR}`,
+    `FACTIII_FRP_PORT=${FRP_SERVER_PORT}`,
+    `FACTIII_FRP_TOKEN=${runnerToken}`,
+    `FACTIII_FRP_DOMAIN=${FRP_DOMAIN_SUFFIX}`,
+    `FACTIII_TASK_ID=${taskId}`
   ];
   const scriptPaths = { envFile: p.envFile, runDir: p.runDir };
   await target.writeFile(p.expose, frpcExposeScript(scriptPaths));
   await target.writeFile(p.unexpose, frpcUnexposeScript(scriptPaths));
   await target.sh(`chmod +x '${p.expose}' '${p.unexpose}'`);
   await target.writeFile(p.envFile, envLines.join("\n") + "\n");
+  await installBundledSkill({
+    name: EXPOSE_SKILL_NAME,
+    content: EXPOSE_SKILL_MD
+  }).catch(() => void 0);
+}
+var ROW_SEP = "|";
+function parseTunnelRows(raw) {
+  const tunnels = [];
+  for (const line of raw.split("\n")) {
+    const [name, port, url2] = line.trim().split(ROW_SEP);
+    if (!name || !url2) continue;
+    const localPort = Number(port);
+    if (!Number.isInteger(localPort) || localPort <= 0) continue;
+    tunnels.push({ name, port: localPort, url: url2 });
+  }
+  return tunnels;
+}
+async function listLiveTunnels(target) {
+  const p = frpcPaths(target);
+  const script = [
+    `set -a; . '${p.envFile}' 2>/dev/null || true; set +a`,
+    `cd '${p.runDir}' 2>/dev/null || exit 0`,
+    "for pidfile in *.pid; do",
+    '  [ -e "$pidfile" ] || continue',
+    '  name=$(basename "$pidfile" .pid)',
+    '  pid=$(cat "$pidfile" 2>/dev/null)',
+    '  [ -n "$pid" ] || continue',
+    // The tunnel is whatever frpc is still running; a stale pid file is not one.
+    '  kill -0 "$pid" 2>/dev/null || continue',
+    '  [ -f "$name.toml" ] || continue',
+    `  port=$(sed -n 's/^localPort = *//p' "$name.toml" | head -1)`,
+    `  sub=$(sed -n 's/^subdomain = *//p' "$name.toml" | tr -d '"' | head -1)`,
+    '  [ -n "$port" ] && [ -n "$sub" ] || continue',
+    `  echo "$name${ROW_SEP}$port${ROW_SEP}http://$sub.$FACTIII_FRP_DOMAIN"`,
+    "done"
+  ].join("\n");
+  const out = await target.run(["sh", "-c", script]).catch(() => "");
+  return parseTunnelRows(out).sort((a, b) => a.port - b.port);
 }
 
 // ../../shared/all/helpers/card-ai/claude-mode.ts
@@ -14064,17 +15916,18 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
     await this.core.ensureSpaceWorkspace();
     await assertAgentSignedIn(session.provider, this.core.target());
     if (hasGit) {
-      const { path: path16 } = await addWorktree(
+      const { path: path17 } = await addWorktree(
         this.core.target(),
         session.taskId,
-        baseBranch || config.mainBranch || "main"
+        baseBranch || config.mainBranch || "main",
+        "card"
       );
-      session.workspacePath = path16;
+      session.workspacePath = path17;
       await setGitIdentity(
         this.core.target(),
         config.gitName,
         config.gitEmail,
-        path16
+        path17
       );
       this.emitter.addLog(session, "system", "Worktree ready.");
     } else {
@@ -14296,17 +16149,18 @@ var ClaudeModeEngine = class _ClaudeModeEngine {
     this.emitter.addLog(session, "system", "Preparing environment...");
     await this.core.ensureSpaceWorkspace();
     await assertAgentSignedIn(session.provider, this.core.target());
-    const { path: path16 } = await addWorktree(
+    const { path: path17 } = await addWorktree(
       this.core.target(),
       session.taskId,
-      config.mainBranch || "main"
+      config.mainBranch || "main",
+      "card"
     );
-    session.workspacePath = path16;
+    session.workspacePath = path17;
     await setGitIdentity(
       this.core.target(),
       config.gitName,
       config.gitEmail,
-      path16
+      path17
     );
     await this.putCard(session);
     const patchDir = `${this.core.target().paths.root}/patches/${session.taskId}`;
@@ -14601,6 +16455,150 @@ async function startTmuxSession(opts) {
   };
 }
 
+// ../../shared/all/helpers/terminal-ai/processes.ts
+var PS_FORMAT = "pid=,ppid=,pcpu=,rss=,etime=,args=";
+var PS_FIELDS = 5;
+function parsePsTable(raw) {
+  const rows = [];
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    const parts2 = trimmed.split(/\s+/);
+    if (parts2.length <= PS_FIELDS) continue;
+    const [pid, ppid, cpu, rss, elapsed] = parts2;
+    const pidNum = Number(pid);
+    const ppidNum = Number(ppid);
+    if (!Number.isInteger(pidNum) || !Number.isInteger(ppidNum)) continue;
+    rows.push({
+      pid: pidNum,
+      ppid: ppidNum,
+      cpu: Number(cpu) || 0,
+      rssKb: Number(rss) || 0,
+      elapsed: elapsed ?? "",
+      args: parts2.slice(PS_FIELDS).join(" ")
+    });
+  }
+  return rows;
+}
+function descendantsOf(rows, roots) {
+  const children = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const list = children.get(row.ppid);
+    if (list) list.push(row);
+    else children.set(row.ppid, [row]);
+  }
+  const found = [];
+  const seen = new Set(roots);
+  const stack = [...roots];
+  while (stack.length) {
+    const pid = stack.pop();
+    for (const child of children.get(pid) ?? []) {
+      if (seen.has(child.pid)) continue;
+      seen.add(child.pid);
+      found.push(child);
+      stack.push(child.pid);
+    }
+  }
+  return found.sort((a, b) => a.pid - b.pid);
+}
+function commandOf(args) {
+  const first = args.trim().split(/\s+/)[0] ?? "";
+  const base = first.split("/").pop() ?? first;
+  return base || "process";
+}
+var SHELLS = /* @__PURE__ */ new Set([
+  "bash",
+  "zsh",
+  "sh",
+  "dash",
+  "fish",
+  "ksh",
+  "tcsh",
+  "csh",
+  "login"
+]);
+function isShell(args) {
+  const name = commandOf(args);
+  return SHELLS.has(name.startsWith("-") ? name.slice(1) : name);
+}
+function processesForPane(rows, panePid) {
+  const kids = descendantsOf(rows, [panePid]);
+  const pane = rows.find((row) => row.pid === panePid);
+  if (pane && !isShell(pane.args)) return [pane, ...kids];
+  return kids;
+}
+function portOf(address) {
+  const colon = address.lastIndexOf(":");
+  if (colon === -1) return null;
+  const port = Number(address.slice(colon + 1));
+  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : null;
+}
+function parseLsofSockets(raw) {
+  const use = /* @__PURE__ */ new Map();
+  let pid = 0;
+  let address = "";
+  const entry = () => {
+    let found = use.get(pid);
+    if (!found) {
+      found = { ports: [], connections: 0 };
+      use.set(pid, found);
+    }
+    return found;
+  };
+  for (const line of raw.split("\n")) {
+    const kind = line[0];
+    if (kind === "p") {
+      pid = Number(line.slice(1)) || 0;
+      address = "";
+      continue;
+    }
+    if (!pid) continue;
+    if (kind === "n") {
+      address = line.slice(1);
+      continue;
+    }
+    if (!line.startsWith("TST=")) continue;
+    const state = line.slice(4);
+    if (state === "LISTEN") {
+      const port = portOf(address);
+      if (port !== null && !entry().ports.includes(port)) {
+        entry().ports.push(port);
+      }
+    } else if (state === "ESTABLISHED") {
+      entry().connections += 1;
+    }
+    address = "";
+  }
+  return use;
+}
+function parseSsListen(raw) {
+  const use = /* @__PURE__ */ new Map();
+  for (const line of raw.split("\n")) {
+    const address = line.trim().split(/\s+/)[3];
+    if (!address) continue;
+    const port = portOf(address);
+    if (port === null) continue;
+    for (const match of line.matchAll(/pid=(\d+)/g)) {
+      const pid = Number(match[1]);
+      if (!Number.isInteger(pid)) continue;
+      const found = use.get(pid) ?? { ports: [], connections: 0 };
+      if (!found.ports.includes(port)) found.ports.push(port);
+      use.set(pid, found);
+    }
+  }
+  return use;
+}
+async function socketsFor(target, pids) {
+  if (pids.length === 0) return /* @__PURE__ */ new Map();
+  const lsof = await target.run(["lsof", "-a", "-p", pids.join(","), "-nP", "-iTCP", "-F", "pnT"]).catch((err) => String(err.stdout ?? ""));
+  if (lsof.trim()) return parseLsofSockets(lsof);
+  const ss = await target.run(["ss", "-ltnpH"]).catch(() => "");
+  if (!ss.trim()) return /* @__PURE__ */ new Map();
+  const all = parseSsListen(ss);
+  const wanted = new Set(pids);
+  for (const pid of all.keys()) if (!wanted.has(pid)) all.delete(pid);
+  return all;
+}
+
 // ../../shared/all/helpers/terminal-ai/watcher.ts
 var PRUNED_DIRS = [
   ".git",
@@ -14625,6 +16623,15 @@ var MAX_BATCH = 200;
 var FLUSH_MS = 120;
 var SELF_WRITE_MS = 2e3;
 var dynamicImport = new Function("s", "return import(s)");
+var importFs = new Function("s", "return import(s)");
+async function resolveReal(path17) {
+  try {
+    const { realpath } = await importFs("fs/promises");
+    return await realpath(path17);
+  } catch {
+    return path17;
+  }
+}
 var loadSubscribe = null;
 function getSubscribe() {
   loadSubscribe ??= dynamicImport("@parcel/watcher").then((m) => m.subscribe).catch(() => null);
@@ -14656,6 +16663,7 @@ var WorkspaceWatcher = class {
      *  not come back as "changed on disk". */
     this.selfWrites = /* @__PURE__ */ new Map();
     this.closed = false;
+    this.watchRoot = root;
   }
   /** Fire-and-forget: callers treat starting a watch as synchronous, and
    *  nothing can be emitted before `subscribe` resolves anyway. */
@@ -14666,9 +16674,11 @@ var WorkspaceWatcher = class {
   async open() {
     const subscribe = await getSubscribe();
     if (!subscribe) return this.stop();
+    this.watchRoot = await resolveReal(this.root);
+    const exclude = await Promise.all(this.exclude.map(resolveReal));
     try {
       const sub = await subscribe(
-        this.root,
+        this.watchRoot,
         (err, events) => {
           if (err) return this.stop();
           for (const event of events) this.onEvent(event);
@@ -14678,7 +16688,7 @@ var WorkspaceWatcher = class {
           ignore: [
             ...PRUNED_DIRS.map((d) => `**/${d}/**`),
             ...NOISE_GLOBS,
-            ...this.exclude
+            ...exclude
           ]
         }
       );
@@ -14707,8 +16717,8 @@ var WorkspaceWatcher = class {
   /** Typed kinds, so unlike a bare `fs.watch` rename there is nothing to stat
    *  to tell a create from a delete. */
   onEvent(event) {
-    if (!event.path.startsWith(this.root)) return;
-    const rel = event.path.slice(this.root.length).replace(/^\/+/, "");
+    if (!event.path.startsWith(this.watchRoot)) return;
+    const rel = event.path.slice(this.watchRoot.length).replace(/^\/+/, "");
     if (!rel) return;
     if (event.type === "create") this.record("added", rel);
     else if (event.type === "delete") this.record("removed", rel);
@@ -14733,19 +16743,19 @@ var WorkspaceWatcher = class {
   }
   record(kind, relPath) {
     if (this.closed) return;
-    const path16 = "/" + relPath;
-    const expiry = this.selfWrites.get(path16);
+    const path17 = "/" + relPath;
+    const expiry = this.selfWrites.get(path17);
     if (expiry !== void 0) {
       if (expiry > Date.now()) return;
-      this.selfWrites.delete(path16);
+      this.selfWrites.delete(path17);
     }
     const { added, changed, removed } = this.pending;
-    added.delete(path16);
-    changed.delete(path16);
-    removed.delete(path16);
-    if (kind === "added") added.add(path16);
-    else if (kind === "changed") changed.add(path16);
-    else removed.add(path16);
+    added.delete(path17);
+    changed.delete(path17);
+    removed.delete(path17);
+    if (kind === "added") added.add(path17);
+    else if (kind === "changed") changed.add(path17);
+    else removed.add(path17);
     if (added.size + changed.size + removed.size > MAX_BATCH) {
       this.pending = { ...emptyPending(), resync: true };
     }
@@ -14764,8 +16774,8 @@ var WorkspaceWatcher = class {
     this.pending = emptyPending();
     if (!resync && !added.size && !changed.size && !removed.size) return;
     const now = Date.now();
-    for (const [path16, expiry] of this.selfWrites) {
-      if (expiry <= now) this.selfWrites.delete(path16);
+    for (const [path17, expiry] of this.selfWrites) {
+      if (expiry <= now) this.selfWrites.delete(path17);
     }
     this.emit({
       added: resync ? [] : [...added],
@@ -14850,16 +16860,15 @@ var TerminalModeEngine = class {
   /** Suppress the change event our own write is about to produce, so a save
    *  never comes back to the editor as an outside edit. Normalized to the form
    *  the watcher emits, since callers spell the path either way. */
-  expectWrite(postId, path16) {
-    this.watchers.get(postId)?.expectWrite(posixNormalize(path16));
+  expectWrite(postId, path17) {
+    this.watchers.get(postId)?.expectWrite(posixNormalize(path17));
   }
   // ── Lifecycle / ModeEngine ──
   start(base, args) {
     const session = {
       ...base,
       openedFiles: [],
-      buffers: {},
-      exposed: []
+      buffers: {}
     };
     this.sessions.set(session.postId, session);
     this.emitter.emitSessionUpdate(session);
@@ -14923,8 +16932,32 @@ var TerminalModeEngine = class {
     this.reservedNames.clear();
     this.sessions.clear();
   }
-  teardown(session) {
-    return teardownSession(session, this.core.target());
+  /** Every tmux session this post owns, by the `terminal-<postId>-<tab>` name
+   *  tmuxName() builds. */
+  async terminalSessionNames(target, postId) {
+    const prefix = `terminal-${postId.replace(/[^a-zA-Z0-9._-]/g, "_")}-`;
+    const stdout = await target.sh(
+      `${tmuxCli(target)} list-sessions -F '#{session_name}' 2>/dev/null || true`
+    ).catch(() => "");
+    return stdout.split("\n").map((line) => line.trim()).filter((name) => name.startsWith(prefix));
+  }
+  /** Kill the post's terminals and everything running inside them. Killing the
+   *  tmux session alone leaves a process that reparented away from the shell,
+   *  so each pane's process tree is killed first. */
+  async killTerminals(postId) {
+    const target = this.core.target();
+    const names = await this.terminalSessionNames(target, postId);
+    for (const name of names) {
+      await target.sh(
+        `for p in $(${tmuxCli(target)} list-panes -t ${name} -F '#{pane_pid}' 2>/dev/null); do pkill -TERM -P "$p" 2>/dev/null || true; done; ${tmuxCli(target)} kill-session -t ${name} 2>/dev/null || true`
+      ).catch(() => {
+      });
+    }
+  }
+  async teardown(session) {
+    await this.killTerminals(session.postId).catch(() => {
+    });
+    await teardownSession(session, this.core.target());
   }
   putCard(s) {
     return putSessionCard(s, this.core.target());
@@ -14961,8 +16994,7 @@ var TerminalModeEngine = class {
         workspacePath: r.worktreePath,
         agentSessionId: r.agentSessionId,
         openedFiles: [],
-        buffers: {},
-        exposed: []
+        buffers: {}
       };
       this.sessions.set(r.postId, session);
       this.startWatching(session);
@@ -15004,8 +17036,7 @@ var TerminalModeEngine = class {
       workspacePath: args.workspacePath,
       agentSessionId: args.agentSessionId,
       openedFiles: [],
-      buffers: {},
-      exposed: []
+      buffers: {}
     };
     this.sessions.set(args.postId, session);
     this.stopWatching(args.postId);
@@ -15025,13 +17056,18 @@ var TerminalModeEngine = class {
         this.reservedNames.values()
       );
       this.reservedNames.set(session.postId, workName);
-      const { path: path16 } = await addWorktree(this.core.target(), workName, branch);
-      session.workspacePath = path16;
+      const { path: path17 } = await addWorktree(
+        this.core.target(),
+        workName,
+        branch,
+        "terminal"
+      );
+      session.workspacePath = path17;
       await setGitIdentity(
         this.core.target(),
         config.gitName,
         config.gitEmail,
-        path16
+        path17
       );
       this.emitter.addLog(session, "system", "Worktree ready.");
     } else {
@@ -15093,19 +17129,23 @@ var TerminalModeEngine = class {
   }
   async bareFsList({
     postId,
-    path: path16
+    path: path17
   }) {
     const target = this.getBareTarget(postId);
     const root = this.getBareRoot(postId);
-    const abs = this.resolveBarePath(path16, root);
+    const abs = this.resolveBarePath(path17, root);
     const relRoot = abs.slice(root.length) || "/";
-    const out = await target.sh(`cd ${shEscape(abs)} && for f in .* *; do
+    const out = await target.run([
+      "sh",
+      "-c",
+      `cd ${shEscape(abs)} && for f in .* *; do
         case "$f" in
           "."|".."|".git"|"*") continue ;;
         esac
         [ -e "$f" ] || continue
         if [ -d "$f" ]; then echo "d/$f"; else echo "f/$f"; fi
-      done | LC_ALL=C sort`);
+      done | LC_ALL=C sort`
+    ]);
     const entries = [];
     for (const line of out.split("\n")) {
       if (!line) continue;
@@ -15143,32 +17183,32 @@ var TerminalModeEngine = class {
   }
   async bareFsRead({
     postId,
-    path: path16
+    path: path17
   }) {
     const target = this.getBareTarget(postId);
-    const abs = this.resolveBarePath(path16, this.getBareRoot(postId));
+    const abs = this.resolveBarePath(path17, this.getBareRoot(postId));
     const b64 = (await target.sh(`base64 < ${shEscape(abs)} | tr -d '
 '`)).trim();
     return { content: b64, encoding: "base64" };
   }
   async bareFsWrite({
     postId,
-    path: path16,
+    path: path17,
     content,
     encoding
   }) {
     const target = this.getBareTarget(postId);
-    const abs = this.resolveBarePath(path16, this.getBareRoot(postId));
+    const abs = this.resolveBarePath(path17, this.getBareRoot(postId));
     const b64 = encoding === "base64" ? content : Buffer.from(content, "utf-8").toString("base64");
     if (!/^[A-Za-z0-9+/=\n\r]*$/.test(b64)) {
       throw new Error("Invalid base64 payload.");
     }
-    this.expectWrite(String(postId), path16);
+    this.expectWrite(String(postId), path17);
     await target.sh(
       `mkdir -p ${shEscape(posixDirname(abs))} && printf %s ${shEscape(b64)} | base64 -d > ${shEscape(abs)}`
     );
     const session = this.sessions.get(String(postId));
-    if (session) delete session.buffers[path16];
+    if (session) delete session.buffers[path17];
   }
   /** Write a dropped image to the per-space drops dir (`paths.root`, OUTSIDE the
    *  card worktree so it never touches the repo) and return its absolute path. */
@@ -15213,39 +17253,39 @@ var TerminalModeEngine = class {
   }
   bareOpenFile({
     postId: rawPostId,
-    path: path16
+    path: path17
   }) {
     const session = this.sessions.get(String(rawPostId));
     if (!session || session.mode !== "bare") return;
-    if (!session.openedFiles.includes(path16)) {
-      session.openedFiles.push(path16);
+    if (!session.openedFiles.includes(path17)) {
+      session.openedFiles.push(path17);
     }
   }
   bareCloseFile({
     postId: rawPostId,
-    path: path16
+    path: path17
   }) {
     const session = this.sessions.get(String(rawPostId));
     if (!session || session.mode !== "bare") return;
-    session.openedFiles = session.openedFiles.filter((p) => p !== path16);
-    delete session.buffers[path16];
+    session.openedFiles = session.openedFiles.filter((p) => p !== path17);
+    delete session.buffers[path17];
   }
   bareBufferSet({
     postId: rawPostId,
-    path: path16,
+    path: path17,
     content
   }) {
     const session = this.sessions.get(String(rawPostId));
     if (!session || session.mode !== "bare") return;
-    session.buffers[path16] = content;
+    session.buffers[path17] = content;
   }
   async bareFsDelete({
     postId,
-    path: path16
+    path: path17
   }) {
     const target = this.getBareTarget(postId);
     const root = this.getBareRoot(postId);
-    const abs = this.resolveBarePath(path16, root);
+    const abs = this.resolveBarePath(path17, root);
     if (abs === root) {
       throw new Error("Refusing to delete the repo root.");
     }
@@ -15253,10 +17293,10 @@ var TerminalModeEngine = class {
   }
   async bareFsMkdir({
     postId,
-    path: path16
+    path: path17
   }) {
     const target = this.getBareTarget(postId);
-    const abs = this.resolveBarePath(path16, this.getBareRoot(postId));
+    const abs = this.resolveBarePath(path17, this.getBareRoot(postId));
     await target.sh(`mkdir -p ${shEscape(abs)}`);
   }
   async bareReview({
@@ -15317,25 +17357,56 @@ var TerminalModeEngine = class {
       commitMessage: session.commitMessage
     };
   }
-  async bareGitStatus({
-    postId: rawPostId
-  }) {
-    const postId = String(rawPostId);
-    const session = this.sessions.get(postId);
+  /** The worktree a card's git panel acts on, or '' when the card has none (a
+   *  OneDrive-only space has no tree to diff). Throws for a session that isn't
+   *  live, so a stale modal gets an error rather than acting on whatever
+   *  happens to sit at the space root. */
+  gitWorkdir(rawPostId) {
+    const session = this.sessions.get(String(rawPostId));
     if (!session) throw new Error("No active session for this card.");
     if (session.mode !== "bare") {
-      throw new Error("bareGitStatus is only valid in Bare mode.");
+      throw new Error("Git actions are only valid in Bare mode.");
     }
     if (session.phase !== "bare-active" && session.phase !== "bare-review") {
       throw new Error("Workspace is not ready.");
     }
-    if (!session.workspacePath) {
-      return { diff: "", changedFiles: [] };
-    }
-    return await extractDiff(
-      this.core.target(),
-      session.workspacePath || void 0
-    );
+    return session.workspacePath || "";
+  }
+  async bareGitStatus({
+    postId
+  }) {
+    const workdir = this.gitWorkdir(postId);
+    if (!workdir) return { diff: "", changedFiles: [] };
+    return await readGitPanel(this.core.target(), workdir);
+  }
+  /** Both staging calls answer with the panel's next state: the index is
+   *  inside .git, which the working-tree watcher prunes, so nothing else would
+   *  tell the panel its rows just moved. */
+  async bareGitStage({
+    postId: rawPostId,
+    paths
+  }) {
+    const workdir = this.gitWorkdir(rawPostId);
+    if (!workdir) return { diff: "", changedFiles: [] };
+    await stagePaths(this.core.target(), workdir, paths);
+    return await readGitPanel(this.core.target(), workdir);
+  }
+  async bareGitUnstage({
+    postId: rawPostId,
+    paths
+  }) {
+    const workdir = this.gitWorkdir(rawPostId);
+    if (!workdir) return { diff: "", changedFiles: [] };
+    await unstagePaths(this.core.target(), workdir, paths);
+    return await readGitPanel(this.core.target(), workdir);
+  }
+  async bareGitCommitDiff({
+    postId,
+    sha
+  }) {
+    const workdir = this.gitWorkdir(postId);
+    if (!workdir) return { diff: "", changedFiles: [] };
+    return await readCommitDiff(this.core.target(), workdir, sha);
   }
   /** `targetOverride` carries the cross-mode lookup, so tabs resolve for cards
    *  this engine doesn't own - the crashed claude sessions users most need. */
@@ -15368,6 +17439,87 @@ var TerminalModeEngine = class {
       return [];
     }
   }
+  /** Pane pids for this card's tabs, keyed by tab id. The pane's own shell is
+   *  the root of everything the user started in that tab. */
+  async panePids(target, postId) {
+    const prefix = `terminal-${postId.replace(/[^a-zA-Z0-9._-]/g, "_")}-`;
+    const stdout = await target.sh(
+      `${tmuxCli(target)} list-panes -a -F '#{session_name}|#{pane_pid}' 2>/dev/null || true`
+    ).catch(() => "");
+    const panes = [];
+    for (const raw of stdout.split("\n")) {
+      const line = raw.trim();
+      if (!line.startsWith(prefix)) continue;
+      const rest = line.slice(prefix.length);
+      const sep = rest.indexOf("|");
+      if (sep === -1) continue;
+      const pid = Number(rest.slice(sep + 1));
+      if (!Number.isInteger(pid) || pid <= 0) continue;
+      panes.push({ tabId: rest.slice(0, sep), pid });
+    }
+    return panes;
+  }
+  async bareListProcesses({
+    postId: rawPostId
+  }) {
+    const postId = String(rawPostId);
+    const target = this.getBareTarget(postId);
+    const panes = await this.panePids(target, postId);
+    if (panes.length === 0) return [];
+    const table = parsePsTable(
+      await target.run(["ps", "-axo", PS_FORMAT]).catch(() => "")
+    );
+    const found = [];
+    for (const pane of panes) {
+      for (const row of processesForPane(table, pane.pid)) {
+        found.push({
+          pid: row.pid,
+          tabId: pane.tabId,
+          command: commandOf(row.args),
+          args: row.args,
+          cpu: row.cpu,
+          memoryKb: row.rssKb,
+          elapsed: row.elapsed,
+          ports: [],
+          connections: 0
+        });
+      }
+    }
+    if (found.length === 0) return [];
+    const sockets = await socketsFor(
+      target,
+      found.map((p) => p.pid)
+    );
+    for (const proc of found) {
+      const use = sockets.get(proc.pid);
+      proc.ports = use?.ports ?? [];
+      proc.connections = use?.connections ?? 0;
+    }
+    return found.sort(
+      (a, b) => (Number(a.tabId) || 0) - (Number(b.tabId) || 0) || a.pid - b.pid
+    );
+  }
+  async bareKillProcess({
+    postId: rawPostId,
+    pid
+  }) {
+    const postId = String(rawPostId);
+    const target = this.getBareTarget(postId);
+    if (!Number.isInteger(pid) || pid <= 1) {
+      throw new Error("Not a process this card can stop.");
+    }
+    const panes = await this.panePids(target, postId);
+    const table = parsePsTable(
+      await target.run(["ps", "-axo", PS_FORMAT]).catch(() => "")
+    );
+    const mine = panes.some(
+      (pane) => processesForPane(table, pane.pid).some((row) => row.pid === pid)
+    );
+    if (!mine) {
+      throw new Error("That process is not running in this card.");
+    }
+    await target.run(["kill", "-TERM", String(pid)]);
+  }
   // ── port forwarding (factiii-expose / factiii-unexpose) ──
   async bareExpose({
     postId,
@@ -15375,7 +17527,6 @@ var TerminalModeEngine = class {
     name
   }) {
     const target = this.getBareTarget(postId);
-    const session = this.sessions.get(String(postId));
     const safeName = name.trim();
     if (!/^[a-zA-Z0-9-]+$/.test(safeName)) {
       throw new Error("Name must be letters, numbers, or dashes.");
@@ -15388,30 +17539,28 @@ var TerminalModeEngine = class {
     if (!/^https?:\/\//.test(url2)) {
       throw new Error(out || "Failed to expose port.");
     }
-    const entry = { name: safeName, port, url: url2 };
-    session.exposed = session.exposed.filter((e) => e.name !== safeName);
-    session.exposed.push(entry);
-    return entry;
+    return { name: safeName, port, url: url2 };
   }
   async bareUnexpose({
     postId,
     name
   }) {
     const target = this.getBareTarget(postId);
-    const session = this.sessions.get(String(postId));
     const safeName = name.trim();
     if (!/^[a-zA-Z0-9-]+$/.test(safeName)) {
       throw new Error("Invalid tunnel name.");
     }
     await target.sh(`factiii-unexpose ${shEscape(safeName)} 2>&1 || true`);
-    session.exposed = session.exposed.filter((e) => e.name !== safeName);
   }
-  bareListExposed({
+  /** Derived, never remembered: `factiii-expose` is on the agent's PATH, so the
+   *  terminal and the agent both open tunnels without telling us, and a runner
+   *  restart would forget any list we kept. */
+  async bareListExposed({
     postId
   }) {
     const session = this.sessions.get(String(postId));
     if (!session || session.mode !== "bare") return [];
-    return session.exposed.slice();
+    return await listLiveTunnels(this.core.target());
   }
 };
 
@@ -15689,571 +17838,204 @@ var CodexLoginFlow = class {
       reject(new Error("Codex sign-in cancelled."));
     }
     await this.cleanup();
-  }
-  onData(chunk) {
-    this.output += this.strip(chunk.toString("utf-8"));
-    if (this.output.length > 2e5) {
-      this.output = this.output.slice(-1e5);
-    }
-    if (this.startResolver) {
-      const url2 = this.output.match(/https:\/\/[^\s\x00-\x1f]+/)?.[0];
-      const code = this.output.match(CODE_LINE_RE)?.[1] ?? this.output.match(CODE_TOKEN_RE)?.[1];
-      if (url2 && code) {
-        const resolve2 = this.startResolver;
-        this.startResolver = null;
-        this.startRejecter = null;
-        resolve2({ url: url2.replace(/[.,;)\]]+$/, ""), code });
-      }
-      return;
-    }
-    if (this.settled) return;
-    if (/success|logged in/i.test(this.output)) {
-      this.settled = true;
-      void this.verifyAndComplete("");
-    }
-  }
-  // Process ended (or success was printed): the auth.json on the cache volume
-  // is the ground truth for whether the sign-in worked.
-  async verifyAndComplete(failTail) {
-    const ok = await loginCredentialsExist("codex", this.target);
-    await this.cleanup();
-    this.onDone(
-      ok ? { status: "complete" } : {
-        status: "error",
-        message: failTail || "Codex sign-in ended without signing in."
-      }
-    );
-  }
-  async onClose() {
-    if (this.settled) return;
-    const tail2 = this.output.trim().slice(-300);
-    if (this.startRejecter) {
-      this.fail(tail2 || "Codex sign-in ended unexpectedly.");
-      return;
-    }
-    this.settled = true;
-    await this.verifyAndComplete(tail2);
-  }
-  fail(message) {
-    if (this.settled) return;
-    this.settled = true;
-    if (this.startRejecter) {
-      const reject = this.startRejecter;
-      this.startResolver = null;
-      this.startRejecter = null;
-      reject(new Error(message));
-      void this.cleanup();
-      return;
-    }
-    void this.cleanup();
-    this.onDone({ status: "error", message });
-  }
-  async cleanup() {
-    await stopLoginExec(this.target, "codex", this.spaceSlug);
-  }
-  reset() {
-    this.output = "";
-    this.strip = createAnsiStripper();
-    this.settled = false;
-    this.startResolver = null;
-    this.startRejecter = null;
-  }
-};
-
-// ../../shared/all/helpers/board-agent-core/github-auth.ts
-var DEVICE_CODE_URL = "https://github.com/login/device/code";
-var TOKEN_URL = "https://github.com/login/oauth/access_token";
-var API_BASE = "https://api.github.com";
-var GITHUB_SCOPES = "repo read:user user:email";
-var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
-async function startGithubDeviceCode(clientId) {
-  const res = await fetch(DEVICE_CODE_URL, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams({ client_id: clientId, scope: GITHUB_SCOPES })
-  });
-  if (!res.ok) {
-    throw new Error(`GitHub device-code start failed: ${await res.text()}`);
-  }
-  const data = await res.json();
-  if (data.error || !data.device_code || !data.user_code) {
-    throw new Error(
-      data.error_description || data.error || "GitHub returned no device code. Is device flow enabled on the OAuth App?"
-    );
-  }
-  return {
-    deviceCode: data.device_code,
-    userCode: data.user_code,
-    verificationUri: data.verification_uri || "https://github.com/login/device",
-    expiresIn: data.expires_in ?? 900,
-    interval: data.interval ?? 5
-  };
-}
-async function pollGithubDeviceCode(clientId, deviceCode) {
-  const res = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams({
-      client_id: clientId,
-      device_code: deviceCode,
-      grant_type: DEVICE_CODE_GRANT
-    })
-  });
-  const data = await res.json();
-  if (data.access_token) {
-    return { status: "complete", accessToken: data.access_token };
-  }
-  switch (data.error) {
-    case "authorization_pending":
-      return { status: "pending" };
-    case "slow_down":
-      return { status: "slow_down" };
-    case "expired_token":
-      return { status: "expired" };
-    case "access_denied":
-      return { status: "declined" };
-    default:
-      return {
-        status: "error",
-        message: data.error_description || data.error || "GitHub sign-in failed."
-      };
-  }
-}
-async function githubApi(token, path16) {
-  const res = await fetch(`${API_BASE}${path16}`, {
-    headers: {
-      Authorization: `Bearer ${token}`,
-      Accept: "application/vnd.github+json",
-      "X-GitHub-Api-Version": "2022-11-28"
-    }
-  });
-  if (!res.ok) {
-    throw new Error(
-      `GitHub ${path16} failed (${res.status}): ${await res.text()}`
-    );
-  }
-  return await res.json();
-}
-async function fetchGithubIdentity(token) {
-  const user = await githubApi(token, "/user");
-  let email = user.email ?? "";
-  if (!email) {
-    try {
-      const emails = await githubApi(token, "/user/emails");
-      email = emails.find((e) => e.primary && e.verified)?.email ?? emails.find((e) => e.verified)?.email ?? "";
-    } catch {
-    }
-  }
-  if (!email) email = `${user.id}+${user.login}@users.noreply.github.com`;
-  return { login: user.login, name: user.name || user.login, email };
-}
-async function listGithubRepos(token) {
-  const out = [];
-  for (let page = 1; page <= 3; page++) {
-    const batch = await githubApi(token, `/user/repos?per_page=100&sort=pushed&page=${page}`);
-    for (const r of batch) {
-      if (r.permissions && !r.permissions.push) continue;
-      out.push({
-        fullName: r.full_name,
-        // Strip any embedded credentials; buildCloneUrl adds the token.
-        cloneUrl: r.clone_url.replace(/\/\/[^@/]*@/, "//"),
-        defaultBranch: r.default_branch,
-        private: r.private
-      });
-    }
-    if (batch.length < 100) break;
-  }
-  return out;
-}
-async function listGithubBranches(token, fullName) {
-  const branches = await githubApi(
-    token,
-    `/repos/${fullName}/branches?per_page=100`
-  );
-  return branches.map((b) => b.name);
-}
-
-// ../../shared/all/helpers/board-agent-core/host-deploy.ts
-var import_child_process3 = require("child_process");
-var import_promises3 = __toESM(require("fs/promises"));
-var import_path5 = __toESM(require("path"));
-var import_util5 = require("util");
-var execFileAsync2 = (0, import_util5.promisify)(import_child_process3.execFile);
-var SKILL_DIR = ".agents/skills/deploy";
-var SKILL_PATH = `${SKILL_DIR}/SKILL.md`;
-var VARIABLES_PATH = `${SKILL_DIR}/required-variables.json`;
-var CHECKER_PATH = `${SKILL_DIR}/check-environment.sh`;
-var CLAUDE_SKILLS_DIR = ".claude/skills";
-var CLAUDE_LINK = `${CLAUDE_SKILLS_DIR}/deploy`;
-async function ensureClaudeSkillLink(workspace) {
-  const linkPath = import_path5.default.join(workspace, CLAUDE_LINK);
-  try {
-    await import_promises3.default.lstat(linkPath);
-    return;
-  } catch {
-  }
-  await import_promises3.default.mkdir(import_path5.default.join(workspace, CLAUDE_SKILLS_DIR), { recursive: true });
-  await import_promises3.default.symlink("../../.agents/skills/deploy", linkPath, "dir");
-}
-var GIT_NO_HELPER = ["-c", "credential.helper="];
-var GIT_ENV = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
-async function hostGit(cwd, ...args) {
-  const { stdout } = await execFileAsync2("git", [...GIT_NO_HELPER, ...args], {
-    cwd,
-    env: GIT_ENV,
-    maxBuffer: 16 * 1024 * 1024
-  });
-  return stdout;
-}
-async function checkDeployStatus(opts) {
-  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
-  const branch = (opts.mainBranch || "main").replace(/[^\w./-]/g, "");
-  const url2 = buildCloneUrl(opts.repoUrl, opts.githubToken);
-  let cloned = false;
-  try {
-    await hostGit(workspace, "rev-parse", "--git-dir");
-    await hostGit(workspace, "remote", "set-url", "origin", url2);
-  } catch {
-    await execFileAsync2(
-      "git",
-      [...GIT_NO_HELPER, "clone", "--branch", branch, url2, workspace],
-      { env: GIT_ENV }
-    );
-    cloned = true;
-  }
-  if (!cloned) await hostGit(workspace, "fetch", "origin", branch);
-  const has = async (refPath) => {
-    try {
-      await hostGit(workspace, "cat-file", "-e", refPath);
-      return true;
-    } catch {
-      return false;
+  }
+  onData(chunk) {
+    this.output += this.strip(chunk.toString("utf-8"));
+    if (this.output.length > 2e5) {
+      this.output = this.output.slice(-1e5);
     }
-  };
-  const hasAll = async (ref) => await has(`${ref}:${SKILL_PATH}`) && await has(`${ref}:${VARIABLES_PATH}`) && await has(`${ref}:${CHECKER_PATH}`);
-  let pendingBranch = "";
-  if (!await hasAll(`origin/${branch}`)) {
-    try {
-      await hostGit(
-        workspace,
-        "fetch",
-        "origin",
-        "+refs/heads/deploy-skill*:refs/remotes/origin/deploy-skill*"
-      );
-      const refs = await hostGit(
-        workspace,
-        "for-each-ref",
-        "--sort=-committerdate",
-        "--format=%(refname:short)",
-        "refs/remotes/origin/deploy-skill*"
-      );
-      for (const ref of refs.split("\n").filter(Boolean)) {
-        if (await hasAll(ref)) {
-          pendingBranch = ref.replace(/^origin\//, "");
-          break;
-        }
+    if (this.startResolver) {
+      const url2 = this.output.match(/https:\/\/[^\s\x00-\x1f]+/)?.[0];
+      const code = this.output.match(CODE_LINE_RE)?.[1] ?? this.output.match(CODE_TOKEN_RE)?.[1];
+      if (url2 && code) {
+        const resolve2 = this.startResolver;
+        this.startResolver = null;
+        this.startRejecter = null;
+        resolve2({ url: url2.replace(/[.,;)\]]+$/, ""), code });
       }
-    } catch {
+      return;
     }
-  }
-  const hasVariables = await has(`origin/${branch}:${VARIABLES_PATH}`);
-  let variables = [];
-  if (hasVariables) {
-    try {
-      const raw = await hostGit(
-        workspace,
-        "cat-file",
-        "-p",
-        `origin/${branch}:${VARIABLES_PATH}`
-      );
-      variables = external_exports.array(requiredVariableSchema).parse(JSON.parse(raw));
-    } catch {
+    if (this.settled) return;
+    if (/success|logged in/i.test(this.output)) {
+      this.settled = true;
+      void this.verifyAndComplete("");
     }
   }
-  return {
-    hasSkill: await has(`origin/${branch}:${SKILL_PATH}`),
-    hasVariables,
-    hasChecker: await has(`origin/${branch}:${CHECKER_PATH}`),
-    branch,
-    pendingBranch,
-    variables
-  };
-}
-var requiredVariableSchema = external_exports.object({
-  key: external_exports.string().min(1),
-  title: external_exports.string().catch(""),
-  description: external_exports.string().catch(""),
-  category: external_exports.string().catch("general"),
-  sensitive: external_exports.boolean().catch(true)
-});
-function spaceEnv(spaceDir) {
-  const paths = hostSpacePaths(spaceDir);
-  return {
-    WORKSPACE: paths.workspace,
-    BACKUPS_DIR: paths.backups,
-    BUILDS_DIR: paths.builds,
-    // No keychain credential helper and no interactive git prompts anywhere
-    // in the deploy surface (agent sessions + authorized commands): auth
-    // comes from the secrets store or the tokened URL, never the keychain.
-    GIT_TERMINAL_PROMPT: "0",
-    GIT_CONFIG_COUNT: "1",
-    GIT_CONFIG_KEY_0: "credential.helper",
-    GIT_CONFIG_VALUE_0: ""
-  };
-}
-async function readContract(workspace) {
-  const skill = await import_promises3.default.readFile(import_path5.default.join(workspace, SKILL_PATH), "utf-8").catch(() => {
-    throw new Error("The creator wrote no SKILL.md.");
-  });
-  const checker = await import_promises3.default.readFile(import_path5.default.join(workspace, CHECKER_PATH), "utf-8").catch(() => {
-    throw new Error("The creator wrote no check-environment.sh.");
-  });
-  try {
-    const raw = JSON.parse(
-      await import_promises3.default.readFile(import_path5.default.join(workspace, VARIABLES_PATH), "utf-8")
+  // Process ended (or success was printed): the auth.json on the cache volume
+  // is the ground truth for whether the sign-in worked.
+  async verifyAndComplete(failTail) {
+    const ok = await loginCredentialsExist("codex", this.target);
+    await this.cleanup();
+    this.onDone(
+      ok ? { status: "complete" } : {
+        status: "error",
+        message: failTail || "Codex sign-in ended without signing in."
+      }
     );
-    return {
-      skill,
-      checker,
-      variables: external_exports.array(requiredVariableSchema).parse(raw)
-    };
-  } catch {
-    throw new Error("The creator wrote no valid required-variables.json.");
-  }
-}
-async function generateDeploySkill(opts) {
-  const { instructions, sendLog } = opts;
-  if (!instructions.trim()) {
-    throw new Error("Describe your deployment process first.");
   }
-  const status = await checkDeployStatus(opts);
-  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
-  sendLog({
-    type: "system",
-    content: `Resetting workspace to origin/${status.branch}...`
-  });
-  await hostGit(
-    workspace,
-    "checkout",
-    "-B",
-    status.branch,
-    `origin/${status.branch}`
-  );
-  await hostGit(workspace, "clean", "-fd");
-  sendLog({
-    type: "system",
-    content: "Analyzing the repo and writing the deploy skill..."
-  });
-  const { result } = await spawnAgent(
-    opts.provider,
-    hostTarget(opts.spaceDir),
-    {
-      cwd: workspace,
-      prompt: buildPrompt(prompts_default.deployCreate, {
-        INSTRUCTIONS: instructions
-      }),
-      allowedTools: "Read,Grep,Glob,Bash,Edit,Write,WebSearch,WebFetch",
-      // auto: the per-action classifier blocks escalations/unrecognized-infra
-      // actions - a host session with no human reviewing each command should
-      // not run bypassPermissions. (Codex maps this to a workspace-write
-      // sandbox; see agent.ts.)
-      permissionMode: "auto",
-      model: "claude-opus-4-6",
-      includePartialMessages: true,
-      env: spaceEnv(opts.spaceDir),
-      callbacks: { onLog: (entry) => sendLog(entry) }
-    }
-  );
-  const { sessionId } = await result;
-  const draft = await readContract(workspace);
-  return { ...draft, sessionId };
-}
-async function reviseDeploySkill(opts) {
-  const { feedback, sendLog } = opts;
-  if (!feedback.trim()) throw new Error("Corrections are empty.");
-  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
-  sendLog({ type: "system", content: "Applying your corrections..." });
-  const { result } = await spawnAgent(
-    opts.provider,
-    hostTarget(opts.spaceDir),
-    {
-      cwd: workspace,
-      prompt: buildPrompt(prompts_default.deployCreateRevise, {
-        FEEDBACK: feedback
-      }),
-      allowedTools: "Read,Grep,Glob,Bash,Edit,Write,WebSearch,WebFetch",
-      permissionMode: "auto",
-      model: "claude-opus-4-6",
-      includePartialMessages: true,
-      resumeSessionId: opts.resumeSessionId || void 0,
-      env: spaceEnv(opts.spaceDir),
-      callbacks: { onLog: (entry) => sendLog(entry) }
+  async onClose() {
+    if (this.settled) return;
+    const tail2 = this.output.trim().slice(-300);
+    if (this.startRejecter) {
+      this.fail(tail2 || "Codex sign-in ended unexpectedly.");
+      return;
     }
-  );
-  const { sessionId } = await result;
-  const draft = await readContract(workspace);
-  return { ...draft, sessionId: sessionId || opts.resumeSessionId || "" };
-}
-async function loadSkillDraft(opts) {
-  const branch = opts.branch.replace(/[^\w./-]/g, "");
-  if (!branch.startsWith("deploy-skill")) {
-    throw new Error("Not a deploy-skill branch.");
+    this.settled = true;
+    await this.verifyAndComplete(tail2);
   }
-  await checkDeployStatus(opts);
-  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
-  await hostGit(
-    workspace,
-    "fetch",
-    "origin",
-    `+refs/heads/${branch}:refs/remotes/origin/${branch}`
-  );
-  await hostGit(workspace, "checkout", "-B", branch, `origin/${branch}`);
-  await hostGit(workspace, "clean", "-fd");
-  return readContract(workspace);
-}
-async function approveDeploySkill(opts) {
-  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
-  await readContract(workspace);
-  await ensureClaudeSkillLink(workspace);
-  if (opts.gitName)
-    await hostGit(workspace, "config", "user.name", opts.gitName);
-  if (opts.gitEmail)
-    await hostGit(workspace, "config", "user.email", opts.gitEmail);
-  if (opts.onBranch) {
-    const dirty = await hostGit(workspace, "status", "--porcelain");
-    if (dirty.trim()) {
-      await hostGit(workspace, "add", "-A");
-      await hostGit(workspace, "commit", "-m", "Revise deploy skill");
-      await hostGit(workspace, "push", "origin", opts.onBranch);
+  fail(message) {
+    if (this.settled) return;
+    this.settled = true;
+    if (this.startRejecter) {
+      const reject = this.startRejecter;
+      this.startResolver = null;
+      this.startRejecter = null;
+      reject(new Error(message));
+      void this.cleanup();
+      return;
     }
-    return { branch: opts.onBranch };
+    void this.cleanup();
+    this.onDone({ status: "error", message });
+  }
+  async cleanup() {
+    await stopLoginExec(this.target, "codex", this.spaceSlug);
+  }
+  reset() {
+    this.output = "";
+    this.strip = createAnsiStripper();
+    this.settled = false;
+    this.startResolver = null;
+    this.startRejecter = null;
+  }
+};
+
+// ../../shared/all/helpers/board-agent-core/github-auth.ts
+var DEVICE_CODE_URL = "https://github.com/login/device/code";
+var TOKEN_URL = "https://github.com/login/oauth/access_token";
+var API_BASE = "https://api.github.com";
+var GITHUB_SCOPES = "repo read:user user:email";
+var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+async function startGithubDeviceCode(clientId) {
+  const res = await fetch(DEVICE_CODE_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams({ client_id: clientId, scope: GITHUB_SCOPES })
+  });
+  if (!res.ok) {
+    throw new Error(`GitHub device-code start failed: ${await res.text()}`);
   }
-  let target = "deploy-skill";
-  try {
-    await hostGit(
-      workspace,
-      "ls-remote",
-      "--exit-code",
-      "--heads",
-      "origin",
-      target
+  const data = await res.json();
+  if (data.error || !data.device_code || !data.user_code) {
+    throw new Error(
+      data.error_description || data.error || "GitHub returned no device code. Is device flow enabled on the OAuth App?"
     );
-    const stamp = (/* @__PURE__ */ new Date()).toISOString().slice(0, 16).replace(/[-:]/g, "").replace("T", "-");
-    target = `${target}-${stamp}`;
-  } catch {
   }
-  await hostGit(workspace, "checkout", "-B", target);
-  await hostGit(workspace, "add", "-A");
-  await hostGit(workspace, "commit", "-m", "Add deploy skill");
-  await hostGit(workspace, "push", "origin", target);
-  return { branch: target };
+  return {
+    deviceCode: data.device_code,
+    userCode: data.user_code,
+    verificationUri: data.verification_uri || "https://github.com/login/device",
+    expiresIn: data.expires_in ?? 900,
+    interval: data.interval ?? 5
+  };
 }
-async function runEnvironmentCheck(opts) {
-  const status = await checkDeployStatus(opts);
-  if (!status.hasChecker) {
+async function pollGithubDeviceCode(clientId, deviceCode) {
+  const res = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams({
+      client_id: clientId,
+      device_code: deviceCode,
+      grant_type: DEVICE_CODE_GRANT
+    })
+  });
+  const data = await res.json();
+  if (data.access_token) {
+    return { status: "complete", accessToken: data.access_token };
+  }
+  switch (data.error) {
+    case "authorization_pending":
+      return { status: "pending" };
+    case "slow_down":
+      return { status: "slow_down" };
+    case "expired_token":
+      return { status: "expired" };
+    case "access_denied":
+      return { status: "declined" };
+    default:
+      return {
+        status: "error",
+        message: data.error_description || data.error || "GitHub sign-in failed."
+      };
+  }
+}
+async function githubApi(token, path17) {
+  const res = await fetch(`${API_BASE}${path17}`, {
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28"
+    }
+  });
+  if (!res.ok) {
     throw new Error(
-      "No environment checker on the default branch. Generate the deploy skill first."
+      `GitHub ${path17} failed (${res.status}): ${await res.text()}`
     );
   }
-  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
-  const script = await hostGit(
-    workspace,
-    "cat-file",
-    "-p",
-    `origin/${status.branch}:${CHECKER_PATH}`
-  );
-  const tmp = import_path5.default.join(opts.spaceDir, `.env-check.${process.pid}.sh`);
-  await import_promises3.default.writeFile(tmp, script, { mode: 448 });
-  let ok = true;
-  let output = "";
-  try {
-    const scriptArg = tmp.split(import_path5.default.sep).join("/");
-    const res = await execLogin(`bash ${JSON.stringify(scriptArg)}`, {
-      cwd: workspace,
-      env: { ...process.env, ...spaceEnv(opts.spaceDir) },
-      timeout: 12e4
-    });
-    output = res.output;
-    if (res.code !== 0) ok = false;
-  } finally {
-    await import_promises3.default.rm(tmp, { force: true });
-  }
-  const checks = [];
-  for (const line of output.split("\n")) {
-    const match = /^(OK|FAIL):\s*(.+)$/.exec(line.trim());
-    if (!match) continue;
-    const [, verdict, rest] = match;
-    const dash = rest.indexOf(" - ");
-    checks.push({
-      ok: verdict === "OK",
-      label: dash > 0 ? rest.slice(0, dash) : rest,
-      detail: dash > 0 ? rest.slice(dash + 3) : ""
-    });
-    if (verdict === "FAIL") ok = false;
+  return await res.json();
+}
+async function fetchGithubIdentity(token) {
+  const user = await githubApi(token, "/user");
+  let email = user.email ?? "";
+  if (!email) {
+    try {
+      const emails = await githubApi(token, "/user/emails");
+      email = emails.find((e) => e.primary && e.verified)?.email ?? emails.find((e) => e.verified)?.email ?? "";
+    } catch {
+    }
   }
-  return { ok, checks, output: output.trim().slice(-4e3) };
+  if (!email) email = `${user.id}+${user.login}@users.noreply.github.com`;
+  return { login: user.login, name: user.name || user.login, email };
 }
-async function fixEnvironment(opts) {
-  const { sendLog } = opts;
-  const before = await runEnvironmentCheck(opts);
-  if (before.ok) return before;
-  const status = await checkDeployStatus(opts);
-  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
-  const script = await hostGit(
-    workspace,
-    "cat-file",
-    "-p",
-    `origin/${status.branch}:${CHECKER_PATH}`
-  );
-  const failed = before.checks.filter((c) => !c.ok).map((c) => `- ${c.label}${c.detail ? ` (${c.detail})` : ""}`).join("\n");
-  sendLog({
-    type: "system",
-    content: "Setting this machine up to pass the environment check..."
-  });
-  const { result } = await spawnAgent(
-    opts.provider,
-    hostTarget(opts.spaceDir),
-    {
-      cwd: workspace,
-      prompt: buildPrompt(prompts_default.deployEnvFix, {
-        CHECKS: failed || before.output.slice(-2e3),
-        SCRIPT: script
-      }),
-      allowedTools: "Bash,Read,Grep,Glob,WebSearch,WebFetch",
-      // auto: installs are in-scope of the owner's explicit "fix environment"
-      // request; the classifier still blocks anything beyond it.
-      permissionMode: "auto",
-      model: "claude-opus-4-6",
-      includePartialMessages: true,
-      env: spaceEnv(opts.spaceDir),
-      callbacks: { onLog: (entry) => sendLog(entry) }
+async function listGithubRepos(token) {
+  const out = [];
+  for (let page = 1; page <= 3; page++) {
+    const batch = await githubApi(token, `/user/repos?per_page=100&sort=pushed&page=${page}`);
+    for (const r of batch) {
+      if (r.permissions && !r.permissions.push) continue;
+      out.push({
+        fullName: r.full_name,
+        // Strip any embedded credentials; buildCloneUrl adds the token.
+        cloneUrl: r.clone_url.replace(/\/\/[^@/]*@/, "//"),
+        defaultBranch: r.default_branch,
+        private: r.private
+      });
     }
-  );
-  await result;
-  sendLog({ type: "system", content: "Re-running the environment check..." });
-  return runEnvironmentCheck(opts);
+    if (batch.length < 100) break;
+  }
+  return out;
 }
-async function discardDeploySkill(opts) {
-  const workspace = import_path5.default.join(opts.spaceDir, "workspace");
-  await hostGit(workspace, "checkout", "--", ".").catch(() => null);
-  await hostGit(workspace, "clean", "-fd");
-  return { success: true };
+async function listGithubBranches(token, fullName) {
+  const branches = await githubApi(
+    token,
+    `/repos/${fullName}/branches?per_page=100`
+  );
+  return branches.map((b) => b.name);
 }
 
 // ../../shared/all/helpers/board-agent-core/host-run.ts
-var import_path7 = __toESM(require("path"));
+var import_path8 = __toESM(require("path"));
 
 // ../../shared/all/helpers/board-agent-core/host-secrets.ts
 var import_child_process4 = require("child_process");
 var import_crypto2 = __toESM(require("crypto"));
-var import_promises4 = __toESM(require("fs/promises"));
-var import_path6 = __toESM(require("path"));
+var import_promises5 = __toESM(require("fs/promises"));
+var import_path7 = __toESM(require("path"));
 var import_util6 = require("util");
 var execFileAsync3 = (0, import_util6.promisify)(import_child_process4.execFile);
 var IDENTITY_FILE = "age-identity.enc";
@@ -16286,7 +18068,7 @@ function deriveKey(password, salt) {
 }
 async function secretsInitialized(configDir) {
   try {
-    await import_promises4.default.access(import_path6.default.join(configDir, IDENTITY_FILE));
+    await import_promises5.default.access(import_path7.default.join(configDir, IDENTITY_FILE));
     return true;
   } catch {
     return false;
@@ -16325,10 +18107,10 @@ async function initSecrets(configDir, password) {
     tag: cipher.getAuthTag().toString("base64"),
     data: data.toString("base64")
   };
-  await import_promises4.default.writeFile(import_path6.default.join(configDir, IDENTITY_FILE), JSON.stringify(box), {
+  await import_promises5.default.writeFile(import_path7.default.join(configDir, IDENTITY_FILE), JSON.stringify(box), {
     mode: 384
   });
-  await import_promises4.default.writeFile(import_path6.default.join(configDir, RECIPIENT_FILE), `${recipient}
+  await import_promises5.default.writeFile(import_path7.default.join(configDir, RECIPIENT_FILE), `${recipient}
 `, {
     mode: 384
   });
@@ -16351,17 +18133,17 @@ function decryptIdentity(box, password) {
   }
 }
 function envPath(spaceDir) {
-  return import_path6.default.join(spaceDir, "secrets", ENV_FILE);
+  return import_path7.default.join(spaceDir, "secrets", ENV_FILE);
 }
 async function identityFor(configDir, password) {
   const box = JSON.parse(
-    await import_promises4.default.readFile(import_path6.default.join(configDir, IDENTITY_FILE), "utf-8")
+    await import_promises5.default.readFile(import_path7.default.join(configDir, IDENTITY_FILE), "utf-8")
   );
   return decryptIdentity(box, password);
 }
 async function readEnv(spaceDir, identity) {
   try {
-    await import_promises4.default.access(envPath(spaceDir));
+    await import_promises5.default.access(envPath(spaceDir));
   } catch {
     return {};
   }
@@ -16390,14 +18172,14 @@ async function readEnv(spaceDir, identity) {
   return values;
 }
 async function writeEnv(configDir, spaceDir, identity, values) {
-  const recipient = (await import_promises4.default.readFile(import_path6.default.join(configDir, RECIPIENT_FILE), "utf-8")).trim();
+  const recipient = (await import_promises5.default.readFile(import_path7.default.join(configDir, RECIPIENT_FILE), "utf-8")).trim();
   const plain = `${Object.entries(values).map(([k, v]) => `${k}=${v}`).join("\n")}
 `;
   const tmp = envPath(spaceDir).replace(
     /\.enc\.env$/,
     `.${process.pid}.tmp.env`
   );
-  await import_promises4.default.writeFile(tmp, plain, { mode: 384 });
+  await import_promises5.default.writeFile(tmp, plain, { mode: 384 });
   try {
     const { stdout } = await execFileAsync3(
       "sops",
@@ -16416,9 +18198,9 @@ async function writeEnv(configDir, spaceDir, identity, values) {
         maxBuffer: 4 * 1024 * 1024
       }
     );
-    await import_promises4.default.writeFile(envPath(spaceDir), stdout, { mode: 384 });
+    await import_promises5.default.writeFile(envPath(spaceDir), stdout, { mode: 384 });
   } finally {
-    await import_promises4.default.rm(tmp, { force: true });
+    await import_promises5.default.rm(tmp, { force: true });
   }
 }
 async function listSecretKeys(configDir, spaceDir, password) {
@@ -16484,8 +18266,8 @@ function tailMarker(text) {
 }
 async function startDeployRun(opts) {
   const { hooks } = opts;
-  const workspace = import_path7.default.join(opts.spaceDir, "workspace");
-  const configDir = import_path7.default.dirname(opts.spaceDir);
+  const workspace = import_path8.default.join(opts.spaceDir, "workspace");
+  const configDir = import_path8.default.dirname(opts.spaceDir);
   const status = await checkDeployStatus(opts);
   if (!status.hasSkill || !status.hasVariables || !status.hasChecker) {
     throw new Error(
@@ -17365,6 +19147,48 @@ var BoardAgentEngine = class _BoardAgentEngine {
       githubToken: config.githubToken
     });
   }
+  // ── Agent skills (SKILL.md) ──
+  // Repo opts are optional here, unlike deploy: the global roots are readable
+  // with no repo configured, and listSkills reports repoAvailable: false.
+  skillOpts() {
+    const config = this.core.readConfig();
+    return {
+      spaceDir: this.core.spaceDir(),
+      repoUrl: config.repoUrl,
+      mainBranch: config.mainBranch,
+      githubToken: config.githubToken
+    };
+  }
+  skillsList() {
+    return listSkills(this.skillOpts());
+  }
+  skillRead(payload) {
+    return readSkill({ ...this.skillOpts(), ...payload });
+  }
+  skillWriteGlobal(payload) {
+    return writeGlobalSkill(payload);
+  }
+  skillDeleteGlobal(payload) {
+    return deleteGlobalSkill(payload);
+  }
+  skillMigrate(payload) {
+    const config = this.core.readConfig();
+    return migrateSkills({
+      ...this.skillOpts(),
+      ...payload,
+      gitName: config.gitName,
+      gitEmail: config.gitEmail
+    });
+  }
+  skillProposeRepo(payload) {
+    const config = this.core.readConfig();
+    return proposeRepoSkill({
+      ...this.skillOpts(),
+      ...payload,
+      gitName: config.gitName,
+      gitEmail: config.gitEmail
+    });
+  }
   deployCreatorState() {
     return this.creatorState;
   }
@@ -17747,7 +19571,7 @@ var BoardAgentEngine = class _BoardAgentEngine {
   // ── Runner secrets store (secrets.sh contract; see host-secrets.ts) ──
   secretsDirs() {
     const spaceDir = this.core.spaceDir();
-    return { configDir: (0, import_path8.dirname)(spaceDir), spaceDir };
+    return { configDir: (0, import_path9.dirname)(spaceDir), spaceDir };
   }
   async deploySecretsStatus() {
     return {
@@ -18115,6 +19939,21 @@ var BoardAgentEngine = class _BoardAgentEngine {
   bareGitStatus(p) {
     return this.terminal.bareGitStatus(p);
   }
+  bareGitCommitDiff(p) {
+    return this.terminal.bareGitCommitDiff(p);
+  }
+  bareGitStage(p) {
+    return this.terminal.bareGitStage(p);
+  }
+  bareGitUnstage(p) {
+    return this.terminal.bareGitUnstage(p);
+  }
+  bareListProcesses(p) {
+    return this.terminal.bareListProcesses(p);
+  }
+  bareKillProcess(p) {
+    return this.terminal.bareKillProcess(p);
+  }
   bareListTerminals(p) {
     return this.terminal.bareListTerminals(
       p,
@@ -18537,6 +20376,28 @@ ${c.content.trim() || "(no description)"}`
         return await this.bareWorkNames();
       case "deployStatus":
         return await this.deployStatus();
+      case "skillsList":
+        return await this.skillsList();
+      case "skillRead":
+        return await this.skillRead(
+          payload
+        );
+      case "skillWriteGlobal":
+        return await this.skillWriteGlobal(
+          payload
+        );
+      case "skillDeleteGlobal":
+        return await this.skillDeleteGlobal(
+          payload
+        );
+      case "skillMigrate":
+        return await this.skillMigrate(
+          payload
+        );
+      case "skillProposeRepo":
+        return await this.skillProposeRepo(
+          payload
+        );
       case "deployCreateSkill":
         return await this.deployCreateSkill(
           payload,
@@ -18700,6 +20561,27 @@ ${c.content.trim() || "(no description)"}`
         return await this.bareGitStatus(
           payload
         );
+      case "bareGitCommitDiff":
+        return await this.bareGitCommitDiff(
+          payload
+        );
+      case "bareGitStage":
+        return await this.bareGitStage(
+          payload
+        );
+      case "bareGitUnstage":
+        return await this.bareGitUnstage(
+          payload
+        );
+      case "bareListProcesses":
+        return await this.bareListProcesses(
+          payload
+        );
+      case "bareKillProcess":
+        await this.bareKillProcess(
+          payload
+        );
+        return void 0;
       case "bareListTerminals":
         return await this.bareListTerminals(
           payload
@@ -18733,7 +20615,7 @@ ${c.content.trim() || "(no description)"}`
         );
         return void 0;
       case "bareListExposed":
-        return this.bareListExposed(
+        return await this.bareListExposed(
           payload
         );
       case "secureStatus":
@@ -18748,9 +20630,9 @@ ${c.content.trim() || "(no description)"}`
 var import_child_process5 = require("child_process");
 var import_crypto3 = require("crypto");
 var import_fs3 = require("fs");
-var import_promises5 = __toESM(require("fs/promises"));
+var import_promises6 = __toESM(require("fs/promises"));
 var import_net2 = require("net");
-var import_path9 = require("path");
+var import_path10 = require("path");
 var import_util7 = require("util");
 var execFileAsync4 = (0, import_util7.promisify)(import_child_process5.execFile);
 var IndexService = class {
@@ -18809,7 +20691,7 @@ var IndexService = class {
     const log = await this.openLog();
     this.proc = (0, import_child_process5.spawn)(
       process.execPath,
-      [(0, import_path9.join)(this.opts.indexDir, "index.js")],
+      [(0, import_path10.join)(this.opts.indexDir, "index.js")],
       {
         cwd: this.opts.indexDir,
         env: {
@@ -18837,8 +20719,8 @@ var IndexService = class {
    *  opened (a missing log must never stop the service from starting). */
   async openLog() {
     try {
-      await import_promises5.default.mkdir(this.opts.dataDir, { recursive: true });
-      return (0, import_fs3.openSync)((0, import_path9.join)(this.opts.dataDir, "index.log"), "a");
+      await import_promises6.default.mkdir(this.opts.dataDir, { recursive: true });
+      return (0, import_fs3.openSync)((0, import_path10.join)(this.opts.dataDir, "index.log"), "a");
     } catch {
       return null;
     }
@@ -18847,10 +20729,10 @@ var IndexService = class {
    *  platform needing node-gyp fails here rather than at query time. */
   async installDeps() {
     const dir = this.opts.indexDir;
-    if ((0, import_fs3.existsSync)((0, import_path9.join)(dir, "node_modules"))) return;
-    await import_promises5.default.copyFile(
-      (0, import_path9.join)(dir, "image-package.json"),
-      (0, import_path9.join)(dir, "package.json")
+    if ((0, import_fs3.existsSync)((0, import_path10.join)(dir, "node_modules"))) return;
+    await import_promises6.default.copyFile(
+      (0, import_path10.join)(dir, "image-package.json"),
+      (0, import_path10.join)(dir, "package.json")
     );
     await execFileAsync4(
       "npm",
@@ -18862,15 +20744,15 @@ var IndexService = class {
    *  CLIs' persistent MCP config, so a fresh port each start would leave every
    *  registration pointing at a dead one. */
   async stablePort() {
-    const file = (0, import_path9.join)(this.opts.dataDir, ".port");
-    const saved = Number(await import_promises5.default.readFile(file, "utf-8").catch(() => ""));
+    const file = (0, import_path10.join)(this.opts.dataDir, ".port");
+    const saved = Number(await import_promises6.default.readFile(file, "utf-8").catch(() => ""));
     if (Number.isInteger(saved) && saved > 0 && await isFree(saved)) {
       return saved;
     }
     const port = await freePort();
-    await import_promises5.default.mkdir(this.opts.dataDir, { recursive: true }).catch(() => {
+    await import_promises6.default.mkdir(this.opts.dataDir, { recursive: true }).catch(() => {
     });
-    await import_promises5.default.writeFile(file, String(port), "utf-8").catch(() => {
+    await import_promises6.default.writeFile(file, String(port), "utf-8").catch(() => {
     });
     return port;
   }
@@ -19038,24 +20920,24 @@ async function pairWithBrowser(serverUrl) {
 
 // src/config.ts
 var import_fs7 = __toESM(require("fs"));
-var import_os4 = __toESM(require("os"));
-var import_path14 = __toESM(require("path"));
+var import_os5 = __toESM(require("os"));
+var import_path15 = __toESM(require("path"));
 
 // src/secureFile.ts
 var import_crypto6 = __toESM(require("crypto"));
 var import_fs6 = __toESM(require("fs"));
-var import_path13 = __toESM(require("path"));
+var import_path14 = __toESM(require("path"));
 
 // src/keychain.ts
 var import_child_process7 = require("child_process");
 var import_crypto4 = __toESM(require("crypto"));
 var import_fs4 = __toESM(require("fs"));
-var import_os2 = __toESM(require("os"));
-var import_path10 = __toESM(require("path"));
+var import_os3 = __toESM(require("os"));
+var import_path11 = __toESM(require("path"));
 var SERVICE = "factiii-runner";
 var ACCOUNT = "config-encryption-key";
-var DPAPI_KEY_FILE = import_path10.default.join(
-  import_os2.default.homedir(),
+var DPAPI_KEY_FILE = import_path11.default.join(
+  import_os3.default.homedir(),
   ".factiii-runner",
   "config-key.dpapi"
 );
@@ -19160,7 +21042,7 @@ function winWrite(key) {
     "-Command",
     `ConvertTo-SecureString -String '${key.toString("base64")}' -AsPlainText -Force | ConvertFrom-SecureString`
   ]);
-  import_fs4.default.mkdirSync(import_path10.default.dirname(DPAPI_KEY_FILE), { recursive: true });
+  import_fs4.default.mkdirSync(import_path11.default.dirname(DPAPI_KEY_FILE), { recursive: true });
   import_fs4.default.writeFileSync(DPAPI_KEY_FILE, `${out.trim()}
 `, { mode: 384 });
 }
@@ -19324,21 +21206,21 @@ function keychainStatus() {
 // src/secureStore.ts
 var import_crypto5 = __toESM(require("crypto"));
 var import_fs5 = __toESM(require("fs"));
-var import_path12 = __toESM(require("path"));
+var import_path13 = __toESM(require("path"));
 
 // src/paths.ts
-var import_os3 = __toESM(require("os"));
-var import_path11 = __toESM(require("path"));
-var CONFIG_DIR = import_path11.default.join(import_os3.default.homedir(), ".factiii-runner");
+var import_os4 = __toESM(require("os"));
+var import_path12 = __toESM(require("path"));
+var CONFIG_DIR = import_path12.default.join(import_os4.default.homedir(), ".factiii-runner");
 function safeSlug(spaceSlug) {
   return spaceSlug.replace(/[^a-zA-Z0-9_.-]/g, "_");
 }
 function spaceDirPath(spaceSlug) {
-  return import_path11.default.join(CONFIG_DIR, safeSlug(spaceSlug));
+  return import_path12.default.join(CONFIG_DIR, safeSlug(spaceSlug));
 }
 
 // src/secureStore.ts
-var VAULT_KEY_FILE = import_path12.default.join(CONFIG_DIR, "vault-key.json");
+var VAULT_KEY_FILE = import_path13.default.join(CONFIG_DIR, "vault-key.json");
 var SCRYPT_N2 = 1 << 15;
 var MIN_PASSWORD_LENGTH = 8;
 var SecureStoreError = class extends Error {
@@ -19660,7 +21542,7 @@ function parseEnvelope(raw) {
   }
 }
 function atomicWrite(filePath, body) {
-  import_fs6.default.mkdirSync(import_path13.default.dirname(filePath), { recursive: true });
+  import_fs6.default.mkdirSync(import_path14.default.dirname(filePath), { recursive: true });
   const tmp = `${filePath}.${process.pid}.tmp`;
   import_fs6.default.writeFileSync(tmp, body, { mode: 384 });
   import_fs6.default.renameSync(tmp, filePath);
@@ -19775,8 +21657,8 @@ function writeBootJson(filePath, value2) {
 }
 
 // src/config.ts
-var CONFIG_DIR2 = import_path14.default.join(import_os4.default.homedir(), ".factiii-runner");
-var CONFIG_FILE = import_path14.default.join(CONFIG_DIR2, "config.json");
+var CONFIG_DIR2 = import_path15.default.join(import_os5.default.homedir(), ".factiii-runner");
+var CONFIG_FILE = import_path15.default.join(CONFIG_DIR2, "config.json");
 function readRunnerConfig() {
   return readBootJson(CONFIG_FILE);
 }
@@ -19948,7 +21830,7 @@ function makeChunkReassembler() {
 var import_crypto7 = require("crypto");
 var import_fs9 = __toESM(require("fs"));
 var import_node_datachannel = require("node-datachannel");
-var import_path16 = __toESM(require("path"));
+var import_path17 = __toESM(require("path"));
 
 // ../../node_modules/engine.io-client/build/esm-debug/transports/polling-xhr.node.js
 var XMLHttpRequestModule = __toESM(require_XMLHttpRequest(), 1);
@@ -21128,12 +23010,12 @@ function parse2(str) {
   uri.queryKey = queryKey(uri, uri["query"]);
   return uri;
 }
-function pathNames(obj, path16) {
-  const regx = /\/{2,9}/g, names = path16.replace(regx, "/").split("/");
-  if (path16.slice(0, 1) == "/" || path16.length === 0) {
+function pathNames(obj, path17) {
+  const regx = /\/{2,9}/g, names = path17.replace(regx, "/").split("/");
+  if (path17.slice(0, 1) == "/" || path17.length === 0) {
     names.splice(0, 1);
   }
-  if (path16.slice(-1) == "/") {
+  if (path17.slice(-1) == "/") {
     names.splice(names.length - 1, 1);
   }
   return names;
@@ -21752,7 +23634,7 @@ var protocol2 = Socket.protocol;
 // ../../node_modules/socket.io-client/build/esm-debug/url.js
 var import_debug7 = __toESM(require_src(), 1);
 var debug7 = (0, import_debug7.default)("socket.io-client:url");
-function url(uri, path16 = "", loc) {
+function url(uri, path17 = "", loc) {
   let obj = uri;
   loc = loc || typeof location !== "undefined" && location;
   if (null == uri)
@@ -21786,7 +23668,7 @@ function url(uri, path16 = "", loc) {
   obj.path = obj.path || "/";
   const ipv6 = obj.host.indexOf(":") !== -1;
   const host = ipv6 ? "[" + obj.host + "]" : obj.host;
-  obj.id = obj.protocol + "://" + host + ":" + obj.port + path16;
+  obj.id = obj.protocol + "://" + host + ":" + obj.port + path17;
   obj.href = obj.protocol + "://" + host + (loc && loc.port === obj.port ? "" : ":" + obj.port);
   return obj;
 }
@@ -23420,8 +25302,8 @@ function lookup(uri, opts) {
   const parsed = url(uri, opts.path || "/socket.io");
   const source = parsed.source;
   const id = parsed.id;
-  const path16 = parsed.path;
-  const sameNamespace = cache[id] && path16 in cache[id]["nsps"];
+  const path17 = parsed.path;
+  const sameNamespace = cache[id] && path17 in cache[id]["nsps"];
   const newConnection = opts.forceNew || opts["force new connection"] || false === opts.multiplex || sameNamespace;
   let io;
   if (newConnection) {
@@ -23463,8 +25345,8 @@ function cardContextPath(target, postId) {
   const safe = postId.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80) || "card";
   return `${target.paths.root}/.cards/${safe}.md`;
 }
-function cardContextPrompt(path16) {
-  return `Read ${path16} - it is the Factiii card this session was opened from. Use it as the context and start working on it.`;
+function cardContextPrompt(path17) {
+  return `Read ${path17} - it is the Factiii card this session was opened from. Use it as the context and start working on it.`;
 }
 var CLAUDE_PERMISSION_MODE = `--permission-mode auto`;
 var RESUME_SEED = "You are now in an interactive terminal, not the board UI. Respond in plain text and use your normal tools; do not use openui-lang or component schemas anymore.";
@@ -23629,10 +25511,10 @@ var TerminalManager = class {
 
 // src/agent-adapter.ts
 var import_fs8 = __toESM(require("fs"));
-var import_path15 = __toESM(require("path"));
-var RUNNER_CONFIG_PATH = import_path15.default.join(CONFIG_DIR, "runner-config.json");
+var import_path16 = __toESM(require("path"));
+var RUNNER_CONFIG_PATH = import_path16.default.join(CONFIG_DIR, "runner-config.json");
 function connectionPath(spaceSlug) {
-  return import_path15.default.join(CONFIG_DIR, `space-${safeSlug(spaceSlug)}.onedrive.json`);
+  return import_path16.default.join(CONFIG_DIR, `space-${safeSlug(spaceSlug)}.onedrive.json`);
 }
 function writeJson(filePath, value2) {
   writeSecureJson(filePath, value2);
@@ -23666,7 +25548,7 @@ function migrateLegacyConfigs() {
   for (const name of legacy) {
     const slug = name.slice("space-".length, -".json".length);
     const parsed = readSecureJson(
-      import_path15.default.join(CONFIG_DIR, name)
+      import_path16.default.join(CONFIG_DIR, name)
     );
     if (!parsed) continue;
     if (!file.defaultSlug) {
@@ -23691,7 +25573,7 @@ function encryptStrayPlaintextConfigs() {
     return;
   }
   for (const name of names) {
-    const filePath = import_path15.default.join(CONFIG_DIR, name);
+    const filePath = import_path16.default.join(CONFIG_DIR, name);
     try {
       const raw = import_fs8.default.readFileSync(filePath, "utf-8");
       if (!raw.startsWith("{")) continue;
@@ -23820,7 +25702,7 @@ var localConfigProvider = {
       "claude",
       "codex"
     ]) {
-      import_fs8.default.mkdirSync(import_path15.default.join(dir, sub), { recursive: true });
+      import_fs8.default.mkdirSync(import_path16.default.join(dir, sub), { recursive: true });
     }
     return dir;
   }
@@ -23842,6 +25724,7 @@ function toRtcIceServers(servers) {
         continue;
       }
       const [, scheme, hostname, port, transport] = turn;
+      if (scheme === "turns" || transport === "tcp") continue;
       out.push({
         hostname,
         port: Number(port ?? (scheme === "turns" ? 5349 : 3478)),
@@ -23993,15 +25876,15 @@ async function startDaemon(config) {
     }
   );
   const indexCandidates = [
-    import_path16.default.join(__dirname, "..", "index"),
-    import_path16.default.join(__dirname, "..", "..", "index", "image")
+    import_path17.default.join(__dirname, "..", "index"),
+    import_path17.default.join(__dirname, "..", "..", "index", "image")
   ];
   const indexDir = indexCandidates.find((p) => import_fs9.default.existsSync(p)) ?? indexCandidates[0];
   const odIndex = new IndexService({
     controlToken: (0, import_crypto7.createHash)("sha256").update(config.authToken).digest("hex"),
     embedUrl: () => config.serverUrl,
     indexDir,
-    dataDir: import_path16.default.join(CONFIG_DIR, "index-data")
+    dataDir: import_path17.default.join(CONFIG_DIR, "index-data")
   });
   void odIndex.ensureRunning().catch((err) => {
     console.error(
@@ -24151,9 +26034,37 @@ async function startDaemon(config) {
         ).join(", ")}`
       );
       const peer = new import_node_datachannel.PeerConnection("runner", { iceServers });
+      const view = {
+        local: /* @__PURE__ */ new Set(),
+        remote: /* @__PURE__ */ new Set(),
+        relays: 0,
+        gathering: "new",
+        ice: "new"
+      };
+      const candidateType = (candidate) => /\btyp (\w+)/.exec(candidate)?.[1] ?? "unknown";
+      let reported = false;
+      const report = (outcome) => {
+        if (reported || !data.linkId) return;
+        reported = true;
+        socket.emit("runnerLinkReport", {
+          linkId: data.linkId,
+          peerSocketId: data.fromSocketId,
+          outcome,
+          detail: [
+            `ice=${view.ice} gathering=${view.gathering} relays=${view.relays}`,
+            `local=${[...view.local].join(",") || "none"}`,
+            `remote=${[...view.remote].join(",") || "none"}`,
+            // Hostname and port only — the credential never leaves the runner.
+            `turn=${iceServers.map(
+              (u) => typeof u === "string" ? u : `${u.relayType}:${u.hostname}:${u.port}`
+            ).join(" ")}`
+          ].join("\n")
+        });
+      };
       const iceCandidateHandler = (msg) => {
         if (msg.fromSocketId === data.fromSocketId) {
           console.log(`[webrtc] remote ICE candidate: ${msg.candidate.candidate.slice(0, 60)}...`);
+          view.remote.add(candidateType(msg.candidate.candidate));
           peer.addRemoteCandidate(
             msg.candidate.candidate,
             msg.candidate.sdpMid || ""
@@ -24169,18 +26080,31 @@ async function startDaemon(config) {
       };
       peer.onStateChange((state) => {
         console.log(`[webrtc] peer state: ${state}`);
+        view.ice = state;
+        if (state === "connected") report("connected");
         if (state === "failed" || state === "closed" || state === "disconnected") {
+          if (state === "failed") report("failed");
           detachIceHandler();
         }
       });
       peer.onGatheringStateChange((state) => {
         console.log(`[webrtc] gathering state: ${state}`);
+        view.gathering = state;
       });
       peer.onLocalCandidate((candidate, mid) => {
         console.log(`[webrtc] local ICE candidate: ${candidate.slice(0, 60)}...`);
+        const type = candidateType(candidate);
+        view.local.add(type);
+        if (type === "relay") view.relays += 1;
         socket.emit("runnerIceCandidate", {
           targetSocketId: data.fromSocketId,
-          candidate: { candidate, sdpMid: mid, sdpMLineIndex: null }
+          // 0 rather than null. A browser accepts a null index, but a mobile
+          // client on the New Architecture passes this straight into codegen'd
+          // JSI bindings that type-check it as a number, and null throws there —
+          // rejecting every candidate we send and stranding the link at
+          // checking. sdpMid identifies the m-line on its own, so the index is
+          // redundant here anyway.
+          candidate: { candidate, sdpMid: mid, sdpMLineIndex: 0 }
         });
       });
       peer.onLocalDescription((sdp, _type) => {